# spaceport.sys 22000.282 vs 22000.434 (CVE-2022-21877, manual pair) # TOC * [Visual Chart Diff](#visual-chart-diff) * [Metadata](#metadata) * [Ghidra Diff Engine](#ghidra-diff-engine) * [Command Line](#command-line) * [Binary Metadata Diff](#binary-metadata-diff) * [Program Options](#program-options) * [Diff Stats](#diff-stats) * [Strings](#strings) * [Deleted](#deleted) * [Added](#added) * [Modified](#modified) * [SP_POOL::SetSpaceInfoTransaction](#sp_poolsetspaceinfotransaction) * [SP_POOL::SetTierInfoTransaction](#sp_poolsettierinfotransaction) * [SpIoctlCreateTier](#spioctlcreatetier) * [Modified (No Code Changes)](#modified-no-code-changes) * [RtlULongAdd](#rtlulongadd) # Visual Chart Diff ```mermaid flowchart LR SP_POOLSetSpaceInfoTransaction-3-old<--Match 75%-->SP_POOLSetSpaceInfoTransaction-3-new SP_POOLSetTierInfoTransaction-3-old<--Match 93%-->SP_POOLSetTierInfoTransaction-3-new SpIoctlCreateTier-1-old<--Match 54%-->SpIoctlCreateTier-1-new subgraph spaceport-10.0.22000.434.sys SP_POOLSetSpaceInfoTransaction-3-new SP_POOLSetTierInfoTransaction-3-new SpIoctlCreateTier-1-new end subgraph spaceport-10.0.22000.282.sys SP_POOLSetSpaceInfoTransaction-3-old SP_POOLSetTierInfoTransaction-3-old SpIoctlCreateTier-1-old end ``` ```mermaid pie showData title Function Matches - 100.0000% "unmatched_funcs_len" : 0 "matched_funcs_len" : 4722 ``` ```mermaid pie showData title Matched Function Similarity - 99.9153% "matched_funcs_with_code_changes_len" : 3 "matched_funcs_with_non_code_changes_len" : 1 "matched_funcs_no_changes_len" : 4718 ``` # Metadata ## Ghidra Diff Engine ### Command Line #### Captured Command Line ``` ghidriff --project-location C:\tools\hugo\patchpalooza\ghidriff\CVE-2022-21877\ghidra_projects --project-name CVE-2022-21877 --symbols-path C:\tools\hugo\patchpalooza\ghidriff\CVE-2022-21877\symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --bsim --max-ram-percent 60.0 --max-section-funcs 200 --md-title spaceport.sys 22000.282 vs 22000.434 (CVE-2022-21877, manual pair) spaceport-10.0.22000.282.sys spaceport-10.0.22000.434.sys ``` #### Verbose Args

``` --old ['C:\\tools\\hugo\\patchpalooza\\ghidriff\\CVE-2022-21877\\spaceport-10.0.22000.282.sys'] --new [['C:\\tools\\hugo\\patchpalooza\\ghidriff\\CVE-2022-21877\\spaceport-10.0.22000.434.sys']] --engine VersionTrackingDiff --output-path C:\tools\hugo\patchpalooza\ghidriff\CVE-2022-21877\output --summary False --project-location C:\tools\hugo\patchpalooza\ghidriff\CVE-2022-21877\ghidra_projects --project-name CVE-2022-21877 --symbols-path C:\tools\hugo\patchpalooza\ghidriff\CVE-2022-21877\symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim True --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title spaceport.sys 22000.282 vs 22000.434 (CVE-2022-21877, manual pair) ```

#### Download Original PEs ``` wget https://msdl.microsoft.com/download/symbols/spaceport.sys/E508DEAECF000/spaceport.sys -O spaceport.sys.x64.10.0.22000.318 wget https://msdl.microsoft.com/download/symbols/spaceport.sys/36E3B02BCF000/spaceport.sys -O spaceport.sys.x64.10.0.22000.434 ``` ## Binary Metadata Diff ```diff --- spaceport-10.0.22000.282.sys Meta +++ spaceport-10.0.22000.434.sys Meta @@ -1,44 +1,44 @@ -Program Name: spaceport-10.0.22000.282.sys +Program Name: spaceport-10.0.22000.434.sys Language ID: x86:LE:64:default (4.7) Compiler ID: windows Processor: x86 Endian: Little Address Size: 64 Minimum Address: 1c0000000 Maximum Address: ff0000184f # of Bytes: 854096 # of Memory Blocks: 12 -# of Instructions: 136397 -# of Defined Data: 13163 +# of Instructions: 136446 +# of Defined Data: 13162 # of Functions: 2361 -# of Symbols: 18560 +# of Symbols: 18561 # of Data Types: 685 # of Data Type Categories: 20 Analyzed: true Compiler: visualstudio:unknown Created With Ghidra Version: 12.1.2 -Date Created: Tue Jul 28 09:10:15 SGT 2026 +Date Created: Tue Jul 28 09:10:21 SGT 2026 Executable Format: Portable Executable (PE) -Executable Location: /C:/tools/hugo/patchpalooza/ghidriff/CVE-2022-21877/spaceport-10.0.22000.282.sys -Executable MD5: 2dc3647abbad551ee4c9ed41e20f95d8 -Executable SHA256: 88a439853cf89a65e25c0492359914615f343e131d6f6b39cca3ff5ba293d25d -FSRL: file:///C:/tools/hugo/patchpalooza/ghidriff/CVE-2022-21877/spaceport-10.0.22000.282.sys?MD5=2dc3647abbad551ee4c9ed41e20f95d8 +Executable Location: /C:/tools/hugo/patchpalooza/ghidriff/CVE-2022-21877/spaceport-10.0.22000.434.sys +Executable MD5: e2833ad00dbda18b334435107414947c +Executable SHA256: 278db9199bad7dfd87d2360f717d306850fb40055055558ac05f0e8e890f1e0d +FSRL: file:///C:/tools/hugo/patchpalooza/ghidriff/CVE-2022-21877/spaceport-10.0.22000.434.sys?MD5=e2833ad00dbda18b334435107414947c PDB Age: 1 PDB File: spaceport.pdb -PDB GUID: a57b6623-23df-6be0-3e8f-df76c5f78465 +PDB GUID: 60199299-3049-1d86-c0cd-44dd1d6b7d76 PDB Loaded: true PDB Version: RSDS PE Property[CompanyName]: Microsoft Corporation PE Property[FileDescription]: Storage Spaces Driver -PE Property[FileVersion]: 10.0.22000.318 (WinBuild.160101.0800) +PE Property[FileVersion]: 10.0.22000.434 (WinBuild.160101.0800) PE Property[InternalName]: spaceport.sys PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved. PE Property[OriginalFilename]: spaceport.sys PE Property[ProductName]: Microsoft® Windows® Operating System -PE Property[ProductVersion]: 10.0.22000.318 +PE Property[ProductVersion]: 10.0.22000.434 PE Property[Translation]: 4b00000 Preferred Root Namespace Category: RTTI Found: false Relocatable: true SectionAlignment: 4096 Should Ask To Analyze: false ``` ## Program Options

Ghidra spaceport-10.0.22000.282.sys Decompiler Options

Ghidra spaceport-10.0.22000.282.sys Specification extensions Options

|Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|

Ghidra spaceport-10.0.22000.282.sys Analyzers Options

|Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.msdApplyOptions|{ interpretation: FUNCTION_IF_EXISTS, applyCallingConvention: true, applySignature: true, demangleOnlyKnownPatterns: true, doDisassembly: true }| |Demangler Microsoft.msdOutputOptions|ghidra.app.util.demangler.microsoft.options.MsdOutputOption@9e5b| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|

Ghidra spaceport-10.0.22000.434.sys Decompiler Options

Ghidra spaceport-10.0.22000.434.sys Specification extensions Options

|Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|

Ghidra spaceport-10.0.22000.434.sys Analyzers Options

## Diff Stats |Stat|Value| | :---: | :---: | |added_funcs_len|0| |deleted_funcs_len|0| |modified_funcs_len|4| |added_symbols_len|2| |deleted_symbols_len|2| |diff_time|17.693913459777832| |deleted_strings_len|0| |added_strings_len|0| |match_types|Counter({'SymbolsHash': 2267, 'ExternalsName': 237, 'ExactBytesFunctionHasher': 81, 'ExactInstructionsFunctionHasher': 7, 'BSIM': 4})| |items_to_process|8| |diff_types|Counter({'code': 3, 'length': 3, 'address': 3, 'called': 3, 'refcount': 1, 'calling': 1})| |unmatched_funcs_len|0| |total_funcs_len|4722| |matched_funcs_len|4722| |matched_funcs_with_code_changes_len|3| |matched_funcs_with_non_code_changes_len|1| |matched_funcs_no_changes_len|4718| |match_func_similarity_percent|99.9153%| |func_match_overall_percent|100.0000%| |first_matches|Counter({'SymbolsHash': 2267, 'ExactBytesFunctionHasher': 81, 'ExactInstructionsFunctionHasher': 7, 'BSIM': 4})| ```mermaid pie showData title All Matches "SymbolsHash" : 2267 "ExternalsName" : 237 "ExactBytesFunctionHasher" : 81 "ExactInstructionsFunctionHasher" : 7 "BSIM" : 4 ``` ```mermaid pie showData title First Matches "SymbolsHash" : 2267 "ExactBytesFunctionHasher" : 81 "ExactInstructionsFunctionHasher" : 7 "BSIM" : 4 ``` ```mermaid pie showData title Diff Stats "added_funcs_len" : 0 "deleted_funcs_len" : 0 "modified_funcs_len" : 4 ``` ```mermaid pie showData title Symbols "added_symbols_len" : 2 "deleted_symbols_len" : 2 ``` ## Strings *No string differences found* # Deleted # Added # Modified *Modified functions contain code changes* ## SP_POOL::SetSpaceInfoTransaction ### Match Info |Key|spaceport-10.0.22000.282.sys - spaceport-10.0.22000.434.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.3| |i_ratio|0.63| |m_ratio|0.94| |b_ratio|0.75| |match_types|SymbolsHash| ### Function Meta Diff |Key|spaceport-10.0.22000.282.sys|spaceport-10.0.22000.434.sys| | :---: | :---: | :---: | |name|SetSpaceInfoTransaction|SetSpaceInfoTransaction| |fullname|SP_POOL::SetSpaceInfoTransaction|SP_POOL::SetSpaceInfoTransaction| |refcount|2|2| |`length`|798|890| |`called`|

Expand for full list:
SDB_POOL_CONFIG::FindSpaceById
SDB_POOL_CONFIG::ResizeSpaceTransaction
SDB_POOL_CONFIG::SetCopiesTransaction
SDB_POOL_CONFIG::SetSpaceReserveTransaction
SDB_RECORD::PreTouch
SDB_RECORD::Touch
SDB_SPACE::NumberOfTiers
SpIdsCopyHelper
SpIsClusterThinProvisioningEnabled
SpSdCopyHelper
SpStringCchCopyHelper

_tlgKeywordOn
_tlgWriteTemplate::Write<_tlgWrapperByVal<8>,_tlgWrapperByRef<16>,_tlgWrapperByVal<4>,_tlgWrapperByVal<8>,_tlgWrapperByVal<8>,_tlgWrapperByVal<4>_>

Expand for full list:
RtlULongAdd
SDB_POOL_CONFIG::FindSpaceById
SDB_POOL_CONFIG::ResizeSpaceTransaction
SDB_POOL_CONFIG::SetCopiesTransaction
SDB_POOL_CONFIG::SetSpaceReserveTransaction
SDB_RECORD::PreTouch
SDB_RECORD::Touch
SDB_SPACE::NumberOfTiers
SpIdsCopyHelper
SpIsClusterThinProvisioningEnabled
SpSdCopyHelper

SpStringCchCopyHelper
_tlgKeywordOn
_tlgWriteTemplate::Write<_tlgWrapperByVal<8>,_tlgWrapperByRef<16>,_tlgWrapperByVal<4>,_tlgWrapperByVal<8>,_tlgWrapperByVal<8>,_tlgWrapperByVal<4>_>

| |calling|SP_POOL::DispatchTransaction|SP_POOL::DispatchTransaction| |paramcount|3|3| |`address`|1c009af5c|1c009af7c| |sig|long __thiscall SetSpaceInfoTransaction(SP_POOL * this, SDB_RECORD * param_1, _SP_SPACE_INFO * param_2)|long __thiscall SetSpaceInfoTransaction(SP_POOL * this, SDB_RECORD * param_1, _SP_SPACE_INFO * param_2)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### SP_POOL::SetSpaceInfoTransaction Called Diff ```diff --- SP_POOL::SetSpaceInfoTransaction called +++ SP_POOL::SetSpaceInfoTransaction called @@ -0,0 +1 @@ +RtlULongAdd ``` ### SP_POOL::SetSpaceInfoTransaction Diff ```diff --- SP_POOL::SetSpaceInfoTransaction +++ SP_POOL::SetSpaceInfoTransaction @@ -1,133 +1,154 @@ /* public: long __cdecl SP_POOL::SetSpaceInfoTransaction(class SDB_RECORD * __ptr64,struct _SP_SPACE_INFO * __ptr64) __ptr64 */ long __thiscall SP_POOL::SetSpaceInfoTransaction(SP_POOL *this,SDB_RECORD *param_1,_SP_SPACE_INFO *param_2) { SDB_SPACE *this_00; - SDB_SPACE *pSVar1; + ulonglong uVar1; uchar uVar2; long lVar3; - ulong uVar4; - undefined8 uVar5; - longlong lVar6; + uint uVar4; + ulong uVar5; + undefined8 uVar6; SDB_RECORD *pSVar7; - _tlgProvider_t *p_Var8; - int iVar9; - SDB_SPACE *pSVar10; - _GUID *p_Var11; - long local_res20 [2]; + ulonglong uVar8; + _tlgProvider_t *p_Var9; + int iVar10; + SDB_SPACE *pSVar11; + _GUID *p_Var12; + uint local_res20 [2]; undefined8 local_68; - SDB_SPACE *local_60; + undefined8 local_60; undefined8 local_58; - undefined8 local_50; + SDB_SPACE *local_50; undefined8 local_48 [2]; - iVar9 = 0; + iVar10 = 0; + local_res20[0] = 0; pSVar7 = (SDB_RECORD *)0x0; lVar3 = SDB_RECORD::PreTouch(param_1,(SDB_OBJECT *)0x0); if (lVar3 < 0) { return lVar3; } this_00 = *(SDB_SPACE **)(param_1 + 0x28); SDB_RECORD::Touch(param_1); local_68 = *(undefined8 *)(this_00 + 0x48); if ((this_00[0x42] == (SDB_SPACE)0x2) || (this_00[0x42] == (SDB_SPACE)0x9)) { lVar3 = SpStringCchCopyHelper((ushort *)(param_2 + 0x28),0x100,(ushort **)(this_00 + 0x30)); if (lVar3 < 0) { return lVar3; } lVar3 = SpStringCchCopyHelper((ushort *)(param_2 + 0x228),0x400,(ushort **)(this_00 + 0x38)); if (lVar3 < 0) { return lVar3; } - lVar3 = SpSdCopyHelper(param_2 + *(uint *)(param_2 + 0xa84),*(ulong *)(param_2 + 0xa80), - (void **)(this_00 + 0xa0),(ushort *)(this_00 + 0x120)); - if (lVar3 < 0) { - return lVar3; + uVar5 = *(ulong *)(param_2 + 0xa80); + uVar8 = (ulonglong)*(uint *)(param_2 + 0xa84); + uVar4 = RtlULongAdd(*(uint *)(param_2 + 0xa84),uVar5,local_res20); + if ((int)uVar4 < 0) { + return uVar4; } - *(undefined4 *)(this_00 + 0xb4) = *(undefined4 *)(param_2 + 0xaa8); - *(undefined4 *)(this_00 + 0xb8) = *(undefined4 *)(param_2 + 0xaac); - *(undefined8 *)(this_00 + 200) = *(undefined8 *)(param_2 + 0xb30); - *(undefined8 *)(this_00 + 0xd0) = *(undefined8 *)(param_2 + 0xb38); - if ((param_2[0xae8] == (_SP_SPACE_INFO)0x0) && - (*(int *)(this_00 + 0x58) != *(int *)(param_2 + 0xa88))) { - if ((*(int *)(param_2 + 0xa88) != 1) || - ((((byte)this_00[0x128] & 2) != 0 && - (uVar2 = SpIsClusterThinProvisioningEnabled(), uVar2 == '\0')))) goto LAB_0; - *(undefined4 *)(this_00 + 0x58) = *(undefined4 *)(param_2 + 0xa88); - } - pSVar10 = this_00 + 0xc0; - lVar3 = SpIdsCopyHelper((_GUID *)(param_2 + *(uint *)(param_2 + 0xab0)), - *(ulong *)(param_2 + 0xaac),(_GUID **)pSVar10); - if (lVar3 < 0) { - return lVar3; - } - p_Var11 = (_GUID *)(ulonglong)*(uint *)(param_2 + 0xac4); - if (*(uint *)(this_00 + 0x80) < *(uint *)(param_2 + 0xac4)) { - if (((this_00[0x42] == (SDB_SPACE)0x9) || (*(int *)(this_00 + 0x78) != 2)) || - (uVar4 = SDB_SPACE::NumberOfTiers(this_00), uVar4 != 0)) goto LAB_0; - pSVar10 = (SDB_SPACE *)0x0; - lVar3 = SDB_POOL_CONFIG::SetCopiesTransaction - (*(SDB_POOL_CONFIG **)(this + 0x30),param_1,(SDB_RECORD *)0x0,(ulong)p_Var11 - ); + if (local_res20[0] <= *(uint *)(param_2 + 4)) { + lVar3 = SpSdCopyHelper(param_2 + uVar8,uVar5,(void **)(this_00 + 0xa0), + (ushort *)(this_00 + 0x120)); if (lVar3 < 0) { return lVar3; } - } - local_60 = *(SDB_SPACE **)(this_00 + 0x48); - pSVar1 = *(SDB_SPACE **)(param_2 + 0xa68); - if (pSVar1 != local_60) { - uVar4 = SDB_SPACE::NumberOfTiers(this_00); - if (uVar4 != 0) goto LAB_0; - *(SDB_SPACE **)(this_00 + 0x138) = pSVar1; - lVar3 = SDB_POOL_CONFIG::ResizeSpaceTransaction(*(SDB_POOL_CONFIG **)(this + 0x30),this_00); - if ((this_00[0x42] == (SDB_SPACE)0x9) && (5 < DAT_1)) { - p_Var8 = (_tlgProvider_t *)&DAT_1; - uVar5 = _tlgKeywordOn(0x1c0062058,0x400000000000); - if ((char)uVar5 != '\0') { - local_58 = *(undefined8 *)(param_2 + 0xa68); - local_50 = local_68; - local_68 = CONCAT44(local_68._4_4_,(uint)(pSVar1 <= local_60)); - local_60 = this_00 + 0x20; - local_48[0] = 0x1000000; - local_res20[0] = lVar3; - _tlgWriteTemplate - :: - Write<_tlgWrapperByVal<8>,_tlgWrapperByRef<16>,_tlgWrapperByVal<4>,_tlgWrapperByVal<8>,_tlgWrapperByVal<8>,_tlgWrapperByVal<4>_> - (p_Var8,&DAT_2,(_GUID *)pSVar10,p_Var11,(_tlgWrapperByVal<8> *)local_48, - (_tlgWrapperByRef<16> *)&local_60,(_tlgWrapperByVal<4> *)&local_68, - (_tlgWrapperByVal<8> *)&local_50,(_tlgWrapperByVal<8> *)&local_58, - (_tlgWrapperByVal<4> *)local_res20); + *(undefined4 *)(this_00 + 0xb4) = *(undefined4 *)(param_2 + 0xaa8); + *(undefined4 *)(this_00 + 0xb8) = *(undefined4 *)(param_2 + 0xaac); + *(undefined8 *)(this_00 + 200) = *(undefined8 *)(param_2 + 0xb30); + *(undefined8 *)(this_00 + 0xd0) = *(undefined8 *)(param_2 + 0xb38); + if ((param_2[0xae8] == (_SP_SPACE_INFO)0x0) && + (*(int *)(this_00 + 0x58) != *(int *)(param_2 + 0xa88))) { + if ((*(int *)(param_2 + 0xa88) != 1) || + ((((byte)this_00[0x128] & 2) != 0 && + (uVar2 = SpIsClusterThinProvisioningEnabled(), uVar2 == '\0')))) goto LAB_0; + *(undefined4 *)(this_00 + 0x58) = *(undefined4 *)(param_2 + 0xa88); + } + uVar5 = *(ulong *)(param_2 + 0xaac); + uVar8 = (ulonglong)*(uint *)(param_2 + 0xab0); + uVar4 = RtlULongAdd(*(uint *)(param_2 + 0xab0),uVar5 << 4,local_res20); + if ((int)uVar4 < 0) { + return uVar4; + } + if (local_res20[0] <= *(uint *)(param_2 + 4)) { + pSVar11 = this_00 + 0xc0; + uVar4 = SpIdsCopyHelper((_GUID *)(param_2 + uVar8),uVar5,(_GUID **)pSVar11); + if ((int)uVar4 < 0) { + return uVar4; } - } - if (lVar3 < 0) { - return lVar3; + p_Var12 = (_GUID *)(ulonglong)*(uint *)(param_2 + 0xac4); + if (*(uint *)(this_00 + 0x80) < *(uint *)(param_2 + 0xac4)) { + if (((this_00[0x42] == (SDB_SPACE)0x9) || (*(int *)(this_00 + 0x78) != 2)) || + (uVar5 = SDB_SPACE::NumberOfTiers(this_00), uVar5 != 0)) goto LAB_0; + pSVar11 = (SDB_SPACE *)0x0; + uVar4 = SDB_POOL_CONFIG::SetCopiesTransaction + (*(SDB_POOL_CONFIG **)(this + 0x30),param_1,(SDB_RECORD *)0x0, + (ulong)p_Var12); + if ((int)uVar4 < 0) { + return uVar4; + } + } + uVar8 = *(ulonglong *)(param_2 + 0xa68); + uVar1 = *(ulonglong *)(this_00 + 0x48); + if (uVar8 == uVar1) { +LAB_1: + if ((*(longlong *)(param_2 + 0xb0c) != 0) || (*(longlong *)(param_2 + 0xb14) != 0)) { + pSVar7 = SDB_POOL_CONFIG::FindSpaceById + (*(SDB_POOL_CONFIG **)(this + 0x30),(_GUID *)(param_2 + 0xb0c)); + if (pSVar7 == (SDB_RECORD *)0x0) { + return -0x3fc7ffba; + } + iVar10 = *(int *)(pSVar7 + 0x18); + } + if (iVar10 == *(int *)(this_00 + 0xb0)) { + return uVar4; + } + lVar3 = SDB_POOL_CONFIG::SetSpaceReserveTransaction + (*(SDB_POOL_CONFIG **)(this + 0x30),param_1,pSVar7); + return lVar3; + } + uVar5 = SDB_SPACE::NumberOfTiers(this_00); + if (uVar5 == 0) { + *(ulonglong *)(this_00 + 0x138) = uVar8; + uVar4 = SDB_POOL_CONFIG::ResizeSpaceTransaction + (*(SDB_POOL_CONFIG **)(this + 0x30),this_00); + if ((this_00[0x42] == (SDB_SPACE)0x9) && (5 < DAT_2)) { + p_Var9 = (_tlgProvider_t *)&DAT_2; + uVar6 = _tlgKeywordOn(0x1c0062058,0x400000000000); + if ((char)uVar6 != '\0') { + local_60 = *(undefined8 *)(param_2 + 0xa68); + local_58 = local_68; + local_68 = CONCAT44(local_68._4_4_,(uint)(uVar8 <= uVar1)); + local_50 = this_00 + 0x20; + local_48[0] = 0x1000000; + local_res20[0] = uVar4; + _tlgWriteTemplate + :: + Write<_tlgWrapperByVal<8>,_tlgWrapperByRef<16>,_tlgWrapperByVal<4>,_tlgWrapperByVal<8>,_tlgWrapperByVal<8>,_tlgWrapperByVal<4>_> + (p_Var9,&DAT_3,(_GUID *)pSVar11,p_Var12, + (_tlgWrapperByVal<8> *)local_48,(_tlgWrapperByRef<16> *)&local_50, + (_tlgWrapperByVal<4> *)&local_68,(_tlgWrapperByVal<8> *)&local_58, + (_tlgWrapperByVal<8> *)&local_60,(_tlgWrapperByVal<4> *)local_res20); + } + } + if ((int)uVar4 < 0) { + return uVar4; + } + goto LAB_1; + } + goto LAB_0; } } - lVar6 = *(longlong *)(param_2 + 0xb0c); - if (lVar6 == 0) { - lVar6 = *(longlong *)(param_2 + 0xb14); - } - if (lVar6 != 0) { - pSVar7 = SDB_POOL_CONFIG::FindSpaceById - (*(SDB_POOL_CONFIG **)(this + 0x30),(_GUID *)(param_2 + 0xb0c)); - if (pSVar7 == (SDB_RECORD *)0x0) { - return -0x3fc7ffba; - } - iVar9 = *(int *)(pSVar7 + 0x18); - } - if (iVar9 != *(int *)(this_00 + 0xb0)) { - lVar3 = SDB_POOL_CONFIG::SetSpaceReserveTransaction - (*(SDB_POOL_CONFIG **)(this + 0x30),param_1,pSVar7); - } + lVar3 = -0x3ffffff3; } else { LAB_0: lVar3 = -0x3fffff45; } return lVar3; } ``` ## SP_POOL::SetTierInfoTransaction ### Match Info |Key|spaceport-10.0.22000.282.sys - spaceport-10.0.22000.434.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.27| |i_ratio|0.7| |m_ratio|0.95| |b_ratio|0.93| |match_types|SymbolsHash| ### Function Meta Diff |Key|spaceport-10.0.22000.282.sys|spaceport-10.0.22000.434.sys| | :---: | :---: | :---: | |name|SetTierInfoTransaction|SetTierInfoTransaction| |fullname|SP_POOL::SetTierInfoTransaction|SP_POOL::SetTierInfoTransaction| |refcount|2|2| |`length`|548|598| |`called`|SDB_POOL_CONFIG::ExtendTierTransaction
SDB_POOL_CONFIG::SetCopiesTransaction
SDB_RECORD::GetObject
SDB_RECORD::PreTouch
SDB_RECORD::Touch
SpIdsCopyHelper
SpIsClusterThinProvisioningEnabled
SpStringCchCopyHelper|RtlULongAdd
SDB_POOL_CONFIG::ExtendTierTransaction
SDB_POOL_CONFIG::SetCopiesTransaction
SDB_RECORD::GetObject
SDB_RECORD::PreTouch
SDB_RECORD::Touch
SpIdsCopyHelper
SpIsClusterThinProvisioningEnabled
SpStringCchCopyHelper| |calling|SP_POOL::DispatchTransaction|SP_POOL::DispatchTransaction| |paramcount|3|3| |`address`|1c009b284|1c009b300| |sig|long __thiscall SetTierInfoTransaction(SP_POOL * this, SDB_RECORD * param_1, _SP_TIER_INFO * param_2)|long __thiscall SetTierInfoTransaction(SP_POOL * this, SDB_RECORD * param_1, _SP_TIER_INFO * param_2)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### SP_POOL::SetTierInfoTransaction Called Diff ```diff --- SP_POOL::SetTierInfoTransaction called +++ SP_POOL::SetTierInfoTransaction called @@ -0,0 +1 @@ +RtlULongAdd ``` ### SP_POOL::SetTierInfoTransaction Diff ```diff --- SP_POOL::SetTierInfoTransaction +++ SP_POOL::SetTierInfoTransaction @@ -1,98 +1,113 @@ /* public: long __cdecl SP_POOL::SetTierInfoTransaction(class SDB_RECORD * __ptr64,struct _SP_TIER_INFO * __ptr64) __ptr64 */ long __thiscall SP_POOL::SetTierInfoTransaction(SP_POOL *this,SDB_RECORD *param_1,_SP_TIER_INFO *param_2) { SDB_TIER *pSVar1; undefined8 uVar2; uchar uVar3; long lVar4; - int iVar5; - SDB_OBJECT *pSVar6; + uint uVar5; + int iVar6; + SDB_OBJECT *pSVar7; + ulonglong uVar8; SDB_RECORD *this_00; + ulong uVar9; + uint local_res20 [2]; + local_res20[0] = 0; lVar4 = SDB_RECORD::PreTouch(param_1,(SDB_OBJECT *)0x0); if (lVar4 < 0) { return lVar4; } pSVar1 = *(SDB_TIER **)(param_1 + 0x28); SDB_RECORD::Touch(param_1); - if ((*(longlong *)(pSVar1 + 0xc0) == 0) || (*(int *)(pSVar1 + 0x44) == 1)) { - lVar4 = SpStringCchCopyHelper((ushort *)(param_2 + 0x38),0x100,(ushort **)(pSVar1 + 0x30)); + if ((*(longlong *)(pSVar1 + 0xc0) != 0) && (*(int *)(pSVar1 + 0x44) != 1)) { + return -0x3fffff45; + } + lVar4 = SpStringCchCopyHelper((ushort *)(param_2 + 0x38),0x100,(ushort **)(pSVar1 + 0x30)); + if (lVar4 < 0) { + return lVar4; + } + lVar4 = SpStringCchCopyHelper((ushort *)(param_2 + 0x238),0x400,(ushort **)(pSVar1 + 0x38)); + if (lVar4 < 0) { + return lVar4; + } + *(undefined4 *)(pSVar1 + 0x8c) = *(undefined4 *)(param_2 + 0xa78); + *(undefined4 *)(pSVar1 + 0x90) = *(undefined4 *)(param_2 + 0xa7c); + if ((((*(int *)(pSVar1 + 0x48) != *(int *)(param_2 + 0xa58)) && (((byte)this[0x50] & 2) != 0)) && + (*(int *)(param_2 + 0xa58) == 1)) && + (uVar3 = SpIsClusterThinProvisioningEnabled(), uVar3 == '\0')) { + return -0x3fffff45; + } + uVar9 = *(ulong *)(param_2 + 0xa7c); + uVar8 = (ulonglong)*(uint *)(param_2 + 0xa80); + uVar5 = RtlULongAdd(*(uint *)(param_2 + 0xa80),uVar9 << 4,local_res20); + if ((int)uVar5 < 0) { + return uVar5; + } + if (*(uint *)(param_2 + 4) < local_res20[0]) { +LAB_0: + lVar4 = -0x3ffffff3; + } + else { + lVar4 = SpIdsCopyHelper((_GUID *)(param_2 + uVar8),uVar9,(_GUID **)(pSVar1 + 0x98)); if (lVar4 < 0) { return lVar4; } - lVar4 = SpStringCchCopyHelper((ushort *)(param_2 + 0x238),0x400,(ushort **)(pSVar1 + 0x38)); - if (lVar4 < 0) { + this_00 = *(SDB_RECORD **)(pSVar1 + 0xc0); + if (this_00 == (SDB_RECORD *)0x0) { + *(undefined4 *)(pSVar1 + 0x44) = *(undefined4 *)(param_2 + 0xa38); + uVar2 = *(undefined8 *)(param_2 + 0xa60); + *(undefined8 *)(pSVar1 + 0x48) = *(undefined8 *)(param_2 + 0xa58); + *(undefined8 *)(pSVar1 + 0x50) = uVar2; + uVar2 = *(undefined8 *)(param_2 + 0xa70); + *(undefined8 *)(pSVar1 + 0x58) = *(undefined8 *)(param_2 + 0xa68); + *(undefined8 *)(pSVar1 + 0x60) = uVar2; + uVar2 = *(undefined8 *)(param_2 + 0xa8c); + *(undefined8 *)(pSVar1 + 0x68) = *(undefined8 *)(param_2 + 0xa84); + *(undefined8 *)(pSVar1 + 0x70) = uVar2; + *(undefined8 *)(pSVar1 + 0x78) = *(undefined8 *)(param_2 + 0xa94); return lVar4; } - *(undefined4 *)(pSVar1 + 0x8c) = *(undefined4 *)(param_2 + 0xa78); - *(undefined4 *)(pSVar1 + 0x90) = *(undefined4 *)(param_2 + 0xa7c); - if ((((*(int *)(pSVar1 + 0x48) == *(int *)(param_2 + 0xa58)) || (((byte)this[0x50] & 2) == 0)) - || (*(int *)(param_2 + 0xa58) != 1)) || - (uVar3 = SpIsClusterThinProvisioningEnabled(), uVar3 != '\0')) { - lVar4 = SpIdsCopyHelper((_GUID *)(param_2 + *(uint *)(param_2 + 0xa80)), - *(ulong *)(param_2 + 0xa7c),(_GUID **)(pSVar1 + 0x98)); + iVar6 = *(int *)(param_2 + 0xa58); + if (*(int *)(pSVar1 + 0x48) != iVar6) { + if (iVar6 != 1) { + return -0x3fffff45; + } + *(undefined4 *)(pSVar1 + 0x48) = 1; + iVar6 = *(int *)(param_2 + 0xa58); + } + if ((iVar6 == 1) && (pSVar7 = SDB_RECORD::GetObject(this_00), *(int *)(pSVar7 + 0x58) != 1)) { + lVar4 = SDB_RECORD::PreTouch(this_00,(SDB_OBJECT *)0x0); if (lVar4 < 0) { return lVar4; } - this_00 = *(SDB_RECORD **)(pSVar1 + 0xc0); - if (this_00 == (SDB_RECORD *)0x0) { - *(undefined4 *)(pSVar1 + 0x44) = *(undefined4 *)(param_2 + 0xa38); - uVar2 = *(undefined8 *)(param_2 + 0xa60); - *(undefined8 *)(pSVar1 + 0x48) = *(undefined8 *)(param_2 + 0xa58); - *(undefined8 *)(pSVar1 + 0x50) = uVar2; - uVar2 = *(undefined8 *)(param_2 + 0xa70); - *(undefined8 *)(pSVar1 + 0x58) = *(undefined8 *)(param_2 + 0xa68); - *(undefined8 *)(pSVar1 + 0x60) = uVar2; - uVar2 = *(undefined8 *)(param_2 + 0xa8c); - *(undefined8 *)(pSVar1 + 0x68) = *(undefined8 *)(param_2 + 0xa84); - *(undefined8 *)(pSVar1 + 0x70) = uVar2; - *(undefined8 *)(pSVar1 + 0x78) = *(undefined8 *)(param_2 + 0xa94); + pSVar7 = SDB_RECORD::GetObject(*(SDB_RECORD **)(pSVar1 + 0xc0)); + if ((((byte)pSVar7[0x128] & 2) != 0) && + (uVar3 = SpIsClusterThinProvisioningEnabled(), uVar3 == '\0')) { + return -0x3fffff45; + } + *(undefined4 *)(pSVar7 + 0x58) = 1; + SDB_RECORD::Touch(*(SDB_RECORD **)(pSVar1 + 0xc0)); + } + if (*(uint *)(pSVar1 + 0x70) < *(uint *)(param_2 + 0xa8c)) { + if (*(int *)(pSVar1 + 0x68) != 2) goto LAB_0; + lVar4 = SDB_POOL_CONFIG::SetCopiesTransaction + (*(SDB_POOL_CONFIG **)(this + 0x30),*(SDB_RECORD **)(pSVar1 + 0xc0),param_1, + *(uint *)(param_2 + 0xa8c)); + if (lVar4 < 0) { return lVar4; } - iVar5 = *(int *)(param_2 + 0xa58); - if (*(int *)(pSVar1 + 0x48) != iVar5) { - if (iVar5 != 1) { - return -0x3fffff45; - } - *(undefined4 *)(pSVar1 + 0x48) = 1; - iVar5 = *(int *)(param_2 + 0xa58); - } - if ((iVar5 == 1) && (pSVar6 = SDB_RECORD::GetObject(this_00), *(int *)(pSVar6 + 0x58) != 1)) { - lVar4 = SDB_RECORD::PreTouch(this_00,(SDB_OBJECT *)0x0); - if (lVar4 < 0) { - return lVar4; - } - pSVar6 = SDB_RECORD::GetObject(*(SDB_RECORD **)(pSVar1 + 0xc0)); - if ((((byte)pSVar6[0x128] & 2) != 0) && - (uVar3 = SpIsClusterThinProvisioningEnabled(), uVar3 == '\0')) { - return -0x3fffff45; - } - *(undefined4 *)(pSVar6 + 0x58) = 1; - SDB_RECORD::Touch(*(SDB_RECORD **)(pSVar1 + 0xc0)); - } - if (*(uint *)(pSVar1 + 0x70) < *(uint *)(param_2 + 0xa8c)) { - if (*(int *)(pSVar1 + 0x68) != 2) { - return -0x3ffffff3; - } - lVar4 = SDB_POOL_CONFIG::SetCopiesTransaction - (*(SDB_POOL_CONFIG **)(this + 0x30),*(SDB_RECORD **)(pSVar1 + 0xc0), - param_1,*(uint *)(param_2 + 0xa8c)); - if (lVar4 < 0) { - return lVar4; - } - } - if (*(longlong *)(param_2 + 0xa40) != *(longlong *)(pSVar1 + 200)) { - *(longlong *)(pSVar1 + 0xd0) = *(longlong *)(param_2 + 0xa40); - lVar4 = SDB_POOL_CONFIG::ExtendTierTransaction(*(SDB_POOL_CONFIG **)(this + 0x30),pSVar1); - } - return lVar4; + } + if (*(longlong *)(param_2 + 0xa40) != *(longlong *)(pSVar1 + 200)) { + *(longlong *)(pSVar1 + 0xd0) = *(longlong *)(param_2 + 0xa40); + lVar4 = SDB_POOL_CONFIG::ExtendTierTransaction(*(SDB_POOL_CONFIG **)(this + 0x30),pSVar1); } } - return -0x3fffff45; + return lVar4; } ``` ## SpIoctlCreateTier ### Match Info |Key|spaceport-10.0.22000.282.sys - spaceport-10.0.22000.434.sys| | :---: | :---: | |diff_type|code,length,called| |ratio|0.43| |i_ratio|0.7| |m_ratio|0.98| |b_ratio|0.54| |match_types|SymbolsHash| ### Function Meta Diff |Key|spaceport-10.0.22000.282.sys|spaceport-10.0.22000.434.sys| | :---: | :---: | :---: | |name|SpIoctlCreateTier|SpIoctlCreateTier| |fullname|SpIoctlCreateTier|SpIoctlCreateTier| |refcount|2|2| |`length`|953|989| |`called`|

Expand for full list:
SDB_OBJECT::SDB_OBJECT
SDB_POOL_CONFIG::FindSpaceById
SDB_TIER::Initialize
SDB_TIER::`vector_deleting_destructor'
SDB_TIER::operator_new
SP_POOL::ExecuteTransactionInternal
SpAccessCheckPool
SpAcquireResourceExclusive
SpFindPoolById
SpIdsCopyHelper
SpIsClusterThinProvisioningEnabled

SpNotify
SpReleaseResourceExclusive
SpStringCchCopyHelper
WPP_SF_
WPP_SF_sd
_guard_dispatch_icall

Expand for full list:
RtlULongAdd
SDB_OBJECT::SDB_OBJECT
SDB_POOL_CONFIG::FindSpaceById
SDB_TIER::Initialize
SDB_TIER::`vector_deleting_destructor'
SDB_TIER::operator_new
SP_POOL::ExecuteTransactionInternal
SpAccessCheckPool
SpAcquireResourceExclusive
SpFindPoolById
SpIdsCopyHelper

SpIsClusterThinProvisioningEnabled
SpNotify
SpReleaseResourceExclusive
SpStringCchCopyHelper
WPP_SF_
WPP_SF_sd
_guard_dispatch_icall

| |calling|SpControlDeviceControl|SpControlDeviceControl| |paramcount|1|1| |address|1c008dac8|1c008dac8| |sig|long __cdecl SpIoctlCreateTier(_IRP * param_1)|long __cdecl SpIoctlCreateTier(_IRP * param_1)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### SpIoctlCreateTier Called Diff ```diff --- SpIoctlCreateTier called +++ SpIoctlCreateTier called @@ -0,0 +1 @@ +RtlULongAdd ``` ### SpIoctlCreateTier Diff ```diff --- SpIoctlCreateTier +++ SpIoctlCreateTier @@ -1,175 +1,180 @@ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ /* long __cdecl SpIoctlCreateTier(struct _IRP * __ptr64) */ long __cdecl SpIoctlCreateTier(_IRP *param_1) { _GUID *p_Var1; longlong lVar2; - undefined8 uVar3; + longlong lVar3; uchar uVar4; - long lVar5; + uint uVar5; SP_POOL *this; SDB_RECORD *pSVar6; SDB_OBJECT *this_00; - longlong lVar7; SDB_POOL_CONFIG *this_01; + ulonglong uVar7; undefined8 *puVar8; undefined8 *puVar9; - undefined4 uVar10; - char *pcVar11; - undefined8 local_48; - undefined8 uStack_40; - undefined4 local_38; - undefined4 uStack_34; - undefined4 uStack_30; - undefined4 uStack_2c; - undefined8 local_28; - undefined8 uStack_20; + ulong uVar10; + undefined8 uVar11; + char *pcVar12; + uint local_res8 [2]; + undefined8 local_58; + undefined8 uStack_50; + undefined4 local_48; + undefined4 uStack_44; + undefined4 uStack_40; + undefined4 uStack_3c; + undefined8 local_38; + undefined8 uStack_30; - lVar7 = *(longlong *)(param_1 + 0xb8); + lVar2 = *(longlong *)(param_1 + 0xb8); pSVar6 = (SDB_RECORD *)0x0; + local_res8[0] = 0; if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) != 0)) && (2 < (byte)WPP_GLOBAL_Control[0x29])) { WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x88, - &WPP_2d31940eaab1331a1bc13f739087b1c1_Traceguids); + &WPP_a4c69f6e983c3b684821e92c348a649f_Traceguids); } SpAcquireResourceExclusive((_ERESOURCE *)(SpControlExt + 0x60)); - if (*(uint *)(lVar7 + 0x10) < 0xab0) { - lVar5 = -0x3ffffffc; + if (*(uint *)(lVar2 + 0x10) < 0xab0) { + uVar5 = 0xc0000004; } else { - lVar2 = *(longlong *)(param_1 + 0x18); - if (*(uint *)(lVar7 + 0x10) == *(uint *)(lVar2 + 4)) { - this = SpFindPoolById((_GUID *)(lVar2 + 8)); + lVar3 = *(longlong *)(param_1 + 0x18); + if (*(uint *)(lVar2 + 0x10) == *(uint *)(lVar3 + 4)) { + this = SpFindPoolById((_GUID *)(lVar3 + 8)); if (this == (SP_POOL *)0x0) { - lVar5 = -0x3fc7ffd0; + uVar5 = 0xc0380030; } else { this_01 = (SDB_POOL_CONFIG *)this; - lVar5 = SpAccessCheckPool(this,param_1); - if (-1 < lVar5) { - p_Var1 = (_GUID *)(lVar2 + 0x28); - lVar7 = *(longlong *)p_Var1; - if (lVar7 == 0) { - lVar7 = *(longlong *)(lVar2 + 0x30); - } - if (lVar7 != 0) { + uVar5 = SpAccessCheckPool(this,param_1); + if (-1 < (int)uVar5) { + p_Var1 = (_GUID *)(lVar3 + 0x28); + if ((*(longlong *)p_Var1 != 0) || (*(longlong *)(lVar3 + 0x30) != 0)) { this_01 = *(SDB_POOL_CONFIG **)(this + 0x30); pSVar6 = SDB_POOL_CONFIG::FindSpaceById(this_01,p_Var1); if (pSVar6 == (SDB_RECORD *)0x0) { - lVar5 = -0x3fc7ffba; + uVar5 = 0xc0380046; goto LAB_0; } } if (this[0x41] == (SP_POOL)0x0) { - lVar5 = -0x3fc7ffb0; + uVar5 = 0xc0380050; } - else if (((((byte)this[0x50] & 2) == 0) || (*(int *)(lVar2 + 0xa58) != 1)) || + else if (((((byte)this[0x50] & 2) == 0) || (*(int *)(lVar3 + 0xa58) != 1)) || (uVar4 = SpIsClusterThinProvisioningEnabled(), uVar4 != '\0')) { this_00 = SDB_TIER::operator_new((__uint64)this_01); if (this_00 == (SDB_OBJECT *)0x0) { - lVar5 = -0x3fffff66; + uVar5 = 0xc000009a; } else { SDB_OBJECT::SDB_OBJECT(this_00); *(undefined ***)this_00 = &SDB_TIER::_vftable_; SDB_TIER::Initialize((SDB_TIER *)this_00); - uVar3 = *(undefined8 *)(lVar2 + 0x20); - *(undefined8 *)(this_00 + 0x20) = *(undefined8 *)(lVar2 + 0x18); - *(undefined8 *)(this_00 + 0x28) = uVar3; - lVar5 = SpStringCchCopyHelper - ((ushort *)(lVar2 + 0x38),0x100,(ushort **)(this_00 + 0x30)); - if ((-1 < lVar5) && - (lVar5 = SpStringCchCopyHelper - ((ushort *)(lVar2 + 0x238),0x400,(ushort **)(this_00 + 0x38)), - -1 < lVar5)) { - *(undefined4 *)(this_00 + 0x44) = *(undefined4 *)(lVar2 + 0xa38); - uVar3 = *(undefined8 *)(lVar2 + 0xa60); - *(undefined8 *)(this_00 + 0x48) = *(undefined8 *)(lVar2 + 0xa58); - *(undefined8 *)(this_00 + 0x50) = uVar3; - uVar3 = *(undefined8 *)(lVar2 + 0xa70); - *(undefined8 *)(this_00 + 0x58) = *(undefined8 *)(lVar2 + 0xa68); - *(undefined8 *)(this_00 + 0x60) = uVar3; - uVar3 = *(undefined8 *)(lVar2 + 0xa8c); - *(undefined8 *)(this_00 + 0x68) = *(undefined8 *)(lVar2 + 0xa84); - *(undefined8 *)(this_00 + 0x70) = uVar3; - *(undefined8 *)(this_00 + 0x78) = *(undefined8 *)(lVar2 + 0xa94); - *(undefined4 *)(this_00 + 0x8c) = *(undefined4 *)(lVar2 + 0xa78); - *(undefined4 *)(this_00 + 0x90) = *(undefined4 *)(lVar2 + 0xa7c); - lVar5 = SpIdsCopyHelper((_GUID *)((ulonglong)*(uint *)(lVar2 + 0xa80) + lVar2), - *(ulong *)(lVar2 + 0xa7c),(_GUID **)(this_00 + 0x98)); - if (-1 < lVar5) { - if (pSVar6 != (SDB_RECORD *)0x0) { - *(undefined8 *)(this_00 + 0xd0) = *(undefined8 *)(lVar2 + 0xa40); + uVar11 = *(undefined8 *)(lVar3 + 0x20); + *(undefined8 *)(this_00 + 0x20) = *(undefined8 *)(lVar3 + 0x18); + *(undefined8 *)(this_00 + 0x28) = uVar11; + uVar5 = SpStringCchCopyHelper + ((ushort *)(lVar3 + 0x38),0x100,(ushort **)(this_00 + 0x30)); + if ((-1 < (int)uVar5) && + (uVar5 = SpStringCchCopyHelper + ((ushort *)(lVar3 + 0x238),0x400,(ushort **)(this_00 + 0x38)), + -1 < (int)uVar5)) { + *(undefined4 *)(this_00 + 0x44) = *(undefined4 *)(lVar3 + 0xa38); + uVar11 = *(undefined8 *)(lVar3 + 0xa60); + *(undefined8 *)(this_00 + 0x48) = *(undefined8 *)(lVar3 + 0xa58); + *(undefined8 *)(this_00 + 0x50) = uVar11; + uVar11 = *(undefined8 *)(lVar3 + 0xa70); + *(undefined8 *)(this_00 + 0x58) = *(undefined8 *)(lVar3 + 0xa68); + *(undefined8 *)(this_00 + 0x60) = uVar11; + uVar11 = *(undefined8 *)(lVar3 + 0xa8c); + *(undefined8 *)(this_00 + 0x68) = *(undefined8 *)(lVar3 + 0xa84); + *(undefined8 *)(this_00 + 0x70) = uVar11; + *(undefined8 *)(this_00 + 0x78) = *(undefined8 *)(lVar3 + 0xa94); + *(undefined4 *)(this_00 + 0x8c) = *(undefined4 *)(lVar3 + 0xa78); + *(undefined4 *)(this_00 + 0x90) = *(undefined4 *)(lVar3 + 0xa7c); + uVar10 = *(ulong *)(lVar3 + 0xa7c); + uVar7 = (ulonglong)*(uint *)(lVar3 + 0xa80); + uVar5 = RtlULongAdd(*(uint *)(lVar3 + 0xa80),uVar10 << 4,local_res8); + if (-1 < (int)uVar5) { + if (*(uint *)(lVar3 + 4) < local_res8[0]) { + uVar5 = 0xc000000d; } - lVar5 = SP_POOL::ExecuteTransactionInternal - (this,'\0',0x1c,this_00,pSVar6,(void *)0x0); - if (-1 < lVar5) { - lVar7 = *(longlong *)p_Var1; - if (lVar7 == 0) { - lVar7 = *(longlong *)(lVar2 + 0x30); + else { + uVar5 = SpIdsCopyHelper((_GUID *)(uVar7 + lVar3),uVar10, + (_GUID **)(this_00 + 0x98)); + if (-1 < (int)uVar5) { + if (pSVar6 != (SDB_RECORD *)0x0) { + *(undefined8 *)(this_00 + 0xd0) = *(undefined8 *)(lVar3 + 0xa40); + } + uVar5 = SP_POOL::ExecuteTransactionInternal + (this,'\0',0x1c,this_00,pSVar6,(void *)0x0); + if (-1 < (int)uVar5) { + if ((*(longlong *)p_Var1 == 0) && (*(longlong *)(lVar3 + 0x30) == 0)) { + uVar11 = 1; + puVar9 = &local_58; + puVar8 = &local_38; + local_58 = 0; + uStack_50 = 0; + local_38 = 0x11e02d6ef01f7200; + uStack_30 = 0x669a0c200008fa91; + } + else { + local_38 = *(undefined8 *)p_Var1; + uStack_30 = *(undefined8 *)(lVar3 + 0x30); + uVar11 = 10; + puVar9 = &local_38; + puVar8 = &local_58; + local_58 = 0x49909db6e717c33d; + uStack_50 = 0xc021c8b3c7b477b4; + } + local_48 = *(undefined4 *)(this + 0x6c); + uStack_44 = *(undefined4 *)(this + 0x70); + uStack_40 = *(undefined4 *)(this + 0x74); + uStack_3c = *(undefined4 *)(this + 0x78); + SpNotify(puVar8,&local_48,puVar9,uVar11,0x10,this,0); + } } - local_38 = *(undefined4 *)(this + 0x6c); - uStack_34 = *(undefined4 *)(this + 0x70); - uStack_30 = *(undefined4 *)(this + 0x74); - uStack_2c = *(undefined4 *)(this + 0x78); - if (lVar7 == 0) { - uVar10 = 1; - puVar9 = &local_48; - local_48 = 0; - uStack_40 = 0; - puVar8 = &local_28; - local_28 = 0x11e02d6ef01f7200; - uStack_20 = 0x669a0c200008fa91; - } - else { - local_28 = *(undefined8 *)p_Var1; - uStack_20 = *(undefined8 *)(lVar2 + 0x30); - uVar10 = 10; - puVar9 = &local_28; - puVar8 = &local_48; - local_48 = 0x49909db6e717c33d; - uStack_40 = 0xc021c8b3c7b477b4; - } - SpNotify(puVar8,&local_38,puVar9,uVar10,0x10,this,0); } } } (*(code *)**(undefined8 **)this_00)(this_00,1); } } else { - lVar5 = -0x3fffff45; + uVar5 = 0xc00000bb; } } } } else { - lVar5 = -0x3ffffffc; + uVar5 = 0xc0000004; } } LAB_0: SpReleaseResourceExclusive((_ERESOURCE *)(SpControlExt + 0x60)); - if (((lVar5 < 0) && (lVar5 != -0x7ffffffb)) && (lVar5 != -0x3fffffdd)) { + if ((((int)uVar5 < 0) && (uVar5 != 0x80000005)) && (uVar5 != 0xc0000023)) { if (SP_TL_DEFAULT != 1) { SP_TL_DEFAULT = 1; } - pcVar11 = "Error"; + pcVar12 = "Error"; } else { if (SP_TL_DEFAULT != 3) { SP_TL_DEFAULT = 3; } - pcVar11 = "Exit "; + pcVar12 = "Exit "; } if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) != 0)) && (SP_TL_DEFAULT <= (byte)WPP_GLOBAL_Control[0x29])) { WPP_SF_sd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x89, - &WPP_2d31940eaab1331a1bc13f739087b1c1_Traceguids,pcVar11); + &WPP_a4c69f6e983c3b684821e92c348a649f_Traceguids,pcVar12); } - return lVar5; + return uVar5; } ``` # Modified (No Code Changes) *Slightly modified functions have no code changes, rather differnces in:* - refcount - length - called - calling - name - fullname ## RtlULongAdd ### Match Info |Key|spaceport-10.0.22000.282.sys - spaceport-10.0.22000.434.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|spaceport-10.0.22000.282.sys|spaceport-10.0.22000.434.sys| | :---: | :---: | :---: | |name|RtlULongAdd|RtlULongAdd| |fullname|RtlULongAdd|RtlULongAdd| |`refcount`|5|9| |length|22|22| |called||| |`calling`|PortPassThroughExGetBasicStructureSize
PortPassThroughValidateNormalizedRequest
SP_CONTROL_WORK::Execute|PortPassThroughExGetBasicStructureSize
PortPassThroughValidateNormalizedRequest
SP_CONTROL_WORK::Execute
SP_POOL::SetSpaceInfoTransaction
SP_POOL::SetTierInfoTransaction
SpIoctlCreateTier| |paramcount|3|3| |`address`|1c001db34|1c001d8b8| |sig|uint __fastcall RtlULongAdd(uint param_1, int param_2, uint * param_3)|uint __fastcall RtlULongAdd(uint param_1, int param_2, uint * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### RtlULongAdd Calling Diff ```diff --- RtlULongAdd calling +++ RtlULongAdd calling @@ -3,0 +4,3 @@ +SP_POOL::SetSpaceInfoTransaction +SP_POOL::SetTierInfoTransaction +SpIoctlCreateTier ``` _{Generated with `ghidriff` version: 1.0.0 on 2026-07-28T09:11:17}