# p9_7824.sys-p9_8328.sys Diff # TOC * [Visual Chart Diff](#visual-chart-diff) * [Metadata](#metadata) * [Ghidra Diff Engine](#ghidra-diff-engine) * [Command Line](#command-line) * [Binary Metadata Diff](#binary-metadata-diff) * [Program Options](#program-options) * [Diff Stats](#diff-stats) * [Strings](#strings) * [Deleted](#deleted) * [Feature_1655910715__private_IsEnabledDeviceUsageNoInline](#feature_1655910715__private_isenableddeviceusagenoinline) * [Feature_1655910715__private_IsEnabledFallback](#feature_1655910715__private_isenabledfallback) * [Added](#added) * [Modified](#modified) * [p9fs::UserCallback::SetCallbackTimeout](#p9fsusercallbacksetcallbacktimeout) * [wil_details_IsEnabledFallback](#wil_details_isenabledfallback) * [wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState](#wil_details_evaluatefeaturedependencies_getcachedfeatureenabledstate) * [p9fs::UserCallbackManager::RegisterUserCallback](#p9fsusercallbackmanagerregisterusercallback) * [p9fs::UserCallbackManager::FindOrInsertCallbackWithLockHeld](#p9fsusercallbackmanagerfindorinsertcallbackwithlockheld) * [wil_InitializeFeatureStaging](#wil_initializefeaturestaging) * [wil_details_FeatureReporting_ReportUsageToServiceDirect](#wil_details_featurereporting_reportusagetoservicedirect) * [wil_details_EvaluateFeatureDependencies](#wil_details_evaluatefeaturedependencies) * [wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState](#wil_details_featurestatecache_reevaluatecachedfeatureenabledstate) * [wil_details_FeatureReporting_ReportUsageToService](#wil_details_featurereporting_reportusagetoservice) * [Feature_3906416953__private_IsEnabledFallback](#feature_3906416953__private_isenabledfallback) * [wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath](#wil_details_featurestatecache_tryenabledeviceusagefastpath) * [wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState](#wil_details_evaluatefeaturedependencies_getcachedfeatureenabledstate) * [Modified (No Code Changes)](#modified-no-code-changes) * [NTOSKRNL.EXE::ExAllocateTimer](#ntoskrnlexeexallocatetimer) * [DeleteTimer](#deletetimer) # Visual Chart Diff ```mermaid flowchart LR p9fsUserCallbackSetCallbackTimeout-1-old<--Match 47%-->p9fsUserCallbackSetCallbackTimeout-1-new wil_details_IsEnabledFallback-3-old<--Match 94%-->wil_details_IsEnabledFallback-3-new wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState-2-old<--Match 27%-->wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState-2-new p9fsUserCallbackManagerRegisterUserCallback-2-old<--Match 99%-->p9fsUserCallbackManagerRegisterUserCallback-2-new p9fsUserCallbackManagerFindOrInsertCallbackWithLockHeld-2-old<--Match 98%-->p9fsUserCallbackManagerFindOrInsertCallbackWithLockHeld-2-new wil_InitializeFeatureStaging-0-old<--Match 87%-->wil_InitializeFeatureStaging-0-new wil_details_FeatureReporting_ReportUsageToServiceDirect-3-old<--Match 95%-->wil_details_FeatureReporting_ReportUsageToServiceDirect-3-new wil_details_EvaluateFeatureDependencies-0-old<--Match 88%-->wil_details_EvaluateFeatureDependencies-0-new wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState-3-old<--Match 61%-->wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState-3-new wil_details_FeatureReporting_ReportUsageToService-3-old<--Match 98%-->wil_details_FeatureReporting_ReportUsageToService-3-new Feature_3906416953__private_IsEnabledFallback-2-old<--Match 89%-->Feature_3906416953__private_IsEnabledFallback-2-new wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath-3-old<--Match 90%-->wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath-3-new wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState-2-old<--Match 63%-->wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState-2-new subgraph p9_8328.sys p9fsUserCallbackSetCallbackTimeout-1-new wil_details_IsEnabledFallback-3-new wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState-2-new p9fsUserCallbackManagerRegisterUserCallback-2-new p9fsUserCallbackManagerFindOrInsertCallbackWithLockHeld-2-new wil_InitializeFeatureStaging-0-new wil_details_FeatureReporting_ReportUsageToServiceDirect-3-new wil_details_EvaluateFeatureDependencies-0-new wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState-3-new wil_details_FeatureReporting_ReportUsageToService-3-new Feature_3906416953__private_IsEnabledFallback-2-new wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath-3-new wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState-2-new end subgraph p9_7824.sys p9fsUserCallbackSetCallbackTimeout-1-old wil_details_IsEnabledFallback-3-old wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState-2-old p9fsUserCallbackManagerRegisterUserCallback-2-old p9fsUserCallbackManagerFindOrInsertCallbackWithLockHeld-2-old wil_InitializeFeatureStaging-0-old wil_details_FeatureReporting_ReportUsageToServiceDirect-3-old wil_details_EvaluateFeatureDependencies-0-old wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState-3-old wil_details_FeatureReporting_ReportUsageToService-3-old Feature_3906416953__private_IsEnabledFallback-2-old wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath-3-old wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState-2-old subgraph Deleted direction LR Feature_1655910715__private_IsEnabledDeviceUsageNoInline Feature_1655910715__private_IsEnabledFallback end end ``` ```mermaid pie showData title Function Matches - 99.7516% "unmatched_funcs_len" : 2 "matched_funcs_len" : 803 ``` ```mermaid pie showData title Matched Function Similarity - 98.0075% "matched_funcs_with_code_changes_len" : 13 "matched_funcs_with_non_code_changes_len" : 3 "matched_funcs_no_changes_len" : 787 ``` # Metadata ## Ghidra Diff Engine ### Command Line #### Captured Command Line ``` ghidriff --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --bsim --max-ram-percent 60.0 --max-section-funcs 200 p9_7824.sys p9_8328.sys ``` #### Verbose Args
``` --old ['p9_7824.sys'] --new [['p9_8328.sys']] --engine VersionTrackingDiff --output-path p9_out --summary False --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim True --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title None ```
#### Download Original PEs ``` wget https://msdl.microsoft.com/download/symbols/P9RDR.SYS/DFAA9B7C23000/P9RDR.SYS -O p9rdr.sys.x64.10.0.26100.7824 wget https://msdl.microsoft.com/download/symbols/P9RDR.SYS/2C5A663923000/P9RDR.SYS -O p9rdr.sys.x64.10.0.26100.8328 ``` ## Binary Metadata Diff ```diff --- p9_7824.sys Meta +++ p9_8328.sys Meta @@ -1,44 +1,44 @@ -Program Name: p9_7824.sys +Program Name: p9_8328.sys Language ID: x86:LE:64:default (4.6) Compiler ID: windows Processor: x86 Endian: Little Address Size: 64 Minimum Address: 140000000 Maximum Address: ff0000184f # of Bytes: 149584 # of Memory Blocks: 13 -# of Instructions: 20258 -# of Defined Data: 1177 -# of Functions: 403 +# of Instructions: 20269 +# of Defined Data: 1172 +# of Functions: 402 # of Symbols: 3965 -# of Data Types: 283 +# of Data Types: 285 # of Data Type Categories: 18 Analyzed: true Compiler: visualstudio:unknown Created With Ghidra Version: 12.0.4 -Date Created: Wed Aug 19 20:17:29 SGT 2026 +Date Created: Wed Aug 19 20:17:32 SGT 2026 Executable Format: Portable Executable (PE) -Executable Location: /tmp/pjp/p9_7824.sys -Executable MD5: ada70e7b4d390e9ade0d8c677a01bfab -Executable SHA256: f52bad554e22d669e8129ce19b7eb8507bdbbd1306284e9a3afac6316bad5e97 -FSRL: file:///tmp/pjp/p9_7824.sys?MD5=ada70e7b4d390e9ade0d8c677a01bfab +Executable Location: /tmp/pjp/p9_8328.sys +Executable MD5: 56a9bd9ed402818c3f4a1a3e5449adfe +Executable SHA256: e532c53349f770f2ba3ce7d503d7f3e24f792c09983bb5649a93b4d3c373354d +FSRL: file:///tmp/pjp/p9_8328.sys?MD5=56a9bd9ed402818c3f4a1a3e5449adfe PDB Age: 1 PDB File: p9rdr.pdb -PDB GUID: 060aa258-9f60-a684-cc3f-c25414632633 +PDB GUID: 51527953-ecbc-7183-c47e-c4cf19cf4759 PDB Loaded: true PDB Version: RSDS PE Property[CompanyName]: Microsoft Corporation PE Property[FileDescription]: Plan 9 redirector -PE Property[FileVersion]: 10.0.26100.7824 (WinBuild.160101.0800) +PE Property[FileVersion]: 10.0.26100.8328 (WinBuild.160101.0800) PE Property[InternalName]: P9RDR.SYS PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved. PE Property[OriginalFilename]: P9RDR.SYS PE Property[ProductName]: Microsoft® Windows® Operating System -PE Property[ProductVersion]: 10.0.26100.7824 +PE Property[ProductVersion]: 10.0.26100.8328 PE Property[Translation]: 4b00409 Preferred Root Namespace Category: RTTI Found: false Relocatable: true SectionAlignment: 4096 Should Ask To Analyze: false ``` ## Program Options
Ghidra p9_7824.sys Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra p9_7824.sys Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra p9_7824.sys Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.Apply Function Calling Conventions|true| |Demangler Microsoft.Apply Function Signatures|true| |Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS| |Demangler Microsoft.Demangle Only Known Mangled Symbols|false| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
Ghidra p9_8328.sys Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra p9_8328.sys Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra p9_8328.sys Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.Apply Function Calling Conventions|true| |Demangler Microsoft.Apply Function Signatures|true| |Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS| |Demangler Microsoft.Demangle Only Known Mangled Symbols|false| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
## Diff Stats |Stat|Value| | :---: | :---: | |added_funcs_len|0| |deleted_funcs_len|2| |modified_funcs_len|16| |added_symbols_len|1| |deleted_symbols_len|4| |diff_time|4.093255996704102| |deleted_strings_len|0| |added_strings_len|0| |match_types|Counter({'SymbolsHash': 396, 'ExternalsName': 107, 'ExactBytesFunctionHasher': 3, 'BSIM': 1, 'Implied Match': 1})| |items_to_process|23| |diff_types|Counter({'code': 13, 'length': 13, 'address': 12, 'sig': 7, 'called': 6, 'refcount': 5, 'calling': 4, 'name': 1, 'fullname': 1})| |unmatched_funcs_len|2| |total_funcs_len|805| |matched_funcs_len|803| |matched_funcs_with_code_changes_len|13| |matched_funcs_with_non_code_changes_len|3| |matched_funcs_no_changes_len|787| |match_func_similarity_percent|98.0075%| |func_match_overall_percent|99.7516%| |first_matches|Counter({'SymbolsHash': 396, 'ExactBytesFunctionHasher': 3, 'BSIM': 1, 'Implied Match': 1})| ```mermaid pie showData title All Matches "SymbolsHash" : 396 "ExternalsName" : 107 "ExactBytesFunctionHasher" : 3 "BSIM" : 1 "Implied-Match" : 1 ``` ```mermaid pie showData title First Matches "SymbolsHash" : 396 "ExactBytesFunctionHasher" : 3 "BSIM" : 1 "Implied-Match" : 1 ``` ```mermaid pie showData title Diff Stats "added_funcs_len" : 0 "deleted_funcs_len" : 2 "modified_funcs_len" : 16 ``` ```mermaid pie showData title Symbols "added_symbols_len" : 1 "deleted_symbols_len" : 4 ``` ## Strings *No string differences found* # Deleted ## Feature_1655910715__private_IsEnabledDeviceUsageNoInline ### Function Meta |Key|p9_7824.sys| | :---: | :---: | |name|Feature_1655910715__private_IsEnabledDeviceUsageNoInline| |fullname|Feature_1655910715__private_IsEnabledDeviceUsageNoInline| |refcount|4| |length|49| |called|Feature_1655910715__private_IsEnabledFallback| |calling|p9fs::UserCallback::SetCallbackTimeout
p9fs::UserCallbackManager::FindOrInsertCallbackWithLockHeld
p9fs::UserCallbackManager::RegisterUserCallback| |paramcount|0| |address|14000bd40| |sig|ulonglong __fastcall Feature_1655910715__private_IsEnabledDeviceUsageNoInline(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_1655910715__private_IsEnabledDeviceUsageNoInline +++ Feature_1655910715__private_IsEnabledDeviceUsageNoInline @@ -1,17 +0,0 @@ - -ulonglong Feature_1655910715__private_IsEnabledDeviceUsageNoInline(void) - -{ - ulonglong uVar1; - undefined8 local_res8; - - local_res8 = (ulonglong)(uint)Feature_1655910715__private_featureState; - if (((uint)Feature_1655910715__private_featureState & 0x10) == 0) { - uVar1 = Feature_1655910715__private_IsEnabledFallback(local_res8,3); - } - else { - uVar1 = (ulonglong)((uint)Feature_1655910715__private_featureState & 1); - } - return uVar1; -} - ``` ## Feature_1655910715__private_IsEnabledFallback ### Function Meta |Key|p9_7824.sys| | :---: | :---: | |name|Feature_1655910715__private_IsEnabledFallback| |fullname|Feature_1655910715__private_IsEnabledFallback| |refcount|2| |length|21| |called|wil_details_IsEnabledFallback| |calling|Feature_1655910715__private_IsEnabledDeviceUsageNoInline| |paramcount|2| |address|14000bd78| |sig|undefined __fastcall Feature_1655910715__private_IsEnabledFallback(ulonglong param_1, int param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_1655910715__private_IsEnabledFallback +++ Feature_1655910715__private_IsEnabledFallback @@ -1,8 +0,0 @@ - -void Feature_1655910715__private_IsEnabledFallback(ulonglong param_1,int param_2) - -{ - wil_details_IsEnabledFallback(param_1,param_2,&Feature_1655910715__private_descriptor); - return; -} - ``` # Added # Modified *Modified functions contain code changes* ## p9fs::UserCallback::SetCallbackTimeout ### Match Info |Key|p9_7824.sys - p9_8328.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.33| |i_ratio|0.4| |m_ratio|0.6| |b_ratio|0.47| |match_types|SymbolsHash| ### Function Meta Diff |Key|p9_7824.sys|p9_8328.sys| | :---: | :---: | :---: | |name|SetCallbackTimeout|SetCallbackTimeout| |fullname|p9fs::UserCallback::SetCallbackTimeout|p9fs::UserCallback::SetCallbackTimeout| |refcount|3|3| |`length`|155|69| |`called`|Feature_1655910715__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAllocateTimer
NTOSKRNL.EXE::ExSetTimer
p9fs::details::DeleteTimer|NTOSKRNL.EXE::ExSetTimer| |calling|p9fs::UserCallback::AddWaiter
p9fs::UserCallbackManager::NotifyUserProcess|p9fs::UserCallback::AddWaiter
p9fs::UserCallbackManager::NotifyUserProcess| |paramcount|1|1| |`address`|14000bc1c|14000bc20| |sig|long __thiscall SetCallbackTimeout(UserCallback * this)|long __thiscall SetCallbackTimeout(UserCallback * this)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### p9fs::UserCallback::SetCallbackTimeout Called Diff ```diff --- p9fs::UserCallback::SetCallbackTimeout called +++ p9fs::UserCallback::SetCallbackTimeout called @@ -1,2 +0,0 @@ -Feature_1655910715__private_IsEnabledDeviceUsageNoInline -NTOSKRNL.EXE::ExAllocateTimer @@ -4 +1,0 @@ -p9fs::details::DeleteTimer ``` ### p9fs::UserCallback::SetCallbackTimeout Diff ```diff --- p9fs::UserCallback::SetCallbackTimeout +++ p9fs::UserCallback::SetCallbackTimeout @@ -1,41 +1,29 @@ /* private: long __cdecl p9fs::UserCallback::SetCallbackTimeout(void) __ptr64 */ long __thiscall p9fs::UserCallback::SetCallbackTimeout(UserCallback *this) { - undefined8 uVar1; - code *pcVar2; - ulonglong uVar3; - longlong lVar4; - undefined1 *puVar5; + longlong lVar1; + undefined8 uVar2; + code *pcVar3; + undefined1 *puVar4; undefined1 auStack_28 [8]; - undefined1 auStack_20 [24]; + undefined1 auStack_20 [32]; - puVar5 = auStack_28; - uVar3 = Feature_1655910715__private_IsEnabledDeviceUsageNoInline(); - if (((int)uVar3 == 0) && (*(longlong *)(this + 0x48) == 0)) { - lVar4 = ExAllocateTimer(TimerCallback,this,0); - if (*(_EX_TIMER **)(this + 0x48) != (_EX_TIMER *)0x0) { - details::DeleteTimer(*(_EX_TIMER **)(this + 0x48)); - } - *(longlong *)(this + 0x48) = lVar4; - if (lVar4 == 0) { - return -0x3fffff66; - } - } + puVar4 = auStack_28; LOCK(); - lVar4 = *(longlong *)this; + lVar1 = *(longlong *)this; *(longlong *)this = *(longlong *)this + 1; UNLOCK(); - if (lVar4 + 1 < 2) { - pcVar2 = (code *)swi(0x29); - (*pcVar2)(0xe); - puVar5 = auStack_20; + if (lVar1 + 1 < 2) { + pcVar3 = (code *)swi(0x29); + (*pcVar3)(0xe); + puVar4 = auStack_20; } - uVar1 = *(undefined8 *)(this + 0x48); - *(undefined8 *)(puVar5 + -8) = 0x14000bca5; - ExSetTimer(uVar1,0xfffffffff4143e00,0,0); + uVar2 = *(undefined8 *)(this + 0x48); + *(undefined8 *)(puVar4 + -8) = 0x14000bc59; + ExSetTimer(uVar2,0xfffffffff4143e00,0,0); return 0; } ``` ## wil_details_IsEnabledFallback ### Match Info |Key|p9_7824.sys - p9_8328.sys| | :---: | :---: | |diff_type|code,refcount,length,sig,address,calling| |ratio|0.48| |i_ratio|0.43| |m_ratio|0.96| |b_ratio|0.94| |match_types|SymbolsHash| ### Function Meta Diff |Key|p9_7824.sys|p9_8328.sys| | :---: | :---: | :---: | |name|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |fullname|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |`refcount`|3|2| |`length`|140|135| |called|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath| |`calling`|Feature_1655910715__private_IsEnabledFallback
Feature_3906416953__private_IsEnabledFallback|Feature_3906416953__private_IsEnabledFallback| |paramcount|3|2| |`address`|140007f0c|140007f34| |`sig`|uint __fastcall wil_details_IsEnabledFallback(ulonglong param_1, int param_2, undefined8 * param_3)|uint __fastcall wil_details_IsEnabledFallback(undefined8 * param_1, uint param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### wil_details_IsEnabledFallback Calling Diff ```diff --- wil_details_IsEnabledFallback calling +++ wil_details_IsEnabledFallback calling @@ -1 +0,0 @@ -Feature_1655910715__private_IsEnabledFallback ``` ### wil_details_IsEnabledFallback Diff ```diff --- wil_details_IsEnabledFallback +++ wil_details_IsEnabledFallback @@ -1,22 +1,26 @@ -uint wil_details_IsEnabledFallback(ulonglong param_1,int param_2,undefined8 *param_3) +uint wil_details_IsEnabledFallback(undefined8 *param_1,uint param_2) { uint uVar1; - ulonglong local_res8; + undefined8 *puVar2; + ulonglong local_res18; uVar1 = (uint)param_1; - local_res8 = param_1 & 0xffffffff; - if ((param_1 & 2) == 0) { - local_res8 = wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState - ((uint *)*param_3,param_1,(longlong)param_3); - uVar1 = (uint)local_res8; + local_res18 = (ulonglong)param_1 & 0xffffffff; + if (((ulonglong)param_1 & 2) == 0) { + puVar2 = &Feature_3906416953__private_featureState; + local_res18 = wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState + ((uint *)&Feature_3906416953__private_featureState,(ulonglong)param_1, + 0x140019730); + param_1 = puVar2; + uVar1 = (uint)local_res18; } if ((param_2 != 0) && - (wil_details_FeatureReporting_ReportUsageToService((longlong)param_3,local_res8,param_2), - param_2 - 3U < 2)) { - wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath((uint)local_res8,param_2,param_3); + (wil_details_FeatureReporting_ReportUsageToService(param_1,local_res18,param_2), + param_2 - 3 < 2)) { + wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath((uint)local_res18,param_2); } return uVar1 & 1; } ``` ## wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState ### Match Info |Key|p9_7824.sys - p9_8328.sys| | :---: | :---: | |diff_type|code,refcount,length,sig,address,calling,called| |ratio|0.16| |i_ratio|0.02| |m_ratio|0.27| |b_ratio|0.27| |match_types|SymbolsHash| ### Function Meta Diff |Key|p9_7824.sys|p9_8328.sys| | :---: | :---: | :---: | |name|wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState|wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState| |fullname|wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState|wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState| |`refcount`|3|2| |`length`|243|47| |`called`|wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState|wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState| |`calling`|wil_details_EvaluateFeatureDependencies
wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState|wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState| |paramcount|2|2| |`address`|14001e17c|14001e1a4| |`sig`|uint __fastcall wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState(uint * param_1, longlong param_2)|ulonglong __fastcall wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState(uint * param_1, undefined8 param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState Called Diff ```diff --- wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState called +++ wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState called @@ -1 +1 @@ -wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState +wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState ``` ### wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState Calling Diff ```diff --- wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState calling +++ wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState calling @@ -1,2 +1 @@ -wil_details_EvaluateFeatureDependencies -wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState +wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState ``` ### wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState Diff ```diff --- wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState +++ wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState @@ -1,63 +1,19 @@ -uint wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState - (uint *param_1,longlong param_2) +ulonglong wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState + (uint *param_1,longlong param_2) { uint uVar1; - undefined8 *puVar2; - uint uVar3; - uint uVar4; - longlong *plVar5; - uint uVar6; - bool bVar7; + undefined4 extraout_var; + undefined8 local_res8; - uVar6 = *param_1; - uVar3 = uVar6; - if ((uVar6 >> 9 & 1) != 0) { - uVar4 = uVar6 >> 6 & 1; - if ((uVar4 != 0) && (plVar5 = *(longlong **)(param_2 + 0x20), plVar5 != (longlong *)0x0)) { - do { - while( true ) { - puVar2 = (undefined8 *)*plVar5; - if (puVar2 == (undefined8 *)0x0) goto LAB_0; - if ((*(char *)((longlong)puVar2 + 0x1e) == '\0') && - (*(char *)((longlong)puVar2 + 0x1d) == '\0')) break; - if ((uVar4 == 0) || (*(char *)((longlong)puVar2 + 0x1f) == '\0')) { - uVar4 = 0; - goto LAB_0; - } - uVar4 = 1; - plVar5 = plVar5 + 1; - } - uVar3 = wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState - ((uint *)*puVar2,(longlong)puVar2); - if ((uVar4 == 0) || ((uVar3 & 1) == 0)) { - uVar4 = 0; - } - else { - uVar4 = 1; - } - plVar5 = plVar5 + 1; - } while (uVar4 != 0); - } -LAB_0: - do { - uVar3 = uVar6 & 0xffffffce; - if ((uVar6 & 1) == uVar4) { - uVar3 = uVar6 & 0xfffffffe; - } - uVar3 = uVar3 & 0xfffffdff | uVar4; - LOCK(); - uVar1 = *param_1; - bVar7 = uVar6 == uVar1; - if (bVar7) { - *param_1 = uVar3; - uVar1 = uVar6; - } - uVar6 = uVar1; - UNLOCK(); - } while (!bVar7); + uVar1 = *param_1; + local_res8 = (ulonglong)uVar1; + if ((uVar1 >> 9 & 1) != 0) { + uVar1 = wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState + (param_1,uVar1,param_2); + local_res8 = CONCAT44(extraout_var,uVar1); } - return uVar3; + return local_res8; } ``` ## p9fs::UserCallbackManager::RegisterUserCallback ### Match Info |Key|p9_7824.sys - p9_8328.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.91| |i_ratio|0.65| |m_ratio|0.99| |b_ratio|0.99| |match_types|SymbolsHash| ### Function Meta Diff |Key|p9_7824.sys|p9_8328.sys| | :---: | :---: | :---: | |name|RegisterUserCallback|RegisterUserCallback| |fullname|p9fs::UserCallbackManager::RegisterUserCallback|p9fs::UserCallbackManager::RegisterUserCallback| |refcount|2|2| |`length`|890|873| |`called`|
Expand for full list:
Feature_1655910715__private_IsEnabledDeviceUsageNoInline
Feature_3906416953__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx
NTOSKRNL.EXE::ExReleasePushLockExclusiveEx
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::SeCaptureSubjectContext
NTOSKRNL.EXE::SeReleaseSubjectContext
OnFailure
RDBSS.SYS::RxSetMinirdrCancelRoutine
operator_newp9fs::GetLogonInformation
p9fs::UserCallback::CompleteRequest
p9fs::UserCallback::Initialize
p9fs::UserCallback::ReleaseReference
p9fs::UserCallback::RemoveFromList
p9fs::UserCallback::ReplyCallback
p9fs::UserCallback::UserCallback
p9fs::UserCallbackManager::FindCallbackWithLockHeld
p9fs::UserCallbackManager::ResumeWaiters
|
Expand for full list:
Feature_3906416953__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx
NTOSKRNL.EXE::ExReleasePushLockExclusiveEx
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::SeCaptureSubjectContext
NTOSKRNL.EXE::SeReleaseSubjectContext
RDBSS.SYS::RxSetMinirdrCancelRoutine
operator_new
p9fs::GetLogonInformation
p9fs::TraceLogp9fs::UserCallback::CompleteRequest
p9fs::UserCallback::Initialize
p9fs::UserCallback::ReleaseReference
p9fs::UserCallback::RemoveFromList
p9fs::UserCallback::ReplyCallback
p9fs::UserCallback::UserCallback
p9fs::UserCallbackManager::FindCallbackWithLockHeld
p9fs::UserCallbackManager::ResumeWaiters
| |calling|p9fs::P9DevFcbXXXControlFile|p9fs::P9DevFcbXXXControlFile| |paramcount|2|2| |`address`|14000b468|14000b480| |sig|long __thiscall RegisterUserCallback(UserCallbackManager * this, _RX_CONTEXT * param_1)|long __thiscall RegisterUserCallback(UserCallbackManager * this, _RX_CONTEXT * param_1)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### p9fs::UserCallbackManager::RegisterUserCallback Called Diff ```diff --- p9fs::UserCallbackManager::RegisterUserCallback called +++ p9fs::UserCallbackManager::RegisterUserCallback called @@ -1 +0,0 @@ -Feature_1655910715__private_IsEnabledDeviceUsageNoInline @@ -9 +7,0 @@ -OnFailure @@ -12,0 +11 @@ +p9fs::TraceLog ``` ### p9fs::UserCallbackManager::RegisterUserCallback Diff ```diff --- p9fs::UserCallbackManager::RegisterUserCallback +++ p9fs::UserCallbackManager::RegisterUserCallback @@ -1,169 +1,169 @@ /* public: long __cdecl p9fs::UserCallbackManager::RegisterUserCallback(struct _RX_CONTEXT * __ptr64) __ptr64 */ long __thiscall p9fs::UserCallbackManager::RegisterUserCallback(UserCallbackManager *this,_RX_CONTEXT *param_1) { UserCallbackManager *pUVar1; longlong lVar2; code *pcVar3; undefined8 uVar4; int iVar5; long lVar6; undefined8 *puVar7; ulonglong uVar8; longlong *plVar9; UserCallback *pUVar10; UserCallback *this_00; undefined1 *puVar11; bool bVar12; UserCallback *local_res8; UserCallback *local_res18; undefined1 auStack_e8 [8]; undefined1 auStack_e0 [24]; UserCallbackManager *local_c8; undefined8 local_b8; longlong lStack_b0; undefined8 uStack_a8; longlong local_98; undefined8 uStack_90; undefined8 local_88; longlong lStack_80; char *local_78; char *local_70; undefined8 local_68; char *local_60; undefined1 local_58 [48]; puVar11 = auStack_e8; SeCaptureSubjectContext(local_58); puVar7 = (undefined8 *)GetLogonInformation((_SECURITY_SUBJECT_CONTEXT *)&local_78); uVar4 = *puVar7; lVar2 = puVar7[1]; local_b8 = uVar4; lStack_b0 = lVar2; SeReleaseSubjectContext(local_58); pUVar1 = this + 0x10; local_88 = uVar4; lStack_80 = lVar2; KeEnterCriticalRegion(); ExAcquirePushLockExclusiveEx(pUVar1,0); local_98 = 0; uStack_90 = 0; uVar8 = Feature_3906416953__private_IsEnabledDeviceUsageNoInline(); if (((int)uVar8 != 0) && (*(uint *)(param_1 + 0x22c) < 0x202)) { - local_68 = 0x1af; + local_68 = 0x1a4; local_78 = "onecore\\vm\\dv\\storage\\plan9\\rdr\\sys\\usercallback.cpp"; local_70 = "p9fs::UserCallbackManager::RegisterUserCallback"; local_60 = "P9: User callback buffer too small: %lu bytes.\n"; - OnFailure((ErrorSite *)&local_78,-0x3fffffff); + TraceLog((ErrorSite *)&local_78,-0x3fffffff); if (pUVar1 != (UserCallbackManager *)0x0) { ExReleasePushLockExclusiveEx(pUVar1,0); KeLeaveCriticalRegion(); } return -0x3fffffdd; } FindCallbackWithLockHeld(this,&local_res8,local_b8); bVar12 = false; this_00 = local_res8; if (local_res8 == (UserCallback *)0x0) { plVar9 = (longlong *)FindCallbackWithLockHeld(this,&local_res18,lStack_b0); this_00 = (UserCallback *)*plVar9; *plVar9 = 0; local_res8 = this_00; if (local_res18 != (UserCallback *)0x0) { UserCallback::ReleaseReference(local_res18); } bVar12 = this_00 == (UserCallback *)0x0; } if (bVar12) { pUVar10 = operator_new(0x58); if ((pUVar10 == (UserCallback *)0x0) || (local_c8 = this, pUVar10 = (UserCallback *)UserCallback::UserCallback(pUVar10,param_1,local_b8,lStack_b0), pUVar10 == (UserCallback *)0x0)) { if (this_00 != (UserCallback *)0x0) { UserCallback::ReleaseReference(this_00); } if (pUVar1 != (UserCallbackManager *)0x0) { ExReleasePushLockExclusiveEx(pUVar1,0); KeLeaveCriticalRegion(); } return -0x3fffff66; } - uVar8 = Feature_1655910715__private_IsEnabledDeviceUsageNoInline(); - if (((int)uVar8 != 0) && (lVar6 = UserCallback::Initialize(pUVar10), lVar6 < 0)) { + lVar6 = UserCallback::Initialize(pUVar10); + if (lVar6 < 0) { UserCallback::RemoveFromList(pUVar10); UserCallback::ReleaseReference(pUVar10); if (this_00 != (UserCallback *)0x0) { UserCallback::ReleaseReference(this_00); } if (pUVar1 == (UserCallbackManager *)0x0) { return lVar6; } ExReleasePushLockExclusiveEx(pUVar1,0); KeLeaveCriticalRegion(); return lVar6; } } else { UserCallback::ReplyCallback(this_00,(_RX_CONTEXT *)&local_b8,(LogonInformation *)param_1); if (local_b8._0_1_ == (_RX_CONTEXT)0x0) { local_60 = (char *)0x0; local_78 = "onecore\\vm\\dv\\storage\\plan9\\rdr\\sys\\usercallback.cpp"; local_70 = "p9fs::UserCallbackManager::RegisterUserCallback"; - local_68 = 0x1c1; - OnFailure((ErrorSite *)&local_78,(long)lStack_b0); + local_68 = 0x1b6; + TraceLog((ErrorSite *)&local_78,(long)lStack_b0); if (this_00 != (UserCallback *)0x0) { UserCallback::ReleaseReference(this_00); } if (pUVar1 != (UserCallbackManager *)0x0) { ExReleasePushLockExclusiveEx(pUVar1,0); KeLeaveCriticalRegion(); } return (long)lStack_b0; } local_98 = lStack_b0; uStack_90 = uStack_a8; pUVar10 = this_00; } *(UserCallbackManager **)(param_1 + 0xd0) = this; *(UserCallback **)(param_1 + 0xd8) = pUVar10; LOCK(); lVar2 = *(longlong *)pUVar10; *(longlong *)pUVar10 = *(longlong *)pUVar10 + 1; UNLOCK(); if (lVar2 + 1 < 2) { pcVar3 = (code *)swi(0x29); (*pcVar3)(0xe); puVar11 = auStack_e0; } - *(undefined8 *)(puVar11 + -8) = 0x14000b683; + *(undefined8 *)(puVar11 + -8) = 0x14000b69b; iVar5 = RxSetMinirdrCancelRoutine(param_1,CancelRxContext); if (iVar5 < 0) { - *(undefined8 *)(puVar11 + -8) = 0x14000b694; + *(undefined8 *)(puVar11 + -8) = 0x14000b6ac; UserCallback::RemoveFromList(pUVar10); - *(undefined8 *)(puVar11 + -8) = 0x14000b6a4; + *(undefined8 *)(puVar11 + -8) = 0x14000b6bc; UserCallback::CompleteRequest(pUVar10,-0x3ffffee0,0); - *(undefined8 *)(puVar11 + -8) = 0x14000b6ac; + *(undefined8 *)(puVar11 + -8) = 0x14000b6c4; UserCallback::ReleaseReference(pUVar10); } if (pUVar1 != (UserCallbackManager *)0x0) { - *(undefined8 *)(puVar11 + -8) = 0x14000b6bd; + *(undefined8 *)(puVar11 + -8) = 0x14000b6d5; ExReleasePushLockExclusiveEx(pUVar1,0); - *(undefined8 *)(puVar11 + -8) = 0x14000b6c9; + *(undefined8 *)(puVar11 + -8) = 0x14000b6e1; KeLeaveCriticalRegion(); } if (local_98 != 0) { - *(undefined8 *)(puVar11 + -8) = 0x14000b6de; + *(undefined8 *)(puVar11 + -8) = 0x14000b6f6; ResumeWaiters((WaiterList *)&local_98); } if (local_res8 != (UserCallback *)0x0) { - *(undefined8 *)(puVar11 + -8) = 0x14000b6ec; + *(undefined8 *)(puVar11 + -8) = 0x14000b704; UserCallback::ReleaseReference(local_res8); } return 0x103; } ``` ## p9fs::UserCallbackManager::FindOrInsertCallbackWithLockHeld ### Match Info |Key|p9_7824.sys - p9_8328.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.82| |i_ratio|0.72| |m_ratio|0.98| |b_ratio|0.98| |match_types|SymbolsHash| ### Function Meta Diff |Key|p9_7824.sys|p9_8328.sys| | :---: | :---: | :---: | |name|FindOrInsertCallbackWithLockHeld|FindOrInsertCallbackWithLockHeld| |fullname|p9fs::UserCallbackManager::FindOrInsertCallbackWithLockHeld|p9fs::UserCallbackManager::FindOrInsertCallbackWithLockHeld| |refcount|2|2| |`length`|216|207| |`called`|Feature_1655910715__private_IsEnabledDeviceUsageNoInline
operator_new
p9fs::UserCallback::Initialize
p9fs::UserCallback::ReleaseReference
p9fs::UserCallback::RemoveFromList
p9fs::UserCallback::UserCallback
p9fs::UserCallbackManager::FindCallbackWithLockHeld|operator_new
p9fs::UserCallback::Initialize
p9fs::UserCallback::ReleaseReference
p9fs::UserCallback::RemoveFromList
p9fs::UserCallback::UserCallback
p9fs::UserCallbackManager::FindCallbackWithLockHeld| |calling|p9fs::UserCallbackManager::NotifyUserProcess|p9fs::UserCallbackManager::NotifyUserProcess| |paramcount|2|2| |`address`|14000b0e0|14000b100| |sig|SharedPtr __thiscall FindOrInsertCallbackWithLockHeld(UserCallbackManager * this, _LUID param_1)|SharedPtr __thiscall FindOrInsertCallbackWithLockHeld(UserCallbackManager * this, _LUID param_1)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### p9fs::UserCallbackManager::FindOrInsertCallbackWithLockHeld Called Diff ```diff --- p9fs::UserCallbackManager::FindOrInsertCallbackWithLockHeld called +++ p9fs::UserCallbackManager::FindOrInsertCallbackWithLockHeld called @@ -1 +0,0 @@ -Feature_1655910715__private_IsEnabledDeviceUsageNoInline ``` ### p9fs::UserCallbackManager::FindOrInsertCallbackWithLockHeld Diff ```diff --- p9fs::UserCallbackManager::FindOrInsertCallbackWithLockHeld +++ p9fs::UserCallbackManager::FindOrInsertCallbackWithLockHeld @@ -1,58 +1,57 @@ -/* WARNING: Removing unreachable block (ram,0x00014000b16f) */ +/* WARNING: Removing unreachable block (ram,0x00014000b186) */ /* private: class p9fs::SharedPtr __cdecl p9fs::UserCallbackManager::FindOrInsertCallbackWithLockHeld(struct _LUID) __ptr64 */ longlong * __thiscall p9fs::UserCallbackManager::FindOrInsertCallbackWithLockHeld (UserCallbackManager *this,longlong *param_2,undefined8 param_3) { longlong lVar1; code *pcVar2; long lVar3; UserCallback *pUVar4; - ulonglong uVar5; - undefined1 *puVar6; + undefined1 *puVar5; longlong local_res20; undefined1 auStack_38 [8]; undefined1 auStack_30 [24]; UserCallbackManager *local_18; - puVar6 = auStack_38; + puVar5 = auStack_38; FindCallbackWithLockHeld(this,&local_res20); if (local_res20 == 0) { pUVar4 = operator_new(0x58); if ((pUVar4 != (UserCallback *)0x0) && (local_18 = this, pUVar4 = (UserCallback *)UserCallback::UserCallback(pUVar4,0,param_3,0), pUVar4 != (UserCallback *)0x0)) { - uVar5 = Feature_1655910715__private_IsEnabledDeviceUsageNoInline(); - if (((int)uVar5 == 0) || (lVar3 = UserCallback::Initialize(pUVar4), -1 < lVar3)) { + lVar3 = UserCallback::Initialize(pUVar4); + if (-1 < lVar3) { *param_2 = (longlong)pUVar4; LOCK(); lVar1 = *(longlong *)pUVar4; *(longlong *)pUVar4 = *(longlong *)pUVar4 + 1; UNLOCK(); if (lVar1 + 1 < 2) { pcVar2 = (code *)swi(0x29); (*pcVar2)(0xe); - puVar6 = auStack_30; + puVar5 = auStack_30; } - if (*(UserCallback **)(puVar6 + 0x58) == (UserCallback *)0x0) { + if (*(UserCallback **)(puVar5 + 0x58) == (UserCallback *)0x0) { return param_2; } - *(undefined8 *)(puVar6 + -8) = 0x14000b177; - UserCallback::ReleaseReference(*(UserCallback **)(puVar6 + 0x58)); + *(undefined8 *)(puVar5 + -8) = 0x14000b18e; + UserCallback::ReleaseReference(*(UserCallback **)(puVar5 + 0x58)); return param_2; } UserCallback::RemoveFromList(pUVar4); UserCallback::ReleaseReference(pUVar4); } *param_2 = 0; } else { *param_2 = local_res20; } return param_2; } ``` ## wil_InitializeFeatureStaging ### Match Info |Key|p9_7824.sys - p9_8328.sys| | :---: | :---: | |diff_type|code,length| |ratio|0.83| |i_ratio|0.28| |m_ratio|0.89| |b_ratio|0.87| |match_types|SymbolsHash| ### Function Meta Diff |Key|p9_7824.sys|p9_8328.sys| | :---: | :---: | :---: | |name|wil_InitializeFeatureStaging|wil_InitializeFeatureStaging| |fullname|wil_InitializeFeatureStaging|wil_InitializeFeatureStaging| |refcount|2|2| |`length`|266|329| |called|NTOSKRNL.EXE::RtlQueryFeatureConfigurationChangeStamp
NTOSKRNL.EXE::RtlRegisterFeatureConfigurationChangeNotification
NTOSKRNL.EXE::RtlRegisterFeatureUsageProvider
wil_details_EvaluateFeatureDependencies
wil_details_PopulateInitialConfiguredFeatureStates|NTOSKRNL.EXE::RtlQueryFeatureConfigurationChangeStamp
NTOSKRNL.EXE::RtlRegisterFeatureConfigurationChangeNotification
NTOSKRNL.EXE::RtlRegisterFeatureUsageProvider
wil_details_EvaluateFeatureDependencies
wil_details_PopulateInitialConfiguredFeatureStates| |calling|DriverEntry|DriverEntry| |paramcount|0|0| |address|14001f078|14001f078| |sig|int __fastcall wil_InitializeFeatureStaging(void)|int __fastcall wil_InitializeFeatureStaging(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### wil_InitializeFeatureStaging Diff ```diff --- wil_InitializeFeatureStaging +++ wil_InitializeFeatureStaging @@ -1,59 +1,70 @@ int wil_InitializeFeatureStaging(void) { bool bVar1; int iVar2; undefined **ppuVar3; + undefined **ppuVar4; undefined8 local_res8; + undefined **local_28; + undefined8 *local_20; + undefined8 local_18; bVar1 = false; if (g_wil_details_isFeatureStagingInitialized == 0) { g_wil_details_isFeatureStagingInitialized = 1; local_res8 = RtlQueryFeatureConfigurationChangeStamp(); wil_details_PopulateInitialConfiguredFeatureStates(); wil_details_EvaluateFeatureDependencies(); - for (ppuVar3 = &wil_details_featureDescriptors_a; ppuVar3 < &wil_details_featureDescriptors_z; - ppuVar3 = ppuVar3 + 1) { + ppuVar4 = &wil_details_featureDescriptors_a; + ppuVar3 = &wil_details_featureDescriptors_a; + do { if (*ppuVar3 != (undefined *)0x0) goto LAB_0; - } + ppuVar3 = ppuVar3 + 1; + } while (ppuVar3 < &wil_details_featureDescriptors_z); LAB_1: g_wil_details_recordFeatureUsage = wil_details_RecordFeatureUsageReporting; + for (; (local_28 = (undefined **)0x0, ppuVar4 < &wil_details_featureDescriptors_z && + (local_28 = ppuVar4, *ppuVar4 == (undefined *)0x0)); ppuVar4 = ppuVar4 + 1) { + } + local_20 = &wil_details_featureDescriptors_z; + local_18 = 0; iVar2 = RtlRegisterFeatureUsageProvider - (wil_details_OnFeatureUsageProviderFlushNotification,0, + (wil_details_OnFeatureUsageProviderFlushNotification,&local_28, &g_wil_details_featureUsageProvider); if (iVar2 != 0) { if (!bVar1) { g_wil_details_featureUsageProvider = 0; return iVar2; } g_wil_details_featureUsageProvider = 0; return 0; } } return 0; LAB_0: if (ppuVar3 == (undefined **)0x0) goto LAB_1; if (((*(char *)((longlong)ppuVar3 + 0x1d) == '\0') && (*(char *)((longlong)ppuVar3 + 0x1e) == '\0')) && (*(char *)((longlong)ppuVar3 + 0x1c) == '\0')) { iVar2 = RtlRegisterFeatureConfigurationChangeNotification (wil_details_ReevaluateOnFeatureConfigurationChange,0,&local_res8, &g_wil_details_featureChangeNotification); if (iVar2 == 0) { bVar1 = true; } else { g_wil_details_featureChangeNotification = 0; } goto LAB_1; } ppuVar3 = ppuVar3 + 7; while( true ) { - if (&UNK_2 < ppuVar3) goto LAB_14001f139; + if (&UNK_2 < ppuVar3) goto LAB_14001f149; if (*ppuVar3 != (undefined *)0x0) break; ppuVar3 = ppuVar3 + 1; } goto LAB_0; } ``` ## wil_details_FeatureReporting_ReportUsageToServiceDirect ### Match Info |Key|p9_7824.sys - p9_8328.sys| | :---: | :---: | |diff_type|code,length,sig,address| |ratio|0.33| |i_ratio|0.59| |m_ratio|0.95| |b_ratio|0.95| |match_types|SymbolsHash| ### Function Meta Diff |Key|p9_7824.sys|p9_8328.sys| | :---: | :---: | :---: | |name|wil_details_FeatureReporting_ReportUsageToServiceDirect|wil_details_FeatureReporting_ReportUsageToServiceDirect| |fullname|wil_details_FeatureReporting_ReportUsageToServiceDirect|wil_details_FeatureReporting_ReportUsageToServiceDirect| |refcount|2|2| |`length`|232|226| |called|NTOSKRNL.EXE::RtlNotifyFeatureUsage
__security_check_cookie
_guard_dispatch_icall
wil_details_FeatureReporting_RecordUsageInCache|NTOSKRNL.EXE::RtlNotifyFeatureUsage
__security_check_cookie
_guard_dispatch_icall
wil_details_FeatureReporting_RecordUsageInCache| |calling|wil_details_FeatureReporting_ReportUsageToService|wil_details_FeatureReporting_ReportUsageToService| |paramcount|3|3| |`address`|140007b4c|140007b3c| |`sig`|bool __fastcall wil_details_FeatureReporting_ReportUsageToServiceDirect(longlong param_1, undefined8 param_2, uint param_3)|bool __fastcall wil_details_FeatureReporting_ReportUsageToServiceDirect(undefined8 param_1, undefined8 param_2, uint param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### wil_details_FeatureReporting_ReportUsageToServiceDirect Diff ```diff --- wil_details_FeatureReporting_ReportUsageToServiceDirect +++ wil_details_FeatureReporting_ReportUsageToServiceDirect @@ -1,46 +1,46 @@ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ bool wil_details_FeatureReporting_ReportUsageToServiceDirect - (longlong param_1,undefined8 param_2,uint param_3) + (undefined8 param_1,undefined8 param_2,uint param_3) { uint6 uVar1; uint *puVar2; - undefined1 auStack_98 [32]; - uint *local_78; - undefined8 local_68; - uint local_60 [6]; - uint local_48; - uint uStack_44; - uint uStack_40; - uint uStack_3c; - undefined8 local_38; - ulonglong local_30; + undefined1 auStack_88 [32]; + uint *local_68; + undefined8 local_58; + uint local_50 [6]; + uint local_38; + uint uStack_34; + uint uStack_30; + uint uStack_2c; + undefined8 local_28; + ulonglong local_20; - local_30 = __security_cookie ^ (ulonglong)auStack_98; + local_20 = __security_cookie ^ (ulonglong)auStack_88; puVar2 = wil_details_FeatureReporting_RecordUsageInCache - (local_60,*(uint **)(param_1 + 8),param_3,(uint)((ulonglong)param_2 >> 0x20)); - local_48 = *puVar2; - uStack_44 = puVar2[1]; - uStack_40 = puVar2[2]; - uStack_3c = puVar2[3]; - local_38 = *(undefined8 *)(puVar2 + 4); + (local_50,&Feature_3906416953__private_reporting,param_3, + (uint)((ulonglong)param_2 >> 0x20)); + local_38 = *puVar2; + uStack_34 = puVar2[1]; + uStack_30 = puVar2[2]; + uStack_2c = puVar2[3]; + local_28 = *(undefined8 *)(puVar2 + 4); if (g_wil_details_recordFeatureUsage != (code *)0x0) { - local_78 = &local_48; - (*g_wil_details_recordFeatureUsage) - (*(undefined4 *)(param_1 + 0x18),param_3,1,*(undefined8 *)(param_1 + 8)); + local_68 = &local_38; + (*g_wil_details_recordFeatureUsage)(0x3906b24,param_3,1,&Feature_3906416953__private_reporting); } if ((((uint)param_2 >> 10 & 1) != 0) && (param_3 != 0xfe)) { - local_68._0_6_ = CONCAT24((short)param_3,*(undefined4 *)(param_1 + 0x18)); - uVar1 = (uint6)local_68; - local_68 = (ulonglong)(uint6)local_68; + local_58._0_6_ = CONCAT24((short)param_3,0x3906b24); + uVar1 = (uint6)local_58; + local_58 = (ulonglong)(uint6)local_58; if (((uint)param_2 >> 0xb & 1) != 0) { - local_68 = CONCAT26(1,uVar1); + local_58 = CONCAT26(1,uVar1); } - RtlNotifyFeatureUsage(&local_68); + RtlNotifyFeatureUsage(&local_58); } - return (int)local_38 == 0; + return (int)local_28 == 0; } ``` ## wil_details_EvaluateFeatureDependencies ### Match Info |Key|p9_7824.sys - p9_8328.sys| | :---: | :---: | |diff_type|code,length,called| |ratio|0.8| |i_ratio|0.32| |m_ratio|0.95| |b_ratio|0.88| |match_types|SymbolsHash| ### Function Meta Diff |Key|p9_7824.sys|p9_8328.sys| | :---: | :---: | :---: | |name|wil_details_EvaluateFeatureDependencies|wil_details_EvaluateFeatureDependencies| |fullname|wil_details_EvaluateFeatureDependencies|wil_details_EvaluateFeatureDependencies| |refcount|3|3| |`length`|232|270| |`called`|wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState|wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState| |calling|wil_InitializeFeatureStaging
wil_details_ReevaluateOnFeatureConfigurationChange|wil_InitializeFeatureStaging
wil_details_ReevaluateOnFeatureConfigurationChange| |paramcount|0|0| |address|14001e08c|14001e08c| |sig|undefined __fastcall wil_details_EvaluateFeatureDependencies(void)|undefined __fastcall wil_details_EvaluateFeatureDependencies(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### wil_details_EvaluateFeatureDependencies Called Diff ```diff --- wil_details_EvaluateFeatureDependencies called +++ wil_details_EvaluateFeatureDependencies called @@ -1 +1 @@ -wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState +wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState ``` ### wil_details_EvaluateFeatureDependencies Diff ```diff --- wil_details_EvaluateFeatureDependencies +++ wil_details_EvaluateFeatureDependencies @@ -1,64 +1,65 @@ void wil_details_EvaluateFeatureDependencies(void) { uint uVar1; undefined **ppuVar2; undefined **ppuVar3; - undefined *puVar4; - bool bVar5; + bool bVar4; - puVar4 = (undefined *)0x0; ppuVar3 = &wil_details_featureDescriptors_a; ppuVar2 = &wil_details_featureDescriptors_a; do { - if (*ppuVar2 != (undefined *)0x0) goto joined_r0x00014001e0c7; + if (*ppuVar2 != (undefined *)0x0) goto joined_r0x00014001e0cd; ppuVar2 = ppuVar2 + 1; } while (ppuVar2 < &wil_details_featureDescriptors_z); LAB_0: while( true ) { if (&UNK_1 < ppuVar3) { return; } if (*ppuVar3 != (undefined *)0x0) break; ppuVar3 = ppuVar3 + 1; } do { if (ppuVar3 == (undefined **)0x0) { return; } - wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState - ((uint *)*ppuVar3,(longlong)ppuVar3); + uVar1 = *(uint *)*ppuVar3; + if ((uVar1 >> 9 & 1) != 0) { + wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState + ((uint *)*ppuVar3,uVar1,(longlong)ppuVar3); + } ppuVar3 = ppuVar3 + 7; while( true ) { if (&UNK_1 < ppuVar3) { return; } - if (*ppuVar3 != puVar4) break; + if (*ppuVar3 != (undefined *)0x0) break; ppuVar3 = ppuVar3 + 1; } } while( true ); -joined_r0x00014001e0c7: +joined_r0x00014001e0cd: while (ppuVar2 != (undefined **)0x0) { uVar1 = *(uint *)*ppuVar2; if ((uVar1 >> 9 & 1) != 0) { if ((uVar1 & 0x180) == 0) { - bVar5 = *(char *)((longlong)ppuVar2 + 0x1f) != '\0'; + bVar4 = *(char *)((longlong)ppuVar2 + 0x1f) != '\0'; } else { - bVar5 = (uVar1 & 0x180) == 0x100; + bVar4 = (uVar1 & 0x180) == 0x100; } LOCK(); - *(uint *)*ppuVar2 = *(uint *)*ppuVar2 ^ uVar1 & 0x40 ^ (uint)bVar5 << 6; + *(uint *)*ppuVar2 = *(uint *)*ppuVar2 ^ uVar1 & 0x40 ^ (uint)bVar4 << 6; UNLOCK(); } ppuVar2 = ppuVar2 + 7; while( true ) { - if (&UNK_1 < ppuVar2) goto LAB_14001e141; + if (&UNK_1 < ppuVar2) goto LAB_14001e14a; if (*ppuVar2 != (undefined *)0x0) break; ppuVar2 = ppuVar2 + 1; } } goto LAB_0; } ``` ## wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState ### Match Info |Key|p9_7824.sys - p9_8328.sys| | :---: | :---: | |diff_type|code,length,address| |ratio|0.25| |i_ratio|0.44| |m_ratio|0.94| |b_ratio|0.61| |match_types|SymbolsHash| ### Function Meta Diff |Key|p9_7824.sys|p9_8328.sys| | :---: | :---: | :---: | |name|wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState|wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState| |fullname|wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState|wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState| |refcount|3|3| |`length`|612|686| |called|NTOSKRNL.EXE::RtlQueryFeatureConfiguration
__security_check_cookie
_guard_dispatch_icall
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState|NTOSKRNL.EXE::RtlQueryFeatureConfiguration
__security_check_cookie
_guard_dispatch_icall
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState| |calling|wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_IsEnabledFallback|wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_IsEnabledFallback| |paramcount|3|3| |`address`|140007c3c|140007c28| |sig|ulonglong __fastcall wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState(uint * param_1, ulonglong param_2, longlong param_3)|ulonglong __fastcall wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState(uint * param_1, ulonglong param_2, longlong param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState Diff ```diff --- wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState +++ wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState @@ -1,151 +1,171 @@ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ ulonglong wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState (uint *param_1,ulonglong param_2,longlong param_3) { - undefined8 *puVar1; - int iVar2; + uint uVar1; + undefined8 *puVar2; int iVar3; uint uVar4; uint uVar5; - uint uVar6; - ulonglong uVar7; - uint uVar8; + ulonglong uVar6; + uint uVar7; + ulonglong uVar8; uint uVar9; - ulonglong uVar10; - longlong *plVar11; + uint uVar10; + uint uVar11; uint uVar12; - bool bVar13; - undefined1 auStack_a8 [32]; - undefined8 local_88; - ulonglong local_80; - undefined8 local_78; + longlong *plVar13; + bool bVar14; + undefined1 auStack_b8 [32]; + int local_98; + undefined8 local_90; + ulonglong local_88; + longlong local_80; + uint *local_78; undefined8 local_70; - undefined8 uStack_68; - undefined8 local_60; + undefined8 local_68; + undefined8 uStack_60; undefined8 local_58; - undefined4 local_50; - ulonglong local_48; + undefined8 local_50; + undefined4 local_48; + ulonglong local_40; - local_48 = __security_cookie ^ (ulonglong)auStack_a8; - iVar2 = 0; - local_88 = param_2; + local_40 = __security_cookie ^ (ulonglong)auStack_b8; + local_98 = 0; + local_90 = param_2; + local_80 = param_3; + local_78 = param_1; if (g_wil_details_ensureSubscribedToFeatureConfigurationChanges != (code *)0x0) { - iVar2 = (*g_wil_details_ensureSubscribedToFeatureConfigurationChanges)(); + local_98 = (*g_wil_details_ensureSubscribedToFeatureConfigurationChanges)(); } + local_68 = 0; + uStack_60 = 0; + uVar12 = 1; local_70 = 0; - uStack_68 = 0; - uVar12 = 1; - local_78 = 0; uVar5 = 0; - local_60 = 0; local_58 = 0; local_50 = 0; + local_48 = 0; iVar3 = RtlQueryFeatureConfiguration (*(undefined4 *)(param_3 + 0x18),1 < (byte)(*(char *)(param_3 + 0x1c) - 2U), - &local_78,&local_58); + &local_70,&local_50); if (iVar3 == 0) { - uVar8 = local_58._4_4_ >> 7 & 1; - local_70 = CONCAT44(local_70._4_4_,local_58._4_4_ >> 4) & 0xffffffff00000003; - uVar4 = local_58._4_4_ >> 6 & 1; + uVar7 = local_50._4_4_ >> 7 & 1; + local_68 = CONCAT44(local_68._4_4_,local_50._4_4_ >> 4) & 0xffffffff00000003; + uVar4 = local_50._4_4_ >> 6 & 1; uVar5 = uVar12; - uVar6 = local_58._4_4_ >> 4 & 3; + uVar10 = local_50._4_4_ >> 4 & 3; LAB_0: - uVar8 = uVar8 << 10; - if (uVar4 != 0) { - uVar4 = 0x800; - goto LAB_1; + uVar7 = uVar7 << 10; + if (uVar4 == 0) goto LAB_1; + uVar4 = 0x800; + } + else { + uVar7 = 0; + uVar4 = 0; + uVar10 = (uint)local_68; + if (iVar3 != 0x117) goto LAB_0; + uVar7 = (local_50._4_4_ >> 7 & 1) << 10; + uVar5 = uVar12; +LAB_1: + uVar4 = 0; + } + uVar5 = -(uint)(uVar5 != 0) & uVar10 & 3; + uVar11 = uVar5 << 7; + if (uVar5 == 0) { + uVar5 = -(uint)(*(char *)(param_3 + 0x1f) != '\0') & 0x40; + } + else { + uVar5 = 0; + if (uVar10 == 2) { + uVar5 = 0x40; } } - else { - uVar8 = 0; - uVar4 = 0; - uVar6 = (uint)local_70; - if (iVar3 != 0x117) goto LAB_0; - uVar8 = (local_58._4_4_ >> 7 & 1) << 10; - uVar5 = uVar12; + uVar9 = uVar5 | uVar11 | uVar7 | uVar4; + uVar10 = uVar12; + if (((uVar7 | uVar4) == 0xc00) || (uVar10 = 0, uVar5 != 0)) { + plVar13 = *(longlong **)(param_3 + 0x20); + uVar7 = uVar12; + if (plVar13 != (longlong *)0x0) { + do { + while( true ) { + puVar2 = (undefined8 *)*plVar13; + if (puVar2 == (undefined8 *)0x0) goto LAB_2; + if ((*(char *)((longlong)puVar2 + 0x1e) == '\0') && + (*(char *)((longlong)puVar2 + 0x1d) == '\0')) break; + if ((uVar7 == 0) || (*(char *)((longlong)puVar2 + 0x1f) == '\0')) { + uVar7 = 0; + goto LAB_2; + } + plVar13 = plVar13 + 1; + uVar7 = uVar12; + } + uVar1 = *(uint *)*puVar2; + local_88 = (ulonglong)uVar1; + uVar6 = local_88; + if ((uVar1 & 2) == 0) { + uVar6 = wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState + ((uint *)*puVar2,local_88,(longlong)puVar2); + } + if ((uVar7 == 0) || (uVar7 = uVar12, (uVar6 & 1) == 0)) { + uVar7 = 0; + } + plVar13 = plVar13 + 1; + } while (uVar7 != 0); + } +LAB_2: + if ((uVar10 != 0) && (uVar7 == 0)) { + uVar9 = uVar5 | uVar11 | uVar4; + } + param_3 = local_80; + if (((uVar9 & 0x40) != 0) && (uVar5 = uVar12, uVar7 != 0)) goto LAB_3; } - uVar4 = 0; -LAB_1: - uVar5 = -(uint)(uVar5 != 0) & uVar6 & 3; - if (uVar5 == 0) { - uVar9 = -(uint)(*(char *)(param_3 + 0x1f) != '\0') & 0x40; + uVar5 = 0; +LAB_3: + uVar9 = uVar9 | uVar5; + if (*(char *)(param_3 + 0x1c) == '\0') { + uVar12 = -(uint)(local_98 != 0) & 1; } - else { - uVar9 = 0; - if (uVar6 == 2) { - uVar9 = 0x40; + uVar6 = param_2 & 0xffffffff; + do { + uVar8 = param_2; + uVar5 = (uint)uVar6; + local_90 = CONCAT44(local_90._4_4_,uVar5); + if ((uVar12 != 0) && (local_90 = CONCAT44(local_90._4_4_,uVar5), (uVar6 & 2) == 0)) { + uVar10 = (uVar9 ^ uVar5) & 0x9c1 ^ uVar5; + uVar5 = uVar10 | 2; + local_90 = CONCAT44(local_90._4_4_,uVar10) | 2; } - } - uVar5 = uVar9 >> 6 ^ (uVar9 | uVar5 << 7 | uVar8 | uVar4); - if ((uVar9 != 0) && (plVar11 = *(longlong **)(param_3 + 0x20), plVar11 != (longlong *)0x0)) { - do { - puVar1 = (undefined8 *)*plVar11; - if (puVar1 == (undefined8 *)0x0) break; - if ((*(char *)((longlong)puVar1 + 0x1e) == '\0') && - (*(char *)((longlong)puVar1 + 0x1d) == '\0')) { - uVar4 = *(uint *)*puVar1; - local_80 = (ulonglong)uVar4; - if ((uVar4 & 2) == 0) { - uVar7 = wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState - ((uint *)*puVar1,local_80,(longlong)puVar1); - uVar4 = (uint)uVar7; - } - uVar6 = uVar5 & 0xfffffffe; - uVar5 = (uint)(((byte)uVar4 & (byte)uVar5 & 1) != 0); - } - else { - if (((uVar5 & 1) == 0) || (uVar6 = uVar12, *(char *)((longlong)puVar1 + 0x1f) == '\0')) { - uVar6 = 0; - } - uVar5 = uVar5 & 0xfffffffe; - } - uVar5 = uVar5 | uVar6; - plVar11 = plVar11 + 1; - } while ((uVar5 & 1) != 0); - } - if (*(char *)(param_3 + 0x1c) == '\0') { - uVar12 = -(uint)(iVar2 != 0) & 1; - } - uVar7 = param_2 & 0xffffffff; - do { - uVar10 = param_2; - uVar6 = (uint)uVar7; - local_88 = CONCAT44(local_88._4_4_,uVar6); - if ((uVar12 != 0) && (local_88 = CONCAT44(local_88._4_4_,uVar6), (uVar7 & 2) == 0)) { - uVar4 = (uVar5 ^ uVar6) & 0x9c1 ^ uVar6; - uVar6 = uVar4 | 2; - local_88 = CONCAT44(local_88._4_4_,uVar4) | 2; + if ((uVar8 & 4) == 0) { + uVar10 = (uVar9 ^ uVar5) & 0x400 ^ uVar5; + uVar5 = uVar10 | 4; + local_90 = CONCAT44(local_90._4_4_,uVar10) | 4; } - if ((uVar10 & 4) == 0) { - uVar4 = (uVar6 ^ uVar5) & 0x400 ^ uVar6; - uVar6 = uVar4 | 4; - local_88 = CONCAT44(local_88._4_4_,uVar4) | 4; - } - uVar7 = uVar10 & 0xffffffff; + uVar6 = uVar8 & 0xffffffff; LOCK(); - uVar4 = *param_1; - bVar13 = (uint)uVar10 == uVar4; - if (bVar13) { - *param_1 = uVar6; + uVar10 = *local_78; + bVar14 = (uint)uVar8 == uVar10; + if (bVar14) { + *local_78 = uVar5; } else { - uVar7 = (ulonglong)uVar4; + uVar6 = (ulonglong)uVar10; } UNLOCK(); - param_2 = uVar7; - } while (!bVar13); - if (((uVar10 & 4) == 0) && + param_2 = uVar6; + } while (!bVar14); + if (((uVar8 & 4) == 0) && (g_wil_details_subscribeFeatureStateCacheToConfigurationChanges != (code *)0x0)) { (*g_wil_details_subscribeFeatureStateCacheToConfigurationChanges) - (param_1,*(undefined1 *)(param_3 + 0x1c),iVar2); + (local_78,*(undefined1 *)(local_80 + 0x1c)); } if (uVar12 == 0) { - local_88 = CONCAT44(local_88._4_4_,(uVar5 ^ uVar6) & 0x9c1 ^ uVar6); + local_90 = CONCAT44(local_90._4_4_,(uVar5 ^ uVar9) & 0x9c1 ^ uVar5); } - return local_88; + return local_90; } ``` ## wil_details_FeatureReporting_ReportUsageToService ### Match Info |Key|p9_7824.sys - p9_8328.sys| | :---: | :---: | |diff_type|code,length,sig,address| |ratio|0.6| |i_ratio|0.54| |m_ratio|0.98| |b_ratio|0.98| |match_types|SymbolsHash| ### Function Meta Diff |Key|p9_7824.sys|p9_8328.sys| | :---: | :---: | :---: | |name|wil_details_FeatureReporting_ReportUsageToService|wil_details_FeatureReporting_ReportUsageToService| |fullname|wil_details_FeatureReporting_ReportUsageToService|wil_details_FeatureReporting_ReportUsageToService| |refcount|2|2| |`length`|289|275| |called|_guard_dispatch_icall
wil_details_FeatureReporting_ReportUsageToServiceDirect|_guard_dispatch_icall
wil_details_FeatureReporting_ReportUsageToServiceDirect| |calling|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |paramcount|3|3| |`address`|140007a24|140007a20| |`sig`|undefined __fastcall wil_details_FeatureReporting_ReportUsageToService(longlong param_1, ulonglong param_2, int param_3)|undefined __fastcall wil_details_FeatureReporting_ReportUsageToService(undefined8 param_1, ulonglong param_2, uint param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### wil_details_FeatureReporting_ReportUsageToService Diff ```diff --- wil_details_FeatureReporting_ReportUsageToService +++ wil_details_FeatureReporting_ReportUsageToService @@ -1,59 +1,66 @@ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ void wil_details_FeatureReporting_ReportUsageToService - (longlong param_1,ulonglong param_2,int param_3) + (undefined8 param_1,ulonglong param_2,uint param_3) { bool bVar1; undefined7 extraout_var; uint uVar2; - uint uVar3; - byte bVar4; - int local_res18 [4]; + uint uVar4; + byte bVar5; + uint local_res18 [4]; + ulonglong uVar3; - uVar2 = (uint)param_2 & 1; + uVar4 = (uint)param_2 & 1; + uVar3 = (ulonglong)param_3; if (param_3 != 0) { if (param_3 == 1) { - uVar3 = (uVar2 ^ 1) << 2; + uVar2 = (uVar4 ^ 1) << 2; + uVar3 = 0; goto LAB_0; } if (param_3 == 2) { - uVar3 = (uVar2 ^ 1) * 4 + 1; + uVar2 = (uVar4 ^ 1) * 4 + 1; + uVar3 = 0; goto LAB_0; } if (param_3 == 3) { - uVar3 = (uVar2 ^ 1) * 4 + 2; + uVar2 = (uVar4 ^ 1) * 4 + 2; + uVar3 = 0; goto LAB_0; } if (param_3 == 4) { - uVar3 = (uVar2 ^ 1) * 4 + 3; + uVar2 = (uVar4 ^ 1) * 4 + 3; + uVar3 = 0; goto LAB_0; } - if (param_3 == 5) { - uVar3 = (uVar2 ^ 1) * 2 + 8; + uVar2 = param_3 - 5; + uVar3 = (ulonglong)uVar2; + if (uVar2 == 0) { + uVar2 = (uVar4 ^ 1) * 2 + 8; goto LAB_0; } - if (param_3 == 6) { - uVar3 = (uVar2 ^ 1) * 2 + 9; + if (uVar2 == 1) { + uVar2 = (uVar4 ^ 1) * 2 + 9; goto LAB_0; } - bVar4 = (char)param_3 + 0x9c; - if (bVar4 < 0x32) { - uVar3 = (-(uint)((param_2 & 1) != 0) & 0xffffffce) + 0x96 + (uint)bVar4; + bVar5 = (char)param_3 + 0x9c; + if (bVar5 < 0x32) { + uVar2 = (-(uint)((param_2 & 1) != 0) & 0xffffffce) + 0x96 + (uint)bVar5; goto LAB_0; } } - uVar3 = 0xff; + uVar2 = 0xff; LAB_0: local_res18[0] = param_3; - bVar1 = wil_details_FeatureReporting_ReportUsageToServiceDirect(param_1,param_2,uVar3); + bVar1 = wil_details_FeatureReporting_ReportUsageToServiceDirect(uVar3,param_2,uVar2); if (((int)CONCAT71(extraout_var,bVar1) != 0) && (g_wil_details_pfnFeatureLoggingHook != (code *)0x0)) { (*g_wil_details_pfnFeatureLoggingHook) - (*(undefined4 *)(param_1 + 0x18),*(undefined8 *)(param_1 + 0x10),0,uVar2,local_res18,0 - ,0,1); + (0x3906b24,&Feature_3906416953_logged_traits,0,uVar4,local_res18,0,0,1); } return; } ``` ## Feature_3906416953__private_IsEnabledFallback ### Match Info |Key|p9_7824.sys - p9_8328.sys| | :---: | :---: | |diff_type|code,length,sig| |ratio|0.8| |i_ratio|0.67| |m_ratio|0.89| |b_ratio|0.89| |match_types|SymbolsHash| ### Function Meta Diff |Key|p9_7824.sys|p9_8328.sys| | :---: | :---: | :---: | |name|Feature_3906416953__private_IsEnabledFallback|Feature_3906416953__private_IsEnabledFallback| |fullname|Feature_3906416953__private_IsEnabledFallback|Feature_3906416953__private_IsEnabledFallback| |refcount|2|2| |`length`|21|14| |called|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |calling|Feature_3906416953__private_IsEnabledDeviceUsageNoInline|Feature_3906416953__private_IsEnabledDeviceUsageNoInline| |paramcount|2|2| |address|14000771c|14000771c| |`sig`|undefined __fastcall Feature_3906416953__private_IsEnabledFallback(ulonglong param_1, int param_2)|undefined __fastcall Feature_3906416953__private_IsEnabledFallback(undefined8 * param_1, uint param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### Feature_3906416953__private_IsEnabledFallback Diff ```diff --- Feature_3906416953__private_IsEnabledFallback +++ Feature_3906416953__private_IsEnabledFallback @@ -1,8 +1,8 @@ -void Feature_3906416953__private_IsEnabledFallback(ulonglong param_1,int param_2) +void Feature_3906416953__private_IsEnabledFallback(undefined8 *param_1,uint param_2) { - wil_details_IsEnabledFallback(param_1,param_2,&wil_details_featureDescriptors_a); + wil_details_IsEnabledFallback(param_1,param_2); return; } ``` ## wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath ### Match Info |Key|p9_7824.sys - p9_8328.sys| | :---: | :---: | |diff_type|code,length,sig,address| |ratio|0.4| |i_ratio|0.37| |m_ratio|0.9| |b_ratio|0.9| |match_types|SymbolsHash| ### Function Meta Diff |Key|p9_7824.sys|p9_8328.sys| | :---: | :---: | :---: | |name|wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath|wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath| |fullname|wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath|wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath| |refcount|2|2| |`length`|91|76| |called||| |calling|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |paramcount|3|2| |`address`|140007ea8|140007ee0| |`sig`|undefined __fastcall wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath(uint param_1, int param_2, undefined8 * param_3)|undefined __fastcall wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath(uint param_1, int param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath Diff ```diff --- wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath +++ wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath @@ -1,52 +1,41 @@ -void wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath - (uint param_1,int param_2,undefined8 *param_3) +void wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath(uint param_1,int param_2) { - uint *puVar1; + uint uVar1; uint uVar2; uint uVar3; - uint uVar4; - bool bVar5; + bool bVar4; - puVar1 = (uint *)*param_3; if (param_2 == 3) { - uVar4 = 0x10; + uVar3 = 0x10; } else { if (param_2 != 4) { return; } - uVar4 = 0x20; + uVar3 = 0x20; } - if ((*(char *)((longlong)param_3 + 0x1e) == '\0') && (*(char *)((longlong)param_3 + 0x1d) == '\0') - ) { - if ((*puVar1 & 2) != 0) { - uVar3 = *puVar1; - while ((uVar3 & 1) == (param_1 & 1)) { - LOCK(); - uVar2 = *puVar1; - bVar5 = uVar3 == uVar2; - if (bVar5) { - *puVar1 = uVar4 | uVar3; - uVar2 = uVar3; - } - UNLOCK(); - if (bVar5) { - return; - } - uVar3 = uVar2; - if ((uVar2 & 2) == 0) { - return; - } + if (((uint)Feature_3906416953__private_featureState & 2) != 0) { + uVar2 = (uint)Feature_3906416953__private_featureState; + while ((uVar2 & 1) == (param_1 & 1)) { + LOCK(); + bVar4 = uVar2 == (uint)Feature_3906416953__private_featureState; + uVar1 = uVar3 | uVar2; + if (!bVar4) { + uVar2 = (uint)Feature_3906416953__private_featureState; + uVar1 = (uint)Feature_3906416953__private_featureState; + } + Feature_3906416953__private_featureState._0_4_ = uVar1; + UNLOCK(); + if (bVar4) { + return; + } + if ((uVar2 & 2) == 0) { + return; } } - } - else { - LOCK(); - *puVar1 = *puVar1 | uVar4; - UNLOCK(); } return; } ``` ## wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState ### Match Info |Key|p9_7824.sys - p9_8328.sys| | :---: | :---: | |diff_type|code,name,fullname,length,sig,address| |ratio|0.23| |i_ratio|0.18| |m_ratio|0.91| |b_ratio|0.63| |match_types|Implied Match| ### Function Meta Diff |Key|p9_7824.sys|p9_8328.sys| | :---: | :---: | :---: | |`name`|wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState|wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState| |`fullname`|wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState|wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState| |refcount|3|3| |`length`|243|265| |called|wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState|wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState| |calling|wil_details_EvaluateFeatureDependencies
wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState|wil_details_EvaluateFeatureDependencies
wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState| |paramcount|2|3| |`address`|14001e17c|14001e1dc| |`sig`|uint __fastcall wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState(uint * param_1, longlong param_2)|uint __fastcall wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState(uint * param_1, uint param_2, longlong param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState Diff ```diff --- wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState +++ wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState @@ -1,63 +1,74 @@ -uint wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState - (uint *param_1,longlong param_2) +uint wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState + (uint *param_1,uint param_2,longlong param_3) { - uint uVar1; - undefined8 *puVar2; - uint uVar3; + undefined8 *puVar1; + bool bVar2; + ulonglong uVar3; uint uVar4; - longlong *plVar5; + uint uVar5; uint uVar6; - bool bVar7; + longlong *plVar7; + bool bVar8; + bool bVar9; - uVar6 = *param_1; - uVar3 = uVar6; - if ((uVar6 >> 9 & 1) != 0) { - uVar4 = uVar6 >> 6 & 1; - if ((uVar4 != 0) && (plVar5 = *(longlong **)(param_2 + 0x20), plVar5 != (longlong *)0x0)) { + uVar6 = param_2 >> 6 & 1; + if (((param_2 & 0xc00) == 0xc00) || (bVar8 = false, bVar2 = true, uVar6 != 0)) { + plVar7 = *(longlong **)(param_3 + 0x20); + bVar8 = (param_2 & 0xc00) == 0xc00; + bVar9 = true; + bVar2 = true; + if (plVar7 != (longlong *)0x0) { do { while( true ) { - puVar2 = (undefined8 *)*plVar5; - if (puVar2 == (undefined8 *)0x0) goto LAB_0; - if ((*(char *)((longlong)puVar2 + 0x1e) == '\0') && - (*(char *)((longlong)puVar2 + 0x1d) == '\0')) break; - if ((uVar4 == 0) || (*(char *)((longlong)puVar2 + 0x1f) == '\0')) { - uVar4 = 0; + puVar1 = (undefined8 *)*plVar7; + if (puVar1 == (undefined8 *)0x0) goto LAB_0; + if ((*(char *)((longlong)puVar1 + 0x1e) == '\0') && + (*(char *)((longlong)puVar1 + 0x1d) == '\0')) break; + if ((!bVar9) || (*(char *)((longlong)puVar1 + 0x1f) == '\0')) { + bVar9 = false; goto LAB_0; } - uVar4 = 1; - plVar5 = plVar5 + 1; + plVar7 = plVar7 + 1; + bVar9 = true; } uVar3 = wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState - ((uint *)*puVar2,(longlong)puVar2); - if ((uVar4 == 0) || ((uVar3 & 1) == 0)) { - uVar4 = 0; + ((uint *)*puVar1,puVar1); + if ((!bVar9) || (bVar9 = true, (uVar3 & 1) == 0)) { + bVar9 = false; } - else { - uVar4 = 1; - } - plVar5 = plVar5 + 1; - } while (uVar4 != 0); + plVar7 = plVar7 + 1; + } while (bVar9); +LAB_0: + bVar2 = bVar9; + if ((uVar6 == 0) || (!bVar9)) { + uVar6 = 0; + } + else { + uVar6 = 1; + } } -LAB_0: - do { - uVar3 = uVar6 & 0xffffffce; - if ((uVar6 & 1) == uVar4) { - uVar3 = uVar6 & 0xfffffffe; - } - uVar3 = uVar3 & 0xfffffdff | uVar4; - LOCK(); - uVar1 = *param_1; - bVar7 = uVar6 == uVar1; - if (bVar7) { - *param_1 = uVar3; - uVar1 = uVar6; - } - uVar6 = uVar1; - UNLOCK(); - } while (!bVar7); } - return uVar3; + do { + uVar5 = param_2 & 0xfffffffe | uVar6; + if ((bVar8) && (!bVar2)) { + uVar5 = param_2 & 0xfffffbfe | uVar6; + } + uVar4 = uVar5 & 0xffffffcf; + if ((param_2 & 1) == uVar6) { + uVar4 = uVar5; + } + LOCK(); + uVar5 = *param_1; + bVar9 = param_2 == uVar5; + if (bVar9) { + *param_1 = uVar4 & 0xfffffdff; + uVar5 = param_2; + } + param_2 = uVar5; + UNLOCK(); + } while (!bVar9); + return uVar4 & 0xfffffdff; } ``` # Modified (No Code Changes) *Slightly modified functions have no code changes, rather differnces in:* - refcount - length - called - calling - name - fullname ## NTOSKRNL.EXE::ExAllocateTimer ### Match Info |Key|p9_7824.sys - p9_8328.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|p9_7824.sys|p9_8328.sys| | :---: | :---: | :---: | |name|ExAllocateTimer|ExAllocateTimer| |fullname|NTOSKRNL.EXE::ExAllocateTimer|NTOSKRNL.EXE::ExAllocateTimer| |`refcount`|3|2| |length|0|0| |called||| |`calling`|p9fs::UserCallback::Initialize
p9fs::UserCallback::SetCallbackTimeout|p9fs::UserCallback::Initialize| |paramcount|0|0| |address|EXTERNAL:00000042|EXTERNAL:00000042| |sig|undefined ExAllocateTimer(void)|undefined ExAllocateTimer(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::ExAllocateTimer Calling Diff ```diff --- NTOSKRNL.EXE::ExAllocateTimer calling +++ NTOSKRNL.EXE::ExAllocateTimer calling @@ -2 +1,0 @@ -p9fs::UserCallback::SetCallbackTimeout ``` ## DeleteTimer ### Match Info |Key|p9_7824.sys - p9_8328.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|p9_7824.sys|p9_8328.sys| | :---: | :---: | :---: | |name|DeleteTimer|DeleteTimer| |fullname|p9fs::details::DeleteTimer|p9fs::details::DeleteTimer| |`refcount`|4|3| |length|30|30| |called|NTOSKRNL.EXE::ExDeleteTimer|NTOSKRNL.EXE::ExDeleteTimer| |`calling`|p9fs::UserCallback::Initialize
p9fs::UserCallback::ReleaseReference
p9fs::UserCallback::SetCallbackTimeout|p9fs::UserCallback::Initialize
p9fs::UserCallback::ReleaseReference| |paramcount|1|1| |`address`|14000b054|14000b074| |sig|void __cdecl DeleteTimer(_EX_TIMER * param_1)|void __cdecl DeleteTimer(_EX_TIMER * param_1)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### DeleteTimer Calling Diff ```diff --- p9fs::details::DeleteTimer calling +++ p9fs::details::DeleteTimer calling @@ -3 +2,0 @@ -p9fs::UserCallback::SetCallbackTimeout ``` Generated with `ghidriff` version: 1.0.0 on 2026-08-19T20:17:56