# pj_4202.sys-pj_8246.sys Diff
# TOC
* [Visual Chart Diff](#visual-chart-diff)
* [Metadata](#metadata)
* [Ghidra Diff Engine](#ghidra-diff-engine)
* [Command Line](#command-line)
* [Binary Metadata Diff](#binary-metadata-diff)
* [Program Options](#program-options)
* [Diff Stats](#diff-stats)
* [Strings](#strings)
* [Deleted](#deleted)
* [WppClassicProviderCallback](#wppclassicprovidercallback)
* [WppInitKm](#wppinitkm)
* [WppLoadTracingSupport](#wpploadtracingsupport)
* [WppTraceCallback](#wpptracecallback)
* [WPP_RECORDER_SF_sDZ](#wpp_recorder_sf_sdz)
* [WPP_RECORDER_SF_sDDld](#wpp_recorder_sf_sddld)
* [WPP_RECORDER_SF_sDdZDlLL](#wpp_recorder_sf_sddzdlll)
* [WPP_RECORDER_SF_sDZ_guid_Dd](#wpp_recorder_sf_sdz_guid_dd)
* [WPP_RECORDER_SF_sDdLZ](#wpp_recorder_sf_sddlz)
* [WPP_RECORDER_SF_sDdZLZ](#wpp_recorder_sf_sddzlz)
* [WPP_RECORDER_SF_sDdLLl](#wpp_recorder_sf_sddlll)
* [WPP_RECORDER_SF_sDdiiZ](#wpp_recorder_sf_sddiiz)
* [WPP_RECORDER_SF_sDiid](#wpp_recorder_sf_sdiid)
* [NTOSKRNL.EXE::WmiTraceMessageVa](#ntoskrnlexewmitracemessageva)
* [NTOSKRNL.EXE::MmLockPagableSectionByHandle](#ntoskrnlexemmlockpagablesectionbyhandle)
* [NTOSKRNL.EXE::MmLockPagableDataSection](#ntoskrnlexemmlockpagabledatasection)
* [NTOSKRNL.EXE::IoWMIRegistrationControl](#ntoskrnlexeiowmiregistrationcontrol)
* [WPPRECORDER.SYS::imp_WppRecorderReplay](#wpprecordersysimp_wpprecorderreplay)
* [NTOSKRNL.EXE::MmUnlockPagableImageSection](#ntoskrnlexemmunlockpagableimagesection)
* [Added](#added)
* [Feature_440600889__private_IsEnabledDeviceUsageNoInline](#feature_440600889__private_isenableddeviceusagenoinline)
* [Feature_440600889__private_IsEnabledFallback](#feature_440600889__private_isenabledfallback)
* [wil_details_FeatureReporting_RecordUsageInCache](#wil_details_featurereporting_recordusageincache)
* [wil_details_FeatureReporting_ReportUsageToService](#wil_details_featurereporting_reportusagetoservice)
* [wil_details_FeatureReporting_ReportUsageToServiceDirect](#wil_details_featurereporting_reportusagetoservicedirect)
* [wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState](#wil_details_featurestatecache_reevaluatecachedfeatureenabledstate)
* [wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath](#wil_details_featurestatecache_tryenabledeviceusagefastpath)
* [wil_details_IsEnabledFallback](#wil_details_isenabledfallback)
* [Feature_2428439865__private_IsEnabledDeviceUsageNoInline](#feature_2428439865__private_isenableddeviceusagenoinline)
* [Feature_2428439865__private_IsEnabledFallback](#feature_2428439865__private_isenabledfallback)
* [Feature_HydrateLargeNonCachedFiles__private_IsEnabledDeviceUsageNoInline](#feature_hydratelargenoncachedfiles__private_isenableddeviceusagenoinline)
* [Feature_HydrateLargeNonCachedFiles__private_IsEnabledFallback](#feature_hydratelargenoncachedfiles__private_isenabledfallback)
* [Feature_1083645240__private_IsEnabledDeviceUsageNoInline](#feature_1083645240__private_isenableddeviceusagenoinline)
* [Feature_1083645240__private_IsEnabledFallback](#feature_1083645240__private_isenabledfallback)
* [Feature_3303736635__private_IsEnabledDeviceUsageNoInline](#feature_3303736635__private_isenableddeviceusagenoinline)
* [Feature_3303736635__private_IsEnabledFallback](#feature_3303736635__private_isenabledfallback)
* [Feature_3411221816__private_IsEnabledDeviceUsageNoInline](#feature_3411221816__private_isenableddeviceusagenoinline)
* [Feature_3411221816__private_IsEnabledFallback](#feature_3411221816__private_isenabledfallback)
* [Feature_78846265__private_IsEnabledDeviceUsageNoInline](#feature_78846265__private_isenableddeviceusagenoinline)
* [Feature_78846265__private_IsEnabledFallback](#feature_78846265__private_isenabledfallback)
* [RtlUnicodeStringCbCopyStringN](#rtlunicodestringcbcopystringn)
* [FastWppCleanup](#fastwppcleanup)
* [FastWppPackEvent](#fastwpppackevent)
* [Feature_ModernWpp__private_IsEnabledDeviceUsageNoInline](#feature_modernwpp__private_isenableddeviceusagenoinline)
* [Feature_ModernWpp__private_IsEnabledFallback](#feature_modernwpp__private_isenabledfallback)
* [Feature_EnableTestConfigViaFilterPort__private_IsEnabledDeviceUsageNoInline](#feature_enabletestconfigviafilterport__private_isenableddeviceusagenoinline)
* [Feature_EnableTestConfigViaFilterPort__private_IsEnabledFallback](#feature_enabletestconfigviafilterport__private_isenabledfallback)
* [Feature_4243261755__private_IsEnabledDeviceUsageNoInline](#feature_4243261755__private_isenableddeviceusagenoinline)
* [Feature_4243261755__private_IsEnabledFallback](#feature_4243261755__private_isenabledfallback)
* [WPP_RECORDER_AND_TRACE_SF_sDDld](#wpp_recorder_and_trace_sf_sddld)
* [WPP_RECORDER_AND_TRACE_SF_sDZdDl](#wpp_recorder_and_trace_sf_sdzddl)
* [WPP_RECORDER_AND_TRACE_SF_sDZDDD](#wpp_recorder_and_trace_sf_sdzddd)
* [WPP_RECORDER_AND_TRACE_SF_sDZ_guid_Dd](#wpp_recorder_and_trace_sf_sdz_guid_dd)
* [WPP_RECORDER_AND_TRACE_SF_sDdLZ](#wpp_recorder_and_trace_sf_sddlz)
* [WPP_RECORDER_AND_TRACE_SF_sDdZLZ](#wpp_recorder_and_trace_sf_sddzlz)
* [WPP_RECORDER_AND_TRACE_SF_sDdLLl](#wpp_recorder_and_trace_sf_sddlll)
* [WPP_RECORDER_AND_TRACE_SF_sDDdd](#wpp_recorder_and_trace_sf_sdddd)
* [WPP_RECORDER_AND_TRACE_SF_sDHZ](#wpp_recorder_and_trace_sf_sdhz)
* [WPP_RECORDER_AND_TRACE_SF_sDid](#wpp_recorder_and_trace_sf_sdid)
* [WPP_RECORDER_AND_TRACE_SF_sDiid](#wpp_recorder_and_trace_sf_sdiid)
* [WPP_RECORDER_AND_TRACE_SF_sDiiiid](#wpp_recorder_and_trace_sf_sdiiiid)
* [PrjfPostSetRenameInformation](#prjfpostsetrenameinformation)
* [PrjfFilterCommandReplyStatus](#prjffiltercommandreplystatus)
* [PrjfValidateAndGetGlobalVolumePath](#prjfvalidateandgetglobalvolumepath)
* [PrjfValidateHandleAccess](#prjfvalidatehandleaccess)
* [NTOSKRNL.EXE::EtwWriteEx](#ntoskrnlexeetwwriteex)
* [NTOSKRNL.EXE::ExAllocatePool3](#ntoskrnlexeexallocatepool3)
* [NTOSKRNL.EXE::RtlNotifyFeatureUsage](#ntoskrnlexertlnotifyfeatureusage)
* [NTOSKRNL.EXE::SeCaptureSecurityDescriptor](#ntoskrnlexesecapturesecuritydescriptor)
* [NTOSKRNL.EXE::SeReleaseSecurityDescriptor](#ntoskrnlexesereleasesecuritydescriptor)
* [Modified](#modified)
* [PrjfAttachFilterHandler](#prjfattachfilterhandler)
* [PrjfClearAttributes](#prjfclearattributes)
* [PrjfSetConfiguration](#prjfsetconfiguration)
* [PrjfCopyStreamData](#prjfcopystreamdata)
* [PrjfInstanceSetup](#prjfinstancesetup)
* [PrjfGetContextFileObject](#prjfgetcontextfileobject)
* [PrjfDeleteFileHandler](#prjfdeletefilehandler)
* [PrjfCreateStreamContext](#prjfcreatestreamcontext)
* [PrjfPostWrite](#prjfpostwrite)
* [PrjfReleaseUnionContext](#prjfreleaseunioncontext)
* [DriverEntry](#driverentry)
* [PrjfFsctlDeleteReparsePoint](#prjffsctldeletereparsepoint)
* [PrjfRemoveTombstonesFromDirectory](#prjfremovetombstonesfromdirectory)
* [PrjfCreateTombstone](#prjfcreatetombstone)
* [PrjfSendCancelCommandInNewThread](#prjfsendcancelcommandinnewthread)
* [PrjfCreateSymbolicLink](#prjfcreatesymboliclink)
* [PrjfOpenParentPlaceHolder](#prjfopenparentplaceholder)
* [PrjfEnumerateDirectoryWithMerge](#prjfenumeratedirectorywithmerge)
* [PrjfPrepareCommandForFilePath](#prjfpreparecommandforfilepath)
* [PrjfGetInstanceFromVolumeName](#prjfgetinstancefromvolumename)
* [PrjfSetDeleteDisposition](#prjfsetdeletedisposition)
* [PrjfProcessPreRenameOrLinkInformation](#prjfprocessprerenameorlinkinformation)
* [PrjfCheckAndCancelTransactedOpen](#prjfcheckandcanceltransactedopen)
* [PrjfTelemetryPostExpansionComplete](#prjftelemetrypostexpansioncomplete)
* [PrjfCloseFileHandler](#prjfclosefilehandler)
* [PrjfMungeDirectoryEnumerateWithoutShortnameFileId64](#prjfmungedirectoryenumeratewithoutshortnamefileid64)
* [PrjfRemoveSparse](#prjfremovesparse)
* [PrjfPreSetDispositionInformation](#prjfpresetdispositioninformation)
* [PrjfProcessFileDirectoryStatus](#prjfprocessfiledirectorystatus)
* [PrjfCopyFileMetaData](#prjfcopyfilemetadata)
* [PrjfLookupEntryBackingLayerNegativePathCache](#prjflookupentrybackinglayernegativepathcache)
* [PrjfPreCleanup](#prjfprecleanup)
* [PrjfCreateMappingEntry](#prjfcreatemappingentry)
* [PrjfSendPostCreateNotifications](#prjfsendpostcreatenotifications)
* [PrjfCreateUnionContext](#prjfcreateunioncontext)
* [FastWppCallback](#fastwppcallback)
* [PrjfPostSetInformation](#prjfpostsetinformation)
* [PrjfSendEndDirectoryEnumerationCommand](#prjfsendenddirectoryenumerationcommand)
* [PrjfPostAcquireForSectionSynchronization](#prjfpostacquireforsectionsynchronization)
* [PrjfCopyFileBasicInformation](#prjfcopyfilebasicinformation)
* [PrjfSynchronizeExpansionPreopWithReason](#prjfsynchronizeexpansionpreopwithreason)
* [PrjfGetSetFileContext](#prjfgetsetfilecontext)
* [PrjfGetUnionContextByFileNameEx](#prjfgetunioncontextbyfilenameex)
* [PrjfCreateSymlinkFromPlaceholderInfoMessage](#prjfcreatesymlinkfromplaceholderinfomessage)
* [PrjfCreateFileContext](#prjfcreatefilecontext)
* [PrjfClearNegativePathCacheHandler](#prjfclearnegativepathcachehandler)
* [PrjfMungeDirectoryEnumerateWithoutShortnameFileIdAll](#prjfmungedirectoryenumeratewithoutshortnamefileidall)
* [PrjfPrepareCommandForFileObject](#prjfpreparecommandforfileobject)
* [PrjfMappingInsert](#prjfmappinginsert)
* [PrjfPostCreate](#prjfpostcreate)
* [PrjfIsNameOnPathOfRoot](#prjfisnameonpathofroot)
* [PrjfInstanceQueryTeardown](#prjfinstancequeryteardown)
* [FastWppTraceMessage](#fastwpptracemessage)
* [PrjfWriteFileDataHandler](#prjfwritefiledatahandler)
* [PrjfMungeDirectoryEnumerateWithShortname](#prjfmungedirectoryenumeratewithshortname)
* [PrjfPostQueryInformation](#prjfpostqueryinformation)
* [PrjfGetSetStreamHandleContext](#prjfgetsetstreamhandlecontext)
* [PrjfCreateRenameOrLinkCompletionContext](#prjfcreaterenameorlinkcompletioncontext)
* [PrjfPopulateFile](#prjfpopulatefile)
* [PrjfImpersonateAndAddSymlinkPrivilege](#prjfimpersonateandaddsymlinkprivilege)
* [PrjfSetPlaceHolderFlags](#prjfsetplaceholderflags)
* [PrjfPostSetDispositionInformation](#prjfpostsetdispositioninformation)
* [PrjfIsDirectoryEmpty](#prjfisdirectoryempty)
* [PrjfSendGetFileStreamCommand](#prjfsendgetfilestreamcommand)
* [PrjfMungeDirectoryEnumerateWithShortnameFileIdAll](#prjfmungedirectoryenumeratewithshortnamefileidall)
* [PrjfInitProcessInfo](#prjfinitprocessinfo)
* [PrjfGetUnionContext](#prjfgetunioncontext)
* [PrjfPreSetRenameInformation](#prjfpresetrenameinformation)
* [PrjfUnload](#prjfunload)
* [PrjfNotifyRenameOrLinkOperation](#prjfnotifyrenameorlinkoperation)
* [PrjfFsctlGetFilterFileIdentifier](#prjffsctlgetfilterfileidentifier)
* [PrjfAdvanceToNextEnumEntry](#prjfadvancetonextenumentry)
* [PrjfPopulateDestinationForRenameOrLink](#prjfpopulatedestinationforrenameorlink)
* [PrjfPortMessage](#prjfportmessage)
* [PrjfPostCleanup](#prjfpostcleanup)
* [PrjfMungeDirectoryEnumerateWithoutShortname](#prjfmungedirectoryenumeratewithoutshortname)
* [PrjfPrepareForDelete](#prjfpreparefordelete)
* [PrjfSetParentPlaceHolderFlagsSynchronized](#prjfsetparentplaceholderflagssynchronized)
* [PrjfSendQueryFileNameCommand](#prjfsendqueryfilenamecommand)
* [PrjfCreatePathTierNode](#prjfcreatepathtiernode)
* [PrjfPreCreate](#prjfprecreate)
* [PrjfProcessTombstoneBounce](#prjfprocesstombstonebounce)
* [PrjfReadFileHandler](#prjfreadfilehandler)
* [PrjfPreSetInformation](#prjfpresetinformation)
* [PrjfFsctlSetReparsePoint](#prjffsctlsetreparsepoint)
* [PrjfPrepareSourceForRename](#prjfpreparesourceforrename)
* [PrjfCreateInstanceTierNode](#prjfcreateinstancetiernode)
* [PrjfScheduleExpansionWorkItem](#prjfscheduleexpansionworkitem)
* [PrjfLaunchExpansion](#prjflaunchexpansion)
* [PrjfFsctlStartVirtualizationInstance](#prjffsctlstartvirtualizationinstance)
* [PrjfExpansionCsqCompleteCanceledIo](#prjfexpansioncsqcompletecanceledio)
* [PrjfInitCommunicationPort](#prjfinitcommunicationport)
* [PrjfValidateFilterFileIdentifierInputBuffer](#prjfvalidatefilterfileidentifierinputbuffer)
* [PrjfPrepareEnumerationContexts](#prjfprepareenumerationcontexts)
* [PrjfReopenFile](#prjfreopenfile)
* [PrjfRevertInMemoryTombstonesForDirectory](#prjfrevertinmemorytombstonesfordirectory)
* [PrjfSendCancelCommandWorker](#prjfsendcancelcommandworker)
* [PrjfGetPrjReparseData](#prjfgetprjreparsedata)
* [PrjfRelPathToFullPath](#prjfrelpathtofullpath)
* [PrjfSetUnionContext](#prjfsetunioncontext)
* [PrjfProcessPrjReparsePointBounce](#prjfprocessprjreparsepointbounce)
* [PrjfRemoveInMemoryTombstone](#prjfremoveinmemorytombstone)
* [PrjfIsFileObjectWithinActiveVirtualizationRoots](#prjfisfileobjectwithinactivevirtualizationroots)
* [PrjfPortDisconnect](#prjfportdisconnect)
* [PrjfPreDirectoryControl](#prjfpredirectorycontrol)
* [PrjfAddInMemoryTombstone](#prjfaddinmemorytombstone)
* [PrjfCreatePathTree](#prjfcreatepathtree)
* [PrjfSendGetPlaceholderInformationCommand](#prjfsendgetplaceholderinformationcommand)
* [PrjfManageHydrationOnNonCachedHandle](#prjfmanagehydrationonnoncachedhandle)
* [PrjfCleanUpRenameLinkTargetTombstone](#prjfcleanuprenamelinktargettombstone)
* [PrjfGetNotificationMask](#prjfgetnotificationmask)
* [PrjfOpenAndCheckEmptyPartialDirectory](#prjfopenandcheckemptypartialdirectory)
* [PrjfOpenAsReparsePoint](#prjfopenasreparsepoint)
* [PrjfVerifyAccessAndSetClientPortIfNeeded](#prjfverifyaccessandsetclientportifneeded)
* [PrjfDoesNameExistInLayer](#prjfdoesnameexistinlayer)
* [PrjfSetupVolumeInformationHandler](#prjfsetupvolumeinformationhandler)
* [PrjfQueryAttributes](#prjfqueryattributes)
* [PrjfSendCommand](#prjfsendcommand)
* [PrjfValidateNamesInEnumeration](#prjfvalidatenamesinenumeration)
* [PrjfSendGetDirectoryEnumerationCommand](#prjfsendgetdirectoryenumerationcommand)
* [PrjfPreSetLinkInformation](#prjfpresetlinkinformation)
* [PrjfTelemetryAndTracingInit](#prjftelemetryandtracinginit)
* [PrjfGetUnionContextByFileName](#prjfgetunioncontextbyfilename)
* [PrjfDeleteTombstoneIfExists](#prjfdeletetombstoneifexists)
* [PrjfProcessOpenWithinVirtualizationRoots](#prjfprocessopenwithinvirtualizationroots)
* [PrjfMungeDirectoryEnumerateWithShortnameFileId64](#prjfmungedirectoryenumeratewithshortnamefileid64)
* [PrjfFlushAndUpdateDiskStateWorker](#prjfflushandupdatediskstateworker)
* [PrjfCreateExpansionContext](#prjfcreateexpansioncontext)
* [PrjfTelemetryAndTracingCleanup](#prjftelemetryandtracingcleanup)
* [PrjfGetSetStreamContext](#prjfgetsetstreamcontext)
* [PrjfFindOrCreateTransactionContext](#prjffindorcreatetransactioncontext)
* [PrjfNormalizeNameComponent](#prjfnormalizenamecomponent)
* [PrjfExpandAndWait](#prjfexpandandwait)
* [PrjfSendCommandAndWaitForCompletion](#prjfsendcommandandwaitforcompletion)
* [PrjfCheckDirectoryContentReparseTags](#prjfcheckdirectorycontentreparsetags)
* [PrjfDoesRootHaveShortNameComponent](#prjfdoesroothaveshortnamecomponent)
* [PrjfFsctlSetReparsePointPostOp](#prjffsctlsetreparsepointpostop)
* [PrjfPostNetworkQueryOpen](#prjfpostnetworkqueryopen)
* [PrjfPrepareDestinationForRenameOrLink](#prjfpreparedestinationforrenameorlink)
* [PrjfMergeEnumerationResults](#prjfmergeenumerationresults)
* [PrjfOpenReparsePoint](#prjfopenreparsepoint)
* [PrjfCreateHardLink](#prjfcreatehardlink)
* [PrjfTransactionNotification](#prjftransactionnotification)
* [PrjfExpandAndPend](#prjfexpandandpend)
* [PrjfUpdatePlaceholderIfNeededHandler](#prjfupdateplaceholderifneededhandler)
* [PrjfValidateFileIdentifier](#prjfvalidatefileidentifier)
* [PrjfOpenPlaceHolder](#prjfopenplaceholder)
* [PrjfCopyAsPlaceHolder](#prjfcopyasplaceholder)
* [PrjfCompleteCommandHandler](#prjfcompletecommandhandler)
* [PrjfUntagFile](#prjfuntagfile)
* [PrjfProcessPostRenameOrLinkInformation](#prjfprocesspostrenameorlinkinformation)
* [PrjfGetUnionContextByVirtualizationInstanceInfo](#prjfgetunioncontextbyvirtualizationinstanceinfo)
* [PrjfPortConnect](#prjfportconnect)
* [PrjfGetContextFileObjectEx](#prjfgetcontextfileobjectex)
* [PrjfShouldAutoAttach](#prjfshouldautoattach)
* [PrjfSendNotifyOperationCommand](#prjfsendnotifyoperationcommand)
* [PrjfBlockFsctlOperation](#prjfblockfsctloperation)
* [PrjfExpandFile](#prjfexpandfile)
* [PrjfWritePlaceholderInformationHandler](#prjfwriteplaceholderinformationhandler)
* [PrjfAddSubContext](#prjfaddsubcontext)
* [PrjfIsZeroAllocatedRange](#prjfiszeroallocatedrange)
* [PrjfValidateNotificationRoot](#prjfvalidatenotificationroot)
* [PrjfValidatePlaceholderInformationMessage](#prjfvalidateplaceholderinformationmessage)
* [PrjfStoreNotificationMappingEntries](#prjfstorenotificationmappingentries)
* [PrjfOpenFileHandler](#prjfopenfilehandler)
* [PrjfPreWrite](#prjfprewrite)
* [PrjfGetSetContextFileObject](#prjfgetsetcontextfileobject)
* [PrjfDecideUpdateDeleteOnFileStateAndUpdateFlags](#prjfdecideupdatedeleteonfilestateandupdateflags)
* [PrjfSendStartDirectoryEnumerationCommand](#prjfsendstartdirectoryenumerationcommand)
* [WPP_RECORDER_SF_sDdZssss](#wpp_recorder_sf_sddzssss)
* [WPP_RECORDER_SF_sDdsZ](#wpp_recorder_sf_sddsz)
* [WPP_RECORDER_SF_sDdZZ](#wpp_recorder_sf_sddzz)
* [WPP_RECORDER_SF_sDsiLiLZ](#wpp_recorder_sf_sdsililz)
* [WPP_RECORDER_SF_sDddZ](#wpp_recorder_sf_sdddz)
* [WPP_RECORDER_SF_sDdLlqqq](#wpp_recorder_sf_sddllqqq)
* [WPP_RECORDER_SF_sDdZDl](#wpp_recorder_sf_sddzdl)
* [WPP_RECORDER_SF_sDqd](#wpp_recorder_sf_sdqd)
* [WPP_RECORDER_SF_sDdDZ](#wpp_recorder_sf_sdddz)
* [WPP_RECORDER_SF_sDq](#wpp_recorder_sf_sdq)
* [WPP_RECORDER_SF_sDdD](#wpp_recorder_sf_sddd)
* [WPP_RECORDER_SF_sDDDZ](#wpp_recorder_sf_sdddz)
* [WPP_RECORDER_SF_sDqZd](#wpp_recorder_sf_sdqzd)
* [WPP_RECORDER_SF_sDLLd](#wpp_recorder_sf_sdlld)
* [WPP_RECORDER_SF_sDsDZ](#wpp_recorder_sf_sdsdz)
* [WPP_RECORDER_SF_sDlLD](#wpp_recorder_sf_sdlld)
* [WPP_RECORDER_SF_sD](#wpp_recorder_sf_sd)
* [WPP_RECORDER_SF_sDd](#wpp_recorder_sf_sdd)
* [WPP_RECORDER_SF_sDdZ](#wpp_recorder_sf_sddz)
* [WPP_RECORDER_SF_sDdZ](#wpp_recorder_sf_sddz)
* [_tlgDefineProvider_annotation__Tlgmtakm_hTelemetryAssertDiagTrackProv](#_tlgdefineprovider_annotation__tlgmtakm_htelemetryassertdiagtrackprov)
* [WPP_RECORDER_SF_sDd](#wpp_recorder_sf_sdd)
* [WPP_RECORDER_SF_sDd](#wpp_recorder_sf_sdd)
* [WPP_RECORDER_SF_sDld](#wpp_recorder_sf_sdld)
* [WPP_RECORDER_SF_sDDd](#wpp_recorder_sf_sddd)
* [WPP_RECORDER_SF_sDiD](#wpp_recorder_sf_sdid)
* [WPP_RECORDER_SF_sDdPZ](#wpp_recorder_sf_sddpz)
* [WPP_RECORDER_SF_sDZDDD](#wpp_recorder_sf_sdzddd)
* [WPP_RECORDER_SF_sDZLii](#wpp_recorder_sf_sdzlii)
* [WPP_RECORDER_SF_sDZd](#wpp_recorder_sf_sdzd)
* [WPP_RECORDER_SF_sDdLL](#wpp_recorder_sf_sddll)
* [WPP_RECORDER_SF_sDdL](#wpp_recorder_sf_sddl)
* [Max Modified Section Functions Reached Error](#max-modified-section-functions-reached-error)
* [Modified (No Code Changes)](#modified-no-code-changes)
* [Section Skipped](#section-skipped)
# Visual Chart Diff
```mermaid
flowchart LR
PrjfAttachFilterHandler-1-old<--Match 79%-->PrjfAttachFilterHandler-1-new
PrjfClearAttributes-3-old<--Match 86%-->PrjfClearAttributes-3-new
PrjfSetConfiguration-1-old<--Match 86%-->PrjfSetConfiguration-1-new
PrjfCopyStreamData-6-old<--Match 92%-->PrjfCopyStreamData-6-new
PrjfInstanceSetup-4-old<--Match 53%-->PrjfInstanceSetup-4-new
PrjfGetContextFileObject-4-old<--Match 90%-->PrjfGetContextFileObject-4-new
PrjfDeleteFileHandler-4-old<--Match 39%-->PrjfDeleteFileHandler-4-new
PrjfCreateStreamContext-4-old<--Match 95%-->PrjfCreateStreamContext-4-new
PrjfPostWrite-4-old<--Match 86%-->PrjfPostWrite-4-new
PrjfReleaseUnionContext-1-old<--Match 95%-->PrjfReleaseUnionContext-1-new
DriverEntry-2-old<--Match 75%-->DriverEntry-2-new
PrjfFsctlDeleteReparsePoint-2-old<--Match 78%-->PrjfFsctlDeleteReparsePoint-2-new
PrjfRemoveTombstonesFromDirectory-2-old<--Match 96%-->PrjfRemoveTombstonesFromDirectory-2-new
PrjfCreateTombstone-3-old<--Match 93%-->PrjfCreateTombstone-3-new
PrjfSendCancelCommandInNewThread-2-old<--Match 89%-->PrjfSendCancelCommandInNewThread-2-new
PrjfCreateSymbolicLink-7-old<--Match 62%-->PrjfCreateSymbolicLink-7-new
PrjfOpenParentPlaceHolder-5-old<--Match 94%-->PrjfOpenParentPlaceHolder-5-new
PrjfEnumerateDirectoryWithMerge-10-old<--Match 84%-->PrjfEnumerateDirectoryWithMerge-10-new
PrjfPrepareCommandForFilePath-9-old<--Match 80%-->PrjfPrepareCommandForFilePath-9-new
PrjfGetInstanceFromVolumeName-2-old<--Match 59%-->PrjfGetInstanceFromVolumeName-2-new
PrjfSetDeleteDisposition-6-old<--Match 47%-->PrjfSetDeleteDisposition-6-new
PrjfProcessPreRenameOrLinkInformation-5-old<--Match 22%-->PrjfProcessPreRenameOrLinkInformation-5-new
PrjfCheckAndCancelTransactedOpen-2-old<--Match 94%-->PrjfCheckAndCancelTransactedOpen-2-new
PrjfTelemetryPostExpansionComplete-7-old<--Match 94%-->PrjfTelemetryPostExpansionComplete-7-new
PrjfCloseFileHandler-2-old<--Match 76%-->PrjfCloseFileHandler-2-new
PrjfMungeDirectoryEnumerateWithoutShortnameFileId64-8-old<--Match 97%-->PrjfMungeDirectoryEnumerateWithoutShortnameFileId64-8-new
pj_4202.sys<--205ommited-->pj_8246.sys
subgraph pj_8246.sys
PrjfAttachFilterHandler-1-new
PrjfClearAttributes-3-new
PrjfSetConfiguration-1-new
PrjfCopyStreamData-6-new
PrjfInstanceSetup-4-new
PrjfGetContextFileObject-4-new
PrjfDeleteFileHandler-4-new
PrjfCreateStreamContext-4-new
PrjfPostWrite-4-new
PrjfReleaseUnionContext-1-new
DriverEntry-2-new
PrjfFsctlDeleteReparsePoint-2-new
PrjfRemoveTombstonesFromDirectory-2-new
PrjfCreateTombstone-3-new
PrjfSendCancelCommandInNewThread-2-new
PrjfCreateSymbolicLink-7-new
PrjfOpenParentPlaceHolder-5-new
PrjfEnumerateDirectoryWithMerge-10-new
PrjfPrepareCommandForFilePath-9-new
PrjfGetInstanceFromVolumeName-2-new
PrjfSetDeleteDisposition-6-new
PrjfProcessPreRenameOrLinkInformation-5-new
PrjfCheckAndCancelTransactedOpen-2-new
PrjfTelemetryPostExpansionComplete-7-new
PrjfCloseFileHandler-2-new
PrjfMungeDirectoryEnumerateWithoutShortnameFileId64-8-new
subgraph Added
direction LR
Feature_440600889__private_IsEnabledDeviceUsageNoInline
Feature_440600889__private_IsEnabledFallback
wil_details_FeatureReporting_RecordUsageInCache
wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureReporting_ReportUsageToServiceDirect
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath
wil_details_IsEnabledFallback
Feature_2428439865__private_IsEnabledDeviceUsageNoInline
Feature_2428439865__private_IsEnabledFallback
Feature_HydrateLargeNonCachedFiles__private_IsEnabledDeviceUsageNoInline
Feature_HydrateLargeNonCachedFiles__private_IsEnabledFallback
Feature_1083645240__private_IsEnabledDeviceUsageNoInline
Feature_1083645240__private_IsEnabledFallback
Feature_3303736635__private_IsEnabledDeviceUsageNoInline
Feature_3303736635__private_IsEnabledFallback
Feature_3411221816__private_IsEnabledDeviceUsageNoInline
Feature_3411221816__private_IsEnabledFallback
Feature_78846265__private_IsEnabledDeviceUsageNoInline
Feature_78846265__private_IsEnabledFallback
RtlUnicodeStringCbCopyStringN
FastWppCleanup
FastWppPackEvent
Feature_ModernWpp__private_IsEnabledDeviceUsageNoInline
Feature_ModernWpp__private_IsEnabledFallback
Feature_EnableTestConfigViaFilterPort__private_IsEnabledDeviceUsageNoInline
Feature_EnableTestConfigViaFilterPort__private_IsEnabledFallback
25_more_added_funcs_omitted
end
end
subgraph pj_4202.sys
PrjfAttachFilterHandler-1-old
PrjfClearAttributes-3-old
PrjfSetConfiguration-1-old
PrjfCopyStreamData-6-old
PrjfInstanceSetup-4-old
PrjfGetContextFileObject-4-old
PrjfDeleteFileHandler-4-old
PrjfCreateStreamContext-4-old
PrjfPostWrite-4-old
PrjfReleaseUnionContext-1-old
DriverEntry-2-old
PrjfFsctlDeleteReparsePoint-2-old
PrjfRemoveTombstonesFromDirectory-2-old
PrjfCreateTombstone-3-old
PrjfSendCancelCommandInNewThread-2-old
PrjfCreateSymbolicLink-7-old
PrjfOpenParentPlaceHolder-5-old
PrjfEnumerateDirectoryWithMerge-10-old
PrjfPrepareCommandForFilePath-9-old
PrjfGetInstanceFromVolumeName-2-old
PrjfSetDeleteDisposition-6-old
PrjfProcessPreRenameOrLinkInformation-5-old
PrjfCheckAndCancelTransactedOpen-2-old
PrjfTelemetryPostExpansionComplete-7-old
PrjfCloseFileHandler-2-old
PrjfMungeDirectoryEnumerateWithoutShortnameFileId64-8-old
subgraph Deleted
direction LR
WppClassicProviderCallback
WppInitKm
WppLoadTracingSupport
WppTraceCallback
WPP_RECORDER_SF_sDZ
WPP_RECORDER_SF_sDDld
WPP_RECORDER_SF_sDdZDlLL
WPP_RECORDER_SF_sDZ_guid_Dd
WPP_RECORDER_SF_sDdLZ
WPP_RECORDER_SF_sDdZLZ
WPP_RECORDER_SF_sDdLLl
WPP_RECORDER_SF_sDdiiZ
WPP_RECORDER_SF_sDiid
NTOSKRNLEXE-WmiTraceMessageVa
NTOSKRNLEXE-MmLockPagableSectionByHandle
NTOSKRNLEXE-MmLockPagableDataSection
NTOSKRNLEXE-IoWMIRegistrationControl
WPPRECORDERSYS-imp_WppRecorderReplay
NTOSKRNLEXE-MmUnlockPagableImageSection
end
end
```
```mermaid
pie showData
title Function Matches - 94.6677%
"unmatched_funcs_len" : 69
"matched_funcs_len" : 1225
```
```mermaid
pie showData
title Matched Function Similarity - 79.0204%
"matched_funcs_with_code_changes_len" : 230
"matched_funcs_with_non_code_changes_len" : 27
"matched_funcs_no_changes_len" : 968
```
# Metadata
## Ghidra Diff Engine
### Command Line
#### Captured Command Line
```
ghidriff --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --bsim --max-ram-percent 60.0 --max-section-funcs 200 pj_4202.sys pj_8246.sys
```
#### Verbose Args
```
--old ['pj_4202.sys'] --new [['pj_8246.sys']] --engine VersionTrackingDiff --output-path pj2_out --summary False --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim True --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title None
```
#### Download Original PEs
```
wget https://msdl.microsoft.com/download/symbols/prjflt.sys/BBC1311145000/prjflt.sys -O prjflt.sys.x64.10.0.26100.4202
wget https://msdl.microsoft.com/download/symbols/prjflt.sys/F77DE92A4E000/prjflt.sys -O prjflt.sys.x64.10.0.26100.8246
```
## Binary Metadata Diff
```diff
--- pj_4202.sys Meta
+++ pj_8246.sys Meta
@@ -1,44 +1,44 @@
-Program Name: pj_4202.sys
+Program Name: pj_8246.sys
Language ID: x86:LE:64:default (4.6)
Compiler ID: windows
Processor: x86
Endian: Little
Address Size: 64
-Minimum Address: 1c0000000
+Minimum Address: 140000000
Maximum Address: ff0000184f
-# of Bytes: 288848
+# of Bytes: 325712
# of Memory Blocks: 15
-# of Instructions: 45743
-# of Defined Data: 2041
-# of Functions: 631
-# of Symbols: 6780
-# of Data Types: 164
+# of Instructions: 52984
+# of Defined Data: 2365
+# of Functions: 663
+# of Symbols: 7832
+# of Data Types: 166
# of Data Type Categories: 12
Analyzed: true
Compiler: visualstudio:unknown
Created With Ghidra Version: 12.0.4
-Date Created: Wed Aug 19 07:16:18 SGT 2026
+Date Created: Wed Aug 19 07:16:22 SGT 2026
Executable Format: Portable Executable (PE)
-Executable Location: /tmp/pj2/pj_4202.sys
-Executable MD5: bd5fa634ad6ab8046fae4a9af18b74cd
-Executable SHA256: ffb5ab23d8174ced2af4267efd9e94dff3ce0c337a1444e7b8d4ac66eb205de7
-FSRL: file:///tmp/pj2/pj_4202.sys?MD5=bd5fa634ad6ab8046fae4a9af18b74cd
+Executable Location: /tmp/pj2/pj_8246.sys
+Executable MD5: ee36990ce21ff8dfc575e30a2cb2c7a0
+Executable SHA256: 6eeb5961eb44704a1515a3df15bbf02ce4e63c55b46fb00158a5d65c7b4fd555
+FSRL: file:///tmp/pj2/pj_8246.sys?MD5=ee36990ce21ff8dfc575e30a2cb2c7a0
PDB Age: 1
PDB File: prjflt.pdb
-PDB GUID: 2a699467-3711-53c0-0928-a050aa633dc3
+PDB GUID: 1c872a30-e67f-093a-89a2-b423d822a551
PDB Loaded: true
PDB Version: RSDS
PE Property[CompanyName]: Microsoft Corporation
PE Property[FileDescription]: Windows Projected File System FS Filter Driver
-PE Property[FileVersion]: 10.0.26100.4202 (WinBuild.160101.0800)
+PE Property[FileVersion]: 10.0.26100.8246 (WinBuild.160101.0800)
PE Property[InternalName]: prjflt.sys
PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved.
PE Property[OriginalFilename]: prjflt.sys
PE Property[ProductName]: Microsoft(R) Windows(R) Kits
-PE Property[ProductVersion]: 10.0.26100.4202
+PE Property[ProductVersion]: 10.0.26100.8246
PE Property[Translation]: 4b00409
Preferred Root Namespace Category:
RTTI Found: false
Relocatable: true
SectionAlignment: 4096
Should Ask To Analyze: false
```
## Program Options
Ghidra pj_4202.sys Decompiler Options
|Decompiler Option|Value|
| :---: | :---: |
|Prototype Evaluation|__fastcall|
Ghidra pj_4202.sys Specification extensions Options
|Specification extensions Option|Value|
| :---: | :---: |
|FormatVersion|0|
|VersionCounter|0|
Ghidra pj_4202.sys Analyzers Options
|Analyzers Option|Value|
| :---: | :---: |
|ASCII Strings|true|
|ASCII Strings.Create Strings Containing Existing Strings|true|
|ASCII Strings.Create Strings Containing References|true|
|ASCII Strings.Force Model Reload|false|
|ASCII Strings.Minimum String Length|LEN_5|
|ASCII Strings.Model File|StringModel.sng|
|ASCII Strings.Require Null Termination for String|true|
|ASCII Strings.Search Only in Accessible Memory Blocks|true|
|ASCII Strings.String Start Alignment|ALIGN_1|
|ASCII Strings.String end alignment|4|
|Aggressive Instruction Finder|false|
|Aggressive Instruction Finder.Create Analysis Bookmarks|true|
|Apply Data Archives|true|
|Apply Data Archives.Archive Chooser|[Auto-Detect]|
|Apply Data Archives.Create Analysis Bookmarks|true|
|Apply Data Archives.GDT User File Archive Path|None|
|Apply Data Archives.User Project Archive Path|None|
|Call Convention ID|true|
|Call Convention ID.Analysis Decompiler Timeout (sec)|60|
|Call-Fixup Installer|true|
|Condense Filler Bytes|false|
|Condense Filler Bytes.Filler Value|Auto|
|Condense Filler Bytes.Minimum number of sequential bytes|1|
|Create Address Tables|true|
|Create Address Tables.Allow Offcut References|false|
|Create Address Tables.Auto Label Table|false|
|Create Address Tables.Create Analysis Bookmarks|true|
|Create Address Tables.Maxmimum Pointer Distance|16777215|
|Create Address Tables.Minimum Pointer Address|4132|
|Create Address Tables.Minimum Table Size|2|
|Create Address Tables.Pointer Alignment|1|
|Create Address Tables.Relocation Table Guide|true|
|Create Address Tables.Table Alignment|4|
|Data Reference|true|
|Data Reference.Address Table Alignment|1|
|Data Reference.Address Table Minimum Size|2|
|Data Reference.Align End of Strings|false|
|Data Reference.Ascii String References|true|
|Data Reference.Create Address Tables|true|
|Data Reference.Minimum String Length|5|
|Data Reference.References to Pointers|true|
|Data Reference.Relocation Table Guide|true|
|Data Reference.Respect Execute Flag|true|
|Data Reference.Subroutine References|true|
|Data Reference.Switch Table References|false|
|Data Reference.Unicode String References|true|
|Decompiler Parameter ID|true|
|Decompiler Parameter ID.Analysis Clear Level|ANALYSIS|
|Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60|
|Decompiler Parameter ID.Commit Data Types|true|
|Decompiler Parameter ID.Commit Void Return Values|false|
|Decompiler Parameter ID.Prototype Evaluation|__fastcall|
|Decompiler Switch Analysis|true|
|Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60|
|Demangler Microsoft|true|
|Demangler Microsoft.Apply Function Calling Conventions|true|
|Demangler Microsoft.Apply Function Signatures|true|
|Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS|
|Demangler Microsoft.Demangle Only Known Mangled Symbols|false|
|Disassemble Entry Points|true|
|Disassemble Entry Points.Respect Execute Flag|true|
|Embedded Media|true|
|Embedded Media.Create Analysis Bookmarks|true|
|External Entry References|true|
|Function ID|true|
|Function ID.Always Apply FID Labels|false|
|Function ID.Create Analysis Bookmarks|true|
|Function ID.Instruction Count Threshold|14.6|
|Function ID.Multiple Match Threshold|30.0|
|Function Start Search|true|
|Function Start Search.Bookmark Functions|false|
|Function Start Search.Search Data Blocks|false|
|Non-Returning Functions - Discovered|true|
|Non-Returning Functions - Discovered.Create Analysis Bookmarks|true|
|Non-Returning Functions - Discovered.Function Non-return Threshold|3|
|Non-Returning Functions - Discovered.Repair Flow Damage|true|
|Non-Returning Functions - Known|true|
|Non-Returning Functions - Known.Create Analysis Bookmarks|true|
|PDB MSDIA|false|
|PDB MSDIA.Search untrusted symbol servers|false|
|PDB Universal|true|
|PDB Universal.Import Source Line Info|true|
|PDB Universal.Search untrusted symbol servers|false|
|Reference|true|
|Reference.Address Table Alignment|1|
|Reference.Address Table Minimum Size|2|
|Reference.Align End of Strings|false|
|Reference.Ascii String References|true|
|Reference.Create Address Tables|true|
|Reference.Minimum String Length|5|
|Reference.References to Pointers|true|
|Reference.Relocation Table Guide|true|
|Reference.Respect Execute Flag|true|
|Reference.Subroutine References|true|
|Reference.Switch Table References|false|
|Reference.Unicode String References|true|
|Scalar Operand References|true|
|Scalar Operand References.Relocation Table Guide|true|
|Shared Return Calls|true|
|Shared Return Calls.Allow Conditional Jumps|false|
|Shared Return Calls.Assume Contiguous Functions Only|true|
|Stack|true|
|Stack.Create Local Variables|true|
|Stack.Create Param Variables|false|
|Stack.Max Threads|2|
|Subroutine References|true|
|Subroutine References.Create Thunks Early|true|
|Variadic Function Signature Override|false|
|Variadic Function Signature Override.Create Analysis Bookmarks|false|
|Windows x86 PE Exception Handling|true|
|Windows x86 PE RTTI Analyzer|true|
|Windows x86 Thread Environment Block (TEB) Analyzer|true|
|Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB||
|Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7|
|WindowsPE x86 Propagate External Parameters|false|
|WindowsResourceReference|true|
|WindowsResourceReference.Create Analysis Bookmarks|true|
|x86 Constant Reference Analyzer|true|
|x86 Constant Reference Analyzer.Create Data from pointer|false|
|x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true|
|x86 Constant Reference Analyzer.Max Threads|2|
|x86 Constant Reference Analyzer.Min absolute reference|4|
|x86 Constant Reference Analyzer.Require pointer param data type|false|
|x86 Constant Reference Analyzer.Speculative reference max|256|
|x86 Constant Reference Analyzer.Speculative reference min|1024|
|x86 Constant Reference Analyzer.Stored Value Pointer analysis|true|
|x86 Constant Reference Analyzer.Trust values read from writable memory|true|
Ghidra pj_8246.sys Decompiler Options
|Decompiler Option|Value|
| :---: | :---: |
|Prototype Evaluation|__fastcall|
Ghidra pj_8246.sys Specification extensions Options
|Specification extensions Option|Value|
| :---: | :---: |
|FormatVersion|0|
|VersionCounter|0|
Ghidra pj_8246.sys Analyzers Options
|Analyzers Option|Value|
| :---: | :---: |
|ASCII Strings|true|
|ASCII Strings.Create Strings Containing Existing Strings|true|
|ASCII Strings.Create Strings Containing References|true|
|ASCII Strings.Force Model Reload|false|
|ASCII Strings.Minimum String Length|LEN_5|
|ASCII Strings.Model File|StringModel.sng|
|ASCII Strings.Require Null Termination for String|true|
|ASCII Strings.Search Only in Accessible Memory Blocks|true|
|ASCII Strings.String Start Alignment|ALIGN_1|
|ASCII Strings.String end alignment|4|
|Aggressive Instruction Finder|false|
|Aggressive Instruction Finder.Create Analysis Bookmarks|true|
|Apply Data Archives|true|
|Apply Data Archives.Archive Chooser|[Auto-Detect]|
|Apply Data Archives.Create Analysis Bookmarks|true|
|Apply Data Archives.GDT User File Archive Path|None|
|Apply Data Archives.User Project Archive Path|None|
|Call Convention ID|true|
|Call Convention ID.Analysis Decompiler Timeout (sec)|60|
|Call-Fixup Installer|true|
|Condense Filler Bytes|false|
|Condense Filler Bytes.Filler Value|Auto|
|Condense Filler Bytes.Minimum number of sequential bytes|1|
|Create Address Tables|true|
|Create Address Tables.Allow Offcut References|false|
|Create Address Tables.Auto Label Table|false|
|Create Address Tables.Create Analysis Bookmarks|true|
|Create Address Tables.Maxmimum Pointer Distance|16777215|
|Create Address Tables.Minimum Pointer Address|4132|
|Create Address Tables.Minimum Table Size|2|
|Create Address Tables.Pointer Alignment|1|
|Create Address Tables.Relocation Table Guide|true|
|Create Address Tables.Table Alignment|4|
|Data Reference|true|
|Data Reference.Address Table Alignment|1|
|Data Reference.Address Table Minimum Size|2|
|Data Reference.Align End of Strings|false|
|Data Reference.Ascii String References|true|
|Data Reference.Create Address Tables|true|
|Data Reference.Minimum String Length|5|
|Data Reference.References to Pointers|true|
|Data Reference.Relocation Table Guide|true|
|Data Reference.Respect Execute Flag|true|
|Data Reference.Subroutine References|true|
|Data Reference.Switch Table References|false|
|Data Reference.Unicode String References|true|
|Decompiler Parameter ID|true|
|Decompiler Parameter ID.Analysis Clear Level|ANALYSIS|
|Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60|
|Decompiler Parameter ID.Commit Data Types|true|
|Decompiler Parameter ID.Commit Void Return Values|false|
|Decompiler Parameter ID.Prototype Evaluation|__fastcall|
|Decompiler Switch Analysis|true|
|Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60|
|Demangler Microsoft|true|
|Demangler Microsoft.Apply Function Calling Conventions|true|
|Demangler Microsoft.Apply Function Signatures|true|
|Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS|
|Demangler Microsoft.Demangle Only Known Mangled Symbols|false|
|Disassemble Entry Points|true|
|Disassemble Entry Points.Respect Execute Flag|true|
|Embedded Media|true|
|Embedded Media.Create Analysis Bookmarks|true|
|External Entry References|true|
|Function ID|true|
|Function ID.Always Apply FID Labels|false|
|Function ID.Create Analysis Bookmarks|true|
|Function ID.Instruction Count Threshold|14.6|
|Function ID.Multiple Match Threshold|30.0|
|Function Start Search|true|
|Function Start Search.Bookmark Functions|false|
|Function Start Search.Search Data Blocks|false|
|Non-Returning Functions - Discovered|true|
|Non-Returning Functions - Discovered.Create Analysis Bookmarks|true|
|Non-Returning Functions - Discovered.Function Non-return Threshold|3|
|Non-Returning Functions - Discovered.Repair Flow Damage|true|
|Non-Returning Functions - Known|true|
|Non-Returning Functions - Known.Create Analysis Bookmarks|true|
|PDB MSDIA|false|
|PDB MSDIA.Search untrusted symbol servers|false|
|PDB Universal|true|
|PDB Universal.Import Source Line Info|true|
|PDB Universal.Search untrusted symbol servers|false|
|Reference|true|
|Reference.Address Table Alignment|1|
|Reference.Address Table Minimum Size|2|
|Reference.Align End of Strings|false|
|Reference.Ascii String References|true|
|Reference.Create Address Tables|true|
|Reference.Minimum String Length|5|
|Reference.References to Pointers|true|
|Reference.Relocation Table Guide|true|
|Reference.Respect Execute Flag|true|
|Reference.Subroutine References|true|
|Reference.Switch Table References|false|
|Reference.Unicode String References|true|
|Scalar Operand References|true|
|Scalar Operand References.Relocation Table Guide|true|
|Shared Return Calls|true|
|Shared Return Calls.Allow Conditional Jumps|false|
|Shared Return Calls.Assume Contiguous Functions Only|true|
|Stack|true|
|Stack.Create Local Variables|true|
|Stack.Create Param Variables|false|
|Stack.Max Threads|2|
|Subroutine References|true|
|Subroutine References.Create Thunks Early|true|
|Variadic Function Signature Override|false|
|Variadic Function Signature Override.Create Analysis Bookmarks|false|
|Windows x86 PE Exception Handling|true|
|Windows x86 PE RTTI Analyzer|true|
|Windows x86 Thread Environment Block (TEB) Analyzer|true|
|Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB||
|Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7|
|WindowsPE x86 Propagate External Parameters|false|
|WindowsResourceReference|true|
|WindowsResourceReference.Create Analysis Bookmarks|true|
|x86 Constant Reference Analyzer|true|
|x86 Constant Reference Analyzer.Create Data from pointer|false|
|x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true|
|x86 Constant Reference Analyzer.Max Threads|2|
|x86 Constant Reference Analyzer.Min absolute reference|4|
|x86 Constant Reference Analyzer.Require pointer param data type|false|
|x86 Constant Reference Analyzer.Speculative reference max|256|
|x86 Constant Reference Analyzer.Speculative reference min|1024|
|x86 Constant Reference Analyzer.Stored Value Pointer analysis|true|
|x86 Constant Reference Analyzer.Trust values read from writable memory|true|
## Diff Stats
|Stat|Value|
| :---: | :---: |
|added_funcs_len|50|
|deleted_funcs_len|19|
|modified_funcs_len|257|
|added_symbols_len|133|
|deleted_symbols_len|20|
|diff_time|22.69388175010681|
|deleted_strings_len|5|
|added_strings_len|2|
|match_types|Counter({'SymbolsHash': 562, 'ExternalsName': 253, 'Implied Match': 45, 'StrUniqueFuncRefsHasher': 12, 'StringsRefsHasher': 3, 'ExactBytesFunctionHasher': 1, 'BSIM': 1})|
|items_to_process|479|
|diff_types|Counter({'address': 251, 'code': 230, 'length': 230, 'called': 175, 'sig': 94, 'name': 61, 'fullname': 61, 'refcount': 50, 'calling': 44})|
|unmatched_funcs_len|69|
|total_funcs_len|1294|
|matched_funcs_len|1225|
|matched_funcs_with_code_changes_len|230|
|matched_funcs_with_non_code_changes_len|27|
|matched_funcs_no_changes_len|968|
|match_func_similarity_percent|79.0204%|
|func_match_overall_percent|94.6677%|
|first_matches|Counter({'SymbolsHash': 562, 'Implied Match': 45, 'StrUniqueFuncRefsHasher': 12, 'StringsRefsHasher': 3, 'ExactBytesFunctionHasher': 1, 'BSIM': 1})|
```mermaid
pie showData
title All Matches
"SymbolsHash" : 562
"ExternalsName" : 253
"ExactBytesFunctionHasher" : 1
"BSIM" : 1
"StringsRefsHasher" : 3
"StrUniqueFuncRefsHasher" : 12
"Implied-Match" : 45
```
```mermaid
pie showData
title First Matches
"SymbolsHash" : 562
"ExactBytesFunctionHasher" : 1
"BSIM" : 1
"StringsRefsHasher" : 3
"StrUniqueFuncRefsHasher" : 12
"Implied-Match" : 45
```
```mermaid
pie showData
title Diff Stats
"added_funcs_len" : 50
"deleted_funcs_len" : 19
"modified_funcs_len" : 257
```
```mermaid
pie showData
title Symbols
"added_symbols_len" : 133
"deleted_symbols_len" : 20
```
## Strings
```mermaid
pie showData
title Strings
"deleted_strings_len" : 5
"added_strings_len" : 2
```
### Strings Diff
```diff
--- deleted strings
+++ added strings
@@ -1,5 +1,2 @@
-u_EtwRegisterClas
-u_EtwUnregister
-u_PsGetVersion
-u_WmiQueryTraceIn
-u_WmiTraceMessage
+u_.
+u_lobal??
```
### String References
#### Old
|String|Ref Count|Ref Func|
| :---: | :---: | :---: |
|u_EtwRegisterClas|1|WppLoadTracingSupport|
|u_EtwUnregister|1|WppLoadTracingSupport|
|u_WmiQueryTraceIn|1|WppLoadTracingSupport|
|u_PsGetVersion|1|WppLoadTracingSupport|
|u_WmiTraceMessage|1|WppLoadTracingSupport|
#### New
|String|Ref Count|Ref Func|
| :---: | :---: | :---: |
|u_.|1||
|u_lobal??_14001702c|1|PrjfValidateAndGetGlobalVolumePath|
# Deleted
## WppClassicProviderCallback
### Function Meta
|Key|pj_4202.sys|
| :---: | :---: |
|name|WppClassicProviderCallback|
|fullname|WppClassicProviderCallback|
|refcount|3|
|length|121|
|called|FastWppCallback
WPPRECORDER.SYS::imp_WppRecorderReplay|
|calling||
|paramcount|4|
|address|1c00057f0|
|sig|undefined __fastcall WppClassicProviderCallback(undefined * param_1, undefined8 param_2, undefined8 * param_3, longlong param_4)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- WppClassicProviderCallback
+++ WppClassicProviderCallback
@@ -1,30 +0,0 @@
-
-void WppClassicProviderCallback
- (undefined *param_1,undefined8 param_2,undefined8 *param_3,longlong param_4)
-
-{
- byte bVar1;
-
- bVar1 = (byte)param_2;
- if (bVar1 < 2) {
- if (bVar1 == 0) {
- *(undefined1 *)(param_4 + 0x29) = 0;
- *(undefined4 *)(param_4 + 0x2c) = 0;
- *(undefined8 *)(param_4 + 0x18) = 0;
- }
- else {
- *(undefined4 *)(param_4 + 0x2c) = *(undefined4 *)((longlong)param_3 + 4);
- *(undefined1 *)(param_4 + 0x29) = *(undefined1 *)((longlong)param_3 + 2);
- param_2 = *param_3;
- *(undefined8 *)(param_4 + 0x18) = param_2;
- param_1 = WPP_GLOBAL_Control;
- imp_WppRecorderReplay
- (WPP_GLOBAL_Control,param_2,*(undefined4 *)((longlong)param_3 + 4),
- *(undefined1 *)((longlong)param_3 + 2));
- }
- FastWppCallback(param_1,param_2,bVar1,*(undefined4 *)(param_4 + 0x2c),*(byte *)(param_4 + 0x29))
- ;
- }
- return;
-}
-
```
## WppInitKm
### Function Meta
|Key|pj_4202.sys|
| :---: | :---: |
|name|WppInitKm|
|fullname|WppInitKm|
|refcount|2|
|length|211|
|called|NTOSKRNL.EXE::IoWMIRegistrationControl
WPPRECORDER.SYS::WppAutoLogStart
_guard_dispatch_icall|
|calling|PrjfTelemetryAndTracingInit|
|paramcount|2|
|address|1c002a5d4|
|sig|undefined __fastcall WppInitKm(undefined8 param_1, undefined8 param_2)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- WppInitKm
+++ WppInitKm
@@ -1,31 +0,0 @@
-
-/* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */
-/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */
-
-void WppInitKm(undefined8 param_1,undefined8 param_2)
-
-{
- code *pcVar1;
- undefined *puVar2;
-
- if (WPP_GLOBAL_Control != &WPP_MAIN_CB) {
- WPP_GLOBAL_Control = &WPP_MAIN_CB;
- if (WPPTraceSuite == 4) {
- puVar2 = &WPP_MAIN_CB;
- do {
- pcVar1 = pfnEtwRegisterClassicProvider;
- *(undefined8 *)(puVar2 + 0x38) = 0;
- (*pcVar1)(*(undefined8 *)(puVar2 + 8),0,WppClassicProviderCallback,puVar2,puVar2 + 0x38);
- puVar2 = *(undefined **)(puVar2 + 0x10);
- } while (puVar2 != (undefined *)0x0);
- }
- else if (WPPTraceSuite == 2) {
- _WPP_MAIN_CB = WppTraceCallback;
- IoWMIRegistrationControl(&WPP_MAIN_CB,0x80010001);
- }
- WppAutoLogStart(WPP_GLOBAL_Control,param_1,param_2);
- WPP_RECORDER_INITIALIZED = &WPP_MAIN_CB;
- }
- return;
-}
-
```
## WppLoadTracingSupport
### Function Meta
|Key|pj_4202.sys|
| :---: | :---: |
|name|WppLoadTracingSupport|
|fullname|WppLoadTracingSupport|
|refcount|2|
|length|309|
|called|NTOSKRNL.EXE::MmGetSystemRoutineAddress
NTOSKRNL.EXE::RtlInitUnicodeString
_guard_dispatch_icall|
|calling|PrjfTelemetryAndTracingInit|
|paramcount|0|
|address|1c002a6b0|
|sig|undefined __fastcall WppLoadTracingSupport(void)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- WppLoadTracingSupport
+++ WppLoadTracingSupport
@@ -1,35 +0,0 @@
-
-/* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */
-
-void WppLoadTracingSupport(void)
-
-{
- uint local_res8 [8];
- undefined8 local_18;
- undefined8 uStack_10;
-
- local_res8[0] = 0;
- local_18 = 0;
- uStack_10 = 0;
- RtlInitUnicodeString(&local_18,L"PsGetVersion");
- pfnWppGetVersion = (code *)MmGetSystemRoutineAddress(&local_18);
- RtlInitUnicodeString(&local_18,L"WmiTraceMessage");
- MmGetSystemRoutineAddress(&local_18);
- RtlInitUnicodeString(&local_18,L"WmiQueryTraceInformation");
- pfnWppQueryTraceInformation = MmGetSystemRoutineAddress(&local_18);
- WPPTraceSuite = 2;
- if (pfnWppGetVersion != (code *)0x0) {
- (*pfnWppGetVersion)(local_res8,0,0,0);
- }
- if (5 < local_res8[0]) {
- RtlInitUnicodeString(&local_18,L"EtwRegisterClassicProvider");
- pfnEtwRegisterClassicProvider = MmGetSystemRoutineAddress(&local_18);
- if (pfnEtwRegisterClassicProvider != 0) {
- RtlInitUnicodeString(&local_18,L"EtwUnregister");
- pfnEtwUnregister = MmGetSystemRoutineAddress(&local_18);
- WPPTraceSuite = 4;
- }
- }
- return;
-}
-
```
## WppTraceCallback
### Function Meta
|Key|pj_4202.sys|
| :---: | :---: |
|name|WppTraceCallback|
|fullname|WppTraceCallback|
|refcount|3|
|length|674|
|called|FastWppCallback
_guard_dispatch_icall
memcpy
memset|
|calling||
|paramcount|6|
|address|1c002a7f0|
|sig|uint __fastcall WppTraceCallback(byte param_1, undefined8 param_2, uint param_3, uint * param_4, longlong param_5, uint * param_6)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- WppTraceCallback
+++ WppTraceCallback
@@ -1,143 +0,0 @@
-
-/* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */
-
-uint WppTraceCallback(byte param_1,undefined8 param_2,uint param_3,uint *param_4,longlong param_5,
- uint *param_6)
-
-{
- undefined8 uVar1;
- ushort *puVar2;
- undefined8 uVar3;
- int iVar4;
- longlong lVar5;
- uint *puVar6;
- ulonglong uVar7;
- uint *puVar8;
- uint uVar9;
- uint uVar10;
- uint uVar11;
- bool bVar12;
- undefined4 local_res8 [2];
- undefined1 uStack_36;
- undefined4 uStack_34;
-
- puVar6 = param_6;
- uVar9 = 0;
- uVar10 = 0;
- *param_6 = 0;
- if (param_1 < 6) {
- if ((param_1 == 5) ||
- ((((param_1 != 0 && (param_1 != 1)) && (param_1 != 2)) && ((param_1 != 3 && (param_1 == 4))))
- )) {
- local_res8[0] = 0;
- param_6._0_4_ = 0;
- if (param_5 != 0) {
- if (param_3 < 0x30) {
- return 0xc000000d;
- }
- uVar7 = (ulonglong)param_4[6];
- do {
- puVar6 = *(uint **)(param_5 + 8);
- if (((*puVar6 == param_4[6]) && (puVar6[1] == param_4[7])) &&
- ((puVar6[2] == param_4[8] && (puVar6[3] == param_4[9])))) break;
- param_5 = *(longlong *)(param_5 + 0x10);
- } while (param_5 != 0);
- if (param_5 != 0) {
- if (param_1 == 5) {
- *(undefined1 *)(param_5 + 0x29) = 0;
- *(undefined4 *)(param_5 + 0x2c) = 0;
- *(undefined8 *)(param_5 + 0x18) = 0;
- }
- else {
- bVar12 = WPPTraceSuite == 2;
- uVar1 = *(undefined8 *)(param_4 + 2);
- *(undefined8 *)(param_5 + 0x18) = uVar1;
- if (bVar12) {
- iVar4 = (*pfnWppQueryTraceInformation)(3,local_res8,4,¶m_6,param_4);
- if (iVar4 == 0) {
- *(undefined1 *)(param_5 + 0x29) = (undefined1)local_res8[0];
- }
- uVar7 = param_5 + 0x2c;
- puVar6 = (uint *)0x2;
- uVar10 = (*pfnWppQueryTraceInformation)(2,uVar7,4,¶m_6,param_4);
- }
- else {
- uStack_34 = (undefined4)((ulonglong)uVar1 >> 0x20);
- *(undefined4 *)(param_5 + 0x2c) = uStack_34;
- uStack_36 = (undefined1)((ulonglong)uVar1 >> 0x10);
- *(undefined1 *)(param_5 + 0x29) = uStack_36;
- }
- }
- FastWppCallback(puVar6,uVar7,param_1 != 5,*(undefined4 *)(param_5 + 0x2c),
- *(byte *)(param_5 + 0x29));
- return uVar10;
- }
- }
- return 0xc0000295;
- }
- }
- else {
- if (param_1 == 6) {
- return 0;
- }
- if (param_1 == 7) {
- return 0;
- }
- if (param_1 == 8) {
- puVar2 = *(ushort **)(param_5 + 0x20);
- lVar5 = param_5;
- do {
- lVar5 = *(longlong *)(lVar5 + 0x10);
- uVar9 = uVar9 + 1;
- } while (lVar5 != 0);
- if (0x3f < uVar9) {
- return 0xc000000d;
- }
- uVar10 = uVar9 * 0x20 + 0x18;
- if (puVar2 == (ushort *)0x0) {
- uVar11 = uVar10;
- uVar10 = 0;
- }
- else {
- uVar11 = *puVar2 + 2 + uVar10;
- }
- if (param_3 < uVar11) {
- if (3 < param_3) {
- *param_4 = uVar11;
- *param_6 = 4;
- return 0xc0000023;
- }
- return 0xc0000023;
- }
- memset(param_4,0,(ulonglong)param_3);
- *param_4 = uVar11;
- param_4[2] = uVar10;
- param_4[4] = uVar9;
- if (puVar2 != (ushort *)0x0) {
- *(ushort *)((ulonglong)uVar10 + (longlong)param_4) = *puVar2;
- memcpy((ushort *)((ulonglong)uVar10 + (longlong)param_4) + 1,*(void **)(puVar2 + 4),
- (ulonglong)*puVar2);
- }
- if (uVar9 != 0) {
- uVar7 = (ulonglong)uVar9;
- puVar8 = param_4 + 10;
- do {
- uVar1 = **(undefined8 **)(param_5 + 8);
- uVar3 = (*(undefined8 **)(param_5 + 8))[1];
- *puVar8 = 0x81000;
- *(undefined8 *)(puVar8 + -4) = uVar1;
- *(undefined8 *)(puVar8 + -2) = uVar3;
- *(undefined1 *)(param_5 + 0x29) = 0;
- *(undefined4 *)(param_5 + 0x2c) = 0;
- param_5 = *(longlong *)(param_5 + 0x10);
- uVar7 = uVar7 - 1;
- puVar8 = puVar8 + 8;
- } while (uVar7 != 0);
- }
- *puVar6 = uVar11;
- return 0;
- }
- }
- return 0xc0000010;
-}
-
```
## WPP_RECORDER_SF_sDZ
### Function Meta
|Key|pj_4202.sys|
| :---: | :---: |
|name|WPP_RECORDER_SF_sDZ|
|fullname|WPP_RECORDER_SF_sDZ|
|refcount|7|
|length|511|
|called|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|
|calling|PrjfCreateExpansionContext
PrjfDoesRootHaveShortNameComponent
PrjfExpansionCsqCompleteCanceledIo
PrjfFsctlSetReparsePoint
PrjfPreWrite
PrjfSetPlaceHolderFlags|
|paramcount|8|
|address|1c0038308|
|sig|undefined __fastcall WPP_RECORDER_SF_sDZ(undefined8 param_1, byte param_2, uint param_3, undefined2 param_4, undefined8 param_5, char * param_6, undefined8 param_7, wchar_t * param_8)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- WPP_RECORDER_SF_sDZ
+++ WPP_RECORDER_SF_sDZ
@@ -1,61 +0,0 @@
-
-void WPP_RECORDER_SF_sDZ(undefined8 param_1,byte param_2,uint param_3,undefined2 param_4,
- undefined8 param_5,char *param_6,undefined8 param_7,wchar_t *param_8)
-
-{
- wchar_t *pwVar1;
- wchar_t wVar2;
- char *pcVar3;
- longlong lVar4;
- longlong lVar5;
- wchar_t *pwVar6;
-
- pwVar1 = param_8;
- pwVar6 = L"NULL";
- wVar2 = L'\b';
- if (((*(uint *)(WPP_GLOBAL_Control +
- ((ulonglong)(param_3 - 1 >> 5 & 0x7ff) + (ulonglong)(param_3 >> 0x10) * 0x14) * 4 +
- 0x2c) >> (param_3 - 1 & 0x1f) & 1) != 0) &&
- (param_2 <= (byte)WPP_GLOBAL_Control[(ulonglong)(param_3 >> 0x10) * 0x50 + 0x29])) {
- if (param_6 == (char *)0x0) {
- lVar5 = 5;
- }
- else {
- lVar4 = -1;
- do {
- lVar5 = lVar4;
- lVar4 = lVar5 + 1;
- } while (param_6[lVar4] != '\0');
- lVar5 = lVar5 + 2;
- }
- pcVar3 = param_6;
- if (param_6 == (char *)0x0) {
- pcVar3 = "NULL";
- }
- FastWppTraceMessage(param_5,param_4,pcVar3,lVar5);
- }
- if ((pwVar1 != (wchar_t *)0x0) && (wVar2 = *pwVar1, *pwVar1 != L'\0')) {
- pwVar6 = *(wchar_t **)(pwVar1 + 4);
- }
- if (pwVar1 == (wchar_t *)0x0) {
- pwVar1 = L"\b";
- }
- lVar5 = -1;
- if (param_6 == (char *)0x0) {
- lVar4 = 5;
- }
- else {
- do {
- lVar4 = lVar5;
- lVar5 = lVar4 + 1;
- } while (param_6[lVar5] != '\0');
- lVar4 = lVar4 + 2;
- }
- if (param_6 == (char *)0x0) {
- param_6 = "NULL";
- }
- WppAutoLogTrace(param_1,param_2,param_3,param_5,param_4,param_6,lVar4,¶m_7,4,pwVar1,2,pwVar6,
- wVar2,0);
- return;
-}
-
```
## WPP_RECORDER_SF_sDDld
### Function Meta
|Key|pj_4202.sys|
| :---: | :---: |
|name|WPP_RECORDER_SF_sDDld|
|fullname|WPP_RECORDER_SF_sDDld|
|refcount|2|
|length|298|
|called|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|
|calling|PrjfPostCreate|
|paramcount|1|
|address|1c003924c|
|sig|undefined __fastcall WPP_RECORDER_SF_sDDld(undefined8 param_1)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- WPP_RECORDER_SF_sDDld
+++ WPP_RECORDER_SF_sDDld
@@ -1,18 +0,0 @@
-
-void WPP_RECORDER_SF_sDDld(undefined8 param_1)
-
-{
- undefined4 local_18 [4];
-
- local_18[0] = 0x67e;
- if (((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x10) != 0) && (1 < (byte)WPP_GLOBAL_Control[0x29]))
- {
- FastWppTraceMessage(&WPP_0b474be437163e15bbc5d557e64edfd4_Traceguids,0x25,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\create.c",0x2a);
- }
- WppAutoLogTrace(param_1,2,5,&WPP_0b474be437163e15bbc5d557e64edfd4_Traceguids,0x25,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\create.c",0x2a,local_18,4,&stack0x00000040
- ,4,&stack0x00000048,4,&stack0x00000050,4,0);
- return;
-}
-
```
## WPP_RECORDER_SF_sDdZDlLL
### Function Meta
|Key|pj_4202.sys|
| :---: | :---: |
|name|WPP_RECORDER_SF_sDdZDlLL|
|fullname|WPP_RECORDER_SF_sDdZDlLL|
|refcount|2|
|length|580|
|called|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|
|calling|PrjfPostCreate|
|paramcount|1|
|address|1c0039790|
|sig|undefined __fastcall WPP_RECORDER_SF_sDdZDlLL(undefined8 param_1)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- WPP_RECORDER_SF_sDdZDlLL
+++ WPP_RECORDER_SF_sDdZDlLL
@@ -1,33 +0,0 @@
-
-void WPP_RECORDER_SF_sDdZDlLL(undefined8 param_1)
-
-{
- wchar_t *pwVar1;
- wchar_t wVar2;
- wchar_t *in_stack_00000048;
- undefined4 local_28 [2];
- undefined4 local_20 [2];
-
- pwVar1 = L"NULL";
- local_28[0] = 0xc000ce01;
- local_20[0] = 0x787;
- wVar2 = L'\b';
- if (((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x10) != 0) && (2 < (byte)WPP_GLOBAL_Control[0x29]))
- {
- FastWppTraceMessage(&WPP_0b474be437163e15bbc5d557e64edfd4_Traceguids,0x2b,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\create.c",0x2a);
- }
- if ((in_stack_00000048 != (wchar_t *)0x0) &&
- (wVar2 = *in_stack_00000048, *in_stack_00000048 != L'\0')) {
- pwVar1 = *(wchar_t **)(in_stack_00000048 + 4);
- }
- if (in_stack_00000048 == (wchar_t *)0x0) {
- in_stack_00000048 = L"\b";
- }
- WppAutoLogTrace(param_1,3,5,&WPP_0b474be437163e15bbc5d557e64edfd4_Traceguids,0x2b,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\create.c",0x2a,local_20,4,local_28,4,
- in_stack_00000048,2,pwVar1,wVar2,&stack0x00000050,4,&stack0x00000058,4,
- &stack0x00000060,4,&stack0x00000068,4,0);
- return;
-}
-
```
## WPP_RECORDER_SF_sDZ_guid_Dd
### Function Meta
|Key|pj_4202.sys|
| :---: | :---: |
|name|WPP_RECORDER_SF_sDZ_guid_Dd|
|fullname|WPP_RECORDER_SF_sDZ_guid_Dd|
|refcount|2|
|length|527|
|called|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|
|calling|PrjfFsctlStartVirtualizationInstance|
|paramcount|1|
|address|1c003a30c|
|sig|undefined __fastcall WPP_RECORDER_SF_sDZ_guid_Dd(undefined8 param_1)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- WPP_RECORDER_SF_sDZ_guid_Dd
+++ WPP_RECORDER_SF_sDZ_guid_Dd
@@ -1,30 +0,0 @@
-
-void WPP_RECORDER_SF_sDZ_guid_Dd(undefined8 param_1)
-
-{
- wchar_t *pwVar1;
- wchar_t wVar2;
- wchar_t *in_stack_00000040;
- undefined4 local_28 [4];
-
- pwVar1 = L"NULL";
- local_28[0] = 0x32a;
- wVar2 = L'\b';
- if (((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x400) != 0) && (3 < (byte)WPP_GLOBAL_Control[0x29]))
- {
- FastWppTraceMessage(&WPP_594c3e8dc88d3460d4d40c2e57e2d4a0_Traceguids,0x27,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\fsctrl.c",0x2a);
- }
- if ((in_stack_00000040 != (wchar_t *)0x0) &&
- (wVar2 = *in_stack_00000040, *in_stack_00000040 != L'\0')) {
- pwVar1 = *(wchar_t **)(in_stack_00000040 + 4);
- }
- if (in_stack_00000040 == (wchar_t *)0x0) {
- in_stack_00000040 = L"\b";
- }
- WppAutoLogTrace(param_1,4,0xb,&WPP_594c3e8dc88d3460d4d40c2e57e2d4a0_Traceguids,0x27,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\fsctrl.c",0x2a,local_28,4,
- in_stack_00000040,2,pwVar1,wVar2);
- return;
-}
-
```
## WPP_RECORDER_SF_sDdLZ
### Function Meta
|Key|pj_4202.sys|
| :---: | :---: |
|name|WPP_RECORDER_SF_sDdLZ|
|fullname|WPP_RECORDER_SF_sDdLZ|
|refcount|3|
|length|595|
|called|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|
|calling|PrjfFsctlSetReparsePoint
PrjfPrepareCommandForFileObject|
|paramcount|6|
|address|1c003a524|
|sig|undefined __fastcall WPP_RECORDER_SF_sDdLZ(undefined8 param_1, undefined8 param_2, uint param_3, undefined2 param_4, undefined8 param_5, char * param_6)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- WPP_RECORDER_SF_sDdLZ
+++ WPP_RECORDER_SF_sDdLZ
@@ -1,62 +0,0 @@
-
-void WPP_RECORDER_SF_sDdLZ
- (undefined8 param_1,undefined8 param_2,uint param_3,undefined2 param_4,
- undefined8 param_5,char *param_6)
-
-{
- wchar_t wVar1;
- char *pcVar2;
- longlong lVar3;
- longlong lVar4;
- wchar_t *pwVar5;
- wchar_t *in_stack_00000050;
-
- pwVar5 = L"NULL";
- wVar1 = L'\b';
- if (((*(uint *)(WPP_GLOBAL_Control +
- ((ulonglong)(param_3 - 1 >> 5 & 0x7ff) + (ulonglong)(param_3 >> 0x10) * 0x14) * 4 +
- 0x2c) >> (param_3 - 1 & 0x1f) & 1) != 0) &&
- (1 < (byte)WPP_GLOBAL_Control[(ulonglong)(param_3 >> 0x10) * 0x50 + 0x29])) {
- if (param_6 == (char *)0x0) {
- lVar4 = 5;
- }
- else {
- lVar3 = -1;
- do {
- lVar4 = lVar3;
- lVar3 = lVar4 + 1;
- } while (param_6[lVar3] != '\0');
- lVar4 = lVar4 + 2;
- }
- pcVar2 = param_6;
- if (param_6 == (char *)0x0) {
- pcVar2 = "NULL";
- }
- FastWppTraceMessage(param_5,param_4,pcVar2,lVar4);
- }
- if ((in_stack_00000050 != (wchar_t *)0x0) &&
- (wVar1 = *in_stack_00000050, *in_stack_00000050 != L'\0')) {
- pwVar5 = *(wchar_t **)(in_stack_00000050 + 4);
- }
- if (in_stack_00000050 == (wchar_t *)0x0) {
- in_stack_00000050 = L"\b";
- }
- lVar4 = -1;
- if (param_6 == (char *)0x0) {
- lVar3 = 5;
- }
- else {
- do {
- lVar3 = lVar4;
- lVar4 = lVar3 + 1;
- } while (param_6[lVar4] != '\0');
- lVar3 = lVar3 + 2;
- }
- if (param_6 == (char *)0x0) {
- param_6 = "NULL";
- }
- WppAutoLogTrace(param_1,2,param_3,param_5,param_4,param_6,lVar3,&stack0x00000038,4,
- &stack0x00000040,4,&stack0x00000048,4,in_stack_00000050,2,pwVar5,wVar1,0);
- return;
-}
-
```
## WPP_RECORDER_SF_sDdZLZ
### Function Meta
|Key|pj_4202.sys|
| :---: | :---: |
|name|WPP_RECORDER_SF_sDdZLZ|
|fullname|WPP_RECORDER_SF_sDdZLZ|
|refcount|2|
|length|622|
|called|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|
|calling|PrjfFsctlStartVirtualizationInstance|
|paramcount|1|
|address|1c003a780|
|sig|undefined __fastcall WPP_RECORDER_SF_sDdZLZ(undefined8 param_1)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- WPP_RECORDER_SF_sDdZLZ
+++ WPP_RECORDER_SF_sDdZLZ
@@ -1,47 +0,0 @@
-
-void WPP_RECORDER_SF_sDdZLZ(undefined8 param_1)
-
-{
- wchar_t wVar1;
- wchar_t *pwVar2;
- wchar_t *pwVar3;
- wchar_t wVar4;
- wchar_t *in_stack_00000048;
- wchar_t *in_stack_00000058;
- undefined4 local_38 [2];
- undefined4 local_30 [2];
-
- pwVar3 = L"NULL";
- local_38[0] = 0xc000ce05;
- local_30[0] = 0x2ea;
- wVar4 = L'\b';
- if (((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x40) != 0) && (3 < (byte)WPP_GLOBAL_Control[0x29]))
- {
- FastWppTraceMessage(&WPP_594c3e8dc88d3460d4d40c2e57e2d4a0_Traceguids,0x23,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\fsctrl.c",0x2a);
- }
- wVar1 = wVar4;
- if ((in_stack_00000058 == (wchar_t *)0x0) ||
- (wVar1 = *in_stack_00000058, *in_stack_00000058 == L'\0')) {
- pwVar2 = L"NULL";
- }
- else {
- pwVar2 = *(wchar_t **)(in_stack_00000058 + 4);
- }
- if (in_stack_00000058 == (wchar_t *)0x0) {
- in_stack_00000058 = L"\b";
- }
- if ((in_stack_00000048 != (wchar_t *)0x0) &&
- (wVar4 = *in_stack_00000048, *in_stack_00000048 != L'\0')) {
- pwVar3 = *(wchar_t **)(in_stack_00000048 + 4);
- }
- if (in_stack_00000048 == (wchar_t *)0x0) {
- in_stack_00000048 = L"\b";
- }
- WppAutoLogTrace(param_1,4,7,&WPP_594c3e8dc88d3460d4d40c2e57e2d4a0_Traceguids,0x23,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\fsctrl.c",0x2a,local_30,4,local_38,4,
- in_stack_00000048,2,pwVar3,wVar4,&stack0x00000050,4,in_stack_00000058,2,pwVar2,
- wVar1,0);
- return;
-}
-
```
## WPP_RECORDER_SF_sDdLLl
### Function Meta
|Key|pj_4202.sys|
| :---: | :---: |
|name|WPP_RECORDER_SF_sDdLLl|
|fullname|WPP_RECORDER_SF_sDdLLl|
|refcount|2|
|length|337|
|called|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|
|calling|PrjfSendCommandAndWaitForCompletion|
|paramcount|1|
|address|1c003b6dc|
|sig|undefined __fastcall WPP_RECORDER_SF_sDdLLl(undefined8 param_1)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- WPP_RECORDER_SF_sDdLLl
+++ WPP_RECORDER_SF_sDdLLl
@@ -1,18 +0,0 @@
-
-void WPP_RECORDER_SF_sDdLLl(undefined8 param_1)
-
-{
- undefined4 local_18 [4];
-
- local_18[0] = 0xd9b;
- if (((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x2000) != 0) && (2 < (byte)WPP_GLOBAL_Control[0x29])
- ) {
- FastWppTraceMessage(&WPP_3ccab5108a9538d17a865fde27ef339f_Traceguids,0x7e,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c",0x2b);
- }
- WppAutoLogTrace(param_1,3,0xe,&WPP_3ccab5108a9538d17a865fde27ef339f_Traceguids,0x7e,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c",0x2b,local_18,4,
- &stack0x00000040,4,&stack0x00000048,4,&stack0x00000050,4,&stack0x00000058,4,0);
- return;
-}
-
```
## WPP_RECORDER_SF_sDdiiZ
### Function Meta
|Key|pj_4202.sys|
| :---: | :---: |
|name|WPP_RECORDER_SF_sDdiiZ|
|fullname|WPP_RECORDER_SF_sDdiiZ|
|refcount|2|
|length|515|
|called|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|
|calling|PrjfWriteFileDataHandler|
|paramcount|1|
|address|1c003bd94|
|sig|undefined __fastcall WPP_RECORDER_SF_sDdiiZ(undefined8 param_1)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- WPP_RECORDER_SF_sDdiiZ
+++ WPP_RECORDER_SF_sDdiiZ
@@ -1,31 +0,0 @@
-
-void WPP_RECORDER_SF_sDdiiZ(undefined8 param_1)
-
-{
- wchar_t wVar1;
- wchar_t *pwVar2;
- wchar_t *in_stack_00000058;
- undefined4 local_28 [4];
-
- pwVar2 = L"NULL";
- local_28[0] = 0x5c4;
- wVar1 = L'\b';
- if (((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x2000) != 0) && (1 < (byte)WPP_GLOBAL_Control[0x29])
- ) {
- FastWppTraceMessage(&WPP_3ccab5108a9538d17a865fde27ef339f_Traceguids,0x37,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c",0x2b);
- }
- if ((in_stack_00000058 != (wchar_t *)0x0) &&
- (wVar1 = *in_stack_00000058, *in_stack_00000058 != L'\0')) {
- pwVar2 = *(wchar_t **)(in_stack_00000058 + 4);
- }
- if (in_stack_00000058 == (wchar_t *)0x0) {
- in_stack_00000058 = L"\b";
- }
- WppAutoLogTrace(param_1,2,0xe,&WPP_3ccab5108a9538d17a865fde27ef339f_Traceguids,0x37,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c",0x2b,local_28,4,
- &stack0x00000040,4,&stack0x00000048,8,&stack0x00000050,8,in_stack_00000058,2,
- pwVar2,wVar1,0);
- return;
-}
-
```
## WPP_RECORDER_SF_sDiid
### Function Meta
|Key|pj_4202.sys|
| :---: | :---: |
|name|WPP_RECORDER_SF_sDiid|
|fullname|WPP_RECORDER_SF_sDiid|
|refcount|2|
|length|304|
|called|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|
|calling|PrjfManageHydrationOnNonCachedHandle|
|paramcount|4|
|address|1c003da04|
|sig|undefined __fastcall WPP_RECORDER_SF_sDiid(undefined8 param_1, undefined8 param_2, undefined8 param_3, undefined2 param_4)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- WPP_RECORDER_SF_sDiid
+++ WPP_RECORDER_SF_sDiid
@@ -1,16 +0,0 @@
-
-void WPP_RECORDER_SF_sDiid
- (undefined8 param_1,undefined8 param_2,undefined8 param_3,undefined2 param_4)
-
-{
- if (((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x2000) != 0) && (1 < (byte)WPP_GLOBAL_Control[0x29])
- ) {
- FastWppTraceMessage(&WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,param_4,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",0x29);
- }
- WppAutoLogTrace(param_1,2,0xe,&WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,param_4,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",0x29,&stack0x00000038,4,
- &stack0x00000040,8,&stack0x00000048,8,&stack0x00000050,4,0);
- return;
-}
-
```
## NTOSKRNL.EXE::WmiTraceMessageVa
### Function Meta
|Key|pj_4202.sys|
| :---: | :---: |
|name|WmiTraceMessageVa|
|fullname|NTOSKRNL.EXE::WmiTraceMessageVa|
|refcount|2|
|length|0|
|called||
|calling|FastWppTraceMessage|
|paramcount|0|
|address|EXTERNAL:00000037|
|sig|undefined WmiTraceMessageVa(void)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|True|
*No code available for NTOSKRNL.EXE::WmiTraceMessageVa*
## NTOSKRNL.EXE::MmLockPagableSectionByHandle
### Function Meta
|Key|pj_4202.sys|
| :---: | :---: |
|name|MmLockPagableSectionByHandle|
|fullname|NTOSKRNL.EXE::MmLockPagableSectionByHandle|
|refcount|2|
|length|0|
|called||
|calling|FastWppCallback|
|paramcount|0|
|address|EXTERNAL:00000039|
|sig|undefined MmLockPagableSectionByHandle(void)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|True|
*No code available for NTOSKRNL.EXE::MmLockPagableSectionByHandle*
## NTOSKRNL.EXE::MmLockPagableDataSection
### Function Meta
|Key|pj_4202.sys|
| :---: | :---: |
|name|MmLockPagableDataSection|
|fullname|NTOSKRNL.EXE::MmLockPagableDataSection|
|refcount|2|
|length|0|
|called||
|calling|FastWppCallback|
|paramcount|0|
|address|EXTERNAL:0000003a|
|sig|undefined MmLockPagableDataSection(void)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|True|
*No code available for NTOSKRNL.EXE::MmLockPagableDataSection*
## NTOSKRNL.EXE::IoWMIRegistrationControl
### Function Meta
|Key|pj_4202.sys|
| :---: | :---: |
|name|IoWMIRegistrationControl|
|fullname|NTOSKRNL.EXE::IoWMIRegistrationControl|
|refcount|3|
|length|0|
|called||
|calling|PrjfTelemetryAndTracingCleanup
WppInitKm|
|paramcount|0|
|address|EXTERNAL:0000003b|
|sig|undefined IoWMIRegistrationControl(void)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|True|
*No code available for NTOSKRNL.EXE::IoWMIRegistrationControl*
## WPPRECORDER.SYS::imp_WppRecorderReplay
### Function Meta
|Key|pj_4202.sys|
| :---: | :---: |
|name|imp_WppRecorderReplay|
|fullname|WPPRECORDER.SYS::imp_WppRecorderReplay|
|refcount|2|
|length|0|
|called||
|calling|WppClassicProviderCallback|
|paramcount|0|
|address|EXTERNAL:0000009d|
|sig|undefined imp_WppRecorderReplay(void)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|True|
*No code available for WPPRECORDER.SYS::imp_WppRecorderReplay*
## NTOSKRNL.EXE::MmUnlockPagableImageSection
### Function Meta
|Key|pj_4202.sys|
| :---: | :---: |
|name|MmUnlockPagableImageSection|
|fullname|NTOSKRNL.EXE::MmUnlockPagableImageSection|
|refcount|3|
|length|0|
|called||
|calling|FastWppCallback
PrjfTelemetryAndTracingInit|
|paramcount|0|
|address|EXTERNAL:00000038|
|sig|undefined MmUnlockPagableImageSection(void)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|True|
*No code available for NTOSKRNL.EXE::MmUnlockPagableImageSection*
# Added
## Feature_440600889__private_IsEnabledDeviceUsageNoInline
### Function Meta
|Key|pj_8246.sys|
| :---: | :---: |
|name|Feature_440600889__private_IsEnabledDeviceUsageNoInline|
|fullname|Feature_440600889__private_IsEnabledDeviceUsageNoInline|
|refcount|2|
|length|49|
|called|Feature_440600889__private_IsEnabledFallback|
|calling|PrjfCreateUnionContext|
|paramcount|0|
|address|140001520|
|sig|ulonglong __fastcall Feature_440600889__private_IsEnabledDeviceUsageNoInline(void)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- Feature_440600889__private_IsEnabledDeviceUsageNoInline
+++ Feature_440600889__private_IsEnabledDeviceUsageNoInline
@@ -0,0 +1,17 @@
+
+ulonglong Feature_440600889__private_IsEnabledDeviceUsageNoInline(void)
+
+{
+ ulonglong uVar1;
+ undefined8 local_res8;
+
+ local_res8 = (ulonglong)Feature_440600889__private_featureState;
+ if ((Feature_440600889__private_featureState & 0x10) == 0) {
+ uVar1 = Feature_440600889__private_IsEnabledFallback(local_res8,3);
+ }
+ else {
+ uVar1 = (ulonglong)(Feature_440600889__private_featureState & 1);
+ }
+ return uVar1;
+}
+
```
## Feature_440600889__private_IsEnabledFallback
### Function Meta
|Key|pj_8246.sys|
| :---: | :---: |
|name|Feature_440600889__private_IsEnabledFallback|
|fullname|Feature_440600889__private_IsEnabledFallback|
|refcount|2|
|length|21|
|called|wil_details_IsEnabledFallback|
|calling|Feature_440600889__private_IsEnabledDeviceUsageNoInline|
|paramcount|2|
|address|140001558|
|sig|undefined __fastcall Feature_440600889__private_IsEnabledFallback(ulonglong param_1, int param_2)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- Feature_440600889__private_IsEnabledFallback
+++ Feature_440600889__private_IsEnabledFallback
@@ -0,0 +1,8 @@
+
+void Feature_440600889__private_IsEnabledFallback(ulonglong param_1,int param_2)
+
+{
+ wil_details_IsEnabledFallback(param_1,param_2,&Feature_440600889__private_descriptor);
+ return;
+}
+
```
## wil_details_FeatureReporting_RecordUsageInCache
### Function Meta
|Key|pj_8246.sys|
| :---: | :---: |
|name|wil_details_FeatureReporting_RecordUsageInCache|
|fullname|wil_details_FeatureReporting_RecordUsageInCache|
|refcount|2|
|length|748|
|called||
|calling|wil_details_FeatureReporting_ReportUsageToServiceDirect|
|paramcount|4|
|address|140004000|
|sig|uint * __fastcall wil_details_FeatureReporting_RecordUsageInCache(uint * param_1, uint * param_2, uint param_3, uint param_4)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- wil_details_FeatureReporting_RecordUsageInCache
+++ wil_details_FeatureReporting_RecordUsageInCache
@@ -0,0 +1,175 @@
+
+uint * wil_details_FeatureReporting_RecordUsageInCache
+ (uint *param_1,uint *param_2,uint param_3,uint param_4)
+
+{
+ uint uVar1;
+ uint uVar2;
+ uint uVar3;
+ uint uVar4;
+ uint uVar5;
+ bool bVar6;
+
+ param_1[0] = 0;
+ param_1[1] = 0;
+ param_1[2] = 0;
+ param_1[3] = 0;
+ param_1[4] = 0;
+ param_1[5] = 0;
+ if (param_3 == 0) {
+LAB_140004209:
+ uVar4 = *param_2;
+ do {
+ uVar3 = uVar4;
+ param_1[1] = 0;
+ uVar2 = uVar3 | 1;
+ if ((uVar3 >> 0xe & 1) != (uint)(param_3 == 4)) {
+ uVar4 = uVar3 >> 5 & 0x1ff;
+ if (uVar4 != 0) {
+ param_1[1] = uVar4;
+ param_1[2] = ~-(uint)(param_3 != 0) & 4;
+ uVar2 = uVar3 & 0xffffc01f | 1;
+ }
+ uVar4 = 0;
+ if (param_3 == 4) {
+ uVar4 = 0x4000;
+ }
+ uVar2 = uVar4 | uVar2 & 0xffffbfff;
+ }
+ uVar4 = uVar2 >> 5 & 0x1ff;
+ uVar5 = uVar4 + 1;
+ if ((0x1ff < uVar5) || (uVar5 < uVar4)) {
+ param_1[2] = param_3;
+ param_1[1] = uVar4;
+ uVar5 = 1;
+ }
+ LOCK();
+ uVar4 = *param_2;
+ bVar6 = uVar3 == uVar4;
+ if (bVar6) {
+ *param_2 = (uVar5 << 5 ^ uVar2) & 0x3fe0 ^ uVar2;
+ uVar4 = uVar3;
+ }
+ UNLOCK();
+ } while (!bVar6);
+ *param_1 = ~uVar3 & 1;
+ }
+ else {
+ if (param_3 != 1) {
+ if ((param_3 == 2) || (param_3 == 3)) {
+LAB_1400040db:
+ uVar4 = 0;
+ if (param_3 == 2) {
+ uVar4 = 2;
+ }
+ else if (param_3 == 3) {
+ uVar4 = 8;
+ }
+ else if (param_3 == 6) {
+ uVar4 = 4;
+ }
+ else if (param_3 == 7) {
+ uVar4 = 0x10;
+ }
+ uVar3 = 1;
+ uVar2 = *param_2;
+ do {
+ uVar1 = uVar2;
+ uVar2 = uVar4 | uVar1;
+ param_1[4] = (uint)(uVar2 == uVar1);
+ uVar5 = uVar2 | 1;
+ if (uVar2 == uVar1) {
+ uVar5 = uVar2;
+ }
+ LOCK();
+ uVar2 = *param_2;
+ bVar6 = uVar1 == uVar2;
+ if (bVar6) {
+ *param_2 = uVar5;
+ uVar2 = uVar1;
+ }
+ UNLOCK();
+ } while (!bVar6);
+ if (((uVar5 & 1) == 0) || ((uVar1 & 1) != 0)) {
+ uVar3 = 0;
+ }
+ *param_1 = uVar3;
+ return param_1;
+ }
+ if (param_3 == 4) goto LAB_140004209;
+ if (param_3 != 5) {
+ if ((param_3 != 6) && (param_3 != 7)) {
+ uVar4 = param_3 - 0x140;
+ if ((int)uVar4 < 0x40) {
+ uVar2 = param_2[1];
+ do {
+ if (((uVar2 & 0x10) == 0) || (uVar3 = 1, (uVar2 >> 5 & 0x3f) != uVar4)) {
+ uVar3 = 0;
+ }
+ param_1[4] = uVar3;
+ LOCK();
+ uVar3 = param_2[1];
+ bVar6 = uVar2 == uVar3;
+ if (bVar6) {
+ param_2[1] = (uVar4 * 0x20 ^ uVar2) & 0x7e0 ^ uVar2 | 0x10;
+ uVar3 = uVar2;
+ }
+ uVar2 = uVar3;
+ UNLOCK();
+ } while (!bVar6);
+ if (param_1[4] != 0) {
+ return param_1;
+ }
+ }
+ param_1[2] = param_3;
+ param_1[1] = 1;
+ param_1[3] = param_4;
+ return param_1;
+ }
+ goto LAB_1400040db;
+ }
+ }
+ uVar4 = *param_2;
+ do {
+ uVar3 = uVar4;
+ param_1[1] = 0;
+ uVar2 = uVar3 | 1;
+ if ((uVar3 & 0x400000) >> 0x16 != (uint)(param_3 == 5)) {
+ uVar4 = (uVar3 & 0x3f8000) >> 0xf;
+ if (uVar4 != 0) {
+ param_1[1] = uVar4;
+ uVar4 = 5;
+ if (param_3 != 1) {
+ uVar4 = 1;
+ }
+ uVar2 = uVar3 & 0xffc07fff | 1;
+ param_1[2] = uVar4;
+ }
+ uVar4 = 0;
+ if (param_3 == 5) {
+ uVar4 = 0x400000;
+ }
+ uVar2 = uVar4 | uVar2 & 0xffbfffff;
+ }
+ uVar4 = uVar2 >> 0xf & 0x7f;
+ uVar5 = uVar4 + 1;
+ if ((0x7f < uVar5) || (uVar5 < uVar4)) {
+ uVar5 = 1;
+ param_1[2] = param_3;
+ param_1[1] = uVar4;
+ }
+ LOCK();
+ uVar4 = *param_2;
+ bVar6 = uVar3 == uVar4;
+ if (bVar6) {
+ *param_2 = (uVar5 << 0xf ^ uVar2) & 0x3f8000 ^ uVar2;
+ uVar4 = uVar3;
+ }
+ UNLOCK();
+ } while (!bVar6);
+ *param_1 = ~uVar3 & 1;
+ }
+ param_1[4] = 0;
+ return param_1;
+}
+
```
## wil_details_FeatureReporting_ReportUsageToService
### Function Meta
|Key|pj_8246.sys|
| :---: | :---: |
|name|wil_details_FeatureReporting_ReportUsageToService|
|fullname|wil_details_FeatureReporting_ReportUsageToService|
|refcount|2|
|length|289|
|called|_guard_dispatch_icall
wil_details_FeatureReporting_ReportUsageToServiceDirect|
|calling|wil_details_IsEnabledFallback|
|paramcount|3|
|address|1400042f4|
|sig|undefined __fastcall wil_details_FeatureReporting_ReportUsageToService(longlong param_1, ulonglong param_2, int param_3)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- wil_details_FeatureReporting_ReportUsageToService
+++ wil_details_FeatureReporting_ReportUsageToService
@@ -0,0 +1,59 @@
+
+/* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */
+
+void wil_details_FeatureReporting_ReportUsageToService
+ (longlong param_1,ulonglong param_2,int param_3)
+
+{
+ bool bVar1;
+ undefined7 extraout_var;
+ uint uVar2;
+ uint uVar3;
+ byte bVar4;
+ int local_res18 [4];
+
+ uVar2 = (uint)param_2 & 1;
+ if (param_3 != 0) {
+ if (param_3 == 1) {
+ uVar3 = (uVar2 ^ 1) << 2;
+ goto LAB_1400043c5;
+ }
+ if (param_3 == 2) {
+ uVar3 = (uVar2 ^ 1) * 4 + 1;
+ goto LAB_1400043c5;
+ }
+ if (param_3 == 3) {
+ uVar3 = (uVar2 ^ 1) * 4 + 2;
+ goto LAB_1400043c5;
+ }
+ if (param_3 == 4) {
+ uVar3 = (uVar2 ^ 1) * 4 + 3;
+ goto LAB_1400043c5;
+ }
+ if (param_3 == 5) {
+ uVar3 = (uVar2 ^ 1) * 2 + 8;
+ goto LAB_1400043c5;
+ }
+ if (param_3 == 6) {
+ uVar3 = (uVar2 ^ 1) * 2 + 9;
+ goto LAB_1400043c5;
+ }
+ bVar4 = (char)param_3 + 0x9c;
+ if (bVar4 < 0x32) {
+ uVar3 = (-(uint)((param_2 & 1) != 0) & 0xffffffce) + 0x96 + (uint)bVar4;
+ goto LAB_1400043c5;
+ }
+ }
+ uVar3 = 0xff;
+LAB_1400043c5:
+ local_res18[0] = param_3;
+ bVar1 = wil_details_FeatureReporting_ReportUsageToServiceDirect(param_1,param_2,uVar3);
+ if (((int)CONCAT71(extraout_var,bVar1) != 0) &&
+ (g_wil_details_pfnFeatureLoggingHook != (code *)0x0)) {
+ (*g_wil_details_pfnFeatureLoggingHook)
+ (*(undefined4 *)(param_1 + 0x18),*(undefined8 *)(param_1 + 0x10),0,uVar2,local_res18,0
+ ,0,1);
+ }
+ return;
+}
+
```
## wil_details_FeatureReporting_ReportUsageToServiceDirect
### Function Meta
|Key|pj_8246.sys|
| :---: | :---: |
|name|wil_details_FeatureReporting_ReportUsageToServiceDirect|
|fullname|wil_details_FeatureReporting_ReportUsageToServiceDirect|
|refcount|2|
|length|232|
|called|NTOSKRNL.EXE::RtlNotifyFeatureUsage
__security_check_cookie
_guard_dispatch_icall
wil_details_FeatureReporting_RecordUsageInCache|
|calling|wil_details_FeatureReporting_ReportUsageToService|
|paramcount|3|
|address|14000441c|
|sig|bool __fastcall wil_details_FeatureReporting_ReportUsageToServiceDirect(longlong param_1, undefined8 param_2, uint param_3)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- wil_details_FeatureReporting_ReportUsageToServiceDirect
+++ wil_details_FeatureReporting_ReportUsageToServiceDirect
@@ -0,0 +1,46 @@
+
+/* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */
+/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
+
+bool wil_details_FeatureReporting_ReportUsageToServiceDirect
+ (longlong param_1,undefined8 param_2,uint param_3)
+
+{
+ uint6 uVar1;
+ uint *puVar2;
+ undefined1 auStack_98 [32];
+ uint *local_78;
+ undefined8 local_68;
+ uint local_60 [6];
+ uint local_48;
+ uint uStack_44;
+ uint uStack_40;
+ uint uStack_3c;
+ undefined8 local_38;
+ ulonglong local_30;
+
+ local_30 = __security_cookie ^ (ulonglong)auStack_98;
+ puVar2 = wil_details_FeatureReporting_RecordUsageInCache
+ (local_60,*(uint **)(param_1 + 8),param_3,(uint)((ulonglong)param_2 >> 0x20));
+ local_48 = *puVar2;
+ uStack_44 = puVar2[1];
+ uStack_40 = puVar2[2];
+ uStack_3c = puVar2[3];
+ local_38 = *(undefined8 *)(puVar2 + 4);
+ if (g_wil_details_recordFeatureUsage != (code *)0x0) {
+ local_78 = &local_48;
+ (*g_wil_details_recordFeatureUsage)
+ (*(undefined4 *)(param_1 + 0x18),param_3,1,*(undefined8 *)(param_1 + 8));
+ }
+ if ((((uint)param_2 >> 10 & 1) != 0) && (param_3 != 0xfe)) {
+ local_68._0_6_ = CONCAT24((short)param_3,*(undefined4 *)(param_1 + 0x18));
+ uVar1 = (uint6)local_68;
+ local_68 = (ulonglong)(uint6)local_68;
+ if (((uint)param_2 >> 0xb & 1) != 0) {
+ local_68 = CONCAT26(1,uVar1);
+ }
+ RtlNotifyFeatureUsage(&local_68);
+ }
+ return (int)local_38 == 0;
+}
+
```
## wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
### Function Meta
|Key|pj_8246.sys|
| :---: | :---: |
|name|wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState|
|fullname|wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState|
|refcount|3|
|length|612|
|called|NTOSKRNL.EXE::RtlQueryFeatureConfiguration
__security_check_cookie
_guard_dispatch_icall
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState|
|calling|wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_IsEnabledFallback|
|paramcount|3|
|address|14000450c|
|sig|ulonglong __fastcall wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState(uint * param_1, ulonglong param_2, longlong param_3)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
+++ wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
@@ -0,0 +1,151 @@
+
+/* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */
+/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
+
+ulonglong wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
+ (uint *param_1,ulonglong param_2,longlong param_3)
+
+{
+ undefined8 *puVar1;
+ int iVar2;
+ int iVar3;
+ uint uVar4;
+ uint uVar5;
+ uint uVar6;
+ ulonglong uVar7;
+ uint uVar8;
+ uint uVar9;
+ ulonglong uVar10;
+ longlong *plVar11;
+ uint uVar12;
+ bool bVar13;
+ undefined1 auStack_a8 [32];
+ undefined8 local_88;
+ ulonglong local_80;
+ undefined8 local_78;
+ undefined8 local_70;
+ undefined8 uStack_68;
+ undefined8 local_60;
+ undefined8 local_58;
+ undefined4 local_50;
+ ulonglong local_48;
+
+ local_48 = __security_cookie ^ (ulonglong)auStack_a8;
+ iVar2 = 0;
+ local_88 = param_2;
+ if (g_wil_details_ensureSubscribedToFeatureConfigurationChanges != (code *)0x0) {
+ iVar2 = (*g_wil_details_ensureSubscribedToFeatureConfigurationChanges)();
+ }
+ local_70 = 0;
+ uStack_68 = 0;
+ uVar12 = 1;
+ local_78 = 0;
+ uVar5 = 0;
+ local_60 = 0;
+ local_58 = 0;
+ local_50 = 0;
+ iVar3 = RtlQueryFeatureConfiguration
+ (*(undefined4 *)(param_3 + 0x18),1 < (byte)(*(char *)(param_3 + 0x1c) - 2U),
+ &local_78,&local_58);
+ if (iVar3 == 0) {
+ uVar8 = local_58._4_4_ >> 7 & 1;
+ local_70 = CONCAT44(local_70._4_4_,local_58._4_4_ >> 4) & 0xffffffff00000003;
+ uVar4 = local_58._4_4_ >> 6 & 1;
+ uVar5 = uVar12;
+ uVar6 = local_58._4_4_ >> 4 & 3;
+LAB_1400045bf:
+ uVar8 = uVar8 << 10;
+ if (uVar4 != 0) {
+ uVar4 = 0x800;
+ goto LAB_1400045ed;
+ }
+ }
+ else {
+ uVar8 = 0;
+ uVar4 = 0;
+ uVar6 = (uint)local_70;
+ if (iVar3 != 0x117) goto LAB_1400045bf;
+ uVar8 = (local_58._4_4_ >> 7 & 1) << 10;
+ uVar5 = uVar12;
+ }
+ uVar4 = 0;
+LAB_1400045ed:
+ uVar5 = -(uint)(uVar5 != 0) & uVar6 & 3;
+ if (uVar5 == 0) {
+ uVar9 = -(uint)(*(char *)(param_3 + 0x1f) != '\0') & 0x40;
+ }
+ else {
+ uVar9 = 0;
+ if (uVar6 == 2) {
+ uVar9 = 0x40;
+ }
+ }
+ uVar5 = uVar9 >> 6 ^ (uVar9 | uVar5 << 7 | uVar8 | uVar4);
+ if ((uVar9 != 0) && (plVar11 = *(longlong **)(param_3 + 0x20), plVar11 != (longlong *)0x0)) {
+ do {
+ puVar1 = (undefined8 *)*plVar11;
+ if (puVar1 == (undefined8 *)0x0) break;
+ if ((*(char *)((longlong)puVar1 + 0x1e) == '\0') &&
+ (*(char *)((longlong)puVar1 + 0x1d) == '\0')) {
+ uVar4 = *(uint *)*puVar1;
+ local_80 = (ulonglong)uVar4;
+ if ((uVar4 & 2) == 0) {
+ uVar7 = wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
+ ((uint *)*puVar1,local_80,(longlong)puVar1);
+ uVar4 = (uint)uVar7;
+ }
+ uVar6 = uVar5 & 0xfffffffe;
+ uVar5 = (uint)(((byte)uVar4 & (byte)uVar5 & 1) != 0);
+ }
+ else {
+ if (((uVar5 & 1) == 0) || (uVar6 = uVar12, *(char *)((longlong)puVar1 + 0x1f) == '\0')) {
+ uVar6 = 0;
+ }
+ uVar5 = uVar5 & 0xfffffffe;
+ }
+ uVar5 = uVar5 | uVar6;
+ plVar11 = plVar11 + 1;
+ } while ((uVar5 & 1) != 0);
+ }
+ if (*(char *)(param_3 + 0x1c) == '\0') {
+ uVar12 = -(uint)(iVar2 != 0) & 1;
+ }
+ uVar7 = param_2 & 0xffffffff;
+ do {
+ uVar10 = param_2;
+ uVar6 = (uint)uVar7;
+ local_88 = CONCAT44(local_88._4_4_,uVar6);
+ if ((uVar12 != 0) && (local_88 = CONCAT44(local_88._4_4_,uVar6), (uVar7 & 2) == 0)) {
+ uVar4 = (uVar5 ^ uVar6) & 0x9c1 ^ uVar6;
+ uVar6 = uVar4 | 2;
+ local_88 = CONCAT44(local_88._4_4_,uVar4) | 2;
+ }
+ if ((uVar10 & 4) == 0) {
+ uVar4 = (uVar6 ^ uVar5) & 0x400 ^ uVar6;
+ uVar6 = uVar4 | 4;
+ local_88 = CONCAT44(local_88._4_4_,uVar4) | 4;
+ }
+ uVar7 = uVar10 & 0xffffffff;
+ LOCK();
+ uVar4 = *param_1;
+ bVar13 = (uint)uVar10 == uVar4;
+ if (bVar13) {
+ *param_1 = uVar6;
+ }
+ else {
+ uVar7 = (ulonglong)uVar4;
+ }
+ UNLOCK();
+ param_2 = uVar7;
+ } while (!bVar13);
+ if (((uVar10 & 4) == 0) &&
+ (g_wil_details_subscribeFeatureStateCacheToConfigurationChanges != (code *)0x0)) {
+ (*g_wil_details_subscribeFeatureStateCacheToConfigurationChanges)
+ (param_1,*(undefined1 *)(param_3 + 0x1c),iVar2);
+ }
+ if (uVar12 == 0) {
+ local_88 = CONCAT44(local_88._4_4_,(uVar5 ^ uVar6) & 0x9c1 ^ uVar6);
+ }
+ return local_88;
+}
+
```
## wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath
### Function Meta
|Key|pj_8246.sys|
| :---: | :---: |
|name|wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath|
|fullname|wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath|
|refcount|2|
|length|91|
|called||
|calling|wil_details_IsEnabledFallback|
|paramcount|3|
|address|140004778|
|sig|undefined __fastcall wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath(uint param_1, int param_2, undefined8 * param_3)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath
+++ wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath
@@ -0,0 +1,52 @@
+
+void wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath
+ (uint param_1,int param_2,undefined8 *param_3)
+
+{
+ uint *puVar1;
+ uint uVar2;
+ uint uVar3;
+ uint uVar4;
+ bool bVar5;
+
+ puVar1 = (uint *)*param_3;
+ if (param_2 == 3) {
+ uVar4 = 0x10;
+ }
+ else {
+ if (param_2 != 4) {
+ return;
+ }
+ uVar4 = 0x20;
+ }
+ if ((*(char *)((longlong)param_3 + 0x1e) == '\0') && (*(char *)((longlong)param_3 + 0x1d) == '\0')
+ ) {
+ if ((*puVar1 & 2) != 0) {
+ uVar3 = *puVar1;
+ while ((uVar3 & 1) == (param_1 & 1)) {
+ LOCK();
+ uVar2 = *puVar1;
+ bVar5 = uVar3 == uVar2;
+ if (bVar5) {
+ *puVar1 = uVar4 | uVar3;
+ uVar2 = uVar3;
+ }
+ UNLOCK();
+ if (bVar5) {
+ return;
+ }
+ uVar3 = uVar2;
+ if ((uVar2 & 2) == 0) {
+ return;
+ }
+ }
+ }
+ }
+ else {
+ LOCK();
+ *puVar1 = *puVar1 | uVar4;
+ UNLOCK();
+ }
+ return;
+}
+
```
## wil_details_IsEnabledFallback
### Function Meta
|Key|pj_8246.sys|
| :---: | :---: |
|name|wil_details_IsEnabledFallback|
|fullname|wil_details_IsEnabledFallback|
|refcount|11|
|length|140|
|called|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath|
|calling|Feature_1083645240__private_IsEnabledFallback
Feature_2428439865__private_IsEnabledFallback
Feature_3303736635__private_IsEnabledFallback
Feature_3411221816__private_IsEnabledFallback
Feature_4243261755__private_IsEnabledFallback
Feature_440600889__private_IsEnabledFallback
Feature_78846265__private_IsEnabledFallback
Feature_EnableTestConfigViaFilterPort__private_IsEnabledFallback
Feature_HydrateLargeNonCachedFiles__private_IsEnabledFallback
Feature_ModernWpp__private_IsEnabledFallback|
|paramcount|3|
|address|1400047dc|
|sig|uint __fastcall wil_details_IsEnabledFallback(ulonglong param_1, int param_2, undefined8 * param_3)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- wil_details_IsEnabledFallback
+++ wil_details_IsEnabledFallback
@@ -0,0 +1,22 @@
+
+uint wil_details_IsEnabledFallback(ulonglong param_1,int param_2,undefined8 *param_3)
+
+{
+ uint uVar1;
+ ulonglong local_res8;
+
+ uVar1 = (uint)param_1;
+ local_res8 = param_1 & 0xffffffff;
+ if ((param_1 & 2) == 0) {
+ local_res8 = wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
+ ((uint *)*param_3,param_1,(longlong)param_3);
+ uVar1 = (uint)local_res8;
+ }
+ if ((param_2 != 0) &&
+ (wil_details_FeatureReporting_ReportUsageToService((longlong)param_3,local_res8,param_2),
+ param_2 - 3U < 2)) {
+ wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath((uint)local_res8,param_2,param_3);
+ }
+ return uVar1 & 1;
+}
+
```
## Feature_2428439865__private_IsEnabledDeviceUsageNoInline
### Function Meta
|Key|pj_8246.sys|
| :---: | :---: |
|name|Feature_2428439865__private_IsEnabledDeviceUsageNoInline|
|fullname|Feature_2428439865__private_IsEnabledDeviceUsageNoInline|
|refcount|3|
|length|49|
|called|Feature_2428439865__private_IsEnabledFallback|
|calling|PrjfScheduleExpansionWorkItem|
|paramcount|0|
|address|140004870|
|sig|ulonglong __fastcall Feature_2428439865__private_IsEnabledDeviceUsageNoInline(void)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- Feature_2428439865__private_IsEnabledDeviceUsageNoInline
+++ Feature_2428439865__private_IsEnabledDeviceUsageNoInline
@@ -0,0 +1,17 @@
+
+ulonglong Feature_2428439865__private_IsEnabledDeviceUsageNoInline(void)
+
+{
+ ulonglong uVar1;
+ undefined8 local_res8;
+
+ local_res8 = (ulonglong)Feature_2428439865__private_featureState;
+ if ((Feature_2428439865__private_featureState & 0x10) == 0) {
+ uVar1 = Feature_2428439865__private_IsEnabledFallback(local_res8,3);
+ }
+ else {
+ uVar1 = (ulonglong)(Feature_2428439865__private_featureState & 1);
+ }
+ return uVar1;
+}
+
```
## Feature_2428439865__private_IsEnabledFallback
### Function Meta
|Key|pj_8246.sys|
| :---: | :---: |
|name|Feature_2428439865__private_IsEnabledFallback|
|fullname|Feature_2428439865__private_IsEnabledFallback|
|refcount|2|
|length|21|
|called|wil_details_IsEnabledFallback|
|calling|Feature_2428439865__private_IsEnabledDeviceUsageNoInline|
|paramcount|2|
|address|1400048a8|
|sig|undefined __fastcall Feature_2428439865__private_IsEnabledFallback(ulonglong param_1, int param_2)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- Feature_2428439865__private_IsEnabledFallback
+++ Feature_2428439865__private_IsEnabledFallback
@@ -0,0 +1,8 @@
+
+void Feature_2428439865__private_IsEnabledFallback(ulonglong param_1,int param_2)
+
+{
+ wil_details_IsEnabledFallback(param_1,param_2,&Feature_2428439865__private_descriptor);
+ return;
+}
+
```
## Feature_HydrateLargeNonCachedFiles__private_IsEnabledDeviceUsageNoInline
### Function Meta
|Key|pj_8246.sys|
| :---: | :---: |
|name|Feature_HydrateLargeNonCachedFiles__private_IsEnabledDeviceUsageNoInline|
|fullname|Feature_HydrateLargeNonCachedFiles__private_IsEnabledDeviceUsageNoInline|
|refcount|8|
|length|49|
|called|Feature_HydrateLargeNonCachedFiles__private_IsEnabledFallback|
|calling|PrjfExpandFile
PrjfManageHydrationOnNonCachedHandle|
|paramcount|0|
|address|1400048c4|
|sig|ulonglong __fastcall Feature_HydrateLargeNonCachedFiles__private_IsEnabledDeviceUsageNoInline(void)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- Feature_HydrateLargeNonCachedFiles__private_IsEnabledDeviceUsageNoInline
+++ Feature_HydrateLargeNonCachedFiles__private_IsEnabledDeviceUsageNoInline
@@ -0,0 +1,17 @@
+
+ulonglong Feature_HydrateLargeNonCachedFiles__private_IsEnabledDeviceUsageNoInline(void)
+
+{
+ ulonglong uVar1;
+ undefined8 local_res8;
+
+ local_res8 = (ulonglong)Feature_HydrateLargeNonCachedFiles__private_featureState;
+ if ((Feature_HydrateLargeNonCachedFiles__private_featureState & 0x10) == 0) {
+ uVar1 = Feature_HydrateLargeNonCachedFiles__private_IsEnabledFallback(local_res8,3);
+ }
+ else {
+ uVar1 = (ulonglong)(Feature_HydrateLargeNonCachedFiles__private_featureState & 1);
+ }
+ return uVar1;
+}
+
```
## Feature_HydrateLargeNonCachedFiles__private_IsEnabledFallback
### Function Meta
|Key|pj_8246.sys|
| :---: | :---: |
|name|Feature_HydrateLargeNonCachedFiles__private_IsEnabledFallback|
|fullname|Feature_HydrateLargeNonCachedFiles__private_IsEnabledFallback|
|refcount|2|
|length|21|
|called|wil_details_IsEnabledFallback|
|calling|Feature_HydrateLargeNonCachedFiles__private_IsEnabledDeviceUsageNoInline|
|paramcount|2|
|address|1400048fc|
|sig|undefined __fastcall Feature_HydrateLargeNonCachedFiles__private_IsEnabledFallback(ulonglong param_1, int param_2)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- Feature_HydrateLargeNonCachedFiles__private_IsEnabledFallback
+++ Feature_HydrateLargeNonCachedFiles__private_IsEnabledFallback
@@ -0,0 +1,9 @@
+
+void Feature_HydrateLargeNonCachedFiles__private_IsEnabledFallback(ulonglong param_1,int param_2)
+
+{
+ wil_details_IsEnabledFallback
+ (param_1,param_2,&Feature_HydrateLargeNonCachedFiles__private_descriptor);
+ return;
+}
+
```
## Feature_1083645240__private_IsEnabledDeviceUsageNoInline
### Function Meta
|Key|pj_8246.sys|
| :---: | :---: |
|name|Feature_1083645240__private_IsEnabledDeviceUsageNoInline|
|fullname|Feature_1083645240__private_IsEnabledDeviceUsageNoInline|
|refcount|5|
|length|49|
|called|Feature_1083645240__private_IsEnabledFallback|
|calling|PrjfReadFileHandler
PrjfWriteFileDataHandler|
|paramcount|0|
|address|140004a28|
|sig|ulonglong __fastcall Feature_1083645240__private_IsEnabledDeviceUsageNoInline(void)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- Feature_1083645240__private_IsEnabledDeviceUsageNoInline
+++ Feature_1083645240__private_IsEnabledDeviceUsageNoInline
@@ -0,0 +1,17 @@
+
+ulonglong Feature_1083645240__private_IsEnabledDeviceUsageNoInline(void)
+
+{
+ ulonglong uVar1;
+ undefined8 local_res8;
+
+ local_res8 = (ulonglong)Feature_1083645240__private_featureState;
+ if ((Feature_1083645240__private_featureState & 0x10) == 0) {
+ uVar1 = Feature_1083645240__private_IsEnabledFallback(local_res8,3);
+ }
+ else {
+ uVar1 = (ulonglong)(Feature_1083645240__private_featureState & 1);
+ }
+ return uVar1;
+}
+
```
## Feature_1083645240__private_IsEnabledFallback
### Function Meta
|Key|pj_8246.sys|
| :---: | :---: |
|name|Feature_1083645240__private_IsEnabledFallback|
|fullname|Feature_1083645240__private_IsEnabledFallback|
|refcount|2|
|length|21|
|called|wil_details_IsEnabledFallback|
|calling|Feature_1083645240__private_IsEnabledDeviceUsageNoInline|
|paramcount|2|
|address|140004a60|
|sig|undefined __fastcall Feature_1083645240__private_IsEnabledFallback(ulonglong param_1, int param_2)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- Feature_1083645240__private_IsEnabledFallback
+++ Feature_1083645240__private_IsEnabledFallback
@@ -0,0 +1,8 @@
+
+void Feature_1083645240__private_IsEnabledFallback(ulonglong param_1,int param_2)
+
+{
+ wil_details_IsEnabledFallback(param_1,param_2,&Feature_1083645240__private_descriptor);
+ return;
+}
+
```
## Feature_3303736635__private_IsEnabledDeviceUsageNoInline
### Function Meta
|Key|pj_8246.sys|
| :---: | :---: |
|name|Feature_3303736635__private_IsEnabledDeviceUsageNoInline|
|fullname|Feature_3303736635__private_IsEnabledDeviceUsageNoInline|
|refcount|2|
|length|49|
|called|Feature_3303736635__private_IsEnabledFallback|
|calling|PrjfCloseFileHandler|
|paramcount|0|
|address|140004a7c|
|sig|ulonglong __fastcall Feature_3303736635__private_IsEnabledDeviceUsageNoInline(void)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- Feature_3303736635__private_IsEnabledDeviceUsageNoInline
+++ Feature_3303736635__private_IsEnabledDeviceUsageNoInline
@@ -0,0 +1,17 @@
+
+ulonglong Feature_3303736635__private_IsEnabledDeviceUsageNoInline(void)
+
+{
+ ulonglong uVar1;
+ undefined8 local_res8;
+
+ local_res8 = (ulonglong)Feature_3303736635__private_featureState;
+ if ((Feature_3303736635__private_featureState & 0x10) == 0) {
+ uVar1 = Feature_3303736635__private_IsEnabledFallback(local_res8,3);
+ }
+ else {
+ uVar1 = (ulonglong)(Feature_3303736635__private_featureState & 1);
+ }
+ return uVar1;
+}
+
```
## Feature_3303736635__private_IsEnabledFallback
### Function Meta
|Key|pj_8246.sys|
| :---: | :---: |
|name|Feature_3303736635__private_IsEnabledFallback|
|fullname|Feature_3303736635__private_IsEnabledFallback|
|refcount|2|
|length|21|
|called|wil_details_IsEnabledFallback|
|calling|Feature_3303736635__private_IsEnabledDeviceUsageNoInline|
|paramcount|2|
|address|140004ab4|
|sig|undefined __fastcall Feature_3303736635__private_IsEnabledFallback(ulonglong param_1, int param_2)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- Feature_3303736635__private_IsEnabledFallback
+++ Feature_3303736635__private_IsEnabledFallback
@@ -0,0 +1,8 @@
+
+void Feature_3303736635__private_IsEnabledFallback(ulonglong param_1,int param_2)
+
+{
+ wil_details_IsEnabledFallback(param_1,param_2,&Feature_3303736635__private_descriptor);
+ return;
+}
+
```
## Feature_3411221816__private_IsEnabledDeviceUsageNoInline
### Function Meta
|Key|pj_8246.sys|
| :---: | :---: |
|name|Feature_3411221816__private_IsEnabledDeviceUsageNoInline|
|fullname|Feature_3411221816__private_IsEnabledDeviceUsageNoInline|
|refcount|3|
|length|49|
|called|Feature_3411221816__private_IsEnabledFallback|
|calling|PrjfPortConnect|
|paramcount|0|
|address|140004ad0|
|sig|ulonglong __fastcall Feature_3411221816__private_IsEnabledDeviceUsageNoInline(void)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- Feature_3411221816__private_IsEnabledDeviceUsageNoInline
+++ Feature_3411221816__private_IsEnabledDeviceUsageNoInline
@@ -0,0 +1,17 @@
+
+ulonglong Feature_3411221816__private_IsEnabledDeviceUsageNoInline(void)
+
+{
+ ulonglong uVar1;
+ undefined8 local_res8;
+
+ local_res8 = (ulonglong)Feature_3411221816__private_featureState;
+ if ((Feature_3411221816__private_featureState & 0x10) == 0) {
+ uVar1 = Feature_3411221816__private_IsEnabledFallback(local_res8,3);
+ }
+ else {
+ uVar1 = (ulonglong)(Feature_3411221816__private_featureState & 1);
+ }
+ return uVar1;
+}
+
```
## Feature_3411221816__private_IsEnabledFallback
### Function Meta
|Key|pj_8246.sys|
| :---: | :---: |
|name|Feature_3411221816__private_IsEnabledFallback|
|fullname|Feature_3411221816__private_IsEnabledFallback|
|refcount|2|
|length|21|
|called|wil_details_IsEnabledFallback|
|calling|Feature_3411221816__private_IsEnabledDeviceUsageNoInline|
|paramcount|2|
|address|140004b08|
|sig|undefined __fastcall Feature_3411221816__private_IsEnabledFallback(ulonglong param_1, int param_2)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- Feature_3411221816__private_IsEnabledFallback
+++ Feature_3411221816__private_IsEnabledFallback
@@ -0,0 +1,8 @@
+
+void Feature_3411221816__private_IsEnabledFallback(ulonglong param_1,int param_2)
+
+{
+ wil_details_IsEnabledFallback(param_1,param_2,&Feature_3411221816__private_descriptor);
+ return;
+}
+
```
## Feature_78846265__private_IsEnabledDeviceUsageNoInline
### Function Meta
|Key|pj_8246.sys|
| :---: | :---: |
|name|Feature_78846265__private_IsEnabledDeviceUsageNoInline|
|fullname|Feature_78846265__private_IsEnabledDeviceUsageNoInline|
|refcount|3|
|length|49|
|called|Feature_78846265__private_IsEnabledFallback|
|calling|PrjfGetInstanceFromVolumeName
PrjfSetupVolumeInformationHandler|
|paramcount|0|
|address|140004b24|
|sig|ulonglong __fastcall Feature_78846265__private_IsEnabledDeviceUsageNoInline(void)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- Feature_78846265__private_IsEnabledDeviceUsageNoInline
+++ Feature_78846265__private_IsEnabledDeviceUsageNoInline
@@ -0,0 +1,17 @@
+
+ulonglong Feature_78846265__private_IsEnabledDeviceUsageNoInline(void)
+
+{
+ ulonglong uVar1;
+ undefined8 local_res8;
+
+ local_res8 = (ulonglong)Feature_78846265__private_featureState;
+ if ((Feature_78846265__private_featureState & 0x10) == 0) {
+ uVar1 = Feature_78846265__private_IsEnabledFallback(local_res8,3);
+ }
+ else {
+ uVar1 = (ulonglong)(Feature_78846265__private_featureState & 1);
+ }
+ return uVar1;
+}
+
```
## Feature_78846265__private_IsEnabledFallback
### Function Meta
|Key|pj_8246.sys|
| :---: | :---: |
|name|Feature_78846265__private_IsEnabledFallback|
|fullname|Feature_78846265__private_IsEnabledFallback|
|refcount|2|
|length|21|
|called|wil_details_IsEnabledFallback|
|calling|Feature_78846265__private_IsEnabledDeviceUsageNoInline|
|paramcount|2|
|address|140004b5c|
|sig|undefined __fastcall Feature_78846265__private_IsEnabledFallback(ulonglong param_1, int param_2)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- Feature_78846265__private_IsEnabledFallback
+++ Feature_78846265__private_IsEnabledFallback
@@ -0,0 +1,8 @@
+
+void Feature_78846265__private_IsEnabledFallback(ulonglong param_1,int param_2)
+
+{
+ wil_details_IsEnabledFallback(param_1,param_2,&Feature_78846265__private_descriptor);
+ return;
+}
+
```
## RtlUnicodeStringCbCopyStringN
### Function Meta
|Key|pj_8246.sys|
| :---: | :---: |
|name|RtlUnicodeStringCbCopyStringN|
|fullname|RtlUnicodeStringCbCopyStringN|
|refcount|2|
|length|205|
|called||
|calling|PrjfPortConnect|
|paramcount|3|
|address|140006088|
|sig|longlong __fastcall RtlUnicodeStringCbCopyStringN(ushort * param_1, short * param_2, ulonglong param_3)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- RtlUnicodeStringCbCopyStringN
+++ RtlUnicodeStringCbCopyStringN
@@ -0,0 +1,52 @@
+
+longlong RtlUnicodeStringCbCopyStringN(ushort *param_1,short *param_2,ulonglong param_3)
+
+{
+ ushort uVar1;
+ ushort uVar2;
+ longlong lVar3;
+ short sVar4;
+ longlong lVar5;
+ ulonglong uVar6;
+ longlong lVar7;
+ ulonglong uVar8;
+
+ uVar1 = *param_1;
+ if ((((((uVar1 & 1) != 0) || (uVar2 = param_1[1], (uVar2 & 1) != 0)) || (uVar2 < uVar1)) ||
+ (uVar2 == 0xffff)) ||
+ ((lVar3 = 0, *(longlong *)(param_1 + 4) == 0 && ((uVar1 != 0 || (uVar2 != 0)))))) {
+ return 0xc000000d;
+ }
+ sVar4 = 0;
+ uVar6 = (ulonglong)(param_1[1] >> 1);
+ uVar8 = param_3 >> 1;
+ if (uVar8 < 0x8000) {
+ lVar5 = lVar3;
+ if (uVar6 != 0) {
+ lVar7 = *(longlong *)(param_1 + 4) - (longlong)param_2;
+ do {
+ sVar4 = (short)lVar5;
+ if (uVar8 == 0) goto LAB_14000613d;
+ if (*param_2 == 0) break;
+ *(short *)(lVar7 + (longlong)param_2) = *param_2;
+ uVar8 = uVar8 - 1;
+ param_2 = param_2 + 1;
+ lVar5 = lVar5 + 1;
+ uVar6 = uVar6 - 1;
+ } while (uVar6 != 0);
+ sVar4 = (short)lVar5;
+ if (uVar6 != 0) goto LAB_14000613d;
+ }
+ sVar4 = (short)lVar5;
+ if ((uVar8 != 0) && (lVar3 = 0, *param_2 != 0)) {
+ lVar3 = 0x80000005;
+ }
+ }
+ else {
+ lVar3 = 0xc000000d;
+ }
+LAB_14000613d:
+ *param_1 = sVar4 * 2;
+ return lVar3;
+}
+
```
## FastWppCleanup
### Function Meta
|Key|pj_8246.sys|
| :---: | :---: |
|name|FastWppCleanup|
|fullname|FastWppCleanup|
|refcount|2|
|length|114|
|called|Feature_ModernWpp__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::EtwUnregister
WPPRECORDER.SYS::WppAutoLogStop|
|calling|PrjfTelemetryAndTracingCleanup|
|paramcount|0|
|address|1400065b0|
|sig|undefined __fastcall FastWppCleanup(void)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- FastWppCleanup
+++ FastWppCleanup
@@ -0,0 +1,25 @@
+
+/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */
+
+void FastWppCleanup(void)
+
+{
+ ulonglong uVar1;
+
+ uVar1 = Feature_ModernWpp__private_IsEnabledDeviceUsageNoInline();
+ if ((int)uVar1 != 0) {
+ EtwUnregister(FastWppRegHandle);
+ FastWppRegHandle = 0;
+ WppAutoLogStop(&WPP_MAIN_CB,0);
+ WPP_RECORDER_INITIALIZED = (undefined *)&WPP_RECORDER_INITIALIZED;
+ _g_rgFastWppLevelEnabledFlags = 0;
+ DAT_14001b488 = 0;
+ _DAT_14001b490 = 0;
+ _DAT_14001b498 = 0;
+ _DAT_14001b4a0 = 0;
+ _DAT_14001b4a8 = 0;
+ FastWppInitState = 0;
+ }
+ return;
+}
+
```
## FastWppPackEvent
### Function Meta
|Key|pj_8246.sys|
| :---: | :---: |
|name|FastWppPackEvent|
|fullname|FastWppPackEvent|
|refcount|3|
|length|159|
|called|memmove|
|calling|FastWppTraceMessage|
|paramcount|4|
|address|14000662c|
|sig|undefined __fastcall FastWppPackEvent(undefined8 * param_1, void * param_2, uint param_3, undefined4 * param_4)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- FastWppPackEvent
+++ FastWppPackEvent
@@ -0,0 +1,36 @@
+
+void FastWppPackEvent(undefined8 *param_1,void *param_2,uint param_3,undefined4 *param_4)
+
+{
+ size_t *psVar1;
+ size_t _Size;
+ void *_Src;
+ size_t *psVar2;
+ ulonglong uVar3;
+ ulonglong uVar4;
+
+ if ((param_1 != (undefined8 *)0x0) && (param_4 != (undefined4 *)0x0)) {
+ psVar2 = param_1 + 1;
+ _Src = (void *)*param_1;
+ uVar4 = 0;
+ while (_Src != (void *)0x0) {
+ _Size = *psVar2;
+ uVar3 = uVar4;
+ if (_Size != 0) {
+ uVar3 = _Size + uVar4;
+ if ((uVar3 < uVar4) || (0xffffffff < uVar3)) break;
+ if ((param_2 != (void *)0x0) && ((uint)uVar3 <= param_3)) {
+ memmove(param_2,_Src,_Size);
+ param_2 = (void *)((longlong)param_2 + _Size);
+ }
+ }
+ psVar1 = psVar2 + 1;
+ psVar2 = psVar2 + 2;
+ uVar4 = uVar3;
+ _Src = (void *)*psVar1;
+ }
+ *param_4 = (int)uVar4;
+ }
+ return;
+}
+
```
## Feature_ModernWpp__private_IsEnabledDeviceUsageNoInline
### Function Meta
|Key|pj_8246.sys|
| :---: | :---: |
|name|Feature_ModernWpp__private_IsEnabledDeviceUsageNoInline|
|fullname|Feature_ModernWpp__private_IsEnabledDeviceUsageNoInline|
|refcount|3|
|length|49|
|called|Feature_ModernWpp__private_IsEnabledFallback|
|calling|FastWppCleanup
PrjfTelemetryAndTracingInit|
|paramcount|0|
|address|14000685c|
|sig|ulonglong __fastcall Feature_ModernWpp__private_IsEnabledDeviceUsageNoInline(void)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- Feature_ModernWpp__private_IsEnabledDeviceUsageNoInline
+++ Feature_ModernWpp__private_IsEnabledDeviceUsageNoInline
@@ -0,0 +1,17 @@
+
+ulonglong Feature_ModernWpp__private_IsEnabledDeviceUsageNoInline(void)
+
+{
+ ulonglong uVar1;
+ undefined8 local_res8;
+
+ local_res8 = (ulonglong)Feature_ModernWpp__private_featureState;
+ if ((Feature_ModernWpp__private_featureState & 0x10) == 0) {
+ uVar1 = Feature_ModernWpp__private_IsEnabledFallback(local_res8,3);
+ }
+ else {
+ uVar1 = (ulonglong)(Feature_ModernWpp__private_featureState & 1);
+ }
+ return uVar1;
+}
+
```
## Feature_ModernWpp__private_IsEnabledFallback
### Function Meta
|Key|pj_8246.sys|
| :---: | :---: |
|name|Feature_ModernWpp__private_IsEnabledFallback|
|fullname|Feature_ModernWpp__private_IsEnabledFallback|
|refcount|2|
|length|21|
|called|wil_details_IsEnabledFallback|
|calling|Feature_ModernWpp__private_IsEnabledDeviceUsageNoInline|
|paramcount|2|
|address|140006894|
|sig|undefined __fastcall Feature_ModernWpp__private_IsEnabledFallback(ulonglong param_1, int param_2)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- Feature_ModernWpp__private_IsEnabledFallback
+++ Feature_ModernWpp__private_IsEnabledFallback
@@ -0,0 +1,8 @@
+
+void Feature_ModernWpp__private_IsEnabledFallback(ulonglong param_1,int param_2)
+
+{
+ wil_details_IsEnabledFallback(param_1,param_2,&Feature_ModernWpp__private_descriptor);
+ return;
+}
+
```
## Feature_EnableTestConfigViaFilterPort__private_IsEnabledDeviceUsageNoInline
### Function Meta
|Key|pj_8246.sys|
| :---: | :---: |
|name|Feature_EnableTestConfigViaFilterPort__private_IsEnabledDeviceUsageNoInline|
|fullname|Feature_EnableTestConfigViaFilterPort__private_IsEnabledDeviceUsageNoInline|
|refcount|2|
|length|49|
|called|Feature_EnableTestConfigViaFilterPort__private_IsEnabledFallback|
|calling|PrjfSleepOnTestSettingFlagsForTests|
|paramcount|0|
|address|140007094|
|sig|ulonglong __fastcall Feature_EnableTestConfigViaFilterPort__private_IsEnabledDeviceUsageNoInline(void)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- Feature_EnableTestConfigViaFilterPort__private_IsEnabledDeviceUsageNoInline
+++ Feature_EnableTestConfigViaFilterPort__private_IsEnabledDeviceUsageNoInline
@@ -0,0 +1,17 @@
+
+ulonglong Feature_EnableTestConfigViaFilterPort__private_IsEnabledDeviceUsageNoInline(void)
+
+{
+ ulonglong uVar1;
+ undefined8 local_res8;
+
+ local_res8 = (ulonglong)Feature_EnableTestConfigViaFilterPort__private_featureState;
+ if ((Feature_EnableTestConfigViaFilterPort__private_featureState & 0x10) == 0) {
+ uVar1 = Feature_EnableTestConfigViaFilterPort__private_IsEnabledFallback(local_res8,3);
+ }
+ else {
+ uVar1 = (ulonglong)(Feature_EnableTestConfigViaFilterPort__private_featureState & 1);
+ }
+ return uVar1;
+}
+
```
## Feature_EnableTestConfigViaFilterPort__private_IsEnabledFallback
### Function Meta
|Key|pj_8246.sys|
| :---: | :---: |
|name|Feature_EnableTestConfigViaFilterPort__private_IsEnabledFallback|
|fullname|Feature_EnableTestConfigViaFilterPort__private_IsEnabledFallback|
|refcount|2|
|length|21|
|called|wil_details_IsEnabledFallback|
|calling|Feature_EnableTestConfigViaFilterPort__private_IsEnabledDeviceUsageNoInline|
|paramcount|2|
|address|1400070cc|
|sig|undefined __fastcall Feature_EnableTestConfigViaFilterPort__private_IsEnabledFallback(ulonglong param_1, int param_2)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- Feature_EnableTestConfigViaFilterPort__private_IsEnabledFallback
+++ Feature_EnableTestConfigViaFilterPort__private_IsEnabledFallback
@@ -0,0 +1,9 @@
+
+void Feature_EnableTestConfigViaFilterPort__private_IsEnabledFallback(ulonglong param_1,int param_2)
+
+{
+ wil_details_IsEnabledFallback
+ (param_1,param_2,&Feature_EnableTestConfigViaFilterPort__private_descriptor);
+ return;
+}
+
```
## Feature_4243261755__private_IsEnabledDeviceUsageNoInline
### Function Meta
|Key|pj_8246.sys|
| :---: | :---: |
|name|Feature_4243261755__private_IsEnabledDeviceUsageNoInline|
|fullname|Feature_4243261755__private_IsEnabledDeviceUsageNoInline|
|refcount|2|
|length|49|
|called|Feature_4243261755__private_IsEnabledFallback|
|calling|PrjfStoreNotificationMappingEntries|
|paramcount|0|
|address|14000b2f4|
|sig|ulonglong __fastcall Feature_4243261755__private_IsEnabledDeviceUsageNoInline(void)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- Feature_4243261755__private_IsEnabledDeviceUsageNoInline
+++ Feature_4243261755__private_IsEnabledDeviceUsageNoInline
@@ -0,0 +1,17 @@
+
+ulonglong Feature_4243261755__private_IsEnabledDeviceUsageNoInline(void)
+
+{
+ ulonglong uVar1;
+ undefined8 local_res8;
+
+ local_res8 = (ulonglong)Feature_4243261755__private_featureState;
+ if ((Feature_4243261755__private_featureState & 0x10) == 0) {
+ uVar1 = Feature_4243261755__private_IsEnabledFallback(local_res8,3);
+ }
+ else {
+ uVar1 = (ulonglong)(Feature_4243261755__private_featureState & 1);
+ }
+ return uVar1;
+}
+
```
## Feature_4243261755__private_IsEnabledFallback
### Function Meta
|Key|pj_8246.sys|
| :---: | :---: |
|name|Feature_4243261755__private_IsEnabledFallback|
|fullname|Feature_4243261755__private_IsEnabledFallback|
|refcount|2|
|length|21|
|called|wil_details_IsEnabledFallback|
|calling|Feature_4243261755__private_IsEnabledDeviceUsageNoInline|
|paramcount|2|
|address|14000b32c|
|sig|undefined __fastcall Feature_4243261755__private_IsEnabledFallback(ulonglong param_1, int param_2)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- Feature_4243261755__private_IsEnabledFallback
+++ Feature_4243261755__private_IsEnabledFallback
@@ -0,0 +1,8 @@
+
+void Feature_4243261755__private_IsEnabledFallback(ulonglong param_1,int param_2)
+
+{
+ wil_details_IsEnabledFallback(param_1,param_2,&Feature_4243261755__private_descriptor);
+ return;
+}
+
```
## WPP_RECORDER_AND_TRACE_SF_sDDld
### Function Meta
|Key|pj_8246.sys|
| :---: | :---: |
|name|WPP_RECORDER_AND_TRACE_SF_sDDld|
|fullname|WPP_RECORDER_AND_TRACE_SF_sDDld|
|refcount|2|
|length|313|
|called|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|
|calling|PrjfPostCreate|
|paramcount|4|
|address|14000f128|
|sig|undefined __fastcall WPP_RECORDER_AND_TRACE_SF_sDDld(undefined8 param_1, char param_2, char param_3, undefined8 param_4)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- WPP_RECORDER_AND_TRACE_SF_sDDld
+++ WPP_RECORDER_AND_TRACE_SF_sDDld
@@ -0,0 +1,20 @@
+
+void WPP_RECORDER_AND_TRACE_SF_sDDld
+ (undefined8 param_1,char param_2,char param_3,undefined8 param_4)
+
+{
+ undefined4 local_18 [4];
+
+ local_18[0] = 0x688;
+ if (param_2 != '\0') {
+ FastWppTraceMessage(0x205,0x26,&WPP_b8de0dfab5423d2f6ea3deba36b4500f_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\create.c");
+ }
+ if (param_3 != '\0') {
+ WppAutoLogTrace(param_4,2,5,&WPP_b8de0dfab5423d2f6ea3deba36b4500f_Traceguids,0x26,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\create.c",0x2a,local_18,4,
+ &stack0x00000058,4,&stack0x00000060,4,&stack0x00000068,4,0);
+ }
+ return;
+}
+
```
## WPP_RECORDER_AND_TRACE_SF_sDZdDl
### Function Meta
|Key|pj_8246.sys|
| :---: | :---: |
|name|WPP_RECORDER_AND_TRACE_SF_sDZdDl|
|fullname|WPP_RECORDER_AND_TRACE_SF_sDZdDl|
|refcount|2|
|length|526|
|called|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|
|calling|PrjfPostCreate|
|paramcount|4|
|address|14000f268|
|sig|undefined __fastcall WPP_RECORDER_AND_TRACE_SF_sDZdDl(undefined8 param_1, char param_2, char param_3, undefined8 param_4)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- WPP_RECORDER_AND_TRACE_SF_sDZdDl
+++ WPP_RECORDER_AND_TRACE_SF_sDZdDl
@@ -0,0 +1,33 @@
+
+void WPP_RECORDER_AND_TRACE_SF_sDZdDl
+ (undefined8 param_1,char param_2,char param_3,undefined8 param_4)
+
+{
+ wchar_t *pwVar1;
+ wchar_t wVar2;
+ wchar_t *in_stack_00000058;
+ undefined4 local_28 [4];
+
+ pwVar1 = L"NULL";
+ wVar2 = L'\b';
+ local_28[0] = 0x5a6;
+ if (param_2 != '\0') {
+ FastWppTraceMessage(0x305,0x21,&WPP_b8de0dfab5423d2f6ea3deba36b4500f_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\create.c");
+ }
+ if (param_3 != '\0') {
+ if ((in_stack_00000058 != (wchar_t *)0x0) &&
+ (wVar2 = *in_stack_00000058, *in_stack_00000058 != L'\0')) {
+ pwVar1 = *(wchar_t **)(in_stack_00000058 + 4);
+ }
+ if (in_stack_00000058 == (wchar_t *)0x0) {
+ in_stack_00000058 = L"\b";
+ }
+ WppAutoLogTrace(param_4,3,5,&WPP_b8de0dfab5423d2f6ea3deba36b4500f_Traceguids,0x21,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\create.c",0x2a,local_28,4,
+ in_stack_00000058,2,pwVar1,wVar2,&stack0x00000060,4,&stack0x00000068,4,
+ &stack0x00000070,4,0);
+ }
+ return;
+}
+
```
## WPP_RECORDER_AND_TRACE_SF_sDZDDD
### Function Meta
|Key|pj_8246.sys|
| :---: | :---: |
|name|WPP_RECORDER_AND_TRACE_SF_sDZDDD|
|fullname|WPP_RECORDER_AND_TRACE_SF_sDZDDD|
|refcount|2|
|length|526|
|called|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|
|calling|PrjfFsctlSetReparsePoint|
|paramcount|4|
|address|140010008|
|sig|undefined __fastcall WPP_RECORDER_AND_TRACE_SF_sDZDDD(undefined8 param_1, char param_2, char param_3, undefined8 param_4)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- WPP_RECORDER_AND_TRACE_SF_sDZDDD
+++ WPP_RECORDER_AND_TRACE_SF_sDZDDD
@@ -0,0 +1,33 @@
+
+void WPP_RECORDER_AND_TRACE_SF_sDZDDD
+ (undefined8 param_1,char param_2,char param_3,undefined8 param_4)
+
+{
+ wchar_t *pwVar1;
+ wchar_t wVar2;
+ wchar_t *in_stack_00000058;
+ undefined4 local_28 [4];
+
+ pwVar1 = L"NULL";
+ wVar2 = L'\b';
+ local_28[0] = 0x168;
+ if (param_2 != '\0') {
+ FastWppTraceMessage(0x407,0x12,&WPP_594c3e8dc88d3460d4d40c2e57e2d4a0_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\fsctrl.c");
+ }
+ if (param_3 != '\0') {
+ if ((in_stack_00000058 != (wchar_t *)0x0) &&
+ (wVar2 = *in_stack_00000058, *in_stack_00000058 != L'\0')) {
+ pwVar1 = *(wchar_t **)(in_stack_00000058 + 4);
+ }
+ if (in_stack_00000058 == (wchar_t *)0x0) {
+ in_stack_00000058 = L"\b";
+ }
+ WppAutoLogTrace(param_4,4,7,&WPP_594c3e8dc88d3460d4d40c2e57e2d4a0_Traceguids,0x12,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\fsctrl.c",0x2a,local_28,4,
+ in_stack_00000058,2,pwVar1,wVar2,&stack0x00000060,4,&stack0x00000068,4,
+ &stack0x00000070,4,0);
+ }
+ return;
+}
+
```
## WPP_RECORDER_AND_TRACE_SF_sDZ_guid_Dd
### Function Meta
|Key|pj_8246.sys|
| :---: | :---: |
|name|WPP_RECORDER_AND_TRACE_SF_sDZ_guid_Dd|
|fullname|WPP_RECORDER_AND_TRACE_SF_sDZ_guid_Dd|
|refcount|2|
|length|524|
|called|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|
|calling|PrjfFsctlStartVirtualizationInstance|
|paramcount|4|
|address|140010220|
|sig|undefined __fastcall WPP_RECORDER_AND_TRACE_SF_sDZ_guid_Dd(undefined8 param_1, char param_2, char param_3, undefined8 param_4)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- WPP_RECORDER_AND_TRACE_SF_sDZ_guid_Dd
+++ WPP_RECORDER_AND_TRACE_SF_sDZ_guid_Dd
@@ -0,0 +1,32 @@
+
+void WPP_RECORDER_AND_TRACE_SF_sDZ_guid_Dd
+ (undefined8 param_1,char param_2,char param_3,undefined8 param_4)
+
+{
+ wchar_t *pwVar1;
+ wchar_t wVar2;
+ wchar_t *in_stack_00000058;
+ undefined4 local_38 [4];
+
+ pwVar1 = L"NULL";
+ wVar2 = L'\b';
+ local_38[0] = 0x32a;
+ if (param_2 != '\0') {
+ FastWppTraceMessage(0x40b,0x27,&WPP_594c3e8dc88d3460d4d40c2e57e2d4a0_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\fsctrl.c");
+ }
+ if (param_3 != '\0') {
+ if ((in_stack_00000058 != (wchar_t *)0x0) &&
+ (wVar2 = *in_stack_00000058, *in_stack_00000058 != L'\0')) {
+ pwVar1 = *(wchar_t **)(in_stack_00000058 + 4);
+ }
+ if (in_stack_00000058 == (wchar_t *)0x0) {
+ in_stack_00000058 = L"\b";
+ }
+ WppAutoLogTrace(param_4,4,0xb,&WPP_594c3e8dc88d3460d4d40c2e57e2d4a0_Traceguids,0x27,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\fsctrl.c",0x2a,local_38,4,
+ in_stack_00000058,2,pwVar1,wVar2);
+ }
+ return;
+}
+
```
## WPP_RECORDER_AND_TRACE_SF_sDdLZ
### Function Meta
|Key|pj_8246.sys|
| :---: | :---: |
|name|WPP_RECORDER_AND_TRACE_SF_sDdLZ|
|fullname|WPP_RECORDER_AND_TRACE_SF_sDdLZ|
|refcount|3|
|length|568|
|called|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|
|calling|PrjfFsctlSetReparsePoint
PrjfPrepareCommandForFileObject|
|paramcount|9|
|address|140010434|
|sig|undefined __fastcall WPP_RECORDER_AND_TRACE_SF_sDdLZ(undefined2 param_1, char param_2, char param_3, undefined8 param_4, undefined8 param_5, undefined4 param_6, ushort param_7, undefined8 param_8, char * param_9)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- WPP_RECORDER_AND_TRACE_SF_sDdLZ
+++ WPP_RECORDER_AND_TRACE_SF_sDdLZ
@@ -0,0 +1,56 @@
+
+void WPP_RECORDER_AND_TRACE_SF_sDdLZ
+ (undefined2 param_1,char param_2,char param_3,undefined8 param_4,undefined8 param_5,
+ undefined4 param_6,ushort param_7,undefined8 param_8,char *param_9)
+
+{
+ longlong lVar1;
+ wchar_t wVar2;
+ longlong lVar3;
+ char *pcVar4;
+ wchar_t *pwVar5;
+ wchar_t *in_stack_00000068;
+
+ pwVar5 = L"NULL";
+ wVar2 = L'\b';
+ if (param_2 != '\0') {
+ if (param_9 != (char *)0x0) {
+ lVar1 = -1;
+ do {
+ lVar1 = lVar1 + 1;
+ } while (param_9[lVar1] != '\0');
+ }
+ pcVar4 = param_9;
+ if (param_9 == (char *)0x0) {
+ pcVar4 = "NULL";
+ }
+ FastWppTraceMessage(param_1,param_7,param_8,pcVar4);
+ }
+ if (param_3 != '\0') {
+ if ((in_stack_00000068 != (wchar_t *)0x0) &&
+ (wVar2 = *in_stack_00000068, *in_stack_00000068 != L'\0')) {
+ pwVar5 = *(wchar_t **)(in_stack_00000068 + 4);
+ }
+ if (in_stack_00000068 == (wchar_t *)0x0) {
+ in_stack_00000068 = L"\b";
+ }
+ lVar1 = -1;
+ if (param_9 == (char *)0x0) {
+ lVar3 = 5;
+ }
+ else {
+ do {
+ lVar3 = lVar1;
+ lVar1 = lVar3 + 1;
+ } while (param_9[lVar1] != '\0');
+ lVar3 = lVar3 + 2;
+ }
+ if (param_9 == (char *)0x0) {
+ param_9 = "NULL";
+ }
+ WppAutoLogTrace(param_4,2,param_6,param_8,param_7,param_9,lVar3,&stack0x00000050,4,
+ &stack0x00000058,4,&stack0x00000060,4,in_stack_00000068,2,pwVar5,wVar2,0);
+ }
+ return;
+}
+
```
## WPP_RECORDER_AND_TRACE_SF_sDdZLZ
### Function Meta
|Key|pj_8246.sys|
| :---: | :---: |
|name|WPP_RECORDER_AND_TRACE_SF_sDdZLZ|
|fullname|WPP_RECORDER_AND_TRACE_SF_sDdZLZ|
|refcount|2|
|length|638|
|called|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|
|calling|PrjfFsctlStartVirtualizationInstance|
|paramcount|4|
|address|140010674|
|sig|undefined __fastcall WPP_RECORDER_AND_TRACE_SF_sDdZLZ(undefined8 param_1, char param_2, char param_3, undefined8 param_4)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- WPP_RECORDER_AND_TRACE_SF_sDdZLZ
+++ WPP_RECORDER_AND_TRACE_SF_sDdZLZ
@@ -0,0 +1,54 @@
+
+void WPP_RECORDER_AND_TRACE_SF_sDdZLZ
+ (undefined8 param_1,char param_2,char param_3,undefined8 param_4)
+
+{
+ wchar_t wVar1;
+ wchar_t *pwVar2;
+ wchar_t *pwVar3;
+ wchar_t wVar4;
+ wchar_t *in_stack_00000060;
+ wchar_t *in_stack_00000070;
+ undefined4 local_38 [2];
+ undefined4 local_30 [2];
+
+ pwVar3 = L"NULL";
+ wVar4 = L'\b';
+ local_38[0] = 0xc000ce05;
+ local_30[0] = 0x2ea;
+ if (param_2 != '\0') {
+ FastWppTraceMessage(0x407,0x23,&WPP_594c3e8dc88d3460d4d40c2e57e2d4a0_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\fsctrl.c");
+ }
+ if (param_3 == '\0') {
+ return;
+ }
+ if (in_stack_00000070 == (wchar_t *)0x0) {
+ wVar1 = L'\b';
+ }
+ else {
+ wVar1 = *in_stack_00000070;
+ if (*in_stack_00000070 != L'\0') {
+ pwVar2 = *(wchar_t **)(in_stack_00000070 + 4);
+ goto LAB_140010801;
+ }
+ }
+ pwVar2 = L"NULL";
+LAB_140010801:
+ if (in_stack_00000070 == (wchar_t *)0x0) {
+ in_stack_00000070 = L"\b";
+ }
+ if ((in_stack_00000060 != (wchar_t *)0x0) &&
+ (wVar4 = *in_stack_00000060, *in_stack_00000060 != L'\0')) {
+ pwVar3 = *(wchar_t **)(in_stack_00000060 + 4);
+ }
+ if (in_stack_00000060 == (wchar_t *)0x0) {
+ in_stack_00000060 = L"\b";
+ }
+ WppAutoLogTrace(param_4,4,7,&WPP_594c3e8dc88d3460d4d40c2e57e2d4a0_Traceguids,0x23,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\fsctrl.c",0x2a,local_30,4,local_38,4,
+ in_stack_00000060,2,pwVar3,wVar4,&stack0x00000068,4,in_stack_00000070,2,pwVar2,
+ wVar1,0);
+ return;
+}
+
```
## WPP_RECORDER_AND_TRACE_SF_sDdLLl
### Function Meta
|Key|pj_8246.sys|
| :---: | :---: |
|name|WPP_RECORDER_AND_TRACE_SF_sDdLLl|
|fullname|WPP_RECORDER_AND_TRACE_SF_sDdLLl|
|refcount|2|
|length|352|
|called|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|
|calling|PrjfFilterCommandReplyStatus|
|paramcount|4|
|address|140011574|
|sig|undefined __fastcall WPP_RECORDER_AND_TRACE_SF_sDdLLl(undefined8 param_1, char param_2, char param_3, undefined8 param_4)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- WPP_RECORDER_AND_TRACE_SF_sDdLLl
+++ WPP_RECORDER_AND_TRACE_SF_sDdLLl
@@ -0,0 +1,20 @@
+
+void WPP_RECORDER_AND_TRACE_SF_sDdLLl
+ (undefined8 param_1,char param_2,char param_3,undefined8 param_4)
+
+{
+ undefined4 local_18 [4];
+
+ local_18[0] = 0xe92;
+ if (param_2 != '\0') {
+ FastWppTraceMessage(0x30e,0x88,&WPP_39279db927ae337b8503ecc20725ff46_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c");
+ }
+ if (param_3 != '\0') {
+ WppAutoLogTrace(param_4,3,0xe,&WPP_39279db927ae337b8503ecc20725ff46_Traceguids,0x88,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c",0x2b,local_18,4,
+ &stack0x00000058,4,&stack0x00000060,4,&stack0x00000068,4,&stack0x00000070,4,0);
+ }
+ return;
+}
+
```
## WPP_RECORDER_AND_TRACE_SF_sDDdd
### Function Meta
|Key|pj_8246.sys|
| :---: | :---: |
|name|WPP_RECORDER_AND_TRACE_SF_sDDdd|
|fullname|WPP_RECORDER_AND_TRACE_SF_sDDdd|
|refcount|2|
|length|315|
|called|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|
|calling|PrjfSleepOnTestSettingFlagsForTests|
|paramcount|4|
|address|1400128ac|
|sig|undefined __fastcall WPP_RECORDER_AND_TRACE_SF_sDDdd(undefined8 param_1, char param_2, char param_3, undefined8 param_4)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- WPP_RECORDER_AND_TRACE_SF_sDDdd
+++ WPP_RECORDER_AND_TRACE_SF_sDDdd
@@ -0,0 +1,20 @@
+
+void WPP_RECORDER_AND_TRACE_SF_sDDdd
+ (undefined8 param_1,char param_2,char param_3,undefined8 param_4)
+
+{
+ undefined4 local_18 [4];
+
+ local_18[0] = 0x1e1f;
+ if (param_2 != '\0') {
+ FastWppTraceMessage(0x315,0xb1,&WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
+ }
+ if (param_3 != '\0') {
+ WppAutoLogTrace(param_4,3,0x15,&WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,0xb1,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",0x29,local_18,4,
+ &stack0x00000058,4,&stack0x00000060,4,&stack0x00000068,4,0);
+ }
+ return;
+}
+
```
## WPP_RECORDER_AND_TRACE_SF_sDHZ
### Function Meta
|Key|pj_8246.sys|
| :---: | :---: |
|name|WPP_RECORDER_AND_TRACE_SF_sDHZ|
|fullname|WPP_RECORDER_AND_TRACE_SF_sDHZ|
|refcount|2|
|length|426|
|called|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|
|calling|PrjfValidateAndGetGlobalVolumePath|
|paramcount|7|
|address|1400129f0|
|sig|undefined __fastcall WPP_RECORDER_AND_TRACE_SF_sDHZ(undefined8 param_1, char param_2, char param_3, undefined8 param_4, undefined8 param_5, undefined8 param_6, ushort param_7)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- WPP_RECORDER_AND_TRACE_SF_sDHZ
+++ WPP_RECORDER_AND_TRACE_SF_sDHZ
@@ -0,0 +1,31 @@
+
+void WPP_RECORDER_AND_TRACE_SF_sDHZ
+ (undefined8 param_1,char param_2,char param_3,undefined8 param_4,undefined8 param_5,
+ undefined8 param_6,ushort param_7)
+
+{
+ wchar_t *pwVar1;
+ wchar_t wVar2;
+ wchar_t *in_stack_00000060;
+
+ pwVar1 = L"NULL";
+ wVar2 = L'\b';
+ if (param_2 != '\0') {
+ FastWppTraceMessage(0x20b,param_7,&WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
+ }
+ if (param_3 != '\0') {
+ if ((in_stack_00000060 != (wchar_t *)0x0) &&
+ (wVar2 = *in_stack_00000060, *in_stack_00000060 != L'\0')) {
+ pwVar1 = *(wchar_t **)(in_stack_00000060 + 4);
+ }
+ if (in_stack_00000060 == (wchar_t *)0x0) {
+ in_stack_00000060 = L"\b";
+ }
+ WppAutoLogTrace(param_4,2,0xb,&WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,param_7,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",0x29,&stack0x00000050,4,
+ &stack0x00000058,2,in_stack_00000060,2,pwVar1,wVar2,0);
+ }
+ return;
+}
+
```
## WPP_RECORDER_AND_TRACE_SF_sDid
### Function Meta
|Key|pj_8246.sys|
| :---: | :---: |
|name|WPP_RECORDER_AND_TRACE_SF_sDid|
|fullname|WPP_RECORDER_AND_TRACE_SF_sDid|
|refcount|2|
|length|286|
|called|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|
|calling|PrjfManageHydrationOnNonCachedHandle|
|paramcount|4|
|address|140013c24|
|sig|undefined __fastcall WPP_RECORDER_AND_TRACE_SF_sDid(undefined8 param_1, char param_2, char param_3, undefined8 param_4)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- WPP_RECORDER_AND_TRACE_SF_sDid
+++ WPP_RECORDER_AND_TRACE_SF_sDid
@@ -0,0 +1,19 @@
+
+void WPP_RECORDER_AND_TRACE_SF_sDid(undefined8 param_1,char param_2,char param_3,undefined8 param_4)
+
+{
+ undefined4 local_18 [4];
+
+ local_18[0] = 0x1ec8;
+ if (param_2 != '\0') {
+ FastWppTraceMessage(0x20e,0xb6,&WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
+ }
+ if (param_3 != '\0') {
+ WppAutoLogTrace(param_4,2,0xe,&WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,0xb6,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",0x29,local_18,4,
+ &stack0x00000058,8,&stack0x00000060,4,0);
+ }
+ return;
+}
+
```
## WPP_RECORDER_AND_TRACE_SF_sDiid
### Function Meta
|Key|pj_8246.sys|
| :---: | :---: |
|name|WPP_RECORDER_AND_TRACE_SF_sDiid|
|fullname|WPP_RECORDER_AND_TRACE_SF_sDiid|
|refcount|2|
|length|309|
|called|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|
|calling|PrjfManageHydrationOnNonCachedHandle|
|paramcount|7|
|address|140013d4c|
|sig|undefined __fastcall WPP_RECORDER_AND_TRACE_SF_sDiid(undefined8 param_1, char param_2, char param_3, undefined8 param_4, undefined8 param_5, undefined8 param_6, ushort param_7)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- WPP_RECORDER_AND_TRACE_SF_sDiid
+++ WPP_RECORDER_AND_TRACE_SF_sDiid
@@ -0,0 +1,18 @@
+
+void WPP_RECORDER_AND_TRACE_SF_sDiid
+ (undefined8 param_1,char param_2,char param_3,undefined8 param_4,undefined8 param_5,
+ undefined8 param_6,ushort param_7)
+
+{
+ if (param_2 != '\0') {
+ FastWppTraceMessage(0x20e,param_7,&WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
+ }
+ if (param_3 != '\0') {
+ WppAutoLogTrace(param_4,2,0xe,&WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,param_7,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",0x29,&stack0x00000050,4,
+ &stack0x00000058,8,&stack0x00000060,8,&stack0x00000068,4,0);
+ }
+ return;
+}
+
```
## WPP_RECORDER_AND_TRACE_SF_sDiiiid
### Function Meta
|Key|pj_8246.sys|
| :---: | :---: |
|name|WPP_RECORDER_AND_TRACE_SF_sDiiiid|
|fullname|WPP_RECORDER_AND_TRACE_SF_sDiiiid|
|refcount|2|
|length|400|
|called|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|
|calling|PrjfManageHydrationOnNonCachedHandle|
|paramcount|4|
|address|140013e88|
|sig|undefined __fastcall WPP_RECORDER_AND_TRACE_SF_sDiiiid(undefined8 param_1, char param_2, char param_3, undefined8 param_4)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- WPP_RECORDER_AND_TRACE_SF_sDiiiid
+++ WPP_RECORDER_AND_TRACE_SF_sDiiiid
@@ -0,0 +1,23 @@
+
+void WPP_RECORDER_AND_TRACE_SF_sDiiiid
+ (undefined8 param_1,char param_2,char param_3,undefined8 param_4)
+
+{
+ undefined4 local_28 [2];
+ undefined4 local_20 [2];
+
+ local_28[0] = 0xc000000d;
+ local_20[0] = 0x1f39;
+ if (param_2 != '\0') {
+ FastWppTraceMessage(0x20e,0xb9,&WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
+ }
+ if (param_3 != '\0') {
+ WppAutoLogTrace(param_4,2,0xe,&WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,0xb9,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",0x29,local_20,4,
+ &stack0x00000058,8,&stack0x00000060,8,&stack0x00000068,8,&stack0x00000070,8,
+ local_28,4,0);
+ }
+ return;
+}
+
```
## PrjfPostSetRenameInformation
### Function Meta
|Key|pj_8246.sys|
| :---: | :---: |
|name|PrjfPostSetRenameInformation|
|fullname|PrjfPostSetRenameInformation|
|refcount|2|
|length|196|
|called|PrjfProcessPostRenameOrLinkInformation
PrjfSleepOnTestSettingFlagsForTests
WPP_RECORDER_AND_TRACE_SF_sDD|
|calling|PrjfPostSetInformation|
|paramcount|3|
|address|14002c4c0|
|sig|ulonglong __fastcall PrjfPostSetRenameInformation(longlong param_1, longlong param_2, longlong * param_3)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- PrjfPostSetRenameInformation
+++ PrjfPostSetRenameInformation
@@ -0,0 +1,26 @@
+
+ulonglong PrjfPostSetRenameInformation(longlong param_1,longlong param_2,longlong *param_3)
+
+{
+ ulonglong uVar1;
+ undefined1 in_stack_ffffffffffffffb8;
+ undefined7 in_stack_ffffffffffffffb9;
+
+ PrjfSleepOnTestSettingFlagsForTests
+ (0x10,(undefined8 *)0x0,param_1,*(undefined8 *)(param_2 + 0x18),
+ CONCAT71(in_stack_ffffffffffffffb9,in_stack_ffffffffffffffb8));
+ uVar1 = PrjfProcessPostRenameOrLinkInformation(param_1,param_2,param_3,0x80);
+ if ((int)uVar1 < 0) {
+ if (((DAT_14001b491 & 0x20) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x20d,DAT_14001b491 & 0x20,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xd,0x21,
+ &WPP_9aa94875f0ba3c84ae0a423dcca6636f_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\fileinfo.c");
+ }
+ }
+ return uVar1 & 0xffffffff;
+}
+
```
## PrjfFilterCommandReplyStatus
### Function Meta
|Key|pj_8246.sys|
| :---: | :---: |
|name|PrjfFilterCommandReplyStatus|
|fullname|PrjfFilterCommandReplyStatus|
|refcount|2|
|length|179|
|called|WPP_RECORDER_AND_TRACE_SF_sDdLLl|
|calling|PrjfSendCommandAndWaitForCompletion|
|paramcount|2|
|address|1400305fc|
|sig|int __fastcall PrjfFilterCommandReplyStatus(longlong param_1, int param_2)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- PrjfFilterCommandReplyStatus
+++ PrjfFilterCommandReplyStatus
@@ -0,0 +1,25 @@
+
+int PrjfFilterCommandReplyStatus(longlong param_1,int param_2)
+
+{
+ int iVar1;
+
+ if ((*(int *)(param_1 + 4) == 7) &&
+ (((((iVar1 = *(int *)(param_1 + 0x144), iVar1 == 2 || (iVar1 == 4)) || (iVar1 == 8)) ||
+ ((iVar1 == 0x80 || (iVar1 == 0x100)))) ||
+ ((iVar1 == 0x200 || ((iVar1 == 0x400 || (iVar1 == 0x800)))))))) {
+ if (param_2 < 0) {
+ if (((DAT_14001b499 & 0x40) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDdLLl
+ (CONCAT71((int7)((ulonglong)param_1 >> 8),DAT_14001b499) & 0xffffffffffffff40,
+ DAT_14001b499 & 0x40,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40));
+ }
+ }
+ param_2 = 0;
+ }
+ return param_2;
+}
+
```
## PrjfValidateAndGetGlobalVolumePath
### Function Meta
|Key|pj_8246.sys|
| :---: | :---: |
|name|PrjfValidateAndGetGlobalVolumePath|
|fullname|PrjfValidateAndGetGlobalVolumePath|
|refcount|3|
|length|1558|
|called|NTOSKRNL.EXE::RtlPrefixUnicodeString
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDHZ
WPP_RECORDER_AND_TRACE_SF_sDZ|
|calling|PrjfGetInstanceFromVolumeName
PrjfSetupVolumeInformationHandler|
|paramcount|2|
|address|14003f004|
|sig|wchar_t * __fastcall PrjfValidateAndGetGlobalVolumePath(wchar_t * param_1, ushort * param_2)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- PrjfValidateAndGetGlobalVolumePath
+++ PrjfValidateAndGetGlobalVolumePath
@@ -0,0 +1,231 @@
+
+wchar_t * PrjfValidateAndGetGlobalVolumePath(wchar_t *param_1,ushort *param_2)
+
+{
+ ushort uVar1;
+ longlong lVar2;
+ char cVar3;
+ ulonglong uVar4;
+ longlong lVar5;
+ byte bVar6;
+ ushort uVar7;
+ wchar_t *pwVar8;
+ wchar_t *pwVar9;
+ wchar_t *pwVar10;
+ ushort uVar11;
+ short sVar12;
+ short *psVar13;
+ short sVar14;
+ wchar_t *pwVar15;
+ undefined2 *puVar16;
+ longlong lVar17;
+ bool bVar18;
+ undefined1 in_stack_ffffffffffffff98;
+ undefined7 in_stack_ffffffffffffff99;
+ undefined4 in_stack_ffffffffffffffa0;
+ undefined4 in_stack_ffffffffffffffa4;
+ undefined4 uVar19;
+ undefined4 in_stack_ffffffffffffffc4;
+
+ sVar12 = 0x30;
+ uVar11 = (ushort)*param_1 >> 1;
+ if (uVar11 < 0x30) {
+ bVar18 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar6 = DAT_14001b491 & 8;
+ if ((bVar6 == 0) && (!bVar18)) {
+ return (wchar_t *)0xc000000d;
+ }
+ uVar11 = 0xdf;
+ pwVar10 = param_1;
+LAB_14003f07a:
+ WPP_RECORDER_AND_TRACE_SF_sDHZ
+ (pwVar10,bVar6,bVar18,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),
+ CONCAT71(in_stack_ffffffffffffff99,in_stack_ffffffffffffff98),
+ CONCAT44(in_stack_ffffffffffffffa4,in_stack_ffffffffffffffa0),uVar11);
+ return (wchar_t *)0xc000000d;
+ }
+ cVar3 = RtlPrefixUnicodeString(&DAT_140016598,param_1,1);
+ pwVar10 = (wchar_t *)0x0;
+ if (cVar3 == '\0') {
+ if (((DAT_14001b491 & 8) == 0) &&
+ ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) {
+ return (wchar_t *)0xc000000d;
+ }
+ uVar19 = 0x259f;
+ uVar11 = 0xe0;
+LAB_14003f10b:
+ WPP_RECORDER_AND_TRACE_SF_sDZ
+ (0x20b,DAT_14001b491 & 8,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xb,uVar11,
+ &WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",
+ CONCAT44(in_stack_ffffffffffffffc4,uVar19),param_1);
+ return (wchar_t *)0xc000000d;
+ }
+ lVar2 = *(longlong *)(param_1 + 4);
+ uVar4 = 0;
+ do {
+ sVar14 = *(short *)(lVar2 + 0x16 + uVar4 * 2);
+ if (((ushort)uVar4 < 0x18) && ((0x842100U >> ((uint)uVar4 & 0x1f) & 1) != 0)) {
+ if (sVar14 != 0x2d) {
+ if (((DAT_14001b491 & 8) == 0) &&
+ ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) {
+ return (wchar_t *)0xc000000d;
+ }
+ uVar11 = 0xe1;
+LAB_14003f285:
+ bVar6 = DAT_14001b491 & 8;
+ bVar18 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ goto LAB_14003f07a;
+ }
+ }
+ else if ((9 < (ushort)(sVar14 - 0x30U)) &&
+ ((5 < (ushort)(sVar14 - 0x41U) && (5 < (ushort)(sVar14 - 0x61U))))) {
+ if (((DAT_14001b491 & 8) == 0) &&
+ ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) {
+ return (wchar_t *)0xc000000d;
+ }
+ uVar11 = 0xe2;
+ goto LAB_14003f285;
+ }
+ uVar7 = (ushort)uVar4 + 1;
+ uVar4 = (ulonglong)uVar7;
+ } while (uVar7 < 0x24);
+ if (*(short *)(lVar2 + 0x5e) != 0x7d) {
+ if (((DAT_14001b491 & 8) == 0) &&
+ ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) {
+ return (wchar_t *)0xc000000d;
+ }
+ uVar19 = 0x25c1;
+ uVar11 = 0xe3;
+ goto LAB_14003f10b;
+ }
+ uVar7 = 0x30;
+ if (0x30 < uVar11) {
+ do {
+ sVar14 = *(short *)(lVar2 + (ulonglong)uVar7 * 2);
+ if (uVar7 == 0x30) {
+ if ((sVar14 != 0x5c) && (sVar14 != 0)) {
+ if (((DAT_14001b491 & 8) == 0) &&
+ ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) {
+ return (wchar_t *)0xc000000d;
+ }
+ uVar19 = 0x25d0;
+ uVar11 = 0xe4;
+ goto LAB_14003f10b;
+ }
+ }
+ else if (sVar14 != 0) {
+ if (((DAT_14001b491 & 8) == 0) &&
+ ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) {
+ return (wchar_t *)0xc000000d;
+ }
+ uVar19 = 0x25da;
+ uVar11 = 0xe5;
+ goto LAB_14003f10b;
+ }
+ uVar7 = uVar7 + 1;
+ } while (uVar7 < uVar11);
+ }
+ uVar7 = *param_2;
+ if ((((((uVar7 & 1) == 0) && (uVar1 = param_2[1], (uVar1 & 1) == 0)) && (uVar7 <= uVar1)) &&
+ (uVar1 != 0xffff)) && ((*(longlong *)(param_2 + 4) != 0 || ((uVar7 == 0 && (uVar1 == 0)))))) {
+ psVar13 = (short *)&u__Global__;
+ uVar4 = (ulonglong)(param_2[1] >> 1);
+ lVar17 = 0x7fff;
+ lVar2 = *(longlong *)(param_2 + 4);
+ pwVar8 = (wchar_t *)0x0;
+ pwVar15 = pwVar10;
+ if (uVar4 == 0) {
+LAB_14003f3cf:
+ sVar14 = (short)pwVar15;
+ pwVar9 = (wchar_t *)0x80000005;
+ }
+ else {
+ do {
+ sVar14 = (short)pwVar15;
+ pwVar9 = pwVar10;
+ if (lVar17 == 0) goto LAB_14003f3d1;
+ if (*psVar13 == 0) break;
+ *(short *)(lVar2 + -0x140017028 + (longlong)psVar13) = *psVar13;
+ lVar17 = lVar17 + -1;
+ psVar13 = psVar13 + 1;
+ pwVar15 = (wchar_t *)((longlong)pwVar15 + 1);
+ uVar4 = uVar4 - 1;
+ } while (uVar4 != 0);
+ sVar14 = (short)pwVar15;
+ pwVar9 = pwVar8;
+ if (((uVar4 == 0) && (lVar17 != 0)) && (*psVar13 != 0)) goto LAB_14003f3cf;
+ }
+LAB_14003f3d1:
+ *param_2 = sVar14 * 2;
+ if (-1 < (int)pwVar9) {
+ if ((0x30 < uVar11) && (*(short *)(*(longlong *)(param_1 + 4) + 0x60) == 0x5c)) {
+ sVar12 = 0x31;
+ }
+ uVar11 = *param_2;
+ puVar16 = (undefined2 *)(*(longlong *)(param_1 + 4) + 6);
+ if ((((((uVar11 & 1) == 0) && (uVar7 = param_2[1], (uVar7 & 1) == 0)) && (uVar11 <= uVar7)) &&
+ (uVar7 != 0xffff)) &&
+ ((*(longlong *)(param_2 + 4) != 0 || ((uVar11 == 0 && (uVar7 == 0)))))) {
+ lVar2 = *(longlong *)(param_2 + 4);
+ uVar11 = uVar11 >> 1;
+ if (puVar16 == (undefined2 *)0x0) goto LAB_14003f523;
+ uVar4 = (ulonglong)((ushort)(sVar12 * 2 - 6U) >> 1);
+ lVar17 = (ulonglong)(param_2[1] >> 1) - (ulonglong)uVar11;
+ pwVar9 = pwVar10;
+ if (lVar17 != 0) {
+ lVar5 = (ulonglong)uVar11 * 2 - (longlong)puVar16;
+ do {
+ sVar12 = (short)pwVar9;
+ if (uVar4 == 0) goto LAB_14003f4b0;
+ uVar4 = uVar4 - 1;
+ *(undefined2 *)(lVar2 + lVar5 + (longlong)puVar16) = *puVar16;
+ pwVar9 = (wchar_t *)((longlong)pwVar9 + 1);
+ puVar16 = puVar16 + 1;
+ lVar17 = lVar17 + -1;
+ } while (lVar17 != 0);
+ }
+ sVar12 = (short)pwVar9;
+ pwVar10 = (wchar_t *)0x0;
+ if (uVar4 != 0) {
+ pwVar10 = (wchar_t *)0x80000005;
+ }
+LAB_14003f4b0:
+ *param_2 = (uVar11 + sVar12) * 2;
+ if (-1 < (int)pwVar10) {
+ return pwVar10;
+ }
+ }
+ else {
+LAB_14003f523:
+ pwVar10 = (wchar_t *)0xc000000d;
+ }
+ bVar18 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar6 = DAT_14001b491 & 8;
+ if ((bVar6 == 0) && (!bVar18)) {
+ return pwVar10;
+ }
+ uVar11 = 0xe7;
+ goto LAB_14003f5d5;
+ }
+ }
+ else {
+ pwVar9 = (wchar_t *)0xc000000d;
+ }
+ pwVar10 = pwVar9;
+ bVar18 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar6 = DAT_14001b491 & 8;
+ if ((bVar6 == 0) && (!bVar18)) {
+ return pwVar10;
+ }
+ uVar11 = 0xe6;
+LAB_14003f5d5:
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x20b,bVar6,bVar18,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xb,uVar11,
+ &WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
+ return pwVar10;
+}
+
```
## PrjfValidateHandleAccess
### Function Meta
|Key|pj_8246.sys|
| :---: | :---: |
|name|PrjfValidateHandleAccess|
|fullname|PrjfValidateHandleAccess|
|refcount|3|
|length|157|
|called|NTOSKRNL.EXE::ObReferenceObjectByHandle
NTOSKRNL.EXE::ObfDereferenceObject|
|calling|PrjfReadFileHandler
PrjfWriteFileDataHandler|
|paramcount|3|
|address|14003f86c|
|sig|ulonglong __fastcall PrjfValidateHandleAccess(longlong param_1, uint param_2, longlong param_3)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- PrjfValidateHandleAccess
+++ PrjfValidateHandleAccess
@@ -0,0 +1,30 @@
+
+ulonglong PrjfValidateHandleAccess(longlong param_1,uint param_2,longlong param_3)
+
+{
+ ulonglong uVar1;
+ longlong local_res8;
+ undefined8 local_res20;
+
+ local_res8 = 0;
+ local_res20 = 0;
+ if (param_1 == 0) {
+ uVar1 = 0;
+ }
+ else {
+ uVar1 = ObReferenceObjectByHandle
+ (param_1,0,*(undefined8 *)IoFileObjectType_exref,0,&local_res8,&local_res20);
+ if (-1 < (int)uVar1) {
+ if ((param_3 == 0) || (local_res8 == param_3)) {
+ ObfDereferenceObject();
+ uVar1 = (ulonglong)(~-(uint)((local_res20._4_4_ & param_2) != 0) & 0xc0000022);
+ }
+ else {
+ ObfDereferenceObject();
+ uVar1 = 0xc0000008;
+ }
+ }
+ }
+ return uVar1;
+}
+
```
## NTOSKRNL.EXE::EtwWriteEx
### Function Meta
|Key|pj_8246.sys|
| :---: | :---: |
|name|EtwWriteEx|
|fullname|NTOSKRNL.EXE::EtwWriteEx|
|refcount|2|
|length|0|
|called||
|calling|FastWppTraceMessage|
|paramcount|0|
|address|EXTERNAL:00000035|
|sig|undefined EtwWriteEx(void)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|True|
*No code available for NTOSKRNL.EXE::EtwWriteEx*
## NTOSKRNL.EXE::ExAllocatePool3
### Function Meta
|Key|pj_8246.sys|
| :---: | :---: |
|name|ExAllocatePool3|
|fullname|NTOSKRNL.EXE::ExAllocatePool3|
|refcount|2|
|length|0|
|called||
|calling|FastWppTraceMessage|
|paramcount|0|
|address|EXTERNAL:00000036|
|sig|undefined ExAllocatePool3(void)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|True|
*No code available for NTOSKRNL.EXE::ExAllocatePool3*
## NTOSKRNL.EXE::RtlNotifyFeatureUsage
### Function Meta
|Key|pj_8246.sys|
| :---: | :---: |
|name|RtlNotifyFeatureUsage|
|fullname|NTOSKRNL.EXE::RtlNotifyFeatureUsage|
|refcount|2|
|length|0|
|called||
|calling|wil_details_FeatureReporting_ReportUsageToServiceDirect|
|paramcount|0|
|address|EXTERNAL:00000082|
|sig|undefined RtlNotifyFeatureUsage(void)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|True|
*No code available for NTOSKRNL.EXE::RtlNotifyFeatureUsage*
## NTOSKRNL.EXE::SeCaptureSecurityDescriptor
### Function Meta
|Key|pj_8246.sys|
| :---: | :---: |
|name|SeCaptureSecurityDescriptor|
|fullname|NTOSKRNL.EXE::SeCaptureSecurityDescriptor|
|refcount|2|
|length|0|
|called||
|calling|PrjfCopyAsPlaceHolder|
|paramcount|0|
|address|EXTERNAL:00000034|
|sig|undefined SeCaptureSecurityDescriptor(void)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|True|
*No code available for NTOSKRNL.EXE::SeCaptureSecurityDescriptor*
## NTOSKRNL.EXE::SeReleaseSecurityDescriptor
### Function Meta
|Key|pj_8246.sys|
| :---: | :---: |
|name|SeReleaseSecurityDescriptor|
|fullname|NTOSKRNL.EXE::SeReleaseSecurityDescriptor|
|refcount|2|
|length|0|
|called||
|calling|PrjfCopyAsPlaceHolder|
|paramcount|0|
|address|EXTERNAL:00000033|
|sig|undefined SeReleaseSecurityDescriptor(void)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|True|
*No code available for NTOSKRNL.EXE::SeReleaseSecurityDescriptor*
# Modified
*Modified functions contain code changes*
## PrjfAttachFilterHandler
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.59|
|i_ratio|0.26|
|m_ratio|0.89|
|b_ratio|0.79|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfAttachFilterHandler|PrjfAttachFilterHandler|
|fullname|PrjfAttachFilterHandler|PrjfAttachFilterHandler|
|refcount|2|2|
|`length`|430|552|
|`called`|FLTMGR.SYS::FltAttachVolumeAtAltitude
FLTMGR.SYS::FltGetVolumeFromFileObject
FLTMGR.SYS::FltObjectDereference
NTOSKRNL.EXE::ObReferenceObjectByHandle
NTOSKRNL.EXE::ObfDereferenceObject
WPP_RECORDER_SF_sDd|FLTMGR.SYS::FltAttachVolumeAtAltitude
FLTMGR.SYS::FltGetVolumeFromFileObject
FLTMGR.SYS::FltObjectDereference
NTOSKRNL.EXE::ObReferenceObjectByHandle
NTOSKRNL.EXE::ObfDereferenceObject
WPP_RECORDER_AND_TRACE_SF_sDD|
|calling|PrjfPortMessage|PrjfPortMessage|
|paramcount|1|1|
|`address`|1c0023a28|14002f6ec|
|sig|int __fastcall PrjfAttachFilterHandler(undefined8 * param_1)|int __fastcall PrjfAttachFilterHandler(undefined8 * param_1)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfAttachFilterHandler Called Diff
```diff
--- PrjfAttachFilterHandler called
+++ PrjfAttachFilterHandler called
@@ -6 +6 @@
-WPP_RECORDER_SF_sDd
+WPP_RECORDER_AND_TRACE_SF_sDD
```
### PrjfAttachFilterHandler Diff
```diff
--- PrjfAttachFilterHandler
+++ PrjfAttachFilterHandler
@@ -1,56 +1,65 @@
int PrjfAttachFilterHandler(undefined8 *param_1)
{
int iVar1;
int iVar2;
- undefined2 uVar3;
+ byte bVar3;
+ bool bVar4;
longlong local_res8;
longlong local_res10;
- undefined8 local_38;
- wchar_t *local_30;
+ ushort uVar5;
undefined8 local_28;
wchar_t *local_20;
+ undefined8 local_18;
+ wchar_t *local_10;
local_res10 = 0;
local_res8 = 0;
- local_20 = L"189800";
- local_30 = L"PrjFlt Instance";
- local_28 = 0xe000c;
- local_38 = 0x20001e;
+ local_10 = L"189800";
+ local_20 = L"PrjFlt Instance";
+ local_18 = 0xe000c;
+ local_28 = 0x20001e;
iVar1 = ObReferenceObjectByHandle
(*param_1,0,*(undefined8 *)IoFileObjectType_exref,1,&local_res10,0);
if (iVar1 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0;
- uVar3 = 199;
+ bVar4 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar3 = DAT_0 & 0x40;
+ if ((bVar3 == 0) && (!bVar4)) goto LAB_1;
+ uVar5 = 0xdb;
}
else {
iVar1 = FltGetVolumeFromFileObject(Globals,local_res10,&local_res8);
if (iVar1 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0;
- uVar3 = 200;
+ bVar4 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar3 = DAT_0 & 0x40;
+ if ((bVar3 == 0) && (!bVar4)) goto LAB_1;
+ uVar5 = 0xdc;
}
else {
- iVar2 = FltAttachVolumeAtAltitude(Globals,local_res8,&local_28,&local_38,0);
+ iVar2 = FltAttachVolumeAtAltitude(Globals,local_res8,&local_18,&local_28,0);
iVar1 = 0;
if (iVar2 != -0x3fe3ffee) {
iVar1 = iVar2;
}
- if ((-1 < iVar1) || ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED))
- goto LAB_0;
- uVar3 = 0xc9;
+ if (-1 < iVar1) goto LAB_1;
+ bVar4 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar3 = DAT_0 & 0x40;
+ if ((bVar3 == 0) && (!bVar4)) goto LAB_1;
+ uVar5 = 0xdd;
}
}
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,uVar3,
- &WPP_3ccab5108a9538d17a865fde27ef339f_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c");
-LAB_0:
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x20e,bVar3,bVar4,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,uVar5,
+ &WPP_39279db927ae337b8503ecc20725ff46_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c");
+LAB_1:
if (local_res8 != 0) {
FltObjectDereference();
}
if (local_res10 != 0) {
ObfDereferenceObject();
}
return iVar1;
}
```
## PrjfClearAttributes
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.7|
|i_ratio|0.43|
|m_ratio|0.91|
|b_ratio|0.86|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfClearAttributes|PrjfClearAttributes|
|fullname|PrjfClearAttributes|PrjfClearAttributes|
|refcount|4|4|
|`length`|303|393|
|`called`|FLTMGR.SYS::FltQueryInformationFile
FLTMGR.SYS::FltSetInformationFile
WPP_RECORDER_SF_sDd
__security_check_cookie|FLTMGR.SYS::FltQueryInformationFile
FLTMGR.SYS::FltSetInformationFile
WPP_RECORDER_AND_TRACE_SF_sDD
__security_check_cookie|
|calling|PrjfFlushAndUpdateDiskStateWorker
PrjfSetDeleteDisposition
PrjfUntagFile|PrjfFlushAndUpdateDiskStateWorker
PrjfSetDeleteDisposition
PrjfUntagFile|
|paramcount|3|3|
|`address`|1c00058b0|14000711c|
|sig|int __fastcall PrjfClearAttributes(undefined8 param_1, undefined8 param_2, uint param_3)|int __fastcall PrjfClearAttributes(undefined8 param_1, undefined8 param_2, uint param_3)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfClearAttributes Called Diff
```diff
--- PrjfClearAttributes called
+++ PrjfClearAttributes called
@@ -3 +3 @@
-WPP_RECORDER_SF_sDd
+WPP_RECORDER_AND_TRACE_SF_sDD
```
### PrjfClearAttributes Diff
```diff
--- PrjfClearAttributes
+++ PrjfClearAttributes
@@ -1,46 +1,53 @@
/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
int PrjfClearAttributes(undefined8 param_1,undefined8 param_2,uint param_3)
{
int iVar1;
- undefined2 uVar2;
- undefined1 auStackY_88 [32];
+ byte bVar2;
+ bool bVar3;
+ undefined1 auStackY_a8 [32];
+ ushort uVar4;
undefined8 local_48;
undefined8 uStack_40;
undefined8 local_38;
undefined8 uStack_30;
undefined8 local_28;
ulonglong local_20;
- local_20 = __security_cookie ^ (ulonglong)auStackY_88;
+ local_20 = __security_cookie ^ (ulonglong)auStackY_a8;
local_48 = 0;
uStack_40 = 0;
local_38 = 0;
uStack_30 = 0;
local_28 = 0;
iVar1 = FltQueryInformationFile(param_2,param_1,&local_48,0x28);
if (iVar1 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) {
+ bVar3 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar2 = DAT_0 & 0x80;
+ if ((bVar2 == 0) && (!bVar3)) {
return iVar1;
}
- uVar2 = 0x2e;
+ uVar4 = 0x2f;
}
else {
local_28 = CONCAT44(local_28._4_4_,(uint)local_28 & ~param_3);
iVar1 = FltSetInformationFile(param_2,param_1,&local_48,0x28);
if (-1 < iVar1) {
return iVar1;
}
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) {
+ bVar3 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar2 = DAT_0 & 0x80;
+ if ((bVar2 == 0) && (!bVar3)) {
return iVar1;
}
- uVar2 = 0x2f;
+ uVar4 = 0x30;
}
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xf,uVar2,
- &WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x20f,bVar2,bVar3,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xf,uVar4,
+ &WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
return iVar1;
}
```
## PrjfSetConfiguration
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.73|
|i_ratio|0.49|
|m_ratio|0.9|
|b_ratio|0.86|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfSetConfiguration|PrjfSetConfiguration|
|fullname|PrjfSetConfiguration|PrjfSetConfiguration|
|refcount|2|2|
|`length`|701|854|
|`called`|NTOSKRNL.EXE::ZwClose
NTOSKRNL.EXE::ZwOpenKey
NTOSKRNL.EXE::ZwQueryValueKey
WPP_RECORDER_SF_sDd
__security_check_cookie|NTOSKRNL.EXE::ZwClose
NTOSKRNL.EXE::ZwOpenKey
NTOSKRNL.EXE::ZwQueryValueKey
WPP_RECORDER_AND_TRACE_SF_sDD
__security_check_cookie|
|calling|DriverEntry|DriverEntry|
|paramcount|1|1|
|`address`|1c003f8b0|140048a08|
|sig|int __fastcall PrjfSetConfiguration(longlong * param_1)|int __fastcall PrjfSetConfiguration(longlong * param_1)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfSetConfiguration Called Diff
```diff
--- PrjfSetConfiguration called
+++ PrjfSetConfiguration called
@@ -4 +4 @@
-WPP_RECORDER_SF_sDd
+WPP_RECORDER_AND_TRACE_SF_sDD
```
### PrjfSetConfiguration Diff
```diff
--- PrjfSetConfiguration
+++ PrjfSetConfiguration
@@ -1,93 +1,106 @@
/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
int PrjfSetConfiguration(longlong *param_1)
{
int iVar1;
- undefined2 uVar2;
- undefined1 auStackY_e8 [32];
+ byte bVar2;
+ bool bVar3;
+ undefined1 auStackY_108 [32];
+ ushort uVar4;
longlong local_a0;
longlong local_98 [2];
wchar_t *local_88;
undefined8 local_80;
wchar_t *local_78;
undefined8 local_70;
wchar_t *local_68;
undefined8 local_60;
longlong local_58;
longlong *local_50;
undefined4 local_48;
undefined4 local_44;
undefined8 local_40;
undefined8 uStack_38;
undefined1 local_30 [12];
undefined4 local_24;
ulonglong local_18;
- local_18 = __security_cookie ^ (ulonglong)auStackY_e8;
+ local_18 = __security_cookie ^ (ulonglong)auStackY_108;
local_44 = 0;
local_98[0] = 0;
local_a0 = 0;
local_58 = 0;
local_88 = L"Parameters";
local_78 = L"DebugOptions";
local_60 = 0x30;
local_68 = L"NegativePathCacheInitialBucketCount";
local_98[1] = 0x160014;
local_80 = 0x1a0018;
local_70 = 0x480046;
local_48 = 0x240;
local_40 = 0;
uStack_38 = 0;
local_50 = param_1;
iVar1 = ZwOpenKey(local_98,0x20019,&local_60);
if (iVar1 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0;
- uVar2 = 0x38;
+ bVar3 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar2 = DAT_0 & 2;
+ if ((bVar2 == 0) && (!bVar3)) goto LAB_1;
+ uVar4 = 0x38;
}
else {
local_58 = local_98[0];
local_50 = local_98 + 1;
local_60 = CONCAT44(local_60._4_4_,0x30);
local_48 = 0x240;
local_40 = 0;
uStack_38 = 0;
iVar1 = ZwOpenKey(&local_a0,0x20019,&local_60);
if (iVar1 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0;
- uVar2 = 0x39;
+ bVar3 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar2 = DAT_0 & 2;
+ if ((bVar2 == 0) && (!bVar3)) goto LAB_1;
+ uVar4 = 0x39;
}
else {
iVar1 = ZwQueryValueKey(local_a0,&local_80,2,local_30);
if (-1 < iVar1) {
iVar1 = ZwQueryValueKey(local_a0,&local_70,2,local_30);
if (iVar1 < 0) {
iVar1 = 0;
local_24 = 0x2000;
}
- DAT_1 = local_24;
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),4,1,0x3b,
- &WPP_3f8aed4e88f83f53ec58226552f2c258_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\prjflt.c");
+ DAT_2 = local_24;
+ if (((DAT_3 & 2) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x401,DAT_3 & 2,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),4,1,0x3b,
+ &WPP_3f8aed4e88f83f53ec58226552f2c258_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\prjflt.c");
}
- goto LAB_0;
+ goto LAB_1;
}
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0;
- uVar2 = 0x3a;
+ bVar3 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar2 = DAT_0 & 2;
+ if ((bVar2 == 0) && (!bVar3)) goto LAB_1;
+ uVar4 = 0x3a;
}
}
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,1,uVar2,
- &WPP_3f8aed4e88f83f53ec58226552f2c258_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\prjflt.c");
-LAB_0:
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x201,bVar2,bVar3,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,1,uVar4,
+ &WPP_3f8aed4e88f83f53ec58226552f2c258_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\prjflt.c");
+LAB_1:
if (local_a0 != 0) {
ZwClose();
}
if (local_98[0] != 0) {
ZwClose();
}
return iVar1;
}
```
## PrjfCopyStreamData
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.74|
|i_ratio|0.53|
|m_ratio|0.95|
|b_ratio|0.92|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfCopyStreamData|PrjfCopyStreamData|
|fullname|PrjfCopyStreamData|PrjfCopyStreamData|
|refcount|2|2|
|`length`|542|608|
|`called`|Expand for full list:
FLTMGR.SYS::FltAcquireResourceExclusive
FLTMGR.SYS::FltReleaseResource
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ObDereferenceObjectDeferDelete
NTOSKRNL.EXE::ObfReferenceObject
NTOSKRNL.EXE::RtlDeleteElementGenericTableAvl
NTOSKRNL.EXE::RtlInsertElementGenericTableAvl
PrjfSendGetFileStreamCommand
WPP_RECORDER_SF_sDd
WPP_RECORDER_SF_sDdZ
__security_check_cookie
Expand for full list:
FLTMGR.SYS::FltAcquireResourceExclusive
FLTMGR.SYS::FltReleaseResource
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ObDereferenceObjectDeferDelete
NTOSKRNL.EXE::ObfReferenceObject
NTOSKRNL.EXE::RtlDeleteElementGenericTableAvl
NTOSKRNL.EXE::RtlInsertElementGenericTableAvl
PrjfSendGetFileStreamCommand
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDdZ
__security_check_cookie
Expand for full list:
FLTMGR.SYS::FltAllocateContext
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltCreateFileEx
FLTMGR.SYS::FltGetInstanceInformation
FLTMGR.SYS::FltGetVolumeGuidName
FLTMGR.SYS::FltGetVolumeProperties
FLTMGR.SYS::FltIsVolumeSnapshot
FLTMGR.SYS::FltQueryVolumeInformationFile
FLTMGR.SYS::FltReleaseContext
FLTMGR.SYS::FltSetInstanceContext
McTemplateK0dhzr1_EtwWriteTransfer
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExInitializeResourceLite
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::RtlGUIDFromString
PrjfShouldAutoAttach
WPP_RECORDER_SF_sD
WPP_RECORDER_SF_sDDd
WPP_RECORDER_SF_sDLLd
WPP_RECORDER_SF_sDd
WPP_RECORDER_SF_sDlLD
__security_check_cookie
memcpy
memsetExpand for full list:
FLTMGR.SYS::FltAllocateContext
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltCreateFileEx
FLTMGR.SYS::FltGetInstanceInformation
FLTMGR.SYS::FltGetVolumeGuidName
FLTMGR.SYS::FltGetVolumeProperties
FLTMGR.SYS::FltIsVolumeSnapshot
FLTMGR.SYS::FltQueryVolumeInformationFile
FLTMGR.SYS::FltReleaseContext
FLTMGR.SYS::FltSetInstanceContext
McTemplateK0dhzr1_EtwWriteTransfer
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExInitializeResourceLite
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::RtlGUIDFromString
PrjfShouldAutoAttach
WPP_RECORDER_AND_TRACE_SF_sD
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDDD
WPP_RECORDER_AND_TRACE_SF_sDLLd
WPP_RECORDER_AND_TRACE_SF_sDlLD
__security_check_cookie
memmove
memset
FLTMGR.SYS::FltGetStreamContext
FLTMGR.SYS::FltReleaseContext
MicrosoftTelemetryAssertTriggeredMsgKM
MicrosoftTelemetryAssertTriggeredNoArgsKM
WPP_RECORDER_SF_sDdD|FLTMGR.SYS::FltGetFileContext
FLTMGR.SYS::FltGetStreamContext
FLTMGR.SYS::FltReleaseContext
MicrosoftTelemetryAssertTriggeredMsgKM
MicrosoftTelemetryAssertTriggeredNoArgsKM
WPP_RECORDER_AND_TRACE_SF_sDdD|
|calling|Expand for full list:
PrjfBlockFsctlOperation
PrjfCleanUpRenameLinkTargetTombstone
PrjfFlushAndUpdateDiskStateWorker
PrjfFsctlSetReparsePoint
PrjfGetContextFileObjectEx
PrjfIsPlaceholderFile
PrjfNotifyRenameOrLinkOperation
PrjfPopulateFile
PrjfPostCreate
PrjfPostQueryInformation
PrjfPrepareSourceForRename
PrjfRemoveInMemoryTombstone
PrjfRevertInMemoryTombstonesForDirectory
PrjfSendGetFileStreamCommand
PrjfSendNotifyOperationCommand
PrjfSetPlaceHolderFlagsSynchronized
PrjfSynchronizeExpansionPreopWithReasonExpand for full list:
PrjfBlockFsctlOperation
PrjfCleanUpRenameLinkTargetTombstone
PrjfFlushAndUpdateDiskStateWorker
PrjfFsctlSetReparsePoint
PrjfGetContextFileObjectEx
PrjfIsPlaceholderFile
PrjfNotifyRenameOrLinkOperation
PrjfPopulateFile
PrjfPostCreate
PrjfPostQueryInformation
PrjfPrepareSourceForRename
PrjfRemoveInMemoryTombstone
PrjfRevertInMemoryTombstonesForDirectory
PrjfSendGetFileStreamCommand
PrjfSendNotifyOperationCommand
PrjfSetPlaceHolderFlagsSynchronized
PrjfSynchronizeExpansionPreopWithReasonExpand for full list:
FLTMGR.SYS::FltClose
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ObfDereferenceObject
PrjfDecideUpdateDeleteOnFileStateAndUpdateFlags
PrjfGetUnionContextByVirtualizationInstanceInfo
PrjfRelPathToFullPath
PrjfReleaseUnionContext
PrjfSetDeleteDisposition
WPP_RECORDER_SF_sD
WPP_RECORDER_SF_sDd
WPP_RECORDER_SF_sDdDExpand for full list:
FLTMGR.SYS::FltClose
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ObfDereferenceObject
PrjfDecideUpdateDeleteOnFileStateAndUpdateFlags
PrjfGetUnionContextByVirtualizationInstanceInfo
PrjfRelPathToFullPath
PrjfReleaseUnionContext
PrjfSetDeleteDisposition
WPP_RECORDER_AND_TRACE_SF_sD
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDdD
FLTMGR.SYS::FltReferenceContext
FLTMGR.SYS::FltReleaseContext
NTOSKRNL.EXE::ExUuidCreate
WPP_RECORDER_SF_sDd
__security_check_cookie|FLTMGR.SYS::FltAllocateContext
FLTMGR.SYS::FltReferenceContext
FLTMGR.SYS::FltReleaseContext
NTOSKRNL.EXE::ExUuidCreate
WPP_RECORDER_AND_TRACE_SF_sDD
__security_check_cookie|
|calling|PrjfGetSetStreamContext|PrjfGetSetStreamContext|
|paramcount|4|4|
|`address`|1c0001e70|140001ff0|
|sig|int __fastcall PrjfCreateStreamContext(undefined8 param_1, longlong param_2, longlong param_3, undefined8 * param_4)|int __fastcall PrjfCreateStreamContext(undefined8 param_1, longlong param_2, longlong param_3, undefined8 * param_4)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfCreateStreamContext Called Diff
```diff
--- PrjfCreateStreamContext called
+++ PrjfCreateStreamContext called
@@ -5 +5 @@
-WPP_RECORDER_SF_sDd
+WPP_RECORDER_AND_TRACE_SF_sDD
```
### PrjfCreateStreamContext Diff
```diff
--- PrjfCreateStreamContext
+++ PrjfCreateStreamContext
@@ -1,58 +1,62 @@
/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
-/* WARNING: Removing unreachable block (ram,0x0001c0001f5f) */
+/* WARNING: Removing unreachable block (ram,0x000140002105) */
int PrjfCreateStreamContext
(undefined8 param_1,longlong param_2,longlong param_3,undefined8 *param_4)
{
int iVar1;
- undefined1 auStackY_88 [32];
+ undefined1 auStackY_a8 [32];
undefined8 local_40;
undefined8 uStack_38;
ulonglong local_30;
- local_30 = __security_cookie ^ (ulonglong)auStackY_88;
+ local_30 = __security_cookie ^ (ulonglong)auStackY_a8;
local_40 = 0;
uStack_38 = 0;
iVar1 = FltAllocateContext(Globals,8,0x30,0x200);
if (-1 < iVar1) {
uRam0000000000000000 = 0;
uRam0000000000000008 = 0;
uRam0000000000000010 = 0;
uRam0000000000000018 = 0;
uRam0000000000000020 = 0;
uRam0000000000000028 = 0;
iVar1 = ExUuidCreate(&local_40);
if (iVar1 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,9,0x19,
- &WPP_0def1edc605734705626ac974b591885_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\context.c");
+ if (((DAT_0 & 2) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x209,DAT_0 & 2,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,9,0x19,
+ &WPP_16258fdb5ea53a6e7a49e4d7510d8a5c_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\context.c");
}
}
else {
uRam0000000000000018 = local_40;
uRam0000000000000020 = uStack_38;
if (*(char *)(param_2 + 0x15) == '\0') {
if ((*(char *)(param_2 + 0x16) != '\0') || (*(char *)(param_2 + 0x17) != '\0')) {
uRam0000000000000000 = 2;
}
}
else {
uRam0000000000000000 = 1;
}
uRam0000000000000028._0_5_ = CONCAT14(1,(undefined4)uRam0000000000000028);
FltReferenceContext(param_1);
uRam0000000000000010 = *(undefined8 *)(param_2 + 8);
if (param_3 != 0) {
uRam0000000000000000 =
CONCAT44(*(undefined4 *)(param_3 + 0x3c),(undefined4)uRam0000000000000000);
}
uRam0000000000000008 = param_1;
*param_4 = 0;
}
}
return iVar1;
}
```
## PrjfPostWrite
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.57|
|i_ratio|0.19|
|m_ratio|0.91|
|b_ratio|0.86|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfPostWrite|PrjfPostWrite|
|fullname|PrjfPostWrite|PrjfPostWrite|
|refcount|3|3|
|`length`|273|351|
|`called`|FLTMGR.SYS::FltReleaseContext
MicrosoftTelemetryAssertTriggeredMsgKM
WPP_RECORDER_SF_sD
WPP_RECORDER_SF_sDdZ|FLTMGR.SYS::FltReleaseContext
MicrosoftTelemetryAssertTriggeredMsgKM
WPP_RECORDER_AND_TRACE_SF_sD
WPP_RECORDER_AND_TRACE_SF_sDdZ|
|calling|||
|paramcount|4|4|
|`address`|1c0004b90|140006160|
|sig|undefined8 __fastcall PrjfPostWrite(longlong param_1, longlong param_2, longlong param_3, ulonglong param_4)|undefined8 __fastcall PrjfPostWrite(longlong param_1, longlong param_2, longlong param_3, ulonglong param_4)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfPostWrite Called Diff
```diff
--- PrjfPostWrite called
+++ PrjfPostWrite called
@@ -3,2 +3,2 @@
-WPP_RECORDER_SF_sD
-WPP_RECORDER_SF_sDdZ
+WPP_RECORDER_AND_TRACE_SF_sD
+WPP_RECORDER_AND_TRACE_SF_sDdZ
```
### PrjfPostWrite Diff
```diff
--- PrjfPostWrite
+++ PrjfPostWrite
@@ -1,46 +1,54 @@
undefined8 PrjfPostWrite(longlong param_1,longlong param_2,longlong param_3,ulonglong param_4)
{
int iVar1;
- undefined4 in_stack_ffffffffffffffdc;
undefined4 in_stack_ffffffffffffffe4;
+ undefined4 in_stack_ffffffffffffffec;
if ((param_4 & 1) == 0) {
iVar1 = *(int *)(param_1 + 0x18);
if (iVar1 < 0) {
- if ((iVar1 != -0x3fe3fffc) &&
- ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
- WPP_RECORDER_SF_sDdZ
- (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),3,2,0xb,
- &WPP_e0f66f78cb02376c02d9fc0dec322fb4_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\readwrite.c",
- CONCAT44(in_stack_ffffffffffffffdc,0x152),
- CONCAT44(in_stack_ffffffffffffffe4,iVar1),
- (wchar_t *)(*(longlong *)(param_2 + 0x20) + 0x58));
+ if (iVar1 != -0x3fe3fffc) {
+ if (((DAT_0 & 4) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDdZ
+ (0x302,DAT_0 & 4,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),3,2,0xb,
+ &WPP_e0f66f78cb02376c02d9fc0dec322fb4_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\readwrite.c",
+ CONCAT44(in_stack_ffffffffffffffe4,0x152),
+ CONCAT44(in_stack_ffffffffffffffec,iVar1),
+ (wchar_t *)(*(longlong *)(param_2 + 0x20) + 0x58));
+ }
}
}
else {
if (*(int *)(*(longlong *)(param_1 + 0x10) + 0x18) != 0) {
if (param_3 == 0) {
MicrosoftTelemetryAssertTriggeredMsgKM();
return 0;
}
*(uint *)(param_3 + 0x28) = *(uint *)(param_3 + 0x28) | 4;
- goto LAB_0;
+ goto LAB_1;
}
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sD(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),4,2,0xc,
- &WPP_e0f66f78cb02376c02d9fc0dec322fb4_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\readwrite.c");
+ if (((DAT_2 & 4) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sD
+ (0x402,DAT_2 & 4,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),4,2,0xc,
+ &WPP_e0f66f78cb02376c02d9fc0dec322fb4_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\readwrite.c");
}
}
}
if (param_3 == 0) {
return 0;
}
-LAB_0:
+LAB_1:
FltReleaseContext(param_3);
return 0;
}
```
## PrjfReleaseUnionContext
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,refcount,length,address,calling,called|
|ratio|0.93|
|i_ratio|0.53|
|m_ratio|0.97|
|b_ratio|0.95|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfReleaseUnionContext|PrjfReleaseUnionContext|
|fullname|PrjfReleaseUnionContext|PrjfReleaseUnionContext|
|`refcount`|32|33|
|`length`|614|655|
|`called`|Expand for full list:
FLTMGR.SYS::FltAcquireResourceExclusive
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltCloseClientPort
FLTMGR.SYS::FltReleaseResource
MicrosoftTelemetryAssertTriggeredMsgKM
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExDeleteResourceLite
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ObDereferenceObjectDeferDelete
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::RtlDeleteElementGenericTableAvl
NTOSKRNL.EXE::RtlDeleteHashTable
NTOSKRNL.EXE::RtlEnumerateGenericTableAvl
NTOSKRNL.EXE::RtlIsGenericTableEmptyAvl
PrjfClearMappingTable
PrjfClearNegativePathCache
WPP_RECORDER_SF_sDdExpand for full list:
FLTMGR.SYS::FltAcquireResourceExclusive
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltCloseClientPort
FLTMGR.SYS::FltReleaseResource
MicrosoftTelemetryAssertTriggeredMsgKM
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExDeleteResourceLite
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ObDereferenceObjectDeferDelete
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::RtlDeleteElementGenericTableAvl
NTOSKRNL.EXE::RtlDeleteHashTable
NTOSKRNL.EXE::RtlEnumerateGenericTableAvl
NTOSKRNL.EXE::RtlIsGenericTableEmptyAvl
PrjfClearMappingTable
PrjfClearNegativePathCache
WPP_RECORDER_AND_TRACE_SF_sDDExpand for full list:
PrjfClearNegativePathCacheHandler
PrjfCloseFileHandler
PrjfCompleteCommandHandler
PrjfCreateRenameOrLinkCompletionContext
PrjfCreateUnionContext
PrjfDeleteFileHandler
PrjfDoesNameExistInLayer
PrjfExpandFile
PrjfFsctlDeleteReparsePoint
PrjfGetSetStreamContext
PrjfGetUnionContextByFileNameEx
PrjfIsFileObjectWithinActiveVirtualizationRoots
PrjfLaunchExpansion
PrjfLookupEntryBackingLayerNegativePathCache
PrjfOpenFileHandler
PrjfPortDisconnect
PrjfPostCreate
PrjfPreDirectoryControl
PrjfPrepareForDelete
PrjfProcessPrjReparsePointBounce
PrjfReadFileHandler
PrjfReleaseRenameOrLinkCompletionContext
PrjfSendCancelCommandWorker
PrjfSendCommand
PrjfSendNotifyOperationCommand
PrjfSetUnionContext
PrjfUpdatePlaceholderIfNeededHandler
PrjfWriteFileDataHandler
PrjfWritePlaceholderInformationHandlerExpand for full list:
PrjfClearNegativePathCacheHandler
PrjfCloseFileHandler
PrjfCompleteCommandHandler
PrjfCreateRenameOrLinkCompletionContext
PrjfCreateUnionContext
PrjfDeleteFileHandler
PrjfDoesNameExistInLayer
PrjfExpandFile
PrjfFsctlDeleteReparsePoint
PrjfGetSetStreamContext
PrjfGetUnionContextByFileNameEx
PrjfIsFileObjectWithinActiveVirtualizationRoots
PrjfLaunchExpansion
PrjfLookupEntryBackingLayerNegativePathCache
PrjfOpenFileHandler
PrjfPortDisconnect
PrjfPostCreate
PrjfPreDirectoryControl
PrjfPrepareForDelete
PrjfProcessPrjReparsePointBounce
PrjfReadFileHandler
PrjfReleaseRenameOrLinkCompletionContext
PrjfSendCancelCommandWorker
PrjfSendCommand
PrjfSendNotifyOperationCommand
PrjfSetUnionContext
PrjfSleepOnTestSettingFlagsForTests
PrjfUpdatePlaceholderIfNeededHandler
PrjfWriteFileDataHandler
PrjfWritePlaceholderInformationHandlerExpand for full list:
FLTMGR.SYS::FltCloseCommunicationPort
FLTMGR.SYS::FltGetRoutineAddress
FLTMGR.SYS::FltInitExtraCreateParameterLookasideList
FLTMGR.SYS::FltRegisterFilter
FLTMGR.SYS::FltStartFiltering
FLTMGR.SYS::FltUnregisterFilter
McGenEventRegister_EtwRegister
McTemplateK0_EtwWriteTransfer
McTemplateK0d_EtwWriteTransfer
NTOSKRNL.EXE::ExInitializeNPagedLookasideList
NTOSKRNL.EXE::ExInitializePagedLookasideList
NTOSKRNL.EXE::KeInitializeEvent
NTOSKRNL.EXE::RtlUnregisterFeatureConfigurationChangeNotification
NTOSKRNL.EXE::RtlUnregisterFeatureUsageProvider
PrjfInitCommunicationPort
PrjfSetConfiguration
PrjfTelemetryAndTracingCleanup
PrjfTelemetryAndTracingInit
WPP_RECORDER_SF_sDd
wil_InitializeFeatureStagingExpand for full list:
FLTMGR.SYS::FltCloseCommunicationPort
FLTMGR.SYS::FltGetRoutineAddress
FLTMGR.SYS::FltInitExtraCreateParameterLookasideList
FLTMGR.SYS::FltRegisterFilter
FLTMGR.SYS::FltStartFiltering
FLTMGR.SYS::FltUnregisterFilter
McGenEventRegister_EtwRegister
McTemplateK0_EtwWriteTransfer
McTemplateK0d_EtwWriteTransfer
NTOSKRNL.EXE::ExInitializeNPagedLookasideList
NTOSKRNL.EXE::ExInitializePagedLookasideList
NTOSKRNL.EXE::KeInitializeEvent
NTOSKRNL.EXE::RtlUnregisterFeatureConfigurationChangeNotification
NTOSKRNL.EXE::RtlUnregisterFeatureUsageProvider
PrjfInitCommunicationPort
PrjfSetConfiguration
PrjfTelemetryAndTracingCleanup
PrjfTelemetryAndTracingInit
WPP_RECORDER_AND_TRACE_SF_sDD
wil_InitializeFeatureStaging
PrjfReleaseUnionContext
WPP_RECORDER_SF_sD|PrjfGetUnionContextByFileName
PrjfReleaseUnionContext
WPP_RECORDER_AND_TRACE_SF_sD|
|calling|PrjfPreFsControl|PrjfPreFsControl|
|paramcount|2|2|
|`address`|1c00223b8|14002db60|
|sig|undefined8 __fastcall PrjfFsctlDeleteReparsePoint(longlong param_1, longlong param_2)|undefined8 __fastcall PrjfFsctlDeleteReparsePoint(longlong param_1, longlong param_2)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfFsctlDeleteReparsePoint Called Diff
```diff
--- PrjfFsctlDeleteReparsePoint called
+++ PrjfFsctlDeleteReparsePoint called
@@ -3 +3 @@
-WPP_RECORDER_SF_sD
+WPP_RECORDER_AND_TRACE_SF_sD
```
### PrjfFsctlDeleteReparsePoint Diff
```diff
--- PrjfFsctlDeleteReparsePoint
+++ PrjfFsctlDeleteReparsePoint
@@ -1,67 +1,84 @@
undefined8 PrjfFsctlDeleteReparsePoint(longlong param_1,longlong param_2)
{
int *piVar1;
undefined8 *puVar2;
int iVar3;
undefined8 uVar4;
- undefined2 uVar5;
+ ushort uVar5;
iVar3 = 0;
uVar4 = 1;
puVar2 = PrjfGetUnionContextByFileName
(param_1,*(undefined8 *)(param_2 + 0x18),(ushort *)0x0,(undefined1 *)0x0);
if (puVar2 == (undefined8 *)0x0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) {
+ if (((DAT_0 & 0x80) == 0) &&
+ ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) {
return 1;
}
- WPP_RECORDER_SF_sD(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),4,7,0x15,
- &WPP_594c3e8dc88d3460d4d40c2e57e2d4a0_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\fsctrl.c");
+ WPP_RECORDER_AND_TRACE_SF_sD
+ (0x407,DAT_0 & 0x80,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),4,7,0x15,
+ &WPP_594c3e8dc88d3460d4d40c2e57e2d4a0_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\fsctrl.c");
return 1;
}
piVar1 = *(int **)(*(longlong *)(param_1 + 0x10) + 0x30);
if (piVar1 == (int *)0x0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sD(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,7,0x16,
- &WPP_594c3e8dc88d3460d4d40c2e57e2d4a0_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\fsctrl.c");
+ if (((DAT_1 & 0x80) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sD
+ (0x207,DAT_1 & 0x80,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,7,0x16,
+ &WPP_594c3e8dc88d3460d4d40c2e57e2d4a0_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\fsctrl.c");
}
iVar3 = -0x3ffffdfa;
- goto LAB_0;
+ goto LAB_2;
}
if ((*(int *)(*(longlong *)(param_1 + 0x10) + 0x20) - 8U & 0xffffffef) == 0) {
if ((short)piVar1[1] == 0) {
if ((*piVar1 == -0x6fffffe4) || (*piVar1 == -0x5fffffde)) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sD(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),3,7,0x19,
- &WPP_594c3e8dc88d3460d4d40c2e57e2d4a0_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\fsctrl.c");
+ if (((DAT_3 & 0x80) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sD
+ (0x307,DAT_3 & 0x80,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),3,7,0x19,
+ &WPP_594c3e8dc88d3460d4d40c2e57e2d4a0_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\fsctrl.c");
}
iVar3 = -0x3fffffde;
}
- goto LAB_0;
+ goto LAB_2;
}
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
+ if (((DAT_1 & 0x80) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
uVar5 = 0x18;
- goto LAB_1;
+ goto LAB_4;
}
}
- else if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
+ else if (((DAT_1 & 0x80) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
uVar5 = 0x17;
-LAB_1:
- WPP_RECORDER_SF_sD(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,7,uVar5,
- &WPP_594c3e8dc88d3460d4d40c2e57e2d4a0_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\fsctrl.c");
+LAB_4:
+ WPP_RECORDER_AND_TRACE_SF_sD
+ (0x207,DAT_1 & 0x80,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,7,uVar5,
+ &WPP_594c3e8dc88d3460d4d40c2e57e2d4a0_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\fsctrl.c");
}
iVar3 = -0x3ffffd88;
-LAB_0:
+LAB_2:
PrjfReleaseUnionContext((longlong)puVar2);
if (iVar3 < 0) {
uVar4 = 4;
*(int *)(param_1 + 0x18) = iVar3;
}
return uVar4;
}
```
## PrjfRemoveTombstonesFromDirectory
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.75|
|i_ratio|0.5|
|m_ratio|0.98|
|b_ratio|0.96|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfRemoveTombstonesFromDirectory|PrjfRemoveTombstonesFromDirectory|
|fullname|PrjfRemoveTombstonesFromDirectory|PrjfRemoveTombstonesFromDirectory|
|refcount|3|3|
|`length`|562|595|
|`called`|FLTMGR.SYS::FltClose
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::RtlEqualUnicodeString
NTOSKRNL.EXE::RtlInitUnicodeString
PrjfDeleteTombstoneIfExists
PrjfEnumerateDirectory
PrjfReopenFile
WPP_RECORDER_SF_sDd|FLTMGR.SYS::FltClose
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::RtlEqualUnicodeString
NTOSKRNL.EXE::RtlInitUnicodeString
PrjfDeleteTombstoneIfExists
PrjfEnumerateDirectory
PrjfReopenFile
WPP_RECORDER_AND_TRACE_SF_sDD|
|calling|PrjfPrepareForDelete
PrjfSetDeleteDisposition|PrjfPrepareForDelete
PrjfSetDeleteDisposition|
|paramcount|2|2|
|`address`|1c0034b70|1400444f0|
|sig|ulonglong __fastcall PrjfRemoveTombstonesFromDirectory(undefined8 param_1, longlong param_2)|ulonglong __fastcall PrjfRemoveTombstonesFromDirectory(undefined8 param_1, longlong param_2)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfRemoveTombstonesFromDirectory Called Diff
```diff
--- PrjfRemoveTombstonesFromDirectory called
+++ PrjfRemoveTombstonesFromDirectory called
@@ -10 +10 @@
-WPP_RECORDER_SF_sDd
+WPP_RECORDER_AND_TRACE_SF_sDD
```
### PrjfRemoveTombstonesFromDirectory Diff
```diff
--- PrjfRemoveTombstonesFromDirectory
+++ PrjfRemoveTombstonesFromDirectory
@@ -1,83 +1,88 @@
ulonglong PrjfRemoveTombstonesFromDirectory(undefined8 param_1,longlong param_2)
{
char cVar1;
uint uVar2;
uint *puVar3;
ulonglong uVar4;
ulonglong uVar5;
- uint *puVar6;
+ undefined4 *puVar6;
+ uint *puVar7;
undefined4 local_res18 [2];
longlong local_res20;
- undefined1 uVar7;
+ undefined1 uVar8;
longlong local_48;
wchar_t local_40 [4];
uint *puStack_38;
undefined8 local_30;
undefined8 uStack_28;
local_48 = 0;
local_res20 = 0;
local_30 = 0;
uStack_28 = 0;
local_40[0] = L'\0';
local_40[1] = L'\0';
local_40[2] = L'\0';
local_40[3] = L'\0';
puStack_38 = (uint *)0x0;
puVar3 = (uint *)ExAllocatePool2(0x100,0x10000,0x65644a50);
if (puVar3 == (uint *)0x0) {
uVar4 = 0xc000009a;
}
else {
uVar5 = PrjfReopenFile(param_1,param_2,0x80000000,&local_48,&local_res20);
uVar4 = uVar5 & 0xffffffff;
if (-1 < (int)uVar5) {
RtlInitUnicodeString(&local_30,L"*");
- uVar7 = 1;
+ uVar8 = 1;
while( true ) {
uVar2 = PrjfEnumerateDirectory
- (param_1,local_res20,0xc,&local_30,0,uVar7,0x10000,puVar3,local_res18);
+ (param_1,local_res20,0xc,&local_30,0,uVar8,0x10000,puVar3,local_res18);
uVar4 = (ulonglong)uVar2;
- puVar6 = puVar3;
+ puVar7 = puVar3;
if ((int)uVar2 < 0) break;
while( true ) {
- puStack_38 = puVar6 + 3;
- local_40[1] = (short)puVar6[2];
- local_40[0] = (short)puVar6[2];
+ puStack_38 = puVar7 + 3;
+ local_40[1] = (short)puVar7[2];
+ local_40[0] = (short)puVar7[2];
cVar1 = RtlEqualUnicodeString(local_40,&DAT_0,1);
if (cVar1 == '\0') {
cVar1 = RtlEqualUnicodeString(local_40,&DAT_1,1);
if (cVar1 == '\0') {
- uVar5 = PrjfDeleteTombstoneIfExists(param_1,local_res20,local_48,local_40);
- uVar4 = uVar5 & 0xffffffff;
- if ((int)uVar5 < 0) goto LAB_2;
+ puVar6 = PrjfDeleteTombstoneIfExists(param_1,local_res20,local_48,local_40);
+ uVar4 = (ulonglong)puVar6 & 0xffffffff;
+ if ((int)puVar6 < 0) goto LAB_2;
}
}
- if (*puVar6 == 0) break;
- puVar6 = (uint *)((longlong)puVar6 + (ulonglong)*puVar6);
+ if (*puVar7 == 0) break;
+ puVar7 = (uint *)((longlong)puVar7 + (ulonglong)*puVar7);
}
- uVar7 = 0;
+ uVar8 = 0;
}
if (uVar2 == 0x80000006) {
uVar4 = 0;
}
- else if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x13,0x15,
- &WPP_4079bacae6ce31fd7110e995a8b7a7c9_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\tombstone.c");
+ else if (((DAT_3 & 8) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x213,DAT_3 & 8,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x13,0x15,
+ &WPP_4079bacae6ce31fd7110e995a8b7a7c9_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\tombstone.c");
}
}
LAB_2:
ExFreePoolWithTag(puVar3,0x65644a50);
if (local_48 != 0) {
FltClose();
}
if (local_res20 != 0) {
ObfDereferenceObject();
}
}
return uVar4;
}
```
## PrjfCreateTombstone
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.8|
|i_ratio|0.69|
|m_ratio|0.95|
|b_ratio|0.93|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfCreateTombstone|PrjfCreateTombstone|
|fullname|PrjfCreateTombstone|PrjfCreateTombstone|
|refcount|6|6|
|`length`|773|857|
|`called`|Expand for full list:
FLTMGR.SYS::FltAllocateExtraCreateParameterFromLookasideList
FLTMGR.SYS::FltAllocateExtraCreateParameterList
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltCreateFileEx2
FLTMGR.SYS::FltFreeExtraCreateParameterList
FLTMGR.SYS::FltInsertExtraCreateParameter
FLTMGR.SYS::FltIsEcpAcknowledged
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::PsGetHostSilo
WPP_RECORDER_SF_sDd
memset
Expand for full list:
FLTMGR.SYS::FltAllocateExtraCreateParameterFromLookasideList
FLTMGR.SYS::FltAllocateExtraCreateParameterList
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltCreateFileEx2
FLTMGR.SYS::FltFreeExtraCreateParameterList
FLTMGR.SYS::FltInsertExtraCreateParameter
FLTMGR.SYS::FltIsEcpAcknowledged
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::PsGetHostSilo
WPP_RECORDER_AND_TRACE_SF_sDD
memset
PrjfPostCleanup
PrjfProcessPostRenameOrLinkInformation
PrjfProcessTombstoneBounce
PrjfRevertInMemoryTombstonesForDirectory|PrjfCleanUpRenameLinkTargetTombstone
PrjfPostCleanup
PrjfProcessPostRenameOrLinkInformation
PrjfProcessTombstoneBounce
PrjfRevertInMemoryTombstonesForDirectory|
|paramcount|3|3|
|`address`|1c00335e4|140042cac|
|sig|int __fastcall PrjfCreateTombstone(undefined8 param_1, undefined8 param_2, char param_3)|int __fastcall PrjfCreateTombstone(undefined8 param_1, undefined8 param_2, char param_3)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfCreateTombstone Called Diff
```diff
--- PrjfCreateTombstone called
+++ PrjfCreateTombstone called
@@ -10 +10 @@
-WPP_RECORDER_SF_sDd
+WPP_RECORDER_AND_TRACE_SF_sDD
```
### PrjfCreateTombstone Diff
```diff
--- PrjfCreateTombstone
+++ PrjfCreateTombstone
@@ -1,105 +1,115 @@
/* WARNING: Type propagation algorithm not settling */
int PrjfCreateTombstone(undefined8 param_1,undefined8 param_2,char param_3)
{
char cVar1;
int iVar2;
- undefined2 uVar3;
+ byte bVar3;
+ bool bVar4;
undefined2 *local_res20;
- undefined4 uVar4;
+ undefined4 uVar5;
+ ushort uVar6;
+ undefined8 in_stack_fffffffffffffef8;
+ undefined4 uVar7;
longlong local_c8;
longlong local_c0;
longlong local_b8 [6];
undefined8 local_88;
undefined8 uStack_80;
undefined8 local_78;
undefined8 uStack_70;
undefined8 local_68;
ulonglong uStack_60;
undefined8 local_58;
undefined8 uStack_50;
undefined8 local_48;
undefined8 local_40;
undefined8 uStack_38;
+ uVar7 = (undefined4)((ulonglong)in_stack_fffffffffffffef8 >> 0x20);
local_48 = 0;
local_c8 = 0;
local_res20 = (undefined2 *)0x0;
local_b8[5] = local_b8[5] & 0xffffffffffff0000;
local_68 = 0;
uStack_60 = uStack_60 & 0xffffffff00000000;
local_c0 = 0;
local_b8[0] = 0;
local_58 = 0;
uStack_50 = 0;
local_b8[1] = 0;
local_b8[2] = 0;
local_b8[3] = 0;
local_b8[4] = 0;
local_88 = 0;
uStack_80 = 0;
local_78 = 0;
uStack_70 = 0;
local_40 = 0;
uStack_38 = 0;
iVar2 = FltAllocateExtraCreateParameterList(Globals,0,&local_c8);
if (iVar2 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0;
- uVar3 = 0x13;
+ bVar4 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar3 = DAT_0 & 8;
+ if ((bVar3 == 0) && (!bVar4)) goto LAB_1;
+ uVar6 = 0x13;
}
else {
- uVar4 = 0;
+ uVar5 = 0;
iVar2 = FltAllocateExtraCreateParameterFromLookasideList
- (Globals,&GUID_ECP_ATOMIC_CREATE,0x58,0,0,&DAT_1,&local_res20);
+ (Globals,&GUID_ECP_ATOMIC_CREATE,0x58,0,0,&DAT_2,&local_res20);
if (-1 < iVar2) {
local_58 = CONCAT26(local_58._6_2_,0xa0000022);
memset(local_res20,0,0x58);
*local_res20 = 0x58;
local_res20[1] = 2;
local_res20[2] = 0;
local_res20[3] = 8;
*(undefined8 **)(local_res20 + 4) = &local_58;
FltInsertExtraCreateParameter(Globals,local_c8,local_res20);
local_b8[3] = 0;
local_b8[4] = 0;
local_b8[1] = 0x28;
local_b8[5] = PsGetHostSilo();
local_b8[2] = local_c8;
local_88 = CONCAT44(local_88._4_4_,0x30);
uStack_80 = 0;
uStack_70 = CONCAT44(uStack_70._4_4_,0x240);
local_68 = 0;
uStack_60 = 0;
local_78 = param_2;
- iVar2 = FltCreateFileEx2(Globals,param_1,&local_c0,local_b8,CONCAT44(uVar4,0x40000000),
- &local_88,&local_40,0,6,0,2,(param_3 != '\0') + 0x210028,0,0,0,
- local_b8 + 1);
+ iVar2 = FltCreateFileEx2(Globals,param_1,&local_c0,local_b8,CONCAT44(uVar5,0x40000000),
+ &local_88,&local_40,0,CONCAT44(uVar7,6),0,2,
+ (param_3 != '\0') + 0x210028,0,0,0,local_b8 + 1);
if (-1 < iVar2) {
cVar1 = FltIsEcpAcknowledged(Globals,local_res20);
if (cVar1 == '\0') {
iVar2 = -0x3fffffff;
}
}
- goto LAB_0;
+ goto LAB_1;
}
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0;
- uVar3 = 0x14;
+ bVar4 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar3 = DAT_0 & 8;
+ if ((bVar3 == 0) && (!bVar4)) goto LAB_1;
+ uVar6 = 0x14;
}
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x13,uVar3,
- &WPP_4079bacae6ce31fd7110e995a8b7a7c9_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\tombstone.c");
-LAB_0:
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x213,bVar3,bVar4,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x13,uVar6,
+ &WPP_4079bacae6ce31fd7110e995a8b7a7c9_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\tombstone.c");
+LAB_1:
if (local_c8 != 0) {
FltFreeExtraCreateParameterList(Globals);
}
if (local_c0 != 0) {
FltClose();
}
if (local_b8[0] != 0) {
ObfDereferenceObject();
}
return iVar2;
}
```
## PrjfSendCancelCommandInNewThread
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.78|
|i_ratio|0.29|
|m_ratio|0.93|
|b_ratio|0.89|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfSendCancelCommandInNewThread|PrjfSendCancelCommandInNewThread|
|fullname|PrjfSendCancelCommandInNewThread|PrjfSendCancelCommandInNewThread|
|refcount|2|2|
|`length`|449|528|
|`called`|FLTMGR.SYS::FltAllocateGenericWorkItem
FLTMGR.SYS::FltFreeGenericWorkItem
FLTMGR.SYS::FltQueueGenericWorkItem
PrjfFreeCommandBuffer
PrjfPrepareCommandForFilePath
WPP_RECORDER_SF_sDLd
WPP_RECORDER_SF_sDd
WPP_RECORDER_SF_sDdZL|FLTMGR.SYS::FltAllocateGenericWorkItem
FLTMGR.SYS::FltFreeGenericWorkItem
FLTMGR.SYS::FltQueueGenericWorkItem
PrjfFreeCommandBuffer
PrjfPrepareCommandForFilePath
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDLd
WPP_RECORDER_AND_TRACE_SF_sDdZL|
|calling|PrjfSendCommandAndWaitForCompletion|PrjfSendCommandAndWaitForCompletion|
|paramcount|2|2|
|`address`|1c00273fc|140034278|
|sig|undefined __fastcall PrjfSendCancelCommandInNewThread(undefined8 param_1, longlong param_2)|undefined __fastcall PrjfSendCancelCommandInNewThread(undefined8 param_1, longlong param_2)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfSendCancelCommandInNewThread Called Diff
```diff
--- PrjfSendCancelCommandInNewThread called
+++ PrjfSendCancelCommandInNewThread called
@@ -6,3 +6,3 @@
-WPP_RECORDER_SF_sDLd
-WPP_RECORDER_SF_sDd
-WPP_RECORDER_SF_sDdZL
+WPP_RECORDER_AND_TRACE_SF_sDD
+WPP_RECORDER_AND_TRACE_SF_sDLd
+WPP_RECORDER_AND_TRACE_SF_sDdZL
```
### PrjfSendCancelCommandInNewThread Diff
```diff
--- PrjfSendCancelCommandInNewThread
+++ PrjfSendCancelCommandInNewThread
@@ -1,60 +1,72 @@
void PrjfSendCancelCommandInNewThread(undefined8 param_1,longlong param_2)
{
int iVar1;
undefined8 uVar2;
longlong lVar3;
longlong lVar4;
uint local_res10 [2];
longlong local_res18;
ulonglong local_38;
longlong lStack_30;
undefined8 local_28;
undefined8 uStack_20;
local_res18 = 0;
lStack_30 = (ulonglong)*(uint *)(param_2 + 0x360) + param_2;
local_res10[0] = 0;
local_28 = *(undefined8 *)(param_2 + 8);
uStack_20 = *(undefined8 *)(param_2 + 0x10);
local_38 = (ulonglong)*(ushort *)(param_2 + 0x364);
uVar2 = PrjfPrepareCommandForFilePath
((ushort *)&local_38,&local_28,8,(ushort *)0x0,(undefined8 *)0x0,0,
(undefined8 *)0x0,&local_res18,local_res10);
lVar4 = local_res18;
if ((int)uVar2 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDdZL(*(undefined8 *)(WPP_GLOBAL_Control + 0x40));
+ if (((DAT_0 & 0x40) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDdZL
+ (&WPP_RECORDER_INITIALIZED,DAT_0 & 0x40,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40));
lVar4 = local_res18;
}
}
else {
*(undefined4 *)(local_res18 + 0x18) = *(undefined4 *)(param_2 + 0x18);
lVar3 = FltAllocateGenericWorkItem();
if (lVar3 == 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0x89,
- &WPP_3ccab5108a9538d17a865fde27ef339f_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c");
+ if (((DAT_0 & 0x40) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x20e,DAT_0 & 0x40,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0x93,
+ &WPP_39279db927ae337b8503ecc20725ff46_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c");
}
}
else {
iVar1 = FltQueueGenericWorkItem(lVar3,param_1,PrjfSendCancelCommandWorker,0,lVar4);
if (iVar1 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDLd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40));
+ if (((DAT_0 & 0x40) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDLd
+ (&WPP_RECORDER_INITIALIZED,DAT_0 & 0x40,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40));
}
FltFreeGenericWorkItem(lVar3);
}
else {
lVar4 = 0;
}
}
}
if (lVar4 != 0) {
PrjfFreeCommandBuffer(lVar4,local_res10[0]);
}
return;
}
```
## PrjfCreateSymbolicLink
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.24|
|i_ratio|0.56|
|m_ratio|0.92|
|b_ratio|0.62|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfCreateSymbolicLink|PrjfCreateSymbolicLink|
|fullname|PrjfCreateSymbolicLink|PrjfCreateSymbolicLink|
|refcount|2|2|
|`length`|1402|1654|
|`called`|Expand for full list:
FLTMGR.SYS::FltAllocateExtraCreateParameterFromLookasideList
FLTMGR.SYS::FltAllocateExtraCreateParameterList
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltCreateFileEx2
FLTMGR.SYS::FltFreeExtraCreateParameterList
FLTMGR.SYS::FltInsertExtraCreateParameter
FLTMGR.SYS::FltIsEcpAcknowledged
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ObfDereferenceObject
PrjfImpersonateAndAddSymlinkPrivilege
PrjfStopImpersonating
WPP_RECORDER_SF_sDd
WPP_RECORDER_SF_sDdZ
__security_check_cookie
memcpy
memsetExpand for full list:
FLTMGR.SYS::FltAllocateExtraCreateParameterFromLookasideList
FLTMGR.SYS::FltAllocateExtraCreateParameterList
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltCreateFileEx2
FLTMGR.SYS::FltFreeExtraCreateParameterList
FLTMGR.SYS::FltInsertExtraCreateParameter
FLTMGR.SYS::FltIsEcpAcknowledged
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ObfDereferenceObject
PrjfImpersonateAndAddSymlinkPrivilege
PrjfStopImpersonating
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDdZ
__security_check_cookie
memmove
memset
FLTMGR.SYS::FltParseFileNameInformation
FLTMGR.SYS::FltReleaseFileNameInformation
PrjfOpenPlaceHolder
WPP_RECORDER_SF_sDdZ|FLTMGR.SYS::FltGetFileNameInformation
FLTMGR.SYS::FltParseFileNameInformation
FLTMGR.SYS::FltReleaseFileNameInformation
PrjfOpenPlaceHolder
WPP_RECORDER_AND_TRACE_SF_sDdZ|
|calling|PrjfDoesNameExistInLayer
PrjfSetParentPlaceHolderFlagsSynchronized|PrjfDoesNameExistInLayer
PrjfSetParentPlaceHolderFlagsSynchronized|
|paramcount|5|5|
|`address`|1c00065a0|140007fe4|
|sig|ulonglong __fastcall PrjfOpenParentPlaceHolder(undefined8 param_1, undefined8 param_2, longlong * param_3, longlong * param_4, byte * param_5)|ulonglong __fastcall PrjfOpenParentPlaceHolder(undefined8 param_1, undefined8 param_2, longlong * param_3, longlong * param_4, byte * param_5)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfOpenParentPlaceHolder Called Diff
```diff
--- PrjfOpenParentPlaceHolder called
+++ PrjfOpenParentPlaceHolder called
@@ -5 +5 @@
-WPP_RECORDER_SF_sDdZ
+WPP_RECORDER_AND_TRACE_SF_sDdZ
```
### PrjfOpenParentPlaceHolder Diff
```diff
--- PrjfOpenParentPlaceHolder
+++ PrjfOpenParentPlaceHolder
@@ -1,50 +1,54 @@
ulonglong PrjfOpenParentPlaceHolder
(undefined8 param_1,undefined8 param_2,longlong *param_3,longlong *param_4,
byte *param_5)
{
uint uVar1;
ulonglong uVar2;
ulonglong uVar3;
longlong *plVar4;
- undefined4 in_stack_ffffffffffffffbc;
undefined4 in_stack_ffffffffffffffc4;
+ undefined4 in_stack_ffffffffffffffcc;
longlong local_28;
wchar_t local_20;
undefined6 uStack_1e;
undefined8 uStack_18;
local_28 = 0;
plVar4 = &local_28;
*param_5 = 0;
_local_20 = 0;
uStack_18 = 0;
uVar1 = FltGetFileNameInformation(0,0x101);
uVar3 = (ulonglong)uVar1;
if (-1 < (int)uVar1) {
uVar1 = FltParseFileNameInformation(local_28);
uVar3 = (ulonglong)uVar1;
if ((-1 < (int)uVar1) && (*(short *)(local_28 + 0x68) != 2)) {
uStack_18 = *(undefined8 *)(local_28 + 0x10);
_local_20 = CONCAT62(*(undefined6 *)(local_28 + 10),
*(short *)(local_28 + 8) + (-2 - *(short *)(local_28 + 0x58)));
uVar2 = PrjfOpenPlaceHolder(param_2,&local_20,plVar4,param_3,param_4,param_5);
uVar3 = uVar2 & 0xffffffff;
- if (((int)uVar2 < 0) && ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED))
- {
- WPP_RECORDER_SF_sDdZ
- (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,10,0x3a,
- &WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",
- CONCAT44(in_stack_ffffffffffffffbc,0xa91),
- CONCAT44(in_stack_ffffffffffffffc4,(int)uVar2),&local_20);
+ if ((int)uVar2 < 0) {
+ if (((DAT_0 & 4) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDdZ
+ (0x20a,DAT_0 & 4,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,10,0x3b,
+ &WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",
+ CONCAT44(in_stack_ffffffffffffffc4,0xab0),
+ CONCAT44(in_stack_ffffffffffffffcc,(int)uVar2),&local_20);
+ }
}
}
}
if (local_28 != 0) {
FltReleaseFileNameInformation(local_28);
}
return uVar3;
}
```
## PrjfEnumerateDirectoryWithMerge
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,sig,address,called|
|ratio|0.34|
|i_ratio|0.39|
|m_ratio|0.95|
|b_ratio|0.84|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfEnumerateDirectoryWithMerge|PrjfEnumerateDirectoryWithMerge|
|fullname|PrjfEnumerateDirectoryWithMerge|PrjfEnumerateDirectoryWithMerge|
|refcount|3|3|
|`length`|2818|3096|
|`called`|Expand for full list:
FLTMGR.SYS::FltReleaseContext
MicrosoftTelemetryAssertTriggeredMsgKM
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::KeSetEvent
NTOSKRNL.EXE::KeWaitForSingleObject
NTOSKRNL.EXE::RtlInitUnicodeString
PrjfEnumerateLayeredDirectories
PrjfFreeEnumContexts
PrjfGetContextFileObjectEx
PrjfMergeEnumerationResults
PrjfPrepareEnumerationContexts
PrjfResetEnumContexts
WPP_RECORDER_SF_sDd
WPP_RECORDER_SF_sDdD
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
memcpyExpand for full list:
FLTMGR.SYS::FltReleaseContext
MicrosoftTelemetryAssertTriggeredMsgKM
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::KeSetEvent
NTOSKRNL.EXE::KeWaitForSingleObject
NTOSKRNL.EXE::RtlInitUnicodeString
PrjfEnumerateLayeredDirectories
PrjfFreeEnumContexts
PrjfGetContextFileObjectEx
PrjfMergeEnumerationResults
PrjfPrepareEnumerationContexts
PrjfResetEnumContexts
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDdD
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
memmove
PrjfPreDirectoryControl|PrjfIsDirectoryEmpty
PrjfPreDirectoryControl|
|paramcount|10|10|
|`address`|1c001b0ac|140025938|
|`sig`|ulonglong __fastcall PrjfEnumerateDirectoryWithMerge(longlong param_1, undefined8 * * * * param_2, longlong param_3, ulonglong param_4, ushort * param_5, undefined4 param_6, byte param_7, uint param_8, longlong param_9, uint * param_10)|ulonglong __fastcall PrjfEnumerateDirectoryWithMerge(longlong param_1, longlong param_2, longlong param_3, ulonglong param_4, ushort * param_5, undefined4 param_6, byte param_7, uint param_8, longlong * * param_9, int * param_10)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfEnumerateDirectoryWithMerge Called Diff
```diff
--- PrjfEnumerateDirectoryWithMerge called
+++ PrjfEnumerateDirectoryWithMerge called
@@ -13,2 +13,2 @@
-WPP_RECORDER_SF_sDd
-WPP_RECORDER_SF_sDdD
+WPP_RECORDER_AND_TRACE_SF_sDD
+WPP_RECORDER_AND_TRACE_SF_sDdD
@@ -17 +17 @@
-memcpy
+memmove
```
### PrjfEnumerateDirectoryWithMerge Diff
```diff
--- PrjfEnumerateDirectoryWithMerge
+++ PrjfEnumerateDirectoryWithMerge
@@ -1,475 +1,484 @@
/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */
ulonglong PrjfEnumerateDirectoryWithMerge
- (longlong param_1,undefined8 ****param_2,longlong param_3,ulonglong param_4,
- ushort *param_5,undefined4 param_6,byte param_7,uint param_8,longlong param_9,
- uint *param_10)
+ (longlong param_1,longlong param_2,longlong param_3,ulonglong param_4,
+ ushort *param_5,undefined4 param_6,byte param_7,uint param_8,longlong **param_9,
+ int *param_10)
{
- bool bVar1;
- undefined4 uVar2;
- char cVar3;
- uint uVar4;
- uint uVar5;
- uint uVar6;
+ undefined4 uVar1;
+ char cVar2;
+ uint uVar3;
+ ulonglong uVar4;
+ longlong lVar5;
+ byte bVar6;
ulonglong uVar7;
- ulonglong uVar8;
- ulonglong uVar9;
- longlong lVar10;
- undefined8 ******ppppppuVar11;
- ulonglong uVar12;
+ int iVar9;
+ uint uVar10;
+ uint uVar11;
+ int iVar12;
int iVar13;
- undefined2 uVar14;
- uint uVar15;
- undefined1 auStackY_188 [32];
- undefined8 *****local_138;
- uint local_130;
+ bool bVar14;
+ undefined1 auStackY_198 [32];
+ longlong **pplVar15;
+ undefined4 uVar16;
+ ushort uVar17;
+ longlong *local_138;
+ int local_130;
char local_12c;
uint local_128;
longlong local_120;
uint local_118;
int local_114;
undefined1 local_110 [4];
uint local_10c;
undefined4 local_108;
ushort *local_100;
void *local_f8;
longlong local_f0;
- longlong local_e8;
- undefined8 *****local_e0;
- undefined8 *****local_d8;
+ longlong **local_e8;
+ undefined8 ***local_e0;
+ undefined8 ***local_d8;
longlong local_d0;
longlong local_c8;
- undefined8 *****local_c0;
- uint *local_b8;
+ longlong local_c0;
+ int *local_b8;
undefined8 local_b0;
longlong lStack_a8;
undefined8 local_98 [4];
undefined1 *local_78;
undefined4 local_70;
undefined4 local_6c;
- longlong *local_68;
+ longlong ***local_68;
undefined4 local_60;
undefined4 local_5c;
longlong *local_58;
undefined4 local_50;
undefined4 local_4c;
ulonglong local_48;
+ ulonglong uVar8;
- local_48 = __security_cookie ^ (ulonglong)auStackY_188;
+ local_48 = __security_cookie ^ (ulonglong)auStackY_198;
+ uVar8 = 0;
+ uVar7 = 0;
+ local_138 = (longlong *)0x0;
+ local_d0 = 0;
+ iVar12 = 0;
+ local_120 = 0;
+ local_128 = 0;
+ local_114 = 0;
+ local_f8 = (void *)0x0;
+ local_10c = 0;
local_100 = param_5;
local_e8 = param_9;
- uVar7 = 0;
- uVar12 = 0;
- local_138 = (undefined8 ******)0x0;
- local_d0 = 0;
- local_120 = 0;
- local_118 = local_118 & 0xffffff00;
- local_128 = 0;
- local_114 = 0;
- local_130 = 0;
- local_12c = '\0';
- local_f8 = (void *)0x0;
- local_10c = 0;
local_d8 = &local_e0;
local_e0 = &local_e0;
local_b8 = param_10;
+ local_118 = local_118 & 0xffffff00;
+ local_130 = 0;
+ local_12c = '\0';
local_b0 = 0;
lStack_a8 = 0;
local_f0 = param_1;
local_c8 = param_3;
- local_c0 = (undefined8 *****)param_2;
+ local_c0 = param_2;
RtlInitUnicodeString(&local_b0,0);
- cVar3 = PrjfGetContextFileObjectEx(param_2,param_3,&local_120,&local_d0,(longlong *)&local_138);
- lVar10 = local_120;
- uVar15 = (uint)param_4;
- if ((cVar3 == '\0') || ((undefined8 ******)local_138 == (undefined8 ******)0x0)) {
+ pplVar15 = &local_138;
+ cVar2 = PrjfGetContextFileObjectEx(param_2,param_3,&local_120,&local_d0,(longlong *)pplVar15);
+ lVar5 = local_120;
+ uVar11 = (uint)param_4;
+ if ((cVar2 == '\0') || (local_138 == (longlong *)0x0)) {
MicrosoftTelemetryAssertTriggeredMsgKM();
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),3,0x12,0x18,
- &WPP_e21b7c61aee93f730c9c252e6e8da2f4_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\dir.c");
+ if (((DAT_0 & 4) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x312,DAT_0 & 4,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),3,0x12,0x18,
+ &WPP_3d19aee1b05838720427e757513a9608_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\dir.c");
}
*param_10 = 0;
- lVar10 = local_120;
- goto LAB_0;
- }
- if ((int)uVar15 < 0x27) {
- if (uVar15 == 0x26) {
-LAB_1:
- uVar4 = 0x50;
- iVar13 = 0x4e;
- uVar6 = 0x50;
+ lVar5 = local_120;
+ goto LAB_1;
+ }
+ uVar10 = 0x10;
+ if ((int)uVar11 < 0x27) {
+ if (uVar11 == 0x26) {
+LAB_2:
+ uVar10 = 0x50;
+ iVar9 = 0x4e;
+ uVar3 = 0x50;
}
else {
- if (uVar15 == 1) {
- uVar4 = 0x40;
+ if (uVar11 == 1) {
+ uVar10 = 0x40;
}
else {
- if (uVar15 != 2) {
- if (uVar15 == 3) {
- uVar4 = 0x5e;
- iVar13 = 0x3f;
- uVar6 = 0x72;
- }
- else if (uVar15 == 0xc) {
- uVar4 = 0xc;
- iVar13 = (-(uint)(*(char *)(local_d0 + 0x2c) != '\0') & 0x30) + 0xc;
- uVar6 = (-(uint)(*(char *)(local_d0 + 0x2c) != '\0') & 0x4c) + 0xc;
- }
- else if (uVar15 == 0x21) {
- uVar4 = 0x10;
- iVar13 = 0x21;
- uVar6 = 0x10;
+ if (uVar11 != 2) {
+ if (uVar11 == 3) {
+ uVar10 = 0x5e;
+ iVar9 = 0x3f;
+ uVar3 = 0x72;
+ }
+ else if (uVar11 == 0xc) {
+ uVar10 = 0xc;
+ iVar9 = (-(uint)(*(char *)(local_d0 + 0x2c) != '\0') & 0x30) + 0xc;
+ uVar3 = (-(uint)(*(char *)(local_d0 + 0x2c) != '\0') & 0x4c) + 0xc;
+ }
+ else if (uVar11 == 0x21) {
+ iVar9 = 0x21;
+ uVar3 = uVar10;
}
else {
- if (uVar15 != 0x25) goto LAB_2;
- uVar4 = 0x68;
- iVar13 = 0x4f;
- uVar6 = 0x6a;
- }
- goto LAB_3;
- }
- uVar4 = 0x44;
- }
- iVar13 = 0x3c;
- uVar6 = 0x58;
+ if (uVar11 != 0x25) goto LAB_3;
+ uVar10 = 0x68;
+ iVar9 = 0x4f;
+ uVar3 = 0x6a;
+ }
+ goto LAB_4;
+ }
+ uVar10 = 0x44;
+ }
+ iVar9 = 0x3c;
+ uVar3 = 0x58;
}
}
else {
- iVar13 = 0x3c;
- if (uVar15 == 0x3c) {
- uVar4 = 0x58;
- uVar6 = uVar4;
- }
- else if (uVar15 == 0x3f) {
- uVar4 = 0x72;
- iVar13 = 0x3f;
- uVar6 = uVar4;
+ iVar9 = 0x3c;
+ if (uVar11 == 0x3c) {
+ uVar10 = 0x58;
+ uVar3 = uVar10;
+ }
+ else if (uVar11 == 0x3f) {
+ uVar10 = 0x72;
+ iVar9 = 0x3f;
+ uVar3 = uVar10;
}
else {
- if (uVar15 == 0x4e) goto LAB_1;
- if (uVar15 == 0x4f) {
- uVar4 = 0x6a;
- iVar13 = 0x4f;
- uVar6 = uVar4;
- }
- else if (uVar15 == 0x50) {
- uVar4 = 0x60;
- iVar13 = 0x50;
- uVar6 = 0x60;
+ if (uVar11 == 0x4e) goto LAB_2;
+ if (uVar11 == 0x4f) {
+ uVar10 = 0x6a;
+ iVar9 = 0x4f;
+ uVar3 = uVar10;
+ }
+ else if (uVar11 == 0x50) {
+ uVar10 = 0x60;
+ iVar9 = 0x50;
+ uVar3 = 0x60;
}
else {
- if (uVar15 != 0x51) {
-LAB_2:
- uVar12 = 0xc000000d;
- goto LAB_0;
- }
- uVar4 = 0x7a;
- iVar13 = 0x51;
- uVar6 = 0x7a;
- }
- }
- }
+ if (uVar11 != 0x51) {
LAB_3:
- if (param_8 < uVar4) {
- uVar12 = 0xc0000004;
+ uVar7 = 0xc000000d;
+ goto LAB_1;
+ }
+ uVar10 = 0x7a;
+ iVar9 = 0x51;
+ uVar3 = 0x7a;
+ }
+ }
+ }
+LAB_4:
+ if (param_8 < uVar10) {
+ uVar7 = 0xc0000004;
}
else {
- if (uVar15 != 0x21) {
- uVar6 = uVar6 + 0x1fe;
- }
- uVar12 = (ulonglong)uVar6;
- if ((uVar6 <= param_8) && (uVar12 = (ulonglong)param_8, 0x10014 < param_8)) {
- uVar12 = 0x10014;
- }
- if (((local_120 == 0) || (*(int *)(local_120 + 0x40) == 3)) || (uVar15 == 0x21)) {
+ if (uVar11 != 0x21) {
+ uVar3 = uVar3 + 0x1fe;
+ }
+ uVar7 = (ulonglong)uVar3;
+ if ((uVar3 <= param_8) && (uVar7 = (ulonglong)param_8, 0x10014 < param_8)) {
+ uVar7 = 0x10014;
+ }
+ if (((local_120 == 0) || (*(int *)(local_120 + 0x40) == 3)) || (uVar11 == 0x21)) {
if ((param_7 & 1) == 0) {
- if (((((ulonglong)local_138[5] & 8) != 0) && (*(int *)(local_138 + 0xb) != 0)) &&
+ if ((((*(uint *)(local_138 + 5) & 8) != 0) && ((int)local_138[0xb] != 0)) &&
(*(int *)((longlong)local_138 + 0x264) == 0)) {
param_7 = param_7 | 1;
}
}
else {
*(undefined4 *)(local_138 + 0xb) = 0;
*(undefined4 *)((longlong)local_138 + 0x264) = 0;
*(uint *)(local_138 + 5) = *(uint *)(local_138 + 5) | 8;
}
- uVar9 = (ulonglong)local_118;
- uVar8 = uVar7;
- uVar4 = 0;
+ uVar4 = (ulonglong)local_118;
+ iVar13 = 0;
local_108 = param_6;
-LAB_4:
+LAB_5:
do {
- uVar2 = local_108;
- if (((char)uVar9 != '\0') || (param_8 <= (uint)uVar8)) break;
+ uVar1 = local_108;
+ uVar16 = (undefined4)((ulonglong)pplVar15 >> 0x20);
+ if (((char)uVar4 != '\0') || (param_8 <= local_128)) break;
PrjfFreeEnumContexts((longlong *)&local_e0);
- ppppppuVar11 = (undefined8 ******)local_c0;
+ pplVar15 = (longlong **)CONCAT44(uVar16,iVar9);
uVar4 = PrjfPrepareEnumerationContexts
- ((longlong *)&local_e0,(longlong)local_c0,local_c8,uVar12,iVar13,param_7,
+ ((longlong *)&local_e0,local_c0,local_c8,uVar7,iVar9,param_7,
*(int *)((longlong)local_138 + 0x264),0);
- uVar7 = (ulonglong)uVar4;
+ uVar8 = uVar4 & 0xffffffff;
if ((int)uVar4 < 0) {
- uVar12 = uVar7;
- lVar10 = local_120;
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)
- goto LAB_0;
- uVar14 = 0x19;
- goto LAB_5;
- }
- ppppppuVar11 = &local_e0;
- lVar10 = local_f0;
- uVar9 = PrjfEnumerateLayeredDirectories
- (local_f0,(longlong *)ppppppuVar11,local_100,(longlong)local_138 + 0x5c,
- *(int *)((longlong)local_138 + 0x264),uVar2,0);
- uVar7 = uVar9 & 0xffffffff;
- if ((int)uVar9 < 0) {
- uVar12 = uVar7;
- lVar10 = local_120;
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)
- goto LAB_0;
- uVar14 = 0x1a;
- goto LAB_5;
- }
- ppppppuVar11 = &local_e0;
- uVar9 = param_4 & 0xffffffff;
- uVar6 = PrjfMergeEnumerationResults
- (lVar10,ppppppuVar11,uVar15,param_8,local_e8,&local_114,
+ bVar14 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar6 = DAT_6 & 4;
+ if ((bVar6 == 0) && (uVar7 = uVar8, lVar5 = local_120, !bVar14)) goto LAB_1;
+ uVar17 = 0x19;
+ goto LAB_7;
+ }
+ pplVar15 = (longlong **)
+ CONCAT44((int)((ulonglong)pplVar15 >> 0x20),*(int *)((longlong)local_138 + 0x264)
+ );
+ lVar5 = local_f0;
+ uVar4 = PrjfEnumerateLayeredDirectories
+ (local_f0,(longlong *)&local_e0,local_100,(longlong)local_138 + 0x5c,
+ *(int *)((longlong)local_138 + 0x264),uVar1,0);
+ uVar8 = uVar4 & 0xffffffff;
+ if ((int)uVar4 < 0) {
+ bVar14 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar6 = DAT_6 & 4;
+ if ((bVar6 == 0) && (uVar7 = uVar8, lVar5 = local_120, !bVar14)) goto LAB_1;
+ uVar17 = 0x1a;
+ goto LAB_7;
+ }
+ uVar4 = param_4 & 0xffffffff;
+ pplVar15 = local_e8;
+ uVar3 = PrjfMergeEnumerationResults
+ (lVar5,&local_e0,uVar11,param_8,(longlong)local_e8,&local_114,
(longlong *)&local_f8,&local_10c);
- uVar4 = local_10c;
- uVar7 = (ulonglong)uVar6;
- if ((uVar6 == 0x80000006) || (uVar6 == 0xc000000f)) {
-LAB_6:
- uVar9 = CONCAT71((int7)(uVar9 >> 8),1);
+ uVar10 = local_10c;
+ uVar8 = (ulonglong)uVar3;
+ if ((uVar3 == 0x80000006) || (uVar3 == 0xc000000f)) {
+LAB_8:
+ uVar4 = CONCAT71((int7)(uVar4 >> 8),1);
}
else {
- if (uVar6 == 0x80000005) {
- *(int *)(local_138 + 0xb) = *(int *)(local_138 + 0xb) + local_114;
+ if (uVar3 == 0x80000005) {
+ *(int *)(local_138 + 0xb) = (int)local_138[0xb] + local_114;
*(uint *)(local_138 + 5) = *(uint *)(local_138 + 5) | 8;
- goto LAB_6;
- }
- if ((int)uVar6 < 0) {
- uVar12 = uVar7;
- lVar10 = local_120;
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)
- goto LAB_0;
- uVar14 = 0x1b;
- goto LAB_5;
- }
- if (iVar13 == 0x21) {
+ goto LAB_8;
+ }
+ if ((int)uVar3 < 0) {
+ bVar14 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar6 = DAT_6 & 4;
+ if ((bVar6 == 0) && (uVar7 = uVar8, lVar5 = local_120, !bVar14)) goto LAB_1;
+ uVar17 = 0x1b;
+ goto LAB_7;
+ }
+ if (iVar9 == 0x21) {
local_128 = local_128 + local_114;
- uVar8 = (ulonglong)local_128;
- uVar9 = (ulonglong)(local_118 & 0xff);
+ uVar4 = (ulonglong)(local_118 & 0xff);
if (param_8 - local_128 < 0x10) {
- uVar9 = 1;
- }
- local_118 = (uint)uVar9;
+ uVar4 = 1;
+ }
+ local_118 = (uint)uVar4;
if ((param_7 & 2) != 0) {
if (local_128 != 0) {
- uVar9 = 1;
+ uVar4 = 1;
}
- local_118 = (uint)uVar9;
+ local_118 = (uint)uVar4;
}
local_100 = (ushort *)0x0;
local_108 = 0;
param_7 = param_7 & 0xfa;
- uVar4 = local_130;
- goto LAB_4;
+ iVar13 = local_130;
+ goto LAB_5;
}
if (local_10c != 0) {
- uVar9 = (ulonglong)local_10c;
- memcpy((void *)((longlong)local_138 + 0x5c),local_f8,uVar9);
- }
- *(uint *)((longlong)local_138 + 0x264) = uVar4;
+ uVar4 = (ulonglong)local_10c;
+ memmove((void *)((longlong)local_138 + 0x5c),local_f8,uVar4);
+ }
+ *(uint *)((longlong)local_138 + 0x264) = uVar10;
if (local_114 != 0) {
local_128 = local_128 + local_114;
- *(int *)(local_138 + 0xb) = *(int *)(local_138 + 0xb) + local_114;
- goto LAB_6;
+ *(int *)(local_138 + 0xb) = (int)local_138[0xb] + local_114;
+ goto LAB_8;
}
param_7 = param_7 & 0xfe;
- uVar9 = uVar9 & 0xffffffffffffff00;
- }
- uVar8 = (ulonglong)local_128;
- uVar4 = local_130 + local_114;
- local_118 = (uint)uVar9;
- local_130 = uVar4;
- } while (-1 < (int)uVar6);
-LAB_7:
- if (((*(uint *)(local_138 + 5) & 0x10) != 0) && ((int)uVar7 != -0x7ffffffb)) {
- if (((int)uVar7 == -0x7ffffffa) && (*(int *)(local_138 + 0xb) == 0)) {
- uVar7 = 0xc000000f;
+ uVar4 = uVar4 & 0xffffffffffffff00;
+ }
+ iVar13 = local_130 + local_114;
+ local_118 = (uint)uVar4;
+ local_130 = iVar13;
+ } while (-1 < (int)uVar3);
+LAB_9:
+ if (((*(uint *)(local_138 + 5) & 0x10) != 0) && ((int)uVar8 != -0x7ffffffb)) {
+ if (((int)uVar8 == -0x7ffffffa) && ((int)local_138[0xb] == 0)) {
+ uVar8 = 0xc000000f;
}
*(uint *)(local_138 + 5) = *(uint *)(local_138 + 5) & 0xffffffef;
}
- *local_b8 = uVar4;
- uVar12 = uVar7;
- lVar10 = local_120;
+ *local_b8 = iVar13;
+ uVar7 = uVar8;
+ lVar5 = local_120;
}
else if ((param_7 & 4) == 0) {
if ((param_7 & 1) == 0) {
- if (((((ulonglong)local_138[5] & 8) != 0) && (*(int *)(local_138 + 0xb) != 0)) &&
+ if ((((*(uint *)(local_138 + 5) & 8) != 0) && ((int)local_138[0xb] != 0)) &&
(*(int *)((longlong)local_138 + 0x264) == 0)) {
param_7 = param_7 | 1;
}
}
else {
*(undefined4 *)(local_138 + 0xb) = 0;
*(undefined4 *)((longlong)local_138 + 0x264) = 0;
*(uint *)(local_138 + 5) = *(uint *)(local_138 + 5) | 8;
*(uint *)(local_138 + 5) = *(uint *)(local_138 + 5) & 0xffffffdf;
}
+ pplVar15 = (longlong **)0x0;
KeWaitForSingleObject(local_138 + 2,0,0,0);
local_12c = '\x01';
- uVar9 = uVar7;
- uVar6 = local_118;
- if (((ulonglong)local_138[5] & 0x20) == 0) {
-LAB_8:
- uVar4 = local_130;
- if (((char)uVar6 != '\0') || (param_8 <= local_128)) goto LAB_7;
- ppppppuVar11 = (undefined8 ******)local_c0;
+ uVar10 = local_118;
+ if ((*(uint *)(local_138 + 5) & 0x20) == 0) {
+LAB_10:
+ iVar13 = local_130;
+ if (((char)uVar10 != '\0') || (param_8 <= local_128)) goto LAB_9;
+ pplVar15 = (longlong **)CONCAT44((int)((ulonglong)pplVar15 >> 0x20),iVar9);
uVar4 = PrjfPrepareEnumerationContexts
- ((longlong *)local_138,(longlong)local_c0,local_c8,uVar12,iVar13,param_7,
+ (local_138,local_c0,local_c8,uVar7,iVar9,param_7,
*(int *)((longlong)local_138 + 0x264),(longlong)(local_138 + 7));
- uVar7 = (ulonglong)uVar4;
+ uVar8 = uVar4 & 0xffffffff;
if (-1 < (int)uVar4) {
- lVar10 = local_f0;
- ppppppuVar11 = (undefined8 ******)local_138;
- uVar8 = PrjfEnumerateLayeredDirectories
- (local_f0,(longlong *)local_138,local_100,(longlong)local_138 + 0x5c,
+ pplVar15 = (longlong **)
+ CONCAT44((int)((ulonglong)pplVar15 >> 0x20),
+ *(int *)((longlong)local_138 + 0x264));
+ lVar5 = local_f0;
+ uVar4 = PrjfEnumerateLayeredDirectories
+ (local_f0,local_138,local_100,(longlong)local_138 + 0x5c,
*(int *)((longlong)local_138 + 0x264),param_6,(longlong)local_138);
- uVar7 = uVar8 & 0xffffffff;
- if ((int)uVar8 < 0) {
- uVar12 = uVar7;
- lVar10 = local_120;
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)
- goto LAB_0;
- uVar14 = 0x1e;
- goto LAB_5;
- }
- ppppppuVar11 = (undefined8 ******)local_138;
- uVar5 = PrjfMergeEnumerationResults
- (lVar10,local_138,uVar15,param_8,local_e8,&local_114,
+ uVar8 = uVar4 & 0xffffffff;
+ if ((int)uVar4 < 0) {
+ bVar14 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar6 = DAT_6 & 4;
+ if ((bVar6 == 0) && (uVar7 = uVar8, lVar5 = local_120, !bVar14)) goto LAB_1;
+ uVar17 = 0x1e;
+ goto LAB_7;
+ }
+ pplVar15 = local_e8;
+ uVar3 = PrjfMergeEnumerationResults
+ (lVar5,local_138,uVar11,param_8,(longlong)local_e8,&local_114,
(longlong *)&local_f8,&local_10c);
- uVar4 = local_10c;
- uVar7 = (ulonglong)uVar5;
- if ((uVar5 != 0x80000006) && (uVar5 != 0xc000000f)) {
- if (uVar5 == 0x80000005) {
- *(int *)(local_138 + 0xb) = *(int *)(local_138 + 0xb) + local_114;
+ uVar10 = local_10c;
+ uVar8 = (ulonglong)uVar3;
+ if ((uVar3 != 0x80000006) && (uVar3 != 0xc000000f)) {
+ if (uVar3 == 0x80000005) {
+ *(int *)(local_138 + 0xb) = (int)local_138[0xb] + local_114;
*(uint *)(local_138 + 5) = *(uint *)(local_138 + 5) | 8;
- uVar4 = local_130 + local_114;
+ iVar13 = local_130 + local_114;
+ goto LAB_9;
+ }
+ if ((int)uVar3 < 0) {
+ bVar14 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar6 = DAT_6 & 4;
+ if ((bVar6 == 0) && (uVar7 = uVar8, lVar5 = local_120, !bVar14)) goto LAB_1;
+ uVar17 = 0x1f;
goto LAB_7;
}
- if ((int)uVar5 < 0) {
- uVar12 = uVar7;
- lVar10 = local_120;
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)
- goto LAB_0;
- uVar14 = 0x1f;
- goto LAB_5;
- }
if (local_10c != 0) {
- memcpy((void *)((longlong)local_138 + 0x5c),local_f8,(ulonglong)local_10c);
- }
- *(uint *)((longlong)local_138 + 0x264) = uVar4;
+ memmove((void *)((longlong)local_138 + 0x5c),local_f8,(ulonglong)local_10c);
+ }
+ *(uint *)((longlong)local_138 + 0x264) = uVar10;
if (local_114 == 0) {
- if (((ulonglong)local_138[5] & 0x20) != 0) {
- uVar7 = 0xc000000f;
- uVar4 = local_130;
- goto LAB_7;
+ if ((*(uint *)(local_138 + 5) & 0x20) != 0) {
+ uVar8 = 0xc000000f;
+ iVar13 = local_130;
+ goto LAB_9;
}
- PrjfResetEnumContexts((longlong *)local_138,uVar5);
+ PrjfResetEnumContexts(local_138,uVar3);
param_7 = param_7 & 0xfe;
- uVar9 = (ulonglong)local_130;
- uVar6 = 0;
+ iVar12 = local_130;
+ uVar10 = 0;
}
else {
local_128 = local_128 + local_114;
- *(int *)(local_138 + 0xb) = *(int *)(local_138 + 0xb) + local_114;
- uVar9 = (ulonglong)(local_130 + local_114);
- uVar6 = 1;
+ *(int *)(local_138 + 0xb) = (int)local_138[0xb] + local_114;
+ iVar12 = local_130 + local_114;
+ uVar10 = 1;
local_130 = local_130 + local_114;
}
- goto LAB_8;
- }
- uVar4 = (int)uVar9 + local_114;
- uVar9 = (ulonglong)uVar4;
- uVar6 = 1;
- local_130 = uVar4;
- if (-1 < (int)uVar5) goto LAB_8;
- goto LAB_7;
- }
- uVar12 = uVar7;
- lVar10 = local_120;
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0;
- uVar14 = 0x1d;
-LAB_5:
- WPP_RECORDER_SF_sDdD
- (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),ppppppuVar11,0x12,uVar14,
- &WPP_e21b7c61aee93f730c9c252e6e8da2f4_Traceguids,
+ goto LAB_10;
+ }
+ iVar13 = iVar12 + local_114;
+ iVar12 = iVar13;
+ uVar10 = 1;
+ local_130 = iVar13;
+ if (-1 < (int)uVar3) goto LAB_10;
+ goto LAB_9;
+ }
+ bVar14 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar6 = DAT_6 & 4;
+ if ((bVar6 == 0) && (uVar7 = uVar8, lVar5 = local_120, !bVar14)) goto LAB_1;
+ uVar17 = 0x1d;
+LAB_7:
+ WPP_RECORDER_AND_TRACE_SF_sDdD
+ (0x212,bVar6,bVar14,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),pplVar15,0x12,
+ uVar17,&WPP_3d19aee1b05838720427e757513a9608_Traceguids,
"onecore\\base\\fs\\gvflt\\filter\\sys\\dir.c");
- uVar12 = uVar7;
- lVar10 = local_120;
+ uVar7 = uVar8;
+ lVar5 = local_120;
}
else {
- uVar12 = 0x80000006;
- lVar10 = local_120;
+ uVar7 = 0x80000006;
+ lVar5 = local_120;
}
}
else {
- uVar12 = 0xc00000bb;
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),4,0x12,0x1c,
- &WPP_e21b7c61aee93f730c9c252e6e8da2f4_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\dir.c");
- }
- if (5 < DAT_9) {
- if (((_DAT_10 & 0x400000000000) == 0) ||
- ((DAT_11 & 0x400000000000) != DAT_11)) {
- bVar1 = false;
+ uVar7 = 0xc00000bb;
+ if (((DAT_11 & 4) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x412,DAT_11 & 4,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),4,0x12,0x1c,
+ &WPP_3d19aee1b05838720427e757513a9608_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\dir.c");
+ }
+ if (5 < DAT_12) {
+ if (((_DAT_13 & 0x400000000000) == 0) ||
+ ((DAT_14 & 0x400000000000) != DAT_14)) {
+ bVar14 = false;
}
else {
- bVar1 = true;
- }
- lVar10 = local_120;
- if (bVar1) {
+ bVar14 = true;
+ }
+ lVar5 = local_120;
+ if (bVar14) {
local_6c = 0;
local_78 = local_110;
local_5c = 0;
local_4c = 0;
local_68 = &local_e8;
local_110[0] = 4;
local_58 = &local_f0;
local_70 = 1;
- local_e8 = 4;
+ local_e8 = (longlong **)0x4;
local_60 = 8;
local_f0 = 0x1000000;
local_50 = 8;
- _tlgWriteTransfer_EtwWriteTransfer(0x1c0011068,&DAT_12,0,0,5,local_98);
- lVar10 = local_120;
- }
- }
- }
- }
-LAB_0:
+ _tlgWriteTransfer_EtwWriteTransfer(0x14001b068,&DAT_15,0,0,5,local_98);
+ lVar5 = local_120;
+ }
+ }
+ }
+ }
+LAB_1:
PrjfFreeEnumContexts((longlong *)&local_e0);
if (local_12c != '\0') {
- PrjfResetEnumContexts((longlong *)local_138,(int)uVar12);
+ PrjfResetEnumContexts(local_138,(int)uVar7);
KeSetEvent(local_138 + 2,0,0);
}
if (lStack_a8 != 0) {
ExFreePoolWithTag(lStack_a8,0x6e664a50);
}
- if (lVar10 != 0) {
- FltReleaseContext(lVar10);
+ if (lVar5 != 0) {
+ FltReleaseContext(lVar5);
}
if (local_d0 != 0) {
FltReleaseContext(local_d0);
}
- if ((undefined8 ******)local_138 != (undefined8 ******)0x0) {
+ if (local_138 != (longlong *)0x0) {
FltReleaseContext();
}
- return uVar12;
+ return uVar7;
}
```
## PrjfPrepareCommandForFilePath
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.51|
|i_ratio|0.49|
|m_ratio|0.95|
|b_ratio|0.8|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfPrepareCommandForFilePath|PrjfPrepareCommandForFilePath|
|fullname|PrjfPrepareCommandForFilePath|PrjfPrepareCommandForFilePath|
|refcount|7|7|
|`length`|898|1008|
|`called`|NTOSKRNL.EXE::ExAllocateFromPagedLookasideList
NTOSKRNL.EXE::ExAllocatePool2
WPP_RECORDER_SF_sD
WPP_RECORDER_SF_sDd
memcpy
memset|NTOSKRNL.EXE::ExAllocateFromPagedLookasideList
NTOSKRNL.EXE::ExAllocatePool2
WPP_RECORDER_AND_TRACE_SF_sD
WPP_RECORDER_AND_TRACE_SF_sDD
memmove
memset|
|calling|PrjfPrepareCommandForFileObject
PrjfSendCancelCommandInNewThread
PrjfSendEndDirectoryEnumerationCommand
PrjfSendGetPlaceholderInformationCommand
PrjfSendNotifyOperationCommand
PrjfSendQueryFileNameCommand|PrjfPrepareCommandForFileObject
PrjfSendCancelCommandInNewThread
PrjfSendEndDirectoryEnumerationCommand
PrjfSendGetPlaceholderInformationCommand
PrjfSendNotifyOperationCommand
PrjfSendQueryFileNameCommand|
|paramcount|9|9|
|`address`|1c0026be8|140033868|
|sig|undefined8 __fastcall PrjfPrepareCommandForFilePath(ushort * param_1, undefined8 * param_2, uint param_3, ushort * param_4, undefined8 * param_5, longlong param_6, undefined8 * param_7, undefined8 * param_8, uint * param_9)|undefined8 __fastcall PrjfPrepareCommandForFilePath(ushort * param_1, undefined8 * param_2, uint param_3, ushort * param_4, undefined8 * param_5, longlong param_6, undefined8 * param_7, undefined8 * param_8, uint * param_9)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfPrepareCommandForFilePath Called Diff
```diff
--- PrjfPrepareCommandForFilePath called
+++ PrjfPrepareCommandForFilePath called
@@ -3,3 +3,3 @@
-WPP_RECORDER_SF_sD
-WPP_RECORDER_SF_sDd
-memcpy
+WPP_RECORDER_AND_TRACE_SF_sD
+WPP_RECORDER_AND_TRACE_SF_sDD
+memmove
```
### PrjfPrepareCommandForFilePath Diff
```diff
--- PrjfPrepareCommandForFilePath
+++ PrjfPrepareCommandForFilePath
@@ -1,166 +1,174 @@
undefined8
PrjfPrepareCommandForFilePath
(ushort *param_1,undefined8 *param_2,uint param_3,ushort *param_4,undefined8 *param_5,
longlong param_6,undefined8 *param_7,undefined8 *param_8,uint *param_9)
{
uint uVar1;
undefined8 uVar2;
uint *puVar3;
ushort *puVar4;
uint *_Dst;
undefined8 *puVar5;
- ushort uVar6;
- uint *puVar7;
- ushort uVar8;
- longlong lVar10;
+ uint *puVar6;
+ ushort uVar7;
+ longlong lVar9;
+ uint uVar10;
uint uVar11;
- uint uVar12;
- undefined2 uVar13;
- ulonglong uVar9;
+ ushort uVar12;
+ ulonglong uVar8;
if (param_3 == 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) {
+ if (((DAT_0 & 0x40) == 0) &&
+ ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) {
return 0xc000000d;
}
- uVar13 = 0x7a;
-LAB_0:
- WPP_RECORDER_SF_sD(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,uVar13,
- &WPP_3ccab5108a9538d17a865fde27ef339f_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c");
+ uVar12 = 0x84;
+LAB_1:
+ WPP_RECORDER_AND_TRACE_SF_sD
+ (0x20e,DAT_0 & 0x40,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,uVar12,
+ &WPP_39279db927ae337b8503ecc20725ff46_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c");
return 0xc000000d;
}
if (param_9 == (uint *)0x0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) {
+ if (((DAT_0 & 0x40) == 0) &&
+ ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) {
return 0xc000000d;
}
- uVar13 = 0x7b;
- goto LAB_0;
+ uVar12 = 0x85;
+ goto LAB_1;
}
- uVar6 = *param_1;
- uVar9 = 0;
- if (uVar6 >> 1 != 0) {
+ uVar12 = *param_1;
+ uVar8 = 0;
+ if (uVar12 >> 1 != 0) {
do {
- if (*(short *)(*(longlong *)(param_1 + 4) + uVar9 * 2) == 0x3a) {
- uVar6 = (short)uVar9 * 2;
- *param_1 = uVar6;
+ if (*(short *)(*(longlong *)(param_1 + 4) + uVar8 * 2) == 0x3a) {
+ uVar12 = (short)uVar8 * 2;
+ *param_1 = uVar12;
break;
}
- uVar8 = (short)uVar9 + 1;
- uVar9 = (ulonglong)uVar8;
- } while (uVar8 < uVar6 >> 1);
+ uVar7 = (short)uVar8 + 1;
+ uVar8 = (ulonglong)uVar7;
+ } while (uVar7 < uVar12 >> 1);
}
- uVar12 = uVar6 + 0x382;
+ uVar11 = uVar12 + 0x382;
if (param_4 != (ushort *)0x0) {
- uVar12 = uVar12 + *param_4 + 2;
+ uVar11 = uVar11 + *param_4 + 2;
}
if (param_6 == 0) {
if (param_7 != (undefined8 *)0x0) {
puVar4 = (ushort *)*param_7;
- goto LAB_1;
+ goto LAB_2;
}
}
else {
puVar4 = *(ushort **)(param_6 + 0x48);
-LAB_1:
- uVar12 = uVar12 + *puVar4 + 2;
+LAB_2:
+ uVar11 = uVar11 + *puVar4 + 2;
}
- if (uVar12 < 0x791) {
- _Dst = (uint *)ExAllocateFromPagedLookasideList(&DAT_2);
+ if (uVar11 < 0x791) {
+ _Dst = (uint *)ExAllocateFromPagedLookasideList(&DAT_3);
memset(_Dst,0,0x790);
}
else {
- _Dst = (uint *)ExAllocatePool2(0x100,(ulonglong)uVar12,0x62634a50);
+ _Dst = (uint *)ExAllocatePool2(0x100,(ulonglong)uVar11,0x62634a50);
}
if (_Dst == (uint *)0x0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) {
+ if (((DAT_0 & 0x40) == 0) &&
+ ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) {
return 0xc000009a;
}
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0x7c,
- &WPP_3ccab5108a9538d17a865fde27ef339f_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c");
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x20e,DAT_0 & 0x40,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0x86,
+ &WPP_39279db927ae337b8503ecc20725ff46_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c");
return 0xc000009a;
}
- memset(_Dst,0,(ulonglong)uVar12);
+ memset(_Dst,0,(ulonglong)uVar11);
_Dst[1] = param_3;
- *_Dst = uVar12;
+ *_Dst = uVar11;
uVar2 = param_2[1];
*(undefined8 *)(_Dst + 2) = *param_2;
*(undefined8 *)(_Dst + 4) = uVar2;
if (param_5 != (undefined8 *)0x0) {
- lVar10 = 4;
+ lVar9 = 4;
puVar3 = _Dst + 0x50;
do {
- puVar7 = puVar3;
+ puVar6 = puVar3;
puVar5 = param_5;
uVar2 = puVar5[1];
- *(undefined8 *)puVar7 = *puVar5;
- *(undefined8 *)(puVar7 + 2) = uVar2;
+ *(undefined8 *)puVar6 = *puVar5;
+ *(undefined8 *)(puVar6 + 2) = uVar2;
uVar2 = puVar5[3];
- *(undefined8 *)(puVar7 + 4) = puVar5[2];
- *(undefined8 *)(puVar7 + 6) = uVar2;
+ *(undefined8 *)(puVar6 + 4) = puVar5[2];
+ *(undefined8 *)(puVar6 + 6) = uVar2;
uVar2 = puVar5[5];
- *(undefined8 *)(puVar7 + 8) = puVar5[4];
- *(undefined8 *)(puVar7 + 10) = uVar2;
+ *(undefined8 *)(puVar6 + 8) = puVar5[4];
+ *(undefined8 *)(puVar6 + 10) = uVar2;
uVar2 = puVar5[7];
- *(undefined8 *)(puVar7 + 0xc) = puVar5[6];
- *(undefined8 *)(puVar7 + 0xe) = uVar2;
+ *(undefined8 *)(puVar6 + 0xc) = puVar5[6];
+ *(undefined8 *)(puVar6 + 0xe) = uVar2;
uVar2 = puVar5[9];
- *(undefined8 *)(puVar7 + 0x10) = puVar5[8];
- *(undefined8 *)(puVar7 + 0x12) = uVar2;
+ *(undefined8 *)(puVar6 + 0x10) = puVar5[8];
+ *(undefined8 *)(puVar6 + 0x12) = uVar2;
uVar2 = puVar5[0xb];
- *(undefined8 *)(puVar7 + 0x14) = puVar5[10];
- *(undefined8 *)(puVar7 + 0x16) = uVar2;
+ *(undefined8 *)(puVar6 + 0x14) = puVar5[10];
+ *(undefined8 *)(puVar6 + 0x16) = uVar2;
uVar2 = puVar5[0xd];
- *(undefined8 *)(puVar7 + 0x18) = puVar5[0xc];
- *(undefined8 *)(puVar7 + 0x1a) = uVar2;
+ *(undefined8 *)(puVar6 + 0x18) = puVar5[0xc];
+ *(undefined8 *)(puVar6 + 0x1a) = uVar2;
uVar2 = puVar5[0xf];
- *(undefined8 *)(puVar7 + 0x1c) = puVar5[0xe];
- *(undefined8 *)(puVar7 + 0x1e) = uVar2;
- lVar10 = lVar10 + -1;
+ *(undefined8 *)(puVar6 + 0x1c) = puVar5[0xe];
+ *(undefined8 *)(puVar6 + 0x1e) = uVar2;
+ lVar9 = lVar9 + -1;
param_5 = puVar5 + 0x10;
- puVar3 = puVar7 + 0x20;
- } while (lVar10 != 0);
+ puVar3 = puVar6 + 0x20;
+ } while (lVar9 != 0);
uVar2 = puVar5[0x11];
- *(undefined8 *)(puVar7 + 0x20) = puVar5[0x10];
- *(undefined8 *)(puVar7 + 0x22) = uVar2;
+ *(undefined8 *)(puVar6 + 0x20) = puVar5[0x10];
+ *(undefined8 *)(puVar6 + 0x22) = uVar2;
uVar2 = puVar5[0x13];
- *(undefined8 *)(puVar7 + 0x24) = puVar5[0x12];
- *(undefined8 *)(puVar7 + 0x26) = uVar2;
+ *(undefined8 *)(puVar6 + 0x24) = puVar5[0x12];
+ *(undefined8 *)(puVar6 + 0x26) = uVar2;
}
_Dst[0xd9] = (uint)*param_1;
_Dst[0xd8] = 0x380;
- memcpy(_Dst + 0xe0,*(void **)(param_1 + 4),(ulonglong)*param_1);
+ memmove(_Dst + 0xe0,*(void **)(param_1 + 4),(ulonglong)*param_1);
uVar1 = _Dst[0xd9];
- uVar11 = uVar1 + 0x382;
+ uVar10 = uVar1 + 0x382;
if (param_4 != (ushort *)0x0) {
_Dst[0xdb] = (uint)*param_4;
- _Dst[0xda] = uVar11;
- memcpy((void *)((ulonglong)uVar11 + (longlong)_Dst),*(void **)(param_4 + 4),(ulonglong)*param_4)
- ;
- uVar11 = uVar1 + 900 + _Dst[0xdb];
+ _Dst[0xda] = uVar10;
+ memmove((void *)((ulonglong)uVar10 + (longlong)_Dst),*(void **)(param_4 + 4),(ulonglong)*param_4
+ );
+ uVar10 = uVar1 + 900 + _Dst[0xdb];
}
if (param_6 == 0) {
- if (param_7 == (undefined8 *)0x0) goto LAB_3;
+ if (param_7 == (undefined8 *)0x0) goto LAB_4;
_Dst[0xdc] = *(uint *)(param_7 + 1);
_Dst[0xde] = (uint)*(ushort *)*param_7;
- _Dst[0xdd] = uVar11;
+ _Dst[0xdd] = uVar10;
puVar4 = (ushort *)*param_7;
}
else {
uVar2 = *(undefined8 *)(param_6 + 0x40);
*(undefined8 *)(_Dst + 0xb) = *(undefined8 *)(param_6 + 0x38);
*(undefined8 *)(_Dst + 0xd) = uVar2;
_Dst[0xdc] = *(uint *)(param_6 + 0x50);
_Dst[0xde] = (uint)**(ushort **)(param_6 + 0x48);
- _Dst[0xdd] = uVar11;
+ _Dst[0xdd] = uVar10;
puVar4 = *(ushort **)(param_6 + 0x48);
}
- memcpy((void *)((ulonglong)uVar11 + (longlong)_Dst),*(void **)(puVar4 + 4),(ulonglong)*puVar4);
-LAB_3:
+ memmove((void *)((ulonglong)uVar10 + (longlong)_Dst),*(void **)(puVar4 + 4),(ulonglong)*puVar4);
+LAB_4:
*param_8 = _Dst;
- *param_9 = uVar12;
+ *param_9 = uVar11;
return 0;
}
```
## PrjfGetInstanceFromVolumeName
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,sig,address,called|
|ratio|0.2|
|i_ratio|0.22|
|m_ratio|0.66|
|b_ratio|0.59|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfGetInstanceFromVolumeName|PrjfGetInstanceFromVolumeName|
|fullname|PrjfGetInstanceFromVolumeName|PrjfGetInstanceFromVolumeName|
|refcount|3|3|
|`length`|245|519|
|`called`|FLTMGR.SYS::FltGetVolumeFromName
FLTMGR.SYS::FltGetVolumeInstanceFromName
FLTMGR.SYS::FltObjectDereference
WPP_RECORDER_SF_sDd|FLTMGR.SYS::FltGetVolumeFromName
FLTMGR.SYS::FltGetVolumeInstanceFromName
FLTMGR.SYS::FltObjectDereference
Feature_78846265__private_IsEnabledDeviceUsageNoInline
PrjfValidateAndGetGlobalVolumePath
WPP_RECORDER_AND_TRACE_SF_sDD
__security_check_cookie|
|calling|PrjfPortConnect
PrjfSetupVolumeInformationHandler|PrjfPortConnect
PrjfSetupVolumeInformationHandler|
|paramcount|2|2|
|`address`|1c00245a0|1400306b8|
|`sig`|int __fastcall PrjfGetInstanceFromVolumeName(undefined8 param_1, undefined8 param_2)|ulonglong __fastcall PrjfGetInstanceFromVolumeName(wchar_t * param_1, undefined8 param_2)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfGetInstanceFromVolumeName Called Diff
```diff
--- PrjfGetInstanceFromVolumeName called
+++ PrjfGetInstanceFromVolumeName called
@@ -4 +4,4 @@
-WPP_RECORDER_SF_sDd
+Feature_78846265__private_IsEnabledDeviceUsageNoInline
+PrjfValidateAndGetGlobalVolumePath
+WPP_RECORDER_AND_TRACE_SF_sDD
+__security_check_cookie
```
### PrjfGetInstanceFromVolumeName Diff
```diff
--- PrjfGetInstanceFromVolumeName
+++ PrjfGetInstanceFromVolumeName
@@ -1,30 +1,70 @@
-int PrjfGetInstanceFromVolumeName(undefined8 param_1,undefined8 param_2)
+/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
+
+ulonglong PrjfGetInstanceFromVolumeName(wchar_t *param_1,undefined8 param_2)
{
- int iVar1;
- undefined2 uVar2;
- longlong local_res18 [2];
+ uint uVar1;
+ ulonglong uVar2;
+ wchar_t *pwVar3;
+ byte bVar4;
+ bool bVar5;
+ undefined1 auStackY_118 [32];
+ ushort uVar6;
+ longlong local_b8;
+ wchar_t local_b0 [4];
+ undefined1 *puStack_a8;
+ undefined1 local_98 [128];
+ ulonglong local_18;
- local_res18[0] = 0;
- iVar1 = FltGetVolumeFromName(Globals,param_1,local_res18);
- if (iVar1 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0;
- uVar2 = 10;
+ local_18 = __security_cookie ^ (ulonglong)auStackY_118;
+ local_b8 = 0;
+ uVar2 = Feature_78846265__private_IsEnabledDeviceUsageNoInline();
+ if ((int)uVar2 == 0) {
+LAB_0:
+ uVar1 = FltGetVolumeFromName(Globals,param_1,&local_b8);
+ uVar2 = (ulonglong)uVar1;
+ if ((int)uVar1 < 0) {
+ bVar5 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar4 = DAT_1 & 0x40;
+ if ((bVar4 == 0) && (!bVar5)) goto LAB_2;
+ uVar6 = 0xb;
+ }
+ else {
+ uVar1 = FltGetVolumeInstanceFromName(Globals,local_b8,0,param_2);
+ uVar2 = (ulonglong)uVar1;
+ if (-1 < (int)uVar1) goto LAB_2;
+ bVar5 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar4 = DAT_1 & 0x40;
+ if ((bVar4 == 0) && (!bVar5)) goto LAB_2;
+ uVar6 = 0xc;
+ }
}
else {
- iVar1 = FltGetVolumeInstanceFromName(Globals,local_res18[0],0,param_2);
- if ((-1 < iVar1) || ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED))
- goto LAB_0;
- uVar2 = 0xb;
+ local_b0[0] = L'\0';
+ local_b0[1] = L'x';
+ local_b0[2] = L'\0';
+ local_b0[3] = L'\0';
+ puStack_a8 = local_98;
+ pwVar3 = PrjfValidateAndGetGlobalVolumePath(param_1,(ushort *)local_b0);
+ uVar2 = (ulonglong)pwVar3 & 0xffffffff;
+ if (-1 < (int)pwVar3) {
+ param_1 = local_b0;
+ goto LAB_0;
+ }
+ bVar5 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar4 = DAT_1 & 0x40;
+ if ((bVar4 == 0) && (!bVar5)) goto LAB_2;
+ uVar6 = 10;
}
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,uVar2,
- &WPP_3ccab5108a9538d17a865fde27ef339f_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c");
-LAB_0:
- if (local_res18[0] != 0) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x20e,bVar4,bVar5,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,uVar6,
+ &WPP_39279db927ae337b8503ecc20725ff46_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c");
+LAB_2:
+ if (local_b8 != 0) {
FltObjectDereference();
}
- return iVar1;
+ return uVar2;
}
```
## PrjfSetDeleteDisposition
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,sig,address,called|
|ratio|0.12|
|i_ratio|0.19|
|m_ratio|0.91|
|b_ratio|0.47|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfSetDeleteDisposition|PrjfSetDeleteDisposition|
|fullname|PrjfSetDeleteDisposition|PrjfSetDeleteDisposition|
|refcount|4|4|
|`length`|1507|1856|
|`called`|Expand for full list:
FLTMGR.SYS::FltReleaseContext
FLTMGR.SYS::FltSetInformationFile
NTOSKRNL.EXE::ExAcquireRundownProtection
NTOSKRNL.EXE::ExReleaseRundownProtection
NTOSKRNL.EXE::KeClearEvent
NTOSKRNL.EXE::KeSetEvent
NTOSKRNL.EXE::KeWaitForSingleObject
PrjfCheckDirectoryContentReparseTags
PrjfClearAttributes
PrjfGetSetContextFileObject
PrjfGetSetFileContext
PrjfQueryAttributes
PrjfRemoveTombstonesFromDirectory
PrjfRevertInMemoryTombstonesForDirectory
WPP_RECORDER_SF_sD
WPP_RECORDER_SF_sDd
WPP_RECORDER_SF_sDdZ
WPP_RECORDER_SF_sDqd
_tlgDefineProvider_annotation__Tlgmtakm_hTelemetryAssertDiagTrackProvExpand for full list:
FLTMGR.SYS::FltReleaseContext
FLTMGR.SYS::FltSetInformationFile
NTOSKRNL.EXE::ExAcquireRundownProtection
NTOSKRNL.EXE::ExReleaseRundownProtection
NTOSKRNL.EXE::KeClearEvent
NTOSKRNL.EXE::KeSetEvent
NTOSKRNL.EXE::KeWaitForSingleObject
PrjfCheckDirectoryContentReparseTags
PrjfClearAttributes
PrjfGetSetContextFileObject
PrjfGetSetFileContext
PrjfQueryAttributes
PrjfRemoveTombstonesFromDirectory
PrjfRevertInMemoryTombstonesForDirectory
PrjfSleepOnTestSettingFlagsForTests
WPP_RECORDER_AND_TRACE_SF_sD
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDdZ
WPP_RECORDER_AND_TRACE_SF_sDqd
PrjfPostCreate
PrjfUpdatePlaceholderIfNeededHandler|PrjfDeleteFileHandler
PrjfPostCreate
PrjfUpdatePlaceholderIfNeededHandler|
|paramcount|6|6|
|`address`|1c002f98c|14003e00c|
|`sig`|ulonglong __fastcall PrjfSetDeleteDisposition(undefined8 param_1, longlong param_2, uint param_3, char param_4, longlong param_5, undefined4 * param_6)|ulonglong __fastcall PrjfSetDeleteDisposition(undefined8 param_1, longlong param_2, uint param_3, char param_4, undefined8 * param_5, undefined4 * param_6)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfSetDeleteDisposition Called Diff
```diff
--- PrjfSetDeleteDisposition called
+++ PrjfSetDeleteDisposition called
@@ -15,5 +15,5 @@
-WPP_RECORDER_SF_sD
-WPP_RECORDER_SF_sDd
-WPP_RECORDER_SF_sDdZ
-WPP_RECORDER_SF_sDqd
-_tlgDefineProvider_annotation__Tlgmtakm_hTelemetryAssertDiagTrackProv
+PrjfSleepOnTestSettingFlagsForTests
+WPP_RECORDER_AND_TRACE_SF_sD
+WPP_RECORDER_AND_TRACE_SF_sDD
+WPP_RECORDER_AND_TRACE_SF_sDdZ
+WPP_RECORDER_AND_TRACE_SF_sDqd
```
### PrjfSetDeleteDisposition Diff
```diff
--- PrjfSetDeleteDisposition
+++ PrjfSetDeleteDisposition
@@ -1,220 +1,241 @@
ulonglong PrjfSetDeleteDisposition
- (undefined8 param_1,longlong param_2,uint param_3,char param_4,longlong param_5,
- undefined4 *param_6)
+ (undefined8 param_1,longlong param_2,uint param_3,char param_4,
+ undefined8 *param_5,undefined4 *param_6)
{
bool bVar1;
bool bVar2;
bool bVar3;
char cVar4;
uint uVar5;
ulonglong uVar6;
- int iVar7;
- ulonglong uVar8;
- longlong lVar9;
- undefined2 uVar10;
- char cVar11;
+ ulonglong uVar7;
+ byte bVar8;
+ int iVar9;
+ ulonglong uVar10;
+ longlong lVar11;
+ bool bVar12;
uint local_res20 [2];
- char *pcVar12;
- undefined8 uVar13;
- longlong *plVar14;
- undefined1 local_55;
- char local_54;
- longlong local_50;
- undefined4 local_48;
- uint local_44;
+ ulonglong in_stack_ffffffffffffff68;
+ ushort uVar13;
+ undefined4 in_stack_ffffffffffffff94;
+ undefined8 in_stack_ffffffffffffff98;
+ undefined4 uVar14;
+ uint local_50 [2];
+ longlong local_48;
longlong local_40;
+ uVar14 = (undefined4)((ulonglong)in_stack_ffffffffffffff98 >> 0x20);
local_res20[0] = CONCAT31(local_res20[0]._1_3_,param_4);
local_48 = 0;
- local_55 = 0;
- local_50 = 0;
- cVar11 = '\0';
+ bVar12 = true;
local_40 = 0;
- bVar1 = true;
- local_54 = '\0';
+ bVar1 = false;
bVar3 = false;
bVar2 = false;
if (param_4 != '\0') {
- plVar14 = &local_50;
- uVar13 = 0;
- pcVar12 = (char *)0x0;
+ uVar7 = 0;
uVar6 = PrjfGetSetFileContext
(param_1,param_2,'\x01',(longlong *)0x0,(undefined4 *)0x0,(undefined2 *)0x0,
- (undefined1 *)0x0,plVar14);
- uVar8 = uVar6 & 0xffffffff;
- if (-1 < (int)uVar6) goto LAB_0;
- lVar9 = local_50;
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDdZ
- (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0xbc,
- &WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,
+ (undefined1 *)0x0,&local_48);
+ uVar10 = uVar6 & 0xffffffff;
+ if (-1 < (int)uVar6) {
+LAB_0:
+ if (param_5 != (undefined8 *)0x0) {
+ PrjfSleepOnTestSettingFlagsForTests(0x20,param_5,0,0,uVar7);
+ }
+ lVar11 = local_48;
+ KeClearEvent(local_48 + 0x120);
+LAB_1:
+ do {
+ if (bVar12) {
+ uVar7 = CONCAT44((int)(uVar7 >> 0x20),0x40);
+ uVar5 = FltSetInformationFile(param_1,param_2);
+ if ((uVar5 == 0xc000029c) || (uVar5 == 0xc000000d)) goto LAB_2;
+ }
+ else {
+LAB_2:
+ uVar14 = (undefined4)(uVar7 >> 0x20);
+ if (((DAT_3 & 0x40) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sD
+ (0x30e,DAT_3 & 0x40,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),3,0xe,0xc2,
+ &WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
+ }
+ uVar7 = CONCAT44(uVar14,0xd);
+ uVar5 = FltSetInformationFile(param_1,param_2);
+ bVar12 = false;
+ if (((char)local_res20[0] == '\0') && (!bVar2)) {
+ while (cVar4 = ExAcquireRundownProtection(lVar11 + 0x150), cVar4 == '\0') {
+ uVar7 = 0;
+ KeWaitForSingleObject(lVar11 + 0x138,0);
+ }
+ bVar2 = true;
+ }
+ }
+ uVar10 = 0;
+ if (uVar5 != 0xc0000123) {
+ uVar10 = (ulonglong)uVar5;
+ }
+ iVar9 = (int)uVar10;
+ if (iVar9 != -0x3ffffedf) {
+ if (iVar9 == -0x3ffffeff) {
+ if (!bVar3) {
+ if ((param_3 & 4) == 0) {
+ local_res20[0] = 0;
+ uVar5 = PrjfCheckDirectoryContentReparseTags(param_1,param_2,local_res20);
+ if ((int)uVar5 < 0) {
+ if (((DAT_4 & 0x40) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ uVar7 = CONCAT71((int7)(uVar7 >> 8),2);
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x20e,DAT_4 & 0x40,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0xc6,
+ &WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
+ }
+ uVar10 = (ulonglong)uVar5;
+ }
+ else if (local_res20[0] == 4) {
+ *param_6 = 4;
+ }
+ goto LAB_5;
+ }
+ uVar6 = PrjfRemoveTombstonesFromDirectory(param_1,param_2);
+ uVar10 = uVar6 & 0xffffffff;
+ if ((int)uVar6 < 0) {
+ if (((DAT_4 & 0x40) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ uVar7 = CONCAT71((int7)(uVar7 >> 8),2);
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x20e,DAT_4 & 0x40,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0xc5,
+ &WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
+ }
+ goto LAB_5;
+ }
+ bVar3 = true;
+ goto LAB_1;
+ }
+ }
+ else if (-1 < iVar9) {
+ *(undefined1 *)(lVar11 + 0x11a) = 1;
+ goto LAB_5;
+ }
+LAB_6:
+ bVar12 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar8 = DAT_4 & 0x40;
+ if (((DAT_4 & 0x40) == 0) && (!bVar12)) goto LAB_14003e62b;
+ uVar13 = 199;
+ goto LAB_7;
+ }
+ if (bVar1) goto LAB_6;
+ local_50[0] = 0;
+ uVar5 = PrjfQueryAttributes(param_2,param_1,local_50);
+ if ((int)uVar5 < 0) {
+ uVar10 = (ulonglong)uVar5;
+ bVar12 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar8 = DAT_4 & 0x40;
+ if (((DAT_4 & 0x40) == 0) && (!bVar12)) goto LAB_14003e62b;
+ uVar13 = 0xc3;
+ goto LAB_7;
+ }
+ if ((local_50[0] & 1) == 0) goto LAB_6;
+ if ((param_3 & 0x20) == 0) {
+ *param_6 = 8;
+ goto LAB_5;
+ }
+ uVar5 = PrjfClearAttributes(param_2,param_1,1);
+ uVar10 = (ulonglong)uVar5;
+ if ((int)uVar5 < 0) goto LAB_8;
+ bVar1 = true;
+ } while( true );
+ }
+ if (((DAT_4 & 0x40) != 0) ||
+ (lVar11 = local_48, (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ uVar7 = CONCAT71((int7)(uVar7 >> 8),2);
+ WPP_RECORDER_AND_TRACE_SF_sDdZ
+ (0x20e,DAT_4 & 0x40,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0xc1,
+ &WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
"onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",
- CONCAT44((int)((ulonglong)uVar13 >> 0x20),0x2017),
- CONCAT44((int)((ulonglong)plVar14 >> 0x20),(int)uVar6),(wchar_t *)(param_2 + 0x58))
- ;
- lVar9 = local_50;
- }
- goto LAB_1;
- }
- plVar14 = &local_50;
- uVar13 = 0;
- pcVar12 = (char *)0x0;
+ CONCAT44(in_stack_ffffffffffffff94,0x20a0),CONCAT44(uVar14,(int)uVar6),
+ (wchar_t *)(param_2 + 0x58));
+ lVar11 = local_48;
+ }
+ goto LAB_9;
+ }
+ uVar7 = in_stack_ffffffffffffff68 & 0xffffffffffffff00;
uVar5 = PrjfGetSetContextFileObject
(param_1,param_2,-0x80000000,'\0','\0',(undefined4 *)0x0,(undefined2 *)0x0,
- plVar14,&local_40);
- uVar8 = (ulonglong)uVar5;
- if (-1 < (int)uVar5) {
-LAB_0:
- if (param_5 != 0) {
- _tlgDefineProvider_annotation__Tlgmtakm_hTelemetryAssertDiagTrackProv();
- }
- lVar9 = local_50;
- KeClearEvent(local_50 + 0x120);
-LAB_2:
- do {
- if (bVar1) {
- local_48 = 3;
- uVar5 = FltSetInformationFile(param_1,param_2,&local_48,4,0x40);
- if ((uVar5 == 0xc000029c) || (uVar5 == 0xc000000d)) goto LAB_3;
- }
- else {
-LAB_3:
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- uVar13 = 0x2052;
- pcVar12 = "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c";
- WPP_RECORDER_SF_sD(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),3,0xe,0xbd,
- &WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
- }
- local_55 = 1;
- uVar5 = FltSetInformationFile(param_1,param_2,&local_55,1,0xd,pcVar12,uVar13);
- bVar1 = false;
- if (((char)local_res20[0] == '\0') && (!bVar2)) {
- cVar4 = ExAcquireRundownProtection(lVar9 + 0x150);
- while (cVar4 == '\0') {
- KeWaitForSingleObject(lVar9 + 0x138,0,0,0,0);
- cVar4 = ExAcquireRundownProtection(lVar9 + 0x150);
- cVar11 = local_54;
- }
- bVar2 = true;
- }
- }
- uVar8 = 0;
- if (uVar5 != 0xc0000123) {
- uVar8 = (ulonglong)uVar5;
- }
- iVar7 = (int)uVar8;
- if (iVar7 != -0x3ffffedf) {
- if (iVar7 == -0x3ffffeff) {
- if (!bVar3) {
- if ((param_3 & 4) == 0) {
- local_res20[0] = 0;
- uVar5 = PrjfCheckDirectoryContentReparseTags(param_1,param_2,local_res20);
- if ((int)uVar5 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0xc1,
- &WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
- }
- uVar8 = (ulonglong)uVar5;
- }
- else if (local_res20[0] == 4) {
- *param_6 = 4;
- }
- goto LAB_4;
- }
- uVar6 = PrjfRemoveTombstonesFromDirectory(param_1,param_2);
- uVar8 = uVar6 & 0xffffffff;
- if ((int)uVar6 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0xc0,
- &WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
- }
- goto LAB_4;
- }
- bVar3 = true;
- goto LAB_2;
- }
- }
- else if (-1 < iVar7) {
- *(undefined1 *)(lVar9 + 0x11a) = 1;
- goto LAB_4;
- }
+ &local_48,&local_40);
+ uVar10 = (ulonglong)uVar5;
+ if (-1 < (int)uVar5) goto LAB_0;
+ if (((DAT_4 & 0x40) != 0) ||
+ (lVar11 = local_48, (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ uVar7 = CONCAT71((int7)(uVar7 >> 8),2);
+ WPP_RECORDER_AND_TRACE_SF_sDdZ
+ (0x20e,DAT_4 & 0x40,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0xc0,
+ &WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",
+ CONCAT44(in_stack_ffffffffffffff94,0x2086),CONCAT44(uVar14,uVar5),
+ (wchar_t *)(param_2 + 0x58));
+ lVar11 = local_48;
+ }
+ goto LAB_10;
+LAB_8:
+ bVar12 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar8 = DAT_4 & 0x40;
+ if (((DAT_4 & 0x40) != 0) || (bVar12)) {
+ uVar13 = 0xc4;
+LAB_7:
+ uVar7 = CONCAT71((int7)(uVar7 >> 8),2);
+ WPP_RECORDER_AND_TRACE_SF_sDqd
+ (0x20e,bVar8,bVar12,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,uVar13,
+ &WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
+ }
LAB_5:
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_4;
- uVar10 = 0xc2;
- goto LAB_6;
- }
- if (cVar11 != '\0') goto LAB_5;
- local_44 = 0;
- uVar5 = PrjfQueryAttributes(param_2,param_1,&local_44);
- if ((int)uVar5 < 0) {
- uVar8 = (ulonglong)uVar5;
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_4;
- uVar10 = 0xbe;
- goto LAB_6;
- }
- if ((local_44 & 1) == 0) goto LAB_5;
- if ((param_3 & 0x20) == 0) {
- *param_6 = 8;
- goto LAB_4;
- }
- uVar5 = PrjfClearAttributes(param_2,param_1,1);
- uVar8 = (ulonglong)uVar5;
- if ((int)uVar5 < 0) goto LAB_7;
- cVar11 = '\x01';
- local_54 = '\x01';
- } while( true );
- }
- lVar9 = local_50;
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDdZ
- (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0xbb,
- &WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",
- CONCAT44((int)((ulonglong)uVar13 >> 0x20),0x1ffd),
- CONCAT44((int)((ulonglong)plVar14 >> 0x20),uVar5),(wchar_t *)(param_2 + 0x58));
- lVar9 = local_50;
- }
- goto LAB_8;
-LAB_7:
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- uVar10 = 0xbf;
-LAB_6:
- WPP_RECORDER_SF_sDqd
- (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,uVar10,
- &WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
- }
-LAB_4:
- KeSetEvent(lVar9 + 0x120,0,0);
+ KeSetEvent(lVar11 + 0x120,0);
if (bVar2) {
- ExReleaseRundownProtection(lVar9 + 0x150);
- }
-LAB_8:
+ ExReleaseRundownProtection(lVar11 + 0x150);
+ }
+LAB_10:
if (local_40 != 0) {
FltReleaseContext();
}
-LAB_1:
- if (lVar9 != 0) {
- FltReleaseContext(lVar9);
- }
- if (((int)uVar8 < 0) && (bVar3)) {
- if (param_5 != 0) {
- _tlgDefineProvider_annotation__Tlgmtakm_hTelemetryAssertDiagTrackProv();
- }
- uVar6 = PrjfRevertInMemoryTombstonesForDirectory(param_1,param_2);
- if (((int)uVar6 < 0) &&
- (uVar8 = uVar6 & 0xffffffff,
- (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0xc3,
- &WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
- }
- }
- return uVar8;
+LAB_9:
+ if (lVar11 != 0) {
+ FltReleaseContext(lVar11);
+ }
+ if (((int)uVar10 < 0) && (bVar3)) {
+ if (param_5 != (undefined8 *)0x0) {
+ PrjfSleepOnTestSettingFlagsForTests(0x200,param_5,0,0,uVar7);
+ }
+ uVar7 = PrjfRevertInMemoryTombstonesForDirectory(param_1,param_2);
+ if ((int)uVar7 < 0) {
+ uVar10 = uVar7 & 0xffffffff;
+ if (((DAT_4 & 0x40) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x20e,DAT_4 & 0x40,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,200,
+ &WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
+ }
+ }
+ }
+ return uVar10;
}
```
## PrjfProcessPreRenameOrLinkInformation
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.1|
|i_ratio|0.09|
|m_ratio|0.86|
|b_ratio|0.22|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfProcessPreRenameOrLinkInformation|PrjfProcessPreRenameOrLinkInformation|
|fullname|PrjfProcessPreRenameOrLinkInformation|PrjfProcessPreRenameOrLinkInformation|
|refcount|3|3|
|`length`|1394|1845|
|`called`|Expand for full list:
FLTMGR.SYS::FltGetFileNameInformation
FLTMGR.SYS::FltGetRequestorProcess
FLTMGR.SYS::FltReleaseFileNameInformation
MicrosoftTelemetryAssertTriggeredNoArgsKM
PrjfCleanUpRenameLinkTargetTombstone
PrjfCreateRenameOrLinkCompletionContext
PrjfNotifyRenameOrLinkOperation
PrjfPopulateDestinationForRenameOrLink
PrjfPrepareSourceForRename
PrjfReleaseRenameOrLinkCompletionContext
PrjfRemoveInMemoryTombstone
PrjfSetParentPlaceHolderFlagsSynchronized
PrjfSetPlaceHolderFlagsSynchronized
PrjfTelemetryTombstoneFailureOperation
WPP_RECORDER_SF_sDd
WPP_RECORDER_SF_sDdDExpand for full list:
FLTMGR.SYS::FltGetFileNameInformation
FLTMGR.SYS::FltGetRequestorProcess
FLTMGR.SYS::FltReleaseFileNameInformation
MicrosoftTelemetryAssertTriggeredNoArgsKM
PrjfCleanUpRenameLinkTargetTombstone
PrjfCreateRenameOrLinkCompletionContext
PrjfNotifyRenameOrLinkOperation
PrjfPopulateDestinationForRenameOrLink
PrjfPrepareSourceForRename
PrjfReleaseRenameOrLinkCompletionContext
PrjfRemoveInMemoryTombstone
PrjfSetParentPlaceHolderFlagsSynchronized
PrjfSetPlaceHolderFlagsSynchronized
PrjfTelemetryTombstoneFailureOperation
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDdD
PrjfPreSetRenameInformation|PrjfPreSetLinkInformation
PrjfPreSetRenameInformation|
|paramcount|5|5|
|`address`|1c0021ae0|14002d09c|
|sig|ulonglong __fastcall PrjfProcessPreRenameOrLinkInformation(longlong param_1, longlong param_2, longlong param_3, uint param_4, undefined8 * param_5)|ulonglong __fastcall PrjfProcessPreRenameOrLinkInformation(longlong param_1, longlong param_2, longlong param_3, uint param_4, undefined8 * param_5)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfProcessPreRenameOrLinkInformation Called Diff
```diff
--- PrjfProcessPreRenameOrLinkInformation called
+++ PrjfProcessPreRenameOrLinkInformation called
@@ -15,2 +15,2 @@
-WPP_RECORDER_SF_sDd
-WPP_RECORDER_SF_sDdD
+WPP_RECORDER_AND_TRACE_SF_sDD
+WPP_RECORDER_AND_TRACE_SF_sDdD
```
### PrjfProcessPreRenameOrLinkInformation Diff
```diff
--- PrjfProcessPreRenameOrLinkInformation
+++ PrjfProcessPreRenameOrLinkInformation
@@ -1,177 +1,243 @@
ulonglong PrjfProcessPreRenameOrLinkInformation
(longlong param_1,longlong param_2,longlong param_3,uint param_4,
undefined8 *param_5)
{
- longlong *plVar1;
- longlong *plVar2;
+ longlong ***ppplVar1;
+ longlong ***ppplVar2;
uint uVar3;
int iVar4;
- ulonglong uVar5;
- longlong lVar6;
- longlong lVar7;
- longlong *plVar8;
+ longlong **pplVar5;
+ ulonglong uVar6;
+ byte bVar7;
+ longlong ****pppplVar8;
ulonglong uVar9;
- undefined8 uVar10;
- char cVar11;
- undefined2 uVar12;
- longlong *local_28;
- longlong local_20;
+ longlong ****pppplVar10;
+ undefined8 uVar11;
+ char cVar12;
+ bool bVar13;
+ longlong ****in_stack_ffffffffffffff88;
+ ushort uVar14;
+ longlong ***local_38;
+ longlong ***local_30;
- local_20 = 0;
- plVar8 = (longlong *)0x0;
- local_28 = (longlong *)0x0;
- uVar3 = FltGetFileNameInformation(param_1,0x101,&local_20);
+ local_30 = (longlong ***)0x0;
+ local_38 = (longlong ***)0x0;
+ uVar3 = FltGetFileNameInformation(param_1,0x101,&local_30);
uVar9 = (ulonglong)uVar3;
if ((int)uVar3 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,9,0xc,
- &WPP_9aa94875f0ba3c84ae0a423dcca6636f_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\fileinfo.c");
- }
- }
- else {
- lVar7 = local_20;
- uVar5 = PrjfCreateRenameOrLinkCompletionContext
- (param_1,*(undefined8 *)(param_2 + 0x18),local_20,param_3,&local_28);
- plVar8 = local_28;
- uVar3 = (uint)lVar7;
- uVar9 = uVar5 & 0xffffffff;
- if ((int)uVar5 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xd,0xd,
- &WPP_9aa94875f0ba3c84ae0a423dcca6636f_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\fileinfo.c");
- plVar8 = local_28;
- }
- }
- else {
- if (local_28 == (longlong *)0x0) goto LAB_0;
- if ((local_28[7] == 0) && (*local_28 == 0)) {
- MicrosoftTelemetryAssertTriggeredNoArgsKM();
- }
- if (plVar8[7] == 0) {
-LAB_1:
- plVar1 = (longlong *)*plVar8;
- if (param_4 != 0x20) goto LAB_2;
- if (plVar1 != (longlong *)0x0) {
- plVar2 = (longlong *)plVar8[7];
- if (((plVar2 == (longlong *)0x0) || (*plVar1 != *plVar2)) || (plVar1[1] != plVar2[1])) {
- cVar11 = '\0';
- }
- else {
- cVar11 = '\x01';
- }
- uVar10 = *(undefined8 *)(param_2 + 0x20);
- uVar5 = PrjfPrepareSourceForRename
- (param_1,*(undefined8 *)(param_2 + 0x18),uVar10,cVar11,local_20,
- (longlong)plVar8);
- uVar3 = (uint)uVar10;
- uVar9 = uVar5 & 0xffffffff;
- if ((int)uVar5 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)
- goto LAB_3;
- uVar12 = 0x10;
- goto LAB_4;
- }
- }
- uVar5 = PrjfSetParentPlaceHolderFlagsSynchronized
- (param_1,*(undefined8 *)(param_2 + 0x18),uVar3);
- uVar9 = uVar5 & 0xffffffff;
- if (-1 < (int)uVar5) {
- uVar3 = PrjfSetPlaceHolderFlagsSynchronized
- (param_1,*(undefined8 *)(param_2 + 0x18),
- *(longlong *)(*(longlong *)(param_1 + 0x10) + 8),8);
- uVar9 = (ulonglong)uVar3;
- if (-1 < (int)uVar3) goto LAB_2;
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- uVar12 = 0x12;
- goto LAB_4;
- }
- goto LAB_3;
- }
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_3;
- uVar12 = 0x11;
- }
- else {
- if (param_4 != 0x40) {
-LAB_5:
- uVar5 = PrjfPopulateDestinationForRenameOrLink
- (param_1,*(undefined8 *****)(param_2 + 0x18),param_3,(longlong)plVar8);
- uVar3 = (uint)param_3;
- uVar9 = uVar5 & 0xffffffff;
- if (-1 < (int)uVar5) goto LAB_1;
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)
- goto LAB_3;
- uVar12 = 0xe;
- goto LAB_4;
- }
- lVar7 = plVar8[7];
- lVar6 = FltGetRequestorProcess(param_1);
- if ((*(longlong *)(lVar7 + 0x20) != lVar6) || ((*(uint *)(lVar7 + 800) & 0x400) != 0))
- goto LAB_5;
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),4,0xd,0xf,
- &WPP_9aa94875f0ba3c84ae0a423dcca6636f_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\fileinfo.c");
- }
-LAB_2:
- iVar4 = PrjfSetPlaceHolderFlagsSynchronized
- (param_1,*(undefined8 *)(param_2 + 0x18),plVar8[10],2);
- if ((iVar4 < 0) && ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xd,0x13,
- &WPP_9aa94875f0ba3c84ae0a423dcca6636f_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\fileinfo.c");
- }
- uVar5 = PrjfNotifyRenameOrLinkOperation
- (param_1,*(undefined8 *)(param_2 + 0x18),*(longlong **)(param_2 + 0x20),
- param_4,plVar8);
- uVar9 = uVar5 & 0xffffffff;
- if (-1 < (int)uVar5) {
- *param_5 = plVar8;
- plVar8 = (longlong *)0x0;
- goto LAB_0;
- }
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_3;
- uVar12 = 0x14;
- }
-LAB_4:
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xd,uVar12,
- &WPP_9aa94875f0ba3c84ae0a423dcca6636f_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\fileinfo.c");
- }
- }
-LAB_3:
- if (plVar8 != (longlong *)0x0) {
- if (((plVar8[7] != 0) &&
- (lVar7 = param_2,
- uVar5 = PrjfCleanUpRenameLinkTargetTombstone(param_1,param_2,(longlong)plVar8,'\x01'),
- (int)uVar5 < 0)) && ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
- WPP_RECORDER_SF_sDdD
- (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),lVar7,0x13,0x15,
+ if (((DAT_0 & 2) != 0) ||
+ (pppplVar8 = (longlong ****)0x0,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ in_stack_ffffffffffffff88 =
+ (longlong ****)CONCAT71((int7)((ulonglong)in_stack_ffffffffffffff88 >> 8),2);
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x209,DAT_0 & 2,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,9,0xc,
&WPP_9aa94875f0ba3c84ae0a423dcca6636f_Traceguids,
"onecore\\base\\fs\\gvflt\\filter\\sys\\fileinfo.c");
- }
- if ((((*plVar8 != 0) && (lVar7 = plVar8[4], lVar7 != 0)) && (plVar8[3] != 0)) &&
- (uVar5 = PrjfRemoveInMemoryTombstone(*(undefined8 *)(param_2 + 0x18),lVar7,plVar8[3]),
- (int)uVar5 < 0)) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDdD
- (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),lVar7,6,0x16,
+ pppplVar8 = (longlong ****)0x0;
+ }
+ }
+ else {
+ in_stack_ffffffffffffff88 = &local_38;
+ pppplVar10 = (longlong ****)local_30;
+ uVar6 = PrjfCreateRenameOrLinkCompletionContext
+ (param_1,*(undefined8 *)(param_2 + 0x18),(longlong)local_30,param_3,
+ in_stack_ffffffffffffff88);
+ pppplVar8 = (longlong ****)local_38;
+ uVar9 = uVar6 & 0xffffffff;
+ if ((int)uVar6 < 0) {
+ if (((DAT_0 & 0x20) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ in_stack_ffffffffffffff88 =
+ (longlong ****)CONCAT71((int7)((ulonglong)in_stack_ffffffffffffff88 >> 8),2);
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x20d,DAT_0 & 0x20,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xd,0xd,
+ &WPP_9aa94875f0ba3c84ae0a423dcca6636f_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\fileinfo.c");
+ pppplVar8 = (longlong ****)local_38;
+ }
+ }
+ else {
+ if ((longlong ****)local_38 == (longlong ****)0x0) goto LAB_1;
+ if (((longlong ***)local_38[7] == (longlong ***)0x0) &&
+ ((longlong ***)*local_38 == (longlong ***)0x0)) {
+ MicrosoftTelemetryAssertTriggeredNoArgsKM();
+ }
+ uVar3 = (uint)pppplVar10;
+ if (pppplVar8[7] == (longlong ***)0x0) {
+LAB_2:
+ ppplVar1 = *pppplVar8;
+ if (param_4 == 0x20) {
+ if (ppplVar1 != (longlong ***)0x0) {
+ ppplVar2 = pppplVar8[7];
+ if (((ppplVar2 == (longlong ***)0x0) || (*ppplVar1 != *ppplVar2)) ||
+ (ppplVar1[1] != ppplVar2[1])) {
+ cVar12 = '\0';
+ }
+ else {
+ cVar12 = '\x01';
+ }
+ uVar11 = *(undefined8 *)(param_2 + 0x20);
+ in_stack_ffffffffffffff88 = (longlong ****)local_30;
+ uVar6 = PrjfPrepareSourceForRename
+ (param_1,*(undefined8 *)(param_2 + 0x18),uVar11,cVar12,
+ (longlong)local_30,(longlong)pppplVar8);
+ uVar3 = (uint)uVar11;
+ uVar9 = uVar6 & 0xffffffff;
+ if ((int)uVar6 < 0) {
+ bVar13 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar7 = DAT_0 & 0x20;
+ if ((bVar7 == 0) && (!bVar13)) goto LAB_3;
+ uVar14 = 0x10;
+ goto LAB_4;
+ }
+ }
+ uVar6 = PrjfSetParentPlaceHolderFlagsSynchronized
+ (param_1,*(undefined8 *)(param_2 + 0x18),uVar3);
+ uVar9 = uVar6 & 0xffffffff;
+ if ((int)uVar6 < 0) {
+ bVar13 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar7 = DAT_0 & 0x20;
+ if ((bVar7 != 0) || (bVar13)) {
+ uVar14 = 0x11;
+ goto LAB_4;
+ }
+ }
+ else {
+ uVar3 = PrjfSetPlaceHolderFlagsSynchronized
+ (param_1,*(undefined8 *)(param_2 + 0x18),
+ *(longlong *)(*(longlong *)(param_1 + 0x10) + 8),8);
+ uVar9 = (ulonglong)uVar3;
+ if (-1 < (int)uVar3) goto LAB_5;
+ bVar13 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar7 = DAT_0 & 0x20;
+ if ((bVar7 != 0) || (bVar13)) {
+ uVar14 = 0x12;
+ goto LAB_4;
+ }
+ }
+ }
+ else {
+LAB_5:
+ iVar4 = PrjfSetPlaceHolderFlagsSynchronized
+ (param_1,*(undefined8 *)(param_2 + 0x18),(longlong)pppplVar8[10],2);
+ if (iVar4 < 0) {
+ if (((DAT_0 & 0x20) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x20d,DAT_0 & 0x20,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xd,0x13,
+ &WPP_9aa94875f0ba3c84ae0a423dcca6636f_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\fileinfo.c");
+ }
+ }
+ in_stack_ffffffffffffff88 = pppplVar8;
+ uVar6 = PrjfNotifyRenameOrLinkOperation
+ (param_1,*(undefined8 *)(param_2 + 0x18),*(longlong **)(param_2 + 0x20),
+ param_4,(longlong *)pppplVar8);
+ uVar9 = uVar6 & 0xffffffff;
+ if (-1 < (int)uVar6) {
+ *param_5 = pppplVar8;
+ pppplVar8 = (longlong ****)0x0;
+ goto LAB_1;
+ }
+ if (((DAT_0 & 0x20) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ in_stack_ffffffffffffff88 =
+ (longlong ****)CONCAT71((int7)((ulonglong)in_stack_ffffffffffffff88 >> 8),2);
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x20d,DAT_0 & 0x20,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xd,0x14,
+ &WPP_9aa94875f0ba3c84ae0a423dcca6636f_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\fileinfo.c");
+ }
+ }
+ }
+ else {
+ if (param_4 == 0x40) {
+ ppplVar1 = pppplVar8[7];
+ pplVar5 = (longlong **)FltGetRequestorProcess(param_1);
+ if ((ppplVar1[4] == pplVar5) && (((ulonglong)ppplVar1[100] & 0x400) == 0)) {
+ bVar13 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ uVar3 = (uint)CONCAT71((int7)((ulonglong)pppplVar10 >> 8),bVar13);
+ if (((DAT_6 & 0x20) != 0) || (bVar13)) {
+ in_stack_ffffffffffffff88 =
+ (longlong ****)CONCAT71((int7)((ulonglong)in_stack_ffffffffffffff88 >> 8),4);
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x40d,DAT_6 & 0x20,bVar13,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),4,0xd,0xf,
+ &WPP_9aa94875f0ba3c84ae0a423dcca6636f_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\fileinfo.c");
+ }
+ goto LAB_2;
+ }
+ }
+ uVar6 = PrjfPopulateDestinationForRenameOrLink
+ (param_1,*(longlong *)(param_2 + 0x18),param_3,(longlong)pppplVar8);
+ uVar3 = (uint)param_3;
+ uVar9 = uVar6 & 0xffffffff;
+ if (-1 < (int)uVar6) goto LAB_2;
+ bVar13 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar7 = DAT_0 & 0x20;
+ if ((bVar7 == 0) && (!bVar13)) goto LAB_3;
+ uVar14 = 0xe;
+LAB_4:
+ in_stack_ffffffffffffff88 =
+ (longlong ****)CONCAT71((int7)((ulonglong)in_stack_ffffffffffffff88 >> 8),2);
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x20d,bVar7,bVar13,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xd,uVar14,
+ &WPP_9aa94875f0ba3c84ae0a423dcca6636f_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\fileinfo.c");
+ }
+ }
+ }
+LAB_3:
+ if (pppplVar8 != (longlong ****)0x0) {
+ if ((pppplVar8[7] != (longlong ***)0x0) &&
+ (uVar6 = PrjfCleanUpRenameLinkTargetTombstone(param_1,param_2,(longlong)pppplVar8,'\x01'),
+ (int)uVar6 < 0)) {
+ if (((DAT_7 & 8) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDdD
+ (0x213,DAT_7 & 8,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),in_stack_ffffffffffffff88,0x13,0x15,
+ &WPP_9aa94875f0ba3c84ae0a423dcca6636f_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\fileinfo.c");
+ }
+ }
+ if ((((*pppplVar8 != (longlong ***)0x0) && (pppplVar8[4] != (longlong ***)0x0)) &&
+ (pppplVar8[3] != (longlong ***)0x0)) &&
+ (uVar6 = PrjfRemoveInMemoryTombstone
+ (*(undefined8 *)(param_2 + 0x18),(longlong)pppplVar8[4],
+ (longlong)pppplVar8[3]), (int)uVar6 < 0)) {
+ if (((DAT_8 & 0x40) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDdD
+ (0x206,DAT_8 & 0x40,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),in_stack_ffffffffffffff88,6,0x16,
&WPP_9aa94875f0ba3c84ae0a423dcca6636f_Traceguids,
"onecore\\base\\fs\\gvflt\\filter\\sys\\fileinfo.c");
}
PrjfTelemetryTombstoneFailureOperation(2,9,(int)uVar9);
}
}
-LAB_0:
- if (local_20 != 0) {
+LAB_1:
+ if ((longlong ****)local_30 != (longlong ****)0x0) {
FltReleaseFileNameInformation();
}
- if (plVar8 != (longlong *)0x0) {
- PrjfReleaseRenameOrLinkCompletionContext(plVar8);
+ if (pppplVar8 != (longlong ****)0x0) {
+ PrjfReleaseRenameOrLinkCompletionContext((longlong *)pppplVar8);
}
return uVar9;
}
```
## PrjfCheckAndCancelTransactedOpen
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.8|
|i_ratio|0.54|
|m_ratio|0.95|
|b_ratio|0.94|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfCheckAndCancelTransactedOpen|PrjfCheckAndCancelTransactedOpen|
|fullname|PrjfCheckAndCancelTransactedOpen|PrjfCheckAndCancelTransactedOpen|
|refcount|4|4|
|`length`|527|587|
|`called`|FLTMGR.SYS::FltCancelFileOpen
FLTMGR.SYS::FltRollbackEnlistment
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::IoGetTransactionParameterBlock
WPP_RECORDER_SF_sDd
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer|FLTMGR.SYS::FltCancelFileOpen
FLTMGR.SYS::FltRollbackEnlistment
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::IoGetTransactionParameterBlock
WPP_RECORDER_AND_TRACE_SF_sDD
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer|
|calling|PrjfPostCreate|PrjfPostCreate|
|paramcount|2|2|
|`address`|1c0018ccc|140022ea8|
|sig|undefined8 __fastcall PrjfCheckAndCancelTransactedOpen(longlong param_1, longlong param_2)|undefined8 __fastcall PrjfCheckAndCancelTransactedOpen(longlong param_1, longlong param_2)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfCheckAndCancelTransactedOpen Called Diff
```diff
--- PrjfCheckAndCancelTransactedOpen called
+++ PrjfCheckAndCancelTransactedOpen called
@@ -5 +5 @@
-WPP_RECORDER_SF_sDd
+WPP_RECORDER_AND_TRACE_SF_sDD
```
### PrjfCheckAndCancelTransactedOpen Diff
```diff
--- PrjfCheckAndCancelTransactedOpen
+++ PrjfCheckAndCancelTransactedOpen
@@ -1,80 +1,90 @@
/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */
undefined8 PrjfCheckAndCancelTransactedOpen(longlong param_1,longlong param_2)
{
longlong lVar1;
undefined8 uVar2;
undefined8 uVar3;
bool bVar4;
int iVar5;
longlong lVar6;
undefined8 uVar7;
- undefined1 auStackY_d8 [32];
+ undefined1 auStackY_f8 [32];
undefined8 local_98 [2];
undefined8 local_88 [4];
uint *local_68;
undefined4 local_60;
undefined4 local_5c;
undefined8 local_58;
uint local_50 [2];
undefined8 *local_48;
undefined4 local_40;
undefined4 local_3c;
ulonglong local_38;
- local_38 = __security_cookie ^ (ulonglong)auStackY_d8;
+ local_38 = __security_cookie ^ (ulonglong)auStackY_f8;
lVar1 = *(longlong *)(param_2 + 0x20);
uVar2 = *(undefined8 *)(param_2 + 0x18);
uVar3 = *(undefined8 *)(param_2 + 0x28);
uVar7 = 0;
lVar6 = IoGetTransactionParameterBlock(lVar1);
if (lVar6 != 0) {
uVar7 = 0xc019003f;
if (5 < DAT_0) {
if (((_DAT_1 & 0x400000000000) == 0) ||
((DAT_2 & 0x400000000000) != DAT_2)) {
bVar4 = false;
}
else {
bVar4 = true;
}
if (bVar4) {
local_5c = 0;
local_68 = local_50;
local_50[1] = 0;
local_3c = 0;
local_58 = *(undefined8 *)(lVar1 + 0x60);
local_50[0] = (uint)*(ushort *)(lVar1 + 0x58);
local_48 = local_98;
local_60 = 2;
local_98[0] = 0x1000000;
local_40 = 8;
- _tlgWriteTransfer_EtwWriteTransfer(0x1c0011068,&DAT_3,0,0,5,local_88);
+ _tlgWriteTransfer_EtwWriteTransfer(0x14001b068,&DAT_3,0,0,5,local_88);
}
}
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),3,10,10,
- &WPP_0b474be437163e15bbc5d557e64edfd4_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\create.c");
+ if (((DAT_4 & 4) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x30a,DAT_4 & 4,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),3,10,10,
+ &WPP_b8de0dfab5423d2f6ea3deba36b4500f_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\create.c");
}
if (*(longlong *)(lVar1 + 0x18) != 0) {
if ((*(uint *)(lVar1 + 0x50) & 0x40000) != 0) {
MicrosoftTelemetryAssertTriggeredNoArgsKM();
}
FltCancelFileOpen(uVar2,lVar1);
}
*(undefined4 *)(param_1 + 0x18) = 0xc019003f;
*(undefined8 *)(param_1 + 0x20) = 0;
iVar5 = FltRollbackEnlistment(uVar2,uVar3,0);
- if ((iVar5 < 0) && ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),3,10,0xb,
- &WPP_0b474be437163e15bbc5d557e64edfd4_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\create.c");
+ if (iVar5 < 0) {
+ if (((DAT_4 & 4) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x30a,DAT_4 & 4,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),3,10,0xb,
+ &WPP_b8de0dfab5423d2f6ea3deba36b4500f_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\create.c");
+ }
}
}
return uVar7;
}
```
## PrjfTelemetryPostExpansionComplete
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.76|
|i_ratio|0.39|
|m_ratio|0.97|
|b_ratio|0.94|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfTelemetryPostExpansionComplete|PrjfTelemetryPostExpansionComplete|
|fullname|PrjfTelemetryPostExpansionComplete|PrjfTelemetryPostExpansionComplete|
|refcount|2|2|
|`length`|664|706|
|`called`|PrjfTelemetryPostDirectoryExpansionComplete
WPP_RECORDER_SF_sDZLii
WPP_RECORDER_SF_sDdZ
__security_check_cookie
_tlgWriteAgg|PrjfTelemetryPostDirectoryExpansionComplete
WPP_RECORDER_AND_TRACE_SF_sDZLii
WPP_RECORDER_AND_TRACE_SF_sDdZ
__security_check_cookie
_tlgWriteAgg|
|calling|PrjfExpansionWorker|PrjfExpansionWorker|
|paramcount|7|7|
|`address`|1c002a334|140037cb8|
|sig|undefined __fastcall PrjfTelemetryPostExpansionComplete(byte param_1, undefined8 param_2, longlong param_3, uint param_4, undefined8 param_5, ulonglong param_6, longlong param_7)|undefined __fastcall PrjfTelemetryPostExpansionComplete(byte param_1, undefined8 param_2, longlong param_3, uint param_4, undefined8 param_5, ulonglong param_6, longlong param_7)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfTelemetryPostExpansionComplete Called Diff
```diff
--- PrjfTelemetryPostExpansionComplete called
+++ PrjfTelemetryPostExpansionComplete called
@@ -2,2 +2,2 @@
-WPP_RECORDER_SF_sDZLii
-WPP_RECORDER_SF_sDdZ
+WPP_RECORDER_AND_TRACE_SF_sDZLii
+WPP_RECORDER_AND_TRACE_SF_sDdZ
```
### PrjfTelemetryPostExpansionComplete Diff
```diff
--- PrjfTelemetryPostExpansionComplete
+++ PrjfTelemetryPostExpansionComplete
@@ -1,133 +1,143 @@
/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
/* WARNING: Type propagation algorithm not settling */
/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */
void PrjfTelemetryPostExpansionComplete
(byte param_1,undefined8 param_2,longlong param_3,uint param_4,undefined8 param_5,
ulonglong param_6,longlong param_7)
{
- undefined2 uVar1;
+ longlong lVar1;
bool bVar2;
- int iVar3;
- undefined1 auStackY_198 [32];
- undefined4 in_stack_fffffffffffffe9c;
- undefined8 in_stack_fffffffffffffea0;
+ undefined7 uVar4;
+ ulonglong uVar3;
+ undefined1 auStackY_1a8 [32];
+ undefined4 in_stack_fffffffffffffea4;
+ undefined8 in_stack_fffffffffffffea8;
uint local_138;
uint local_134;
ulonglong local_130;
longlong lStack_128;
undefined8 local_120;
longlong local_118;
longlong local_110;
longlong local_108;
longlong local_100;
ulonglong local_f8 [6];
undefined8 *local_c8;
undefined4 local_c0;
undefined4 local_bc;
longlong *local_b8;
undefined4 local_b0;
undefined4 local_ac;
longlong *local_a8;
undefined4 local_a0;
undefined4 local_9c;
longlong *local_98;
undefined4 local_90;
undefined4 local_8c;
longlong *local_88;
undefined4 local_80;
undefined4 local_7c;
uint *local_78;
undefined4 local_70;
undefined4 local_6c;
ulonglong *local_68;
undefined4 local_60;
undefined4 local_5c;
uint *local_58;
undefined4 local_50;
undefined4 local_4c;
ulonglong *local_48;
undefined4 local_40;
undefined4 local_3c;
ulonglong local_38;
- local_38 = __security_cookie ^ (ulonglong)auStackY_198;
- iVar3 = (int)param_2;
- lStack_128 = *(longlong *)(*(longlong *)(param_3 + 0x110) + 0x48);
- uVar1 = *(undefined2 *)(lStack_128 + 0x120);
- local_130 = (ulonglong)CONCAT22(uVar1,uVar1);
- lStack_128 = lStack_128 + 0x122;
+ local_38 = __security_cookie ^ (ulonglong)auStackY_1a8;
+ lVar1 = *(longlong *)(*(longlong *)(param_3 + 0x110) + 0x48);
+ local_130 = (ulonglong)CONCAT22(*(undefined2 *)(lVar1 + 0x120),*(undefined2 *)(lVar1 + 0x120));
+ lStack_128 = lVar1 + 0x122;
+ uVar4 = (undefined7)((ulonglong)param_2 >> 8);
if ((int)param_4 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- param_2 = CONCAT71((int7)((ulonglong)param_2 >> 8),2);
- WPP_RECORDER_SF_sDdZ
- (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,10,0xe,
+ uVar3 = CONCAT71(uVar4,DAT_0) & 0xffffffffffffff04;
+ if (((DAT_0 & 4) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDdZ
+ (0x20a,DAT_0 & 4,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,10,0xe,
&WPP_cead7f9b79fe32a96920046e878d7ba9_Traceguids,
"onecore\\base\\fs\\gvflt\\filter\\sys\\telemetry.c",
- CONCAT44(in_stack_fffffffffffffe9c,0x191),
- CONCAT44((int)((ulonglong)in_stack_fffffffffffffea0 >> 0x20),param_4),
+ CONCAT44(in_stack_fffffffffffffea4,0x191),
+ CONCAT44((int)((ulonglong)in_stack_fffffffffffffea8 >> 0x20),param_4),
(wchar_t *)&local_130);
}
}
- else if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDZLii(*(undefined8 *)(WPP_GLOBAL_Control + 0x40));
+ else {
+ uVar3 = CONCAT71(uVar4,DAT_1) & 0xffffffffffffff04;
+ if (((DAT_1 & 4) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDZLii
+ (lVar1,DAT_1 & 4,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40));
+ }
}
- if (iVar3 == 1) {
+ if ((int)param_2 == 1) {
local_f8[0] = -(ulonglong)(param_6 != 0) & param_6 >> 0xb;
- if (5 < DAT_0) {
- if (((_DAT_1 & 0x400000000000) == 0) ||
- ((DAT_2 & 0x400000000000) != DAT_2)) {
+ if (5 < DAT_2) {
+ if (((_DAT_3 & 0x400000000000) == 0) ||
+ ((DAT_4 & 0x400000000000) != DAT_4)) {
bVar2 = false;
}
else {
bVar2 = true;
}
if (bVar2) {
local_bc = 0;
local_c8 = &local_120;
local_ac = 0;
local_9c = 0;
local_8c = 0;
local_7c = 0;
local_6c = 0;
local_5c = 0;
local_4c = 0;
local_3c = 0;
local_b8 = &local_118;
local_110 = param_7 * param_7;
local_a8 = &local_110;
local_98 = &local_108;
local_88 = &local_100;
local_78 = &local_138;
local_68 = local_f8;
local_58 = &local_134;
local_48 = local_f8 + 1;
local_120 = 1;
local_c0 = 8;
local_118 = param_7;
local_b0 = 8;
local_a0 = 8;
local_108 = param_7;
local_90 = 8;
local_100 = param_7;
local_80 = 8;
local_138 = (uint)param_1;
local_70 = 4;
local_60 = 8;
local_50 = 4;
local_f8[1] = 0x1000000;
local_40 = 8;
local_134 = param_4;
- _tlgWriteAgg(4,&DAT_3,8,0xb,local_f8 + 2);
+ _tlgWriteAgg(8,&DAT_5,0x400000000000,0xb,local_f8 + 2);
}
}
}
- else if (iVar3 == 2) {
+ else if ((int)param_2 == 2) {
PrjfTelemetryPostDirectoryExpansionComplete
- (param_1,param_2,(ulonglong)param_4,param_5,param_6,param_7);
+ (param_1,uVar3,(ulonglong)param_4,param_5,param_6,param_7);
}
return;
}
```
## PrjfCloseFileHandler
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.28|
|i_ratio|0.2|
|m_ratio|0.86|
|b_ratio|0.76|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfCloseFileHandler|PrjfCloseFileHandler|
|fullname|PrjfCloseFileHandler|PrjfCloseFileHandler|
|refcount|2|2|
|`length`|535|749|
|`called`|Expand for full list:
FLTMGR.SYS::FltAcquireResourceExclusive
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltReleaseResource
NTOSKRNL.EXE::IoGetCurrentProcess
NTOSKRNL.EXE::ObDereferenceObjectDeferDelete
NTOSKRNL.EXE::RtlDeleteElementGenericTableAvl
NTOSKRNL.EXE::RtlLookupElementGenericTableAvl
PrjfGetUnionContextByVirtualizationInstanceInfo
PrjfReleaseUnionContext
WPP_RECORDER_SF_sD
__security_check_cookie
Expand for full list:
FLTMGR.SYS::FltAcquireResourceExclusive
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltReleaseResource
Feature_3303736635__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::IoGetCurrentProcess
NTOSKRNL.EXE::ObDereferenceObjectDeferDelete
NTOSKRNL.EXE::RtlDeleteElementGenericTableAvl
NTOSKRNL.EXE::RtlLookupElementGenericTableAvl
PrjfGetUnionContextByVirtualizationInstanceInfo
PrjfReleaseUnionContext
WPP_RECORDER_AND_TRACE_SF_sD
__security_check_cookie
MicrosoftTelemetryAssertTriggeredNoArgsKM
WPP_RECORDER_SF_sDd
memcpy|MicrosoftTelemetryAssertTriggeredMsgKM
MicrosoftTelemetryAssertTriggeredNoArgsKM
WPP_RECORDER_AND_TRACE_SF_sDD
memmove|
|calling|PrjfTranslateCurrentEnumEntry|PrjfTranslateCurrentEnumEntry|
|paramcount|8|8|
|`address`|1c001d3d0|140027f68|
|sig|undefined8 __fastcall PrjfMungeDirectoryEnumerateWithoutShortnameFileId64(int param_1, char param_2, undefined8 * param_3, char param_4, undefined8 * param_5, uint param_6, undefined8 * param_7, uint * param_8)|undefined8 __fastcall PrjfMungeDirectoryEnumerateWithoutShortnameFileId64(int param_1, char param_2, undefined8 * param_3, char param_4, undefined8 * param_5, uint param_6, undefined8 * param_7, uint * param_8)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfMungeDirectoryEnumerateWithoutShortnameFileId64 Called Diff
```diff
--- PrjfMungeDirectoryEnumerateWithoutShortnameFileId64 called
+++ PrjfMungeDirectoryEnumerateWithoutShortnameFileId64 called
@@ -3,2 +3,2 @@
-WPP_RECORDER_SF_sDd
-memcpy
+WPP_RECORDER_AND_TRACE_SF_sDD
+memmove
```
### PrjfMungeDirectoryEnumerateWithoutShortnameFileId64 Diff
```diff
--- PrjfMungeDirectoryEnumerateWithoutShortnameFileId64
+++ PrjfMungeDirectoryEnumerateWithoutShortnameFileId64
@@ -1,135 +1,139 @@
undefined8
PrjfMungeDirectoryEnumerateWithoutShortnameFileId64
(int param_1,char param_2,undefined8 *param_3,char param_4,undefined8 *param_5,
uint param_6,undefined8 *param_7,uint *param_8)
{
uint uVar1;
bool bVar2;
uint uVar3;
undefined4 uVar4;
undefined8 uVar5;
undefined8 uVar6;
uint uVar7;
uVar5 = 0;
uVar7 = 0;
uVar3 = 0;
if ((param_1 == 0x26) || (bVar2 = true, param_1 == 0x4e)) {
bVar2 = false;
}
if (bVar2) {
MicrosoftTelemetryAssertTriggeredNoArgsKM();
}
uVar6 = uVar5;
if (param_1 != 0x26) {
if (param_1 == 0x4e) {
uVar1 = *(uint *)((longlong)param_3 + 0x3c);
if ((uVar1 + 0x50 <= param_6) || ((uVar7 = uVar3, 0x4f < param_6 && (param_2 != '\0')))) {
uVar7 = uVar1;
if (param_6 - 0x50 <= uVar1) {
uVar7 = param_6 - 0x50;
}
uVar5 = param_3[1];
*param_5 = *param_3;
param_5[1] = uVar5;
uVar5 = param_3[3];
param_5[2] = param_3[2];
param_5[3] = uVar5;
uVar5 = param_3[5];
param_5[4] = param_3[4];
param_5[5] = uVar5;
uVar5 = param_3[7];
param_5[6] = param_3[6];
param_5[7] = uVar5;
uVar5 = param_3[9];
param_5[8] = param_3[8];
param_5[9] = uVar5;
if (*(int *)((longlong)param_3 + 0x44) == -0x6fffffe4) {
uVar3 = *(uint *)(param_3 + 7) & 0xffffe9ff;
if (uVar3 == 0) {
uVar3 = 0x80;
}
*(uint *)(param_5 + 7) = uVar3;
*(undefined4 *)((longlong)param_5 + 0x44) = 0;
}
if (param_4 != '\0') {
*(uint *)(param_5 + 7) = *(uint *)(param_5 + 7) | 0x440000;
param_5[6] = 0;
param_5[9] = 0xffffffffffffffff;
}
- memcpy(param_5 + 10,param_3 + 10,(ulonglong)uVar7);
+ memmove(param_5 + 10,param_3 + 10,(ulonglong)uVar7);
*(undefined4 *)param_5 = 0;
*param_7 = param_5;
uVar7 = uVar7 + 0x50;
if (uVar7 < uVar1 + 0x50) {
uVar6 = 0x80000005;
}
}
}
else {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),3,0x12,0xe,
- &WPP_e21b7c61aee93f730c9c252e6e8da2f4_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\dir.c");
+ if (((DAT_0 & 4) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x312,DAT_0 & 4,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),3,0x12,0xe,
+ &WPP_3d19aee1b05838720427e757513a9608_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\dir.c");
}
MicrosoftTelemetryAssertTriggeredMsgKM();
uVar6 = 0xc00000bb;
}
- goto LAB_0;
+ goto LAB_1;
}
uVar1 = *(uint *)((longlong)param_3 + 0x3c);
if ((param_6 < uVar1 + 0x50) && ((uVar6 = 0, uVar7 = uVar3, param_6 < 0x50 || (param_2 == '\0'))))
- goto LAB_0;
+ goto LAB_1;
uVar7 = uVar1;
if (param_6 - 0x50 <= uVar1) {
uVar7 = param_6 - 0x50;
}
uVar6 = param_3[1];
*param_5 = *param_3;
param_5[1] = uVar6;
uVar6 = param_3[3];
param_5[2] = param_3[2];
param_5[3] = uVar6;
uVar6 = param_3[5];
param_5[4] = param_3[4];
param_5[5] = uVar6;
param_5[6] = param_3[6];
if (*(int *)((longlong)param_3 + 0x44) == -0x6fffffe4) {
uVar3 = *(uint *)(param_3 + 7) & 0xffffe9ff;
if (uVar3 == 0) {
uVar3 = 0x80;
}
*(uint *)(param_5 + 7) = uVar3;
-LAB_1:
+LAB_2:
uVar4 = *(undefined4 *)(param_3 + 8);
}
else {
*(uint *)(param_5 + 7) = *(uint *)(param_3 + 7);
- if ((*(uint *)(param_3 + 7) & 0x400) == 0) goto LAB_1;
+ if ((*(uint *)(param_3 + 7) & 0x400) == 0) goto LAB_2;
uVar4 = *(undefined4 *)((longlong)param_3 + 0x44);
}
*(undefined4 *)(param_5 + 8) = uVar4;
if (param_4 == '\0') {
param_5[9] = param_3[9];
}
else {
*(uint *)(param_5 + 7) = *(uint *)(param_5 + 7) | 0x440000;
param_5[6] = 0;
param_5[9] = 0xffffffffffffffff;
}
*(undefined4 *)((longlong)param_5 + 0x3c) = *(undefined4 *)((longlong)param_3 + 0x3c);
- memcpy(param_5 + 10,param_3 + 10,(ulonglong)uVar7);
+ memmove(param_5 + 10,param_3 + 10,(ulonglong)uVar7);
*(undefined4 *)param_5 = 0;
*param_7 = param_5;
uVar7 = uVar7 + 0x50;
uVar6 = uVar5;
if (uVar7 < uVar1 + 0x50) {
uVar6 = 0x80000005;
}
-LAB_0:
+LAB_1:
*param_8 = uVar7;
return uVar6;
}
```
## PrjfRemoveSparse
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.66|
|i_ratio|0.46|
|m_ratio|0.95|
|b_ratio|0.92|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfRemoveSparse|PrjfRemoveSparse|
|fullname|PrjfRemoveSparse|PrjfRemoveSparse|
|refcount|2|2|
|`length`|242|279|
|`called`|FLTMGR.SYS::FltFsControlFile
MicrosoftTelemetryAssertTriggeredNoArgsKM
WPP_RECORDER_SF_sDdZ|FLTMGR.SYS::FltFsControlFile
MicrosoftTelemetryAssertTriggeredNoArgsKM
WPP_RECORDER_AND_TRACE_SF_sDdZ|
|calling|PrjfFlushAndUpdateDiskStateWorker|PrjfFlushAndUpdateDiskStateWorker|
|paramcount|3|3|
|`address`|1c0020820|14002ba34|
|sig|int __fastcall PrjfRemoveSparse(undefined8 param_1, longlong param_2, int * param_3)|int __fastcall PrjfRemoveSparse(undefined8 param_1, longlong param_2, int * param_3)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfRemoveSparse Called Diff
```diff
--- PrjfRemoveSparse called
+++ PrjfRemoveSparse called
@@ -3 +3 @@
-WPP_RECORDER_SF_sDdZ
+WPP_RECORDER_AND_TRACE_SF_sDdZ
```
### PrjfRemoveSparse Diff
```diff
--- PrjfRemoveSparse
+++ PrjfRemoveSparse
@@ -1,40 +1,39 @@
int PrjfRemoveSparse(undefined8 param_1,longlong param_2,int *param_3)
{
int iVar1;
undefined1 local_res18 [16];
- undefined8 in_stack_ffffffffffffffc8;
- undefined4 uVar2;
- undefined4 in_stack_ffffffffffffffdc;
- undefined4 uVar3;
+ undefined4 in_stack_ffffffffffffffe4;
+ undefined4 in_stack_ffffffffffffffec;
- uVar2 = (undefined4)((ulonglong)in_stack_ffffffffffffffc8 >> 0x20);
if (*param_3 == 1) {
MicrosoftTelemetryAssertTriggeredNoArgsKM();
}
if ((**(uint **)(*(longlong *)(param_3 + 2) + 0x58) & 1) == 0) {
- uVar3 = 0;
local_res18[0] = 0;
- iVar1 = FltFsControlFile(param_1,param_2,0x900c4,local_res18,CONCAT44(uVar2,1),0,0,0);
+ iVar1 = FltFsControlFile(param_1,param_2,0x900c4,local_res18,1,0,0,0);
if (iVar1 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDdZ
- (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),4,10,0xc,
- &WPP_286736bb6a73387d41449b09eaab690a_Traceguids,
+ if (((DAT_0 & 4) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDdZ
+ (0x40a,DAT_0 & 4,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),4,10,0xc,
+ &WPP_8662402235063b115c167dc7c0c22e28_Traceguids,
"onecore\\base\\fs\\gvflt\\filter\\sys\\expansion.c",
- CONCAT44(in_stack_ffffffffffffffdc,0x2b1),CONCAT44(uVar3,iVar1),
- (wchar_t *)(param_2 + 0x58));
+ CONCAT44(in_stack_ffffffffffffffe4,0x2c2),
+ CONCAT44(in_stack_ffffffffffffffec,iVar1),(wchar_t *)(param_2 + 0x58));
}
}
else {
**(uint **)(*(longlong *)(param_3 + 2) + 0x58) =
**(uint **)(*(longlong *)(param_3 + 2) + 0x58) | 1;
}
}
else {
iVar1 = 0;
}
return iVar1;
}
```
## PrjfPreSetDispositionInformation
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.87|
|i_ratio|0.5|
|m_ratio|0.96|
|b_ratio|0.92|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfPreSetDispositionInformation|PrjfPreSetDispositionInformation|
|fullname|PrjfPreSetDispositionInformation|PrjfPreSetDispositionInformation|
|refcount|2|2|
|`length`|279|315|
|`called`|NTOSKRNL.EXE::ExFreePoolWithTag
PrjfIsFileObjectWithinActiveVirtualizationRoots
PrjfPrepareForDelete
PrjfRevertInMemoryTombstonesForDirectory
WPP_RECORDER_SF_sDd|NTOSKRNL.EXE::ExFreePoolWithTag
PrjfIsFileObjectWithinActiveVirtualizationRoots
PrjfPrepareForDelete
PrjfRevertInMemoryTombstonesForDirectory
WPP_RECORDER_AND_TRACE_SF_sDD|
|calling|PrjfPreSetInformation|PrjfPreSetInformation|
|paramcount|2|2|
|`address`|1c0021230|14002c600|
|sig|undefined8 __fastcall PrjfPreSetDispositionInformation(longlong param_1, longlong param_2)|undefined8 __fastcall PrjfPreSetDispositionInformation(longlong param_1, longlong param_2)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfPreSetDispositionInformation Called Diff
```diff
--- PrjfPreSetDispositionInformation called
+++ PrjfPreSetDispositionInformation called
@@ -5 +5 @@
-WPP_RECORDER_SF_sDd
+WPP_RECORDER_AND_TRACE_SF_sDD
```
### PrjfPreSetDispositionInformation Diff
```diff
--- PrjfPreSetDispositionInformation
+++ PrjfPreSetDispositionInformation
@@ -1,53 +1,59 @@
undefined8 PrjfPreSetDispositionInformation(longlong param_1,longlong param_2)
{
longlong lVar1;
int iVar2;
ulonglong uVar3;
undefined8 *puVar4;
undefined8 uVar5;
wchar_t local_18 [4];
longlong lStack_10;
local_18[0] = L'\0';
local_18[1] = L'\0';
local_18[2] = L'\0';
local_18[3] = L'\0';
lStack_10 = 0;
uVar5 = 1;
iVar2 = 0;
uVar3 = PrjfIsFileObjectWithinActiveVirtualizationRoots(param_1,param_2,(undefined8 *)local_18);
if ((int)uVar3 < 0) goto LAB_0;
lVar1 = *(longlong *)(param_1 + 0x10);
iVar2 = 0;
if (*(int *)(lVar1 + 0x20) == 0xd) {
if (**(char **)(lVar1 + 0x38) != '\0') {
LAB_1:
puVar4 = PrjfPrepareForDelete(param_1,param_2,local_18);
iVar2 = (int)puVar4;
if (iVar2 < 0) goto LAB_0;
}
}
else if ((*(int *)(lVar1 + 0x20) == 0x40) && (iVar2 = 0, (**(uint **)(lVar1 + 0x38) & 1) != 0))
goto LAB_1;
uVar5 = 0;
LAB_0:
if (lStack_10 != 0) {
ExFreePoolWithTag(lStack_10,0x6e664a50);
}
if (iVar2 < 0) {
uVar3 = PrjfRevertInMemoryTombstonesForDirectory
(*(undefined8 *)(param_2 + 0x18),*(undefined8 *)(param_2 + 0x20));
- if (((int)uVar3 < 0) && ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x13,10,
- &WPP_9aa94875f0ba3c84ae0a423dcca6636f_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\fileinfo.c");
+ if ((int)uVar3 < 0) {
+ if (((DAT_2 & 8) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x213,DAT_2 & 8,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x13,10,
+ &WPP_9aa94875f0ba3c84ae0a423dcca6636f_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\fileinfo.c");
+ }
}
*(undefined8 *)(param_1 + 0x20) = 0;
uVar5 = 4;
*(int *)(param_1 + 0x18) = iVar2;
}
return uVar5;
}
```
## PrjfProcessFileDirectoryStatus
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.75|
|i_ratio|0.56|
|m_ratio|0.97|
|b_ratio|0.95|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfProcessFileDirectoryStatus|PrjfProcessFileDirectoryStatus|
|fullname|PrjfProcessFileDirectoryStatus|PrjfProcessFileDirectoryStatus|
|refcount|2|2|
|`length`|385|416|
|`called`|FLTMGR.SYS::FltClose
FLTMGR.SYS::FltParseFileNameInformation
NTOSKRNL.EXE::ObfDereferenceObject
PrjfOpenAsReparsePoint
WPP_RECORDER_SF_sDd|FLTMGR.SYS::FltClose
FLTMGR.SYS::FltParseFileNameInformation
NTOSKRNL.EXE::ObfDereferenceObject
PrjfOpenAsReparsePoint
WPP_RECORDER_AND_TRACE_SF_sDD|
|calling|PrjfPostCreate|PrjfPostCreate|
|paramcount|3|3|
|`address`|1c0033ee8|1400436b4|
|sig|int __fastcall PrjfProcessFileDirectoryStatus(longlong param_1, longlong param_2, longlong param_3)|int __fastcall PrjfProcessFileDirectoryStatus(longlong param_1, longlong param_2, longlong param_3)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfProcessFileDirectoryStatus Called Diff
```diff
--- PrjfProcessFileDirectoryStatus called
+++ PrjfProcessFileDirectoryStatus called
@@ -5 +5 @@
-WPP_RECORDER_SF_sDd
+WPP_RECORDER_AND_TRACE_SF_sDD
```
### PrjfProcessFileDirectoryStatus Diff
```diff
--- PrjfProcessFileDirectoryStatus
+++ PrjfProcessFileDirectoryStatus
@@ -1,53 +1,59 @@
int PrjfProcessFileDirectoryStatus(longlong param_1,longlong param_2,longlong param_3)
{
int iVar1;
int extraout_EAX;
- byte local_res8 [8];
+ char local_res8 [8];
longlong local_res20;
- undefined8 in_stack_ffffffffffffff98;
+ undefined1 in_stack_ffffffffffffff98;
+ undefined7 in_stack_ffffffffffffff99;
longlong local_28 [2];
local_res20 = 0;
local_28[0] = 0;
- local_res8[0] = 0;
+ local_res8[0] = '\0';
iVar1 = *(int *)(param_1 + 0x18);
if ((((iVar1 == -0x3fffff46) || (iVar1 == -0x3ffffefd)) ||
((iVar1 == -0x3fffffcb && (*(char *)(*(longlong *)(param_1 + 0x10) + 0x23) == '\x02')))) &&
((*(uint *)(*(longlong *)(param_1 + 0x10) + 0x20) & 0x2000) == 0)) {
iVar1 = FltParseFileNameInformation(*(undefined8 *)(param_3 + 0x30));
if (iVar1 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x13,0x20,
- &WPP_4079bacae6ce31fd7110e995a8b7a7c9_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\tombstone.c");
+ if (((DAT_0 & 8) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x213,DAT_0 & 8,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x13,0x20,
+ &WPP_4079bacae6ce31fd7110e995a8b7a7c9_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\tombstone.c");
}
}
else {
PrjfOpenAsReparsePoint
((wchar_t *)(*(longlong *)(param_3 + 0x30) + 8),0,*(undefined8 *)(param_2 + 0x18),
- 0x80,in_stack_ffffffffffffff98,(longlong)&local_res20,(longlong)local_28,
- (byte *)0x0,(byte *)0x0,(undefined8 *******)0x0,local_res8,(uint *)0x0);
- if ((extraout_EAX < 0) || (local_res8[0] == 0)) {
+ 0x80,CONCAT71(in_stack_ffffffffffffff99,in_stack_ffffffffffffff98),
+ (longlong)&local_res20,(longlong)local_28,(byte *)0x0,(byte *)0x0,(byte *)0x0,
+ (undefined8 *******)local_res8,(uint *)0x0);
+ if ((extraout_EAX < 0) || (local_res8[0] == '\0')) {
iVar1 = 0;
}
else {
*(undefined4 *)(param_1 + 0x18) = 0x104;
*(undefined8 *)(param_1 + 0x20) = 0xa0000022;
iVar1 = extraout_EAX;
}
}
if (local_res20 != 0) {
FltClose();
}
if (local_28[0] != 0) {
ObfDereferenceObject();
}
}
else {
iVar1 = 0;
}
return iVar1;
}
```
## PrjfCopyFileMetaData
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.65|
|i_ratio|0.28|
|m_ratio|0.91|
|b_ratio|0.86|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfCopyFileMetaData|PrjfCopyFileMetaData|
|fullname|PrjfCopyFileMetaData|PrjfCopyFileMetaData|
|refcount|3|3|
|`length`|316|388|
|`called`|PrjfCopyFileBasicInformation
WPP_RECORDER_SF_sD
WPP_RECORDER_SF_sDd|PrjfCopyFileBasicInformation
WPP_RECORDER_AND_TRACE_SF_sD
WPP_RECORDER_AND_TRACE_SF_sDD|
|calling|PrjfCopyAsPlaceHolder|PrjfCopyAsPlaceHolder|
|paramcount|5|5|
|`address`|1c002b9e0|140039290|
|sig|int __fastcall PrjfCopyFileMetaData(longlong param_1, longlong param_2, longlong param_3, longlong param_4, uint param_5)|int __fastcall PrjfCopyFileMetaData(longlong param_1, longlong param_2, longlong param_3, longlong param_4, uint param_5)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfCopyFileMetaData Called Diff
```diff
--- PrjfCopyFileMetaData called
+++ PrjfCopyFileMetaData called
@@ -2,2 +2,2 @@
-WPP_RECORDER_SF_sD
-WPP_RECORDER_SF_sDd
+WPP_RECORDER_AND_TRACE_SF_sD
+WPP_RECORDER_AND_TRACE_SF_sDD
```
### PrjfCopyFileMetaData Diff
```diff
--- PrjfCopyFileMetaData
+++ PrjfCopyFileMetaData
@@ -1,39 +1,49 @@
int PrjfCopyFileMetaData
(longlong param_1,longlong param_2,longlong param_3,longlong param_4,uint param_5)
{
int iVar1;
undefined8 local_38;
undefined8 local_30;
undefined8 local_28;
undefined8 local_20;
undefined4 local_18;
undefined4 local_14;
iVar1 = 0;
if ((((param_1 == 0) || (param_2 == 0)) || (param_3 == 0)) || (param_4 == 0)) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sD(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xf,0x1e,
- &WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
+ if (((DAT_0 & 0x80) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sD
+ (0x20f,DAT_0 & 0x80,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xf,0x1f,
+ &WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
}
iVar1 = -0x3ffffff3;
}
else if ((param_5 & 0x68) != 0) {
+ local_14 = 0;
local_20 = *(undefined8 *)(param_1 + 0x28);
- local_14 = 0;
local_38 = *(undefined8 *)(param_1 + 0x10);
local_30 = *(undefined8 *)(param_1 + 0x18);
local_28 = *(undefined8 *)(param_1 + 0x20);
local_18 = *(undefined4 *)(param_1 + 0x30);
iVar1 = PrjfCopyFileBasicInformation(&local_38,param_3,param_4,(ulonglong)param_5);
- if ((iVar1 < 0) && ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xf,0x20,
- &WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
+ if (iVar1 < 0) {
+ if (((DAT_0 & 0x80) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x20f,DAT_0 & 0x80,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xf,0x21,
+ &WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
+ }
}
}
return iVar1;
}
```
## PrjfLookupEntryBackingLayerNegativePathCache
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,sig,address,called|
|ratio|0.66|
|i_ratio|0.37|
|m_ratio|0.95|
|b_ratio|0.58|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfLookupEntryBackingLayerNegativePathCache|PrjfLookupEntryBackingLayerNegativePathCache|
|fullname|PrjfLookupEntryBackingLayerNegativePathCache|PrjfLookupEntryBackingLayerNegativePathCache|
|refcount|2|2|
|`length`|1466|1638|
|`called`|Expand for full list:
FLTMGR.SYS::FltAcquireResourceShared
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltCreateFileEx2
FLTMGR.SYS::FltGetFileNameInformationUnsafe
FLTMGR.SYS::FltReleaseFileNameInformation
FLTMGR.SYS::FltReleaseResource
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::RtlCompareUnicodeString
NTOSKRNL.EXE::RtlDowncaseUnicodeString
NTOSKRNL.EXE::RtlGetNextEntryHashTable
NTOSKRNL.EXE::RtlHashUnicodeString
NTOSKRNL.EXE::RtlLookupEntryHashTable
PrjfAllocateUnicodeString
PrjfGetUnionContextByFileNameEx
PrjfReleaseUnionContext
WPP_RECORDER_SF_sDdZZ
WPP_RECORDER_SF_sDdZZZq
WPP_RECORDER_SF_sDdZZq
WPP_RECORDER_SF_sDdZd
memcpyExpand for full list:
FLTMGR.SYS::FltAcquireResourceShared
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltCreateFileEx2
FLTMGR.SYS::FltGetFileNameInformationUnsafe
FLTMGR.SYS::FltReleaseFileNameInformation
FLTMGR.SYS::FltReleaseResource
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::RtlCompareUnicodeString
NTOSKRNL.EXE::RtlDowncaseUnicodeString
NTOSKRNL.EXE::RtlGetNextEntryHashTable
NTOSKRNL.EXE::RtlHashUnicodeString
NTOSKRNL.EXE::RtlLookupEntryHashTable
PrjfAllocateUnicodeString
PrjfGetUnionContextByFileNameEx
PrjfReleaseUnionContext
WPP_RECORDER_AND_TRACE_SF_sDdZZ
WPP_RECORDER_AND_TRACE_SF_sDdZZZq
WPP_RECORDER_AND_TRACE_SF_sDdZZq
WPP_RECORDER_AND_TRACE_SF_sDdZd
memmoveExpand for full list:
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltCreateFileEx2
FLTMGR.SYS::FltGetFileNameInformation
FLTMGR.SYS::FltParseFileNameInformation
FLTMGR.SYS::FltReferenceContext
FLTMGR.SYS::FltReleaseContext
FLTMGR.SYS::FltReleaseFileNameInformation
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExAcquireRundownProtection
NTOSKRNL.EXE::ExAllocateFromPagedLookasideList
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExFreeToPagedLookasideList
NTOSKRNL.EXE::KeWaitForSingleObject
NTOSKRNL.EXE::ObfDereferenceObject
PrjfAddInMemoryTombstone
PrjfAllocateUnicodeString
PrjfGetContextFileObjectEx
PrjfGetSetContextFileObject
PrjfIsFileObjectWithinActiveVirtualizationRoots
PrjfOpenPlaceHolder
PrjfPrepareForDelete
PrjfRemoveInMemoryTombstone
PrjfRevertInMemoryTombstonesForDirectory
PrjfTelemetryTombstoneFailureOperation
RtlUnicodeStringCopy
WPP_RECORDER_SF_sDd
_tlgDefineProvider_annotation__Tlgmtakm_hTelemetryAssertDiagTrackProv
memsetExpand for full list:
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltCreateFileEx2
FLTMGR.SYS::FltGetFileNameInformation
FLTMGR.SYS::FltParseFileNameInformation
FLTMGR.SYS::FltReferenceContext
FLTMGR.SYS::FltReleaseContext
FLTMGR.SYS::FltReleaseFileNameInformation
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExAcquireRundownProtection
NTOSKRNL.EXE::ExAllocateFromPagedLookasideList
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExFreeToPagedLookasideList
NTOSKRNL.EXE::KeWaitForSingleObject
NTOSKRNL.EXE::ObfDereferenceObject
PrjfAddInMemoryTombstone
PrjfAllocateUnicodeString
PrjfGetContextFileObjectEx
PrjfGetSetContextFileObject
PrjfIsFileObjectWithinActiveVirtualizationRoots
PrjfOpenPlaceHolder
PrjfPrepareForDelete
PrjfRemoveInMemoryTombstone
PrjfRevertInMemoryTombstonesForDirectory
PrjfSleepOnTestSettingFlagsForTests
PrjfTelemetryTombstoneFailureOperation
RtlUnicodeStringCopy
WPP_RECORDER_AND_TRACE_SF_sDD
memset
NTOSKRNL.EXE::ExFreePoolWithTag
WPP_RECORDER_SF_sD
WPP_RECORDER_SF_sDDDZ
WPP_RECORDER_SF_sDdDZ
memcpy|NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
WPP_RECORDER_AND_TRACE_SF_sD
WPP_RECORDER_AND_TRACE_SF_sDDDZ
WPP_RECORDER_AND_TRACE_SF_sDdDZ
memmove|
|calling|PrjfStoreNotificationMappingEntries|PrjfStoreNotificationMappingEntries|
|paramcount|3|3|
|`address`|1c0035488|140044ec8|
|sig|undefined4 __fastcall PrjfCreateMappingEntry(ushort * param_1, uint param_2, longlong * param_3)|undefined4 __fastcall PrjfCreateMappingEntry(ushort * param_1, uint param_2, longlong * param_3)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfCreateMappingEntry Called Diff
```diff
--- PrjfCreateMappingEntry called
+++ PrjfCreateMappingEntry called
@@ -3,4 +3,4 @@
-WPP_RECORDER_SF_sD
-WPP_RECORDER_SF_sDDDZ
-WPP_RECORDER_SF_sDdDZ
-memcpy
+WPP_RECORDER_AND_TRACE_SF_sD
+WPP_RECORDER_AND_TRACE_SF_sDDDZ
+WPP_RECORDER_AND_TRACE_SF_sDdDZ
+memmove
```
### PrjfCreateMappingEntry Diff
```diff
--- PrjfCreateMappingEntry
+++ PrjfCreateMappingEntry
@@ -1,57 +1,68 @@
undefined4 PrjfCreateMappingEntry(ushort *param_1,uint param_2,longlong *param_3)
{
- ushort uVar1;
void *_Dst;
- undefined4 uVar2;
- undefined2 uVar3;
+ undefined4 uVar1;
+ ushort uVar2;
if (param_2 == 0xffffffff) {
- uVar2 = 0xc000000d;
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0;
- uVar3 = 0x19;
+ uVar1 = 0xc000000d;
+ if (((DAT_0 & 0x80) == 0) &&
+ ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) goto LAB_1;
+ uVar2 = 0x19;
}
else {
if ((param_2 == 0) || ((param_2 & 0xffffe000) == 0)) {
- uVar1 = *param_1;
+ uVar2 = *param_1;
*param_3 = 0;
param_3[1] = 0;
- _Dst = (void *)ExAllocatePool2(0x102,uVar1,0x6d6e4a50);
+ _Dst = (void *)ExAllocatePool2(0x102,uVar2,0x6d6e4a50);
*param_3 = (longlong)_Dst;
if (_Dst != (void *)0x0) {
- memcpy(_Dst,param_1,(ulonglong)*param_1);
+ memmove(_Dst,param_1,(ulonglong)*param_1);
if ((param_2 & 1) != 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDDDZ(*(undefined8 *)(WPP_GLOBAL_Control + 0x40));
+ if (((DAT_2 & 0x80) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDDDZ
+ (_Dst,DAT_2 & 0x80,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40));
}
param_2 = 1;
}
*(uint *)(param_3 + 1) = param_2;
return 0;
}
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sD(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x14,0x1b,
- &WPP_5c05f7cae5513ff3734adbc0d3bd9537_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\mapping.c");
+ if (((DAT_3 & 0x10) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sD
+ (0x214,DAT_3 & 0x10,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x14,0x1b,
+ &WPP_0314efc3b1f93d76a134ccc0e69e0e16_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\mapping.c");
}
- uVar2 = 0xc000009a;
- goto LAB_0;
+ uVar1 = 0xc000009a;
+ goto LAB_1;
}
- uVar2 = 0xc000000d;
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0;
- uVar3 = 0x1a;
+ uVar1 = 0xc000000d;
+ if (((DAT_0 & 0x80) == 0) &&
+ ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) goto LAB_1;
+ uVar2 = 0x1a;
}
- uVar2 = 0xc000000d;
- WPP_RECORDER_SF_sDdDZ
- (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,7,uVar3,
- &WPP_5c05f7cae5513ff3734adbc0d3bd9537_Traceguids,
+ uVar1 = 0xc000000d;
+ WPP_RECORDER_AND_TRACE_SF_sDdDZ
+ (0x207,DAT_0 & 0x80,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,7,uVar2,
+ &WPP_0314efc3b1f93d76a134ccc0e69e0e16_Traceguids,
"onecore\\base\\fs\\gvflt\\filter\\sys\\mapping.c");
-LAB_0:
+LAB_1:
if (*param_3 != 0) {
ExFreePoolWithTag(*param_3,0x6d6e4a50);
*param_3 = 0;
}
- return uVar2;
+ return uVar1;
}
```
## PrjfSendPostCreateNotifications
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.45|
|i_ratio|0.41|
|m_ratio|0.96|
|b_ratio|0.93|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfSendPostCreateNotifications|PrjfSendPostCreateNotifications|
|fullname|PrjfSendPostCreateNotifications|PrjfSendPostCreateNotifications|
|refcount|2|2|
|`length`|561|627|
|`called`|FLTMGR.SYS::FltQueryInformationFile
PrjfSendNotifyOperationCommand
WPP_RECORDER_SF_sDd
WPP_RECORDER_SF_sDqd
__security_check_cookie|FLTMGR.SYS::FltQueryInformationFile
PrjfSendNotifyOperationCommand
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDqd
__security_check_cookie|
|calling|PrjfProcessOpenWithinVirtualizationRoots|PrjfProcessOpenWithinVirtualizationRoots|
|paramcount|7|7|
|`address`|1c001ad2c|140025554|
|sig|ulonglong __fastcall PrjfSendPostCreateNotifications(longlong param_1, undefined8 param_2, undefined8 param_3, undefined8 * param_4, wchar_t * param_5, uint param_6, uint * param_7)|ulonglong __fastcall PrjfSendPostCreateNotifications(longlong param_1, undefined8 param_2, undefined8 param_3, undefined8 * param_4, wchar_t * param_5, uint param_6, uint * param_7)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfSendPostCreateNotifications Called Diff
```diff
--- PrjfSendPostCreateNotifications called
+++ PrjfSendPostCreateNotifications called
@@ -3,2 +3,2 @@
-WPP_RECORDER_SF_sDd
-WPP_RECORDER_SF_sDqd
+WPP_RECORDER_AND_TRACE_SF_sDD
+WPP_RECORDER_AND_TRACE_SF_sDqd
```
### PrjfSendPostCreateNotifications Diff
```diff
--- PrjfSendPostCreateNotifications
+++ PrjfSendPostCreateNotifications
@@ -1,84 +1,93 @@
/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
ulonglong PrjfSendPostCreateNotifications
(longlong param_1,undefined8 param_2,undefined8 param_3,undefined8 *param_4,
wchar_t *param_5,uint param_6,uint *param_7)
{
longlong lVar1;
uint uVar2;
longlong *plVar3;
ulonglong uVar4;
undefined4 uVar5;
undefined1 auStackY_f8 [32];
- undefined4 local_98;
- uint local_94;
- uint local_90;
- uint local_8c;
+ undefined8 local_98;
+ undefined8 uStack_90;
undefined4 local_88;
- undefined4 local_84;
- undefined8 local_78;
- undefined8 uStack_70;
- undefined8 local_68;
- undefined8 uStack_60;
- undefined8 local_58;
- ulonglong local_50;
+ uint local_84;
+ uint local_80;
+ uint local_7c;
+ undefined4 local_78;
+ undefined4 local_74;
+ undefined8 local_70;
+ undefined8 uStack_68;
+ undefined8 local_60;
+ ulonglong local_58;
- local_50 = __security_cookie ^ (ulonglong)auStackY_f8;
- local_58 = 0;
- local_68 = 0;
- uStack_60 = 0;
- uVar2 = FltQueryInformationFile(param_2,param_3,&local_68);
+ local_58 = __security_cookie ^ (ulonglong)auStackY_f8;
+ local_60 = 0;
+ local_70 = 0;
+ uStack_68 = 0;
+ uVar2 = FltQueryInformationFile(param_2,param_3,&local_70);
uVar4 = (ulonglong)uVar2;
if ((int)uVar2 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) {
+ if (((DAT_0 & 0x20) == 0) &&
+ ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) {
return uVar4;
}
- WPP_RECORDER_SF_sDqd
- (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,0xc,
- &WPP_0b474be437163e15bbc5d557e64edfd4_Traceguids,
+ WPP_RECORDER_AND_TRACE_SF_sDqd
+ (0x205,DAT_0 & 0x20,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,0xc,
+ &WPP_b8de0dfab5423d2f6ea3deba36b4500f_Traceguids,
"onecore\\base\\fs\\gvflt\\filter\\sys\\create.c");
return uVar4;
}
- if ((((*(uint *)(param_4 + 7) & 0x10000) == 0) || (local_58._6_1_ != '\0')) ||
- (local_58._7_1_ != '\0')) {
+ if ((((*(uint *)(param_4 + 7) & 0x10000) == 0) || (local_60._6_1_ != '\0')) ||
+ (local_60._7_1_ != '\0')) {
*param_7 = 1;
return uVar4;
}
*param_7 = param_6;
lVar1 = *(longlong *)(param_1 + 0x20);
- local_84 = 0;
+ local_74 = 0;
if (lVar1 == 2) {
uVar5 = 4;
-LAB_0:
- if ((byte)((byte)uVar5 & (byte)param_6) != 0) goto LAB_1;
+LAB_1:
+ if ((byte)((byte)uVar5 & (byte)param_6) != 0) goto LAB_2;
}
else if ((lVar1 == 0) || (lVar1 == 3)) {
uVar5 = 8;
- goto LAB_0;
+ goto LAB_1;
}
if ((param_6 & 2) == 0) {
return uVar4;
}
uVar5 = 2;
-LAB_1:
+LAB_2:
lVar1 = *(longlong *)(param_1 + 0x10);
- local_78 = *param_4;
- uStack_70 = param_4[1];
- local_98 = *(undefined4 *)(*(longlong *)(lVar1 + 0x18) + 0x10);
- local_94 = (uint)*(ushort *)(lVar1 + 0x2a);
- local_90 = (uint)*(byte *)(lVar1 + 0x23);
- local_8c = *(uint *)(lVar1 + 0x20) & 0xffffff;
- local_88 = *(undefined4 *)(param_1 + 0x20);
+ local_98 = *param_4;
+ uStack_90 = param_4[1];
+ local_88 = *(undefined4 *)(*(longlong *)(lVar1 + 0x18) + 0x10);
+ local_84 = (uint)*(ushort *)(lVar1 + 0x2a);
+ local_80 = (uint)*(byte *)(lVar1 + 0x23);
+ local_7c = *(uint *)(lVar1 + 0x20) & 0xffffff;
+ local_78 = *(undefined4 *)(param_1 + 0x20);
plVar3 = PrjfSendNotifyOperationCommand
- (param_1,param_2,param_3,&local_78,param_5,local_58._5_1_,uVar5,(ushort *)0x0,
- (ushort *)&local_98,'\0',param_7);
- if (((int)plVar3 < 0) && ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,0xd,
- &WPP_0b474be437163e15bbc5d557e64edfd4_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\create.c");
+ (param_1,param_2,param_3,&local_98,param_5,local_60._5_1_,uVar5,(ushort *)0x0,
+ (ushort *)&local_88,'\0',param_7);
+ if ((int)plVar3 < 0) {
+ if (((DAT_0 & 0x20) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x205,DAT_0 & 0x20,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,0xd,
+ &WPP_b8de0dfab5423d2f6ea3deba36b4500f_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\create.c");
+ }
}
return (ulonglong)plVar3 & 0xffffffff;
}
```
## PrjfCreateUnionContext
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.34|
|i_ratio|0.59|
|m_ratio|0.93|
|b_ratio|0.9|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfCreateUnionContext|PrjfCreateUnionContext|
|fullname|PrjfCreateUnionContext|PrjfCreateUnionContext|
|refcount|2|2|
|`length`|716|827|
|`called`|NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExInitializeResourceLite
NTOSKRNL.EXE::KeInitializeEvent
NTOSKRNL.EXE::RtlCopyUnicodeString
NTOSKRNL.EXE::RtlCreateHashTableEx
NTOSKRNL.EXE::RtlDeleteHashTable
NTOSKRNL.EXE::RtlInitializeGenericTableAvl
NTOSKRNL.EXE::RtlRandomEx
PrjfReleaseUnionContext
WPP_RECORDER_SF_sD|Expand for full list:
Feature_440600889__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExDeleteResourceLite
NTOSKRNL.EXE::ExInitializeResourceLite
NTOSKRNL.EXE::KeInitializeEvent
NTOSKRNL.EXE::RtlCopyUnicodeString
NTOSKRNL.EXE::RtlCreateHashTableEx
NTOSKRNL.EXE::RtlDeleteHashTable
NTOSKRNL.EXE::RtlInitializeGenericTableAvl
NTOSKRNL.EXE::RtlRandomEx
PrjfReleaseUnionContext
WPP_RECORDER_AND_TRACE_SF_sD
NTOSKRNL.EXE::MmLockPagableSectionByHandle
NTOSKRNL.EXE::MmUnlockPagableImageSection||
|`calling`|PrjfTelemetryAndTracingCleanup
WppClassicProviderCallback
WppTraceCallback||
|paramcount|5|4|
|`address`|1c0004ee4|140006540|
|`sig`|undefined __fastcall FastWppCallback(undefined8 param_1, undefined8 param_2, char param_3, undefined4 param_4, byte param_5)|undefined __fastcall FastWppCallback(undefined8 param_1, int param_2, byte param_3, undefined8 param_4)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### FastWppCallback Called Diff
```diff
--- FastWppCallback called
+++ FastWppCallback called
@@ -1,3 +0,0 @@
-NTOSKRNL.EXE::MmLockPagableDataSection
-NTOSKRNL.EXE::MmLockPagableSectionByHandle
-NTOSKRNL.EXE::MmUnlockPagableImageSection
```
### FastWppCallback Calling Diff
```diff
--- FastWppCallback calling
+++ FastWppCallback calling
@@ -1,3 +0,0 @@
-PrjfTelemetryAndTracingCleanup
-WppClassicProviderCallback
-WppTraceCallback
```
### FastWppCallback Diff
```diff
--- FastWppCallback
+++ FastWppCallback
@@ -1,55 +1,39 @@
/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */
-void FastWppCallback(undefined8 param_1,undefined8 param_2,char param_3,undefined4 param_4,
- byte param_5)
+void FastWppCallback(undefined8 param_1,int param_2,byte param_3,undefined8 param_4)
{
byte bVar1;
ulonglong uVar2;
- ulonglong uVar3;
- byte bVar4;
+ byte bVar3;
- if (param_3 == '\0') {
+ if (param_2 == 0) {
_g_rgFastWppLevelEnabledFlags = 0;
- _DAT_0 = 0;
+ DAT_0 = 0;
_DAT_1 = 0;
- if (FastWppSectionLocked != '\0') {
- FastWppSectionLocked = '\0';
- MmUnlockPagableImageSection(FastWppSectionHandle);
+ _DAT_2 = 0;
+ _DAT_3 = 0;
+ _DAT_4 = 0;
+ }
+ else if (param_2 == 1) {
+ bVar1 = 5;
+ if (param_3 < 6) {
+ bVar1 = param_3;
}
- }
- else {
- if (FastWppSectionLocked == '\0') {
- if (FastWppSectionHandle == 0) {
- FastWppSectionHandle = MmLockPagableDataSection(FastWppPlaceholder);
- if (FastWppSectionHandle == 0) {
- return;
- }
- }
- else {
- MmLockPagableSectionByHandle();
- }
- FastWppSectionLocked = '\x01';
+ bVar3 = 1;
+ if (bVar1 == 0) goto LAB_5;
+ do {
+ uVar2 = (ulonglong)bVar3;
+ bVar3 = bVar3 + 1;
+ *(undefined8 *)(&g_rgFastWppLevelEnabledFlags + uVar2 * 8) = param_4;
+ } while (bVar3 <= bVar1);
+ for (; bVar3 < 5; bVar3 = bVar3 + 1) {
+LAB_5:
+ *(undefined8 *)(&g_rgFastWppLevelEnabledFlags + (ulonglong)bVar3 * 8) = 0;
}
- uVar2 = 1;
- bVar4 = 5;
- if (param_5 < 6) {
- bVar4 = param_5;
- }
- uVar3 = uVar2;
- if (bVar4 == 0) goto LAB_2;
- do {
- bVar1 = (char)uVar3 + 1;
- uVar2 = (ulonglong)bVar1;
- *(undefined4 *)(&g_rgFastWppLevelEnabledFlags + uVar3 * 4) = param_4;
- uVar3 = uVar2;
- } while (bVar1 <= bVar4);
- for (; (byte)uVar2 < 5; uVar2 = (ulonglong)(byte)((char)uVar2 + 1)) {
-LAB_2:
- *(undefined4 *)(&g_rgFastWppLevelEnabledFlags + uVar2 * 4) = 0;
- }
+ return;
}
return;
}
```
## PrjfPostSetInformation
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.67|
|i_ratio|0.35|
|m_ratio|0.96|
|b_ratio|0.73|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfPostSetInformation|PrjfPostSetInformation|
|fullname|PrjfPostSetInformation|PrjfPostSetInformation|
|refcount|3|3|
|`length`|260|246|
|`called`|PrjfPostSetDispositionInformation
PrjfProcessPostRenameOrLinkInformation
WPP_RECORDER_SF_sDd
_tlgDefineProvider_annotation__Tlgmtakm_hTelemetryAssertDiagTrackProv|PrjfPostSetDispositionInformation
PrjfPostSetRenameInformation
PrjfProcessPostRenameOrLinkInformation
WPP_RECORDER_AND_TRACE_SF_sDD|
|calling|||
|paramcount|3|3|
|`address`|1c00210b0|14002c3c0|
|sig|undefined8 __fastcall PrjfPostSetInformation(longlong param_1, longlong param_2, longlong * param_3)|undefined8 __fastcall PrjfPostSetInformation(longlong param_1, longlong param_2, longlong * param_3)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfPostSetInformation Called Diff
```diff
--- PrjfPostSetInformation called
+++ PrjfPostSetInformation called
@@ -1,0 +2 @@
+PrjfPostSetRenameInformation
@@ -3,2 +4 @@
-WPP_RECORDER_SF_sDd
-_tlgDefineProvider_annotation__Tlgmtakm_hTelemetryAssertDiagTrackProv
+WPP_RECORDER_AND_TRACE_SF_sDD
```
### PrjfPostSetInformation Diff
```diff
--- PrjfPostSetInformation
+++ PrjfPostSetInformation
@@ -1,52 +1,46 @@
undefined8 PrjfPostSetInformation(longlong param_1,longlong param_2,longlong *param_3)
{
int iVar1;
ulonglong uVar2;
- longlong lVar3;
- undefined1 uVar4;
- undefined7 uVar5;
- undefined2 uVar6;
- uVar4 = (undefined1)param_2;
- uVar5 = (undefined7)((ulonglong)param_2 >> 8);
iVar1 = *(int *)(*(longlong *)(param_1 + 0x10) + 0x20);
if (iVar1 == 10) {
LAB_0:
- lVar3 = param_1;
- _tlgDefineProvider_annotation__Tlgmtakm_hTelemetryAssertDiagTrackProv();
- uVar2 = PrjfProcessPostRenameOrLinkInformation(lVar3,CONCAT71(uVar5,uVar4),param_3,0x80);
+ uVar2 = PrjfPostSetRenameInformation(param_1,param_2,param_3);
iVar1 = (int)uVar2;
- if ((-1 < iVar1) || ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED))
- goto LAB_1;
- uVar6 = 0x21;
}
else {
if (iVar1 != 0xb) {
if ((iVar1 == 0xd) || (iVar1 == 0x40)) {
iVar1 = PrjfPostSetDispositionInformation(param_1,param_2);
goto LAB_1;
}
if (iVar1 == 0x41) goto LAB_0;
if (iVar1 != 0x48) {
return 0;
}
}
uVar2 = PrjfProcessPostRenameOrLinkInformation(param_1,param_2,param_3,0x100);
iVar1 = (int)uVar2;
- if ((-1 < iVar1) || ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED))
- goto LAB_1;
- uVar6 = 0x23;
+ if (iVar1 < 0) {
+ if (((DAT_2 & 0x20) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x20d,DAT_2 & 0x20,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xd,0x23,
+ &WPP_9aa94875f0ba3c84ae0a423dcca6636f_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\fileinfo.c");
+ }
+ }
}
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xd,uVar6,
- &WPP_9aa94875f0ba3c84ae0a423dcca6636f_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\fileinfo.c");
LAB_1:
if (iVar1 != 0) {
*(undefined8 *)(param_1 + 0x20) = 0;
*(int *)(param_1 + 0x18) = iVar1;
}
return 0;
}
```
## PrjfSendEndDirectoryEnumerationCommand
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.47|
|i_ratio|0.36|
|m_ratio|0.92|
|b_ratio|0.89|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfSendEndDirectoryEnumerationCommand|PrjfSendEndDirectoryEnumerationCommand|
|fullname|PrjfSendEndDirectoryEnumerationCommand|PrjfSendEndDirectoryEnumerationCommand|
|refcount|3|3|
|`length`|579|689|
|`called`|MicrosoftTelemetryAssertTriggeredNoArgsKM
PrjfFreeCommandBuffer
PrjfPrepareCommandForFileObject
PrjfPrepareCommandForFilePath
PrjfSendCommand
WPP_RECORDER_SF_sDd
WPP_RECORDER_SF_sDdZ
memset|MicrosoftTelemetryAssertTriggeredNoArgsKM
PrjfFreeCommandBuffer
PrjfPrepareCommandForFileObject
PrjfPrepareCommandForFilePath
PrjfSendCommand
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDdZ
memset|
|calling|PrjfContextCleanup
PrjfDoesNameExistInLayer|PrjfContextCleanup
PrjfDoesNameExistInLayer|
|paramcount|5|5|
|`address`|1c0027cf8|140034c38|
|sig|ulonglong __fastcall PrjfSendEndDirectoryEnumerationCommand(longlong param_1, undefined8 param_2, longlong param_3, undefined8 * param_4, undefined8 * param_5)|ulonglong __fastcall PrjfSendEndDirectoryEnumerationCommand(longlong param_1, undefined8 param_2, longlong param_3, undefined8 * param_4, undefined8 * param_5)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfSendEndDirectoryEnumerationCommand Called Diff
```diff
--- PrjfSendEndDirectoryEnumerationCommand called
+++ PrjfSendEndDirectoryEnumerationCommand called
@@ -6,2 +6,2 @@
-WPP_RECORDER_SF_sDd
-WPP_RECORDER_SF_sDdZ
+WPP_RECORDER_AND_TRACE_SF_sDD
+WPP_RECORDER_AND_TRACE_SF_sDdZ
```
### PrjfSendEndDirectoryEnumerationCommand Diff
```diff
--- PrjfSendEndDirectoryEnumerationCommand
+++ PrjfSendEndDirectoryEnumerationCommand
@@ -1,99 +1,105 @@
/* WARNING: Type propagation algorithm not settling */
ulonglong PrjfSendEndDirectoryEnumerationCommand
(longlong param_1,undefined8 param_2,longlong param_3,undefined8 *param_4,
undefined8 *param_5)
{
- uint uVar1;
- ulonglong uVar2;
+ int iVar1;
+ uint uVar2;
ulonglong uVar3;
- undefined2 uVar4;
+ byte bVar4;
+ bool bVar5;
uint local_res18 [4];
- undefined8 in_stack_fffffffffffffd68;
- uint *puVar5;
- undefined8 uVar6;
- undefined8 in_stack_fffffffffffffd80;
- undefined4 uVar9;
- undefined8 uVar7;
- uint **ppuVar8;
- wchar_t *pwVar10;
+ undefined8 in_stack_fffffffffffffd58;
+ ushort uVar6;
+ undefined4 uVar7;
+ undefined4 in_stack_fffffffffffffd84;
+ undefined4 in_stack_fffffffffffffd8c;
+ wchar_t *pwVar8;
uint *local_268;
int local_260 [2];
wchar_t local_258 [8];
undefined8 local_248;
undefined8 uStack_240;
undefined8 local_238;
undefined8 uStack_230;
- uVar9 = (undefined4)((ulonglong)in_stack_fffffffffffffd80 >> 0x20);
local_268 = (uint *)0x0;
memset(&local_238,0,0x220);
local_res18[0] = 0;
local_260[1] = 0;
local_260[0] = 4;
local_238 = *param_5;
uStack_230 = param_5[1];
if (param_3 == 0) {
local_248 = *param_4;
uStack_240 = param_4[1];
- ppuVar8 = &local_268;
- uVar9 = 0;
local_258[0] = L'\0';
local_258[1] = L'\0';
local_258[2] = L'\0';
local_258[3] = L'\0';
local_258[4] = L'\0';
local_258[5] = L'\0';
local_258[6] = L'\0';
local_258[7] = L'\0';
- uVar2 = PrjfPrepareCommandForFilePath
+ uVar3 = PrjfPrepareCommandForFilePath
((ushort *)local_258,&local_248,2,(ushort *)0x0,&local_238,0,(undefined8 *)0x0
- ,ppuVar8,local_res18);
- uVar3 = uVar2 & 0xffffffff;
- if (-1 < (int)uVar2) goto LAB_0;
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_1;
- pwVar10 = local_258;
- uVar4 = 0x99;
- uVar7 = CONCAT44((int)((ulonglong)ppuVar8 >> 0x20),(int)uVar2);
- uVar6 = CONCAT44(uVar9,0x1292);
+ ,&local_268,local_res18);
+ iVar1 = (int)uVar3;
+ uVar3 = uVar3 & 0xffffffff;
+ if (-1 < iVar1) goto LAB_0;
+ bVar5 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar4 = DAT_1 & 0x40;
+ if ((bVar4 == 0) && (!bVar5)) goto LAB_2;
+ pwVar8 = local_258;
+ uVar7 = 0x13c7;
+ uVar6 = 0xab;
}
else {
if (param_4 != (undefined8 *)0x0) {
MicrosoftTelemetryAssertTriggeredNoArgsKM();
}
- puVar5 = local_res18;
- uVar2 = PrjfPrepareCommandForFileObject
- (param_2,param_3,2,&local_238,in_stack_fffffffffffffd68,(longlong *)&local_268
- ,puVar5);
- uVar3 = uVar2 & 0xffffffff;
- if (-1 < (int)uVar2) {
+ uVar3 = PrjfPrepareCommandForFileObject
+ (param_2,param_3,2,&local_238,in_stack_fffffffffffffd58,(longlong *)&local_268
+ ,local_res18);
+ iVar1 = (int)uVar3;
+ uVar3 = uVar3 & 0xffffffff;
+ if (-1 < iVar1) {
LAB_0:
- uVar1 = PrjfSendCommand(param_1,param_2,local_268,0,(longlong)(local_260 + 1),local_260);
- uVar3 = (ulonglong)uVar1;
- if (((int)uVar1 < 0) && ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED))
- {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0x9a,
- &WPP_3ccab5108a9538d17a865fde27ef339f_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c");
+ uVar2 = PrjfSendCommand(param_1,param_2,local_268,0,(longlong)(local_260 + 1),local_260);
+ uVar3 = (ulonglong)uVar2;
+ if ((int)uVar2 < 0) {
+ if (((DAT_1 & 0x40) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x20e,DAT_1 & 0x40,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0xac,
+ &WPP_39279db927ae337b8503ecc20725ff46_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c");
+ }
}
- goto LAB_1;
+ goto LAB_2;
}
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_1;
- pwVar10 = (wchar_t *)(param_3 + 0x58);
- uVar4 = 0x98;
- uVar7 = CONCAT44(uVar9,(int)uVar2);
- uVar6 = CONCAT44((int)((ulonglong)puVar5 >> 0x20),0x127b);
+ bVar5 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar4 = DAT_1 & 0x40;
+ if ((bVar4 == 0) && (!bVar5)) goto LAB_2;
+ pwVar8 = (wchar_t *)(param_3 + 0x58);
+ uVar7 = 0x13b0;
+ uVar6 = 0xaa;
}
- WPP_RECORDER_SF_sDdZ
- (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,uVar4,
- &WPP_3ccab5108a9538d17a865fde27ef339f_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c",uVar6,uVar7,pwVar10);
-LAB_1:
+ WPP_RECORDER_AND_TRACE_SF_sDdZ
+ (0x20e,bVar4,bVar5,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,uVar6,
+ &WPP_39279db927ae337b8503ecc20725ff46_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c",
+ CONCAT44(in_stack_fffffffffffffd84,uVar7),CONCAT44(in_stack_fffffffffffffd8c,iVar1),
+ pwVar8);
+LAB_2:
if (local_268 != (uint *)0x0) {
PrjfFreeCommandBuffer((longlong)local_268,local_res18[0]);
}
return uVar3;
}
```
## PrjfPostAcquireForSectionSynchronization
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.71|
|i_ratio|0.32|
|m_ratio|0.92|
|b_ratio|0.86|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfPostAcquireForSectionSynchronization|PrjfPostAcquireForSectionSynchronization|
|fullname|PrjfPostAcquireForSectionSynchronization|PrjfPostAcquireForSectionSynchronization|
|refcount|3|3|
|`length`|138|168|
|`called`|FLTMGR.SYS::FltReleaseContext
WPP_RECORDER_SF_sDd|FLTMGR.SYS::FltReleaseContext
WPP_RECORDER_AND_TRACE_SF_sDD|
|calling|||
|paramcount|4|4|
|`address`|1c0031ac0|140040e90|
|sig|undefined8 __fastcall PrjfPostAcquireForSectionSynchronization(longlong param_1, undefined8 param_2, longlong param_3, ulonglong param_4)|undefined8 __fastcall PrjfPostAcquireForSectionSynchronization(longlong param_1, undefined8 param_2, longlong param_3, ulonglong param_4)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfPostAcquireForSectionSynchronization Called Diff
```diff
--- PrjfPostAcquireForSectionSynchronization called
+++ PrjfPostAcquireForSectionSynchronization called
@@ -2 +2 @@
-WPP_RECORDER_SF_sDd
+WPP_RECORDER_AND_TRACE_SF_sDD
```
### PrjfPostAcquireForSectionSynchronization Diff
```diff
--- PrjfPostAcquireForSectionSynchronization
+++ PrjfPostAcquireForSectionSynchronization
@@ -1,24 +1,28 @@
undefined8
PrjfPostAcquireForSectionSynchronization
(longlong param_1,undefined8 param_2,longlong param_3,ulonglong param_4)
{
if ((param_4 & 1) == 0) {
if (*(int *)(param_1 + 0x18) < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,2,0x37,
- &WPP_3f8aed4e88f83f53ec58226552f2c258_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\prjflt.c");
+ if (((DAT_0 & 4) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x202,DAT_0 & 4,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,2,0x37,
+ &WPP_3f8aed4e88f83f53ec58226552f2c258_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\prjflt.c");
}
}
else {
*(uint *)(param_3 + 0x28) = *(uint *)(param_3 + 0x28) | 4;
}
}
if (param_3 != 0) {
FltReleaseContext(param_3);
}
return 0;
}
```
## PrjfCopyFileBasicInformation
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.69|
|i_ratio|0.45|
|m_ratio|0.93|
|b_ratio|0.9|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfCopyFileBasicInformation|PrjfCopyFileBasicInformation|
|fullname|PrjfCopyFileBasicInformation|PrjfCopyFileBasicInformation|
|refcount|3|3|
|`length`|555|646|
|`called`|FLTMGR.SYS::FltFsControlFile
FLTMGR.SYS::FltSetInformationFile
WPP_RECORDER_SF_sDd
__security_check_cookie|FLTMGR.SYS::FltFsControlFile
FLTMGR.SYS::FltSetInformationFile
WPP_RECORDER_AND_TRACE_SF_sDD
__security_check_cookie|
|calling|PrjfCopyFileMetaData
PrjfFsctlSetReparsePointPostOp|PrjfCopyFileMetaData
PrjfFsctlSetReparsePointPostOp|
|paramcount|4|4|
|`address`|1c002b7ac|140039000|
|sig|int __fastcall PrjfCopyFileBasicInformation(undefined8 * param_1, undefined8 param_2, undefined8 param_3, ulonglong param_4)|int __fastcall PrjfCopyFileBasicInformation(undefined8 * param_1, undefined8 param_2, undefined8 param_3, ulonglong param_4)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfCopyFileBasicInformation Called Diff
```diff
--- PrjfCopyFileBasicInformation called
+++ PrjfCopyFileBasicInformation called
@@ -3 +3 @@
-WPP_RECORDER_SF_sDd
+WPP_RECORDER_AND_TRACE_SF_sDD
```
### PrjfCopyFileBasicInformation Diff
```diff
--- PrjfCopyFileBasicInformation
+++ PrjfCopyFileBasicInformation
@@ -1,77 +1,88 @@
/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
int PrjfCopyFileBasicInformation
(undefined8 *param_1,undefined8 param_2,undefined8 param_3,ulonglong param_4)
{
int iVar1;
- undefined2 uVar2;
- undefined4 uVar3;
- undefined1 auStackY_b8 [32];
+ byte bVar2;
+ bool bVar3;
+ undefined4 uVar4;
+ undefined1 auStackY_d8 [32];
+ ushort uVar5;
undefined2 local_78 [4];
undefined8 local_70;
undefined8 uStack_68;
undefined8 local_60;
undefined8 uStack_58;
undefined8 local_50;
ulonglong local_48;
- local_48 = __security_cookie ^ (ulonglong)auStackY_b8;
+ local_48 = __security_cookie ^ (ulonglong)auStackY_d8;
local_70 = *param_1;
uStack_68 = param_1[1];
local_78[0] = 0;
- uVar3 = *(undefined4 *)(param_1 + 2);
+ uVar4 = *(undefined4 *)(param_1 + 2);
local_60 = param_1[2];
uStack_58 = param_1[3];
if ((param_4 & 8) == 0) {
- uVar3 = 0;
+ uVar4 = 0;
local_70 = 0;
uStack_68 = 0;
local_60 = 0;
uStack_58 = 0;
}
local_50._0_4_ = (uint)param_1[4];
local_50._0_4_ = -(uint)((param_4 & 0x20) != 0) & (uint)local_50;
local_50._4_4_ = (undefined4)((ulonglong)param_1[4] >> 0x20);
if ((param_4 & 0x40) != 0) {
local_50._0_4_ = (uint)local_50 | 0x400000;
}
- iVar1 = FltSetInformationFile(param_3,uVar3,&local_70,0x28);
+ iVar1 = FltSetInformationFile(param_3,uVar4,&local_70,0x28);
if (iVar1 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) {
+ bVar3 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar2 = DAT_0 & 0x80;
+ if ((bVar2 == 0) && (!bVar3)) {
return iVar1;
}
- uVar2 = 0x2a;
+ uVar5 = 0x2b;
}
else {
if ((param_4 & 0x20) == 0) {
return iVar1;
}
if ((local_50 & 0x800) == 0) {
return iVar1;
}
iVar1 = FltFsControlFile(param_3,param_2,0x9003c,0);
if (iVar1 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xf,0x2b,
- &WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
+ if (((DAT_0 & 0x80) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x20f,DAT_0 & 0x80,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xf,0x2c,
+ &WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
}
local_78[0] = 1;
}
iVar1 = FltFsControlFile(param_3,param_2,0x9c040,local_78);
if (-1 < iVar1) {
return iVar1;
}
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) {
+ bVar3 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar2 = DAT_0 & 0x80;
+ if ((bVar2 == 0) && (!bVar3)) {
return iVar1;
}
- uVar2 = 0x2c;
+ uVar5 = 0x2d;
}
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xf,uVar2,
- &WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x20f,bVar2,bVar3,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xf,uVar5,
+ &WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
return iVar1;
}
```
## PrjfSynchronizeExpansionPreopWithReason
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.86|
|i_ratio|0.47|
|m_ratio|0.98|
|b_ratio|0.96|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfSynchronizeExpansionPreopWithReason|PrjfSynchronizeExpansionPreopWithReason|
|fullname|PrjfSynchronizeExpansionPreopWithReason|PrjfSynchronizeExpansionPreopWithReason|
|refcount|7|7|
|`length`|551|587|
|`called`|FLTMGR.SYS::FltReleaseContext
MicrosoftTelemetryAssertTriggeredMsgKM
PrjfExpandAndPend
PrjfExpandAndWait
PrjfGetContextFileObject
PrjfGetSetStreamHandleContext
WPP_RECORDER_SF_sDd|FLTMGR.SYS::FltReleaseContext
MicrosoftTelemetryAssertTriggeredMsgKM
PrjfExpandAndPend
PrjfExpandAndWait
PrjfGetContextFileObject
PrjfGetSetStreamHandleContext
WPP_RECORDER_AND_TRACE_SF_sDD|
|calling|PrjfPreAcquireForSectionSynchronization
PrjfPreFsControl
PrjfPreLockControl
PrjfPreRead
PrjfPreWrite|PrjfPreAcquireForSectionSynchronization
PrjfPreFsControl
PrjfPreLockControl
PrjfPreRead
PrjfPreWrite|
|paramcount|8|8|
|`address`|1c0020a84|14002bcd8|
|sig|undefined8 __fastcall PrjfSynchronizeExpansionPreopWithReason(uint * param_1, longlong param_2, uint param_3, int param_4, undefined8 param_5, undefined8 param_6, int param_7, undefined8 * param_8)|undefined8 __fastcall PrjfSynchronizeExpansionPreopWithReason(uint * param_1, longlong param_2, uint param_3, int param_4, undefined8 param_5, undefined8 param_6, int param_7, undefined8 * param_8)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfSynchronizeExpansionPreopWithReason Called Diff
```diff
--- PrjfSynchronizeExpansionPreopWithReason called
+++ PrjfSynchronizeExpansionPreopWithReason called
@@ -7 +7 @@
-WPP_RECORDER_SF_sDd
+WPP_RECORDER_AND_TRACE_SF_sDD
```
### PrjfSynchronizeExpansionPreopWithReason Diff
```diff
--- PrjfSynchronizeExpansionPreopWithReason
+++ PrjfSynchronizeExpansionPreopWithReason
@@ -1,90 +1,94 @@
undefined8
PrjfSynchronizeExpansionPreopWithReason
(uint *param_1,longlong param_2,uint param_3,int param_4,undefined8 param_5,
undefined8 param_6,int param_7,undefined8 *param_8)
{
int iVar1;
longlong lVar2;
int *piVar3;
char cVar4;
uint uVar5;
undefined8 uVar6;
longlong local_res10;
int *local_38;
longlong local_30;
local_res10 = 0;
local_38 = (int *)0x0;
local_30 = 0;
*param_8 = 0;
uVar6 = 1;
cVar4 = PrjfGetContextFileObject
(*(undefined8 *)(param_2 + 0x18),*(undefined8 *)(param_2 + 0x20),&local_res10,
(longlong *)&local_38);
piVar3 = local_38;
lVar2 = local_res10;
if ((cVar4 == '\0') || ((int)param_3 <= *(int *)(local_res10 + 0x40))) goto LAB_0;
uVar5 = PrjfGetSetStreamHandleContext
(*(undefined8 *)(param_2 + 0x18),*(undefined8 *)(param_2 + 0x20),local_res10,
local_38,'\0',&local_30);
if ((int)uVar5 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,10,0x23,
- &WPP_286736bb6a73387d41449b09eaab690a_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\expansion.c");
+ if (((DAT_1 & 4) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x20a,DAT_1 & 4,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,10,0x24,
+ &WPP_8662402235063b115c167dc7c0c22e28_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\expansion.c");
}
-LAB_1:
+LAB_2:
param_1[8] = 0;
param_1[9] = 0;
uVar6 = 4;
param_1[6] = uVar5;
}
else {
iVar1 = *piVar3;
if (iVar1 == 0) {
if (param_4 != 0) {
if (param_4 == 1) {
if ((*param_1 & 2) == 0) {
uVar5 = PrjfExpandAndPend(param_1,*(undefined8 *)(param_2 + 0x18),
*(longlong *)(param_2 + 0x20),lVar2,param_3,1,param_7);
- if (uVar5 != 0x103) goto LAB_2;
+ if (uVar5 != 0x103) goto LAB_3;
uVar6 = 2;
}
else {
uVar6 = 3;
}
}
else {
if (param_4 != 2) {
uVar5 = 0xc000000d;
MicrosoftTelemetryAssertTriggeredMsgKM();
- goto LAB_1;
+ goto LAB_2;
}
uVar5 = PrjfExpandAndWait(param_1,*(undefined8 *)(param_2 + 0x18),
*(longlong *)(param_2 + 0x20),lVar2,param_3,1,param_7,'\0');
-LAB_2:
- if ((int)uVar5 < 0) goto LAB_1;
+LAB_3:
+ if ((int)uVar5 < 0) goto LAB_2;
}
}
}
else if ((iVar1 != 1) && (iVar1 != 2)) {
uVar5 = 0xc000000d;
MicrosoftTelemetryAssertTriggeredMsgKM();
- goto LAB_1;
+ goto LAB_2;
}
}
if (local_30 != 0) {
FltReleaseContext();
}
LAB_0:
if (piVar3 != (int *)0x0) {
FltReleaseContext(piVar3);
}
if (lVar2 != 0) {
FltReleaseContext(lVar2);
}
return uVar6;
}
```
## PrjfGetSetFileContext
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.82|
|i_ratio|0.56|
|m_ratio|0.96|
|b_ratio|0.92|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfGetSetFileContext|PrjfGetSetFileContext|
|fullname|PrjfGetSetFileContext|PrjfGetSetFileContext|
|refcount|7|7|
|`length`|534|608|
|`called`|FLTMGR.SYS::FltGetInstanceContext
FLTMGR.SYS::FltReleaseContext
FLTMGR.SYS::FltSetFileContext
MicrosoftTelemetryAssertTriggeredNoArgsKM
PrjfCreateFileContext
WPP_RECORDER_SF_sDd|FLTMGR.SYS::FltGetInstanceContext
FLTMGR.SYS::FltReleaseContext
FLTMGR.SYS::FltSetFileContext
MicrosoftTelemetryAssertTriggeredNoArgsKM
PrjfCreateFileContext
WPP_RECORDER_AND_TRACE_SF_sDD|
|calling|PrjfDeleteTombstoneIfExists
PrjfGetSetContextFileObject
PrjfPrepareForDelete
PrjfProcessTombstoneBounce
PrjfSetDeleteDisposition|PrjfDeleteTombstoneIfExists
PrjfGetSetContextFileObject
PrjfPrepareForDelete
PrjfProcessTombstoneBounce
PrjfSetDeleteDisposition|
|paramcount|8|8|
|`address`|1c0018328|140022370|
|sig|ulonglong __fastcall PrjfGetSetFileContext(undefined8 param_1, undefined8 param_2, char param_3, longlong * param_4, undefined4 * param_5, undefined2 * param_6, undefined1 * param_7, longlong * param_8)|ulonglong __fastcall PrjfGetSetFileContext(undefined8 param_1, undefined8 param_2, char param_3, longlong * param_4, undefined4 * param_5, undefined2 * param_6, undefined1 * param_7, longlong * param_8)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfGetSetFileContext Called Diff
```diff
--- PrjfGetSetFileContext called
+++ PrjfGetSetFileContext called
@@ -6 +6 @@
-WPP_RECORDER_SF_sDd
+WPP_RECORDER_AND_TRACE_SF_sDD
```
### PrjfGetSetFileContext Diff
```diff
--- PrjfGetSetFileContext
+++ PrjfGetSetFileContext
@@ -1,82 +1,89 @@
ulonglong PrjfGetSetFileContext
(undefined8 param_1,undefined8 param_2,char param_3,longlong *param_4,
undefined4 *param_5,undefined2 *param_6,undefined1 *param_7,longlong *param_8)
{
int iVar1;
uint uVar2;
ulonglong uVar3;
longlong lVar4;
undefined1 uVar5;
ulonglong uVar6;
longlong local_48;
longlong local_40;
longlong local_38 [2];
local_48 = 0;
local_38[0] = 0;
local_40 = 0;
*param_8 = 0;
iVar1 = FltGetInstanceContext(param_1,&local_40);
if ((iVar1 < 0) || (local_40 == 0)) {
MicrosoftTelemetryAssertTriggeredNoArgsKM();
}
uVar3 = PrjfCreateFileContext(local_40,param_3,param_5,param_6,param_4,&local_48);
uVar6 = uVar3 & 0xffffffff;
if ((int)uVar3 < 0) {
- lVar4 = local_48;
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,9,0x17,
- &WPP_0def1edc605734705626ac974b591885_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\context.c");
+ if (((DAT_0 & 2) != 0) ||
+ (lVar4 = local_48, (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x209,DAT_0 & 2,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,9,0x17,
+ &WPP_16258fdb5ea53a6e7a49e4d7510d8a5c_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\context.c");
lVar4 = local_48;
}
}
else {
if (param_3 == '\0') {
if ((param_6 != (undefined2 *)0x0) && (*(longlong *)(param_6 + 4) != 0)) {
MicrosoftTelemetryAssertTriggeredNoArgsKM();
}
if ((param_4 != (longlong *)0x0) && (*param_4 != 0)) {
MicrosoftTelemetryAssertTriggeredNoArgsKM();
}
}
lVar4 = local_48;
uVar5 = 1;
uVar2 = FltSetFileContext(param_1,param_2,1,local_48,local_38);
uVar6 = (ulonglong)uVar2;
if ((int)uVar2 < 0) {
FltReleaseContext(lVar4);
uVar5 = 0;
if (uVar2 != 0xc01c0002) {
lVar4 = 0;
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,9,0x18,
- &WPP_0def1edc605734705626ac974b591885_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\context.c");
+ if (((DAT_0 & 2) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x209,DAT_0 & 2,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,9,0x18,
+ &WPP_16258fdb5ea53a6e7a49e4d7510d8a5c_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\context.c");
}
- goto LAB_0;
+ goto LAB_1;
}
uVar6 = 0;
lVar4 = local_38[0];
}
if (param_7 != (undefined1 *)0x0) {
*param_7 = uVar5;
}
if (*(char *)(lVar4 + 0x119) != param_3) {
MicrosoftTelemetryAssertTriggeredNoArgsKM();
}
*param_8 = lVar4;
lVar4 = 0;
}
-LAB_0:
+LAB_1:
if (local_40 != 0) {
FltReleaseContext();
}
if (lVar4 != 0) {
FltReleaseContext(lVar4);
}
return uVar6;
}
```
## PrjfGetUnionContextByFileNameEx
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.5|
|i_ratio|0.46|
|m_ratio|0.93|
|b_ratio|0.88|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfGetUnionContextByFileNameEx|PrjfGetUnionContextByFileNameEx|
|fullname|PrjfGetUnionContextByFileNameEx|PrjfGetUnionContextByFileNameEx|
|refcount|9|9|
|`length`|570|677|
|`called`|FLTMGR.SYS::FltGetFileNameInformation
FLTMGR.SYS::FltReleaseFileNameInformation
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExFreePoolWithTag
PrjfAllocateUnicodeString
PrjfConvertFullPathToRelative
PrjfGetUnionContextByFileName
PrjfReleaseUnionContext
WPP_RECORDER_SF_sDd|FLTMGR.SYS::FltGetFileNameInformation
FLTMGR.SYS::FltReleaseFileNameInformation
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExFreePoolWithTag
PrjfAllocateUnicodeString
PrjfConvertFullPathToRelative
PrjfGetUnionContextByFileName
PrjfReleaseUnionContext
WPP_RECORDER_AND_TRACE_SF_sDD|
|calling|PrjfCreateRenameOrLinkCompletionContext
PrjfDoesNameExistInLayer
PrjfIsFileObjectWithinActiveVirtualizationRoots
PrjfLookupEntryBackingLayerNegativePathCache
PrjfPostCreate|PrjfCreateRenameOrLinkCompletionContext
PrjfDoesNameExistInLayer
PrjfIsFileObjectWithinActiveVirtualizationRoots
PrjfLookupEntryBackingLayerNegativePathCache
PrjfPostCreate|
|paramcount|7|7|
|`address`|1c000327c|1400036e8|
|sig|undefined8 * __fastcall PrjfGetUnionContextByFileNameEx(undefined8 param_1, char param_2, undefined8 param_3, ushort * param_4, undefined8 * param_5, ushort * param_6, undefined1 * param_7)|undefined8 * __fastcall PrjfGetUnionContextByFileNameEx(undefined8 param_1, char param_2, undefined8 param_3, ushort * param_4, undefined8 * param_5, ushort * param_6, undefined1 * param_7)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfGetUnionContextByFileNameEx Called Diff
```diff
--- PrjfGetUnionContextByFileNameEx called
+++ PrjfGetUnionContextByFileNameEx called
@@ -9 +9 @@
-WPP_RECORDER_SF_sDd
+WPP_RECORDER_AND_TRACE_SF_sDD
```
### PrjfGetUnionContextByFileNameEx Diff
```diff
--- PrjfGetUnionContextByFileNameEx
+++ PrjfGetUnionContextByFileNameEx
@@ -1,93 +1,103 @@
undefined8 *
PrjfGetUnionContextByFileNameEx
(undefined8 param_1,char param_2,undefined8 param_3,ushort *param_4,undefined8 *param_5,
ushort *param_6,undefined1 *param_7)
{
- ushort uVar1;
- uint uVar2;
- undefined8 *puVar3;
- ulonglong uVar4;
+ uint uVar1;
+ undefined8 *puVar2;
+ ulonglong uVar3;
+ byte bVar4;
undefined8 *puVar5;
- undefined2 uVar6;
+ bool bVar6;
longlong local_res20;
+ ushort uVar7;
- puVar3 = (undefined8 *)0x0;
+ puVar2 = (undefined8 *)0x0;
local_res20 = 0;
*param_5 = 0;
- puVar5 = puVar3;
+ puVar5 = puVar2;
if (param_4 == (ushort *)0x0) {
- uVar2 = FltGetFileNameInformation
+ uVar1 = FltGetFileNameInformation
(param_1,(-(uint)(param_2 != '\0') & 0x4000000) + 0x101,&local_res20);
- puVar5 = (undefined8 *)(ulonglong)uVar2;
- if (-1 < (int)uVar2) {
+ puVar5 = (undefined8 *)(ulonglong)uVar1;
+ if (-1 < (int)uVar1) {
param_4 = (ushort *)(local_res20 + 8);
goto LAB_0;
}
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_1;
- uVar6 = 0x25;
-LAB_2:
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,9,uVar6,
- &WPP_0def1edc605734705626ac974b591885_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\context.c");
+ bVar6 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar4 = DAT_1 & 2;
+ if ((bVar4 == 0) && (!bVar6)) goto LAB_2;
+ uVar7 = 0x25;
+LAB_3:
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x209,bVar4,bVar6,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,9,uVar7,
+ &WPP_16258fdb5ea53a6e7a49e4d7510d8a5c_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\context.c");
}
else {
LAB_0:
- puVar3 = PrjfGetUnionContextByFileName(param_1,param_3,param_4,param_7);
- if (puVar3 == (undefined8 *)0x0) goto LAB_1;
- if (*param_4 == *(ushort *)(puVar3 + 5)) {
+ puVar2 = PrjfGetUnionContextByFileName(param_1,param_3,param_4,param_7);
+ if (puVar2 == (undefined8 *)0x0) goto LAB_2;
+ if (*param_4 == *(ushort *)(puVar2 + 5)) {
param_6[4] = 0;
param_6[5] = 0;
param_6[6] = 0;
param_6[7] = 0;
param_6[0] = 0;
param_6[1] = 0;
}
else {
- uVar1 = (*param_4 - *(ushort *)(puVar3 + 5)) - 2;
- param_6[1] = uVar1;
- if (*param_4 <= uVar1) {
+ uVar7 = (*param_4 - *(ushort *)(puVar2 + 5)) - 2;
+ param_6[1] = uVar7;
+ if (*param_4 <= uVar7) {
MicrosoftTelemetryAssertTriggeredNoArgsKM();
}
if (param_6[1] == 0) {
MicrosoftTelemetryAssertTriggeredNoArgsKM();
}
- uVar4 = PrjfAllocateUnicodeString(0x6e664a50,param_6);
- puVar5 = (undefined8 *)(uVar4 & 0xffffffff);
- if ((int)uVar4 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_1;
- uVar6 = 0x26;
- goto LAB_2;
+ uVar3 = PrjfAllocateUnicodeString(0x6e664a50,param_6);
+ puVar5 = (undefined8 *)(uVar3 & 0xffffffff);
+ if ((int)uVar3 < 0) {
+ bVar6 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar4 = DAT_1 & 2;
+ if ((bVar4 == 0) && (!bVar6)) goto LAB_2;
+ uVar7 = 0x26;
+ goto LAB_3;
}
- uVar4 = PrjfConvertFullPathToRelative((ushort *)(puVar3 + 5),param_4,param_6);
- puVar5 = (undefined8 *)(uVar4 & 0xffffffff);
- if ((int)uVar4 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,9,0x27,
- &WPP_0def1edc605734705626ac974b591885_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\context.c");
+ uVar3 = PrjfConvertFullPathToRelative((ushort *)(puVar2 + 5),param_4,param_6);
+ puVar5 = (undefined8 *)(uVar3 & 0xffffffff);
+ if ((int)uVar3 < 0) {
+ if (((DAT_1 & 2) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x209,DAT_1 & 2,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,9,0x27,
+ &WPP_16258fdb5ea53a6e7a49e4d7510d8a5c_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\context.c");
}
if (*(longlong *)(param_6 + 4) != 0) {
ExFreePoolWithTag(*(longlong *)(param_6 + 4),0x6e664a50);
param_6[4] = 0;
param_6[5] = 0;
param_6[6] = 0;
param_6[7] = 0;
}
- goto LAB_1;
+ goto LAB_2;
}
}
- *param_5 = puVar3;
- puVar3 = (undefined8 *)0x0;
+ *param_5 = puVar2;
+ puVar2 = (undefined8 *)0x0;
}
-LAB_1:
+LAB_2:
if (local_res20 != 0) {
FltReleaseFileNameInformation();
}
- if (puVar3 != (undefined8 *)0x0) {
- PrjfReleaseUnionContext((longlong)puVar3);
+ if (puVar2 != (undefined8 *)0x0) {
+ PrjfReleaseUnionContext((longlong)puVar2);
}
return puVar5;
}
```
## PrjfCreateSymlinkFromPlaceholderInfoMessage
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.72|
|i_ratio|0.44|
|m_ratio|0.94|
|b_ratio|0.93|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfCreateSymlinkFromPlaceholderInfoMessage|PrjfCreateSymlinkFromPlaceholderInfoMessage|
|fullname|PrjfCreateSymlinkFromPlaceholderInfoMessage|PrjfCreateSymlinkFromPlaceholderInfoMessage|
|refcount|2|2|
|`length`|211|246|
|`called`|PrjfCreateSymbolicLink
WPP_RECORDER_SF_sDd|PrjfCreateSymbolicLink
WPP_RECORDER_AND_TRACE_SF_sDD|
|calling|PrjfWritePlaceholderInformationHandler|PrjfWritePlaceholderInformationHandler|
|paramcount|4|4|
|`address`|1c002c3b8|140039e2c|
|sig|int __fastcall PrjfCreateSymlinkFromPlaceholderInfoMessage(undefined8 param_1, longlong param_2, wchar_t * param_3, longlong param_4)|int __fastcall PrjfCreateSymlinkFromPlaceholderInfoMessage(undefined8 param_1, longlong param_2, wchar_t * param_3, longlong param_4)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfCreateSymlinkFromPlaceholderInfoMessage Called Diff
```diff
--- PrjfCreateSymlinkFromPlaceholderInfoMessage called
+++ PrjfCreateSymlinkFromPlaceholderInfoMessage called
@@ -2 +2 @@
-WPP_RECORDER_SF_sDd
+WPP_RECORDER_AND_TRACE_SF_sDD
```
### PrjfCreateSymlinkFromPlaceholderInfoMessage Diff
```diff
--- PrjfCreateSymlinkFromPlaceholderInfoMessage
+++ PrjfCreateSymlinkFromPlaceholderInfoMessage
@@ -1,26 +1,32 @@
int PrjfCreateSymlinkFromPlaceholderInfoMessage
(undefined8 param_1,longlong param_2,wchar_t *param_3,longlong param_4)
{
int iVar1;
ulonglong local_28;
longlong lStack_20;
ulonglong local_18;
longlong lStack_10;
local_18 = (ulonglong)CONCAT22(*(undefined2 *)(param_4 + 0x70),*(undefined2 *)(param_4 + 0x70));
lStack_10 = (ulonglong)*(uint *)(param_4 + 0x68) + param_4;
local_28 = (ulonglong)CONCAT22(*(undefined2 *)(param_4 + 0x72),*(undefined2 *)(param_4 + 0x72));
lStack_20 = (ulonglong)*(uint *)(param_4 + 0x6c) + param_4;
iVar1 = PrjfCreateSymbolicLink
(param_1,param_2,param_3,(ulonglong)*(uint *)(param_4 + 0x60) + param_4,
(ushort *)&local_18,(ushort *)&local_28,*(uint *)(param_4 + 0x74));
- if ((iVar1 < 0) && ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,0xd9,
- &WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
+ if (iVar1 < 0) {
+ if (((DAT_0 & 0x20) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x205,DAT_0 & 0x20,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,0xde,
+ &WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
+ }
}
return iVar1;
}
```
## PrjfCreateFileContext
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.19|
|i_ratio|0.59|
|m_ratio|0.96|
|b_ratio|0.58|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfCreateFileContext|PrjfCreateFileContext|
|fullname|PrjfCreateFileContext|PrjfCreateFileContext|
|refcount|2|2|
|`length`|1140|1276|
|`called`|Expand for full list:
FLTMGR.SYS::FltAllocateContext
FLTMGR.SYS::FltReferenceContext
FLTMGR.SYS::FltReleaseContext
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExInitializeResourceLite
NTOSKRNL.EXE::ExInitializeRundownProtection
NTOSKRNL.EXE::KeInitializeEvent
NTOSKRNL.EXE::RtlCreateHashTable
PrjfAllocateUnicodeString
WPP_RECORDER_SF_sD
WPP_RECORDER_SF_sDd
memcpy
memsetExpand for full list:
FLTMGR.SYS::FltAllocateContext
FLTMGR.SYS::FltReferenceContext
FLTMGR.SYS::FltReleaseContext
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExInitializeResourceLite
NTOSKRNL.EXE::ExInitializeRundownProtection
NTOSKRNL.EXE::KeInitializeEvent
NTOSKRNL.EXE::RtlCreateHashTable
PrjfAllocateUnicodeString
WPP_RECORDER_AND_TRACE_SF_sD
WPP_RECORDER_AND_TRACE_SF_sDD
memmove
memset
PrjfGetUnionContextByVirtualizationInstanceInfo
PrjfReleaseUnionContext
WPP_RECORDER_SF_sD|PrjfClearNegativePathCache
PrjfGetUnionContextByVirtualizationInstanceInfo
PrjfReleaseUnionContext
WPP_RECORDER_AND_TRACE_SF_sD|
|calling|PrjfPortMessage|PrjfPortMessage|
|paramcount|3|3|
|`address`|1c0023be0|14002f91c|
|sig|undefined8 __fastcall PrjfClearNegativePathCacheHandler(undefined8 param_1, longlong * param_2, int * param_3)|undefined8 __fastcall PrjfClearNegativePathCacheHandler(undefined8 param_1, longlong * param_2, int * param_3)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfClearNegativePathCacheHandler Called Diff
```diff
--- PrjfClearNegativePathCacheHandler called
+++ PrjfClearNegativePathCacheHandler called
@@ -4 +4 @@
-WPP_RECORDER_SF_sD
+WPP_RECORDER_AND_TRACE_SF_sD
```
### PrjfClearNegativePathCacheHandler Diff
```diff
--- PrjfClearNegativePathCacheHandler
+++ PrjfClearNegativePathCacheHandler
@@ -1,26 +1,30 @@
undefined8 PrjfClearNegativePathCacheHandler(undefined8 param_1,longlong *param_2,int *param_3)
{
longlong *plVar1;
undefined8 uVar2;
uVar2 = 0;
plVar1 = PrjfGetUnionContextByVirtualizationInstanceInfo(param_2,param_1);
if (plVar1 == (longlong *)0x0) {
uVar2 = 0xc000ce04;
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sD(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0xc3,
- &WPP_3ccab5108a9538d17a865fde27ef339f_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c");
+ if (((DAT_0 & 0x40) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sD
+ (0x20e,DAT_0 & 0x40,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0xd5,
+ &WPP_39279db927ae337b8503ecc20725ff46_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c");
}
}
else {
if ((*(uint *)(plVar1 + 7) & 1) != 0) {
PrjfClearNegativePathCache((longlong)plVar1,param_3);
}
PrjfReleaseUnionContext((longlong)plVar1);
}
return uVar2;
}
```
## PrjfMungeDirectoryEnumerateWithoutShortnameFileIdAll
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.91|
|i_ratio|0.61|
|m_ratio|0.97|
|b_ratio|0.96|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfMungeDirectoryEnumerateWithoutShortnameFileIdAll|PrjfMungeDirectoryEnumerateWithoutShortnameFileIdAll|
|fullname|PrjfMungeDirectoryEnumerateWithoutShortnameFileIdAll|PrjfMungeDirectoryEnumerateWithoutShortnameFileIdAll|
|refcount|2|2|
|`length`|468|512|
|`called`|MicrosoftTelemetryAssertTriggeredMsgKM
MicrosoftTelemetryAssertTriggeredNoArgsKM
WPP_RECORDER_SF_sDd
memcpy|MicrosoftTelemetryAssertTriggeredMsgKM
MicrosoftTelemetryAssertTriggeredNoArgsKM
WPP_RECORDER_AND_TRACE_SF_sDD
memmove|
|calling|PrjfTranslateCurrentEnumEntry|PrjfTranslateCurrentEnumEntry|
|paramcount|8|8|
|`address`|1c001d6cc|140028290|
|sig|undefined8 __fastcall PrjfMungeDirectoryEnumerateWithoutShortnameFileIdAll(int param_1, char param_2, undefined8 * param_3, char param_4, undefined8 * param_5, uint param_6, undefined8 * param_7, uint * param_8)|undefined8 __fastcall PrjfMungeDirectoryEnumerateWithoutShortnameFileIdAll(int param_1, char param_2, undefined8 * param_3, char param_4, undefined8 * param_5, uint param_6, undefined8 * param_7, uint * param_8)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfMungeDirectoryEnumerateWithoutShortnameFileIdAll Called Diff
```diff
--- PrjfMungeDirectoryEnumerateWithoutShortnameFileIdAll called
+++ PrjfMungeDirectoryEnumerateWithoutShortnameFileIdAll called
@@ -3,2 +3,2 @@
-WPP_RECORDER_SF_sDd
-memcpy
+WPP_RECORDER_AND_TRACE_SF_sDD
+memmove
```
### PrjfMungeDirectoryEnumerateWithoutShortnameFileIdAll Diff
```diff
--- PrjfMungeDirectoryEnumerateWithoutShortnameFileIdAll
+++ PrjfMungeDirectoryEnumerateWithoutShortnameFileIdAll
@@ -1,78 +1,82 @@
undefined8
PrjfMungeDirectoryEnumerateWithoutShortnameFileIdAll
(int param_1,char param_2,undefined8 *param_3,char param_4,undefined8 *param_5,
uint param_6,undefined8 *param_7,uint *param_8)
{
uint uVar1;
undefined8 uVar2;
uint uVar3;
undefined8 uVar4;
uint uVar5;
uVar4 = 0;
uVar5 = 0;
if (param_1 == 0x50) {
uVar1 = *(uint *)((longlong)param_3 + 0x3c);
if ((uVar1 + 0x60 <= param_6) || ((uVar5 = 0, 0x5f < param_6 && (param_2 != '\0')))) {
uVar5 = uVar1;
if (param_6 - 0x60 <= uVar1) {
uVar5 = param_6 - 0x60;
}
uVar2 = param_3[1];
*param_5 = *param_3;
param_5[1] = uVar2;
uVar2 = param_3[3];
param_5[2] = param_3[2];
param_5[3] = uVar2;
uVar2 = param_3[5];
param_5[4] = param_3[4];
param_5[5] = uVar2;
uVar2 = param_3[7];
param_5[6] = param_3[6];
param_5[7] = uVar2;
uVar2 = param_3[9];
param_5[8] = param_3[8];
param_5[9] = uVar2;
uVar2 = param_3[0xb];
param_5[10] = param_3[10];
param_5[0xb] = uVar2;
if (*(int *)((longlong)param_3 + 0x44) == -0x6fffffe4) {
uVar3 = *(uint *)(param_3 + 7) & 0xffffe9ff;
if (uVar3 == 0) {
uVar3 = 0x80;
}
*(uint *)(param_5 + 7) = uVar3;
*(undefined4 *)((longlong)param_5 + 0x44) = 0;
}
if (param_4 != '\0') {
*(uint *)(param_5 + 7) = *(uint *)(param_5 + 7) | 0x440000;
param_5[6] = 0;
param_5[9] = 0xffffffffffffffff;
param_5[10] = 0xffffffffffffffff;
param_5[0xb] = 0xffffffffffffffff;
}
- memcpy(param_5 + 0xc,param_3 + 0xc,(ulonglong)uVar5);
+ memmove(param_5 + 0xc,param_3 + 0xc,(ulonglong)uVar5);
*(undefined4 *)param_5 = 0;
*param_7 = param_5;
uVar5 = uVar5 + 0x60;
if (uVar5 < uVar1 + 0x60) {
uVar4 = 0x80000005;
}
}
}
else {
MicrosoftTelemetryAssertTriggeredNoArgsKM();
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),3,0x12,0x12,
- &WPP_e21b7c61aee93f730c9c252e6e8da2f4_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\dir.c");
+ if (((DAT_0 & 4) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x312,DAT_0 & 4,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),3,0x12,0x12,
+ &WPP_3d19aee1b05838720427e757513a9608_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\dir.c");
}
MicrosoftTelemetryAssertTriggeredMsgKM();
uVar4 = 0xc00000bb;
}
*param_8 = uVar5;
return uVar4;
}
```
## PrjfPrepareCommandForFileObject
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.73|
|i_ratio|0.71|
|m_ratio|0.98|
|b_ratio|0.96|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfPrepareCommandForFileObject|PrjfPrepareCommandForFileObject|
|fullname|PrjfPrepareCommandForFileObject|PrjfPrepareCommandForFileObject|
|refcount|5|5|
|`length`|540|568|
|`called`|FLTMGR.SYS::FltReleaseContext
PrjfGetContextFileObjectEx
PrjfPrepareCommandForFilePath
WPP_RECORDER_SF_sDdLZ|FLTMGR.SYS::FltReleaseContext
PrjfGetContextFileObjectEx
PrjfPrepareCommandForFilePath
WPP_RECORDER_AND_TRACE_SF_sDdLZ|
|calling|PrjfSendEndDirectoryEnumerationCommand
PrjfSendGetDirectoryEnumerationCommand
PrjfSendGetFileStreamCommand
PrjfSendStartDirectoryEnumerationCommand|PrjfSendEndDirectoryEnumerationCommand
PrjfSendGetDirectoryEnumerationCommand
PrjfSendGetFileStreamCommand
PrjfSendStartDirectoryEnumerationCommand|
|paramcount|7|7|
|`address`|1c00269c4|140033628|
|sig|ulonglong __fastcall PrjfPrepareCommandForFileObject(undefined8 param_1, undefined8 param_2, uint param_3, undefined8 * param_4, undefined8 param_5, longlong * param_6, uint * param_7)|ulonglong __fastcall PrjfPrepareCommandForFileObject(undefined8 param_1, undefined8 param_2, uint param_3, undefined8 * param_4, undefined8 param_5, longlong * param_6, uint * param_7)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfPrepareCommandForFileObject Called Diff
```diff
--- PrjfPrepareCommandForFileObject called
+++ PrjfPrepareCommandForFileObject called
@@ -4 +4 @@
-WPP_RECORDER_SF_sDdLZ
+WPP_RECORDER_AND_TRACE_SF_sDdLZ
```
### PrjfPrepareCommandForFileObject Diff
```diff
--- PrjfPrepareCommandForFileObject
+++ PrjfPrepareCommandForFileObject
@@ -1,116 +1,117 @@
ulonglong PrjfPrepareCommandForFileObject
(undefined8 param_1,undefined8 param_2,uint param_3,undefined8 *param_4,
undefined8 param_5,longlong *param_6,uint *param_7)
{
undefined8 *puVar1;
undefined8 uVar2;
longlong lVar3;
longlong lVar4;
char cVar5;
ulonglong uVar6;
undefined8 *puVar7;
longlong lVar8;
- longlong *plVar9;
- undefined8 *puVar10;
- ulonglong uVar11;
+ undefined8 *puVar9;
+ ulonglong uVar10;
longlong local_58;
longlong local_50;
longlong local_48;
undefined8 uStack_40;
longlong local_38;
ushort local_30 [4];
longlong lStack_28;
- uVar11 = 0;
+ uVar10 = 0;
local_50 = 0;
local_48 = 0;
*param_6 = 0;
local_58 = 0;
local_38 = 0;
local_30[0] = 0;
local_30[1] = 0;
local_30[2] = 0;
local_30[3] = 0;
lStack_28 = 0;
cVar5 = PrjfGetContextFileObjectEx(param_1,param_2,&local_48,&local_50,&local_58);
lVar4 = local_48;
lVar3 = local_50;
if (cVar5 != '\0') {
lStack_28 = *(longlong *)(local_48 + 0x48);
- plVar9 = &local_48;
local_30[1] = *(undefined2 *)(lStack_28 + 0x120);
local_30[0] = *(undefined2 *)(lStack_28 + 0x120);
lStack_28 = lStack_28 + 0x122;
uStack_40 = *(undefined8 *)(local_48 + 0x68);
local_48 = *(longlong *)(local_48 + 0x60);
uVar6 = PrjfPrepareCommandForFilePath
- (local_30,plVar9,param_3,(ushort *)0x0,param_4,local_58,(undefined8 *)0x0,
+ (local_30,&local_48,param_3,(ushort *)0x0,param_4,local_58,(undefined8 *)0x0,
&local_38,param_7);
- uVar11 = uVar6 & 0xffffffff;
+ uVar10 = uVar6 & 0xffffffff;
if ((int)uVar6 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDdLZ
- (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),plVar9,0xe,0x7d,
- &WPP_3ccab5108a9538d17a865fde27ef339f_Traceguids,
+ if (((DAT_0 & 0x40) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDdLZ
+ (0x20e,DAT_0 & 0x40,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),param_4,0xe,0x87,
+ &WPP_39279db927ae337b8503ecc20725ff46_Traceguids,
"onecore\\base\\fs\\gvflt\\filter\\sys\\message.c");
}
}
else {
uVar2 = *(undefined8 *)(lVar3 + 0x20);
*(undefined8 *)(local_38 + 0x1c) = *(undefined8 *)(lVar3 + 0x18);
*(undefined8 *)(local_38 + 0x24) = uVar2;
if (local_58 != 0) {
uVar2 = *(undefined8 *)(local_58 + 0x40);
*(undefined8 *)(local_38 + 0x2c) = *(undefined8 *)(local_58 + 0x38);
*(undefined8 *)(local_38 + 0x34) = uVar2;
}
puVar7 = *(undefined8 **)(lVar4 + 0x70);
lVar8 = 2;
- puVar10 = (undefined8 *)(local_38 + 0x3c);
+ puVar9 = (undefined8 *)(local_38 + 0x3c);
do {
uVar2 = puVar7[1];
- *puVar10 = *puVar7;
- puVar10[1] = uVar2;
+ *puVar9 = *puVar7;
+ puVar9[1] = uVar2;
uVar2 = puVar7[3];
- puVar10[2] = puVar7[2];
- puVar10[3] = uVar2;
+ puVar9[2] = puVar7[2];
+ puVar9[3] = uVar2;
uVar2 = puVar7[5];
- puVar10[4] = puVar7[4];
- puVar10[5] = uVar2;
+ puVar9[4] = puVar7[4];
+ puVar9[5] = uVar2;
uVar2 = puVar7[7];
- puVar10[6] = puVar7[6];
- puVar10[7] = uVar2;
+ puVar9[6] = puVar7[6];
+ puVar9[7] = uVar2;
uVar2 = puVar7[9];
- puVar10[8] = puVar7[8];
- puVar10[9] = uVar2;
+ puVar9[8] = puVar7[8];
+ puVar9[9] = uVar2;
uVar2 = puVar7[0xb];
- puVar10[10] = puVar7[10];
- puVar10[0xb] = uVar2;
+ puVar9[10] = puVar7[10];
+ puVar9[0xb] = uVar2;
uVar2 = puVar7[0xd];
- puVar10[0xc] = puVar7[0xc];
- puVar10[0xd] = uVar2;
+ puVar9[0xc] = puVar7[0xc];
+ puVar9[0xd] = uVar2;
puVar1 = puVar7 + 0xe;
uVar2 = puVar7[0xf];
puVar7 = puVar7 + 0x10;
- puVar10[0xe] = *puVar1;
- puVar10[0xf] = uVar2;
+ puVar9[0xe] = *puVar1;
+ puVar9[0xf] = uVar2;
lVar8 = lVar8 + -1;
- puVar10 = puVar10 + 0x10;
+ puVar9 = puVar9 + 0x10;
} while (lVar8 != 0);
*param_6 = local_38;
}
}
if (lVar4 != 0) {
FltReleaseContext(lVar4);
}
if (lVar3 != 0) {
FltReleaseContext(lVar3);
}
if (local_58 != 0) {
FltReleaseContext();
}
- return uVar11;
+ return uVar10;
}
```
## PrjfMappingInsert
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.52|
|i_ratio|0.17|
|m_ratio|0.95|
|b_ratio|0.65|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfMappingInsert|PrjfMappingInsert|
|fullname|PrjfMappingInsert|PrjfMappingInsert|
|refcount|2|2|
|`length`|1555|1800|
|`called`|Expand for full list:
FLTMGR.SYS::FltAcquireResourceExclusive
FLTMGR.SYS::FltReleaseResource
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::RtlRbInsertNodeEx
NTOSKRNL.EXE::RtlRbRemoveNode
PrjfCreateInstanceTierNode
PrjfCreatePathTierNode
PrjfCreatePathTree
PrjfDeletePathTierNode
PrjfDeletePathTree
PrjfRBComparePathNodes
PrjfWalkPath
WPP_RECORDER_SF_sD
WPP_RECORDER_SF_sDdExpand for full list:
FLTMGR.SYS::FltAcquireResourceExclusive
FLTMGR.SYS::FltReleaseResource
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::RtlRbInsertNodeEx
NTOSKRNL.EXE::RtlRbRemoveNode
PrjfCreateInstanceTierNode
PrjfCreatePathTierNode
PrjfCreatePathTree
PrjfDeletePathTierNode
PrjfDeletePathTree
PrjfRBComparePathNodes
PrjfWalkPath
WPP_RECORDER_AND_TRACE_SF_sD
WPP_RECORDER_AND_TRACE_SF_sDDExpand for full list:
FLTMGR.SYS::FltAcknowledgeEcp
FLTMGR.SYS::FltCancelFileOpen
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltFindExtraCreateParameter
FLTMGR.SYS::FltGetEcpListFromCallbackData
FLTMGR.SYS::FltReissueSynchronousIo
FLTMGR.SYS::FltReleaseContext
FLTMGR.SYS::FltReleaseFileNameInformation
FLTMGR.SYS::FltRemoveOpenReparseEntry
FLTMGR.SYS::FltSetCallbackDataDirty
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExFreeToPagedLookasideList
NTOSKRNL.EXE::ObfDereferenceObject
PrjfCheckAndCancelTransactedOpen
PrjfGetContextFileObject
PrjfGetSetContextFileObject
PrjfGetUnionContextByFileNameEx
PrjfOpenAsReparsePoint
PrjfProcessFileDirectoryStatus
PrjfProcessOpenWithinVirtualizationRoots
PrjfProcessPrjReparsePointBounce
PrjfProcessTombstoneBounce
PrjfReleaseUnionContext
PrjfSetDeleteDisposition
PrjfSetPlaceHolderFlagsSynchronized
WPP_RECORDER_SF_sDDld
WPP_RECORDER_SF_sDZdDl
WPP_RECORDER_SF_sDd
WPP_RECORDER_SF_sDdD
WPP_RECORDER_SF_sDdZ
WPP_RECORDER_SF_sDdZDl
WPP_RECORDER_SF_sDdZDlLL
WPP_RECORDER_SF_sDdZdDl
WPP_RECORDER_SF_sDqDld
WPP_RECORDER_SF_sDqdExpand for full list:
FLTMGR.SYS::FltAcknowledgeEcp
FLTMGR.SYS::FltCancelFileOpen
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltFindExtraCreateParameter
FLTMGR.SYS::FltGetEcpListFromCallbackData
FLTMGR.SYS::FltReissueSynchronousIo
FLTMGR.SYS::FltReleaseContext
FLTMGR.SYS::FltReleaseFileNameInformation
FLTMGR.SYS::FltRemoveOpenReparseEntry
FLTMGR.SYS::FltSetCallbackDataDirty
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExFreeToPagedLookasideList
NTOSKRNL.EXE::ObfDereferenceObject
PrjfCheckAndCancelTransactedOpen
PrjfGetContextFileObject
PrjfGetSetContextFileObject
PrjfGetUnionContextByFileNameEx
PrjfOpenAsReparsePoint
PrjfProcessFileDirectoryStatus
PrjfProcessOpenWithinVirtualizationRoots
PrjfProcessPrjReparsePointBounce
PrjfProcessTombstoneBounce
PrjfReleaseUnionContext
PrjfSetDeleteDisposition
PrjfSetPlaceHolderFlagsSynchronized
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDDld
WPP_RECORDER_AND_TRACE_SF_sDZdDl
WPP_RECORDER_AND_TRACE_SF_sDdD
WPP_RECORDER_AND_TRACE_SF_sDdZ
WPP_RECORDER_AND_TRACE_SF_sDdZDl
WPP_RECORDER_AND_TRACE_SF_sDdZDlLL
WPP_RECORDER_AND_TRACE_SF_sDdZdDl
WPP_RECORDER_AND_TRACE_SF_sDqDld
WPP_RECORDER_AND_TRACE_SF_sDqdExpand for full list:
FLTMGR.SYS::FltAcquireResourceShared
FLTMGR.SYS::FltGetFileNameInformation
FLTMGR.SYS::FltGetInstanceContext
FLTMGR.SYS::FltReleaseContext
FLTMGR.SYS::FltReleaseFileNameInformation
FLTMGR.SYS::FltReleaseResource
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::RtlCopyUnicodeString
NTOSKRNL.EXE::RtlPrefixUnicodeString
PrjfAllocateUnicodeString
WPP_RECORDER_SF_sDZL
WPP_RECORDER_SF_sDdExpand for full list:
FLTMGR.SYS::FltAcquireResourceShared
FLTMGR.SYS::FltGetFileNameInformation
FLTMGR.SYS::FltGetInstanceContext
FLTMGR.SYS::FltReleaseContext
FLTMGR.SYS::FltReleaseFileNameInformation
FLTMGR.SYS::FltReleaseResource
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::RtlCopyUnicodeString
NTOSKRNL.EXE::RtlPrefixUnicodeString
PrjfAllocateUnicodeString
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDZL
PrjfFsctlStartVirtualizationInstance|PrjfFsctlSetReparsePoint
PrjfFsctlStartVirtualizationInstance|
|paramcount|4|4|
|`address`|1c00034c0|140003994|
|sig|int __fastcall PrjfIsNameOnPathOfRoot(undefined8 param_1, undefined8 param_2, undefined4 * param_3, undefined2 * param_4)|int __fastcall PrjfIsNameOnPathOfRoot(undefined8 param_1, undefined8 param_2, undefined4 * param_3, undefined2 * param_4)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfIsNameOnPathOfRoot Called Diff
```diff
--- PrjfIsNameOnPathOfRoot called
+++ PrjfIsNameOnPathOfRoot called
@@ -11,2 +11,2 @@
-WPP_RECORDER_SF_sDZL
-WPP_RECORDER_SF_sDd
+WPP_RECORDER_AND_TRACE_SF_sDD
+WPP_RECORDER_AND_TRACE_SF_sDZL
```
### PrjfIsNameOnPathOfRoot Diff
```diff
--- PrjfIsNameOnPathOfRoot
+++ PrjfIsNameOnPathOfRoot
@@ -1,94 +1,112 @@
int PrjfIsNameOnPathOfRoot
(undefined8 param_1,undefined8 param_2,undefined4 *param_3,undefined2 *param_4)
{
ushort *puVar1;
ushort uVar2;
longlong lVar3;
char cVar4;
int iVar5;
undefined8 *puVar6;
undefined8 uVar7;
- undefined8 *puVar8;
- ushort *puVar9;
+ ushort *puVar8;
+ undefined8 *puVar9;
+ ushort *puVar10;
longlong local_res18;
longlong local_res20;
local_res18 = 0;
local_res20 = 0;
iVar5 = FltGetInstanceContext(param_2,&local_res18);
if ((iVar5 < 0) || (local_res18 == 0)) {
MicrosoftTelemetryAssertTriggeredNoArgsKM();
}
*param_3 = 0;
*(undefined8 *)(param_4 + 4) = 0;
*param_4 = 0;
iVar5 = FltGetFileNameInformation(param_1,0x101,&local_res20);
lVar3 = local_res20;
if (iVar5 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,9,0x2b,
- &WPP_0def1edc605734705626ac974b591885_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\context.c");
+ if (((DAT_0 & 2) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x209,DAT_0 & 2,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,9,0x2b,
+ &WPP_16258fdb5ea53a6e7a49e4d7510d8a5c_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\context.c");
}
}
else {
- puVar9 = (ushort *)(local_res20 + 8);
+ puVar10 = (ushort *)(local_res20 + 8);
FltAcquireResourceShared(local_res18 + 0x30);
iVar5 = -0x3ffffddb;
puVar6 = (undefined8 *)(local_res18 + 0x98);
- for (puVar8 = (undefined8 *)*puVar6; puVar8 != puVar6; puVar8 = (undefined8 *)*puVar8) {
- puVar1 = (ushort *)(puVar8 + 3);
- cVar4 = RtlPrefixUnicodeString(puVar1,puVar9,1);
+ for (puVar9 = (undefined8 *)*puVar6; puVar9 != puVar6; puVar9 = (undefined8 *)*puVar9) {
+ puVar1 = (ushort *)(puVar9 + 3);
+ puVar8 = puVar1;
+ cVar4 = RtlPrefixUnicodeString(puVar1,puVar10,1);
if (cVar4 != '\0') {
uVar2 = *puVar1;
- if (uVar2 < *puVar9) {
- if (*(short *)(*(longlong *)(lVar3 + 0x10) + (ulonglong)(uVar2 >> 1) * 2) != 0x5c)
- goto LAB_0;
+ if (uVar2 < *puVar10) {
+ puVar8 = (ushort *)(ulonglong)(uVar2 >> 1);
+ if (*(short *)(*(longlong *)(lVar3 + 0x10) + (longlong)puVar8 * 2) != 0x5c)
+ goto LAB_1;
*param_3 = 2;
}
- else if (*puVar9 == uVar2) {
+ else if (*puVar10 == uVar2) {
*param_3 = 3;
}
-LAB_1:
+LAB_2:
iVar5 = 0;
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDZL(*(undefined8 *)(WPP_GLOBAL_Control + 0x40));
+ if (((DAT_3 & 0x40) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDZL
+ (puVar8,DAT_3 & 0x40,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40));
}
- param_4[1] = *(undefined2 *)((longlong)puVar8 + 0x1a);
+ param_4[1] = *(undefined2 *)((longlong)puVar9 + 0x1a);
uVar7 = PrjfAllocateUnicodeString(0x6e664a50,param_4);
if ((int)uVar7 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,9,0x2d,
- &WPP_0def1edc605734705626ac974b591885_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\context.c");
+ if (((DAT_0 & 2) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x209,DAT_0 & 2,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,9,0x2d,
+ &WPP_16258fdb5ea53a6e7a49e4d7510d8a5c_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\context.c");
}
*param_3 = 0;
+ iVar5 = 0;
}
else {
RtlCopyUnicodeString(param_4,puVar1);
}
break;
}
- cVar4 = RtlPrefixUnicodeString(puVar9,puVar1,1);
+ puVar8 = puVar10;
+ cVar4 = RtlPrefixUnicodeString(puVar10,puVar1,1);
if ((cVar4 != '\0') &&
- ((*puVar1 <= *puVar9 || (*(short *)(puVar8[4] + (ulonglong)(*puVar9 >> 1) * 2) == 0x5c))))
- {
+ ((*puVar1 <= *puVar10 ||
+ (puVar8 = (ushort *)(ulonglong)(*puVar10 >> 1),
+ *(short *)(puVar9[4] + (longlong)puVar8 * 2) == 0x5c)))) {
*param_3 = 1;
- goto LAB_1;
+ goto LAB_2;
}
-LAB_0:
+LAB_1:
puVar6 = (undefined8 *)(local_res18 + 0x98);
}
FltReleaseResource(local_res18 + 0x30);
}
if (local_res18 != 0) {
FltReleaseContext();
}
if (local_res20 != 0) {
FltReleaseFileNameInformation();
}
return iVar5;
}
```
## PrjfInstanceQueryTeardown
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.3|
|i_ratio|0.32|
|m_ratio|0.92|
|b_ratio|0.86|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfInstanceQueryTeardown|PrjfInstanceQueryTeardown|
|fullname|PrjfInstanceQueryTeardown|PrjfInstanceQueryTeardown|
|refcount|3|3|
|`length`|364|434|
|`called`|FLTMGR.SYS::FltAcquireResourceExclusive
FLTMGR.SYS::FltGetInstanceContext
FLTMGR.SYS::FltReleaseContext
FLTMGR.SYS::FltReleaseResource
WPP_RECORDER_SF_sDZd
WPP_RECORDER_SF_sDd|FLTMGR.SYS::FltAcquireResourceExclusive
FLTMGR.SYS::FltGetInstanceContext
FLTMGR.SYS::FltReleaseContext
FLTMGR.SYS::FltReleaseResource
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDZd|
|calling|||
|paramcount|1|1|
|`address`|1c0030a30|14003fa80|
|sig|undefined8 __fastcall PrjfInstanceQueryTeardown(longlong param_1)|undefined8 __fastcall PrjfInstanceQueryTeardown(longlong param_1)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfInstanceQueryTeardown Called Diff
```diff
--- PrjfInstanceQueryTeardown called
+++ PrjfInstanceQueryTeardown called
@@ -5,2 +5,2 @@
-WPP_RECORDER_SF_sDZd
-WPP_RECORDER_SF_sDd
+WPP_RECORDER_AND_TRACE_SF_sDD
+WPP_RECORDER_AND_TRACE_SF_sDZd
```
### PrjfInstanceQueryTeardown Diff
```diff
--- PrjfInstanceQueryTeardown
+++ PrjfInstanceQueryTeardown
@@ -1,74 +1,87 @@
undefined8 PrjfInstanceQueryTeardown(longlong param_1)
{
longlong lVar1;
longlong *plVar2;
- undefined8 uVar3;
- code *pcVar4;
- undefined1 *puVar5;
- longlong *plVar6;
- undefined8 uVar7;
- undefined1 *puVar8;
+ code *pcVar3;
+ undefined1 *puVar4;
+ longlong *plVar5;
+ undefined8 uVar6;
+ undefined1 *puVar7;
longlong local_res8;
- undefined1 auStack_58 [8];
- undefined1 auStack_50 [72];
+ undefined1 auStack_68 [8];
+ undefined1 auStack_60 [88];
- puVar8 = auStack_58;
- uVar7 = 0;
+ puVar7 = auStack_68;
+ uVar6 = 0;
local_res8 = 0;
FltGetInstanceContext(*(undefined8 *)(param_1 + 0x18),&local_res8);
FltAcquireResourceExclusive(local_res8 + 0x30);
- plVar6 = *(longlong **)(local_res8 + 0x98);
+ plVar5 = *(longlong **)(local_res8 + 0x98);
do {
- if (plVar6 == (longlong *)(local_res8 + 0x98)) {
+ if (plVar5 == (longlong *)(local_res8 + 0x98)) {
LAB_0:
- *(undefined8 *)(puVar8 + -8) = 0x1c0030b6e;
- FltReleaseResource(*(longlong *)(puVar8 + 0x60) + 0x30);
- *(undefined8 *)(puVar8 + -8) = 0x1c0030b7f;
- FltReleaseContext(*(undefined8 *)(puVar8 + 0x60));
- return uVar7;
+ *(undefined8 *)(puVar7 + -8) = 0x14003fc03;
+ FltReleaseResource(*(longlong *)(puVar7 + 0x70) + 0x30);
+ *(undefined8 *)(puVar7 + -8) = 0x14003fc14;
+ FltReleaseContext(*(undefined8 *)(puVar7 + 0x70));
+ return uVar6;
}
- puVar5 = auStack_58;
- if (plVar6[8] != 0) {
+ puVar4 = auStack_68;
+ if (plVar5[8] != 0) {
LAB_1:
- puVar8 = puVar5;
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- *(int *)(puVar8 + 0x40) = (int)plVar6[9];
- *(longlong **)(puVar8 + 0x38) = plVar6 + 3;
- *(undefined4 *)(puVar8 + 0x30) = 0x301;
- *(char **)(puVar8 + 0x28) = "onecore\\base\\fs\\gvflt\\filter\\sys\\prjflt.c";
- *(undefined **)(puVar8 + 0x20) = &WPP_3f8aed4e88f83f53ec58226552f2c258_Traceguids;
- uVar7 = *(undefined8 *)(WPP_GLOBAL_Control + 0x40);
- *(undefined8 *)(puVar8 + -8) = 0x1c0030b1e;
- WPP_RECORDER_SF_sDZd
- (uVar7,3,0x10,0x19,*(undefined8 *)(puVar8 + 0x20),*(char **)(puVar8 + 0x28),
- *(undefined8 *)(puVar8 + 0x30),*(wchar_t **)(puVar8 + 0x38));
+ puVar7 = puVar4;
+ if (((DAT_2 & 1) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ *(int *)(puVar7 + 0x58) = (int)plVar5[9];
+ *(longlong **)(puVar7 + 0x50) = plVar5 + 3;
+ *(undefined4 *)(puVar7 + 0x48) = 0x301;
+ *(char **)(puVar7 + 0x40) = "onecore\\base\\fs\\gvflt\\filter\\sys\\prjflt.c";
+ *(undefined **)(puVar7 + 0x38) = &WPP_3f8aed4e88f83f53ec58226552f2c258_Traceguids;
+ uVar6 = *(undefined8 *)(WPP_GLOBAL_Control + 0x40);
+ *(undefined2 *)(puVar7 + 0x30) = 0x19;
+ *(undefined4 *)(puVar7 + 0x28) = 0x10;
+ puVar7[0x20] = 3;
+ *(undefined8 *)(puVar7 + -8) = 0x14003fb92;
+ WPP_RECORDER_AND_TRACE_SF_sDZd
+ (0x310,DAT_2 & 1,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,uVar6,
+ puVar7[0x20],*(undefined4 *)(puVar7 + 0x28),*(ushort *)(puVar7 + 0x30),
+ *(undefined8 *)(puVar7 + 0x38),*(char **)(puVar7 + 0x40),
+ *(undefined8 *)(puVar7 + 0x48),*(wchar_t **)(puVar7 + 0x50));
}
- uVar7 = 0xc01c0010;
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- *(undefined4 *)(puVar8 + 0x38) = 0xc01c0010;
- *(undefined4 *)(puVar8 + 0x30) = 0x312;
- *(char **)(puVar8 + 0x28) = "onecore\\base\\fs\\gvflt\\filter\\sys\\prjflt.c";
- uVar3 = *(undefined8 *)(WPP_GLOBAL_Control + 0x40);
- *(undefined **)(puVar8 + 0x20) = &WPP_3f8aed4e88f83f53ec58226552f2c258_Traceguids;
- *(undefined8 *)(puVar8 + -8) = 0x1c0030b5e;
- WPP_RECORDER_SF_sDd(uVar3,3,0x10,0x1a,*(undefined8 *)(puVar8 + 0x20),
- *(char **)(puVar8 + 0x28));
+ if (((DAT_2 & 1) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ *(undefined4 *)(puVar7 + 0x50) = 0xc01c0010;
+ *(undefined4 *)(puVar7 + 0x48) = 0x312;
+ *(char **)(puVar7 + 0x40) = "onecore\\base\\fs\\gvflt\\filter\\sys\\prjflt.c";
+ uVar6 = *(undefined8 *)(WPP_GLOBAL_Control + 0x40);
+ *(undefined **)(puVar7 + 0x38) = &WPP_3f8aed4e88f83f53ec58226552f2c258_Traceguids;
+ *(undefined2 *)(puVar7 + 0x30) = 0x1a;
+ *(undefined4 *)(puVar7 + 0x28) = 0x10;
+ puVar7[0x20] = 3;
+ *(undefined8 *)(puVar7 + -8) = 0x14003fbf1;
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x310,DAT_2 & 1,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,uVar6,
+ puVar7[0x20],*(undefined4 *)(puVar7 + 0x28),*(ushort *)(puVar7 + 0x30),
+ *(undefined8 *)(puVar7 + 0x38),*(char **)(puVar7 + 0x40));
}
+ uVar6 = 0xc01c0010;
goto LAB_0;
}
- lVar1 = *plVar6;
- if ((*(longlong **)(lVar1 + 8) != plVar6) ||
- (plVar2 = (longlong *)plVar6[1], (longlong *)*plVar2 != plVar6)) {
- pcVar4 = (code *)swi(0x29);
- (*pcVar4)(3);
- puVar5 = auStack_50;
+ lVar1 = *plVar5;
+ if ((*(longlong **)(lVar1 + 8) != plVar5) ||
+ (plVar2 = (longlong *)plVar5[1], (longlong *)*plVar2 != plVar5)) {
+ pcVar3 = (code *)swi(0x29);
+ (*pcVar3)(3);
+ puVar4 = auStack_60;
goto LAB_1;
}
*plVar2 = lVar1;
*(longlong **)(lVar1 + 8) = plVar2;
- plVar6 = (longlong *)*plVar6;
+ plVar5 = (longlong *)*plVar5;
} while( true );
}
```
## FastWppTraceMessage
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,refcount,length,sig,address,calling,called|
|ratio|0.2|
|i_ratio|0.04|
|m_ratio|0.32|
|b_ratio|0.28|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|FastWppTraceMessage|FastWppTraceMessage|
|fullname|FastWppTraceMessage|FastWppTraceMessage|
|`refcount`|56|60|
|`length`|68|385|
|`called`|NTOSKRNL.EXE::WmiTraceMessageVa|FastWppPackEvent
NTOSKRNL.EXE::EtwWriteEx
NTOSKRNL.EXE::ExAllocatePool3
NTOSKRNL.EXE::ExFreePoolWithTag
__security_check_cookie|
|`calling`|Expand for full list:
WPP_RECORDER_SF_sD
WPP_RECORDER_SF_sDDDZ
WPP_RECORDER_SF_sDDZ
WPP_RECORDER_SF_sDDZDZ
WPP_RECORDER_SF_sDDd
WPP_RECORDER_SF_sDDld
WPP_RECORDER_SF_sDLLd
WPP_RECORDER_SF_sDLd
WPP_RECORDER_SF_sDZ
WPP_RECORDER_SF_sDZDDD
WPP_RECORDER_SF_sDZL
WPP_RECORDER_SF_sDZLL
WPP_RECORDER_SF_sDZLii
WPP_RECORDER_SF_sDZ_guid_Dd
WPP_RECORDER_SF_sDZd
WPP_RECORDER_SF_sDZdDl
WPP_RECORDER_SF_sDd
WPP_RECORDER_SF_sDdD
WPP_RECORDER_SF_sDdDZ
WPP_RECORDER_SF_sDdL
WPP_RECORDER_SF_sDdLL
WPP_RECORDER_SF_sDdLLl
WPP_RECORDER_SF_sDdLZ
WPP_RECORDER_SF_sDdLlqqq
WPP_RECORDER_SF_sDdPZ
WPP_RECORDER_SF_sDdZ
WPP_RECORDER_SF_sDdZDl
WPP_RECORDER_SF_sDdZDlLL
WPP_RECORDER_SF_sDdZL
WPP_RECORDER_SF_sDdZLZ
WPP_RECORDER_SF_sDdZP
WPP_RECORDER_SF_sDdZZ
WPP_RECORDER_SF_sDdZZZq
WPP_RECORDER_SF_sDdZZq
WPP_RECORDER_SF_sDdZd
WPP_RECORDER_SF_sDdZdDl
WPP_RECORDER_SF_sDdZssss
WPP_RECORDER_SF_sDddZ
WPP_RECORDER_SF_sDdiiZ
WPP_RECORDER_SF_sDdsZ
WPP_RECORDER_SF_sDiD
WPP_RECORDER_SF_sDiid
WPP_RECORDER_SF_sDl
WPP_RECORDER_SF_sDlLD
WPP_RECORDER_SF_sDlLL
WPP_RECORDER_SF_sDld
WPP_RECORDER_SF_sDq
WPP_RECORDER_SF_sDqDld
WPP_RECORDER_SF_sDqZd
WPP_RECORDER_SF_sDqd
WPP_RECORDER_SF_sDqqZd
WPP_RECORDER_SF_sDqqqZd
WPP_RECORDER_SF_sDqqqd
WPP_RECORDER_SF_sDsDZ
WPP_RECORDER_SF_sDsiLiLZExpand for full list:
WPP_RECORDER_AND_TRACE_SF_sD
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDDD
WPP_RECORDER_AND_TRACE_SF_sDDDZ
WPP_RECORDER_AND_TRACE_SF_sDDZ
WPP_RECORDER_AND_TRACE_SF_sDDZDZ
WPP_RECORDER_AND_TRACE_SF_sDDdd
WPP_RECORDER_AND_TRACE_SF_sDDld
WPP_RECORDER_AND_TRACE_SF_sDHZ
WPP_RECORDER_AND_TRACE_SF_sDLLd
WPP_RECORDER_AND_TRACE_SF_sDLd
WPP_RECORDER_AND_TRACE_SF_sDZ
WPP_RECORDER_AND_TRACE_SF_sDZDDD
WPP_RECORDER_AND_TRACE_SF_sDZL
WPP_RECORDER_AND_TRACE_SF_sDZLL
WPP_RECORDER_AND_TRACE_SF_sDZLii
WPP_RECORDER_AND_TRACE_SF_sDZ_guid_Dd
WPP_RECORDER_AND_TRACE_SF_sDZd
WPP_RECORDER_AND_TRACE_SF_sDZdDl
WPP_RECORDER_AND_TRACE_SF_sDdD
WPP_RECORDER_AND_TRACE_SF_sDdDZ
WPP_RECORDER_AND_TRACE_SF_sDdL
WPP_RECORDER_AND_TRACE_SF_sDdLL
WPP_RECORDER_AND_TRACE_SF_sDdLLl
WPP_RECORDER_AND_TRACE_SF_sDdLZ
WPP_RECORDER_AND_TRACE_SF_sDdLlqqq
WPP_RECORDER_AND_TRACE_SF_sDdPZ
WPP_RECORDER_AND_TRACE_SF_sDdZ
WPP_RECORDER_AND_TRACE_SF_sDdZDl
WPP_RECORDER_AND_TRACE_SF_sDdZDlLL
WPP_RECORDER_AND_TRACE_SF_sDdZL
WPP_RECORDER_AND_TRACE_SF_sDdZLZ
WPP_RECORDER_AND_TRACE_SF_sDdZP
WPP_RECORDER_AND_TRACE_SF_sDdZZ
WPP_RECORDER_AND_TRACE_SF_sDdZZZq
WPP_RECORDER_AND_TRACE_SF_sDdZZq
WPP_RECORDER_AND_TRACE_SF_sDdZd
WPP_RECORDER_AND_TRACE_SF_sDdZdDl
WPP_RECORDER_AND_TRACE_SF_sDdZssss
WPP_RECORDER_AND_TRACE_SF_sDddZ
WPP_RECORDER_AND_TRACE_SF_sDdiiZ
WPP_RECORDER_AND_TRACE_SF_sDdsZ
WPP_RECORDER_AND_TRACE_SF_sDiD
WPP_RECORDER_AND_TRACE_SF_sDid
WPP_RECORDER_AND_TRACE_SF_sDiid
WPP_RECORDER_AND_TRACE_SF_sDiiiid
WPP_RECORDER_AND_TRACE_SF_sDl
WPP_RECORDER_AND_TRACE_SF_sDlLD
WPP_RECORDER_AND_TRACE_SF_sDlLL
WPP_RECORDER_AND_TRACE_SF_sDld
WPP_RECORDER_AND_TRACE_SF_sDq
WPP_RECORDER_AND_TRACE_SF_sDqDld
WPP_RECORDER_AND_TRACE_SF_sDqZd
WPP_RECORDER_AND_TRACE_SF_sDqd
WPP_RECORDER_AND_TRACE_SF_sDqqZd
WPP_RECORDER_AND_TRACE_SF_sDqqqZd
WPP_RECORDER_AND_TRACE_SF_sDqqqd
WPP_RECORDER_AND_TRACE_SF_sDsDZ
WPP_RECORDER_AND_TRACE_SF_sDsiLiLZExpand for full list:
FLTMGR.SYS::FltAcquireResourceShared
FLTMGR.SYS::FltReleaseResource
FLTMGR.SYS::FltWriteFileEx
NTOSKRNL.EXE::IoAllocateMdl
NTOSKRNL.EXE::IoFreeMdl
NTOSKRNL.EXE::IoGetCurrentProcess
NTOSKRNL.EXE::MmProbeAndLockPages
NTOSKRNL.EXE::MmUnlockPages
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::ObfReferenceObject
NTOSKRNL.EXE::ProbeForRead
NTOSKRNL.EXE::RtlLookupElementGenericTableAvl
PrjfGetUnionContextByVirtualizationInstanceInfo
PrjfManageHydrationOnNonCachedHandle
PrjfReleaseUnionContext
WPP_RECORDER_SF_sD
WPP_RECORDER_SF_sDd
WPP_RECORDER_SF_sDdZ
WPP_RECORDER_SF_sDdiiZ
WPP_RECORDER_SF_sDsiLiLZ
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransferExpand for full list:
FLTMGR.SYS::FltAcquireResourceShared
FLTMGR.SYS::FltReleaseResource
FLTMGR.SYS::FltWriteFileEx
Feature_1083645240__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::IoAllocateMdl
NTOSKRNL.EXE::IoFreeMdl
NTOSKRNL.EXE::IoGetCurrentProcess
NTOSKRNL.EXE::MmProbeAndLockPages
NTOSKRNL.EXE::MmUnlockPages
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::ObfReferenceObject
NTOSKRNL.EXE::ProbeForRead
NTOSKRNL.EXE::RtlLookupElementGenericTableAvl
PrjfGetUnionContextByVirtualizationInstanceInfo
PrjfManageHydrationOnNonCachedHandle
PrjfReleaseUnionContext
PrjfValidateHandleAccess
WPP_RECORDER_AND_TRACE_SF_sD
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDdZ
WPP_RECORDER_AND_TRACE_SF_sDdiiZ
WPP_RECORDER_AND_TRACE_SF_sDsiLiLZ
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
MicrosoftTelemetryAssertTriggeredNoArgsKM
WPP_RECORDER_SF_sDd
memcpy|MicrosoftTelemetryAssertTriggeredMsgKM
MicrosoftTelemetryAssertTriggeredNoArgsKM
WPP_RECORDER_AND_TRACE_SF_sDD
memmove|
|calling|PrjfTranslateCurrentEnumEntry|PrjfTranslateCurrentEnumEntry|
|paramcount|9|9|
|`address`|1c001c4ec|140026edc|
|sig|undefined8 __fastcall PrjfMungeDirectoryEnumerateWithShortname(int param_1, char param_2, undefined8 * param_3, char param_4, char param_5, undefined8 * param_6, uint param_7, undefined8 * param_8, uint * param_9)|undefined8 __fastcall PrjfMungeDirectoryEnumerateWithShortname(int param_1, char param_2, undefined8 * param_3, char param_4, char param_5, undefined8 * param_6, uint param_7, undefined8 * param_8, uint * param_9)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfMungeDirectoryEnumerateWithShortname Called Diff
```diff
--- PrjfMungeDirectoryEnumerateWithShortname called
+++ PrjfMungeDirectoryEnumerateWithShortname called
@@ -3,2 +3,2 @@
-WPP_RECORDER_SF_sDd
-memcpy
+WPP_RECORDER_AND_TRACE_SF_sDD
+memmove
```
### PrjfMungeDirectoryEnumerateWithShortname Diff
```diff
--- PrjfMungeDirectoryEnumerateWithShortname
+++ PrjfMungeDirectoryEnumerateWithShortname
@@ -1,172 +1,184 @@
undefined8
PrjfMungeDirectoryEnumerateWithShortname
(int param_1,char param_2,undefined8 *param_3,char param_4,char param_5,
undefined8 *param_6,uint param_7,undefined8 *param_8,uint *param_9)
{
uint uVar1;
bool bVar2;
uint uVar3;
undefined4 uVar4;
undefined8 uVar5;
undefined8 uVar6;
uint uVar7;
uVar5 = 0;
uVar7 = 0;
uVar3 = 0;
if ((param_1 == 3) || (bVar2 = true, param_1 == 0x3f)) {
bVar2 = false;
}
if (bVar2) {
MicrosoftTelemetryAssertTriggeredNoArgsKM();
}
uVar6 = uVar5;
if (param_1 != 3) {
if (param_1 != 0x3f) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),3,0x12,0xd,
- &WPP_e21b7c61aee93f730c9c252e6e8da2f4_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\dir.c");
+ if (((DAT_0 & 4) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x312,DAT_0 & 4,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),3,0x12,0xd,
+ &WPP_3d19aee1b05838720427e757513a9608_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\dir.c");
}
MicrosoftTelemetryAssertTriggeredMsgKM();
uVar6 = 0xc00000bb;
- goto LAB_0;
+ goto LAB_1;
}
uVar1 = *(uint *)((longlong)param_3 + 0x3c);
if ((param_7 < uVar1 + 0x72) && ((uVar7 = uVar3, param_7 < 0x72 || (param_2 == '\0'))))
- goto LAB_0;
+ goto LAB_1;
uVar7 = uVar1;
if (param_7 - 0x72 <= uVar1) {
uVar7 = param_7 - 0x72;
}
uVar5 = param_3[1];
*param_6 = *param_3;
param_6[1] = uVar5;
uVar5 = param_3[3];
param_6[2] = param_3[2];
param_6[3] = uVar5;
uVar5 = param_3[5];
param_6[4] = param_3[4];
param_6[5] = uVar5;
uVar5 = param_3[7];
param_6[6] = param_3[6];
param_6[7] = uVar5;
uVar5 = param_3[9];
param_6[8] = param_3[8];
param_6[9] = uVar5;
param_6[10] = param_3[10];
if (param_4 == '\0') {
-LAB_1:
+LAB_2:
*(undefined1 *)(param_6 + 0xb) = 0;
}
else {
if (0x18 < *(byte *)(param_3 + 0xb)) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x12,0xc,
- &WPP_e21b7c61aee93f730c9c252e6e8da2f4_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\dir.c");
+ if (((DAT_3 & 4) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x212,DAT_3 & 4,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x12,0xc,
+ &WPP_3d19aee1b05838720427e757513a9608_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\dir.c");
}
if (0x18 < *(byte *)(param_3 + 0xb)) {
MicrosoftTelemetryAssertTriggeredNoArgsKM();
}
- goto LAB_1;
+ goto LAB_2;
}
*(byte *)(param_6 + 0xb) = *(byte *)(param_3 + 0xb);
- memcpy((void *)((longlong)param_6 + 0x5a),(void *)((longlong)param_3 + 0x5a),
- (longlong)*(char *)(param_3 + 0xb));
+ memmove((void *)((longlong)param_6 + 0x5a),(void *)((longlong)param_3 + 0x5a),
+ (longlong)*(char *)(param_3 + 0xb));
}
if (*(int *)((longlong)param_3 + 0x44) == -0x6fffffe4) {
uVar3 = *(uint *)(param_3 + 7) & 0xffffe9ff;
if (uVar3 == 0) {
uVar3 = 0x80;
}
*(uint *)(param_6 + 7) = uVar3;
*(undefined4 *)((longlong)param_6 + 0x44) = 0;
}
if (param_5 != '\0') {
*(uint *)(param_6 + 7) = *(uint *)(param_6 + 7) | 0x440000;
param_6[6] = 0;
param_6[9] = 0xffffffffffffffff;
param_6[10] = 0xffffffffffffffff;
}
- memcpy((void *)((longlong)param_6 + 0x72),(void *)((longlong)param_3 + 0x72),(ulonglong)uVar7);
+ memmove((void *)((longlong)param_6 + 0x72),(void *)((longlong)param_3 + 0x72),(ulonglong)uVar7);
*(undefined4 *)param_6 = 0;
*param_8 = param_6;
uVar7 = uVar7 + 0x72;
if (uVar7 < uVar1 + 0x72) {
uVar6 = 0x80000005;
}
- goto LAB_0;
+ goto LAB_1;
}
uVar1 = *(uint *)((longlong)param_3 + 0x3c);
if ((param_7 < uVar1 + 0x5e) && ((uVar6 = 0, uVar7 = uVar3, param_7 < 0x5e || (param_2 == '\0'))))
- goto LAB_0;
+ goto LAB_1;
uVar7 = uVar1;
if (param_7 - 0x5e <= uVar1) {
uVar7 = param_7 - 0x5e;
}
uVar6 = param_3[1];
*param_6 = *param_3;
param_6[1] = uVar6;
uVar6 = param_3[3];
param_6[2] = param_3[2];
param_6[3] = uVar6;
uVar6 = param_3[5];
param_6[4] = param_3[4];
param_6[5] = uVar6;
param_6[6] = param_3[6];
if (*(int *)((longlong)param_3 + 0x44) == -0x6fffffe4) {
uVar3 = *(uint *)(param_3 + 7) & 0xffffe9ff;
if (uVar3 == 0) {
uVar3 = 0x80;
}
*(uint *)(param_6 + 7) = uVar3;
-LAB_2:
+LAB_4:
uVar4 = *(undefined4 *)(param_3 + 8);
}
else {
*(uint *)(param_6 + 7) = *(uint *)(param_3 + 7);
- if ((*(uint *)(param_3 + 7) & 0x400) == 0) goto LAB_2;
+ if ((*(uint *)(param_3 + 7) & 0x400) == 0) goto LAB_4;
uVar4 = *(undefined4 *)((longlong)param_3 + 0x44);
}
*(undefined4 *)(param_6 + 8) = uVar4;
if (param_5 != '\0') {
*(uint *)(param_6 + 7) = *(uint *)(param_6 + 7) | 0x440000;
param_6[6] = 0;
}
if (param_4 == '\0') {
-LAB_3:
+LAB_5:
*(undefined1 *)((longlong)param_6 + 0x44) = 0;
}
else {
if (0x18 < *(byte *)(param_3 + 0xb)) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x12,0xb,
- &WPP_e21b7c61aee93f730c9c252e6e8da2f4_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\dir.c");
+ if (((DAT_3 & 4) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x212,DAT_3 & 4,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x12,0xb,
+ &WPP_3d19aee1b05838720427e757513a9608_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\dir.c");
}
if (0x18 < *(byte *)(param_3 + 0xb)) {
MicrosoftTelemetryAssertTriggeredNoArgsKM();
}
- goto LAB_3;
+ goto LAB_5;
}
*(byte *)((longlong)param_6 + 0x44) = *(byte *)(param_3 + 0xb);
- memcpy((void *)((longlong)param_6 + 0x46),(void *)((longlong)param_3 + 0x5a),
- (longlong)*(char *)(param_3 + 0xb));
+ memmove((void *)((longlong)param_6 + 0x46),(void *)((longlong)param_3 + 0x5a),
+ (longlong)*(char *)(param_3 + 0xb));
}
*(undefined4 *)((longlong)param_6 + 0x3c) = *(undefined4 *)((longlong)param_3 + 0x3c);
- memcpy((void *)((longlong)param_6 + 0x5e),(void *)((longlong)param_3 + 0x72),(ulonglong)uVar7);
+ memmove((void *)((longlong)param_6 + 0x5e),(void *)((longlong)param_3 + 0x72),(ulonglong)uVar7);
*(undefined4 *)param_6 = 0;
*param_8 = param_6;
uVar7 = uVar7 + 0x5e;
uVar6 = uVar5;
if (uVar7 < uVar1 + 0x5e) {
uVar6 = 0x80000005;
}
-LAB_0:
+LAB_1:
*param_9 = uVar7;
return uVar6;
}
```
## PrjfPostQueryInformation
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.92|
|i_ratio|0.55|
|m_ratio|0.97|
|b_ratio|0.93|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfPostQueryInformation|PrjfPostQueryInformation|
|fullname|PrjfPostQueryInformation|PrjfPostQueryInformation|
|refcount|3|3|
|`length`|486|529|
|`called`|FLTMGR.SYS::FltReleaseContext
PrjfGetContextFileObject
WPP_RECORDER_SF_sD|FLTMGR.SYS::FltReleaseContext
PrjfGetContextFileObject
WPP_RECORDER_AND_TRACE_SF_sD|
|calling|||
|paramcount|2|2|
|`address`|1c0020e00|14002c0c0|
|sig|undefined8 __fastcall PrjfPostQueryInformation(longlong param_1, longlong param_2)|undefined8 __fastcall PrjfPostQueryInformation(longlong param_1, longlong param_2)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfPostQueryInformation Called Diff
```diff
--- PrjfPostQueryInformation called
+++ PrjfPostQueryInformation called
@@ -3 +3 @@
-WPP_RECORDER_SF_sD
+WPP_RECORDER_AND_TRACE_SF_sD
```
### PrjfPostQueryInformation Diff
```diff
--- PrjfPostQueryInformation
+++ PrjfPostQueryInformation
@@ -1,92 +1,97 @@
undefined8 PrjfPostQueryInformation(longlong param_1,longlong param_2)
{
int iVar1;
longlong lVar2;
undefined8 *puVar3;
int *piVar4;
longlong lVar5;
char cVar6;
uint uVar7;
longlong lVar8;
uint uVar9;
int *local_res8;
longlong local_18 [2];
local_res8 = (int *)0x0;
local_18[0] = 0;
if (((*(int *)(param_1 + 0x18) + 0x80000000U & 0x80000000) == 0) &&
(*(int *)(param_1 + 0x18) != -0x7ffffffb)) {
return 0;
}
cVar6 = PrjfGetContextFileObject
(*(undefined8 *)(param_2 + 0x18),*(undefined8 *)(param_2 + 0x20),local_18,
(longlong *)&local_res8);
lVar5 = local_18[0];
piVar4 = local_res8;
if (cVar6 != '\0') {
if (local_18[0] == 0) goto LAB_0;
if (*(int *)(local_18[0] + 0x40) != 3) {
lVar2 = *(longlong *)(param_1 + 0x10);
iVar1 = *(int *)(lVar2 + 0x20);
puVar3 = *(undefined8 **)(lVar2 + 0x28);
if (iVar1 == 0x16) {
- if ((*local_res8 == 2) &&
- ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
- WPP_RECORDER_SF_sD(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),3,0xd,0x24,
- &WPP_9aa94875f0ba3c84ae0a423dcca6636f_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\fileinfo.c");
+ if (*local_res8 == 2) {
+ if (((DAT_1 & 0x20) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sD
+ (0x30d,DAT_1 & 0x20,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),3,0xd,0x24,
+ &WPP_9aa94875f0ba3c84ae0a423dcca6636f_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\fileinfo.c");
+ }
}
}
else if (iVar1 == 0x1c) {
if ((*(int *)(local_18[0] + 0x40) == 1) && (*local_res8 == 0)) {
*puVar3 = 0;
}
}
else {
uVar9 = 0;
lVar8 = 0;
if ((iVar1 == 4) || (iVar1 == 0x12)) {
lVar8 = 0x20;
}
else if (iVar1 == 0x22) {
lVar8 = 0x30;
}
else if (iVar1 == 0x23) {
uVar9 = 4;
}
else if (((iVar1 == 0x44) || (iVar1 == 0x46)) || (uVar9 = 0, iVar1 == 0x4d)) {
lVar8 = 0x38;
uVar9 = 0x3c;
}
if ((*(int *)(param_1 + 0x18) != -0x7ffffffb) ||
(lVar8 + 4U <= (ulonglong)*(uint *)(lVar2 + 0x18))) {
uVar7 = 0xffffe9ff;
if (*local_res8 == 2) {
uVar7 = 0xffffebff;
}
uVar7 = uVar7 & *(uint *)(lVar8 + (longlong)puVar3);
if (uVar7 == 0) {
uVar7 = 0x80;
}
*(uint *)(lVar8 + (longlong)puVar3) = uVar7;
}
if ((uVar9 != 0) &&
((*(int *)(param_1 + 0x18) != -0x7ffffffb ||
(uVar9 + 4 <= *(uint *)(*(longlong *)(param_1 + 0x10) + 0x18))))) {
*(undefined4 *)((ulonglong)uVar9 + (longlong)puVar3) = 0;
}
}
}
}
if (lVar5 != 0) {
FltReleaseContext(lVar5);
}
LAB_0:
if (piVar4 != (int *)0x0) {
FltReleaseContext(piVar4);
}
return 0;
}
```
## PrjfGetSetStreamHandleContext
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.75|
|i_ratio|0.41|
|m_ratio|0.94|
|b_ratio|0.9|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfGetSetStreamHandleContext|PrjfGetSetStreamHandleContext|
|fullname|PrjfGetSetStreamHandleContext|PrjfGetSetStreamHandleContext|
|refcount|5|5|
|`length`|682|797|
|`called`|Expand for full list:
FLTMGR.SYS::FltAllocateContext
FLTMGR.SYS::FltGetStreamHandleContext
FLTMGR.SYS::FltReferenceContext
FLTMGR.SYS::FltReleaseContext
FLTMGR.SYS::FltSetStreamHandleContext
NTOSKRNL.EXE::ExUuidCreate
NTOSKRNL.EXE::IoGetCurrentProcess
NTOSKRNL.EXE::KeInitializeEvent
PrjfInitProcessInfo
WPP_RECORDER_SF_sDd
__security_check_cookie
memsetExpand for full list:
FLTMGR.SYS::FltAllocateContext
FLTMGR.SYS::FltGetStreamHandleContext
FLTMGR.SYS::FltReferenceContext
FLTMGR.SYS::FltReleaseContext
FLTMGR.SYS::FltSetStreamHandleContext
NTOSKRNL.EXE::ExUuidCreate
NTOSKRNL.EXE::IoGetCurrentProcess
NTOSKRNL.EXE::KeInitializeEvent
PrjfInitProcessInfo
WPP_RECORDER_AND_TRACE_SF_sDD
__security_check_cookie
memset
PrjfIsDirectoryEmpty
PrjfLaunchExpansion
PrjfSynchronizeExpansionPreopWithReason|PrjfGetSetContextFileObject
PrjfIsDirectoryEmpty
PrjfLaunchExpansion
PrjfSynchronizeExpansionPreopWithReason|
|paramcount|6|6|
|`address`|1c0018964|140022a84|
|sig|int __fastcall PrjfGetSetStreamHandleContext(undefined8 param_1, undefined8 param_2, undefined8 param_3, int * param_4, char param_5, undefined8 * param_6)|int __fastcall PrjfGetSetStreamHandleContext(undefined8 param_1, undefined8 param_2, undefined8 param_3, int * param_4, char param_5, undefined8 * param_6)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfGetSetStreamHandleContext Called Diff
```diff
--- PrjfGetSetStreamHandleContext called
+++ PrjfGetSetStreamHandleContext called
@@ -10 +10 @@
-WPP_RECORDER_SF_sDd
+WPP_RECORDER_AND_TRACE_SF_sDD
```
### PrjfGetSetStreamHandleContext Diff
```diff
--- PrjfGetSetStreamHandleContext
+++ PrjfGetSetStreamHandleContext
@@ -1,96 +1,107 @@
/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
int PrjfGetSetStreamHandleContext
(undefined8 param_1,undefined8 param_2,undefined8 param_3,int *param_4,char param_5,
undefined8 *param_6)
{
int iVar1;
undefined8 uVar2;
void *pvVar3;
- undefined2 uVar4;
- undefined1 auStackY_a8 [32];
+ byte bVar4;
+ bool bVar5;
+ undefined1 auStackY_c8 [32];
+ ushort uVar6;
void *local_68;
void *local_60;
undefined8 local_58;
undefined8 uStack_50;
ulonglong local_48;
- local_48 = __security_cookie ^ (ulonglong)auStackY_a8;
+ local_48 = __security_cookie ^ (ulonglong)auStackY_c8;
local_68 = (void *)0x0;
local_60 = (void *)0x0;
*param_6 = 0;
local_58 = 0;
uStack_50 = 0;
iVar1 = FltGetStreamHandleContext(0,param_2,&local_68);
if (iVar1 == -0x3ffffddb) {
iVar1 = FltAllocateContext(Globals,0x10,0x268);
if (iVar1 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) {
+ if (((DAT_0 & 2) == 0) &&
+ ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) {
return iVar1;
}
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,9,0x1e,
- &WPP_0def1edc605734705626ac974b591885_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\context.c");
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x209,DAT_0 & 2,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,9,0x1e,
+ &WPP_16258fdb5ea53a6e7a49e4d7510d8a5c_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\context.c");
return iVar1;
}
memset(local_68,0,0x268);
*(void **)((longlong)local_68 + 8) = local_68;
*(void **)local_68 = local_68;
KeInitializeEvent((longlong)local_68 + 0x10,1,1);
*(undefined8 *)((longlong)local_68 + 0x30) = param_3;
FltReferenceContext(param_3);
if (param_5 != '\0') {
*(uint *)((longlong)local_68 + 0x28) = *(uint *)((longlong)local_68 + 0x28) | 1;
}
if (*param_4 == 1) {
*(uint *)((longlong)local_68 + 0x28) = *(uint *)((longlong)local_68 + 0x28) | 0x18;
}
iVar1 = ExUuidCreate(&local_58);
pvVar3 = local_68;
if (iVar1 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0;
- uVar4 = 0x1f;
+ bVar5 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar4 = DAT_0 & 2;
+ if ((bVar4 == 0) && (!bVar5)) goto LAB_1;
+ uVar6 = 0x1f;
}
else {
*(undefined4 *)((longlong)local_68 + 0x38) = (undefined4)local_58;
*(undefined4 *)((longlong)local_68 + 0x3c) = local_58._4_4_;
*(undefined4 *)((longlong)local_68 + 0x40) = (undefined4)uStack_50;
*(undefined4 *)((longlong)local_68 + 0x44) = uStack_50._4_4_;
uVar2 = IoGetCurrentProcess();
iVar1 = PrjfInitProcessInfo(uVar2,(longlong *)((longlong)pvVar3 + 0x48));
if (-1 < iVar1) {
iVar1 = FltSetStreamHandleContext(param_1,param_2,1,local_68);
pvVar3 = local_68;
if (iVar1 < 0) {
FltReleaseContext(local_68);
if (iVar1 != -0x3fe3fffe) {
return iVar1;
}
iVar1 = 0;
pvVar3 = local_60;
}
- goto LAB_1;
+ goto LAB_2;
}
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0;
- uVar4 = 0x20;
+ bVar5 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar4 = DAT_0 & 2;
+ if ((bVar4 == 0) && (!bVar5)) goto LAB_1;
+ uVar6 = 0x20;
}
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,9,uVar4,
- &WPP_0def1edc605734705626ac974b591885_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\context.c");
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x209,bVar4,bVar5,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,9,uVar6,
+ &WPP_16258fdb5ea53a6e7a49e4d7510d8a5c_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\context.c");
}
else {
pvVar3 = local_68;
- if (iVar1 < 0) goto LAB_0;
-LAB_1:
+ if (iVar1 < 0) goto LAB_1;
+LAB_2:
local_68 = (void *)0x0;
*param_6 = pvVar3;
}
-LAB_0:
+LAB_1:
if (local_68 != (void *)0x0) {
FltReleaseContext();
}
return iVar1;
}
```
## PrjfCreateRenameOrLinkCompletionContext
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.42|
|i_ratio|0.36|
|m_ratio|0.95|
|b_ratio|0.72|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfCreateRenameOrLinkCompletionContext|PrjfCreateRenameOrLinkCompletionContext|
|fullname|PrjfCreateRenameOrLinkCompletionContext|PrjfCreateRenameOrLinkCompletionContext|
|refcount|2|2|
|`length`|1226|1392|
|`called`|Expand for full list:
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltParseFileNameInformation
FLTMGR.SYS::FltReleaseContext
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExAllocateFromPagedLookasideList
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ObfReferenceObject
PrjfGetSetContextFileObject
PrjfGetUnionContextByFileNameEx
PrjfOpenPlaceHolder
PrjfReleaseRenameOrLinkCompletionContext
PrjfReleaseUnionContext
WPP_RECORDER_SF_sD
WPP_RECORDER_SF_sDd
WPP_RECORDER_SF_sDdZ
WPP_RECORDER_SF_sDqqZd
WPP_RECORDER_SF_sDqqqZd
memsetExpand for full list:
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltParseFileNameInformation
FLTMGR.SYS::FltReleaseContext
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExAllocateFromPagedLookasideList
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ObfReferenceObject
PrjfGetSetContextFileObject
PrjfGetUnionContextByFileNameEx
PrjfOpenPlaceHolder
PrjfReleaseRenameOrLinkCompletionContext
PrjfReleaseUnionContext
WPP_RECORDER_AND_TRACE_SF_sD
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDdZ
WPP_RECORDER_AND_TRACE_SF_sDqqZd
WPP_RECORDER_AND_TRACE_SF_sDqqqZd
memsetExpand for full list:
FLTMGR.SYS::FltReleaseContext
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::RtlAppendUnicodeStringToString
NTOSKRNL.EXE::RtlAppendUnicodeToString
NTOSKRNL.EXE::RtlCopyUnicodeString
PrjfGetContextFileObject
PrjfLookupInMemoryTombstoneEntry
PrjfSendGetPlaceholderInformationCommand
WPP_RECORDER_SF_sDd
WPP_RECORDER_SF_sDdZ
Expand for full list:
FLTMGR.SYS::FltReleaseContext
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::RtlAppendUnicodeStringToString
NTOSKRNL.EXE::RtlAppendUnicodeToString
NTOSKRNL.EXE::RtlCopyUnicodeString
PrjfGetContextFileObject
PrjfLookupInMemoryTombstoneEntry
PrjfSendGetPlaceholderInformationCommand
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDdZ
Expand for full list:
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::IoGetCurrentProcess
NTOSKRNL.EXE::ZwAdjustPrivilegesToken
NTOSKRNL.EXE::ZwClose
NTOSKRNL.EXE::ZwDuplicateToken
NTOSKRNL.EXE::ZwOpenProcessTokenEx
NTOSKRNL.EXE::ZwOpenThreadTokenEx
NTOSKRNL.EXE::ZwQuerySecurityObject
NTOSKRNL.EXE::ZwSetInformationThread
PrjfStopImpersonating
WPP_RECORDER_SF_sDd
__security_check_cookieExpand for full list:
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::IoGetCurrentProcess
NTOSKRNL.EXE::ZwAdjustPrivilegesToken
NTOSKRNL.EXE::ZwClose
NTOSKRNL.EXE::ZwDuplicateToken
NTOSKRNL.EXE::ZwOpenProcessTokenEx
NTOSKRNL.EXE::ZwOpenThreadTokenEx
NTOSKRNL.EXE::ZwQuerySecurityObject
NTOSKRNL.EXE::ZwSetInformationThread
PrjfStopImpersonating
WPP_RECORDER_AND_TRACE_SF_sDD
__security_check_cookie
NTOSKRNL.EXE::ExAcquireFastMutex
NTOSKRNL.EXE::ExReleaseFastMutex
PrjfSuppressTimestamps
WPP_RECORDER_SF_sDZ|FLTMGR.SYS::FltTagFile
NTOSKRNL.EXE::ExAcquireFastMutex
NTOSKRNL.EXE::ExReleaseFastMutex
PrjfSuppressTimestamps
WPP_RECORDER_AND_TRACE_SF_sDZ|
|calling|PrjfFlushAndUpdateDiskStateWorker
PrjfSetPlaceHolderFlagsSynchronized|PrjfFlushAndUpdateDiskStateWorker
PrjfSetPlaceHolderFlagsSynchronized|
|paramcount|5|5|
|`address`|1c002ff78|14003e754|
|sig|int __fastcall PrjfSetPlaceHolderFlags(undefined8 param_1, longlong param_2, longlong param_3, uint param_4, char param_5)|int __fastcall PrjfSetPlaceHolderFlags(undefined8 param_1, longlong param_2, longlong param_3, uint param_4, char param_5)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfSetPlaceHolderFlags Called Diff
```diff
--- PrjfSetPlaceHolderFlags called
+++ PrjfSetPlaceHolderFlags called
@@ -5 +5 @@
-WPP_RECORDER_SF_sDZ
+WPP_RECORDER_AND_TRACE_SF_sDZ
```
### PrjfSetPlaceHolderFlags Diff
```diff
--- PrjfSetPlaceHolderFlags
+++ PrjfSetPlaceHolderFlags
@@ -1,62 +1,66 @@
int PrjfSetPlaceHolderFlags
(undefined8 param_1,longlong param_2,longlong param_3,uint param_4,char param_5)
{
longlong lVar1;
longlong lVar2;
bool bVar3;
int iVar4;
int iVar5;
- int iVar6;
- uint uVar7;
- undefined4 in_stack_ffffffffffffffac;
+ uint uVar6;
+ int iVar7;
+ undefined4 in_stack_ffffffffffffffa4;
undefined8 local_48;
longlong lStack_40;
lVar2 = *(longlong *)(param_3 + 0x48);
iVar5 = 0;
bVar3 = false;
if ((*(uint *)(lVar2 + 0xc) & param_4) != param_4) {
lVar1 = param_3 + 8;
ExAcquireFastMutex(lVar1);
*(uint *)(lVar2 + 0xc) = *(uint *)(lVar2 + 0xc) | param_4;
- iVar6 = *(int *)(lVar2 + 0xc);
+ iVar7 = *(int *)(lVar2 + 0xc);
ExReleaseFastMutex(lVar1);
if ((param_5 != '\0') && (*(char *)(param_2 + 0x4b) == '\0')) {
*(undefined1 *)(param_2 + 0x4b) = 1;
bVar3 = true;
}
iVar4 = PrjfSuppressTimestamps(param_1,param_2,'\x01');
- uVar7 = 0;
+ uVar6 = 0;
do {
iVar5 = FltTagFile(param_1,param_2,0x9000001c,0,*(longlong *)(param_3 + 0x48) + 8,
*(undefined2 *)(*(longlong *)(param_3 + 0x48) + 4));
if (iVar5 < 0) {
lStack_40 = lVar2 + 0x122;
local_48 = (ulonglong)
CONCAT22(*(undefined2 *)(lVar2 + 0x120),*(undefined2 *)(lVar2 + 0x120));
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDZ(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,10,0x3c,
- &WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",
- CONCAT44(in_stack_ffffffffffffffac,0xb51),(wchar_t *)&local_48);
+ if (((DAT_0 & 4) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDZ
+ (0x20a,DAT_0 & 4,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,10,0x3d,
+ &WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",
+ CONCAT44(in_stack_ffffffffffffffa4,0xb70),(wchar_t *)&local_48);
}
break;
}
- if (*(int *)(lVar2 + 0xc) == iVar6) break;
+ if (*(int *)(lVar2 + 0xc) == iVar7) break;
ExAcquireFastMutex(lVar1);
- iVar6 = *(int *)(lVar2 + 0xc);
+ iVar7 = *(int *)(lVar2 + 0xc);
ExReleaseFastMutex(lVar1);
- uVar7 = uVar7 + 1;
- } while (uVar7 < 5);
+ uVar6 = uVar6 + 1;
+ } while (uVar6 < 5);
if (-1 < iVar4) {
PrjfSuppressTimestamps(param_1,param_2,'\0');
}
if (bVar3) {
*(undefined1 *)(param_2 + 0x4b) = 0;
}
}
return iVar5;
}
```
## PrjfPostSetDispositionInformation
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.82|
|i_ratio|0.45|
|m_ratio|0.95|
|b_ratio|0.91|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfPostSetDispositionInformation|PrjfPostSetDispositionInformation|
|fullname|PrjfPostSetDispositionInformation|PrjfPostSetDispositionInformation|
|refcount|2|2|
|`length`|183|221|
|`called`|PrjfRevertInMemoryTombstonesForDirectory
WPP_RECORDER_SF_sDd|PrjfRevertInMemoryTombstonesForDirectory
WPP_RECORDER_AND_TRACE_SF_sDD|
|calling|PrjfPostSetInformation|PrjfPostSetInformation|
|paramcount|2|2|
|`address`|1c0020ff0|14002c2d8|
|sig|int __fastcall PrjfPostSetDispositionInformation(longlong param_1, longlong param_2)|int __fastcall PrjfPostSetDispositionInformation(longlong param_1, longlong param_2)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfPostSetDispositionInformation Called Diff
```diff
--- PrjfPostSetDispositionInformation called
+++ PrjfPostSetDispositionInformation called
@@ -2 +2 @@
-WPP_RECORDER_SF_sDd
+WPP_RECORDER_AND_TRACE_SF_sDD
```
### PrjfPostSetDispositionInformation Diff
```diff
--- PrjfPostSetDispositionInformation
+++ PrjfPostSetDispositionInformation
@@ -1,40 +1,46 @@
int PrjfPostSetDispositionInformation(longlong param_1,longlong param_2)
{
longlong lVar1;
bool bVar2;
ulonglong uVar3;
bool bVar4;
lVar1 = *(longlong *)(param_1 + 0x10);
bVar2 = true;
if (*(int *)(lVar1 + 0x20) == 0xd) {
bVar4 = **(char **)(lVar1 + 0x38) == '\0';
LAB_0:
if (!bVar4) goto LAB_1;
}
else if (*(int *)(lVar1 + 0x20) == 0x40) {
bVar4 = (**(uint **)(lVar1 + 0x38) & 1) == 0;
goto LAB_0;
}
bVar2 = false;
LAB_1:
if (*(int *)(param_1 + 0x18) == 0) {
if (bVar2) {
return 0;
}
}
else if (!bVar2) {
return 0;
}
uVar3 = PrjfRevertInMemoryTombstonesForDirectory
(*(undefined8 *)(param_2 + 0x18),*(undefined8 *)(param_2 + 0x20));
- if (((int)uVar3 < 0) && ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xd,0xb,
- &WPP_9aa94875f0ba3c84ae0a423dcca6636f_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\fileinfo.c");
+ if ((int)uVar3 < 0) {
+ if (((DAT_2 & 0x20) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x20d,DAT_2 & 0x20,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xd,0xb,
+ &WPP_9aa94875f0ba3c84ae0a423dcca6636f_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\fileinfo.c");
+ }
}
return (int)uVar3;
}
```
## PrjfIsDirectoryEmpty
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,sig,address,called|
|ratio|0.4|
|i_ratio|0.33|
|m_ratio|0.94|
|b_ratio|0.77|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfIsDirectoryEmpty|PrjfIsDirectoryEmpty|
|fullname|PrjfIsDirectoryEmpty|PrjfIsDirectoryEmpty|
|refcount|3|3|
|`length`|768|864|
|`called`|FLTMGR.SYS::FltReleaseContext
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::RtlEqualUnicodeString
PrjfEnumerateDirectoryWithMerge
PrjfGetSetContextFileObject
PrjfGetSetStreamHandleContext
WPP_RECORDER_SF_sDd
WPP_RECORDER_SF_sDdD|FLTMGR.SYS::FltReleaseContext
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::RtlEqualUnicodeString
PrjfEnumerateDirectoryWithMerge
PrjfGetSetContextFileObject
PrjfGetSetStreamHandleContext
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDdD|
|calling|PrjfOpenAndCheckEmptyPartialDirectory
PrjfPrepareForDelete|PrjfOpenAndCheckEmptyPartialDirectory
PrjfPrepareForDelete|
|paramcount|5|5|
|`address`|1c001fc54|14002ad14|
|`sig`|int __fastcall PrjfIsDirectoryEmpty(longlong param_1, undefined8 * * * * param_2, longlong param_3, undefined8 param_4, undefined1 * param_5)|int __fastcall PrjfIsDirectoryEmpty(longlong param_1, longlong param_2, longlong param_3, undefined8 param_4, undefined1 * param_5)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfIsDirectoryEmpty Called Diff
```diff
--- PrjfIsDirectoryEmpty called
+++ PrjfIsDirectoryEmpty called
@@ -8,2 +8,2 @@
-WPP_RECORDER_SF_sDd
-WPP_RECORDER_SF_sDdD
+WPP_RECORDER_AND_TRACE_SF_sDD
+WPP_RECORDER_AND_TRACE_SF_sDdD
```
### PrjfIsDirectoryEmpty Diff
```diff
--- PrjfIsDirectoryEmpty
+++ PrjfIsDirectoryEmpty
@@ -1,105 +1,116 @@
int PrjfIsDirectoryEmpty
- (longlong param_1,undefined8 ****param_2,longlong param_3,undefined8 param_4,
+ (longlong param_1,longlong param_2,longlong param_3,undefined8 param_4,
undefined1 *param_5)
{
char cVar1;
int iVar2;
- uint *puVar3;
- ulonglong uVar4;
- undefined8 ****ppppuVar5;
+ ulonglong uVar3;
+ byte bVar4;
int unaff_EBX;
- byte bVar6;
- undefined1 uVar7;
- uint *puVar8;
- undefined2 uVar9;
- uint local_res20 [2];
+ undefined1 uVar5;
+ longlong **pplVar6;
+ bool bVar7;
+ int local_res20 [2];
+ ushort *puVar8;
+ ushort uVar9;
int *local_68;
longlong local_60;
- longlong local_58;
- undefined8 local_50;
- uint *puStack_48;
- ushort local_40 [4];
- wchar_t *local_38;
+ longlong **local_58;
+ longlong local_50;
+ undefined8 local_48;
+ longlong **pplStack_40;
+ ushort local_38 [4];
+ wchar_t *local_30;
+ local_38[0] = 2;
+ local_38[1] = 4;
+ local_38[2] = 0;
+ local_38[3] = 0;
local_res20[0] = 0;
local_60 = 0;
local_68 = (int *)0x0;
- local_58 = 0;
- uVar7 = 1;
- local_38 = L"*";
- local_40[0] = 2;
- local_40[1] = 4;
- local_40[2] = 0;
- local_40[3] = 0;
+ local_30 = L"*";
+ uVar5 = 1;
local_50 = 0;
- puStack_48 = (uint *)0x0;
- bVar6 = 1;
- puVar3 = (uint *)ExAllocatePool2(0x100,0x10000,0x65644a50);
- if (puVar3 == (uint *)0x0) {
+ bVar4 = 1;
+ local_48 = 0;
+ pplStack_40 = (longlong **)0x0;
+ local_58 = (longlong **)ExAllocatePool2(0x100,0x10000,0x65644a50);
+ if (local_58 == (longlong **)0x0) {
return unaff_EBX;
}
iVar2 = PrjfGetSetContextFileObject
(param_2,param_3,-0x80000000,'\x01','\0',(undefined4 *)0x0,(undefined2 *)0x0,
&local_60,&local_68);
if (iVar2 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0;
- uVar9 = 0x28;
+ bVar7 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar4 = DAT_0 & 0x20;
+ if ((bVar4 == 0) && (!bVar7)) goto LAB_1;
+ uVar9 = 0x29;
}
else {
- iVar2 = PrjfGetSetStreamHandleContext(param_2,param_3,local_60,local_68,'\0',&local_58);
+ iVar2 = PrjfGetSetStreamHandleContext(param_2,param_3,local_60,local_68,'\0',&local_50);
if (-1 < iVar2) {
while( true ) {
- ppppuVar5 = param_2;
- uVar4 = PrjfEnumerateDirectoryWithMerge
- (param_1,param_2,param_3,0x3c,local_40,0,bVar6,0x10000,(longlong)puVar3,
- local_res20);
- puVar8 = puVar3;
- if ((int)uVar4 < 0) break;
+ puVar8 = local_38;
+ uVar3 = PrjfEnumerateDirectoryWithMerge
+ (param_1,param_2,param_3,0x3c,puVar8,0,bVar4,0x10000,local_58,local_res20)
+ ;
+ pplVar6 = local_58;
+ if ((int)uVar3 < 0) break;
while( true ) {
- puStack_48 = puVar8 + 0x16;
- local_50._0_4_ = CONCAT22((short)puVar8[0xf],(short)puVar8[0xf]);
- cVar1 = RtlEqualUnicodeString(&local_50,&DAT_1,1);
+ pplStack_40 = pplVar6 + 0xb;
+ local_48._0_4_ =
+ CONCAT22(*(undefined2 *)((longlong)pplVar6 + 0x3c),
+ *(undefined2 *)((longlong)pplVar6 + 0x3c));
+ cVar1 = RtlEqualUnicodeString(&local_48,&DAT_2,1);
if ((cVar1 == '\0') &&
- (cVar1 = RtlEqualUnicodeString(&local_50,&DAT_2,1), cVar1 == '\0')) {
- uVar7 = 0;
- goto LAB_3;
+ (cVar1 = RtlEqualUnicodeString(&local_48,&DAT_3,1), cVar1 == '\0')) {
+ uVar5 = 0;
+ goto LAB_4;
}
- if (*puVar8 == 0) break;
- puVar8 = (uint *)((longlong)puVar8 + (ulonglong)*puVar8);
+ if (*(uint *)pplVar6 == 0) break;
+ pplVar6 = (longlong **)((longlong)pplVar6 + (ulonglong)*(uint *)pplVar6);
}
- bVar6 = 0;
+ bVar4 = 0;
}
- if ((int)uVar4 == -0x7ffffffa) {
-LAB_3:
- *param_5 = uVar7;
+ if ((int)uVar3 == -0x7ffffffa) {
+LAB_4:
+ *param_5 = uVar5;
}
- else if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDdD
- (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),ppppuVar5,10,0x2b,
- &WPP_286736bb6a73387d41449b09eaab690a_Traceguids,
+ else if (((DAT_0 & 4) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDdD
+ (0x20a,DAT_0 & 4,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),puVar8,10,0x2c,
+ &WPP_8662402235063b115c167dc7c0c22e28_Traceguids,
"onecore\\base\\fs\\gvflt\\filter\\sys\\expansion.c");
}
- goto LAB_0;
+ goto LAB_1;
}
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0;
- uVar9 = 0x29;
+ bVar7 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar4 = DAT_0 & 0x20;
+ if ((bVar4 == 0) && (!bVar7)) goto LAB_1;
+ uVar9 = 0x2a;
}
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xd,uVar9,
- &WPP_286736bb6a73387d41449b09eaab690a_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\expansion.c");
-LAB_0:
- ExFreePoolWithTag(puVar3,0x65644a50);
- if (local_58 != 0) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x20d,bVar4,bVar7,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xd,uVar9,
+ &WPP_8662402235063b115c167dc7c0c22e28_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\expansion.c");
+LAB_1:
+ ExFreePoolWithTag(local_58,0x65644a50);
+ if (local_50 != 0) {
FltReleaseContext();
}
if (local_68 != (int *)0x0) {
FltReleaseContext(local_68);
}
if (local_60 != 0) {
FltReleaseContext(local_60);
}
return unaff_EBX;
}
```
## PrjfSendGetFileStreamCommand
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.6|
|i_ratio|0.34|
|m_ratio|0.95|
|b_ratio|0.94|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfSendGetFileStreamCommand|PrjfSendGetFileStreamCommand|
|fullname|PrjfSendGetFileStreamCommand|PrjfSendGetFileStreamCommand|
|refcount|2|2|
|`length`|545|602|
|`called`|FLTMGR.SYS::FltReleaseContext
PrjfFreeCommandBuffer
PrjfGetContextFileObject
PrjfPrepareCommandForFileObject
PrjfSendCommand
WPP_RECORDER_SF_sDdZ
memset|FLTMGR.SYS::FltReleaseContext
PrjfFreeCommandBuffer
PrjfGetContextFileObject
PrjfPrepareCommandForFileObject
PrjfSendCommand
WPP_RECORDER_AND_TRACE_SF_sDdZ
memset|
|calling|PrjfCopyStreamData|PrjfCopyStreamData|
|paramcount|5|5|
|`address`|1c00281d8|1400351e8|
|sig|ulonglong __fastcall PrjfSendGetFileStreamCommand(undefined8 param_1, longlong param_2, undefined8 * param_3, undefined4 param_4, int param_5)|ulonglong __fastcall PrjfSendGetFileStreamCommand(undefined8 param_1, longlong param_2, undefined8 * param_3, undefined4 param_4, int param_5)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfSendGetFileStreamCommand Called Diff
```diff
--- PrjfSendGetFileStreamCommand called
+++ PrjfSendGetFileStreamCommand called
@@ -6 +6 @@
-WPP_RECORDER_SF_sDdZ
+WPP_RECORDER_AND_TRACE_SF_sDdZ
```
### PrjfSendGetFileStreamCommand Diff
```diff
--- PrjfSendGetFileStreamCommand
+++ PrjfSendGetFileStreamCommand
@@ -1,83 +1,90 @@
ulonglong PrjfSendGetFileStreamCommand
(undefined8 param_1,longlong param_2,undefined8 *param_3,undefined4 param_4,
int param_5)
{
uint *puVar1;
uint uVar2;
ulonglong uVar3;
ulonglong uVar4;
longlong lVar5;
longlong lVar6;
undefined4 local_res18 [2];
uint local_res20 [2];
- undefined8 in_stack_fffffffffffffd68;
- uint *puVar7;
- undefined4 uVar8;
+ undefined8 in_stack_fffffffffffffd58;
undefined4 in_stack_fffffffffffffd84;
- longlong local_268;
- uint *local_260;
+ undefined4 in_stack_fffffffffffffd8c;
+ uint *local_268;
+ longlong local_260;
longlong local_258 [2];
undefined8 local_248;
undefined4 local_240;
undefined4 local_23c;
- local_260 = (uint *)0x0;
+ local_268 = (uint *)0x0;
memset(&local_248,0,0x220);
local_res20[0] = 0;
lVar5 = 0;
local_23c = 0;
local_res18[0] = 0;
param_5 = 4;
+ local_260 = 0;
local_258[0] = 0;
- local_268 = 0;
if (param_3 != (undefined8 *)0x0) {
local_248 = *param_3;
}
- puVar7 = local_res20;
local_240 = param_4;
uVar3 = PrjfPrepareCommandForFileObject
- (param_1,param_2,6,&local_248,in_stack_fffffffffffffd68,(longlong *)&local_260,
- puVar7);
- puVar1 = local_260;
- uVar8 = (undefined4)((ulonglong)puVar7 >> 0x20);
+ (param_1,param_2,6,&local_248,in_stack_fffffffffffffd58,(longlong *)&local_268,
+ local_res20);
+ puVar1 = local_268;
uVar4 = uVar3 & 0xffffffff;
if ((int)uVar3 < 0) {
lVar6 = 0;
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDdZ
- (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0x9b,
- &WPP_3ccab5108a9538d17a865fde27ef339f_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c",CONCAT44(uVar8,0x12f4),
- CONCAT44(in_stack_fffffffffffffd84,(int)uVar3),(wchar_t *)(param_2 + 0x58));
+ if (((DAT_0 & 0x40) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDdZ
+ (0x20e,DAT_0 & 0x40,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0xad,
+ &WPP_39279db927ae337b8503ecc20725ff46_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c",
+ CONCAT44(in_stack_fffffffffffffd84,0x1429),
+ CONCAT44(in_stack_fffffffffffffd8c,(int)uVar3),(wchar_t *)(param_2 + 0x58));
}
}
else {
- PrjfGetContextFileObject(param_1,param_2,local_258,&local_268);
- lVar5 = local_258[0];
- uVar2 = PrjfSendCommand(0,param_1,puVar1,*(longlong *)(local_258[0] + 0x58) + 0x28,
+ PrjfGetContextFileObject(param_1,param_2,&local_260,local_258);
+ lVar5 = local_260;
+ uVar2 = PrjfSendCommand(0,param_1,puVar1,*(longlong *)(local_260 + 0x58) + 0x28,
(longlong)local_res18,¶m_5);
uVar4 = (ulonglong)uVar2;
- lVar6 = local_268;
- if (((int)uVar2 < 0) && ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
- WPP_RECORDER_SF_sDdZ
- (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0x9c,
- &WPP_3ccab5108a9538d17a865fde27ef339f_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c",CONCAT44(uVar8,0x130a),
- CONCAT44(in_stack_fffffffffffffd84,uVar2),(wchar_t *)(param_2 + 0x58));
- lVar6 = local_268;
+ lVar6 = local_258[0];
+ if ((int)uVar2 < 0) {
+ if (((DAT_0 & 0x40) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDdZ
+ (0x20e,DAT_0 & 0x40,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0xae,
+ &WPP_39279db927ae337b8503ecc20725ff46_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c",
+ CONCAT44(in_stack_fffffffffffffd84,0x143f),
+ CONCAT44(in_stack_fffffffffffffd8c,uVar2),(wchar_t *)(param_2 + 0x58));
+ lVar6 = local_258[0];
+ }
}
}
if (puVar1 != (uint *)0x0) {
PrjfFreeCommandBuffer((longlong)puVar1,local_res20[0]);
}
if (lVar5 != 0) {
FltReleaseContext(lVar5);
}
if (lVar6 != 0) {
FltReleaseContext(lVar6);
}
return uVar4;
}
```
## PrjfMungeDirectoryEnumerateWithShortnameFileIdAll
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.79|
|i_ratio|0.5|
|m_ratio|0.95|
|b_ratio|0.93|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfMungeDirectoryEnumerateWithShortnameFileIdAll|PrjfMungeDirectoryEnumerateWithShortnameFileIdAll|
|fullname|PrjfMungeDirectoryEnumerateWithShortnameFileIdAll|PrjfMungeDirectoryEnumerateWithShortnameFileIdAll|
|refcount|2|2|
|`length`|606|697|
|`called`|MicrosoftTelemetryAssertTriggeredMsgKM
MicrosoftTelemetryAssertTriggeredNoArgsKM
WPP_RECORDER_SF_sDd
memcpy|MicrosoftTelemetryAssertTriggeredMsgKM
MicrosoftTelemetryAssertTriggeredNoArgsKM
WPP_RECORDER_AND_TRACE_SF_sDD
memmove|
|calling|PrjfTranslateCurrentEnumEntry|PrjfTranslateCurrentEnumEntry|
|paramcount|9|9|
|`address`|1c001cd14|14002781c|
|sig|undefined8 __fastcall PrjfMungeDirectoryEnumerateWithShortnameFileIdAll(int param_1, char param_2, undefined8 * param_3, char param_4, char param_5, undefined8 * param_6, uint param_7, undefined8 * param_8, uint * param_9)|undefined8 __fastcall PrjfMungeDirectoryEnumerateWithShortnameFileIdAll(int param_1, char param_2, undefined8 * param_3, char param_4, char param_5, undefined8 * param_6, uint param_7, undefined8 * param_8, uint * param_9)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfMungeDirectoryEnumerateWithShortnameFileIdAll Called Diff
```diff
--- PrjfMungeDirectoryEnumerateWithShortnameFileIdAll called
+++ PrjfMungeDirectoryEnumerateWithShortnameFileIdAll called
@@ -3,2 +3,2 @@
-WPP_RECORDER_SF_sDd
-memcpy
+WPP_RECORDER_AND_TRACE_SF_sDD
+memmove
```
### PrjfMungeDirectoryEnumerateWithShortnameFileIdAll Diff
```diff
--- PrjfMungeDirectoryEnumerateWithShortnameFileIdAll
+++ PrjfMungeDirectoryEnumerateWithShortnameFileIdAll
@@ -1,98 +1,106 @@
undefined8
PrjfMungeDirectoryEnumerateWithShortnameFileIdAll
(int param_1,char param_2,undefined8 *param_3,char param_4,char param_5,
undefined8 *param_6,uint param_7,undefined8 *param_8,uint *param_9)
{
uint uVar1;
undefined8 uVar2;
uint uVar3;
undefined8 uVar4;
uint uVar5;
uVar4 = 0;
uVar5 = 0;
if (param_1 != 0x51) {
MicrosoftTelemetryAssertTriggeredNoArgsKM();
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),3,0x12,0x14,
- &WPP_e21b7c61aee93f730c9c252e6e8da2f4_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\dir.c");
+ if (((DAT_0 & 4) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x312,DAT_0 & 4,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),3,0x12,0x14,
+ &WPP_3d19aee1b05838720427e757513a9608_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\dir.c");
}
MicrosoftTelemetryAssertTriggeredMsgKM();
uVar4 = 0xc00000bb;
- goto LAB_0;
+ goto LAB_1;
}
uVar1 = *(uint *)((longlong)param_3 + 0x3c);
if ((param_7 < uVar1 + 0x7a) && ((uVar5 = 0, param_7 < 0x7a || (param_2 == '\0'))))
- goto LAB_0;
+ goto LAB_1;
uVar5 = uVar1;
if (param_7 - 0x7a <= uVar1) {
uVar5 = param_7 - 0x7a;
}
uVar2 = param_3[1];
*param_6 = *param_3;
param_6[1] = uVar2;
uVar2 = param_3[3];
param_6[2] = param_3[2];
param_6[3] = uVar2;
uVar2 = param_3[5];
param_6[4] = param_3[4];
param_6[5] = uVar2;
uVar2 = param_3[7];
param_6[6] = param_3[6];
param_6[7] = uVar2;
uVar2 = param_3[9];
param_6[8] = param_3[8];
param_6[9] = uVar2;
uVar2 = param_3[0xb];
param_6[10] = param_3[10];
param_6[0xb] = uVar2;
if (param_4 == '\0') {
-LAB_1:
+LAB_2:
*(undefined1 *)(param_6 + 0xc) = 0;
}
else {
if (0x18 < *(byte *)(param_3 + 0xc)) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x12,0x13,
- &WPP_e21b7c61aee93f730c9c252e6e8da2f4_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\dir.c");
+ if (((DAT_3 & 4) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x212,DAT_3 & 4,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x12,0x13,
+ &WPP_3d19aee1b05838720427e757513a9608_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\dir.c");
}
if (0x18 < *(byte *)(param_3 + 0xc)) {
MicrosoftTelemetryAssertTriggeredNoArgsKM();
}
- goto LAB_1;
+ goto LAB_2;
}
*(byte *)(param_6 + 0xc) = *(byte *)(param_3 + 0xc);
- memcpy((void *)((longlong)param_6 + 0x62),(void *)((longlong)param_3 + 0x62),
- (longlong)*(char *)(param_3 + 0xc));
+ memmove((void *)((longlong)param_6 + 0x62),(void *)((longlong)param_3 + 0x62),
+ (longlong)*(char *)(param_3 + 0xc));
}
if (*(int *)((longlong)param_3 + 0x44) == -0x6fffffe4) {
uVar3 = *(uint *)(param_3 + 7) & 0xffffe9ff;
if (uVar3 == 0) {
uVar3 = 0x80;
}
*(uint *)(param_6 + 7) = uVar3;
*(undefined4 *)((longlong)param_6 + 0x44) = 0;
}
if (param_5 != '\0') {
*(uint *)(param_6 + 7) = *(uint *)(param_6 + 7) | 0x440000;
param_6[6] = 0;
param_6[9] = 0xffffffffffffffff;
param_6[10] = 0xffffffffffffffff;
param_6[0xb] = 0xffffffffffffffff;
}
- memcpy((void *)((longlong)param_6 + 0x7a),(void *)((longlong)param_3 + 0x7a),(ulonglong)uVar5);
+ memmove((void *)((longlong)param_6 + 0x7a),(void *)((longlong)param_3 + 0x7a),(ulonglong)uVar5);
*(undefined4 *)param_6 = 0;
*param_8 = param_6;
uVar5 = uVar5 + 0x7a;
if (uVar5 < uVar1 + 0x7a) {
uVar4 = 0x80000005;
}
-LAB_0:
+LAB_1:
*param_9 = uVar5;
return uVar4;
}
```
## PrjfInitProcessInfo
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.72|
|i_ratio|0.56|
|m_ratio|0.91|
|b_ratio|0.87|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfInitProcessInfo|PrjfInitProcessInfo|
|fullname|PrjfInitProcessInfo|PrjfInitProcessInfo|
|refcount|3|3|
|`length`|507|629|
|`called`|NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::PsGetProcessId
NTOSKRNL.EXE::PsGetProcessImageFileName
NTOSKRNL.EXE::RtlAnsiStringToUnicodeString
NTOSKRNL.EXE::RtlFreeUnicodeString
NTOSKRNL.EXE::RtlInitAnsiString
NTOSKRNL.EXE::SeLocateProcessImageName
WPP_RECORDER_SF_sD
memcpy|NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::PsGetProcessId
NTOSKRNL.EXE::PsGetProcessImageFileName
NTOSKRNL.EXE::RtlAnsiStringToUnicodeString
NTOSKRNL.EXE::RtlFreeUnicodeString
NTOSKRNL.EXE::RtlInitAnsiString
NTOSKRNL.EXE::SeLocateProcessImageName
WPP_RECORDER_AND_TRACE_SF_sD
memmove|
|calling|PrjfGetSetStreamHandleContext
PrjfSendNotifyOperationCommand|PrjfGetSetStreamHandleContext
PrjfSendNotifyOperationCommand|
|paramcount|2|2|
|`address`|1c002dbf0|14003bc34|
|sig|int __fastcall PrjfInitProcessInfo(undefined8 param_1, longlong * param_2)|int __fastcall PrjfInitProcessInfo(undefined8 param_1, longlong * param_2)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfInitProcessInfo Called Diff
```diff
--- PrjfInitProcessInfo called
+++ PrjfInitProcessInfo called
@@ -9,2 +9,2 @@
-WPP_RECORDER_SF_sD
-memcpy
+WPP_RECORDER_AND_TRACE_SF_sD
+memmove
```
### PrjfInitProcessInfo Diff
```diff
--- PrjfInitProcessInfo
+++ PrjfInitProcessInfo
@@ -1,79 +1,88 @@
int PrjfInitProcessInfo(undefined8 param_1,longlong *param_2)
{
ulonglong uVar1;
int iVar2;
undefined4 uVar3;
undefined8 uVar4;
undefined2 *puVar5;
- undefined2 uVar6;
+ byte bVar6;
+ bool bVar7;
ulonglong *local_res18 [2];
+ ushort uVar8;
undefined8 local_38;
void *pvStack_30;
ulonglong local_28;
void *pvStack_20;
local_res18[0] = (ulonglong *)0x0;
local_28 = 0;
pvStack_20 = (void *)0x0;
iVar2 = SeLocateProcessImageName(0,local_res18);
if (iVar2 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- uVar6 = 0xc5;
-LAB_0:
- WPP_RECORDER_SF_sD(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,9,uVar6,
- &WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
+ bVar7 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar6 = DAT_0 & 2;
+ if (((DAT_0 & 2) != 0) || (bVar7)) {
+ uVar8 = 0xca;
+LAB_1:
+ WPP_RECORDER_AND_TRACE_SF_sD
+ (0x209,bVar6,bVar7,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,9,uVar8,
+ &WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
}
}
else {
if (local_res18[0][1] == 0) {
local_38 = 0;
pvStack_30 = (void *)0x0;
uVar4 = PsGetProcessImageFileName(param_1);
RtlInitAnsiString(&local_38,uVar4);
iVar2 = RtlAnsiStringToUnicodeString(&local_28,&local_38,1);
if (iVar2 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- uVar6 = 0xc4;
- goto LAB_0;
+ bVar7 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar6 = DAT_0 & 2;
+ if (((DAT_0 & 2) != 0) || (bVar7)) {
+ uVar8 = 0xc9;
+ goto LAB_1;
}
- goto LAB_1;
+ goto LAB_2;
}
local_38 = local_28;
pvStack_30 = pvStack_20;
}
else {
local_38 = *local_res18[0];
pvStack_30 = (void *)local_res18[0][1];
}
uVar1 = local_38;
puVar5 = (undefined2 *)ExAllocatePool2(0x100,(local_38 >> 0x10 & 0xffff) + 0x10,0x68734a50);
*param_2 = (longlong)puVar5;
if (puVar5 != (undefined2 *)0x0) {
*puVar5 = (short)uVar1;
*(undefined2 *)(*param_2 + 2) = local_38._2_2_;
*(longlong *)(*param_2 + 8) = *param_2 + 0x10;
- memcpy(*(void **)(*param_2 + 8),pvStack_30,uVar1 & 0xffff);
+ memmove(*(void **)(*param_2 + 8),pvStack_30,uVar1 & 0xffff);
uVar3 = PsGetProcessId(param_1);
*(undefined4 *)(param_2 + 1) = uVar3;
- goto LAB_2;
+ goto LAB_3;
}
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- uVar6 = 0xc6;
- goto LAB_0;
+ bVar7 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar6 = DAT_0 & 2;
+ if (((DAT_0 & 2) != 0) || (bVar7)) {
+ uVar8 = 0xcb;
+ goto LAB_1;
}
}
-LAB_1:
+LAB_2:
iVar2 = -0x3fffff66;
-LAB_2:
+LAB_3:
if (pvStack_20 != (void *)0x0) {
RtlFreeUnicodeString(&local_28);
}
if (local_res18[0] != (ulonglong *)0x0) {
ExFreePoolWithTag(local_res18[0],0);
}
return iVar2;
}
```
## PrjfGetUnionContext
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.88|
|i_ratio|0.42|
|m_ratio|0.96|
|b_ratio|0.92|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfGetUnionContext|PrjfGetUnionContext|
|fullname|PrjfGetUnionContext|PrjfGetUnionContext|
|refcount|9|9|
|`length`|282|318|
|`called`|FLTMGR.SYS::FltAcquireResourceShared
FLTMGR.SYS::FltGetInstanceContext
FLTMGR.SYS::FltReleaseContext
FLTMGR.SYS::FltReleaseResource
MicrosoftTelemetryAssertTriggeredNoArgsKM
WPP_RECORDER_SF_sDd|FLTMGR.SYS::FltAcquireResourceShared
FLTMGR.SYS::FltGetInstanceContext
FLTMGR.SYS::FltReleaseContext
FLTMGR.SYS::FltReleaseResource
MicrosoftTelemetryAssertTriggeredNoArgsKM
WPP_RECORDER_AND_TRACE_SF_sDD|
|calling|PrjfExpandFile
PrjfGetSetStreamContext
PrjfGetUnionContextByVirtualizationInstanceInfo
PrjfLaunchExpansion
PrjfPreDirectoryControl
PrjfSendCancelCommandWorker
PrjfSendCommand
PrjfSendNotifyOperationCommand|PrjfExpandFile
PrjfGetSetStreamContext
PrjfGetUnionContextByVirtualizationInstanceInfo
PrjfLaunchExpansion
PrjfPreDirectoryControl
PrjfSendCancelCommandWorker
PrjfSendCommand
PrjfSendNotifyOperationCommand|
|paramcount|2|2|
|`address`|1c0002f74|140003398|
|sig|longlong * __fastcall PrjfGetUnionContext(undefined8 param_1, longlong * param_2)|longlong * __fastcall PrjfGetUnionContext(undefined8 param_1, longlong * param_2)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfGetUnionContext Called Diff
```diff
--- PrjfGetUnionContext called
+++ PrjfGetUnionContext called
@@ -6 +6 @@
-WPP_RECORDER_SF_sDd
+WPP_RECORDER_AND_TRACE_SF_sDD
```
### PrjfGetUnionContext Diff
```diff
--- PrjfGetUnionContext
+++ PrjfGetUnionContext
@@ -1,49 +1,53 @@
longlong * PrjfGetUnionContext(undefined8 param_1,longlong *param_2)
{
longlong *plVar1;
int *piVar2;
int iVar3;
undefined8 *puVar4;
longlong *plVar5;
longlong local_18 [2];
plVar5 = (longlong *)0x0;
local_18[0] = 0;
iVar3 = FltGetInstanceContext(param_1,local_18);
if (iVar3 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0x23,
- &WPP_0def1edc605734705626ac974b591885_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\context.c");
+ if (((DAT_0 & 0x40) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x20e,DAT_0 & 0x40,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0x23,
+ &WPP_16258fdb5ea53a6e7a49e4d7510d8a5c_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\context.c");
}
}
else {
FltAcquireResourceShared(local_18[0] + 0x30);
for (puVar4 = *(undefined8 **)(local_18[0] + 0x98); puVar4 != (undefined8 *)(local_18[0] + 0x98)
; puVar4 = (undefined8 *)*puVar4) {
plVar1 = puVar4 + -2;
if ((*param_2 == *plVar1) && (param_2[1] == puVar4[-1])) {
plVar5 = plVar1;
if (plVar1 != (longlong *)0x0) {
LOCK();
piVar2 = (int *)(puVar4 + 9);
iVar3 = *piVar2;
*piVar2 = *piVar2 + 1;
UNLOCK();
if (iVar3 + 1 < 2) {
MicrosoftTelemetryAssertTriggeredNoArgsKM();
}
}
break;
}
}
FltReleaseResource(local_18[0] + 0x30);
}
if (local_18[0] != 0) {
FltReleaseContext();
}
return plVar5;
}
```
## PrjfPreSetRenameInformation
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.78|
|i_ratio|0.41|
|m_ratio|0.93|
|b_ratio|0.87|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfPreSetRenameInformation|PrjfPreSetRenameInformation|
|fullname|PrjfPreSetRenameInformation|PrjfPreSetRenameInformation|
|refcount|2|2|
|`length`|400|494|
|`called`|FLTMGR.SYS::FltGetDestinationFileNameInformation
FLTMGR.SYS::FltReleaseFileNameInformation
MicrosoftTelemetryAssertTriggeredNoArgsKM
PrjfProcessPreRenameOrLinkInformation
WPP_RECORDER_SF_sD
WPP_RECORDER_SF_sDd|FLTMGR.SYS::FltGetDestinationFileNameInformation
FLTMGR.SYS::FltReleaseFileNameInformation
MicrosoftTelemetryAssertTriggeredNoArgsKM
PrjfProcessPreRenameOrLinkInformation
WPP_RECORDER_AND_TRACE_SF_sD
WPP_RECORDER_AND_TRACE_SF_sDD|
|calling|PrjfPreSetInformation|PrjfPreSetInformation|
|paramcount|3|3|
|`address`|1c00214e0|14002c934|
|sig|undefined8 __fastcall PrjfPreSetRenameInformation(longlong param_1, longlong param_2, longlong * param_3)|undefined8 __fastcall PrjfPreSetRenameInformation(longlong param_1, longlong param_2, longlong * param_3)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfPreSetRenameInformation Called Diff
```diff
--- PrjfPreSetRenameInformation called
+++ PrjfPreSetRenameInformation called
@@ -5,2 +5,2 @@
-WPP_RECORDER_SF_sD
-WPP_RECORDER_SF_sDd
+WPP_RECORDER_AND_TRACE_SF_sD
+WPP_RECORDER_AND_TRACE_SF_sDD
```
### PrjfPreSetRenameInformation Diff
```diff
--- PrjfPreSetRenameInformation
+++ PrjfPreSetRenameInformation
@@ -1,58 +1,66 @@
undefined8 PrjfPreSetRenameInformation(longlong param_1,longlong param_2,longlong *param_3)
{
longlong lVar1;
int iVar2;
ulonglong uVar3;
undefined8 uVar4;
longlong local_res8;
iVar2 = 0;
+ local_res8 = 0;
*param_3 = 0;
- local_res8 = 0;
uVar4 = 1;
lVar1 = *(longlong *)(*(longlong *)(param_1 + 0x10) + 0x38);
if (((*(longlong *)(*(longlong *)(param_1 + 0x10) + 0x28) == 0) && (1 < *(uint *)(lVar1 + 0x10)))
&& (*(short *)(lVar1 + 0x14) == 0x3a)) {
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) {
+ if (((DAT_0 & 0x20) == 0) &&
+ ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) {
return 1;
}
- WPP_RECORDER_SF_sD(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),4,0xd,0x1f,
- &WPP_9aa94875f0ba3c84ae0a423dcca6636f_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\fileinfo.c");
+ WPP_RECORDER_AND_TRACE_SF_sD
+ (0x40d,DAT_0 & 0x20,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),4,0xd,0x1f,
+ &WPP_9aa94875f0ba3c84ae0a423dcca6636f_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\fileinfo.c");
}
else {
iVar2 = FltGetDestinationFileNameInformation
(*(undefined8 *)(param_2 + 0x18),*(undefined8 *)(param_2 + 0x20),
*(undefined8 *)(lVar1 + 8),lVar1 + 0x14,*(undefined4 *)(lVar1 + 0x10),0x101,
&local_res8);
if (iVar2 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xd,0x20,
- &WPP_9aa94875f0ba3c84ae0a423dcca6636f_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\fileinfo.c");
+ if (((DAT_1 & 0x20) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x20d,DAT_1 & 0x20,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xd,0x20,
+ &WPP_9aa94875f0ba3c84ae0a423dcca6636f_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\fileinfo.c");
}
}
else {
uVar3 = PrjfProcessPreRenameOrLinkInformation(param_1,param_2,local_res8,0x20,param_3);
iVar2 = (int)uVar3;
if (*param_3 != 0) {
if (iVar2 < 0) {
MicrosoftTelemetryAssertTriggeredNoArgsKM();
}
uVar4 = 0;
}
}
}
if (local_res8 != 0) {
FltReleaseFileNameInformation();
}
if (iVar2 < 0) {
*(undefined8 *)(param_1 + 0x20) = 0;
uVar4 = 4;
*(int *)(param_1 + 0x18) = iVar2;
}
return uVar4;
}
```
## PrjfUnload
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.89|
|i_ratio|0.29|
|m_ratio|0.97|
|b_ratio|0.95|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfUnload|PrjfUnload|
|fullname|PrjfUnload|PrjfUnload|
|refcount|3|3|
|`length`|574|613|
|`called`|Expand for full list:
FLTMGR.SYS::FltCloseCommunicationPort
FLTMGR.SYS::FltDeleteExtraCreateParameterLookasideList
FLTMGR.SYS::FltUnregisterFilter
McGenEventUnregister_EtwUnregister
McTemplateK0_EtwWriteTransfer
NTOSKRNL.EXE::ExAcquireFastMutex
NTOSKRNL.EXE::ExDeleteNPagedLookasideList
NTOSKRNL.EXE::ExDeletePagedLookasideList
NTOSKRNL.EXE::ExReleaseFastMutex
NTOSKRNL.EXE::RtlUnregisterFeatureConfigurationChangeNotification
NTOSKRNL.EXE::RtlUnregisterFeatureUsageProvider
PrjfTelemetryAndTracingCleanup
WPP_RECORDER_SF_sDdExpand for full list:
FLTMGR.SYS::FltCloseCommunicationPort
FLTMGR.SYS::FltDeleteExtraCreateParameterLookasideList
FLTMGR.SYS::FltUnregisterFilter
McGenEventUnregister_EtwUnregister
McTemplateK0_EtwWriteTransfer
NTOSKRNL.EXE::ExAcquireFastMutex
NTOSKRNL.EXE::ExDeleteNPagedLookasideList
NTOSKRNL.EXE::ExDeletePagedLookasideList
NTOSKRNL.EXE::ExReleaseFastMutex
NTOSKRNL.EXE::RtlUnregisterFeatureConfigurationChangeNotification
NTOSKRNL.EXE::RtlUnregisterFeatureUsageProvider
PrjfTelemetryAndTracingCleanup
WPP_RECORDER_AND_TRACE_SF_sDDExpand for full list:
FLTMGR.SYS::FltDeleteFileContext
FLTMGR.SYS::FltDeleteStreamContext
FLTMGR.SYS::FltDeleteStreamHandleContext
FLTMGR.SYS::FltIsDirectory
FLTMGR.SYS::FltReleaseContext
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExAcquireFastMutex
NTOSKRNL.EXE::ExReleaseFastMutex
PrjfGetContextFileObject
PrjfGetNotificationMask
PrjfGetSetContextFileObject
PrjfSendNotifyOperationCommand
WPP_RECORDER_SF_sD
WPP_RECORDER_SF_sDd
WPP_RECORDER_SF_sDdDExpand for full list:
FLTMGR.SYS::FltDeleteFileContext
FLTMGR.SYS::FltDeleteStreamContext
FLTMGR.SYS::FltDeleteStreamHandleContext
FLTMGR.SYS::FltIsDirectory
FLTMGR.SYS::FltReleaseContext
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExAcquireFastMutex
NTOSKRNL.EXE::ExReleaseFastMutex
PrjfGetContextFileObject
PrjfGetNotificationMask
PrjfGetSetContextFileObject
PrjfSendNotifyOperationCommand
WPP_RECORDER_AND_TRACE_SF_sD
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDdD
__security_check_cookie
PrjfProcessPreRenameOrLinkInformation|PrjfProcessPostRenameOrLinkInformation
PrjfProcessPreRenameOrLinkInformation|
|paramcount|5|5|
|`address`|1c002469c|1400308c8|
|sig|ulonglong __fastcall PrjfNotifyRenameOrLinkOperation(longlong param_1, undefined8 param_2, longlong * param_3, uint param_4, longlong * param_5)|ulonglong __fastcall PrjfNotifyRenameOrLinkOperation(longlong param_1, undefined8 param_2, longlong * param_3, uint param_4, longlong * param_5)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfNotifyRenameOrLinkOperation Called Diff
```diff
--- PrjfNotifyRenameOrLinkOperation called
+++ PrjfNotifyRenameOrLinkOperation called
@@ -13,3 +13,4 @@
-WPP_RECORDER_SF_sD
-WPP_RECORDER_SF_sDd
-WPP_RECORDER_SF_sDdD
+WPP_RECORDER_AND_TRACE_SF_sD
+WPP_RECORDER_AND_TRACE_SF_sDD
+WPP_RECORDER_AND_TRACE_SF_sDdD
+__security_check_cookie
```
### PrjfNotifyRenameOrLinkOperation Diff
```diff
--- PrjfNotifyRenameOrLinkOperation
+++ PrjfNotifyRenameOrLinkOperation
@@ -1,240 +1,272 @@
+
+/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
ulonglong PrjfNotifyRenameOrLinkOperation
(longlong param_1,undefined8 param_2,longlong *param_3,uint param_4,
longlong *param_5)
{
undefined4 *puVar1;
- undefined4 uVar2;
+ char cVar2;
undefined4 uVar3;
undefined4 uVar4;
- bool bVar5;
+ undefined4 uVar5;
bool bVar6;
- bool bVar7;
- longlong *plVar8;
- longlong lVar9;
- char cVar10;
- uint uVar11;
- uint uVar12;
+ undefined8 uVar7;
+ char cVar8;
+ uint uVar9;
+ longlong *plVar10;
+ char cVar11;
+ ulonglong uVar12;
longlong *plVar13;
- undefined1 uVar14;
- ushort *puVar15;
- undefined8 uVar16;
- ulonglong uVar17;
- longlong *plVar18;
- uint uVar19;
- int *piVar20;
- char cVar21;
- uint local_94;
- uint local_90 [2];
- int *local_88;
- longlong local_80;
+ ushort *puVar14;
+ longlong lVar15;
+ int *piVar16;
+ bool bVar17;
+ undefined1 auStackY_118 [32];
+ wchar_t *pwVar18;
+ undefined1 local_b6;
+ char local_b5;
+ uint local_b4;
+ uint local_b0;
+ uint local_ac;
+ longlong local_a8;
+ longlong *local_a0;
+ undefined8 local_98;
+ int *local_90;
+ longlong local_88;
undefined8 local_78;
undefined8 uStack_70;
ulonglong local_68 [5];
- plVar8 = param_5;
- uVar19 = 0;
- uVar17 = 0;
- local_80 = 0;
- piVar20 = (int *)0x0;
- local_88 = (int *)0x0;
- local_90[0] = 0;
- plVar18 = (longlong *)*param_5;
- plVar13 = (longlong *)param_5[7];
- local_94 = 0;
- cVar10 = '\0';
- if (plVar18 == (longlong *)0x0) {
- if (plVar13 != (longlong *)0x0) goto LAB_0;
+ local_68[3] = __security_cookie ^ (ulonglong)auStackY_118;
+ uVar12 = 0;
+ plVar13 = (longlong *)*param_5;
+ piVar16 = (int *)0x0;
+ plVar10 = (longlong *)param_5[7];
+ cVar11 = '\x01';
+ local_a8 = 0;
+ local_90 = (int *)0x0;
+ local_ac = 0;
+ local_b0 = 0;
+ bVar17 = true;
+ if (plVar13 == (longlong *)0x0) {
+ if (plVar10 != (longlong *)0x0) goto LAB_0;
LAB_1:
- cVar21 = '\x01';
- bVar5 = true;
+ bVar6 = true;
}
else {
- if (((plVar13 != (longlong *)0x0) && (*plVar18 == *plVar13)) && (plVar18[1] == plVar13[1]))
+ if (((plVar10 != (longlong *)0x0) && (*plVar13 == *plVar10)) && (plVar13[1] == plVar10[1]))
goto LAB_1;
LAB_0:
- bVar5 = false;
- cVar21 = cVar10;
- }
- if ((plVar13 == (longlong *)0x0) || (cVar21 != '\0')) {
- bVar7 = false;
- uVar12 = 0;
+ bVar6 = false;
+ bVar17 = false;
+ }
+ local_b4 = param_4;
+ local_a0 = param_3;
+ local_98 = param_2;
+ local_88 = param_1;
+ if ((plVar10 == (longlong *)0x0) || (bVar17)) {
+ local_b5 = '\0';
LAB_2:
- plVar18 = &local_80;
- cVar10 = PrjfGetContextFileObject(param_2,param_3,plVar18,(longlong *)&local_88);
- piVar20 = local_88;
- if (cVar10 == '\0') goto LAB_3;
- if (((local_88 == (int *)0x0) || ((param_4 & local_88[10]) == 0)) ||
- (bVar6 = true, *plVar8 == 0)) {
- bVar6 = false;
- }
- if (cVar21 == '\0') {
+ plVar13 = &local_a8;
+ cVar8 = PrjfGetContextFileObject(local_98,local_a0,plVar13,(longlong *)&local_90);
+ piVar16 = local_90;
+ lVar15 = local_a8;
+ if (cVar8 != '\0') {
+ if (((local_90 == (int *)0x0) || ((local_90[10] & local_b4) == 0)) ||
+ (bVar17 = true, *param_5 == 0)) {
+ bVar17 = false;
+ }
+ if (bVar6) {
+ if (!bVar17) {
+ if (*param_5 == 0) {
+ MicrosoftTelemetryAssertTriggeredNoArgsKM();
+ }
+ if ((char *)*param_5 == (char *)0x0) {
+ uVar12 = 0xc000ce01;
+ lVar15 = local_a8;
+ goto LAB_3;
+ }
+ uVar9 = PrjfGetNotificationMask((wchar_t *)(param_5 + 8),(char *)*param_5,plVar13);
+ if ((local_b4 & uVar9) == 0) {
+ bVar17 = false;
+ goto LAB_4;
+ }
+ }
+ }
+ else {
LAB_4:
- if (bVar6) goto LAB_5;
- goto LAB_3;
- }
- if (bVar6) {
-LAB_5:
+ lVar15 = local_a8;
+ if (!bVar17) goto LAB_5;
+ }
local_68[2] = 0;
local_68[0] = 0;
local_68[1] = 0;
- if (param_4 == 0x80) {
- local_68[0] = (ulonglong)(uint)piVar20[10];
- }
- puVar15 = (ushort *)(plVar8 + 8);
- if (cVar21 == '\0') {
- puVar15 = (ushort *)&EmptyPathFileName;
- }
- if ((piVar20 == (int *)0x0) || (uVar14 = 1, *piVar20 != 1)) {
- uVar14 = 0;
- }
- local_78 = *(undefined8 *)*plVar8;
- uStack_70 = ((undefined8 *)*plVar8)[1];
- uVar16 = param_2;
- plVar18 = param_3;
- plVar13 = PrjfSendNotifyOperationCommand
- (param_1,param_2,param_3,&local_78,(wchar_t *)(plVar8 + 1),uVar14,param_4,
- puVar15,(ushort *)local_68,'\0',local_90);
- uVar17 = (ulonglong)plVar13 & 0xffffffff;
- uVar19 = local_90[0];
- if (((int)plVar13 < 0) &&
- ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
- plVar18 = (longlong *)0xd;
- WPP_RECORDER_SF_sDdD
- (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),uVar16,0xd,0x9f,
- &WPP_3ccab5108a9538d17a865fde27ef339f_Traceguids,
+ if (local_b4 == 0x80) {
+ local_68[0] = (ulonglong)(uint)piVar16[10];
+ }
+ puVar14 = (ushort *)(param_5 + 8);
+ if (!bVar6) {
+ puVar14 = (ushort *)&EmptyPathFileName;
+ }
+ if ((piVar16 == (int *)0x0) || (cVar2 = cVar11, *piVar16 != 1)) {
+ cVar2 = '\0';
+ }
+ local_78 = *(undefined8 *)*param_5;
+ uStack_70 = ((undefined8 *)*param_5)[1];
+ pwVar18 = (wchar_t *)(param_5 + 1);
+ plVar13 = local_a0;
+ plVar10 = PrjfSendNotifyOperationCommand
+ (local_88,local_98,local_a0,&local_78,pwVar18,cVar2,local_b4,puVar14,
+ (ushort *)local_68,'\0',&local_ac);
+ uVar12 = (ulonglong)plVar10 & 0xffffffff;
+ lVar15 = local_a8;
+ if ((int)plVar10 < 0) {
+ bVar17 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ plVar13 = (longlong *)CONCAT71((int7)((ulonglong)plVar13 >> 8),bVar17);
+ if (((DAT_6 & 0x20) != 0) || (bVar17)) {
+ WPP_RECORDER_AND_TRACE_SF_sDdD
+ (0x20d,DAT_6 & 0x20,bVar17,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),
+ pwVar18,0xd,0xb1,&WPP_39279db927ae337b8503ecc20725ff46_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c");
+ lVar15 = local_a8;
+ }
+ }
+ }
+ }
+ else {
+ local_b5 = '\x01';
+ uVar12 = 0;
+ if (((*(uint *)(plVar10 + 7) & 0x10000) == 0) ||
+ (uVar9 = PrjfGetNotificationMask((wchar_t *)(param_5 + 8),(char *)plVar10,plVar13),
+ (uVar9 & 1) != 0)) goto LAB_2;
+ local_b6 = 0;
+ uVar9 = FltIsDirectory(local_a0,local_98,&local_b6);
+ if ((int)uVar9 < 0) {
+ if (((DAT_7 & 0x20) == 0) &&
+ ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) {
+ return (ulonglong)uVar9;
+ }
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x205,DAT_7 & 0x20,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,0xaf,
+ &WPP_39279db927ae337b8503ecc20725ff46_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c");
+ return (ulonglong)uVar9;
+ }
+ local_78 = *(undefined8 *)param_5[7];
+ uStack_70 = ((undefined8 *)param_5[7])[1];
+ plVar13 = local_a0;
+ plVar10 = PrjfSendNotifyOperationCommand
+ (local_88,local_98,local_a0,&local_78,(wchar_t *)&EmptyPathFileName,local_b6
+ ,local_b4,(ushort *)(param_5 + 8),(ushort *)0x0,'\x01',&local_b0);
+ uVar12 = (ulonglong)plVar10 & 0xffffffff;
+ if (-1 < (int)plVar10) goto LAB_2;
+ bVar17 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ plVar13 = (longlong *)CONCAT71((int7)((ulonglong)plVar13 >> 8),bVar17);
+ lVar15 = 0;
+ if (((DAT_6 & 0x20) != 0) || (bVar17)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x20d,DAT_6 & 0x20,bVar17,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xd,
+ 0xb0,&WPP_39279db927ae337b8503ecc20725ff46_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c");
+ cVar8 = '\0';
+ }
+ else {
+ cVar8 = '\0';
+ }
+ }
+LAB_5:
+ uVar7 = local_98;
+ plVar10 = local_a0;
+ if (local_b4 != 0x80) goto LAB_3;
+ if (cVar8 == '\0') {
+ if (local_b5 == '\0') {
+ MicrosoftTelemetryAssertTriggeredNoArgsKM();
+ }
+ if (local_b0 == 1) {
+ if (((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) ||
+ (*(short *)(WPP_GLOBAL_Control + 0x48) == 0)) {
+ cVar11 = '\0';
+ }
+ if (((DAT_8 & 0x20) != 0) || (cVar11 != '\0')) {
+ WPP_RECORDER_AND_TRACE_SF_sD
+ (0x50d,DAT_8 & 0x20,cVar11,_PrjfTraceRecorder,5,0xd,0xb2,
+ &WPP_39279db927ae337b8503ecc20725ff46_Traceguids,
"onecore\\base\\fs\\gvflt\\filter\\sys\\message.c");
- uVar19 = local_90[0];
}
goto LAB_3;
}
- if (*plVar8 == 0) {
- MicrosoftTelemetryAssertTriggeredNoArgsKM();
- }
- if (*plVar8 != 0) {
- uVar11 = PrjfGetNotificationMask((wchar_t *)(plVar8 + 8),*plVar8,plVar18);
- if ((param_4 & uVar11) == 0) {
- bVar6 = false;
- goto LAB_4;
- }
- goto LAB_5;
- }
-LAB_6:
- uVar17 = 0xc000ce01;
+ if (local_b0 + 1 < 2) {
+ if (((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) ||
+ (plVar13 = (longlong *)CONCAT71((int7)((ulonglong)plVar13 >> 8),1),
+ *(short *)(WPP_GLOBAL_Control + 0x48) == 0)) {
+ plVar13 = (longlong *)((ulonglong)plVar13 & 0xffffffffffffff00);
+ }
+ if (((DAT_8 & 0x20) != 0) || ((char)plVar13 != '\0')) {
+ WPP_RECORDER_AND_TRACE_SF_sD
+ (0x50d,DAT_8 & 0x20,(char)plVar13,_PrjfTraceRecorder,5,0xd,0xb3,
+ &WPP_39279db927ae337b8503ecc20725ff46_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c");
+ }
+ if ((*param_5 != 0) || (param_5[7] == 0)) {
+ MicrosoftTelemetryAssertTriggeredNoArgsKM();
+ }
+ if ((char *)param_5[7] == (char *)0x0) {
+LAB_9:
+ uVar12 = 0xc000ce01;
+ goto LAB_3;
+ }
+ local_b0 = PrjfGetNotificationMask((wchar_t *)(param_5 + 8),(char *)param_5[7],plVar13);
+ }
+ uVar9 = PrjfGetSetContextFileObject
+ (local_98,(longlong)local_a0,local_b0,'\x01','\0',(undefined4 *)param_5[7],
+ (undefined2 *)(param_5 + 8),&local_a8,&local_90);
+ uVar12 = (ulonglong)uVar9;
+ lVar15 = local_a8;
+ piVar16 = local_90;
}
else {
- bVar7 = true;
- uVar17 = 0;
- uVar12 = uVar19;
- if (((*(uint *)(plVar13 + 7) & 0x10000) == 0) ||
- (uVar11 = PrjfGetNotificationMask((wchar_t *)(param_5 + 8),(longlong)plVar13,plVar18),
- (uVar11 & 1) != 0)) goto LAB_2;
- param_5._0_1_ = 0;
- uVar12 = FltIsDirectory(param_3,param_2,¶m_5);
- if ((int)uVar12 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) {
- return (ulonglong)uVar12;
- }
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,0x9d,
- &WPP_3ccab5108a9538d17a865fde27ef339f_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c");
- return (ulonglong)uVar12;
- }
- local_78 = *(undefined8 *)plVar8[7];
- uStack_70 = ((undefined8 *)plVar8[7])[1];
- plVar18 = param_3;
- plVar13 = PrjfSendNotifyOperationCommand
- (param_1,param_2,param_3,&local_78,(wchar_t *)&EmptyPathFileName,
- param_5._0_1_,param_4,(ushort *)(plVar8 + 8),(ushort *)0x0,'\x01',&local_94
- );
- uVar17 = (ulonglong)plVar13 & 0xffffffff;
- uVar12 = local_94;
- if (-1 < (int)plVar13) goto LAB_2;
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) {
- cVar10 = '\0';
- }
- else {
- plVar18 = (longlong *)0xd;
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xd,0x9e,
- &WPP_3ccab5108a9538d17a865fde27ef339f_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c");
- uVar12 = local_94;
- }
+ if ((char *)param_5[7] == (char *)0x0) {
+ FltDeleteStreamHandleContext(local_98,local_a0,0);
+ FltDeleteStreamContext(uVar7,plVar10,0);
+ FltDeleteFileContext(uVar7,plVar10,0);
+ goto LAB_3;
+ }
+ if (bVar6) {
+ if (local_ac + 1 < 2) {
+ if ((char *)*param_5 == (char *)0x0) goto LAB_9;
+ local_ac = PrjfGetNotificationMask((wchar_t *)(param_5 + 8),(char *)*param_5,plVar13);
+ }
+ }
+ else if (local_b0 + 1 < 2) {
+ local_b0 = PrjfGetNotificationMask((wchar_t *)(param_5 + 8),(char *)param_5[7],plVar13);
+ }
+ ExAcquireFastMutex(lVar15 + 8);
+ puVar1 = (undefined4 *)param_5[7];
+ uVar3 = puVar1[1];
+ uVar4 = puVar1[2];
+ uVar5 = puVar1[3];
+ *(undefined4 *)(lVar15 + 0x60) = *puVar1;
+ *(undefined4 *)(lVar15 + 100) = uVar3;
+ *(undefined4 *)(lVar15 + 0x68) = uVar4;
+ *(undefined4 *)(lVar15 + 0x6c) = uVar5;
+ uVar9 = local_b0;
+ if (bVar6) {
+ uVar9 = local_ac;
+ }
+ piVar16[10] = uVar9;
+ ExReleaseFastMutex(lVar15 + 8);
+ }
LAB_3:
- if (param_4 != 0x80) goto LAB_7;
- if (cVar10 != '\0') {
- if (plVar8[7] == 0) {
- FltDeleteStreamHandleContext(param_2,param_3,0);
- FltDeleteStreamContext(param_2,param_3,0);
- FltDeleteFileContext(param_2,param_3,0);
- goto LAB_7;
- }
- if (cVar21 == '\0') {
- if (uVar12 + 1 < 2) {
- uVar12 = PrjfGetNotificationMask((wchar_t *)(plVar8 + 8),plVar8[7],plVar18);
- }
- }
- else if (uVar19 + 1 < 2) {
- if (*plVar8 == 0) goto LAB_6;
- uVar19 = PrjfGetNotificationMask((wchar_t *)(plVar8 + 8),*plVar8,plVar18);
- }
- lVar9 = local_80;
- ExAcquireFastMutex(local_80 + 8);
- puVar1 = (undefined4 *)plVar8[7];
- uVar2 = puVar1[1];
- uVar3 = puVar1[2];
- uVar4 = puVar1[3];
- *(undefined4 *)(lVar9 + 0x60) = *puVar1;
- *(undefined4 *)(lVar9 + 100) = uVar2;
- *(undefined4 *)(lVar9 + 0x68) = uVar3;
- *(undefined4 *)(lVar9 + 0x6c) = uVar4;
- if (bVar5) {
- uVar12 = uVar19;
- }
- piVar20[10] = uVar12;
- ExReleaseFastMutex(lVar9 + 8);
- goto LAB_7;
- }
- if (!bVar7) {
- MicrosoftTelemetryAssertTriggeredNoArgsKM();
- }
- if (uVar12 == 1) {
- if (((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) &&
- (*(short *)(WPP_GLOBAL_Control + 0x48) != 0)) {
- WPP_RECORDER_SF_sD(_PrjfTraceRecorder,5,0xd,0xa0,
- &WPP_3ccab5108a9538d17a865fde27ef339f_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c");
- }
- goto LAB_7;
- }
- if (uVar12 + 1 < 2) {
- if (((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) &&
- (*(short *)(WPP_GLOBAL_Control + 0x48) != 0)) {
- plVar18 = (longlong *)0xd;
- WPP_RECORDER_SF_sD(_PrjfTraceRecorder,5,0xd,0xa1,
- &WPP_3ccab5108a9538d17a865fde27ef339f_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c");
- }
- if ((*plVar8 != 0) || (plVar8[7] == 0)) {
- MicrosoftTelemetryAssertTriggeredNoArgsKM();
- }
- if (plVar8[7] == 0) goto LAB_6;
- uVar12 = PrjfGetNotificationMask((wchar_t *)(plVar8 + 8),plVar8[7],plVar18);
- }
- uVar19 = PrjfGetSetContextFileObject
- (param_2,(longlong)param_3,uVar12,'\x01','\0',(undefined4 *)plVar8[7],
- (undefined2 *)(plVar8 + 8),&local_80,&local_88);
- uVar17 = (ulonglong)uVar19;
- piVar20 = local_88;
- }
-LAB_7:
- if (local_80 != 0) {
- FltReleaseContext(local_80);
- }
- if (piVar20 != (int *)0x0) {
- FltReleaseContext(piVar20);
- }
- return uVar17;
+ if (lVar15 != 0) {
+ FltReleaseContext(lVar15);
+ }
+ if (piVar16 != (int *)0x0) {
+ FltReleaseContext(piVar16);
+ }
+ return uVar12;
}
```
## PrjfFsctlGetFilterFileIdentifier
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.66|
|i_ratio|0.44|
|m_ratio|0.89|
|b_ratio|0.83|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfFsctlGetFilterFileIdentifier|PrjfFsctlGetFilterFileIdentifier|
|fullname|PrjfFsctlGetFilterFileIdentifier|PrjfFsctlGetFilterFileIdentifier|
|refcount|2|2|
|`length`|597|773|
|`called`|FLTMGR.SYS::FltGetFileNameInformation
FLTMGR.SYS::FltParseFileNameInformation
FLTMGR.SYS::FltReleaseFileNameInformation
PrjfValidateFilterFileIdentifierInputBuffer
WPP_RECORDER_SF_sDd
memcpy|FLTMGR.SYS::FltGetFileNameInformation
FLTMGR.SYS::FltParseFileNameInformation
FLTMGR.SYS::FltReleaseFileNameInformation
PrjfValidateFilterFileIdentifierInputBuffer
WPP_RECORDER_AND_TRACE_SF_sDD
memmove|
|calling|PrjfPreFsControl|PrjfPreFsControl|
|paramcount|2|2|
|`address`|1c00225d0|14002de20|
|sig|undefined4 __fastcall PrjfFsctlGetFilterFileIdentifier(longlong param_1, longlong param_2)|undefined4 __fastcall PrjfFsctlGetFilterFileIdentifier(longlong param_1, longlong param_2)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfFsctlGetFilterFileIdentifier Called Diff
```diff
--- PrjfFsctlGetFilterFileIdentifier called
+++ PrjfFsctlGetFilterFileIdentifier called
@@ -5,2 +5,2 @@
-WPP_RECORDER_SF_sDd
-memcpy
+WPP_RECORDER_AND_TRACE_SF_sDD
+memmove
```
### PrjfFsctlGetFilterFileIdentifier Diff
```diff
--- PrjfFsctlGetFilterFileIdentifier
+++ PrjfFsctlGetFilterFileIdentifier
@@ -1,106 +1,116 @@
undefined4 PrjfFsctlGetFilterFileIdentifier(longlong param_1,longlong param_2)
{
ushort *puVar1;
ushort uVar2;
int iVar3;
- ushort uVar4;
+ byte bVar4;
undefined4 uVar5;
- undefined2 uVar6;
- undefined8 uVar7;
+ undefined8 uVar6;
+ bool bVar8;
char local_res8 [8];
longlong local_res18;
- undefined8 uVar8;
+ ushort uVar9;
+ undefined8 uVar7;
- uVar8 = 0;
uVar7 = 0;
+ uVar6 = 0;
local_res18 = 0;
local_res8[0] = '\0';
uVar5 = 4;
puVar1 = *(ushort **)(*(longlong *)(param_1 + 0x10) + 0x30);
if (puVar1 == (ushort *)0x0) {
iVar3 = -0x3ffffff3;
}
else {
iVar3 = PrjfValidateFilterFileIdentifierInputBuffer
(param_2,*(uint *)(*(longlong *)(param_1 + 0x10) + 0x20),puVar1,local_res8);
if (-1 < iVar3) {
if (local_res8[0] == '\0') {
uVar5 = 1;
goto LAB_0;
}
if (*(uint *)(*(longlong *)(param_1 + 0x10) + 0x18) < 4) {
iVar3 = -0x3fffffdd;
}
else {
iVar3 = FltGetFileNameInformation(param_1,0x101,&local_res18);
- uVar8 = uVar7;
+ uVar7 = uVar6;
if (iVar3 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- uVar6 = 0x29;
-LAB_1:
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,7,uVar6,
- &WPP_594c3e8dc88d3460d4d40c2e57e2d4a0_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\fsctrl.c");
+ bVar8 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar4 = DAT_1 & 0x80;
+ if ((bVar4 != 0) || (bVar8)) {
+ uVar9 = 0x29;
+LAB_2:
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x207,bVar4,bVar8,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,7,uVar9,
+ &WPP_594c3e8dc88d3460d4d40c2e57e2d4a0_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\fsctrl.c");
}
}
else {
iVar3 = FltParseFileNameInformation(local_res18);
if (iVar3 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- uVar6 = 0x2a;
- goto LAB_1;
+ bVar8 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar4 = DAT_1 & 0x80;
+ if ((bVar4 != 0) || (bVar8)) {
+ uVar9 = 0x2a;
+ goto LAB_2;
}
}
else {
puVar1 = *(ushort **)(*(longlong *)(param_1 + 0x10) + 0x30);
- uVar4 = *(ushort *)(local_res18 + 8);
- uVar2 = uVar4 + 6;
- if (uVar2 < uVar4) {
+ uVar9 = *(ushort *)(local_res18 + 8);
+ uVar2 = uVar9 + 6;
+ if (uVar2 < uVar9) {
*puVar1 = 0xffff;
iVar3 = -0x3fffff6b;
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- uVar6 = 0x2b;
- goto LAB_1;
+ bVar8 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar4 = DAT_1 & 0x80;
+ if ((bVar4 != 0) || (bVar8)) {
+ uVar9 = 0x2b;
+ goto LAB_2;
}
}
else {
*puVar1 = uVar2;
- uVar4 = uVar4 + 8;
- if (uVar4 < uVar2) {
+ uVar9 = uVar9 + 8;
+ if (uVar9 < uVar2) {
iVar3 = -0x3fffff6b;
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- uVar6 = 0x2c;
- goto LAB_1;
+ bVar8 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar4 = DAT_1 & 0x80;
+ if ((bVar4 != 0) || (bVar8)) {
+ uVar9 = 0x2c;
+ goto LAB_2;
}
}
else {
- if ((uint)uVar4 <= *(uint *)(*(longlong *)(param_1 + 0x10) + 0x18)) {
+ if ((uint)uVar9 <= *(uint *)(*(longlong *)(param_1 + 0x10) + 0x18)) {
puVar1[1] = *(short *)(local_res18 + 8) + 6;
puVar1[2] = *(ushort *)(local_res18 + 0x18);
puVar1[3] = *(ushort *)(local_res18 + 8);
- memcpy(puVar1 + 4,*(void **)(local_res18 + 0x10),
- (ulonglong)*(ushort *)(local_res18 + 8));
+ memmove(puVar1 + 4,*(void **)(local_res18 + 0x10),
+ (ulonglong)*(ushort *)(local_res18 + 8));
*(undefined4 *)(param_1 + 0x18) = 0;
- *(ulonglong *)(param_1 + 0x20) = (ulonglong)(uint)uVar4;
+ *(ulonglong *)(param_1 + 0x20) = (ulonglong)(uint)uVar9;
goto LAB_0;
}
iVar3 = -0x7ffffffb;
- uVar8 = 2;
+ uVar7 = 2;
}
}
}
}
}
}
}
*(int *)(param_1 + 0x18) = iVar3;
- *(undefined8 *)(param_1 + 0x20) = uVar8;
+ *(undefined8 *)(param_1 + 0x20) = uVar7;
LAB_0:
if (local_res18 != 0) {
FltReleaseFileNameInformation();
}
return uVar5;
}
```
## PrjfAdvanceToNextEnumEntry
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address|
|ratio|0.64|
|i_ratio|0.45|
|m_ratio|0.95|
|b_ratio|0.86|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfAdvanceToNextEnumEntry|PrjfAdvanceToNextEnumEntry|
|fullname|PrjfAdvanceToNextEnumEntry|PrjfAdvanceToNextEnumEntry|
|refcount|6|6|
|`length`|72|62|
|called|PrjfGetCurrentEnumEntryFromContext|PrjfGetCurrentEnumEntryFromContext|
|calling|PrjfMergeEnumerationResults|PrjfMergeEnumerationResults|
|paramcount|1|1|
|`address`|1c001b05c|1400258f0|
|sig|undefined8 __fastcall PrjfAdvanceToNextEnumEntry(longlong param_1)|undefined8 __fastcall PrjfAdvanceToNextEnumEntry(longlong param_1)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfAdvanceToNextEnumEntry Diff
```diff
--- PrjfAdvanceToNextEnumEntry
+++ PrjfAdvanceToNextEnumEntry
@@ -1,25 +1,25 @@
undefined8 PrjfAdvanceToNextEnumEntry(longlong param_1)
{
undefined4 *puVar1;
undefined8 uVar2;
int local_res10 [2];
- int local_res18 [2];
- int local_res20 [2];
+ undefined4 local_res18 [2];
+ undefined4 local_res20 [2];
- local_res18[0] = 0;
- local_res20[0] = 0;
local_res10[0] = 0;
- puVar1 = PrjfGetCurrentEnumEntryFromContext(param_1,local_res18,local_res20,local_res10);
+ puVar1 = PrjfGetCurrentEnumEntryFromContext(param_1,local_res20,local_res18,local_res10);
uVar2 = 0;
if (puVar1 != (undefined4 *)0x0) {
if (local_res10[0] == 0) {
- local_res10[0] = local_res20[0] + local_res18[0];
+ *(undefined4 *)(param_1 + 0x30) = 0xffffffff;
}
- *(int *)(param_1 + 0x30) = *(int *)(param_1 + 0x30) + local_res10[0];
- uVar2 = CONCAT71((uint7)(uint3)((uint)local_res10[0] >> 8),1);
+ else {
+ *(int *)(param_1 + 0x30) = *(int *)(param_1 + 0x30) + local_res10[0];
+ }
+ uVar2 = CONCAT71((int7)((ulonglong)puVar1 >> 8),1);
}
return uVar2;
}
```
## PrjfPopulateDestinationForRenameOrLink
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,sig,address,called|
|ratio|0.53|
|i_ratio|0.35|
|m_ratio|0.94|
|b_ratio|0.9|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfPopulateDestinationForRenameOrLink|PrjfPopulateDestinationForRenameOrLink|
|fullname|PrjfPopulateDestinationForRenameOrLink|PrjfPopulateDestinationForRenameOrLink|
|refcount|2|2|
|`length`|654|757|
|`called`|Expand for full list:
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltParseFileNameInformation
MicrosoftTelemetryAssertTriggeredNoArgsKM
PrjfDeleteTombstoneIfExists
PrjfPartiallyExpandDirectory
PrjfPrepareDestinationForRenameOrLink
PrjfReopenFile
WPP_RECORDER_SF_sDd
WPP_RECORDER_SF_sDqqqd
__security_check_cookie
_guard_dispatch_icall
memsetExpand for full list:
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltParseFileNameInformation
MicrosoftTelemetryAssertTriggeredNoArgsKM
PrjfDeleteTombstoneIfExists
PrjfPartiallyExpandDirectory
PrjfPrepareDestinationForRenameOrLink
PrjfReopenFile
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDqqqd
__security_check_cookie
_guard_dispatch_icall
memsetExpand for full list:
FLTMGR.SYS::FltGetInstanceContext
FLTMGR.SYS::FltReleaseContext
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
PrjfAttachFilterHandler
PrjfClearNegativePathCacheHandler
PrjfCloseFileHandler
PrjfCompleteCommandHandler
PrjfDeleteFileHandler
PrjfOpenFileHandler
PrjfReadFileHandler
PrjfSetupVolumeInformationHandler
PrjfUpdatePlaceholderIfNeededHandler
PrjfWriteFileDataHandler
PrjfWritePlaceholderInformationHandler
WPP_RECORDER_SF_sD
WPP_RECORDER_SF_sDDd
WPP_RECORDER_SF_sDd
WPP_RECORDER_SF_sDdD
__security_check_cookie
memcpyExpand for full list:
FLTMGR.SYS::FltGetInstanceContext
FLTMGR.SYS::FltReleaseContext
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
PrjfAttachFilterHandler
PrjfClearNegativePathCacheHandler
PrjfCloseFileHandler
PrjfCompleteCommandHandler
PrjfDeleteFileHandler
PrjfOpenFileHandler
PrjfReadFileHandler
PrjfSetupVolumeInformationHandler
PrjfUpdatePlaceholderIfNeededHandler
PrjfWriteFileDataHandler
PrjfWritePlaceholderInformationHandler
WPP_RECORDER_AND_TRACE_SF_sD
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDDD
WPP_RECORDER_AND_TRACE_SF_sDdD
memmoveExpand for full list:
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltReleaseContext
FLTMGR.SYS::FltReleaseFileNameInformation
FLTMGR.SYS::FltSetInformationFile
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExFreeToPagedLookasideList
NTOSKRNL.EXE::ExReleaseRundownProtection
NTOSKRNL.EXE::KeWaitForSingleObject
NTOSKRNL.EXE::ObReferenceObjectByHandle
NTOSKRNL.EXE::ObfDereferenceObject
PrjfCreateTombstone
PrjfRemoveInMemoryTombstone
PrjfRevertInMemoryTombstonesForDirectory
PrjfSendNotifyOperationCommand
PrjfTelemetryTombstoneFailureOperation
WPP_RECORDER_SF_sDDd
WPP_RECORDER_SF_sDdExpand for full list:
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltReleaseContext
FLTMGR.SYS::FltReleaseFileNameInformation
FLTMGR.SYS::FltSetInformationFile
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExFreeToPagedLookasideList
NTOSKRNL.EXE::ExReleaseRundownProtection
NTOSKRNL.EXE::KeWaitForSingleObject
NTOSKRNL.EXE::ObReferenceObjectByHandle
NTOSKRNL.EXE::ObfDereferenceObject
PrjfCreateTombstone
PrjfRemoveInMemoryTombstone
PrjfRevertInMemoryTombstonesForDirectory
PrjfSendNotifyOperationCommand
PrjfTelemetryTombstoneFailureOperation
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDDD
__security_check_cookie
MicrosoftTelemetryAssertTriggeredNoArgsKM
WPP_RECORDER_SF_sDd
memcpy|MicrosoftTelemetryAssertTriggeredMsgKM
MicrosoftTelemetryAssertTriggeredNoArgsKM
WPP_RECORDER_AND_TRACE_SF_sDD
memmove|
|calling|PrjfTranslateCurrentEnumEntry|PrjfTranslateCurrentEnumEntry|
|paramcount|8|8|
|`address`|1c001cf84|140027ae8|
|sig|undefined8 __fastcall PrjfMungeDirectoryEnumerateWithoutShortname(uint param_1, char param_2, undefined8 * param_3, char param_4, undefined8 * param_5, uint param_6, undefined8 * param_7, uint * param_8)|undefined8 __fastcall PrjfMungeDirectoryEnumerateWithoutShortname(uint param_1, char param_2, undefined8 * param_3, char param_4, undefined8 * param_5, uint param_6, undefined8 * param_7, uint * param_8)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfMungeDirectoryEnumerateWithoutShortname Called Diff
```diff
--- PrjfMungeDirectoryEnumerateWithoutShortname called
+++ PrjfMungeDirectoryEnumerateWithoutShortname called
@@ -3,2 +3,2 @@
-WPP_RECORDER_SF_sDd
-memcpy
+WPP_RECORDER_AND_TRACE_SF_sDD
+memmove
```
### PrjfMungeDirectoryEnumerateWithoutShortname Diff
```diff
--- PrjfMungeDirectoryEnumerateWithoutShortname
+++ PrjfMungeDirectoryEnumerateWithoutShortname
@@ -1,186 +1,190 @@
undefined8
PrjfMungeDirectoryEnumerateWithoutShortname
(uint param_1,char param_2,undefined8 *param_3,char param_4,undefined8 *param_5,
uint param_6,undefined8 *param_7,uint *param_8)
{
uint uVar1;
uint uVar2;
uint uVar3;
undefined4 uVar4;
uint uVar5;
undefined8 uVar6;
bool bVar8;
undefined8 uVar7;
uVar7 = 0;
uVar3 = 0;
uVar6 = 0;
uVar5 = 0;
if ((0x3c < param_1) ||
(uVar2 = uVar5, (0x1000000000001006U >> ((longlong)(int)param_1 & 0x3fU) & 1) == 0)) {
uVar2 = 1;
}
if (uVar2 != 0) {
MicrosoftTelemetryAssertTriggeredNoArgsKM();
}
if (param_1 == 1) {
uVar2 = *(uint *)((longlong)param_3 + 0x3c);
if ((uVar2 + 0x40 <= param_6) || ((uVar3 = uVar5, 0x3f < param_6 && (param_2 != '\0')))) {
uVar3 = uVar2;
if (param_6 - 0x40 <= uVar2) {
uVar3 = param_6 - 0x40;
}
uVar6 = param_3[1];
*param_5 = *param_3;
param_5[1] = uVar6;
uVar6 = param_3[3];
param_5[2] = param_3[2];
param_5[3] = uVar6;
uVar6 = param_3[5];
param_5[4] = param_3[4];
param_5[5] = uVar6;
param_5[6] = param_3[6];
uVar5 = *(uint *)(param_3 + 7);
if ((*(int *)((longlong)param_3 + 0x44) == -0x6fffffe4) &&
(uVar5 = uVar5 & 0xffffe9ff, uVar5 == 0)) {
uVar5 = 0x80;
}
*(uint *)(param_5 + 7) = uVar5;
if (param_4 != '\0') {
*(uint *)(param_5 + 7) = *(uint *)(param_5 + 7) | 0x440000;
param_5[6] = 0;
}
*(undefined4 *)((longlong)param_5 + 0x3c) = *(undefined4 *)((longlong)param_3 + 0x3c);
- memcpy(param_5 + 8,param_3 + 0xb,(ulonglong)uVar3);
+ memmove(param_5 + 8,param_3 + 0xb,(ulonglong)uVar3);
*(undefined4 *)param_5 = 0;
*param_7 = param_5;
uVar3 = uVar3 + 0x40;
uVar6 = uVar7;
if (uVar3 < uVar2 + 0x40) {
uVar6 = 0x80000005;
}
}
goto LAB_0;
}
if (param_1 == 2) {
uVar1 = *(uint *)((longlong)param_3 + 0x3c);
uVar2 = uVar1 + 0x44;
if ((param_6 < uVar2) && ((uVar3 = uVar5, param_6 < 0x44 || (param_2 == '\0'))))
goto LAB_0;
if (param_6 - 0x44 <= uVar1) {
uVar1 = param_6 - 0x44;
}
uVar6 = param_3[1];
*param_5 = *param_3;
param_5[1] = uVar6;
uVar6 = param_3[3];
param_5[2] = param_3[2];
param_5[3] = uVar6;
uVar6 = param_3[5];
param_5[4] = param_3[4];
param_5[5] = uVar6;
param_5[6] = param_3[6];
if (*(int *)((longlong)param_3 + 0x44) == -0x6fffffe4) {
uVar3 = *(uint *)(param_3 + 7) & 0xffffe9ff;
if (uVar3 == 0) {
uVar3 = 0x80;
}
*(uint *)(param_5 + 7) = uVar3;
LAB_1:
uVar4 = *(undefined4 *)(param_3 + 8);
}
else {
*(uint *)(param_5 + 7) = *(uint *)(param_3 + 7);
if ((*(uint *)(param_3 + 7) & 0x400) == 0) goto LAB_1;
uVar4 = *(undefined4 *)((longlong)param_3 + 0x44);
}
*(undefined4 *)(param_5 + 8) = uVar4;
if (param_4 != '\0') {
*(uint *)(param_5 + 7) = *(uint *)(param_5 + 7) | 0x440000;
param_5[6] = 0;
}
*(undefined4 *)((longlong)param_5 + 0x3c) = *(undefined4 *)((longlong)param_3 + 0x3c);
- memcpy((void *)((longlong)param_5 + 0x44),param_3 + 0xb,(ulonglong)uVar1);
+ memmove((void *)((longlong)param_5 + 0x44),param_3 + 0xb,(ulonglong)uVar1);
uVar3 = uVar1 + 0x44;
LAB_2:
bVar8 = uVar3 < uVar2;
}
else {
if (param_1 != 0xc) {
if (param_1 != 0x3c) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),3,0x12,10,
- &WPP_e21b7c61aee93f730c9c252e6e8da2f4_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\dir.c");
+ if (((DAT_3 & 4) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x312,DAT_3 & 4,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),3,0x12,10,
+ &WPP_3d19aee1b05838720427e757513a9608_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\dir.c");
}
MicrosoftTelemetryAssertTriggeredMsgKM();
uVar6 = 0xc00000bb;
goto LAB_0;
}
uVar1 = *(uint *)((longlong)param_3 + 0x3c);
uVar2 = uVar1 + 0x58;
if ((param_6 < uVar2) && ((uVar6 = uVar7, uVar3 = uVar5, param_6 < 0x58 || (param_2 == '\0')))
) goto LAB_0;
if (param_6 - 0x58 <= uVar1) {
uVar1 = param_6 - 0x58;
}
uVar6 = param_3[1];
*param_5 = *param_3;
param_5[1] = uVar6;
uVar6 = param_3[3];
param_5[2] = param_3[2];
param_5[3] = uVar6;
uVar6 = param_3[5];
param_5[4] = param_3[4];
param_5[5] = uVar6;
uVar6 = param_3[7];
param_5[6] = param_3[6];
param_5[7] = uVar6;
uVar6 = param_3[9];
param_5[8] = param_3[8];
param_5[9] = uVar6;
param_5[10] = param_3[10];
if (*(int *)((longlong)param_3 + 0x44) == -0x6fffffe4) {
uVar3 = *(uint *)(param_3 + 7) & 0xffffe9ff;
if (uVar3 == 0) {
uVar3 = 0x80;
}
*(uint *)(param_5 + 7) = uVar3;
*(undefined4 *)((longlong)param_5 + 0x44) = 0;
}
if (param_4 != '\0') {
*(uint *)(param_5 + 7) = *(uint *)(param_5 + 7) | 0x440000;
param_5[6] = 0;
param_5[9] = 0xffffffffffffffff;
param_5[10] = 0xffffffffffffffff;
}
- memcpy(param_5 + 0xb,param_3 + 0xb,(ulonglong)uVar1);
+ memmove(param_5 + 0xb,param_3 + 0xb,(ulonglong)uVar1);
uVar3 = uVar1 + 0x58;
goto LAB_2;
}
uVar2 = *(uint *)((longlong)param_3 + 0x3c);
if ((param_6 < uVar2 + 0xc) && ((uVar3 = uVar5, param_6 < 0xc || (param_2 == '\0'))))
goto LAB_0;
uVar3 = uVar2;
if (param_6 - 0xc <= uVar2) {
uVar3 = param_6 - 0xc;
}
*(undefined4 *)((longlong)param_5 + 4) = *(undefined4 *)((longlong)param_3 + 4);
*(undefined4 *)(param_5 + 1) = *(undefined4 *)((longlong)param_3 + 0x3c);
- memcpy((void *)((longlong)param_5 + 0xc),param_3 + 0xb,(ulonglong)uVar3);
+ memmove((void *)((longlong)param_5 + 0xc),param_3 + 0xb,(ulonglong)uVar3);
uVar3 = uVar3 + 0xc;
bVar8 = uVar3 < uVar2 + 0xc;
}
*(undefined4 *)param_5 = 0;
*param_7 = param_5;
uVar6 = uVar7;
if (bVar8) {
uVar6 = 0x80000005;
}
LAB_0:
*param_8 = uVar3;
return uVar6;
}
```
## PrjfPrepareForDelete
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.35|
|i_ratio|0.34|
|m_ratio|0.89|
|b_ratio|0.34|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfPrepareForDelete|PrjfPrepareForDelete|
|fullname|PrjfPrepareForDelete|PrjfPrepareForDelete|
|refcount|3|3|
|`length`|1355|1708|
|`called`|Expand for full list:
FLTMGR.SYS::FltReleaseContext
NTOSKRNL.EXE::ExAcquireFastMutex
NTOSKRNL.EXE::ExReleaseFastMutex
PrjfDoesNameExistInLayer
PrjfGetContextFileObjectEx
PrjfGetSetFileContext
PrjfGetUnionContextByFileName
PrjfIsDirectoryEmpty
PrjfReleaseUnionContext
PrjfRemoveTombstonesFromDirectory
PrjfSendNotifyOperationCommand
PrjfSetParentPlaceHolderFlagsSynchronized
WPP_RECORDER_SF_sDd
WPP_RECORDER_SF_sDqExpand for full list:
FLTMGR.SYS::FltReleaseContext
NTOSKRNL.EXE::ExAcquireFastMutex
NTOSKRNL.EXE::ExReleaseFastMutex
PrjfDoesNameExistInLayer
PrjfGetContextFileObjectEx
PrjfGetSetFileContext
PrjfGetUnionContextByFileName
PrjfIsDirectoryEmpty
PrjfReleaseUnionContext
PrjfRemoveTombstonesFromDirectory
PrjfSendNotifyOperationCommand
PrjfSetParentPlaceHolderFlagsSynchronized
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDq
PrjfPreSetDispositionInformation|PrjfPreCleanup
PrjfPreSetDispositionInformation|
|paramcount|3|3|
|`address`|1c002f100|14003d5fc|
|sig|undefined8 * __fastcall PrjfPrepareForDelete(longlong param_1, longlong param_2, wchar_t * param_3)|undefined8 * __fastcall PrjfPrepareForDelete(longlong param_1, longlong param_2, wchar_t * param_3)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfPrepareForDelete Called Diff
```diff
--- PrjfPrepareForDelete called
+++ PrjfPrepareForDelete called
@@ -13,2 +13,2 @@
-WPP_RECORDER_SF_sDd
-WPP_RECORDER_SF_sDq
+WPP_RECORDER_AND_TRACE_SF_sDD
+WPP_RECORDER_AND_TRACE_SF_sDq
```
### PrjfPrepareForDelete Diff
```diff
--- PrjfPrepareForDelete
+++ PrjfPrepareForDelete
@@ -1,206 +1,245 @@
undefined8 * PrjfPrepareForDelete(longlong param_1,longlong param_2,wchar_t *param_3)
{
int *piVar1;
char cVar2;
uint extraout_EAX;
longlong *plVar3;
ulonglong uVar4;
- byte bVar5;
- uint uVar6;
- undefined8 *puVar7;
- longlong lVar9;
- undefined8 *puVar10;
- uint uVar11;
+ undefined2 uVar5;
+ byte bVar6;
+ uint uVar7;
+ undefined8 *puVar8;
+ longlong lVar10;
+ undefined8 *puVar11;
longlong lVar12;
+ undefined7 uVar15;
char *pcVar13;
undefined8 uVar14;
- undefined2 uVar15;
int **ppiVar16;
undefined8 *puVar17;
undefined8 *puVar18;
+ bool bVar19;
char local_res10 [8];
wchar_t *local_res18;
char local_res20 [8];
+ undefined1 uVar20;
+ ushort uVar21;
longlong local_68 [2];
int *local_58;
undefined8 uStack_50;
longlong local_48 [2];
- undefined8 *puVar8;
+ undefined8 *puVar9;
- puVar7 = (undefined8 *)0x0;
+ puVar8 = (undefined8 *)0x0;
local_58 = (int *)0x0;
ppiVar16 = &local_58;
local_68[0] = 0;
plVar3 = local_68;
local_48[0] = 0;
local_res20[0] = '\0';
puVar17 = (undefined8 *)0x0;
local_res10[0] = '\0';
local_res18 = param_3;
cVar2 = PrjfGetContextFileObjectEx
(*(undefined8 *)(param_2 + 0x18),*(undefined8 *)(param_2 + 0x20),plVar3,
(longlong *)ppiVar16,local_48);
piVar1 = local_58;
- lVar9 = local_68[0];
- uVar11 = (uint)plVar3;
+ lVar10 = local_68[0];
+ uVar7 = (uint)plVar3;
if (cVar2 == '\0') {
pcVar13 = local_res10;
uVar4 = PrjfDoesNameExistInLayer(param_1,*(undefined8 *)(param_2 + 0x18),pcVar13);
- uVar11 = (uint)pcVar13;
- puVar10 = (undefined8 *)(uVar4 & 0xffffffff);
- lVar9 = local_68[0];
+ uVar7 = (uint)pcVar13;
+ puVar11 = (undefined8 *)(uVar4 & 0xffffffff);
+ lVar10 = local_68[0];
if ((int)uVar4 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- uVar11 = 0xd;
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xd,0x61,
- &WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
- lVar9 = local_68[0];
- }
- goto LAB_0;
- }
- if (local_res10[0] == '\0') goto LAB_1;
- uVar11 = 0;
+ bVar19 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ uVar7 = (uint)CONCAT71((int7)((ulonglong)pcVar13 >> 8),bVar19);
+ if (((DAT_0 & 0x20) != 0) || (bVar19)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x20d,DAT_0 & 0x20,bVar19,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,
+ 0xd,99,&WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
+ lVar10 = local_68[0];
+ }
+ goto LAB_1;
+ }
+ if (local_res10[0] == '\0') goto LAB_2;
+ uVar14 = 0;
puVar17 = PrjfGetUnionContextByFileName
(param_1,*(undefined8 *)(param_2 + 0x18),(ushort *)0x0,(undefined1 *)0x0);
if (puVar17 == (undefined8 *)0x0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- uVar11 = 5;
- WPP_RECORDER_SF_sDq(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,0x62,
- &WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
- }
- puVar10 = (undefined8 *)0xc000ce01;
- lVar9 = local_68[0];
- goto LAB_0;
- }
- uVar11 = 0;
+ bVar19 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ uVar7 = (uint)CONCAT71((int7)((ulonglong)uVar14 >> 8),bVar19);
+ if (((DAT_3 & 0x20) != 0) || (bVar19)) {
+ WPP_RECORDER_AND_TRACE_SF_sDq
+ (0x205,DAT_3 & 0x20,bVar19,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,
+ 100,&WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
+ }
+ puVar11 = (undefined8 *)0xc000ce01;
+ lVar10 = local_68[0];
+ goto LAB_1;
+ }
+ uVar14 = 0;
uVar4 = PrjfGetSetFileContext
(*(undefined8 *)(param_2 + 0x18),*(undefined8 *)(param_2 + 0x20),'\0',
(longlong *)0x0,(undefined4 *)puVar17,(undefined2 *)0x0,(undefined1 *)0x0,
local_68);
- puVar10 = (undefined8 *)(uVar4 & 0xffffffff);
- lVar9 = local_68[0];
+ uVar7 = (uint)uVar14;
+ puVar11 = (undefined8 *)(uVar4 & 0xffffffff);
+ lVar10 = local_68[0];
puVar18 = puVar17;
- if (-1 < (int)uVar4) goto LAB_2;
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- uVar11 = 0xd;
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xd,99,
- &WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
- lVar9 = local_68[0];
- }
-LAB_3:
+ if (-1 < (int)uVar4) goto LAB_4;
+ bVar19 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ uVar7 = (uint)CONCAT71((int7)((ulonglong)uVar14 >> 8),bVar19);
+ if (((DAT_0 & 0x20) != 0) || (bVar19)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x20d,DAT_0 & 0x20,bVar19,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xd,
+ 0x65,&WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
+ lVar10 = local_68[0];
+ }
+LAB_5:
PrjfReleaseUnionContext((longlong)puVar17);
- goto LAB_0;
- }
- puVar8 = puVar7;
+ goto LAB_1;
+ }
+ puVar9 = puVar8;
if ((local_68[0] == 0) || (*(int *)(local_68[0] + 0x40) == 3)) {
pcVar13 = local_res10;
uVar4 = PrjfDoesNameExistInLayer(param_1,*(undefined8 *)(param_2 + 0x18),pcVar13);
- uVar11 = (uint)pcVar13;
- puVar10 = (undefined8 *)(uVar4 & 0xffffffff);
+ uVar7 = (uint)pcVar13;
+ puVar11 = (undefined8 *)(uVar4 & 0xffffffff);
if (-1 < (int)uVar4) {
+LAB_6:
+ puVar18 = puVar17;
+ puVar17 = puVar8;
+ if (local_res10[0] == (char)puVar9) goto LAB_2;
LAB_4:
- puVar18 = puVar17;
- puVar17 = puVar7;
- if (local_res10[0] == (char)puVar8) goto LAB_1;
+ ExAcquireFastMutex(lVar10 + 8);
+ *(undefined1 *)(lVar10 + 0x118) = 1;
+ ExReleaseFastMutex(lVar10 + 8);
+ puVar17 = puVar18;
LAB_2:
- ExAcquireFastMutex(lVar9 + 8);
- *(undefined1 *)(lVar9 + 0x118) = 1;
- ExReleaseFastMutex(lVar9 + 8);
- puVar17 = puVar18;
-LAB_1:
if ((piVar1 != (int *)0x0) && ((piVar1[10] & 0x10U) != 0)) {
- local_58 = *(int **)(lVar9 + 0x60);
- uStack_50 = *(undefined8 *)(lVar9 + 0x68);
+ local_58 = *(int **)(lVar10 + 0x60);
+ uStack_50 = *(undefined8 *)(lVar10 + 0x68);
uVar14 = *(undefined8 *)(param_2 + 0x20);
plVar3 = PrjfSendNotifyOperationCommand
(param_1,*(undefined8 *)(param_2 + 0x18),uVar14,&local_58,local_res18,
*piVar1 == 1,0x10,(ushort *)0x0,(ushort *)0x0,'\0',(uint *)0x0);
- uVar11 = (uint)uVar14;
- puVar10 = (undefined8 *)((ulonglong)plVar3 & 0xffffffff);
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- uVar11 = 0xd;
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),4,0xd,100,
- &WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
+ puVar11 = (undefined8 *)((ulonglong)plVar3 & 0xffffffff);
+ bVar19 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ uVar7 = (uint)CONCAT71((int7)((ulonglong)uVar14 >> 8),bVar19);
+ if (((DAT_7 & 0x20) != 0) || (bVar19)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x40d,DAT_7 & 0x20,bVar19,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),4,
+ 0xd,0x66,&WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
}
}
- if (puVar17 == (undefined8 *)0x0) goto LAB_0;
- goto LAB_3;
- }
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0;
- uVar15 = 0x60;
-LAB_5:
- bVar5 = 2;
+ if (puVar17 == (undefined8 *)0x0) goto LAB_1;
+ goto LAB_5;
+ }
+ uVar7 = (uint)CONCAT71((int7)((ulonglong)pcVar13 >> 8),
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED);
+ bVar6 = DAT_0 & 0x20;
+ if ((bVar6 == 0) && ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED))
+ goto LAB_1;
+ uVar21 = 0x62;
+LAB_8:
+ uVar5 = 0x20d;
+ uVar20 = 2;
}
else {
- puVar10 = puVar7;
+ puVar11 = puVar8;
if (*local_58 != 1) {
-LAB_6:
- puVar18 = puVar7;
- if ((*(uint *)(*(longlong *)(lVar9 + 0x48) + 0xc) & 8) == 0) goto LAB_2;
+LAB_9:
+ puVar18 = puVar8;
+ if ((*(uint *)(*(longlong *)(lVar10 + 0x48) + 0xc) & 8) == 0) goto LAB_4;
pcVar13 = local_res10;
uVar4 = PrjfDoesNameExistInLayer(param_1,*(undefined8 *)(param_2 + 0x18),pcVar13);
- uVar11 = (uint)pcVar13;
- puVar10 = (undefined8 *)(uVar4 & 0xffffffff);
- if (-1 < (int)uVar4) goto LAB_4;
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0;
- uVar15 = 0x5f;
- goto LAB_5;
+ uVar7 = (uint)pcVar13;
+ puVar11 = (undefined8 *)(uVar4 & 0xffffffff);
+ if (-1 < (int)uVar4) goto LAB_6;
+ uVar7 = (uint)CONCAT71((int7)((ulonglong)pcVar13 >> 8),
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED);
+ bVar6 = DAT_0 & 0x20;
+ if ((bVar6 == 0) && ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED))
+ goto LAB_1;
+ uVar21 = 0x61;
+ goto LAB_8;
}
lVar12 = *(longlong *)(param_2 + 0x20);
- uVar6 = PrjfIsDirectoryEmpty
- (param_1,*(undefined8 *****)(param_2 + 0x18),lVar12,ppiVar16,local_res20);
- uVar11 = (uint)lVar12;
- puVar8 = (undefined8 *)(ulonglong)uVar6;
- puVar10 = (undefined8 *)(ulonglong)extraout_EAX;
+ uVar7 = PrjfIsDirectoryEmpty(param_1,*(longlong *)(param_2 + 0x18),lVar12,ppiVar16,local_res20);
+ puVar9 = (undefined8 *)(ulonglong)uVar7;
+ puVar11 = (undefined8 *)(ulonglong)extraout_EAX;
+ uVar15 = (undefined7)((ulonglong)lVar12 >> 8);
if ((int)extraout_EAX < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0;
- uVar15 = 0x5c;
- goto LAB_5;
- }
- if (local_res20[0] != (char)uVar6) {
+ uVar7 = (uint)CONCAT71(uVar15,(undefined **)WPP_RECORDER_INITIALIZED !=
+ &WPP_RECORDER_INITIALIZED);
+ bVar6 = DAT_0 & 0x20;
+ if ((bVar6 == 0) && ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED))
+ goto LAB_1;
+ uVar21 = 0x5e;
+ goto LAB_8;
+ }
+ if (local_res20[0] != (char)uVar7) {
uVar4 = PrjfRemoveTombstonesFromDirectory
(*(undefined8 *)(param_2 + 0x18),*(longlong *)(param_2 + 0x20));
- puVar10 = (undefined8 *)(uVar4 & 0xffffffff);
- if (-1 < (int)uVar4) goto LAB_6;
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0;
- uVar15 = 0x5e;
- goto LAB_5;
- }
- puVar10 = (undefined8 *)0xc0000101;
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0;
- uVar15 = 0x5d;
- bVar5 = 4;
- }
- uVar11 = 0xd;
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),bVar5,0xd,uVar15,
- &WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
-LAB_0:
- if (lVar9 != 0) {
- FltReleaseContext(lVar9);
+ uVar7 = (uint)lVar12;
+ puVar11 = (undefined8 *)(uVar4 & 0xffffffff);
+ if (-1 < (int)uVar4) goto LAB_9;
+ uVar7 = (uint)CONCAT71((int7)((ulonglong)lVar12 >> 8),
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED);
+ bVar6 = DAT_0 & 0x20;
+ if ((bVar6 == 0) && ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED))
+ goto LAB_1;
+ uVar21 = 0x60;
+ goto LAB_8;
+ }
+ puVar11 = (undefined8 *)0xc0000101;
+ uVar7 = (uint)CONCAT71(uVar15,(undefined **)WPP_RECORDER_INITIALIZED !=
+ &WPP_RECORDER_INITIALIZED);
+ bVar6 = DAT_7 & 0x20;
+ if ((bVar6 == 0) && ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED))
+ goto LAB_1;
+ uVar5 = 0x40d;
+ uVar21 = 0x5f;
+ uVar20 = 4;
+ }
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (uVar5,bVar6,(char)uVar7,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),uVar20,0xd,uVar21,
+ &WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
+LAB_1:
+ if (lVar10 != 0) {
+ FltReleaseContext(lVar10);
}
if (piVar1 != (int *)0x0) {
FltReleaseContext(piVar1);
}
if (local_48[0] != 0) {
FltReleaseContext();
}
- if (-1 < (int)puVar10) {
- uVar4 = PrjfSetParentPlaceHolderFlagsSynchronized
- (param_1,*(undefined8 *)(param_2 + 0x18),uVar11);
- puVar10 = (undefined8 *)(uVar4 & 0xffffffff);
- if (((int)uVar4 < 0) && ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,0x65,
- &WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
- }
- }
- return puVar10;
+ if (-1 < (int)puVar11) {
+ uVar4 = PrjfSetParentPlaceHolderFlagsSynchronized(param_1,*(undefined8 *)(param_2 + 0x18),uVar7)
+ ;
+ puVar11 = (undefined8 *)(uVar4 & 0xffffffff);
+ if ((int)uVar4 < 0) {
+ if (((DAT_3 & 0x20) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x205,DAT_3 & 0x20,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,0x67,
+ &WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
+ }
+ }
+ }
+ return puVar11;
}
```
## PrjfSetParentPlaceHolderFlagsSynchronized
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.9|
|i_ratio|0.62|
|m_ratio|0.97|
|b_ratio|0.94|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfSetParentPlaceHolderFlagsSynchronized|PrjfSetParentPlaceHolderFlagsSynchronized|
|fullname|PrjfSetParentPlaceHolderFlagsSynchronized|PrjfSetParentPlaceHolderFlagsSynchronized|
|refcount|3|3|
|`length`|392|431|
|`called`|FLTMGR.SYS::FltClose
FLTMGR.SYS::FltReleaseContext
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ObfDereferenceObject
PrjfGetSetContextFileObject
PrjfOpenParentPlaceHolder
PrjfSetPlaceHolderFlagsSynchronized
WPP_RECORDER_SF_sDd|FLTMGR.SYS::FltClose
FLTMGR.SYS::FltReleaseContext
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ObfDereferenceObject
PrjfGetSetContextFileObject
PrjfOpenParentPlaceHolder
PrjfSetPlaceHolderFlagsSynchronized
WPP_RECORDER_AND_TRACE_SF_sDD|
|calling|PrjfPrepareForDelete
PrjfProcessPreRenameOrLinkInformation|PrjfPrepareForDelete
PrjfProcessPreRenameOrLinkInformation|
|paramcount|3|3|
|`address`|1c00070b4|140008ccc|
|sig|ulonglong __fastcall PrjfSetParentPlaceHolderFlagsSynchronized(undefined8 param_1, undefined8 param_2, uint param_3)|ulonglong __fastcall PrjfSetParentPlaceHolderFlagsSynchronized(undefined8 param_1, undefined8 param_2, uint param_3)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfSetParentPlaceHolderFlagsSynchronized Called Diff
```diff
--- PrjfSetParentPlaceHolderFlagsSynchronized called
+++ PrjfSetParentPlaceHolderFlagsSynchronized called
@@ -8 +8 @@
-WPP_RECORDER_SF_sDd
+WPP_RECORDER_AND_TRACE_SF_sDD
```
### PrjfSetParentPlaceHolderFlagsSynchronized Diff
```diff
--- PrjfSetParentPlaceHolderFlagsSynchronized
+++ PrjfSetParentPlaceHolderFlagsSynchronized
@@ -1,60 +1,64 @@
ulonglong PrjfSetParentPlaceHolderFlagsSynchronized
(undefined8 param_1,undefined8 param_2,uint param_3)
{
uint uVar1;
ulonglong uVar2;
int *piVar3;
ulonglong uVar4;
uint local_res18 [2];
longlong local_res20;
int *local_38;
longlong local_30;
longlong local_28 [2];
local_30 = 0;
local_res20 = 0;
local_28[0] = 0;
local_38 = (int *)0x0;
local_res18[0] = param_3 & 0xffffff00;
uVar2 = PrjfOpenParentPlaceHolder(param_1,param_2,&local_30,&local_res20,(byte *)local_res18);
uVar4 = uVar2 & 0xffffffff;
piVar3 = (int *)0x0;
if ((-1 < (int)uVar2) && ((char)local_res18[0] != '\0')) {
uVar1 = PrjfGetSetContextFileObject
(param_2,local_res20,-0x80000000,'\0','\0',(undefined4 *)0x0,(undefined2 *)0x0
,local_28,&local_38);
piVar3 = local_38;
uVar4 = (ulonglong)uVar1;
if ((int)uVar1 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,10,0x3b,
- &WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
+ if (((DAT_0 & 4) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x20a,DAT_0 & 4,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,10,0x3c,
+ &WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
piVar3 = local_38;
}
}
else {
if ((local_38 == (int *)0x0) || (*local_38 != 1)) {
MicrosoftTelemetryAssertTriggeredNoArgsKM();
}
uVar1 = PrjfSetPlaceHolderFlagsSynchronized(param_1,param_2,local_res20,2);
uVar4 = (ulonglong)uVar1;
}
}
if (local_30 != 0) {
FltClose();
}
if (local_res20 != 0) {
ObfDereferenceObject(local_res20);
}
if (local_28[0] != 0) {
FltReleaseContext();
}
if (piVar3 != (int *)0x0) {
FltReleaseContext(piVar3);
}
return uVar4;
}
```
## PrjfSendQueryFileNameCommand
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.52|
|i_ratio|0.47|
|m_ratio|0.92|
|b_ratio|0.88|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfSendQueryFileNameCommand|PrjfSendQueryFileNameCommand|
|fullname|PrjfSendQueryFileNameCommand|PrjfSendQueryFileNameCommand|
|refcount|2|2|
|`length`|363|444|
|`called`|PrjfFreeCommandBuffer
PrjfPrepareCommandForFilePath
PrjfSendCommand
WPP_RECORDER_SF_sDdZ|PrjfFreeCommandBuffer
PrjfPrepareCommandForFilePath
PrjfSendCommand
WPP_RECORDER_AND_TRACE_SF_sDdZ|
|calling|PrjfDoesNameExistInLayer|PrjfDoesNameExistInLayer|
|paramcount|5|5|
|`address`|1c00285cc|140035664|
|sig|ulonglong __fastcall PrjfSendQueryFileNameCommand(longlong param_1, undefined8 param_2, undefined8 * param_3, wchar_t * param_4, undefined1 * param_5)|ulonglong __fastcall PrjfSendQueryFileNameCommand(longlong param_1, undefined8 param_2, undefined8 * param_3, wchar_t * param_4, undefined1 * param_5)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfSendQueryFileNameCommand Called Diff
```diff
--- PrjfSendQueryFileNameCommand called
+++ PrjfSendQueryFileNameCommand called
@@ -4 +4 @@
-WPP_RECORDER_SF_sDdZ
+WPP_RECORDER_AND_TRACE_SF_sDdZ
```
### PrjfSendQueryFileNameCommand Diff
```diff
--- PrjfSendQueryFileNameCommand
+++ PrjfSendQueryFileNameCommand
@@ -1,70 +1,71 @@
/* WARNING: Type propagation algorithm not settling */
ulonglong PrjfSendQueryFileNameCommand
(longlong param_1,undefined8 param_2,undefined8 *param_3,wchar_t *param_4,
undefined1 *param_5)
{
uint uVar1;
ulonglong uVar2;
- ulonglong uVar3;
- undefined2 uVar4;
+ byte bVar3;
+ bool bVar4;
uint local_res18 [4];
- undefined8 uVar5;
+ ushort uVar5;
undefined4 uVar6;
- uint **ppuVar7;
- undefined8 uVar8;
+ undefined4 in_stack_ffffffffffffffb4;
+ undefined4 in_stack_ffffffffffffffbc;
int local_38 [2];
uint *local_30;
undefined8 local_28;
undefined8 uStack_20;
- undefined4 uVar9;
local_28 = *param_3;
uStack_20 = param_3[1];
local_30 = (uint *)0x0;
local_res18[0] = 0;
local_38[1] = 0;
- ppuVar7 = &local_30;
local_38[0] = 4;
- uVar6 = 0;
uVar2 = PrjfPrepareCommandForFilePath
((ushort *)param_4,&local_28,5,(ushort *)0x0,(undefined8 *)0x0,0,
- (undefined8 *)0x0,ppuVar7,local_res18);
- uVar9 = (undefined4)((ulonglong)ppuVar7 >> 0x20);
- uVar3 = uVar2 & 0xffffffff;
- if ((int)uVar2 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0;
- uVar4 = 0x91;
- uVar8 = CONCAT44(uVar9,(int)uVar2);
- uVar5 = CONCAT44(uVar6,0x1126);
+ (undefined8 *)0x0,&local_30,local_res18);
+ uVar1 = (uint)uVar2;
+ uVar2 = uVar2 & 0xffffffff;
+ if ((int)uVar1 < 0) {
+ bVar4 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar3 = DAT_0 & 0x40;
+ if ((bVar3 == 0) && (!bVar4)) goto LAB_1;
+ uVar6 = 0x125b;
+ uVar5 = 0xa3;
}
else {
uVar1 = PrjfSendCommand(param_1,param_2,local_30,0,(longlong)(local_38 + 1),local_38);
- uVar3 = (ulonglong)uVar1;
+ uVar2 = (ulonglong)uVar1;
if (uVar1 == 0xc0000034) {
- uVar3 = 0;
+ uVar2 = 0;
*param_5 = 0;
- goto LAB_0;
+ goto LAB_1;
}
if (-1 < (int)uVar1) {
*param_5 = 1;
- goto LAB_0;
+ goto LAB_1;
}
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0;
- uVar4 = 0x92;
- uVar8 = CONCAT44(uVar9,uVar1);
- uVar5 = CONCAT44(uVar6,0x113c);
+ bVar4 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar3 = DAT_0 & 0x40;
+ if ((bVar3 == 0) && (!bVar4)) goto LAB_1;
+ uVar6 = 0x1271;
+ uVar5 = 0xa4;
}
- WPP_RECORDER_SF_sDdZ
- (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,uVar4,
- &WPP_3ccab5108a9538d17a865fde27ef339f_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c",uVar5,uVar8,param_4);
-LAB_0:
+ WPP_RECORDER_AND_TRACE_SF_sDdZ
+ (0x20e,bVar3,bVar4,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,uVar5,
+ &WPP_39279db927ae337b8503ecc20725ff46_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c",
+ CONCAT44(in_stack_ffffffffffffffb4,uVar6),CONCAT44(in_stack_ffffffffffffffbc,uVar1),
+ param_4);
+LAB_1:
if (local_30 != (uint *)0x0) {
PrjfFreeCommandBuffer((longlong)local_30,local_res18[0]);
}
- return uVar3;
+ return uVar2;
}
```
## PrjfCreatePathTierNode
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.63|
|i_ratio|0.38|
|m_ratio|0.93|
|b_ratio|0.88|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfCreatePathTierNode|PrjfCreatePathTierNode|
|fullname|PrjfCreatePathTierNode|PrjfCreatePathTierNode|
|refcount|3|3|
|`length`|721|850|
|`called`|NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::RtlCopyUnicodeString
PrjfAllocateUnicodeString
PrjfCreatePathTree
PrjfDeletePathTree
WPP_RECORDER_SF_sD
WPP_RECORDER_SF_sDd
WPP_RECORDER_SF_sDdZ|NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::RtlCopyUnicodeString
PrjfAllocateUnicodeString
PrjfCreatePathTree
PrjfDeletePathTree
WPP_RECORDER_AND_TRACE_SF_sD
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDdZ|
|calling|PrjfMappingInsert|PrjfMappingInsert|
|paramcount|7|7|
|`address`|1c0035674|14004514c|
|sig|ulonglong __fastcall PrjfCreatePathTierNode(longlong param_1, uint param_2, char param_3, longlong param_4, uint param_5, undefined8 param_6, longlong * param_7)|ulonglong __fastcall PrjfCreatePathTierNode(longlong param_1, uint param_2, char param_3, longlong param_4, uint param_5, undefined8 param_6, longlong * param_7)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfCreatePathTierNode Called Diff
```diff
--- PrjfCreatePathTierNode called
+++ PrjfCreatePathTierNode called
@@ -7,3 +7,3 @@
-WPP_RECORDER_SF_sD
-WPP_RECORDER_SF_sDd
-WPP_RECORDER_SF_sDdZ
+WPP_RECORDER_AND_TRACE_SF_sD
+WPP_RECORDER_AND_TRACE_SF_sDD
+WPP_RECORDER_AND_TRACE_SF_sDdZ
```
### PrjfCreatePathTierNode Diff
```diff
--- PrjfCreatePathTierNode
+++ PrjfCreatePathTierNode
@@ -1,94 +1,109 @@
ulonglong PrjfCreatePathTierNode
(longlong param_1,uint param_2,char param_3,longlong param_4,uint param_5,
undefined8 param_6,longlong *param_7)
{
short sVar1;
uint *puVar2;
ulonglong uVar3;
ulonglong uVar4;
- undefined4 in_stack_ffffffffffffffac;
undefined4 in_stack_ffffffffffffffb4;
+ undefined4 in_stack_ffffffffffffffbc;
ulonglong local_38;
longlong lStack_30;
*param_7 = 0;
puVar2 = (uint *)ExAllocatePool2(0x100,0x40,0x6d6e4a50);
if (puVar2 == (uint *)0x0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sD(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x14,0x26,
- &WPP_5c05f7cae5513ff3734adbc0d3bd9537_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\mapping.c");
+ if (((DAT_0 & 0x10) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sD
+ (0x214,DAT_0 & 0x10,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x14,0x26,
+ &WPP_0314efc3b1f93d76a134ccc0e69e0e16_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\mapping.c");
}
return 0xc000009a;
}
if (((byte)param_2 & 0x11) == 0x11) {
sVar1 = *(short *)(param_4 + 2);
if (sVar1 == 0) {
puVar2[10] = 0;
puVar2[0xb] = 0;
puVar2[8] = 0;
- goto LAB_0;
+ goto LAB_1;
}
local_38 = (ulonglong)CONCAT22(sVar1,sVar1);
lStack_30 = param_4 + 4;
uVar4 = 0xc000000d;
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDdZ
- (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x14,0x27,
- &WPP_5c05f7cae5513ff3734adbc0d3bd9537_Traceguids,
+ if (((DAT_0 & 0x10) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDdZ
+ (0x214,DAT_0 & 0x10,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x14,0x27,
+ &WPP_0314efc3b1f93d76a134ccc0e69e0e16_Traceguids,
"onecore\\base\\fs\\gvflt\\filter\\sys\\mapping.c",
- CONCAT44(in_stack_ffffffffffffffac,0x66c),
- CONCAT44(in_stack_ffffffffffffffb4,0xc000000d),(wchar_t *)&local_38);
+ CONCAT44(in_stack_ffffffffffffffb4,0x66d),
+ CONCAT44(in_stack_ffffffffffffffbc,0xc000000d),(wchar_t *)&local_38);
}
-LAB_1:
- if (param_3 == '\0') goto LAB_2;
+LAB_2:
+ if (param_3 == '\0') goto LAB_3;
}
else {
*(undefined2 *)((longlong)puVar2 + 0x22) = *(undefined2 *)(param_1 + 2);
uVar3 = PrjfAllocateUnicodeString(0x6e664a50,(undefined2 *)(puVar2 + 8));
uVar4 = uVar3 & 0xffffffff;
if ((int)uVar3 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x14,0x28,
- &WPP_5c05f7cae5513ff3734adbc0d3bd9537_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\mapping.c");
+ if (((DAT_0 & 0x10) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x214,DAT_0 & 0x10,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x14,0x28,
+ &WPP_0314efc3b1f93d76a134ccc0e69e0e16_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\mapping.c");
}
- goto LAB_1;
+ goto LAB_2;
}
RtlCopyUnicodeString(puVar2 + 8,param_1);
-LAB_0:
+LAB_1:
*puVar2 = param_2;
if (param_3 == '\0') {
-LAB_3:
+LAB_4:
if ((param_2 & 1) != 0) {
puVar2[0xc] = param_5;
}
*param_7 = (longlong)puVar2;
return 0;
}
if ((param_2 & 0x10) != 0) {
*(undefined8 *)(puVar2 + 0xe) = param_6;
- goto LAB_3;
+ goto LAB_4;
}
uVar3 = PrjfCreatePathTree((undefined8 *)(puVar2 + 0xe));
uVar4 = uVar3 & 0xffffffff;
- if (-1 < (int)uVar3) goto LAB_3;
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x14,0x29,
- &WPP_5c05f7cae5513ff3734adbc0d3bd9537_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\mapping.c");
+ if (-1 < (int)uVar3) goto LAB_4;
+ if (((DAT_0 & 0x10) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x214,DAT_0 & 0x10,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x14,0x29,
+ &WPP_0314efc3b1f93d76a134ccc0e69e0e16_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\mapping.c");
}
}
if (*(undefined8 **)(puVar2 + 0xe) != (undefined8 *)0x0) {
PrjfDeletePathTree(*(undefined8 **)(puVar2 + 0xe));
}
-LAB_2:
+LAB_3:
if (*(longlong *)(puVar2 + 10) != 0) {
ExFreePoolWithTag(*(longlong *)(puVar2 + 10),0x6d6e4a50);
}
ExFreePoolWithTag(puVar2,0x6d6e4a50);
return uVar4;
}
```
## PrjfPreCreate
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.5|
|i_ratio|0.22|
|m_ratio|0.88|
|b_ratio|0.5|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfPreCreate|PrjfPreCreate|
|fullname|PrjfPreCreate|PrjfPreCreate|
|refcount|3|3|
|`length`|1039|1380|
|`called`|FLTMGR.SYS::FltAddOpenReparseEntry
FLTMGR.SYS::FltEnlistInTransaction
FLTMGR.SYS::FltGetFileNameInformation
FLTMGR.SYS::FltReleaseContext
FLTMGR.SYS::FltReleaseFileNameInformation
NTOSKRNL.EXE::ExAllocateFromPagedLookasideList
NTOSKRNL.EXE::ExFreeToPagedLookasideList
PrjfFindOrCreateTransactionContext
WPP_RECORDER_SF_sDd|FLTMGR.SYS::FltAddOpenReparseEntry
FLTMGR.SYS::FltEnlistInTransaction
FLTMGR.SYS::FltGetFileNameInformation
FLTMGR.SYS::FltReleaseContext
FLTMGR.SYS::FltReleaseFileNameInformation
NTOSKRNL.EXE::ExAllocateFromPagedLookasideList
NTOSKRNL.EXE::ExFreeToPagedLookasideList
PrjfFindOrCreateTransactionContext
WPP_RECORDER_AND_TRACE_SF_sDD|
|calling|||
|paramcount|3|3|
|`address`|1c001a070|1400245c0|
|sig|undefined4 __fastcall PrjfPreCreate(longlong param_1, longlong param_2, longlong * param_3)|undefined4 __fastcall PrjfPreCreate(longlong param_1, longlong param_2, longlong * param_3)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfPreCreate Called Diff
```diff
--- PrjfPreCreate called
+++ PrjfPreCreate called
@@ -9 +9 @@
-WPP_RECORDER_SF_sDd
+WPP_RECORDER_AND_TRACE_SF_sDD
```
### PrjfPreCreate Diff
```diff
--- PrjfPreCreate
+++ PrjfPreCreate
@@ -1,170 +1,191 @@
undefined4 PrjfPreCreate(longlong param_1,longlong param_2,longlong *param_3)
{
byte *pbVar1;
longlong lVar2;
int iVar3;
int iVar4;
- longlong lVar5;
+ byte bVar5;
longlong lVar6;
longlong lVar7;
longlong lVar8;
- undefined2 uVar9;
+ longlong lVar9;
undefined4 uVar10;
longlong lVar11;
+ bool bVar12;
longlong local_res10 [2];
longlong local_res20;
+ ushort uVar13;
- lVar5 = 0;
+ lVar9 = 0;
local_res10[0] = 0;
- lVar11 = 0;
+ local_res20 = 0;
lVar6 = 0;
- lVar7 = 0;
- local_res20 = 0;
+ lVar8 = 0;
if ((*(uint *)(*(longlong *)(param_2 + 0x20) + 0x50) & 0x400000) != 0) {
return 1;
}
uVar10 = 4;
- lVar8 = lVar6;
+ lVar11 = lVar9;
+ lVar7 = lVar6;
if (*(longlong *)(param_2 + 0x28) == 0) {
LAB_0:
- lVar8 = 0;
lVar2 = *(longlong *)(param_1 + 0x10);
if ((*(uint *)(lVar2 + 0x20) & 0x2000) == 0) {
if ((*(byte *)(lVar2 + 6) & 4) == 0) {
iVar3 = FltGetFileNameInformation(param_1,0x102,local_res10);
}
else {
*(byte *)(lVar2 + 6) = *(byte *)(lVar2 + 6) & 0xfb;
iVar3 = FltGetFileNameInformation(param_1,0x302);
pbVar1 = (byte *)(*(longlong *)(param_1 + 0x10) + 6);
*pbVar1 = *pbVar1 | 4;
}
if (iVar3 < 0) {
- lVar8 = lVar6;
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- uVar9 = 0x18;
- goto LAB_1;
+ bVar12 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar5 = DAT_1 & 0x20;
+ if ((bVar5 != 0) || (bVar12)) {
+ uVar13 = 0x19;
+ goto LAB_2;
}
+ goto LAB_3;
+ }
+ }
+ lVar6 = ExAllocateFromPagedLookasideList(&DAT_4);
+ lVar7 = lVar6;
+ if (lVar6 == 0) {
+ iVar3 = -0x3fffff66;
+ bVar12 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar5 = DAT_1 & 0x20;
+ if ((bVar5 != 0) || (bVar12)) {
+ uVar13 = 0x1a;
+ lVar8 = lVar9;
+LAB_5:
+ iVar3 = -0x3fffff66;
goto LAB_2;
}
}
- lVar5 = ExAllocateFromPagedLookasideList(&DAT_3);
- if (lVar5 == 0) {
- iVar3 = -0x3fffff66;
- lVar8 = lVar7;
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- uVar9 = 0x19;
- iVar3 = -0x3fffff66;
- goto LAB_1;
- }
- }
else {
- *(undefined8 *)(lVar5 + 0x2c) = 0;
- *(undefined8 *)(lVar5 + 0x34) = 0;
- *(undefined4 *)(lVar5 + 0x3c) = 0;
- *(longlong *)(lVar5 + 8) = lVar5;
- *(longlong *)lVar5 = lVar5;
- *(undefined8 *)(lVar5 + 0x18) = 0;
- *(undefined8 *)(lVar5 + 0x20) = 0;
- *(undefined4 *)(lVar5 + 0x10) = 0x9000001c;
- *(undefined4 *)(lVar5 + 0x14) = 0x80000004;
- *(undefined4 *)(lVar5 + 0x28) = 0x30;
- iVar3 = FltAddOpenReparseEntry(Globals,param_1,lVar5);
+ *(undefined8 *)(lVar6 + 0x2c) = 0;
+ *(undefined8 *)(lVar6 + 0x34) = 0;
+ *(undefined4 *)(lVar6 + 0x3c) = 0;
+ *(longlong *)(lVar6 + 8) = lVar6;
+ *(longlong *)lVar6 = lVar6;
+ *(undefined8 *)(lVar6 + 0x18) = 0;
+ *(undefined8 *)(lVar6 + 0x20) = 0;
+ *(undefined4 *)(lVar6 + 0x10) = 0x9000001c;
+ *(undefined4 *)(lVar6 + 0x14) = 0x80000004;
+ *(undefined4 *)(lVar6 + 0x28) = 0x30;
+ iVar3 = FltAddOpenReparseEntry(Globals,param_1,lVar6);
if (iVar3 < 0) {
- lVar8 = lVar7;
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- uVar9 = 0x1a;
- lVar6 = lVar7;
- goto LAB_1;
+ bVar12 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar5 = DAT_1 & 0x20;
+ if ((bVar5 != 0) || (bVar12)) {
+ uVar13 = 0x1b;
+ goto LAB_2;
}
}
else {
+ lVar8 = lVar9;
if ((*(uint *)(*(longlong *)(param_1 + 0x10) + 0x20) & 0x200000) == 0) {
-LAB_4:
+LAB_6:
+ lVar7 = 0;
uVar10 = 5;
- *(longlong *)(lVar5 + 0x30) = local_res10[0];
+ *(longlong *)(lVar6 + 0x30) = local_res10[0];
local_res10[0] = 0;
- *(longlong *)(lVar5 + 0x38) = lVar6;
- *param_3 = lVar5;
- lVar5 = lVar8;
- goto LAB_5;
+ *(longlong *)(lVar6 + 0x38) = lVar8;
+ *param_3 = lVar6;
+ lVar8 = lVar7;
+ goto LAB_7;
}
- lVar6 = ExAllocateFromPagedLookasideList(&DAT_6);
- if (lVar6 == 0) {
+ lVar8 = ExAllocateFromPagedLookasideList(&DAT_8);
+ if (lVar8 == 0) {
iVar3 = -0x3fffff66;
- lVar8 = lVar6;
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- uVar9 = 0x1b;
- goto LAB_1;
+ bVar12 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar5 = DAT_1 & 0x20;
+ if ((bVar5 != 0) || (bVar12)) {
+ uVar13 = 0x1c;
+ goto LAB_5;
}
}
else {
- *(longlong *)(lVar6 + 8) = lVar6;
- *(longlong *)lVar6 = lVar6;
- *(undefined8 *)(lVar6 + 0x18) = 0;
- *(undefined8 *)(lVar6 + 0x20) = 0;
- *(undefined4 *)(lVar6 + 0x10) = 0xa0000022;
- *(undefined4 *)(lVar6 + 0x14) = 0x8000007e;
- *(undefined4 *)(lVar6 + 0x28) = 0x30;
- iVar3 = FltAddOpenReparseEntry(Globals,param_1,lVar6);
- if (-1 < iVar3) goto LAB_4;
- lVar8 = lVar6;
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- uVar9 = 0x1c;
- goto LAB_1;
+ *(longlong *)(lVar8 + 8) = lVar8;
+ *(longlong *)lVar8 = lVar8;
+ *(undefined8 *)(lVar8 + 0x18) = 0;
+ *(undefined8 *)(lVar8 + 0x20) = 0;
+ *(undefined4 *)(lVar8 + 0x10) = 0xa0000022;
+ *(undefined4 *)(lVar8 + 0x14) = 0x8000007e;
+ *(undefined4 *)(lVar8 + 0x28) = 0x30;
+ iVar3 = FltAddOpenReparseEntry(Globals,param_1,lVar8);
+ if (-1 < iVar3) goto LAB_6;
+ bVar12 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar5 = DAT_1 & 0x20;
+ if ((bVar5 != 0) || (bVar12)) {
+ uVar13 = 0x1d;
+ goto LAB_2;
}
}
}
}
}
else {
iVar3 = PrjfFindOrCreateTransactionContext
(*(undefined8 *)(param_2 + 0x18),*(longlong *)(param_2 + 0x28),&local_res20);
lVar11 = local_res20;
if (iVar3 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,0x16,
- &WPP_0b474be437163e15bbc5d557e64edfd4_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\create.c");
+ lVar7 = lVar9;
+ if (((DAT_1 & 0x20) != 0) ||
+ (lVar8 = lVar9, (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x205,DAT_1 & 0x20,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,0x17,
+ &WPP_b8de0dfab5423d2f6ea3deba36b4500f_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\create.c");
+ lVar8 = lVar9;
lVar11 = local_res20;
}
}
else {
iVar4 = FltEnlistInTransaction
(*(undefined8 *)(param_2 + 0x18),*(undefined8 *)(param_2 + 0x28),local_res20
,0xc);
iVar3 = 0;
if (iVar4 != -0x3fe3ffe5) {
iVar3 = iVar4;
}
if (-1 < iVar3) goto LAB_0;
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_2;
- uVar9 = 0x17;
-LAB_1:
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,uVar9,
- &WPP_0b474be437163e15bbc5d557e64edfd4_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\create.c");
- lVar8 = lVar6;
+ bVar12 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar5 = DAT_1 & 0x20;
+ if ((bVar5 == 0) && (!bVar12)) goto LAB_3;
+ uVar13 = 0x18;
+ lVar6 = lVar9;
+ lVar8 = lVar9;
+LAB_2:
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x205,bVar5,bVar12,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,uVar13,
+ &WPP_b8de0dfab5423d2f6ea3deba36b4500f_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\create.c");
+ lVar7 = lVar6;
}
}
-LAB_2:
+LAB_3:
*(int *)(param_1 + 0x18) = iVar3;
*(undefined8 *)(param_1 + 0x20) = 0;
-LAB_5:
+LAB_7:
if (lVar11 != 0) {
FltReleaseContext(lVar11);
}
if (local_res10[0] != 0) {
FltReleaseFileNameInformation();
}
if (lVar8 != 0) {
- ExFreeToPagedLookasideList(&DAT_6,lVar8);
+ ExFreeToPagedLookasideList(&DAT_8,lVar8);
}
- if (lVar5 != 0) {
- ExFreeToPagedLookasideList(&DAT_3,lVar5);
+ if (lVar7 != 0) {
+ ExFreeToPagedLookasideList(&DAT_4,lVar7);
}
return uVar10;
}
```
## PrjfProcessTombstoneBounce
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,sig,address,called|
|ratio|0.39|
|i_ratio|0.22|
|m_ratio|0.94|
|b_ratio|0.37|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfProcessTombstoneBounce|PrjfProcessTombstoneBounce|
|fullname|PrjfProcessTombstoneBounce|PrjfProcessTombstoneBounce|
|refcount|2|2|
|`length`|2139|2474|
|`called`|Expand for full list:
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltParseFileNameInformation
FLTMGR.SYS::FltQueryInformationFile
FLTMGR.SYS::FltReissueSynchronousIo
FLTMGR.SYS::FltReleaseContext
FLTMGR.SYS::FltRemoveOpenReparseEntry
FLTMGR.SYS::FltSetCallbackDataDirty
FLTMGR.SYS::FltSetInformationFile
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExFreeToPagedLookasideList
NTOSKRNL.EXE::KeWaitForSingleObject
NTOSKRNL.EXE::ObfDereferenceObject
PrjfAddInMemoryTombstone
PrjfAllocateUnicodeString
PrjfConvertFullPathToRelative
PrjfCreateTombstone
PrjfGetSetFileContext
PrjfOpenAsReparsePoint
PrjfRemoveInMemoryTombstone
PrjfTelemetryTombstoneFailureOperation
WPP_RECORDER_SF_sD
WPP_RECORDER_SF_sDd
WPP_RECORDER_SF_sDdZ
WPP_RECORDER_SF_sDdsZ
__security_check_cookie
_tlgDefineProvider_annotation__Tlgmtakm_hTelemetryAssertDiagTrackProvExpand for full list:
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltParseFileNameInformation
FLTMGR.SYS::FltQueryInformationFile
FLTMGR.SYS::FltReissueSynchronousIo
FLTMGR.SYS::FltReleaseContext
FLTMGR.SYS::FltRemoveOpenReparseEntry
FLTMGR.SYS::FltSetCallbackDataDirty
FLTMGR.SYS::FltSetInformationFile
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExFreeToPagedLookasideList
NTOSKRNL.EXE::KeWaitForSingleObject
NTOSKRNL.EXE::ObfDereferenceObject
PrjfAddInMemoryTombstone
PrjfAllocateUnicodeString
PrjfConvertFullPathToRelative
PrjfCreateTombstone
PrjfGetSetFileContext
PrjfOpenAsReparsePoint
PrjfRemoveInMemoryTombstone
PrjfSleepOnTestSettingFlagsForTests
PrjfTelemetryTombstoneFailureOperation
WPP_RECORDER_AND_TRACE_SF_sD
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDdZ
WPP_RECORDER_AND_TRACE_SF_sDdsZ
__security_check_cookieExpand for full list:
FLTMGR.SYS::FltAcquireResourceShared
FLTMGR.SYS::FltReadFile
FLTMGR.SYS::FltReleaseResource
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::IoGetCurrentProcess
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::ObfReferenceObject
NTOSKRNL.EXE::RtlLookupElementGenericTableAvl
PrjfGetUnionContextByVirtualizationInstanceInfo
PrjfReleaseUnionContext
WPP_RECORDER_SF_sD
WPP_RECORDER_SF_sDd
WPP_RECORDER_SF_sDdD
__security_check_cookieExpand for full list:
FLTMGR.SYS::FltAcquireResourceShared
FLTMGR.SYS::FltReadFile
FLTMGR.SYS::FltReleaseResource
Feature_1083645240__private_IsEnabledDeviceUsageNoInline
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::IoGetCurrentProcess
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::ObfReferenceObject
NTOSKRNL.EXE::RtlLookupElementGenericTableAvl
PrjfGetUnionContextByVirtualizationInstanceInfo
PrjfReleaseUnionContext
PrjfValidateHandleAccess
WPP_RECORDER_AND_TRACE_SF_sD
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDdD
__security_check_cookie
PrjfPreSetLinkInformation
PrjfPreSetRenameInformation
_tlgDefineProvider_annotation__Tlgmtakm_hTelemetryAssertDiagTrackProv|PrjfPreSetDispositionInformation
PrjfPreSetLinkInformation
PrjfPreSetRenameInformation
PrjfSleepOnTestSettingFlagsForTests|
|calling|||
|paramcount|3|3|
|`address`|1c0021350|14002c750|
|`sig`|ulonglong __fastcall PrjfPreSetInformation(longlong param_1, longlong param_2, longlong * param_3)|undefined4 __fastcall PrjfPreSetInformation(longlong param_1, longlong param_2, longlong * param_3)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfPreSetInformation Called Diff
```diff
--- PrjfPreSetInformation called
+++ PrjfPreSetInformation called
@@ -4 +4 @@
-_tlgDefineProvider_annotation__Tlgmtakm_hTelemetryAssertDiagTrackProv
+PrjfSleepOnTestSettingFlagsForTests
```
### PrjfPreSetInformation Diff
```diff
--- PrjfPreSetInformation
+++ PrjfPreSetInformation
@@ -1,36 +1,36 @@
-ulonglong PrjfPreSetInformation(longlong param_1,longlong param_2,longlong *param_3)
+undefined4 PrjfPreSetInformation(longlong param_1,longlong param_2,longlong *param_3)
{
int iVar1;
- uint uVar2;
- ulonglong uVar4;
+ undefined4 uVar2;
+ undefined8 in_stack_ffffffffffffffe8;
undefined8 uVar3;
- uVar4 = 1;
+ uVar2 = 1;
iVar1 = *(int *)(*(longlong *)(param_1 + 0x10) + 0x20);
if (iVar1 == 10) {
LAB_0:
uVar3 = PrjfPreSetRenameInformation(param_1,param_2,param_3);
- uVar2 = (uint)uVar3;
+ uVar2 = (undefined4)uVar3;
}
else {
if (iVar1 != 0xb) {
if ((iVar1 == 0xd) || (iVar1 == 0x40)) {
uVar3 = PrjfPreSetDispositionInformation(param_1,param_2);
- uVar2 = (uint)uVar3;
+ uVar2 = (undefined4)uVar3;
goto LAB_1;
}
if (iVar1 == 0x41) goto LAB_0;
- if (iVar1 != 0x48) goto LAB_2;
+ if (iVar1 != 0x48) goto LAB_1;
}
uVar3 = PrjfPreSetLinkInformation(param_1,param_2,param_3);
- uVar2 = (uint)uVar3;
+ uVar2 = (undefined4)uVar3;
}
LAB_1:
- uVar4 = (ulonglong)uVar2;
-LAB_2:
- _tlgDefineProvider_annotation__Tlgmtakm_hTelemetryAssertDiagTrackProv();
- return uVar4 & 0xffffffff;
+ PrjfSleepOnTestSettingFlagsForTests
+ (0x80,(undefined8 *)0x0,param_1,*(undefined8 *)(param_2 + 0x18),
+ in_stack_ffffffffffffffe8);
+ return uVar2;
}
```
## PrjfFsctlSetReparsePoint
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.29|
|i_ratio|0.24|
|m_ratio|0.94|
|b_ratio|0.38|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfFsctlSetReparsePoint|PrjfFsctlSetReparsePoint|
|fullname|PrjfFsctlSetReparsePoint|PrjfFsctlSetReparsePoint|
|refcount|2|2|
|`length`|1796|2129|
|`called`|Expand for full list:
FLTMGR.SYS::FltReleaseContext
McTemplateK0dhzr1hzr3_EtwWriteTransfer
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::FsRtlValidateReparsePointBuffer
PrjfExpandAndWait
PrjfGetContextFileObject
PrjfIsNameOnPathOfRoot
WPP_RECORDER_SF_sDZ
WPP_RECORDER_SF_sDZDDD
WPP_RECORDER_SF_sDd
WPP_RECORDER_SF_sDdLZ
WPP_RECORDER_SF_sDdZ
WPP_RECORDER_SF_sDdZZExpand for full list:
FLTMGR.SYS::FltReleaseContext
McTemplateK0dhzr1hzr3_EtwWriteTransfer
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::FsRtlValidateReparsePointBuffer
PrjfExpandAndWait
PrjfGetContextFileObject
PrjfIsNameOnPathOfRoot
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDZ
WPP_RECORDER_AND_TRACE_SF_sDZDDD
WPP_RECORDER_AND_TRACE_SF_sDdLZ
WPP_RECORDER_AND_TRACE_SF_sDdZ
WPP_RECORDER_AND_TRACE_SF_sDdZZExpand for full list:
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltParseFileNameInformation
FLTMGR.SYS::FltReferenceFileNameInformation
FLTMGR.SYS::FltReleaseContext
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ObfDereferenceObject
PrjfAddInMemoryTombstone
PrjfDoesNameExistInLayer
PrjfGetContextFileObject
PrjfGetSetContextFileObject
PrjfOpenPlaceHolder
PrjfTelemetryTombstoneFailureOperation
WPP_RECORDER_SF_sDdExpand for full list:
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltParseFileNameInformation
FLTMGR.SYS::FltReferenceFileNameInformation
FLTMGR.SYS::FltReleaseContext
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ObfDereferenceObject
PrjfAddInMemoryTombstone
PrjfDoesNameExistInLayer
PrjfGetContextFileObject
PrjfGetSetContextFileObject
PrjfOpenPlaceHolder
PrjfTelemetryTombstoneFailureOperation
WPP_RECORDER_AND_TRACE_SF_sDD
NTOSKRNL.EXE::ExFreePoolWithTag
PrjfCreatePathTree
PrjfDeletePathTree
WPP_RECORDER_SF_sD
WPP_RECORDER_SF_sDd|NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
PrjfCreatePathTree
PrjfDeletePathTree
WPP_RECORDER_AND_TRACE_SF_sD
WPP_RECORDER_AND_TRACE_SF_sDD|
|calling|PrjfMappingInsert|PrjfMappingInsert|
|paramcount|2|2|
|`address`|1c0035348|140044d44|
|sig|ulonglong __fastcall PrjfCreateInstanceTierNode(undefined8 param_1, longlong * param_2)|ulonglong __fastcall PrjfCreateInstanceTierNode(undefined8 param_1, longlong * param_2)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfCreateInstanceTierNode Called Diff
```diff
--- PrjfCreateInstanceTierNode called
+++ PrjfCreateInstanceTierNode called
@@ -5,2 +5,2 @@
-WPP_RECORDER_SF_sD
-WPP_RECORDER_SF_sDd
+WPP_RECORDER_AND_TRACE_SF_sD
+WPP_RECORDER_AND_TRACE_SF_sDD
```
### PrjfCreateInstanceTierNode Diff
```diff
--- PrjfCreateInstanceTierNode
+++ PrjfCreateInstanceTierNode
@@ -1,43 +1,51 @@
ulonglong PrjfCreateInstanceTierNode(undefined8 param_1,longlong *param_2)
{
undefined8 *puVar1;
ulonglong uVar2;
ulonglong uVar3;
*param_2 = 0;
puVar1 = (undefined8 *)ExAllocatePool2(0x100,0x18,0x6d6e4a50);
if (puVar1 == (undefined8 *)0x0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sD(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x14,0x23,
- &WPP_5c05f7cae5513ff3734adbc0d3bd9537_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\mapping.c");
+ if (((DAT_0 & 0x10) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sD
+ (0x214,DAT_0 & 0x10,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x14,0x23,
+ &WPP_0314efc3b1f93d76a134ccc0e69e0e16_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\mapping.c");
}
uVar3 = 0xc000009a;
}
else {
puVar1[2] = 0;
puVar1[1] = 0;
*puVar1 = param_1;
uVar2 = PrjfCreatePathTree(puVar1 + 1);
uVar3 = uVar2 & 0xffffffff;
if ((int)uVar2 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x14,0x24,
- &WPP_5c05f7cae5513ff3734adbc0d3bd9537_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\mapping.c");
+ if (((DAT_0 & 0x10) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x214,DAT_0 & 0x10,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x14,0x24,
+ &WPP_0314efc3b1f93d76a134ccc0e69e0e16_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\mapping.c");
}
if ((undefined8 *)puVar1[1] != (undefined8 *)0x0) {
PrjfDeletePathTree((undefined8 *)puVar1[1]);
}
ExFreePoolWithTag(puVar1,0x6d6e4a50);
}
else {
*param_2 = (longlong)puVar1;
uVar3 = 0;
}
}
return uVar3;
}
```
## PrjfScheduleExpansionWorkItem
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.93|
|i_ratio|0.56|
|m_ratio|0.94|
|b_ratio|0.9|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfScheduleExpansionWorkItem|PrjfScheduleExpansionWorkItem|
|fullname|PrjfScheduleExpansionWorkItem|PrjfScheduleExpansionWorkItem|
|refcount|3|3|
|`length`|351|380|
|`called`|FLTMGR.SYS::FltAllocateGenericWorkItem
FLTMGR.SYS::FltFreeGenericWorkItem
FLTMGR.SYS::FltQueueGenericWorkItem
NTOSKRNL.EXE::KeClearEvent
NTOSKRNL.EXE::KeWaitForSingleObject
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::ObfReferenceObject|FLTMGR.SYS::FltAllocateGenericWorkItem
FLTMGR.SYS::FltFreeGenericWorkItem
FLTMGR.SYS::FltQueueGenericWorkItem
Feature_2428439865__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::KeClearEvent
NTOSKRNL.EXE::KeWaitForSingleObject
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::ObfReferenceObject|
|calling|PrjfExpansionCsqInsertIo
PrjfLaunchExpansion|PrjfExpansionCsqInsertIo
PrjfLaunchExpansion|
|paramcount|4|4|
|`address`|1c002091c|14002bb54|
|sig|ulonglong __fastcall PrjfScheduleExpansionWorkItem(undefined8 param_1, undefined8 param_2, longlong param_3, longlong param_4)|ulonglong __fastcall PrjfScheduleExpansionWorkItem(undefined8 param_1, undefined8 param_2, longlong param_3, longlong param_4)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfScheduleExpansionWorkItem Called Diff
```diff
--- PrjfScheduleExpansionWorkItem called
+++ PrjfScheduleExpansionWorkItem called
@@ -3,0 +4 @@
+Feature_2428439865__private_IsEnabledDeviceUsageNoInline
```
### PrjfScheduleExpansionWorkItem Diff
```diff
--- PrjfScheduleExpansionWorkItem
+++ PrjfScheduleExpansionWorkItem
@@ -1,74 +1,82 @@
ulonglong PrjfScheduleExpansionWorkItem
(undefined8 param_1,undefined8 param_2,longlong param_3,longlong param_4)
{
longlong *plVar1;
int *piVar2;
longlong *plVar3;
int iVar4;
longlong *plVar5;
longlong *plVar6;
undefined8 *puVar7;
code *pcVar8;
uint uVar9;
longlong lVar10;
ulonglong uVar11;
+ ulonglong uVar12;
+ bool bVar13;
uVar11 = 0;
plVar3 = (longlong *)(param_3 + 200);
+ bVar13 = false;
plVar5 = (longlong *)*plVar3;
if (param_4 != 0) {
plVar6 = *(longlong **)(param_3 + 0xd0);
plVar1 = (longlong *)(param_4 + 0x30);
if ((longlong *)*plVar6 != plVar3) goto LAB_0;
*plVar1 = (longlong)plVar3;
*(longlong **)(param_4 + 0x38) = plVar6;
*plVar6 = (longlong)plVar1;
*(longlong **)(param_3 + 0xd0) = plVar1;
}
if (plVar5 == plVar3) {
LOCK();
piVar2 = (int *)(param_3 + 0x40);
iVar4 = *piVar2;
*piVar2 = *piVar2 + 1;
UNLOCK();
if (iVar4 == 0) {
KeWaitForSingleObject(param_3 + 0x10,0,0,0,0);
KeClearEvent(param_3 + 0x10);
lVar10 = FltAllocateGenericWorkItem();
if (lVar10 == 0) {
uVar11 = 0xc000009a;
}
else {
ObfReferenceObject(param_2);
+ uVar11 = Feature_2428439865__private_IsEnabledDeviceUsageNoInline();
+ bVar13 = (int)uVar11 != 0;
uVar9 = FltQueueGenericWorkItem(lVar10,param_1,PrjfExpansionWorker,0,param_2);
uVar11 = (ulonglong)uVar9;
if (-1 < (int)uVar9) {
return uVar11;
}
FltFreeGenericWorkItem(lVar10);
}
if (param_4 != 0) {
puVar7 = *(undefined8 **)(param_3 + 0xd0);
if (((longlong *)*puVar7 != plVar3) ||
(plVar5 = (longlong *)puVar7[1], (undefined8 *)*plVar5 != puVar7)) {
LAB_0:
pcVar8 = (code *)swi(0x29);
(*pcVar8)(3);
pcVar8 = (code *)swi(3);
uVar11 = (*pcVar8)();
return uVar11;
}
*(longlong **)(param_3 + 0xd0) = plVar5;
*plVar5 = (longlong)plVar3;
}
LOCK();
*(int *)(param_3 + 0x40) = *(int *)(param_3 + 0x40) + -1;
UNLOCK();
- ObfDereferenceObject(param_2);
+ uVar12 = Feature_2428439865__private_IsEnabledDeviceUsageNoInline();
+ if (((int)uVar12 == 0) || (bVar13)) {
+ ObfDereferenceObject(param_2);
+ }
}
}
return uVar11;
}
```
## PrjfLaunchExpansion
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.22|
|i_ratio|0.3|
|m_ratio|0.94|
|b_ratio|0.7|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfLaunchExpansion|PrjfLaunchExpansion|
|fullname|PrjfLaunchExpansion|PrjfLaunchExpansion|
|refcount|3|3|
|`length`|1028|1209|
|`called`|Expand for full list:
FLTMGR.SYS::FltCancellableWaitForSingleObject
FLTMGR.SYS::FltCbdqInsertIo
FLTMGR.SYS::FltGetStreamContext
FLTMGR.SYS::FltReleaseContext
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExAcquireFastMutex
NTOSKRNL.EXE::ExFreeToNPagedLookasideList
NTOSKRNL.EXE::ExReleaseFastMutex
PrjfCreateExpansionContext
PrjfGetSetStreamHandleContext
PrjfGetUnionContext
PrjfIsZeroAllocatedRange
PrjfReleaseUnionContext
PrjfScheduleExpansionWorkItem
PrjfTelemetryPostDirectoryExpansionTrigger
WPP_RECORDER_SF_sDZLL
WPP_RECORDER_SF_sDdZExpand for full list:
FLTMGR.SYS::FltCancellableWaitForSingleObject
FLTMGR.SYS::FltCbdqInsertIo
FLTMGR.SYS::FltGetStreamContext
FLTMGR.SYS::FltReleaseContext
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExAcquireFastMutex
NTOSKRNL.EXE::ExFreeToNPagedLookasideList
NTOSKRNL.EXE::ExReleaseFastMutex
PrjfCreateExpansionContext
PrjfGetSetStreamHandleContext
PrjfGetUnionContext
PrjfIsZeroAllocatedRange
PrjfReleaseUnionContext
PrjfScheduleExpansionWorkItem
PrjfTelemetryPostDirectoryExpansionTrigger
WPP_RECORDER_AND_TRACE_SF_sDZLL
WPP_RECORDER_AND_TRACE_SF_sDdZ
PrjfExpandAndWait|PrjfExpandAndPend
PrjfExpandAndWait|
|paramcount|7|7|
|`address`|1c001ff5c|14002b07c|
|sig|int __fastcall PrjfLaunchExpansion(undefined8 param_1, longlong param_2, longlong param_3, uint param_4, uint * param_5, int param_6, int param_7)|int __fastcall PrjfLaunchExpansion(undefined8 param_1, longlong param_2, longlong param_3, uint param_4, uint * param_5, int param_6, int param_7)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfLaunchExpansion Called Diff
```diff
--- PrjfLaunchExpansion called
+++ PrjfLaunchExpansion called
@@ -16,2 +16,2 @@
-WPP_RECORDER_SF_sDZLL
-WPP_RECORDER_SF_sDdZ
+WPP_RECORDER_AND_TRACE_SF_sDZLL
+WPP_RECORDER_AND_TRACE_SF_sDdZ
```
### PrjfLaunchExpansion Diff
```diff
--- PrjfLaunchExpansion
+++ PrjfLaunchExpansion
@@ -1,162 +1,189 @@
int PrjfLaunchExpansion(undefined8 param_1,longlong param_2,longlong param_3,uint param_4,
uint *param_5,int param_6,int param_7)
{
int *piVar1;
- char cVar2;
- int iVar3;
- longlong *plVar4;
- longlong lVar5;
- ulonglong uVar6;
- byte bVar7;
- int iVar8;
- undefined2 uVar9;
- bool bVar10;
+ longlong lVar2;
+ char cVar3;
+ int iVar4;
+ longlong *plVar5;
+ longlong lVar6;
+ ulonglong uVar7;
+ undefined2 uVar8;
+ byte bVar9;
+ int iVar10;
+ byte bVar11;
+ bool bVar12;
byte local_res18;
- undefined4 uVar11;
- undefined4 in_stack_ffffffffffffff6c;
- undefined8 in_stack_ffffffffffffff70;
- undefined8 uVar12;
- ulonglong local_78;
- longlong lStack_70;
- int *local_68;
- longlong local_60 [3];
- longlong local_48;
- undefined8 uStack_40;
+ undefined1 uVar13;
+ ushort uVar14;
+ undefined4 uVar15;
+ undefined4 in_stack_ffffffffffffff74;
+ undefined8 in_stack_ffffffffffffff78;
+ undefined8 uVar16;
+ ulonglong local_68;
+ longlong lStack_60;
+ int *local_58;
+ longlong *local_50;
+ longlong local_48 [2];
+ longlong local_38;
+ undefined8 uStack_30;
- uVar11 = (undefined4)((ulonglong)in_stack_ffffffffffffff70 >> 0x20);
- plVar4 = (longlong *)0x0;
- iVar8 = 0;
- local_68 = (int *)0x0;
- local_60[0] = 0;
+ uVar15 = (undefined4)((ulonglong)in_stack_ffffffffffffff78 >> 0x20);
+ local_50 = (longlong *)0x0;
+ iVar10 = 0;
+ local_58 = (int *)0x0;
+ local_48[0] = 0;
+ bVar11 = 0;
local_res18 = 0;
if (*(longlong *)(param_3 + 0x58) == 0) {
- local_48 = *(longlong *)(param_3 + 0x60);
- uStack_40 = *(undefined8 *)(param_3 + 0x68);
- local_78 = 0;
- plVar4 = PrjfGetUnionContext(param_1,&local_48);
- if (plVar4 != (longlong *)0x0) {
- cVar2 = PrjfIsZeroAllocatedRange(param_1,param_2);
- iVar3 = PrjfCreateExpansionContext(param_1,(longlong)plVar4,param_3,param_4,cVar2,&local_78);
- if (((iVar3 < 0) || (iVar3 = FltGetStreamContext(param_1,param_2,&local_68), iVar3 < 0)) ||
- (iVar3 = PrjfGetSetStreamHandleContext(param_1,param_2,param_3,local_68,'\0',local_60),
- uVar6 = local_78, iVar3 < 0)) goto LAB_0;
+ local_38 = *(longlong *)(param_3 + 0x60);
+ uStack_30 = *(undefined8 *)(param_3 + 0x68);
+ local_68 = 0;
+ plVar5 = PrjfGetUnionContext(param_1,&local_38);
+ local_50 = plVar5;
+ if (plVar5 != (longlong *)0x0) {
+ cVar3 = PrjfIsZeroAllocatedRange(param_1,param_2);
+ iVar4 = PrjfCreateExpansionContext(param_1,(longlong)plVar5,param_3,param_4,cVar3,&local_68);
+ if (((iVar4 < 0) || (iVar4 = FltGetStreamContext(param_1,param_2,&local_58), iVar4 < 0)) ||
+ (iVar4 = PrjfGetSetStreamHandleContext(param_1,param_2,param_3,local_58,'\0',local_48),
+ uVar7 = local_68, iVar4 < 0)) goto LAB_0;
LOCK();
- bVar10 = *(ulonglong *)(param_3 + 0x58) == 0;
- if (bVar10) {
- *(ulonglong *)(param_3 + 0x58) = local_78;
+ bVar12 = *(ulonglong *)(param_3 + 0x58) == 0;
+ if (bVar12) {
+ *(ulonglong *)(param_3 + 0x58) = local_68;
}
UNLOCK();
- if (!bVar10) {
- if (*(longlong **)(local_78 + 200) != (longlong *)(local_78 + 200)) {
+ if (!bVar12) {
+ if (*(longlong **)(local_68 + 200) != (longlong *)(local_68 + 200)) {
MicrosoftTelemetryAssertTriggeredNoArgsKM();
}
- ExFreeToNPagedLookasideList(&DAT_1,uVar6);
+ ExFreeToNPagedLookasideList(&DAT_1,uVar7);
}
goto LAB_2;
}
- iVar3 = -0x3fff31fc;
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0;
- bVar7 = 2;
- uVar9 = 0x1b;
- uVar12 = CONCAT44(uVar11,0xc000ce04);
- uVar11 = 0x6f3;
- iVar3 = -0x3fff31fc;
-LAB_3:
- WPP_RECORDER_SF_sDdZ
- (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),bVar7,10,uVar9,
- &WPP_286736bb6a73387d41449b09eaab690a_Traceguids,
+ iVar4 = -0x3fff31fc;
+ bVar12 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar9 = DAT_3 & 4;
+ if ((bVar9 == 0) && (!bVar12)) goto LAB_0;
+ uVar8 = 0x20a;
+ uVar16 = CONCAT44(uVar15,0xc000ce04);
+ uVar15 = 0x73b;
+ uVar14 = 0x1c;
+ uVar13 = 2;
+LAB_4:
+ WPP_RECORDER_AND_TRACE_SF_sDdZ
+ (uVar8,bVar9,bVar12,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),uVar13,10,uVar14,
+ &WPP_8662402235063b115c167dc7c0c22e28_Traceguids,
"onecore\\base\\fs\\gvflt\\filter\\sys\\expansion.c",
- CONCAT44(in_stack_ffffffffffffff6c,uVar11),uVar12,(wchar_t *)(param_2 + 0x58));
- uVar11 = (undefined4)((ulonglong)uVar12 >> 0x20);
- goto LAB_0;
- }
-LAB_2:
- LOCK();
- piVar1 = (int *)(*(longlong *)(param_3 + 0x58) + 0x44);
- *piVar1 = *piVar1 + 1;
- UNLOCK();
- *(int *)(*(longlong *)(param_3 + 0x58) + 300) = param_7;
- if (*(int *)(*(longlong *)(param_3 + 0x58) + 4) < (int)param_4) {
- *(uint *)(*(longlong *)(param_3 + 0x58) + 4) = param_4;
- iVar3 = FltCancellableWaitForSingleObject(*(longlong *)(param_3 + 0x58) + 0x10,0,param_5);
- if (iVar3 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0;
- uVar9 = 0x1c;
- bVar7 = 3;
- uVar12 = CONCAT44(uVar11,iVar3);
- uVar11 = 0x76b;
- goto LAB_3;
- }
- }
- if (param_7 == 0x13) {
- **(uint **)(param_3 + 0x58) = **(uint **)(param_3 + 0x58) | 2;
- }
- if (param_5 == (uint *)0x0) {
- ExAcquireFastMutex(*(longlong *)(param_3 + 0x58) + 0xd8);
- uVar6 = PrjfScheduleExpansionWorkItem(param_1,param_2,*(longlong *)(param_3 + 0x58),0);
- iVar3 = (int)uVar6;
- ExReleaseFastMutex(*(longlong *)(param_3 + 0x58) + 0xd8);
- lVar5 = *(longlong *)(param_3 + 0x58);
- if (iVar3 < 0) goto LAB_4;
+ CONCAT44(in_stack_ffffffffffffff74,uVar15),uVar16,(wchar_t *)(param_2 + 0x58));
+ uVar15 = (undefined4)((ulonglong)uVar16 >> 0x20);
}
else {
- if ((*param_5 & 1) == 0) {
- MicrosoftTelemetryAssertTriggeredNoArgsKM();
+LAB_2:
+ LOCK();
+ piVar1 = (int *)(*(longlong *)(param_3 + 0x58) + 0x44);
+ *piVar1 = *piVar1 + 1;
+ UNLOCK();
+ *(int *)(*(longlong *)(param_3 + 0x58) + 300) = param_7;
+ if (*(int *)(*(longlong *)(param_3 + 0x58) + 4) < (int)param_4) {
+ *(uint *)(*(longlong *)(param_3 + 0x58) + 4) = param_4;
+ iVar4 = FltCancellableWaitForSingleObject(*(longlong *)(param_3 + 0x58) + 0x10,0,param_5);
+ if (iVar4 < 0) {
+ bVar12 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar9 = DAT_5 & 4;
+ if ((bVar9 == 0) && (!bVar12)) goto LAB_0;
+ uVar8 = 0x30a;
+ uVar16 = CONCAT44(uVar15,iVar4);
+ uVar15 = 0x7b3;
+ uVar14 = 0x1d;
+ uVar13 = 3;
+ goto LAB_4;
+ }
}
- iVar3 = FltCbdqInsertIo(*(longlong *)(param_3 + 0x58) + 0x48,param_5,0,param_2);
- lVar5 = *(longlong *)(param_3 + 0x58);
- if (iVar3 < 0) {
-LAB_4:
- LOCK();
- *(int *)(lVar5 + 0x44) = *(int *)(lVar5 + 0x44) + -1;
- UNLOCK();
- goto LAB_0;
+ if (param_7 == 0x13) {
+ **(uint **)(param_3 + 0x58) = **(uint **)(param_3 + 0x58) | 2;
}
- local_res18 = 1;
+ if (param_5 == (uint *)0x0) {
+ ExAcquireFastMutex(*(longlong *)(param_3 + 0x58) + 0xd8);
+ uVar7 = PrjfScheduleExpansionWorkItem(param_1,param_2,*(longlong *)(param_3 + 0x58),0);
+ iVar4 = (int)uVar7;
+ ExReleaseFastMutex(*(longlong *)(param_3 + 0x58) + 0xd8);
+ lVar6 = *(longlong *)(param_3 + 0x58);
+ if (-1 < iVar4) {
+ LOCK();
+ piVar1 = (int *)(lVar6 + 0x118);
+ iVar10 = *piVar1;
+ *piVar1 = *piVar1 + 1;
+ UNLOCK();
+ iVar10 = iVar10 + 1;
+ bVar11 = local_res18;
+ goto LAB_0;
+ }
+ }
+ else {
+ if ((*param_5 & 1) == 0) {
+ MicrosoftTelemetryAssertTriggeredNoArgsKM();
+ }
+ iVar4 = FltCbdqInsertIo(*(longlong *)(param_3 + 0x58) + 0x48,param_5,0,param_2);
+ lVar6 = *(longlong *)(param_3 + 0x58);
+ if (-1 < iVar4) {
+ LOCK();
+ piVar1 = (int *)(lVar6 + 0x118);
+ iVar10 = *piVar1;
+ *piVar1 = *piVar1 + 1;
+ UNLOCK();
+ iVar10 = iVar10 + 1;
+ bVar11 = 1;
+ goto LAB_0;
+ }
+ }
+ LOCK();
+ *(int *)(lVar6 + 0x44) = *(int *)(lVar6 + 0x44) + -1;
+ UNLOCK();
}
- LOCK();
- piVar1 = (int *)(lVar5 + 0x118);
- iVar8 = *piVar1;
- *piVar1 = *piVar1 + 1;
- UNLOCK();
- iVar8 = iVar8 + 1;
LAB_0:
- lVar5 = *(longlong *)(param_3 + 0x58);
- local_78 = 0;
- lStack_70 = 0;
- if (iVar3 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDdZ
- (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,10,0xc,
+ lVar6 = *(longlong *)(param_3 + 0x58);
+ local_68 = 0;
+ lStack_60 = 0;
+ if (iVar4 < 0) {
+ if (((DAT_3 & 4) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDdZ
+ (0x20a,DAT_3 & 4,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,10,0xc,
&WPP_cead7f9b79fe32a96920046e878d7ba9_Traceguids,
"onecore\\base\\fs\\gvflt\\filter\\sys\\telemetry.c",
- CONCAT44(in_stack_ffffffffffffff6c,0x110),CONCAT44(uVar11,iVar3),
+ CONCAT44(in_stack_ffffffffffffff74,0x110),CONCAT44(uVar15,iVar4),
(wchar_t *)(param_2 + 0x58));
}
}
else {
- lStack_70 = *(longlong *)(*(longlong *)(lVar5 + 0x110) + 0x48);
- uVar9 = *(undefined2 *)(lStack_70 + 0x120);
- local_78 = (ulonglong)CONCAT22(uVar9,uVar9);
- lStack_70 = lStack_70 + 0x122;
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDZLL(*(undefined8 *)(WPP_GLOBAL_Control + 0x40));
+ lVar2 = *(longlong *)(*(longlong *)(lVar6 + 0x110) + 0x48);
+ local_68 = (ulonglong)CONCAT22(*(undefined2 *)(lVar2 + 0x120),*(undefined2 *)(lVar2 + 0x120));
+ lStack_60 = lVar2 + 0x122;
+ if (((DAT_6 & 4) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDZLL
+ (lVar2,DAT_6 & 4,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40));
}
}
- if ((param_6 == 2) && (iVar8 < 2)) {
- PrjfTelemetryPostDirectoryExpansionTrigger(param_7,lVar5,iVar8,iVar3,local_res18);
+ if ((param_6 == 2) && (iVar10 < 2)) {
+ PrjfTelemetryPostDirectoryExpansionTrigger(param_7,lVar6,iVar10,iVar4,bVar11);
}
- if (plVar4 != (longlong *)0x0) {
- PrjfReleaseUnionContext((longlong)plVar4);
+ if (local_50 != (longlong *)0x0) {
+ PrjfReleaseUnionContext((longlong)local_50);
}
- if (local_68 != (int *)0x0) {
+ if (local_58 != (int *)0x0) {
FltReleaseContext();
}
- if (local_60[0] != 0) {
+ if (local_48[0] != 0) {
FltReleaseContext();
}
- return iVar3;
+ return iVar4;
}
```
## PrjfFsctlStartVirtualizationInstance
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.49|
|i_ratio|0.33|
|m_ratio|0.86|
|b_ratio|0.61|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfFsctlStartVirtualizationInstance|PrjfFsctlStartVirtualizationInstance|
|fullname|PrjfFsctlStartVirtualizationInstance|PrjfFsctlStartVirtualizationInstance|
|refcount|2|2|
|`length`|1503|2024|
|`called`|Expand for full list:
FLTMGR.SYS::FltGetFileNameInformation
FLTMGR.SYS::FltParseFileNameInformation
FLTMGR.SYS::FltReleaseFileNameInformation
McTemplateK0dhzr1hzr3_EtwWriteTransfer
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExFreePoolWithTag
PrjfDoesRootHaveShortNameComponent
PrjfGetPrjReparseData
PrjfIsNameOnPathOfRoot
PrjfSetUnionContext
WPP_RECORDER_SF_sDDd
WPP_RECORDER_SF_sDZ_guid_Dd
WPP_RECORDER_SF_sDd
WPP_RECORDER_SF_sDdD
WPP_RECORDER_SF_sDdZLZ
__security_check_cookieExpand for full list:
FLTMGR.SYS::FltGetFileNameInformation
FLTMGR.SYS::FltParseFileNameInformation
FLTMGR.SYS::FltReleaseFileNameInformation
McTemplateK0dhzr1hzr3_EtwWriteTransfer
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExFreePoolWithTag
PrjfDoesRootHaveShortNameComponent
PrjfGetPrjReparseData
PrjfIsNameOnPathOfRoot
PrjfSetUnionContext
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDDD
WPP_RECORDER_AND_TRACE_SF_sDZ_guid_Dd
WPP_RECORDER_AND_TRACE_SF_sDdD
WPP_RECORDER_AND_TRACE_SF_sDdZLZ
__security_check_cookie
FLTMGR.SYS::FltCompletePendedPreOperation
NTOSKRNL.EXE::KeSetEvent
WPP_RECORDER_SF_sDZ|FLTMGR.SYS::FltCompletePendedPostOperation
FLTMGR.SYS::FltCompletePendedPreOperation
NTOSKRNL.EXE::KeSetEvent
WPP_RECORDER_AND_TRACE_SF_sDZ|
|calling|||
|paramcount|2|2|
|`address`|1c001f430|14002a3f0|
|sig|undefined __fastcall PrjfExpansionCsqCompleteCanceledIo(longlong param_1, uint * param_2)|undefined __fastcall PrjfExpansionCsqCompleteCanceledIo(longlong param_1, uint * param_2)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfExpansionCsqCompleteCanceledIo Called Diff
```diff
--- PrjfExpansionCsqCompleteCanceledIo called
+++ PrjfExpansionCsqCompleteCanceledIo called
@@ -4 +4 @@
-WPP_RECORDER_SF_sDZ
+WPP_RECORDER_AND_TRACE_SF_sDZ
```
### PrjfExpansionCsqCompleteCanceledIo Diff
```diff
--- PrjfExpansionCsqCompleteCanceledIo
+++ PrjfExpansionCsqCompleteCanceledIo
@@ -1,35 +1,39 @@
void PrjfExpansionCsqCompleteCanceledIo(longlong param_1,uint *param_2)
{
int *piVar1;
int iVar2;
- undefined4 in_stack_ffffffffffffffec;
+ undefined4 in_stack_ffffffffffffffe4;
if ((*param_2 & 0x80000) == 0) {
param_2[8] = 0;
param_2[9] = 0;
param_2[6] = 0xc0000120;
FltCompletePendedPreOperation(param_2,4,0,param_2);
}
else {
FltCompletePendedPostOperation();
}
LOCK();
piVar1 = (int *)(param_1 + -4);
iVar2 = *piVar1;
*piVar1 = *piVar1 + -1;
UNLOCK();
if (iVar2 == 1) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDZ(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),3,10,10,
- &WPP_286736bb6a73387d41449b09eaab690a_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\expansion.c",
- CONCAT44(in_stack_ffffffffffffffec,0x1f1),
- (wchar_t *)(*(longlong *)(param_1 + 200) + 0x78));
+ if (((DAT_0 & 4) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDZ
+ (0x30a,DAT_0 & 4,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),3,10,10,
+ &WPP_8662402235063b115c167dc7c0c22e28_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\expansion.c",
+ CONCAT44(in_stack_ffffffffffffffe4,0x202),
+ (wchar_t *)(*(longlong *)(param_1 + 200) + 0x78));
}
KeSetEvent(param_1 + -0x20,0,0);
}
return;
}
```
## PrjfInitCommunicationPort
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.78|
|i_ratio|0.51|
|m_ratio|0.92|
|b_ratio|0.88|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfInitCommunicationPort|PrjfInitCommunicationPort|
|fullname|PrjfInitCommunicationPort|PrjfInitCommunicationPort|
|refcount|2|2|
|`length`|406|480|
|`called`|FLTMGR.SYS::FltCreateCommunicationPort
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::RtlInitUnicodeString
SeSddlSecurityDescriptorFromSDDL
WPP_RECORDER_SF_sDd|FLTMGR.SYS::FltCreateCommunicationPort
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::RtlInitUnicodeString
SeSddlSecurityDescriptorFromSDDL
WPP_RECORDER_AND_TRACE_SF_sDD|
|calling|DriverEntry|DriverEntry|
|paramcount|2|2|
|`address`|1c0008384|14000a8b4|
|sig|ulonglong __fastcall PrjfInitCommunicationPort(undefined8 param_1, undefined8 param_2)|ulonglong __fastcall PrjfInitCommunicationPort(undefined8 param_1, undefined8 param_2)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfInitCommunicationPort Called Diff
```diff
--- PrjfInitCommunicationPort called
+++ PrjfInitCommunicationPort called
@@ -5 +5 @@
-WPP_RECORDER_SF_sDd
+WPP_RECORDER_AND_TRACE_SF_sDD
```
### PrjfInitCommunicationPort Diff
```diff
--- PrjfInitCommunicationPort
+++ PrjfInitCommunicationPort
@@ -1,66 +1,73 @@
ulonglong PrjfInitCommunicationPort(undefined8 param_1,undefined8 param_2)
{
uint uVar1;
ulonglong uVar2;
ulonglong uVar3;
- undefined2 uVar4;
+ bool bVar4;
longlong local_res8;
+ ushort uVar5;
+ undefined8 in_stack_ffffffffffffff80;
+ undefined4 uVar6;
ushort local_58 [4];
wchar_t *local_50;
undefined8 local_48;
undefined8 uStack_40;
undefined8 local_38;
undefined8 uStack_30;
undefined8 *local_28;
undefined8 uStack_20;
longlong local_18;
ulonglong local_10;
+ uVar6 = (undefined4)((ulonglong)in_stack_ffffffffffffff80 >> 0x20);
local_res8 = 0;
local_50 = L"D:P(A;;0x001f0001;;;AU)";
local_58[0] = 0x2e;
local_58[1] = 0x30;
local_58[2] = 0;
local_58[3] = 0;
local_18 = 0;
local_10 = local_10 & 0xffffffff00000000;
local_48 = 0;
uStack_40 = 0;
local_38 = 0;
uStack_30 = 0;
local_28 = (undefined8 *)0x0;
uStack_20 = 0;
uVar2 = SeSddlSecurityDescriptorFromSDDL(local_58,param_2,&local_res8);
uVar3 = uVar2 & 0xffffffff;
if ((int)uVar2 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0;
- uVar4 = 0x21;
+ bVar4 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ if (((DAT_1 & 2) == 0) && (!bVar4)) goto LAB_14000aa66;
+ uVar5 = 0x21;
}
else {
RtlInitUnicodeString(&local_48,L"\\PrjFltPort");
local_28 = &local_48;
uStack_30 = 0;
local_10 = 0;
local_18 = local_res8;
local_38 = CONCAT44(local_38._4_4_,0x30);
uStack_20 = CONCAT44(uStack_20._4_4_,0x240);
uVar1 = FltCreateCommunicationPort
- (Globals,&DAT_1,&local_38,0,PrjfPortConnect,PrjfPortDisconnect,
- PrjfPortMessage,0x7fffffff);
+ (Globals,&DAT_2,&local_38,0,PrjfPortConnect,PrjfPortDisconnect,
+ PrjfPortMessage,CONCAT44(uVar6,0x7fffffff));
uVar3 = (ulonglong)uVar1;
- if ((-1 < (int)uVar1) || ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED))
- goto LAB_0;
- uVar4 = 0x22;
+ if (-1 < (int)uVar1) goto LAB_0;
+ bVar4 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ if (((DAT_1 & 2) == 0) && (!bVar4)) goto LAB_14000aa66;
+ uVar5 = 0x22;
}
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,1,uVar4,
- &WPP_3f8aed4e88f83f53ec58226552f2c258_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\prjflt.c");
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x201,DAT_1 & 2,bVar4,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,1,uVar5,
+ &WPP_3f8aed4e88f83f53ec58226552f2c258_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\prjflt.c");
LAB_0:
if (local_res8 != 0) {
ExFreePoolWithTag(local_res8,0);
}
return uVar3;
}
```
## PrjfValidateFilterFileIdentifierInputBuffer
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.86|
|i_ratio|0.46|
|m_ratio|0.95|
|b_ratio|0.91|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfValidateFilterFileIdentifierInputBuffer|PrjfValidateFilterFileIdentifierInputBuffer|
|fullname|PrjfValidateFilterFileIdentifierInputBuffer|PrjfValidateFilterFileIdentifierInputBuffer|
|refcount|2|2|
|`length`|278|316|
|`called`|FLTMGR.SYS::FltGetInstanceContext
FLTMGR.SYS::FltReleaseContext
NTOSKRNL.EXE::RtlCompareAltitudes
WPP_RECORDER_SF_sDd|FLTMGR.SYS::FltGetInstanceContext
FLTMGR.SYS::FltReleaseContext
NTOSKRNL.EXE::RtlCompareAltitudes
WPP_RECORDER_AND_TRACE_SF_sDD|
|calling|PrjfFsctlGetFilterFileIdentifier|PrjfFsctlGetFilterFileIdentifier|
|paramcount|4|4|
|`address`|1c0023908|14002f5a8|
|sig|int __fastcall PrjfValidateFilterFileIdentifierInputBuffer(longlong param_1, uint param_2, ushort * param_3, undefined1 * param_4)|int __fastcall PrjfValidateFilterFileIdentifierInputBuffer(longlong param_1, uint param_2, ushort * param_3, undefined1 * param_4)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfValidateFilterFileIdentifierInputBuffer Called Diff
```diff
--- PrjfValidateFilterFileIdentifierInputBuffer called
+++ PrjfValidateFilterFileIdentifierInputBuffer called
@@ -4 +4 @@
-WPP_RECORDER_SF_sDd
+WPP_RECORDER_AND_TRACE_SF_sDD
```
### PrjfValidateFilterFileIdentifierInputBuffer Diff
```diff
--- PrjfValidateFilterFileIdentifierInputBuffer
+++ PrjfValidateFilterFileIdentifierInputBuffer
@@ -1,44 +1,48 @@
int PrjfValidateFilterFileIdentifierInputBuffer
(longlong param_1,uint param_2,ushort *param_3,undefined1 *param_4)
{
ushort uVar1;
undefined8 uVar2;
int iVar3;
int iVar4;
longlong local_res8;
undefined8 local_18;
ushort *puStack_10;
uVar2 = *(undefined8 *)(param_1 + 0x18);
local_res8 = 0;
*param_4 = 0;
local_18 = 0;
puStack_10 = (ushort *)0x0;
iVar3 = FltGetInstanceContext(uVar2,&local_res8);
if (iVar3 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,7,0x28,
- &WPP_594c3e8dc88d3460d4d40c2e57e2d4a0_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\fsctrl.c");
+ if (((DAT_0 & 0x80) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x207,DAT_0 & 0x80,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,7,0x28,
+ &WPP_594c3e8dc88d3460d4d40c2e57e2d4a0_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\fsctrl.c");
}
}
else if ((param_2 < 4) || (uVar1 = *param_3, param_2 < uVar1 + 2)) {
iVar3 = -0x3ffffff3;
}
else {
puStack_10 = param_3 + 1;
local_18 = CONCAT62(CONCAT42(local_18._4_4_,uVar1),uVar1);
iVar4 = RtlCompareAltitudes(local_res8 + 8,&local_18);
if (iVar4 == 0) {
iVar3 = 0;
*param_4 = 1;
}
}
if (local_res8 != 0) {
FltReleaseContext();
}
return iVar3;
}
```
## PrjfPrepareEnumerationContexts
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,sig,address,called|
|ratio|0.43|
|i_ratio|0.38|
|m_ratio|0.96|
|b_ratio|0.87|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfPrepareEnumerationContexts|PrjfPrepareEnumerationContexts|
|fullname|PrjfPrepareEnumerationContexts|PrjfPrepareEnumerationContexts|
|refcount|3|3|
|`length`|681|743|
|`called`|MicrosoftTelemetryAssertTriggeredMsgKM
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExAllocateFromPagedLookasideList
NTOSKRNL.EXE::ExAllocatePool2
PrjfAddSubContext
WPP_RECORDER_SF_sDd
memset|MicrosoftTelemetryAssertTriggeredMsgKM
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExAllocateFromPagedLookasideList
NTOSKRNL.EXE::ExAllocatePool2
PrjfAddSubContext
WPP_RECORDER_AND_TRACE_SF_sDD
memset|
|calling|PrjfEnumerateDirectoryWithMerge|PrjfEnumerateDirectoryWithMerge|
|paramcount|8|8|
|`address`|1c001ddfc|140028a78|
|`sig`|int __fastcall PrjfPrepareEnumerationContexts(longlong * param_1, longlong param_2, longlong param_3, ulonglong param_4, undefined4 param_5, byte param_6, int param_7, longlong param_8)|ulonglong __fastcall PrjfPrepareEnumerationContexts(longlong * param_1, longlong param_2, longlong param_3, ulonglong param_4, undefined4 param_5, byte param_6, int param_7, longlong param_8)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfPrepareEnumerationContexts Called Diff
```diff
--- PrjfPrepareEnumerationContexts called
+++ PrjfPrepareEnumerationContexts called
@@ -6 +6 @@
-WPP_RECORDER_SF_sDd
+WPP_RECORDER_AND_TRACE_SF_sDD
```
### PrjfPrepareEnumerationContexts Diff
```diff
--- PrjfPrepareEnumerationContexts
+++ PrjfPrepareEnumerationContexts
@@ -1,87 +1,107 @@
-int PrjfPrepareEnumerationContexts
- (longlong *param_1,longlong param_2,longlong param_3,ulonglong param_4,
- undefined4 param_5,byte param_6,int param_7,longlong param_8)
+ulonglong PrjfPrepareEnumerationContexts
+ (longlong *param_1,longlong param_2,longlong param_3,ulonglong param_4,
+ undefined4 param_5,byte param_6,int param_7,longlong param_8)
{
- int iVar1;
+ ulonglong uVar1;
+ ulonglong uVar2;
void *_Dst;
- longlong *plVar2;
+ longlong *plVar3;
+ ulonglong uVar4;
size_t _Size;
- ulonglong uVar3;
- uint uVar4;
+ uint uVar5;
- iVar1 = 0;
- uVar3 = param_4;
+ uVar4 = 0;
+ uVar2 = param_4;
if ((param_8 != 0) && ((param_6 & 4) != 0)) {
MicrosoftTelemetryAssertTriggeredNoArgsKM();
}
- if ((((longlong *)*param_1 != param_1) ||
- ((iVar1 = PrjfAddSubContext((longlong)param_1,param_2,param_3,uVar3,0), -1 < iVar1 &&
- ((param_8 == 0 ||
- (iVar1 = PrjfAddSubContext((longlong)param_1,param_2,param_3,uVar3,param_8), -1 < iVar1)))))
- ) && (plVar2 = (longlong *)*param_1, plVar2 != param_1)) {
+ if ((longlong *)*param_1 == param_1) {
+ uVar1 = PrjfAddSubContext((longlong)param_1,param_2,param_3,uVar2,0);
+ uVar4 = uVar1 & 0xffffffff;
+ if ((int)uVar1 < 0) {
+ return uVar4;
+ }
+ if (param_8 != 0) {
+ uVar2 = PrjfAddSubContext((longlong)param_1,param_2,param_3,uVar2,param_8);
+ uVar4 = uVar2 & 0xffffffff;
+ if ((int)uVar2 < 0) {
+ return uVar4;
+ }
+ }
+ }
+ plVar3 = (longlong *)*param_1;
+ if (plVar3 != param_1) {
do {
- if ((*(int *)((longlong)plVar2 + 0x34) != 0) && (plVar2[9] == 0)) {
+ if ((*(int *)((longlong)plVar3 + 0x34) != 0) && (plVar3[9] == 0)) {
MicrosoftTelemetryAssertTriggeredNoArgsKM();
}
- if (((param_6 & 1) != 0) || (*(int *)((longlong)plVar2 + 0x34) == 0)) {
- _Dst = (void *)plVar2[8];
+ if (((param_6 & 1) != 0) || (*(int *)((longlong)plVar3 + 0x34) == 0)) {
+ _Dst = (void *)plVar3[8];
if (_Dst == (void *)0x0) {
- uVar4 = (uint)param_4;
- if (uVar4 == 0) {
+ uVar5 = (uint)param_4;
+ if (uVar5 == 0) {
MicrosoftTelemetryAssertTriggeredNoArgsKM();
LAB_0:
_Dst = (void *)ExAllocateFromPagedLookasideList(&DAT_1);
_Size = 0x27c;
LAB_2:
memset(_Dst,0,_Size);
}
else {
- if (uVar4 < 0x27d) goto LAB_0;
- if (uVar4 < 0x1015) {
+ if (uVar5 < 0x27d) goto LAB_0;
+ if (uVar5 < 0x1015) {
_Dst = (void *)ExAllocateFromPagedLookasideList(&DAT_3);
_Size = 0x1014;
goto LAB_2;
}
- if (uVar4 < 0x10015) {
+ if (uVar5 < 0x10015) {
_Dst = (void *)ExAllocateFromPagedLookasideList(&DAT_4);
_Size = 0x10014;
goto LAB_2;
}
MicrosoftTelemetryAssertTriggeredMsgKM();
_Dst = (void *)ExAllocatePool2(0x100,param_4 & 0xffffffff,0x6e654a50);
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x12,0x50,
- &WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
+ if (((DAT_5 & 4) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x212,DAT_5 & 4,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x12,0x52,
+ &WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
}
}
- plVar2[8] = (longlong)_Dst;
+ plVar3[8] = (longlong)_Dst;
if (_Dst == (void *)0x0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) {
- return -0x3fffff66;
+ if (((DAT_5 & 4) == 0) &&
+ ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) {
+ return 0xc000009a;
}
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x12,0x16,
- &WPP_e21b7c61aee93f730c9c252e6e8da2f4_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\dir.c");
- return -0x3fffff66;
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x212,DAT_5 & 4,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x12,0x16,
+ &WPP_3d19aee1b05838720427e757513a9608_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\dir.c");
+ return 0xc000009a;
}
- *(uint *)(plVar2 + 7) = uVar4;
+ *(uint *)(plVar3 + 7) = uVar5;
}
- memset(_Dst,0,(ulonglong)*(uint *)(plVar2 + 7));
- *(undefined4 *)((longlong)plVar2 + 0x34) = 0;
- *(undefined4 *)(plVar2 + 6) = 0;
- *(undefined4 *)((longlong)plVar2 + 0x14) = 0;
- *(undefined4 *)((longlong)plVar2 + 0x2c) = param_5;
- *(byte *)(plVar2 + 5) = param_6;
- if (((plVar2[9] == 0) && ((param_6 & 1) == 0)) && (param_7 != 0)) {
- *(byte *)(plVar2 + 5) = param_6 | 4;
+ memset(_Dst,0,(ulonglong)*(uint *)(plVar3 + 7));
+ *(undefined4 *)((longlong)plVar3 + 0x34) = 0;
+ *(undefined4 *)(plVar3 + 6) = 0;
+ *(undefined4 *)((longlong)plVar3 + 0x14) = 0;
+ *(undefined4 *)((longlong)plVar3 + 0x2c) = param_5;
+ *(byte *)(plVar3 + 5) = param_6;
+ if (((plVar3[9] == 0) && ((param_6 & 1) == 0)) && (param_7 != 0)) {
+ *(byte *)(plVar3 + 5) = param_6 | 4;
}
}
- plVar2 = (longlong *)*plVar2;
- } while (plVar2 != param_1);
+ plVar3 = (longlong *)*plVar3;
+ } while (plVar3 != param_1);
}
- return iVar1;
+ return uVar4;
}
```
## PrjfReopenFile
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.75|
|i_ratio|0.76|
|m_ratio|0.98|
|b_ratio|0.98|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfReopenFile|PrjfReopenFile|
|fullname|PrjfReopenFile|PrjfReopenFile|
|refcount|4|4|
|`length`|817|850|
|`called`|Expand for full list:
FLTMGR.SYS::FltCreateFileEx2
FLTMGR.SYS::FltGetVolumeFromInstance
FLTMGR.SYS::FltGetVolumeName
FLTMGR.SYS::FltObjectDereference
FLTMGR.SYS::FltQueryInformationFile
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::PsGetHostSilo
NTOSKRNL.EXE::RtlAppendUnicodeStringToString
NTOSKRNL.EXE::RtlAppendUnicodeToString
NTOSKRNL.EXE::RtlInitUnicodeString
PrjfAllocateUnicodeString
WPP_RECORDER_SF_sDdZZExpand for full list:
FLTMGR.SYS::FltCreateFileEx2
FLTMGR.SYS::FltGetVolumeFromInstance
FLTMGR.SYS::FltGetVolumeName
FLTMGR.SYS::FltObjectDereference
FLTMGR.SYS::FltQueryInformationFile
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::PsGetHostSilo
NTOSKRNL.EXE::RtlAppendUnicodeStringToString
NTOSKRNL.EXE::RtlAppendUnicodeToString
NTOSKRNL.EXE::RtlInitUnicodeString
PrjfAllocateUnicodeString
WPP_RECORDER_AND_TRACE_SF_sDdZZ
PrjfPopulateDestinationForRenameOrLink
PrjfRemoveTombstonesFromDirectory|PrjfFlushAndUpdateDiskStateWorker
PrjfPopulateDestinationForRenameOrLink
PrjfRemoveTombstonesFromDirectory|
|paramcount|5|5|
|`address`|1c002f654|14003dcb0|
|sig|ulonglong __fastcall PrjfReopenFile(undefined8 param_1, longlong param_2, undefined4 param_3, undefined8 param_4, undefined8 param_5)|ulonglong __fastcall PrjfReopenFile(undefined8 param_1, longlong param_2, undefined4 param_3, undefined8 param_4, undefined8 param_5)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfReopenFile Called Diff
```diff
--- PrjfReopenFile called
+++ PrjfReopenFile called
@@ -12 +12 @@
-WPP_RECORDER_SF_sDdZZ
+WPP_RECORDER_AND_TRACE_SF_sDdZZ
```
### PrjfReopenFile Diff
```diff
--- PrjfReopenFile
+++ PrjfReopenFile
@@ -1,140 +1,138 @@
ulonglong PrjfReopenFile(undefined8 param_1,longlong param_2,undefined4 param_3,undefined8 param_4,
undefined8 param_5)
{
uint uVar1;
ulonglong uVar2;
ulonglong uVar3;
- undefined8 in_stack_fffffffffffffed8;
- undefined4 uVar5;
- undefined8 uVar4;
- undefined8 *puVar6;
- undefined4 uVar7;
ulonglong in_stack_fffffffffffffef8;
- undefined8 in_stack_ffffffffffffff00;
- undefined4 uVar8;
+ undefined4 in_stack_ffffffffffffff04;
+ undefined4 in_stack_ffffffffffffff0c;
+ undefined8 in_stack_ffffffffffffff10;
+ undefined4 uVar4;
undefined4 local_c8 [2];
- char local_c0 [2];
- ushort uStack_be;
- undefined4 uStack_bc;
+ wchar_t local_c0 [4];
longlong lStack_b8;
longlong local_b0;
undefined4 local_a8 [2];
undefined8 local_a0;
undefined8 local_98;
undefined8 *puStack_90;
undefined8 local_88;
undefined8 uStack_80;
undefined8 local_78;
undefined8 uStack_70;
ulonglong local_68;
undefined8 local_60;
undefined8 uStack_58;
- char *local_50;
+ wchar_t *local_50;
undefined8 uStack_48;
undefined8 local_40;
ulonglong uStack_38;
undefined8 local_30;
undefined8 uStack_28;
- uVar8 = (undefined4)((ulonglong)in_stack_ffffffffffffff00 >> 0x20);
- uVar5 = (undefined4)((ulonglong)in_stack_fffffffffffffed8 >> 0x20);
+ uVar4 = (undefined4)((ulonglong)in_stack_ffffffffffffff10 >> 0x20);
local_a0 = 0;
local_a8[0] = 0;
local_b0 = 0;
local_c8[0] = 0;
local_40 = 0;
uStack_38 = uStack_38 & 0xffffffff00000000;
local_68 = local_68 & 0xffffffffffff0000;
- _local_c0 = 0;
+ local_c0[0] = L'\0';
+ local_c0[1] = L'\0';
+ local_c0[2] = L'\0';
+ local_c0[3] = L'\0';
lStack_b8 = 0;
local_98 = 0;
puStack_90 = (undefined8 *)0x0;
local_30 = 0;
uStack_28 = 0;
local_60 = 0;
uStack_58 = 0;
- local_50 = (char *)0x0;
+ local_50 = (wchar_t *)0x0;
uStack_48 = 0;
local_88 = 0;
uStack_80 = 0;
local_78 = 0;
uStack_70 = 0;
RtlInitUnicodeString(local_c0,0);
- uVar4 = CONCAT44(uVar5,6);
- uVar1 = FltQueryInformationFile(param_1,param_2,&local_a0,8,uVar4,local_a8);
- uVar5 = (undefined4)((ulonglong)uVar4 >> 0x20);
+ uVar1 = FltQueryInformationFile(param_1,param_2,&local_a0,8,6,local_a8);
uVar3 = (ulonglong)uVar1;
if (-1 < (int)uVar1) {
uVar1 = FltGetVolumeFromInstance(param_1,&local_b0);
uVar3 = (ulonglong)uVar1;
if (-1 < (int)uVar1) {
uVar1 = FltGetVolumeName(local_b0,0,local_c8);
uVar3 = (ulonglong)uVar1;
if (((uVar1 + 0x80000000 & 0x80000000) != 0) || (uVar1 == 0xc0000023)) {
if ((ushort)((ushort)local_c8[0] + 10) < (ushort)local_c8[0]) {
uVar3 = 0xc0000095;
- _local_c0 = CONCAT22(0xffff,local_c0);
+ local_c0[1] = 0xffff;
}
else {
- _local_c0 = CONCAT22((ushort)local_c8[0] + 10,local_c0);
- uVar2 = PrjfAllocateUnicodeString(0x6e664a50,(undefined2 *)local_c0);
+ local_c0[1] = (ushort)local_c8[0] + 10;
+ uVar2 = PrjfAllocateUnicodeString(0x6e664a50,local_c0);
uVar3 = uVar2 & 0xffffffff;
if (-1 < (int)uVar2) {
uVar1 = FltGetVolumeName(local_b0,local_c0,local_c8);
uVar3 = (ulonglong)uVar1;
if (-1 < (int)uVar1) {
uVar1 = RtlAppendUnicodeToString(local_c0,L"\\");
uVar3 = (ulonglong)uVar1;
if (-1 < (int)uVar1) {
puStack_90 = &local_a0;
local_98 = CONCAT44(local_98._4_4_,0x80008);
uVar1 = RtlAppendUnicodeStringToString(local_c0,&local_98);
uVar3 = (ulonglong)uVar1;
if (-1 < (int)uVar1) {
local_68 = 0;
uStack_80 = 0;
local_88 = 0x28;
local_78 = 0;
uStack_70 = 0;
local_68 = PsGetHostSilo();
uStack_58 = 0;
local_50 = local_c0;
- puVar6 = &local_30;
- uVar7 = 0;
local_60 = CONCAT44(local_60._4_4_,0x30);
uStack_48 = CONCAT44(uStack_48._4_4_,0x200);
local_40 = 0;
uStack_38 = 0;
- uVar1 = FltCreateFileEx2(Globals,param_1,param_4,param_5,CONCAT44(uVar5,param_3),
- &local_60,puVar6,0,
- in_stack_fffffffffffffef8 & 0xffffffff00000000,
- CONCAT44(uVar8,7),1,0x202028,0,0,0x800,&local_88);
+ uVar1 = FltCreateFileEx2(Globals,param_1,param_4,param_5,param_3,&local_60,
+ &local_30,0,
+ in_stack_fffffffffffffef8 & 0xffffffff00000000,7,1,
+ CONCAT44(uVar4,0x202028),0,0,0x800,&local_88);
uVar3 = (ulonglong)uVar1;
- if (((int)uVar1 < 0) &&
- ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
- WPP_RECORDER_SF_sDdZZ
- (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,10,0x99,
- &WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",
- CONCAT44((int)((ulonglong)puVar6 >> 0x20),0x186b),
- CONCAT44(uVar7,uVar1),(wchar_t *)(param_2 + 0x58),local_c0);
+ if ((int)uVar1 < 0) {
+ if (((DAT_0 & 4) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDdZZ
+ (0x20a,DAT_0 & 4,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED
+ ,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,10,0x9b,
+ &WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",
+ CONCAT44(in_stack_ffffffffffffff04,0x18a2),
+ CONCAT44(in_stack_ffffffffffffff0c,uVar1),
+ (wchar_t *)(param_2 + 0x58),local_c0);
+ }
}
}
}
}
}
}
}
}
}
if (local_b0 != 0) {
FltObjectDereference();
}
if (lStack_b8 != 0) {
ExFreePoolWithTag(lStack_b8,0x6e664a50);
}
return uVar3;
}
```
## PrjfRevertInMemoryTombstonesForDirectory
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.64|
|i_ratio|0.37|
|m_ratio|0.97|
|b_ratio|0.61|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfRevertInMemoryTombstonesForDirectory|PrjfRevertInMemoryTombstonesForDirectory|
|fullname|PrjfRevertInMemoryTombstonesForDirectory|PrjfRevertInMemoryTombstonesForDirectory|
|refcount|6|6|
|`length`|1283|1375|
|`called`|Expand for full list:
FLTMGR.SYS::FltAcquireResourceExclusive
FLTMGR.SYS::FltGetFileNameInformationUnsafe
FLTMGR.SYS::FltParseFileNameInformation
FLTMGR.SYS::FltQueryInformationFile
FLTMGR.SYS::FltReferenceContext
FLTMGR.SYS::FltReleaseContext
FLTMGR.SYS::FltReleaseFileNameInformation
FLTMGR.SYS::FltReleaseResource
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::KeWaitForSingleObject
NTOSKRNL.EXE::RtlAppendUnicodeStringToString
NTOSKRNL.EXE::RtlAppendUnicodeToString
NTOSKRNL.EXE::RtlEndEnumerationHashTable
NTOSKRNL.EXE::RtlEnumerateEntryHashTable
NTOSKRNL.EXE::RtlGetNextEntryHashTable
NTOSKRNL.EXE::RtlInitEnumerationHashTable
NTOSKRNL.EXE::RtlLookupEntryHashTable
NTOSKRNL.EXE::RtlRemoveEntryHashTable
PrjfAllocateUnicodeString
PrjfCreateTombstone
PrjfGetContextFileObject
PrjfTelemetryTombstoneFailureOperation
WPP_RECORDER_SF_sDd
__security_check_cookieExpand for full list:
FLTMGR.SYS::FltAcquireResourceExclusive
FLTMGR.SYS::FltGetFileNameInformationUnsafe
FLTMGR.SYS::FltParseFileNameInformation
FLTMGR.SYS::FltQueryInformationFile
FLTMGR.SYS::FltReferenceContext
FLTMGR.SYS::FltReleaseContext
FLTMGR.SYS::FltReleaseFileNameInformation
FLTMGR.SYS::FltReleaseResource
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::KeWaitForSingleObject
NTOSKRNL.EXE::RtlAppendUnicodeStringToString
NTOSKRNL.EXE::RtlAppendUnicodeToString
NTOSKRNL.EXE::RtlEndEnumerationHashTable
NTOSKRNL.EXE::RtlEnumerateEntryHashTable
NTOSKRNL.EXE::RtlGetNextEntryHashTable
NTOSKRNL.EXE::RtlInitEnumerationHashTable
NTOSKRNL.EXE::RtlLookupEntryHashTable
NTOSKRNL.EXE::RtlRemoveEntryHashTable
PrjfAllocateUnicodeString
PrjfCreateTombstone
PrjfGetContextFileObject
PrjfTelemetryTombstoneFailureOperation
WPP_RECORDER_AND_TRACE_SF_sDD
__security_check_cookie
PrjfPostSetDispositionInformation
PrjfPreCleanup
PrjfPreSetDispositionInformation
PrjfSetDeleteDisposition|PrjfPostCleanup
PrjfPostSetDispositionInformation
PrjfPreCleanup
PrjfPreSetDispositionInformation
PrjfSetDeleteDisposition|
|paramcount|2|2|
|`address`|1c0034dac|14004474c|
|sig|ulonglong __fastcall PrjfRevertInMemoryTombstonesForDirectory(undefined8 param_1, undefined8 param_2)|ulonglong __fastcall PrjfRevertInMemoryTombstonesForDirectory(undefined8 param_1, undefined8 param_2)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfRevertInMemoryTombstonesForDirectory Called Diff
```diff
--- PrjfRevertInMemoryTombstonesForDirectory called
+++ PrjfRevertInMemoryTombstonesForDirectory called
@@ -23 +23 @@
-WPP_RECORDER_SF_sDd
+WPP_RECORDER_AND_TRACE_SF_sDD
```
### PrjfRevertInMemoryTombstonesForDirectory Diff
```diff
--- PrjfRevertInMemoryTombstonesForDirectory
+++ PrjfRevertInMemoryTombstonesForDirectory
@@ -1,172 +1,178 @@
/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
ulonglong PrjfRevertInMemoryTombstonesForDirectory(undefined8 param_1,undefined8 param_2)
{
int *piVar1;
bool bVar2;
char cVar3;
uint uVar4;
longlong lVar5;
ulonglong uVar6;
longlong lVar7;
longlong lVar8;
ulonglong uVar9;
- undefined1 auStackY_128 [32];
- longlong local_e0;
- longlong local_d8;
- undefined2 local_d0;
- short sStack_ce;
- undefined4 uStack_cc;
- longlong lStack_c8;
- longlong local_c0;
- longlong local_b8;
- undefined8 local_b0;
- undefined8 local_a8;
- int *local_a0;
+ undefined1 auStackY_138 [32];
+ longlong local_d0;
+ longlong local_c8;
+ undefined2 local_c0;
+ short sStack_be;
+ undefined4 uStack_bc;
+ longlong lStack_b8;
+ longlong local_b0;
+ longlong local_a8;
+ undefined8 local_a0;
undefined8 local_98;
undefined8 uStack_90;
undefined8 local_88;
undefined8 local_80;
undefined8 uStack_78;
undefined8 local_70;
undefined8 uStack_68;
undefined8 local_60;
undefined8 local_58;
undefined8 uStack_50;
undefined8 local_48;
ulonglong local_40;
- local_40 = __security_cookie ^ (ulonglong)auStackY_128;
- local_c0 = 0;
+ local_40 = __security_cookie ^ (ulonglong)auStackY_138;
+ local_b0 = 0;
local_60 = 0;
- local_e0 = 0;
+ local_d0 = 0;
lVar7 = 0;
- local_d8 = 0;
+ local_c8 = 0;
local_48 = 0;
local_88 = 0;
local_80 = 0;
uStack_78 = 0;
local_70 = 0;
uStack_68 = 0;
local_58 = 0;
uStack_50 = 0;
- _local_d0 = 0;
- lStack_c8 = 0;
+ _local_c0 = 0;
+ lStack_b8 = 0;
local_98 = 0;
uStack_90 = 0;
- local_b0 = param_1;
uVar4 = FltQueryInformationFile(0,0,&local_58,0x18);
uVar9 = (ulonglong)uVar4;
lVar8 = lVar7;
if ((int)uVar4 < 0) {
- lVar8 = 0;
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,0x24,
- &WPP_4079bacae6ce31fd7110e995a8b7a7c9_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\tombstone.c");
+ if (((DAT_0 & 0x20) != 0) ||
+ (lVar8 = 0, (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x205,DAT_0 & 0x20,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,0x24,
+ &WPP_4079bacae6ce31fd7110e995a8b7a7c9_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\tombstone.c");
lVar8 = lVar7;
}
}
else if ((((local_48._6_1_ == '\0') && (local_48._5_1_ != '\0')) &&
- (cVar3 = PrjfGetContextFileObject(param_1,param_2,&local_d8,&local_c0), lVar8 = local_d8,
- cVar3 != '\0')) && (piVar1 = (int *)(local_d8 + 0x104), local_a0 = piVar1, *piVar1 != 0))
- {
- uVar4 = FltGetFileNameInformationUnsafe(param_2,param_1,0x301,&local_e0);
+ (cVar3 = PrjfGetContextFileObject(param_1,param_2,&local_c8,&local_b0), lVar8 = local_c8,
+ cVar3 != '\0')) && (piVar1 = (int *)(local_c8 + 0x104), *piVar1 != 0)) {
+ uVar4 = FltGetFileNameInformationUnsafe(param_2,param_1,0x301,&local_d0);
uVar9 = (ulonglong)uVar4;
if (-1 < (int)uVar4) {
- uVar4 = FltParseFileNameInformation(local_e0);
+ uVar4 = FltParseFileNameInformation(local_d0);
uVar9 = (ulonglong)uVar4;
if (-1 < (int)uVar4) {
- local_b8 = lVar8 + 0x88;
- FltAcquireResourceExclusive(local_b8);
+ local_a8 = lVar8 + 0x88;
+ FltAcquireResourceExclusive(local_a8);
bVar2 = true;
if (*piVar1 != 0) {
while (bVar2) {
lVar7 = lVar8 + 0xf0;
RtlInitEnumerationHashTable(lVar7,&local_80);
do {
lVar5 = RtlEnumerateEntryHashTable(lVar7,&local_80);
if (lVar5 == 0) {
bVar2 = false;
RtlEndEnumerationHashTable(lVar7,&local_80);
- goto LAB_0;
+ goto LAB_1;
}
} while (*(longlong *)(lVar5 + 0x30) == 0);
RtlEndEnumerationHashTable(lVar7,&local_80);
- local_a8 = *(undefined8 *)(lVar5 + 0x10);
- _local_d0 = CONCAT22(*(short *)(local_e0 + 10) + 2 + *(short *)(lVar5 + 0x22),local_d0);
- uVar6 = PrjfAllocateUnicodeString(0x6e664a50,&stack0xffffffffffffff30);
+ local_a0 = *(undefined8 *)(lVar5 + 0x10);
+ _local_c0 = CONCAT22(*(short *)(local_d0 + 10) + 2 + *(short *)(lVar5 + 0x22),local_c0);
+ uVar6 = PrjfAllocateUnicodeString(0x6e664a50,&stack0xffffffffffffff40);
uVar9 = uVar6 & 0xffffffff;
if ((int)uVar6 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x13,0x25,
- &WPP_4079bacae6ce31fd7110e995a8b7a7c9_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\tombstone.c");
+ if (((DAT_2 & 8) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x213,DAT_2 & 8,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x13,0x25,
+ &WPP_4079bacae6ce31fd7110e995a8b7a7c9_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\tombstone.c");
}
break;
}
- RtlAppendUnicodeStringToString(&stack0xffffffffffffff30,local_e0 + 8);
- RtlAppendUnicodeToString(&stack0xffffffffffffff30,L"\\");
- RtlAppendUnicodeStringToString(&stack0xffffffffffffff30,lVar5 + 0x20);
+ RtlAppendUnicodeStringToString(&stack0xffffffffffffff40,local_d0 + 8);
+ RtlAppendUnicodeToString(&stack0xffffffffffffff40,L"\\");
+ RtlAppendUnicodeStringToString(&stack0xffffffffffffff40,lVar5 + 0x20);
lVar8 = *(longlong *)(lVar5 + 0x30);
*(undefined1 *)(lVar5 + 0x19) = 1;
FltReferenceContext(lVar8);
- lVar7 = local_b8;
- FltReleaseResource(local_b8);
+ lVar7 = local_a8;
+ FltReleaseResource(local_a8);
KeWaitForSingleObject(lVar8 + 0x120,0,0,0);
if (*(char *)(lVar8 + 0x11a) == '\0') {
- uVar4 = PrjfCreateTombstone(local_b0,&stack0xffffffffffffff30,*(char *)(lVar5 + 0x18))
- ;
+ uVar4 = PrjfCreateTombstone(param_1,&stack0xffffffffffffff40,*(char *)(lVar5 + 0x18));
uVar9 = (ulonglong)uVar4;
if ((int)uVar4 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,0x26,
- &WPP_4079bacae6ce31fd7110e995a8b7a7c9_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\tombstone.c");
+ if (((DAT_0 & 0x20) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x205,DAT_0 & 0x20,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,0x26,
+ &WPP_4079bacae6ce31fd7110e995a8b7a7c9_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\tombstone.c");
}
PrjfTelemetryTombstoneFailureOperation(1,6,uVar4);
}
}
FltReleaseContext(lVar8);
- if (lStack_c8 != 0) {
- ExFreePoolWithTag(lStack_c8,0x6e664a50);
+ if (lStack_b8 != 0) {
+ ExFreePoolWithTag(lStack_b8,0x6e664a50);
}
FltAcquireResourceExclusive(lVar7);
- lVar8 = local_d8;
- lVar7 = local_d8 + 0xf0;
- lVar5 = RtlLookupEntryHashTable(lVar7,local_a8);
+ lVar8 = local_c8;
+ lVar7 = local_c8 + 0xf0;
+ lVar5 = RtlLookupEntryHashTable(lVar7,local_a0);
while (lVar5 != 0) {
if (*(char *)(lVar5 + 0x19) != '\0') {
RtlRemoveEntryHashTable(lVar7,lVar5);
if (*(longlong *)(lVar5 + 0x28) != 0) {
ExFreePoolWithTag(*(longlong *)(lVar5 + 0x28),0x6e664a50);
}
if (*(longlong *)(lVar5 + 0x30) != 0) {
FltReleaseContext();
}
ExFreePoolWithTag(lVar5,0x74684a50);
}
lVar5 = RtlGetNextEntryHashTable(lVar7,&local_98);
}
-LAB_0:
- if (*local_a0 == 0) break;
+LAB_1:
+ if (*piVar1 == 0) break;
}
}
FltReleaseResource(lVar8 + 0x88);
}
}
}
- if (local_e0 != 0) {
+ if (local_d0 != 0) {
FltReleaseFileNameInformation();
}
if (lVar8 != 0) {
FltReleaseContext(lVar8);
}
- if (local_c0 != 0) {
+ if (local_b0 != 0) {
FltReleaseContext();
}
return uVar9;
}
```
## PrjfSendCancelCommandWorker
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.71|
|i_ratio|0.39|
|m_ratio|0.93|
|b_ratio|0.88|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfSendCancelCommandWorker|PrjfSendCancelCommandWorker|
|fullname|PrjfSendCancelCommandWorker|PrjfSendCancelCommandWorker|
|refcount|3|3|
|`length`|323|374|
|`called`|FLTMGR.SYS::FltFreeGenericWorkItem
FLTMGR.SYS::FltSendMessage
PrjfFreeCommandBuffer
PrjfGetUnionContext
PrjfReleaseUnionContext
WPP_RECORDER_SF_sDd
WPP_RECORDER_SF_sDld|FLTMGR.SYS::FltFreeGenericWorkItem
FLTMGR.SYS::FltSendMessage
PrjfFreeCommandBuffer
PrjfGetUnionContext
PrjfReleaseUnionContext
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDld|
|calling|||
|paramcount|3|3|
|`address`|1c0003e30|140004f30|
|sig|undefined __fastcall PrjfSendCancelCommandWorker(longlong param_1, undefined8 param_2, uint * param_3)|undefined __fastcall PrjfSendCancelCommandWorker(longlong param_1, undefined8 param_2, uint * param_3)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfSendCancelCommandWorker Called Diff
```diff
--- PrjfSendCancelCommandWorker called
+++ PrjfSendCancelCommandWorker called
@@ -6,2 +6,2 @@
-WPP_RECORDER_SF_sDd
-WPP_RECORDER_SF_sDld
+WPP_RECORDER_AND_TRACE_SF_sDD
+WPP_RECORDER_AND_TRACE_SF_sDld
```
### PrjfSendCancelCommandWorker Diff
```diff
--- PrjfSendCancelCommandWorker
+++ PrjfSendCancelCommandWorker
@@ -1,38 +1,47 @@
void PrjfSendCancelCommandWorker(longlong param_1,undefined8 param_2,uint *param_3)
{
int iVar1;
longlong *plVar2;
longlong local_18;
undefined8 uStack_10;
local_18 = *(longlong *)(param_3 + 2);
uStack_10 = *(undefined8 *)(param_3 + 4);
plVar2 = PrjfGetUnionContext(param_2,&local_18);
if (plVar2 != (longlong *)0x0) {
if (plVar2[10] == 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0x86,
- &WPP_3ccab5108a9538d17a865fde27ef339f_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c");
+ if (((DAT_0 & 0x40) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x20e,DAT_0 & 0x40,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0x90,
+ &WPP_39279db927ae337b8503ecc20725ff46_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c");
}
}
else {
iVar1 = FltSendMessage(Globals,plVar2 + 10,param_3,*param_3,0,0,0);
- if (((iVar1 == -0x3fffffc9) || (iVar1 < 0)) &&
- ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
- WPP_RECORDER_SF_sDld(*(undefined8 *)(WPP_GLOBAL_Control + 0x40));
+ if ((iVar1 == -0x3fffffc9) || (iVar1 < 0)) {
+ if (((DAT_0 & 0x40) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDld
+ (&WPP_RECORDER_INITIALIZED,DAT_0 & 0x40,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40));
+ }
}
}
}
if (param_1 != 0) {
FltFreeGenericWorkItem(param_1);
}
PrjfFreeCommandBuffer((longlong)param_3,*param_3);
if (plVar2 != (longlong *)0x0) {
PrjfReleaseUnionContext((longlong)plVar2);
}
return;
}
```
## PrjfGetPrjReparseData
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.27|
|i_ratio|0.3|
|m_ratio|0.82|
|b_ratio|0.54|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfGetPrjReparseData|PrjfGetPrjReparseData|
|fullname|PrjfGetPrjReparseData|PrjfGetPrjReparseData|
|refcount|4|4|
|`length`|678|1028|
|`called`|FLTMGR.SYS::FltFsControlFile
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
WPP_RECORDER_SF_sDqd|FLTMGR.SYS::FltFsControlFile
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
WPP_RECORDER_AND_TRACE_SF_sDqd|
|calling|PrjfFsctlSetReparsePointPostOp
PrjfFsctlStartVirtualizationInstance
PrjfGetSetContextFileObject|PrjfFsctlSetReparsePointPostOp
PrjfFsctlStartVirtualizationInstance
PrjfGetSetContextFileObject|
|paramcount|4|4|
|`address`|1c002d3b8|14003b0ec|
|sig|int __fastcall PrjfGetPrjReparseData(undefined8 param_1, longlong param_2, undefined8 * param_3, undefined1 * param_4)|int __fastcall PrjfGetPrjReparseData(undefined8 param_1, longlong param_2, undefined8 * param_3, undefined1 * param_4)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfGetPrjReparseData Called Diff
```diff
--- PrjfGetPrjReparseData called
+++ PrjfGetPrjReparseData called
@@ -5 +5 @@
-WPP_RECORDER_SF_sDqd
+WPP_RECORDER_AND_TRACE_SF_sDqd
```
### PrjfGetPrjReparseData Diff
```diff
--- PrjfGetPrjReparseData
+++ PrjfGetPrjReparseData
@@ -1,91 +1,105 @@
int PrjfGetPrjReparseData
(undefined8 param_1,longlong param_2,undefined8 *param_3,undefined1 *param_4)
{
int *piVar1;
- byte bVar2;
- int iVar3;
- undefined2 uVar4;
+ undefined2 uVar2;
+ byte bVar3;
+ int iVar4;
uint local_res10 [2];
- ulonglong in_stack_ffffffffffffffa8;
+ undefined1 uVar5;
+ ushort uVar6;
local_res10[0] = 0;
- iVar3 = *(ushort *)(param_2 + 0x58) + 0x1a;
- do {
- piVar1 = (int *)ExAllocatePool2(0x100,iVar3,0x69724a50);
+ iVar4 = *(ushort *)(param_2 + 0x58) + 0x1a;
+ while( true ) {
+ piVar1 = (int *)ExAllocatePool2(0x100,iVar4,0x69724a50);
if (piVar1 == (int *)0x0) {
return -0x3fffff66;
}
- in_stack_ffffffffffffffa8 = in_stack_ffffffffffffffa8 & 0xffffffff00000000;
- iVar3 = FltFsControlFile(param_1,param_2,0x900a8,0,in_stack_ffffffffffffffa8,piVar1,iVar3,
- local_res10);
- if (iVar3 == 0x103) {
+ iVar4 = FltFsControlFile(param_1,param_2,0x900a8,0,0,piVar1,iVar4,local_res10);
+ if (iVar4 == 0x103) {
MicrosoftTelemetryAssertTriggeredNoArgsKM();
}
- else if (iVar3 == -0x3ffffd8b) {
+ else if (iVar4 == -0x3ffffd8b) {
*param_3 = 0;
- iVar3 = 0;
+ iVar4 = 0;
*param_4 = 0;
goto LAB_0;
}
- if (local_res10[0] < 8) {
-LAB_1:
- if (iVar3 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0;
- uVar4 = 0x1a;
- bVar2 = 2;
- }
- else {
- if (local_res10[0] < *(ushort *)(piVar1 + 1) + 8) {
- iVar3 = -0x3fff31fe;
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)
- goto LAB_0;
- uVar4 = 0x1b;
- }
- else if (*(ushort *)(piVar1 + 1) == (ushort)((short)piVar1[0x48] + 0x11aU)) {
- if (1 < (uint)piVar1[2]) {
- *param_4 = 1;
- *param_3 = piVar1;
- return iVar3;
- }
- iVar3 = -0x3fffff45;
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)
- goto LAB_0;
- uVar4 = 0x1d;
- }
- else {
- iVar3 = -0x3fff31fe;
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)
- goto LAB_0;
- uVar4 = 0x1c;
- }
-LAB_2:
- bVar2 = 4;
- }
- WPP_RECORDER_SF_sDqd
- (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),bVar2,5,uVar4,
- &WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
-LAB_0:
- ExFreePoolWithTag(piVar1,0x69724a50);
- return iVar3;
- }
+ if (local_res10[0] < 8) break;
if (*piVar1 != -0x6fffffe4) {
- iVar3 = 0;
+ iVar4 = 0;
*param_3 = 0;
*param_4 = 0;
goto LAB_0;
}
- if (iVar3 != -0x7ffffffb) goto LAB_1;
+ if (iVar4 != -0x7ffffffb) break;
if (*(ushort *)(piVar1 + 1) < 0x11a) {
- iVar3 = -0x3fff31fe;
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0;
- uVar4 = 0x19;
+ iVar4 = -0x3fff31fe;
+ if (((DAT_1 & 0x20) == 0) &&
+ ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) goto LAB_0;
+ uVar6 = 0x19;
goto LAB_2;
}
- iVar3 = *(ushort *)(piVar1 + 1) + 8;
+ iVar4 = *(ushort *)(piVar1 + 1) + 8;
ExFreePoolWithTag(piVar1,0x69724a50);
- } while( true );
+ }
+ if (iVar4 < 0) {
+ bVar3 = DAT_3 & 0x20;
+ if ((bVar3 == 0) && ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED))
+ goto LAB_0;
+ uVar2 = 0x205;
+ uVar6 = 0x1a;
+ uVar5 = 2;
+ goto LAB_4;
+ }
+ if (local_res10[0] < *(ushort *)(piVar1 + 1) + 8) {
+ iVar4 = -0x3fff31fe;
+ if (((DAT_1 & 0x20) == 0) &&
+ ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) goto LAB_0;
+ uVar6 = 0x1b;
+LAB_2:
+ iVar4 = -0x3fff31fe;
+ }
+ else {
+ uVar6 = *(ushort *)(piVar1 + 0x48) + 0x11a;
+ if (uVar6 < *(ushort *)(piVar1 + 0x48)) {
+ iVar4 = -0x3fff31fe;
+ if (((DAT_1 & 0x20) == 0) &&
+ ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) goto LAB_0;
+ uVar6 = 0x1c;
+ goto LAB_2;
+ }
+ if (*(ushort *)(piVar1 + 1) != uVar6) {
+ iVar4 = -0x3fff31fe;
+ if (((DAT_1 & 0x20) == 0) &&
+ ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) goto LAB_0;
+ uVar6 = 0x1d;
+ goto LAB_2;
+ }
+ if (1 < (uint)piVar1[2]) {
+ *param_4 = 1;
+ *param_3 = piVar1;
+ return 0;
+ }
+ iVar4 = -0x3fffff45;
+ if (((DAT_1 & 0x20) == 0) &&
+ ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) goto LAB_0;
+ uVar6 = 0x1e;
+ }
+ bVar3 = DAT_1 & 0x20;
+ uVar2 = 0x405;
+ uVar5 = 4;
+LAB_4:
+ WPP_RECORDER_AND_TRACE_SF_sDqd
+ (uVar2,bVar3,(undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),uVar5,5,uVar6,
+ &WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
+LAB_0:
+ ExFreePoolWithTag(piVar1,0x69724a50);
+ return iVar4;
}
```
## PrjfRelPathToFullPath
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.8|
|i_ratio|0.42|
|m_ratio|0.95|
|b_ratio|0.9|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfRelPathToFullPath|PrjfRelPathToFullPath|
|fullname|PrjfRelPathToFullPath|PrjfRelPathToFullPath|
|refcount|5|5|
|`length`|281|324|
|`called`|WPP_RECORDER_SF_sDd
memcpy|WPP_RECORDER_AND_TRACE_SF_sDD
memmove|
|calling|PrjfDeleteFileHandler
PrjfOpenFileHandler
PrjfUpdatePlaceholderIfNeededHandler
PrjfWritePlaceholderInformationHandler|PrjfDeleteFileHandler
PrjfOpenFileHandler
PrjfUpdatePlaceholderIfNeededHandler
PrjfWritePlaceholderInformationHandler|
|paramcount|5|5|
|`address`|1c00272dc|14003412c|
|sig|uint __fastcall PrjfRelPathToFullPath(ushort * param_1, ushort param_2, void * param_3, void * param_4, ushort param_5)|uint __fastcall PrjfRelPathToFullPath(ushort * param_1, ushort param_2, void * param_3, void * param_4, ushort param_5)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfRelPathToFullPath Called Diff
```diff
--- PrjfRelPathToFullPath called
+++ PrjfRelPathToFullPath called
@@ -1,2 +1,2 @@
-WPP_RECORDER_SF_sDd
-memcpy
+WPP_RECORDER_AND_TRACE_SF_sDD
+memmove
```
### PrjfRelPathToFullPath Diff
```diff
--- PrjfRelPathToFullPath
+++ PrjfRelPathToFullPath
@@ -1,42 +1,46 @@
uint PrjfRelPathToFullPath
(ushort *param_1,ushort param_2,void *param_3,void *param_4,ushort param_5)
{
longlong lVar1;
ushort uVar2;
uint uVar3;
ulonglong _Size;
bool bVar4;
_Size = (ulonglong)param_2;
if ((uint)param_1[1] < (uint)param_5 + (uint)param_2 + 2) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0xc,
- &WPP_3ccab5108a9538d17a865fde27ef339f_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c");
+ if (((DAT_0 & 0x40) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x20e,DAT_0 & 0x40,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0xd,
+ &WPP_39279db927ae337b8503ecc20725ff46_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c");
}
uVar3 = 0xc0000023;
}
else {
- memcpy(*(void **)(param_1 + 4),param_3,_Size);
+ memmove(*(void **)(param_1 + 4),param_3,_Size);
lVar1 = *(longlong *)(param_1 + 4);
*(undefined2 *)(_Size + lVar1) = 0x5c;
- memcpy((void *)(lVar1 + 2 + _Size),param_4,(ulonglong)param_5);
+ memmove((void *)(lVar1 + 2 + _Size),param_4,(ulonglong)param_5);
if ((ushort)(param_2 + param_5) < param_2) {
uVar3 = 0xc0000095;
uVar2 = 0xffff;
}
else {
uVar2 = param_2 + param_5 + 2;
bVar4 = uVar2 < 2;
if (bVar4) {
uVar2 = 0xffff;
}
uVar3 = -(uint)bVar4 & 0xc0000095;
}
*param_1 = uVar2;
}
return uVar3;
}
```
## PrjfSetUnionContext
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.58|
|i_ratio|0.38|
|m_ratio|0.92|
|b_ratio|0.56|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfSetUnionContext|PrjfSetUnionContext|
|fullname|PrjfSetUnionContext|PrjfSetUnionContext|
|refcount|2|2|
|`length`|932|1135|
|`called`|Expand for full list:
FLTMGR.SYS::FltAcquireResourceExclusive
FLTMGR.SYS::FltGetInstanceContext
FLTMGR.SYS::FltReleaseContext
FLTMGR.SYS::FltReleaseResource
NTOSKRNL.EXE::ExAcquireFastMutex
NTOSKRNL.EXE::ExReleaseFastMutex
PrjfCreateUnionContext
PrjfReleaseUnionContext
PrjfStoreNotificationMappingEntries
WPP_RECORDER_SF_sD
WPP_RECORDER_SF_sDd
Expand for full list:
FLTMGR.SYS::FltAcquireResourceExclusive
FLTMGR.SYS::FltGetInstanceContext
FLTMGR.SYS::FltReleaseContext
FLTMGR.SYS::FltReleaseResource
NTOSKRNL.EXE::ExAcquireFastMutex
NTOSKRNL.EXE::ExReleaseFastMutex
PrjfCreateUnionContext
PrjfReleaseUnionContext
PrjfStoreNotificationMappingEntries
WPP_RECORDER_AND_TRACE_SF_sD
WPP_RECORDER_AND_TRACE_SF_sDD
Expand for full list:
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltParseFileNameInformation
FLTMGR.SYS::FltReleaseContext
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::RtlFreeUnicodeString
PrjfGetSetContextFileObject
PrjfInsertEntryBackingLayerNegativePathCache
PrjfLookupEntryBackingLayerNegativePathCache
PrjfOpenPlaceHolder
PrjfParseParentAndNextComponentPathName
PrjfPartiallyExpandDirectory
PrjfReleaseUnionContext
PrjfTelemetryTombstoneFailureOperation
WPP_RECORDER_SF_sD
WPP_RECORDER_SF_sDd
WPP_RECORDER_SF_sDdZExpand for full list:
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltParseFileNameInformation
FLTMGR.SYS::FltReleaseContext
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::RtlFreeUnicodeString
PrjfGetSetContextFileObject
PrjfInsertEntryBackingLayerNegativePathCache
PrjfLookupEntryBackingLayerNegativePathCache
PrjfOpenPlaceHolder
PrjfParseParentAndNextComponentPathName
PrjfPartiallyExpandDirectory
PrjfReleaseUnionContext
PrjfTelemetryTombstoneFailureOperation
WPP_RECORDER_AND_TRACE_SF_sD
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDdZExpand for full list:
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltReleaseContext
FLTMGR.SYS::FltReleaseResource
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::RtlRemoveEntryHashTable
PrjfGetContextFileObject
PrjfLookupInMemoryTombstoneEntry
PrjfOpenPlaceHolder
WPP_RECORDER_SF_sDd
WPP_RECORDER_SF_sDdZ
Expand for full list:
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltReleaseContext
FLTMGR.SYS::FltReleaseResource
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::RtlRemoveEntryHashTable
PrjfGetContextFileObject
PrjfLookupInMemoryTombstoneEntry
PrjfOpenPlaceHolder
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDdZ
PrjfPreCleanup
PrjfProcessPostRenameOrLinkInformation
PrjfProcessPreRenameOrLinkInformation
PrjfProcessTombstoneBounce|PrjfPostCleanup
PrjfPreCleanup
PrjfProcessPostRenameOrLinkInformation
PrjfProcessPreRenameOrLinkInformation
PrjfProcessTombstoneBounce|
|paramcount|3|3|
|`address`|1c00348d4|140044210|
|sig|ulonglong __fastcall PrjfRemoveInMemoryTombstone(undefined8 param_1, longlong param_2, longlong param_3)|ulonglong __fastcall PrjfRemoveInMemoryTombstone(undefined8 param_1, longlong param_2, longlong param_3)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfRemoveInMemoryTombstone Called Diff
```diff
--- PrjfRemoveInMemoryTombstone called
+++ PrjfRemoveInMemoryTombstone called
@@ -10,2 +10,2 @@
-WPP_RECORDER_SF_sDd
-WPP_RECORDER_SF_sDdZ
+WPP_RECORDER_AND_TRACE_SF_sDD
+WPP_RECORDER_AND_TRACE_SF_sDdZ
```
### PrjfRemoveInMemoryTombstone Diff
```diff
--- PrjfRemoveInMemoryTombstone
+++ PrjfRemoveInMemoryTombstone
@@ -1,119 +1,125 @@
ulonglong PrjfRemoveInMemoryTombstone(undefined8 param_1,longlong param_2,longlong param_3)
{
bool bVar1;
bool bVar2;
char cVar3;
short sVar4;
uint uVar5;
ulonglong uVar6;
short sVar7;
- ulonglong uVar8;
- longlong lVar9;
+ longlong lVar8;
+ ulonglong uVar9;
longlong lVar10;
longlong lVar11;
byte local_res18 [8];
longlong local_res20;
- undefined4 in_stack_ffffffffffffff7c;
undefined4 in_stack_ffffffffffffff84;
+ undefined4 in_stack_ffffffffffffff8c;
longlong local_68;
longlong local_60;
longlong local_58;
longlong local_50;
wchar_t local_48;
undefined6 uStack_46;
undefined8 uStack_40;
local_58 = 0;
local_res20 = 0;
local_68 = 0;
local_50 = 0;
- lVar9 = 0;
+ lVar8 = 0;
local_res18[0] = 0;
lVar10 = 0;
local_60 = 0;
bVar1 = true;
_local_48 = 0;
uStack_40 = 0;
lVar11 = lVar10;
if (param_3 == 0) {
uStack_40 = *(undefined8 *)(param_2 + 0x10);
sVar7 = *(short *)(param_2 + 8) - *(short *)(param_2 + 0x58);
sVar4 = sVar7 + -2;
if (sVar4 == *(short *)(param_2 + 0x18)) {
sVar4 = sVar7;
}
_local_48 = CONCAT62(*(undefined6 *)(param_2 + 10),sVar4);
uVar6 = PrjfOpenPlaceHolder(param_1,&local_48,0,&local_58,&local_res20,local_res18);
- uVar8 = uVar6 & 0xffffffff;
+ uVar9 = uVar6 & 0xffffffff;
param_3 = local_res20;
bVar2 = true;
if ((int)uVar6 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDdZ
- (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x13,0xc,
+ if (((DAT_0 & 8) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDdZ
+ (0x213,DAT_0 & 8,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x13,0xc,
&WPP_4079bacae6ce31fd7110e995a8b7a7c9_Traceguids,
"onecore\\base\\fs\\gvflt\\filter\\sys\\tombstone.c",
- CONCAT44(in_stack_ffffffffffffff7c,0x139),
- CONCAT44(in_stack_ffffffffffffff84,(int)uVar6),&local_48);
+ CONCAT44(in_stack_ffffffffffffff84,0x139),
+ CONCAT44(in_stack_ffffffffffffff8c,(int)uVar6),&local_48);
param_3 = local_res20;
}
- goto LAB_0;
+ goto LAB_1;
}
}
else {
bVar2 = false;
}
bVar1 = bVar2;
cVar3 = PrjfGetContextFileObject(param_1,param_3,&local_68,&local_50);
- lVar9 = local_68;
+ lVar8 = local_68;
if (cVar3 != '\0') {
uVar5 = PrjfLookupInMemoryTombstoneEntry
(local_68,(short *)(param_2 + 0x58),1,(int *)0x0,&local_60);
lVar11 = local_60;
- uVar8 = (ulonglong)uVar5;
+ uVar9 = (ulonglong)uVar5;
if (-1 < (int)uVar5) {
- RtlRemoveEntryHashTable(lVar9 + 0xf0,local_60,0);
- uVar8 = 0;
- FltReleaseResource(lVar9 + 0x88);
- goto LAB_0;
+ RtlRemoveEntryHashTable(lVar8 + 0xf0,local_60,0);
+ uVar9 = 0;
+ FltReleaseResource(lVar8 + 0x88);
+ goto LAB_1;
}
if (uVar5 != 0xc0000225) {
- lVar11 = 0;
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x13,0xd,
- &WPP_4079bacae6ce31fd7110e995a8b7a7c9_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\tombstone.c");
+ if (((DAT_0 & 8) != 0) ||
+ (lVar11 = 0, (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x213,DAT_0 & 8,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x13,0xd,
+ &WPP_4079bacae6ce31fd7110e995a8b7a7c9_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\tombstone.c");
lVar11 = lVar10;
}
- goto LAB_0;
+ goto LAB_1;
}
}
- uVar8 = 0;
+ uVar9 = 0;
lVar11 = lVar10;
-LAB_0:
+LAB_1:
if (local_58 != 0) {
FltClose();
}
if ((bVar1) && (param_3 != 0)) {
ObfDereferenceObject(param_3);
}
- if (lVar9 != 0) {
- FltReleaseContext(lVar9);
+ if (lVar8 != 0) {
+ FltReleaseContext(lVar8);
}
if (local_50 != 0) {
FltReleaseContext();
}
if (lVar11 != 0) {
if (*(longlong *)(lVar11 + 0x28) != 0) {
ExFreePoolWithTag(*(longlong *)(lVar11 + 0x28),0x6e664a50);
}
if (*(longlong *)(lVar11 + 0x30) != 0) {
FltReleaseContext();
}
ExFreePoolWithTag(lVar11,0x74684a50);
}
- return uVar8;
+ return uVar9;
}
```
## PrjfIsFileObjectWithinActiveVirtualizationRoots
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.67|
|i_ratio|0.35|
|m_ratio|0.92|
|b_ratio|0.87|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfIsFileObjectWithinActiveVirtualizationRoots|PrjfIsFileObjectWithinActiveVirtualizationRoots|
|fullname|PrjfIsFileObjectWithinActiveVirtualizationRoots|PrjfIsFileObjectWithinActiveVirtualizationRoots|
|refcount|4|4|
|`length`|388|478|
|`called`|NTOSKRNL.EXE::ExFreePoolWithTag
PrjfGetUnionContextByFileNameEx
PrjfReleaseUnionContext
WPP_RECORDER_SF_sDdZ|NTOSKRNL.EXE::ExFreePoolWithTag
PrjfGetUnionContextByFileNameEx
PrjfReleaseUnionContext
WPP_RECORDER_AND_TRACE_SF_sDdZ|
|calling|PrjfPreCleanup
PrjfPreQueryVolumeInformation
PrjfPreSetDispositionInformation|PrjfPreCleanup
PrjfPreQueryVolumeInformation
PrjfPreSetDispositionInformation|
|paramcount|3|3|
|`address`|1c0005c24|1400074e8|
|sig|ulonglong __fastcall PrjfIsFileObjectWithinActiveVirtualizationRoots(undefined8 param_1, longlong param_2, undefined8 * param_3)|ulonglong __fastcall PrjfIsFileObjectWithinActiveVirtualizationRoots(undefined8 param_1, longlong param_2, undefined8 * param_3)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfIsFileObjectWithinActiveVirtualizationRoots Called Diff
```diff
--- PrjfIsFileObjectWithinActiveVirtualizationRoots called
+++ PrjfIsFileObjectWithinActiveVirtualizationRoots called
@@ -4 +4 @@
-WPP_RECORDER_SF_sDdZ
+WPP_RECORDER_AND_TRACE_SF_sDdZ
```
### PrjfIsFileObjectWithinActiveVirtualizationRoots Diff
```diff
--- PrjfIsFileObjectWithinActiveVirtualizationRoots
+++ PrjfIsFileObjectWithinActiveVirtualizationRoots
@@ -1,62 +1,71 @@
ulonglong PrjfIsFileObjectWithinActiveVirtualizationRoots
(undefined8 param_1,longlong param_2,undefined8 *param_3)
{
longlong lVar1;
undefined8 *puVar2;
ulonglong uVar3;
+ char cVar4;
longlong local_res10;
- undefined4 uVar4;
undefined4 in_stack_ffffffffffffffd4;
+ undefined4 in_stack_ffffffffffffffdc;
undefined8 local_18;
longlong lStack_10;
- uVar4 = 0;
local_res10 = 0;
local_18 = 0;
lStack_10 = 0;
puVar2 = PrjfGetUnionContextByFileNameEx
(param_1,'\0',*(undefined8 *)(param_2 + 0x18),(ushort *)0x0,&local_res10,
(ushort *)&local_18,(undefined1 *)0x0);
lVar1 = lStack_10;
uVar3 = (ulonglong)puVar2 & 0xffffffff;
if ((int)puVar2 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDdZ
- (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,0x51,
- &WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",CONCAT44(uVar4,0xfac),
- CONCAT44(in_stack_ffffffffffffffd4,(int)puVar2),
+ if (((DAT_0 & 0x20) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDdZ
+ (0x205,DAT_0 & 0x20,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,0x53,
+ &WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",
+ CONCAT44(in_stack_ffffffffffffffd4,0xfe3),
+ CONCAT44(in_stack_ffffffffffffffdc,(int)puVar2),
(wchar_t *)(*(longlong *)(param_2 + 0x20) + 0x58));
}
}
else {
if (local_res10 == 0) {
uVar3 = 0xc000ce04;
- if (((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) &&
- (*(short *)(WPP_GLOBAL_Control + 0x48) != 0)) {
- WPP_RECORDER_SF_sDdZ
- (_PrjfTraceRecorder,5,5,0x52,&WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",CONCAT44(uVar4,0xfbd),
- CONCAT44(in_stack_ffffffffffffffd4,0xc000ce04),
+ if (((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) ||
+ (cVar4 = '\x01', *(short *)(WPP_GLOBAL_Control + 0x48) == 0)) {
+ cVar4 = '\0';
+ }
+ if (((DAT_1 & 0x20) != 0) || (cVar4 != '\0')) {
+ WPP_RECORDER_AND_TRACE_SF_sDdZ
+ (0x505,DAT_1 & 0x20,cVar4,_PrjfTraceRecorder,5,5,0x54,
+ &WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",
+ CONCAT44(in_stack_ffffffffffffffd4,0xff4),
+ CONCAT44(in_stack_ffffffffffffffdc,0xc000ce04),
(wchar_t *)(*(longlong *)(param_2 + 0x20) + 0x58));
}
- goto LAB_0;
+ goto LAB_2;
}
if (param_3 != (undefined8 *)0x0) {
lStack_10 = 0;
*param_3 = local_18;
param_3[1] = lVar1;
}
}
if (local_res10 != 0) {
PrjfReleaseUnionContext(local_res10);
}
-LAB_0:
+LAB_2:
if (lStack_10 != 0) {
ExFreePoolWithTag(lStack_10,0x6e664a50);
}
return uVar3;
}
```
## PrjfPortDisconnect
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.79|
|i_ratio|0.4|
|m_ratio|0.96|
|b_ratio|0.91|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfPortDisconnect|PrjfPortDisconnect|
|fullname|PrjfPortDisconnect|PrjfPortDisconnect|
|refcount|4|4|
|`length`|534|605|
|`called`|Expand for full list:
FLTMGR.SYS::FltAcquireResourceExclusive
FLTMGR.SYS::FltCloseClientPort
FLTMGR.SYS::FltGetInstanceContext
FLTMGR.SYS::FltObjectDereference
FLTMGR.SYS::FltReleaseContext
FLTMGR.SYS::FltReleaseResource
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExAcquireFastMutex
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExReleaseFastMutex
NTOSKRNL.EXE::KeSetEvent
PrjfReleaseUnionContext
WPP_RECORDER_SF_sD
WPP_RECORDER_SF_sDdExpand for full list:
FLTMGR.SYS::FltAcquireResourceExclusive
FLTMGR.SYS::FltCloseClientPort
FLTMGR.SYS::FltGetInstanceContext
FLTMGR.SYS::FltObjectDereference
FLTMGR.SYS::FltReleaseContext
FLTMGR.SYS::FltReleaseResource
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExAcquireFastMutex
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExReleaseFastMutex
NTOSKRNL.EXE::KeSetEvent
PrjfReleaseUnionContext
WPP_RECORDER_AND_TRACE_SF_sD
WPP_RECORDER_AND_TRACE_SF_sDDExpand for full list:
FLTMGR.SYS::FltLockUserBuffer
FLTMGR.SYS::FltReleaseContext
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::MmMapLockedPagesSpecifyCache
NTOSKRNL.EXE::ProbeForWrite
PrjfEnumerateDirectoryWithMerge
PrjfGetContextFileObjectEx
PrjfGetUnionContext
PrjfReleaseUnionContext
WPP_RECORDER_SF_sDd
WPP_RECORDER_SF_sDqZd
Expand for full list:
FLTMGR.SYS::FltLockUserBuffer
FLTMGR.SYS::FltReleaseContext
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::MmMapLockedPagesSpecifyCache
NTOSKRNL.EXE::ProbeForWrite
PrjfEnumerateDirectoryWithMerge
PrjfGetContextFileObjectEx
PrjfGetUnionContext
PrjfReleaseUnionContext
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDqZd
Expand for full list:
FLTMGR.SYS::FltAcquireResourceExclusive
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltReleaseContext
FLTMGR.SYS::FltReleaseResource
MicrosoftTelemetryAssertTriggeredMsgKM
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::RtlCopyUnicodeString
NTOSKRNL.EXE::RtlDowncaseUnicodeString
NTOSKRNL.EXE::RtlFreeUnicodeString
NTOSKRNL.EXE::RtlHashUnicodeString
NTOSKRNL.EXE::RtlInsertEntryHashTable
PrjfAllocateUnicodeString
PrjfGetSetContextFileObject
PrjfOpenPlaceHolder
WPP_RECORDER_SF_sDdZExpand for full list:
FLTMGR.SYS::FltAcquireResourceExclusive
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltReleaseContext
FLTMGR.SYS::FltReleaseResource
MicrosoftTelemetryAssertTriggeredMsgKM
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::RtlCopyUnicodeString
NTOSKRNL.EXE::RtlDowncaseUnicodeString
NTOSKRNL.EXE::RtlFreeUnicodeString
NTOSKRNL.EXE::RtlHashUnicodeString
NTOSKRNL.EXE::RtlInsertEntryHashTable
PrjfAllocateUnicodeString
PrjfGetSetContextFileObject
PrjfOpenPlaceHolder
WPP_RECORDER_AND_TRACE_SF_sDdZ
PrjfPreCleanup
PrjfPrepareSourceForRename
PrjfProcessTombstoneBounce|PrjfDeleteTombstoneIfExists
PrjfPreCleanup
PrjfPrepareSourceForRename
PrjfProcessTombstoneBounce|
|paramcount|6|6|
|`address`|1c0032dcc|1400423ec|
|sig|ulonglong __fastcall PrjfAddInMemoryTombstone(undefined8 param_1, longlong param_2, undefined8 param_3, longlong param_4, longlong param_5, undefined8 * param_6)|ulonglong __fastcall PrjfAddInMemoryTombstone(undefined8 param_1, longlong param_2, undefined8 param_3, longlong param_4, longlong param_5, undefined8 * param_6)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfAddInMemoryTombstone Called Diff
```diff
--- PrjfAddInMemoryTombstone called
+++ PrjfAddInMemoryTombstone called
@@ -17 +17 @@
-WPP_RECORDER_SF_sDdZ
+WPP_RECORDER_AND_TRACE_SF_sDdZ
```
### PrjfAddInMemoryTombstone Diff
```diff
--- PrjfAddInMemoryTombstone
+++ PrjfAddInMemoryTombstone
@@ -1,159 +1,156 @@
ulonglong PrjfAddInMemoryTombstone
(undefined8 param_1,longlong param_2,undefined8 param_3,longlong param_4,
longlong param_5,undefined8 *param_6)
{
undefined2 *puVar1;
undefined2 uVar2;
bool bVar3;
- bool bVar4;
- short sVar5;
- uint uVar6;
- ulonglong uVar7;
- short sVar8;
- ulonglong uVar9;
+ short sVar4;
+ uint uVar5;
+ ulonglong uVar6;
+ short sVar7;
+ ulonglong uVar8;
+ longlong lVar9;
longlong lVar10;
- longlong lVar11;
- undefined8 in_stack_ffffffffffffff68;
- undefined4 uVar12;
- undefined8 in_stack_ffffffffffffff70;
- undefined4 uVar14;
- longlong *plVar13;
+ undefined4 in_stack_ffffffffffffff74;
+ undefined4 in_stack_ffffffffffffff7c;
byte local_78 [4];
undefined4 local_74;
longlong local_70;
longlong local_68;
longlong local_60;
longlong local_58;
wchar_t local_50;
undefined6 uStack_4e;
undefined8 uStack_48;
undefined8 local_40;
undefined8 uStack_38;
- uVar12 = (undefined4)((ulonglong)in_stack_ffffffffffffff68 >> 0x20);
- uVar14 = (undefined4)((ulonglong)in_stack_ffffffffffffff70 >> 0x20);
+ local_60 = 0;
+ lVar10 = 0;
+ local_58 = 0;
+ lVar9 = 0;
+ local_74 = 0;
+ local_70 = 0;
+ local_68 = 0;
bVar3 = true;
- local_60 = 0;
- lVar11 = 0;
- local_70 = 0;
- lVar10 = 0;
- local_68 = 0;
- local_58 = 0;
- local_74 = 0;
local_78[0] = 0;
_local_50 = 0;
uStack_48 = 0;
local_40 = 0;
uStack_38 = 0;
if (param_5 == 0) {
uStack_48 = *(undefined8 *)(param_4 + 0x10);
- sVar8 = *(short *)(param_4 + 8) - *(short *)(param_4 + 0x58);
- sVar5 = sVar8 + -2;
- if (sVar5 == *(short *)(param_4 + 0x18)) {
- sVar5 = sVar8;
+ sVar7 = *(short *)(param_4 + 8) - *(short *)(param_4 + 0x58);
+ sVar4 = sVar7 + -2;
+ if (sVar4 == *(short *)(param_4 + 0x18)) {
+ sVar4 = sVar7;
}
- _local_50 = CONCAT62(*(undefined6 *)(param_4 + 10),sVar5);
- uVar7 = PrjfOpenPlaceHolder(param_1,&local_50,param_3,&local_60,&local_70,local_78);
- uVar9 = uVar7 & 0xffffffff;
+ _local_50 = CONCAT62(*(undefined6 *)(param_4 + 10),sVar4);
+ uVar6 = PrjfOpenPlaceHolder(param_1,&local_50,param_3,&local_60,&local_70,local_78);
+ uVar8 = uVar6 & 0xffffffff;
param_5 = local_70;
- bVar4 = true;
- if ((int)uVar7 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDdZ
- (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x13,10,
+ if ((int)uVar6 < 0) {
+ if (((DAT_0 & 8) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDdZ
+ (0x213,DAT_0 & 8,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x13,10,
&WPP_4079bacae6ce31fd7110e995a8b7a7c9_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\tombstone.c",CONCAT44(uVar12,0x68),
- CONCAT44(uVar14,(int)uVar7),&local_50);
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\tombstone.c",
+ CONCAT44(in_stack_ffffffffffffff74,0x68),
+ CONCAT44(in_stack_ffffffffffffff7c,(int)uVar6),&local_50);
param_5 = local_70;
}
- goto LAB_0;
+ goto LAB_1;
}
}
else {
- bVar4 = false;
+ bVar3 = false;
}
- bVar3 = bVar4;
- plVar13 = &local_68;
- uVar12 = 0;
- uVar6 = PrjfGetSetContextFileObject
+ uVar5 = PrjfGetSetContextFileObject
(param_1,param_5,-0x80000000,'\0','\0',(undefined4 *)0x0,(undefined2 *)0x0,
- plVar13,&local_58);
- lVar11 = local_68;
- uVar14 = (undefined4)((ulonglong)plVar13 >> 0x20);
- uVar9 = (ulonglong)uVar6;
- if ((int)uVar6 < 0) {
- if (local_68 == 0) goto LAB_1;
+ &local_68,&local_58);
+ lVar10 = local_68;
+ uVar8 = (ulonglong)uVar5;
+ if ((int)uVar5 < 0) {
+ if (local_68 == 0) goto LAB_2;
}
else {
if (local_68 != 0) {
- lVar10 = ExAllocatePool2(0x100,0x38,0x74684a50);
- if (lVar10 == 0) {
- uVar9 = 0xc000009a;
+ lVar9 = ExAllocatePool2(0x100,0x38,0x74684a50);
+ if (lVar9 == 0) {
+ uVar8 = 0xc000009a;
}
else {
- puVar1 = (undefined2 *)(lVar10 + 0x20);
- *(char *)(lVar10 + 0x18) = (char)param_3;
+ puVar1 = (undefined2 *)(lVar9 + 0x20);
+ *(char *)(lVar9 + 0x18) = (char)param_3;
uVar2 = *(undefined2 *)(param_2 + 2);
- *(undefined2 *)(lVar10 + 0x22) = uVar2;
+ *(undefined2 *)(lVar9 + 0x22) = uVar2;
*puVar1 = uVar2;
- uVar7 = PrjfAllocateUnicodeString(0x6e664a50,puVar1);
- uVar9 = uVar7 & 0xffffffff;
- if (-1 < (int)uVar7) {
+ uVar6 = PrjfAllocateUnicodeString(0x6e664a50,puVar1);
+ uVar8 = uVar6 & 0xffffffff;
+ if (-1 < (int)uVar6) {
if (param_6 != (undefined8 *)0x0) {
- *(undefined8 *)(lVar10 + 0x30) = *param_6;
+ *(undefined8 *)(lVar9 + 0x30) = *param_6;
*param_6 = 0;
}
RtlCopyUnicodeString(puVar1,param_2);
- uVar6 = RtlDowncaseUnicodeString(&local_40,param_2,1);
- uVar9 = (ulonglong)uVar6;
- if (-1 < (int)uVar6) {
- uVar6 = RtlHashUnicodeString(&local_40,1,0,&local_74);
- uVar9 = (ulonglong)uVar6;
- FltAcquireResourceExclusive(lVar11 + 0x88);
- RtlInsertEntryHashTable(lVar11 + 0xf0,lVar10,local_74,0);
- FltReleaseResource(lVar11 + 0x88);
- lVar10 = 0;
+ uVar5 = RtlDowncaseUnicodeString(&local_40,param_2,1);
+ uVar8 = (ulonglong)uVar5;
+ if (-1 < (int)uVar5) {
+ uVar5 = RtlHashUnicodeString(&local_40,1,0,&local_74);
+ uVar8 = (ulonglong)uVar5;
+ FltAcquireResourceExclusive(lVar10 + 0x88);
+ RtlInsertEntryHashTable(lVar10 + 0xf0,lVar9,local_74,0);
+ FltReleaseResource(lVar10 + 0x88);
+ lVar9 = 0;
}
}
}
- goto LAB_0;
+ goto LAB_1;
}
+LAB_2:
+ MicrosoftTelemetryAssertTriggeredMsgKM();
+ uVar8 = 0xc00000e5;
+ }
+ if (((DAT_0 & 8) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDdZ
+ (0x213,DAT_0 & 8,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x13,0xb,
+ &WPP_4079bacae6ce31fd7110e995a8b7a7c9_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\tombstone.c",
+ CONCAT44(in_stack_ffffffffffffff74,0x90),
+ CONCAT44(in_stack_ffffffffffffff7c,(int)uVar8),(wchar_t *)(param_5 + 0x58));
+ }
LAB_1:
- MicrosoftTelemetryAssertTriggeredMsgKM();
- uVar9 = 0xc00000e5;
- }
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDdZ
- (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x13,0xb,
- &WPP_4079bacae6ce31fd7110e995a8b7a7c9_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\tombstone.c",CONCAT44(uVar12,0x90),
- CONCAT44(uVar14,(int)uVar9),(wchar_t *)(param_5 + 0x58));
- }
-LAB_0:
if (local_60 != 0) {
FltClose();
}
if ((bVar3) && (param_5 != 0)) {
ObfDereferenceObject(param_5);
}
- if (lVar11 != 0) {
- FltReleaseContext(lVar11);
+ if (lVar10 != 0) {
+ FltReleaseContext(lVar10);
}
if (local_58 != 0) {
FltReleaseContext();
}
- if (lVar10 != 0) {
- if (*(longlong *)(lVar10 + 0x28) != 0) {
- ExFreePoolWithTag(*(longlong *)(lVar10 + 0x28),0x6e664a50);
+ if (lVar9 != 0) {
+ if (*(longlong *)(lVar9 + 0x28) != 0) {
+ ExFreePoolWithTag(*(longlong *)(lVar9 + 0x28),0x6e664a50);
}
- if (*(longlong *)(lVar10 + 0x30) != 0) {
+ if (*(longlong *)(lVar9 + 0x30) != 0) {
FltReleaseContext();
}
- ExFreePoolWithTag(lVar10,0x74684a50);
+ ExFreePoolWithTag(lVar9,0x74684a50);
}
RtlFreeUnicodeString(&local_40);
- return uVar9;
+ return uVar8;
}
```
## PrjfCreatePathTree
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.76|
|i_ratio|0.42|
|m_ratio|0.93|
|b_ratio|0.85|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfCreatePathTree|PrjfCreatePathTree|
|fullname|PrjfCreatePathTree|PrjfCreatePathTree|
|refcount|4|4|
|`length`|153|186|
|`called`|NTOSKRNL.EXE::ExAllocatePool2
WPP_RECORDER_SF_sD|NTOSKRNL.EXE::ExAllocatePool2
WPP_RECORDER_AND_TRACE_SF_sD|
|calling|PrjfCreateInstanceTierNode
PrjfCreatePathTierNode
PrjfMappingInsert|PrjfCreateInstanceTierNode
PrjfCreatePathTierNode
PrjfMappingInsert|
|paramcount|1|1|
|`address`|1c003594c|1400454a8|
|sig|undefined8 __fastcall PrjfCreatePathTree(undefined8 * param_1)|undefined8 __fastcall PrjfCreatePathTree(undefined8 * param_1)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfCreatePathTree Called Diff
```diff
--- PrjfCreatePathTree called
+++ PrjfCreatePathTree called
@@ -2 +2 @@
-WPP_RECORDER_SF_sD
+WPP_RECORDER_AND_TRACE_SF_sD
```
### PrjfCreatePathTree Diff
```diff
--- PrjfCreatePathTree
+++ PrjfCreatePathTree
@@ -1,26 +1,30 @@
undefined8 PrjfCreatePathTree(undefined8 *param_1)
{
undefined8 *puVar1;
undefined8 uVar2;
uVar2 = 0;
*param_1 = 0;
puVar1 = (undefined8 *)ExAllocatePool2(0x100,0x10,0x6d6e4a50);
if (puVar1 == (undefined8 *)0x0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sD(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x14,0x25,
- &WPP_5c05f7cae5513ff3734adbc0d3bd9537_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\mapping.c");
+ if (((DAT_0 & 0x10) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sD
+ (0x214,DAT_0 & 0x10,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x14,0x25,
+ &WPP_0314efc3b1f93d76a134ccc0e69e0e16_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\mapping.c");
}
uVar2 = 0xc000009a;
}
else {
*puVar1 = 0;
puVar1[1] = 0;
*param_1 = puVar1;
}
return uVar2;
}
```
## PrjfSendGetPlaceholderInformationCommand
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.27|
|i_ratio|0.62|
|m_ratio|0.94|
|b_ratio|0.91|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfSendGetPlaceholderInformationCommand|PrjfSendGetPlaceholderInformationCommand|
|fullname|PrjfSendGetPlaceholderInformationCommand|PrjfSendGetPlaceholderInformationCommand|
|refcount|2|2|
|`length`|451|529|
|`called`|PrjfFreeCommandBuffer
PrjfPrepareCommandForFilePath
PrjfSendCommand
WPP_RECORDER_SF_sDdZ|PrjfFreeCommandBuffer
PrjfPrepareCommandForFilePath
PrjfSendCommand
WPP_RECORDER_AND_TRACE_SF_sDdZ|
|calling|PrjfPopulateFile|PrjfPopulateFile|
|paramcount|6|6|
|`address`|1c0028400|14003544c|
|sig|ulonglong __fastcall PrjfSendGetPlaceholderInformationCommand(longlong param_1, undefined8 param_2, undefined8 * param_3, wchar_t * param_4, undefined8 * param_5, longlong param_6)|ulonglong __fastcall PrjfSendGetPlaceholderInformationCommand(longlong param_1, undefined8 param_2, undefined8 * param_3, wchar_t * param_4, undefined8 * param_5, longlong param_6)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfSendGetPlaceholderInformationCommand Called Diff
```diff
--- PrjfSendGetPlaceholderInformationCommand called
+++ PrjfSendGetPlaceholderInformationCommand called
@@ -4 +4 @@
-WPP_RECORDER_SF_sDdZ
+WPP_RECORDER_AND_TRACE_SF_sDdZ
```
### PrjfSendGetPlaceholderInformationCommand Diff
```diff
--- PrjfSendGetPlaceholderInformationCommand
+++ PrjfSendGetPlaceholderInformationCommand
@@ -1,99 +1,101 @@
/* WARNING: Type propagation algorithm not settling */
ulonglong PrjfSendGetPlaceholderInformationCommand
(longlong param_1,undefined8 param_2,undefined8 *param_3,wchar_t *param_4,
undefined8 *param_5,longlong param_6)
{
undefined8 *puVar1;
- uint *puVar2;
- uint uVar3;
- ulonglong uVar4;
- uint *puVar5;
- longlong lVar6;
- ulonglong uVar7;
- undefined2 uVar8;
+ undefined8 uVar2;
+ uint *puVar3;
+ uint uVar4;
+ ulonglong uVar5;
+ uint *puVar6;
+ byte bVar7;
+ longlong lVar8;
+ bool bVar9;
uint local_res18 [2];
- undefined8 uVar9;
- undefined4 uVar10;
- uint **ppuVar11;
- undefined8 uVar12;
+ ushort uVar10;
+ undefined4 uVar11;
+ undefined4 in_stack_ffffffffffffffb4;
+ undefined4 in_stack_ffffffffffffffbc;
int local_38 [2];
uint *local_30;
undefined8 local_28;
undefined8 uStack_20;
- undefined4 uVar13;
local_28 = *param_3;
uStack_20 = param_3[1];
local_30 = (uint *)0x0;
local_res18[0] = 0;
local_38[1] = 0;
- ppuVar11 = &local_30;
local_38[0] = 4;
- uVar10 = 0;
- uVar4 = PrjfPrepareCommandForFilePath
+ uVar5 = PrjfPrepareCommandForFilePath
((ushort *)param_4,&local_28,4,(ushort *)param_4,(undefined8 *)0x0,param_6,
- (undefined8 *)0x0,ppuVar11,local_res18);
- puVar2 = local_30;
- uVar13 = (undefined4)((ulonglong)ppuVar11 >> 0x20);
- uVar7 = uVar4 & 0xffffffff;
+ (undefined8 *)0x0,&local_30,local_res18);
+ puVar3 = local_30;
+ uVar4 = (uint)uVar5;
+ uVar5 = uVar5 & 0xffffffff;
if ((int)uVar4 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0;
- uVar8 = 0x8d;
- uVar12 = CONCAT44(uVar13,(int)uVar4);
- uVar9 = CONCAT44(uVar10,0x1013);
+ bVar9 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar7 = DAT_0 & 0x40;
+ if ((bVar7 == 0) && (!bVar9)) goto LAB_1;
+ uVar11 = 0x110a;
+ uVar10 = 0x97;
}
else {
- lVar6 = 2;
- puVar5 = local_30 + 0xf;
+ lVar8 = 2;
+ puVar6 = local_30 + 0xf;
do {
- uVar9 = param_5[1];
- *(undefined8 *)puVar5 = *param_5;
- *(undefined8 *)(puVar5 + 2) = uVar9;
- uVar9 = param_5[3];
- *(undefined8 *)(puVar5 + 4) = param_5[2];
- *(undefined8 *)(puVar5 + 6) = uVar9;
- uVar9 = param_5[5];
- *(undefined8 *)(puVar5 + 8) = param_5[4];
- *(undefined8 *)(puVar5 + 10) = uVar9;
- uVar9 = param_5[7];
- *(undefined8 *)(puVar5 + 0xc) = param_5[6];
- *(undefined8 *)(puVar5 + 0xe) = uVar9;
- uVar9 = param_5[9];
- *(undefined8 *)(puVar5 + 0x10) = param_5[8];
- *(undefined8 *)(puVar5 + 0x12) = uVar9;
- uVar9 = param_5[0xb];
- *(undefined8 *)(puVar5 + 0x14) = param_5[10];
- *(undefined8 *)(puVar5 + 0x16) = uVar9;
- uVar9 = param_5[0xd];
- *(undefined8 *)(puVar5 + 0x18) = param_5[0xc];
- *(undefined8 *)(puVar5 + 0x1a) = uVar9;
+ uVar2 = param_5[1];
+ *(undefined8 *)puVar6 = *param_5;
+ *(undefined8 *)(puVar6 + 2) = uVar2;
+ uVar2 = param_5[3];
+ *(undefined8 *)(puVar6 + 4) = param_5[2];
+ *(undefined8 *)(puVar6 + 6) = uVar2;
+ uVar2 = param_5[5];
+ *(undefined8 *)(puVar6 + 8) = param_5[4];
+ *(undefined8 *)(puVar6 + 10) = uVar2;
+ uVar2 = param_5[7];
+ *(undefined8 *)(puVar6 + 0xc) = param_5[6];
+ *(undefined8 *)(puVar6 + 0xe) = uVar2;
+ uVar2 = param_5[9];
+ *(undefined8 *)(puVar6 + 0x10) = param_5[8];
+ *(undefined8 *)(puVar6 + 0x12) = uVar2;
+ uVar2 = param_5[0xb];
+ *(undefined8 *)(puVar6 + 0x14) = param_5[10];
+ *(undefined8 *)(puVar6 + 0x16) = uVar2;
+ uVar2 = param_5[0xd];
+ *(undefined8 *)(puVar6 + 0x18) = param_5[0xc];
+ *(undefined8 *)(puVar6 + 0x1a) = uVar2;
puVar1 = param_5 + 0xe;
- uVar9 = param_5[0xf];
+ uVar2 = param_5[0xf];
param_5 = param_5 + 0x10;
- *(undefined8 *)(puVar5 + 0x1c) = *puVar1;
- *(undefined8 *)(puVar5 + 0x1e) = uVar9;
- lVar6 = lVar6 + -1;
- puVar5 = puVar5 + 0x20;
- } while (lVar6 != 0);
- uVar3 = PrjfSendCommand(param_1,param_2,local_30,0,(longlong)(local_38 + 1),local_38);
- uVar7 = (ulonglong)uVar3;
- if ((((uVar3 + 0x80000000 & 0x80000000) != 0) || (uVar3 == 0xc0000034)) ||
- ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) goto LAB_0;
- uVar8 = 0x8e;
- uVar12 = CONCAT44(uVar13,uVar3);
- uVar9 = CONCAT44(uVar10,0x102e);
+ *(undefined8 *)(puVar6 + 0x1c) = *puVar1;
+ *(undefined8 *)(puVar6 + 0x1e) = uVar2;
+ lVar8 = lVar8 + -1;
+ puVar6 = puVar6 + 0x20;
+ } while (lVar8 != 0);
+ uVar4 = PrjfSendCommand(param_1,param_2,local_30,0,(longlong)(local_38 + 1),local_38);
+ uVar5 = (ulonglong)uVar4;
+ if (((uVar4 + 0x80000000 & 0x80000000) != 0) || (uVar4 == 0xc0000034)) goto LAB_1;
+ bVar9 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar7 = DAT_0 & 0x40;
+ if ((bVar7 == 0) && (!bVar9)) goto LAB_1;
+ uVar11 = 0x1125;
+ uVar10 = 0x98;
}
- WPP_RECORDER_SF_sDdZ
- (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,uVar8,
- &WPP_3ccab5108a9538d17a865fde27ef339f_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c",uVar9,uVar12,param_4);
-LAB_0:
- if (puVar2 != (uint *)0x0) {
- PrjfFreeCommandBuffer((longlong)puVar2,local_res18[0]);
+ WPP_RECORDER_AND_TRACE_SF_sDdZ
+ (0x20e,bVar7,bVar9,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,uVar10,
+ &WPP_39279db927ae337b8503ecc20725ff46_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c",
+ CONCAT44(in_stack_ffffffffffffffb4,uVar11),CONCAT44(in_stack_ffffffffffffffbc,uVar4),
+ param_4);
+LAB_1:
+ if (puVar3 != (uint *)0x0) {
+ PrjfFreeCommandBuffer((longlong)puVar3,local_res18[0]);
}
- return uVar7;
+ return uVar5;
}
```
## PrjfManageHydrationOnNonCachedHandle
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,sig,address,called|
|ratio|0.15|
|i_ratio|0.17|
|m_ratio|0.81|
|b_ratio|0.12|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfManageHydrationOnNonCachedHandle|PrjfManageHydrationOnNonCachedHandle|
|fullname|PrjfManageHydrationOnNonCachedHandle|PrjfManageHydrationOnNonCachedHandle|
|refcount|2|2|
|`length`|1479|2156|
|`called`|Expand for full list:
FLTMGR.SYS::FltAllocatePoolAlignedWithTag
FLTMGR.SYS::FltFreePoolAlignedWithTag
FLTMGR.SYS::FltWriteFileEx
MicrosoftTelemetryAssertTriggeredMsgKM
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::IoGetRelatedDeviceObject
NTOSKRNL.EXE::MmMapLockedPagesSpecifyCache
WPP_RECORDER_SF_sDDd
WPP_RECORDER_SF_sDd
WPP_RECORDER_SF_sDdPZ
WPP_RECORDER_SF_sDdZ
WPP_RECORDER_SF_sDiD
WPP_RECORDER_SF_sDiid
memcpyExpand for full list:
FLTMGR.SYS::FltAllocatePoolAlignedWithTag
FLTMGR.SYS::FltFreePoolAlignedWithTag
FLTMGR.SYS::FltWriteFileEx
Feature_HydrateLargeNonCachedFiles__private_IsEnabledDeviceUsageNoInline
MicrosoftTelemetryAssertTriggeredMsgKM
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::IoGetRelatedDeviceObject
NTOSKRNL.EXE::MmMapLockedPagesSpecifyCache
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDDD
WPP_RECORDER_AND_TRACE_SF_sDdPZ
WPP_RECORDER_AND_TRACE_SF_sDdZ
WPP_RECORDER_AND_TRACE_SF_sDiD
WPP_RECORDER_AND_TRACE_SF_sDid
WPP_RECORDER_AND_TRACE_SF_sDiid
WPP_RECORDER_AND_TRACE_SF_sDiiiid
memmoveExpand for full list:
FLTMGR.SYS::FltGetFileNameInformationUnsafe
FLTMGR.SYS::FltParseFileName
FLTMGR.SYS::FltReferenceContext
FLTMGR.SYS::FltReleaseContext
FLTMGR.SYS::FltReleaseFileNameInformation
FLTMGR.SYS::FltReleaseResource
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::KeWaitForSingleObject
NTOSKRNL.EXE::RtlAppendUnicodeStringToString
NTOSKRNL.EXE::RtlAppendUnicodeToString
NTOSKRNL.EXE::RtlInitUnicodeString
NTOSKRNL.EXE::RtlRemoveEntryHashTable
PrjfAllocateUnicodeString
PrjfCreateTombstone
PrjfGetContextFileObject
PrjfLookupInMemoryTombstoneEntry
PrjfTelemetryTombstoneFailureOperation
WPP_RECORDER_SF_sDdExpand for full list:
FLTMGR.SYS::FltGetFileNameInformationUnsafe
FLTMGR.SYS::FltParseFileName
FLTMGR.SYS::FltReferenceContext
FLTMGR.SYS::FltReleaseContext
FLTMGR.SYS::FltReleaseFileNameInformation
FLTMGR.SYS::FltReleaseResource
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::KeWaitForSingleObject
NTOSKRNL.EXE::RtlAppendUnicodeStringToString
NTOSKRNL.EXE::RtlAppendUnicodeToString
NTOSKRNL.EXE::RtlInitUnicodeString
NTOSKRNL.EXE::RtlRemoveEntryHashTable
PrjfAllocateUnicodeString
PrjfCreateTombstone
PrjfGetContextFileObject
PrjfLookupInMemoryTombstoneEntry
PrjfTelemetryTombstoneFailureOperation
WPP_RECORDER_AND_TRACE_SF_sDD
PrjfProcessPreRenameOrLinkInformation|PrjfProcessPostRenameOrLinkInformation
PrjfProcessPreRenameOrLinkInformation|
|paramcount|4|4|
|`address`|1c003317c|1400427e4|
|sig|ulonglong __fastcall PrjfCleanUpRenameLinkTargetTombstone(longlong param_1, longlong param_2, longlong param_3, char param_4)|ulonglong __fastcall PrjfCleanUpRenameLinkTargetTombstone(longlong param_1, longlong param_2, longlong param_3, char param_4)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfCleanUpRenameLinkTargetTombstone Called Diff
```diff
--- PrjfCleanUpRenameLinkTargetTombstone called
+++ PrjfCleanUpRenameLinkTargetTombstone called
@@ -19 +19 @@
-WPP_RECORDER_SF_sDd
+WPP_RECORDER_AND_TRACE_SF_sDD
```
### PrjfCleanUpRenameLinkTargetTombstone Diff
```diff
--- PrjfCleanUpRenameLinkTargetTombstone
+++ PrjfCleanUpRenameLinkTargetTombstone
@@ -1,154 +1,166 @@
ulonglong PrjfCleanUpRenameLinkTargetTombstone
(longlong param_1,longlong param_2,longlong param_3,char param_4)
{
longlong lVar1;
char cVar2;
char cVar3;
uint uVar4;
int iVar5;
ulonglong uVar6;
longlong lVar7;
ulonglong uVar8;
longlong lVar9;
longlong lVar10;
int local_res8 [2];
longlong local_78;
longlong local_70;
longlong local_68;
longlong local_60;
undefined8 local_58;
longlong lStack_50;
undefined2 local_48;
undefined2 local_46;
undefined4 local_44;
longlong local_40;
undefined8 local_38;
undefined8 uStack_30;
lVar7 = 0;
local_60 = 0;
lVar10 = *(longlong *)(*(longlong *)(param_1 + 0x10) + 0x38);
local_38 = 0;
uStack_30 = 0;
local_44 = 0;
cVar3 = '\0';
local_68 = 0;
local_58 = 0;
lStack_50 = 0;
local_70 = 0;
local_res8[0] = 0;
local_78 = 0;
RtlInitUnicodeString(&local_58);
local_46 = *(undefined2 *)(lVar10 + 0x10);
local_48 = *(undefined2 *)(lVar10 + 0x10);
local_40 = lVar10 + 0x14;
uVar4 = FltParseFileName(&local_48,0,0,&local_38);
uVar8 = (ulonglong)uVar4;
lVar10 = lVar7;
if ((int)uVar4 < 0) goto LAB_0;
cVar2 = PrjfGetContextFileObject
(*(undefined8 *)(param_2 + 0x18),*(undefined8 *)(param_3 + 0x50),&local_70,
&local_60);
lVar10 = local_70;
if (cVar2 == '\0') goto LAB_0;
uVar4 = PrjfLookupInMemoryTombstoneEntry(local_70,&local_38,1,local_res8,&local_78);
uVar8 = (ulonglong)uVar4;
if (uVar4 == 0xc0000225) {
uVar8 = 0;
goto LAB_0;
}
if ((int)uVar4 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x13,0x21,
- &WPP_4079bacae6ce31fd7110e995a8b7a7c9_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\tombstone.c");
+ if (((DAT_1 & 8) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x213,DAT_1 & 8,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x13,0x21,
+ &WPP_4079bacae6ce31fd7110e995a8b7a7c9_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\tombstone.c");
}
goto LAB_0;
}
if (param_4 == '\0') {
-LAB_1:
+LAB_2:
lVar9 = local_78;
cVar3 = RtlRemoveEntryHashTable(lVar10 + 0xf0,local_78,0);
-LAB_2:
+LAB_3:
FltReleaseResource(lVar10 + 0x88);
if (cVar3 != '\0') {
if (*(longlong *)(lVar9 + 0x28) != 0) {
ExFreePoolWithTag(*(longlong *)(lVar9 + 0x28),0x6e664a50);
}
if (*(longlong *)(lVar9 + 0x30) != 0) {
FltReleaseContext();
}
ExFreePoolWithTag(lVar9,0x74684a50);
}
}
else {
FltGetFileNameInformationUnsafe
(*(undefined8 *)(param_3 + 0x50),*(undefined8 *)(param_2 + 0x18),0x301,&local_68);
lVar9 = local_78;
local_58._0_4_ =
CONCAT22(*(short *)(local_68 + 10) + *(short *)(local_78 + 0x22) + 2,(undefined2)local_58);
uVar6 = PrjfAllocateUnicodeString(0x6e664a50,(undefined2 *)&local_58);
uVar8 = uVar6 & 0xffffffff;
if ((int)uVar6 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x13,0x22,
- &WPP_4079bacae6ce31fd7110e995a8b7a7c9_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\tombstone.c");
+ if (((DAT_1 & 8) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x213,DAT_1 & 8,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x13,0x22,
+ &WPP_4079bacae6ce31fd7110e995a8b7a7c9_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\tombstone.c");
lVar7 = 0;
}
- goto LAB_2;
+ goto LAB_3;
}
RtlAppendUnicodeStringToString(&local_58,local_68 + 8);
RtlAppendUnicodeToString(&local_58,L"\\");
RtlAppendUnicodeStringToString(&local_58,lVar9 + 0x20);
lVar1 = *(longlong *)(lVar9 + 0x30);
cVar3 = *(char *)(lVar9 + 0x18);
if (lVar1 != 0) {
FltReferenceContext(lVar1);
lVar7 = lVar1;
}
FltReleaseResource(lVar10 + 0x88);
KeWaitForSingleObject(lVar7 + 0x120,0,0,0,0);
if (*(char *)(lVar7 + 0x11a) == '\0') {
iVar5 = PrjfCreateTombstone(*(undefined8 *)(param_2 + 0x18),&local_58,cVar3);
if (iVar5 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,0x23,
- &WPP_4079bacae6ce31fd7110e995a8b7a7c9_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\tombstone.c");
+ if (((DAT_4 & 0x20) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x205,DAT_4 & 0x20,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,0x23,
+ &WPP_4079bacae6ce31fd7110e995a8b7a7c9_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\tombstone.c");
}
PrjfTelemetryTombstoneFailureOperation(1,7,iVar5);
}
}
lVar10 = local_70;
uVar4 = PrjfLookupInMemoryTombstoneEntry(local_70,&local_38,1,local_res8,&local_78);
uVar8 = (ulonglong)uVar4;
if (uVar4 != 0xc0000225) {
if ((int)uVar4 < 0) {
MicrosoftTelemetryAssertTriggeredNoArgsKM();
}
- goto LAB_1;
+ goto LAB_2;
}
uVar8 = 0;
}
if (lVar7 != 0) {
FltReleaseContext(lVar7);
}
LAB_0:
if (lStack_50 != 0) {
ExFreePoolWithTag(lStack_50,0x6e664a50);
}
if (local_68 != 0) {
FltReleaseFileNameInformation();
}
if (lVar10 != 0) {
FltReleaseContext(lVar10);
}
if (local_60 != 0) {
FltReleaseContext();
}
return uVar8;
}
```
## PrjfGetNotificationMask
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,sig,address,called|
|ratio|0.45|
|i_ratio|0.26|
|m_ratio|0.89|
|b_ratio|0.85|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfGetNotificationMask|PrjfGetNotificationMask|
|fullname|PrjfGetNotificationMask|PrjfGetNotificationMask|
|refcount|7|7|
|`length`|282|353|
|`called`|PrjfMappingLookup
WPP_RECORDER_SF_sDdZ
WPP_RECORDER_SF_sDsDZ|PrjfMappingLookup
WPP_RECORDER_AND_TRACE_SF_sDdZ
WPP_RECORDER_AND_TRACE_SF_sDsDZ|
|calling|PrjfNotifyRenameOrLinkOperation
PrjfProcessOpenWithinVirtualizationRoots|PrjfNotifyRenameOrLinkOperation
PrjfProcessOpenWithinVirtualizationRoots|
|paramcount|3|3|
|`address`|1c002d294|14003af84|
|`sig`|uint __fastcall PrjfGetNotificationMask(wchar_t * param_1, longlong param_2, undefined8 param_3)|uint __fastcall PrjfGetNotificationMask(wchar_t * param_1, char * param_2, undefined8 param_3)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfGetNotificationMask Called Diff
```diff
--- PrjfGetNotificationMask called
+++ PrjfGetNotificationMask called
@@ -2,2 +2,2 @@
-WPP_RECORDER_SF_sDdZ
-WPP_RECORDER_SF_sDsDZ
+WPP_RECORDER_AND_TRACE_SF_sDdZ
+WPP_RECORDER_AND_TRACE_SF_sDsDZ
```
### PrjfGetNotificationMask Diff
```diff
--- PrjfGetNotificationMask
+++ PrjfGetNotificationMask
@@ -1,35 +1,47 @@
-uint PrjfGetNotificationMask(wchar_t *param_1,longlong param_2,undefined8 param_3)
+uint PrjfGetNotificationMask(wchar_t *param_1,char *param_2,undefined8 param_3)
{
int iVar1;
uint uVar2;
+ char cVar3;
uint local_res18 [2];
uint local_res20 [2];
- undefined4 in_stack_ffffffffffffffdc;
- undefined8 in_stack_ffffffffffffffe0;
- undefined4 uVar3;
+ undefined4 in_stack_ffffffffffffffd4;
+ undefined8 in_stack_ffffffffffffffd8;
+ undefined4 uVar4;
- uVar3 = (undefined4)((ulonglong)in_stack_ffffffffffffffe0 >> 0x20);
+ uVar4 = (undefined4)((ulonglong)in_stack_ffffffffffffffd8 >> 0x20);
local_res20[0] = 0;
local_res18[0] = 0;
uVar2 = 1;
- iVar1 = PrjfMappingLookup(param_2,(ushort *)param_1,param_3,local_res20,local_res18);
+ iVar1 = PrjfMappingLookup((longlong)param_2,(ushort *)param_1,param_3,local_res20,local_res18);
if (iVar1 == 0) {
+ if (((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) ||
+ (cVar3 = '\x01', *(short *)(WPP_GLOBAL_Control + 0x48) == 0)) {
+ cVar3 = '\0';
+ }
uVar2 = local_res20[0];
- if (((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) &&
- (*(short *)(WPP_GLOBAL_Control + 0x48) != 0)) {
- WPP_RECORDER_SF_sDsDZ();
+ if (((DAT_0 & 0x10) != 0) || (cVar3 != '\0')) {
+ if ((local_res18[0] & 1) == 0) {
+ param_2 = "";
+ }
+ WPP_RECORDER_AND_TRACE_SF_sDsDZ(param_2,DAT_0 & 0x10,cVar3);
}
}
- else if ((iVar1 != -0x3fffffc6) &&
- (uVar2 = 0, (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
- WPP_RECORDER_SF_sDdZ
- (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x14,0xab,
- &WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",
- CONCAT44(in_stack_ffffffffffffffdc,0x1c95),CONCAT44(uVar3,iVar1),param_1);
+ else if (iVar1 != -0x3fffffc6) {
+ uVar2 = 0;
+ if (((DAT_1 & 0x10) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDdZ
+ (0x214,DAT_1 & 0x10,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x14,0xad,
+ &WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",
+ CONCAT44(in_stack_ffffffffffffffd4,0x1ccc),CONCAT44(uVar4,iVar1),param_1);
+ }
}
return uVar2;
}
```
## PrjfOpenAndCheckEmptyPartialDirectory
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,sig,address,called|
|ratio|0.55|
|i_ratio|0.47|
|m_ratio|0.89|
|b_ratio|0.82|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfOpenAndCheckEmptyPartialDirectory|PrjfOpenAndCheckEmptyPartialDirectory|
|fullname|PrjfOpenAndCheckEmptyPartialDirectory|PrjfOpenAndCheckEmptyPartialDirectory|
|refcount|2|2|
|`length`|434|556|
|`called`|FLTMGR.SYS::FltClose
NTOSKRNL.EXE::ObfDereferenceObject
PrjfIsDirectoryEmpty
PrjfOpenAsReparsePoint
WPP_RECORDER_SF_sDdZ|FLTMGR.SYS::FltClose
NTOSKRNL.EXE::ObfDereferenceObject
PrjfIsDirectoryEmpty
PrjfOpenAsReparsePoint
WPP_RECORDER_AND_TRACE_SF_sDdZ|
|calling|PrjfPrepareDestinationForRenameOrLink|PrjfPrepareDestinationForRenameOrLink|
|paramcount|5|5|
|`address`|1c00063e4|140007db0|
|`sig`|int __fastcall PrjfOpenAndCheckEmptyPartialDirectory(longlong param_1, undefined8 * * * * param_2, wchar_t * param_3, undefined8 param_4, undefined1 * param_5)|int __fastcall PrjfOpenAndCheckEmptyPartialDirectory(longlong param_1, longlong param_2, wchar_t * param_3, undefined8 param_4, undefined1 * param_5)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfOpenAndCheckEmptyPartialDirectory Called Diff
```diff
--- PrjfOpenAndCheckEmptyPartialDirectory called
+++ PrjfOpenAndCheckEmptyPartialDirectory called
@@ -5 +5 @@
-WPP_RECORDER_SF_sDdZ
+WPP_RECORDER_AND_TRACE_SF_sDdZ
```
### PrjfOpenAndCheckEmptyPartialDirectory Diff
```diff
--- PrjfOpenAndCheckEmptyPartialDirectory
+++ PrjfOpenAndCheckEmptyPartialDirectory
@@ -1,76 +1,80 @@
int PrjfOpenAndCheckEmptyPartialDirectory
- (longlong param_1,undefined8 ****param_2,wchar_t *param_3,undefined8 param_4,
+ (longlong param_1,longlong param_2,wchar_t *param_3,undefined8 param_4,
undefined1 *param_5)
{
int extraout_EAX;
int extraout_EAX_00;
- int iVar1;
- undefined2 uVar2;
+ byte bVar1;
+ int iVar2;
undefined8 uVar3;
+ bool bVar4;
undefined8 in_stack_ffffffffffffff98;
- longlong *plVar4;
- undefined4 uVar5;
- byte *pbVar6;
+ ushort uVar5;
+ undefined4 uVar6;
+ undefined8 uVar7;
undefined4 uVar8;
- undefined8 uVar7;
byte local_28;
undefined1 local_27 [7];
longlong local_20;
longlong local_18 [2];
- pbVar6 = &local_28;
+ uVar8 = 0;
+ uVar6 = 0;
local_18[0] = 0;
local_20 = 0;
uVar3 = 0x80;
- plVar4 = &local_20;
local_28 = 0;
local_27[0] = 0;
PrjfOpenAsReparsePoint
(param_3,param_4,param_2,0x80,in_stack_ffffffffffffff98,(longlong)local_18,
- (longlong)plVar4,pbVar6,(byte *)0x0,(undefined8 *******)0x0,(byte *)0x0,(uint *)0x0);
- uVar8 = (undefined4)((ulonglong)pbVar6 >> 0x20);
- uVar5 = (undefined4)((ulonglong)plVar4 >> 0x20);
+ (longlong)&local_20,&local_28,(byte *)0x0,(byte *)0x0,(undefined8 *******)0x0,
+ (uint *)0x0);
if (extraout_EAX < 0) {
- iVar1 = extraout_EAX;
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0;
- uVar2 = 0x71;
+ bVar4 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar1 = DAT_0 & 0x20;
+ if ((bVar1 == 0) && (iVar2 = extraout_EAX, !bVar4)) goto LAB_1;
uVar7 = CONCAT44(uVar8,extraout_EAX);
- uVar3 = CONCAT44(uVar5,0x144b);
- iVar1 = extraout_EAX;
+ uVar3 = CONCAT44(uVar6,0x1482);
+ uVar5 = 0x73;
+ iVar2 = extraout_EAX;
}
else if (local_28 == 0) {
- iVar1 = -0x3ffffd8b;
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0;
- uVar2 = 0x72;
+ iVar2 = -0x3ffffd8b;
+ bVar4 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar1 = DAT_0 & 0x20;
+ if ((bVar1 == 0) && (!bVar4)) goto LAB_1;
uVar7 = CONCAT44(uVar8,0xc0000275);
- uVar3 = CONCAT44(uVar5,0x145b);
- iVar1 = -0x3ffffd8b;
+ uVar3 = CONCAT44(uVar6,0x1492);
+ uVar5 = 0x74;
+ iVar2 = -0x3ffffd8b;
}
else {
PrjfIsDirectoryEmpty(param_1,param_2,local_20,uVar3,local_27);
- iVar1 = extraout_EAX_00;
+ iVar2 = extraout_EAX_00;
if (-1 < extraout_EAX_00) {
*param_5 = local_27[0];
- goto LAB_0;
+ goto LAB_1;
}
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0;
- uVar2 = 0x73;
+ bVar4 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar1 = DAT_0 & 0x20;
+ if ((bVar1 == 0) && (!bVar4)) goto LAB_1;
uVar7 = CONCAT44(uVar8,extraout_EAX_00);
- uVar3 = CONCAT44(uVar5,0x146b);
+ uVar3 = CONCAT44(uVar6,0x14a2);
+ uVar5 = 0x75;
}
- WPP_RECORDER_SF_sDdZ
- (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xd,uVar2,
- &WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,
+ WPP_RECORDER_AND_TRACE_SF_sDdZ
+ (0x20d,bVar1,bVar4,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xd,uVar5,
+ &WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
"onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",uVar3,uVar7,param_3);
-LAB_0:
+LAB_1:
if (local_18[0] != 0) {
FltClose();
}
if (local_20 != 0) {
ObfDereferenceObject();
}
- return iVar1;
+ return iVar2;
}
```
## PrjfOpenAsReparsePoint
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,sig,address,called|
|ratio|0.18|
|i_ratio|0.33|
|m_ratio|0.94|
|b_ratio|0.78|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfOpenAsReparsePoint|PrjfOpenAsReparsePoint|
|fullname|PrjfOpenAsReparsePoint|PrjfOpenAsReparsePoint|
|refcount|7|7|
|`length`|1347|1560|
|`called`|FLTMGR.SYS::FltGetInstanceContext
FLTMGR.SYS::FltReleaseContext
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExAllocateFromPagedLookasideList
NTOSKRNL.EXE::ExFreeToPagedLookasideList
PrjfOpenReparsePoint
WPP_RECORDER_SF_sDd
WPP_RECORDER_SF_sDdZssss|FLTMGR.SYS::FltGetInstanceContext
FLTMGR.SYS::FltReleaseContext
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExAllocateFromPagedLookasideList
NTOSKRNL.EXE::ExFreeToPagedLookasideList
PrjfOpenReparsePoint
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDdZssss|
|calling|PrjfDecideUpdateDeleteOnFileStateAndUpdateFlags
PrjfDeleteTombstoneIfExists
PrjfOpenAndCheckEmptyPartialDirectory
PrjfPostCreate
PrjfProcessFileDirectoryStatus
PrjfProcessTombstoneBounce|PrjfDecideUpdateDeleteOnFileStateAndUpdateFlags
PrjfDeleteTombstoneIfExists
PrjfOpenAndCheckEmptyPartialDirectory
PrjfPostCreate
PrjfProcessFileDirectoryStatus
PrjfProcessTombstoneBounce|
|paramcount|12|12|
|`address`|1c002e4b8|14003c840|
|`sig`|int __fastcall PrjfOpenAsReparsePoint(wchar_t * param_1, undefined8 param_2, undefined8 param_3, undefined4 param_4, undefined8 param_5, longlong param_6, longlong param_7, byte * param_8, byte * param_9, undefined8 * * * * * * * param_10, byte * param_11, uint * param_12)|int __fastcall PrjfOpenAsReparsePoint(wchar_t * param_1, undefined8 param_2, undefined8 param_3, undefined4 param_4, undefined8 param_5, longlong param_6, longlong param_7, byte * param_8, byte * param_9, byte * param_10, undefined8 * * * * * * * param_11, uint * param_12)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfOpenAsReparsePoint Called Diff
```diff
--- PrjfOpenAsReparsePoint called
+++ PrjfOpenAsReparsePoint called
@@ -7,2 +7,2 @@
-WPP_RECORDER_SF_sDd
-WPP_RECORDER_SF_sDdZssss
+WPP_RECORDER_AND_TRACE_SF_sDD
+WPP_RECORDER_AND_TRACE_SF_sDdZssss
```
### PrjfOpenAsReparsePoint Diff
```diff
--- PrjfOpenAsReparsePoint
+++ PrjfOpenAsReparsePoint
@@ -1,257 +1,274 @@
-
-/* WARNING: Removing unreachable block (ram,0x0001c002e966) */
int PrjfOpenAsReparsePoint
(wchar_t *param_1,undefined8 param_2,undefined8 param_3,undefined4 param_4,
undefined8 param_5,longlong param_6,longlong param_7,byte *param_8,byte *param_9,
- undefined8 *******param_10,byte *param_11,uint *param_12)
+ byte *param_10,undefined8 *******param_11,uint *param_12)
{
undefined8 uVar1;
code *pcVar2;
int iVar3;
- undefined8 *********pppppppppuVar4;
- undefined8 *********pppppppppuVar5;
- undefined8 *********pppppppppuVar6;
- undefined8 *********pppppppppuVar7;
+ undefined8 ********ppppppppuVar4;
+ undefined8 ********ppppppppuVar5;
+ undefined8 ********ppppppppuVar6;
+ undefined8 ********ppppppppuVar7;
ulonglong uVar8;
char *pcVar9;
- char *pcVar10;
- uint uVar11;
+ undefined8 ********ppppppppuVar10;
+ undefined1 *puVar11;
undefined1 *puVar12;
undefined1 *puVar13;
- undefined1 *puVar14;
- undefined8 *********pppppppppuVar15;
+ char *pcVar14;
+ byte bVar15;
char *pcVar16;
- undefined2 uVar17;
- byte *unaff_R12;
- undefined8 *********pppppppppuVar18;
- undefined8 *********pppppppppuVar19;
- undefined8 *********pppppppppuVar20;
- undefined1 auStackY_d8 [8];
- undefined1 auStackY_d0 [24];
- undefined8 ********local_60;
- undefined8 ********local_58;
+ undefined8 ********ppppppppuVar17;
+ byte *unaff_R13;
+ undefined8 ********ppppppppuVar18;
+ uint uVar19;
+ bool bVar20;
+ undefined1 auStackY_e8 [8];
+ undefined1 auStackY_e0 [24];
+ ushort uVar21;
+ longlong local_68;
+ undefined8 *******local_60;
+ undefined8 *******local_58;
- puVar12 = auStackY_d8;
- puVar13 = auStackY_d8;
- pppppppppuVar18 = (undefined8 *********)0x0;
- uVar11 = 0x80000004;
- pppppppppuVar20 = (undefined8 *********)0x0;
- pppppppppuVar15 = (undefined8 *********)0x0;
- puVar14 = auStackY_d8;
- if ((param_6 == 0) || (puVar14 = auStackY_d8, param_7 == 0)) goto LAB_0;
- FltGetInstanceContext(param_3);
- MicrosoftTelemetryAssertTriggeredNoArgsKM();
- if ((iRam0000000000000018 != 2) && (iRam0000000000000018 != 0x1c)) {
+ puVar11 = auStackY_e8;
+ puVar12 = auStackY_e8;
+ ppppppppuVar17 = (undefined8 ********)0x0;
+ uVar19 = 0x80000004;
+ local_68 = 0;
+ ppppppppuVar18 = (undefined8 ********)0x0;
+ ppppppppuVar10 = (undefined8 ********)0x0;
+ puVar13 = auStackY_e8;
+ if ((param_6 == 0) || (puVar13 = auStackY_e8, param_7 == 0)) goto LAB_0;
+ iVar3 = FltGetInstanceContext(param_3,&local_68);
+ if ((iVar3 < 0) || (local_68 == 0)) {
MicrosoftTelemetryAssertTriggeredNoArgsKM();
}
+ if ((*(int *)(local_68 + 0x18) != 2) && (*(int *)(local_68 + 0x18) != 0x1c)) {
+ MicrosoftTelemetryAssertTriggeredNoArgsKM();
+ }
if (param_12 != (uint *)0x0) {
- uVar11 = *param_12;
+ uVar19 = *param_12;
}
local_58 = &local_60;
local_60 = &local_60;
- pppppppppuVar4 = pppppppppuVar18;
- pppppppppuVar7 = pppppppppuVar18;
- pppppppppuVar19 = pppppppppuVar18;
- pppppppppuVar5 = pppppppppuVar18;
- pppppppppuVar6 = pppppppppuVar18;
+ ppppppppuVar4 = ppppppppuVar17;
+ ppppppppuVar7 = ppppppppuVar17;
+ ppppppppuVar5 = ppppppppuVar17;
+ ppppppppuVar6 = ppppppppuVar17;
if (param_8 == (byte *)0x0) {
LAB_1:
- uVar11 = uVar11 | 0x80000000;
- pppppppppuVar7 = pppppppppuVar15;
+ uVar19 = uVar19 | 0x80000000;
+ ppppppppuVar7 = ppppppppuVar10;
if (param_9 != (byte *)0x0) {
*param_9 = 0;
- pppppppppuVar5 = (undefined8 *********)ExAllocateFromPagedLookasideList(&DAT_2);
- pppppppppuVar6 = pppppppppuVar20;
- if (pppppppppuVar5 == (undefined8 *********)0x0) {
- puVar13 = auStackY_d8;
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- uVar17 = 0x31;
- goto LAB_3;
- }
- goto LAB_4;
- }
- pppppppppuVar5[1] = pppppppppuVar5;
- *pppppppppuVar5 = pppppppppuVar5;
- pppppppppuVar5[3] = (undefined8 ********)0x0;
- pppppppppuVar5[4] = (undefined8 ********)0x0;
- *(undefined4 *)(pppppppppuVar5 + 2) = 0xa000000c;
- *(uint *)((longlong)pppppppppuVar5 + 0x14) = uVar11;
- *(undefined4 *)(pppppppppuVar5 + 5) = 0x30;
- if ((undefined8 *********)*local_58 != &local_60) goto LAB_5;
- pppppppppuVar5[1] = local_58;
- *pppppppppuVar5 = &local_60;
- *local_58 = pppppppppuVar5;
- local_58 = pppppppppuVar5;
- }
- pppppppppuVar6 = pppppppppuVar18;
- pppppppppuVar19 = (undefined8 *********)param_10;
- if (param_10 != (undefined8 *******)0x0) {
- *(undefined1 *)param_10 = 0;
- pppppppppuVar6 = (undefined8 *********)ExAllocateFromPagedLookasideList(&DAT_2);
- if (pppppppppuVar6 == (undefined8 *********)0x0) {
- puVar13 = auStackY_d8;
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- uVar17 = 0x32;
- goto LAB_3;
- }
- goto LAB_4;
- }
- pppppppppuVar6[1] = pppppppppuVar6;
- *pppppppppuVar6 = pppppppppuVar6;
- pppppppppuVar6[3] = (undefined8 ********)0x0;
- pppppppppuVar6[4] = (undefined8 ********)0x0;
- *(undefined4 *)(pppppppppuVar6 + 2) = 0xa0000003;
- *(uint *)((longlong)pppppppppuVar6 + 0x14) = uVar11;
- *(undefined4 *)(pppppppppuVar6 + 5) = 0x30;
- if ((undefined8 *********)*local_58 != &local_60) goto LAB_5;
- pppppppppuVar6[1] = local_58;
- *pppppppppuVar6 = &local_60;
- *local_58 = pppppppppuVar6;
- local_58 = pppppppppuVar6;
- }
- puVar14 = auStackY_d8;
- pppppppppuVar7 = pppppppppuVar18;
- if (param_11 == (byte *)0x0) {
-LAB_6:
- puVar13 = puVar14;
- *(longlong *)(puVar13 + 0x40) = param_7;
- *(longlong *)(puVar13 + 0x38) = param_6;
- *(undefined8 **********)(puVar13 + 0x30) = &local_60;
- *(undefined4 *)(puVar13 + 0x20) = 0x28;
- *(undefined8 *)(puVar13 + -8) = 0x1c002e862;
+ ppppppppuVar5 = (undefined8 ********)ExAllocateFromPagedLookasideList(&DAT_2);
+ ppppppppuVar6 = ppppppppuVar18;
+ if (ppppppppuVar5 == (undefined8 ********)0x0) {
+ bVar20 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar15 = DAT_3 & 4;
+ if ((bVar15 != 0) || (puVar12 = auStackY_e8, bVar20)) {
+ uVar21 = 0x32;
+ goto LAB_4;
+ }
+ goto LAB_5;
+ }
+ ppppppppuVar5[1] = ppppppppuVar5;
+ *ppppppppuVar5 = ppppppppuVar5;
+ ppppppppuVar5[3] = (undefined8 *******)0x0;
+ ppppppppuVar5[4] = (undefined8 *******)0x0;
+ *(undefined4 *)(ppppppppuVar5 + 2) = 0xa000000c;
+ *(uint *)((longlong)ppppppppuVar5 + 0x14) = uVar19;
+ *(undefined4 *)(ppppppppuVar5 + 5) = 0x30;
+ if ((undefined8 ********)*local_58 != &local_60) goto LAB_6;
+ ppppppppuVar5[1] = local_58;
+ *ppppppppuVar5 = &local_60;
+ *local_58 = ppppppppuVar5;
+ local_58 = ppppppppuVar5;
+ }
+ ppppppppuVar6 = ppppppppuVar17;
+ unaff_R13 = param_10;
+ if (param_10 != (byte *)0x0) {
+ *param_10 = 0;
+ ppppppppuVar6 = (undefined8 ********)ExAllocateFromPagedLookasideList(&DAT_2);
+ if (ppppppppuVar6 == (undefined8 ********)0x0) {
+ bVar20 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar15 = DAT_3 & 4;
+ if ((bVar15 != 0) || (puVar12 = auStackY_e8, bVar20)) {
+ uVar21 = 0x33;
+ goto LAB_4;
+ }
+ goto LAB_5;
+ }
+ ppppppppuVar6[1] = ppppppppuVar6;
+ *ppppppppuVar6 = ppppppppuVar6;
+ ppppppppuVar6[3] = (undefined8 *******)0x0;
+ ppppppppuVar6[4] = (undefined8 *******)0x0;
+ *(undefined4 *)(ppppppppuVar6 + 2) = 0xa0000003;
+ *(uint *)((longlong)ppppppppuVar6 + 0x14) = uVar19;
+ *(undefined4 *)(ppppppppuVar6 + 5) = 0x30;
+ if ((undefined8 ********)*local_58 != &local_60) goto LAB_6;
+ ppppppppuVar6[1] = local_58;
+ *ppppppppuVar6 = &local_60;
+ *local_58 = ppppppppuVar6;
+ local_58 = ppppppppuVar6;
+ }
+ ppppppppuVar7 = ppppppppuVar17;
+ puVar13 = auStackY_e8;
+ if (param_11 == (undefined8 *******)0x0) {
+LAB_7:
+ puVar12 = puVar13;
+ *(longlong *)(puVar12 + 0x40) = param_7;
+ *(longlong *)(puVar12 + 0x38) = param_6;
+ *(undefined8 *********)(puVar12 + 0x30) = &local_60;
+ *(undefined4 *)(puVar12 + 0x20) = 0x28;
+ *(undefined8 *)(puVar12 + -8) = 0x14003cca9;
uVar8 = PrjfOpenReparsePoint
- (param_3,param_1,param_2,param_4,*(undefined4 *)(puVar13 + 0x20),
- *(undefined8 *)(puVar13 + 0x28),*(longlong **)(puVar13 + 0x30),
- *(undefined8 *)(puVar13 + 0x38),*(undefined8 *)(puVar13 + 0x40));
+ (param_3,param_1,param_2,param_4,*(undefined4 *)(puVar12 + 0x20),
+ *(undefined8 *)(puVar12 + 0x28),*(longlong **)(puVar12 + 0x30),
+ *(undefined8 *)(puVar12 + 0x38),*(undefined8 *)(puVar12 + 0x40));
iVar3 = (int)uVar8;
if (iVar3 < 0) {
- if (((iVar3 != -0x3fffffcc) && (iVar3 != -0x3fffffc6)) &&
- ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
- pcVar16 = "did";
- pcVar10 = "did";
- pcVar9 = "did";
- if (param_11 == (byte *)0x0) {
- pcVar10 = "did NOT";
+ if ((iVar3 != -0x3fffffcc) && (iVar3 != -0x3fffffc6)) {
+ if (((DAT_3 & 4) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ pcVar16 = "did";
+ pcVar14 = "did";
+ if ((undefined8 ********)param_11 == (undefined8 ********)0x0) {
+ pcVar14 = "did NOT";
+ }
+ pcVar9 = "did";
+ *(char **)(puVar12 + 0x78) = pcVar14;
+ if (param_10 == (byte *)0x0) {
+ pcVar9 = "did NOT";
+ }
+ *(char **)(puVar12 + 0x70) = pcVar9;
+ uVar1 = *(undefined8 *)(WPP_GLOBAL_Control + 0x40);
+ if (param_9 == (byte *)0x0) {
+ pcVar16 = "did NOT";
+ }
+ pcVar14 = "Did";
+ *(char **)(puVar12 + 0x68) = pcVar16;
+ if (param_8 == (byte *)0x0) {
+ pcVar14 = "Did NOT";
+ }
+ *(char **)(puVar12 + 0x60) = pcVar14;
+ *(wchar_t **)(puVar12 + 0x58) = param_1;
+ *(int *)(puVar12 + 0x50) = iVar3;
+ *(undefined8 *)(puVar12 + -8) = 0x14003cd70;
+ WPP_RECORDER_AND_TRACE_SF_sDdZssss
+ (pcVar9,DAT_3 & 4,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,uVar1);
}
- *(char **)(puVar13 + 0x60) = pcVar10;
- if (pppppppppuVar19 == (undefined8 *********)0x0) {
- pcVar9 = "did NOT";
- }
- *(char **)(puVar13 + 0x58) = pcVar9;
- if (param_9 == (byte *)0x0) {
- pcVar16 = "did NOT";
- }
- pcVar9 = "Did";
- *(char **)(puVar13 + 0x50) = pcVar16;
- if (param_8 == (byte *)0x0) {
- pcVar9 = "Did NOT";
- }
- uVar1 = *(undefined8 *)(WPP_GLOBAL_Control + 0x40);
- *(char **)(puVar13 + 0x48) = pcVar9;
- *(wchar_t **)(puVar13 + 0x40) = param_1;
- *(int *)(puVar13 + 0x38) = iVar3;
- *(undefined8 *)(puVar13 + -8) = 0x1c002e913;
- WPP_RECORDER_SF_sDdZssss(uVar1);
}
}
else {
if (param_8 != (byte *)0x0) {
- *param_8 = *(byte *)((longlong)pppppppppuVar4 + 0x14) & 1;
+ *param_8 = *(byte *)((longlong)ppppppppuVar4 + 0x14) & 1;
}
if (param_9 != (byte *)0x0) {
- *param_9 = *(byte *)((longlong)pppppppppuVar5 + 0x14) & 1;
- }
- if (pppppppppuVar19 != (undefined8 *********)0x0) {
- *(byte *)pppppppppuVar19 = *(byte *)((longlong)pppppppppuVar6 + 0x14) & 1;
- }
- if (param_11 != (byte *)0x0) {
- *param_11 = *(byte *)((longlong)pppppppppuVar7 + 0x14) & 1;
+ *param_9 = *(byte *)((longlong)ppppppppuVar5 + 0x14) & 1;
+ }
+ if (param_10 != (byte *)0x0) {
+ *param_10 = *(byte *)((longlong)ppppppppuVar6 + 0x14) & 1;
+ }
+ if ((undefined8 ********)param_11 != (undefined8 ********)0x0) {
+ *(byte *)param_11 = *(byte *)((longlong)ppppppppuVar7 + 0x14) & 1;
}
}
}
else {
- *param_11 = 0;
- pppppppppuVar7 = (undefined8 *********)ExAllocateFromPagedLookasideList(&DAT_2);
- if (pppppppppuVar7 != (undefined8 *********)0x0) {
- pppppppppuVar7[1] = pppppppppuVar7;
- *pppppppppuVar7 = pppppppppuVar7;
- pppppppppuVar7[3] = (undefined8 ********)0x0;
- pppppppppuVar7[4] = (undefined8 ********)0x0;
- *(undefined4 *)(pppppppppuVar7 + 2) = 0xa0000022;
- *(uint *)((longlong)pppppppppuVar7 + 0x14) = uVar11;
- *(undefined4 *)(pppppppppuVar7 + 5) = 0x30;
- unaff_R12 = param_11;
- if ((undefined8 *********)*local_58 != &local_60) goto LAB_5;
- goto LAB_7;
- }
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- uVar17 = 0x33;
- goto LAB_3;
+ *(undefined1 *)param_11 = 0;
+ ppppppppuVar7 = (undefined8 ********)ExAllocateFromPagedLookasideList(&DAT_2);
+ if (ppppppppuVar7 != (undefined8 ********)0x0) {
+ ppppppppuVar7[1] = ppppppppuVar7;
+ *ppppppppuVar7 = ppppppppuVar7;
+ ppppppppuVar7[3] = (undefined8 *******)0x0;
+ ppppppppuVar7[4] = (undefined8 *******)0x0;
+ *(undefined4 *)(ppppppppuVar7 + 2) = 0xa0000022;
+ *(uint *)((longlong)ppppppppuVar7 + 0x14) = uVar19;
+ *(undefined4 *)(ppppppppuVar7 + 5) = 0x30;
+ ppppppppuVar17 = (undefined8 ********)param_11;
+ if ((undefined8 ********)*local_58 != &local_60) goto LAB_6;
+ goto LAB_8;
+ }
+ bVar20 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar15 = DAT_3 & 4;
+ if ((bVar15 != 0) || (bVar20)) {
+ uVar21 = 0x34;
+ goto LAB_4;
}
}
}
else {
*param_8 = 0;
- pppppppppuVar4 = (undefined8 *********)ExAllocateFromPagedLookasideList(&DAT_2);
- if (pppppppppuVar4 != (undefined8 *********)0x0) {
- pppppppppuVar4[1] = pppppppppuVar4;
- *pppppppppuVar4 = pppppppppuVar4;
- pppppppppuVar4[3] = (undefined8 ********)0x0;
- pppppppppuVar4[4] = (undefined8 ********)0x0;
- *(undefined4 *)(pppppppppuVar4 + 2) = 0x9000001c;
- *(uint *)((longlong)pppppppppuVar4 + 0x14) = uVar11 | 0x80000000;
- *(undefined4 *)(pppppppppuVar4 + 5) = 0x30;
- if ((undefined8 *********)*local_58 == &local_60) {
- pppppppppuVar4[1] = local_58;
- *pppppppppuVar4 = &local_60;
- *local_58 = pppppppppuVar4;
- local_58 = pppppppppuVar4;
+ ppppppppuVar4 = (undefined8 ********)ExAllocateFromPagedLookasideList(&DAT_2);
+ if (ppppppppuVar4 != (undefined8 ********)0x0) {
+ ppppppppuVar4[1] = ppppppppuVar4;
+ *ppppppppuVar4 = ppppppppuVar4;
+ ppppppppuVar4[3] = (undefined8 *******)0x0;
+ ppppppppuVar4[4] = (undefined8 *******)0x0;
+ *(undefined4 *)(ppppppppuVar4 + 2) = 0x9000001c;
+ *(uint *)((longlong)ppppppppuVar4 + 0x14) = uVar19 | 0x80000000;
+ *(undefined4 *)(ppppppppuVar4 + 5) = 0x30;
+ if ((undefined8 ********)*local_58 == &local_60) {
+ ppppppppuVar4[1] = local_58;
+ *ppppppppuVar4 = &local_60;
+ *local_58 = ppppppppuVar4;
+ local_58 = ppppppppuVar4;
goto LAB_1;
}
+LAB_6:
+ pcVar2 = (code *)swi(0x29);
+ local_58 = (undefined8 *******)(*pcVar2)(3);
+ puVar11 = auStackY_e0;
+ param_11 = ppppppppuVar17;
+ param_10 = unaff_R13;
+LAB_8:
+ ppppppppuVar7[1] = local_58;
+ *ppppppppuVar7 = &local_60;
+ *local_58 = ppppppppuVar7;
+ local_58 = ppppppppuVar7;
+ puVar13 = puVar11;
+ goto LAB_7;
+ }
+ bVar20 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar15 = DAT_3 & 4;
+ if ((bVar15 != 0) || (puVar12 = auStackY_e8, bVar20)) {
+ uVar21 = 0x31;
+LAB_4:
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x20a,bVar15,bVar20,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,10,uVar21,
+ &WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
+ puVar12 = auStackY_e8;
+ }
+ }
LAB_5:
- pcVar2 = (code *)swi(0x29);
- local_58 = (undefined8 ********)(*pcVar2)(3);
- puVar12 = auStackY_d0;
- param_11 = unaff_R12;
-LAB_7:
- pppppppppuVar7[1] = local_58;
- *pppppppppuVar7 = &local_60;
- *local_58 = pppppppppuVar7;
- local_58 = pppppppppuVar7;
- puVar14 = puVar12;
- goto LAB_6;
- }
- puVar13 = auStackY_d8;
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- uVar17 = 0x30;
-LAB_3:
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,10,uVar17,
- &WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
- puVar13 = auStackY_d8;
- }
- }
-LAB_4:
- if (pppppppppuVar4 != (undefined8 *********)0x0) {
- *(undefined8 *)(puVar13 + -8) = 0x1c002e988;
- ExFreeToPagedLookasideList(&DAT_2,pppppppppuVar4);
- }
- if (pppppppppuVar5 != (undefined8 *********)0x0) {
- *(undefined8 *)(puVar13 + -8) = 0x1c002e9a3;
- ExFreeToPagedLookasideList(&DAT_2,pppppppppuVar5);
- }
- if (pppppppppuVar6 != (undefined8 *********)0x0) {
- *(undefined8 *)(puVar13 + -8) = 0x1c002e9be;
- ExFreeToPagedLookasideList(&DAT_2,pppppppppuVar6);
- }
- puVar14 = puVar13;
- if (pppppppppuVar7 != (undefined8 *********)0x0) {
- *(undefined8 *)(puVar13 + -8) = 0x1c002e9d9;
- ExFreeToPagedLookasideList(&DAT_2,pppppppppuVar7);
+ if (local_68 != 0) {
+ *(undefined8 *)(puVar12 + -8) = 0x14003cdc9;
+ FltReleaseContext();
+ }
+ if (ppppppppuVar4 != (undefined8 ********)0x0) {
+ *(undefined8 *)(puVar12 + -8) = 0x14003cde4;
+ ExFreeToPagedLookasideList(&DAT_2,ppppppppuVar4);
+ }
+ if (ppppppppuVar5 != (undefined8 ********)0x0) {
+ *(undefined8 *)(puVar12 + -8) = 0x14003cdff;
+ ExFreeToPagedLookasideList(&DAT_2,ppppppppuVar5);
+ }
+ if (ppppppppuVar6 != (undefined8 ********)0x0) {
+ *(undefined8 *)(puVar12 + -8) = 0x14003ce1a;
+ ExFreeToPagedLookasideList(&DAT_2,ppppppppuVar6);
+ }
+ puVar13 = puVar12;
+ if (ppppppppuVar7 != (undefined8 ********)0x0) {
+ *(undefined8 *)(puVar12 + -8) = 0x14003ce35;
+ ExFreeToPagedLookasideList(&DAT_2,ppppppppuVar7);
}
LAB_0:
- return (int)*(undefined8 *)(puVar14 + 200);
+ return (int)*(undefined8 *)(puVar13 + 0xa8);
}
```
## PrjfVerifyAccessAndSetClientPortIfNeeded
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.46|
|i_ratio|0.34|
|m_ratio|0.88|
|b_ratio|0.38|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfVerifyAccessAndSetClientPortIfNeeded|PrjfVerifyAccessAndSetClientPortIfNeeded|
|fullname|PrjfVerifyAccessAndSetClientPortIfNeeded|PrjfVerifyAccessAndSetClientPortIfNeeded|
|refcount|2|2|
|`length`|1098|1426|
|`called`|Expand for full list:
FLTMGR.SYS::FltAcquireResourceExclusive
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltCreateFileEx2
FLTMGR.SYS::FltGetInstanceContext
FLTMGR.SYS::FltReleaseContext
FLTMGR.SYS::FltReleaseResource
NTOSKRNL.EXE::ExAcquireFastMutex
NTOSKRNL.EXE::ExReleaseFastMutex
NTOSKRNL.EXE::IoGetCurrentProcess
NTOSKRNL.EXE::ObfReferenceObject
WPP_RECORDER_SF_sD
WPP_RECORDER_SF_sDd
WPP_RECORDER_SF_sDdDExpand for full list:
FLTMGR.SYS::FltAcquireResourceExclusive
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltCreateFileEx2
FLTMGR.SYS::FltGetInstanceContext
FLTMGR.SYS::FltReleaseContext
FLTMGR.SYS::FltReleaseResource
NTOSKRNL.EXE::ExAcquireFastMutex
NTOSKRNL.EXE::ExReleaseFastMutex
NTOSKRNL.EXE::IoGetCurrentProcess
NTOSKRNL.EXE::ObfReferenceObject
WPP_RECORDER_AND_TRACE_SF_sD
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDdDExpand for full list:
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltGetFileNameInformation
FLTMGR.SYS::FltParseFileNameInformation
FLTMGR.SYS::FltReleaseContext
FLTMGR.SYS::FltReleaseFileNameInformation
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExUuidCreate
NTOSKRNL.EXE::ObfDereferenceObject
PrjfGetSetContextFileObject
PrjfGetUnionContextByFileNameEx
PrjfOpenParentPlaceHolder
PrjfReleaseUnionContext
PrjfSendEndDirectoryEnumerationCommand
PrjfSendGetDirectoryEnumerationCommand
PrjfSendQueryFileNameCommand
PrjfSendStartDirectoryEnumerationCommand
WPP_RECORDER_SF_sDd
WPP_RECORDER_SF_sDdZ
__security_check_cookieExpand for full list:
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltGetFileNameInformation
FLTMGR.SYS::FltParseFileNameInformation
FLTMGR.SYS::FltReleaseContext
FLTMGR.SYS::FltReleaseFileNameInformation
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExUuidCreate
NTOSKRNL.EXE::ObfDereferenceObject
PrjfGetSetContextFileObject
PrjfGetUnionContextByFileNameEx
PrjfOpenParentPlaceHolder
PrjfReleaseUnionContext
PrjfSendEndDirectoryEnumerationCommand
PrjfSendGetDirectoryEnumerationCommand
PrjfSendQueryFileNameCommand
PrjfSendStartDirectoryEnumerationCommand
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDdZ
__security_check_cookie
PrjfPrepareSourceForRename|PrjfPrepareForDelete
PrjfPrepareSourceForRename|
|paramcount|3|3|
|`address`|1c002ca8c|14003a670|
|sig|ulonglong __fastcall PrjfDoesNameExistInLayer(longlong param_1, undefined8 param_2, undefined1 * param_3)|ulonglong __fastcall PrjfDoesNameExistInLayer(longlong param_1, undefined8 param_2, undefined1 * param_3)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfDoesNameExistInLayer Called Diff
```diff
--- PrjfDoesNameExistInLayer called
+++ PrjfDoesNameExistInLayer called
@@ -19,2 +19,2 @@
-WPP_RECORDER_SF_sDd
-WPP_RECORDER_SF_sDdZ
+WPP_RECORDER_AND_TRACE_SF_sDD
+WPP_RECORDER_AND_TRACE_SF_sDdZ
```
### PrjfDoesNameExistInLayer Diff
```diff
--- PrjfDoesNameExistInLayer
+++ PrjfDoesNameExistInLayer
@@ -1,232 +1,258 @@
/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
ulonglong PrjfDoesNameExistInLayer(longlong param_1,undefined8 param_2,undefined1 *param_3)
{
longlong lVar1;
uint uVar2;
uint *puVar3;
undefined8 *puVar4;
ulonglong uVar5;
- ulonglong uVar6;
- uint *puVar7;
- undefined2 uVar8;
+ byte bVar6;
+ ulonglong uVar7;
+ uint *puVar8;
uint *puVar9;
uint *puVar10;
uint *puVar11;
uint *puVar12;
- undefined1 auStackY_118 [32];
- undefined4 uVar13;
+ bool bVar13;
+ undefined1 auStackY_128 [32];
+ ushort uVar14;
undefined8 in_stack_ffffffffffffff20;
- undefined4 uVar14;
+ undefined4 uVar15;
+ undefined4 in_stack_ffffffffffffff2c;
byte local_c8 [8];
longlong local_c0;
uint *local_b8;
uint *local_b0;
uint *local_a8;
longlong local_98;
undefined8 uStack_90;
uint local_88 [2];
longlong local_80;
longlong local_78;
undefined8 uStack_70;
wchar_t local_68 [4];
longlong lStack_60;
longlong local_58;
undefined8 uStack_50;
ulonglong local_48;
- uVar14 = (undefined4)((ulonglong)in_stack_ffffffffffffff20 >> 0x20);
- local_48 = __security_cookie ^ (ulonglong)auStackY_118;
+ uVar15 = (undefined4)((ulonglong)in_stack_ffffffffffffff20 >> 0x20);
+ local_48 = __security_cookie ^ (ulonglong)auStackY_128;
puVar3 = (uint *)0x0;
*param_3 = 0;
local_b8 = (uint *)0x0;
local_a8 = (uint *)0x0;
local_88[0] = 0;
local_c0 = 0;
local_98 = 0;
local_68[0] = L'\0';
local_68[1] = L'\0';
local_68[2] = L'\0';
local_68[3] = L'\0';
lStack_60 = 0;
puVar11 = (uint *)0x0;
local_78 = 0;
local_58 = 0;
uStack_50 = 0;
local_80 = 0;
puVar9 = (uint *)0x0;
local_b0 = (uint *)0x0;
uVar2 = FltGetFileNameInformation(0,0x101,&local_c0);
- uVar6 = (ulonglong)uVar2;
+ uVar7 = (ulonglong)uVar2;
puVar10 = puVar9;
puVar12 = puVar11;
if ((int)uVar2 < 0) {
- puVar7 = puVar3;
- puVar10 = puVar3;
- puVar12 = puVar3;
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,0x66,
- &WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
- puVar7 = (uint *)0x0;
+ if (((DAT_0 & 0x20) != 0) ||
+ (puVar8 = puVar3, puVar10 = puVar3, puVar12 = puVar3,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x205,DAT_0 & 0x20,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,0x68,
+ &WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
+ puVar8 = (uint *)0x0;
puVar10 = puVar9;
puVar12 = puVar11;
}
- goto LAB_0;
- }
- uVar13 = 0;
+ goto LAB_1;
+ }
puVar4 = PrjfGetUnionContextByFileNameEx
(param_1,'\0',param_2,(ushort *)(local_c0 + 8),&local_b8,(ushort *)local_68,
(undefined1 *)0x0);
- puVar7 = local_b8;
- uVar6 = (ulonglong)puVar4 & 0xffffffff;
+ puVar8 = local_b8;
+ uVar7 = (ulonglong)puVar4 & 0xffffffff;
if ((int)puVar4 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,0x67,
- &WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
- puVar7 = local_b8;
- }
- goto LAB_0;
- }
- if (local_b8 == (uint *)0x0) goto LAB_0;
+ if (((DAT_0 & 0x20) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x205,DAT_0 & 0x20,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,0x69,
+ &WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
+ puVar8 = local_b8;
+ }
+ goto LAB_1;
+ }
+ if (local_b8 == (uint *)0x0) goto LAB_1;
if ((local_b8[0xe] & 0x20000) != 0) {
local_78 = *(longlong *)local_b8;
uStack_70 = *(undefined8 *)(local_b8 + 2);
uVar5 = PrjfSendQueryFileNameCommand(param_1,param_2,&local_78,local_68,param_3);
- uVar6 = uVar5 & 0xffffffff;
- if (((int)uVar5 < 0) && ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
- WPP_RECORDER_SF_sDdZ
- (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,0x68,
- &WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",CONCAT44(uVar13,0x1247),
- CONCAT44(uVar14,(int)uVar5),local_68);
- }
- goto LAB_0;
+ uVar7 = uVar5 & 0xffffffff;
+ if ((int)uVar5 < 0) {
+ if (((DAT_0 & 0x20) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDdZ
+ (0x205,DAT_0 & 0x20,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,0x6a,
+ &WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",CONCAT44(uVar15,0x127e),
+ CONCAT44(in_stack_ffffffffffffff2c,(int)uVar5),local_68);
+ }
+ }
+ goto LAB_1;
}
local_c8[0] = 0;
uVar5 = PrjfOpenParentPlaceHolder(param_1,param_2,&local_78,&local_98,local_c8);
lVar1 = local_98;
- uVar6 = uVar5 & 0xffffffff;
+ uVar7 = uVar5 & 0xffffffff;
if ((int)uVar5 < 0) {
- puVar10 = puVar3;
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- uVar8 = 0x69;
-LAB_1:
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,uVar8,
- &WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
+ bVar13 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar6 = DAT_0 & 0x20;
+ if ((bVar6 != 0) || (puVar10 = puVar3, bVar13)) {
+ uVar14 = 0x6b;
+LAB_2:
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x205,bVar6,bVar13,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,uVar14,
+ &WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
puVar10 = puVar3;
}
}
else if (local_c8[0] != 0) {
uVar2 = PrjfGetSetContextFileObject
(param_2,local_98,-0x80000000,'\0','\0',(undefined4 *)0x0,(undefined2 *)0x0,
&local_80,&local_b0);
puVar3 = local_b0;
- uVar6 = (ulonglong)uVar2;
+ uVar7 = (ulonglong)uVar2;
puVar10 = puVar3;
if ((int)uVar2 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,0x6a,
- &WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
+ if (((DAT_0 & 0x20) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x205,DAT_0 & 0x20,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,0x6c,
+ &WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
puVar10 = local_b0;
}
}
else {
if (*local_b0 != 1) {
MicrosoftTelemetryAssertTriggeredNoArgsKM();
}
uVar2 = FltParseFileNameInformation(local_c0);
- uVar6 = (ulonglong)uVar2;
+ uVar7 = (ulonglong)uVar2;
if ((int)uVar2 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- uVar8 = 0x6b;
- goto LAB_1;
+ bVar13 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar6 = DAT_0 & 0x20;
+ if ((bVar6 != 0) || (bVar13)) {
+ uVar14 = 0x6d;
+ goto LAB_2;
}
}
else {
local_a8 = (uint *)ExAllocatePool2(0x100,0x20a,0x65644a50);
if (local_a8 == (uint *)0x0) {
- uVar6 = 0xc000009a;
+ uVar7 = 0xc000009a;
}
else {
uVar2 = ExUuidCreate(&local_58);
- uVar6 = (ulonglong)uVar2;
+ uVar7 = (ulonglong)uVar2;
if (-1 < (int)uVar2) {
local_98 = local_58;
uStack_90 = uStack_50;
uVar5 = PrjfSendStartDirectoryEnumerationCommand(param_1,param_2,lVar1,&local_98);
- uVar6 = uVar5 & 0xffffffff;
+ uVar7 = uVar5 & 0xffffffff;
if ((int)uVar5 == -0x3fffffcc) {
- uVar6 = 0;
+ uVar7 = 0;
}
else if ((int)uVar5 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- uVar8 = 0x6c;
- goto LAB_1;
+ bVar13 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar6 = DAT_0 & 0x20;
+ if ((bVar6 != 0) || (bVar13)) {
+ uVar14 = 0x6e;
+ goto LAB_2;
}
}
else {
local_98 = local_58;
uStack_90 = uStack_50;
uVar5 = PrjfSendGetDirectoryEnumerationCommand
(param_1,param_2,lVar1,0xc,(ushort *)(local_c0 + 0x58),1,0x20a,
&local_98,local_a8,local_88);
- uVar6 = uVar5 & 0xffffffff;
+ uVar7 = uVar5 & 0xffffffff;
if ((int)uVar5 == -0x7ffffffa) {
- uVar6 = 0;
+ uVar7 = 0;
}
else if ((int)uVar5 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,0x6d,
- &WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
+ if (((DAT_0 & 0x20) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x205,DAT_0 & 0x20,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,0x6f,
+ &WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
}
}
else {
*param_3 = 1;
}
local_98 = local_58;
uStack_90 = uStack_50;
PrjfSendEndDirectoryEnumerationCommand
(param_1,param_2,lVar1,(undefined8 *)0x0,&local_98);
}
}
}
}
}
}
if (local_78 != 0) {
FltClose();
}
puVar12 = local_a8;
if (lVar1 != 0) {
ObfDereferenceObject(lVar1);
puVar12 = local_a8;
}
-LAB_0:
+LAB_1:
if (local_c0 != 0) {
FltReleaseFileNameInformation();
}
if (local_80 != 0) {
FltReleaseContext();
}
if (puVar10 != (uint *)0x0) {
FltReleaseContext(puVar10);
}
- if (puVar7 != (uint *)0x0) {
- PrjfReleaseUnionContext((longlong)puVar7);
+ if (puVar8 != (uint *)0x0) {
+ PrjfReleaseUnionContext((longlong)puVar8);
}
if (lStack_60 != 0) {
ExFreePoolWithTag(lStack_60,0x6e664a50);
}
if (puVar12 != (uint *)0x0) {
ExFreePoolWithTag(puVar12,0x65644a50);
}
- return uVar6;
+ return uVar7;
}
```
## PrjfSetupVolumeInformationHandler
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.14|
|i_ratio|0.21|
|m_ratio|0.84|
|b_ratio|0.31|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfSetupVolumeInformationHandler|PrjfSetupVolumeInformationHandler|
|fullname|PrjfSetupVolumeInformationHandler|PrjfSetupVolumeInformationHandler|
|refcount|2|2|
|`length`|1386|1971|
|`called`|Expand for full list:
FLTMGR.SYS::FltAllocatePoolAlignedWithTag
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltCreateFileEx
FLTMGR.SYS::FltCreateSystemVolumeInformationFolder
FLTMGR.SYS::FltFreePoolAlignedWithTag
FLTMGR.SYS::FltGetVolumeFromName
FLTMGR.SYS::FltGetVolumeName
FLTMGR.SYS::FltObjectDereference
FLTMGR.SYS::FltWriteFile
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::RtlAppendUnicodeToString
NTOSKRNL.EXE::RtlInitUnicodeString
PrjfAllocateUnicodeString
PrjfGetInstanceFromVolumeName
WPP_RECORDER_SF_sDZd
WPP_RECORDER_SF_sDd
memcpy
memsetExpand for full list:
FLTMGR.SYS::FltAllocatePoolAlignedWithTag
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltCreateFileEx
FLTMGR.SYS::FltCreateSystemVolumeInformationFolder
FLTMGR.SYS::FltFreePoolAlignedWithTag
FLTMGR.SYS::FltGetVolumeFromName
FLTMGR.SYS::FltGetVolumeName
FLTMGR.SYS::FltObjectDereference
FLTMGR.SYS::FltWriteFile
Feature_78846265__private_IsEnabledDeviceUsageNoInline
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::RtlAppendUnicodeToString
NTOSKRNL.EXE::RtlInitUnicodeString
PrjfAllocateUnicodeString
PrjfGetInstanceFromVolumeName
PrjfValidateAndGetGlobalVolumePath
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDZd
__security_check_cookie
memmove
memset
WPP_RECORDER_SF_sDd
__security_check_cookie|FLTMGR.SYS::FltQueryInformationFile
WPP_RECORDER_AND_TRACE_SF_sDD
__security_check_cookie|
|calling|PrjfSetDeleteDisposition|PrjfSetDeleteDisposition|
|paramcount|3|3|
|`address`|1c0006fd8|140008bc0|
|sig|int __fastcall PrjfQueryAttributes(undefined8 param_1, undefined8 param_2, undefined4 * param_3)|int __fastcall PrjfQueryAttributes(undefined8 param_1, undefined8 param_2, undefined4 * param_3)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfQueryAttributes Called Diff
```diff
--- PrjfQueryAttributes called
+++ PrjfQueryAttributes called
@@ -2 +2 @@
-WPP_RECORDER_SF_sDd
+WPP_RECORDER_AND_TRACE_SF_sDD
```
### PrjfQueryAttributes Diff
```diff
--- PrjfQueryAttributes
+++ PrjfQueryAttributes
@@ -1,35 +1,39 @@
/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
int PrjfQueryAttributes(undefined8 param_1,undefined8 param_2,undefined4 *param_3)
{
int iVar1;
- undefined1 auStackY_78 [32];
+ undefined1 auStackY_98 [32];
undefined8 local_38;
undefined8 uStack_30;
undefined8 local_28;
undefined8 uStack_20;
undefined8 local_18;
ulonglong local_10;
- local_10 = __security_cookie ^ (ulonglong)auStackY_78;
+ local_10 = __security_cookie ^ (ulonglong)auStackY_98;
local_38 = 0;
uStack_30 = 0;
local_28 = 0;
uStack_20 = 0;
local_18 = 0;
iVar1 = FltQueryInformationFile(param_2,param_1,&local_38,0x28);
if (iVar1 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xf,0x2d,
- &WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
+ if (((DAT_0 & 0x80) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x20f,DAT_0 & 0x80,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xf,0x2e,
+ &WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
}
}
else {
*param_3 = (undefined4)local_18;
}
return iVar1;
}
```
## PrjfSendCommand
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.78|
|i_ratio|0.5|
|m_ratio|0.95|
|b_ratio|0.91|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfSendCommand|PrjfSendCommand|
|fullname|PrjfSendCommand|PrjfSendCommand|
|refcount|8|8|
|`length`|464|526|
|`called`|HAL.DLL::KeQueryPerformanceCounter
MicrosoftTelemetryAssertTriggeredNoArgsKM
PrjfAggregateTelemetry
PrjfGetUnionContext
PrjfReleaseUnionContext
PrjfSendCommandAndWaitForCompletion
WPP_RECORDER_SF_sD
WPP_RECORDER_SF_sDd|HAL.DLL::KeQueryPerformanceCounter
MicrosoftTelemetryAssertTriggeredNoArgsKM
PrjfAggregateTelemetry
PrjfGetUnionContext
PrjfReleaseUnionContext
PrjfSendCommandAndWaitForCompletion
WPP_RECORDER_AND_TRACE_SF_sD
WPP_RECORDER_AND_TRACE_SF_sDD|
|calling|PrjfSendEndDirectoryEnumerationCommand
PrjfSendGetDirectoryEnumerationCommand
PrjfSendGetFileStreamCommand
PrjfSendGetPlaceholderInformationCommand
PrjfSendNotifyOperationCommand
PrjfSendQueryFileNameCommand
PrjfSendStartDirectoryEnumerationCommand|PrjfSendEndDirectoryEnumerationCommand
PrjfSendGetDirectoryEnumerationCommand
PrjfSendGetFileStreamCommand
PrjfSendGetPlaceholderInformationCommand
PrjfSendNotifyOperationCommand
PrjfSendQueryFileNameCommand
PrjfSendStartDirectoryEnumerationCommand|
|paramcount|6|6|
|`address`|1c00275c4|140034490|
|sig|int __fastcall PrjfSendCommand(longlong param_1, undefined8 param_2, uint * param_3, longlong param_4, longlong param_5, int * param_6)|int __fastcall PrjfSendCommand(longlong param_1, undefined8 param_2, uint * param_3, longlong param_4, longlong param_5, int * param_6)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfSendCommand Called Diff
```diff
--- PrjfSendCommand called
+++ PrjfSendCommand called
@@ -7,2 +7,2 @@
-WPP_RECORDER_SF_sD
-WPP_RECORDER_SF_sDd
+WPP_RECORDER_AND_TRACE_SF_sD
+WPP_RECORDER_AND_TRACE_SF_sDD
```
### PrjfSendCommand Diff
```diff
--- PrjfSendCommand
+++ PrjfSendCommand
@@ -1,63 +1,70 @@
int PrjfSendCommand(longlong param_1,undefined8 param_2,uint *param_3,longlong param_4,
longlong param_5,int *param_6)
{
longlong *plVar1;
int iVar2;
longlong *plVar3;
longlong lVar4;
longlong lVar5;
longlong local_res18 [2];
longlong local_38;
undefined8 uStack_30;
local_res18[0] = 0;
if (*param_3 < 0x381) {
MicrosoftTelemetryAssertTriggeredNoArgsKM();
}
if (param_5 == 0) {
iVar2 = -0x3ffffff3;
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sD(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0x8b,
- &WPP_3ccab5108a9538d17a865fde27ef339f_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c");
+ if (((DAT_0 & 0x40) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sD
+ (0x20e,DAT_0 & 0x40,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0x95,
+ &WPP_39279db927ae337b8503ecc20725ff46_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c");
}
}
else {
local_38 = *(longlong *)(param_3 + 2);
uStack_30 = *(undefined8 *)(param_3 + 4);
plVar3 = PrjfGetUnionContext(param_2,&local_38);
if (plVar3 == (longlong *)0x0) {
iVar2 = -0x3fff31ff;
}
else {
if (plVar3[10] == 0) {
iVar2 = -0x3fff31ff;
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0x8c,
- &WPP_3ccab5108a9538d17a865fde27ef339f_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c");
+ if (((DAT_0 & 0x40) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x20e,DAT_0 & 0x40,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0x96,
+ &WPP_39279db927ae337b8503ecc20725ff46_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c");
}
}
else {
lVar4 = KeQueryPerformanceCounter(local_res18);
LOCK();
plVar1 = plVar3 + 0x26;
lVar5 = *plVar1;
*(int *)plVar1 = (int)*plVar1 + 1;
UNLOCK();
param_3[6] = (int)lVar5 + 1;
iVar2 = PrjfSendCommandAndWaitForCompletion
- (param_1,param_2,(longlong)param_3,param_4,(longlong)plVar3,param_5,
- param_6);
+ (param_1,param_2,param_3,param_4,(longlong)plVar3,param_5,param_6);
lVar5 = KeQueryPerformanceCounter(0);
PrjfAggregateTelemetry
((ulonglong)param_3,iVar2,((lVar5 - lVar4) * 1000000) / local_res18[0]);
}
PrjfReleaseUnionContext((longlong)plVar3);
}
}
return iVar2;
}
```
## PrjfValidateNamesInEnumeration
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,sig,address,called|
|ratio|0.29|
|i_ratio|0.29|
|m_ratio|0.61|
|b_ratio|0.26|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfValidateNamesInEnumeration|PrjfValidateNamesInEnumeration|
|fullname|PrjfValidateNamesInEnumeration|PrjfValidateNamesInEnumeration|
|refcount|2|2|
|`length`|579|1515|
|`called`|MicrosoftTelemetryAssertTriggeredNoArgsKM
WPP_RECORDER_SF_sDd
WPP_RECORDER_SF_sDdD|MicrosoftTelemetryAssertTriggeredNoArgsKM
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDdD|
|calling|PrjfSendGetDirectoryEnumerationCommand|PrjfSendGetDirectoryEnumerationCommand|
|paramcount|3|3|
|`address`|1c0028f0c|140036184|
|`sig`|undefined8 __fastcall PrjfValidateNamesInEnumeration(int param_1, uint * param_2, uint param_3)|undefined4 __fastcall PrjfValidateNamesInEnumeration(int param_1, uint * param_2, uint param_3)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfValidateNamesInEnumeration Called Diff
```diff
--- PrjfValidateNamesInEnumeration called
+++ PrjfValidateNamesInEnumeration called
@@ -2,2 +2,2 @@
-WPP_RECORDER_SF_sDd
-WPP_RECORDER_SF_sDdD
+WPP_RECORDER_AND_TRACE_SF_sDD
+WPP_RECORDER_AND_TRACE_SF_sDdD
```
### PrjfValidateNamesInEnumeration Diff
```diff
--- PrjfValidateNamesInEnumeration
+++ PrjfValidateNamesInEnumeration
@@ -1,101 +1,193 @@
-undefined8 PrjfValidateNamesInEnumeration(int param_1,uint *param_2,uint param_3)
+undefined4 PrjfValidateNamesInEnumeration(int param_1,uint *param_2,uint param_3)
{
- ushort uVar1;
- uint uVar2;
- int iVar3;
- undefined1 uVar4;
- undefined7 uVar5;
- ushort uVar6;
- uint *puVar7;
- ushort uVar8;
+ uint uVar1;
+ int iVar2;
+ undefined4 uVar3;
+ ushort uVar4;
+ uint *puVar5;
+ byte bVar6;
+ ushort uVar7;
+ bool bVar9;
+ undefined1 in_stack_ffffffffffffffa8;
+ undefined7 in_stack_ffffffffffffffa9;
+ ulonglong uVar8;
- uVar4 = SUB81(param_2,0);
- uVar5 = (undefined7)((ulonglong)param_2 >> 8);
if ((param_1 != 0xc) &&
((0x15 < param_1 - 0x3cU || ((0x3c0009U >> (param_1 - 0x3cU & 0x1f) & 1) == 0)))) {
MicrosoftTelemetryAssertTriggeredNoArgsKM();
}
while( true ) {
if (param_1 == 0xc) {
- uVar6 = (ushort)param_2[2];
- puVar7 = param_2 + 3;
- iVar3 = 0xc;
+ if (0xffff < param_2[2]) {
+ uVar3 = 0xc000000d;
+ bVar9 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar6 = DAT_0 & 0x40;
+ if ((bVar6 == 0) && (!bVar9)) {
+ return 0xc000000d;
+ }
+ uVar4 = 0x99;
+ goto LAB_1;
+ }
+ uVar4 = (ushort)param_2[2];
+ puVar5 = param_2 + 3;
+ iVar2 = 0xc;
}
else if (param_1 == 0x3c) {
- uVar6 = (ushort)param_2[0xf];
- puVar7 = param_2 + 0x16;
- iVar3 = 0x58;
+ if (0xffff < param_2[0xf]) {
+ uVar3 = 0xc000000d;
+ bVar9 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar6 = DAT_0 & 0x40;
+ if ((bVar6 == 0) && (!bVar9)) {
+ return 0xc000000d;
+ }
+ uVar4 = 0x9a;
+ goto LAB_1;
+ }
+ uVar4 = (ushort)param_2[0xf];
+ puVar5 = param_2 + 0x16;
+ iVar2 = 0x58;
}
else if (param_1 == 0x3f) {
- uVar6 = (ushort)param_2[0xf];
- puVar7 = (uint *)((longlong)param_2 + 0x72);
- iVar3 = 0x72;
+ if (0xffff < param_2[0xf]) {
+ uVar3 = 0xc000000d;
+ bVar9 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar6 = DAT_0 & 0x40;
+ if ((bVar6 == 0) && (!bVar9)) {
+ return 0xc000000d;
+ }
+ uVar4 = 0x9b;
+ goto LAB_1;
+ }
+ uVar4 = (ushort)param_2[0xf];
+ puVar5 = (uint *)((longlong)param_2 + 0x72);
+ iVar2 = 0x72;
}
else if (param_1 == 0x4e) {
- uVar6 = (ushort)param_2[0xf];
- puVar7 = param_2 + 0x14;
- iVar3 = 0x50;
+ if (0xffff < param_2[0xf]) {
+ uVar3 = 0xc000000d;
+ bVar9 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar6 = DAT_0 & 0x40;
+ if ((bVar6 == 0) && (!bVar9)) {
+ return 0xc000000d;
+ }
+ uVar4 = 0x9c;
+ goto LAB_1;
+ }
+ uVar4 = (ushort)param_2[0xf];
+ puVar5 = param_2 + 0x14;
+ iVar2 = 0x50;
}
else if (param_1 == 0x4f) {
- uVar6 = (ushort)param_2[0xf];
- puVar7 = (uint *)((longlong)param_2 + 0x6a);
- iVar3 = 0x6a;
+ if (0xffff < param_2[0xf]) {
+ uVar3 = 0xc000000d;
+ bVar9 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar6 = DAT_0 & 0x40;
+ if ((bVar6 == 0) && (!bVar9)) {
+ return 0xc000000d;
+ }
+ uVar4 = 0x9d;
+ goto LAB_1;
+ }
+ uVar4 = (ushort)param_2[0xf];
+ puVar5 = (uint *)((longlong)param_2 + 0x6a);
+ iVar2 = 0x6a;
}
else if (param_1 == 0x50) {
- uVar6 = (ushort)param_2[0xf];
- puVar7 = param_2 + 0x18;
- iVar3 = 0x60;
+ if (0xffff < param_2[0xf]) {
+ uVar3 = 0xc000000d;
+ bVar9 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar6 = DAT_0 & 0x40;
+ if ((bVar6 == 0) && (!bVar9)) {
+ return 0xc000000d;
+ }
+ uVar4 = 0x9e;
+ goto LAB_1;
+ }
+ uVar4 = (ushort)param_2[0xf];
+ puVar5 = param_2 + 0x18;
+ iVar2 = 0x60;
}
else {
if (param_1 != 0x51) {
MicrosoftTelemetryAssertTriggeredNoArgsKM();
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDdD
- (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),CONCAT71(uVar5,uVar4),0xe,0x8f,
- &WPP_3ccab5108a9538d17a865fde27ef339f_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c");
+ if (((DAT_0 & 0x40) == 0) &&
+ ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) {
+ return 0xc0000003;
}
+ WPP_RECORDER_AND_TRACE_SF_sDdD
+ (0x20e,DAT_0 & 0x40,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),
+ CONCAT71(in_stack_ffffffffffffffa9,in_stack_ffffffffffffffa8),0xe,0xa0,
+ &WPP_39279db927ae337b8503ecc20725ff46_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c");
return 0xc0000003;
}
- uVar6 = (ushort)param_2[0xf];
- puVar7 = (uint *)((longlong)param_2 + 0x7a);
- iVar3 = 0x7a;
+ if (0xffff < param_2[0xf]) {
+ uVar3 = 0xc000000d;
+ bVar9 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar6 = DAT_0 & 0x40;
+ if ((bVar6 == 0) && (!bVar9)) {
+ return 0xc000000d;
+ }
+ uVar4 = 0x9f;
+ goto LAB_1;
+ }
+ uVar4 = (ushort)param_2[0xf];
+ puVar5 = (uint *)((longlong)param_2 + 0x7a);
+ iVar2 = 0x7a;
}
- if (param_3 < (uint)uVar6 + iVar3) break;
- if (((uVar6 == 0) || ((uVar6 & 1) != 0)) || (uVar6 = uVar6 >> 1, 0x104 < uVar6)) {
+ if (param_3 < (uint)uVar4 + iVar2) {
+ MicrosoftTelemetryAssertTriggeredNoArgsKM();
+ uVar3 = 0xc0000023;
+ bVar9 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar6 = DAT_0 & 0x40;
+ if ((bVar6 == 0) && (!bVar9)) {
+ return 0xc0000023;
+ }
+ uVar4 = 0xa1;
+ goto LAB_1;
+ }
+ if (((uVar4 == 0) || ((uVar4 & 1) != 0)) || (uVar4 = uVar4 >> 1, 0x104 < uVar4)) {
return 0xc0000033;
}
uVar8 = 0;
- if (uVar6 != 0) {
+ if (uVar4 != 0) {
do {
- uVar1 = *(ushort *)((longlong)puVar7 + (ulonglong)uVar8 * 2);
- if (((uVar1 < 0x80) && (-1 < (char)uVar1)) &&
- ((*(byte *)((ulonglong)uVar1 + *(longlong *)FsRtlLegalAnsiCharacterArray_exref) & 4) == 0
+ uVar7 = *(ushort *)((longlong)puVar5 + uVar8 * 2);
+ if (((uVar7 < 0x80) && (-1 < (char)uVar7)) &&
+ ((*(byte *)((ulonglong)uVar7 + *(longlong *)FsRtlLegalAnsiCharacterArray_exref) & 4) == 0
)) {
return 0xc0000033;
}
- if (uVar1 == 0x3a) {
+ if (uVar7 == 0x3a) {
return 0xc0000033;
}
- uVar8 = uVar8 + 1;
- } while (uVar8 < uVar6);
+ uVar7 = (short)uVar8 + 1;
+ uVar8 = (ulonglong)uVar7;
+ } while (uVar7 < uVar4);
}
- uVar2 = *param_2;
- if (uVar2 == 0) {
+ uVar1 = *param_2;
+ if (uVar1 == 0) {
return 0;
}
- param_3 = param_3 - uVar2;
- param_2 = (uint *)((longlong)param_2 + (ulonglong)uVar2);
+ if (param_3 < uVar1) break;
+ param_3 = param_3 - uVar1;
+ param_2 = (uint *)((longlong)param_2 + (ulonglong)uVar1);
}
- MicrosoftTelemetryAssertTriggeredNoArgsKM();
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0x90,
- &WPP_3ccab5108a9538d17a865fde27ef339f_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c");
- return 0xc0000023;
+ uVar3 = 0xc0000023;
+ bVar9 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar6 = DAT_0 & 0x40;
+ if ((bVar6 != 0) || (bVar9)) {
+ uVar4 = 0xa2;
+LAB_1:
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x20e,bVar6,bVar9,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,uVar4,
+ &WPP_39279db927ae337b8503ecc20725ff46_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c");
}
- return 0xc0000023;
+ return uVar3;
}
```
## PrjfSendGetDirectoryEnumerationCommand
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.39|
|i_ratio|0.33|
|m_ratio|0.93|
|b_ratio|0.9|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfSendGetDirectoryEnumerationCommand|PrjfSendGetDirectoryEnumerationCommand|
|fullname|PrjfSendGetDirectoryEnumerationCommand|PrjfSendGetDirectoryEnumerationCommand|
|refcount|3|3|
|`length`|651|753|
|`called`|MicrosoftTelemetryAssertTriggeredNoArgsKM
PrjfFreeCommandBuffer
PrjfPrepareCommandForFileObject
PrjfSendCommand
PrjfValidateNamesInEnumeration
WPP_RECORDER_SF_sDdZ
__security_check_cookie
memcpy
memset|MicrosoftTelemetryAssertTriggeredNoArgsKM
PrjfFreeCommandBuffer
PrjfPrepareCommandForFileObject
PrjfSendCommand
PrjfValidateNamesInEnumeration
WPP_RECORDER_AND_TRACE_SF_sDdZ
__security_check_cookie
memmove
memset|
|calling|PrjfDoesNameExistInLayer
PrjfEnumerateLayeredDirectories|PrjfDoesNameExistInLayer
PrjfEnumerateLayeredDirectories|
|paramcount|10|10|
|`address`|1c0027f44|140034ef0|
|sig|ulonglong __fastcall PrjfSendGetDirectoryEnumerationCommand(longlong param_1, undefined8 param_2, longlong param_3, int param_4, ushort * param_5, byte param_6, uint param_7, undefined8 * param_8, uint * param_9, uint * param_10)|ulonglong __fastcall PrjfSendGetDirectoryEnumerationCommand(longlong param_1, undefined8 param_2, longlong param_3, int param_4, ushort * param_5, byte param_6, uint param_7, undefined8 * param_8, uint * param_9, uint * param_10)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfSendGetDirectoryEnumerationCommand Called Diff
```diff
--- PrjfSendGetDirectoryEnumerationCommand called
+++ PrjfSendGetDirectoryEnumerationCommand called
@@ -6 +6 @@
-WPP_RECORDER_SF_sDdZ
+WPP_RECORDER_AND_TRACE_SF_sDdZ
@@ -8 +8 @@
-memcpy
+memmove
```
### PrjfSendGetDirectoryEnumerationCommand Diff
```diff
--- PrjfSendGetDirectoryEnumerationCommand
+++ PrjfSendGetDirectoryEnumerationCommand
@@ -1,108 +1,118 @@
/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
ulonglong PrjfSendGetDirectoryEnumerationCommand
(longlong param_1,undefined8 param_2,longlong param_3,int param_4,
ushort *param_5,byte param_6,uint param_7,undefined8 *param_8,uint *param_9,
uint *param_10)
{
undefined8 uVar1;
- uint uVar2;
- uint *puVar3;
+ undefined8 uVar2;
+ uint uVar3;
uint *puVar4;
uint *puVar5;
- uint uVar6;
- ulonglong uVar7;
- undefined8 uVar8;
- undefined2 uVar9;
- undefined1 auStackY_2f8 [32];
- undefined8 in_stack_fffffffffffffd28;
- uint *puVar10;
- undefined4 uVar11;
+ uint *puVar6;
+ uint uVar7;
+ int iVar8;
+ ulonglong uVar9;
+ byte bVar10;
+ bool bVar11;
+ undefined1 auStackY_308 [32];
+ undefined8 in_stack_fffffffffffffd18;
+ ushort uVar12;
+ undefined4 uVar13;
undefined4 in_stack_fffffffffffffd44;
+ undefined4 in_stack_fffffffffffffd4c;
uint local_2a8 [2];
uint *local_2a0;
longlong local_298;
undefined8 local_288;
undefined8 uStack_280;
int local_278;
undefined1 local_274 [512];
uint local_74;
byte local_70;
byte local_6f;
ulonglong local_68;
- puVar4 = param_10;
- puVar3 = param_9;
- local_68 = __security_cookie ^ (ulonglong)auStackY_2f8;
- uVar8 = *param_8;
- uVar1 = param_8[1];
+ puVar5 = param_10;
+ puVar4 = param_9;
+ local_68 = __security_cookie ^ (ulonglong)auStackY_308;
+ uVar1 = *param_8;
+ uVar2 = param_8[1];
local_2a0 = (uint *)0x0;
local_298 = param_1;
memset(&local_288,0,0x220);
local_74 = param_7;
local_2a8[0] = 0;
if (param_7 == 0) {
MicrosoftTelemetryAssertTriggeredNoArgsKM();
}
- *puVar4 = 0;
+ *puVar5 = 0;
local_6f = param_6 & 1;
local_70 = param_6 & 2;
- local_288 = uVar8;
- uStack_280 = uVar1;
+ local_288 = uVar1;
+ uStack_280 = uVar2;
local_278 = param_4;
if (param_5 != (ushort *)0x0) {
- memcpy(local_274,*(void **)(param_5 + 4),(ulonglong)*param_5);
+ memmove(local_274,*(void **)(param_5 + 4),(ulonglong)*param_5);
}
- puVar10 = local_2a8;
- uVar7 = PrjfPrepareCommandForFileObject
- (param_2,param_3,3,&local_288,in_stack_fffffffffffffd28,(longlong *)&local_2a0,
- puVar10);
- puVar5 = local_2a0;
- uVar11 = (undefined4)((ulonglong)puVar10 >> 0x20);
- uVar6 = (uint)uVar7;
- uVar7 = uVar7 & 0xffffffff;
- if ((int)uVar6 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0;
- uVar9 = 0x95;
- uVar8 = CONCAT44(uVar11,0x1218);
+ uVar9 = PrjfPrepareCommandForFileObject
+ (param_2,param_3,3,&local_288,in_stack_fffffffffffffd18,(longlong *)&local_2a0,
+ local_2a8);
+ puVar6 = local_2a0;
+ uVar7 = (uint)uVar9;
+ uVar9 = uVar9 & 0xffffffff;
+ if ((int)uVar7 < 0) {
+ bVar11 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar10 = DAT_0 & 0x40;
+ if ((bVar10 == 0) && (!bVar11)) goto LAB_1;
+ uVar13 = 0x134d;
+ uVar12 = 0xa7;
}
else {
- uVar6 = PrjfSendCommand(local_298,param_2,local_2a0,0,(longlong)puVar3,(int *)¶m_7);
- uVar2 = param_7;
- uVar7 = (ulonglong)uVar6;
- if (-1 < (int)uVar6) {
- uVar8 = PrjfValidateNamesInEnumeration(param_4,puVar3,param_7);
- if ((int)uVar8 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDdZ
- (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0x97,
- &WPP_3ccab5108a9538d17a865fde27ef339f_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c",CONCAT44(uVar11,0x1243),
- CONCAT44(in_stack_fffffffffffffd44,uVar6),(wchar_t *)(param_3 + 0x58));
+ uVar7 = PrjfSendCommand(local_298,param_2,local_2a0,0,(longlong)puVar4,(int *)¶m_7);
+ uVar3 = param_7;
+ uVar9 = (ulonglong)uVar7;
+ if (-1 < (int)uVar7) {
+ iVar8 = PrjfValidateNamesInEnumeration(param_4,puVar4,param_7);
+ if (iVar8 < 0) {
+ if (((DAT_0 & 0x40) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDdZ
+ (0x20e,DAT_0 & 0x40,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0xa9,
+ &WPP_39279db927ae337b8503ecc20725ff46_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c",
+ CONCAT44(in_stack_fffffffffffffd44,0x1378),
+ CONCAT44(in_stack_fffffffffffffd4c,uVar7),(wchar_t *)(param_3 + 0x58));
}
- uVar7 = 0x80000006;
+ uVar9 = 0x80000006;
}
else {
- *puVar4 = uVar2;
+ *puVar5 = uVar3;
}
- goto LAB_0;
+ goto LAB_1;
}
- if ((uVar6 == 0x80000006) ||
- ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) goto LAB_0;
- uVar9 = 0x96;
- uVar8 = CONCAT44(uVar11,0x1230);
+ if (uVar7 == 0x80000006) goto LAB_1;
+ bVar11 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar10 = DAT_0 & 0x40;
+ if ((bVar10 == 0) && (!bVar11)) goto LAB_1;
+ uVar13 = 0x1365;
+ uVar12 = 0xa8;
}
- WPP_RECORDER_SF_sDdZ
- (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,uVar9,
- &WPP_3ccab5108a9538d17a865fde27ef339f_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c",uVar8,
- CONCAT44(in_stack_fffffffffffffd44,uVar6),(wchar_t *)(param_3 + 0x58));
-LAB_0:
- if (puVar5 != (uint *)0x0) {
- PrjfFreeCommandBuffer((longlong)puVar5,local_2a8[0]);
+ WPP_RECORDER_AND_TRACE_SF_sDdZ
+ (0x20e,bVar10,bVar11,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,uVar12,
+ &WPP_39279db927ae337b8503ecc20725ff46_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c",
+ CONCAT44(in_stack_fffffffffffffd44,uVar13),CONCAT44(in_stack_fffffffffffffd4c,uVar7),
+ (wchar_t *)(param_3 + 0x58));
+LAB_1:
+ if (puVar6 != (uint *)0x0) {
+ PrjfFreeCommandBuffer((longlong)puVar6,local_2a8[0]);
}
- return uVar7;
+ return uVar9;
}
```
## PrjfPreSetLinkInformation
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.87|
|i_ratio|0.55|
|m_ratio|0.96|
|b_ratio|0.91|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfPreSetLinkInformation|PrjfPreSetLinkInformation|
|fullname|PrjfPreSetLinkInformation|PrjfPreSetLinkInformation|
|refcount|2|2|
|`length`|294|339|
|`called`|FLTMGR.SYS::FltGetDestinationFileNameInformation
FLTMGR.SYS::FltReleaseFileNameInformation
MicrosoftTelemetryAssertTriggeredNoArgsKM
PrjfProcessPreRenameOrLinkInformation
WPP_RECORDER_SF_sDd|FLTMGR.SYS::FltGetDestinationFileNameInformation
FLTMGR.SYS::FltReleaseFileNameInformation
MicrosoftTelemetryAssertTriggeredNoArgsKM
PrjfProcessPreRenameOrLinkInformation
WPP_RECORDER_AND_TRACE_SF_sDD|
|calling|PrjfPreSetInformation|PrjfPreSetInformation|
|paramcount|3|3|
|`address`|1c00213b0|14002c7d8|
|sig|undefined8 __fastcall PrjfPreSetLinkInformation(longlong param_1, longlong param_2, longlong * param_3)|undefined8 __fastcall PrjfPreSetLinkInformation(longlong param_1, longlong param_2, longlong * param_3)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfPreSetLinkInformation Called Diff
```diff
--- PrjfPreSetLinkInformation called
+++ PrjfPreSetLinkInformation called
@@ -5 +5 @@
-WPP_RECORDER_SF_sDd
+WPP_RECORDER_AND_TRACE_SF_sDD
```
### PrjfPreSetLinkInformation Diff
```diff
--- PrjfPreSetLinkInformation
+++ PrjfPreSetLinkInformation
@@ -1,46 +1,50 @@
undefined8 PrjfPreSetLinkInformation(longlong param_1,longlong param_2,longlong *param_3)
{
longlong lVar1;
int iVar2;
ulonglong uVar3;
undefined8 uVar4;
longlong local_res8;
*param_3 = 0;
local_res8 = 0;
uVar4 = 1;
lVar1 = *(longlong *)(*(longlong *)(param_1 + 0x10) + 0x38);
iVar2 = FltGetDestinationFileNameInformation
(*(undefined8 *)(param_2 + 0x18),*(undefined8 *)(param_2 + 0x20),
*(undefined8 *)(lVar1 + 8),lVar1 + 0x14,*(undefined4 *)(lVar1 + 0x10),0x101,
&local_res8);
if (iVar2 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xd,0x22,
- &WPP_9aa94875f0ba3c84ae0a423dcca6636f_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\fileinfo.c");
+ if (((DAT_0 & 0x20) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x20d,DAT_0 & 0x20,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xd,0x22,
+ &WPP_9aa94875f0ba3c84ae0a423dcca6636f_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\fileinfo.c");
}
}
else {
uVar3 = PrjfProcessPreRenameOrLinkInformation(param_1,param_2,local_res8,0x40,param_3);
iVar2 = (int)uVar3;
if (*param_3 != 0) {
if (iVar2 < 0) {
MicrosoftTelemetryAssertTriggeredNoArgsKM();
}
uVar4 = 0;
}
}
if (local_res8 != 0) {
FltReleaseFileNameInformation();
}
if (iVar2 < 0) {
*(undefined8 *)(param_1 + 0x20) = 0;
uVar4 = 4;
*(int *)(param_1 + 0x18) = iVar2;
}
return uVar4;
}
```
## PrjfTelemetryAndTracingInit
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.32|
|i_ratio|0.23|
|m_ratio|0.9|
|b_ratio|0.69|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfTelemetryAndTracingInit|PrjfTelemetryAndTracingInit|
|fullname|PrjfTelemetryAndTracingInit|PrjfTelemetryAndTracingInit|
|refcount|2|2|
|`length`|917|1147|
|`called`|Expand for full list:
InitializeTelemetryAssertsKMWorkerInternal
MicrosoftTelemetryAssertTriggeredMsgKM
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::IoQueryFullDriverPath
NTOSKRNL.EXE::MmUnlockPagableImageSection
NTOSKRNL.EXE::RtlFreeAnsiString
NTOSKRNL.EXE::RtlInitAnsiString
NTOSKRNL.EXE::RtlInitUnicodeString
NTOSKRNL.EXE::RtlUnicodeStringToAnsiString
TlgRegisterAggregateProvider
WPPRECORDER.SYS::imp_WppRecorderConfigure
WPPRECORDER.SYS::imp_WppRecorderLogCreate
WPP_RECORDER_SF_sDd
WppInitKm
WppLoadTracingSupport
__security_check_cookieExpand for full list:
Feature_ModernWpp__private_IsEnabledDeviceUsageNoInline
InitializeTelemetryAssertsKMWorkerInternal
MicrosoftTelemetryAssertTriggeredMsgKM
NTOSKRNL.EXE::EtwRegister
NTOSKRNL.EXE::EtwSetInformation
NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExReleasePushLockExclusiveEx
NTOSKRNL.EXE::IoQueryFullDriverPath
NTOSKRNL.EXE::RtlFreeAnsiString
NTOSKRNL.EXE::RtlInitAnsiString
NTOSKRNL.EXE::RtlInitUnicodeString
NTOSKRNL.EXE::RtlUnicodeStringToAnsiString
TlgRegisterAggregateProvider
WPPRECORDER.SYS::WppAutoLogStart
WPPRECORDER.SYS::imp_WppRecorderConfigure
WPPRECORDER.SYS::imp_WppRecorderLogCreate
WPP_RECORDER_AND_TRACE_SF_sDD
__security_check_cookie
FLTMGR.SYS::FltGetFileNameInformation
FLTMGR.SYS::FltGetInstanceContext
FLTMGR.SYS::FltReleaseContext
FLTMGR.SYS::FltReleaseFileNameInformation
FLTMGR.SYS::FltReleaseResource
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::RtlPrefixUnicodeString
WPP_RECORDER_SF_sDd|FLTMGR.SYS::FltAcquireResourceShared
FLTMGR.SYS::FltGetFileNameInformation
FLTMGR.SYS::FltGetInstanceContext
FLTMGR.SYS::FltReleaseContext
FLTMGR.SYS::FltReleaseFileNameInformation
FLTMGR.SYS::FltReleaseResource
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::RtlPrefixUnicodeString
WPP_RECORDER_AND_TRACE_SF_sDD|
|`calling`|PrjfFsctlDeleteReparsePoint
PrjfGetUnionContextByFileNameEx
PrjfPrepareForDelete|PrjfFsctlDeleteReparsePoint
PrjfGetUnionContextByFileNameEx
PrjfPrepareForDelete
PrjfSleepOnTestSettingFlagsForTests|
|paramcount|4|4|
|`address`|1c0003098|1400034e0|
|sig|undefined8 * __fastcall PrjfGetUnionContextByFileName(undefined8 param_1, undefined8 param_2, ushort * param_3, undefined1 * param_4)|undefined8 * __fastcall PrjfGetUnionContextByFileName(undefined8 param_1, undefined8 param_2, ushort * param_3, undefined1 * param_4)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfGetUnionContextByFileName Called Diff
```diff
--- PrjfGetUnionContextByFileName called
+++ PrjfGetUnionContextByFileName called
@@ -9 +9 @@
-WPP_RECORDER_SF_sDd
+WPP_RECORDER_AND_TRACE_SF_sDD
```
### PrjfGetUnionContextByFileName Calling Diff
```diff
--- PrjfGetUnionContextByFileName calling
+++ PrjfGetUnionContextByFileName calling
@@ -3,0 +4 @@
+PrjfSleepOnTestSettingFlagsForTests
```
### PrjfGetUnionContextByFileName Diff
```diff
--- PrjfGetUnionContextByFileName
+++ PrjfGetUnionContextByFileName
@@ -1,81 +1,85 @@
undefined8 *
PrjfGetUnionContextByFileName
(undefined8 param_1,undefined8 param_2,ushort *param_3,undefined1 *param_4)
{
int *piVar1;
bool bVar2;
char cVar3;
int iVar4;
undefined8 *puVar5;
undefined8 *puVar6;
undefined1 uVar7;
longlong local_res18;
longlong local_res20;
local_res18 = 0;
puVar5 = (undefined8 *)0x0;
local_res20 = 0;
bVar2 = false;
uVar7 = 0;
iVar4 = FltGetInstanceContext(param_2,&local_res18);
if ((iVar4 < 0) || (local_res18 == 0)) {
MicrosoftTelemetryAssertTriggeredNoArgsKM();
}
if (param_3 == (ushort *)0x0) {
iVar4 = FltGetFileNameInformation(param_1,0x101,&local_res20);
if (iVar4 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,9,0x24,
- &WPP_0def1edc605734705626ac974b591885_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\context.c");
+ if (((DAT_0 & 2) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x209,DAT_0 & 2,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,9,0x24,
+ &WPP_16258fdb5ea53a6e7a49e4d7510d8a5c_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\context.c");
}
- goto LAB_0;
+ goto LAB_1;
}
param_3 = (ushort *)(local_res20 + 8);
}
FltAcquireResourceShared(local_res18 + 0x30);
bVar2 = true;
puVar5 = (undefined8 *)(local_res18 + 0x98);
uVar7 = 0;
for (puVar6 = (undefined8 *)*puVar5; puVar6 != puVar5; puVar6 = (undefined8 *)*puVar6) {
puVar5 = puVar6 + -2;
cVar3 = RtlPrefixUnicodeString(puVar6 + 3,param_3,1);
if (cVar3 == '\0') {
if (*(char *)(puVar6 + 99) != '\0') {
uVar7 = 1;
}
}
else if ((*param_3 <= *(ushort *)(puVar6 + 3)) ||
(*(short *)(*(longlong *)(param_3 + 4) + (ulonglong)(*(ushort *)(puVar6 + 3) >> 1) * 2)
== 0x5c)) {
LOCK();
piVar1 = (int *)(puVar6 + 9);
iVar4 = *piVar1;
*piVar1 = *piVar1 + 1;
UNLOCK();
if (iVar4 + 1 < 2) {
MicrosoftTelemetryAssertTriggeredNoArgsKM();
}
- goto LAB_0;
+ goto LAB_1;
}
puVar5 = (undefined8 *)(local_res18 + 0x98);
}
puVar5 = (undefined8 *)0x0;
-LAB_0:
+LAB_1:
if (param_4 != (undefined1 *)0x0) {
*param_4 = uVar7;
}
if (bVar2) {
FltReleaseResource(local_res18 + 0x30);
}
if (local_res18 != 0) {
FltReleaseContext();
}
if (local_res20 != 0) {
FltReleaseFileNameInformation();
}
return puVar5;
}
```
## PrjfDeleteTombstoneIfExists
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,sig,address,called|
|ratio|0.45|
|i_ratio|0.45|
|m_ratio|0.92|
|b_ratio|0.41|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfDeleteTombstoneIfExists|PrjfDeleteTombstoneIfExists|
|fullname|PrjfDeleteTombstoneIfExists|PrjfDeleteTombstoneIfExists|
|refcount|4|4|
|`length`|887|1062|
|`called`|Expand for full list:
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltQueryInformationFile
FLTMGR.SYS::FltReleaseContext
FLTMGR.SYS::FltSetInformationFile
NTOSKRNL.EXE::ObfDereferenceObject
PrjfAddInMemoryTombstone
PrjfGetSetFileContext
PrjfOpenAsReparsePoint
PrjfTelemetryTombstoneFailureOperation
WPP_RECORDER_SF_sDd
WPP_RECORDER_SF_sDdZ
WPP_RECORDER_SF_sDqd
__security_check_cookieExpand for full list:
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltQueryInformationFile
FLTMGR.SYS::FltReleaseContext
FLTMGR.SYS::FltSetInformationFile
NTOSKRNL.EXE::ObfDereferenceObject
PrjfAddInMemoryTombstone
PrjfGetSetFileContext
PrjfOpenAsReparsePoint
PrjfTelemetryTombstoneFailureOperation
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDdZ
WPP_RECORDER_AND_TRACE_SF_sDqd
__security_check_cookie
PrjfPrepareDestinationForRenameOrLink
PrjfRemoveTombstonesFromDirectory|PrjfPopulateDestinationForRenameOrLink
PrjfPrepareDestinationForRenameOrLink
PrjfRemoveTombstonesFromDirectory|
|paramcount|4|4|
|`address`|1c00338f0|14004300c|
|`sig`|ulonglong __fastcall PrjfDeleteTombstoneIfExists(undefined8 param_1, longlong param_2, undefined8 param_3, wchar_t * param_4)|undefined4 * __fastcall PrjfDeleteTombstoneIfExists(undefined8 param_1, longlong param_2, undefined8 param_3, wchar_t * param_4)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfDeleteTombstoneIfExists Called Diff
```diff
--- PrjfDeleteTombstoneIfExists called
+++ PrjfDeleteTombstoneIfExists called
@@ -10,3 +10,3 @@
-WPP_RECORDER_SF_sDd
-WPP_RECORDER_SF_sDdZ
-WPP_RECORDER_SF_sDqd
+WPP_RECORDER_AND_TRACE_SF_sDD
+WPP_RECORDER_AND_TRACE_SF_sDdZ
+WPP_RECORDER_AND_TRACE_SF_sDqd
```
### PrjfDeleteTombstoneIfExists Diff
```diff
--- PrjfDeleteTombstoneIfExists
+++ PrjfDeleteTombstoneIfExists
@@ -1,116 +1,134 @@
/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
/* WARNING: Type propagation algorithm not settling */
-ulonglong PrjfDeleteTombstoneIfExists
- (undefined8 param_1,longlong param_2,undefined8 param_3,wchar_t *param_4)
+undefined4 *
+PrjfDeleteTombstoneIfExists(undefined8 param_1,longlong param_2,undefined8 param_3,wchar_t *param_4)
{
uint extraout_EAX;
- uint uVar1;
- ulonglong uVar2;
- ulonglong uVar3;
+ ulonglong uVar1;
+ byte bVar2;
+ undefined4 *puVar3;
longlong *plVar4;
- undefined2 uVar5;
+ uint uVar5;
+ bool bVar6;
undefined1 auStackY_e8 [32];
undefined8 in_stack_ffffffffffffff38;
- undefined4 uVar6;
- byte local_88 [8];
+ ushort uVar7;
+ undefined4 uVar8;
+ undefined8 *******pppppppuVar9;
+ char local_88 [8];
longlong local_80;
undefined4 local_78;
longlong local_70;
longlong local_68 [3];
undefined1 uStack_4b;
undefined8 local_50;
ulonglong local_48;
+ undefined4 uVar10;
local_48 = __security_cookie ^ (ulonglong)auStackY_e8;
local_50 = 0;
local_68[0] = 0;
+ pppppppuVar9 = (undefined8 *******)local_88;
local_80 = 0;
- local_88[0] = 0;
+ uVar8 = 0;
+ local_88[0] = '\0';
local_88[1] = 0;
local_68[1] = 0;
local_68[2] = 0;
local_70 = 0;
local_78 = 0;
- PrjfOpenAsReparsePoint
- (param_4,param_3,param_1,0x10080,in_stack_ffffffffffffff38,(longlong)local_68,
- (longlong)&local_80,(byte *)0x0,(byte *)0x0,(undefined8 *******)0x0,local_88,
- (uint *)0x0);
- uVar3 = (ulonglong)extraout_EAX;
- if ((extraout_EAX == 0xc0000034) || (local_88[0] == 0)) {
- uVar3 = 0;
- goto LAB_0;
- }
+ uVar5 = PrjfOpenAsReparsePoint
+ (param_4,param_3,param_1,0x10080,in_stack_ffffffffffffff38,(longlong)local_68,
+ (longlong)&local_80,(byte *)0x0,(byte *)0x0,(byte *)0x0,pppppppuVar9,
+ (uint *)0x0);
+ uVar10 = (undefined4)((ulonglong)pppppppuVar9 >> 0x20);
+ puVar3 = (undefined4 *)(ulonglong)uVar5;
+ if ((extraout_EAX == 0xc0000034) || (local_88[0] == (char)uVar5)) goto LAB_0;
if ((int)extraout_EAX < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0;
- uVar5 = 0xe;
+ bVar6 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar2 = DAT_1 & 8;
+ puVar3 = (undefined4 *)(ulonglong)extraout_EAX;
+ if ((bVar2 == 0) && (!bVar6)) goto LAB_0;
+ uVar7 = 0xe;
}
else {
- plVar4 = &local_70;
- uVar6 = 0;
- uVar2 = PrjfGetSetFileContext
- (param_1,local_80,'\x01',(longlong *)0x0,(undefined4 *)0x0,(undefined2 *)0x0,
- (undefined1 *)0x0,plVar4);
- uVar3 = uVar2 & 0xffffffff;
- if ((int)uVar2 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDdZ
- (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x13,0xf,
+ uVar1 = PrjfGetSetFileContext
+ (param_1,local_80,'\x01',(longlong *)0x0,puVar3,(undefined2 *)puVar3,
+ (undefined1 *)puVar3,&local_70);
+ puVar3 = (undefined4 *)(uVar1 & 0xffffffff);
+ if ((int)uVar1 < 0) {
+ if (((DAT_1 & 8) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDdZ
+ (0x213,DAT_1 & 8,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x13,0xf,
&WPP_4079bacae6ce31fd7110e995a8b7a7c9_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\tombstone.c",CONCAT44(uVar6,0x1e8),
- CONCAT44((int)((ulonglong)plVar4 >> 0x20),(int)uVar2),
- (wchar_t *)(local_80 + 0x58));
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\tombstone.c",CONCAT44(uVar8,0x1e8),
+ CONCAT44(uVar10,(int)uVar1),(wchar_t *)(local_80 + 0x58));
}
goto LAB_0;
}
plVar4 = local_68 + 1;
- uVar1 = FltQueryInformationFile(param_1,local_80,plVar4);
- uVar3 = (ulonglong)uVar1;
- if (-1 < (int)uVar1) {
- uVar2 = PrjfAddInMemoryTombstone
+ uVar5 = FltQueryInformationFile(param_1,local_80,plVar4);
+ puVar3 = (undefined4 *)(ulonglong)uVar5;
+ if (-1 < (int)uVar5) {
+ uVar1 = PrjfAddInMemoryTombstone
(param_1,(longlong)param_4,
CONCAT71((int7)((ulonglong)plVar4 >> 8),uStack_4b),0,param_2,&local_70);
- uVar3 = uVar2 & 0xffffffff;
- if ((int)uVar2 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x13,0x11,
- &WPP_4079bacae6ce31fd7110e995a8b7a7c9_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\tombstone.c");
+ puVar3 = (undefined4 *)(uVar1 & 0xffffffff);
+ if ((int)uVar1 < 0) {
+ if (((DAT_1 & 8) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x213,DAT_1 & 8,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x13,0x11,
+ &WPP_4079bacae6ce31fd7110e995a8b7a7c9_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\tombstone.c");
}
- PrjfTelemetryTombstoneFailureOperation(3,3,(int)uVar2);
+ PrjfTelemetryTombstoneFailureOperation(3,3,(int)uVar1);
}
else {
local_88[1] = 1;
- uVar1 = FltSetInformationFile(param_1,local_80,local_88 + 1,1);
- uVar3 = (ulonglong)uVar1;
- if (((int)uVar1 < 0) &&
- ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
- WPP_RECORDER_SF_sDqd
- (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x13,0x12,
- &WPP_4079bacae6ce31fd7110e995a8b7a7c9_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\tombstone.c");
+ uVar5 = FltSetInformationFile(param_1,local_80,local_88 + 1,1);
+ puVar3 = (undefined4 *)(ulonglong)uVar5;
+ if ((int)uVar5 < 0) {
+ if (((DAT_1 & 8) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDqd
+ (0x213,DAT_1 & 8,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x13,0x12,
+ &WPP_4079bacae6ce31fd7110e995a8b7a7c9_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\tombstone.c");
+ }
}
}
goto LAB_0;
}
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0;
- uVar5 = 0x10;
+ bVar6 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar2 = DAT_1 & 8;
+ if ((bVar2 == 0) && (!bVar6)) goto LAB_0;
+ uVar7 = 0x10;
}
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x13,uVar5,
- &WPP_4079bacae6ce31fd7110e995a8b7a7c9_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\tombstone.c");
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x213,bVar2,bVar6,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x13,uVar7,
+ &WPP_4079bacae6ce31fd7110e995a8b7a7c9_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\tombstone.c");
LAB_0:
if (local_68[0] != 0) {
FltClose();
}
if (local_80 != 0) {
ObfDereferenceObject();
}
if (local_70 != 0) {
FltReleaseContext();
}
- return uVar3;
+ return puVar3;
}
```
## PrjfProcessOpenWithinVirtualizationRoots
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,sig,address,called|
|ratio|0.19|
|i_ratio|0.12|
|m_ratio|0.9|
|b_ratio|0.37|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfProcessOpenWithinVirtualizationRoots|PrjfProcessOpenWithinVirtualizationRoots|
|fullname|PrjfProcessOpenWithinVirtualizationRoots|PrjfProcessOpenWithinVirtualizationRoots|
|refcount|2|2|
|`length`|881|1047|
|`called`|Expand for full list:
FLTMGR.SYS::FltReleaseContext
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExAcquireFastMutex
NTOSKRNL.EXE::ExReleaseFastMutex
PrjfExpandAndWait
PrjfGetNotificationMask
PrjfGetSetContextFileObject
PrjfSendPostCreateNotifications
PrjfSetPlaceHolderFlagsSynchronized
WPP_RECORDER_SF_sDd
WPP_RECORDER_SF_sDdZ
Expand for full list:
FLTMGR.SYS::FltReleaseContext
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExAcquireFastMutex
NTOSKRNL.EXE::ExReleaseFastMutex
PrjfExpandAndWait
PrjfGetNotificationMask
PrjfGetSetContextFileObject
PrjfSendPostCreateNotifications
PrjfSetPlaceHolderFlagsSynchronized
WPP_RECORDER_AND_TRACE_SF_sD
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDdZ
MicrosoftTelemetryAssertTriggeredNoArgsKM
WPP_RECORDER_SF_sDd
memcpy|MicrosoftTelemetryAssertTriggeredMsgKM
MicrosoftTelemetryAssertTriggeredNoArgsKM
WPP_RECORDER_AND_TRACE_SF_sDD
memmove|
|calling|PrjfTranslateCurrentEnumEntry|PrjfTranslateCurrentEnumEntry|
|paramcount|9|9|
|`address`|1c001c8fc|140027374|
|sig|undefined8 __fastcall PrjfMungeDirectoryEnumerateWithShortnameFileId64(int param_1, char param_2, undefined8 * param_3, char param_4, char param_5, undefined8 * param_6, uint param_7, undefined8 * param_8, uint * param_9)|undefined8 __fastcall PrjfMungeDirectoryEnumerateWithShortnameFileId64(int param_1, char param_2, undefined8 * param_3, char param_4, char param_5, undefined8 * param_6, uint param_7, undefined8 * param_8, uint * param_9)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfMungeDirectoryEnumerateWithShortnameFileId64 Called Diff
```diff
--- PrjfMungeDirectoryEnumerateWithShortnameFileId64 called
+++ PrjfMungeDirectoryEnumerateWithShortnameFileId64 called
@@ -3,2 +3,2 @@
-WPP_RECORDER_SF_sDd
-memcpy
+WPP_RECORDER_AND_TRACE_SF_sDD
+memmove
```
### PrjfMungeDirectoryEnumerateWithShortnameFileId64 Diff
```diff
--- PrjfMungeDirectoryEnumerateWithShortnameFileId64
+++ PrjfMungeDirectoryEnumerateWithShortnameFileId64
@@ -1,178 +1,190 @@
undefined8
PrjfMungeDirectoryEnumerateWithShortnameFileId64
(int param_1,char param_2,undefined8 *param_3,char param_4,char param_5,
undefined8 *param_6,uint param_7,undefined8 *param_8,uint *param_9)
{
uint uVar1;
undefined4 uVar2;
bool bVar3;
uint uVar4;
undefined8 uVar5;
undefined8 uVar6;
uint uVar7;
uVar5 = 0;
uVar7 = 0;
uVar4 = 0;
if ((param_1 == 0x25) || (bVar3 = true, param_1 == 0x4f)) {
bVar3 = false;
}
if (bVar3) {
MicrosoftTelemetryAssertTriggeredNoArgsKM();
}
uVar6 = uVar5;
if (param_1 != 0x25) {
if (param_1 != 0x4f) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),3,0x12,0x11,
- &WPP_e21b7c61aee93f730c9c252e6e8da2f4_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\dir.c");
+ if (((DAT_0 & 4) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x312,DAT_0 & 4,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),3,0x12,0x11,
+ &WPP_3d19aee1b05838720427e757513a9608_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\dir.c");
}
MicrosoftTelemetryAssertTriggeredMsgKM();
uVar6 = 0xc00000bb;
- goto LAB_0;
+ goto LAB_1;
}
uVar1 = *(uint *)((longlong)param_3 + 0x3c);
if ((param_7 < uVar1 + 0x6a) && ((uVar7 = uVar4, param_7 < 0x6a || (param_2 == '\0'))))
- goto LAB_0;
+ goto LAB_1;
uVar7 = uVar1;
if (param_7 - 0x6a <= uVar1) {
uVar7 = param_7 - 0x6a;
}
uVar5 = param_3[1];
*param_6 = *param_3;
param_6[1] = uVar5;
uVar5 = param_3[3];
param_6[2] = param_3[2];
param_6[3] = uVar5;
uVar5 = param_3[5];
param_6[4] = param_3[4];
param_6[5] = uVar5;
uVar5 = param_3[7];
param_6[6] = param_3[6];
param_6[7] = uVar5;
uVar5 = param_3[9];
param_6[8] = param_3[8];
param_6[9] = uVar5;
if (param_4 == '\0') {
-LAB_1:
+LAB_2:
*(undefined1 *)(param_6 + 10) = 0;
}
else {
if (0x18 < *(byte *)(param_3 + 10)) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x12,0x10,
- &WPP_e21b7c61aee93f730c9c252e6e8da2f4_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\dir.c");
+ if (((DAT_3 & 4) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x212,DAT_3 & 4,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x12,0x10,
+ &WPP_3d19aee1b05838720427e757513a9608_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\dir.c");
}
if (0x18 < *(byte *)(param_3 + 10)) {
MicrosoftTelemetryAssertTriggeredNoArgsKM();
}
- goto LAB_1;
+ goto LAB_2;
}
*(byte *)(param_6 + 10) = *(byte *)(param_3 + 10);
- memcpy((void *)((longlong)param_6 + 0x52),(void *)((longlong)param_3 + 0x52),
- (longlong)*(char *)(param_3 + 10));
+ memmove((void *)((longlong)param_6 + 0x52),(void *)((longlong)param_3 + 0x52),
+ (longlong)*(char *)(param_3 + 10));
}
if (*(int *)((longlong)param_3 + 0x44) == -0x6fffffe4) {
uVar4 = *(uint *)(param_3 + 7) & 0xffffe9ff;
if (uVar4 == 0) {
uVar4 = 0x80;
}
*(uint *)(param_6 + 7) = uVar4;
*(undefined4 *)((longlong)param_6 + 0x44) = 0;
}
if (param_5 != '\0') {
*(uint *)(param_6 + 7) = *(uint *)(param_6 + 7) | 0x440000;
param_6[6] = 0;
param_6[9] = 0xffffffffffffffff;
}
- memcpy((void *)((longlong)param_6 + 0x6a),(void *)((longlong)param_3 + 0x6a),(ulonglong)uVar7);
+ memmove((void *)((longlong)param_6 + 0x6a),(void *)((longlong)param_3 + 0x6a),(ulonglong)uVar7);
*(undefined4 *)param_6 = 0;
*param_8 = param_6;
uVar7 = uVar7 + 0x6a;
if (uVar7 < uVar1 + 0x6a) {
uVar6 = 0x80000005;
}
- goto LAB_0;
+ goto LAB_1;
}
uVar1 = *(uint *)((longlong)param_3 + 0x3c);
if ((param_7 < uVar1 + 0x68) && ((uVar6 = 0, uVar7 = uVar4, param_7 < 0x68 || (param_2 == '\0'))))
- goto LAB_0;
+ goto LAB_1;
uVar7 = uVar1;
if (param_7 - 0x68 <= uVar1) {
uVar7 = param_7 - 0x68;
}
uVar6 = param_3[1];
*param_6 = *param_3;
param_6[1] = uVar6;
uVar6 = param_3[3];
param_6[2] = param_3[2];
param_6[3] = uVar6;
uVar6 = param_3[5];
param_6[4] = param_3[4];
param_6[5] = uVar6;
param_6[6] = param_3[6];
if (*(int *)((longlong)param_3 + 0x44) == -0x6fffffe4) {
uVar4 = *(uint *)(param_3 + 7) & 0xffffe9ff;
if (uVar4 == 0) {
uVar4 = 0x80;
}
*(uint *)(param_6 + 7) = uVar4;
-LAB_2:
+LAB_4:
uVar2 = *(undefined4 *)(param_3 + 8);
}
else {
*(uint *)(param_6 + 7) = *(uint *)(param_3 + 7);
- if ((*(uint *)(param_3 + 7) & 0x400) == 0) goto LAB_2;
+ if ((*(uint *)(param_3 + 7) & 0x400) == 0) goto LAB_4;
uVar2 = *(undefined4 *)((longlong)param_3 + 0x44);
}
*(undefined4 *)(param_6 + 8) = uVar2;
if (param_5 == '\0') {
param_6[0xc] = param_3[9];
}
else {
*(uint *)(param_6 + 7) = *(uint *)(param_6 + 7) | 0x440000;
param_6[6] = 0;
param_6[0xc] = 0xffffffffffffffff;
}
if (param_4 == '\0') {
-LAB_3:
+LAB_5:
*(undefined1 *)((longlong)param_6 + 0x44) = 0;
}
else {
if (0x18 < *(byte *)(param_3 + 10)) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x12,0xf,
- &WPP_e21b7c61aee93f730c9c252e6e8da2f4_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\dir.c");
+ if (((DAT_3 & 4) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x212,DAT_3 & 4,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x12,0xf,
+ &WPP_3d19aee1b05838720427e757513a9608_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\dir.c");
}
if (0x18 < *(byte *)(param_3 + 10)) {
MicrosoftTelemetryAssertTriggeredNoArgsKM();
}
- goto LAB_3;
+ goto LAB_5;
}
*(byte *)((longlong)param_6 + 0x44) = *(byte *)(param_3 + 10);
- memcpy((void *)((longlong)param_6 + 0x46),(void *)((longlong)param_3 + 0x52),
- (longlong)*(char *)(param_3 + 10));
+ memmove((void *)((longlong)param_6 + 0x46),(void *)((longlong)param_3 + 0x52),
+ (longlong)*(char *)(param_3 + 10));
}
*(undefined1 *)((longlong)param_6 + 0x44) = 0;
*(undefined8 *)((longlong)param_6 + 0x46) = 0;
*(undefined8 *)((longlong)param_6 + 0x4e) = 0;
*(undefined8 *)((longlong)param_6 + 0x56) = 0;
*(undefined4 *)((longlong)param_6 + 0x3c) = *(undefined4 *)((longlong)param_3 + 0x3c);
- memcpy(param_6 + 0xd,(void *)((longlong)param_3 + 0x6a),(ulonglong)uVar7);
+ memmove(param_6 + 0xd,(void *)((longlong)param_3 + 0x6a),(ulonglong)uVar7);
*(undefined4 *)param_6 = 0;
*param_8 = param_6;
uVar7 = uVar7 + 0x68;
uVar6 = uVar5;
if (uVar7 < uVar1 + 0x68) {
uVar6 = 0x80000005;
}
-LAB_0:
+LAB_1:
*param_9 = uVar7;
return uVar6;
}
```
## PrjfFlushAndUpdateDiskStateWorker
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.46|
|i_ratio|0.34|
|m_ratio|0.91|
|b_ratio|0.46|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfFlushAndUpdateDiskStateWorker|PrjfFlushAndUpdateDiskStateWorker|
|fullname|PrjfFlushAndUpdateDiskStateWorker|PrjfFlushAndUpdateDiskStateWorker|
|refcount|3|3|
|`length`|877|1082|
|`called`|Expand for full list:
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltFlushBuffers2
FLTMGR.SYS::FltFreeGenericWorkItem
FLTMGR.SYS::FltReleaseContext
NTOSKRNL.EXE::ExReInitializeRundownProtection
NTOSKRNL.EXE::ExRundownCompleted
NTOSKRNL.EXE::ExWaitForRundownProtectionRelease
NTOSKRNL.EXE::KeClearEvent
NTOSKRNL.EXE::KeSetEvent
NTOSKRNL.EXE::ObfDereferenceObject
PrjfClearAttributes
PrjfGetContextFileObject
PrjfRemoveSparse
PrjfReopenFile
PrjfSetPlaceHolderFlags
PrjfUntagFile
WPP_RECORDER_SF_sDdZ
WPP_RECORDER_SF_sDqExpand for full list:
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltFlushBuffers2
FLTMGR.SYS::FltFreeGenericWorkItem
FLTMGR.SYS::FltReleaseContext
NTOSKRNL.EXE::ExReInitializeRundownProtection
NTOSKRNL.EXE::ExRundownCompleted
NTOSKRNL.EXE::ExWaitForRundownProtectionRelease
NTOSKRNL.EXE::KeClearEvent
NTOSKRNL.EXE::KeSetEvent
NTOSKRNL.EXE::ObfDereferenceObject
PrjfClearAttributes
PrjfGetContextFileObject
PrjfRemoveSparse
PrjfReopenFile
PrjfSetPlaceHolderFlags
PrjfUntagFile
WPP_RECORDER_AND_TRACE_SF_sDdZ
WPP_RECORDER_AND_TRACE_SF_sDq
NTOSKRNL.EXE::ExAllocateFromNPagedLookasideList
NTOSKRNL.EXE::ExFreeToNPagedLookasideList
NTOSKRNL.EXE::KeInitializeEvent
WPP_RECORDER_SF_sDZ
__security_check_cookie
_tlgWriteAgg|FLTMGR.SYS::FltCbdqInitialize
NTOSKRNL.EXE::ExAllocateFromNPagedLookasideList
NTOSKRNL.EXE::ExFreeToNPagedLookasideList
NTOSKRNL.EXE::KeInitializeEvent
WPP_RECORDER_AND_TRACE_SF_sDZ
__security_check_cookie
_tlgWriteAgg|
|calling|PrjfLaunchExpansion|PrjfLaunchExpansion|
|paramcount|6|6|
|`address`|1c001e658|140029354|
|sig|int __fastcall PrjfCreateExpansionContext(undefined8 param_1, longlong param_2, longlong param_3, uint param_4, char param_5, undefined8 * param_6)|int __fastcall PrjfCreateExpansionContext(undefined8 param_1, longlong param_2, longlong param_3, uint param_4, char param_5, undefined8 * param_6)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfCreateExpansionContext Called Diff
```diff
--- PrjfCreateExpansionContext called
+++ PrjfCreateExpansionContext called
@@ -5 +5 @@
-WPP_RECORDER_SF_sDZ
+WPP_RECORDER_AND_TRACE_SF_sDZ
```
### PrjfCreateExpansionContext Diff
```diff
--- PrjfCreateExpansionContext
+++ PrjfCreateExpansionContext
@@ -1,109 +1,111 @@
/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */
int PrjfCreateExpansionContext
(undefined8 param_1,longlong param_2,longlong param_3,uint param_4,char param_5,
undefined8 *param_6)
{
longlong *plVar1;
longlong lVar2;
- bool bVar3;
- int iVar4;
+ int iVar3;
+ uint *puVar4;
uint *puVar5;
- uint *puVar6;
- undefined8 uVar7;
- undefined1 auStackY_f8 [32];
- undefined4 uVar8;
+ undefined8 uVar6;
+ bool bVar7;
+ undefined1 auStackY_118 [32];
+ undefined4 in_stack_ffffffffffffff34;
undefined8 local_b8;
undefined8 local_b0;
undefined8 local_a8 [4];
undefined8 *local_88;
undefined8 local_80;
uint *local_78;
undefined8 local_70;
undefined8 local_68;
uint local_60 [2];
undefined8 *local_58;
undefined8 local_50;
ulonglong local_48;
- local_48 = __security_cookie ^ (ulonglong)auStackY_f8;
- puVar5 = (uint *)ExAllocateFromNPagedLookasideList(&DAT_0);
- if (puVar5 == (uint *)0x0) {
- iVar4 = -0x3fffff66;
+ local_48 = __security_cookie ^ (ulonglong)auStackY_118;
+ puVar4 = (uint *)ExAllocateFromNPagedLookasideList(&DAT_0);
+ if (puVar4 == (uint *)0x0) {
+ iVar3 = -0x3fffff66;
}
else {
- uVar8 = 1;
- iVar4 = FltCbdqInitialize(param_1,puVar5 + 0x12,PrjfExpansionCsqInsertIo,
+ iVar3 = FltCbdqInitialize(param_1,puVar4 + 0x12,PrjfExpansionCsqInsertIo,
PrjfExpansionCsqRemoveIo);
- if (iVar4 < 0) {
- ExFreeToNPagedLookasideList(&DAT_0,puVar5);
+ if (iVar3 < 0) {
+ ExFreeToNPagedLookasideList(&DAT_0,puVar4);
}
else {
- puVar6 = puVar5 + 0x32;
- *(uint **)(puVar5 + 0x34) = puVar6;
- *(uint **)puVar6 = puVar6;
- KeInitializeEvent(puVar5 + 4,0);
- KeInitializeEvent(puVar5 + 10,1);
- uVar7 = 0;
- puVar5[0x36] = 1;
- puVar6 = puVar5 + 0x3c;
- puVar5[0x38] = 0;
- puVar5[0x39] = 0;
- puVar5[0x3a] = 0;
- KeInitializeEvent(puVar6,1);
- *puVar5 = 0;
- puVar5[2] = 0;
- puVar5[0x10] = 0;
- puVar5[0x11] = 0;
- *(longlong *)(puVar5 + 0x44) = param_3;
- puVar5[0x4a] = *(uint *)(param_2 + 0x48);
+ puVar5 = puVar4 + 0x32;
+ *(uint **)(puVar4 + 0x34) = puVar5;
+ *(uint **)puVar5 = puVar5;
+ KeInitializeEvent(puVar4 + 4,0,1);
+ KeInitializeEvent(puVar4 + 10,1);
+ uVar6 = 0;
+ puVar4[0x36] = 1;
+ puVar5 = puVar4 + 0x3c;
+ puVar4[0x38] = 0;
+ puVar4[0x39] = 0;
+ puVar4[0x3a] = 0;
+ KeInitializeEvent(puVar5,1);
+ *puVar4 = 0;
+ puVar4[2] = 0;
+ puVar4[0x10] = 0;
+ puVar4[0x11] = 0;
+ *(longlong *)(puVar4 + 0x44) = param_3;
+ puVar4[0x4a] = *(uint *)(param_2 + 0x48);
LOCK();
plVar1 = (longlong *)(param_2 + 0x40);
lVar2 = *plVar1;
*plVar1 = *plVar1 + 1;
UNLOCK();
- *(longlong *)(puVar5 + 0x48) = lVar2 + 1;
- puVar5[0x46] = 0;
+ *(longlong *)(puVar4 + 0x48) = lVar2 + 1;
+ puVar4[0x46] = 0;
if ((*(int *)(param_3 + 0x40) == 1) && (param_5 == '\0')) {
- puVar5[1] = 3;
- *puVar5 = *puVar5 | 8;
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- uVar7 = 10;
- puVar6 = *(uint **)(WPP_GLOBAL_Control + 0x40);
- WPP_RECORDER_SF_sDZ(puVar6,3,10,0xb,&WPP_286736bb6a73387d41449b09eaab690a_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\expansion.c",
- CONCAT44(uVar8,0x246),(wchar_t *)(param_3 + 0x78));
+ puVar4[1] = 3;
+ *puVar4 = *puVar4 | 8;
+ bVar7 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ uVar6 = CONCAT71((int7)((ulonglong)uVar6 >> 8),bVar7);
+ if (((DAT_1 & 4) != 0) || (bVar7)) {
+ puVar5 = (uint *)0x30a;
+ WPP_RECORDER_AND_TRACE_SF_sDZ
+ (0x30a,DAT_1 & 4,bVar7,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),3,10,
+ 0xb,&WPP_8662402235063b115c167dc7c0c22e28_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\expansion.c",
+ CONCAT44(in_stack_ffffffffffffff34,599),(wchar_t *)(param_3 + 0x78));
}
- if (5 < DAT_1) {
- if (((_DAT_2 & 0x400000000000) == 0) ||
- (bVar3 = true, (DAT_3 & 0x400000000000) != DAT_3)) {
- bVar3 = false;
+ if (5 < DAT_2) {
+ if (((_DAT_3 & 0x400000000000) == 0) ||
+ (bVar7 = true, (DAT_4 & 0x400000000000) != DAT_4)) {
+ bVar7 = false;
}
- if (bVar3) {
+ if (bVar7) {
local_88 = &local_b8;
local_b8 = 1;
local_78 = local_60;
local_80 = 8;
local_68 = *(undefined8 *)(param_2 + 0x30);
local_60[0] = (uint)*(ushort *)(param_2 + 0x28);
local_58 = &local_b0;
local_70 = 2;
local_60[1] = 0;
local_b0 = 0x1000000;
local_50 = 8;
- _tlgWriteAgg(puVar6,&DAT_4,uVar7,6,local_a8);
+ _tlgWriteAgg(puVar5,&DAT_5,uVar6,6,local_a8);
}
}
}
else {
- puVar5[1] = param_4;
+ puVar4[1] = param_4;
}
- *param_6 = puVar5;
+ *param_6 = puVar4;
}
}
- return iVar4;
+ return iVar3;
}
```
## PrjfTelemetryAndTracingCleanup
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.47|
|i_ratio|0.28|
|m_ratio|0.77|
|b_ratio|0.75|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfTelemetryAndTracingCleanup|PrjfTelemetryAndTracingCleanup|
|fullname|PrjfTelemetryAndTracingCleanup|PrjfTelemetryAndTracingCleanup|
|refcount|3|3|
|`length`|491|321|
|`called`|Expand for full list:
CancelTimerCallbacksAndDeleteTimer
DestroyAggregateSession
FastWppCallback
LookUpTableFlushComplete
NTOSKRNL.EXE::EtwUnregister
NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx
NTOSKRNL.EXE::ExReleasePushLockExclusiveEx
NTOSKRNL.EXE::IoWMIRegistrationControl
UninitializeTelemetryAssertsKM
WPPRECORDER.SYS::WppAutoLogStop
WPPRECORDER.SYS::imp_WppRecorderLogDelete
_guard_dispatch_icall
DestroyAggregateSession
FastWppCleanup
LookUpTableFlushComplete
NTOSKRNL.EXE::EtwUnregister
NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx
NTOSKRNL.EXE::ExReleasePushLockExclusiveEx
UninitializeTelemetryAssertsKM
WPPRECORDER.SYS::imp_WppRecorderLogDelete|
|calling|DriverEntry
PrjfUnload|DriverEntry
PrjfUnload|
|paramcount|0|0|
|`address`|1c0029dc8|1400377f8|
|sig|undefined __fastcall PrjfTelemetryAndTracingCleanup(void)|undefined __fastcall PrjfTelemetryAndTracingCleanup(void)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfTelemetryAndTracingCleanup Called Diff
```diff
--- PrjfTelemetryAndTracingCleanup called
+++ PrjfTelemetryAndTracingCleanup called
@@ -3 +3 @@
-FastWppCallback
+FastWppCleanup
@@ -8 +7,0 @@
-NTOSKRNL.EXE::IoWMIRegistrationControl
@@ -10 +8,0 @@
-WPPRECORDER.SYS::WppAutoLogStop
@@ -12 +9,0 @@
-_guard_dispatch_icall
```
### PrjfTelemetryAndTracingCleanup Diff
```diff
--- PrjfTelemetryAndTracingCleanup
+++ PrjfTelemetryAndTracingCleanup
@@ -1,80 +1,55 @@
-
-/* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */
void PrjfTelemetryAndTracingCleanup(void)
{
longlong *plVar1;
- longlong lVar2;
- undefined *puVar3;
+ undefined8 uVar2;
+ longlong lVar3;
longlong *plVar4;
- undefined8 uVar5;
- longlong lVar6;
+ longlong lVar5;
- uVar5 = DAT_0;
+ uVar2 = DAT_0;
if (DAT_1 == TlgAggregateInternalRegisteredProviderEtwCallback) {
- lVar6 = 0;
+ lVar5 = 0;
ExAcquirePushLockExclusiveEx(&DAT_2,0);
- lVar2 = DAT_3;
+ lVar3 = DAT_3;
plVar4 = &DAT_3;
- while (lVar2 != 0) {
- plVar1 = (longlong *)(lVar2 + 0x160);
- if (*(undefined4 **)(lVar2 + 0x158) == &DAT_4) {
+ while (lVar3 != 0) {
+ plVar1 = (longlong *)(lVar3 + 0x160);
+ if (*(undefined4 **)(lVar3 + 0x158) == &DAT_4) {
*plVar4 = *plVar1;
- LookUpTableFlushComplete(lVar2);
- uVar5 = DAT_5;
- lVar6 = lVar2;
+ LookUpTableFlushComplete(lVar3);
+ uVar2 = DAT_5;
+ lVar5 = lVar3;
if (DAT_3 == 0) {
DAT_5 = 0;
DAT_6 = 0;
- EtwUnregister(uVar5);
+ EtwUnregister(uVar2);
}
break;
}
plVar4 = plVar1;
- lVar2 = *plVar1;
+ lVar3 = *plVar1;
}
ExReleasePushLockExclusiveEx(&DAT_2,0);
- if (lVar6 != 0) {
- CancelTimerCallbacksAndDeleteTimer(lVar6);
+ if (lVar5 != 0) {
+ CancelTimerCallbacksAndDeleteTimer(lVar5);
}
- uVar5 = DAT_0;
+ uVar2 = DAT_0;
DAT_0 = 0;
DAT_4 = 0;
- EtwUnregister(uVar5);
+ EtwUnregister(uVar2);
DAT_1 = (code *)0x0;
- DestroyAggregateSession(lVar6);
+ DestroyAggregateSession(lVar5);
}
else {
DAT_0 = 0;
DAT_4 = 0;
- EtwUnregister(uVar5);
+ EtwUnregister(uVar2);
}
UninitializeTelemetryAssertsKM();
- puVar3 = WPP_GLOBAL_Control;
- uVar5 = _PrjfTraceRecorder;
- imp_WppRecorderLogDelete();
- FastWppCallback(puVar3,uVar5,'\x01',0,0);
- if ((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) {
- puVar3 = WPP_GLOBAL_Control;
- if (WPPTraceSuite == 4) {
- for (; puVar3 != (undefined *)0x0; puVar3 = *(undefined **)(puVar3 + 0x10)) {
- if (*(longlong *)(puVar3 + 0x38) != 0) {
- (*pfnEtwUnregister)();
- *(undefined8 *)(puVar3 + 0x38) = 0;
- }
- }
- }
- else if (WPPTraceSuite == 2) {
- IoWMIRegistrationControl(WPP_GLOBAL_Control);
- }
- uVar5 = 0;
- puVar3 = WPP_GLOBAL_Control;
- WppAutoLogStop();
- WPP_GLOBAL_Control = (undefined *)&WPP_GLOBAL_Control;
- WPP_RECORDER_INITIALIZED = (undefined *)&WPP_RECORDER_INITIALIZED;
- }
- FastWppCallback(puVar3,uVar5,'\0',0,0);
+ imp_WppRecorderLogDelete(WPP_GLOBAL_Control,_PrjfTraceRecorder);
+ FastWppCleanup();
return;
}
```
## PrjfGetSetStreamContext
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.41|
|i_ratio|0.4|
|m_ratio|0.95|
|b_ratio|0.31|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfGetSetStreamContext|PrjfGetSetStreamContext|
|fullname|PrjfGetSetStreamContext|PrjfGetSetStreamContext|
|refcount|2|2|
|`length`|1044|1186|
|`called`|Expand for full list:
FLTMGR.SYS::FltDeleteContext
FLTMGR.SYS::FltDeleteStreamContext
FLTMGR.SYS::FltGetStreamContext
FLTMGR.SYS::FltQueryInformationFile
FLTMGR.SYS::FltReleaseContext
FLTMGR.SYS::FltSetStreamContext
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::CcCoherencyFlushAndPurgeCache
NTOSKRNL.EXE::FsRtlAcquireFileExclusive
NTOSKRNL.EXE::FsRtlReleaseFile
NTOSKRNL.EXE::IoGetTopLevelIrp
NTOSKRNL.EXE::IoSetTopLevelIrp
PrjfCreateStreamContext
PrjfGetUnionContext
PrjfReleaseUnionContext
WPP_RECORDER_SF_sD
WPP_RECORDER_SF_sDd
WPP_RECORDER_SF_sDqd
__security_check_cookieExpand for full list:
FLTMGR.SYS::FltDeleteContext
FLTMGR.SYS::FltDeleteStreamContext
FLTMGR.SYS::FltGetStreamContext
FLTMGR.SYS::FltQueryInformationFile
FLTMGR.SYS::FltReleaseContext
FLTMGR.SYS::FltSetStreamContext
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::CcCoherencyFlushAndPurgeCache
NTOSKRNL.EXE::FsRtlAcquireFileExclusive
NTOSKRNL.EXE::FsRtlReleaseFile
NTOSKRNL.EXE::IoGetTopLevelIrp
NTOSKRNL.EXE::IoSetTopLevelIrp
PrjfCreateStreamContext
PrjfGetUnionContext
PrjfReleaseUnionContext
WPP_RECORDER_AND_TRACE_SF_sD
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDqd
__security_check_cookie
FLTMGR.SYS::FltGetTransactionContext
FLTMGR.SYS::FltReleaseContext
FLTMGR.SYS::FltSetTransactionContext
WPP_RECORDER_SF_sDd|FLTMGR.SYS::FltAllocateContext
FLTMGR.SYS::FltGetTransactionContext
FLTMGR.SYS::FltReleaseContext
FLTMGR.SYS::FltSetTransactionContext
WPP_RECORDER_AND_TRACE_SF_sDD|
|calling|PrjfPreCreate|PrjfPreCreate|
|paramcount|3|3|
|`address`|1c0018198|140022198|
|sig|int __fastcall PrjfFindOrCreateTransactionContext(undefined8 param_1, undefined8 param_2, longlong * param_3)|int __fastcall PrjfFindOrCreateTransactionContext(undefined8 param_1, undefined8 param_2, longlong * param_3)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfFindOrCreateTransactionContext Called Diff
```diff
--- PrjfFindOrCreateTransactionContext called
+++ PrjfFindOrCreateTransactionContext called
@@ -5 +5 @@
-WPP_RECORDER_SF_sDd
+WPP_RECORDER_AND_TRACE_SF_sDD
```
### PrjfFindOrCreateTransactionContext Diff
```diff
--- PrjfFindOrCreateTransactionContext
+++ PrjfFindOrCreateTransactionContext
@@ -1,54 +1,61 @@
int PrjfFindOrCreateTransactionContext(undefined8 param_1,undefined8 param_2,longlong *param_3)
{
int iVar1;
longlong lVar2;
- undefined2 uVar3;
+ byte bVar3;
+ bool bVar4;
longlong local_res20;
+ ushort uVar5;
longlong local_28 [2];
local_28[0] = 0;
local_res20 = 0;
iVar1 = FltGetTransactionContext(param_1,param_2,local_28);
lVar2 = local_28[0];
if (-1 < iVar1) {
local_28[0] = 0;
*param_3 = lVar2;
goto LAB_0;
}
iVar1 = FltAllocateContext(Globals,0x20,4,1,&local_res20);
if (iVar1 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0;
- uVar3 = 0x39;
-LAB_1:
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,9,uVar3,
- &WPP_0def1edc605734705626ac974b591885_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\context.c");
+ bVar4 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar3 = DAT_1 & 2;
+ if ((bVar3 == 0) && (!bVar4)) goto LAB_0;
+ uVar5 = 0x39;
+LAB_2:
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x209,bVar3,bVar4,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,9,uVar5,
+ &WPP_16258fdb5ea53a6e7a49e4d7510d8a5c_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\context.c");
}
else {
iVar1 = FltSetTransactionContext(param_1,param_2,1,local_res20,local_28);
lVar2 = local_res20;
if (iVar1 < 0) {
FltReleaseContext(local_res20);
local_res20 = 0;
if (iVar1 != -0x3fe3fffe) {
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) {
+ bVar4 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar3 = DAT_1 & 2;
+ if ((bVar3 == 0) && (!bVar4)) {
return iVar1;
}
- uVar3 = 0x3a;
- goto LAB_1;
+ uVar5 = 0x3a;
+ goto LAB_2;
}
iVar1 = 0;
lVar2 = local_28[0];
}
local_res20 = 0;
*param_3 = lVar2;
}
LAB_0:
if (local_res20 != 0) {
FltReleaseContext();
}
return iVar1;
}
```
## PrjfNormalizeNameComponent
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.74|
|i_ratio|0.54|
|m_ratio|0.95|
|b_ratio|0.65|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfNormalizeNameComponent|PrjfNormalizeNameComponent|
|fullname|PrjfNormalizeNameComponent|PrjfNormalizeNameComponent|
|refcount|3|3|
|`length`|1460|1633|
|`called`|Expand for full list:
FLTMGR.SYS::FltAllocateExtraCreateParameterFromLookasideList
FLTMGR.SYS::FltAllocateExtraCreateParameterList
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltCreateFileEx2
FLTMGR.SYS::FltFreeExtraCreateParameterList
FLTMGR.SYS::FltGetInstanceContext
FLTMGR.SYS::FltInsertExtraCreateParameter
FLTMGR.SYS::FltQueryDirectoryFile
FLTMGR.SYS::FltReleaseContext
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::IoGetTransactionParameterBlock
NTOSKRNL.EXE::ObfDereferenceObject
PrjfGetSetContextFileObject
PrjfPartiallyExpandDirectory
WPP_RECORDER_SF_sDd
WPP_RECORDER_SF_sDdZ
WPP_RECORDER_SF_sDdZZ
__security_check_cookieExpand for full list:
FLTMGR.SYS::FltAllocateExtraCreateParameterFromLookasideList
FLTMGR.SYS::FltAllocateExtraCreateParameterList
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltCreateFileEx2
FLTMGR.SYS::FltFreeExtraCreateParameterList
FLTMGR.SYS::FltGetInstanceContext
FLTMGR.SYS::FltInsertExtraCreateParameter
FLTMGR.SYS::FltQueryDirectoryFile
FLTMGR.SYS::FltReleaseContext
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::IoGetTransactionParameterBlock
NTOSKRNL.EXE::ObfDereferenceObject
PrjfGetSetContextFileObject
PrjfPartiallyExpandDirectory
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDdZ
WPP_RECORDER_AND_TRACE_SF_sDdZZ
__security_check_cookie
NTOSKRNL.EXE::ExAcquireFastMutex
NTOSKRNL.EXE::ExReleaseFastMutex
NTOSKRNL.EXE::KeSetEvent
PrjfLaunchExpansion
WPP_RECORDER_SF_sDdZ|FLTMGR.SYS::FltCancellableWaitForSingleObject
NTOSKRNL.EXE::ExAcquireFastMutex
NTOSKRNL.EXE::ExReleaseFastMutex
NTOSKRNL.EXE::KeSetEvent
PrjfLaunchExpansion
WPP_RECORDER_AND_TRACE_SF_sDdZ|
|calling|PrjfFsctlSetReparsePoint
PrjfPartiallyExpandDirectory
PrjfProcessOpenWithinVirtualizationRoots
PrjfSetPlaceHolderFlagsSynchronized
PrjfSynchronizeExpansionPreopWithReason|PrjfFsctlSetReparsePoint
PrjfPartiallyExpandDirectory
PrjfProcessOpenWithinVirtualizationRoots
PrjfSetPlaceHolderFlagsSynchronized
PrjfSynchronizeExpansionPreopWithReason|
|paramcount|8|8|
|`address`|1c001eab0|1400297f0|
|sig|int __fastcall PrjfExpandAndWait(undefined8 param_1, undefined8 param_2, longlong param_3, longlong param_4, uint param_5, int param_6, int param_7, char param_8)|int __fastcall PrjfExpandAndWait(undefined8 param_1, undefined8 param_2, longlong param_3, longlong param_4, uint param_5, int param_6, int param_7, char param_8)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfExpandAndWait Called Diff
```diff
--- PrjfExpandAndWait called
+++ PrjfExpandAndWait called
@@ -6 +6 @@
-WPP_RECORDER_SF_sDdZ
+WPP_RECORDER_AND_TRACE_SF_sDdZ
```
### PrjfExpandAndWait Diff
```diff
--- PrjfExpandAndWait
+++ PrjfExpandAndWait
@@ -1,99 +1,117 @@
int PrjfExpandAndWait(undefined8 param_1,undefined8 param_2,longlong param_3,longlong param_4,
uint param_5,int param_6,int param_7,char param_8)
{
longlong lVar1;
int *piVar2;
int iVar3;
undefined4 *puVar4;
int iVar5;
- undefined4 in_stack_ffffffffffffffac;
- undefined4 in_stack_ffffffffffffffb4;
+ undefined4 in_stack_ffffffffffffffc4;
+ undefined4 in_stack_ffffffffffffffcc;
lVar1 = param_4 + 8;
ExAcquireFastMutex(lVar1);
if (*(int *)(param_4 + 0x40) < (int)param_5) {
ExReleaseFastMutex(lVar1);
iVar5 = PrjfLaunchExpansion(param_2,param_3,param_4,param_5,(uint *)0x0,param_6,param_7);
if (-1 < iVar5) {
iVar5 = FltCancellableWaitForSingleObject(*(longlong *)(param_4 + 0x58) + 0x10,0,param_1);
LOCK();
piVar2 = (int *)(*(longlong *)(param_4 + 0x58) + 0x44);
iVar3 = *piVar2;
*piVar2 = *piVar2 + -1;
UNLOCK();
if ((iVar5 == -0x3ffffee0) || (iVar5 == -0x3fffffb5)) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDdZ
- (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),3,10,0x1e,
- &WPP_286736bb6a73387d41449b09eaab690a_Traceguids,
+ if (((DAT_0 & 4) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDdZ
+ (0x30a,DAT_0 & 4,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),3,10,0x1f,
+ &WPP_8662402235063b115c167dc7c0c22e28_Traceguids,
"onecore\\base\\fs\\gvflt\\filter\\sys\\expansion.c",
- CONCAT44(in_stack_ffffffffffffffac,0x803),
- CONCAT44(in_stack_ffffffffffffffb4,iVar5),(wchar_t *)(param_3 + 0x58));
+ CONCAT44(in_stack_ffffffffffffffc4,0x84b),
+ CONCAT44(in_stack_ffffffffffffffcc,iVar5),(wchar_t *)(param_3 + 0x58));
}
if (iVar3 == 1) {
KeSetEvent(*(longlong *)(param_4 + 0x58) + 0x28,0,0);
}
}
- else if ((iVar5 < 0) && ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED))
- {
- WPP_RECORDER_SF_sDdZ
- (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),3,10,0x1f,
- &WPP_286736bb6a73387d41449b09eaab690a_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\expansion.c",
- CONCAT44(in_stack_ffffffffffffffac,0x815),
- CONCAT44(in_stack_ffffffffffffffb4,iVar5),(wchar_t *)(param_3 + 0x58));
+ else if (iVar5 < 0) {
+ if (((DAT_0 & 4) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDdZ
+ (0x30a,DAT_0 & 4,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),3,10,0x20,
+ &WPP_8662402235063b115c167dc7c0c22e28_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\expansion.c",
+ CONCAT44(in_stack_ffffffffffffffc4,0x85d),
+ CONCAT44(in_stack_ffffffffffffffcc,iVar5),(wchar_t *)(param_3 + 0x58));
+ }
}
}
ExAcquireFastMutex(lVar1);
if (*(int *)(param_4 + 0x40) < (int)param_5) {
puVar4 = *(undefined4 **)(param_4 + 0x58);
if (puVar4 != (undefined4 *)0x0) {
if ((-1 < iVar5) && (iVar5 = puVar4[2], -1 < iVar5)) {
iVar5 = -0x3fffff1b;
}
*puVar4 = 0;
*(undefined4 *)(*(longlong *)(param_4 + 0x58) + 4) = *(undefined4 *)(param_4 + 0x40);
}
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDdZ
- (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,10,0x20,
- &WPP_286736bb6a73387d41449b09eaab690a_Traceguids,
+ if (((DAT_1 & 4) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDdZ
+ (0x20a,DAT_1 & 4,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,10,0x21,
+ &WPP_8662402235063b115c167dc7c0c22e28_Traceguids,
"onecore\\base\\fs\\gvflt\\filter\\sys\\expansion.c",
- CONCAT44(in_stack_ffffffffffffffac,0x844),
- CONCAT44(in_stack_ffffffffffffffb4,iVar5),(wchar_t *)(param_3 + 0x58));
+ CONCAT44(in_stack_ffffffffffffffc4,0x88c),
+ CONCAT44(in_stack_ffffffffffffffcc,iVar5),(wchar_t *)(param_3 + 0x58));
}
}
else {
iVar5 = 0;
}
- ExReleaseFastMutex(param_4 + 8);
- if ((((-1 < iVar5) && (param_8 != '\0')) &&
- (iVar5 = FltCancellableWaitForSingleObject(param_4 + 0x158,0,param_1), iVar5 < 0)) &&
- ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
- WPP_RECORDER_SF_sDdZ
- (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),3,10,0x21,
- &WPP_286736bb6a73387d41449b09eaab690a_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\expansion.c",
- CONCAT44(in_stack_ffffffffffffffac,0x85e),CONCAT44(in_stack_ffffffffffffffb4,iVar5)
- ,(wchar_t *)(param_3 + 0x58));
+ ExReleaseFastMutex(lVar1);
+ if (((-1 < iVar5) && (param_8 != '\0')) &&
+ (iVar5 = FltCancellableWaitForSingleObject(param_4 + 0x158,0,param_1), iVar5 < 0)) {
+ if (((DAT_0 & 4) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDdZ
+ (0x30a,DAT_0 & 4,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),3,10,0x22,
+ &WPP_8662402235063b115c167dc7c0c22e28_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\expansion.c",
+ CONCAT44(in_stack_ffffffffffffffc4,0x8a6),
+ CONCAT44(in_stack_ffffffffffffffcc,iVar5),(wchar_t *)(param_3 + 0x58));
+ }
}
}
else {
ExReleaseFastMutex();
- if (((param_8 != '\0') &&
- (iVar5 = FltCancellableWaitForSingleObject(param_4 + 0x158,0,param_1), iVar5 < 0)) &&
- ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
- WPP_RECORDER_SF_sDdZ
- (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),3,10,0x1d,
- &WPP_286736bb6a73387d41449b09eaab690a_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\expansion.c",
- CONCAT44(in_stack_ffffffffffffffac,0x7e4),CONCAT44(in_stack_ffffffffffffffb4,iVar5)
- ,(wchar_t *)(param_3 + 0x58));
+ if ((param_8 != '\0') &&
+ (iVar5 = FltCancellableWaitForSingleObject(param_4 + 0x158,0,param_1), iVar5 < 0)) {
+ if (((DAT_0 & 4) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDdZ
+ (0x30a,DAT_0 & 4,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),3,10,0x1e,
+ &WPP_8662402235063b115c167dc7c0c22e28_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\expansion.c",
+ CONCAT44(in_stack_ffffffffffffffc4,0x82c),
+ CONCAT44(in_stack_ffffffffffffffcc,iVar5),(wchar_t *)(param_3 + 0x58));
+ }
}
iVar5 = 0;
}
return iVar5;
}
```
## PrjfSendCommandAndWaitForCompletion
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,sig,address,called|
|ratio|0.43|
|i_ratio|0.37|
|m_ratio|0.99|
|b_ratio|0.55|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfSendCommandAndWaitForCompletion|PrjfSendCommandAndWaitForCompletion|
|fullname|PrjfSendCommandAndWaitForCompletion|PrjfSendCommandAndWaitForCompletion|
|refcount|2|2|
|`length`|1365|1414|
|`called`|Expand for full list:
FLTMGR.SYS::FltAcquireResourceExclusive
FLTMGR.SYS::FltCancellableWaitForMultipleObjects
FLTMGR.SYS::FltReleaseResource
FLTMGR.SYS::FltSendMessage
MicrosoftTelemetryAssertTriggeredMsgKM
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::KeInitializeEvent
NTOSKRNL.EXE::RtlDeleteElementGenericTableAvl
NTOSKRNL.EXE::RtlInsertElementGenericTableAvl
PrjfSendCancelCommandInNewThread
WPP_RECORDER_SF_sDdLLl
WPP_RECORDER_SF_sDdLlqqq
__security_check_cookieExpand for full list:
FLTMGR.SYS::FltAcquireResourceExclusive
FLTMGR.SYS::FltCancellableWaitForMultipleObjects
FLTMGR.SYS::FltReleaseResource
FLTMGR.SYS::FltSendMessage
MicrosoftTelemetryAssertTriggeredMsgKM
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::KeInitializeEvent
NTOSKRNL.EXE::RtlDeleteElementGenericTableAvl
NTOSKRNL.EXE::RtlInsertElementGenericTableAvl
PrjfFilterCommandReplyStatus
PrjfSendCancelCommandInNewThread
WPP_RECORDER_AND_TRACE_SF_sDdLlqqq
__security_check_cookie
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::RtlEqualUnicodeString
PrjfEnumerateDirectory
WPP_RECORDER_SF_sD
WPP_RECORDER_SF_sDd|NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::RtlEqualUnicodeString
PrjfEnumerateDirectory
WPP_RECORDER_AND_TRACE_SF_sD
WPP_RECORDER_AND_TRACE_SF_sDD|
|calling|PrjfSetDeleteDisposition|PrjfSetDeleteDisposition|
|paramcount|3|3|
|`address`|1c002ab84|140038074|
|sig|int __fastcall PrjfCheckDirectoryContentReparseTags(undefined8 param_1, undefined8 param_2, uint * param_3)|int __fastcall PrjfCheckDirectoryContentReparseTags(undefined8 param_1, undefined8 param_2, uint * param_3)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfCheckDirectoryContentReparseTags Called Diff
```diff
--- PrjfCheckDirectoryContentReparseTags called
+++ PrjfCheckDirectoryContentReparseTags called
@@ -5,2 +5,2 @@
-WPP_RECORDER_SF_sD
-WPP_RECORDER_SF_sDd
+WPP_RECORDER_AND_TRACE_SF_sD
+WPP_RECORDER_AND_TRACE_SF_sDD
```
### PrjfCheckDirectoryContentReparseTags Diff
```diff
--- PrjfCheckDirectoryContentReparseTags
+++ PrjfCheckDirectoryContentReparseTags
@@ -1,82 +1,90 @@
int PrjfCheckDirectoryContentReparseTags(undefined8 param_1,undefined8 param_2,uint *param_3)
{
uint uVar1;
char cVar2;
uint uVar3;
int iVar4;
uint *puVar5;
uint *puVar6;
undefined4 local_res18 [4];
undefined1 uVar7;
undefined8 local_48;
uint *puStack_40;
undefined8 local_38;
wchar_t *local_30;
*param_3 = 0;
local_38 = 0x40002;
local_30 = L"*";
local_48 = 0;
puStack_40 = (uint *)0x0;
puVar5 = (uint *)ExAllocatePool2(0x100,0x10000,0x65644a50);
if (puVar5 == (uint *)0x0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sD(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x12,0xac,
- &WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
+ if (((DAT_0 & 4) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sD
+ (0x212,DAT_0 & 4,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x12,0xae,
+ &WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
}
iVar4 = -0x3fffff66;
}
else {
uVar7 = 1;
while( true ) {
iVar4 = PrjfEnumerateDirectory
(param_1,param_2,0x3c,&local_38,0,uVar7,0x10000,puVar5,local_res18);
puVar6 = puVar5;
if (iVar4 < 0) break;
while( true ) {
puStack_40 = puVar6 + 0x16;
local_48._0_4_ = CONCAT22((short)puVar6[0xf],(short)puVar6[0xf]);
- cVar2 = RtlEqualUnicodeString(&local_48,&DAT_0,1);
+ cVar2 = RtlEqualUnicodeString(&local_48,&DAT_1,1);
if (cVar2 == '\0') {
- cVar2 = RtlEqualUnicodeString(&local_48,&DAT_1,1);
+ cVar2 = RtlEqualUnicodeString(&local_48,&DAT_2,1);
if (cVar2 == '\0') {
uVar1 = puVar6[0x11];
if (uVar1 == 0) {
*param_3 = *param_3 | 1;
}
else {
uVar3 = *param_3;
if (uVar1 == 0x9000001c) {
uVar3 = uVar3 | 2;
}
else if (uVar1 == 0xa0000022) {
uVar3 = uVar3 | 4;
}
else {
uVar3 = uVar3 | 8;
}
*param_3 = uVar3;
}
}
}
if (*puVar6 == 0) break;
puVar6 = (uint *)((longlong)puVar6 + (ulonglong)*puVar6);
}
uVar7 = 0;
}
if (iVar4 == -0x7ffffffa) {
iVar4 = 0;
}
- else if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x12,0xad,
- &WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
+ else if (((DAT_0 & 4) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x212,DAT_0 & 4,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x12,0xaf,
+ &WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
}
ExFreePoolWithTag(puVar5,0x65644a50);
}
return iVar4;
}
```
## PrjfDoesRootHaveShortNameComponent
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.58|
|i_ratio|0.37|
|m_ratio|0.93|
|b_ratio|0.67|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfDoesRootHaveShortNameComponent|PrjfDoesRootHaveShortNameComponent|
|fullname|PrjfDoesRootHaveShortNameComponent|PrjfDoesRootHaveShortNameComponent|
|refcount|2|2|
|`length`|1183|1400|
|`called`|FLTMGR.SYS::FltClose
FLTMGR.SYS::FltCreateFileEx2
FLTMGR.SYS::FltQueryInformationFile
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ObfDereferenceObject
WPP_RECORDER_SF_sDZ
WPP_RECORDER_SF_sDdZ
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer|FLTMGR.SYS::FltClose
FLTMGR.SYS::FltCreateFileEx2
FLTMGR.SYS::FltQueryInformationFile
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ObfDereferenceObject
WPP_RECORDER_AND_TRACE_SF_sDZ
WPP_RECORDER_AND_TRACE_SF_sDdZ
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer|
|calling|PrjfFsctlStartVirtualizationInstance|PrjfFsctlStartVirtualizationInstance|
|paramcount|3|3|
|`address`|1c00022ec|140002504|
|sig|int __fastcall PrjfDoesRootHaveShortNameComponent(undefined8 param_1, longlong param_2, undefined1 * param_3)|int __fastcall PrjfDoesRootHaveShortNameComponent(undefined8 param_1, longlong param_2, undefined1 * param_3)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfDoesRootHaveShortNameComponent Called Diff
```diff
--- PrjfDoesRootHaveShortNameComponent called
+++ PrjfDoesRootHaveShortNameComponent called
@@ -7,2 +7,2 @@
-WPP_RECORDER_SF_sDZ
-WPP_RECORDER_SF_sDdZ
+WPP_RECORDER_AND_TRACE_SF_sDZ
+WPP_RECORDER_AND_TRACE_SF_sDdZ
```
### PrjfDoesRootHaveShortNameComponent Diff
```diff
--- PrjfDoesRootHaveShortNameComponent
+++ PrjfDoesRootHaveShortNameComponent
@@ -1,178 +1,193 @@
/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */
int PrjfDoesRootHaveShortNameComponent(undefined8 param_1,longlong param_2,undefined1 *param_3)
{
- bool bVar1;
- int iVar2;
- ushort uVar3;
+ int iVar1;
+ byte bVar2;
+ short sVar3;
ushort uVar4;
- short sVar5;
- undefined2 uVar6;
+ ushort uVar5;
+ bool bVar6;
undefined1 auStackY_1a8 [32];
- undefined8 in_stack_fffffffffffffe88;
- undefined4 uVar8;
- undefined8 uVar7;
- ulonglong in_stack_fffffffffffffe90;
- undefined4 uVar10;
- undefined8 uVar9;
+ undefined4 uVar7;
+ undefined4 in_stack_fffffffffffffea4;
+ ulonglong in_stack_fffffffffffffea8;
+ undefined8 uVar8;
longlong local_120;
longlong local_118;
wchar_t local_110;
short sStack_10e;
undefined4 uStack_10c;
longlong lStack_108;
undefined1 *local_100;
undefined8 local_f8;
longlong local_f0;
longlong local_e8;
undefined8 local_e0;
undefined8 uStack_d8;
wchar_t *local_d0;
undefined8 uStack_c8;
undefined8 local_c0;
undefined8 uStack_b8;
undefined8 local_b0;
undefined8 uStack_a8;
undefined8 local_98 [4];
uint *local_78;
undefined4 local_70;
undefined4 local_6c;
undefined8 local_68;
uint local_60 [2];
undefined1 **local_58;
undefined4 local_50;
undefined4 local_4c;
ulonglong local_48;
- uVar8 = (undefined4)((ulonglong)in_stack_fffffffffffffe88 >> 0x20);
local_48 = __security_cookie ^ (ulonglong)auStackY_1a8;
- iVar2 = 0;
+ iVar1 = 0;
local_118 = 0;
local_120 = 0;
_local_110 = 0;
lStack_108 = 0;
local_e0 = 0;
uStack_d8 = 0;
local_d0 = (wchar_t *)0x0;
uStack_c8 = 0;
local_c0 = 0;
uStack_b8 = 0;
local_b0 = 0;
uStack_a8 = 0;
local_100 = param_3;
local_f8 = param_1;
local_f0 = param_2;
local_e8 = ExAllocatePool2(0x100,0x1c,0x696e4a50);
if (local_e8 == 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDdZ
- (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0x2e,
- &WPP_0def1edc605734705626ac974b591885_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\context.c",CONCAT44(uVar8,0xa2a),
- in_stack_fffffffffffffe90 & 0xffffffff00000000,&local_110);
+ if (((DAT_0 & 0x40) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDdZ
+ (0x20e,DAT_0 & 0x40,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0x2e,
+ &WPP_16258fdb5ea53a6e7a49e4d7510d8a5c_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\context.c",
+ CONCAT44(in_stack_fffffffffffffea4,0xa30),
+ in_stack_fffffffffffffea8 & 0xffffffff00000000,&local_110);
}
- iVar2 = -0x3fffff66;
+ iVar1 = -0x3fffff66;
}
else {
*param_3 = 0;
- bVar1 = true;
- uVar3 = *(ushort *)(param_2 + 8) >> 1;
+ bVar6 = true;
uVar4 = (*(ushort *)(param_2 + 0x18) >> 1) + 1;
- if (uVar4 <= uVar3) {
- sVar5 = uVar4 * 2;
+ uVar5 = *(ushort *)(param_2 + 8) >> 1;
+ if (uVar4 <= uVar5) {
+ sVar3 = uVar4 * 2;
do {
if ((*(short *)(*(longlong *)(local_f0 + 0x10) + (ulonglong)uVar4 * 2) == 0x5c) ||
- ((uint)uVar3 < uVar4 + 1)) {
+ ((uint)uVar5 < uVar4 + 1)) {
local_d0 = &local_110;
- uVar10 = 0;
- uVar8 = (undefined4)((ulonglong)&local_b0 >> 0x20);
- _local_110 = CONCAT22(sVar5,sVar5);
+ in_stack_fffffffffffffea8 = CONCAT44((int)(in_stack_fffffffffffffea8 >> 0x20),1);
+ _local_110 = CONCAT22(sVar3,sVar3);
local_e0 = CONCAT44(local_e0._4_4_,0x30);
uStack_d8 = 0;
uStack_c8 = CONCAT44(uStack_c8._4_4_,0x240);
local_c0 = 0;
uStack_b8 = 0;
lStack_108 = *(longlong *)(local_f0 + 0x10);
- iVar2 = FltCreateFileEx2(Globals,local_f8,&local_118,&local_120);
- if (iVar2 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) break;
- uVar6 = 0x2f;
- uVar9 = CONCAT44(uVar10,iVar2);
- uVar7 = CONCAT44(uVar8,0xa66);
+ iVar1 = FltCreateFileEx2(Globals,local_f8,&local_118,&local_120);
+ if (iVar1 < 0) {
+ bVar6 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar2 = DAT_0 & 0x40;
+ if ((bVar2 == 0) && (!bVar6)) break;
+ uVar8 = CONCAT44((int)(in_stack_fffffffffffffea8 >> 0x20),iVar1);
+ uVar7 = 0xa6c;
+ uVar4 = 0x2f;
}
else {
- iVar2 = FltQueryInformationFile(local_f8,local_120);
- if (-1 < iVar2) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDZ(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),3,0xe,0x32,
- &WPP_0def1edc605734705626ac974b591885_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\context.c",
- CONCAT44(uVar8,0xa8f),&local_110);
+ iVar1 = FltQueryInformationFile(local_f8,local_120,local_e8);
+ if (-1 < iVar1) {
+ if (((DAT_1 & 0x40) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDZ
+ (0x30e,DAT_1 & 0x40,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),3,0xe,0x32,
+ &WPP_16258fdb5ea53a6e7a49e4d7510d8a5c_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\context.c",
+ CONCAT44(in_stack_fffffffffffffea4,0xa95),&local_110);
}
*local_100 = 1;
- if (5 < DAT_0) {
- if (((_DAT_1 & 0x400000000000) == 0) ||
- ((DAT_2 & 0x400000000000) != DAT_2)) {
- bVar1 = false;
+ if (5 < DAT_2) {
+ if (((_DAT_3 & 0x400000000000) == 0) ||
+ ((DAT_4 & 0x400000000000) != DAT_4)) {
+ bVar6 = false;
}
- if (bVar1) {
+ if (bVar6) {
local_78 = local_60;
local_6c = 0;
local_60[1] = 0;
local_4c = 0;
local_68 = *(undefined8 *)(local_f0 + 0x10);
local_60[0] = (uint)*(ushort *)(local_f0 + 8);
local_58 = &local_100;
local_70 = 2;
local_100 = (undefined1 *)0x1000000;
local_50 = 8;
- _tlgWriteTransfer_EtwWriteTransfer(0x1c0011068,&DAT_3,0,0,5,local_98);
+ _tlgWriteTransfer_EtwWriteTransfer(0x14001b068,&DAT_5,0,0,5,local_98);
}
}
break;
}
- if (iVar2 == -0x3fffffcc) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDdZ
- (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),4,0xe,0x30,
- &WPP_0def1edc605734705626ac974b591885_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\context.c",CONCAT44(uVar8,0xa79),
- CONCAT44(uVar10,0xc0000034),&local_110);
+ uVar7 = (undefined4)(in_stack_fffffffffffffea8 >> 0x20);
+ if (iVar1 == -0x3fffffcc) {
+ if (((DAT_6 & 0x40) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ in_stack_fffffffffffffea8 = CONCAT44(uVar7,0xc0000034);
+ WPP_RECORDER_AND_TRACE_SF_sDdZ
+ (0x40e,DAT_6 & 0x40,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),4,0xe,0x30,
+ &WPP_16258fdb5ea53a6e7a49e4d7510d8a5c_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\context.c",
+ CONCAT44(in_stack_fffffffffffffea4,0xa7f),in_stack_fffffffffffffea8,
+ &local_110);
}
FltClose(local_118);
local_118 = 0;
ObfDereferenceObject(local_120);
local_120 = 0;
- goto LAB_4;
+ goto LAB_7;
}
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) break;
- uVar6 = 0x31;
- uVar9 = CONCAT44(uVar10,iVar2);
- uVar7 = CONCAT44(uVar8,0xa88);
+ bVar6 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar2 = DAT_0 & 0x40;
+ if ((bVar2 == 0) && (!bVar6)) break;
+ uVar8 = CONCAT44(uVar7,iVar1);
+ uVar7 = 0xa8e;
+ uVar4 = 0x31;
}
- WPP_RECORDER_SF_sDdZ
- (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,uVar6,
- &WPP_0def1edc605734705626ac974b591885_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\context.c",uVar7,uVar9,&local_110);
+ WPP_RECORDER_AND_TRACE_SF_sDdZ
+ (0x20e,bVar2,bVar6,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,uVar4,
+ &WPP_16258fdb5ea53a6e7a49e4d7510d8a5c_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\context.c",
+ CONCAT44(in_stack_fffffffffffffea4,uVar7),uVar8,&local_110);
break;
}
-LAB_4:
- iVar2 = 0;
- sVar5 = sVar5 + 2;
+LAB_7:
+ iVar1 = 0;
+ sVar3 = sVar3 + 2;
uVar4 = uVar4 + 1;
- } while (uVar4 <= uVar3);
+ } while (uVar4 <= uVar5);
}
ExFreePoolWithTag(local_e8,0x696e4a50);
if (local_118 != 0) {
FltClose();
}
if (local_120 != 0) {
ObfDereferenceObject();
}
}
- return iVar2;
+ return iVar1;
}
```
## PrjfFsctlSetReparsePointPostOp
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.43|
|i_ratio|0.33|
|m_ratio|0.92|
|b_ratio|0.87|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfFsctlSetReparsePointPostOp|PrjfFsctlSetReparsePointPostOp|
|fullname|PrjfFsctlSetReparsePointPostOp|PrjfFsctlSetReparsePointPostOp|
|refcount|2|2|
|`length`|379|454|
|`called`|FLTMGR.SYS::FltReleaseContext
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExAcquireFastMutex
NTOSKRNL.EXE::ExReleaseFastMutex
PrjfCopyFileBasicInformation
PrjfGetPrjReparseData
WPP_RECORDER_SF_sDqd|FLTMGR.SYS::FltReleaseContext
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExAcquireFastMutex
NTOSKRNL.EXE::ExReleaseFastMutex
PrjfCopyFileBasicInformation
PrjfGetPrjReparseData
WPP_RECORDER_AND_TRACE_SF_sDqd|
|calling|PrjfPostFsControl|PrjfPostFsControl|
|paramcount|3|3|
|`address`|1c0022f38|14002e984|
|sig|undefined8 __fastcall PrjfFsctlSetReparsePointPostOp(longlong param_1, longlong param_2, longlong param_3)|undefined8 __fastcall PrjfFsctlSetReparsePointPostOp(longlong param_1, longlong param_2, longlong param_3)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfFsctlSetReparsePointPostOp Called Diff
```diff
--- PrjfFsctlSetReparsePointPostOp called
+++ PrjfFsctlSetReparsePointPostOp called
@@ -7 +7 @@
-WPP_RECORDER_SF_sDqd
+WPP_RECORDER_AND_TRACE_SF_sDqd
```
### PrjfFsctlSetReparsePointPostOp Diff
```diff
--- PrjfFsctlSetReparsePointPostOp
+++ PrjfFsctlSetReparsePointPostOp
@@ -1,56 +1,61 @@
undefined8 PrjfFsctlSetReparsePointPostOp(longlong param_1,longlong param_2,longlong param_3)
{
int iVar1;
- undefined2 uVar2;
+ byte bVar2;
+ bool bVar3;
char local_res8 [8];
longlong local_res20;
+ ushort uVar4;
undefined8 local_38;
undefined8 uStack_30;
undefined8 local_28;
undefined8 uStack_20;
undefined8 local_18;
local_res20 = 0;
local_res8[0] = '\0';
local_38 = 0;
uStack_30 = 0;
local_28 = 0;
uStack_20 = 0;
local_18 = 0;
- if (-1 < *(int *)(param_1 + 0x18)) {
- iVar1 = PrjfGetPrjReparseData
- (*(undefined8 *)(param_2 + 0x18),*(longlong *)(param_2 + 0x20),&local_res20,
- local_res8);
- if (iVar1 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0;
- uVar2 = 0x2e;
+ if (*(int *)(param_1 + 0x18) < 0) goto LAB_0;
+ iVar1 = PrjfGetPrjReparseData
+ (*(undefined8 *)(param_2 + 0x18),*(longlong *)(param_2 + 0x20),&local_res20,
+ local_res8);
+ if (iVar1 < 0) {
+ bVar3 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar2 = DAT_1 & 0x80;
+ if ((bVar2 == 0) && (!bVar3)) goto LAB_0;
+ uVar4 = 0x2e;
+ }
+ else {
+ if (local_res8[0] == '\0') {
+ MicrosoftTelemetryAssertTriggeredNoArgsKM();
}
- else {
- if (local_res8[0] == '\0') {
- MicrosoftTelemetryAssertTriggeredNoArgsKM();
- }
- ExAcquireFastMutex(param_3 + 8);
- *(longlong *)(param_3 + 0x48) = local_res20;
- *(longlong *)(param_3 + 0x70) = local_res20 + 0x20;
- *(undefined4 *)(param_3 + 0x40) = 1;
- ExReleaseFastMutex(param_3 + 8);
- local_18 = CONCAT44(local_18._4_4_,0x400000);
- iVar1 = PrjfCopyFileBasicInformation
- (&local_38,*(undefined8 *)(param_2 + 0x20),*(undefined8 *)(param_2 + 0x18),
- 0x40);
- if ((-1 < iVar1) || ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED))
- goto LAB_0;
- uVar2 = 0x2f;
- }
- WPP_RECORDER_SF_sDqd
- (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,7,uVar2,
- &WPP_594c3e8dc88d3460d4d40c2e57e2d4a0_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\fsctrl.c");
+ ExAcquireFastMutex(param_3 + 8);
+ *(longlong *)(param_3 + 0x48) = local_res20;
+ *(longlong *)(param_3 + 0x70) = local_res20 + 0x20;
+ *(undefined4 *)(param_3 + 0x40) = 1;
+ ExReleaseFastMutex(param_3 + 8);
+ local_18 = CONCAT44(local_18._4_4_,0x400000);
+ iVar1 = PrjfCopyFileBasicInformation
+ (&local_38,*(undefined8 *)(param_2 + 0x20),*(undefined8 *)(param_2 + 0x18),
+ 0x40);
+ if (-1 < iVar1) goto LAB_0;
+ bVar3 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar2 = DAT_1 & 0x80;
+ if ((bVar2 == 0) && (!bVar3)) goto LAB_0;
+ uVar4 = 0x2f;
}
+ WPP_RECORDER_AND_TRACE_SF_sDqd
+ (0x207,bVar2,bVar3,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,7,uVar4,
+ &WPP_594c3e8dc88d3460d4d40c2e57e2d4a0_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\fsctrl.c");
LAB_0:
FltReleaseContext(param_3);
return 0;
}
```
## PrjfPostNetworkQueryOpen
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.75|
|i_ratio|0.32|
|m_ratio|0.92|
|b_ratio|0.88|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfPostNetworkQueryOpen|PrjfPostNetworkQueryOpen|
|fullname|PrjfPostNetworkQueryOpen|PrjfPostNetworkQueryOpen|
|refcount|3|3|
|`length`|583|696|
|`called`|FLTMGR.SYS::FltGetFileNameInformation
FLTMGR.SYS::FltReleaseFileNameInformation
WPP_RECORDER_SF_sD
WPP_RECORDER_SF_sDd
__security_check_cookie
_guard_dispatch_icall
memset|FLTMGR.SYS::FltGetFileNameInformation
FLTMGR.SYS::FltReleaseFileNameInformation
WPP_RECORDER_AND_TRACE_SF_sD
WPP_RECORDER_AND_TRACE_SF_sDD
__security_check_cookie
_guard_dispatch_icall
memset|
|calling|||
|paramcount|4|4|
|`address`|1c0019d90|140024270|
|sig|undefined8 __fastcall PrjfPostNetworkQueryOpen(longlong param_1, longlong param_2, undefined8 param_3, uint param_4)|undefined8 __fastcall PrjfPostNetworkQueryOpen(longlong param_1, longlong param_2, undefined8 param_3, uint param_4)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfPostNetworkQueryOpen Called Diff
```diff
--- PrjfPostNetworkQueryOpen called
+++ PrjfPostNetworkQueryOpen called
@@ -3,2 +3,2 @@
-WPP_RECORDER_SF_sD
-WPP_RECORDER_SF_sDd
+WPP_RECORDER_AND_TRACE_SF_sD
+WPP_RECORDER_AND_TRACE_SF_sDD
```
### PrjfPostNetworkQueryOpen Diff
```diff
--- PrjfPostNetworkQueryOpen
+++ PrjfPostNetworkQueryOpen
@@ -1,99 +1,110 @@
/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
/* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */
undefined8
PrjfPostNetworkQueryOpen(longlong param_1,longlong param_2,undefined8 param_3,uint param_4)
{
longlong lVar1;
int iVar2;
- undefined2 uVar3;
- undefined1 auStackY_118 [32];
+ byte bVar3;
+ bool bVar4;
+ undefined1 auStackY_128 [32];
+ ushort uVar5;
longlong local_c8;
undefined8 local_c0;
undefined8 uStack_b8;
longlong local_b0;
undefined8 uStack_a8;
undefined8 local_a0;
ulonglong uStack_98;
undefined8 local_90;
undefined8 uStack_88;
undefined1 local_78 [56];
uint local_40;
int local_3c;
ulonglong local_28;
- local_28 = __security_cookie ^ (ulonglong)auStackY_118;
+ local_28 = __security_cookie ^ (ulonglong)auStackY_128;
local_c8 = 0;
local_a0 = 0;
uStack_98 = uStack_98 & 0xffffffff00000000;
local_c0 = 0;
uStack_b8 = 0;
local_b0 = 0;
uStack_a8 = 0;
local_90 = 0;
uStack_88 = 0;
memset(local_78,0,0x48);
if ((param_4 & 1) != 0) {
return 0;
}
if (-1 < *(int *)(param_1 + 0x18)) {
lVar1 = *(longlong *)(*(longlong *)(param_1 + 0x10) + 0x20);
if ((*(uint *)(lVar1 + 0x30) & 0x400) == 0) {
return 0;
}
iVar2 = FltGetFileNameInformation(param_1,0x102,&local_c8);
if (iVar2 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- uVar3 = 0x30;
-LAB_0:
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,uVar3,
- &WPP_0b474be437163e15bbc5d557e64edfd4_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\create.c");
+ bVar4 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar3 = DAT_0 & 0x20;
+ if ((bVar3 != 0) || (bVar4)) {
+ uVar5 = 0x31;
+LAB_1:
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x205,bVar3,bVar4,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,uVar5,
+ &WPP_b8de0dfab5423d2f6ea3deba36b4500f_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\create.c");
}
}
else {
uStack_b8 = 0;
local_b0 = local_c8 + 8;
local_c0 = CONCAT44(local_c0._4_4_,0x30);
uStack_a8 = CONCAT44(uStack_a8._4_4_,0x200);
local_a0 = 0;
uStack_98 = 0;
iVar2 = (*PrjfFltQueryInformationByName)
(Globals,*(undefined8 *)(param_2 + 0x18),&local_c0,&local_90);
if (iVar2 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- uVar3 = 0x31;
- goto LAB_0;
+ bVar4 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar3 = DAT_0 & 0x20;
+ if ((bVar3 != 0) || (bVar4)) {
+ uVar5 = 0x32;
+ goto LAB_1;
}
}
else if ((local_40 >> 10 & 1) == 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sD(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),3,5,0x32,
- &WPP_0b474be437163e15bbc5d557e64edfd4_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\create.c");
+ if (((DAT_2 & 0x20) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sD
+ (0x305,DAT_2 & 0x20,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),3,5,0x33,
+ &WPP_b8de0dfab5423d2f6ea3deba36b4500f_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\create.c");
}
}
else {
if (local_3c == -0x6fffffe4) {
local_40 = local_40 & 0xffffe9ff;
if (local_40 == 0) {
local_40 = 0x80;
}
*(uint *)(lVar1 + 0x30) = local_40;
- goto LAB_1;
+ goto LAB_3;
}
- if (local_3c != -0x5fffffde) goto LAB_1;
+ if (local_3c != -0x5fffffde) goto LAB_3;
}
}
}
*(undefined8 *)(param_1 + 0x20) = 0;
*(undefined4 *)(param_1 + 0x18) = 0xc01c0004;
-LAB_1:
+LAB_3:
if (local_c8 != 0) {
FltReleaseFileNameInformation();
}
return 0;
}
```
## PrjfPrepareDestinationForRenameOrLink
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,sig,address,called|
|ratio|0.29|
|i_ratio|0.26|
|m_ratio|0.9|
|b_ratio|0.81|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfPrepareDestinationForRenameOrLink|PrjfPrepareDestinationForRenameOrLink|
|fullname|PrjfPrepareDestinationForRenameOrLink|PrjfPrepareDestinationForRenameOrLink|
|refcount|2|2|
|`length`|658|845|
|`called`|PrjfDeleteTombstoneIfExists
PrjfOpenAndCheckEmptyPartialDirectory
WPP_RECORDER_SF_sD
WPP_RECORDER_SF_sDd
__security_check_cookie
_guard_dispatch_icall
memset|PrjfDeleteTombstoneIfExists
PrjfOpenAndCheckEmptyPartialDirectory
WPP_RECORDER_AND_TRACE_SF_sD
WPP_RECORDER_AND_TRACE_SF_sDD
__security_check_cookie
_guard_dispatch_icall
memset|
|calling|PrjfPopulateDestinationForRenameOrLink|PrjfPopulateDestinationForRenameOrLink|
|paramcount|5|5|
|`address`|1c0006990|140008460|
|`sig`|ulonglong __fastcall PrjfPrepareDestinationForRenameOrLink(longlong param_1, undefined8 * * * * param_2, undefined8 param_3, wchar_t * param_4, longlong param_5)|ulonglong __fastcall PrjfPrepareDestinationForRenameOrLink(longlong param_1, longlong param_2, undefined8 param_3, wchar_t * param_4, longlong param_5)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfPrepareDestinationForRenameOrLink Called Diff
```diff
--- PrjfPrepareDestinationForRenameOrLink called
+++ PrjfPrepareDestinationForRenameOrLink called
@@ -3,2 +3,2 @@
-WPP_RECORDER_SF_sD
-WPP_RECORDER_SF_sDd
+WPP_RECORDER_AND_TRACE_SF_sD
+WPP_RECORDER_AND_TRACE_SF_sDD
```
### PrjfPrepareDestinationForRenameOrLink Diff
```diff
--- PrjfPrepareDestinationForRenameOrLink
+++ PrjfPrepareDestinationForRenameOrLink
@@ -1,110 +1,129 @@
/* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */
/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
ulonglong PrjfPrepareDestinationForRenameOrLink
- (longlong param_1,undefined8 ****param_2,undefined8 param_3,wchar_t *param_4,
+ (longlong param_1,longlong param_2,undefined8 param_3,wchar_t *param_4,
longlong param_5)
{
int iVar1;
uint *puVar2;
- bool bVar3;
- uint uVar4;
- ulonglong uVar5;
- ulonglong uVar6;
- undefined2 uVar7;
- undefined1 auStackY_148 [32];
+ uint uVar3;
+ undefined4 *puVar4;
+ undefined2 uVar5;
+ byte bVar6;
+ ulonglong uVar7;
+ char cVar8;
+ bool bVar9;
+ undefined1 auStackY_158 [32];
+ undefined4 uVar10;
+ ushort uVar11;
char local_f8 [8];
- undefined4 local_f0;
- undefined4 local_ec;
- undefined8 local_e8;
- wchar_t *local_e0;
- undefined4 local_d8;
- undefined4 local_d4;
- undefined8 local_d0;
- undefined8 uStack_c8;
- undefined8 local_c0;
- undefined8 uStack_b8;
+ longlong local_f0;
+ undefined4 local_e8;
+ undefined4 local_e4;
+ undefined8 local_e0;
+ wchar_t *local_d8;
+ undefined4 local_d0;
+ undefined4 local_cc;
+ undefined8 local_c8;
+ undefined8 uStack_c0;
+ undefined8 local_b8;
+ undefined8 uStack_b0;
undefined1 local_a8 [56];
byte local_70;
int local_6c;
ulonglong local_58;
- local_58 = __security_cookie ^ (ulonglong)auStackY_148;
- local_ec = 0;
- local_d4 = 0;
- local_c0 = 0;
- uStack_b8 = 0;
+ local_58 = __security_cookie ^ (ulonglong)auStackY_158;
+ local_e4 = 0;
+ local_cc = 0;
+ local_b8 = 0;
+ uStack_b0 = 0;
+ local_f0 = param_1;
memset(local_a8,0,0x48);
+ cVar8 = '\x01';
local_f8[0] = '\0';
iVar1 = *(int *)(*(longlong *)(param_1 + 0x10) + 0x20);
- if ((((iVar1 != 10) && (iVar1 != 0x41)) ||
- (puVar2 = *(uint **)(*(longlong *)(param_1 + 0x10) + 0x38), (char)*puVar2 == '\0')) ||
- (bVar3 = true, (*puVar2 & 2) == 0)) {
- bVar3 = false;
+ bVar9 = false;
+ if ((((iVar1 == 10) || (iVar1 == 0x41)) &&
+ (puVar2 = *(uint **)(*(longlong *)(param_1 + 0x10) + 0x38), (char)*puVar2 != '\0')) &&
+ (bVar9 = false, (*puVar2 & 2) != 0)) {
+ bVar9 = true;
}
- local_f0 = 0x30;
- local_d8 = 0x200;
- local_d0 = 0;
- uStack_c8 = 0;
- local_e8 = param_3;
- local_e0 = param_4;
- uVar4 = (*PrjfFltQueryInformationByName)(Globals,param_2,&local_f0,&local_c0);
- uVar6 = (ulonglong)uVar4;
- if (uVar4 == 0xc0000034) {
+ local_e8 = 0x30;
+ local_d0 = 0x200;
+ local_c8 = 0;
+ uStack_c0 = 0;
+ local_e0 = param_3;
+ local_d8 = param_4;
+ uVar3 = (*PrjfFltQueryInformationByName)(Globals,param_2,&local_e8,&local_b8);
+ uVar7 = (ulonglong)uVar3;
+ if (uVar3 == 0xc0000034) {
return 0;
}
- if ((int)uVar4 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) {
- return uVar6;
+ if ((int)uVar3 < 0) {
+ bVar9 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar6 = DAT_0 & 0x20;
+ if ((bVar6 == 0) && (!bVar9)) {
+ return uVar7;
}
- uVar7 = 0x74;
-LAB_0:
- uVar4 = 0xd;
+ uVar11 = 0x76;
LAB_1:
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,uVar4,uVar7,
- &WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
+ uVar5 = 0x20d;
+ uVar10 = 0xd;
+LAB_2:
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (uVar5,bVar6,bVar9,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,uVar10,uVar11,
+ &WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
}
else {
if (local_6c == -0x5fffffde) {
- uVar5 = PrjfDeleteTombstoneIfExists(param_2,*(longlong *)(param_5 + 0x50),param_3,param_4);
- uVar6 = uVar5 & 0xffffffff;
- if ((int)uVar5 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) {
- return uVar6;
+ puVar4 = PrjfDeleteTombstoneIfExists(param_2,*(longlong *)(param_5 + 0x50),param_3,param_4);
+ uVar7 = (ulonglong)puVar4 & 0xffffffff;
+ if ((int)puVar4 < 0) {
+ bVar9 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar6 = DAT_3 & 8;
+ if ((bVar6 == 0) && (!bVar9)) {
+ return uVar7;
}
- uVar7 = 0x75;
- uVar4 = 0x13;
+ uVar5 = 0x213;
+ uVar11 = 0x77;
+ uVar10 = 0x13;
+ goto LAB_2;
+ }
+ }
+ else if (((bVar9) && ((local_70 & 0x10) != 0)) && (local_6c == -0x6fffffe4)) {
+ uVar3 = PrjfOpenAndCheckEmptyPartialDirectory(local_f0,param_2,param_4,param_3,local_f8);
+ uVar7 = (ulonglong)uVar3;
+ if ((int)uVar3 < 0) {
+ bVar9 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar6 = DAT_0 & 0x20;
+ if ((bVar6 == 0) && (!bVar9)) {
+ return uVar7;
+ }
+ uVar11 = 0x78;
goto LAB_1;
}
- }
- else if (((bVar3) && ((local_70 & 0x10) != 0)) && (local_6c == -0x6fffffe4)) {
- uVar4 = PrjfOpenAndCheckEmptyPartialDirectory(param_1,param_2,param_4,param_3,local_f8);
- uVar6 = (ulonglong)uVar4;
- if ((int)uVar4 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) {
- return uVar6;
+ if (local_f8[0] == '\0') {
+ if (((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) ||
+ (*(short *)(WPP_GLOBAL_Control + 0x48) == 0)) {
+ cVar8 = '\0';
}
- uVar7 = 0x76;
- goto LAB_0;
- }
- if (local_f8[0] == '\0') {
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) {
+ if (((DAT_4 & 0x20) == 0) && (cVar8 == '\0')) {
return 0xc0000101;
}
- if (*(short *)(WPP_GLOBAL_Control + 0x48) == 0) {
- return 0xc0000101;
- }
- WPP_RECORDER_SF_sD(_PrjfTraceRecorder,5,0xd,0x77,
- &WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
+ WPP_RECORDER_AND_TRACE_SF_sD
+ (0x50d,DAT_4 & 0x20,cVar8,_PrjfTraceRecorder,5,0xd,0x79,
+ &WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
return 0xc0000101;
}
}
- uVar6 = 0;
+ uVar7 = 0;
}
- return uVar6;
+ return uVar7;
}
```
## PrjfMergeEnumerationResults
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.97|
|i_ratio|0.4|
|m_ratio|0.99|
|b_ratio|0.97|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfMergeEnumerationResults|PrjfMergeEnumerationResults|
|fullname|PrjfMergeEnumerationResults|PrjfMergeEnumerationResults|
|refcount|3|3|
|`length`|1449|1526|
|`called`|MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::RtlCompareUnicodeString
NTOSKRNL.EXE::RtlEqualUnicodeString
PrjfAdvanceToNextEnumEntry
PrjfGetCurrentEntryFileName
PrjfGetCurrentEnumEntryFromContext
PrjfTranslateCurrentEnumEntry
WPP_RECORDER_SF_sDd|MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::RtlCompareUnicodeString
NTOSKRNL.EXE::RtlEqualUnicodeString
PrjfAdvanceToNextEnumEntry
PrjfGetCurrentEntryFileName
PrjfGetCurrentEnumEntryFromContext
PrjfTranslateCurrentEnumEntry
WPP_RECORDER_AND_TRACE_SF_sDD|
|calling|PrjfEnumerateDirectoryWithMerge|PrjfEnumerateDirectoryWithMerge|
|paramcount|8|8|
|`address`|1c001bf1c|1400268bc|
|sig|int __fastcall PrjfMergeEnumerationResults(undefined8 param_1, undefined8 * param_2, uint param_3, uint param_4, longlong param_5, int * param_6, longlong * param_7, uint * param_8)|int __fastcall PrjfMergeEnumerationResults(undefined8 param_1, undefined8 * param_2, uint param_3, uint param_4, longlong param_5, int * param_6, longlong * param_7, uint * param_8)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfMergeEnumerationResults Called Diff
```diff
--- PrjfMergeEnumerationResults called
+++ PrjfMergeEnumerationResults called
@@ -8 +8 @@
-WPP_RECORDER_SF_sDd
+WPP_RECORDER_AND_TRACE_SF_sDD
```
### PrjfMergeEnumerationResults Diff
```diff
--- PrjfMergeEnumerationResults
+++ PrjfMergeEnumerationResults
@@ -1,243 +1,247 @@
int PrjfMergeEnumerationResults
(undefined8 param_1,undefined8 *param_2,uint param_3,uint param_4,longlong param_5,
int *param_6,longlong *param_7,uint *param_8)
{
undefined8 *puVar1;
undefined8 *puVar2;
undefined8 *puVar3;
char cVar4;
uint uVar5;
uint uVar6;
int iVar7;
uint uVar8;
int iVar9;
undefined8 uVar10;
undefined4 *puVar11;
undefined *puVar12;
int iVar13;
int iVar14;
int iVar15;
char cVar16;
int iVar17;
undefined8 *puVar18;
int iVar19;
bool bVar20;
uint local_98;
uint local_94;
int local_90;
uint local_8c;
longlong local_88;
uint *local_80;
undefined8 local_78;
longlong lStack_70;
undefined8 *local_68;
longlong local_60;
undefined8 local_58;
longlong lStack_50;
longlong local_48;
uint *local_40 [2];
iVar15 = 0;
iVar17 = 0;
iVar14 = 0;
iVar7 = 0;
local_94 = 0;
local_40[0] = (uint *)0x0;
local_98 = 0;
local_90 = 0;
local_80 = (uint *)0x0;
local_8c = 0;
local_60 = 0;
*param_8 = 0;
*param_6 = 0;
iVar13 = 1;
for (puVar1 = (undefined8 *)*param_2; iVar9 = 0, iVar19 = 0, puVar1 != param_2;
puVar1 = (undefined8 *)*puVar1) {
iVar15 = iVar15 + 1;
iVar9 = *(int *)((longlong)puVar1 + 0x14);
if (iVar9 == -0x7ffffffa) {
iVar17 = iVar17 + 1;
}
else if (iVar9 == -0x3ffffff1) {
iVar14 = iVar14 + 1;
}
else if (iVar9 == -0x7ffffffb) {
iVar7 = iVar7 + 1;
}
else {
iVar19 = iVar13;
if (iVar9 < 0) break;
}
}
if (iVar19 == 0) {
if (iVar14 != iVar15) {
if (iVar14 + iVar17 == iVar15) {
return -0x7ffffffa;
}
if (iVar7 == 0) {
cVar16 = '\x01';
uVar5 = 0;
LAB_0:
do {
uVar6 = uVar5;
if (param_4 <= local_98) {
LAB_1:
*param_6 = local_90 + uVar6;
return iVar9;
}
local_68 = (undefined8 *)0x0;
puVar2 = (undefined8 *)0x0;
for (puVar1 = (undefined8 *)*param_2; puVar1 != param_2; puVar1 = (undefined8 *)*puVar1) {
puVar18 = puVar2;
puVar3 = local_68;
if (((*(int *)((longlong)puVar1 + 0x14) != -0x7ffffffa) &&
(*(int *)((longlong)puVar1 + 0x14) != -0x3ffffff1)) &&
(puVar18 = puVar1, puVar3 = puVar1, puVar2 != (undefined8 *)0x0)) {
local_88 = 0;
local_48 = 0;
local_58 = 0;
lStack_50 = 0;
local_78 = 0;
lStack_70 = 0;
uVar5 = PrjfGetCurrentEntryFileName((longlong)puVar2,&local_88);
uVar6 = PrjfGetCurrentEntryFileName((longlong)puVar1,&local_48);
puVar18 = puVar2;
puVar3 = local_68;
if ((uVar5 != 0) && (puVar18 = puVar1, puVar3 = puVar1, uVar6 != 0)) {
local_58 = CONCAT62(CONCAT42(local_58._4_4_,(short)uVar5),(short)uVar5);
lStack_50 = local_88;
local_78 = CONCAT62(CONCAT42(local_78._4_4_,(short)uVar6),(short)uVar6);
lStack_70 = local_48;
cVar4 = RtlEqualUnicodeString(&local_58,&DAT_2,1);
if (cVar4 == '\0') {
cVar4 = RtlEqualUnicodeString(&local_58,&DAT_3);
iVar7 = iVar13;
if (cVar4 == '\0') {
cVar4 = RtlEqualUnicodeString(&local_78,&DAT_2);
if ((cVar4 == '\0') &&
(cVar4 = RtlEqualUnicodeString(&local_78,&DAT_3), cVar4 == '\0')) {
iVar7 = RtlCompareUnicodeString(&local_58,&local_78);
}
}
else {
cVar4 = RtlEqualUnicodeString();
if (cVar4 == '\0') {
puVar12 = &DAT_3;
goto LAB_4;
}
}
}
else {
puVar12 = &DAT_2;
LAB_4:
cVar4 = RtlEqualUnicodeString(&local_78,puVar12);
iVar7 = (cVar4 != '\0') - 1;
}
if ((((iVar7 < 1) && (puVar18 = puVar2, puVar3 = local_68, iVar7 == 0)) &&
(uVar10 = PrjfAdvanceToNextEnumEntry((longlong)puVar1), puVar3 = local_68,
(char)uVar10 == '\0')) &&
(uVar10 = PrjfAdvanceToNextEnumEntry((longlong)puVar1), puVar3 = local_68,
(char)uVar10 == '\0')) {
MicrosoftTelemetryAssertTriggeredNoArgsKM();
puVar3 = local_68;
}
}
}
local_68 = puVar3;
puVar2 = puVar18;
uVar6 = local_8c;
}
if (puVar2 == (undefined8 *)0x0) goto LAB_1;
uVar8 = PrjfGetCurrentEntryFileName((longlong)puVar2,&local_60);
local_88 = CONCAT44(local_88._4_4_,uVar8);
puVar11 = PrjfGetCurrentEnumEntryFromContext
((longlong)puVar2,(undefined4 *)0x0,(undefined4 *)0x0,
(undefined4 *)0x0);
if (puVar11 != (undefined4 *)0x0) {
bVar20 = false;
iVar7 = *(int *)((longlong)puVar2 + 0x2c);
if (iVar7 == 0x21) {
bVar20 = false;
if (puVar11[2] == -0x5fffffde) {
bVar20 = true;
}
}
else if ((((iVar7 == 0x3c) || (iVar7 == 0x3f)) ||
((iVar7 == 0x4e || ((iVar7 == 0x4f || (iVar7 == 0x50)))))) || (iVar7 == 0x51))
{
bVar20 = puVar11[0x11] == -0x5fffffde;
}
if (bVar20) {
PrjfAdvanceToNextEnumEntry((longlong)puVar2);
*param_7 = local_60;
*param_8 = uVar8;
uVar5 = uVar6;
goto LAB_0;
}
}
iVar9 = PrjfTranslateCurrentEnumEntry
((ulonglong)local_98 + param_5,(longlong)puVar2,param_3,cVar16,
param_4 - local_98,(undefined8 *)((ulonglong)local_98 + param_5),
local_40,&local_94);
uVar5 = local_94;
if (iVar9 == -0x7ffffffb) {
if (cVar16 == '\0') {
MicrosoftTelemetryAssertTriggeredNoArgsKM();
}
uVar6 = local_94;
if (local_94 == 0) {
MicrosoftTelemetryAssertTriggeredNoArgsKM();
}
goto LAB_1;
}
if (iVar9 < 0) {
return iVar9;
}
if (local_94 == 0) goto LAB_1;
if (uVar6 != 0) {
if (cVar16 != '\0') {
MicrosoftTelemetryAssertTriggeredNoArgsKM();
}
local_90 = local_90 + (uVar6 + 7 & 0xfffffff8);
}
if (local_80 != (uint *)0x0) {
if (cVar16 != '\0') {
MicrosoftTelemetryAssertTriggeredNoArgsKM();
}
if (*local_80 != 0) {
MicrosoftTelemetryAssertTriggeredNoArgsKM();
}
*local_80 = uVar6 + 7 & 0xfffffff8;
if (iVar9 < 0) {
return iVar9;
}
}
cVar16 = '\0';
local_8c = uVar5;
local_80 = local_40[0];
local_98 = local_98 + (uVar5 + 7 & 0xfffffff8);
uVar10 = PrjfAdvanceToNextEnumEntry((longlong)puVar2);
if (((char)uVar10 == '\0') &&
(uVar10 = PrjfAdvanceToNextEnumEntry((longlong)puVar2), (char)uVar10 == '\0')) {
MicrosoftTelemetryAssertTriggeredNoArgsKM();
}
*param_7 = local_60;
*param_8 = uVar8;
uVar6 = uVar5;
if ((*(byte *)(puVar2 + 5) & 2) != 0) goto LAB_1;
} while( true );
}
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x12,0x17,
- &WPP_e21b7c61aee93f730c9c252e6e8da2f4_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\dir.c");
+ if (((DAT_5 & 4) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x212,DAT_5 & 4,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x12,0x17,
+ &WPP_3d19aee1b05838720427e757513a9608_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\dir.c");
}
*param_6 = 0;
}
iVar9 = -0x3ffffff1;
}
return iVar9;
}
```
## PrjfOpenReparsePoint
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.67|
|i_ratio|0.54|
|m_ratio|0.95|
|b_ratio|0.8|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfOpenReparsePoint|PrjfOpenReparsePoint|
|fullname|PrjfOpenReparsePoint|PrjfOpenReparsePoint|
|refcount|3|3|
|`length`|954|1083|
|`called`|FLTMGR.SYS::FltAllocateExtraCreateParameterFromLookasideList
FLTMGR.SYS::FltAllocateExtraCreateParameterList
FLTMGR.SYS::FltCreateFileEx2
FLTMGR.SYS::FltFreeExtraCreateParameterList
FLTMGR.SYS::FltInsertExtraCreateParameter
MicrosoftTelemetryAssertTriggeredNoArgsKM
WPP_RECORDER_SF_sDd
WPP_RECORDER_SF_sDdZ
WPP_RECORDER_SF_sDdZP|FLTMGR.SYS::FltAllocateExtraCreateParameterFromLookasideList
FLTMGR.SYS::FltAllocateExtraCreateParameterList
FLTMGR.SYS::FltCreateFileEx2
FLTMGR.SYS::FltFreeExtraCreateParameterList
FLTMGR.SYS::FltInsertExtraCreateParameter
MicrosoftTelemetryAssertTriggeredNoArgsKM
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDdZ
WPP_RECORDER_AND_TRACE_SF_sDdZP|
|calling|PrjfOpenAsReparsePoint
PrjfOpenPlaceHolder|PrjfOpenAsReparsePoint
PrjfOpenPlaceHolder|
|paramcount|9|9|
|`address`|1c002eb8c|14003d004|
|sig|ulonglong __fastcall PrjfOpenReparsePoint(undefined8 param_1, wchar_t * param_2, undefined8 param_3, undefined4 param_4, undefined4 param_5, undefined8 param_6, longlong * param_7, undefined8 param_8, undefined8 param_9)|ulonglong __fastcall PrjfOpenReparsePoint(undefined8 param_1, wchar_t * param_2, undefined8 param_3, undefined4 param_4, undefined4 param_5, undefined8 param_6, longlong * param_7, undefined8 param_8, undefined8 param_9)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfOpenReparsePoint Called Diff
```diff
--- PrjfOpenReparsePoint called
+++ PrjfOpenReparsePoint called
@@ -7,3 +7,3 @@
-WPP_RECORDER_SF_sDd
-WPP_RECORDER_SF_sDdZ
-WPP_RECORDER_SF_sDdZP
+WPP_RECORDER_AND_TRACE_SF_sDD
+WPP_RECORDER_AND_TRACE_SF_sDdZ
+WPP_RECORDER_AND_TRACE_SF_sDdZP
```
### PrjfOpenReparsePoint Diff
```diff
--- PrjfOpenReparsePoint
+++ PrjfOpenReparsePoint
@@ -1,162 +1,174 @@
/* WARNING: Type propagation algorithm not settling */
ulonglong PrjfOpenReparsePoint
(undefined8 param_1,wchar_t *param_2,undefined8 param_3,undefined4 param_4,
undefined4 param_5,undefined8 param_6,longlong *param_7,undefined8 param_8,
undefined8 param_9)
{
longlong *plVar1;
longlong lVar2;
longlong *plVar3;
code *pcVar4;
uint uVar5;
int iVar6;
ulonglong uVar7;
- longlong *plVar8;
- undefined2 uVar9;
- undefined4 uVar10;
- undefined8 *puVar11;
- undefined4 uVar12;
+ byte bVar8;
+ longlong *plVar9;
+ bool bVar10;
+ undefined4 uVar11;
+ ushort uVar12;
undefined8 in_stack_ffffffffffffff18;
uint uVar13;
- undefined8 in_stack_ffffffffffffff20;
+ undefined4 in_stack_ffffffffffffff24;
+ undefined4 in_stack_ffffffffffffff2c;
+ undefined8 in_stack_ffffffffffffff30;
undefined4 uVar14;
longlong *local_a8;
longlong local_a0 [6];
undefined8 local_70;
undefined8 uStack_68;
wchar_t *local_60;
undefined8 uStack_58;
undefined8 local_50;
ulonglong uStack_48;
undefined8 local_40;
undefined8 uStack_38;
uVar13 = (uint)((ulonglong)in_stack_ffffffffffffff18 >> 0x20);
- uVar14 = (undefined4)((ulonglong)in_stack_ffffffffffffff20 >> 0x20);
+ uVar14 = (undefined4)((ulonglong)in_stack_ffffffffffffff30 >> 0x20);
local_a0[5] = local_a0[5] & 0xffffffffffff0000;
- local_50 = 0;
local_a8 = (longlong *)0x0;
local_a0[0] = 0;
+ local_50 = 0;
uStack_48 = uStack_48 & 0xffffffff00000000;
local_a0[1] = 0;
local_a0[2] = 0;
local_a0[3] = 0;
local_a0[4] = 0;
local_70 = 0;
uStack_68 = 0;
local_60 = (wchar_t *)0x0;
uStack_58 = 0;
local_40 = 0;
uStack_38 = 0;
uVar5 = FltAllocateExtraCreateParameterList(Globals,0,local_a0);
uVar7 = (ulonglong)uVar5;
if ((int)uVar5 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0;
- uVar9 = 0x35;
+ bVar10 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar8 = DAT_0 & 0x20;
+ if ((bVar8 == 0) && (!bVar10)) goto LAB_1;
+ uVar12 = 0x36;
}
else {
- uVar10 = 0;
+ uVar11 = 0;
uVar5 = FltAllocateExtraCreateParameterFromLookasideList
- (Globals,&ECP_TYPE_OPEN_REPARSE_GUID,0x10,0,0,&DAT_1,&local_a8);
+ (Globals,&ECP_TYPE_OPEN_REPARSE_GUID,0x10,0,0,&DAT_2,&local_a8);
uVar7 = (ulonglong)uVar5;
if (-1 < (int)uVar5) {
local_a8[1] = (longlong)local_a8;
*local_a8 = (longlong)local_a8;
- plVar8 = (longlong *)0x0;
+ plVar9 = (longlong *)0x0;
while (plVar1 = (longlong *)*param_7, plVar1 != param_7) {
if (((longlong *)plVar1[1] != param_7) ||
- (lVar2 = *plVar1, *(longlong **)(lVar2 + 8) != plVar1)) goto LAB_2;
+ (lVar2 = *plVar1, *(longlong **)(lVar2 + 8) != plVar1)) goto LAB_3;
*param_7 = lVar2;
*(longlong **)(lVar2 + 8) = param_7;
plVar3 = (longlong *)local_a8[1];
- if ((longlong *)*plVar3 != local_a8) goto LAB_2;
+ if ((longlong *)*plVar3 != local_a8) goto LAB_3;
*plVar1 = (longlong)local_a8;
plVar1[1] = (longlong)plVar3;
*plVar3 = (longlong)plVar1;
local_a8[1] = (longlong)plVar1;
if ((int)plVar1[2] == -0x5fffffde) {
- plVar8 = plVar1;
+ plVar9 = plVar1;
}
}
iVar6 = FltInsertExtraCreateParameter(Globals,local_a0[0],local_a8);
if (iVar6 < 0) {
MicrosoftTelemetryAssertTriggeredNoArgsKM();
}
local_a0[1] = 0x28;
local_a0[2] = local_a0[0];
- puVar11 = &local_40;
- uVar12 = 0;
local_a0[5] = 1;
local_a0[3] = 0;
local_a0[4] = 0;
local_70 = CONCAT44(local_70._4_4_,0x30);
uStack_58 = CONCAT44(uStack_58._4_4_,0x240);
local_50 = 0;
uStack_48 = 0;
uStack_68 = param_3;
local_60 = param_2;
- uVar5 = FltCreateFileEx2(Globals,param_1,param_8,param_9,CONCAT44(uVar10,param_4),&local_70,
- puVar11,0,(ulonglong)uVar13 << 0x20,CONCAT44(uVar14,7),1,param_5,0,0,
- 0,local_a0 + 1);
+ uVar5 = FltCreateFileEx2(Globals,param_1,param_8,param_9,CONCAT44(uVar11,param_4),&local_70,
+ &local_40,0,(ulonglong)uVar13 << 0x20,7,1,CONCAT44(uVar14,param_5),0,
+ 0,0,local_a0 + 1);
uVar7 = (ulonglong)uVar5;
if ((int)uVar5 < 0) {
if (uVar5 == 0xc0000279) {
- if ((plVar8 == (longlong *)0x0) || ((*(uint *)((longlong)plVar8 + 0x14) & 1) == 0)) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDdZP(*(undefined8 *)(WPP_GLOBAL_Control + 0x40));
+ if ((plVar9 == (longlong *)0x0) || ((*(uint *)((longlong)plVar9 + 0x14) & 1) == 0)) {
+ if (((DAT_4 & 4) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDdZP
+ (&WPP_RECORDER_INITIALIZED,DAT_4 & 4,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40));
}
}
else {
uVar7 = 0xc0000281;
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDdZ
- (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),4,10,0x37,
- &WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,
+ if (((DAT_5 & 4) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDdZ
+ (0x40a,DAT_5 & 4,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),4,10,0x38,
+ &WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
"onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",
- CONCAT44((int)((ulonglong)puVar11 >> 0x20),0x92e),
- CONCAT44(uVar12,0xc0000281),param_2);
+ CONCAT44(in_stack_ffffffffffffff24,0x94d),
+ CONCAT44(in_stack_ffffffffffffff2c,0xc0000281),param_2);
}
}
}
}
else {
while( true ) {
- plVar8 = (longlong *)*local_a8;
- if (plVar8 == local_a8) break;
- if (((longlong *)plVar8[1] != local_a8) ||
- (lVar2 = *plVar8, (longlong *)*(longlong *)(lVar2 + 8) != plVar8)) {
-LAB_2:
+ plVar9 = (longlong *)*local_a8;
+ if (plVar9 == local_a8) break;
+ if (((longlong *)plVar9[1] != local_a8) ||
+ (lVar2 = *plVar9, (longlong *)*(longlong *)(lVar2 + 8) != plVar9)) {
+LAB_3:
pcVar4 = (code *)swi(0x29);
(*pcVar4)(3);
pcVar4 = (code *)swi(3);
uVar7 = (*pcVar4)();
return uVar7;
}
*local_a8 = lVar2;
*(longlong **)(lVar2 + 8) = local_a8;
plVar1 = (longlong *)param_7[1];
- if ((longlong *)*plVar1 != param_7) goto LAB_2;
- *plVar8 = (longlong)param_7;
- plVar8[1] = (longlong)plVar1;
- *plVar1 = (longlong)plVar8;
- param_7[1] = (longlong)plVar8;
+ if ((longlong *)*plVar1 != param_7) goto LAB_3;
+ *plVar9 = (longlong)param_7;
+ plVar9[1] = (longlong)plVar1;
+ *plVar1 = (longlong)plVar9;
+ param_7[1] = (longlong)plVar9;
}
}
- goto LAB_0;
+ goto LAB_1;
}
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0;
- uVar9 = 0x36;
+ bVar10 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar8 = DAT_0 & 0x20;
+ if ((bVar8 == 0) && (!bVar10)) goto LAB_1;
+ uVar12 = 0x37;
}
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,uVar9,
- &WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
-LAB_0:
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x205,bVar8,bVar10,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,uVar12,
+ &WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
+LAB_1:
if (local_a0[0] != 0) {
FltFreeExtraCreateParameterList(Globals);
}
return uVar7;
}
```
## PrjfCreateHardLink
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.62|
|i_ratio|0.51|
|m_ratio|0.93|
|b_ratio|0.89|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfCreateHardLink|PrjfCreateHardLink|
|fullname|PrjfCreateHardLink|PrjfCreateHardLink|
|refcount|2|2|
|`length`|777|905|
|`called`|FLTMGR.SYS::FltClose
FLTMGR.SYS::FltCreateFileEx
FLTMGR.SYS::FltSetInformationFile
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
WPP_RECORDER_SF_sD
WPP_RECORDER_SF_sDdZ
memcpy|FLTMGR.SYS::FltClose
FLTMGR.SYS::FltCreateFileEx
FLTMGR.SYS::FltSetInformationFile
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
WPP_RECORDER_AND_TRACE_SF_sD
WPP_RECORDER_AND_TRACE_SF_sDdZ
memmove|
|calling|PrjfWritePlaceholderInformationHandler|PrjfWritePlaceholderInformationHandler|
|paramcount|3|3|
|`address`|1c002bb24|14003941c|
|sig|int __fastcall PrjfCreateHardLink(undefined8 param_1, longlong param_2, wchar_t * param_3)|int __fastcall PrjfCreateHardLink(undefined8 param_1, longlong param_2, wchar_t * param_3)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfCreateHardLink Called Diff
```diff
--- PrjfCreateHardLink called
+++ PrjfCreateHardLink called
@@ -6,3 +6,3 @@
-WPP_RECORDER_SF_sD
-WPP_RECORDER_SF_sDdZ
-memcpy
+WPP_RECORDER_AND_TRACE_SF_sD
+WPP_RECORDER_AND_TRACE_SF_sDdZ
+memmove
```
### PrjfCreateHardLink Diff
```diff
--- PrjfCreateHardLink
+++ PrjfCreateHardLink
@@ -1,96 +1,109 @@
int PrjfCreateHardLink(undefined8 param_1,longlong param_2,wchar_t *param_3)
{
int iVar1;
undefined1 *puVar2;
undefined8 local_res10;
longlong local_res20;
- undefined8 *puVar3;
- undefined4 uVar4;
- undefined4 uVar5;
ulonglong in_stack_ffffffffffffff58;
+ undefined4 in_stack_ffffffffffffff64;
+ undefined4 in_stack_ffffffffffffff6c;
undefined8 local_68;
longlong lStack_60;
undefined8 local_58;
undefined8 uStack_50;
undefined4 local_48;
undefined4 local_44;
undefined8 local_40;
undefined8 *local_38;
undefined4 local_30;
undefined4 local_2c;
undefined8 local_28;
undefined8 uStack_20;
local_44 = 0;
local_2c = 0;
local_res20 = 0;
local_res10 = 0;
local_40 = 0;
local_68 = (ulonglong)CONCAT22(*(undefined2 *)(param_2 + 4),*(undefined2 *)(param_2 + 4));
lStack_60 = param_2 + 6;
local_38 = &local_68;
- puVar3 = &local_58;
- uVar5 = 0;
local_58 = 0;
uStack_50 = 0;
local_48 = 0x30;
local_30 = 0x240;
local_28 = 0;
uStack_20 = 0;
- iVar1 = FltCreateFileEx(Globals,param_1,&local_res20,&local_res10,0x100100,&local_48,puVar3,0,
+ iVar1 = FltCreateFileEx(Globals,param_1,&local_res20,&local_res10,0x100100,&local_48,&local_58,0,
in_stack_ffffffffffffff58 & 0xffffffff00000000,7,1,0x204020,0,0,1);
- uVar4 = (undefined4)((ulonglong)puVar3 >> 0x20);
if (iVar1 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDdZ
- (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,0x80,
- &WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",CONCAT44(uVar4,0x169c),
- CONCAT44(uVar5,iVar1),(wchar_t *)&local_68);
+ if (((DAT_0 & 0x20) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDdZ
+ (0x205,DAT_0 & 0x20,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,0x82,
+ &WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",
+ CONCAT44(in_stack_ffffffffffffff64,0x16d3),
+ CONCAT44(in_stack_ffffffffffffff6c,iVar1),(wchar_t *)&local_68);
}
}
else {
puVar2 = (undefined1 *)ExAllocatePool2(0x100,(ulonglong)(ushort)*param_3 + 0x18,0x6e6c4a50);
if (puVar2 == (undefined1 *)0x0) {
iVar1 = -0x3fffff66;
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sD(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,0x81,
- &WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
+ if (((DAT_0 & 0x20) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sD
+ (0x205,DAT_0 & 0x20,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,0x83,
+ &WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
}
}
else {
- memcpy(puVar2 + 0x14,*(void **)(param_3 + 4),(ulonglong)(ushort)*param_3);
+ memmove(puVar2 + 0x14,*(void **)(param_3 + 4),(ulonglong)(ushort)*param_3);
*(undefined8 *)(puVar2 + 8) = 0;
*puVar2 = 0;
*(uint *)(puVar2 + 0x10) = (uint)(ushort)*param_3;
iVar1 = FltSetInformationFile(param_1,local_res10,puVar2,(ushort)*param_3 + 0x18,0xb);
if (iVar1 == -0x3fffffcb) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDdZ
- (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),3,5,0x82,
- &WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",CONCAT44(uVar4,0x16c6),
- CONCAT44(uVar5,0xc0000035),param_3);
+ if (((DAT_1 & 0x20) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDdZ
+ (0x305,DAT_1 & 0x20,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),3,5,0x84,
+ &WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",
+ CONCAT44(in_stack_ffffffffffffff64,0x16fd),
+ CONCAT44(in_stack_ffffffffffffff6c,0xc0000035),param_3);
}
iVar1 = 0;
}
- else if ((iVar1 < 0) && ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED))
- {
- WPP_RECORDER_SF_sDdZ
- (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,0x83,
- &WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",CONCAT44(uVar4,0x16cf),
- CONCAT44(uVar5,iVar1),param_3);
+ else if (iVar1 < 0) {
+ if (((DAT_0 & 0x20) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDdZ
+ (0x205,DAT_0 & 0x20,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,0x85,
+ &WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",
+ CONCAT44(in_stack_ffffffffffffff64,0x1706),
+ CONCAT44(in_stack_ffffffffffffff6c,iVar1),param_3);
+ }
}
ExFreePoolWithTag(puVar2,0x6e6c4a50);
}
}
if (local_res20 != 0) {
FltClose();
}
return iVar1;
}
```
## PrjfTransactionNotification
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.34|
|i_ratio|0.11|
|m_ratio|0.78|
|b_ratio|0.74|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfTransactionNotification|PrjfTransactionNotification|
|fullname|PrjfTransactionNotification|PrjfTransactionNotification|
|refcount|3|3|
|`length`|102|149|
|`called`|WPP_RECORDER_SF_sDd|WPP_RECORDER_AND_TRACE_SF_sDD|
|calling|||
|paramcount|0|0|
|`address`|1c0032790|140041d60|
|sig|undefined8 __fastcall PrjfTransactionNotification(void)|undefined8 __fastcall PrjfTransactionNotification(void)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfTransactionNotification Called Diff
```diff
--- PrjfTransactionNotification called
+++ PrjfTransactionNotification called
@@ -1 +1 @@
-WPP_RECORDER_SF_sDd
+WPP_RECORDER_AND_TRACE_SF_sDD
```
### PrjfTransactionNotification Diff
```diff
--- PrjfTransactionNotification
+++ PrjfTransactionNotification
@@ -1,13 +1,22 @@
undefined8 PrjfTransactionNotification(void)
{
- if (((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) &&
- (*(short *)(WPP_GLOBAL_Control + 0x48) != 0)) {
- WPP_RECORDER_SF_sDd(_PrjfTraceRecorder,5,0xd,0x20,
- &WPP_3f8aed4e88f83f53ec58226552f2c258_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\prjflt.c");
+ char cVar1;
+
+ if (((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) ||
+ (*(short *)(WPP_GLOBAL_Control + 0x48) == 0)) {
+ cVar1 = '\0';
+ }
+ else {
+ cVar1 = '\x01';
+ }
+ if (((DAT_0 & 0x20) != 0) || (cVar1 != '\0')) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x50d,DAT_0 & 0x20,cVar1,_PrjfTraceRecorder,5,0xd,0x20,
+ &WPP_3f8aed4e88f83f53ec58226552f2c258_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\prjflt.c");
}
return 0;
}
```
## PrjfExpandAndPend
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.81|
|i_ratio|0.58|
|m_ratio|0.97|
|b_ratio|0.95|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfExpandAndPend|PrjfExpandAndPend|
|fullname|PrjfExpandAndPend|PrjfExpandAndPend|
|refcount|2|2|
|`length`|383|414|
|`called`|FLTMGR.SYS::FltLockUserBuffer
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExAcquireFastMutex
NTOSKRNL.EXE::ExReleaseFastMutex
PrjfLaunchExpansion
WPP_RECORDER_SF_sDdZ|FLTMGR.SYS::FltLockUserBuffer
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExAcquireFastMutex
NTOSKRNL.EXE::ExReleaseFastMutex
PrjfLaunchExpansion
WPP_RECORDER_AND_TRACE_SF_sDdZ|
|calling|PrjfSynchronizeExpansionPreopWithReason|PrjfSynchronizeExpansionPreopWithReason|
|paramcount|7|7|
|`address`|1c001e928|140029648|
|sig|int __fastcall PrjfExpandAndPend(uint * param_1, undefined8 param_2, longlong param_3, longlong param_4, uint param_5, int param_6, int param_7)|int __fastcall PrjfExpandAndPend(uint * param_1, undefined8 param_2, longlong param_3, longlong param_4, uint param_5, int param_6, int param_7)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfExpandAndPend Called Diff
```diff
--- PrjfExpandAndPend called
+++ PrjfExpandAndPend called
@@ -6 +6 @@
-WPP_RECORDER_SF_sDdZ
+WPP_RECORDER_AND_TRACE_SF_sDdZ
```
### PrjfExpandAndPend Diff
```diff
--- PrjfExpandAndPend
+++ PrjfExpandAndPend
@@ -1,57 +1,60 @@
int PrjfExpandAndPend(uint *param_1,undefined8 param_2,longlong param_3,longlong param_4,
uint param_5,int param_6,int param_7)
{
char cVar1;
longlong lVar2;
int iVar3;
- undefined4 in_stack_ffffffffffffffcc;
undefined4 in_stack_ffffffffffffffd4;
+ undefined4 in_stack_ffffffffffffffdc;
if ((*param_1 & 2) != 0) {
MicrosoftTelemetryAssertTriggeredNoArgsKM();
}
ExAcquireFastMutex(param_4 + 8);
if ((int)param_5 <= *(int *)(param_4 + 0x40)) {
ExReleaseFastMutex();
return 0;
}
ExReleaseFastMutex(param_4 + 8);
lVar2 = *(longlong *)(param_1 + 4);
cVar1 = *(char *)(lVar2 + 4);
if ((byte)(cVar1 - 3U) < 2) {
if ((*(int *)(lVar2 + 0x18) != 0) && (iVar3 = FltLockUserBuffer(param_1), iVar3 < 0)) {
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) {
+ if (((DAT_0 & 4) == 0) &&
+ ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) {
return iVar3;
}
- WPP_RECORDER_SF_sDdZ
- (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,10,0x22,
- &WPP_286736bb6a73387d41449b09eaab690a_Traceguids,
+ WPP_RECORDER_AND_TRACE_SF_sDdZ
+ (0x20a,DAT_0 & 4,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,10,0x23,
+ &WPP_8662402235063b115c167dc7c0c22e28_Traceguids,
"onecore\\base\\fs\\gvflt\\filter\\sys\\expansion.c",
- CONCAT44(in_stack_ffffffffffffffcc,0x896),CONCAT44(in_stack_ffffffffffffffd4,iVar3)
+ CONCAT44(in_stack_ffffffffffffffd4,0x8de),CONCAT44(in_stack_ffffffffffffffdc,iVar3)
,(wchar_t *)(param_3 + 0x58));
return iVar3;
}
}
else {
if (cVar1 == '\r') {
if (*(char *)(lVar2 + 5) != '\x02') {
if (((*(uint *)(lVar2 + 0x28) & 3) != 0) && (iVar3 = FltLockUserBuffer(param_1), iVar3 < 0))
{
return iVar3;
}
- goto LAB_0;
+ goto LAB_1;
}
}
- else if (cVar1 == '\x11') goto LAB_0;
+ else if (cVar1 == '\x11') goto LAB_1;
MicrosoftTelemetryAssertTriggeredNoArgsKM();
}
-LAB_0:
+LAB_1:
iVar3 = PrjfLaunchExpansion(param_2,param_3,param_4,param_5,param_1,param_6,param_7);
if (-1 < iVar3) {
iVar3 = 0x103;
}
return iVar3;
}
```
## PrjfUpdatePlaceholderIfNeededHandler
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,sig,address,called|
|ratio|0.24|
|i_ratio|0.17|
|m_ratio|0.92|
|b_ratio|0.47|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfUpdatePlaceholderIfNeededHandler|PrjfUpdatePlaceholderIfNeededHandler|
|fullname|PrjfUpdatePlaceholderIfNeededHandler|PrjfUpdatePlaceholderIfNeededHandler|
|refcount|2|2|
|`length`|1601|1925|
|`called`|Expand for full list:
FLTMGR.SYS::FltClose
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::RtlCompareMemory
PrjfCopyAsPlaceHolder
PrjfCreatePrjReparseBuffer
PrjfDecideUpdateDeleteOnFileStateAndUpdateFlags
PrjfGetUnionContextByVirtualizationInstanceInfo
PrjfRelPathToFullPath
PrjfReleaseUnionContext
PrjfSetDeleteDisposition
PrjfValidatePlaceholderInformationMessage
WPP_RECORDER_SF_sDd
__security_check_cookie
_tlgDefineProvider_annotation__Tlgmtakm_hTelemetryAssertDiagTrackProv
memsetExpand for full list:
FLTMGR.SYS::FltClose
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::RtlCompareMemory
PrjfCopyAsPlaceHolder
PrjfCreatePrjReparseBuffer
PrjfDecideUpdateDeleteOnFileStateAndUpdateFlags
PrjfGetUnionContextByVirtualizationInstanceInfo
PrjfRelPathToFullPath
PrjfReleaseUnionContext
PrjfSetDeleteDisposition
PrjfSleepOnTestSettingFlagsForTests
PrjfValidatePlaceholderInformationMessage
WPP_RECORDER_AND_TRACE_SF_sDD
__security_check_cookie
memset
WPP_RECORDER_SF_sDd|WPP_RECORDER_AND_TRACE_SF_sD
WPP_RECORDER_AND_TRACE_SF_sDD|
|calling|PrjfValidatePlaceholderInformationMessage|PrjfValidatePlaceholderInformationMessage|
|paramcount|2|2|
|`address`|1c0030738|14003f624|
|`sig`|undefined4 __fastcall PrjfValidateFileIdentifier(ushort * param_1, uint param_2)|undefined8 __fastcall PrjfValidateFileIdentifier(ushort * param_1, uint param_2)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfValidateFileIdentifier Called Diff
```diff
--- PrjfValidateFileIdentifier called
+++ PrjfValidateFileIdentifier called
@@ -1,2 +1,2 @@
-WPP_RECORDER_SF_sD
-WPP_RECORDER_SF_sDd
+WPP_RECORDER_AND_TRACE_SF_sD
+WPP_RECORDER_AND_TRACE_SF_sDD
```
### PrjfValidateFileIdentifier Diff
```diff
--- PrjfValidateFileIdentifier
+++ PrjfValidateFileIdentifier
@@ -1,55 +1,68 @@
-undefined4 PrjfValidateFileIdentifier(ushort *param_1,uint param_2)
+undefined8 PrjfValidateFileIdentifier(ushort *param_1,uint param_2)
{
uint uVar1;
- undefined2 uVar2;
+ ushort uVar2;
if (param_2 < 8) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0x7b,
- &WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
+ if (((DAT_0 & 0x40) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x20e,DAT_0 & 0x40,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0x7d,
+ &WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
}
}
else {
if (*param_1 == param_2) {
uVar1 = param_1[2] + 6;
if (uVar1 < 6) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xb,0x7d,
- &WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
- return 0xc0000095;
+ if (((DAT_0 & 8) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x20b,DAT_0 & 8,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xb,0x7f,
+ &WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
}
return 0xc0000095;
}
if (*param_1 == uVar1) {
if (param_1[1] <= param_1[2]) {
return 0;
}
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) {
+ if (((DAT_0 & 8) == 0) &&
+ ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) {
return 0xc000000d;
}
- uVar2 = 0x7f;
+ uVar2 = 0x81;
}
else {
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) {
+ if (((DAT_0 & 8) == 0) &&
+ ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) {
return 0xc000000d;
}
- uVar2 = 0x7e;
+ uVar2 = 0x80;
}
}
else {
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) {
+ if (((DAT_0 & 8) == 0) &&
+ ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) {
return 0xc000000d;
}
- uVar2 = 0x7c;
+ uVar2 = 0x7e;
}
- WPP_RECORDER_SF_sD(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xb,uVar2,
- &WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
+ WPP_RECORDER_AND_TRACE_SF_sD
+ (0x20b,DAT_0 & 8,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xb,uVar2,
+ &WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
}
return 0xc000000d;
}
```
## PrjfOpenPlaceHolder
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.73|
|i_ratio|0.66|
|m_ratio|0.97|
|b_ratio|0.94|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfOpenPlaceHolder|PrjfOpenPlaceHolder|
|fullname|PrjfOpenPlaceHolder|PrjfOpenPlaceHolder|
|refcount|8|8|
|`length`|382|413|
|`called`|FLTMGR.SYS::FltClose
NTOSKRNL.EXE::ObfDereferenceObject
PrjfOpenReparsePoint
WPP_RECORDER_SF_sDdZ
__security_check_cookie|FLTMGR.SYS::FltClose
NTOSKRNL.EXE::ObfDereferenceObject
PrjfOpenReparsePoint
WPP_RECORDER_AND_TRACE_SF_sDdZ
__security_check_cookie|
|calling|PrjfAddInMemoryTombstone
PrjfCreateRenameOrLinkCompletionContext
PrjfOpenParentPlaceHolder
PrjfPreCleanup
PrjfPrepareSourceForRename
PrjfProcessPrjReparsePointBounce
PrjfRemoveInMemoryTombstone|PrjfAddInMemoryTombstone
PrjfCreateRenameOrLinkCompletionContext
PrjfOpenParentPlaceHolder
PrjfPreCleanup
PrjfPrepareSourceForRename
PrjfProcessPrjReparsePointBounce
PrjfRemoveInMemoryTombstone|
|paramcount|6|6|
|`address`|1c002ea04|14003ce60|
|sig|ulonglong __fastcall PrjfOpenPlaceHolder(undefined8 param_1, wchar_t * param_2, undefined8 param_3, longlong * param_4, longlong * param_5, byte * param_6)|ulonglong __fastcall PrjfOpenPlaceHolder(undefined8 param_1, wchar_t * param_2, undefined8 param_3, longlong * param_4, longlong * param_5, byte * param_6)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfOpenPlaceHolder Called Diff
```diff
--- PrjfOpenPlaceHolder called
+++ PrjfOpenPlaceHolder called
@@ -4 +4 @@
-WPP_RECORDER_SF_sDdZ
+WPP_RECORDER_AND_TRACE_SF_sDdZ
```
### PrjfOpenPlaceHolder Diff
```diff
--- PrjfOpenPlaceHolder
+++ PrjfOpenPlaceHolder
@@ -1,72 +1,75 @@
/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
ulonglong PrjfOpenPlaceHolder(undefined8 param_1,wchar_t *param_2,undefined8 param_3,
longlong *param_4,longlong *param_5,byte *param_6)
{
ulonglong uVar1;
- undefined1 auStackY_e8 [32];
- undefined8 in_stack_ffffffffffffff40;
- undefined8 ***pppuVar2;
- longlong *plVar3;
+ undefined1 auStackY_f8 [32];
+ undefined4 in_stack_ffffffffffffff30;
+ undefined4 in_stack_ffffffffffffff34;
+ undefined4 in_stack_ffffffffffffff54;
+ undefined4 in_stack_ffffffffffffff5c;
longlong local_98;
longlong local_90;
undefined8 **local_88;
undefined8 **local_80;
undefined8 **local_78;
undefined8 **local_70;
undefined4 local_68;
undefined4 local_64;
undefined8 local_60;
undefined8 uStack_58;
undefined8 local_50;
ulonglong local_48;
- local_48 = __security_cookie ^ (ulonglong)auStackY_e8;
+ local_48 = __security_cookie ^ (ulonglong)auStackY_f8;
local_78 = &local_88;
local_70 = &local_88;
local_50 = 0x30;
local_88 = &local_78;
local_98 = 0;
local_80 = &local_78;
local_90 = 0;
local_68 = 0x9000001c;
- plVar3 = &local_98;
local_64 = 0x80000004;
- pppuVar2 = &local_88;
local_60 = 0;
uStack_58 = 0;
uVar1 = PrjfOpenReparsePoint
- (param_1,param_2,0,0x80,0x29,in_stack_ffffffffffffff40,(longlong *)pppuVar2,
- plVar3,&local_90);
+ (param_1,param_2,0,0x80,0x29,
+ CONCAT44(in_stack_ffffffffffffff34,in_stack_ffffffffffffff30),
+ (longlong *)&local_88,&local_98,&local_90);
if ((int)uVar1 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDdZ
- (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,10,0x39,
- &WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,
+ if (((DAT_0 & 4) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDdZ
+ (0x20a,DAT_0 & 4,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,10,0x3a,
+ &WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
"onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",
- CONCAT44((int)((ulonglong)pppuVar2 >> 0x20),0x995),
- CONCAT44((int)((ulonglong)plVar3 >> 0x20),(int)uVar1),param_2);
+ CONCAT44(in_stack_ffffffffffffff54,0x9b4),
+ CONCAT44(in_stack_ffffffffffffff5c,(int)uVar1),param_2);
}
}
else {
if (param_6 != (byte *)0x0) {
*param_6 = (byte)local_64 & 1;
}
*param_4 = local_98;
local_98 = 0;
- if (param_5 == (longlong *)0x0) goto LAB_0;
+ if (param_5 == (longlong *)0x0) goto LAB_1;
*param_5 = local_90;
local_90 = 0;
}
if (local_98 != 0) {
FltClose();
}
-LAB_0:
+LAB_1:
if (local_90 != 0) {
ObfDereferenceObject();
}
return uVar1 & 0xffffffff;
}
```
## PrjfCopyAsPlaceHolder
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,sig,address,called|
|ratio|0.08|
|i_ratio|0.36|
|m_ratio|0.85|
|b_ratio|0.56|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfCopyAsPlaceHolder|PrjfCopyAsPlaceHolder|
|fullname|PrjfCopyAsPlaceHolder|PrjfCopyAsPlaceHolder|
|refcount|3|3|
|`length`|2202|3008|
|`called`|Expand for full list:
FLTMGR.SYS::FltAllocateExtraCreateParameterFromLookasideList
FLTMGR.SYS::FltAllocateExtraCreateParameterList
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltCreateFileEx2
FLTMGR.SYS::FltFreeExtraCreateParameterList
FLTMGR.SYS::FltInsertExtraCreateParameter
FLTMGR.SYS::FltIsEcpAcknowledged
FLTMGR.SYS::FltRemoveExtraCreateParameter
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ObfDereferenceObject
PrjfCopyFileMetaData
WPP_RECORDER_SF_sD
WPP_RECORDER_SF_sDd
WPP_RECORDER_SF_sDdZ
__security_check_cookie
memsetExpand for full list:
FLTMGR.SYS::FltAllocateExtraCreateParameterFromLookasideList
FLTMGR.SYS::FltAllocateExtraCreateParameterList
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltCreateFileEx2
FLTMGR.SYS::FltFreeExtraCreateParameterList
FLTMGR.SYS::FltInsertExtraCreateParameter
FLTMGR.SYS::FltIsEcpAcknowledged
FLTMGR.SYS::FltRemoveExtraCreateParameter
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::SeCaptureSecurityDescriptor
NTOSKRNL.EXE::SeReleaseSecurityDescriptor
PrjfCopyFileMetaData
WPP_RECORDER_AND_TRACE_SF_sD
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDdZ
__security_check_cookie
memset
PrjfWritePlaceholderInformationHandler|PrjfUpdatePlaceholderIfNeededHandler
PrjfWritePlaceholderInformationHandler|
|paramcount|7|8|
|`address`|1c002af08|140038438|
|`sig`|int __fastcall PrjfCopyAsPlaceHolder(char * param_1, wchar_t * param_2, longlong param_3, longlong param_4, int param_5, char param_6, uint param_7)|int __fastcall PrjfCopyAsPlaceHolder(char * param_1, longlong param_2, wchar_t * param_3, longlong param_4, longlong param_5, int param_6, char param_7, uint param_8)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfCopyAsPlaceHolder Called Diff
```diff
--- PrjfCopyAsPlaceHolder called
+++ PrjfCopyAsPlaceHolder called
@@ -10,0 +11,2 @@
+NTOSKRNL.EXE::SeCaptureSecurityDescriptor
+NTOSKRNL.EXE::SeReleaseSecurityDescriptor
@@ -12,3 +14,3 @@
-WPP_RECORDER_SF_sD
-WPP_RECORDER_SF_sDd
-WPP_RECORDER_SF_sDdZ
+WPP_RECORDER_AND_TRACE_SF_sD
+WPP_RECORDER_AND_TRACE_SF_sDD
+WPP_RECORDER_AND_TRACE_SF_sDdZ
```
### PrjfCopyAsPlaceHolder Diff
```diff
--- PrjfCopyAsPlaceHolder
+++ PrjfCopyAsPlaceHolder
@@ -1,332 +1,365 @@
/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
int PrjfCopyAsPlaceHolder
- (char *param_1,wchar_t *param_2,longlong param_3,longlong param_4,int param_5,
- char param_6,uint param_7)
+ (char *param_1,longlong param_2,wchar_t *param_3,longlong param_4,longlong param_5,
+ int param_6,char param_7,uint param_8)
{
- longlong lVar1;
- char cVar2;
- int iVar3;
- uint uVar4;
- ushort uVar5;
- uint uVar6;
- undefined2 uVar7;
- undefined1 auStackY_198 [32];
- undefined8 uVar8;
- undefined4 uVar9;
- undefined8 uVar10;
- undefined4 uVar11;
- undefined2 *local_118;
- int local_110;
- uint local_10c;
- wchar_t *local_108;
+ uint uVar1;
+ longlong lVar2;
+ char cVar3;
+ int iVar4;
+ undefined2 uVar5;
+ byte bVar6;
+ ushort uVar7;
+ uint uVar8;
+ bool bVar9;
+ undefined1 auStackY_1a8 [32];
+ undefined4 uVar10;
+ undefined4 in_stack_fffffffffffffea4;
+ undefined4 in_stack_fffffffffffffeac;
+ undefined2 *local_128;
+ int local_120;
+ uint local_11c;
+ wchar_t *local_118;
+ longlong local_110;
+ longlong local_108;
longlong local_100;
- longlong local_f8;
+ int local_f8;
+ undefined4 local_f4;
longlong local_f0;
- int local_e8;
- undefined4 local_e4;
- char *local_e0;
- char *local_d8;
- longlong local_d0;
+ char *local_e8;
+ longlong local_e0;
+ undefined8 local_d8;
+ longlong lStack_d0;
undefined8 local_c8;
- longlong lStack_c0;
- undefined8 local_b8;
- undefined8 uStack_b0;
- ulonglong local_a8;
- undefined8 local_a0;
+ undefined8 uStack_c0;
+ ulonglong local_b8;
+ undefined8 local_b0;
+ undefined8 uStack_a8;
+ wchar_t *local_a0;
undefined8 uStack_98;
- wchar_t *local_90;
- undefined8 uStack_88;
- char *local_80;
- ulonglong local_78;
+ longlong local_90;
+ ulonglong local_88;
+ undefined8 local_80;
+ undefined8 uStack_78;
undefined8 local_70;
undefined8 uStack_68;
undefined8 local_60;
undefined8 uStack_58;
- undefined8 local_50;
- undefined8 uStack_48;
- ulonglong local_40;
+ ulonglong local_50;
- local_40 = __security_cookie ^ (ulonglong)auStackY_198;
- local_d8 = (char *)0x0;
+ local_50 = __security_cookie ^ (ulonglong)auStackY_1a8;
+ local_e8 = (char *)0x0;
+ local_120 = 0;
+ local_f0 = 0;
local_110 = 0;
- local_e0 = (char *)0x0;
+ local_128 = (undefined2 *)0x0;
+ local_b8 = local_b8 & 0xffffffffffff0000;
+ local_90 = 0;
+ local_88 = local_88 & 0xffffffff00000000;
+ local_108 = 0;
local_100 = 0;
- local_118 = (undefined2 *)0x0;
- local_a8 = local_a8 & 0xffffffffffff0000;
- local_80 = (char *)0x0;
- local_78 = local_78 & 0xffffffff00000000;
- local_f8 = 0;
- local_f0 = 0;
+ local_d8 = 0;
+ lStack_d0 = 0;
local_c8 = 0;
- lStack_c0 = 0;
- local_b8 = 0;
- uStack_b0 = 0;
- local_a0 = 0;
+ uStack_c0 = 0;
+ local_b0 = 0;
+ uStack_a8 = 0;
+ local_a0 = (wchar_t *)0x0;
uStack_98 = 0;
- local_90 = (wchar_t *)0x0;
- uStack_88 = 0;
+ local_80 = 0;
+ uStack_78 = 0;
local_70 = 0;
uStack_68 = 0;
local_60 = 0;
uStack_58 = 0;
- local_50 = 0;
- uStack_48 = 0;
- local_108 = param_2;
- local_d0 = param_3;
- if ((param_5 == 0) || (param_4 == 0)) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- uVar7 = 0x3d;
-LAB_0:
- WPP_RECORDER_SF_sD(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,uVar7,
- &WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
+ local_118 = param_3;
+ local_e0 = param_4;
+ if ((param_6 == 0) || (param_5 == 0)) {
+ if (((DAT_0 & 0x20) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ uVar7 = 0x3e;
+LAB_1:
+ WPP_RECORDER_AND_TRACE_SF_sD
+ (0x205,DAT_0 & 0x20,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,uVar7,
+ &WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
}
}
- else if (param_5 == *(ushort *)(param_4 + 4) + 8) {
- if (param_1 == (char *)0x0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- uVar7 = 0x3f;
- goto LAB_0;
+ else if (param_6 == *(ushort *)(param_5 + 4) + 8) {
+ if (param_1 != (char *)0x0) {
+ iVar4 = *(int *)(param_1 + 0x38);
+ if (iVar4 == 0) {
+LAB_2:
+ if (*(int *)(param_1 + 0x40) != 0) {
+ uVar1 = *(uint *)(param_1 + 0x44);
+ if (uVar1 < 0x150) {
+ if (((DAT_0 & 0x20) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ uVar7 = 0x44;
+ goto LAB_1;
+ }
+ goto LAB_3;
+ }
+ uVar8 = uVar1 + *(int *)(param_1 + 0x40);
+ if (uVar8 < uVar1) {
+ iVar4 = -0x3fffff6b;
+ bVar9 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar6 = DAT_4 & 0x40;
+ if ((bVar6 == 0) && (!bVar9)) {
+ return -0x3fffff6b;
+ }
+ uVar7 = 0x45;
+ }
+ else if (param_8 < uVar8) {
+ iVar4 = -0x3ffffff3;
+ bVar9 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar6 = DAT_4 & 0x40;
+ if ((bVar6 == 0) && (!bVar9)) {
+ return -0x3ffffff3;
+ }
+ uVar7 = 0x46;
+ }
+ else {
+ iVar4 = SeCaptureSecurityDescriptor
+ (param_2 + (ulonglong)uVar1,CONCAT31((int3)(uVar8 >> 8),1),1);
+ if (-1 < iVar4) goto LAB_5;
+ bVar9 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar6 = DAT_4 & 0x40;
+ if ((bVar6 == 0) && (!bVar9)) goto LAB_6;
+ uVar7 = 0x47;
+ }
+ goto LAB_7;
+ }
+LAB_5:
+ if (*(int *)(param_1 + 0x48) != 0) {
+ iVar4 = -0x3fffff45;
+ goto LAB_6;
+ }
+ uVar1 = *(uint *)(param_1 + 0x30);
+ local_f8 = (*param_1 != '\0') + 0x200028;
+ local_11c = uVar1;
+ iVar4 = FltAllocateExtraCreateParameterList(Globals,0,&local_110);
+ if (iVar4 < 0) {
+ bVar9 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar6 = DAT_0 & 0x20;
+ if ((bVar6 == 0) && (!bVar9)) goto LAB_6;
+ uVar7 = 0x4b;
+LAB_8:
+ uVar5 = 0x205;
+ uVar10 = 5;
+ }
+ else {
+ iVar4 = FltAllocateExtraCreateParameterFromLookasideList
+ (Globals,&GUID_ECP_ATOMIC_CREATE,0x58);
+ if (iVar4 < 0) {
+ bVar9 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar6 = DAT_0 & 0x20;
+ if ((bVar6 == 0) && (!bVar9)) goto LAB_6;
+ uVar7 = 0x4c;
+ goto LAB_8;
+ }
+ memset(local_128,0,0x58);
+ *local_128 = 0x58;
+ local_128[1] = 2;
+ local_128[2] = 0;
+ uVar7 = *(ushort *)(param_5 + 4) + 8;
+ if (uVar7 < *(ushort *)(param_5 + 4)) {
+ local_128[3] = 0xffff;
+ iVar4 = -0x3fffff6b;
+ goto LAB_6;
+ }
+ local_128[3] = uVar7;
+ *(longlong *)(local_128 + 4) = param_5;
+ if (*param_1 == '\0') {
+ local_128[1] = local_128[1] | 1;
+ *(undefined8 *)(local_128 + 8) = *(undefined8 *)(param_1 + 8);
+ local_128[1] = local_128[1] | 4;
+ *(undefined8 *)(local_128 + 0xc) = *(undefined8 *)(param_1 + 8);
+ local_128[1] = local_128[1] | 8;
+ }
+ if (DAT_9 == '\0') {
+ if (param_7 != '\0') {
+ local_128[1] = local_128[1] | 0x400;
+ local_128[1] = local_128[1] | 0x200;
+ }
+ uStack_58 = *(undefined8 *)(param_1 + 0x28);
+ local_70 = *(undefined8 *)(param_1 + 0x10);
+ uStack_68 = *(undefined8 *)(param_1 + 0x18);
+ local_60 = *(undefined8 *)(param_1 + 0x20);
+ *(undefined8 **)(local_128 + 0x10) = &local_70;
+ local_128[1] = local_128[1] | 0x10;
+ local_128[1] = local_128[1] | 0x20;
+ local_11c = uVar1 | 0x400000;
+ *(uint *)(local_128 + 0x14) = local_11c;
+ }
+ while (iVar4 = FltInsertExtraCreateParameter(Globals,local_110,local_128), -1 < iVar4) {
+ local_d8 = 0x28;
+ lStack_d0 = local_110;
+ local_a0 = local_118;
+ local_90 = local_f0;
+ local_b8 = 1;
+ uStack_a8 = 0;
+ local_88 = 0;
+ local_c8 = 0;
+ uStack_c0 = 0;
+ local_b0 = CONCAT44(local_b0._4_4_,0x30);
+ uStack_98 = CONCAT44(uStack_98._4_4_,0x240);
+ iVar4 = FltCreateFileEx2(Globals,local_e0,&local_108,&local_100);
+ if (-1 < iVar4) {
+ cVar3 = FltIsEcpAcknowledged(Globals,local_128);
+ lVar2 = local_e0;
+ if (cVar3 == '\0') {
+ iVar4 = -0x3fffff45;
+ bVar9 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar6 = DAT_4 & 4;
+ if ((bVar6 != 0) || (bVar9)) {
+ iVar4 = -0x3fffff45;
+ uVar10 = 0xe2f;
+ uVar7 = 0x51;
+ goto LAB_10;
+ }
+ }
+ else {
+ iVar4 = PrjfCopyFileMetaData((longlong)param_1,local_108,local_100,local_e0,2);
+ if ((-1 < iVar4) && (DAT_9 != '\0')) {
+ iVar4 = PrjfCopyFileMetaData((longlong)param_1,local_108,local_100,lVar2,0x68);
+ }
+ }
+ goto LAB_6;
+ }
+ if (iVar4 == -0x3fffffcb) {
+ iVar4 = 0;
+ goto LAB_6;
+ }
+ if ((iVar4 != -0x3fffff45) || (DAT_9 != '\0')) {
+ bVar9 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar6 = DAT_4 & 4;
+ if ((bVar6 != 0) || (bVar9)) {
+ uVar10 = 0xe16;
+ uVar7 = 0x50;
+LAB_10:
+ WPP_RECORDER_AND_TRACE_SF_sDdZ
+ (0x20a,bVar6,bVar9,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,10,uVar7,
+ &WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",
+ CONCAT44(in_stack_fffffffffffffea4,uVar10),
+ CONCAT44(in_stack_fffffffffffffeac,iVar4),local_118);
+ }
+ goto LAB_6;
+ }
+ if (((DAT_11 & 4) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDdZ
+ (0x40a,DAT_11 & 4,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),4,10,0x4e,
+ &WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",
+ CONCAT44(in_stack_fffffffffffffea4,0xddd),
+ CONCAT44(in_stack_fffffffffffffeac,0xc00000bb),local_118);
+ }
+ local_f4 = 0;
+ DAT_9 = '\x01';
+ iVar4 = FltRemoveExtraCreateParameter
+ (Globals,local_110,&GUID_ECP_ATOMIC_CREATE,&local_128);
+ if (iVar4 < 0) {
+ bVar9 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar6 = DAT_4 & 4;
+ if ((bVar6 != 0) || (bVar9)) {
+ uVar10 = 0xdfb;
+ uVar7 = 0x4f;
+ goto LAB_10;
+ }
+ goto LAB_6;
+ }
+ local_128[1] = local_128[1] & 0xffef;
+ local_128[1] = local_128[1] & 0xfbff;
+ local_128[1] = local_128[1] & 0xfdff;
+ local_128[1] = local_128[1] & 0xffdf;
+ }
+ MicrosoftTelemetryAssertTriggeredNoArgsKM();
+ bVar9 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar6 = DAT_4 & 0x80;
+ if ((bVar6 == 0) && (!bVar9)) goto LAB_6;
+ uVar5 = 0x20f;
+ uVar7 = 0x4d;
+ uVar10 = 0xf;
+ }
}
+ else {
+ uVar1 = *(uint *)(param_1 + 0x3c);
+ if (uVar1 < 0x150) {
+ if (((DAT_0 & 0x20) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ uVar7 = 0x41;
+ goto LAB_1;
+ }
+ goto LAB_3;
+ }
+ if (uVar1 + iVar4 < uVar1) {
+ iVar4 = -0x3fffff6b;
+ bVar9 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar6 = DAT_4 & 0x40;
+ if ((bVar6 == 0) && (!bVar9)) {
+ return -0x3fffff6b;
+ }
+ uVar7 = 0x42;
+ }
+ else {
+ if (uVar1 + iVar4 <= param_8) {
+ local_e8 = param_1 + uVar1;
+ local_120 = iVar4;
+ goto LAB_2;
+ }
+ iVar4 = -0x3ffffff3;
+ bVar9 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar6 = DAT_4 & 0x40;
+ if ((bVar6 == 0) && (!bVar9)) {
+ return -0x3ffffff3;
+ }
+ uVar7 = 0x43;
+ }
+LAB_7:
+ uVar5 = 0x20e;
+ uVar10 = 0xe;
+ }
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (uVar5,bVar6,bVar9,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,uVar10,uVar7,
+ &WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
+ goto LAB_6;
}
- else {
- iVar3 = *(int *)(param_1 + 0x38);
- if (iVar3 == 0) {
-LAB_1:
- if (*(int *)(param_1 + 0x40) == 0) {
-LAB_2:
- if (*(int *)(param_1 + 0x48) != 0) {
- return -0x3fffff45;
- }
- uVar6 = *(uint *)(param_1 + 0x30);
- local_e8 = (*param_1 != '\0') + 0x200028;
- local_10c = uVar6;
- iVar3 = FltAllocateExtraCreateParameterList(Globals,0,&local_100);
- if (iVar3 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)
- goto LAB_3;
- uVar7 = 0x49;
- }
- else {
- iVar3 = FltAllocateExtraCreateParameterFromLookasideList
- (Globals,&GUID_ECP_ATOMIC_CREATE,0x58);
- if (-1 < iVar3) {
- memset(local_118,0,0x58);
- *local_118 = 0x58;
- local_118[1] = 2;
- local_118[2] = 0;
- uVar5 = *(ushort *)(param_4 + 4) + 8;
- if (uVar5 < *(ushort *)(param_4 + 4)) {
- local_118[3] = 0xffff;
- iVar3 = -0x3fffff6b;
- goto LAB_3;
- }
- local_118[3] = uVar5;
- *(longlong *)(local_118 + 4) = param_4;
- if (*param_1 == '\0') {
- local_118[1] = local_118[1] | 1;
- *(undefined8 *)(local_118 + 8) = *(undefined8 *)(param_1 + 8);
- local_118[1] = local_118[1] | 4;
- *(undefined8 *)(local_118 + 0xc) = *(undefined8 *)(param_1 + 8);
- local_118[1] = local_118[1] | 8;
- }
- if (DAT_4 == '\0') {
- if (param_6 != '\0') {
- local_118[1] = local_118[1] | 0x400;
- local_118[1] = local_118[1] | 0x200;
- }
- uStack_48 = *(undefined8 *)(param_1 + 0x28);
- local_60 = *(undefined8 *)(param_1 + 0x10);
- uStack_58 = *(undefined8 *)(param_1 + 0x18);
- local_50 = *(undefined8 *)(param_1 + 0x20);
- *(undefined8 **)(local_118 + 0x10) = &local_60;
- local_118[1] = local_118[1] | 0x10;
- local_118[1] = local_118[1] | 0x20;
- local_10c = uVar6 | 0x400000;
- *(uint *)(local_118 + 0x14) = local_10c;
- }
- while (iVar3 = FltInsertExtraCreateParameter(Globals,local_100,local_118), -1 < iVar3)
- {
- local_c8 = 0x28;
- lStack_c0 = local_100;
- local_90 = local_108;
- local_80 = local_e0;
- uVar9 = (undefined4)((ulonglong)&local_70 >> 0x20);
- uVar11 = 0;
- local_a8 = 1;
- uStack_98 = 0;
- local_78 = 0;
- local_b8 = 0;
- uStack_b0 = 0;
- local_a0 = CONCAT44(local_a0._4_4_,0x30);
- uStack_88 = CONCAT44(uStack_88._4_4_,0x240);
- iVar3 = FltCreateFileEx2(Globals,local_d0,&local_f8,&local_f0);
- if (-1 < iVar3) {
- cVar2 = FltIsEcpAcknowledged(Globals,local_118);
- lVar1 = local_d0;
- if (cVar2 == '\0') {
- iVar3 = -0x3fffff45;
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- uVar7 = 0x4f;
- uVar10 = CONCAT44(uVar11,0xc00000bb);
- uVar8 = CONCAT44(uVar9,0xdfd);
- iVar3 = -0x3fffff45;
- goto LAB_5;
- }
- }
- else {
- iVar3 = PrjfCopyFileMetaData((longlong)param_1,local_f8,local_f0,local_d0,2);
- if ((-1 < iVar3) && (DAT_4 != '\0')) {
- iVar3 = PrjfCopyFileMetaData((longlong)param_1,local_f8,local_f0,lVar1,0x68);
- }
- }
- goto LAB_3;
- }
- if (iVar3 == -0x3fffffcb) {
- iVar3 = 0;
- goto LAB_3;
- }
- if ((iVar3 != -0x3fffff45) || (DAT_4 != '\0')) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- uVar7 = 0x4e;
- uVar10 = CONCAT44(uVar11,iVar3);
- uVar8 = CONCAT44(uVar9,0xde4);
-LAB_5:
- WPP_RECORDER_SF_sDdZ
- (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,10,uVar7,
- &WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",uVar8,uVar10,
- local_108);
- }
- goto LAB_3;
- }
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- uVar10 = CONCAT44(uVar11,0xc00000bb);
- uVar8 = CONCAT44(uVar9,0xdab);
- WPP_RECORDER_SF_sDdZ
- (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),4,10,0x4c,
- &WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",uVar8,uVar10,local_108
- );
- uVar9 = (undefined4)((ulonglong)uVar8 >> 0x20);
- uVar11 = (undefined4)((ulonglong)uVar10 >> 0x20);
- }
- local_e4 = 0;
- DAT_4 = '\x01';
- iVar3 = FltRemoveExtraCreateParameter
- (Globals,local_100,&GUID_ECP_ATOMIC_CREATE,&local_118);
- if (iVar3 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- uVar7 = 0x4d;
- uVar10 = CONCAT44(uVar11,iVar3);
- uVar8 = CONCAT44(uVar9,0xdc9);
- goto LAB_5;
- }
- goto LAB_3;
- }
- local_118[1] = local_118[1] & 0xffef;
- local_118[1] = local_118[1] & 0xfbff;
- local_118[1] = local_118[1] & 0xfdff;
- local_118[1] = local_118[1] & 0xffdf;
- }
- MicrosoftTelemetryAssertTriggeredNoArgsKM();
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)
- goto LAB_3;
- uVar7 = 0x4b;
- uVar6 = 0xf;
- goto LAB_6;
- }
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)
- goto LAB_3;
- uVar7 = 0x4a;
- }
- uVar6 = 5;
- }
- else {
- uVar6 = *(uint *)(param_1 + 0x44);
- if (uVar6 < 0x150) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- uVar7 = 0x43;
- goto LAB_0;
- }
- goto LAB_7;
- }
- uVar4 = *(int *)(param_1 + 0x40) + uVar6;
- if (uVar4 < uVar6) {
- iVar3 = -0x3fffff6b;
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) {
- return -0x3fffff6b;
- }
- uVar7 = 0x44;
- }
- else {
- if (uVar4 <= param_7) {
- local_e0 = param_1 + uVar6;
- goto LAB_2;
- }
- iVar3 = -0x3ffffff3;
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) {
- return -0x3ffffff3;
- }
- uVar7 = 0x45;
- }
-LAB_8:
- uVar6 = 0xe;
- }
+ if (((DAT_0 & 0x20) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ uVar7 = 0x40;
+ goto LAB_1;
+ }
+ }
+ else if (((DAT_0 & 0x20) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ uVar7 = 0x3f;
+ goto LAB_1;
+ }
+LAB_3:
+ iVar4 = -0x3ffffff3;
LAB_6:
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,uVar6,uVar7,
- &WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
- goto LAB_3;
- }
- uVar6 = *(uint *)(param_1 + 0x3c);
- if (0x14f < uVar6) {
- if (uVar6 + iVar3 < uVar6) {
- iVar3 = -0x3fffff6b;
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) {
- return -0x3fffff6b;
- }
- uVar7 = 0x41;
- }
- else {
- if (uVar6 + iVar3 <= param_7) {
- local_d8 = param_1 + uVar6;
- local_110 = iVar3;
- goto LAB_1;
- }
- iVar3 = -0x3ffffff3;
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) {
- return -0x3ffffff3;
- }
- uVar7 = 0x42;
- }
- goto LAB_8;
- }
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- uVar7 = 0x40;
- goto LAB_0;
- }
- }
- }
- else if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- uVar7 = 0x3e;
- goto LAB_0;
- }
-LAB_7:
- iVar3 = -0x3ffffff3;
-LAB_3:
+ if (local_110 != 0) {
+ FltFreeExtraCreateParameterList(Globals);
+ }
+ if (local_108 != 0) {
+ FltClose();
+ }
if (local_100 != 0) {
- FltFreeExtraCreateParameterList(Globals);
- }
- if (local_f8 != 0) {
- FltClose();
+ ObfDereferenceObject();
}
if (local_f0 != 0) {
- ObfDereferenceObject();
- }
- return iVar3;
+ SeReleaseSecurityDescriptor(local_f0,1);
+ }
+ return iVar4;
}
```
## PrjfCompleteCommandHandler
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,sig,address,called|
|ratio|0.32|
|i_ratio|0.29|
|m_ratio|0.8|
|b_ratio|0.35|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfCompleteCommandHandler|PrjfCompleteCommandHandler|
|fullname|PrjfCompleteCommandHandler|PrjfCompleteCommandHandler|
|refcount|2|2|
|`length`|605|930|
|`called`|Expand for full list:
FLTMGR.SYS::FltAcquireResourceExclusive
FLTMGR.SYS::FltReleaseResource
NTOSKRNL.EXE::KeSetEvent
NTOSKRNL.EXE::RtlLookupElementGenericTableAvl
PrjfGetUnionContextByVirtualizationInstanceInfo
PrjfReleaseUnionContext
WPP_RECORDER_SF_sD
WPP_RECORDER_SF_sDd
WPP_RECORDER_SF_sDl
WPP_RECORDER_SF_sDlLL
memcpy
Expand for full list:
FLTMGR.SYS::FltAcquireResourceExclusive
FLTMGR.SYS::FltReleaseResource
NTOSKRNL.EXE::KeSetEvent
NTOSKRNL.EXE::RtlLookupElementGenericTableAvl
PrjfGetUnionContextByVirtualizationInstanceInfo
PrjfReleaseUnionContext
WPP_RECORDER_AND_TRACE_SF_sD
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDl
WPP_RECORDER_AND_TRACE_SF_sDlLL
memmove
MicrosoftTelemetryAssertTriggeredNoArgsKM
PrjfClearAttributes
WPP_RECORDER_SF_sDdZ|FLTMGR.SYS::FltUntagFile
MicrosoftTelemetryAssertTriggeredNoArgsKM
PrjfClearAttributes
WPP_RECORDER_AND_TRACE_SF_sDdZ|
|calling|PrjfFlushAndUpdateDiskStateWorker|PrjfFlushAndUpdateDiskStateWorker|
|paramcount|3|3|
|`address`|1c0020cb4|14002bf2c|
|sig|int __fastcall PrjfUntagFile(undefined8 param_1, longlong param_2, longlong param_3)|int __fastcall PrjfUntagFile(undefined8 param_1, longlong param_2, longlong param_3)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfUntagFile Called Diff
```diff
--- PrjfUntagFile called
+++ PrjfUntagFile called
@@ -4 +4 @@
-WPP_RECORDER_SF_sDdZ
+WPP_RECORDER_AND_TRACE_SF_sDdZ
```
### PrjfUntagFile Diff
```diff
--- PrjfUntagFile
+++ PrjfUntagFile
@@ -1,49 +1,55 @@
int PrjfUntagFile(undefined8 param_1,longlong param_2,longlong param_3)
{
uint *puVar1;
int iVar2;
- undefined2 uVar3;
- undefined4 uVar4;
- undefined4 in_stack_ffffffffffffffdc;
+ byte bVar3;
+ bool bVar4;
+ ushort uVar5;
+ undefined4 uVar6;
undefined4 in_stack_ffffffffffffffe4;
+ undefined4 in_stack_ffffffffffffffec;
iVar2 = PrjfClearAttributes(param_2,param_1,0x401000);
if (iVar2 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) {
+ bVar4 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar3 = DAT_0 & 4;
+ if ((bVar3 == 0) && (!bVar4)) {
return iVar2;
}
- uVar3 = 0xd;
- uVar4 = 0x2f1;
-LAB_0:
- WPP_RECORDER_SF_sDdZ
- (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),4,10,uVar3,
- &WPP_286736bb6a73387d41449b09eaab690a_Traceguids,
+ uVar6 = 0x302;
+ uVar5 = 0xd;
+LAB_1:
+ WPP_RECORDER_AND_TRACE_SF_sDdZ
+ (0x40a,bVar3,bVar4,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),4,10,uVar5,
+ &WPP_8662402235063b115c167dc7c0c22e28_Traceguids,
"onecore\\base\\fs\\gvflt\\filter\\sys\\expansion.c",
- CONCAT44(in_stack_ffffffffffffffdc,uVar4),CONCAT44(in_stack_ffffffffffffffe4,iVar2),
+ CONCAT44(in_stack_ffffffffffffffe4,uVar6),CONCAT44(in_stack_ffffffffffffffec,iVar2),
(wchar_t *)(param_2 + 0x58));
}
else {
iVar2 = FltUntagFile(param_1,param_2,0x9000001c,0);
if (iVar2 < 0) {
if ((iVar2 + 0x3ffffd8bU & 0xfffffffd) != 0) {
if ((iVar2 + 0x3ffffd8aU < 0x3d) &&
((0x1000000000000005U >> ((ulonglong)(iVar2 + 0x3ffffd8aU) & 0x3f) & 1) != 0)) {
MicrosoftTelemetryAssertTriggeredNoArgsKM();
}
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) {
+ bVar4 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar3 = DAT_0 & 4;
+ if ((bVar3 == 0) && (!bVar4)) {
return iVar2;
}
- uVar3 = 0xe;
- uVar4 = 0x317;
- goto LAB_0;
+ uVar6 = 0x328;
+ uVar5 = 0xe;
+ goto LAB_1;
}
iVar2 = 0;
}
puVar1 = *(uint **)(*(longlong *)(param_3 + 8) + 0x58);
*puVar1 = *puVar1 | 4;
}
return iVar2;
}
```
## PrjfProcessPostRenameOrLinkInformation
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,calling,called|
|ratio|0.31|
|i_ratio|0.28|
|m_ratio|0.91|
|b_ratio|0.46|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfProcessPostRenameOrLinkInformation|PrjfProcessPostRenameOrLinkInformation|
|fullname|PrjfProcessPostRenameOrLinkInformation|PrjfProcessPostRenameOrLinkInformation|
|refcount|3|3|
|`length`|1118|1382|
|`called`|Expand for full list:
FLTMGR.SYS::FltReleaseContext
MicrosoftTelemetryAssertTriggeredMsgKM
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::KeWaitForSingleObject
NTOSKRNL.EXE::RtlCompareUnicodeString
PrjfCleanUpRenameLinkTargetTombstone
PrjfCreateTombstone
PrjfGetSetContextFileObject
PrjfNotifyRenameOrLinkOperation
PrjfReleaseRenameOrLinkCompletionContext
PrjfRemoveInMemoryTombstone
PrjfTelemetryTombstoneFailureOperation
WPP_RECORDER_SF_sDd
WPP_RECORDER_SF_sDdDExpand for full list:
FLTMGR.SYS::FltReleaseContext
MicrosoftTelemetryAssertTriggeredMsgKM
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::KeWaitForSingleObject
NTOSKRNL.EXE::RtlCompareUnicodeString
PrjfCleanUpRenameLinkTargetTombstone
PrjfCreateTombstone
PrjfGetSetContextFileObject
PrjfNotifyRenameOrLinkOperation
PrjfReleaseRenameOrLinkCompletionContext
PrjfRemoveInMemoryTombstone
PrjfTelemetryTombstoneFailureOperation
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDdD
PrjfPostSetRenameInformation|
|paramcount|4|4|
|`address`|1c0021678|14002cb2c|
|sig|ulonglong __fastcall PrjfProcessPostRenameOrLinkInformation(longlong param_1, longlong param_2, longlong * param_3, uint param_4)|ulonglong __fastcall PrjfProcessPostRenameOrLinkInformation(longlong param_1, longlong param_2, longlong * param_3, uint param_4)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfProcessPostRenameOrLinkInformation Called Diff
```diff
--- PrjfProcessPostRenameOrLinkInformation called
+++ PrjfProcessPostRenameOrLinkInformation called
@@ -13,2 +13,2 @@
-WPP_RECORDER_SF_sDd
-WPP_RECORDER_SF_sDdD
+WPP_RECORDER_AND_TRACE_SF_sDD
+WPP_RECORDER_AND_TRACE_SF_sDdD
```
### PrjfProcessPostRenameOrLinkInformation Calling Diff
```diff
--- PrjfProcessPostRenameOrLinkInformation calling
+++ PrjfProcessPostRenameOrLinkInformation calling
@@ -1,0 +2 @@
+PrjfPostSetRenameInformation
```
### PrjfProcessPostRenameOrLinkInformation Diff
```diff
--- PrjfProcessPostRenameOrLinkInformation
+++ PrjfProcessPostRenameOrLinkInformation
@@ -1,153 +1,181 @@
ulonglong PrjfProcessPostRenameOrLinkInformation
(longlong param_1,longlong param_2,longlong *param_3,uint param_4)
{
- int iVar1;
- ulonglong uVar2;
+ uint uVar1;
+ int iVar2;
ulonglong uVar3;
- longlong lVar4;
- uint uVar5;
- undefined8 uVar6;
- undefined7 uVar7;
- undefined2 uVar8;
- longlong local_res18;
- uint local_res20;
+ ulonglong uVar4;
+ undefined2 uVar5;
+ byte bVar6;
+ undefined8 uVar7;
+ undefined7 uVar8;
+ bool bVar9;
+ longlong local_res18 [2];
+ ulonglong in_stack_ffffffffffffff78;
+ undefined4 uVar10;
+ ushort uVar11;
longlong local_48 [2];
uVar3 = 0;
local_48[0] = 0;
- local_res18 = 0;
- local_res20 = param_4;
+ local_res18[0] = 0;
if (param_4 == 0x80) {
if (*(int *)(param_1 + 0x18) == 0) {
- uVar2 = PrjfCleanUpRenameLinkTargetTombstone(param_1,param_2,(longlong)param_3,'\0');
- uVar3 = uVar2 & 0xffffffff;
- if (-1 < (int)uVar2) {
- if ((param_3[3] == 0) ||
- (KeWaitForSingleObject(param_3[5] + 0x120,0,0,0,0), *(char *)(param_3[5] + 0x11a) != '\0'
- )) goto LAB_0;
- uVar6 = 0x80000000;
- uVar5 = PrjfGetSetContextFileObject
+ uVar4 = PrjfCleanUpRenameLinkTargetTombstone(param_1,param_2,(longlong)param_3,'\0');
+ uVar3 = uVar4 & 0xffffffff;
+ if (-1 < (int)uVar4) {
+ if (param_3[3] == 0) {
+LAB_0:
+ if (param_3[3] != 0) {
+ uVar4 = PrjfRemoveInMemoryTombstone
+ (*(undefined8 *)(param_2 + 0x18),param_3[4],param_3[3]);
+ uVar3 = uVar4 & 0xffffffff;
+ if ((int)uVar4 < 0) {
+ if (((DAT_1 & 0x20) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDdD
+ (0x20d,DAT_1 & 0x20,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),in_stack_ffffffffffffff78,0xd,
+ 0x1b,&WPP_9aa94875f0ba3c84ae0a423dcca6636f_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\fileinfo.c");
+ }
+ PrjfTelemetryTombstoneFailureOperation(2,10,(int)uVar4);
+ }
+ }
+ goto LAB_2;
+ }
+ in_stack_ffffffffffffff78 = 0;
+ KeWaitForSingleObject(param_3[5] + 0x120,0,0);
+ if (*(char *)(param_3[5] + 0x11a) != '\0') goto LAB_0;
+ uVar7 = 0x80000000;
+ in_stack_ffffffffffffff78 = in_stack_ffffffffffffff78 & 0xffffffffffffff00;
+ uVar1 = PrjfGetSetContextFileObject
(*(undefined8 *)(param_2 + 0x18),param_3[3],-0x80000000,'\0','\0',
- (undefined4 *)0x0,(undefined2 *)0x0,local_48,&local_res18);
- uVar3 = (ulonglong)uVar5;
- if (-1 < (int)uVar5) {
- if (*(char *)(local_res18 + 0x2c) == '\0') {
+ (undefined4 *)0x0,(undefined2 *)0x0,local_48,local_res18);
+ uVar3 = (ulonglong)uVar1;
+ if (-1 < (int)uVar1) {
+ if (*(char *)(local_res18[0] + 0x2c) == '\0') {
MicrosoftTelemetryAssertTriggeredNoArgsKM();
}
- uVar7 = (undefined7)((ulonglong)uVar6 >> 8);
- uVar5 = PrjfCreateTombstone(*(undefined8 *)(param_2 + 0x18),param_3[4] + 8,
+ uVar8 = (undefined7)((ulonglong)uVar7 >> 8);
+ uVar1 = PrjfCreateTombstone(*(undefined8 *)(param_2 + 0x18),param_3[4] + 8,
(char)param_3[6]);
- uVar3 = (ulonglong)uVar5;
- if (uVar5 == 0xc0000035) {
- iVar1 = RtlCompareUnicodeString(param_3 + 1,param_3 + 8,CONCAT71(uVar7,1));
- if (iVar1 != 0) {
-LAB_1:
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x13,0x19,
- &WPP_9aa94875f0ba3c84ae0a423dcca6636f_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\fileinfo.c");
+ uVar3 = (ulonglong)uVar1;
+ if (uVar1 == 0xc0000035) {
+ iVar2 = RtlCompareUnicodeString(param_3 + 1,param_3 + 8,CONCAT71(uVar8,1));
+ if (iVar2 != 0) {
+LAB_3:
+ if (((DAT_4 & 8) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x213,DAT_4 & 8,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x13,0x19,
+ &WPP_9aa94875f0ba3c84ae0a423dcca6636f_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\fileinfo.c");
}
- PrjfTelemetryTombstoneFailureOperation(1,2,uVar5);
- goto LAB_2;
+ PrjfTelemetryTombstoneFailureOperation(1,2,uVar1);
+ goto LAB_5;
}
uVar3 = 0;
}
- else if ((int)uVar5 < 0) goto LAB_1;
-LAB_0:
- if (param_3[3] != 0) {
- lVar4 = param_3[4];
- uVar2 = PrjfRemoveInMemoryTombstone(*(undefined8 *)(param_2 + 0x18),lVar4,param_3[3]);
- uVar3 = uVar2 & 0xffffffff;
- if ((int)uVar2 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDdD
- (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),lVar4,0xd,0x1b,
- &WPP_9aa94875f0ba3c84ae0a423dcca6636f_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\fileinfo.c");
- }
- PrjfTelemetryTombstoneFailureOperation(2,10,(int)uVar2);
- }
- }
- goto LAB_3;
+ else if ((int)uVar1 < 0) goto LAB_3;
+ goto LAB_0;
}
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- uVar8 = 0x18;
- uVar5 = 0x13;
- goto LAB_4;
+ bVar9 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar6 = DAT_4 & 8;
+ if ((bVar6 != 0) || (bVar9)) {
+ uVar5 = 0x213;
+ uVar11 = 0x18;
+ uVar10 = 0x13;
+ goto LAB_6;
}
- goto LAB_2;
+ goto LAB_5;
}
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_5;
- uVar8 = 0x17;
+ bVar9 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar6 = DAT_4 & 8;
+ if ((bVar6 == 0) && (!bVar9)) goto LAB_7;
+ uVar11 = 0x17;
}
else {
- uVar2 = PrjfCleanUpRenameLinkTargetTombstone(param_1,param_2,(longlong)param_3,'\x01');
- uVar3 = uVar2 & 0xffffffff;
- if (-1 < (int)uVar2) goto LAB_0;
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_5;
- uVar8 = 0x1a;
+ uVar4 = PrjfCleanUpRenameLinkTargetTombstone(param_1,param_2,(longlong)param_3,'\x01');
+ uVar3 = uVar4 & 0xffffffff;
+ if (-1 < (int)uVar4) goto LAB_0;
+ bVar9 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar6 = DAT_4 & 8;
+ if ((bVar6 == 0) && (!bVar9)) goto LAB_7;
+ uVar11 = 0x1a;
}
-LAB_6:
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x13,uVar8,
- &WPP_9aa94875f0ba3c84ae0a423dcca6636f_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\fileinfo.c");
+LAB_8:
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x213,bVar6,bVar9,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x13,uVar11,
+ &WPP_9aa94875f0ba3c84ae0a423dcca6636f_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\fileinfo.c");
}
else {
if (param_4 == 0x100) {
if (*(int *)(param_1 + 0x18) < 0) {
- uVar2 = PrjfCleanUpRenameLinkTargetTombstone(param_1,param_2,(longlong)param_3,'\x01');
- uVar3 = uVar2 & 0xffffffff;
- if ((int)uVar2 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)
- goto LAB_5;
- uVar8 = 0x1c;
- goto LAB_6;
+ uVar4 = PrjfCleanUpRenameLinkTargetTombstone(param_1,param_2,(longlong)param_3,'\x01');
+ uVar3 = uVar4 & 0xffffffff;
+ if ((int)uVar4 < 0) {
+ bVar9 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar6 = DAT_4 & 8;
+ if ((bVar6 == 0) && (!bVar9)) goto LAB_7;
+ uVar11 = 0x1c;
+ goto LAB_8;
}
}
else {
- uVar2 = PrjfCleanUpRenameLinkTargetTombstone(param_1,param_2,(longlong)param_3,'\0');
- uVar3 = uVar2 & 0xffffffff;
- if ((int)uVar2 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)
- goto LAB_5;
- uVar8 = 0x1d;
- goto LAB_6;
+ uVar4 = PrjfCleanUpRenameLinkTargetTombstone(param_1,param_2,(longlong)param_3,'\0');
+ uVar3 = uVar4 & 0xffffffff;
+ if ((int)uVar4 < 0) {
+ bVar9 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar6 = DAT_4 & 8;
+ if ((bVar6 == 0) && (!bVar9)) goto LAB_7;
+ uVar11 = 0x1d;
+ goto LAB_8;
}
}
}
else {
MicrosoftTelemetryAssertTriggeredMsgKM();
}
-LAB_3:
+LAB_2:
if (-1 < *(int *)(param_1 + 0x18)) {
- uVar2 = PrjfNotifyRenameOrLinkOperation
+ uVar4 = PrjfNotifyRenameOrLinkOperation
(param_1,*(undefined8 *)(param_2 + 0x18),*(longlong **)(param_2 + 0x20),
- local_res20,param_3);
- uVar3 = uVar2 & 0xffffffff;
- if (((int)uVar2 < 0) && ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED))
- {
- uVar8 = 0x1e;
- uVar5 = 0xd;
-LAB_4:
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,uVar5,uVar8,
- &WPP_9aa94875f0ba3c84ae0a423dcca6636f_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\fileinfo.c");
+ param_4,param_3);
+ uVar3 = uVar4 & 0xffffffff;
+ if ((int)uVar4 < 0) {
+ bVar9 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar6 = DAT_1 & 0x20;
+ if ((bVar6 != 0) || (bVar9)) {
+ uVar5 = 0x20d;
+ uVar11 = 0x1e;
+ uVar10 = 0xd;
+LAB_6:
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (uVar5,bVar6,bVar9,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,uVar10,uVar11,
+ &WPP_9aa94875f0ba3c84ae0a423dcca6636f_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\fileinfo.c");
+ }
}
}
-LAB_2:
+LAB_5:
if (local_48[0] != 0) {
FltReleaseContext();
}
- if (local_res18 != 0) {
+ if (local_res18[0] != 0) {
FltReleaseContext();
}
}
-LAB_5:
+LAB_7:
if (param_3 != (longlong *)0x0) {
PrjfReleaseRenameOrLinkCompletionContext(param_3);
}
return uVar3;
}
```
## PrjfGetUnionContextByVirtualizationInstanceInfo
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.74|
|i_ratio|0.24|
|m_ratio|0.84|
|b_ratio|0.75|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfGetUnionContextByVirtualizationInstanceInfo|PrjfGetUnionContextByVirtualizationInstanceInfo|
|fullname|PrjfGetUnionContextByVirtualizationInstanceInfo|PrjfGetUnionContextByVirtualizationInstanceInfo|
|refcount|10|10|
|`length`|173|247|
|`called`|PrjfGetUnionContext
WPP_RECORDER_SF_sD|PrjfGetUnionContext
WPP_RECORDER_AND_TRACE_SF_sD|
|calling|PrjfClearNegativePathCacheHandler
PrjfCloseFileHandler
PrjfCompleteCommandHandler
PrjfDeleteFileHandler
PrjfOpenFileHandler
PrjfReadFileHandler
PrjfUpdatePlaceholderIfNeededHandler
PrjfWriteFileDataHandler
PrjfWritePlaceholderInformationHandler|PrjfClearNegativePathCacheHandler
PrjfCloseFileHandler
PrjfCompleteCommandHandler
PrjfDeleteFileHandler
PrjfOpenFileHandler
PrjfReadFileHandler
PrjfUpdatePlaceholderIfNeededHandler
PrjfWriteFileDataHandler
PrjfWritePlaceholderInformationHandler|
|paramcount|2|2|
|`address`|1c0018c18|140022da8|
|sig|longlong * __fastcall PrjfGetUnionContextByVirtualizationInstanceInfo(longlong * param_1, undefined8 param_2)|longlong * __fastcall PrjfGetUnionContextByVirtualizationInstanceInfo(longlong * param_1, undefined8 param_2)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfGetUnionContextByVirtualizationInstanceInfo Called Diff
```diff
--- PrjfGetUnionContextByVirtualizationInstanceInfo called
+++ PrjfGetUnionContextByVirtualizationInstanceInfo called
@@ -2 +2 @@
-WPP_RECORDER_SF_sD
+WPP_RECORDER_AND_TRACE_SF_sD
```
### PrjfGetUnionContextByVirtualizationInstanceInfo Diff
```diff
--- PrjfGetUnionContextByVirtualizationInstanceInfo
+++ PrjfGetUnionContextByVirtualizationInstanceInfo
@@ -1,33 +1,38 @@
longlong * PrjfGetUnionContextByVirtualizationInstanceInfo(longlong *param_1,undefined8 param_2)
{
longlong *plVar1;
- undefined2 uVar2;
+ ushort uVar2;
longlong local_18;
longlong lStack_10;
if (param_1 == (longlong *)0x0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) {
+ if (((DAT_0 & 2) == 0) &&
+ ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) {
return (longlong *)0x0;
}
uVar2 = 0x28;
}
else {
if ((int)param_1[2] == -0x6fffffe4) {
local_18 = *param_1;
lStack_10 = param_1[1];
plVar1 = PrjfGetUnionContext(param_2,&local_18);
return plVar1;
}
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) {
+ if (((DAT_0 & 2) == 0) &&
+ ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) {
return (longlong *)0x0;
}
uVar2 = 0x29;
}
- WPP_RECORDER_SF_sD(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,9,uVar2,
- &WPP_0def1edc605734705626ac974b591885_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\context.c");
+ WPP_RECORDER_AND_TRACE_SF_sD
+ (0x209,DAT_0 & 2,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,9,uVar2,
+ &WPP_16258fdb5ea53a6e7a49e4d7510d8a5c_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\context.c");
return (longlong *)0x0;
}
```
## PrjfPortConnect
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,sig,address,called|
|ratio|0.26|
|i_ratio|0.21|
|m_ratio|0.92|
|b_ratio|0.39|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfPortConnect|PrjfPortConnect|
|fullname|PrjfPortConnect|PrjfPortConnect|
|refcount|4|4|
|`length`|1183|1455|
|`called`|MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
PrjfAllocateUnicodeString
PrjfGetInstanceFromVolumeName
PrjfVerifyAccessAndSetClientPortIfNeeded
WPP_RECORDER_SF_sD
WPP_RECORDER_SF_sDd
WPP_RECORDER_SF_sDdD|Expand for full list:
Feature_3411221816__private_IsEnabledDeviceUsageNoInline
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
PrjfAllocateUnicodeString
PrjfGetInstanceFromVolumeName
PrjfVerifyAccessAndSetClientPortIfNeeded
RtlUnicodeStringCbCopyStringN
WPP_RECORDER_AND_TRACE_SF_sD
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDdD
FLTMGR.SYS::FltReleaseContext
MicrosoftTelemetryAssertTriggeredNoArgsKM
PrjfGetContextFileObject
WPP_RECORDER_SF_sDdD|FLTMGR.SYS::FltGetStreamHandleContext
FLTMGR.SYS::FltReleaseContext
MicrosoftTelemetryAssertTriggeredNoArgsKM
PrjfGetContextFileObject
WPP_RECORDER_AND_TRACE_SF_sDdD|
|calling|PrjFsctlDuplicateExtentsPreOp
PrjfEnumerateDirectoryWithMerge
PrjfExpansionWorker
PrjfPartiallyExpandDirectory
PrjfPreAcquireForSectionSynchronization
PrjfPreCleanup
PrjfPreDirectoryControl
PrjfPreWrite
PrjfPrepareCommandForFileObject
PrjfPrepareForDelete|PrjFsctlDuplicateExtentsPreOp
PrjfEnumerateDirectoryWithMerge
PrjfExpansionWorker
PrjfPartiallyExpandDirectory
PrjfPreAcquireForSectionSynchronization
PrjfPreCleanup
PrjfPreDirectoryControl
PrjfPreWrite
PrjfPrepareCommandForFileObject
PrjfPrepareForDelete|
|paramcount|5|5|
|`address`|1c000298c|140002cbc|
|sig|char __fastcall PrjfGetContextFileObjectEx(undefined8 param_1, undefined8 param_2, longlong * param_3, longlong * param_4, longlong * param_5)|char __fastcall PrjfGetContextFileObjectEx(undefined8 param_1, undefined8 param_2, longlong * param_3, longlong * param_4, longlong * param_5)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfGetContextFileObjectEx Called Diff
```diff
--- PrjfGetContextFileObjectEx called
+++ PrjfGetContextFileObjectEx called
@@ -5 +5 @@
-WPP_RECORDER_SF_sDdD
+WPP_RECORDER_AND_TRACE_SF_sDdD
```
### PrjfGetContextFileObjectEx Diff
```diff
--- PrjfGetContextFileObjectEx
+++ PrjfGetContextFileObjectEx
@@ -1,59 +1,63 @@
char PrjfGetContextFileObjectEx
(undefined8 param_1,undefined8 param_2,longlong *param_3,longlong *param_4,
longlong *param_5)
{
char cVar1;
- uint uVar2;
+ int iVar2;
longlong lVar3;
longlong lVar4;
longlong local_res18;
longlong local_res20;
+ undefined8 in_stack_ffffffffffffff88;
*param_3 = 0;
*param_4 = 0;
local_res18 = 0;
local_res20 = 0;
*param_5 = 0;
cVar1 = PrjfGetContextFileObject(param_1,param_2,&local_res18,&local_res20);
lVar4 = local_res20;
lVar3 = local_res18;
if (cVar1 != '\0') {
if (local_res20 == 0) {
if (local_res18 != 0) {
MicrosoftTelemetryAssertTriggeredNoArgsKM();
}
}
else {
- uVar2 = FltGetStreamHandleContext(param_1,param_2,param_5);
- if (((uVar2 + 0x80000000 & 0x80000000) == 0) && (uVar2 != 0xc0000225)) {
- lVar3 = local_res18;
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDdD
- (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),(ulonglong)uVar2,9,0x16,
- &WPP_0def1edc605734705626ac974b591885_Traceguids,
+ iVar2 = FltGetStreamHandleContext(param_1,param_2,param_5);
+ if (((iVar2 + 0x80000000U & 0x80000000) == 0) && (iVar2 != -0x3ffffddb)) {
+ if (((DAT_0 & 2) != 0) ||
+ (lVar3 = local_res18, (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED
+ )) {
+ WPP_RECORDER_AND_TRACE_SF_sDdD
+ (0x209,DAT_0 & 2,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),in_stack_ffffffffffffff88,9,0x16,
+ &WPP_16258fdb5ea53a6e7a49e4d7510d8a5c_Traceguids,
"onecore\\base\\fs\\gvflt\\filter\\sys\\context.c");
lVar3 = local_res18;
}
- goto LAB_0;
+ goto LAB_1;
}
}
*param_3 = lVar3;
*param_4 = lVar4;
lVar4 = 0;
lVar3 = 0;
}
-LAB_0:
+LAB_1:
if (lVar3 != 0) {
FltReleaseContext();
}
if (lVar4 != 0) {
FltReleaseContext(lVar4);
}
if ((cVar1 == '\0') && (*param_5 != 0)) {
MicrosoftTelemetryAssertTriggeredNoArgsKM();
}
return cVar1;
}
```
## PrjfShouldAutoAttach
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.54|
|i_ratio|0.41|
|m_ratio|0.87|
|b_ratio|0.62|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfShouldAutoAttach|PrjfShouldAutoAttach|
|fullname|PrjfShouldAutoAttach|PrjfShouldAutoAttach|
|refcount|2|2|
|`length`|1179|1573|
|`called`|Expand for full list:
FLTMGR.SYS::FltAllocatePoolAlignedWithTag
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltCreateFileEx
FLTMGR.SYS::FltCreateSystemVolumeInformationFolder
FLTMGR.SYS::FltFreePoolAlignedWithTag
FLTMGR.SYS::FltGetVolumeName
FLTMGR.SYS::FltReadFile
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::RtlAppendUnicodeToString
NTOSKRNL.EXE::RtlInitUnicodeString
PrjfAllocateUnicodeString
WPP_RECORDER_SF_sDd
memcpyExpand for full list:
FLTMGR.SYS::FltAllocatePoolAlignedWithTag
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltCreateFileEx
FLTMGR.SYS::FltCreateSystemVolumeInformationFolder
FLTMGR.SYS::FltFreePoolAlignedWithTag
FLTMGR.SYS::FltGetVolumeName
FLTMGR.SYS::FltReadFile
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::RtlAppendUnicodeToString
NTOSKRNL.EXE::RtlInitUnicodeString
PrjfAllocateUnicodeString
WPP_RECORDER_AND_TRACE_SF_sDD
memmoveExpand for full list:
FLTMGR.SYS::FltGetRequestorProcess
FLTMGR.SYS::FltGetStreamHandleContext
FLTMGR.SYS::FltReleaseContext
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::KeWaitForSingleObject
NTOSKRNL.EXE::PsGetProcessId
PrjfFreeCommandBuffer
PrjfGetContextFileObject
PrjfGetUnionContext
PrjfInitProcessInfo
PrjfPrepareCommandForFilePath
PrjfReleaseUnionContext
PrjfSendCommand
WPP_RECORDER_SF_sDDZ
WPP_RECORDER_SF_sDDZDZ
WPP_RECORDER_SF_sDDd
WPP_RECORDER_SF_sDd
WPP_RECORDER_SF_sDdDZ
WPP_RECORDER_SF_sDdZ
memsetExpand for full list:
FLTMGR.SYS::FltGetRequestorProcess
FLTMGR.SYS::FltGetStreamHandleContext
FLTMGR.SYS::FltReleaseContext
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::KeWaitForSingleObject
NTOSKRNL.EXE::PsGetProcessId
PrjfFreeCommandBuffer
PrjfGetContextFileObject
PrjfGetUnionContext
PrjfInitProcessInfo
PrjfPrepareCommandForFilePath
PrjfReleaseUnionContext
PrjfSendCommand
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDDD
WPP_RECORDER_AND_TRACE_SF_sDDZ
WPP_RECORDER_AND_TRACE_SF_sDDZDZ
WPP_RECORDER_AND_TRACE_SF_sDdDZ
WPP_RECORDER_AND_TRACE_SF_sDdZ
memset
PrjfNotifyRenameOrLinkOperation
PrjfPostCleanup
PrjfPrepareForDelete
PrjfSendPostCreateNotifications|PrjfExpandFile
PrjfNotifyRenameOrLinkOperation
PrjfPostCleanup
PrjfPrepareForDelete
PrjfSendPostCreateNotifications|
|paramcount|11|11|
|`address`|1c0003f7c|1400050b0|
|sig|longlong * __fastcall PrjfSendNotifyOperationCommand(longlong param_1, undefined8 param_2, undefined8 param_3, undefined8 * param_4, wchar_t * param_5, undefined1 param_6, undefined4 param_7, ushort * param_8, ushort * param_9, char param_10, uint * param_11)|longlong * __fastcall PrjfSendNotifyOperationCommand(longlong param_1, undefined8 param_2, undefined8 param_3, undefined8 * param_4, wchar_t * param_5, undefined1 param_6, undefined4 param_7, ushort * param_8, ushort * param_9, char param_10, uint * param_11)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfSendNotifyOperationCommand Called Diff
```diff
--- PrjfSendNotifyOperationCommand called
+++ PrjfSendNotifyOperationCommand called
@@ -14,6 +14,6 @@
-WPP_RECORDER_SF_sDDZ
-WPP_RECORDER_SF_sDDZDZ
-WPP_RECORDER_SF_sDDd
-WPP_RECORDER_SF_sDd
-WPP_RECORDER_SF_sDdDZ
-WPP_RECORDER_SF_sDdZ
+WPP_RECORDER_AND_TRACE_SF_sDD
+WPP_RECORDER_AND_TRACE_SF_sDDD
+WPP_RECORDER_AND_TRACE_SF_sDDZ
+WPP_RECORDER_AND_TRACE_SF_sDDZDZ
+WPP_RECORDER_AND_TRACE_SF_sDdDZ
+WPP_RECORDER_AND_TRACE_SF_sDdZ
```
### PrjfSendNotifyOperationCommand Diff
```diff
--- PrjfSendNotifyOperationCommand
+++ PrjfSendNotifyOperationCommand
@@ -1,233 +1,261 @@
longlong *
PrjfSendNotifyOperationCommand
(longlong param_1,undefined8 param_2,undefined8 param_3,undefined8 *param_4,
wchar_t *param_5,undefined1 param_6,undefined4 param_7,ushort *param_8,ushort *param_9,
char param_10,uint *param_11)
{
ushort *puVar1;
char cVar2;
uint *puVar3;
longlong lVar4;
char cVar5;
uint uVar6;
- int iVar7;
- undefined8 uVar8;
- longlong *plVar9;
- ulonglong uVar10;
+ undefined8 uVar7;
+ longlong *plVar8;
+ ulonglong uVar9;
+ undefined2 uVar10;
byte bVar11;
longlong *plVar12;
longlong *plVar13;
- undefined2 uVar14;
- longlong *plVar15;
- longlong *plVar16;
- undefined4 uVar17;
- uint **ppuVar18;
- undefined8 uVar19;
+ longlong *plVar14;
+ bool bVar15;
+ undefined1 uVar16;
+ undefined8 in_stack_fffffffffffffd10;
+ ushort uVar17;
+ undefined4 uVar18;
+ undefined4 in_stack_fffffffffffffd34;
+ undefined4 in_stack_fffffffffffffd3c;
uint local_2a8 [2];
longlong local_2a0;
int local_298 [2];
uint *local_290;
longlong local_288;
longlong local_280;
longlong local_278 [3];
undefined8 uStack_260;
undefined1 local_258 [4];
undefined4 local_254;
undefined8 local_250;
undefined8 uStack_248;
undefined8 local_240;
- undefined4 uVar20;
puVar1 = param_8;
- plVar9 = (longlong *)0x0;
+ plVar8 = (longlong *)0x0;
local_298[0] = 4;
local_290 = (uint *)0x0;
local_2a8[0] = 0;
param_8._0_4_ = 0;
memset(local_258,0,0x220);
- plVar15 = (longlong *)0x0;
+ plVar12 = (longlong *)0x0;
local_258[0] = param_6;
local_2a0 = 0;
local_288 = 0;
local_280 = 0;
local_254 = param_7;
local_278[0] = 0;
local_278[1] = 0;
if (param_9 != (ushort *)0x0) {
local_250 = *(undefined8 *)param_9;
uStack_248 = *(undefined8 *)(param_9 + 4);
local_240 = *(undefined8 *)(param_9 + 8);
}
param_9 = (ushort *)&EmptyPathFileName;
if (puVar1 != (ushort *)0x0) {
param_9 = puVar1;
}
- plVar13 = &local_288;
- cVar5 = PrjfGetContextFileObject(param_2,param_3,plVar13,&local_280);
+ cVar5 = PrjfGetContextFileObject(param_2,param_3,&local_288,&local_280);
lVar4 = local_288;
cVar2 = param_10;
- plVar16 = plVar15;
+ plVar13 = plVar12;
if (cVar5 == '\0') {
if (param_10 != '\0') {
LAB_0:
uVar6 = FltGetStreamHandleContext(param_2,param_3,&local_2a0);
- plVar12 = (longlong *)(ulonglong)uVar6;
+ plVar14 = (longlong *)(ulonglong)uVar6;
if ((int)uVar6 < 0) {
if ((uVar6 == 0xc0000225) && (cVar2 != '\0')) {
- uVar8 = FltGetRequestorProcess(param_1);
- uVar6 = PrjfInitProcessInfo(uVar8,local_278);
- plVar12 = (longlong *)(ulonglong)uVar6;
+ uVar7 = FltGetRequestorProcess(param_1);
+ uVar6 = PrjfInitProcessInfo(uVar7,local_278);
+ plVar14 = (longlong *)(ulonglong)uVar6;
if ((int)uVar6 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0xa4,
- &WPP_3ccab5108a9538d17a865fde27ef339f_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c");
- }
- goto LAB_1;
- }
- plVar15 = local_278;
- goto LAB_2;
+ if (((DAT_1 & 0x40) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x20e,DAT_1 & 0x40,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0xb6,
+ &WPP_39279db927ae337b8503ecc20725ff46_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c");
+ }
+ goto LAB_2;
+ }
+ plVar12 = local_278;
+ goto LAB_3;
}
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_1;
- uVar14 = 0xa5;
- uVar6 = 0xd;
+ bVar15 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar11 = DAT_1 & 0x20;
+ if ((bVar11 == 0) && (!bVar15)) goto LAB_2;
+ uVar10 = 0x20d;
+ uVar17 = 0xb7;
+ uVar18 = 0xd;
}
else {
- plVar15 = (longlong *)(local_2a0 + 0x48);
-LAB_2:
+ plVar12 = (longlong *)(local_2a0 + 0x48);
+LAB_3:
local_278[2] = *param_4;
uStack_260 = param_4[1];
- plVar9 = PrjfGetUnionContext(param_2,local_278 + 2);
- plVar16 = plVar9;
- if ((plVar9 != (longlong *)0x0) && (plVar9[10] != 0)) {
- if ((*(uint *)(plVar9 + 100) & 1) == 0) {
- if (plVar9[4] == 0) {
- plVar12 = (longlong *)0xc000ce01;
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)
- goto LAB_1;
- uVar14 = 0xa7;
- goto LAB_3;
- }
- iVar7 = PsGetProcessId();
- if (iVar7 == (int)plVar15[1]) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDDZDZ(*(undefined8 *)(WPP_GLOBAL_Control + 0x40));
+ plVar8 = PrjfGetUnionContext(param_2,local_278 + 2);
+ plVar13 = plVar8;
+ if ((plVar8 != (longlong *)0x0) && (plVar8[10] != 0)) {
+ if ((*(uint *)(plVar8 + 100) & 1) == 0) {
+ if (plVar8[4] == 0) {
+ if (((DAT_1 & 0x40) == 0) &&
+ (plVar14 = (longlong *)0xc000ce01,
+ (undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED))
+ goto LAB_2;
+ uVar17 = 0xb9;
+ goto LAB_4;
+ }
+ uVar6 = PsGetProcessId();
+ if (uVar6 == *(uint *)(plVar12 + 1)) {
+ if (((DAT_5 & 0x40) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDDZDZ
+ ((ulonglong)*(uint *)(plVar12 + 1),DAT_5 & 0x40,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40));
}
- goto LAB_1;
+ goto LAB_2;
}
}
local_278[2] = *param_4;
uStack_260 = param_4[1];
- ppuVar18 = &local_290;
- uVar10 = PrjfPrepareCommandForFilePath
- ((ushort *)param_5,local_278 + 2,7,param_9,(undefined8 *)local_258,
- local_2a0,plVar15,ppuVar18,local_2a8);
- uVar17 = (undefined4)((ulonglong)plVar15 >> 0x20);
- uVar20 = (undefined4)((ulonglong)ppuVar18 >> 0x20);
- plVar12 = (longlong *)(uVar10 & 0xffffffff);
- if ((int)uVar10 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)
- goto LAB_1;
- uVar14 = 0xa9;
- uVar19 = CONCAT44(uVar20,(int)uVar10);
- uVar8 = CONCAT44(uVar17,0x158b);
+ uVar9 = PrjfPrepareCommandForFilePath
+ ((ushort *)param_5,local_278 + 2,7,param_9,(undefined8 *)local_258,
+ local_2a0,plVar12,&local_290,local_2a8);
+ uVar6 = (uint)uVar9;
+ plVar14 = (longlong *)(uVar9 & 0xffffffff);
+ if ((int)uVar6 < 0) {
+ bVar15 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar11 = DAT_1 & 0x40;
+ if ((bVar11 == 0) && (!bVar15)) goto LAB_2;
+ uVar18 = 0x16c0;
+ uVar17 = 0xbb;
}
else {
uVar6 = PrjfSendCommand(param_1,param_2,local_290,0,(longlong)¶m_8,local_298);
puVar3 = param_11;
- plVar12 = (longlong *)(ulonglong)uVar6;
+ plVar14 = (longlong *)(ulonglong)uVar6;
if (-1 < (int)uVar6) {
if (param_11 != (uint *)0x0) {
if ((uint)param_8 != 0xffffffff) {
if (((uint)param_8 & 0xffffe000) == 0) {
if (((uint)param_8 & 1) != 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDDd
- (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),4,0xe,0xac,
- &WPP_3ccab5108a9538d17a865fde27ef339f_Traceguids,
+ if (((DAT_5 & 0x40) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDDD
+ (0x40e,DAT_5 & 0x40,
+ (undefined **)WPP_RECORDER_INITIALIZED !=
+ &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),4,0xe,0xbe,
+ &WPP_39279db927ae337b8503ecc20725ff46_Traceguids,
"onecore\\base\\fs\\gvflt\\filter\\sys\\message.c");
}
param_8._0_4_ = 1;
}
}
else {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),3,0xe,0xab,
- &WPP_3ccab5108a9538d17a865fde27ef339f_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c");
+ if (((DAT_6 & 0x40) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x30e,DAT_6 & 0x40,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED
+ ,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),3,0xe,0xbd,
+ &WPP_39279db927ae337b8503ecc20725ff46_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c");
}
param_8._0_4_ = 0xffffffff;
}
}
*puVar3 = (uint)param_8;
}
- goto LAB_1;
- }
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)
- goto LAB_1;
- uVar14 = 0xaa;
- uVar19 = CONCAT44(uVar20,uVar6);
- uVar8 = CONCAT44(uVar17,0x159c);
- }
- WPP_RECORDER_SF_sDdZ
- (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,uVar14,
- &WPP_3ccab5108a9538d17a865fde27ef339f_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c",uVar8,uVar19,param_5);
- goto LAB_1;
+ goto LAB_2;
+ }
+ bVar15 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar11 = DAT_1 & 0x40;
+ if ((bVar11 == 0) && (!bVar15)) goto LAB_2;
+ uVar18 = 0x16d1;
+ uVar17 = 0xbc;
+ }
+ WPP_RECORDER_AND_TRACE_SF_sDdZ
+ (0x20e,bVar11,bVar15,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,uVar17,
+ &WPP_39279db927ae337b8503ecc20725ff46_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c",
+ CONCAT44(in_stack_fffffffffffffd34,uVar18),
+ CONCAT44(in_stack_fffffffffffffd3c,uVar6),param_5);
+ goto LAB_2;
}
- plVar12 = (longlong *)0xc000ce01;
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_1;
- uVar14 = 0xa6;
-LAB_3:
- plVar12 = (longlong *)0xc000ce01;
- uVar6 = 0xe;
+ if (((DAT_1 & 0x40) == 0) &&
+ (plVar14 = (longlong *)0xc000ce01,
+ (undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) goto LAB_2;
+ uVar17 = 0xb8;
+LAB_4:
+ bVar15 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar11 = DAT_1 & 0x40;
+ plVar14 = (longlong *)0xc000ce01;
+ uVar18 = 0xe;
+ uVar10 = 0x20e;
}
- WPP_RECORDER_SF_sDdDZ
- (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,uVar6,uVar14,
- &WPP_3ccab5108a9538d17a865fde27ef339f_Traceguids,
+ WPP_RECORDER_AND_TRACE_SF_sDdDZ
+ (uVar10,bVar11,bVar15,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,uVar18,uVar17,
+ &WPP_39279db927ae337b8503ecc20725ff46_Traceguids,
"onecore\\base\\fs\\gvflt\\filter\\sys\\message.c");
- plVar16 = plVar9;
- goto LAB_1;
+ plVar13 = plVar8;
+ goto LAB_2;
}
- plVar12 = plVar9;
- plVar16 = plVar9;
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_1;
- uVar14 = 0xa2;
- bVar11 = 2;
+ bVar15 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar11 = DAT_1 & 0x40;
+ if ((bVar11 == 0) && (plVar13 = plVar8, plVar14 = plVar8, !bVar15)) goto LAB_2;
+ uVar10 = 0x20e;
+ uVar17 = 0xb4;
+ uVar16 = 2;
}
else {
- plVar13 = (longlong *)0x0;
KeWaitForSingleObject(local_288 + 0x120,0,0,0,0);
if (*(char *)(lVar4 + 0x11a) == '\0') goto LAB_0;
- plVar12 = (longlong *)0x0;
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_1;
- uVar14 = 0xa3;
- bVar11 = 4;
- }
- WPP_RECORDER_SF_sDDZ(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),bVar11,plVar13,uVar14);
- plVar12 = (longlong *)0x0;
- plVar16 = plVar15;
-LAB_1:
+ bVar15 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar11 = DAT_5 & 0x40;
+ if ((bVar11 == 0) && (plVar14 = (longlong *)0x0, !bVar15)) goto LAB_2;
+ uVar10 = 0x40e;
+ uVar17 = 0xb5;
+ uVar16 = 4;
+ }
+ WPP_RECORDER_AND_TRACE_SF_sDDZ
+ (uVar10,bVar11,bVar15,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),uVar16,
+ in_stack_fffffffffffffd10,uVar17);
+ plVar13 = plVar12;
+ plVar14 = (longlong *)0x0;
+LAB_2:
if (local_278[0] != 0) {
ExFreePoolWithTag(local_278[0],0x68734a50);
}
if (local_290 != (uint *)0x0) {
PrjfFreeCommandBuffer((longlong)local_290,local_2a8[0]);
}
if (local_288 != 0) {
FltReleaseContext();
}
if (local_280 != 0) {
FltReleaseContext();
}
if (local_2a0 != 0) {
FltReleaseContext();
}
- if (plVar16 != (longlong *)0x0) {
- PrjfReleaseUnionContext((longlong)plVar16);
- }
- return plVar12;
+ if (plVar13 != (longlong *)0x0) {
+ PrjfReleaseUnionContext((longlong)plVar13);
+ }
+ return plVar14;
}
```
## PrjfBlockFsctlOperation
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.79|
|i_ratio|0.53|
|m_ratio|0.98|
|b_ratio|0.94|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfBlockFsctlOperation|PrjfBlockFsctlOperation|
|fullname|PrjfBlockFsctlOperation|PrjfBlockFsctlOperation|
|refcount|2|2|
|`length`|632|675|
|`called`|FLTMGR.SYS::FltReleaseContext
FLTMGR.SYS::FltVetoBypassIo
NTOSKRNL.EXE::RtlInitUnicodeString
PrjfGetContextFileObject
WPP_RECORDER_SF_sDd
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer|FLTMGR.SYS::FltReleaseContext
FLTMGR.SYS::FltVetoBypassIo
NTOSKRNL.EXE::RtlInitUnicodeString
PrjfGetContextFileObject
WPP_RECORDER_AND_TRACE_SF_sDD
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer|
|calling|PrjfPreFsControl|PrjfPreFsControl|
|paramcount|2|2|
|`address`|1c0022138|14002d8b4|
|sig|undefined4 __fastcall PrjfBlockFsctlOperation(longlong param_1, longlong param_2)|undefined4 __fastcall PrjfBlockFsctlOperation(longlong param_1, longlong param_2)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfBlockFsctlOperation Called Diff
```diff
--- PrjfBlockFsctlOperation called
+++ PrjfBlockFsctlOperation called
@@ -5 +5 @@
-WPP_RECORDER_SF_sDd
+WPP_RECORDER_AND_TRACE_SF_sDD
```
### PrjfBlockFsctlOperation Diff
```diff
--- PrjfBlockFsctlOperation
+++ PrjfBlockFsctlOperation
@@ -1,121 +1,125 @@
/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
/* WARNING: Type propagation algorithm not settling */
/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */
undefined4 PrjfBlockFsctlOperation(longlong param_1,longlong param_2)
{
uint uVar1;
int *piVar2;
bool bVar3;
bool bVar4;
ulonglong uVar5;
char cVar6;
int iVar7;
- undefined8 uVar8;
+ longlong lVar8;
undefined4 uVar10;
- undefined1 auStackY_e8 [32];
+ undefined4 uVar11;
+ undefined1 auStackY_108 [32];
ulonglong local_a8;
longlong local_a0 [7];
ulonglong *local_68;
undefined4 local_60;
undefined4 local_5c;
longlong *local_58;
undefined4 local_50;
undefined4 local_4c;
ulonglong local_48;
- undefined8 uVar9;
+ longlong lVar9;
- local_48 = __security_cookie ^ (ulonglong)auStackY_e8;
+ local_48 = __security_cookie ^ (ulonglong)auStackY_108;
local_a8 = 0;
local_a0[0] = 0;
uVar1 = *(uint *)(*(longlong *)(param_1 + 0x10) + 0x28);
bVar3 = true;
uVar10 = 1;
cVar6 = PrjfGetContextFileObject
(*(undefined8 *)(param_2 + 0x18),*(undefined8 *)(param_2 + 0x20),
(longlong *)&local_a8,local_a0);
uVar5 = local_a8;
if (cVar6 != '\0') {
if (local_a8 == 0) goto LAB_0;
uVar10 = 1;
if (*(int *)(local_a8 + 0x40) != 3) {
iVar7 = 0;
+ uVar11 = 4;
uVar10 = 4;
- uVar9 = 0;
- uVar8 = 0;
+ lVar9 = 0;
+ lVar8 = 0;
bVar4 = true;
if (uVar1 == 0x94264) {
iVar7 = -0x3fff5d5d;
- uVar8 = uVar9;
+ lVar8 = lVar9;
+ uVar10 = uVar11;
bVar4 = true;
}
else if (uVar1 == 0x98268) {
iVar7 = -0x3fff5d5c;
- uVar8 = uVar9;
+ lVar8 = lVar9;
+ uVar10 = uVar11;
}
else if (uVar1 == 0x90448) {
local_a0[1] = 0;
local_a0[2] = 0;
if ((*(uint *)(*(longlong *)(param_1 + 0x10) + 0x20) < 0x18) ||
(piVar2 = *(int **)(*(longlong *)(param_1 + 0x10) + 0x30), piVar2 == (int *)0x0)) {
iVar7 = -0x3ffffdfa;
- uVar10 = 4;
}
else if ((*piVar2 - 1U & 0xfffffffd) == 0) {
RtlInitUnicodeString(local_a0 + 1,L"Bypass not supported on virtualized file");
- iVar7 = FltVetoBypassIo(param_1);
- uVar8 = 0;
- if (-1 < iVar7) {
- uVar8 = 0x160;
- }
+ iVar7 = FltVetoBypassIo(param_1,param_2);
+ lVar8 = ((longlong)iVar7 >> 0x3f & 0xfffffffffffffea0U) + 0x160;
+ uVar10 = uVar11;
}
else {
bVar4 = false;
- uVar8 = uVar9;
+ lVar8 = lVar9;
uVar10 = 1;
}
}
else {
iVar7 = -0x3fffff45;
- uVar10 = 4;
}
*(int *)(param_1 + 0x18) = iVar7;
- *(undefined8 *)(param_1 + 0x20) = uVar8;
+ *(longlong *)(param_1 + 0x20) = lVar8;
if (bVar4) {
if (5 < DAT_1) {
if (((_DAT_2 & 0x400000000000) == 0) ||
((DAT_3 & 0x400000000000) != DAT_3)) {
bVar3 = false;
}
if (bVar3) {
local_5c = 0;
local_68 = &local_a8;
local_4c = 0;
local_58 = local_a0 + 1;
local_60 = 8;
local_50 = 8;
local_a0[1] = 0x1000000;
local_a8 = (ulonglong)uVar1;
- _tlgWriteTransfer_EtwWriteTransfer(0x1c0011068,&DAT_4,0,0,4,local_a0 + 3);
+ _tlgWriteTransfer_EtwWriteTransfer(0x14001b068,&DAT_4,0,0,4,local_a0 + 3);
}
}
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),3,7,0x2d,
- &WPP_594c3e8dc88d3460d4d40c2e57e2d4a0_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\fsctrl.c");
+ if (((DAT_5 & 0x80) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x307,DAT_5 & 0x80,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),3,7,0x2d,
+ &WPP_594c3e8dc88d3460d4d40c2e57e2d4a0_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\fsctrl.c");
}
}
}
}
if (uVar5 != 0) {
FltReleaseContext(uVar5);
}
LAB_0:
if (local_a0[0] != 0) {
FltReleaseContext();
}
return uVar10;
}
```
## PrjfExpandFile
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,sig,address,called|
|ratio|0.36|
|i_ratio|0.24|
|m_ratio|0.88|
|b_ratio|0.45|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfExpandFile|PrjfExpandFile|
|fullname|PrjfExpandFile|PrjfExpandFile|
|refcount|2|2|
|`length`|1498|1903|
|`called`|Expand for full list:
FLTMGR.SYS::FltAllocateGenericWorkItem
FLTMGR.SYS::FltFreeGenericWorkItem
FLTMGR.SYS::FltGetFileNameInformationUnsafe
FLTMGR.SYS::FltQueueGenericWorkItem
FLTMGR.SYS::FltReleaseFileNameInformation
FLTMGR.SYS::FltSetInformationFile
MicrosoftTelemetryAssertTriggeredMsgKM
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExAcquireFastMutex
NTOSKRNL.EXE::ExReInitializeRundownProtection
NTOSKRNL.EXE::ExReleaseFastMutex
NTOSKRNL.EXE::ExRundownCompleted
NTOSKRNL.EXE::ExWaitForRundownProtectionRelease
NTOSKRNL.EXE::KeClearEvent
NTOSKRNL.EXE::KeQueryPriorityThread
NTOSKRNL.EXE::KeSetEvent
NTOSKRNL.EXE::ObfReferenceObject
PrjfCopyStreamData
PrjfGetUnionContext
PrjfReleaseUnionContext
PrjfSendNotifyOperationCommand
PrjfSuppressTimestamps
WPP_RECORDER_SF_sDd
WPP_RECORDER_SF_sDdZ
WPP_RECORDER_SF_sDqdExpand for full list:
FLTMGR.SYS::FltAllocateGenericWorkItem
FLTMGR.SYS::FltFreeGenericWorkItem
FLTMGR.SYS::FltGetFileNameInformationUnsafe
FLTMGR.SYS::FltQueueGenericWorkItem
FLTMGR.SYS::FltReleaseFileNameInformation
FLTMGR.SYS::FltSetInformationFile
Feature_HydrateLargeNonCachedFiles__private_IsEnabledDeviceUsageNoInline
MicrosoftTelemetryAssertTriggeredMsgKM
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExAcquireFastMutex
NTOSKRNL.EXE::ExReInitializeRundownProtection
NTOSKRNL.EXE::ExReleaseFastMutex
NTOSKRNL.EXE::ExRundownCompleted
NTOSKRNL.EXE::ExWaitForRundownProtectionRelease
NTOSKRNL.EXE::IoGetRelatedDeviceObject
NTOSKRNL.EXE::KeClearEvent
NTOSKRNL.EXE::KeQueryPriorityThread
NTOSKRNL.EXE::KeSetEvent
NTOSKRNL.EXE::ObfReferenceObject
PrjfCopyStreamData
PrjfGetUnionContext
PrjfReleaseUnionContext
PrjfSendNotifyOperationCommand
PrjfSuppressTimestamps
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDdZ
WPP_RECORDER_AND_TRACE_SF_sDqdExpand for full list:
NTOSKRNL.EXE::ExFreePoolWithTag
PrjfAllocateUnicodeString
PrjfCopyAsPlaceHolder
PrjfCreateHardLink
PrjfCreatePrjReparseBuffer
PrjfCreateSymlinkFromPlaceholderInfoMessage
PrjfGetUnionContextByVirtualizationInstanceInfo
PrjfRelPathToFullPath
PrjfReleaseUnionContext
PrjfValidatePlaceholderInformationMessage
WPP_RECORDER_SF_sDd
Expand for full list:
NTOSKRNL.EXE::ExFreePoolWithTag
PrjfAllocateUnicodeString
PrjfCopyAsPlaceHolder
PrjfCreateHardLink
PrjfCreatePrjReparseBuffer
PrjfCreateSymlinkFromPlaceholderInfoMessage
PrjfGetUnionContextByVirtualizationInstanceInfo
PrjfRelPathToFullPath
PrjfReleaseUnionContext
PrjfValidatePlaceholderInformationMessage
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_SF_sDd
memset|NTOSKRNL.EXE::ExAllocateFromPagedLookasideList
WPP_RECORDER_AND_TRACE_SF_sDD
memset|
|calling|PrjfPrepareEnumerationContexts|PrjfPrepareEnumerationContexts|
|paramcount|5|5|
|`address`|1c001af64|1400257d0|
|`sig`|undefined4 __fastcall PrjfAddSubContext(longlong param_1, longlong param_2, longlong param_3, undefined8 param_4, longlong param_5)|undefined8 __fastcall PrjfAddSubContext(longlong param_1, longlong param_2, longlong param_3, undefined8 param_4, longlong param_5)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfAddSubContext Called Diff
```diff
--- PrjfAddSubContext called
+++ PrjfAddSubContext called
@@ -2 +2 @@
-WPP_RECORDER_SF_sDd
+WPP_RECORDER_AND_TRACE_SF_sDD
```
### PrjfAddSubContext Diff
```diff
--- PrjfAddSubContext
+++ PrjfAddSubContext
@@ -1,40 +1,43 @@
-undefined4
+undefined8
PrjfAddSubContext(longlong param_1,longlong param_2,longlong param_3,undefined8 param_4,
longlong param_5)
{
code *pcVar1;
longlong *_Dst;
longlong *plVar2;
- undefined4 uVar3;
+ undefined8 uVar3;
uVar3 = 0;
_Dst = (longlong *)ExAllocateFromPagedLookasideList(&DAT_0);
if (_Dst == (longlong *)0x0) {
uVar3 = 0xc000009a;
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x12,0x15,
- &WPP_e21b7c61aee93f730c9c252e6e8da2f4_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\dir.c");
- uVar3 = 0xc000009a;
+ if (((DAT_1 & 4) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x212,DAT_1 & 4,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x12,0x15,
+ &WPP_3d19aee1b05838720427e757513a9608_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\dir.c");
}
}
else {
memset(_Dst,0,0x50);
_Dst[9] = param_5;
_Dst[3] = param_3;
_Dst[4] = param_2;
plVar2 = *(longlong **)(param_1 + 8);
if (*plVar2 != param_1) {
pcVar1 = (code *)swi(0x29);
plVar2 = (longlong *)(*pcVar1)(3);
}
*_Dst = param_1;
_Dst[1] = (longlong)plVar2;
*plVar2 = (longlong)_Dst;
*(longlong **)(param_1 + 8) = _Dst;
}
return uVar3;
}
```
## PrjfIsZeroAllocatedRange
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.7|
|i_ratio|0.38|
|m_ratio|0.95|
|b_ratio|0.93|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfIsZeroAllocatedRange|PrjfIsZeroAllocatedRange|
|fullname|PrjfIsZeroAllocatedRange|PrjfIsZeroAllocatedRange|
|refcount|2|2|
|`length`|236|277|
|`called`|FLTMGR.SYS::FltFsControlFile
WPP_RECORDER_SF_sDq
__security_check_cookie|FLTMGR.SYS::FltFsControlFile
WPP_RECORDER_AND_TRACE_SF_sDq
__security_check_cookie|
|calling|PrjfLaunchExpansion|PrjfLaunchExpansion|
|paramcount|2|2|
|`address`|1c002ddf4|14003beb0|
|sig|undefined1 __fastcall PrjfIsZeroAllocatedRange(undefined8 param_1, undefined8 param_2)|undefined1 __fastcall PrjfIsZeroAllocatedRange(undefined8 param_1, undefined8 param_2)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfIsZeroAllocatedRange Called Diff
```diff
--- PrjfIsZeroAllocatedRange called
+++ PrjfIsZeroAllocatedRange called
@@ -2 +2 @@
-WPP_RECORDER_SF_sDq
+WPP_RECORDER_AND_TRACE_SF_sDq
```
### PrjfIsZeroAllocatedRange Diff
```diff
--- PrjfIsZeroAllocatedRange
+++ PrjfIsZeroAllocatedRange
@@ -1,32 +1,35 @@
/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
undefined1 PrjfIsZeroAllocatedRange(undefined8 param_1,undefined8 param_2)
{
int iVar1;
undefined1 uVar2;
- undefined1 auStackY_78 [32];
+ undefined1 auStackY_98 [32];
undefined8 local_20;
undefined8 uStack_18;
ulonglong local_10;
- local_10 = __security_cookie ^ (ulonglong)auStackY_78;
+ local_10 = __security_cookie ^ (ulonglong)auStackY_98;
local_20 = 0;
uStack_18 = 0x7fffffffffffffff;
iVar1 = FltFsControlFile(0,param_2,0x940cf,&local_20);
if (iVar1 < 0) {
- uVar2 = 0;
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDq(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,10,0xa3,
- &WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
+ if (((DAT_0 & 4) != 0) ||
+ (uVar2 = 0, (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDq
+ (0x20a,DAT_0 & 4,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,10,0xa5,
+ &WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
uVar2 = 0;
}
}
else {
uVar2 = 1;
}
return uVar2;
}
```
## PrjfValidateNotificationRoot
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,sig,address,called|
|ratio|0.51|
|i_ratio|0.1|
|m_ratio|0.82|
|b_ratio|0.67|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfValidateNotificationRoot|PrjfValidateNotificationRoot|
|fullname|PrjfValidateNotificationRoot|PrjfValidateNotificationRoot|
|refcount|2|2|
|`length`|484|676|
|`called`|WPP_RECORDER_SF_sDd
WPP_RECORDER_SF_sDdL
WPP_RECORDER_SF_sDdLL|WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDdL
WPP_RECORDER_AND_TRACE_SF_sDdLL|
|calling|PrjfStoreNotificationMappingEntries|PrjfStoreNotificationMappingEntries|
|paramcount|4|4|
|`address`|1c00366b4|1400463e0|
|`sig`|undefined8 __fastcall PrjfValidateNotificationRoot(longlong param_1, undefined8 param_2, undefined8 param_3, undefined8 * param_4)|undefined8 __fastcall PrjfValidateNotificationRoot(longlong param_1, uint param_2, undefined8 param_3, undefined8 * param_4)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfValidateNotificationRoot Called Diff
```diff
--- PrjfValidateNotificationRoot called
+++ PrjfValidateNotificationRoot called
@@ -1,3 +1,3 @@
-WPP_RECORDER_SF_sDd
-WPP_RECORDER_SF_sDdL
-WPP_RECORDER_SF_sDdLL
+WPP_RECORDER_AND_TRACE_SF_sDD
+WPP_RECORDER_AND_TRACE_SF_sDdL
+WPP_RECORDER_AND_TRACE_SF_sDdLL
```
### PrjfValidateNotificationRoot Diff
```diff
--- PrjfValidateNotificationRoot
+++ PrjfValidateNotificationRoot
@@ -1,67 +1,90 @@
undefined8
-PrjfValidateNotificationRoot
- (longlong param_1,undefined8 param_2,undefined8 param_3,undefined8 *param_4)
+PrjfValidateNotificationRoot(longlong param_1,uint param_2,undefined8 param_3,undefined8 *param_4)
{
uint uVar1;
uint uVar2;
- undefined2 uVar3;
+ undefined1 in_stack_ffffffffffffffa8;
+ undefined7 in_stack_ffffffffffffffa9;
+ undefined4 in_stack_ffffffffffffffb0;
+ undefined4 in_stack_ffffffffffffffb4;
+ ushort uVar3;
- uVar2 = *(uint *)(param_1 + 4);
*param_4 = 0;
- if (uVar2 < 0x10) {
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) {
+ uVar1 = *(uint *)(param_1 + 4);
+ if (uVar1 < 0x10) {
+ if (((DAT_0 & 0x10) == 0) &&
+ ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) {
return 0xc000000d;
}
uVar3 = 0x10;
}
else {
- if (uVar2 <= (uint)param_2) {
- uVar1 = *(ushort *)(param_1 + 0xe) + 0x10;
- if (uVar1 < 0x10) {
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) {
+ if (uVar1 <= param_2) {
+ uVar2 = *(ushort *)(param_1 + 0xe) + 0x10;
+ if (uVar2 < 0x10) {
+ if (((DAT_1 & 8) == 0) &&
+ ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) {
return 0xc0000095;
}
uVar3 = 0x12;
}
else {
- if (uVar2 < uVar1) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x14,0x13,
- &WPP_5c05f7cae5513ff3734adbc0d3bd9537_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\mapping.c");
+ if (uVar1 < uVar2) {
+ if (((DAT_0 & 0x10) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x214,DAT_0 & 0x10,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x14,0x13,
+ &WPP_0314efc3b1f93d76a134ccc0e69e0e16_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\mapping.c");
}
return 0xc000000d;
}
- uVar2 = *(ushort *)(param_1 + 0xe) + 4;
- if (3 < uVar2) {
- if (*(ushort *)(param_1 + 0xc) == uVar2) {
+ uVar1 = *(ushort *)(param_1 + 0xe) + 4;
+ if (3 < uVar1) {
+ if (*(ushort *)(param_1 + 0xc) == uVar1) {
*param_4 = (ushort *)(param_1 + 0xc);
return 0;
}
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) {
+ if (((DAT_0 & 0x10) == 0) &&
+ ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) {
return 0xc000000d;
}
- WPP_RECORDER_SF_sDdLL(*(undefined8 *)(WPP_GLOBAL_Control + 0x40));
+ WPP_RECORDER_AND_TRACE_SF_sDdLL
+ ((ulonglong)uVar1,DAT_0 & 0x10,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40));
return 0xc000000d;
}
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) {
+ if (((DAT_1 & 8) == 0) &&
+ ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) {
return 0xc0000095;
}
uVar3 = 0x14;
}
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xb,uVar3,
- &WPP_5c05f7cae5513ff3734adbc0d3bd9537_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\mapping.c");
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x20b,DAT_1 & 8,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xb,uVar3,
+ &WPP_0314efc3b1f93d76a134ccc0e69e0e16_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\mapping.c");
return 0xc0000095;
}
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) {
+ if (((DAT_0 & 0x10) == 0) &&
+ ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) {
return 0xc000000d;
}
uVar3 = 0x11;
}
- WPP_RECORDER_SF_sDdL(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),param_2,param_3,uVar3);
+ WPP_RECORDER_AND_TRACE_SF_sDdL
+ (param_1,DAT_0 & 0x10,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),
+ CONCAT71(in_stack_ffffffffffffffa9,in_stack_ffffffffffffffa8),
+ CONCAT44(in_stack_ffffffffffffffb4,in_stack_ffffffffffffffb0),uVar3);
return 0xc000000d;
}
```
## PrjfValidatePlaceholderInformationMessage
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.44|
|i_ratio|0.16|
|m_ratio|0.76|
|b_ratio|0.28|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfValidatePlaceholderInformationMessage|PrjfValidatePlaceholderInformationMessage|
|fullname|PrjfValidatePlaceholderInformationMessage|PrjfValidatePlaceholderInformationMessage|
|refcount|3|3|
|`length`|1409|2317|
|`called`|MicrosoftTelemetryAssertTriggeredNoArgsKM
PrjfValidateFileIdentifier
WPP_RECORDER_SF_sD
WPP_RECORDER_SF_sDd|MicrosoftTelemetryAssertTriggeredNoArgsKM
PrjfValidateFileIdentifier
WPP_RECORDER_AND_TRACE_SF_sD
WPP_RECORDER_AND_TRACE_SF_sDD|
|calling|PrjfUpdatePlaceholderIfNeededHandler
PrjfWritePlaceholderInformationHandler|PrjfUpdatePlaceholderIfNeededHandler
PrjfWritePlaceholderInformationHandler|
|paramcount|3|3|
|`address`|1c00076e8|140009750|
|sig|int __fastcall PrjfValidatePlaceholderInformationMessage(uint * param_1, uint param_2, undefined8 * param_3)|int __fastcall PrjfValidatePlaceholderInformationMessage(uint * param_1, uint param_2, undefined8 * param_3)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfValidatePlaceholderInformationMessage Called Diff
```diff
--- PrjfValidatePlaceholderInformationMessage called
+++ PrjfValidatePlaceholderInformationMessage called
@@ -3,2 +3,2 @@
-WPP_RECORDER_SF_sD
-WPP_RECORDER_SF_sDd
+WPP_RECORDER_AND_TRACE_SF_sD
+WPP_RECORDER_AND_TRACE_SF_sDD
```
### PrjfValidatePlaceholderInformationMessage Diff
```diff
--- PrjfValidatePlaceholderInformationMessage
+++ PrjfValidatePlaceholderInformationMessage
@@ -1,221 +1,243 @@
int PrjfValidatePlaceholderInformationMessage(uint *param_1,uint param_2,undefined8 *param_3)
{
uint uVar1;
uint uVar2;
uint uVar3;
uint uVar4;
int iVar5;
- uint uVar6;
- undefined2 uVar7;
+ undefined8 uVar6;
+ uint uVar7;
+ ushort uVar8;
uVar1 = *param_1;
if (param_2 < uVar1) {
- iVar5 = -0x3ffffff3;
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) {
+ if (((DAT_0 & 0x40) == 0) &&
+ ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) {
return -0x3ffffff3;
}
- uVar7 = 0x84;
+ uVar8 = 0x86;
}
else if (uVar1 < 0x78) {
- iVar5 = -0x3ffffff3;
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) {
+ if (((DAT_0 & 0x40) == 0) &&
+ ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) {
return -0x3ffffff3;
}
- uVar7 = 0x85;
+ uVar8 = 0x87;
}
else {
uVar4 = param_1[0x16];
if (uVar4 < 0x78) {
- iVar5 = -0x3ffffff3;
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) {
+ if (((DAT_0 & 0x40) == 0) &&
+ ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) {
return -0x3ffffff3;
}
- uVar7 = 0x86;
+ uVar8 = 0x88;
}
else {
uVar2 = param_1[1];
if ((uVar2 & 0x18) == 0) {
- iVar5 = -0x3ffffff3;
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) {
+ if (((DAT_0 & 0x40) == 0) &&
+ ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) {
return -0x3ffffff3;
}
- uVar7 = 0x87;
+ uVar8 = 0x89;
}
else {
- uVar6 = (ushort)param_1[0x17] + uVar4;
- if (uVar6 < uVar4) {
+ uVar7 = uVar4 + (ushort)param_1[0x17];
+ if (uVar7 < uVar4) {
iVar5 = -0x3fffff6b;
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) {
+ if (((DAT_0 & 0x40) == 0) &&
+ ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) {
return -0x3fffff6b;
}
- uVar7 = 0x88;
- }
- else if (uVar1 < uVar6) {
- iVar5 = -0x3ffffff3;
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) {
+ uVar8 = 0x8a;
+ goto LAB_1;
+ }
+ if (uVar1 < uVar7) {
+ if (((DAT_0 & 0x40) == 0) &&
+ ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) {
return -0x3ffffff3;
}
- uVar7 = 0x89;
+ uVar8 = 0x8b;
}
else if ((uVar2 & 8) == 0) {
if ((uVar2 & 0x10) == 0) {
MicrosoftTelemetryAssertTriggeredNoArgsKM();
return 0;
}
uVar4 = param_1[0x18];
if (uVar4 < 0x78) {
- iVar5 = -0x3ffffff3;
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) {
+ if (((DAT_0 & 0x40) == 0) &&
+ ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) {
return -0x3ffffff3;
}
- uVar7 = 0x95;
+ uVar8 = 0x97;
}
else {
uVar2 = param_1[0x19];
- uVar6 = (ushort)uVar2 + uVar4;
- if (uVar6 < uVar4) {
+ uVar7 = uVar4 + (ushort)uVar2;
+ if (uVar7 < uVar4) {
iVar5 = -0x3fffff6b;
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) {
+ if (((DAT_0 & 0x40) == 0) &&
+ ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) {
return -0x3fffff6b;
}
- uVar7 = 0x96;
- }
- else {
- if (uVar6 <= uVar1) {
- *param_3 = (ushort *)((longlong)param_1 + (ulonglong)uVar4);
- iVar5 = PrjfValidateFileIdentifier
- ((ushort *)((longlong)param_1 + (ulonglong)uVar4),
- (uint)(ushort)uVar2);
- if (-1 < iVar5) {
- return iVar5;
- }
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) {
- return iVar5;
- }
- WPP_RECORDER_SF_sD(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0x98,
- &WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
+ uVar8 = 0x98;
+ goto LAB_1;
+ }
+ if (uVar7 <= uVar1) {
+ *param_3 = (ushort *)((longlong)param_1 + (ulonglong)uVar4);
+ uVar6 = PrjfValidateFileIdentifier
+ ((ushort *)((longlong)param_1 + (ulonglong)uVar4),
+ (uint)(ushort)uVar2);
+ iVar5 = (int)uVar6;
+ if (-1 < iVar5) {
return iVar5;
}
- iVar5 = -0x3ffffff3;
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) {
- return -0x3ffffff3;
- }
- uVar7 = 0x97;
- }
+ if (((DAT_0 & 0x40) == 0) &&
+ ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) {
+ return iVar5;
+ }
+ WPP_RECORDER_AND_TRACE_SF_sD
+ (0x20e,DAT_0 & 0x40,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0x9a,
+ &WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
+ return iVar5;
+ }
+ if (((DAT_0 & 0x40) == 0) &&
+ ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) {
+ return -0x3ffffff3;
+ }
+ uVar8 = 0x99;
}
}
else if ((uVar2 & 0x10) == 0) {
uVar4 = param_1[0x18];
if (uVar4 < 0x78) {
- iVar5 = -0x3ffffff3;
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) {
+ if (((DAT_0 & 0x40) == 0) &&
+ ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) {
return -0x3ffffff3;
}
- uVar7 = 0x8b;
+ uVar8 = 0x8d;
}
else {
uVar2 = param_1[0x19];
if (uVar2 < 0x150) {
- iVar5 = -0x3ffffff3;
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) {
+ if (((DAT_0 & 0x40) == 0) &&
+ ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) {
return -0x3ffffff3;
}
- uVar7 = 0x8c;
- }
- else if (uVar2 + uVar4 < uVar4) {
- iVar5 = -0x3fffff6b;
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) {
- return -0x3fffff6b;
- }
- uVar7 = 0x8d;
- }
- else if (uVar1 < uVar2 + uVar4) {
- iVar5 = -0x3ffffff3;
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) {
- return -0x3ffffff3;
- }
- uVar7 = 0x8e;
+ uVar8 = 0x8e;
}
else {
- uVar4 = param_1[0x1a];
- if (uVar4 == 0) {
- return 0;
- }
- uVar6 = (ushort)param_1[0x1c] + uVar4;
- if (uVar6 < uVar4) {
+ if (uVar4 + uVar2 < uVar4) {
iVar5 = -0x3fffff6b;
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) {
+ if (((DAT_0 & 0x40) == 0) &&
+ ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) {
return -0x3fffff6b;
}
- uVar7 = 0x8f;
- }
- else if (uVar1 < uVar6) {
- iVar5 = -0x3ffffff3;
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) {
+ uVar8 = 0x8f;
+ goto LAB_1;
+ }
+ if (uVar1 < uVar4 + uVar2) {
+ if (((DAT_0 & 0x40) == 0) &&
+ ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) {
return -0x3ffffff3;
}
- uVar7 = 0x90;
+ uVar8 = 0x90;
}
else {
- uVar3 = param_1[0x1b];
- uVar6 = *(ushort *)((longlong)param_1 + 0x72) + uVar3;
- if (uVar6 < uVar3) {
+ uVar4 = param_1[0x1a];
+ if (uVar4 == 0) {
+ return 0;
+ }
+ uVar7 = (ushort)param_1[0x1c] + uVar4;
+ if (uVar7 < uVar4) {
iVar5 = -0x3fffff6b;
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) {
+ if (((DAT_0 & 0x40) == 0) &&
+ ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) {
return -0x3fffff6b;
}
- uVar7 = 0x91;
- }
- else if (uVar1 < uVar6) {
- iVar5 = -0x3ffffff3;
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) {
+ uVar8 = 0x91;
+ goto LAB_1;
+ }
+ if (uVar1 < uVar7) {
+ if (((DAT_0 & 0x40) == 0) &&
+ ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) {
return -0x3ffffff3;
}
- uVar7 = 0x92;
+ uVar8 = 0x92;
}
else {
- iVar5 = (uint)*(ushort *)((longlong)param_1 + 0x72) + (uint)(ushort)param_1[0x1c];
- if (uVar3 <= uVar4) {
- uVar4 = uVar3;
- }
- if (uVar1 < uVar4 + iVar5) {
- iVar5 = -0x3ffffff3;
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) {
+ uVar3 = param_1[0x1b];
+ uVar7 = uVar3 + *(ushort *)((longlong)param_1 + 0x72);
+ if (uVar7 < uVar3) {
+ iVar5 = -0x3fffff6b;
+ if (((DAT_0 & 0x40) == 0) &&
+ ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) {
+ return -0x3fffff6b;
+ }
+ uVar8 = 0x93;
+ goto LAB_1;
+ }
+ if (uVar1 < uVar7) {
+ if (((DAT_0 & 0x40) == 0) &&
+ ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) {
return -0x3ffffff3;
}
- uVar7 = 0x93;
+ uVar8 = 0x94;
}
else {
- if (iVar5 + 0x78 + uVar2 + (ushort)param_1[0x17] <= uVar1) {
- return 0;
- }
- iVar5 = -0x3ffffff3;
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) {
- return -0x3ffffff3;
- }
- uVar7 = 0x94;
+ iVar5 = (uint)*(ushort *)((longlong)param_1 + 0x72) +
+ (uint)(ushort)param_1[0x1c];
+ if (uVar3 <= uVar4) {
+ uVar4 = uVar3;
+ }
+ if (uVar1 < uVar4 + iVar5) {
+ if (((DAT_0 & 0x40) == 0) &&
+ ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) {
+ return -0x3ffffff3;
+ }
+ uVar8 = 0x95;
+ }
+ else {
+ if (iVar5 + 0x78 + uVar2 + (uint)(ushort)param_1[0x17] <= uVar1) {
+ return 0;
+ }
+ if (((DAT_0 & 0x40) == 0) &&
+ ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) {
+ return -0x3ffffff3;
+ }
+ uVar8 = 0x96;
+ }
}
}
}
}
}
}
else {
- iVar5 = -0x3ffffff3;
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) {
+ if (((DAT_0 & 0x40) == 0) &&
+ ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) {
return -0x3ffffff3;
}
- uVar7 = 0x8a;
+ uVar8 = 0x8c;
}
}
}
}
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,uVar7,
- &WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
+ iVar5 = -0x3ffffff3;
+LAB_1:
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x20e,DAT_0 & 0x40,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,uVar8,
+ &WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
return iVar5;
}
```
## PrjfStoreNotificationMappingEntries
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,sig,address,called|
|ratio|0.35|
|i_ratio|0.23|
|m_ratio|0.89|
|b_ratio|0.85|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfStoreNotificationMappingEntries|PrjfStoreNotificationMappingEntries|
|fullname|PrjfStoreNotificationMappingEntries|PrjfStoreNotificationMappingEntries|
|refcount|2|2|
|`length`|635|818|
|`called`|MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExFreePoolWithTag
PrjfClearMappingTable
PrjfCreateMappingEntry
PrjfMappingInsert
PrjfValidateNotificationRoot
WPP_RECORDER_SF_sDd
WPP_RECORDER_SF_sDdD|Feature_4243261755__private_IsEnabledDeviceUsageNoInline
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExFreePoolWithTag
PrjfClearMappingTable
PrjfCreateMappingEntry
PrjfMappingInsert
PrjfValidateNotificationRoot
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDdD|
|calling|PrjfSetUnionContext|PrjfSetUnionContext|
|paramcount|3|3|
|`address`|1c0036430|1400460a4|
|`sig`|int __fastcall PrjfStoreNotificationMappingEntries(ushort * param_1, longlong * param_2, longlong param_3)|int __fastcall PrjfStoreNotificationMappingEntries(ushort * param_1, uint param_2, longlong param_3)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfStoreNotificationMappingEntries Called Diff
```diff
--- PrjfStoreNotificationMappingEntries called
+++ PrjfStoreNotificationMappingEntries called
@@ -0,0 +1 @@
+Feature_4243261755__private_IsEnabledDeviceUsageNoInline
@@ -7,2 +8,2 @@
-WPP_RECORDER_SF_sDd
-WPP_RECORDER_SF_sDdD
+WPP_RECORDER_AND_TRACE_SF_sDD
+WPP_RECORDER_AND_TRACE_SF_sDdD
```
### PrjfStoreNotificationMappingEntries Diff
```diff
--- PrjfStoreNotificationMappingEntries
+++ PrjfStoreNotificationMappingEntries
@@ -1,114 +1,133 @@
-int PrjfStoreNotificationMappingEntries(ushort *param_1,longlong *param_2,longlong param_3)
+int PrjfStoreNotificationMappingEntries(ushort *param_1,uint param_2,longlong param_3)
{
- ushort uVar1;
- bool bVar2;
- undefined8 uVar3;
+ bool bVar1;
+ undefined8 uVar2;
+ ulonglong uVar3;
ulonglong uVar4;
- ulonglong uVar5;
- uint uVar6;
- longlong *plVar7;
- undefined2 uVar8;
+ byte bVar5;
+ ulonglong uVar6;
+ ulonglong uVar7;
+ bool bVar8;
ushort *local_res8;
- int local_50;
+ undefined1 in_stack_ffffffffffffff88;
+ undefined7 in_stack_ffffffffffffff89;
+ ushort uVar9;
int local_48;
- longlong local_38 [2];
+ int local_40;
+ ulonglong local_38 [2];
- uVar5 = 0;
+ uVar6 = 0;
local_res8 = (ushort *)0x0;
- plVar7 = (longlong *)((ulonglong)param_2 & 0xffffffff);
- bVar2 = true;
+ bVar1 = true;
local_38[0] = 0;
local_38[1] = 0;
+ uVar7 = uVar6;
if (param_3 == 0) {
MicrosoftTelemetryAssertTriggeredNoArgsKM();
}
do {
- uVar6 = (uint)plVar7;
- if (uVar6 < 0x10) {
- local_48 = -0x3ffffff3;
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- local_48 = -0x3ffffff3;
- uVar8 = 10;
-LAB_0:
- WPP_RECORDER_SF_sDdD
- (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),param_2,0x14,uVar8,
- &WPP_5c05f7cae5513ff3734adbc0d3bd9537_Traceguids,
+ if (param_2 < 0x10) {
+ local_40 = -0x3ffffff3;
+ bVar8 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar5 = DAT_0 & 0x10;
+ if ((bVar5 != 0) || (bVar8)) {
+ local_40 = -0x3ffffff3;
+ uVar9 = 10;
+LAB_1:
+ WPP_RECORDER_AND_TRACE_SF_sDdD
+ (0x214,bVar5,bVar8,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),
+ CONCAT71(in_stack_ffffffffffffff89,in_stack_ffffffffffffff88),0x14,uVar9,
+ &WPP_0314efc3b1f93d76a134ccc0e69e0e16_Traceguids,
"onecore\\base\\fs\\gvflt\\filter\\sys\\mapping.c");
}
}
else {
- param_2 = plVar7;
- uVar3 = PrjfValidateNotificationRoot((longlong)param_1,plVar7,uVar5,&local_res8);
- local_48 = (int)uVar3;
- if (local_48 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- uVar8 = 0xb;
- goto LAB_0;
+ uVar2 = PrjfValidateNotificationRoot((longlong)param_1,param_2,uVar7,&local_res8);
+ local_40 = (int)uVar2;
+ if (local_40 < 0) {
+ bVar8 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar5 = DAT_0 & 0x10;
+ if ((bVar5 != 0) || (bVar8)) {
+ uVar9 = 0xb;
+ goto LAB_1;
}
}
else {
- param_2 = (longlong *)(ulonglong)*(uint *)(param_1 + 4);
- local_48 = PrjfCreateMappingEntry(local_res8,*(uint *)(param_1 + 4),local_38);
- if (local_48 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- param_2 = (longlong *)CONCAT71((int7)((ulonglong)param_2 >> 8),2);
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x14,0xc,
- &WPP_5c05f7cae5513ff3734adbc0d3bd9537_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\mapping.c");
+ local_40 = PrjfCreateMappingEntry(local_res8,*(uint *)(param_1 + 4),(longlong *)local_38);
+ if (local_40 < 0) {
+ if (((DAT_0 & 0x10) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ in_stack_ffffffffffffff88 = 2;
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x214,DAT_0 & 0x10,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x14,0xc,
+ &WPP_0314efc3b1f93d76a134ccc0e69e0e16_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\mapping.c");
}
}
else {
- param_2 = local_38;
- uVar4 = PrjfMappingInsert(param_3,param_2);
- local_48 = (int)uVar4;
- if (local_48 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- uVar8 = 0xd;
- local_50 = local_48;
-LAB_1:
- param_2 = (longlong *)CONCAT71((int7)((ulonglong)param_2 >> 8),2);
- WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x14,uVar8,
- &WPP_5c05f7cae5513ff3734adbc0d3bd9537_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\mapping.c");
- local_48 = local_50;
+ uVar3 = PrjfMappingInsert(param_3,(longlong *)local_38);
+ local_40 = (int)uVar3;
+ if (local_40 < 0) {
+ if (((DAT_0 & 0x10) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ uVar9 = 0xd;
+ local_48 = local_40;
+LAB_2:
+ in_stack_ffffffffffffff88 = 2;
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x214,DAT_0 & 0x10,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x14,uVar9,
+ &WPP_0314efc3b1f93d76a134ccc0e69e0e16_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\mapping.c");
+ local_40 = local_48;
}
}
else {
- uVar1 = *param_1;
- uVar5 = (ulonglong)((int)uVar5 + 1);
- if (uVar1 == 0) {
- bVar2 = false;
+ uVar9 = *param_1;
+ uVar7 = (ulonglong)((int)uVar7 + 1);
+ if (uVar9 == 0) {
+ bVar1 = false;
}
- else if (((uint)uVar1 < *(uint *)(param_1 + 2)) || (uVar6 < uVar1)) {
- local_48 = -0x3ffffff3;
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- local_50 = -0x3ffffff3;
- uVar8 = 0xe;
- goto LAB_1;
+ else if (((uint)uVar9 < *(uint *)(param_1 + 2)) || (param_2 < uVar9)) {
+ local_40 = -0x3ffffff3;
+ if (((DAT_0 & 0x10) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ local_48 = -0x3ffffff3;
+ uVar9 = 0xe;
+ goto LAB_2;
}
}
else {
- plVar7 = (longlong *)(ulonglong)(uVar6 - uVar1);
- param_1 = (ushort *)((longlong)param_1 + (ulonglong)uVar1);
- bVar2 = true;
- local_48 = 0;
+ param_2 = param_2 - uVar9;
+ param_1 = (ushort *)((longlong)param_1 + (ulonglong)uVar9);
+ bVar1 = true;
+ local_40 = 0;
}
}
+ uVar3 = local_38[0];
+ local_38[0] = uVar3;
if (local_38[0] != 0) {
- param_2 = (longlong *)0x6d6e4a50;
- ExFreePoolWithTag();
+ ExFreePoolWithTag(local_38[0],0x6d6e4a50);
+ uVar4 = Feature_4243261755__private_IsEnabledDeviceUsageNoInline();
+ local_38[0] = uVar3;
+ if ((int)uVar4 != 0) {
+ local_38[0] = uVar6;
+ }
}
}
}
}
- if ((!bVar2) || (local_48 < 0)) {
- if (local_48 < 0) {
+ if ((!bVar1) || (local_40 < 0)) {
+ if (local_40 < 0) {
PrjfClearMappingTable(param_3);
}
- return local_48;
+ return local_40;
}
} while( true );
}
```
## PrjfOpenFileHandler
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.08|
|i_ratio|0.08|
|m_ratio|0.89|
|b_ratio|0.35|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfOpenFileHandler|PrjfOpenFileHandler|
|fullname|PrjfOpenFileHandler|PrjfOpenFileHandler|
|refcount|2|2|
|`length`|2181|2752|
|`called`|Expand for full list:
FLTMGR.SYS::FltAcquireResourceExclusive
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltCreateFileEx
FLTMGR.SYS::FltReleaseResource
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExUuidCreate
NTOSKRNL.EXE::IoGetCurrentProcess
NTOSKRNL.EXE::KeDelayExecutionThread
NTOSKRNL.EXE::ObfReferenceObject
NTOSKRNL.EXE::RtlInsertElementGenericTableAvl
PrjfGetUnionContextByVirtualizationInstanceInfo
PrjfRelPathToFullPath
PrjfReleaseUnionContext
WPP_RECORDER_SF_sD
WPP_RECORDER_SF_sDd
WPP_RECORDER_SF_sDdD
WPP_RECORDER_SF_sDdZ
__security_check_cookieExpand for full list:
FLTMGR.SYS::FltAcquireResourceExclusive
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltCreateFileEx
FLTMGR.SYS::FltReleaseResource
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExUuidCreate
NTOSKRNL.EXE::IoGetCurrentProcess
NTOSKRNL.EXE::KeDelayExecutionThread
NTOSKRNL.EXE::ObfReferenceObject
NTOSKRNL.EXE::RtlInsertElementGenericTableAvl
PrjfGetUnionContextByVirtualizationInstanceInfo
PrjfRelPathToFullPath
PrjfReleaseUnionContext
WPP_RECORDER_AND_TRACE_SF_sD
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDdD
WPP_RECORDER_AND_TRACE_SF_sDdZ
__security_check_cookie
PrjfGetContextFileObjectEx
PrjfSynchronizeExpansionPreopWithReason
WPP_RECORDER_SF_sDZ|FLTMGR.SYS::FltReleaseContext
PrjfGetContextFileObjectEx
PrjfSynchronizeExpansionPreopWithReason
WPP_RECORDER_AND_TRACE_SF_sDZ|
|calling|||
|paramcount|3|3|
|`address`|1c0004d00|140006320|
|sig|ulonglong __fastcall PrjfPreWrite(uint * param_1, longlong param_2, longlong * param_3)|ulonglong __fastcall PrjfPreWrite(uint * param_1, longlong param_2, longlong * param_3)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfPreWrite Called Diff
```diff
--- PrjfPreWrite called
+++ PrjfPreWrite called
@@ -4 +4 @@
-WPP_RECORDER_SF_sDZ
+WPP_RECORDER_AND_TRACE_SF_sDZ
```
### PrjfPreWrite Diff
```diff
--- PrjfPreWrite
+++ PrjfPreWrite
@@ -1,77 +1,84 @@
ulonglong PrjfPreWrite(uint *param_1,longlong param_2,longlong *param_3)
{
longlong lVar1;
longlong lVar2;
int *piVar3;
char cVar4;
uint uVar5;
ulonglong uVar6;
ulonglong uVar7;
longlong local_res8;
longlong local_res20;
longlong *plVar8;
- undefined8 in_stack_ffffffffffffffa0;
- undefined4 in_stack_ffffffffffffffac;
+ undefined4 in_stack_ffffffffffffff80;
+ undefined4 in_stack_ffffffffffffff84;
+ undefined4 in_stack_ffffffffffffffa4;
int *local_48;
wchar_t local_40;
undefined1 auStack_3e [6];
longlong lStack_38;
local_res20 = 0;
local_48 = (int *)0x0;
local_res8 = 0;
_local_40 = 0;
lStack_38 = 0;
uVar7 = 1;
if (*(int *)(*(longlong *)(param_1 + 4) + 0x18) != 0) {
plVar8 = &local_res8;
cVar4 = PrjfGetContextFileObjectEx
(*(undefined8 *)(param_2 + 0x18),*(undefined8 *)(param_2 + 0x20),&local_res20,
(longlong *)&local_48,plVar8);
piVar3 = local_48;
lVar2 = local_res20;
if (((cVar4 != '\0') && (*local_48 == 0)) && ((**(uint **)(param_1 + 4) & 2) == 0)) {
if ((**(uint **)(param_1 + 4) & 1) != 0) {
uVar6 = PrjfSynchronizeExpansionPreopWithReason
- (param_1,param_2,3,1,plVar8,in_stack_ffffffffffffffa0,0x11,param_3);
+ (param_1,param_2,3,1,plVar8,
+ CONCAT44(in_stack_ffffffffffffff84,in_stack_ffffffffffffff80),0x11,
+ param_3);
uVar7 = uVar6 & 0xffffffff;
if ((((int)uVar6 == 2) && (lVar2 != 0)) && (*(int *)(lVar2 + 0x40) != 3)) {
lVar1 = *(longlong *)(lVar2 + 0x48);
lStack_38 = lVar1 + 0x122;
_local_40 = CONCAT62(CONCAT42(auStack_3e._2_4_,*(undefined2 *)(lVar1 + 0x120)),
*(undefined2 *)(lVar1 + 0x120));
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDZ(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),3,2,(short)uVar6 + 8,
- &WPP_e0f66f78cb02376c02d9fc0dec322fb4_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\readwrite.c",
- CONCAT44(in_stack_ffffffffffffffac,0xe2),&local_40);
+ if (((DAT_0 & 4) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDZ
+ (0x302,DAT_0 & 4,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),3,2,10,
+ &WPP_e0f66f78cb02376c02d9fc0dec322fb4_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\readwrite.c",
+ CONCAT44(in_stack_ffffffffffffffa4,0xe2),&local_40);
}
}
}
uVar5 = piVar3[10];
if (((((uVar5 >> 9 & 1) != 0) || ((uVar5 >> 0xb & 1) != 0)) || ((uVar5 >> 10 & 1) != 0)) &&
(local_res8 != 0)) {
*param_3 = local_res8;
local_res8 = 0;
uVar5 = 0;
if ((uint)uVar7 != 1) {
uVar5 = (uint)uVar7;
}
uVar7 = (ulonglong)uVar5;
}
}
if (lVar2 != 0) {
FltReleaseContext(lVar2);
}
if (piVar3 != (int *)0x0) {
FltReleaseContext(piVar3);
}
if (local_res8 != 0) {
FltReleaseContext();
}
}
return uVar7;
}
```
## PrjfGetSetContextFileObject
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.59|
|i_ratio|0.17|
|m_ratio|0.92|
|b_ratio|0.39|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfGetSetContextFileObject|PrjfGetSetContextFileObject|
|fullname|PrjfGetSetContextFileObject|PrjfGetSetContextFileObject|
|refcount|16|16|
|`length`|1135|1349|
|`called`|Expand for full list:
FLTMGR.SYS::FltDeleteFileContext
FLTMGR.SYS::FltDeleteStreamContext
FLTMGR.SYS::FltGetFileContext
FLTMGR.SYS::FltReleaseContext
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExFreePoolWithTag
PrjfGetPrjReparseData
PrjfGetSetFileContext
PrjfGetSetStreamContext
PrjfGetSetStreamHandleContext
WPP_RECORDER_SF_sDq
WPP_RECORDER_SF_sDqdExpand for full list:
FLTMGR.SYS::FltDeleteFileContext
FLTMGR.SYS::FltDeleteStreamContext
FLTMGR.SYS::FltGetFileContext
FLTMGR.SYS::FltReleaseContext
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExFreePoolWithTag
PrjfGetPrjReparseData
PrjfGetSetFileContext
PrjfGetSetStreamContext
PrjfGetSetStreamHandleContext
WPP_RECORDER_AND_TRACE_SF_sDq
WPP_RECORDER_AND_TRACE_SF_sDqdExpand for full list:
PrjfAddInMemoryTombstone
PrjfCreateRenameOrLinkCompletionContext
PrjfDecideUpdateDeleteOnFileStateAndUpdateFlags
PrjfDoesNameExistInLayer
PrjfIsDirectoryEmpty
PrjfNormalizeNameComponent
PrjfNotifyRenameOrLinkOperation
PrjfPostCreate
PrjfPreCleanup
PrjfPrepareSourceForRename
PrjfProcessOpenWithinVirtualizationRoots
PrjfProcessPostRenameOrLinkInformation
PrjfProcessPrjReparsePointBounce
PrjfSetDeleteDisposition
PrjfSetParentPlaceHolderFlagsSynchronizedExpand for full list:
PrjfAddInMemoryTombstone
PrjfCreateRenameOrLinkCompletionContext
PrjfDecideUpdateDeleteOnFileStateAndUpdateFlags
PrjfDoesNameExistInLayer
PrjfIsDirectoryEmpty
PrjfNormalizeNameComponent
PrjfNotifyRenameOrLinkOperation
PrjfPostCreate
PrjfPreCleanup
PrjfPrepareSourceForRename
PrjfProcessOpenWithinVirtualizationRoots
PrjfProcessPostRenameOrLinkInformation
PrjfProcessPrjReparsePointBounce
PrjfSetDeleteDisposition
PrjfSetParentPlaceHolderFlagsSynchronized
FLTMGR.SYS::FltCreateFileEx2
FLTMGR.SYS::FltReleaseContext
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ObfDereferenceObject
PrjfGetSetContextFileObject
PrjfOpenAsReparsePoint
WPP_RECORDER_SF_sDdDZ
WPP_RECORDER_SF_sDdZ
WPP_RECORDER_SF_sDdZd|FLTMGR.SYS::FltClose
FLTMGR.SYS::FltCreateFileEx2
FLTMGR.SYS::FltReleaseContext
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ObfDereferenceObject
PrjfGetSetContextFileObject
PrjfOpenAsReparsePoint
WPP_RECORDER_AND_TRACE_SF_sDdDZ
WPP_RECORDER_AND_TRACE_SF_sDdZ
WPP_RECORDER_AND_TRACE_SF_sDdZd|
|calling|PrjfDeleteFileHandler
PrjfUpdatePlaceholderIfNeededHandler|PrjfDeleteFileHandler
PrjfUpdatePlaceholderIfNeededHandler|
|paramcount|9|9|
|`address`|1c002c494|140039f2c|
|sig|int __fastcall PrjfDecideUpdateDeleteOnFileStateAndUpdateFlags(undefined8 param_1, uint param_2, wchar_t * param_3, longlong * param_4, longlong * param_5, undefined4 * param_6, byte * param_7, undefined8 * param_8, undefined1 * param_9)|int __fastcall PrjfDecideUpdateDeleteOnFileStateAndUpdateFlags(undefined8 param_1, uint param_2, wchar_t * param_3, longlong * param_4, longlong * param_5, undefined4 * param_6, byte * param_7, undefined8 * param_8, undefined1 * param_9)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfDecideUpdateDeleteOnFileStateAndUpdateFlags Called Diff
```diff
--- PrjfDecideUpdateDeleteOnFileStateAndUpdateFlags called
+++ PrjfDecideUpdateDeleteOnFileStateAndUpdateFlags called
@@ -8,3 +8,3 @@
-WPP_RECORDER_SF_sDdDZ
-WPP_RECORDER_SF_sDdZ
-WPP_RECORDER_SF_sDdZd
+WPP_RECORDER_AND_TRACE_SF_sDdDZ
+WPP_RECORDER_AND_TRACE_SF_sDdZ
+WPP_RECORDER_AND_TRACE_SF_sDdZd
```
### PrjfDecideUpdateDeleteOnFileStateAndUpdateFlags Diff
```diff
--- PrjfDecideUpdateDeleteOnFileStateAndUpdateFlags
+++ PrjfDecideUpdateDeleteOnFileStateAndUpdateFlags
@@ -1,252 +1,291 @@
/* WARNING: Type propagation algorithm not settling */
int PrjfDecideUpdateDeleteOnFileStateAndUpdateFlags
(undefined8 param_1,uint param_2,wchar_t *param_3,longlong *param_4,longlong *param_5,
undefined4 *param_6,byte *param_7,undefined8 *param_8,undefined1 *param_9)
{
undefined8 *puVar1;
- longlong lVar2;
int extraout_EAX;
- int iVar3;
- undefined8 *puVar4;
+ int iVar2;
+ undefined8 *puVar3;
+ byte bVar4;
longlong lVar5;
- undefined2 uVar6;
+ longlong lVar6;
longlong lVar7;
- undefined8 in_stack_fffffffffffffef8;
- longlong *plVar8;
- undefined8 uVar9;
- byte *pbVar11;
- undefined8 uVar12;
- wchar_t *pwVar14;
+ longlong lVar8;
+ bool bVar9;
+ undefined4 in_stack_fffffffffffffef8;
+ undefined4 in_stack_fffffffffffffefc;
+ ushort uVar10;
+ char *pcVar11;
+ byte *pbVar12;
+ undefined8 uVar13;
+ undefined4 uVar14;
+ undefined8 *******pppppppuVar15;
+ undefined8 uVar16;
+ undefined4 uVar17;
byte local_a8;
- byte local_a7;
- undefined1 local_a6 [6];
+ char local_a7;
+ byte local_a6;
+ byte local_a5 [5];
longlong local_a0;
longlong local_98;
longlong local_90;
uint local_88 [2];
longlong local_80 [3];
wchar_t *local_68;
undefined8 local_60;
undefined8 local_58;
undefined8 uStack_50;
undefined8 local_48;
undefined8 uStack_40;
- undefined4 uVar10;
- undefined4 uVar13;
+ lVar5 = 0;
*param_4 = 0;
local_a8 = 0;
- local_a7 = 0;
+ local_a7 = '\0';
*param_6 = 0;
lVar7 = 0;
local_90 = 0;
local_80[0] = 0;
local_98 = 0;
*param_5 = 0;
local_a0 = 0;
local_88[0] = 0x80000000;
*param_9 = 0;
- pwVar14 = (wchar_t *)(local_a6 + 1);
- pbVar11 = &local_a8;
- plVar8 = &local_a0;
+ pppppppuVar15 = (undefined8 *******)&local_a7;
+ pbVar12 = &local_a6;
+ pcVar11 = (char *)local_a5;
PrjfOpenAsReparsePoint
- (param_3,0,param_1,0x10180,in_stack_fffffffffffffef8,(longlong)&local_98,
- (longlong)plVar8,pbVar11,(byte *)pwVar14,(undefined8 *******)local_a6,&local_a7,
- local_88);
- uVar10 = (undefined4)((ulonglong)plVar8 >> 0x20);
- uVar13 = (undefined4)((ulonglong)pbVar11 >> 0x20);
- iVar3 = extraout_EAX;
+ (param_3,0,param_1,0x10180,CONCAT44(in_stack_fffffffffffffefc,in_stack_fffffffffffffef8)
+ ,(longlong)&local_98,(longlong)&local_a0,&local_a8,(byte *)pcVar11,pbVar12,
+ pppppppuVar15,local_88);
+ uVar14 = (undefined4)((ulonglong)pbVar12 >> 0x20);
+ uVar17 = (undefined4)((ulonglong)pppppppuVar15 >> 0x20);
+ iVar2 = extraout_EAX;
+ lVar8 = lVar7;
if (extraout_EAX < 0) {
if (extraout_EAX == -0x3ffffd7f) {
- iVar3 = -0x3fffffc6;
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDdZd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),4,0xe,0x9a);
- }
- goto LAB_0;
+ iVar2 = -0x3fffffc6;
+ if (((DAT_0 & 0x40) != 0) ||
+ (lVar8 = lVar5, (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDdZd
+ (0x40e,DAT_0 & 0x40,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),4,0xe,0x9c);
+ lVar8 = lVar7;
+ }
+ goto LAB_1;
}
if (extraout_EAX == -0x3ffffd87) {
- if ((local_a8 != 0) || (local_a7 != 0)) {
+ if ((local_a8 != 0) || (local_a7 != '\0')) {
MicrosoftTelemetryAssertTriggeredNoArgsKM();
}
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- pwVar14 = param_3;
- WPP_RECORDER_SF_sDdZ
- (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),3,0xe,0x9c,
- &WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",CONCAT44(uVar10,0x196e),
- CONCAT44(uVar13,0xc0000279),param_3);
- }
+ if (((DAT_2 & 0x40) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ uVar16 = CONCAT44(uVar17,0xc0000279);
+ uVar13 = CONCAT44(uVar14,0x19a5);
+ pcVar11 = "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c";
+ WPP_RECORDER_AND_TRACE_SF_sDdZ
+ (0x30e,DAT_2 & 0x40,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),3,0xe,0x9e,
+ &WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",uVar13,uVar16,param_3);
+ uVar14 = (undefined4)((ulonglong)uVar13 >> 0x20);
+ uVar17 = (undefined4)((ulonglong)uVar16 >> 0x20);
+ }
+ uVar16 = CONCAT44(uVar17,1);
+ uVar13 = CONCAT44(uVar14,3);
local_80[1] = 0x30;
- local_80[2] = 0;
local_60 = 0x240;
- uVar10 = 0;
- puVar4 = &local_48;
local_48 = 0;
uStack_40 = 0;
+ local_80[2] = 0;
local_58 = 0;
uStack_50 = 0;
local_68 = param_3;
- iVar3 = FltCreateFileEx2(Globals,param_1,&local_98,&local_a0,0x10180,local_80 + 1,puVar4,0,
- (ulonglong)pwVar14 & 0xffffffff00000000,3,1,0x200028,0,0,1,0);
- if (-1 < iVar3) goto LAB_1;
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0;
- uVar6 = 0x9d;
- uVar12 = CONCAT44(uVar10,iVar3);
- uVar9 = CONCAT44((int)((ulonglong)puVar4 >> 0x20),0x1992);
+ iVar2 = FltCreateFileEx2(Globals,param_1,&local_98,&local_a0,0x10180,local_80 + 1,&local_48,0,
+ (ulonglong)pcVar11 & 0xffffffff00000000,uVar13,uVar16,0x200028,0,0,1,
+ 0);
+ uVar14 = (undefined4)((ulonglong)uVar13 >> 0x20);
+ uVar17 = (undefined4)((ulonglong)uVar16 >> 0x20);
+ if (-1 < iVar2) goto LAB_3;
+ bVar9 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar4 = DAT_4 & 0x40;
+ if ((bVar4 == 0) && (!bVar9)) goto LAB_1;
+ uVar16 = CONCAT44(uVar17,iVar2);
+ uVar13 = CONCAT44(uVar14,0x19c9);
+ uVar10 = 0x9f;
}
else {
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0;
- uVar12 = CONCAT44(uVar13,extraout_EAX);
- uVar9 = CONCAT44(uVar10,0x195c);
- uVar6 = 0x9b;
- iVar3 = extraout_EAX;
- }
-LAB_2:
- WPP_RECORDER_SF_sDdZ
- (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,uVar6,
- &WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",uVar9,uVar12,param_3);
+ bVar9 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar4 = DAT_4 & 0x40;
+ if ((bVar4 == 0) && (!bVar9)) goto LAB_1;
+ uVar16 = CONCAT44(uVar17,extraout_EAX);
+ uVar13 = CONCAT44(uVar14,0x1993);
+ uVar10 = 0x9d;
+ lVar7 = lVar5;
+ iVar2 = extraout_EAX;
+ }
+LAB_5:
+ WPP_RECORDER_AND_TRACE_SF_sDdZ
+ (0x20e,bVar4,bVar9,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,uVar10,
+ &WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",uVar13,uVar16,param_3);
+ lVar8 = lVar7;
}
else {
-LAB_1:
+LAB_3:
if (local_a8 == 0) {
- if (local_a7 == 0) {
+ if (local_a7 == '\0') {
if ((param_2 & 2) == 0) {
- iVar3 = -0x3fff31fb;
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDdDZ
- (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),3,0xe,0xa2,
- &WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,
+ iVar2 = -0x3fff31fb;
+ if (((DAT_2 & 0x40) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDdDZ
+ (0x30e,DAT_2 & 0x40,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),3,0xe,0xa4,
+ &WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
"onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
}
*param_6 = 2;
- lVar7 = 0;
- goto LAB_0;
+ goto LAB_1;
}
}
else {
if ((param_2 & 4) == 0) {
- iVar3 = -0x3fff31fb;
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDdDZ
- (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),3,0xe,0xa1,
- &WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,
+ iVar2 = -0x3fff31fb;
+ if (((DAT_2 & 0x40) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDdDZ
+ (0x30e,DAT_2 & 0x40,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),3,0xe,0xa3,
+ &WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
"onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
}
*param_6 = 4;
- lVar7 = 0;
- goto LAB_0;
+ goto LAB_1;
}
*param_9 = 1;
+ lVar7 = lVar5;
}
}
else {
- plVar8 = &local_90;
- uVar10 = 0;
- iVar3 = PrjfGetSetContextFileObject
+ iVar2 = PrjfGetSetContextFileObject
(param_1,local_a0,-0x80000000,'\0','\0',(undefined4 *)0x0,(undefined2 *)0x0,
- plVar8,local_80);
+ &local_90,local_80);
lVar7 = local_90;
- uVar13 = (undefined4)((ulonglong)plVar8 >> 0x20);
- if (iVar3 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDdZ
- (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0x9e,
- &WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",CONCAT44(uVar10,0x19bc),
- CONCAT44(uVar13,iVar3),param_3);
- lVar7 = local_90;
- }
- goto LAB_0;
+ lVar8 = lVar7;
+ if (iVar2 < 0) {
+ if (((DAT_4 & 0x40) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDdZ
+ (0x20e,DAT_4 & 0x40,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0xa0,
+ &WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",CONCAT44(uVar14,0x19f3),
+ CONCAT44(uVar17,iVar2),param_3);
+ lVar8 = local_90;
+ }
+ goto LAB_1;
}
if ((local_90 == 0) || (*(int *)(local_90 + 0x40) == 3)) {
MicrosoftTelemetryAssertTriggeredNoArgsKM();
}
- lVar2 = *(longlong *)(lVar7 + 0x48);
- if (lVar2 == 0) {
- iVar3 = -0x3fffffde;
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0;
- uVar6 = 0x9f;
- uVar12 = CONCAT44(uVar13,0xc0000022);
- uVar9 = CONCAT44(uVar10,0x19d0);
- iVar3 = -0x3fffffde;
- goto LAB_2;
- }
- lVar5 = 2;
- if (((*(uint *)(lVar2 + 0xc) & 2) != 0) && ((param_2 & 1) == 0)) {
- iVar3 = -0x3fff31fb;
- if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) {
- WPP_RECORDER_SF_sDdDZ
- (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),3,0xe,0xa0,
- &WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,
+ lVar5 = *(longlong *)(lVar7 + 0x48);
+ if (lVar5 == 0) {
+ iVar2 = -0x3fffffde;
+ bVar9 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar4 = DAT_4 & 0x40;
+ if ((bVar4 == 0) && (!bVar9)) goto LAB_1;
+ uVar16 = CONCAT44(uVar17,0xc0000022);
+ uVar13 = CONCAT44(uVar14,0x1a07);
+ uVar10 = 0xa1;
+ iVar2 = -0x3fffffde;
+ goto LAB_5;
+ }
+ lVar6 = 2;
+ if (((*(uint *)(lVar5 + 0xc) & 2) != 0) && ((param_2 & 1) == 0)) {
+ iVar2 = -0x3fff31fb;
+ if (((DAT_2 & 0x40) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDdDZ
+ (0x30e,DAT_2 & 0x40,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),3,0xe,0xa2,
+ &WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
"onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
}
*param_6 = 1;
- goto LAB_0;
+ goto LAB_1;
}
if (param_8 != (undefined8 *)0x0) {
- puVar4 = (undefined8 *)(lVar2 + 0x20);
+ puVar3 = (undefined8 *)(lVar5 + 0x20);
do {
- uVar9 = puVar4[1];
- *param_8 = *puVar4;
- param_8[1] = uVar9;
- uVar9 = puVar4[3];
- param_8[2] = puVar4[2];
- param_8[3] = uVar9;
- uVar9 = puVar4[5];
- param_8[4] = puVar4[4];
- param_8[5] = uVar9;
- uVar9 = puVar4[7];
- param_8[6] = puVar4[6];
- param_8[7] = uVar9;
- uVar9 = puVar4[9];
- param_8[8] = puVar4[8];
- param_8[9] = uVar9;
- uVar9 = puVar4[0xb];
- param_8[10] = puVar4[10];
- param_8[0xb] = uVar9;
- uVar9 = puVar4[0xd];
- param_8[0xc] = puVar4[0xc];
- param_8[0xd] = uVar9;
- puVar1 = puVar4 + 0xe;
- uVar9 = puVar4[0xf];
- puVar4 = puVar4 + 0x10;
+ uVar13 = puVar3[1];
+ *param_8 = *puVar3;
+ param_8[1] = uVar13;
+ uVar13 = puVar3[3];
+ param_8[2] = puVar3[2];
+ param_8[3] = uVar13;
+ uVar13 = puVar3[5];
+ param_8[4] = puVar3[4];
+ param_8[5] = uVar13;
+ uVar13 = puVar3[7];
+ param_8[6] = puVar3[6];
+ param_8[7] = uVar13;
+ uVar13 = puVar3[9];
+ param_8[8] = puVar3[8];
+ param_8[9] = uVar13;
+ uVar13 = puVar3[0xb];
+ param_8[10] = puVar3[10];
+ param_8[0xb] = uVar13;
+ uVar13 = puVar3[0xd];
+ param_8[0xc] = puVar3[0xc];
+ param_8[0xd] = uVar13;
+ puVar1 = puVar3 + 0xe;
+ uVar13 = puVar3[0xf];
+ puVar3 = puVar3 + 0x10;
param_8[0xe] = *puVar1;
- param_8[0xf] = uVar9;
- lVar5 = lVar5 + -1;
+ param_8[0xf] = uVar13;
+ lVar6 = lVar6 + -1;
param_8 = param_8 + 0x10;
- } while (lVar5 != 0);
+ } while (lVar6 != 0);
}
}
lVar5 = local_98;
- lVar2 = local_a0;
+ lVar8 = local_a0;
if (param_7 != (byte *)0x0) {
*param_7 = local_a8;
}
local_98 = 0;
*param_4 = lVar5;
local_a0 = 0;
- *param_5 = lVar2;
- }
-LAB_0:
+ *param_5 = lVar8;
+ lVar8 = lVar7;
+ }
+LAB_1:
if (local_98 != 0) {
FltClose();
}
if (local_a0 != 0) {
ObfDereferenceObject();
}
- if (lVar7 != 0) {
- FltReleaseContext(lVar7);
+ if (lVar8 != 0) {
+ FltReleaseContext(lVar8);
}
if (local_80[0] != 0) {
FltReleaseContext();
}
- if (iVar3 == -0x3ffffd87) {
+ if (iVar2 == -0x3ffffd87) {
MicrosoftTelemetryAssertTriggeredNoArgsKM();
}
- return iVar3;
+ return iVar2;
}
```
## PrjfSendStartDirectoryEnumerationCommand
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.57|
|i_ratio|0.3|
|m_ratio|0.92|
|b_ratio|0.88|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|name|PrjfSendStartDirectoryEnumerationCommand|PrjfSendStartDirectoryEnumerationCommand|
|fullname|PrjfSendStartDirectoryEnumerationCommand|PrjfSendStartDirectoryEnumerationCommand|
|refcount|3|3|
|`length`|381|456|
|`called`|PrjfFreeCommandBuffer
PrjfPrepareCommandForFileObject
PrjfSendCommand
WPP_RECORDER_SF_sDdZ
memset|PrjfFreeCommandBuffer
PrjfPrepareCommandForFileObject
PrjfSendCommand
WPP_RECORDER_AND_TRACE_SF_sDdZ
memset|
|calling|PrjfDoesNameExistInLayer
PrjfEnumerateLayeredDirectories|PrjfDoesNameExistInLayer
PrjfEnumerateLayeredDirectories|
|paramcount|4|4|
|`address`|1c0028740|140035828|
|sig|ulonglong __fastcall PrjfSendStartDirectoryEnumerationCommand(longlong param_1, undefined8 param_2, longlong param_3, undefined8 * param_4)|ulonglong __fastcall PrjfSendStartDirectoryEnumerationCommand(longlong param_1, undefined8 param_2, longlong param_3, undefined8 * param_4)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfSendStartDirectoryEnumerationCommand Called Diff
```diff
--- PrjfSendStartDirectoryEnumerationCommand called
+++ PrjfSendStartDirectoryEnumerationCommand called
@@ -4 +4 @@
-WPP_RECORDER_SF_sDdZ
+WPP_RECORDER_AND_TRACE_SF_sDdZ
```
### PrjfSendStartDirectoryEnumerationCommand Diff
```diff
--- PrjfSendStartDirectoryEnumerationCommand
+++ PrjfSendStartDirectoryEnumerationCommand
@@ -1,60 +1,64 @@
/* WARNING: Type propagation algorithm not settling */
ulonglong PrjfSendStartDirectoryEnumerationCommand
(longlong param_1,undefined8 param_2,longlong param_3,undefined8 *param_4)
{
uint uVar1;
ulonglong uVar2;
- undefined2 uVar3;
+ byte bVar3;
+ bool bVar4;
uint local_res20 [2];
- undefined8 in_stack_fffffffffffffd88;
- uint *puVar4;
- undefined8 uVar5;
+ undefined8 in_stack_fffffffffffffd78;
+ ushort uVar5;
+ undefined4 uVar6;
undefined4 in_stack_fffffffffffffda4;
+ undefined4 in_stack_fffffffffffffdac;
uint *local_248;
int local_240 [2];
undefined8 local_238;
undefined8 uStack_230;
- undefined4 uVar6;
local_248 = (uint *)0x0;
memset(&local_238,0,0x220);
local_238 = *param_4;
uStack_230 = param_4[1];
- puVar4 = local_res20;
local_res20[0] = 0;
local_240[1] = 0;
local_240[0] = 4;
uVar2 = PrjfPrepareCommandForFileObject
- (param_2,param_3,1,&local_238,in_stack_fffffffffffffd88,(longlong *)&local_248,
- puVar4);
- uVar6 = (undefined4)((ulonglong)puVar4 >> 0x20);
+ (param_2,param_3,1,&local_238,in_stack_fffffffffffffd78,(longlong *)&local_248,
+ local_res20);
uVar1 = (uint)uVar2;
uVar2 = uVar2 & 0xffffffff;
if ((int)uVar1 < 0) {
- if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0;
- uVar3 = 0x93;
- uVar5 = CONCAT44(uVar6,0x1183);
+ bVar4 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar3 = DAT_0 & 0x40;
+ if ((bVar3 == 0) && (!bVar4)) goto LAB_1;
+ uVar6 = 0x12b8;
+ uVar5 = 0xa5;
}
else {
uVar1 = PrjfSendCommand(param_1,param_2,local_248,0,(longlong)(local_240 + 1),local_240);
uVar2 = (ulonglong)uVar1;
- if ((-1 < (int)uVar1) || ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED))
- goto LAB_0;
- uVar3 = 0x94;
- uVar5 = CONCAT44(uVar6,0x1194);
+ if (-1 < (int)uVar1) goto LAB_1;
+ bVar4 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar3 = DAT_0 & 0x40;
+ if ((bVar3 == 0) && (!bVar4)) goto LAB_1;
+ uVar6 = 0x12c9;
+ uVar5 = 0xa6;
}
- WPP_RECORDER_SF_sDdZ
- (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,uVar3,
- &WPP_3ccab5108a9538d17a865fde27ef339f_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c",uVar5,
- CONCAT44(in_stack_fffffffffffffda4,uVar1),(wchar_t *)(param_3 + 0x58));
-LAB_0:
+ WPP_RECORDER_AND_TRACE_SF_sDdZ
+ (0x20e,bVar3,bVar4,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,uVar5,
+ &WPP_39279db927ae337b8503ecc20725ff46_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c",
+ CONCAT44(in_stack_fffffffffffffda4,uVar6),CONCAT44(in_stack_fffffffffffffdac,uVar1),
+ (wchar_t *)(param_3 + 0x58));
+LAB_1:
if (local_248 != (uint *)0x0) {
PrjfFreeCommandBuffer((longlong)local_248,local_res20[0]);
}
return uVar2;
}
```
## WPP_RECORDER_SF_sDdZssss
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,name,fullname,length,sig,address|
|ratio|0.15|
|i_ratio|0.33|
|m_ratio|0.99|
|b_ratio|0.63|
|match_types|BSIM|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|`name`|WPP_RECORDER_SF_sDdZssss|WPP_RECORDER_AND_TRACE_SF_sDdZssss|
|`fullname`|WPP_RECORDER_SF_sDdZssss|WPP_RECORDER_AND_TRACE_SF_sDdZssss|
|refcount|2|2|
|`length`|936|967|
|called|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|
|calling|PrjfOpenAsReparsePoint|PrjfOpenAsReparsePoint|
|paramcount|1|4|
|`address`|1c003d534|14001372c|
|`sig`|undefined __fastcall WPP_RECORDER_SF_sDdZssss(undefined8 param_1)|undefined __fastcall WPP_RECORDER_AND_TRACE_SF_sDdZssss(undefined8 param_1, char param_2, char param_3, undefined8 param_4)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### WPP_RECORDER_SF_sDdZssss Diff
```diff
--- WPP_RECORDER_SF_sDdZssss
+++ WPP_RECORDER_AND_TRACE_SF_sDdZssss
@@ -1,122 +1,116 @@
-void WPP_RECORDER_SF_sDdZssss(undefined8 param_1)
+void WPP_RECORDER_AND_TRACE_SF_sDdZssss
+ (undefined8 param_1,char param_2,char param_3,undefined8 param_4)
{
- char *pcVar1;
+ longlong lVar1;
longlong lVar2;
longlong lVar3;
longlong lVar4;
longlong lVar5;
- longlong lVar6;
+ wchar_t wVar6;
wchar_t *pwVar7;
- wchar_t wVar8;
- wchar_t *pwVar9;
- char *pcVar10;
- wchar_t *in_stack_00000048;
- char *in_stack_00000050;
- char *in_stack_00000058;
- char *in_stack_00000060;
+ wchar_t *pwStack0000000000000040;
+ wchar_t *in_stack_00000060;
char *in_stack_00000068;
- undefined4 local_38 [4];
+ char *in_stack_00000070;
+ char *in_stack_00000078;
+ char *in_stack_00000080;
+ undefined4 local_48 [4];
- pcVar10 = in_stack_00000050;
- pwVar7 = in_stack_00000048;
- local_38[0] = 0x834;
- in_stack_00000048 = L"\b";
- if (((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x200) != 0) && (1 < (byte)WPP_GLOBAL_Control[0x29]))
- {
+ local_48[0] = 0x853;
+ pwStack0000000000000040 = L"\b";
+ if (param_2 != '\0') {
+ if (in_stack_00000080 != (char *)0x0) {
+ lVar5 = -1;
+ do {
+ lVar5 = lVar5 + 1;
+ } while (in_stack_00000080[lVar5] != '\0');
+ }
+ if (in_stack_00000078 != (char *)0x0) {
+ lVar5 = -1;
+ do {
+ lVar5 = lVar5 + 1;
+ } while (in_stack_00000078[lVar5] != '\0');
+ }
+ if (in_stack_00000070 != (char *)0x0) {
+ lVar5 = -1;
+ do {
+ lVar5 = lVar5 + 1;
+ } while (in_stack_00000070[lVar5] != '\0');
+ }
if (in_stack_00000068 != (char *)0x0) {
- lVar6 = -1;
+ lVar5 = -1;
do {
- lVar6 = lVar6 + 1;
- } while (in_stack_00000068[lVar6] != '\0');
+ lVar5 = lVar5 + 1;
+ } while (in_stack_00000068[lVar5] != '\0');
}
- pcVar1 = in_stack_00000068;
- if (in_stack_00000068 == (char *)0x0) {
- pcVar1 = "NULL";
- }
- if (in_stack_00000060 != (char *)0x0) {
- lVar6 = -1;
- do {
- lVar6 = lVar6 + 1;
- } while (in_stack_00000060[lVar6] != '\0');
- }
- if (in_stack_00000058 != (char *)0x0) {
- lVar6 = -1;
- do {
- lVar6 = lVar6 + 1;
- } while (in_stack_00000058[lVar6] != '\0');
- }
- if (in_stack_00000050 != (char *)0x0) {
- lVar6 = -1;
- do {
- lVar6 = lVar6 + 1;
- } while (in_stack_00000050[lVar6] != '\0');
- }
- in_stack_00000050 = pcVar1;
- FastWppTraceMessage(&WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,0x34,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",0x29);
+ FastWppTraceMessage(0x20a,0x35,&WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
}
lVar5 = 5;
- wVar8 = L'\b';
- pwVar9 = L"NULL";
- lVar6 = lVar5;
- if (in_stack_00000068 != (char *)0x0) {
- lVar6 = -1;
- do {
- lVar3 = lVar6;
- lVar6 = lVar3 + 1;
- } while (in_stack_00000068[lVar6] != '\0');
- lVar6 = lVar3 + 2;
+ wVar6 = L'\b';
+ pwVar7 = L"NULL";
+ if (param_3 != '\0') {
+ lVar3 = lVar5;
+ if (in_stack_00000080 != (char *)0x0) {
+ lVar3 = -1;
+ do {
+ lVar2 = lVar3;
+ lVar3 = lVar2 + 1;
+ } while (in_stack_00000080[lVar3] != '\0');
+ lVar3 = lVar2 + 2;
+ }
+ if (in_stack_00000080 == (char *)0x0) {
+ in_stack_00000080 = "NULL";
+ }
+ lVar2 = lVar5;
+ if (in_stack_00000078 != (char *)0x0) {
+ lVar2 = -1;
+ do {
+ lVar1 = lVar2;
+ lVar2 = lVar1 + 1;
+ } while (in_stack_00000078[lVar2] != '\0');
+ lVar2 = lVar1 + 2;
+ }
+ if (in_stack_00000078 == (char *)0x0) {
+ in_stack_00000078 = "NULL";
+ }
+ lVar1 = lVar5;
+ if (in_stack_00000070 != (char *)0x0) {
+ lVar1 = -1;
+ do {
+ lVar4 = lVar1;
+ lVar1 = lVar4 + 1;
+ } while (in_stack_00000070[lVar1] != '\0');
+ lVar1 = lVar4 + 2;
+ }
+ if (in_stack_00000070 == (char *)0x0) {
+ in_stack_00000070 = "NULL";
+ }
+ lVar4 = -1;
+ if (in_stack_00000068 != (char *)0x0) {
+ do {
+ lVar5 = lVar4;
+ lVar4 = lVar5 + 1;
+ } while (in_stack_00000068[lVar4] != '\0');
+ lVar5 = lVar5 + 2;
+ }
+ if (in_stack_00000068 == (char *)0x0) {
+ in_stack_00000068 = "NULL";
+ }
+ if ((in_stack_00000060 != (wchar_t *)0x0) &&
+ (wVar6 = *in_stack_00000060, *in_stack_00000060 != L'\0')) {
+ pwVar7 = *(wchar_t **)(in_stack_00000060 + 4);
+ }
+ if (in_stack_00000060 == (wchar_t *)0x0) {
+ in_stack_00000060 = L"\b";
+ }
+ WppAutoLogTrace(param_4,2,10,&WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,0x35,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",0x29,local_48,4,
+ &stack0x00000058,4,in_stack_00000060,2,pwVar7,wVar6,in_stack_00000068,lVar5,
+ in_stack_00000070,lVar1,in_stack_00000078,lVar2,in_stack_00000080,lVar3,0);
}
- if (in_stack_00000068 == (char *)0x0) {
- in_stack_00000068 = "NULL";
- }
- lVar3 = lVar5;
- if (in_stack_00000060 != (char *)0x0) {
- lVar3 = -1;
- do {
- lVar2 = lVar3;
- lVar3 = lVar2 + 1;
- } while (in_stack_00000060[lVar3] != '\0');
- lVar3 = lVar2 + 2;
- }
- if (in_stack_00000060 == (char *)0x0) {
- in_stack_00000060 = "NULL";
- }
- lVar2 = lVar5;
- if (in_stack_00000058 != (char *)0x0) {
- lVar2 = -1;
- do {
- lVar4 = lVar2;
- lVar2 = lVar4 + 1;
- } while (in_stack_00000058[lVar2] != '\0');
- lVar2 = lVar4 + 2;
- }
- if (in_stack_00000058 == (char *)0x0) {
- in_stack_00000058 = "NULL";
- }
- lVar4 = -1;
- if (pcVar10 != (char *)0x0) {
- do {
- lVar5 = lVar4;
- lVar4 = lVar5 + 1;
- } while (pcVar10[lVar4] != '\0');
- lVar5 = lVar5 + 2;
- }
- if (pcVar10 == (char *)0x0) {
- pcVar10 = "NULL";
- }
- if ((pwVar7 != (wchar_t *)0x0) && (wVar8 = *pwVar7, *pwVar7 != L'\0')) {
- pwVar9 = *(wchar_t **)(pwVar7 + 4);
- }
- if (pwVar7 == (wchar_t *)0x0) {
- pwVar7 = L"\b";
- }
- WppAutoLogTrace(param_1,2,10,&WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,0x34,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",0x29,local_38,4,&stack0x00000040,
- 4,pwVar7,2,pwVar9,wVar8,pcVar10,lVar5,in_stack_00000058,lVar2,in_stack_00000060,
- lVar3,in_stack_00000068,lVar6,0);
return;
}
```
## WPP_RECORDER_SF_sDdsZ
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,name,fullname,length,sig,address|
|ratio|0.34|
|i_ratio|0.4|
|m_ratio|0.98|
|b_ratio|0.9|
|match_types|StringsRefsHasher|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|`name`|WPP_RECORDER_SF_sDdsZ|WPP_RECORDER_AND_TRACE_SF_sDdsZ|
|`fullname`|WPP_RECORDER_SF_sDdsZ|WPP_RECORDER_AND_TRACE_SF_sDdsZ|
|refcount|2|2|
|`length`|568|565|
|called|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|
|calling|PrjfProcessTombstoneBounce|PrjfProcessTombstoneBounce|
|paramcount|1|4|
|`address`|1c003e16c|140014658|
|`sig`|undefined __fastcall WPP_RECORDER_SF_sDdsZ(undefined8 param_1)|undefined __fastcall WPP_RECORDER_AND_TRACE_SF_sDdsZ(undefined8 param_1, char param_2, char param_3, undefined8 param_4)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### WPP_RECORDER_SF_sDdsZ Diff
```diff
--- WPP_RECORDER_SF_sDdsZ
+++ WPP_RECORDER_AND_TRACE_SF_sDdsZ
@@ -1,53 +1,55 @@
-void WPP_RECORDER_SF_sDdsZ(undefined8 param_1)
+void WPP_RECORDER_AND_TRACE_SF_sDdsZ
+ (undefined8 param_1,char param_2,char param_3,undefined8 param_4)
{
longlong lVar1;
wchar_t wVar2;
longlong lVar3;
wchar_t *pwVar4;
- char *in_stack_00000048;
- wchar_t *in_stack_00000050;
- undefined4 local_28 [4];
+ char *in_stack_00000060;
+ wchar_t *in_stack_00000068;
+ undefined4 local_38 [4];
pwVar4 = L"NULL";
- local_28[0] = 0x4d9;
wVar2 = L'\b';
- if (((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x40000) != 0) &&
- (1 < (byte)WPP_GLOBAL_Control[0x29])) {
- if (in_stack_00000048 != (char *)0x0) {
+ local_38[0] = 0x4d9;
+ if (param_2 != '\0') {
+ if (in_stack_00000060 != (char *)0x0) {
lVar1 = -1;
do {
lVar1 = lVar1 + 1;
- } while (in_stack_00000048[lVar1] != '\0');
+ } while (in_stack_00000060[lVar1] != '\0');
}
- FastWppTraceMessage(&WPP_4079bacae6ce31fd7110e995a8b7a7c9_Traceguids,0x1b,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\tombstone.c",0x2d);
+ FastWppTraceMessage(0x213,0x1b,&WPP_4079bacae6ce31fd7110e995a8b7a7c9_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\tombstone.c");
}
- if ((in_stack_00000050 != (wchar_t *)0x0) &&
- (wVar2 = *in_stack_00000050, *in_stack_00000050 != L'\0')) {
- pwVar4 = *(wchar_t **)(in_stack_00000050 + 4);
+ if (param_3 != '\0') {
+ if ((in_stack_00000068 != (wchar_t *)0x0) &&
+ (wVar2 = *in_stack_00000068, *in_stack_00000068 != L'\0')) {
+ pwVar4 = *(wchar_t **)(in_stack_00000068 + 4);
+ }
+ if (in_stack_00000068 == (wchar_t *)0x0) {
+ in_stack_00000068 = L"\b";
+ }
+ lVar1 = -1;
+ if (in_stack_00000060 == (char *)0x0) {
+ lVar3 = 5;
+ }
+ else {
+ do {
+ lVar3 = lVar1;
+ lVar1 = lVar3 + 1;
+ } while (in_stack_00000060[lVar1] != '\0');
+ lVar3 = lVar3 + 2;
+ }
+ if (in_stack_00000060 == (char *)0x0) {
+ in_stack_00000060 = "NULL";
+ }
+ WppAutoLogTrace(param_4,2,0x13,&WPP_4079bacae6ce31fd7110e995a8b7a7c9_Traceguids,0x1b,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\tombstone.c",0x2d,local_38,4,
+ &stack0x00000058,4,in_stack_00000060,lVar3,in_stack_00000068,2,pwVar4,wVar2,0);
}
- if (in_stack_00000050 == (wchar_t *)0x0) {
- in_stack_00000050 = L"\b";
- }
- lVar1 = -1;
- if (in_stack_00000048 == (char *)0x0) {
- lVar3 = 5;
- }
- else {
- do {
- lVar3 = lVar1;
- lVar1 = lVar3 + 1;
- } while (in_stack_00000048[lVar1] != '\0');
- lVar3 = lVar3 + 2;
- }
- if (in_stack_00000048 == (char *)0x0) {
- in_stack_00000048 = "NULL";
- }
- WppAutoLogTrace(param_1,2,0x13,&WPP_4079bacae6ce31fd7110e995a8b7a7c9_Traceguids,0x1b,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\tombstone.c",0x2d,local_28,4,
- &stack0x00000040,4,in_stack_00000048,lVar3,in_stack_00000050,2,pwVar4,wVar2,0);
return;
}
```
## WPP_RECORDER_SF_sDdZZ
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,name,fullname,length,sig,address|
|ratio|0.31|
|i_ratio|0.33|
|m_ratio|0.95|
|b_ratio|0.86|
|match_types|StringsRefsHasher|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|`name`|WPP_RECORDER_SF_sDdZZ|WPP_RECORDER_AND_TRACE_SF_sDdZZ|
|`fullname`|WPP_RECORDER_SF_sDdZZ|WPP_RECORDER_AND_TRACE_SF_sDdZZ|
|refcount|6|6|
|`length`|770|694|
|called|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|
|calling|PrjfFsctlSetReparsePoint
PrjfLookupEntryBackingLayerNegativePathCache
PrjfNormalizeNameComponent
PrjfReopenFile|PrjfFsctlSetReparsePoint
PrjfLookupEntryBackingLayerNegativePathCache
PrjfNormalizeNameComponent
PrjfReopenFile|
|paramcount|10|13|
|`address`|1c003a9f8|1400108fc|
|`sig`|undefined __fastcall WPP_RECORDER_SF_sDdZZ(undefined8 param_1, byte param_2, uint param_3, undefined2 param_4, undefined8 param_5, char * param_6, undefined8 param_7, undefined8 param_8, wchar_t * param_9, char * param_10)|undefined __fastcall WPP_RECORDER_AND_TRACE_SF_sDdZZ(undefined2 param_1, char param_2, char param_3, undefined8 param_4, undefined1 param_5, undefined4 param_6, ushort param_7, undefined8 param_8, char * param_9, undefined8 param_10, undefined8 param_11, wchar_t * param_12, wchar_t * param_13)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### WPP_RECORDER_SF_sDdZZ Diff
```diff
--- WPP_RECORDER_SF_sDdZZ
+++ WPP_RECORDER_AND_TRACE_SF_sDdZZ
@@ -1,78 +1,77 @@
-void WPP_RECORDER_SF_sDdZZ
- (undefined8 param_1,byte param_2,uint param_3,undefined2 param_4,undefined8 param_5,
- char *param_6,undefined8 param_7,undefined8 param_8,wchar_t *param_9,char *param_10)
+void WPP_RECORDER_AND_TRACE_SF_sDdZZ
+ (undefined2 param_1,char param_2,char param_3,undefined8 param_4,undefined1 param_5,
+ undefined4 param_6,ushort param_7,undefined8 param_8,char *param_9,
+ undefined8 param_10,undefined8 param_11,wchar_t *param_12,wchar_t *param_13)
{
wchar_t wVar1;
- wchar_t *pwVar2;
+ longlong lVar2;
wchar_t *pwVar3;
wchar_t *pwVar4;
- char *pcVar5;
- longlong lVar6;
- longlong lVar7;
- wchar_t *pwVar8;
- wchar_t wVar9;
+ longlong lVar5;
+ wchar_t *pwVar6;
+ char *pcVar7;
+ wchar_t wVar8;
+ wchar_t *pwVar9;
- pwVar3 = (wchar_t *)param_10;
- pwVar4 = param_9;
- pwVar8 = L"NULL";
- param_9 = (wchar_t *)0x4;
- param_10 = "NULL";
- wVar9 = L'\b';
- if (((*(uint *)(WPP_GLOBAL_Control +
- ((ulonglong)(param_3 - 1 >> 5 & 0x7ff) + (ulonglong)(param_3 >> 0x10) * 0x14) * 4 +
- 0x2c) >> (param_3 - 1 & 0x1f) & 1) != 0) &&
- (param_2 <= (byte)WPP_GLOBAL_Control[(ulonglong)(param_3 >> 0x10) * 0x50 + 0x29])) {
- if (param_6 == (char *)0x0) {
- lVar7 = 5;
+ pwVar4 = param_13;
+ pwVar6 = param_12;
+ pwVar9 = L"NULL";
+ wVar8 = L'\b';
+ if (param_2 != '\0') {
+ if (param_9 != (char *)0x0) {
+ lVar2 = -1;
+ do {
+ lVar2 = lVar2 + 1;
+ } while (param_9[lVar2] != '\0');
}
- else {
- lVar6 = -1;
- do {
- lVar7 = lVar6;
- lVar6 = lVar7 + 1;
- } while (param_6[lVar6] != '\0');
- lVar7 = lVar7 + 2;
+ pcVar7 = param_9;
+ if (param_9 == (char *)0x0) {
+ pcVar7 = "NULL";
}
- pcVar5 = param_6;
- if (param_6 == (char *)0x0) {
- pcVar5 = "NULL";
- }
- FastWppTraceMessage(param_5,param_4,pcVar5,lVar7);
+ FastWppTraceMessage(param_1,param_7,param_8,pcVar7);
}
- wVar1 = wVar9;
- if ((pwVar3 == (wchar_t *)0x0) || (wVar1 = *pwVar3, *pwVar3 == 0)) {
- pwVar2 = L"NULL";
+ if (param_3 == '\0') {
+ return;
+ }
+ if (pwVar4 == (wchar_t *)0x0) {
+ wVar1 = L'\b';
}
else {
- pwVar2 = *(wchar_t **)((longlong)pwVar3 + 8);
+ wVar1 = *pwVar4;
+ if (*pwVar4 != L'\0') {
+ pwVar3 = *(wchar_t **)(pwVar4 + 4);
+ goto LAB_0;
+ }
}
- if (pwVar3 == (wchar_t *)0x0) {
- pwVar3 = L"\b";
- }
- if ((pwVar4 != (wchar_t *)0x0) && (wVar9 = *pwVar4, *pwVar4 != L'\0')) {
- pwVar8 = *(wchar_t **)(pwVar4 + 4);
- }
+ pwVar3 = L"NULL";
+LAB_0:
if (pwVar4 == (wchar_t *)0x0) {
pwVar4 = L"\b";
}
- lVar7 = -1;
- if (param_6 == (char *)0x0) {
- lVar6 = 5;
+ if ((pwVar6 != (wchar_t *)0x0) && (wVar8 = *pwVar6, *pwVar6 != L'\0')) {
+ pwVar9 = *(wchar_t **)(pwVar6 + 4);
+ }
+ if (pwVar6 == (wchar_t *)0x0) {
+ pwVar6 = L"\b";
+ }
+ lVar2 = -1;
+ if (param_9 == (char *)0x0) {
+ lVar5 = 5;
}
else {
do {
- lVar6 = lVar7;
- lVar7 = lVar6 + 1;
- } while (param_6[lVar7] != '\0');
- lVar6 = lVar6 + 2;
+ lVar5 = lVar2;
+ lVar2 = lVar5 + 1;
+ } while (param_9[lVar2] != '\0');
+ lVar5 = lVar5 + 2;
}
- if (param_6 == (char *)0x0) {
- param_6 = "NULL";
+ if (param_9 == (char *)0x0) {
+ param_9 = "NULL";
}
- WppAutoLogTrace(param_1,param_2,param_3,param_5,param_4,param_6,lVar6,¶m_7,param_9,¶m_8,
- param_9,pwVar4,2,pwVar8,wVar9,pwVar3,2,pwVar2,wVar1,0);
+ WppAutoLogTrace(param_4,param_5,param_6,param_8,param_7,param_9,lVar5,¶m_10,4,¶m_11,4,
+ pwVar6,2,pwVar9,wVar8,pwVar4,2,pwVar3,wVar1,0);
return;
}
```
## WPP_RECORDER_SF_sDsiLiLZ
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,name,fullname,length,sig,address|
|ratio|0.3|
|i_ratio|0.4|
|m_ratio|0.99|
|b_ratio|0.93|
|match_types|StringsRefsHasher|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|`name`|WPP_RECORDER_SF_sDsiLiLZ|WPP_RECORDER_AND_TRACE_SF_sDsiLiLZ|
|`fullname`|WPP_RECORDER_SF_sDsiLiLZ|WPP_RECORDER_AND_TRACE_SF_sDsiLiLZ|
|refcount|2|2|
|`length`|711|717|
|called|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|
|calling|PrjfWriteFileDataHandler|PrjfWriteFileDataHandler|
|paramcount|1|4|
|`address`|1c003c2d4|1400121d4|
|`sig`|undefined __fastcall WPP_RECORDER_SF_sDsiLiLZ(undefined8 param_1)|undefined __fastcall WPP_RECORDER_AND_TRACE_SF_sDsiLiLZ(undefined8 param_1, char param_2, char param_3, undefined8 param_4)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### WPP_RECORDER_SF_sDsiLiLZ Diff
```diff
--- WPP_RECORDER_SF_sDsiLiLZ
+++ WPP_RECORDER_AND_TRACE_SF_sDsiLiLZ
@@ -1,54 +1,60 @@
-void WPP_RECORDER_SF_sDsiLiLZ(undefined8 param_1)
+void WPP_RECORDER_AND_TRACE_SF_sDsiLiLZ
+ (undefined8 param_1,char param_2,char param_3,undefined8 param_4)
{
wchar_t wVar1;
longlong lVar2;
wchar_t *pwVar3;
longlong lVar4;
- char *in_stack_00000040;
- wchar_t *in_stack_00000068;
- undefined4 local_28 [4];
+ char *in_stack_00000058;
+ wchar_t *in_stack_00000080;
+ undefined4 local_38 [4];
pwVar3 = L"NULL";
- local_28[0] = 0x5d7;
- wVar1 = L'\b';
- if (((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x2000) != 0) && (2 < (byte)WPP_GLOBAL_Control[0x29])
- ) {
- if (in_stack_00000040 != (char *)0x0) {
+ local_38[0] = 0x643;
+ if (param_2 != '\0') {
+ if (in_stack_00000058 != (char *)0x0) {
lVar2 = -1;
do {
lVar2 = lVar2 + 1;
- } while (in_stack_00000040[lVar2] != '\0');
+ } while (in_stack_00000058[lVar2] != '\0');
}
- FastWppTraceMessage(&WPP_3ccab5108a9538d17a865fde27ef339f_Traceguids,0x38,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c",0x2b);
+ FastWppTraceMessage(0x30e,0x3c,&WPP_39279db927ae337b8503ecc20725ff46_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c");
}
- if ((in_stack_00000068 != (wchar_t *)0x0) &&
- (wVar1 = *in_stack_00000068, *in_stack_00000068 != L'\0')) {
- pwVar3 = *(wchar_t **)(in_stack_00000068 + 4);
+ if (param_3 != '\0') {
+ if (in_stack_00000080 == (wchar_t *)0x0) {
+ wVar1 = L'\b';
+ }
+ else {
+ wVar1 = *in_stack_00000080;
+ if (*in_stack_00000080 != L'\0') {
+ pwVar3 = *(wchar_t **)(in_stack_00000080 + 4);
+ }
+ }
+ if (in_stack_00000080 == (wchar_t *)0x0) {
+ in_stack_00000080 = L"\b";
+ }
+ lVar2 = -1;
+ if (in_stack_00000058 == (char *)0x0) {
+ lVar4 = 5;
+ }
+ else {
+ do {
+ lVar4 = lVar2;
+ lVar2 = lVar4 + 1;
+ } while (in_stack_00000058[lVar2] != '\0');
+ lVar4 = lVar4 + 2;
+ }
+ if (in_stack_00000058 == (char *)0x0) {
+ in_stack_00000058 = "NULL";
+ }
+ WppAutoLogTrace(param_4,3,0xe,&WPP_39279db927ae337b8503ecc20725ff46_Traceguids,0x3c,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c",0x2b,local_38,4,
+ in_stack_00000058,lVar4,&stack0x00000060,8,&stack0x00000068,4,&stack0x00000070,8
+ ,&stack0x00000078,4,in_stack_00000080,2,pwVar3,wVar1,0);
}
- if (in_stack_00000068 == (wchar_t *)0x0) {
- in_stack_00000068 = L"\b";
- }
- lVar2 = -1;
- if (in_stack_00000040 == (char *)0x0) {
- lVar4 = 5;
- }
- else {
- do {
- lVar4 = lVar2;
- lVar2 = lVar4 + 1;
- } while (in_stack_00000040[lVar2] != '\0');
- lVar4 = lVar4 + 2;
- }
- if (in_stack_00000040 == (char *)0x0) {
- in_stack_00000040 = "NULL";
- }
- WppAutoLogTrace(param_1,3,0xe,&WPP_3ccab5108a9538d17a865fde27ef339f_Traceguids,0x38,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c",0x2b,local_28,4,
- in_stack_00000040,lVar4,&stack0x00000048,8,&stack0x00000050,4,&stack0x00000058,8,
- &stack0x00000060,4,in_stack_00000068,2,pwVar3,wVar1,0);
return;
}
```
## WPP_RECORDER_SF_sDddZ
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,name,fullname,length,sig,address|
|ratio|0.44|
|i_ratio|0.42|
|m_ratio|0.98|
|b_ratio|0.93|
|match_types|StrUniqueFuncRefsHasher|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|`name`|WPP_RECORDER_SF_sDddZ|WPP_RECORDER_AND_TRACE_SF_sDddZ|
|`fullname`|WPP_RECORDER_SF_sDddZ|WPP_RECORDER_AND_TRACE_SF_sDddZ|
|refcount|1|1|
|`length`|468|478|
|called|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|
|calling|||
|paramcount|1|4|
|`address`|1c003bbb8|140011a7c|
|`sig`|undefined __fastcall WPP_RECORDER_SF_sDddZ(undefined8 param_1)|undefined __fastcall WPP_RECORDER_AND_TRACE_SF_sDddZ(undefined8 param_1, char param_2, char param_3, undefined8 param_4)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### WPP_RECORDER_SF_sDddZ Diff
```diff
--- WPP_RECORDER_SF_sDddZ
+++ WPP_RECORDER_AND_TRACE_SF_sDddZ
@@ -1,30 +1,32 @@
-void WPP_RECORDER_SF_sDddZ(undefined8 param_1)
+void WPP_RECORDER_AND_TRACE_SF_sDddZ
+ (undefined8 param_1,char param_2,char param_3,undefined8 param_4)
{
wchar_t *pwVar1;
wchar_t wVar2;
- wchar_t *in_stack_00000050;
+ wchar_t *in_stack_00000068;
undefined4 local_28 [4];
pwVar1 = L"NULL";
- local_28[0] = 0x60b;
wVar2 = L'\b';
- if (((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x2000) != 0) && (1 < (byte)WPP_GLOBAL_Control[0x29])
- ) {
- FastWppTraceMessage(&WPP_3ccab5108a9538d17a865fde27ef339f_Traceguids,0x3a,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c",0x2b);
+ local_28[0] = 0x677;
+ if (param_2 != '\0') {
+ FastWppTraceMessage(0x20e,0x3e,&WPP_39279db927ae337b8503ecc20725ff46_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c");
}
- if ((in_stack_00000050 != (wchar_t *)0x0) &&
- (wVar2 = *in_stack_00000050, *in_stack_00000050 != L'\0')) {
- pwVar1 = *(wchar_t **)(in_stack_00000050 + 4);
+ if (param_3 != '\0') {
+ if ((in_stack_00000068 != (wchar_t *)0x0) &&
+ (wVar2 = *in_stack_00000068, *in_stack_00000068 != L'\0')) {
+ pwVar1 = *(wchar_t **)(in_stack_00000068 + 4);
+ }
+ if (in_stack_00000068 == (wchar_t *)0x0) {
+ in_stack_00000068 = L"\b";
+ }
+ WppAutoLogTrace(param_4,2,0xe,&WPP_39279db927ae337b8503ecc20725ff46_Traceguids,0x3e,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c",0x2b,local_28,4,
+ &stack0x00000058,4,&stack0x00000060,4,in_stack_00000068,2,pwVar1,wVar2,0);
}
- if (in_stack_00000050 == (wchar_t *)0x0) {
- in_stack_00000050 = L"\b";
- }
- WppAutoLogTrace(param_1,2,0xe,&WPP_3ccab5108a9538d17a865fde27ef339f_Traceguids,0x3a,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c",0x2b,local_28,4,
- &stack0x00000040,4,&stack0x00000048,4,in_stack_00000050,2,pwVar1,wVar2,0);
return;
}
```
## WPP_RECORDER_SF_sDdLlqqq
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,name,fullname,length,sig,address|
|ratio|0.37|
|i_ratio|0.44|
|m_ratio|1.0|
|b_ratio|0.92|
|match_types|StrUniqueFuncRefsHasher|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|`name`|WPP_RECORDER_SF_sDdLlqqq|WPP_RECORDER_AND_TRACE_SF_sDdLlqqq|
|`fullname`|WPP_RECORDER_SF_sDdLlqqq|WPP_RECORDER_AND_TRACE_SF_sDdLlqqq|
|refcount|6|6|
|`length`|410|430|
|called|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|
|calling|PrjfSendCommandAndWaitForCompletion|PrjfSendCommandAndWaitForCompletion|
|paramcount|4|7|
|`address`|1c003b834|1400116dc|
|`sig`|undefined __fastcall WPP_RECORDER_SF_sDdLlqqq(undefined8 param_1, byte param_2, undefined8 param_3, undefined2 param_4)|undefined __fastcall WPP_RECORDER_AND_TRACE_SF_sDdLlqqq(undefined2 param_1, char param_2, char param_3, undefined8 param_4, undefined1 param_5, undefined8 param_6, ushort param_7)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### WPP_RECORDER_SF_sDdLlqqq Diff
```diff
--- WPP_RECORDER_SF_sDdLlqqq
+++ WPP_RECORDER_AND_TRACE_SF_sDdLlqqq
@@ -1,16 +1,19 @@
-void WPP_RECORDER_SF_sDdLlqqq(undefined8 param_1,byte param_2,undefined8 param_3,undefined2 param_4)
+void WPP_RECORDER_AND_TRACE_SF_sDdLlqqq
+ (undefined2 param_1,char param_2,char param_3,undefined8 param_4,undefined1 param_5,
+ undefined8 param_6,ushort param_7)
{
- if (((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x2000) != 0) &&
- (param_2 <= (byte)WPP_GLOBAL_Control[0x29])) {
- FastWppTraceMessage(&WPP_3ccab5108a9538d17a865fde27ef339f_Traceguids,param_4,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c",0x2b);
+ if (param_2 != '\0') {
+ FastWppTraceMessage(param_1,param_7,&WPP_39279db927ae337b8503ecc20725ff46_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c");
}
- WppAutoLogTrace(param_1,param_2,0xe,&WPP_3ccab5108a9538d17a865fde27ef339f_Traceguids,param_4,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c",0x2b,&stack0x00000038,4,
- &stack0x00000040,4,&stack0x00000048,4,&stack0x00000050,4,&stack0x00000058,8,
- &stack0x00000060,8,&stack0x00000068,8,0);
+ if (param_3 != '\0') {
+ WppAutoLogTrace(param_4,param_5,0xe,&WPP_39279db927ae337b8503ecc20725ff46_Traceguids,param_7,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c",0x2b,&stack0x00000050,4,
+ &stack0x00000058,4,&stack0x00000060,4,&stack0x00000068,4,&stack0x00000070,8,
+ &stack0x00000078,8,&stack0x00000080,8,0);
+ }
return;
}
```
## WPP_RECORDER_SF_sDdZDl
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,name,fullname,length,sig,address|
|ratio|0.42|
|i_ratio|0.45|
|m_ratio|1.0|
|b_ratio|0.95|
|match_types|StrUniqueFuncRefsHasher|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|`name`|WPP_RECORDER_SF_sDdZDl|WPP_RECORDER_AND_TRACE_SF_sDdZDl|
|`fullname`|WPP_RECORDER_SF_sDdZDl|WPP_RECORDER_AND_TRACE_SF_sDdZDl|
|refcount|5|5|
|`length`|511|519|
|called|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|
|calling|PrjfPostCreate|PrjfPostCreate|
|paramcount|4|7|
|`address`|1c0039588|14000f480|
|`sig`|undefined __fastcall WPP_RECORDER_SF_sDdZDl(undefined8 param_1, byte param_2, undefined8 param_3, undefined2 param_4)|undefined __fastcall WPP_RECORDER_AND_TRACE_SF_sDdZDl(undefined2 param_1, char param_2, char param_3, undefined8 param_4, undefined1 param_5, undefined8 param_6, ushort param_7)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### WPP_RECORDER_SF_sDdZDl Diff
```diff
--- WPP_RECORDER_SF_sDdZDl
+++ WPP_RECORDER_AND_TRACE_SF_sDdZDl
@@ -1,29 +1,32 @@
-void WPP_RECORDER_SF_sDdZDl(undefined8 param_1,byte param_2,undefined8 param_3,undefined2 param_4)
+void WPP_RECORDER_AND_TRACE_SF_sDdZDl
+ (undefined2 param_1,char param_2,char param_3,undefined8 param_4,undefined1 param_5,
+ undefined8 param_6,ushort param_7)
{
wchar_t *pwVar1;
wchar_t wVar2;
- wchar_t *in_stack_00000048;
+ wchar_t *in_stack_00000060;
pwVar1 = L"NULL";
wVar2 = L'\b';
- if (((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x10) != 0) &&
- (param_2 <= (byte)WPP_GLOBAL_Control[0x29])) {
- FastWppTraceMessage(&WPP_0b474be437163e15bbc5d557e64edfd4_Traceguids,param_4,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\create.c",0x2a);
+ if (param_2 != '\0') {
+ FastWppTraceMessage(param_1,param_7,&WPP_b8de0dfab5423d2f6ea3deba36b4500f_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\create.c");
}
- if ((in_stack_00000048 != (wchar_t *)0x0) &&
- (wVar2 = *in_stack_00000048, *in_stack_00000048 != L'\0')) {
- pwVar1 = *(wchar_t **)(in_stack_00000048 + 4);
+ if (param_3 != '\0') {
+ if ((in_stack_00000060 != (wchar_t *)0x0) &&
+ (wVar2 = *in_stack_00000060, *in_stack_00000060 != L'\0')) {
+ pwVar1 = *(wchar_t **)(in_stack_00000060 + 4);
+ }
+ if (in_stack_00000060 == (wchar_t *)0x0) {
+ in_stack_00000060 = L"\b";
+ }
+ WppAutoLogTrace(param_4,param_5,5,&WPP_b8de0dfab5423d2f6ea3deba36b4500f_Traceguids,param_7,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\create.c",0x2a,&stack0x00000050,4,
+ &stack0x00000058,4,in_stack_00000060,2,pwVar1,wVar2,&stack0x00000068,4,
+ &stack0x00000070,4,0);
}
- if (in_stack_00000048 == (wchar_t *)0x0) {
- in_stack_00000048 = L"\b";
- }
- WppAutoLogTrace(param_1,param_2,5,&WPP_0b474be437163e15bbc5d557e64edfd4_Traceguids,param_4,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\create.c",0x2a,&stack0x00000038,4,
- &stack0x00000040,4,in_stack_00000048,2,pwVar1,wVar2,&stack0x00000050,4,
- &stack0x00000058,4,0);
return;
}
```
## WPP_RECORDER_SF_sDqd
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,name,fullname,length,sig,address|
|ratio|0.29|
|i_ratio|0.18|
|m_ratio|0.91|
|b_ratio|0.81|
|match_types|StrUniqueFuncRefsHasher|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|`name`|WPP_RECORDER_SF_sDqd|WPP_RECORDER_AND_TRACE_SF_sDqd|
|`fullname`|WPP_RECORDER_SF_sDqd|WPP_RECORDER_AND_TRACE_SF_sDqd|
|refcount|13|13|
|`length`|446|384|
|called|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|
|calling|PrjfDeleteTombstoneIfExists
PrjfExpandFile
PrjfFsctlSetReparsePointPostOp
PrjfGetPrjReparseData
PrjfGetSetContextFileObject
PrjfGetSetStreamContext
PrjfPostCreate
PrjfSendPostCreateNotifications
PrjfSetDeleteDisposition|PrjfDeleteTombstoneIfExists
PrjfExpandFile
PrjfFsctlSetReparsePointPostOp
PrjfGetPrjReparseData
PrjfGetSetContextFileObject
PrjfGetSetStreamContext
PrjfPostCreate
PrjfSendPostCreateNotifications
PrjfSetDeleteDisposition|
|paramcount|6|9|
|`address`|1c0038c3c|14000eb38|
|`sig`|undefined __fastcall WPP_RECORDER_SF_sDqd(undefined8 param_1, byte param_2, uint param_3, undefined2 param_4, undefined8 param_5, char * param_6)|undefined __fastcall WPP_RECORDER_AND_TRACE_SF_sDqd(undefined2 param_1, char param_2, char param_3, undefined8 param_4, undefined1 param_5, undefined4 param_6, ushort param_7, undefined8 param_8, char * param_9)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### WPP_RECORDER_SF_sDqd Diff
```diff
--- WPP_RECORDER_SF_sDqd
+++ WPP_RECORDER_AND_TRACE_SF_sDqd
@@ -1,50 +1,44 @@
-void WPP_RECORDER_SF_sDqd
- (undefined8 param_1,byte param_2,uint param_3,undefined2 param_4,undefined8 param_5,
- char *param_6)
+void WPP_RECORDER_AND_TRACE_SF_sDqd
+ (undefined2 param_1,char param_2,char param_3,undefined8 param_4,undefined1 param_5,
+ undefined4 param_6,ushort param_7,undefined8 param_8,char *param_9)
{
- char *pcVar1;
+ longlong lVar1;
longlong lVar2;
- longlong lVar3;
+ char *pcVar3;
- if (((*(uint *)(WPP_GLOBAL_Control +
- ((ulonglong)(param_3 - 1 >> 5 & 0x7ff) + (ulonglong)(param_3 >> 0x10) * 0x14) * 4 +
- 0x2c) >> (param_3 - 1 & 0x1f) & 1) != 0) &&
- (param_2 <= (byte)WPP_GLOBAL_Control[(ulonglong)(param_3 >> 0x10) * 0x50 + 0x29])) {
- if (param_6 == (char *)0x0) {
- lVar3 = 5;
+ if (param_2 != '\0') {
+ if (param_9 != (char *)0x0) {
+ lVar1 = -1;
+ do {
+ lVar1 = lVar1 + 1;
+ } while (param_9[lVar1] != '\0');
+ }
+ pcVar3 = param_9;
+ if (param_9 == (char *)0x0) {
+ pcVar3 = "NULL";
+ }
+ FastWppTraceMessage(param_1,param_7,param_8,pcVar3);
+ }
+ if (param_3 != '\0') {
+ lVar1 = -1;
+ if (param_9 == (char *)0x0) {
+ lVar2 = 5;
}
else {
- lVar2 = -1;
do {
- lVar3 = lVar2;
- lVar2 = lVar3 + 1;
- } while (param_6[lVar2] != '\0');
- lVar3 = lVar3 + 2;
+ lVar2 = lVar1;
+ lVar1 = lVar2 + 1;
+ } while (param_9[lVar1] != '\0');
+ lVar2 = lVar2 + 2;
}
- pcVar1 = param_6;
- if (param_6 == (char *)0x0) {
- pcVar1 = "NULL";
+ if (param_9 == (char *)0x0) {
+ param_9 = "NULL";
}
- FastWppTraceMessage(param_5,param_4,pcVar1,lVar3);
+ WppAutoLogTrace(param_4,param_5,param_6,param_8,param_7,param_9,lVar2,&stack0x00000050,4,
+ &stack0x00000058,8,&stack0x00000060,4,0);
}
- lVar3 = -1;
- if (param_6 == (char *)0x0) {
- lVar2 = 5;
- }
- else {
- do {
- lVar2 = lVar3;
- lVar3 = lVar2 + 1;
- } while (param_6[lVar3] != '\0');
- lVar2 = lVar2 + 2;
- }
- if (param_6 == (char *)0x0) {
- param_6 = "NULL";
- }
- WppAutoLogTrace(param_1,param_2,param_3,param_5,param_4,param_6,lVar2,&stack0x00000038,4,
- &stack0x00000040,8,&stack0x00000048,4,0);
return;
}
```
## WPP_RECORDER_SF_sDdDZ
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,name,fullname,length,sig,address|
|ratio|0.26|
|i_ratio|0.26|
|m_ratio|0.96|
|b_ratio|0.86|
|match_types|StrUniqueFuncRefsHasher|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|`name`|WPP_RECORDER_SF_sDdDZ|WPP_RECORDER_AND_TRACE_SF_sDdDZ|
|`fullname`|WPP_RECORDER_SF_sDdDZ|WPP_RECORDER_AND_TRACE_SF_sDdDZ|
|refcount|6|6|
|`length`|602|571|
|called|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|
|calling|PrjfCreateMappingEntry
PrjfDecideUpdateDeleteOnFileStateAndUpdateFlags
PrjfSendNotifyOperationCommand|PrjfCreateMappingEntry
PrjfDecideUpdateDeleteOnFileStateAndUpdateFlags
PrjfSendNotifyOperationCommand|
|paramcount|6|9|
|`address`|1c003b478|140011330|
|`sig`|undefined __fastcall WPP_RECORDER_SF_sDdDZ(undefined8 param_1, byte param_2, uint param_3, undefined2 param_4, undefined8 param_5, char * param_6)|undefined __fastcall WPP_RECORDER_AND_TRACE_SF_sDdDZ(undefined2 param_1, char param_2, char param_3, undefined8 param_4, undefined1 param_5, undefined4 param_6, ushort param_7, undefined8 param_8, char * param_9)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### WPP_RECORDER_SF_sDdDZ Diff
```diff
--- WPP_RECORDER_SF_sDdDZ
+++ WPP_RECORDER_AND_TRACE_SF_sDdDZ
@@ -1,62 +1,56 @@
-void WPP_RECORDER_SF_sDdDZ
- (undefined8 param_1,byte param_2,uint param_3,undefined2 param_4,undefined8 param_5,
- char *param_6)
+void WPP_RECORDER_AND_TRACE_SF_sDdDZ
+ (undefined2 param_1,char param_2,char param_3,undefined8 param_4,undefined1 param_5,
+ undefined4 param_6,ushort param_7,undefined8 param_8,char *param_9)
{
- wchar_t wVar1;
- char *pcVar2;
+ longlong lVar1;
+ wchar_t wVar2;
longlong lVar3;
- longlong lVar4;
+ char *pcVar4;
wchar_t *pwVar5;
- wchar_t *in_stack_00000050;
+ wchar_t *in_stack_00000068;
pwVar5 = L"NULL";
- wVar1 = L'\b';
- if (((*(uint *)(WPP_GLOBAL_Control +
- ((ulonglong)(param_3 - 1 >> 5 & 0x7ff) + (ulonglong)(param_3 >> 0x10) * 0x14) * 4 +
- 0x2c) >> (param_3 - 1 & 0x1f) & 1) != 0) &&
- (param_2 <= (byte)WPP_GLOBAL_Control[(ulonglong)(param_3 >> 0x10) * 0x50 + 0x29])) {
- if (param_6 == (char *)0x0) {
- lVar4 = 5;
+ wVar2 = L'\b';
+ if (param_2 != '\0') {
+ if (param_9 != (char *)0x0) {
+ lVar1 = -1;
+ do {
+ lVar1 = lVar1 + 1;
+ } while (param_9[lVar1] != '\0');
+ }
+ pcVar4 = param_9;
+ if (param_9 == (char *)0x0) {
+ pcVar4 = "NULL";
+ }
+ FastWppTraceMessage(param_1,param_7,param_8,pcVar4);
+ }
+ if (param_3 != '\0') {
+ if ((in_stack_00000068 != (wchar_t *)0x0) &&
+ (wVar2 = *in_stack_00000068, *in_stack_00000068 != L'\0')) {
+ pwVar5 = *(wchar_t **)(in_stack_00000068 + 4);
+ }
+ if (in_stack_00000068 == (wchar_t *)0x0) {
+ in_stack_00000068 = L"\b";
+ }
+ lVar1 = -1;
+ if (param_9 == (char *)0x0) {
+ lVar3 = 5;
}
else {
- lVar3 = -1;
do {
- lVar4 = lVar3;
- lVar3 = lVar4 + 1;
- } while (param_6[lVar3] != '\0');
- lVar4 = lVar4 + 2;
+ lVar3 = lVar1;
+ lVar1 = lVar3 + 1;
+ } while (param_9[lVar1] != '\0');
+ lVar3 = lVar3 + 2;
}
- pcVar2 = param_6;
- if (param_6 == (char *)0x0) {
- pcVar2 = "NULL";
+ if (param_9 == (char *)0x0) {
+ param_9 = "NULL";
}
- FastWppTraceMessage(param_5,param_4,pcVar2,lVar4);
+ WppAutoLogTrace(param_4,param_5,param_6,param_8,param_7,param_9,lVar3,&stack0x00000050,4,
+ &stack0x00000058,4,&stack0x00000060,4,in_stack_00000068,2,pwVar5,wVar2,0);
}
- if ((in_stack_00000050 != (wchar_t *)0x0) &&
- (wVar1 = *in_stack_00000050, *in_stack_00000050 != L'\0')) {
- pwVar5 = *(wchar_t **)(in_stack_00000050 + 4);
- }
- if (in_stack_00000050 == (wchar_t *)0x0) {
- in_stack_00000050 = L"\b";
- }
- lVar4 = -1;
- if (param_6 == (char *)0x0) {
- lVar3 = 5;
- }
- else {
- do {
- lVar3 = lVar4;
- lVar4 = lVar3 + 1;
- } while (param_6[lVar4] != '\0');
- lVar3 = lVar3 + 2;
- }
- if (param_6 == (char *)0x0) {
- param_6 = "NULL";
- }
- WppAutoLogTrace(param_1,param_2,param_3,param_5,param_4,param_6,lVar3,&stack0x00000038,4,
- &stack0x00000040,4,&stack0x00000048,4,in_stack_00000050,2,pwVar5,wVar1,0);
return;
}
```
## WPP_RECORDER_SF_sDq
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,name,fullname,length,sig,address|
|ratio|0.29|
|i_ratio|0.23|
|m_ratio|0.9|
|b_ratio|0.79|
|match_types|StrUniqueFuncRefsHasher|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|`name`|WPP_RECORDER_SF_sDq|WPP_RECORDER_AND_TRACE_SF_sDq|
|`fullname`|WPP_RECORDER_SF_sDq|WPP_RECORDER_AND_TRACE_SF_sDq|
|refcount|5|5|
|`length`|398|350|
|called|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|
|calling|PrjfFlushAndUpdateDiskStateWorker
PrjfGetSetContextFileObject
PrjfIsZeroAllocatedRange
PrjfPrepareForDelete|PrjfFlushAndUpdateDiskStateWorker
PrjfGetSetContextFileObject
PrjfIsZeroAllocatedRange
PrjfPrepareForDelete|
|paramcount|6|9|
|`address`|1c0038aa4|14000e9d0|
|`sig`|undefined __fastcall WPP_RECORDER_SF_sDq(undefined8 param_1, byte param_2, uint param_3, undefined2 param_4, undefined8 param_5, char * param_6)|undefined __fastcall WPP_RECORDER_AND_TRACE_SF_sDq(undefined2 param_1, char param_2, char param_3, undefined8 param_4, undefined1 param_5, undefined4 param_6, ushort param_7, undefined8 param_8, char * param_9)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### WPP_RECORDER_SF_sDq Diff
```diff
--- WPP_RECORDER_SF_sDq
+++ WPP_RECORDER_AND_TRACE_SF_sDq
@@ -1,49 +1,44 @@
-void WPP_RECORDER_SF_sDq(undefined8 param_1,byte param_2,uint param_3,undefined2 param_4,
- undefined8 param_5,char *param_6)
+void WPP_RECORDER_AND_TRACE_SF_sDq
+ (undefined2 param_1,char param_2,char param_3,undefined8 param_4,undefined1 param_5,
+ undefined4 param_6,ushort param_7,undefined8 param_8,char *param_9)
{
- char *pcVar1;
+ longlong lVar1;
longlong lVar2;
- longlong lVar3;
+ char *pcVar3;
- if (((*(uint *)(WPP_GLOBAL_Control +
- ((ulonglong)(param_3 - 1 >> 5 & 0x7ff) + (ulonglong)(param_3 >> 0x10) * 0x14) * 4 +
- 0x2c) >> (param_3 - 1 & 0x1f) & 1) != 0) &&
- (param_2 <= (byte)WPP_GLOBAL_Control[(ulonglong)(param_3 >> 0x10) * 0x50 + 0x29])) {
- if (param_6 == (char *)0x0) {
- lVar3 = 5;
+ if (param_2 != '\0') {
+ if (param_9 != (char *)0x0) {
+ lVar1 = -1;
+ do {
+ lVar1 = lVar1 + 1;
+ } while (param_9[lVar1] != '\0');
+ }
+ pcVar3 = param_9;
+ if (param_9 == (char *)0x0) {
+ pcVar3 = "NULL";
+ }
+ FastWppTraceMessage(param_1,param_7,param_8,pcVar3);
+ }
+ if (param_3 != '\0') {
+ lVar1 = -1;
+ if (param_9 == (char *)0x0) {
+ lVar2 = 5;
}
else {
- lVar2 = -1;
do {
- lVar3 = lVar2;
- lVar2 = lVar3 + 1;
- } while (param_6[lVar2] != '\0');
- lVar3 = lVar3 + 2;
+ lVar2 = lVar1;
+ lVar1 = lVar2 + 1;
+ } while (param_9[lVar1] != '\0');
+ lVar2 = lVar2 + 2;
}
- pcVar1 = param_6;
- if (param_6 == (char *)0x0) {
- pcVar1 = "NULL";
+ if (param_9 == (char *)0x0) {
+ param_9 = "NULL";
}
- FastWppTraceMessage(param_5,param_4,pcVar1,lVar3);
+ WppAutoLogTrace(param_4,param_5,param_6,param_8,param_7,param_9,lVar2,&stack0x00000050,4,
+ &stack0x00000058,8,0);
}
- lVar3 = -1;
- if (param_6 == (char *)0x0) {
- lVar2 = 5;
- }
- else {
- do {
- lVar2 = lVar3;
- lVar3 = lVar2 + 1;
- } while (param_6[lVar3] != '\0');
- lVar2 = lVar2 + 2;
- }
- if (param_6 == (char *)0x0) {
- param_6 = "NULL";
- }
- WppAutoLogTrace(param_1,param_2,param_3,param_5,param_4,param_6,lVar2,&stack0x00000038,4,
- &stack0x00000040,8,0);
return;
}
```
## WPP_RECORDER_SF_sDdD
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,name,fullname,length,sig,address|
|ratio|0.29|
|i_ratio|0.26|
|m_ratio|0.93|
|b_ratio|0.83|
|match_types|StrUniqueFuncRefsHasher|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|`name`|WPP_RECORDER_SF_sDdD|WPP_RECORDER_AND_TRACE_SF_sDdD|
|`fullname`|WPP_RECORDER_SF_sDdD|WPP_RECORDER_AND_TRACE_SF_sDdD|
|refcount|22|22|
|`length`|415|369|
|called|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|
|calling|Expand for full list:
PrjfDeleteFileHandler
PrjfEnumerateDirectoryWithMerge
PrjfFsctlStartVirtualizationInstance
PrjfGetContextFileObject
PrjfGetContextFileObjectEx
PrjfIsDirectoryEmpty
PrjfNotifyRenameOrLinkOperation
PrjfOpenFileHandler
PrjfPortConnect
PrjfPortMessage
PrjfPostCreate
PrjfProcessPostRenameOrLinkInformation
PrjfProcessPreRenameOrLinkInformation
PrjfReadFileHandler
PrjfStoreNotificationMappingEntries
PrjfValidateNamesInEnumeration
PrjfVerifyAccessAndSetClientPortIfNeededExpand for full list:
PrjfDeleteFileHandler
PrjfEnumerateDirectoryWithMerge
PrjfFsctlStartVirtualizationInstance
PrjfGetContextFileObject
PrjfGetContextFileObjectEx
PrjfIsDirectoryEmpty
PrjfNotifyRenameOrLinkOperation
PrjfOpenFileHandler
PrjfPortConnect
PrjfPortMessage
PrjfPostCreate
PrjfProcessPostRenameOrLinkInformation
PrjfProcessPreRenameOrLinkInformation
PrjfReadFileHandler
PrjfStoreNotificationMappingEntries
PrjfValidateNamesInEnumeration
PrjfVerifyAccessAndSetClientPortIfNeeded
WPPRECORDER.SYS::WppAutoLogTrace|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|
|calling|PrjfCreateMappingEntry|PrjfCreateMappingEntry|
|paramcount|1|4|
|`address`|1c003e3ac|140014894|
|`sig`|undefined __fastcall WPP_RECORDER_SF_sDDDZ(undefined8 param_1)|undefined __fastcall WPP_RECORDER_AND_TRACE_SF_sDDDZ(undefined8 param_1, char param_2, char param_3, undefined8 param_4)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### WPP_RECORDER_SF_sDDDZ Diff
```diff
--- WPP_RECORDER_SF_sDDDZ
+++ WPP_RECORDER_AND_TRACE_SF_sDDDZ
@@ -1,32 +1,34 @@
-void WPP_RECORDER_SF_sDDDZ(undefined8 param_1)
+void WPP_RECORDER_AND_TRACE_SF_sDDDZ
+ (undefined8 param_1,char param_2,char param_3,undefined8 param_4)
{
wchar_t *pwVar1;
wchar_t wVar2;
- wchar_t *in_stack_00000050;
+ wchar_t *in_stack_00000068;
undefined4 local_28 [2];
undefined4 local_20 [2];
pwVar1 = L"NULL";
+ wVar2 = L'\b';
local_28[0] = 1;
- local_20[0] = 0x266;
- wVar2 = L'\b';
- if (((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x40) != 0) && (2 < (byte)WPP_GLOBAL_Control[0x29]))
- {
- FastWppTraceMessage(&WPP_5c05f7cae5513ff3734adbc0d3bd9537_Traceguids,0x1c,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\mapping.c",0x2b);
+ local_20[0] = 0x267;
+ if (param_2 != '\0') {
+ FastWppTraceMessage(0x307,0x1c,&WPP_0314efc3b1f93d76a134ccc0e69e0e16_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\mapping.c");
}
- if ((in_stack_00000050 != (wchar_t *)0x0) &&
- (wVar2 = *in_stack_00000050, *in_stack_00000050 != L'\0')) {
- pwVar1 = *(wchar_t **)(in_stack_00000050 + 4);
+ if (param_3 != '\0') {
+ if ((in_stack_00000068 != (wchar_t *)0x0) &&
+ (wVar2 = *in_stack_00000068, *in_stack_00000068 != L'\0')) {
+ pwVar1 = *(wchar_t **)(in_stack_00000068 + 4);
+ }
+ if (in_stack_00000068 == (wchar_t *)0x0) {
+ in_stack_00000068 = L"\b";
+ }
+ WppAutoLogTrace(param_4,3,7,&WPP_0314efc3b1f93d76a134ccc0e69e0e16_Traceguids,0x1c,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\mapping.c",0x2b,local_20,4,
+ &stack0x00000058,4,local_28,4,in_stack_00000068,2,pwVar1,wVar2,0);
}
- if (in_stack_00000050 == (wchar_t *)0x0) {
- in_stack_00000050 = L"\b";
- }
- WppAutoLogTrace(param_1,3,7,&WPP_5c05f7cae5513ff3734adbc0d3bd9537_Traceguids,0x1c,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\mapping.c",0x2b,local_20,4,
- &stack0x00000040,4,local_28,4,in_stack_00000050,2,pwVar1,wVar2,0);
return;
}
```
## WPP_RECORDER_SF_sDqZd
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,name,fullname,length,sig,address|
|ratio|0.41|
|i_ratio|0.37|
|m_ratio|0.99|
|b_ratio|0.93|
|match_types|StrUniqueFuncRefsHasher|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|`name`|WPP_RECORDER_SF_sDqZd|WPP_RECORDER_AND_TRACE_SF_sDqZd|
|`fullname`|WPP_RECORDER_SF_sDqZd|WPP_RECORDER_AND_TRACE_SF_sDqZd|
|refcount|2|2|
|`length`|474|488|
|called|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|
|calling|PrjfPreDirectoryControl|PrjfPreDirectoryControl|
|paramcount|0|3|
|`address`|1c0039d60|14000fc9c|
|`sig`|undefined __fastcall WPP_RECORDER_SF_sDqZd(void)|undefined __fastcall WPP_RECORDER_AND_TRACE_SF_sDqZd(undefined8 param_1, char param_2, char param_3)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### WPP_RECORDER_SF_sDqZd Diff
```diff
--- WPP_RECORDER_SF_sDqZd
+++ WPP_RECORDER_AND_TRACE_SF_sDqZd
@@ -1,32 +1,37 @@
-void WPP_RECORDER_SF_sDqZd(void)
+void WPP_RECORDER_AND_TRACE_SF_sDqZd(undefined8 param_1,char param_2,char param_3)
{
undefined8 uVar1;
wchar_t wVar2;
wchar_t *pwVar3;
- wchar_t *in_stack_00000048;
+ wchar_t *in_stack_00000060;
undefined4 local_28 [4];
uVar1 = _PrjfTraceRecorder;
pwVar3 = L"NULL";
- local_28[0] = 0xfd3;
- wVar2 = L'\b';
- if (((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x20000) != 0) &&
- (4 < (byte)WPP_GLOBAL_Control[0x29])) {
- FastWppTraceMessage(&WPP_e21b7c61aee93f730c9c252e6e8da2f4_Traceguids,0x21,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\dir.c",0x27);
+ local_28[0] = 0xfd6;
+ if (param_2 != '\0') {
+ FastWppTraceMessage(0x512,0x21,&WPP_3d19aee1b05838720427e757513a9608_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\dir.c");
}
- if ((in_stack_00000048 != (wchar_t *)0x0) &&
- (wVar2 = *in_stack_00000048, *in_stack_00000048 != L'\0')) {
- pwVar3 = *(wchar_t **)(in_stack_00000048 + 4);
+ if (param_3 != '\0') {
+ if (in_stack_00000060 == (wchar_t *)0x0) {
+ wVar2 = L'\b';
+ }
+ else {
+ wVar2 = *in_stack_00000060;
+ if (*in_stack_00000060 != L'\0') {
+ pwVar3 = *(wchar_t **)(in_stack_00000060 + 4);
+ }
+ }
+ if (in_stack_00000060 == (wchar_t *)0x0) {
+ in_stack_00000060 = L"\b";
+ }
+ WppAutoLogTrace(uVar1,5,0x12,&WPP_3d19aee1b05838720427e757513a9608_Traceguids,0x21,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\dir.c",0x27,local_28,4,&stack0x00000058,
+ 8,in_stack_00000060,2,pwVar3,wVar2,&stack0x00000068,4,0);
}
- if (in_stack_00000048 == (wchar_t *)0x0) {
- in_stack_00000048 = L"\b";
- }
- WppAutoLogTrace(uVar1,5,0x12,&WPP_e21b7c61aee93f730c9c252e6e8da2f4_Traceguids,0x21,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\dir.c",0x27,local_28,4,&stack0x00000040,8,
- in_stack_00000048,2,pwVar3,wVar2,&stack0x00000050,4,0);
return;
}
```
## WPP_RECORDER_SF_sDLLd
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,name,fullname,length,sig,address|
|ratio|0.63|
|i_ratio|0.39|
|m_ratio|0.99|
|b_ratio|0.91|
|match_types|StrUniqueFuncRefsHasher|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|`name`|WPP_RECORDER_SF_sDLLd|WPP_RECORDER_AND_TRACE_SF_sDLLd|
|`fullname`|WPP_RECORDER_SF_sDLLd|WPP_RECORDER_AND_TRACE_SF_sDLLd|
|refcount|2|2|
|`length`|314|329|
|called|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|
|calling|PrjfInstanceSetup|PrjfInstanceSetup|
|paramcount|1|4|
|`address`|1c003def4|1400143cc|
|`sig`|undefined __fastcall WPP_RECORDER_SF_sDLLd(undefined8 param_1)|undefined __fastcall WPP_RECORDER_AND_TRACE_SF_sDLLd(undefined8 param_1, char param_2, char param_3, undefined8 param_4)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### WPP_RECORDER_SF_sDLLd Diff
```diff
--- WPP_RECORDER_SF_sDLLd
+++ WPP_RECORDER_AND_TRACE_SF_sDLLd
@@ -1,21 +1,24 @@
-void WPP_RECORDER_SF_sDLLd(undefined8 param_1)
+void WPP_RECORDER_AND_TRACE_SF_sDLLd
+ (undefined8 param_1,char param_2,char param_3,undefined8 param_4)
{
undefined4 local_28 [2];
undefined4 local_20 [2];
undefined4 local_18 [4];
local_28[0] = 0xc0000182;
local_20[0] = 0x100000;
local_18[0] = 0x22c;
- if (((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 8) != 0) && (1 < (byte)WPP_GLOBAL_Control[0x29])) {
- FastWppTraceMessage(&WPP_3f8aed4e88f83f53ec58226552f2c258_Traceguids,0x12,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\prjflt.c",0x2a);
+ if (param_2 != '\0') {
+ FastWppTraceMessage(0x204,0x12,&WPP_3f8aed4e88f83f53ec58226552f2c258_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\prjflt.c");
}
- WppAutoLogTrace(param_1,2,4,&WPP_3f8aed4e88f83f53ec58226552f2c258_Traceguids,0x12,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\prjflt.c",0x2a,local_18,4,local_20,4,
- &stack0x00000048,4,local_28,4,0);
+ if (param_3 != '\0') {
+ WppAutoLogTrace(param_4,2,4,&WPP_3f8aed4e88f83f53ec58226552f2c258_Traceguids,0x12,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\prjflt.c",0x2a,local_18,4,local_20,4,
+ &stack0x00000060,4,local_28,4,0);
+ }
return;
}
```
## WPP_RECORDER_SF_sDsDZ
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,name,fullname,length,sig,address|
|ratio|0.36|
|i_ratio|0.43|
|m_ratio|0.99|
|b_ratio|0.9|
|match_types|StrUniqueFuncRefsHasher|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|`name`|WPP_RECORDER_SF_sDsDZ|WPP_RECORDER_AND_TRACE_SF_sDsDZ|
|`fullname`|WPP_RECORDER_SF_sDsDZ|WPP_RECORDER_AND_TRACE_SF_sDsDZ|
|refcount|2|2|
|`length`|583|572|
|called|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|
|calling|PrjfGetNotificationMask|PrjfGetNotificationMask|
|paramcount|0|3|
|`address`|1c003dca4|140014188|
|`sig`|undefined __fastcall WPP_RECORDER_SF_sDsDZ(void)|undefined __fastcall WPP_RECORDER_AND_TRACE_SF_sDsDZ(undefined8 param_1, char param_2, char param_3)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### WPP_RECORDER_SF_sDsDZ Diff
```diff
--- WPP_RECORDER_SF_sDsDZ
+++ WPP_RECORDER_AND_TRACE_SF_sDsDZ
@@ -1,55 +1,56 @@
-void WPP_RECORDER_SF_sDsDZ(void)
+void WPP_RECORDER_AND_TRACE_SF_sDsDZ(undefined8 param_1,char param_2,char param_3)
{
undefined8 uVar1;
longlong lVar2;
wchar_t wVar3;
longlong lVar4;
wchar_t *pwVar5;
- char *in_stack_00000040;
- wchar_t *in_stack_00000050;
- undefined4 local_28 [4];
+ char *in_stack_00000058;
+ wchar_t *in_stack_00000068;
+ undefined4 local_38 [4];
uVar1 = _PrjfTraceRecorder;
pwVar5 = L"NULL";
- local_28[0] = 0x1c8a;
wVar3 = L'\b';
- if (((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x80000) != 0) &&
- (4 < (byte)WPP_GLOBAL_Control[0x29])) {
- if (in_stack_00000040 != (char *)0x0) {
+ local_38[0] = 0x1cc1;
+ if (param_2 != '\0') {
+ if (in_stack_00000058 != (char *)0x0) {
lVar2 = -1;
do {
lVar2 = lVar2 + 1;
- } while (in_stack_00000040[lVar2] != '\0');
+ } while (in_stack_00000058[lVar2] != '\0');
}
- FastWppTraceMessage(&WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,0xaa,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",0x29);
+ FastWppTraceMessage(0x514,0xac,&WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
}
- if ((in_stack_00000050 != (wchar_t *)0x0) &&
- (wVar3 = *in_stack_00000050, *in_stack_00000050 != L'\0')) {
- pwVar5 = *(wchar_t **)(in_stack_00000050 + 4);
+ if (param_3 != '\0') {
+ if ((in_stack_00000068 != (wchar_t *)0x0) &&
+ (wVar3 = *in_stack_00000068, *in_stack_00000068 != L'\0')) {
+ pwVar5 = *(wchar_t **)(in_stack_00000068 + 4);
+ }
+ if (in_stack_00000068 == (wchar_t *)0x0) {
+ in_stack_00000068 = L"\b";
+ }
+ lVar2 = -1;
+ if (in_stack_00000058 == (char *)0x0) {
+ lVar4 = 5;
+ }
+ else {
+ do {
+ lVar4 = lVar2;
+ lVar2 = lVar4 + 1;
+ } while (in_stack_00000058[lVar2] != '\0');
+ lVar4 = lVar4 + 2;
+ }
+ if (in_stack_00000058 == (char *)0x0) {
+ in_stack_00000058 = "NULL";
+ }
+ WppAutoLogTrace(uVar1,5,0x14,&WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,0xac,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",0x29,local_38,4,
+ in_stack_00000058,lVar4,&stack0x00000060,4,in_stack_00000068,2,pwVar5,wVar3,0);
}
- if (in_stack_00000050 == (wchar_t *)0x0) {
- in_stack_00000050 = L"\b";
- }
- lVar2 = -1;
- if (in_stack_00000040 == (char *)0x0) {
- lVar4 = 5;
- }
- else {
- do {
- lVar4 = lVar2;
- lVar2 = lVar4 + 1;
- } while (in_stack_00000040[lVar2] != '\0');
- lVar4 = lVar4 + 2;
- }
- if (in_stack_00000040 == (char *)0x0) {
- in_stack_00000040 = "NULL";
- }
- WppAutoLogTrace(uVar1,5,0x14,&WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,0xaa,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",0x29,local_28,4,in_stack_00000040
- ,lVar4,&stack0x00000048,4,in_stack_00000050,2,pwVar5,wVar3,0);
return;
}
```
## WPP_RECORDER_SF_sDlLD
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,name,fullname,length,sig,address|
|ratio|0.4|
|i_ratio|0.38|
|m_ratio|0.99|
|b_ratio|0.89|
|match_types|StrUniqueFuncRefsHasher|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|`name`|WPP_RECORDER_SF_sDlLD|WPP_RECORDER_AND_TRACE_SF_sDlLD|
|`fullname`|WPP_RECORDER_SF_sDlLD|WPP_RECORDER_AND_TRACE_SF_sDlLD|
|refcount|3|3|
|`length`|299|307|
|called|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|
|calling|PrjfInstanceSetup|PrjfInstanceSetup|
|paramcount|4|7|
|`address`|1c003e038|14001451c|
|`sig`|undefined __fastcall WPP_RECORDER_SF_sDlLD(undefined8 param_1, byte param_2, undefined8 param_3, undefined2 param_4)|undefined __fastcall WPP_RECORDER_AND_TRACE_SF_sDlLD(undefined2 param_1, char param_2, char param_3, undefined8 param_4, undefined1 param_5, undefined8 param_6, ushort param_7)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### WPP_RECORDER_SF_sDlLD Diff
```diff
--- WPP_RECORDER_SF_sDlLD
+++ WPP_RECORDER_AND_TRACE_SF_sDlLD
@@ -1,15 +1,18 @@
-void WPP_RECORDER_SF_sDlLD(undefined8 param_1,byte param_2,undefined8 param_3,undefined2 param_4)
+void WPP_RECORDER_AND_TRACE_SF_sDlLD
+ (undefined2 param_1,char param_2,char param_3,undefined8 param_4,undefined1 param_5,
+ undefined8 param_6,ushort param_7)
{
- if (((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 8) != 0) &&
- (param_2 <= (byte)WPP_GLOBAL_Control[0x29])) {
- FastWppTraceMessage(&WPP_3f8aed4e88f83f53ec58226552f2c258_Traceguids,param_4,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\prjflt.c",0x2a);
+ if (param_2 != '\0') {
+ FastWppTraceMessage(param_1,param_7,&WPP_3f8aed4e88f83f53ec58226552f2c258_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\prjflt.c");
}
- WppAutoLogTrace(param_1,param_2,4,&WPP_3f8aed4e88f83f53ec58226552f2c258_Traceguids,param_4,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\prjflt.c",0x2a,&stack0x00000038,4,
- &stack0x00000040,4,&stack0x00000048,4,&stack0x00000050,4,0);
+ if (param_3 != '\0') {
+ WppAutoLogTrace(param_4,param_5,4,&WPP_3f8aed4e88f83f53ec58226552f2c258_Traceguids,param_7,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\prjflt.c",0x2a,&stack0x00000050,4,
+ &stack0x00000058,4,&stack0x00000060,4,&stack0x00000068,4,0);
+ }
return;
}
```
## WPP_RECORDER_SF_sD
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,name,fullname,refcount,length,sig,address,calling|
|ratio|0.29|
|i_ratio|0.19|
|m_ratio|0.89|
|b_ratio|0.76|
|match_types|Implied Match|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|`name`|WPP_RECORDER_SF_sD|WPP_RECORDER_AND_TRACE_SF_sD|
|`fullname`|WPP_RECORDER_SF_sD|WPP_RECORDER_AND_TRACE_SF_sD|
|`refcount`|58|57|
|`length`|354|302|
|called|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|
|`calling`|Expand for full list:
PrjfCheckDirectoryContentReparseTags
PrjfClearNegativePathCacheHandler
PrjfCloseFileHandler
PrjfCompleteCommandHandler
PrjfCopyAsPlaceHolder
PrjfCopyFileMetaData
PrjfCreateFileContext
PrjfCreateHardLink
PrjfCreateInstanceTierNode
PrjfCreateMappingEntry
PrjfCreatePathTierNode
PrjfCreatePathTree
PrjfCreateRenameOrLinkCompletionContext
PrjfCreateUnionContext
PrjfDeleteFileHandler
PrjfFsctlDeleteReparsePoint
PrjfGetSetStreamContext
PrjfGetUnionContextByVirtualizationInstanceInfo
PrjfInitProcessInfo
PrjfInstanceSetup
PrjfMappingInsert
PrjfNotifyRenameOrLinkOperation
PrjfOpenFileHandler
PrjfPortConnect
PrjfPortDisconnect
PrjfPortMessage
PrjfPostNetworkQueryOpen
PrjfPostQueryInformation
PrjfPostWrite
PrjfPreSetRenameInformation
PrjfPrepareCommandForFilePath
PrjfPrepareDestinationForRenameOrLink
PrjfProcessPrjReparsePointBounce
PrjfProcessTombstoneBounce
PrjfReadFileHandler
PrjfSendCommand
PrjfSetDeleteDisposition
PrjfSetUnionContext
PrjfValidateFileIdentifier
PrjfValidatePlaceholderInformationMessage
PrjfVerifyAccessAndSetClientPortIfNeeded
PrjfWriteFileDataHandlerExpand for full list:
PrjfCheckDirectoryContentReparseTags
PrjfClearNegativePathCacheHandler
PrjfCloseFileHandler
PrjfCompleteCommandHandler
PrjfCopyAsPlaceHolder
PrjfCopyFileMetaData
PrjfCreateFileContext
PrjfCreateHardLink
PrjfCreateInstanceTierNode
PrjfCreateMappingEntry
PrjfCreatePathTierNode
PrjfCreatePathTree
PrjfCreateRenameOrLinkCompletionContext
PrjfCreateUnionContext
PrjfDeleteFileHandler
PrjfFsctlDeleteReparsePoint
PrjfGetSetStreamContext
PrjfGetUnionContextByVirtualizationInstanceInfo
PrjfInitProcessInfo
PrjfInstanceSetup
PrjfMappingInsert
PrjfNotifyRenameOrLinkOperation
PrjfOpenFileHandler
PrjfPortConnect
PrjfPortDisconnect
PrjfPortMessage
PrjfPostNetworkQueryOpen
PrjfPostQueryInformation
PrjfPostWrite
PrjfPreSetRenameInformation
PrjfPrepareCommandForFilePath
PrjfPrepareDestinationForRenameOrLink
PrjfProcessOpenWithinVirtualizationRoots
PrjfProcessPrjReparsePointBounce
PrjfProcessTombstoneBounce
PrjfReadFileHandler
PrjfSendCommand
PrjfSetDeleteDisposition
PrjfSetUnionContext
PrjfValidateFileIdentifier
PrjfValidatePlaceholderInformationMessage
PrjfVerifyAccessAndSetClientPortIfNeeded
PrjfWriteFileDataHandler
WPPRECORDER.SYS::WppAutoLogTrace|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|
|`calling`|Expand for full list:
DriverEntry
PrjfAddSubContext
PrjfAttachFilterHandler
PrjfBlockFsctlOperation
PrjfCheckAndCancelTransactedOpen
PrjfCheckDirectoryContentReparseTags
PrjfCleanUpRenameLinkTargetTombstone
PrjfClearAttributes
PrjfCompleteCommandHandler
PrjfCopyAsPlaceHolder
PrjfCopyFileBasicInformation
PrjfCopyFileMetaData
PrjfCopyStreamData
PrjfCreateFileContext
PrjfCreateInstanceTierNode
PrjfCreatePathTierNode
PrjfCreateRenameOrLinkCompletionContext
PrjfCreateStreamContext
PrjfCreateSymbolicLink
PrjfCreateSymlinkFromPlaceholderInfoMessage
PrjfCreateTombstone
PrjfDeleteFileHandler
PrjfDeleteTombstoneIfExists
PrjfDoesNameExistInLayer
PrjfEnumerateDirectoryWithMerge
PrjfExpandFile
PrjfFindOrCreateTransactionContext
PrjfFsctlGetFilterFileIdentifier
PrjfFsctlSetReparsePoint
PrjfFsctlStartVirtualizationInstance
PrjfGetInstanceFromVolumeName
PrjfGetSetFileContext
PrjfGetSetStreamContext
PrjfGetSetStreamHandleContext
PrjfGetUnionContext
PrjfGetUnionContextByFileName
PrjfGetUnionContextByFileNameEx
PrjfImpersonateAndAddSymlinkPrivilege
PrjfInitCommunicationPort
PrjfInstanceQueryTeardown
PrjfInstanceSetup
PrjfIsDirectoryEmpty
PrjfIsNameOnPathOfRoot
PrjfManageHydrationOnNonCachedHandle
PrjfMappingInsert
PrjfMergeEnumerationResults
PrjfMungeDirectoryEnumerateWithShortname
PrjfMungeDirectoryEnumerateWithShortnameFileId64
PrjfMungeDirectoryEnumerateWithShortnameFileIdAll
PrjfMungeDirectoryEnumerateWithoutShortname
PrjfMungeDirectoryEnumerateWithoutShortnameFileId64
PrjfMungeDirectoryEnumerateWithoutShortnameFileIdAll
PrjfNormalizeNameComponent
PrjfNotifyRenameOrLinkOperation
PrjfOpenAsReparsePoint
PrjfOpenFileHandler
PrjfOpenReparsePoint
PrjfPopulateDestinationForRenameOrLink
PrjfPopulateFile
PrjfPortConnect
PrjfPortDisconnect
PrjfPortMessage
PrjfPostAcquireForSectionSynchronization
PrjfPostCleanup
PrjfPostCreate
PrjfPostNetworkQueryOpen
PrjfPostSetDispositionInformation
PrjfPostSetInformation
PrjfPreCleanup
PrjfPreCreate
PrjfPreDirectoryControl
PrjfPreSetDispositionInformation
PrjfPreSetLinkInformation
PrjfPreSetRenameInformation
PrjfPrepareCommandForFilePath
PrjfPrepareDestinationForRenameOrLink
PrjfPrepareEnumerationContexts
PrjfPrepareForDelete
PrjfPrepareSourceForRename
PrjfProcessFileDirectoryStatus
PrjfProcessOpenWithinVirtualizationRoots
PrjfProcessPostRenameOrLinkInformation
PrjfProcessPreRenameOrLinkInformation
PrjfProcessPrjReparsePointBounce
PrjfProcessTombstoneBounce
PrjfQueryAttributes
PrjfReadFileHandler
PrjfRelPathToFullPath
PrjfReleaseUnionContext
PrjfRemoveInMemoryTombstone
PrjfRemoveTombstonesFromDirectory
PrjfRevertInMemoryTombstonesForDirectory
PrjfSendCancelCommandInNewThread
PrjfSendCancelCommandWorker
PrjfSendCommand
PrjfSendEndDirectoryEnumerationCommand
PrjfSendNotifyOperationCommand
PrjfSendPostCreateNotifications
PrjfSetConfiguration
PrjfSetDeleteDisposition
PrjfSetParentPlaceHolderFlagsSynchronized
PrjfSetUnionContext
PrjfSetupVolumeInformationHandler
PrjfShouldAutoAttach
PrjfStoreNotificationMappingEntries
PrjfSynchronizeExpansionPreopWithReason
PrjfTelemetryAndTracingInit
PrjfTransactionNotification
PrjfUnload
PrjfUpdatePlaceholderIfNeededHandler
PrjfValidateFileIdentifier
PrjfValidateFilterFileIdentifierInputBuffer
PrjfValidateNamesInEnumeration
PrjfValidateNotificationRoot
PrjfValidatePlaceholderInformationMessage
PrjfVerifyAccessAndSetClientPortIfNeeded
PrjfWriteFileDataHandler
PrjfWritePlaceholderInformationHandlerExpand for full list:
DriverEntry
PrjfAddSubContext
PrjfAttachFilterHandler
PrjfBlockFsctlOperation
PrjfCheckAndCancelTransactedOpen
PrjfCheckDirectoryContentReparseTags
PrjfCleanUpRenameLinkTargetTombstone
PrjfClearAttributes
PrjfCompleteCommandHandler
PrjfCopyAsPlaceHolder
PrjfCopyFileBasicInformation
PrjfCopyFileMetaData
PrjfCopyStreamData
PrjfCreateFileContext
PrjfCreateInstanceTierNode
PrjfCreatePathTierNode
PrjfCreateRenameOrLinkCompletionContext
PrjfCreateStreamContext
PrjfCreateSymbolicLink
PrjfCreateSymlinkFromPlaceholderInfoMessage
PrjfCreateTombstone
PrjfDeleteFileHandler
PrjfDeleteTombstoneIfExists
PrjfDoesNameExistInLayer
PrjfEnumerateDirectoryWithMerge
PrjfExpandFile
PrjfFindOrCreateTransactionContext
PrjfFsctlGetFilterFileIdentifier
PrjfFsctlSetReparsePoint
PrjfFsctlStartVirtualizationInstance
PrjfGetInstanceFromVolumeName
PrjfGetSetFileContext
PrjfGetSetStreamContext
PrjfGetSetStreamHandleContext
PrjfGetUnionContext
PrjfGetUnionContextByFileName
PrjfGetUnionContextByFileNameEx
PrjfImpersonateAndAddSymlinkPrivilege
PrjfInitCommunicationPort
PrjfInstanceQueryTeardown
PrjfInstanceSetup
PrjfIsDirectoryEmpty
PrjfIsNameOnPathOfRoot
PrjfManageHydrationOnNonCachedHandle
PrjfMappingInsert
PrjfMergeEnumerationResults
PrjfMungeDirectoryEnumerateWithShortname
PrjfMungeDirectoryEnumerateWithShortnameFileId64
PrjfMungeDirectoryEnumerateWithShortnameFileIdAll
PrjfMungeDirectoryEnumerateWithoutShortname
PrjfMungeDirectoryEnumerateWithoutShortnameFileId64
PrjfMungeDirectoryEnumerateWithoutShortnameFileIdAll
PrjfNormalizeNameComponent
PrjfNotifyRenameOrLinkOperation
PrjfOpenAsReparsePoint
PrjfOpenFileHandler
PrjfOpenReparsePoint
PrjfPopulateDestinationForRenameOrLink
PrjfPopulateFile
PrjfPortConnect
PrjfPortDisconnect
PrjfPortMessage
PrjfPostAcquireForSectionSynchronization
PrjfPostCleanup
PrjfPostCreate
PrjfPostNetworkQueryOpen
PrjfPostSetDispositionInformation
PrjfPostSetInformation
PrjfPostSetRenameInformation
PrjfPreCleanup
PrjfPreCreate
PrjfPreDirectoryControl
PrjfPreSetDispositionInformation
PrjfPreSetLinkInformation
PrjfPreSetRenameInformation
PrjfPrepareCommandForFilePath
PrjfPrepareDestinationForRenameOrLink
PrjfPrepareEnumerationContexts
PrjfPrepareForDelete
PrjfPrepareSourceForRename
PrjfProcessFileDirectoryStatus
PrjfProcessOpenWithinVirtualizationRoots
PrjfProcessPostRenameOrLinkInformation
PrjfProcessPreRenameOrLinkInformation
PrjfProcessPrjReparsePointBounce
PrjfProcessTombstoneBounce
PrjfQueryAttributes
PrjfReadFileHandler
PrjfRelPathToFullPath
PrjfReleaseUnionContext
PrjfRemoveInMemoryTombstone
PrjfRemoveTombstonesFromDirectory
PrjfRevertInMemoryTombstonesForDirectory
PrjfSendCancelCommandInNewThread
PrjfSendCancelCommandWorker
PrjfSendCommand
PrjfSendEndDirectoryEnumerationCommand
PrjfSendNotifyOperationCommand
PrjfSendPostCreateNotifications
PrjfSetConfiguration
PrjfSetDeleteDisposition
PrjfSetParentPlaceHolderFlagsSynchronized
PrjfSetUnionContext
PrjfSetupVolumeInformationHandler
PrjfShouldAutoAttach
PrjfSleepOnTestSettingFlagsForTests
PrjfStoreNotificationMappingEntries
PrjfSynchronizeExpansionPreopWithReason
PrjfTelemetryAndTracingInit
PrjfTransactionNotification
PrjfUnload
PrjfUpdatePlaceholderIfNeededHandler
PrjfValidateAndGetGlobalVolumePath
PrjfValidateFileIdentifier
PrjfValidateFilterFileIdentifierInputBuffer
PrjfValidateNamesInEnumeration
PrjfValidateNotificationRoot
PrjfValidatePlaceholderInformationMessage
PrjfVerifyAccessAndSetClientPortIfNeeded
PrjfWriteFileDataHandler
PrjfWritePlaceholderInformationHandler
WPPRECORDER.SYS::WppAutoLogTrace|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|
|calling|Expand for full list:
PrjfAddInMemoryTombstone
PrjfCopyAsPlaceHolder
PrjfCopyStreamData
PrjfCreateHardLink
PrjfCreatePathTierNode
PrjfCreateRenameOrLinkCompletionContext
PrjfCreateSymbolicLink
PrjfDecideUpdateDeleteOnFileStateAndUpdateFlags
PrjfDeleteTombstoneIfExists
PrjfDoesNameExistInLayer
PrjfDoesRootHaveShortNameComponent
PrjfExpandAndPend
PrjfExpandAndWait
PrjfExpandFile
PrjfFlushAndUpdateDiskStateWorker
PrjfFsctlSetReparsePoint
PrjfGetNotificationMask
PrjfIsFileObjectWithinActiveVirtualizationRoots
PrjfLaunchExpansion
PrjfManageHydrationOnNonCachedHandle
PrjfNormalizeNameComponent
PrjfOpenAndCheckEmptyPartialDirectory
PrjfOpenFileHandler
PrjfOpenParentPlaceHolder
PrjfOpenPlaceHolder
PrjfOpenReparsePoint
PrjfPopulateFile
PrjfPostCreate
PrjfPostWrite
PrjfProcessOpenWithinVirtualizationRoots
PrjfProcessPrjReparsePointBounce
PrjfProcessTombstoneBounce
PrjfRemoveInMemoryTombstone
PrjfRemoveSparse
PrjfSendEndDirectoryEnumerationCommand
PrjfSendGetDirectoryEnumerationCommand
PrjfSendGetFileStreamCommand
PrjfSendGetPlaceholderInformationCommand
PrjfSendNotifyOperationCommand
PrjfSendQueryFileNameCommand
PrjfSendStartDirectoryEnumerationCommand
PrjfSetDeleteDisposition
PrjfTelemetryPostExpansionComplete
PrjfUntagFile
PrjfWriteFileDataHandlerExpand for full list:
PrjfAddInMemoryTombstone
PrjfCopyAsPlaceHolder
PrjfCopyStreamData
PrjfCreateHardLink
PrjfCreatePathTierNode
PrjfCreateRenameOrLinkCompletionContext
PrjfCreateSymbolicLink
PrjfDecideUpdateDeleteOnFileStateAndUpdateFlags
PrjfDeleteTombstoneIfExists
PrjfDoesNameExistInLayer
PrjfDoesRootHaveShortNameComponent
PrjfExpandAndPend
PrjfExpandAndWait
PrjfExpandFile
PrjfFlushAndUpdateDiskStateWorker
PrjfFsctlSetReparsePoint
PrjfGetNotificationMask
PrjfIsFileObjectWithinActiveVirtualizationRoots
PrjfLaunchExpansion
PrjfManageHydrationOnNonCachedHandle
PrjfNormalizeNameComponent
PrjfOpenAndCheckEmptyPartialDirectory
PrjfOpenFileHandler
PrjfOpenParentPlaceHolder
PrjfOpenPlaceHolder
PrjfOpenReparsePoint
PrjfPopulateFile
PrjfPostCreate
PrjfPostWrite
PrjfProcessOpenWithinVirtualizationRoots
PrjfProcessPrjReparsePointBounce
PrjfProcessTombstoneBounce
PrjfRemoveInMemoryTombstone
PrjfRemoveSparse
PrjfSendEndDirectoryEnumerationCommand
PrjfSendGetDirectoryEnumerationCommand
PrjfSendGetFileStreamCommand
PrjfSendGetPlaceholderInformationCommand
PrjfSendNotifyOperationCommand
PrjfSendQueryFileNameCommand
PrjfSendStartDirectoryEnumerationCommand
PrjfSetDeleteDisposition
PrjfTelemetryPostExpansionComplete
PrjfUntagFile
PrjfWriteFileDataHandler
WPPRECORDER.SYS::WppAutoLogTrace|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|
|`calling`|Expand for full list:
PrjfAddInMemoryTombstone
PrjfCopyAsPlaceHolder
PrjfCopyStreamData
PrjfCreateHardLink
PrjfCreatePathTierNode
PrjfCreateRenameOrLinkCompletionContext
PrjfCreateSymbolicLink
PrjfDecideUpdateDeleteOnFileStateAndUpdateFlags
PrjfDeleteTombstoneIfExists
PrjfDoesNameExistInLayer
PrjfDoesRootHaveShortNameComponent
PrjfExpandAndPend
PrjfExpandAndWait
PrjfExpandFile
PrjfFlushAndUpdateDiskStateWorker
PrjfFsctlSetReparsePoint
PrjfGetNotificationMask
PrjfIsFileObjectWithinActiveVirtualizationRoots
PrjfLaunchExpansion
PrjfManageHydrationOnNonCachedHandle
PrjfNormalizeNameComponent
PrjfOpenAndCheckEmptyPartialDirectory
PrjfOpenFileHandler
PrjfOpenParentPlaceHolder
PrjfOpenPlaceHolder
PrjfOpenReparsePoint
PrjfPopulateFile
PrjfPostCreate
PrjfPostWrite
PrjfProcessOpenWithinVirtualizationRoots
PrjfProcessPrjReparsePointBounce
PrjfProcessTombstoneBounce
PrjfRemoveInMemoryTombstone
PrjfRemoveSparse
PrjfSendEndDirectoryEnumerationCommand
PrjfSendGetDirectoryEnumerationCommand
PrjfSendGetFileStreamCommand
PrjfSendGetPlaceholderInformationCommand
PrjfSendNotifyOperationCommand
PrjfSendQueryFileNameCommand
PrjfSendStartDirectoryEnumerationCommand
PrjfSetDeleteDisposition
PrjfTelemetryPostExpansionComplete
PrjfUntagFile
PrjfWriteFileDataHandlerExpand for full list:
DriverEntry
PrjfAddSubContext
PrjfAttachFilterHandler
PrjfBlockFsctlOperation
PrjfCheckAndCancelTransactedOpen
PrjfCheckDirectoryContentReparseTags
PrjfCleanUpRenameLinkTargetTombstone
PrjfClearAttributes
PrjfCompleteCommandHandler
PrjfCopyAsPlaceHolder
PrjfCopyFileBasicInformation
PrjfCopyFileMetaData
PrjfCopyStreamData
PrjfCreateFileContext
PrjfCreateInstanceTierNode
PrjfCreatePathTierNode
PrjfCreateRenameOrLinkCompletionContext
PrjfCreateStreamContext
PrjfCreateSymbolicLink
PrjfCreateSymlinkFromPlaceholderInfoMessage
PrjfCreateTombstone
PrjfDeleteFileHandler
PrjfDeleteTombstoneIfExists
PrjfDoesNameExistInLayer
PrjfEnumerateDirectoryWithMerge
PrjfExpandFile
PrjfFindOrCreateTransactionContext
PrjfFsctlGetFilterFileIdentifier
PrjfFsctlSetReparsePoint
PrjfFsctlStartVirtualizationInstance
PrjfGetInstanceFromVolumeName
PrjfGetSetFileContext
PrjfGetSetStreamContext
PrjfGetSetStreamHandleContext
PrjfGetUnionContext
PrjfGetUnionContextByFileName
PrjfGetUnionContextByFileNameEx
PrjfImpersonateAndAddSymlinkPrivilege
PrjfInitCommunicationPort
PrjfInstanceQueryTeardown
PrjfInstanceSetup
PrjfIsDirectoryEmpty
PrjfIsNameOnPathOfRoot
PrjfManageHydrationOnNonCachedHandle
PrjfMappingInsert
PrjfMergeEnumerationResults
PrjfMungeDirectoryEnumerateWithShortname
PrjfMungeDirectoryEnumerateWithShortnameFileId64
PrjfMungeDirectoryEnumerateWithShortnameFileIdAll
PrjfMungeDirectoryEnumerateWithoutShortname
PrjfMungeDirectoryEnumerateWithoutShortnameFileId64
PrjfMungeDirectoryEnumerateWithoutShortnameFileIdAll
PrjfNormalizeNameComponent
PrjfNotifyRenameOrLinkOperation
PrjfOpenAsReparsePoint
PrjfOpenFileHandler
PrjfOpenReparsePoint
PrjfPopulateDestinationForRenameOrLink
PrjfPopulateFile
PrjfPortConnect
PrjfPortDisconnect
PrjfPortMessage
PrjfPostAcquireForSectionSynchronization
PrjfPostCleanup
PrjfPostCreate
PrjfPostNetworkQueryOpen
PrjfPostSetDispositionInformation
PrjfPostSetInformation
PrjfPostSetRenameInformation
PrjfPreCleanup
PrjfPreCreate
PrjfPreDirectoryControl
PrjfPreSetDispositionInformation
PrjfPreSetLinkInformation
PrjfPreSetRenameInformation
PrjfPrepareCommandForFilePath
PrjfPrepareDestinationForRenameOrLink
PrjfPrepareEnumerationContexts
PrjfPrepareForDelete
PrjfPrepareSourceForRename
PrjfProcessFileDirectoryStatus
PrjfProcessOpenWithinVirtualizationRoots
PrjfProcessPostRenameOrLinkInformation
PrjfProcessPreRenameOrLinkInformation
PrjfProcessPrjReparsePointBounce
PrjfProcessTombstoneBounce
PrjfQueryAttributes
PrjfReadFileHandler
PrjfRelPathToFullPath
PrjfReleaseUnionContext
PrjfRemoveInMemoryTombstone
PrjfRemoveTombstonesFromDirectory
PrjfRevertInMemoryTombstonesForDirectory
PrjfSendCancelCommandInNewThread
PrjfSendCancelCommandWorker
PrjfSendCommand
PrjfSendEndDirectoryEnumerationCommand
PrjfSendNotifyOperationCommand
PrjfSendPostCreateNotifications
PrjfSetConfiguration
PrjfSetDeleteDisposition
PrjfSetParentPlaceHolderFlagsSynchronized
PrjfSetUnionContext
PrjfSetupVolumeInformationHandler
PrjfShouldAutoAttach
PrjfSleepOnTestSettingFlagsForTests
PrjfStoreNotificationMappingEntries
PrjfSynchronizeExpansionPreopWithReason
PrjfTelemetryAndTracingInit
PrjfTransactionNotification
PrjfUnload
PrjfUpdatePlaceholderIfNeededHandler
PrjfValidateAndGetGlobalVolumePath
PrjfValidateFileIdentifier
PrjfValidateFilterFileIdentifierInputBuffer
PrjfValidateNamesInEnumeration
PrjfValidateNotificationRoot
PrjfValidatePlaceholderInformationMessage
PrjfVerifyAccessAndSetClientPortIfNeeded
PrjfWriteFileDataHandler
PrjfWritePlaceholderInformationHandler
Feature_EnableTestConfigViaFilterPort__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::KeDelayExecutionThread
NTOSKRNL.EXE::PsGetProcessId
PrjfGetUnionContextByFileName
PrjfReleaseUnionContext
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDDD
WPP_RECORDER_AND_TRACE_SF_sDDdd|
|`calling`|PrjfPostSetInformation
PrjfPreCleanup
PrjfPreSetInformation
PrjfProcessTombstoneBounce
PrjfSetDeleteDisposition
PrjfUpdatePlaceholderIfNeededHandler|PrjfPostSetRenameInformation
PrjfPreCleanup
PrjfPreSetInformation
PrjfProcessTombstoneBounce
PrjfSetDeleteDisposition
PrjfUpdatePlaceholderIfNeededHandler|
|paramcount|0|5|
|`address`|1c0005870|1400094b0|
|`sig`|undefined __fastcall _tlgDefineProvider_annotation__Tlgmtakm_hTelemetryAssertDiagTrackProv(void)|undefined __fastcall PrjfSleepOnTestSettingFlagsForTests(uint param_1, undefined8 * param_2, longlong param_3, undefined8 param_4, undefined8 param_5)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### _tlgDefineProvider_annotation__Tlgmtakm_hTelemetryAssertDiagTrackProv Called Diff
```diff
--- _tlgDefineProvider_annotation__Tlgmtakm_hTelemetryAssertDiagTrackProv called
+++ PrjfSleepOnTestSettingFlagsForTests called
@@ -0,0 +1,9 @@
+FLTMGR.SYS::FltGetRequestorProcess
+Feature_EnableTestConfigViaFilterPort__private_IsEnabledDeviceUsageNoInline
+NTOSKRNL.EXE::KeDelayExecutionThread
+NTOSKRNL.EXE::PsGetProcessId
+PrjfGetUnionContextByFileName
+PrjfReleaseUnionContext
+WPP_RECORDER_AND_TRACE_SF_sDD
+WPP_RECORDER_AND_TRACE_SF_sDDD
+WPP_RECORDER_AND_TRACE_SF_sDDdd
```
### _tlgDefineProvider_annotation__Tlgmtakm_hTelemetryAssertDiagTrackProv Calling Diff
```diff
--- _tlgDefineProvider_annotation__Tlgmtakm_hTelemetryAssertDiagTrackProv calling
+++ PrjfSleepOnTestSettingFlagsForTests calling
@@ -1 +1 @@
-PrjfPostSetInformation
+PrjfPostSetRenameInformation
```
### _tlgDefineProvider_annotation__Tlgmtakm_hTelemetryAssertDiagTrackProv Diff
```diff
--- _tlgDefineProvider_annotation__Tlgmtakm_hTelemetryAssertDiagTrackProv
+++ PrjfSleepOnTestSettingFlagsForTests
@@ -1,7 +1,85 @@
-void _tlgDefineProvider_annotation__Tlgmtakm_hTelemetryAssertDiagTrackProv(void)
+void PrjfSleepOnTestSettingFlagsForTests
+ (uint param_1,undefined8 *param_2,longlong param_3,undefined8 param_4,
+ undefined8 param_5)
{
+ bool bVar1;
+ bool bVar2;
+ uint uVar3;
+ ulonglong uVar4;
+ undefined8 uVar5;
+
+ bVar2 = false;
+ bVar1 = false;
+ uVar4 = Feature_EnableTestConfigViaFilterPort__private_IsEnabledDeviceUsageNoInline();
+ if ((int)uVar4 != 0) {
+ return;
+ }
+ if (param_2 == (undefined8 *)0x0) {
+ param_2 = PrjfGetUnionContextByFileName(param_3,param_4,(ushort *)0x0,(undefined1 *)0x0);
+ if (param_2 == (undefined8 *)0x0) {
+ if (((DAT_0 & 0x20) == 0) &&
+ ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) {
+ return;
+ }
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x315,DAT_0 & 0x20,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),3,0x15,0xb0,
+ &WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
+ return;
+ }
+ bVar2 = true;
+ }
+ if (param_3 != 0) {
+ uVar5 = FltGetRequestorProcess(param_3);
+ uVar3 = PsGetProcessId(uVar5);
+ if (uVar3 != *(uint *)((longlong)param_2 + 0x324)) {
+ if (((DAT_0 & 0x20) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDDdd
+ ((ulonglong)*(uint *)((longlong)param_2 + 0x324),DAT_0 & 0x20,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40));
+ }
+ goto LAB_1;
+ }
+ }
+ if (((DAT_2 & 0x20) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDDD
+ (0x415,DAT_2 & 0x20,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),4,0x15,0xb2,
+ &WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
+ }
+ param_5._4_4_ = 0xffffffff;
+ param_5._0_4_ = 0xfff0bdc0;
+ while( true ) {
+ if ((*(uint *)(param_2 + 100) & param_1) == 0) break;
+ KeDelayExecutionThread(0,0,¶m_5);
+ bVar1 = true;
+ }
+ param_5 = CONCAT44(param_5._4_4_,(undefined4)param_5);
+ if (bVar1) {
+ if (((DAT_2 & 0x20) != 0) ||
+ (param_5 = CONCAT44(param_5._4_4_,(undefined4)param_5),
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x415,DAT_2 & 0x20,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),4,0x15,0xb3,
+ &WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
+ }
+ }
+LAB_1:
+ if (bVar2) {
+ PrjfReleaseUnionContext((longlong)param_2);
+ }
return;
}
```
## WPP_RECORDER_SF_sDd
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,name,fullname,refcount,length,sig,address,calling|
|ratio|0.26|
|i_ratio|0.24|
|m_ratio|0.94|
|b_ratio|0.46|
|match_types|Implied Match|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|`name`|WPP_RECORDER_SF_sDd|WPP_RECORDER_AND_TRACE_SF_sDdiiZ|
|`fullname`|WPP_RECORDER_SF_sDd|WPP_RECORDER_AND_TRACE_SF_sDdiiZ|
|`refcount`|204|2|
|`length`|394|532|
|called|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|
|`calling`|Expand for full list:
DriverEntry
PrjfAddSubContext
PrjfAttachFilterHandler
PrjfBlockFsctlOperation
PrjfCheckAndCancelTransactedOpen
PrjfCheckDirectoryContentReparseTags
PrjfCleanUpRenameLinkTargetTombstone
PrjfClearAttributes
PrjfCompleteCommandHandler
PrjfCopyAsPlaceHolder
PrjfCopyFileBasicInformation
PrjfCopyFileMetaData
PrjfCopyStreamData
PrjfCreateFileContext
PrjfCreateInstanceTierNode
PrjfCreatePathTierNode
PrjfCreateRenameOrLinkCompletionContext
PrjfCreateStreamContext
PrjfCreateSymbolicLink
PrjfCreateSymlinkFromPlaceholderInfoMessage
PrjfCreateTombstone
PrjfDeleteFileHandler
PrjfDeleteTombstoneIfExists
PrjfDoesNameExistInLayer
PrjfEnumerateDirectoryWithMerge
PrjfExpandFile
PrjfFindOrCreateTransactionContext
PrjfFsctlGetFilterFileIdentifier
PrjfFsctlSetReparsePoint
PrjfFsctlStartVirtualizationInstance
PrjfGetInstanceFromVolumeName
PrjfGetSetFileContext
PrjfGetSetStreamContext
PrjfGetSetStreamHandleContext
PrjfGetUnionContext
PrjfGetUnionContextByFileName
PrjfGetUnionContextByFileNameEx
PrjfImpersonateAndAddSymlinkPrivilege
PrjfInitCommunicationPort
PrjfInstanceQueryTeardown
PrjfInstanceSetup
PrjfIsDirectoryEmpty
PrjfIsNameOnPathOfRoot
PrjfManageHydrationOnNonCachedHandle
PrjfMappingInsert
PrjfMergeEnumerationResults
PrjfMungeDirectoryEnumerateWithShortname
PrjfMungeDirectoryEnumerateWithShortnameFileId64
PrjfMungeDirectoryEnumerateWithShortnameFileIdAll
PrjfMungeDirectoryEnumerateWithoutShortname
PrjfMungeDirectoryEnumerateWithoutShortnameFileId64
PrjfMungeDirectoryEnumerateWithoutShortnameFileIdAll
PrjfNormalizeNameComponent
PrjfNotifyRenameOrLinkOperation
PrjfOpenAsReparsePoint
PrjfOpenFileHandler
PrjfOpenReparsePoint
PrjfPopulateDestinationForRenameOrLink
PrjfPopulateFile
PrjfPortConnect
PrjfPortDisconnect
PrjfPortMessage
PrjfPostAcquireForSectionSynchronization
PrjfPostCleanup
PrjfPostCreate
PrjfPostNetworkQueryOpen
PrjfPostSetDispositionInformation
PrjfPostSetInformation
PrjfPreCleanup
PrjfPreCreate
PrjfPreDirectoryControl
PrjfPreSetDispositionInformation
PrjfPreSetLinkInformation
PrjfPreSetRenameInformation
PrjfPrepareCommandForFilePath
PrjfPrepareDestinationForRenameOrLink
PrjfPrepareEnumerationContexts
PrjfPrepareForDelete
PrjfPrepareSourceForRename
PrjfProcessFileDirectoryStatus
PrjfProcessOpenWithinVirtualizationRoots
PrjfProcessPostRenameOrLinkInformation
PrjfProcessPreRenameOrLinkInformation
PrjfProcessPrjReparsePointBounce
PrjfProcessTombstoneBounce
PrjfQueryAttributes
PrjfReadFileHandler
PrjfRelPathToFullPath
PrjfReleaseUnionContext
PrjfRemoveInMemoryTombstone
PrjfRemoveTombstonesFromDirectory
PrjfRevertInMemoryTombstonesForDirectory
PrjfSendCancelCommandInNewThread
PrjfSendCancelCommandWorker
PrjfSendCommand
PrjfSendEndDirectoryEnumerationCommand
PrjfSendNotifyOperationCommand
PrjfSendPostCreateNotifications
PrjfSetConfiguration
PrjfSetDeleteDisposition
PrjfSetParentPlaceHolderFlagsSynchronized
PrjfSetUnionContext
PrjfSetupVolumeInformationHandler
PrjfShouldAutoAttach
PrjfStoreNotificationMappingEntries
PrjfSynchronizeExpansionPreopWithReason
PrjfTelemetryAndTracingInit
PrjfTransactionNotification
PrjfUnload
PrjfUpdatePlaceholderIfNeededHandler
PrjfValidateFileIdentifier
PrjfValidateFilterFileIdentifierInputBuffer
PrjfValidateNamesInEnumeration
PrjfValidateNotificationRoot
PrjfValidatePlaceholderInformationMessage
PrjfVerifyAccessAndSetClientPortIfNeeded
PrjfWriteFileDataHandler
PrjfWritePlaceholderInformationHandler
WPPRECORDER.SYS::WppAutoLogTrace|FLTMGR.SYS::FltAllocateContext
FLTMGR.SYS::FltReferenceContext
FLTMGR.SYS::FltReleaseContext
NTOSKRNL.EXE::ExUuidCreate
WPP_RECORDER_AND_TRACE_SF_sDD
__security_check_cookie|
|`calling`|Expand for full list:
DriverEntry
PrjfAddSubContext
PrjfAttachFilterHandler
PrjfBlockFsctlOperation
PrjfCheckAndCancelTransactedOpen
PrjfCheckDirectoryContentReparseTags
PrjfCleanUpRenameLinkTargetTombstone
PrjfClearAttributes
PrjfCompleteCommandHandler
PrjfCopyAsPlaceHolder
PrjfCopyFileBasicInformation
PrjfCopyFileMetaData
PrjfCopyStreamData
PrjfCreateFileContext
PrjfCreateInstanceTierNode
PrjfCreatePathTierNode
PrjfCreateRenameOrLinkCompletionContext
PrjfCreateStreamContext
PrjfCreateSymbolicLink
PrjfCreateSymlinkFromPlaceholderInfoMessage
PrjfCreateTombstone
PrjfDeleteFileHandler
PrjfDeleteTombstoneIfExists
PrjfDoesNameExistInLayer
PrjfEnumerateDirectoryWithMerge
PrjfExpandFile
PrjfFindOrCreateTransactionContext
PrjfFsctlGetFilterFileIdentifier
PrjfFsctlSetReparsePoint
PrjfFsctlStartVirtualizationInstance
PrjfGetInstanceFromVolumeName
PrjfGetSetFileContext
PrjfGetSetStreamContext
PrjfGetSetStreamHandleContext
PrjfGetUnionContext
PrjfGetUnionContextByFileName
PrjfGetUnionContextByFileNameEx
PrjfImpersonateAndAddSymlinkPrivilege
PrjfInitCommunicationPort
PrjfInstanceQueryTeardown
PrjfInstanceSetup
PrjfIsDirectoryEmpty
PrjfIsNameOnPathOfRoot
PrjfManageHydrationOnNonCachedHandle
PrjfMappingInsert
PrjfMergeEnumerationResults
PrjfMungeDirectoryEnumerateWithShortname
PrjfMungeDirectoryEnumerateWithShortnameFileId64
PrjfMungeDirectoryEnumerateWithShortnameFileIdAll
PrjfMungeDirectoryEnumerateWithoutShortname
PrjfMungeDirectoryEnumerateWithoutShortnameFileId64
PrjfMungeDirectoryEnumerateWithoutShortnameFileIdAll
PrjfNormalizeNameComponent
PrjfNotifyRenameOrLinkOperation
PrjfOpenAsReparsePoint
PrjfOpenFileHandler
PrjfOpenReparsePoint
PrjfPopulateDestinationForRenameOrLink
PrjfPopulateFile
PrjfPortConnect
PrjfPortDisconnect
PrjfPortMessage
PrjfPostAcquireForSectionSynchronization
PrjfPostCleanup
PrjfPostCreate
PrjfPostNetworkQueryOpen
PrjfPostSetDispositionInformation
PrjfPostSetInformation
PrjfPreCleanup
PrjfPreCreate
PrjfPreDirectoryControl
PrjfPreSetDispositionInformation
PrjfPreSetLinkInformation
PrjfPreSetRenameInformation
PrjfPrepareCommandForFilePath
PrjfPrepareDestinationForRenameOrLink
PrjfPrepareEnumerationContexts
PrjfPrepareForDelete
PrjfPrepareSourceForRename
PrjfProcessFileDirectoryStatus
PrjfProcessOpenWithinVirtualizationRoots
PrjfProcessPostRenameOrLinkInformation
PrjfProcessPreRenameOrLinkInformation
PrjfProcessPrjReparsePointBounce
PrjfProcessTombstoneBounce
PrjfQueryAttributes
PrjfReadFileHandler
PrjfRelPathToFullPath
PrjfReleaseUnionContext
PrjfRemoveInMemoryTombstone
PrjfRemoveTombstonesFromDirectory
PrjfRevertInMemoryTombstonesForDirectory
PrjfSendCancelCommandInNewThread
PrjfSendCancelCommandWorker
PrjfSendCommand
PrjfSendEndDirectoryEnumerationCommand
PrjfSendNotifyOperationCommand
PrjfSendPostCreateNotifications
PrjfSetConfiguration
PrjfSetDeleteDisposition
PrjfSetParentPlaceHolderFlagsSynchronized
PrjfSetUnionContext
PrjfSetupVolumeInformationHandler
PrjfShouldAutoAttach
PrjfStoreNotificationMappingEntries
PrjfSynchronizeExpansionPreopWithReason
PrjfTelemetryAndTracingInit
PrjfTransactionNotification
PrjfUnload
PrjfUpdatePlaceholderIfNeededHandler
PrjfValidateFileIdentifier
PrjfValidateFilterFileIdentifierInputBuffer
PrjfValidateNamesInEnumeration
PrjfValidateNotificationRoot
PrjfValidatePlaceholderInformationMessage
PrjfVerifyAccessAndSetClientPortIfNeeded
PrjfWriteFileDataHandler
PrjfWritePlaceholderInformationHandler
WPPRECORDER.SYS::WppAutoLogTrace|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|
|calling|PrjfSendCancelCommandWorker|PrjfSendCancelCommandWorker|
|paramcount|1|4|
|`address`|1c003c1c0|1400120b4|
|`sig`|undefined __fastcall WPP_RECORDER_SF_sDld(undefined8 param_1)|undefined __fastcall WPP_RECORDER_AND_TRACE_SF_sDld(undefined8 param_1, char param_2, char param_3, undefined8 param_4)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### WPP_RECORDER_SF_sDld Diff
```diff
--- WPP_RECORDER_SF_sDld
+++ WPP_RECORDER_AND_TRACE_SF_sDld
@@ -1,18 +1,19 @@
-void WPP_RECORDER_SF_sDld(undefined8 param_1)
+void WPP_RECORDER_AND_TRACE_SF_sDld(undefined8 param_1,char param_2,char param_3,undefined8 param_4)
{
undefined4 local_18 [4];
- local_18[0] = 0xef5;
- if (((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x2000) != 0) && (1 < (byte)WPP_GLOBAL_Control[0x29])
- ) {
- FastWppTraceMessage(&WPP_3ccab5108a9538d17a865fde27ef339f_Traceguids,0x87,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c",0x2b);
+ local_18[0] = 0xfec;
+ if (param_2 != '\0') {
+ FastWppTraceMessage(0x20e,0x91,&WPP_39279db927ae337b8503ecc20725ff46_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c");
}
- WppAutoLogTrace(param_1,2,0xe,&WPP_3ccab5108a9538d17a865fde27ef339f_Traceguids,0x87,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c",0x2b,local_18,4,
- &stack0x00000040,4,&stack0x00000048,4,0);
+ if (param_3 != '\0') {
+ WppAutoLogTrace(param_4,2,0xe,&WPP_39279db927ae337b8503ecc20725ff46_Traceguids,0x91,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c",0x2b,local_18,4,
+ &stack0x00000058,4,&stack0x00000060,4,0);
+ }
return;
}
```
## WPP_RECORDER_SF_sDDd
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,name,fullname,refcount,length,sig,address,calling|
|ratio|0.29|
|i_ratio|0.17|
|m_ratio|0.91|
|b_ratio|0.81|
|match_types|Implied Match|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|`name`|WPP_RECORDER_SF_sDDd|WPP_RECORDER_AND_TRACE_SF_sDDD|
|`fullname`|WPP_RECORDER_SF_sDDd|WPP_RECORDER_AND_TRACE_SF_sDDD|
|`refcount`|7|8|
|`length`|438|372|
|called|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|
|`calling`|PrjfFsctlStartVirtualizationInstance
PrjfInstanceSetup
PrjfManageHydrationOnNonCachedHandle
PrjfPortMessage
PrjfPostCleanup
PrjfSendNotifyOperationCommand|PrjfFsctlStartVirtualizationInstance
PrjfInstanceSetup
PrjfManageHydrationOnNonCachedHandle
PrjfPortMessage
PrjfPostCleanup
PrjfSendNotifyOperationCommand
PrjfSleepOnTestSettingFlagsForTests|
|paramcount|6|9|
|`address`|1c0039f44|14000fe8c|
|`sig`|undefined __fastcall WPP_RECORDER_SF_sDDd(undefined8 param_1, byte param_2, uint param_3, undefined2 param_4, undefined8 param_5, char * param_6)|undefined __fastcall WPP_RECORDER_AND_TRACE_SF_sDDD(undefined2 param_1, char param_2, char param_3, undefined8 param_4, undefined1 param_5, undefined4 param_6, ushort param_7, undefined8 param_8, char * param_9)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### WPP_RECORDER_SF_sDDd Calling Diff
```diff
--- WPP_RECORDER_SF_sDDd calling
+++ WPP_RECORDER_AND_TRACE_SF_sDDD calling
@@ -6,0 +7 @@
+PrjfSleepOnTestSettingFlagsForTests
```
### WPP_RECORDER_SF_sDDd Diff
```diff
--- WPP_RECORDER_SF_sDDd
+++ WPP_RECORDER_AND_TRACE_SF_sDDD
@@ -1,50 +1,44 @@
-void WPP_RECORDER_SF_sDDd
- (undefined8 param_1,byte param_2,uint param_3,undefined2 param_4,undefined8 param_5,
- char *param_6)
+void WPP_RECORDER_AND_TRACE_SF_sDDD
+ (undefined2 param_1,char param_2,char param_3,undefined8 param_4,undefined1 param_5,
+ undefined4 param_6,ushort param_7,undefined8 param_8,char *param_9)
{
- char *pcVar1;
+ longlong lVar1;
longlong lVar2;
- longlong lVar3;
+ char *pcVar3;
- if (((*(uint *)(WPP_GLOBAL_Control +
- ((ulonglong)(param_3 - 1 >> 5 & 0x7ff) + (ulonglong)(param_3 >> 0x10) * 0x14) * 4 +
- 0x2c) >> (param_3 - 1 & 0x1f) & 1) != 0) &&
- (param_2 <= (byte)WPP_GLOBAL_Control[(ulonglong)(param_3 >> 0x10) * 0x50 + 0x29])) {
- if (param_6 == (char *)0x0) {
- lVar3 = 5;
+ if (param_2 != '\0') {
+ if (param_9 != (char *)0x0) {
+ lVar1 = -1;
+ do {
+ lVar1 = lVar1 + 1;
+ } while (param_9[lVar1] != '\0');
+ }
+ pcVar3 = param_9;
+ if (param_9 == (char *)0x0) {
+ pcVar3 = "NULL";
+ }
+ FastWppTraceMessage(param_1,param_7,param_8,pcVar3);
+ }
+ if (param_3 != '\0') {
+ lVar1 = -1;
+ if (param_9 == (char *)0x0) {
+ lVar2 = 5;
}
else {
- lVar2 = -1;
do {
- lVar3 = lVar2;
- lVar2 = lVar3 + 1;
- } while (param_6[lVar2] != '\0');
- lVar3 = lVar3 + 2;
+ lVar2 = lVar1;
+ lVar1 = lVar2 + 1;
+ } while (param_9[lVar1] != '\0');
+ lVar2 = lVar2 + 2;
}
- pcVar1 = param_6;
- if (param_6 == (char *)0x0) {
- pcVar1 = "NULL";
+ if (param_9 == (char *)0x0) {
+ param_9 = "NULL";
}
- FastWppTraceMessage(param_5,param_4,pcVar1,lVar3);
+ WppAutoLogTrace(param_4,param_5,param_6,param_8,param_7,param_9,lVar2,&stack0x00000050,4,
+ &stack0x00000058,4,&stack0x00000060,4,0);
}
- lVar3 = -1;
- if (param_6 == (char *)0x0) {
- lVar2 = 5;
- }
- else {
- do {
- lVar2 = lVar3;
- lVar3 = lVar2 + 1;
- } while (param_6[lVar3] != '\0');
- lVar2 = lVar2 + 2;
- }
- if (param_6 == (char *)0x0) {
- param_6 = "NULL";
- }
- WppAutoLogTrace(param_1,param_2,param_3,param_5,param_4,param_6,lVar2,&stack0x00000038,4,
- &stack0x00000040,4,&stack0x00000048,4,0);
return;
}
```
## WPP_RECORDER_SF_sDiD
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,name,fullname,length,sig,address|
|ratio|0.45|
|i_ratio|0.34|
|m_ratio|0.97|
|b_ratio|0.89|
|match_types|Implied Match|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|`name`|WPP_RECORDER_SF_sDiD|WPP_RECORDER_AND_TRACE_SF_sDiD|
|`fullname`|WPP_RECORDER_SF_sDiD|WPP_RECORDER_AND_TRACE_SF_sDiD|
|refcount|2|2|
|`length`|280|286|
|called|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|
|calling|PrjfManageHydrationOnNonCachedHandle|PrjfManageHydrationOnNonCachedHandle|
|paramcount|1|4|
|`address`|1c003d8e4|140013afc|
|`sig`|undefined __fastcall WPP_RECORDER_SF_sDiD(undefined8 param_1)|undefined __fastcall WPP_RECORDER_AND_TRACE_SF_sDiD(undefined8 param_1, char param_2, char param_3, undefined8 param_4)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### WPP_RECORDER_SF_sDiD Diff
```diff
--- WPP_RECORDER_SF_sDiD
+++ WPP_RECORDER_AND_TRACE_SF_sDiD
@@ -1,18 +1,19 @@
-void WPP_RECORDER_SF_sDiD(undefined8 param_1)
+void WPP_RECORDER_AND_TRACE_SF_sDiD(undefined8 param_1,char param_2,char param_3,undefined8 param_4)
{
undefined4 local_18 [4];
- local_18[0] = 0x1f6b;
- if (((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x2000) != 0) && (1 < (byte)WPP_GLOBAL_Control[0x29])
- ) {
- FastWppTraceMessage(&WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,0xb8,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",0x29);
+ local_18[0] = 0x1ff4;
+ if (param_2 != '\0') {
+ FastWppTraceMessage(0x20e,0xbd,&WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
}
- WppAutoLogTrace(param_1,2,0xe,&WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,0xb8,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",0x29,local_18,4,&stack0x00000040,
- 8,&stack0x00000048,4,0);
+ if (param_3 != '\0') {
+ WppAutoLogTrace(param_4,2,0xe,&WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,0xbd,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",0x29,local_18,4,
+ &stack0x00000058,8,&stack0x00000060,4,0);
+ }
return;
}
```
## WPP_RECORDER_SF_sDdPZ
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,name,fullname,length,sig,address|
|ratio|0.41|
|i_ratio|0.4|
|m_ratio|0.99|
|b_ratio|0.93|
|match_types|Implied Match|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|`name`|WPP_RECORDER_SF_sDdPZ|WPP_RECORDER_AND_TRACE_SF_sDdPZ|
|`fullname`|WPP_RECORDER_SF_sDdPZ|WPP_RECORDER_AND_TRACE_SF_sDdPZ|
|refcount|2|2|
|`length`|479|493|
|called|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|
|calling|PrjfManageHydrationOnNonCachedHandle|PrjfManageHydrationOnNonCachedHandle|
|paramcount|1|4|
|`address`|1c003c9a8|140012ba4|
|`sig`|undefined __fastcall WPP_RECORDER_SF_sDdPZ(undefined8 param_1)|undefined __fastcall WPP_RECORDER_AND_TRACE_SF_sDdPZ(undefined8 param_1, char param_2, char param_3, undefined8 param_4)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### WPP_RECORDER_SF_sDdPZ Diff
```diff
--- WPP_RECORDER_SF_sDdPZ
+++ WPP_RECORDER_AND_TRACE_SF_sDdPZ
@@ -1,32 +1,38 @@
-void WPP_RECORDER_SF_sDdPZ(undefined8 param_1)
+void WPP_RECORDER_AND_TRACE_SF_sDdPZ
+ (undefined8 param_1,char param_2,char param_3,undefined8 param_4)
{
wchar_t wVar1;
wchar_t *pwVar2;
- wchar_t *in_stack_00000050;
+ wchar_t *in_stack_00000068;
undefined4 local_28 [2];
undefined4 local_20 [2];
pwVar2 = L"NULL";
local_28[0] = 0xc000009a;
- local_20[0] = 0x1f1f;
- wVar1 = L'\b';
- if (((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x2000) != 0) && (1 < (byte)WPP_GLOBAL_Control[0x29])
- ) {
- FastWppTraceMessage(&WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,0xb6,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",0x29);
+ local_20[0] = 0x1fa8;
+ if (param_2 != '\0') {
+ FastWppTraceMessage(0x20e,0xbb,&WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
}
- if ((in_stack_00000050 != (wchar_t *)0x0) &&
- (wVar1 = *in_stack_00000050, *in_stack_00000050 != L'\0')) {
- pwVar2 = *(wchar_t **)(in_stack_00000050 + 4);
+ if (param_3 != '\0') {
+ if (in_stack_00000068 == (wchar_t *)0x0) {
+ wVar1 = L'\b';
+ }
+ else {
+ wVar1 = *in_stack_00000068;
+ if (*in_stack_00000068 != L'\0') {
+ pwVar2 = *(wchar_t **)(in_stack_00000068 + 4);
+ }
+ }
+ if (in_stack_00000068 == (wchar_t *)0x0) {
+ in_stack_00000068 = L"\b";
+ }
+ WppAutoLogTrace(param_4,2,0xe,&WPP_6701bcde7e1a3a880aefa5946b7e7533_Traceguids,0xbb,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",0x29,local_20,4,local_28,4,
+ &stack0x00000060,8,in_stack_00000068,2,pwVar2,wVar1,0);
}
- if (in_stack_00000050 == (wchar_t *)0x0) {
- in_stack_00000050 = L"\b";
- }
- WppAutoLogTrace(param_1,2,0xe,&WPP_a64bbc2af2f237de77ac4bddbee74e6d_Traceguids,0xb6,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",0x29,local_20,4,local_28,4,
- &stack0x00000048,8,in_stack_00000050,2,pwVar2,wVar1,0);
return;
}
```
## WPP_RECORDER_SF_sDZDDD
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,name,fullname,refcount,length,sig,address,calling|
|ratio|0.18|
|i_ratio|0.17|
|m_ratio|0.96|
|b_ratio|0.71|
|match_types|Implied Match|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|`name`|WPP_RECORDER_SF_sDZDDD|WPP_RECORDER_AND_TRACE_SF_sDZ|
|`fullname`|WPP_RECORDER_SF_sDZDDD|WPP_RECORDER_AND_TRACE_SF_sDZ|
|`refcount`|2|8|
|`length`|513|483|
|called|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|
|`calling`|PrjfFsctlSetReparsePoint|PrjfCreateExpansionContext
PrjfDoesRootHaveShortNameComponent
PrjfExpansionCsqCompleteCanceledIo
PrjfFsctlSetReparsePoint
PrjfPreWrite
PrjfSetPlaceHolderFlags
PrjfValidateAndGetGlobalVolumePath|
|paramcount|1|11|
|`address`|1c003a104|14000e294|
|`sig`|undefined __fastcall WPP_RECORDER_SF_sDZDDD(undefined8 param_1)|undefined __fastcall WPP_RECORDER_AND_TRACE_SF_sDZ(undefined2 param_1, char param_2, char param_3, undefined8 param_4, undefined1 param_5, undefined4 param_6, ushort param_7, undefined8 param_8, char * param_9, undefined8 param_10, wchar_t * param_11)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### WPP_RECORDER_SF_sDZDDD Calling Diff
```diff
--- WPP_RECORDER_SF_sDZDDD calling
+++ WPP_RECORDER_AND_TRACE_SF_sDZ calling
@@ -0,0 +1,3 @@
+PrjfCreateExpansionContext
+PrjfDoesRootHaveShortNameComponent
+PrjfExpansionCsqCompleteCanceledIo
@@ -1,0 +5,3 @@
+PrjfPreWrite
+PrjfSetPlaceHolderFlags
+PrjfValidateAndGetGlobalVolumePath
```
### WPP_RECORDER_SF_sDZDDD Diff
```diff
--- WPP_RECORDER_SF_sDZDDD
+++ WPP_RECORDER_AND_TRACE_SF_sDZ
@@ -1,31 +1,57 @@
-void WPP_RECORDER_SF_sDZDDD(undefined8 param_1)
+void WPP_RECORDER_AND_TRACE_SF_sDZ
+ (undefined2 param_1,char param_2,char param_3,undefined8 param_4,undefined1 param_5,
+ undefined4 param_6,ushort param_7,undefined8 param_8,char *param_9,
+ undefined8 param_10,wchar_t *param_11)
{
- wchar_t *pwVar1;
- wchar_t wVar2;
- wchar_t *in_stack_00000040;
- undefined4 local_28 [4];
+ longlong lVar1;
+ wchar_t *pwVar2;
+ wchar_t wVar3;
+ longlong lVar4;
+ char *pcVar5;
+ wchar_t *pwVar6;
- pwVar1 = L"NULL";
- local_28[0] = 0x168;
- wVar2 = L'\b';
- if (((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x40) != 0) && (3 < (byte)WPP_GLOBAL_Control[0x29]))
- {
- FastWppTraceMessage(&WPP_594c3e8dc88d3460d4d40c2e57e2d4a0_Traceguids,0x12,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\fsctrl.c",0x2a);
+ pwVar2 = param_11;
+ pwVar6 = L"NULL";
+ wVar3 = L'\b';
+ if (param_2 != '\0') {
+ if (param_9 != (char *)0x0) {
+ lVar1 = -1;
+ do {
+ lVar1 = lVar1 + 1;
+ } while (param_9[lVar1] != '\0');
+ }
+ pcVar5 = param_9;
+ if (param_9 == (char *)0x0) {
+ pcVar5 = "NULL";
+ }
+ FastWppTraceMessage(param_1,param_7,param_8,pcVar5);
}
- if ((in_stack_00000040 != (wchar_t *)0x0) &&
- (wVar2 = *in_stack_00000040, *in_stack_00000040 != L'\0')) {
- pwVar1 = *(wchar_t **)(in_stack_00000040 + 4);
+ if (param_3 != '\0') {
+ if ((pwVar2 != (wchar_t *)0x0) && (wVar3 = *pwVar2, *pwVar2 != L'\0')) {
+ pwVar6 = *(wchar_t **)(pwVar2 + 4);
+ }
+ if (pwVar2 == (wchar_t *)0x0) {
+ pwVar2 = L"\b";
+ }
+ lVar1 = -1;
+ if (param_9 == (char *)0x0) {
+ lVar4 = 5;
+ }
+ else {
+ do {
+ lVar4 = lVar1;
+ lVar1 = lVar4 + 1;
+ } while (param_9[lVar1] != '\0');
+ lVar4 = lVar4 + 2;
+ }
+ if (param_9 == (char *)0x0) {
+ param_9 = "NULL";
+ }
+ WppAutoLogTrace(param_4,param_5,param_6,param_8,param_7,param_9,lVar4,¶m_10,4,pwVar2,2,
+ pwVar6,wVar3,0);
}
- if (in_stack_00000040 == (wchar_t *)0x0) {
- in_stack_00000040 = L"\b";
- }
- WppAutoLogTrace(param_1,4,7,&WPP_594c3e8dc88d3460d4d40c2e57e2d4a0_Traceguids,0x12,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\fsctrl.c",0x2a,local_28,4,
- in_stack_00000040,2,pwVar1,wVar2,&stack0x00000048,4,&stack0x00000050,4,
- &stack0x00000058,4,0);
return;
}
```
## WPP_RECORDER_SF_sDZLii
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,name,fullname,length,sig,address|
|ratio|0.39|
|i_ratio|0.38|
|m_ratio|0.99|
|b_ratio|0.93|
|match_types|Implied Match|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|`name`|WPP_RECORDER_SF_sDZLii|WPP_RECORDER_AND_TRACE_SF_sDZLii|
|`fullname`|WPP_RECORDER_SF_sDZLii|WPP_RECORDER_AND_TRACE_SF_sDZLii|
|refcount|2|2|
|`length`|515|532|
|called|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|
|calling|PrjfTelemetryPostExpansionComplete|PrjfTelemetryPostExpansionComplete|
|paramcount|1|4|
|`address`|1c003c79c|140012690|
|`sig`|undefined __fastcall WPP_RECORDER_SF_sDZLii(undefined8 param_1)|undefined __fastcall WPP_RECORDER_AND_TRACE_SF_sDZLii(undefined8 param_1, char param_2, char param_3, undefined8 param_4)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### WPP_RECORDER_SF_sDZLii Diff
```diff
--- WPP_RECORDER_SF_sDZLii
+++ WPP_RECORDER_AND_TRACE_SF_sDZLii
@@ -1,31 +1,37 @@
-void WPP_RECORDER_SF_sDZLii(undefined8 param_1)
+void WPP_RECORDER_AND_TRACE_SF_sDZLii
+ (undefined8 param_1,char param_2,char param_3,undefined8 param_4)
{
wchar_t wVar1;
wchar_t *pwVar2;
- wchar_t *in_stack_00000040;
+ wchar_t *in_stack_00000058;
undefined4 local_28 [4];
pwVar2 = L"NULL";
local_28[0] = 0x18a;
- wVar1 = L'\b';
- if (((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x200) != 0) && (3 < (byte)WPP_GLOBAL_Control[0x29]))
- {
- FastWppTraceMessage(&WPP_cead7f9b79fe32a96920046e878d7ba9_Traceguids,0xd,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\telemetry.c",0x2d);
+ if (param_2 != '\0') {
+ FastWppTraceMessage(0x40a,0xd,&WPP_cead7f9b79fe32a96920046e878d7ba9_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\telemetry.c");
}
- if ((in_stack_00000040 != (wchar_t *)0x0) &&
- (wVar1 = *in_stack_00000040, *in_stack_00000040 != L'\0')) {
- pwVar2 = *(wchar_t **)(in_stack_00000040 + 4);
+ if (param_3 != '\0') {
+ if (in_stack_00000058 == (wchar_t *)0x0) {
+ wVar1 = L'\b';
+ }
+ else {
+ wVar1 = *in_stack_00000058;
+ if (*in_stack_00000058 != L'\0') {
+ pwVar2 = *(wchar_t **)(in_stack_00000058 + 4);
+ }
+ }
+ if (in_stack_00000058 == (wchar_t *)0x0) {
+ in_stack_00000058 = L"\b";
+ }
+ WppAutoLogTrace(param_4,4,10,&WPP_cead7f9b79fe32a96920046e878d7ba9_Traceguids,0xd,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\telemetry.c",0x2d,local_28,4,
+ in_stack_00000058,2,pwVar2,wVar1,&stack0x00000060,4,&stack0x00000068,8,
+ &stack0x00000070,8,0);
}
- if (in_stack_00000040 == (wchar_t *)0x0) {
- in_stack_00000040 = L"\b";
- }
- WppAutoLogTrace(param_1,4,10,&WPP_cead7f9b79fe32a96920046e878d7ba9_Traceguids,0xd,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\telemetry.c",0x2d,local_28,4,
- in_stack_00000040,2,pwVar2,wVar1,&stack0x00000048,4,&stack0x00000050,8,
- &stack0x00000058,8,0);
return;
}
```
## WPP_RECORDER_SF_sDZd
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,name,fullname,length,sig,address|
|ratio|0.26|
|i_ratio|0.22|
|m_ratio|0.94|
|b_ratio|0.85|
|match_types|Implied Match|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|`name`|WPP_RECORDER_SF_sDZd|WPP_RECORDER_AND_TRACE_SF_sDZd|
|`fullname`|WPP_RECORDER_SF_sDZd|WPP_RECORDER_AND_TRACE_SF_sDZd|
|refcount|3|3|
|`length`|560|533|
|called|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|
|calling|PrjfInstanceQueryTeardown
PrjfSetupVolumeInformationHandler|PrjfInstanceQueryTeardown
PrjfSetupVolumeInformationHandler|
|paramcount|8|11|
|`address`|1c003b240|140011114|
|`sig`|undefined __fastcall WPP_RECORDER_SF_sDZd(undefined8 param_1, byte param_2, uint param_3, undefined2 param_4, undefined8 param_5, char * param_6, undefined8 param_7, wchar_t * param_8)|undefined __fastcall WPP_RECORDER_AND_TRACE_SF_sDZd(undefined2 param_1, char param_2, char param_3, undefined8 param_4, undefined1 param_5, undefined4 param_6, ushort param_7, undefined8 param_8, char * param_9, undefined8 param_10, wchar_t * param_11)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### WPP_RECORDER_SF_sDZd Diff
```diff
--- WPP_RECORDER_SF_sDZd
+++ WPP_RECORDER_AND_TRACE_SF_sDZd
@@ -1,62 +1,57 @@
-void WPP_RECORDER_SF_sDZd
- (undefined8 param_1,byte param_2,uint param_3,undefined2 param_4,undefined8 param_5,
- char *param_6,undefined8 param_7,wchar_t *param_8)
+void WPP_RECORDER_AND_TRACE_SF_sDZd
+ (undefined2 param_1,char param_2,char param_3,undefined8 param_4,undefined1 param_5,
+ undefined4 param_6,ushort param_7,undefined8 param_8,char *param_9,
+ undefined8 param_10,wchar_t *param_11)
{
- wchar_t *pwVar1;
- wchar_t wVar2;
- char *pcVar3;
+ longlong lVar1;
+ wchar_t *pwVar2;
+ wchar_t wVar3;
longlong lVar4;
- longlong lVar5;
+ char *pcVar5;
wchar_t *pwVar6;
- pwVar1 = param_8;
+ pwVar2 = param_11;
pwVar6 = L"NULL";
- wVar2 = L'\b';
- if (((*(uint *)(WPP_GLOBAL_Control +
- ((ulonglong)(param_3 - 1 >> 5 & 0x7ff) + (ulonglong)(param_3 >> 0x10) * 0x14) * 4 +
- 0x2c) >> (param_3 - 1 & 0x1f) & 1) != 0) &&
- (param_2 <= (byte)WPP_GLOBAL_Control[(ulonglong)(param_3 >> 0x10) * 0x50 + 0x29])) {
- if (param_6 == (char *)0x0) {
- lVar5 = 5;
+ wVar3 = L'\b';
+ if (param_2 != '\0') {
+ if (param_9 != (char *)0x0) {
+ lVar1 = -1;
+ do {
+ lVar1 = lVar1 + 1;
+ } while (param_9[lVar1] != '\0');
+ }
+ pcVar5 = param_9;
+ if (param_9 == (char *)0x0) {
+ pcVar5 = "NULL";
+ }
+ FastWppTraceMessage(param_1,param_7,param_8,pcVar5);
+ }
+ if (param_3 != '\0') {
+ if ((pwVar2 != (wchar_t *)0x0) && (wVar3 = *pwVar2, *pwVar2 != L'\0')) {
+ pwVar6 = *(wchar_t **)(pwVar2 + 4);
+ }
+ if (pwVar2 == (wchar_t *)0x0) {
+ pwVar2 = L"\b";
+ }
+ lVar1 = -1;
+ if (param_9 == (char *)0x0) {
+ lVar4 = 5;
}
else {
- lVar4 = -1;
do {
- lVar5 = lVar4;
- lVar4 = lVar5 + 1;
- } while (param_6[lVar4] != '\0');
- lVar5 = lVar5 + 2;
+ lVar4 = lVar1;
+ lVar1 = lVar4 + 1;
+ } while (param_9[lVar1] != '\0');
+ lVar4 = lVar4 + 2;
}
- pcVar3 = param_6;
- if (param_6 == (char *)0x0) {
- pcVar3 = "NULL";
+ if (param_9 == (char *)0x0) {
+ param_9 = "NULL";
}
- FastWppTraceMessage(param_5,param_4,pcVar3,lVar5);
+ WppAutoLogTrace(param_4,param_5,param_6,param_8,param_7,param_9,lVar4,¶m_10,4,pwVar2,2,
+ pwVar6,wVar3,&stack0x00000060,4,0);
}
- if ((pwVar1 != (wchar_t *)0x0) && (wVar2 = *pwVar1, *pwVar1 != L'\0')) {
- pwVar6 = *(wchar_t **)(pwVar1 + 4);
- }
- if (pwVar1 == (wchar_t *)0x0) {
- pwVar1 = L"\b";
- }
- lVar5 = -1;
- if (param_6 == (char *)0x0) {
- lVar4 = 5;
- }
- else {
- do {
- lVar4 = lVar5;
- lVar5 = lVar4 + 1;
- } while (param_6[lVar5] != '\0');
- lVar4 = lVar4 + 2;
- }
- if (param_6 == (char *)0x0) {
- param_6 = "NULL";
- }
- WppAutoLogTrace(param_1,param_2,param_3,param_5,param_4,param_6,lVar4,¶m_7,4,pwVar1,2,pwVar6,
- wVar2,&stack0x00000048,4,0);
return;
}
```
## WPP_RECORDER_SF_sDdLL
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,name,fullname,length,sig,address|
|ratio|0.45|
|i_ratio|0.31|
|m_ratio|0.98|
|b_ratio|0.9|
|match_types|Implied Match|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|`name`|WPP_RECORDER_SF_sDdLL|WPP_RECORDER_AND_TRACE_SF_sDdLL|
|`fullname`|WPP_RECORDER_SF_sDdLL|WPP_RECORDER_AND_TRACE_SF_sDdLL|
|refcount|2|2|
|`length`|300|313|
|called|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|
|calling|PrjfValidateNotificationRoot|PrjfValidateNotificationRoot|
|paramcount|1|4|
|`address`|1c003e694|140014b94|
|`sig`|undefined __fastcall WPP_RECORDER_SF_sDdLL(undefined8 param_1)|undefined __fastcall WPP_RECORDER_AND_TRACE_SF_sDdLL(undefined8 param_1, char param_2, char param_3, undefined8 param_4)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### WPP_RECORDER_SF_sDdLL Diff
```diff
--- WPP_RECORDER_SF_sDdLL
+++ WPP_RECORDER_AND_TRACE_SF_sDdLL
@@ -1,18 +1,20 @@
-void WPP_RECORDER_SF_sDdLL(undefined8 param_1)
+void WPP_RECORDER_AND_TRACE_SF_sDdLL
+ (undefined8 param_1,char param_2,char param_3,undefined8 param_4)
{
undefined4 local_18 [4];
- local_18[0] = 0x1b9;
- if (((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x80000) != 0) &&
- (1 < (byte)WPP_GLOBAL_Control[0x29])) {
- FastWppTraceMessage(&WPP_5c05f7cae5513ff3734adbc0d3bd9537_Traceguids,0x15,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\mapping.c",0x2b);
+ local_18[0] = 0x1ba;
+ if (param_2 != '\0') {
+ FastWppTraceMessage(0x214,0x15,&WPP_0314efc3b1f93d76a134ccc0e69e0e16_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\mapping.c");
}
- WppAutoLogTrace(param_1,2,0x14,&WPP_5c05f7cae5513ff3734adbc0d3bd9537_Traceguids,0x15,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\mapping.c",0x2b,local_18,4,
- &stack0x00000040,4,&stack0x00000048,4,&stack0x00000050,4,0);
+ if (param_3 != '\0') {
+ WppAutoLogTrace(param_4,2,0x14,&WPP_0314efc3b1f93d76a134ccc0e69e0e16_Traceguids,0x15,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\mapping.c",0x2b,local_18,4,
+ &stack0x00000058,4,&stack0x00000060,4,&stack0x00000068,4,0);
+ }
return;
}
```
## WPP_RECORDER_SF_sDdL
### Match Info
|Key|pj_4202.sys - pj_8246.sys|
| :---: | :---: |
|diff_type|code,name,fullname,length,sig,address|
|ratio|0.4|
|i_ratio|0.26|
|m_ratio|0.97|
|b_ratio|0.89|
|match_types|Implied Match|
### Function Meta Diff
|Key|pj_4202.sys|pj_8246.sys|
| :---: | :---: | :---: |
|`name`|WPP_RECORDER_SF_sDdL|WPP_RECORDER_AND_TRACE_SF_sDdL|
|`fullname`|WPP_RECORDER_SF_sDdL|WPP_RECORDER_AND_TRACE_SF_sDdL|
|refcount|2|2|
|`length`|257|267|
|called|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|
|calling|PrjfValidateNotificationRoot|PrjfValidateNotificationRoot|
|paramcount|4|7|
|`address`|1c003e58c|140014a80|
|`sig`|undefined __fastcall WPP_RECORDER_SF_sDdL(undefined8 param_1, undefined8 param_2, undefined8 param_3, undefined2 param_4)|undefined __fastcall WPP_RECORDER_AND_TRACE_SF_sDdL(undefined8 param_1, char param_2, char param_3, undefined8 param_4, undefined8 param_5, undefined8 param_6, ushort param_7)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### WPP_RECORDER_SF_sDdL Diff
```diff
--- WPP_RECORDER_SF_sDdL
+++ WPP_RECORDER_AND_TRACE_SF_sDdL
@@ -1,16 +1,18 @@
-void WPP_RECORDER_SF_sDdL
- (undefined8 param_1,undefined8 param_2,undefined8 param_3,undefined2 param_4)
+void WPP_RECORDER_AND_TRACE_SF_sDdL
+ (undefined8 param_1,char param_2,char param_3,undefined8 param_4,undefined8 param_5,
+ undefined8 param_6,ushort param_7)
{
- if (((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x80000) != 0) &&
- (1 < (byte)WPP_GLOBAL_Control[0x29])) {
- FastWppTraceMessage(&WPP_5c05f7cae5513ff3734adbc0d3bd9537_Traceguids,param_4,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\mapping.c",0x2b);
+ if (param_2 != '\0') {
+ FastWppTraceMessage(0x214,param_7,&WPP_0314efc3b1f93d76a134ccc0e69e0e16_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\mapping.c");
}
- WppAutoLogTrace(param_1,2,0x14,&WPP_5c05f7cae5513ff3734adbc0d3bd9537_Traceguids,param_4,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\mapping.c",0x2b,&stack0x00000038,4,
- &stack0x00000040,4,&stack0x00000048,4,0);
+ if (param_3 != '\0') {
+ WppAutoLogTrace(param_4,2,0x14,&WPP_0314efc3b1f93d76a134ccc0e69e0e16_Traceguids,param_7,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\mapping.c",0x2b,&stack0x00000050,4,
+ &stack0x00000058,4,&stack0x00000060,4,0);
+ }
return;
}
```
## Max Modified Section Functions Reached Error
57 Functions Ommited...
# Modified (No Code Changes)
*Slightly modified functions have no code changes, rather differnces in:*
- refcount
- length
- called
- calling
- name
- fullname
## Section Skipped
**This section was skipped because markdown was too big. Adjust max_section_funcs: 200 to a higher number.**
Generated with `ghidriff` version: 1.0.0 on 2026-08-19T07:17:12