# nw-3527.sys-nw-3733.sys Diff
# TOC
* [Visual Chart Diff](#visual-chart-diff)
* [Metadata](#metadata)
* [Ghidra Diff Engine](#ghidra-diff-engine)
* [Command Line](#command-line)
* [Binary Metadata Diff](#binary-metadata-diff)
* [Program Options](#program-options)
* [Diff Stats](#diff-stats)
* [Strings](#strings)
* [Deleted](#deleted)
* [wil_details_RegisterFeatureStagingChangeNotification](#wil_details_registerfeaturestagingchangenotification)
* [Added](#added)
* [Dot11CheckSelectiveTranslationTable](#dot11checkselectivetranslationtable)
* [Feature_1281542463__private_IsEnabledDeviceUsage](#feature_1281542463__private_isenableddeviceusage)
* [Feature_1281542463__private_IsEnabledFallback](#feature_1281542463__private_isenabledfallback)
* [wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath](#wil_details_featurestatecache_tryenabledeviceusagefastpath)
* [wil_details_IsEnabledFallback](#wil_details_isenabledfallback)
* [Feature_Servicing_WFAQuickTrackCertRSNIE__private_IsEnabledFallback](#feature_servicing_wfaquicktrackcertrsnie__private_isenabledfallback)
* [Feature_Servicing_WlanihvextSetIGTKAndBIGTK__private_IsEnabledFallback](#feature_servicing_wlanihvextsetigtkandbigtk__private_isenabledfallback)
* [Modified](#modified)
* [wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState](#wil_details_evaluatefeaturedependencies_getcachedfeatureenabledstate)
* [wil_details_FeatureReporting_ReportUsageToServiceDirect](#wil_details_featurereporting_reportusagetoservicedirect)
* [wil_details_EvaluateFeatureDependencies](#wil_details_evaluatefeaturedependencies)
* [Dot11Translate80211ToEthernetNdisPacket](#dot11translate80211toethernetndispacket)
* [wil_details_GetCurrentFeatureEnabledState](#wil_details_getcurrentfeatureenabledstate)
* [wil_details_FeatureReporting_ReportUsageToService](#wil_details_featurereporting_reportusagetoservice)
* [wil_details_PopulateInitialConfiguredFeatureStates](#wil_details_populateinitialconfiguredfeaturestates)
* [wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState](#wil_details_evaluatefeaturedependencies_reevaluatecachedfeatureenabledstate)
* [wil_InitializeFeatureStaging](#wil_initializefeaturestaging)
* [wil_details_BuildFeatureStateCacheFromQueryResults](#wil_details_buildfeaturestatecachefromqueryresults)
* [wil_details_FeatureReporting_RecordUsageInCache](#wil_details_featurereporting_recordusageincache)
* [Feature_Servicing_WlanihvextSetIGTKAndBIGTK__private_IsEnabled](#feature_servicing_wlanihvextsetigtkandbigtk__private_isenabled)
* [wil_details_FeatureStateCache_GetCachedFeatureEnabledState](#wil_details_featurestatecache_getcachedfeatureenabledstate)
* [Feature_Servicing_WFAQuickTrackCertRSNIE__private_IsEnabled](#feature_servicing_wfaquicktrackcertrsnie__private_isenabled)
* [Modified (No Code Changes)](#modified-no-code-changes)
# Visual Chart Diff
```mermaid
flowchart LR
wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState-2-old<--Match 85%-->wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState-2-new
wil_details_FeatureReporting_ReportUsageToServiceDirect-5-old<--Match 87%-->wil_details_FeatureReporting_ReportUsageToServiceDirect-5-new
wil_details_EvaluateFeatureDependencies-0-old<--Match 96%-->wil_details_EvaluateFeatureDependencies-0-new
Dot11Translate80211ToEthernetNdisPacket-3-old<--Match 27%-->Dot11Translate80211ToEthernetNdisPacket-3-new
wil_details_GetCurrentFeatureEnabledState-2-old<--Match 90%-->wil_details_GetCurrentFeatureEnabledState-2-new
wil_details_FeatureReporting_ReportUsageToService-6-old<--Match 96%-->wil_details_FeatureReporting_ReportUsageToService-6-new
wil_details_PopulateInitialConfiguredFeatureStates-0-old<--Match 95%-->wil_details_PopulateInitialConfiguredFeatureStates-0-new
wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState-3-old<--Match 79%-->wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState-3-new
wil_InitializeFeatureStaging-0-old<--Match 53%-->wil_InitializeFeatureStaging-0-new
wil_details_BuildFeatureStateCacheFromQueryResults-3-old<--Match 85%-->wil_details_BuildFeatureStateCacheFromQueryResults-3-new
wil_details_FeatureReporting_RecordUsageInCache-3-old<--Match 82%-->wil_details_FeatureReporting_RecordUsageInCache-3-new
Feature_Servicing_WlanihvextSetIGTKAndBIGTK__private_IsEnabled-0-old<--Match 32%-->Feature_Servicing_WlanihvextSetIGTKAndBIGTK__private_IsEnabledDeviceUsage-0-new
wil_details_FeatureStateCache_GetCachedFeatureEnabledState-2-old<--Match 28%-->wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState-2-new
Feature_Servicing_WFAQuickTrackCertRSNIE__private_IsEnabled-0-old<--Match 32%-->Feature_Servicing_WFAQuickTrackCertRSNIE__private_IsEnabledDeviceUsage-0-new
subgraph nw-3733.sys
wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState-2-new
wil_details_FeatureReporting_ReportUsageToServiceDirect-5-new
wil_details_EvaluateFeatureDependencies-0-new
Dot11Translate80211ToEthernetNdisPacket-3-new
wil_details_GetCurrentFeatureEnabledState-2-new
wil_details_FeatureReporting_ReportUsageToService-6-new
wil_details_PopulateInitialConfiguredFeatureStates-0-new
wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState-3-new
wil_InitializeFeatureStaging-0-new
wil_details_BuildFeatureStateCacheFromQueryResults-3-new
wil_details_FeatureReporting_RecordUsageInCache-3-new
Feature_Servicing_WlanihvextSetIGTKAndBIGTK__private_IsEnabledDeviceUsage-0-new
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState-2-new
Feature_Servicing_WFAQuickTrackCertRSNIE__private_IsEnabledDeviceUsage-0-new
subgraph Added
direction LR
Dot11CheckSelectiveTranslationTable
Feature_1281542463__private_IsEnabledDeviceUsage
Feature_1281542463__private_IsEnabledFallback
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath
wil_details_IsEnabledFallback
Feature_Servicing_WFAQuickTrackCertRSNIE__private_IsEnabledFallback
Feature_Servicing_WlanihvextSetIGTKAndBIGTK__private_IsEnabledFallback
end
end
subgraph nw-3527.sys
wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState-2-old
wil_details_FeatureReporting_ReportUsageToServiceDirect-5-old
wil_details_EvaluateFeatureDependencies-0-old
Dot11Translate80211ToEthernetNdisPacket-3-old
wil_details_GetCurrentFeatureEnabledState-2-old
wil_details_FeatureReporting_ReportUsageToService-6-old
wil_details_PopulateInitialConfiguredFeatureStates-0-old
wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState-3-old
wil_InitializeFeatureStaging-0-old
wil_details_BuildFeatureStateCacheFromQueryResults-3-old
wil_details_FeatureReporting_RecordUsageInCache-3-old
Feature_Servicing_WlanihvextSetIGTKAndBIGTK__private_IsEnabled-0-old
wil_details_FeatureStateCache_GetCachedFeatureEnabledState-2-old
Feature_Servicing_WFAQuickTrackCertRSNIE__private_IsEnabled-0-old
subgraph Deleted
direction LR
wil_details_RegisterFeatureStagingChangeNotification
end
end
```
```mermaid
pie showData
title Function Matches - 99.7635%
"unmatched_funcs_len" : 8
"matched_funcs_len" : 3375
```
```mermaid
pie showData
title Matched Function Similarity - 99.5556%
"matched_funcs_with_code_changes_len" : 14
"matched_funcs_with_non_code_changes_len" : 1
"matched_funcs_no_changes_len" : 3360
```
# Metadata
## Ghidra Diff Engine
### Command Line
#### Captured Command Line
```
ghidriff --project-location ./proj --project-name nw-30078 --symbols-path symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --bsim --max-ram-percent 60.0 --max-section-funcs 200 nw-3527.sys nw-3733.sys
```
#### Verbose Args
```
--old ['nw-3527.sys'] --new [['nw-3733.sys']] --engine VersionTrackingDiff --output-path ./out --summary False --project-location ./proj --project-name nw-30078 --symbols-path symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim True --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title None
```
#### Download Original PEs
```
wget https://msdl.microsoft.com/download/symbols/NWiFi.SYS/C2D7A4C7BA000/NWiFi.SYS -O nwifi.sys.x64.10.0.22621.3640
wget https://msdl.microsoft.com/download/symbols/NWiFi.SYS/15D53548BA000/NWiFi.SYS -O nwifi.sys.x64.10.0.22621.3790
```
## Binary Metadata Diff
```diff
--- nw-3527.sys Meta
+++ nw-3733.sys Meta
@@ -1,44 +1,44 @@
-Program Name: nw-3527.sys
+Program Name: nw-3733.sys
Language ID: x86:LE:64:default (4.6)
Compiler ID: windows
Processor: x86
Endian: Little
Address Size: 64
Minimum Address: 1c0000000
Maximum Address: ff0000184f
-# of Bytes: 764784
+# of Bytes: 764752
# of Memory Blocks: 13
-# of Instructions: 136634
-# of Defined Data: 3179
-# of Functions: 1689
-# of Symbols: 16705
+# of Instructions: 136732
+# of Defined Data: 3195
+# of Functions: 1694
+# of Symbols: 16728
# of Data Types: 2089
# of Data Type Categories: 145
Analyzed: true
Compiler: visualstudio:unknown
Created With Ghidra Version: 12.0.4
-Date Created: Sun Aug 16 15:05:40 SGT 2026
+Date Created: Sun Aug 16 15:05:44 SGT 2026
Executable Format: Portable Executable (PE)
-Executable Location: /sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/ghidriff/nwifi-30078/nw-3527.sys
-Executable MD5: 4f4e31314b561a6ded131b36820047c7
-Executable SHA256: 91c6281add525124de76e3cdf13c3ede455979eb9408c46ef51ff9af14bab4d9
-FSRL: file:///sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/ghidriff/nwifi-30078/nw-3527.sys?MD5=4f4e31314b561a6ded131b36820047c7
+Executable Location: /sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/ghidriff/nwifi-30078/nw-3733.sys
+Executable MD5: c913fc914e297554d37cb93e22296f7a
+Executable SHA256: b856587cf18c8417dec6a4ed56024e759015d6b093aea4dd603bb460f9663a37
+FSRL: file:///sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/ghidriff/nwifi-30078/nw-3733.sys?MD5=c913fc914e297554d37cb93e22296f7a
PDB Age: 1
PDB File: nwifi.pdb
-PDB GUID: eced7bfe-66e4-80e3-7a4f-2fd283a30d59
+PDB GUID: afbbddbc-329d-f930-c905-f91a05567120
PDB Loaded: true
PDB Version: RSDS
PE Property[CompanyName]: Microsoft Corporation
PE Property[FileDescription]: NativeWiFi Miniport Driver
-PE Property[FileVersion]: 10.0.22621.3640 (WinBuild.160101.0800)
+PE Property[FileVersion]: 10.0.22621.3790 (WinBuild.160101.0800)
PE Property[InternalName]: NWiFi.SYS
PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved.
PE Property[OriginalFilename]: NWiFi.SYS
PE Property[ProductName]: Microsoft® Windows® Operating System
-PE Property[ProductVersion]: 10.0.22621.3640
+PE Property[ProductVersion]: 10.0.22621.3790
PE Property[Translation]: 4b00409
Preferred Root Namespace Category:
RTTI Found: false
Relocatable: true
SectionAlignment: 4096
Should Ask To Analyze: false
```
## Program Options
Ghidra nw-3527.sys Decompiler Options
|Decompiler Option|Value|
| :---: | :---: |
|Prototype Evaluation|__fastcall|
Ghidra nw-3527.sys Specification extensions Options
|Specification extensions Option|Value|
| :---: | :---: |
|FormatVersion|0|
|VersionCounter|0|
Ghidra nw-3527.sys Analyzers Options
|Analyzers Option|Value|
| :---: | :---: |
|ASCII Strings|true|
|ASCII Strings.Create Strings Containing Existing Strings|true|
|ASCII Strings.Create Strings Containing References|true|
|ASCII Strings.Force Model Reload|false|
|ASCII Strings.Minimum String Length|LEN_5|
|ASCII Strings.Model File|StringModel.sng|
|ASCII Strings.Require Null Termination for String|true|
|ASCII Strings.Search Only in Accessible Memory Blocks|true|
|ASCII Strings.String Start Alignment|ALIGN_1|
|ASCII Strings.String end alignment|4|
|Aggressive Instruction Finder|false|
|Aggressive Instruction Finder.Create Analysis Bookmarks|true|
|Apply Data Archives|true|
|Apply Data Archives.Archive Chooser|[Auto-Detect]|
|Apply Data Archives.Create Analysis Bookmarks|true|
|Apply Data Archives.GDT User File Archive Path|None|
|Apply Data Archives.User Project Archive Path|None|
|Call Convention ID|true|
|Call Convention ID.Analysis Decompiler Timeout (sec)|60|
|Call-Fixup Installer|true|
|Condense Filler Bytes|false|
|Condense Filler Bytes.Filler Value|Auto|
|Condense Filler Bytes.Minimum number of sequential bytes|1|
|Create Address Tables|true|
|Create Address Tables.Allow Offcut References|false|
|Create Address Tables.Auto Label Table|false|
|Create Address Tables.Create Analysis Bookmarks|true|
|Create Address Tables.Maxmimum Pointer Distance|16777215|
|Create Address Tables.Minimum Pointer Address|4132|
|Create Address Tables.Minimum Table Size|2|
|Create Address Tables.Pointer Alignment|1|
|Create Address Tables.Relocation Table Guide|true|
|Create Address Tables.Table Alignment|4|
|Data Reference|true|
|Data Reference.Address Table Alignment|1|
|Data Reference.Address Table Minimum Size|2|
|Data Reference.Align End of Strings|false|
|Data Reference.Ascii String References|true|
|Data Reference.Create Address Tables|true|
|Data Reference.Minimum String Length|5|
|Data Reference.References to Pointers|true|
|Data Reference.Relocation Table Guide|true|
|Data Reference.Respect Execute Flag|true|
|Data Reference.Subroutine References|true|
|Data Reference.Switch Table References|false|
|Data Reference.Unicode String References|true|
|Decompiler Parameter ID|true|
|Decompiler Parameter ID.Analysis Clear Level|ANALYSIS|
|Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60|
|Decompiler Parameter ID.Commit Data Types|true|
|Decompiler Parameter ID.Commit Void Return Values|false|
|Decompiler Parameter ID.Prototype Evaluation|__fastcall|
|Decompiler Switch Analysis|true|
|Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60|
|Demangler Microsoft|true|
|Demangler Microsoft.Apply Function Calling Conventions|true|
|Demangler Microsoft.Apply Function Signatures|true|
|Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS|
|Demangler Microsoft.Demangle Only Known Mangled Symbols|false|
|Disassemble Entry Points|true|
|Disassemble Entry Points.Respect Execute Flag|true|
|Embedded Media|true|
|Embedded Media.Create Analysis Bookmarks|true|
|External Entry References|true|
|Function ID|true|
|Function ID.Always Apply FID Labels|false|
|Function ID.Create Analysis Bookmarks|true|
|Function ID.Instruction Count Threshold|14.6|
|Function ID.Multiple Match Threshold|30.0|
|Function Start Search|true|
|Function Start Search.Bookmark Functions|false|
|Function Start Search.Search Data Blocks|false|
|Non-Returning Functions - Discovered|true|
|Non-Returning Functions - Discovered.Create Analysis Bookmarks|true|
|Non-Returning Functions - Discovered.Function Non-return Threshold|3|
|Non-Returning Functions - Discovered.Repair Flow Damage|true|
|Non-Returning Functions - Known|true|
|Non-Returning Functions - Known.Create Analysis Bookmarks|true|
|PDB MSDIA|false|
|PDB MSDIA.Search untrusted symbol servers|false|
|PDB Universal|true|
|PDB Universal.Import Source Line Info|true|
|PDB Universal.Search untrusted symbol servers|false|
|Reference|true|
|Reference.Address Table Alignment|1|
|Reference.Address Table Minimum Size|2|
|Reference.Align End of Strings|false|
|Reference.Ascii String References|true|
|Reference.Create Address Tables|true|
|Reference.Minimum String Length|5|
|Reference.References to Pointers|true|
|Reference.Relocation Table Guide|true|
|Reference.Respect Execute Flag|true|
|Reference.Subroutine References|true|
|Reference.Switch Table References|false|
|Reference.Unicode String References|true|
|Scalar Operand References|true|
|Scalar Operand References.Relocation Table Guide|true|
|Shared Return Calls|true|
|Shared Return Calls.Allow Conditional Jumps|false|
|Shared Return Calls.Assume Contiguous Functions Only|true|
|Stack|true|
|Stack.Create Local Variables|true|
|Stack.Create Param Variables|false|
|Stack.Max Threads|2|
|Subroutine References|true|
|Subroutine References.Create Thunks Early|true|
|Variadic Function Signature Override|false|
|Variadic Function Signature Override.Create Analysis Bookmarks|false|
|Windows x86 PE Exception Handling|true|
|Windows x86 PE RTTI Analyzer|true|
|Windows x86 Thread Environment Block (TEB) Analyzer|true|
|Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB||
|Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7|
|WindowsPE x86 Propagate External Parameters|false|
|WindowsResourceReference|true|
|WindowsResourceReference.Create Analysis Bookmarks|true|
|x86 Constant Reference Analyzer|true|
|x86 Constant Reference Analyzer.Create Data from pointer|false|
|x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true|
|x86 Constant Reference Analyzer.Max Threads|2|
|x86 Constant Reference Analyzer.Min absolute reference|4|
|x86 Constant Reference Analyzer.Require pointer param data type|false|
|x86 Constant Reference Analyzer.Speculative reference max|256|
|x86 Constant Reference Analyzer.Speculative reference min|1024|
|x86 Constant Reference Analyzer.Stored Value Pointer analysis|true|
|x86 Constant Reference Analyzer.Trust values read from writable memory|true|
Ghidra nw-3733.sys Decompiler Options
|Decompiler Option|Value|
| :---: | :---: |
|Prototype Evaluation|__fastcall|
Ghidra nw-3733.sys Specification extensions Options
|Specification extensions Option|Value|
| :---: | :---: |
|FormatVersion|0|
|VersionCounter|0|
Ghidra nw-3733.sys Analyzers Options
|Analyzers Option|Value|
| :---: | :---: |
|ASCII Strings|true|
|ASCII Strings.Create Strings Containing Existing Strings|true|
|ASCII Strings.Create Strings Containing References|true|
|ASCII Strings.Force Model Reload|false|
|ASCII Strings.Minimum String Length|LEN_5|
|ASCII Strings.Model File|StringModel.sng|
|ASCII Strings.Require Null Termination for String|true|
|ASCII Strings.Search Only in Accessible Memory Blocks|true|
|ASCII Strings.String Start Alignment|ALIGN_1|
|ASCII Strings.String end alignment|4|
|Aggressive Instruction Finder|false|
|Aggressive Instruction Finder.Create Analysis Bookmarks|true|
|Apply Data Archives|true|
|Apply Data Archives.Archive Chooser|[Auto-Detect]|
|Apply Data Archives.Create Analysis Bookmarks|true|
|Apply Data Archives.GDT User File Archive Path|None|
|Apply Data Archives.User Project Archive Path|None|
|Call Convention ID|true|
|Call Convention ID.Analysis Decompiler Timeout (sec)|60|
|Call-Fixup Installer|true|
|Condense Filler Bytes|false|
|Condense Filler Bytes.Filler Value|Auto|
|Condense Filler Bytes.Minimum number of sequential bytes|1|
|Create Address Tables|true|
|Create Address Tables.Allow Offcut References|false|
|Create Address Tables.Auto Label Table|false|
|Create Address Tables.Create Analysis Bookmarks|true|
|Create Address Tables.Maxmimum Pointer Distance|16777215|
|Create Address Tables.Minimum Pointer Address|4132|
|Create Address Tables.Minimum Table Size|2|
|Create Address Tables.Pointer Alignment|1|
|Create Address Tables.Relocation Table Guide|true|
|Create Address Tables.Table Alignment|4|
|Data Reference|true|
|Data Reference.Address Table Alignment|1|
|Data Reference.Address Table Minimum Size|2|
|Data Reference.Align End of Strings|false|
|Data Reference.Ascii String References|true|
|Data Reference.Create Address Tables|true|
|Data Reference.Minimum String Length|5|
|Data Reference.References to Pointers|true|
|Data Reference.Relocation Table Guide|true|
|Data Reference.Respect Execute Flag|true|
|Data Reference.Subroutine References|true|
|Data Reference.Switch Table References|false|
|Data Reference.Unicode String References|true|
|Decompiler Parameter ID|true|
|Decompiler Parameter ID.Analysis Clear Level|ANALYSIS|
|Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60|
|Decompiler Parameter ID.Commit Data Types|true|
|Decompiler Parameter ID.Commit Void Return Values|false|
|Decompiler Parameter ID.Prototype Evaluation|__fastcall|
|Decompiler Switch Analysis|true|
|Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60|
|Demangler Microsoft|true|
|Demangler Microsoft.Apply Function Calling Conventions|true|
|Demangler Microsoft.Apply Function Signatures|true|
|Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS|
|Demangler Microsoft.Demangle Only Known Mangled Symbols|false|
|Disassemble Entry Points|true|
|Disassemble Entry Points.Respect Execute Flag|true|
|Embedded Media|true|
|Embedded Media.Create Analysis Bookmarks|true|
|External Entry References|true|
|Function ID|true|
|Function ID.Always Apply FID Labels|false|
|Function ID.Create Analysis Bookmarks|true|
|Function ID.Instruction Count Threshold|14.6|
|Function ID.Multiple Match Threshold|30.0|
|Function Start Search|true|
|Function Start Search.Bookmark Functions|false|
|Function Start Search.Search Data Blocks|false|
|Non-Returning Functions - Discovered|true|
|Non-Returning Functions - Discovered.Create Analysis Bookmarks|true|
|Non-Returning Functions - Discovered.Function Non-return Threshold|3|
|Non-Returning Functions - Discovered.Repair Flow Damage|true|
|Non-Returning Functions - Known|true|
|Non-Returning Functions - Known.Create Analysis Bookmarks|true|
|PDB MSDIA|false|
|PDB MSDIA.Search untrusted symbol servers|false|
|PDB Universal|true|
|PDB Universal.Import Source Line Info|true|
|PDB Universal.Search untrusted symbol servers|false|
|Reference|true|
|Reference.Address Table Alignment|1|
|Reference.Address Table Minimum Size|2|
|Reference.Align End of Strings|false|
|Reference.Ascii String References|true|
|Reference.Create Address Tables|true|
|Reference.Minimum String Length|5|
|Reference.References to Pointers|true|
|Reference.Relocation Table Guide|true|
|Reference.Respect Execute Flag|true|
|Reference.Subroutine References|true|
|Reference.Switch Table References|false|
|Reference.Unicode String References|true|
|Scalar Operand References|true|
|Scalar Operand References.Relocation Table Guide|true|
|Shared Return Calls|true|
|Shared Return Calls.Allow Conditional Jumps|false|
|Shared Return Calls.Assume Contiguous Functions Only|true|
|Stack|true|
|Stack.Create Local Variables|true|
|Stack.Create Param Variables|false|
|Stack.Max Threads|2|
|Subroutine References|true|
|Subroutine References.Create Thunks Early|true|
|Variadic Function Signature Override|false|
|Variadic Function Signature Override.Create Analysis Bookmarks|false|
|Windows x86 PE Exception Handling|true|
|Windows x86 PE RTTI Analyzer|true|
|Windows x86 Thread Environment Block (TEB) Analyzer|true|
|Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB||
|Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7|
|WindowsPE x86 Propagate External Parameters|false|
|WindowsResourceReference|true|
|WindowsResourceReference.Create Analysis Bookmarks|true|
|x86 Constant Reference Analyzer|true|
|x86 Constant Reference Analyzer.Create Data from pointer|false|
|x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true|
|x86 Constant Reference Analyzer.Max Threads|2|
|x86 Constant Reference Analyzer.Min absolute reference|4|
|x86 Constant Reference Analyzer.Require pointer param data type|false|
|x86 Constant Reference Analyzer.Speculative reference max|256|
|x86 Constant Reference Analyzer.Speculative reference min|1024|
|x86 Constant Reference Analyzer.Stored Value Pointer analysis|true|
|x86 Constant Reference Analyzer.Trust values read from writable memory|true|
## Diff Stats
|Stat|Value|
| :---: | :---: |
|added_funcs_len|7|
|deleted_funcs_len|1|
|modified_funcs_len|15|
|added_symbols_len|5|
|deleted_symbols_len|2|
|diff_time|6.986245155334473|
|deleted_strings_len|0|
|added_strings_len|0|
|match_types|Counter({'SymbolsHash': 1677, 'ExternalsName': 168, 'ExactInstructionsFunctionHasher': 6, 'Implied Match': 3, 'ExactBytesFunctionHasher': 2})|
|items_to_process|30|
|diff_types|Counter({'code': 14, 'length': 14, 'address': 13, 'sig': 8, 'called': 6, 'calling': 4, 'refcount': 4, 'name': 3, 'fullname': 3})|
|unmatched_funcs_len|8|
|total_funcs_len|3383|
|matched_funcs_len|3375|
|matched_funcs_with_code_changes_len|14|
|matched_funcs_with_non_code_changes_len|1|
|matched_funcs_no_changes_len|3360|
|match_func_similarity_percent|99.5556%|
|func_match_overall_percent|99.7635%|
|first_matches|Counter({'SymbolsHash': 1677, 'ExactInstructionsFunctionHasher': 6, 'Implied Match': 3, 'ExactBytesFunctionHasher': 2})|
```mermaid
pie showData
title All Matches
"SymbolsHash" : 1677
"ExternalsName" : 168
"ExactBytesFunctionHasher" : 2
"ExactInstructionsFunctionHasher" : 6
"Implied-Match" : 3
```
```mermaid
pie showData
title First Matches
"SymbolsHash" : 1677
"ExactBytesFunctionHasher" : 2
"ExactInstructionsFunctionHasher" : 6
"Implied-Match" : 3
```
```mermaid
pie showData
title Diff Stats
"added_funcs_len" : 7
"deleted_funcs_len" : 1
"modified_funcs_len" : 15
```
```mermaid
pie showData
title Symbols
"added_symbols_len" : 5
"deleted_symbols_len" : 2
```
## Strings
*No string differences found*
# Deleted
## wil_details_RegisterFeatureStagingChangeNotification
### Function Meta
|Key|nw-3527.sys|
| :---: | :---: |
|name|wil_details_RegisterFeatureStagingChangeNotification|
|fullname|wil_details_RegisterFeatureStagingChangeNotification|
|refcount|2|
|length|93|
|called|NTOSKRNL.EXE::RtlRegisterFeatureConfigurationChangeNotification
wil_details_FeatureDescriptors_SkipPadding|
|calling|wil_InitializeFeatureStaging|
|paramcount|0|
|address|1c00a202c|
|sig|undefined __fastcall wil_details_RegisterFeatureStagingChangeNotification(void)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- wil_details_RegisterFeatureStagingChangeNotification
+++ wil_details_RegisterFeatureStagingChangeNotification
@@ -1,28 +0,0 @@
-
-void wil_details_RegisterFeatureStagingChangeNotification(void)
-
-{
- int iVar1;
- longlong *plVar2;
- undefined **ppuVar3;
-
- ppuVar3 = &wil_details_featureDescriptors_a;
- while( true ) {
- plVar2 = wil_details_FeatureDescriptors_SkipPadding((longlong *)ppuVar3);
- if (plVar2 == (longlong *)0x0) {
- return;
- }
- if (((*(char *)((longlong)plVar2 + 0x15) == '\0') &&
- (*(char *)((longlong)plVar2 + 0x16) == '\0')) &&
- (*(char *)((longlong)plVar2 + 0x14) == '\0')) break;
- ppuVar3 = (undefined **)(plVar2 + 6);
- }
- iVar1 = RtlRegisterFeatureConfigurationChangeNotification
- (wil_details_OnFeatureConfigurationChange,0);
- if (iVar1 == 0) {
- return;
- }
- wil_details_featureChangeNotification = 0;
- return;
-}
-
```
# Added
## Dot11CheckSelectiveTranslationTable
### Function Meta
|Key|nw-3733.sys|
| :---: | :---: |
|name|Dot11CheckSelectiveTranslationTable|
|fullname|Dot11CheckSelectiveTranslationTable|
|refcount|2|
|length|111|
|called|_guard_dispatch_icall|
|calling|Dot11Translate80211ToEthernetNdisPacket|
|paramcount|2|
|address|1c0005950|
|sig|bool __fastcall Dot11CheckSelectiveTranslationTable(longlong param_1, short param_2)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- Dot11CheckSelectiveTranslationTable
+++ Dot11CheckSelectiveTranslationTable
@@ -0,0 +1,26 @@
+
+/* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */
+
+bool Dot11CheckSelectiveTranslationTable(longlong param_1,short param_2)
+
+{
+ code *pcVar1;
+ int iVar2;
+ ulonglong uVar3;
+
+ if (((*(longlong *)(param_1 + 0x98) != 0) &&
+ (pcVar1 = *(code **)(*(longlong *)(param_1 + 0x98) + 0xa8), pcVar1 != (code *)0x0)) &&
+ (iVar2 = (*pcVar1)(*(undefined8 *)(param_1 + 0x1c18)), iVar2 != 0)) {
+ return iVar2 == 2;
+ }
+ uVar3 = 0;
+ while( true ) {
+ if (1 < (uint)uVar3) {
+ return false;
+ }
+ if (param_2 == (&gSelectiveTranslationTable)[uVar3]) break;
+ uVar3 = (ulonglong)((uint)uVar3 + 1);
+ }
+ return true;
+}
+
```
## Feature_1281542463__private_IsEnabledDeviceUsage
### Function Meta
|Key|nw-3733.sys|
| :---: | :---: |
|name|Feature_1281542463__private_IsEnabledDeviceUsage|
|fullname|Feature_1281542463__private_IsEnabledDeviceUsage|
|refcount|2|
|length|49|
|called|Feature_1281542463__private_IsEnabledFallback|
|calling|Dot11Translate80211ToEthernetNdisPacket|
|paramcount|0|
|address|1c0020c38|
|sig|ulonglong __fastcall Feature_1281542463__private_IsEnabledDeviceUsage(void)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- Feature_1281542463__private_IsEnabledDeviceUsage
+++ Feature_1281542463__private_IsEnabledDeviceUsage
@@ -0,0 +1,17 @@
+
+ulonglong Feature_1281542463__private_IsEnabledDeviceUsage(void)
+
+{
+ ulonglong uVar1;
+ undefined8 local_res8;
+
+ local_res8 = (ulonglong)Feature_1281542463__private_featureState;
+ if ((Feature_1281542463__private_featureState & 0x10) == 0) {
+ uVar1 = Feature_1281542463__private_IsEnabledFallback(local_res8,3);
+ }
+ else {
+ uVar1 = (ulonglong)(Feature_1281542463__private_featureState & 1);
+ }
+ return uVar1;
+}
+
```
## Feature_1281542463__private_IsEnabledFallback
### Function Meta
|Key|nw-3733.sys|
| :---: | :---: |
|name|Feature_1281542463__private_IsEnabledFallback|
|fullname|Feature_1281542463__private_IsEnabledFallback|
|refcount|2|
|length|21|
|called|wil_details_IsEnabledFallback|
|calling|Feature_1281542463__private_IsEnabledDeviceUsage|
|paramcount|2|
|address|1c0020c70|
|sig|undefined __fastcall Feature_1281542463__private_IsEnabledFallback(ulonglong param_1, int param_2)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- Feature_1281542463__private_IsEnabledFallback
+++ Feature_1281542463__private_IsEnabledFallback
@@ -0,0 +1,8 @@
+
+void Feature_1281542463__private_IsEnabledFallback(ulonglong param_1,int param_2)
+
+{
+ wil_details_IsEnabledFallback(param_1,param_2,&Feature_1281542463__private_descriptor);
+ return;
+}
+
```
## wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath
### Function Meta
|Key|nw-3733.sys|
| :---: | :---: |
|name|wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath|
|fullname|wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath|
|refcount|2|
|length|74|
|called||
|calling|wil_details_IsEnabledFallback|
|paramcount|3|
|address|1c002125c|
|sig|undefined __fastcall wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath(uint param_1, int param_2, undefined8 * param_3)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath
+++ wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath
@@ -0,0 +1,50 @@
+
+void wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath
+ (uint param_1,int param_2,undefined8 *param_3)
+
+{
+ uint uVar1;
+ uint *puVar2;
+ uint uVar3;
+ uint uVar4;
+ bool bVar5;
+
+ puVar2 = (uint *)*param_3;
+ if (param_2 == 3) {
+ uVar4 = 0x10;
+ }
+ else {
+ if (param_2 != 4) {
+ return;
+ }
+ uVar4 = 0x20;
+ }
+ if ((*(char *)((longlong)param_3 + 0x1e) == '\0') && (*(char *)((longlong)param_3 + 0x1d) == '\0')
+ ) {
+ uVar3 = *puVar2;
+ do {
+ if ((uVar3 & 2) == 0) {
+ return;
+ }
+ if (((uVar3 ^ param_1) & 1) != 0) {
+ return;
+ }
+ LOCK();
+ uVar1 = *puVar2;
+ bVar5 = uVar3 == uVar1;
+ if (bVar5) {
+ *puVar2 = uVar3 | uVar4;
+ uVar1 = uVar3;
+ }
+ uVar3 = uVar1;
+ UNLOCK();
+ } while (!bVar5);
+ }
+ else {
+ LOCK();
+ *puVar2 = *puVar2 | uVar4;
+ UNLOCK();
+ }
+ return;
+}
+
```
## wil_details_IsEnabledFallback
### Function Meta
|Key|nw-3733.sys|
| :---: | :---: |
|name|wil_details_IsEnabledFallback|
|fullname|wil_details_IsEnabledFallback|
|refcount|4|
|length|140|
|called|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath|
|calling|Feature_1281542463__private_IsEnabledFallback
Feature_Servicing_WFAQuickTrackCertRSNIE__private_IsEnabledFallback
Feature_Servicing_WlanihvextSetIGTKAndBIGTK__private_IsEnabledFallback|
|paramcount|3|
|address|1c002140c|
|sig|uint __fastcall wil_details_IsEnabledFallback(ulonglong param_1, int param_2, undefined8 * param_3)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- wil_details_IsEnabledFallback
+++ wil_details_IsEnabledFallback
@@ -0,0 +1,22 @@
+
+uint wil_details_IsEnabledFallback(ulonglong param_1,int param_2,undefined8 *param_3)
+
+{
+ uint uVar1;
+ ulonglong local_res8;
+
+ uVar1 = (uint)param_1;
+ local_res8 = param_1 & 0xffffffff;
+ if ((param_1 & 2) == 0) {
+ local_res8 = wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
+ ((uint *)*param_3,param_1,(longlong)param_3);
+ uVar1 = (uint)local_res8;
+ }
+ if ((param_2 != 0) &&
+ (wil_details_FeatureReporting_ReportUsageToService((longlong)param_3,local_res8,param_2),
+ param_2 - 3U < 2)) {
+ wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath((uint)local_res8,param_2,param_3);
+ }
+ return uVar1 & 1;
+}
+
```
## Feature_Servicing_WFAQuickTrackCertRSNIE__private_IsEnabledFallback
### Function Meta
|Key|nw-3733.sys|
| :---: | :---: |
|name|Feature_Servicing_WFAQuickTrackCertRSNIE__private_IsEnabledFallback|
|fullname|Feature_Servicing_WFAQuickTrackCertRSNIE__private_IsEnabledFallback|
|refcount|2|
|length|21|
|called|wil_details_IsEnabledFallback|
|calling|Feature_Servicing_WFAQuickTrackCertRSNIE__private_IsEnabledDeviceUsage|
|paramcount|2|
|address|1c002a6d8|
|sig|undefined __fastcall Feature_Servicing_WFAQuickTrackCertRSNIE__private_IsEnabledFallback(ulonglong param_1, int param_2)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- Feature_Servicing_WFAQuickTrackCertRSNIE__private_IsEnabledFallback
+++ Feature_Servicing_WFAQuickTrackCertRSNIE__private_IsEnabledFallback
@@ -0,0 +1,10 @@
+
+void Feature_Servicing_WFAQuickTrackCertRSNIE__private_IsEnabledFallback
+ (ulonglong param_1,int param_2)
+
+{
+ wil_details_IsEnabledFallback
+ (param_1,param_2,&Feature_Servicing_WFAQuickTrackCertRSNIE__private_descriptor);
+ return;
+}
+
```
## Feature_Servicing_WlanihvextSetIGTKAndBIGTK__private_IsEnabledFallback
### Function Meta
|Key|nw-3733.sys|
| :---: | :---: |
|name|Feature_Servicing_WlanihvextSetIGTKAndBIGTK__private_IsEnabledFallback|
|fullname|Feature_Servicing_WlanihvextSetIGTKAndBIGTK__private_IsEnabledFallback|
|refcount|2|
|length|21|
|called|wil_details_IsEnabledFallback|
|calling|Feature_Servicing_WlanihvextSetIGTKAndBIGTK__private_IsEnabledDeviceUsage|
|paramcount|2|
|address|1c00590c8|
|sig|undefined __fastcall Feature_Servicing_WlanihvextSetIGTKAndBIGTK__private_IsEnabledFallback(ulonglong param_1, int param_2)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- Feature_Servicing_WlanihvextSetIGTKAndBIGTK__private_IsEnabledFallback
+++ Feature_Servicing_WlanihvextSetIGTKAndBIGTK__private_IsEnabledFallback
@@ -0,0 +1,10 @@
+
+void Feature_Servicing_WlanihvextSetIGTKAndBIGTK__private_IsEnabledFallback
+ (ulonglong param_1,int param_2)
+
+{
+ wil_details_IsEnabledFallback
+ (param_1,param_2,&Feature_Servicing_WlanihvextSetIGTKAndBIGTK__private_descriptor);
+ return;
+}
+
```
# Modified
*Modified functions contain code changes*
## wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState
### Match Info
|Key|nw-3527.sys - nw-3733.sys|
| :---: | :---: |
|diff_type|code,length,address|
|ratio|0.91|
|i_ratio|0.69|
|m_ratio|1.0|
|b_ratio|0.85|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|nw-3527.sys|nw-3733.sys|
| :---: | :---: | :---: |
|name|wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState|wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState|
|fullname|wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState|wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState|
|refcount|3|3|
|`length`|45|47|
|called|wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState|wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState|
|calling|wil_details_EvaluateFeatureDependencies
wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState|wil_details_EvaluateFeatureDependencies
wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState|
|paramcount|2|2|
|`address`|1c00a1f1c|1c00a1fe8|
|sig|uint __fastcall wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState(uint * param_1, longlong param_2)|uint __fastcall wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState(uint * param_1, longlong param_2)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState Diff
```diff
--- wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState
+++ wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState
@@ -1,15 +1,15 @@
uint wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState
(uint *param_1,longlong param_2)
{
uint uVar1;
uVar1 = *param_1;
- if ((char)uVar1 < '\0') {
+ if ((uVar1 >> 9 & 1) != 0) {
uVar1 = wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState
(param_1,uVar1,param_2);
}
return uVar1;
}
```
## wil_details_FeatureReporting_ReportUsageToServiceDirect
### Match Info
|Key|nw-3527.sys - nw-3733.sys|
| :---: | :---: |
|diff_type|code,length,sig,address|
|ratio|0.84|
|i_ratio|0.41|
|m_ratio|0.98|
|b_ratio|0.87|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|nw-3527.sys|nw-3733.sys|
| :---: | :---: | :---: |
|name|wil_details_FeatureReporting_ReportUsageToServiceDirect|wil_details_FeatureReporting_ReportUsageToServiceDirect|
|fullname|wil_details_FeatureReporting_ReportUsageToServiceDirect|wil_details_FeatureReporting_ReportUsageToServiceDirect|
|refcount|2|2|
|`length`|237|233|
|called|NTOSKRNL.EXE::RtlNotifyFeatureUsage
__security_check_cookie
_guard_dispatch_icall
wil_details_FeatureReporting_RecordUsageInCache|NTOSKRNL.EXE::RtlNotifyFeatureUsage
__security_check_cookie
_guard_dispatch_icall
wil_details_FeatureReporting_RecordUsageInCache|
|calling|wil_details_FeatureReporting_ReportUsageToService|wil_details_FeatureReporting_ReportUsageToService|
|paramcount|5|3|
|`address`|1c0032548|1c002106c|
|`sig`|bool __fastcall wil_details_FeatureReporting_ReportUsageToServiceDirect(uint * param_1, undefined4 param_2, int param_3, int param_4, uint param_5)|bool __fastcall wil_details_FeatureReporting_ReportUsageToServiceDirect(longlong param_1, undefined8 param_2, ulonglong param_3)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### wil_details_FeatureReporting_ReportUsageToServiceDirect Diff
```diff
--- wil_details_FeatureReporting_ReportUsageToServiceDirect
+++ wil_details_FeatureReporting_ReportUsageToServiceDirect
@@ -1,44 +1,46 @@
/* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */
/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
bool wil_details_FeatureReporting_ReportUsageToServiceDirect
- (uint *param_1,undefined4 param_2,int param_3,int param_4,uint param_5)
+ (longlong param_1,undefined8 param_2,ulonglong param_3)
{
uint6 uVar1;
uint *puVar2;
undefined1 auStack_98 [32];
uint *local_78;
undefined8 local_68;
uint local_60 [6];
uint local_48;
uint uStack_44;
uint uStack_40;
uint uStack_3c;
undefined8 local_38;
ulonglong local_30;
local_30 = __security_cookie ^ (ulonglong)auStack_98;
- puVar2 = wil_details_FeatureReporting_RecordUsageInCache(local_60,param_1,(ulonglong)param_5);
+ puVar2 = wil_details_FeatureReporting_RecordUsageInCache
+ (local_60,*(uint **)(param_1 + 8),param_3,(uint)((ulonglong)param_2 >> 0x20));
local_48 = *puVar2;
uStack_44 = puVar2[1];
uStack_40 = puVar2[2];
uStack_3c = puVar2[3];
local_38 = *(undefined8 *)(puVar2 + 4);
if (g_wil_details_recordFeatureUsage != 0) {
local_78 = &local_48;
- (*(code *)g_wil_details_recordFeatureUsage)(param_2,param_5,1,param_1);
+ (*(code *)g_wil_details_recordFeatureUsage)
+ (*(undefined4 *)(param_1 + 0x18),param_3 & 0xffffffff,1,*(undefined8 *)(param_1 + 8));
}
- if ((param_3 != 0) && (param_5 != 0xfe)) {
- local_68._0_6_ = CONCAT24((short)param_5,param_2);
+ if ((((uint)param_2 >> 10 & 1) != 0) && ((int)param_3 != 0xfe)) {
+ local_68._0_6_ = CONCAT24((short)(param_3 & 0xffffffff),*(undefined4 *)(param_1 + 0x18));
uVar1 = (uint6)local_68;
local_68 = (ulonglong)(uint6)local_68;
- if (param_4 != 0) {
+ if (((uint)param_2 >> 0xb & 1) != 0) {
local_68 = CONCAT26(1,uVar1);
}
RtlNotifyFeatureUsage(&local_68);
}
return (int)local_38 == 0;
}
```
## wil_details_EvaluateFeatureDependencies
### Match Info
|Key|nw-3527.sys - nw-3733.sys|
| :---: | :---: |
|diff_type|code,length,address,calling|
|ratio|0.75|
|i_ratio|0.56|
|m_ratio|1.0|
|b_ratio|0.96|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|nw-3527.sys|nw-3733.sys|
| :---: | :---: | :---: |
|name|wil_details_EvaluateFeatureDependencies|wil_details_EvaluateFeatureDependencies|
|fullname|wil_details_EvaluateFeatureDependencies|wil_details_EvaluateFeatureDependencies|
|refcount|3|3|
|`length`|163|171|
|called|wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState
wil_details_FeatureDescriptors_SkipPadding|wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState
wil_details_FeatureDescriptors_SkipPadding|
|`calling`|wil_InitializeFeatureStaging
wil_details_OnFeatureConfigurationChange|wil_InitializeFeatureStaging
wil_details_ReevaluateOnFeatureConfigurationChange|
|paramcount|0|0|
|`address`|1c00a1e70|1c00a1f34|
|sig|undefined __fastcall wil_details_EvaluateFeatureDependencies(void)|undefined __fastcall wil_details_EvaluateFeatureDependencies(void)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### wil_details_EvaluateFeatureDependencies Calling Diff
```diff
--- wil_details_EvaluateFeatureDependencies calling
+++ wil_details_EvaluateFeatureDependencies calling
@@ -2 +2 @@
-wil_details_OnFeatureConfigurationChange
+wil_details_ReevaluateOnFeatureConfigurationChange
```
### wil_details_EvaluateFeatureDependencies Diff
```diff
--- wil_details_EvaluateFeatureDependencies
+++ wil_details_EvaluateFeatureDependencies
@@ -1,43 +1,43 @@
void wil_details_EvaluateFeatureDependencies(void)
{
longlong *plVar1;
undefined **ppuVar2;
uint uVar3;
ulonglong uVar4;
bool bVar5;
- plVar1 = wil_details_FeatureDescriptors_SkipPadding((longlong *)&wil_details_featureDescriptors_a)
- ;
+ plVar1 = wil_details_FeatureDescriptors_SkipPadding
+ ((longlong *)&Feature_1281542463__private_descriptor);
if (plVar1 != (longlong *)0x0) {
uVar4 = 0;
do {
uVar3 = *(uint *)*plVar1;
- if ((char)uVar3 < '\0') {
- if ((uVar3 & 0x60) == 0) {
- bVar5 = *(char *)((longlong)plVar1 + 0x17) != '\0';
+ if ((uVar3 >> 9 & 1) != 0) {
+ if ((uVar3 & 0x180) == 0) {
+ bVar5 = *(char *)((longlong)plVar1 + 0x1f) != '\0';
}
else {
- bVar5 = (uVar3 & 0x60) == 0x40;
+ bVar5 = (uVar3 & 0x180) == 0x100;
}
- uVar3 = uVar3 & 0x10 ^ (uint)bVar5 << 4 | (uint)uVar4 & 0xffffffef;
+ uVar3 = uVar3 & 0x40 ^ (uint)bVar5 << 6 | (uint)uVar4 & 0xffffffbf;
uVar4 = (ulonglong)uVar3;
LOCK();
*(uint *)*plVar1 = *(uint *)*plVar1 ^ uVar3;
UNLOCK();
}
- plVar1 = wil_details_FeatureDescriptors_SkipPadding(plVar1 + 6);
+ plVar1 = wil_details_FeatureDescriptors_SkipPadding(plVar1 + 7);
} while (plVar1 != (longlong *)0x0);
}
- ppuVar2 = &wil_details_featureDescriptors_a;
+ ppuVar2 = &Feature_1281542463__private_descriptor;
while( true ) {
plVar1 = wil_details_FeatureDescriptors_SkipPadding((longlong *)ppuVar2);
if (plVar1 == (longlong *)0x0) break;
wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState
((uint *)*plVar1,(longlong)plVar1);
- ppuVar2 = (undefined **)(plVar1 + 6);
+ ppuVar2 = (undefined **)(plVar1 + 7);
}
return;
}
```
## Dot11Translate80211ToEthernetNdisPacket
### Match Info
|Key|nw-3527.sys - nw-3733.sys|
| :---: | :---: |
|diff_type|code,refcount,length,called|
|ratio|0.11|
|i_ratio|0.16|
|m_ratio|0.98|
|b_ratio|0.27|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|nw-3527.sys|nw-3733.sys|
| :---: | :---: | :---: |
|name|Dot11Translate80211ToEthernetNdisPacket|Dot11Translate80211ToEthernetNdisPacket|
|fullname|Dot11Translate80211ToEthernetNdisPacket|Dot11Translate80211ToEthernetNdisPacket|
|`refcount`|8|5|
|`length`|1006|872|
|`called`|NDIS.SYS::NdisAdvanceNetBufferListDataStart
NTOSKRNL.EXE::ExAllocateFromNPagedLookasideList
NTOSKRNL.EXE::MmMapLockedPagesSpecifyCache
WPP_SF_
_guard_dispatch_icall|Dot11CheckSelectiveTranslationTable
Feature_1281542463__private_IsEnabledDeviceUsage
NDIS.SYS::NdisAdvanceNetBufferListDataStart
NTOSKRNL.EXE::ExAllocateFromNPagedLookasideList
NTOSKRNL.EXE::MmMapLockedPagesSpecifyCache
WPP_SF_|
|calling|Dot11PacketConverterReceivePacket
ExtSTAReceiveDataPacket|Dot11PacketConverterReceivePacket
ExtSTAReceiveDataPacket|
|paramcount|3|3|
|address|1c00043e0|1c00043e0|
|sig|undefined8 __fastcall Dot11Translate80211ToEthernetNdisPacket(longlong param_1, longlong param_2, undefined8 * param_3)|undefined8 __fastcall Dot11Translate80211ToEthernetNdisPacket(longlong param_1, longlong param_2, undefined8 * param_3)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### Dot11Translate80211ToEthernetNdisPacket Called Diff
```diff
--- Dot11Translate80211ToEthernetNdisPacket called
+++ Dot11Translate80211ToEthernetNdisPacket called
@@ -0,0 +1,2 @@
+Dot11CheckSelectiveTranslationTable
+Feature_1281542463__private_IsEnabledDeviceUsage
@@ -5 +6,0 @@
-_guard_dispatch_icall
```
### Dot11Translate80211ToEthernetNdisPacket Diff
```diff
--- Dot11Translate80211ToEthernetNdisPacket
+++ Dot11Translate80211ToEthernetNdisPacket
@@ -1,173 +1,170 @@
-
-/* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */
undefined8
Dot11Translate80211ToEthernetNdisPacket(longlong param_1,longlong param_2,undefined8 *param_3)
{
undefined8 *puVar1;
- short sVar2;
- undefined4 uVar3;
+ undefined4 uVar2;
+ uint uVar3;
uint uVar4;
longlong lVar5;
- code *pcVar6;
- byte bVar7;
- ushort uVar8;
- int iVar9;
+ byte bVar6;
+ bool bVar7;
+ longlong lVar8;
+ ulonglong uVar9;
+ undefined7 extraout_var;
undefined8 *puVar10;
- longlong lVar11;
- undefined8 uVar12;
- undefined8 *puVar13;
- uint uVar14;
- ushort *puVar15;
- ushort uVar16;
- ulonglong uVar17;
- uint uVar18;
+ undefined8 uVar11;
+ ushort uVar12;
+ ushort uVar13;
+ undefined8 *puVar14;
+ uint uVar15;
+ uint uVar16;
+ ushort *puVar17;
+ ulonglong uVar18;
uint uVar19;
- ulonglong uVar20;
- ulonglong local_res10;
- undefined4 uVar21;
- ushort uStack_44;
- undefined2 uStack_42;
- undefined2 uVar22;
+ ulonglong local_58;
+ undefined4 local_50;
+ ushort uStack_4c;
+ undefined2 uStack_4a;
+ undefined2 uStack_48;
lVar5 = *(longlong *)(param_2 + 0x28);
- uVar3 = *(undefined4 *)(param_2 + 0x3c);
- uVar20 = 0;
+ uVar2 = *(undefined4 *)(param_2 + 0x3c);
if ((*(byte *)(lVar5 + 10) & 5) == 0) {
- lVar11 = MmMapLockedPagesSpecifyCache(lVar5,0,1,0,0,0x40000020,0,0);
+ lVar8 = MmMapLockedPagesSpecifyCache(lVar5,0,1,0,0,0x40000020);
}
else {
- lVar11 = *(longlong *)(lVar5 + 0x18);
+ lVar8 = *(longlong *)(lVar5 + 0x18);
}
- uVar4 = *(uint *)(param_2 + 0xc);
- uVar17 = (ulonglong)uVar4;
- puVar15 = (ushort *)(lVar11 + (ulonglong)*(uint *)(param_2 + 0x38));
- if ((uVar17 + 8 < 8) || ((ulonglong)*(uint *)(lVar5 + 0x28) < uVar17 + 8)) {
- return 0xc001000f;
+ uVar3 = *(uint *)(param_2 + 0xc);
+ uVar18 = (ulonglong)uVar3;
+ uVar4 = *(uint *)(lVar5 + 0x28);
+ puVar17 = (ushort *)(lVar8 + (ulonglong)*(uint *)(param_2 + 0x38));
+ if ((uVar18 + 8 < 8) || ((ulonglong)uVar4 < uVar18 + 8)) {
+LAB_0:
+ uVar11 = 0xc001000f;
}
- local_res10 = *(ulonglong *)(*(longlong *)(param_2 + 0x20) + 0xb0);
- uVar18 = (uint)local_res10 & 0xffff0000;
- local_res10 = local_res10 & 0xffffffffffff0000;
- if (((char)*puVar15 < '\0') && (local_res10 == 0)) {
- uVar14 = uVar4 - 2 & 0xff;
- uVar19 = uVar14 - 4 & 0xff;
- if (-1 < (short)*puVar15) {
- uVar19 = uVar14;
+ else {
+ local_58 = *(ulonglong *)(*(longlong *)(param_2 + 0x20) + 0xb0);
+ uVar16 = (uint)local_58 & 0xffff0000;
+ local_58 = local_58 & 0xffffffffffff0000;
+ if (((char)*puVar17 < '\0') && (local_58 == 0)) {
+ uVar15 = uVar3 - 2 & 0xff;
+ uVar19 = uVar15 - 4 & 0xff;
+ if (-1 < (short)*puVar17) {
+ uVar19 = uVar15;
+ }
+ if ((*(byte *)((ulonglong)uVar19 + (longlong)puVar17) & 0xf) < 8) {
+ uVar16 = (*(byte *)((ulonglong)uVar19 + (longlong)puVar17) & 0xf) << 0x10;
+ local_58 = (ulonglong)uVar16;
+ }
}
- if ((*(byte *)((ulonglong)uVar19 + (longlong)puVar15) & 0xf) < 8) {
- uVar18 = (*(byte *)((ulonglong)uVar19 + (longlong)puVar15) & 0xf) << 0x10;
- local_res10 = (ulonglong)uVar18;
+ uVar13 = *(ushort *)(uVar18 + 6 + (longlong)puVar17);
+ uVar19 = uVar3 - 0xe;
+ if (uVar13 == 0x81) {
+ uVar9 = Feature_1281542463__private_IsEnabledDeviceUsage();
+ if (((int)uVar9 != 0) && ((ulonglong)uVar4 < (ulonglong)*(uint *)(param_2 + 0xc) + 0xc))
+ goto LAB_0;
+ uVar13 = *(ushort *)((longlong)puVar17 + uVar18 + 8);
+ bVar6 = (byte)uVar13;
+ uVar16 = ((bVar6 & 0xf) << 8 | (uint)(uVar13 >> 8)) << 4 ^ uVar16;
+ if (((uVar16 & 0xfff0) != 0) && ((*(uint *)(param_1 + 0x80) & 0x200) == 0)) {
+ if ((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) {
+ WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),10,
+ &WPP_632545ae6a7232f3ab98617ae9e39362_Traceguids);
+ }
+ return 0x10003;
+ }
+ if ((*(uint *)(param_1 + 0x80) & 0x40) != 0) {
+ uVar16 = uVar16 | bVar6 >> 5;
+ }
+ local_58 = CONCAT44(local_58._4_4_,uVar16);
+ uVar13 = *(ushort *)((longlong)puVar17 + uVar18 + 10);
+ uVar19 = uVar3 - 10;
+ }
+ *(ulonglong *)(*(longlong *)(param_2 + 0x20) + 0xb0) = local_58;
+ if (((ushort)(uVar13 >> 8 | uVar13 << 8) < 0x600) ||
+ (bVar7 = Dot11CheckSelectiveTranslationTable
+ (param_1,*(short *)((longlong)puVar17 + uVar18 + 6)),
+ (int)CONCAT71(extraout_var,bVar7) != 0)) {
+ uVar13 = *puVar17 & 0x100;
+ if (uVar13 == 0) {
+ local_50 = *(undefined4 *)(puVar17 + 2);
+ uStack_4c = puVar17[4];
+ }
+ else {
+ local_50 = *(undefined4 *)(puVar17 + 8);
+ uStack_4c = puVar17[10];
+ }
+ if ((*puVar17 & 0x200) == 0) {
+ uStack_4a = (undefined2)*(undefined4 *)(puVar17 + 5);
+ uStack_48 = (undefined2)((uint)*(undefined4 *)(puVar17 + 5) >> 0x10);
+ uVar12 = puVar17[7];
+ }
+ else if (uVar13 == 0) {
+ uStack_4a = (undefined2)*(undefined4 *)(puVar17 + 8);
+ uStack_48 = (undefined2)((uint)*(undefined4 *)(puVar17 + 8) >> 0x10);
+ uVar12 = puVar17[10];
+ }
+ else {
+ uStack_4a = (undefined2)*(undefined4 *)(puVar17 + 0xc);
+ uStack_48 = (undefined2)((uint)*(undefined4 *)(puVar17 + 0xc) >> 0x10);
+ uVar12 = puVar17[0xe];
+ }
+ uVar13 = ((short)uVar2 - (short)uVar19) - 0xe;
+ }
+ else {
+ uVar19 = uVar19 + 8;
+ uVar12 = *puVar17 & 0x100;
+ if (uVar12 == 0) {
+ local_50 = *(undefined4 *)(puVar17 + 2);
+ uStack_4c = puVar17[4];
+ }
+ else {
+ local_50 = *(undefined4 *)(puVar17 + 8);
+ uStack_4c = puVar17[10];
+ }
+ if ((*puVar17 & 0x200) == 0) {
+ uStack_4a = (undefined2)*(undefined4 *)(puVar17 + 5);
+ uStack_48 = (undefined2)((uint)*(undefined4 *)(puVar17 + 5) >> 0x10);
+ uVar12 = puVar17[7];
+ }
+ else if (uVar12 == 0) {
+ uStack_4a = (undefined2)*(undefined4 *)(puVar17 + 8);
+ uStack_48 = (undefined2)((uint)*(undefined4 *)(puVar17 + 8) >> 0x10);
+ uVar12 = puVar17[10];
+ }
+ else {
+ uStack_4a = (undefined2)*(undefined4 *)(puVar17 + 0xc);
+ uStack_48 = (undefined2)((uint)*(undefined4 *)(puVar17 + 0xc) >> 0x10);
+ uVar12 = puVar17[0xe];
+ }
+ }
+ puVar10 = (undefined8 *)ExAllocateFromNPagedLookasideList(&Dot11Mem);
+ if (puVar10 == (undefined8 *)0x0) {
+ uVar11 = 0xc000009a;
+ }
+ else {
+ *puVar10 = &Dot11Mem;
+ *(undefined4 *)(puVar10 + 1) = 0x74766e43;
+ puVar1 = puVar10 + 2;
+ puVar14 = (undefined8 *)((ulonglong)uVar19 + (longlong)puVar17);
+ *puVar1 = 0;
+ puVar10[3] = 0;
+ *(undefined4 *)(puVar10 + 4) = 0;
+ *puVar1 = *puVar14;
+ *(undefined4 *)(puVar10 + 3) = *(undefined4 *)(puVar14 + 1);
+ *(undefined2 *)((longlong)puVar10 + 0x1c) = *(undefined2 *)((longlong)puVar14 + 0xc);
+ *puVar14 = CONCAT26(uStack_4a,CONCAT24(uStack_4c,local_50));
+ *(uint *)(puVar14 + 1) = CONCAT22(uVar12,uStack_48);
+ *(ushort *)((longlong)puVar14 + 0xc) = uVar13;
+ NdisAdvanceNetBufferListDataStart(*(undefined8 *)(param_2 + 0x20),uVar19,1,NetMonShutdown);
+ *(uint *)(puVar10 + 4) = uVar19;
+ *param_3 = puVar1;
+ uVar11 = 0;
}
}
- uVar16 = *(ushort *)(uVar17 + 6 + (longlong)puVar15);
- uVar19 = uVar4 - 0xe;
- if (uVar16 == 0x81) {
- uVar16 = *(ushort *)((longlong)puVar15 + uVar17 + 8);
- bVar7 = (byte)uVar16;
- uVar18 = ((bVar7 & 0xf) << 8 | (uint)(uVar16 >> 8)) << 4 ^ uVar18;
- if (((uVar18 & 0xfff0) != 0) && ((*(uint *)(param_1 + 0x80) >> 9 & 1) == 0)) {
- if ((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) {
- WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),10,
- &WPP_39457ae802743135fee386e888330fd8_Traceguids);
- }
- return 0x10003;
- }
- if ((*(uint *)(param_1 + 0x80) & 0x40) != 0) {
- uVar18 = uVar18 | bVar7 >> 5;
- }
- local_res10 = CONCAT44(local_res10._4_4_,uVar18);
- uVar16 = *(ushort *)((longlong)puVar15 + uVar17 + 10);
- uVar19 = uVar4 - 10;
- }
- *(ulonglong *)(*(longlong *)(param_2 + 0x20) + 0xb0) = local_res10;
- if ((ushort)(uVar16 >> 8 | uVar16 << 8) < 0x600) {
-LAB_0:
- uVar16 = *puVar15;
- if ((uVar16 >> 8 & 1) == 0) {
- uVar21 = *(undefined4 *)(puVar15 + 2);
- uStack_44 = puVar15[4];
- }
- else {
- uVar21 = *(undefined4 *)(puVar15 + 8);
- uStack_44 = puVar15[10];
- }
- if ((uVar16 & 0x200) == 0) {
- uStack_42 = (undefined2)*(undefined4 *)(puVar15 + 5);
- uVar22 = (undefined2)((uint)*(undefined4 *)(puVar15 + 5) >> 0x10);
- uVar8 = puVar15[7];
- }
- else if ((uVar16 & 0x300) == 0x200) {
- uStack_42 = (undefined2)*(undefined4 *)(puVar15 + 8);
- uVar22 = (undefined2)((uint)*(undefined4 *)(puVar15 + 8) >> 0x10);
- uVar8 = puVar15[10];
- }
- else {
- uStack_42 = (undefined2)*(undefined4 *)(puVar15 + 0xc);
- uVar22 = (undefined2)((uint)*(undefined4 *)(puVar15 + 0xc) >> 0x10);
- uVar8 = puVar15[0xe];
- }
- uVar16 = ((short)uVar3 - (short)uVar19) - 0xe;
- }
- else {
- sVar2 = *(short *)((longlong)puVar15 + uVar17 + 6);
- if (((*(longlong *)(param_1 + 0x98) == 0) ||
- (pcVar6 = *(code **)(*(longlong *)(param_1 + 0x98) + 0xa8), pcVar6 == (code *)0x0)) ||
- (iVar9 = (*pcVar6)(*(undefined8 *)(param_1 + 0x1c18),sVar2), iVar9 == 0)) {
- for (; (uint)uVar20 < 2; uVar20 = (ulonglong)((uint)uVar20 + 1)) {
- if (sVar2 == (&gSelectiveTranslationTable)[uVar20]) goto LAB_0;
- }
- }
- else if (iVar9 == 2) goto LAB_0;
- uVar8 = *puVar15;
- uVar19 = uVar19 + 8;
- if ((uVar8 >> 8 & 1) == 0) {
- uVar21 = *(undefined4 *)(puVar15 + 2);
- uStack_44 = puVar15[4];
- }
- else {
- uVar21 = *(undefined4 *)(puVar15 + 8);
- uStack_44 = puVar15[10];
- }
- if ((uVar8 & 0x200) == 0) {
- uStack_42 = (undefined2)*(undefined4 *)(puVar15 + 5);
- uVar22 = (undefined2)((uint)*(undefined4 *)(puVar15 + 5) >> 0x10);
- uVar8 = puVar15[7];
- }
- else if ((uVar8 & 0x300) == 0x200) {
- uStack_42 = (undefined2)*(undefined4 *)(puVar15 + 8);
- uVar22 = (undefined2)((uint)*(undefined4 *)(puVar15 + 8) >> 0x10);
- uVar8 = puVar15[10];
- }
- else {
- uStack_42 = (undefined2)*(undefined4 *)(puVar15 + 0xc);
- uVar22 = (undefined2)((uint)*(undefined4 *)(puVar15 + 0xc) >> 0x10);
- uVar8 = puVar15[0xe];
- }
- }
- puVar10 = (undefined8 *)ExAllocateFromNPagedLookasideList(&Dot11Mem);
- if (puVar10 == (undefined8 *)0x0) {
- uVar12 = 0xc000009a;
- }
- else {
- *puVar10 = &Dot11Mem;
- *(undefined4 *)(puVar10 + 1) = 0x74766e43;
- puVar1 = puVar10 + 2;
- puVar13 = (undefined8 *)((ulonglong)uVar19 + (longlong)puVar15);
- *puVar1 = 0;
- puVar10[3] = 0;
- *(undefined4 *)(puVar10 + 4) = 0;
- *puVar1 = *puVar13;
- *(undefined4 *)(puVar10 + 3) = *(undefined4 *)(puVar13 + 1);
- *(undefined2 *)((longlong)puVar10 + 0x1c) = *(undefined2 *)((longlong)puVar13 + 0xc);
- *puVar13 = CONCAT26(uStack_42,CONCAT24(uStack_44,uVar21));
- *(uint *)(puVar13 + 1) = CONCAT22(uVar8,uVar22);
- *(ushort *)((longlong)puVar13 + 0xc) = uVar16;
- NdisAdvanceNetBufferListDataStart(*(undefined8 *)(param_2 + 0x20),uVar19,1,NetMonShutdown);
- *(uint *)(puVar10 + 4) = uVar19;
- *param_3 = puVar1;
- uVar12 = 0;
- }
- return uVar12;
+ return uVar11;
}
```
## wil_details_GetCurrentFeatureEnabledState
### Match Info
|Key|nw-3527.sys - nw-3733.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.54|
|i_ratio|0.46|
|m_ratio|0.93|
|b_ratio|0.9|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|nw-3527.sys|nw-3733.sys|
| :---: | :---: | :---: |
|name|wil_details_GetCurrentFeatureEnabledState|wil_details_GetCurrentFeatureEnabledState|
|fullname|wil_details_GetCurrentFeatureEnabledState|wil_details_GetCurrentFeatureEnabledState|
|refcount|2|2|
|`length`|286|340|
|`called`|wil_RtlStagingConfig_QueryFeatureState
wil_details_FeatureStateCache_GetCachedFeatureEnabledState|wil_RtlStagingConfig_QueryFeatureState
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState|
|calling|wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState|wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState|
|paramcount|2|2|
|`address`|1c0032770|1c00212b0|
|sig|uint __fastcall wil_details_GetCurrentFeatureEnabledState(longlong param_1, undefined4 * param_2)|uint __fastcall wil_details_GetCurrentFeatureEnabledState(longlong param_1, undefined4 * param_2)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### wil_details_GetCurrentFeatureEnabledState Called Diff
```diff
--- wil_details_GetCurrentFeatureEnabledState called
+++ wil_details_GetCurrentFeatureEnabledState called
@@ -2 +2 @@
-wil_details_FeatureStateCache_GetCachedFeatureEnabledState
+wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
```
### wil_details_GetCurrentFeatureEnabledState Diff
```diff
--- wil_details_GetCurrentFeatureEnabledState
+++ wil_details_GetCurrentFeatureEnabledState
@@ -1,70 +1,69 @@
uint wil_details_GetCurrentFeatureEnabledState(longlong param_1,undefined4 *param_2)
{
char cVar1;
undefined4 uVar2;
undefined8 *puVar3;
undefined8 uVar4;
ulonglong uVar5;
uint uVar6;
uint uVar7;
longlong *plVar8;
- bool bVar9;
uint local_res8;
+ ulonglong local_res10;
uint local_28 [8];
- cVar1 = *(char *)(param_1 + 0x14);
- uVar2 = *(undefined4 *)(param_1 + 0x10);
+ cVar1 = *(char *)(param_1 + 0x1c);
+ uVar2 = *(undefined4 *)(param_1 + 0x18);
*param_2 = 1;
local_28[4] = 0;
local_28[5] = 0;
local_28[0] = 0;
local_28[1] = 0;
local_28[2] = 0;
local_28[3] = 0;
uVar4 = wil_RtlStagingConfig_QueryFeatureState(local_28,uVar2,(uint)((byte)(cVar1 - 2U) < 2));
uVar7 = -(uint)((int)uVar4 != 0) & local_28[0] & 3;
if (uVar7 == 0) {
- uVar6 = -(uint)(*(char *)(param_1 + 0x17) != '\0') & 0x10;
+ uVar6 = -(uint)(*(char *)(param_1 + 0x1f) != '\0') & 0x40;
}
else {
uVar6 = 0;
if (local_28[0] == 2) {
- uVar6 = 0x10;
+ uVar6 = 0x40;
}
}
- local_res8 = uVar6 >> 1 |
- uVar7 << 5 | -(uint)(local_28[5] != 0) & 0x200 | -(uint)(local_28[4] != 0) & 0x100 |
- uVar6;
- if ((uVar6 >> 1 != 0) && (plVar8 = *(longlong **)(param_1 + 0x18), plVar8 != (longlong *)0x0)) {
- do {
- puVar3 = (undefined8 *)*plVar8;
- if (puVar3 == (undefined8 *)0x0) {
- return local_res8;
- }
- if ((*(char *)((longlong)puVar3 + 0x16) == '\0') &&
- (*(char *)((longlong)puVar3 + 0x15) == '\0')) {
- uVar5 = wil_details_FeatureStateCache_GetCachedFeatureEnabledState
- ((uint *)*puVar3,(longlong)puVar3);
- if ((local_res8 & 8) == 0) goto LAB_0;
- bVar9 = (uVar5 & 8) == 0;
-LAB_1:
- if (bVar9) goto LAB_0;
- uVar7 = 8;
+ local_res8 = uVar6 >> 6 |
+ uVar6 | uVar7 << 7 |
+ -(uint)(local_28[5] != 0) & 0x800 | -(uint)(local_28[4] != 0) & 0x400;
+ if ((uVar6 >> 6 != 0) && (plVar8 = *(longlong **)(param_1 + 0x20), plVar8 != (longlong *)0x0)) {
+ for (; ((local_res8 & 1) != 0 && (puVar3 = (undefined8 *)*plVar8, puVar3 != (undefined8 *)0x0));
+ plVar8 = plVar8 + 1) {
+ if ((*(char *)((longlong)puVar3 + 0x1e) == '\0') &&
+ (*(char *)((longlong)puVar3 + 0x1d) == '\0')) {
+ uVar6 = *(uint *)*puVar3;
+ local_res10 = (ulonglong)uVar6;
+ if ((uVar6 & 2) == 0) {
+ uVar5 = wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
+ ((uint *)*puVar3,local_res10,(longlong)puVar3);
+ uVar6 = (uint)uVar5;
+ }
+ uVar7 = local_res8 & 0xfffffffe;
+ local_res8 = (uint)((uVar6 & local_res8 & 1) != 0);
}
else {
- if ((local_res8 & 8) != 0) {
- bVar9 = *(char *)((longlong)puVar3 + 0x17) == '\0';
- goto LAB_1;
+ if (((local_res8 & 1) == 0) || (*(char *)((longlong)puVar3 + 0x1f) == '\0')) {
+ uVar7 = 0;
}
-LAB_0:
- uVar7 = 0;
+ else {
+ uVar7 = 1;
+ }
+ local_res8 = local_res8 & 0xfffffffe;
}
- plVar8 = plVar8 + 1;
- local_res8 = local_res8 & 0xfffffff7 | uVar7;
- } while (uVar7 != 0);
+ local_res8 = local_res8 | uVar7;
+ }
}
return local_res8;
}
```
## wil_details_FeatureReporting_ReportUsageToService
### Match Info
|Key|nw-3527.sys - nw-3733.sys|
| :---: | :---: |
|diff_type|code,refcount,length,sig,address,calling|
|ratio|0.56|
|i_ratio|0.27|
|m_ratio|0.99|
|b_ratio|0.96|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|nw-3527.sys|nw-3733.sys|
| :---: | :---: | :---: |
|name|wil_details_FeatureReporting_ReportUsageToService|wil_details_FeatureReporting_ReportUsageToService|
|fullname|wil_details_FeatureReporting_ReportUsageToService|wil_details_FeatureReporting_ReportUsageToService|
|`refcount`|3|2|
|`length`|135|126|
|called|_guard_dispatch_icall
wil_details_FeatureReporting_ReportUsageToServiceDirect
wil_details_MapReportingKind|_guard_dispatch_icall
wil_details_FeatureReporting_ReportUsageToServiceDirect
wil_details_MapReportingKind|
|`calling`|Feature_Servicing_WFAQuickTrackCertRSNIE__private_IsEnabled
Feature_Servicing_WlanihvextSetIGTKAndBIGTK__private_IsEnabled|wil_details_IsEnabledFallback|
|paramcount|6|3|
|`address`|1c00324b8|1c0020fe4|
|`sig`|undefined __fastcall wil_details_FeatureReporting_ReportUsageToService(uint * param_1, undefined4 param_2, int param_3, int param_4, undefined8 param_5, int param_6)|undefined __fastcall wil_details_FeatureReporting_ReportUsageToService(longlong param_1, undefined8 param_2, int param_3)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### wil_details_FeatureReporting_ReportUsageToService Calling Diff
```diff
--- wil_details_FeatureReporting_ReportUsageToService calling
+++ wil_details_FeatureReporting_ReportUsageToService calling
@@ -1,2 +1 @@
-Feature_Servicing_WFAQuickTrackCertRSNIE__private_IsEnabled
-Feature_Servicing_WlanihvextSetIGTKAndBIGTK__private_IsEnabled
+wil_details_IsEnabledFallback
```
### wil_details_FeatureReporting_ReportUsageToService Diff
```diff
--- wil_details_FeatureReporting_ReportUsageToService
+++ wil_details_FeatureReporting_ReportUsageToService
@@ -1,24 +1,25 @@
/* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */
void wil_details_FeatureReporting_ReportUsageToService
- (uint *param_1,undefined4 param_2,int param_3,int param_4,undefined8 param_5,
- int param_6)
+ (longlong param_1,undefined8 param_2,int param_3)
{
bool bVar1;
uint uVar2;
undefined7 extraout_var;
- undefined4 uStack0000000000000038;
+ uint uVar3;
+ int local_res18 [4];
- uStack0000000000000038 = 3;
- uVar2 = wil_details_MapReportingKind(3,param_6);
- bVar1 = wil_details_FeatureReporting_ReportUsageToServiceDirect
- (param_1,param_2,param_3,param_4,uVar2);
+ uVar3 = (uint)param_2 & 1;
+ local_res18[0] = param_3;
+ uVar2 = wil_details_MapReportingKind(param_3,uVar3);
+ bVar1 = wil_details_FeatureReporting_ReportUsageToServiceDirect(param_1,param_2,(ulonglong)uVar2);
if (((int)CONCAT71(extraout_var,bVar1) != 0) && (g_wil_details_pfnFeatureLoggingHook != 0)) {
- (*(code *)g_wil_details_pfnFeatureLoggingHook)(param_2,param_5,0,param_6,&stack0x00000038,0,0,1)
- ;
+ (*(code *)g_wil_details_pfnFeatureLoggingHook)
+ (*(undefined4 *)(param_1 + 0x18),*(undefined8 *)(param_1 + 0x10),0,uVar3,local_res18,0
+ ,0,1);
}
return;
}
```
## wil_details_PopulateInitialConfiguredFeatureStates
### Match Info
|Key|nw-3527.sys - nw-3733.sys|
| :---: | :---: |
|diff_type|code,length,sig,address|
|ratio|0.76|
|i_ratio|0.53|
|m_ratio|0.95|
|b_ratio|0.95|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|nw-3527.sys|nw-3733.sys|
| :---: | :---: | :---: |
|name|wil_details_PopulateInitialConfiguredFeatureStates|wil_details_PopulateInitialConfiguredFeatureStates|
|fullname|wil_details_PopulateInitialConfiguredFeatureStates|wil_details_PopulateInitialConfiguredFeatureStates|
|refcount|2|2|
|`length`|237|219|
|called|NTOSKRNL.EXE::RtlQueryFeatureConfiguration
__security_check_cookie
wil_details_BuildFeatureStateCacheFromQueryResults
wil_details_FeatureDescriptors_SkipPadding|NTOSKRNL.EXE::RtlQueryFeatureConfiguration
__security_check_cookie
wil_details_BuildFeatureStateCacheFromQueryResults
wil_details_FeatureDescriptors_SkipPadding|
|calling|wil_InitializeFeatureStaging|wil_InitializeFeatureStaging|
|paramcount|0|0|
|`address`|1c00a44b8|1c00a4500|
|`sig`|int __fastcall wil_details_PopulateInitialConfiguredFeatureStates(void)|undefined __fastcall wil_details_PopulateInitialConfiguredFeatureStates(void)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### wil_details_PopulateInitialConfiguredFeatureStates Diff
```diff
--- wil_details_PopulateInitialConfiguredFeatureStates
+++ wil_details_PopulateInitialConfiguredFeatureStates
@@ -1,58 +1,52 @@
/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
-int wil_details_PopulateInitialConfiguredFeatureStates(void)
+void wil_details_PopulateInitialConfiguredFeatureStates(void)
{
int iVar1;
longlong *plVar2;
undefined **ppuVar3;
undefined8 uVar4;
- int iVar5;
undefined1 auStack_58 [32];
undefined8 local_38;
undefined8 local_30;
undefined8 local_28;
undefined4 local_20;
ulonglong local_18;
local_18 = __security_cookie ^ (ulonglong)auStack_58;
- iVar5 = 0;
- ppuVar3 = &wil_details_featureDescriptors_a;
+ ppuVar3 = &Feature_1281542463__private_descriptor;
do {
plVar2 = wil_details_FeatureDescriptors_SkipPadding((longlong *)ppuVar3);
if (plVar2 == (longlong *)0x0) {
- return iVar5;
+ return;
}
local_30 = 0;
local_38 = 0;
local_28 = 0;
local_20 = 0;
- if ((*(char *)((longlong)plVar2 + 0x15) == '\0') && (*(char *)((longlong)plVar2 + 0x16) == '\0')
+ if ((*(char *)((longlong)plVar2 + 0x1d) == '\0') && (*(char *)((longlong)plVar2 + 0x1e) == '\0')
) {
iVar1 = RtlQueryFeatureConfiguration
- ((int)plVar2[2],1 < (byte)(*(char *)((longlong)plVar2 + 0x14) - 2U),
+ ((int)plVar2[3],1 < (byte)(*(char *)((longlong)plVar2 + 0x1c) - 2U),
&local_30,&local_28);
if (iVar1 == -0x7fffffde) {
- local_38 = 0x83;
+ local_38 = 0x206;
uVar4 = local_38;
do {
*(undefined8 *)*plVar2 = uVar4;
- plVar2 = wil_details_FeatureDescriptors_SkipPadding(plVar2 + 6);
+ plVar2 = wil_details_FeatureDescriptors_SkipPadding(plVar2 + 7);
} while (plVar2 != (longlong *)0x0);
- return iVar5;
+ return;
}
}
else {
iVar1 = -0x3ffffddb;
}
- iVar1 = wil_details_BuildFeatureStateCacheFromQueryResults
- (iVar1,(longlong)&local_28,(uint *)&local_38);
- if (iVar1 != 0) {
- iVar5 = iVar1;
- }
+ wil_details_BuildFeatureStateCacheFromQueryResults(iVar1,(longlong)&local_28,(uint *)&local_38);
+ ppuVar3 = (undefined **)(plVar2 + 7);
*(undefined8 *)*plVar2 = local_38;
- ppuVar3 = (undefined **)(plVar2 + 6);
} while( true );
}
```
## wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState
### Match Info
|Key|nw-3527.sys - nw-3733.sys|
| :---: | :---: |
|diff_type|code,length,address|
|ratio|0.37|
|i_ratio|0.5|
|m_ratio|0.92|
|b_ratio|0.79|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|nw-3527.sys|nw-3733.sys|
| :---: | :---: | :---: |
|name|wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState|wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState|
|fullname|wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState|wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState|
|refcount|2|2|
|`length`|171|194|
|called|wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState|wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState|
|calling|wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState|wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState|
|paramcount|3|3|
|`address`|1c00a1f50|1c00a2020|
|sig|uint __fastcall wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState(uint * param_1, uint param_2, longlong param_3)|uint __fastcall wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState(uint * param_1, uint param_2, longlong param_3)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState Diff
```diff
--- wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState
+++ wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState
@@ -1,51 +1,61 @@
uint wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState
(uint *param_1,uint param_2,longlong param_3)
{
undefined8 *puVar1;
uint uVar2;
- longlong *plVar3;
- uint uVar4;
- bool bVar5;
+ uint uVar3;
+ longlong *plVar4;
+ uint uVar5;
+ bool bVar6;
- uVar4 = param_2 >> 4 & 1;
- if (uVar4 != 0) {
- plVar3 = *(longlong **)(param_3 + 0x18);
- bVar5 = plVar3 == (longlong *)0x0;
- while (!bVar5) {
+ uVar5 = param_2 >> 6 & 1;
+ if (uVar5 != 0) {
+ plVar4 = *(longlong **)(param_3 + 0x20);
+ bVar6 = plVar4 == (longlong *)0x0;
+ while (!bVar6) {
while( true ) {
- puVar1 = (undefined8 *)*plVar3;
+ puVar1 = (undefined8 *)*plVar4;
if (puVar1 == (undefined8 *)0x0) goto LAB_0;
- if ((*(char *)((longlong)puVar1 + 0x16) == '\0') &&
- (*(char *)((longlong)puVar1 + 0x15) == '\0')) break;
- if ((uVar4 == 0) || (*(char *)((longlong)puVar1 + 0x17) == '\0')) {
- uVar4 = 0;
+ if ((*(char *)((longlong)puVar1 + 0x1e) == '\0') &&
+ (*(char *)((longlong)puVar1 + 0x1d) == '\0')) break;
+ if ((uVar5 == 0) || (*(char *)((longlong)puVar1 + 0x1f) == '\0')) {
+ uVar5 = 0;
goto LAB_0;
}
- uVar4 = 1;
- plVar3 = plVar3 + 1;
+ uVar5 = 1;
+ plVar4 = plVar4 + 1;
}
uVar2 = wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState
((uint *)*puVar1,(longlong)puVar1);
- if ((uVar4 == 0) || ((uVar2 & 8) == 0)) {
- uVar4 = 0;
+ if ((uVar5 == 0) || ((uVar2 & 1) == 0)) {
+ uVar5 = 0;
}
else {
- uVar4 = 1;
+ uVar5 = 1;
}
- plVar3 = plVar3 + 1;
- bVar5 = uVar4 == 0;
+ plVar4 = plVar4 + 1;
+ bVar6 = uVar5 == 0;
}
}
LAB_0:
- uVar2 = 0x80;
- if ((param_2 >> 3 & 1) != uVar4) {
- uVar2 = 0x88;
- }
- LOCK();
- *param_1 = *param_1 ^ uVar2;
- UNLOCK();
- return uVar2 ^ param_2;
+ do {
+ uVar2 = param_2 & 0xffffffce;
+ if ((param_2 & 1) == uVar5) {
+ uVar2 = param_2 & 0xfffffffe;
+ }
+ uVar3 = uVar2 & 0xfffffdff | uVar5;
+ LOCK();
+ uVar2 = *param_1;
+ bVar6 = param_2 == uVar2;
+ if (bVar6) {
+ *param_1 = uVar3;
+ uVar2 = param_2;
+ }
+ param_2 = uVar2;
+ UNLOCK();
+ } while (!bVar6);
+ return uVar3;
}
```
## wil_InitializeFeatureStaging
### Match Info
|Key|nw-3527.sys - nw-3733.sys|
| :---: | :---: |
|diff_type|code,length,called|
|ratio|0.33|
|i_ratio|0.34|
|m_ratio|0.64|
|b_ratio|0.53|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|nw-3527.sys|nw-3733.sys|
| :---: | :---: | :---: |
|name|wil_InitializeFeatureStaging|wil_InitializeFeatureStaging|
|fullname|wil_InitializeFeatureStaging|wil_InitializeFeatureStaging|
|refcount|2|2|
|`length`|59|131|
|`called`|NTOSKRNL.EXE::RtlQueryFeatureConfigurationChangeStamp
wil_details_EvaluateFeatureDependencies
wil_details_PopulateInitialConfiguredFeatureStates
wil_details_RegisterFeatureStagingChangeNotification|NTOSKRNL.EXE::RtlQueryFeatureConfigurationChangeStamp
NTOSKRNL.EXE::RtlRegisterFeatureConfigurationChangeNotification
wil_details_EvaluateFeatureDependencies
wil_details_FeatureDescriptors_SkipPadding
wil_details_PopulateInitialConfiguredFeatureStates|
|calling|DriverEntry|DriverEntry|
|paramcount|0|0|
|address|1c00a4474|1c00a4474|
|sig|int __fastcall wil_InitializeFeatureStaging(void)|int __fastcall wil_InitializeFeatureStaging(void)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### wil_InitializeFeatureStaging Called Diff
```diff
--- wil_InitializeFeatureStaging called
+++ wil_InitializeFeatureStaging called
@@ -1,0 +2 @@
+NTOSKRNL.EXE::RtlRegisterFeatureConfigurationChangeNotification
@@ -2,0 +4 @@
+wil_details_FeatureDescriptors_SkipPadding
@@ -4 +5,0 @@
-wil_details_RegisterFeatureStagingChangeNotification
```
### wil_InitializeFeatureStaging Diff
```diff
--- wil_InitializeFeatureStaging
+++ wil_InitializeFeatureStaging
@@ -1,15 +1,33 @@
int wil_InitializeFeatureStaging(void)
{
int iVar1;
+ longlong *plVar2;
+ undefined **ppuVar3;
+ undefined8 local_res8 [4];
- RtlQueryFeatureConfigurationChangeStamp();
- iVar1 = wil_details_PopulateInitialConfiguredFeatureStates();
+ local_res8[0] = RtlQueryFeatureConfigurationChangeStamp();
+ wil_details_PopulateInitialConfiguredFeatureStates();
wil_details_EvaluateFeatureDependencies();
- if (iVar1 == 0) {
- iVar1 = wil_details_RegisterFeatureStagingChangeNotification();
+ ppuVar3 = &Feature_1281542463__private_descriptor;
+ while( true ) {
+ plVar2 = wil_details_FeatureDescriptors_SkipPadding((longlong *)ppuVar3);
+ if (plVar2 == (longlong *)0x0) {
+ return 0;
+ }
+ if (((*(char *)((longlong)plVar2 + 0x1d) == '\0') &&
+ (*(char *)((longlong)plVar2 + 0x1e) == '\0')) &&
+ (*(char *)((longlong)plVar2 + 0x1c) == '\0')) break;
+ ppuVar3 = (undefined **)(plVar2 + 7);
}
- return iVar1;
+ iVar1 = RtlRegisterFeatureConfigurationChangeNotification
+ (wil_details_ReevaluateOnFeatureConfigurationChange,0,local_res8,
+ &wil_details_featureChangeNotification);
+ if (iVar1 != 0) {
+ wil_details_featureChangeNotification = 0;
+ return iVar1;
+ }
+ return 0;
}
```
## wil_details_BuildFeatureStateCacheFromQueryResults
### Match Info
|Key|nw-3527.sys - nw-3733.sys|
| :---: | :---: |
|diff_type|code,length,sig,address|
|ratio|0.76|
|i_ratio|0.61|
|m_ratio|0.94|
|b_ratio|0.85|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|nw-3527.sys|nw-3733.sys|
| :---: | :---: | :---: |
|name|wil_details_BuildFeatureStateCacheFromQueryResults|wil_details_BuildFeatureStateCacheFromQueryResults|
|fullname|wil_details_BuildFeatureStateCacheFromQueryResults|wil_details_BuildFeatureStateCacheFromQueryResults|
|refcount|3|3|
|`length`|106|97|
|called|||
|calling|wil_details_PopulateInitialConfiguredFeatureStates
wil_details_UpdateFeatureConfiguredStates|wil_details_PopulateInitialConfiguredFeatureStates
wil_details_UpdateFeatureConfiguredStates|
|paramcount|3|3|
|`address`|1c00a1dfc|1c00a1ecc|
|`sig`|int __fastcall wil_details_BuildFeatureStateCacheFromQueryResults(int param_1, longlong param_2, uint * param_3)|undefined __fastcall wil_details_BuildFeatureStateCacheFromQueryResults(int param_1, longlong param_2, uint * param_3)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### wil_details_BuildFeatureStateCacheFromQueryResults Diff
```diff
--- wil_details_BuildFeatureStateCacheFromQueryResults
+++ wil_details_BuildFeatureStateCacheFromQueryResults
@@ -1,33 +1,28 @@
-int wil_details_BuildFeatureStateCacheFromQueryResults(int param_1,longlong param_2,uint *param_3)
+void wil_details_BuildFeatureStateCacheFromQueryResults(int param_1,longlong param_2,uint *param_3)
{
uint uVar1;
- int iVar2;
- iVar2 = 0;
if ((param_1 == -0x7fffffde) || (param_1 == -0x3ffffddb)) {
param_3[0] = 0;
param_3[1] = 0;
- param_1 = iVar2;
}
else {
param_3[0] = 0;
param_3[1] = 0;
if (param_1 == 0) {
- uVar1 = ((*(uint *)(param_2 + 4) & 0x40) << 2 | *(uint *)(param_2 + 4) & 0xb0) * 2 | 0x83;
+ uVar1 = ((*(uint *)(param_2 + 4) & 0x40) << 2 | *(uint *)(param_2 + 4) & 0xb0) << 3 | 0x206;
goto LAB_0;
}
if (param_1 == 0x117) {
- uVar1 = (*(uint *)(param_2 + 4) & 0x80) * 2 | 0x83;
- iVar2 = 0;
+ uVar1 = (*(uint *)(param_2 + 4) & 0x80) << 3 | 0x206;
goto LAB_0;
}
}
- uVar1 = 0x83;
- iVar2 = param_1;
+ uVar1 = 0x206;
LAB_0:
*param_3 = uVar1;
- return iVar2;
+ return;
}
```
## wil_details_FeatureReporting_RecordUsageInCache
### Match Info
|Key|nw-3527.sys - nw-3733.sys|
| :---: | :---: |
|diff_type|code,length,sig,address|
|ratio|0.73|
|i_ratio|0.2|
|m_ratio|0.97|
|b_ratio|0.82|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|nw-3527.sys|nw-3733.sys|
| :---: | :---: | :---: |
|name|wil_details_FeatureReporting_RecordUsageInCache|wil_details_FeatureReporting_RecordUsageInCache|
|fullname|wil_details_FeatureReporting_RecordUsageInCache|wil_details_FeatureReporting_RecordUsageInCache|
|refcount|2|2|
|`length`|345|360|
|called|wil_details_FeatureReporting_IncrementOpportunityInCache
wil_details_FeatureReporting_IncrementUsageInCache|wil_details_FeatureReporting_IncrementOpportunityInCache
wil_details_FeatureReporting_IncrementUsageInCache|
|calling|wil_details_FeatureReporting_ReportUsageToServiceDirect|wil_details_FeatureReporting_ReportUsageToServiceDirect|
|paramcount|3|4|
|`address`|1c0032358|1c0020e74|
|`sig`|uint * __fastcall wil_details_FeatureReporting_RecordUsageInCache(uint * param_1, uint * param_2, undefined8 param_3)|uint * __fastcall wil_details_FeatureReporting_RecordUsageInCache(uint * param_1, uint * param_2, undefined8 param_3, uint param_4)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### wil_details_FeatureReporting_RecordUsageInCache Diff
```diff
--- wil_details_FeatureReporting_RecordUsageInCache
+++ wil_details_FeatureReporting_RecordUsageInCache
@@ -1,89 +1,98 @@
uint * wil_details_FeatureReporting_RecordUsageInCache
- (uint *param_1,uint *param_2,undefined8 param_3)
+ (uint *param_1,uint *param_2,undefined8 param_3,uint param_4)
{
uint uVar1;
uint uVar2;
uint uVar3;
uint uVar4;
uint uVar5;
bool bVar6;
uVar3 = (uint)param_3;
param_1[0] = 0;
param_1[1] = 0;
param_1[2] = 0;
param_1[3] = 0;
param_1[4] = 0;
param_1[5] = 0;
if (uVar3 == 0) {
LAB_0:
wil_details_FeatureReporting_IncrementUsageInCache(param_2,uVar3,param_3,param_1);
}
else {
if (uVar3 == 1) {
LAB_1:
wil_details_FeatureReporting_IncrementOpportunityInCache(param_2,uVar3,param_3,param_1);
return param_1;
}
- uVar5 = 0;
if ((uVar3 != 2) && (uVar3 != 3)) {
if (uVar3 == 4) goto LAB_0;
if (uVar3 == 5) goto LAB_1;
if ((uVar3 != 6) && (uVar3 != 7)) {
uVar4 = uVar3 - 0x140;
if (uVar4 < 0x40) {
- uVar1 = param_2[1];
+ uVar5 = param_2[1];
do {
- if (((uVar1 & 0x10) == 0) || (uVar2 = 1, (uVar1 >> 5 & 0x3f) != uVar4)) {
- uVar2 = uVar5;
+ if (((uVar5 & 0x10) == 0) || (uVar2 = 1, (uVar5 >> 5 & 0x3f) != uVar4)) {
+ uVar2 = 0;
}
param_1[4] = uVar2;
LOCK();
uVar2 = param_2[1];
- bVar6 = uVar1 == uVar2;
+ bVar6 = uVar5 == uVar2;
if (bVar6) {
- param_2[1] = uVar1 & 0xfffff81f | (uVar4 & 0x3f) << 5 | 0x10;
- uVar2 = uVar1;
+ param_2[1] = uVar5 & 0xfffff81f | (uVar4 & 0x3f) << 5 | 0x10;
+ uVar2 = uVar5;
}
- uVar1 = uVar2;
+ uVar5 = uVar2;
UNLOCK();
} while (!bVar6);
}
param_1[2] = uVar3;
param_1[1] = 1;
- param_1[3] = 0;
+ param_1[3] = param_4;
return param_1;
}
}
+ uVar4 = 0;
if (uVar3 == 2) {
- uVar5 = 2;
+ uVar4 = 2;
}
else if (uVar3 == 3) {
- uVar5 = 8;
+ uVar4 = 8;
}
else if (uVar3 == 6) {
- uVar5 = 4;
+ uVar4 = 4;
}
else if (uVar3 == 7) {
- uVar5 = 0x10;
+ uVar4 = 0x10;
}
+ uVar5 = 1;
uVar3 = *param_2;
do {
+ uVar1 = uVar3;
+ uVar3 = uVar4 | uVar1;
+ param_1[4] = (uint)(uVar3 == uVar1);
+ uVar2 = uVar3 | 1;
+ if (uVar3 == uVar1) {
+ uVar2 = uVar3;
+ }
LOCK();
- uVar4 = *param_2;
- bVar6 = uVar3 == uVar4;
+ uVar3 = *param_2;
+ bVar6 = uVar1 == uVar3;
if (bVar6) {
- *param_2 = uVar3 | uVar5 | 1;
- uVar4 = uVar3;
+ *param_2 = uVar2;
+ uVar3 = uVar1;
}
- uVar3 = uVar4;
UNLOCK();
} while (!bVar6);
- *param_1 = ~uVar3 & 1;
- param_1[4] = (uint)((uVar5 & uVar3) == uVar5);
+ if (((uVar2 & 1) == 0) || ((uVar1 & 1) != 0)) {
+ uVar5 = 0;
+ }
+ *param_1 = uVar5;
}
return param_1;
}
```
## Feature_Servicing_WlanihvextSetIGTKAndBIGTK__private_IsEnabled
### Match Info
|Key|nw-3527.sys - nw-3733.sys|
| :---: | :---: |
|diff_type|code,name,fullname,length,sig,address,called|
|ratio|0.34|
|i_ratio|0.11|
|m_ratio|0.7|
|b_ratio|0.32|
|match_types|Implied Match|
### Function Meta Diff
|Key|nw-3527.sys|nw-3733.sys|
| :---: | :---: | :---: |
|`name`|Feature_Servicing_WlanihvextSetIGTKAndBIGTK__private_IsEnabled|Feature_Servicing_WlanihvextSetIGTKAndBIGTK__private_IsEnabledDeviceUsage|
|`fullname`|Feature_Servicing_WlanihvextSetIGTKAndBIGTK__private_IsEnabled|Feature_Servicing_WlanihvextSetIGTKAndBIGTK__private_IsEnabledDeviceUsage|
|refcount|12|12|
|`length`|94|49|
|`called`|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_GetCachedFeatureEnabledState|Feature_Servicing_WlanihvextSetIGTKAndBIGTK__private_IsEnabledFallback|
|calling|ExtSTASetMulticastCipherAlgo
ExtSTASetUnicastCipherAlgo
ExtSTASetWEPDefaultKeyValue
ExtSTASetWEPKeyMapping
QueryCapabilityRawData
UpdateCapabilityDerivedData|ExtSTASetMulticastCipherAlgo
ExtSTASetUnicastCipherAlgo
ExtSTASetWEPDefaultKeyValue
ExtSTASetWEPKeyMapping
QueryCapabilityRawData
UpdateCapabilityDerivedData|
|paramcount|0|0|
|`address`|1c0058f70|1c0059090|
|`sig`|uint __fastcall Feature_Servicing_WlanihvextSetIGTKAndBIGTK__private_IsEnabled(void)|ulonglong __fastcall Feature_Servicing_WlanihvextSetIGTKAndBIGTK__private_IsEnabledDeviceUsage(void)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### Feature_Servicing_WlanihvextSetIGTKAndBIGTK__private_IsEnabled Called Diff
```diff
--- Feature_Servicing_WlanihvextSetIGTKAndBIGTK__private_IsEnabled called
+++ Feature_Servicing_WlanihvextSetIGTKAndBIGTK__private_IsEnabledDeviceUsage called
@@ -1,2 +1 @@
-wil_details_FeatureReporting_ReportUsageToService
-wil_details_FeatureStateCache_GetCachedFeatureEnabledState
+Feature_Servicing_WlanihvextSetIGTKAndBIGTK__private_IsEnabledFallback
```
### Feature_Servicing_WlanihvextSetIGTKAndBIGTK__private_IsEnabled Diff
```diff
--- Feature_Servicing_WlanihvextSetIGTKAndBIGTK__private_IsEnabled
+++ Feature_Servicing_WlanihvextSetIGTKAndBIGTK__private_IsEnabledDeviceUsage
@@ -1,18 +1,17 @@
-uint Feature_Servicing_WlanihvextSetIGTKAndBIGTK__private_IsEnabled(void)
+ulonglong Feature_Servicing_WlanihvextSetIGTKAndBIGTK__private_IsEnabledDeviceUsage(void)
{
ulonglong uVar1;
- uint uVar2;
+ undefined8 local_res8;
- uVar1 = wil_details_FeatureStateCache_GetCachedFeatureEnabledState
- ((uint *)&Feature_Servicing_WlanihvextSetIGTKAndBIGTK__private_featureState,
- 0x1c0096f40);
- uVar2 = (uint)(uVar1 >> 3) & 1;
- wil_details_FeatureReporting_ReportUsageToService
- ((uint *)&Feature_Servicing_WlanihvextSetIGTKAndBIGTK__private_reporting,0x2c0c400,
- (uint)uVar1 >> 8 & 1,(uint)(uVar1 >> 9) & 1,
- &Feature_Servicing_WlanihvextSetIGTKAndBIGTK_logged_traits,uVar2);
- return uVar2;
+ local_res8 = (ulonglong)Feature_Servicing_WlanihvextSetIGTKAndBIGTK__private_featureState;
+ if ((Feature_Servicing_WlanihvextSetIGTKAndBIGTK__private_featureState & 0x10) == 0) {
+ uVar1 = Feature_Servicing_WlanihvextSetIGTKAndBIGTK__private_IsEnabledFallback(local_res8,3);
+ }
+ else {
+ uVar1 = (ulonglong)(Feature_Servicing_WlanihvextSetIGTKAndBIGTK__private_featureState & 1);
+ }
+ return uVar1;
}
```
## wil_details_FeatureStateCache_GetCachedFeatureEnabledState
### Match Info
|Key|nw-3527.sys - nw-3733.sys|
| :---: | :---: |
|diff_type|code,name,fullname,refcount,length,sig,address,calling,called|
|ratio|0.14|
|i_ratio|0.02|
|m_ratio|0.28|
|b_ratio|0.28|
|match_types|Implied Match|
### Function Meta Diff
|Key|nw-3527.sys|nw-3733.sys|
| :---: | :---: | :---: |
|`name`|wil_details_FeatureStateCache_GetCachedFeatureEnabledState|wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState|
|`fullname`|wil_details_FeatureStateCache_GetCachedFeatureEnabledState|wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState|
|`refcount`|4|3|
|`length`|45|249|
|`called`|wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState|_guard_dispatch_icall
wil_details_GetCurrentFeatureEnabledState|
|`calling`|Feature_Servicing_WFAQuickTrackCertRSNIE__private_IsEnabled
Feature_Servicing_WlanihvextSetIGTKAndBIGTK__private_IsEnabled
wil_details_GetCurrentFeatureEnabledState|wil_details_GetCurrentFeatureEnabledState
wil_details_IsEnabledFallback|
|paramcount|2|3|
|`address`|1c003263c|1c002115c|
|`sig`|ulonglong __fastcall wil_details_FeatureStateCache_GetCachedFeatureEnabledState(uint * param_1, longlong param_2)|ulonglong __fastcall wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState(uint * param_1, ulonglong param_2, longlong param_3)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### wil_details_FeatureStateCache_GetCachedFeatureEnabledState Called Diff
```diff
--- wil_details_FeatureStateCache_GetCachedFeatureEnabledState called
+++ wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState called
@@ -1 +1,2 @@
-wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
+_guard_dispatch_icall
+wil_details_GetCurrentFeatureEnabledState
```
### wil_details_FeatureStateCache_GetCachedFeatureEnabledState Calling Diff
```diff
--- wil_details_FeatureStateCache_GetCachedFeatureEnabledState calling
+++ wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState calling
@@ -1,2 +0,0 @@
-Feature_Servicing_WFAQuickTrackCertRSNIE__private_IsEnabled
-Feature_Servicing_WlanihvextSetIGTKAndBIGTK__private_IsEnabled
@@ -3,0 +2 @@
+wil_details_IsEnabledFallback
```
### wil_details_FeatureStateCache_GetCachedFeatureEnabledState Diff
```diff
--- wil_details_FeatureStateCache_GetCachedFeatureEnabledState
+++ wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
@@ -1,14 +1,66 @@
-ulonglong wil_details_FeatureStateCache_GetCachedFeatureEnabledState(uint *param_1,longlong param_2)
+/* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */
+
+ulonglong wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
+ (uint *param_1,ulonglong param_2,longlong param_3)
{
- undefined8 local_res8;
+ int iVar1;
+ uint uVar2;
+ ulonglong uVar3;
+ uint uVar4;
+ uint uVar5;
+ ulonglong uVar6;
+ bool bVar7;
+ uint local_res8 [2];
+ undefined8 local_res10;
- local_res8 = (ulonglong)*param_1;
- if ((*param_1 & 1) == 0) {
- local_res8 = wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
- (param_1,local_res8,param_2);
+ iVar1 = 0;
+ local_res8[0] = 0;
+ local_res10 = param_2;
+ if (g_wil_details_ensureSubscribedToFeatureConfigurationChanges != 0) {
+ iVar1 = (*(code *)g_wil_details_ensureSubscribedToFeatureConfigurationChanges)();
}
- return local_res8;
+ uVar2 = wil_details_GetCurrentFeatureEnabledState(param_3,local_res8);
+ if (*(char *)(param_3 + 0x1c) == '\0') {
+ local_res8[0] = local_res8[0] & -(uint)(iVar1 != 0);
+ }
+ uVar3 = param_2 & 0xffffffff;
+ do {
+ uVar6 = param_2;
+ uVar5 = (uint)uVar3;
+ local_res10 = CONCAT44(local_res10._4_4_,uVar5);
+ if ((local_res8[0] != 0) && (local_res10 = CONCAT44(local_res10._4_4_,uVar5), (uVar3 & 2) == 0))
+ {
+ uVar4 = (uVar5 ^ uVar2) & 0x9c1 ^ uVar5;
+ uVar5 = uVar4 | 2;
+ local_res10 = CONCAT44(local_res10._4_4_,uVar4) | 2;
+ }
+ if ((uVar6 & 4) == 0) {
+ uVar4 = uVar5 ^ (uVar2 ^ uVar5) & 0x400;
+ uVar5 = uVar4 | 4;
+ local_res10 = CONCAT44(local_res10._4_4_,uVar4) | 4;
+ }
+ uVar3 = uVar6 & 0xffffffff;
+ LOCK();
+ uVar4 = *param_1;
+ bVar7 = (uint)uVar6 == uVar4;
+ if (bVar7) {
+ *param_1 = uVar5;
+ }
+ else {
+ uVar3 = (ulonglong)uVar4;
+ }
+ UNLOCK();
+ param_2 = uVar3;
+ } while (!bVar7);
+ if (((uVar6 & 4) == 0) && (g_wil_details_subscribeFeatureStateCacheToConfigurationChanges != 0)) {
+ (*(code *)g_wil_details_subscribeFeatureStateCacheToConfigurationChanges)
+ (param_1,*(undefined1 *)(param_3 + 0x1c),iVar1);
+ }
+ if (local_res8[0] == 0) {
+ local_res10 = CONCAT44(local_res10._4_4_,uVar5 ^ (uVar2 ^ uVar5) & 0x9c1);
+ }
+ return local_res10;
}
```
## Feature_Servicing_WFAQuickTrackCertRSNIE__private_IsEnabled
### Match Info
|Key|nw-3527.sys - nw-3733.sys|
| :---: | :---: |
|diff_type|code,name,fullname,length,sig,address,called|
|ratio|0.34|
|i_ratio|0.11|
|m_ratio|0.7|
|b_ratio|0.32|
|match_types|Implied Match|
### Function Meta Diff
|Key|nw-3527.sys|nw-3733.sys|
| :---: | :---: | :---: |
|`name`|Feature_Servicing_WFAQuickTrackCertRSNIE__private_IsEnabled|Feature_Servicing_WFAQuickTrackCertRSNIE__private_IsEnabledDeviceUsage|
|`fullname`|Feature_Servicing_WFAQuickTrackCertRSNIE__private_IsEnabled|Feature_Servicing_WFAQuickTrackCertRSNIE__private_IsEnabledDeviceUsage|
|refcount|3|3|
|`length`|94|49|
|`called`|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_GetCachedFeatureEnabledState|Feature_Servicing_WFAQuickTrackCertRSNIE__private_IsEnabledFallback|
|calling|IEPRSNParseIE|IEPRSNParseIE|
|paramcount|0|0|
|`address`|1c0029db0|1c002a6a0|
|`sig`|uint __fastcall Feature_Servicing_WFAQuickTrackCertRSNIE__private_IsEnabled(void)|ulonglong __fastcall Feature_Servicing_WFAQuickTrackCertRSNIE__private_IsEnabledDeviceUsage(void)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### Feature_Servicing_WFAQuickTrackCertRSNIE__private_IsEnabled Called Diff
```diff
--- Feature_Servicing_WFAQuickTrackCertRSNIE__private_IsEnabled called
+++ Feature_Servicing_WFAQuickTrackCertRSNIE__private_IsEnabledDeviceUsage called
@@ -1,2 +1 @@
-wil_details_FeatureReporting_ReportUsageToService
-wil_details_FeatureStateCache_GetCachedFeatureEnabledState
+Feature_Servicing_WFAQuickTrackCertRSNIE__private_IsEnabledFallback
```
### Feature_Servicing_WFAQuickTrackCertRSNIE__private_IsEnabled Diff
```diff
--- Feature_Servicing_WFAQuickTrackCertRSNIE__private_IsEnabled
+++ Feature_Servicing_WFAQuickTrackCertRSNIE__private_IsEnabledDeviceUsage
@@ -1,18 +1,17 @@
-uint Feature_Servicing_WFAQuickTrackCertRSNIE__private_IsEnabled(void)
+ulonglong Feature_Servicing_WFAQuickTrackCertRSNIE__private_IsEnabledDeviceUsage(void)
{
ulonglong uVar1;
- uint uVar2;
+ undefined8 local_res8;
- uVar1 = wil_details_FeatureStateCache_GetCachedFeatureEnabledState
- ((uint *)&Feature_Servicing_WFAQuickTrackCertRSNIE__private_featureState,
- 0x1c0096f10);
- uVar2 = (uint)(uVar1 >> 3) & 1;
- wil_details_FeatureReporting_ReportUsageToService
- ((uint *)&Feature_Servicing_WFAQuickTrackCertRSNIE__private_reporting,0x2dff05f,
- (uint)uVar1 >> 8 & 1,(uint)(uVar1 >> 9) & 1,
- &Feature_Servicing_WFAQuickTrackCertRSNIE_logged_traits,uVar2);
- return uVar2;
+ local_res8 = (ulonglong)Feature_Servicing_WFAQuickTrackCertRSNIE__private_featureState;
+ if ((Feature_Servicing_WFAQuickTrackCertRSNIE__private_featureState & 0x10) == 0) {
+ uVar1 = Feature_Servicing_WFAQuickTrackCertRSNIE__private_IsEnabledFallback(local_res8,3);
+ }
+ else {
+ uVar1 = (ulonglong)(Feature_Servicing_WFAQuickTrackCertRSNIE__private_featureState & 1);
+ }
+ return uVar1;
}
```
# Modified (No Code Changes)
*Slightly modified functions have no code changes, rather differnces in:*
- refcount
- length
- called
- calling
- name
- fullname
Generated with `ghidriff` version: 1.0.0 on 2026-08-16T15:06:49