# rasman.dll 26100.7309 vs 26100.7705 (CVE-2026-21525, manual pair) # TOC * [Visual Chart Diff](#visual-chart-diff) * [Metadata](#metadata) * [Ghidra Diff Engine](#ghidra-diff-engine) * [Command Line](#command-line) * [Binary Metadata Diff](#binary-metadata-diff) * [Program Options](#program-options) * [Diff Stats](#diff-stats) * [Strings](#strings) * [Deleted](#deleted) * [Feature_817320250__private_IsEnabledDeviceUsageNoInline](#feature_817320250__private_isenableddeviceusagenoinline) * [Added](#added) * [Modified](#modified) * [wil_details_FeatureReporting_ReportUsageToServiceDirect](#wil_details_featurereporting_reportusagetoservicedirect) * [Feature_VPN_BugFixes_25B_Use_After_Free_Fix__private_IsEnabledDeviceUsageNoInline](#feature_vpn_bugfixes_25b_use_after_free_fix__private_isenableddeviceusagenoinline) * [wil_details_FeatureReporting_ReportUsageToService](#wil_details_featurereporting_reportusagetoservice) * [RpcConnect](#rpcconnect) * [wil_details_IsEnabledFallback](#wil_details_isenabledfallback) * [wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath](#wil_details_featurestatecache_tryenabledeviceusagefastpath) * [Modified (No Code Changes)](#modified-no-code-changes) # Visual Chart Diff ```mermaid flowchart LR wil_details_FeatureReporting_ReportUsageToServiceDirect-3-old<--Match 93%-->wil_details_FeatureReporting_ReportUsageToServiceDirect-3-new Feature_VPN_BugFixes_25B_Use_After_Free_Fix__private_IsEnabledDeviceUsageNoInline-0-old<--Match 96%-->Feature_VPN_BugFixes_25B_Use_After_Free_Fix__private_IsEnabledDeviceUsageNoInline-0-new wil_details_FeatureReporting_ReportUsageToService-3-old<--Match 94%-->wil_details_FeatureReporting_ReportUsageToService-3-new RpcConnect-1-old<--Match 48%-->RpcConnect-1-new wil_details_IsEnabledFallback-3-old<--Match 94%-->wil_details_IsEnabledFallback-3-new wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath-3-old<--Match 90%-->wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath-3-new subgraph rasman-10.0.26100.7705.dll wil_details_FeatureReporting_ReportUsageToServiceDirect-3-new Feature_VPN_BugFixes_25B_Use_After_Free_Fix__private_IsEnabledDeviceUsageNoInline-0-new wil_details_FeatureReporting_ReportUsageToService-3-new RpcConnect-1-new wil_details_IsEnabledFallback-3-new wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath-3-new end subgraph rasman-10.0.26100.7309.dll wil_details_FeatureReporting_ReportUsageToServiceDirect-3-old Feature_VPN_BugFixes_25B_Use_After_Free_Fix__private_IsEnabledDeviceUsageNoInline-0-old wil_details_FeatureReporting_ReportUsageToService-3-old RpcConnect-1-old wil_details_IsEnabledFallback-3-old wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath-3-old subgraph Deleted direction LR Feature_817320250__private_IsEnabledDeviceUsageNoInline end end ``` ```mermaid pie showData title Function Matches - 99.9066% "unmatched_funcs_len" : 1 "matched_funcs_len" : 1070 ``` ```mermaid pie showData title Matched Function Similarity - 99.4393% "matched_funcs_with_code_changes_len" : 6 "matched_funcs_with_non_code_changes_len" : 0 "matched_funcs_no_changes_len" : 1064 ``` # Metadata ## Ghidra Diff Engine ### Command Line #### Captured Command Line ``` ghidriff --project-location C:\tools\hugo\patchpalooza\ghidriff\CVE-2026-21525\ghidra_projects --project-name CVE-2026-21525 --symbols-path C:\tools\hugo\patchpalooza\ghidriff\CVE-2026-21525\symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --bsim --max-ram-percent 60.0 --max-section-funcs 200 --md-title rasman.dll 26100.7309 vs 26100.7705 (CVE-2026-21525, manual pair) rasman-10.0.26100.7309.dll rasman-10.0.26100.7705.dll ``` #### Verbose Args

``` --old ['C:\\tools\\hugo\\patchpalooza\\ghidriff\\CVE-2026-21525\\rasman-10.0.26100.7309.dll'] --new [['C:\\tools\\hugo\\patchpalooza\\ghidriff\\CVE-2026-21525\\rasman-10.0.26100.7705.dll']] --engine VersionTrackingDiff --output-path C:\tools\hugo\patchpalooza\ghidriff\CVE-2026-21525\output --summary False --project-location C:\tools\hugo\patchpalooza\ghidriff\CVE-2026-21525\ghidra_projects --project-name CVE-2026-21525 --symbols-path C:\tools\hugo\patchpalooza\ghidriff\CVE-2026-21525\symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim True --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title rasman.dll 26100.7309 vs 26100.7705 (CVE-2026-21525, manual pair) ```

#### Download Original PEs ``` wget https://msdl.microsoft.com/download/symbols/Rasman.dll/52274C9938000/Rasman.dll -O rasman.dll.x64.10.0.26100.7309 wget https://msdl.microsoft.com/download/symbols/Rasman.dll/6F60017238000/Rasman.dll -O rasman.dll.x64.10.0.26100.7705 ``` ## Binary Metadata Diff ```diff --- rasman-10.0.26100.7309.dll Meta +++ rasman-10.0.26100.7705.dll Meta @@ -1,44 +1,44 @@ -Program Name: rasman-10.0.26100.7309.dll +Program Name: rasman-10.0.26100.7705.dll Language ID: x86:LE:64:default (4.7) Compiler ID: windows Processor: x86 Endian: Little Address Size: 64 Minimum Address: 180000000 Maximum Address: ff0000184f # of Bytes: 235600 # of Memory Blocks: 10 -# of Instructions: 38237 -# of Defined Data: 3254 -# of Functions: 536 -# of Symbols: 5785 +# of Instructions: 38190 +# of Defined Data: 3226 +# of Functions: 535 +# of Symbols: 5768 # of Data Types: 512 # of Data Type Categories: 29 Analyzed: true Compiler: visualstudio:unknown Created With Ghidra Version: 12.1.2 -Date Created: Tue Jul 28 19:45:52 SGT 2026 +Date Created: Tue Jul 28 19:45:56 SGT 2026 Executable Format: Portable Executable (PE) -Executable Location: /C:/tools/hugo/patchpalooza/ghidriff/CVE-2026-21525/rasman-10.0.26100.7309.dll -Executable MD5: 2babb19d93719fdf8ddae586934847ca -Executable SHA256: 46c67ae01a5768d3529f3d8bd973c96ad9ba9aa262fb43fbead1cf7189b80dfc -FSRL: file:///C:/tools/hugo/patchpalooza/ghidriff/CVE-2026-21525/rasman-10.0.26100.7309.dll?MD5=2babb19d93719fdf8ddae586934847ca +Executable Location: /C:/tools/hugo/patchpalooza/ghidriff/CVE-2026-21525/rasman-10.0.26100.7705.dll +Executable MD5: 209da89449264c251e580b0002c192d9 +Executable SHA256: 5c0ca2c11d3b3a2366e2e97c7a466a82c0174568dfa06f3ecd70d8f086333e2d +FSRL: file:///C:/tools/hugo/patchpalooza/ghidriff/CVE-2026-21525/rasman-10.0.26100.7705.dll?MD5=209da89449264c251e580b0002c192d9 PDB Age: 1 PDB File: rasman.pdb -PDB GUID: 492266bd-0505-e152-2832-a47a5c37de2a +PDB GUID: 53c238a9-6026-1db3-1e6b-91661bbe3c03 PDB Loaded: true PDB Version: RSDS PE Property[CompanyName]: Microsoft Corporation PE Property[FileDescription]: Remote Access Connection Manager -PE Property[FileVersion]: 10.0.26100.7309 (WinBuild.160101.0800) +PE Property[FileVersion]: 10.0.26100.7705 (WinBuild.160101.0800) PE Property[InternalName]: Rasman.dll PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved. PE Property[OriginalFilename]: Rasman.dll PE Property[ProductName]: Microsoft® Windows® Operating System -PE Property[ProductVersion]: 10.0.26100.7309 +PE Property[ProductVersion]: 10.0.26100.7705 PE Property[Translation]: 4b00409 Preferred Root Namespace Category: RTTI Found: false Relocatable: true SectionAlignment: 4096 Should Ask To Analyze: false ``` ## Program Options

Ghidra rasman-10.0.26100.7309.dll Decompiler Options

Ghidra rasman-10.0.26100.7309.dll Specification extensions Options

|Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|

Ghidra rasman-10.0.26100.7309.dll Analyzers Options

|Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.msdApplyOptions|{ interpretation: FUNCTION_IF_EXISTS, applyCallingConvention: true, applySignature: true, demangleOnlyKnownPatterns: true, doDisassembly: true }| |Demangler Microsoft.msdOutputOptions|ghidra.app.util.demangler.microsoft.options.MsdOutputOption@9e5b| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|

Ghidra rasman-10.0.26100.7705.dll Decompiler Options

Ghidra rasman-10.0.26100.7705.dll Specification extensions Options

|Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|

Ghidra rasman-10.0.26100.7705.dll Analyzers Options

## Diff Stats |Stat|Value| | :---: | :---: | |added_funcs_len|0| |deleted_funcs_len|1| |modified_funcs_len|6| |added_symbols_len|2| |deleted_symbols_len|12| |diff_time|14.224342823028564| |deleted_strings_len|0| |added_strings_len|0| |match_types|Counter({'SymbolsHash': 532, 'ExternalsName': 116, 'ExactBytesFunctionHasher': 1, 'ExactInstructionsFunctionHasher': 1})| |items_to_process|21| |diff_types|Counter({'code': 6, 'length': 6, 'sig': 5, 'address': 5, 'called': 1, 'refcount': 1, 'calling': 1})| |unmatched_funcs_len|1| |total_funcs_len|1071| |matched_funcs_len|1070| |matched_funcs_with_code_changes_len|6| |matched_funcs_with_non_code_changes_len|0| |matched_funcs_no_changes_len|1064| |match_func_similarity_percent|99.4393%| |func_match_overall_percent|99.9066%| |first_matches|Counter({'SymbolsHash': 532, 'ExactBytesFunctionHasher': 1, 'ExactInstructionsFunctionHasher': 1})| ```mermaid pie showData title All Matches "SymbolsHash" : 532 "ExternalsName" : 116 "ExactBytesFunctionHasher" : 1 "ExactInstructionsFunctionHasher" : 1 ``` ```mermaid pie showData title First Matches "SymbolsHash" : 532 "ExactBytesFunctionHasher" : 1 "ExactInstructionsFunctionHasher" : 1 ``` ```mermaid pie showData title Diff Stats "added_funcs_len" : 0 "deleted_funcs_len" : 1 "modified_funcs_len" : 6 ``` ```mermaid pie showData title Symbols "added_symbols_len" : 2 "deleted_symbols_len" : 12 ``` ## Strings *No string differences found* # Deleted ## Feature_817320250__private_IsEnabledDeviceUsageNoInline ### Function Meta |Key|rasman-10.0.26100.7309.dll| | :---: | :---: | |name|Feature_817320250__private_IsEnabledDeviceUsageNoInline| |fullname|Feature_817320250__private_IsEnabledDeviceUsageNoInline| |refcount|2| |length|51| |called|wil_details_IsEnabledFallback| |calling|RpcConnect| |paramcount|0| |address|180027eb8| |sig|uint __fastcall Feature_817320250__private_IsEnabledDeviceUsageNoInline(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_817320250__private_IsEnabledDeviceUsageNoInline +++ Feature_817320250__private_IsEnabledDeviceUsageNoInline @@ -1,15 +0,0 @@ - -uint Feature_817320250__private_IsEnabledDeviceUsageNoInline(void) - -{ - uint uVar1; - ulonglong local_res8; - - local_res8 = (ulonglong)Feature_817320250__private_featureState; - if ((Feature_817320250__private_featureState & 0x10) != 0) { - return Feature_817320250__private_featureState & 1; - } - uVar1 = wil_details_IsEnabledFallback(local_res8,3,&Feature_817320250__private_descriptor); - return uVar1; -} - ``` # Added # Modified *Modified functions contain code changes* ## wil_details_FeatureReporting_ReportUsageToServiceDirect ### Match Info |Key|rasman-10.0.26100.7309.dll - rasman-10.0.26100.7705.dll| | :---: | :---: | |diff_type|code,length,sig,address| |ratio|0.43| |i_ratio|0.66| |m_ratio|0.96| |b_ratio|0.93| |match_types|SymbolsHash| ### Function Meta Diff |Key|rasman-10.0.26100.7309.dll|rasman-10.0.26100.7705.dll| | :---: | :---: | :---: | |name|wil_details_FeatureReporting_ReportUsageToServiceDirect|wil_details_FeatureReporting_ReportUsageToServiceDirect| |fullname|wil_details_FeatureReporting_ReportUsageToServiceDirect|wil_details_FeatureReporting_ReportUsageToServiceDirect| |refcount|2|2| |`length`|127|137| |called|__security_check_cookie
wil_RtlStagingConfig_RecordFeatureUsage
wil_details_FeatureReporting_RecordUsageInCache|__security_check_cookie
wil_RtlStagingConfig_RecordFeatureUsage
wil_details_FeatureReporting_RecordUsageInCache| |calling|wil_details_FeatureReporting_ReportUsageToService|wil_details_FeatureReporting_ReportUsageToService| |paramcount|3|3| |`address`|180024eb4|180024e54| |`sig`|bool __fastcall wil_details_FeatureReporting_ReportUsageToServiceDirect(longlong param_1, undefined8 param_2, undefined8 param_3)|bool __fastcall wil_details_FeatureReporting_ReportUsageToServiceDirect(undefined8 param_1, undefined8 param_2, undefined8 param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### wil_details_FeatureReporting_ReportUsageToServiceDirect Diff ```diff --- wil_details_FeatureReporting_ReportUsageToServiceDirect +++ wil_details_FeatureReporting_ReportUsageToServiceDirect @@ -1,24 +1,25 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ bool wil_details_FeatureReporting_ReportUsageToServiceDirect - (longlong param_1,undefined8 param_2,undefined8 param_3) + (undefined8 param_1,undefined8 param_2,undefined8 param_3) { uint *puVar1; - undefined1 auStack_88 [48]; - uint local_58 [10]; - undefined8 local_30; - ulonglong local_28; + undefined1 auStack_78 [48]; + uint local_48 [10]; + undefined8 local_20; + ulonglong local_18; - local_28 = __security_cookie ^ (ulonglong)auStack_88; + local_18 = __security_cookie ^ (ulonglong)auStack_78; puVar1 = wil_details_FeatureReporting_RecordUsageInCache - (local_58,*(uint **)(param_1 + 8),param_3,(uint)((ulonglong)param_2 >> 0x20)); - local_30 = *(undefined8 *)(puVar1 + 4); + (local_48,(uint *)& + Feature_VPN_BugFixes_25B_Use_After_Free_Fix__private_reporting + ,param_3,(uint)((ulonglong)param_2 >> 0x20)); + local_20 = *(undefined8 *)(puVar1 + 4); if ((((uint)param_2 >> 10 & 1) != 0) && ((int)param_3 != 0xfe)) { - wil_RtlStagingConfig_RecordFeatureUsage - (*(undefined4 *)(param_1 + 0x18),(short)param_3,(uint)param_2 >> 0xb & 1); + wil_RtlStagingConfig_RecordFeatureUsage(0x3672917,(short)param_3,(uint)param_2 >> 0xb & 1); } - return (int)local_30 == 0; + return (int)local_20 == 0; } ``` ## Feature_VPN_BugFixes_25B_Use_After_Free_Fix__private_IsEnabledDeviceUsageNoInline ### Match Info |Key|rasman-10.0.26100.7309.dll - rasman-10.0.26100.7705.dll| | :---: | :---: | |diff_type|code,length,address| |ratio|0.69| |i_ratio|0.61| |m_ratio|0.96| |b_ratio|0.96| |match_types|SymbolsHash| ### Function Meta Diff |Key|rasman-10.0.26100.7309.dll|rasman-10.0.26100.7705.dll| | :---: | :---: | :---: | |name|Feature_VPN_BugFixes_25B_Use_After_Free_Fix__private_IsEnabledDeviceUsageNoInline|Feature_VPN_BugFixes_25B_Use_After_Free_Fix__private_IsEnabledDeviceUsageNoInline| |fullname|Feature_VPN_BugFixes_25B_Use_After_Free_Fix__private_IsEnabledDeviceUsageNoInline|Feature_VPN_BugFixes_25B_Use_After_Free_Fix__private_IsEnabledDeviceUsageNoInline| |refcount|2|2| |`length`|51|44| |called|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |calling|InitializeConnection|InitializeConnection| |paramcount|0|0| |`address`|180024340|1800242f0| |sig|uint __fastcall Feature_VPN_BugFixes_25B_Use_After_Free_Fix__private_IsEnabledDeviceUsageNoInline(void)|uint __fastcall Feature_VPN_BugFixes_25B_Use_After_Free_Fix__private_IsEnabledDeviceUsageNoInline(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### Feature_VPN_BugFixes_25B_Use_After_Free_Fix__private_IsEnabledDeviceUsageNoInline Diff ```diff --- Feature_VPN_BugFixes_25B_Use_After_Free_Fix__private_IsEnabledDeviceUsageNoInline +++ Feature_VPN_BugFixes_25B_Use_After_Free_Fix__private_IsEnabledDeviceUsageNoInline @@ -1,16 +1,16 @@ uint Feature_VPN_BugFixes_25B_Use_After_Free_Fix__private_IsEnabledDeviceUsageNoInline(void) { uint uVar1; - ulonglong local_res8; + undefined8 local_res8; - local_res8 = (ulonglong)Feature_VPN_BugFixes_25B_Use_After_Free_Fix__private_featureState; + local_res8 = (undefined4 *) + (ulonglong)Feature_VPN_BugFixes_25B_Use_After_Free_Fix__private_featureState; if ((Feature_VPN_BugFixes_25B_Use_After_Free_Fix__private_featureState & 0x10) != 0) { return Feature_VPN_BugFixes_25B_Use_After_Free_Fix__private_featureState & 1; } - uVar1 = wil_details_IsEnabledFallback - (local_res8,3,&Feature_VPN_BugFixes_25B_Use_After_Free_Fix__private_descriptor); + uVar1 = wil_details_IsEnabledFallback(local_res8,3); return uVar1; } ``` ## wil_details_FeatureReporting_ReportUsageToService ### Match Info |Key|rasman-10.0.26100.7309.dll - rasman-10.0.26100.7705.dll| | :---: | :---: | |diff_type|code,length,sig,address| |ratio|0.63| |i_ratio|0.56| |m_ratio|0.94| |b_ratio|0.94| |match_types|SymbolsHash| ### Function Meta Diff |Key|rasman-10.0.26100.7309.dll|rasman-10.0.26100.7705.dll| | :---: | :---: | :---: | |name|wil_details_FeatureReporting_ReportUsageToService|wil_details_FeatureReporting_ReportUsageToService| |fullname|wil_details_FeatureReporting_ReportUsageToService|wil_details_FeatureReporting_ReportUsageToService| |refcount|2|2| |`length`|125|114| |called|_guard_dispatch_icall$thunk$10345483385596137414
wil_details_FeatureReporting_ReportUsageToServiceDirect
wil_details_MapReportingKind|_guard_dispatch_icall$thunk$10345483385596137414
wil_details_FeatureReporting_ReportUsageToServiceDirect
wil_details_MapReportingKind| |calling|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |paramcount|3|3| |`address`|180024e30|180024dd8| |`sig`|undefined __fastcall wil_details_FeatureReporting_ReportUsageToService(longlong param_1, undefined8 param_2, int param_3)|undefined __fastcall wil_details_FeatureReporting_ReportUsageToService(undefined8 param_1, undefined8 param_2, uint param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### wil_details_FeatureReporting_ReportUsageToService Diff ```diff --- wil_details_FeatureReporting_ReportUsageToService +++ wil_details_FeatureReporting_ReportUsageToService @@ -1,27 +1,28 @@ /* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: guard_dispatch_icall */ void wil_details_FeatureReporting_ReportUsageToService - (longlong param_1,undefined8 param_2,int param_3) + (undefined8 param_1,undefined8 param_2,uint param_3) { bool bVar1; uint uVar2; undefined7 extraout_var; - uint uVar3; - int local_res18 [4]; + ulonglong uVar3; + uint uVar4; + uint local_res18 [4]; - uVar3 = (uint)param_2 & 1; + uVar4 = (uint)param_2 & 1; + uVar3 = (ulonglong)param_3; local_res18[0] = param_3; - uVar2 = wil_details_MapReportingKind(param_3,uVar3); - bVar1 = wil_details_FeatureReporting_ReportUsageToServiceDirect(param_1,param_2,(ulonglong)uVar2); + uVar2 = wil_details_MapReportingKind(param_3,uVar4); + bVar1 = wil_details_FeatureReporting_ReportUsageToServiceDirect(uVar3,param_2,(ulonglong)uVar2); if (((int)CONCAT71(extraout_var,bVar1) != 0) && (g_wil_details_pfnFeatureLoggingHook != (code *)0x0)) { (*g_wil_details_pfnFeatureLoggingHook) - (*(undefined4 *)(param_1 + 0x18),*(undefined8 *)(param_1 + 0x10),0,uVar3,local_res18,0 - ,0,1); + (0x3672917,&Feature_VPN_BugFixes_25B_logged_traits,0,uVar4,local_res18,0,0,1); } return; } ``` ## RpcConnect ### Match Info |Key|rasman-10.0.26100.7309.dll - rasman-10.0.26100.7705.dll| | :---: | :---: | |diff_type|code,length,sig,called| |ratio|0.45| |i_ratio|0.52| |m_ratio|0.97| |b_ratio|0.48| |match_types|SymbolsHash| ### Function Meta Diff |Key|rasman-10.0.26100.7309.dll|rasman-10.0.26100.7705.dll| | :---: | :---: | :---: | |name|RpcConnect|RpcConnect| |fullname|RpcConnect|RpcConnect| |refcount|6|6| |`length`|1142|1062| |`called`|

Expand for full list:
API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError
API-MS-WIN-CORE-HEAP-L2-1-0.DLL::LocalAlloc
API-MS-WIN-CORE-HEAP-L2-1-0.DLL::LocalFree
API-MS-WIN-CORE-KERNEL32-LEGACY-L1-1-0.DLL::GetComputerNameW
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::EnterCriticalSection
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::LeaveCriticalSection
API-MS-WIN-SECURITY-BASE-L1-1-0.DLL::AllocateAndInitializeSid
API-MS-WIN-SECURITY-BASE-L1-1-0.DLL::FreeSid
Feature_817320250__private_IsEnabledDeviceUsageNoInline
MSVCRT.DLL::_wcsicmp
RPCRT4.DLL::I_RpcMapWin32Status

RPCRT4.DLL::RpcBindingFree
RPCRT4.DLL::RpcBindingFromStringBindingW
RPCRT4.DLL::RpcBindingSetAuthInfoExW
RPCRT4.DLL::RpcStringBindingComposeW
RPCRT4.DLL::RpcStringFreeW
StringCchPrintfW
__security_check_cookie

Expand for full list:
API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError
API-MS-WIN-CORE-HEAP-L2-1-0.DLL::LocalAlloc
API-MS-WIN-CORE-HEAP-L2-1-0.DLL::LocalFree
API-MS-WIN-CORE-KERNEL32-LEGACY-L1-1-0.DLL::GetComputerNameW
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::EnterCriticalSection
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::LeaveCriticalSection
API-MS-WIN-SECURITY-BASE-L1-1-0.DLL::AllocateAndInitializeSid
API-MS-WIN-SECURITY-BASE-L1-1-0.DLL::FreeSid
MSVCRT.DLL::_wcsicmp
RPCRT4.DLL::I_RpcMapWin32Status
RPCRT4.DLL::RpcBindingFree

RPCRT4.DLL::RpcBindingFromStringBindingW
RPCRT4.DLL::RpcBindingSetAuthInfoExW
RPCRT4.DLL::RpcStringBindingComposeW
RPCRT4.DLL::RpcStringFreeW
StringCchPrintfW
__security_check_cookie

| |calling|RasRPCBind
RasRpcConnect
RemoteSubmitRequestLocal|RasRPCBind
RasRpcConnect
RemoteSubmitRequestLocal| |paramcount|1|1| |address|180011e90|180011e90| |`sig`|wchar_t * __fastcall RpcConnect(wchar_t * param_1)|STRSAFE_LPWSTR __fastcall RpcConnect(STRSAFE_LPWSTR param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### RpcConnect Called Diff ```diff --- RpcConnect called +++ RpcConnect called @@ -9 +8,0 @@ -Feature_817320250__private_IsEnabledDeviceUsageNoInline ``` ### RpcConnect Diff ```diff --- RpcConnect +++ RpcConnect @@ -1,198 +1,187 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ /* WARNING: Globals starting with '_' overlap smaller symbols at the same address */ -wchar_t * RpcConnect(wchar_t *param_1) +STRSAFE_LPWSTR RpcConnect(STRSAFE_LPWSTR param_1) { bool bVar1; longlong lVar2; BOOL BVar3; DWORD DVar4; int iVar5; - uint uVar6; RPC_STATUS Status; - HRESULT HVar7; + HRESULT HVar6; + uint uVar7; undefined4 extraout_var; ulonglong uVar8; STRSAFE_LPWSTR pszDest; longlong lVar9; - wchar_t *pwVar10; + STRSAFE_LPWSTR pwVar10; ulong AuthnSvc; - wchar_t *Endpoint; - RPC_BINDING_HANDLE *Binding; wchar_t *_Str1; bool bVar11; RPC_SECURITY_QOS *in_stack_00000050; RPC_BINDING_HANDLE *in_stack_00000068; undefined1 auStackY_f8 [32]; DWORD local_90 [2]; RPC_WSTR local_88; - RPC_SECURITY_QOS *local_80; - RPC_BINDING_HANDLE *local_78; - PSID local_70; - RPC_WSTR local_68; + PSID local_80; + RPC_WSTR local_78; + wchar_t *local_70; + RPC_BINDING_HANDLE *local_68; _SID_IDENTIFIER_AUTHORITY local_60; WCHAR local_58 [16]; ulonglong local_38; local_38 = __security_cookie ^ (ulonglong)auStackY_f8; - pwVar10 = (wchar_t *)0x0; - local_78 = in_stack_00000068; - local_80 = in_stack_00000050; + pwVar10 = (STRSAFE_LPWSTR)0x0; + local_68 = in_stack_00000068; local_90[0] = 0x10; local_60.Value[0] = '\0'; local_60.Value[1] = '\0'; local_60.Value[2] = '\0'; local_60.Value[3] = '\0'; local_60.Value[4] = '\0'; local_60.Value[5] = '\x05'; - local_70 = (PSID)0x0; + local_80 = (PSID)0x0; local_58[0] = L'\0'; local_58[1] = L'\0'; local_58[2] = L'\0'; local_58[3] = L'\0'; local_58[4] = L'\0'; local_58[5] = L'\0'; local_58[6] = L'\0'; local_58[7] = L'\0'; local_58[8] = L'\0'; local_58[9] = L'\0'; local_58[10] = L'\0'; local_58[0xb] = L'\0'; local_58[0xc] = L'\0'; local_58[0xd] = L'\0'; local_58[0xe] = L'\0'; local_58[0xf] = L'\0'; if (in_stack_00000068 == (RPC_BINDING_HANDLE *)0x0) { - return (wchar_t *)0x57; + return (STRSAFE_LPWSTR)0x57; } BVar3 = GetComputerNameW(local_58,local_90); if (BVar3 == 0) { DVar4 = GetLastError(); - return (wchar_t *)CONCAT44(extraout_var,DVar4); + return (STRSAFE_LPWSTR)CONCAT44(extraout_var,DVar4); } EnterCriticalSection((LPCRITICAL_SECTION)&g_RpcCs); - if ((param_1 == (wchar_t *)0x0) || (*param_1 == L'\0')) { + local_70 = L"RasmanLrpc"; + if ((param_1 == (STRSAFE_LPWSTR)0x0) || (*param_1 == L'\0')) { param_1 = local_58; bVar11 = true; LAB_0: - if (g_hBinding != (RPC_BINDING_HANDLE)0x0) { - _g_dwRefCount = _g_dwRefCount + 1; - *in_stack_00000068 = g_hBinding; - goto LAB_1; + if (g_hBinding == (RPC_BINDING_HANDLE)0x0) { + iVar5 = _wcsicmp(L"RasmanLrpc",L"RasmanLrpc"); + if (iVar5 == 0) { + BVar3 = AllocateAndInitializeSid(&local_60,'\x01',0x12,0,0,0,0,0,0,0,&local_80); + if (BVar3 == 0) { + DVar4 = GetLastError(); + pwVar10 = (STRSAFE_LPWSTR)(ulonglong)DVar4; + goto LAB_1; + } + *(PSID *)(in_stack_00000050 + 2) = local_80; + in_stack_00000050->Capabilities = 0x11; + } + goto LAB_2; } + *in_stack_00000068 = g_hBinding; } else { uVar8 = 0xffffffffffffffff; do { uVar8 = uVar8 + 1; } while (param_1[uVar8] != L'\0'); if (((2 < uVar8) && (*param_1 == L'\\')) && (param_1[1] == L'\\')) { param_1 = param_1 + 2; } iVar5 = _wcsicmp(param_1,local_58); bVar11 = iVar5 == 0; if (iVar5 == 0) goto LAB_0; - } - uVar6 = Feature_817320250__private_IsEnabledDeviceUsageNoInline(); - Endpoint = L"RasmanLrpc"; - bVar1 = false; - if (((uVar6 == 0) || (!bVar11)) || (iVar5 = _wcsicmp(L"RasmanLrpc",L"RasmanLrpc"), iVar5 != 0)) { +LAB_2: if (bVar11) { _Str1 = L"ncalrpc"; param_1 = pwVar10; - Binding = &g_hBinding; + in_stack_00000068 = &g_hBinding; } else { - Endpoint = L"\\PIPE\\ROUTER"; + local_70 = L"\\PIPE\\ROUTER"; _Str1 = L"ncacn_np"; - Binding = local_78; } + local_88 = (RPC_WSTR)0x0; + bVar1 = false; + local_78 = (RPC_WSTR)0x0; + iVar5 = _wcsicmp(_Str1,L"ncalrpc"); + Status = RpcStringBindingComposeW + ((RPC_WSTR)0x0,(RPC_WSTR)_Str1,(RPC_WSTR)param_1,(RPC_WSTR)local_70, + (RPC_WSTR)L"Security=Impersonation Dynamic True",&local_88); + if (Status == 0) { + Status = RpcBindingFromStringBindingW(local_88,in_stack_00000068); + RpcStringFreeW(&local_88); + if (Status == 0) { + bVar1 = true; + if (iVar5 == 0) { + param_1 = (STRSAFE_LPWSTR)0x0; + AuthnSvc = 10; + } + else { + lVar2 = -1; + if (param_1 != (STRSAFE_LPWSTR)0x0) { + do { + lVar9 = lVar2; + lVar2 = lVar9 + 1; + } while (param_1[lVar9 + 1] != L'\0'); + uVar8 = lVar9 + 9U & 0xffffffff; + pszDest = LocalAlloc(0x40,uVar8 * 2); + if (pszDest != (STRSAFE_LPWSTR)0x0) { + HVar6 = StringCchPrintfW(pszDest,uVar8,L"host/%s",param_1); + if (HVar6 < 0) { + LocalFree(pszDest); + pszDest = pwVar10; + } + if (-1 < HVar6) { + Status = RpcBindingSetAuthInfoExW + (*in_stack_00000068,(RPC_WSTR)pszDest,6,9, + (RPC_AUTH_IDENTITY_HANDLE)0x0,0,in_stack_00000050); + LocalFree(pszDest); + goto LAB_3; + } + } + } + AuthnSvc = 9; + } + Status = RpcBindingSetAuthInfoExW + (*in_stack_00000068,(RPC_WSTR)param_1,6,AuthnSvc, + (RPC_AUTH_IDENTITY_HANDLE)0x0,0,in_stack_00000050); + } + } +LAB_3: + if (local_78 != (RPC_WSTR)0x0) { + RpcStringFreeW(&local_78); + } + if (Status != 0) { + if (bVar1) { + if (*in_stack_00000068 != (RPC_BINDING_HANDLE)0x0) { + RpcBindingFree(in_stack_00000068); + } + *in_stack_00000068 = (RPC_BINDING_HANDLE)0x0; + } + uVar7 = I_RpcMapWin32Status(Status); + pwVar10 = (STRSAFE_LPWSTR)(ulonglong)uVar7; + } + if (!bVar11) goto LAB_1; + *local_68 = g_hBinding; } - else { - BVar3 = AllocateAndInitializeSid(&local_60,'\x01',0x12,0,0,0,0,0,0,0,&local_70); - if (BVar3 == 0) { - DVar4 = GetLastError(); - pwVar10 = (wchar_t *)(ulonglong)DVar4; - goto LAB_1; - } - *(PSID *)(in_stack_00000050 + 2) = local_70; - in_stack_00000050->Capabilities = 0x11; - Binding = &g_hBinding; - if (!bVar11) { - Binding = local_78; - } - _Str1 = L"ncalrpc"; - param_1 = pwVar10; - } - local_88 = (RPC_WSTR)0x0; - local_68 = (RPC_WSTR)0x0; - iVar5 = _wcsicmp(_Str1,L"ncalrpc"); - Status = RpcStringBindingComposeW - ((RPC_WSTR)0x0,(RPC_WSTR)_Str1,(RPC_WSTR)param_1,(RPC_WSTR)Endpoint, - (RPC_WSTR)L"Security=Impersonation Dynamic True",&local_88); - if (Status == 0) { - Status = RpcBindingFromStringBindingW(local_88,Binding); - RpcStringFreeW(&local_88); - if (Status == 0) { - bVar1 = true; - if (iVar5 == 0) { - param_1 = (wchar_t *)0x0; - AuthnSvc = 10; - } - else { - lVar2 = -1; - if (param_1 != (wchar_t *)0x0) { - do { - lVar9 = lVar2; - lVar2 = lVar9 + 1; - } while (param_1[lVar9 + 1] != L'\0'); - uVar8 = lVar9 + 9U & 0xffffffff; - pszDest = LocalAlloc(0x40,uVar8 * 2); - if (pszDest != (STRSAFE_LPWSTR)0x0) { - HVar7 = StringCchPrintfW(pszDest,uVar8,L"host/%s",param_1); - if (-1 < HVar7) { - Status = RpcBindingSetAuthInfoExW - (*Binding,(RPC_WSTR)pszDest,6,9,(RPC_AUTH_IDENTITY_HANDLE)0x0,0, - local_80); - LocalFree(pszDest); - goto LAB_2; - } - LocalFree(pszDest); - } - } - AuthnSvc = 9; - } - Status = RpcBindingSetAuthInfoExW - (*Binding,(RPC_WSTR)param_1,6,AuthnSvc,(RPC_AUTH_IDENTITY_HANDLE)0x0,0, - local_80); - } - } -LAB_2: - if (local_68 != (RPC_WSTR)0x0) { - RpcStringFreeW(&local_68); - } - if (Status != 0) { - if (bVar1) { - if (*Binding != (RPC_BINDING_HANDLE)0x0) { - RpcBindingFree(Binding); - } - *Binding = (RPC_BINDING_HANDLE)0x0; - } - uVar6 = I_RpcMapWin32Status(Status); - pwVar10 = (wchar_t *)(ulonglong)uVar6; - } - if (bVar11) { - _g_dwRefCount = _g_dwRefCount + 1; - *local_78 = g_hBinding; - } + _g_dwRefCount = _g_dwRefCount + 1; LAB_1: - uVar6 = Feature_817320250__private_IsEnabledDeviceUsageNoInline(); - if ((uVar6 != 0) && (local_70 != (PSID)0x0)) { - FreeSid(local_70); + if (local_80 != (PSID)0x0) { + FreeSid(local_80); } LeaveCriticalSection((LPCRITICAL_SECTION)&g_RpcCs); return pwVar10; } ``` ## wil_details_IsEnabledFallback ### Match Info |Key|rasman-10.0.26100.7309.dll - rasman-10.0.26100.7705.dll| | :---: | :---: | |diff_type|code,refcount,length,sig,address,calling| |ratio|0.48| |i_ratio|0.43| |m_ratio|0.96| |b_ratio|0.94| |match_types|SymbolsHash| ### Function Meta Diff |Key|rasman-10.0.26100.7309.dll|rasman-10.0.26100.7705.dll| | :---: | :---: | :---: | |name|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |fullname|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |`refcount`|3|2| |`length`|140|135| |called|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath| |`calling`|Feature_817320250__private_IsEnabledDeviceUsageNoInline
Feature_VPN_BugFixes_25B_Use_After_Free_Fix__private_IsEnabledDeviceUsageNoInline|Feature_VPN_BugFixes_25B_Use_After_Free_Fix__private_IsEnabledDeviceUsageNoInline| |paramcount|3|2| |`address`|180025258|1800251f0| |`sig`|uint __fastcall wil_details_IsEnabledFallback(ulonglong param_1, int param_2, undefined8 * param_3)|uint __fastcall wil_details_IsEnabledFallback(undefined4 * param_1, uint param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### wil_details_IsEnabledFallback Calling Diff ```diff --- wil_details_IsEnabledFallback calling +++ wil_details_IsEnabledFallback calling @@ -1 +0,0 @@ -Feature_817320250__private_IsEnabledDeviceUsageNoInline ``` ### wil_details_IsEnabledFallback Diff ```diff --- wil_details_IsEnabledFallback +++ wil_details_IsEnabledFallback @@ -1,22 +1,26 @@ -uint wil_details_IsEnabledFallback(ulonglong param_1,int param_2,undefined8 *param_3) +uint wil_details_IsEnabledFallback(undefined4 *param_1,uint param_2) { uint uVar1; - ulonglong local_res8; + undefined4 *puVar2; + ulonglong local_res18; uVar1 = (uint)param_1; - local_res8 = param_1 & 0xffffffff; - if ((param_1 & 2) == 0) { - local_res8 = wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState - ((uint *)*param_3,param_1,(longlong)param_3); - uVar1 = (uint)local_res8; + local_res18 = (ulonglong)param_1 & 0xffffffff; + if (((ulonglong)param_1 & 2) == 0) { + puVar2 = &Feature_VPN_BugFixes_25B_Use_After_Free_Fix__private_featureState; + local_res18 = wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState + (&Feature_VPN_BugFixes_25B_Use_After_Free_Fix__private_featureState, + (ulonglong)param_1,0x18002e4c8); + param_1 = puVar2; + uVar1 = (uint)local_res18; } if ((param_2 != 0) && - (wil_details_FeatureReporting_ReportUsageToService((longlong)param_3,local_res8,param_2), - param_2 - 3U < 2)) { - wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath((uint)local_res8,param_2,param_3); + (wil_details_FeatureReporting_ReportUsageToService(param_1,local_res18,param_2), + param_2 - 3 < 2)) { + wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath((uint)local_res18,param_2); } return uVar1 & 1; } ``` ## wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath ### Match Info |Key|rasman-10.0.26100.7309.dll - rasman-10.0.26100.7705.dll| | :---: | :---: | |diff_type|code,length,sig,address| |ratio|0.4| |i_ratio|0.37| |m_ratio|0.9| |b_ratio|0.9| |match_types|SymbolsHash| ### Function Meta Diff |Key|rasman-10.0.26100.7309.dll|rasman-10.0.26100.7705.dll| | :---: | :---: | :---: | |name|wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath|wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath| |fullname|wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath|wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath| |refcount|1|1| |`length`|91|76| |called||| |calling|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |paramcount|3|2| |`address`|18002504c|180024ff4| |`sig`|undefined __fastcall wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath(uint param_1, int param_2, undefined8 * param_3)|undefined __fastcall wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath(uint param_1, int param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath Diff ```diff --- wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath +++ wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath @@ -1,52 +1,41 @@ -void wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath - (uint param_1,int param_2,undefined8 *param_3) +void wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath(uint param_1,int param_2) { - uint *puVar1; + uint uVar1; uint uVar2; uint uVar3; - uint uVar4; - bool bVar5; + bool bVar4; - puVar1 = (uint *)*param_3; if (param_2 == 3) { - uVar4 = 0x10; + uVar3 = 0x10; } else { if (param_2 != 4) { return; } - uVar4 = 0x20; + uVar3 = 0x20; } - if ((*(char *)((longlong)param_3 + 0x1e) == '\0') && (*(char *)((longlong)param_3 + 0x1d) == '\0') - ) { - if ((*puVar1 & 2) != 0) { - uVar3 = *puVar1; - while ((uVar3 & 1) == (param_1 & 1)) { - LOCK(); - uVar2 = *puVar1; - bVar5 = uVar3 == uVar2; - if (bVar5) { - *puVar1 = uVar4 | uVar3; - uVar2 = uVar3; - } - UNLOCK(); - if (bVar5) { - return; - } - uVar3 = uVar2; - if ((uVar2 & 2) == 0) { - return; - } + if ((Feature_VPN_BugFixes_25B_Use_After_Free_Fix__private_featureState & 2) != 0) { + uVar2 = Feature_VPN_BugFixes_25B_Use_After_Free_Fix__private_featureState; + while ((uVar2 & 1) == (param_1 & 1)) { + LOCK(); + bVar4 = uVar2 == Feature_VPN_BugFixes_25B_Use_After_Free_Fix__private_featureState; + uVar1 = uVar3 | uVar2; + if (!bVar4) { + uVar2 = Feature_VPN_BugFixes_25B_Use_After_Free_Fix__private_featureState; + uVar1 = Feature_VPN_BugFixes_25B_Use_After_Free_Fix__private_featureState; + } + Feature_VPN_BugFixes_25B_Use_After_Free_Fix__private_featureState = uVar1; + UNLOCK(); + if (bVar4) { + return; + } + if ((uVar2 & 2) == 0) { + return; } } - } - else { - LOCK(); - *puVar1 = *puVar1 | uVar4; - UNLOCK(); } return; } ``` # Modified (No Code Changes) *Slightly modified functions have no code changes, rather differnces in:* - refcount - length - called - calling - name - fullname _{Generated with `ghidriff` version: 1.0.0 on 2026-07-28T19:47:10}