# pj_6725.sys-pj_6899.sys Diff # TOC * [Visual Chart Diff](#visual-chart-diff) * [Metadata](#metadata) * [Ghidra Diff Engine](#ghidra-diff-engine) * [Command Line](#command-line) * [Binary Metadata Diff](#binary-metadata-diff) * [Program Options](#program-options) * [Diff Stats](#diff-stats) * [Strings](#strings) * [Deleted](#deleted) * [Added](#added) * [Feature_2983238971__private_IsEnabledDeviceUsageNoInline](#feature_2983238971__private_isenableddeviceusagenoinline) * [Feature_2983238971__private_IsEnabledFallback](#feature_2983238971__private_isenabledfallback) * [NTOSKRNL.EXE::SeCaptureSecurityDescriptor](#ntoskrnlexesecapturesecuritydescriptor) * [NTOSKRNL.EXE::SeReleaseSecurityDescriptor](#ntoskrnlexesereleasesecuritydescriptor) * [Modified](#modified) * [wil_details_IsEnabledFallback](#wil_details_isenabledfallback) * [wil_details_FeatureReporting_ReportUsageToServiceDirect](#wil_details_featurereporting_reportusagetoservicedirect) * [Feature_HydrateLargeNonCachedFiles__private_IsEnabledFallback](#feature_hydratelargenoncachedfiles__private_isenabledfallback) * [PrjfUpdatePlaceholderIfNeededHandler](#prjfupdateplaceholderifneededhandler) * [PrjfCopyAsPlaceHolder](#prjfcopyasplaceholder) * [PrjfPortMessage](#prjfportmessage) * [wil_details_FeatureReporting_ReportUsageToService](#wil_details_featurereporting_reportusagetoservice) * [PrjfWritePlaceholderInformationHandler](#prjfwriteplaceholderinformationhandler) * [wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath](#wil_details_featurestatecache_tryenabledeviceusagefastpath) * [Modified (No Code Changes)](#modified-no-code-changes) # Visual Chart Diff ```mermaid flowchart LR wil_details_IsEnabledFallback-2-old<--Match 94%-->wil_details_IsEnabledFallback-2-new wil_details_FeatureReporting_ReportUsageToServiceDirect-3-old<--Match 95%-->wil_details_FeatureReporting_ReportUsageToServiceDirect-3-new Feature_HydrateLargeNonCachedFiles__private_IsEnabledFallback-2-old<--Match 89%-->Feature_HydrateLargeNonCachedFiles__private_IsEnabledFallback-2-new PrjfUpdatePlaceholderIfNeededHandler-4-old<--Match 94%-->PrjfUpdatePlaceholderIfNeededHandler-4-new PrjfCopyAsPlaceHolder-7-old<--Match 88%-->PrjfCopyAsPlaceHolder-7-new PrjfPortMessage-6-old<--Match 82%-->PrjfPortMessage-6-new wil_details_FeatureReporting_ReportUsageToService-3-old<--Match 98%-->wil_details_FeatureReporting_ReportUsageToService-3-new PrjfWritePlaceholderInformationHandler-3-old<--Match 94%-->PrjfWritePlaceholderInformationHandler-3-new wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath-2-old<--Match 90%-->wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath-2-new subgraph pj_6899.sys wil_details_IsEnabledFallback-2-new wil_details_FeatureReporting_ReportUsageToServiceDirect-3-new Feature_HydrateLargeNonCachedFiles__private_IsEnabledFallback-2-new PrjfUpdatePlaceholderIfNeededHandler-4-new PrjfCopyAsPlaceHolder-7-new PrjfPortMessage-6-new wil_details_FeatureReporting_ReportUsageToService-3-new PrjfWritePlaceholderInformationHandler-3-new wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath-2-new subgraph Added direction LR Feature_2983238971__private_IsEnabledDeviceUsageNoInline Feature_2983238971__private_IsEnabledFallback NTOSKRNLEXE-SeCaptureSecurityDescriptor NTOSKRNLEXE-SeReleaseSecurityDescriptor end end subgraph pj_6725.sys wil_details_IsEnabledFallback-2-old wil_details_FeatureReporting_ReportUsageToServiceDirect-3-old Feature_HydrateLargeNonCachedFiles__private_IsEnabledFallback-2-old PrjfUpdatePlaceholderIfNeededHandler-4-old PrjfCopyAsPlaceHolder-7-old PrjfPortMessage-6-old wil_details_FeatureReporting_ReportUsageToService-3-old PrjfWritePlaceholderInformationHandler-3-old wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath-2-old end ``` ```mermaid pie showData title Function Matches - 99.6894% "unmatched_funcs_len" : 4 "matched_funcs_len" : 1284 ``` ```mermaid pie showData title Matched Function Similarity - 99.2991% "matched_funcs_with_code_changes_len" : 9 "matched_funcs_with_non_code_changes_len" : 0 "matched_funcs_no_changes_len" : 1275 ``` # Metadata ## Ghidra Diff Engine ### Command Line #### Captured Command Line ``` ghidriff --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --bsim --max-ram-percent 60.0 --max-section-funcs 200 pj_6725.sys pj_6899.sys ``` #### Verbose Args
``` --old ['pj_6725.sys'] --new [['pj_6899.sys']] --engine VersionTrackingDiff --output-path pjp_out --summary False --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim True --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title None ```
#### Download Original PEs ``` wget https://msdl.microsoft.com/download/symbols/prjflt.sys/93DDD7EB47000/prjflt.sys -O prjflt.sys.x64.10.0.26100.6725 wget https://msdl.microsoft.com/download/symbols/prjflt.sys/DCBFA79F47000/prjflt.sys -O prjflt.sys.x64.10.0.26100.6899 ``` ## Binary Metadata Diff ```diff --- pj_6725.sys Meta +++ pj_6899.sys Meta @@ -1,44 +1,44 @@ -Program Name: pj_6725.sys +Program Name: pj_6899.sys Language ID: x86:LE:64:default (4.6) Compiler ID: windows Processor: x86 Endian: Little Address Size: 64 Minimum Address: 140000000 Maximum Address: ff0000184f # of Bytes: 297040 # of Memory Blocks: 15 -# of Instructions: 46641 -# of Defined Data: 2251 -# of Functions: 642 -# of Symbols: 6987 +# of Instructions: 46761 +# of Defined Data: 2265 +# of Functions: 646 +# of Symbols: 7010 # of Data Types: 165 # of Data Type Categories: 12 Analyzed: true Compiler: visualstudio:unknown Created With Ghidra Version: 12.0.4 -Date Created: Wed Aug 19 20:02:40 SGT 2026 +Date Created: Wed Aug 19 20:02:43 SGT 2026 Executable Format: Portable Executable (PE) -Executable Location: /tmp/pjp/pj_6725.sys -Executable MD5: 9e1363378d78a28678ed56fdd2f95cc3 -Executable SHA256: ed9ae611924b369392d4ceceef99751da7a972186032480e8ad6258750e9ec74 -FSRL: file:///tmp/pjp/pj_6725.sys?MD5=9e1363378d78a28678ed56fdd2f95cc3 +Executable Location: /tmp/pjp/pj_6899.sys +Executable MD5: f76c7585dc272ee0f8bbbce8df66df1d +Executable SHA256: 185bab380ff59a6ebad6551af33abfa4e00ab37049ac9515c686b6e0f88d0f27 +FSRL: file:///tmp/pjp/pj_6899.sys?MD5=f76c7585dc272ee0f8bbbce8df66df1d PDB Age: 1 PDB File: prjflt.pdb -PDB GUID: b7b76cc2-a195-818b-779b-8242bc19243d +PDB GUID: ef8675b0-b020-b3a8-b2a2-04863c7fa7a7 PDB Loaded: true PDB Version: RSDS PE Property[CompanyName]: Microsoft Corporation PE Property[FileDescription]: Windows Projected File System FS Filter Driver -PE Property[FileVersion]: 10.0.26100.6725 (WinBuild.160101.0800) +PE Property[FileVersion]: 10.0.26100.6899 (WinBuild.160101.0800) PE Property[InternalName]: prjflt.sys PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved. PE Property[OriginalFilename]: prjflt.sys PE Property[ProductName]: Microsoft(R) Windows(R) Kits -PE Property[ProductVersion]: 10.0.26100.6725 +PE Property[ProductVersion]: 10.0.26100.6899 PE Property[Translation]: 4b00409 Preferred Root Namespace Category: RTTI Found: false Relocatable: true SectionAlignment: 4096 Should Ask To Analyze: false ``` ## Program Options
Ghidra pj_6725.sys Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra pj_6725.sys Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra pj_6725.sys Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.Apply Function Calling Conventions|true| |Demangler Microsoft.Apply Function Signatures|true| |Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS| |Demangler Microsoft.Demangle Only Known Mangled Symbols|false| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
Ghidra pj_6899.sys Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra pj_6899.sys Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra pj_6899.sys Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.Apply Function Calling Conventions|true| |Demangler Microsoft.Apply Function Signatures|true| |Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS| |Demangler Microsoft.Demangle Only Known Mangled Symbols|false| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
## Diff Stats |Stat|Value| | :---: | :---: | |added_funcs_len|4| |deleted_funcs_len|0| |modified_funcs_len|9| |added_symbols_len|7| |deleted_symbols_len|2| |diff_time|3.551651954650879| |deleted_strings_len|0| |added_strings_len|0| |match_types|Counter({'SymbolsHash': 641, 'ExternalsName': 260})| |items_to_process|22| |diff_types|Counter({'code': 9, 'length': 9, 'sig': 8, 'address': 7, 'called': 4, 'refcount': 1, 'calling': 1})| |unmatched_funcs_len|4| |total_funcs_len|1288| |matched_funcs_len|1284| |matched_funcs_with_code_changes_len|9| |matched_funcs_with_non_code_changes_len|0| |matched_funcs_no_changes_len|1275| |match_func_similarity_percent|99.2991%| |func_match_overall_percent|99.6894%| |first_matches|Counter({'SymbolsHash': 641})| ```mermaid pie showData title All Matches "SymbolsHash" : 641 "ExternalsName" : 260 ``` ```mermaid pie showData title First Matches "SymbolsHash" : 641 ``` ```mermaid pie showData title Diff Stats "added_funcs_len" : 4 "deleted_funcs_len" : 0 "modified_funcs_len" : 9 ``` ```mermaid pie showData title Symbols "added_symbols_len" : 7 "deleted_symbols_len" : 2 ``` ## Strings *No string differences found* # Deleted # Added ## Feature_2983238971__private_IsEnabledDeviceUsageNoInline ### Function Meta |Key|pj_6899.sys| | :---: | :---: | |name|Feature_2983238971__private_IsEnabledDeviceUsageNoInline| |fullname|Feature_2983238971__private_IsEnabledDeviceUsageNoInline| |refcount|7| |length|49| |called|Feature_2983238971__private_IsEnabledFallback| |calling|PrjfCopyAsPlaceHolder
PrjfPortMessage
PrjfUpdatePlaceholderIfNeededHandler
PrjfWritePlaceholderInformationHandler| |paramcount|0| |address|140004484| |sig|ulonglong __fastcall Feature_2983238971__private_IsEnabledDeviceUsageNoInline(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_2983238971__private_IsEnabledDeviceUsageNoInline +++ Feature_2983238971__private_IsEnabledDeviceUsageNoInline @@ -0,0 +1,17 @@ + +ulonglong Feature_2983238971__private_IsEnabledDeviceUsageNoInline(void) + +{ + ulonglong uVar1; + undefined8 local_res8; + + local_res8 = (ulonglong)Feature_2983238971__private_featureState; + if ((Feature_2983238971__private_featureState & 0x10) == 0) { + uVar1 = Feature_2983238971__private_IsEnabledFallback(local_res8,3); + } + else { + uVar1 = (ulonglong)(Feature_2983238971__private_featureState & 1); + } + return uVar1; +} + ``` ## Feature_2983238971__private_IsEnabledFallback ### Function Meta |Key|pj_6899.sys| | :---: | :---: | |name|Feature_2983238971__private_IsEnabledFallback| |fullname|Feature_2983238971__private_IsEnabledFallback| |refcount|2| |length|21| |called|wil_details_IsEnabledFallback| |calling|Feature_2983238971__private_IsEnabledDeviceUsageNoInline| |paramcount|2| |address|1400044bc| |sig|undefined __fastcall Feature_2983238971__private_IsEnabledFallback(ulonglong param_1, int param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_2983238971__private_IsEnabledFallback +++ Feature_2983238971__private_IsEnabledFallback @@ -0,0 +1,8 @@ + +void Feature_2983238971__private_IsEnabledFallback(ulonglong param_1,int param_2) + +{ + wil_details_IsEnabledFallback(param_1,param_2,&Feature_2983238971__private_descriptor); + return; +} + ``` ## NTOSKRNL.EXE::SeCaptureSecurityDescriptor ### Function Meta |Key|pj_6899.sys| | :---: | :---: | |name|SeCaptureSecurityDescriptor| |fullname|NTOSKRNL.EXE::SeCaptureSecurityDescriptor| |refcount|2| |length|0| |called|| |calling|PrjfCopyAsPlaceHolder| |paramcount|0| |address|EXTERNAL:00000036| |sig|undefined SeCaptureSecurityDescriptor(void)| |sym_type|Function| |sym_source|IMPORTED| |external|True| *No code available for NTOSKRNL.EXE::SeCaptureSecurityDescriptor* ## NTOSKRNL.EXE::SeReleaseSecurityDescriptor ### Function Meta |Key|pj_6899.sys| | :---: | :---: | |name|SeReleaseSecurityDescriptor| |fullname|NTOSKRNL.EXE::SeReleaseSecurityDescriptor| |refcount|2| |length|0| |called|| |calling|PrjfCopyAsPlaceHolder| |paramcount|0| |address|EXTERNAL:00000035| |sig|undefined SeReleaseSecurityDescriptor(void)| |sym_type|Function| |sym_source|IMPORTED| |external|True| *No code available for NTOSKRNL.EXE::SeReleaseSecurityDescriptor* # Modified *Modified functions contain code changes* ## wil_details_IsEnabledFallback ### Match Info |Key|pj_6725.sys - pj_6899.sys| | :---: | :---: | |diff_type|code,refcount,length,sig,address,calling| |ratio|0.48| |i_ratio|0.43| |m_ratio|0.96| |b_ratio|0.94| |match_types|SymbolsHash| ### Function Meta Diff |Key|pj_6725.sys|pj_6899.sys| | :---: | :---: | :---: | |name|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |fullname|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |`refcount`|2|3| |`length`|135|140| |called|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath| |`calling`|Feature_HydrateLargeNonCachedFiles__private_IsEnabledFallback|Feature_2983238971__private_IsEnabledFallback
Feature_HydrateLargeNonCachedFiles__private_IsEnabledFallback| |paramcount|2|3| |`address`|1400042bc|1400042e0| |`sig`|uint __fastcall wil_details_IsEnabledFallback(undefined4 * param_1, uint param_2)|uint __fastcall wil_details_IsEnabledFallback(ulonglong param_1, int param_2, undefined8 * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### wil_details_IsEnabledFallback Calling Diff ```diff --- wil_details_IsEnabledFallback calling +++ wil_details_IsEnabledFallback calling @@ -0,0 +1 @@ +Feature_2983238971__private_IsEnabledFallback ``` ### wil_details_IsEnabledFallback Diff ```diff --- wil_details_IsEnabledFallback +++ wil_details_IsEnabledFallback @@ -1,26 +1,22 @@ -uint wil_details_IsEnabledFallback(undefined4 *param_1,uint param_2) +uint wil_details_IsEnabledFallback(ulonglong param_1,int param_2,undefined8 *param_3) { uint uVar1; - undefined4 *puVar2; - ulonglong local_res18; + ulonglong local_res8; uVar1 = (uint)param_1; - local_res18 = (ulonglong)param_1 & 0xffffffff; - if (((ulonglong)param_1 & 2) == 0) { - puVar2 = &Feature_HydrateLargeNonCachedFiles__private_featureState; - local_res18 = wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState - (&Feature_HydrateLargeNonCachedFiles__private_featureState, - (ulonglong)param_1,0x1400118b8); - param_1 = puVar2; - uVar1 = (uint)local_res18; + local_res8 = param_1 & 0xffffffff; + if ((param_1 & 2) == 0) { + local_res8 = wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState + ((uint *)*param_3,param_1,(longlong)param_3); + uVar1 = (uint)local_res8; } if ((param_2 != 0) && - (wil_details_FeatureReporting_ReportUsageToService(param_1,local_res18,param_2), - param_2 - 3 < 2)) { - wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath((uint)local_res18,param_2); + (wil_details_FeatureReporting_ReportUsageToService((longlong)param_3,local_res8,param_2), + param_2 - 3U < 2)) { + wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath((uint)local_res8,param_2,param_3); } return uVar1 & 1; } ``` ## wil_details_FeatureReporting_ReportUsageToServiceDirect ### Match Info |Key|pj_6725.sys - pj_6899.sys| | :---: | :---: | |diff_type|code,length,sig,address| |ratio|0.35| |i_ratio|0.56| |m_ratio|0.95| |b_ratio|0.95| |match_types|SymbolsHash| ### Function Meta Diff |Key|pj_6725.sys|pj_6899.sys| | :---: | :---: | :---: | |name|wil_details_FeatureReporting_ReportUsageToServiceDirect|wil_details_FeatureReporting_ReportUsageToServiceDirect| |fullname|wil_details_FeatureReporting_ReportUsageToServiceDirect|wil_details_FeatureReporting_ReportUsageToServiceDirect| |refcount|2|2| |`length`|226|232| |called|NTOSKRNL.EXE::RtlNotifyFeatureUsage
__security_check_cookie
_guard_dispatch_icall
wil_details_FeatureReporting_RecordUsageInCache|NTOSKRNL.EXE::RtlNotifyFeatureUsage
__security_check_cookie
_guard_dispatch_icall
wil_details_FeatureReporting_RecordUsageInCache| |calling|wil_details_FeatureReporting_ReportUsageToService|wil_details_FeatureReporting_ReportUsageToService| |paramcount|3|3| |`address`|140003f10|140003f20| |`sig`|bool __fastcall wil_details_FeatureReporting_ReportUsageToServiceDirect(undefined8 param_1, undefined8 param_2, uint param_3)|bool __fastcall wil_details_FeatureReporting_ReportUsageToServiceDirect(longlong param_1, undefined8 param_2, uint param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### wil_details_FeatureReporting_ReportUsageToServiceDirect Diff ```diff --- wil_details_FeatureReporting_ReportUsageToServiceDirect +++ wil_details_FeatureReporting_ReportUsageToServiceDirect @@ -1,47 +1,46 @@ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ bool wil_details_FeatureReporting_ReportUsageToServiceDirect - (undefined8 param_1,undefined8 param_2,uint param_3) + (longlong param_1,undefined8 param_2,uint param_3) { uint6 uVar1; uint *puVar2; - undefined1 auStack_88 [32]; - uint *local_68; - undefined8 local_58; - uint local_50 [6]; - uint local_38; - uint uStack_34; - uint uStack_30; - uint uStack_2c; - undefined8 local_28; - ulonglong local_20; + undefined1 auStack_98 [32]; + uint *local_78; + undefined8 local_68; + uint local_60 [6]; + uint local_48; + uint uStack_44; + uint uStack_40; + uint uStack_3c; + undefined8 local_38; + ulonglong local_30; - local_20 = __security_cookie ^ (ulonglong)auStack_88; + local_30 = __security_cookie ^ (ulonglong)auStack_98; puVar2 = wil_details_FeatureReporting_RecordUsageInCache - (local_50,(uint *)&Feature_HydrateLargeNonCachedFiles__private_reporting, - param_3,(uint)((ulonglong)param_2 >> 0x20)); - local_38 = *puVar2; - uStack_34 = puVar2[1]; - uStack_30 = puVar2[2]; - uStack_2c = puVar2[3]; - local_28 = *(undefined8 *)(puVar2 + 4); + (local_60,*(uint **)(param_1 + 8),param_3,(uint)((ulonglong)param_2 >> 0x20)); + local_48 = *puVar2; + uStack_44 = puVar2[1]; + uStack_40 = puVar2[2]; + uStack_3c = puVar2[3]; + local_38 = *(undefined8 *)(puVar2 + 4); if (g_wil_details_recordFeatureUsage != (code *)0x0) { - local_68 = &local_38; + local_78 = &local_48; (*g_wil_details_recordFeatureUsage) - (0x35b91a3,param_3,1,&Feature_HydrateLargeNonCachedFiles__private_reporting); + (*(undefined4 *)(param_1 + 0x18),param_3,1,*(undefined8 *)(param_1 + 8)); } if ((((uint)param_2 >> 10 & 1) != 0) && (param_3 != 0xfe)) { - local_58._0_6_ = CONCAT24((short)param_3,0x35b91a3); - uVar1 = (uint6)local_58; - local_58 = (ulonglong)(uint6)local_58; + local_68._0_6_ = CONCAT24((short)param_3,*(undefined4 *)(param_1 + 0x18)); + uVar1 = (uint6)local_68; + local_68 = (ulonglong)(uint6)local_68; if (((uint)param_2 >> 0xb & 1) != 0) { - local_58 = CONCAT26(1,uVar1); + local_68 = CONCAT26(1,uVar1); } - RtlNotifyFeatureUsage(&local_58); + RtlNotifyFeatureUsage(&local_68); } - return (int)local_28 == 0; + return (int)local_38 == 0; } ``` ## Feature_HydrateLargeNonCachedFiles__private_IsEnabledFallback ### Match Info |Key|pj_6725.sys - pj_6899.sys| | :---: | :---: | |diff_type|code,length,sig| |ratio|0.73| |i_ratio|0.67| |m_ratio|0.89| |b_ratio|0.89| |match_types|SymbolsHash| ### Function Meta Diff |Key|pj_6725.sys|pj_6899.sys| | :---: | :---: | :---: | |name|Feature_HydrateLargeNonCachedFiles__private_IsEnabledFallback|Feature_HydrateLargeNonCachedFiles__private_IsEnabledFallback| |fullname|Feature_HydrateLargeNonCachedFiles__private_IsEnabledFallback|Feature_HydrateLargeNonCachedFiles__private_IsEnabledFallback| |refcount|2|2| |`length`|14|21| |called|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |calling|Feature_HydrateLargeNonCachedFiles__private_IsEnabledDeviceUsageNoInline|Feature_HydrateLargeNonCachedFiles__private_IsEnabledDeviceUsageNoInline| |paramcount|2|2| |address|140003ae8|140003ae8| |`sig`|undefined __fastcall Feature_HydrateLargeNonCachedFiles__private_IsEnabledFallback(undefined4 * param_1, uint param_2)|undefined __fastcall Feature_HydrateLargeNonCachedFiles__private_IsEnabledFallback(ulonglong param_1, int param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### Feature_HydrateLargeNonCachedFiles__private_IsEnabledFallback Diff ```diff --- Feature_HydrateLargeNonCachedFiles__private_IsEnabledFallback +++ Feature_HydrateLargeNonCachedFiles__private_IsEnabledFallback @@ -1,8 +1,9 @@ -void Feature_HydrateLargeNonCachedFiles__private_IsEnabledFallback(undefined4 *param_1,uint param_2) +void Feature_HydrateLargeNonCachedFiles__private_IsEnabledFallback(ulonglong param_1,int param_2) { - wil_details_IsEnabledFallback(param_1,param_2); + wil_details_IsEnabledFallback + (param_1,param_2,&Feature_HydrateLargeNonCachedFiles__private_descriptor); return; } ``` ## PrjfUpdatePlaceholderIfNeededHandler ### Match Info |Key|pj_6725.sys - pj_6899.sys| | :---: | :---: | |diff_type|code,length,sig,address,called| |ratio|0.71| |i_ratio|0.65| |m_ratio|0.99| |b_ratio|0.94| |match_types|SymbolsHash| ### Function Meta Diff |Key|pj_6725.sys|pj_6899.sys| | :---: | :---: | :---: | |name|PrjfUpdatePlaceholderIfNeededHandler|PrjfUpdatePlaceholderIfNeededHandler| |fullname|PrjfUpdatePlaceholderIfNeededHandler|PrjfUpdatePlaceholderIfNeededHandler| |refcount|2|2| |`length`|1601|1645| |`called`|
Expand for full list:
FLTMGR.SYS::FltClose
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::RtlCompareMemory
PrjfCopyAsPlaceHolder
PrjfCreatePrjReparseBuffer
PrjfDecideUpdateDeleteOnFileStateAndUpdateFlags
PrjfGetUnionContextByVirtualizationInstanceInfo
PrjfRelPathToFullPathPrjfReleaseUnionContext
PrjfSetDeleteDisposition
PrjfValidatePlaceholderInformationMessage
WPP_RECORDER_SF_sDd
__security_check_cookie
_tlgDefineProvider_annotation__Tlgmtakm_hTelemetryAssertDiagTrackProv
memset
|
Expand for full list:
FLTMGR.SYS::FltClose
Feature_2983238971__private_IsEnabledDeviceUsageNoInline
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::RtlCompareMemory
PrjfCopyAsPlaceHolder
PrjfCreatePrjReparseBuffer
PrjfDecideUpdateDeleteOnFileStateAndUpdateFlags
PrjfGetUnionContextByVirtualizationInstanceInfoPrjfRelPathToFullPath
PrjfReleaseUnionContext
PrjfSetDeleteDisposition
PrjfValidatePlaceholderInformationMessage
WPP_RECORDER_SF_sDd
__security_check_cookie
_tlgDefineProvider_annotation__Tlgmtakm_hTelemetryAssertDiagTrackProv
memset
| |calling|PrjfPortMessage|PrjfPortMessage| |paramcount|4|5| |`address`|140029944|1400299a8| |`sig`|uint __fastcall PrjfUpdatePlaceholderIfNeededHandler(longlong param_1, uint * param_2, uint param_3, undefined4 * param_4)|uint __fastcall PrjfUpdatePlaceholderIfNeededHandler(longlong param_1, uint * param_2, longlong param_3, uint param_4, undefined4 * param_5)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### PrjfUpdatePlaceholderIfNeededHandler Called Diff ```diff --- PrjfUpdatePlaceholderIfNeededHandler called +++ PrjfUpdatePlaceholderIfNeededHandler called @@ -1,0 +2 @@ +Feature_2983238971__private_IsEnabledDeviceUsageNoInline ``` ### PrjfUpdatePlaceholderIfNeededHandler Diff ```diff --- PrjfUpdatePlaceholderIfNeededHandler +++ PrjfUpdatePlaceholderIfNeededHandler @@ -1,241 +1,249 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ uint PrjfUpdatePlaceholderIfNeededHandler - (longlong param_1,uint *param_2,uint param_3,undefined4 *param_4) + (longlong param_1,uint *param_2,longlong param_3,uint param_4,undefined4 *param_5) { ushort uVar1; ushort uVar2; uint uVar3; longlong *plVar4; longlong *plVar5; short *psVar6; ulonglong uVar7; longlong lVar8; ulonglong uVar9; undefined2 uVar10; short *psVar11; longlong lVar12; longlong *plVar13; char *pcVar14; - undefined1 auStackY_218 [32]; - byte local_1c8; - char local_1c7 [3]; - int local_1c4; - longlong *local_1c0; - longlong local_1b8; - longlong local_1b0; + undefined1 auStackY_228 [32]; + byte local_1d8; + char local_1d7 [3]; + int local_1d4; + longlong *local_1d0; + longlong local_1c8; + longlong local_1c0; + undefined8 local_1b8; + longlong lStack_1b0; undefined8 local_1a8; - longlong lStack_1a0; - undefined8 local_198; - short *psStack_190; + short *psStack_1a0; + longlong local_198; + longlong local_190; longlong local_188; - longlong local_180; longlong local_178; void *pvStack_170; - undefined4 *local_168; + longlong local_168; + undefined4 *local_160; undefined8 local_158 [16]; undefined1 local_d8 [128]; ulonglong local_58; - local_58 = __security_cookie ^ (ulonglong)auStackY_218; + local_58 = __security_cookie ^ (ulonglong)auStackY_228; plVar4 = (longlong *)0x0; + local_160 = param_5; local_188 = 0; - local_1c0 = (longlong *)0x0; - local_1c4 = 0; - local_1b0 = 0; + local_198 = 0; + local_1d0 = (longlong *)0x0; + local_1d4 = 0; + local_1c0 = 0; + lVar12 = 0; + local_1c8 = 0; + local_1a8 = 0; + psStack_1a0 = (short *)0x0; + local_1d8 = 0; local_1b8 = 0; - local_1c8 = 0; - local_1c7[0] = '\0'; - lVar12 = 0; - local_198 = 0; - psStack_190 = (short *)0x0; - local_1a8 = 0; - lStack_1a0 = 0; - local_180 = param_1; - local_168 = param_4; + lStack_1b0 = 0; + local_1d7[0] = '\0'; + local_190 = param_1; + local_168 = param_3; memset(local_158,0,0x100); - *param_4 = 0; + *param_5 = 0; if ((param_2[1] & 0x10) != 0) { MicrosoftTelemetryAssertTriggeredNoArgsKM(); } - uVar3 = PrjfValidatePlaceholderInformationMessage(param_2,param_3,&local_188); - if (local_188 != 0) { + uVar3 = PrjfValidatePlaceholderInformationMessage(param_2,param_4,&local_198); + if (local_198 != 0) { MicrosoftTelemetryAssertTriggeredNoArgsKM(); } if ((int)uVar3 < 0) { plVar5 = plVar4; if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0; uVar10 = 0xba; } else { plVar5 = PrjfGetUnionContextByVirtualizationInstanceInfo((longlong *)(param_2 + 2),param_1); if (plVar5 == (longlong *)0x0) { uVar3 = 0xc000000d; if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0; uVar10 = 0xbb; uVar3 = 0xc000000d; } else { local_178 = plVar5[5]; pvStack_170 = (void *)plVar5[6]; psVar11 = (short *)((ulonglong)param_2[0x16] + (longlong)param_2); if (psVar11 == (short *)0x0) { uVar3 = 0xc000000d; } else { uVar7 = (ulonglong)(ushort)((ushort)param_2[0x17] >> 1); for (psVar6 = psVar11; (uVar7 != 0 && (*psVar6 != 0)); psVar6 = psVar6 + 1) { uVar7 = uVar7 - 1; } uVar3 = ~-(uint)(uVar7 != 0) & 0xc000000d; if (uVar7 != 0) { - local_198 = 0; - psStack_190 = (short *)0x0; + local_1a8 = 0; + psStack_1a0 = (short *)0x0; lVar8 = 0x7fff; psVar6 = psVar11; do { if (*psVar6 == 0) break; psVar6 = psVar6 + 1; lVar8 = lVar8 + -1; } while (lVar8 != 0); uVar3 = ~-(uint)(lVar8 != 0) & 0xc000000d; if (lVar8 == 0) { - local_198._0_2_ = 0; - uVar2 = (ushort)local_198; + local_1a8._0_2_ = 0; + uVar2 = (ushort)local_1a8; } else { uVar2 = (0x7fff - (short)lVar8) * 2; - local_198 = (ulonglong)CONCAT22(uVar2 + 2,uVar2); - psStack_190 = psVar11; + local_1a8 = (ulonglong)CONCAT22(uVar2 + 2,uVar2); + psStack_1a0 = psVar11; } if ((int)uVar3 < 0) { if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0; uVar10 = 0xbd; goto LAB_1; } uVar1 = (ushort)local_178; if (((ushort)(uVar2 + (ushort)local_178) < (ushort)local_178) || (uVar2 = uVar2 + (ushort)local_178 + 2, uVar2 < 2)) { uVar3 = 0xc0000095; - local_1a8._0_4_ = CONCAT22(0xffff,(wchar_t)local_1a8); - goto LAB_0; - } - local_1a8 = (ulonglong)CONCAT42(local_1a8._4_4_,uVar2) << 0x10; - lStack_1a0 = ExAllocatePool2(0x100,uVar2,0x746d4a50); - if (lStack_1a0 == 0) { + local_1b8._0_4_ = CONCAT22(0xffff,(wchar_t)local_1b8); + goto LAB_0; + } + local_1b8 = (ulonglong)CONCAT42(local_1b8._4_4_,uVar2) << 0x10; + lStack_1b0 = ExAllocatePool2(0x100,uVar2,0x746d4a50); + if (lStack_1b0 == 0) { uVar3 = 0xc000009a; goto LAB_0; } uVar3 = PrjfRelPathToFullPath - ((ushort *)&local_1a8,uVar1,pvStack_170,psStack_190,(ushort)local_198); + ((ushort *)&local_1b8,uVar1,pvStack_170,psStack_1a0,(ushort)local_1a8); if ((int)uVar3 < 0) { if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0; uVar10 = 0xbe; goto LAB_1; } uVar3 = PrjfDecideUpdateDeleteOnFileStateAndUpdateFlags - (param_1,param_2[1],(wchar_t *)&local_1a8,&local_1b0,&local_1b8,param_4, - &local_1c8,local_158,local_1c7); + (param_1,param_2[1],(wchar_t *)&local_1b8,&local_1c0,&local_1c8,param_5, + &local_1d8,local_158,local_1d7); plVar13 = plVar4; - lVar8 = local_1b8; + lVar8 = local_1c8; if (((int)uVar3 < 0) || ((param_2[1] & 8) == 0)) { LAB_2: - if (local_1b0 != 0) { + if (local_1c0 != 0) { FltClose(); } plVar4 = plVar13; if (lVar8 != 0) { ObfDereferenceObject(lVar8); } } else { pcVar14 = (char *)((ulonglong)param_2[0x18] + (longlong)param_2); - if ((local_1c8 != 0) && + uVar7 = Feature_2983238971__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar7 != 0) { + local_188 = (ulonglong)param_2[0x18] + local_168; + } + if ((local_1d8 != 0) && (lVar8 = RtlCompareMemory(pcVar14 + 0xd0,local_d8,0x80), lVar8 == 0x80)) { uVar3 = 0; - lVar8 = local_1b8; + lVar8 = local_1c8; if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) { WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),4,0xe,0xbf, - &WPP_3ccab5108a9538d17a865fde27ef339f_Traceguids, + &WPP_2255d1e077eb3e47145ae5fb45367206_Traceguids, "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c"); - lVar8 = local_1b8; + lVar8 = local_1c8; } goto LAB_2; } - lVar8 = local_1b8; + lVar8 = local_1c8; uVar9 = (ulonglong)param_2[1]; uVar7 = PrjfSetDeleteDisposition - (local_180,local_1b8,param_2[1],local_1c7[0],(longlong)plVar5, - local_168); + (local_190,local_1c8,param_2[1],local_1d7[0],(longlong)plVar5, + local_160); uVar3 = (uint)uVar7; if ((int)uVar3 < 0) { plVar13 = (longlong *)0x0; if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) { uVar10 = 0xc0; lVar12 = lVar8; LAB_3: WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,uVar10, - &WPP_3ccab5108a9538d17a865fde27ef339f_Traceguids, + &WPP_2255d1e077eb3e47145ae5fb45367206_Traceguids, "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c"); plVar13 = plVar4; lVar8 = lVar12; } goto LAB_2; } - FltClose(local_1b0); - local_1b0 = 0; + FltClose(local_1c0); + local_1c0 = 0; ObfDereferenceObject(lVar8); _tlgDefineProvider_annotation__Tlgmtakm_hTelemetryAssertDiagTrackProv(); local_178 = *(longlong *)(param_2 + 2); pvStack_170 = *(void **)(param_2 + 4); uVar3 = PrjfCreatePrjReparseBuffer - ((ushort *)&local_198,&local_178,uVar9,(undefined8 *)(pcVar14 + 0x50), - &local_1c0,&local_1c4); - plVar4 = local_1c0; + ((ushort *)&local_1a8,&local_178,uVar9,(undefined8 *)(pcVar14 + 0x50), + &local_1d0,&local_1d4); + plVar4 = local_1d0; if ((int)uVar3 < 0) { if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) { WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0xc1, - &WPP_3ccab5108a9538d17a865fde27ef339f_Traceguids, + &WPP_2255d1e077eb3e47145ae5fb45367206_Traceguids, "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c"); - plVar4 = local_1c0; + plVar4 = local_1d0; } } else { uVar3 = PrjfCopyAsPlaceHolder - (pcVar14,(wchar_t *)&local_1a8,local_180,(longlong)local_1c0, - local_1c4,'\0',param_2[0x19]); + (pcVar14,local_188,(wchar_t *)&local_1b8,local_190, + (longlong)local_1d0,local_1d4,'\0',param_2[0x19]); if (((int)uVar3 < 0) && ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) { uVar10 = 0xc2; goto LAB_3; } } } if (plVar4 != (longlong *)0x0) { ExFreePoolWithTag(plVar4,0x69724a50); } goto LAB_0; } } if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0; uVar10 = 0xbc; } } LAB_1: WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,uVar10, - &WPP_3ccab5108a9538d17a865fde27ef339f_Traceguids, + &WPP_2255d1e077eb3e47145ae5fb45367206_Traceguids, "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c"); LAB_0: - if (lStack_1a0 != 0) { - ExFreePoolWithTag(lStack_1a0,0x746d4a50); + if (lStack_1b0 != 0) { + ExFreePoolWithTag(lStack_1b0,0x746d4a50); } if (plVar5 != (longlong *)0x0) { PrjfReleaseUnionContext((longlong)plVar5); } return uVar3; } ``` ## PrjfCopyAsPlaceHolder ### Match Info |Key|pj_6725.sys - pj_6899.sys| | :---: | :---: | |diff_type|code,length,sig,address,called| |ratio|0.18| |i_ratio|0.59| |m_ratio|0.96| |b_ratio|0.88| |match_types|SymbolsHash| ### Function Meta Diff |Key|pj_6725.sys|pj_6899.sys| | :---: | :---: | :---: | |name|PrjfCopyAsPlaceHolder|PrjfCopyAsPlaceHolder| |fullname|PrjfCopyAsPlaceHolder|PrjfCopyAsPlaceHolder| |refcount|3|3| |`length`|2202|2349| |`called`|
Expand for full list:
FLTMGR.SYS::FltAllocateExtraCreateParameterFromLookasideList
FLTMGR.SYS::FltAllocateExtraCreateParameterList
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltCreateFileEx2
FLTMGR.SYS::FltFreeExtraCreateParameterList
FLTMGR.SYS::FltInsertExtraCreateParameter
FLTMGR.SYS::FltIsEcpAcknowledged
FLTMGR.SYS::FltRemoveExtraCreateParameter
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ObfDereferenceObject
PrjfCopyFileMetaDataWPP_RECORDER_SF_sD
WPP_RECORDER_SF_sDd
WPP_RECORDER_SF_sDdZ
__security_check_cookie
memset
|
Expand for full list:
FLTMGR.SYS::FltAllocateExtraCreateParameterFromLookasideList
FLTMGR.SYS::FltAllocateExtraCreateParameterList
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltCreateFileEx2
FLTMGR.SYS::FltFreeExtraCreateParameterList
FLTMGR.SYS::FltInsertExtraCreateParameter
FLTMGR.SYS::FltIsEcpAcknowledged
FLTMGR.SYS::FltRemoveExtraCreateParameter
Feature_2983238971__private_IsEnabledDeviceUsageNoInline
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ObfDereferenceObjectNTOSKRNL.EXE::SeCaptureSecurityDescriptor
NTOSKRNL.EXE::SeReleaseSecurityDescriptor
PrjfCopyFileMetaData
WPP_RECORDER_SF_sD
WPP_RECORDER_SF_sDd
WPP_RECORDER_SF_sDdZ
__security_check_cookie
memset
| |calling|PrjfUpdatePlaceholderIfNeededHandler
PrjfWritePlaceholderInformationHandler|PrjfUpdatePlaceholderIfNeededHandler
PrjfWritePlaceholderInformationHandler| |paramcount|7|8| |`address`|14002bf88|14002c038| |`sig`|int __fastcall PrjfCopyAsPlaceHolder(char * param_1, wchar_t * param_2, longlong param_3, longlong param_4, int param_5, char param_6, uint param_7)|int __fastcall PrjfCopyAsPlaceHolder(char * param_1, longlong param_2, wchar_t * param_3, longlong param_4, longlong param_5, int param_6, char param_7, uint param_8)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### PrjfCopyAsPlaceHolder Called Diff ```diff --- PrjfCopyAsPlaceHolder called +++ PrjfCopyAsPlaceHolder called @@ -8,0 +9 @@ +Feature_2983238971__private_IsEnabledDeviceUsageNoInline @@ -10,0 +12,2 @@ +NTOSKRNL.EXE::SeCaptureSecurityDescriptor +NTOSKRNL.EXE::SeReleaseSecurityDescriptor ``` ### PrjfCopyAsPlaceHolder Diff ```diff --- PrjfCopyAsPlaceHolder +++ PrjfCopyAsPlaceHolder @@ -1,332 +1,350 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ int PrjfCopyAsPlaceHolder - (char *param_1,wchar_t *param_2,longlong param_3,longlong param_4,int param_5, - char param_6,uint param_7) + (char *param_1,longlong param_2,wchar_t *param_3,longlong param_4,longlong param_5, + int param_6,char param_7,uint param_8) { - longlong lVar1; - char cVar2; - int iVar3; - uint uVar4; - ushort uVar5; - uint uVar6; - undefined2 uVar7; - undefined1 auStackY_198 [32]; - undefined8 uVar8; - undefined4 uVar9; - undefined8 uVar10; - undefined4 uVar11; - undefined2 *local_118; - int local_110; - uint local_10c; - wchar_t *local_108; + uint uVar1; + longlong lVar2; + char cVar3; + int iVar4; + ulonglong uVar5; + ushort uVar6; + uint uVar7; + undefined2 uVar8; + undefined1 auStackY_1a8 [32]; + undefined8 uVar9; + undefined4 uVar10; + undefined8 uVar11; + undefined4 uVar12; + undefined2 *local_128; + int local_120; + uint local_11c; + wchar_t *local_118; + longlong local_110; + longlong local_108; longlong local_100; - longlong local_f8; - longlong local_f0; - int local_e8; - undefined4 local_e4; - char *local_e0; - char *local_d8; - longlong local_d0; + char *local_f8; + int local_f0; + undefined4 local_ec; + char *local_e8; + longlong local_e0; + undefined8 local_d8; + longlong lStack_d0; undefined8 local_c8; - longlong lStack_c0; - undefined8 local_b8; - undefined8 uStack_b0; - ulonglong local_a8; - undefined8 local_a0; + undefined8 uStack_c0; + ulonglong local_b8; + undefined8 local_b0; + undefined8 uStack_a8; + wchar_t *local_a0; undefined8 uStack_98; - wchar_t *local_90; - undefined8 uStack_88; - char *local_80; - ulonglong local_78; + char *local_90; + ulonglong local_88; + undefined8 local_80; + undefined8 uStack_78; undefined8 local_70; undefined8 uStack_68; undefined8 local_60; undefined8 uStack_58; - undefined8 local_50; - undefined8 uStack_48; - ulonglong local_40; + ulonglong local_50; - local_40 = __security_cookie ^ (ulonglong)auStackY_198; - local_d8 = (char *)0x0; + local_50 = __security_cookie ^ (ulonglong)auStackY_1a8; + local_b8 = local_b8 & 0xffffffffffff0000; + local_90 = (char *)0x0; + local_e8 = (char *)0x0; + local_120 = 0; + local_f8 = (char *)0x0; local_110 = 0; - local_e0 = (char *)0x0; + local_128 = (undefined2 *)0x0; + local_88 = local_88 & 0xffffffff00000000; + local_108 = 0; local_100 = 0; - local_118 = (undefined2 *)0x0; - local_a8 = local_a8 & 0xffffffffffff0000; - local_80 = (char *)0x0; - local_78 = local_78 & 0xffffffff00000000; - local_f8 = 0; - local_f0 = 0; + local_d8 = 0; + lStack_d0 = 0; local_c8 = 0; - lStack_c0 = 0; - local_b8 = 0; - uStack_b0 = 0; - local_a0 = 0; + uStack_c0 = 0; + local_b0 = 0; + uStack_a8 = 0; + local_a0 = (wchar_t *)0x0; uStack_98 = 0; - local_90 = (wchar_t *)0x0; - uStack_88 = 0; + local_80 = 0; + uStack_78 = 0; local_70 = 0; uStack_68 = 0; local_60 = 0; uStack_58 = 0; - local_50 = 0; - uStack_48 = 0; - local_108 = param_2; - local_d0 = param_3; - if ((param_5 == 0) || (param_4 == 0)) { + local_118 = param_3; + local_e0 = param_4; + if ((param_6 == 0) || (param_5 == 0)) { if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) { - uVar7 = 0x3d; + uVar8 = 0x3d; LAB_0: - WPP_RECORDER_SF_sD(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,uVar7, - &WPP_eb4ee84f974430c4f79bbe27822c6228_Traceguids, + WPP_RECORDER_SF_sD(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,uVar8, + &WPP_a7b4d8e3d5bf39a415b91bbd80b0d6bf_Traceguids, "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c"); } - } - else if (param_5 == *(ushort *)(param_4 + 4) + 8) { +LAB_1: + iVar4 = -0x3ffffff3; + } + else { + if (param_6 != *(ushort *)(param_5 + 4) + 8) { + if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) { + uVar8 = 0x3e; + goto LAB_0; + } + goto LAB_1; + } if (param_1 == (char *)0x0) { if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) { - uVar7 = 0x3f; + uVar8 = 0x3f; goto LAB_0; } + goto LAB_1; + } + iVar4 = *(int *)(param_1 + 0x38); + if (iVar4 != 0) { + uVar7 = *(uint *)(param_1 + 0x3c); + if (0x14f < uVar7) { + if (uVar7 + iVar4 < uVar7) { + iVar4 = -0x3fffff6b; + if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) + goto LAB_2; + uVar8 = 0x41; + iVar4 = -0x3fffff6b; + } + else { + if (uVar7 + iVar4 <= param_8) { + local_e8 = param_1 + uVar7; + local_120 = iVar4; + goto LAB_3; + } + iVar4 = -0x3ffffff3; + if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) + goto LAB_2; + uVar8 = 0x42; + iVar4 = -0x3ffffff3; + } + goto LAB_4; + } + if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) { + uVar8 = 0x40; + goto LAB_0; + } + goto LAB_1; + } +LAB_3: + if (*(int *)(param_1 + 0x40) == 0) goto LAB_5; + uVar7 = *(uint *)(param_1 + 0x44); + if (uVar7 < 0x150) { + if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) { + uVar8 = 0x43; + goto LAB_0; + } + goto LAB_1; + } + uVar1 = uVar7 + *(int *)(param_1 + 0x40); + if (uVar1 < uVar7) { + iVar4 = -0x3fffff6b; + if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_2; + uVar8 = 0x44; + iVar4 = -0x3fffff6b; +LAB_4: + uVar7 = 0xe; +LAB_6: + WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,uVar7,uVar8, + &WPP_a7b4d8e3d5bf39a415b91bbd80b0d6bf_Traceguids, + "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c"); } else { - iVar3 = *(int *)(param_1 + 0x38); - if (iVar3 == 0) { -LAB_1: - if (*(int *)(param_1 + 0x40) == 0) { -LAB_2: - if (*(int *)(param_1 + 0x48) != 0) { - return -0x3fffff45; - } - uVar6 = *(uint *)(param_1 + 0x30); - local_e8 = (*param_1 != '\0') + 0x200028; - local_10c = uVar6; - iVar3 = FltAllocateExtraCreateParameterList(Globals,0,&local_100); - if (iVar3 < 0) { - if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) - goto LAB_3; - uVar7 = 0x49; + if (param_8 < uVar1) { + iVar4 = -0x3ffffff3; + if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_2; + uVar8 = 0x45; + iVar4 = -0x3ffffff3; + goto LAB_4; + } + uVar5 = Feature_2983238971__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar5 == 0) { + local_f8 = param_1 + *(uint *)(param_1 + 0x44); +LAB_5: + if (*(int *)(param_1 + 0x48) != 0) { + iVar4 = -0x3fffff45; + goto LAB_7; + } + uVar7 = *(uint *)(param_1 + 0x30); + local_f0 = (*param_1 != '\0') + 0x200028; + local_11c = uVar7; + iVar4 = FltAllocateExtraCreateParameterList(Globals,0,&local_110); + if (-1 < iVar4) { + iVar4 = FltAllocateExtraCreateParameterFromLookasideList + (Globals,&GUID_ECP_ATOMIC_CREATE,0x58); + if (iVar4 < 0) { + if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) { + uVar8 = 0x4b; + goto LAB_8; + } } else { - iVar3 = FltAllocateExtraCreateParameterFromLookasideList - (Globals,&GUID_ECP_ATOMIC_CREATE,0x58); - if (-1 < iVar3) { - memset(local_118,0,0x58); - *local_118 = 0x58; - local_118[1] = 2; - local_118[2] = 0; - uVar5 = *(ushort *)(param_4 + 4) + 8; - if (uVar5 < *(ushort *)(param_4 + 4)) { - local_118[3] = 0xffff; - iVar3 = -0x3fffff6b; - goto LAB_3; + memset(local_128,0,0x58); + *local_128 = 0x58; + local_128[1] = 2; + local_128[2] = 0; + uVar6 = *(ushort *)(param_5 + 4) + 8; + if (uVar6 < *(ushort *)(param_5 + 4)) { + local_128[3] = 0xffff; + iVar4 = -0x3fffff6b; + } + else { + local_128[3] = uVar6; + *(longlong *)(local_128 + 4) = param_5; + if (*param_1 == '\0') { + local_128[1] = local_128[1] | 1; + *(undefined8 *)(local_128 + 8) = *(undefined8 *)(param_1 + 8); + local_128[1] = local_128[1] | 4; + *(undefined8 *)(local_128 + 0xc) = *(undefined8 *)(param_1 + 8); + local_128[1] = local_128[1] | 8; } - local_118[3] = uVar5; - *(longlong *)(local_118 + 4) = param_4; - if (*param_1 == '\0') { - local_118[1] = local_118[1] | 1; - *(undefined8 *)(local_118 + 8) = *(undefined8 *)(param_1 + 8); - local_118[1] = local_118[1] | 4; - *(undefined8 *)(local_118 + 0xc) = *(undefined8 *)(param_1 + 8); - local_118[1] = local_118[1] | 8; + if (DAT_9 == '\0') { + if (param_7 != '\0') { + local_128[1] = local_128[1] | 0x400; + local_128[1] = local_128[1] | 0x200; + } + uStack_58 = *(undefined8 *)(param_1 + 0x28); + local_70 = *(undefined8 *)(param_1 + 0x10); + uStack_68 = *(undefined8 *)(param_1 + 0x18); + local_60 = *(undefined8 *)(param_1 + 0x20); + *(undefined8 **)(local_128 + 0x10) = &local_70; + local_128[1] = local_128[1] | 0x10; + local_128[1] = local_128[1] | 0x20; + local_11c = uVar7 | 0x400000; + *(uint *)(local_128 + 0x14) = local_11c; } - if (DAT_4 == '\0') { - if (param_6 != '\0') { - local_118[1] = local_118[1] | 0x400; - local_118[1] = local_118[1] | 0x200; - } - uStack_48 = *(undefined8 *)(param_1 + 0x28); - local_60 = *(undefined8 *)(param_1 + 0x10); - uStack_58 = *(undefined8 *)(param_1 + 0x18); - local_50 = *(undefined8 *)(param_1 + 0x20); - *(undefined8 **)(local_118 + 0x10) = &local_60; - local_118[1] = local_118[1] | 0x10; - local_118[1] = local_118[1] | 0x20; - local_10c = uVar6 | 0x400000; - *(uint *)(local_118 + 0x14) = local_10c; - } - while (iVar3 = FltInsertExtraCreateParameter(Globals,local_100,local_118), -1 < iVar3) + while (iVar4 = FltInsertExtraCreateParameter(Globals,local_110,local_128), -1 < iVar4) { - local_c8 = 0x28; - lStack_c0 = local_100; - local_90 = local_108; - local_80 = local_e0; - uVar9 = (undefined4)((ulonglong)&local_70 >> 0x20); - uVar11 = 0; - local_a8 = 1; - uStack_98 = 0; - local_78 = 0; - local_b8 = 0; - uStack_b0 = 0; - local_a0 = CONCAT44(local_a0._4_4_,0x30); - uStack_88 = CONCAT44(uStack_88._4_4_,0x240); - iVar3 = FltCreateFileEx2(Globals,local_d0,&local_f8,&local_f0); - if (-1 < iVar3) { - cVar2 = FltIsEcpAcknowledged(Globals,local_118); - lVar1 = local_d0; - if (cVar2 == '\0') { - iVar3 = -0x3fffff45; + local_d8 = 0x28; + lStack_d0 = local_110; + local_a0 = local_118; + local_90 = local_f8; + uVar10 = (undefined4)((ulonglong)&local_80 >> 0x20); + uVar12 = 0; + local_b8 = 1; + uStack_a8 = 0; + local_88 = 0; + local_c8 = 0; + uStack_c0 = 0; + local_b0 = CONCAT44(local_b0._4_4_,0x30); + uStack_98 = CONCAT44(uStack_98._4_4_,0x240); + iVar4 = FltCreateFileEx2(Globals,local_e0,&local_108,&local_100); + if (-1 < iVar4) { + cVar3 = FltIsEcpAcknowledged(Globals,local_128); + lVar2 = local_e0; + if (cVar3 == '\0') { + iVar4 = -0x3fffff45; if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) { - uVar7 = 0x4f; - uVar10 = CONCAT44(uVar11,0xc00000bb); - uVar8 = CONCAT44(uVar9,0xdfd); - iVar3 = -0x3fffff45; - goto LAB_5; + uVar8 = 0x50; + uVar11 = CONCAT44(uVar12,0xc00000bb); + uVar9 = CONCAT44(uVar10,0xe2a); + iVar4 = -0x3fffff45; + goto LAB_10; } } else { - iVar3 = PrjfCopyFileMetaData((longlong)param_1,local_f8,local_f0,local_d0,2); - if ((-1 < iVar3) && (DAT_4 != '\0')) { - iVar3 = PrjfCopyFileMetaData((longlong)param_1,local_f8,local_f0,lVar1,0x68); + iVar4 = PrjfCopyFileMetaData((longlong)param_1,local_108,local_100,local_e0,2); + if ((-1 < iVar4) && (DAT_9 != '\0')) { + iVar4 = PrjfCopyFileMetaData((longlong)param_1,local_108,local_100,lVar2,0x68) + ; } } - goto LAB_3; - } - if (iVar3 == -0x3fffffcb) { - iVar3 = 0; - goto LAB_3; - } - if ((iVar3 != -0x3fffff45) || (DAT_4 != '\0')) { + goto LAB_7; + } + if (iVar4 == -0x3fffffcb) { + iVar4 = 0; + goto LAB_7; + } + if ((iVar4 != -0x3fffff45) || (DAT_9 != '\0')) { if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) { - uVar7 = 0x4e; - uVar10 = CONCAT44(uVar11,iVar3); - uVar8 = CONCAT44(uVar9,0xde4); -LAB_5: + uVar8 = 0x4f; + uVar11 = CONCAT44(uVar12,iVar4); + uVar9 = CONCAT44(uVar10,0xe11); +LAB_10: WPP_RECORDER_SF_sDdZ - (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,10,uVar7, - &WPP_eb4ee84f974430c4f79bbe27822c6228_Traceguids, - "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",uVar8,uVar10, - local_108); + (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,10,uVar8, + &WPP_a7b4d8e3d5bf39a415b91bbd80b0d6bf_Traceguids, + "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",uVar9,uVar11, + local_118); } - goto LAB_3; + goto LAB_7; } if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) { - uVar10 = CONCAT44(uVar11,0xc00000bb); - uVar8 = CONCAT44(uVar9,0xdab); + uVar11 = CONCAT44(uVar12,0xc00000bb); + uVar9 = CONCAT44(uVar10,0xdd8); WPP_RECORDER_SF_sDdZ - (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),4,10,0x4c, - &WPP_eb4ee84f974430c4f79bbe27822c6228_Traceguids, - "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",uVar8,uVar10,local_108 + (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),4,10,0x4d, + &WPP_a7b4d8e3d5bf39a415b91bbd80b0d6bf_Traceguids, + "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",uVar9,uVar11,local_118 ); - uVar9 = (undefined4)((ulonglong)uVar8 >> 0x20); - uVar11 = (undefined4)((ulonglong)uVar10 >> 0x20); - } - local_e4 = 0; - DAT_4 = '\x01'; - iVar3 = FltRemoveExtraCreateParameter - (Globals,local_100,&GUID_ECP_ATOMIC_CREATE,&local_118); - if (iVar3 < 0) { + uVar10 = (undefined4)((ulonglong)uVar9 >> 0x20); + uVar12 = (undefined4)((ulonglong)uVar11 >> 0x20); + } + local_ec = 0; + DAT_9 = '\x01'; + iVar4 = FltRemoveExtraCreateParameter + (Globals,local_110,&GUID_ECP_ATOMIC_CREATE,&local_128); + if (iVar4 < 0) { if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) { - uVar7 = 0x4d; - uVar10 = CONCAT44(uVar11,iVar3); - uVar8 = CONCAT44(uVar9,0xdc9); - goto LAB_5; + uVar8 = 0x4e; + uVar11 = CONCAT44(uVar12,iVar4); + uVar9 = CONCAT44(uVar10,0xdf6); + goto LAB_10; } - goto LAB_3; - } - local_118[1] = local_118[1] & 0xffef; - local_118[1] = local_118[1] & 0xfbff; - local_118[1] = local_118[1] & 0xfdff; - local_118[1] = local_118[1] & 0xffdf; + goto LAB_7; + } + local_128[1] = local_128[1] & 0xffef; + local_128[1] = local_128[1] & 0xfbff; + local_128[1] = local_128[1] & 0xfdff; + local_128[1] = local_128[1] & 0xffdf; } MicrosoftTelemetryAssertTriggeredNoArgsKM(); - if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) - goto LAB_3; - uVar7 = 0x4b; - uVar6 = 0xf; - goto LAB_6; + if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) { + uVar8 = 0x4c; + uVar7 = 0xf; + goto LAB_6; + } } - if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) - goto LAB_3; - uVar7 = 0x4a; } - uVar6 = 5; + goto LAB_7; } - else { - uVar6 = *(uint *)(param_1 + 0x44); - if (uVar6 < 0x150) { - if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) { - uVar7 = 0x43; - goto LAB_0; - } - goto LAB_7; - } - uVar4 = *(int *)(param_1 + 0x40) + uVar6; - if (uVar4 < uVar6) { - iVar3 = -0x3fffff6b; - if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) { - return -0x3fffff6b; - } - uVar7 = 0x44; - } - else { - if (uVar4 <= param_7) { - local_e0 = param_1 + uVar6; - goto LAB_2; - } - iVar3 = -0x3ffffff3; - if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) { - return -0x3ffffff3; - } - uVar7 = 0x45; - } + if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_7; + uVar8 = 0x4a; LAB_8: - uVar6 = 0xe; - } -LAB_6: - WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,uVar6,uVar7, - &WPP_eb4ee84f974430c4f79bbe27822c6228_Traceguids, - "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c"); - goto LAB_3; - } - uVar6 = *(uint *)(param_1 + 0x3c); - if (0x14f < uVar6) { - if (uVar6 + iVar3 < uVar6) { - iVar3 = -0x3fffff6b; - if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) { - return -0x3fffff6b; - } - uVar7 = 0x41; - } - else { - if (uVar6 + iVar3 <= param_7) { - local_d8 = param_1 + uVar6; - local_110 = iVar3; - goto LAB_1; - } - iVar3 = -0x3ffffff3; - if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) { - return -0x3ffffff3; - } - uVar7 = 0x42; - } - goto LAB_8; - } - if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) { - uVar7 = 0x40; - goto LAB_0; - } - } - } - else if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) { - uVar7 = 0x3e; - goto LAB_0; + uVar7 = 5; + goto LAB_6; + } + iVar4 = SeCaptureSecurityDescriptor((ulonglong)*(uint *)(param_1 + 0x44) + param_2,1,1); + if (-1 < iVar4) goto LAB_5; + if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) { + uVar8 = 0x46; + goto LAB_4; + } + } } LAB_7: - iVar3 = -0x3ffffff3; -LAB_3: + if (local_110 != 0) { + FltFreeExtraCreateParameterList(Globals); + } + if (local_108 != 0) { + FltClose(); + } if (local_100 != 0) { - FltFreeExtraCreateParameterList(Globals); - } - if (local_f8 != 0) { - FltClose(); - } - if (local_f0 != 0) { ObfDereferenceObject(); } - return iVar3; +LAB_2: + uVar5 = Feature_2983238971__private_IsEnabledDeviceUsageNoInline(); + if (((int)uVar5 != 0) && (local_f8 != (char *)0x0)) { + SeReleaseSecurityDescriptor(local_f8,1,1); + } + return iVar4; } ``` ## PrjfPortMessage ### Match Info |Key|pj_6725.sys - pj_6899.sys| | :---: | :---: | |diff_type|code,length,called| |ratio|0.45| |i_ratio|0.48| |m_ratio|0.98| |b_ratio|0.82| |match_types|SymbolsHash| ### Function Meta Diff |Key|pj_6725.sys|pj_6899.sys| | :---: | :---: | :---: | |name|PrjfPortMessage|PrjfPortMessage| |fullname|PrjfPortMessage|PrjfPortMessage| |refcount|4|4| |`length`|3297|3398| |`called`|
Expand for full list:
FLTMGR.SYS::FltGetInstanceContext
FLTMGR.SYS::FltReleaseContext
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
PrjfAttachFilterHandler
PrjfClearNegativePathCacheHandler
PrjfCloseFileHandler
PrjfCompleteCommandHandler
PrjfDeleteFileHandler
PrjfOpenFileHandler
PrjfReadFileHandlerPrjfSetupVolumeInformationHandler
PrjfUpdatePlaceholderIfNeededHandler
PrjfWriteFileDataHandler
PrjfWritePlaceholderInformationHandler
WPP_RECORDER_SF_sD
WPP_RECORDER_SF_sDDd
WPP_RECORDER_SF_sDd
WPP_RECORDER_SF_sDdD
__security_check_cookie
memcpy
|
Expand for full list:
FLTMGR.SYS::FltGetInstanceContext
FLTMGR.SYS::FltReleaseContext
Feature_2983238971__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
PrjfAttachFilterHandler
PrjfClearNegativePathCacheHandler
PrjfCloseFileHandler
PrjfCompleteCommandHandler
PrjfDeleteFileHandler
PrjfOpenFileHandlerPrjfReadFileHandler
PrjfSetupVolumeInformationHandler
PrjfUpdatePlaceholderIfNeededHandler
PrjfWriteFileDataHandler
PrjfWritePlaceholderInformationHandler
WPP_RECORDER_SF_sD
WPP_RECORDER_SF_sDDd
WPP_RECORDER_SF_sDd
WPP_RECORDER_SF_sDdD
__security_check_cookie
memcpy
| |calling||| |paramcount|6|6| |address|140026ca0|140026ca0| |sig|uint __fastcall PrjfPortMessage(longlong param_1, void * param_2, uint param_3, void * param_4, uint param_5, uint * param_6)|uint __fastcall PrjfPortMessage(longlong param_1, void * param_2, uint param_3, void * param_4, uint param_5, uint * param_6)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### PrjfPortMessage Called Diff ```diff --- PrjfPortMessage called +++ PrjfPortMessage called @@ -2,0 +3 @@ +Feature_2983238971__private_IsEnabledDeviceUsageNoInline ``` ### PrjfPortMessage Diff ```diff --- PrjfPortMessage +++ PrjfPortMessage @@ -1,468 +1,485 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ uint PrjfPortMessage(longlong param_1,void *param_2,uint param_3,void *param_4,uint param_5, uint *param_6) { - int iVar1; - ulonglong uVar2; + ulonglong uVar1; + uint uVar2; uint uVar3; uint uVar4; + int iVar5; int *_Dst; undefined4 *_Src; - undefined8 uVar5; - undefined4 *puVar6; - ulonglong _Size; - undefined2 uVar7; - uint uVar8; + undefined8 uVar6; + longlong lVar7; + undefined4 *puVar8; + ulonglong uVar9; + undefined2 uVar10; undefined1 auStackY_c8 [32]; void *local_78; undefined4 *local_70; - int *local_68; - void *local_60; - undefined8 local_58; - undefined8 uStack_50; - ulonglong local_48; + longlong local_68; + int *local_60; + void *local_58; + uint *local_50; + undefined8 uStack_48; + ulonglong local_40; - local_48 = __security_cookie ^ (ulonglong)auStackY_c8; - _Size = (ulonglong)param_3; - uVar4 = 0; + local_40 = __security_cookie ^ (ulonglong)auStackY_c8; + uVar9 = (ulonglong)param_3; + local_50 = param_6; + uVar3 = 0; _Dst = (int *)0x0; _Src = (undefined4 *)0x0; local_70 = (undefined4 *)0x0; - puVar6 = _Src; + puVar8 = _Src; local_78 = param_2; - local_60 = param_4; + local_68 = param_1; + local_58 = param_4; if (param_3 < 0x10) { - uVar4 = 0xc000000d; + uVar3 = 0xc000000d; if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0; - uVar7 = 0x56; + uVar10 = 0x56; } else { - _Dst = (int *)ExAllocatePool2(0x102,_Size,0x746d4a50); - local_68 = _Dst; + _Dst = (int *)ExAllocatePool2(0x102,uVar9,0x746d4a50); + local_60 = _Dst; if (_Dst == (int *)0x0) { - uVar4 = 0xc000009a; + uVar3 = 0xc000009a; if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0; - uVar7 = 0x57; + uVar10 = 0x57; LAB_1: - uVar4 = 0xc000009a; + uVar3 = 0xc000009a; WPP_RECORDER_SF_sDDd - (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,uVar7, - &WPP_3ccab5108a9538d17a865fde27ef339f_Traceguids, + (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,uVar10, + &WPP_2255d1e077eb3e47145ae5fb45367206_Traceguids, "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c"); - puVar6 = _Src; + puVar8 = _Src; goto LAB_0; } - memcpy(_Dst,local_78,_Size); + memcpy(_Dst,local_78,uVar9); if (_Dst[1] == param_3) { if (*_Dst != 5) { if (param_5 < 0xc) { - uVar4 = 0xc000000d; - puVar6 = (undefined4 *)0x0; + uVar3 = 0xc000000d; + puVar8 = (undefined4 *)0x0; if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0; - uVar7 = 0x5a; + uVar10 = 0x5a; goto LAB_2; } - _Size = 0x746d4a50; - _Src = (undefined4 *)ExAllocatePool2(0x100,(ulonglong)param_5); + uVar9 = 0x746d4a50; + _Src = (undefined4 *)ExAllocatePool2(0x100); local_70 = _Src; if (_Src == (undefined4 *)0x0) { - uVar4 = 0xc000009a; - puVar6 = _Src; + uVar3 = 0xc000009a; + puVar8 = _Src; if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0; - uVar7 = 0x5b; + uVar10 = 0x5b; goto LAB_1; } } - puVar6 = _Src; - if (param_1 == 0) { - uVar4 = 0xc000000d; + puVar8 = _Src; + if (local_68 == 0) { + uVar3 = 0xc000000d; if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0; - uVar7 = 0x5c; + uVar10 = 0x5c; } else { - uVar2 = *(ulonglong *)(param_1 + 8); - if (uVar2 != 0) { - if (*(int *)(param_1 + 0x18) == 2) goto LAB_3; + uVar1 = *(ulonglong *)(local_68 + 8); + if (uVar1 != 0) { + if (*(int *)(local_68 + 0x18) == 2) goto LAB_3; LAB_4: - iVar1 = *_Dst; - if (iVar1 < 0xd) { - if (iVar1 == 0xc) { + iVar5 = *_Dst; + if (iVar5 < 0xd) { + if (iVar5 == 0xc) { if (_Dst[1] == 0x78) { - uVar3 = _Dst[0x1c] + 0x10; - uVar8 = 0xffffffff; - if (uVar3 >= 0x10) { - uVar8 = uVar3; - } - uVar4 = -(uint)(uVar3 < 0x10) & 0xc0000095; - if (0xf < uVar3) { - if (uVar8 <= param_5) { - *_Src = 0xd; - _Src[1] = uVar8; - uVar3 = PrjfReadFileHandler(uVar2,(longlong *)(_Dst + 2),(longlong)(_Src + 2), - uVar8 - 8); + uVar4 = _Dst[0x1c] + 0x10; + uVar2 = 0xffffffff; + if (uVar4 >= 0x10) { + uVar2 = uVar4; + } + uVar3 = -(uint)(uVar4 < 0x10) & 0xc0000095; + if (0xf < uVar4) { + if (param_5 < uVar2) { + uVar3 = 0xc000000d; + if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) + goto LAB_0; + uVar10 = 0x6c; goto LAB_5; } - uVar4 = 0xc000000d; - if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) - goto LAB_0; - uVar7 = 0x6c; + *_Src = 0xd; + _Src[1] = uVar2; + iVar5 = PrjfReadFileHandler(uVar1,(longlong *)(_Dst + 2),(longlong)(_Src + 2), + uVar2 - 8); + _Src[2] = iVar5; + *local_50 = uVar2; goto LAB_6; } if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0; - uVar7 = 0x6b; - } - else { - uVar4 = 0xc000000d; - if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) - goto LAB_0; - uVar7 = 0x6a; - } - } - else if (iVar1 == 1) { + uVar10 = 0x6b; + } + else { + uVar3 = 0xc000000d; + if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) + goto LAB_0; + uVar10 = 0x6a; + } + } + else if (iVar5 == 1) { if (param_5 < 0xc) { - uVar4 = 0xc000000d; - if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) - goto LAB_0; - uVar7 = 0x61; + uVar3 = 0xc000000d; + if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) + goto LAB_0; + uVar10 = 0x61; } else { if ((ulonglong)(uint)_Dst[1] == (ulonglong)(uint)_Dst[2] + 8) { *_Src = 2; _Src[1] = 0xc; - uVar4 = PrjfWriteFileDataHandler(uVar2,(uint *)(_Dst + 2),_Dst[1] - 8); + uVar3 = PrjfWriteFileDataHandler(uVar1,(uint *)(_Dst + 2),_Dst[1] - 8); LAB_7: - _Src[2] = uVar4; + _Src[2] = uVar3; LAB_8: *param_6 = 0xc; - uVar4 = 0; - goto LAB_9; - } - uVar4 = 0xc000000d; - if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) - goto LAB_0; - uVar7 = 0x62; - } - } - else if (iVar1 == 3) { + uVar3 = 0; + goto LAB_6; + } + uVar3 = 0xc000000d; + if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) + goto LAB_0; + uVar10 = 0x62; + } + } + else if (iVar5 == 3) { if (param_5 < 0xc) { - uVar4 = 0xc000000d; - if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) - goto LAB_0; - uVar7 = 0x5f; - } - else { + uVar3 = 0xc000000d; + if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) + goto LAB_0; + uVar10 = 0x5f; + } + else { + uVar9 = Feature_2983238971__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar9 == 0) { + lVar7 = 0; + } + else { + lVar7 = (longlong)local_78 + 8; + } if ((ulonglong)(uint)_Dst[1] == (ulonglong)(uint)_Dst[2] + 8) { *_Src = 4; _Src[1] = 0xc; - uVar4 = PrjfWritePlaceholderInformationHandler - (uVar2,(uint *)(_Dst + 2),_Dst[1] - 8); + uVar3 = PrjfWritePlaceholderInformationHandler + (uVar1,(uint *)(_Dst + 2),lVar7,_Dst[1] - 8); goto LAB_7; } - uVar4 = 0xc000000d; - if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) - goto LAB_0; - uVar7 = 0x60; - } - } - else if (iVar1 == 5) { + uVar3 = 0xc000000d; + if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) + goto LAB_0; + uVar10 = 0x60; + } + } + else if (iVar5 == 5) { if ((ulonglong)(uint)_Dst[1] == (ulonglong)(uint)_Dst[2] + 8) { - PrjfCompleteCommandHandler(uVar2,(uint *)(_Dst + 2),_Size); + PrjfCompleteCommandHandler(uVar1,(uint *)(_Dst + 2),uVar9); *param_6 = 0; - goto LAB_9; - } - uVar4 = 0xc000000d; + goto LAB_6; + } + uVar3 = 0xc000000d; if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0; - uVar7 = 99; + uVar10 = 99; } else { - if (iVar1 != 6) { - if (iVar1 == 8) { - uVar8 = 0x1c; + if (iVar5 != 6) { + if (iVar5 == 8) { if (0x1b < param_5) { - if ((ulonglong)(uint)_Dst[1] == (ulonglong)(uint)_Dst[2] + 8) { - *_Src = 9; - _Src[1] = 0x1c; - uVar3 = PrjfOpenFileHandler(uVar2,(uint *)(_Dst + 2),_Dst[1] - 8, - (longlong)(_Src + 2)); - uVar4 = 0; - goto LAB_5; + if ((ulonglong)(uint)_Dst[1] != (ulonglong)(uint)_Dst[2] + 8) { + uVar3 = 0xc000000d; + if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) + goto LAB_0; + uVar10 = 0x67; + goto LAB_9; } - uVar4 = 0xc000000d; - if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) - goto LAB_0; - uVar7 = 0x67; - goto LAB_10; - } - uVar4 = 0xc000000d; + *_Src = 9; + _Src[1] = 0x1c; + uVar2 = PrjfOpenFileHandler(uVar1,(uint *)(_Dst + 2),_Dst[1] - 8, + (longlong)(_Src + 2)); + _Src[2] = uVar2; + *param_6 = 0x1c; + goto LAB_6; + } + uVar3 = 0xc000000d; if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0; - uVar7 = 0x66; + uVar10 = 0x66; } else { - if (iVar1 != 10) goto LAB_11; + if (iVar5 != 10) goto LAB_10; if (0xb < param_5) { if (_Dst[1] == 0x68) { *_Src = 0xb; _Src[1] = 0xc; - uVar5 = PrjfCloseFileHandler(uVar2,(longlong *)(_Dst + 2)); - uVar4 = (uint)uVar5; + uVar6 = PrjfCloseFileHandler(uVar1,(longlong *)(_Dst + 2)); + uVar3 = (uint)uVar6; goto LAB_7; } - uVar4 = 0xc000000d; + uVar3 = 0xc000000d; if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0; - uVar7 = 0x69; + uVar10 = 0x69; goto LAB_2; } - uVar4 = 0xc000000d; + uVar3 = 0xc000000d; if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0; - uVar7 = 0x68; - } - goto LAB_6; + uVar10 = 0x68; + } + goto LAB_5; } if (param_5 < 0xc) { - uVar4 = 0xc000000d; - if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) - goto LAB_0; - uVar7 = 100; + uVar3 = 0xc000000d; + if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) + goto LAB_0; + uVar10 = 100; } else { if ((ulonglong)(uint)_Dst[1] == (ulonglong)(uint)_Dst[2] + 8) { *_Src = 7; _Src[1] = 0xc; - uVar4 = PrjfSetupVolumeInformationHandler((uint *)(_Dst + 2),_Dst[1] - 8); + uVar3 = PrjfSetupVolumeInformationHandler((uint *)(_Dst + 2),_Dst[1] - 8); goto LAB_7; } - uVar4 = 0xc000000d; - if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) - goto LAB_0; - uVar7 = 0x65; + uVar3 = 0xc000000d; + if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) + goto LAB_0; + uVar10 = 0x65; } } } else { - if (iVar1 == 0xe) { + if (iVar5 == 0xe) { local_78 = (void *)0x0; - uVar4 = FltGetInstanceContext(uVar2,&local_78); - if ((int)uVar4 < 0) { + uVar3 = FltGetInstanceContext(uVar1,&local_78); + if ((int)uVar3 < 0) { if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) { - uVar7 = 0x6d; -LAB_12: - WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,uVar7, - &WPP_3ccab5108a9538d17a865fde27ef339f_Traceguids, + uVar10 = 0x6d; +LAB_11: + WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,uVar10, + &WPP_2255d1e077eb3e47145ae5fb45367206_Traceguids, "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c"); } } else if (param_5 < 0x10) { - uVar4 = 0xc000000d; + uVar3 = 0xc000000d; if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) { WPP_RECORDER_SF_sDdD (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),&WPP_RECORDER_INITIALIZED, - 0xe,0x6e,&WPP_3ccab5108a9538d17a865fde27ef339f_Traceguids, + 0xe,0x6e,&WPP_2255d1e077eb3e47145ae5fb45367206_Traceguids, "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c"); } } else { - uVar3 = *(ushort *)((longlong)local_78 + 8) + 0x10; - uVar8 = 0xffffffff; - if (uVar3 >= 0x10) { - uVar8 = uVar3; - } - uVar4 = -(uint)(uVar3 < 0x10) & 0xc0000095; - if (uVar3 < 0x10) { + uVar4 = *(ushort *)((longlong)local_78 + 8) + 0x10; + uVar2 = 0xffffffff; + if (uVar4 >= 0x10) { + uVar2 = uVar4; + } + uVar3 = -(uint)(uVar4 < 0x10) & 0xc0000095; + if (uVar4 < 0x10) { if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) { - uVar7 = 0x6f; - goto LAB_12; + uVar10 = 0x6f; + goto LAB_11; } } else { *_Src = 0xf; - if (param_5 < uVar8) { + if (param_5 < uVar2) { _Src[1] = 0x10; - _Src[3] = uVar8; - *param_6 = 0x10; + _Src[3] = uVar2; + *local_50 = 0x10; _Src[2] = 0x80000005; } else { _Src[3] = (uint)*(ushort *)((longlong)local_78 + 8); memcpy(_Src + 4,*(void **)((longlong)local_78 + 0x10), (ulonglong)*(ushort *)((longlong)local_78 + 8)); - *param_6 = uVar8; + *local_50 = uVar2; _Src[2] = 0; } } } if (local_78 != (void *)0x0) { FltReleaseContext(); } - if ((int)uVar4 < 0) goto LAB_0; -LAB_9: - memcpy(local_60,_Src,(ulonglong)param_5); + if ((int)uVar3 < 0) goto LAB_0; +LAB_6: + memcpy(local_58,_Src,(ulonglong)param_5); goto LAB_0; } - uVar8 = 0x10; - if (iVar1 != 0x10) { - if (iVar1 == 0x12) { + if (iVar5 != 0x10) { + if (iVar5 == 0x12) { if (0xf < param_5) { if ((ulonglong)(uint)_Dst[1] != (ulonglong)(uint)_Dst[2] + 8) { - uVar4 = 0xc000000d; + uVar3 = 0xc000000d; if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0; - uVar7 = 0x73; - goto LAB_10; + uVar10 = 0x73; + goto LAB_9; } *_Src = 0x13; _Src[1] = 0x10; - uVar3 = PrjfDeleteFileHandler(uVar2,(uint *)(_Dst + 2),_Dst[1] - 8,_Src + 3); -LAB_5: - _Src[2] = uVar3; - *param_6 = uVar8; - goto LAB_9; - } - uVar4 = 0xc000000d; - if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) - goto LAB_0; - uVar7 = 0x72; - } - else if (iVar1 == 0x14) { + uVar2 = PrjfDeleteFileHandler(uVar1,(uint *)(_Dst + 2),_Dst[1] - 8,_Src + 3); +LAB_12: + _Src[2] = uVar2; + *param_6 = 0x10; + goto LAB_6; + } + uVar3 = 0xc000000d; + if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) + goto LAB_0; + uVar10 = 0x72; + } + else if (iVar5 == 0x14) { if (_Dst[1] != 0x60) { - uVar4 = 0xc000000d; + uVar3 = 0xc000000d; if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0; - uVar7 = 0x74; + uVar10 = 0x74; goto LAB_2; } if (0xf < param_5) { *_Src = 0x15; _Src[1] = 0x10; - uVar5 = PrjfClearNegativePathCacheHandler(uVar2,(longlong *)(_Dst + 2),_Src + 3); - uVar3 = (uint)uVar5; - goto LAB_5; - } - uVar4 = 0xc000000d; - if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) - goto LAB_0; - uVar7 = 0x75; - } - else if (iVar1 == 0x16) { + uVar6 = PrjfClearNegativePathCacheHandler(uVar1,(longlong *)(_Dst + 2),_Src + 3); + uVar2 = (uint)uVar6; + goto LAB_12; + } + uVar3 = 0xc000000d; + if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) + goto LAB_0; + uVar10 = 0x75; + } + else if (iVar5 == 0x16) { if (0xb < param_5) { *_Src = 0x17; _Src[1] = 0xc; - local_78 = (void *)0x0; - local_58 = 0; - uStack_50 = 0; + local_68 = 0; + local_50 = (uint *)0x0; + uStack_48 = 0; if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) { WPP_RECORDER_SF_sD(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0xc4, - &WPP_3ccab5108a9538d17a865fde27ef339f_Traceguids, + &WPP_2255d1e077eb3e47145ae5fb45367206_Traceguids, "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c"); } - if (local_78 != (void *)0x0) { + if (local_68 != 0) { FltReleaseContext(); } _Src[2] = 0; goto LAB_8; } - uVar4 = 0xc000000d; - if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) - goto LAB_0; - uVar7 = 0x76; - } - else { - if (iVar1 != 0x18) { -LAB_11: - uVar4 = 0xc000000d; + uVar3 = 0xc000000d; + if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) + goto LAB_0; + uVar10 = 0x76; + } + else { + if (iVar5 != 0x18) { +LAB_10: + uVar3 = 0xc000000d; if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0; - uVar7 = 0x78; + uVar10 = 0x78; goto LAB_2; } if (0xb < param_5) { *_Src = 0x19; _Src[1] = 0xc; - uVar4 = PrjfAttachFilterHandler((undefined8 *)(_Dst + 2)); + uVar3 = PrjfAttachFilterHandler((undefined8 *)(_Dst + 2)); goto LAB_7; } - uVar4 = 0xc000000d; - if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) - goto LAB_0; - uVar7 = 0x77; - } -LAB_6: - uVar4 = 0xc000000d; + uVar3 = 0xc000000d; + if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) + goto LAB_0; + uVar10 = 0x77; + } +LAB_5: + uVar3 = 0xc000000d; WPP_RECORDER_SF_sDdD (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),&WPP_RECORDER_INITIALIZED,0xe, - uVar7,&WPP_3ccab5108a9538d17a865fde27ef339f_Traceguids, + uVar10,&WPP_2255d1e077eb3e47145ae5fb45367206_Traceguids, "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c"); goto LAB_0; } + lVar7 = 0; if (param_5 < 0x10) { - uVar4 = 0xc000000d; + uVar3 = 0xc000000d; if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0; - uVar7 = 0x70; + uVar10 = 0x70; } else { + uVar9 = Feature_2983238971__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar9 != 0) { + lVar7 = (longlong)local_78 + 8; + } if ((ulonglong)(uint)_Dst[1] == (ulonglong)(uint)_Dst[2] + 8) { *_Src = 0x11; _Src[1] = 0x10; - uVar3 = PrjfUpdatePlaceholderIfNeededHandler - (uVar2,(uint *)(_Dst + 2),_Dst[1] - 8,_Src + 3); - goto LAB_5; - } - uVar4 = 0xc000000d; + uVar2 = PrjfUpdatePlaceholderIfNeededHandler + (uVar1,(uint *)(_Dst + 2),lVar7,_Dst[1] - 8,_Src + 3); + goto LAB_12; + } + uVar3 = 0xc000000d; if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0; - uVar7 = 0x71; + uVar10 = 0x71; } } goto LAB_2; } - if (*(int *)(param_1 + 0x18) == 2) { + if (*(int *)(local_68 + 0x18) == 2) { LAB_3: if ((*_Dst == 6) || (*_Dst == 0x18)) goto LAB_4; - uVar4 = 0xc000000d; + uVar3 = 0xc000000d; if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0; - uVar7 = 0x5e; + uVar10 = 0x5e; } else { - uVar4 = 0xc000000d; + uVar3 = 0xc000000d; if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0; - uVar7 = 0x5d; + uVar10 = 0x5d; } } -LAB_10: - uVar4 = 0xc000000d; - WPP_RECORDER_SF_sD(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,uVar7, - &WPP_3ccab5108a9538d17a865fde27ef339f_Traceguids, +LAB_9: + uVar3 = 0xc000000d; + WPP_RECORDER_SF_sD(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,uVar10, + &WPP_2255d1e077eb3e47145ae5fb45367206_Traceguids, "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c"); goto LAB_0; } - uVar4 = 0xc000000d; + uVar3 = 0xc000000d; if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0; - uVar7 = 0x59; + uVar10 = 0x59; } LAB_2: - WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,uVar7, - &WPP_3ccab5108a9538d17a865fde27ef339f_Traceguids, + WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,uVar10, + &WPP_2255d1e077eb3e47145ae5fb45367206_Traceguids, "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c"); - puVar6 = _Src; + puVar8 = _Src; LAB_0: if (_Dst != (int *)0x0) { ExFreePoolWithTag(_Dst,0x746d4a50); } - if (puVar6 != (undefined4 *)0x0) { - ExFreePoolWithTag(puVar6,0x746d4a50); + if (puVar8 != (undefined4 *)0x0) { + ExFreePoolWithTag(puVar8,0x746d4a50); } - return uVar4; + return uVar3; } ``` ## wil_details_FeatureReporting_ReportUsageToService ### Match Info |Key|pj_6725.sys - pj_6899.sys| | :---: | :---: | |diff_type|code,length,sig,address| |ratio|0.6| |i_ratio|0.54| |m_ratio|0.98| |b_ratio|0.98| |match_types|SymbolsHash| ### Function Meta Diff |Key|pj_6725.sys|pj_6899.sys| | :---: | :---: | :---: | |name|wil_details_FeatureReporting_ReportUsageToService|wil_details_FeatureReporting_ReportUsageToService| |fullname|wil_details_FeatureReporting_ReportUsageToService|wil_details_FeatureReporting_ReportUsageToService| |refcount|2|2| |`length`|275|289| |called|_guard_dispatch_icall
wil_details_FeatureReporting_ReportUsageToServiceDirect|_guard_dispatch_icall
wil_details_FeatureReporting_ReportUsageToServiceDirect| |calling|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |paramcount|3|3| |`address`|140003df4|140003df8| |`sig`|undefined __fastcall wil_details_FeatureReporting_ReportUsageToService(undefined8 param_1, ulonglong param_2, uint param_3)|undefined __fastcall wil_details_FeatureReporting_ReportUsageToService(longlong param_1, ulonglong param_2, int param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### wil_details_FeatureReporting_ReportUsageToService Diff ```diff --- wil_details_FeatureReporting_ReportUsageToService +++ wil_details_FeatureReporting_ReportUsageToService @@ -1,66 +1,59 @@ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ void wil_details_FeatureReporting_ReportUsageToService - (undefined8 param_1,ulonglong param_2,uint param_3) + (longlong param_1,ulonglong param_2,int param_3) { bool bVar1; undefined7 extraout_var; uint uVar2; - uint uVar4; - byte bVar5; - uint local_res18 [4]; - ulonglong uVar3; + uint uVar3; + byte bVar4; + int local_res18 [4]; - uVar4 = (uint)param_2 & 1; - uVar3 = (ulonglong)param_3; + uVar2 = (uint)param_2 & 1; if (param_3 != 0) { if (param_3 == 1) { - uVar2 = (uVar4 ^ 1) << 2; - uVar3 = 0; + uVar3 = (uVar2 ^ 1) << 2; goto LAB_0; } if (param_3 == 2) { - uVar2 = (uVar4 ^ 1) * 4 + 1; - uVar3 = 0; + uVar3 = (uVar2 ^ 1) * 4 + 1; goto LAB_0; } if (param_3 == 3) { - uVar2 = (uVar4 ^ 1) * 4 + 2; - uVar3 = 0; + uVar3 = (uVar2 ^ 1) * 4 + 2; goto LAB_0; } if (param_3 == 4) { - uVar2 = (uVar4 ^ 1) * 4 + 3; - uVar3 = 0; + uVar3 = (uVar2 ^ 1) * 4 + 3; goto LAB_0; } - uVar2 = param_3 - 5; - uVar3 = (ulonglong)uVar2; - if (uVar2 == 0) { - uVar2 = (uVar4 ^ 1) * 2 + 8; + if (param_3 == 5) { + uVar3 = (uVar2 ^ 1) * 2 + 8; goto LAB_0; } - if (uVar2 == 1) { - uVar2 = (uVar4 ^ 1) * 2 + 9; + if (param_3 == 6) { + uVar3 = (uVar2 ^ 1) * 2 + 9; goto LAB_0; } - bVar5 = (char)param_3 + 0x9c; - if (bVar5 < 0x32) { - uVar2 = (-(uint)((param_2 & 1) != 0) & 0xffffffce) + 0x96 + (uint)bVar5; + bVar4 = (char)param_3 + 0x9c; + if (bVar4 < 0x32) { + uVar3 = (-(uint)((param_2 & 1) != 0) & 0xffffffce) + 0x96 + (uint)bVar4; goto LAB_0; } } - uVar2 = 0xff; + uVar3 = 0xff; LAB_0: local_res18[0] = param_3; - bVar1 = wil_details_FeatureReporting_ReportUsageToServiceDirect(uVar3,param_2,uVar2); + bVar1 = wil_details_FeatureReporting_ReportUsageToServiceDirect(param_1,param_2,uVar3); if (((int)CONCAT71(extraout_var,bVar1) != 0) && (g_wil_details_pfnFeatureLoggingHook != (code *)0x0)) { (*g_wil_details_pfnFeatureLoggingHook) - (0x35b91a3,&Feature_SFS_CD_BugFixes_2406_logged_traits,0,uVar4,local_res18,0,0,1); + (*(undefined4 *)(param_1 + 0x18),*(undefined8 *)(param_1 + 0x10),0,uVar2,local_res18,0 + ,0,1); } return; } ``` ## PrjfWritePlaceholderInformationHandler ### Match Info |Key|pj_6725.sys - pj_6899.sys| | :---: | :---: | |diff_type|code,length,sig,address,called| |ratio|0.7| |i_ratio|0.39| |m_ratio|0.98| |b_ratio|0.94| |match_types|SymbolsHash| ### Function Meta Diff |Key|pj_6725.sys|pj_6899.sys| | :---: | :---: | :---: | |name|PrjfWritePlaceholderInformationHandler|PrjfWritePlaceholderInformationHandler| |fullname|PrjfWritePlaceholderInformationHandler|PrjfWritePlaceholderInformationHandler| |refcount|2|2| |`length`|1212|1245| |`called`|
Expand for full list:
NTOSKRNL.EXE::ExFreePoolWithTag
PrjfAllocateUnicodeString
PrjfCopyAsPlaceHolder
PrjfCreateHardLink
PrjfCreatePrjReparseBuffer
PrjfCreateSymlinkFromPlaceholderInfoMessage
PrjfGetUnionContextByVirtualizationInstanceInfo
PrjfRelPathToFullPath
PrjfReleaseUnionContext
PrjfValidatePlaceholderInformationMessage
WPP_RECORDER_SF_sDd
|
Expand for full list:
Feature_2983238971__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExFreePoolWithTag
PrjfAllocateUnicodeString
PrjfCopyAsPlaceHolder
PrjfCreateHardLink
PrjfCreatePrjReparseBuffer
PrjfCreateSymlinkFromPlaceholderInfoMessage
PrjfGetUnionContextByVirtualizationInstanceInfo
PrjfRelPathToFullPath
PrjfReleaseUnionContext
PrjfValidatePlaceholderInformationMessageWPP_RECORDER_SF_sDd
| |calling|PrjfPortMessage|PrjfPortMessage| |paramcount|3|4| |`address`|14002a934|14002a9c4| |`sig`|uint __fastcall PrjfWritePlaceholderInformationHandler(longlong param_1, uint * param_2, uint param_3)|uint __fastcall PrjfWritePlaceholderInformationHandler(longlong param_1, uint * param_2, longlong param_3, uint param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### PrjfWritePlaceholderInformationHandler Called Diff ```diff --- PrjfWritePlaceholderInformationHandler called +++ PrjfWritePlaceholderInformationHandler called @@ -0,0 +1 @@ +Feature_2983238971__private_IsEnabledDeviceUsageNoInline ``` ### PrjfWritePlaceholderInformationHandler Diff ```diff --- PrjfWritePlaceholderInformationHandler +++ PrjfWritePlaceholderInformationHandler @@ -1,179 +1,186 @@ -uint PrjfWritePlaceholderInformationHandler(longlong param_1,uint *param_2,uint param_3) +uint PrjfWritePlaceholderInformationHandler + (longlong param_1,uint *param_2,longlong param_3,uint param_4) { uint uVar1; ushort uVar2; uint uVar3; longlong *plVar4; - short *psVar5; - undefined8 uVar6; - ushort uVar7; - longlong *plVar8; + longlong *plVar5; + short *psVar6; + undefined8 uVar7; + ushort uVar8; ulonglong uVar9; - short *psVar10; + longlong lVar10; void *pvVar11; undefined2 uVar12; - longlong lVar13; - int local_res20 [2]; - longlong *local_68; + short *psVar13; + int local_78 [2]; + longlong *local_70; + longlong local_68; longlong local_60; wchar_t local_58 [4]; longlong lStack_50; ushort local_48 [4]; short *psStack_40; longlong local_38; void *pvStack_30; - plVar8 = (longlong *)0x0; + plVar4 = (longlong *)0x0; + local_68 = 0; local_60 = 0; - local_68 = (longlong *)0x0; - local_res20[0] = 0; + local_70 = (longlong *)0x0; + local_78[0] = 0; local_48[0] = 0; local_48[1] = 0; local_48[2] = 0; local_48[3] = 0; psStack_40 = (short *)0x0; local_58[0] = L'\0'; local_58[1] = L'\0'; local_58[2] = L'\0'; local_58[3] = L'\0'; lStack_50 = 0; - uVar3 = PrjfValidatePlaceholderInformationMessage(param_2,param_3,&local_60); - plVar4 = plVar8; + uVar3 = PrjfValidatePlaceholderInformationMessage(param_2,param_4,&local_60); + plVar5 = plVar4; if ((int)uVar3 < 0) goto LAB_0; - plVar4 = PrjfGetUnionContextByVirtualizationInstanceInfo((longlong *)(param_2 + 2),param_1); - if (plVar4 == (longlong *)0x0) { + plVar5 = PrjfGetUnionContextByVirtualizationInstanceInfo((longlong *)(param_2 + 2),param_1); + if (plVar5 == (longlong *)0x0) { uVar3 = 0xc000000d; if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0; uVar12 = 0xd; uVar3 = 0xc000000d; goto LAB_1; } - local_38 = plVar4[5]; - pvStack_30 = (void *)plVar4[6]; - psVar10 = (short *)((ulonglong)param_2[0x16] + (longlong)param_2); - if (psVar10 == (short *)0x0) { + local_38 = plVar5[5]; + pvStack_30 = (void *)plVar5[6]; + psVar13 = (short *)((ulonglong)param_2[0x16] + (longlong)param_2); + if (psVar13 == (short *)0x0) { uVar3 = 0xc000000d; LAB_2: if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0; uVar12 = 0xe; } else { uVar9 = (ulonglong)(ushort)((ushort)param_2[0x17] >> 1); - for (psVar5 = psVar10; (uVar9 != 0 && (*psVar5 != 0)); psVar5 = psVar5 + 1) { + for (psVar6 = psVar13; (uVar9 != 0 && (*psVar6 != 0)); psVar6 = psVar6 + 1) { uVar9 = uVar9 - 1; } uVar3 = ~-(uint)(uVar9 != 0) & 0xc000000d; if (uVar9 == 0) goto LAB_2; - lVar13 = 0x7fff; - psVar5 = psVar10; + lVar10 = 0x7fff; + psVar6 = psVar13; do { - if (*psVar5 == 0) break; - psVar5 = psVar5 + 1; - lVar13 = lVar13 + -1; - } while (lVar13 != 0); - uVar3 = ~-(uint)(lVar13 != 0) & 0xc000000d; - if (lVar13 == 0) { - uVar7 = local_48[0]; + if (*psVar6 == 0) break; + psVar6 = psVar6 + 1; + lVar10 = lVar10 + -1; + } while (lVar10 != 0); + uVar3 = ~-(uint)(lVar10 != 0) & 0xc000000d; + if (lVar10 == 0) { + uVar8 = local_48[0]; } else { - uVar7 = (0x7fff - (short)lVar13) * 2; - local_48[1] = uVar7 + 2; - local_48[0] = uVar7; - psStack_40 = psVar10; + uVar8 = (0x7fff - (short)lVar10) * 2; + local_48[1] = uVar8 + 2; + local_48[0] = uVar8; + psStack_40 = psVar13; } if ((int)uVar3 < 0) { if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0; uVar12 = 0xf; } else { uVar2 = (ushort)local_38; - if (((ushort)(uVar7 + (ushort)local_38) < (ushort)local_38) || - (local_58[1] = uVar7 + (ushort)local_38 + 2, (ushort)local_58[1] < 2)) { + if (((ushort)(uVar8 + (ushort)local_38) < (ushort)local_38) || + (local_58[1] = uVar8 + (ushort)local_38 + 2, (ushort)local_58[1] < 2)) { uVar3 = 0xc0000095; local_58[1] = 0xffff; goto LAB_0; } - uVar6 = PrjfAllocateUnicodeString(0x746d4a50,local_58); - uVar3 = (uint)uVar6; + uVar7 = PrjfAllocateUnicodeString(0x746d4a50,local_58); + uVar3 = (uint)uVar7; if ((int)uVar3 < 0) { if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0; uVar12 = 0x10; } else { pvVar11 = pvStack_30; uVar3 = PrjfRelPathToFullPath((ushort *)local_58,uVar2,pvStack_30,psStack_40,local_48[0]); if (-1 < (int)uVar3) { if ((param_2[1] & 8) == 0) { if ((((param_2[1] & 0x10) == 0) || (uVar3 = PrjfCreateHardLink(param_1,local_60,local_58), -1 < (int)uVar3)) || ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) goto LAB_0; uVar12 = 0x15; LAB_3: WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,uVar12, - &WPP_3ccab5108a9538d17a865fde27ef339f_Traceguids, + &WPP_2255d1e077eb3e47145ae5fb45367206_Traceguids, "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c"); } else { uVar1 = param_2[0x18]; + uVar9 = Feature_2983238971__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar9 != 0) { + local_68 = (ulonglong)param_2[0x18] + param_3; + } if (param_2[0x1a] != 0) { uVar3 = PrjfCreateSymlinkFromPlaceholderInfoMessage - (param_1,(longlong)plVar4,local_58,(longlong)param_2); + (param_1,(longlong)plVar5,local_58,(longlong)param_2); if ((-1 < (int)uVar3) || ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) goto LAB_0; uVar12 = 0x12; goto LAB_1; } local_38 = *(longlong *)(param_2 + 2); pvStack_30 = *(void **)(param_2 + 4); uVar3 = PrjfCreatePrjReparseBuffer (local_48,&local_38,pvVar11, (undefined8 *)((char *)((ulonglong)uVar1 + (longlong)param_2) + 0x50) - ,&local_68,local_res20); - plVar8 = local_68; + ,&local_70,local_78); + plVar4 = local_70; if ((int)uVar3 < 0) { if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) { WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0x13, - &WPP_3ccab5108a9538d17a865fde27ef339f_Traceguids, + &WPP_2255d1e077eb3e47145ae5fb45367206_Traceguids, "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c"); - plVar8 = local_68; + plVar4 = local_70; } } else { uVar3 = PrjfCopyAsPlaceHolder - ((char *)((ulonglong)uVar1 + (longlong)param_2),local_58,param_1, - (longlong)local_68,local_res20[0],'\x01',param_2[0x19]); + ((char *)((ulonglong)uVar1 + (longlong)param_2),local_68,local_58, + param_1,(longlong)local_70,local_78[0],'\x01',param_2[0x19]); if (((int)uVar3 < 0) && ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) { uVar12 = 0x14; goto LAB_3; } } } - if (plVar8 != (longlong *)0x0) { - ExFreePoolWithTag(plVar8,0x69724a50); + if (plVar4 != (longlong *)0x0) { + ExFreePoolWithTag(plVar4,0x69724a50); } goto LAB_0; } if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0; uVar12 = 0x11; } } } LAB_1: WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,uVar12, - &WPP_3ccab5108a9538d17a865fde27ef339f_Traceguids, + &WPP_2255d1e077eb3e47145ae5fb45367206_Traceguids, "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c"); LAB_0: if (lStack_50 != 0) { ExFreePoolWithTag(lStack_50,0x746d4a50); } - if (plVar4 != (longlong *)0x0) { - PrjfReleaseUnionContext((longlong)plVar4); + if (plVar5 != (longlong *)0x0) { + PrjfReleaseUnionContext((longlong)plVar5); } return uVar3; } ``` ## wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath ### Match Info |Key|pj_6725.sys - pj_6899.sys| | :---: | :---: | |diff_type|code,length,sig,address| |ratio|0.4| |i_ratio|0.37| |m_ratio|0.9| |b_ratio|0.9| |match_types|SymbolsHash| ### Function Meta Diff |Key|pj_6725.sys|pj_6899.sys| | :---: | :---: | :---: | |name|wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath|wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath| |fullname|wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath|wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath| |refcount|2|2| |`length`|76|91| |called||| |calling|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |paramcount|2|3| |`address`|140004268|14000427c| |`sig`|undefined __fastcall wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath(uint param_1, int param_2)|undefined __fastcall wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath(uint param_1, int param_2, undefined8 * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath Diff ```diff --- wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath +++ wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath @@ -1,41 +1,52 @@ -void wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath(uint param_1,int param_2) +void wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath + (uint param_1,int param_2,undefined8 *param_3) { - uint uVar1; + uint *puVar1; uint uVar2; uint uVar3; - bool bVar4; + uint uVar4; + bool bVar5; + puVar1 = (uint *)*param_3; if (param_2 == 3) { - uVar3 = 0x10; + uVar4 = 0x10; } else { if (param_2 != 4) { return; } - uVar3 = 0x20; + uVar4 = 0x20; } - if ((Feature_HydrateLargeNonCachedFiles__private_featureState & 2) != 0) { - uVar2 = Feature_HydrateLargeNonCachedFiles__private_featureState; - while ((uVar2 & 1) == (param_1 & 1)) { - LOCK(); - bVar4 = uVar2 == Feature_HydrateLargeNonCachedFiles__private_featureState; - uVar1 = uVar3 | uVar2; - if (!bVar4) { - uVar2 = Feature_HydrateLargeNonCachedFiles__private_featureState; - uVar1 = Feature_HydrateLargeNonCachedFiles__private_featureState; - } - Feature_HydrateLargeNonCachedFiles__private_featureState = uVar1; - UNLOCK(); - if (bVar4) { - return; - } - if ((uVar2 & 2) == 0) { - return; + if ((*(char *)((longlong)param_3 + 0x1e) == '\0') && (*(char *)((longlong)param_3 + 0x1d) == '\0') + ) { + if ((*puVar1 & 2) != 0) { + uVar3 = *puVar1; + while ((uVar3 & 1) == (param_1 & 1)) { + LOCK(); + uVar2 = *puVar1; + bVar5 = uVar3 == uVar2; + if (bVar5) { + *puVar1 = uVar4 | uVar3; + uVar2 = uVar3; + } + UNLOCK(); + if (bVar5) { + return; + } + uVar3 = uVar2; + if ((uVar2 & 2) == 0) { + return; + } } } + } + else { + LOCK(); + *puVar1 = *puVar1 | uVar4; + UNLOCK(); } return; } ``` # Modified (No Code Changes) *Slightly modified functions have no code changes, rather differnces in:* - refcount - length - called - calling - name - fullname Generated with `ghidriff` version: 1.0.0 on 2026-08-19T20:03:16