# pj_8115.sys-pj_8246.sys Diff # TOC * [Visual Chart Diff](#visual-chart-diff) * [Metadata](#metadata) * [Ghidra Diff Engine](#ghidra-diff-engine) * [Command Line](#command-line) * [Binary Metadata Diff](#binary-metadata-diff) * [Program Options](#program-options) * [Diff Stats](#diff-stats) * [Strings](#strings) * [Deleted](#deleted) * [Added](#added) * [Feature_440600889__private_IsEnabledDeviceUsageNoInline](#feature_440600889__private_isenableddeviceusagenoinline) * [Feature_440600889__private_IsEnabledFallback](#feature_440600889__private_isenabledfallback) * [Feature_2428439865__private_IsEnabledDeviceUsageNoInline](#feature_2428439865__private_isenableddeviceusagenoinline) * [Feature_2428439865__private_IsEnabledFallback](#feature_2428439865__private_isenabledfallback) * [Feature_3303736635__private_IsEnabledDeviceUsageNoInline](#feature_3303736635__private_isenableddeviceusagenoinline) * [Feature_3303736635__private_IsEnabledFallback](#feature_3303736635__private_isenabledfallback) * [Feature_3411221816__private_IsEnabledDeviceUsageNoInline](#feature_3411221816__private_isenableddeviceusagenoinline) * [Feature_3411221816__private_IsEnabledFallback](#feature_3411221816__private_isenabledfallback) * [RtlUnicodeStringCbCopyStringN](#rtlunicodestringcbcopystringn) * [Feature_4243261755__private_IsEnabledDeviceUsageNoInline](#feature_4243261755__private_isenableddeviceusagenoinline) * [Feature_4243261755__private_IsEnabledFallback](#feature_4243261755__private_isenabledfallback) * [Modified](#modified) * [PrjfCloseFileHandler](#prjfclosefilehandler) * [PrjfCreateUnionContext](#prjfcreateunioncontext) * [PrjfWriteFileDataHandler](#prjfwritefiledatahandler) * [PrjfCompleteCommandHandler](#prjfcompletecommandhandler) * [PrjfPortConnect](#prjfportconnect) * [PrjfScheduleExpansionWorkItem](#prjfscheduleexpansionworkitem) * [PrjfStoreNotificationMappingEntries](#prjfstorenotificationmappingentries) * [Modified (No Code Changes)](#modified-no-code-changes) * [wil_details_IsEnabledFallback](#wil_details_isenabledfallback) * [WPP_RECORDER_AND_TRACE_SF_sDD](#wpp_recorder_and_trace_sf_sdd) * [NTOSKRNL.EXE::ExDeleteResourceLite](#ntoskrnlexeexdeleteresourcelite) # Visual Chart Diff ```mermaid flowchart LR PrjfCloseFileHandler-2-old<--Match 89%-->PrjfCloseFileHandler-2-new PrjfCreateUnionContext-6-old<--Match 97%-->PrjfCreateUnionContext-6-new PrjfWriteFileDataHandler-3-old<--Match 16%-->PrjfWriteFileDataHandler-3-new PrjfCompleteCommandHandler-2-old<--Match 63%-->PrjfCompleteCommandHandler-2-new PrjfPortConnect-5-old<--Match 79%-->PrjfPortConnect-5-new PrjfScheduleExpansionWorkItem-4-old<--Match 90%-->PrjfScheduleExpansionWorkItem-4-new PrjfStoreNotificationMappingEntries-3-old<--Match 97%-->PrjfStoreNotificationMappingEntries-3-new subgraph pj_8246.sys PrjfCloseFileHandler-2-new PrjfCreateUnionContext-6-new PrjfWriteFileDataHandler-3-new PrjfCompleteCommandHandler-2-new PrjfPortConnect-5-new PrjfScheduleExpansionWorkItem-4-new PrjfStoreNotificationMappingEntries-3-new subgraph Added direction LR Feature_440600889__private_IsEnabledDeviceUsageNoInline Feature_440600889__private_IsEnabledFallback Feature_2428439865__private_IsEnabledDeviceUsageNoInline Feature_2428439865__private_IsEnabledFallback Feature_3303736635__private_IsEnabledDeviceUsageNoInline Feature_3303736635__private_IsEnabledFallback Feature_3411221816__private_IsEnabledDeviceUsageNoInline Feature_3411221816__private_IsEnabledFallback RtlUnicodeStringCbCopyStringN Feature_4243261755__private_IsEnabledDeviceUsageNoInline Feature_4243261755__private_IsEnabledFallback end end subgraph pj_8115.sys PrjfCloseFileHandler-2-old PrjfCreateUnionContext-6-old PrjfWriteFileDataHandler-3-old PrjfCompleteCommandHandler-2-old PrjfPortConnect-5-old PrjfScheduleExpansionWorkItem-4-old PrjfStoreNotificationMappingEntries-3-old end ``` ```mermaid pie showData title Function Matches - 99.1635% "unmatched_funcs_len" : 11 "matched_funcs_len" : 1304 ``` ```mermaid pie showData title Matched Function Similarity - 99.1564% "matched_funcs_with_code_changes_len" : 7 "matched_funcs_with_non_code_changes_len" : 4 "matched_funcs_no_changes_len" : 1293 ``` # Metadata ## Ghidra Diff Engine ### Command Line #### Captured Command Line ``` ghidriff --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --bsim --max-ram-percent 60.0 --max-section-funcs 200 pj_8115.sys pj_8246.sys ``` #### Verbose Args
``` --old ['pj_8115.sys'] --new [['pj_8246.sys']] --engine VersionTrackingDiff --output-path pj_out --summary False --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim True --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title None ```
#### Download Original PEs ``` wget https://msdl.microsoft.com/download/symbols/prjflt.sys/86C773414E000/prjflt.sys -O prjflt.sys.x64.10.0.26100.8115 wget https://msdl.microsoft.com/download/symbols/prjflt.sys/F77DE92A4E000/prjflt.sys -O prjflt.sys.x64.10.0.26100.8246 ``` ## Binary Metadata Diff ```diff --- pj_8115.sys Meta +++ pj_8246.sys Meta @@ -1,44 +1,44 @@ -Program Name: pj_8115.sys +Program Name: pj_8246.sys Language ID: x86:LE:64:default (4.6) Compiler ID: windows Processor: x86 Endian: Little Address Size: 64 Minimum Address: 140000000 Maximum Address: ff0000184f # of Bytes: 325712 # of Memory Blocks: 15 -# of Instructions: 52800 -# of Defined Data: 2328 -# of Functions: 652 -# of Symbols: 7782 +# of Instructions: 52984 +# of Defined Data: 2365 +# of Functions: 663 +# of Symbols: 7832 # of Data Types: 166 # of Data Type Categories: 12 Analyzed: true Compiler: visualstudio:unknown Created With Ghidra Version: 12.0.4 -Date Created: Wed Aug 19 00:11:43 SGT 2026 +Date Created: Wed Aug 19 00:11:46 SGT 2026 Executable Format: Portable Executable (PE) -Executable Location: /tmp/pj/pj_8115.sys -Executable MD5: efa1cdbc8a1f487d90c54805cfdd085b -Executable SHA256: 51d12b128e33bc0110344cea5c6374192d525c9f918666c9886a57c5486e5d3d -FSRL: file:///tmp/pj/pj_8115.sys?MD5=efa1cdbc8a1f487d90c54805cfdd085b +Executable Location: /tmp/pj/pj_8246.sys +Executable MD5: ee36990ce21ff8dfc575e30a2cb2c7a0 +Executable SHA256: 6eeb5961eb44704a1515a3df15bbf02ce4e63c55b46fb00158a5d65c7b4fd555 +FSRL: file:///tmp/pj/pj_8246.sys?MD5=ee36990ce21ff8dfc575e30a2cb2c7a0 PDB Age: 1 PDB File: prjflt.pdb -PDB GUID: 6a59d136-7b64-cbd8-f8be-946731fdcb0a +PDB GUID: 1c872a30-e67f-093a-89a2-b423d822a551 PDB Loaded: true PDB Version: RSDS PE Property[CompanyName]: Microsoft Corporation PE Property[FileDescription]: Windows Projected File System FS Filter Driver -PE Property[FileVersion]: 10.0.26100.8115 (WinBuild.160101.0800) +PE Property[FileVersion]: 10.0.26100.8246 (WinBuild.160101.0800) PE Property[InternalName]: prjflt.sys PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved. PE Property[OriginalFilename]: prjflt.sys PE Property[ProductName]: Microsoft(R) Windows(R) Kits -PE Property[ProductVersion]: 10.0.26100.8115 +PE Property[ProductVersion]: 10.0.26100.8246 PE Property[Translation]: 4b00409 Preferred Root Namespace Category: RTTI Found: false Relocatable: true SectionAlignment: 4096 Should Ask To Analyze: false ``` ## Program Options
Ghidra pj_8115.sys Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra pj_8115.sys Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra pj_8115.sys Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.Apply Function Calling Conventions|true| |Demangler Microsoft.Apply Function Signatures|true| |Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS| |Demangler Microsoft.Demangle Only Known Mangled Symbols|false| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
Ghidra pj_8246.sys Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra pj_8246.sys Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra pj_8246.sys Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.Apply Function Calling Conventions|true| |Demangler Microsoft.Apply Function Signatures|true| |Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS| |Demangler Microsoft.Demangle Only Known Mangled Symbols|false| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
## Diff Stats |Stat|Value| | :---: | :---: | |added_funcs_len|11| |deleted_funcs_len|0| |modified_funcs_len|11| |added_symbols_len|23| |deleted_symbols_len|7| |diff_time|3.886441707611084| |deleted_strings_len|0| |added_strings_len|0| |match_types|Counter({'SymbolsHash': 649, 'ExternalsName': 258, 'ExactBytesFunctionHasher': 1, 'BSIM': 1})| |items_to_process|52| |diff_types|Counter({'address': 9, 'length': 8, 'code': 7, 'called': 7, 'refcount': 3, 'calling': 2, 'sig': 1})| |unmatched_funcs_len|11| |total_funcs_len|1315| |matched_funcs_len|1304| |matched_funcs_with_code_changes_len|7| |matched_funcs_with_non_code_changes_len|4| |matched_funcs_no_changes_len|1293| |match_func_similarity_percent|99.1564%| |func_match_overall_percent|99.1635%| |first_matches|Counter({'SymbolsHash': 649, 'ExactBytesFunctionHasher': 1, 'BSIM': 1})| ```mermaid pie showData title All Matches "SymbolsHash" : 649 "ExternalsName" : 258 "ExactBytesFunctionHasher" : 1 "BSIM" : 1 ``` ```mermaid pie showData title First Matches "SymbolsHash" : 649 "ExactBytesFunctionHasher" : 1 "BSIM" : 1 ``` ```mermaid pie showData title Diff Stats "added_funcs_len" : 11 "deleted_funcs_len" : 0 "modified_funcs_len" : 11 ``` ```mermaid pie showData title Symbols "added_symbols_len" : 23 "deleted_symbols_len" : 7 ``` ## Strings *No string differences found* # Deleted # Added ## Feature_440600889__private_IsEnabledDeviceUsageNoInline ### Function Meta |Key|pj_8246.sys| | :---: | :---: | |name|Feature_440600889__private_IsEnabledDeviceUsageNoInline| |fullname|Feature_440600889__private_IsEnabledDeviceUsageNoInline| |refcount|2| |length|49| |called|Feature_440600889__private_IsEnabledFallback| |calling|PrjfCreateUnionContext| |paramcount|0| |address|140001520| |sig|ulonglong __fastcall Feature_440600889__private_IsEnabledDeviceUsageNoInline(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_440600889__private_IsEnabledDeviceUsageNoInline +++ Feature_440600889__private_IsEnabledDeviceUsageNoInline @@ -0,0 +1,17 @@ + +ulonglong Feature_440600889__private_IsEnabledDeviceUsageNoInline(void) + +{ + ulonglong uVar1; + undefined8 local_res8; + + local_res8 = (ulonglong)Feature_440600889__private_featureState; + if ((Feature_440600889__private_featureState & 0x10) == 0) { + uVar1 = Feature_440600889__private_IsEnabledFallback(local_res8,3); + } + else { + uVar1 = (ulonglong)(Feature_440600889__private_featureState & 1); + } + return uVar1; +} + ``` ## Feature_440600889__private_IsEnabledFallback ### Function Meta |Key|pj_8246.sys| | :---: | :---: | |name|Feature_440600889__private_IsEnabledFallback| |fullname|Feature_440600889__private_IsEnabledFallback| |refcount|2| |length|21| |called|wil_details_IsEnabledFallback| |calling|Feature_440600889__private_IsEnabledDeviceUsageNoInline| |paramcount|2| |address|140001558| |sig|undefined __fastcall Feature_440600889__private_IsEnabledFallback(ulonglong param_1, int param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_440600889__private_IsEnabledFallback +++ Feature_440600889__private_IsEnabledFallback @@ -0,0 +1,8 @@ + +void Feature_440600889__private_IsEnabledFallback(ulonglong param_1,int param_2) + +{ + wil_details_IsEnabledFallback(param_1,param_2,&Feature_440600889__private_descriptor); + return; +} + ``` ## Feature_2428439865__private_IsEnabledDeviceUsageNoInline ### Function Meta |Key|pj_8246.sys| | :---: | :---: | |name|Feature_2428439865__private_IsEnabledDeviceUsageNoInline| |fullname|Feature_2428439865__private_IsEnabledDeviceUsageNoInline| |refcount|3| |length|49| |called|Feature_2428439865__private_IsEnabledFallback| |calling|PrjfScheduleExpansionWorkItem| |paramcount|0| |address|140004870| |sig|ulonglong __fastcall Feature_2428439865__private_IsEnabledDeviceUsageNoInline(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_2428439865__private_IsEnabledDeviceUsageNoInline +++ Feature_2428439865__private_IsEnabledDeviceUsageNoInline @@ -0,0 +1,17 @@ + +ulonglong Feature_2428439865__private_IsEnabledDeviceUsageNoInline(void) + +{ + ulonglong uVar1; + undefined8 local_res8; + + local_res8 = (ulonglong)Feature_2428439865__private_featureState; + if ((Feature_2428439865__private_featureState & 0x10) == 0) { + uVar1 = Feature_2428439865__private_IsEnabledFallback(local_res8,3); + } + else { + uVar1 = (ulonglong)(Feature_2428439865__private_featureState & 1); + } + return uVar1; +} + ``` ## Feature_2428439865__private_IsEnabledFallback ### Function Meta |Key|pj_8246.sys| | :---: | :---: | |name|Feature_2428439865__private_IsEnabledFallback| |fullname|Feature_2428439865__private_IsEnabledFallback| |refcount|2| |length|21| |called|wil_details_IsEnabledFallback| |calling|Feature_2428439865__private_IsEnabledDeviceUsageNoInline| |paramcount|2| |address|1400048a8| |sig|undefined __fastcall Feature_2428439865__private_IsEnabledFallback(ulonglong param_1, int param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_2428439865__private_IsEnabledFallback +++ Feature_2428439865__private_IsEnabledFallback @@ -0,0 +1,8 @@ + +void Feature_2428439865__private_IsEnabledFallback(ulonglong param_1,int param_2) + +{ + wil_details_IsEnabledFallback(param_1,param_2,&Feature_2428439865__private_descriptor); + return; +} + ``` ## Feature_3303736635__private_IsEnabledDeviceUsageNoInline ### Function Meta |Key|pj_8246.sys| | :---: | :---: | |name|Feature_3303736635__private_IsEnabledDeviceUsageNoInline| |fullname|Feature_3303736635__private_IsEnabledDeviceUsageNoInline| |refcount|2| |length|49| |called|Feature_3303736635__private_IsEnabledFallback| |calling|PrjfCloseFileHandler| |paramcount|0| |address|140004a7c| |sig|ulonglong __fastcall Feature_3303736635__private_IsEnabledDeviceUsageNoInline(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_3303736635__private_IsEnabledDeviceUsageNoInline +++ Feature_3303736635__private_IsEnabledDeviceUsageNoInline @@ -0,0 +1,17 @@ + +ulonglong Feature_3303736635__private_IsEnabledDeviceUsageNoInline(void) + +{ + ulonglong uVar1; + undefined8 local_res8; + + local_res8 = (ulonglong)Feature_3303736635__private_featureState; + if ((Feature_3303736635__private_featureState & 0x10) == 0) { + uVar1 = Feature_3303736635__private_IsEnabledFallback(local_res8,3); + } + else { + uVar1 = (ulonglong)(Feature_3303736635__private_featureState & 1); + } + return uVar1; +} + ``` ## Feature_3303736635__private_IsEnabledFallback ### Function Meta |Key|pj_8246.sys| | :---: | :---: | |name|Feature_3303736635__private_IsEnabledFallback| |fullname|Feature_3303736635__private_IsEnabledFallback| |refcount|2| |length|21| |called|wil_details_IsEnabledFallback| |calling|Feature_3303736635__private_IsEnabledDeviceUsageNoInline| |paramcount|2| |address|140004ab4| |sig|undefined __fastcall Feature_3303736635__private_IsEnabledFallback(ulonglong param_1, int param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_3303736635__private_IsEnabledFallback +++ Feature_3303736635__private_IsEnabledFallback @@ -0,0 +1,8 @@ + +void Feature_3303736635__private_IsEnabledFallback(ulonglong param_1,int param_2) + +{ + wil_details_IsEnabledFallback(param_1,param_2,&Feature_3303736635__private_descriptor); + return; +} + ``` ## Feature_3411221816__private_IsEnabledDeviceUsageNoInline ### Function Meta |Key|pj_8246.sys| | :---: | :---: | |name|Feature_3411221816__private_IsEnabledDeviceUsageNoInline| |fullname|Feature_3411221816__private_IsEnabledDeviceUsageNoInline| |refcount|3| |length|49| |called|Feature_3411221816__private_IsEnabledFallback| |calling|PrjfPortConnect| |paramcount|0| |address|140004ad0| |sig|ulonglong __fastcall Feature_3411221816__private_IsEnabledDeviceUsageNoInline(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_3411221816__private_IsEnabledDeviceUsageNoInline +++ Feature_3411221816__private_IsEnabledDeviceUsageNoInline @@ -0,0 +1,17 @@ + +ulonglong Feature_3411221816__private_IsEnabledDeviceUsageNoInline(void) + +{ + ulonglong uVar1; + undefined8 local_res8; + + local_res8 = (ulonglong)Feature_3411221816__private_featureState; + if ((Feature_3411221816__private_featureState & 0x10) == 0) { + uVar1 = Feature_3411221816__private_IsEnabledFallback(local_res8,3); + } + else { + uVar1 = (ulonglong)(Feature_3411221816__private_featureState & 1); + } + return uVar1; +} + ``` ## Feature_3411221816__private_IsEnabledFallback ### Function Meta |Key|pj_8246.sys| | :---: | :---: | |name|Feature_3411221816__private_IsEnabledFallback| |fullname|Feature_3411221816__private_IsEnabledFallback| |refcount|2| |length|21| |called|wil_details_IsEnabledFallback| |calling|Feature_3411221816__private_IsEnabledDeviceUsageNoInline| |paramcount|2| |address|140004b08| |sig|undefined __fastcall Feature_3411221816__private_IsEnabledFallback(ulonglong param_1, int param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_3411221816__private_IsEnabledFallback +++ Feature_3411221816__private_IsEnabledFallback @@ -0,0 +1,8 @@ + +void Feature_3411221816__private_IsEnabledFallback(ulonglong param_1,int param_2) + +{ + wil_details_IsEnabledFallback(param_1,param_2,&Feature_3411221816__private_descriptor); + return; +} + ``` ## RtlUnicodeStringCbCopyStringN ### Function Meta |Key|pj_8246.sys| | :---: | :---: | |name|RtlUnicodeStringCbCopyStringN| |fullname|RtlUnicodeStringCbCopyStringN| |refcount|2| |length|205| |called|| |calling|PrjfPortConnect| |paramcount|3| |address|140006088| |sig|longlong __fastcall RtlUnicodeStringCbCopyStringN(ushort * param_1, short * param_2, ulonglong param_3)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- RtlUnicodeStringCbCopyStringN +++ RtlUnicodeStringCbCopyStringN @@ -0,0 +1,52 @@ + +longlong RtlUnicodeStringCbCopyStringN(ushort *param_1,short *param_2,ulonglong param_3) + +{ + ushort uVar1; + ushort uVar2; + longlong lVar3; + short sVar4; + longlong lVar5; + ulonglong uVar6; + longlong lVar7; + ulonglong uVar8; + + uVar1 = *param_1; + if ((((((uVar1 & 1) != 0) || (uVar2 = param_1[1], (uVar2 & 1) != 0)) || (uVar2 < uVar1)) || + (uVar2 == 0xffff)) || + ((lVar3 = 0, *(longlong *)(param_1 + 4) == 0 && ((uVar1 != 0 || (uVar2 != 0)))))) { + return 0xc000000d; + } + sVar4 = 0; + uVar6 = (ulonglong)(param_1[1] >> 1); + uVar8 = param_3 >> 1; + if (uVar8 < 0x8000) { + lVar5 = lVar3; + if (uVar6 != 0) { + lVar7 = *(longlong *)(param_1 + 4) - (longlong)param_2; + do { + sVar4 = (short)lVar5; + if (uVar8 == 0) goto LAB_14000613d; + if (*param_2 == 0) break; + *(short *)(lVar7 + (longlong)param_2) = *param_2; + uVar8 = uVar8 - 1; + param_2 = param_2 + 1; + lVar5 = lVar5 + 1; + uVar6 = uVar6 - 1; + } while (uVar6 != 0); + sVar4 = (short)lVar5; + if (uVar6 != 0) goto LAB_14000613d; + } + sVar4 = (short)lVar5; + if ((uVar8 != 0) && (lVar3 = 0, *param_2 != 0)) { + lVar3 = 0x80000005; + } + } + else { + lVar3 = 0xc000000d; + } +LAB_14000613d: + *param_1 = sVar4 * 2; + return lVar3; +} + ``` ## Feature_4243261755__private_IsEnabledDeviceUsageNoInline ### Function Meta |Key|pj_8246.sys| | :---: | :---: | |name|Feature_4243261755__private_IsEnabledDeviceUsageNoInline| |fullname|Feature_4243261755__private_IsEnabledDeviceUsageNoInline| |refcount|2| |length|49| |called|Feature_4243261755__private_IsEnabledFallback| |calling|PrjfStoreNotificationMappingEntries| |paramcount|0| |address|14000b2f4| |sig|ulonglong __fastcall Feature_4243261755__private_IsEnabledDeviceUsageNoInline(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_4243261755__private_IsEnabledDeviceUsageNoInline +++ Feature_4243261755__private_IsEnabledDeviceUsageNoInline @@ -0,0 +1,17 @@ + +ulonglong Feature_4243261755__private_IsEnabledDeviceUsageNoInline(void) + +{ + ulonglong uVar1; + undefined8 local_res8; + + local_res8 = (ulonglong)Feature_4243261755__private_featureState; + if ((Feature_4243261755__private_featureState & 0x10) == 0) { + uVar1 = Feature_4243261755__private_IsEnabledFallback(local_res8,3); + } + else { + uVar1 = (ulonglong)(Feature_4243261755__private_featureState & 1); + } + return uVar1; +} + ``` ## Feature_4243261755__private_IsEnabledFallback ### Function Meta |Key|pj_8246.sys| | :---: | :---: | |name|Feature_4243261755__private_IsEnabledFallback| |fullname|Feature_4243261755__private_IsEnabledFallback| |refcount|2| |length|21| |called|wil_details_IsEnabledFallback| |calling|Feature_4243261755__private_IsEnabledDeviceUsageNoInline| |paramcount|2| |address|14000b32c| |sig|undefined __fastcall Feature_4243261755__private_IsEnabledFallback(ulonglong param_1, int param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_4243261755__private_IsEnabledFallback +++ Feature_4243261755__private_IsEnabledFallback @@ -0,0 +1,8 @@ + +void Feature_4243261755__private_IsEnabledFallback(ulonglong param_1,int param_2) + +{ + wil_details_IsEnabledFallback(param_1,param_2,&Feature_4243261755__private_descriptor); + return; +} + ``` # Modified *Modified functions contain code changes* ## PrjfCloseFileHandler ### Match Info |Key|pj_8115.sys - pj_8246.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.31| |i_ratio|0.68| |m_ratio|0.93| |b_ratio|0.89| |match_types|SymbolsHash| ### Function Meta Diff |Key|pj_8115.sys|pj_8246.sys| | :---: | :---: | :---: | |name|PrjfCloseFileHandler|PrjfCloseFileHandler| |fullname|PrjfCloseFileHandler|PrjfCloseFileHandler| |refcount|2|2| |`length`|642|749| |`called`|
Expand for full list:
FLTMGR.SYS::FltAcquireResourceExclusive
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltReleaseResource
NTOSKRNL.EXE::IoGetCurrentProcess
NTOSKRNL.EXE::ObDereferenceObjectDeferDelete
NTOSKRNL.EXE::RtlDeleteElementGenericTableAvl
NTOSKRNL.EXE::RtlLookupElementGenericTableAvl
PrjfGetUnionContextByVirtualizationInstanceInfo
PrjfReleaseUnionContext
WPP_RECORDER_AND_TRACE_SF_sD
__security_check_cookie
|
Expand for full list:
FLTMGR.SYS::FltAcquireResourceExclusive
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltReleaseResource
Feature_3303736635__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::IoGetCurrentProcess
NTOSKRNL.EXE::ObDereferenceObjectDeferDelete
NTOSKRNL.EXE::RtlDeleteElementGenericTableAvl
NTOSKRNL.EXE::RtlLookupElementGenericTableAvl
PrjfGetUnionContextByVirtualizationInstanceInfo
PrjfReleaseUnionContext
WPP_RECORDER_AND_TRACE_SF_sD__security_check_cookie
| |calling|PrjfPortMessage|PrjfPortMessage| |paramcount|2|2| |`address`|14002f9dc|14002f9ec| |sig|undefined8 __fastcall PrjfCloseFileHandler(undefined8 param_1, longlong * param_2)|undefined8 __fastcall PrjfCloseFileHandler(undefined8 param_1, longlong * param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### PrjfCloseFileHandler Called Diff ```diff --- PrjfCloseFileHandler called +++ PrjfCloseFileHandler called @@ -3,0 +4 @@ +Feature_3303736635__private_IsEnabledDeviceUsageNoInline ``` ### PrjfCloseFileHandler Diff ```diff --- PrjfCloseFileHandler +++ PrjfCloseFileHandler @@ -1,83 +1,95 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ undefined8 PrjfCloseFileHandler(undefined8 param_1,longlong *param_2) { - longlong *plVar1; - undefined8 uVar2; - longlong *plVar3; - longlong lVar4; + undefined8 uVar1; + longlong *plVar2; + longlong lVar3; + ulonglong uVar4; undefined8 uVar5; undefined1 auStackY_a8 [32]; + ushort uVar6; longlong local_58; longlong lStack_50; undefined8 local_48; undefined8 uStack_40; ulonglong local_38; local_38 = __security_cookie ^ (ulonglong)auStackY_a8; uVar5 = 0; local_58 = 0; lStack_50 = 0; local_48 = 0; uStack_40 = 0; - plVar3 = PrjfGetUnionContextByVirtualizationInstanceInfo(param_2,param_1); - if (plVar3 == (longlong *)0x0) { - uVar5 = 0xc000000d; + plVar2 = PrjfGetUnionContextByVirtualizationInstanceInfo(param_2,param_1); + if (plVar2 == (longlong *)0x0) { + if (((DAT_0 & 0x40) == 0) && + ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) { + return 0xc000000d; + } + WPP_RECORDER_AND_TRACE_SF_sD + (0x20e,DAT_0 & 0x40, + (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED, + *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0x29, + &WPP_39279db927ae337b8503ecc20725ff46_Traceguids, + "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c"); + return 0xc000000d; + } + lVar3 = IoGetCurrentProcess(); + if (lVar3 != plVar2[4]) { + uVar5 = 0xc0000022; if (((DAT_0 & 0x40) != 0) || ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) { WPP_RECORDER_AND_TRACE_SF_sD (0x20e,DAT_0 & 0x40, (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED, - *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0x29, - &WPP_e171f0135d683f8dea929abaa2ed97b9_Traceguids, + *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0x2a, + &WPP_39279db927ae337b8503ecc20725ff46_Traceguids, + "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c"); + } + goto LAB_1; + } + local_58 = param_2[10]; + lStack_50 = param_2[0xb]; + FltAcquireResourceExclusive(plVar2 + 0xc); + lVar3 = RtlLookupElementGenericTableAvl(plVar2 + 0x19,&local_58); + uVar4 = Feature_3303736635__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar4 == 0) { + if (lVar3 != 0) goto LAB_2; + if (((DAT_0 & 0x40) != 0) || + ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) { + uVar6 = 0x2c; + goto LAB_3; + } + } + else { + if ((lVar3 != 0) && (*(longlong *)(lVar3 + 0x18) != 0)) { +LAB_2: + ObDereferenceObjectDeferDelete(*(undefined8 *)(lVar3 + 0x10)); + uVar1 = *(undefined8 *)(lVar3 + 0x18); + RtlDeleteElementGenericTableAvl(plVar2 + 0x19,lVar3); + FltReleaseResource(plVar2 + 0xc); + FltClose(uVar1); + goto LAB_1; + } + if (((DAT_0 & 0x40) != 0) || + ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) { + uVar6 = 0x2b; +LAB_3: + WPP_RECORDER_AND_TRACE_SF_sD + (0x20e,DAT_0 & 0x40, + (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED, + *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,uVar6, + &WPP_39279db927ae337b8503ecc20725ff46_Traceguids, "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c"); } } - else { - lVar4 = IoGetCurrentProcess(); - if (lVar4 == plVar3[4]) { - local_58 = param_2[10]; - lStack_50 = param_2[0xb]; - plVar1 = plVar3 + 0xc; - FltAcquireResourceExclusive(plVar1); - lVar4 = RtlLookupElementGenericTableAvl(plVar3 + 0x19,&local_58); - if (lVar4 == 0) { - uVar5 = 0xc0000008; - if (((DAT_0 & 0x40) != 0) || - ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) { - WPP_RECORDER_AND_TRACE_SF_sD - (0x20e,DAT_0 & 0x40, - (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED, - *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0x2b, - &WPP_e171f0135d683f8dea929abaa2ed97b9_Traceguids, - "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c"); - } - FltReleaseResource(plVar1); - } - else { - ObDereferenceObjectDeferDelete(*(undefined8 *)(lVar4 + 0x10)); - uVar2 = *(undefined8 *)(lVar4 + 0x18); - RtlDeleteElementGenericTableAvl(plVar3 + 0x19,lVar4); - FltReleaseResource(plVar1); - FltClose(uVar2); - } - } - else { - uVar5 = 0xc0000022; - if (((DAT_0 & 0x40) != 0) || - ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) { - WPP_RECORDER_AND_TRACE_SF_sD - (0x20e,DAT_0 & 0x40, - (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED, - *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0x2a, - &WPP_e171f0135d683f8dea929abaa2ed97b9_Traceguids, - "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c"); - } - } - PrjfReleaseUnionContext((longlong)plVar3); - } + uVar5 = 0xc0000008; + FltReleaseResource(plVar2 + 0xc); +LAB_1: + PrjfReleaseUnionContext((longlong)plVar2); return uVar5; } ``` ## PrjfCreateUnionContext ### Match Info |Key|pj_8115.sys - pj_8246.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.78| |i_ratio|0.79| |m_ratio|0.98| |b_ratio|0.97| |match_types|SymbolsHash| ### Function Meta Diff |Key|pj_8115.sys|pj_8246.sys| | :---: | :---: | :---: | |name|PrjfCreateUnionContext|PrjfCreateUnionContext| |fullname|PrjfCreateUnionContext|PrjfCreateUnionContext| |refcount|2|2| |`length`|795|827| |`called`|NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExInitializeResourceLite
NTOSKRNL.EXE::KeInitializeEvent
NTOSKRNL.EXE::RtlCopyUnicodeString
NTOSKRNL.EXE::RtlCreateHashTableEx
NTOSKRNL.EXE::RtlDeleteHashTable
NTOSKRNL.EXE::RtlInitializeGenericTableAvl
NTOSKRNL.EXE::RtlRandomEx
PrjfReleaseUnionContext
WPP_RECORDER_AND_TRACE_SF_sD|
Expand for full list:
Feature_440600889__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExDeleteResourceLite
NTOSKRNL.EXE::ExInitializeResourceLite
NTOSKRNL.EXE::KeInitializeEvent
NTOSKRNL.EXE::RtlCopyUnicodeString
NTOSKRNL.EXE::RtlCreateHashTableEx
NTOSKRNL.EXE::RtlDeleteHashTable
NTOSKRNL.EXE::RtlInitializeGenericTableAvl
NTOSKRNL.EXE::RtlRandomEx
PrjfReleaseUnionContextWPP_RECORDER_AND_TRACE_SF_sD
| |calling|PrjfSetUnionContext|PrjfSetUnionContext| |paramcount|6|6| |`address`|14000216c|1400021c0| |sig|undefined8 __fastcall PrjfCreateUnionContext(longlong param_1, undefined4 * param_2, ushort * param_3, uint param_4, undefined1 param_5, undefined8 * param_6)|undefined8 __fastcall PrjfCreateUnionContext(longlong param_1, undefined4 * param_2, ushort * param_3, uint param_4, undefined1 param_5, undefined8 * param_6)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### PrjfCreateUnionContext Called Diff ```diff --- PrjfCreateUnionContext called +++ PrjfCreateUnionContext called @@ -0,0 +1 @@ +Feature_440600889__private_IsEnabledDeviceUsageNoInline @@ -1,0 +3 @@ +NTOSKRNL.EXE::ExDeleteResourceLite ``` ### PrjfCreateUnionContext Diff ```diff --- PrjfCreateUnionContext +++ PrjfCreateUnionContext @@ -1,107 +1,113 @@ /* WARNING: Globals starting with '_' overlap smaller symbols at the same address */ undefined8 PrjfCreateUnionContext (longlong param_1,undefined4 *param_2,ushort *param_3,uint param_4,undefined1 param_5, undefined8 *param_6) { int *piVar1; int iVar2; undefined4 uVar3; undefined4 uVar4; char cVar5; undefined4 uVar6; undefined4 *puVar7; - byte bVar8; - undefined8 uVar9; - bool bVar10; + ulonglong uVar8; + byte bVar9; + undefined8 uVar10; + bool bVar11; uint local_res18 [4]; - ushort uVar11; + ushort uVar12; undefined4 *local_38 [2]; - uVar9 = 0; + uVar10 = 0; local_res18[0] = 0; local_38[0] = (undefined4 *)0x0; puVar7 = (undefined4 *)ExAllocatePool2(0x40,(ulonglong)*param_3 + 0x32a,0x63754a50); if (puVar7 == (undefined4 *)0x0) { - uVar9 = 0xc000009a; - bVar10 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED; - bVar8 = DAT_0 & 2; - if ((bVar8 == 0) && (!bVar10)) goto LAB_1; - uVar11 = 0x21; + uVar10 = 0xc000009a; + bVar11 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED; + bVar9 = DAT_0 & 2; + if ((bVar9 == 0) && (!bVar11)) goto LAB_1; + uVar12 = 0x21; LAB_2: - uVar9 = 0xc000009a; + uVar10 = 0xc000009a; WPP_RECORDER_AND_TRACE_SF_sD - (0x209,bVar8,bVar10,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,9,uVar11, - &WPP_0def1edc605734705626ac974b591885_Traceguids, + (0x209,bVar9,bVar11,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,9,uVar12, + &WPP_16258fdb5ea53a6e7a49e4d7510d8a5c_Traceguids, "onecore\\base\\fs\\gvflt\\filter\\sys\\context.c"); } else { uVar6 = param_2[1]; uVar3 = param_2[2]; uVar4 = param_2[3]; *puVar7 = *param_2; puVar7[1] = uVar6; puVar7[2] = uVar3; puVar7[3] = uVar4; LOCK(); piVar1 = (int *)(param_1 + 0xa8); iVar2 = *piVar1; *piVar1 = *piVar1 + 1; UNLOCK(); puVar7[0xf] = iVar2 + 1; RtlInitializeGenericTableAvl (puVar7 + 0x32,PrjfCompareHandleTableEntry,PrjfAllocateHandleTableEntry, PrjfFreeHandleTableEntry,0); ExInitializeResourceLite(puVar7 + 0x18); RtlInitializeGenericTableAvl (puVar7 + 0x68,PrjfCompareCommandTableEntry,PrjfAllocateCommandTableEntry, PrjfFreeCommandTableEntry,0); ExInitializeResourceLite(puVar7 + 0x4e); KeInitializeEvent(puVar7 + 0x82,0,0); puVar7[0x16] = 1; local_res18[0] = (uint)SystemReserved1[0xf] ^ (uint)((ulonglong)_DAT_3 >> 0x20) ^ (uint)_DAT_3 ^ (uint)puVar7; uVar6 = RtlRandomEx(local_res18); puVar7[0x12] = uVar6; *(undefined8 *)(puVar7 + 0x10) = 0; *(undefined2 *)(puVar7 + 10) = 0; *(ushort *)((longlong)puVar7 + 0x2a) = *param_3; *(longlong *)(puVar7 + 0xc) = (longlong)puVar7 + 0x32a; RtlCopyUnicodeString(puVar7 + 10,param_3); *(undefined1 *)(puVar7 + 0xca) = param_5; *(undefined8 *)(puVar7 + 0x14) = 0; puVar7[0xe] = param_4; if ((param_4 & 1) != 0) { ExInitializeResourceLite(puVar7 + 0x88); local_38[0] = puVar7 + 0xa2; cVar5 = RtlCreateHashTableEx(local_38,DAT_4,0,0); if (cVar5 == '\0') { local_38[0] = (undefined4 *)0x0; - uVar9 = 0xc000009a; - bVar10 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED; - bVar8 = DAT_0 & 2; - if ((bVar8 == 0) && (!bVar10)) goto LAB_1; - uVar11 = 0x22; + uVar8 = Feature_440600889__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar8 != 0) { + puVar7[0xe] = puVar7[0xe] & 0xfffffffe; + ExDeleteResourceLite(puVar7 + 0x88); + } + uVar10 = 0xc000009a; + bVar11 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED; + bVar9 = DAT_0 & 2; + if ((bVar9 == 0) && (!bVar11)) goto LAB_1; + uVar12 = 0x22; goto LAB_2; } } *(undefined8 *)(puVar7 + 0xac) = 0; ExInitializeResourceLite(puVar7 + 0xae); local_38[0] = (undefined4 *)0x0; *param_6 = puVar7; puVar7 = (undefined4 *)0x0; } LAB_1: if (puVar7 != (undefined4 *)0x0) { PrjfReleaseUnionContext((longlong)puVar7); } if (local_38[0] != (undefined4 *)0x0) { RtlDeleteHashTable(); } - return uVar9; + return uVar10; } ``` ## PrjfWriteFileDataHandler ### Match Info |Key|pj_8115.sys - pj_8246.sys| | :---: | :---: | |diff_type|code,length,address| |ratio|0.14| |i_ratio|0.1| |m_ratio|0.97| |b_ratio|0.16| |match_types|SymbolsHash| ### Function Meta Diff |Key|pj_8115.sys|pj_8246.sys| | :---: | :---: | :---: | |name|PrjfWriteFileDataHandler|PrjfWriteFileDataHandler| |fullname|PrjfWriteFileDataHandler|PrjfWriteFileDataHandler| |refcount|2|2| |`length`|2247|2387| |called|
Expand for full list:
FLTMGR.SYS::FltAcquireResourceShared
FLTMGR.SYS::FltReleaseResource
FLTMGR.SYS::FltWriteFileEx
Feature_1083645240__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::IoAllocateMdl
NTOSKRNL.EXE::IoFreeMdl
NTOSKRNL.EXE::IoGetCurrentProcess
NTOSKRNL.EXE::MmProbeAndLockPages
NTOSKRNL.EXE::MmUnlockPages
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::ObfReferenceObjectNTOSKRNL.EXE::ProbeForRead
NTOSKRNL.EXE::RtlLookupElementGenericTableAvl
PrjfGetUnionContextByVirtualizationInstanceInfo
PrjfManageHydrationOnNonCachedHandle
PrjfReleaseUnionContext
PrjfValidateHandleAccess
WPP_RECORDER_AND_TRACE_SF_sD
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDdZ
WPP_RECORDER_AND_TRACE_SF_sDdiiZ
WPP_RECORDER_AND_TRACE_SF_sDsiLiLZ
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
|
Expand for full list:
FLTMGR.SYS::FltAcquireResourceShared
FLTMGR.SYS::FltReleaseResource
FLTMGR.SYS::FltWriteFileEx
Feature_1083645240__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::IoAllocateMdl
NTOSKRNL.EXE::IoFreeMdl
NTOSKRNL.EXE::IoGetCurrentProcess
NTOSKRNL.EXE::MmProbeAndLockPages
NTOSKRNL.EXE::MmUnlockPages
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::ObfReferenceObjectNTOSKRNL.EXE::ProbeForRead
NTOSKRNL.EXE::RtlLookupElementGenericTableAvl
PrjfGetUnionContextByVirtualizationInstanceInfo
PrjfManageHydrationOnNonCachedHandle
PrjfReleaseUnionContext
PrjfValidateHandleAccess
WPP_RECORDER_AND_TRACE_SF_sD
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDdZ
WPP_RECORDER_AND_TRACE_SF_sDdiiZ
WPP_RECORDER_AND_TRACE_SF_sDsiLiLZ
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
| |calling|PrjfPortMessage|PrjfPortMessage| |paramcount|3|3| |`address`|14003673c|140036778| |sig|longlong * __fastcall PrjfWriteFileDataHandler(undefined8 param_1, uint * param_2, uint param_3)|longlong * __fastcall PrjfWriteFileDataHandler(undefined8 param_1, uint * param_2, uint param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### PrjfWriteFileDataHandler Diff ```diff --- PrjfWriteFileDataHandler +++ PrjfWriteFileDataHandler @@ -1,262 +1,270 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ /* WARNING: Globals starting with '_' overlap smaller symbols at the same address */ longlong * PrjfWriteFileDataHandler(undefined8 param_1,uint *param_2,uint param_3) { longlong lVar1; bool bVar2; uint uVar3; - longlong lVar4; - ulonglong uVar5; - longlong *plVar6; + longlong *plVar4; + longlong lVar5; + ulonglong uVar6; longlong *plVar7; - ulonglong uVar8; - byte bVar9; - longlong *plVar10; - longlong *plVar11; + longlong *plVar8; + longlong *plVar9; + ulonglong uVar10; + byte bVar11; longlong *plVar12; - bool bVar13; - undefined1 auStackY_148 [32]; - ushort uVar14; - undefined8 in_stack_ffffffffffffff00; - undefined4 uVar15; - undefined8 in_stack_ffffffffffffff08; + longlong *plVar13; + bool bVar14; + undefined1 auStackY_158 [32]; + ushort uVar15; + undefined8 in_stack_fffffffffffffef0; undefined4 uVar16; - uint local_c4; + undefined8 in_stack_fffffffffffffef8; + undefined4 uVar17; + uint local_c8 [2]; longlong *local_c0; undefined4 local_b8; undefined4 local_b4; undefined8 local_b0; longlong *local_a8; - longlong *local_a0; undefined8 local_98 [4]; uint *local_78; undefined8 local_70; uint *local_68; undefined8 local_60; longlong local_58; uint local_50 [2]; longlong **local_48; undefined8 local_40; ulonglong local_38; - uVar15 = (undefined4)((ulonglong)in_stack_ffffffffffffff00 >> 0x20); - uVar16 = (undefined4)((ulonglong)in_stack_ffffffffffffff08 >> 0x20); - local_38 = __security_cookie ^ (ulonglong)auStackY_148; - plVar6 = (longlong *)0x0; - plVar11 = (longlong *)0x0; - plVar12 = (longlong *)0x0; + uVar16 = (undefined4)((ulonglong)in_stack_fffffffffffffef0 >> 0x20); + uVar17 = (undefined4)((ulonglong)in_stack_fffffffffffffef8 >> 0x20); + local_38 = __security_cookie ^ (ulonglong)auStackY_158; + plVar8 = (longlong *)0x0; + plVar13 = (longlong *)0x0; local_b8 = 0; bVar2 = false; - plVar10 = (longlong *)0x0; + plVar12 = (longlong *)0x0; local_a8 = (longlong *)0x0; local_b0 = param_1; if (param_3 < *param_2) { - plVar7 = (longlong *)0xc000000d; - bVar13 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED; - bVar9 = DAT_0 & 0x40; - plVar11 = plVar6; - if ((bVar9 == 0) && (plVar10 = plVar6, plVar12 = plVar6, !bVar13)) goto LAB_1; - uVar14 = 0x33; -LAB_2: - plVar7 = (longlong *)0xc000000d; - plVar10 = plVar6; - plVar12 = plVar6; + if (((DAT_0 & 0x40) != 0) || + ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) { + uVar15 = 0x34; +LAB_1: + WPP_RECORDER_AND_TRACE_SF_sDD + (0x20e,DAT_0 & 0x40, + (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED, + *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,uVar15, + &WPP_39279db927ae337b8503ecc20725ff46_Traceguids, + "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c"); + } } else { - if (*param_2 < 0x78) { - plVar7 = (longlong *)0xc000000d; - bVar13 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED; - bVar9 = DAT_0 & 0x40; - if ((bVar9 == 0) && (!bVar13)) goto LAB_1; - uVar14 = 0x34; + if (0x77 < *param_2) { + plVar4 = PrjfGetUnionContextByVirtualizationInstanceInfo((longlong *)(param_2 + 2),param_1); + if (plVar4 == (longlong *)0x0) { + plVar9 = (longlong *)0xc000000d; + bVar14 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED; + bVar11 = DAT_0 & 0x40; + if ((bVar11 == 0) && (!bVar14)) goto LAB_2; + uVar15 = 0x36; + plVar12 = plVar8; + plVar13 = plVar8; + } + else { + lVar5 = IoGetCurrentProcess(); + if (lVar5 != plVar4[4]) { + plVar9 = (longlong *)0xc0000022; + if (((DAT_0 & 0x40) != 0) || + ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) { + WPP_RECORDER_AND_TRACE_SF_sD + (0x20e,DAT_0 & 0x40, + (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED, + *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0x37, + &WPP_39279db927ae337b8503ecc20725ff46_Traceguids, + "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c"); + plVar12 = plVar8; + plVar13 = plVar8; + } + goto LAB_2; + } + plVar7 = plVar4 + 0xc; + FltAcquireResourceShared(plVar7); + lVar5 = RtlLookupElementGenericTableAvl(plVar4 + 0x19,param_2 + 0x16); + if (lVar5 == 0) { + FltReleaseResource(plVar7); + plVar9 = (longlong *)0xc0000008; + bVar14 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED; + bVar11 = DAT_0 & 0x40; + if ((bVar11 == 0) && (!bVar14)) goto LAB_2; + uVar15 = 0x38; + } + else { + plVar13 = *(longlong **)(lVar5 + 0x10); + local_c0 = plVar13; + ObfReferenceObject(plVar13); + uVar6 = Feature_1083645240__private_IsEnabledDeviceUsageNoInline(); + plVar9 = plVar8; + if ((int)uVar6 != 0) { + uVar6 = PrjfValidateHandleAccess(*(longlong *)(lVar5 + 0x18),6,(longlong)plVar13); + plVar9 = (longlong *)(uVar6 & 0xffffffff); + } + FltReleaseResource(plVar7); + uVar6 = Feature_1083645240__private_IsEnabledDeviceUsageNoInline(); + if (((int)uVar6 == 0) || (-1 < (int)plVar9)) { + uVar6 = (ulonglong)param_2[0x1c]; + if (plVar13[3] == 0) { + plVar9 = (longlong *)0xc00000bb; + if (((DAT_0 & 0x40) != 0) || + ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) { + WPP_RECORDER_AND_TRACE_SF_sDdZ + (0x20e,DAT_0 & 0x40, + (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED, + *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0x3a, + &WPP_39279db927ae337b8503ecc20725ff46_Traceguids, + "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c",CONCAT44(uVar16,0x613) + ,CONCAT44(uVar17,0xc00000bb),(wchar_t *)(plVar13 + 0xb)); + } + if (5 < DAT_3) { + if (((_DAT_4 & 0x400000000000) == 0) || + (bVar14 = true, (DAT_5 & 0x400000000000) != DAT_5)) { + bVar14 = false; + } + if (bVar14) { + local_c8[0] = *(uint *)(plVar13 + 10) >> 3 & 1; + local_78 = local_c8; + local_70 = 4; + local_68 = local_50; + local_60 = 2; + local_58 = plVar13[0xc]; + local_50[0] = (uint)*(ushort *)(plVar13 + 0xb); + local_50[1] = 0; + local_c0 = (longlong *)0x1000000; + local_48 = &local_c0; + local_40 = 8; + _tlgWriteTransfer_EtwWriteTransfer(0x14001b068,&DAT_6,0,0,6,local_98); + } + } + goto LAB_2; + } + lVar5 = *(longlong *)(plVar13[3] + 0x20); + lVar1 = *(longlong *)(param_2 + 0x1a); + if ((lVar1 < 0) || (lVar5 < lVar1)) { + plVar9 = (longlong *)0xc000000d; + if (((DAT_0 & 0x40) != 0) || + ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) { + WPP_RECORDER_AND_TRACE_SF_sDdiiZ + (CONCAT71((int7)((ulonglong)plVar7 >> 8),DAT_0) & + 0xffffffffffffff40,DAT_0 & 0x40, + (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED, + *(undefined8 *)(WPP_GLOBAL_Control + 0x40)); + } + goto LAB_2; + } + uVar10 = lVar5 - lVar1; + if (uVar10 < uVar6) { + uVar6 = uVar10; + if (((DAT_7 & 0x40) != 0) || + ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) { + uVar17 = 1; + WPP_RECORDER_AND_TRACE_SF_sDsiLiLZ + (plVar13 + 0xb,DAT_7 & 0x40, + (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED, + *(undefined8 *)(WPP_GLOBAL_Control + 0x40)); + } + } + ProbeForRead(*(undefined8 *)(param_2 + 0x1e),param_2[0x1c],1); + plVar12 = (longlong *)IoAllocateMdl(*(undefined8 *)(param_2 + 0x1e),param_2[0x1c],0,0); + local_a8 = plVar12; + if (plVar12 == (longlong *)0x0) { + plVar9 = (longlong *)0xc000009a; + local_b4 = 0xc000009a; + if (((DAT_0 & 0x40) != 0) || + ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) { + WPP_RECORDER_AND_TRACE_SF_sDdZ + (0x20e,DAT_0 & 0x40, + (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED, + *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0x3d, + &WPP_39279db927ae337b8503ecc20725ff46_Traceguids, + "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c",CONCAT44(uVar16,0x668) + ,CONCAT44(uVar17,0xc000009a),(wchar_t *)(plVar13 + 0xb)); + } + goto LAB_2; + } + MmProbeAndLockPages(plVar12,0,0); + bVar2 = true; + if ((*(uint *)(plVar13 + 10) & 8) == 0) { + uVar17 = 0; + plVar8 = plVar12; + uVar3 = FltWriteFileEx(local_b0,plVar13,param_2 + 0x1a,uVar6 & 0xffffffff); + plVar9 = (longlong *)(ulonglong)uVar3; + if ((int)uVar3 < 0) { + if (((DAT_0 & 4) != 0) || + ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) { + WPP_RECORDER_AND_TRACE_SF_sDdZ + (0x20a,DAT_0 & 4, + (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED, + *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,10,0x40, + &WPP_39279db927ae337b8503ecc20725ff46_Traceguids, + "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c", + CONCAT44(uVar17,0x6a6),CONCAT44((int)((ulonglong)plVar8 >> 0x20),uVar3) + ,(wchar_t *)(plVar13 + 0xb)); + } + } + goto LAB_2; + } + uVar3 = PrjfManageHydrationOnNonCachedHandle + (local_b0,(ulonglong)plVar13,(longlong)param_2,(longlong)plVar12); + plVar9 = (longlong *)(ulonglong)uVar3; + if (-1 < (int)uVar3) goto LAB_2; + bVar14 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED; + bVar11 = DAT_0 & 0x40; + if ((bVar11 == 0) && (!bVar14)) goto LAB_2; + uVar15 = 0x3f; + } + else { + bVar14 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED; + bVar11 = DAT_0 & 0x40; + if ((bVar11 == 0) && (!bVar14)) goto LAB_2; + uVar15 = 0x39; + } + } + } + WPP_RECORDER_AND_TRACE_SF_sDD + (0x20e,bVar11,bVar14,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,uVar15, + &WPP_39279db927ae337b8503ecc20725ff46_Traceguids, + "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c"); goto LAB_2; } - plVar11 = PrjfGetUnionContextByVirtualizationInstanceInfo((longlong *)(param_2 + 2),param_1); - local_a0 = plVar11; - if (plVar11 == (longlong *)0x0) { - plVar7 = (longlong *)0xc000000d; - bVar13 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED; - bVar9 = DAT_0 & 0x40; - if ((bVar9 == 0) && (!bVar13)) goto LAB_1; - uVar14 = 0x35; - goto LAB_2; - } - lVar4 = IoGetCurrentProcess(); - if (lVar4 != plVar11[4]) { - plVar7 = (longlong *)0xc0000022; - if (((DAT_0 & 0x40) != 0) || - ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) { - WPP_RECORDER_AND_TRACE_SF_sD - (0x20e,DAT_0 & 0x40, - (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED, - *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0x36, - &WPP_e171f0135d683f8dea929abaa2ed97b9_Traceguids, - "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c"); - } + if (((DAT_0 & 0x40) != 0) || + ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) { + uVar15 = 0x35; goto LAB_1; } - FltAcquireResourceShared(plVar11 + 0xc); - lVar4 = RtlLookupElementGenericTableAvl(plVar11 + 0x19,param_2 + 0x16); - if (lVar4 == 0) { - FltReleaseResource(plVar11 + 0xc); - plVar7 = (longlong *)0xc0000008; - bVar13 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED; - bVar9 = DAT_0 & 0x40; - if ((bVar9 == 0) && (!bVar13)) goto LAB_1; - uVar14 = 0x37; - } - else { - plVar12 = *(longlong **)(lVar4 + 0x10); - local_c0 = plVar12; - ObfReferenceObject(plVar12); - uVar5 = Feature_1083645240__private_IsEnabledDeviceUsageNoInline(); - plVar7 = plVar6; - if ((int)uVar5 != 0) { - uVar5 = PrjfValidateHandleAccess(*(longlong *)(lVar4 + 0x18),6,(longlong)plVar12); - plVar7 = (longlong *)(uVar5 & 0xffffffff); - } - plVar6 = plVar11 + 0xc; - FltReleaseResource(plVar6); - uVar5 = Feature_1083645240__private_IsEnabledDeviceUsageNoInline(); - if (((int)uVar5 == 0) || (-1 < (int)plVar7)) { - uVar5 = (ulonglong)param_2[0x1c]; - if (plVar12[3] == 0) { - plVar7 = (longlong *)0xc00000bb; - if (((DAT_0 & 0x40) != 0) || - ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) { - WPP_RECORDER_AND_TRACE_SF_sDdZ - (0x20e,DAT_0 & 0x40, - (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED, - *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0x39, - &WPP_e171f0135d683f8dea929abaa2ed97b9_Traceguids, - "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c",CONCAT44(uVar15,0x602), - CONCAT44(uVar16,0xc00000bb),(wchar_t *)(plVar12 + 0xb)); - } - if (5 < DAT_3) { - if (((_DAT_4 & 0x400000000000) == 0) || - (bVar13 = true, (DAT_5 & 0x400000000000) != DAT_5)) { - bVar13 = false; - } - if (bVar13) { - local_c4 = *(uint *)(plVar12 + 10) >> 3 & 1; - local_78 = &local_c4; - local_70 = 4; - local_68 = local_50; - local_60 = 2; - local_58 = plVar12[0xc]; - local_50[0] = (uint)*(ushort *)(plVar12 + 0xb); - local_50[1] = 0; - local_c0 = (longlong *)0x1000000; - local_48 = &local_c0; - local_40 = 8; - _tlgWriteTransfer_EtwWriteTransfer(0x14001b068,&DAT_6,0,0,6,local_98); - } - } - goto LAB_1; - } - lVar4 = *(longlong *)(plVar12[3] + 0x20); - lVar1 = *(longlong *)(param_2 + 0x1a); - if ((lVar1 < 0) || (lVar4 < lVar1)) { - plVar7 = (longlong *)0xc000000d; - if (((DAT_0 & 0x40) != 0) || - ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) { - WPP_RECORDER_AND_TRACE_SF_sDdiiZ - (CONCAT71((int7)((ulonglong)plVar6 >> 8),DAT_0) & 0xffffffffffffff40, - DAT_0 & 0x40, - (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED, - *(undefined8 *)(WPP_GLOBAL_Control + 0x40)); - } - goto LAB_1; - } - uVar8 = lVar4 - lVar1; - if (uVar8 < uVar5) { - uVar5 = uVar8; - if (((DAT_7 & 0x40) != 0) || - ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) { - uVar16 = 1; - WPP_RECORDER_AND_TRACE_SF_sDsiLiLZ - (plVar12 + 0xb,DAT_7 & 0x40, - (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED, - *(undefined8 *)(WPP_GLOBAL_Control + 0x40)); - } - } - ProbeForRead(*(undefined8 *)(param_2 + 0x1e),param_2[0x1c],1); - plVar10 = (longlong *)IoAllocateMdl(*(undefined8 *)(param_2 + 0x1e),param_2[0x1c],0,0); - local_a8 = plVar10; - if (plVar10 == (longlong *)0x0) { - plVar7 = (longlong *)0xc000009a; - local_b4 = 0xc000009a; - if (((DAT_0 & 0x40) != 0) || - ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) { - WPP_RECORDER_AND_TRACE_SF_sDdZ - (0x20e,DAT_0 & 0x40, - (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED, - *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0x3c, - &WPP_e171f0135d683f8dea929abaa2ed97b9_Traceguids, - "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c",CONCAT44(uVar15,0x657), - CONCAT44(uVar16,0xc000009a),(wchar_t *)(plVar12 + 0xb)); - } - goto LAB_1; - } - MmProbeAndLockPages(plVar10,0,0); - bVar2 = true; - if ((*(uint *)(plVar12 + 10) & 8) == 0) { - uVar16 = 0; - plVar6 = plVar10; - uVar3 = FltWriteFileEx(local_b0,plVar12,param_2 + 0x1a,uVar5 & 0xffffffff); - plVar7 = (longlong *)(ulonglong)uVar3; - if ((int)uVar3 < 0) { - if (((DAT_0 & 4) != 0) || - ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) { - WPP_RECORDER_AND_TRACE_SF_sDdZ - (0x20a,DAT_0 & 4, - (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED, - *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,10,0x3f, - &WPP_e171f0135d683f8dea929abaa2ed97b9_Traceguids, - "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c",CONCAT44(uVar16,0x695), - CONCAT44((int)((ulonglong)plVar6 >> 0x20),uVar3),(wchar_t *)(plVar12 + 0xb) - ); - } - } - goto LAB_1; - } - uVar3 = PrjfManageHydrationOnNonCachedHandle - (local_b0,(ulonglong)plVar12,(longlong)param_2,(longlong)plVar10); - plVar7 = (longlong *)(ulonglong)uVar3; - if (-1 < (int)uVar3) goto LAB_1; - bVar13 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED; - bVar9 = DAT_0 & 0x40; - if ((bVar9 == 0) && (!bVar13)) goto LAB_1; - uVar14 = 0x3e; - } - else { - bVar13 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED; - bVar9 = DAT_0 & 0x40; - if ((bVar9 == 0) && (!bVar13)) goto LAB_1; - uVar14 = 0x38; - } - } - } - WPP_RECORDER_AND_TRACE_SF_sDD - (0x20e,bVar9,bVar13,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,uVar14, - &WPP_e171f0135d683f8dea929abaa2ed97b9_Traceguids, - "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c"); -LAB_1: + } + plVar9 = (longlong *)0xc000000d; + plVar4 = plVar8; + plVar12 = plVar8; + plVar13 = plVar8; +LAB_2: + if (plVar13 != (longlong *)0x0) { + ObfDereferenceObject(plVar13); + } + if (plVar4 != (longlong *)0x0) { + PrjfReleaseUnionContext((longlong)plVar4); + } + if (bVar2) { + MmUnlockPages(plVar12); + } if (plVar12 != (longlong *)0x0) { - ObfDereferenceObject(plVar12); - } - if (plVar11 != (longlong *)0x0) { - PrjfReleaseUnionContext((longlong)plVar11); - } - if (bVar2) { - MmUnlockPages(plVar10); - } - if (plVar10 != (longlong *)0x0) { - IoFreeMdl(plVar10); - } - return plVar7; + IoFreeMdl(plVar12); + } + return plVar9; } ``` ## PrjfCompleteCommandHandler ### Match Info |Key|pj_8115.sys - pj_8246.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.86| |i_ratio|0.49| |m_ratio|0.98| |b_ratio|0.63| |match_types|SymbolsHash| ### Function Meta Diff |Key|pj_8115.sys|pj_8246.sys| | :---: | :---: | :---: | |name|PrjfCompleteCommandHandler|PrjfCompleteCommandHandler| |fullname|PrjfCompleteCommandHandler|PrjfCompleteCommandHandler| |refcount|2|2| |`length`|952|930| |`called`|
Expand for full list:
FLTMGR.SYS::FltAcquireResourceExclusive
FLTMGR.SYS::FltReleaseResource
NTOSKRNL.EXE::KeSetEvent
NTOSKRNL.EXE::RtlLookupElementGenericTableAvl
PrjfGetUnionContextByVirtualizationInstanceInfo
PrjfReleaseUnionContext
WPP_RECORDER_AND_TRACE_SF_sD
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDl
WPP_RECORDER_AND_TRACE_SF_sDlLL
memcpy
|
Expand for full list:
FLTMGR.SYS::FltAcquireResourceExclusive
FLTMGR.SYS::FltReleaseResource
NTOSKRNL.EXE::KeSetEvent
NTOSKRNL.EXE::RtlLookupElementGenericTableAvl
PrjfGetUnionContextByVirtualizationInstanceInfo
PrjfReleaseUnionContext
WPP_RECORDER_AND_TRACE_SF_sD
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDl
WPP_RECORDER_AND_TRACE_SF_sDlLL
memmove
| |calling|PrjfPortMessage|PrjfPortMessage| |paramcount|2|2| |`address`|140004a08|140004b78| |sig|undefined __fastcall PrjfCompleteCommandHandler(undefined8 param_1, uint * param_2)|undefined __fastcall PrjfCompleteCommandHandler(undefined8 param_1, uint * param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### PrjfCompleteCommandHandler Called Diff ```diff --- PrjfCompleteCommandHandler called +++ PrjfCompleteCommandHandler called @@ -11 +11 @@ -memcpy +memmove ``` ### PrjfCompleteCommandHandler Diff ```diff --- PrjfCompleteCommandHandler +++ PrjfCompleteCommandHandler @@ -1,114 +1,116 @@ void PrjfCompleteCommandHandler(undefined8 param_1,uint *param_2) { uint uVar1; longlong lVar2; longlong *plVar3; longlong lVar4; + longlong *plVar5; undefined1 in_stack_ffffffffffffff98; undefined7 in_stack_ffffffffffffff99; undefined4 in_stack_ffffffffffffffa0; undefined4 in_stack_ffffffffffffffa4; - ushort uVar5; + ushort uVar6; undefined8 local_18; undefined8 uStack_10; local_18 = 0; uStack_10 = 0; if (*param_2 < 100) { if (((DAT_0 & 0x40) == 0) && ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) { return; } - uVar5 = 0x40; + uVar6 = 0x41; LAB_1: WPP_RECORDER_AND_TRACE_SF_sDD (0x20e,DAT_0 & 0x40, (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED, - *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,uVar5, - &WPP_e171f0135d683f8dea929abaa2ed97b9_Traceguids, + *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,uVar6, + &WPP_39279db927ae337b8503ecc20725ff46_Traceguids, "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c"); return; } uVar1 = param_2[0x18] + 100; if (uVar1 < param_2[0x18]) { if (((DAT_0 & 0x40) == 0) && ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) { return; } - uVar5 = 0x41; + uVar6 = 0x42; goto LAB_1; } if (*param_2 < uVar1) { if (((DAT_0 & 0x40) == 0) && ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) { return; } - uVar5 = 0x42; + uVar6 = 0x43; goto LAB_1; } plVar3 = PrjfGetUnionContextByVirtualizationInstanceInfo((longlong *)(param_2 + 2),param_1); if (plVar3 == (longlong *)0x0) { if (((DAT_0 & 0x40) == 0) && ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) { return; } WPP_RECORDER_AND_TRACE_SF_sD (0x20e,DAT_0 & 0x40, (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED, - *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0x43, - &WPP_e171f0135d683f8dea929abaa2ed97b9_Traceguids, + *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0x44, + &WPP_39279db927ae337b8503ecc20725ff46_Traceguids, "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c"); return; } local_18 = CONCAT44(local_18._4_4_,param_2[0x16]); FltAcquireResourceExclusive(plVar3 + 0x27); - lVar4 = RtlLookupElementGenericTableAvl(plVar3 + 0x34,&local_18); + plVar5 = plVar3 + 0x34; + lVar4 = RtlLookupElementGenericTableAvl(plVar5,&local_18); if (lVar4 == 0) { if (((DAT_2 & 0x40) == 0) && ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) goto LAB_3; - uVar5 = 0x44; + uVar6 = 0x45; } else { if (*(int *)(lVar4 + 4) != 2) { lVar2 = *(longlong *)(lVar4 + 8); if (*(uint *)(lVar2 + 0x1c) < param_2[0x18]) { *(undefined4 *)(lVar2 + 0x18) = 0xc0000023; *(uint *)(*(longlong *)(lVar4 + 8) + 0x1c) = param_2[0x18]; if (((DAT_0 & 0x40) != 0) || ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) { WPP_RECORDER_AND_TRACE_SF_sDlLL ((ulonglong)*(uint *)(*(longlong *)(lVar4 + 8) + 0x1c),DAT_0 & 0x40, (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED, *(undefined8 *)(WPP_GLOBAL_Control + 0x40)); } } else { *(uint *)(lVar2 + 0x18) = param_2[0x17]; if (param_2[0x18] != 0) { *(uint *)(*(longlong *)(lVar4 + 8) + 0x1c) = param_2[0x18]; - memcpy(*(void **)(*(longlong *)(lVar4 + 8) + 0x20),param_2 + 0x19,(ulonglong)param_2[0x18] - ); + memmove(*(void **)(*(longlong *)(lVar4 + 8) + 0x20),param_2 + 0x19, + (ulonglong)param_2[0x18]); } } *(undefined4 *)(lVar4 + 4) = 2; KeSetEvent(*(undefined8 *)(lVar4 + 8),0,0); goto LAB_3; } if (((DAT_2 & 0x40) == 0) && ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) goto LAB_3; - uVar5 = 0x45; + uVar6 = 0x46; } WPP_RECORDER_AND_TRACE_SF_sDl - (&WPP_RECORDER_INITIALIZED,DAT_2 & 0x40, + (plVar5,DAT_2 & 0x40, (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED, *(undefined8 *)(WPP_GLOBAL_Control + 0x40), CONCAT71(in_stack_ffffffffffffff99,in_stack_ffffffffffffff98), - CONCAT44(in_stack_ffffffffffffffa4,in_stack_ffffffffffffffa0),uVar5); + CONCAT44(in_stack_ffffffffffffffa4,in_stack_ffffffffffffffa0),uVar6); LAB_3: FltReleaseResource(plVar3 + 0x27); PrjfReleaseUnionContext((longlong)plVar3); return; } ``` ## PrjfPortConnect ### Match Info |Key|pj_8115.sys - pj_8246.sys| | :---: | :---: | |diff_type|code,length,sig,address,called| |ratio|0.28| |i_ratio|0.35| |m_ratio|0.96| |b_ratio|0.79| |match_types|SymbolsHash| ### Function Meta Diff |Key|pj_8115.sys|pj_8246.sys| | :---: | :---: | :---: | |name|PrjfPortConnect|PrjfPortConnect| |fullname|PrjfPortConnect|PrjfPortConnect| |refcount|4|4| |`length`|1529|1455| |`called`|MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
PrjfAllocateUnicodeString
PrjfGetInstanceFromVolumeName
PrjfVerifyAccessAndSetClientPortIfNeeded
WPP_RECORDER_AND_TRACE_SF_sD
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDdD|
Expand for full list:
Feature_3411221816__private_IsEnabledDeviceUsageNoInline
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
PrjfAllocateUnicodeString
PrjfGetInstanceFromVolumeName
PrjfVerifyAccessAndSetClientPortIfNeeded
RtlUnicodeStringCbCopyStringN
WPP_RECORDER_AND_TRACE_SF_sD
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDdD
| |calling||| |paramcount|5|5| |`address`|1400319e0|140031a60| |`sig`|longlong * __fastcall PrjfPortConnect(undefined8 param_1, undefined8 param_2, longlong * param_3, uint param_4, longlong * param_5)|ulonglong __fastcall PrjfPortConnect(undefined8 param_1, undefined8 param_2, longlong * param_3, uint param_4, longlong * param_5)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### PrjfPortConnect Called Diff ```diff --- PrjfPortConnect called +++ PrjfPortConnect called @@ -0,0 +1 @@ +Feature_3411221816__private_IsEnabledDeviceUsageNoInline @@ -6,0 +8 @@ +RtlUnicodeStringCbCopyStringN ``` ### PrjfPortConnect Diff ```diff --- PrjfPortConnect +++ PrjfPortConnect @@ -1,210 +1,190 @@ -longlong * -PrjfPortConnect(undefined8 param_1,undefined8 param_2,longlong *param_3,uint param_4, - longlong *param_5) +ulonglong PrjfPortConnect(undefined8 param_1,undefined8 param_2,longlong *param_3,uint param_4, + longlong *param_5) { - uint uVar1; - undefined8 *puVar2; - ulonglong uVar3; + longlong *plVar1; + uint uVar2; + undefined8 *puVar3; ulonglong uVar4; - short *psVar5; + short sVar5; byte bVar6; - short sVar7; + ulonglong uVar7; longlong *plVar8; - longlong *plVar9; + bool bVar9; longlong *plVar10; - longlong lVar11; - longlong *plVar12; - bool bVar13; - ushort uVar14; + ushort uVar11; undefined8 local_48; - undefined8 local_40; + wchar_t local_40; + short sStack_3e; + undefined4 uStack_3c; longlong lStack_38; longlong local_28; longlong lStack_20; - plVar12 = (longlong *)0x0; + uVar7 = 0; local_48 = 0; - plVar9 = (longlong *)0x0; - local_40 = 0; + _local_40 = 0; lStack_38 = 0; - plVar10 = plVar12; + plVar8 = (longlong *)0x0; if (param_4 == 0) { LAB_0: - puVar2 = (undefined8 *)ExAllocatePool2(0x100,0x20,0x6f634a50); - if (puVar2 != (undefined8 *)0x0) { - if (plVar10 == (longlong *)0x0) { - *(undefined4 *)(puVar2 + 3) = 2; + puVar3 = (undefined8 *)ExAllocatePool2(0x100,0x20,0x6f634a50); + if (puVar3 != (undefined8 *)0x0) { + if (plVar8 == (longlong *)0x0) { + *(undefined4 *)(puVar3 + 3) = 2; LAB_1: - puVar2[1] = local_48; - *puVar2 = param_1; - *param_5 = (longlong)puVar2; + puVar3[1] = local_48; + *puVar3 = param_1; + *param_5 = (longlong)puVar3; goto LAB_2; } - if (*(uint *)(plVar10 + 2) < 2) { - *(uint *)(puVar2 + 3) = *(uint *)(plVar10 + 2); - if ((ushort)(*(short *)((longlong)plVar10 + 0x14) - 1U) < 0x7fff) { - local_40._0_4_ = CONCAT22(*(short *)((longlong)plVar10 + 0x14) * 2,(wchar_t)local_40); - uVar3 = PrjfAllocateUnicodeString(0x69764a50,(undefined2 *)&local_40); - plVar9 = (longlong *)(uVar3 & 0xffffffff); - if ((int)uVar3 < 0) { - bVar13 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED; - bVar6 = DAT_3 & 0x40; - if ((bVar6 == 0) && (!bVar13)) goto LAB_4; - uVar14 = 0x56; + if (*(uint *)(plVar8 + 2) < 2) { + *(uint *)(puVar3 + 3) = *(uint *)(plVar8 + 2); + uVar7 = Feature_3411221816__private_IsEnabledDeviceUsageNoInline(); + sVar5 = *(short *)((longlong)plVar8 + 0x14); + if ((int)uVar7 == 0) { + if ((ushort)(sVar5 - 1U) < 0x7fff) { + sVar5 = sVar5 * 2; + goto LAB_3; + } + uVar7 = 0xc000000d; + bVar9 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED; + bVar6 = DAT_4 & 0x40; + if ((bVar6 != 0) || (bVar9)) { + uVar11 = 0x57; + goto LAB_5; + } + } + else if ((ushort)(sVar5 - 1U) < 0xfffe) { +LAB_3: + _local_40 = CONCAT22(sVar5,local_40); + uVar4 = PrjfAllocateUnicodeString(0x69764a50,&local_40); + uVar7 = uVar4 & 0xffffffff; + if ((int)uVar4 < 0) { + bVar9 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED; + bVar6 = DAT_4 & 0x40; + if ((bVar6 != 0) || (bVar9)) { + uVar11 = 0x58; +LAB_6: + WPP_RECORDER_AND_TRACE_SF_sDD + (0x20e,bVar6,bVar9,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,uVar11, + &WPP_39279db927ae337b8503ecc20725ff46_Traceguids, + "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c"); + } } else { - uVar3 = (ulonglong)*(ushort *)((longlong)plVar10 + 0x14); - if (((local_40 & 1) == 0) && ((local_40 & 0x10000) == 0)) { - if ((((ushort)local_40._2_2_ < (ushort)(wchar_t)local_40) || - (local_40._2_2_ == L'\xffff')) || - ((lStack_38 == 0 && (((wchar_t)local_40 != L'\0' || (local_40._2_2_ != L'\0')))))) - goto LAB_5; - uVar4 = (ulonglong)((ushort)local_40._2_2_ >> 1); - sVar7 = 0; - if (uVar3 < 0x8000) { - psVar5 = (short *)((longlong)plVar10 + 0x16); - plVar8 = plVar12; - if (uVar4 != 0) { - lVar11 = lStack_38 - (longlong)psVar5; - do { - sVar7 = (short)plVar8; - plVar9 = plVar12; - if (uVar3 == 0) goto LAB_6; - if (*psVar5 == 0) break; - *(short *)((longlong)psVar5 + lVar11) = *psVar5; - uVar3 = uVar3 - 1; - psVar5 = psVar5 + 1; - plVar8 = (longlong *)((longlong)plVar8 + 1); - uVar4 = uVar4 - 1; - } while (uVar4 != 0); - sVar7 = (short)plVar8; - plVar9 = (longlong *)0x0; - if (uVar4 != 0) goto LAB_6; - } - sVar7 = (short)plVar8; - plVar9 = (longlong *)0x0; - if ((uVar3 != 0) && (plVar9 = (longlong *)0x0, *psVar5 != 0)) { - plVar9 = (longlong *)0x80000005; + uVar4 = Feature_3411221816__private_IsEnabledDeviceUsageNoInline(); + uVar7 = (ulonglong)*(ushort *)((longlong)plVar8 + 0x14); + if ((int)uVar4 == 0) { + uVar7 = (ulonglong)*(ushort *)((longlong)plVar8 + 0x14) * 2; + } + uVar4 = RtlUnicodeStringCbCopyStringN + ((ushort *)&local_40,(short *)((longlong)plVar8 + 0x16),uVar7); + uVar7 = uVar4 & 0xffffffff; + if ((int)uVar4 < 0) { + bVar9 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED; + bVar6 = DAT_4 & 0x40; + if ((bVar6 != 0) || (bVar9)) { + uVar11 = 0x59; + goto LAB_6; + } + } + else { + uVar4 = PrjfGetInstanceFromVolumeName(&local_40,&local_48); + uVar7 = uVar4 & 0xffffffff; + if ((int)uVar4 < 0) { + bVar9 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED; + bVar6 = DAT_4 & 0x40; + if ((bVar6 != 0) || (bVar9)) { + uVar11 = 0x5a; + goto LAB_6; } } else { - plVar9 = (longlong *)0xc000000d; - } -LAB_6: - local_40 = CONCAT62(local_40._2_6_,sVar7 * 2); - if (-1 < (int)plVar9) { - uVar3 = PrjfGetInstanceFromVolumeName((wchar_t *)&local_40,&local_48); - plVar9 = (longlong *)(uVar3 & 0xffffffff); - if ((int)uVar3 < 0) { - bVar13 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED; - bVar6 = DAT_3 & 0x40; - if ((bVar6 != 0) || (bVar13)) { - uVar14 = 0x58; - goto LAB_7; + local_28 = *plVar8; + lStack_20 = plVar8[1]; + plVar1 = puVar3 + 2; + plVar10 = plVar1; + uVar2 = PrjfVerifyAccessAndSetClientPortIfNeeded + (local_48,&local_28,param_1,(int)plVar8[2],plVar1); + uVar7 = (ulonglong)uVar2; + if (-1 < (int)uVar2) { + if (((int)plVar8[2] == 0) && (*plVar1 == 0)) { + MicrosoftTelemetryAssertTriggeredNoArgsKM(); } + goto LAB_1; } - else { - local_28 = *plVar10; - lStack_20 = plVar10[1]; - plVar12 = puVar2 + 2; - plVar8 = plVar12; - uVar1 = PrjfVerifyAccessAndSetClientPortIfNeeded - (local_48,&local_28,param_1,(int)plVar10[2],plVar12); - plVar9 = (longlong *)(ulonglong)uVar1; - if (-1 < (int)uVar1) { - if (((int)plVar10[2] == 0) && (*plVar12 == 0)) { - MicrosoftTelemetryAssertTriggeredNoArgsKM(); - } - goto LAB_1; - } - if (((DAT_3 & 0x40) != 0) || - ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) { - WPP_RECORDER_AND_TRACE_SF_sDdD - (0x20e,DAT_3 & 0x40, - (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED, - *(undefined8 *)(WPP_GLOBAL_Control + 0x40),plVar8,0xe,0x59, - &WPP_e171f0135d683f8dea929abaa2ed97b9_Traceguids, - "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c"); - } + if (((DAT_4 & 0x40) != 0) || + ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) { + WPP_RECORDER_AND_TRACE_SF_sDdD + (0x20e,DAT_4 & 0x40, + (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED, + *(undefined8 *)(WPP_GLOBAL_Control + 0x40),plVar10,0xe,0x5b, + &WPP_39279db927ae337b8503ecc20725ff46_Traceguids, + "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c"); } - goto LAB_4; } } - else { -LAB_5: - plVar9 = (longlong *)0xc000000d; - } - bVar13 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED; - bVar6 = DAT_3 & 0x40; - if ((bVar6 == 0) && (!bVar13)) goto LAB_4; - uVar14 = 0x57; } -LAB_7: - WPP_RECORDER_AND_TRACE_SF_sDD - (0x20e,bVar6,bVar13,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,uVar14, - &WPP_e171f0135d683f8dea929abaa2ed97b9_Traceguids, - "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c"); } else { - plVar9 = (longlong *)0xc000000d; - bVar13 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED; - bVar6 = DAT_3 & 0x40; - if ((bVar6 != 0) || (bVar13)) { - uVar14 = 0x55; - goto LAB_8; + uVar7 = 0xc000000d; + bVar9 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED; + bVar6 = DAT_4 & 0x40; + if ((bVar6 != 0) || (bVar9)) { + uVar11 = 0x56; + goto LAB_5; } } } else { - plVar9 = (longlong *)0xc000000d; - bVar13 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED; - bVar6 = DAT_3 & 0x40; - if ((bVar6 != 0) || (bVar13)) { - uVar14 = 0x54; -LAB_8: - plVar9 = (longlong *)0xc000000d; + uVar7 = 0xc000000d; + bVar9 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED; + bVar6 = DAT_4 & 0x40; + if ((bVar6 != 0) || (bVar9)) { + uVar11 = 0x55; +LAB_5: + uVar7 = 0xc000000d; WPP_RECORDER_AND_TRACE_SF_sD - (0x20e,bVar6,bVar13,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,uVar14, - &WPP_e171f0135d683f8dea929abaa2ed97b9_Traceguids, + (0x20e,bVar6,bVar9,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,uVar11, + &WPP_39279db927ae337b8503ecc20725ff46_Traceguids, "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c"); } } -LAB_4: - ExFreePoolWithTag(puVar2,0x6f634a50); + ExFreePoolWithTag(puVar3,0x6f634a50); goto LAB_2; } - plVar9 = (longlong *)0xc000009a; - bVar13 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED; - bVar6 = DAT_3 & 0x40; - if ((bVar6 == 0) && (!bVar13)) goto LAB_2; - uVar14 = 0x53; + uVar7 = 0xc000009a; + bVar9 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED; + bVar6 = DAT_4 & 0x40; + if ((bVar6 == 0) && (!bVar9)) goto LAB_2; + uVar11 = 0x54; } else if (param_4 < 0x16) { - plVar9 = (longlong *)0xc000000d; - bVar13 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED; - bVar6 = DAT_3 & 0x40; - if ((bVar6 == 0) && (!bVar13)) goto LAB_2; - uVar14 = 0x51; + uVar7 = 0xc000000d; + bVar9 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED; + bVar6 = DAT_4 & 0x40; + if ((bVar6 == 0) && (!bVar9)) goto LAB_2; + uVar11 = 0x52; } else { - plVar10 = param_3; + plVar8 = param_3; if (*(ushort *)((longlong)param_3 + 0x14) + 0x16 <= param_4) goto LAB_0; - plVar9 = (longlong *)0xc000000d; - bVar13 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED; - bVar6 = DAT_3 & 0x40; - if ((bVar6 == 0) && (!bVar13)) goto LAB_2; - uVar14 = 0x52; + uVar7 = 0xc000000d; + bVar9 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED; + bVar6 = DAT_4 & 0x40; + if ((bVar6 == 0) && (!bVar9)) goto LAB_2; + uVar11 = 0x53; } WPP_RECORDER_AND_TRACE_SF_sDD - (0x20e,bVar6,bVar13,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,uVar14, - &WPP_e171f0135d683f8dea929abaa2ed97b9_Traceguids, + (0x20e,bVar6,bVar9,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,uVar11, + &WPP_39279db927ae337b8503ecc20725ff46_Traceguids, "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c"); LAB_2: if (lStack_38 != 0) { ExFreePoolWithTag(lStack_38,0x69764a50); } - return plVar9; + return uVar7; } ``` ## PrjfScheduleExpansionWorkItem ### Match Info |Key|pj_8115.sys - pj_8246.sys| | :---: | :---: | |diff_type|code,length,called| |ratio|0.93| |i_ratio|0.59| |m_ratio|0.94| |b_ratio|0.9| |match_types|SymbolsHash| ### Function Meta Diff |Key|pj_8115.sys|pj_8246.sys| | :---: | :---: | :---: | |name|PrjfScheduleExpansionWorkItem|PrjfScheduleExpansionWorkItem| |fullname|PrjfScheduleExpansionWorkItem|PrjfScheduleExpansionWorkItem| |refcount|3|3| |`length`|351|380| |`called`|FLTMGR.SYS::FltAllocateGenericWorkItem
FLTMGR.SYS::FltFreeGenericWorkItem
FLTMGR.SYS::FltQueueGenericWorkItem
NTOSKRNL.EXE::KeClearEvent
NTOSKRNL.EXE::KeWaitForSingleObject
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::ObfReferenceObject|FLTMGR.SYS::FltAllocateGenericWorkItem
FLTMGR.SYS::FltFreeGenericWorkItem
FLTMGR.SYS::FltQueueGenericWorkItem
Feature_2428439865__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::KeClearEvent
NTOSKRNL.EXE::KeWaitForSingleObject
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::ObfReferenceObject| |calling|PrjfExpansionCsqInsertIo
PrjfLaunchExpansion|PrjfExpansionCsqInsertIo
PrjfLaunchExpansion| |paramcount|4|4| |address|14002bb54|14002bb54| |sig|ulonglong __fastcall PrjfScheduleExpansionWorkItem(undefined8 param_1, undefined8 param_2, longlong param_3, longlong param_4)|ulonglong __fastcall PrjfScheduleExpansionWorkItem(undefined8 param_1, undefined8 param_2, longlong param_3, longlong param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### PrjfScheduleExpansionWorkItem Called Diff ```diff --- PrjfScheduleExpansionWorkItem called +++ PrjfScheduleExpansionWorkItem called @@ -3,0 +4 @@ +Feature_2428439865__private_IsEnabledDeviceUsageNoInline ``` ### PrjfScheduleExpansionWorkItem Diff ```diff --- PrjfScheduleExpansionWorkItem +++ PrjfScheduleExpansionWorkItem @@ -1,74 +1,82 @@ ulonglong PrjfScheduleExpansionWorkItem (undefined8 param_1,undefined8 param_2,longlong param_3,longlong param_4) { longlong *plVar1; int *piVar2; longlong *plVar3; int iVar4; longlong *plVar5; longlong *plVar6; undefined8 *puVar7; code *pcVar8; uint uVar9; longlong lVar10; ulonglong uVar11; + ulonglong uVar12; + bool bVar13; uVar11 = 0; plVar3 = (longlong *)(param_3 + 200); + bVar13 = false; plVar5 = (longlong *)*plVar3; if (param_4 != 0) { plVar6 = *(longlong **)(param_3 + 0xd0); plVar1 = (longlong *)(param_4 + 0x30); if ((longlong *)*plVar6 != plVar3) goto LAB_0; *plVar1 = (longlong)plVar3; *(longlong **)(param_4 + 0x38) = plVar6; *plVar6 = (longlong)plVar1; *(longlong **)(param_3 + 0xd0) = plVar1; } if (plVar5 == plVar3) { LOCK(); piVar2 = (int *)(param_3 + 0x40); iVar4 = *piVar2; *piVar2 = *piVar2 + 1; UNLOCK(); if (iVar4 == 0) { KeWaitForSingleObject(param_3 + 0x10,0,0,0,0); KeClearEvent(param_3 + 0x10); lVar10 = FltAllocateGenericWorkItem(); if (lVar10 == 0) { uVar11 = 0xc000009a; } else { ObfReferenceObject(param_2); + uVar11 = Feature_2428439865__private_IsEnabledDeviceUsageNoInline(); + bVar13 = (int)uVar11 != 0; uVar9 = FltQueueGenericWorkItem(lVar10,param_1,PrjfExpansionWorker,0,param_2); uVar11 = (ulonglong)uVar9; if (-1 < (int)uVar9) { return uVar11; } FltFreeGenericWorkItem(lVar10); } if (param_4 != 0) { puVar7 = *(undefined8 **)(param_3 + 0xd0); if (((longlong *)*puVar7 != plVar3) || (plVar5 = (longlong *)puVar7[1], (undefined8 *)*plVar5 != puVar7)) { LAB_0: pcVar8 = (code *)swi(0x29); (*pcVar8)(3); pcVar8 = (code *)swi(3); uVar11 = (*pcVar8)(); return uVar11; } *(longlong **)(param_3 + 0xd0) = plVar5; *plVar5 = (longlong)plVar3; } LOCK(); *(int *)(param_3 + 0x40) = *(int *)(param_3 + 0x40) + -1; UNLOCK(); - ObfDereferenceObject(param_2); + uVar12 = Feature_2428439865__private_IsEnabledDeviceUsageNoInline(); + if (((int)uVar12 == 0) || (bVar13)) { + ObfDereferenceObject(param_2); + } } } return uVar11; } ``` ## PrjfStoreNotificationMappingEntries ### Match Info |Key|pj_8115.sys - pj_8246.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.7| |i_ratio|0.55| |m_ratio|0.99| |b_ratio|0.97| |match_types|SymbolsHash| ### Function Meta Diff |Key|pj_8115.sys|pj_8246.sys| | :---: | :---: | :---: | |name|PrjfStoreNotificationMappingEntries|PrjfStoreNotificationMappingEntries| |fullname|PrjfStoreNotificationMappingEntries|PrjfStoreNotificationMappingEntries| |refcount|2|2| |`length`|824|818| |`called`|MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExFreePoolWithTag
PrjfClearMappingTable
PrjfCreateMappingEntry
PrjfMappingInsert
PrjfValidateNotificationRoot
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDdD|Feature_4243261755__private_IsEnabledDeviceUsageNoInline
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExFreePoolWithTag
PrjfClearMappingTable
PrjfCreateMappingEntry
PrjfMappingInsert
PrjfValidateNotificationRoot
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDdD| |calling|PrjfSetUnionContext|PrjfSetUnionContext| |paramcount|3|3| |`address`|140045fe4|1400460a4| |sig|int __fastcall PrjfStoreNotificationMappingEntries(ushort * param_1, uint param_2, longlong param_3)|int __fastcall PrjfStoreNotificationMappingEntries(ushort * param_1, uint param_2, longlong param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### PrjfStoreNotificationMappingEntries Called Diff ```diff --- PrjfStoreNotificationMappingEntries called +++ PrjfStoreNotificationMappingEntries called @@ -0,0 +1 @@ +Feature_4243261755__private_IsEnabledDeviceUsageNoInline ``` ### PrjfStoreNotificationMappingEntries Diff ```diff --- PrjfStoreNotificationMappingEntries +++ PrjfStoreNotificationMappingEntries @@ -1,123 +1,133 @@ int PrjfStoreNotificationMappingEntries(ushort *param_1,uint param_2,longlong param_3) { bool bVar1; undefined8 uVar2; ulonglong uVar3; - byte bVar4; - ulonglong uVar5; - bool bVar6; + ulonglong uVar4; + byte bVar5; + ulonglong uVar6; + ulonglong uVar7; + bool bVar8; ushort *local_res8; undefined1 in_stack_ffffffffffffff88; undefined7 in_stack_ffffffffffffff89; - ushort uVar7; + ushort uVar9; int local_48; int local_40; - longlong local_38 [2]; + ulonglong local_38 [2]; - uVar5 = 0; + uVar6 = 0; local_res8 = (ushort *)0x0; bVar1 = true; local_38[0] = 0; local_38[1] = 0; + uVar7 = uVar6; if (param_3 == 0) { MicrosoftTelemetryAssertTriggeredNoArgsKM(); } do { if (param_2 < 0x10) { local_40 = -0x3ffffff3; - bVar6 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED; - bVar4 = DAT_0 & 0x10; - if ((bVar4 != 0) || (bVar6)) { + bVar8 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED; + bVar5 = DAT_0 & 0x10; + if ((bVar5 != 0) || (bVar8)) { local_40 = -0x3ffffff3; - uVar7 = 10; + uVar9 = 10; LAB_1: WPP_RECORDER_AND_TRACE_SF_sDdD - (0x214,bVar4,bVar6,*(undefined8 *)(WPP_GLOBAL_Control + 0x40), - CONCAT71(in_stack_ffffffffffffff89,in_stack_ffffffffffffff88),0x14,uVar7, - &WPP_5c05f7cae5513ff3734adbc0d3bd9537_Traceguids, + (0x214,bVar5,bVar8,*(undefined8 *)(WPP_GLOBAL_Control + 0x40), + CONCAT71(in_stack_ffffffffffffff89,in_stack_ffffffffffffff88),0x14,uVar9, + &WPP_0314efc3b1f93d76a134ccc0e69e0e16_Traceguids, "onecore\\base\\fs\\gvflt\\filter\\sys\\mapping.c"); } } else { - uVar2 = PrjfValidateNotificationRoot((longlong)param_1,param_2,uVar5,&local_res8); + uVar2 = PrjfValidateNotificationRoot((longlong)param_1,param_2,uVar7,&local_res8); local_40 = (int)uVar2; if (local_40 < 0) { - bVar6 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED; - bVar4 = DAT_0 & 0x10; - if ((bVar4 != 0) || (bVar6)) { - uVar7 = 0xb; + bVar8 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED; + bVar5 = DAT_0 & 0x10; + if ((bVar5 != 0) || (bVar8)) { + uVar9 = 0xb; goto LAB_1; } } else { - local_40 = PrjfCreateMappingEntry(local_res8,*(uint *)(param_1 + 4),local_38); + local_40 = PrjfCreateMappingEntry(local_res8,*(uint *)(param_1 + 4),(longlong *)local_38); if (local_40 < 0) { if (((DAT_0 & 0x10) != 0) || ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) { in_stack_ffffffffffffff88 = 2; WPP_RECORDER_AND_TRACE_SF_sDD (0x214,DAT_0 & 0x10, (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED, *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x14,0xc, - &WPP_5c05f7cae5513ff3734adbc0d3bd9537_Traceguids, + &WPP_0314efc3b1f93d76a134ccc0e69e0e16_Traceguids, "onecore\\base\\fs\\gvflt\\filter\\sys\\mapping.c"); } } else { - uVar3 = PrjfMappingInsert(param_3,local_38); + uVar3 = PrjfMappingInsert(param_3,(longlong *)local_38); local_40 = (int)uVar3; if (local_40 < 0) { if (((DAT_0 & 0x10) != 0) || ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) { - uVar7 = 0xd; + uVar9 = 0xd; local_48 = local_40; LAB_2: in_stack_ffffffffffffff88 = 2; WPP_RECORDER_AND_TRACE_SF_sDD (0x214,DAT_0 & 0x10, (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED, - *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x14,uVar7, - &WPP_5c05f7cae5513ff3734adbc0d3bd9537_Traceguids, + *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x14,uVar9, + &WPP_0314efc3b1f93d76a134ccc0e69e0e16_Traceguids, "onecore\\base\\fs\\gvflt\\filter\\sys\\mapping.c"); local_40 = local_48; } } else { - uVar7 = *param_1; - uVar5 = (ulonglong)((int)uVar5 + 1); - if (uVar7 == 0) { + uVar9 = *param_1; + uVar7 = (ulonglong)((int)uVar7 + 1); + if (uVar9 == 0) { bVar1 = false; } - else if (((uint)uVar7 < *(uint *)(param_1 + 2)) || (param_2 < uVar7)) { + else if (((uint)uVar9 < *(uint *)(param_1 + 2)) || (param_2 < uVar9)) { + local_40 = -0x3ffffff3; if (((DAT_0 & 0x10) != 0) || - (local_40 = -0x3ffffff3, - (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) { + ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) { local_48 = -0x3ffffff3; - uVar7 = 0xe; + uVar9 = 0xe; goto LAB_2; } } else { - param_2 = param_2 - uVar7; - param_1 = (ushort *)((longlong)param_1 + (ulonglong)uVar7); + param_2 = param_2 - uVar9; + param_1 = (ushort *)((longlong)param_1 + (ulonglong)uVar9); bVar1 = true; local_40 = 0; } } + uVar3 = local_38[0]; + local_38[0] = uVar3; if (local_38[0] != 0) { ExFreePoolWithTag(local_38[0],0x6d6e4a50); + uVar4 = Feature_4243261755__private_IsEnabledDeviceUsageNoInline(); + local_38[0] = uVar3; + if ((int)uVar4 != 0) { + local_38[0] = uVar6; + } } } } } if ((!bVar1) || (local_40 < 0)) { if (local_40 < 0) { PrjfClearMappingTable(param_3); } return local_40; } } while( true ); } ``` # Modified (No Code Changes) *Slightly modified functions have no code changes, rather differnces in:* - refcount - length - called - calling - name - fullname ## wil_details_IsEnabledFallback ### Match Info |Key|pj_8115.sys - pj_8246.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.83| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|pj_8115.sys|pj_8246.sys| | :---: | :---: | :---: | |name|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |fullname|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |`refcount`|6|11| |length|140|140| |called|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath| |`calling`|Feature_1083645240__private_IsEnabledFallback
Feature_78846265__private_IsEnabledFallback
Feature_EnableTestConfigViaFilterPort__private_IsEnabledFallback
Feature_HydrateLargeNonCachedFiles__private_IsEnabledFallback
Feature_ModernWpp__private_IsEnabledFallback|Feature_1083645240__private_IsEnabledFallback
Feature_2428439865__private_IsEnabledFallback
Feature_3303736635__private_IsEnabledFallback
Feature_3411221816__private_IsEnabledFallback
Feature_4243261755__private_IsEnabledFallback
Feature_440600889__private_IsEnabledFallback
Feature_78846265__private_IsEnabledFallback
Feature_EnableTestConfigViaFilterPort__private_IsEnabledFallback
Feature_HydrateLargeNonCachedFiles__private_IsEnabledFallback
Feature_ModernWpp__private_IsEnabledFallback| |paramcount|3|3| |`address`|1400047bc|1400047dc| |sig|uint __fastcall wil_details_IsEnabledFallback(ulonglong param_1, int param_2, undefined8 * param_3)|uint __fastcall wil_details_IsEnabledFallback(ulonglong param_1, int param_2, undefined8 * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### wil_details_IsEnabledFallback Calling Diff ```diff --- wil_details_IsEnabledFallback calling +++ wil_details_IsEnabledFallback calling @@ -1,0 +2,5 @@ +Feature_2428439865__private_IsEnabledFallback +Feature_3303736635__private_IsEnabledFallback +Feature_3411221816__private_IsEnabledFallback +Feature_4243261755__private_IsEnabledFallback +Feature_440600889__private_IsEnabledFallback ``` ## WPP_RECORDER_AND_TRACE_SF_sDD ### Match Info |Key|pj_8115.sys - pj_8246.sys| | :---: | :---: | |diff_type|refcount| |ratio|1.0| |i_ratio|0.99| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|pj_8115.sys|pj_8246.sys| | :---: | :---: | :---: | |name|WPP_RECORDER_AND_TRACE_SF_sDD|WPP_RECORDER_AND_TRACE_SF_sDD| |fullname|WPP_RECORDER_AND_TRACE_SF_sDD|WPP_RECORDER_AND_TRACE_SF_sDD| |`refcount`|205|206| |length|332|332| |called|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace| |calling|
Expand for full list:
DriverEntry
PrjfAddSubContext
PrjfAttachFilterHandler
PrjfBlockFsctlOperation
PrjfCheckAndCancelTransactedOpen
PrjfCheckDirectoryContentReparseTags
PrjfCleanUpRenameLinkTargetTombstone
PrjfClearAttributes
PrjfCompleteCommandHandler
PrjfCopyAsPlaceHolder
PrjfCopyFileBasicInformationPrjfCopyFileMetaData
PrjfCopyStreamData
PrjfCreateFileContext
PrjfCreateInstanceTierNode
PrjfCreatePathTierNode
PrjfCreateRenameOrLinkCompletionContext
PrjfCreateStreamContext
PrjfCreateSymbolicLink
PrjfCreateSymlinkFromPlaceholderInfoMessage
PrjfCreateTombstone
PrjfDeleteFileHandler
PrjfDeleteTombstoneIfExists
PrjfDoesNameExistInLayer
PrjfEnumerateDirectoryWithMerge
PrjfExpandFile
PrjfFindOrCreateTransactionContext
PrjfFsctlGetFilterFileIdentifier
PrjfFsctlSetReparsePoint
PrjfFsctlStartVirtualizationInstance
PrjfGetInstanceFromVolumeName
PrjfGetSetFileContext
PrjfGetSetStreamContext
PrjfGetSetStreamHandleContext
PrjfGetUnionContext
PrjfGetUnionContextByFileName
PrjfGetUnionContextByFileNameEx
PrjfImpersonateAndAddSymlinkPrivilege
PrjfInitCommunicationPort
PrjfInstanceQueryTeardown
PrjfInstanceSetup
PrjfIsDirectoryEmpty
PrjfIsNameOnPathOfRoot
PrjfManageHydrationOnNonCachedHandle
PrjfMappingInsert
PrjfMergeEnumerationResults
PrjfMungeDirectoryEnumerateWithShortname
PrjfMungeDirectoryEnumerateWithShortnameFileId64
PrjfMungeDirectoryEnumerateWithShortnameFileIdAll
PrjfMungeDirectoryEnumerateWithoutShortname
PrjfMungeDirectoryEnumerateWithoutShortnameFileId64
PrjfMungeDirectoryEnumerateWithoutShortnameFileIdAll
PrjfNormalizeNameComponent
PrjfNotifyRenameOrLinkOperation
PrjfOpenAsReparsePoint
PrjfOpenFileHandler
PrjfOpenReparsePoint
PrjfPopulateDestinationForRenameOrLink
PrjfPopulateFile
PrjfPortConnect
PrjfPortDisconnect
PrjfPortMessage
PrjfPostAcquireForSectionSynchronization
PrjfPostCleanup
PrjfPostCreate
PrjfPostNetworkQueryOpen
PrjfPostSetDispositionInformation
PrjfPostSetInformation
PrjfPostSetRenameInformation
PrjfPreCleanup
PrjfPreCreate
PrjfPreDirectoryControl
PrjfPreSetDispositionInformation
PrjfPreSetLinkInformation
PrjfPreSetRenameInformation
PrjfPrepareCommandForFilePath
PrjfPrepareDestinationForRenameOrLink
PrjfPrepareEnumerationContexts
PrjfPrepareForDelete
PrjfPrepareSourceForRename
PrjfProcessFileDirectoryStatus
PrjfProcessOpenWithinVirtualizationRoots
PrjfProcessPostRenameOrLinkInformation
PrjfProcessPreRenameOrLinkInformation
PrjfProcessPrjReparsePointBounce
PrjfProcessTombstoneBounce
PrjfQueryAttributes
PrjfReadFileHandler
PrjfRelPathToFullPath
PrjfReleaseUnionContext
PrjfRemoveInMemoryTombstone
PrjfRemoveTombstonesFromDirectory
PrjfRevertInMemoryTombstonesForDirectory
PrjfSendCancelCommandInNewThread
PrjfSendCancelCommandWorker
PrjfSendCommand
PrjfSendEndDirectoryEnumerationCommand
PrjfSendNotifyOperationCommand
PrjfSendPostCreateNotifications
PrjfSetConfiguration
PrjfSetDeleteDisposition
PrjfSetParentPlaceHolderFlagsSynchronized
PrjfSetUnionContext
PrjfSetupVolumeInformationHandler
PrjfShouldAutoAttach
PrjfSleepOnTestSettingFlagsForTests
PrjfStoreNotificationMappingEntries
PrjfSynchronizeExpansionPreopWithReason
PrjfTelemetryAndTracingInit
PrjfTransactionNotification
PrjfUnload
PrjfUpdatePlaceholderIfNeededHandler
PrjfValidateAndGetGlobalVolumePath
PrjfValidateFileIdentifier
PrjfValidateFilterFileIdentifierInputBuffer
PrjfValidateNamesInEnumeration
PrjfValidateNotificationRoot
PrjfValidatePlaceholderInformationMessage
PrjfVerifyAccessAndSetClientPortIfNeeded
PrjfWriteFileDataHandler
PrjfWritePlaceholderInformationHandler
|
Expand for full list:
DriverEntry
PrjfAddSubContext
PrjfAttachFilterHandler
PrjfBlockFsctlOperation
PrjfCheckAndCancelTransactedOpen
PrjfCheckDirectoryContentReparseTags
PrjfCleanUpRenameLinkTargetTombstone
PrjfClearAttributes
PrjfCompleteCommandHandler
PrjfCopyAsPlaceHolder
PrjfCopyFileBasicInformationPrjfCopyFileMetaData
PrjfCopyStreamData
PrjfCreateFileContext
PrjfCreateInstanceTierNode
PrjfCreatePathTierNode
PrjfCreateRenameOrLinkCompletionContext
PrjfCreateStreamContext
PrjfCreateSymbolicLink
PrjfCreateSymlinkFromPlaceholderInfoMessage
PrjfCreateTombstone
PrjfDeleteFileHandler
PrjfDeleteTombstoneIfExists
PrjfDoesNameExistInLayer
PrjfEnumerateDirectoryWithMerge
PrjfExpandFile
PrjfFindOrCreateTransactionContext
PrjfFsctlGetFilterFileIdentifier
PrjfFsctlSetReparsePoint
PrjfFsctlStartVirtualizationInstance
PrjfGetInstanceFromVolumeName
PrjfGetSetFileContext
PrjfGetSetStreamContext
PrjfGetSetStreamHandleContext
PrjfGetUnionContext
PrjfGetUnionContextByFileName
PrjfGetUnionContextByFileNameEx
PrjfImpersonateAndAddSymlinkPrivilege
PrjfInitCommunicationPort
PrjfInstanceQueryTeardown
PrjfInstanceSetup
PrjfIsDirectoryEmpty
PrjfIsNameOnPathOfRoot
PrjfManageHydrationOnNonCachedHandle
PrjfMappingInsert
PrjfMergeEnumerationResults
PrjfMungeDirectoryEnumerateWithShortname
PrjfMungeDirectoryEnumerateWithShortnameFileId64
PrjfMungeDirectoryEnumerateWithShortnameFileIdAll
PrjfMungeDirectoryEnumerateWithoutShortname
PrjfMungeDirectoryEnumerateWithoutShortnameFileId64
PrjfMungeDirectoryEnumerateWithoutShortnameFileIdAll
PrjfNormalizeNameComponent
PrjfNotifyRenameOrLinkOperation
PrjfOpenAsReparsePoint
PrjfOpenFileHandler
PrjfOpenReparsePoint
PrjfPopulateDestinationForRenameOrLink
PrjfPopulateFile
PrjfPortConnect
PrjfPortDisconnect
PrjfPortMessage
PrjfPostAcquireForSectionSynchronization
PrjfPostCleanup
PrjfPostCreate
PrjfPostNetworkQueryOpen
PrjfPostSetDispositionInformation
PrjfPostSetInformation
PrjfPostSetRenameInformation
PrjfPreCleanup
PrjfPreCreate
PrjfPreDirectoryControl
PrjfPreSetDispositionInformation
PrjfPreSetLinkInformation
PrjfPreSetRenameInformation
PrjfPrepareCommandForFilePath
PrjfPrepareDestinationForRenameOrLink
PrjfPrepareEnumerationContexts
PrjfPrepareForDelete
PrjfPrepareSourceForRename
PrjfProcessFileDirectoryStatus
PrjfProcessOpenWithinVirtualizationRoots
PrjfProcessPostRenameOrLinkInformation
PrjfProcessPreRenameOrLinkInformation
PrjfProcessPrjReparsePointBounce
PrjfProcessTombstoneBounce
PrjfQueryAttributes
PrjfReadFileHandler
PrjfRelPathToFullPath
PrjfReleaseUnionContext
PrjfRemoveInMemoryTombstone
PrjfRemoveTombstonesFromDirectory
PrjfRevertInMemoryTombstonesForDirectory
PrjfSendCancelCommandInNewThread
PrjfSendCancelCommandWorker
PrjfSendCommand
PrjfSendEndDirectoryEnumerationCommand
PrjfSendNotifyOperationCommand
PrjfSendPostCreateNotifications
PrjfSetConfiguration
PrjfSetDeleteDisposition
PrjfSetParentPlaceHolderFlagsSynchronized
PrjfSetUnionContext
PrjfSetupVolumeInformationHandler
PrjfShouldAutoAttach
PrjfSleepOnTestSettingFlagsForTests
PrjfStoreNotificationMappingEntries
PrjfSynchronizeExpansionPreopWithReason
PrjfTelemetryAndTracingInit
PrjfTransactionNotification
PrjfUnload
PrjfUpdatePlaceholderIfNeededHandler
PrjfValidateAndGetGlobalVolumePath
PrjfValidateFileIdentifier
PrjfValidateFilterFileIdentifierInputBuffer
PrjfValidateNamesInEnumeration
PrjfValidateNotificationRoot
PrjfValidatePlaceholderInformationMessage
PrjfVerifyAccessAndSetClientPortIfNeeded
PrjfWriteFileDataHandler
PrjfWritePlaceholderInformationHandler
| |paramcount|9|9| |address|14000e140|14000e140| |sig|undefined __fastcall WPP_RECORDER_AND_TRACE_SF_sDD(undefined2 param_1, char param_2, char param_3, undefined8 param_4, undefined1 param_5, undefined4 param_6, ushort param_7, undefined8 param_8, char * param_9)|undefined __fastcall WPP_RECORDER_AND_TRACE_SF_sDD(undefined2 param_1, char param_2, char param_3, undefined8 param_4, undefined1 param_5, undefined4 param_6, ushort param_7, undefined8 param_8, char * param_9)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## NTOSKRNL.EXE::ExDeleteResourceLite ### Match Info |Key|pj_8115.sys - pj_8246.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|pj_8115.sys|pj_8246.sys| | :---: | :---: | :---: | |name|ExDeleteResourceLite|ExDeleteResourceLite| |fullname|NTOSKRNL.EXE::ExDeleteResourceLite|NTOSKRNL.EXE::ExDeleteResourceLite| |`refcount`|6|7| |length|0|0| |called||| |`calling`|PrjfContextCleanup
PrjfReleaseUnionContext|PrjfContextCleanup
PrjfCreateUnionContext
PrjfReleaseUnionContext| |paramcount|0|0| |`address`|EXTERNAL:00000082|EXTERNAL:00000080| |sig|undefined ExDeleteResourceLite(void)|undefined ExDeleteResourceLite(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::ExDeleteResourceLite Calling Diff ```diff --- NTOSKRNL.EXE::ExDeleteResourceLite calling +++ NTOSKRNL.EXE::ExDeleteResourceLite calling @@ -1,0 +2 @@ +PrjfCreateUnionContext ``` Generated with `ghidriff` version: 1.0.0 on 2026-08-19T00:12:19