# pf_8972.sys-pf_9168.sys Diff

# TOC

* [Visual Chart Diff](#visual-chart-diff)
* [Metadata](#metadata)
	* [Ghidra Diff Engine](#ghidra-diff-engine)
		* [Command Line](#command-line)
	* [Binary Metadata Diff](#binary-metadata-diff)
	* [Program Options](#program-options)
	* [Diff Stats](#diff-stats)
	* [Strings](#strings)
* [Deleted](#deleted)
* [Added](#added)
	* [Feature_66039097__private_IsEnabledDeviceUsageNoInline](#feature_66039097__private_isenableddeviceusagenoinline)
	* [Feature_66039097__private_IsEnabledFallback](#feature_66039097__private_isenabledfallback)
	* [WPP_RECORDER_AND_TRACE_SF_sDdHH](#wpp_recorder_and_trace_sf_sddhh)
* [Modified](#modified)
	* [PrjfProcessPrjReparsePointBounce](#prjfprocessprjreparsepointbounce)
	* [PrjfLookupEntryBackingLayerNegativePathCache](#prjflookupentrybackinglayernegativepathcache)
* [Modified (No Code Changes)](#modified-no-code-changes)
	* [wil_details_IsEnabledFallback](#wil_details_isenabledfallback)
	* [WPPRECORDER.SYS::WppAutoLogTrace](#wpprecordersyswppautologtrace)
	* [FastWppTraceMessage](#fastwpptracemessage)

# Visual Chart Diff



```mermaid

flowchart LR

PrjfProcessPrjReparsePointBounce-8-old<--Match 82%-->PrjfProcessPrjReparsePointBounce-8-new
PrjfLookupEntryBackingLayerNegativePathCache-8-old<--Match 95%-->PrjfLookupEntryBackingLayerNegativePathCache-8-new

subgraph pf_9168.sys
    PrjfProcessPrjReparsePointBounce-8-new
PrjfLookupEntryBackingLayerNegativePathCache-8-new
    subgraph Added
direction LR
Feature_66039097__private_IsEnabledDeviceUsageNoInline
    Feature_66039097__private_IsEnabledFallback
    WPP_RECORDER_AND_TRACE_SF_sDdHH
end
end

subgraph pf_8972.sys
    PrjfProcessPrjReparsePointBounce-8-old
PrjfLookupEntryBackingLayerNegativePathCache-8-old
    
end

```


```mermaid
pie showData
    title Function Matches - 99.7766%
"unmatched_funcs_len" : 3
"matched_funcs_len" : 1340
```



```mermaid
pie showData
    title Matched Function Similarity - 99.6269%
"matched_funcs_with_code_changes_len" : 2
"matched_funcs_with_non_code_changes_len" : 3
"matched_funcs_no_changes_len" : 1335
```

# Metadata

## Ghidra Diff Engine

### Command Line

#### Captured Command Line


```
ghidriff --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --bsim --max-ram-percent 60.0 --max-section-funcs 200 pf_8972.sys pf_9168.sys
```


#### Verbose Args


<details>

```
--old ['pf_8972.sys'] --new [['pf_9168.sys']] --engine VersionTrackingDiff --output-path pf_out --summary False --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim True --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title None
```


</details>

#### Download Original PEs


```
wget https://msdl.microsoft.com/download/symbols/prjflt.sys/E583634050000/prjflt.sys -O prjflt.sys.x64.10.0.26100.8972
wget https://msdl.microsoft.com/download/symbols/prjflt.sys/D84D84F151000/prjflt.sys -O prjflt.sys.x64.10.0.26100.9168
```


## Binary Metadata Diff


```diff
--- pf_8972.sys Meta
+++ pf_9168.sys Meta
@@ -1,44 +1,44 @@
-Program Name: pf_8972.sys
+Program Name: pf_9168.sys
 Language ID: x86:LE:64:default (4.6)
 Compiler ID: windows
 Processor: x86
 Endian: Little
 Address Size: 64
 Minimum Address: 140000000
 Maximum Address: ff0000184f
-# of Bytes: 333904
+# of Bytes: 338000
 # of Memory Blocks: 15
-# of Instructions: 54219
-# of Defined Data: 2218
-# of Functions: 670
-# of Symbols: 7894
+# of Instructions: 54335
+# of Defined Data: 2226
+# of Functions: 673
+# of Symbols: 7926
 # of Data Types: 166
 # of Data Type Categories: 12
 Analyzed: true
 Compiler: visualstudio:unknown
 Created With Ghidra Version: 12.0.4
-Date Created: Fri Aug 21 23:44:57 SGT 2026
+Date Created: Fri Aug 21 23:45:00 SGT 2026
 Executable Format: Portable Executable (PE)
-Executable Location: /tmp/pf51/pf_8972.sys
-Executable MD5: 9acbac27bff01e204c228b7548455514
-Executable SHA256: bc4f4ca80b6867fc0f9c284c5628fc03dd8e266d7dea8ff3927a6db700448bef
-FSRL: file:///tmp/pf51/pf_8972.sys?MD5=9acbac27bff01e204c228b7548455514
+Executable Location: /tmp/pf51/pf_9168.sys
+Executable MD5: d7c39c405263a6f199f577ef6c3cb6f6
+Executable SHA256: 63f1efd43e8084f9c83034b193f32b483927ddbe3b5d3ec7f308cab4e945201a
+FSRL: file:///tmp/pf51/pf_9168.sys?MD5=d7c39c405263a6f199f577ef6c3cb6f6
 PDB Age: 1
 PDB File: prjflt.pdb
-PDB GUID: 4cc3776f-cff1-f56c-84fc-29fde1e0d9b5
+PDB GUID: 3060fca1-2a8b-ca29-9f66-3f81485dba85
 PDB Loaded: true
 PDB Version: RSDS
 PE Property[CompanyName]: Microsoft Corporation
 PE Property[FileDescription]: Windows Projected File System FS Filter Driver
-PE Property[FileVersion]: 10.0.26100.8972 (WinBuild.160101.0800)
+PE Property[FileVersion]: 10.0.26100.9168 (WinBuild.160101.0800)
 PE Property[InternalName]: prjflt.sys
 PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved.
 PE Property[OriginalFilename]: prjflt.sys
 PE Property[ProductName]: Microsoft(R) Windows(R) Kits
-PE Property[ProductVersion]: 10.0.26100.8972
+PE Property[ProductVersion]: 10.0.26100.9168
 PE Property[Translation]: 4b00409
 Preferred Root Namespace Category: 
 RTTI Found: false
 Relocatable: true
 SectionAlignment: 4096
 Should Ask To Analyze: false

```


## Program Options


<details>
<summary>Ghidra pf_8972.sys Decompiler Options</summary>


|Decompiler Option|Value|
| :---: | :---: |
|Prototype Evaluation|__fastcall|

</details>


<details>
<summary>Ghidra pf_8972.sys Specification extensions Options</summary>


|Specification extensions Option|Value|
| :---: | :---: |
|FormatVersion|0|
|VersionCounter|0|

</details>


<details>
<summary>Ghidra pf_8972.sys Analyzers Options</summary>


|Analyzers Option|Value|
| :---: | :---: |
|ASCII Strings|true|
|ASCII Strings.Create Strings Containing Existing Strings|true|
|ASCII Strings.Create Strings Containing References|true|
|ASCII Strings.Force Model Reload|false|
|ASCII Strings.Minimum String Length|LEN_5|
|ASCII Strings.Model File|StringModel.sng|
|ASCII Strings.Require Null Termination for String|true|
|ASCII Strings.Search Only in Accessible Memory Blocks|true|
|ASCII Strings.String Start Alignment|ALIGN_1|
|ASCII Strings.String end alignment|4|
|Aggressive Instruction Finder|false|
|Aggressive Instruction Finder.Create Analysis Bookmarks|true|
|Apply Data Archives|true|
|Apply Data Archives.Archive Chooser|[Auto-Detect]|
|Apply Data Archives.Create Analysis Bookmarks|true|
|Apply Data Archives.GDT User File Archive Path|None|
|Apply Data Archives.User Project Archive Path|None|
|Call Convention ID|true|
|Call Convention ID.Analysis Decompiler Timeout (sec)|60|
|Call-Fixup Installer|true|
|Condense Filler Bytes|false|
|Condense Filler Bytes.Filler Value|Auto|
|Condense Filler Bytes.Minimum number of sequential bytes|1|
|Create Address Tables|true|
|Create Address Tables.Allow Offcut References|false|
|Create Address Tables.Auto Label Table|false|
|Create Address Tables.Create Analysis Bookmarks|true|
|Create Address Tables.Maxmimum Pointer Distance|16777215|
|Create Address Tables.Minimum Pointer Address|4132|
|Create Address Tables.Minimum Table Size|2|
|Create Address Tables.Pointer Alignment|1|
|Create Address Tables.Relocation Table Guide|true|
|Create Address Tables.Table Alignment|4|
|Data Reference|true|
|Data Reference.Address Table Alignment|1|
|Data Reference.Address Table Minimum Size|2|
|Data Reference.Align End of Strings|false|
|Data Reference.Ascii String References|true|
|Data Reference.Create Address Tables|true|
|Data Reference.Minimum String Length|5|
|Data Reference.References to Pointers|true|
|Data Reference.Relocation Table Guide|true|
|Data Reference.Respect Execute Flag|true|
|Data Reference.Subroutine References|true|
|Data Reference.Switch Table References|false|
|Data Reference.Unicode String References|true|
|Decompiler Parameter ID|true|
|Decompiler Parameter ID.Analysis Clear Level|ANALYSIS|
|Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60|
|Decompiler Parameter ID.Commit Data Types|true|
|Decompiler Parameter ID.Commit Void Return Values|false|
|Decompiler Parameter ID.Prototype Evaluation|__fastcall|
|Decompiler Switch Analysis|true|
|Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60|
|Demangler Microsoft|true|
|Demangler Microsoft.Apply Function Calling Conventions|true|
|Demangler Microsoft.Apply Function Signatures|true|
|Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS|
|Demangler Microsoft.Demangle Only Known Mangled Symbols|false|
|Disassemble Entry Points|true|
|Disassemble Entry Points.Respect Execute Flag|true|
|Embedded Media|true|
|Embedded Media.Create Analysis Bookmarks|true|
|External Entry References|true|
|Function ID|true|
|Function ID.Always Apply FID Labels|false|
|Function ID.Create Analysis Bookmarks|true|
|Function ID.Instruction Count Threshold|14.6|
|Function ID.Multiple Match Threshold|30.0|
|Function Start Search|true|
|Function Start Search.Bookmark Functions|false|
|Function Start Search.Search Data Blocks|false|
|Non-Returning Functions - Discovered|true|
|Non-Returning Functions - Discovered.Create Analysis Bookmarks|true|
|Non-Returning Functions - Discovered.Function Non-return Threshold|3|
|Non-Returning Functions - Discovered.Repair Flow Damage|true|
|Non-Returning Functions - Known|true|
|Non-Returning Functions - Known.Create Analysis Bookmarks|true|
|PDB MSDIA|false|
|PDB MSDIA.Search untrusted symbol servers|false|
|PDB Universal|true|
|PDB Universal.Import Source Line Info|true|
|PDB Universal.Search untrusted symbol servers|false|
|Reference|true|
|Reference.Address Table Alignment|1|
|Reference.Address Table Minimum Size|2|
|Reference.Align End of Strings|false|
|Reference.Ascii String References|true|
|Reference.Create Address Tables|true|
|Reference.Minimum String Length|5|
|Reference.References to Pointers|true|
|Reference.Relocation Table Guide|true|
|Reference.Respect Execute Flag|true|
|Reference.Subroutine References|true|
|Reference.Switch Table References|false|
|Reference.Unicode String References|true|
|Scalar Operand References|true|
|Scalar Operand References.Relocation Table Guide|true|
|Shared Return Calls|true|
|Shared Return Calls.Allow Conditional Jumps|false|
|Shared Return Calls.Assume Contiguous Functions Only|true|
|Stack|true|
|Stack.Create Local Variables|true|
|Stack.Create Param Variables|false|
|Stack.Max Threads|2|
|Subroutine References|true|
|Subroutine References.Create Thunks Early|true|
|Variadic Function Signature Override|false|
|Variadic Function Signature Override.Create Analysis Bookmarks|false|
|Windows x86 PE Exception Handling|true|
|Windows x86 PE RTTI Analyzer|true|
|Windows x86 Thread Environment Block (TEB) Analyzer|true|
|Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB||
|Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7|
|WindowsPE x86 Propagate External Parameters|false|
|WindowsResourceReference|true|
|WindowsResourceReference.Create Analysis Bookmarks|true|
|x86 Constant Reference Analyzer|true|
|x86 Constant Reference Analyzer.Create Data from pointer|false|
|x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true|
|x86 Constant Reference Analyzer.Max Threads|2|
|x86 Constant Reference Analyzer.Min absolute reference|4|
|x86 Constant Reference Analyzer.Require pointer param data type|false|
|x86 Constant Reference Analyzer.Speculative reference max|256|
|x86 Constant Reference Analyzer.Speculative reference min|1024|
|x86 Constant Reference Analyzer.Stored Value Pointer analysis|true|
|x86 Constant Reference Analyzer.Trust values read from writable memory|true|

</details>


<details>
<summary>Ghidra pf_9168.sys Decompiler Options</summary>


|Decompiler Option|Value|
| :---: | :---: |
|Prototype Evaluation|__fastcall|

</details>


<details>
<summary>Ghidra pf_9168.sys Specification extensions Options</summary>


|Specification extensions Option|Value|
| :---: | :---: |
|FormatVersion|0|
|VersionCounter|0|

</details>


<details>
<summary>Ghidra pf_9168.sys Analyzers Options</summary>


|Analyzers Option|Value|
| :---: | :---: |
|ASCII Strings|true|
|ASCII Strings.Create Strings Containing Existing Strings|true|
|ASCII Strings.Create Strings Containing References|true|
|ASCII Strings.Force Model Reload|false|
|ASCII Strings.Minimum String Length|LEN_5|
|ASCII Strings.Model File|StringModel.sng|
|ASCII Strings.Require Null Termination for String|true|
|ASCII Strings.Search Only in Accessible Memory Blocks|true|
|ASCII Strings.String Start Alignment|ALIGN_1|
|ASCII Strings.String end alignment|4|
|Aggressive Instruction Finder|false|
|Aggressive Instruction Finder.Create Analysis Bookmarks|true|
|Apply Data Archives|true|
|Apply Data Archives.Archive Chooser|[Auto-Detect]|
|Apply Data Archives.Create Analysis Bookmarks|true|
|Apply Data Archives.GDT User File Archive Path|None|
|Apply Data Archives.User Project Archive Path|None|
|Call Convention ID|true|
|Call Convention ID.Analysis Decompiler Timeout (sec)|60|
|Call-Fixup Installer|true|
|Condense Filler Bytes|false|
|Condense Filler Bytes.Filler Value|Auto|
|Condense Filler Bytes.Minimum number of sequential bytes|1|
|Create Address Tables|true|
|Create Address Tables.Allow Offcut References|false|
|Create Address Tables.Auto Label Table|false|
|Create Address Tables.Create Analysis Bookmarks|true|
|Create Address Tables.Maxmimum Pointer Distance|16777215|
|Create Address Tables.Minimum Pointer Address|4132|
|Create Address Tables.Minimum Table Size|2|
|Create Address Tables.Pointer Alignment|1|
|Create Address Tables.Relocation Table Guide|true|
|Create Address Tables.Table Alignment|4|
|Data Reference|true|
|Data Reference.Address Table Alignment|1|
|Data Reference.Address Table Minimum Size|2|
|Data Reference.Align End of Strings|false|
|Data Reference.Ascii String References|true|
|Data Reference.Create Address Tables|true|
|Data Reference.Minimum String Length|5|
|Data Reference.References to Pointers|true|
|Data Reference.Relocation Table Guide|true|
|Data Reference.Respect Execute Flag|true|
|Data Reference.Subroutine References|true|
|Data Reference.Switch Table References|false|
|Data Reference.Unicode String References|true|
|Decompiler Parameter ID|true|
|Decompiler Parameter ID.Analysis Clear Level|ANALYSIS|
|Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60|
|Decompiler Parameter ID.Commit Data Types|true|
|Decompiler Parameter ID.Commit Void Return Values|false|
|Decompiler Parameter ID.Prototype Evaluation|__fastcall|
|Decompiler Switch Analysis|true|
|Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60|
|Demangler Microsoft|true|
|Demangler Microsoft.Apply Function Calling Conventions|true|
|Demangler Microsoft.Apply Function Signatures|true|
|Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS|
|Demangler Microsoft.Demangle Only Known Mangled Symbols|false|
|Disassemble Entry Points|true|
|Disassemble Entry Points.Respect Execute Flag|true|
|Embedded Media|true|
|Embedded Media.Create Analysis Bookmarks|true|
|External Entry References|true|
|Function ID|true|
|Function ID.Always Apply FID Labels|false|
|Function ID.Create Analysis Bookmarks|true|
|Function ID.Instruction Count Threshold|14.6|
|Function ID.Multiple Match Threshold|30.0|
|Function Start Search|true|
|Function Start Search.Bookmark Functions|false|
|Function Start Search.Search Data Blocks|false|
|Non-Returning Functions - Discovered|true|
|Non-Returning Functions - Discovered.Create Analysis Bookmarks|true|
|Non-Returning Functions - Discovered.Function Non-return Threshold|3|
|Non-Returning Functions - Discovered.Repair Flow Damage|true|
|Non-Returning Functions - Known|true|
|Non-Returning Functions - Known.Create Analysis Bookmarks|true|
|PDB MSDIA|false|
|PDB MSDIA.Search untrusted symbol servers|false|
|PDB Universal|true|
|PDB Universal.Import Source Line Info|true|
|PDB Universal.Search untrusted symbol servers|false|
|Reference|true|
|Reference.Address Table Alignment|1|
|Reference.Address Table Minimum Size|2|
|Reference.Align End of Strings|false|
|Reference.Ascii String References|true|
|Reference.Create Address Tables|true|
|Reference.Minimum String Length|5|
|Reference.References to Pointers|true|
|Reference.Relocation Table Guide|true|
|Reference.Respect Execute Flag|true|
|Reference.Subroutine References|true|
|Reference.Switch Table References|false|
|Reference.Unicode String References|true|
|Scalar Operand References|true|
|Scalar Operand References.Relocation Table Guide|true|
|Shared Return Calls|true|
|Shared Return Calls.Allow Conditional Jumps|false|
|Shared Return Calls.Assume Contiguous Functions Only|true|
|Stack|true|
|Stack.Create Local Variables|true|
|Stack.Create Param Variables|false|
|Stack.Max Threads|2|
|Subroutine References|true|
|Subroutine References.Create Thunks Early|true|
|Variadic Function Signature Override|false|
|Variadic Function Signature Override.Create Analysis Bookmarks|false|
|Windows x86 PE Exception Handling|true|
|Windows x86 PE RTTI Analyzer|true|
|Windows x86 Thread Environment Block (TEB) Analyzer|true|
|Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB||
|Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7|
|WindowsPE x86 Propagate External Parameters|false|
|WindowsResourceReference|true|
|WindowsResourceReference.Create Analysis Bookmarks|true|
|x86 Constant Reference Analyzer|true|
|x86 Constant Reference Analyzer.Create Data from pointer|false|
|x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true|
|x86 Constant Reference Analyzer.Max Threads|2|
|x86 Constant Reference Analyzer.Min absolute reference|4|
|x86 Constant Reference Analyzer.Require pointer param data type|false|
|x86 Constant Reference Analyzer.Speculative reference max|256|
|x86 Constant Reference Analyzer.Speculative reference min|1024|
|x86 Constant Reference Analyzer.Stored Value Pointer analysis|true|
|x86 Constant Reference Analyzer.Trust values read from writable memory|true|

</details>

## Diff Stats



|Stat|Value|
| :---: | :---: |
|added_funcs_len|3|
|deleted_funcs_len|0|
|modified_funcs_len|5|
|added_symbols_len|4|
|deleted_symbols_len|1|
|diff_time|3.2049059867858887|
|deleted_strings_len|0|
|added_strings_len|0|
|match_types|Counter({'SymbolsHash': 669, 'ExternalsName': 258})|
|items_to_process|13|
|diff_types|Counter({'refcount': 3, 'calling': 3, 'code': 2, 'length': 2, 'address': 2, 'called': 1})|
|unmatched_funcs_len|3|
|total_funcs_len|1343|
|matched_funcs_len|1340|
|matched_funcs_with_code_changes_len|2|
|matched_funcs_with_non_code_changes_len|3|
|matched_funcs_no_changes_len|1335|
|match_func_similarity_percent|99.6269%|
|func_match_overall_percent|99.7766%|
|first_matches|Counter({'SymbolsHash': 669})|



```mermaid
pie showData
    title All Matches
"SymbolsHash" : 669
"ExternalsName" : 258
```



```mermaid
pie showData
    title First Matches
"SymbolsHash" : 669
```



```mermaid
pie showData
    title Diff Stats
"added_funcs_len" : 3
"deleted_funcs_len" : 0
"modified_funcs_len" : 5
```



```mermaid
pie showData
    title Symbols
"added_symbols_len" : 4
"deleted_symbols_len" : 1
```

## Strings


*No string differences found*

# Deleted

# Added

## Feature_66039097__private_IsEnabledDeviceUsageNoInline

### Function Meta



|Key|pf_9168.sys|
| :---: | :---: |
|name|Feature_66039097__private_IsEnabledDeviceUsageNoInline|
|fullname|Feature_66039097__private_IsEnabledDeviceUsageNoInline|
|refcount|2|
|length|49|
|called|Feature_66039097__private_IsEnabledFallback|
|calling|PrjfLookupEntryBackingLayerNegativePathCache|
|paramcount|0|
|address|140007034|
|sig|ulonglong __fastcall Feature_66039097__private_IsEnabledDeviceUsageNoInline(void)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|


```diff
--- Feature_66039097__private_IsEnabledDeviceUsageNoInline
+++ Feature_66039097__private_IsEnabledDeviceUsageNoInline
@@ -0,0 +1,17 @@
+
+ulonglong Feature_66039097__private_IsEnabledDeviceUsageNoInline(void)
+
+{
+  ulonglong uVar1;
+  undefined8 local_res8;
+  
+  local_res8 = (ulonglong)Feature_66039097__private_featureState;
+  if ((Feature_66039097__private_featureState & 0x10) == 0) {
+    uVar1 = Feature_66039097__private_IsEnabledFallback(local_res8,3);
+  }
+  else {
+    uVar1 = (ulonglong)(Feature_66039097__private_featureState & 1);
+  }
+  return uVar1;
+}
+

```


## Feature_66039097__private_IsEnabledFallback

### Function Meta



|Key|pf_9168.sys|
| :---: | :---: |
|name|Feature_66039097__private_IsEnabledFallback|
|fullname|Feature_66039097__private_IsEnabledFallback|
|refcount|2|
|length|21|
|called|wil_details_IsEnabledFallback|
|calling|Feature_66039097__private_IsEnabledDeviceUsageNoInline|
|paramcount|2|
|address|14000706c|
|sig|undefined __fastcall Feature_66039097__private_IsEnabledFallback(ulonglong param_1, int param_2)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|


```diff
--- Feature_66039097__private_IsEnabledFallback
+++ Feature_66039097__private_IsEnabledFallback
@@ -0,0 +1,8 @@
+
+void Feature_66039097__private_IsEnabledFallback(ulonglong param_1,int param_2)
+
+{
+  wil_details_IsEnabledFallback(param_1,param_2,&Feature_66039097__private_descriptor);
+  return;
+}
+

```


## WPP_RECORDER_AND_TRACE_SF_sDdHH

### Function Meta



|Key|pf_9168.sys|
| :---: | :---: |
|name|WPP_RECORDER_AND_TRACE_SF_sDdHH|
|fullname|WPP_RECORDER_AND_TRACE_SF_sDdHH|
|refcount|2|
|length|324|
|called|FastWppTraceMessage<br>WPPRECORDER.SYS::WppAutoLogTrace|
|calling|PrjfLookupEntryBackingLayerNegativePathCache|
|paramcount|4|
|address|140012dc8|
|sig|undefined __fastcall WPP_RECORDER_AND_TRACE_SF_sDdHH(undefined8 param_1, char param_2, char param_3, undefined8 param_4)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|


```diff
--- WPP_RECORDER_AND_TRACE_SF_sDdHH
+++ WPP_RECORDER_AND_TRACE_SF_sDdHH
@@ -0,0 +1,22 @@
+
+void WPP_RECORDER_AND_TRACE_SF_sDdHH
+               (undefined8 param_1,char param_2,char param_3,undefined8 param_4)
+
+{
+  undefined4 local_28 [2];
+  undefined4 local_20 [2];
+  
+  local_28[0] = 0xc0000106;
+  local_20[0] = 0x1dcd;
+  if (param_2 != '\0') {
+    FastWppTraceMessage(0x205,0xb5,&WPP_8e9fec0fc8053b2ba5e7afee61831e70_Traceguids,
+                        "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c");
+  }
+  if (param_3 != '\0') {
+    WppAutoLogTrace(param_4,2,5,&WPP_8e9fec0fc8053b2ba5e7afee61831e70_Traceguids,0xb5,
+                    "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",0x29,local_20,4,local_28,4,
+                    &stack0x00000060,2,&stack0x00000068,2,0);
+  }
+  return;
+}
+

```


# Modified


*Modified functions contain code changes*
## PrjfProcessPrjReparsePointBounce

### Match Info



|Key|pf_8972.sys - pf_9168.sys|
| :---: | :---: |
|diff_type|code,length,address|
|ratio|0.56|
|i_ratio|0.56|
|m_ratio|1.0|
|b_ratio|0.82|
|match_types|SymbolsHash|

### Function Meta Diff



|Key|pf_8972.sys|pf_9168.sys|
| :---: | :---: | :---: |
|name|PrjfProcessPrjReparsePointBounce|PrjfProcessPrjReparsePointBounce|
|fullname|PrjfProcessPrjReparsePointBounce|PrjfProcessPrjReparsePointBounce|
|refcount|2|2|
|`length`|1460|1472|
|called|<details><summary>Expand for full list:<br>FLTMGR.SYS::FltClose<br>FLTMGR.SYS::FltParseFileNameInformation<br>FLTMGR.SYS::FltReleaseContext<br>MicrosoftTelemetryAssertTriggeredNoArgsKM<br>NTOSKRNL.EXE::ObfDereferenceObject<br>NTOSKRNL.EXE::RtlFreeUnicodeString<br>PrjfGetSetContextFileObject<br>PrjfInsertEntryBackingLayerNegativePathCache<br>PrjfLookupEntryBackingLayerNegativePathCache<br>PrjfOpenPlaceHolder<br>PrjfParseParentAndNextComponentPathName</summary>PrjfPartiallyExpandDirectory<br>PrjfReleaseUnionContext<br>PrjfTelemetryTombstoneFailureOperation<br>WPP_RECORDER_AND_TRACE_SF_sD<br>WPP_RECORDER_AND_TRACE_SF_sDD<br>WPP_RECORDER_AND_TRACE_SF_sDdZ</details>|<details><summary>Expand for full list:<br>FLTMGR.SYS::FltClose<br>FLTMGR.SYS::FltParseFileNameInformation<br>FLTMGR.SYS::FltReleaseContext<br>MicrosoftTelemetryAssertTriggeredNoArgsKM<br>NTOSKRNL.EXE::ObfDereferenceObject<br>NTOSKRNL.EXE::RtlFreeUnicodeString<br>PrjfGetSetContextFileObject<br>PrjfInsertEntryBackingLayerNegativePathCache<br>PrjfLookupEntryBackingLayerNegativePathCache<br>PrjfOpenPlaceHolder<br>PrjfParseParentAndNextComponentPathName</summary>PrjfPartiallyExpandDirectory<br>PrjfReleaseUnionContext<br>PrjfTelemetryTombstoneFailureOperation<br>WPP_RECORDER_AND_TRACE_SF_sD<br>WPP_RECORDER_AND_TRACE_SF_sDD<br>WPP_RECORDER_AND_TRACE_SF_sDdZ</details>|
|calling|PrjfPostCreate|PrjfPostCreate|
|paramcount|8|8|
|`address`|1400251b8|1400261b8|
|sig|ulonglong __fastcall PrjfProcessPrjReparsePointBounce(longlong param_1, undefined8 param_2, longlong param_3, ushort param_4, uint * param_5, char * param_6, longlong * param_7, undefined1 * param_8)|ulonglong __fastcall PrjfProcessPrjReparsePointBounce(longlong param_1, undefined8 param_2, longlong param_3, ushort param_4, uint * param_5, char * param_6, longlong * param_7, undefined1 * param_8)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|

### PrjfProcessPrjReparsePointBounce Diff


```diff
--- PrjfProcessPrjReparsePointBounce
+++ PrjfProcessPrjReparsePointBounce
@@ -1,236 +1,235 @@
 
 ulonglong PrjfProcessPrjReparsePointBounce
                     (longlong param_1,undefined8 param_2,longlong param_3,ushort param_4,
                     uint *param_5,char *param_6,longlong *param_7,undefined1 *param_8)
 
 {
   undefined1 *puVar1;
   uint uVar2;
   int iVar3;
   ulonglong uVar4;
   byte bVar5;
   ulonglong uVar6;
   char cVar7;
   longlong lVar8;
   wchar_t *pwVar9;
   bool bVar10;
   ushort uVar11;
   undefined4 in_stack_ffffffffffffff54;
   undefined4 in_stack_ffffffffffffff5c;
   char local_98;
   byte local_97 [3];
   undefined4 local_94;
   longlong local_90;
   longlong local_88;
   longlong local_80;
   longlong local_78;
   longlong local_70;
   wchar_t local_68 [24];
   undefined8 local_38;
   undefined8 uStack_30;
   
   puVar1 = param_8;
-  bVar10 = false;
   local_70 = 0;
   local_90 = 0;
-  local_97[0] = 0;
-  *param_8 = 0;
-  local_98 = '\0';
   local_80 = 0;
   local_78 = 0;
+  local_88 = 0;
+  local_94 = 0;
+  *param_8 = 0;
+  local_97[0] = 0;
+  local_98 = '\0';
   local_68[0] = L'\0';
   local_68[1] = L'\0';
   local_68[2] = L'\0';
   local_68[3] = L'\0';
   local_68[4] = L'\0';
   local_68[5] = L'\0';
   local_68[6] = L'\0';
   local_68[7] = L'\0';
-  local_88 = 0;
   local_68[8] = L'\0';
   local_68[9] = L'\0';
   local_68[10] = L'\0';
   local_68[0xb] = L'\0';
   local_68[0xc] = L'\0';
   local_68[0xd] = L'\0';
   local_68[0xe] = L'\0';
   local_68[0xf] = L'\0';
-  local_94 = 0;
   local_68[0x10] = L'\0';
   local_68[0x11] = L'\0';
   local_68[0x12] = L'\0';
   local_68[0x13] = L'\0';
   local_68[0x14] = L'\0';
   local_68[0x15] = L'\0';
   local_68[0x16] = L'\0';
   local_68[0x17] = L'\0';
   local_38 = 0;
   uStack_30 = 0;
   uVar2 = FltParseFileNameInformation(param_3);
   uVar6 = (ulonglong)uVar2;
   if ((int)uVar2 < 0) {
     bVar10 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
     bVar5 = DAT_0 & 0x20;
     if ((bVar5 == 0) && (!bVar10)) goto LAB_1;
     uVar11 = 0x11;
   }
   else {
     if (param_4 < *(ushort *)(param_3 + 0x58)) {
       MicrosoftTelemetryAssertTriggeredNoArgsKM();
     }
     pwVar9 = local_68;
     uVar2 = PrjfParseParentAndNextComponentPathName
                       ((ulonglong *)(param_3 + 8),param_4,(ushort *)pwVar9,local_68 + 8,
                        local_68 + 0x10,&local_98);
     cVar7 = local_98;
     uVar6 = (ulonglong)uVar2;
     if (-1 < (int)uVar2) {
       if ((*(char *)(*(longlong *)(param_1 + 0x10) + 0x23) == '\x01') || (local_98 == '\0')) {
         param_8._0_1_ = '\0';
         pwVar9 = local_68 + 0x10;
         bVar10 = true;
         uVar4 = PrjfLookupEntryBackingLayerNegativePathCache
                           (param_2,local_68,pwVar9,(ushort *)(local_68 + 8),&local_88,&local_38,
                            &local_94,(undefined1 *)&param_8);
         uVar6 = uVar4 & 0xffffffff;
         if ((int)uVar4 < 0) {
           if (((DAT_0 & 0x20) != 0) ||
              ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
             WPP_RECORDER_AND_TRACE_SF_sDdZ
                       (0x205,DAT_0 & 0x20,
                        (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
                        *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,0x13,
                        &WPP_1ed884329d1b317a4917ab36bbc71259_Traceguids,
                        "onecore\\base\\fs\\gvflt\\filter\\sys\\create.c",
                        CONCAT44(in_stack_ffffffffffffff54,0x2c9),
                        CONCAT44(in_stack_ffffffffffffff5c,(int)uVar4),local_68 + 8);
           }
-        }
-        else {
-          if ((char)param_8 == '\0') goto LAB_2;
+          goto LAB_1;
+        }
+        if ((char)param_8 != '\0') {
           uVar6 = (ulonglong)((-(uint)(cVar7 != '\0') & 0xfffffffa) + 0xc000003a);
+          goto LAB_1;
         }
       }
       else {
-LAB_2:
-        uVar2 = PrjfOpenPlaceHolder(param_2,local_68,pwVar9,&local_70,&local_90,local_97);
-        lVar8 = local_90;
+        bVar10 = false;
+      }
+      uVar2 = PrjfOpenPlaceHolder(param_2,local_68,pwVar9,&local_70,&local_90,local_97);
+      lVar8 = local_90;
+      uVar6 = (ulonglong)uVar2;
+      if ((int)uVar2 < 0) {
+        if (uVar2 == 0xc0000279) {
+          uVar6 = 0xc000003a;
+        }
+        else if (((DAT_0 & 0x20) != 0) ||
+                ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+          WPP_RECORDER_AND_TRACE_SF_sDdZ
+                    (0x205,DAT_0 & 0x20,
+                     (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+                     *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,0x14,
+                     &WPP_1ed884329d1b317a4917ab36bbc71259_Traceguids,
+                     "onecore\\base\\fs\\gvflt\\filter\\sys\\create.c",
+                     CONCAT44(in_stack_ffffffffffffff54,0x309),
+                     CONCAT44(in_stack_ffffffffffffff5c,uVar2),local_68);
+          lVar8 = local_90;
+        }
+      }
+      else {
+        if (local_97[0] == 0) goto LAB_2;
+        uVar2 = PrjfGetSetContextFileObject
+                          (param_2,local_90,-0x80000000,'\x01','\0',(undefined4 *)0x0,
+                           (undefined2 *)0x0,&local_80,&local_78);
         uVar6 = (ulonglong)uVar2;
         if ((int)uVar2 < 0) {
-          if (uVar2 == 0xc0000279) {
-            uVar6 = 0xc000003a;
-          }
-          else if (((DAT_0 & 0x20) != 0) ||
-                  ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+          if (((DAT_0 & 0x20) != 0) ||
+             ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
             WPP_RECORDER_AND_TRACE_SF_sDdZ
                       (0x205,DAT_0 & 0x20,
                        (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
-                       *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,0x14,
+                       *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,0x15,
                        &WPP_1ed884329d1b317a4917ab36bbc71259_Traceguids,
                        "onecore\\base\\fs\\gvflt\\filter\\sys\\create.c",
-                       CONCAT44(in_stack_ffffffffffffff54,0x309),
-                       CONCAT44(in_stack_ffffffffffffff5c,uVar2),local_68);
-            lVar8 = local_90;
-          }
-        }
-        else {
-          if (local_97[0] == 0) goto LAB_3;
-          uVar2 = PrjfGetSetContextFileObject
-                            (param_2,local_90,-0x80000000,'\x01','\0',(undefined4 *)0x0,
-                             (undefined2 *)0x0,&local_80,&local_78);
-          uVar6 = (ulonglong)uVar2;
-          if ((int)uVar2 < 0) {
-            if (((DAT_0 & 0x20) != 0) ||
-               ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
-              WPP_RECORDER_AND_TRACE_SF_sDdZ
-                        (0x205,DAT_0 & 0x20,
-                         (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
-                         *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,0x15,
-                         &WPP_1ed884329d1b317a4917ab36bbc71259_Traceguids,
-                         "onecore\\base\\fs\\gvflt\\filter\\sys\\create.c",
-                         CONCAT44(in_stack_ffffffffffffff54,800),
-                         CONCAT44(in_stack_ffffffffffffff5c,uVar2),(wchar_t *)(lVar8 + 0x58));
-            }
-            goto LAB_4;
-          }
-          uVar4 = PrjfPartiallyExpandDirectory(param_1,param_2,lVar8,local_68 + 0x10);
-          iVar3 = (int)uVar4;
-          uVar6 = uVar4 & 0xffffffff;
-          if (iVar3 < 0) {
-            if (iVar3 == -0x3ffffdd3) {
-              if (*param_5 < 0x14) {
-                *param_5 = *param_5 + 1;
-                cVar7 = '\0';
-              }
-              else {
-                if (((DAT_0 & 0x20) != 0) ||
-                   ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
-                  WPP_RECORDER_AND_TRACE_SF_sD
-                            (0x205,DAT_0 & 0x20,
-                             (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
-                             *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,0x16,
-                             &WPP_1ed884329d1b317a4917ab36bbc71259_Traceguids,
-                             "onecore\\base\\fs\\gvflt\\filter\\sys\\create.c");
-                }
-                PrjfTelemetryTombstoneFailureOperation(4,8,0xc000022d);
-              }
-LAB_5:
-              uVar6 = 0;
-              goto LAB_3;
-            }
-            if (iVar3 == -0x3fffffcc) {
-              uVar6 = uVar4 & 0xffffffff;
-              if (cVar7 == '\0') {
-                uVar6 = 0xc000003a;
-              }
-              if (!bVar10) goto LAB_5;
-              PrjfInsertEntryBackingLayerNegativePathCache
-                        (local_88,(undefined2 *)&local_38,local_94);
-            }
-          }
-          else {
-            *puVar1 = 1;
-LAB_3:
-            *param_6 = cVar7;
-            if (cVar7 == '\0') {
-              *param_7 = 0;
+                       CONCAT44(in_stack_ffffffffffffff54,800),
+                       CONCAT44(in_stack_ffffffffffffff5c,uVar2),(wchar_t *)(lVar8 + 0x58));
+          }
+          goto LAB_3;
+        }
+        uVar4 = PrjfPartiallyExpandDirectory(param_1,param_2,lVar8,local_68 + 0x10);
+        iVar3 = (int)uVar4;
+        uVar6 = uVar4 & 0xffffffff;
+        if (iVar3 < 0) {
+          if (iVar3 == -0x3ffffdd3) {
+            if (*param_5 < 0x14) {
+              *param_5 = *param_5 + 1;
+              cVar7 = '\0';
             }
             else {
-              *param_7 = lVar8;
-              lVar8 = 0;
+              if (((DAT_0 & 0x20) != 0) ||
+                 ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+                WPP_RECORDER_AND_TRACE_SF_sD
+                          (0x205,DAT_0 & 0x20,
+                           (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+                           *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,0x16,
+                           &WPP_1ed884329d1b317a4917ab36bbc71259_Traceguids,
+                           "onecore\\base\\fs\\gvflt\\filter\\sys\\create.c");
+              }
+              PrjfTelemetryTombstoneFailureOperation(4,8,0xc000022d);
             }
-          }
 LAB_4:
-          if (local_80 != 0) {
-            FltReleaseContext();
-          }
-          if (local_78 != 0) {
-            FltReleaseContext();
-          }
-        }
-        if (local_70 != 0) {
-          FltClose();
-        }
-        if (lVar8 != 0) {
-          ObfDereferenceObject(lVar8);
-        }
-      }
-      if (local_88 != 0) {
-        PrjfReleaseUnionContext(local_88);
+            uVar6 = 0;
+            goto LAB_2;
+          }
+          if (iVar3 == -0x3fffffcc) {
+            uVar6 = uVar4 & 0xffffffff;
+            if (cVar7 == '\0') {
+              uVar6 = 0xc000003a;
+            }
+            if (!bVar10) goto LAB_4;
+            PrjfInsertEntryBackingLayerNegativePathCache(local_88,(undefined2 *)&local_38,local_94);
+          }
+        }
+        else {
+          *puVar1 = 1;
+LAB_2:
+          *param_6 = cVar7;
+          if (cVar7 == '\0') {
+            *param_7 = 0;
+          }
+          else {
+            *param_7 = lVar8;
+            lVar8 = 0;
+          }
+        }
+LAB_3:
+        if (local_80 != 0) {
+          FltReleaseContext();
+        }
+        if (local_78 != 0) {
+          FltReleaseContext();
+        }
+      }
+      if (local_70 != 0) {
+        FltClose();
+      }
+      if (lVar8 != 0) {
+        ObfDereferenceObject(lVar8);
       }
       goto LAB_1;
     }
     bVar10 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
     bVar5 = DAT_0 & 0x20;
     if ((bVar5 == 0) && (!bVar10)) goto LAB_1;
     uVar11 = 0x12;
   }
   WPP_RECORDER_AND_TRACE_SF_sDD
             (0x205,bVar5,bVar10,*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,uVar11,
              &WPP_1ed884329d1b317a4917ab36bbc71259_Traceguids,
              "onecore\\base\\fs\\gvflt\\filter\\sys\\create.c");
 LAB_1:
+  if (local_88 != 0) {
+    PrjfReleaseUnionContext(local_88);
+  }
   RtlFreeUnicodeString(&local_38);
   return uVar6;
 }
 

```


## PrjfLookupEntryBackingLayerNegativePathCache

### Match Info



|Key|pf_8972.sys - pf_9168.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.91|
|i_ratio|0.59|
|m_ratio|0.97|
|b_ratio|0.95|
|match_types|SymbolsHash|

### Function Meta Diff



|Key|pf_8972.sys|pf_9168.sys|
| :---: | :---: | :---: |
|name|PrjfLookupEntryBackingLayerNegativePathCache|PrjfLookupEntryBackingLayerNegativePathCache|
|fullname|PrjfLookupEntryBackingLayerNegativePathCache|PrjfLookupEntryBackingLayerNegativePathCache|
|refcount|2|2|
|`length`|1657|1780|
|`called`|<details><summary>Expand for full list:<br>FLTMGR.SYS::FltAcquireResourceShared<br>FLTMGR.SYS::FltClose<br>FLTMGR.SYS::FltCreateFileEx2<br>FLTMGR.SYS::FltGetFileNameInformationUnsafe<br>FLTMGR.SYS::FltReleaseFileNameInformation<br>FLTMGR.SYS::FltReleaseResource<br>Feature_Servicing_MSRC109658__private_IsEnabledDeviceUsageNoInline<br>NTOSKRNL.EXE::ExFreePoolWithTag<br>NTOSKRNL.EXE::ObfDereferenceObject<br>NTOSKRNL.EXE::RtlCompareUnicodeString<br>NTOSKRNL.EXE::RtlDowncaseUnicodeString</summary>NTOSKRNL.EXE::RtlGetNextEntryHashTable<br>NTOSKRNL.EXE::RtlHashUnicodeString<br>NTOSKRNL.EXE::RtlLookupEntryHashTable<br>PrjfAllocateUnicodeString<br>PrjfGetUnionContextByFileNameEx<br>PrjfReleaseUnionContext<br>WPP_RECORDER_AND_TRACE_SF_sDdZZ<br>WPP_RECORDER_AND_TRACE_SF_sDdZZZq<br>WPP_RECORDER_AND_TRACE_SF_sDdZZq<br>WPP_RECORDER_AND_TRACE_SF_sDdZd<br>memmove</details>|<details><summary>Expand for full list:<br>FLTMGR.SYS::FltAcquireResourceShared<br>FLTMGR.SYS::FltClose<br>FLTMGR.SYS::FltCreateFileEx2<br>FLTMGR.SYS::FltGetFileNameInformationUnsafe<br>FLTMGR.SYS::FltReleaseFileNameInformation<br>FLTMGR.SYS::FltReleaseResource<br>Feature_66039097__private_IsEnabledDeviceUsageNoInline<br>Feature_Servicing_MSRC109658__private_IsEnabledDeviceUsageNoInline<br>NTOSKRNL.EXE::ExFreePoolWithTag<br>NTOSKRNL.EXE::ObfDereferenceObject<br>NTOSKRNL.EXE::RtlCompareUnicodeString</summary>NTOSKRNL.EXE::RtlDowncaseUnicodeString<br>NTOSKRNL.EXE::RtlGetNextEntryHashTable<br>NTOSKRNL.EXE::RtlHashUnicodeString<br>NTOSKRNL.EXE::RtlLookupEntryHashTable<br>PrjfAllocateUnicodeString<br>PrjfGetUnionContextByFileNameEx<br>PrjfReleaseUnionContext<br>WPP_RECORDER_AND_TRACE_SF_sDdHH<br>WPP_RECORDER_AND_TRACE_SF_sDdZZ<br>WPP_RECORDER_AND_TRACE_SF_sDdZZZq<br>WPP_RECORDER_AND_TRACE_SF_sDdZZq<br>WPP_RECORDER_AND_TRACE_SF_sDdZd<br>memmove</details>|
|calling|PrjfProcessPrjReparsePointBounce|PrjfProcessPrjReparsePointBounce|
|paramcount|8|8|
|`address`|1400077c4|140007818|
|sig|ulonglong __fastcall PrjfLookupEntryBackingLayerNegativePathCache(undefined8 param_1, wchar_t * param_2, wchar_t * param_3, ushort * param_4, longlong * param_5, undefined8 param_6, undefined4 * param_7, undefined1 * param_8)|ulonglong __fastcall PrjfLookupEntryBackingLayerNegativePathCache(undefined8 param_1, wchar_t * param_2, wchar_t * param_3, ushort * param_4, longlong * param_5, undefined8 param_6, undefined4 * param_7, undefined1 * param_8)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|

### PrjfLookupEntryBackingLayerNegativePathCache Called Diff


```diff
--- PrjfLookupEntryBackingLayerNegativePathCache called
+++ PrjfLookupEntryBackingLayerNegativePathCache called
@@ -6,0 +7 @@
+Feature_66039097__private_IsEnabledDeviceUsageNoInline
@@ -17,0 +19 @@
+WPP_RECORDER_AND_TRACE_SF_sDdHH
```


### PrjfLookupEntryBackingLayerNegativePathCache Diff


```diff
--- PrjfLookupEntryBackingLayerNegativePathCache
+++ PrjfLookupEntryBackingLayerNegativePathCache
@@ -1,234 +1,254 @@
 
 ulonglong PrjfLookupEntryBackingLayerNegativePathCache
                     (undefined8 param_1,wchar_t *param_2,wchar_t *param_3,ushort *param_4,
                     longlong *param_5,undefined8 param_6,undefined4 *param_7,undefined1 *param_8)
 
 {
   wchar_t wVar1;
   uint uVar2;
   int iVar3;
   undefined8 *puVar4;
   ulonglong uVar5;
   longlong lVar6;
   undefined2 uVar7;
   void *_Dst;
   byte bVar8;
   ulonglong uVar9;
   longlong lVar10;
   undefined8 uVar11;
   bool bVar12;
   undefined1 uVar13;
   ulonglong *puVar14;
   ushort uVar15;
   undefined4 in_stack_ffffffffffffff04;
   undefined4 in_stack_ffffffffffffff0c;
   ulonglong in_stack_ffffffffffffff20;
   char local_c8 [8];
   longlong local_c0;
   ushort local_b8 [4];
   void *pvStack_b0;
   longlong local_a8;
   ulonglong local_a0;
   void *pvStack_98;
   longlong local_90;
   longlong local_88;
   undefined8 local_80;
   undefined8 uStack_78;
   wchar_t *local_70;
   undefined8 uStack_68;
   undefined8 local_60;
   undefined8 uStack_58;
   undefined8 local_50;
   undefined8 uStack_48;
   undefined8 local_40;
   undefined8 local_38;
   undefined8 uStack_30;
   
   local_c0 = 0;
   *param_5 = 0;
   local_c8[0] = '\0';
   local_88 = 0;
   local_b8[0] = 0;
   local_b8[1] = 0;
   local_b8[2] = 0;
   local_b8[3] = 0;
   pvStack_b0 = (void *)0x0;
   *param_7 = 0;
   local_a0 = 0;
   pvStack_98 = (void *)0x0;
   local_90 = 0;
   local_80 = 0;
   uStack_78 = 0;
   local_a8 = 0;
   local_70 = (wchar_t *)0x0;
   uStack_68 = 0;
   *param_8 = 0;
   local_60 = 0;
   uStack_58 = 0;
   local_38 = 0;
   uStack_30 = 0;
   puVar4 = PrjfGetUnionContextByFileNameEx(0,'\0',param_1,param_4,&local_c0,local_b8,local_c8);
   lVar10 = local_c0;
   uVar9 = (ulonglong)puVar4 & 0xffffffff;
   if ((int)puVar4 < 0) {
     if (((DAT_0 & 0x20) != 0) ||
        ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
       WPP_RECORDER_AND_TRACE_SF_sDdZd
                 (0x205,DAT_0 & 0x20,
                  (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
                  *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,0xb0);
       lVar10 = local_c0;
     }
     goto LAB_1;
   }
   bVar12 = true;
   if (local_c0 == 0) {
     if (local_c8[0] == '\0') {
       uVar9 = 0xc000ce01;
       goto LAB_1;
     }
     uStack_78 = 0;
     local_80 = CONCAT44(local_80._4_4_,0x30);
     uStack_68 = CONCAT44(uStack_68._4_4_,0x240);
     local_60 = 0;
     uStack_58 = 0;
     local_70 = param_2;
     uVar2 = FltCreateFileEx2(Globals,param_1,&local_88,&local_90,0x100001,&local_80,&local_38,0,0x90
                              ,7,1,0x4021,0,in_stack_ffffffffffffff20 & 0xffffffff00000000,0x800,0);
     uVar9 = (ulonglong)uVar2;
     if ((int)uVar2 < 0) {
       if (((DAT_0 & 0x20) != 0) ||
          ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
         WPP_RECORDER_AND_TRACE_SF_sDdZZ
                   (0x205,DAT_0 & 0x20,
                    (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
                    *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,0xb1,
-                   &WPP_7303a320ba6d337a9e93fa19922c0989_Traceguids,
+                   &WPP_8e9fec0fc8053b2ba5e7afee61831e70_Traceguids,
                    "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",
-                   CONCAT44(in_stack_ffffffffffffff04,0x1d6d),
+                   CONCAT44(in_stack_ffffffffffffff04,0x1d6e),
                    CONCAT44(in_stack_ffffffffffffff0c,uVar2),param_2,param_3);
       }
       goto LAB_1;
     }
     uVar2 = FltGetFileNameInformationUnsafe(local_90,param_1,0x101,&local_a8);
     uVar9 = (ulonglong)uVar2;
     if ((int)uVar2 < 0) {
       if (((DAT_0 & 0x20) != 0) ||
          ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
         WPP_RECORDER_AND_TRACE_SF_sDdZZq
                   (0,DAT_0 & 0x20,
                    (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
                    *(undefined8 *)(WPP_GLOBAL_Control + 0x40));
       }
       goto LAB_1;
     }
     puVar14 = &local_a0;
     puVar4 = PrjfGetUnionContextByFileNameEx
                        (0,'\0',param_1,(ushort *)(local_a8 + 8),&local_c0,(ushort *)puVar14,
                         (undefined1 *)0x0);
     lVar10 = local_c0;
     uVar9 = (ulonglong)puVar4 & 0xffffffff;
     if ((int)puVar4 < 0) {
       if (((DAT_0 & 0x20) != 0) ||
          ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
         WPP_RECORDER_AND_TRACE_SF_sDdZZZq
                   (0x205,DAT_0 & 0x20,
                    (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
                    *(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,puVar14,0xb3);
         lVar10 = local_c0;
       }
       goto LAB_1;
     }
     if (local_c0 == 0) {
       uVar9 = 0xc000ce01;
       bVar8 = DAT_2 & 0x20;
       if (((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) ||
          (*(short *)(WPP_GLOBAL_Control + 0x48) == 0)) {
         bVar12 = false;
       }
       if ((bVar8 == 0) && (bVar12 == false)) goto LAB_1;
       uVar7 = 0x505;
       uVar15 = 0xb4;
       uVar13 = 5;
       uVar11 = _PrjfTraceRecorder;
     }
     else {
-      wVar1 = *param_3;
-      if ((short)local_a0 != 0) {
-        wVar1 = wVar1 + L'\x02' + (short)local_a0;
-      }
-      local_b8[1] = wVar1;
+      if ((ushort)local_a0 == 0) {
+        wVar1 = *param_3;
+LAB_3:
+        local_b8[1] = wVar1;
+      }
+      else {
+        uVar9 = Feature_66039097__private_IsEnabledDeviceUsageNoInline();
+        if ((int)uVar9 == 0) {
+          wVar1 = (ushort)local_a0 + 2 + *param_3;
+          goto LAB_3;
+        }
+        uVar2 = (ushort)local_a0 + 2 + (uint)(ushort)*param_3;
+        if (0xffff < uVar2) {
+          uVar9 = 0xc0000106;
+          if (((DAT_0 & 0x20) != 0) ||
+             ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) {
+            WPP_RECORDER_AND_TRACE_SF_sDdHH
+                      ((ulonglong)uVar2,DAT_0 & 0x20,
+                       (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED,
+                       *(undefined8 *)(WPP_GLOBAL_Control + 0x40));
+          }
+          goto LAB_1;
+        }
+        local_b8[1] = (short)uVar2;
+      }
       uVar5 = PrjfAllocateUnicodeString(0x6e664a50,local_b8);
       uVar9 = uVar5 & 0xffffffff;
       if (-1 < (int)uVar5) {
         uVar15 = local_b8[1];
         local_b8[0] = uVar15;
         _Dst = pvStack_b0;
-        if ((short)local_a0 != 0) {
+        if ((ushort)local_a0 != 0) {
           memmove(pvStack_b0,pvStack_98,local_a0 & 0xffff);
           *(undefined2 *)((longlong)pvStack_b0 + (local_a0 >> 1 & 0x7fff) * 2) = 0x5c;
           _Dst = (void *)((longlong)pvStack_b0 + (local_a0 & 0xffff) + 2);
         }
         memmove(_Dst,*(void **)(param_3 + 4),(ulonglong)(ushort)*param_3);
-        goto LAB_3;
+        goto LAB_4;
       }
       bVar12 = (undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED;
       bVar8 = DAT_0 & 0x20;
       if ((bVar8 == 0) && (!bVar12)) goto LAB_1;
       uVar7 = 0x205;
       uVar11 = *(undefined8 *)(WPP_GLOBAL_Control + 0x40);
-      uVar15 = 0xb5;
+      uVar15 = 0xb6;
       uVar13 = 2;
     }
     WPP_RECORDER_AND_TRACE_SF_sDdZZZq(uVar7,bVar8,bVar12,uVar11,uVar13,puVar14,uVar15);
   }
   else {
-LAB_3:
+LAB_4:
     if ((*(uint *)(lVar10 + 0x38) & 1) != 0) {
       uVar2 = RtlDowncaseUnicodeString(param_6,local_b8,1);
       uVar9 = (ulonglong)uVar2;
       uVar5 = Feature_Servicing_MSRC109658__private_IsEnabledDeviceUsageNoInline();
       if (((int)uVar5 == 0) || (-1 < (int)uVar2)) {
         uVar2 = RtlHashUnicodeString(param_6,1,0,param_7);
         uVar9 = (ulonglong)uVar2;
         local_40 = 0;
         local_50 = 0;
         uStack_48 = 0;
         FltAcquireResourceShared(lVar10 + 0x220);
         lVar6 = RtlLookupEntryHashTable(lVar10 + 0x288,*param_7,&local_50);
         while (lVar6 != 0) {
           iVar3 = RtlCompareUnicodeString(param_6,lVar6 + 0x18,1);
           if (iVar3 == 0) {
             *param_8 = 1;
             break;
           }
           lVar6 = RtlGetNextEntryHashTable(lVar10 + 0x288,&local_50);
         }
         FltReleaseResource();
         *param_5 = lVar10;
         lVar10 = 0;
       }
     }
   }
 LAB_1:
   if (local_88 != 0) {
     FltClose();
   }
   if (local_90 != 0) {
     ObfDereferenceObject();
   }
   if (local_a8 != 0) {
     FltReleaseFileNameInformation();
   }
   if (lVar10 != 0) {
     PrjfReleaseUnionContext(lVar10);
   }
   if (pvStack_b0 != (void *)0x0) {
     ExFreePoolWithTag(pvStack_b0,0x6e664a50);
   }
   if (pvStack_98 != (void *)0x0) {
     ExFreePoolWithTag(pvStack_98,0x6e664a50);
   }
   return uVar9;
 }
 

```


# Modified (No Code Changes)


*Slightly modified functions have no code changes, rather differnces in:*
- refcount
- length
- called
- calling
- name
- fullname

## wil_details_IsEnabledFallback

### Match Info



|Key|pf_8972.sys - pf_9168.sys|
| :---: | :---: |
|diff_type|refcount,calling|
|ratio|1.0|
|i_ratio|1.0|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash|

### Function Meta Diff



|Key|pf_8972.sys|pf_9168.sys|
| :---: | :---: | :---: |
|name|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback|
|fullname|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback|
|`refcount`|13|14|
|length|140|140|
|called|wil_details_FeatureReporting_ReportUsageToService<br>wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState<br>wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath|wil_details_FeatureReporting_ReportUsageToService<br>wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState<br>wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath|
|`calling`|<details><summary>Expand for full list:<br>Feature_1526925624__private_IsEnabledFallback<br>Feature_2096096568__private_IsEnabledFallback<br>Feature_2998397241__private_IsEnabledFallback<br>Feature_32499002__private_IsEnabledFallback<br>Feature_EnableTestConfigViaFilterPort__private_IsEnabledFallback<br>Feature_ModernWpp__private_IsEnabledFallback<br>Feature_Servicing_MSRC104659__private_IsEnabledFallback<br>Feature_Servicing_MSRC109651__private_IsEnabledFallback<br>Feature_Servicing_MSRC109652__private_IsEnabledFallback<br>Feature_Servicing_MSRC109654__private_IsEnabledFallback<br>Feature_Servicing_MSRC109658__private_IsEnabledFallback</summary>Feature_Servicing_MSRC109779__private_IsEnabledFallback</details>|<details><summary>Expand for full list:<br>Feature_1526925624__private_IsEnabledFallback<br>Feature_2096096568__private_IsEnabledFallback<br>Feature_2998397241__private_IsEnabledFallback<br>Feature_32499002__private_IsEnabledFallback<br>Feature_66039097__private_IsEnabledFallback<br>Feature_EnableTestConfigViaFilterPort__private_IsEnabledFallback<br>Feature_ModernWpp__private_IsEnabledFallback<br>Feature_Servicing_MSRC104659__private_IsEnabledFallback<br>Feature_Servicing_MSRC109651__private_IsEnabledFallback<br>Feature_Servicing_MSRC109652__private_IsEnabledFallback<br>Feature_Servicing_MSRC109654__private_IsEnabledFallback</summary>Feature_Servicing_MSRC109658__private_IsEnabledFallback<br>Feature_Servicing_MSRC109779__private_IsEnabledFallback</details>|
|paramcount|3|3|
|address|140004904|140004904|
|sig|uint __fastcall wil_details_IsEnabledFallback(ulonglong param_1, int param_2, undefined8 * param_3)|uint __fastcall wil_details_IsEnabledFallback(ulonglong param_1, int param_2, undefined8 * param_3)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|

### wil_details_IsEnabledFallback Calling Diff


```diff
--- wil_details_IsEnabledFallback calling
+++ wil_details_IsEnabledFallback calling
@@ -4,0 +5 @@
+Feature_66039097__private_IsEnabledFallback
```


## WPPRECORDER.SYS::WppAutoLogTrace

### Match Info



|Key|pf_8972.sys - pf_9168.sys|
| :---: | :---: |
|diff_type|refcount,calling|
|ratio|1.0|
|i_ratio|1.0|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash,ExternalsName|

### Function Meta Diff



|Key|pf_8972.sys|pf_9168.sys|
| :---: | :---: | :---: |
|name|WppAutoLogTrace|WppAutoLogTrace|
|fullname|WPPRECORDER.SYS::WppAutoLogTrace|WPPRECORDER.SYS::WppAutoLogTrace|
|`refcount`|61|62|
|length|0|0|
|called|||
|`calling`|<details><summary>Expand for full list:<br>WPP_RECORDER_AND_TRACE_SF_sD<br>WPP_RECORDER_AND_TRACE_SF_sDD<br>WPP_RECORDER_AND_TRACE_SF_sDDD<br>WPP_RECORDER_AND_TRACE_SF_sDDDZ<br>WPP_RECORDER_AND_TRACE_SF_sDDZ<br>WPP_RECORDER_AND_TRACE_SF_sDDZDZ<br>WPP_RECORDER_AND_TRACE_SF_sDDdd<br>WPP_RECORDER_AND_TRACE_SF_sDDld<br>WPP_RECORDER_AND_TRACE_SF_sDHZ<br>WPP_RECORDER_AND_TRACE_SF_sDLLd<br>WPP_RECORDER_AND_TRACE_SF_sDLd</summary>WPP_RECORDER_AND_TRACE_SF_sDZ<br>WPP_RECORDER_AND_TRACE_SF_sDZDDD<br>WPP_RECORDER_AND_TRACE_SF_sDZL<br>WPP_RECORDER_AND_TRACE_SF_sDZLL<br>WPP_RECORDER_AND_TRACE_SF_sDZLii<br>WPP_RECORDER_AND_TRACE_SF_sDZ_guid_Dd<br>WPP_RECORDER_AND_TRACE_SF_sDZd<br>WPP_RECORDER_AND_TRACE_SF_sDZdDl<br>WPP_RECORDER_AND_TRACE_SF_sDdD<br>WPP_RECORDER_AND_TRACE_SF_sDdDDZ<br>WPP_RECORDER_AND_TRACE_SF_sDdDZ<br>WPP_RECORDER_AND_TRACE_SF_sDdL<br>WPP_RECORDER_AND_TRACE_SF_sDdLL<br>WPP_RECORDER_AND_TRACE_SF_sDdLLl<br>WPP_RECORDER_AND_TRACE_SF_sDdLZ<br>WPP_RECORDER_AND_TRACE_SF_sDdLlqqq<br>WPP_RECORDER_AND_TRACE_SF_sDdPZ<br>WPP_RECORDER_AND_TRACE_SF_sDdZ<br>WPP_RECORDER_AND_TRACE_SF_sDdZDl<br>WPP_RECORDER_AND_TRACE_SF_sDdZDlLL<br>WPP_RECORDER_AND_TRACE_SF_sDdZL<br>WPP_RECORDER_AND_TRACE_SF_sDdZLZ<br>WPP_RECORDER_AND_TRACE_SF_sDdZP<br>WPP_RECORDER_AND_TRACE_SF_sDdZZ<br>WPP_RECORDER_AND_TRACE_SF_sDdZZZq<br>WPP_RECORDER_AND_TRACE_SF_sDdZZq<br>WPP_RECORDER_AND_TRACE_SF_sDdZd<br>WPP_RECORDER_AND_TRACE_SF_sDdZdDl<br>WPP_RECORDER_AND_TRACE_SF_sDdZssss<br>WPP_RECORDER_AND_TRACE_SF_sDddZ<br>WPP_RECORDER_AND_TRACE_SF_sDdiiZ<br>WPP_RECORDER_AND_TRACE_SF_sDdsZ<br>WPP_RECORDER_AND_TRACE_SF_sDiD<br>WPP_RECORDER_AND_TRACE_SF_sDid<br>WPP_RECORDER_AND_TRACE_SF_sDiid<br>WPP_RECORDER_AND_TRACE_SF_sDiiiid<br>WPP_RECORDER_AND_TRACE_SF_sDl<br>WPP_RECORDER_AND_TRACE_SF_sDlLD<br>WPP_RECORDER_AND_TRACE_SF_sDlLL<br>WPP_RECORDER_AND_TRACE_SF_sDld<br>WPP_RECORDER_AND_TRACE_SF_sDq<br>WPP_RECORDER_AND_TRACE_SF_sDqDld<br>WPP_RECORDER_AND_TRACE_SF_sDqZd<br>WPP_RECORDER_AND_TRACE_SF_sDqd<br>WPP_RECORDER_AND_TRACE_SF_sDqqZd<br>WPP_RECORDER_AND_TRACE_SF_sDqqqZd<br>WPP_RECORDER_AND_TRACE_SF_sDqqqd<br>WPP_RECORDER_AND_TRACE_SF_sDsDZ<br>WPP_RECORDER_AND_TRACE_SF_sDsiLiLZ</details>|<details><summary>Expand for full list:<br>WPP_RECORDER_AND_TRACE_SF_sD<br>WPP_RECORDER_AND_TRACE_SF_sDD<br>WPP_RECORDER_AND_TRACE_SF_sDDD<br>WPP_RECORDER_AND_TRACE_SF_sDDDZ<br>WPP_RECORDER_AND_TRACE_SF_sDDZ<br>WPP_RECORDER_AND_TRACE_SF_sDDZDZ<br>WPP_RECORDER_AND_TRACE_SF_sDDdd<br>WPP_RECORDER_AND_TRACE_SF_sDDld<br>WPP_RECORDER_AND_TRACE_SF_sDHZ<br>WPP_RECORDER_AND_TRACE_SF_sDLLd<br>WPP_RECORDER_AND_TRACE_SF_sDLd</summary>WPP_RECORDER_AND_TRACE_SF_sDZ<br>WPP_RECORDER_AND_TRACE_SF_sDZDDD<br>WPP_RECORDER_AND_TRACE_SF_sDZL<br>WPP_RECORDER_AND_TRACE_SF_sDZLL<br>WPP_RECORDER_AND_TRACE_SF_sDZLii<br>WPP_RECORDER_AND_TRACE_SF_sDZ_guid_Dd<br>WPP_RECORDER_AND_TRACE_SF_sDZd<br>WPP_RECORDER_AND_TRACE_SF_sDZdDl<br>WPP_RECORDER_AND_TRACE_SF_sDdD<br>WPP_RECORDER_AND_TRACE_SF_sDdDDZ<br>WPP_RECORDER_AND_TRACE_SF_sDdDZ<br>WPP_RECORDER_AND_TRACE_SF_sDdHH<br>WPP_RECORDER_AND_TRACE_SF_sDdL<br>WPP_RECORDER_AND_TRACE_SF_sDdLL<br>WPP_RECORDER_AND_TRACE_SF_sDdLLl<br>WPP_RECORDER_AND_TRACE_SF_sDdLZ<br>WPP_RECORDER_AND_TRACE_SF_sDdLlqqq<br>WPP_RECORDER_AND_TRACE_SF_sDdPZ<br>WPP_RECORDER_AND_TRACE_SF_sDdZ<br>WPP_RECORDER_AND_TRACE_SF_sDdZDl<br>WPP_RECORDER_AND_TRACE_SF_sDdZDlLL<br>WPP_RECORDER_AND_TRACE_SF_sDdZL<br>WPP_RECORDER_AND_TRACE_SF_sDdZLZ<br>WPP_RECORDER_AND_TRACE_SF_sDdZP<br>WPP_RECORDER_AND_TRACE_SF_sDdZZ<br>WPP_RECORDER_AND_TRACE_SF_sDdZZZq<br>WPP_RECORDER_AND_TRACE_SF_sDdZZq<br>WPP_RECORDER_AND_TRACE_SF_sDdZd<br>WPP_RECORDER_AND_TRACE_SF_sDdZdDl<br>WPP_RECORDER_AND_TRACE_SF_sDdZssss<br>WPP_RECORDER_AND_TRACE_SF_sDddZ<br>WPP_RECORDER_AND_TRACE_SF_sDdiiZ<br>WPP_RECORDER_AND_TRACE_SF_sDdsZ<br>WPP_RECORDER_AND_TRACE_SF_sDiD<br>WPP_RECORDER_AND_TRACE_SF_sDid<br>WPP_RECORDER_AND_TRACE_SF_sDiid<br>WPP_RECORDER_AND_TRACE_SF_sDiiiid<br>WPP_RECORDER_AND_TRACE_SF_sDl<br>WPP_RECORDER_AND_TRACE_SF_sDlLD<br>WPP_RECORDER_AND_TRACE_SF_sDlLL<br>WPP_RECORDER_AND_TRACE_SF_sDld<br>WPP_RECORDER_AND_TRACE_SF_sDq<br>WPP_RECORDER_AND_TRACE_SF_sDqDld<br>WPP_RECORDER_AND_TRACE_SF_sDqZd<br>WPP_RECORDER_AND_TRACE_SF_sDqd<br>WPP_RECORDER_AND_TRACE_SF_sDqqZd<br>WPP_RECORDER_AND_TRACE_SF_sDqqqZd<br>WPP_RECORDER_AND_TRACE_SF_sDqqqd<br>WPP_RECORDER_AND_TRACE_SF_sDsDZ<br>WPP_RECORDER_AND_TRACE_SF_sDsiLiLZ</details>|
|paramcount|0|0|
|address|EXTERNAL:000000a1|EXTERNAL:000000a1|
|sig|undefined WppAutoLogTrace(void)|undefined WppAutoLogTrace(void)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|True|True|

### WPPRECORDER.SYS::WppAutoLogTrace Calling Diff


```diff
--- WPPRECORDER.SYS::WppAutoLogTrace calling
+++ WPPRECORDER.SYS::WppAutoLogTrace calling
@@ -22,0 +23 @@
+WPP_RECORDER_AND_TRACE_SF_sDdHH
```


## FastWppTraceMessage

### Match Info



|Key|pf_8972.sys - pf_9168.sys|
| :---: | :---: |
|diff_type|refcount,calling|
|ratio|1.0|
|i_ratio|0.92|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash|

### Function Meta Diff



|Key|pf_8972.sys|pf_9168.sys|
| :---: | :---: | :---: |
|name|FastWppTraceMessage|FastWppTraceMessage|
|fullname|FastWppTraceMessage|FastWppTraceMessage|
|`refcount`|61|62|
|length|385|385|
|called|FastWppPackEvent<br>NTOSKRNL.EXE::EtwWriteEx<br>NTOSKRNL.EXE::ExAllocatePool3<br>NTOSKRNL.EXE::ExFreePoolWithTag<br>__security_check_cookie|FastWppPackEvent<br>NTOSKRNL.EXE::EtwWriteEx<br>NTOSKRNL.EXE::ExAllocatePool3<br>NTOSKRNL.EXE::ExFreePoolWithTag<br>__security_check_cookie|
|`calling`|<details><summary>Expand for full list:<br>WPP_RECORDER_AND_TRACE_SF_sD<br>WPP_RECORDER_AND_TRACE_SF_sDD<br>WPP_RECORDER_AND_TRACE_SF_sDDD<br>WPP_RECORDER_AND_TRACE_SF_sDDDZ<br>WPP_RECORDER_AND_TRACE_SF_sDDZ<br>WPP_RECORDER_AND_TRACE_SF_sDDZDZ<br>WPP_RECORDER_AND_TRACE_SF_sDDdd<br>WPP_RECORDER_AND_TRACE_SF_sDDld<br>WPP_RECORDER_AND_TRACE_SF_sDHZ<br>WPP_RECORDER_AND_TRACE_SF_sDLLd<br>WPP_RECORDER_AND_TRACE_SF_sDLd</summary>WPP_RECORDER_AND_TRACE_SF_sDZ<br>WPP_RECORDER_AND_TRACE_SF_sDZDDD<br>WPP_RECORDER_AND_TRACE_SF_sDZL<br>WPP_RECORDER_AND_TRACE_SF_sDZLL<br>WPP_RECORDER_AND_TRACE_SF_sDZLii<br>WPP_RECORDER_AND_TRACE_SF_sDZ_guid_Dd<br>WPP_RECORDER_AND_TRACE_SF_sDZd<br>WPP_RECORDER_AND_TRACE_SF_sDZdDl<br>WPP_RECORDER_AND_TRACE_SF_sDdD<br>WPP_RECORDER_AND_TRACE_SF_sDdDDZ<br>WPP_RECORDER_AND_TRACE_SF_sDdDZ<br>WPP_RECORDER_AND_TRACE_SF_sDdL<br>WPP_RECORDER_AND_TRACE_SF_sDdLL<br>WPP_RECORDER_AND_TRACE_SF_sDdLLl<br>WPP_RECORDER_AND_TRACE_SF_sDdLZ<br>WPP_RECORDER_AND_TRACE_SF_sDdLlqqq<br>WPP_RECORDER_AND_TRACE_SF_sDdPZ<br>WPP_RECORDER_AND_TRACE_SF_sDdZ<br>WPP_RECORDER_AND_TRACE_SF_sDdZDl<br>WPP_RECORDER_AND_TRACE_SF_sDdZDlLL<br>WPP_RECORDER_AND_TRACE_SF_sDdZL<br>WPP_RECORDER_AND_TRACE_SF_sDdZLZ<br>WPP_RECORDER_AND_TRACE_SF_sDdZP<br>WPP_RECORDER_AND_TRACE_SF_sDdZZ<br>WPP_RECORDER_AND_TRACE_SF_sDdZZZq<br>WPP_RECORDER_AND_TRACE_SF_sDdZZq<br>WPP_RECORDER_AND_TRACE_SF_sDdZd<br>WPP_RECORDER_AND_TRACE_SF_sDdZdDl<br>WPP_RECORDER_AND_TRACE_SF_sDdZssss<br>WPP_RECORDER_AND_TRACE_SF_sDddZ<br>WPP_RECORDER_AND_TRACE_SF_sDdiiZ<br>WPP_RECORDER_AND_TRACE_SF_sDdsZ<br>WPP_RECORDER_AND_TRACE_SF_sDiD<br>WPP_RECORDER_AND_TRACE_SF_sDid<br>WPP_RECORDER_AND_TRACE_SF_sDiid<br>WPP_RECORDER_AND_TRACE_SF_sDiiiid<br>WPP_RECORDER_AND_TRACE_SF_sDl<br>WPP_RECORDER_AND_TRACE_SF_sDlLD<br>WPP_RECORDER_AND_TRACE_SF_sDlLL<br>WPP_RECORDER_AND_TRACE_SF_sDld<br>WPP_RECORDER_AND_TRACE_SF_sDq<br>WPP_RECORDER_AND_TRACE_SF_sDqDld<br>WPP_RECORDER_AND_TRACE_SF_sDqZd<br>WPP_RECORDER_AND_TRACE_SF_sDqd<br>WPP_RECORDER_AND_TRACE_SF_sDqqZd<br>WPP_RECORDER_AND_TRACE_SF_sDqqqZd<br>WPP_RECORDER_AND_TRACE_SF_sDqqqd<br>WPP_RECORDER_AND_TRACE_SF_sDsDZ<br>WPP_RECORDER_AND_TRACE_SF_sDsiLiLZ</details>|<details><summary>Expand for full list:<br>WPP_RECORDER_AND_TRACE_SF_sD<br>WPP_RECORDER_AND_TRACE_SF_sDD<br>WPP_RECORDER_AND_TRACE_SF_sDDD<br>WPP_RECORDER_AND_TRACE_SF_sDDDZ<br>WPP_RECORDER_AND_TRACE_SF_sDDZ<br>WPP_RECORDER_AND_TRACE_SF_sDDZDZ<br>WPP_RECORDER_AND_TRACE_SF_sDDdd<br>WPP_RECORDER_AND_TRACE_SF_sDDld<br>WPP_RECORDER_AND_TRACE_SF_sDHZ<br>WPP_RECORDER_AND_TRACE_SF_sDLLd<br>WPP_RECORDER_AND_TRACE_SF_sDLd</summary>WPP_RECORDER_AND_TRACE_SF_sDZ<br>WPP_RECORDER_AND_TRACE_SF_sDZDDD<br>WPP_RECORDER_AND_TRACE_SF_sDZL<br>WPP_RECORDER_AND_TRACE_SF_sDZLL<br>WPP_RECORDER_AND_TRACE_SF_sDZLii<br>WPP_RECORDER_AND_TRACE_SF_sDZ_guid_Dd<br>WPP_RECORDER_AND_TRACE_SF_sDZd<br>WPP_RECORDER_AND_TRACE_SF_sDZdDl<br>WPP_RECORDER_AND_TRACE_SF_sDdD<br>WPP_RECORDER_AND_TRACE_SF_sDdDDZ<br>WPP_RECORDER_AND_TRACE_SF_sDdDZ<br>WPP_RECORDER_AND_TRACE_SF_sDdHH<br>WPP_RECORDER_AND_TRACE_SF_sDdL<br>WPP_RECORDER_AND_TRACE_SF_sDdLL<br>WPP_RECORDER_AND_TRACE_SF_sDdLLl<br>WPP_RECORDER_AND_TRACE_SF_sDdLZ<br>WPP_RECORDER_AND_TRACE_SF_sDdLlqqq<br>WPP_RECORDER_AND_TRACE_SF_sDdPZ<br>WPP_RECORDER_AND_TRACE_SF_sDdZ<br>WPP_RECORDER_AND_TRACE_SF_sDdZDl<br>WPP_RECORDER_AND_TRACE_SF_sDdZDlLL<br>WPP_RECORDER_AND_TRACE_SF_sDdZL<br>WPP_RECORDER_AND_TRACE_SF_sDdZLZ<br>WPP_RECORDER_AND_TRACE_SF_sDdZP<br>WPP_RECORDER_AND_TRACE_SF_sDdZZ<br>WPP_RECORDER_AND_TRACE_SF_sDdZZZq<br>WPP_RECORDER_AND_TRACE_SF_sDdZZq<br>WPP_RECORDER_AND_TRACE_SF_sDdZd<br>WPP_RECORDER_AND_TRACE_SF_sDdZdDl<br>WPP_RECORDER_AND_TRACE_SF_sDdZssss<br>WPP_RECORDER_AND_TRACE_SF_sDddZ<br>WPP_RECORDER_AND_TRACE_SF_sDdiiZ<br>WPP_RECORDER_AND_TRACE_SF_sDdsZ<br>WPP_RECORDER_AND_TRACE_SF_sDiD<br>WPP_RECORDER_AND_TRACE_SF_sDid<br>WPP_RECORDER_AND_TRACE_SF_sDiid<br>WPP_RECORDER_AND_TRACE_SF_sDiiiid<br>WPP_RECORDER_AND_TRACE_SF_sDl<br>WPP_RECORDER_AND_TRACE_SF_sDlLD<br>WPP_RECORDER_AND_TRACE_SF_sDlLL<br>WPP_RECORDER_AND_TRACE_SF_sDld<br>WPP_RECORDER_AND_TRACE_SF_sDq<br>WPP_RECORDER_AND_TRACE_SF_sDqDld<br>WPP_RECORDER_AND_TRACE_SF_sDqZd<br>WPP_RECORDER_AND_TRACE_SF_sDqd<br>WPP_RECORDER_AND_TRACE_SF_sDqqZd<br>WPP_RECORDER_AND_TRACE_SF_sDqqqZd<br>WPP_RECORDER_AND_TRACE_SF_sDqqqd<br>WPP_RECORDER_AND_TRACE_SF_sDsDZ<br>WPP_RECORDER_AND_TRACE_SF_sDsiLiLZ</details>|
|paramcount|4|4|
|address|140006674|140006674|
|sig|undefined __fastcall FastWppTraceMessage(undefined2 param_1, ushort param_2, undefined8 param_3, undefined8 param_4)|undefined __fastcall FastWppTraceMessage(undefined2 param_1, ushort param_2, undefined8 param_3, undefined8 param_4)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|

### FastWppTraceMessage Calling Diff


```diff
--- FastWppTraceMessage calling
+++ FastWppTraceMessage calling
@@ -22,0 +23 @@
+WPP_RECORDER_AND_TRACE_SF_sDdHH
```




<sub>Generated with `ghidriff` version: 1.0.0 on 2026-08-21T23:45:32</sub>