# pj_7309.sys-pj_7462.sys Diff # TOC * [Visual Chart Diff](#visual-chart-diff) * [Metadata](#metadata) * [Ghidra Diff Engine](#ghidra-diff-engine) * [Command Line](#command-line) * [Binary Metadata Diff](#binary-metadata-diff) * [Program Options](#program-options) * [Diff Stats](#diff-stats) * [Strings](#strings) * [Deleted](#deleted) * [Added](#added) * [Feature_3579016506__private_IsEnabledFallback](#feature_3579016506__private_isenabledfallback) * [Feature_3797454136__private_IsEnabledDeviceUsageNoInline](#feature_3797454136__private_isenableddeviceusagenoinline) * [Feature_3797454136__private_IsEnabledFallback](#feature_3797454136__private_isenabledfallback) * [Feature_2814151992__private_IsEnabledDeviceUsageNoInline](#feature_2814151992__private_isenableddeviceusagenoinline) * [Feature_2814151992__private_IsEnabledFallback](#feature_2814151992__private_isenabledfallback) * [Feature_4287139131__private_IsEnabledDeviceUsageNoInline](#feature_4287139131__private_isenableddeviceusagenoinline) * [Feature_4287139131__private_IsEnabledFallback](#feature_4287139131__private_isenabledfallback) * [Feature_3568532792__private_IsEnabledDeviceUsageNoInline](#feature_3568532792__private_isenableddeviceusagenoinline) * [Feature_3568532792__private_IsEnabledFallback](#feature_3568532792__private_isenabledfallback) * [Modified](#modified) * [PrjfGetPrjReparseData](#prjfgetprjreparsedata) * [PrjfOpenAsReparsePoint](#prjfopenasreparsepoint) * [PrjfSetupVolumeInformationHandler](#prjfsetupvolumeinformationhandler) * [PrjfSendCommand](#prjfsendcommand) * [PrjfValidateNamesInEnumeration](#prjfvalidatenamesinenumeration) * [PrjfProcessOpenWithinVirtualizationRoots](#prjfprocessopenwithinvirtualizationroots) * [WPP_RECORDER_SF_sDDZDZ](#wpp_recorder_sf_sddzdz) * [PrjfValidateFileIdentifier](#prjfvalidatefileidentifier) * [PrjfAdvanceToNextEnumEntry](#prjfadvancetonextenumentry) * [PrjfCompleteCommandHandler](#prjfcompletecommandhandler) * [PrjfExpandFile](#prjfexpandfile) * [WPP_RECORDER_SF_sDiD](#wpp_recorder_sf_sdid) * [PrjfGetSetContextFileObject](#prjfgetsetcontextfileobject) * [Modified (No Code Changes)](#modified-no-code-changes) * [wil_details_IsEnabledFallback](#wil_details_isenabledfallback) * [WPP_RECORDER_SF_sD](#wpp_recorder_sf_sd) * [MicrosoftTelemetryAssertTriggeredNoArgsKM](#microsofttelemetryasserttriggerednoargskm) * [PrjfGetSetContextFileObject](#prjfgetsetcontextfileobject) # Visual Chart Diff ```mermaid flowchart LR PrjfGetPrjReparseData-4-old<--Match 94%-->PrjfGetPrjReparseData-4-new PrjfOpenAsReparsePoint-12-old<--Match 97%-->PrjfOpenAsReparsePoint-12-new PrjfSetupVolumeInformationHandler-2-old<--Match 99%-->PrjfSetupVolumeInformationHandler-2-new PrjfSendCommand-6-old<--Match 98%-->PrjfSendCommand-6-new PrjfValidateNamesInEnumeration-3-old<--Match 41%-->PrjfValidateNamesInEnumeration-3-new PrjfProcessOpenWithinVirtualizationRoots-5-old<--Match 35%-->PrjfProcessOpenWithinVirtualizationRoots-5-new WPP_RECORDER_SF_sDDZDZ-1-old<--Match 99%-->WPP_RECORDER_SF_sDDZDZ-1-new PrjfValidateFileIdentifier-2-old<--Match 99%-->PrjfValidateFileIdentifier-2-new PrjfAdvanceToNextEnumEntry-1-old<--Match 64%-->PrjfAdvanceToNextEnumEntry-1-new PrjfCompleteCommandHandler-3-old<--Match 88%-->PrjfCompleteCommandHandler-3-new PrjfExpandFile-4-old<--Match 97%-->PrjfExpandFile-4-new WPP_RECORDER_SF_sDiD-1-old<--Match 99%-->WPP_RECORDER_SF_sDiD-1-new PrjfGetSetContextFileObject-9-old<--Match 6%-->Feature_3579016506__private_IsEnabledDeviceUsageNoInline-9-new subgraph pj_7462.sys PrjfGetPrjReparseData-4-new PrjfOpenAsReparsePoint-12-new PrjfSetupVolumeInformationHandler-2-new PrjfSendCommand-6-new PrjfValidateNamesInEnumeration-3-new PrjfProcessOpenWithinVirtualizationRoots-5-new WPP_RECORDER_SF_sDDZDZ-1-new PrjfValidateFileIdentifier-2-new PrjfAdvanceToNextEnumEntry-1-new PrjfCompleteCommandHandler-3-new PrjfExpandFile-4-new WPP_RECORDER_SF_sDiD-1-new Feature_3579016506__private_IsEnabledDeviceUsageNoInline-9-new subgraph Added direction LR Feature_3579016506__private_IsEnabledFallback Feature_3797454136__private_IsEnabledDeviceUsageNoInline Feature_3797454136__private_IsEnabledFallback Feature_2814151992__private_IsEnabledDeviceUsageNoInline Feature_2814151992__private_IsEnabledFallback Feature_4287139131__private_IsEnabledDeviceUsageNoInline Feature_4287139131__private_IsEnabledFallback Feature_3568532792__private_IsEnabledDeviceUsageNoInline Feature_3568532792__private_IsEnabledFallback end end subgraph pj_7309.sys PrjfGetPrjReparseData-4-old PrjfOpenAsReparsePoint-12-old PrjfSetupVolumeInformationHandler-2-old PrjfSendCommand-6-old PrjfValidateNamesInEnumeration-3-old PrjfProcessOpenWithinVirtualizationRoots-5-old WPP_RECORDER_SF_sDDZDZ-1-old PrjfValidateFileIdentifier-2-old PrjfAdvanceToNextEnumEntry-1-old PrjfCompleteCommandHandler-3-old PrjfExpandFile-4-old WPP_RECORDER_SF_sDiD-1-old PrjfGetSetContextFileObject-9-old end ``` ```mermaid pie showData title Function Matches - 99.3130% "unmatched_funcs_len" : 9 "matched_funcs_len" : 1301 ``` ```mermaid pie showData title Matched Function Similarity - 98.6164% "matched_funcs_with_code_changes_len" : 13 "matched_funcs_with_non_code_changes_len" : 5 "matched_funcs_no_changes_len" : 1283 ``` # Metadata ## Ghidra Diff Engine ### Command Line #### Captured Command Line ``` ghidriff --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --bsim --max-ram-percent 60.0 --max-section-funcs 200 pj_7309.sys pj_7462.sys ``` #### Verbose Args
``` --old ['pj_7309.sys'] --new [['pj_7462.sys']] --engine VersionTrackingDiff --output-path pjp2_out --summary False --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim True --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title None ```
#### Download Original PEs ``` wget https://msdl.microsoft.com/download/symbols/prjflt.sys/296F88DA47000/prjflt.sys -O prjflt.sys.x64.10.0.26100.7309 wget https://msdl.microsoft.com/download/symbols/prjflt.sys/C050646D47000/prjflt.sys -O prjflt.sys.x64.10.0.26100.7462 ``` ## Binary Metadata Diff ```diff --- pj_7309.sys Meta +++ pj_7462.sys Meta @@ -1,44 +1,44 @@ -Program Name: pj_7309.sys +Program Name: pj_7462.sys Language ID: x86:LE:64:default (4.6) Compiler ID: windows Processor: x86 Endian: Little Address Size: 64 Minimum Address: 140000000 Maximum Address: ff0000184f # of Bytes: 297040 # of Memory Blocks: 15 -# of Instructions: 46988 -# of Defined Data: 2355 -# of Functions: 650 -# of Symbols: 7099 +# of Instructions: 47334 +# of Defined Data: 2389 +# of Functions: 660 +# of Symbols: 7145 # of Data Types: 165 # of Data Type Categories: 12 Analyzed: true Compiler: visualstudio:unknown Created With Ghidra Version: 12.0.4 -Date Created: Wed Aug 19 20:10:33 SGT 2026 +Date Created: Wed Aug 19 20:10:37 SGT 2026 Executable Format: Portable Executable (PE) -Executable Location: /tmp/pjp/pj_7309.sys -Executable MD5: 34ce61908daa46bfdb23ff58beeb2875 -Executable SHA256: 933e0862552cf839905efb55bd867a43881eed1680051096d6b6b5250e5674c8 -FSRL: file:///tmp/pjp/pj_7309.sys?MD5=34ce61908daa46bfdb23ff58beeb2875 +Executable Location: /tmp/pjp/pj_7462.sys +Executable MD5: c27422b1434782147b94efab69f660cd +Executable SHA256: 2a9350bc757df5a7480494b2faf40813731baf0dd26c6383b6d86f46dee68468 +FSRL: file:///tmp/pjp/pj_7462.sys?MD5=c27422b1434782147b94efab69f660cd PDB Age: 1 PDB File: prjflt.pdb -PDB GUID: 01f0a175-bebb-212b-82f3-9e623dfd57e4 +PDB GUID: 09bae914-f233-a51e-6248-457e5d4c25bf PDB Loaded: true PDB Version: RSDS PE Property[CompanyName]: Microsoft Corporation PE Property[FileDescription]: Windows Projected File System FS Filter Driver -PE Property[FileVersion]: 10.0.26100.7309 (WinBuild.160101.0800) +PE Property[FileVersion]: 10.0.26100.7462 (WinBuild.160101.0800) PE Property[InternalName]: prjflt.sys PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved. PE Property[OriginalFilename]: prjflt.sys PE Property[ProductName]: Microsoft(R) Windows(R) Kits -PE Property[ProductVersion]: 10.0.26100.7309 +PE Property[ProductVersion]: 10.0.26100.7462 PE Property[Translation]: 4b00409 Preferred Root Namespace Category: RTTI Found: false Relocatable: true SectionAlignment: 4096 Should Ask To Analyze: false ``` ## Program Options
Ghidra pj_7309.sys Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra pj_7309.sys Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra pj_7309.sys Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.Apply Function Calling Conventions|true| |Demangler Microsoft.Apply Function Signatures|true| |Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS| |Demangler Microsoft.Demangle Only Known Mangled Symbols|false| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
Ghidra pj_7462.sys Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra pj_7462.sys Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra pj_7462.sys Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.Apply Function Calling Conventions|true| |Demangler Microsoft.Apply Function Signatures|true| |Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS| |Demangler Microsoft.Demangle Only Known Mangled Symbols|false| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
## Diff Stats |Stat|Value| | :---: | :---: | |added_funcs_len|9| |deleted_funcs_len|0| |modified_funcs_len|18| |added_symbols_len|20| |deleted_symbols_len|5| |diff_time|3.7769839763641357| |deleted_strings_len|0| |added_strings_len|0| |match_types|Counter({'SymbolsHash': 649, 'ExternalsName': 262, 'Implied Match': 1})| |items_to_process|52| |diff_types|Counter({'length': 14, 'code': 13, 'address': 12, 'called': 7, 'refcount': 5, 'sig': 4, 'calling': 3, 'name': 1, 'fullname': 1})| |unmatched_funcs_len|9| |total_funcs_len|1310| |matched_funcs_len|1301| |matched_funcs_with_code_changes_len|13| |matched_funcs_with_non_code_changes_len|5| |matched_funcs_no_changes_len|1283| |match_func_similarity_percent|98.6164%| |func_match_overall_percent|99.3130%| |first_matches|Counter({'SymbolsHash': 649, 'Implied Match': 1})| ```mermaid pie showData title All Matches "SymbolsHash" : 649 "ExternalsName" : 262 "Implied-Match" : 1 ``` ```mermaid pie showData title First Matches "SymbolsHash" : 649 "Implied-Match" : 1 ``` ```mermaid pie showData title Diff Stats "added_funcs_len" : 9 "deleted_funcs_len" : 0 "modified_funcs_len" : 18 ``` ```mermaid pie showData title Symbols "added_symbols_len" : 20 "deleted_symbols_len" : 5 ``` ## Strings *No string differences found* # Deleted # Added ## Feature_3579016506__private_IsEnabledFallback ### Function Meta |Key|pj_7462.sys| | :---: | :---: | |name|Feature_3579016506__private_IsEnabledFallback| |fullname|Feature_3579016506__private_IsEnabledFallback| |refcount|2| |length|21| |called|wil_details_IsEnabledFallback| |calling|Feature_3579016506__private_IsEnabledDeviceUsageNoInline| |paramcount|2| |address|140003ae8| |sig|undefined __fastcall Feature_3579016506__private_IsEnabledFallback(ulonglong param_1, int param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_3579016506__private_IsEnabledFallback +++ Feature_3579016506__private_IsEnabledFallback @@ -0,0 +1,8 @@ + +void Feature_3579016506__private_IsEnabledFallback(ulonglong param_1,int param_2) + +{ + wil_details_IsEnabledFallback(param_1,param_2,&Feature_3579016506__private_descriptor); + return; +} + ``` ## Feature_3797454136__private_IsEnabledDeviceUsageNoInline ### Function Meta |Key|pj_7462.sys| | :---: | :---: | |name|Feature_3797454136__private_IsEnabledDeviceUsageNoInline| |fullname|Feature_3797454136__private_IsEnabledDeviceUsageNoInline| |refcount|4| |length|49| |called|Feature_3797454136__private_IsEnabledFallback| |calling|PrjfAdvanceToNextEnumEntry| |paramcount|0| |address|140004374| |sig|ulonglong __fastcall Feature_3797454136__private_IsEnabledDeviceUsageNoInline(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_3797454136__private_IsEnabledDeviceUsageNoInline +++ Feature_3797454136__private_IsEnabledDeviceUsageNoInline @@ -0,0 +1,17 @@ + +ulonglong Feature_3797454136__private_IsEnabledDeviceUsageNoInline(void) + +{ + ulonglong uVar1; + undefined8 local_res8; + + local_res8 = (ulonglong)Feature_3797454136__private_featureState; + if ((Feature_3797454136__private_featureState & 0x10) == 0) { + uVar1 = Feature_3797454136__private_IsEnabledFallback(local_res8,3); + } + else { + uVar1 = (ulonglong)(Feature_3797454136__private_featureState & 1); + } + return uVar1; +} + ``` ## Feature_3797454136__private_IsEnabledFallback ### Function Meta |Key|pj_7462.sys| | :---: | :---: | |name|Feature_3797454136__private_IsEnabledFallback| |fullname|Feature_3797454136__private_IsEnabledFallback| |refcount|2| |length|21| |called|wil_details_IsEnabledFallback| |calling|Feature_3797454136__private_IsEnabledDeviceUsageNoInline| |paramcount|2| |address|1400043ac| |sig|undefined __fastcall Feature_3797454136__private_IsEnabledFallback(ulonglong param_1, int param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_3797454136__private_IsEnabledFallback +++ Feature_3797454136__private_IsEnabledFallback @@ -0,0 +1,8 @@ + +void Feature_3797454136__private_IsEnabledFallback(ulonglong param_1,int param_2) + +{ + wil_details_IsEnabledFallback(param_1,param_2,&Feature_3797454136__private_descriptor); + return; +} + ``` ## Feature_2814151992__private_IsEnabledDeviceUsageNoInline ### Function Meta |Key|pj_7462.sys| | :---: | :---: | |name|Feature_2814151992__private_IsEnabledDeviceUsageNoInline| |fullname|Feature_2814151992__private_IsEnabledDeviceUsageNoInline| |refcount|2| |length|49| |called|Feature_2814151992__private_IsEnabledFallback| |calling|PrjfCompleteCommandHandler| |paramcount|0| |address|14000452c| |sig|ulonglong __fastcall Feature_2814151992__private_IsEnabledDeviceUsageNoInline(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_2814151992__private_IsEnabledDeviceUsageNoInline +++ Feature_2814151992__private_IsEnabledDeviceUsageNoInline @@ -0,0 +1,17 @@ + +ulonglong Feature_2814151992__private_IsEnabledDeviceUsageNoInline(void) + +{ + ulonglong uVar1; + undefined8 local_res8; + + local_res8 = (ulonglong)Feature_2814151992__private_featureState; + if ((Feature_2814151992__private_featureState & 0x10) == 0) { + uVar1 = Feature_2814151992__private_IsEnabledFallback(local_res8,3); + } + else { + uVar1 = (ulonglong)(Feature_2814151992__private_featureState & 1); + } + return uVar1; +} + ``` ## Feature_2814151992__private_IsEnabledFallback ### Function Meta |Key|pj_7462.sys| | :---: | :---: | |name|Feature_2814151992__private_IsEnabledFallback| |fullname|Feature_2814151992__private_IsEnabledFallback| |refcount|2| |length|21| |called|wil_details_IsEnabledFallback| |calling|Feature_2814151992__private_IsEnabledDeviceUsageNoInline| |paramcount|2| |address|140004564| |sig|undefined __fastcall Feature_2814151992__private_IsEnabledFallback(ulonglong param_1, int param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_2814151992__private_IsEnabledFallback +++ Feature_2814151992__private_IsEnabledFallback @@ -0,0 +1,8 @@ + +void Feature_2814151992__private_IsEnabledFallback(ulonglong param_1,int param_2) + +{ + wil_details_IsEnabledFallback(param_1,param_2,&Feature_2814151992__private_descriptor); + return; +} + ``` ## Feature_4287139131__private_IsEnabledDeviceUsageNoInline ### Function Meta |Key|pj_7462.sys| | :---: | :---: | |name|Feature_4287139131__private_IsEnabledDeviceUsageNoInline| |fullname|Feature_4287139131__private_IsEnabledDeviceUsageNoInline| |refcount|9| |length|49| |called|Feature_4287139131__private_IsEnabledFallback| |calling|PrjfValidateNamesInEnumeration| |paramcount|0| |address|1400045d4| |sig|ulonglong __fastcall Feature_4287139131__private_IsEnabledDeviceUsageNoInline(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_4287139131__private_IsEnabledDeviceUsageNoInline +++ Feature_4287139131__private_IsEnabledDeviceUsageNoInline @@ -0,0 +1,17 @@ + +ulonglong Feature_4287139131__private_IsEnabledDeviceUsageNoInline(void) + +{ + ulonglong uVar1; + undefined8 local_res8; + + local_res8 = (ulonglong)Feature_4287139131__private_featureState; + if ((Feature_4287139131__private_featureState & 0x10) == 0) { + uVar1 = Feature_4287139131__private_IsEnabledFallback(local_res8,3); + } + else { + uVar1 = (ulonglong)(Feature_4287139131__private_featureState & 1); + } + return uVar1; +} + ``` ## Feature_4287139131__private_IsEnabledFallback ### Function Meta |Key|pj_7462.sys| | :---: | :---: | |name|Feature_4287139131__private_IsEnabledFallback| |fullname|Feature_4287139131__private_IsEnabledFallback| |refcount|2| |length|21| |called|wil_details_IsEnabledFallback| |calling|Feature_4287139131__private_IsEnabledDeviceUsageNoInline| |paramcount|2| |address|14000460c| |sig|undefined __fastcall Feature_4287139131__private_IsEnabledFallback(ulonglong param_1, int param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_4287139131__private_IsEnabledFallback +++ Feature_4287139131__private_IsEnabledFallback @@ -0,0 +1,8 @@ + +void Feature_4287139131__private_IsEnabledFallback(ulonglong param_1,int param_2) + +{ + wil_details_IsEnabledFallback(param_1,param_2,&Feature_4287139131__private_descriptor); + return; +} + ``` ## Feature_3568532792__private_IsEnabledDeviceUsageNoInline ### Function Meta |Key|pj_7462.sys| | :---: | :---: | |name|Feature_3568532792__private_IsEnabledDeviceUsageNoInline| |fullname|Feature_3568532792__private_IsEnabledDeviceUsageNoInline| |refcount|2| |length|49| |called|Feature_3568532792__private_IsEnabledFallback| |calling|PrjfGetPrjReparseData| |paramcount|0| |address|14000633c| |sig|ulonglong __fastcall Feature_3568532792__private_IsEnabledDeviceUsageNoInline(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_3568532792__private_IsEnabledDeviceUsageNoInline +++ Feature_3568532792__private_IsEnabledDeviceUsageNoInline @@ -0,0 +1,17 @@ + +ulonglong Feature_3568532792__private_IsEnabledDeviceUsageNoInline(void) + +{ + ulonglong uVar1; + undefined8 local_res8; + + local_res8 = (ulonglong)Feature_3568532792__private_featureState; + if ((Feature_3568532792__private_featureState & 0x10) == 0) { + uVar1 = Feature_3568532792__private_IsEnabledFallback(local_res8,3); + } + else { + uVar1 = (ulonglong)(Feature_3568532792__private_featureState & 1); + } + return uVar1; +} + ``` ## Feature_3568532792__private_IsEnabledFallback ### Function Meta |Key|pj_7462.sys| | :---: | :---: | |name|Feature_3568532792__private_IsEnabledFallback| |fullname|Feature_3568532792__private_IsEnabledFallback| |refcount|2| |length|21| |called|wil_details_IsEnabledFallback| |calling|Feature_3568532792__private_IsEnabledDeviceUsageNoInline| |paramcount|2| |address|140006374| |sig|undefined __fastcall Feature_3568532792__private_IsEnabledFallback(ulonglong param_1, int param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_3568532792__private_IsEnabledFallback +++ Feature_3568532792__private_IsEnabledFallback @@ -0,0 +1,8 @@ + +void Feature_3568532792__private_IsEnabledFallback(ulonglong param_1,int param_2) + +{ + wil_details_IsEnabledFallback(param_1,param_2,&Feature_3568532792__private_descriptor); + return; +} + ``` # Modified *Modified functions contain code changes* ## PrjfGetPrjReparseData ### Match Info |Key|pj_7309.sys - pj_7462.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.3| |i_ratio|0.61| |m_ratio|0.94| |b_ratio|0.94| |match_types|SymbolsHash| ### Function Meta Diff |Key|pj_7309.sys|pj_7462.sys| | :---: | :---: | :---: | |name|PrjfGetPrjReparseData|PrjfGetPrjReparseData| |fullname|PrjfGetPrjReparseData|PrjfGetPrjReparseData| |refcount|4|4| |`length`|678|763| |`called`|FLTMGR.SYS::FltFsControlFile
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
WPP_RECORDER_SF_sDqd|FLTMGR.SYS::FltFsControlFile
Feature_3568532792__private_IsEnabledDeviceUsageNoInline
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
WPP_RECORDER_SF_sDqd| |calling|PrjfFsctlSetReparsePointPostOp
PrjfFsctlStartVirtualizationInstance
PrjfGetSetContextFileObject|PrjfFsctlSetReparsePointPostOp
PrjfFsctlStartVirtualizationInstance
PrjfGetSetContextFileObject| |paramcount|4|4| |`address`|14002e528|14002e8e8| |sig|int __fastcall PrjfGetPrjReparseData(undefined8 param_1, longlong param_2, undefined8 * param_3, undefined1 * param_4)|int __fastcall PrjfGetPrjReparseData(undefined8 param_1, longlong param_2, undefined8 * param_3, undefined1 * param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### PrjfGetPrjReparseData Called Diff ```diff --- PrjfGetPrjReparseData called +++ PrjfGetPrjReparseData called @@ -1,0 +2 @@ +Feature_3568532792__private_IsEnabledDeviceUsageNoInline ``` ### PrjfGetPrjReparseData Diff ```diff --- PrjfGetPrjReparseData +++ PrjfGetPrjReparseData @@ -1,91 +1,101 @@ int PrjfGetPrjReparseData (undefined8 param_1,longlong param_2,undefined8 *param_3,undefined1 *param_4) { int *piVar1; - byte bVar2; - int iVar3; - undefined2 uVar4; + ulonglong uVar2; + byte bVar3; + int iVar4; + undefined2 uVar5; uint local_res10 [2]; ulonglong in_stack_ffffffffffffffa8; local_res10[0] = 0; - iVar3 = *(ushort *)(param_2 + 0x58) + 0x1a; - do { - piVar1 = (int *)ExAllocatePool2(0x100,iVar3,0x69724a50); + iVar4 = *(ushort *)(param_2 + 0x58) + 0x1a; + while( true ) { + piVar1 = (int *)ExAllocatePool2(0x100,iVar4,0x69724a50); if (piVar1 == (int *)0x0) { return -0x3fffff66; } in_stack_ffffffffffffffa8 = in_stack_ffffffffffffffa8 & 0xffffffff00000000; - iVar3 = FltFsControlFile(param_1,param_2,0x900a8,0,in_stack_ffffffffffffffa8,piVar1,iVar3, + iVar4 = FltFsControlFile(param_1,param_2,0x900a8,0,in_stack_ffffffffffffffa8,piVar1,iVar4, local_res10); - if (iVar3 == 0x103) { + if (iVar4 == 0x103) { MicrosoftTelemetryAssertTriggeredNoArgsKM(); } - else if (iVar3 == -0x3ffffd8b) { + else if (iVar4 == -0x3ffffd8b) { *param_3 = 0; - iVar3 = 0; + iVar4 = 0; *param_4 = 0; goto LAB_0; } - if (local_res10[0] < 8) { -LAB_1: - if (iVar3 < 0) { - if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0; - uVar4 = 0x1a; - bVar2 = 2; - } - else { - if (local_res10[0] < *(ushort *)(piVar1 + 1) + 8) { - iVar3 = -0x3fff31fe; - if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) - goto LAB_0; - uVar4 = 0x1b; - } - else if (*(ushort *)(piVar1 + 1) == (ushort)((short)piVar1[0x48] + 0x11aU)) { - if (1 < (uint)piVar1[2]) { - *param_4 = 1; - *param_3 = piVar1; - return iVar3; - } - iVar3 = -0x3fffff45; - if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) - goto LAB_0; - uVar4 = 0x1d; - } - else { - iVar3 = -0x3fff31fe; - if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) - goto LAB_0; - uVar4 = 0x1c; - } -LAB_2: - bVar2 = 4; - } - WPP_RECORDER_SF_sDqd - (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),bVar2,5,uVar4, - &WPP_2460d16852bb36967a0c5d77aec11f17_Traceguids, - "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c"); -LAB_0: - ExFreePoolWithTag(piVar1,0x69724a50); - return iVar3; - } + if (local_res10[0] < 8) break; if (*piVar1 != -0x6fffffe4) { - iVar3 = 0; + iVar4 = 0; *param_3 = 0; *param_4 = 0; goto LAB_0; } - if (iVar3 != -0x7ffffffb) goto LAB_1; + if (iVar4 != -0x7ffffffb) break; if (*(ushort *)(piVar1 + 1) < 0x11a) { - iVar3 = -0x3fff31fe; + iVar4 = -0x3fff31fe; if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0; - uVar4 = 0x19; - goto LAB_2; + uVar5 = 0x19; + goto LAB_1; } - iVar3 = *(ushort *)(piVar1 + 1) + 8; + iVar4 = *(ushort *)(piVar1 + 1) + 8; ExFreePoolWithTag(piVar1,0x69724a50); - } while( true ); + } + if (iVar4 < 0) { + if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0; + uVar5 = 0x1a; + bVar3 = 2; + } + else { + if (local_res10[0] < *(ushort *)(piVar1 + 1) + 8) { + iVar4 = -0x3fff31fe; + if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0; + uVar5 = 0x1b; + } + else { + uVar2 = Feature_3568532792__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar2 != 0) { + if ((ushort)(*(ushort *)(piVar1 + 0x48) + 0x11a) < *(ushort *)(piVar1 + 0x48)) { + iVar4 = -0x3fff31fe; + if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) + goto LAB_0; + uVar5 = 0x1c; + iVar4 = -0x3fff31fe; + goto LAB_1; + } + iVar4 = 0; + } + if ((short)piVar1[1] == (short)((short)piVar1[0x48] + 0x11a)) { + if (1 < (uint)piVar1[2]) { + *param_4 = 1; + *param_3 = piVar1; + return iVar4; + } + iVar4 = -0x3fffff45; + if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0; + uVar5 = 0x1e; + } + else { + iVar4 = -0x3fff31fe; + if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0; + uVar5 = 0x1d; + } + } +LAB_1: + bVar3 = 4; + } + WPP_RECORDER_SF_sDqd + (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),bVar3,5,uVar5, + &WPP_d105f3c1388d302f0868144c31c5620c_Traceguids, + "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c"); +LAB_0: + ExFreePoolWithTag(piVar1,0x69724a50); + return iVar4; } ``` ## PrjfOpenAsReparsePoint ### Match Info |Key|pj_7309.sys - pj_7462.sys| | :---: | :---: | |diff_type|code,length,sig,address| |ratio|0.46| |i_ratio|0.7| |m_ratio|1.0| |b_ratio|0.97| |match_types|SymbolsHash| ### Function Meta Diff |Key|pj_7309.sys|pj_7462.sys| | :---: | :---: | :---: | |name|PrjfOpenAsReparsePoint|PrjfOpenAsReparsePoint| |fullname|PrjfOpenAsReparsePoint|PrjfOpenAsReparsePoint| |refcount|7|7| |`length`|1347|1340| |called|FLTMGR.SYS::FltGetInstanceContext
FLTMGR.SYS::FltReleaseContext
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExAllocateFromPagedLookasideList
NTOSKRNL.EXE::ExFreeToPagedLookasideList
PrjfOpenReparsePoint
WPP_RECORDER_SF_sDd
WPP_RECORDER_SF_sDdZssss|FLTMGR.SYS::FltGetInstanceContext
FLTMGR.SYS::FltReleaseContext
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExAllocateFromPagedLookasideList
NTOSKRNL.EXE::ExFreeToPagedLookasideList
PrjfOpenReparsePoint
WPP_RECORDER_SF_sDd
WPP_RECORDER_SF_sDdZssss| |calling|PrjfDecideUpdateDeleteOnFileStateAndUpdateFlags
PrjfDeleteTombstoneIfExists
PrjfOpenAndCheckEmptyPartialDirectory
PrjfPostCreate
PrjfProcessFileDirectoryStatus
PrjfProcessTombstoneBounce|PrjfDecideUpdateDeleteOnFileStateAndUpdateFlags
PrjfDeleteTombstoneIfExists
PrjfOpenAndCheckEmptyPartialDirectory
PrjfPostCreate
PrjfProcessFileDirectoryStatus
PrjfProcessTombstoneBounce| |paramcount|12|12| |`address`|14002f764|14002fb78| |`sig`|int __fastcall PrjfOpenAsReparsePoint(wchar_t * param_1, undefined8 param_2, undefined8 param_3, undefined4 param_4, undefined8 param_5, longlong param_6, longlong param_7, byte * param_8, byte * param_9, undefined8 * * * * * * * param_10, byte * param_11, uint * param_12)|int __fastcall PrjfOpenAsReparsePoint(wchar_t * param_1, undefined8 param_2, undefined8 param_3, undefined4 param_4, undefined8 param_5, longlong param_6, longlong param_7, byte * param_8, byte * param_9, byte * param_10, undefined8 * * * * * * * param_11, uint * param_12)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### PrjfOpenAsReparsePoint Diff ```diff --- PrjfOpenAsReparsePoint +++ PrjfOpenAsReparsePoint @@ -1,257 +1,262 @@ - -/* WARNING: Removing unreachable block (ram,0x00014002fc12) */ int PrjfOpenAsReparsePoint (wchar_t *param_1,undefined8 param_2,undefined8 param_3,undefined4 param_4, undefined8 param_5,longlong param_6,longlong param_7,byte *param_8,byte *param_9, - undefined8 *******param_10,byte *param_11,uint *param_12) + byte *param_10,undefined8 *******param_11,uint *param_12) { undefined8 uVar1; code *pcVar2; int iVar3; - undefined8 *********pppppppppuVar4; - undefined8 *********pppppppppuVar5; - undefined8 *********pppppppppuVar6; - undefined8 *********pppppppppuVar7; + undefined8 ********ppppppppuVar4; + undefined8 ********ppppppppuVar5; + undefined8 ********ppppppppuVar6; + undefined8 ********ppppppppuVar7; ulonglong uVar8; char *pcVar9; char *pcVar10; uint uVar11; undefined1 *puVar12; undefined1 *puVar13; undefined1 *puVar14; - undefined8 *********pppppppppuVar15; + undefined8 ********ppppppppuVar15; char *pcVar16; undefined2 uVar17; - byte *unaff_R12; - undefined8 *********pppppppppuVar18; - undefined8 *********pppppppppuVar19; - undefined8 *********pppppppppuVar20; + undefined8 ********ppppppppuVar18; + byte *unaff_R13; + undefined8 ********ppppppppuVar19; undefined1 auStackY_d8 [8]; undefined1 auStackY_d0 [24]; - undefined8 ********local_60; - undefined8 ********local_58; + longlong local_68; + undefined8 *******local_60; + undefined8 *******local_58; puVar12 = auStackY_d8; puVar13 = auStackY_d8; - pppppppppuVar18 = (undefined8 *********)0x0; + ppppppppuVar18 = (undefined8 ********)0x0; uVar11 = 0x80000004; - pppppppppuVar20 = (undefined8 *********)0x0; - pppppppppuVar15 = (undefined8 *********)0x0; + local_68 = 0; + ppppppppuVar19 = (undefined8 ********)0x0; + ppppppppuVar15 = (undefined8 ********)0x0; puVar14 = auStackY_d8; if ((param_6 == 0) || (puVar14 = auStackY_d8, param_7 == 0)) goto LAB_0; - FltGetInstanceContext(param_3); - MicrosoftTelemetryAssertTriggeredNoArgsKM(); - if ((iRam0000000000000018 != 2) && (iRam0000000000000018 != 0x1c)) { + iVar3 = FltGetInstanceContext(param_3,&local_68); + if ((iVar3 < 0) || (local_68 == 0)) { + MicrosoftTelemetryAssertTriggeredNoArgsKM(); + } + if ((*(int *)(local_68 + 0x18) != 2) && (*(int *)(local_68 + 0x18) != 0x1c)) { MicrosoftTelemetryAssertTriggeredNoArgsKM(); } if (param_12 != (uint *)0x0) { uVar11 = *param_12; } local_58 = &local_60; local_60 = &local_60; - pppppppppuVar4 = pppppppppuVar18; - pppppppppuVar7 = pppppppppuVar18; - pppppppppuVar19 = pppppppppuVar18; - pppppppppuVar5 = pppppppppuVar18; - pppppppppuVar6 = pppppppppuVar18; + ppppppppuVar4 = ppppppppuVar18; + ppppppppuVar7 = ppppppppuVar18; + ppppppppuVar5 = ppppppppuVar18; + ppppppppuVar6 = ppppppppuVar18; if (param_8 == (byte *)0x0) { LAB_1: uVar11 = uVar11 | 0x80000000; - pppppppppuVar7 = pppppppppuVar15; + ppppppppuVar7 = ppppppppuVar15; if (param_9 != (byte *)0x0) { *param_9 = 0; - pppppppppuVar5 = (undefined8 *********)ExAllocateFromPagedLookasideList(&DAT_2); - pppppppppuVar6 = pppppppppuVar20; - if (pppppppppuVar5 == (undefined8 *********)0x0) { - puVar13 = auStackY_d8; - if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) { - uVar17 = 0x31; - goto LAB_3; - } - goto LAB_4; - } - pppppppppuVar5[1] = pppppppppuVar5; - *pppppppppuVar5 = pppppppppuVar5; - pppppppppuVar5[3] = (undefined8 ********)0x0; - pppppppppuVar5[4] = (undefined8 ********)0x0; - *(undefined4 *)(pppppppppuVar5 + 2) = 0xa000000c; - *(uint *)((longlong)pppppppppuVar5 + 0x14) = uVar11; - *(undefined4 *)(pppppppppuVar5 + 5) = 0x30; - if ((undefined8 *********)*local_58 != &local_60) goto LAB_5; - pppppppppuVar5[1] = local_58; - *pppppppppuVar5 = &local_60; - *local_58 = pppppppppuVar5; - local_58 = pppppppppuVar5; - } - pppppppppuVar6 = pppppppppuVar18; - pppppppppuVar19 = (undefined8 *********)param_10; - if (param_10 != (undefined8 *******)0x0) { - *(undefined1 *)param_10 = 0; - pppppppppuVar6 = (undefined8 *********)ExAllocateFromPagedLookasideList(&DAT_2); - if (pppppppppuVar6 == (undefined8 *********)0x0) { + ppppppppuVar5 = (undefined8 ********)ExAllocateFromPagedLookasideList(&DAT_2); + ppppppppuVar6 = ppppppppuVar19; + if (ppppppppuVar5 == (undefined8 ********)0x0) { puVar13 = auStackY_d8; if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) { uVar17 = 0x32; goto LAB_3; } goto LAB_4; } - pppppppppuVar6[1] = pppppppppuVar6; - *pppppppppuVar6 = pppppppppuVar6; - pppppppppuVar6[3] = (undefined8 ********)0x0; - pppppppppuVar6[4] = (undefined8 ********)0x0; - *(undefined4 *)(pppppppppuVar6 + 2) = 0xa0000003; - *(uint *)((longlong)pppppppppuVar6 + 0x14) = uVar11; - *(undefined4 *)(pppppppppuVar6 + 5) = 0x30; - if ((undefined8 *********)*local_58 != &local_60) goto LAB_5; - pppppppppuVar6[1] = local_58; - *pppppppppuVar6 = &local_60; - *local_58 = pppppppppuVar6; - local_58 = pppppppppuVar6; + ppppppppuVar5[1] = ppppppppuVar5; + *ppppppppuVar5 = ppppppppuVar5; + ppppppppuVar5[3] = (undefined8 *******)0x0; + ppppppppuVar5[4] = (undefined8 *******)0x0; + *(undefined4 *)(ppppppppuVar5 + 2) = 0xa000000c; + *(uint *)((longlong)ppppppppuVar5 + 0x14) = uVar11; + *(undefined4 *)(ppppppppuVar5 + 5) = 0x30; + if ((undefined8 ********)*local_58 != &local_60) goto LAB_5; + ppppppppuVar5[1] = local_58; + *ppppppppuVar5 = &local_60; + *local_58 = ppppppppuVar5; + local_58 = ppppppppuVar5; + } + ppppppppuVar6 = ppppppppuVar18; + unaff_R13 = param_10; + if (param_10 != (byte *)0x0) { + *param_10 = 0; + ppppppppuVar6 = (undefined8 ********)ExAllocateFromPagedLookasideList(&DAT_2); + if (ppppppppuVar6 == (undefined8 ********)0x0) { + puVar13 = auStackY_d8; + if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) { + uVar17 = 0x33; + goto LAB_3; + } + goto LAB_4; + } + ppppppppuVar6[1] = ppppppppuVar6; + *ppppppppuVar6 = ppppppppuVar6; + ppppppppuVar6[3] = (undefined8 *******)0x0; + ppppppppuVar6[4] = (undefined8 *******)0x0; + *(undefined4 *)(ppppppppuVar6 + 2) = 0xa0000003; + *(uint *)((longlong)ppppppppuVar6 + 0x14) = uVar11; + *(undefined4 *)(ppppppppuVar6 + 5) = 0x30; + if ((undefined8 ********)*local_58 != &local_60) goto LAB_5; + ppppppppuVar6[1] = local_58; + *ppppppppuVar6 = &local_60; + *local_58 = ppppppppuVar6; + local_58 = ppppppppuVar6; } puVar14 = auStackY_d8; - pppppppppuVar7 = pppppppppuVar18; - if (param_11 == (byte *)0x0) { + ppppppppuVar7 = ppppppppuVar18; + if (param_11 == (undefined8 *******)0x0) { LAB_6: puVar13 = puVar14; *(longlong *)(puVar13 + 0x40) = param_7; *(longlong *)(puVar13 + 0x38) = param_6; - *(undefined8 **********)(puVar13 + 0x30) = &local_60; + *(undefined8 *********)(puVar13 + 0x30) = &local_60; *(undefined4 *)(puVar13 + 0x20) = 0x28; - *(undefined8 *)(puVar13 + -8) = 0x14002fb0e; + *(undefined8 *)(puVar13 + -8) = 0x14002ff1e; uVar8 = PrjfOpenReparsePoint (param_3,param_1,param_2,param_4,*(undefined4 *)(puVar13 + 0x20), *(undefined8 *)(puVar13 + 0x28),*(longlong **)(puVar13 + 0x30), *(undefined8 *)(puVar13 + 0x38),*(undefined8 *)(puVar13 + 0x40)); iVar3 = (int)uVar8; if (iVar3 < 0) { if (((iVar3 != -0x3fffffcc) && (iVar3 != -0x3fffffc6)) && ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED)) { pcVar16 = "did"; pcVar10 = "did"; + if ((undefined8 ********)param_11 == (undefined8 ********)0x0) { + pcVar10 = "did NOT"; + } pcVar9 = "did"; - if (param_11 == (byte *)0x0) { - pcVar10 = "did NOT"; - } *(char **)(puVar13 + 0x60) = pcVar10; - if (pppppppppuVar19 == (undefined8 *********)0x0) { + if (param_10 == (byte *)0x0) { pcVar9 = "did NOT"; } *(char **)(puVar13 + 0x58) = pcVar9; if (param_9 == (byte *)0x0) { pcVar16 = "did NOT"; } - pcVar9 = "Did"; + pcVar10 = "Did"; *(char **)(puVar13 + 0x50) = pcVar16; if (param_8 == (byte *)0x0) { - pcVar9 = "Did NOT"; + pcVar10 = "Did NOT"; } uVar1 = *(undefined8 *)(WPP_GLOBAL_Control + 0x40); - *(char **)(puVar13 + 0x48) = pcVar9; + *(char **)(puVar13 + 0x48) = pcVar10; *(wchar_t **)(puVar13 + 0x40) = param_1; *(int *)(puVar13 + 0x38) = iVar3; - *(undefined8 *)(puVar13 + -8) = 0x14002fbbf; + *(undefined8 *)(puVar13 + -8) = 0x14002ffcc; WPP_RECORDER_SF_sDdZssss(uVar1); } } else { if (param_8 != (byte *)0x0) { - *param_8 = *(byte *)((longlong)pppppppppuVar4 + 0x14) & 1; + *param_8 = *(byte *)((longlong)ppppppppuVar4 + 0x14) & 1; } if (param_9 != (byte *)0x0) { - *param_9 = *(byte *)((longlong)pppppppppuVar5 + 0x14) & 1; - } - if (pppppppppuVar19 != (undefined8 *********)0x0) { - *(byte *)pppppppppuVar19 = *(byte *)((longlong)pppppppppuVar6 + 0x14) & 1; - } - if (param_11 != (byte *)0x0) { - *param_11 = *(byte *)((longlong)pppppppppuVar7 + 0x14) & 1; + *param_9 = *(byte *)((longlong)ppppppppuVar5 + 0x14) & 1; + } + if (param_10 != (byte *)0x0) { + *param_10 = *(byte *)((longlong)ppppppppuVar6 + 0x14) & 1; + } + if ((undefined8 ********)param_11 != (undefined8 ********)0x0) { + *(byte *)param_11 = *(byte *)((longlong)ppppppppuVar7 + 0x14) & 1; } } } else { - *param_11 = 0; - pppppppppuVar7 = (undefined8 *********)ExAllocateFromPagedLookasideList(&DAT_2); - if (pppppppppuVar7 != (undefined8 *********)0x0) { - pppppppppuVar7[1] = pppppppppuVar7; - *pppppppppuVar7 = pppppppppuVar7; - pppppppppuVar7[3] = (undefined8 ********)0x0; - pppppppppuVar7[4] = (undefined8 ********)0x0; - *(undefined4 *)(pppppppppuVar7 + 2) = 0xa0000022; - *(uint *)((longlong)pppppppppuVar7 + 0x14) = uVar11; - *(undefined4 *)(pppppppppuVar7 + 5) = 0x30; - unaff_R12 = param_11; - if ((undefined8 *********)*local_58 != &local_60) goto LAB_5; + *(undefined1 *)param_11 = 0; + ppppppppuVar7 = (undefined8 ********)ExAllocateFromPagedLookasideList(&DAT_2); + if (ppppppppuVar7 != (undefined8 ********)0x0) { + ppppppppuVar7[1] = ppppppppuVar7; + *ppppppppuVar7 = ppppppppuVar7; + ppppppppuVar7[3] = (undefined8 *******)0x0; + ppppppppuVar7[4] = (undefined8 *******)0x0; + *(undefined4 *)(ppppppppuVar7 + 2) = 0xa0000022; + *(uint *)((longlong)ppppppppuVar7 + 0x14) = uVar11; + *(undefined4 *)(ppppppppuVar7 + 5) = 0x30; + ppppppppuVar18 = (undefined8 ********)param_11; + if ((undefined8 ********)*local_58 != &local_60) goto LAB_5; goto LAB_7; } if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) { - uVar17 = 0x33; + uVar17 = 0x34; goto LAB_3; } } } else { *param_8 = 0; - pppppppppuVar4 = (undefined8 *********)ExAllocateFromPagedLookasideList(&DAT_2); - if (pppppppppuVar4 != (undefined8 *********)0x0) { - pppppppppuVar4[1] = pppppppppuVar4; - *pppppppppuVar4 = pppppppppuVar4; - pppppppppuVar4[3] = (undefined8 ********)0x0; - pppppppppuVar4[4] = (undefined8 ********)0x0; - *(undefined4 *)(pppppppppuVar4 + 2) = 0x9000001c; - *(uint *)((longlong)pppppppppuVar4 + 0x14) = uVar11 | 0x80000000; - *(undefined4 *)(pppppppppuVar4 + 5) = 0x30; - if ((undefined8 *********)*local_58 == &local_60) { - pppppppppuVar4[1] = local_58; - *pppppppppuVar4 = &local_60; - *local_58 = pppppppppuVar4; - local_58 = pppppppppuVar4; + ppppppppuVar4 = (undefined8 ********)ExAllocateFromPagedLookasideList(&DAT_2); + if (ppppppppuVar4 != (undefined8 ********)0x0) { + ppppppppuVar4[1] = ppppppppuVar4; + *ppppppppuVar4 = ppppppppuVar4; + ppppppppuVar4[3] = (undefined8 *******)0x0; + ppppppppuVar4[4] = (undefined8 *******)0x0; + *(undefined4 *)(ppppppppuVar4 + 2) = 0x9000001c; + *(uint *)((longlong)ppppppppuVar4 + 0x14) = uVar11 | 0x80000000; + *(undefined4 *)(ppppppppuVar4 + 5) = 0x30; + if ((undefined8 ********)*local_58 == &local_60) { + ppppppppuVar4[1] = local_58; + *ppppppppuVar4 = &local_60; + *local_58 = ppppppppuVar4; + local_58 = ppppppppuVar4; goto LAB_1; } LAB_5: pcVar2 = (code *)swi(0x29); - local_58 = (undefined8 ********)(*pcVar2)(3); + local_58 = (undefined8 *******)(*pcVar2)(3); puVar12 = auStackY_d0; - param_11 = unaff_R12; + param_11 = ppppppppuVar18; + param_10 = unaff_R13; LAB_7: - pppppppppuVar7[1] = local_58; - *pppppppppuVar7 = &local_60; - *local_58 = pppppppppuVar7; - local_58 = pppppppppuVar7; + ppppppppuVar7[1] = local_58; + *ppppppppuVar7 = &local_60; + *local_58 = ppppppppuVar7; + local_58 = ppppppppuVar7; puVar14 = puVar12; goto LAB_6; } puVar13 = auStackY_d8; if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) { - uVar17 = 0x30; + uVar17 = 0x31; LAB_3: WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,10,uVar17, - &WPP_2460d16852bb36967a0c5d77aec11f17_Traceguids, + &WPP_d105f3c1388d302f0868144c31c5620c_Traceguids, "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c"); puVar13 = auStackY_d8; } } LAB_4: - if (pppppppppuVar4 != (undefined8 *********)0x0) { - *(undefined8 *)(puVar13 + -8) = 0x14002fc34; - ExFreeToPagedLookasideList(&DAT_2,pppppppppuVar4); - } - if (pppppppppuVar5 != (undefined8 *********)0x0) { - *(undefined8 *)(puVar13 + -8) = 0x14002fc4f; - ExFreeToPagedLookasideList(&DAT_2,pppppppppuVar5); - } - if (pppppppppuVar6 != (undefined8 *********)0x0) { - *(undefined8 *)(puVar13 + -8) = 0x14002fc6a; - ExFreeToPagedLookasideList(&DAT_2,pppppppppuVar6); + if (local_68 != 0) { + *(undefined8 *)(puVar13 + -8) = 0x140030026; + FltReleaseContext(); + } + if (ppppppppuVar4 != (undefined8 ********)0x0) { + *(undefined8 *)(puVar13 + -8) = 0x140030041; + ExFreeToPagedLookasideList(&DAT_2,ppppppppuVar4); + } + if (ppppppppuVar5 != (undefined8 ********)0x0) { + *(undefined8 *)(puVar13 + -8) = 0x14003005c; + ExFreeToPagedLookasideList(&DAT_2,ppppppppuVar5); + } + if (ppppppppuVar6 != (undefined8 ********)0x0) { + *(undefined8 *)(puVar13 + -8) = 0x140030077; + ExFreeToPagedLookasideList(&DAT_2,ppppppppuVar6); } puVar14 = puVar13; - if (pppppppppuVar7 != (undefined8 *********)0x0) { - *(undefined8 *)(puVar13 + -8) = 0x14002fc85; - ExFreeToPagedLookasideList(&DAT_2,pppppppppuVar7); + if (ppppppppuVar7 != (undefined8 ********)0x0) { + *(undefined8 *)(puVar13 + -8) = 0x140030092; + ExFreeToPagedLookasideList(&DAT_2,ppppppppuVar7); } LAB_0: return (int)*(undefined8 *)(puVar14 + 200); } ``` ## PrjfSetupVolumeInformationHandler ### Match Info |Key|pj_7309.sys - pj_7462.sys| | :---: | :---: | |diff_type|code,length,address| |ratio|0.65| |i_ratio|0.55| |m_ratio|1.0| |b_ratio|0.99| |match_types|SymbolsHash| ### Function Meta Diff |Key|pj_7309.sys|pj_7462.sys| | :---: | :---: | :---: | |name|PrjfSetupVolumeInformationHandler|PrjfSetupVolumeInformationHandler| |fullname|PrjfSetupVolumeInformationHandler|PrjfSetupVolumeInformationHandler| |refcount|2|2| |`length`|1386|1381| |called|
Expand for full list:
FLTMGR.SYS::FltAllocatePoolAlignedWithTag
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltCreateFileEx
FLTMGR.SYS::FltCreateSystemVolumeInformationFolder
FLTMGR.SYS::FltFreePoolAlignedWithTag
FLTMGR.SYS::FltGetVolumeFromName
FLTMGR.SYS::FltGetVolumeName
FLTMGR.SYS::FltObjectDereference
FLTMGR.SYS::FltWriteFile
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExFreePoolWithTagNTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::RtlAppendUnicodeToString
NTOSKRNL.EXE::RtlInitUnicodeString
PrjfAllocateUnicodeString
PrjfGetInstanceFromVolumeName
WPP_RECORDER_SF_sDZd
WPP_RECORDER_SF_sDd
memcpy
memset
|
Expand for full list:
FLTMGR.SYS::FltAllocatePoolAlignedWithTag
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltCreateFileEx
FLTMGR.SYS::FltCreateSystemVolumeInformationFolder
FLTMGR.SYS::FltFreePoolAlignedWithTag
FLTMGR.SYS::FltGetVolumeFromName
FLTMGR.SYS::FltGetVolumeName
FLTMGR.SYS::FltObjectDereference
FLTMGR.SYS::FltWriteFile
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExFreePoolWithTagNTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::RtlAppendUnicodeToString
NTOSKRNL.EXE::RtlInitUnicodeString
PrjfAllocateUnicodeString
PrjfGetInstanceFromVolumeName
WPP_RECORDER_SF_sDZd
WPP_RECORDER_SF_sDd
memcpy
memset
| |calling|PrjfPortMessage|PrjfPortMessage| |paramcount|2|2| |`address`|140004f20|1400050e0| |sig|int __fastcall PrjfSetupVolumeInformationHandler(uint * param_1, uint param_2)|int __fastcall PrjfSetupVolumeInformationHandler(uint * param_1, uint param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### PrjfSetupVolumeInformationHandler Diff ```diff --- PrjfSetupVolumeInformationHandler +++ PrjfSetupVolumeInformationHandler @@ -1,198 +1,198 @@ int PrjfSetupVolumeInformationHandler(uint *param_1,uint param_2) { uint uVar1; ushort uVar2; int iVar3; undefined8 uVar4; void *_Dst; undefined2 uVar5; longlong local_res8; uint local_res10 [2]; longlong local_res18; longlong local_res20; - undefined8 in_stack_fffffffffffffef8; + undefined8 in_stack_ffffffffffffff08; undefined4 uVar6; - undefined8 in_stack_ffffffffffffff08; + undefined8 in_stack_ffffffffffffff18; undefined4 uVar7; - undefined8 in_stack_ffffffffffffff18; + undefined8 in_stack_ffffffffffffff28; undefined4 uVar8; - undefined8 local_a8; - longlong local_a0; undefined8 local_98; - longlong lStack_90; - wchar_t local_88 [4]; - uint *puStack_80; - undefined8 local_78; - undefined8 uStack_70; + longlong local_90; + undefined8 local_88; + longlong lStack_80; + wchar_t local_78 [4]; + uint *puStack_70; undefined8 local_68; undefined8 uStack_60; - undefined1 *local_58; + undefined8 local_58; undefined8 uStack_50; - undefined8 local_48; - ulonglong uStack_40; + undefined1 *local_48; + undefined8 uStack_40; + undefined8 local_38; + ulonglong uStack_30; - uVar6 = (undefined4)((ulonglong)in_stack_fffffffffffffef8 >> 0x20); - uVar8 = (undefined4)((ulonglong)in_stack_ffffffffffffff18 >> 0x20); - uVar7 = (undefined4)((ulonglong)in_stack_ffffffffffffff08 >> 0x20); + uVar6 = (undefined4)((ulonglong)in_stack_ffffffffffffff08 >> 0x20); + uVar8 = (undefined4)((ulonglong)in_stack_ffffffffffffff28 >> 0x20); + uVar7 = (undefined4)((ulonglong)in_stack_ffffffffffffff18 >> 0x20); local_res8 = 0; - local_48 = 0; - uStack_40 = uStack_40 & 0xffffffff00000000; - local_a0 = 0; + local_38 = 0; + uStack_30 = uStack_30 & 0xffffffff00000000; + local_90 = 0; local_res20 = 0; - local_88[0] = L'\0'; - local_88[1] = L'\0'; - local_88[2] = L'\0'; - local_88[3] = L'\0'; - puStack_80 = (uint *)0x0; + local_78[0] = L'\0'; + local_78[1] = L'\0'; + local_78[2] = L'\0'; + local_78[3] = L'\0'; + puStack_70 = (uint *)0x0; local_res10[0] = 0; _Dst = (void *)0x0; + local_88 = 0; + lStack_80 = 0; + local_res18 = 0; + local_58 = 0; + uStack_50 = 0; local_98 = 0; - lStack_90 = 0; - local_res18 = 0; + local_48 = (undefined1 *)0x0; + uStack_40 = 0; local_68 = 0; uStack_60 = 0; - local_a8 = 0; - local_58 = (undefined1 *)0x0; - uStack_50 = 0; - local_78 = 0; - uStack_70 = 0; - RtlInitUnicodeString(&local_98,0); + RtlInitUnicodeString(&local_88,0); uVar1 = *param_1; if (param_2 < uVar1) { iVar3 = -0x3ffffff3; _Dst = (void *)0x0; if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0; - uVar5 = 0x42; + uVar5 = 0x44; } else if (uVar1 < 0xc) { iVar3 = -0x3ffffff3; if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0; - uVar5 = 0x43; + uVar5 = 0x45; iVar3 = -0x3ffffff3; } else { uVar2 = (ushort)param_1[1]; if (uVar1 < uVar2 + 0xc) { iVar3 = -0x3ffffff3; if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0; - uVar5 = 0x44; + uVar5 = 0x46; } else { - puStack_80 = param_1 + 3; - local_88[1] = uVar2; - local_88[0] = uVar2; - iVar3 = PrjfGetInstanceFromVolumeName(local_88,&local_res8); + puStack_70 = param_1 + 3; + local_78[1] = uVar2; + local_78[0] = uVar2; + iVar3 = PrjfGetInstanceFromVolumeName(local_78,&local_res8); if (iVar3 < 0) { if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) { WPP_RECORDER_SF_sDZd - (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0x45, - &WPP_c27d1349da683f933f0d6f7e89c40427_Traceguids, - "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c",CONCAT44(uVar7,0x74a), - local_88); + (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0x47, + &WPP_6b5ed361b79f3110f6a652810956a79b_Traceguids, + "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c",CONCAT44(uVar7,0x763), + local_78); } goto LAB_0; } iVar3 = FltCreateSystemVolumeInformationFolder(local_res8); if (iVar3 < 0) { if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0; - uVar5 = 0x46; + uVar5 = 0x48; } else { - iVar3 = FltGetVolumeFromName(Globals,local_88,&local_res18); + iVar3 = FltGetVolumeFromName(Globals,local_78,&local_res18); if (-1 < iVar3) { iVar3 = FltGetVolumeName(local_res18,0,local_res10); if (iVar3 != -0x3fffffdd) { iVar3 = -0x3ffffff0; goto LAB_0; } if (0xffff < local_res10[0]) { MicrosoftTelemetryAssertTriggeredNoArgsKM(); } uVar1 = (local_res10[0] & 0xffff) * 2; if (uVar1 < 0x10000) { uVar2 = (ushort)uVar1; if ((uVar2 <= (ushort)(uVar2 + 8)) && ((ushort)(uVar2 + 8) <= (ushort)(uVar2 + 0x50))) { - local_98._0_4_ = CONCAT22(uVar2 + 0x50,(undefined2)local_98); - uVar4 = PrjfAllocateUnicodeString(0x6e664a50,(undefined2 *)&local_98); + local_88._0_4_ = CONCAT22(uVar2 + 0x50,(undefined2)local_88); + uVar4 = PrjfAllocateUnicodeString(0x6e664a50,(undefined2 *)&local_88); iVar3 = (int)uVar4; if (iVar3 < 0) goto LAB_0; - iVar3 = FltGetVolumeName(local_res18,&local_98,local_res10); + iVar3 = FltGetVolumeName(local_res18,&local_88,local_res10); if (iVar3 < 0) goto LAB_0; - iVar3 = RtlAppendUnicodeToString(&local_98,L"\\System Volume Information\\Gvflt.md"); + iVar3 = RtlAppendUnicodeToString(&local_88,L"\\System Volume Information\\Gvflt.md"); if (iVar3 < 0) { if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0; - uVar5 = 0x48; + uVar5 = 0x4a; } else { - local_58 = (undefined1 *)&local_98; - local_68 = CONCAT44(local_68._4_4_,0x30); - uStack_60 = 0; - uStack_50 = CONCAT44(uStack_50._4_4_,0x200); - local_48 = 0; - uStack_40 = 0; - iVar3 = FltCreateFileEx(Globals,local_res8,&local_a0,&local_res20, - CONCAT44(uVar6,0x1f01ff),&local_68,&local_78,0, + local_48 = (undefined1 *)&local_88; + local_58 = CONCAT44(local_58._4_4_,0x30); + uStack_50 = 0; + uStack_40 = CONCAT44(uStack_40._4_4_,0x200); + local_38 = 0; + uStack_30 = 0; + iVar3 = FltCreateFileEx(Globals,local_res8,&local_90,&local_res20, + CONCAT44(uVar6,0x1f01ff),&local_58,&local_68,0, CONCAT44(uVar8,6),1,3,0,0,0,0); if (iVar3 < 0) { if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0; - uVar5 = 0x49; + uVar5 = 0x4b; } else { - local_a8 = 0; + local_98 = 0; local_res10[0] = 4; _Dst = (void *)FltAllocatePoolAlignedWithTag(local_res8,0x200,0x1000,0x69764a50); if (_Dst == (void *)0x0) { iVar3 = -0x3fffff66; goto LAB_0; } memset(_Dst,0,0x1000); memcpy(_Dst,param_1 + 2,(ulonglong)local_res10[0]); - iVar3 = FltWriteFile(local_res8,local_res20,&local_a8,0x1000,_Dst,1,0,0,0); + iVar3 = FltWriteFile(local_res8,local_res20,&local_98,0x1000,_Dst,1,0,0,0); if ((-1 < iVar3) || ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED)) goto LAB_0; - uVar5 = 0x4a; + uVar5 = 0x4c; } } goto LAB_1; } } - local_98._0_4_ = CONCAT22(0xffff,(undefined2)local_98); + local_88._0_4_ = CONCAT22(0xffff,(undefined2)local_88); iVar3 = -0x3fffff6b; goto LAB_0; } if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0; - uVar5 = 0x47; + uVar5 = 0x49; } } } LAB_1: WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,uVar5, - &WPP_c27d1349da683f933f0d6f7e89c40427_Traceguids, + &WPP_6b5ed361b79f3110f6a652810956a79b_Traceguids, "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c"); LAB_0: - if (lStack_90 != 0) { - ExFreePoolWithTag(lStack_90,0x6e664a50); + if (lStack_80 != 0) { + ExFreePoolWithTag(lStack_80,0x6e664a50); } if (local_res20 != 0) { ObfDereferenceObject(); } - if (local_a0 != 0) { + if (local_90 != 0) { FltClose(); } if (local_res8 != 0) { FltObjectDereference(); } if (local_res18 != 0) { FltObjectDereference(local_res18); } if (_Dst != (void *)0x0) { FltFreePoolAlignedWithTag(local_res8,_Dst,0x69764a50); } return iVar3; } ``` ## PrjfSendCommand ### Match Info |Key|pj_7309.sys - pj_7462.sys| | :---: | :---: | |diff_type|code,length,address| |ratio|0.93| |i_ratio|0.8| |m_ratio|1.0| |b_ratio|0.98| |match_types|SymbolsHash| ### Function Meta Diff |Key|pj_7309.sys|pj_7462.sys| | :---: | :---: | :---: | |name|PrjfSendCommand|PrjfSendCommand| |fullname|PrjfSendCommand|PrjfSendCommand| |refcount|8|8| |`length`|464|468| |called|HAL.DLL::KeQueryPerformanceCounter
MicrosoftTelemetryAssertTriggeredNoArgsKM
PrjfAggregateTelemetry
PrjfGetUnionContext
PrjfReleaseUnionContext
PrjfSendCommandAndWaitForCompletion
WPP_RECORDER_SF_sD
WPP_RECORDER_SF_sDd|HAL.DLL::KeQueryPerformanceCounter
MicrosoftTelemetryAssertTriggeredNoArgsKM
PrjfAggregateTelemetry
PrjfGetUnionContext
PrjfReleaseUnionContext
PrjfSendCommandAndWaitForCompletion
WPP_RECORDER_SF_sD
WPP_RECORDER_SF_sDd| |calling|PrjfSendEndDirectoryEnumerationCommand
PrjfSendGetDirectoryEnumerationCommand
PrjfSendGetFileStreamCommand
PrjfSendGetPlaceholderInformationCommand
PrjfSendNotifyOperationCommand
PrjfSendQueryFileNameCommand
PrjfSendStartDirectoryEnumerationCommand|PrjfSendEndDirectoryEnumerationCommand
PrjfSendGetDirectoryEnumerationCommand
PrjfSendGetFileStreamCommand
PrjfSendGetPlaceholderInformationCommand
PrjfSendNotifyOperationCommand
PrjfSendQueryFileNameCommand
PrjfSendStartDirectoryEnumerationCommand| |paramcount|6|6| |`address`|140028640|1400287c0| |sig|int __fastcall PrjfSendCommand(longlong param_1, undefined8 param_2, uint * param_3, longlong param_4, longlong param_5, int * param_6)|int __fastcall PrjfSendCommand(longlong param_1, undefined8 param_2, uint * param_3, longlong param_4, longlong param_5, int * param_6)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### PrjfSendCommand Diff ```diff --- PrjfSendCommand +++ PrjfSendCommand @@ -1,63 +1,63 @@ int PrjfSendCommand(longlong param_1,undefined8 param_2,uint *param_3,longlong param_4, longlong param_5,int *param_6) { longlong *plVar1; int iVar2; longlong *plVar3; longlong lVar4; longlong lVar5; longlong local_res18 [2]; longlong local_38; undefined8 uStack_30; local_res18[0] = 0; if (*param_3 < 0x381) { MicrosoftTelemetryAssertTriggeredNoArgsKM(); } if (param_5 == 0) { iVar2 = -0x3ffffff3; if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) { - WPP_RECORDER_SF_sD(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0x8d, - &WPP_c27d1349da683f933f0d6f7e89c40427_Traceguids, + WPP_RECORDER_SF_sD(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0x8f, + &WPP_6b5ed361b79f3110f6a652810956a79b_Traceguids, "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c"); } } else { local_38 = *(longlong *)(param_3 + 2); uStack_30 = *(undefined8 *)(param_3 + 4); plVar3 = PrjfGetUnionContext(param_2,&local_38); if (plVar3 == (longlong *)0x0) { iVar2 = -0x3fff31ff; } else { if (plVar3[10] == 0) { iVar2 = -0x3fff31ff; if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) { - WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0x8e, - &WPP_c27d1349da683f933f0d6f7e89c40427_Traceguids, + WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0x90, + &WPP_6b5ed361b79f3110f6a652810956a79b_Traceguids, "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c"); } } else { lVar4 = KeQueryPerformanceCounter(local_res18); LOCK(); plVar1 = plVar3 + 0x26; lVar5 = *plVar1; *(int *)plVar1 = (int)*plVar1 + 1; UNLOCK(); param_3[6] = (int)lVar5 + 1; iVar2 = PrjfSendCommandAndWaitForCompletion (param_1,param_2,(longlong)param_3,param_4,(longlong)plVar3,param_5, param_6); lVar5 = KeQueryPerformanceCounter(0); PrjfAggregateTelemetry ((ulonglong)param_3,iVar2,((lVar5 - lVar4) * 1000000) / local_res18[0]); } PrjfReleaseUnionContext((longlong)plVar3); } } return iVar2; } ``` ## PrjfValidateNamesInEnumeration ### Match Info |Key|pj_7309.sys - pj_7462.sys| | :---: | :---: | |diff_type|code,length,sig,address,called| |ratio|0.39| |i_ratio|0.28| |m_ratio|0.71| |b_ratio|0.41| |match_types|SymbolsHash| ### Function Meta Diff |Key|pj_7309.sys|pj_7462.sys| | :---: | :---: | :---: | |name|PrjfValidateNamesInEnumeration|PrjfValidateNamesInEnumeration| |fullname|PrjfValidateNamesInEnumeration|PrjfValidateNamesInEnumeration| |refcount|2|2| |`length`|579|1162| |`called`|MicrosoftTelemetryAssertTriggeredNoArgsKM
WPP_RECORDER_SF_sDd
WPP_RECORDER_SF_sDdD|Feature_4287139131__private_IsEnabledDeviceUsageNoInline
MicrosoftTelemetryAssertTriggeredNoArgsKM
WPP_RECORDER_SF_sDd
WPP_RECORDER_SF_sDdD| |calling|PrjfSendGetDirectoryEnumerationCommand|PrjfSendGetDirectoryEnumerationCommand| |paramcount|3|3| |`address`|140029fc8|14002a14c| |`sig`|undefined8 __fastcall PrjfValidateNamesInEnumeration(int param_1, uint * param_2, uint param_3)|undefined4 __fastcall PrjfValidateNamesInEnumeration(int param_1, uint * param_2, uint param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### PrjfValidateNamesInEnumeration Called Diff ```diff --- PrjfValidateNamesInEnumeration called +++ PrjfValidateNamesInEnumeration called @@ -0,0 +1 @@ +Feature_4287139131__private_IsEnabledDeviceUsageNoInline ``` ### PrjfValidateNamesInEnumeration Diff ```diff --- PrjfValidateNamesInEnumeration +++ PrjfValidateNamesInEnumeration @@ -1,101 +1,180 @@ -undefined8 PrjfValidateNamesInEnumeration(int param_1,uint *param_2,uint param_3) +undefined4 PrjfValidateNamesInEnumeration(int param_1,uint *param_2,uint param_3) { ushort uVar1; uint uVar2; - int iVar3; - undefined1 uVar4; - undefined7 uVar5; - ushort uVar6; - uint *puVar7; + ulonglong uVar3; + int iVar4; + undefined1 uVar5; + undefined7 uVar6; + undefined4 uVar7; ushort uVar8; + undefined2 uVar9; + uint *puVar10; + ushort uVar11; - uVar4 = SUB81(param_2,0); - uVar5 = (undefined7)((ulonglong)param_2 >> 8); + uVar5 = SUB81(param_2,0); + uVar6 = (undefined7)((ulonglong)param_2 >> 8); if ((param_1 != 0xc) && ((0x15 < param_1 - 0x3cU || ((0x3c0009U >> (param_1 - 0x3cU & 0x1f) & 1) == 0)))) { MicrosoftTelemetryAssertTriggeredNoArgsKM(); } while( true ) { if (param_1 == 0xc) { - uVar6 = (ushort)param_2[2]; - puVar7 = param_2 + 3; - iVar3 = 0xc; + uVar3 = Feature_4287139131__private_IsEnabledDeviceUsageNoInline(); + if (((int)uVar3 != 0) && (0xffff < param_2[2])) { + uVar7 = 0xc000000d; + if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) { + return 0xc000000d; + } + uVar9 = 0x93; + goto LAB_0; + } + uVar8 = (ushort)param_2[2]; + puVar10 = param_2 + 3; + iVar4 = 0xc; } else if (param_1 == 0x3c) { - uVar6 = (ushort)param_2[0xf]; - puVar7 = param_2 + 0x16; - iVar3 = 0x58; + uVar3 = Feature_4287139131__private_IsEnabledDeviceUsageNoInline(); + if (((int)uVar3 != 0) && (0xffff < param_2[0xf])) { + uVar7 = 0xc000000d; + if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) { + return 0xc000000d; + } + uVar9 = 0x94; + goto LAB_0; + } + uVar8 = (ushort)param_2[0xf]; + puVar10 = param_2 + 0x16; + iVar4 = 0x58; } else if (param_1 == 0x3f) { - uVar6 = (ushort)param_2[0xf]; - puVar7 = (uint *)((longlong)param_2 + 0x72); - iVar3 = 0x72; + uVar3 = Feature_4287139131__private_IsEnabledDeviceUsageNoInline(); + if (((int)uVar3 != 0) && (0xffff < param_2[0xf])) { + uVar7 = 0xc000000d; + if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) { + return 0xc000000d; + } + uVar9 = 0x95; + goto LAB_0; + } + uVar8 = (ushort)param_2[0xf]; + puVar10 = (uint *)((longlong)param_2 + 0x72); + iVar4 = 0x72; } else if (param_1 == 0x4e) { - uVar6 = (ushort)param_2[0xf]; - puVar7 = param_2 + 0x14; - iVar3 = 0x50; + uVar3 = Feature_4287139131__private_IsEnabledDeviceUsageNoInline(); + if (((int)uVar3 != 0) && (0xffff < param_2[0xf])) { + uVar7 = 0xc000000d; + if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) { + return 0xc000000d; + } + uVar9 = 0x96; + goto LAB_0; + } + uVar8 = (ushort)param_2[0xf]; + puVar10 = param_2 + 0x14; + iVar4 = 0x50; } else if (param_1 == 0x4f) { - uVar6 = (ushort)param_2[0xf]; - puVar7 = (uint *)((longlong)param_2 + 0x6a); - iVar3 = 0x6a; + uVar3 = Feature_4287139131__private_IsEnabledDeviceUsageNoInline(); + if (((int)uVar3 != 0) && (0xffff < param_2[0xf])) { + uVar7 = 0xc000000d; + if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) { + return 0xc000000d; + } + uVar9 = 0x97; + goto LAB_0; + } + uVar8 = (ushort)param_2[0xf]; + puVar10 = (uint *)((longlong)param_2 + 0x6a); + iVar4 = 0x6a; } else if (param_1 == 0x50) { - uVar6 = (ushort)param_2[0xf]; - puVar7 = param_2 + 0x18; - iVar3 = 0x60; + uVar3 = Feature_4287139131__private_IsEnabledDeviceUsageNoInline(); + if (((int)uVar3 != 0) && (0xffff < param_2[0xf])) { + uVar7 = 0xc000000d; + if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) { + return 0xc000000d; + } + uVar9 = 0x98; + goto LAB_0; + } + uVar8 = (ushort)param_2[0xf]; + puVar10 = param_2 + 0x18; + iVar4 = 0x60; } else { if (param_1 != 0x51) { MicrosoftTelemetryAssertTriggeredNoArgsKM(); if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) { WPP_RECORDER_SF_sDdD - (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),CONCAT71(uVar5,uVar4),0xe,0x91, - &WPP_c27d1349da683f933f0d6f7e89c40427_Traceguids, + (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),CONCAT71(uVar6,uVar5),0xe,0x9a, + &WPP_6b5ed361b79f3110f6a652810956a79b_Traceguids, "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c"); + return 0xc0000003; } return 0xc0000003; } - uVar6 = (ushort)param_2[0xf]; - puVar7 = (uint *)((longlong)param_2 + 0x7a); - iVar3 = 0x7a; + uVar3 = Feature_4287139131__private_IsEnabledDeviceUsageNoInline(); + if (((int)uVar3 != 0) && (0xffff < param_2[0xf])) { + uVar7 = 0xc000000d; + if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) { + return 0xc000000d; + } + uVar9 = 0x99; + goto LAB_0; + } + uVar8 = (ushort)param_2[0xf]; + puVar10 = (uint *)((longlong)param_2 + 0x7a); + iVar4 = 0x7a; } - if (param_3 < (uint)uVar6 + iVar3) break; - if (((uVar6 == 0) || ((uVar6 & 1) != 0)) || (uVar6 = uVar6 >> 1, 0x104 < uVar6)) { + if (param_3 < (uint)uVar8 + iVar4) { + MicrosoftTelemetryAssertTriggeredNoArgsKM(); + uVar7 = 0xc0000023; + if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) { + return 0xc0000023; + } + uVar9 = 0x9b; + goto LAB_0; + } + if (((uVar8 == 0) || ((uVar8 & 1) != 0)) || (uVar8 = uVar8 >> 1, 0x104 < uVar8)) { return 0xc0000033; } - uVar8 = 0; - if (uVar6 != 0) { + uVar11 = 0; + if (uVar8 != 0) { do { - uVar1 = *(ushort *)((longlong)puVar7 + (ulonglong)uVar8 * 2); + uVar1 = *(ushort *)((longlong)puVar10 + (ulonglong)uVar11 * 2); if (((uVar1 < 0x80) && (-1 < (char)uVar1)) && ((*(byte *)((ulonglong)uVar1 + *(longlong *)FsRtlLegalAnsiCharacterArray_exref) & 4) == 0 )) { return 0xc0000033; } if (uVar1 == 0x3a) { return 0xc0000033; } - uVar8 = uVar8 + 1; - } while (uVar8 < uVar6); + uVar11 = uVar11 + 1; + } while (uVar11 < uVar8); } - uVar2 = *param_2; - if (uVar2 == 0) { + if (*param_2 == 0) { return 0; } + uVar3 = Feature_4287139131__private_IsEnabledDeviceUsageNoInline(); + uVar2 = *param_2; + if (((int)uVar3 != 0) && (param_3 < uVar2)) break; param_3 = param_3 - uVar2; param_2 = (uint *)((longlong)param_2 + (ulonglong)uVar2); } - MicrosoftTelemetryAssertTriggeredNoArgsKM(); + uVar7 = 0xc0000023; if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) { - WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0x92, - &WPP_c27d1349da683f933f0d6f7e89c40427_Traceguids, + uVar9 = 0x9c; + uVar7 = 0xc0000023; +LAB_0: + WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,uVar9, + &WPP_6b5ed361b79f3110f6a652810956a79b_Traceguids, "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c"); - return 0xc0000023; } - return 0xc0000023; + return uVar7; } ``` ## PrjfProcessOpenWithinVirtualizationRoots ### Match Info |Key|pj_7309.sys - pj_7462.sys| | :---: | :---: | |diff_type|code,length,called| |ratio|0.12| |i_ratio|0.22| |m_ratio|0.85| |b_ratio|0.35| |match_types|SymbolsHash| ### Function Meta Diff |Key|pj_7309.sys|pj_7462.sys| | :---: | :---: | :---: | |name|PrjfProcessOpenWithinVirtualizationRoots|PrjfProcessOpenWithinVirtualizationRoots| |fullname|PrjfProcessOpenWithinVirtualizationRoots|PrjfProcessOpenWithinVirtualizationRoots| |refcount|2|2| |`length`|881|1149| |`called`|
Expand for full list:
FLTMGR.SYS::FltReleaseContext
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExAcquireFastMutex
NTOSKRNL.EXE::ExReleaseFastMutex
PrjfExpandAndWait
PrjfGetNotificationMask
PrjfGetSetContextFileObject
PrjfSendPostCreateNotifications
PrjfSetPlaceHolderFlagsSynchronized
WPP_RECORDER_SF_sDd
WPP_RECORDER_SF_sDdZ
|
Expand for full list:
FLTMGR.SYS::FltReleaseContext
Feature_3579016506__private_IsEnabledDeviceUsageNoInline
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExAcquireFastMutex
NTOSKRNL.EXE::ExReleaseFastMutex
PrjfExpandAndWait
PrjfGetNotificationMask
PrjfGetSetContextFileObject
PrjfSendPostCreateNotifications
PrjfSetPlaceHolderFlagsSynchronized
WPP_RECORDER_SF_sDWPP_RECORDER_SF_sDd
WPP_RECORDER_SF_sDdZ
| |calling|PrjfPostCreate|PrjfPostCreate| |paramcount|5|5| |address|14001b4d8|14001b4d8| |sig|int __fastcall PrjfProcessOpenWithinVirtualizationRoots(longlong param_1, undefined8 param_2, longlong param_3, undefined8 * param_4, wchar_t * param_5)|int __fastcall PrjfProcessOpenWithinVirtualizationRoots(longlong param_1, undefined8 param_2, longlong param_3, undefined8 * param_4, wchar_t * param_5)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### PrjfProcessOpenWithinVirtualizationRoots Called Diff ```diff --- PrjfProcessOpenWithinVirtualizationRoots called +++ PrjfProcessOpenWithinVirtualizationRoots called @@ -1,0 +2 @@ +Feature_3579016506__private_IsEnabledDeviceUsageNoInline @@ -9,0 +11 @@ +WPP_RECORDER_SF_sD ``` ### PrjfProcessOpenWithinVirtualizationRoots Diff ```diff --- PrjfProcessOpenWithinVirtualizationRoots +++ PrjfProcessOpenWithinVirtualizationRoots @@ -1,139 +1,181 @@ int PrjfProcessOpenWithinVirtualizationRoots (longlong param_1,undefined8 param_2,longlong param_3,undefined8 *param_4, wchar_t *param_5) { - longlong lVar1; - uint uVar2; - longlong lVar3; - undefined8 *puVar4; - int *piVar5; - longlong lVar6; - int iVar7; - uint uVar8; - ulonglong uVar9; - wchar_t *pwVar10; - undefined8 uVar11; + wchar_t wVar1; + longlong lVar2; + uint uVar3; + int iVar4; + uint uVar5; + ulonglong uVar6; + wchar_t *pwVar7; + longlong lVar8; + int *piVar9; + undefined8 uVar10; + undefined2 uVar11; bool bVar12; - uint local_res18 [2]; - undefined8 *local_res20; - longlong *plVar13; - int *local_48; - longlong local_40; + undefined8 uVar13; + longlong *plVar14; + uint local_58; + uint local_54; + int *local_50; + longlong local_48 [2]; - lVar3 = *(longlong *)(param_3 + 0x18); - local_res18[0] = 0xffffffff; - uVar11 = 0x80000000; - local_40 = 0; - local_48 = (int *)0x0; - plVar13 = &local_40; - uVar2 = *(uint *)(*(longlong *)(*(longlong *)(param_1 + 0x10) + 0x18) + 0x10); - local_res20 = param_4; - pwVar10 = param_5; - iVar7 = PrjfGetSetContextFileObject - (param_2,param_3,-0x80000000,'\x01', - (byte)(*(uint *)(*(longlong *)(param_1 + 0x10) + 0x20) >> 0xc) & 1, - (undefined4 *)param_4,param_5,plVar13,&local_48); - lVar6 = local_40; - piVar5 = local_48; - puVar4 = local_res20; - if (iVar7 < 0) { - if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) { - WPP_RECORDER_SF_sDdZ - (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,0xe, - &WPP_0b474be437163e15bbc5d557e64edfd4_Traceguids, - "onecore\\base\\fs\\gvflt\\filter\\sys\\create.c", - CONCAT44((int)((ulonglong)pwVar10 >> 0x20),0x175), - CONCAT44((int)((ulonglong)plVar13 >> 0x20),iVar7),(wchar_t *)(param_3 + 0x58)); + local_54 = 0xffffffff; + lVar2 = *(longlong *)(param_3 + 0x18); + local_48[0] = 0; + local_50 = (int *)0x0; + uVar6 = Feature_3579016506__private_IsEnabledDeviceUsageNoInline(); + lVar8 = *(longlong *)(param_1 + 0x10); + uVar10 = 0x80000000; + if ((int)uVar6 == 0) { + local_58 = *(uint *)(*(longlong *)(lVar8 + 0x18) + 0x10); + plVar14 = local_48; + pwVar7 = param_5; + iVar4 = PrjfGetSetContextFileObject + (param_2,param_3,-0x80000000,'\x01',(byte)(*(uint *)(lVar8 + 0x20) >> 0xc) & 1 + ,(undefined4 *)param_4,param_5,plVar14,&local_50); + piVar9 = local_50; + if (iVar4 < 0) { + lVar8 = local_48[0]; + if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) { + uVar11 = 0x10; + uVar13 = CONCAT44((int)((ulonglong)plVar14 >> 0x20),iVar4); + uVar10 = CONCAT44((int)((ulonglong)pwVar7 >> 0x20),0x1ad); +LAB_0: + WPP_RECORDER_SF_sDdZ + (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,uVar11, + &WPP_b6a0520656d237d485f9e2c959abecff_Traceguids, + "onecore\\base\\fs\\gvflt\\filter\\sys\\create.c",uVar10,uVar13, + (wchar_t *)(param_3 + 0x58)); + lVar8 = local_48[0]; + piVar9 = local_50; + } + } + else { + if (local_48[0] == 0) { + if (local_50 == (int *)0x0) { + return iVar4; + } + MicrosoftTelemetryAssertTriggeredNoArgsKM(); + goto LAB_1; + } +LAB_2: + lVar8 = local_48[0]; + piVar9 = local_50; + uVar5 = local_50[10]; + if (uVar5 == 0) { + pwVar7 = (wchar_t *)(local_48[0] + 0x78); + if (*(longlong *)(param_5 + 4) != 0) { + pwVar7 = param_5; + } + uVar5 = PrjfGetNotificationMask(pwVar7,(longlong)param_4,uVar10); + } + if (*(longlong *)(param_5 + 4) == 0) { + param_5 = (wchar_t *)(lVar8 + 0x78); + } + uVar6 = PrjfSendPostCreateNotifications + (param_1,param_2,param_3,param_4,param_5,uVar5,&local_54); + iVar4 = (int)uVar6; + if (iVar4 < 0) { + if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) { + WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,0x11, + &WPP_b6a0520656d237d485f9e2c959abecff_Traceguids, + "onecore\\base\\fs\\gvflt\\filter\\sys\\create.c"); + } + } + else { + uVar3 = local_54; + if (local_54 == 0xffffffff) { + uVar3 = uVar5; + } + ExAcquireFastMutex(lVar8 + 8); + piVar9[10] = uVar3; + ExReleaseFastMutex(lVar8 + 8); + if (*piVar9 == 1) { + bVar12 = (local_58 & 0x106) == 0; + } + else { + if (*piVar9 == 0) { + if ((*(longlong *)(param_1 + 0x20) == 3) || (*(longlong *)(param_1 + 0x20) == 0)) { + iVar4 = 0x13; + } + else { + if ((local_58 & 6) == 0) { + ExAcquireFastMutex(lVar8 + 8); + if ((*(int *)(lVar8 + 0x40) != 3) && ((*(byte *)(lVar2 + 6) & 4) != 0)) { + if ((*(byte *)(lVar2 + 4) & 0x40) == 0) { + *(byte *)(lVar2 + 6) = *(byte *)(lVar2 + 6) & 0xfb; + } + else { + ExAcquireFastMutex(*(undefined8 *)(lVar2 + 0x30)); + *(byte *)(lVar2 + 6) = *(byte *)(lVar2 + 6) & 0xfb; + ExReleaseFastMutex(*(undefined8 *)(lVar2 + 0x30)); + } + } + ExReleaseFastMutex(lVar8 + 8); + bVar12 = (local_58 & 0x100) == 0; + goto LAB_3; + } + iVar4 = 0x10; + } + iVar4 = PrjfExpandAndWait(param_1,param_2,param_3,lVar8,3,1,iVar4,'\0'); + goto LAB_4; + } + bVar12 = (local_58 & 0x116) == 0; + } +LAB_3: + if (!bVar12) { + iVar4 = PrjfSetPlaceHolderFlagsSynchronized(param_1,param_2,param_3,2); + } + } } } else { - if (local_40 == 0) { - if (local_48 == (int *)0x0) { - return iVar7; - } - MicrosoftTelemetryAssertTriggeredNoArgsKM(); - goto LAB_0; - } - uVar8 = local_48[10]; - local_48 = (int *)CONCAT44(local_48._4_4_,uVar8); - if (uVar8 == 0) { - pwVar10 = (wchar_t *)(local_40 + 0x78); - if (*(longlong *)(param_5 + 4) != 0) { - pwVar10 = param_5; - } - uVar8 = PrjfGetNotificationMask(pwVar10,(longlong)local_res20,uVar11); - local_48 = (int *)CONCAT44(local_48._4_4_,uVar8); - } - if (*(longlong *)(param_5 + 4) == 0) { - param_5 = (wchar_t *)(lVar6 + 0x78); - } - uVar9 = PrjfSendPostCreateNotifications - (param_1,param_2,param_3,puVar4,param_5,uVar8,local_res18); - iVar7 = (int)uVar9; - if (iVar7 < 0) { + wVar1 = *param_5; + local_58 = *(uint *)(*(longlong *)(lVar8 + 0x18) + 0x10); + plVar14 = local_48; + pwVar7 = param_5; + iVar4 = PrjfGetSetContextFileObject + (param_2,param_3,-0x80000000,'\x01',(byte)(*(uint *)(lVar8 + 0x20) >> 0xc) & 1 + ,(undefined4 *)param_4,param_5,plVar14,&local_50); + lVar8 = local_48[0]; + piVar9 = local_50; + if (iVar4 < 0) { if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) { - WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,0xf, - &WPP_0b474be437163e15bbc5d557e64edfd4_Traceguids, - "onecore\\base\\fs\\gvflt\\filter\\sys\\create.c"); + uVar11 = 0xe; + uVar13 = CONCAT44((int)((ulonglong)plVar14 >> 0x20),iVar4); + uVar10 = CONCAT44((int)((ulonglong)pwVar7 >> 0x20),0x179); + goto LAB_0; } } else { - uVar8 = local_res18[0]; - if (local_res18[0] == 0xffffffff) { - uVar8 = (uint)local_48; + if (local_48[0] == 0) { + if (local_50 == (int *)0x0) { + return iVar4; + } + MicrosoftTelemetryAssertTriggeredNoArgsKM(); + goto LAB_1; } - ExAcquireFastMutex(lVar6 + 8); - piVar5[10] = uVar8; - lVar1 = lVar6 + 8; - ExReleaseFastMutex(lVar1); - if (*piVar5 == 1) { - bVar12 = (uVar2 & 0x106) == 0; - } - else { - if (*piVar5 == 0) { - if ((*(longlong *)(param_1 + 0x20) == 3) || (*(longlong *)(param_1 + 0x20) == 0)) { - iVar7 = 0x13; - } - else { - if ((uVar2 & 6) == 0) { - ExAcquireFastMutex(lVar1); - if ((*(int *)(lVar6 + 0x40) != 3) && ((*(byte *)(lVar3 + 6) & 4) != 0)) { - if ((*(byte *)(lVar3 + 4) & 0x40) == 0) { - *(byte *)(lVar3 + 6) = *(byte *)(lVar3 + 6) & 0xfb; - } - else { - ExAcquireFastMutex(*(undefined8 *)(lVar3 + 0x30)); - *(byte *)(lVar3 + 6) = *(byte *)(lVar3 + 6) & 0xfb; - ExReleaseFastMutex(*(undefined8 *)(lVar3 + 0x30)); - } - } - ExReleaseFastMutex(lVar1); - bVar12 = (uVar2 & 0x100) == 0; - goto LAB_1; - } - iVar7 = 0x10; - } - iVar7 = PrjfExpandAndWait(param_1,param_2,param_3,lVar6,3,1,iVar7,'\0'); - goto LAB_2; - } - bVar12 = (uVar2 & 0x116) == 0; - } -LAB_1: - if (!bVar12) { - iVar7 = PrjfSetPlaceHolderFlagsSynchronized(param_1,param_2,param_3,2); + if ((wVar1 != L'\0') || (*local_50 == 1)) goto LAB_2; + iVar4 = -0x3fff31fe; + if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) { + WPP_RECORDER_SF_sD(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,0xf, + &WPP_b6a0520656d237d485f9e2c959abecff_Traceguids, + "onecore\\base\\fs\\gvflt\\filter\\sys\\create.c"); } } } -LAB_2: - if (lVar6 != 0) { - FltReleaseContext(lVar6); +LAB_4: + if (lVar8 != 0) { + FltReleaseContext(lVar8); } -LAB_0: - if (piVar5 != (int *)0x0) { - FltReleaseContext(piVar5); +LAB_1: + if (piVar9 != (int *)0x0) { + FltReleaseContext(piVar9); } - return iVar7; + return iVar4; } ``` ## WPP_RECORDER_SF_sDDZDZ ### Match Info |Key|pj_7309.sys - pj_7462.sys| | :---: | :---: | |diff_type|code,length| |ratio|0.93| |i_ratio|0.91| |m_ratio|1.0| |b_ratio|0.99| |match_types|SymbolsHash| ### Function Meta Diff |Key|pj_7309.sys|pj_7462.sys| | :---: | :---: | :---: | |name|WPP_RECORDER_SF_sDDZDZ|WPP_RECORDER_SF_sDDZDZ| |fullname|WPP_RECORDER_SF_sDDZDZ|WPP_RECORDER_SF_sDDZDZ| |refcount|2|2| |`length`|620|621| |called|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace| |calling|PrjfSendNotifyOperationCommand|PrjfSendNotifyOperationCommand| |paramcount|1|1| |address|14003ceb8|14003ceb8| |sig|undefined __fastcall WPP_RECORDER_SF_sDDZDZ(undefined8 param_1)|undefined __fastcall WPP_RECORDER_SF_sDDZDZ(undefined8 param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### WPP_RECORDER_SF_sDDZDZ Diff ```diff --- WPP_RECORDER_SF_sDDZDZ +++ WPP_RECORDER_SF_sDDZDZ @@ -1,45 +1,45 @@ void WPP_RECORDER_SF_sDDZDZ(undefined8 param_1) { wchar_t wVar1; wchar_t *pwVar2; wchar_t *pwVar3; wchar_t wVar4; wchar_t *in_stack_00000048; wchar_t *in_stack_00000058; undefined4 local_38 [4]; pwVar3 = L"NULL"; - local_38[0] = 0x15e4; + local_38[0] = 0x1656; wVar4 = L'\b'; if (((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x2000) != 0) && (3 < (byte)WPP_GLOBAL_Control[0x29]) ) { - FastWppTraceMessage(&WPP_c27d1349da683f933f0d6f7e89c40427_Traceguids,0xaa, + FastWppTraceMessage(&WPP_6b5ed361b79f3110f6a652810956a79b_Traceguids,0xb4, "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c",0x2b); } wVar1 = wVar4; if ((in_stack_00000058 == (wchar_t *)0x0) || (wVar1 = *in_stack_00000058, *in_stack_00000058 == L'\0')) { pwVar2 = L"NULL"; } else { pwVar2 = *(wchar_t **)(in_stack_00000058 + 4); } if (in_stack_00000058 == (wchar_t *)0x0) { in_stack_00000058 = L"\b"; } if ((in_stack_00000048 != (wchar_t *)0x0) && (wVar4 = *in_stack_00000048, *in_stack_00000048 != L'\0')) { pwVar3 = *(wchar_t **)(in_stack_00000048 + 4); } if (in_stack_00000048 == (wchar_t *)0x0) { in_stack_00000048 = L"\b"; } - WppAutoLogTrace(param_1,4,0xe,&WPP_c27d1349da683f933f0d6f7e89c40427_Traceguids,0xaa, + WppAutoLogTrace(param_1,4,0xe,&WPP_6b5ed361b79f3110f6a652810956a79b_Traceguids,0xb4, "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c",0x2b,local_38,4, &stack0x00000040,4,in_stack_00000048,2,pwVar3,wVar4,&stack0x00000050,4, in_stack_00000058,2,pwVar2,wVar1,0); return; } ``` ## PrjfValidateFileIdentifier ### Match Info |Key|pj_7309.sys - pj_7462.sys| | :---: | :---: | |diff_type|code,length,sig,address| |ratio|0.85| |i_ratio|0.69| |m_ratio|1.0| |b_ratio|0.99| |match_types|SymbolsHash| ### Function Meta Diff |Key|pj_7309.sys|pj_7462.sys| | :---: | :---: | :---: | |name|PrjfValidateFileIdentifier|PrjfValidateFileIdentifier| |fullname|PrjfValidateFileIdentifier|PrjfValidateFileIdentifier| |refcount|2|2| |`length`|381|383| |called|WPP_RECORDER_SF_sD
WPP_RECORDER_SF_sDd|WPP_RECORDER_SF_sD
WPP_RECORDER_SF_sDd| |calling|PrjfValidatePlaceholderInformationMessage|PrjfValidatePlaceholderInformationMessage| |paramcount|2|2| |`address`|140031a00|140031e0c| |`sig`|undefined4 __fastcall PrjfValidateFileIdentifier(ushort * param_1, uint param_2)|undefined8 __fastcall PrjfValidateFileIdentifier(ushort * param_1, uint param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### PrjfValidateFileIdentifier Diff ```diff --- PrjfValidateFileIdentifier +++ PrjfValidateFileIdentifier @@ -1,55 +1,55 @@ -undefined4 PrjfValidateFileIdentifier(ushort *param_1,uint param_2) +undefined8 PrjfValidateFileIdentifier(ushort *param_1,uint param_2) { uint uVar1; undefined2 uVar2; if (param_2 < 8) { if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) { - WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0x7c, - &WPP_2460d16852bb36967a0c5d77aec11f17_Traceguids, + WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0x7d, + &WPP_d105f3c1388d302f0868144c31c5620c_Traceguids, "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c"); } } else { if (*param_1 == param_2) { uVar1 = param_1[2] + 6; if (uVar1 < 6) { if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) { - WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xb,0x7e, - &WPP_2460d16852bb36967a0c5d77aec11f17_Traceguids, + WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xb,0x7f, + &WPP_d105f3c1388d302f0868144c31c5620c_Traceguids, "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c"); return 0xc0000095; } return 0xc0000095; } if (*param_1 == uVar1) { if (param_1[1] <= param_1[2]) { return 0; } if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) { return 0xc000000d; } - uVar2 = 0x80; + uVar2 = 0x81; } else { if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) { return 0xc000000d; } - uVar2 = 0x7f; + uVar2 = 0x80; } } else { if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) { return 0xc000000d; } - uVar2 = 0x7d; + uVar2 = 0x7e; } WPP_RECORDER_SF_sD(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xb,uVar2, - &WPP_2460d16852bb36967a0c5d77aec11f17_Traceguids, + &WPP_d105f3c1388d302f0868144c31c5620c_Traceguids, "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c"); } return 0xc000000d; } ``` ## PrjfAdvanceToNextEnumEntry ### Match Info |Key|pj_7309.sys - pj_7462.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.5| |i_ratio|0.48| |m_ratio|0.7| |b_ratio|0.64| |match_types|SymbolsHash| ### Function Meta Diff |Key|pj_7309.sys|pj_7462.sys| | :---: | :---: | :---: | |name|PrjfAdvanceToNextEnumEntry|PrjfAdvanceToNextEnumEntry| |fullname|PrjfAdvanceToNextEnumEntry|PrjfAdvanceToNextEnumEntry| |refcount|6|6| |`length`|72|120| |`called`|PrjfGetCurrentEnumEntryFromContext|Feature_3797454136__private_IsEnabledDeviceUsageNoInline
PrjfGetCurrentEnumEntryFromContext| |calling|PrjfMergeEnumerationResults|PrjfMergeEnumerationResults| |paramcount|1|1| |`address`|14001c05c|14001c168| |sig|undefined8 __fastcall PrjfAdvanceToNextEnumEntry(longlong param_1)|undefined8 __fastcall PrjfAdvanceToNextEnumEntry(longlong param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### PrjfAdvanceToNextEnumEntry Called Diff ```diff --- PrjfAdvanceToNextEnumEntry called +++ PrjfAdvanceToNextEnumEntry called @@ -0,0 +1 @@ +Feature_3797454136__private_IsEnabledDeviceUsageNoInline ``` ### PrjfAdvanceToNextEnumEntry Diff ```diff --- PrjfAdvanceToNextEnumEntry +++ PrjfAdvanceToNextEnumEntry @@ -1,25 +1,45 @@ undefined8 PrjfAdvanceToNextEnumEntry(longlong param_1) { undefined4 *puVar1; - undefined8 uVar2; + ulonglong uVar2; + undefined8 uVar3; + int iVar4; int local_res10 [2]; int local_res18 [2]; int local_res20 [2]; local_res18[0] = 0; local_res20[0] = 0; local_res10[0] = 0; puVar1 = PrjfGetCurrentEnumEntryFromContext(param_1,local_res18,local_res20,local_res10); - uVar2 = 0; + iVar4 = local_res10[0]; + uVar3 = 0; if (puVar1 != (undefined4 *)0x0) { if (local_res10[0] == 0) { - local_res10[0] = local_res20[0] + local_res18[0]; + uVar2 = Feature_3797454136__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar2 == 0) { + iVar4 = local_res20[0] + local_res18[0]; + } + else { + *(undefined4 *)(param_1 + 0x30) = 0xffffffff; + iVar4 = 0; + } } - *(int *)(param_1 + 0x30) = *(int *)(param_1 + 0x30) + local_res10[0]; - uVar2 = CONCAT71((uint7)(uint3)((uint)local_res10[0] >> 8),1); + else { + uVar2 = Feature_3797454136__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar2 != 0) { + *(int *)(param_1 + 0x30) = *(int *)(param_1 + 0x30) + iVar4; + iVar4 = 0; + } + } + uVar2 = Feature_3797454136__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar2 == 0) { + *(int *)(param_1 + 0x30) = *(int *)(param_1 + 0x30) + iVar4; + } + uVar3 = CONCAT71((int7)(uVar2 >> 8),1); } - return uVar2; + return uVar3; } ``` ## PrjfCompleteCommandHandler ### Match Info |Key|pj_7309.sys - pj_7462.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.42| |i_ratio|0.59| |m_ratio|0.93| |b_ratio|0.88| |match_types|SymbolsHash| ### Function Meta Diff |Key|pj_7309.sys|pj_7462.sys| | :---: | :---: | :---: | |name|PrjfCompleteCommandHandler|PrjfCompleteCommandHandler| |fullname|PrjfCompleteCommandHandler|PrjfCompleteCommandHandler| |refcount|2|2| |`length`|605|716| |`called`|
Expand for full list:
FLTMGR.SYS::FltAcquireResourceExclusive
FLTMGR.SYS::FltReleaseResource
NTOSKRNL.EXE::KeSetEvent
NTOSKRNL.EXE::RtlLookupElementGenericTableAvl
PrjfGetUnionContextByVirtualizationInstanceInfo
PrjfReleaseUnionContext
WPP_RECORDER_SF_sD
WPP_RECORDER_SF_sDd
WPP_RECORDER_SF_sDl
WPP_RECORDER_SF_sDlLL
memcpy
|
Expand for full list:
FLTMGR.SYS::FltAcquireResourceExclusive
FLTMGR.SYS::FltReleaseResource
Feature_2814151992__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::KeSetEvent
NTOSKRNL.EXE::RtlLookupElementGenericTableAvl
PrjfGetUnionContextByVirtualizationInstanceInfo
PrjfReleaseUnionContext
WPP_RECORDER_SF_sD
WPP_RECORDER_SF_sDd
WPP_RECORDER_SF_sDl
WPP_RECORDER_SF_sDlLLmemcpy
| |calling|PrjfPortMessage|PrjfPortMessage| |paramcount|3|3| |`address`|1400044d8|140004628| |sig|undefined __fastcall PrjfCompleteCommandHandler(undefined8 param_1, uint * param_2, undefined8 param_3)|undefined __fastcall PrjfCompleteCommandHandler(undefined8 param_1, uint * param_2, undefined8 param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### PrjfCompleteCommandHandler Called Diff ```diff --- PrjfCompleteCommandHandler called +++ PrjfCompleteCommandHandler called @@ -2,0 +3 @@ +Feature_2814151992__private_IsEnabledDeviceUsageNoInline ``` ### PrjfCompleteCommandHandler Diff ```diff --- PrjfCompleteCommandHandler +++ PrjfCompleteCommandHandler @@ -1,73 +1,95 @@ void PrjfCompleteCommandHandler(undefined8 param_1,uint *param_2,undefined8 param_3) { - longlong lVar1; - longlong *plVar2; - longlong lVar3; - undefined8 *puVar4; - undefined2 uVar5; + uint uVar1; + longlong lVar2; + ulonglong uVar3; + longlong *plVar4; + longlong lVar5; + undefined8 *puVar6; + undefined2 uVar7; undefined8 local_18; undefined8 uStack_10; local_18 = 0; uStack_10 = 0; if (*param_2 < 100) { if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) { return; } - WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0x3d, - &WPP_c27d1349da683f933f0d6f7e89c40427_Traceguids, - "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c"); - return; + uVar7 = 0x3d; + goto LAB_0; } - plVar2 = PrjfGetUnionContextByVirtualizationInstanceInfo((longlong *)(param_2 + 2),param_1); - if (plVar2 == (longlong *)0x0) { + uVar3 = Feature_2814151992__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar3 != 0) { + uVar1 = param_2[0x18] + 100; + if (uVar1 < param_2[0x18]) { + if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) { + return; + } + uVar7 = 0x3e; +LAB_0: + WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,uVar7, + &WPP_6b5ed361b79f3110f6a652810956a79b_Traceguids, + "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c"); + return; + } + if (*param_2 < uVar1) { + if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) { + return; + } + uVar7 = 0x3f; + goto LAB_0; + } + } + plVar4 = PrjfGetUnionContextByVirtualizationInstanceInfo((longlong *)(param_2 + 2),param_1); + if (plVar4 == (longlong *)0x0) { if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) { return; } - WPP_RECORDER_SF_sD(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0x3e, - &WPP_c27d1349da683f933f0d6f7e89c40427_Traceguids, + WPP_RECORDER_SF_sD(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,0xe,0x40, + &WPP_6b5ed361b79f3110f6a652810956a79b_Traceguids, "onecore\\base\\fs\\gvflt\\filter\\sys\\message.c"); return; } local_18 = CONCAT44(local_18._4_4_,param_2[0x16]); - FltAcquireResourceExclusive(plVar2 + 0x27); - puVar4 = &local_18; - lVar3 = RtlLookupElementGenericTableAvl(plVar2 + 0x34); - if (lVar3 == 0) { - if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0; - uVar5 = 0x3f; + FltAcquireResourceExclusive(plVar4 + 0x27); + puVar6 = &local_18; + lVar5 = RtlLookupElementGenericTableAvl(plVar4 + 0x34); + if (lVar5 == 0) { + if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_1; + uVar7 = 0x41; } else { - if (*(int *)(lVar3 + 4) != 2) { - lVar1 = *(longlong *)(lVar3 + 8); - if (*(uint *)(lVar1 + 0x1c) < param_2[0x18]) { - *(undefined4 *)(lVar1 + 0x18) = 0xc0000023; - *(uint *)(*(longlong *)(lVar3 + 8) + 0x1c) = param_2[0x18]; + if (*(int *)(lVar5 + 4) != 2) { + lVar2 = *(longlong *)(lVar5 + 8); + if (*(uint *)(lVar2 + 0x1c) < param_2[0x18]) { + *(undefined4 *)(lVar2 + 0x18) = 0xc0000023; + *(uint *)(*(longlong *)(lVar5 + 8) + 0x1c) = param_2[0x18]; if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) { WPP_RECORDER_SF_sDlLL(*(undefined8 *)(WPP_GLOBAL_Control + 0x40)); } } else { - *(uint *)(lVar1 + 0x18) = param_2[0x17]; + *(uint *)(lVar2 + 0x18) = param_2[0x17]; if (param_2[0x18] != 0) { - *(uint *)(*(longlong *)(lVar3 + 8) + 0x1c) = param_2[0x18]; - memcpy(*(void **)(*(longlong *)(lVar3 + 8) + 0x20),param_2 + 0x19,(ulonglong)param_2[0x18] + *(uint *)(*(longlong *)(lVar5 + 8) + 0x1c) = param_2[0x18]; + memcpy(*(void **)(*(longlong *)(lVar5 + 8) + 0x20),param_2 + 0x19,(ulonglong)param_2[0x18] ); } } - *(undefined4 *)(lVar3 + 4) = 2; - KeSetEvent(*(undefined8 *)(lVar3 + 8),0,0); - goto LAB_0; + *(undefined4 *)(lVar5 + 4) = 2; + KeSetEvent(*(undefined8 *)(lVar5 + 8),0,0); + goto LAB_1; } - if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0; - uVar5 = 0x40; + if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_1; + uVar7 = 0x42; } - WPP_RECORDER_SF_sDl(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),puVar4,param_3,uVar5); -LAB_0: - FltReleaseResource(plVar2 + 0x27); - PrjfReleaseUnionContext((longlong)plVar2); + WPP_RECORDER_SF_sDl(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),puVar6,param_3,uVar7); +LAB_1: + FltReleaseResource(plVar4 + 0x27); + PrjfReleaseUnionContext((longlong)plVar4); return; } ``` ## PrjfExpandFile ### Match Info |Key|pj_7309.sys - pj_7462.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.43| |i_ratio|0.48| |m_ratio|0.98| |b_ratio|0.97| |match_types|SymbolsHash| ### Function Meta Diff |Key|pj_7309.sys|pj_7462.sys| | :---: | :---: | :---: | |name|PrjfExpandFile|PrjfExpandFile| |fullname|PrjfExpandFile|PrjfExpandFile| |refcount|2|2| |`length`|1623|1704| |`called`|
Expand for full list:
FLTMGR.SYS::FltAllocateGenericWorkItem
FLTMGR.SYS::FltFreeGenericWorkItem
FLTMGR.SYS::FltGetFileNameInformationUnsafe
FLTMGR.SYS::FltQueueGenericWorkItem
FLTMGR.SYS::FltReleaseFileNameInformation
FLTMGR.SYS::FltSetInformationFile
Feature_HydrateLargeNonCachedFiles__private_IsEnabledDeviceUsageNoInline
MicrosoftTelemetryAssertTriggeredMsgKM
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExAcquireFastMutex
NTOSKRNL.EXE::ExReInitializeRundownProtectionNTOSKRNL.EXE::ExReleaseFastMutex
NTOSKRNL.EXE::ExRundownCompleted
NTOSKRNL.EXE::ExWaitForRundownProtectionRelease
NTOSKRNL.EXE::IoGetRelatedDeviceObject
NTOSKRNL.EXE::KeClearEvent
NTOSKRNL.EXE::KeQueryPriorityThread
NTOSKRNL.EXE::KeSetEvent
NTOSKRNL.EXE::ObfReferenceObject
PrjfCopyStreamData
PrjfGetUnionContext
PrjfReleaseUnionContext
PrjfSendNotifyOperationCommand
PrjfSuppressTimestamps
WPP_RECORDER_SF_sDd
WPP_RECORDER_SF_sDdZ
WPP_RECORDER_SF_sDqd
|
Expand for full list:
FLTMGR.SYS::FltAllocateGenericWorkItem
FLTMGR.SYS::FltFreeGenericWorkItem
FLTMGR.SYS::FltGetFileNameInformationUnsafe
FLTMGR.SYS::FltQueueGenericWorkItem
FLTMGR.SYS::FltReleaseFileNameInformation
FLTMGR.SYS::FltSetInformationFile
Feature_3579016506__private_IsEnabledDeviceUsageNoInline
Feature_HydrateLargeNonCachedFiles__private_IsEnabledDeviceUsageNoInline
MicrosoftTelemetryAssertTriggeredMsgKM
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExAcquireFastMutexNTOSKRNL.EXE::ExReInitializeRundownProtection
NTOSKRNL.EXE::ExReleaseFastMutex
NTOSKRNL.EXE::ExRundownCompleted
NTOSKRNL.EXE::ExWaitForRundownProtectionRelease
NTOSKRNL.EXE::IoGetRelatedDeviceObject
NTOSKRNL.EXE::KeClearEvent
NTOSKRNL.EXE::KeQueryPriorityThread
NTOSKRNL.EXE::KeSetEvent
NTOSKRNL.EXE::ObfReferenceObject
PrjfCopyStreamData
PrjfGetUnionContext
PrjfReleaseUnionContext
PrjfSendNotifyOperationCommand
PrjfSuppressTimestamps
WPP_RECORDER_SF_sDd
WPP_RECORDER_SF_sDdZ
WPP_RECORDER_SF_sDqd
| |calling|PrjfExpansionWorker|PrjfExpansionWorker| |paramcount|4|4| |`address`|14001fe14|14001ff44| |sig|int __fastcall PrjfExpandFile(undefined8 param_1, longlong param_2, int * param_3, undefined8 * param_4)|int __fastcall PrjfExpandFile(undefined8 param_1, longlong param_2, int * param_3, undefined8 * param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### PrjfExpandFile Called Diff ```diff --- PrjfExpandFile called +++ PrjfExpandFile called @@ -6,0 +7 @@ +Feature_3579016506__private_IsEnabledDeviceUsageNoInline ``` ### PrjfExpandFile Diff ```diff --- PrjfExpandFile +++ PrjfExpandFile @@ -1,232 +1,248 @@ + +/* WARNING: Type propagation algorithm not settling */ int PrjfExpandFile(undefined8 param_1,longlong param_2,int *param_3,undefined8 *param_4) { uint uVar1; uint uVar2; uint *puVar3; short sVar4; int iVar5; int iVar6; - ulonglong uVar7; - longlong lVar8; - longlong *plVar9; - wchar_t *pwVar10; - longlong lVar11; - uint uVar12; - undefined2 uVar13; - undefined8 uVar14; - uint uVar15; + int iVar7; + ulonglong uVar8; + longlong lVar9; + longlong *plVar10; + wchar_t *pwVar11; + longlong lVar12; + uint uVar13; + undefined2 uVar14; + undefined8 uVar15; uint uVar16; - undefined4 uVar17; - undefined4 in_stack_ffffffffffffff3c; - undefined8 in_stack_ffffffffffffff40; - longlong local_90; - undefined8 local_88; - longlong lStack_80; - longlong local_78 [2]; + uint uVar17; + undefined4 uVar18; + undefined4 in_stack_ffffffffffffff4c; + undefined8 in_stack_ffffffffffffff50; + longlong local_80; + undefined8 local_78; + longlong lStack_70; longlong *local_68; undefined8 uStack_60; - undefined8 local_58 [2]; - longlong local_48; + longlong local_58 [3]; longlong lStack_40; + local_58[1] = 0; local_58[0] = 0; - local_78[0] = 0; - uVar15 = 0; + uVar16 = 0; puVar3 = *(uint **)(*(longlong *)(param_3 + 2) + 0x58); - uVar12 = *(uint *)(*(longlong *)(param_3 + 2) + 0x40); - local_88 = 0; - local_90 = 0; + uVar13 = *(uint *)(*(longlong *)(param_3 + 2) + 0x40); + local_78 = 0; + local_80 = 0; uVar1 = *puVar3; uVar2 = puVar3[1]; - uVar16 = uVar1 & 2; - if ((int)uVar2 < (int)uVar12) { + uVar17 = uVar1 & 2; + if ((int)uVar2 < (int)uVar13) { MicrosoftTelemetryAssertTriggeredNoArgsKM(); } - else if (uVar12 == uVar2) { + else if (uVar13 == uVar2) { return 0; } - uVar7 = Feature_HydrateLargeNonCachedFiles__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar7 != 0) { - lVar8 = IoGetRelatedDeviceObject(param_2); - uVar15 = (uint)*(ushort *)(lVar8 + 0x130); + uVar8 = Feature_HydrateLargeNonCachedFiles__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar8 != 0) { + lVar9 = IoGetRelatedDeviceObject(param_2); + uVar16 = (uint)*(ushort *)(lVar9 + 0x130); } ExWaitForRundownProtectionRelease(*(longlong *)(param_3 + 2) + 0x50); ExRundownCompleted(*(longlong *)(param_3 + 2) + 0x50); iVar5 = PrjfSuppressTimestamps(param_1,param_2,'\x01'); local_68 = *(longlong **)(*(longlong *)(param_3 + 2) + 0x60); uStack_60 = *(undefined8 *)(*(longlong *)(param_3 + 2) + 0x68); local_68 = PrjfGetUnionContext(param_1,(longlong *)&local_68); - uVar17 = (undefined4)((ulonglong)in_stack_ffffffffffffff40 >> 0x20); - iVar6 = iVar5; + uVar18 = (undefined4)((ulonglong)in_stack_ffffffffffffff50 >> 0x20); + iVar7 = iVar5; if (local_68 == (longlong *)0x0) goto LAB_0; - if (uVar12 == 1) { - uVar14 = local_88; - if ((uVar16 == 0) && ((uVar1 & 8) == 0)) { - uVar14 = *(undefined8 *)(param_3 + 4); - local_88 = uVar14; - uVar7 = Feature_HydrateLargeNonCachedFiles__private_IsEnabledDeviceUsageNoInline(); - uVar17 = (undefined4)((ulonglong)in_stack_ffffffffffffff40 >> 0x20); - lVar8 = *(longlong *)(param_3 + 4); - if ((int)uVar7 == 0) { - if (lVar8 < 0x100000000) goto LAB_1; - uVar12 = 0xffffffff; + if (uVar13 == 1) { + uVar15 = local_78; + if ((uVar17 == 0) && ((uVar1 & 8) == 0)) { + uVar15 = *(undefined8 *)(param_3 + 4); + local_78 = uVar15; + uVar8 = Feature_HydrateLargeNonCachedFiles__private_IsEnabledDeviceUsageNoInline(); + uVar18 = (undefined4)((ulonglong)in_stack_ffffffffffffff50 >> 0x20); + lVar9 = *(longlong *)(param_3 + 4); + if ((int)uVar8 == 0) { + if (lVar9 < 0x100000000) goto LAB_1; + uVar13 = 0xffffffff; } else { - if ((longlong)(ulonglong)-uVar15 < lVar8) { - uVar12 = -uVar15; + if ((longlong)(ulonglong)-uVar16 < lVar9) { + uVar13 = -uVar16; } else { LAB_1: - uVar12 = param_3[4]; - } - if (lVar8 < 1) goto LAB_2; - } - lVar8 = 0; + uVar13 = param_3[4]; + } + if (lVar9 < 1) goto LAB_2; + } + lVar9 = 0; do { - local_48 = *(longlong *)(param_3 + 6); + local_58[2] = *(longlong *)(param_3 + 6); lStack_40 = *(longlong *)(param_3 + 8); - uVar7 = PrjfCopyStreamData(param_1,lVar8,uVar12,param_2,(longlong)local_68, - (undefined4 *)&local_48); - iVar6 = (int)uVar7; - if (iVar6 < 0) { + uVar8 = PrjfCopyStreamData(param_1,lVar9,uVar13,param_2,(longlong)local_68, + (undefined4 *)(local_58 + 2)); + iVar7 = (int)uVar8; + if (iVar7 < 0) { if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) { WPP_RECORDER_SF_sDdZ (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,10,0x16, - &WPP_f005dcb7f0783b82332fda780a823c51_Traceguids, + &WPP_45ea8e47f9523b59d055d023c121aaab_Traceguids, "onecore\\base\\fs\\gvflt\\filter\\sys\\expansion.c", - CONCAT44(in_stack_ffffffffffffff3c,0x50f), - CONCAT44((int)((ulonglong)in_stack_ffffffffffffff40 >> 0x20),iVar6), + CONCAT44(in_stack_ffffffffffffff4c,0x510), + CONCAT44((int)((ulonglong)in_stack_ffffffffffffff50 >> 0x20),iVar7), (wchar_t *)(param_2 + 0x58)); } goto LAB_0; } - lVar8 = lVar8 + (ulonglong)uVar12; - uVar7 = Feature_HydrateLargeNonCachedFiles__private_IsEnabledDeviceUsageNoInline(); - uVar17 = (undefined4)((ulonglong)in_stack_ffffffffffffff40 >> 0x20); - lVar11 = *(longlong *)(param_3 + 4) - lVar8; - if ((int)uVar7 == 0) { - if (lVar11 < 0x100000000) goto LAB_3; - uVar12 = 0xffffffff; - } - else if ((longlong)(ulonglong)-uVar15 < lVar11) { - uVar12 = -uVar15; + lVar9 = lVar9 + (ulonglong)uVar13; + uVar8 = Feature_HydrateLargeNonCachedFiles__private_IsEnabledDeviceUsageNoInline(); + uVar18 = (undefined4)((ulonglong)in_stack_ffffffffffffff50 >> 0x20); + lVar12 = *(longlong *)(param_3 + 4) - lVar9; + if ((int)uVar8 == 0) { + if (lVar12 < 0x100000000) goto LAB_3; + uVar13 = 0xffffffff; + } + else if ((longlong)(ulonglong)-uVar16 < lVar12) { + uVar13 = -uVar16; } else { LAB_3: - uVar12 = param_3[4] - (int)lVar8; - } - uVar14 = local_88; - } while (lVar8 < *(longlong *)(param_3 + 4)); - } - } - else if (uVar12 == 2) { - uVar14 = 0; - if (uVar16 != 0) { - local_58[0] = 0; - iVar6 = FltSetInformationFile(param_1,param_2,local_58,8,0x14); - if (iVar6 < 0) { - local_90 = 0; + uVar13 = param_3[4] - (int)lVar9; + } + uVar15 = local_78; + } while (lVar9 < *(longlong *)(param_3 + 4)); + } + } + else if (uVar13 == 2) { + uVar15 = 0; + if (uVar17 != 0) { + local_58[1] = 0; + iVar7 = FltSetInformationFile(param_1,param_2,local_58 + 1,8,0x14); + if (iVar7 < 0) { + local_80 = 0; goto LAB_0; } } } else { MicrosoftTelemetryAssertTriggeredMsgKM(); - uVar14 = local_88; + uVar15 = local_78; } LAB_2: if ((uVar2 == 3) && ((param_3[10] & 0x1000U) != 0)) { - local_88 = 0; - lStack_80 = 0; - iVar6 = FltGetFileNameInformationUnsafe(param_2,param_1,0x101,local_78); + local_78 = 0; + lStack_70 = 0; + iVar6 = FltGetFileNameInformationUnsafe(param_2,param_1,0x101,local_58); if (iVar6 < 0) { + iVar7 = iVar6; if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0; - pwVar10 = (wchar_t *)(param_2 + 0x58); - uVar13 = 0x17; - uVar14 = CONCAT44(uVar17,iVar6); - uVar17 = 0x56b; + pwVar11 = (wchar_t *)(param_2 + 0x58); + uVar14 = 0x17; + uVar15 = CONCAT44(uVar18,iVar6); + uVar18 = 0x56c; } else { - local_48 = *local_68; - lStack_40 = local_68[1]; - uVar17 = 0; - lStack_80 = (ulonglong)*(ushort *)(local_68 + 5) + 2 + *(longlong *)(local_78[0] + 0x10); - sVar4 = (*(short *)(local_78[0] + 8) - *(ushort *)(local_68 + 5)) + -2; - local_88._0_4_ = CONCAT22(sVar4,sVar4); - plVar9 = PrjfSendNotifyOperationCommand - (0,param_1,param_2,&local_48,(wchar_t *)&local_88,*param_3 == 1,0x1000, - (ushort *)0x0,(ushort *)0x0,'\0',(uint *)0x0); - iVar6 = (int)plVar9; - if (-1 < iVar6) goto LAB_4; - if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0; - uVar13 = 0x18; - pwVar10 = (wchar_t *)(local_78[0] + 8); - uVar14 = CONCAT44(uVar17,iVar6); - uVar17 = 0x58b; + uVar8 = Feature_3579016506__private_IsEnabledDeviceUsageNoInline(); + if (((int)uVar8 == 0) || (*(ushort *)(local_68 + 5) < *(ushort *)(local_58[0] + 8))) { + local_58[2] = *local_68; + lStack_40 = local_68[1]; + lStack_70 = *(longlong *)(local_58[0] + 0x10) + 2 + (ulonglong)*(ushort *)(local_68 + 5); + uVar18 = 0; + sVar4 = (*(short *)(local_58[0] + 8) - *(ushort *)(local_68 + 5)) + -2; + local_78._0_4_ = CONCAT22(sVar4,sVar4); + plVar10 = PrjfSendNotifyOperationCommand + (0,param_1,param_2,local_58 + 2,(wchar_t *)&local_78,*param_3 == 1, + 0x1000,(ushort *)0x0,(ushort *)0x0,'\0',(uint *)0x0); + iVar6 = (int)plVar10; + if (-1 < iVar6) goto LAB_4; + iVar7 = iVar6; + if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0; + uVar14 = 0x19; + pwVar11 = (wchar_t *)(local_58[0] + 8); + uVar15 = CONCAT44(uVar18,iVar6); + uVar18 = 0x59b; + } + else { + iVar6 = -0x3fffffcd; + iVar7 = -0x3fffffcd; + if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0; + pwVar11 = (wchar_t *)(param_2 + 0x58); + uVar14 = 0x18; + uVar15 = CONCAT44(uVar18,0xc0000033); + uVar18 = 0x57e; + } } WPP_RECORDER_SF_sDdZ - (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,10,uVar13, - &WPP_f005dcb7f0783b82332fda780a823c51_Traceguids, + (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,10,uVar14, + &WPP_45ea8e47f9523b59d055d023c121aaab_Traceguids, "onecore\\base\\fs\\gvflt\\filter\\sys\\expansion.c", - CONCAT44(in_stack_ffffffffffffff3c,uVar17),uVar14,pwVar10); + CONCAT44(in_stack_ffffffffffffff4c,uVar18),uVar15,pwVar11); + iVar7 = iVar6; } else { LAB_4: ExAcquireFastMutex(*(longlong *)(param_3 + 2) + 8); *(uint *)(*(longlong *)(param_3 + 2) + 0x40) = uVar2; KeClearEvent(*(longlong *)(param_3 + 2) + 0x158); ExReleaseFastMutex(*(longlong *)(param_3 + 2) + 8); - local_90 = FltAllocateGenericWorkItem(); - if (local_90 == 0) { + local_80 = FltAllocateGenericWorkItem(); + if (local_80 == 0) { KeSetEvent(*(longlong *)(param_3 + 2) + 0x158,0); - iVar6 = -0x3fffff66; + iVar7 = -0x3fffff66; if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) { - WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,10,0x19, - &WPP_f005dcb7f0783b82332fda780a823c51_Traceguids, + WPP_RECORDER_SF_sDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,10,0x1a, + &WPP_45ea8e47f9523b59d055d023c121aaab_Traceguids, "onecore\\base\\fs\\gvflt\\filter\\sys\\expansion.c"); } } else { ObfReferenceObject(param_2); - iVar6 = KeQueryPriorityThread(SystemReserved1[0xf]); - iVar6 = FltQueueGenericWorkItem - (local_90,param_1,PrjfFlushAndUpdateDiskStateWorker,iVar6 + 0x20,param_2); - if (iVar6 < 0) { + iVar7 = KeQueryPriorityThread(SystemReserved1[0xf]); + iVar7 = FltQueueGenericWorkItem + (local_80,param_1,PrjfFlushAndUpdateDiskStateWorker,iVar7 + 0x20,param_2); + if (iVar7 < 0) { if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) { WPP_RECORDER_SF_sDqd - (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,10,0x1a, - &WPP_f005dcb7f0783b82332fda780a823c51_Traceguids, + (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,10,0x1b, + &WPP_45ea8e47f9523b59d055d023c121aaab_Traceguids, "onecore\\base\\fs\\gvflt\\filter\\sys\\expansion.c"); } KeSetEvent(*(longlong *)(param_3 + 2) + 0x158,0); } else { - local_90 = 0; + local_80 = 0; if (param_4 != (undefined8 *)0x0) { - *param_4 = uVar14; + *param_4 = uVar15; } } } } LAB_0: if (-1 < iVar5) { PrjfSuppressTimestamps(param_1,param_2,'\0'); } if (*(int *)(*(longlong *)(param_3 + 2) + 0x40) < 3) { ExReInitializeRundownProtection(*(longlong *)(param_3 + 2) + 0x50); } - *(int *)(*(longlong *)(*(longlong *)(param_3 + 2) + 0x58) + 8) = iVar6; + *(int *)(*(longlong *)(*(longlong *)(param_3 + 2) + 0x58) + 8) = iVar7; if (local_68 != (longlong *)0x0) { PrjfReleaseUnionContext((longlong)local_68); } - if (local_90 != 0) { - FltFreeGenericWorkItem(local_90); - } - if (local_78[0] != 0) { + if (local_80 != 0) { + FltFreeGenericWorkItem(local_80); + } + if (local_58[0] != 0) { FltReleaseFileNameInformation(); } - return iVar6; + return iVar7; } ``` ## WPP_RECORDER_SF_sDiD ### Match Info |Key|pj_7309.sys - pj_7462.sys| | :---: | :---: | |diff_type|code,length| |ratio|0.8| |i_ratio|0.89| |m_ratio|0.99| |b_ratio|0.99| |match_types|SymbolsHash| ### Function Meta Diff |Key|pj_7309.sys|pj_7462.sys| | :---: | :---: | :---: | |name|WPP_RECORDER_SF_sDiD|WPP_RECORDER_SF_sDiD| |fullname|WPP_RECORDER_SF_sDiD|WPP_RECORDER_SF_sDiD| |refcount|2|2| |`length`|280|277| |called|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace| |calling|PrjfManageHydrationOnNonCachedHandle|PrjfManageHydrationOnNonCachedHandle| |paramcount|1|1| |address|14003fa1c|14003fa1c| |sig|undefined __fastcall WPP_RECORDER_SF_sDiD(undefined8 param_1)|undefined __fastcall WPP_RECORDER_SF_sDiD(undefined8 param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### WPP_RECORDER_SF_sDiD Diff ```diff --- WPP_RECORDER_SF_sDiD +++ WPP_RECORDER_SF_sDiD @@ -1,18 +1,18 @@ void WPP_RECORDER_SF_sDiD(undefined8 param_1) { undefined4 local_18 [4]; - local_18[0] = 0x1ff2; + local_18[0] = 0x2000; if (((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x2000) != 0) && (1 < (byte)WPP_GLOBAL_Control[0x29]) ) { - FastWppTraceMessage(&WPP_2460d16852bb36967a0c5d77aec11f17_Traceguids,0xbc, + FastWppTraceMessage(&WPP_d105f3c1388d302f0868144c31c5620c_Traceguids,0xbd, "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",0x29); } - WppAutoLogTrace(param_1,2,0xe,&WPP_2460d16852bb36967a0c5d77aec11f17_Traceguids,0xbc, + WppAutoLogTrace(param_1,2,0xe,&WPP_d105f3c1388d302f0868144c31c5620c_Traceguids,0xbd, "onecore\\base\\fs\\gvflt\\filter\\sys\\utils.c",0x29,local_18,4,&stack0x00000040, 8,&stack0x00000048,4,0); return; } ``` ## PrjfGetSetContextFileObject ### Match Info |Key|pj_7309.sys - pj_7462.sys| | :---: | :---: | |diff_type|code,name,fullname,refcount,length,sig,address,calling,called| |ratio|0.09| |i_ratio|0.01| |m_ratio|0.09| |b_ratio|0.06| |match_types|Implied Match| ### Function Meta Diff |Key|pj_7309.sys|pj_7462.sys| | :---: | :---: | :---: | |`name`|PrjfGetSetContextFileObject|Feature_3579016506__private_IsEnabledDeviceUsageNoInline| |`fullname`|PrjfGetSetContextFileObject|Feature_3579016506__private_IsEnabledDeviceUsageNoInline| |`refcount`|16|3| |`length`|1135|49| |`called`|
Expand for full list:
FLTMGR.SYS::FltDeleteFileContext
FLTMGR.SYS::FltDeleteStreamContext
FLTMGR.SYS::FltGetFileContext
FLTMGR.SYS::FltReleaseContext
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExFreePoolWithTag
PrjfGetPrjReparseData
PrjfGetSetFileContext
PrjfGetSetStreamContext
PrjfGetSetStreamHandleContext
WPP_RECORDER_SF_sDqWPP_RECORDER_SF_sDqd
|Feature_3579016506__private_IsEnabledFallback| |`calling`|
Expand for full list:
PrjfAddInMemoryTombstone
PrjfCreateRenameOrLinkCompletionContext
PrjfDecideUpdateDeleteOnFileStateAndUpdateFlags
PrjfDoesNameExistInLayer
PrjfIsDirectoryEmpty
PrjfNormalizeNameComponent
PrjfNotifyRenameOrLinkOperation
PrjfPostCreate
PrjfPreCleanup
PrjfPrepareSourceForRename
PrjfProcessOpenWithinVirtualizationRootsPrjfProcessPostRenameOrLinkInformation
PrjfProcessPrjReparsePointBounce
PrjfSetDeleteDisposition
PrjfSetParentPlaceHolderFlagsSynchronized
|PrjfExpandFile
PrjfProcessOpenWithinVirtualizationRoots| |paramcount|9|0| |`address`|140002afc|140003ab0| |`sig`|int __fastcall PrjfGetSetContextFileObject(undefined8 param_1, longlong param_2, int param_3, char param_4, char param_5, undefined4 * param_6, undefined2 * param_7, longlong * param_8, undefined8 * param_9)|ulonglong __fastcall Feature_3579016506__private_IsEnabledDeviceUsageNoInline(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### PrjfGetSetContextFileObject Called Diff ```diff --- PrjfGetSetContextFileObject called +++ Feature_3579016506__private_IsEnabledDeviceUsageNoInline called @@ -1,12 +1 @@ -FLTMGR.SYS::FltDeleteFileContext -FLTMGR.SYS::FltDeleteStreamContext -FLTMGR.SYS::FltGetFileContext -FLTMGR.SYS::FltReleaseContext -MicrosoftTelemetryAssertTriggeredNoArgsKM -NTOSKRNL.EXE::ExFreePoolWithTag -PrjfGetPrjReparseData -PrjfGetSetFileContext -PrjfGetSetStreamContext -PrjfGetSetStreamHandleContext -WPP_RECORDER_SF_sDq -WPP_RECORDER_SF_sDqd +Feature_3579016506__private_IsEnabledFallback ``` ### PrjfGetSetContextFileObject Calling Diff ```diff --- PrjfGetSetContextFileObject calling +++ Feature_3579016506__private_IsEnabledDeviceUsageNoInline calling @@ -1,10 +1 @@ -PrjfAddInMemoryTombstone -PrjfCreateRenameOrLinkCompletionContext -PrjfDecideUpdateDeleteOnFileStateAndUpdateFlags -PrjfDoesNameExistInLayer -PrjfIsDirectoryEmpty -PrjfNormalizeNameComponent -PrjfNotifyRenameOrLinkOperation -PrjfPostCreate -PrjfPreCleanup -PrjfPrepareSourceForRename +PrjfExpandFile @@ -12,4 +2,0 @@ -PrjfProcessPostRenameOrLinkInformation -PrjfProcessPrjReparsePointBounce -PrjfSetDeleteDisposition -PrjfSetParentPlaceHolderFlagsSynchronized ``` ### PrjfGetSetContextFileObject Diff ```diff --- PrjfGetSetContextFileObject +++ Feature_3579016506__private_IsEnabledDeviceUsageNoInline @@ -1,149 +1,17 @@ -int PrjfGetSetContextFileObject - (undefined8 param_1,longlong param_2,int param_3,char param_4,char param_5, - undefined4 *param_6,undefined2 *param_7,longlong *param_8,undefined8 *param_9) +ulonglong Feature_3579016506__private_IsEnabledDeviceUsageNoInline(void) { - int iVar1; - ulonglong uVar2; - longlong lVar3; - int *piVar4; - undefined2 uVar5; - longlong lVar6; - char local_58; - char local_57; - char local_56 [6]; - longlong local_50; - int *local_48; - longlong local_40; - longlong local_38 [2]; + ulonglong uVar1; + undefined8 local_res8; - lVar3 = 0; - local_50 = 0; - local_48 = (int *)0x0; - local_40 = 0; - *param_8 = 0; - lVar6 = 0; - local_38[0] = 0; - local_56[0] = '\0'; - local_57 = '\0'; - *param_9 = 0; - local_58 = '\0'; - iVar1 = FltGetFileContext(param_1,param_2,&local_50); - if (iVar1 == -0x3ffffddb) { - iVar1 = PrjfGetPrjReparseData(param_1,param_2,local_38,local_56); - if (iVar1 < 0) { - if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0; - uVar5 = 10; - } - else { - if ((local_56[0] == '\0') && (param_3 == 1)) { - lVar3 = lVar6; - if (((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) && - (*(short *)(WPP_GLOBAL_Control + 0x48) != 0)) { - WPP_RECORDER_SF_sDq(_PrjfTraceRecorder,5,5,0xb, - &WPP_0def1edc605734705626ac974b591885_Traceguids, - "onecore\\base\\fs\\gvflt\\filter\\sys\\context.c"); - } - goto LAB_0; - } - uVar2 = PrjfGetSetFileContext - (param_1,param_2,'\0',local_38,param_6,param_7,&local_57,&local_50); - iVar1 = (int)uVar2; - if (-1 < iVar1) goto LAB_1; - lVar3 = lVar6; - if ((undefined **)WPP_RECORDER_INITIALIZED == &WPP_RECORDER_INITIALIZED) goto LAB_0; - uVar5 = 0xc; - } - WPP_RECORDER_SF_sDqd - (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,uVar5, - &WPP_0def1edc605734705626ac974b591885_Traceguids, - "onecore\\base\\fs\\gvflt\\filter\\sys\\context.c"); - lVar3 = lVar6; - goto LAB_0; - } - if (iVar1 < 0) { - if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) { - WPP_RECORDER_SF_sDqd - (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,0xd, - &WPP_0def1edc605734705626ac974b591885_Traceguids, - "onecore\\base\\fs\\gvflt\\filter\\sys\\context.c"); - } - iVar1 = -0x3fffffde; - lVar3 = lVar6; - goto LAB_0; - } -LAB_1: - if ((local_50 == 0) || (local_38[0] != 0)) { - MicrosoftTelemetryAssertTriggeredNoArgsKM(); - } - if (*(char *)(local_50 + 0x119) != '\0') { - MicrosoftTelemetryAssertTriggeredNoArgsKM(); - } - iVar1 = PrjfGetSetStreamContext(param_1,param_2,local_50,&local_58,(longlong *)&local_48); - piVar4 = local_48; - if (iVar1 < 0) { - if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) { - WPP_RECORDER_SF_sDqd - (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),4,5,0xe, - &WPP_0def1edc605734705626ac974b591885_Traceguids, - "onecore\\base\\fs\\gvflt\\filter\\sys\\context.c"); - piVar4 = local_48; - } + local_res8 = (ulonglong)Feature_3579016506__private_featureState; + if ((Feature_3579016506__private_featureState & 0x10) == 0) { + uVar1 = Feature_3579016506__private_IsEnabledFallback(local_res8,3); } else { - if (local_48 == (int *)0x0) { - MicrosoftTelemetryAssertTriggeredNoArgsKM(); - } - if (param_3 != -0x80000000) { - piVar4[10] = param_3; - } - if (((param_4 != '\0') || (param_5 != '\0')) || - ((param_3 != 1 && (lVar3 = lVar6, param_3 != -0x80000000)))) { - iVar1 = PrjfGetSetStreamHandleContext(param_1,param_2,local_50,piVar4,param_5,&local_40); - lVar3 = local_40; - if (iVar1 < 0) { - if ((undefined **)WPP_RECORDER_INITIALIZED != &WPP_RECORDER_INITIALIZED) { - WPP_RECORDER_SF_sDqd - (*(undefined8 *)(WPP_GLOBAL_Control + 0x40),2,5,0xf, - &WPP_0def1edc605734705626ac974b591885_Traceguids, - "onecore\\base\\fs\\gvflt\\filter\\sys\\context.c"); - lVar3 = local_40; - } - goto LAB_2; - } - if (local_40 == 0) { - MicrosoftTelemetryAssertTriggeredNoArgsKM(); - } - } - lVar6 = local_50; - local_50 = 0; - local_57 = '\0'; - *param_8 = lVar6; - *param_9 = piVar4; - local_58 = '\0'; - piVar4 = (int *)0x0; + uVar1 = (ulonglong)(Feature_3579016506__private_featureState & 1); } -LAB_2: - if (piVar4 != (int *)0x0) { - FltReleaseContext(piVar4); - } -LAB_0: - if (local_50 != 0) { - FltReleaseContext(); - } - if (lVar3 != 0) { - FltReleaseContext(lVar3); - } - if (local_58 != '\0') { - FltDeleteStreamContext(param_1,param_2,0); - } - if (local_57 != '\0') { - FltDeleteFileContext(param_1,param_2,0); - } - if (local_38[0] != 0) { - ExFreePoolWithTag(local_38[0],0x69724a50); - } - return iVar1; + return uVar1; } ``` # Modified (No Code Changes) *Slightly modified functions have no code changes, rather differnces in:* - refcount - length - called - calling - name - fullname ## wil_details_IsEnabledFallback ### Match Info |Key|pj_7309.sys - pj_7462.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|pj_7309.sys|pj_7462.sys| | :---: | :---: | :---: | |name|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |fullname|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |`refcount`|4|9| |length|140|140| |called|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath| |`calling`|Feature_2983238971__private_IsEnabledFallback
Feature_EnableTestConfigViaFilterPort__private_IsEnabledFallback
Feature_HydrateLargeNonCachedFiles__private_IsEnabledFallback|Feature_2814151992__private_IsEnabledFallback
Feature_2983238971__private_IsEnabledFallback
Feature_3568532792__private_IsEnabledFallback
Feature_3579016506__private_IsEnabledFallback
Feature_3797454136__private_IsEnabledFallback
Feature_4287139131__private_IsEnabledFallback
Feature_EnableTestConfigViaFilterPort__private_IsEnabledFallback
Feature_HydrateLargeNonCachedFiles__private_IsEnabledFallback| |paramcount|3|3| |address|1400042e0|1400042e0| |sig|uint __fastcall wil_details_IsEnabledFallback(ulonglong param_1, int param_2, undefined8 * param_3)|uint __fastcall wil_details_IsEnabledFallback(ulonglong param_1, int param_2, undefined8 * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### wil_details_IsEnabledFallback Calling Diff ```diff --- wil_details_IsEnabledFallback calling +++ wil_details_IsEnabledFallback calling @@ -0,0 +1 @@ +Feature_2814151992__private_IsEnabledFallback @@ -1,0 +3,4 @@ +Feature_3568532792__private_IsEnabledFallback +Feature_3579016506__private_IsEnabledFallback +Feature_3797454136__private_IsEnabledFallback +Feature_4287139131__private_IsEnabledFallback ``` ## WPP_RECORDER_SF_sD ### Match Info |Key|pj_7309.sys - pj_7462.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|0.99| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|pj_7309.sys|pj_7462.sys| | :---: | :---: | :---: | |name|WPP_RECORDER_SF_sD|WPP_RECORDER_SF_sD| |fullname|WPP_RECORDER_SF_sD|WPP_RECORDER_SF_sD| |`refcount`|57|58| |length|354|354| |called|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace|FastWppTraceMessage
WPPRECORDER.SYS::WppAutoLogTrace| |`calling`|
Expand for full list:
PrjfCheckDirectoryContentReparseTags
PrjfClearNegativePathCacheHandler
PrjfCloseFileHandler
PrjfCompleteCommandHandler
PrjfCopyAsPlaceHolder
PrjfCopyFileMetaData
PrjfCreateFileContext
PrjfCreateHardLink
PrjfCreateInstanceTierNode
PrjfCreateMappingEntry
PrjfCreatePathTierNodePrjfCreatePathTree
PrjfCreateRenameOrLinkCompletionContext
PrjfCreateUnionContext
PrjfDeleteFileHandler
PrjfFsctlDeleteReparsePoint
PrjfGetSetStreamContext
PrjfGetUnionContextByVirtualizationInstanceInfo
PrjfInitProcessInfo
PrjfInstanceSetup
PrjfMappingInsert
PrjfNotifyRenameOrLinkOperation
PrjfOpenFileHandler
PrjfPortConnect
PrjfPortDisconnect
PrjfPortMessage
PrjfPostNetworkQueryOpen
PrjfPostQueryInformation
PrjfPostWrite
PrjfPreSetRenameInformation
PrjfPrepareCommandForFilePath
PrjfPrepareDestinationForRenameOrLink
PrjfProcessPrjReparsePointBounce
PrjfProcessTombstoneBounce
PrjfReadFileHandler
PrjfSendCommand
PrjfSetDeleteDisposition
PrjfSetUnionContext
PrjfValidateFileIdentifier
PrjfValidatePlaceholderInformationMessage
PrjfVerifyAccessAndSetClientPortIfNeeded
PrjfWriteFileDataHandler
|
Expand for full list:
PrjfCheckDirectoryContentReparseTags
PrjfClearNegativePathCacheHandler
PrjfCloseFileHandler
PrjfCompleteCommandHandler
PrjfCopyAsPlaceHolder
PrjfCopyFileMetaData
PrjfCreateFileContext
PrjfCreateHardLink
PrjfCreateInstanceTierNode
PrjfCreateMappingEntry
PrjfCreatePathTierNodePrjfCreatePathTree
PrjfCreateRenameOrLinkCompletionContext
PrjfCreateUnionContext
PrjfDeleteFileHandler
PrjfFsctlDeleteReparsePoint
PrjfGetSetStreamContext
PrjfGetUnionContextByVirtualizationInstanceInfo
PrjfInitProcessInfo
PrjfInstanceSetup
PrjfMappingInsert
PrjfNotifyRenameOrLinkOperation
PrjfOpenFileHandler
PrjfPortConnect
PrjfPortDisconnect
PrjfPortMessage
PrjfPostNetworkQueryOpen
PrjfPostQueryInformation
PrjfPostWrite
PrjfPreSetRenameInformation
PrjfPrepareCommandForFilePath
PrjfPrepareDestinationForRenameOrLink
PrjfProcessOpenWithinVirtualizationRoots
PrjfProcessPrjReparsePointBounce
PrjfProcessTombstoneBounce
PrjfReadFileHandler
PrjfSendCommand
PrjfSetDeleteDisposition
PrjfSetUnionContext
PrjfValidateFileIdentifier
PrjfValidatePlaceholderInformationMessage
PrjfVerifyAccessAndSetClientPortIfNeeded
PrjfWriteFileDataHandler
| |paramcount|6|6| |address|14003a008|14003a008| |sig|undefined __fastcall WPP_RECORDER_SF_sD(undefined8 param_1, byte param_2, uint param_3, undefined2 param_4, undefined8 param_5, char * param_6)|undefined __fastcall WPP_RECORDER_SF_sD(undefined8 param_1, byte param_2, uint param_3, undefined2 param_4, undefined8 param_5, char * param_6)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### WPP_RECORDER_SF_sD Calling Diff ```diff --- WPP_RECORDER_SF_sD calling +++ WPP_RECORDER_SF_sD calling @@ -32,0 +33 @@ +PrjfProcessOpenWithinVirtualizationRoots ``` ## MicrosoftTelemetryAssertTriggeredNoArgsKM ### Match Info |Key|pj_7309.sys - pj_7462.sys| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|0.9| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|pj_7309.sys|pj_7462.sys| | :---: | :---: | :---: | |name|MicrosoftTelemetryAssertTriggeredNoArgsKM|MicrosoftTelemetryAssertTriggeredNoArgsKM| |fullname|MicrosoftTelemetryAssertTriggeredNoArgsKM|MicrosoftTelemetryAssertTriggeredNoArgsKM| |`refcount`|154|155| |length|39|39| |called|MicrosoftTelemetryAssertTriggeredWorker|MicrosoftTelemetryAssertTriggeredWorker| |calling|
Expand for full list:
PrjfAllocateCommandTableEntry
PrjfAllocateHandleTableEntry
PrjfAllocateUnicodeString
PrjfCheckAndCancelTransactedOpen
PrjfCleanUpRenameLinkTargetTombstone
PrjfContextCleanup
PrjfCopyAsPlaceHolder
PrjfCopyStreamData
PrjfCreateFileContext
PrjfCreateRenameOrLinkCompletionContext
PrjfCreateSymbolicLinkPrjfDecideUpdateDeleteOnFileStateAndUpdateFlags
PrjfDoesNameExistInLayer
PrjfEnumerateLayeredDirectories
PrjfExpandAndPend
PrjfExpandFile
PrjfExpansionWorker
PrjfFreeCommandBuffer
PrjfFreeEnumerationResultBuffer
PrjfFsctlSetReparsePoint
PrjfFsctlSetReparsePointPostOp
PrjfFsctlStartVirtualizationInstance
PrjfGenerateFileName
PrjfGetContextFileObject
PrjfGetContextFileObjectEx
PrjfGetPrjReparseData
PrjfGetSetContextFileObject
PrjfGetSetFileContext
PrjfGetSetStreamContext
PrjfGetUnionContext
PrjfGetUnionContextByFileName
PrjfGetUnionContextByFileNameEx
PrjfImpersonateAndAddSymlinkPrivilege
PrjfInstanceSetup
PrjfIsNameOnPathOfRoot
PrjfLaunchExpansion
PrjfManageHydrationOnNonCachedHandle
PrjfMergeEnumerationResults
PrjfMungeDirectoryEnumerateWithShortname
PrjfMungeDirectoryEnumerateWithShortnameFileId64
PrjfMungeDirectoryEnumerateWithShortnameFileIdAll
PrjfMungeDirectoryEnumerateWithoutShortname
PrjfMungeDirectoryEnumerateWithoutShortnameFileId64
PrjfMungeDirectoryEnumerateWithoutShortnameFileIdAll
PrjfMungeNamesEnumerate
PrjfMungeReparseEnumerate
PrjfNormalizeNameComponent
PrjfNotifyRenameOrLinkOperation
PrjfOpenAsReparsePoint
PrjfOpenFileHandler
PrjfOpenReparsePoint
PrjfParseParentAndNextComponentPathName
PrjfPartiallyExpandDirectory
PrjfPopulateDestinationForRenameOrLink
PrjfPortConnect
PrjfPortDisconnect
PrjfPostCleanup
PrjfPostCreate
PrjfPostQueryOpen
PrjfPostQueryVolumeInformation
PrjfPreAcquireForSectionSynchronization
PrjfPreCleanup
PrjfPreDirectoryControl
PrjfPreLockControl
PrjfPreSetLinkInformation
PrjfPreSetRenameInformation
PrjfPrepareEnumerationContexts
PrjfPrepareSourceForRename
PrjfProcessOpenWithinVirtualizationRoots
PrjfProcessPostRenameOrLinkInformation
PrjfProcessPreRenameOrLinkInformation
PrjfProcessPrjReparsePointBounce
PrjfProcessTombstoneBounce
PrjfReadFileHandler
PrjfReleaseUnionContext
PrjfRemoveSparse
PrjfSendCommand
PrjfSendCommandAndWaitForCompletion
PrjfSendEndDirectoryEnumerationCommand
PrjfSendGetDirectoryEnumerationCommand
PrjfSetParentPlaceHolderFlagsSynchronized
PrjfSetPlaceHolderFlagsSynchronized
PrjfSetupVolumeInformationHandler
PrjfShouldAutoAttach
PrjfStopImpersonating
PrjfStoreNotificationMappingEntries
PrjfUntagFile
PrjfUpdatePlaceholderIfNeededHandler
PrjfValidateNamesInEnumeration
PrjfValidatePlaceholderInformationMessage
|
Expand for full list:
PrjfAllocateCommandTableEntry
PrjfAllocateHandleTableEntry
PrjfAllocateUnicodeString
PrjfCheckAndCancelTransactedOpen
PrjfCleanUpRenameLinkTargetTombstone
PrjfContextCleanup
PrjfCopyAsPlaceHolder
PrjfCopyStreamData
PrjfCreateFileContext
PrjfCreateRenameOrLinkCompletionContext
PrjfCreateSymbolicLinkPrjfDecideUpdateDeleteOnFileStateAndUpdateFlags
PrjfDoesNameExistInLayer
PrjfEnumerateLayeredDirectories
PrjfExpandAndPend
PrjfExpandFile
PrjfExpansionWorker
PrjfFreeCommandBuffer
PrjfFreeEnumerationResultBuffer
PrjfFsctlSetReparsePoint
PrjfFsctlSetReparsePointPostOp
PrjfFsctlStartVirtualizationInstance
PrjfGenerateFileName
PrjfGetContextFileObject
PrjfGetContextFileObjectEx
PrjfGetPrjReparseData
PrjfGetSetContextFileObject
PrjfGetSetFileContext
PrjfGetSetStreamContext
PrjfGetUnionContext
PrjfGetUnionContextByFileName
PrjfGetUnionContextByFileNameEx
PrjfImpersonateAndAddSymlinkPrivilege
PrjfInstanceSetup
PrjfIsNameOnPathOfRoot
PrjfLaunchExpansion
PrjfManageHydrationOnNonCachedHandle
PrjfMergeEnumerationResults
PrjfMungeDirectoryEnumerateWithShortname
PrjfMungeDirectoryEnumerateWithShortnameFileId64
PrjfMungeDirectoryEnumerateWithShortnameFileIdAll
PrjfMungeDirectoryEnumerateWithoutShortname
PrjfMungeDirectoryEnumerateWithoutShortnameFileId64
PrjfMungeDirectoryEnumerateWithoutShortnameFileIdAll
PrjfMungeNamesEnumerate
PrjfMungeReparseEnumerate
PrjfNormalizeNameComponent
PrjfNotifyRenameOrLinkOperation
PrjfOpenAsReparsePoint
PrjfOpenFileHandler
PrjfOpenReparsePoint
PrjfParseParentAndNextComponentPathName
PrjfPartiallyExpandDirectory
PrjfPopulateDestinationForRenameOrLink
PrjfPortConnect
PrjfPortDisconnect
PrjfPostCleanup
PrjfPostCreate
PrjfPostQueryOpen
PrjfPostQueryVolumeInformation
PrjfPreAcquireForSectionSynchronization
PrjfPreCleanup
PrjfPreDirectoryControl
PrjfPreLockControl
PrjfPreSetLinkInformation
PrjfPreSetRenameInformation
PrjfPrepareEnumerationContexts
PrjfPrepareSourceForRename
PrjfProcessOpenWithinVirtualizationRoots
PrjfProcessPostRenameOrLinkInformation
PrjfProcessPreRenameOrLinkInformation
PrjfProcessPrjReparsePointBounce
PrjfProcessTombstoneBounce
PrjfReadFileHandler
PrjfReleaseUnionContext
PrjfRemoveSparse
PrjfSendCommand
PrjfSendCommandAndWaitForCompletion
PrjfSendEndDirectoryEnumerationCommand
PrjfSendGetDirectoryEnumerationCommand
PrjfSetParentPlaceHolderFlagsSynchronized
PrjfSetPlaceHolderFlagsSynchronized
PrjfSetupVolumeInformationHandler
PrjfShouldAutoAttach
PrjfStopImpersonating
PrjfStoreNotificationMappingEntries
PrjfUntagFile
PrjfUpdatePlaceholderIfNeededHandler
PrjfValidateNamesInEnumeration
PrjfValidatePlaceholderInformationMessage
| |paramcount|0|0| |`address`|14000a4f0|14000a6f0| |sig|undefined __fastcall MicrosoftTelemetryAssertTriggeredNoArgsKM(void)|undefined __fastcall MicrosoftTelemetryAssertTriggeredNoArgsKM(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## PrjfGetSetContextFileObject ### Match Info |Key|pj_7309.sys - pj_7462.sys| | :---: | :---: | |diff_type|refcount| |ratio|1.0| |i_ratio|0.98| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|pj_7309.sys|pj_7462.sys| | :---: | :---: | :---: | |name|PrjfGetSetContextFileObject|PrjfGetSetContextFileObject| |fullname|PrjfGetSetContextFileObject|PrjfGetSetContextFileObject| |`refcount`|16|17| |length|1135|1135| |called|
Expand for full list:
FLTMGR.SYS::FltDeleteFileContext
FLTMGR.SYS::FltDeleteStreamContext
FLTMGR.SYS::FltGetFileContext
FLTMGR.SYS::FltReleaseContext
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExFreePoolWithTag
PrjfGetPrjReparseData
PrjfGetSetFileContext
PrjfGetSetStreamContext
PrjfGetSetStreamHandleContext
WPP_RECORDER_SF_sDqWPP_RECORDER_SF_sDqd
|
Expand for full list:
FLTMGR.SYS::FltDeleteFileContext
FLTMGR.SYS::FltDeleteStreamContext
FLTMGR.SYS::FltGetFileContext
FLTMGR.SYS::FltReleaseContext
MicrosoftTelemetryAssertTriggeredNoArgsKM
NTOSKRNL.EXE::ExFreePoolWithTag
PrjfGetPrjReparseData
PrjfGetSetFileContext
PrjfGetSetStreamContext
PrjfGetSetStreamHandleContext
WPP_RECORDER_SF_sDqWPP_RECORDER_SF_sDqd
| |calling|
Expand for full list:
PrjfAddInMemoryTombstone
PrjfCreateRenameOrLinkCompletionContext
PrjfDecideUpdateDeleteOnFileStateAndUpdateFlags
PrjfDoesNameExistInLayer
PrjfIsDirectoryEmpty
PrjfNormalizeNameComponent
PrjfNotifyRenameOrLinkOperation
PrjfPostCreate
PrjfPreCleanup
PrjfPrepareSourceForRename
PrjfProcessOpenWithinVirtualizationRootsPrjfProcessPostRenameOrLinkInformation
PrjfProcessPrjReparsePointBounce
PrjfSetDeleteDisposition
PrjfSetParentPlaceHolderFlagsSynchronized
|
Expand for full list:
PrjfAddInMemoryTombstone
PrjfCreateRenameOrLinkCompletionContext
PrjfDecideUpdateDeleteOnFileStateAndUpdateFlags
PrjfDoesNameExistInLayer
PrjfIsDirectoryEmpty
PrjfNormalizeNameComponent
PrjfNotifyRenameOrLinkOperation
PrjfPostCreate
PrjfPreCleanup
PrjfPrepareSourceForRename
PrjfProcessOpenWithinVirtualizationRootsPrjfProcessPostRenameOrLinkInformation
PrjfProcessPrjReparsePointBounce
PrjfSetDeleteDisposition
PrjfSetParentPlaceHolderFlagsSynchronized
| |paramcount|9|9| |address|140002afc|140002afc| |sig|int __fastcall PrjfGetSetContextFileObject(undefined8 param_1, longlong param_2, int param_3, char param_4, char param_5, undefined4 * param_6, undefined2 * param_7, longlong * param_8, undefined8 * param_9)|int __fastcall PrjfGetSetContextFileObject(undefined8 param_1, longlong param_2, int param_3, char param_4, char param_5, undefined4 * param_6, undefined2 * param_7, longlong * param_8, undefined8 * param_9)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| Generated with `ghidriff` version: 1.0.0 on 2026-08-19T20:11:08