# refs-2026-06.sys-refs-2026-07.sys Diff # TOC * [Visual Chart Diff](#visual-chart-diff) * [Metadata](#metadata) * [Ghidra Diff Engine](#ghidra-diff-engine) * [Command Line](#command-line) * [Binary Metadata Diff](#binary-metadata-diff) * [Program Options](#program-options) * [Diff Stats](#diff-stats) * [Strings](#strings) * [Deleted](#deleted) * [FUN_1c005e485](#fun_1c005e485) * [FUN_1c018b894](#fun_1c018b894) * [Added](#added) * [ValidateOTEntryBoundaries](#validateotentryboundaries) * [Modified](#modified) * [RefsQueryNameInfo](#refsquerynameinfo) * [InitializeRemovableDevice](#initializeremovabledevice) * [RtlULongMult](#rtlulongmult) * [CmsVolume::ReadLatestCheckpoint](#cmsvolumereadlatestcheckpoint) * [CmsVolume::ValidateCheckpointRecord](#cmsvolumevalidatecheckpointrecord) * [CmsBPlusTable::CheckPage](#cmsbplustablecheckpage) * [CmsStream::GhostExtents](#cmsstreamghostextents) * [LogValidateEntryHeader](#logvalidateentryheader) * [RefsSetEndOfFileInfo](#refssetendoffileinfo) * [RefsFinishBuffers](#refsfinishbuffers) * [LogCoreScanDataRecord](#logcorescandatarecord) * [RefsSetAllocationInfo](#refssetallocationinfo) * [RefsSetPositionInfo](#refssetpositioninfo) * [CmsBPlusTable::MmsCheckIndexEntry](#cmsbplustablemmscheckindexentry) * [CmsBPlusTable::EnumerateWithCursor](#cmsbplustableenumeratewithcursor) * [CmsVolume::ReadAndRepairSelfChecksumBlock](#cmsvolumereadandrepairselfchecksumblock) * [LogReadControlRecord](#logreadcontrolrecord) * [FUN_1c0095f33](#fun_1c0095f33) * [Modified (No Code Changes)](#modified-no-code-changes) * [RefsFspClose](#refsfspclose) * [NTOSKRNL.EXE::ExFreePoolWithTag](#ntoskrnlexeexfreepoolwithtag) * [GetLengthPhys](#getlengthphys) * [memset](#memset) * [RtlULongAdd](#rtlulongadd) * [WPP_SF_D](#wpp_sf_d) * [wil_details_IsEnabledFallback](#wil_details_isenabledfallback) * [NTOSKRNL.EXE::ExAllocatePoolWithTag](#ntoskrnlexeexallocatepoolwithtag) # Visual Chart Diff ```mermaid flowchart LR RefsQueryNameInfo-7-old<--Match 81%-->RefsQueryNameInfo-7-new InitializeRemovableDevice-3-old<--Match 30%-->InitializeRemovableDevice-3-new RtlULongMult-3-old<--Match 87%-->RtlULongMult-3-new CmsVolumeReadLatestCheckpoint-2-old<--Match 30%-->CmsVolumeReadLatestCheckpoint-2-new CmsVolumeValidateCheckpointRecord-7-old<--Match 61%-->CmsVolumeValidateCheckpointRecord-7-new CmsBPlusTableCheckPage-3-old<--Match 73%-->CmsBPlusTableCheckPage-3-new CmsStreamGhostExtents-7-old<--Match 96%-->CmsStreamGhostExtents-7-new LogValidateEntryHeader-0-old<--Match 73%-->LogValidateEntryHeader-0-new RefsSetEndOfFileInfo-7-old<--Match 82%-->RefsSetEndOfFileInfo-7-new RefsFinishBuffers-4-old<--Match 57%-->RefsFinishBuffers-4-new LogCoreScanDataRecord-0-old<--Match 56%-->LogCoreScanDataRecord-0-new RefsSetAllocationInfo-5-old<--Match 76%-->RefsSetAllocationInfo-5-new RefsSetPositionInfo-2-old<--Match 85%-->RefsSetPositionInfo-2-new CmsBPlusTableMmsCheckIndexEntry-4-old<--Match 18%-->CmsBPlusTableMmsCheckIndexEntry-4-new CmsBPlusTableEnumerateWithCursor-4-old<--Match 67%-->CmsBPlusTableEnumerateWithCursor-4-new CmsVolumeReadAndRepairSelfChecksumBlock-15-old<--Match 17%-->CmsVolumeReadAndRepairSelfChecksumBlock-15-new LogReadControlRecord-0-old<--Match 46%-->LogReadControlRecord-0-new FUN_1c0095f33-0-old<--Match 20%-->LogValidateEntryMetadata-0-new subgraph refs-2026-07.sys RefsQueryNameInfo-7-new InitializeRemovableDevice-3-new RtlULongMult-3-new CmsVolumeReadLatestCheckpoint-2-new CmsVolumeValidateCheckpointRecord-7-new CmsBPlusTableCheckPage-3-new CmsStreamGhostExtents-7-new LogValidateEntryHeader-0-new RefsSetEndOfFileInfo-7-new RefsFinishBuffers-4-new LogCoreScanDataRecord-0-new RefsSetAllocationInfo-5-new RefsSetPositionInfo-2-new CmsBPlusTableMmsCheckIndexEntry-4-new CmsBPlusTableEnumerateWithCursor-4-new CmsVolumeReadAndRepairSelfChecksumBlock-15-new LogReadControlRecord-0-new LogValidateEntryMetadata-0-new subgraph Added direction LR ValidateOTEntryBoundaries end end subgraph refs-2026-06.sys RefsQueryNameInfo-7-old InitializeRemovableDevice-3-old RtlULongMult-3-old CmsVolumeReadLatestCheckpoint-2-old CmsVolumeValidateCheckpointRecord-7-old CmsBPlusTableCheckPage-3-old CmsStreamGhostExtents-7-old LogValidateEntryHeader-0-old RefsSetEndOfFileInfo-7-old RefsFinishBuffers-4-old LogCoreScanDataRecord-0-old RefsSetAllocationInfo-5-old RefsSetPositionInfo-2-old CmsBPlusTableMmsCheckIndexEntry-4-old CmsBPlusTableEnumerateWithCursor-4-old CmsVolumeReadAndRepairSelfChecksumBlock-15-old LogReadControlRecord-0-old FUN_1c0095f33-0-old subgraph Deleted direction LR FUN_1c005e485 FUN_1c018b894 end end ``` ```mermaid pie showData title Function Matches - 99.9701% "unmatched_funcs_len" : 3 "matched_funcs_len" : 10025 ``` ```mermaid pie showData title Matched Function Similarity - 99.6110% "matched_funcs_with_code_changes_len" : 18 "matched_funcs_with_non_code_changes_len" : 21 "matched_funcs_no_changes_len" : 9986 ``` # Metadata ## Ghidra Diff Engine ### Command Line #### Captured Command Line ``` ghidriff --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --max-ram-percent 60.0 --max-section-funcs 200 refs-2026-06.sys refs-2026-07.sys ``` #### Verbose Args
``` --old ['refs-2026-06.sys'] --new [['refs-2026-07.sys']] --engine VersionTrackingDiff --output-path out --summary False --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim False --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title None ```
#### Download Original PEs ``` wget https://msdl.microsoft.com/download/symbols/refs.sys/05A5F811250000/refs.sys -O refs.sys.x64.10.0.20348.4893 wget https://msdl.microsoft.com/download/symbols/refs.sys/4B4F5C2B251000/refs.sys -O refs.sys.x64.10.0.20348.5386 ``` ## Binary Metadata Diff ```diff --- refs-2026-06.sys Meta +++ refs-2026-07.sys Meta @@ -1,44 +1,44 @@ -Program Name: refs-2026-06.sys +Program Name: refs-2026-07.sys Language ID: x86:LE:64:default (4.7) Compiler ID: windows Processor: x86 Endian: Little Address Size: 64 Minimum Address: 1c0000000 Maximum Address: ff0000184f -# of Bytes: 2430888 +# of Bytes: 2435112 # of Memory Blocks: 13 -# of Instructions: 413002 -# of Defined Data: 23263 -# of Functions: 5006 -# of Symbols: 50321 +# of Instructions: 413448 +# of Defined Data: 23313 +# of Functions: 5022 +# of Symbols: 50388 # of Data Types: 1141 # of Data Type Categories: 39 Analyzed: true Compiler: visualstudio:unknown Created With Ghidra Version: 12.1.2 -Date Created: Fri Aug 28 15:51:37 SGT 2026 +Date Created: Fri Aug 28 15:51:43 SGT 2026 Executable Format: Portable Executable (PE) -Executable Location: /C:/Users/Jacob/Downloads/pdbs/refs-2026-06.sys -Executable MD5: 96ecff2af7318b4f6538f8accda355e9 -Executable SHA256: a69d3df36a5917b354c7ef791745e2c729866365db6ff5f3020e790e1fe1ea7a -FSRL: file:///C:/Users/Jacob/Downloads/pdbs/refs-2026-06.sys?MD5=96ecff2af7318b4f6538f8accda355e9 +Executable Location: /C:/Users/Jacob/Downloads/pdbs/refs-2026-07.sys +Executable MD5: 55c3defb67cd8488dd72bd53b43b29e1 +Executable SHA256: d7d7569d7b0fe668ff31221f5b1bcd7801b84b0fec60f4392d2e1368e6fcf0a8 +FSRL: file:///C:/Users/Jacob/Downloads/pdbs/refs-2026-07.sys?MD5=55c3defb67cd8488dd72bd53b43b29e1 PDB Age: 1 PDB File: refs.pdb -PDB GUID: 996b1e16-7c7d-0c3e-7d3e-6ee9ffcbe9b2 +PDB GUID: 1f8ba397-75d2-75e9-69e9-ae453ac31caf PDB Loaded: true PDB Version: RSDS PE Property[CompanyName]: Microsoft Corporation PE Property[FileDescription]: NT ReFS FS Driver -PE Property[FileVersion]: 10.0.20348.4893 (WinBuild.160101.0800) +PE Property[FileVersion]: 10.0.20348.5386 (WinBuild.160101.0800) PE Property[InternalName]: refs.sys PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved. PE Property[OriginalFilename]: refs.sys PE Property[ProductName]: Microsoft® Windows® Operating System -PE Property[ProductVersion]: 10.0.20348.4893 +PE Property[ProductVersion]: 10.0.20348.5386 PE Property[Translation]: 4b00409 Preferred Root Namespace Category: RTTI Found: false Relocatable: true SectionAlignment: 4096 Should Ask To Analyze: false ``` ## Program Options
Ghidra refs-2026-06.sys Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra refs-2026-06.sys Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra refs-2026-06.sys Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|false| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.msdApplyOptions|{ interpretation: FUNCTION_IF_EXISTS, applyCallingConvention: true, applySignature: true, demangleOnlyKnownPatterns: true, doDisassembly: true }| |Demangler Microsoft.msdOutputOptions|ghidra.app.util.demangler.microsoft.options.MsdOutputOption@9e5b| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
Ghidra refs-2026-07.sys Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra refs-2026-07.sys Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra refs-2026-07.sys Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|false| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.msdApplyOptions|{ interpretation: FUNCTION_IF_EXISTS, applyCallingConvention: true, applySignature: true, demangleOnlyKnownPatterns: true, doDisassembly: true }| |Demangler Microsoft.msdOutputOptions|ghidra.app.util.demangler.microsoft.options.MsdOutputOption@9e5b| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
## Diff Stats |Stat|Value| | :---: | :---: | |added_funcs_len|1| |deleted_funcs_len|2| |modified_funcs_len|39| |added_symbols_len|33| |deleted_symbols_len|9| |diff_time|24.05238151550293| |deleted_strings_len|0| |added_strings_len|0| |match_types|Counter({'SymbolsHash': 4779, 'ExternalsName': 443, 'ExactInstructionsFunctionHasher': 187, 'BulkBasicBlockMnemonicHash': 18, 'SigCallingCalledHasher': 6, 'StructuralGraphHash': 6, 'ExactBytesFunctionHasher': 5, 'BulkInstructionHash': 4, 'StrUniqueFuncRefsHasher': 2, 'StringsRefsHasher': 1})| |items_to_process|84| |diff_types|Counter({'address': 32, 'called': 26, 'refcount': 25, 'length': 22, 'calling': 19, 'code': 18, 'name': 10, 'fullname': 10, 'sig': 10})| |unmatched_funcs_len|3| |total_funcs_len|10028| |matched_funcs_len|10025| |matched_funcs_with_code_changes_len|18| |matched_funcs_with_non_code_changes_len|21| |matched_funcs_no_changes_len|9986| |match_func_similarity_percent|99.6110%| |func_match_overall_percent|99.9701%| |first_matches|Counter({'SymbolsHash': 4779, 'ExactInstructionsFunctionHasher': 187, 'BulkBasicBlockMnemonicHash': 18, 'SigCallingCalledHasher': 6, 'StructuralGraphHash': 6, 'ExactBytesFunctionHasher': 5, 'BulkInstructionHash': 4, 'StrUniqueFuncRefsHasher': 2, 'StringsRefsHasher': 1})| ```mermaid pie showData title All Matches "SymbolsHash" : 4779 "ExternalsName" : 443 "ExactBytesFunctionHasher" : 5 "ExactInstructionsFunctionHasher" : 187 "BulkInstructionHash" : 4 "SigCallingCalledHasher" : 6 "StringsRefsHasher" : 1 "StrUniqueFuncRefsHasher" : 2 "StructuralGraphHash" : 6 "BulkBasicBlockMnemonicHash" : 18 ``` ```mermaid pie showData title First Matches "SymbolsHash" : 4779 "ExactBytesFunctionHasher" : 5 "ExactInstructionsFunctionHasher" : 187 "BulkInstructionHash" : 4 "SigCallingCalledHasher" : 6 "StringsRefsHasher" : 1 "StrUniqueFuncRefsHasher" : 2 "StructuralGraphHash" : 6 "BulkBasicBlockMnemonicHash" : 18 ``` ```mermaid pie showData title Diff Stats "added_funcs_len" : 1 "deleted_funcs_len" : 2 "modified_funcs_len" : 39 ``` ```mermaid pie showData title Symbols "added_symbols_len" : 33 "deleted_symbols_len" : 9 ``` ## Strings *No string differences found* # Deleted ## FUN_1c005e485 ### Function Meta |Key|refs-2026-06.sys| | :---: | :---: | |name|FUN_1c005e485| |fullname|FUN_1c005e485| |refcount|3| |length|33| |called|memset| |calling|CmsVolume::ReadAndRepairSelfChecksumBlock
FUN_1c0095f33| |paramcount|0| |address|1c005e485| |sig|undefined FUN_1c005e485(void)| |sym_type|Function| |sym_source|DEFAULT| |external|False| ```diff --- FUN_1c005e485 +++ FUN_1c005e485 @@ -1,22 +0,0 @@ - -/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ - -undefined4 FUN_1c005e485(void) - -{ - undefined4 unaff_EBX; - longlong unaff_RBP; - char unaff_SIL; - longlong unaff_R13; - ulonglong in_stack_00000040; - - memset(*(void **)(unaff_RBP + -0x60),-0x21524111,in_stack_00000040 >> 0x20); - if (unaff_SIL != '\0') { - MspCleanupTopologyIds((_SmsTopologyIds *)(unaff_RBP + -0x58)); - } - if (unaff_R13 != 0) { - ExFreePoolWithTag(); - } - return unaff_EBX; -} - ``` ## FUN_1c018b894 ### Function Meta |Key|refs-2026-06.sys| | :---: | :---: | |name|FUN_1c018b894| |fullname|FUN_1c018b894| |refcount|3| |length|74| |called|RefsDeviceIoControl| |calling|| |paramcount|0| |address|1c018b894| |sig|undefined FUN_1c018b894(void)| |sym_type|Function| |sym_source|DEFAULT| |external|False| ```diff --- FUN_1c018b894 +++ FUN_1c018b894 @@ -1,20 +0,0 @@ - -void FUN_1c018b894(void) - -{ - longlong unaff_RBX; - void *unaff_RBP; - _DEVICE_OBJECT *unaff_RSI; - _IRP_CONTEXT *unaff_RDI; - undefined1 uStack0000000000000070; - - *(uint *)(unaff_RBX + 4) = *(uint *)(unaff_RBX + 4) | 0x4000000; - if ((*(uint *)(unaff_RBX + 4) & 0x4010000) == 0x4010000) { - uStack0000000000000070 = SUB81(unaff_RBP,0); - RefsDeviceIoControl(unaff_RDI,unaff_RSI,0x74804,'\0',&stack0x00000070,1,unaff_RBP, - (ulong)unaff_RBP,unaff_RBP); - *(uint *)(unaff_RBX + 4) = *(uint *)(unaff_RBX + 4) & 0xfffeffff; - } - return; -} - ``` # Added ## ValidateOTEntryBoundaries ### Function Meta |Key|refs-2026-07.sys| | :---: | :---: | |name|ValidateOTEntryBoundaries| |fullname|ValidateOTEntryBoundaries| |refcount|2| |length|494| |called|NTOSKRNL.EXE::ExAllocatePoolWithTag
NTOSKRNL.EXE::ExFreePoolWithTag
_SmsIndexEntry::GetLengthPhys
memset| |calling|CmsBPlusTable::CheckPage| |paramcount|0| |address|1c007b668| |sig|undefined ValidateOTEntryBoundaries(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- ValidateOTEntryBoundaries +++ ValidateOTEntryBoundaries @@ -0,0 +1,99 @@ + +uint ValidateOTEntryBoundaries(uint *param_1,uint param_2) + +{ + uint *_Dst; + uint uVar1; + ulong uVar2; + uint *puVar3; + ulonglong uVar4; + ulonglong uVar5; + ulonglong uVar6; + _SmsIndexEntry *this; + uint *puVar7; + uint uVar8; + uint uVar9; + uint uVar10; + ulonglong uVar11; + + uVar9 = *param_1; + if (((((uVar9 < 0x28) || (uVar8 = param_1[1], uVar8 < uVar9)) || + (uVar10 = param_1[4], uVar10 < uVar8)) || + ((uVar1 = param_1[8], uVar1 < uVar10 || (param_2 < uVar1)))) || + ((ulonglong)(uVar1 - uVar10) < (ulonglong)param_1[5] << 2)) { +LAB_1c007b838: + uVar9 = 0xc0000470; + } + else { + if (uVar8 - uVar9 != 0) { + uVar9 = uVar8 - uVar9 >> 4; + if (uVar9 != 0) { + if (uVar9 * 4 <= uVar9 * 5) { + puVar3 = (uint *)ExAllocatePoolWithTag(1,uVar9 * 5,0x6f76534d); + if (puVar3 == (uint *)0x0) { + return 0xc000009a; + } + _Dst = puVar3 + uVar9; + memset(_Dst,0,(ulonglong)uVar9); + uVar8 = *param_1; + uVar11 = 0; + uVar4 = (ulonglong)param_1[1]; + while( true ) { + if ((uint)uVar4 <= uVar8) break; + uVar10 = (uint)uVar4 - uVar8; + if (uVar10 < 0x10) goto LAB_1c007b813; + this = (_SmsIndexEntry *)((ulonglong)uVar8 + (longlong)param_1); + uVar2 = _SmsIndexEntry::GetLengthPhys(this); + if ((uVar2 < 0x10) || (uVar10 < uVar2)) goto LAB_1c007b813; + if (((byte)this[8] & 4) == 0) { + if (uVar9 <= (uint)uVar11) goto LAB_1c007b813; + uVar4 = uVar11 & 0xffffffff; + uVar11 = (ulonglong)((uint)uVar11 + 1); + puVar3[uVar4] = uVar8; + uVar4 = (ulonglong)param_1[1]; + } + uVar8 = uVar8 + uVar2; + } + uVar9 = param_1[4]; + uVar4 = 0; + uVar8 = 0; + if (param_1[5] != 0) { + uVar11 = uVar11 & 0xffffffff; + do { + uVar8 = (uint)*(ushort *)((longlong)param_1 + uVar4 * 4 + (ulonglong)uVar9); + puVar7 = puVar3; + uVar6 = uVar11; + if (uVar11 != 0) { + do { + uVar5 = (longlong)uVar6 / 2; + if (puVar7[uVar5] < uVar8) { + puVar7 = puVar7 + uVar5 + 1; + uVar5 = uVar6 + (-1 - uVar5); + } + uVar6 = uVar5; + } while (0 < (longlong)uVar5); + } + if (((puVar7 == puVar3 + uVar11) || (*puVar7 != uVar8)) || + (uVar6 = (longlong)puVar7 - (longlong)puVar3 >> 2 & 0xffffffff, + *(char *)(uVar6 + (longlong)_Dst) != '\0')) goto LAB_1c007b813; + uVar10 = (int)uVar4 + 1; + uVar4 = (ulonglong)uVar10; + *(undefined1 *)(uVar6 + (longlong)_Dst) = 1; + uVar8 = 0; + } while (uVar10 < param_1[5]); + } + goto LAB_1c007b818; + } + goto LAB_1c007b838; + } + } + uVar9 = -(uint)(param_1[5] != 0) & 0xc0000470; + } + return uVar9; +LAB_1c007b813: + uVar8 = 0xc0000470; +LAB_1c007b818: + ExFreePoolWithTag(puVar3,0); + return uVar8; +} + ``` # Modified *Modified functions contain code changes* ## RefsQueryNameInfo ### Match Info |Key|refs-2026-06.sys - refs-2026-07.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.9| |i_ratio|0.56| |m_ratio|0.81| |b_ratio|0.81| |match_types|SymbolsHash| ### Function Meta Diff |Key|refs-2026-06.sys|refs-2026-07.sys| | :---: | :---: | :---: | |name|RefsQueryNameInfo|RefsQueryNameInfo| |fullname|RefsQueryNameInfo|RefsQueryNameInfo| |refcount|4|4| |`length`|624|981| |`called`|NTOSKRNL.EXE::ExFreePoolWithTag
RefsBuildNormalizedNameWithSystemSpecialCases
RefsStatusDebug
WPP_SF_D
memmove|NTOSKRNL.EXE::ExFreePoolWithTag
RefsBuildNormalizedNameWithSystemSpecialCases
RefsHasSystemName
RefsRaiseStatusInternal
RefsStatusDebug
RefsUpdateFcbInfoFromDisk
WPP_SF_D
memmove| |calling|RefsCommonQueryInformation|RefsCommonQueryInformation| |paramcount|7|7| |`address`|1c01a4498|1c01a2db4| |sig|long __cdecl RefsQueryNameInfo(_IRP_CONTEXT * param_1, _FILE_OBJECT * param_2, _SCB * param_3, uchar param_4, _FILE_NAME_INFORMATION * param_5, ulong * param_6, _CCB * param_7)|long __cdecl RefsQueryNameInfo(_IRP_CONTEXT * param_1, _FILE_OBJECT * param_2, _SCB * param_3, uchar param_4, _FILE_NAME_INFORMATION * param_5, ulong * param_6, _CCB * param_7)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### RefsQueryNameInfo Called Diff ```diff --- RefsQueryNameInfo called +++ RefsQueryNameInfo called @@ -2,0 +3,2 @@ +RefsHasSystemName +RefsRaiseStatusInternal @@ -3,0 +6 @@ +RefsUpdateFcbInfoFromDisk ``` ### RefsQueryNameInfo Diff ```diff --- RefsQueryNameInfo +++ RefsQueryNameInfo @@ -1,149 +1,149 @@ /* long __cdecl RefsQueryNameInfo(struct _IRP_CONTEXT * __ptr64,struct _FILE_OBJECT * __ptr64,struct _SCB * __ptr64,unsigned char,struct _FILE_NAME_INFORMATION * __ptr64,unsigned long * __ptr64,struct _CCB * __ptr64) */ long __cdecl RefsQueryNameInfo(_IRP_CONTEXT *param_1,_FILE_OBJECT *param_2,_SCB *param_3,uchar param_4, _FILE_NAME_INFORMATION *param_5,ulong *param_6,_CCB *param_7) { ushort uVar1; ushort uVar2; uchar uVar3; uint uVar4; long lVar5; uint uVar6; _CCB *p_Var7; ulong uVar8; _UNICODE_STRING *p_Var9; _SCB *p_Var10; long lVar11; uchar local_res20 [8]; uchar in_stack_ffffffffffffffa8; _SCB *local_48; undefined8 local_40; undefined8 local_38; lVar11 = 0; local_40 = 0; local_48 = (_SCB *)0x0; local_res20[0] = '\0'; local_38 = 0; *(undefined4 *)param_5 = 0; *(undefined2 *)(param_5 + 4) = 0; *param_6 = *param_6 - 4; p_Var7 = (_CCB *)0x0; if (((param_4 == '\0') && (p_Var7 = (_CCB *)0x0, param_7 != (_CCB *)0x0)) && ((*(uint *)(param_7 + 4) & 8) == 0)) { p_Var7 = param_7 + 0x10; } if (p_Var7 == (_CCB *)0x0) { p_Var10 = param_3; if (param_7 != (_CCB *)0x0) { if ((char)*(uint *)(param_7 + 4) < '\0') { if ((((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)((longlong)WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && (3 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x29))) { - param_3 = (_SCB *)&WPP_2a612cb084f737cc666b65cc6d907d4c_Traceguids; - WPP_SF_D(WPP_GLOBAL_Control[3],0x2a,&WPP_2a612cb084f737cc666b65cc6d907d4c_Traceguids, + param_3 = (_SCB *)&WPP_3645efd58e5132b0a6aeb06ec081cf60_Traceguids; + WPP_SF_D(WPP_GLOBAL_Control[3],0x2a,&WPP_3645efd58e5132b0a6aeb06ec081cf60_Traceguids, 0xc0000022); } uVar8 = (ulong)param_3; if (RefsStatusDebugEnabled != '\0') { - uVar8 = 0xb0a; - RefsStatusDebug(-0x3fffffde,"FileInfo.c",0xb0a); + uVar8 = 0xb08; + RefsStatusDebug(-0x3fffffde,"FileInfo.c",0xb08); } /* WARNING: Subroutine does not return */ RefsRaiseStatusInternal(param_1,-0x3fffffde,uVar8); } if (((param_7 != (_CCB *)0x0) && ((*(uint *)(param_7 + 4) & 8) == 0)) && (((*(longlong *)(param_7 + 0x48) == 0 || ((*(uint *)(*(longlong *)(param_7 + 0x48) + 4) & 2) != 0)) && (uVar3 = RefsHasSystemName((_REFS_FILE_REFERENCE *)(*(longlong *)(param_3 + 0x78) + 8)), uVar3 == '\0')))) { if ((((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)((longlong)WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && (3 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x29))) { - p_Var10 = (_SCB *)&WPP_2a612cb084f737cc666b65cc6d907d4c_Traceguids; - WPP_SF_D(WPP_GLOBAL_Control[3],0x2b,&WPP_2a612cb084f737cc666b65cc6d907d4c_Traceguids, + p_Var10 = (_SCB *)&WPP_3645efd58e5132b0a6aeb06ec081cf60_Traceguids; + WPP_SF_D(WPP_GLOBAL_Control[3],0x2b,&WPP_3645efd58e5132b0a6aeb06ec081cf60_Traceguids, 0xc000000d); } uVar8 = (ulong)p_Var10; if (RefsStatusDebugEnabled != '\0') { - uVar8 = 0xb1d; - RefsStatusDebug(-0x3ffffff3,"FileInfo.c",0xb1d); + uVar8 = 0xb1b; + RefsStatusDebug(-0x3ffffff3,"FileInfo.c",0xb1b); } /* WARNING: Subroutine does not return */ RefsRaiseStatusInternal(param_1,-0x3ffffff3,uVar8); } } if ((*(uint *)(*(_FCB **)(p_Var10 + 0x78) + 4) & 8) == 0) { RefsUpdateFcbInfoFromDisk(param_1,*(_FCB **)(p_Var10 + 0x78),(_OLD_SCB_SNAPSHOT *)0x0); } p_Var9 = (_UNICODE_STRING *)&local_40; lVar5 = RefsBuildNormalizedNameWithSystemSpecialCases (param_1,param_3,p_Var9,local_res20,in_stack_ffffffffffffffa8); uVar8 = (ulong)p_Var9; if (lVar5 < 0) { if ((((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)((longlong)WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && (3 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x29))) { - uVar8 = 0xc0120628; - WPP_SF_D(WPP_GLOBAL_Control[3],0x2c,&WPP_2a612cb084f737cc666b65cc6d907d4c_Traceguids,lVar5); + uVar8 = 0xc0121628; + WPP_SF_D(WPP_GLOBAL_Control[3],0x2c,&WPP_3645efd58e5132b0a6aeb06ec081cf60_Traceguids,lVar5); } if (RefsStatusDebugEnabled != '\0') { - uVar8 = 0xb33; - RefsStatusDebug(lVar5,"FileInfo.c",0xb33); + uVar8 = 0xb31; + RefsStatusDebug(lVar5,"FileInfo.c",0xb31); } /* WARNING: Subroutine does not return */ RefsRaiseStatusInternal(param_1,lVar5,uVar8); } p_Var7 = (_CCB *)&local_40; } uVar1 = *(ushort *)p_Var7; uVar6 = (uint)uVar1; *(uint *)param_5 = uVar6; uVar2 = *(ushort *)(param_3 + 0xd0); if ((uVar2 != 0) && ((*(int *)(param_3 + 200) == 0x80 || (*(int *)(param_3 + 200) == 0xb0)))) { uVar6 = uVar2 + 2 + (uint)uVar1; *(uint *)param_5 = uVar6; local_48 = param_3 + 0xd0; } uVar4 = *param_6; if (uVar4 < uVar6) { if ((((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)((longlong)WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && (3 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x29))) { - WPP_SF_D(WPP_GLOBAL_Control[3],0x2d,&WPP_2a612cb084f737cc666b65cc6d907d4c_Traceguids, + WPP_SF_D(WPP_GLOBAL_Control[3],0x2d,&WPP_3645efd58e5132b0a6aeb06ec081cf60_Traceguids, 0x80000005); } lVar11 = -0x7ffffffb; if (RefsStatusDebugEnabled != '\0') { - RefsStatusDebug(-0x7ffffffb,"FileInfo.c",0xb5a); + RefsStatusDebug(-0x7ffffffb,"FileInfo.c",0xb58); } uVar4 = *param_6; uVar6 = uVar4 & 0xfffffffe; } *param_6 = uVar4 - uVar6; uVar4 = (uint)*(ushort *)p_Var7; if (uVar6 < *(ushort *)p_Var7) { uVar4 = uVar6; } if (uVar4 != 0) { memmove(param_5 + 4,*(void **)(p_Var7 + 8),(ulonglong)uVar4); } if (uVar6 - uVar4 != 0) { uVar1 = *(ushort *)p_Var7; *(undefined2 *)(param_5 + (ulonglong)uVar1 + 4) = 0x3a; uVar6 = (uVar6 - uVar4) - 2; if (uVar6 != 0) { memmove(param_5 + (ulonglong)uVar1 + 6,*(void **)(local_48 + 8),(ulonglong)uVar6); } } if ((local_res20[0] != '\0') && (*(longlong *)(p_Var7 + 8) != 0)) { ExFreePoolWithTag(*(longlong *)(p_Var7 + 8),0); } return lVar11; } ``` ## InitializeRemovableDevice ### Match Info |Key|refs-2026-06.sys - refs-2026-07.sys| | :---: | :---: | |diff_type|code,refcount,length,address,called| |ratio|0.69| |i_ratio|0.34| |m_ratio|0.73| |b_ratio|0.3| |match_types|SymbolsHash| ### Function Meta Diff |Key|refs-2026-06.sys|refs-2026-07.sys| | :---: | :---: | :---: | |name|InitializeRemovableDevice|InitializeRemovableDevice| |fullname|InitializeRemovableDevice|InitializeRemovableDevice| |`refcount`|3|2| |`length`|227|393| |`called`|RefsDeviceIoControl|Feature_Servicing_ReFSMountHotplugTelemetry__private_IsEnabledDeviceUsage
RefsDeviceIoControl| |calling|InitializeDevice|InitializeDevice| |paramcount|3|3| |`address`|1c018b7b0|1c018c7d0| |sig|void __cdecl InitializeRemovableDevice(_IRP_CONTEXT * param_1, _VCB * param_2, _DEVICE_OBJECT * param_3)|void __cdecl InitializeRemovableDevice(_IRP_CONTEXT * param_1, _VCB * param_2, _DEVICE_OBJECT * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|ANALYSIS| |external|False|False| ### InitializeRemovableDevice Called Diff ```diff --- InitializeRemovableDevice called +++ InitializeRemovableDevice called @@ -0,0 +1 @@ +Feature_Servicing_ReFSMountHotplugTelemetry__private_IsEnabledDeviceUsage ``` ### InitializeRemovableDevice Diff ```diff --- InitializeRemovableDevice +++ InitializeRemovableDevice @@ -1,43 +1,53 @@ /* void __cdecl InitializeRemovableDevice(struct _IRP_CONTEXT * __ptr64,struct _VCB * __ptr64,struct _DEVICE_OBJECT * __ptr64) */ void __cdecl InitializeRemovableDevice(_IRP_CONTEXT *param_1,_VCB *param_2,_DEVICE_OBJECT *param_3) { uint *puVar1; long lVar2; + int iVar3; undefined1 local_res8 [8]; undefined8 local_res10; + local_res10 = 0; local_res8[0] = 1; - local_res10 = 0; lVar2 = RefsDeviceIoControl(param_1,param_3,0x74804,'\0',local_res8,1,(void *)0x0,0, (__uint64 *)0x0); if (-1 < lVar2) { *(uint *)(param_2 + 4) = *(uint *)(param_2 + 4) | 0x10000; } puVar1 = (uint *)(*(longlong *)(*(longlong *)(*(longlong *)(param_1 + 0x40) + 0xd0) + 0x10) + 0x30 ); *puVar1 = *puVar1 & 0xfffffffd; lVar2 = RefsDeviceIoControl(param_1,param_3,0x2d0c14,'\0',(void *)0x0,0,&local_res10,8, (__uint64 *)0x0); - if ((-1 < lVar2) && (local_res10._7_1_ == '\0')) { - if ((local_res10._5_1_ == '\0') && (local_res10._6_1_ == '\0')) { - if ((local_res10._4_1_ != '\0') && ((*(uint *)(param_2 + 4) & 0x10000) == 0)) { - FUN_1c018b894(); - return; - } + if (lVar2 < 0) { + iVar3 = Feature_Servicing_ReFSMountHotplugTelemetry__private_IsEnabledDeviceUsage(); + if (iVar3 != 0) { + param_2[0xcd2] = (_VCB)((byte)param_2[0xcd2] | 4); } - else { + } + else { + iVar3 = Feature_Servicing_ReFSMountHotplugTelemetry__private_IsEnabledDeviceUsage(); + if (iVar3 != 0) { + param_2[0xcd2] = + (_VCB)(((((local_res10._7_1_ & 1) * '\x02' | local_res10._6_1_ & 1) * '\x02' | + local_res10._5_1_ & 1) * '\x02' | local_res10._4_1_ & 1) << 3 | + (byte)param_2[0xcd2] & 0x87); + } + if ((local_res10._7_1_ == 0) && + (((local_res10._5_1_ != 0 || (local_res10._6_1_ != 0)) || + ((local_res10._4_1_ != 0 && ((*(uint *)(param_2 + 4) & 0x10000) == 0)))))) { *(uint *)(param_2 + 4) = *(uint *)(param_2 + 4) | 0x4000000; } } if ((*(uint *)(param_2 + 4) & 0x4010000) == 0x4010000) { local_res8[0] = 0; RefsDeviceIoControl(param_1,param_3,0x74804,'\0',local_res8,1,(void *)0x0,0,(__uint64 *)0x0); *(uint *)(param_2 + 4) = *(uint *)(param_2 + 4) & 0xfffeffff; } return; } ``` ## RtlULongMult ### Match Info |Key|refs-2026-06.sys - refs-2026-07.sys| | :---: | :---: | |diff_type|code,length,address| |ratio|0.38| |i_ratio|0.35| |m_ratio|0.96| |b_ratio|0.87| |match_types|SymbolsHash| ### Function Meta Diff |Key|refs-2026-06.sys|refs-2026-07.sys| | :---: | :---: | :---: | |name|RtlULongMult|RtlULongMult| |fullname|RtlULongMult|RtlULongMult| |refcount|2|2| |`length`|33|37| |called||| |calling|RefsDeallocateRanges|RefsDeallocateRanges| |paramcount|3|3| |`address`|1c00a6d40|1c00a73e0| |sig|long __cdecl RtlULongMult(ulong param_1, ulong param_2, ulong * param_3)|long __cdecl RtlULongMult(ulong param_1, ulong param_2, ulong * param_3)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### RtlULongMult Diff ```diff --- RtlULongMult +++ RtlULongMult @@ -1,18 +1,18 @@ /* long __cdecl RtlULongMult(unsigned long,unsigned long,unsigned long * __ptr64) */ long __cdecl RtlULongMult(ulong param_1,ulong param_2,ulong *param_3) { - ulonglong uVar1; - ulong uVar2; + ulong uVar1; + ulonglong uVar2; - uVar1 = (ulonglong)param_1 << 4; - uVar2 = 0xffffffff; - if (uVar1 < 0x100000000) { - uVar2 = (ulong)uVar1; + uVar2 = (ulonglong)param_1 * (ulonglong)param_2; + uVar1 = 0xffffffff; + if (uVar2 < 0x100000000) { + uVar1 = (ulong)uVar2; } - *param_3 = uVar2; - return -(uint)(0xffffffff < uVar1) & 0xc0000095; + *param_3 = uVar1; + return -(uint)(0xffffffff < uVar2) & 0xc0000095; } ``` ## CmsVolume::ReadLatestCheckpoint ### Match Info |Key|refs-2026-06.sys - refs-2026-07.sys| | :---: | :---: | |diff_type|code,refcount,length,address,called| |ratio|0.2| |i_ratio|0.38| |m_ratio|0.97| |b_ratio|0.3| |match_types|SymbolsHash| ### Function Meta Diff |Key|refs-2026-06.sys|refs-2026-07.sys| | :---: | :---: | :---: | |name|ReadLatestCheckpoint|ReadLatestCheckpoint| |fullname|CmsVolume::ReadLatestCheckpoint|CmsVolume::ReadLatestCheckpoint| |`refcount`|3|2| |`length`|1446|1491| |`called`|CmsVolume::ChooseCheckpointRecord
CmsVolume::ReadAndRepairSelfChecksumBlock
CmsVolume::RewriteCheckpointRecord
NTOSKRNL.EXE::ExAllocatePoolWithTag
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::FsRtlIsTotalDeviceFailure
WPP_SF_Dq
__security_check_cookie
_guard_dispatch_icall
memmove|
Expand for full list:
CmsVolume::ChooseCheckpointRecord
CmsVolume::ReadAndRepairSelfChecksumBlock
CmsVolume::RewriteCheckpointRecord
Feature_1076875578__private_IsEnabledDeviceUsage
NTOSKRNL.EXE::ExAllocatePoolWithTag
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::FsRtlIsTotalDeviceFailure
RtlULongAdd
WPP_SF_Dq
__security_check_cookie
_guard_dispatch_icallmemmove
| |calling|CmsVolume::Start|CmsVolume::Start| |paramcount|2|2| |`address`|1c005d2b0|1c004d900| |sig|long __thiscall ReadLatestCheckpoint(CmsVolume * this, CmsTransactionContext * param_1)|long __thiscall ReadLatestCheckpoint(CmsVolume * this, CmsTransactionContext * param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|ANALYSIS| |external|False|False| ### CmsVolume::ReadLatestCheckpoint Called Diff ```diff --- CmsVolume::ReadLatestCheckpoint called +++ CmsVolume::ReadLatestCheckpoint called @@ -3,0 +4 @@ +Feature_1076875578__private_IsEnabledDeviceUsage @@ -6,0 +8 @@ +RtlULongAdd ``` ### CmsVolume::ReadLatestCheckpoint Diff ```diff --- CmsVolume::ReadLatestCheckpoint +++ CmsVolume::ReadLatestCheckpoint @@ -1,231 +1,247 @@ +/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ -/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ /* public: long __cdecl CmsVolume::ReadLatestCheckpoint(class CmsTransactionContext * __ptr64) __ptr64 */ long __thiscall CmsVolume::ReadLatestCheckpoint(CmsVolume *this,CmsTransactionContext *param_1) { undefined1 auVar1 [16]; - char cVar2; - long lVar3; - _RTL_GENERIC_COMPARE_RESULTS _Var4; - longlong lVar5; - undefined4 *puVar6; - undefined8 uVar7; - void *pvVar8; - uint uVar9; + ulong uVar2; + char cVar3; + long lVar4; + _RTL_GENERIC_COMPARE_RESULTS _Var5; + int iVar6; + longlong lVar7; + undefined8 uVar8; + undefined4 *puVar9; + void *_Dst; + uint uVar10; void *_Src; - uint uVar10; ulonglong uVar11; longlong *plVar12; uchar uVar13; + ulonglong uVar14; size_t _Size; - uchar uVar14; + uchar uVar15; _SmsBigIdentifier *in_R9; - ulonglong uVar16; - uchar *puVar17; + char *pcVar16; + uint uVar17; uint uVar18; CmsVolume *pCVar19; undefined1 auStackY_108 [32]; uchar in_stack_ffffffffffffff60; char local_88 [4]; - uchar local_84 [4]; - longlong local_80 [2]; - CmsTransactionContext *local_70; - longlong local_68; - longlong lStack_60; - longlong local_58; - longlong lStack_50; - ulonglong local_48; - uint *puVar15; + undefined2 local_84 [2]; + ulong local_80; + ulong local_7c; + longlong local_78 [2]; + CmsTransactionContext *local_68; + longlong local_60; + longlong lStack_58; + longlong local_50; + longlong lStack_48; + ulonglong local_40; - local_48 = __security_cookie ^ (ulonglong)auStackY_108; - uVar10 = 0xffffffff; + local_40 = __security_cookie ^ (ulonglong)auStackY_108; + uVar18 = 0xffffffff; local_88[0] = '\x01'; - plVar12 = local_80; - local_84[0] = '\0'; - local_84[1] = '\0'; - local_80[0] = 0; - local_80[1] = 0; - uVar9 = 0; - local_68 = 0; - lStack_60 = 0; - local_58 = 0; - lStack_50 = 0; - local_70 = param_1; + plVar12 = local_78; + local_84[0] = 0; + local_78[0] = 0; + local_78[1] = 0; + uVar10 = 0; + local_60 = 0; + lStack_58 = 0; + local_50 = 0; + lStack_48 = 0; + local_68 = param_1; do { - lVar5 = ExAllocatePoolWithTag(0x200,*(undefined4 *)(this + 0x600)); - *plVar12 = lVar5; - if (lVar5 == 0) goto LAB_0; - uVar9 = uVar9 + 1; + lVar7 = ExAllocatePoolWithTag(0x200,*(undefined4 *)(this + 0x600)); + *plVar12 = lVar7; + if (lVar7 == 0) goto LAB_0; + uVar10 = uVar10 + 1; plVar12 = plVar12 + 1; - } while (uVar9 < 2); + } while (uVar10 < 2); while( true ) { pCVar19 = this + 0x620; uVar11 = 0; - plVar12 = local_80; - puVar17 = local_84; + pcVar16 = (char *)local_84; + plVar12 = local_78; do { - local_68 = *(longlong *)(pCVar19 + -8); + local_60 = *(longlong *)(pCVar19 + -8); if (*(uint *)pCVar19 < 2) { - lStack_50 = 0; - lStack_60 = 0; - local_58 = 0; + lStack_48 = 0; + lStack_58 = 0; + local_50 = 0; } else { - lStack_60 = local_68 + 1; - local_58 = local_68 + 2; - lStack_50 = local_68 + 3; - } - uVar18 = (uint)uVar11; - lVar3 = ReadAndRepairSelfChecksumBlock - (this,local_70,(void *)0x0,in_R9,(_LCN_TUPLE *)&local_68,*(uint *)pCVar19, + lStack_58 = local_60 + 1; + local_50 = local_60 + 2; + lStack_48 = local_60 + 3; + } + uVar17 = (uint)uVar11; + lVar4 = ReadAndRepairSelfChecksumBlock + (this,local_68,(void *)0x0,in_R9,(_LCN_TUPLE *)&local_60,*(uint *)pCVar19, (void *)*plVar12,ValidateCheckpointRecordCallback,ChooseCheckpointRecord, - local_84 + uVar11,(_SmsScrubIoOutput *)0x0,(_SCRUB_PARITY_EXTENT_DATA *)0x0 - ,local_88,in_stack_ffffffffffffff60,'\0'); - uVar9 = uVar10; - if (lVar3 < 0) { - cVar2 = FsRtlIsTotalDeviceFailure(lVar3); - if (cVar2 != '\0') goto LAB_1; - } - else if (((*puVar17 != '\0') && (uVar9 = uVar18, uVar10 != 0xffffffff)) && - (_Var4 = ChooseCheckpointRecord - ((void *)local_80[uVar10],(void *)*plVar12,*(ulong *)pCVar19), - uVar9 = uVar10, _Var4 == 0)) { - uVar9 = uVar18; - } - uVar10 = uVar9; - uVar11 = (ulonglong)(uVar18 + 1); - puVar17 = puVar17 + 1; + (uchar *)((longlong)local_84 + uVar11),(_SmsScrubIoOutput *)0x0, + (_SCRUB_PARITY_EXTENT_DATA *)0x0,local_88,in_stack_ffffffffffffff60,'\0'); + uVar10 = uVar18; + if (lVar4 < 0) { + cVar3 = FsRtlIsTotalDeviceFailure(lVar4); + if (cVar3 != '\0') goto LAB_1; + } + else if (((*pcVar16 != '\0') && (uVar10 = uVar17, uVar18 != 0xffffffff)) && + (_Var5 = ChooseCheckpointRecord + ((void *)local_78[uVar18],(void *)*plVar12,*(ulong *)pCVar19), + uVar10 = uVar18, _Var5 == 0)) { + uVar10 = uVar17; + } + uVar18 = uVar10; + uVar11 = (ulonglong)(uVar17 + 1); + pcVar16 = pcVar16 + 1; pCVar19 = pCVar19 + 0x68; plVar12 = plVar12 + 1; - } while (uVar18 + 1 < 2); - if (uVar10 != 0xffffffff) break; - if (local_88[0] == '\0') goto LAB_2; + } while (uVar17 + 1 < 2); + if (uVar18 != 0xffffffff) { + if ((((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)((longlong)WPP_GLOBAL_Control + 0x2c) & 0x1000) != 0)) && + (1 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x29))) { + in_R9 = (_SmsBigIdentifier *)(ulonglong)*(uint *)(this + 0xc18); + WPP_SF_Dq(WPP_GLOBAL_Control[3],0xb,&WPP_9e1204f91d6136e9fba262fc2971b663_Traceguids); + } + if (DAT_2 != 0) { + in_R9 = (_SmsBigIdentifier *)local_84; + uVar18 = (*(code *)DAT_2)(*(undefined8 *)(this + 0x30),2,local_78); + } + memmove(*(void **)(this + 0x608),(void *)local_78[uVar18],(ulonglong)*(uint *)(this + 0x600)); + uVar11 = (ulonglong)(uVar18 - 1 & 1); + *(CmsVolume **)(this + 0x5e0) = this + uVar11 * 0xc0 + 0x460; + *(CmsVolume **)(this + 0x6e8) = this + (uVar11 + 0xf) * 0x68; + if (*(ushort *)(this + 0x77c) < *(ushort *)((longlong)*(void **)(this + 0x608) + 0x50)) { + return -0x3ffffeb1; + } + memmove(*(void **)(this + 0x608),(void *)local_78[uVar18],(ulonglong)*(uint *)(this + 0x600)); + lVar7 = *(longlong *)(this + 0x608); + uVar13 = 0xff; + *(undefined8 *)(this + 0x730) = *(undefined8 *)(lVar7 + 0x60); + *(undefined8 *)(this + 0x738) = *(undefined8 *)(lVar7 + 0x68); + *(undefined8 *)(this + 0x750) = *(undefined8 *)(lVar7 + 0x70); + uVar18 = *(uint *)(this + 0xc3c); + *(uint *)(this + 0xc3c) = uVar18 | 0x40000000; + if (*(int *)(lVar7 + 0x88) != 0) { + *(uint *)(this + 0xc3c) = uVar18 & 0xbfffffff; + auVar1 = ZEXT416(8) * ZEXT416(*(uint *)(lVar7 + 0x8c) >> 3); + uVar8 = auVar1._0_8_; + if (auVar1._8_8_ != 0) { + uVar8 = 0xffffffffffffffff; + } + in_R9 = (_SmsBigIdentifier *)ExAllocatePoolWithTag(0x200,uVar8,0x6950534d); + *(_SmsBigIdentifier **)(this + 0x758) = in_R9; + if (in_R9 == (_SmsBigIdentifier *)0x0) goto LAB_0; + lVar7 = *(longlong *)(this + 0x608); + uVar18 = *(uint *)(lVar7 + 0x8c); + *(uint *)(this + 0x760) = uVar18; + uVar14 = (ulonglong)uVar18; + memmove(in_R9,(void *)((ulonglong)*(uint *)(lVar7 + 0x88) + lVar7),uVar14); + uVar13 = (uchar)uVar14; + } + if (DAT_3 != 0) { + uVar13 = 'M'; + puVar9 = (undefined4 *)ExAllocatePoolWithTag(0x200,0xe0); + if (puVar9 != (undefined4 *)0x0) { + *puVar9 = 0xc; + *(undefined8 *)(puVar9 + 2) = *(undefined8 *)(this + 0x30); + puVar9[4] = 0; + *(undefined8 *)(puVar9 + 6) = *(undefined8 *)(this + 0x750); + *(undefined8 *)(puVar9 + 8) = *(undefined8 *)(this + 0x730); + uVar8 = *(undefined8 *)(local_78[uVar11] + 0x70); + *(undefined8 *)(puVar9 + 10) = uVar8; + *(undefined8 *)(puVar9 + 0xc) = *(undefined8 *)(local_78[uVar11] + 0x60); + (*(code *)DAT_3)(puVar9,CONCAT71((int7)((ulonglong)uVar8 >> 8),1)); + ExFreePoolWithTag(puVar9,0); + } + } + uVar15 = (uchar)in_R9; + lVar7 = *(longlong *)(this + 0x608); + uVar11 = 0xd; + if (*(uint *)(lVar7 + 0x90) < 0xe) goto LAB_4; + local_80 = 0; + uVar18 = 0xd; + goto LAB_5; + } + if (local_88[0] == '\0') break; local_88[0] = '\0'; } - if ((((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)((longlong)WPP_GLOBAL_Control + 0x2c) & 0x1000) != 0)) && - (1 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x29))) { - in_R9 = (_SmsBigIdentifier *)(ulonglong)*(uint *)(this + 0xc18); - WPP_SF_Dq(WPP_GLOBAL_Control[3],0xb,&WPP_5eee8a30ae5b3d37f936470884c84904_Traceguids); - } - uVar14 = (uchar)in_R9; - uVar9 = 0; - if (DAT_3 != 0) { - uVar14 = (uchar)local_84; - uVar10 = (*(code *)DAT_3)(*(undefined8 *)(this + 0x30),2,local_80); - } - memmove(*(void **)(this + 0x608),(void *)local_80[uVar10],(ulonglong)*(uint *)(this + 0x600)); - uVar11 = (ulonglong)(uVar10 - 1 & 1); - *(CmsVolume **)(this + 0x5e0) = this + uVar11 * 0xc0 + 0x460; - *(CmsVolume **)(this + 0x6e8) = this + (uVar11 + 0xf) * 0x68; - if (*(ushort *)(this + 0x77c) < *(ushort *)((longlong)*(void **)(this + 0x608) + 0x50)) { - return -0x3ffffeb1; - } - uVar16 = (ulonglong)*(uint *)(this + 0x600); - memmove(*(void **)(this + 0x608),(void *)local_80[uVar10],uVar16); - uVar13 = (uchar)uVar16; - lVar5 = *(longlong *)(this + 0x608); - *(undefined8 *)(this + 0x730) = *(undefined8 *)(lVar5 + 0x60); - *(undefined8 *)(this + 0x738) = *(undefined8 *)(lVar5 + 0x68); - *(undefined8 *)(this + 0x750) = *(undefined8 *)(lVar5 + 0x70); - uVar10 = *(uint *)(this + 0xc3c); - *(uint *)(this + 0xc3c) = uVar10 | 0x40000000; - if (*(int *)(lVar5 + 0x88) != 0) { - *(uint *)(this + 0xc3c) = uVar10 & 0xbfffffff; - auVar1 = ZEXT816(8) * ZEXT416(*(uint *)(lVar5 + 0x8c) >> 3); - uVar7 = auVar1._0_8_; - if (auVar1._8_8_ != 0) { - uVar7 = 0xffffffffffffffff; - } - pvVar8 = (void *)ExAllocatePoolWithTag(0x200,uVar7,0x6950534d); - *(void **)(this + 0x758) = pvVar8; - if (pvVar8 == (void *)0x0) goto LAB_0; - lVar5 = *(longlong *)(this + 0x608); - uVar10 = *(uint *)(lVar5 + 0x8c); - *(uint *)(this + 0x760) = uVar10; - uVar16 = (ulonglong)uVar10; - memmove(pvVar8,(void *)((ulonglong)*(uint *)(lVar5 + 0x88) + lVar5),uVar16); - uVar14 = (uchar)pvVar8; - uVar13 = (uchar)uVar16; - } - if (DAT_4 != 0) { - uVar13 = 'M'; - puVar6 = (undefined4 *)ExAllocatePoolWithTag(0x200,0xe0); - if (puVar6 != (undefined4 *)0x0) { - *puVar6 = 0xc; - *(undefined8 *)(puVar6 + 2) = *(undefined8 *)(this + 0x30); - puVar6[4] = 0; - *(undefined8 *)(puVar6 + 6) = *(undefined8 *)(this + 0x750); - *(undefined8 *)(puVar6 + 8) = *(undefined8 *)(this + 0x730); - uVar7 = *(undefined8 *)(local_80[uVar11] + 0x70); - *(undefined8 *)(puVar6 + 10) = uVar7; - *(undefined8 *)(puVar6 + 0xc) = *(undefined8 *)(local_80[uVar11] + 0x60); - (*(code *)DAT_4)(puVar6,CONCAT71((int7)((ulonglong)uVar7 >> 8),1)); - ExFreePoolWithTag(puVar6,0); - } - } - lVar5 = *(longlong *)(this + 0x608); - uVar11 = 0xd; - if (*(uint *)(lVar5 + 0x90) < 0xe) goto LAB_5; - puVar15 = (uint *)(lVar5 + 200); - uVar16 = (ulonglong)(*(uint *)(lVar5 + 0x90) - 0xd); - do { - uVar10 = *puVar15; - puVar15 = puVar15 + 1; - uVar9 = uVar9 + (*(int *)((ulonglong)uVar10 + 0x24 + lVar5) + 0x2fU & 0xfffffff8); - uVar16 = uVar16 - 1; - } while (uVar16 != 0); +LAB_6: + lVar4 = -0x3fffffce; + goto LAB_1; +LAB_0: + lVar4 = -0x3fffff66; + goto LAB_1; + while( true ) { + lVar7 = *(longlong *)(this + 0x608); + uVar18 = uVar18 + 1; + if (*(uint *)(lVar7 + 0x90) <= uVar18) break; +LAB_5: + uVar2 = local_80; + uVar14 = (ulonglong)*(uint *)(lVar7 + 0x94 + (ulonglong)uVar18 * 4); + iVar6 = Feature_1076875578__private_IsEnabledDeviceUsage(); + if (iVar6 == 0) { + local_80 = uVar2 + (*(int *)(uVar14 + 0x24 + lVar7) + 0x2fU & 0xfffffff8); + } + else { + local_7c = 0; + lVar4 = RtlULongAdd(0x28,*(ulong *)(uVar14 + 0x24 + lVar7),&local_7c); + if (((lVar4 < 0) || (uVar10 = local_7c + 7 & 0xfffffff8, uVar10 < local_7c)) || + (lVar4 = RtlULongAdd(uVar2,uVar10,&local_80), lVar4 < 0)) goto LAB_6; + } + } uVar13 = 'M'; - auVar1 = ZEXT416(8) * ZEXT416(uVar9 >> 3); - uVar7 = auVar1._0_8_; + auVar1 = ZEXT816(8) * ZEXT416(local_80 >> 3); + uVar8 = auVar1._0_8_; if (auVar1._8_8_ != 0) { - uVar7 = 0xffffffffffffffff; - } - pvVar8 = (void *)ExAllocatePoolWithTag(0x200,uVar7); - uVar14 = (uchar)puVar15; - *(void **)(this + 0x770) = pvVar8; - if (pvVar8 != (void *)0x0) { + uVar8 = 0xffffffffffffffff; + } + _Dst = (void *)ExAllocatePoolWithTag(0x200,uVar8); + uVar15 = (uchar)in_R9; + *(void **)(this + 0x770) = _Dst; + if (_Dst == (void *)0x0) { + lVar4 = -0x3fffff66; + } + else { *(int *)(this + 0x778) = *(int *)(*(longlong *)(this + 0x608) + 0x90) + -0xd; if (0xd < *(uint *)(*(longlong *)(this + 0x608) + 0x90)) { do { _Src = (void *)((ulonglong)*(uint *)(*(longlong *)(this + 0x608) + 0x94 + uVar11 * 4) + *(longlong *)(this + 0x608)); _Size = (ulonglong)*(uint *)((longlong)_Src + 0x24) + 0x28; - memmove(pvVar8,_Src,_Size); - uVar14 = (uchar)puVar15; + memmove(_Dst,_Src,_Size); + uVar15 = (uchar)in_R9; uVar13 = (uchar)_Size; - uVar10 = (int)uVar11 + 1; - uVar11 = (ulonglong)uVar10; - pvVar8 = (void *)((longlong)pvVar8 + - ((ulonglong)*(uint *)((longlong)_Src + 0x24) + 0x2f & 0xfffffffffffffff8)); - } while (uVar10 < *(uint *)(*(longlong *)(this + 0x608) + 0x90)); - } -LAB_5: - lVar3 = RewriteCheckpointRecord(this,local_70,uVar13,uVar14); - if (-1 < lVar3) { - lVar3 = 0; - } - goto LAB_1; - } -LAB_0: - lVar3 = -0x3fffff66; + uVar18 = (int)uVar11 + 1; + uVar11 = (ulonglong)uVar18; + _Dst = (void *)((longlong)_Dst + + ((ulonglong)*(uint *)((longlong)_Src + 0x24) + 0x2f & 0xfffffffffffffff8)); + } while (uVar18 < *(uint *)(*(longlong *)(this + 0x608) + 0x90)); + } +LAB_4: + lVar4 = RewriteCheckpointRecord(this,local_68,uVar13,uVar15); + if (-1 < lVar4) { + lVar4 = 0; + } + } LAB_1: - lVar5 = 2; - plVar12 = local_80; + lVar7 = 2; + plVar12 = local_78; do { if (*plVar12 != 0) { ExFreePoolWithTag(*plVar12,0); } plVar12 = plVar12 + 1; - lVar5 = lVar5 + -1; - } while (lVar5 != 0); - return lVar3; -LAB_2: - lVar3 = -0x3fffffce; - goto LAB_1; + lVar7 = lVar7 + -1; + } while (lVar7 != 0); + return lVar4; } ``` ## CmsVolume::ValidateCheckpointRecord ### Match Info |Key|refs-2026-06.sys - refs-2026-07.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.37| |i_ratio|0.6| |m_ratio|0.98| |b_ratio|0.61| |match_types|SymbolsHash| ### Function Meta Diff |Key|refs-2026-06.sys|refs-2026-07.sys| | :---: | :---: | :---: | |name|ValidateCheckpointRecord|ValidateCheckpointRecord| |fullname|CmsVolume::ValidateCheckpointRecord|CmsVolume::ValidateCheckpointRecord| |refcount|2|2| |`length`|1070|1126| |`called`|CmsChecksum::GetMetadataChecksumClass
CmsVolume::ComputeOrVerifySelfChecksumBlock
CmsVolume::ReadAndRepairSelfChecksumBlock
NTOSKRNL.EXE::DbgPrintEx
NTOSKRNL.EXE::ExAllocatePoolWithTag
WPP_SF_Diiii
WPP_SF_Dq
__security_check_cookie
_guard_dispatch_icall
operator_delete|
Expand for full list:
CmsChecksum::GetMetadataChecksumClass
CmsVolume::ComputeOrVerifySelfChecksumBlock
CmsVolume::ReadAndRepairSelfChecksumBlock
Feature_1337977145__private_IsEnabledDeviceUsage
Feature_3102454072__private_IsEnabledDeviceUsage
NTOSKRNL.EXE::DbgPrintEx
NTOSKRNL.EXE::ExAllocatePoolWithTag
WPP_SF_Diiii
WPP_SF_Dq
__security_check_cookie
_guard_dispatch_icalloperator_delete
| |calling|CmsVolume::ValidateCheckpointRecordCallback|CmsVolume::ValidateCheckpointRecordCallback| |paramcount|7|7| |`address`|1c005dc30|1c004b810| |sig|uchar __thiscall ValidateCheckpointRecord(CmsVolume * this, CmsTransactionContext * param_1, CmsVolume * param_2, void * param_3, _LCN_TUPLE * param_4, ulong param_5, void * param_6)|uchar __thiscall ValidateCheckpointRecord(CmsVolume * this, CmsTransactionContext * param_1, CmsVolume * param_2, void * param_3, _LCN_TUPLE * param_4, ulong param_5, void * param_6)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### CmsVolume::ValidateCheckpointRecord Called Diff ```diff --- CmsVolume::ValidateCheckpointRecord called +++ CmsVolume::ValidateCheckpointRecord called @@ -3,0 +4,2 @@ +Feature_1337977145__private_IsEnabledDeviceUsage +Feature_3102454072__private_IsEnabledDeviceUsage ``` ### CmsVolume::ValidateCheckpointRecord Diff ```diff --- CmsVolume::ValidateCheckpointRecord +++ CmsVolume::ValidateCheckpointRecord @@ -1,181 +1,181 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ /* public: unsigned char __cdecl CmsVolume::ValidateCheckpointRecord(class CmsTransactionContext * __ptr64,class CmsVolume * __ptr64,void * __ptr64,union _LCN_TUPLE const * __ptr64,unsigned long,void * __ptr64) __ptr64 */ uchar __thiscall CmsVolume::ValidateCheckpointRecord (CmsVolume *this,CmsTransactionContext *param_1,CmsVolume *param_2,void *param_3, _LCN_TUPLE *param_4,ulong param_5,void *param_6) { uint uVar1; - uint uVar2; - byte bVar3; - long lVar4; - int iVar5; - void *pvVar6; - ulonglong uVar7; - uint uVar8; - CmsChecksum *pCVar9; + bool bVar2; + CmsChecksum *pCVar3; + byte bVar4; + long lVar5; + int iVar6; + void *pvVar7; + ulonglong uVar8; + uint uVar9; uint uVar10; - ulonglong uVar11; + _SmsBigIdentifier *p_Var11; _LCN_TUPLE *p_Var12; - undefined8 **ppuVar13; - _SmsBigIdentifier *p_Var14; - char cVar15; - ulong uVar16; - _LCN_TUPLE *p_Var17; - uint *puVar18; + _SmsBigIdentifier *p_Var13; + ulong uVar14; + _LCN_TUPLE *p_Var15; + uint uVar16; + uint *puVar17; undefined1 auStackY_118 [32]; uchar in_stack_ffffffffffffff50; - uchar local_98; - char local_97; + uchar local_97 [7]; CmsTransactionContext *local_90; CmsChecksum *local_88; CmsVolume *local_80; _LCN_TUPLE *local_78; CmsVolume *local_70; uint local_68 [4]; ulonglong local_58; local_58 = __security_cookie ^ (ulonglong)auStackY_118; - cVar15 = '\0'; - pvVar6 = (void *)0x0; - local_98 = *(uchar *)param_6; - bVar3 = (byte)*(undefined4 *)(param_2 + 0x40) & 0x1f; - uVar8 = param_5 << bVar3; + pvVar7 = (void *)0x0; + local_97[0] = *(uchar *)param_6; + uVar9 = param_5 << ((byte)*(undefined4 *)(param_2 + 0x40) & 0x1f); local_78 = param_4; - local_97 = '\0'; + bVar2 = false; local_68[0] = 0xc; local_68[1] = 7; local_68[2] = 8; if (param_5 != 0) { + p_Var13 = (_SmsBigIdentifier *)(ulonglong)uVar9; local_90 = param_1; local_80 = this; local_70 = param_2; - lVar4 = ComputeOrVerifySelfChecksumBlock - (param_2,param_1,param_3,uVar8,param_4,*(ulong *)((longlong)param_3 + 0x58), + lVar5 = ComputeOrVerifySelfChecksumBlock + (param_2,param_1,param_3,uVar9,param_4,*(ulong *)((longlong)param_3 + 0x58), *(ulong *)((longlong)param_3 + 0x5c),'\x01'); - if (lVar4 < 0) { + if (lVar5 < 0) { DbgPrintEx(0x65,0,"Checkpoint at LCN=0x%llx failed checksum validation, status=0x%x\n", *(undefined8 *)param_4); } - else { - uVar1 = *(uint *)((longlong)param_3 + 0x90); - if ((uVar1 <= uVar8 >> 2) && (4 < uVar1)) { - uVar1 = uVar1 * 4 + 0x98; - uVar11 = 0; - do { - uVar10 = *(uint *)((longlong)param_3 + uVar11 * 4 + 0x94); - uVar7 = (ulonglong)uVar10; - if (uVar10 < uVar1) { - return '\0'; - } - if (uVar8 < uVar10) { - return '\0'; - } - if ((ulonglong)uVar8 < uVar7 + 0x28) { - return '\0'; - } - if ((uVar10 + 7 & 0xfffffff8) != uVar10) { - return '\0'; - } - uVar10 = *(uint *)(uVar7 + 0x24 + (longlong)param_3); - if (uVar8 < uVar10) { - return '\0'; - } - if ((ulonglong)uVar8 < uVar7 + 0x28 + (ulonglong)uVar10) { - return '\0'; - } - if ((((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)((longlong)WPP_GLOBAL_Control + 0x2c) & 0x1000) != 0)) && - (1 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x29))) { - WPP_SF_Dq(WPP_GLOBAL_Control[3],0xd,&WPP_5eee8a30ae5b3d37f936470884c84904_Traceguids, - uVar11); - } - ppuVar13 = &WPP_GLOBAL_Control; - uVar10 = (int)uVar11 + 1; - uVar11 = (ulonglong)uVar10; - } while (uVar10 < *(uint *)((longlong)param_3 + 0x90)); + else if ((*(uint *)((longlong)param_3 + 0x90) <= uVar9 >> 2) && + (4 < *(uint *)((longlong)param_3 + 0x90))) { + iVar6 = Feature_3102454072__private_IsEnabledDeviceUsage(); + uVar10 = *(uint *)((longlong)param_3 + 0x90); + if ((iVar6 == 0) || (uVar10 < 0x1b)) { + p_Var11 = (_SmsBigIdentifier *)0x0; + uVar16 = uVar10 * 4 + 0x98; + if (uVar10 != 0) { + do { + uVar10 = *(uint *)((longlong)param_3 + (longlong)p_Var11 * 4 + 0x94); + uVar8 = (ulonglong)uVar10; + if (uVar10 < uVar16) { + return '\0'; + } + if (uVar9 < uVar10) { + return '\0'; + } + if ((ulonglong)uVar9 < uVar8 + 0x28) { + return '\0'; + } + if ((uVar10 + 7 & 0xfffffff8) != uVar10) { + return '\0'; + } + uVar1 = *(uint *)(uVar8 + 0x24 + (longlong)param_3); + if (uVar9 < uVar1) { + return '\0'; + } + if ((ulonglong)uVar9 < uVar8 + 0x28 + (ulonglong)uVar1) { + return '\0'; + } + iVar6 = Feature_1337977145__private_IsEnabledDeviceUsage(); + if ((iVar6 != 0) && (0x80 < *(uint *)((ulonglong)uVar10 + 0x24 + (longlong)param_3))) { + return '\0'; + } + iVar6 = (int)p_Var11; + if ((((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)((longlong)WPP_GLOBAL_Control + 0x2c) & 0x1000) != 0)) && + (1 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x29))) { + WPP_SF_Dq(WPP_GLOBAL_Control[3],0xd,&WPP_9e1204f91d6136e9fba262fc2971b663_Traceguids); + p_Var13 = p_Var11; + } + uVar10 = iVar6 + 1; + p_Var11 = (_SmsBigIdentifier *)(ulonglong)uVar10; + } while (uVar10 < *(uint *)((longlong)param_3 + 0x90)); + } uVar10 = *(uint *)((longlong)param_3 + 0x8c); - if ((((uVar10 <= uVar8) && (uVar2 = *(uint *)((longlong)param_3 + 0x88), uVar2 <= uVar8)) && - ((uVar1 <= uVar2 || (uVar10 == 0)))) && (uVar10 + uVar2 <= uVar8)) { - uVar8 = 0 << bVar3; - pCVar9 = (CmsChecksum *)(ulonglong)uVar8; - if (local_98 != (uchar)uVar8) { - puVar18 = local_68; + if ((((uVar10 <= uVar9) && (uVar1 = *(uint *)((longlong)param_3 + 0x88), uVar1 <= uVar9)) && + ((uVar16 <= uVar1 || (uVar10 == 0)))) && (uVar10 + uVar1 <= uVar9)) { + if (local_97[0] != '\0') { + uVar9 = 0; + puVar17 = local_68; do { - if (cVar15 != '\0') break; - p_Var14 = (_SmsBigIdentifier *)(ulonglong)*puVar18; - local_98 = (uchar)pCVar9; - p_Var17 = (_LCN_TUPLE *) - ((ulonglong)*(uint *)((longlong)param_3 + (longlong)p_Var14 * 4 + 0x94) + + if (bVar2) break; + p_Var11 = (_SmsBigIdentifier *)(ulonglong)*puVar17; + local_88 = (CmsChecksum *)0x0; + local_97[0] = '\0'; + p_Var15 = (_LCN_TUPLE *) + ((ulonglong)*(uint *)((longlong)param_3 + (longlong)p_Var11 * 4 + 0x94) + (longlong)param_3); - local_88 = pCVar9; - lVar4 = CmsChecksum::GetMetadataChecksumClass((ushort)(byte)p_Var17[0x22],&local_88); - pCVar9 = local_88; - if (lVar4 < 0) { - if (pvVar6 == (void *)0x0) { + lVar5 = CmsChecksum::GetMetadataChecksumClass((ushort)(byte)p_Var15[0x22],&local_88); + pCVar3 = local_88; + if (lVar5 < 0) { + if (pvVar7 == (void *)0x0) { return '\0'; } - operator_delete(pvVar6); + operator_delete(pvVar7); return '\0'; } - p_Var12 = p_Var17 + 0x20; - iVar5 = (**(code **)(*(longlong *)local_88 + 0x90)) + p_Var12 = p_Var15 + 0x20; + iVar6 = (**(code **)(*(longlong *)local_88 + 0x90)) (local_88,*(undefined8 *)(local_90 + 0x20)); - bVar3 = (**(code **)(*(longlong *)pCVar9 + 0xa0)) - (pCVar9,*(undefined8 *)(local_90 + 0x20)); - pCVar9 = (CmsChecksum *)0x0; - uVar16 = iVar5 << (bVar3 & 0x1f); - if (pvVar6 == (void *)0x0) { + bVar4 = (**(code **)(*(longlong *)pCVar3 + 0xa0)) + (pCVar3,*(undefined8 *)(local_90 + 0x20)); + uVar14 = iVar6 << (bVar4 & 0x1f); + if (pvVar7 == (void *)0x0) { p_Var12 = (_LCN_TUPLE *)0x6950534d; - pvVar6 = (void *)ExAllocatePoolWithTag - (0x200,uVar16 << ((byte)*(undefined4 *)(local_80 + 0x40) + pvVar7 = (void *)ExAllocatePoolWithTag + (0x200,uVar14 << ((byte)*(undefined4 *)(local_80 + 0x40) & 0x1f)); - cVar15 = local_97; - if (pvVar6 != (void *)0x0) goto LAB_0; + if (pvVar7 != (void *)0x0) goto LAB_0; } else { LAB_0: - lVar4 = ReadAndRepairSelfChecksumBlock - (local_80,local_90,p_Var12,(_SmsBigIdentifier *)ppuVar13,p_Var17, - uVar16,pvVar6,ValidateGlobalTableRootBlock, - ChooseGlobalTableRootBlock,&local_98,(_SmsScrubIoOutput *)0x0, - (_SCRUB_PARITY_EXTENT_DATA *)0x0,p_Var17, - in_stack_ffffffffffffff50,'\0'); - if ((lVar4 < 0) || (cVar15 = local_97, local_98 == '\0')) { - local_97 = '\x01'; + lVar5 = ReadAndRepairSelfChecksumBlock + (local_80,local_90,p_Var12,p_Var13,p_Var15,uVar14,pvVar7, + ValidateGlobalTableRootBlock,ChooseGlobalTableRootBlock,local_97, + (_SmsScrubIoOutput *)0x0,(_SCRUB_PARITY_EXTENT_DATA *)0x0,p_Var15 + ,in_stack_ffffffffffffff50,'\0'); + if ((lVar5 < 0) || (local_97[0] == '\0')) { + bVar2 = true; DbgPrintEx(0x65,0, "GlobalTable[%u] at LCN=0x%llx failed checksum validation, status=0x%x\n" ); - ppuVar13 = (undefined8 **)p_Var14; - cVar15 = '\x01'; + p_Var13 = p_Var11; } } - uVar8 = uVar8 + 1; - puVar18 = puVar18 + 1; - } while (uVar8 < 3); - if (pvVar6 != (void *)0x0) { - operator_delete(pvVar6); + uVar9 = uVar9 + 1; + puVar17 = puVar17 + 1; + } while (uVar9 < 3); + if (pvVar7 != (void *)0x0) { + operator_delete(pvVar7); } - if (cVar15 != '\0') { + if (bVar2) { return '\0'; } } if ((((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)((longlong)WPP_GLOBAL_Control + 0x2c) & 0x1000) != 0)) && (1 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x29))) { WPP_SF_Diiii(WPP_GLOBAL_Control[3]); } return '\x01'; } } } } return '\0'; } ``` ## CmsBPlusTable::CheckPage ### Match Info |Key|refs-2026-06.sys - refs-2026-07.sys| | :---: | :---: | |diff_type|code,refcount,length,address,called| |ratio|0.24| |i_ratio|0.51| |m_ratio|0.98| |b_ratio|0.73| |match_types|SymbolsHash| ### Function Meta Diff |Key|refs-2026-06.sys|refs-2026-07.sys| | :---: | :---: | :---: | |name|CheckPage|CheckPage| |fullname|CmsBPlusTable::CheckPage|CmsBPlusTable::CheckPage| |`refcount`|4|3| |`length`|264|262| |`called`|_guard_dispatch_icall
memcmp|Feature_1107546425__private_IsEnabledDeviceUsage
ValidateOTEntryBoundaries
_guard_dispatch_icall
memcmp| |calling|CmsVolume::MakePageResident|CmsVolume::MakePageResident| |paramcount|3|3| |`address`|1c006e764|1c006ff84| |sig|long __thiscall CheckPage(CmsBPlusTable * this, CmsTransactionContext * param_1, SmsPage * param_2)|long __thiscall CheckPage(CmsBPlusTable * this, CmsTransactionContext * param_1, SmsPage * param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|ANALYSIS| |external|False|False| ### CmsBPlusTable::CheckPage Called Diff ```diff --- CmsBPlusTable::CheckPage called +++ CmsBPlusTable::CheckPage called @@ -0,0 +1,2 @@ +Feature_1107546425__private_IsEnabledDeviceUsage +ValidateOTEntryBoundaries ``` ### CmsBPlusTable::CheckPage Diff ```diff --- CmsBPlusTable::CheckPage +++ CmsBPlusTable::CheckPage @@ -1,37 +1,55 @@ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ /* public: long __cdecl CmsBPlusTable::CheckPage(class CmsTransactionContext * __ptr64,struct SmsPage * __ptr64) __ptr64 */ long __thiscall CmsBPlusTable::CheckPage(CmsBPlusTable *this,CmsTransactionContext *param_1,SmsPage *param_2) { - uint uVar1; - longlong lVar2; - int *piVar3; - int iVar4; + undefined4 uVar1; + uint uVar2; + longlong lVar3; + int *piVar4; + int iVar5; + int iVar6; + long lVar7; void *_Buf1; - int iVar5; + uint uVar8; + uint *puVar9; + bool bVar10; - lVar2 = *(longlong *)(param_1 + 0x20); - piVar3 = *(int **)(param_2 + 0x80); - iVar5 = *(int *)(param_2 + 0x148) << ((byte)*(undefined4 *)(lVar2 + 0x40) & 0x1f); - iVar4 = memcmp(piVar3 + 8,param_2 + 8,0x20); - if ((((iVar4 == 0) && ((char)piVar3[1] == '\x02')) && (*piVar3 == 0x2b42534d)) && - (piVar3[3] == *(int *)(lVar2 + 0xc18))) { - _Buf1 = (void *)(**(code **)(**(longlong **)(this + 0x60) + 0x40))(); - iVar4 = memcmp(_Buf1,param_2 + 8,0x20); - uVar1 = *(uint *)(*(longlong *)(param_2 + 0x80) + 0x50); - if (iVar4 == 0) { - if (0x27 < uVar1) { - return ~-(uint)((ulonglong)uVar1 + 0x28 < (ulonglong)(iVar5 - 0x50)) & 0xc0000470; - } + lVar3 = *(longlong *)(param_1 + 0x20); + piVar4 = *(int **)(param_2 + 0x80); + iVar6 = *(int *)(param_2 + 0x148); + uVar1 = *(undefined4 *)(lVar3 + 0x40); + iVar5 = memcmp(piVar4 + 8,param_2 + 8,0x20); + if ((((iVar5 != 0) || ((char)piVar4[1] != '\x02')) || (*piVar4 != 0x2b42534d)) || + (piVar4[3] != *(int *)(lVar3 + 0xc18))) { + return -0x3ffffb90; + } + _Buf1 = (void *)(**(code **)(**(longlong **)(this + 0x60) + 0x40))(); + iVar5 = memcmp(_Buf1,param_2 + 8,0x20); + puVar9 = (uint *)(*(longlong *)(param_2 + 0x80) + 0x50); + uVar2 = *puVar9; + if (iVar5 == 0) { + bVar10 = uVar2 < 0x28; + } + else { + bVar10 = uVar2 < 8; + } + if ((!bVar10) && + (uVar8 = (iVar6 << ((byte)uVar1 & 0x1f)) - 0x50, (ulonglong)uVar2 + 0x28 < (ulonglong)uVar8)) { + iVar6 = Feature_1107546425__private_IsEnabledDeviceUsage(); + if (iVar6 == 0) { + return 0; } - else if (7 < uVar1) { - return ~-(uint)((ulonglong)uVar1 + 0x28 < (ulonglong)(iVar5 - 0x50)) & 0xc0000470; + uVar2 = *puVar9; + if (uVar2 < uVar8) { + lVar7 = ValidateOTEntryBoundaries((longlong)puVar9 + (ulonglong)uVar2,uVar8 - uVar2); + return lVar7; } } return -0x3ffffb90; } ``` ## CmsStream::GhostExtents ### Match Info |Key|refs-2026-06.sys - refs-2026-07.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.36| |i_ratio|0.79| |m_ratio|0.97| |b_ratio|0.96| |match_types|SymbolsHash| ### Function Meta Diff |Key|refs-2026-06.sys|refs-2026-07.sys| | :---: | :---: | :---: | |name|GhostExtents|GhostExtents| |fullname|CmsStream::GhostExtents|CmsStream::GhostExtents| |refcount|3|3| |`length`|392|419| |`called`|CmsStream::AddRun
CmsStream::DeleteAllocation
CmsStream::LogRedoForGhostExtents
CmsTableSetBase::EnterTree
CmsTransactionContext::FreeRunCopies|CmsStream::AddRun
CmsStream::DeleteAllocation
CmsStream::LogRedoForGhostExtents
CmsTableSetBase::EnterTree
CmsTransactionContext::FreeRunCopies
Feature_881316153__private_IsEnabledDeviceUsage| |calling|CmsLogRedoQueue::RedoGhostExtents
MsGhostExtents|CmsLogRedoQueue::RedoGhostExtents
MsGhostExtents| |paramcount|7|7| |`address`|1c01062bc|1c010695c| |sig|long __thiscall GhostExtents(CmsStream * this, CmsTransactionContext * param_1, __int64 param_2, __int64 param_3, _GUID param_4, ulong param_5, void * param_6)|long __thiscall GhostExtents(CmsStream * this, CmsTransactionContext * param_1, __int64 param_2, __int64 param_3, _GUID param_4, ulong param_5, void * param_6)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### CmsStream::GhostExtents Called Diff ```diff --- CmsStream::GhostExtents called +++ CmsStream::GhostExtents called @@ -5,0 +6 @@ +Feature_881316153__private_IsEnabledDeviceUsage ``` ### CmsStream::GhostExtents Diff ```diff --- CmsStream::GhostExtents +++ CmsStream::GhostExtents @@ -1,82 +1,92 @@ /* public: long __cdecl CmsStream::GhostExtents(class CmsTransactionContext * __ptr64,__int64,__int64,struct _GUID,unsigned long,void * __ptr64) __ptr64 */ long __thiscall CmsStream::GhostExtents - (CmsStream *this,CmsTransactionContext *param_1,longlong param_2,ulonglong param_3, - longlong *param_5,undefined4 param_6,void *param_7) + (CmsStream *this,CmsTransactionContext *param_1,longlong param_2,undefined8 param_3, + longlong *param_5,uint param_6,void *param_7) { - ulonglong uVar1; + int iVar1; long lVar2; ulonglong uVar3; ulonglong uVar4; longlong lVar5; longlong local_68; - undefined8 uStack_60; + undefined4 uStack_60; + undefined4 uStack_5c; longlong local_58; - ulonglong uStack_50; + undefined8 uStack_50; undefined4 local_48; undefined4 uStack_44; undefined4 uStack_40; undefined4 uStack_3c; undefined4 uStack_38; undefined4 uStack_34; - undefined4 uStack_30; + uint uStack_30; undefined4 local_2c; - uStack_34 = 0; - uStack_30 = 0; + uStack_50._0_4_ = (undefined4)param_3; + uStack_50._4_4_ = (undefined4)((ulonglong)param_3 >> 0x20); + uStack_60 = (undefined4)uStack_50; + uStack_5c = uStack_50._4_4_; uStack_44 = 0; uStack_40 = 0; uStack_3c = 0; uStack_38 = 0; + uStack_34 = 0; + uStack_30 = 0; local_2c = 0; local_68 = param_2; - uStack_60 = param_3; local_58 = param_2; uStack_50 = param_3; - CmsTransactionContext::FreeRunCopies(param_1); - if (param_1 != (CmsTransactionContext *)0x0) { - *(ulonglong *)(param_1 + 0x10) = *(ulonglong *)(param_1 + 0x10) & 0xfffffe7fffffffff; + iVar1 = Feature_881316153__private_IsEnabledDeviceUsage(); + if ((iVar1 == 0) || (param_6 < 0xffc8)) { + CmsTransactionContext::FreeRunCopies(param_1); + if (param_1 != (CmsTransactionContext *)0x0) { + *(ulonglong *)(param_1 + 0x10) = *(ulonglong *)(param_1 + 0x10) & 0xfffffe7fffffffff; + } + CmsTableSetBase::EnterTree(*(CmsTableSetBase **)(this + 0x10),param_1); + uVar4 = *(ulonglong *)(param_1 + 0x10); + *(ulonglong *)(param_1 + 0x10) = uVar4 | 0x2000000000; + lVar2 = DeleteAllocation(this,param_1,(_RANGE *)&local_58,0,(_RANGE *)0x0); + if ((uVar4 & 0x2000000000) == 0) { + *(ulonglong *)(param_1 + 0x10) = *(ulonglong *)(param_1 + 0x10) & 0xffffffdfffffffff; + } + if (-1 < lVar2) { + uStack_38 = 0xffffffff; + uStack_34 = 0xffffffff; + uVar4 = CONCAT44(uStack_5c,uStack_60); + local_48 = (undefined4)*param_5; + uStack_44 = (undefined4)((ulonglong)*param_5 >> 0x20); + uStack_40 = (undefined4)param_5[1]; + uStack_3c = (undefined4)((ulonglong)param_5[1] >> 0x20); + uStack_30 = param_6; + do { + if (uVar4 == 0) { + local_68 = *param_5; + uStack_60 = (undefined4)param_5[1]; + uStack_5c = *(undefined4 *)((longlong)param_5 + 0xc); + lVar2 = LogRedoForGhostExtents(this,param_1,local_58,uStack_50,&local_68,param_6,param_7); + return lVar2; + } + uVar3 = 0x7fffffff; + if (uVar4 < 0x7fffffff) { + uVar3 = uVar4 & 0xffffffff; + } + uStack_60 = (undefined4)uVar3; + lVar5 = local_68 + uVar3; + uVar4 = uVar4 - uVar3; + lVar2 = AddRun(this,param_1,(_SRANGE *)&local_68,local_68,0x280,(SmsRun *)0x0,0, + (_SmsRecallMetadataHeader *)&local_48,param_7); + local_68 = lVar5; + } while (-1 < lVar2); + } } - CmsTableSetBase::EnterTree(*(CmsTableSetBase **)(this + 0x10),param_1); - uVar4 = *(ulonglong *)(param_1 + 0x10); - *(ulonglong *)(param_1 + 0x10) = uVar4 | 0x2000000000; - lVar2 = DeleteAllocation(this,param_1,(_RANGE *)&local_58,0,(_RANGE *)0x0); - if ((uVar4 & 0x2000000000) == 0) { - *(ulonglong *)(param_1 + 0x10) = *(ulonglong *)(param_1 + 0x10) & 0xffffffdfffffffff; - } - if (-1 < lVar2) { - uStack_38 = 0xffffffff; - uStack_34 = 0xffffffff; - local_48 = (undefined4)*param_5; - uStack_44 = (undefined4)((ulonglong)*param_5 >> 0x20); - uStack_40 = (undefined4)param_5[1]; - uStack_3c = (undefined4)((ulonglong)param_5[1] >> 0x20); - uStack_30 = param_6; - uVar4 = uStack_60; - do { - if (uVar4 == 0) { - local_68 = *param_5; - uStack_60 = param_5[1]; - lVar2 = LogRedoForGhostExtents(this,param_1,local_58,uStack_50,&local_68,param_6,param_7); - return lVar2; - } - uVar3 = 0x7fffffff; - if (uVar4 < 0x7fffffff) { - uVar3 = uVar4 & 0xffffffff; - } - uVar1 = uStack_60 >> 0x20; - uStack_60 = CONCAT44((int)uVar1,(int)uVar3); - lVar5 = local_68 + uVar3; - uVar4 = uVar4 - uVar3; - lVar2 = AddRun(this,param_1,(_SRANGE *)&local_68,local_68,0x280,(SmsRun *)0x0,0, - (_SmsRecallMetadataHeader *)&local_48,param_7); - local_68 = lVar5; - } while (-1 < lVar2); + else { + lVar2 = -0x3ffff6fc; } return lVar2; } ``` ## LogValidateEntryHeader ### Match Info |Key|refs-2026-06.sys - refs-2026-07.sys| | :---: | :---: | |diff_type|code,refcount,length,address,called| |ratio|0.75| |i_ratio|0.12| |m_ratio|0.93| |b_ratio|0.73| |match_types|SymbolsHash| ### Function Meta Diff |Key|refs-2026-06.sys|refs-2026-07.sys| | :---: | :---: | :---: | |name|LogValidateEntryHeader|LogValidateEntryHeader| |fullname|LogValidateEntryHeader|LogValidateEntryHeader| |`refcount`|9|8| |`length`|281|283| |`called`||Feature_3155669306__private_IsEnabledDeviceUsage| |calling|LogCoreScanDataRecord
LogReadControlRecord
LogRepairEntryHeader|LogCoreScanDataRecord
LogReadControlRecord
LogRepairEntryHeader| |paramcount|0|0| |`address`|1c0058424|1c005c30c| |sig|undefined LogValidateEntryHeader(void)|undefined LogValidateEntryHeader(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### LogValidateEntryHeader Called Diff ```diff --- LogValidateEntryHeader called +++ LogValidateEntryHeader called @@ -0,0 +1 @@ +Feature_3155669306__private_IsEnabledDeviceUsage ``` ### LogValidateEntryHeader Diff ```diff --- LogValidateEntryHeader +++ LogValidateEntryHeader @@ -1,56 +1,62 @@ undefined8 LogValidateEntryHeader (longlong param_1,longlong param_2,longlong param_3,int *param_4,uint param_5,char param_6 ) { - int iVar1; - uint uVar2; + uint uVar1; + int iVar2; if (((((0x77 < param_5) && (*param_4 == *(int *)(param_1 + 0x2ecc))) && (param_4[1] == *(int *)(param_1 + 0x2ed0))) && - ((iVar1 = *(int *)(param_1 + 0xe50), param_4[3] == iVar1 && (0x77 < (uint)param_4[0x15])))) && - (((uint)param_4[0x15] <= (uint)(param_4[0xe] * iVar1) && + ((iVar2 = *(int *)(param_1 + 0xe50), param_4[3] == iVar2 && (0x77 < (uint)param_4[0x15])))) && + (((uint)param_4[0x15] <= (uint)(param_4[0xe] * iVar2) && ((uint)param_4[0xf] <= (uint)param_4[0xe])))) { if (*(int *)(param_1 + 0xe48) - 4U < 3) { if (param_4[4] != *(int *)(param_1 + 0x28)) { return 0xc03d0202; } if (param_4[5] != *(int *)(param_1 + 0x2c)) { return 0xc03d0202; } if (param_4[6] != *(int *)(param_1 + 0x30)) { return 0xc03d0202; } if (param_4[7] != *(int *)(param_1 + 0x34)) { return 0xc03d0202; } if (*(longlong *)(param_4 + 10) != param_2) { return 0xc03d0202; } if ((param_3 != 0) && (*(longlong *)(param_4 + 0xc) != param_3)) { return 0xc03d0202; } if (*(int *)(param_1 + 0xe48) == 5) { - uVar2 = param_4[8]; - if (*(uint *)(param_1 + 0xe4c) < uVar2) { + uVar1 = param_4[8]; + if (*(uint *)(param_1 + 0xe4c) < uVar1) { if (param_6 == '\0') { - *(uint *)(param_1 + 0xe4c) = uVar2; + *(uint *)(param_1 + 0xe4c) = uVar1; } } - else if (uVar2 < *(uint *)(param_1 + 0xe4c)) { + else if (uVar1 < *(uint *)(param_1 + 0xe4c)) { return 0xc03d0202; } } } - if (param_5 < (uint)(param_4[0xf] * iVar1)) { + if (param_5 < (uint)(param_4[0xf] * iVar2)) { return 0xc03d0201; } - if ((uint)param_4[0x15] <= param_5) { + iVar2 = Feature_3155669306__private_IsEnabledDeviceUsage(); + if (iVar2 == 0) { + if ((uint)param_4[0x15] <= param_5) { + return 0; + } + } + else if (((uint)param_4[0x15] <= param_5) && (0x37 < param_5 - param_4[0x15])) { return 0; } } return 0xc03d0202; } ``` ## RefsSetEndOfFileInfo ### Match Info |Key|refs-2026-06.sys - refs-2026-07.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.49| |i_ratio|0.52| |m_ratio|0.97| |b_ratio|0.82| |match_types|SymbolsHash| ### Function Meta Diff |Key|refs-2026-06.sys|refs-2026-07.sys| | :---: | :---: | :---: | |name|RefsSetEndOfFileInfo|RefsSetEndOfFileInfo| |fullname|RefsSetEndOfFileInfo|RefsSetEndOfFileInfo| |refcount|2|2| |`length`|2311|2190| |`called`|
Expand for full list:
Feature_800271674__private_IsEnabledDeviceUsage
FsRtlTagFileForStorageNotification
MsSetRangeValidState
RefsAddAllocation
RefsBindMinstoreTransaction
RefsCheckpointCurrentTransaction
RefsCreateInternalAttributeStream
RefsDeleteAllocation
RefsDeleteInternalAttributeStream
RefsLookupAllocationEx
RefsPostUsnChangeWithOverrideOptionRefsPrepareForCriticalIo
RefsPrepareToShrinkFileSize
RefsRaiseStatusInternal
RefsSetBothCacheSizes
RefsSnapshotScb
RefsStatusDebug
RefsUpdateFileDupInfo
RefsUpdateScbFromAttribute
RefsUpdateScbFromFileObject
RefsUpdateStandardInformation
RefsWriteFileSizes
RefsZeroEndOfClusterStraddlingEof
WPP_SF_D
|
Expand for full list:
FsRtlTagFileForStorageNotification
MsSetRangeValidState
RefsAddAllocation
RefsBindMinstoreTransaction
RefsCheckpointCurrentTransaction
RefsCreateInternalAttributeStream
RefsDeleteAllocation
RefsDeleteInternalAttributeStream
RefsLookupAllocationEx
RefsPostUsnChangeWithOverrideOption
RefsPrepareForCriticalIoRefsPrepareToShrinkFileSize
RefsRaiseStatusInternal
RefsSetBothCacheSizes
RefsSnapshotScb
RefsStatusDebug
RefsUpdateFileDupInfo
RefsUpdateScbFromAttribute
RefsUpdateScbFromFileObject
RefsUpdateStandardInformation
RefsWriteFileSizes
RefsZeroEndOfClusterStraddlingEof
WPP_SF_D
| |calling|RefsCommonSetInformation|RefsCommonSetInformation| |paramcount|7|7| |`address`|1c0186094|1c0187038| |sig|long __cdecl RefsSetEndOfFileInfo(_IRP_CONTEXT * param_1, _FILE_OBJECT * param_2, _IRP * param_3, _SCB * param_4, _CCB * param_5, uchar param_6, uchar * param_7)|long __cdecl RefsSetEndOfFileInfo(_IRP_CONTEXT * param_1, _FILE_OBJECT * param_2, _IRP * param_3, _SCB * param_4, _CCB * param_5, uchar param_6, uchar * param_7)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### RefsSetEndOfFileInfo Called Diff ```diff --- RefsSetEndOfFileInfo called +++ RefsSetEndOfFileInfo called @@ -1 +0,0 @@ -Feature_800271674__private_IsEnabledDeviceUsage ``` ### RefsSetEndOfFileInfo Diff ```diff --- RefsSetEndOfFileInfo +++ RefsSetEndOfFileInfo @@ -1,383 +1,363 @@ /* long __cdecl RefsSetEndOfFileInfo(struct _IRP_CONTEXT * __ptr64,struct _FILE_OBJECT * __ptr64,struct _IRP * __ptr64,struct _SCB * __ptr64,struct _CCB * __ptr64,unsigned char,unsigned char * __ptr64) */ long __cdecl RefsSetEndOfFileInfo (_IRP_CONTEXT *param_1,_FILE_OBJECT *param_2,_IRP *param_3,_SCB *param_4,_CCB *param_5, uchar param_6,uchar *param_7) { _CC_FILE_SIZES *p_Var1; - longlong lVar2; - _FCB *p_Var3; - ulonglong uVar4; - bool bVar5; + byte bVar2; + longlong lVar3; + _FCB *p_Var4; + ulonglong uVar5; bool bVar6; bool bVar7; - byte bVar8; - int iVar9; + bool bVar8; + char cVar9; long lVar10; - longlong lVar11; - uint uVar12; - _FILE_OBJECT *p_Var13; - ulonglong uVar14; - ulong uVar15; - longlong lVar16; - ulonglong uVar17; - longlong *plVar18; - uchar uVar19; - ulong uVar20; - _SCB *p_Var21; + int iVar11; + longlong lVar12; + uint uVar13; + _FILE_OBJECT *p_Var14; + ulonglong uVar15; + ulong uVar16; + longlong lVar17; + ulonglong uVar18; + longlong *plVar19; + uchar uVar20; + ulong uVar21; + _SCB *p_Var22; uchar local_res20 [8]; uchar in_stack_ffffffffffffff48; - __int64 *p_Var22; + __int64 *p_Var23; void **in_stack_ffffffffffffff58; ulong *in_stack_ffffffffffffff60; __int64 local_58; __uint64 local_50; longlong local_48; longlong local_40; - lVar2 = *(longlong *)(param_4 + 0x20); - p_Var3 = *(_FCB **)(param_4 + 0x78); - bVar8 = (byte)*(uint *)(param_4 + 0x88); - bVar6 = false; - bVar5 = true; + lVar3 = *(longlong *)(param_4 + 0x20); + p_Var4 = *(_FCB **)(param_4 + 0x78); + cVar9 = (char)*(uint *)(param_4 + 0x88); bVar7 = false; - p_Var21 = param_4; + bVar6 = true; + bVar8 = false; + p_Var22 = param_4; if ((*(uint *)(param_4 + 0x88) & 0x20) == 0) { RefsUpdateScbFromAttribute(param_1,param_4,(_ATTRIBUTE_ENUMERATION_CONTEXT *)param_3); - bVar8 = (byte)*(undefined4 *)(param_4 + 0x88); - } - uVar19 = (uchar)p_Var21; - if ((bVar8 & 0x80) != 0) { + cVar9 = (char)*(undefined4 *)(param_4 + 0x88); + } + uVar20 = (uchar)p_Var22; + if (cVar9 < '\0') { lVar10 = -0x3ffffb42; if ((((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)((longlong)WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && (3 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x29))) { - WPP_SF_D(WPP_GLOBAL_Control[3],0x80,&WPP_2a612cb084f737cc666b65cc6d907d4c_Traceguids, + WPP_SF_D(WPP_GLOBAL_Control[3],0x7f,&WPP_3645efd58e5132b0a6aeb06ec081cf60_Traceguids, 0xc00004be); } if (RefsStatusDebugEnabled == '\0') { return -0x3ffffb42; } - uVar15 = 0x234a; + uVar16 = 0x233e; LAB_0: - RefsStatusDebug(lVar10,"FileInfo.c",uVar15); + RefsStatusDebug(lVar10,"FileInfo.c",uVar16); return lVar10; } - uVar4 = **(ulonglong **)(param_3 + 0x18); + uVar5 = **(ulonglong **)(param_3 + 0x18); if ((*(uint *)(param_4 + 0x118) & 0x40) != 0) { return 0; } RefsSnapshotScb(param_1,param_4); if (*(char *)(*(longlong *)(param_3 + 0xb8) + 0x21) != '\0') { lVar10 = -0x3fffff45; if ((((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)((longlong)WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && (3 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x29))) { - WPP_SF_D(WPP_GLOBAL_Control[3],0x81,&WPP_2a612cb084f737cc666b65cc6d907d4c_Traceguids, + WPP_SF_D(WPP_GLOBAL_Control[3],0x80,&WPP_3645efd58e5132b0a6aeb06ec081cf60_Traceguids, 0xc00000bb); } if (RefsStatusDebugEnabled == '\0') { return -0x3fffff45; } - uVar15 = 0x237a; + uVar16 = 0x236e; goto LAB_0; } if (param_5 != (_CCB *)0x0) { *(undefined4 *)(param_1 + 0x188) = *(undefined4 *)(param_5 + 0x54); } - iVar9 = Feature_800271674__private_IsEnabledDeviceUsage(); - if (iVar9 == 0) { - if (*(longlong *)(*(longlong *)(param_4 + 0x80) + 0x1e0) < (longlong)uVar4) { - lVar10 = -0x3ffffff3; - if ((((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)((longlong)WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && - (3 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x29))) { - WPP_SF_D(WPP_GLOBAL_Control[3],0x83,&WPP_2a612cb084f737cc666b65cc6d907d4c_Traceguids, - 0xc000000d); - } - if (RefsStatusDebugEnabled == '\0') { - return -0x3ffffff3; - } - uVar15 = 0x2392; - goto LAB_0; - } - } - else if ((*(longlong *)(*(longlong *)(param_4 + 0x80) + 0x1e0) < (longlong)uVar4) || - ((longlong)uVar4 < 0)) { + if ((*(longlong *)(*(longlong *)(param_4 + 0x80) + 0x1e0) < (longlong)uVar5) || + ((longlong)uVar5 < 0)) { lVar10 = -0x3ffffff3; if ((((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)((longlong)WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && (3 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x29))) { - WPP_SF_D(WPP_GLOBAL_Control[3],0x82,&WPP_2a612cb084f737cc666b65cc6d907d4c_Traceguids, + WPP_SF_D(WPP_GLOBAL_Control[3],0x81,&WPP_3645efd58e5132b0a6aeb06ec081cf60_Traceguids, 0xc000000d); } if (RefsStatusDebugEnabled == '\0') { return -0x3ffffff3; } - uVar15 = 0x238d; + uVar16 = 0x2380; goto LAB_0; } - if (*(ulonglong *)(param_4 + 0x20) == uVar4) goto LAB_1; - bVar6 = true; - if (((longlong)uVar4 < (longlong)*(ulonglong *)(param_4 + 0x20)) && - (lVar10 = RefsPrepareToShrinkFileSize(param_1,param_2,param_4,uVar4), lVar10 != 0)) { + if (*(ulonglong *)(param_4 + 0x20) == uVar5) goto LAB_1; + bVar7 = true; + if (((longlong)uVar5 < (longlong)*(ulonglong *)(param_4 + 0x20)) && + (lVar10 = RefsPrepareToShrinkFileSize(param_1,param_2,param_4,uVar5), lVar10 != 0)) { return lVar10; } - uVar15 = 2; - if ((longlong)uVar4 <= *(longlong *)(param_4 + 0x20)) { - uVar15 = 4; - } - uVar20 = 0; - RefsPostUsnChangeWithOverrideOption(param_1,param_4,uVar15,(_FILE_NAME *)0x0); + uVar16 = 2; + if ((longlong)uVar5 <= *(longlong *)(param_4 + 0x20)) { + uVar16 = 4; + } + uVar21 = 0; + RefsPostUsnChangeWithOverrideOption(param_1,param_4,uVar16,(_FILE_NAME *)0x0); if (*(longlong *)(*(longlong *)(param_4 + 0xe8) + 8) != 0) { if ((*(longlong *)(param_2 + 0x28) == 0) || (*(longlong *)(*(longlong *)(param_2 + 0x28) + 8) == 0)) { - bVar7 = false; - if (((*(uint *)(p_Var3 + 4) & 4) != 0) || ((*(uint *)(param_3 + 0x10) & 2) != 0)) + bVar8 = false; + if (((*(uint *)(p_Var4 + 4) & 4) != 0) || ((*(uint *)(param_3 + 0x10) & 2) != 0)) goto LAB_2; - uVar20 = 0xc011e5b0; - uVar15 = 0; + uVar21 = 0xc011f5b0; + uVar16 = 0; RefsCreateInternalAttributeStream(param_1,param_4,'\0',(_UNICODE_STRING *)&DAT_3); } - bVar7 = true; + bVar8 = true; } LAB_2: - uVar12 = *(uint *)(param_4 + 0x88); - if (((uVar12 & 8) == 0) || ((uVar12 & 0x40) != 0)) { + uVar13 = *(uint *)(param_4 + 0x88); + if (((uVar13 & 8) == 0) || ((uVar13 & 0x40) != 0)) { local_58 = 0; local_res20[0] = '\0'; - if (((*(uint *)(*(longlong *)(param_4 + 0x80) + 0x220) & (uint)lVar2) != 0) && - (lVar2 < (longlong)uVar4)) { - uVar20 = 4; - p_Var22 = &local_58; - lVar16 = lVar2 >> (*(byte *)(*(longlong *)(param_4 + 0x80) + 0x228) & 0x3f); + if (((*(uint *)(*(longlong *)(param_4 + 0x80) + 0x220) & (uint)lVar3) != 0) && + (lVar3 < (longlong)uVar5)) { + uVar21 = 4; + p_Var23 = &local_58; + lVar17 = lVar3 >> (*(byte *)(*(longlong *)(param_4 + 0x80) + 0x228) & 0x3f); RefsLookupAllocationEx - (param_1,param_4,lVar16,4,p_Var22,&local_50,in_stack_ffffffffffffff58, + (param_1,param_4,lVar17,4,p_Var23,&local_50,in_stack_ffffffffffffff58, in_stack_ffffffffffffff60,(uchar *)0x0,(uchar *)0x0,(uchar *)0x0,local_res20, (uchar *)0x0,0); - in_stack_ffffffffffffff48 = (uchar)p_Var22; - uVar15 = (ulong)lVar16; + in_stack_ffffffffffffff48 = (uchar)p_Var23; + uVar16 = (ulong)lVar17; if (local_res20[0] != '\0') { if ((((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)((longlong)WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && (3 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x29))) { - uVar15 = 0xc0120628; - WPP_SF_D(WPP_GLOBAL_Control[3],0x85,&WPP_2a612cb084f737cc666b65cc6d907d4c_Traceguids, + uVar16 = 0xc0121628; + WPP_SF_D(WPP_GLOBAL_Control[3],0x83,&WPP_3645efd58e5132b0a6aeb06ec081cf60_Traceguids, 0xc000a007); } if (RefsStatusDebugEnabled != '\0') { - uVar15 = 0x2423; - RefsStatusDebug(-0x3fff5ff9,"FileInfo.c",0x2423); + uVar16 = 0x2410; + RefsStatusDebug(-0x3fff5ff9,"FileInfo.c",0x2410); } /* WARNING: Subroutine does not return */ - RefsRaiseStatusInternal(param_1,-0x3fff5ff9,uVar15); - } - } - if (((*(uint *)(*(longlong *)(param_4 + 0x80) + 0x220) & (uint)uVar4) != 0) && - ((longlong)uVar4 < lVar2)) { - uVar20 = 4; - p_Var22 = &local_58; - lVar16 = (longlong)uVar4 >> (*(byte *)(*(longlong *)(param_4 + 0x80) + 0x228) & 0x3f); + RefsRaiseStatusInternal(param_1,-0x3fff5ff9,uVar16); + } + } + if (((*(uint *)(*(longlong *)(param_4 + 0x80) + 0x220) & (uint)uVar5) != 0) && + ((longlong)uVar5 < lVar3)) { + uVar21 = 4; + p_Var23 = &local_58; + lVar17 = (longlong)uVar5 >> (*(byte *)(*(longlong *)(param_4 + 0x80) + 0x228) & 0x3f); RefsLookupAllocationEx - (param_1,param_4,lVar16,4,p_Var22,&local_50,in_stack_ffffffffffffff58, + (param_1,param_4,lVar17,4,p_Var23,&local_50,in_stack_ffffffffffffff58, in_stack_ffffffffffffff60,(uchar *)0x0,(uchar *)0x0,(uchar *)0x0,local_res20, (uchar *)0x0,0); - in_stack_ffffffffffffff48 = (uchar)p_Var22; - uVar15 = (ulong)lVar16; + in_stack_ffffffffffffff48 = (uchar)p_Var23; + uVar16 = (ulong)lVar17; if (local_res20[0] != '\0') { if ((((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)((longlong)WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && (3 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x29))) { - uVar15 = 0xc0120628; - WPP_SF_D(WPP_GLOBAL_Control[3],0x86,&WPP_2a612cb084f737cc666b65cc6d907d4c_Traceguids, + uVar16 = 0xc0121628; + WPP_SF_D(WPP_GLOBAL_Control[3],0x84,&WPP_3645efd58e5132b0a6aeb06ec081cf60_Traceguids, 0xc000a007); } if (RefsStatusDebugEnabled != '\0') { - uVar15 = 0x243a; - RefsStatusDebug(-0x3fff5ff9,"FileInfo.c",0x243a); + uVar16 = 0x2427; + RefsStatusDebug(-0x3fff5ff9,"FileInfo.c",0x2427); } /* WARNING: Subroutine does not return */ - RefsRaiseStatusInternal(param_1,-0x3fff5ff9,uVar15); + RefsRaiseStatusInternal(param_1,-0x3fff5ff9,uVar16); } } p_Var1 = (_CC_FILE_SIZES *)(param_4 + 0x18); - lVar16 = *(longlong *)p_Var1; - if (lVar16 < (longlong)uVar4) { + lVar17 = *(longlong *)p_Var1; + if (lVar17 < (longlong)uVar5) { if (*(short *)(param_4 + 0xf4) < 0) { - uVar12 = -*(int *)(param_4 + 0xf0); + uVar13 = -*(int *)(param_4 + 0xf0); *(ulonglong *)p_Var1 = - (longlong)(*(int *)(param_4 + 0xf0) + -1) + uVar4 & (longlong)(int)uVar12; - p_Var21 = param_4; - RefsSetBothCacheSizes((_IRP_CONTEXT *)(ulonglong)uVar12,param_2,p_Var1,param_4); - uVar20 = (ulong)p_Var21; + (longlong)(*(int *)(param_4 + 0xf0) + -1) + uVar5 & (longlong)(int)uVar13; + p_Var22 = param_4; + RefsSetBothCacheSizes((_IRP_CONTEXT *)(ulonglong)uVar13,param_2,p_Var1,param_4); + uVar21 = (ulong)p_Var22; } else { - uVar17 = uVar4; + uVar18 = uVar5; if (((*(uint *)(param_4 + 0x88) & 0x80000) == 0) && - (iVar9 = *(int *)(param_4 + 0xf0), iVar9 != 0)) { - uVar17 = (longlong)(iVar9 + -1) + uVar4 & (longlong)-iVar9; - } - uVar14 = (ulonglong)*(uint *)(*(longlong *)(param_4 + 0x80) + 0x220); - bVar8 = *(byte *)(*(longlong *)(param_4 + 0x80) + 0x228); - lVar11 = (longlong)((uVar14 - lVar16) + uVar17) >> (bVar8 & 0x3f); - lVar16 = (longlong)(uVar14 + lVar16) >> (bVar8 & 0x3f); - RefsAddAllocation(param_1,param_2,param_4,lVar16,lVar11,0,(_CCB *)0x0); - in_stack_ffffffffffffff48 = (uchar)lVar11; - uVar20 = (ulong)lVar16; + (iVar11 = *(int *)(param_4 + 0xf0), iVar11 != 0)) { + uVar18 = (longlong)(iVar11 + -1) + uVar5 & (longlong)-iVar11; + } + uVar15 = (ulonglong)*(uint *)(*(longlong *)(param_4 + 0x80) + 0x220); + bVar2 = *(byte *)(*(longlong *)(param_4 + 0x80) + 0x228); + lVar12 = (longlong)((uVar15 - lVar17) + uVar18) >> (bVar2 & 0x3f); + lVar17 = (longlong)(uVar15 + lVar17) >> (bVar2 & 0x3f); + RefsAddAllocation(param_1,param_2,param_4,lVar17,lVar12,0,(_CCB *)0x0); + in_stack_ffffffffffffff48 = (uchar)lVar12; + uVar21 = (ulong)lVar17; } } else { - if ((*(short *)(param_4 + 0xf4) < 0) && ((longlong)uVar4 < *(longlong *)(param_4 + 0x20))) { - uVar17 = ((ulonglong)*(uint *)(param_4 + 0xf0) - 1) + uVar4; - if ((longlong)uVar17 < lVar16) { - lVar11 = (lVar16 >> (*(byte *)(*(longlong *)(param_4 + 0x80) + 0x228) & 0x3f)) + -1; - lVar16 = (longlong)((longlong)(int)-*(uint *)(param_4 + 0xf0) & uVar17) >> + if ((*(short *)(param_4 + 0xf4) < 0) && ((longlong)uVar5 < *(longlong *)(param_4 + 0x20))) { + uVar18 = ((ulonglong)*(uint *)(param_4 + 0xf0) - 1) + uVar5; + if ((longlong)uVar18 < lVar17) { + lVar12 = (lVar17 >> (*(byte *)(*(longlong *)(param_4 + 0x80) + 0x228) & 0x3f)) + -1; + lVar17 = (longlong)((longlong)(int)-*(uint *)(param_4 + 0xf0) & uVar18) >> (*(byte *)(*(longlong *)(param_4 + 0x80) + 0x228) & 0x3f); - RefsDeleteAllocation(param_1,param_2,param_4,lVar16,lVar11,'\0'); - in_stack_ffffffffffffff48 = (uchar)lVar11; - uVar20 = (ulong)lVar16; + RefsDeleteAllocation(param_1,param_2,param_4,lVar17,lVar12,'\0'); + in_stack_ffffffffffffff48 = (uchar)lVar12; + uVar21 = (ulong)lVar17; } } LOCK(); *(uint *)(param_4 + 0x88) = *(uint *)(param_4 + 0x88) | 1; UNLOCK(); } - if ((*(uint *)(p_Var3 + 4) & 4) != 0) { - RefsPrepareForCriticalIo(param_1,param_3,param_4,uVar20); + if ((*(uint *)(p_Var4 + 4) & 4) != 0) { + RefsPrepareForCriticalIo(param_1,param_3,param_4,uVar21); FsRtlTagFileForStorageNotification(param_1,param_3,param_4,1); } if ((*(uint *)(param_4 + 0x88) & 0x10) == 0) { LOCK(); *(uint *)(param_4 + 0x88) = *(uint *)(param_4 + 0x88) | 0x4000; UNLOCK(); } - uVar17 = (ulonglong)*(uint *)(*(longlong *)(param_4 + 0x80) + 0x220); - bVar8 = *(byte *)(*(longlong *)(param_4 + 0x80) + 0x228); - lVar16 = (longlong)(*(longlong *)(param_4 + 0x20) + uVar17) >> (bVar8 & 0x3f); - lVar11 = (longlong)(uVar17 + uVar4) >> (bVar8 & 0x3f); - if ((lVar16 < lVar11) && ((*(uint *)(p_Var3 + 4) & 4) == 0)) { + uVar18 = (ulonglong)*(uint *)(*(longlong *)(param_4 + 0x80) + 0x220); + bVar2 = *(byte *)(*(longlong *)(param_4 + 0x80) + 0x228); + lVar12 = (longlong)(*(longlong *)(param_4 + 0x20) + uVar18) >> (bVar2 & 0x3f); + lVar17 = (longlong)(uVar18 + uVar5) >> (bVar2 & 0x3f); + if ((lVar12 < lVar17) && ((*(uint *)(p_Var4 + 4) & 4) == 0)) { RefsBindMinstoreTransaction(param_1); - plVar18 = &local_48; - local_40 = lVar11 - lVar16; - local_48 = lVar16; - iVar9 = MsSetRangeValidState - (*(undefined8 *)(param_1 + 0x18),*(undefined8 *)(param_4 + 0x170),plVar18,0) - ; - uVar15 = (ulong)plVar18; - if (iVar9 < 0) { + plVar19 = &local_48; + local_40 = lVar17 - lVar12; + local_48 = lVar12; + iVar11 = MsSetRangeValidState + (*(undefined8 *)(param_1 + 0x18),*(undefined8 *)(param_4 + 0x170),plVar19,0 + ); + uVar16 = (ulong)plVar19; + if (iVar11 < 0) { if ((((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)((longlong)WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && (3 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x29))) { - uVar15 = 0xc0120628; - WPP_SF_D(WPP_GLOBAL_Control[3],0x87,&WPP_2a612cb084f737cc666b65cc6d907d4c_Traceguids,iVar9 - ); + uVar16 = 0xc0121628; + WPP_SF_D(WPP_GLOBAL_Control[3],0x85,&WPP_3645efd58e5132b0a6aeb06ec081cf60_Traceguids, + iVar11); } if (RefsStatusDebugEnabled != '\0') { - uVar15 = 0x24d4; - RefsStatusDebug(iVar9,"FileInfo.c",0x24d4); + uVar16 = 0x24c1; + RefsStatusDebug(iVar11,"FileInfo.c",0x24c1); } /* WARNING: Subroutine does not return */ - RefsRaiseStatusInternal(param_1,iVar9,uVar15); - } - } - uVar19 = '\x03'; - *(ulonglong *)(param_4 + 0x20) = uVar4; - *(ulonglong *)(param_4 + 0x28) = uVar4; + RefsRaiseStatusInternal(param_1,iVar11,uVar16); + } + } + uVar20 = '\x03'; + *(ulonglong *)(param_4 + 0x20) = uVar5; + *(ulonglong *)(param_4 + 0x28) = uVar5; RefsWriteFileSizes(param_1,param_4,(_CC_FILE_SIZES *)0x0,3,in_stack_ffffffffffffff48); - bVar5 = true; + bVar6 = true; } else { - if (0x20000 < (longlong)uVar4) { + if (0x20000 < (longlong)uVar5) { if ((((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)((longlong)WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && (3 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x29))) { - uVar15 = 0xc0120628; - WPP_SF_D(WPP_GLOBAL_Control[3],0x84,&WPP_2a612cb084f737cc666b65cc6d907d4c_Traceguids, + uVar16 = 0xc0121628; + WPP_SF_D(WPP_GLOBAL_Control[3],0x82,&WPP_3645efd58e5132b0a6aeb06ec081cf60_Traceguids, 0xc0000427); } if (RefsStatusDebugEnabled != '\0') { - uVar15 = 0x23d7; - RefsStatusDebug(-0x3ffffbd9,"FileInfo.c",0x23d7); + uVar16 = 0x23c4; + RefsStatusDebug(-0x3ffffbd9,"FileInfo.c",0x23c4); } /* WARNING: Subroutine does not return */ - RefsRaiseStatusInternal(param_1,-0x3ffffbd9,uVar15); - } - if (*(longlong *)(param_4 + 0x18) < (longlong)uVar4) { - *(ulonglong *)(param_4 + 0x18) = uVar4; + RefsRaiseStatusInternal(param_1,-0x3ffffbd9,uVar16); + } + if (*(longlong *)(param_4 + 0x18) < (longlong)uVar5) { + *(ulonglong *)(param_4 + 0x18) = uVar5; } else { LOCK(); *(uint *)(param_4 + 0x88) = *(uint *)(param_4 + 0x88) | 1; UNLOCK(); - uVar12 = *(uint *)(param_4 + 0x88); - } - if ((uVar12 & 0x10) == 0) { + uVar13 = *(uint *)(param_4 + 0x88); + } + if ((uVar13 & 0x10) == 0) { LOCK(); *(uint *)(param_4 + 0x88) = *(uint *)(param_4 + 0x88) | 0x4000; UNLOCK(); } - uVar19 = '\x03'; - *(ulonglong *)(param_4 + 0x20) = uVar4; - *(ulonglong *)(param_4 + 0x28) = uVar4; + uVar20 = '\x03'; + *(ulonglong *)(param_4 + 0x20) = uVar5; + *(ulonglong *)(param_4 + 0x28) = uVar5; RefsWriteFileSizes(param_1,param_4,(_CC_FILE_SIZES *)0x0,3,in_stack_ffffffffffffff48); - bVar5 = false; + bVar6 = false; } LAB_1: if (param_5 == (_CCB *)0x0) { *(uint *)(param_2 + 0x50) = *(uint *)(param_2 + 0x50) | 0x1000; } else { *(uint *)(param_5 + 4) = *(uint *)(param_5 + 4) | 0x700000; } if ((*(uint *)(param_3 + 0x10) & 2) != 0) { - *(uint *)(p_Var3 + 4) = *(uint *)(p_Var3 + 4) | 0x40000; - } - p_Var13 = param_2; + *(uint *)(p_Var4 + 4) = *(uint *)(p_Var4 + 4) | 0x40000; + } + p_Var14 = param_2; RefsUpdateScbFromFileObject(param_2,param_4,param_6); - if (((*(uint *)(p_Var3 + 4) & 0x10) != 0) && - (p_Var13 = (_FILE_OBJECT *)param_1, RefsUpdateStandardInformation(param_1,p_Var3), + if (((*(uint *)(p_Var4 + 4) & 0x10) != 0) && + (p_Var14 = (_FILE_OBJECT *)param_1, RefsUpdateStandardInformation(param_1,p_Var4), (*(uint *)(param_3 + 0x10) & 2) == 0)) { *(uint *)(param_5 + 4) = *(uint *)(param_5 + 4) | 0x10000; } - *(uint *)(p_Var3 + 4) = *(uint *)(p_Var3 + 4) & 0xffffffef; - if (bVar6) { + *(uint *)(p_Var4 + 4) = *(uint *)(p_Var4 + 4) & 0xffffffef; + if (bVar7) { LOCK(); *(uint *)(param_4 + 0x88) = *(uint *)(param_4 + 0x88) & 0xfffffffb; UNLOCK(); } - if (bVar7) { - if (*(longlong *)(param_4 + 0x20) < lVar2) { - p_Var13 = (_FILE_OBJECT *)param_1; + if (bVar8) { + if (*(longlong *)(param_4 + 0x20) < lVar3) { + p_Var14 = (_FILE_OBJECT *)param_1; RefsCheckpointCurrentTransaction(param_1); } - p_Var21 = param_4; + p_Var22 = param_4; RefsSetBothCacheSizes - ((_IRP_CONTEXT *)p_Var13,param_2,(_CC_FILE_SIZES *)(param_4 + 0x18),param_4); - uVar19 = (uchar)p_Var21; + ((_IRP_CONTEXT *)p_Var14,param_2,(_CC_FILE_SIZES *)(param_4 + 0x18),param_4); + uVar20 = (uchar)p_Var22; } RefsCheckpointCurrentTransaction(param_1); - uVar4 = *(ulonglong *)(param_4 + 0x20); - if ((((*(uint *)(*(longlong *)(param_4 + 0x80) + 0x220) + uVar4 & - (longlong)*(int *)(*(longlong *)(param_4 + 0x80) + 0x224)) != uVar4) && - ((longlong)uVar4 < lVar2)) && (bVar5)) { + uVar5 = *(ulonglong *)(param_4 + 0x20); + if ((((*(uint *)(*(longlong *)(param_4 + 0x80) + 0x220) + uVar5 & + (longlong)*(int *)(*(longlong *)(param_4 + 0x80) + 0x224)) != uVar5) && + ((longlong)uVar5 < lVar3)) && (bVar6)) { RefsZeroEndOfClusterStraddlingEof(param_1,param_4,param_3); } RefsCheckpointCurrentTransaction(param_1); if (param_6 != '\0') { - RefsUpdateFileDupInfo(param_1,p_Var3,param_5); - } - if (*(int *)(param_4 + 0x90) != 0) { - return 0; - } - if (*(longlong *)(param_4 + 0xe0) == 0) { - return 0; - } - RefsDeleteInternalAttributeStream(param_1,param_4,0,uVar19); + RefsUpdateFileDupInfo(param_1,p_Var4,param_5); + } + if ((*(int *)(param_4 + 0x90) == 0) && (*(longlong *)(param_4 + 0xe0) != 0)) { + RefsDeleteInternalAttributeStream(param_1,param_4,0,uVar20); + } return 0; } ``` ## RefsFinishBuffers ### Match Info |Key|refs-2026-06.sys - refs-2026-07.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.95| |i_ratio|0.51| |m_ratio|0.58| |b_ratio|0.58| |match_types|SymbolsHash| ### Function Meta Diff |Key|refs-2026-06.sys|refs-2026-07.sys| | :---: | :---: | :---: | |name|RefsFinishBuffers|RefsFinishBuffers| |fullname|RefsFinishBuffers|RefsFinishBuffers| |refcount|4|4| |`length`|435|1087| |`called`|MsFreeChecksumContext
MsPersistReserveAllocationAndGenerateChecksum
RefsCommitCurrentTransaction
RefsDeallocateCompressionBuffer
RefsFindRollbackStructByType
RefsTraceNonCachedIo|
Expand for full list:
MsFreeChecksumContext
MsGetStreamSummary
MsPersistReserveAllocationAndGenerateChecksum
MsVerifyOrRepairFromChecksum
NTOSKRNL.EXE::ExReleaseResourceLite
NTOSKRNL.EXE::IoGetTopLevelIrp
NTOSKRNL.EXE::RtlCaptureStackBackTrace
RefsBindMinstoreTransactionNoRaise
RefsCommitCurrentTransaction
RefsCopyIntoMdl
RefsDeallocateCompressionBufferRefsFindRollbackStructByType
RefsReleaseFcb
RefsTraceNonCachedIo
RefsWriteUsnJournalChanges
| |calling|RefsCommonIoCompletionWorker
RefsNonCachedIo|RefsCommonIoCompletionWorker
RefsNonCachedIo| |paramcount|4|4| |`address`|1c019b274|1c019c234| |sig|long __cdecl RefsFinishBuffers(_IRP_CONTEXT * param_1, _IRP * param_2, _SCB * param_3, COMPRESSION_CONTEXT * param_4)|long __cdecl RefsFinishBuffers(_IRP_CONTEXT * param_1, _IRP * param_2, _SCB * param_3, COMPRESSION_CONTEXT * param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### RefsFinishBuffers Called Diff ```diff --- RefsFinishBuffers called +++ RefsFinishBuffers called @@ -1,0 +2 @@ +MsGetStreamSummary @@ -2,0 +4,5 @@ +MsVerifyOrRepairFromChecksum +NTOSKRNL.EXE::ExReleaseResourceLite +NTOSKRNL.EXE::IoGetTopLevelIrp +NTOSKRNL.EXE::RtlCaptureStackBackTrace +RefsBindMinstoreTransactionNoRaise @@ -3,0 +10 @@ +RefsCopyIntoMdl @@ -5,0 +13 @@ +RefsReleaseFcb @@ -6,0 +15 @@ +RefsWriteUsnJournalChanges ``` ### RefsFinishBuffers Diff ```diff --- RefsFinishBuffers +++ RefsFinishBuffers @@ -1,347 +1,347 @@ /* long __cdecl RefsFinishBuffers(struct _IRP_CONTEXT * __ptr64,struct _IRP * __ptr64,struct _SCB * __ptr64,struct COMPRESSION_CONTEXT * __ptr64) */ long __cdecl RefsFinishBuffers(_IRP_CONTEXT *param_1,_IRP *param_2,_SCB *param_3,COMPRESSION_CONTEXT *param_4) { uint *puVar1; longlong *plVar2; longlong lVar3; _IRP_CONTEXT *p_Var4; _FCB *p_Var5; longlong lVar6; longlong *plVar7; code *pcVar8; undefined1 *puVar9; uchar uVar10; int iVar11; uint uVar12; uint uVar13; long lVar14; uint extraout_EAX; _ROLLBACK_STRUCT *p_Var15; undefined7 extraout_var; _FCB *p_Var16; undefined8 *puVar17; _IRP_CONTEXT *p_Var18; COMPRESSION_CONTEXT *pCVar19; COMPRESSION_CONTEXT *pCVar20; undefined1 *puVar21; _IRP_CONTEXT *p_Var22; ulong uVar23; longlong lVar24; int iVar25; COMPRESSION_CONTEXT *pCVar26; undefined1 auStackY_a0 [8]; undefined1 auStackY_98 [16]; undefined4 local_68; undefined4 uStack_64; undefined4 uStack_60; undefined4 uStack_5c; - undefined8 uStack_58; + undefined8 local_58; undefined8 uStack_50; - undefined8 uStack_48; + undefined8 local_48; undefined8 uStack_40; - longlong lStack_38; + longlong local_38; lVar3 = *(longlong *)(param_3 + 0x80); pCVar19 = (COMPRESSION_CONTEXT *)0x0; if (*(int *)(param_4 + 100) == 0) { RefsTraceNonCachedIo(6,param_2,param_3,param_4,0); if (param_1[0x28] == (_IRP_CONTEXT)0x3) { iVar11 = RefsBindMinstoreTransactionNoRaise(param_1); if (((-1 < iVar11) && (iVar11 = MsVerifyOrRepairFromChecksum (*(undefined8 *)(param_1 + 0x18),*(undefined8 *)(param_3 + 0x170), *(undefined8 *)(param_4 + 0x80),*(undefined8 *)param_4), -1 < iVar11) ) && (*(_MDL **)(param_4 + 0x10) != (_MDL *)0x0)) { uVar23 = *(ulong *)(param_4 + 0x88); if (*(longlong *)(param_4 + 0x88) < 0) { *(undefined8 *)(param_4 + 0x88) = 0; pCVar19 = (COMPRESSION_CONTEXT *)(ulonglong)-uVar23; uVar23 = 0; } RefsCopyIntoMdl(param_1,*(_MDL **)(param_4 + 0x10),*(int *)(param_4 + 0x94) - (int)pCVar19, uVar23,pCVar19 + *(longlong *)param_4); } } else { if (((*(uint *)(*(longlong *)(param_1 + 0x48) + 0x10) & 2) != 0) && (param_1 == *(_IRP_CONTEXT **)(param_1 + 0x68))) { IoGetTopLevelIrp(); } pCVar20 = param_4 + 0x120; local_68 = *(undefined4 *)(param_4 + 0x38); uStack_64 = *(undefined4 *)(param_4 + 0x3c); uStack_60 = *(undefined4 *)(param_4 + 0x40); uStack_5c = *(undefined4 *)(param_4 + 0x44); iVar11 = MsPersistReserveAllocationAndGenerateChecksum (*(undefined8 *)(param_3 + 0x170),*(undefined8 *)(param_1 + 0x18),&local_68 ,*(longlong *)(param_4 + 0x38) << ((byte)*(undefined4 *)(lVar3 + 0x228) & 0x3f)); MsFreeChecksumContext(); if (-1 < iVar11) { pCVar26 = (COMPRESSION_CONTEXT *)0x0; if ((*(short *)(param_3 + 0xf4) < 0) && ((*(uint *)(param_3 + 0x88) & 0x10) != 0)) { pCVar20 = *(COMPRESSION_CONTEXT **)(param_3 + 0x170); - uStack_58 = 0; + local_58 = 0; uStack_50 = 0; - lStack_38 = 0; - uStack_48 = 0; + local_38 = 0; + local_48 = 0; uStack_40 = 0; iVar11 = MsGetStreamSummary(*(undefined8 *)(param_1 + 0x18)); - if ((-1 < iVar11) && (*(longlong *)(*(longlong *)(param_3 + 0x78) + 0x90) != lStack_38)) { + if ((-1 < iVar11) && (*(longlong *)(*(longlong *)(param_3 + 0x78) + 0x90) != local_38)) { pCVar20 = *(COMPRESSION_CONTEXT **)(param_1 + 0x48); if ((*(uint *)(pCVar20 + 0x10) & 2) == 0) { puVar1 = (uint *)(*(longlong *) (*(longlong *)(*(longlong *)(pCVar20 + 0xb8) + 0x30) + 0x20) + 4); *puVar1 = *puVar1 | 0x10000; } else { puVar1 = (uint *)(*(longlong *)(param_3 + 0x78) + 4); *puVar1 = *puVar1 | 0x40000; } - *(longlong *)(*(longlong *)(param_3 + 0x78) + 0x90) = lStack_38; + *(longlong *)(*(longlong *)(param_3 + 0x78) + 0x90) = local_38; *(uint *)(*(longlong *)(param_3 + 0x78) + 0xa8) = *(uint *)(*(longlong *)(param_3 + 0x78) + 0xa8) | 0x40000000; *(uint *)(*(longlong *)(param_3 + 0x78) + 4) = *(uint *)(*(longlong *)(param_3 + 0x78) + 4) | 0x10; } } if (*(int *)(param_1 + 0x17c) != 0 || *(int *)(param_1 + 0x178) != 0) { RefsWriteUsnJournalChanges(param_1); } p_Var18 = param_1 + 400; p_Var15 = (_ROLLBACK_STRUCT *)0x0; while (p_Var15 = RefsFindRollbackStructByType((_LIST_ENTRY *)p_Var18,(ulong)pCVar20,p_Var15) , p_Var15 != (_ROLLBACK_STRUCT *)0x0) { lVar24 = *(longlong *)(p_Var15 + 0x30); if (lVar24 != 0) { *(undefined8 *)(p_Var15 + 0x18) = *(undefined8 *)(lVar24 + 0x18); *(undefined8 *)(p_Var15 + 0x20) = *(undefined8 *)(lVar24 + 0x20); *(undefined8 *)(p_Var15 + 0x28) = *(undefined8 *)(lVar24 + 0x28); *(uint *)(p_Var15 + 0x38) = *(uint *)(lVar24 + 0x88) & 0x248; } } RefsCommitCurrentTransaction(param_1,'\0'); if ((*(uint *)(param_1 + 4) >> 0xd & 1) != 0) { *(uint *)(param_1 + 4) = *(uint *)(param_1 + 4) & 0xffffcfff; p_Var15 = (_ROLLBACK_STRUCT *)(*(longlong *)(param_3 + 0x80) + 0x5a0); RtlCaptureStackBackTrace(0,9); ExReleaseResourceLite(*(longlong *)(param_3 + 0x80) + 0x4f0); } p_Var18 = param_1 + 0x70; while (p_Var22 = *(_IRP_CONTEXT **)p_Var18, p_Var22 != p_Var18) { p_Var5 = *(_FCB **)(param_3 + 0x78); if ((_FCB *)(p_Var22 + -0x48) == p_Var5) { p_Var16 = p_Var5 + 0x48; lVar24 = *(longlong *)p_Var16; if ((*(_FCB **)(lVar24 + 8) != p_Var16) || (plVar2 = *(longlong **)(p_Var5 + 0x50), (_FCB *)*plVar2 != p_Var16)) goto LAB_0; *plVar2 = lVar24; pCVar26 = (COMPRESSION_CONTEXT *)0x1; *(longlong **)(lVar24 + 8) = plVar2; } else { RefsReleaseFcb(param_1,(_FCB *)(p_Var22 + -0x48)); } } if ((char)pCVar26 != '\0') { lVar24 = *(longlong *)(param_3 + 0x78); puVar17 = (undefined8 *)(lVar24 + 0x48); if (*(_IRP_CONTEXT **)(p_Var22 + 8) != p_Var18) { LAB_0: pcVar8 = (code *)swi(0x29); (*pcVar8)(3); puVar21 = auStackY_a0; p_Var22 = param_1; do { ExAcquireFastMutex(*(longlong *)(p_Var22 + 0x60) + 8); ExAcquireFastMutex(*(longlong *)(param_1 + 0xb0) + 0x430); lVar24 = *(longlong *)(p_Var22 + 0xe0); iVar25 = (int)lVar3; if (((lVar24 != 0) && ((*(uint *)(*(longlong *)(param_1 + 0xb0) + 4) & 0x80000) != 0)) && ((*(int *)(pCVar19 + 0x10) != iVar25 || (*(int *)(pCVar19 + 0x14) != iVar25)))) { lVar6 = *(longlong *)(lVar24 + 0x58); if (*(longlong *)(p_Var22 + 0xd8) < lVar6) { *(uint *)(p_Var22 + 4) = *(uint *)(p_Var22 + 4) | 0x800000; *(longlong *)(p_Var22 + 0xd8) = lVar6; } plVar2 = (longlong *)(lVar24 + 0x20); lVar6 = *plVar2; if (*(int *)(lVar24 + 0x68) < iVar25) { *(longlong *)(lVar24 + 0x68) = lVar3; if (lVar6 != 0) { if ((*(longlong **)(lVar6 + 8) != plVar2) || (p_Var15 = *(_ROLLBACK_STRUCT **)(lVar24 + 0x28), *(longlong **)p_Var15 != plVar2)) goto LAB_1; *(longlong *)p_Var15 = lVar6; *(_ROLLBACK_STRUCT **)(lVar6 + 8) = p_Var15; lVar6 = *(longlong *)(lVar24 + 0x10); *plVar2 = lVar3; plVar2 = (longlong *)(lVar24 + 0x10); if (lVar6 != 0) { if ((*(longlong **)(lVar6 + 8) != plVar2) || (plVar7 = *(longlong **)(lVar24 + 0x18), (longlong *)*plVar7 != plVar2)) goto LAB_1; *plVar7 = lVar6; *(longlong **)(lVar6 + 8) = plVar7; *plVar2 = lVar3; } } } else { if (lVar6 != 0) { if ((*(longlong **)(lVar6 + 8) != plVar2) || (p_Var15 = *(_ROLLBACK_STRUCT **)(lVar24 + 0x28), *(longlong **)p_Var15 != plVar2)) goto LAB_1; *(longlong *)p_Var15 = lVar6; *(_ROLLBACK_STRUCT **)(lVar6 + 8) = p_Var15; plVar7 = (longlong *)(lVar24 + 0x10); p_Var15 = (_ROLLBACK_STRUCT *)*plVar7; if (p_Var15 != (_ROLLBACK_STRUCT *)0x0) { if ((*(longlong **)(p_Var15 + 8) != plVar7) || (puVar17 = *(undefined8 **)(lVar24 + 0x18), (longlong *)*puVar17 != plVar7) ) goto LAB_1; *puVar17 = p_Var15; *(undefined8 **)(p_Var15 + 8) = puVar17; *plVar7 = lVar3; } } lVar6 = *(longlong *)(param_1 + 0xb0); p_Var15 = *(_ROLLBACK_STRUCT **)(lVar6 + 0x428); if (*(longlong *)p_Var15 != lVar6 + 0x420) { LAB_1: uVar10 = (uchar)p_Var15; pcVar8 = (code *)swi(0x29); uVar12 = (*pcVar8)(3); puVar21 = auStackY_98; LAB_2: uVar13 = uVar12; *(longlong *)(param_3 + 0x408) = lVar3; *(longlong *)(param_3 + 0x410) = lVar3; *(longlong *)(param_3 + 0x418) = lVar3; *(uint *)(param_1 + 0x78) = *(uint *)(param_1 + 0x78) & 0xdfffffff; if (*(int *)(param_3 + 0xa74) == iVar25) { - *(undefined8 *)(puVar21 + -8) = 0x1c01c34ce; + *(undefined8 *)(puVar21 + -8) = 0x1c01c4428; RefsNotifyNewUsn(p_Var18,(_VCB *)param_3,uVar10); *(uint *)(param_1 + 0x74) = *(uint *)(param_1 + 0x74) & 0xffffcfff; - *(undefined8 *)(puVar21 + -8) = 0x1c01c34ec; + *(undefined8 *)(puVar21 + -8) = 0x1c01c4446; RtlCaptureStackBackTrace(0,9,param_3 + 0x5a0); - *(undefined8 *)(puVar21 + -8) = 0x1c01c34ff; + *(undefined8 *)(puVar21 + -8) = 0x1c01c4459; uVar13 = ExReleaseResourceLite(param_3 + 0x4f0); puVar9 = puVar21; LAB_3: puVar21 = puVar9; if ((*(int *)(param_3 + 0xa74) == iVar25) && (uVar13 = *(uint *)(param_1 + 0x74), (uVar13 >> 0xc & 1) != 0)) { *(uint *)(param_1 + 0x74) = uVar13 & 0xffffcfff; - *(undefined8 *)(puVar21 + -8) = 0x1c01c3529; + *(undefined8 *)(puVar21 + -8) = 0x1c01c4483; RtlCaptureStackBackTrace(0,9,param_3 + 0x5a0); - *(undefined8 *)(puVar21 + -8) = 0x1c01c353c; + *(undefined8 *)(puVar21 + -8) = 0x1c01c4496; uVar13 = ExReleaseResourceLite(param_3 + 0x4f0); *(uint *)(param_1 + 0x74) = *(uint *)(param_1 + 0x74) & 0xffffcfff; } } *(uint *)(param_1 + 0x74) = *(uint *)(param_1 + 0x74) & 0xffffefff; lVar24 = *(longlong *)(param_1 + 0xd8); uVar12 = *(uint *)(lVar24 + 8); if ((((uVar12 & 8) != 0) && (uVar13 = DAT_4, (DAT_4 & 1) == 0)) && (*(int *)(param_1 + 0x80) == iVar25)) { - *(undefined8 *)(puVar21 + -8) = 0x1c019e7b0; + *(undefined8 *)(puVar21 + -8) = 0x1c019f770; uVar10 = RefsIsModifyingTransactionActive(p_Var18); uVar13 = (uint)CONCAT71(extraout_var,uVar10); if ((uVar10 != '\0') || ((*(uint *)(param_1 + 0x78) & 0x40000000) != 0)) { *(uint *)(lVar24 + 8) = uVar12 | 0x400; *(uint *)(param_1 + 0x78) = *(uint *)(param_1 + 0x78) & 0xbfffffff; } } p_Var18 = *(_IRP_CONTEXT **)(param_1 + 0x88); if (p_Var18 != (_IRP_CONTEXT *)0x0) { - *(undefined8 *)(puVar21 + -8) = 0x1c019e80d; + *(undefined8 *)(puVar21 + -8) = 0x1c019f7cd; uVar12 = MsCommitTransaction(); uVar13 = uVar12; if ((char)iVar11 == '\0') { p_Var18 = *(_IRP_CONTEXT **)(param_1 + 0x88); - *(undefined8 *)(puVar21 + -8) = 0x1c019e81d; + *(undefined8 *)(puVar21 + -8) = 0x1c019f7dd; uVar13 = MsDeleteTransactionContext(); *(longlong *)(param_1 + 0x88) = lVar3; } if ((int)uVar12 < 0) { - lVar14 = FUN_1c01c354d(); + lVar14 = FUN_1c01c44a7(); return lVar14; } } p_Var22 = *(_IRP_CONTEXT **)(param_1 + 0x200); while (p_Var22 != param_1 + 0x200) { p_Var4 = *(_IRP_CONTEXT **)p_Var22; - *(undefined8 *)(puVar21 + -8) = 0x1c019e842; + *(undefined8 *)(puVar21 + -8) = 0x1c019f802; RefsProcessRollbackStruct(p_Var18,(_ROLLBACK_STRUCT *)(p_Var22 + -8),1); p_Var22 = p_Var4; uVar13 = extraout_EAX; } return uVar13; } *plVar2 = lVar6 + 0x420; *(_ROLLBACK_STRUCT **)(lVar24 + 0x28) = p_Var15; *(longlong **)p_Var15 = plVar2; *(longlong **)(lVar6 + 0x428) = plVar2; if (*(int *)(p_Var22 + 0x18) == iVar25) { plVar2 = (longlong *)(lVar24 + 0x10); lVar6 = *(longlong *)(*(longlong *)(param_1 + 0xb0) + 0x468); plVar7 = *(longlong **)(lVar6 + 8); if (*plVar7 != lVar6) goto LAB_1; *plVar2 = lVar6; *(longlong **)(lVar24 + 0x18) = plVar7; *plVar7 = (longlong)plVar2; *(longlong **)(lVar6 + 8) = plVar2; } } } ExReleaseFastMutex(*(longlong *)(param_1 + 0xb0) + 0x430); ExReleaseFastMutex(*(longlong *)(p_Var22 + 0x60) + 8); if (pCVar19 == pCVar26) { *(longlong *)(pCVar19 + 8) = 0; *(longlong *)(pCVar19 + 0x10) = 0; *(longlong *)(pCVar19 + 0x18) = 0; } else { *(longlong *)param_4 = *(longlong *)pCVar19; ExFreePoolWithTag(pCVar19,0); pCVar19 = param_4; } do { param_4 = pCVar19; uVar10 = (uchar)p_Var15; pCVar19 = *(COMPRESSION_CONTEXT **)param_4; if (pCVar19 == (COMPRESSION_CONTEXT *)0x0) { uVar13 = 0; puVar9 = auStackY_a0; uVar12 = 0; if ((*(uint *)(param_1 + 0x78) & 0x20000000) == 0) goto LAB_3; goto LAB_2; } p_Var22 = *(_IRP_CONTEXT **)(pCVar19 + 8); } while (p_Var22 == (_IRP_CONTEXT *)0x0); } while( true ); } *puVar17 = p_Var22; *(_IRP_CONTEXT **)(lVar24 + 0x50) = p_Var18; *(undefined8 **)(p_Var22 + 8) = puVar17; *(undefined8 **)p_Var18 = puVar17; } RefsDeallocateCompressionBuffer(p_Var22,param_2,param_4); } *(undefined8 *)(param_4 + 0x40) = 0; } } else { iVar11 = 0; } return iVar11; } ``` ## LogCoreScanDataRecord ### Match Info |Key|refs-2026-06.sys - refs-2026-07.sys| | :---: | :---: | |diff_type|code,refcount,length,address,called| |ratio|0.47| |i_ratio|0.36| |m_ratio|0.99| |b_ratio|0.56| |match_types|SymbolsHash| ### Function Meta Diff |Key|refs-2026-06.sys|refs-2026-07.sys| | :---: | :---: | :---: | |name|LogCoreScanDataRecord|LogCoreScanDataRecord| |fullname|LogCoreScanDataRecord|LogCoreScanDataRecord| |`refcount`|3|2| |`length`|1212|1229| |`called`|LogCoreFetchDataRecord
LogGetNextRecordLsn
LogRepairEntryHeader
LogValidateEntryHeader
LogVerifyChecksumEntryHeader
NTOSKRNL.EXE::ExAllocatePoolWithTag
NTOSKRNL.EXE::ExFreePoolWithTag
_guard_dispatch_icall
memmove|
Expand for full list:
Feature_1912855864__private_IsEnabledDeviceUsage
LogCoreFetchDataRecord
LogGetNextRecordLsn
LogRepairEntryHeader
LogValidateEntryHeader
LogValidateEntryMetadata
LogVerifyChecksumEntryHeader
NTOSKRNL.EXE::ExAllocatePoolWithTag
NTOSKRNL.EXE::ExFreePoolWithTag
_guard_dispatch_icall
memmove
| |calling|MlLogScanLog|MlLogScanLog| |paramcount|0|0| |`address`|1c00572c4|1c005b83c| |sig|undefined LogCoreScanDataRecord(void)|undefined LogCoreScanDataRecord(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### LogCoreScanDataRecord Called Diff ```diff --- LogCoreScanDataRecord called +++ LogCoreScanDataRecord called @@ -0,0 +1 @@ +Feature_1912855864__private_IsEnabledDeviceUsage @@ -4,0 +6 @@ +LogValidateEntryMetadata ``` ### LogCoreScanDataRecord Diff ```diff --- LogCoreScanDataRecord +++ LogCoreScanDataRecord @@ -1,201 +1,213 @@ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ int LogCoreScanDataRecord (longlong param_1,undefined8 param_2,ulonglong param_3,undefined8 param_4, undefined8 param_5,ulonglong param_6,longlong *param_7,uint *param_8, undefined8 param_9,undefined8 *param_10) { uint *puVar1; void *pvVar2; int iVar3; - int iVar4; - void *pvVar5; + uint uVar4; + int iVar5; undefined8 uVar6; ulonglong uVar7; ulonglong uVar8; longlong lVar9; - uint uVar10; - undefined8 *puVar11; - uint uVar12; - void *pvVar13; - uint uVar14; + undefined8 *puVar10; + uint uVar11; + void *pvVar12; + uint uVar13; + bool bVar14; int local_res20; undefined8 in_stack_ffffffffffffff88; undefined4 uVar15; void **ppvVar16; undefined1 *puVar17; - void *local_58; + undefined8 local_58; void *local_50; - undefined8 local_48; + void *local_48; uVar15 = (undefined4)((ulonglong)in_stack_ffffffffffffff88 >> 0x20); - pvVar5 = (void *)0x0; puVar17 = (undefined1 *)¶m_9; local_58 = (void *)0x0; - ppvVar16 = &local_58; + ppvVar16 = &local_50; + local_50 = (void *)0x0; + pvVar12 = (void *)0x0; param_9._0_4_ = 0; uVar8 = param_6; iVar3 = LogCoreFetchDataRecord(param_1); - pvVar2 = local_58; + pvVar2 = local_50; if (iVar3 < 0) { return iVar3; } - uVar12 = *(uint *)(param_1 + 0xe50); - uVar7 = CONCAT44(uVar15,uVar12); + uVar13 = *(uint *)(param_1 + 0xe50); + uVar8 = uVar8 & 0xffffffffffffff00; + uVar7 = CONCAT44(uVar15,uVar13); iVar3 = LogValidateEntryHeader - (param_1,param_3,*(undefined8 *)(param_1 + 0xe80),local_58,uVar7, - uVar8 & 0xffffffffffffff00,ppvVar16,puVar17); - uVar10 = (uint)param_9; + (param_1,param_3,*(undefined8 *)(param_1 + 0xe80),local_50,uVar7,uVar8,ppvVar16, + puVar17); + uVar11 = (uint)param_9; if (iVar3 == -0x3fc2fdff) { - uVar14 = *(int *)((longlong)pvVar2 + 0x3c) * *(int *)(param_1 + 0xe50); - uVar12 = (uint)param_9; - if (uVar14 < (uint)param_9) { - uVar12 = uVar14; - } - uVar7 = (ulonglong)uVar12; - iVar3 = LogValidateEntryHeader(); - } - if ((iVar3 < 0) || (iVar3 = LogVerifyChecksumEntryHeader(param_1,uVar12,pvVar2), iVar3 < 0)) { + uVar4 = *(int *)((longlong)pvVar2 + 0x3c) * *(int *)(param_1 + 0xe50); + uVar13 = (uint)param_9; + if (uVar4 < (uint)param_9) { + uVar13 = uVar4; + } + uVar7 = (ulonglong)uVar13; + iVar3 = LogValidateEntryHeader + (param_1,param_3,*(undefined8 *)(param_1 + 0xe80),pvVar2,uVar7, + uVar8 & 0xffffffffffffff00,ppvVar16,puVar17); + } + if ((iVar3 < 0) || (iVar3 = LogVerifyChecksumEntryHeader(param_1,uVar13,pvVar2), iVar3 < 0)) { local_res20 = (int)param_4; uVar7 = (*(longlong *)(param_1 + 8) + (param_3 & 0xffffffff)) * (ulonglong)*(uint *)(param_1 + 0xe50); - iVar4 = LogRepairEntryHeader + iVar5 = LogRepairEntryHeader (param_1,param_2,pvVar2,(local_res20 - (int)pvVar2) + 0x1000000,uVar7,param_3, (ulonglong)ppvVar16 & 0xffffffffffffff00); - if (-1 < iVar4) { + if (-1 < iVar5) { iVar3 = 0; - uVar14 = *(int *)((longlong)pvVar2 + 0x3c) * *(int *)(param_1 + 0xe50); - uVar12 = uVar10; - if (uVar14 < uVar10) { - uVar12 = uVar14; + uVar4 = *(int *)((longlong)pvVar2 + 0x3c) * *(int *)(param_1 + 0xe50); + uVar13 = uVar11; + if (uVar4 < uVar11) { + uVar13 = uVar4; } } } if (*(longlong *)(param_1 + 0x2ec0) == 0) { - uVar14 = 0; - pvVar13 = pvVar5; + uVar11 = 0; if (iVar3 < 0) goto LAB_0; LAB_1: - pvVar5 = (void *)0x0; - local_50 = (void *)0x0; + local_58 = (void *)0x0; + pvVar12 = (void *)0x0; LAB_2: if (*(longlong *)(param_1 + 0x2ec0) != 0) { param_9._0_4_ = *(int *)(param_1 + 0xe50) * (int)param_3; memmove((void *)((ulonglong)(uint)param_9 + *(longlong *)(param_1 + 0x2ec0)),pvVar2, - (ulonglong)uVar12); - if (uVar14 != 0) { - memmove((void *)((ulonglong)((uint)param_9 + uVar12) + *(longlong *)(param_1 + 0x2ec0)), - local_50,(ulonglong)uVar14); - } - } - uVar12 = *(uint *)((longlong)pvVar2 + 0x54); - if (*(int *)((longlong)pvVar2 + (ulonglong)uVar12 + 0x30) == 2) { - uVar10 = *(uint *)((longlong)pvVar2 + (ulonglong)uVar12 + 0x20); - if ((void *)*param_7 == (void *)0x0) { - *param_8 = uVar10; - *param_7 = (longlong)pvVar2 + - (ulonglong)*(uint *)((longlong)pvVar2 + (ulonglong)uVar12 + 0x28) + - (ulonglong)uVar12; - goto LAB_3; - } - if (uVar10 <= *param_8) { - memmove((void *)*param_7, - (void *)((longlong)pvVar2 + - (ulonglong)*(uint *)((longlong)pvVar2 + (ulonglong)uVar12 + 0x28) + - (ulonglong)uVar12),(ulonglong)uVar10); - goto LAB_3; - } - iVar3 = -0x3fffffdd; + (ulonglong)uVar13); + if (uVar11 != 0) { + memmove((void *)((ulonglong)((uint)param_9 + uVar13) + *(longlong *)(param_1 + 0x2ec0)), + pvVar12,(ulonglong)uVar11); + } + } + uVar11 = *(uint *)((longlong)pvVar2 + 0x54); + if (*(int *)((longlong)pvVar2 + (ulonglong)uVar11 + 0x30) == 2) { + iVar5 = Feature_1912855864__private_IsEnabledDeviceUsage(); + if ((iVar5 == 0) || (iVar3 = LogValidateEntryMetadata(pvVar2,uVar13), -1 < iVar3)) { + uVar13 = *(uint *)((longlong)pvVar2 + (ulonglong)uVar11 + 0x20); + if ((void *)*param_7 == (void *)0x0) { + *param_8 = uVar13; + *param_7 = (longlong)pvVar2 + + (ulonglong)*(uint *)((longlong)pvVar2 + (ulonglong)uVar11 + 0x28) + + (ulonglong)uVar11; + } + else { + if (*param_8 < uVar13) { + iVar3 = -0x3fffffdd; + goto LAB_3; + } + memmove((void *)*param_7, + (void *)((longlong)pvVar2 + + (ulonglong)*(uint *)((longlong)pvVar2 + (ulonglong)uVar11 + 0x28) + + (ulonglong)uVar11),(ulonglong)uVar13); + } + goto LAB_4; + } } else { iVar3 = 0x105; -LAB_3: +LAB_4: if (param_10 != (undefined8 *)0x0) { - puVar11 = param_10; + puVar10 = param_10; uVar6 = LogGetNextRecordLsn(param_1,*(undefined8 *)((longlong)pvVar2 + 0x28), *(undefined4 *)((longlong)pvVar2 + 0x38)); - *puVar11 = uVar6; + *puVar10 = uVar6; } *(ulonglong *)(param_1 + 0xe80) = param_3; } } else { - pvVar13 = (void *)0x0; + pvVar12 = (void *)0x0; if (-1 < iVar3) { - uVar10 = *(uint *)(param_1 + 0xe50); - uVar14 = (*(int *)((longlong)pvVar2 + 0x38) - *(int *)((longlong)pvVar2 + 0x3c)) * uVar10; - if (uVar14 == 0) goto LAB_1; - if ((uint)param_9 < uVar14 + uVar12) { - pvVar5 = (void *)ExAllocatePoolWithTag(0x200,uVar14,0x6c6c534d); - if (pvVar5 == (void *)0x0) { + uVar4 = *(uint *)(param_1 + 0xe50); + uVar11 = (*(int *)((longlong)pvVar2 + 0x38) - *(int *)((longlong)pvVar2 + 0x3c)) * uVar4; + if (uVar11 == 0) goto LAB_1; + if ((uint)param_9 < uVar11 + uVar13) { + local_58 = (void *)ExAllocatePoolWithTag(0x200,uVar11,0x6c6c534d); + if (local_58 == (void *)0x0) { return -0x3fffff66; } lVar9 = (*(longlong *)(param_1 + 8) + (param_3 & 0xffffffff)) * (ulonglong)*(uint *)(param_1 + 0xe50); - uVar7 = (ulonglong)uVar12 + lVar9; - local_50 = pvVar5; - iVar3 = (*DAT_4)(param_2,CONCAT71((int7)((ulonglong)lVar9 >> 8),3),pvVar5,uVar14, + uVar7 = (ulonglong)uVar13 + lVar9; + local_48 = local_58; + iVar3 = (*DAT_5)(param_2,CONCAT71((int7)((ulonglong)lVar9 >> 8),3),local_58,uVar11, uVar7); - if (iVar3 < 0) goto LAB_5; - uVar10 = *(uint *)(param_1 + 0xe50); + if (iVar3 < 0) goto LAB_6; + uVar4 = *(uint *)(param_1 + 0xe50); } else { - local_50 = (void *)((ulonglong)uVar12 + (longlong)pvVar2); - } - if ((uVar10 <= uVar14) && (uVar14 % uVar10 == 0)) { + local_48 = (void *)((ulonglong)uVar13 + (longlong)pvVar2); + } + if ((uVar4 <= uVar11) && (uVar11 % uVar4 == 0)) { iVar3 = 0; + pvVar12 = local_48; goto LAB_2; } iVar3 = -0x3ffffdfa; - pvVar13 = pvVar5; + pvVar12 = local_58; } LAB_0: - pvVar5 = pvVar13; + local_58 = pvVar12; if ((ulonglong)*(uint *)(param_1 + 0xe70) <= (ulonglong) (uint)(*(int *)(param_1 + 0x2ed4) + 0xaf + *(int *)(param_1 + 0xe50) & -*(int *)(param_1 + 0xe50)) + (param_3 & 0xffffffff)) { - local_48 = (void *)CONCAT44((int)((ulonglong)*(undefined8 *)(param_1 + 0x18) >> 0x20) + 1, + local_58 = (void *)CONCAT44((int)((ulonglong)*(undefined8 *)(param_1 + 0x18) >> 0x20) + 1, (int)*(undefined8 *)(param_1 + 0x18)); - local_50 = (void *)((ulonglong)((int)(param_3 >> 0x20) + 1) << 0x20); - pvVar2 = local_50; - if (((local_50 < local_48) && - (iVar4 = LogCoreFetchDataRecord - (param_1,param_2,local_50,param_4,uVar7,param_6,&local_58,¶m_9), - -1 < iVar4)) && - ((iVar4 = LogValidateEntryHeader + local_48 = (void *)((ulonglong)((int)(param_3 >> 0x20) + 1) << 0x20); + pvVar2 = local_48; + bVar14 = local_48 < local_58; + local_58 = pvVar12; + if (((bVar14) && + (iVar5 = LogCoreFetchDataRecord + (param_1,param_2,local_48,param_4,uVar7,param_6,&local_50,¶m_9), + -1 < iVar5)) && + ((iVar5 = LogValidateEntryHeader (param_1,pvVar2,*(undefined8 *)(param_1 + 0xe80),param_4, *(undefined4 *)(param_1 + 0xe50),1), - (iVar4 + 0x80000000U & 0x80000000) != 0 || - (((iVar4 == -0x3fc2fdff || - (iVar4 = LogRepairEntryHeader - (param_1,param_2,local_58,*(uint *)(param_1 + 0xe50), + (iVar5 + 0x80000000U & 0x80000000) != 0 || + (((iVar5 == -0x3fc2fdff || + (iVar5 = LogRepairEntryHeader + (param_1,param_2,local_50,*(uint *)(param_1 + 0xe50), *(longlong *)(param_1 + 8) * (ulonglong)*(uint *)(param_1 + 0xe50), - pvVar2,1), (iVar4 + 0x80000000U & 0x80000000) != 0)) || - (iVar4 == -0x3fc2fdff)))))) { + pvVar2,1), (iVar5 + 0x80000000U & 0x80000000) != 0)) || + (iVar5 == -0x3fc2fdff)))))) { LOCK(); puVar1 = (uint *)(param_1 + 0x2d30); - uVar12 = *puVar1; + uVar13 = *puVar1; *puVar1 = *puVar1 + 1; UNLOCK(); iVar3 = 0x105; - uVar8 = (ulonglong)(uVar12 + 1); - if (0x1f < uVar12) { + uVar8 = (ulonglong)(uVar13 + 1); + if (0x1f < uVar13) { uVar8 = 0x20; } *param_10 = pvVar2; *(int *)(param_1 + 0x2d30 + uVar8 * 4) = (int)param_3; *(ulonglong *)(param_1 + 0xe78) = param_3; } } } - if (pvVar5 == (void *)0x0) { +LAB_3: + if (local_58 == (void *)0x0) { return iVar3; } -LAB_5: - ExFreePoolWithTag(pvVar5,0); +LAB_6: + ExFreePoolWithTag(local_58,0); return iVar3; } ``` ## RefsSetAllocationInfo ### Match Info |Key|refs-2026-06.sys - refs-2026-07.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.24| |i_ratio|0.1| |m_ratio|0.97| |b_ratio|0.76| |match_types|SymbolsHash| ### Function Meta Diff |Key|refs-2026-06.sys|refs-2026-07.sys| | :---: | :---: | :---: | |name|RefsSetAllocationInfo|RefsSetAllocationInfo| |fullname|RefsSetAllocationInfo|RefsSetAllocationInfo| |refcount|2|2| |`length`|1655|1562| |`called`|
Expand for full list:
Feature_800271674__private_IsEnabledDeviceUsage
FsRtlTagFileForStorageNotification
RefsAddAllocation
RefsCheckpointCurrentTransaction
RefsCreateInternalAttributeStream
RefsDeleteAllocation
RefsDeleteInternalAttributeStream
RefsPostUsnChangeWithOverrideOption
RefsPrepareForCriticalIo
RefsPrepareToShrinkFileSize
RefsRaiseStatusInternalRefsSetBothCacheSizes
RefsSnapshotScb
RefsStatusDebug
RefsTelemetryUnsupportedADS
RefsUpdateFileDupInfo
RefsUpdateScbFromAttribute
RefsUpdateScbFromFileObject
RefsUpdateStandardInformation
RefsWriteFileSizes
RefsZeroEndOfClusterStraddlingEof
WPP_SF_D
__security_check_cookie
memset
|
Expand for full list:
FsRtlTagFileForStorageNotification
RefsAddAllocation
RefsCheckpointCurrentTransaction
RefsCreateInternalAttributeStream
RefsDeleteAllocation
RefsDeleteInternalAttributeStream
RefsPostUsnChangeWithOverrideOption
RefsPrepareForCriticalIo
RefsPrepareToShrinkFileSize
RefsRaiseStatusInternal
RefsSetBothCacheSizesRefsSnapshotScb
RefsStatusDebug
RefsTelemetryUnsupportedADS
RefsUpdateFileDupInfo
RefsUpdateScbFromAttribute
RefsUpdateScbFromFileObject
RefsUpdateStandardInformation
RefsWriteFileSizes
RefsZeroEndOfClusterStraddlingEof
WPP_SF_D
__security_check_cookie
memset
| |calling|RefsCommonSetInformation|RefsCommonSetInformation| |paramcount|5|5| |`address`|1c0185a14|1c0186a14| |sig|long __cdecl RefsSetAllocationInfo(_IRP_CONTEXT * param_1, _FILE_OBJECT * param_2, _IRP * param_3, _SCB * param_4, _CCB * param_5)|long __cdecl RefsSetAllocationInfo(_IRP_CONTEXT * param_1, _FILE_OBJECT * param_2, _IRP * param_3, _SCB * param_4, _CCB * param_5)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### RefsSetAllocationInfo Called Diff ```diff --- RefsSetAllocationInfo called +++ RefsSetAllocationInfo called @@ -1 +0,0 @@ -Feature_800271674__private_IsEnabledDeviceUsage ``` ### RefsSetAllocationInfo Diff ```diff --- RefsSetAllocationInfo +++ RefsSetAllocationInfo @@ -1,273 +1,246 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ /* long __cdecl RefsSetAllocationInfo(struct _IRP_CONTEXT * __ptr64,struct _FILE_OBJECT * __ptr64,struct _IRP * __ptr64,struct _SCB * __ptr64,struct _CCB * __ptr64) */ long __cdecl RefsSetAllocationInfo (_IRP_CONTEXT *param_1,_FILE_OBJECT *param_2,_IRP *param_3,_SCB *param_4,_CCB *param_5) { _CC_FILE_SIZES *p_Var1; byte bVar2; - _FCB *p_Var3; - longlong lVar4; - _SCB *p_Var5; - longlong lVar6; - bool bVar7; + int iVar3; + _FCB *p_Var4; + longlong lVar5; + _SCB *p_Var6; + longlong lVar7; bool bVar8; bool bVar9; - char cVar10; - int iVar11; + bool bVar10; + char cVar11; long lVar12; uint uVar13; longlong lVar14; _FILE_OBJECT *p_Var15; ulonglong uVar16; ulong uVar17; _ATTRIBUTE_ENUMERATION_CONTEXT *p_Var18; _SCB *p_Var19; uchar uVar20; _SCB *p_Var21; ulonglong uVar22; undefined1 auStackY_198 [32]; uchar in_stack_fffffffffffffe88; undefined1 local_120 [224]; ulonglong local_40; local_40 = __security_cookie ^ (ulonglong)auStackY_198; - p_Var3 = *(_FCB **)(param_4 + 0x78); + p_Var4 = *(_FCB **)(param_4 + 0x78); + bVar10 = false; bVar9 = false; bVar8 = false; - bVar7 = false; p_Var18 = (_ATTRIBUTE_ENUMERATION_CONTEXT *)0xe0; p_Var21 = param_4; memset(local_120,0,0xe0); - lVar4 = *(longlong *)(param_4 + 0x20); + lVar5 = *(longlong *)(param_4 + 0x20); if ((*(uint *)(param_4 + 0x118) & 0x40) == 0) { - cVar10 = (char)*(uint *)(param_4 + 0x88); + cVar11 = (char)*(uint *)(param_4 + 0x88); if ((*(uint *)(param_4 + 0x88) & 0x20) == 0) { RefsUpdateScbFromAttribute(param_1,param_4,p_Var18); - cVar10 = (char)*(undefined4 *)(param_4 + 0x88); + cVar11 = (char)*(undefined4 *)(param_4 + 0x88); } uVar17 = (ulong)p_Var18; - if (cVar10 < '\0') { + if (cVar11 < '\0') { if ((((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)((longlong)WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && (3 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x29))) { - WPP_SF_D(WPP_GLOBAL_Control[3],0x7c,&WPP_2a612cb084f737cc666b65cc6d907d4c_Traceguids, + WPP_SF_D(WPP_GLOBAL_Control[3],0x7c,&WPP_3645efd58e5132b0a6aeb06ec081cf60_Traceguids, 0xc00004be); } if (RefsStatusDebugEnabled != '\0') { - RefsStatusDebug(-0x3ffffb42,"FileInfo.c",0x2112); + RefsStatusDebug(-0x3ffffb42,"FileInfo.c",0x210e); } return -0x3ffffb42; } if (param_5 != (_CCB *)0x0) { *(undefined4 *)(param_1 + 0x188) = *(undefined4 *)(param_5 + 0x54); } RefsSnapshotScb(param_1,param_4); - p_Var5 = (_SCB *)**(undefined8 **)(param_3 + 0x18); - iVar11 = Feature_800271674__private_IsEnabledDeviceUsage(); - if (iVar11 == 0) { - if ((longlong)p_Var5 <= *(longlong *)(*(longlong *)(param_4 + 0x80) + 0x1e0)) - goto LAB_0; - if ((((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)((longlong)WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && - (3 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x29))) { - WPP_SF_D(WPP_GLOBAL_Control[3],0x7e,&WPP_2a612cb084f737cc666b65cc6d907d4c_Traceguids, + p_Var6 = (_SCB *)**(undefined8 **)(param_3 + 0x18); + if ((*(longlong *)(*(longlong *)(param_4 + 0x80) + 0x1e0) < (longlong)p_Var6) || + ((longlong)p_Var6 < 0)) { + if (((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + (((*(uint *)((longlong)WPP_GLOBAL_Control + 0x2c) & 0x100) != 0 && + (3 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x29))))) { + WPP_SF_D(WPP_GLOBAL_Control[3],0x7d,&WPP_3645efd58e5132b0a6aeb06ec081cf60_Traceguids, 0xc000000d); } if (RefsStatusDebugEnabled != '\0') { - uVar17 = 0x2143; - goto LAB_1; - } + RefsStatusDebug(-0x3ffffff3,"FileInfo.c",0x2138); + } + return -0x3ffffff3; + } + if ((longlong)p_Var6 < *(longlong *)(param_4 + 0x20)) { + p_Var19 = param_4; + p_Var21 = p_Var6; + lVar12 = RefsPrepareToShrinkFileSize(param_1,param_2,param_4,(__int64)p_Var6); + uVar17 = (ulong)p_Var19; + if (lVar12 != 0) { + return lVar12; + } + } + p_Var1 = (_CC_FILE_SIZES *)(param_4 + 0x18); + if ((p_Var6 != *(_SCB **)p_Var1) && (*(longlong *)(*(longlong *)(param_4 + 0xe8) + 8) != 0)) { + if ((*(longlong *)(param_2 + 0x28) == 0) || + (bVar9 = true, *(longlong *)(*(longlong *)(param_2 + 0x28) + 8) == 0)) { + bVar9 = false; + } + if (((!bVar9) && ((*(uint *)(p_Var4 + 4) & 4) == 0)) && ((*(uint *)(param_3 + 0x10) & 2) == 0) + ) { + p_Var21 = (_SCB *)&DAT_0; + uVar17 = 0; + RefsCreateInternalAttributeStream(param_1,param_4,'\0',(_UNICODE_STRING *)&DAT_0); + bVar9 = true; + } + } + if (((*(uint *)(param_4 + 0x88) & 8) == 0) || ((*(uint *)(param_4 + 0x88) & 0x40) != 0)) { + bVar10 = true; } else { - if (((longlong)p_Var5 <= *(longlong *)(*(longlong *)(param_4 + 0x80) + 0x1e0)) && - (-1 < (longlong)p_Var5)) { -LAB_0: - if ((longlong)p_Var5 < *(longlong *)(param_4 + 0x20)) { - p_Var19 = param_4; - p_Var21 = p_Var5; - lVar12 = RefsPrepareToShrinkFileSize(param_1,param_2,param_4,(__int64)p_Var5); - uVar17 = (ulong)p_Var19; - if (lVar12 != 0) { - return lVar12; - } - } - p_Var1 = (_CC_FILE_SIZES *)(param_4 + 0x18); - if ((p_Var5 != *(_SCB **)p_Var1) && (*(longlong *)(*(longlong *)(param_4 + 0xe8) + 8) != 0)) - { - if ((*(longlong *)(param_2 + 0x28) == 0) || - (bVar8 = true, *(longlong *)(*(longlong *)(param_2 + 0x28) + 8) == 0)) { - bVar8 = false; - } - if (((!bVar8) && ((*(uint *)(p_Var3 + 4) & 4) == 0)) && - ((*(uint *)(param_3 + 0x10) & 2) == 0)) { - p_Var21 = (_SCB *)&DAT_2; - uVar17 = 0; - RefsCreateInternalAttributeStream - (param_1,param_4,'\0',(_UNICODE_STRING *)&DAT_2); - bVar8 = true; - } - } - if (((*(uint *)(param_4 + 0x88) & 8) == 0) || ((*(uint *)(param_4 + 0x88) & 0x40) != 0)) { - bVar9 = true; - } - else { - if (0x20000 < (longlong)p_Var5) { - RefsTelemetryUnsupportedADS(*(_VCB **)(param_4 + 0x80),(__int64)p_Var5); - if ((((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)((longlong)WPP_GLOBAL_Control + 0x2c) >> 8 & 1) != 0)) && - (3 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x29))) { - uVar17 = 0xc0120628; - WPP_SF_D(WPP_GLOBAL_Control[3],0x7f,&WPP_2a612cb084f737cc666b65cc6d907d4c_Traceguids, - 0xc0000427); - } - if (RefsStatusDebugEnabled != '\0') { - uVar17 = 0x2186; - RefsStatusDebug(-0x3ffffbd9,"FileInfo.c",0x2186); - } + if (0x20000 < (longlong)p_Var6) { + RefsTelemetryUnsupportedADS(*(_VCB **)(param_4 + 0x80),(__int64)p_Var6); + if ((((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)((longlong)WPP_GLOBAL_Control + 0x2c) >> 8 & 1) != 0)) && + (3 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x29))) { + uVar17 = 0xc0121628; + WPP_SF_D(WPP_GLOBAL_Control[3],0x7e,&WPP_3645efd58e5132b0a6aeb06ec081cf60_Traceguids, + 0xc0000427); + } + if (RefsStatusDebugEnabled != '\0') { + uVar17 = 0x217a; + RefsStatusDebug(-0x3ffffbd9,"FileInfo.c",0x217a); + } /* WARNING: Subroutine does not return */ - RefsRaiseStatusInternal(param_1,-0x3ffffbd9,uVar17); - } - if (p_Var5 != *(_SCB **)p_Var1) { - if ((longlong)p_Var5 < *(longlong *)(param_4 + 0x20)) { - RefsPostUsnChangeWithOverrideOption(param_1,param_4,4,(_FILE_NAME *)0x0); - } - *(_SCB **)p_Var1 = p_Var5; + RefsRaiseStatusInternal(param_1,-0x3ffffbd9,uVar17); + } + if (p_Var6 != *(_SCB **)p_Var1) { + if ((longlong)p_Var6 < *(longlong *)(param_4 + 0x20)) { + RefsPostUsnChangeWithOverrideOption(param_1,param_4,4,(_FILE_NAME *)0x0); + } + *(_SCB **)p_Var1 = p_Var6; + LOCK(); + *(uint *)(param_4 + 0x88) = *(uint *)(param_4 + 0x88) | 1; + UNLOCK(); + if ((longlong)p_Var6 < *(longlong *)(param_4 + 0x20)) { + *(_SCB **)(param_4 + 0x20) = p_Var6; + *(_SCB **)(param_4 + 0x28) = p_Var6; + if ((*(uint *)(param_4 + 0x88) & 0x10) == 0) { LOCK(); - *(uint *)(param_4 + 0x88) = *(uint *)(param_4 + 0x88) | 1; - UNLOCK(); - if ((longlong)p_Var5 < *(longlong *)(param_4 + 0x20)) { - *(_SCB **)(param_4 + 0x20) = p_Var5; - *(_SCB **)(param_4 + 0x28) = p_Var5; - if ((*(uint *)(param_4 + 0x88) & 0x10) == 0) { - LOCK(); - *(uint *)(param_4 + 0x88) = *(uint *)(param_4 + 0x88) | 0x4000; - UNLOCK(); - } - } - p_Var21 = (_SCB *)0x3; - RefsWriteFileSizes(param_1,param_4,(_CC_FILE_SIZES *)0x0,3,in_stack_fffffffffffffe88); - bVar7 = true; - } - } - if (bVar9) { - uVar22 = (ulonglong)*(uint *)(*(longlong *)(param_4 + 0x80) + 0x220); - bVar2 = *(byte *)(*(longlong *)(param_4 + 0x80) + 0x228); - uVar16 = ((longlong)(p_Var5 + uVar22) >> (bVar2 & 0x3f)) << (bVar2 & 0x3f); - lVar6 = *(longlong *)p_Var1; - if (lVar6 < (longlong)uVar16) { - if (*(short *)(param_4 + 0xf4) < 0) { - *(ulonglong *)p_Var1 = - (longlong)(*(int *)(param_4 + 0xf0) + -1) + uVar16 & - (longlong)-*(int *)(param_4 + 0xf0); - } - else { - if (((*(uint *)(param_4 + 0x88) & 0x80000) == 0) && - (iVar11 = *(int *)(param_4 + 0xf0), iVar11 != 0)) { - uVar16 = uVar16 + (longlong)(iVar11 + -1) & (longlong)-iVar11; - } - lVar14 = (longlong)((uVar22 - lVar6) + uVar16) >> (bVar2 & 0x3f); - RefsAddAllocation(param_1,param_2,param_4,(longlong)(uVar22 + lVar6) >> (bVar2 & 0x3f) - ,lVar14,0,(_CCB *)0x0); - in_stack_fffffffffffffe88 = (uchar)lVar14; - } - LOCK(); - *(uint *)(param_4 + 0x88) = *(uint *)(param_4 + 0x88) | 1; + *(uint *)(param_4 + 0x88) = *(uint *)(param_4 + 0x88) | 0x4000; UNLOCK(); } - else if ((longlong)uVar16 < lVar6) { - if ((longlong)uVar16 < *(longlong *)(param_4 + 0x20)) { - RefsPostUsnChangeWithOverrideOption(param_1,param_4,4,(_FILE_NAME *)0x0); - *(ulonglong *)(param_4 + 0x20) = uVar16; - *(ulonglong *)(param_4 + 0x28) = uVar16; - if ((*(uint *)(param_4 + 0x88) & 0x10) == 0) { - LOCK(); - *(uint *)(param_4 + 0x88) = *(uint *)(param_4 + 0x88) | 0x4000; - UNLOCK(); - } - } - in_stack_fffffffffffffe88 = 0xff; - RefsDeleteAllocation - (param_1,param_2,param_4, - (longlong)(*(uint *)(*(longlong *)(param_4 + 0x80) + 0x220) + uVar16) >> - (*(byte *)(*(longlong *)(param_4 + 0x80) + 0x228) & 0x3f),0x7fffffffffffffff, - '\x01'); + } + p_Var21 = (_SCB *)0x3; + RefsWriteFileSizes(param_1,param_4,(_CC_FILE_SIZES *)0x0,3,in_stack_fffffffffffffe88); + bVar8 = true; + } + } + if (bVar10) { + uVar22 = (ulonglong)*(uint *)(*(longlong *)(param_4 + 0x80) + 0x220); + bVar2 = *(byte *)(*(longlong *)(param_4 + 0x80) + 0x228); + uVar16 = ((longlong)(p_Var6 + uVar22) >> (bVar2 & 0x3f)) << (bVar2 & 0x3f); + lVar7 = *(longlong *)p_Var1; + if (lVar7 < (longlong)uVar16) { + if (*(short *)(param_4 + 0xf4) < 0) { + *(ulonglong *)p_Var1 = + (longlong)(*(int *)(param_4 + 0xf0) + -1) + uVar16 & + (longlong)-*(int *)(param_4 + 0xf0); + } + else { + if (((*(uint *)(param_4 + 0x88) & 0x80000) == 0) && + (iVar3 = *(int *)(param_4 + 0xf0), iVar3 != 0)) { + uVar16 = uVar16 + (longlong)(iVar3 + -1) & (longlong)-iVar3; } - p_Var21 = (_SCB *)0x3; - RefsWriteFileSizes(param_1,param_4,(_CC_FILE_SIZES *)0x0,3,in_stack_fffffffffffffe88); - bVar7 = true; - if ((*(uint *)(p_Var3 + 4) & 4) != 0) { - RefsPrepareForCriticalIo(param_1,param_3,param_4,(ulong)p_Var21); - p_Var21 = (_SCB *)0x1; - FsRtlTagFileForStorageNotification(param_1,param_3,param_4,1); + lVar14 = (longlong)((uVar22 - lVar7) + uVar16) >> (bVar2 & 0x3f); + RefsAddAllocation(param_1,param_2,param_4,(longlong)(uVar22 + lVar7) >> (bVar2 & 0x3f), + lVar14,0,(_CCB *)0x0); + in_stack_fffffffffffffe88 = (uchar)lVar14; + } + LOCK(); + *(uint *)(param_4 + 0x88) = *(uint *)(param_4 + 0x88) | 1; + UNLOCK(); + } + else if ((longlong)uVar16 < lVar7) { + if ((longlong)uVar16 < *(longlong *)(param_4 + 0x20)) { + RefsPostUsnChangeWithOverrideOption(param_1,param_4,4,(_FILE_NAME *)0x0); + *(ulonglong *)(param_4 + 0x20) = uVar16; + *(ulonglong *)(param_4 + 0x28) = uVar16; + if ((*(uint *)(param_4 + 0x88) & 0x10) == 0) { + LOCK(); + *(uint *)(param_4 + 0x88) = *(uint *)(param_4 + 0x88) | 0x4000; + UNLOCK(); } } - uVar20 = (uchar)p_Var21; - if (param_5 == (_CCB *)0x0) { - *(uint *)(param_2 + 0x50) = *(uint *)(param_2 + 0x50) | 0x1000; - } - else { - *(uint *)(param_5 + 4) = *(uint *)(param_5 + 4) | 0x710000; - } - p_Var15 = param_2; - RefsUpdateScbFromFileObject(param_2,param_4,'\x01'); - uVar13 = *(uint *)(p_Var3 + 4); - if ((uVar13 & 0x10) != 0) { - p_Var15 = (_FILE_OBJECT *)param_1; - RefsUpdateStandardInformation(param_1,p_Var3); - uVar13 = *(uint *)(p_Var3 + 4); - } - *(uint *)(p_Var3 + 4) = uVar13 & 0xffffffef; - if (bVar7) { - LOCK(); - *(uint *)(param_4 + 0x88) = *(uint *)(param_4 + 0x88) & 0xfffffffb; - UNLOCK(); - } - if (bVar8) { - if (*(longlong *)(param_4 + 0x20) < lVar4) { - p_Var15 = (_FILE_OBJECT *)param_1; - RefsCheckpointCurrentTransaction(param_1); - } - p_Var21 = param_4; - RefsSetBothCacheSizes((_IRP_CONTEXT *)p_Var15,param_2,p_Var1,param_4); - uVar20 = (uchar)p_Var21; - } + in_stack_fffffffffffffe88 = 0xff; + RefsDeleteAllocation + (param_1,param_2,param_4, + (longlong)(*(uint *)(*(longlong *)(param_4 + 0x80) + 0x220) + uVar16) >> + (*(byte *)(*(longlong *)(param_4 + 0x80) + 0x228) & 0x3f),0x7fffffffffffffff, + '\x01'); + } + p_Var21 = (_SCB *)0x3; + RefsWriteFileSizes(param_1,param_4,(_CC_FILE_SIZES *)0x0,3,in_stack_fffffffffffffe88); + bVar8 = true; + if ((*(uint *)(p_Var4 + 4) & 4) != 0) { + RefsPrepareForCriticalIo(param_1,param_3,param_4,(ulong)p_Var21); + p_Var21 = (_SCB *)0x1; + FsRtlTagFileForStorageNotification(param_1,param_3,param_4,1); + } + } + uVar20 = (uchar)p_Var21; + if (param_5 == (_CCB *)0x0) { + *(uint *)(param_2 + 0x50) = *(uint *)(param_2 + 0x50) | 0x1000; + } + else { + *(uint *)(param_5 + 4) = *(uint *)(param_5 + 4) | 0x710000; + } + p_Var15 = param_2; + RefsUpdateScbFromFileObject(param_2,param_4,'\x01'); + uVar13 = *(uint *)(p_Var4 + 4); + if ((uVar13 & 0x10) != 0) { + p_Var15 = (_FILE_OBJECT *)param_1; + RefsUpdateStandardInformation(param_1,p_Var4); + uVar13 = *(uint *)(p_Var4 + 4); + } + *(uint *)(p_Var4 + 4) = uVar13 & 0xffffffef; + if (bVar8) { + LOCK(); + *(uint *)(param_4 + 0x88) = *(uint *)(param_4 + 0x88) & 0xfffffffb; + UNLOCK(); + } + if (bVar9) { + if (*(longlong *)(param_4 + 0x20) < lVar5) { + p_Var15 = (_FILE_OBJECT *)param_1; RefsCheckpointCurrentTransaction(param_1); - uVar16 = *(ulonglong *)(param_4 + 0x20); - if ((((*(uint *)(*(longlong *)(param_4 + 0x80) + 0x220) + uVar16 & - (longlong)*(int *)(*(longlong *)(param_4 + 0x80) + 0x224)) != uVar16) && - ((longlong)uVar16 < lVar4)) && (bVar9)) { - RefsZeroEndOfClusterStraddlingEof(param_1,param_4,param_3); - } - RefsCheckpointCurrentTransaction(param_1); - RefsUpdateFileDupInfo(param_1,p_Var3,param_5); - if ((*(int *)(param_4 + 0x90) == 0) && (*(longlong *)(param_4 + 0xe0) != 0)) { - RefsDeleteInternalAttributeStream(param_1,param_4,0,uVar20); - } - goto LAB_3; - } - if ((((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)((longlong)WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && - (3 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x29))) { - WPP_SF_D(WPP_GLOBAL_Control[3],0x7d,&WPP_2a612cb084f737cc666b65cc6d907d4c_Traceguids, - 0xc000000d); - } - if (RefsStatusDebugEnabled != '\0') { - uVar17 = 0x213d; -LAB_1: - RefsStatusDebug(-0x3ffffff3,"FileInfo.c",uVar17); - } - } - lVar12 = -0x3ffffff3; + } + p_Var21 = param_4; + RefsSetBothCacheSizes((_IRP_CONTEXT *)p_Var15,param_2,p_Var1,param_4); + uVar20 = (uchar)p_Var21; + } + RefsCheckpointCurrentTransaction(param_1); + uVar16 = *(ulonglong *)(param_4 + 0x20); + if ((((*(uint *)(*(longlong *)(param_4 + 0x80) + 0x220) + uVar16 & + (longlong)*(int *)(*(longlong *)(param_4 + 0x80) + 0x224)) != uVar16) && + ((longlong)uVar16 < lVar5)) && (bVar10)) { + RefsZeroEndOfClusterStraddlingEof(param_1,param_4,param_3); + } + RefsCheckpointCurrentTransaction(param_1); + RefsUpdateFileDupInfo(param_1,p_Var4,param_5); + if ((*(int *)(param_4 + 0x90) == 0) && (*(longlong *)(param_4 + 0xe0) != 0)) { + RefsDeleteInternalAttributeStream(param_1,param_4,0,uVar20); + } } - else { -LAB_3: - lVar12 = 0; - } - return lVar12; + return 0; } ``` ## RefsSetPositionInfo ### Match Info |Key|refs-2026-06.sys - refs-2026-07.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.5| |i_ratio|0.25| |m_ratio|0.87| |b_ratio|0.85| |match_types|SymbolsHash| ### Function Meta Diff |Key|refs-2026-06.sys|refs-2026-07.sys| | :---: | :---: | :---: | |name|RefsSetPositionInfo|RefsSetPositionInfo| |fullname|RefsSetPositionInfo|RefsSetPositionInfo| |refcount|2|2| |`length`|148|128| |`called`|Feature_800271674__private_IsEnabledDeviceUsage
RefsStatusDebug
WPP_SF_D|RefsStatusDebug
WPP_SF_D| |calling|RefsCommonSetInformation|RefsCommonSetInformation| |paramcount|2|2| |`address`|1c01de618|1c01df578| |sig|long __cdecl RefsSetPositionInfo(_FILE_OBJECT * param_1, _IRP * param_2)|long __cdecl RefsSetPositionInfo(_FILE_OBJECT * param_1, _IRP * param_2)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### RefsSetPositionInfo Called Diff ```diff --- RefsSetPositionInfo called +++ RefsSetPositionInfo called @@ -1 +0,0 @@ -Feature_800271674__private_IsEnabledDeviceUsage ``` ### RefsSetPositionInfo Diff ```diff --- RefsSetPositionInfo +++ RefsSetPositionInfo @@ -1,31 +1,27 @@ /* long __cdecl RefsSetPositionInfo(struct _FILE_OBJECT * __ptr64,struct _IRP * __ptr64) */ long __cdecl RefsSetPositionInfo(_FILE_OBJECT *param_1,_IRP *param_2) { - longlong *plVar1; - int iVar2; - long lVar3; + long lVar1; - plVar1 = *(longlong **)(param_2 + 0x18); - iVar2 = Feature_800271674__private_IsEnabledDeviceUsage(); - if ((iVar2 == 0) || (-1 < *plVar1)) { - *(longlong *)(param_1 + 0x68) = *plVar1; - lVar3 = 0; - } - else { + if (**(longlong **)(param_2 + 0x18) < 0) { if ((((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)((longlong)WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && (3 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x29))) { - WPP_SF_D(WPP_GLOBAL_Control[3],0x77,&WPP_2a612cb084f737cc666b65cc6d907d4c_Traceguids, + WPP_SF_D(WPP_GLOBAL_Control[3],0x77,&WPP_3645efd58e5132b0a6aeb06ec081cf60_Traceguids, 0xc000000d); } if (RefsStatusDebugEnabled != '\0') { - RefsStatusDebug(-0x3ffffff3,"FileInfo.c",0x202e); + RefsStatusDebug(-0x3ffffff3,"FileInfo.c",0x202b); } - lVar3 = -0x3ffffff3; + lVar1 = -0x3ffffff3; } - return lVar3; + else { + *(longlong *)(param_1 + 0x68) = **(longlong **)(param_2 + 0x18); + lVar1 = 0; + } + return lVar1; } ``` ## CmsBPlusTable::MmsCheckIndexEntry ### Match Info |Key|refs-2026-06.sys - refs-2026-07.sys| | :---: | :---: | |diff_type|code,length,called| |ratio|0.1| |i_ratio|0.1| |m_ratio|0.61| |b_ratio|0.18| |match_types|SymbolsHash| ### Function Meta Diff |Key|refs-2026-06.sys|refs-2026-07.sys| | :---: | :---: | :---: | |name|MmsCheckIndexEntry|MmsCheckIndexEntry| |fullname|CmsBPlusTable::MmsCheckIndexEntry|CmsBPlusTable::MmsCheckIndexEntry| |refcount|6|6| |`length`|319|732| |`called`|_SmsIndexEntry::GetDataLength
_SmsIndexEntry::GetKeyLength
_SmsIndexEntry::GetLengthPhys|Feature_2293230905__private_IsEnabledDeviceUsage
_SmsIndexEntry::GetDataLength
_SmsIndexEntry::GetKeyLength
_SmsIndexEntry::GetLengthPhys
_SmsIndexEntry::IsStreamIndexEntry
_guard_dispatch_icall| |calling|CmsBPlusTable::EnumerateWithCursor
CmsBPlusTable::FindNextIndexEntry
CmsBPlusTable::TryToCollapseFromPage|CmsBPlusTable::EnumerateWithCursor
CmsBPlusTable::FindNextIndexEntry
CmsBPlusTable::TryToCollapseFromPage| |paramcount|4|4| |address|1c0044be8|1c0044be8| |sig|long __cdecl MmsCheckIndexEntry(SmsPage * param_1, _SmsIndexHeader * param_2, _SmsIndexEntry * param_3, _SmsPropertyDef * param_4)|long __cdecl MmsCheckIndexEntry(SmsPage * param_1, _SmsIndexHeader * param_2, _SmsIndexEntry * param_3, _SmsPropertyDef * param_4)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### CmsBPlusTable::MmsCheckIndexEntry Called Diff ```diff --- CmsBPlusTable::MmsCheckIndexEntry called +++ CmsBPlusTable::MmsCheckIndexEntry called @@ -0,0 +1 @@ +Feature_2293230905__private_IsEnabledDeviceUsage @@ -3,0 +5,2 @@ +_SmsIndexEntry::IsStreamIndexEntry +_guard_dispatch_icall ``` ### CmsBPlusTable::MmsCheckIndexEntry Diff ```diff --- CmsBPlusTable::MmsCheckIndexEntry +++ CmsBPlusTable::MmsCheckIndexEntry @@ -1,60 +1,172 @@ +/* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ /* public: static long __cdecl CmsBPlusTable::MmsCheckIndexEntry(struct SmsPage * __ptr64,struct _SmsIndexHeader * __ptr64,struct _SmsIndexEntry * __ptr64,struct _SmsPropertyDef * __ptr64) */ long __cdecl CmsBPlusTable::MmsCheckIndexEntry (SmsPage *param_1,_SmsIndexHeader *param_2,_SmsIndexEntry *param_3, _SmsPropertyDef *param_4) { - ushort uVar1; - ulong uVar2; - _SmsIndexEntry *p_Var3; - _SmsIndexEntry *this; - uint uVar4; - uint uVar5; - _SmsIndexHeader *p_Var6; - uint uVar7; - ushort uVar8; - ushort uVar9; + uint uVar1; + longlong lVar2; + ulonglong uVar3; + ulonglong uVar4; + bool bVar5; + byte bVar6; + ushort uVar7; + ulong uVar8; + int iVar9; + longlong lVar10; + uint uVar11; + _SmsIndexHeader *p_Var12; + ushort uVar13; + uint uVar14; + _SmsIndexEntry *p_Var15; + ulonglong uVar16; + _SmsIndexEntry *p_Var17; + uint uVar18; - p_Var6 = param_2; - p_Var3 = param_3; - uVar2 = _SmsIndexEntry::GetLengthPhys(param_3); - if ((_SmsIndexHeader *)(param_3 + uVar2) <= p_Var6 + *(uint *)(p_Var6 + 0x10)) { - uVar9 = *(ushort *)(param_3 + 8); - uVar4 = 0xc; - uVar5 = 0xc; - uVar8 = uVar9 & 0x40; - if (((uVar8 != 0) || (uVar5 = (uint)*(ushort *)(p_Var3 + 4), 0xf < *(ushort *)(p_Var3 + 4))) && - (uVar2 = _SmsIndexEntry::GetLengthPhys(p_Var3), (uVar5 & 0xffff) <= uVar2)) { - uVar5 = 0; - uVar7 = 0; - if (uVar8 == 0) { - uVar4 = (uint)*(ushort *)(p_Var3 + 4); + p_Var17 = param_3; + p_Var12 = param_2; + p_Var15 = param_3; + uVar8 = _SmsIndexEntry::GetLengthPhys(param_3); + if (p_Var12 + *(uint *)(p_Var12 + 0x10) < (_SmsIndexHeader *)(p_Var15 + uVar8)) { + return -0x3ffffb90; + } + uVar16 = (ulonglong)*(ushort *)(p_Var15 + 8); + uVar18 = 0; + uVar14 = 0; + uVar13 = *(ushort *)(p_Var15 + 8) & 0x40; + if ((uVar13 == 0) && (0xf < *(ushort *)(p_Var17 + 4))) { +LAB_0: + uVar11 = (uint)*(ushort *)(param_3 + 4); + } + else { + bVar5 = _SmsIndexEntry::IsStreamIndexEntry(p_Var17); + if (!bVar5) { + return -0x3ffffb90; + } + uVar11 = 0xc; + if (uVar13 == 0) goto LAB_0; + } + uVar8 = _SmsIndexEntry::GetLengthPhys(param_3); + if (uVar8 < (uVar11 & 0xffff)) { + return -0x3ffffb90; + } + uVar11 = 0xc; + if (uVar13 == 0) { + uVar11 = (uint)*(ushort *)(param_3 + 4); + } + p_Var17 = param_3; + uVar7 = _SmsIndexEntry::GetKeyLength(param_3); + uVar11 = (uint)uVar7 + (uVar11 & 0xffff); + uVar8 = _SmsIndexEntry::GetLengthPhys(p_Var17); + if (uVar8 < uVar11) { + return -0x3ffffb90; + } + if ((((byte)param_2[0xd] & 1) == 0) && ((uVar16 & 2) != 0)) { + return -0x3ffffb90; + } + if ((uVar13 != 0) || (*(ushort *)(param_3 + 10) < 0x10)) { + bVar5 = _SmsIndexEntry::IsStreamIndexEntry(p_Var17); + if (!bVar5) { + return -0x3ffffb90; + } + uVar11 = uVar18; + if (uVar13 != 0) goto LAB_1; + if (*(short *)(param_3 + 10) != 0) { + return -0x3ffffb90; + } + } + uVar11 = (uint)*(ushort *)(param_3 + 10); +LAB_1: + p_Var17 = param_3; + uVar8 = _SmsIndexEntry::GetLengthPhys(param_3); + if (uVar11 <= uVar8) { + if (uVar13 == 0) { + uVar14 = (uint)*(ushort *)(param_3 + 10); + } + uVar8 = _SmsIndexEntry::GetDataLength(p_Var17); + uVar14 = uVar14 + uVar8; + p_Var17 = param_3; + uVar8 = _SmsIndexEntry::GetLengthPhys(param_3); + if ((uVar14 <= uVar8) && + (((param_2[0xc] != (_SmsIndexHeader)0x0 || ((*(uint *)(param_4 + 0x2c) & 4) == 0)) || + (bVar5 = _SmsIndexEntry::IsStreamIndexEntry(p_Var17), bVar5)))) { + iVar9 = Feature_2293230905__private_IsEnabledDeviceUsage(); + if ((((iVar9 == 0) || (param_2[0xc] != (_SmsIndexHeader)0x0)) || + (bVar5 = _SmsIndexEntry::IsStreamIndexEntry(param_3), bVar5)) || + ((((byte)param_3[8] & 4) != 0 || (*(short *)(param_4 + 4) != 10)))) { + return 0; } - this = p_Var3; - uVar1 = _SmsIndexEntry::GetKeyLength(p_Var3); - uVar4 = (uint)uVar1 + (uVar4 & 0xffff); - uVar2 = _SmsIndexEntry::GetLengthPhys(p_Var3); - if ((((uVar4 <= uVar2) && ((~(byte)param_2[0xd] & (uVar9 >> 1 & 1) != 0) == 0)) && - ((uVar8 != 0 || (uVar5 = (uint)*(ushort *)(this + 10), 0xf < *(ushort *)(this + 10))))) && - (p_Var3 = this, uVar2 = _SmsIndexEntry::GetLengthPhys(this), uVar5 <= uVar2)) { - if (uVar8 == 0) { - uVar7 = (uint)*(ushort *)(p_Var3 + 10); - } - uVar2 = _SmsIndexEntry::GetDataLength(this); - uVar7 = uVar7 + uVar2; - uVar2 = _SmsIndexEntry::GetLengthPhys(p_Var3); - if ((uVar7 <= uVar2) && - (((param_2[0xc] != (_SmsIndexHeader)0x0 || ((*(uint *)(param_4 + 0x2c) & 4) == 0)) || - (uVar8 != 0)))) { + if (0xf < *(ushort *)(param_3 + 6)) { + if (*(int *)(param_3 + (ulonglong)*(ushort *)(param_3 + 4) + 0xc) != 1) { return 0; } + if (0x4f < *(uint *)(param_3 + 0xc)) { + uVar13 = *(ushort *)(param_3 + 10); + if ((*(int *)(param_3 + (ulonglong)uVar13 + 0x4c) - 1U < 4) && + (((*(uint *)(param_3 + (ulonglong)uVar13 + 0x14) & 8) != 0 || + (*(int *)(param_3 + (ulonglong)uVar13 + 0x4c) == 1)))) { + lVar2 = *(longlong *)(*(longlong *)(*(longlong *)(param_1 + 0x78) + 0x60) + 0x18); + lVar10 = 8; + if (*(int *)(lVar2 + 0x40) != 0xc) { + lVar10 = 0x10; + } + bVar6 = (**(code **)(**(longlong **) + (lVar10 + (longlong)CmsChecksum::StreamChecksumTable) + 200)) + (*(longlong **)(lVar10 + (longlong)CmsChecksum::StreamChecksumTable), + lVar2); + uVar14 = *(uint *)(param_3 + (ulonglong)uVar13 + 0x4c); + uVar11 = (1 << (bVar6 & 0x1f)) * 0x10; + if ((uVar14 + 5) * 0x10 + uVar11 <= *(uint *)(param_3 + 0xc)) { + uVar1 = *(uint *)(lVar2 + 0x50); + uVar16 = (ulonglong)uVar1; + if (uVar1 == 0) { + return 0; + } + if (uVar14 != 0) { + p_Var17 = param_3 + (ulonglong)uVar11 + (ulonglong)uVar13 + 0x50; + do { + uVar3 = *(ulonglong *)(p_Var17 + 8); + if (uVar3 == 0) { + return -0x3ffffae8; + } + if (uVar16 < uVar3) { + return -0x3ffffae8; + } + uVar4 = *(ulonglong *)p_Var17; + if (~uVar4 < uVar3) { + return -0x3ffffae8; + } + if (uVar4 / uVar16 != ((uVar3 - 1) + uVar4) / uVar16) { + return -0x3ffffae8; + } + uVar18 = uVar18 + 1; + p_Var17 = p_Var17 + 0x10; + } while (uVar18 < uVar14); + } + if ((*(uint *)(param_3 + (ulonglong)uVar13 + 0x14) & 8) != 0) { + return 0; + } + if ((*(uint *)(param_3 + (ulonglong)uVar11 + 0x50 + (ulonglong)uVar13) & uVar1 - 1) == + 0) { + if (*(ulonglong *)(param_3 + (ulonglong)uVar11 + 0x58 + (ulonglong)uVar13) == uVar16 + ) { + return 0; + } + return -0x3ffffae8; + } + return -0x3ffffae8; + } + } + } } + return -0x3ffffae8; } } return -0x3ffffb90; } ``` ## CmsBPlusTable::EnumerateWithCursor ### Match Info |Key|refs-2026-06.sys - refs-2026-07.sys| | :---: | :---: | |diff_type|code,length| |ratio|0.33| |i_ratio|0.62| |m_ratio|0.99| |b_ratio|0.67| |match_types|SymbolsHash| ### Function Meta Diff |Key|refs-2026-06.sys|refs-2026-07.sys| | :---: | :---: | :---: | |name|EnumerateWithCursor|EnumerateWithCursor| |fullname|CmsBPlusTable::EnumerateWithCursor|CmsBPlusTable::EnumerateWithCursor| |refcount|4|4| |`length`|842|852| |called|CmsBPlusTable::FindFirstIndexEntry
CmsBPlusTable::FindNextIndexEntry
CmsBPlusTable::MmsCheckIndexEntry
CmsBPlusTable::MmsGetLastNonEndIndexEntry
CmsBPlusTable::MmsIndexEntryByOffset
CmsKeyRules::GetKeyRules
CmsTable::UpdateCursorFromFoundIndexEntry
_guard_dispatch_icall|CmsBPlusTable::FindFirstIndexEntry
CmsBPlusTable::FindNextIndexEntry
CmsBPlusTable::MmsCheckIndexEntry
CmsBPlusTable::MmsGetLastNonEndIndexEntry
CmsBPlusTable::MmsIndexEntryByOffset
CmsKeyRules::GetKeyRules
CmsTable::UpdateCursorFromFoundIndexEntry
_guard_dispatch_icall| |calling||| |paramcount|4|4| |address|1c0037780|1c0037780| |sig|long __thiscall EnumerateWithCursor(CmsBPlusTable * this, CmsTransactionContext * param_1, CmsTableCursor * param_2, uchar param_3)|long __thiscall EnumerateWithCursor(CmsBPlusTable * this, CmsTransactionContext * param_1, CmsTableCursor * param_2, uchar param_3)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### CmsBPlusTable::EnumerateWithCursor Diff ```diff --- CmsBPlusTable::EnumerateWithCursor +++ CmsBPlusTable::EnumerateWithCursor @@ -1,175 +1,172 @@ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ /* protected: virtual long __cdecl CmsBPlusTable::EnumerateWithCursor(class CmsTransactionContext * __ptr64,class CmsTableCursor * __ptr64,unsigned char) __ptr64 */ long __thiscall CmsBPlusTable::EnumerateWithCursor (CmsBPlusTable *this,CmsTransactionContext *param_1,CmsTableCursor *param_2,uchar param_3) { - ushort uVar1; - _SmsIndexHeader *p_Var2; + SmsLookupStack *pSVar1; + ushort uVar2; code *pcVar3; - ulong uVar4; - char cVar5; - long lVar6; - CmsKeyRules *pCVar7; - _SmsIndexHeader *p_Var8; + char cVar4; + long lVar5; + CmsKeyRules *pCVar6; + _SmsIndexHeader *p_Var7; + _SmsIndexEntry *p_Var8; _SmsIndexEntry *p_Var9; - _SmsIndexEntry *p_Var10; - CmsTableCursor *pCVar11; - uint uVar12; - CmsBPlusTable *pCVar13; - CmsTransactionContext *pCVar14; - ulong uVar15; - _CmsRow *p_Var16; - _SmsIndexEntry *p_Var17; - longlong *plVar18; - uint uVar19; - bool bVar20; + CmsTableCursor *pCVar10; + uint uVar11; + SmsPage *pSVar12; + CmsTransactionContext *pCVar13; + ulong uVar14; + _CmsRow *p_Var15; + longlong *plVar16; + uint uVar17; + bool bVar18; ulong local_res8 [2]; local_res8[0] = 0; - uVar19 = *(uint *)(param_2 + 8) >> 0xb & 1; - uVar12 = uVar19 | 0x20000; + uVar17 = *(uint *)(param_2 + 8) >> 0xb & 1; + uVar11 = uVar17 | 0x20000; if ((*(uint *)(param_2 + 0x34) & 4) == 0) { - uVar12 = uVar19; + uVar11 = uVar17; } - uVar19 = uVar12 | 0x2000; + uVar17 = uVar11 | 0x2000; if ((*(uint *)(param_2 + 8) & 2) == 0) { - uVar19 = uVar12; + uVar17 = uVar11; } (**(code **)(*(longlong *)this + 0x40))(this,param_1,0); - uVar12 = *(uint *)(param_2 + 8); - if ((uVar12 & 8) != 0) { - p_Var16 = (_CmsRow *)(param_2 + 0x48); - if ((uVar12 & 0x10) == 0) { - uVar19 = uVar19 | 8; - pCVar7 = CmsKeyRules::GetKeyRules((uint)*(ushort *)(*(longlong *)(this + 0x18) + 4)); - cVar5 = (*(code *)**(undefined8 **)pCVar7)(pCVar7,p_Var16); - if (cVar5 == '\0') { - lVar6 = -0x3ffffff3; + uVar11 = *(uint *)(param_2 + 8); + if ((uVar11 & 8) != 0) { + p_Var15 = (_CmsRow *)(param_2 + 0x48); + if ((uVar11 & 0x10) == 0) { + uVar17 = uVar17 | 8; + pCVar6 = CmsKeyRules::GetKeyRules((uint)*(ushort *)(*(longlong *)(this + 0x18) + 4)); + cVar4 = (*(code *)**(undefined8 **)pCVar6)(pCVar6,p_Var15); + if (cVar4 == '\0') { + lVar5 = -0x3ffffff3; goto LAB_0; } } else { - uVar19 = (~uVar12 & 1) * 2 + 2 | uVar19; - p_Var16 = (_CmsRow *)0x0; + p_Var15 = (_CmsRow *)0x0; + uVar17 = (~uVar11 & 1) * 2 + 2 | uVar17; } - p_Var8 = (_SmsIndexHeader *)this; - lVar6 = FindFirstIndexEntry(this,param_1,p_Var16,(SmsLookupStack *)(param_2 + 0x1e0),uVar19, - param_3,local_res8,(_SmsQuickIndex *)0x0,(_SmsView *)0x0); - if (lVar6 == -0x3fffffcc) { + pSVar1 = (SmsLookupStack *)(param_2 + 0x1e0); + lVar5 = FindFirstIndexEntry(this,param_1,p_Var15,pSVar1,uVar17,param_3,local_res8, + (_SmsQuickIndex *)0x0,(_SmsView *)0x0); + if (lVar5 == -0x3fffffcc) { LAB_1: if (*KdDebuggerEnabled_exref != (code)0x0) { pcVar3 = (code *)swi(3); - lVar6 = (*pcVar3)(); - return lVar6; + lVar5 = (*pcVar3)(); + return lVar5; } - p_Var8 = (_SmsIndexHeader *)KdDebuggerEnabled_exref; - if (lVar6 < 0) goto LAB_0; + if (lVar5 < 0) goto LAB_0; } else { - if (lVar6 < 0) goto LAB_0; + if (lVar5 < 0) goto LAB_0; if (*(longlong *)(param_2 + 0x208) == 0) goto LAB_1; } - bVar20 = false; + bVar18 = false; if (local_res8[0] == 0) { - uVar15 = *(ulong *)(param_2 + 0x218); + uVar14 = *(ulong *)(param_2 + 0x218); if ((*(uint *)(param_2 + 8) & 2) == 0) { - p_Var8 = *(_SmsIndexHeader **)(param_2 + 0x208); - bVar20 = false; - if ((uVar15 == *(ulong *)(p_Var8 + 0x14)) && (*(ulong *)(p_Var8 + 0x14) != 0)) { - uVar15 = uVar15 - 1; - bVar20 = true; - *(ulong *)(param_2 + 0x218) = uVar15; + p_Var7 = *(_SmsIndexHeader **)(param_2 + 0x208); + if ((uVar14 == *(ulong *)(p_Var7 + 0x14)) && (*(ulong *)(p_Var7 + 0x14) != 0)) { + uVar14 = uVar14 - 1; + bVar18 = true; + *(ulong *)(param_2 + 0x218) = uVar14; } } else { - bVar20 = uVar15 == 0; - uVar4 = 0; - if (!bVar20) { - *(ulong *)(param_2 + 0x218) = uVar15 - 1; - uVar4 = uVar15 - 1; + bVar18 = uVar14 == 0; + if (bVar18) { + uVar14 = 0; } - uVar15 = uVar4; - p_Var8 = *(_SmsIndexHeader **)(param_2 + 0x208); + else { + uVar14 = uVar14 - 1; + *(ulong *)(param_2 + 0x218) = uVar14; + } + p_Var7 = *(_SmsIndexHeader **)(param_2 + 0x208); } - p_Var9 = MmsIndexEntryByOffset(p_Var8,uVar15); - *(_SmsIndexEntry **)(param_2 + 0x210) = p_Var9; + p_Var8 = MmsIndexEntryByOffset(p_Var7,uVar14); + *(_SmsIndexEntry **)(param_2 + 0x210) = p_Var8; } else { - p_Var9 = *(_SmsIndexEntry **)(param_2 + 0x210); + p_Var8 = *(_SmsIndexEntry **)(param_2 + 0x210); } - if (p_Var9 == (_SmsIndexEntry *)0x0) { - p_Var2 = *(_SmsIndexHeader **)(param_2 + 0x208); - if (((byte)p_Var2[0xd] & 2) != 0) { - lVar6 = -0x3ffffd8d; + p_Var7 = *(_SmsIndexHeader **)(param_2 + 0x208); + if (p_Var8 == (_SmsIndexEntry *)0x0) { + if (((byte)p_Var7[0xd] & 2) != 0) { + lVar5 = -0x3ffffd8d; goto LAB_0; } - uVar1 = *(ushort *)(p_Var2 + ((ulonglong)*(uint *)(p_Var2 + 0x10) - 4)); - *(_SmsIndexEntry **)(param_2 + 0x210) = (_SmsIndexEntry *)(p_Var2 + uVar1); - lVar6 = MmsCheckIndexEntry((SmsPage *)p_Var8,p_Var2,(_SmsIndexEntry *)(p_Var2 + uVar1), + uVar2 = *(ushort *)(p_Var7 + ((ulonglong)*(uint *)(p_Var7 + 0x10) - 4)); + *(_SmsIndexEntry **)(param_2 + 0x210) = (_SmsIndexEntry *)(p_Var7 + uVar2); + lVar5 = MmsCheckIndexEntry(*(SmsPage **)pSVar1,p_Var7,(_SmsIndexEntry *)(p_Var7 + uVar2), *(_SmsPropertyDef **)(this + 0x18)); - if ((lVar6 < 0) || - (lVar6 = CmsTable::UpdateCursorFromFoundIndexEntry + if ((lVar5 < 0) || + (lVar5 = CmsTable::UpdateCursorFromFoundIndexEntry ((CmsTransactionCore *)param_1,param_2,'\0',(_SmsIndexEntry *)0x0), - lVar6 < 0)) goto LAB_0; - bVar20 = true; + lVar5 < 0)) goto LAB_0; + bVar18 = true; } else { - p_Var2 = *(_SmsIndexHeader **)(param_2 + 0x208); - p_Var17 = p_Var9; - lVar6 = MmsCheckIndexEntry((SmsPage *)p_Var8,p_Var2,p_Var9,*(_SmsPropertyDef **)(this + 0x18)) - ; - if (lVar6 < 0) goto LAB_0; - p_Var10 = (_SmsIndexEntry *)0x0; - if (((byte)p_Var9[8] & 2) != 0) { - p_Var10 = MmsGetLastNonEndIndexEntry((SmsPage *)p_Var8,p_Var2,(_SmsPropertyDef *)p_Var17); + pSVar12 = *(SmsPage **)pSVar1; + lVar5 = MmsCheckIndexEntry(pSVar12,p_Var7,p_Var8,*(_SmsPropertyDef **)(this + 0x18)); + if (lVar5 < 0) goto LAB_0; + p_Var9 = (_SmsIndexEntry *)0x0; + if ((*(byte *)(*(longlong *)(param_2 + 0x210) + 8) & 2) != 0) { + p_Var9 = MmsGetLastNonEndIndexEntry + (pSVar12,*(_SmsIndexHeader **)(param_2 + 0x208),(_SmsPropertyDef *)p_Var8 + ); } - lVar6 = CmsTable::UpdateCursorFromFoundIndexEntry - ((CmsTransactionCore *)param_1,param_2,'\0',p_Var10); - if (lVar6 < 0) goto LAB_0; + lVar5 = CmsTable::UpdateCursorFromFoundIndexEntry + ((CmsTransactionCore *)param_1,param_2,'\0',p_Var9); + if (lVar5 < 0) goto LAB_0; } - uVar12 = *(uint *)(param_2 + 8); - *(uint *)(param_2 + 8) = uVar12 & 0xfffffff7; - if (!bVar20) goto LAB_0; - *(uint *)(param_2 + 8) = uVar12 & 0xfffffff7 | 4; + uVar11 = *(uint *)(param_2 + 8); + *(uint *)(param_2 + 8) = uVar11 & 0xfffffff7; + if (!bVar18) goto LAB_0; + *(uint *)(param_2 + 8) = uVar11 & 0xfffffff7 | 4; } - while ((pCVar13 = this, - lVar6 = FindNextIndexEntry(this,param_1,param_2,uVar19 & 0xfffffff9,param_3), -1 < lVar6 && - (p_Var9 = *(_SmsIndexEntry **)(param_2 + 0x210), p_Var9 != (_SmsIndexEntry *)0x0))) { - p_Var8 = *(_SmsIndexHeader **)(param_2 + 0x208); - p_Var17 = p_Var9; - lVar6 = MmsCheckIndexEntry((SmsPage *)pCVar13,p_Var8,p_Var9,*(_SmsPropertyDef **)(this + 0x18)); - if (lVar6 < 0) break; - p_Var10 = (_SmsIndexEntry *)0x0; - if (((byte)p_Var9[8] & 2) != 0) { - p_Var10 = MmsGetLastNonEndIndexEntry((SmsPage *)pCVar13,p_Var8,(_SmsPropertyDef *)p_Var17); + while ((lVar5 = FindNextIndexEntry(this,param_1,param_2,uVar17 & 0xfffffff9,param_3), -1 < lVar5 + && (p_Var8 = *(_SmsIndexEntry **)(param_2 + 0x210), p_Var8 != (_SmsIndexEntry *)0x0))) { + pSVar12 = *(SmsPage **)(param_2 + 0x1e0); + lVar5 = MmsCheckIndexEntry(pSVar12,*(_SmsIndexHeader **)(param_2 + 0x208),p_Var8, + *(_SmsPropertyDef **)(this + 0x18)); + if (lVar5 < 0) break; + p_Var9 = (_SmsIndexEntry *)0x0; + if ((*(byte *)(*(longlong *)(param_2 + 0x210) + 8) & 2) != 0) { + p_Var9 = MmsGetLastNonEndIndexEntry + (pSVar12,*(_SmsIndexHeader **)(param_2 + 0x208),(_SmsPropertyDef *)p_Var8); } - lVar6 = CmsTable::UpdateCursorFromFoundIndexEntry - ((CmsTransactionCore *)param_1,param_2,'\0',p_Var10); - if ((lVar6 < 0) || ((*(byte *)(*(longlong *)(param_2 + 0x68) + 8) & 4) == 0)) break; + lVar5 = CmsTable::UpdateCursorFromFoundIndexEntry + ((CmsTransactionCore *)param_1,param_2,'\0',p_Var9); + if ((lVar5 < 0) || ((*(byte *)(*(longlong *)(param_2 + 0x68) + 8) & 4) == 0)) break; *(uint *)(param_2 + 8) = *(uint *)(param_2 + 8) | 4; } LAB_0: - pCVar11 = param_2 + 0x78; - if (*(CmsTableCursor **)pCVar11 == pCVar11) { - pCVar14 = param_1 + 0x788; - plVar18 = *(longlong **)(param_1 + 0x790); - if ((CmsTransactionContext *)*plVar18 != pCVar14) { - pCVar14 = (CmsTransactionContext *)0x3; + pCVar10 = param_2 + 0x78; + if (*(CmsTableCursor **)pCVar10 == pCVar10) { + pCVar13 = param_1 + 0x788; + plVar16 = *(longlong **)(param_1 + 0x790); + if ((CmsTransactionContext *)*plVar16 != pCVar13) { + pCVar13 = (CmsTransactionContext *)0x3; pcVar3 = (code *)swi(0x29); - pCVar11 = (CmsTableCursor *)(*pcVar3)(); + pCVar10 = (CmsTableCursor *)(*pcVar3)(); } - *(CmsTransactionContext **)pCVar11 = pCVar14; - *(longlong **)(pCVar11 + 8) = plVar18; - *plVar18 = (longlong)pCVar11; - *(CmsTableCursor **)(pCVar14 + 8) = pCVar11; + *(CmsTransactionContext **)pCVar10 = pCVar13; + *(longlong **)(pCVar10 + 8) = plVar16; + *plVar16 = (longlong)pCVar10; + *(CmsTableCursor **)(pCVar13 + 8) = pCVar10; *(CmsTransactionContext **)(param_2 + 0x1d8) = param_1; *(CmsBPlusTable **)(param_2 + 0x70) = this; } - return lVar6; + return lVar5; } ``` ## CmsVolume::ReadAndRepairSelfChecksumBlock ### Match Info |Key|refs-2026-06.sys - refs-2026-07.sys| | :---: | :---: | |diff_type|code,refcount,length,address,called| |ratio|0.13| |i_ratio|0.19| |m_ratio|0.98| |b_ratio|0.17| |match_types|SymbolsHash| ### Function Meta Diff |Key|refs-2026-06.sys|refs-2026-07.sys| | :---: | :---: | :---: | |name|ReadAndRepairSelfChecksumBlock|ReadAndRepairSelfChecksumBlock| |fullname|CmsVolume::ReadAndRepairSelfChecksumBlock|CmsVolume::ReadAndRepairSelfChecksumBlock| |`refcount`|6|5| |`length`|1767|1720| |`called`|
Expand for full list:
CmsVolume::ReadLcnTuple
CmsVolume::RepairFromCopyLcnTuple
FUN_1c005e485
FUN_1c0095f33
MspCleanupTopologyIds
MspGrowTopologyIds
MspInitializeReadCopyContext
MspQueryTopologyId
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::FsRtlIsTotalDeviceFailure
WPP_SF_D__security_check_cookie
_guard_dispatch_icall
memmove
|
Expand for full list:
CmsVolume::ReadLcnTuple
CmsVolume::RepairFromCopyLcnTuple
Feature_1076875578__private_IsEnabledDeviceUsage
MspCleanupTopologyIds
MspGrowTopologyIds
MspInitializeReadCopyContext
MspQueryTopologyId
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::FsRtlIsTotalDeviceFailure
WPP_SF_D
__security_check_cookie_guard_dispatch_icall
memmove
memset
| |calling|CmsVolume::MoveSuperBlock
CmsVolume::ReadLatestCheckpoint
CmsVolume::ReadSuperBlock
CmsVolume::ValidateCheckpointRecord|CmsVolume::MoveSuperBlock
CmsVolume::ReadLatestCheckpoint
CmsVolume::ReadSuperBlock
CmsVolume::ValidateCheckpointRecord| |paramcount|15|15| |`address`|1c005e068|1c004bc80| |sig|long __thiscall ReadAndRepairSelfChecksumBlock(CmsVolume * this, CmsTransactionContext * param_1, void * param_2, _SmsBigIdentifier * param_3, _LCN_TUPLE * param_4, ulong param_5, void * param_6, _func_uchar_CmsTransactionContext_ptr_CmsVolume_ptr_void_ptr__LCN_TUPLE_ptr_ulong_void_ptr * param_7, _func__RTL_GENERIC_COMPARE_RESULTS_void_ptr_void_ptr_ulong * param_8, uchar * param_9, _SmsScrubIoOutput * param_10, _SCRUB_PARITY_EXTENT_DATA * param_11, void * param_12, uchar param_13, uchar param_14)|long __thiscall ReadAndRepairSelfChecksumBlock(CmsVolume * this, CmsTransactionContext * param_1, void * param_2, _SmsBigIdentifier * param_3, _LCN_TUPLE * param_4, ulong param_5, void * param_6, _func_uchar_CmsTransactionContext_ptr_CmsVolume_ptr_void_ptr__LCN_TUPLE_ptr_ulong_void_ptr * param_7, _func__RTL_GENERIC_COMPARE_RESULTS_void_ptr_void_ptr_ulong * param_8, uchar * param_9, _SmsScrubIoOutput * param_10, _SCRUB_PARITY_EXTENT_DATA * param_11, void * param_12, uchar param_13, uchar param_14)| |sym_type|Function|Function| |sym_source|IMPORTED|ANALYSIS| |external|False|False| ### CmsVolume::ReadAndRepairSelfChecksumBlock Called Diff ```diff --- CmsVolume::ReadAndRepairSelfChecksumBlock called +++ CmsVolume::ReadAndRepairSelfChecksumBlock called @@ -3,2 +3 @@ -FUN_1c005e485 -FUN_1c0095f33 +Feature_1076875578__private_IsEnabledDeviceUsage @@ -14,0 +14 @@ +memset ``` ### CmsVolume::ReadAndRepairSelfChecksumBlock Diff ```diff --- CmsVolume::ReadAndRepairSelfChecksumBlock +++ CmsVolume::ReadAndRepairSelfChecksumBlock @@ -1,329 +1,358 @@ +/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ -/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ /* WARNING: Exceeded maximum restarts with more pending */ /* private: long __cdecl CmsVolume::ReadAndRepairSelfChecksumBlock(class CmsTransactionContext * __ptr64,void * __ptr64,union _SmsBigIdentifier * __ptr64,union _LCN_TUPLE const * __ptr64,unsigned long,void * __ptr64,unsigned char (__cdecl*)(class CmsTransactionContext * __ptr64,class CmsVolume * __ptr64,void * __ptr64,union _LCN_TUPLE const * __ptr64,unsigned long,void * __ptr64),enum _RTL_GENERIC_COMPARE_RESULTS (__cdecl*)(void * __ptr64,void * __ptr64,unsigned long),unsigned char * __ptr64,struct _SmsScrubIoOutput * __ptr64,struct _SCRUB_PARITY_EXTENT_DATA * __ptr64,void * __ptr64,unsigned char,unsigned char) __ptr64 */ long __thiscall CmsVolume::ReadAndRepairSelfChecksumBlock (CmsVolume *this,CmsTransactionContext *param_1,void *param_2,_SmsBigIdentifier *param_3, _LCN_TUPLE *param_4,ulong param_5,void *param_6, _func_uchar_CmsTransactionContext_ptr_CmsVolume_ptr_void_ptr__LCN_TUPLE_ptr_ulong_void_ptr *param_7,_func__RTL_GENERIC_COMPARE_RESULTS_void_ptr_void_ptr_ulong *param_8, uchar *param_9,_SmsScrubIoOutput *param_10,_SCRUB_PARITY_EXTENT_DATA *param_11, void *param_12,uchar param_13,uchar param_14) { - longlong lVar1; + undefined4 uVar1; bool bVar2; - char cVar3; - long lVar4; - int iVar5; - long lVar6; - uint *puVar7; - byte bVar8; - ulonglong uVar9; - longlong *plVar10; - CmsVolume *pCVar11; - uchar *puVar12; - uint uVar13; - ulonglong *puVar14; - ulonglong uVar15; - ulonglong *puVar16; - _LCN_TUPLE *p_Var17; + _LCN_TUPLE *p_Var3; + bool bVar4; + char cVar5; + int iVar6; + long lVar7; + ulong uVar8; + long lVar9; + uint *puVar10; + longlong lVar11; + ulonglong uVar12; + longlong *plVar13; + CmsVolume *pCVar14; + void *pvVar15; + ulong *puVar16; + ulonglong uVar17; ulonglong uVar18; _SmsBigIdentifier *p_Var19; uint uVar20; uint uVar21; ushort uVar22; - ulong uVar23; - bool bVar24; + uint uVar23; undefined1 auStackY_148 [32]; uint local_108; - uint local_f0; - int local_ec; - ulonglong local_e0; - uchar *local_d8; - void *local_d0; - CmsTransactionContext *local_c8; + uint local_104; + ulong local_fc; + uint local_f8; + uint local_f4; + long local_f0; + _LCN_TUPLE *local_e8; + uchar *local_e0; + void *local_d8; + CmsTransactionContext *local_d0; _func_uchar_CmsTransactionContext_ptr_CmsVolume_ptr_void_ptr__LCN_TUPLE_ptr_ulong_void_ptr - *local_c0; - _SmsScrubIoOutput *local_b8; - _SmsTopologyIds *local_b0; - void *local_a8; - undefined8 local_a0; - undefined8 uStack_98; - _func__RTL_GENERIC_COMPARE_RESULTS_void_ptr_void_ptr_ulong *local_90; - _SCRUB_PARITY_EXTENT_DATA *local_88; - undefined8 local_80; - longlong local_78 [4]; - uint local_58 [4]; - ulonglong local_48; + *local_c8; + _SmsScrubIoOutput *local_c0; + CmsVolume *local_b8; + void *local_b0; + undefined8 local_a8; + undefined8 uStack_a0; + _func__RTL_GENERIC_COMPARE_RESULTS_void_ptr_void_ptr_ulong *local_98; + ulong *local_90; + CmsVolume *local_88; + _SCRUB_PARITY_EXTENT_DATA *local_80; + undefined8 local_78; + longlong local_70 [4]; + uint local_50 [4]; + ulonglong local_40; - local_48 = __security_cookie ^ (ulonglong)auStackY_148; - plVar10 = local_78; - local_a8 = param_6; - uVar13 = 1; - uVar21 = *(uint *)(this + 3000); - local_c0 = param_7; - local_90 = param_8; - local_d8 = param_9; - local_88 = param_11; - local_d0 = param_12; - bVar8 = (byte)*(undefined4 *)(this + 0x40); - uVar23 = param_5 << (bVar8 & 0x1f); - puVar7 = local_58; + local_40 = __security_cookie ^ (ulonglong)auStackY_148; + local_b0 = param_6; + local_c8 = param_7; + local_98 = param_8; + local_e0 = param_9; + local_80 = param_11; + local_d8 = param_12; + local_e8 = param_4; + local_c0 = param_10; + uVar21 = param_5 << ((byte)*(undefined4 *)(this + 0x40) & 0x1f); + local_d0 = param_1; + local_88 = this; + iVar6 = Feature_1076875578__private_IsEnabledDeviceUsage(); + if ((iVar6 != 0) && (*(uint *)(this + 0xc1c) < uVar21)) { + return -0x3fffffce; + } + local_104 = *(uint *)(this + 3000); + plVar13 = local_70; + uVar1 = *(undefined4 *)(this + 0x40); + puVar10 = local_50; local_108 = 0xffffffff; - local_b8 = param_10; uVar20 = 0; - local_80 = local_80 & 0xffffffff00000000; - local_ec = 0; + local_f4 = 0; + uVar23 = 1; + local_f0 = 0; bVar2 = false; - local_f0 = 0; - local_78[0] = 0; - local_78[1] = 0; - local_78[2] = 0; - local_78[3] = 0; - local_58[0] = 0; - local_58[1] = 0; - local_58[2] = 0; - local_58[3] = 0; + local_f8 = 0; + local_70[0] = 0; + local_70[1] = 0; + local_70[2] = 0; + local_70[3] = 0; + local_50[0] = 0; + local_50[1] = 0; + local_50[2] = 0; + local_50[3] = 0; if (*(longlong *)param_4 != 0) { - local_78[0] = *(longlong *)param_4; - local_58[0] = 1; - local_58[1] = 0; - uVar20 = uVar13; - p_Var17 = param_4; + local_70[0] = *(longlong *)param_4; + local_50[0] = 1; + local_50[1] = 0; + uVar20 = 1; do { - p_Var17 = p_Var17 + 8; - lVar1 = *(longlong *)p_Var17; - if (lVar1 == 0) break; - if (lVar1 == (ulonglong)*puVar7 + *plVar10) { - *puVar7 = *puVar7 + 1; + param_4 = param_4 + 8; + lVar11 = *(longlong *)param_4; + if (lVar11 == 0) break; + if (lVar11 == (ulonglong)*puVar10 + *plVar13) { + *puVar10 = *puVar10 + 1; } else { - plVar10 = plVar10 + 1; - puVar7 = puVar7 + 1; - uVar13 = uVar13 + 1; - *plVar10 = lVar1; - *puVar7 = 1; + plVar13 = plVar13 + 1; + puVar10 = puVar10 + 1; + uVar23 = uVar23 + 1; + *plVar13 = lVar11; + *puVar10 = 1; } uVar20 = uVar20 + 1; } while (uVar20 < 4); - uVar20 = uVar13; - if (uVar13 != 0) { - puVar7 = local_58; - uVar18 = (ulonglong)uVar13; - plVar10 = local_78; + uVar20 = uVar23; + if (uVar23 != 0) { + puVar10 = local_50; + uVar18 = (ulonglong)uVar23; + plVar13 = local_70; do { - *plVar10 = *plVar10 << (bVar8 & 0x3f); - plVar10 = plVar10 + 1; - *puVar7 = *puVar7 << (bVar8 & 0x1f); - puVar7 = puVar7 + 1; + *plVar13 = *plVar13 << ((byte)uVar1 & 0x3f); + plVar13 = plVar13 + 1; + *puVar10 = *puVar10 << ((byte)uVar1 & 0x1f); + puVar10 = puVar10 + 1; uVar18 = uVar18 - 1; } while (uVar18 != 0); } } - local_a0 = 0; - uStack_98 = 0; - local_e0 = 0; - if ((DAT_0 == 0) || (DAT_1c016a430 == 0)) { - uVar21 = 1; - } - p_Var19 = (_SmsBigIdentifier *)&local_e0; - local_c8 = param_1; - lVar4 = MspInitializeReadCopyContext(uVar21,uVar23,(_SmsReadCopyContext **)p_Var19); - uVar18 = local_e0; - if (lVar4 < 0) { + local_a8 = 0; + uStack_a0 = 0; + bVar4 = false; + local_78 = 0; + if ((DAT_0 == 0) || (DAT_1c016b430 == 0)) { + local_104 = 1; + } + p_Var19 = (_SmsBigIdentifier *)&local_78; + lVar7 = MspInitializeReadCopyContext(local_104,uVar21,(_SmsReadCopyContext **)p_Var19); + uVar18 = local_78; + if (lVar7 < 0) { if ((((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)((longlong)WPP_GLOBAL_Control + 0x2c) & 0x400) != 0)) && (1 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x29))) { - WPP_SF_D(WPP_GLOBAL_Control[3],0xc,&WPP_eaae7bf532cc3ca380113afe0a3e91b7_Traceguids,lVar4); - } - goto LAB_1; - } - lVar4 = MspGrowTopologyIds((_SmsTopologyIds *)&local_a0,4); - if (lVar4 < 0) { - if ((((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)((longlong)WPP_GLOBAL_Control + 0x2c) >> 10 & 1) != 0)) && - (1 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x29))) { - p_Var19 = (_SmsBigIdentifier *)&WPP_eaae7bf532cc3ca380113afe0a3e91b7_Traceguids; - WPP_SF_D(WPP_GLOBAL_Control[3],0xd,&WPP_eaae7bf532cc3ca380113afe0a3e91b7_Traceguids,lVar4); - } - bVar24 = true; - bVar2 = true; + WPP_SF_D(WPP_GLOBAL_Control[3],0xc,&WPP_a2a86a8e96ea3617ddc203b78f1d8973_Traceguids); + } +LAB_1: + bVar2 = bVar4; + *local_e0 = '\0'; +LAB_2: + memset(local_b0,-0x21524111,(ulonglong)uVar21); + if (!bVar2) goto LAB_3; } else { - bVar24 = false; - } - pCVar11 = (CmsVolume *)0x1; - *local_d8 = '\0'; - if (param_10 != (_SmsScrubIoOutput *)0x0) { - *(undefined8 *)param_10 = 0; - *(undefined8 *)(param_10 + 8) = 0; - *(undefined8 *)(param_10 + 0x10) = 0; - *(undefined8 *)(param_10 + 0x18) = 0; - *(undefined8 *)(param_10 + 0x20) = 0; - *(undefined8 *)(param_10 + 0x28) = 0; - *(undefined8 *)(param_10 + 0x30) = 0; - } - if ((uVar21 < 2) || (bVar24)) { -LAB_2: - local_e0 = local_e0 & 0xffffffff00000000; - local_b0 = (_SmsTopologyIds *)0x0; - if (uVar21 != 0) goto LAB_3; - } - else { - p_Var19 = (_SmsBigIdentifier *)0x0; - pCVar11 = (CmsVolume *)0x0; - lVar4 = MspQueryTopologyId(*(_VCB **)(this + 0x30),(void *)0x0,(_SmsBigIdentifier *)0x0, - (_LBO_RUN_TUPLE *)local_78,uVar20,0,uVar23, - (_SmsTopologyIds *)&local_a0); - if (lVar4 < 0) goto LAB_2; - local_b0 = (_SmsTopologyIds *)&local_a0; - local_e0 = local_e0 & 0xffffffff00000000; -LAB_3: - puVar14 = (ulonglong *)0x0; - bVar24 = param_10 != (_SmsScrubIoOutput *)0x0; - puVar16 = &local_e0; - if (uVar21 < 2) { - puVar16 = puVar14; - } - do { - uVar13 = (uint)puVar14; - lVar4 = ReadLcnTuple(this,pCVar11,p_Var19,param_4,uVar23, - *(void **)(uVar18 + 8 + (longlong)puVar14 * 0x10),(ulong *)puVar16, - -(uint)bVar24 & 2); - *(long *)(uVar18 + (longlong)puVar14 * 0x10) = lVar4; - uVar20 = local_108; - if (lVar4 < 0) { - if (-1 < local_ec) { - local_ec = lVar4; - } - local_f0 = local_f0 + 1; - FsRtlIsTotalDeviceFailure(lVar4); - } - else { - p_Var19 = *(_SmsBigIdentifier **)(uVar18 + 8 + (longlong)puVar14 * 0x10); - pCVar11 = this; - cVar3 = (*local_c0)(local_c8,this,p_Var19,param_4); - if (cVar3 == '\0') { - *(undefined4 *)(uVar18 + (longlong)puVar14 * 0x10) = 0xc0000470; + lVar7 = MspGrowTopologyIds((_SmsTopologyIds *)&local_a8,4); + if (lVar7 < 0) { + if ((((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)((longlong)WPP_GLOBAL_Control + 0x2c) >> 10 & 1) != 0)) && + (1 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x29))) { + p_Var19 = (_SmsBigIdentifier *)&WPP_a2a86a8e96ea3617ddc203b78f1d8973_Traceguids; + WPP_SF_D(WPP_GLOBAL_Control[3],0xd); + } + bVar4 = true; + bVar2 = true; + } + else { + bVar4 = false; + } + pCVar14 = (CmsVolume *)0x1; + *local_e0 = '\0'; + if (param_10 != (_SmsScrubIoOutput *)0x0) { + *(undefined8 *)param_10 = 0; + *(undefined8 *)(param_10 + 8) = 0; + *(undefined8 *)(param_10 + 0x10) = 0; + *(undefined8 *)(param_10 + 0x18) = 0; + *(undefined8 *)(param_10 + 0x20) = 0; + *(undefined8 *)(param_10 + 0x28) = 0; + *(undefined8 *)(param_10 + 0x30) = 0; + } + if ((local_104 < 2) || (bVar4)) { +LAB_4: + local_fc = 0; + local_b8 = (CmsVolume *)0x0; + if (local_104 != 0) goto LAB_5; + } + else { + p_Var19 = (_SmsBigIdentifier *)0x0; + pCVar14 = (CmsVolume *)0x0; + lVar7 = MspQueryTopologyId(*(_VCB **)(this + 0x30),(void *)0x0,(_SmsBigIdentifier *)0x0, + (_LBO_RUN_TUPLE *)local_70,uVar20,0,uVar21, + (_SmsTopologyIds *)&local_a8); + if (lVar7 < 0) goto LAB_4; + pCVar14 = (CmsVolume *)&local_a8; + local_b8 = pCVar14; +LAB_5: + local_fc = 0; + puVar16 = (ulong *)0x0; + uVar8 = -(uint)(param_10 != (_SmsScrubIoOutput *)0x0) & 2; + local_78 = CONCAT44(local_78._4_4_,-(uint)(param_10 != (_SmsScrubIoOutput *)0x0)) & + 0xffffffff00000002; + local_90 = &local_fc; + if (local_104 < 2) { + local_90 = puVar16; + } + do { + uVar23 = (uint)puVar16; + lVar7 = ReadLcnTuple(this,pCVar14,p_Var19,local_e8,uVar21, + *(void **)(uVar18 + 8 + (longlong)puVar16 * 0x10),local_90,uVar8); + *(long *)(uVar18 + (longlong)puVar16 * 0x10) = lVar7; + uVar20 = local_108; + if (lVar7 < 0) { + if (-1 < local_f0) { + local_f0 = lVar7; + } + local_f8 = local_f8 + 1; + FsRtlIsTotalDeviceFailure(lVar7); } else { - if ((lVar4 != 0x40000035) && (param_14 == '\0')) { - bVar2 = true; + p_Var19 = *(_SmsBigIdentifier **)(uVar18 + 8 + (longlong)puVar16 * 0x10); + pCVar14 = this; + cVar5 = (*local_c8)(local_d0); + if (cVar5 == '\0') { + *(undefined4 *)(uVar18 + (longlong)puVar16 * 0x10) = 0xc0000470; } - *local_d8 = '\x01'; - uVar20 = uVar13; - if (local_108 != 0xffffffff) { - p_Var19 = (_SmsBigIdentifier *)(ulonglong)param_5; - pCVar11 = *(CmsVolume **)(uVar18 + 8 + (longlong)puVar14 * 0x10); - iVar5 = (*local_90)(*(undefined8 *)(uVar18 + 8 + (ulonglong)local_108 * 0x10)); - if ((iVar5 != 0) && (uVar20 = local_108, iVar5 == 2)) { - local_80 = CONCAT44(local_80._4_4_,(uint)local_80 + 1); + else { + if ((lVar7 != 0x40000035) && (param_14 == '\0')) { + bVar2 = true; + } + *local_e0 = '\x01'; + uVar20 = uVar23; + if (local_108 != 0xffffffff) { + p_Var19 = (_SmsBigIdentifier *)(ulonglong)param_5; + pCVar14 = *(CmsVolume **)(uVar18 + 8 + (longlong)puVar16 * 0x10); + iVar6 = (*local_98)(*(undefined8 *)(uVar18 + 8 + (ulonglong)local_108 * 0x10)); + if ((iVar6 != 0) && (uVar20 = local_108, iVar6 == 2)) { + local_f4 = local_f4 + 1; + } } } } - } - local_108 = uVar20; - uVar13 = uVar13 + 1; - puVar14 = (ulonglong *)(ulonglong)uVar13; - local_e0 = CONCAT44(local_e0._4_4_,uVar13); - param_10 = local_b8; - } while (uVar13 < uVar21); - } - if (((param_10 == (_SmsScrubIoOutput *)0x0) && (local_f0 == uVar21)) && - (lVar4 = ReadLcnTuple(this,pCVar11,p_Var19,param_4,uVar23,*(void **)(uVar18 + 8),(ulong *)0x0,0 - ), -1 < lVar4)) { - p_Var19 = *(_SmsBigIdentifier **)(uVar18 + 8); - cVar3 = (*local_c0)(local_c8,this,p_Var19,param_4); - if (cVar3 != '\0') { + local_108 = uVar20; + local_fc = uVar23 + 1; + puVar16 = (ulong *)(ulonglong)local_fc; + param_10 = local_c0; + uVar8 = (ulong)local_78; + } while (local_fc < local_104); + } + p_Var3 = local_e8; + if (((param_10 == (_SmsScrubIoOutput *)0x0) && (local_f8 == local_104)) && + (lVar7 = ReadLcnTuple(this,pCVar14,p_Var19,local_e8,uVar21,*(void **)(uVar18 + 8), + (ulong *)0x0,0), -1 < lVar7)) { + p_Var19 = *(_SmsBigIdentifier **)(uVar18 + 8); + cVar5 = (*local_c8)(local_d0,this); + pvVar15 = (void *)0x0; + if (cVar5 == '\0') goto LAB_6; bVar2 = true; local_108 = 0; - *local_d8 = '\x01'; - } - } - uVar15 = 0; - if (*local_d8 != '\0') { - if (bVar2) { - if (param_10 != (_SmsScrubIoOutput *)0x0) { - *(ulonglong *)(param_10 + 0x10) = (ulonglong)uVar23; - *(int *)param_10 = -0x3ffffb96; - *(undefined8 *)(param_10 + 8) = 0; -LAB_4: - *(longlong *)(param_10 + 0x28) = - *(longlong *)param_4 << ((byte)*(undefined4 *)(this + 0x40) & 0x3f); - *(ulonglong *)(param_10 + 0x30) = (ulonglong)uVar23; - *(ulonglong *)(param_10 + 0x18) = (ulonglong)uVar23; - } - } - else if ((uint)local_80 < uVar21 - 1) { - local_80 = (ulonglong)(ushort)local_108 << 0x10; - uVar22 = 0; - puVar12 = local_d8; - uVar9 = uVar15; - if (uVar21 != 0) { - do { - uVar9 = uVar15; - param_10 = local_b8; - if (1 < (uint)uVar15) break; - if (uVar22 != (ushort)local_108) { - cVar3 = FsRtlIsTotalDeviceFailure(*(undefined4 *)(uVar18 + (ulonglong)uVar22 * 0x10)); - if ((cVar3 == '\0') && (*(int *)(uVar18 + (ulonglong)uVar22 * 0x10) < 0)) { - uVar9 = (ulonglong)((uint)uVar15 + 1); - *(ushort *)((longlong)local_78 + uVar15 * 2 + -4) = uVar22; + *local_e0 = '\x01'; + } + else { +LAB_6: + pvVar15 = (void *)(ulonglong)local_108; + } + uVar17 = 0; + if (*local_e0 != '\0') { + if (bVar2) { + if (param_10 != (_SmsScrubIoOutput *)0x0) { + *(ulonglong *)(param_10 + 0x10) = (ulonglong)uVar21; + *(int *)param_10 = -0x3ffffb96; + *(undefined8 *)(param_10 + 8) = 0; + lVar11 = *(longlong *)p_Var3; +LAB_7: + *(longlong *)(param_10 + 0x28) = lVar11 << ((byte)*(undefined4 *)(this + 0x40) & 0x3f); + *(ulonglong *)(param_10 + 0x18) = (ulonglong)uVar21; + *(ulonglong *)(param_10 + 0x30) = (ulonglong)uVar21; + } + } + else if (local_f4 < local_104 - 1) { + uVar22 = 0; + local_78 = ((ulonglong)pvVar15 & 0xffff) << 0x10; + uVar12 = uVar17; + if (local_104 != 0) { + do { + uVar12 = uVar17; + param_10 = local_c0; + this = local_88; + if (1 < (uint)uVar17) break; + if (uVar22 != (ushort)pvVar15) { + cVar5 = FsRtlIsTotalDeviceFailure(*(undefined4 *)(uVar18 + (ulonglong)uVar22 * 0x10)); + pvVar15 = (void *)(ulonglong)local_108; + if ((cVar5 == '\0') && (*(int *)(uVar18 + (ulonglong)uVar22 * 0x10) < 0)) { + uVar12 = (ulonglong)((uint)uVar17 + 1); + *(ushort *)((longlong)local_70 + uVar17 * 2 + -4) = uVar22; + } } + uVar22 = uVar22 + 1; + uVar17 = uVar12; + param_10 = local_c0; + this = local_88; + } while (uVar22 < local_104); + } + p_Var3 = local_e8; + local_78 = CONCAT62(local_78._2_6_,(short)uVar12); + if ((short)uVar12 == 0) { + lVar9 = -0x3fffff40; + } + else { + lVar9 = RepairFromCopyLcnTuple + (this,pvVar15,p_Var19,local_e8,uVar21,(_SmsRepairParameters *)&local_78, + (_SmsTopologyIds *)local_b8,local_80); + } + if (param_10 != (_SmsScrubIoOutput *)0x0) { + uVar12 = (ulonglong)uVar21; + uVar17 = 0; + if (lVar9 < 0) { + uVar12 = 0; + uVar17 = (ulonglong)uVar21; } - uVar22 = uVar22 + 1; - uVar15 = uVar9; - param_10 = local_b8; - } while (uVar22 < uVar21); - } - local_80 = CONCAT62(local_80._2_6_,(short)uVar9); - if ((short)uVar9 == 0) { - lVar6 = -0x3fffff40; - } - else { - lVar6 = RepairFromCopyLcnTuple - (this,puVar12,p_Var19,param_4,uVar23,(_SmsRepairParameters *)&local_80, - local_b0,local_88); - } - if (param_10 != (_SmsScrubIoOutput *)0x0) { - uVar9 = (ulonglong)uVar23; - uVar15 = 0; - if (lVar6 < 0) { - uVar9 = 0; - uVar15 = (ulonglong)uVar23; - } - *(ulonglong *)(param_10 + 0x10) = uVar15; - *(ulonglong *)(param_10 + 8) = uVar9; - *(long *)param_10 = lVar6; - goto LAB_4; - } - } - } - if (*local_d8 != '\0') { - memmove(local_a8,*(void **)(uVar18 + 8 + (ulonglong)local_108 * 0x10),(ulonglong)uVar23); - MspCleanupTopologyIds((_SmsTopologyIds *)&local_a0); - if (uVar18 != 0) { - ExFreePoolWithTag(uVar18,0); - } - return 0; - } - if (-1 < lVar4) { - lVar4 = FUN_1c0095f33(1); - return lVar4; - } -LAB_1: - *local_d8 = '\0'; - lVar4 = FUN_1c005e485(); - return lVar4; + *(ulonglong *)(param_10 + 0x10) = uVar17; + *(ulonglong *)(param_10 + 8) = uVar12; + *(long *)param_10 = lVar9; + lVar11 = *(longlong *)p_Var3; + goto LAB_7; + } + } + } + if (*local_e0 == '\0') { + bVar2 = true; + bVar4 = true; + if (lVar7 < 0) goto LAB_1; + if (local_f0 < 0) { + lVar7 = local_f0; + } + goto LAB_2; + } + memmove(local_b0,*(void **)(uVar18 + 8 + (ulonglong)local_108 * 0x10),(ulonglong)uVar21); + lVar7 = 0; + } + MspCleanupTopologyIds((_SmsTopologyIds *)&local_a8); +LAB_3: + if (uVar18 != 0) { + ExFreePoolWithTag(uVar18,0); + } + return lVar7; } ``` ## LogReadControlRecord ### Match Info |Key|refs-2026-06.sys - refs-2026-07.sys| | :---: | :---: | |diff_type|code,refcount,length,address,called| |ratio|0.63| |i_ratio|0.38| |m_ratio|0.99| |b_ratio|0.46| |match_types|SymbolsHash| ### Function Meta Diff |Key|refs-2026-06.sys|refs-2026-07.sys| | :---: | :---: | :---: | |name|LogReadControlRecord|LogReadControlRecord| |fullname|LogReadControlRecord|LogReadControlRecord| |`refcount`|4|3| |`length`|879|866| |`called`|LogValidateEntryHeader
LogVerifyChecksumEntryHeader
NTOSKRNL.EXE::ExAllocatePoolWithTag
NTOSKRNL.EXE::ExFreePoolWithTag
_guard_dispatch_icall
memmove
memset|Feature_1912855864__private_IsEnabledDeviceUsage
LogValidateEntryHeader
LogValidateEntryMetadata
LogVerifyChecksumEntryHeader
NTOSKRNL.EXE::ExAllocatePoolWithTag
NTOSKRNL.EXE::ExFreePoolWithTag
_guard_dispatch_icall
memmove
memset| |calling|LogCoreReadControlArea|LogCoreReadControlArea| |paramcount|0|0| |`address`|1c00581b8|1c005bfa0| |sig|undefined LogReadControlRecord(void)|undefined LogReadControlRecord(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### LogReadControlRecord Called Diff ```diff --- LogReadControlRecord called +++ LogReadControlRecord called @@ -0,0 +1 @@ +Feature_1912855864__private_IsEnabledDeviceUsage @@ -1,0 +3 @@ +LogValidateEntryMetadata ``` ### LogReadControlRecord Diff ```diff --- LogReadControlRecord +++ LogReadControlRecord @@ -1,130 +1,136 @@ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ int LogReadControlRecord(longlong param_1,undefined8 param_2,longlong param_3,void *param_4) { uint uVar1; bool bVar2; int iVar3; int iVar4; int iVar5; + int iVar6; void *_Dst; - int iVar6; - longlong lVar7; + int iVar7; uint uVar8; - int iVar9; - uint uVar10; - longlong lVar11; + uint uVar9; + longlong lVar10; + uint uVar11; + longlong lVar12; + bool bVar13; ulonglong in_stack_ffffffffffffff80; uint local_64; uint local_60; longlong local_58 [3]; local_60 = 0; local_64 = 0; - iVar9 = 0; + iVar6 = 0; bVar2 = false; local_58[0] = 0; uVar8 = 0xffffffff; + uVar9 = 0xffffffff; uVar1 = *(uint *)(param_1 + 0x2f38); if ((*(byte *)(param_1 + 0x3c) & 1) == 0) { uVar1 = 1; } _Dst = (void *)ExAllocatePoolWithTag(0x200,uVar1 << 0xc,0x6c6c534d); if (_Dst == (void *)0x0) { iVar5 = -0x3fffff66; goto LAB_0; } memset(_Dst,0,(ulonglong)(uVar1 << 0xc)); - iVar6 = *(int *)(param_1 + 0xe54) * *(uint *)(param_1 + 0xe50); + iVar7 = *(int *)(param_1 + 0xe54) * *(uint *)(param_1 + 0xe50); param_3 = (ulonglong)*(uint *)(param_1 + 0xe50) * param_3; iVar5 = 0; - if (((uVar1 < 2) || (iVar5 = (*DAT_1)(param_2,param_3,iVar6,local_58), -1 < iVar5)) || + if (((uVar1 < 2) || (iVar5 = (*DAT_1)(param_2,param_3,iVar7,local_58), -1 < iVar5)) || (local_58[0] != 0)) { - uVar10 = 0; - lVar7 = param_1; - iVar4 = 0; + uVar11 = 0; + iVar3 = 0; if (uVar1 != 0) { do { - lVar11 = (ulonglong)(uVar10 << 0xc) + (longlong)_Dst; + lVar12 = (ulonglong)(uVar11 << 0xc) + (longlong)_Dst; if (uVar1 < 2) { - iVar5 = (*DAT_2)(param_2,3,lVar11,iVar6,param_3); + iVar5 = (*DAT_2)(param_2,3,lVar12,iVar7,param_3); } else { - iVar5 = (*DAT_3)(param_2,lVar11,iVar6,param_3,uVar10); + iVar5 = (*DAT_3)(param_2,lVar12,iVar7,param_3,uVar11); } if (iVar5 < 0) { local_60 = local_60 + 1; - iVar3 = iVar5; - if (iVar4 < 0) { - iVar3 = iVar4; + iVar4 = iVar5; + if (iVar3 < 0) { + iVar4 = iVar3; } LAB_4: - lVar7 = param_1; - iVar9 = iVar3; + iVar6 = iVar4; } else { in_stack_ffffffffffffff80 = in_stack_ffffffffffffff80 & 0xffffffffffffff00; - lVar7 = param_1; - iVar3 = LogValidateEntryHeader(param_1,0,0,lVar11,0x1000,in_stack_ffffffffffffff80); - iVar9 = iVar4; - if (iVar3 < 0) { - lVar7 = param_1; - if (-1 < iVar4) goto LAB_4; + iVar4 = LogValidateEntryHeader(param_1,0,0,lVar12,0x1000,in_stack_ffffffffffffff80); + iVar6 = iVar3; + if (iVar4 < 0) { + if (-1 < iVar3) goto LAB_4; } else { - iVar4 = LogVerifyChecksumEntryHeader(); - if (-1 < iVar4) { + iVar3 = LogVerifyChecksumEntryHeader(param_1,0x1000,lVar12); + if (-1 < iVar3) { local_64 = local_64 + 1; if (iVar5 != 0x40000035) { bVar2 = true; } - if (uVar8 == 0xffffffff) { - uVar8 = uVar10; + bVar13 = uVar9 == 0xffffffff; + uVar9 = uVar8; + if (bVar13) { + uVar9 = uVar11; + uVar8 = uVar11; } } } } - uVar10 = uVar10 + 1; - iVar4 = iVar9; - } while (uVar10 < uVar1); + uVar11 = uVar11 + 1; + iVar3 = iVar6; + } while (uVar11 < uVar1); } - if (((local_60 == uVar1) && (iVar4 = (*DAT_2)(param_2,3,_Dst,iVar6,param_3), -1 < iVar4) - ) && (iVar4 = LogVerifyChecksumEntryHeader(lVar7,0x1000,_Dst), -1 < iVar4)) { - uVar8 = 0; + if (((local_60 == uVar1) && (iVar3 = (*DAT_2)(param_2,3,_Dst,iVar7,param_3), -1 < iVar3) + ) && (iVar3 = LogVerifyChecksumEntryHeader(param_1,0x1000,_Dst), -1 < iVar3)) { + uVar9 = 0; bVar2 = true; local_64 = 1; } - else if (uVar8 == 0xffffffff) { - if ((-1 < iVar5) && (iVar5 = -0x3ffffb90, iVar9 < 0)) { - iVar5 = iVar9; + else if (uVar9 == 0xffffffff) { + if ((-1 < iVar5) && (iVar5 = -0x3ffffb90, iVar6 < 0)) { + iVar5 = iVar6; } goto LAB_5; } - lVar11 = (ulonglong)(uVar8 << 0xc) + (longlong)_Dst; + lVar12 = (ulonglong)(uVar9 << 0xc) + (longlong)_Dst; if ((local_64 != uVar1) && (!bVar2)) { in_stack_ffffffffffffff80 = 0; - (*DAT_6)(param_2,param_3,iVar6,uVar8,uVar1,0); + (*DAT_6)(param_2,param_3,iVar7,uVar9,uVar1,0); } iVar5 = LogValidateEntryHeader - (lVar7,0,0,lVar11,0x1000,in_stack_ffffffffffffff80 & 0xffffffffffffff00); + (param_1,0,0,lVar12,0x1000,in_stack_ffffffffffffff80 & 0xffffffffffffff00); if (-1 < iVar5) { - lVar11 = (ulonglong)*(uint *)(lVar11 + 0x54) + lVar11; - if (*(int *)(lVar11 + 0x20) == 0xe48) { - memmove(param_4,(void *)(lVar11 + (ulonglong)*(uint *)(lVar11 + 0x28)),0xe48); + lVar10 = (ulonglong)*(uint *)(lVar12 + 0x54) + lVar12; + if (*(int *)(lVar10 + 0x20) == 0xe48) { + iVar6 = Feature_1912855864__private_IsEnabledDeviceUsage(); + if ((iVar6 == 0) || (iVar5 = LogValidateEntryMetadata(lVar12,0x1000), -1 < iVar5)) { + memmove(param_4,(void *)((ulonglong)*(uint *)(lVar10 + 0x28) + lVar10), + (ulonglong)*(uint *)(lVar10 + 0x20)); + } } else { iVar5 = -0x3fc2fdfe; } } } LAB_5: ExFreePoolWithTag(_Dst,0); LAB_0: if (local_58[0] != 0) { (*DAT_7)(param_2); } return iVar5; } ``` ## FUN_1c0095f33 ### Match Info |Key|refs-2026-06.sys - refs-2026-07.sys| | :---: | :---: | |diff_type|code,name,fullname,refcount,length,sig,address,calling,called| |ratio|0.28| |i_ratio|0.0| |m_ratio|0.5| |b_ratio|0.2| |match_types|SigCallingCalledHasher| ### Function Meta Diff |Key|refs-2026-06.sys|refs-2026-07.sys| | :---: | :---: | :---: | |`name`|FUN_1c0095f33|LogValidateEntryMetadata| |`fullname`|FUN_1c0095f33|LogValidateEntryMetadata| |`refcount`|1|3| |`length`|19|39| |`called`|FUN_1c005e485|| |`calling`|CmsVolume::ReadAndRepairSelfChecksumBlock|LogCoreScanDataRecord
LogReadControlRecord| |paramcount|0|0| |`address`|1c0095f33|1c007be54| |`sig`|undefined FUN_1c0095f33(void)|undefined LogValidateEntryMetadata(void)| |sym_type|Function|Function| |sym_source|DEFAULT|IMPORTED| |external|False|False| ### FUN_1c0095f33 Called Diff ```diff --- FUN_1c0095f33 called +++ LogValidateEntryMetadata called @@ -1 +0,0 @@ -FUN_1c005e485 ``` ### FUN_1c0095f33 Calling Diff ```diff --- FUN_1c0095f33 calling +++ LogValidateEntryMetadata calling @@ -1 +1,2 @@ -CmsVolume::ReadAndRepairSelfChecksumBlock +LogCoreScanDataRecord +LogReadControlRecord ``` ### FUN_1c0095f33 Diff ```diff --- FUN_1c0095f33 +++ LogValidateEntryMetadata @@ -1,28 +1,16 @@ -/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ - -ulonglong FUN_1c0095f33(void) +undefined8 LogValidateEntryMetadata(longlong param_1,int param_2) { - ulonglong uVar1; - ulonglong unaff_RBX; - longlong unaff_RBP; - char unaff_SIL; - longlong unaff_R13; - ulonglong in_stack_00000040; - longlong in_stack_00000058; + uint uVar1; + uint uVar2; - if (-1 < in_stack_00000058) { - memset(*(void **)(unaff_RBP + -0x60),-0x21524111,in_stack_00000040 >> 0x20); - if (unaff_SIL != '\0') { - MspCleanupTopologyIds((_SmsTopologyIds *)(unaff_RBP + -0x58)); - } - if (unaff_R13 != 0) { - ExFreePoolWithTag(); - } - return unaff_RBX & 0xffffffff; + uVar1 = *(uint *)(param_1 + 0x54); + uVar2 = *(uint *)((ulonglong)uVar1 + 0x28 + param_1); + if (((0x37 < uVar2) && (uVar2 <= param_2 - uVar1)) && + (*(uint *)((ulonglong)uVar1 + 0x20 + param_1) <= (param_2 - uVar1) - uVar2)) { + return 0; } - uVar1 = FUN_1c005e485(); - return uVar1; + return 0xc03d0202; } ``` # Modified (No Code Changes) *Slightly modified functions have no code changes, rather differnces in:* - refcount - length - called - calling - name - fullname ## RefsFspClose ### Match Info |Key|refs-2026-06.sys - refs-2026-07.sys| | :---: | :---: | |diff_type|length,address,called| |ratio|1.0| |i_ratio|0.67| |m_ratio|0.79| |b_ratio|0.79| |match_types|SymbolsHash| ### Function Meta Diff |Key|refs-2026-06.sys|refs-2026-07.sys| | :---: | :---: | :---: | |name|RefsFspClose|RefsFspClose| |fullname|RefsFspClose|RefsFspClose| |refcount|12|12| |`length`|811|529| |`called`|
Expand for full list:
NTOSKRNL.EXE::ExRaiseStatus
NTOSKRNL.EXE::IoGetTopLevelIrp
NTOSKRNL.EXE::IoSetTopLevelIrp
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
RefsCheckpointForLogFileFull
RefsCommonClose
RefsExtendedCompleteRequestInternal
RefsInitializeTopLevelIrp
RefsPreRequestProcessingExtend
RefsQueueCloseRefsRemoveClose
RefsStatusDebug
WPP_SF_D
|NTOSKRNL.EXE::IoSetTopLevelIrp
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
RefsCheckpointForLogFileFull
RefsCommonClose
RefsInitializeTopLevelIrp
RefsPreRequestProcessingExtend
RefsRemoveClose| |calling|RefsCheckpointVolumeUntilDone
RefsCommonCreate
RefsFlushVolume
RefsPerformDismountOnVcb|RefsCheckpointVolumeUntilDone
RefsCommonCreate
RefsFlushVolume
RefsPerformDismountOnVcb| |paramcount|1|1| |`address`|1c0186e90|1c0187dc0| |sig|void __cdecl RefsFspClose(_VCB * param_1)|void __cdecl RefsFspClose(_VCB * param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### RefsFspClose Called Diff ```diff --- RefsFspClose called +++ RefsFspClose called @@ -1,2 +0,0 @@ -NTOSKRNL.EXE::ExRaiseStatus -NTOSKRNL.EXE::IoGetTopLevelIrp @@ -8 +5,0 @@ -RefsExtendedCompleteRequestInternal @@ -11 +7,0 @@ -RefsQueueClose @@ -13,2 +8,0 @@ -RefsStatusDebug -WPP_SF_D ``` ## NTOSKRNL.EXE::ExFreePoolWithTag ### Match Info |Key|refs-2026-06.sys - refs-2026-07.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|refs-2026-06.sys|refs-2026-07.sys| | :---: | :---: | :---: | |name|ExFreePoolWithTag|ExFreePoolWithTag| |fullname|NTOSKRNL.EXE::ExFreePoolWithTag|NTOSKRNL.EXE::ExFreePoolWithTag| |`refcount`|763|764| |length|0|0| |called||| |`calling`|
Expand for full list:
::operator()
AllocateAndComposeTableKeyPath
AllocateAndGetVolumeLabel
CleanupClMulCrcLibrary
CmsAllocationZones::CreateForFormat
CmsAllocationZones::ExtendSingleTier
CmsAllocator::MakeRegion
CmsAllocator::PersistFilteredViewParallel
CmsAllocator::ReleaseFilteredView
CmsAllocator::Shutdown
CmsAllocator::`scalar_deleting_destructor'CmsAvlTableFlex::FreeIndexEntry
CmsAvlTableLite::FreeIndexEntry
CmsBPlusTable::AbortUndoRecords
CmsBPlusTable::AddToIndex
CmsBPlusTable::ChecksumWritePlanLevel
CmsBPlusTable::CommitUndoRecords
CmsBPlusTable::CoordinateTreeUpdateWorkInParallel
CmsBPlusTable::DiscardAllPages
CmsBPlusTable::EnqueueTreeUpdate
CmsBPlusTable::ForEachTablePageInPageTable
CmsBPlusTable::GenerateTriageContext
CmsBPlusTable::PrepareToFreeOrWritePagesWorker
CmsBPlusTable::ReleaseTreeIoBatch
CmsBPlusTable::RunPageCleanupForAllDirtyTrees
CmsBPlusTable::SetObjectRecordPayload
CmsBPlusTable::TriageCorruptChild
CmsBPlusTable::UpdateBoundTrees
CmsBPlusTable::UpdateObjectTableWorkerParentChildTable
CmsBPlusTable::operator_delete
CmsBlockCache::GrowMaxBlockAddresses
CmsBlockCache::Teardown
CmsBlockRefcount::BlockRefTableTelemetry
CmsBlockRefcount::`scalar_deleting_destructor'
CmsCachedRuns::`scalar_deleting_destructor'
CmsCachedRuns::~CmsCachedRuns
CmsChecksum::UninitializeLibrary
CmsCompositeBase::CacheRoot
CmsCompositeBase::TeardownCachedRoot
CmsCompositeBase::`vector_deleting_destructor'
CmsCompression::UninitializeLibrary
CmsContainerCursor::`scalar_deleting_destructor'
CmsContainerCursor::~CmsContainerCursor
CmsContainerRangeMap::`scalar_deleting_destructor'
CmsCountMap::AddEntry
CmsCountMap::DeleteEntry
CmsCountMap::FindMappedValue
CmsCowRootComposite::`scalar_deleting_destructor'
CmsCrc32<&unsigned_long___cdecl_Crc32C_Intrinsic(void_const*___ptr64,unsigned___int64,unsigned_long),PARITY_ENCODER,1>::`scalar_deleting_destructor'
CmsDurableLog::LogReleaseTopologyId
CmsDurableLog::LogWriteBatchCompletion
CmsDurableLog::MergeMemLog
CmsDurableLog::Start
CmsEmbeddedComposite::AbortReparent
CmsEmbeddedComposite::CommitReparent
CmsEmbeddedComposite::PinRootInternal
CmsEmbeddedComposite::Reparent
CmsEmbeddedComposite::TeardownParent
CmsEmbeddedComposite::`vector_deleting_destructor'
CmsFailoverBPlusTable::TriageInsertFromBackup
CmsFailoverBPlusTable::TriageRepairFromBackup
CmsFailoverBPlusTable::`scalar_deleting_destructor'
CmsHashTable::CreateOrExpandOverflowBucket
CmsHashTable::DeleteInternal
CmsHashTable::Optimize
CmsHashTable::Uninitialize
CmsIntegrityState::`scalar_deleting_destructor'
CmsKeyRules::AddKeyRules
CmsKeyRules::UninitializeLibrary
CmsLogRedoQueue::OpenTable
CmsLogRedoQueue::OpenTableFromTablePath
CmsLogRedoQueue::RedoModifyStreamExtent
CmsLogRedoQueue::RedoOneRecord
CmsLogRedoQueue::RedoReparentTable
CmsLogRedoQueue::RedoStreamFastPathRowInsertion
CmsLogRedoQueue::RedoWorkRoutine
CmsLogRedoQueue::SaveCurrentTablePath
CmsLogRedoQueue::Teardown
CmsLookasides::Free
CmsLookasides::UninitializeLibrary
CmsMatchAllCursor::`vector_deleting_destructor'
CmsMatchTablePathCursor::`scalar_deleting_destructor'
CmsObjectTable::AddIdentifierAtLcn
CmsObjectTable::EnumerateQueryChildrenCursor
CmsObjectTable::GetParentIdentifierByChildIdentifier
CmsObjectTable::InitializeTable
CmsObjectTable::UpdateIdentifierLcn
CmsPinCache::~CmsPinCache
CmsPoolComposite::`scalar_deleting_destructor'
CmsPoolComposite::~CmsPoolComposite
CmsRangeAndCountMap::~CmsRangeAndCountMap
CmsRangeMap::DeleteEntry
CmsRangeMap::PinRangeInIndex
CmsReadCache::AddRequestToReadCacheContext
CmsReadCache::GatherCacheContext
CmsReadCache::ProcessReadCacheRepair
CmsReadCache::UpdateCacheFromCacheContext
CmsReferenced::`scalar_deleting_destructor'
CmsReservedPools::~CmsReservedPools
CmsRestarter::FindObjectTableLSN
CmsRestarter::FindOpenTable
CmsRestarter::QueueWait
CmsRestarter::RedoOneRecordBlock
CmsRestarter::RedoTUTables
CmsRestarter::StoreDeletedTable
CmsRestarter::Teardown
CmsRestarter::UpdatePathPrefix
CmsRestarter::~CmsRestarter
CmsRowWithBuffer::GrowBuffer
CmsRowWithBuffer::NewLength
CmsRowWithBuffer::NewLength
CmsRowWithBuffer::Reset
CmsRowWithBuffer::operator=
CmsRowWithBuffer::~CmsRowWithBuffer
CmsRulesMETA::CreateDirectorKey
CmsSchemaTable::GrowCachedSchemasArray
CmsSchemaTable::InitializePhase2
CmsSchemaTable::RegisterSchema
CmsSchemaTable::~CmsSchemaTable
CmsStream::AddAllocation
CmsStream::DuplicateExtents
CmsStream::FastPathRowSlice
CmsStream::GenerateChecksumForRange
CmsStream::GetGhostedExtentMetadata
CmsStream::GetStreamExtentCountWithStartingVcn
CmsStream::GetStreamSummary
CmsStream::GetStreamUserPayload
CmsStream::InvalidateChecksums
CmsStream::LookupSnapshotDelta
CmsStream::MergeTwoRuns
CmsStream::PrecowSharedRanges
CmsStream::SetContainersStationaryVolatile
CmsStream::SplitRun
CmsStream::StripAllChecksums
CmsStream::UpdateStreamSummary
CmsStream::UpdateStreamUserPayload
CmsStream::VerifyOrRepairFromChecksum
CmsStream::`vector_deleting_destructor'
CmsStream::~CmsStream
CmsTable::Enumerate
CmsTable::UpdateCursorFromFoundIndexEntry
CmsTableCursor::RestartCursor
CmsTableCursor::~CmsTableCursor
CmsTableSetBase::AttachNew
CmsTableSetBase::`scalar_deleting_destructor'
CmsTableSetBase::~CmsTableSetBase
CmsThinProvisioning::ProcessAllocatedRanges
CmsTransactionContext::GetScrubBuffer
CmsTransactionContext::ReuseTransaction
CmsTransactionContext::`vector_deleting_destructor'
CmsTrashTable::TeardownEntry
CmsTrashTable::TrashCleanerWorkerFn
CmsTxMemLog::AllocateRedoBlock
CmsTxMemLog::FreeRedoBlock
CmsVolume::ChangeVolumeOptionDynamically
CmsVolume::Checkpoint
CmsVolume::CleanupDirtyTableEntriesAfterTreeUpdateInternal
CmsVolume::Extend
CmsVolume::InitializeRangeSearchStrategies
CmsVolume::InitializeStorageTier
CmsVolume::InitializeStorageTierArray
CmsVolume::InitializeVolumeRedoLog
CmsVolume::MakePageResident
CmsVolume::MoveSuperBlock
CmsVolume::ReadAndRepairSelfChecksumBlock
CmsVolume::ReadLatestCheckpoint
CmsVolume::ReadSuperBlock
CmsVolume::Shutdown
CmsVolume::TeardownPageTableEntry
CmsVolume::`vector_deleting_destructor'
CmsVolume::~CmsVolume
CmsVolumeAnalyzer::AnalyzeAndProcessContainerMoves
CmsVolumeAnalyzer::CleanupRotationBuffers
CmsVolumeAnalyzer::CompactContainers
CmsVolumeAnalyzer::DeleteBitmaps
CmsVolumeAnalyzer::`scalar_deleting_destructor'
CmsVolumeContainer::AddReservedContainer
CmsVolumeContainer::CompactAndCompressContainer
CmsVolumeContainer::CompressContainerBuffer
CmsVolumeContainer::CreateContainerEnumerateCursor
CmsVolumeContainer::FreeCompactAndCompressContainerBuffers
CmsVolumeContainer::Initialize
CmsVolumeContainer::InsertCompressionUnitOffsetsForContainer
CmsVolumeContainer::PersistContainerCache
CmsVolumeContainer::PersistContainerCacheParallel
CmsVolumeContainer::ReadCompressedContainerRangeInternal
CmsVolumeContainer::RealRangeToContainerRange
CmsVolumeContainer::RecompactEmbeddedContainer
CmsVolumeContainer::ReleasePinnedContainersAtEndOfTransaction
CmsVolumeContainer::RestoreCompactionContainerRanges
CmsVolumeContainer::RestoreContainerArray
CmsVolumeContainer::RotateContainers
CmsVolumeContainer::SetContainerRangeValid
CmsVolumeContainer::SetContainerStationaryVolatile
CmsVolumeContainer::Shutdown
CmsVolumeContainer::ValidateContainerRotationBuffer
CmsVolumeContainer::`scalar_deleting_destructor'
CmsVolumeContainer::~CmsVolumeContainer
ConditionallyCreateOrOpenFileSystemFile
CopyKeyHelper
CopyObjectTablePayload
DeleteDirectoryOnDisk
DriverEntry
EndAndCleanupEnumeration
FUN_1c0009928
FUN_1c001c69f
FUN_1c0040e7a
FUN_1c00424c3
FUN_1c004bb50
FUN_1c0051ed4
FUN_1c007e8f6
FUN_1c007efd5
FUN_1c00882ca
FUN_1c008d102
FUN_1c0091b86
FUN_1c0091bae
FUN_1c0095c36
FUN_1c01befb7
FUN_1c01c083f
FUN_1c01c4f30
FUN_1c01c61a5
FsLibInitializeIoPerf
FsLibIoFailureCleanupSummary
FsLibIoPerfCleanupPeriodicData
FsLibIoPerfCleanupSummaryData
FsLibIoPerfFreeCountersData
FsLibIoPerfFreeVolumeData
FsLibIoPerfInitializeVolumeData
GetDiskProperties
GetSharedSecurityFromDescriptorUnsafe
InitializeDefaultClientRootSecurityDescriptor
InitializeDefaultSecurityDescriptor
InitializeDefaultServerRootSecurityDescriptor
InitializeVcbDeviceName
InitializeVerifyBlock
InitializeVolumeInfoTable
IssueSynchronousDeviceIoControl
LogCoreScanDataRecord
LogCoreWriteDataRecord
LogReadControlRecord
LogRepairEntryHeader
LogWriteEntryCompletion
MlLogCloseLog
MlLogOpenLog
MlLogScanLog
MsAllocator::RangeArrayStrategy::State::PostExtend
MsAllocator::RangeArrayStrategy::State::`scalar_deleting_destructor'
MsAllocator::RangeArrayStrategy::State::~State
MsAllocator::SmrStrategy::State::`scalar_deleting_destructor'
MsCreateDurableFailoverTableObject
MsCreateDurableTableObject
MsFreeChecksumContext
MsKmeAllocateIoRequest
MsKmeClearSmrBandInfoCache
MsKmeDeleteReservedIoRuns
MsKmeGetSMRBandSize
MsKmeGetSMRBandWriteHead
MsKmePrefetchPages
MsKmeQueryAndCacheSmrBandInfoForRange
MsKmeQueryCpuInformation
MsKmeQueryMapAllocations
MsKmeReleaseIoRequest
MsKmeResetIoRequest
MsKmeResetSMRSimBand
MsKmeUpdateBootSector
MsKmeZeroSMRRegion
MsPersistReserveAllocationAndGenerateChecksum
MsTriageDeleteContext
MsUninitializeLibrary
MspCleanupDirtyTableListWorkerFn
MspCleanupTopologyIds
MspGrowTopologyIds
OpenFileSystemFile
ReallocateAndCopyIndexEntryIntoBuffer
RefsAbortPendingUsnReasons
RefsAccessCheck
RefsAcquireParentForSystemFile
RefsAppendNameToParent
RefsBuildFileName
RefsBuildRelativeName
RefsCacheSharedSecurityForCreate
RefsCancelReadUsnJournal
RefsChangeAttributeValue
RefsChangeResidentStreamIntegrity
RefsChangeStreamSparsenessAndBlob
RefsChangeVolumeSize
RefsCheckToAllowForReadCache
RefsCleanupAttributeContext
RefsCleanupAttributeExpression
RefsCleanupFailedTransaction
RefsCommitCurrentTransaction
RefsCommonClose
RefsCommonCreate
RefsCommonVolumeOpen
RefsCompleteThroughDebugInfoIrpImplementation
RefsConvertToIntegrity
RefsCreateAttribute
RefsCreateAttributeWithValueReal
RefsCreateFileId2
RefsCreateIndex
RefsCreateLinkAttribute
RefsCreateStreamSnapshot
RefsDeactivateUsnJournal
RefsDecompressWorker
RefsDecrementFcbUsnRecordReferenceCountAndFreeIt
RefsDefragFileInternal
RefsDeleteCcb
RefsDeleteFcb
RefsDeleteMdlAndBuffer
RefsDeleteNormalizedName
RefsDeleteReservedBitmap
RefsDeleteReservedBuffer
RefsDeleteScb
RefsDeleteVcb
RefsDetermineVirtualDisk
RefsEtwPostWriteEventWorker
RefsEtwWriteVolumeFailureEvent
RefsFreeEresource
RefsFreeFcbTableEntry
RefsFreeFcbUsnRecord
RefsFreeFileKey
RefsFreeNonpagedDataFcb
RefsFreeNonpagedIndexFcb
RefsFreeScbAttributeName
RefsFullDeleteLcb
RefsGeneratePathNameForEventLog
RefsGetSfioReservation
RefsGetVolumeInformation
RefsHoldIrpForNewUsn
RefsInitializeObjLinkRow
RefsInitializeReservedBuffer
RefsIoPerfLogFileObjectInfo
RefsIoPerfPostFileObjectInfo
RefsIsVolumeUpgradeDisabled
RefsKsrRestoreContext
RefsKsrSaveContext
RefsLinkFileToSelf
RefsLookupAttributeForScb
RefsMapAttributeValue
RefsMigrateLcb
RefsMountVolume
RefsNonCachedNonAlignedIo
RefsNotifyChangeDirectory
RefsNotifyNewUsn
RefsOpenFcbById
RefsOpenUsnJournal
RefsOplockPrePostIrp
RefsPerformDismountOnVcb
RefsPerformVerifyOperation
RefsPostUsnChangeWithOverrideOption
RefsPrepareForCriticalIo
RefsQueryDirectory
RefsQueryNameInfo
RefsQueryRegionInfo
RefsQueryRetrievalPointers
RefsQueueTriageForDeadLink
RefsReadBootSectorLocation
RefsReadUsnWorker
RefsReleaseAllFiles
RefsReleaseSharedResources
RefsRemoveDebugInfoIrpImplementation
RefsRemoveLink
RefsRemovePrefixHashEntry
RefsRepairDirectory
RefsRepairFile
RefsRepairSecurity
RefsReseekAttribute
RefsReserveCcbNamesInLcb
RefsReserveClusters
RefsSalvageChild
RefsSalvageIndexTable
RefsScrubBootSector
RefsScrubVerifyBlock
RefsSeAccessCheck
RefsSecurityReleaseRow
RefsSendDismountFailedEvent
RefsSendEventLogHourlyReport
RefsSendFileTypeNotification
RefsSetBreakOnCorrupt
RefsSetClearVolumeFlag
RefsSetLinkInfo
RefsSetRenameInfo
RefsSqmAddToStreamEx
RefsStreamSnapshotManagement
RefsTelemetrySetIntegrity
RefsTelemetryVolumeInfoWorker
RefsTelemetryWorker
RefsUnmapAttribute
RefsUpdateDynamicRegistrySettings
RefsUpdateNormalizedName
RefsWaitForNewUsn
RefsWalkUpTree
RefsWatchForRegistryChanges
RefsWriteUsnJournalChanges
RemoveReferenceSharedSecurityUnsafe
SetAndGetVolumeTimes
SetResidentStreamSummary
SetVolumeMounted
SmsAllocationRegionEx::FreeRegionBitmap
SmsAllocationRegionEx::`scalar_deleting_destructor'
SmsCompactionUndoChain::~SmsCompactionUndoChain
SmsContainer::`scalar_deleting_destructor'
SmsContainer::~SmsContainer
SmsTableSetEntry::`scalar_deleting_destructor'
SmsTableSetLookupStack::~SmsTableSetLookupStack
SortWritePlanWorker
TmsTableSet::DeleteRow
TmsTableSet::EnumerateAll
TmsTableSet::FindRow
TmsTableSet::InsertRow
TmsTableSet::PinNextRow
TmsTableSet::PinRowInternalSharedDownMerge
TmsTableSet::PreMergeDownForPinRow
TmsTableSet::`vector_deleting_destructor'
UnlockMainFcbPagingAsyncTableSetCb
UnpinPinnedRowInContext
_SmsBindable::::~
_SmsBindable::`scalar_deleting_destructor'
_SmsBindable::~_SmsBindable
_SmsCacheInfo::`scalar_deleting_destructor'
_SmsLazyWriterNotification::`scalar_deleting_destructor'
_SmsRotationEntry::`scalar_deleting_destructor'
`ConditionallyCreateOrOpenFileSystemFile'::__l1::fin$0
`DeleteDirectoryOnDisk'::__l1::fin$0
`GetDiskProperties'::__l1::fin$0
`InitializeDefaultClientRootSecurityDescriptor'::__l1::fin$0
`InitializeDefaultSecurityDescriptor'::__l1::fin$0
`InitializeDefaultServerRootSecurityDescriptor'::__l1::fin$0
`InitializeVcbDeviceName'::__l1::fin$0
`InitializeVerifyBlock'::__l1::fin$0
`InitializeVolumeInfoTable'::__l1::fin$0
`OpenFileSystemFile'::__l1::fin$0
`RefsAccessCheck'::__l1::fin$1
`RefsAcquireParentForSystemFile'::__l1::fin$1
`RefsBuildNormalizedNameImplementation'::__l1::fin$0
`RefsCacheSharedSecurityForCreate'::__l1::fin$0
`RefsChangeAttributeValue'::__l1::fin$0
`RefsChangeResidentStreamIntegrity'::__l1::fin$0
`RefsChangeStreamSparsenessAndBlob'::__l1::fin$0
`RefsChangeVolumeSize'::__l1::fin$1
`RefsCommonCreate'::__l1::fin$0
`RefsConvertToIntegrity'::__l1::fin$0
`RefsCreateAttribute'::__l1::fin$0
`RefsCreateAttributeWithValueReal'::__l1::fin$0
`RefsCreateFcb'::__l1::fin$0
`RefsCreateFileId2'::__l1::fin$0
`RefsCreateIndex'::__l1::fin$0
`RefsCreateLcb'::__l1::fin$0
`RefsCreateLinkAttribute'::__l1::fin$0
`RefsCreateRootFcb'::__l1::fin$0
`RefsCreateScb'::__l1::fin$0
`RefsCreateStreamSnapshot'::__l1::fin$0
`RefsDefragFileInternal'::__l1::fin$1
`RefsDetermineVirtualDisk'::__l1::fin$2
`RefsDismountVolume'::__l1::fin$0
`RefsGeneratePathNameForEventLog'::__l1::fin$1
`RefsGetSfioReservation'::__l1::fin$0
`RefsGetVolumeInformation'::__l1::fin$0
`RefsLinkFileToSelf'::__l1::fin$0
`RefsMapAttributeValue'::__l1::fin$0
`RefsMountVolume'::__l1::fin$2
`RefsNonCachedIo'::__l1::fin$2
`RefsNonCachedNonAlignedIo'::__l1::fin$1
`RefsNotifyChangeDirectory'::__l1::fin$0
`RefsOpenFcbById'::__l1::fin$1
`RefsOpenUsnJournal'::__l1::fin$0
`RefsPerformDismountOnVcb'::__l1::fin$2
`RefsPerformVerifyOperation'::__l1::fin$0
`RefsPostUsnChangeWithOverrideOption'::__l1::fin$0
`RefsPrepareForCriticalIo'::__l1::fin$0
`RefsQueryDirectory'::__l1::fin$1
`RefsQueryNameInfo'::__l1::fin$0
`RefsQueryRegionInfo'::__l1::fin$0
`RefsQueryRetrievalPointers'::__l1::fin$0
`RefsReadUsnWorker'::__l1::fin$0
`RefsRemoveLink'::__l1::fin$0
`RefsRepairDirectory'::__l1::fin$1
`RefsRepairFile'::__l1::fin$4
`RefsRepairSecurity'::__l1::fin$0
`RefsScrubBootSector'::__l1::fin$0
`RefsScrubVerifyBlock'::__l1::fin$0
`RefsSendFileTypeNotification'::__l1::fin$0
`RefsSetBreakOnCorrupt'::__l1::fin$0
`RefsSetClearVolumeFlag'::__l1::fin$0
`RefsSetLinkInfo'::__l1::fin$0
`RefsSetLinkInfo'::__l1::fin$1
`RefsSetRenameInfo'::__l1::fin$0
`RefsStreamSnapshotManagement'::__l1::fin$0
`RefsTelemetrySetIntegrity'::__l1::fin$0
`RefsTelemetryVolumeInfoWorker'::__l1::fin$0
`RefsUpdateNormalizedName'::__l1::fin$0
`RefsWalkUpTree'::__l1::fin$0
`RefsWatchForRegistryChanges'::__l1::fin$0
`RefsWriteUsnJournalChanges'::__l1::fin$1
`SetAndGetVolumeTimes'::__l1::fin$0
`SetResidentStreamSummary'::__l1::fin$0
`SetVolumeMounted'::__l1::fin$0
operator_delete
|
Expand for full list:
::operator()
AllocateAndComposeTableKeyPath
AllocateAndGetVolumeLabel
CleanupClMulCrcLibrary
CmsAllocationZones::CreateForFormat
CmsAllocationZones::ExtendSingleTier
CmsAllocator::MakeRegion
CmsAllocator::PersistFilteredViewParallel
CmsAllocator::ReleaseFilteredView
CmsAllocator::Shutdown
CmsAllocator::`scalar_deleting_destructor'CmsAvlTableFlex::FreeIndexEntry
CmsAvlTableLite::FreeIndexEntry
CmsBPlusTable::AbortUndoRecords
CmsBPlusTable::AddToIndex
CmsBPlusTable::ChecksumWritePlanLevel
CmsBPlusTable::CommitUndoRecords
CmsBPlusTable::CoordinateTreeUpdateWorkInParallel
CmsBPlusTable::DiscardAllPages
CmsBPlusTable::EnqueueTreeUpdate
CmsBPlusTable::ForEachTablePageInPageTable
CmsBPlusTable::GenerateTriageContext
CmsBPlusTable::PrepareToFreeOrWritePagesWorker
CmsBPlusTable::ReleaseTreeIoBatch
CmsBPlusTable::RunPageCleanupForAllDirtyTrees
CmsBPlusTable::SetObjectRecordPayload
CmsBPlusTable::TriageCorruptChild
CmsBPlusTable::UpdateBoundTrees
CmsBPlusTable::UpdateObjectTableWorkerParentChildTable
CmsBPlusTable::operator_delete
CmsBlockCache::GrowMaxBlockAddresses
CmsBlockCache::Teardown
CmsBlockRefcount::BlockRefTableTelemetry
CmsBlockRefcount::`scalar_deleting_destructor'
CmsCachedRuns::`scalar_deleting_destructor'
CmsCachedRuns::~CmsCachedRuns
CmsChecksum::UninitializeLibrary
CmsCompositeBase::CacheRoot
CmsCompositeBase::TeardownCachedRoot
CmsCompositeBase::`vector_deleting_destructor'
CmsCompression::UninitializeLibrary
CmsContainerCursor::`scalar_deleting_destructor'
CmsContainerCursor::~CmsContainerCursor
CmsContainerRangeMap::`scalar_deleting_destructor'
CmsCountMap::AddEntry
CmsCountMap::DeleteEntry
CmsCountMap::FindMappedValue
CmsCowRootComposite::`scalar_deleting_destructor'
CmsCrc32<&unsigned_long___cdecl_Crc32C_Intrinsic(void_const*___ptr64,unsigned___int64,unsigned_long),PARITY_ENCODER,1>::`scalar_deleting_destructor'
CmsDurableLog::LogReleaseTopologyId
CmsDurableLog::LogWriteBatchCompletion
CmsDurableLog::MergeMemLog
CmsDurableLog::Start
CmsEmbeddedComposite::AbortReparent
CmsEmbeddedComposite::CommitReparent
CmsEmbeddedComposite::PinRootInternal
CmsEmbeddedComposite::Reparent
CmsEmbeddedComposite::TeardownParent
CmsEmbeddedComposite::`vector_deleting_destructor'
CmsFailoverBPlusTable::TriageInsertFromBackup
CmsFailoverBPlusTable::TriageRepairFromBackup
CmsFailoverBPlusTable::`scalar_deleting_destructor'
CmsHashTable::CreateOrExpandOverflowBucket
CmsHashTable::DeleteInternal
CmsHashTable::Optimize
CmsHashTable::Uninitialize
CmsIntegrityState::`scalar_deleting_destructor'
CmsKeyRules::AddKeyRules
CmsKeyRules::UninitializeLibrary
CmsLogRedoQueue::OpenTable
CmsLogRedoQueue::OpenTableFromTablePath
CmsLogRedoQueue::RedoModifyStreamExtent
CmsLogRedoQueue::RedoOneRecord
CmsLogRedoQueue::RedoReparentTable
CmsLogRedoQueue::RedoStreamFastPathRowInsertion
CmsLogRedoQueue::RedoWorkRoutine
CmsLogRedoQueue::SaveCurrentTablePath
CmsLogRedoQueue::Teardown
CmsLookasides::Free
CmsLookasides::UninitializeLibrary
CmsMatchAllCursor::`vector_deleting_destructor'
CmsMatchTablePathCursor::`scalar_deleting_destructor'
CmsObjectTable::AddIdentifierAtLcn
CmsObjectTable::EnumerateQueryChildrenCursor
CmsObjectTable::GetParentIdentifierByChildIdentifier
CmsObjectTable::InitializeTable
CmsObjectTable::UpdateIdentifierLcn
CmsPinCache::~CmsPinCache
CmsPoolComposite::`scalar_deleting_destructor'
CmsPoolComposite::~CmsPoolComposite
CmsRangeAndCountMap::~CmsRangeAndCountMap
CmsRangeMap::DeleteEntry
CmsRangeMap::PinRangeInIndex
CmsReadCache::AddRequestToReadCacheContext
CmsReadCache::GatherCacheContext
CmsReadCache::ProcessReadCacheRepair
CmsReadCache::UpdateCacheFromCacheContext
CmsReferenced::`scalar_deleting_destructor'
CmsReservedPools::~CmsReservedPools
CmsRestarter::FindObjectTableLSN
CmsRestarter::FindOpenTable
CmsRestarter::QueueWait
CmsRestarter::RedoOneRecordBlock
CmsRestarter::RedoTUTables
CmsRestarter::StoreDeletedTable
CmsRestarter::Teardown
CmsRestarter::UpdatePathPrefix
CmsRestarter::~CmsRestarter
CmsRowWithBuffer::GrowBuffer
CmsRowWithBuffer::NewLength
CmsRowWithBuffer::NewLength
CmsRowWithBuffer::Reset
CmsRowWithBuffer::operator=
CmsRowWithBuffer::~CmsRowWithBuffer
CmsRulesMETA::CreateDirectorKey
CmsSchemaTable::GrowCachedSchemasArray
CmsSchemaTable::InitializePhase2
CmsSchemaTable::RegisterSchema
CmsSchemaTable::~CmsSchemaTable
CmsStream::AddAllocation
CmsStream::DuplicateExtents
CmsStream::FastPathRowSlice
CmsStream::GenerateChecksumForRange
CmsStream::GetGhostedExtentMetadata
CmsStream::GetStreamExtentCountWithStartingVcn
CmsStream::GetStreamSummary
CmsStream::GetStreamUserPayload
CmsStream::InvalidateChecksums
CmsStream::LookupSnapshotDelta
CmsStream::MergeTwoRuns
CmsStream::PrecowSharedRanges
CmsStream::SetContainersStationaryVolatile
CmsStream::SplitRun
CmsStream::StripAllChecksums
CmsStream::UpdateStreamSummary
CmsStream::UpdateStreamUserPayload
CmsStream::VerifyOrRepairFromChecksum
CmsStream::`vector_deleting_destructor'
CmsStream::~CmsStream
CmsTable::Enumerate
CmsTable::UpdateCursorFromFoundIndexEntry
CmsTableCursor::RestartCursor
CmsTableCursor::~CmsTableCursor
CmsTableSetBase::AttachNew
CmsTableSetBase::`scalar_deleting_destructor'
CmsTableSetBase::~CmsTableSetBase
CmsThinProvisioning::ProcessAllocatedRanges
CmsTransactionContext::GetScrubBuffer
CmsTransactionContext::ReuseTransaction
CmsTransactionContext::`vector_deleting_destructor'
CmsTrashTable::TeardownEntry
CmsTrashTable::TrashCleanerWorkerFn
CmsTxMemLog::AllocateRedoBlock
CmsTxMemLog::FreeRedoBlock
CmsVolume::ChangeVolumeOptionDynamically
CmsVolume::Checkpoint
CmsVolume::CleanupDirtyTableEntriesAfterTreeUpdateInternal
CmsVolume::Extend
CmsVolume::InitializeRangeSearchStrategies
CmsVolume::InitializeStorageTier
CmsVolume::InitializeStorageTierArray
CmsVolume::InitializeVolumeRedoLog
CmsVolume::MakePageResident
CmsVolume::MoveSuperBlock
CmsVolume::ReadAndRepairSelfChecksumBlock
CmsVolume::ReadLatestCheckpoint
CmsVolume::ReadSuperBlock
CmsVolume::Shutdown
CmsVolume::TeardownPageTableEntry
CmsVolume::`vector_deleting_destructor'
CmsVolume::~CmsVolume
CmsVolumeAnalyzer::AnalyzeAndProcessContainerMoves
CmsVolumeAnalyzer::CleanupRotationBuffers
CmsVolumeAnalyzer::CompactContainers
CmsVolumeAnalyzer::DeleteBitmaps
CmsVolumeAnalyzer::`scalar_deleting_destructor'
CmsVolumeContainer::AddReservedContainer
CmsVolumeContainer::CompactAndCompressContainer
CmsVolumeContainer::CompressContainerBuffer
CmsVolumeContainer::CreateContainerEnumerateCursor
CmsVolumeContainer::FreeCompactAndCompressContainerBuffers
CmsVolumeContainer::Initialize
CmsVolumeContainer::InsertCompressionUnitOffsetsForContainer
CmsVolumeContainer::PersistContainerCache
CmsVolumeContainer::PersistContainerCacheParallel
CmsVolumeContainer::ReadCompressedContainerRangeInternal
CmsVolumeContainer::RealRangeToContainerRange
CmsVolumeContainer::RecompactEmbeddedContainer
CmsVolumeContainer::ReleasePinnedContainersAtEndOfTransaction
CmsVolumeContainer::RestoreCompactionContainerRanges
CmsVolumeContainer::RestoreContainerArray
CmsVolumeContainer::RotateContainers
CmsVolumeContainer::SetContainerRangeValid
CmsVolumeContainer::SetContainerStationaryVolatile
CmsVolumeContainer::Shutdown
CmsVolumeContainer::ValidateContainerRotationBuffer
CmsVolumeContainer::`scalar_deleting_destructor'
CmsVolumeContainer::~CmsVolumeContainer
ConditionallyCreateOrOpenFileSystemFile
CopyKeyHelper
CopyObjectTablePayload
DeleteDirectoryOnDisk
DriverEntry
EndAndCleanupEnumeration
FUN_1c0009928
FUN_1c001c69f
FUN_1c0040e7a
FUN_1c00424c3
FUN_1c00547b0
FUN_1c005d2d8
FUN_1c007f980
FUN_1c008005f
FUN_1c0089354
FUN_1c008e18e
FUN_1c009192e
FUN_1c0092e74
FUN_1c0092e9c
FUN_1c01bff67
FUN_1c01c1799
FUN_1c01c5dce
FUN_1c01c7633
FsLibInitializeIoPerf
FsLibIoFailureCleanupSummary
FsLibIoPerfCleanupPeriodicData
FsLibIoPerfCleanupSummaryData
FsLibIoPerfFreeCountersData
FsLibIoPerfFreeVolumeData
FsLibIoPerfInitializeVolumeData
GetDiskProperties
GetSharedSecurityFromDescriptorUnsafe
InitializeDefaultClientRootSecurityDescriptor
InitializeDefaultSecurityDescriptor
InitializeDefaultServerRootSecurityDescriptor
InitializeVcbDeviceName
InitializeVerifyBlock
InitializeVolumeInfoTable
IssueSynchronousDeviceIoControl
LogCoreScanDataRecord
LogCoreWriteDataRecord
LogReadControlRecord
LogRepairEntryHeader
LogWriteEntryCompletion
MlLogCloseLog
MlLogOpenLog
MlLogScanLog
MsAllocator::RangeArrayStrategy::State::PostExtend
MsAllocator::RangeArrayStrategy::State::`scalar_deleting_destructor'
MsAllocator::RangeArrayStrategy::State::~State
MsAllocator::SmrStrategy::State::`scalar_deleting_destructor'
MsCreateDurableFailoverTableObject
MsCreateDurableTableObject
MsFreeChecksumContext
MsKmeAllocateIoRequest
MsKmeClearSmrBandInfoCache
MsKmeDeleteReservedIoRuns
MsKmeGetSMRBandSize
MsKmeGetSMRBandWriteHead
MsKmePrefetchPages
MsKmeQueryAndCacheSmrBandInfoForRange
MsKmeQueryCpuInformation
MsKmeQueryMapAllocations
MsKmeReleaseIoRequest
MsKmeResetIoRequest
MsKmeResetSMRSimBand
MsKmeUpdateBootSector
MsKmeZeroSMRRegion
MsPersistReserveAllocationAndGenerateChecksum
MsTriageDeleteContext
MsUninitializeLibrary
MspCleanupDirtyTableListWorkerFn
MspCleanupTopologyIds
MspGrowTopologyIds
OpenFileSystemFile
ReallocateAndCopyIndexEntryIntoBuffer
RefsAbortPendingUsnReasons
RefsAccessCheck
RefsAcquireParentForSystemFile
RefsAppendNameToParent
RefsBuildFileName
RefsBuildRelativeName
RefsCacheSharedSecurityForCreate
RefsCancelReadUsnJournal
RefsChangeAttributeValue
RefsChangeResidentStreamIntegrity
RefsChangeStreamSparsenessAndBlob
RefsChangeVolumeSize
RefsCheckToAllowForReadCache
RefsCleanupAttributeContext
RefsCleanupAttributeExpression
RefsCleanupFailedTransaction
RefsCommitCurrentTransaction
RefsCommonClose
RefsCommonCreate
RefsCommonVolumeOpen
RefsCompleteThroughDebugInfoIrpImplementation
RefsConvertToIntegrity
RefsCreateAttribute
RefsCreateAttributeWithValueReal
RefsCreateFileId2
RefsCreateIndex
RefsCreateLinkAttribute
RefsCreateStreamSnapshot
RefsDeactivateUsnJournal
RefsDecompressWorker
RefsDecrementFcbUsnRecordReferenceCountAndFreeIt
RefsDefragFileInternal
RefsDeleteCcb
RefsDeleteFcb
RefsDeleteMdlAndBuffer
RefsDeleteNormalizedName
RefsDeleteReservedBitmap
RefsDeleteReservedBuffer
RefsDeleteScb
RefsDeleteVcb
RefsDetermineVirtualDisk
RefsEtwPostWriteEventWorker
RefsEtwWriteVolumeFailureEvent
RefsFreeEresource
RefsFreeFcbTableEntry
RefsFreeFcbUsnRecord
RefsFreeFileKey
RefsFreeNonpagedDataFcb
RefsFreeNonpagedIndexFcb
RefsFreeScbAttributeName
RefsFullDeleteLcb
RefsGeneratePathNameForEventLog
RefsGetSfioReservation
RefsGetVolumeInformation
RefsHoldIrpForNewUsn
RefsInitializeObjLinkRow
RefsInitializeReservedBuffer
RefsIoPerfLogFileObjectInfo
RefsIoPerfPostFileObjectInfo
RefsIsVolumeUpgradeDisabled
RefsKsrRestoreContext
RefsKsrSaveContext
RefsLinkFileToSelf
RefsLookupAttributeForScb
RefsMapAttributeValue
RefsMigrateLcb
RefsMountVolume
RefsNonCachedNonAlignedIo
RefsNotifyChangeDirectory
RefsNotifyNewUsn
RefsOpenFcbById
RefsOpenUsnJournal
RefsOplockPrePostIrp
RefsPerformDismountOnVcb
RefsPerformVerifyOperation
RefsPostUsnChangeWithOverrideOption
RefsPrepareForCriticalIo
RefsQueryDirectory
RefsQueryNameInfo
RefsQueryRegionInfo
RefsQueryRetrievalPointers
RefsQueueTriageForDeadLink
RefsReadBootSectorLocation
RefsReadUsnWorker
RefsReleaseAllFiles
RefsReleaseSharedResources
RefsRemoveDebugInfoIrpImplementation
RefsRemoveLink
RefsRemovePrefixHashEntry
RefsRepairDirectory
RefsRepairFile
RefsRepairSecurity
RefsReseekAttribute
RefsReserveCcbNamesInLcb
RefsReserveClusters
RefsSalvageChild
RefsSalvageIndexTable
RefsScrubBootSector
RefsScrubVerifyBlock
RefsSeAccessCheck
RefsSecurityReleaseRow
RefsSendDismountFailedEvent
RefsSendEventLogHourlyReport
RefsSendFileTypeNotification
RefsSetBreakOnCorrupt
RefsSetClearVolumeFlag
RefsSetLinkInfo
RefsSetRenameInfo
RefsSqmAddToStreamEx
RefsStreamSnapshotManagement
RefsTelemetrySetIntegrity
RefsTelemetryVolumeInfoWorker
RefsTelemetryWorker
RefsUnmapAttribute
RefsUpdateDynamicRegistrySettings
RefsUpdateNormalizedName
RefsWaitForNewUsn
RefsWalkUpTree
RefsWatchForRegistryChanges
RefsWriteUsnJournalChanges
RemoveReferenceSharedSecurityUnsafe
SetAndGetVolumeTimes
SetResidentStreamSummary
SetVolumeMounted
SmsAllocationRegionEx::FreeRegionBitmap
SmsAllocationRegionEx::`scalar_deleting_destructor'
SmsCompactionUndoChain::~SmsCompactionUndoChain
SmsContainer::`scalar_deleting_destructor'
SmsContainer::~SmsContainer
SmsTableSetEntry::`scalar_deleting_destructor'
SmsTableSetLookupStack::~SmsTableSetLookupStack
SortWritePlanWorker
TmsTableSet::DeleteRow
TmsTableSet::EnumerateAll
TmsTableSet::FindRow
TmsTableSet::InsertRow
TmsTableSet::PinNextRow
TmsTableSet::PinRowInternalSharedDownMerge
TmsTableSet::PreMergeDownForPinRow
TmsTableSet::`vector_deleting_destructor'
UnlockMainFcbPagingAsyncTableSetCb
UnpinPinnedRowInContext
ValidateOTEntryBoundaries
_SmsBindable::::~
_SmsBindable::`scalar_deleting_destructor'
_SmsBindable::~_SmsBindable
_SmsCacheInfo::`scalar_deleting_destructor'
_SmsLazyWriterNotification::`scalar_deleting_destructor'
_SmsRotationEntry::`scalar_deleting_destructor'
`ConditionallyCreateOrOpenFileSystemFile'::__l1::fin$0
`DeleteDirectoryOnDisk'::__l1::fin$0
`GetDiskProperties'::__l1::fin$0
`InitializeDefaultClientRootSecurityDescriptor'::__l1::fin$0
`InitializeDefaultSecurityDescriptor'::__l1::fin$0
`InitializeDefaultServerRootSecurityDescriptor'::__l1::fin$0
`InitializeVcbDeviceName'::__l1::fin$0
`InitializeVerifyBlock'::__l1::fin$0
`InitializeVolumeInfoTable'::__l1::fin$0
`OpenFileSystemFile'::__l1::fin$0
`RefsAccessCheck'::__l1::fin$1
`RefsAcquireParentForSystemFile'::__l1::fin$1
`RefsBuildNormalizedNameImplementation'::__l1::fin$0
`RefsCacheSharedSecurityForCreate'::__l1::fin$0
`RefsChangeAttributeValue'::__l1::fin$0
`RefsChangeResidentStreamIntegrity'::__l1::fin$0
`RefsChangeStreamSparsenessAndBlob'::__l1::fin$0
`RefsChangeVolumeSize'::__l1::fin$1
`RefsCommonCreate'::__l1::fin$0
`RefsConvertToIntegrity'::__l1::fin$0
`RefsCreateAttribute'::__l1::fin$0
`RefsCreateAttributeWithValueReal'::__l1::fin$0
`RefsCreateFcb'::__l1::fin$0
`RefsCreateFileId2'::__l1::fin$0
`RefsCreateIndex'::__l1::fin$0
`RefsCreateLcb'::__l1::fin$0
`RefsCreateLinkAttribute'::__l1::fin$0
`RefsCreateRootFcb'::__l1::fin$0
`RefsCreateScb'::__l1::fin$0
`RefsCreateStreamSnapshot'::__l1::fin$0
`RefsDefragFileInternal'::__l1::fin$1
`RefsDetermineVirtualDisk'::__l1::fin$2
`RefsDismountVolume'::__l1::fin$0
`RefsGeneratePathNameForEventLog'::__l1::fin$1
`RefsGetSfioReservation'::__l1::fin$0
`RefsGetVolumeInformation'::__l1::fin$0
`RefsLinkFileToSelf'::__l1::fin$0
`RefsMapAttributeValue'::__l1::fin$0
`RefsMountVolume'::__l1::fin$2
`RefsNonCachedIo'::__l1::fin$2
`RefsNonCachedNonAlignedIo'::__l1::fin$1
`RefsNotifyChangeDirectory'::__l1::fin$0
`RefsOpenFcbById'::__l1::fin$1
`RefsOpenUsnJournal'::__l1::fin$0
`RefsPerformDismountOnVcb'::__l1::fin$2
`RefsPerformVerifyOperation'::__l1::fin$0
`RefsPostUsnChangeWithOverrideOption'::__l1::fin$0
`RefsPrepareForCriticalIo'::__l1::fin$0
`RefsQueryDirectory'::__l1::fin$1
`RefsQueryNameInfo'::__l1::fin$0
`RefsQueryRegionInfo'::__l1::fin$0
`RefsQueryRetrievalPointers'::__l1::fin$0
`RefsReadUsnWorker'::__l1::fin$0
`RefsRemoveLink'::__l1::fin$0
`RefsRepairDirectory'::__l1::fin$1
`RefsRepairFile'::__l1::fin$4
`RefsRepairSecurity'::__l1::fin$0
`RefsScrubBootSector'::__l1::fin$0
`RefsScrubVerifyBlock'::__l1::fin$0
`RefsSendFileTypeNotification'::__l1::fin$0
`RefsSetBreakOnCorrupt'::__l1::fin$0
`RefsSetClearVolumeFlag'::__l1::fin$0
`RefsSetLinkInfo'::__l1::fin$0
`RefsSetLinkInfo'::__l1::fin$1
`RefsSetRenameInfo'::__l1::fin$0
`RefsStreamSnapshotManagement'::__l1::fin$0
`RefsTelemetrySetIntegrity'::__l1::fin$0
`RefsTelemetryVolumeInfoWorker'::__l1::fin$0
`RefsUpdateNormalizedName'::__l1::fin$0
`RefsWalkUpTree'::__l1::fin$0
`RefsWatchForRegistryChanges'::__l1::fin$0
`RefsWriteUsnJournalChanges'::__l1::fin$1
`SetAndGetVolumeTimes'::__l1::fin$0
`SetResidentStreamSummary'::__l1::fin$0
`SetVolumeMounted'::__l1::fin$0
operator_delete
| |paramcount|0|0| |address|EXTERNAL:00000001|EXTERNAL:00000001| |sig|undefined ExFreePoolWithTag(void)|undefined ExFreePoolWithTag(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::ExFreePoolWithTag Calling Diff ```diff --- NTOSKRNL.EXE::ExFreePoolWithTag calling +++ NTOSKRNL.EXE::ExFreePoolWithTag calling @@ -209,13 +209,13 @@ -FUN_1c004bb50 -FUN_1c0051ed4 -FUN_1c007e8f6 -FUN_1c007efd5 -FUN_1c00882ca -FUN_1c008d102 -FUN_1c0091b86 -FUN_1c0091bae -FUN_1c0095c36 -FUN_1c01befb7 -FUN_1c01c083f -FUN_1c01c4f30 -FUN_1c01c61a5 +FUN_1c00547b0 +FUN_1c005d2d8 +FUN_1c007f980 +FUN_1c008005f +FUN_1c0089354 +FUN_1c008e18e +FUN_1c009192e +FUN_1c0092e74 +FUN_1c0092e9c +FUN_1c01bff67 +FUN_1c01c1799 +FUN_1c01c5dce +FUN_1c01c7633 @@ -416,0 +417 @@ +ValidateOTEntryBoundaries ``` ## GetLengthPhys ### Match Info |Key|refs-2026-06.sys - refs-2026-07.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|refs-2026-06.sys|refs-2026-07.sys| | :---: | :---: | :---: | |name|GetLengthPhys|GetLengthPhys| |fullname|_SmsIndexEntry::GetLengthPhys|_SmsIndexEntry::GetLengthPhys| |`refcount`|48|49| |length|20|20| |called||| |`calling`|
Expand for full list:
CmsAvlTableFlex::InitializeIndexEntry
CmsBPlusTable::AbortUndoRecords
CmsBPlusTable::AddToIndex
CmsBPlusTable::CompressIndexBucket
CmsBPlusTable::CreateIndex
CmsBPlusTable::DeleteIndexEntry
CmsBPlusTable::MergeRowsInBucketNoAbort
CmsBPlusTable::MmsCheckIndexEntry
CmsBPlusTable::MmsCheckIndexEntryWithinBounds
CmsBPlusTable::MmsMarkIndexEntryDeleted
CmsBPlusTable::MmsMoveIndexEntriesCollateHighCmsBPlusTable::PrepareUndoForUpdatePinnedRow
CmsBPlusTable::TryToCollapseFromPage
CmsStream::MergeTwoRuns
CmsTable::Enumerate
CmsTable::UpdateCursorFromFoundIndexEntry
FUN_1c008ab06
|
Expand for full list:
CmsAvlTableFlex::InitializeIndexEntry
CmsBPlusTable::AbortUndoRecords
CmsBPlusTable::AddToIndex
CmsBPlusTable::CompressIndexBucket
CmsBPlusTable::CreateIndex
CmsBPlusTable::DeleteIndexEntry
CmsBPlusTable::MergeRowsInBucketNoAbort
CmsBPlusTable::MmsCheckIndexEntry
CmsBPlusTable::MmsCheckIndexEntryWithinBounds
CmsBPlusTable::MmsMarkIndexEntryDeleted
CmsBPlusTable::MmsMoveIndexEntriesCollateHighCmsBPlusTable::PrepareUndoForUpdatePinnedRow
CmsBPlusTable::TryToCollapseFromPage
CmsStream::MergeTwoRuns
CmsTable::Enumerate
CmsTable::UpdateCursorFromFoundIndexEntry
FUN_1c008bb90
ValidateOTEntryBoundaries
| |paramcount|1|1| |address|1c0035434|1c0035434| |sig|ulong __thiscall GetLengthPhys(_SmsIndexEntry * this)|ulong __thiscall GetLengthPhys(_SmsIndexEntry * this)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### GetLengthPhys Calling Diff ```diff --- _SmsIndexEntry::GetLengthPhys calling +++ _SmsIndexEntry::GetLengthPhys calling @@ -17 +17,2 @@ -FUN_1c008ab06 +FUN_1c008bb90 +ValidateOTEntryBoundaries ``` ## memset ### Match Info |Key|refs-2026-06.sys - refs-2026-07.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.85| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|refs-2026-06.sys|refs-2026-07.sys| | :---: | :---: | :---: | |name|memset|memset| |fullname|memset|memset| |`refcount`|575|576| |length|236|236| |called||| |`calling`|
Expand for full list:
AllocateAndComposeTableKeyPath
AllocateAndGetVolumeLabel
ClMulCrcBase::Compute
ClMulCrcBase::Compute
CmsAllocationZones::CreateForFormat
CmsAllocationZones::CreateForFormatSmallVolume
CmsAllocationZones::ExtendSingleTier
CmsAllocationZones::LoadFromMaaSummary
CmsAllocationZones::PersistToMaaSummary
CmsAllocationZones::UpgradeFromPreRS3
CmsAllocator::AllocateLcnsCmsAllocator::CommitAllocatorSummary
CmsAllocator::InitializeResources
CmsAllocator::LoadAllocatorSummary
CmsAllocator::MakeRegion
CmsAllocator::PersistRegion
CmsBPlusTable::AddToIndex
CmsBPlusTable::AddUndoForSliceFastPath
CmsBPlusTable::AllocateUndo
CmsBPlusTable::AttemptSiblingMerge
CmsBPlusTable::CreateIndex
CmsBPlusTable::DeleteFromIndexInternal
CmsBPlusTable::DoesTableHavePendingRedo
CmsBPlusTable::EnqueueTreeUpdate
CmsBPlusTable::FindFirstIndexEntry
CmsBPlusTable::FindInIndex
CmsBPlusTable::FindLastInIndex
CmsBPlusTable::FindNextIndexEntry
CmsBPlusTable::FormatUndoRecord
CmsBPlusTable::GenerateTriageContext
CmsBPlusTable::InitializeTreeIoBatch
CmsBPlusTable::OptimizeTablePages
CmsBPlusTable::PrepareBoundSetUpdate
CmsBPlusTable::ResetAcquiredResourceOwner
CmsBPlusTable::SliceRangeRow
CmsBPlusTable::SwapDirectorData
CmsBPlusTable::TriageCorruptChild
CmsBPlusTable::TryEnqueueWriteFailuresForRetry
CmsBPlusTable::TryToCollapseFromPage
CmsBPlusTable::UpdateBoundTrees
CmsBPlusTable::UpdateDataWithRoot
CmsBPlusTable::UpdateEmbeddedTableSchema
CmsBPlusTable::UpdateInIndex
CmsBPlusTable::UpdateParentDirectorRow
CmsBlockCache::GrowMaxBlockAddresses
CmsBlockRefcount::BlockRefTableTelemetry
CmsBlockRefcount::PersistCacheEntry
CmsBlockRefcount::PopulateCacheEntry
CmsCachedPin::InitializeLibrary
CmsCompositeBase::CacheRoot
CmsCompositeKey::AddKey
CmsCompositeKey::ExpandInPlaceKeys
CmsCountMap::InitializeLibrary
CmsCowRootComposite::CmsCowRootComposite
CmsDurableLog::WaitForVirtualToRecordReferenceMigration
CmsEmbeddedComposite::CreateNewParent
CmsEmbeddedComposite::FindIndexHeaderInPage
CmsFailoverBPlusTable::AddToIndex
CmsFailoverBPlusTable::DeleteFromIndex
CmsFailoverBPlusTable::Enumerate
CmsFailoverBPlusTable::FindInIndex
CmsFailoverBPlusTable::FindLastInIndex
CmsFailoverBPlusTable::PinDataWithRoot
CmsFailoverBPlusTable::PinInIndex
CmsFailoverBPlusTable::PinNextInIndex
CmsFailoverBPlusTable::ScrubTable
CmsFailoverBPlusTable::TriageInsertFromBackup
CmsFailoverBPlusTable::TriageReviveFromBackup
CmsFailoverBPlusTable::UpdateDataWithRoot
CmsFailoverBPlusTable::UpdateInIndex
CmsFailoverBPlusTable::UpdateInIndexTuActiveGen
CmsFailoverBPlusTable::UpdateInIndexTuActiveGenAction
CmsHashTable::AttemptResize
CmsHashTable::CreateOrExpandOverflowBucket
CmsHashTable::Initialize
CmsHashTableLite::Initialize
CmsIntegrityState::Initialize
CmsLogRedoQueue::RedoReparentTable
CmsLookasides::InitializeLibrary
CmsObjectTable::GetLastFlushedLsnOfIdentifier
CmsObjectTable::GetObjectRecordOfIdentifier
CmsObjectTable::GetObjectRecordPayload
CmsObjectTable::InitializeTable
CmsObjectTable::PreCowParentChildLink
CmsPinCache::AddToPinCache
CmsPinCache::TransferOneCachedPin
CmsPoolComposite::CmsPoolComposite
CmsPoolComposite::Initialize
CmsRangeMap::InitializeLibrary
CmsReadCache::AddRequestToReadCacheContext
CmsReadCache::GatherCacheContext
CmsReadCache::ProcessReadCacheRepair
CmsRefcountCacheEntry::AllocateArray
CmsRefcountCacheEntry::Set
CmsRefcountCacheEntry::Set
CmsReservedPools::InitializePool
CmsRestarter::CmsRestarter
CmsRestarter::InitializeLibrary
CmsRestarter::RedoPass
CmsRestarter::Restart
CmsRestarter::StoreDeletedTable
CmsRestarter::UpdatePathPrefix
CmsRotatingSkipList<_RANGE,SmsAllocationRegionEx,OrderByStartOfRange,RegionLockPolicies>::Node::Node
CmsSchemaTable::GrowCachedSchemasArray
CmsSchemaTable::RegisterSchema
CmsStream::LogRedoForFastPathInsertion
CmsTable::InsertMetaRow
CmsTable::OutputRow
CmsTableCursor::CmsTableCursor
CmsTableSetBase::CommitMerge
CmsThinProvisioning::WorkItemState::WorkItemState
CmsTransactionContext::InitializeTransactionMemoryBuffer
CmsTrashTable::PostTrashCleaner
CmsTxMemLog::AddRedoRecord
CmsTxMemLog::AllocateRedoBlock
CmsVolume::AggregatedPerfCounterTelemetry
CmsVolume::ChangeVolumeOptionDynamically
CmsVolume::Checkpoint
CmsVolume::CmsVolume
CmsVolume::CmsVolume
CmsVolume::CommitTopLevelAction
CmsVolume::CommitTx
CmsVolume::ComputeOrVerifySelfChecksumBlock
CmsVolume::Extend
CmsVolume::FormatPageHeader
CmsVolume::InitializeAllocationSearchStrategies
CmsVolume::InitializeRangeSearchStrategies
CmsVolume::InitializeStorageTier
CmsVolume::InitializeStorageTierArray
CmsVolume::InitializeVolumeAllocator
CmsVolume::MakePageResident
CmsVolume::MoveSuperBlock
CmsVolume::Pin
CmsVolume::PrePopulateSystemAllocator
CmsVolume::ReadPageWorker
CmsVolume::ReadSuperBlock
CmsVolume::Start
CmsVolume::StartPagingContext
CmsVolume::operator_new
CmsVolumeAnalyzer::CmsVolumeAnalyzer
CmsVolumeAnalyzer::CompactContainers
CmsVolumeAnalyzer::Initialize
CmsVolumeAnalyzer::InitializeAndQueueRotationWorkItems
CmsVolumeContainer::AddReservedContainer
CmsVolumeContainer::CacheContainerInitialAllocationBitmap
CmsVolumeContainer::CmsVolumeContainer
CmsVolumeContainer::CompactAndCompressContainer
CmsVolumeContainer::CompressContainerBuffer
CmsVolumeContainer::CopyInitialAllocationBitmap
CmsVolumeContainer::Initialize
CmsVolumeContainer::InsertCompressionUnitOffsetsForContainer
CmsVolumeContainer::PersistContainerCacheParallel
CmsVolumeContainer::PersistContainerCacheWorker
CmsVolumeContainer::ReadCompressedContainerRange
CmsVolumeContainer::ReadCompressedContainerRangeInternal
CmsVolumeContainer::RealRangeToContainerRange
CmsVolumeContainer::RecompactEmbeddedContainer
CmsVolumeContainer::RestoreCompactionContainerRanges
CmsVolumeContainer::ValidateContainerRotationBuffer
CreateAndInitializeIndexContext
DeleteDirectoryOnDisk
DeleteFileOnDisk
DriverEntry
FUN_1c000e320
FUN_1c001083b
FUN_1c002adb9
FUN_1c005e485
FUN_1c00852fc
FUN_1c0086e64
FUN_1c01befb7
FsLibInitializeIoPerf
FsLibIoFailureResetTable
FsLibIoPerfSnapshotVolumeCounters
FsRtlTagFileForStorageNotification
GetResidentStreamSummary
InitializeReparseIndexTable
InitializeVerifyBlock
LZX_DecodeNewGroup
LogCoreReadControlArea
LogCoreWriteDataRecord
LogInitializeFlushWindows
LogReadControlRecord
LogWriteControlRecord
McGenControlCallbackV2
MlLogAdvanceLogStart
MlLogOpenLog
MlLogScanLog
MsAllocator::RangeArrayStrategy::State::PopulateEntries
MsCreateDurableFailoverTableObject
MsCreateDurableTableObject
MsKmeAllocateIoRequest
MsKmeAllocateIoRun
MsKmeChecksumEventNotification
MsKmeCreateBaseAddressFromTuple
MsKmeCreateCacheContext
MsKmeDecrementCloseCount
MsKmeGenericSpacesRequest
MsKmeGetRowSizeAndOffset
MsKmeGetSMRBandSize
MsKmeGetSMRBandWriteHead
MsKmeInitializeReservedIoRequests
MsKmeInitializeReservedIoRuns
MsKmeLogEventNotification
MsKmeMetadataEventNotification
MsKmeQueryAndCacheSmrBandInfoForRange
MsKmeQueryMapAllocations
MsKmeQueryStorageClasses
MsKmeQueryStorageSeekPenalty
MsKmeQueryStorageTier
MsKmeQueryStreamsParameters
MsKmeQueryTopologyId
MsKmeReleaseCacheContext
MsKmeResetSMRSimBand
MsKmeSynchronousRepairFromCopy
MsKmeSynchronousScrubPickingWinners
MsKmeTreeCycleDetectedNotification
MsKmeUntrim
MsKmeUpdateBootSector
MsKmeZeroSMRRegion
MsPinDataWithRoot
MsUninitializeLibrary
MspAddVolumeToQueuedCheckpointList
MspCheckpointVolume
MspInitializeSchemas
MspRemoveVolumeFromQueuedCheckpointList
OpenFileSystemFile
ParityEncode
ParityEncode
ParityEncode
ParityEncode
ReadRepTree
ReallocateAndCopyIndexEntryIntoBuffer
RefsAccessCheck
RefsAcquireAllFiles
RefsAcquireParentForSystemFile
RefsAddExtentToTrimRequest
RefsAddFileNameIndexEntry
RefsAddNameToParent
RefsAddPreallocatedStructToRollbackList
RefsAllocAndFormatResidentAttribute
RefsAllocateNonpagedFcb
RefsAsyncCachedReadRequest
RefsBackpointerValueFromFileName
RefsChangeAttributeValue
RefsChangeResidentStreamIntegrity
RefsChangeStreamSparsenessAndBlob
RefsCheckUsnTimeOut
RefsCleanCheckpoint
RefsCommonCleanup
RefsConvertToIntegrity
RefsCopyReadA
RefsCopyWriteInternal
RefsCreateAttribute
RefsCreateAttributeWithValueEx
RefsCreateFcb
RefsCreateFile
RefsCreateFileId2
RefsCreateIndex
RefsCreateLcb
RefsCreateNewFile
RefsCreatePrerestartScb
RefsCreateRootFcb
RefsCreateScb
RefsCreateStreamSnapshot
RefsDeleteObjectLinkByRow
RefsDeleteReparsePoint
RefsDerefExportedSecurityDescriptor
RefsDetermineVirtualDisk
RefsEtwPostSalvageEvent
RefsFastIoCheckIfPossible
RefsFastLock
RefsFastQueryBasicInfo
RefsFastQueryNetworkOpenInfo
RefsFastQueryStdInfo
RefsFastUnlockAll
RefsFastUnlockAllByKey
RefsFastUnlockSingle
RefsFileLevelTrim
RefsFillIrpBuffer
RefsFillMdl
RefsFindCaseInsensitiveIndexEntryByRow
RefsFindFileId
RefsFindIndexEntryByRow
RefsFsdCleanup
RefsFsdCreate
RefsFsdDispatch
RefsFsdDispatchWait
RefsFsdRead
RefsFsdShutdown
RefsFsdWrite
RefsFspDispatch
RefsGetFirstReparseInfo
RefsGetNextReparseInfo
RefsGetReparsePoint
RefsGetReparsePointValue
RefsGetStandardInfo
RefsGetVolumeData
RefsGetVolumeInfo
RefsHoldIrpForNewUsn
RefsInitHashSegment
RefsInitialize
RefsInitializeAttributeContext
RefsInitializeFcbAndStdInfo
RefsInitializeIndexContext
RefsInitializeIoContext
RefsInitializeIrpContext
RefsInitializeObjLinkRow
RefsInitializeQueryDirectory
RefsInitializeSqm
RefsInitializeVcb
RefsIoPerfPostFileObjectInfo
RefsIsSparseStreamRemaining
RefsKsrRestoreContext
RefsKsrSaveContext
RefsLinkFileToSelf
RefsListStreamSnapshots
RefsMdlReadA
RefsNameIsStillPresent
RefsNetworkOpenCreate
RefsNonCachedIo
RefsNonCachedNonAlignedIo
RefsNotifyAccessCheck
RefsOpenAttributeInExistingFile
RefsOpenFcbById
RefsOpenNewAttr
RefsOverwriteAttr
RefsPagingFileIoWithNoAllocation
RefsParseNameForCreate
RefsPerformDismountOnVcbNonpaged
RefsPeriodicTimerCallback
RefsPostUsnChangeWithOverrideOption
RefsQueryDeltasStreamSnapshot
RefsQueryDirectory
RefsQueryLinksFullIdInfo
RefsQueryLinksInfo
RefsQueryRegionInfo
RefsQueryStreamsInfo
RefsQueryVolumeCounters
RefsQueryVolumeSmrInfo
RefsReadBootSectorLocation
RefsReadSingle
RefsReadUsnWorker
RefsReconcileFileIds
RefsReleaseSharedResources
RefsRemoveDataAttributes
RefsRemoveLink
RefsRemoveReparsePoint
RefsRenameAttributePriv
RefsRepairFile
RefsReplaceAttribute
RefsReserveClusters
RefsResidentWrite
RefsSalvageChild
RefsSalvageIndexTable
RefsSalvageLinkLcb
RefsScrubHandleInternal
RefsScrubVerifyBlock
RefsSeAccessCheck
RefsSecurityFindMatchingDescriptor
RefsSendBeginDismountEvent
RefsSetAllocationInfo
RefsSetReparsePointInternal
RefsSetupUsnJournal
RefsSqmAddToStream
RefsSqmAddToStreamEx
RefsStreamRename
RefsTelemetryContainerRotation
RefsTelemetryPerfCounters
RefsTelemetryPeriodicVolume
RefsTelemetryReadCache
RefsTelemetryStreamSnapshotOperations
RefsTelemetryUpdatePerfCounters
RefsTelemetryVolumeInfo
RefsUpdateDuplicateInfo
RefsUpdateDynamicRegistrySettings
RefsUpdateFcbInfoFromDisk
RefsUpdateIndexScbFromAttribute
RefsUpdateLink
RefsUpdateNormalizedName
RefsUpdateScbFromAttribute
RefsUpdateStandardInformation
RefsUsnAppendData
RefsWalkUpTree
RefsWasTxfTransactionActive
RefsWriteBytes
RefsWriteFcbUsnRecordToJournal
RefsZeroEndOfClusterStraddlingEof
RefsZeroRangeInStream
RegisterSchemaTableSchema
SetResidentStreamSummary
SmsContainer::SmsContainer
TmsTableSet::SliceRangeRow
ValidateGlobalTableRootBlock
WppTraceCallback
WriteRepTree
_SmsIndexEntry::MmsInitializeIndexEntry
create_slot_lookup_table
do_block_output
init_compression_memory
make_table
make_table_8bit
output_block
redo_first_block
return_difference
update_tree_estimates
|
Expand for full list:
AllocateAndComposeTableKeyPath
AllocateAndGetVolumeLabel
ClMulCrcBase::Compute
ClMulCrcBase::Compute
CmsAllocationZones::CreateForFormat
CmsAllocationZones::CreateForFormatSmallVolume
CmsAllocationZones::ExtendSingleTier
CmsAllocationZones::LoadFromMaaSummary
CmsAllocationZones::PersistToMaaSummary
CmsAllocationZones::UpgradeFromPreRS3
CmsAllocator::AllocateLcnsCmsAllocator::CommitAllocatorSummary
CmsAllocator::InitializeResources
CmsAllocator::LoadAllocatorSummary
CmsAllocator::MakeRegion
CmsAllocator::PersistRegion
CmsBPlusTable::AddToIndex
CmsBPlusTable::AddUndoForSliceFastPath
CmsBPlusTable::AllocateUndo
CmsBPlusTable::AttemptSiblingMerge
CmsBPlusTable::CreateIndex
CmsBPlusTable::DeleteFromIndexInternal
CmsBPlusTable::DoesTableHavePendingRedo
CmsBPlusTable::EnqueueTreeUpdate
CmsBPlusTable::FindFirstIndexEntry
CmsBPlusTable::FindInIndex
CmsBPlusTable::FindLastInIndex
CmsBPlusTable::FindNextIndexEntry
CmsBPlusTable::FormatUndoRecord
CmsBPlusTable::GenerateTriageContext
CmsBPlusTable::InitializeTreeIoBatch
CmsBPlusTable::OptimizeTablePages
CmsBPlusTable::PrepareBoundSetUpdate
CmsBPlusTable::ResetAcquiredResourceOwner
CmsBPlusTable::SliceRangeRow
CmsBPlusTable::SwapDirectorData
CmsBPlusTable::TriageCorruptChild
CmsBPlusTable::TryEnqueueWriteFailuresForRetry
CmsBPlusTable::TryToCollapseFromPage
CmsBPlusTable::UpdateBoundTrees
CmsBPlusTable::UpdateDataWithRoot
CmsBPlusTable::UpdateEmbeddedTableSchema
CmsBPlusTable::UpdateInIndex
CmsBPlusTable::UpdateParentDirectorRow
CmsBlockCache::GrowMaxBlockAddresses
CmsBlockRefcount::BlockRefTableTelemetry
CmsBlockRefcount::PersistCacheEntry
CmsBlockRefcount::PopulateCacheEntry
CmsCachedPin::InitializeLibrary
CmsCompositeBase::CacheRoot
CmsCompositeKey::AddKey
CmsCompositeKey::ExpandInPlaceKeys
CmsCountMap::InitializeLibrary
CmsCowRootComposite::CmsCowRootComposite
CmsDurableLog::WaitForVirtualToRecordReferenceMigration
CmsEmbeddedComposite::CreateNewParent
CmsEmbeddedComposite::FindIndexHeaderInPage
CmsFailoverBPlusTable::AddToIndex
CmsFailoverBPlusTable::DeleteFromIndex
CmsFailoverBPlusTable::Enumerate
CmsFailoverBPlusTable::FindInIndex
CmsFailoverBPlusTable::FindLastInIndex
CmsFailoverBPlusTable::PinDataWithRoot
CmsFailoverBPlusTable::PinInIndex
CmsFailoverBPlusTable::PinNextInIndex
CmsFailoverBPlusTable::ScrubTable
CmsFailoverBPlusTable::TriageInsertFromBackup
CmsFailoverBPlusTable::TriageReviveFromBackup
CmsFailoverBPlusTable::UpdateDataWithRoot
CmsFailoverBPlusTable::UpdateInIndex
CmsFailoverBPlusTable::UpdateInIndexTuActiveGen
CmsFailoverBPlusTable::UpdateInIndexTuActiveGenAction
CmsHashTable::AttemptResize
CmsHashTable::CreateOrExpandOverflowBucket
CmsHashTable::Initialize
CmsHashTableLite::Initialize
CmsIntegrityState::Initialize
CmsLogRedoQueue::RedoReparentTable
CmsLookasides::InitializeLibrary
CmsObjectTable::GetLastFlushedLsnOfIdentifier
CmsObjectTable::GetObjectRecordOfIdentifier
CmsObjectTable::GetObjectRecordPayload
CmsObjectTable::InitializeTable
CmsObjectTable::PreCowParentChildLink
CmsPinCache::AddToPinCache
CmsPinCache::TransferOneCachedPin
CmsPoolComposite::CmsPoolComposite
CmsPoolComposite::Initialize
CmsRangeMap::InitializeLibrary
CmsReadCache::AddRequestToReadCacheContext
CmsReadCache::GatherCacheContext
CmsReadCache::ProcessReadCacheRepair
CmsRefcountCacheEntry::AllocateArray
CmsRefcountCacheEntry::Set
CmsRefcountCacheEntry::Set
CmsReservedPools::InitializePool
CmsRestarter::CmsRestarter
CmsRestarter::InitializeLibrary
CmsRestarter::RedoPass
CmsRestarter::Restart
CmsRestarter::StoreDeletedTable
CmsRestarter::UpdatePathPrefix
CmsRotatingSkipList<_RANGE,SmsAllocationRegionEx,OrderByStartOfRange,RegionLockPolicies>::Node::Node
CmsSchemaTable::GrowCachedSchemasArray
CmsSchemaTable::RegisterSchema
CmsStream::LogRedoForFastPathInsertion
CmsTable::InsertMetaRow
CmsTable::OutputRow
CmsTableCursor::CmsTableCursor
CmsTableSetBase::CommitMerge
CmsThinProvisioning::WorkItemState::WorkItemState
CmsTransactionContext::InitializeTransactionMemoryBuffer
CmsTrashTable::PostTrashCleaner
CmsTxMemLog::AddRedoRecord
CmsTxMemLog::AllocateRedoBlock
CmsVolume::AggregatedPerfCounterTelemetry
CmsVolume::ChangeVolumeOptionDynamically
CmsVolume::Checkpoint
CmsVolume::CmsVolume
CmsVolume::CmsVolume
CmsVolume::CommitTopLevelAction
CmsVolume::CommitTx
CmsVolume::ComputeOrVerifySelfChecksumBlock
CmsVolume::Extend
CmsVolume::FormatPageHeader
CmsVolume::InitializeAllocationSearchStrategies
CmsVolume::InitializeRangeSearchStrategies
CmsVolume::InitializeStorageTier
CmsVolume::InitializeStorageTierArray
CmsVolume::InitializeVolumeAllocator
CmsVolume::MakePageResident
CmsVolume::MoveSuperBlock
CmsVolume::Pin
CmsVolume::PrePopulateSystemAllocator
CmsVolume::ReadAndRepairSelfChecksumBlock
CmsVolume::ReadPageWorker
CmsVolume::ReadSuperBlock
CmsVolume::Start
CmsVolume::StartPagingContext
CmsVolume::operator_new
CmsVolumeAnalyzer::CmsVolumeAnalyzer
CmsVolumeAnalyzer::CompactContainers
CmsVolumeAnalyzer::Initialize
CmsVolumeAnalyzer::InitializeAndQueueRotationWorkItems
CmsVolumeContainer::AddReservedContainer
CmsVolumeContainer::CacheContainerInitialAllocationBitmap
CmsVolumeContainer::CmsVolumeContainer
CmsVolumeContainer::CompactAndCompressContainer
CmsVolumeContainer::CompressContainerBuffer
CmsVolumeContainer::CopyInitialAllocationBitmap
CmsVolumeContainer::Initialize
CmsVolumeContainer::InsertCompressionUnitOffsetsForContainer
CmsVolumeContainer::PersistContainerCacheParallel
CmsVolumeContainer::PersistContainerCacheWorker
CmsVolumeContainer::ReadCompressedContainerRange
CmsVolumeContainer::ReadCompressedContainerRangeInternal
CmsVolumeContainer::RealRangeToContainerRange
CmsVolumeContainer::RecompactEmbeddedContainer
CmsVolumeContainer::RestoreCompactionContainerRanges
CmsVolumeContainer::ValidateContainerRotationBuffer
CreateAndInitializeIndexContext
DeleteDirectoryOnDisk
DeleteFileOnDisk
DriverEntry
FUN_1c000e320
FUN_1c001083b
FUN_1c002adb9
FUN_1c0086386
FUN_1c0087eee
FUN_1c01bff67
FsLibInitializeIoPerf
FsLibIoFailureResetTable
FsLibIoPerfSnapshotVolumeCounters
FsRtlTagFileForStorageNotification
GetResidentStreamSummary
InitializeReparseIndexTable
InitializeVerifyBlock
LZX_DecodeNewGroup
LogCoreReadControlArea
LogCoreWriteDataRecord
LogInitializeFlushWindows
LogReadControlRecord
LogWriteControlRecord
McGenControlCallbackV2
MlLogAdvanceLogStart
MlLogOpenLog
MlLogScanLog
MsAllocator::RangeArrayStrategy::State::PopulateEntries
MsCreateDurableFailoverTableObject
MsCreateDurableTableObject
MsKmeAllocateIoRequest
MsKmeAllocateIoRun
MsKmeChecksumEventNotification
MsKmeCreateBaseAddressFromTuple
MsKmeCreateCacheContext
MsKmeDecrementCloseCount
MsKmeGenericSpacesRequest
MsKmeGetRowSizeAndOffset
MsKmeGetSMRBandSize
MsKmeGetSMRBandWriteHead
MsKmeInitializeReservedIoRequests
MsKmeInitializeReservedIoRuns
MsKmeLogEventNotification
MsKmeMetadataEventNotification
MsKmeQueryAndCacheSmrBandInfoForRange
MsKmeQueryMapAllocations
MsKmeQueryStorageClasses
MsKmeQueryStorageSeekPenalty
MsKmeQueryStorageTier
MsKmeQueryStreamsParameters
MsKmeQueryTopologyId
MsKmeReleaseCacheContext
MsKmeResetSMRSimBand
MsKmeSynchronousRepairFromCopy
MsKmeSynchronousScrubPickingWinners
MsKmeTreeCycleDetectedNotification
MsKmeUntrim
MsKmeUpdateBootSector
MsKmeZeroSMRRegion
MsPinDataWithRoot
MsUninitializeLibrary
MspAddVolumeToQueuedCheckpointList
MspCheckpointVolume
MspInitializeSchemas
MspRemoveVolumeFromQueuedCheckpointList
OpenFileSystemFile
ParityEncode
ParityEncode
ParityEncode
ParityEncode
ReadRepTree
ReallocateAndCopyIndexEntryIntoBuffer
RefsAccessCheck
RefsAcquireAllFiles
RefsAcquireParentForSystemFile
RefsAddExtentToTrimRequest
RefsAddFileNameIndexEntry
RefsAddNameToParent
RefsAddPreallocatedStructToRollbackList
RefsAllocAndFormatResidentAttribute
RefsAllocateNonpagedFcb
RefsAsyncCachedReadRequest
RefsBackpointerValueFromFileName
RefsChangeAttributeValue
RefsChangeResidentStreamIntegrity
RefsChangeStreamSparsenessAndBlob
RefsCheckUsnTimeOut
RefsCleanCheckpoint
RefsCommonCleanup
RefsConvertToIntegrity
RefsCopyReadA
RefsCopyWriteInternal
RefsCreateAttribute
RefsCreateAttributeWithValueEx
RefsCreateFcb
RefsCreateFile
RefsCreateFileId2
RefsCreateIndex
RefsCreateLcb
RefsCreateNewFile
RefsCreatePrerestartScb
RefsCreateRootFcb
RefsCreateScb
RefsCreateStreamSnapshot
RefsDeleteObjectLinkByRow
RefsDeleteReparsePoint
RefsDerefExportedSecurityDescriptor
RefsDetermineVirtualDisk
RefsEtwPostSalvageEvent
RefsFastIoCheckIfPossible
RefsFastLock
RefsFastQueryBasicInfo
RefsFastQueryNetworkOpenInfo
RefsFastQueryStdInfo
RefsFastUnlockAll
RefsFastUnlockAllByKey
RefsFastUnlockSingle
RefsFileLevelTrim
RefsFillIrpBuffer
RefsFillMdl
RefsFindCaseInsensitiveIndexEntryByRow
RefsFindFileId
RefsFindIndexEntryByRow
RefsFsdCleanup
RefsFsdCreate
RefsFsdDispatch
RefsFsdDispatchWait
RefsFsdRead
RefsFsdShutdown
RefsFsdWrite
RefsFspDispatch
RefsGetFirstReparseInfo
RefsGetNextReparseInfo
RefsGetReparsePoint
RefsGetReparsePointValue
RefsGetStandardInfo
RefsGetVolumeData
RefsGetVolumeInfo
RefsHoldIrpForNewUsn
RefsInitHashSegment
RefsInitialize
RefsInitializeAttributeContext
RefsInitializeFcbAndStdInfo
RefsInitializeIndexContext
RefsInitializeIoContext
RefsInitializeIrpContext
RefsInitializeObjLinkRow
RefsInitializeQueryDirectory
RefsInitializeSqm
RefsInitializeVcb
RefsIoPerfPostFileObjectInfo
RefsIsSparseStreamRemaining
RefsKsrRestoreContext
RefsKsrSaveContext
RefsLinkFileToSelf
RefsListStreamSnapshots
RefsMdlReadA
RefsNameIsStillPresent
RefsNetworkOpenCreate
RefsNonCachedIo
RefsNonCachedNonAlignedIo
RefsNotifyAccessCheck
RefsOpenAttributeInExistingFile
RefsOpenFcbById
RefsOpenNewAttr
RefsOverwriteAttr
RefsPagingFileIoWithNoAllocation
RefsParseNameForCreate
RefsPerformDismountOnVcbNonpaged
RefsPeriodicTimerCallback
RefsPostUsnChangeWithOverrideOption
RefsQueryDeltasStreamSnapshot
RefsQueryDirectory
RefsQueryLinksFullIdInfo
RefsQueryLinksInfo
RefsQueryRegionInfo
RefsQueryStreamsInfo
RefsQueryVolumeCounters
RefsQueryVolumeSmrInfo
RefsReadBootSectorLocation
RefsReadSingle
RefsReadUsnWorker
RefsReconcileFileIds
RefsReleaseSharedResources
RefsRemoveDataAttributes
RefsRemoveLink
RefsRemoveReparsePoint
RefsRenameAttributePriv
RefsRepairFile
RefsReplaceAttribute
RefsReserveClusters
RefsResidentWrite
RefsSalvageChild
RefsSalvageIndexTable
RefsSalvageLinkLcb
RefsScrubHandleInternal
RefsScrubVerifyBlock
RefsSeAccessCheck
RefsSecurityFindMatchingDescriptor
RefsSendBeginDismountEvent
RefsSetAllocationInfo
RefsSetReparsePointInternal
RefsSetupUsnJournal
RefsSqmAddToStream
RefsSqmAddToStreamEx
RefsStreamRename
RefsTelemetryContainerRotation
RefsTelemetryPerfCounters
RefsTelemetryPeriodicVolume
RefsTelemetryReadCache
RefsTelemetryStreamSnapshotOperations
RefsTelemetryUpdatePerfCounters
RefsTelemetryVolumeInfo
RefsUpdateDuplicateInfo
RefsUpdateDynamicRegistrySettings
RefsUpdateFcbInfoFromDisk
RefsUpdateIndexScbFromAttribute
RefsUpdateLink
RefsUpdateNormalizedName
RefsUpdateScbFromAttribute
RefsUpdateStandardInformation
RefsUsnAppendData
RefsWalkUpTree
RefsWasTxfTransactionActive
RefsWriteBytes
RefsWriteFcbUsnRecordToJournal
RefsZeroEndOfClusterStraddlingEof
RefsZeroRangeInStream
RegisterSchemaTableSchema
SetResidentStreamSummary
SmsContainer::SmsContainer
TmsTableSet::SliceRangeRow
ValidateGlobalTableRootBlock
ValidateOTEntryBoundaries
WppTraceCallback
WriteRepTree
_SmsIndexEntry::MmsInitializeIndexEntry
create_slot_lookup_table
do_block_output
init_compression_memory
make_table
make_table_8bit
output_block
redo_first_block
return_difference
update_tree_estimates
| |paramcount|3|3| |`address`|1c007b600|1c007c680| |sig|void * __cdecl memset(void * _Dst, int _Val, size_t _Size)|void * __cdecl memset(void * _Dst, int _Val, size_t _Size)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### memset Calling Diff ```diff --- memset calling +++ memset calling @@ -134,0 +135 @@ +CmsVolume::ReadAndRepairSelfChecksumBlock @@ -167,4 +168,3 @@ -FUN_1c005e485 -FUN_1c00852fc -FUN_1c0086e64 -FUN_1c01befb7 +FUN_1c0086386 +FUN_1c0087eee +FUN_1c01bff67 @@ -393,0 +394 @@ +ValidateOTEntryBoundaries ``` ## RtlULongAdd ### Match Info |Key|refs-2026-06.sys - refs-2026-07.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|refs-2026-06.sys|refs-2026-07.sys| | :---: | :---: | :---: | |name|RtlULongAdd|RtlULongAdd| |fullname|RtlULongAdd|RtlULongAdd| |`refcount`|3|5| |length|22|22| |called||| |`calling`|RefsDeallocateRanges
RefsGhostExtents|CmsVolume::ReadLatestCheckpoint
RefsDeallocateRanges
RefsGhostExtents| |paramcount|3|3| |`address`|1c004ed1c|1c004ea08| |sig|long __cdecl RtlULongAdd(ulong param_1, ulong param_2, ulong * param_3)|long __cdecl RtlULongAdd(ulong param_1, ulong param_2, ulong * param_3)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### RtlULongAdd Calling Diff ```diff --- RtlULongAdd calling +++ RtlULongAdd calling @@ -0,0 +1 @@ +CmsVolume::ReadLatestCheckpoint ``` ## WPP_SF_D ### Match Info |Key|refs-2026-06.sys - refs-2026-07.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.85| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|refs-2026-06.sys|refs-2026-07.sys| | :---: | :---: | :---: | |name|WPP_SF_D|WPP_SF_D| |fullname|WPP_SF_D|WPP_SF_D| |`refcount`|1831|1829| |length|59|59| |called|_guard_dispatch_icall|_guard_dispatch_icall| |`calling`|
Expand for full list:
AllocateAndGetVolumeLabel
CmsBPlusTable::AddSplitPageToIoRequest
CmsDurableLog::Start
CmsLogRedoQueue::RedoOneRecord
CmsLogRedoQueue::RedoWorkRoutine
CmsRestarter::Restart
CmsVolume::ReadAndRepairSelfChecksumBlock
CmsVolume::SmartIoReadAndRepair
CmsVolumeAnalyzer::CompactContainers
ComposeDirIndexEntry
ContinueEnumerationDeleteDirectoryOnDisk
DeleteFileOnDisk
DoInsertObjectLinkToParent
DriverEntry
FUN_1c0062bcc
FUN_1c0081190
FUN_1c008144e
FUN_1c0081801
FUN_1c0083c4b
FUN_1c0084618
FUN_1c008480b
FUN_1c0084fdc
FUN_1c00852fc
FUN_1c0086e64
FUN_1c0087b68
FUN_1c0087f82
FUN_1c0090998
FUN_1c0096d7c
FUN_1c0096fcb
FUN_1c009702e
FUN_1c00970c2
FUN_1c0099017
FUN_1c01859d0
FUN_1c019785b
FUN_1c0198c91
FUN_1c01b8a7e
FUN_1c01befb7
FUN_1c01bf522
FUN_1c01c2e63
FUN_1c01c2ec8
FUN_1c01c354d
FUN_1c01c37aa
FUN_1c01c4205
FUN_1c01c4589
FUN_1c01c4668
FUN_1c01c61a5
FUN_1c01c62f9
FUN_1c01c8e29
GetResidentStreamSummary
GetSecurityIdFromSecurityDescriptorUnsafe
GetSharedSecurityFromDescriptorUnsafe
InitializeDasdFile
InitializeDefaultClientRootSecurityDescriptor
InitializeDefaultSecurityDescriptor
InitializeDefaultServerRootSecurityDescriptor
InitializeDevice
InitializeReparseIndexTable
InitializeVcbDeviceName
InitializeVerifyBlock
InitializeVolumeInfoTable
IrpMinstoreIoCompletion
MsKmeInitializeReservedIoRequests
OpenFileSystemFile
OpenMetadataDirectory
OpenRefsObjectForFcb
OpenSecurityFile
ReallocateAndCopyIndexEntryIntoBuffer
RefsAccessCheck
RefsAcquireExclusiveVcb
RefsAcquireFcbWithPaging
RefsAcquireParentForSystemFile
RefsAcquireRangeLock
RefsAcquireSharedFcb
RefsAcquireSharedVcb
RefsAddAllocationForResidentWrite
RefsAddExtentToTrimRequest
RefsAddFileNameIndexEntry
RefsAdvanceMdl
RefsAllocateAttribute
RefsAppendNameToParent
RefsAsyncCachedReadRequest
RefsBindMinstoreTransaction
RefsBreakBatchOplock
RefsBugcheckExceptionFilter
RefsBuildPathNameForEventLog
RefsBuildPathNameForEventLogByFileReference
RefsBuildRelativeName
RefsCacheCoherencyFlush
RefsCacheSharedSecurityBySecurityId
RefsCacheSharedSecurityForCreate
RefsCancelReadUsnJournal
RefsChangeAttributeValue
RefsChangeResidentStreamIntegrity
RefsChangeStreamSparsenessAndBlob
RefsChangeVolumeSize
RefsCheckExistingFile
RefsCheckFileForDelete
RefsCheckIndexContents
RefsCheckIndexForAddOrDelete
RefsCheckLocksInZeroRange
RefsCheckScbForLinkRemoval
RefsCheckStreamSnapshotManagementBuffers
RefsCheckValidAttributeAccess
RefsCheckpointForVolumeSnapshot
RefsCheckpointVolume
RefsCommonCleanup
RefsCommonClose
RefsCommonCreate
RefsCommonCreateOnNewStack
RefsCommonDeviceControl
RefsCommonDirectoryControl
RefsCommonFileSystemControlOnNewStack
RefsCommonFlushBuffers
RefsCommonIoCompletionWorker
RefsCommonLockControl
RefsCommonPnp
RefsCommonQueryInformation
RefsCommonQuerySecurityInfo
RefsCommonQueryVolumeInfo
RefsCommonRead
RefsCommonSetInformation
RefsCommonSetSecurityInfo
RefsCommonSetVolumeInfo
RefsCommonVolumeOpen
RefsCommonWrite
RefsCommonWriteOnNewStack
RefsCompleteMdl
RefsConvertToIntegrity
RefsCopyReadA
RefsCreateAndAcquireFileIdParent
RefsCreateAttribute
RefsCreateAttributeWithValueEx
RefsCreateAttributeWithValueReal
RefsCreateCompletionRoutine
RefsCreateDirectory
RefsCreateFcb
RefsCreateFile
RefsCreateFileLock
RefsCreateLinkAttribute
RefsCreateMdlAndBuffer
RefsCreateNewFile
RefsCreateReparsePointInternal
RefsCreateRootFcb
RefsCreateStreamSnapshot
RefsCreateUsnJournal
RefsDeactivateUsnJournal
RefsDeallocateRanges
RefsDefragFile
RefsDefragFileInternal
RefsDeleteAllMinstoreStreams
RefsDeleteAllocation
RefsDeleteCorruptedContainer
RefsDeleteEntireStream
RefsDeleteFile
RefsDeleteFileId2
RefsDeleteLinkAttribute
RefsDeleteObject
RefsDeleteObjectLink
RefsDeleteObjectLinkByRow
RefsDeleteReparsePoint
RefsDeleteReparsePointInternal
RefsDeleteResidentAttributeRecord
RefsDeleteUsnJournal
RefsDeleteUsnSpecial
RefsDetermineVirtualDisk
RefsDeviceIoControl
RefsDeviceIoControlAsync
RefsDeviceIoControlAsync2
RefsDirtyVolume
RefsDuplicateExtents
RefsEtwWriteEvent
RefsEtwWriteVolumeFailureEvent
RefsExceptionFilter
RefsExecuteUnderOpenedDirectoryById
RefsFastLock
RefsFastUnlockAll
RefsFastUnlockAllByKey
RefsFastUnlockSingle
RefsFileLevelTrim
RefsFillStandardInfo
RefsFillStandardLinkInfo
RefsFilterCallbackAcquireForCreateSection
RefsFindCaseInsensitiveIndexEntryByRow
RefsFindFileId
RefsFindIndexEntry
RefsFindTargetElements
RefsFlushForWriteThrough
RefsFlushIndex
RefsFlushReparseIndex
RefsFlushSecurity
RefsFlushVolume
RefsForEachChildFcbInTriageRange
RefsForEachChildLcbAndScb
RefsForcePurgeCacheAndCloseSection
RefsFsdClose
RefsFsdDeviceControl
RefsFsdDispatchSwitch
RefsFsdRead
RefsFsdWrite
RefsFspClose
RefsGeneratePathNameForEventLog
RefsGetBootAreaInfo
RefsGetCompression
RefsGetDiskGeometry
RefsGetFirstReparseInfo
RefsGetGhostedRanges
RefsGetIntegrity
RefsGetMetadataRetrievalPointers
RefsGetNextFileIdFromObjectTable
RefsGetNextReparseInfo
RefsGetRangeState
RefsGetReparsePoint
RefsGetReparsePointValue
RefsGetRetrievalPointerBase
RefsGetRetrievalPointerCount
RefsGetRetrievalPointers
RefsGetSfioReservation
RefsGetStatistics
RefsGetStreamSummary
RefsGetVolumeBitmap
RefsGetVolumeData
RefsGetVolumeInfo
RefsGetVolumeInformation
RefsGetVolumeMetadataBitmap
RefsGhostExtents
RefsHandlePagingFile
RefsHasPendingRedo
RefsHoldIrpForNewUsn
RefsInitializeFcbAndStdInfo
RefsInitializeIrpContext
RefsInitializePerVolumeTelemetry
RefsInitializeQueryDirectory
RefsInitializeReservedBuffer
RefsInitializeVcb
RefsIoCallSelf
RefsIsRangeGhosted
RefsIsRangeSharedOrCompacted
RefsIsRangeValid
RefsIsVolumeDirty
RefsIsVolumeMounted
RefsLinkFileToSelf
RefsListStreamSnapshots
RefsLockUserBuffer
RefsLockVolume
RefsLockVolumeInternal
RefsLookupAllocationEx
RefsLookupAttributeForScb
RefsLookupLinkAttribute
RefsLookupNextInFileRecord
RefsLookupUnnamedDataAttribute
RefsMapAttributeValue
RefsMapStandardInfo
RefsMarkHandle
RefsMasterIrpSyncCompletionRoutine
RefsMdlReadA
RefsMigrateLinkLcbAndCommit
RefsMinstoreRead
RefsModifySecurity
RefsMountVolume
RefsMoveFile
RefsNetworkOpenCreate
RefsNonCachedIo
RefsNonCachedNonAlignedIo
RefsNonCachedResidentRead
RefsNotifyChangeDirectory
RefsNotifyMinstoreOfScbDoom
RefsNotifyStorageSpaceAllocation
RefsOpenAttribute
RefsOpenAttributeCheck
RefsOpenAttributeInExistingFile
RefsOpenExistingAttr
RefsOpenExistingEncryptedStream
RefsOpenExistingPrefixFcb
RefsOpenFcbById
RefsOpenFileHighLevel
RefsOpenHardlinkDirectoryTarget
RefsOpenNewAttr
RefsOpenSubdirectory
RefsOplockRequest
RefsOverwriteAttr
RefsParseName
RefsPartialSetStandardInfo
RefsPerformDismountOnVcb
RefsPerformTriage
RefsPerformTriageInternal
RefsPerformVerifyDiskRead
RefsPerformVerifyOperation
RefsPinStream
RefsPingVolume
RefsPrePostIrp
RefsPrePostIrpInternal
RefsPrefetchFile
RefsPrepareForCriticalIo
RefsPreparePinWriteStream
RefsPrepareToShrinkFileSize
RefsProcessException
RefsProcessTreeForRename
RefsQueryAllocatedRanges
RefsQueryAlternateNameInfo
RefsQueryCompressedFileSize
RefsQueryDeltasStreamSnapshot
RefsQueryDirectory
RefsQueryExtentReadCache
RefsQueryFileRegions
RefsQueryFsAttributeInfo
RefsQueryFsVolumeInfo
RefsQueryLinksFullIdInfo
RefsQueryLinksInfo
RefsQueryNameInfo
RefsQueryPersistentVolumeState
RefsQueryRegionInfo
RefsQueryRetrievalPointers
RefsQueryStorageClasses
RefsQueryStreamId
RefsQueryStreamsInfo
RefsQueryStreamsParameters
RefsQueryUsnJournal
RefsQueryViewIndex
RefsQueryVolumeCounters
RefsQueryVolumeNumaInfo
RefsQueryVolumeSmrInfo
RefsQueueTriageForDeadFcb
RefsQueueTriageForDeadFileId
RefsQueueTriageForDeadLink
RefsRaiseStatusInternal
RefsReadBootSectorLocation
RefsReadFileUsnData
RefsReadSingle
RefsReadUsnJournal
RefsReadUsnWorker
RefsReallocateRange
RefsReconcileFileIds
RefsRemoveDataAttributes
RefsRemoveOrphanedHardlinkBackPointer
RefsRemoveSupersededTarget
RefsRepairCopies
RefsRepairDirectory
RefsRepairFile
RefsRepairParentChildTable
RefsRepairScbByDestruction
RefsRepairSecurity
RefsRepairUsnJournal
RefsReplaceAttribute
RefsReseekAttribute
RefsReserveCcbNamesInLcb
RefsReserveClusters
RefsResetVolsnapBehaviorForVolume
RefsResidentWrite
RefsRestartIndexEnumeration
RefsSalvageChild
RefsSalvageIndexTable
RefsSalvageLinkLcb
RefsSalvageOpenSubdirById
RefsSalvageOpenSubdirsUsingParentChildTable
RefsScrubBootSector
RefsScrubHandle
RefsScrubHandleInternal
RefsScrubUndiscoverableId
RefsScrubVerifyBlock
RefsSecurityFindMatchingDescriptor
RefsSendFileTypeNotification
RefsSetAllocationInfo
RefsSetBasicInfo
RefsSetBreakOnCorrupt
RefsSetCachedRunsState
RefsSetClearVolumeFlag
RefsSetCompression
RefsSetDispositionInfo
RefsSetEndOfFileInfo
RefsSetExtendedDasdIo
RefsSetFileStrictlySequential
RefsSetFsLabelInfo
RefsSetIntegrity
RefsSetLinkInfo
RefsSetPersistentVolumeState
RefsSetPositionInfo
RefsSetPurgeFailureMode
RefsSetRenameInfo
RefsSetReparsePoint
RefsSetReparsePointInternal
RefsSetSfioReservation
RefsSetSparse
RefsSetStreamStationaryAndPreloaded
RefsSetStreamSummary
RefsSetValidDataLengthInfo
RefsSetVolumeInfo
RefsSetVolumeSmrGCParameters
RefsSetupReadCacheContext
RefsSetupUsnJournal
RefsShutdownCompletionRoutine
RefsSimpleCompletionRoutine
RefsSimpleCompletionRoutine2
RefsSingleNonAlignedSync
RefsStreamRename
RefsStreamSnapshotManagement
RefsStreamsAssociateId
RefsSuppressCheckpointOnLFF
RefsTrimCompletionRoutine
RefsUnlockVolume
RefsUnlockVolumeInternal
RefsUnmapThinProvisioningSpace
RefsUnpackFileId
RefsUpdateDuplicateInfo
RefsUpdateFcbInfoFromDisk
RefsUpdateLink
RefsUpdateNormalizedName
RefsUpdateScbFromAttribute
RefsUserFsRequest
RefsVerifyReadCompletionRoutine
RefsVerifyVolumeRequest
RefsVolumeDasdIo
RefsWaitForNewUsn
RefsWaitForOplockCompletionEvent
RefsWalkUpTree
RefsWasTxfTransactionActive
RefsWriteBootSector
RefsWriteBytes
RefsWriteOplockPrePostIrp
RefsWriteUsnCloseRecord
RefsWriteUsnForRenameAndCommit
RefsWriteUsnJournalChanges
RefsWriteUsnReason
RefsWriteVerifyBlock
RefsZeroRange
RefsZeroRangeInStream
RefsZeroStreamSizes
SetAndGetVolumeTimes
SetResidentStreamSummary
SetVolumeMounted
UpgradeUnnamedDataStreamToStreamSet
`RefsCommonCreate'::__l1::fin$0
|
Expand for full list:
AllocateAndGetVolumeLabel
CmsBPlusTable::AddSplitPageToIoRequest
CmsDurableLog::Start
CmsLogRedoQueue::RedoOneRecord
CmsLogRedoQueue::RedoWorkRoutine
CmsRestarter::Restart
CmsVolume::ReadAndRepairSelfChecksumBlock
CmsVolume::SmartIoReadAndRepair
CmsVolumeAnalyzer::CompactContainers
ComposeDirIndexEntry
ContinueEnumerationDeleteDirectoryOnDisk
DeleteFileOnDisk
DoInsertObjectLinkToParent
DriverEntry
FUN_1c005735c
FUN_1c008221a
FUN_1c00824d8
FUN_1c008288b
FUN_1c0084cd5
FUN_1c00856a2
FUN_1c0085895
FUN_1c0086066
FUN_1c0086386
FUN_1c0087eee
FUN_1c0088bf2
FUN_1c008900c
FUN_1c00926be
FUN_1c00947d4
FUN_1c0094a23
FUN_1c0094a86
FUN_1c0094b1a
FUN_1c0098f99
FUN_1c01869d0
FUN_1c019881b
FUN_1c0199c51
FUN_1c01afd9e
FUN_1c01bff67
FUN_1c01c04d2
FUN_1c01c3dbd
FUN_1c01c3e22
FUN_1c01c44a7
FUN_1c01c4704
FUN_1c01c4beb
FUN_1c01c4f6f
FUN_1c01c504e
FUN_1c01c6a13
FUN_1c01c7633
FUN_1c01c7787
GetResidentStreamSummary
GetSecurityIdFromSecurityDescriptorUnsafe
GetSharedSecurityFromDescriptorUnsafe
InitializeDasdFile
InitializeDefaultClientRootSecurityDescriptor
InitializeDefaultSecurityDescriptor
InitializeDefaultServerRootSecurityDescriptor
InitializeDevice
InitializeReparseIndexTable
InitializeVcbDeviceName
InitializeVerifyBlock
InitializeVolumeInfoTable
IrpMinstoreIoCompletion
MsKmeInitializeReservedIoRequests
OpenFileSystemFile
OpenMetadataDirectory
OpenRefsObjectForFcb
OpenSecurityFile
ReallocateAndCopyIndexEntryIntoBuffer
RefsAccessCheck
RefsAcquireExclusiveVcb
RefsAcquireFcbWithPaging
RefsAcquireParentForSystemFile
RefsAcquireRangeLock
RefsAcquireSharedFcb
RefsAcquireSharedVcb
RefsAddAllocationForResidentWrite
RefsAddExtentToTrimRequest
RefsAddFileNameIndexEntry
RefsAdvanceMdl
RefsAllocateAttribute
RefsAppendNameToParent
RefsAsyncCachedReadRequest
RefsBindMinstoreTransaction
RefsBreakBatchOplock
RefsBugcheckExceptionFilter
RefsBuildPathNameForEventLog
RefsBuildPathNameForEventLogByFileReference
RefsBuildRelativeName
RefsCacheCoherencyFlush
RefsCacheSharedSecurityBySecurityId
RefsCacheSharedSecurityForCreate
RefsCancelReadUsnJournal
RefsChangeAttributeValue
RefsChangeResidentStreamIntegrity
RefsChangeStreamSparsenessAndBlob
RefsChangeVolumeSize
RefsCheckExistingFile
RefsCheckFileForDelete
RefsCheckIndexContents
RefsCheckIndexForAddOrDelete
RefsCheckLocksInZeroRange
RefsCheckScbForLinkRemoval
RefsCheckStreamSnapshotManagementBuffers
RefsCheckValidAttributeAccess
RefsCheckpointForVolumeSnapshot
RefsCheckpointVolume
RefsCommonCleanup
RefsCommonClose
RefsCommonCreate
RefsCommonCreateOnNewStack
RefsCommonDeviceControl
RefsCommonDirectoryControl
RefsCommonFileSystemControlOnNewStack
RefsCommonFlushBuffers
RefsCommonIoCompletionWorker
RefsCommonLockControl
RefsCommonPnp
RefsCommonQueryInformation
RefsCommonQuerySecurityInfo
RefsCommonQueryVolumeInfo
RefsCommonRead
RefsCommonSetInformation
RefsCommonSetSecurityInfo
RefsCommonSetVolumeInfo
RefsCommonVolumeOpen
RefsCommonWrite
RefsCommonWriteOnNewStack
RefsCompleteMdl
RefsConvertToIntegrity
RefsCopyReadA
RefsCreateAndAcquireFileIdParent
RefsCreateAttribute
RefsCreateAttributeWithValueEx
RefsCreateAttributeWithValueReal
RefsCreateCompletionRoutine
RefsCreateDirectory
RefsCreateFcb
RefsCreateFile
RefsCreateFileLock
RefsCreateLinkAttribute
RefsCreateMdlAndBuffer
RefsCreateNewFile
RefsCreateReparsePointInternal
RefsCreateRootFcb
RefsCreateStreamSnapshot
RefsCreateUsnJournal
RefsDeactivateUsnJournal
RefsDeallocateRanges
RefsDefragFile
RefsDefragFileInternal
RefsDeleteAllMinstoreStreams
RefsDeleteAllocation
RefsDeleteCorruptedContainer
RefsDeleteEntireStream
RefsDeleteFile
RefsDeleteFileId2
RefsDeleteLinkAttribute
RefsDeleteObject
RefsDeleteObjectLink
RefsDeleteObjectLinkByRow
RefsDeleteReparsePoint
RefsDeleteReparsePointInternal
RefsDeleteResidentAttributeRecord
RefsDeleteUsnJournal
RefsDeleteUsnSpecial
RefsDetermineVirtualDisk
RefsDeviceIoControl
RefsDeviceIoControlAsync
RefsDeviceIoControlAsync2
RefsDirtyVolume
RefsDuplicateExtents
RefsEtwWriteEvent
RefsEtwWriteVolumeFailureEvent
RefsExceptionFilter
RefsExecuteUnderOpenedDirectoryById
RefsFastLock
RefsFastUnlockAll
RefsFastUnlockAllByKey
RefsFastUnlockSingle
RefsFileLevelTrim
RefsFillStandardInfo
RefsFillStandardLinkInfo
RefsFilterCallbackAcquireForCreateSection
RefsFindCaseInsensitiveIndexEntryByRow
RefsFindFileId
RefsFindIndexEntry
RefsFindTargetElements
RefsFlushForWriteThrough
RefsFlushIndex
RefsFlushReparseIndex
RefsFlushSecurity
RefsFlushVolume
RefsForEachChildFcbInTriageRange
RefsForEachChildLcbAndScb
RefsForcePurgeCacheAndCloseSection
RefsFsdClose
RefsFsdDeviceControl
RefsFsdDispatchSwitch
RefsFsdRead
RefsFsdWrite
RefsGeneratePathNameForEventLog
RefsGetBootAreaInfo
RefsGetCompression
RefsGetDiskGeometry
RefsGetFirstReparseInfo
RefsGetGhostedRanges
RefsGetIntegrity
RefsGetMetadataRetrievalPointers
RefsGetNextFileIdFromObjectTable
RefsGetNextReparseInfo
RefsGetRangeState
RefsGetReparsePoint
RefsGetReparsePointValue
RefsGetRetrievalPointerBase
RefsGetRetrievalPointerCount
RefsGetRetrievalPointers
RefsGetSfioReservation
RefsGetStatistics
RefsGetStreamSummary
RefsGetVolumeBitmap
RefsGetVolumeData
RefsGetVolumeInfo
RefsGetVolumeInformation
RefsGetVolumeMetadataBitmap
RefsGhostExtents
RefsHandlePagingFile
RefsHasPendingRedo
RefsHoldIrpForNewUsn
RefsInitializeFcbAndStdInfo
RefsInitializeIrpContext
RefsInitializePerVolumeTelemetry
RefsInitializeQueryDirectory
RefsInitializeReservedBuffer
RefsInitializeVcb
RefsIoCallSelf
RefsIsRangeGhosted
RefsIsRangeSharedOrCompacted
RefsIsRangeValid
RefsIsVolumeDirty
RefsIsVolumeMounted
RefsLinkFileToSelf
RefsListStreamSnapshots
RefsLockUserBuffer
RefsLockVolume
RefsLockVolumeInternal
RefsLookupAllocationEx
RefsLookupAttributeForScb
RefsLookupLinkAttribute
RefsLookupNextInFileRecord
RefsLookupUnnamedDataAttribute
RefsMapAttributeValue
RefsMapStandardInfo
RefsMarkHandle
RefsMasterIrpSyncCompletionRoutine
RefsMdlReadA
RefsMigrateLinkLcbAndCommit
RefsMinstoreRead
RefsModifySecurity
RefsMountVolume
RefsMoveFile
RefsNetworkOpenCreate
RefsNonCachedIo
RefsNonCachedNonAlignedIo
RefsNonCachedResidentRead
RefsNotifyChangeDirectory
RefsNotifyMinstoreOfScbDoom
RefsNotifyStorageSpaceAllocation
RefsOpenAttribute
RefsOpenAttributeCheck
RefsOpenAttributeInExistingFile
RefsOpenExistingAttr
RefsOpenExistingEncryptedStream
RefsOpenExistingPrefixFcb
RefsOpenFcbById
RefsOpenFileHighLevel
RefsOpenHardlinkDirectoryTarget
RefsOpenNewAttr
RefsOpenSubdirectory
RefsOplockRequest
RefsOverwriteAttr
RefsParseName
RefsPartialSetStandardInfo
RefsPerformDismountOnVcb
RefsPerformTriage
RefsPerformTriageInternal
RefsPerformVerifyDiskRead
RefsPerformVerifyOperation
RefsPinStream
RefsPingVolume
RefsPrePostIrp
RefsPrePostIrpInternal
RefsPrefetchFile
RefsPrepareForCriticalIo
RefsPreparePinWriteStream
RefsPrepareToShrinkFileSize
RefsProcessException
RefsProcessTreeForRename
RefsQueryAllocatedRanges
RefsQueryAlternateNameInfo
RefsQueryCompressedFileSize
RefsQueryDeltasStreamSnapshot
RefsQueryDirectory
RefsQueryExtentReadCache
RefsQueryFileRegions
RefsQueryFsAttributeInfo
RefsQueryFsVolumeInfo
RefsQueryLinksFullIdInfo
RefsQueryLinksInfo
RefsQueryNameInfo
RefsQueryPersistentVolumeState
RefsQueryRegionInfo
RefsQueryRetrievalPointers
RefsQueryStorageClasses
RefsQueryStreamId
RefsQueryStreamsInfo
RefsQueryStreamsParameters
RefsQueryUsnJournal
RefsQueryViewIndex
RefsQueryVolumeCounters
RefsQueryVolumeNumaInfo
RefsQueryVolumeSmrInfo
RefsQueueTriageForDeadFcb
RefsQueueTriageForDeadFileId
RefsQueueTriageForDeadLink
RefsRaiseStatusInternal
RefsReadBootSectorLocation
RefsReadFileUsnData
RefsReadSingle
RefsReadUsnJournal
RefsReadUsnWorker
RefsReallocateRange
RefsReconcileFileIds
RefsRemoveDataAttributes
RefsRemoveOrphanedHardlinkBackPointer
RefsRemoveSupersededTarget
RefsRepairCopies
RefsRepairDirectory
RefsRepairFile
RefsRepairParentChildTable
RefsRepairScbByDestruction
RefsRepairSecurity
RefsRepairUsnJournal
RefsReplaceAttribute
RefsReseekAttribute
RefsReserveCcbNamesInLcb
RefsReserveClusters
RefsResetVolsnapBehaviorForVolume
RefsResidentWrite
RefsRestartIndexEnumeration
RefsSalvageChild
RefsSalvageIndexTable
RefsSalvageLinkLcb
RefsSalvageOpenSubdirById
RefsSalvageOpenSubdirsUsingParentChildTable
RefsScrubBootSector
RefsScrubHandle
RefsScrubHandleInternal
RefsScrubUndiscoverableId
RefsScrubVerifyBlock
RefsSecurityFindMatchingDescriptor
RefsSendFileTypeNotification
RefsSetAllocationInfo
RefsSetBasicInfo
RefsSetBreakOnCorrupt
RefsSetCachedRunsState
RefsSetClearVolumeFlag
RefsSetCompression
RefsSetDispositionInfo
RefsSetEndOfFileInfo
RefsSetExtendedDasdIo
RefsSetFileStrictlySequential
RefsSetFsLabelInfo
RefsSetIntegrity
RefsSetLinkInfo
RefsSetPersistentVolumeState
RefsSetPositionInfo
RefsSetPurgeFailureMode
RefsSetRenameInfo
RefsSetReparsePoint
RefsSetReparsePointInternal
RefsSetSfioReservation
RefsSetSparse
RefsSetStreamStationaryAndPreloaded
RefsSetStreamSummary
RefsSetValidDataLengthInfo
RefsSetVolumeInfo
RefsSetVolumeSmrGCParameters
RefsSetupReadCacheContext
RefsSetupUsnJournal
RefsShutdownCompletionRoutine
RefsSimpleCompletionRoutine
RefsSimpleCompletionRoutine2
RefsSingleNonAlignedSync
RefsStreamRename
RefsStreamSnapshotManagement
RefsStreamsAssociateId
RefsSuppressCheckpointOnLFF
RefsTrimCompletionRoutine
RefsUnlockVolume
RefsUnlockVolumeInternal
RefsUnmapThinProvisioningSpace
RefsUnpackFileId
RefsUpdateDuplicateInfo
RefsUpdateFcbInfoFromDisk
RefsUpdateLink
RefsUpdateNormalizedName
RefsUpdateScbFromAttribute
RefsUserFsRequest
RefsVerifyReadCompletionRoutine
RefsVerifyVolumeRequest
RefsVolumeDasdIo
RefsWaitForNewUsn
RefsWaitForOplockCompletionEvent
RefsWalkUpTree
RefsWasTxfTransactionActive
RefsWriteBootSector
RefsWriteBytes
RefsWriteOplockPrePostIrp
RefsWriteUsnCloseRecord
RefsWriteUsnForRenameAndCommit
RefsWriteUsnJournalChanges
RefsWriteUsnReason
RefsWriteVerifyBlock
RefsZeroRange
RefsZeroRangeInStream
RefsZeroStreamSizes
SetAndGetVolumeTimes
SetResidentStreamSummary
SetVolumeMounted
UpgradeUnnamedDataStreamToStreamSet
`RefsCommonCreate'::__l1::fin$0
| |paramcount|0|0| |`address`|1c0058bd0|1c005b5b8| |sig|undefined WPP_SF_D(void)|undefined WPP_SF_D(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### WPP_SF_D Calling Diff ```diff --- WPP_SF_D calling +++ WPP_SF_D calling @@ -16,34 +16,34 @@ -FUN_1c0062bcc -FUN_1c0081190 -FUN_1c008144e -FUN_1c0081801 -FUN_1c0083c4b -FUN_1c0084618 -FUN_1c008480b -FUN_1c0084fdc -FUN_1c00852fc -FUN_1c0086e64 -FUN_1c0087b68 -FUN_1c0087f82 -FUN_1c0090998 -FUN_1c0096d7c -FUN_1c0096fcb -FUN_1c009702e -FUN_1c00970c2 -FUN_1c0099017 -FUN_1c01859d0 -FUN_1c019785b -FUN_1c0198c91 -FUN_1c01b8a7e -FUN_1c01befb7 -FUN_1c01bf522 -FUN_1c01c2e63 -FUN_1c01c2ec8 -FUN_1c01c354d -FUN_1c01c37aa -FUN_1c01c4205 -FUN_1c01c4589 -FUN_1c01c4668 -FUN_1c01c61a5 -FUN_1c01c62f9 -FUN_1c01c8e29 +FUN_1c005735c +FUN_1c008221a +FUN_1c00824d8 +FUN_1c008288b +FUN_1c0084cd5 +FUN_1c00856a2 +FUN_1c0085895 +FUN_1c0086066 +FUN_1c0086386 +FUN_1c0087eee +FUN_1c0088bf2 +FUN_1c008900c +FUN_1c00926be +FUN_1c00947d4 +FUN_1c0094a23 +FUN_1c0094a86 +FUN_1c0094b1a +FUN_1c0098f99 +FUN_1c01869d0 +FUN_1c019881b +FUN_1c0199c51 +FUN_1c01afd9e +FUN_1c01bff67 +FUN_1c01c04d2 +FUN_1c01c3dbd +FUN_1c01c3e22 +FUN_1c01c44a7 +FUN_1c01c4704 +FUN_1c01c4beb +FUN_1c01c4f6f +FUN_1c01c504e +FUN_1c01c6a13 +FUN_1c01c7633 +FUN_1c01c7787 @@ -201 +200,0 @@ -RefsFspClose ``` ## wil_details_IsEnabledFallback ### Match Info |Key|refs-2026-06.sys - refs-2026-07.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.83| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|refs-2026-06.sys|refs-2026-07.sys| | :---: | :---: | :---: | |name|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |fullname|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |`refcount`|5|13| |length|138|138| |called|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath| |`calling`|Feature_800271674__private_IsEnabledFallback
Feature_Servicing_REFSDisallowDASDOplock__private_IsEnabledFallback
Feature_Servicing_RefsDIScanPerfFix__private_IsEnabledFallback
Feature_Servicing_RefsRedirectionGuardSupport__private_IsEnabledFallback|
Expand for full list:
Feature_1076875578__private_IsEnabledFallback
Feature_1107546425__private_IsEnabledFallback
Feature_1337977145__private_IsEnabledFallback
Feature_1912855864__private_IsEnabledFallback
Feature_2293230905__private_IsEnabledFallback
Feature_3102454072__private_IsEnabledFallback
Feature_3155669306__private_IsEnabledFallback
Feature_881316153__private_IsEnabledFallback
Feature_Servicing_REFSDisallowDASDOplock__private_IsEnabledFallback
Feature_Servicing_ReFSMountHotplugTelemetry__private_IsEnabledFallback
Feature_Servicing_RefsDIScanPerfFix__private_IsEnabledFallbackFeature_Servicing_RefsRedirectionGuardSupport__private_IsEnabledFallback
| |paramcount|0|0| |`address`|1c0076ab8|1c0077658| |sig|undefined wil_details_IsEnabledFallback(void)|undefined wil_details_IsEnabledFallback(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### wil_details_IsEnabledFallback Calling Diff ```diff --- wil_details_IsEnabledFallback calling +++ wil_details_IsEnabledFallback calling @@ -1 +1,8 @@ -Feature_800271674__private_IsEnabledFallback +Feature_1076875578__private_IsEnabledFallback +Feature_1107546425__private_IsEnabledFallback +Feature_1337977145__private_IsEnabledFallback +Feature_1912855864__private_IsEnabledFallback +Feature_2293230905__private_IsEnabledFallback +Feature_3102454072__private_IsEnabledFallback +Feature_3155669306__private_IsEnabledFallback +Feature_881316153__private_IsEnabledFallback @@ -2,0 +10 @@ +Feature_Servicing_ReFSMountHotplugTelemetry__private_IsEnabledFallback ``` ## NTOSKRNL.EXE::ExAllocatePoolWithTag ### Match Info |Key|refs-2026-06.sys - refs-2026-07.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|refs-2026-06.sys|refs-2026-07.sys| | :---: | :---: | :---: | |name|ExAllocatePoolWithTag|ExAllocatePoolWithTag| |fullname|NTOSKRNL.EXE::ExAllocatePoolWithTag|NTOSKRNL.EXE::ExAllocatePoolWithTag| |`refcount`|507|508| |length|0|0| |called||| |`calling`|
Expand for full list:
::operator()
AllocateAndComposeTableKeyPath
AllocateAndGetVolumeLabel
CmsAllocationZones::CopyEntriesByAllocationType
CmsAllocationZones::CreateForFormat
CmsAllocationZones::CreateForFormatSmallVolume
CmsAllocationZones::ExtendSingleTier
CmsAllocationZones::LoadFromMaaSummary
CmsAllocationZones::UpgradeFromPreRS3
CmsAllocator::InitializeAllocator
CmsAllocator::InitializeResourcesCmsAllocator::MakeAllocator
CmsAllocator::MakeFilteredView
CmsAllocator::MakeRegion
CmsAllocator::PersistFilteredViewParallel
CmsAllocator::StartAllocationRequest
CmsAvlTableFlex::InitializeIndexEntry
CmsAvlTableLite::InitializeIndexEntry
CmsBPlusTable::AddUndoForSliceFastPath
CmsBPlusTable::AllocateUndo
CmsBPlusTable::ChecksumWritePlanLevel
CmsBPlusTable::CoordinateTreeUpdateWorkInParallel
CmsBPlusTable::EnqueueTreeUpdate
CmsBPlusTable::FindFirstIndexEntry
CmsBPlusTable::GenerateTriageContext
CmsBPlusTable::InitializeForCreateIndex
CmsBPlusTable::InitializeTreeIoBatch
CmsBPlusTable::SetObjectRecordPayload
CmsBPlusTable::TriageCorruptChild
CmsBPlusTable::UpdateBoundTrees
CmsBlockCache::CreateInstance
CmsBlockCache::GrowMaxBlockAddresses
CmsBlockRefcount::BlockRefTableTelemetry
CmsBlockRefcount::Initialize
CmsCachedRuns::Initialize
CmsCachedRuns::ResetPostExtend
CmsChecksum::InitializeLibrary
CmsCompositeBase::CacheRoot
CmsCompression::InitializeLibrary
CmsCompressionLZX::Allocate
CmsContainerRangeMap::ParallelForEachBucket
CmsDurableLog::LogLibraryQueryTopologyId
CmsDurableLog::Start
CmsEmbeddedComposite::CreateNewParent
CmsEmbeddedComposite::PinRootInternal
CmsEmbeddedComposite::Reparent
CmsFailoverBPlusTable::TriageRepairFromBackup
CmsHashTable::AllocateTable
CmsHashTable::CreateOrExpandOverflowBucket
CmsIntegrityState::Initialize
CmsKeyRules::AddKeyRules
CmsKeyRules::InitializeLibrary
CmsLogRedoQueue::RedoModifyStreamExtent
CmsLogRedoQueue::RedoReparentTable
CmsLogRedoQueue::RedoStreamFastPathRowInsertion
CmsLookasides::Allocate
CmsLookasides::InitializeLibrary
CmsObjectTable::CreateQueryChildrenCursor
CmsObjectTable::GetObjectRecordOfIdentifier
CmsObjectTable::InitializeTable
CmsPinCache::TransferOneCachedPin
CmsPoolComposite::Initialize
CmsRangeAndCountMap::Initialize
CmsReadCache::AddRequestToReadCacheContext
CmsReadCache::GatherCacheContext
CmsReadCache::ProcessReadCacheRepair
CmsReservedPools::InitializePool
CmsRestarter::FlushAndCheckpoint
CmsRestarter::QueueCheckpoint
CmsRestarter::QueueWait
CmsRestarter::RedoOneRecordBlock
CmsRestarter::RedoPass
CmsRestarter::Restart
CmsRestarter::StoreDeletedTable
CmsRestarter::UpdatePathPrefix
CmsRotatingSkipList<_RANGE,SmsAllocationRegionEx,OrderByStartOfRange,RegionLockPolicies>::PreAllocateForInsert
CmsRowWithBuffer::GrowBuffer
CmsRowWithBuffer::NewLength
CmsRowWithBuffer::NewLength
CmsSMRSimulator::CmsSMRSimulator
CmsSchemaTable::GrowCachedSchemasArray
CmsSchemaTable::InitializeIdSchemaTable
CmsSchemaTable::RegisterSchema
CmsStream::FastPathRowSlice
CmsStream::LookupAllocation
CmsStream::MergeTwoRuns
CmsStream::SetContainersStationaryVolatile
CmsStream::VerifyOrRepairFromChecksum
CmsTable::Enumerate
CmsTable::OutputRow
CmsTable::UpdateCursorFromFoundIndexEntry
CmsTableFactory::ProduceDegenerateBTable
CmsTableSetBase::AttachNew
CmsTableSetBase::LogUndoForSetRowWeakRef
CmsTableSetBase::OpenExisting
CmsTableSetBase::OpenExistingBypass
CmsTransactionContext::GetScrubBuffer
CmsTrashTable::AddFileTable
CmsTrashTable::AddTableSetMergeFinish
CmsTrashTable::PostTrashCleaner
CmsTxMemLog::AddRedoRecord
CmsTxMemLog::AllocateRedoBlock
CmsVolume::ChangeVolumeOptionDynamically
CmsVolume::Checkpoint
CmsVolume::Extend
CmsVolume::InitializeAllocationSearchStrategies
CmsVolume::InitializeRangeSearchStrategies
CmsVolume::InitializeStorageTier
CmsVolume::InitializeStorageTierArray
CmsVolume::InitializeUpcaseTable
CmsVolume::InitializeVolumeAllocator
CmsVolume::MakePageResident
CmsVolume::MoveSuperBlock
CmsVolume::QueryStorageTierRegionInfo
CmsVolume::ReadLatestCheckpoint
CmsVolume::ReadSuperBlock
CmsVolume::SmsTrim::Initialize
CmsVolume::Start
CmsVolume::SyncForFreeSpace
CmsVolume::ValidateCheckpointRecord
CmsVolume::operator_new
CmsVolumeAnalyzer::CompactContainers
CmsVolumeAnalyzer::Initialize
CmsVolumeAnalyzer::InitializeAndQueueRotationWorkItems
CmsVolumeContainer::AddReservedContainer
CmsVolumeContainer::CompactAndCompressContainer
CmsVolumeContainer::CompressContainerBuffer
CmsVolumeContainer::CreateContainerCacheArrayCopy
CmsVolumeContainer::CreateContainerEnumerateCursor
CmsVolumeContainer::CreateContainerForCache
CmsVolumeContainer::Initialize
CmsVolumeContainer::InitializeIndex
CmsVolumeContainer::InsertCompressionUnitOffsetsForContainer
CmsVolumeContainer::PersistContainerCacheParallel
CmsVolumeContainer::PinContainer
CmsVolumeContainer::QueueContainerRotation
CmsVolumeContainer::ReadCompressedContainerRangeInternal
CmsVolumeContainer::RealRangeToContainerRange
CmsVolumeContainer::RecompactEmbeddedContainer
CmsVolumeContainer::RestoreCompactionContainerRanges
CmsVolumeContainer::RestoreContainerArray
CmsVolumeContainer::RotateContainers
CmsVolumeContainer::SetContainerRangeValid
CmsVolumeContainer::SetContainerStationaryVolatile
CmsVolumeContainer::ValidateContainerRotationBuffer
CopyKeyHelper
CopyObjectTablePayload
DeleteDirectoryOnDisk
DriverEntry
ExAllocatePoolUninitialized
FUN_1c0009928
FUN_1c002adb9
FUN_1c003415a
FUN_1c0060676
FUN_1c0068041
FUN_1c01befb7
FUN_1c01c61a5
FsLibInitializeIoPerf
FsLibIoFailureSummarizeTable
FsLibIoFailureSummarizeTableForEventLog
FsLibIoPerfInitializeCountersData
FsLibIoPerfInitializeSummaryData
FsLibIoPerfInitializeVolumeData
FsLibIoPerfPrepareToSendData
GetDiskProperties
GetSharedSecurityFromDescriptorUnsafe
InitializeClMulCrcLibrary
InitializeDefaultClientRootSecurityDescriptor
InitializeDefaultSecurityDescriptor
InitializeDefaultServerRootSecurityDescriptor
InitializeVcbDeviceName
InitializeVerifyBlock
InitializeVolumeInfoTable
IssueSynchronousDeviceIoControl
LockFcbMainPagingAsyncTableSetCb
LogCoreScanDataRecord
LogCoreWriteDataRecord
LogInitializeFlushWindows
LogReadControlRecord
LogRepairEntryHeader
MlLogOpenLog
MlLogScanLog
MsAllocateRowWithBuffer
MsAllocator::RangeArrayStrategy::State::PopulateEntries
MsAllocator::StrategySupport::LinearAcquireNextRegion
MsCreateDurableFailoverTableObject
MsCreateMatchAllCursor
MsCreateMatchLongCursor
MsCreateSMRSimulator
MsCreateStreamTableSet
MsCreateTableCursor
MsCreateTransactionContext
MsKmeAllocateIoRequest
MsKmeAllocateIoRun
MsKmeGetSMRBandSize
MsKmeGetSMRBandWriteHead
MsKmeInitializeReservedIoRequestsForVcb
MsKmeInitializeReservedIoRuns
MsKmeInitializeReservedIoRunsForVcb
MsKmePrefetchPages
MsKmeQueryAndCacheSmrBandInfoForRange
MsKmeQueryCpuInformation
MsKmeQueryMapAllocations
MsKmeResetSMRSimBand
MsKmeTelemetry
MsKmeUpdateBootSector
MsKmeZeroSMRRegion
MsOpenStream
MspGrowTopologyIds
MspInitializeReadCopyContext
MspLazyWriterScan
MspQueueEntry
OpenFileSystemFile
ReallocateAndCopyIndexEntryIntoBuffer
RefsAccessCheck
RefsAcquireAllFiles
RefsAcquireSharedScbForTransaction
RefsAllocAndFormatResidentAttribute
RefsAllocateEresourcePriv
RefsAllocateFcbTableEntry
RefsAllocateFileKey
RefsAllocateNonpagedFcb
RefsAppendNameToParent
RefsBackpointerValueFromFileName
RefsBuildFileName
RefsBuildRelativeName
RefsCacheSharedSecurityBySecurityId
RefsChangeAttributeValue
RefsChangeResidentStreamIntegrity
RefsChangeStreamSparsenessAndBlob
RefsChangeVolumeSize
RefsCheckToAllowForReadCache
RefsCommonSetInformation
RefsCommonVolumeOpen
RefsConvertToIntegrity
RefsCreateAttribute
RefsCreateFcb
RefsCreateFileId2
RefsCreateIndex
RefsCreateMdlAndBuffer
RefsCreatePrerestartScb
RefsCreateScb
RefsCreateStreamSnapshot
RefsDefragFileInternal
RefsDetermineVirtualDisk
RefsDeviceIoControlAsync2
RefsEtwPostWriteEvent
RefsFindFileId
RefsFindStartingNode
RefsGeneratePathNameForEventLog
RefsGetReparsePointValue
RefsGetSfioReservation
RefsGetVolumeInformation
RefsHoldIrpForNewUsn
RefsInitHashSegment
RefsInitializeAttributeRowKey
RefsInitializeObjLinkRow
RefsInitializePerVolumeTelemetry
RefsInitializeQueryDirectory
RefsInitializeRefsData
RefsInitializeReservedBuffer
RefsInitializeSqm
RefsInitializeVcb
RefsInsertDebugInfoIrpImplementation
RefsInsertPrefixHashEntry
RefsIoPerfPostFileObjectInfo
RefsKsrRestoreContext
RefsLookupAttributeForScb
RefsMapAttributeValue
RefsMigrateLcb
RefsMountVolume
RefsNonCachedNonAlignedIo
RefsNotifyChangeDirectory
RefsOpenAttribute
RefsOpenUsnJournal
RefsPerformVerifyOperation
RefsPostTelemetryVolumeInfo
RefsPostUsnChangeWithOverrideOption
RefsPrepareForCriticalIo
RefsQueryDirectory
RefsQueryRegionInfo
RefsQueryRetrievalPointers
RefsReadBootSectorLocation
RefsRepairFile
RefsRepairSecurity
RefsReseekAttribute
RefsReserveCcbNamesInLcb
RefsReserveClusters
RefsScrubBootSector
RefsScrubVerifyBlock
RefsSecurityGetDescriptorById
RefsSendBeginDismountEvent
RefsSendFileTypeNotification
RefsSetBreakOnCorrupt
RefsSetClearVolumeFlag
RefsSetLinkInfo
RefsSetRenameInfo
RefsSqmAddToStreamEx
RefsStreamSnapshotManagement
RefsTelemetrySetIntegrity
RefsUpdateNormalizedName
RefsWaitForNewUsn
RefsWatchForRegistryChanges
RefsWriteUsnJournalChanges
SetAndGetVolumeTimes
SetResidentStreamSummary
SetVolumeMounted
operator_new
|
Expand for full list:
::operator()
AllocateAndComposeTableKeyPath
AllocateAndGetVolumeLabel
CmsAllocationZones::CopyEntriesByAllocationType
CmsAllocationZones::CreateForFormat
CmsAllocationZones::CreateForFormatSmallVolume
CmsAllocationZones::ExtendSingleTier
CmsAllocationZones::LoadFromMaaSummary
CmsAllocationZones::UpgradeFromPreRS3
CmsAllocator::InitializeAllocator
CmsAllocator::InitializeResourcesCmsAllocator::MakeAllocator
CmsAllocator::MakeFilteredView
CmsAllocator::MakeRegion
CmsAllocator::PersistFilteredViewParallel
CmsAllocator::StartAllocationRequest
CmsAvlTableFlex::InitializeIndexEntry
CmsAvlTableLite::InitializeIndexEntry
CmsBPlusTable::AddUndoForSliceFastPath
CmsBPlusTable::AllocateUndo
CmsBPlusTable::ChecksumWritePlanLevel
CmsBPlusTable::CoordinateTreeUpdateWorkInParallel
CmsBPlusTable::EnqueueTreeUpdate
CmsBPlusTable::FindFirstIndexEntry
CmsBPlusTable::GenerateTriageContext
CmsBPlusTable::InitializeForCreateIndex
CmsBPlusTable::InitializeTreeIoBatch
CmsBPlusTable::SetObjectRecordPayload
CmsBPlusTable::TriageCorruptChild
CmsBPlusTable::UpdateBoundTrees
CmsBlockCache::CreateInstance
CmsBlockCache::GrowMaxBlockAddresses
CmsBlockRefcount::BlockRefTableTelemetry
CmsBlockRefcount::Initialize
CmsCachedRuns::Initialize
CmsCachedRuns::ResetPostExtend
CmsChecksum::InitializeLibrary
CmsCompositeBase::CacheRoot
CmsCompression::InitializeLibrary
CmsCompressionLZX::Allocate
CmsContainerRangeMap::ParallelForEachBucket
CmsDurableLog::LogLibraryQueryTopologyId
CmsDurableLog::Start
CmsEmbeddedComposite::CreateNewParent
CmsEmbeddedComposite::PinRootInternal
CmsEmbeddedComposite::Reparent
CmsFailoverBPlusTable::TriageRepairFromBackup
CmsHashTable::AllocateTable
CmsHashTable::CreateOrExpandOverflowBucket
CmsIntegrityState::Initialize
CmsKeyRules::AddKeyRules
CmsKeyRules::InitializeLibrary
CmsLogRedoQueue::RedoModifyStreamExtent
CmsLogRedoQueue::RedoReparentTable
CmsLogRedoQueue::RedoStreamFastPathRowInsertion
CmsLookasides::Allocate
CmsLookasides::InitializeLibrary
CmsObjectTable::CreateQueryChildrenCursor
CmsObjectTable::GetObjectRecordOfIdentifier
CmsObjectTable::InitializeTable
CmsPinCache::TransferOneCachedPin
CmsPoolComposite::Initialize
CmsRangeAndCountMap::Initialize
CmsReadCache::AddRequestToReadCacheContext
CmsReadCache::GatherCacheContext
CmsReadCache::ProcessReadCacheRepair
CmsReservedPools::InitializePool
CmsRestarter::FlushAndCheckpoint
CmsRestarter::QueueCheckpoint
CmsRestarter::QueueWait
CmsRestarter::RedoOneRecordBlock
CmsRestarter::RedoPass
CmsRestarter::Restart
CmsRestarter::StoreDeletedTable
CmsRestarter::UpdatePathPrefix
CmsRotatingSkipList<_RANGE,SmsAllocationRegionEx,OrderByStartOfRange,RegionLockPolicies>::PreAllocateForInsert
CmsRowWithBuffer::GrowBuffer
CmsRowWithBuffer::NewLength
CmsRowWithBuffer::NewLength
CmsSMRSimulator::CmsSMRSimulator
CmsSchemaTable::GrowCachedSchemasArray
CmsSchemaTable::InitializeIdSchemaTable
CmsSchemaTable::RegisterSchema
CmsStream::FastPathRowSlice
CmsStream::LookupAllocation
CmsStream::MergeTwoRuns
CmsStream::SetContainersStationaryVolatile
CmsStream::VerifyOrRepairFromChecksum
CmsTable::Enumerate
CmsTable::OutputRow
CmsTable::UpdateCursorFromFoundIndexEntry
CmsTableFactory::ProduceDegenerateBTable
CmsTableSetBase::AttachNew
CmsTableSetBase::LogUndoForSetRowWeakRef
CmsTableSetBase::OpenExisting
CmsTableSetBase::OpenExistingBypass
CmsTransactionContext::GetScrubBuffer
CmsTrashTable::AddFileTable
CmsTrashTable::AddTableSetMergeFinish
CmsTrashTable::PostTrashCleaner
CmsTxMemLog::AddRedoRecord
CmsTxMemLog::AllocateRedoBlock
CmsVolume::ChangeVolumeOptionDynamically
CmsVolume::Checkpoint
CmsVolume::Extend
CmsVolume::InitializeAllocationSearchStrategies
CmsVolume::InitializeRangeSearchStrategies
CmsVolume::InitializeStorageTier
CmsVolume::InitializeStorageTierArray
CmsVolume::InitializeUpcaseTable
CmsVolume::InitializeVolumeAllocator
CmsVolume::MakePageResident
CmsVolume::MoveSuperBlock
CmsVolume::QueryStorageTierRegionInfo
CmsVolume::ReadLatestCheckpoint
CmsVolume::ReadSuperBlock
CmsVolume::SmsTrim::Initialize
CmsVolume::Start
CmsVolume::SyncForFreeSpace
CmsVolume::ValidateCheckpointRecord
CmsVolume::operator_new
CmsVolumeAnalyzer::CompactContainers
CmsVolumeAnalyzer::Initialize
CmsVolumeAnalyzer::InitializeAndQueueRotationWorkItems
CmsVolumeContainer::AddReservedContainer
CmsVolumeContainer::CompactAndCompressContainer
CmsVolumeContainer::CompressContainerBuffer
CmsVolumeContainer::CreateContainerCacheArrayCopy
CmsVolumeContainer::CreateContainerEnumerateCursor
CmsVolumeContainer::CreateContainerForCache
CmsVolumeContainer::Initialize
CmsVolumeContainer::InitializeIndex
CmsVolumeContainer::InsertCompressionUnitOffsetsForContainer
CmsVolumeContainer::PersistContainerCacheParallel
CmsVolumeContainer::PinContainer
CmsVolumeContainer::QueueContainerRotation
CmsVolumeContainer::ReadCompressedContainerRangeInternal
CmsVolumeContainer::RealRangeToContainerRange
CmsVolumeContainer::RecompactEmbeddedContainer
CmsVolumeContainer::RestoreCompactionContainerRanges
CmsVolumeContainer::RestoreContainerArray
CmsVolumeContainer::RotateContainers
CmsVolumeContainer::SetContainerRangeValid
CmsVolumeContainer::SetContainerStationaryVolatile
CmsVolumeContainer::ValidateContainerRotationBuffer
CopyKeyHelper
CopyObjectTablePayload
DeleteDirectoryOnDisk
DriverEntry
ExAllocatePoolUninitialized
FUN_1c0009928
FUN_1c002adb9
FUN_1c003415a
FUN_1c0054496
FUN_1c00594c9
FUN_1c01bff67
FUN_1c01c7633
FsLibInitializeIoPerf
FsLibIoFailureSummarizeTable
FsLibIoFailureSummarizeTableForEventLog
FsLibIoPerfInitializeCountersData
FsLibIoPerfInitializeSummaryData
FsLibIoPerfInitializeVolumeData
FsLibIoPerfPrepareToSendData
GetDiskProperties
GetSharedSecurityFromDescriptorUnsafe
InitializeClMulCrcLibrary
InitializeDefaultClientRootSecurityDescriptor
InitializeDefaultSecurityDescriptor
InitializeDefaultServerRootSecurityDescriptor
InitializeVcbDeviceName
InitializeVerifyBlock
InitializeVolumeInfoTable
IssueSynchronousDeviceIoControl
LockFcbMainPagingAsyncTableSetCb
LogCoreScanDataRecord
LogCoreWriteDataRecord
LogInitializeFlushWindows
LogReadControlRecord
LogRepairEntryHeader
MlLogOpenLog
MlLogScanLog
MsAllocateRowWithBuffer
MsAllocator::RangeArrayStrategy::State::PopulateEntries
MsAllocator::StrategySupport::LinearAcquireNextRegion
MsCreateDurableFailoverTableObject
MsCreateMatchAllCursor
MsCreateMatchLongCursor
MsCreateSMRSimulator
MsCreateStreamTableSet
MsCreateTableCursor
MsCreateTransactionContext
MsKmeAllocateIoRequest
MsKmeAllocateIoRun
MsKmeGetSMRBandSize
MsKmeGetSMRBandWriteHead
MsKmeInitializeReservedIoRequestsForVcb
MsKmeInitializeReservedIoRuns
MsKmeInitializeReservedIoRunsForVcb
MsKmePrefetchPages
MsKmeQueryAndCacheSmrBandInfoForRange
MsKmeQueryCpuInformation
MsKmeQueryMapAllocations
MsKmeResetSMRSimBand
MsKmeTelemetry
MsKmeUpdateBootSector
MsKmeZeroSMRRegion
MsOpenStream
MspGrowTopologyIds
MspInitializeReadCopyContext
MspLazyWriterScan
MspQueueEntry
OpenFileSystemFile
ReallocateAndCopyIndexEntryIntoBuffer
RefsAccessCheck
RefsAcquireAllFiles
RefsAcquireSharedScbForTransaction
RefsAllocAndFormatResidentAttribute
RefsAllocateEresourcePriv
RefsAllocateFcbTableEntry
RefsAllocateFileKey
RefsAllocateNonpagedFcb
RefsAppendNameToParent
RefsBackpointerValueFromFileName
RefsBuildFileName
RefsBuildRelativeName
RefsCacheSharedSecurityBySecurityId
RefsChangeAttributeValue
RefsChangeResidentStreamIntegrity
RefsChangeStreamSparsenessAndBlob
RefsChangeVolumeSize
RefsCheckToAllowForReadCache
RefsCommonSetInformation
RefsCommonVolumeOpen
RefsConvertToIntegrity
RefsCreateAttribute
RefsCreateFcb
RefsCreateFileId2
RefsCreateIndex
RefsCreateMdlAndBuffer
RefsCreatePrerestartScb
RefsCreateScb
RefsCreateStreamSnapshot
RefsDefragFileInternal
RefsDetermineVirtualDisk
RefsDeviceIoControlAsync2
RefsEtwPostWriteEvent
RefsFindFileId
RefsFindStartingNode
RefsGeneratePathNameForEventLog
RefsGetReparsePointValue
RefsGetSfioReservation
RefsGetVolumeInformation
RefsHoldIrpForNewUsn
RefsInitHashSegment
RefsInitializeAttributeRowKey
RefsInitializeObjLinkRow
RefsInitializePerVolumeTelemetry
RefsInitializeQueryDirectory
RefsInitializeRefsData
RefsInitializeReservedBuffer
RefsInitializeSqm
RefsInitializeVcb
RefsInsertDebugInfoIrpImplementation
RefsInsertPrefixHashEntry
RefsIoPerfPostFileObjectInfo
RefsKsrRestoreContext
RefsLookupAttributeForScb
RefsMapAttributeValue
RefsMigrateLcb
RefsMountVolume
RefsNonCachedNonAlignedIo
RefsNotifyChangeDirectory
RefsOpenAttribute
RefsOpenUsnJournal
RefsPerformVerifyOperation
RefsPostTelemetryVolumeInfo
RefsPostUsnChangeWithOverrideOption
RefsPrepareForCriticalIo
RefsQueryDirectory
RefsQueryRegionInfo
RefsQueryRetrievalPointers
RefsReadBootSectorLocation
RefsRepairFile
RefsRepairSecurity
RefsReseekAttribute
RefsReserveCcbNamesInLcb
RefsReserveClusters
RefsScrubBootSector
RefsScrubVerifyBlock
RefsSecurityGetDescriptorById
RefsSendBeginDismountEvent
RefsSendFileTypeNotification
RefsSetBreakOnCorrupt
RefsSetClearVolumeFlag
RefsSetLinkInfo
RefsSetRenameInfo
RefsSqmAddToStreamEx
RefsStreamSnapshotManagement
RefsTelemetrySetIntegrity
RefsUpdateNormalizedName
RefsWaitForNewUsn
RefsWatchForRegistryChanges
RefsWriteUsnJournalChanges
SetAndGetVolumeTimes
SetResidentStreamSummary
SetVolumeMounted
ValidateOTEntryBoundaries
operator_new
| |paramcount|0|0| |address|EXTERNAL:00000177|EXTERNAL:00000177| |sig|undefined ExAllocatePoolWithTag(void)|undefined ExAllocatePoolWithTag(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::ExAllocatePoolWithTag Calling Diff ```diff --- NTOSKRNL.EXE::ExAllocatePoolWithTag calling +++ NTOSKRNL.EXE::ExAllocatePoolWithTag calling @@ -154,4 +154,4 @@ -FUN_1c0060676 -FUN_1c0068041 -FUN_1c01befb7 -FUN_1c01c61a5 +FUN_1c0054496 +FUN_1c00594c9 +FUN_1c01bff67 +FUN_1c01c7633 @@ -307,0 +308 @@ +ValidateOTEntryBoundaries ``` Generated with `ghidriff` version: 1.0.0 on 2026-08-28T15:53:42