# pf_8737.sys-pf_8875.sys Diff
# TOC
* [Visual Chart Diff](#visual-chart-diff)
* [Metadata](#metadata)
* [Ghidra Diff Engine](#ghidra-diff-engine)
* [Command Line](#command-line)
* [Binary Metadata Diff](#binary-metadata-diff)
* [Program Options](#program-options)
* [Diff Stats](#diff-stats)
* [Strings](#strings)
* [Deleted](#deleted)
* [Added](#added)
* [Feature_2998397241__private_IsEnabledFallback](#feature_2998397241__private_isenabledfallback)
* [PrjfOpenAsReparsePointOld](#prjfopenasreparsepointold)
* [PrjfOpenReparsePointOld](#prjfopenreparsepointold)
* [Modified](#modified)
* [WPP_RECORDER_AND_TRACE_SF_sDdZssss](#wpp_recorder_and_trace_sf_sddzssss)
* [WPP_RECORDER_AND_TRACE_SF_sDdZP](#wpp_recorder_and_trace_sf_sddzp)
* [PrjfOpenAndCheckEmptyPartialDirectory](#prjfopenandcheckemptypartialdirectory)
* [PrjfProcessFileDirectoryStatus](#prjfprocessfiledirectorystatus)
* [PrjfOpenAsReparsePoint](#prjfopenasreparsepoint)
* [PrjfDeleteTombstoneIfExists](#prjfdeletetombstoneifexists)
* [PrjfPostCreate](#prjfpostcreate)
* [PrjfOpenReparsePoint](#prjfopenreparsepoint)
* [PrjfOpenPlaceHolder](#prjfopenplaceholder)
* [PrjfCopyAsPlaceHolder](#prjfcopyasplaceholder)
* [PrjfProcessTombstoneBounce](#prjfprocesstombstonebounce)
* [PrjfDecideUpdateDeleteOnFileStateAndUpdateFlags](#prjfdecideupdatedeleteonfilestateandupdateflags)
* [PrjfOpenAsReparsePoint](#prjfopenasreparsepoint)
* [Modified (No Code Changes)](#modified-no-code-changes)
* [FLTMGR.SYS::FltReleaseContext](#fltmgrsysfltreleasecontext)
* [wil_details_IsEnabledFallback](#wil_details_isenabledfallback)
* [FLTMGR.SYS::FltInsertExtraCreateParameter](#fltmgrsysfltinsertextracreateparameter)
* [FLTMGR.SYS::FltFreeExtraCreateParameterList](#fltmgrsysfltfreeextracreateparameterlist)
* [NTOSKRNL.EXE::ExAllocateFromPagedLookasideList](#ntoskrnlexeexallocatefrompagedlookasidelist)
* [WPP_RECORDER_AND_TRACE_SF_sDD](#wpp_recorder_and_trace_sf_sdd)
* [FLTMGR.SYS::FltCreateFileEx2](#fltmgrsysfltcreatefileex2)
* [NTOSKRNL.EXE::ExFreeToPagedLookasideList](#ntoskrnlexeexfreetopagedlookasidelist)
* [FLTMGR.SYS::FltGetInstanceContext](#fltmgrsysfltgetinstancecontext)
* [MicrosoftTelemetryAssertTriggeredNoArgsKM](#microsofttelemetryasserttriggerednoargskm)
* [WPP_RECORDER_AND_TRACE_SF_sDdZ](#wpp_recorder_and_trace_sf_sddz)
* [FLTMGR.SYS::FltAllocateExtraCreateParameterList](#fltmgrsysfltallocateextracreateparameterlist)
* [FLTMGR.SYS::FltAllocateExtraCreateParameterFromLookasideList](#fltmgrsysfltallocateextracreateparameterfromlookasidelist)
# Visual Chart Diff
```mermaid
flowchart LR
WPP_RECORDER_AND_TRACE_SF_sDdZssss-4-old<--Match 64%-->WPP_RECORDER_AND_TRACE_SF_sDdZssss-4-new
WPP_RECORDER_AND_TRACE_SF_sDdZP-4-old<--Match 95%-->WPP_RECORDER_AND_TRACE_SF_sDdZP-4-new
PrjfOpenAndCheckEmptyPartialDirectory-5-old<--Match 85%-->PrjfOpenAndCheckEmptyPartialDirectory-5-new
PrjfProcessFileDirectoryStatus-3-old<--Match 82%-->PrjfProcessFileDirectoryStatus-3-new
PrjfOpenAsReparsePoint-12-old<--Match 99%-->PrjfOpenAsReparsePoint-12-new
PrjfDeleteTombstoneIfExists-4-old<--Match 91%-->PrjfDeleteTombstoneIfExists-4-new
PrjfPostCreate-3-old<--Match 65%-->PrjfPostCreate-3-new
PrjfOpenReparsePoint-9-old<--Match 96%-->PrjfOpenReparsePoint-9-new
PrjfOpenPlaceHolder-6-old<--Match 89%-->PrjfOpenPlaceHolder-6-new
PrjfCopyAsPlaceHolder-8-old<--Match 97%-->PrjfCopyAsPlaceHolder-8-new
PrjfProcessTombstoneBounce-5-old<--Match 95%-->PrjfProcessTombstoneBounce-5-new
PrjfDecideUpdateDeleteOnFileStateAndUpdateFlags-9-old<--Match 86%-->PrjfDecideUpdateDeleteOnFileStateAndUpdateFlags-9-new
PrjfOpenAsReparsePoint-12-old<--Match 6%-->Feature_2998397241__private_IsEnabledDeviceUsageNoInline-12-new
subgraph pf_8875.sys
WPP_RECORDER_AND_TRACE_SF_sDdZssss-4-new
WPP_RECORDER_AND_TRACE_SF_sDdZP-4-new
PrjfOpenAndCheckEmptyPartialDirectory-5-new
PrjfProcessFileDirectoryStatus-3-new
PrjfOpenAsReparsePoint-12-new
PrjfDeleteTombstoneIfExists-4-new
PrjfPostCreate-3-new
PrjfOpenReparsePoint-9-new
PrjfOpenPlaceHolder-6-new
PrjfCopyAsPlaceHolder-8-new
PrjfProcessTombstoneBounce-5-new
PrjfDecideUpdateDeleteOnFileStateAndUpdateFlags-9-new
Feature_2998397241__private_IsEnabledDeviceUsageNoInline-12-new
subgraph Added
direction LR
Feature_2998397241__private_IsEnabledFallback
PrjfOpenAsReparsePointOld
PrjfOpenReparsePointOld
end
end
subgraph pf_8737.sys
WPP_RECORDER_AND_TRACE_SF_sDdZssss-4-old
WPP_RECORDER_AND_TRACE_SF_sDdZP-4-old
PrjfOpenAndCheckEmptyPartialDirectory-5-old
PrjfProcessFileDirectoryStatus-3-old
PrjfOpenAsReparsePoint-12-old
PrjfDeleteTombstoneIfExists-4-old
PrjfPostCreate-3-old
PrjfOpenReparsePoint-9-old
PrjfOpenPlaceHolder-6-old
PrjfCopyAsPlaceHolder-8-old
PrjfProcessTombstoneBounce-5-old
PrjfDecideUpdateDeleteOnFileStateAndUpdateFlags-9-old
PrjfOpenAsReparsePoint-12-old
end
```
```mermaid
pie showData
title Function Matches - 99.7758%
"unmatched_funcs_len" : 3
"matched_funcs_len" : 1335
```
```mermaid
pie showData
title Matched Function Similarity - 98.0524%
"matched_funcs_with_code_changes_len" : 13
"matched_funcs_with_non_code_changes_len" : 13
"matched_funcs_no_changes_len" : 1309
```
# Metadata
## Ghidra Diff Engine
### Command Line
#### Captured Command Line
```
ghidriff --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --max-ram-percent 60.0 --max-section-funcs 200 pf_8737.sys pf_8875.sys
```
#### Verbose Args
```
--old ['pf_8737.sys'] --new [['pf_8875.sys']] --engine VersionTrackingDiff --output-path pf_out --summary False --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim False --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title None
```
#### Download Original PEs
```
wget https://msdl.microsoft.com/download/symbols/prjflt.sys/0113481D4F000/prjflt.sys -O prjflt.sys.x64.10.0.26100.8737
wget https://msdl.microsoft.com/download/symbols/prjflt.sys/3C8C42FA50000/prjflt.sys -O prjflt.sys.x64.10.0.26100.8875
```
## Binary Metadata Diff
```diff
--- pf_8737.sys Meta
+++ pf_8875.sys Meta
@@ -1,44 +1,44 @@
-Program Name: pf_8737.sys
+Program Name: pf_8875.sys
Language ID: x86:LE:64:default (4.6)
Compiler ID: windows
Processor: x86
Endian: Little
Address Size: 64
Minimum Address: 140000000
Maximum Address: ff0000184f
-# of Bytes: 329808
+# of Bytes: 333904
# of Memory Blocks: 15
-# of Instructions: 53161
-# of Defined Data: 2149
-# of Functions: 667
-# of Symbols: 7769
+# of Instructions: 53906
+# of Defined Data: 2154
+# of Functions: 671
+# of Symbols: 7855
# of Data Types: 166
# of Data Type Categories: 12
Analyzed: true
Compiler: visualstudio:unknown
Created With Ghidra Version: 12.0.4
-Date Created: Sat Aug 22 11:16:01 SGT 2026
+Date Created: Sat Aug 22 11:16:05 SGT 2026
Executable Format: Portable Executable (PE)
-Executable Location: /tmp/pf69/pf_8737.sys
-Executable MD5: 5b882542bf7386f31c18bf1eb3ad9e30
-Executable SHA256: 8d985c0ae5a872bb2691141fc0552b6f1ec4fd7de71bc641726f22073360a99c
-FSRL: file:///tmp/pf69/pf_8737.sys?MD5=5b882542bf7386f31c18bf1eb3ad9e30
+Executable Location: /tmp/pf69/pf_8875.sys
+Executable MD5: eb17859bfc86e5a7e81eb5666e87b059
+Executable SHA256: 900cf86fac329554e9142d7824d2fd758e119c9d2b9c8c7bc549bfc5873b57ef
+FSRL: file:///tmp/pf69/pf_8875.sys?MD5=eb17859bfc86e5a7e81eb5666e87b059
PDB Age: 1
PDB File: prjflt.pdb
-PDB GUID: 0701af4b-9e74-4be2-897a-4665df985211
+PDB GUID: e36e244a-fcfa-21d4-fbbe-0959502d641a
PDB Loaded: true
PDB Version: RSDS
PE Property[CompanyName]: Microsoft Corporation
PE Property[FileDescription]: Windows Projected File System FS Filter Driver
-PE Property[FileVersion]: 10.0.26100.8737 (WinBuild.160101.0800)
+PE Property[FileVersion]: 10.0.26100.8875 (WinBuild.160101.0800)
PE Property[InternalName]: prjflt.sys
PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved.
PE Property[OriginalFilename]: prjflt.sys
PE Property[ProductName]: Microsoft(R) Windows(R) Kits
-PE Property[ProductVersion]: 10.0.26100.8737
+PE Property[ProductVersion]: 10.0.26100.8875
PE Property[Translation]: 4b00409
Preferred Root Namespace Category:
RTTI Found: false
Relocatable: true
SectionAlignment: 4096
Should Ask To Analyze: false
```
## Program Options
Ghidra pf_8737.sys Decompiler Options
|Decompiler Option|Value|
| :---: | :---: |
|Prototype Evaluation|__fastcall|
Ghidra pf_8737.sys Specification extensions Options
|Specification extensions Option|Value|
| :---: | :---: |
|FormatVersion|0|
|VersionCounter|0|
Ghidra pf_8737.sys Analyzers Options
|Analyzers Option|Value|
| :---: | :---: |
|ASCII Strings|true|
|ASCII Strings.Create Strings Containing Existing Strings|true|
|ASCII Strings.Create Strings Containing References|true|
|ASCII Strings.Force Model Reload|false|
|ASCII Strings.Minimum String Length|LEN_5|
|ASCII Strings.Model File|StringModel.sng|
|ASCII Strings.Require Null Termination for String|true|
|ASCII Strings.Search Only in Accessible Memory Blocks|true|
|ASCII Strings.String Start Alignment|ALIGN_1|
|ASCII Strings.String end alignment|4|
|Aggressive Instruction Finder|false|
|Aggressive Instruction Finder.Create Analysis Bookmarks|true|
|Apply Data Archives|true|
|Apply Data Archives.Archive Chooser|[Auto-Detect]|
|Apply Data Archives.Create Analysis Bookmarks|true|
|Apply Data Archives.GDT User File Archive Path|None|
|Apply Data Archives.User Project Archive Path|None|
|Call Convention ID|true|
|Call Convention ID.Analysis Decompiler Timeout (sec)|60|
|Call-Fixup Installer|true|
|Condense Filler Bytes|false|
|Condense Filler Bytes.Filler Value|Auto|
|Condense Filler Bytes.Minimum number of sequential bytes|1|
|Create Address Tables|true|
|Create Address Tables.Allow Offcut References|false|
|Create Address Tables.Auto Label Table|false|
|Create Address Tables.Create Analysis Bookmarks|true|
|Create Address Tables.Maxmimum Pointer Distance|16777215|
|Create Address Tables.Minimum Pointer Address|4132|
|Create Address Tables.Minimum Table Size|2|
|Create Address Tables.Pointer Alignment|1|
|Create Address Tables.Relocation Table Guide|true|
|Create Address Tables.Table Alignment|4|
|Data Reference|true|
|Data Reference.Address Table Alignment|1|
|Data Reference.Address Table Minimum Size|2|
|Data Reference.Align End of Strings|false|
|Data Reference.Ascii String References|true|
|Data Reference.Create Address Tables|true|
|Data Reference.Minimum String Length|5|
|Data Reference.References to Pointers|true|
|Data Reference.Relocation Table Guide|true|
|Data Reference.Respect Execute Flag|true|
|Data Reference.Subroutine References|true|
|Data Reference.Switch Table References|false|
|Data Reference.Unicode String References|true|
|Decompiler Parameter ID|true|
|Decompiler Parameter ID.Analysis Clear Level|ANALYSIS|
|Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60|
|Decompiler Parameter ID.Commit Data Types|true|
|Decompiler Parameter ID.Commit Void Return Values|false|
|Decompiler Parameter ID.Prototype Evaluation|__fastcall|
|Decompiler Switch Analysis|true|
|Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60|
|Demangler Microsoft|true|
|Demangler Microsoft.Apply Function Calling Conventions|true|
|Demangler Microsoft.Apply Function Signatures|true|
|Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS|
|Demangler Microsoft.Demangle Only Known Mangled Symbols|false|
|Disassemble Entry Points|true|
|Disassemble Entry Points.Respect Execute Flag|true|
|Embedded Media|true|
|Embedded Media.Create Analysis Bookmarks|true|
|External Entry References|true|
|Function ID|true|
|Function ID.Always Apply FID Labels|false|
|Function ID.Create Analysis Bookmarks|true|
|Function ID.Instruction Count Threshold|14.6|
|Function ID.Multiple Match Threshold|30.0|
|Function Start Search|true|
|Function Start Search.Bookmark Functions|false|
|Function Start Search.Search Data Blocks|false|
|Non-Returning Functions - Discovered|true|
|Non-Returning Functions - Discovered.Create Analysis Bookmarks|true|
|Non-Returning Functions - Discovered.Function Non-return Threshold|3|
|Non-Returning Functions - Discovered.Repair Flow Damage|true|
|Non-Returning Functions - Known|true|
|Non-Returning Functions - Known.Create Analysis Bookmarks|true|
|PDB MSDIA|false|
|PDB MSDIA.Search untrusted symbol servers|false|
|PDB Universal|true|
|PDB Universal.Import Source Line Info|true|
|PDB Universal.Search untrusted symbol servers|false|
|Reference|true|
|Reference.Address Table Alignment|1|
|Reference.Address Table Minimum Size|2|
|Reference.Align End of Strings|false|
|Reference.Ascii String References|true|
|Reference.Create Address Tables|true|
|Reference.Minimum String Length|5|
|Reference.References to Pointers|true|
|Reference.Relocation Table Guide|true|
|Reference.Respect Execute Flag|true|
|Reference.Subroutine References|true|
|Reference.Switch Table References|false|
|Reference.Unicode String References|true|
|Scalar Operand References|true|
|Scalar Operand References.Relocation Table Guide|true|
|Shared Return Calls|true|
|Shared Return Calls.Allow Conditional Jumps|false|
|Shared Return Calls.Assume Contiguous Functions Only|true|
|Stack|true|
|Stack.Create Local Variables|true|
|Stack.Create Param Variables|false|
|Stack.Max Threads|2|
|Subroutine References|true|
|Subroutine References.Create Thunks Early|true|
|Variadic Function Signature Override|false|
|Variadic Function Signature Override.Create Analysis Bookmarks|false|
|Windows x86 PE Exception Handling|true|
|Windows x86 PE RTTI Analyzer|true|
|Windows x86 Thread Environment Block (TEB) Analyzer|true|
|Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB||
|Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7|
|WindowsPE x86 Propagate External Parameters|false|
|WindowsResourceReference|true|
|WindowsResourceReference.Create Analysis Bookmarks|true|
|x86 Constant Reference Analyzer|true|
|x86 Constant Reference Analyzer.Create Data from pointer|false|
|x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true|
|x86 Constant Reference Analyzer.Max Threads|2|
|x86 Constant Reference Analyzer.Min absolute reference|4|
|x86 Constant Reference Analyzer.Require pointer param data type|false|
|x86 Constant Reference Analyzer.Speculative reference max|256|
|x86 Constant Reference Analyzer.Speculative reference min|1024|
|x86 Constant Reference Analyzer.Stored Value Pointer analysis|true|
|x86 Constant Reference Analyzer.Trust values read from writable memory|true|
Ghidra pf_8875.sys Decompiler Options
|Decompiler Option|Value|
| :---: | :---: |
|Prototype Evaluation|__fastcall|
Ghidra pf_8875.sys Specification extensions Options
|Specification extensions Option|Value|
| :---: | :---: |
|FormatVersion|0|
|VersionCounter|0|
Ghidra pf_8875.sys Analyzers Options
|Analyzers Option|Value|
| :---: | :---: |
|ASCII Strings|true|
|ASCII Strings.Create Strings Containing Existing Strings|true|
|ASCII Strings.Create Strings Containing References|true|
|ASCII Strings.Force Model Reload|false|
|ASCII Strings.Minimum String Length|LEN_5|
|ASCII Strings.Model File|StringModel.sng|
|ASCII Strings.Require Null Termination for String|true|
|ASCII Strings.Search Only in Accessible Memory Blocks|true|
|ASCII Strings.String Start Alignment|ALIGN_1|
|ASCII Strings.String end alignment|4|
|Aggressive Instruction Finder|false|
|Aggressive Instruction Finder.Create Analysis Bookmarks|true|
|Apply Data Archives|true|
|Apply Data Archives.Archive Chooser|[Auto-Detect]|
|Apply Data Archives.Create Analysis Bookmarks|true|
|Apply Data Archives.GDT User File Archive Path|None|
|Apply Data Archives.User Project Archive Path|None|
|Call Convention ID|true|
|Call Convention ID.Analysis Decompiler Timeout (sec)|60|
|Call-Fixup Installer|true|
|Condense Filler Bytes|false|
|Condense Filler Bytes.Filler Value|Auto|
|Condense Filler Bytes.Minimum number of sequential bytes|1|
|Create Address Tables|true|
|Create Address Tables.Allow Offcut References|false|
|Create Address Tables.Auto Label Table|false|
|Create Address Tables.Create Analysis Bookmarks|true|
|Create Address Tables.Maxmimum Pointer Distance|16777215|
|Create Address Tables.Minimum Pointer Address|4132|
|Create Address Tables.Minimum Table Size|2|
|Create Address Tables.Pointer Alignment|1|
|Create Address Tables.Relocation Table Guide|true|
|Create Address Tables.Table Alignment|4|
|Data Reference|true|
|Data Reference.Address Table Alignment|1|
|Data Reference.Address Table Minimum Size|2|
|Data Reference.Align End of Strings|false|
|Data Reference.Ascii String References|true|
|Data Reference.Create Address Tables|true|
|Data Reference.Minimum String Length|5|
|Data Reference.References to Pointers|true|
|Data Reference.Relocation Table Guide|true|
|Data Reference.Respect Execute Flag|true|
|Data Reference.Subroutine References|true|
|Data Reference.Switch Table References|false|
|Data Reference.Unicode String References|true|
|Decompiler Parameter ID|true|
|Decompiler Parameter ID.Analysis Clear Level|ANALYSIS|
|Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60|
|Decompiler Parameter ID.Commit Data Types|true|
|Decompiler Parameter ID.Commit Void Return Values|false|
|Decompiler Parameter ID.Prototype Evaluation|__fastcall|
|Decompiler Switch Analysis|true|
|Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60|
|Demangler Microsoft|true|
|Demangler Microsoft.Apply Function Calling Conventions|true|
|Demangler Microsoft.Apply Function Signatures|true|
|Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS|
|Demangler Microsoft.Demangle Only Known Mangled Symbols|false|
|Disassemble Entry Points|true|
|Disassemble Entry Points.Respect Execute Flag|true|
|Embedded Media|true|
|Embedded Media.Create Analysis Bookmarks|true|
|External Entry References|true|
|Function ID|true|
|Function ID.Always Apply FID Labels|false|
|Function ID.Create Analysis Bookmarks|true|
|Function ID.Instruction Count Threshold|14.6|
|Function ID.Multiple Match Threshold|30.0|
|Function Start Search|true|
|Function Start Search.Bookmark Functions|false|
|Function Start Search.Search Data Blocks|false|
|Non-Returning Functions - Discovered|true|
|Non-Returning Functions - Discovered.Create Analysis Bookmarks|true|
|Non-Returning Functions - Discovered.Function Non-return Threshold|3|
|Non-Returning Functions - Discovered.Repair Flow Damage|true|
|Non-Returning Functions - Known|true|
|Non-Returning Functions - Known.Create Analysis Bookmarks|true|
|PDB MSDIA|false|
|PDB MSDIA.Search untrusted symbol servers|false|
|PDB Universal|true|
|PDB Universal.Import Source Line Info|true|
|PDB Universal.Search untrusted symbol servers|false|
|Reference|true|
|Reference.Address Table Alignment|1|
|Reference.Address Table Minimum Size|2|
|Reference.Align End of Strings|false|
|Reference.Ascii String References|true|
|Reference.Create Address Tables|true|
|Reference.Minimum String Length|5|
|Reference.References to Pointers|true|
|Reference.Relocation Table Guide|true|
|Reference.Respect Execute Flag|true|
|Reference.Subroutine References|true|
|Reference.Switch Table References|false|
|Reference.Unicode String References|true|
|Scalar Operand References|true|
|Scalar Operand References.Relocation Table Guide|true|
|Shared Return Calls|true|
|Shared Return Calls.Allow Conditional Jumps|false|
|Shared Return Calls.Assume Contiguous Functions Only|true|
|Stack|true|
|Stack.Create Local Variables|true|
|Stack.Create Param Variables|false|
|Stack.Max Threads|2|
|Subroutine References|true|
|Subroutine References.Create Thunks Early|true|
|Variadic Function Signature Override|false|
|Variadic Function Signature Override.Create Analysis Bookmarks|false|
|Windows x86 PE Exception Handling|true|
|Windows x86 PE RTTI Analyzer|true|
|Windows x86 Thread Environment Block (TEB) Analyzer|true|
|Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB||
|Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7|
|WindowsPE x86 Propagate External Parameters|false|
|WindowsResourceReference|true|
|WindowsResourceReference.Create Analysis Bookmarks|true|
|x86 Constant Reference Analyzer|true|
|x86 Constant Reference Analyzer.Create Data from pointer|false|
|x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true|
|x86 Constant Reference Analyzer.Max Threads|2|
|x86 Constant Reference Analyzer.Min absolute reference|4|
|x86 Constant Reference Analyzer.Require pointer param data type|false|
|x86 Constant Reference Analyzer.Speculative reference max|256|
|x86 Constant Reference Analyzer.Speculative reference min|1024|
|x86 Constant Reference Analyzer.Stored Value Pointer analysis|true|
|x86 Constant Reference Analyzer.Trust values read from writable memory|true|
## Diff Stats
|Stat|Value|
| :---: | :---: |
|added_funcs_len|3|
|deleted_funcs_len|0|
|modified_funcs_len|26|
|added_symbols_len|8|
|deleted_symbols_len|6|
|diff_time|3.693902015686035|
|deleted_strings_len|0|
|added_strings_len|0|
|match_types|Counter({'SymbolsHash': 664, 'ExternalsName': 258, 'ExactBytesFunctionHasher': 1, 'Implied Match': 1})|
|items_to_process|43|
|diff_types|Counter({'refcount': 16, 'calling': 16, 'code': 13, 'length': 13, 'address': 12, 'called': 8, 'sig': 6, 'name': 1, 'fullname': 1})|
|unmatched_funcs_len|3|
|total_funcs_len|1338|
|matched_funcs_len|1335|
|matched_funcs_with_code_changes_len|13|
|matched_funcs_with_non_code_changes_len|13|
|matched_funcs_no_changes_len|1309|
|match_func_similarity_percent|98.0524%|
|func_match_overall_percent|99.7758%|
|first_matches|Counter({'SymbolsHash': 664, 'ExactBytesFunctionHasher': 1, 'Implied Match': 1})|
```mermaid
pie showData
title All Matches
"SymbolsHash" : 664
"ExternalsName" : 258
"ExactBytesFunctionHasher" : 1
"Implied-Match" : 1
```
```mermaid
pie showData
title First Matches
"SymbolsHash" : 664
"ExactBytesFunctionHasher" : 1
"Implied-Match" : 1
```
```mermaid
pie showData
title Diff Stats
"added_funcs_len" : 3
"deleted_funcs_len" : 0
"modified_funcs_len" : 26
```
```mermaid
pie showData
title Symbols
"added_symbols_len" : 8
"deleted_symbols_len" : 6
```
## Strings
*No string differences found*
# Deleted
# Added
## Feature_2998397241__private_IsEnabledFallback
### Function Meta
|Key|pf_8875.sys|
| :---: | :---: |
|name|Feature_2998397241__private_IsEnabledFallback|
|fullname|Feature_2998397241__private_IsEnabledFallback|
|refcount|2|
|length|21|
|called|wil_details_IsEnabledFallback|
|calling|Feature_2998397241__private_IsEnabledDeviceUsageNoInline|
|paramcount|2|
|address|1400048ec|
|sig|undefined __fastcall Feature_2998397241__private_IsEnabledFallback(ulonglong param_1, int param_2)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- Feature_2998397241__private_IsEnabledFallback
+++ Feature_2998397241__private_IsEnabledFallback
@@ -0,0 +1,8 @@
+
+void Feature_2998397241__private_IsEnabledFallback(ulonglong param_1,int param_2)
+
+{
+ wil_details_IsEnabledFallback(param_1,param_2,&Feature_2998397241__private_descriptor);
+ return;
+}
+
```
## PrjfOpenAsReparsePointOld
### Function Meta
|Key|pf_8875.sys|
| :---: | :---: |
|name|PrjfOpenAsReparsePointOld|
|fullname|PrjfOpenAsReparsePointOld|
|refcount|7|
|length|1575|
|called|FLTMGR.SYS::FltGetInstanceContext
FLTMGR.SYS::FltReleaseContext
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExAllocateFromPagedLookasideList
NTOSKRNL.EXE::ExFreeToPagedLookasideList
PrjfOpenReparsePointOld
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDdZssss|
|calling|PrjfDecideUpdateDeleteOnFileStateAndUpdateFlags
PrjfDeleteTombstoneIfExists
PrjfOpenAndCheckEmptyPartialDirectory
PrjfPostCreate
PrjfProcessFileDirectoryStatus
PrjfProcessTombstoneBounce|
|paramcount|12|
|address|14003ce98|
|sig|int __fastcall PrjfOpenAsReparsePointOld(wchar_t * param_1, undefined8 param_2, undefined8 param_3, undefined4 param_4, undefined8 param_5, longlong param_6, longlong param_7, byte * param_8, byte * param_9, byte * param_10, undefined8 * * * * * * * param_11, uint * param_12)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- PrjfOpenAsReparsePointOld
+++ PrjfOpenAsReparsePointOld
@@ -0,0 +1,278 @@
+
+int PrjfOpenAsReparsePointOld
+ (wchar_t *param_1,undefined8 param_2,undefined8 param_3,undefined4 param_4,
+ undefined8 param_5,longlong param_6,longlong param_7,byte *param_8,byte *param_9,
+ byte *param_10,undefined8 *******param_11,uint *param_12)
+
+{
+ undefined8 uVar1;
+ code *pcVar2;
+ int iVar3;
+ undefined8 ********ppppppppuVar4;
+ undefined8 ********ppppppppuVar5;
+ undefined8 ********ppppppppuVar6;
+ undefined8 ********ppppppppuVar7;
+ ulonglong uVar8;
+ char *pcVar9;
+ undefined8 ********ppppppppuVar10;
+ undefined1 *puVar11;
+ undefined1 *puVar12;
+ undefined1 *puVar13;
+ char *pcVar14;
+ byte bVar15;
+ char *pcVar16;
+ undefined8 ********ppppppppuVar17;
+ byte *unaff_R13;
+ undefined8 ********ppppppppuVar18;
+ uint uVar19;
+ bool bVar20;
+ undefined1 auStackY_e8 [8];
+ undefined1 auStackY_e0 [24];
+ ushort uVar21;
+ longlong local_68;
+ undefined8 *******local_60;
+ undefined8 *******local_58;
+
+ puVar11 = auStackY_e8;
+ puVar12 = auStackY_e8;
+ ppppppppuVar17 = (undefined8 ********)0x0;
+ uVar19 = 0x80000004;
+ local_68 = 0;
+ ppppppppuVar18 = (undefined8 ********)0x0;
+ ppppppppuVar10 = (undefined8 ********)0x0;
+ puVar13 = auStackY_e8;
+ if ((param_6 == 0) || (puVar13 = auStackY_e8, param_7 == 0)) goto LAB_14003d4ab;
+ iVar3 = FltGetInstanceContext(param_3,&local_68);
+ if ((iVar3 < 0) || (local_68 == 0)) {
+ MicrosoftTelemetryAssertTriggeredNoArgsKM();
+ }
+ if ((*(int *)(local_68 + 0x18) != 2) && (*(int *)(local_68 + 0x18) != 0x1c)) {
+ MicrosoftTelemetryAssertTriggeredNoArgsKM();
+ }
+ if (param_12 != (uint *)0x0) {
+ uVar19 = *param_12;
+ }
+ local_58 = &local_60;
+ local_60 = &local_60;
+ ppppppppuVar4 = ppppppppuVar17;
+ ppppppppuVar7 = ppppppppuVar17;
+ ppppppppuVar5 = ppppppppuVar17;
+ ppppppppuVar6 = ppppppppuVar17;
+ if (param_8 == (byte *)0x0) {
+LAB_14003d04f:
+ uVar19 = uVar19 | 0x80000000;
+ ppppppppuVar7 = ppppppppuVar10;
+ if (param_9 != (byte *)0x0) {
+ *param_9 = 0;
+ ppppppppuVar5 = (undefined8 ********)ExAllocateFromPagedLookasideList(&DAT_14001b700);
+ ppppppppuVar6 = ppppppppuVar18;
+ if (ppppppppuVar5 == (undefined8 ********)0x0) {
+ bVar20 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar15 = DAT_14001b3d1 & 4;
+ if ((bVar15 != 0) || (puVar12 = auStackY_e8, bVar20)) {
+ uVar21 = 0x38;
+ goto LAB_14003cfd6;
+ }
+ goto LAB_14003d420;
+ }
+ ppppppppuVar5[1] = ppppppppuVar5;
+ *ppppppppuVar5 = ppppppppuVar5;
+ ppppppppuVar5[3] = (undefined8 *******)0x0;
+ ppppppppuVar5[4] = (undefined8 *******)0x0;
+ *(undefined4 *)(ppppppppuVar5 + 2) = 0xa000000c;
+ *(uint *)((longlong)ppppppppuVar5 + 0x14) = uVar19;
+ *(undefined4 *)(ppppppppuVar5 + 5) = 0x30;
+ if ((undefined8 ********)*local_58 != &local_60) goto LAB_14003d2b0;
+ ppppppppuVar5[1] = local_58;
+ *ppppppppuVar5 = &local_60;
+ *local_58 = ppppppppuVar5;
+ local_58 = ppppppppuVar5;
+ }
+ ppppppppuVar6 = ppppppppuVar17;
+ unaff_R13 = param_10;
+ if (param_10 != (byte *)0x0) {
+ *param_10 = 0;
+ ppppppppuVar6 = (undefined8 ********)ExAllocateFromPagedLookasideList(&DAT_14001b700);
+ if (ppppppppuVar6 == (undefined8 ********)0x0) {
+ bVar20 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar15 = DAT_14001b3d1 & 4;
+ if ((bVar15 != 0) || (puVar12 = auStackY_e8, bVar20)) {
+ uVar21 = 0x39;
+ goto LAB_14003cfd6;
+ }
+ goto LAB_14003d420;
+ }
+ ppppppppuVar6[1] = ppppppppuVar6;
+ *ppppppppuVar6 = ppppppppuVar6;
+ ppppppppuVar6[3] = (undefined8 *******)0x0;
+ ppppppppuVar6[4] = (undefined8 *******)0x0;
+ *(undefined4 *)(ppppppppuVar6 + 2) = 0xa0000003;
+ *(uint *)((longlong)ppppppppuVar6 + 0x14) = uVar19;
+ *(undefined4 *)(ppppppppuVar6 + 5) = 0x30;
+ if ((undefined8 ********)*local_58 != &local_60) goto LAB_14003d2b0;
+ ppppppppuVar6[1] = local_58;
+ *ppppppppuVar6 = &local_60;
+ *local_58 = ppppppppuVar6;
+ local_58 = ppppppppuVar6;
+ }
+ ppppppppuVar7 = ppppppppuVar17;
+ puVar13 = auStackY_e8;
+ if (param_11 == (undefined8 *******)0x0) {
+LAB_14003d2c9:
+ puVar12 = puVar13;
+ *(longlong *)(puVar12 + 0x40) = param_7;
+ *(longlong *)(puVar12 + 0x38) = param_6;
+ *(undefined8 *********)(puVar12 + 0x30) = &local_60;
+ *(undefined4 *)(puVar12 + 0x20) = 0x28;
+ *(undefined8 *)(puVar12 + -8) = 0x14003d301;
+ uVar8 = PrjfOpenReparsePointOld
+ (param_3,param_1,param_2,param_4,*(undefined4 *)(puVar12 + 0x20),
+ *(undefined8 *)(puVar12 + 0x28),*(longlong **)(puVar12 + 0x30),
+ *(undefined8 *)(puVar12 + 0x38),*(undefined8 *)(puVar12 + 0x40));
+ iVar3 = (int)uVar8;
+ if (iVar3 < 0) {
+ if ((iVar3 != -0x3fffffcc) && (iVar3 != -0x3fffffc6)) {
+ if (((DAT_14001b3d1 & 4) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ pcVar16 = "did";
+ pcVar14 = "did";
+ if ((undefined8 ********)param_11 == (undefined8 ********)0x0) {
+ pcVar14 = "did NOT";
+ }
+ pcVar9 = "did";
+ *(char **)(puVar12 + 0x78) = pcVar14;
+ if (param_10 == (byte *)0x0) {
+ pcVar9 = "did NOT";
+ }
+ *(char **)(puVar12 + 0x70) = pcVar9;
+ uVar1 = *(undefined8 *)(WPP_GLOBAL_Control + 0x40);
+ if (param_9 == (byte *)0x0) {
+ pcVar16 = "did NOT";
+ }
+ pcVar14 = "Did";
+ *(char **)(puVar12 + 0x68) = pcVar16;
+ if (param_8 == (byte *)0x0) {
+ pcVar14 = "Did NOT";
+ }
+ *(char **)(puVar12 + 0x60) = pcVar14;
+ *(wchar_t **)(puVar12 + 0x58) = param_1;
+ *(int *)(puVar12 + 0x50) = iVar3;
+ *(undefined4 *)(puVar12 + 0x48) = 0x950;
+ *(undefined2 *)(puVar12 + 0x30) = 0x3b;
+ *(undefined8 *)(puVar12 + -8) = 0x14003d3d7;
+ WPP_RECORDER_AND_TRACE_SF_sDdZssss
+ (pcVar9,DAT_14001b3d1 & 4,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,uVar1,
+ *(undefined8 *)(puVar12 + 0x20),*(undefined8 *)(puVar12 + 0x28),
+ *(ushort *)(puVar12 + 0x30));
+ }
+ }
+ }
+ else {
+ if (param_8 != (byte *)0x0) {
+ *param_8 = *(byte *)((longlong)ppppppppuVar4 + 0x14) & 1;
+ }
+ if (param_9 != (byte *)0x0) {
+ *param_9 = *(byte *)((longlong)ppppppppuVar5 + 0x14) & 1;
+ }
+ if (param_10 != (byte *)0x0) {
+ *param_10 = *(byte *)((longlong)ppppppppuVar6 + 0x14) & 1;
+ }
+ if ((undefined8 ********)param_11 != (undefined8 ********)0x0) {
+ *(byte *)param_11 = *(byte *)((longlong)ppppppppuVar7 + 0x14) & 1;
+ }
+ }
+ }
+ else {
+ *(undefined1 *)param_11 = 0;
+ ppppppppuVar7 = (undefined8 ********)ExAllocateFromPagedLookasideList(&DAT_14001b700);
+ if (ppppppppuVar7 != (undefined8 ********)0x0) {
+ ppppppppuVar7[1] = ppppppppuVar7;
+ *ppppppppuVar7 = ppppppppuVar7;
+ ppppppppuVar7[3] = (undefined8 *******)0x0;
+ ppppppppuVar7[4] = (undefined8 *******)0x0;
+ *(undefined4 *)(ppppppppuVar7 + 2) = 0xa0000022;
+ *(uint *)((longlong)ppppppppuVar7 + 0x14) = uVar19;
+ *(undefined4 *)(ppppppppuVar7 + 5) = 0x30;
+ ppppppppuVar17 = (undefined8 ********)param_11;
+ if ((undefined8 ********)*local_58 != &local_60) goto LAB_14003d2b0;
+ goto LAB_14003d2b7;
+ }
+ bVar20 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar15 = DAT_14001b3d1 & 4;
+ if ((bVar15 != 0) || (bVar20)) {
+ uVar21 = 0x3a;
+ goto LAB_14003cfd6;
+ }
+ }
+ }
+ else {
+ *param_8 = 0;
+ ppppppppuVar4 = (undefined8 ********)ExAllocateFromPagedLookasideList(&DAT_14001b700);
+ if (ppppppppuVar4 != (undefined8 ********)0x0) {
+ ppppppppuVar4[1] = ppppppppuVar4;
+ *ppppppppuVar4 = ppppppppuVar4;
+ ppppppppuVar4[3] = (undefined8 *******)0x0;
+ ppppppppuVar4[4] = (undefined8 *******)0x0;
+ *(undefined4 *)(ppppppppuVar4 + 2) = 0x9000001c;
+ *(uint *)((longlong)ppppppppuVar4 + 0x14) = uVar19 | 0x80000000;
+ *(undefined4 *)(ppppppppuVar4 + 5) = 0x30;
+ if ((undefined8 ********)*local_58 == &local_60) {
+ ppppppppuVar4[1] = local_58;
+ *ppppppppuVar4 = &local_60;
+ *local_58 = ppppppppuVar4;
+ local_58 = ppppppppuVar4;
+ goto LAB_14003d04f;
+ }
+LAB_14003d2b0:
+ pcVar2 = (code *)swi(0x29);
+ local_58 = (undefined8 *******)(*pcVar2)(3);
+ puVar11 = auStackY_e0;
+ param_11 = ppppppppuVar17;
+ param_10 = unaff_R13;
+LAB_14003d2b7:
+ ppppppppuVar7[1] = local_58;
+ *ppppppppuVar7 = &local_60;
+ *local_58 = ppppppppuVar7;
+ local_58 = ppppppppuVar7;
+ puVar13 = puVar11;
+ goto LAB_14003d2c9;
+ }
+ bVar20 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar15 = DAT_14001b3d1 & 4;
+ if ((bVar15 != 0) || (puVar12 = auStackY_e8, bVar20)) {
+ uVar21 = 0x37;
+LAB_14003cfd6:
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x20a,bVar15,bVar20,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,10,uVar21,
+ &WPP_7785e5eeecf6357514fa74506e9ad78e_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
+ puVar12 = auStackY_e8;
+ }
+ }
+LAB_14003d420:
+ if (local_68 != 0) {
+ *(undefined8 *)(puVar12 + -8) = 0x14003d430;
+ FltReleaseContext();
+ }
+ if (ppppppppuVar4 != (undefined8 ********)0x0) {
+ *(undefined8 *)(puVar12 + -8) = 0x14003d44b;
+ ExFreeToPagedLookasideList(&DAT_14001b700,ppppppppuVar4);
+ }
+ if (ppppppppuVar5 != (undefined8 ********)0x0) {
+ *(undefined8 *)(puVar12 + -8) = 0x14003d466;
+ ExFreeToPagedLookasideList(&DAT_14001b700,ppppppppuVar5);
+ }
+ if (ppppppppuVar6 != (undefined8 ********)0x0) {
+ *(undefined8 *)(puVar12 + -8) = 0x14003d481;
+ ExFreeToPagedLookasideList(&DAT_14001b700,ppppppppuVar6);
+ }
+ puVar13 = puVar12;
+ if (ppppppppuVar7 != (undefined8 ********)0x0) {
+ *(undefined8 *)(puVar12 + -8) = 0x14003d49c;
+ ExFreeToPagedLookasideList(&DAT_14001b700,ppppppppuVar7);
+ }
+LAB_14003d4ab:
+ return (int)*(undefined8 *)(puVar13 + 0xa8);
+}
+
```
## PrjfOpenReparsePointOld
### Function Meta
|Key|pf_8875.sys|
| :---: | :---: |
|name|PrjfOpenReparsePointOld|
|fullname|PrjfOpenReparsePointOld|
|refcount|3|
|length|1098|
|called|FLTMGR.SYS::FltAllocateExtraCreateParameterFromLookasideList
FLTMGR.SYS::FltAllocateExtraCreateParameterList
FLTMGR.SYS::FltCreateFileEx2
FLTMGR.SYS::FltFreeExtraCreateParameterList
FLTMGR.SYS::FltInsertExtraCreateParameter
MicrosoftTelemetryAssertTriggeredNoArgsKM
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDdZ
WPP_RECORDER_AND_TRACE_SF_sDdZP|
|calling|PrjfOpenAsReparsePointOld
PrjfOpenPlaceHolder|
|paramcount|9|
|address|14003db08|
|sig|ulonglong __fastcall PrjfOpenReparsePointOld(undefined8 param_1, wchar_t * param_2, undefined8 param_3, undefined4 param_4, undefined4 param_5, undefined8 param_6, longlong * param_7, undefined8 param_8, undefined8 param_9)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- PrjfOpenReparsePointOld
+++ PrjfOpenReparsePointOld
@@ -0,0 +1,178 @@
+
+/* WARNING: Type propagation algorithm not settling */
+
+ulonglong PrjfOpenReparsePointOld
+ (undefined8 param_1,wchar_t *param_2,undefined8 param_3,undefined4 param_4,
+ undefined4 param_5,undefined8 param_6,longlong *param_7,undefined8 param_8,
+ undefined8 param_9)
+
+{
+ longlong *plVar1;
+ longlong lVar2;
+ longlong *plVar3;
+ code *pcVar4;
+ uint uVar5;
+ int iVar6;
+ ulonglong uVar7;
+ byte bVar8;
+ longlong *plVar9;
+ bool bVar10;
+ undefined4 uVar12;
+ undefined8 uVar11;
+ undefined8 *puVar13;
+ ushort uVar14;
+ undefined8 in_stack_ffffffffffffff18;
+ uint uVar15;
+ undefined4 in_stack_ffffffffffffff24;
+ undefined4 in_stack_ffffffffffffff2c;
+ undefined8 in_stack_ffffffffffffff30;
+ undefined4 uVar16;
+ longlong *local_a8;
+ longlong local_a0 [6];
+ undefined8 local_70;
+ undefined8 uStack_68;
+ wchar_t *local_60;
+ undefined8 uStack_58;
+ undefined8 local_50;
+ ulonglong uStack_48;
+ undefined8 local_40;
+ undefined8 uStack_38;
+
+ uVar15 = (uint)((ulonglong)in_stack_ffffffffffffff18 >> 0x20);
+ uVar16 = (undefined4)((ulonglong)in_stack_ffffffffffffff30 >> 0x20);
+ local_a0[5] = local_a0[5] & 0xffffffffffff0000;
+ local_a8 = (longlong *)0x0;
+ local_a0[0] = 0;
+ local_50 = 0;
+ uStack_48 = uStack_48 & 0xffffffff00000000;
+ local_a0[1] = 0;
+ local_a0[2] = 0;
+ local_a0[3] = 0;
+ local_a0[4] = 0;
+ local_70 = 0;
+ uStack_68 = 0;
+ local_60 = (wchar_t *)0x0;
+ uStack_58 = 0;
+ local_40 = 0;
+ uStack_38 = 0;
+ uVar5 = FltAllocateExtraCreateParameterList(Globals,0,local_a0);
+ uVar7 = (ulonglong)uVar5;
+ if ((int)uVar5 < 0) {
+ bVar10 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar8 = DAT_14001b3d0 & 0x20;
+ if ((bVar8 == 0) && (!bVar10)) goto LAB_14003dbf9;
+ uVar14 = 0x40;
+ }
+ else {
+ uVar12 = 0;
+ uVar5 = FltAllocateExtraCreateParameterFromLookasideList
+ (Globals,&ECP_TYPE_OPEN_REPARSE_GUID,0x10,0,0,&DAT_14001b680,&local_a8);
+ uVar7 = (ulonglong)uVar5;
+ if (-1 < (int)uVar5) {
+ local_a8[1] = (longlong)local_a8;
+ *local_a8 = (longlong)local_a8;
+ plVar9 = (longlong *)0x0;
+ while (plVar1 = (longlong *)*param_7, plVar1 != param_7) {
+ if (((longlong *)plVar1[1] != param_7) ||
+ (lVar2 = *plVar1, *(longlong **)(lVar2 + 8) != plVar1)) goto LAB_14003df4b;
+ *param_7 = lVar2;
+ *(longlong **)(lVar2 + 8) = param_7;
+ plVar3 = (longlong *)local_a8[1];
+ if ((longlong *)*plVar3 != local_a8) goto LAB_14003df4b;
+ *plVar1 = (longlong)local_a8;
+ plVar1[1] = (longlong)plVar3;
+ *plVar3 = (longlong)plVar1;
+ local_a8[1] = (longlong)plVar1;
+ if ((int)plVar1[2] == -0x5fffffde) {
+ plVar9 = plVar1;
+ }
+ }
+ iVar6 = FltInsertExtraCreateParameter(Globals,local_a0[0],local_a8);
+ if (iVar6 < 0) {
+ MicrosoftTelemetryAssertTriggeredNoArgsKM();
+ }
+ local_a0[1] = 0x28;
+ local_a0[2] = local_a0[0];
+ puVar13 = &local_70;
+ local_a0[5] = 1;
+ uVar11 = CONCAT44(uVar12,param_4);
+ local_a0[3] = 0;
+ local_a0[4] = 0;
+ local_70 = CONCAT44(local_70._4_4_,0x30);
+ uStack_58 = CONCAT44(uStack_58._4_4_,0x240);
+ local_50 = 0;
+ uStack_48 = 0;
+ uStack_68 = param_3;
+ local_60 = param_2;
+ uVar5 = FltCreateFileEx2(Globals,param_1,param_8,param_9,uVar11,puVar13,&local_40,0,
+ (ulonglong)uVar15 << 0x20,7,1,CONCAT44(uVar16,param_5),0,0,0,
+ local_a0 + 1);
+ uVar7 = (ulonglong)uVar5;
+ if ((int)uVar5 < 0) {
+ if (uVar5 == 0xc0000279) {
+ if ((plVar9 == (longlong *)0x0) || ((*(uint *)((longlong)plVar9 + 0x14) & 1) == 0)) {
+ if (((DAT_14001b3d1 & 4) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDdZP
+ (&WPP_RECORDER_INITIALIZED,DAT_14001b3d1 & 4,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),uVar11,puVar13,0x43);
+ }
+ }
+ else {
+ uVar7 = 0xc0000281;
+ if (((DAT_14001b3e1 & 4) != 0) ||
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ WPP_RECORDER_AND_TRACE_SF_sDdZ
+ (0x40a,DAT_14001b3e1 & 4,
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),4,10,0x42,
+ &WPP_7785e5eeecf6357514fa74506e9ad78e_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",
+ CONCAT44(in_stack_ffffffffffffff24,0xb03),
+ CONCAT44(in_stack_ffffffffffffff2c,0xc0000281),param_2);
+ }
+ }
+ }
+ }
+ else {
+ while( true ) {
+ plVar9 = (longlong *)*local_a8;
+ if (plVar9 == local_a8) break;
+ if (((longlong *)plVar9[1] != local_a8) ||
+ (lVar2 = *plVar9, (longlong *)*(longlong *)(lVar2 + 8) != plVar9)) {
+LAB_14003df4b:
+ pcVar4 = (code *)swi(0x29);
+ (*pcVar4)(3);
+ pcVar4 = (code *)swi(3);
+ uVar7 = (*pcVar4)();
+ return uVar7;
+ }
+ *local_a8 = lVar2;
+ *(longlong **)(lVar2 + 8) = local_a8;
+ plVar1 = (longlong *)param_7[1];
+ if ((longlong *)*plVar1 != param_7) goto LAB_14003df4b;
+ *plVar9 = (longlong)param_7;
+ plVar9[1] = (longlong)plVar1;
+ *plVar1 = (longlong)plVar9;
+ param_7[1] = (longlong)plVar9;
+ }
+ }
+ goto LAB_14003dbf9;
+ }
+ bVar10 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar8 = DAT_14001b3d0 & 0x20;
+ if ((bVar8 == 0) && (!bVar10)) goto LAB_14003dbf9;
+ uVar14 = 0x41;
+ }
+ WPP_RECORDER_AND_TRACE_SF_sDD
+ (0x205,bVar8,bVar10,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,uVar14,
+ &WPP_7785e5eeecf6357514fa74506e9ad78e_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
+LAB_14003dbf9:
+ if (local_a0[0] != 0) {
+ FltFreeExtraCreateParameterList(Globals);
+ }
+ return uVar7;
+}
+
```
# Modified
*Modified functions contain code changes*
## WPP_RECORDER_AND_TRACE_SF_sDdZssss
### Match Info
|Key|pf_8737.sys - pf_8875.sys|
| :---: | :---: |
|diff_type|code,refcount,length,sig,address,calling|
|ratio|0.95|
|i_ratio|0.58|
|m_ratio|0.99|
|b_ratio|0.64|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pf_8737.sys|pf_8875.sys|
| :---: | :---: | :---: |
|name|WPP_RECORDER_AND_TRACE_SF_sDdZssss|WPP_RECORDER_AND_TRACE_SF_sDdZssss|
|fullname|WPP_RECORDER_AND_TRACE_SF_sDdZssss|WPP_RECORDER_AND_TRACE_SF_sDdZssss|
|`refcount`|2|3|
|`length`|967|986|
|called|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|
|`calling`|PrjfOpenAsReparsePoint|PrjfOpenAsReparsePoint
PrjfOpenAsReparsePointOld|
|paramcount|4|7|
|`address`|140013950|140013944|
|`sig`|undefined __fastcall WPP_RECORDER_AND_TRACE_SF_sDdZssss(undefined8 param_1, char param_2, char param_3, undefined8 param_4)|undefined __fastcall WPP_RECORDER_AND_TRACE_SF_sDdZssss(undefined8 param_1, char param_2, char param_3, undefined8 param_4, undefined8 param_5, undefined8 param_6, ushort param_7)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### WPP_RECORDER_AND_TRACE_SF_sDdZssss Calling Diff
```diff
--- WPP_RECORDER_AND_TRACE_SF_sDdZssss calling
+++ WPP_RECORDER_AND_TRACE_SF_sDdZssss calling
@@ -1,0 +2 @@
+PrjfOpenAsReparsePointOld
```
### WPP_RECORDER_AND_TRACE_SF_sDdZssss Diff
```diff
--- WPP_RECORDER_AND_TRACE_SF_sDdZssss
+++ WPP_RECORDER_AND_TRACE_SF_sDdZssss
@@ -1,116 +1,115 @@
void WPP_RECORDER_AND_TRACE_SF_sDdZssss
- (undefined8 param_1,char param_2,char param_3,undefined8 param_4)
+ (undefined8 param_1,char param_2,char param_3,undefined8 param_4,undefined8 param_5,
+ undefined8 param_6,ushort param_7)
{
longlong lVar1;
longlong lVar2;
longlong lVar3;
longlong lVar4;
longlong lVar5;
wchar_t wVar6;
wchar_t *pwVar7;
wchar_t *pwStack0000000000000040;
wchar_t *in_stack_00000060;
char *in_stack_00000068;
char *in_stack_00000070;
char *in_stack_00000078;
char *in_stack_00000080;
- undefined4 local_48 [4];
- local_48[0] = 0x862;
pwStack0000000000000040 = L"\b";
if (param_2 != '\0') {
if (in_stack_00000080 != (char *)0x0) {
lVar5 = -1;
do {
lVar5 = lVar5 + 1;
} while (in_stack_00000080[lVar5] != '\0');
}
if (in_stack_00000078 != (char *)0x0) {
lVar5 = -1;
do {
lVar5 = lVar5 + 1;
} while (in_stack_00000078[lVar5] != '\0');
}
if (in_stack_00000070 != (char *)0x0) {
lVar5 = -1;
do {
lVar5 = lVar5 + 1;
} while (in_stack_00000070[lVar5] != '\0');
}
if (in_stack_00000068 != (char *)0x0) {
lVar5 = -1;
do {
lVar5 = lVar5 + 1;
} while (in_stack_00000068[lVar5] != '\0');
}
- FastWppTraceMessage(0x20a,0x36,&WPP_20e7495dfd7e3f36bcabba5500ea3aac_Traceguids,
+ FastWppTraceMessage(0x20a,param_7,&WPP_7785e5eeecf6357514fa74506e9ad78e_Traceguids,
"onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
}
+ wVar6 = L'\b';
lVar5 = 5;
- wVar6 = L'\b';
pwVar7 = L"NULL";
if (param_3 != '\0') {
lVar3 = lVar5;
if (in_stack_00000080 != (char *)0x0) {
lVar3 = -1;
do {
lVar2 = lVar3;
lVar3 = lVar2 + 1;
} while (in_stack_00000080[lVar3] != '\0');
lVar3 = lVar2 + 2;
}
if (in_stack_00000080 == (char *)0x0) {
in_stack_00000080 = "NULL";
}
lVar2 = lVar5;
if (in_stack_00000078 != (char *)0x0) {
lVar2 = -1;
do {
lVar1 = lVar2;
lVar2 = lVar1 + 1;
} while (in_stack_00000078[lVar2] != '\0');
lVar2 = lVar1 + 2;
}
if (in_stack_00000078 == (char *)0x0) {
in_stack_00000078 = "NULL";
}
lVar1 = lVar5;
if (in_stack_00000070 != (char *)0x0) {
lVar1 = -1;
do {
lVar4 = lVar1;
lVar1 = lVar4 + 1;
} while (in_stack_00000070[lVar1] != '\0');
lVar1 = lVar4 + 2;
}
if (in_stack_00000070 == (char *)0x0) {
in_stack_00000070 = "NULL";
}
lVar4 = -1;
if (in_stack_00000068 != (char *)0x0) {
do {
lVar5 = lVar4;
lVar4 = lVar5 + 1;
} while (in_stack_00000068[lVar4] != '\0');
lVar5 = lVar5 + 2;
}
if (in_stack_00000068 == (char *)0x0) {
in_stack_00000068 = "NULL";
}
if ((in_stack_00000060 != (wchar_t *)0x0) &&
(wVar6 = *in_stack_00000060, *in_stack_00000060 != L'\0')) {
pwVar7 = *(wchar_t **)(in_stack_00000060 + 4);
}
if (in_stack_00000060 == (wchar_t *)0x0) {
in_stack_00000060 = L"\b";
}
- WppAutoLogTrace(param_4,2,10,&WPP_20e7495dfd7e3f36bcabba5500ea3aac_Traceguids,0x36,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",0x29,local_48,4,
+ WppAutoLogTrace(param_4,2,10,&WPP_7785e5eeecf6357514fa74506e9ad78e_Traceguids,param_7,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",0x29,&stack0x00000050,4,
&stack0x00000058,4,in_stack_00000060,2,pwVar7,wVar6,in_stack_00000068,lVar5,
in_stack_00000070,lVar1,in_stack_00000078,lVar2,in_stack_00000080,lVar3,0);
}
return;
}
```
## WPP_RECORDER_AND_TRACE_SF_sDdZP
### Match Info
|Key|pf_8737.sys - pf_8875.sys|
| :---: | :---: |
|diff_type|code,refcount,length,sig,calling|
|ratio|0.87|
|i_ratio|0.57|
|m_ratio|1.0|
|b_ratio|0.95|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pf_8737.sys|pf_8875.sys|
| :---: | :---: | :---: |
|name|WPP_RECORDER_AND_TRACE_SF_sDdZP|WPP_RECORDER_AND_TRACE_SF_sDdZP|
|fullname|WPP_RECORDER_AND_TRACE_SF_sDdZP|WPP_RECORDER_AND_TRACE_SF_sDdZP|
|`refcount`|2|3|
|`length`|484|472|
|called|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|
|`calling`|PrjfOpenReparsePoint|PrjfOpenReparsePoint
PrjfOpenReparsePointOld|
|paramcount|4|7|
|address|140012fbc|140012fbc|
|`sig`|undefined __fastcall WPP_RECORDER_AND_TRACE_SF_sDdZP(undefined8 param_1, char param_2, char param_3, undefined8 param_4)|undefined __fastcall WPP_RECORDER_AND_TRACE_SF_sDdZP(undefined8 param_1, char param_2, char param_3, undefined8 param_4, undefined8 param_5, undefined8 param_6, ushort param_7)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### WPP_RECORDER_AND_TRACE_SF_sDdZP Calling Diff
```diff
--- WPP_RECORDER_AND_TRACE_SF_sDdZP calling
+++ WPP_RECORDER_AND_TRACE_SF_sDdZP calling
@@ -1,0 +2 @@
+PrjfOpenReparsePointOld
```
### WPP_RECORDER_AND_TRACE_SF_sDdZP Diff
```diff
--- WPP_RECORDER_AND_TRACE_SF_sDdZP
+++ WPP_RECORDER_AND_TRACE_SF_sDdZP
@@ -1,36 +1,35 @@
void WPP_RECORDER_AND_TRACE_SF_sDdZP
- (undefined8 param_1,char param_2,char param_3,undefined8 param_4)
+ (undefined8 param_1,char param_2,char param_3,undefined8 param_4,undefined8 param_5,
+ undefined8 param_6,ushort param_7)
{
wchar_t wVar1;
wchar_t *pwVar2;
wchar_t *in_stack_00000060;
- undefined4 local_28 [4];
pwVar2 = L"NULL";
- local_28[0] = 0x964;
if (param_2 != '\0') {
- FastWppTraceMessage(0x20a,0x3a,&WPP_20e7495dfd7e3f36bcabba5500ea3aac_Traceguids,
+ FastWppTraceMessage(0x20a,param_7,&WPP_7785e5eeecf6357514fa74506e9ad78e_Traceguids,
"onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
}
if (param_3 != '\0') {
if (in_stack_00000060 == (wchar_t *)0x0) {
wVar1 = L'\b';
}
else {
wVar1 = *in_stack_00000060;
if (*in_stack_00000060 != L'\0') {
pwVar2 = *(wchar_t **)(in_stack_00000060 + 4);
}
}
if (in_stack_00000060 == (wchar_t *)0x0) {
in_stack_00000060 = L"\b";
}
- WppAutoLogTrace(param_4,2,10,&WPP_20e7495dfd7e3f36bcabba5500ea3aac_Traceguids,0x3a,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",0x29,local_28,4,
+ WppAutoLogTrace(param_4,2,10,&WPP_7785e5eeecf6357514fa74506e9ad78e_Traceguids,param_7,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",0x29,&stack0x00000050,4,
&stack0x00000058,4,in_stack_00000060,2,pwVar2,wVar1,&stack0x00000068,8,0);
}
return;
}
```
## PrjfOpenAndCheckEmptyPartialDirectory
### Match Info
|Key|pf_8737.sys - pf_8875.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.23|
|i_ratio|0.39|
|m_ratio|0.93|
|b_ratio|0.85|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pf_8737.sys|pf_8875.sys|
| :---: | :---: | :---: |
|name|PrjfOpenAndCheckEmptyPartialDirectory|PrjfOpenAndCheckEmptyPartialDirectory|
|fullname|PrjfOpenAndCheckEmptyPartialDirectory|PrjfOpenAndCheckEmptyPartialDirectory|
|refcount|2|2|
|`length`|556|625|
|`called`|FLTMGR.SYS::FltClose
NTOSKRNL.EXE::ObfDereferenceObject
PrjfIsDirectoryEmpty
PrjfOpenAsReparsePoint
WPP_RECORDER_AND_TRACE_SF_sDdZ|FLTMGR.SYS::FltClose
Feature_2998397241__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ObfDereferenceObject
PrjfIsDirectoryEmpty
PrjfOpenAsReparsePoint
PrjfOpenAsReparsePointOld
WPP_RECORDER_AND_TRACE_SF_sDdZ|
|calling|PrjfPrepareDestinationForRenameOrLink|PrjfPrepareDestinationForRenameOrLink|
|paramcount|5|5|
|`address`|140007df0|140007e40|
|sig|int __fastcall PrjfOpenAndCheckEmptyPartialDirectory(longlong param_1, longlong param_2, wchar_t * param_3, undefined8 param_4, undefined1 * param_5)|int __fastcall PrjfOpenAndCheckEmptyPartialDirectory(longlong param_1, longlong param_2, wchar_t * param_3, undefined8 param_4, undefined1 * param_5)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfOpenAndCheckEmptyPartialDirectory Called Diff
```diff
--- PrjfOpenAndCheckEmptyPartialDirectory called
+++ PrjfOpenAndCheckEmptyPartialDirectory called
@@ -1,0 +2 @@
+Feature_2998397241__private_IsEnabledDeviceUsageNoInline
@@ -4,0 +6 @@
+PrjfOpenAsReparsePointOld
```
### PrjfOpenAndCheckEmptyPartialDirectory Diff
```diff
--- PrjfOpenAndCheckEmptyPartialDirectory
+++ PrjfOpenAndCheckEmptyPartialDirectory
@@ -1,80 +1,96 @@
int PrjfOpenAndCheckEmptyPartialDirectory
(longlong param_1,longlong param_2,wchar_t *param_3,undefined8 param_4,
undefined1 *param_5)
{
int extraout_EAX;
int extraout_EAX_00;
- byte bVar1;
- int iVar2;
+ int extraout_EAX_01;
+ ulonglong uVar1;
+ byte bVar2;
undefined8 uVar3;
- bool bVar4;
- undefined8 in_stack_ffffffffffffff98;
- ushort uVar5;
- undefined4 uVar6;
- undefined8 uVar7;
- undefined4 uVar8;
- byte local_28;
- undefined1 local_27 [7];
- longlong local_20;
- longlong local_18 [2];
+ int iVar4;
+ bool bVar5;
+ undefined8 in_stack_ffffffffffffff78;
+ ushort uVar6;
+ undefined4 uVar7;
+ undefined8 uVar8;
+ undefined4 uVar9;
+ byte local_38;
+ undefined1 local_37 [7];
+ longlong local_30;
+ longlong local_28 [2];
- uVar8 = 0;
- uVar6 = 0;
- local_18[0] = 0;
- local_20 = 0;
+ local_28[0] = 0;
+ local_30 = 0;
+ local_38 = 0;
+ local_37[0] = 0;
+ uVar1 = Feature_2998397241__private_IsEnabledDeviceUsageNoInline();
uVar3 = 0x80;
- local_28 = 0;
- local_27[0] = 0;
- PrjfOpenAsReparsePoint
- (param_3,param_4,param_2,0x80,in_stack_ffffffffffffff98,(longlong)local_18,
- (longlong)&local_20,&local_28,(byte *)0x0,(byte *)0x0,(undefined8 *******)0x0,
- (uint *)0x0);
- if (extraout_EAX < 0) {
- bVar4 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
- bVar1 = DAT_0 & 0x20;
- if ((bVar1 == 0) && (iVar2 = extraout_EAX, !bVar4)) goto LAB_1;
- uVar7 = CONCAT44(uVar8,extraout_EAX);
- uVar3 = CONCAT44(uVar6,0x1491);
- uVar5 = 0x74;
- iVar2 = extraout_EAX;
- }
- else if (local_28 == 0) {
- iVar2 = -0x3ffffd8b;
- bVar4 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
- bVar1 = DAT_0 & 0x20;
- if ((bVar1 == 0) && (!bVar4)) goto LAB_1;
- uVar7 = CONCAT44(uVar8,0xc0000275);
- uVar3 = CONCAT44(uVar6,0x14a1);
- uVar5 = 0x75;
- iVar2 = -0x3ffffd8b;
+ if ((int)uVar1 == 0) {
+ uVar9 = 0;
+ uVar7 = 0;
+ iVar4 = PrjfOpenAsReparsePointOld
+ (param_3,param_4,param_2,0x80,in_stack_ffffffffffffff78,(longlong)local_28,
+ (longlong)&local_30,&local_38,(byte *)0x0,(byte *)0x0,(undefined8 *******)0x0
+ ,(uint *)0x0);
+ bVar2 = (byte)iVar4;
+ iVar4 = extraout_EAX_00;
}
else {
- PrjfIsDirectoryEmpty(param_1,param_2,local_20,uVar3,local_27);
- iVar2 = extraout_EAX_00;
- if (-1 < extraout_EAX_00) {
- *param_5 = local_27[0];
+ uVar9 = 0;
+ uVar7 = 0;
+ iVar4 = PrjfOpenAsReparsePoint
+ (param_3,param_4,param_2,0x80,in_stack_ffffffffffffff78,(longlong)local_28,
+ (longlong)&local_30,&local_38,(byte *)0x0,(byte *)0x0,(undefined8 *******)0x0
+ ,(uint *)0x0,0);
+ bVar2 = (byte)iVar4;
+ iVar4 = extraout_EAX;
+ }
+ if (iVar4 < 0) {
+ bVar5 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar2 = DAT_0 & 0x20;
+ if ((bVar2 == 0) && (!bVar5)) goto LAB_1;
+ uVar8 = CONCAT44(uVar9,iVar4);
+ uVar3 = CONCAT44(uVar7,0x165b);
+ uVar6 = 0x7d;
+ }
+ else if (local_38 == bVar2) {
+ iVar4 = -0x3ffffd8b;
+ bVar5 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar2 = DAT_0 & 0x20;
+ if ((bVar2 == 0) && (!bVar5)) goto LAB_1;
+ uVar8 = CONCAT44(uVar9,0xc0000275);
+ uVar3 = CONCAT44(uVar7,0x166b);
+ uVar6 = 0x7e;
+ iVar4 = -0x3ffffd8b;
+ }
+ else {
+ PrjfIsDirectoryEmpty(param_1,param_2,local_30,uVar3,local_37);
+ iVar4 = extraout_EAX_01;
+ if (-1 < extraout_EAX_01) {
+ *param_5 = local_37[0];
goto LAB_1;
}
- bVar4 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
- bVar1 = DAT_0 & 0x20;
- if ((bVar1 == 0) && (!bVar4)) goto LAB_1;
- uVar7 = CONCAT44(uVar8,extraout_EAX_00);
- uVar3 = CONCAT44(uVar6,0x14b1);
- uVar5 = 0x76;
+ bVar5 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar2 = DAT_0 & 0x20;
+ if ((bVar2 == 0) && (!bVar5)) goto LAB_1;
+ uVar8 = CONCAT44(uVar9,extraout_EAX_01);
+ uVar3 = CONCAT44(uVar7,0x167b);
+ uVar6 = 0x7f;
}
WPP_RECORDER_AND_TRACE_SF_sDdZ
- (0x20d,bVar1,bVar4,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xd,uVar5,
- &WPP_20e7495dfd7e3f36bcabba5500ea3aac_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",uVar3,uVar7,param_3);
+ (0x20d,bVar2,bVar5,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xd,uVar6,
+ &WPP_7785e5eeecf6357514fa74506e9ad78e_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",uVar3,uVar8,param_3);
LAB_1:
- if (local_18[0] != 0) {
+ if (local_28[0] != 0) {
FltClose();
}
- if (local_20 != 0) {
+ if (local_30 != 0) {
ObfDereferenceObject();
}
- return iVar2;
+ return iVar4;
}
```
## PrjfProcessFileDirectoryStatus
### Match Info
|Key|pf_8737.sys - pf_8875.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.65|
|i_ratio|0.46|
|m_ratio|0.91|
|b_ratio|0.82|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pf_8737.sys|pf_8875.sys|
| :---: | :---: | :---: |
|name|PrjfProcessFileDirectoryStatus|PrjfProcessFileDirectoryStatus|
|fullname|PrjfProcessFileDirectoryStatus|PrjfProcessFileDirectoryStatus|
|refcount|2|2|
|`length`|416|478|
|`called`|FLTMGR.SYS::FltClose
FLTMGR.SYS::FltParseFileNameInformation
NTOSKRNL.EXE::ObfDereferenceObject
PrjfOpenAsReparsePoint
WPP_RECORDER_AND_TRACE_SF_sDD|FLTMGR.SYS::FltClose
FLTMGR.SYS::FltParseFileNameInformation
Feature_2998397241__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ObfDereferenceObject
PrjfOpenAsReparsePoint
PrjfOpenAsReparsePointOld
WPP_RECORDER_AND_TRACE_SF_sDD|
|calling|PrjfPostCreate|PrjfPostCreate|
|paramcount|3|3|
|`address`|140043704|140044294|
|sig|int __fastcall PrjfProcessFileDirectoryStatus(longlong param_1, longlong param_2, longlong param_3)|int __fastcall PrjfProcessFileDirectoryStatus(longlong param_1, longlong param_2, longlong param_3)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfProcessFileDirectoryStatus Called Diff
```diff
--- PrjfProcessFileDirectoryStatus called
+++ PrjfProcessFileDirectoryStatus called
@@ -2,0 +3 @@
+Feature_2998397241__private_IsEnabledDeviceUsageNoInline
@@ -4,0 +6 @@
+PrjfOpenAsReparsePointOld
```
### PrjfProcessFileDirectoryStatus Diff
```diff
--- PrjfProcessFileDirectoryStatus
+++ PrjfProcessFileDirectoryStatus
@@ -1,59 +1,73 @@
int PrjfProcessFileDirectoryStatus(longlong param_1,longlong param_2,longlong param_3)
{
int iVar1;
int extraout_EAX;
+ int extraout_EAX_00;
+ int iVar2;
+ ulonglong uVar3;
+ wchar_t *pwVar4;
char local_res8 [8];
longlong local_res20;
- undefined1 in_stack_ffffffffffffff98;
- undefined7 in_stack_ffffffffffffff99;
- longlong local_28 [2];
+ undefined1 in_stack_ffffffffffffff78;
+ undefined7 in_stack_ffffffffffffff79;
+ longlong local_38 [2];
+ iVar1 = *(int *)(param_1 + 0x18);
local_res20 = 0;
- local_28[0] = 0;
+ local_38[0] = 0;
local_res8[0] = '\0';
- iVar1 = *(int *)(param_1 + 0x18);
if ((((iVar1 == -0x3fffff46) || (iVar1 == -0x3ffffefd)) ||
((iVar1 == -0x3fffffcb && (*(char *)(*(longlong *)(param_1 + 0x10) + 0x23) == '\x02')))) &&
((*(uint *)(*(longlong *)(param_1 + 0x10) + 0x20) & 0x2000) == 0)) {
iVar1 = FltParseFileNameInformation(*(undefined8 *)(param_3 + 0x30));
if (iVar1 < 0) {
if (((DAT_0 & 8) != 0) ||
((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
WPP_RECORDER_AND_TRACE_SF_sDD
(0x213,DAT_0 & 8,
(undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x13,0x20,
- &WPP_72817d06a04c3905e527c1052e2dfcc5_Traceguids,
+ &WPP_909d345ffcfd3abf7500768e0378e777_Traceguids,
"onecore\\base\\fs\\gvflt\\filter\\sys\\tombstone.c");
}
}
else {
- PrjfOpenAsReparsePoint
- ((wchar_t *)(*(longlong *)(param_3 + 0x30) + 8),0,*(undefined8 *)(param_2 + 0x18),
- 0x80,CONCAT71(in_stack_ffffffffffffff99,in_stack_ffffffffffffff98),
- (longlong)&local_res20,(longlong)local_28,(byte *)0x0,(byte *)0x0,(byte *)0x0,
- (undefined8 *******)local_res8,(uint *)0x0);
- if ((extraout_EAX < 0) || (local_res8[0] == '\0')) {
- iVar1 = 0;
+ uVar3 = Feature_2998397241__private_IsEnabledDeviceUsageNoInline();
+ pwVar4 = (wchar_t *)(*(longlong *)(param_3 + 0x30) + 8);
+ if ((int)uVar3 == 0) {
+ iVar1 = PrjfOpenAsReparsePointOld
+ (pwVar4,0,*(undefined8 *)(param_2 + 0x18),0x80,
+ CONCAT71(in_stack_ffffffffffffff79,in_stack_ffffffffffffff78),
+ (longlong)&local_res20,(longlong)local_38,(byte *)0x0,(byte *)0x0,
+ (byte *)0x0,(undefined8 *******)local_res8,(uint *)0x0);
+ iVar2 = extraout_EAX_00;
}
else {
+ iVar1 = PrjfOpenAsReparsePoint
+ (pwVar4,0,*(undefined8 *)(param_2 + 0x18),0x80,
+ CONCAT71(in_stack_ffffffffffffff79,in_stack_ffffffffffffff78),
+ (longlong)&local_res20,(longlong)local_38,(byte *)0x0,(byte *)0x0,
+ (byte *)0x0,(undefined8 *******)local_res8,(uint *)0x0,0);
+ iVar2 = extraout_EAX;
+ }
+ if ((-1 < iVar2) && (local_res8[0] != (char)iVar1)) {
*(undefined4 *)(param_1 + 0x18) = 0x104;
*(undefined8 *)(param_1 + 0x20) = 0xa0000022;
- iVar1 = extraout_EAX;
+ iVar1 = iVar2;
}
}
if (local_res20 != 0) {
FltClose();
}
- if (local_28[0] != 0) {
+ if (local_38[0] != 0) {
ObfDereferenceObject();
}
}
else {
iVar1 = 0;
}
return iVar1;
}
```
## PrjfOpenAsReparsePoint
### Match Info
|Key|pf_8737.sys - pf_8875.sys|
| :---: | :---: |
|diff_type|code,length,sig,address|
|ratio|0.95|
|i_ratio|0.84|
|m_ratio|0.99|
|b_ratio|0.99|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pf_8737.sys|pf_8875.sys|
| :---: | :---: | :---: |
|name|PrjfOpenAsReparsePoint|PrjfOpenAsReparsePoint|
|fullname|PrjfOpenAsReparsePoint|PrjfOpenAsReparsePoint|
|refcount|7|7|
|`length`|1560|1585|
|called|FLTMGR.SYS::FltGetInstanceContext
FLTMGR.SYS::FltReleaseContext
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExAllocateFromPagedLookasideList
NTOSKRNL.EXE::ExFreeToPagedLookasideList
PrjfOpenReparsePoint
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDdZssss|FLTMGR.SYS::FltGetInstanceContext
FLTMGR.SYS::FltReleaseContext
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExAllocateFromPagedLookasideList
NTOSKRNL.EXE::ExFreeToPagedLookasideList
PrjfOpenReparsePoint
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDdZssss|
|calling|PrjfDecideUpdateDeleteOnFileStateAndUpdateFlags
PrjfDeleteTombstoneIfExists
PrjfOpenAndCheckEmptyPartialDirectory
PrjfPostCreate
PrjfProcessFileDirectoryStatus
PrjfProcessTombstoneBounce|PrjfDecideUpdateDeleteOnFileStateAndUpdateFlags
PrjfDeleteTombstoneIfExists
PrjfOpenAndCheckEmptyPartialDirectory
PrjfPostCreate
PrjfProcessFileDirectoryStatus
PrjfProcessTombstoneBounce|
|paramcount|12|13|
|`address`|14003c800|14003c860|
|`sig`|int __fastcall PrjfOpenAsReparsePoint(wchar_t * param_1, undefined8 param_2, undefined8 param_3, undefined4 param_4, undefined8 param_5, longlong param_6, longlong param_7, byte * param_8, byte * param_9, byte * param_10, undefined8 * * * * * * * param_11, uint * param_12)|int __fastcall PrjfOpenAsReparsePoint(wchar_t * param_1, undefined8 param_2, undefined8 param_3, undefined4 param_4, undefined8 param_5, longlong param_6, longlong param_7, byte * param_8, byte * param_9, byte * param_10, undefined8 * * * * * * * param_11, uint * param_12, undefined4 param_13)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfOpenAsReparsePoint Diff
```diff
--- PrjfOpenAsReparsePoint
+++ PrjfOpenAsReparsePoint
@@ -1,274 +1,280 @@
int PrjfOpenAsReparsePoint
(wchar_t *param_1,undefined8 param_2,undefined8 param_3,undefined4 param_4,
undefined8 param_5,longlong param_6,longlong param_7,byte *param_8,byte *param_9,
- byte *param_10,undefined8 *******param_11,uint *param_12)
+ byte *param_10,undefined8 *******param_11,uint *param_12,undefined4 param_13)
{
undefined8 uVar1;
code *pcVar2;
int iVar3;
undefined8 ********ppppppppuVar4;
undefined8 ********ppppppppuVar5;
undefined8 ********ppppppppuVar6;
undefined8 ********ppppppppuVar7;
ulonglong uVar8;
char *pcVar9;
undefined8 ********ppppppppuVar10;
undefined1 *puVar11;
undefined1 *puVar12;
undefined1 *puVar13;
char *pcVar14;
byte bVar15;
char *pcVar16;
undefined8 ********ppppppppuVar17;
byte *unaff_R13;
undefined8 ********ppppppppuVar18;
uint uVar19;
bool bVar20;
undefined1 auStackY_e8 [8];
undefined1 auStackY_e0 [24];
ushort uVar21;
longlong local_68;
undefined8 *******local_60;
undefined8 *******local_58;
puVar11 = auStackY_e8;
puVar12 = auStackY_e8;
ppppppppuVar17 = (undefined8 ********)0x0;
uVar19 = 0x80000004;
local_68 = 0;
ppppppppuVar18 = (undefined8 ********)0x0;
ppppppppuVar10 = (undefined8 ********)0x0;
puVar13 = auStackY_e8;
if ((param_6 == 0) || (puVar13 = auStackY_e8, param_7 == 0)) goto LAB_0;
iVar3 = FltGetInstanceContext(param_3,&local_68);
if ((iVar3 < 0) || (local_68 == 0)) {
MicrosoftTelemetryAssertTriggeredNoArgsKM();
}
if ((*(int *)(local_68 + 0x18) != 2) && (*(int *)(local_68 + 0x18) != 0x1c)) {
MicrosoftTelemetryAssertTriggeredNoArgsKM();
}
if (param_12 != (uint *)0x0) {
uVar19 = *param_12;
}
local_58 = &local_60;
local_60 = &local_60;
ppppppppuVar4 = ppppppppuVar17;
ppppppppuVar7 = ppppppppuVar17;
ppppppppuVar5 = ppppppppuVar17;
ppppppppuVar6 = ppppppppuVar17;
if (param_8 == (byte *)0x0) {
LAB_1:
uVar19 = uVar19 | 0x80000000;
ppppppppuVar7 = ppppppppuVar10;
if (param_9 != (byte *)0x0) {
*param_9 = 0;
ppppppppuVar5 = (undefined8 ********)ExAllocateFromPagedLookasideList(&DAT_2);
ppppppppuVar6 = ppppppppuVar18;
if (ppppppppuVar5 == (undefined8 ********)0x0) {
bVar20 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
bVar15 = DAT_3 & 4;
if ((bVar15 != 0) || (puVar12 = auStackY_e8, bVar20)) {
uVar21 = 0x33;
goto LAB_4;
}
goto LAB_5;
}
ppppppppuVar5[1] = ppppppppuVar5;
*ppppppppuVar5 = ppppppppuVar5;
ppppppppuVar5[3] = (undefined8 *******)0x0;
ppppppppuVar5[4] = (undefined8 *******)0x0;
*(undefined4 *)(ppppppppuVar5 + 2) = 0xa000000c;
*(uint *)((longlong)ppppppppuVar5 + 0x14) = uVar19;
*(undefined4 *)(ppppppppuVar5 + 5) = 0x30;
if ((undefined8 ********)*local_58 != &local_60) goto LAB_6;
ppppppppuVar5[1] = local_58;
*ppppppppuVar5 = &local_60;
*local_58 = ppppppppuVar5;
local_58 = ppppppppuVar5;
}
ppppppppuVar6 = ppppppppuVar17;
unaff_R13 = param_10;
if (param_10 != (byte *)0x0) {
*param_10 = 0;
ppppppppuVar6 = (undefined8 ********)ExAllocateFromPagedLookasideList(&DAT_2);
if (ppppppppuVar6 == (undefined8 ********)0x0) {
bVar20 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
bVar15 = DAT_3 & 4;
if ((bVar15 != 0) || (puVar12 = auStackY_e8, bVar20)) {
uVar21 = 0x34;
goto LAB_4;
}
goto LAB_5;
}
ppppppppuVar6[1] = ppppppppuVar6;
*ppppppppuVar6 = ppppppppuVar6;
ppppppppuVar6[3] = (undefined8 *******)0x0;
ppppppppuVar6[4] = (undefined8 *******)0x0;
*(undefined4 *)(ppppppppuVar6 + 2) = 0xa0000003;
*(uint *)((longlong)ppppppppuVar6 + 0x14) = uVar19;
*(undefined4 *)(ppppppppuVar6 + 5) = 0x30;
if ((undefined8 ********)*local_58 != &local_60) goto LAB_6;
ppppppppuVar6[1] = local_58;
*ppppppppuVar6 = &local_60;
*local_58 = ppppppppuVar6;
local_58 = ppppppppuVar6;
}
ppppppppuVar7 = ppppppppuVar17;
puVar13 = auStackY_e8;
if (param_11 == (undefined8 *******)0x0) {
LAB_7:
puVar12 = puVar13;
+ *(undefined4 *)(puVar12 + 0x48) = param_13;
*(longlong *)(puVar12 + 0x40) = param_7;
*(longlong *)(puVar12 + 0x38) = param_6;
*(undefined8 *********)(puVar12 + 0x30) = &local_60;
*(undefined4 *)(puVar12 + 0x20) = 0x28;
- *(undefined8 *)(puVar12 + -8) = 0x14003cc69;
+ *(undefined8 *)(puVar12 + -8) = 0x14003ccd3;
uVar8 = PrjfOpenReparsePoint
(param_3,param_1,param_2,param_4,*(undefined4 *)(puVar12 + 0x20),
*(undefined8 *)(puVar12 + 0x28),*(longlong **)(puVar12 + 0x30),
- *(undefined8 *)(puVar12 + 0x38),*(undefined8 *)(puVar12 + 0x40));
+ *(undefined8 *)(puVar12 + 0x38),*(undefined8 *)(puVar12 + 0x40),
+ *(uint *)(puVar12 + 0x48));
iVar3 = (int)uVar8;
if (iVar3 < 0) {
if ((iVar3 != -0x3fffffcc) && (iVar3 != -0x3fffffc6)) {
if (((DAT_3 & 4) != 0) ||
((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
pcVar16 = "did";
pcVar14 = "did";
if ((undefined8 ********)param_11 == (undefined8 ********)0x0) {
pcVar14 = "did NOT";
}
pcVar9 = "did";
*(char **)(puVar12 + 0x78) = pcVar14;
if (param_10 == (byte *)0x0) {
pcVar9 = "did NOT";
}
*(char **)(puVar12 + 0x70) = pcVar9;
uVar1 = *(undefined8 *)(WPP_GLOBAL_Control + 0x40);
if (param_9 == (byte *)0x0) {
pcVar16 = "did NOT";
}
pcVar14 = "Did";
*(char **)(puVar12 + 0x68) = pcVar16;
if (param_8 == (byte *)0x0) {
pcVar14 = "Did NOT";
}
*(char **)(puVar12 + 0x60) = pcVar14;
*(wchar_t **)(puVar12 + 0x58) = param_1;
*(int *)(puVar12 + 0x50) = iVar3;
- *(undefined8 *)(puVar12 + -8) = 0x14003cd30;
+ *(undefined4 *)(puVar12 + 0x48) = 0x86c;
+ *(undefined2 *)(puVar12 + 0x30) = 0x36;
+ *(undefined8 *)(puVar12 + -8) = 0x14003cda9;
WPP_RECORDER_AND_TRACE_SF_sDdZssss
(pcVar9,DAT_3 & 4,
- (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,uVar1);
+ (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,uVar1,
+ *(undefined8 *)(puVar12 + 0x20),*(undefined8 *)(puVar12 + 0x28),
+ *(ushort *)(puVar12 + 0x30));
}
}
}
else {
if (param_8 != (byte *)0x0) {
*param_8 = *(byte *)((longlong)ppppppppuVar4 + 0x14) & 1;
}
if (param_9 != (byte *)0x0) {
*param_9 = *(byte *)((longlong)ppppppppuVar5 + 0x14) & 1;
}
if (param_10 != (byte *)0x0) {
*param_10 = *(byte *)((longlong)ppppppppuVar6 + 0x14) & 1;
}
if ((undefined8 ********)param_11 != (undefined8 ********)0x0) {
*(byte *)param_11 = *(byte *)((longlong)ppppppppuVar7 + 0x14) & 1;
}
}
}
else {
*(undefined1 *)param_11 = 0;
ppppppppuVar7 = (undefined8 ********)ExAllocateFromPagedLookasideList(&DAT_2);
if (ppppppppuVar7 != (undefined8 ********)0x0) {
ppppppppuVar7[1] = ppppppppuVar7;
*ppppppppuVar7 = ppppppppuVar7;
ppppppppuVar7[3] = (undefined8 *******)0x0;
ppppppppuVar7[4] = (undefined8 *******)0x0;
*(undefined4 *)(ppppppppuVar7 + 2) = 0xa0000022;
*(uint *)((longlong)ppppppppuVar7 + 0x14) = uVar19;
*(undefined4 *)(ppppppppuVar7 + 5) = 0x30;
ppppppppuVar17 = (undefined8 ********)param_11;
if ((undefined8 ********)*local_58 != &local_60) goto LAB_6;
goto LAB_8;
}
bVar20 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
bVar15 = DAT_3 & 4;
if ((bVar15 != 0) || (bVar20)) {
uVar21 = 0x35;
goto LAB_4;
}
}
}
else {
*param_8 = 0;
ppppppppuVar4 = (undefined8 ********)ExAllocateFromPagedLookasideList(&DAT_2);
if (ppppppppuVar4 != (undefined8 ********)0x0) {
ppppppppuVar4[1] = ppppppppuVar4;
*ppppppppuVar4 = ppppppppuVar4;
ppppppppuVar4[3] = (undefined8 *******)0x0;
ppppppppuVar4[4] = (undefined8 *******)0x0;
*(undefined4 *)(ppppppppuVar4 + 2) = 0x9000001c;
*(uint *)((longlong)ppppppppuVar4 + 0x14) = uVar19 | 0x80000000;
*(undefined4 *)(ppppppppuVar4 + 5) = 0x30;
if ((undefined8 ********)*local_58 == &local_60) {
ppppppppuVar4[1] = local_58;
*ppppppppuVar4 = &local_60;
*local_58 = ppppppppuVar4;
local_58 = ppppppppuVar4;
goto LAB_1;
}
LAB_6:
pcVar2 = (code *)swi(0x29);
local_58 = (undefined8 *******)(*pcVar2)(3);
puVar11 = auStackY_e0;
param_11 = ppppppppuVar17;
param_10 = unaff_R13;
LAB_8:
ppppppppuVar7[1] = local_58;
*ppppppppuVar7 = &local_60;
*local_58 = ppppppppuVar7;
local_58 = ppppppppuVar7;
puVar13 = puVar11;
goto LAB_7;
}
bVar20 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
bVar15 = DAT_3 & 4;
if ((bVar15 != 0) || (puVar12 = auStackY_e8, bVar20)) {
uVar21 = 0x32;
LAB_4:
WPP_RECORDER_AND_TRACE_SF_sDD
(0x20a,bVar15,bVar20,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,10,uVar21,
- &WPP_20e7495dfd7e3f36bcabba5500ea3aac_Traceguids,
+ &WPP_7785e5eeecf6357514fa74506e9ad78e_Traceguids,
"onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
puVar12 = auStackY_e8;
}
}
LAB_5:
if (local_68 != 0) {
- *(undefined8 *)(puVar12 + -8) = 0x14003cd89;
+ *(undefined8 *)(puVar12 + -8) = 0x14003ce02;
FltReleaseContext();
}
if (ppppppppuVar4 != (undefined8 ********)0x0) {
- *(undefined8 *)(puVar12 + -8) = 0x14003cda4;
+ *(undefined8 *)(puVar12 + -8) = 0x14003ce1d;
ExFreeToPagedLookasideList(&DAT_2,ppppppppuVar4);
}
if (ppppppppuVar5 != (undefined8 ********)0x0) {
- *(undefined8 *)(puVar12 + -8) = 0x14003cdbf;
+ *(undefined8 *)(puVar12 + -8) = 0x14003ce38;
ExFreeToPagedLookasideList(&DAT_2,ppppppppuVar5);
}
if (ppppppppuVar6 != (undefined8 ********)0x0) {
- *(undefined8 *)(puVar12 + -8) = 0x14003cdda;
+ *(undefined8 *)(puVar12 + -8) = 0x14003ce53;
ExFreeToPagedLookasideList(&DAT_2,ppppppppuVar6);
}
puVar13 = puVar12;
if (ppppppppuVar7 != (undefined8 ********)0x0) {
- *(undefined8 *)(puVar12 + -8) = 0x14003cdf5;
+ *(undefined8 *)(puVar12 + -8) = 0x14003ce6e;
ExFreeToPagedLookasideList(&DAT_2,ppppppppuVar7);
}
LAB_0:
return (int)*(undefined8 *)(puVar13 + 0xa8);
}
```
## PrjfDeleteTombstoneIfExists
### Match Info
|Key|pf_8737.sys - pf_8875.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.51|
|i_ratio|0.51|
|m_ratio|0.97|
|b_ratio|0.91|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pf_8737.sys|pf_8875.sys|
| :---: | :---: | :---: |
|name|PrjfDeleteTombstoneIfExists|PrjfDeleteTombstoneIfExists|
|fullname|PrjfDeleteTombstoneIfExists|PrjfDeleteTombstoneIfExists|
|refcount|4|4|
|`length`|1062|1126|
|`called`|Expand for full list:
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltQueryInformationFile
FLTMGR.SYS::FltReleaseContext
FLTMGR.SYS::FltSetInformationFile
NTOSKRNL.EXE::ObfDereferenceObject
PrjfAddInMemoryTombstone
PrjfGetSetFileContext
PrjfOpenAsReparsePoint
PrjfTelemetryTombstoneFailureOperation
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDdZ
WPP_RECORDER_AND_TRACE_SF_sDqd
__security_check_cookieExpand for full list:
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltQueryInformationFile
FLTMGR.SYS::FltReleaseContext
FLTMGR.SYS::FltSetInformationFile
Feature_2998397241__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ObfDereferenceObject
PrjfAddInMemoryTombstone
PrjfGetSetFileContext
PrjfOpenAsReparsePoint
PrjfOpenAsReparsePointOld
PrjfTelemetryTombstoneFailureOperation
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDdZ
WPP_RECORDER_AND_TRACE_SF_sDqd
__security_check_cookie
PrjfPrepareDestinationForRenameOrLink
PrjfRemoveTombstonesFromDirectory|PrjfPopulateDestinationForRenameOrLink
PrjfPrepareDestinationForRenameOrLink
PrjfRemoveTombstonesFromDirectory|
|paramcount|4|4|
|`address`|14004305c|140043bac|
|sig|undefined4 * __fastcall PrjfDeleteTombstoneIfExists(undefined8 param_1, longlong param_2, undefined8 param_3, wchar_t * param_4)|undefined4 * __fastcall PrjfDeleteTombstoneIfExists(undefined8 param_1, longlong param_2, undefined8 param_3, wchar_t * param_4)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfDeleteTombstoneIfExists Called Diff
```diff
--- PrjfDeleteTombstoneIfExists called
+++ PrjfDeleteTombstoneIfExists called
@@ -4,0 +5 @@
+Feature_2998397241__private_IsEnabledDeviceUsageNoInline
@@ -8,0 +10 @@
+PrjfOpenAsReparsePointOld
```
### PrjfDeleteTombstoneIfExists Diff
```diff
--- PrjfDeleteTombstoneIfExists
+++ PrjfDeleteTombstoneIfExists
@@ -1,134 +1,149 @@
/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
/* WARNING: Type propagation algorithm not settling */
undefined4 *
PrjfDeleteTombstoneIfExists(undefined8 param_1,longlong param_2,undefined8 param_3,wchar_t *param_4)
{
uint extraout_EAX;
- ulonglong uVar1;
- byte bVar2;
- undefined4 *puVar3;
- longlong *plVar4;
- uint uVar5;
- bool bVar6;
- undefined1 auStackY_e8 [32];
- undefined8 in_stack_ffffffffffffff38;
- ushort uVar7;
- undefined4 uVar8;
- undefined8 *******pppppppuVar9;
+ uint extraout_EAX_00;
+ uint uVar1;
+ ulonglong uVar2;
+ byte bVar3;
+ undefined4 *puVar4;
+ longlong *plVar5;
+ uint uVar6;
+ bool bVar7;
+ undefined1 auStackY_f8 [32];
+ undefined8 in_stack_ffffffffffffff28;
+ ushort uVar8;
+ undefined4 uVar9;
+ undefined8 *******pppppppuVar10;
+ undefined4 uVar11;
char local_88 [8];
longlong local_80;
undefined4 local_78;
longlong local_70;
longlong local_68 [3];
undefined1 uStack_4b;
undefined8 local_50;
ulonglong local_48;
- undefined4 uVar10;
- local_48 = __security_cookie ^ (ulonglong)auStackY_e8;
+ local_48 = __security_cookie ^ (ulonglong)auStackY_f8;
+ local_70 = 0;
local_50 = 0;
- local_68[0] = 0;
- pppppppuVar9 = (undefined8 *******)local_88;
local_80 = 0;
- uVar8 = 0;
local_88[0] = '\0';
local_88[1] = 0;
local_68[1] = 0;
local_68[2] = 0;
- local_70 = 0;
+ local_68[0] = 0;
local_78 = 0;
- uVar5 = PrjfOpenAsReparsePoint
- (param_4,param_3,param_1,0x10080,in_stack_ffffffffffffff38,(longlong)local_68,
- (longlong)&local_80,(byte *)0x0,(byte *)0x0,(byte *)0x0,pppppppuVar9,
- (uint *)0x0);
- uVar10 = (undefined4)((ulonglong)pppppppuVar9 >> 0x20);
- puVar3 = (undefined4 *)(ulonglong)uVar5;
- if ((extraout_EAX == 0xc0000034) || (local_88[0] == (char)uVar5)) goto LAB_0;
- if ((int)extraout_EAX < 0) {
- bVar6 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
- bVar2 = DAT_1 & 8;
- puVar3 = (undefined4 *)(ulonglong)extraout_EAX;
- if ((bVar2 == 0) && (!bVar6)) goto LAB_0;
- uVar7 = 0xe;
+ uVar2 = Feature_2998397241__private_IsEnabledDeviceUsageNoInline();
+ pppppppuVar10 = (undefined8 *******)local_88;
+ if ((int)uVar2 == 0) {
+ uVar9 = 0;
+ uVar6 = PrjfOpenAsReparsePointOld
+ (param_4,param_3,param_1,0x10080,in_stack_ffffffffffffff28,(longlong)&local_70
+ ,(longlong)&local_80,(byte *)0x0,(byte *)0x0,(byte *)0x0,pppppppuVar10,
+ (uint *)0x0);
+ uVar11 = (undefined4)((ulonglong)pppppppuVar10 >> 0x20);
+ uVar1 = extraout_EAX_00;
}
else {
- uVar1 = PrjfGetSetFileContext
- (param_1,local_80,'\x01',(longlong *)0x0,puVar3,(undefined2 *)puVar3,
- (undefined1 *)puVar3,&local_70);
- puVar3 = (undefined4 *)(uVar1 & 0xffffffff);
- if ((int)uVar1 < 0) {
+ uVar9 = 0;
+ uVar6 = PrjfOpenAsReparsePoint
+ (param_4,param_3,param_1,0x10080,in_stack_ffffffffffffff28,(longlong)&local_70
+ ,(longlong)&local_80,(byte *)0x0,(byte *)0x0,(byte *)0x0,pppppppuVar10,
+ (uint *)0x0,0);
+ uVar11 = (undefined4)((ulonglong)pppppppuVar10 >> 0x20);
+ uVar1 = extraout_EAX;
+ }
+ puVar4 = (undefined4 *)(ulonglong)uVar6;
+ if ((uVar1 == 0xc0000034) || (local_88[0] == (char)uVar6)) goto LAB_0;
+ if ((int)uVar1 < 0) {
+ bVar7 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar3 = DAT_1 & 8;
+ puVar4 = (undefined4 *)(ulonglong)uVar1;
+ if ((bVar3 == 0) && (!bVar7)) goto LAB_0;
+ uVar8 = 0xe;
+ }
+ else {
+ uVar2 = PrjfGetSetFileContext
+ (param_1,local_80,'\x01',(longlong *)0x0,puVar4,(undefined2 *)puVar4,
+ (undefined1 *)puVar4,local_68);
+ puVar4 = (undefined4 *)(uVar2 & 0xffffffff);
+ if ((int)uVar2 < 0) {
if (((DAT_1 & 8) != 0) ||
((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
WPP_RECORDER_AND_TRACE_SF_sDdZ
(0x213,DAT_1 & 8,
(undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x13,0xf,
- &WPP_72817d06a04c3905e527c1052e2dfcc5_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\tombstone.c",CONCAT44(uVar8,0x1e9),
- CONCAT44(uVar10,(int)uVar1),(wchar_t *)(local_80 + 0x58));
+ &WPP_909d345ffcfd3abf7500768e0378e777_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\tombstone.c",CONCAT44(uVar9,0x1fd),
+ CONCAT44(uVar11,(int)uVar2),(wchar_t *)(local_80 + 0x58));
}
goto LAB_0;
}
- plVar4 = local_68 + 1;
- uVar5 = FltQueryInformationFile(param_1,local_80,plVar4);
- puVar3 = (undefined4 *)(ulonglong)uVar5;
- if (-1 < (int)uVar5) {
+ plVar5 = local_68 + 1;
+ uVar1 = FltQueryInformationFile(param_1,local_80,plVar5);
+ puVar4 = (undefined4 *)(ulonglong)uVar1;
+ if (-1 < (int)uVar1) {
uVar1 = PrjfAddInMemoryTombstone
(param_1,(longlong)param_4,
- CONCAT71((int7)((ulonglong)plVar4 >> 8),uStack_4b),0,param_2,&local_70);
- puVar3 = (undefined4 *)(uVar1 & 0xffffffff);
+ CONCAT71((int7)((ulonglong)plVar5 >> 8),uStack_4b),0,param_2,local_68);
+ puVar4 = (undefined4 *)(ulonglong)uVar1;
if ((int)uVar1 < 0) {
if (((DAT_1 & 8) != 0) ||
((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
WPP_RECORDER_AND_TRACE_SF_sDD
(0x213,DAT_1 & 8,
(undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x13,0x11,
- &WPP_72817d06a04c3905e527c1052e2dfcc5_Traceguids,
+ &WPP_909d345ffcfd3abf7500768e0378e777_Traceguids,
"onecore\\base\\fs\\gvflt\\filter\\sys\\tombstone.c");
}
- PrjfTelemetryTombstoneFailureOperation(3,3,(int)uVar1);
+ PrjfTelemetryTombstoneFailureOperation(3,3,uVar1);
}
else {
local_88[1] = 1;
- uVar5 = FltSetInformationFile(param_1,local_80,local_88 + 1,1);
- puVar3 = (undefined4 *)(ulonglong)uVar5;
- if ((int)uVar5 < 0) {
+ uVar1 = FltSetInformationFile(param_1,local_80,local_88 + 1,1);
+ puVar4 = (undefined4 *)(ulonglong)uVar1;
+ if ((int)uVar1 < 0) {
if (((DAT_1 & 8) != 0) ||
((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
WPP_RECORDER_AND_TRACE_SF_sDqd
(0x213,DAT_1 & 8,
(undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x13,0x12,
- &WPP_72817d06a04c3905e527c1052e2dfcc5_Traceguids,
+ &WPP_909d345ffcfd3abf7500768e0378e777_Traceguids,
"onecore\\base\\fs\\gvflt\\filter\\sys\\tombstone.c");
}
}
}
goto LAB_0;
}
- bVar6 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
- bVar2 = DAT_1 & 8;
- if ((bVar2 == 0) && (!bVar6)) goto LAB_0;
- uVar7 = 0x10;
+ bVar7 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
+ bVar3 = DAT_1 & 8;
+ if ((bVar3 == 0) && (!bVar7)) goto LAB_0;
+ uVar8 = 0x10;
}
WPP_RECORDER_AND_TRACE_SF_sDD
- (0x213,bVar2,bVar6,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x13,uVar7,
- &WPP_72817d06a04c3905e527c1052e2dfcc5_Traceguids,
+ (0x213,bVar3,bVar7,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0x13,uVar8,
+ &WPP_909d345ffcfd3abf7500768e0378e777_Traceguids,
"onecore\\base\\fs\\gvflt\\filter\\sys\\tombstone.c");
LAB_0:
- if (local_68[0] != 0) {
+ if (local_70 != 0) {
FltClose();
}
if (local_80 != 0) {
ObfDereferenceObject();
}
- if (local_70 != 0) {
+ if (local_68[0] != 0) {
FltReleaseContext();
}
- return puVar3;
+ return puVar4;
}
```
## PrjfPostCreate
### Match Info
|Key|pf_8737.sys - pf_8875.sys|
| :---: | :---: |
|diff_type|code,length,called|
|ratio|0.67|
|i_ratio|0.61|
|m_ratio|1.0|
|b_ratio|0.65|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pf_8737.sys|pf_8875.sys|
| :---: | :---: | :---: |
|name|PrjfPostCreate|PrjfPostCreate|
|fullname|PrjfPostCreate|PrjfPostCreate|
|refcount|3|3|
|`length`|4451|4480|
|`called`|Expand for full list:
FLTMGR.SYS::FltAcknowledgeEcp
FLTMGR.SYS::FltCancelFileOpen
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltFindExtraCreateParameter
FLTMGR.SYS::FltGetEcpListFromCallbackData
FLTMGR.SYS::FltReissueSynchronousIo
FLTMGR.SYS::FltReleaseContext
FLTMGR.SYS::FltReleaseFileNameInformation
FLTMGR.SYS::FltRemoveOpenReparseEntry
FLTMGR.SYS::FltSetCallbackDataDirty
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExFreeToPagedLookasideList
NTOSKRNL.EXE::ObfDereferenceObject
PrjfCheckAndCancelTransactedOpen
PrjfGetContextFileObject
PrjfGetSetContextFileObject
PrjfGetUnionContextByFileNameEx
PrjfOpenAsReparsePoint
PrjfProcessFileDirectoryStatus
PrjfProcessOpenWithinVirtualizationRoots
PrjfProcessPrjReparsePointBounce
PrjfProcessTombstoneBounce
PrjfReleaseUnionContext
PrjfSetDeleteDisposition
PrjfSetPlaceHolderFlagsSynchronized
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDDld
WPP_RECORDER_AND_TRACE_SF_sDZdDl
WPP_RECORDER_AND_TRACE_SF_sDdD
WPP_RECORDER_AND_TRACE_SF_sDdZ
WPP_RECORDER_AND_TRACE_SF_sDdZDl
WPP_RECORDER_AND_TRACE_SF_sDdZDlLL
WPP_RECORDER_AND_TRACE_SF_sDdZdDl
WPP_RECORDER_AND_TRACE_SF_sDqDld
WPP_RECORDER_AND_TRACE_SF_sDqdExpand for full list:
FLTMGR.SYS::FltAcknowledgeEcp
FLTMGR.SYS::FltCancelFileOpen
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltFindExtraCreateParameter
FLTMGR.SYS::FltGetEcpListFromCallbackData
FLTMGR.SYS::FltReissueSynchronousIo
FLTMGR.SYS::FltReleaseContext
FLTMGR.SYS::FltReleaseFileNameInformation
FLTMGR.SYS::FltRemoveOpenReparseEntry
FLTMGR.SYS::FltSetCallbackDataDirty
Feature_2998397241__private_IsEnabledDeviceUsageNoInline
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExFreeToPagedLookasideList
NTOSKRNL.EXE::ObfDereferenceObject
PrjfCheckAndCancelTransactedOpen
PrjfGetContextFileObject
PrjfGetSetContextFileObject
PrjfGetUnionContextByFileNameEx
PrjfOpenAsReparsePoint
PrjfOpenAsReparsePointOld
PrjfProcessFileDirectoryStatus
PrjfProcessOpenWithinVirtualizationRoots
PrjfProcessPrjReparsePointBounce
PrjfProcessTombstoneBounce
PrjfReleaseUnionContext
PrjfSetDeleteDisposition
PrjfSetPlaceHolderFlagsSynchronized
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDDld
WPP_RECORDER_AND_TRACE_SF_sDZdDl
WPP_RECORDER_AND_TRACE_SF_sDdD
WPP_RECORDER_AND_TRACE_SF_sDdZ
WPP_RECORDER_AND_TRACE_SF_sDdZDl
WPP_RECORDER_AND_TRACE_SF_sDdZDlLL
WPP_RECORDER_AND_TRACE_SF_sDdZdDl
WPP_RECORDER_AND_TRACE_SF_sDqDld
WPP_RECORDER_AND_TRACE_SF_sDqd
FLTMGR.SYS::FltAllocateExtraCreateParameterList
FLTMGR.SYS::FltCreateFileEx2
FLTMGR.SYS::FltFreeExtraCreateParameterList
FLTMGR.SYS::FltInsertExtraCreateParameter
MicrosoftTelemetryAssertTriggeredNoArgsKM
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDdZ
WPP_RECORDER_AND_TRACE_SF_sDdZP|FLTMGR.SYS::FltAllocateExtraCreateParameterFromLookasideList
FLTMGR.SYS::FltAllocateExtraCreateParameterList
FLTMGR.SYS::FltCreateFileEx2
FLTMGR.SYS::FltFreeExtraCreateParameterList
FLTMGR.SYS::FltInsertExtraCreateParameter
MicrosoftTelemetryAssertTriggeredNoArgsKM
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDdZ
WPP_RECORDER_AND_TRACE_SF_sDdZP|
|calling|PrjfOpenAsReparsePoint
PrjfOpenPlaceHolder|PrjfOpenAsReparsePoint
PrjfOpenPlaceHolder|
|paramcount|9|10|
|`address`|14003cfc4|14003d6ac|
|`sig`|ulonglong __fastcall PrjfOpenReparsePoint(undefined8 param_1, wchar_t * param_2, undefined8 param_3, undefined4 param_4, undefined4 param_5, undefined8 param_6, longlong * param_7, undefined8 param_8, undefined8 param_9)|ulonglong __fastcall PrjfOpenReparsePoint(undefined8 param_1, wchar_t * param_2, undefined8 param_3, undefined4 param_4, undefined4 param_5, undefined8 param_6, longlong * param_7, undefined8 param_8, undefined8 param_9, uint param_10)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfOpenReparsePoint Diff
```diff
--- PrjfOpenReparsePoint
+++ PrjfOpenReparsePoint
@@ -1,174 +1,178 @@
/* WARNING: Type propagation algorithm not settling */
ulonglong PrjfOpenReparsePoint
(undefined8 param_1,wchar_t *param_2,undefined8 param_3,undefined4 param_4,
undefined4 param_5,undefined8 param_6,longlong *param_7,undefined8 param_8,
- undefined8 param_9)
+ undefined8 param_9,uint param_10)
{
longlong *plVar1;
longlong lVar2;
longlong *plVar3;
code *pcVar4;
uint uVar5;
int iVar6;
ulonglong uVar7;
byte bVar8;
longlong *plVar9;
bool bVar10;
- undefined4 uVar11;
- ushort uVar12;
+ undefined4 uVar12;
+ undefined8 uVar11;
+ undefined8 *puVar13;
+ ushort uVar14;
undefined8 in_stack_ffffffffffffff18;
- uint uVar13;
+ uint uVar15;
undefined4 in_stack_ffffffffffffff24;
undefined4 in_stack_ffffffffffffff2c;
undefined8 in_stack_ffffffffffffff30;
- undefined4 uVar14;
+ undefined4 uVar16;
longlong *local_a8;
longlong local_a0 [6];
undefined8 local_70;
undefined8 uStack_68;
wchar_t *local_60;
undefined8 uStack_58;
undefined8 local_50;
ulonglong uStack_48;
undefined8 local_40;
undefined8 uStack_38;
- uVar13 = (uint)((ulonglong)in_stack_ffffffffffffff18 >> 0x20);
- uVar14 = (undefined4)((ulonglong)in_stack_ffffffffffffff30 >> 0x20);
+ uVar15 = (uint)((ulonglong)in_stack_ffffffffffffff18 >> 0x20);
+ uVar16 = (undefined4)((ulonglong)in_stack_ffffffffffffff30 >> 0x20);
local_a0[5] = local_a0[5] & 0xffffffffffff0000;
local_a8 = (longlong *)0x0;
local_a0[0] = 0;
local_50 = 0;
uStack_48 = uStack_48 & 0xffffffff00000000;
local_a0[1] = 0;
local_a0[2] = 0;
local_a0[3] = 0;
local_a0[4] = 0;
local_70 = 0;
uStack_68 = 0;
local_60 = (wchar_t *)0x0;
uStack_58 = 0;
local_40 = 0;
uStack_38 = 0;
uVar5 = FltAllocateExtraCreateParameterList(Globals,0,local_a0);
uVar7 = (ulonglong)uVar5;
if ((int)uVar5 < 0) {
bVar10 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
bVar8 = DAT_0 & 0x20;
if ((bVar8 == 0) && (!bVar10)) goto LAB_1;
- uVar12 = 0x37;
+ uVar14 = 0x3c;
}
else {
- uVar11 = 0;
+ uVar12 = 0;
uVar5 = FltAllocateExtraCreateParameterFromLookasideList
(Globals,&ECP_TYPE_OPEN_REPARSE_GUID,0x10,0,0,&DAT_2,&local_a8);
uVar7 = (ulonglong)uVar5;
if (-1 < (int)uVar5) {
local_a8[1] = (longlong)local_a8;
*local_a8 = (longlong)local_a8;
plVar9 = (longlong *)0x0;
while (plVar1 = (longlong *)*param_7, plVar1 != param_7) {
if (((longlong *)plVar1[1] != param_7) ||
(lVar2 = *plVar1, *(longlong **)(lVar2 + 8) != plVar1)) goto LAB_3;
*param_7 = lVar2;
*(longlong **)(lVar2 + 8) = param_7;
plVar3 = (longlong *)local_a8[1];
if ((longlong *)*plVar3 != local_a8) goto LAB_3;
*plVar1 = (longlong)local_a8;
plVar1[1] = (longlong)plVar3;
*plVar3 = (longlong)plVar1;
local_a8[1] = (longlong)plVar1;
if ((int)plVar1[2] == -0x5fffffde) {
plVar9 = plVar1;
}
}
iVar6 = FltInsertExtraCreateParameter(Globals,local_a0[0],local_a8);
if (iVar6 < 0) {
MicrosoftTelemetryAssertTriggeredNoArgsKM();
}
- local_a0[1] = 0x28;
local_a0[2] = local_a0[0];
local_a0[5] = 1;
+ local_a0[1] = 0x28;
+ uStack_58 = CONCAT44(uStack_58._4_4_,(param_10 & 1) << 10) | 0x240;
+ puVar13 = &local_70;
+ uVar11 = CONCAT44(uVar12,param_4);
local_a0[3] = 0;
local_a0[4] = 0;
local_70 = CONCAT44(local_70._4_4_,0x30);
- uStack_58 = CONCAT44(uStack_58._4_4_,0x240);
local_50 = 0;
uStack_48 = 0;
uStack_68 = param_3;
local_60 = param_2;
- uVar5 = FltCreateFileEx2(Globals,param_1,param_8,param_9,CONCAT44(uVar11,param_4),&local_70,
- &local_40,0,(ulonglong)uVar13 << 0x20,7,1,CONCAT44(uVar14,param_5),0,
- 0,0,local_a0 + 1);
+ uVar5 = FltCreateFileEx2(Globals,param_1,param_8,param_9,uVar11,puVar13,&local_40,0,
+ (ulonglong)uVar15 << 0x20,7,1,CONCAT44(uVar16,param_5),0,0,param_10,
+ local_a0 + 1);
uVar7 = (ulonglong)uVar5;
if ((int)uVar5 < 0) {
if (uVar5 == 0xc0000279) {
if ((plVar9 == (longlong *)0x0) || ((*(uint *)((longlong)plVar9 + 0x14) & 1) == 0)) {
if (((DAT_4 & 4) != 0) ||
((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
WPP_RECORDER_AND_TRACE_SF_sDdZP
(&WPP_RECORDER_INITIALIZED,DAT_4 & 4,
(undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
- *(undefined8 *)(WPP_GLOBAL_Control + 0x40));
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),uVar11,puVar13,0x3f);
}
}
else {
uVar7 = 0xc0000281;
if (((DAT_5 & 4) != 0) ||
((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
WPP_RECORDER_AND_TRACE_SF_sDdZ
(0x40a,DAT_5 & 4,
(undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
- *(undefined8 *)(WPP_GLOBAL_Control + 0x40),4,10,0x39,
- &WPP_20e7495dfd7e3f36bcabba5500ea3aac_Traceguids,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),4,10,0x3e,
+ &WPP_7785e5eeecf6357514fa74506e9ad78e_Traceguids,
"onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",
- CONCAT44(in_stack_ffffffffffffff24,0x95c),
+ CONCAT44(in_stack_ffffffffffffff24,0xa54),
CONCAT44(in_stack_ffffffffffffff2c,0xc0000281),param_2);
}
}
}
}
else {
while( true ) {
plVar9 = (longlong *)*local_a8;
if (plVar9 == local_a8) break;
if (((longlong *)plVar9[1] != local_a8) ||
(lVar2 = *plVar9, (longlong *)*(longlong *)(lVar2 + 8) != plVar9)) {
LAB_3:
pcVar4 = (code *)swi(0x29);
(*pcVar4)(3);
pcVar4 = (code *)swi(3);
uVar7 = (*pcVar4)();
return uVar7;
}
*local_a8 = lVar2;
*(longlong **)(lVar2 + 8) = local_a8;
plVar1 = (longlong *)param_7[1];
if ((longlong *)*plVar1 != param_7) goto LAB_3;
*plVar9 = (longlong)param_7;
plVar9[1] = (longlong)plVar1;
*plVar1 = (longlong)plVar9;
param_7[1] = (longlong)plVar9;
}
}
goto LAB_1;
}
bVar10 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
bVar8 = DAT_0 & 0x20;
if ((bVar8 == 0) && (!bVar10)) goto LAB_1;
- uVar12 = 0x38;
+ uVar14 = 0x3d;
}
WPP_RECORDER_AND_TRACE_SF_sDD
- (0x205,bVar8,bVar10,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,uVar12,
- &WPP_20e7495dfd7e3f36bcabba5500ea3aac_Traceguids,
+ (0x205,bVar8,bVar10,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,uVar14,
+ &WPP_7785e5eeecf6357514fa74506e9ad78e_Traceguids,
"onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
LAB_1:
if (local_a0[0] != 0) {
FltFreeExtraCreateParameterList(Globals);
}
return uVar7;
}
```
## PrjfOpenPlaceHolder
### Match Info
|Key|pf_8737.sys - pf_8875.sys|
| :---: | :---: |
|diff_type|code,length,sig,address,called|
|ratio|0.75|
|i_ratio|0.67|
|m_ratio|0.93|
|b_ratio|0.89|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pf_8737.sys|pf_8875.sys|
| :---: | :---: | :---: |
|name|PrjfOpenPlaceHolder|PrjfOpenPlaceHolder|
|fullname|PrjfOpenPlaceHolder|PrjfOpenPlaceHolder|
|refcount|8|8|
|`length`|413|474|
|`called`|FLTMGR.SYS::FltClose
NTOSKRNL.EXE::ObfDereferenceObject
PrjfOpenReparsePoint
WPP_RECORDER_AND_TRACE_SF_sDdZ
__security_check_cookie|FLTMGR.SYS::FltClose
Feature_2998397241__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ObfDereferenceObject
PrjfOpenReparsePoint
PrjfOpenReparsePointOld
WPP_RECORDER_AND_TRACE_SF_sDdZ
__security_check_cookie|
|calling|PrjfAddInMemoryTombstone
PrjfCreateRenameOrLinkCompletionContext
PrjfOpenParentPlaceHolder
PrjfPreCleanup
PrjfPrepareSourceForRename
PrjfProcessPrjReparsePointBounce
PrjfRemoveInMemoryTombstone|PrjfAddInMemoryTombstone
PrjfCreateRenameOrLinkCompletionContext
PrjfOpenParentPlaceHolder
PrjfPreCleanup
PrjfPrepareSourceForRename
PrjfProcessPrjReparsePointBounce
PrjfRemoveInMemoryTombstone|
|paramcount|6|6|
|`address`|14003ce20|14003d4c8|
|`sig`|ulonglong __fastcall PrjfOpenPlaceHolder(undefined8 param_1, wchar_t * param_2, undefined8 param_3, longlong * param_4, longlong * param_5, byte * param_6)|int __fastcall PrjfOpenPlaceHolder(undefined8 param_1, wchar_t * param_2, undefined8 param_3, longlong * param_4, longlong * param_5, byte * param_6)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfOpenPlaceHolder Called Diff
```diff
--- PrjfOpenPlaceHolder called
+++ PrjfOpenPlaceHolder called
@@ -1,0 +2 @@
+Feature_2998397241__private_IsEnabledDeviceUsageNoInline
@@ -3,0 +5 @@
+PrjfOpenReparsePointOld
```
### PrjfOpenPlaceHolder Diff
```diff
--- PrjfOpenPlaceHolder
+++ PrjfOpenPlaceHolder
@@ -1,75 +1,87 @@
/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
-ulonglong PrjfOpenPlaceHolder(undefined8 param_1,wchar_t *param_2,undefined8 param_3,
- longlong *param_4,longlong *param_5,byte *param_6)
+int PrjfOpenPlaceHolder(undefined8 param_1,wchar_t *param_2,undefined8 param_3,longlong *param_4,
+ longlong *param_5,byte *param_6)
{
- ulonglong uVar1;
+ int iVar1;
+ ulonglong uVar2;
undefined1 auStackY_f8 [32];
undefined4 in_stack_ffffffffffffff30;
undefined4 in_stack_ffffffffffffff34;
undefined4 in_stack_ffffffffffffff54;
undefined4 in_stack_ffffffffffffff5c;
longlong local_98;
longlong local_90;
undefined8 **local_88;
undefined8 **local_80;
undefined8 **local_78;
undefined8 **local_70;
undefined4 local_68;
undefined4 local_64;
undefined8 local_60;
undefined8 uStack_58;
undefined8 local_50;
ulonglong local_48;
local_48 = __security_cookie ^ (ulonglong)auStackY_f8;
local_78 = &local_88;
local_70 = &local_88;
local_50 = 0x30;
local_88 = &local_78;
local_98 = 0;
local_80 = &local_78;
local_90 = 0;
+ local_60 = 0;
+ uStack_58 = 0;
local_68 = 0x9000001c;
local_64 = 0x80000004;
- local_60 = 0;
- uStack_58 = 0;
- uVar1 = PrjfOpenReparsePoint
- (param_1,param_2,0,0x80,0x29,
- CONCAT44(in_stack_ffffffffffffff34,in_stack_ffffffffffffff30),
- (longlong *)&local_88,&local_98,&local_90);
- if ((int)uVar1 < 0) {
+ uVar2 = Feature_2998397241__private_IsEnabledDeviceUsageNoInline();
+ if ((int)uVar2 == 0) {
+ uVar2 = PrjfOpenReparsePointOld
+ (param_1,param_2,0,0x80,0x29,
+ CONCAT44(in_stack_ffffffffffffff34,in_stack_ffffffffffffff30),
+ (longlong *)&local_88,&local_98,&local_90);
+ iVar1 = (int)uVar2;
+ }
+ else {
+ uVar2 = PrjfOpenReparsePoint
+ (param_1,param_2,0,0x80,0x29,
+ CONCAT44(in_stack_ffffffffffffff34,in_stack_ffffffffffffff30),
+ (longlong *)&local_88,&local_98,&local_90,0);
+ iVar1 = (int)uVar2;
+ }
+ if (iVar1 < 0) {
if (((DAT_0 & 4) != 0) ||
((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
WPP_RECORDER_AND_TRACE_SF_sDdZ
(0x20a,DAT_0 & 4,
(undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
- *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,10,0x3b,
- &WPP_20e7495dfd7e3f36bcabba5500ea3aac_Traceguids,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,10,0x44,
+ &WPP_7785e5eeecf6357514fa74506e9ad78e_Traceguids,
"onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",
- CONCAT44(in_stack_ffffffffffffff54,0x9c3),
- CONCAT44(in_stack_ffffffffffffff5c,(int)uVar1),param_2);
+ CONCAT44(in_stack_ffffffffffffff54,0xb7a),CONCAT44(in_stack_ffffffffffffff5c,iVar1)
+ ,param_2);
}
}
else {
if (param_6 != (byte *)0x0) {
*param_6 = (byte)local_64 & 1;
}
*param_4 = local_98;
local_98 = 0;
if (param_5 == (longlong *)0x0) goto LAB_1;
*param_5 = local_90;
local_90 = 0;
}
if (local_98 != 0) {
FltClose();
}
LAB_1:
if (local_90 != 0) {
ObfDereferenceObject();
}
- return uVar1 & 0xffffffff;
+ return iVar1;
}
```
## PrjfCopyAsPlaceHolder
### Match Info
|Key|pf_8737.sys - pf_8875.sys|
| :---: | :---: |
|diff_type|code,length,address|
|ratio|0.93|
|i_ratio|0.67|
|m_ratio|1.0|
|b_ratio|0.97|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pf_8737.sys|pf_8875.sys|
| :---: | :---: | :---: |
|name|PrjfCopyAsPlaceHolder|PrjfCopyAsPlaceHolder|
|fullname|PrjfCopyAsPlaceHolder|PrjfCopyAsPlaceHolder|
|refcount|3|3|
|`length`|3008|2989|
|called|Expand for full list:
FLTMGR.SYS::FltAllocateExtraCreateParameterFromLookasideList
FLTMGR.SYS::FltAllocateExtraCreateParameterList
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltCreateFileEx2
FLTMGR.SYS::FltFreeExtraCreateParameterList
FLTMGR.SYS::FltInsertExtraCreateParameter
FLTMGR.SYS::FltIsEcpAcknowledged
FLTMGR.SYS::FltRemoveExtraCreateParameter
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::SeCaptureSecurityDescriptor
NTOSKRNL.EXE::SeReleaseSecurityDescriptor
PrjfCopyFileMetaData
WPP_RECORDER_AND_TRACE_SF_sD
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDdZ
__security_check_cookie
memsetExpand for full list:
FLTMGR.SYS::FltAllocateExtraCreateParameterFromLookasideList
FLTMGR.SYS::FltAllocateExtraCreateParameterList
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltCreateFileEx2
FLTMGR.SYS::FltFreeExtraCreateParameterList
FLTMGR.SYS::FltInsertExtraCreateParameter
FLTMGR.SYS::FltIsEcpAcknowledged
FLTMGR.SYS::FltRemoveExtraCreateParameter
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::SeCaptureSecurityDescriptor
NTOSKRNL.EXE::SeReleaseSecurityDescriptor
PrjfCopyFileMetaData
WPP_RECORDER_AND_TRACE_SF_sD
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDdZ
__security_check_cookie
memset
PrjfWritePlaceholderInformationHandler|PrjfUpdatePlaceholderIfNeededHandler
PrjfWritePlaceholderInformationHandler|
|paramcount|8|8|
|`address`|140038498|1400384b8|
|sig|int __fastcall PrjfCopyAsPlaceHolder(char * param_1, longlong param_2, wchar_t * param_3, longlong param_4, longlong param_5, int param_6, char param_7, uint param_8)|int __fastcall PrjfCopyAsPlaceHolder(char * param_1, longlong param_2, wchar_t * param_3, longlong param_4, longlong param_5, int param_6, char param_7, uint param_8)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfCopyAsPlaceHolder Diff
```diff
--- PrjfCopyAsPlaceHolder
+++ PrjfCopyAsPlaceHolder
@@ -1,365 +1,365 @@
/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
int PrjfCopyAsPlaceHolder
(char *param_1,longlong param_2,wchar_t *param_3,longlong param_4,longlong param_5,
int param_6,char param_7,uint param_8)
{
uint uVar1;
longlong lVar2;
char cVar3;
int iVar4;
undefined2 uVar5;
byte bVar6;
ushort uVar7;
uint uVar8;
bool bVar9;
undefined1 auStackY_1a8 [32];
undefined4 uVar10;
undefined4 in_stack_fffffffffffffea4;
undefined4 in_stack_fffffffffffffeac;
undefined2 *local_128;
int local_120;
uint local_11c;
wchar_t *local_118;
longlong local_110;
longlong local_108;
longlong local_100;
int local_f8;
undefined4 local_f4;
longlong local_f0;
char *local_e8;
longlong local_e0;
undefined8 local_d8;
longlong lStack_d0;
undefined8 local_c8;
undefined8 uStack_c0;
ulonglong local_b8;
undefined8 local_b0;
undefined8 uStack_a8;
wchar_t *local_a0;
undefined8 uStack_98;
longlong local_90;
ulonglong local_88;
undefined8 local_80;
undefined8 uStack_78;
undefined8 local_70;
undefined8 uStack_68;
undefined8 local_60;
undefined8 uStack_58;
ulonglong local_50;
local_50 = __security_cookie ^ (ulonglong)auStackY_1a8;
local_e8 = (char *)0x0;
local_120 = 0;
local_f0 = 0;
local_110 = 0;
local_128 = (undefined2 *)0x0;
local_b8 = local_b8 & 0xffffffffffff0000;
local_90 = 0;
local_88 = local_88 & 0xffffffff00000000;
local_108 = 0;
local_100 = 0;
local_d8 = 0;
lStack_d0 = 0;
local_c8 = 0;
uStack_c0 = 0;
local_b0 = 0;
uStack_a8 = 0;
local_a0 = (wchar_t *)0x0;
uStack_98 = 0;
local_80 = 0;
uStack_78 = 0;
local_70 = 0;
uStack_68 = 0;
local_60 = 0;
uStack_58 = 0;
local_118 = param_3;
local_e0 = param_4;
if ((param_6 == 0) || (param_5 == 0)) {
if (((DAT_0 & 0x20) != 0) ||
((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
- uVar7 = 0x3f;
+ uVar7 = 0x48;
LAB_1:
WPP_RECORDER_AND_TRACE_SF_sD
(0x205,DAT_0 & 0x20,
(undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,uVar7,
- &WPP_20e7495dfd7e3f36bcabba5500ea3aac_Traceguids,
+ &WPP_7785e5eeecf6357514fa74506e9ad78e_Traceguids,
"onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
}
}
else if (param_6 == *(ushort *)(param_5 + 4) + 8) {
if (param_1 != (char *)0x0) {
iVar4 = *(int *)(param_1 + 0x38);
if (iVar4 == 0) {
LAB_2:
if (*(int *)(param_1 + 0x40) != 0) {
uVar1 = *(uint *)(param_1 + 0x44);
if (uVar1 < 0x150) {
if (((DAT_0 & 0x20) != 0) ||
((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
- uVar7 = 0x45;
+ uVar7 = 0x4e;
goto LAB_1;
}
goto LAB_3;
}
uVar8 = uVar1 + *(int *)(param_1 + 0x40);
if (uVar8 < uVar1) {
iVar4 = -0x3fffff6b;
bVar9 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
bVar6 = DAT_4 & 0x40;
if ((bVar6 == 0) && (!bVar9)) {
return -0x3fffff6b;
}
- uVar7 = 0x46;
+ uVar7 = 0x4f;
}
else if (param_8 < uVar8) {
iVar4 = -0x3ffffff3;
bVar9 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
bVar6 = DAT_4 & 0x40;
if ((bVar6 == 0) && (!bVar9)) {
return -0x3ffffff3;
}
- uVar7 = 0x47;
+ uVar7 = 0x50;
}
else {
iVar4 = SeCaptureSecurityDescriptor
(param_2 + (ulonglong)uVar1,CONCAT31((int3)(uVar8 >> 8),1),1);
if (-1 < iVar4) goto LAB_5;
bVar9 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
bVar6 = DAT_4 & 0x40;
if ((bVar6 == 0) && (!bVar9)) goto LAB_6;
- uVar7 = 0x48;
+ uVar7 = 0x51;
}
goto LAB_7;
}
LAB_5:
if (*(int *)(param_1 + 0x48) != 0) {
iVar4 = -0x3fffff45;
goto LAB_6;
}
uVar1 = *(uint *)(param_1 + 0x30);
local_f8 = (*param_1 != '\0') + 0x200028;
local_11c = uVar1;
iVar4 = FltAllocateExtraCreateParameterList(Globals,0,&local_110);
if (iVar4 < 0) {
bVar9 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
bVar6 = DAT_0 & 0x20;
if ((bVar6 == 0) && (!bVar9)) goto LAB_6;
- uVar7 = 0x4c;
+ uVar7 = 0x55;
LAB_8:
uVar5 = 0x205;
uVar10 = 5;
}
else {
iVar4 = FltAllocateExtraCreateParameterFromLookasideList
(Globals,&GUID_ECP_ATOMIC_CREATE,0x58);
if (iVar4 < 0) {
bVar9 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
bVar6 = DAT_0 & 0x20;
if ((bVar6 == 0) && (!bVar9)) goto LAB_6;
- uVar7 = 0x4d;
+ uVar7 = 0x56;
goto LAB_8;
}
memset(local_128,0,0x58);
*local_128 = 0x58;
local_128[1] = 2;
local_128[2] = 0;
uVar7 = *(ushort *)(param_5 + 4) + 8;
if (uVar7 < *(ushort *)(param_5 + 4)) {
local_128[3] = 0xffff;
iVar4 = -0x3fffff6b;
goto LAB_6;
}
local_128[3] = uVar7;
*(longlong *)(local_128 + 4) = param_5;
if (*param_1 == '\0') {
local_128[1] = local_128[1] | 1;
*(undefined8 *)(local_128 + 8) = *(undefined8 *)(param_1 + 8);
local_128[1] = local_128[1] | 4;
*(undefined8 *)(local_128 + 0xc) = *(undefined8 *)(param_1 + 8);
local_128[1] = local_128[1] | 8;
}
if (DAT_9 == '\0') {
if (param_7 != '\0') {
local_128[1] = local_128[1] | 0x400;
local_128[1] = local_128[1] | 0x200;
}
uStack_58 = *(undefined8 *)(param_1 + 0x28);
local_70 = *(undefined8 *)(param_1 + 0x10);
uStack_68 = *(undefined8 *)(param_1 + 0x18);
local_60 = *(undefined8 *)(param_1 + 0x20);
*(undefined8 **)(local_128 + 0x10) = &local_70;
local_128[1] = local_128[1] | 0x10;
local_128[1] = local_128[1] | 0x20;
local_11c = uVar1 | 0x400000;
*(uint *)(local_128 + 0x14) = local_11c;
}
while (iVar4 = FltInsertExtraCreateParameter(Globals,local_110,local_128), -1 < iVar4) {
local_d8 = 0x28;
lStack_d0 = local_110;
local_a0 = local_118;
local_90 = local_f0;
local_b8 = 1;
uStack_a8 = 0;
local_88 = 0;
local_c8 = 0;
uStack_c0 = 0;
local_b0 = CONCAT44(local_b0._4_4_,0x30);
uStack_98 = CONCAT44(uStack_98._4_4_,0x240);
iVar4 = FltCreateFileEx2(Globals,local_e0,&local_108,&local_100);
if (-1 < iVar4) {
cVar3 = FltIsEcpAcknowledged(Globals,local_128);
lVar2 = local_e0;
if (cVar3 == '\0') {
iVar4 = -0x3fffff45;
bVar9 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
bVar6 = DAT_4 & 4;
if ((bVar6 != 0) || (bVar9)) {
iVar4 = -0x3fffff45;
- uVar10 = 0xe3e;
- uVar7 = 0x52;
+ uVar10 = 0xff5;
+ uVar7 = 0x5b;
goto LAB_10;
}
}
else {
iVar4 = PrjfCopyFileMetaData((longlong)param_1,local_108,local_100,local_e0,2);
if ((-1 < iVar4) && (DAT_9 != '\0')) {
iVar4 = PrjfCopyFileMetaData((longlong)param_1,local_108,local_100,lVar2,0x68);
}
}
goto LAB_6;
}
if (iVar4 == -0x3fffffcb) {
iVar4 = 0;
goto LAB_6;
}
if ((iVar4 != -0x3fffff45) || (DAT_9 != '\0')) {
bVar9 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
bVar6 = DAT_4 & 4;
if ((bVar6 != 0) || (bVar9)) {
- uVar10 = 0xe25;
- uVar7 = 0x51;
+ uVar10 = 0xfdc;
+ uVar7 = 0x5a;
LAB_10:
WPP_RECORDER_AND_TRACE_SF_sDdZ
(0x20a,bVar6,bVar9,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,10,uVar7,
- &WPP_20e7495dfd7e3f36bcabba5500ea3aac_Traceguids,
+ &WPP_7785e5eeecf6357514fa74506e9ad78e_Traceguids,
"onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",
CONCAT44(in_stack_fffffffffffffea4,uVar10),
CONCAT44(in_stack_fffffffffffffeac,iVar4),local_118);
}
goto LAB_6;
}
if (((DAT_11 & 4) != 0) ||
((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
WPP_RECORDER_AND_TRACE_SF_sDdZ
(0x40a,DAT_11 & 4,
(undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
- *(undefined8 *)(WPP_GLOBAL_Control + 0x40),4,10,0x4f,
- &WPP_20e7495dfd7e3f36bcabba5500ea3aac_Traceguids,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),4,10,0x58,
+ &WPP_7785e5eeecf6357514fa74506e9ad78e_Traceguids,
"onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",
- CONCAT44(in_stack_fffffffffffffea4,0xdec),
+ CONCAT44(in_stack_fffffffffffffea4,0xfa3),
CONCAT44(in_stack_fffffffffffffeac,0xc00000bb),local_118);
}
local_f4 = 0;
DAT_9 = '\x01';
iVar4 = FltRemoveExtraCreateParameter
(Globals,local_110,&GUID_ECP_ATOMIC_CREATE,&local_128);
if (iVar4 < 0) {
bVar9 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
bVar6 = DAT_4 & 4;
if ((bVar6 != 0) || (bVar9)) {
- uVar10 = 0xe0a;
- uVar7 = 0x50;
+ uVar10 = 0xfc1;
+ uVar7 = 0x59;
goto LAB_10;
}
goto LAB_6;
}
local_128[1] = local_128[1] & 0xffef;
local_128[1] = local_128[1] & 0xfbff;
local_128[1] = local_128[1] & 0xfdff;
local_128[1] = local_128[1] & 0xffdf;
}
MicrosoftTelemetryAssertTriggeredNoArgsKM();
bVar9 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
bVar6 = DAT_4 & 0x80;
if ((bVar6 == 0) && (!bVar9)) goto LAB_6;
uVar5 = 0x20f;
- uVar7 = 0x4e;
+ uVar7 = 0x57;
uVar10 = 0xf;
}
}
else {
uVar1 = *(uint *)(param_1 + 0x3c);
if (uVar1 < 0x150) {
if (((DAT_0 & 0x20) != 0) ||
((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
- uVar7 = 0x42;
+ uVar7 = 0x4b;
goto LAB_1;
}
goto LAB_3;
}
if (uVar1 + iVar4 < uVar1) {
iVar4 = -0x3fffff6b;
bVar9 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
bVar6 = DAT_4 & 0x40;
if ((bVar6 == 0) && (!bVar9)) {
return -0x3fffff6b;
}
- uVar7 = 0x43;
+ uVar7 = 0x4c;
}
else {
if (uVar1 + iVar4 <= param_8) {
local_e8 = param_1 + uVar1;
local_120 = iVar4;
goto LAB_2;
}
iVar4 = -0x3ffffff3;
bVar9 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
bVar6 = DAT_4 & 0x40;
if ((bVar6 == 0) && (!bVar9)) {
return -0x3ffffff3;
}
- uVar7 = 0x44;
+ uVar7 = 0x4d;
}
LAB_7:
uVar5 = 0x20e;
uVar10 = 0xe;
}
WPP_RECORDER_AND_TRACE_SF_sDD
(uVar5,bVar6,bVar9,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,uVar10,uVar7,
- &WPP_20e7495dfd7e3f36bcabba5500ea3aac_Traceguids,
+ &WPP_7785e5eeecf6357514fa74506e9ad78e_Traceguids,
"onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
goto LAB_6;
}
if (((DAT_0 & 0x20) != 0) ||
((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
- uVar7 = 0x41;
+ uVar7 = 0x4a;
goto LAB_1;
}
}
else if (((DAT_0 & 0x20) != 0) ||
((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
- uVar7 = 0x40;
+ uVar7 = 0x49;
goto LAB_1;
}
LAB_3:
iVar4 = -0x3ffffff3;
LAB_6:
if (local_110 != 0) {
FltFreeExtraCreateParameterList(Globals);
}
if (local_108 != 0) {
FltClose();
}
if (local_100 != 0) {
ObfDereferenceObject();
}
if (local_f0 != 0) {
SeReleaseSecurityDescriptor(local_f0,1);
}
return iVar4;
}
```
## PrjfProcessTombstoneBounce
### Match Info
|Key|pf_8737.sys - pf_8875.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.7|
|i_ratio|0.63|
|m_ratio|0.99|
|b_ratio|0.95|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pf_8737.sys|pf_8875.sys|
| :---: | :---: | :---: |
|name|PrjfProcessTombstoneBounce|PrjfProcessTombstoneBounce|
|fullname|PrjfProcessTombstoneBounce|PrjfProcessTombstoneBounce|
|refcount|2|2|
|`length`|2474|2538|
|`called`|Expand for full list:
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltParseFileNameInformation
FLTMGR.SYS::FltQueryInformationFile
FLTMGR.SYS::FltReissueSynchronousIo
FLTMGR.SYS::FltReleaseContext
FLTMGR.SYS::FltRemoveOpenReparseEntry
FLTMGR.SYS::FltSetCallbackDataDirty
FLTMGR.SYS::FltSetInformationFile
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExFreeToPagedLookasideList
NTOSKRNL.EXE::KeWaitForSingleObject
NTOSKRNL.EXE::ObfDereferenceObject
PrjfAddInMemoryTombstone
PrjfAllocateUnicodeString
PrjfConvertFullPathToRelative
PrjfCreateTombstone
PrjfGetSetFileContext
PrjfOpenAsReparsePoint
PrjfRemoveInMemoryTombstone
PrjfSleepOnTestSettingFlagsForTests
PrjfTelemetryTombstoneFailureOperation
WPP_RECORDER_AND_TRACE_SF_sD
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDdZ
WPP_RECORDER_AND_TRACE_SF_sDdsZ
__security_check_cookieExpand for full list:
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltParseFileNameInformation
FLTMGR.SYS::FltQueryInformationFile
FLTMGR.SYS::FltReissueSynchronousIo
FLTMGR.SYS::FltReleaseContext
FLTMGR.SYS::FltRemoveOpenReparseEntry
FLTMGR.SYS::FltSetCallbackDataDirty
FLTMGR.SYS::FltSetInformationFile
Feature_2998397241__private_IsEnabledDeviceUsageNoInline
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExFreeToPagedLookasideList
NTOSKRNL.EXE::KeWaitForSingleObject
NTOSKRNL.EXE::ObfDereferenceObject
PrjfAddInMemoryTombstone
PrjfAllocateUnicodeString
PrjfConvertFullPathToRelative
PrjfCreateTombstone
PrjfGetSetFileContext
PrjfOpenAsReparsePoint
PrjfOpenAsReparsePointOld
PrjfRemoveInMemoryTombstone
PrjfSleepOnTestSettingFlagsForTests
PrjfTelemetryTombstoneFailureOperation
WPP_RECORDER_AND_TRACE_SF_sD
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDdZ
WPP_RECORDER_AND_TRACE_SF_sDdsZ
__security_check_cookie
FLTMGR.SYS::FltCreateFileEx2
FLTMGR.SYS::FltReleaseContext
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ObfDereferenceObject
PrjfGetSetContextFileObject
PrjfOpenAsReparsePoint
WPP_RECORDER_AND_TRACE_SF_sDdDZ
WPP_RECORDER_AND_TRACE_SF_sDdZ
WPP_RECORDER_AND_TRACE_SF_sDdZd|Expand for full list:
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltCreateFileEx2
FLTMGR.SYS::FltReleaseContext
Feature_2998397241__private_IsEnabledDeviceUsageNoInline
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ObfDereferenceObject
PrjfGetSetContextFileObject
PrjfOpenAsReparsePoint
PrjfOpenAsReparsePointOld
WPP_RECORDER_AND_TRACE_SF_sDdDZ
WPP_RECORDER_AND_TRACE_SF_sDdZ
WPP_RECORDER_AND_TRACE_SF_sDdZd
PrjfUpdatePlaceholderIfNeededHandler|PrjfDeleteFileHandler
PrjfUpdatePlaceholderIfNeededHandler|
|paramcount|9|9|
|`address`|140039f8c|140039f98|
|sig|int __fastcall PrjfDecideUpdateDeleteOnFileStateAndUpdateFlags(undefined8 param_1, uint param_2, wchar_t * param_3, longlong * param_4, longlong * param_5, undefined4 * param_6, byte * param_7, undefined8 * param_8, undefined1 * param_9)|int __fastcall PrjfDecideUpdateDeleteOnFileStateAndUpdateFlags(undefined8 param_1, uint param_2, wchar_t * param_3, longlong * param_4, longlong * param_5, undefined4 * param_6, byte * param_7, undefined8 * param_8, undefined1 * param_9)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfDecideUpdateDeleteOnFileStateAndUpdateFlags Called Diff
```diff
--- PrjfDecideUpdateDeleteOnFileStateAndUpdateFlags called
+++ PrjfDecideUpdateDeleteOnFileStateAndUpdateFlags called
@@ -3,0 +4 @@
+Feature_2998397241__private_IsEnabledDeviceUsageNoInline
@@ -7,0 +9 @@
+PrjfOpenAsReparsePointOld
```
### PrjfDecideUpdateDeleteOnFileStateAndUpdateFlags Diff
```diff
--- PrjfDecideUpdateDeleteOnFileStateAndUpdateFlags
+++ PrjfDecideUpdateDeleteOnFileStateAndUpdateFlags
@@ -1,291 +1,300 @@
/* WARNING: Type propagation algorithm not settling */
int PrjfDecideUpdateDeleteOnFileStateAndUpdateFlags
(undefined8 param_1,uint param_2,wchar_t *param_3,longlong *param_4,longlong *param_5,
undefined4 *param_6,byte *param_7,undefined8 *param_8,undefined1 *param_9)
{
undefined8 *puVar1;
+ longlong lVar2;
int extraout_EAX;
- int iVar2;
- undefined8 *puVar3;
- byte bVar4;
- longlong lVar5;
- longlong lVar6;
+ int extraout_EAX_00;
+ int iVar3;
+ ulonglong uVar4;
+ undefined8 *puVar5;
+ byte bVar6;
longlong lVar7;
- longlong lVar8;
+ uint uVar8;
bool bVar9;
undefined4 in_stack_fffffffffffffef8;
undefined4 in_stack_fffffffffffffefc;
ushort uVar10;
char *pcVar11;
byte *pbVar12;
undefined8 uVar13;
undefined4 uVar14;
undefined8 *******pppppppuVar15;
undefined8 uVar16;
undefined4 uVar17;
byte local_a8;
char local_a7;
byte local_a6;
byte local_a5 [5];
longlong local_a0;
longlong local_98;
- longlong local_90;
- uint local_88 [2];
+ uint local_90 [2];
+ ulonglong local_88;
longlong local_80 [3];
wchar_t *local_68;
undefined8 local_60;
undefined8 local_58;
undefined8 uStack_50;
undefined8 local_48;
undefined8 uStack_40;
- lVar5 = 0;
- *param_4 = 0;
local_a8 = 0;
local_a7 = '\0';
+ local_88 = 0;
*param_6 = 0;
- lVar7 = 0;
- local_90 = 0;
local_80[0] = 0;
local_98 = 0;
+ local_a0 = 0;
*param_5 = 0;
- local_a0 = 0;
- local_88[0] = 0x80000000;
+ local_90[0] = 0x80000000;
+ *param_4 = 0;
*param_9 = 0;
- pppppppuVar15 = (undefined8 *******)&local_a7;
- pbVar12 = &local_a6;
- pcVar11 = (char *)local_a5;
- PrjfOpenAsReparsePoint
- (param_3,0,param_1,0x10180,CONCAT44(in_stack_fffffffffffffefc,in_stack_fffffffffffffef8)
- ,(longlong)&local_98,(longlong)&local_a0,&local_a8,(byte *)pcVar11,pbVar12,
- pppppppuVar15,local_88);
- uVar14 = (undefined4)((ulonglong)pbVar12 >> 0x20);
- uVar17 = (undefined4)((ulonglong)pppppppuVar15 >> 0x20);
- iVar2 = extraout_EAX;
- lVar8 = lVar7;
- if (extraout_EAX < 0) {
- if (extraout_EAX == -0x3ffffd7f) {
- iVar2 = -0x3fffffc6;
+ uVar4 = Feature_2998397241__private_IsEnabledDeviceUsageNoInline();
+ if ((int)uVar4 == 0) {
+ pppppppuVar15 = (undefined8 *******)&local_a7;
+ pbVar12 = &local_a6;
+ pcVar11 = (char *)local_a5;
+ uVar8 = PrjfOpenAsReparsePointOld
+ (param_3,0,param_1,0x10180,
+ CONCAT44(in_stack_fffffffffffffefc,in_stack_fffffffffffffef8),
+ (longlong)&local_98,(longlong)&local_a0,&local_a8,(byte *)pcVar11,pbVar12,
+ pppppppuVar15,local_90);
+ uVar14 = (undefined4)((ulonglong)pbVar12 >> 0x20);
+ uVar17 = (undefined4)((ulonglong)pppppppuVar15 >> 0x20);
+ iVar3 = extraout_EAX_00;
+ }
+ else {
+ pppppppuVar15 = (undefined8 *******)&local_a7;
+ pbVar12 = &local_a6;
+ pcVar11 = (char *)local_a5;
+ uVar8 = PrjfOpenAsReparsePoint
+ (param_3,0,param_1,0x10180,
+ CONCAT44(in_stack_fffffffffffffefc,in_stack_fffffffffffffef8),
+ (longlong)&local_98,(longlong)&local_a0,&local_a8,(byte *)pcVar11,pbVar12,
+ pppppppuVar15,local_90,1);
+ uVar14 = (undefined4)((ulonglong)pbVar12 >> 0x20);
+ uVar17 = (undefined4)((ulonglong)pppppppuVar15 >> 0x20);
+ iVar3 = extraout_EAX;
+ }
+ uVar4 = (ulonglong)uVar8;
+ if (iVar3 < 0) {
+ if (iVar3 == -0x3ffffd7f) {
+ iVar3 = -0x3fffffc6;
if (((DAT_0 & 0x40) != 0) ||
- (lVar8 = lVar5, (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+ ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
WPP_RECORDER_AND_TRACE_SF_sDdZd
(0x40e,DAT_0 & 0x40,
(undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
- *(undefined8 *)(WPP_GLOBAL_Control + 0x40),4,0xe,0x9d);
- lVar8 = lVar7;
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),4,0xe,0xa6);
}
goto LAB_1;
}
- if (extraout_EAX == -0x3ffffd87) {
+ if (iVar3 == -0x3ffffd87) {
if ((local_a8 != 0) || (local_a7 != '\0')) {
MicrosoftTelemetryAssertTriggeredNoArgsKM();
}
if (((DAT_2 & 0x40) != 0) ||
((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
uVar16 = CONCAT44(uVar17,0xc0000279);
- uVar13 = CONCAT44(uVar14,0x19b4);
+ uVar13 = CONCAT44(uVar14,0x1b91);
pcVar11 = "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c";
WPP_RECORDER_AND_TRACE_SF_sDdZ
(0x30e,DAT_2 & 0x40,
(undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
- *(undefined8 *)(WPP_GLOBAL_Control + 0x40),3,0xe,0x9f,
- &WPP_20e7495dfd7e3f36bcabba5500ea3aac_Traceguids,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),3,0xe,0xa8,
+ &WPP_7785e5eeecf6357514fa74506e9ad78e_Traceguids,
"onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",uVar13,uVar16,param_3);
uVar14 = (undefined4)((ulonglong)uVar13 >> 0x20);
uVar17 = (undefined4)((ulonglong)uVar16 >> 0x20);
}
uVar16 = CONCAT44(uVar17,1);
uVar13 = CONCAT44(uVar14,3);
local_80[1] = 0x30;
local_60 = 0x240;
local_48 = 0;
uStack_40 = 0;
local_80[2] = 0;
local_58 = 0;
uStack_50 = 0;
local_68 = param_3;
- iVar2 = FltCreateFileEx2(Globals,param_1,&local_98,&local_a0,0x10180,local_80 + 1,&local_48,0,
+ iVar3 = FltCreateFileEx2(Globals,param_1,&local_98,&local_a0,0x10180,local_80 + 1,&local_48,0,
(ulonglong)pcVar11 & 0xffffffff00000000,uVar13,uVar16,0x200028,0,0,1,
0);
uVar14 = (undefined4)((ulonglong)uVar13 >> 0x20);
uVar17 = (undefined4)((ulonglong)uVar16 >> 0x20);
- if (-1 < iVar2) goto LAB_3;
+ if (-1 < iVar3) goto LAB_3;
bVar9 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
- bVar4 = DAT_4 & 0x40;
- if ((bVar4 == 0) && (!bVar9)) goto LAB_1;
- uVar16 = CONCAT44(uVar17,iVar2);
- uVar13 = CONCAT44(uVar14,0x19d8);
- uVar10 = 0xa0;
+ bVar6 = DAT_4 & 0x40;
+ if ((bVar6 == 0) && (!bVar9)) goto LAB_1;
+ uVar16 = CONCAT44(uVar17,iVar3);
+ uVar13 = CONCAT44(uVar14,0x1bb5);
+ uVar10 = 0xa9;
}
else {
bVar9 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
- bVar4 = DAT_4 & 0x40;
- if ((bVar4 == 0) && (!bVar9)) goto LAB_1;
- uVar16 = CONCAT44(uVar17,extraout_EAX);
- uVar13 = CONCAT44(uVar14,0x19a2);
- uVar10 = 0x9e;
- lVar7 = lVar5;
- iVar2 = extraout_EAX;
+ bVar6 = DAT_4 & 0x40;
+ if ((bVar6 == 0) && (!bVar9)) goto LAB_1;
+ uVar16 = CONCAT44(uVar17,iVar3);
+ uVar13 = CONCAT44(uVar14,0x1b7f);
+ uVar10 = 0xa7;
}
LAB_5:
WPP_RECORDER_AND_TRACE_SF_sDdZ
- (0x20e,bVar4,bVar9,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,uVar10,
- &WPP_20e7495dfd7e3f36bcabba5500ea3aac_Traceguids,
+ (0x20e,bVar6,bVar9,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,uVar10,
+ &WPP_7785e5eeecf6357514fa74506e9ad78e_Traceguids,
"onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",uVar13,uVar16,param_3);
- lVar8 = lVar7;
}
else {
LAB_3:
if (local_a8 == 0) {
if (local_a7 == '\0') {
if ((param_2 & 2) == 0) {
- iVar2 = -0x3fff31fb;
+ iVar3 = -0x3fff31fb;
if (((DAT_2 & 0x40) != 0) ||
((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
WPP_RECORDER_AND_TRACE_SF_sDdDZ
(0x30e,DAT_2 & 0x40,
(undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
- *(undefined8 *)(WPP_GLOBAL_Control + 0x40),3,0xe,0xa5,
- &WPP_20e7495dfd7e3f36bcabba5500ea3aac_Traceguids,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),3,0xe,0xae,
+ &WPP_7785e5eeecf6357514fa74506e9ad78e_Traceguids,
"onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
}
*param_6 = 2;
goto LAB_1;
}
}
else {
if ((param_2 & 4) == 0) {
- iVar2 = -0x3fff31fb;
+ iVar3 = -0x3fff31fb;
if (((DAT_2 & 0x40) != 0) ||
((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
WPP_RECORDER_AND_TRACE_SF_sDdDZ
(0x30e,DAT_2 & 0x40,
(undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
- *(undefined8 *)(WPP_GLOBAL_Control + 0x40),3,0xe,0xa4,
- &WPP_20e7495dfd7e3f36bcabba5500ea3aac_Traceguids,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),3,0xe,0xad,
+ &WPP_7785e5eeecf6357514fa74506e9ad78e_Traceguids,
"onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
}
*param_6 = 4;
goto LAB_1;
}
*param_9 = 1;
- lVar7 = lVar5;
}
}
else {
- iVar2 = PrjfGetSetContextFileObject
+ iVar3 = PrjfGetSetContextFileObject
(param_1,local_a0,-0x80000000,'\0','\0',(undefined4 *)0x0,(undefined2 *)0x0,
- &local_90,local_80);
- lVar7 = local_90;
- lVar8 = lVar7;
- if (iVar2 < 0) {
+ (longlong *)&local_88,local_80);
+ uVar4 = local_88;
+ if (iVar3 < 0) {
if (((DAT_4 & 0x40) != 0) ||
((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
WPP_RECORDER_AND_TRACE_SF_sDdZ
(0x20e,DAT_4 & 0x40,
(undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
- *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0xa1,
- &WPP_20e7495dfd7e3f36bcabba5500ea3aac_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",CONCAT44(uVar14,0x1a02),
- CONCAT44(uVar17,iVar2),param_3);
- lVar8 = local_90;
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0xaa,
+ &WPP_7785e5eeecf6357514fa74506e9ad78e_Traceguids,
+ "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",CONCAT44(uVar14,0x1bdf),
+ CONCAT44(uVar17,iVar3),param_3);
+ uVar4 = local_88;
}
goto LAB_1;
}
- if ((local_90 == 0) || (*(int *)(local_90 + 0x40) == 3)) {
+ if ((local_88 == 0) || (*(int *)(local_88 + 0x40) == 3)) {
MicrosoftTelemetryAssertTriggeredNoArgsKM();
}
- lVar5 = *(longlong *)(lVar7 + 0x48);
- if (lVar5 == 0) {
- iVar2 = -0x3fffffde;
+ lVar2 = *(longlong *)(uVar4 + 0x48);
+ if (lVar2 == 0) {
+ iVar3 = -0x3fffffde;
bVar9 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
- bVar4 = DAT_4 & 0x40;
- if ((bVar4 == 0) && (!bVar9)) goto LAB_1;
+ bVar6 = DAT_4 & 0x40;
+ if ((bVar6 == 0) && (!bVar9)) goto LAB_1;
uVar16 = CONCAT44(uVar17,0xc0000022);
- uVar13 = CONCAT44(uVar14,0x1a16);
- uVar10 = 0xa2;
- iVar2 = -0x3fffffde;
+ uVar13 = CONCAT44(uVar14,0x1bf3);
+ uVar10 = 0xab;
+ iVar3 = -0x3fffffde;
goto LAB_5;
}
- lVar6 = 2;
- if (((*(uint *)(lVar5 + 0xc) & 2) != 0) && ((param_2 & 1) == 0)) {
- iVar2 = -0x3fff31fb;
+ lVar7 = 2;
+ if (((*(uint *)(lVar2 + 0xc) & 2) != 0) && ((param_2 & 1) == 0)) {
+ iVar3 = -0x3fff31fb;
if (((DAT_2 & 0x40) != 0) ||
((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
WPP_RECORDER_AND_TRACE_SF_sDdDZ
(0x30e,DAT_2 & 0x40,
(undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
- *(undefined8 *)(WPP_GLOBAL_Control + 0x40),3,0xe,0xa3,
- &WPP_20e7495dfd7e3f36bcabba5500ea3aac_Traceguids,
+ *(undefined8 *)(WPP_GLOBAL_Control + 0x40),3,0xe,0xac,
+ &WPP_7785e5eeecf6357514fa74506e9ad78e_Traceguids,
"onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
}
*param_6 = 1;
goto LAB_1;
}
if (param_8 != (undefined8 *)0x0) {
- puVar3 = (undefined8 *)(lVar5 + 0x20);
+ puVar5 = (undefined8 *)(lVar2 + 0x20);
do {
- uVar13 = puVar3[1];
- *param_8 = *puVar3;
+ uVar13 = puVar5[1];
+ *param_8 = *puVar5;
param_8[1] = uVar13;
- uVar13 = puVar3[3];
- param_8[2] = puVar3[2];
+ uVar13 = puVar5[3];
+ param_8[2] = puVar5[2];
param_8[3] = uVar13;
- uVar13 = puVar3[5];
- param_8[4] = puVar3[4];
+ uVar13 = puVar5[5];
+ param_8[4] = puVar5[4];
param_8[5] = uVar13;
- uVar13 = puVar3[7];
- param_8[6] = puVar3[6];
+ uVar13 = puVar5[7];
+ param_8[6] = puVar5[6];
param_8[7] = uVar13;
- uVar13 = puVar3[9];
- param_8[8] = puVar3[8];
+ uVar13 = puVar5[9];
+ param_8[8] = puVar5[8];
param_8[9] = uVar13;
- uVar13 = puVar3[0xb];
- param_8[10] = puVar3[10];
+ uVar13 = puVar5[0xb];
+ param_8[10] = puVar5[10];
param_8[0xb] = uVar13;
- uVar13 = puVar3[0xd];
- param_8[0xc] = puVar3[0xc];
+ uVar13 = puVar5[0xd];
+ param_8[0xc] = puVar5[0xc];
param_8[0xd] = uVar13;
- puVar1 = puVar3 + 0xe;
- uVar13 = puVar3[0xf];
- puVar3 = puVar3 + 0x10;
+ puVar1 = puVar5 + 0xe;
+ uVar13 = puVar5[0xf];
+ puVar5 = puVar5 + 0x10;
param_8[0xe] = *puVar1;
param_8[0xf] = uVar13;
- lVar6 = lVar6 + -1;
+ lVar7 = lVar7 + -1;
param_8 = param_8 + 0x10;
- } while (lVar6 != 0);
- }
- }
- lVar5 = local_98;
- lVar8 = local_a0;
+ } while (lVar7 != 0);
+ }
+ }
+ lVar7 = local_98;
+ lVar2 = local_a0;
if (param_7 != (byte *)0x0) {
*param_7 = local_a8;
}
local_98 = 0;
- *param_4 = lVar5;
+ *param_4 = lVar7;
local_a0 = 0;
- *param_5 = lVar8;
- lVar8 = lVar7;
+ *param_5 = lVar2;
}
LAB_1:
if (local_98 != 0) {
FltClose();
}
if (local_a0 != 0) {
ObfDereferenceObject();
}
- if (lVar8 != 0) {
- FltReleaseContext(lVar8);
+ if (uVar4 != 0) {
+ FltReleaseContext(uVar4);
}
if (local_80[0] != 0) {
FltReleaseContext();
}
- if (iVar2 == -0x3ffffd87) {
+ if (iVar3 == -0x3ffffd87) {
MicrosoftTelemetryAssertTriggeredNoArgsKM();
}
- return iVar2;
+ return iVar3;
}
```
## PrjfOpenAsReparsePoint
### Match Info
|Key|pf_8737.sys - pf_8875.sys|
| :---: | :---: |
|diff_type|code,name,fullname,refcount,length,sig,address,calling,called|
|ratio|0.05|
|i_ratio|0.01|
|m_ratio|0.07|
|b_ratio|0.06|
|match_types|Implied Match|
### Function Meta Diff
|Key|pf_8737.sys|pf_8875.sys|
| :---: | :---: | :---: |
|`name`|PrjfOpenAsReparsePoint|Feature_2998397241__private_IsEnabledDeviceUsageNoInline|
|`fullname`|PrjfOpenAsReparsePoint|Feature_2998397241__private_IsEnabledDeviceUsageNoInline|
|`refcount`|7|8|
|`length`|1560|49|
|`called`|FLTMGR.SYS::FltGetInstanceContext
FLTMGR.SYS::FltReleaseContext
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExAllocateFromPagedLookasideList
NTOSKRNL.EXE::ExFreeToPagedLookasideList
PrjfOpenReparsePoint
WPP_RECORDER_AND_TRACE_SF_sDD
WPP_RECORDER_AND_TRACE_SF_sDdZssss|Feature_2998397241__private_IsEnabledFallback|
|`calling`|PrjfDecideUpdateDeleteOnFileStateAndUpdateFlags
PrjfDeleteTombstoneIfExists
PrjfOpenAndCheckEmptyPartialDirectory
PrjfPostCreate
PrjfProcessFileDirectoryStatus
PrjfProcessTombstoneBounce|PrjfDecideUpdateDeleteOnFileStateAndUpdateFlags
PrjfDeleteTombstoneIfExists
PrjfOpenAndCheckEmptyPartialDirectory
PrjfOpenPlaceHolder
PrjfPostCreate
PrjfProcessFileDirectoryStatus
PrjfProcessTombstoneBounce|
|paramcount|12|0|
|`address`|14003c800|1400048b4|
|`sig`|int __fastcall PrjfOpenAsReparsePoint(wchar_t * param_1, undefined8 param_2, undefined8 param_3, undefined4 param_4, undefined8 param_5, longlong param_6, longlong param_7, byte * param_8, byte * param_9, byte * param_10, undefined8 * * * * * * * param_11, uint * param_12)|ulonglong __fastcall Feature_2998397241__private_IsEnabledDeviceUsageNoInline(void)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### PrjfOpenAsReparsePoint Called Diff
```diff
--- PrjfOpenAsReparsePoint called
+++ Feature_2998397241__private_IsEnabledDeviceUsageNoInline called
@@ -1,8 +1 @@
-FLTMGR.SYS::FltGetInstanceContext
-FLTMGR.SYS::FltReleaseContext
-MicrosoftTelemetryAssertTriggeredNoArgsKM
-NTOSKRNL.EXE::ExAllocateFromPagedLookasideList
-NTOSKRNL.EXE::ExFreeToPagedLookasideList
-PrjfOpenReparsePoint
-WPP_RECORDER_AND_TRACE_SF_sDD
-WPP_RECORDER_AND_TRACE_SF_sDdZssss
+Feature_2998397241__private_IsEnabledFallback
```
### PrjfOpenAsReparsePoint Calling Diff
```diff
--- PrjfOpenAsReparsePoint calling
+++ Feature_2998397241__private_IsEnabledDeviceUsageNoInline calling
@@ -3,0 +4 @@
+PrjfOpenPlaceHolder
```
### PrjfOpenAsReparsePoint Diff
```diff
--- PrjfOpenAsReparsePoint
+++ Feature_2998397241__private_IsEnabledDeviceUsageNoInline
@@ -1,274 +1,17 @@
-int PrjfOpenAsReparsePoint
- (wchar_t *param_1,undefined8 param_2,undefined8 param_3,undefined4 param_4,
- undefined8 param_5,longlong param_6,longlong param_7,byte *param_8,byte *param_9,
- byte *param_10,undefined8 *******param_11,uint *param_12)
+ulonglong Feature_2998397241__private_IsEnabledDeviceUsageNoInline(void)
{
- undefined8 uVar1;
- code *pcVar2;
- int iVar3;
- undefined8 ********ppppppppuVar4;
- undefined8 ********ppppppppuVar5;
- undefined8 ********ppppppppuVar6;
- undefined8 ********ppppppppuVar7;
- ulonglong uVar8;
- char *pcVar9;
- undefined8 ********ppppppppuVar10;
- undefined1 *puVar11;
- undefined1 *puVar12;
- undefined1 *puVar13;
- char *pcVar14;
- byte bVar15;
- char *pcVar16;
- undefined8 ********ppppppppuVar17;
- byte *unaff_R13;
- undefined8 ********ppppppppuVar18;
- uint uVar19;
- bool bVar20;
- undefined1 auStackY_e8 [8];
- undefined1 auStackY_e0 [24];
- ushort uVar21;
- longlong local_68;
- undefined8 *******local_60;
- undefined8 *******local_58;
+ ulonglong uVar1;
+ undefined8 local_res8;
- puVar11 = auStackY_e8;
- puVar12 = auStackY_e8;
- ppppppppuVar17 = (undefined8 ********)0x0;
- uVar19 = 0x80000004;
- local_68 = 0;
- ppppppppuVar18 = (undefined8 ********)0x0;
- ppppppppuVar10 = (undefined8 ********)0x0;
- puVar13 = auStackY_e8;
- if ((param_6 == 0) || (puVar13 = auStackY_e8, param_7 == 0)) goto LAB_0;
- iVar3 = FltGetInstanceContext(param_3,&local_68);
- if ((iVar3 < 0) || (local_68 == 0)) {
- MicrosoftTelemetryAssertTriggeredNoArgsKM();
- }
- if ((*(int *)(local_68 + 0x18) != 2) && (*(int *)(local_68 + 0x18) != 0x1c)) {
- MicrosoftTelemetryAssertTriggeredNoArgsKM();
- }
- if (param_12 != (uint *)0x0) {
- uVar19 = *param_12;
- }
- local_58 = &local_60;
- local_60 = &local_60;
- ppppppppuVar4 = ppppppppuVar17;
- ppppppppuVar7 = ppppppppuVar17;
- ppppppppuVar5 = ppppppppuVar17;
- ppppppppuVar6 = ppppppppuVar17;
- if (param_8 == (byte *)0x0) {
-LAB_1:
- uVar19 = uVar19 | 0x80000000;
- ppppppppuVar7 = ppppppppuVar10;
- if (param_9 != (byte *)0x0) {
- *param_9 = 0;
- ppppppppuVar5 = (undefined8 ********)ExAllocateFromPagedLookasideList(&DAT_2);
- ppppppppuVar6 = ppppppppuVar18;
- if (ppppppppuVar5 == (undefined8 ********)0x0) {
- bVar20 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
- bVar15 = DAT_3 & 4;
- if ((bVar15 != 0) || (puVar12 = auStackY_e8, bVar20)) {
- uVar21 = 0x33;
- goto LAB_4;
- }
- goto LAB_5;
- }
- ppppppppuVar5[1] = ppppppppuVar5;
- *ppppppppuVar5 = ppppppppuVar5;
- ppppppppuVar5[3] = (undefined8 *******)0x0;
- ppppppppuVar5[4] = (undefined8 *******)0x0;
- *(undefined4 *)(ppppppppuVar5 + 2) = 0xa000000c;
- *(uint *)((longlong)ppppppppuVar5 + 0x14) = uVar19;
- *(undefined4 *)(ppppppppuVar5 + 5) = 0x30;
- if ((undefined8 ********)*local_58 != &local_60) goto LAB_6;
- ppppppppuVar5[1] = local_58;
- *ppppppppuVar5 = &local_60;
- *local_58 = ppppppppuVar5;
- local_58 = ppppppppuVar5;
- }
- ppppppppuVar6 = ppppppppuVar17;
- unaff_R13 = param_10;
- if (param_10 != (byte *)0x0) {
- *param_10 = 0;
- ppppppppuVar6 = (undefined8 ********)ExAllocateFromPagedLookasideList(&DAT_2);
- if (ppppppppuVar6 == (undefined8 ********)0x0) {
- bVar20 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
- bVar15 = DAT_3 & 4;
- if ((bVar15 != 0) || (puVar12 = auStackY_e8, bVar20)) {
- uVar21 = 0x34;
- goto LAB_4;
- }
- goto LAB_5;
- }
- ppppppppuVar6[1] = ppppppppuVar6;
- *ppppppppuVar6 = ppppppppuVar6;
- ppppppppuVar6[3] = (undefined8 *******)0x0;
- ppppppppuVar6[4] = (undefined8 *******)0x0;
- *(undefined4 *)(ppppppppuVar6 + 2) = 0xa0000003;
- *(uint *)((longlong)ppppppppuVar6 + 0x14) = uVar19;
- *(undefined4 *)(ppppppppuVar6 + 5) = 0x30;
- if ((undefined8 ********)*local_58 != &local_60) goto LAB_6;
- ppppppppuVar6[1] = local_58;
- *ppppppppuVar6 = &local_60;
- *local_58 = ppppppppuVar6;
- local_58 = ppppppppuVar6;
- }
- ppppppppuVar7 = ppppppppuVar17;
- puVar13 = auStackY_e8;
- if (param_11 == (undefined8 *******)0x0) {
-LAB_7:
- puVar12 = puVar13;
- *(longlong *)(puVar12 + 0x40) = param_7;
- *(longlong *)(puVar12 + 0x38) = param_6;
- *(undefined8 *********)(puVar12 + 0x30) = &local_60;
- *(undefined4 *)(puVar12 + 0x20) = 0x28;
- *(undefined8 *)(puVar12 + -8) = 0x14003cc69;
- uVar8 = PrjfOpenReparsePoint
- (param_3,param_1,param_2,param_4,*(undefined4 *)(puVar12 + 0x20),
- *(undefined8 *)(puVar12 + 0x28),*(longlong **)(puVar12 + 0x30),
- *(undefined8 *)(puVar12 + 0x38),*(undefined8 *)(puVar12 + 0x40));
- iVar3 = (int)uVar8;
- if (iVar3 < 0) {
- if ((iVar3 != -0x3fffffcc) && (iVar3 != -0x3fffffc6)) {
- if (((DAT_3 & 4) != 0) ||
- ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
- pcVar16 = "did";
- pcVar14 = "did";
- if ((undefined8 ********)param_11 == (undefined8 ********)0x0) {
- pcVar14 = "did NOT";
- }
- pcVar9 = "did";
- *(char **)(puVar12 + 0x78) = pcVar14;
- if (param_10 == (byte *)0x0) {
- pcVar9 = "did NOT";
- }
- *(char **)(puVar12 + 0x70) = pcVar9;
- uVar1 = *(undefined8 *)(WPP_GLOBAL_Control + 0x40);
- if (param_9 == (byte *)0x0) {
- pcVar16 = "did NOT";
- }
- pcVar14 = "Did";
- *(char **)(puVar12 + 0x68) = pcVar16;
- if (param_8 == (byte *)0x0) {
- pcVar14 = "Did NOT";
- }
- *(char **)(puVar12 + 0x60) = pcVar14;
- *(wchar_t **)(puVar12 + 0x58) = param_1;
- *(int *)(puVar12 + 0x50) = iVar3;
- *(undefined8 *)(puVar12 + -8) = 0x14003cd30;
- WPP_RECORDER_AND_TRACE_SF_sDdZssss
- (pcVar9,DAT_3 & 4,
- (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,uVar1);
- }
- }
- }
- else {
- if (param_8 != (byte *)0x0) {
- *param_8 = *(byte *)((longlong)ppppppppuVar4 + 0x14) & 1;
- }
- if (param_9 != (byte *)0x0) {
- *param_9 = *(byte *)((longlong)ppppppppuVar5 + 0x14) & 1;
- }
- if (param_10 != (byte *)0x0) {
- *param_10 = *(byte *)((longlong)ppppppppuVar6 + 0x14) & 1;
- }
- if ((undefined8 ********)param_11 != (undefined8 ********)0x0) {
- *(byte *)param_11 = *(byte *)((longlong)ppppppppuVar7 + 0x14) & 1;
- }
- }
- }
- else {
- *(undefined1 *)param_11 = 0;
- ppppppppuVar7 = (undefined8 ********)ExAllocateFromPagedLookasideList(&DAT_2);
- if (ppppppppuVar7 != (undefined8 ********)0x0) {
- ppppppppuVar7[1] = ppppppppuVar7;
- *ppppppppuVar7 = ppppppppuVar7;
- ppppppppuVar7[3] = (undefined8 *******)0x0;
- ppppppppuVar7[4] = (undefined8 *******)0x0;
- *(undefined4 *)(ppppppppuVar7 + 2) = 0xa0000022;
- *(uint *)((longlong)ppppppppuVar7 + 0x14) = uVar19;
- *(undefined4 *)(ppppppppuVar7 + 5) = 0x30;
- ppppppppuVar17 = (undefined8 ********)param_11;
- if ((undefined8 ********)*local_58 != &local_60) goto LAB_6;
- goto LAB_8;
- }
- bVar20 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
- bVar15 = DAT_3 & 4;
- if ((bVar15 != 0) || (bVar20)) {
- uVar21 = 0x35;
- goto LAB_4;
- }
- }
+ local_res8 = (ulonglong)Feature_2998397241__private_featureState;
+ if ((Feature_2998397241__private_featureState & 0x10) == 0) {
+ uVar1 = Feature_2998397241__private_IsEnabledFallback(local_res8,3);
}
else {
- *param_8 = 0;
- ppppppppuVar4 = (undefined8 ********)ExAllocateFromPagedLookasideList(&DAT_2);
- if (ppppppppuVar4 != (undefined8 ********)0x0) {
- ppppppppuVar4[1] = ppppppppuVar4;
- *ppppppppuVar4 = ppppppppuVar4;
- ppppppppuVar4[3] = (undefined8 *******)0x0;
- ppppppppuVar4[4] = (undefined8 *******)0x0;
- *(undefined4 *)(ppppppppuVar4 + 2) = 0x9000001c;
- *(uint *)((longlong)ppppppppuVar4 + 0x14) = uVar19 | 0x80000000;
- *(undefined4 *)(ppppppppuVar4 + 5) = 0x30;
- if ((undefined8 ********)*local_58 == &local_60) {
- ppppppppuVar4[1] = local_58;
- *ppppppppuVar4 = &local_60;
- *local_58 = ppppppppuVar4;
- local_58 = ppppppppuVar4;
- goto LAB_1;
- }
-LAB_6:
- pcVar2 = (code *)swi(0x29);
- local_58 = (undefined8 *******)(*pcVar2)(3);
- puVar11 = auStackY_e0;
- param_11 = ppppppppuVar17;
- param_10 = unaff_R13;
-LAB_8:
- ppppppppuVar7[1] = local_58;
- *ppppppppuVar7 = &local_60;
- *local_58 = ppppppppuVar7;
- local_58 = ppppppppuVar7;
- puVar13 = puVar11;
- goto LAB_7;
- }
- bVar20 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
- bVar15 = DAT_3 & 4;
- if ((bVar15 != 0) || (puVar12 = auStackY_e8, bVar20)) {
- uVar21 = 0x32;
-LAB_4:
- WPP_RECORDER_AND_TRACE_SF_sDD
- (0x20a,bVar15,bVar20,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,10,uVar21,
- &WPP_20e7495dfd7e3f36bcabba5500ea3aac_Traceguids,
- "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
- puVar12 = auStackY_e8;
- }
+ uVar1 = (ulonglong)(Feature_2998397241__private_featureState & 1);
}
-LAB_5:
- if (local_68 != 0) {
- *(undefined8 *)(puVar12 + -8) = 0x14003cd89;
- FltReleaseContext();
- }
- if (ppppppppuVar4 != (undefined8 ********)0x0) {
- *(undefined8 *)(puVar12 + -8) = 0x14003cda4;
- ExFreeToPagedLookasideList(&DAT_2,ppppppppuVar4);
- }
- if (ppppppppuVar5 != (undefined8 ********)0x0) {
- *(undefined8 *)(puVar12 + -8) = 0x14003cdbf;
- ExFreeToPagedLookasideList(&DAT_2,ppppppppuVar5);
- }
- if (ppppppppuVar6 != (undefined8 ********)0x0) {
- *(undefined8 *)(puVar12 + -8) = 0x14003cdda;
- ExFreeToPagedLookasideList(&DAT_2,ppppppppuVar6);
- }
- puVar13 = puVar12;
- if (ppppppppuVar7 != (undefined8 ********)0x0) {
- *(undefined8 *)(puVar12 + -8) = 0x14003cdf5;
- ExFreeToPagedLookasideList(&DAT_2,ppppppppuVar7);
- }
-LAB_0:
- return (int)*(undefined8 *)(puVar13 + 0xa8);
+ return uVar1;
}
```
# Modified (No Code Changes)
*Slightly modified functions have no code changes, rather differnces in:*
- refcount
- length
- called
- calling
- name
- fullname
## FLTMGR.SYS::FltReleaseContext
### Match Info
|Key|pf_8737.sys - pf_8875.sys|
| :---: | :---: |
|diff_type|refcount,calling|
|ratio|1.0|
|i_ratio|1.0|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash,ExternalsName|
### Function Meta Diff
|Key|pf_8737.sys|pf_8875.sys|
| :---: | :---: | :---: |
|name|FltReleaseContext|FltReleaseContext|
|fullname|FLTMGR.SYS::FltReleaseContext|FLTMGR.SYS::FltReleaseContext|
|`refcount`|147|148|
|length|0|0|
|called|||
|`calling`|Expand for full list:
PrjFsctlDuplicateExtentsPreOp
PrjfAddInMemoryTombstone
PrjfBlockFsctlOperation
PrjfCleanUpRenameLinkTargetTombstone
PrjfContextCleanup
PrjfCreateFileContext
PrjfCreateRenameOrLinkCompletionContext
PrjfCreateStreamContext
PrjfDecideUpdateDeleteOnFileStateAndUpdateFlags
PrjfDeleteTombstoneIfExists
PrjfDoesNameExistInLayer
PrjfEnumerateDirectoryWithMerge
PrjfExpansionWorker
PrjfFindOrCreateTransactionContext
PrjfFlushAndUpdateDiskStateWorker
PrjfFreeInMemoryTombstoneHashTable
PrjfFsctlSetReparsePoint
PrjfFsctlSetReparsePointPostOp
PrjfGetContextFileObject
PrjfGetContextFileObjectEx
PrjfGetSetContextFileObject
PrjfGetSetFileContext
PrjfGetSetStreamContext
PrjfGetSetStreamHandleContext
PrjfGetUnionContext
PrjfGetUnionContextByFileName
PrjfInstanceQueryTeardown
PrjfInstanceSetup
PrjfIsDirectoryEmpty
PrjfIsNameOnPathOfRoot
PrjfIsPlaceholderFile
PrjfLaunchExpansion
PrjfNormalizeNameComponent
PrjfNotifyRenameOrLinkOperation
PrjfOpenAsReparsePoint
PrjfPartiallyExpandDirectory
PrjfPopulateFile
PrjfPortDisconnect
PrjfPortMessage
PrjfPostAcquireForSectionSynchronization
PrjfPostCleanup
PrjfPostCreate
PrjfPostFsControl
PrjfPostQueryInformation
PrjfPostWrite
PrjfPreAcquireForSectionSynchronization
PrjfPreCleanup
PrjfPreCreate
PrjfPreDirectoryControl
PrjfPreWrite
PrjfPrepareCommandForFileObject
PrjfPrepareForDelete
PrjfPrepareSourceForRename
PrjfProcessOpenWithinVirtualizationRoots
PrjfProcessPostRenameOrLinkInformation
PrjfProcessPrjReparsePointBounce
PrjfProcessTombstoneBounce
PrjfReleaseRenameOrLinkCompletionContext
PrjfRemoveInMemoryTombstone
PrjfRevertInMemoryTombstonesForDirectory
PrjfSendGetFileStreamCommand
PrjfSendNotifyOperationCommand
PrjfSetDeleteDisposition
PrjfSetParentPlaceHolderFlagsSynchronized
PrjfSetPlaceHolderFlagsSynchronized
PrjfSetUnionContext
PrjfSynchronizeExpansionPreopWithReason
PrjfValidateFilterFileIdentifierInputBuffer
PrjfVerifyAccessAndSetClientPortIfNeededExpand for full list:
PrjFsctlDuplicateExtentsPreOp
PrjfAddInMemoryTombstone
PrjfBlockFsctlOperation
PrjfCleanUpRenameLinkTargetTombstone
PrjfContextCleanup
PrjfCreateFileContext
PrjfCreateRenameOrLinkCompletionContext
PrjfCreateStreamContext
PrjfDecideUpdateDeleteOnFileStateAndUpdateFlags
PrjfDeleteTombstoneIfExists
PrjfDoesNameExistInLayer
PrjfEnumerateDirectoryWithMerge
PrjfExpansionWorker
PrjfFindOrCreateTransactionContext
PrjfFlushAndUpdateDiskStateWorker
PrjfFreeInMemoryTombstoneHashTable
PrjfFsctlSetReparsePoint
PrjfFsctlSetReparsePointPostOp
PrjfGetContextFileObject
PrjfGetContextFileObjectEx
PrjfGetSetContextFileObject
PrjfGetSetFileContext
PrjfGetSetStreamContext
PrjfGetSetStreamHandleContext
PrjfGetUnionContext
PrjfGetUnionContextByFileName
PrjfInstanceQueryTeardown
PrjfInstanceSetup
PrjfIsDirectoryEmpty
PrjfIsNameOnPathOfRoot
PrjfIsPlaceholderFile
PrjfLaunchExpansion
PrjfNormalizeNameComponent
PrjfNotifyRenameOrLinkOperation
PrjfOpenAsReparsePoint
PrjfOpenAsReparsePointOld
PrjfPartiallyExpandDirectory
PrjfPopulateFile
PrjfPortDisconnect
PrjfPortMessage
PrjfPostAcquireForSectionSynchronization
PrjfPostCleanup
PrjfPostCreate
PrjfPostFsControl
PrjfPostQueryInformation
PrjfPostWrite
PrjfPreAcquireForSectionSynchronization
PrjfPreCleanup
PrjfPreCreate
PrjfPreDirectoryControl
PrjfPreWrite
PrjfPrepareCommandForFileObject
PrjfPrepareForDelete
PrjfPrepareSourceForRename
PrjfProcessOpenWithinVirtualizationRoots
PrjfProcessPostRenameOrLinkInformation
PrjfProcessPrjReparsePointBounce
PrjfProcessTombstoneBounce
PrjfReleaseRenameOrLinkCompletionContext
PrjfRemoveInMemoryTombstone
PrjfRevertInMemoryTombstonesForDirectory
PrjfSendGetFileStreamCommand
PrjfSendNotifyOperationCommand
PrjfSetDeleteDisposition
PrjfSetParentPlaceHolderFlagsSynchronized
PrjfSetPlaceHolderFlagsSynchronized
PrjfSetUnionContext
PrjfSynchronizeExpansionPreopWithReason
PrjfValidateFilterFileIdentifierInputBuffer
PrjfVerifyAccessAndSetClientPortIfNeeded
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath|
|`calling`|Expand for full list:
Feature_1526925624__private_IsEnabledFallback
Feature_2096096568__private_IsEnabledFallback
Feature_2428439865__private_IsEnabledFallback
Feature_32499002__private_IsEnabledFallback
Feature_3303736635__private_IsEnabledFallback
Feature_3411221816__private_IsEnabledFallback
Feature_4243261755__private_IsEnabledFallback
Feature_440600889__private_IsEnabledFallback
Feature_78846265__private_IsEnabledFallback
Feature_EnableTestConfigViaFilterPort__private_IsEnabledFallback
Feature_ModernWpp__private_IsEnabledFallback
Expand for full list:
Feature_1526925624__private_IsEnabledFallback
Feature_2096096568__private_IsEnabledFallback
Feature_2428439865__private_IsEnabledFallback
Feature_2998397241__private_IsEnabledFallback
Feature_32499002__private_IsEnabledFallback
Feature_3303736635__private_IsEnabledFallback
Feature_3411221816__private_IsEnabledFallback
Feature_4243261755__private_IsEnabledFallback
Feature_440600889__private_IsEnabledFallback
Feature_78846265__private_IsEnabledFallback
Feature_EnableTestConfigViaFilterPort__private_IsEnabledFallback
Feature_ModernWpp__private_IsEnabledFallback
PrjfCreateSymbolicLink
PrjfCreateTombstone
PrjfNormalizeNameComponent
PrjfOpenReparsePoint|PrjfCopyAsPlaceHolder
PrjfCreateSymbolicLink
PrjfCreateTombstone
PrjfNormalizeNameComponent
PrjfOpenReparsePoint
PrjfOpenReparsePointOld|
|paramcount|0|0|
|address|EXTERNAL:000000bc|EXTERNAL:000000bc|
|sig|undefined FltInsertExtraCreateParameter(void)|undefined FltInsertExtraCreateParameter(void)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|True|True|
### FLTMGR.SYS::FltInsertExtraCreateParameter Calling Diff
```diff
--- FLTMGR.SYS::FltInsertExtraCreateParameter calling
+++ FLTMGR.SYS::FltInsertExtraCreateParameter calling
@@ -5,0 +6 @@
+PrjfOpenReparsePointOld
```
## FLTMGR.SYS::FltFreeExtraCreateParameterList
### Match Info
|Key|pf_8737.sys - pf_8875.sys|
| :---: | :---: |
|diff_type|refcount,calling|
|ratio|1.0|
|i_ratio|1.0|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash,ExternalsName|
### Function Meta Diff
|Key|pf_8737.sys|pf_8875.sys|
| :---: | :---: | :---: |
|name|FltFreeExtraCreateParameterList|FltFreeExtraCreateParameterList|
|fullname|FLTMGR.SYS::FltFreeExtraCreateParameterList|FLTMGR.SYS::FltFreeExtraCreateParameterList|
|`refcount`|6|7|
|length|0|0|
|called|||
|`calling`|PrjfCopyAsPlaceHolder
PrjfCreateSymbolicLink
PrjfCreateTombstone
PrjfNormalizeNameComponent
PrjfOpenReparsePoint|PrjfCopyAsPlaceHolder
PrjfCreateSymbolicLink
PrjfCreateTombstone
PrjfNormalizeNameComponent
PrjfOpenReparsePoint
PrjfOpenReparsePointOld|
|paramcount|0|0|
|address|EXTERNAL:000000bb|EXTERNAL:000000bb|
|sig|undefined FltFreeExtraCreateParameterList(void)|undefined FltFreeExtraCreateParameterList(void)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|True|True|
### FLTMGR.SYS::FltFreeExtraCreateParameterList Calling Diff
```diff
--- FLTMGR.SYS::FltFreeExtraCreateParameterList calling
+++ FLTMGR.SYS::FltFreeExtraCreateParameterList calling
@@ -5,0 +6 @@
+PrjfOpenReparsePointOld
```
## NTOSKRNL.EXE::ExAllocateFromPagedLookasideList
### Match Info
|Key|pf_8737.sys - pf_8875.sys|
| :---: | :---: |
|diff_type|refcount,calling|
|ratio|1.0|
|i_ratio|1.0|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash,ExternalsName|
### Function Meta Diff
|Key|pf_8737.sys|pf_8875.sys|
| :---: | :---: | :---: |
|name|ExAllocateFromPagedLookasideList|ExAllocateFromPagedLookasideList|
|fullname|NTOSKRNL.EXE::ExAllocateFromPagedLookasideList|NTOSKRNL.EXE::ExAllocateFromPagedLookasideList|
|`refcount`|14|18|
|length|0|0|
|called|||
|`calling`|PrjfAddSubContext
PrjfCreateRenameOrLinkCompletionContext
PrjfOpenAsReparsePoint
PrjfPreCleanup
PrjfPreCreate
PrjfPrepareCommandForFilePath
PrjfPrepareEnumerationContexts|PrjfAddSubContext
PrjfCreateRenameOrLinkCompletionContext
PrjfOpenAsReparsePoint
PrjfOpenAsReparsePointOld
PrjfPreCleanup
PrjfPreCreate
PrjfPrepareCommandForFilePath
PrjfPrepareEnumerationContexts|
|paramcount|0|0|
|address|EXTERNAL:00000067|EXTERNAL:00000067|
|sig|undefined ExAllocateFromPagedLookasideList(void)|undefined ExAllocateFromPagedLookasideList(void)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|True|True|
### NTOSKRNL.EXE::ExAllocateFromPagedLookasideList Calling Diff
```diff
--- NTOSKRNL.EXE::ExAllocateFromPagedLookasideList calling
+++ NTOSKRNL.EXE::ExAllocateFromPagedLookasideList calling
@@ -3,0 +4 @@
+PrjfOpenAsReparsePointOld
```
## WPP_RECORDER_AND_TRACE_SF_sDD
### Match Info
|Key|pf_8737.sys - pf_8875.sys|
| :---: | :---: |
|diff_type|refcount,calling|
|ratio|1.0|
|i_ratio|0.99|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|pf_8737.sys|pf_8875.sys|
| :---: | :---: | :---: |
|name|WPP_RECORDER_AND_TRACE_SF_sDD|WPP_RECORDER_AND_TRACE_SF_sDD|
|fullname|WPP_RECORDER_AND_TRACE_SF_sDD|WPP_RECORDER_AND_TRACE_SF_sDD|
|`refcount`|206|208|
|length|332|332|
|called|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|
|`calling`|Expand for full list:
DriverEntry
PrjfAddSubContext
PrjfAttachFilterHandler
PrjfBlockFsctlOperation
PrjfCheckAndCancelTransactedOpen
PrjfCheckDirectoryContentReparseTags
PrjfCleanUpRenameLinkTargetTombstone
PrjfClearAttributes
PrjfCompleteCommandHandler
PrjfCopyAsPlaceHolder
PrjfCopyFileBasicInformation
PrjfCopyFileMetaData
PrjfCopyStreamData
PrjfCreateFileContext
PrjfCreateInstanceTierNode
PrjfCreatePathTierNode
PrjfCreateRenameOrLinkCompletionContext
PrjfCreateStreamContext
PrjfCreateSymbolicLink
PrjfCreateSymlinkFromPlaceholderInfoMessage
PrjfCreateTombstone
PrjfDeleteFileHandler
PrjfDeleteTombstoneIfExists
PrjfDoesNameExistInLayer
PrjfEnumerateDirectoryWithMerge
PrjfExpandFile
PrjfFindOrCreateTransactionContext
PrjfFsctlGetFilterFileIdentifier
PrjfFsctlSetReparsePoint
PrjfFsctlStartVirtualizationInstance
PrjfGetInstanceFromVolumeName
PrjfGetSetFileContext
PrjfGetSetStreamContext
PrjfGetSetStreamHandleContext
PrjfGetUnionContext
PrjfGetUnionContextByFileName
PrjfGetUnionContextByFileNameEx
PrjfImpersonateAndAddSymlinkPrivilege
PrjfInitCommunicationPort
PrjfInstanceQueryTeardown
PrjfInstanceSetup
PrjfIsDirectoryEmpty
PrjfIsNameOnPathOfRoot
PrjfManageHydrationOnNonCachedHandle
PrjfMappingInsert
PrjfMergeEnumerationResults
PrjfMungeDirectoryEnumerateWithShortname
PrjfMungeDirectoryEnumerateWithShortnameFileId64
PrjfMungeDirectoryEnumerateWithShortnameFileIdAll
PrjfMungeDirectoryEnumerateWithoutShortname
PrjfMungeDirectoryEnumerateWithoutShortnameFileId64
PrjfMungeDirectoryEnumerateWithoutShortnameFileIdAll
PrjfNormalizeNameComponent
PrjfNotifyRenameOrLinkOperation
PrjfOpenAsReparsePoint
PrjfOpenFileHandler
PrjfOpenReparsePoint
PrjfPopulateDestinationForRenameOrLink
PrjfPopulateFile
PrjfPortConnect
PrjfPortDisconnect
PrjfPortMessage
PrjfPostAcquireForSectionSynchronization
PrjfPostCleanup
PrjfPostCreate
PrjfPostNetworkQueryOpen
PrjfPostSetDispositionInformation
PrjfPostSetInformation
PrjfPostSetRenameInformation
PrjfPreCleanup
PrjfPreCreate
PrjfPreDirectoryControl
PrjfPreSetDispositionInformation
PrjfPreSetLinkInformation
PrjfPreSetRenameInformation
PrjfPrepareCommandForFilePath
PrjfPrepareDestinationForRenameOrLink
PrjfPrepareEnumerationContexts
PrjfPrepareForDelete
PrjfPrepareSourceForRename
PrjfProcessFileDirectoryStatus
PrjfProcessOpenWithinVirtualizationRoots
PrjfProcessPostRenameOrLinkInformation
PrjfProcessPreRenameOrLinkInformation
PrjfProcessPrjReparsePointBounce
PrjfProcessTombstoneBounce
PrjfQueryAttributes
PrjfReadFileHandler
PrjfRelPathToFullPath
PrjfReleaseUnionContext
PrjfRemoveInMemoryTombstone
PrjfRemoveTombstonesFromDirectory
PrjfRevertInMemoryTombstonesForDirectory
PrjfSendCancelCommandInNewThread
PrjfSendCancelCommandWorker
PrjfSendCommand
PrjfSendEndDirectoryEnumerationCommand
PrjfSendNotifyOperationCommand
PrjfSendPostCreateNotifications
PrjfSetConfiguration
PrjfSetDeleteDisposition
PrjfSetParentPlaceHolderFlagsSynchronized
PrjfSetUnionContext
PrjfSetupVolumeInformationHandler
PrjfShouldAutoAttach
PrjfSleepOnTestSettingFlagsForTests
PrjfStoreNotificationMappingEntries
PrjfSynchronizeExpansionPreopWithReason
PrjfTelemetryAndTracingInit
PrjfTransactionNotification
PrjfUnload
PrjfUpdatePlaceholderIfNeededHandler
PrjfValidateAndGetGlobalVolumePath
PrjfValidateFileIdentifier
PrjfValidateFilterFileIdentifierInputBuffer
PrjfValidateNamesInEnumeration
PrjfValidateNotificationRoot
PrjfValidatePlaceholderInformationMessage
PrjfVerifyAccessAndSetClientPortIfNeeded
PrjfWriteFileDataHandler
PrjfWritePlaceholderInformationHandlerExpand for full list:
DriverEntry
PrjfAddSubContext
PrjfAttachFilterHandler
PrjfBlockFsctlOperation
PrjfCheckAndCancelTransactedOpen
PrjfCheckDirectoryContentReparseTags
PrjfCleanUpRenameLinkTargetTombstone
PrjfClearAttributes
PrjfCompleteCommandHandler
PrjfCopyAsPlaceHolder
PrjfCopyFileBasicInformation
PrjfCopyFileMetaData
PrjfCopyStreamData
PrjfCreateFileContext
PrjfCreateInstanceTierNode
PrjfCreatePathTierNode
PrjfCreateRenameOrLinkCompletionContext
PrjfCreateStreamContext
PrjfCreateSymbolicLink
PrjfCreateSymlinkFromPlaceholderInfoMessage
PrjfCreateTombstone
PrjfDeleteFileHandler
PrjfDeleteTombstoneIfExists
PrjfDoesNameExistInLayer
PrjfEnumerateDirectoryWithMerge
PrjfExpandFile
PrjfFindOrCreateTransactionContext
PrjfFsctlGetFilterFileIdentifier
PrjfFsctlSetReparsePoint
PrjfFsctlStartVirtualizationInstance
PrjfGetInstanceFromVolumeName
PrjfGetSetFileContext
PrjfGetSetStreamContext
PrjfGetSetStreamHandleContext
PrjfGetUnionContext
PrjfGetUnionContextByFileName
PrjfGetUnionContextByFileNameEx
PrjfImpersonateAndAddSymlinkPrivilege
PrjfInitCommunicationPort
PrjfInstanceQueryTeardown
PrjfInstanceSetup
PrjfIsDirectoryEmpty
PrjfIsNameOnPathOfRoot
PrjfManageHydrationOnNonCachedHandle
PrjfMappingInsert
PrjfMergeEnumerationResults
PrjfMungeDirectoryEnumerateWithShortname
PrjfMungeDirectoryEnumerateWithShortnameFileId64
PrjfMungeDirectoryEnumerateWithShortnameFileIdAll
PrjfMungeDirectoryEnumerateWithoutShortname
PrjfMungeDirectoryEnumerateWithoutShortnameFileId64
PrjfMungeDirectoryEnumerateWithoutShortnameFileIdAll
PrjfNormalizeNameComponent
PrjfNotifyRenameOrLinkOperation
PrjfOpenAsReparsePoint
PrjfOpenAsReparsePointOld
PrjfOpenFileHandler
PrjfOpenReparsePoint
PrjfOpenReparsePointOld
PrjfPopulateDestinationForRenameOrLink
PrjfPopulateFile
PrjfPortConnect
PrjfPortDisconnect
PrjfPortMessage
PrjfPostAcquireForSectionSynchronization
PrjfPostCleanup
PrjfPostCreate
PrjfPostNetworkQueryOpen
PrjfPostSetDispositionInformation
PrjfPostSetInformation
PrjfPostSetRenameInformation
PrjfPreCleanup
PrjfPreCreate
PrjfPreDirectoryControl
PrjfPreSetDispositionInformation
PrjfPreSetLinkInformation
PrjfPreSetRenameInformation
PrjfPrepareCommandForFilePath
PrjfPrepareDestinationForRenameOrLink
PrjfPrepareEnumerationContexts
PrjfPrepareForDelete
PrjfPrepareSourceForRename
PrjfProcessFileDirectoryStatus
PrjfProcessOpenWithinVirtualizationRoots
PrjfProcessPostRenameOrLinkInformation
PrjfProcessPreRenameOrLinkInformation
PrjfProcessPrjReparsePointBounce
PrjfProcessTombstoneBounce
PrjfQueryAttributes
PrjfReadFileHandler
PrjfRelPathToFullPath
PrjfReleaseUnionContext
PrjfRemoveInMemoryTombstone
PrjfRemoveTombstonesFromDirectory
PrjfRevertInMemoryTombstonesForDirectory
PrjfSendCancelCommandInNewThread
PrjfSendCancelCommandWorker
PrjfSendCommand
PrjfSendEndDirectoryEnumerationCommand
PrjfSendNotifyOperationCommand
PrjfSendPostCreateNotifications
PrjfSetConfiguration
PrjfSetDeleteDisposition
PrjfSetParentPlaceHolderFlagsSynchronized
PrjfSetUnionContext
PrjfSetupVolumeInformationHandler
PrjfShouldAutoAttach
PrjfSleepOnTestSettingFlagsForTests
PrjfStoreNotificationMappingEntries
PrjfSynchronizeExpansionPreopWithReason
PrjfTelemetryAndTracingInit
PrjfTransactionNotification
PrjfUnload
PrjfUpdatePlaceholderIfNeededHandler
PrjfValidateAndGetGlobalVolumePath
PrjfValidateFileIdentifier
PrjfValidateFilterFileIdentifierInputBuffer
PrjfValidateNamesInEnumeration
PrjfValidateNotificationRoot
PrjfValidatePlaceholderInformationMessage
PrjfVerifyAccessAndSetClientPortIfNeeded
PrjfWriteFileDataHandler
PrjfWritePlaceholderInformationHandlerExpand for full list:
PrjfCopyAsPlaceHolder
PrjfCreateSymbolicLink
PrjfCreateTombstone
PrjfDecideUpdateDeleteOnFileStateAndUpdateFlags
PrjfDoesRootHaveShortNameComponent
PrjfLookupEntryBackingLayerNegativePathCache
PrjfNormalizeNameComponent
PrjfOpenReparsePoint
PrjfPreCleanup
PrjfReopenFile
PrjfVerifyAccessAndSetClientPortIfNeeded
Expand for full list:
PrjfCopyAsPlaceHolder
PrjfCreateSymbolicLink
PrjfCreateTombstone
PrjfDecideUpdateDeleteOnFileStateAndUpdateFlags
PrjfDoesRootHaveShortNameComponent
PrjfLookupEntryBackingLayerNegativePathCache
PrjfNormalizeNameComponent
PrjfOpenReparsePoint
PrjfOpenReparsePointOld
PrjfPreCleanup
PrjfReopenFile
PrjfVerifyAccessAndSetClientPortIfNeeded
PrjfFreeEnumContexts
PrjfFreeEnumerationResultBuffer
PrjfOpenAsReparsePoint
PrjfPostCleanup
PrjfPostCreate
PrjfPreCleanup
PrjfPreCreate
PrjfProcessTombstoneBounce
PrjfReleaseRenameOrLinkCompletionContext|Expand for full list:
PrjfFreeCommandBuffer
PrjfFreeEnumContexts
PrjfFreeEnumerationResultBuffer
PrjfOpenAsReparsePoint
PrjfOpenAsReparsePointOld
PrjfPostCleanup
PrjfPostCreate
PrjfPreCleanup
PrjfPreCreate
PrjfProcessTombstoneBounce
PrjfReleaseRenameOrLinkCompletionContext
Expand for full list:
PrjfGetSetFileContext
PrjfGetUnionContext
PrjfGetUnionContextByFileName
PrjfInstanceQueryTeardown
PrjfIsNameOnPathOfRoot
PrjfNormalizeNameComponent
PrjfOpenAsReparsePoint
PrjfPortDisconnect
PrjfPortMessage
PrjfSetUnionContext
PrjfValidateFilterFileIdentifierInputBuffer
PrjfVerifyAccessAndSetClientPortIfNeededExpand for full list:
PrjfGetSetFileContext
PrjfGetUnionContext
PrjfGetUnionContextByFileName
PrjfInstanceQueryTeardown
PrjfIsNameOnPathOfRoot
PrjfNormalizeNameComponent
PrjfOpenAsReparsePoint
PrjfOpenAsReparsePointOld
PrjfPortDisconnect
PrjfPortMessage
PrjfSetUnionContext
PrjfValidateFilterFileIdentifierInputBuffer
PrjfVerifyAccessAndSetClientPortIfNeededExpand for full list:
PrjfAllocateCommandTableEntry
PrjfAllocateHandleTableEntry
PrjfAllocateUnicodeString
PrjfCheckAndCancelTransactedOpen
PrjfCleanUpRenameLinkTargetTombstone
PrjfContextCleanup
PrjfCopyAsPlaceHolder
PrjfCopyStreamData
PrjfCreateFileContext
PrjfCreateRenameOrLinkCompletionContext
PrjfCreateSymbolicLink
PrjfDecideUpdateDeleteOnFileStateAndUpdateFlags
PrjfDoesNameExistInLayer
PrjfEnumerateLayeredDirectories
PrjfExpandAndPend
PrjfExpandFile
PrjfExpansionWorker
PrjfFreeCommandBuffer
PrjfFreeEnumerationResultBuffer
PrjfFsctlSetReparsePoint
PrjfFsctlSetReparsePointPostOp
PrjfFsctlStartVirtualizationInstance
PrjfGenerateFileName
PrjfGetContextFileObject
PrjfGetContextFileObjectEx
PrjfGetPrjReparseData
PrjfGetSetContextFileObject
PrjfGetSetFileContext
PrjfGetSetStreamContext
PrjfGetUnionContext
PrjfGetUnionContextByFileName
PrjfGetUnionContextByFileNameEx
PrjfImpersonateAndAddSymlinkPrivilege
PrjfInstanceSetup
PrjfIsNameOnPathOfRoot
PrjfLaunchExpansion
PrjfManageHydrationOnNonCachedHandle
PrjfMergeEnumerationResults
PrjfMungeDirectoryEnumerateWithShortname
PrjfMungeDirectoryEnumerateWithShortnameFileId64
PrjfMungeDirectoryEnumerateWithShortnameFileIdAll
PrjfMungeDirectoryEnumerateWithoutShortname
PrjfMungeDirectoryEnumerateWithoutShortnameFileId64
PrjfMungeDirectoryEnumerateWithoutShortnameFileIdAll
PrjfMungeNamesEnumerate
PrjfMungeReparseEnumerate
PrjfNormalizeNameComponent
PrjfNotifyRenameOrLinkOperation
PrjfOpenAsReparsePoint
PrjfOpenFileHandler
PrjfOpenReparsePoint
PrjfParseParentAndNextComponentPathName
PrjfPartiallyExpandDirectory
PrjfPopulateDestinationForRenameOrLink
PrjfPortConnect
PrjfPortDisconnect
PrjfPostCleanup
PrjfPostCreate
PrjfPostQueryOpen
PrjfPostQueryVolumeInformation
PrjfPreAcquireForSectionSynchronization
PrjfPreCleanup
PrjfPreDirectoryControl
PrjfPreLockControl
PrjfPreSetLinkInformation
PrjfPreSetRenameInformation
PrjfPrepareEnumerationContexts
PrjfPrepareSourceForRename
PrjfProcessOpenWithinVirtualizationRoots
PrjfProcessPostRenameOrLinkInformation
PrjfProcessPreRenameOrLinkInformation
PrjfProcessPrjReparsePointBounce
PrjfProcessTombstoneBounce
PrjfReadFileHandler
PrjfReleaseUnionContext
PrjfRemoveSparse
PrjfSendCommand
PrjfSendCommandAndWaitForCompletion
PrjfSendEndDirectoryEnumerationCommand
PrjfSendGetDirectoryEnumerationCommand
PrjfSetParentPlaceHolderFlagsSynchronized
PrjfSetPlaceHolderFlagsSynchronized
PrjfSetupVolumeInformationHandler
PrjfShouldAutoAttach
PrjfStopImpersonating
PrjfStoreNotificationMappingEntries
PrjfUntagFile
PrjfUpdatePlaceholderIfNeededHandler
PrjfValidateNamesInEnumeration
PrjfValidatePlaceholderInformationMessageExpand for full list:
PrjfAllocateCommandTableEntry
PrjfAllocateHandleTableEntry
PrjfAllocateUnicodeString
PrjfCheckAndCancelTransactedOpen
PrjfCleanUpRenameLinkTargetTombstone
PrjfContextCleanup
PrjfCopyAsPlaceHolder
PrjfCopyStreamData
PrjfCreateFileContext
PrjfCreateRenameOrLinkCompletionContext
PrjfCreateSymbolicLink
PrjfDecideUpdateDeleteOnFileStateAndUpdateFlags
PrjfDoesNameExistInLayer
PrjfEnumerateLayeredDirectories
PrjfExpandAndPend
PrjfExpandFile
PrjfExpansionWorker
PrjfFreeCommandBuffer
PrjfFreeEnumerationResultBuffer
PrjfFsctlSetReparsePoint
PrjfFsctlSetReparsePointPostOp
PrjfFsctlStartVirtualizationInstance
PrjfGenerateFileName
PrjfGetContextFileObject
PrjfGetContextFileObjectEx
PrjfGetPrjReparseData
PrjfGetSetContextFileObject
PrjfGetSetFileContext
PrjfGetSetStreamContext
PrjfGetUnionContext
PrjfGetUnionContextByFileName
PrjfGetUnionContextByFileNameEx
PrjfImpersonateAndAddSymlinkPrivilege
PrjfInstanceSetup
PrjfIsNameOnPathOfRoot
PrjfLaunchExpansion
PrjfManageHydrationOnNonCachedHandle
PrjfMergeEnumerationResults
PrjfMungeDirectoryEnumerateWithShortname
PrjfMungeDirectoryEnumerateWithShortnameFileId64
PrjfMungeDirectoryEnumerateWithShortnameFileIdAll
PrjfMungeDirectoryEnumerateWithoutShortname
PrjfMungeDirectoryEnumerateWithoutShortnameFileId64
PrjfMungeDirectoryEnumerateWithoutShortnameFileIdAll
PrjfMungeNamesEnumerate
PrjfMungeReparseEnumerate
PrjfNormalizeNameComponent
PrjfNotifyRenameOrLinkOperation
PrjfOpenAsReparsePoint
PrjfOpenAsReparsePointOld
PrjfOpenFileHandler
PrjfOpenReparsePoint
PrjfOpenReparsePointOld
PrjfParseParentAndNextComponentPathName
PrjfPartiallyExpandDirectory
PrjfPopulateDestinationForRenameOrLink
PrjfPortConnect
PrjfPortDisconnect
PrjfPostCleanup
PrjfPostCreate
PrjfPostQueryOpen
PrjfPostQueryVolumeInformation
PrjfPreAcquireForSectionSynchronization
PrjfPreCleanup
PrjfPreDirectoryControl
PrjfPreLockControl
PrjfPreSetLinkInformation
PrjfPreSetRenameInformation
PrjfPrepareEnumerationContexts
PrjfPrepareSourceForRename
PrjfProcessOpenWithinVirtualizationRoots
PrjfProcessPostRenameOrLinkInformation
PrjfProcessPreRenameOrLinkInformation
PrjfProcessPrjReparsePointBounce
PrjfProcessTombstoneBounce
PrjfReadFileHandler
PrjfReleaseUnionContext
PrjfRemoveSparse
PrjfSendCommand
PrjfSendCommandAndWaitForCompletion
PrjfSendEndDirectoryEnumerationCommand
PrjfSendGetDirectoryEnumerationCommand
PrjfSetParentPlaceHolderFlagsSynchronized
PrjfSetPlaceHolderFlagsSynchronized
PrjfSetupVolumeInformationHandler
PrjfShouldAutoAttach
PrjfStopImpersonating
PrjfStoreNotificationMappingEntries
PrjfUntagFile
PrjfUpdatePlaceholderIfNeededHandler
PrjfValidateNamesInEnumeration
PrjfValidatePlaceholderInformationMessage
WPPRECORDER.SYS::WppAutoLogTrace|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|
|`calling`|Expand for full list:
PrjfAddInMemoryTombstone
PrjfCopyAsPlaceHolder
PrjfCopyStreamData
PrjfCreateHardLink
PrjfCreatePathTierNode
PrjfCreateRenameOrLinkCompletionContext
PrjfCreateSymbolicLink
PrjfDecideUpdateDeleteOnFileStateAndUpdateFlags
PrjfDeleteTombstoneIfExists
PrjfDoesNameExistInLayer
PrjfDoesRootHaveShortNameComponent
PrjfExpandAndPend
PrjfExpandAndWait
PrjfExpandFile
PrjfFlushAndUpdateDiskStateWorker
PrjfFsctlSetReparsePoint
PrjfGetNotificationMask
PrjfIsFileObjectWithinActiveVirtualizationRoots
PrjfLaunchExpansion
PrjfManageHydrationOnNonCachedHandle
PrjfNormalizeNameComponent
PrjfOpenAndCheckEmptyPartialDirectory
PrjfOpenFileHandler
PrjfOpenParentPlaceHolder
PrjfOpenPlaceHolder
PrjfOpenReparsePoint
PrjfPopulateFile
PrjfPostCreate
PrjfPostWrite
PrjfProcessOpenWithinVirtualizationRoots
PrjfProcessPrjReparsePointBounce
PrjfProcessTombstoneBounce
PrjfRemoveInMemoryTombstone
PrjfRemoveSparse
PrjfSendEndDirectoryEnumerationCommand
PrjfSendGetDirectoryEnumerationCommand
PrjfSendGetFileStreamCommand
PrjfSendGetPlaceholderInformationCommand
PrjfSendNotifyOperationCommand
PrjfSendQueryFileNameCommand
PrjfSendStartDirectoryEnumerationCommand
PrjfSetDeleteDisposition
PrjfTelemetryPostExpansionComplete
PrjfUntagFile
PrjfWriteFileDataHandlerExpand for full list:
PrjfAddInMemoryTombstone
PrjfCopyAsPlaceHolder
PrjfCopyStreamData
PrjfCreateHardLink
PrjfCreatePathTierNode
PrjfCreateRenameOrLinkCompletionContext
PrjfCreateSymbolicLink
PrjfDecideUpdateDeleteOnFileStateAndUpdateFlags
PrjfDeleteTombstoneIfExists
PrjfDoesNameExistInLayer
PrjfDoesRootHaveShortNameComponent
PrjfExpandAndPend
PrjfExpandAndWait
PrjfExpandFile
PrjfFlushAndUpdateDiskStateWorker
PrjfFsctlSetReparsePoint
PrjfGetNotificationMask
PrjfIsFileObjectWithinActiveVirtualizationRoots
PrjfLaunchExpansion
PrjfManageHydrationOnNonCachedHandle
PrjfNormalizeNameComponent
PrjfOpenAndCheckEmptyPartialDirectory
PrjfOpenFileHandler
PrjfOpenParentPlaceHolder
PrjfOpenPlaceHolder
PrjfOpenReparsePoint
PrjfOpenReparsePointOld
PrjfPopulateFile
PrjfPostCreate
PrjfPostWrite
PrjfProcessOpenWithinVirtualizationRoots
PrjfProcessPrjReparsePointBounce
PrjfProcessTombstoneBounce
PrjfRemoveInMemoryTombstone
PrjfRemoveSparse
PrjfSendEndDirectoryEnumerationCommand
PrjfSendGetDirectoryEnumerationCommand
PrjfSendGetFileStreamCommand
PrjfSendGetPlaceholderInformationCommand
PrjfSendNotifyOperationCommand
PrjfSendQueryFileNameCommand
PrjfSendStartDirectoryEnumerationCommand
PrjfSetDeleteDisposition
PrjfTelemetryPostExpansionComplete
PrjfUntagFile
PrjfWriteFileDataHandler
PrjfCreateSymbolicLink
PrjfCreateTombstone
PrjfNormalizeNameComponent
PrjfOpenReparsePoint|PrjfCopyAsPlaceHolder
PrjfCreateSymbolicLink
PrjfCreateTombstone
PrjfNormalizeNameComponent
PrjfOpenReparsePoint
PrjfOpenReparsePointOld|
|paramcount|0|0|
|address|EXTERNAL:000000be|EXTERNAL:000000be|
|sig|undefined FltAllocateExtraCreateParameterList(void)|undefined FltAllocateExtraCreateParameterList(void)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|True|True|
### FLTMGR.SYS::FltAllocateExtraCreateParameterList Calling Diff
```diff
--- FLTMGR.SYS::FltAllocateExtraCreateParameterList calling
+++ FLTMGR.SYS::FltAllocateExtraCreateParameterList calling
@@ -5,0 +6 @@
+PrjfOpenReparsePointOld
```
## FLTMGR.SYS::FltAllocateExtraCreateParameterFromLookasideList
### Match Info
|Key|pf_8737.sys - pf_8875.sys|
| :---: | :---: |
|diff_type|refcount,calling|
|ratio|1.0|
|i_ratio|1.0|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash,ExternalsName|
### Function Meta Diff
|Key|pf_8737.sys|pf_8875.sys|
| :---: | :---: | :---: |
|name|FltAllocateExtraCreateParameterFromLookasideList|FltAllocateExtraCreateParameterFromLookasideList|
|fullname|FLTMGR.SYS::FltAllocateExtraCreateParameterFromLookasideList|FLTMGR.SYS::FltAllocateExtraCreateParameterFromLookasideList|
|`refcount`|6|7|
|length|0|0|
|called|||
|`calling`|PrjfCopyAsPlaceHolder
PrjfCreateSymbolicLink
PrjfCreateTombstone
PrjfNormalizeNameComponent
PrjfOpenReparsePoint|PrjfCopyAsPlaceHolder
PrjfCreateSymbolicLink
PrjfCreateTombstone
PrjfNormalizeNameComponent
PrjfOpenReparsePoint
PrjfOpenReparsePointOld|
|paramcount|0|0|
|address|EXTERNAL:000000bd|EXTERNAL:000000bd|
|sig|undefined FltAllocateExtraCreateParameterFromLookasideList(void)|undefined FltAllocateExtraCreateParameterFromLookasideList(void)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|True|True|
### FLTMGR.SYS::FltAllocateExtraCreateParameterFromLookasideList Calling Diff
```diff
--- FLTMGR.SYS::FltAllocateExtraCreateParameterFromLookasideList calling
+++ FLTMGR.SYS::FltAllocateExtraCreateParameterFromLookasideList calling
@@ -5,0 +6 @@
+PrjfOpenReparsePointOld
```
Generated with `ghidriff` version: 1.0.0 on 2026-08-22T11:16:40