# prjflt_8328.sys-prjflt_8457.sys Diff # TOC * [Visual Chart Diff](#visual-chart-diff) * [Metadata](#metadata) * [Ghidra Diff Engine](#ghidra-diff-engine) * [Command Line](#command-line) * [Binary Metadata Diff](#binary-metadata-diff) * [Program Options](#program-options) * [Diff Stats](#diff-stats) * [Strings](#strings) * [Deleted](#deleted) * [Added](#added) * [Feature_1526925624__private_IsEnabledDeviceUsageNoInline](#feature_1526925624__private_isenableddeviceusagenoinline) * [Feature_1526925624__private_IsEnabledFallback](#feature_1526925624__private_isenabledfallback) * [Modified](#modified) * [PrjfRevertInMemoryTombstonesForDirectory](#prjfrevertinmemorytombstonesfordirectory) * [Modified (No Code Changes)](#modified-no-code-changes) * [wil_details_IsEnabledFallback](#wil_details_isenabledfallback) # Visual Chart Diff ```mermaid flowchart LR PrjfRevertInMemoryTombstonesForDirectory-2-old<--Match 66%-->PrjfRevertInMemoryTombstonesForDirectory-2-new subgraph prjflt_8457.sys PrjfRevertInMemoryTombstonesForDirectory-2-new subgraph Added direction LR Feature_1526925624__private_IsEnabledDeviceUsageNoInline Feature_1526925624__private_IsEnabledFallback end end subgraph prjflt_8328.sys PrjfRevertInMemoryTombstonesForDirectory-2-old end ``` ```mermaid pie showData title Function Matches - 99.8492% "unmatched_funcs_len" : 2 "matched_funcs_len" : 1324 ``` ```mermaid pie showData title Matched Function Similarity - 99.8489% "matched_funcs_with_code_changes_len" : 1 "matched_funcs_with_non_code_changes_len" : 1 "matched_funcs_no_changes_len" : 1322 ``` # Metadata ## Ghidra Diff Engine ### Command Line #### Captured Command Line ``` ghidriff --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --bsim --max-ram-percent 60.0 --max-section-funcs 200 prjflt_8328.sys prjflt_8457.sys ``` #### Verbose Args

``` --old ['prjflt_8328.sys'] --new [['prjflt_8457.sys']] --engine VersionTrackingDiff --output-path ghidriff_out --summary False --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim True --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title None ```

#### Download Original PEs ``` wget https://msdl.microsoft.com/download/symbols/prjflt.sys/C711F54A4F000/prjflt.sys -O prjflt.sys.x64.10.0.26100.8328 wget https://msdl.microsoft.com/download/symbols/prjflt.sys/618299B04F000/prjflt.sys -O prjflt.sys.x64.10.0.26100.8457 ``` ## Binary Metadata Diff ```diff --- prjflt_8328.sys Meta +++ prjflt_8457.sys Meta @@ -1,44 +1,44 @@ -Program Name: prjflt_8328.sys +Program Name: prjflt_8457.sys Language ID: x86:LE:64:default (4.6) Compiler ID: windows Processor: x86 Endian: Little Address Size: 64 Minimum Address: 140000000 Maximum Address: ff0000184f # of Bytes: 329808 # of Memory Blocks: 15 -# of Instructions: 52949 -# of Defined Data: 2171 -# of Functions: 662 -# of Symbols: 7738 +# of Instructions: 52976 +# of Defined Data: 2177 +# of Functions: 664 +# of Symbols: 7749 # of Data Types: 166 # of Data Type Categories: 12 Analyzed: true Compiler: visualstudio:unknown Created With Ghidra Version: 12.0.4 -Date Created: Sun Aug 16 22:32:32 SGT 2026 +Date Created: Sun Aug 16 22:32:36 SGT 2026 Executable Format: Portable Executable (PE) -Executable Location: /tmp/prj/prjflt_8328.sys -Executable MD5: 3b2ae26b65abb1848c29368163f4ed59 -Executable SHA256: 121ecc0a3d9b49304077082b57e6514cc73c9ed2e9bedf6587be9fb79175d445 -FSRL: file:///tmp/prj/prjflt_8328.sys?MD5=3b2ae26b65abb1848c29368163f4ed59 +Executable Location: /tmp/prj/prjflt_8457.sys +Executable MD5: fc75f43e2cd77ff7237c45b7259722fd +Executable SHA256: 877f38b110b40bd8e7af604849a493500337df0df1d9ebda62a807251fb9244a +FSRL: file:///tmp/prj/prjflt_8457.sys?MD5=fc75f43e2cd77ff7237c45b7259722fd PDB Age: 1 PDB File: prjflt.pdb -PDB GUID: 6271ebb8-ec70-5a9b-67f3-21dfde5e1b8b +PDB GUID: a5f71928-8671-bf21-1e62-57bcac818034 PDB Loaded: true PDB Version: RSDS PE Property[CompanyName]: Microsoft Corporation PE Property[FileDescription]: Windows Projected File System FS Filter Driver -PE Property[FileVersion]: 10.0.26100.8328 (WinBuild.160101.0800) +PE Property[FileVersion]: 10.0.26100.8457 (WinBuild.160101.0800) PE Property[InternalName]: prjflt.sys PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved. PE Property[OriginalFilename]: prjflt.sys PE Property[ProductName]: Microsoft(R) Windows(R) Kits -PE Property[ProductVersion]: 10.0.26100.8328 +PE Property[ProductVersion]: 10.0.26100.8457 PE Property[Translation]: 4b00409 Preferred Root Namespace Category: RTTI Found: false Relocatable: true SectionAlignment: 4096 Should Ask To Analyze: false ``` ## Program Options

Ghidra prjflt_8328.sys Decompiler Options

Ghidra prjflt_8328.sys Specification extensions Options

|Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|

Ghidra prjflt_8328.sys Analyzers Options

|Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.Apply Function Calling Conventions|true| |Demangler Microsoft.Apply Function Signatures|true| |Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS| |Demangler Microsoft.Demangle Only Known Mangled Symbols|false| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|

Ghidra prjflt_8457.sys Decompiler Options

Ghidra prjflt_8457.sys Specification extensions Options

|Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|

Ghidra prjflt_8457.sys Analyzers Options

## Diff Stats |Stat|Value| | :---: | :---: | |added_funcs_len|2| |deleted_funcs_len|0| |modified_funcs_len|2| |added_symbols_len|4| |deleted_symbols_len|1| |diff_time|2.850072145462036| |deleted_strings_len|0| |added_strings_len|0| |match_types|Counter({'SymbolsHash': 661, 'ExternalsName': 258})| |items_to_process|9| |diff_types|Counter({'refcount': 1, 'calling': 1, 'code': 1, 'length': 1, 'called': 1})| |unmatched_funcs_len|2| |total_funcs_len|1326| |matched_funcs_len|1324| |matched_funcs_with_code_changes_len|1| |matched_funcs_with_non_code_changes_len|1| |matched_funcs_no_changes_len|1322| |match_func_similarity_percent|99.8489%| |func_match_overall_percent|99.8492%| |first_matches|Counter({'SymbolsHash': 661})| ```mermaid pie showData title All Matches "SymbolsHash" : 661 "ExternalsName" : 258 ``` ```mermaid pie showData title First Matches "SymbolsHash" : 661 ``` ```mermaid pie showData title Diff Stats "added_funcs_len" : 2 "deleted_funcs_len" : 0 "modified_funcs_len" : 2 ``` ```mermaid pie showData title Symbols "added_symbols_len" : 4 "deleted_symbols_len" : 1 ``` ## Strings *No string differences found* # Deleted # Added ## Feature_1526925624__private_IsEnabledDeviceUsageNoInline ### Function Meta |Key|prjflt_8457.sys| | :---: | :---: | |name|Feature_1526925624__private_IsEnabledDeviceUsageNoInline| |fullname|Feature_1526925624__private_IsEnabledDeviceUsageNoInline| |refcount|3| |length|49| |called|Feature_1526925624__private_IsEnabledFallback| |calling|PrjfRevertInMemoryTombstonesForDirectory| |paramcount|0| |address|14000b2e4| |sig|ulonglong __fastcall Feature_1526925624__private_IsEnabledDeviceUsageNoInline(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_1526925624__private_IsEnabledDeviceUsageNoInline +++ Feature_1526925624__private_IsEnabledDeviceUsageNoInline @@ -0,0 +1,17 @@ + +ulonglong Feature_1526925624__private_IsEnabledDeviceUsageNoInline(void) + +{ + ulonglong uVar1; + undefined8 local_res8; + + local_res8 = (ulonglong)Feature_1526925624__private_featureState; + if ((Feature_1526925624__private_featureState & 0x10) == 0) { + uVar1 = Feature_1526925624__private_IsEnabledFallback(local_res8,3); + } + else { + uVar1 = (ulonglong)(Feature_1526925624__private_featureState & 1); + } + return uVar1; +} + ``` ## Feature_1526925624__private_IsEnabledFallback ### Function Meta |Key|prjflt_8457.sys| | :---: | :---: | |name|Feature_1526925624__private_IsEnabledFallback| |fullname|Feature_1526925624__private_IsEnabledFallback| |refcount|2| |length|21| |called|wil_details_IsEnabledFallback| |calling|Feature_1526925624__private_IsEnabledDeviceUsageNoInline| |paramcount|2| |address|14000b31c| |sig|undefined __fastcall Feature_1526925624__private_IsEnabledFallback(ulonglong param_1, int param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_1526925624__private_IsEnabledFallback +++ Feature_1526925624__private_IsEnabledFallback @@ -0,0 +1,8 @@ + +void Feature_1526925624__private_IsEnabledFallback(ulonglong param_1,int param_2) + +{ + wil_details_IsEnabledFallback(param_1,param_2,&Feature_1526925624__private_descriptor); + return; +} + ``` # Modified *Modified functions contain code changes* ## PrjfRevertInMemoryTombstonesForDirectory ### Match Info |Key|prjflt_8328.sys - prjflt_8457.sys| | :---: | :---: | |diff_type|code,length,called| |ratio|0.33| |i_ratio|0.62| |m_ratio|0.99| |b_ratio|0.66| |match_types|SymbolsHash| ### Function Meta Diff |Key|prjflt_8328.sys|prjflt_8457.sys| | :---: | :---: | :---: | |name|PrjfRevertInMemoryTombstonesForDirectory|PrjfRevertInMemoryTombstonesForDirectory| |fullname|PrjfRevertInMemoryTombstonesForDirectory|PrjfRevertInMemoryTombstonesForDirectory| |refcount|6|6| |`length`|1375|1424| |`called`|

Expand for full list:
FLTMGR.SYS::FltAcquireResourceExclusive
FLTMGR.SYS::FltGetFileNameInformationUnsafe
FLTMGR.SYS::FltParseFileNameInformation
FLTMGR.SYS::FltQueryInformationFile
FLTMGR.SYS::FltReferenceContext
FLTMGR.SYS::FltReleaseContext
FLTMGR.SYS::FltReleaseFileNameInformation
FLTMGR.SYS::FltReleaseResource
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::KeWaitForSingleObject
NTOSKRNL.EXE::RtlAppendUnicodeStringToString

NTOSKRNL.EXE::RtlAppendUnicodeToString
NTOSKRNL.EXE::RtlEndEnumerationHashTable
NTOSKRNL.EXE::RtlEnumerateEntryHashTable
NTOSKRNL.EXE::RtlGetNextEntryHashTable
NTOSKRNL.EXE::RtlInitEnumerationHashTable
NTOSKRNL.EXE::RtlLookupEntryHashTable
NTOSKRNL.EXE::RtlRemoveEntryHashTable
PrjfAllocateUnicodeString
PrjfCreateTombstone
PrjfGetContextFileObject
PrjfTelemetryTombstoneFailureOperation
WPP_RECORDER_AND_TRACE_SF_sDD
__security_check_cookie

Expand for full list:
FLTMGR.SYS::FltAcquireResourceExclusive
FLTMGR.SYS::FltGetFileNameInformationUnsafe
FLTMGR.SYS::FltParseFileNameInformation
FLTMGR.SYS::FltQueryInformationFile
FLTMGR.SYS::FltReferenceContext
FLTMGR.SYS::FltReleaseContext
FLTMGR.SYS::FltReleaseFileNameInformation
FLTMGR.SYS::FltReleaseResource
Feature_1526925624__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::KeWaitForSingleObject

NTOSKRNL.EXE::RtlAppendUnicodeStringToString
NTOSKRNL.EXE::RtlAppendUnicodeToString
NTOSKRNL.EXE::RtlEndEnumerationHashTable
NTOSKRNL.EXE::RtlEnumerateEntryHashTable
NTOSKRNL.EXE::RtlGetNextEntryHashTable
NTOSKRNL.EXE::RtlInitEnumerationHashTable
NTOSKRNL.EXE::RtlLookupEntryHashTable
NTOSKRNL.EXE::RtlRemoveEntryHashTable
PrjfAllocateUnicodeString
PrjfCreateTombstone
PrjfGetContextFileObject
PrjfTelemetryTombstoneFailureOperation
WPP_RECORDER_AND_TRACE_SF_sDD
__security_check_cookie

| |calling|PrjfPostCleanup
PrjfPostSetDispositionInformation
PrjfPreCleanup
PrjfPreSetDispositionInformation
PrjfSetDeleteDisposition|PrjfPostCleanup
PrjfPostSetDispositionInformation
PrjfPreCleanup
PrjfPreSetDispositionInformation
PrjfSetDeleteDisposition| |paramcount|2|2| |address|14004465c|14004465c| |sig|ulonglong __fastcall PrjfRevertInMemoryTombstonesForDirectory(undefined8 param_1, undefined8 param_2)|ulonglong __fastcall PrjfRevertInMemoryTombstonesForDirectory(undefined8 param_1, undefined8 param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### PrjfRevertInMemoryTombstonesForDirectory Called Diff ```diff --- PrjfRevertInMemoryTombstonesForDirectory called +++ PrjfRevertInMemoryTombstonesForDirectory called @@ -8,0 +9 @@ +Feature_1526925624__private_IsEnabledDeviceUsageNoInline ``` ### PrjfRevertInMemoryTombstonesForDirectory Diff ```diff --- PrjfRevertInMemoryTombstonesForDirectory +++ PrjfRevertInMemoryTombstonesForDirectory @@ -1,178 +1,189 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ ulonglong PrjfRevertInMemoryTombstonesForDirectory(undefined8 param_1,undefined8 param_2) { int *piVar1; - bool bVar2; - char cVar3; - uint uVar4; - longlong lVar5; - ulonglong uVar6; - longlong lVar7; - longlong lVar8; - ulonglong uVar9; - undefined1 auStackY_138 [32]; - longlong local_d0; - longlong local_c8; - undefined2 local_c0; - short sStack_be; - undefined4 uStack_bc; - longlong lStack_b8; - longlong local_b0; - longlong local_a8; + longlong lVar2; + bool bVar3; + char cVar4; + uint uVar5; + longlong lVar6; + ulonglong uVar7; + ulonglong uVar8; + longlong lVar9; + undefined1 auStackY_148 [32]; + char local_e7; + longlong local_e0; + longlong local_d8; + undefined2 local_d0; + short sStack_ce; + undefined4 uStack_cc; + longlong lStack_c8; + longlong local_c0; + longlong local_b8; + undefined8 local_b0; + undefined8 local_a8; undefined8 local_a0; - undefined8 local_98; - undefined8 uStack_90; + undefined8 uStack_98; + undefined8 local_90; undefined8 local_88; - undefined8 local_80; - undefined8 uStack_78; - undefined8 local_70; - undefined8 uStack_68; + undefined8 uStack_80; + undefined8 local_78; + undefined8 uStack_70; + undefined8 local_68; undefined8 local_60; - undefined8 local_58; - undefined8 uStack_50; - undefined8 local_48; - ulonglong local_40; + undefined8 uStack_58; + undefined8 local_50; + ulonglong local_48; - local_40 = __security_cookie ^ (ulonglong)auStackY_138; - local_b0 = 0; + local_48 = __security_cookie ^ (ulonglong)auStackY_148; + local_c0 = 0; + local_e0 = 0; + lVar9 = 0; + local_d8 = 0; + local_68 = 0; + local_50 = 0; + local_90 = 0; + local_88 = 0; + uStack_80 = 0; + local_e7 = '\0'; + local_78 = 0; + uStack_70 = 0; local_60 = 0; - local_d0 = 0; - lVar7 = 0; - local_c8 = 0; - local_48 = 0; - local_88 = 0; - local_80 = 0; - uStack_78 = 0; - local_70 = 0; - uStack_68 = 0; - local_58 = 0; - uStack_50 = 0; - _local_c0 = 0; - lStack_b8 = 0; - local_98 = 0; - uStack_90 = 0; - uVar4 = FltQueryInformationFile(0,0,&local_58,0x18); - uVar9 = (ulonglong)uVar4; - lVar8 = lVar7; - if ((int)uVar4 < 0) { + uStack_58 = 0; + _local_d0 = 0; + lStack_c8 = 0; + local_a0 = 0; + uStack_98 = 0; + local_b0 = param_1; + uVar5 = FltQueryInformationFile(0,0,&local_60,0x18); + uVar8 = (ulonglong)uVar5; + if ((int)uVar5 < 0) { if (((DAT_0 & 0x20) != 0) || - (lVar8 = 0, (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) { + ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) { WPP_RECORDER_AND_TRACE_SF_sDD (0x205,DAT_0 & 0x20, (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED, *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,0x24, - &WPP_4079bacae6ce31fd7110e995a8b7a7c9_Traceguids, + &WPP_72817d06a04c3905e527c1052e2dfcc5_Traceguids, "onecore\\base\\fs\\gvflt\\filter\\sys\\tombstone.c"); - lVar8 = lVar7; } } - else if ((((local_48._6_1_ == '\0') && (local_48._5_1_ != '\0')) && - (cVar3 = PrjfGetContextFileObject(param_1,param_2,&local_c8,&local_b0), lVar8 = local_c8, - cVar3 != '\0')) && (piVar1 = (int *)(local_c8 + 0x104), *piVar1 != 0)) { - uVar4 = FltGetFileNameInformationUnsafe(param_2,param_1,0x301,&local_d0); - uVar9 = (ulonglong)uVar4; - if (-1 < (int)uVar4) { - uVar4 = FltParseFileNameInformation(local_d0); - uVar9 = (ulonglong)uVar4; - if (-1 < (int)uVar4) { - local_a8 = lVar8 + 0x88; - FltAcquireResourceExclusive(local_a8); - bVar2 = true; + else if ((((local_50._6_1_ == '\0') && (lVar9 = 0, local_50._5_1_ != '\0')) && + (cVar4 = PrjfGetContextFileObject(param_1,param_2,&local_d8,&local_c0), lVar9 = local_d8, + cVar4 != '\0')) && (piVar1 = (int *)(local_d8 + 0x104), *piVar1 != 0)) { + uVar5 = FltGetFileNameInformationUnsafe(param_2,param_1,0x301,&local_e0); + uVar8 = (ulonglong)uVar5; + if (-1 < (int)uVar5) { + uVar5 = FltParseFileNameInformation(local_e0); + uVar8 = (ulonglong)uVar5; + if (-1 < (int)uVar5) { + local_b8 = lVar9 + 0x88; + FltAcquireResourceExclusive(local_b8); + bVar3 = true; if (*piVar1 != 0) { - while (bVar2) { - lVar7 = lVar8 + 0xf0; - RtlInitEnumerationHashTable(lVar7,&local_80); + while (bVar3) { + lVar2 = lVar9 + 0xf0; + RtlInitEnumerationHashTable(lVar2,&local_88); do { - lVar5 = RtlEnumerateEntryHashTable(lVar7,&local_80); - if (lVar5 == 0) { - bVar2 = false; - RtlEndEnumerationHashTable(lVar7,&local_80); + lVar6 = RtlEnumerateEntryHashTable(lVar2,&local_88); + if (lVar6 == 0) { + bVar3 = false; + RtlEndEnumerationHashTable(lVar2,&local_88); goto LAB_1; } - } while (*(longlong *)(lVar5 + 0x30) == 0); - RtlEndEnumerationHashTable(lVar7,&local_80); - local_a0 = *(undefined8 *)(lVar5 + 0x10); - _local_c0 = CONCAT22(*(short *)(local_d0 + 10) + 2 + *(short *)(lVar5 + 0x22),local_c0); - uVar6 = PrjfAllocateUnicodeString(0x6e664a50,&stack0xffffffffffffff40); - uVar9 = uVar6 & 0xffffffff; - if ((int)uVar6 < 0) { + } while (*(longlong *)(lVar6 + 0x30) == 0); + RtlEndEnumerationHashTable(lVar2,&local_88); + local_a8 = *(undefined8 *)(lVar6 + 0x10); + _local_d0 = CONCAT22(*(short *)(local_e0 + 10) + 2 + *(short *)(lVar6 + 0x22),local_d0); + uVar7 = PrjfAllocateUnicodeString(0x6e664a50,&stack0xffffffffffffff30); + uVar8 = uVar7 & 0xffffffff; + if ((int)uVar7 < 0) { if (((DAT_2 & 8) != 0) || ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) { WPP_RECORDER_AND_TRACE_SF_sDD (0x213,DAT_2 & 8, (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED, *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x13,0x25, - &WPP_4079bacae6ce31fd7110e995a8b7a7c9_Traceguids, + &WPP_72817d06a04c3905e527c1052e2dfcc5_Traceguids, "onecore\\base\\fs\\gvflt\\filter\\sys\\tombstone.c"); } break; } - RtlAppendUnicodeStringToString(&stack0xffffffffffffff40,local_d0 + 8); - RtlAppendUnicodeToString(&stack0xffffffffffffff40,L"\\"); - RtlAppendUnicodeStringToString(&stack0xffffffffffffff40,lVar5 + 0x20); - lVar8 = *(longlong *)(lVar5 + 0x30); - *(undefined1 *)(lVar5 + 0x19) = 1; - FltReferenceContext(lVar8); - lVar7 = local_a8; - FltReleaseResource(local_a8); - KeWaitForSingleObject(lVar8 + 0x120,0,0,0); - if (*(char *)(lVar8 + 0x11a) == '\0') { - uVar4 = PrjfCreateTombstone(param_1,&stack0xffffffffffffff40,*(char *)(lVar5 + 0x18)); - uVar9 = (ulonglong)uVar4; - if ((int)uVar4 < 0) { + RtlAppendUnicodeStringToString(&stack0xffffffffffffff30,local_e0 + 8); + RtlAppendUnicodeToString(&stack0xffffffffffffff30,L"\\"); + RtlAppendUnicodeStringToString(&stack0xffffffffffffff30,lVar6 + 0x20); + lVar9 = *(longlong *)(lVar6 + 0x30); + *(undefined1 *)(lVar6 + 0x19) = 1; + uVar7 = Feature_1526925624__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar7 != 0) { + local_e7 = *(char *)(lVar6 + 0x18); + } + FltReferenceContext(lVar9); + lVar2 = local_b8; + FltReleaseResource(local_b8); + KeWaitForSingleObject(lVar9 + 0x120,0,0,0); + if (*(char *)(lVar9 + 0x11a) == '\0') { + uVar8 = Feature_1526925624__private_IsEnabledDeviceUsageNoInline(); + cVar4 = local_e7; + if ((int)uVar8 == 0) { + cVar4 = *(char *)(lVar6 + 0x18); + } + uVar5 = PrjfCreateTombstone(local_b0,&stack0xffffffffffffff30,cVar4); + uVar8 = (ulonglong)uVar5; + if ((int)uVar5 < 0) { if (((DAT_0 & 0x20) != 0) || ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) { WPP_RECORDER_AND_TRACE_SF_sDD (0x205,DAT_0 & 0x20, (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED, *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,0x26, - &WPP_4079bacae6ce31fd7110e995a8b7a7c9_Traceguids, + &WPP_72817d06a04c3905e527c1052e2dfcc5_Traceguids, "onecore\\base\\fs\\gvflt\\filter\\sys\\tombstone.c"); } - PrjfTelemetryTombstoneFailureOperation(1,6,uVar4); + PrjfTelemetryTombstoneFailureOperation(1,6,uVar5); } } - FltReleaseContext(lVar8); - if (lStack_b8 != 0) { - ExFreePoolWithTag(lStack_b8,0x6e664a50); + FltReleaseContext(lVar9); + if (lStack_c8 != 0) { + ExFreePoolWithTag(lStack_c8,0x6e664a50); } - FltAcquireResourceExclusive(lVar7); - lVar8 = local_c8; - lVar7 = local_c8 + 0xf0; - lVar5 = RtlLookupEntryHashTable(lVar7,local_a0); - while (lVar5 != 0) { - if (*(char *)(lVar5 + 0x19) != '\0') { - RtlRemoveEntryHashTable(lVar7,lVar5); - if (*(longlong *)(lVar5 + 0x28) != 0) { - ExFreePoolWithTag(*(longlong *)(lVar5 + 0x28),0x6e664a50); + FltAcquireResourceExclusive(lVar2); + lVar9 = local_d8; + lVar2 = local_d8 + 0xf0; + lVar6 = RtlLookupEntryHashTable(lVar2,local_a8); + while (lVar6 != 0) { + if (*(char *)(lVar6 + 0x19) != '\0') { + RtlRemoveEntryHashTable(lVar2,lVar6); + if (*(longlong *)(lVar6 + 0x28) != 0) { + ExFreePoolWithTag(*(longlong *)(lVar6 + 0x28),0x6e664a50); } - if (*(longlong *)(lVar5 + 0x30) != 0) { + if (*(longlong *)(lVar6 + 0x30) != 0) { FltReleaseContext(); } - ExFreePoolWithTag(lVar5,0x74684a50); + ExFreePoolWithTag(lVar6,0x74684a50); } - lVar5 = RtlGetNextEntryHashTable(lVar7,&local_98); + lVar6 = RtlGetNextEntryHashTable(lVar2,&local_a0); } LAB_1: if (*piVar1 == 0) break; } } - FltReleaseResource(lVar8 + 0x88); + FltReleaseResource(lVar9 + 0x88); } } } - if (local_d0 != 0) { + if (local_e0 != 0) { FltReleaseFileNameInformation(); } - if (lVar8 != 0) { - FltReleaseContext(lVar8); + if (lVar9 != 0) { + FltReleaseContext(lVar9); } - if (local_b0 != 0) { + if (local_c0 != 0) { FltReleaseContext(); } - return uVar9; + return uVar8; } ``` # Modified (No Code Changes) *Slightly modified functions have no code changes, rather differnces in:* - refcount - length - called - calling - name - fullname ## wil_details_IsEnabledFallback ### Match Info |Key|prjflt_8328.sys - prjflt_8457.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|prjflt_8328.sys|prjflt_8457.sys| | :---: | :---: | :---: | |name|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |fullname|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |`refcount`|10|11| |length|140|140| |called|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath| |`calling`|Feature_1083645240__private_IsEnabledFallback
Feature_2428439865__private_IsEnabledFallback
Feature_3303736635__private_IsEnabledFallback
Feature_3411221816__private_IsEnabledFallback
Feature_4243261755__private_IsEnabledFallback
Feature_440600889__private_IsEnabledFallback
Feature_78846265__private_IsEnabledFallback
Feature_EnableTestConfigViaFilterPort__private_IsEnabledFallback
Feature_ModernWpp__private_IsEnabledFallback|Feature_1083645240__private_IsEnabledFallback
Feature_1526925624__private_IsEnabledFallback
Feature_2428439865__private_IsEnabledFallback
Feature_3303736635__private_IsEnabledFallback
Feature_3411221816__private_IsEnabledFallback
Feature_4243261755__private_IsEnabledFallback
Feature_440600889__private_IsEnabledFallback
Feature_78846265__private_IsEnabledFallback
Feature_EnableTestConfigViaFilterPort__private_IsEnabledFallback
Feature_ModernWpp__private_IsEnabledFallback| |paramcount|3|3| |address|140004828|140004828| |sig|uint __fastcall wil_details_IsEnabledFallback(ulonglong param_1, int param_2, undefined8 * param_3)|uint __fastcall wil_details_IsEnabledFallback(ulonglong param_1, int param_2, undefined8 * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### wil_details_IsEnabledFallback Calling Diff ```diff --- wil_details_IsEnabledFallback calling +++ wil_details_IsEnabledFallback calling @@ -1,0 +2 @@ +Feature_1526925624__private_IsEnabledFallback ``` _{Generated with `ghidriff` version: 1.0.0 on 2026-08-16T22:33:08}