# pj_7920.sys-pj_8036.sys Diff # TOC * [Visual Chart Diff](#visual-chart-diff) * [Metadata](#metadata) * [Ghidra Diff Engine](#ghidra-diff-engine) * [Command Line](#command-line) * [Binary Metadata Diff](#binary-metadata-diff) * [Program Options](#program-options) * [Diff Stats](#diff-stats) * [Strings](#strings) * [Deleted](#deleted) * [Added](#added) * [Feature_1083645240__private_IsEnabledDeviceUsageNoInline](#feature_1083645240__private_isenableddeviceusagenoinline) * [Feature_1083645240__private_IsEnabledFallback](#feature_1083645240__private_isenabledfallback) * [Feature_78846265__private_IsEnabledDeviceUsageNoInline](#feature_78846265__private_isenableddeviceusagenoinline) * [Feature_78846265__private_IsEnabledFallback](#feature_78846265__private_isenabledfallback) * [PrjfValidateAndGetGlobalVolumePath](#prjfvalidateandgetglobalvolumepath) * [PrjfValidateHandleAccess](#prjfvalidatehandleaccess) * [WPP_RECORDER_SF_sDHZ](#wpp_recorder_sf_sdhz) * [Modified](#modified) * [PrjfGetInstanceFromVolumeName](#prjfgetinstancefromvolumename) * [PrjfSetupVolumeInformationHandler](#prjfsetupvolumeinformationhandler) * [PrjfWriteFileDataHandler](#prjfwritefiledatahandler) * [WPP_RECORDER_SF_sDdLLl](#wpp_recorder_sf_sddlll) * [PrjfReadFileHandler](#prjfreadfilehandler) * [PrjfWritePlaceholderInformationHandler](#prjfwriteplaceholderinformationhandler) * [Modified (No Code Changes)](#modified-no-code-changes) * [__GSHandlerCheck](#__gshandlercheck) * [wil_details_IsEnabledFallback](#wil_details_isenabledfallback) * [WPP_RECORDER_SF_sDZ](#wpp_recorder_sf_sdz) * [NTOSKRNL.EXE::RtlPrefixUnicodeString](#ntoskrnlexertlprefixunicodestring) * [WPPRECORDER.SYS::WppAutoLogTrace](#wpprecordersyswppautologtrace) * [__security_check_cookie](#__security_check_cookie) * [NTOSKRNL.EXE::ObfDereferenceObject](#ntoskrnlexeobfdereferenceobject) * [FastWppTraceMessage](#fastwpptracemessage) * [NTOSKRNL.EXE::ObReferenceObjectByHandle](#ntoskrnlexeobreferenceobjectbyhandle) # Visual Chart Diff ```mermaid flowchart LR PrjfGetInstanceFromVolumeName-2-old<--Match 75%-->PrjfGetInstanceFromVolumeName-2-new PrjfSetupVolumeInformationHandler-2-old<--Match 91%-->PrjfSetupVolumeInformationHandler-2-new PrjfWriteFileDataHandler-3-old<--Match 22%-->PrjfWriteFileDataHandler-3-new WPP_RECORDER_SF_sDdLLl-1-old<--Match 99%-->WPP_RECORDER_SF_sDdLLl-1-new PrjfReadFileHandler-4-old<--Match 75%-->PrjfReadFileHandler-4-new PrjfWritePlaceholderInformationHandler-4-old<--Match 98%-->PrjfWritePlaceholderInformationHandler-4-new subgraph pj_8036.sys PrjfGetInstanceFromVolumeName-2-new PrjfSetupVolumeInformationHandler-2-new PrjfWriteFileDataHandler-3-new WPP_RECORDER_SF_sDdLLl-1-new PrjfReadFileHandler-4-new PrjfWritePlaceholderInformationHandler-4-new subgraph Added direction LR Feature_1083645240__private_IsEnabledDeviceUsageNoInline Feature_1083645240__private_IsEnabledFallback Feature_78846265__private_IsEnabledDeviceUsageNoInline Feature_78846265__private_IsEnabledFallback PrjfValidateAndGetGlobalVolumePath PrjfValidateHandleAccess WPP_RECORDER_SF_sDHZ end end subgraph pj_7920.sys PrjfGetInstanceFromVolumeName-2-old PrjfSetupVolumeInformationHandler-2-old PrjfWriteFileDataHandler-3-old WPP_RECORDER_SF_sDdLLl-1-old PrjfReadFileHandler-4-old PrjfWritePlaceholderInformationHandler-4-old end ``` ```mermaid pie showData title Function Matches - 99.4677% "unmatched_funcs_len" : 7 "matched_funcs_len" : 1308 ``` ```mermaid pie showData title Matched Function Similarity - 98.7768% "matched_funcs_with_code_changes_len" : 6 "matched_funcs_with_non_code_changes_len" : 10 "matched_funcs_no_changes_len" : 1292 ``` # Metadata ## Ghidra Diff Engine ### Command Line #### Captured Command Line ``` ghidriff --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --bsim --max-ram-percent 60.0 --max-section-funcs 200 pj_7920.sys pj_8036.sys ``` #### Verbose Args
``` --old ['pj_7920.sys'] --new [['pj_8036.sys']] --engine VersionTrackingDiff --output-path pj3_out --summary False --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim True --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title None ```
#### Download Original PEs ``` wget https://msdl.microsoft.com/download/symbols/prjflt.sys/8F19044B47000/prjflt.sys -O prjflt.sys.x64.10.0.26100.7920 wget https://msdl.microsoft.com/download/symbols/prjflt.sys/100D0BB047000/prjflt.sys -O prjflt.sys.x64.10.0.26100.8036 ``` ## Binary Metadata Diff ```diff --- pj_7920.sys Meta +++ pj_8036.sys Meta @@ -1,44 +1,44 @@ -Program Name: pj_7920.sys +Program Name: pj_8036.sys Language ID: x86:LE:64:default (4.6) Compiler ID: windows Processor: x86 Endian: Little Address Size: 64 Minimum Address: 140000000 Maximum Address: ff0000184f # of Bytes: 297040 # of Memory Blocks: 15 -# of Instructions: 47178 -# of Defined Data: 2302 -# of Functions: 654 -# of Symbols: 7081 +# of Instructions: 47736 +# of Defined Data: 2322 +# of Functions: 661 +# of Symbols: 7161 # of Data Types: 165 # of Data Type Categories: 12 Analyzed: true Compiler: visualstudio:unknown Created With Ghidra Version: 12.0.4 -Date Created: Wed Aug 19 20:18:04 SGT 2026 +Date Created: Wed Aug 19 20:18:08 SGT 2026 Executable Format: Portable Executable (PE) -Executable Location: /tmp/pjp/pj_7920.sys -Executable MD5: 96ab8c8d8faddf0c7e2cda58982410b0 -Executable SHA256: e31bf9ae1bdff86e6683e469dd56d341c019c02e389d3086608ba61de160949f -FSRL: file:///tmp/pjp/pj_7920.sys?MD5=96ab8c8d8faddf0c7e2cda58982410b0 +Executable Location: /tmp/pjp/pj_8036.sys +Executable MD5: c55d8b2855b551a152ce40a4a8112628 +Executable SHA256: d5afe5fe1f66c520b1b49bf43d8567d80c4dd42a03621cbceb6587bc29a424dc +FSRL: file:///tmp/pjp/pj_8036.sys?MD5=c55d8b2855b551a152ce40a4a8112628 PDB Age: 1 PDB File: prjflt.pdb -PDB GUID: 955db6ec-9487-f80e-0925-b5c15906ba95 +PDB GUID: af4d64bc-b802-345f-eee3-34e3877aea99 PDB Loaded: true PDB Version: RSDS PE Property[CompanyName]: Microsoft Corporation PE Property[FileDescription]: Windows Projected File System FS Filter Driver -PE Property[FileVersion]: 10.0.26100.7920 (WinBuild.160101.0800) +PE Property[FileVersion]: 10.0.26100.8036 (WinBuild.160101.0800) PE Property[InternalName]: prjflt.sys PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved. PE Property[OriginalFilename]: prjflt.sys PE Property[ProductName]: Microsoft(R) Windows(R) Kits -PE Property[ProductVersion]: 10.0.26100.7920 +PE Property[ProductVersion]: 10.0.26100.8036 PE Property[Translation]: 4b00409 Preferred Root Namespace Category: RTTI Found: false Relocatable: true SectionAlignment: 4096 Should Ask To Analyze: false ``` ## Program Options
Ghidra pj_7920.sys Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra pj_7920.sys Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra pj_7920.sys Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.Apply Function Calling Conventions|true| |Demangler Microsoft.Apply Function Signatures|true| |Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS| |Demangler Microsoft.Demangle Only Known Mangled Symbols|false| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
Ghidra pj_8036.sys Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra pj_8036.sys Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra pj_8036.sys Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.Apply Function Calling Conventions|true| |Demangler Microsoft.Apply Function Signatures|true| |Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS| |Demangler Microsoft.Demangle Only Known Mangled Symbols|false| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
## Diff Stats |Stat|Value| | :---: | :---: | |added_funcs_len|7| |deleted_funcs_len|0| |modified_funcs_len|16| |added_symbols_len|9| |deleted_symbols_len|2| |diff_time|3.691344976425171| |deleted_strings_len|0| |added_strings_len|1| |match_types|Counter({'SymbolsHash': 653, 'ExternalsName': 262})| |items_to_process|34| |diff_types|Counter({'refcount': 9, 'address': 8, 'calling': 8, 'length': 7, 'code': 6, 'sig': 4, 'called': 4})| |unmatched_funcs_len|7| |total_funcs_len|1315| |matched_funcs_len|1308| |matched_funcs_with_code_changes_len|6| |matched_funcs_with_non_code_changes_len|10| |matched_funcs_no_changes_len|1292| |match_func_similarity_percent|98.7768%| |func_match_overall_percent|99.4677%| |first_matches|Counter({'SymbolsHash': 653})| ```mermaid pie showData title All Matches "SymbolsHash" : 653 "ExternalsName" : 262 ``` ```mermaid pie showData title First Matches "SymbolsHash" : 653 ``` ```mermaid pie showData title Diff Stats "added_funcs_len" : 7 "deleted_funcs_len" : 0 "modified_funcs_len" : 16 ``` ```mermaid pie showData title Symbols "added_symbols_len" : 9 "deleted_symbols_len" : 2 ``` ## Strings ```mermaid pie showData title Strings "deleted_strings_len" : 0 "added_strings_len" : 1 ``` ### Strings Diff ```diff --- deleted strings +++ added strings @@ -0,0 +1 @@ +u_lobal?? ``` ### String References #### Old |String|Ref Count|Ref Func| | :---: | :---: | :---: | #### New |String|Ref Count|Ref Func| | :---: | :---: | :---: | |u_lobal??_14000e0ac|1|PrjfValidateAndGetGlobalVolumePath| # Deleted # Added ## Feature_1083645240__private_IsEnabledDeviceUsageNoInline ### Function Meta |Key|pj_8036.sys| | :---: | :---: | |name|Feature_1083645240__private_IsEnabledDeviceUsageNoInline| |fullname|Feature_1083645240__private_IsEnabledDeviceUsageNoInline| |refcount|5| |length|49| |called|Feature_1083645240__private_IsEnabledFallback| |calling|PrjfReadFileHandler
PrjfWriteFileDataHandler| |paramcount|0| |address|140004484| |sig|ulonglong __fastcall Feature_1083645240__private_IsEnabledDeviceUsageNoInline(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_1083645240__private_IsEnabledDeviceUsageNoInline +++ Feature_1083645240__private_IsEnabledDeviceUsageNoInline @@ -0,0 +1,17 @@ + +ulonglong Feature_1083645240__private_IsEnabledDeviceUsageNoInline(void) + +{ + ulonglong uVar1; + undefined8 local_res8; + + local_res8 = (ulonglong)Feature_1083645240__private_featureState; + if ((Feature_1083645240__private_featureState & 0x10) == 0) { + uVar1 = Feature_1083645240__private_IsEnabledFallback(local_res8,3); + } + else { + uVar1 = (ulonglong)(Feature_1083645240__private_featureState & 1); + } + return uVar1; +} + ``` ## Feature_1083645240__private_IsEnabledFallback ### Function Meta |Key|pj_8036.sys| | :---: | :---: | |name|Feature_1083645240__private_IsEnabledFallback| |fullname|Feature_1083645240__private_IsEnabledFallback| |refcount|2| |length|21| |called|wil_details_IsEnabledFallback| |calling|Feature_1083645240__private_IsEnabledDeviceUsageNoInline| |paramcount|2| |address|1400044bc| |sig|undefined __fastcall Feature_1083645240__private_IsEnabledFallback(ulonglong param_1, int param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_1083645240__private_IsEnabledFallback +++ Feature_1083645240__private_IsEnabledFallback @@ -0,0 +1,8 @@ + +void Feature_1083645240__private_IsEnabledFallback(ulonglong param_1,int param_2) + +{ + wil_details_IsEnabledFallback(param_1,param_2,&Feature_1083645240__private_descriptor); + return; +} + ``` ## Feature_78846265__private_IsEnabledDeviceUsageNoInline ### Function Meta |Key|pj_8036.sys| | :---: | :---: | |name|Feature_78846265__private_IsEnabledDeviceUsageNoInline| |fullname|Feature_78846265__private_IsEnabledDeviceUsageNoInline| |refcount|3| |length|49| |called|Feature_78846265__private_IsEnabledFallback| |calling|PrjfGetInstanceFromVolumeName
PrjfSetupVolumeInformationHandler| |paramcount|0| |address|140004580| |sig|ulonglong __fastcall Feature_78846265__private_IsEnabledDeviceUsageNoInline(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_78846265__private_IsEnabledDeviceUsageNoInline +++ Feature_78846265__private_IsEnabledDeviceUsageNoInline @@ -0,0 +1,17 @@ + +ulonglong Feature_78846265__private_IsEnabledDeviceUsageNoInline(void) + +{ + ulonglong uVar1; + undefined8 local_res8; + + local_res8 = (ulonglong)Feature_78846265__private_featureState; + if ((Feature_78846265__private_featureState & 0x10) == 0) { + uVar1 = Feature_78846265__private_IsEnabledFallback(local_res8,3); + } + else { + uVar1 = (ulonglong)(Feature_78846265__private_featureState & 1); + } + return uVar1; +} + ``` ## Feature_78846265__private_IsEnabledFallback ### Function Meta |Key|pj_8036.sys| | :---: | :---: | |name|Feature_78846265__private_IsEnabledFallback| |fullname|Feature_78846265__private_IsEnabledFallback| |refcount|2| |length|21| |called|wil_details_IsEnabledFallback| |calling|Feature_78846265__private_IsEnabledDeviceUsageNoInline| |paramcount|2| |address|1400045b8| |sig|undefined __fastcall Feature_78846265__private_IsEnabledFallback(ulonglong param_1, int param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_78846265__private_IsEnabledFallback +++ Feature_78846265__private_IsEnabledFallback @@ -0,0 +1,8 @@ + +void Feature_78846265__private_IsEnabledFallback(ulonglong param_1,int param_2) + +{ + wil_details_IsEnabledFallback(param_1,param_2,&Feature_78846265__private_descriptor); + return; +} + ``` ## PrjfValidateAndGetGlobalVolumePath ### Function Meta |Key|pj_8036.sys| | :---: | :---: | |name|PrjfValidateAndGetGlobalVolumePath| |fullname|PrjfValidateAndGetGlobalVolumePath| |refcount|3| |length|1227| |called|NTOSKRNL.EXE::RtlPrefixUnicodeString
WPP_RECORDER_SF_sDHZ
WPP_RECORDER_SF_sDZ
WPP_RECORDER_SF_sDd| |calling|PrjfGetInstanceFromVolumeName
PrjfSetupVolumeInformationHandler| |paramcount|3| |address|140031ddc| |sig|int __fastcall PrjfValidateAndGetGlobalVolumePath(wchar_t * param_1, ushort * param_2, longlong param_3)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- PrjfValidateAndGetGlobalVolumePath +++ PrjfValidateAndGetGlobalVolumePath @@ -0,0 +1,208 @@ + +int PrjfValidateAndGetGlobalVolumePath(wchar_t *param_1,ushort *param_2,longlong param_3) + +{ + ushort uVar1; + longlong lVar2; + char cVar3; + ulonglong uVar4; + longlong lVar5; + ushort uVar6; + int iVar7; + int iVar8; + int iVar9; + ushort *puVar10; + short *psVar11; + ushort uVar12; + short sVar13; + short sVar14; + undefined2 *puVar16; + undefined2 uVar17; + longlong lVar18; + undefined4 uVar19; + undefined4 in_stack_ffffffffffffffbc; + int iVar15; + + sVar13 = 0x30; + uVar12 = (ushort)*param_1 >> 1; + if (uVar12 < 0x30) { + if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) { + return -0x3ffffff3; + } + uVar17 = 0xdf; + puVar10 = param_2; +LAB_140031e3e: + WPP_RECORDER_SF_sDHZ(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),puVar10,param_3,uVar17); + return -0x3ffffff3; + } + cVar3 = RtlPrefixUnicodeString(&DAT_14000d558,param_1,1); + iVar8 = 0; + if (cVar3 == '\0') { + if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) { + return -0x3ffffff3; + } + uVar17 = 0xe0; + uVar19 = 0x25a1; +LAB_140031ea5: + WPP_RECORDER_SF_sDZ(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xb,uVar17, + &WPP_9abe4cea4fef37c56daa812f6745afa6_Traceguids, + "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c", + CONCAT44(in_stack_ffffffffffffffbc,uVar19),param_1); + return -0x3ffffff3; + } + param_3 = *(longlong *)(param_1 + 4); + uVar4 = 0; + do { + uVar6 = *(ushort *)(param_3 + 0x16 + uVar4 * 2); + puVar10 = (ushort *)(ulonglong)uVar6; + if (((ushort)uVar4 < 0x18) && ((0x842100U >> ((uint)uVar4 & 0x1f) & 1) != 0)) { + if (uVar6 != 0x2d) { + if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) { + return -0x3ffffff3; + } + uVar17 = 0xe1; + goto LAB_140031e3e; + } + } + else if ((9 < (ushort)(uVar6 - 0x30)) && + ((5 < (ushort)(uVar6 - 0x41) && + (puVar10 = (ushort *)(ulonglong)(ushort)(uVar6 - 0x61), 5 < (ushort)(uVar6 - 0x61))))) + { + if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) { + return -0x3ffffff3; + } + uVar17 = 0xe2; + goto LAB_140031e3e; + } + uVar6 = (ushort)uVar4 + 1; + uVar4 = (ulonglong)uVar6; + } while (uVar6 < 0x24); + if (*(short *)(param_3 + 0x5e) != 0x7d) { + if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) { + return -0x3ffffff3; + } + uVar17 = 0xe3; + uVar19 = 0x25c3; + goto LAB_140031ea5; + } + uVar6 = 0x30; + if (0x30 < uVar12) { + do { + sVar14 = *(short *)(param_3 + (ulonglong)uVar6 * 2); + if (uVar6 == 0x30) { + if ((sVar14 != 0x5c) && (sVar14 != 0)) { + if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) { + return -0x3ffffff3; + } + uVar17 = 0xe4; + uVar19 = 0x25d2; + goto LAB_140031ea5; + } + } + else if (sVar14 != 0) { + if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) { + return -0x3ffffff3; + } + uVar17 = 0xe5; + uVar19 = 0x25dc; + goto LAB_140031ea5; + } + uVar6 = uVar6 + 1; + } while (uVar6 < uVar12); + } + uVar6 = *param_2; + if (((((uVar6 & 1) == 0) && (uVar1 = param_2[1], (uVar1 & 1) == 0)) && (uVar6 <= uVar1)) && + ((uVar1 != 0xffff && ((*(longlong *)(param_2 + 4) != 0 || ((uVar6 == 0 && (uVar1 == 0)))))))) { + psVar11 = (short *)&u__Global__; + uVar4 = (ulonglong)(param_2[1] >> 1); + lVar18 = 0x7fff; + lVar2 = *(longlong *)(param_2 + 4); + iVar7 = 0; + iVar15 = iVar8; + if (uVar4 == 0) { +LAB_1400320dc: + sVar14 = (short)iVar15; + iVar9 = -0x7ffffffb; + } + else { + do { + sVar14 = (short)iVar15; + iVar9 = iVar8; + if (lVar18 == 0) goto LAB_1400320de; + if (*psVar11 == 0) break; + *(short *)(lVar2 + -0x14000e0a8 + (longlong)psVar11) = *psVar11; + lVar18 = lVar18 + -1; + psVar11 = psVar11 + 1; + iVar15 = iVar15 + 1; + uVar4 = uVar4 - 1; + } while (uVar4 != 0); + sVar14 = (short)iVar15; + iVar9 = iVar7; + if (((uVar4 == 0) && (lVar18 != 0)) && (*psVar11 != 0)) goto LAB_1400320dc; + } +LAB_1400320de: + *param_2 = sVar14 * 2; + if (-1 < iVar9) { + if ((0x30 < uVar12) && (*(short *)(*(longlong *)(param_1 + 4) + 0x60) == 0x5c)) { + sVar13 = 0x31; + } + uVar12 = *param_2; + puVar16 = (undefined2 *)(*(longlong *)(param_1 + 4) + 6); + if ((((((uVar12 & 1) == 0) && (uVar6 = param_2[1], (uVar6 & 1) == 0)) && (uVar12 <= uVar6)) && + (uVar6 != 0xffff)) && + ((*(longlong *)(param_2 + 4) != 0 || ((uVar12 == 0 && (uVar6 == 0)))))) { + lVar2 = *(longlong *)(param_2 + 4); + uVar12 = uVar12 >> 1; + if (puVar16 == (undefined2 *)0x0) goto LAB_140032203; + uVar4 = (ulonglong)((ushort)(sVar13 * 2 - 6U) >> 1); + lVar18 = (ulonglong)(param_2[1] >> 1) - (ulonglong)uVar12; + iVar9 = iVar8; + if (lVar18 != 0) { + lVar5 = (ulonglong)uVar12 * 2 - (longlong)puVar16; + do { + sVar13 = (short)iVar9; + if (uVar4 == 0) goto LAB_1400321bb; + uVar4 = uVar4 - 1; + *(undefined2 *)((longlong)puVar16 + lVar2 + lVar5) = *puVar16; + iVar9 = iVar9 + 1; + puVar16 = puVar16 + 1; + lVar18 = lVar18 + -1; + } while (lVar18 != 0); + } + sVar13 = (short)iVar9; + iVar8 = 0; + if (uVar4 != 0) { + iVar8 = -0x7ffffffb; + } +LAB_1400321bb: + *param_2 = (uVar12 + sVar13) * 2; + if (-1 < iVar8) { + return iVar8; + } + } + else { +LAB_140032203: + iVar8 = -0x3ffffff3; + } + if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) { + return iVar8; + } + uVar17 = 0xe7; + iVar9 = iVar8; + goto LAB_140032257; + } + } + else { + iVar9 = -0x3ffffff3; + } + if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) { + return iVar9; + } + uVar17 = 0xe6; +LAB_140032257: + WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xb,uVar17, + &WPP_9abe4cea4fef37c56daa812f6745afa6_Traceguids, + "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c"); + return iVar9; +} + ``` ## PrjfValidateHandleAccess ### Function Meta |Key|pj_8036.sys| | :---: | :---: | |name|PrjfValidateHandleAccess| |fullname|PrjfValidateHandleAccess| |refcount|3| |length|157| |called|NTOSKRNL.EXE::ObReferenceObjectByHandle
NTOSKRNL.EXE::ObfDereferenceObject| |calling|PrjfReadFileHandler
PrjfWriteFileDataHandler| |paramcount|3| |address|140032438| |sig|ulonglong __fastcall PrjfValidateHandleAccess(longlong param_1, uint param_2, longlong param_3)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- PrjfValidateHandleAccess +++ PrjfValidateHandleAccess @@ -0,0 +1,30 @@ + +ulonglong PrjfValidateHandleAccess(longlong param_1,uint param_2,longlong param_3) + +{ + ulonglong uVar1; + longlong local_res8; + undefined8 local_res20; + + local_res8 = 0; + local_res20 = 0; + if (param_1 == 0) { + uVar1 = 0; + } + else { + uVar1 = ObReferenceObjectByHandle + (param_1,0,*(undefined8 *)IoFileObjectType_exref,0,&local_res8,&local_res20); + if (-1 < (int)uVar1) { + if ((param_3 == 0) || (local_res8 == param_3)) { + ObfDereferenceObject(); + uVar1 = (ulonglong)(~-(uint)((local_res20._4_4_ & param_2) != 0) & 0xc0000022); + } + else { + ObfDereferenceObject(); + uVar1 = 0xc0000008; + } + } + } + return uVar1; +} + ``` ## WPP_RECORDER_SF_sDHZ ### Function Meta |Key|pj_8036.sys| | :---: | :---: | |name|WPP_RECORDER_SF_sDHZ| |fullname|WPP_RECORDER_SF_sDHZ| |refcount|2| |length|424| |called|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace| |calling|PrjfValidateAndGetGlobalVolumePath| |paramcount|4| |address|14003eae0| |sig|undefined __fastcall WPP_RECORDER_SF_sDHZ(undefined8 param_1, undefined8 param_2, undefined8 param_3, undefined2 param_4)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- WPP_RECORDER_SF_sDHZ +++ WPP_RECORDER_SF_sDHZ @@ -0,0 +1,29 @@ + +void WPP_RECORDER_SF_sDHZ + (undefined8 param_1,undefined8 param_2,undefined8 param_3,undefined2 param_4) + +{ + wchar_t *pwVar1; + wchar_t wVar2; + wchar_t *in_stack_00000048; + + pwVar1 = L"NULL"; + wVar2 = L'\b'; + if (((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x400) != 0) && (1 < (byte)WPP_GLOBAL_Control[0x29])) + { + FastWppTraceMessage(&WPP_9abe4cea4fef37c56daa812f6745afa6_Traceguids,param_4, + "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",0x29); + } + if ((in_stack_00000048 != (wchar_t *)0x0) && + (wVar2 = *in_stack_00000048, *in_stack_00000048 != L'\0')) { + pwVar1 = *(wchar_t **)(in_stack_00000048 + 4); + } + if (in_stack_00000048 == (wchar_t *)0x0) { + in_stack_00000048 = L"\b"; + } + WppAutoLogTrace(param_1,2,0xb,&WPP_9abe4cea4fef37c56daa812f6745afa6_Traceguids,param_4, + "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",0x29,&stack0x00000038,4, + &stack0x00000040,2,in_stack_00000048,2,pwVar1,wVar2,0); + return; +} + ``` # Modified *Modified functions contain code changes* ## PrjfGetInstanceFromVolumeName ### Match Info |Key|pj_7920.sys - pj_8036.sys| | :---: | :---: | |diff_type|code,length,sig,called| |ratio|0.3| |i_ratio|0.47| |m_ratio|0.78| |b_ratio|0.75| |match_types|SymbolsHash| ### Function Meta Diff |Key|pj_7920.sys|pj_8036.sys| | :---: | :---: | :---: | |name|PrjfGetInstanceFromVolumeName|PrjfGetInstanceFromVolumeName| |fullname|PrjfGetInstanceFromVolumeName|PrjfGetInstanceFromVolumeName| |refcount|3|3| |`length`|245|397| |`called`|FLTMGR.SYS::FltGetVolumeFromName
FLTMGR.SYS::FltGetVolumeInstanceFromName
FLTMGR.SYS::FltObjectDereference
WPP_RECORDER_SF_sDd|FLTMGR.SYS::FltGetVolumeFromName
FLTMGR.SYS::FltGetVolumeInstanceFromName
FLTMGR.SYS::FltObjectDereference
Feature_78846265__private_IsEnabledDeviceUsageNoInline
PrjfValidateAndGetGlobalVolumePath
WPP_RECORDER_SF_sDd
__security_check_cookie| |calling|PrjfPortConnect
PrjfSetupVolumeInformationHandler|PrjfPortConnect
PrjfSetupVolumeInformationHandler| |paramcount|2|3| |address|140025710|140025710| |`sig`|int __fastcall PrjfGetInstanceFromVolumeName(undefined8 param_1, undefined8 param_2)|int __fastcall PrjfGetInstanceFromVolumeName(wchar_t * param_1, undefined8 param_2, longlong param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### PrjfGetInstanceFromVolumeName Called Diff ```diff --- PrjfGetInstanceFromVolumeName called +++ PrjfGetInstanceFromVolumeName called @@ -3,0 +4,2 @@ +Feature_78846265__private_IsEnabledDeviceUsageNoInline +PrjfValidateAndGetGlobalVolumePath @@ -4,0 +7 @@ +__security_check_cookie ``` ### PrjfGetInstanceFromVolumeName Diff ```diff --- PrjfGetInstanceFromVolumeName +++ PrjfGetInstanceFromVolumeName @@ -1,30 +1,57 @@ -int PrjfGetInstanceFromVolumeName(undefined8 param_1,undefined8 param_2) +/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ + +int PrjfGetInstanceFromVolumeName(wchar_t *param_1,undefined8 param_2,longlong param_3) { int iVar1; - undefined2 uVar2; - longlong local_res18 [2]; + ulonglong uVar2; + undefined2 uVar3; + undefined1 auStackY_f8 [32]; + longlong local_b8; + wchar_t local_b0 [4]; + undefined1 *puStack_a8; + undefined1 local_98 [128]; + ulonglong local_18; - local_res18[0] = 0; - iVar1 = FltGetVolumeFromName(Globals,param_1,local_res18); - if (iVar1 < 0) { - if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0; - uVar2 = 10; + local_18 = __security_cookie ^ (ulonglong)auStackY_f8; + local_b8 = 0; + uVar2 = Feature_78846265__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar2 == 0) { +LAB_0: + iVar1 = FltGetVolumeFromName(Globals,param_1,&local_b8); + if (iVar1 < 0) { + if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_1; + uVar3 = 0xb; + } + else { + iVar1 = FltGetVolumeInstanceFromName(Globals,local_b8,0,param_2); + if ((-1 < iVar1) || ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) + goto LAB_1; + uVar3 = 0xc; + } } else { - iVar1 = FltGetVolumeInstanceFromName(Globals,local_res18[0],0,param_2); - if ((-1 < iVar1) || ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) - goto LAB_0; - uVar2 = 0xb; + local_b0[0] = L'\0'; + local_b0[1] = L'x'; + local_b0[2] = L'\0'; + local_b0[3] = L'\0'; + puStack_a8 = local_98; + iVar1 = PrjfValidateAndGetGlobalVolumePath(param_1,(ushort *)local_b0,param_3); + if (-1 < iVar1) { + param_1 = local_b0; + goto LAB_0; + } + if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_1; + uVar3 = 10; } - WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,uVar2, - &WPP_7642f67f9d7e36cc26ec38a25b4c3165_Traceguids, + WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,uVar3, + &WPP_1d85ca05f54836e6837feaf19b6b0e42_Traceguids, "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c"); -LAB_0: - if (local_res18[0] != 0) { +LAB_1: + if (local_b8 != 0) { FltObjectDereference(); } return iVar1; } ``` ## PrjfSetupVolumeInformationHandler ### Match Info |Key|pj_7920.sys - pj_8036.sys| | :---: | :---: | |diff_type|code,length,sig,address,called| |ratio|0.45| |i_ratio|0.47| |m_ratio|0.95| |b_ratio|0.91| |match_types|SymbolsHash| ### Function Meta Diff |Key|pj_7920.sys|pj_8036.sys| | :---: | :---: | :---: | |name|PrjfSetupVolumeInformationHandler|PrjfSetupVolumeInformationHandler| |fullname|PrjfSetupVolumeInformationHandler|PrjfSetupVolumeInformationHandler| |refcount|2|2| |`length`|1381|1538| |`called`|
Expand for full list:
FLTMGR.SYS::FltAllocatePoolAlignedWithTag
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltCreateFileEx
FLTMGR.SYS::FltCreateSystemVolumeInformationFolder
FLTMGR.SYS::FltFreePoolAlignedWithTag
FLTMGR.SYS::FltGetVolumeFromName
FLTMGR.SYS::FltGetVolumeName
FLTMGR.SYS::FltObjectDereference
FLTMGR.SYS::FltWriteFile
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExFreePoolWithTagNTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::RtlAppendUnicodeToString
NTOSKRNL.EXE::RtlInitUnicodeString
PrjfAllocateUnicodeString
PrjfGetInstanceFromVolumeName
WPP_RECORDER_SF_sDZd
WPP_RECORDER_SF_sDd
memcpy
memset
|
Expand for full list:
FLTMGR.SYS::FltAllocatePoolAlignedWithTag
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltCreateFileEx
FLTMGR.SYS::FltCreateSystemVolumeInformationFolder
FLTMGR.SYS::FltFreePoolAlignedWithTag
FLTMGR.SYS::FltGetVolumeFromName
FLTMGR.SYS::FltGetVolumeName
FLTMGR.SYS::FltObjectDereference
FLTMGR.SYS::FltWriteFile
Feature_78846265__private_IsEnabledDeviceUsageNoInline
MicrosoftTelemetryAssertTriggeredNoArgsKMNTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::RtlAppendUnicodeToString
NTOSKRNL.EXE::RtlInitUnicodeString
PrjfAllocateUnicodeString
PrjfGetInstanceFromVolumeName
PrjfValidateAndGetGlobalVolumePath
WPP_RECORDER_SF_sDZd
WPP_RECORDER_SF_sDd
__security_check_cookie
memcpy
memset
| |calling|PrjfPortMessage|PrjfPortMessage| |paramcount|2|3| |`address`|140004fe0|140005090| |`sig`|int __fastcall PrjfSetupVolumeInformationHandler(uint * param_1, uint param_2)|int __fastcall PrjfSetupVolumeInformationHandler(uint * param_1, uint param_2, longlong param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### PrjfSetupVolumeInformationHandler Called Diff ```diff --- PrjfSetupVolumeInformationHandler called +++ PrjfSetupVolumeInformationHandler called @@ -9,0 +10 @@ +Feature_78846265__private_IsEnabledDeviceUsageNoInline @@ -16,0 +18 @@ +PrjfValidateAndGetGlobalVolumePath @@ -18,0 +21 @@ +__security_check_cookie ``` ### PrjfSetupVolumeInformationHandler Diff ```diff --- PrjfSetupVolumeInformationHandler +++ PrjfSetupVolumeInformationHandler @@ -1,198 +1,224 @@ -int PrjfSetupVolumeInformationHandler(uint *param_1,uint param_2) +/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ + +int PrjfSetupVolumeInformationHandler(uint *param_1,uint param_2,longlong param_3) { uint uVar1; ushort uVar2; int iVar3; - undefined8 uVar4; + ulonglong uVar4; + undefined8 uVar5; + wchar_t *pwVar6; void *_Dst; - undefined2 uVar5; - longlong local_res8; - uint local_res10 [2]; - longlong local_res18; - longlong local_res20; - undefined8 in_stack_ffffffffffffff08; - undefined4 uVar6; - undefined8 in_stack_ffffffffffffff18; - undefined4 uVar7; - undefined8 in_stack_ffffffffffffff28; + undefined2 uVar7; + undefined1 auStackY_1c8 [32]; + undefined8 in_stack_fffffffffffffe68; undefined4 uVar8; - undefined8 local_98; - longlong local_90; - undefined8 local_88; - longlong lStack_80; - wchar_t local_78 [4]; - uint *puStack_70; - undefined8 local_68; - undefined8 uStack_60; - undefined8 local_58; - undefined8 uStack_50; - undefined1 *local_48; - undefined8 uStack_40; - undefined8 local_38; - ulonglong uStack_30; + uint local_148 [2]; + longlong local_140; + longlong local_138; + undefined8 local_130; + longlong lStack_128; + longlong local_120; + wchar_t local_118 [4]; + uint *puStack_110; + undefined8 local_108; + longlong local_100; + wchar_t local_f8 [4]; + undefined1 *puStack_f0; + undefined8 local_e8; + undefined8 uStack_e0; + undefined1 *local_d8; + undefined8 uStack_d0; + undefined8 local_c8; + ulonglong uStack_c0; + undefined8 local_b8; + undefined8 uStack_b0; + undefined1 local_a8 [128]; + ulonglong local_28; - uVar6 = (undefined4)((ulonglong)in_stack_ffffffffffffff08 >> 0x20); - uVar8 = (undefined4)((ulonglong)in_stack_ffffffffffffff28 >> 0x20); - uVar7 = (undefined4)((ulonglong)in_stack_ffffffffffffff18 >> 0x20); - local_res8 = 0; - local_38 = 0; - uStack_30 = uStack_30 & 0xffffffff00000000; - local_90 = 0; - local_res20 = 0; - local_78[0] = L'\0'; - local_78[1] = L'\0'; - local_78[2] = L'\0'; - local_78[3] = L'\0'; - puStack_70 = (uint *)0x0; - local_res10[0] = 0; + uVar8 = (undefined4)((ulonglong)in_stack_fffffffffffffe68 >> 0x20); + local_28 = __security_cookie ^ (ulonglong)auStackY_1c8; + local_140 = 0; + local_c8 = 0; + uStack_c0 = uStack_c0 & 0xffffffff00000000; + local_100 = 0; + local_120 = 0; + local_118[0] = L'\0'; + local_118[1] = L'\0'; + local_118[2] = L'\0'; + local_118[3] = L'\0'; + puStack_110 = (uint *)0x0; + local_148[0] = 0; _Dst = (void *)0x0; - local_88 = 0; - lStack_80 = 0; - local_res18 = 0; - local_58 = 0; - uStack_50 = 0; - local_98 = 0; - local_48 = (undefined1 *)0x0; - uStack_40 = 0; - local_68 = 0; - uStack_60 = 0; - RtlInitUnicodeString(&local_88,0); + local_130 = 0; + lStack_128 = 0; + local_138 = 0; + local_e8 = 0; + uStack_e0 = 0; + local_108 = 0; + local_d8 = (undefined1 *)0x0; + uStack_d0 = 0; + local_b8 = 0; + uStack_b0 = 0; + local_f8[0] = L'\0'; + local_f8[1] = L'\0'; + local_f8[2] = L'\0'; + local_f8[3] = L'\0'; + puStack_f0 = (undefined1 *)0x0; + RtlInitUnicodeString(&local_130,0); uVar1 = *param_1; if (param_2 < uVar1) { iVar3 = -0x3ffffff3; _Dst = (void *)0x0; if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0; - uVar5 = 0x44; + uVar7 = 0x47; } else if (uVar1 < 0xc) { iVar3 = -0x3ffffff3; if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0; - uVar5 = 0x45; + uVar7 = 0x48; iVar3 = -0x3ffffff3; } else { uVar2 = (ushort)param_1[1]; if (uVar1 < uVar2 + 0xc) { iVar3 = -0x3ffffff3; if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0; - uVar5 = 0x46; + uVar7 = 0x49; } else { - puStack_70 = param_1 + 3; - local_78[1] = uVar2; - local_78[0] = uVar2; - iVar3 = PrjfGetInstanceFromVolumeName(local_78,&local_res8); + puStack_110 = param_1 + 3; + local_118[1] = uVar2; + local_118[0] = uVar2; + iVar3 = PrjfGetInstanceFromVolumeName(local_118,&local_140,param_3); if (iVar3 < 0) { if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) { WPP_RECORDER_SF_sDZd - (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0x47, - &WPP_7642f67f9d7e36cc26ec38a25b4c3165_Traceguids, - "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c",CONCAT44(uVar7,0x75f), - local_78); + (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0x4a, + &WPP_1d85ca05f54836e6837feaf19b6b0e42_Traceguids, + "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c",CONCAT44(uVar8,0x7a3), + local_118); } goto LAB_0; } - iVar3 = FltCreateSystemVolumeInformationFolder(local_res8); + iVar3 = FltCreateSystemVolumeInformationFolder(local_140); if (iVar3 < 0) { if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0; - uVar5 = 0x48; + uVar7 = 0x4b; } else { - iVar3 = FltGetVolumeFromName(Globals,local_78,&local_res18); + uVar4 = Feature_78846265__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar4 == 0) { + pwVar6 = local_118; + } + else { + local_f8[0] = L'\0'; + local_f8[1] = L'x'; + local_f8[2] = L'\0'; + local_f8[3] = L'\0'; + puStack_f0 = local_a8; + iVar3 = PrjfValidateAndGetGlobalVolumePath(local_118,(ushort *)local_f8,param_3); + if (iVar3 < 0) { + if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) + goto LAB_0; + uVar7 = 0x4c; + goto LAB_1; + } + pwVar6 = local_f8; + } + iVar3 = FltGetVolumeFromName(Globals,pwVar6,&local_138); if (-1 < iVar3) { - iVar3 = FltGetVolumeName(local_res18,0,local_res10); + iVar3 = FltGetVolumeName(local_138,0,local_148); if (iVar3 != -0x3fffffdd) { iVar3 = -0x3ffffff0; goto LAB_0; } - if (0xffff < local_res10[0]) { + if (0xffff < local_148[0]) { MicrosoftTelemetryAssertTriggeredNoArgsKM(); } - uVar1 = (local_res10[0] & 0xffff) * 2; + uVar1 = (local_148[0] & 0xffff) * 2; if (uVar1 < 0x10000) { uVar2 = (ushort)uVar1; if ((uVar2 <= (ushort)(uVar2 + 8)) && ((ushort)(uVar2 + 8) <= (ushort)(uVar2 + 0x50))) { - local_88._0_4_ = CONCAT22(uVar2 + 0x50,(undefined2)local_88); - uVar4 = PrjfAllocateUnicodeString(0x6e664a50,(undefined2 *)&local_88); - iVar3 = (int)uVar4; + local_130._0_4_ = CONCAT22(uVar2 + 0x50,(undefined2)local_130); + uVar5 = PrjfAllocateUnicodeString(0x6e664a50,(undefined2 *)&local_130); + iVar3 = (int)uVar5; if (iVar3 < 0) goto LAB_0; - iVar3 = FltGetVolumeName(local_res18,&local_88,local_res10); + iVar3 = FltGetVolumeName(local_138,&local_130,local_148); if (iVar3 < 0) goto LAB_0; - iVar3 = RtlAppendUnicodeToString(&local_88,L"\\System Volume Information\\Gvflt.md"); + iVar3 = RtlAppendUnicodeToString(&local_130,L"\\System Volume Information\\Gvflt.md"); if (iVar3 < 0) { if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0; - uVar5 = 0x4a; + uVar7 = 0x4e; } else { - local_48 = (undefined1 *)&local_88; - local_58 = CONCAT44(local_58._4_4_,0x30); - uStack_50 = 0; - uStack_40 = CONCAT44(uStack_40._4_4_,0x200); - local_38 = 0; - uStack_30 = 0; - iVar3 = FltCreateFileEx(Globals,local_res8,&local_90,&local_res20, - CONCAT44(uVar6,0x1f01ff),&local_58,&local_68,0, - CONCAT44(uVar8,6),1,3,0,0,0,0); + local_d8 = (undefined1 *)&local_130; + local_e8 = CONCAT44(local_e8._4_4_,0x30); + uStack_e0 = 0; + uStack_d0 = CONCAT44(uStack_d0._4_4_,0x200); + local_c8 = 0; + uStack_c0 = 0; + iVar3 = FltCreateFileEx(Globals,local_140,&local_100,&local_120); if (iVar3 < 0) { if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0; - uVar5 = 0x4b; + uVar7 = 0x4f; } else { - local_98 = 0; - local_res10[0] = 4; - _Dst = (void *)FltAllocatePoolAlignedWithTag(local_res8,0x200,0x1000,0x69764a50); + local_108 = 0; + local_148[0] = 4; + _Dst = (void *)FltAllocatePoolAlignedWithTag(local_140,0x200,0x1000,0x69764a50); if (_Dst == (void *)0x0) { iVar3 = -0x3fffff66; goto LAB_0; } memset(_Dst,0,0x1000); - memcpy(_Dst,param_1 + 2,(ulonglong)local_res10[0]); - iVar3 = FltWriteFile(local_res8,local_res20,&local_98,0x1000,_Dst,1,0,0,0); + memcpy(_Dst,param_1 + 2,(ulonglong)local_148[0]); + iVar3 = FltWriteFile(local_140,local_120,&local_108,0x1000); if ((-1 < iVar3) || ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) goto LAB_0; - uVar5 = 0x4c; + uVar7 = 0x50; } } goto LAB_1; } } - local_88._0_4_ = CONCAT22(0xffff,(undefined2)local_88); + local_130._0_4_ = CONCAT22(0xffff,(undefined2)local_130); iVar3 = -0x3fffff6b; goto LAB_0; } if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0; - uVar5 = 0x49; + uVar7 = 0x4d; } } } LAB_1: - WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,uVar5, - &WPP_7642f67f9d7e36cc26ec38a25b4c3165_Traceguids, + WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,uVar7, + &WPP_1d85ca05f54836e6837feaf19b6b0e42_Traceguids, "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c"); LAB_0: - if (lStack_80 != 0) { - ExFreePoolWithTag(lStack_80,0x6e664a50); - } - if (local_res20 != 0) { + if (lStack_128 != 0) { + ExFreePoolWithTag(lStack_128,0x6e664a50); + } + if (local_120 != 0) { ObfDereferenceObject(); } - if (local_90 != 0) { + if (local_100 != 0) { FltClose(); } - if (local_res8 != 0) { + if (local_140 != 0) { FltObjectDereference(); } - if (local_res18 != 0) { - FltObjectDereference(local_res18); + if (local_138 != 0) { + FltObjectDereference(local_138); } if (_Dst != (void *)0x0) { - FltFreePoolAlignedWithTag(local_res8,_Dst,0x69764a50); + FltFreePoolAlignedWithTag(local_140,_Dst,0x69764a50); } return iVar3; } ``` ## PrjfWriteFileDataHandler ### Match Info |Key|pj_7920.sys - pj_8036.sys| | :---: | :---: | |diff_type|code,length,sig,address,called| |ratio|0.17| |i_ratio|0.4| |m_ratio|0.99| |b_ratio|0.22| |match_types|SymbolsHash| ### Function Meta Diff |Key|pj_7920.sys|pj_8036.sys| | :---: | :---: | :---: | |name|PrjfWriteFileDataHandler|PrjfWriteFileDataHandler| |fullname|PrjfWriteFileDataHandler|PrjfWriteFileDataHandler| |refcount|2|2| |`length`|1783|1786| |`called`|
Expand for full list:
FLTMGR.SYS::FltAcquireResourceShared
FLTMGR.SYS::FltReleaseResource
FLTMGR.SYS::FltWriteFileEx
NTOSKRNL.EXE::IoAllocateMdl
NTOSKRNL.EXE::IoFreeMdl
NTOSKRNL.EXE::IoGetCurrentProcess
NTOSKRNL.EXE::MmProbeAndLockPages
NTOSKRNL.EXE::MmUnlockPages
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::ObfReferenceObject
NTOSKRNL.EXE::ProbeForReadNTOSKRNL.EXE::RtlLookupElementGenericTableAvl
PrjfGetUnionContextByVirtualizationInstanceInfo
PrjfManageHydrationOnNonCachedHandle
PrjfReleaseUnionContext
WPP_RECORDER_SF_sD
WPP_RECORDER_SF_sDd
WPP_RECORDER_SF_sDdZ
WPP_RECORDER_SF_sDdiiZ
WPP_RECORDER_SF_sDsiLiLZ
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
|
Expand for full list:
FLTMGR.SYS::FltAcquireResourceShared
FLTMGR.SYS::FltReleaseResource
FLTMGR.SYS::FltWriteFileEx
Feature_1083645240__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::IoAllocateMdl
NTOSKRNL.EXE::IoFreeMdl
NTOSKRNL.EXE::IoGetCurrentProcess
NTOSKRNL.EXE::MmProbeAndLockPages
NTOSKRNL.EXE::MmUnlockPages
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::ObfReferenceObjectNTOSKRNL.EXE::ProbeForRead
NTOSKRNL.EXE::RtlLookupElementGenericTableAvl
PrjfGetUnionContextByVirtualizationInstanceInfo
PrjfManageHydrationOnNonCachedHandle
PrjfReleaseUnionContext
PrjfValidateHandleAccess
WPP_RECORDER_SF_sD
WPP_RECORDER_SF_sDd
WPP_RECORDER_SF_sDdZ
WPP_RECORDER_SF_sDdiiZ
WPP_RECORDER_SF_sDsiLiLZ
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
| |calling|PrjfPortMessage|PrjfPortMessage| |paramcount|3|3| |`address`|14002a4e4|14002a5e4| |`sig`|int __fastcall PrjfWriteFileDataHandler(ulonglong param_1, uint * param_2, uint param_3)|longlong * __fastcall PrjfWriteFileDataHandler(undefined8 param_1, uint * param_2, uint param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### PrjfWriteFileDataHandler Called Diff ```diff --- PrjfWriteFileDataHandler called +++ PrjfWriteFileDataHandler called @@ -3,0 +4 @@ +Feature_1083645240__private_IsEnabledDeviceUsageNoInline @@ -15,0 +17 @@ +PrjfValidateHandleAccess ``` ### PrjfWriteFileDataHandler Diff ```diff --- PrjfWriteFileDataHandler +++ PrjfWriteFileDataHandler @@ -1,238 +1,221 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ /* WARNING: Globals starting with '_' overlap smaller symbols at the same address */ -int PrjfWriteFileDataHandler(ulonglong param_1,uint *param_2,uint param_3) +longlong * PrjfWriteFileDataHandler(undefined8 param_1,uint *param_2,uint param_3) { - longlong *plVar1; + longlong lVar1; bool bVar2; bool bVar3; - int iVar4; - longlong *plVar5; - longlong lVar6; - undefined2 uVar7; - ulonglong uVar8; - longlong lVar9; - longlong lVar11; - ulonglong uVar13; - undefined1 auStackY_148 [32]; - undefined8 in_stack_fffffffffffffee8; + uint uVar4; + longlong lVar5; + ulonglong uVar6; + longlong *plVar7; + longlong *plVar8; + ulonglong uVar9; + undefined2 uVar10; + longlong *plVar11; + longlong *plVar12; + longlong *plVar13; + undefined1 auStackY_138 [32]; + undefined8 in_stack_fffffffffffffef8; undefined4 uVar14; - undefined8 in_stack_fffffffffffffef0; + undefined8 in_stack_ffffffffffffff00; undefined4 uVar15; - undefined8 local_d0; - longlong local_c8; - undefined4 local_c0; - undefined4 local_bc; - longlong local_b8; - uint *local_b0; + uint local_c4; + longlong *local_c0; + undefined4 local_b8; + undefined4 local_b4; + undefined8 local_b0; longlong *local_a8; + longlong *local_a0; undefined8 local_98 [4]; - undefined8 *local_78; - undefined4 local_70; - undefined4 local_6c; + uint *local_78; + undefined8 local_70; uint *local_68; - undefined4 local_60; - undefined4 local_5c; - undefined8 local_58; + undefined8 local_60; + longlong local_58; uint local_50 [2]; - longlong *local_48; - undefined4 local_40; - undefined4 local_3c; + longlong **local_48; + undefined8 local_40; ulonglong local_38; - longlong lVar10; - longlong lVar12; - uVar14 = (undefined4)((ulonglong)in_stack_fffffffffffffee8 >> 0x20); - uVar15 = (undefined4)((ulonglong)in_stack_fffffffffffffef0 >> 0x20); - local_38 = __security_cookie ^ (ulonglong)auStackY_148; - plVar5 = (longlong *)0x0; - lVar10 = 0; - lVar9 = 0; - local_c0 = 0; - bVar2 = false; + uVar14 = (undefined4)((ulonglong)in_stack_fffffffffffffef8 >> 0x20); + uVar15 = (undefined4)((ulonglong)in_stack_ffffffffffffff00 >> 0x20); + local_38 = __security_cookie ^ (ulonglong)auStackY_138; + plVar7 = (longlong *)0x0; + plVar11 = (longlong *)0x0; + plVar12 = (longlong *)0x0; + local_b8 = 0; bVar3 = false; - lVar12 = 0; - lVar11 = 0; - local_b8 = 0; - local_d0 = param_1; + plVar13 = (longlong *)0x0; + local_a8 = (longlong *)0x0; + local_b0 = param_1; if (param_3 < *param_2) { - iVar4 = -0x3ffffff3; - lVar9 = lVar10; - lVar11 = lVar12; - bVar3 = bVar2; + plVar8 = (longlong *)0xc000000d; + plVar11 = plVar7; + plVar12 = plVar7; + plVar13 = plVar7; if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0; - uVar7 = 0x31; + uVar10 = 0x33; } else if (*param_2 < 0x78) { - iVar4 = -0x3ffffff3; - lVar9 = lVar10; - lVar11 = lVar12; - bVar3 = bVar2; + plVar8 = (longlong *)0xc000000d; if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0; - uVar7 = 0x32; - iVar4 = -0x3ffffff3; + uVar10 = 0x34; } else { - plVar5 = PrjfGetUnionContextByVirtualizationInstanceInfo((longlong *)(param_2 + 2),param_1); - local_a8 = plVar5; - if (plVar5 == (longlong *)0x0) { - iVar4 = -0x3ffffff3; - bVar3 = bVar2; + plVar11 = PrjfGetUnionContextByVirtualizationInstanceInfo((longlong *)(param_2 + 2),param_1); + local_a0 = plVar11; + if (plVar11 == (longlong *)0x0) { + plVar8 = (longlong *)0xc000000d; if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0; - uVar7 = 0x33; + uVar10 = 0x35; } else { - lVar6 = IoGetCurrentProcess(); - if (lVar6 != plVar5[4]) { - iVar4 = -0x3fffffde; - bVar3 = bVar2; + lVar5 = IoGetCurrentProcess(); + if (lVar5 != plVar11[4]) { + plVar8 = (longlong *)0xc0000022; if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) { - WPP_RECORDER_SF_sD(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0x34, - &WPP_7642f67f9d7e36cc26ec38a25b4c3165_Traceguids, + WPP_RECORDER_SF_sD(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0x36, + &WPP_1d85ca05f54836e6837feaf19b6b0e42_Traceguids, "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c"); } goto LAB_0; } - plVar1 = plVar5 + 0xc; - FltAcquireResourceShared(plVar1); - lVar6 = RtlLookupElementGenericTableAvl(plVar5 + 0x19,param_2 + 0x16); - if (lVar6 != 0) { - lVar9 = *(longlong *)(lVar6 + 0x10); - local_c8 = lVar9; - ObfReferenceObject(lVar9); - FltReleaseResource(plVar1); - uVar8 = (ulonglong)param_2[0x1c]; - if (*(longlong *)(lVar9 + 0x18) == 0) { - iVar4 = -0x3fffff45; - if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) { - WPP_RECORDER_SF_sDdZ - (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0x36, - &WPP_7642f67f9d7e36cc26ec38a25b4c3165_Traceguids, - "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c",CONCAT44(uVar14,0x5c2), - CONCAT44(uVar15,0xc00000bb),(wchar_t *)(lVar9 + 0x58)); - } - lVar11 = lVar12; - if (5 < DAT_1) { - if (((_DAT_2 & 0x400000000000) == 0) || - ((DAT_3 & 0x400000000000) != DAT_3)) { - bVar2 = false; - } - else { - bVar2 = true; - } - if (bVar2) { - local_d0 = CONCAT44(local_d0._4_4_,*(uint *)(lVar9 + 0x50) >> 3) & 0xffffffff00000001; - local_78 = &local_d0; - local_70 = 4; - local_6c = 0; - local_68 = local_50; - local_60 = 2; - local_5c = 0; - local_58 = *(undefined8 *)(lVar9 + 0x60); - local_50[0] = (uint)*(ushort *)(lVar9 + 0x58); - local_50[1] = 0; - local_c8 = 0x1000000; - local_48 = &local_c8; - local_40 = 8; - local_3c = 0; - _tlgWriteTransfer_EtwWriteTransfer(0x140012068,&DAT_4,0,0,6,local_98); - } - } - } - else { - lVar10 = *(longlong *)(*(longlong *)(lVar9 + 0x18) + 0x20); - local_b0 = param_2 + 0x1a; - lVar12 = *(longlong *)local_b0; - if ((lVar12 < 0) || (lVar10 < lVar12)) { - iVar4 = -0x3ffffff3; + FltAcquireResourceShared(plVar11 + 0xc); + lVar5 = RtlLookupElementGenericTableAvl(plVar11 + 0x19,param_2 + 0x16); + if (lVar5 == 0) { + FltReleaseResource(plVar11 + 0xc); + plVar8 = (longlong *)0xc0000008; + if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0; + uVar10 = 0x37; + } + else { + plVar12 = *(longlong **)(lVar5 + 0x10); + local_c0 = plVar12; + ObfReferenceObject(plVar12); + uVar6 = Feature_1083645240__private_IsEnabledDeviceUsageNoInline(); + plVar8 = plVar7; + if ((int)uVar6 != 0) { + uVar6 = PrjfValidateHandleAccess(*(longlong *)(lVar5 + 0x18),6,(longlong)plVar12); + plVar8 = (longlong *)(uVar6 & 0xffffffff); + } + FltReleaseResource(plVar11 + 0xc); + uVar6 = Feature_1083645240__private_IsEnabledDeviceUsageNoInline(); + if (((int)uVar6 == 0) || (-1 < (int)plVar8)) { + uVar6 = (ulonglong)param_2[0x1c]; + if (plVar12[3] == 0) { + plVar8 = (longlong *)0xc00000bb; + if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) { + WPP_RECORDER_SF_sDdZ + (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0x39, + &WPP_1d85ca05f54836e6837feaf19b6b0e42_Traceguids, + "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c",CONCAT44(uVar14,0x603), + CONCAT44(uVar15,0xc00000bb),(wchar_t *)(plVar12 + 0xb)); + } + if (5 < DAT_1) { + if (((_DAT_2 & 0x400000000000) == 0) || + (bVar2 = true, (DAT_3 & 0x400000000000) != DAT_3)) { + bVar2 = false; + } + if (bVar2) { + local_c4 = *(uint *)(plVar12 + 10) >> 3 & 1; + local_78 = &local_c4; + local_70 = 4; + local_68 = local_50; + local_60 = 2; + local_58 = plVar12[0xc]; + local_50[0] = (uint)*(ushort *)(plVar12 + 0xb); + local_50[1] = 0; + local_c0 = (longlong *)0x1000000; + local_48 = &local_c0; + local_40 = 8; + _tlgWriteTransfer_EtwWriteTransfer(0x140012068,&DAT_4,0,0,6,local_98); + } + } + goto LAB_0; + } + lVar5 = *(longlong *)(plVar12[3] + 0x20); + lVar1 = *(longlong *)(param_2 + 0x1a); + if ((lVar1 < 0) || (lVar5 < lVar1)) { + plVar8 = (longlong *)0xc000000d; if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) { WPP_RECORDER_SF_sDdiiZ(*(undefined8 *)(WPP_GLOBAL_Control + 0x40)); } - } - else { - uVar13 = lVar10 - lVar12; - if (uVar13 < uVar8) { - if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) { - uVar15 = 1; - WPP_RECORDER_SF_sDsiLiLZ(*(undefined8 *)(WPP_GLOBAL_Control + 0x40)); - } - uVar8 = uVar13 & 0xffffffff; - } - ProbeForRead(*(undefined8 *)(param_2 + 0x1e),param_2[0x1c],1); - lVar11 = IoAllocateMdl(*(undefined8 *)(param_2 + 0x1e),param_2[0x1c],0,0); - local_b8 = lVar11; - if (lVar11 == 0) { - iVar4 = -0x3fffff66; - local_bc = 0xc000009a; - if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) { - WPP_RECORDER_SF_sDdZ - (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0x39, - &WPP_7642f67f9d7e36cc26ec38a25b4c3165_Traceguids, - "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c",CONCAT44(uVar14,0x617) - ,CONCAT44(uVar15,0xc000009a),(wchar_t *)(lVar9 + 0x58)); - } - bVar3 = false; - } - else { - MmProbeAndLockPages(lVar11,0,0); - bVar3 = true; - if ((*(uint *)(lVar9 + 0x50) & 8) == 0) { - uVar14 = 0; - uVar15 = (undefined4)((ulonglong)&local_c0 >> 0x20); - iVar4 = FltWriteFileEx(local_d0,lVar9,local_b0,uVar8); - if ((iVar4 < 0) && - ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) { - WPP_RECORDER_SF_sDdZ - (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,10,0x3c, - &WPP_7642f67f9d7e36cc26ec38a25b4c3165_Traceguids, - "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c", - CONCAT44(uVar15,0x655),CONCAT44(uVar14,iVar4),(wchar_t *)(lVar9 + 0x58) - ); - } - } - else { - iVar4 = PrjfManageHydrationOnNonCachedHandle - (local_d0,lVar9,(longlong)param_2,lVar11); - if ((iVar4 < 0) && - ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) { - WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0x3b, - &WPP_7642f67f9d7e36cc26ec38a25b4c3165_Traceguids, - "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c"); - } - } - } - } - } - goto LAB_0; + goto LAB_0; + } + uVar9 = lVar5 - lVar1; + if ((uVar9 < uVar6) && + (uVar6 = uVar9, (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) { + uVar15 = 1; + WPP_RECORDER_SF_sDsiLiLZ(*(undefined8 *)(WPP_GLOBAL_Control + 0x40)); + } + ProbeForRead(*(undefined8 *)(param_2 + 0x1e),param_2[0x1c],1); + plVar13 = (longlong *)IoAllocateMdl(*(undefined8 *)(param_2 + 0x1e),param_2[0x1c],0,0); + local_a8 = plVar13; + if (plVar13 == (longlong *)0x0) { + plVar8 = (longlong *)0xc000009a; + local_b4 = 0xc000009a; + if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) { + WPP_RECORDER_SF_sDdZ + (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0x3c, + &WPP_1d85ca05f54836e6837feaf19b6b0e42_Traceguids, + "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c",CONCAT44(uVar14,0x658), + CONCAT44(uVar15,0xc000009a),(wchar_t *)(plVar12 + 0xb)); + } + goto LAB_0; + } + MmProbeAndLockPages(plVar13,0,0); + bVar3 = true; + if ((*(uint *)(plVar12 + 10) & 8) == 0) { + uVar14 = 0; + uVar15 = (undefined4)((ulonglong)&local_b8 >> 0x20); + uVar4 = FltWriteFileEx(local_b0,plVar12,param_2 + 0x1a,uVar6 & 0xffffffff); + plVar8 = (longlong *)(ulonglong)uVar4; + if (((int)uVar4 < 0) && + ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) { + WPP_RECORDER_SF_sDdZ + (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,10,0x3f, + &WPP_1d85ca05f54836e6837feaf19b6b0e42_Traceguids, + "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c",CONCAT44(uVar15,0x696), + CONCAT44(uVar14,uVar4),(wchar_t *)(plVar12 + 0xb)); + } + goto LAB_0; + } + uVar4 = PrjfManageHydrationOnNonCachedHandle + (local_b0,(longlong)plVar12,(longlong)param_2,(longlong)plVar13); + plVar8 = (longlong *)(ulonglong)uVar4; + if ((-1 < (int)uVar4) || + ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) + goto LAB_0; + uVar10 = 0x3e; + } + else { + if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) + goto LAB_0; + uVar10 = 0x38; + } } - FltReleaseResource(plVar1); - iVar4 = -0x3ffffff8; - bVar3 = bVar2; - if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0; - uVar7 = 0x35; } } - WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,uVar7, - &WPP_7642f67f9d7e36cc26ec38a25b4c3165_Traceguids, + WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,uVar10, + &WPP_1d85ca05f54836e6837feaf19b6b0e42_Traceguids, "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c"); - lVar9 = lVar10; - lVar11 = lVar12; - bVar3 = bVar2; LAB_0: - if (lVar9 != 0) { - ObfDereferenceObject(lVar9); - } - if (plVar5 != (longlong *)0x0) { - PrjfReleaseUnionContext((longlong)plVar5); + if (plVar12 != (longlong *)0x0) { + ObfDereferenceObject(plVar12); + } + if (plVar11 != (longlong *)0x0) { + PrjfReleaseUnionContext((longlong)plVar11); } if (bVar3) { - MmUnlockPages(lVar11); - } - if (lVar11 != 0) { - IoFreeMdl(lVar11); - } - return iVar4; + MmUnlockPages(plVar13); + } + if (plVar13 != (longlong *)0x0) { + IoFreeMdl(plVar13); + } + return plVar8; } ``` ## WPP_RECORDER_SF_sDdLLl ### Match Info |Key|pj_7920.sys - pj_8036.sys| | :---: | :---: | |diff_type|code,length| |ratio|0.8| |i_ratio|0.86| |m_ratio|1.0| |b_ratio|0.99| |match_types|SymbolsHash| ### Function Meta Diff |Key|pj_7920.sys|pj_8036.sys| | :---: | :---: | :---: | |name|WPP_RECORDER_SF_sDdLLl|WPP_RECORDER_SF_sDdLLl| |fullname|WPP_RECORDER_SF_sDdLLl|WPP_RECORDER_SF_sDdLLl| |refcount|2|2| |`length`|337|339| |called|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace| |calling|PrjfSendCommandAndWaitForCompletion|PrjfSendCommandAndWaitForCompletion| |paramcount|1|1| |address|14003d6dc|14003d6dc| |sig|undefined __fastcall WPP_RECORDER_SF_sDdLLl(undefined8 param_1)|undefined __fastcall WPP_RECORDER_SF_sDdLLl(undefined8 param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### WPP_RECORDER_SF_sDdLLl Diff ```diff --- WPP_RECORDER_SF_sDdLLl +++ WPP_RECORDER_SF_sDdLLl @@ -1,18 +1,18 @@ void WPP_RECORDER_SF_sDdLLl(undefined8 param_1) { undefined4 local_18 [4]; - local_18[0] = 0xe18; + local_18[0] = 0xe6f; if (((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x2000) != 0) && (2 < (byte)WPP_GLOBAL_Control[0x29]) ) { - FastWppTraceMessage(&WPP_7642f67f9d7e36cc26ec38a25b4c3165_Traceguids,0x82, + FastWppTraceMessage(&WPP_1d85ca05f54836e6837feaf19b6b0e42_Traceguids,0x86, "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c",0x2b); } - WppAutoLogTrace(param_1,3,0xe,&WPP_7642f67f9d7e36cc26ec38a25b4c3165_Traceguids,0x82, + WppAutoLogTrace(param_1,3,0xe,&WPP_1d85ca05f54836e6837feaf19b6b0e42_Traceguids,0x86, "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c",0x2b,local_18,4, &stack0x00000040,4,&stack0x00000048,4,&stack0x00000050,4,&stack0x00000058,4,0); return; } ``` ## PrjfReadFileHandler ### Match Info |Key|pj_7920.sys - pj_8036.sys| | :---: | :---: | |diff_type|code,length,sig,address,called| |ratio|0.49| |i_ratio|0.37| |m_ratio|0.93| |b_ratio|0.75| |match_types|SymbolsHash| ### Function Meta Diff |Key|pj_7920.sys|pj_8036.sys| | :---: | :---: | :---: | |name|PrjfReadFileHandler|PrjfReadFileHandler| |fullname|PrjfReadFileHandler|PrjfReadFileHandler| |refcount|2|2| |`length`|862|973| |`called`|
Expand for full list:
FLTMGR.SYS::FltAcquireResourceShared
FLTMGR.SYS::FltReadFile
FLTMGR.SYS::FltReleaseResource
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::IoGetCurrentProcess
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::ObfReferenceObject
NTOSKRNL.EXE::RtlLookupElementGenericTableAvl
PrjfGetUnionContextByVirtualizationInstanceInfo
PrjfReleaseUnionContext
WPP_RECORDER_SF_sDWPP_RECORDER_SF_sDd
WPP_RECORDER_SF_sDdD
__security_check_cookie
|
Expand for full list:
FLTMGR.SYS::FltAcquireResourceShared
FLTMGR.SYS::FltReadFile
FLTMGR.SYS::FltReleaseResource
Feature_1083645240__private_IsEnabledDeviceUsageNoInline
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::IoGetCurrentProcess
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::ObfReferenceObject
NTOSKRNL.EXE::RtlLookupElementGenericTableAvl
PrjfGetUnionContextByVirtualizationInstanceInfo
PrjfReleaseUnionContextPrjfValidateHandleAccess
WPP_RECORDER_SF_sD
WPP_RECORDER_SF_sDd
WPP_RECORDER_SF_sDdD
__security_check_cookie
| |calling|PrjfPortMessage|PrjfPortMessage| |paramcount|4|4| |`address`|140028090|140028124| |`sig`|int __fastcall PrjfReadFileHandler(undefined8 param_1, longlong * param_2, longlong param_3, uint param_4)|ulonglong __fastcall PrjfReadFileHandler(undefined8 param_1, longlong * param_2, longlong param_3, uint param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### PrjfReadFileHandler Called Diff ```diff --- PrjfReadFileHandler called +++ PrjfReadFileHandler called @@ -3,0 +4 @@ +Feature_1083645240__private_IsEnabledDeviceUsageNoInline @@ -10,0 +12 @@ +PrjfValidateHandleAccess ``` ### PrjfReadFileHandler Diff ```diff --- PrjfReadFileHandler +++ PrjfReadFileHandler @@ -1,102 +1,122 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ -int PrjfReadFileHandler(undefined8 param_1,longlong *param_2,longlong param_3,uint param_4) +ulonglong PrjfReadFileHandler(undefined8 param_1,longlong *param_2,longlong param_3,uint param_4) { longlong *plVar1; - int iVar2; + longlong lVar2; longlong *plVar3; longlong lVar4; - uint uVar5; - undefined2 uVar6; + ulonglong uVar5; + uint uVar6; + ulonglong uVar7; + undefined2 uVar8; undefined1 auStackY_b8 [32]; longlong local_68; longlong lStack_60; undefined8 local_58; undefined8 uStack_50; ulonglong local_48; local_48 = __security_cookie ^ (ulonglong)auStackY_b8; - uVar5 = (int)param_2[0xd] + 8; + uVar6 = (int)param_2[0xd] + 8; local_68 = 0; lStack_60 = 0; local_58 = 0; uStack_50 = 0; - if (uVar5 < 8) { + if (uVar6 < 8) { if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) { - return -0x3fffff6b; + return 0xc0000095; } - WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0x2b, - &WPP_7642f67f9d7e36cc26ec38a25b4c3165_Traceguids, + WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0x2c, + &WPP_1d85ca05f54836e6837feaf19b6b0e42_Traceguids, "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c"); - return -0x3fffff6b; + return 0xc0000095; } - if (param_4 < uVar5) { + if (param_4 < uVar6) { if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) { - return -0x3ffffff3; + return 0xc000000d; } WPP_RECORDER_SF_sDdD - (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),param_2,0xe,0x2c, - &WPP_7642f67f9d7e36cc26ec38a25b4c3165_Traceguids, + (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),param_2,0xe,0x2d, + &WPP_1d85ca05f54836e6837feaf19b6b0e42_Traceguids, "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c"); - return -0x3ffffff3; + return 0xc000000d; } plVar3 = PrjfGetUnionContextByVirtualizationInstanceInfo(param_2,param_1); if (plVar3 == (longlong *)0x0) { if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) { - return -0x3ffffff3; + return 0xc000000d; } - WPP_RECORDER_SF_sD(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0x2d, - &WPP_7642f67f9d7e36cc26ec38a25b4c3165_Traceguids, + WPP_RECORDER_SF_sD(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0x2e, + &WPP_1d85ca05f54836e6837feaf19b6b0e42_Traceguids, "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c"); - return -0x3ffffff3; + return 0xc000000d; } lVar4 = IoGetCurrentProcess(); if (lVar4 == plVar3[4]) { local_68 = param_2[10]; lStack_60 = param_2[0xb]; plVar1 = plVar3 + 0xc; FltAcquireResourceShared(plVar1); lVar4 = RtlLookupElementGenericTableAvl(plVar3 + 0x19,&local_68); if (lVar4 != 0) { - lVar4 = *(longlong *)(lVar4 + 0x10); - ObfReferenceObject(lVar4); + lVar2 = *(longlong *)(lVar4 + 0x10); + ObfReferenceObject(lVar2); + uVar7 = Feature_1083645240__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar7 == 0) { + uVar7 = 0; + } + else { + uVar7 = PrjfValidateHandleAccess(*(longlong *)(lVar4 + 0x18),1,lVar2); + uVar7 = uVar7 & 0xffffffff; + } FltReleaseResource(plVar1); - if ((*(uint *)(lVar4 + 0x50) & 0x40) == 0) { - MicrosoftTelemetryAssertTriggeredNoArgsKM(); + uVar5 = Feature_1083645240__private_IsEnabledDeviceUsageNoInline(); + if (((int)uVar5 == 0) || (-1 < (int)uVar7)) { + if ((*(uint *)(lVar2 + 0x50) & 0x40) == 0) { + MicrosoftTelemetryAssertTriggeredNoArgsKM(); + } + uVar6 = FltReadFile(param_1,lVar2,param_2 + 0xc,(int)param_2[0xd]); + uVar7 = (ulonglong)uVar6; + if (uVar6 == 0xc0000011) { + *(undefined4 *)(param_3 + 4) = 0; + uVar7 = 0; + } + else if (((int)uVar6 < 0) && + ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) { + uVar8 = 0x32; + goto LAB_0; + } } - iVar2 = FltReadFile(param_1,lVar4,param_2 + 0xc,(int)param_2[0xd]); - if (iVar2 == -0x3fffffef) { - iVar2 = 0; - *(undefined4 *)(param_3 + 4) = 0; - } - else if ((iVar2 < 0) && ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) - { - WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0x30, - &WPP_7642f67f9d7e36cc26ec38a25b4c3165_Traceguids, + else if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) { + uVar8 = 0x31; +LAB_0: + WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,uVar8, + &WPP_1d85ca05f54836e6837feaf19b6b0e42_Traceguids, "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c"); } - ObfDereferenceObject(lVar4); - goto LAB_0; + if (lVar2 != 0) { + ObfDereferenceObject(lVar2); + } + goto LAB_1; } FltReleaseResource(plVar1); - iVar2 = -0x3ffffff8; - if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0; - uVar6 = 0x2f; - iVar2 = -0x3ffffff8; + uVar7 = 0xc0000008; + if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_1; + uVar8 = 0x30; } else { - iVar2 = -0x3fffffde; - if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0; - uVar6 = 0x2e; - iVar2 = -0x3fffffde; + uVar7 = 0xc0000022; + if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_1; + uVar8 = 0x2f; } - WPP_RECORDER_SF_sD(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,uVar6, - &WPP_7642f67f9d7e36cc26ec38a25b4c3165_Traceguids, + WPP_RECORDER_SF_sD(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,uVar8, + &WPP_1d85ca05f54836e6837feaf19b6b0e42_Traceguids, "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c"); -LAB_0: +LAB_1: PrjfReleaseUnionContext((longlong)plVar3); - return iVar2; + return uVar7; } ``` ## PrjfWritePlaceholderInformationHandler ### Match Info |Key|pj_7920.sys - pj_8036.sys| | :---: | :---: | |diff_type|code,length,address| |ratio|0.93| |i_ratio|0.62| |m_ratio|1.0| |b_ratio|0.98| |match_types|SymbolsHash| ### Function Meta Diff |Key|pj_7920.sys|pj_8036.sys| | :---: | :---: | :---: | |name|PrjfWritePlaceholderInformationHandler|PrjfWritePlaceholderInformationHandler| |fullname|PrjfWritePlaceholderInformationHandler|PrjfWritePlaceholderInformationHandler| |refcount|2|2| |`length`|1221|1224| |called|
Expand for full list:
NTOSKRNL.EXE::ExFreePoolWithTag
PrjfAllocateUnicodeString
PrjfCopyAsPlaceHolder
PrjfCreateHardLink
PrjfCreatePrjReparseBuffer
PrjfCreateSymlinkFromPlaceholderInfoMessage
PrjfGetUnionContextByVirtualizationInstanceInfo
PrjfRelPathToFullPath
PrjfReleaseUnionContext
PrjfValidatePlaceholderInformationMessage
WPP_RECORDER_SF_sDd
|
Expand for full list:
NTOSKRNL.EXE::ExFreePoolWithTag
PrjfAllocateUnicodeString
PrjfCopyAsPlaceHolder
PrjfCreateHardLink
PrjfCreatePrjReparseBuffer
PrjfCreateSymlinkFromPlaceholderInfoMessage
PrjfGetUnionContextByVirtualizationInstanceInfo
PrjfRelPathToFullPath
PrjfReleaseUnionContext
PrjfValidatePlaceholderInformationMessage
WPP_RECORDER_SF_sDd
| |calling|PrjfPortMessage|PrjfPortMessage| |paramcount|4|4| |`address`|14002ac40|14002ad3c| |sig|uint __fastcall PrjfWritePlaceholderInformationHandler(longlong param_1, uint * param_2, longlong param_3, uint param_4)|uint __fastcall PrjfWritePlaceholderInformationHandler(longlong param_1, uint * param_2, longlong param_3, uint param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### PrjfWritePlaceholderInformationHandler Diff ```diff --- PrjfWritePlaceholderInformationHandler +++ PrjfWritePlaceholderInformationHandler @@ -1,181 +1,181 @@ uint PrjfWritePlaceholderInformationHandler (longlong param_1,uint *param_2,longlong param_3,uint param_4) { char *pcVar1; uint uVar2; ushort uVar3; uint uVar4; longlong *plVar5; longlong *plVar6; short *psVar7; undefined8 uVar8; ushort uVar9; ulonglong uVar10; longlong lVar11; void *pvVar12; undefined2 uVar13; short *psVar14; int local_88 [2]; longlong *local_80; longlong local_78; wchar_t local_70 [4]; longlong lStack_68; ushort local_60 [4]; short *psStack_58; longlong local_48; void *pvStack_40; plVar5 = (longlong *)0x0; local_78 = 0; local_80 = (longlong *)0x0; local_88[0] = 0; local_60[0] = 0; local_60[1] = 0; local_60[2] = 0; local_60[3] = 0; psStack_58 = (short *)0x0; local_70[0] = L'\0'; local_70[1] = L'\0'; local_70[2] = L'\0'; local_70[3] = L'\0'; lStack_68 = 0; uVar4 = PrjfValidatePlaceholderInformationMessage(param_2,param_4,&local_78); plVar6 = plVar5; if ((int)uVar4 < 0) goto LAB_0; plVar6 = PrjfGetUnionContextByVirtualizationInstanceInfo((longlong *)(param_2 + 2),param_1); if (plVar6 == (longlong *)0x0) { uVar4 = 0xc000000d; if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0; - uVar13 = 0xd; + uVar13 = 0xe; uVar4 = 0xc000000d; goto LAB_1; } local_48 = plVar6[5]; pvStack_40 = (void *)plVar6[6]; psVar14 = (short *)((ulonglong)param_2[0x16] + (longlong)param_2); if (psVar14 == (short *)0x0) { uVar4 = 0xc000000d; LAB_2: if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0; - uVar13 = 0xe; + uVar13 = 0xf; } else { uVar10 = (ulonglong)(ushort)((ushort)param_2[0x17] >> 1); for (psVar7 = psVar14; (uVar10 != 0 && (*psVar7 != 0)); psVar7 = psVar7 + 1) { uVar10 = uVar10 - 1; } uVar4 = ~-(uint)(uVar10 != 0) & 0xc000000d; if (uVar10 == 0) goto LAB_2; lVar11 = 0x7fff; psVar7 = psVar14; do { if (*psVar7 == 0) break; psVar7 = psVar7 + 1; lVar11 = lVar11 + -1; } while (lVar11 != 0); uVar4 = ~-(uint)(lVar11 != 0) & 0xc000000d; if (lVar11 == 0) { uVar9 = local_60[0]; } else { uVar9 = (0x7fff - (short)lVar11) * 2; local_60[1] = uVar9 + 2; local_60[0] = uVar9; psStack_58 = psVar14; } if ((int)uVar4 < 0) { if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0; - uVar13 = 0xf; + uVar13 = 0x10; } else { uVar3 = (ushort)local_48; if (((ushort)(uVar9 + (ushort)local_48) < (ushort)local_48) || (local_70[1] = uVar9 + (ushort)local_48 + 2, (ushort)local_70[1] < 2)) { uVar4 = 0xc0000095; local_70[1] = 0xffff; goto LAB_0; } uVar8 = PrjfAllocateUnicodeString(0x746d4a50,local_70); uVar4 = (uint)uVar8; if ((int)uVar4 < 0) { if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0; - uVar13 = 0x10; + uVar13 = 0x11; } else { pvVar12 = pvStack_40; uVar4 = PrjfRelPathToFullPath((ushort *)local_70,uVar3,pvStack_40,psStack_58,local_60[0]); if (-1 < (int)uVar4) { if ((param_2[1] & 8) == 0) { if ((((param_2[1] & 0x10) == 0) || (uVar4 = PrjfCreateHardLink(param_1,local_78,local_70), -1 < (int)uVar4)) || ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) goto LAB_0; - uVar13 = 0x15; + uVar13 = 0x16; LAB_3: WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,uVar13, - &WPP_7642f67f9d7e36cc26ec38a25b4c3165_Traceguids, + &WPP_1d85ca05f54836e6837feaf19b6b0e42_Traceguids, "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c"); } else { uVar2 = param_2[0x18]; pcVar1 = (char *)((ulonglong)uVar2 + (longlong)param_2); if (param_2[0x1a] != 0) { uVar4 = PrjfCreateSymlinkFromPlaceholderInfoMessage (param_1,(longlong)plVar6,local_70,(longlong)param_2); if ((-1 < (int)uVar4) || ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) goto LAB_0; - uVar13 = 0x12; + uVar13 = 0x13; goto LAB_1; } local_48 = *(longlong *)(param_2 + 2); pvStack_40 = *(void **)(param_2 + 4); uVar4 = PrjfCreatePrjReparseBuffer (local_60,&local_48,pvVar12,(undefined8 *)(pcVar1 + 0x50),&local_80, local_88); plVar5 = local_80; if ((int)uVar4 < 0) { if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) { - WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0x13, - &WPP_7642f67f9d7e36cc26ec38a25b4c3165_Traceguids, + WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0x14, + &WPP_1d85ca05f54836e6837feaf19b6b0e42_Traceguids, "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c"); plVar5 = local_80; } } else { uVar4 = PrjfCopyAsPlaceHolder (pcVar1,param_3 + (ulonglong)uVar2,local_70,param_1, (longlong)local_80,local_88[0],'\x01',param_2[0x19]); if (((int)uVar4 < 0) && ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) { - uVar13 = 0x14; + uVar13 = 0x15; goto LAB_3; } } } if (plVar5 != (longlong *)0x0) { ExFreePoolWithTag(plVar5,0x69724a50); } goto LAB_0; } if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0; - uVar13 = 0x11; + uVar13 = 0x12; } } } LAB_1: WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,uVar13, - &WPP_7642f67f9d7e36cc26ec38a25b4c3165_Traceguids, + &WPP_1d85ca05f54836e6837feaf19b6b0e42_Traceguids, "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c"); LAB_0: if (lStack_68 != 0) { ExFreePoolWithTag(lStack_68,0x746d4a50); } if (plVar6 != (longlong *)0x0) { PrjfReleaseUnionContext((longlong)plVar6); } return uVar4; } ``` # Modified (No Code Changes) *Slightly modified functions have no code changes, rather differnces in:* - refcount - length - called - calling - name - fullname ## __GSHandlerCheck ### Match Info |Key|pj_7920.sys - pj_8036.sys| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|0.88| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|pj_7920.sys|pj_8036.sys| | :---: | :---: | :---: | |name|__GSHandlerCheck|__GSHandlerCheck| |fullname|__GSHandlerCheck|__GSHandlerCheck| |`refcount`|58|60| |length|29|29| |called|__GSHandlerCheckCommon|__GSHandlerCheckCommon| |calling||| |paramcount|4|4| |`address`|14000ad48|14000ae98| |sig|undefined8 __fastcall __GSHandlerCheck(undefined8 param_1, undefined8 param_2, undefined8 param_3, longlong param_4)|undefined8 __fastcall __GSHandlerCheck(undefined8 param_1, undefined8 param_2, undefined8 param_3, longlong param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## wil_details_IsEnabledFallback ### Match Info |Key|pj_7920.sys - pj_8036.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|pj_7920.sys|pj_8036.sys| | :---: | :---: | :---: | |name|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |fullname|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |`refcount`|6|8| |length|140|140| |called|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath| |`calling`|Feature_2814151992__private_IsEnabledFallback
Feature_3568532792__private_IsEnabledFallback
Feature_4287139131__private_IsEnabledFallback
Feature_EnableTestConfigViaFilterPort__private_IsEnabledFallback
Feature_HydrateLargeNonCachedFiles__private_IsEnabledFallback|Feature_1083645240__private_IsEnabledFallback
Feature_2814151992__private_IsEnabledFallback
Feature_3568532792__private_IsEnabledFallback
Feature_4287139131__private_IsEnabledFallback
Feature_78846265__private_IsEnabledFallback
Feature_EnableTestConfigViaFilterPort__private_IsEnabledFallback
Feature_HydrateLargeNonCachedFiles__private_IsEnabledFallback| |paramcount|3|3| |address|1400042e0|1400042e0| |sig|uint __fastcall wil_details_IsEnabledFallback(ulonglong param_1, int param_2, undefined8 * param_3)|uint __fastcall wil_details_IsEnabledFallback(ulonglong param_1, int param_2, undefined8 * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### wil_details_IsEnabledFallback Calling Diff ```diff --- wil_details_IsEnabledFallback calling +++ wil_details_IsEnabledFallback calling @@ -0,0 +1 @@ +Feature_1083645240__private_IsEnabledFallback @@ -3,0 +5 @@ +Feature_78846265__private_IsEnabledFallback ``` ## WPP_RECORDER_SF_sDZ ### Match Info |Key|pj_7920.sys - pj_8036.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|0.95| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|pj_7920.sys|pj_8036.sys| | :---: | :---: | :---: | |name|WPP_RECORDER_SF_sDZ|WPP_RECORDER_SF_sDZ| |fullname|WPP_RECORDER_SF_sDZ|WPP_RECORDER_SF_sDZ| |`refcount`|7|8| |length|511|511| |called|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace| |`calling`|PrjfCreateExpansionContext
PrjfDoesRootHaveShortNameComponent
PrjfExpansionCsqCompleteCanceledIo
PrjfFsctlSetReparsePoint
PrjfPreWrite
PrjfSetPlaceHolderFlags|PrjfCreateExpansionContext
PrjfDoesRootHaveShortNameComponent
PrjfExpansionCsqCompleteCanceledIo
PrjfFsctlSetReparsePoint
PrjfPreWrite
PrjfSetPlaceHolderFlags
PrjfValidateAndGetGlobalVolumePath| |paramcount|8|8| |address|14003a308|14003a308| |sig|undefined __fastcall WPP_RECORDER_SF_sDZ(undefined8 param_1, byte param_2, uint param_3, undefined2 param_4, undefined8 param_5, char * param_6, undefined8 param_7, wchar_t * param_8)|undefined __fastcall WPP_RECORDER_SF_sDZ(undefined8 param_1, byte param_2, uint param_3, undefined2 param_4, undefined8 param_5, char * param_6, undefined8 param_7, wchar_t * param_8)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### WPP_RECORDER_SF_sDZ Calling Diff ```diff --- WPP_RECORDER_SF_sDZ calling +++ WPP_RECORDER_SF_sDZ calling @@ -6,0 +7 @@ +PrjfValidateAndGetGlobalVolumePath ``` ## NTOSKRNL.EXE::RtlPrefixUnicodeString ### Match Info |Key|pj_7920.sys - pj_8036.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|pj_7920.sys|pj_8036.sys| | :---: | :---: | :---: | |name|RtlPrefixUnicodeString|RtlPrefixUnicodeString| |fullname|NTOSKRNL.EXE::RtlPrefixUnicodeString|NTOSKRNL.EXE::RtlPrefixUnicodeString| |`refcount`|4|5| |length|0|0| |called||| |`calling`|PrjfGetUnionContextByFileName
PrjfIsNameOnPathOfRoot|PrjfGetUnionContextByFileName
PrjfIsNameOnPathOfRoot
PrjfValidateAndGetGlobalVolumePath| |paramcount|0|0| |address|EXTERNAL:00000070|EXTERNAL:00000070| |sig|undefined RtlPrefixUnicodeString(void)|undefined RtlPrefixUnicodeString(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::RtlPrefixUnicodeString Calling Diff ```diff --- NTOSKRNL.EXE::RtlPrefixUnicodeString calling +++ NTOSKRNL.EXE::RtlPrefixUnicodeString calling @@ -2,0 +3 @@ +PrjfValidateAndGetGlobalVolumePath ``` ## WPPRECORDER.SYS::WppAutoLogTrace ### Match Info |Key|pj_7920.sys - pj_8036.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|pj_7920.sys|pj_8036.sys| | :---: | :---: | :---: | |name|WppAutoLogTrace|WppAutoLogTrace| |fullname|WPPRECORDER.SYS::WppAutoLogTrace|WPPRECORDER.SYS::WppAutoLogTrace| |`refcount`|59|60| |length|0|0| |called||| |`calling`|
Expand for full list:
WPP_RECORDER_SF_sD
WPP_RECORDER_SF_sDDDZ
WPP_RECORDER_SF_sDDZ
WPP_RECORDER_SF_sDDZDZ
WPP_RECORDER_SF_sDDd
WPP_RECORDER_SF_sDDdd
WPP_RECORDER_SF_sDDld
WPP_RECORDER_SF_sDLLd
WPP_RECORDER_SF_sDLd
WPP_RECORDER_SF_sDZ
WPP_RECORDER_SF_sDZDDDWPP_RECORDER_SF_sDZL
WPP_RECORDER_SF_sDZLL
WPP_RECORDER_SF_sDZLii
WPP_RECORDER_SF_sDZ_guid_Dd
WPP_RECORDER_SF_sDZd
WPP_RECORDER_SF_sDZdDl
WPP_RECORDER_SF_sDd
WPP_RECORDER_SF_sDdD
WPP_RECORDER_SF_sDdDZ
WPP_RECORDER_SF_sDdL
WPP_RECORDER_SF_sDdLL
WPP_RECORDER_SF_sDdLLl
WPP_RECORDER_SF_sDdLZ
WPP_RECORDER_SF_sDdLlqqq
WPP_RECORDER_SF_sDdPZ
WPP_RECORDER_SF_sDdZ
WPP_RECORDER_SF_sDdZDl
WPP_RECORDER_SF_sDdZDlLL
WPP_RECORDER_SF_sDdZL
WPP_RECORDER_SF_sDdZLZ
WPP_RECORDER_SF_sDdZP
WPP_RECORDER_SF_sDdZZ
WPP_RECORDER_SF_sDdZZZq
WPP_RECORDER_SF_sDdZZq
WPP_RECORDER_SF_sDdZd
WPP_RECORDER_SF_sDdZdDl
WPP_RECORDER_SF_sDdZssss
WPP_RECORDER_SF_sDddZ
WPP_RECORDER_SF_sDdiiZ
WPP_RECORDER_SF_sDdsZ
WPP_RECORDER_SF_sDiD
WPP_RECORDER_SF_sDid
WPP_RECORDER_SF_sDiid
WPP_RECORDER_SF_sDiiiid
WPP_RECORDER_SF_sDl
WPP_RECORDER_SF_sDlLD
WPP_RECORDER_SF_sDlLL
WPP_RECORDER_SF_sDld
WPP_RECORDER_SF_sDq
WPP_RECORDER_SF_sDqDld
WPP_RECORDER_SF_sDqZd
WPP_RECORDER_SF_sDqd
WPP_RECORDER_SF_sDqqZd
WPP_RECORDER_SF_sDqqqZd
WPP_RECORDER_SF_sDqqqd
WPP_RECORDER_SF_sDsDZ
WPP_RECORDER_SF_sDsiLiLZ
|
Expand for full list:
WPP_RECORDER_SF_sD
WPP_RECORDER_SF_sDDDZ
WPP_RECORDER_SF_sDDZ
WPP_RECORDER_SF_sDDZDZ
WPP_RECORDER_SF_sDDd
WPP_RECORDER_SF_sDDdd
WPP_RECORDER_SF_sDDld
WPP_RECORDER_SF_sDHZ
WPP_RECORDER_SF_sDLLd
WPP_RECORDER_SF_sDLd
WPP_RECORDER_SF_sDZWPP_RECORDER_SF_sDZDDD
WPP_RECORDER_SF_sDZL
WPP_RECORDER_SF_sDZLL
WPP_RECORDER_SF_sDZLii
WPP_RECORDER_SF_sDZ_guid_Dd
WPP_RECORDER_SF_sDZd
WPP_RECORDER_SF_sDZdDl
WPP_RECORDER_SF_sDd
WPP_RECORDER_SF_sDdD
WPP_RECORDER_SF_sDdDZ
WPP_RECORDER_SF_sDdL
WPP_RECORDER_SF_sDdLL
WPP_RECORDER_SF_sDdLLl
WPP_RECORDER_SF_sDdLZ
WPP_RECORDER_SF_sDdLlqqq
WPP_RECORDER_SF_sDdPZ
WPP_RECORDER_SF_sDdZ
WPP_RECORDER_SF_sDdZDl
WPP_RECORDER_SF_sDdZDlLL
WPP_RECORDER_SF_sDdZL
WPP_RECORDER_SF_sDdZLZ
WPP_RECORDER_SF_sDdZP
WPP_RECORDER_SF_sDdZZ
WPP_RECORDER_SF_sDdZZZq
WPP_RECORDER_SF_sDdZZq
WPP_RECORDER_SF_sDdZd
WPP_RECORDER_SF_sDdZdDl
WPP_RECORDER_SF_sDdZssss
WPP_RECORDER_SF_sDddZ
WPP_RECORDER_SF_sDdiiZ
WPP_RECORDER_SF_sDdsZ
WPP_RECORDER_SF_sDiD
WPP_RECORDER_SF_sDid
WPP_RECORDER_SF_sDiid
WPP_RECORDER_SF_sDiiiid
WPP_RECORDER_SF_sDl
WPP_RECORDER_SF_sDlLD
WPP_RECORDER_SF_sDlLL
WPP_RECORDER_SF_sDld
WPP_RECORDER_SF_sDq
WPP_RECORDER_SF_sDqDld
WPP_RECORDER_SF_sDqZd
WPP_RECORDER_SF_sDqd
WPP_RECORDER_SF_sDqqZd
WPP_RECORDER_SF_sDqqqZd
WPP_RECORDER_SF_sDqqqd
WPP_RECORDER_SF_sDsDZ
WPP_RECORDER_SF_sDsiLiLZ
| |paramcount|0|0| |address|EXTERNAL:000000a4|EXTERNAL:000000a4| |sig|undefined WppAutoLogTrace(void)|undefined WppAutoLogTrace(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### WPPRECORDER.SYS::WppAutoLogTrace Calling Diff ```diff --- WPPRECORDER.SYS::WppAutoLogTrace calling +++ WPPRECORDER.SYS::WppAutoLogTrace calling @@ -7,0 +8 @@ +WPP_RECORDER_SF_sDHZ ``` ## __security_check_cookie ### Match Info |Key|pj_7920.sys - pj_8036.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.75| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|pj_7920.sys|pj_8036.sys| | :---: | :---: | :---: | |name|__security_check_cookie|__security_check_cookie| |fullname|__security_check_cookie|__security_check_cookie| |`refcount`|63|65| |length|30|30| |called|__report_gsfailure|__report_gsfailure| |`calling`|
Expand for full list:
EnableFlushTimer
LookUpTableFlushComplete
McTemplateK0_EtwWriteTransfer
McTemplateK0d_EtwWriteTransfer
McTemplateK0dhzr1_EtwWriteTransfer
McTemplateK0dhzr1hzr3_EtwWriteTransfer
MicrosoftTelemetryAssertTriggeredWorker
PrjfAggregateTelemetry
PrjfAggregateTelemetryNotifications
PrjfBlockFsctlOperation
PrjfCheckAndCancelTransactedOpenPrjfClearAttributes
PrjfCloseFileHandler
PrjfCopyAsPlaceHolder
PrjfCopyFileBasicInformation
PrjfCopyStreamData
PrjfCreateExpansionContext
PrjfCreateStreamContext
PrjfCreateSymbolicLink
PrjfDeleteTombstoneIfExists
PrjfDoesNameExistInLayer
PrjfDoesRootHaveShortNameComponent
PrjfEnumerateDirectoryWithMerge
PrjfExpansionWorker
PrjfFsctlStartVirtualizationInstance
PrjfGetSetStreamContext
PrjfGetSetStreamHandleContext
PrjfImpersonateAndAddSymlinkPrivilege
PrjfInstanceSetup
PrjfIsZeroAllocatedRange
PrjfNormalizeNameComponent
PrjfOpenFileHandler
PrjfOpenPlaceHolder
PrjfPartiallyExpandDirectory
PrjfPopulateDestinationForRenameOrLink
PrjfPostNetworkQueryOpen
PrjfPrepareDestinationForRenameOrLink
PrjfProcessTombstoneBounce
PrjfQueryAttributes
PrjfReadFileHandler
PrjfRevertInMemoryTombstonesForDirectory
PrjfSendCommandAndWaitForCompletion
PrjfSendGetDirectoryEnumerationCommand
PrjfSendPostCreateNotifications
PrjfSetConfiguration
PrjfSuppressTimestamps
PrjfTelemetryAndTracingInit
PrjfTelemetryPostDirectoryExpansionComplete
PrjfTelemetryPostDirectoryExpansionTrigger
PrjfTelemetryPostExpansionComplete
PrjfTelemetryTombstoneFailureOperation
PrjfUpdatePlaceholderIfNeededHandler
PrjfWriteFileDataHandler
TlgRegisterAggregateProviderEx
TraceLoggingRegisterEx_EtwRegister_EtwSetInformation
__GSHandlerCheckCommon
_tlgWriteTemplate::Write,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<1>,struct__tlgWrapperByRef<16>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<1>_>
wil_details_FeatureReporting_ReportUsageToServiceDirect
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_PopulateInitialConfiguredFeatureStates
wil_details_RecordCachedUsage
wil_details_ReevaluateOnFeatureConfigurationChange
|
Expand for full list:
EnableFlushTimer
LookUpTableFlushComplete
McTemplateK0_EtwWriteTransfer
McTemplateK0d_EtwWriteTransfer
McTemplateK0dhzr1_EtwWriteTransfer
McTemplateK0dhzr1hzr3_EtwWriteTransfer
MicrosoftTelemetryAssertTriggeredWorker
PrjfAggregateTelemetry
PrjfAggregateTelemetryNotifications
PrjfBlockFsctlOperation
PrjfCheckAndCancelTransactedOpenPrjfClearAttributes
PrjfCloseFileHandler
PrjfCopyAsPlaceHolder
PrjfCopyFileBasicInformation
PrjfCopyStreamData
PrjfCreateExpansionContext
PrjfCreateStreamContext
PrjfCreateSymbolicLink
PrjfDeleteTombstoneIfExists
PrjfDoesNameExistInLayer
PrjfDoesRootHaveShortNameComponent
PrjfEnumerateDirectoryWithMerge
PrjfExpansionWorker
PrjfFsctlStartVirtualizationInstance
PrjfGetInstanceFromVolumeName
PrjfGetSetStreamContext
PrjfGetSetStreamHandleContext
PrjfImpersonateAndAddSymlinkPrivilege
PrjfInstanceSetup
PrjfIsZeroAllocatedRange
PrjfNormalizeNameComponent
PrjfOpenFileHandler
PrjfOpenPlaceHolder
PrjfPartiallyExpandDirectory
PrjfPopulateDestinationForRenameOrLink
PrjfPostNetworkQueryOpen
PrjfPrepareDestinationForRenameOrLink
PrjfProcessTombstoneBounce
PrjfQueryAttributes
PrjfReadFileHandler
PrjfRevertInMemoryTombstonesForDirectory
PrjfSendCommandAndWaitForCompletion
PrjfSendGetDirectoryEnumerationCommand
PrjfSendPostCreateNotifications
PrjfSetConfiguration
PrjfSetupVolumeInformationHandler
PrjfSuppressTimestamps
PrjfTelemetryAndTracingInit
PrjfTelemetryPostDirectoryExpansionComplete
PrjfTelemetryPostDirectoryExpansionTrigger
PrjfTelemetryPostExpansionComplete
PrjfTelemetryTombstoneFailureOperation
PrjfUpdatePlaceholderIfNeededHandler
PrjfWriteFileDataHandler
TlgRegisterAggregateProviderEx
TraceLoggingRegisterEx_EtwRegister_EtwSetInformation
__GSHandlerCheckCommon
_tlgWriteTemplate::Write,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<1>,struct__tlgWrapperByRef<16>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<1>_>
wil_details_FeatureReporting_ReportUsageToServiceDirect
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_PopulateInitialConfiguredFeatureStates
wil_details_RecordCachedUsage
wil_details_ReevaluateOnFeatureConfigurationChange
| |paramcount|1|1| |`address`|14000af40|14000b090| |sig|void __cdecl __security_check_cookie(uintptr_t _StackCookie)|void __cdecl __security_check_cookie(uintptr_t _StackCookie)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### __security_check_cookie Calling Diff ```diff --- __security_check_cookie calling +++ __security_check_cookie calling @@ -25,0 +26 @@ +PrjfGetInstanceFromVolumeName @@ -45,0 +47 @@ +PrjfSetupVolumeInformationHandler ``` ## NTOSKRNL.EXE::ObfDereferenceObject ### Match Info |Key|pj_7920.sys - pj_8036.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|pj_7920.sys|pj_8036.sys| | :---: | :---: | :---: | |name|ObfDereferenceObject|ObfDereferenceObject| |fullname|NTOSKRNL.EXE::ObfDereferenceObject|NTOSKRNL.EXE::ObfDereferenceObject| |`refcount`|46|48| |length|0|0| |called||| |`calling`|
Expand for full list:
PrjfAddInMemoryTombstone
PrjfAttachFilterHandler
PrjfCopyAsPlaceHolder
PrjfCreateSymbolicLink
PrjfCreateTombstone
PrjfDecideUpdateDeleteOnFileStateAndUpdateFlags
PrjfDeleteFileHandler
PrjfDeleteTombstoneIfExists
PrjfDoesNameExistInLayer
PrjfDoesRootHaveShortNameComponent
PrjfExpansionWorkerPrjfFlushAndUpdateDiskStateWorker
PrjfInstanceSetup
PrjfLookupEntryBackingLayerNegativePathCache
PrjfNormalizeNameComponent
PrjfOpenAndCheckEmptyPartialDirectory
PrjfOpenPlaceHolder
PrjfPostCleanup
PrjfPostCreate
PrjfPreCleanup
PrjfPrepareSourceForRename
PrjfProcessFileDirectoryStatus
PrjfProcessPrjReparsePointBounce
PrjfProcessTombstoneBounce
PrjfReadFileHandler
PrjfReleaseRenameOrLinkCompletionContext
PrjfReleaseUnionContext
PrjfRemoveInMemoryTombstone
PrjfRemoveTombstonesFromDirectory
PrjfScheduleExpansionWorkItem
PrjfSetParentPlaceHolderFlagsSynchronized
PrjfSetupVolumeInformationHandler
PrjfShouldAutoAttach
PrjfUpdatePlaceholderIfNeededHandler
PrjfWriteFileDataHandler
|
Expand for full list:
PrjfAddInMemoryTombstone
PrjfAttachFilterHandler
PrjfCopyAsPlaceHolder
PrjfCreateSymbolicLink
PrjfCreateTombstone
PrjfDecideUpdateDeleteOnFileStateAndUpdateFlags
PrjfDeleteFileHandler
PrjfDeleteTombstoneIfExists
PrjfDoesNameExistInLayer
PrjfDoesRootHaveShortNameComponent
PrjfExpansionWorkerPrjfFlushAndUpdateDiskStateWorker
PrjfInstanceSetup
PrjfLookupEntryBackingLayerNegativePathCache
PrjfNormalizeNameComponent
PrjfOpenAndCheckEmptyPartialDirectory
PrjfOpenPlaceHolder
PrjfPostCleanup
PrjfPostCreate
PrjfPreCleanup
PrjfPrepareSourceForRename
PrjfProcessFileDirectoryStatus
PrjfProcessPrjReparsePointBounce
PrjfProcessTombstoneBounce
PrjfReadFileHandler
PrjfReleaseRenameOrLinkCompletionContext
PrjfReleaseUnionContext
PrjfRemoveInMemoryTombstone
PrjfRemoveTombstonesFromDirectory
PrjfScheduleExpansionWorkItem
PrjfSetParentPlaceHolderFlagsSynchronized
PrjfSetupVolumeInformationHandler
PrjfShouldAutoAttach
PrjfUpdatePlaceholderIfNeededHandler
PrjfValidateHandleAccess
PrjfWriteFileDataHandler
| |paramcount|0|0| |address|EXTERNAL:0000006b|EXTERNAL:0000006b| |sig|undefined ObfDereferenceObject(void)|undefined ObfDereferenceObject(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::ObfDereferenceObject Calling Diff ```diff --- NTOSKRNL.EXE::ObfDereferenceObject calling +++ NTOSKRNL.EXE::ObfDereferenceObject calling @@ -34,0 +35 @@ +PrjfValidateHandleAccess ``` ## FastWppTraceMessage ### Match Info |Key|pj_7920.sys - pj_8036.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|pj_7920.sys|pj_8036.sys| | :---: | :---: | :---: | |name|FastWppTraceMessage|FastWppTraceMessage| |fullname|FastWppTraceMessage|FastWppTraceMessage| |`refcount`|59|60| |length|68|68| |called|NTOSKRNL.EXE::WmiTraceMessageVa|NTOSKRNL.EXE::WmiTraceMessageVa| |`calling`|
Expand for full list:
WPP_RECORDER_SF_sD
WPP_RECORDER_SF_sDDDZ
WPP_RECORDER_SF_sDDZ
WPP_RECORDER_SF_sDDZDZ
WPP_RECORDER_SF_sDDd
WPP_RECORDER_SF_sDDdd
WPP_RECORDER_SF_sDDld
WPP_RECORDER_SF_sDLLd
WPP_RECORDER_SF_sDLd
WPP_RECORDER_SF_sDZ
WPP_RECORDER_SF_sDZDDDWPP_RECORDER_SF_sDZL
WPP_RECORDER_SF_sDZLL
WPP_RECORDER_SF_sDZLii
WPP_RECORDER_SF_sDZ_guid_Dd
WPP_RECORDER_SF_sDZd
WPP_RECORDER_SF_sDZdDl
WPP_RECORDER_SF_sDd
WPP_RECORDER_SF_sDdD
WPP_RECORDER_SF_sDdDZ
WPP_RECORDER_SF_sDdL
WPP_RECORDER_SF_sDdLL
WPP_RECORDER_SF_sDdLLl
WPP_RECORDER_SF_sDdLZ
WPP_RECORDER_SF_sDdLlqqq
WPP_RECORDER_SF_sDdPZ
WPP_RECORDER_SF_sDdZ
WPP_RECORDER_SF_sDdZDl
WPP_RECORDER_SF_sDdZDlLL
WPP_RECORDER_SF_sDdZL
WPP_RECORDER_SF_sDdZLZ
WPP_RECORDER_SF_sDdZP
WPP_RECORDER_SF_sDdZZ
WPP_RECORDER_SF_sDdZZZq
WPP_RECORDER_SF_sDdZZq
WPP_RECORDER_SF_sDdZd
WPP_RECORDER_SF_sDdZdDl
WPP_RECORDER_SF_sDdZssss
WPP_RECORDER_SF_sDddZ
WPP_RECORDER_SF_sDdiiZ
WPP_RECORDER_SF_sDdsZ
WPP_RECORDER_SF_sDiD
WPP_RECORDER_SF_sDid
WPP_RECORDER_SF_sDiid
WPP_RECORDER_SF_sDiiiid
WPP_RECORDER_SF_sDl
WPP_RECORDER_SF_sDlLD
WPP_RECORDER_SF_sDlLL
WPP_RECORDER_SF_sDld
WPP_RECORDER_SF_sDq
WPP_RECORDER_SF_sDqDld
WPP_RECORDER_SF_sDqZd
WPP_RECORDER_SF_sDqd
WPP_RECORDER_SF_sDqqZd
WPP_RECORDER_SF_sDqqqZd
WPP_RECORDER_SF_sDqqqd
WPP_RECORDER_SF_sDsDZ
WPP_RECORDER_SF_sDsiLiLZ
|
Expand for full list:
WPP_RECORDER_SF_sD
WPP_RECORDER_SF_sDDDZ
WPP_RECORDER_SF_sDDZ
WPP_RECORDER_SF_sDDZDZ
WPP_RECORDER_SF_sDDd
WPP_RECORDER_SF_sDDdd
WPP_RECORDER_SF_sDDld
WPP_RECORDER_SF_sDHZ
WPP_RECORDER_SF_sDLLd
WPP_RECORDER_SF_sDLd
WPP_RECORDER_SF_sDZWPP_RECORDER_SF_sDZDDD
WPP_RECORDER_SF_sDZL
WPP_RECORDER_SF_sDZLL
WPP_RECORDER_SF_sDZLii
WPP_RECORDER_SF_sDZ_guid_Dd
WPP_RECORDER_SF_sDZd
WPP_RECORDER_SF_sDZdDl
WPP_RECORDER_SF_sDd
WPP_RECORDER_SF_sDdD
WPP_RECORDER_SF_sDdDZ
WPP_RECORDER_SF_sDdL
WPP_RECORDER_SF_sDdLL
WPP_RECORDER_SF_sDdLLl
WPP_RECORDER_SF_sDdLZ
WPP_RECORDER_SF_sDdLlqqq
WPP_RECORDER_SF_sDdPZ
WPP_RECORDER_SF_sDdZ
WPP_RECORDER_SF_sDdZDl
WPP_RECORDER_SF_sDdZDlLL
WPP_RECORDER_SF_sDdZL
WPP_RECORDER_SF_sDdZLZ
WPP_RECORDER_SF_sDdZP
WPP_RECORDER_SF_sDdZZ
WPP_RECORDER_SF_sDdZZZq
WPP_RECORDER_SF_sDdZZq
WPP_RECORDER_SF_sDdZd
WPP_RECORDER_SF_sDdZdDl
WPP_RECORDER_SF_sDdZssss
WPP_RECORDER_SF_sDddZ
WPP_RECORDER_SF_sDdiiZ
WPP_RECORDER_SF_sDdsZ
WPP_RECORDER_SF_sDiD
WPP_RECORDER_SF_sDid
WPP_RECORDER_SF_sDiid
WPP_RECORDER_SF_sDiiiid
WPP_RECORDER_SF_sDl
WPP_RECORDER_SF_sDlLD
WPP_RECORDER_SF_sDlLL
WPP_RECORDER_SF_sDld
WPP_RECORDER_SF_sDq
WPP_RECORDER_SF_sDqDld
WPP_RECORDER_SF_sDqZd
WPP_RECORDER_SF_sDqd
WPP_RECORDER_SF_sDqqZd
WPP_RECORDER_SF_sDqqqZd
WPP_RECORDER_SF_sDqqqd
WPP_RECORDER_SF_sDsDZ
WPP_RECORDER_SF_sDsiLiLZ
| |paramcount|4|4| |`address`|140005988|140005ad8| |sig|undefined __fastcall FastWppTraceMessage(undefined8 param_1, undefined2 param_2, undefined8 param_3, undefined8 param_4)|undefined __fastcall FastWppTraceMessage(undefined8 param_1, undefined2 param_2, undefined8 param_3, undefined8 param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### FastWppTraceMessage Calling Diff ```diff --- FastWppTraceMessage calling +++ FastWppTraceMessage calling @@ -7,0 +8 @@ +WPP_RECORDER_SF_sDHZ ``` ## NTOSKRNL.EXE::ObReferenceObjectByHandle ### Match Info |Key|pj_7920.sys - pj_8036.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|pj_7920.sys|pj_8036.sys| | :---: | :---: | :---: | |name|ObReferenceObjectByHandle|ObReferenceObjectByHandle| |fullname|NTOSKRNL.EXE::ObReferenceObjectByHandle|NTOSKRNL.EXE::ObReferenceObjectByHandle| |`refcount`|3|4| |length|0|0| |called||| |`calling`|PrjfAttachFilterHandler
PrjfPostCleanup|PrjfAttachFilterHandler
PrjfPostCleanup
PrjfValidateHandleAccess| |paramcount|0|0| |address|EXTERNAL:0000003e|EXTERNAL:0000003e| |sig|undefined ObReferenceObjectByHandle(void)|undefined ObReferenceObjectByHandle(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::ObReferenceObjectByHandle Calling Diff ```diff --- NTOSKRNL.EXE::ObReferenceObjectByHandle calling +++ NTOSKRNL.EXE::ObReferenceObjectByHandle calling @@ -2,0 +3 @@ +PrjfValidateHandleAccess ``` Generated with `ghidriff` version: 1.0.0 on 2026-08-19T20:18:41