# storport.sys KB5074109 vs KB5077181 (CVE-2026-21508) # TOC * [Visual Chart Diff](#visual-chart-diff) * [Metadata](#metadata) * [Ghidra Diff Engine](#ghidra-diff-engine) * [Command Line](#command-line) * [Binary Metadata Diff](#binary-metadata-diff) * [Program Options](#program-options) * [Diff Stats](#diff-stats) * [Strings](#strings) * [Deleted](#deleted) * [Added](#added) * [Feature_Servicing_StorageSetProperty_BufferCheck__private_IsEnabledDeviceUsageNoInline](#feature_servicing_storagesetproperty_buffercheck__private_isenableddeviceusagenoinline) * [Feature_Servicing_StorageSetProperty_BufferCheck__private_IsEnabledFallback](#feature_servicing_storagesetproperty_buffercheck__private_isenabledfallback) * [Feature_FixSteelixUfsIceRegression__private_IsEnabledDeviceUsageNoInline](#feature_fixsteelixufsiceregression__private_isenableddeviceusagenoinline) * [Feature_FixSteelixUfsIceRegression__private_IsEnabledFallback](#feature_fixsteelixufsiceregression__private_isenabledfallback) * [Modified](#modified) * [RaidSetStorageAdapterProtocolSpecificProperty](#raidsetstorageadapterprotocolspecificproperty) * [RaUnitStorageSetDeviceProtocolSpecificPropertyIoctl](#raunitstoragesetdeviceprotocolspecificpropertyioctl) * [RaidAdapterSendCryptoOperationSynchronously](#raidadaptersendcryptooperationsynchronously) * [Modified (No Code Changes)](#modified-no-code-changes) * [wil_details_IsEnabledFallback](#wil_details_isenabledfallback) # Visual Chart Diff ```mermaid flowchart LR RaidSetStorageAdapterProtocolSpecificProperty-0-old<--Match 95%-->RaidSetStorageAdapterProtocolSpecificProperty-0-new RaUnitStorageSetDeviceProtocolSpecificPropertyIoctl-0-old<--Match 93%-->RaUnitStorageSetDeviceProtocolSpecificPropertyIoctl-0-new RaidAdapterSendCryptoOperationSynchronously-0-old<--Match 95%-->RaidAdapterSendCryptoOperationSynchronously-0-new subgraph storport-10.0.26100.7705.sys RaidSetStorageAdapterProtocolSpecificProperty-0-new RaUnitStorageSetDeviceProtocolSpecificPropertyIoctl-0-new RaidAdapterSendCryptoOperationSynchronously-0-new subgraph Added direction LR Feature_Servicing_StorageSetProperty_BufferCheck__private_IsEnabledDeviceUsageNoInline Feature_Servicing_StorageSetProperty_BufferCheck__private_IsEnabledFallback Feature_FixSteelixUfsIceRegression__private_IsEnabledDeviceUsageNoInline Feature_FixSteelixUfsIceRegression__private_IsEnabledFallback end end subgraph storport-10.0.26100.7309.sys RaidSetStorageAdapterProtocolSpecificProperty-0-old RaUnitStorageSetDeviceProtocolSpecificPropertyIoctl-0-old RaidAdapterSendCryptoOperationSynchronously-0-old end ``` ```mermaid pie showData title Function Matches - 99.9417% "unmatched_funcs_len" : 4 "matched_funcs_len" : 6856 ``` ```mermaid pie showData title Matched Function Similarity - 99.9417% "matched_funcs_with_code_changes_len" : 3 "matched_funcs_with_non_code_changes_len" : 1 "matched_funcs_no_changes_len" : 6852 ``` # Metadata ## Ghidra Diff Engine ### Command Line #### Captured Command Line ``` ghidriff --project-location C:\tools\hugo\patchpalooza\ghidriff\CVE-2026-21508\ghidra_projects --project-name CVE-2026-21508 --symbols-path C:\tools\hugo\patchpalooza\ghidriff\CVE-2026-21508\symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --bsim --max-ram-percent 60.0 --max-section-funcs 200 --md-title storport.sys KB5074109 vs KB5077181 (CVE-2026-21508) storport-10.0.26100.7309.sys storport-10.0.26100.7705.sys ``` #### Verbose Args

``` --old ['C:\\tools\\hugo\\patchpalooza\\ghidriff\\CVE-2026-21508\\storport-10.0.26100.7309.sys'] --new [['C:\\tools\\hugo\\patchpalooza\\ghidriff\\CVE-2026-21508\\storport-10.0.26100.7705.sys']] --engine VersionTrackingDiff --output-path C:\tools\hugo\patchpalooza\ghidriff\CVE-2026-21508\output --summary False --project-location C:\tools\hugo\patchpalooza\ghidriff\CVE-2026-21508\ghidra_projects --project-name CVE-2026-21508 --symbols-path C:\tools\hugo\patchpalooza\ghidriff\CVE-2026-21508\symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim True --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title storport.sys KB5074109 vs KB5077181 (CVE-2026-21508) ```

#### Download Original PEs ``` wget https://msdl.microsoft.com/download/symbols/storport.sys/74A1128D26F000/storport.sys -O storport.sys.x64.10.0.26100.7309 wget https://msdl.microsoft.com/download/symbols/storport.sys/7F7C0C9526F000/storport.sys -O storport.sys.x64.10.0.26100.7705 ``` ## Binary Metadata Diff ```diff --- storport-10.0.26100.7309.sys Meta +++ storport-10.0.26100.7705.sys Meta @@ -1,44 +1,44 @@ -Program Name: storport-10.0.26100.7309.sys +Program Name: storport-10.0.26100.7705.sys Language ID: x86:LE:64:default (4.7) Compiler ID: windows Processor: x86 Endian: Little Address Size: 64 Minimum Address: 140000000 Maximum Address: ff0000184f -# of Bytes: 2556056 +# of Bytes: 2556120 # of Memory Blocks: 16 -# of Instructions: 397591 -# of Defined Data: 27004 -# of Functions: 3428 -# of Symbols: 39114 +# of Instructions: 397653 +# of Defined Data: 27048 +# of Functions: 3432 +# of Symbols: 39142 # of Data Types: 4091 # of Data Type Categories: 314 Analyzed: true Compiler: visualstudio:unknown Created With Ghidra Version: 12.1.2 -Date Created: Fri Jul 24 23:04:40 SGT 2026 +Date Created: Fri Jul 24 23:04:46 SGT 2026 Executable Format: Portable Executable (PE) -Executable Location: /C:/tools/hugo/patchpalooza/ghidriff/CVE-2026-21508/storport-10.0.26100.7309.sys -Executable MD5: 3241a0a49c17bfc672de7b997f176840 -Executable SHA256: b6f22b50a1ac209d1b3a77872d90d7ce7dd1ead035d68329cdb28b77462a57aa -FSRL: file:///C:/tools/hugo/patchpalooza/ghidriff/CVE-2026-21508/storport-10.0.26100.7309.sys?MD5=3241a0a49c17bfc672de7b997f176840 +Executable Location: /C:/tools/hugo/patchpalooza/ghidriff/CVE-2026-21508/storport-10.0.26100.7705.sys +Executable MD5: f324468334699f9a9b7e6f689dfc3b53 +Executable SHA256: e9eff6f70577f6c091a32ff8c5a697f53456a0e32dc4de12d0a6ce862be4d1fe +FSRL: file:///C:/tools/hugo/patchpalooza/ghidriff/CVE-2026-21508/storport-10.0.26100.7705.sys?MD5=f324468334699f9a9b7e6f689dfc3b53 PDB Age: 1 PDB File: storport.pdb -PDB GUID: da4362a2-b3d3-b007-45c5-e7b87e34c43a +PDB GUID: 380fac98-defd-e456-9336-e33c65e471fd PDB Loaded: true PDB Version: RSDS PE Property[CompanyName]: Microsoft Corporation PE Property[FileDescription]: Microsoft Storage Port Driver -PE Property[FileVersion]: 10.0.26100.7309 (WinBuild.160101.0800) +PE Property[FileVersion]: 10.0.26100.7705 (WinBuild.160101.0800) PE Property[InternalName]: storport.sys PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved. PE Property[OriginalFilename]: storport.sys PE Property[ProductName]: Microsoft® Windows® Operating System -PE Property[ProductVersion]: 10.0.26100.7309 +PE Property[ProductVersion]: 10.0.26100.7705 PE Property[Translation]: 4b00000 Preferred Root Namespace Category: RTTI Found: false Relocatable: true SectionAlignment: 4096 Should Ask To Analyze: false ``` ## Program Options

Ghidra storport-10.0.26100.7309.sys Decompiler Options

Ghidra storport-10.0.26100.7309.sys Specification extensions Options

|Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|

Ghidra storport-10.0.26100.7309.sys Analyzers Options

|Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|false| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.msdApplyOptions|{ interpretation: FUNCTION_IF_EXISTS, applyCallingConvention: true, applySignature: true, demangleOnlyKnownPatterns: true, doDisassembly: true }| |Demangler Microsoft.msdOutputOptions|ghidra.app.util.demangler.microsoft.options.MsdOutputOption@9e5b| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|

Ghidra storport-10.0.26100.7705.sys Decompiler Options

Ghidra storport-10.0.26100.7705.sys Specification extensions Options

|Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|

Ghidra storport-10.0.26100.7705.sys Analyzers Options

## Diff Stats |Stat|Value| | :---: | :---: | |added_funcs_len|4| |deleted_funcs_len|0| |modified_funcs_len|4| |added_symbols_len|21| |deleted_symbols_len|8| |diff_time|24.04673671722412| |deleted_strings_len|0| |added_strings_len|0| |match_types|Counter({'SymbolsHash': 3251, 'ExternalsName': 370, 'StructuralGraphHash': 281, 'ExactInstructionsFunctionHasher': 83, 'ExactBytesFunctionHasher': 40, 'BSIM': 11, 'BulkInstructionHash': 4})| |items_to_process|37| |diff_types|Counter({'address': 4, 'code': 3, 'length': 3, 'called': 3, 'refcount': 1, 'calling': 1})| |unmatched_funcs_len|4| |total_funcs_len|6860| |matched_funcs_len|6856| |matched_funcs_with_code_changes_len|3| |matched_funcs_with_non_code_changes_len|1| |matched_funcs_no_changes_len|6852| |match_func_similarity_percent|99.9417%| |func_match_overall_percent|99.9417%| |first_matches|Counter({'SymbolsHash': 3251, 'StructuralGraphHash': 281, 'ExactInstructionsFunctionHasher': 83, 'ExactBytesFunctionHasher': 40, 'BSIM': 11, 'BulkInstructionHash': 4})| ```mermaid pie showData title All Matches "SymbolsHash" : 3251 "ExternalsName" : 370 "ExactBytesFunctionHasher" : 40 "ExactInstructionsFunctionHasher" : 83 "BSIM" : 11 "BulkInstructionHash" : 4 "StructuralGraphHash" : 281 ``` ```mermaid pie showData title First Matches "SymbolsHash" : 3251 "ExactBytesFunctionHasher" : 40 "ExactInstructionsFunctionHasher" : 83 "BSIM" : 11 "BulkInstructionHash" : 4 "StructuralGraphHash" : 281 ``` ```mermaid pie showData title Diff Stats "added_funcs_len" : 4 "deleted_funcs_len" : 0 "modified_funcs_len" : 4 ``` ```mermaid pie showData title Symbols "added_symbols_len" : 21 "deleted_symbols_len" : 8 ``` ## Strings *No string differences found* # Deleted # Added ## Feature_Servicing_StorageSetProperty_BufferCheck__private_IsEnabledDeviceUsageNoInline ### Function Meta |Key|storport-10.0.26100.7705.sys| | :---: | :---: | |name|Feature_Servicing_StorageSetProperty_BufferCheck__private_IsEnabledDeviceUsageNoInline| |fullname|Feature_Servicing_StorageSetProperty_BufferCheck__private_IsEnabledDeviceUsageNoInline| |refcount|3| |length|49| |called|Feature_Servicing_StorageSetProperty_BufferCheck__private_IsEnabledFallback| |calling|RaUnitStorageSetDeviceProtocolSpecificPropertyIoctl
RaidSetStorageAdapterProtocolSpecificProperty| |paramcount|0| |address|140056894| |sig|undefined Feature_Servicing_StorageSetProperty_BufferCheck__private_IsEnabledDeviceUsageNoInline(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_Servicing_StorageSetProperty_BufferCheck__private_IsEnabledDeviceUsageNoInline +++ Feature_Servicing_StorageSetProperty_BufferCheck__private_IsEnabledDeviceUsageNoInline @@ -0,0 +1,17 @@ + +ulonglong Feature_Servicing_StorageSetProperty_BufferCheck__private_IsEnabledDeviceUsageNoInline + (void) + +{ + ulonglong uVar1; + + if ((Feature_Servicing_StorageSetProperty_BufferCheck__private_featureState & 0x10) == 0) { + uVar1 = Feature_Servicing_StorageSetProperty_BufferCheck__private_IsEnabledFallback + (Feature_Servicing_StorageSetProperty_BufferCheck__private_featureState,3); + } + else { + uVar1 = (ulonglong)(Feature_Servicing_StorageSetProperty_BufferCheck__private_featureState & 1); + } + return uVar1; +} + ``` ## Feature_Servicing_StorageSetProperty_BufferCheck__private_IsEnabledFallback ### Function Meta |Key|storport-10.0.26100.7705.sys| | :---: | :---: | |name|Feature_Servicing_StorageSetProperty_BufferCheck__private_IsEnabledFallback| |fullname|Feature_Servicing_StorageSetProperty_BufferCheck__private_IsEnabledFallback| |refcount|2| |length|21| |called|wil_details_IsEnabledFallback| |calling|Feature_Servicing_StorageSetProperty_BufferCheck__private_IsEnabledDeviceUsageNoInline| |paramcount|0| |address|1400568cc| |sig|undefined Feature_Servicing_StorageSetProperty_BufferCheck__private_IsEnabledFallback(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_Servicing_StorageSetProperty_BufferCheck__private_IsEnabledFallback +++ Feature_Servicing_StorageSetProperty_BufferCheck__private_IsEnabledFallback @@ -0,0 +1,10 @@ + +void Feature_Servicing_StorageSetProperty_BufferCheck__private_IsEnabledFallback + (undefined8 param_1,undefined8 param_2) + +{ + wil_details_IsEnabledFallback + (param_1,param_2,&Feature_Servicing_StorageSetProperty_BufferCheck__private_descriptor); + return; +} + ``` ## Feature_FixSteelixUfsIceRegression__private_IsEnabledDeviceUsageNoInline ### Function Meta |Key|storport-10.0.26100.7705.sys| | :---: | :---: | |name|Feature_FixSteelixUfsIceRegression__private_IsEnabledDeviceUsageNoInline| |fullname|Feature_FixSteelixUfsIceRegression__private_IsEnabledDeviceUsageNoInline| |refcount|2| |length|49| |called|Feature_FixSteelixUfsIceRegression__private_IsEnabledFallback| |calling|RaidAdapterSendCryptoOperationSynchronously| |paramcount|0| |address|140069828| |sig|undefined Feature_FixSteelixUfsIceRegression__private_IsEnabledDeviceUsageNoInline(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_FixSteelixUfsIceRegression__private_IsEnabledDeviceUsageNoInline +++ Feature_FixSteelixUfsIceRegression__private_IsEnabledDeviceUsageNoInline @@ -0,0 +1,16 @@ + +ulonglong Feature_FixSteelixUfsIceRegression__private_IsEnabledDeviceUsageNoInline(void) + +{ + ulonglong uVar1; + + if ((Feature_FixSteelixUfsIceRegression__private_featureState & 0x10) == 0) { + uVar1 = Feature_FixSteelixUfsIceRegression__private_IsEnabledFallback + (Feature_FixSteelixUfsIceRegression__private_featureState,3); + } + else { + uVar1 = (ulonglong)(Feature_FixSteelixUfsIceRegression__private_featureState & 1); + } + return uVar1; +} + ``` ## Feature_FixSteelixUfsIceRegression__private_IsEnabledFallback ### Function Meta |Key|storport-10.0.26100.7705.sys| | :---: | :---: | |name|Feature_FixSteelixUfsIceRegression__private_IsEnabledFallback| |fullname|Feature_FixSteelixUfsIceRegression__private_IsEnabledFallback| |refcount|2| |length|21| |called|wil_details_IsEnabledFallback| |calling|Feature_FixSteelixUfsIceRegression__private_IsEnabledDeviceUsageNoInline| |paramcount|0| |address|140069860| |sig|undefined Feature_FixSteelixUfsIceRegression__private_IsEnabledFallback(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_FixSteelixUfsIceRegression__private_IsEnabledFallback +++ Feature_FixSteelixUfsIceRegression__private_IsEnabledFallback @@ -0,0 +1,10 @@ + +void Feature_FixSteelixUfsIceRegression__private_IsEnabledFallback + (undefined8 param_1,undefined8 param_2) + +{ + wil_details_IsEnabledFallback + (param_1,param_2,&Feature_FixSteelixUfsIceRegression__private_descriptor); + return; +} + ``` # Modified *Modified functions contain code changes* ## RaidSetStorageAdapterProtocolSpecificProperty ### Match Info |Key|storport-10.0.26100.7309.sys - storport-10.0.26100.7705.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.44| |i_ratio|0.66| |m_ratio|0.96| |b_ratio|0.95| |match_types|SymbolsHash| ### Function Meta Diff |Key|storport-10.0.26100.7309.sys|storport-10.0.26100.7705.sys| | :---: | :---: | :---: | |name|RaidSetStorageAdapterProtocolSpecificProperty|RaidSetStorageAdapterProtocolSpecificProperty| |fullname|RaidSetStorageAdapterProtocolSpecificProperty|RaidSetStorageAdapterProtocolSpecificProperty| |refcount|2|2| |`length`|556|590| |`called`|NTOSKRNL.EXE::ExFreePoolWithTag
RaBuildSetProtocolSpecificPropertyBufferForMiniport
RaidAdapterSendSrbIoControlSynchronously
memcpy|Feature_Servicing_StorageSetProperty_BufferCheck__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExFreePoolWithTag
RaBuildSetProtocolSpecificPropertyBufferForMiniport
RaidAdapterSendSrbIoControlSynchronously
memcpy| |calling|RaidAdapterStorageSetPropertyIoctl|RaidAdapterStorageSetPropertyIoctl| |paramcount|0|0| |`address`|14006680c|14006685c| |sig|undefined RaidSetStorageAdapterProtocolSpecificProperty(void)|undefined RaidSetStorageAdapterProtocolSpecificProperty(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### RaidSetStorageAdapterProtocolSpecificProperty Called Diff ```diff --- RaidSetStorageAdapterProtocolSpecificProperty called +++ RaidSetStorageAdapterProtocolSpecificProperty called @@ -0,0 +1 @@ +Feature_Servicing_StorageSetProperty_BufferCheck__private_IsEnabledDeviceUsageNoInline ``` ### RaidSetStorageAdapterProtocolSpecificProperty Diff ```diff --- RaidSetStorageAdapterProtocolSpecificProperty +++ RaidSetStorageAdapterProtocolSpecificProperty @@ -1,114 +1,122 @@ int RaidSetStorageAdapterProtocolSpecificProperty (longlong param_1,longlong param_2,ulonglong *param_3) { uint uVar1; - uint uVar2; - int *piVar3; - bool bVar4; - uint uVar5; + int *piVar2; + bool bVar3; + uint uVar4; + int iVar5; + int *_Src; int iVar6; - int *_Src; - int iVar7; - longlong lVar8; + longlong lVar7; undefined1 local_res18 [8]; undefined1 local_res20 [8]; - undefined4 local_58 [2]; + undefined4 local_58; + uint local_54; longlong local_50 [2]; - lVar8 = 0; - piVar3 = *(int **)(param_2 + 0x18); - local_58[0] = 0; + piVar2 = *(int **)(param_2 + 0x18); + lVar7 = 0; local_50[0] = 0; - uVar1 = *(uint *)(*(longlong *)(param_2 + 0xb8) + 0x10); - iVar7 = 1; - uVar2 = *(uint *)(*(longlong *)(param_2 + 0xb8) + 8); - *param_3 = 0; + local_58 = 0; + local_54 = *(uint *)(*(longlong *)(param_2 + 0xb8) + 0x10); + uVar1 = *(uint *)(*(longlong *)(param_2 + 0xb8) + 8); + iVar6 = 1; + iVar5 = *piVar2; + bVar3 = false; local_res20[0] = 0; local_res18[0] = 0; - if (*piVar3 == 0x31) { - bVar4 = false; - uVar5 = 0x48; + *param_3 = 0; + if (iVar5 == 0x31) { + uVar4 = 0x48; } else { - if (*piVar3 != 0x43) { + if (iVar5 != 0x43) { return -0x3fffff11; } - bVar4 = true; - uVar5 = 0x50; + bVar3 = true; + uVar4 = 0x50; } - if (uVar1 < uVar5) { + if (local_54 < uVar4) { return -0x3fffff11; } - _Src = piVar3 + 2; - if (bVar4) { + _Src = piVar2 + 2; + if (bVar3) { if (*_Src != 1) { return -0x3fffff11; } - if (piVar3[3] != 0x48) { + if (piVar2[3] != 0x48) { return -0x3fffff11; } - _Src = piVar3 + 4; + _Src = piVar2 + 4; + } + iVar5 = Feature_Servicing_StorageSetProperty_BufferCheck__private_IsEnabledDeviceUsageNoInline(); + if ((iVar5 != 0) && + ((ulonglong)local_54 < + (((ulonglong)(uint)_Src[5] + (ulonglong)(uint)_Src[4]) - (longlong)piVar2) + (longlong)_Src)) + { + return -0x3fffff11; } if ((*_Src != 0) && (_Src[1] != 0)) { - uVar1 = _Src[4]; - if ((uVar1 == 0) || ((0x3f < uVar1 && (_Src[5] != 0)))) { - if (uVar2 < 0x48) { - if (uVar2 < 8) { + uVar4 = _Src[4]; + if ((uVar4 == 0) || ((0x3f < uVar4 && (_Src[5] != 0)))) { + if (uVar1 < 0x48) { + if (uVar1 < 8) { return -0x3fffffdd; } - *piVar3 = (-(uint)bVar4 & 0xffffffb9) + 0x48; - iVar6 = 0; - piVar3[1] = 0x48; + *piVar2 = (-(uint)bVar3 & 0xffffffb9) + 0x48; + iVar5 = 0; + piVar2[1] = 0x48; *param_3 = 8; - lVar8 = 0; + lVar7 = 0; } else { - if ((ulonglong)uVar2 < (ulonglong)uVar1 + 8 + (ulonglong)(uint)_Src[5]) { + if ((ulonglong)uVar1 < (ulonglong)uVar4 + 8 + (ulonglong)(uint)_Src[5]) { return -0x3fffff11; } - iVar6 = RaBuildSetProtocolSpecificPropertyBufferForMiniport - (*(undefined8 *)(param_1 + 8),param_2,local_50,local_58,local_res20, + iVar5 = RaBuildSetProtocolSpecificPropertyBufferForMiniport + (*(undefined8 *)(param_1 + 8),param_2,local_50,&local_58,local_res20, local_res18); - lVar8 = local_50[0]; - if ((-1 < iVar6) && - (iVar6 = RaidAdapterSendSrbIoControlSynchronously - (param_1,param_2,local_50[0],local_58[0],0,local_res18[0],0x40,0), - -1 < iVar6)) { - if (bVar4) { - memcpy(piVar3 + 2,_Src,0x40); + lVar7 = local_50[0]; + if ((-1 < iVar5) && + (iVar5 = RaidAdapterSendSrbIoControlSynchronously + (param_1,param_2,local_50[0],local_58,0,local_res18[0],0x40,0), + -1 < iVar5)) { + if (bVar3) { + memcpy(piVar2 + 2,_Src,0x40); } else { - iVar7 = 0x48; + iVar6 = 0x48; } - *piVar3 = iVar7; - uVar1 = piVar3[7]; - piVar3[1] = 0x48; - piVar3[8] = *(int *)(lVar8 + 0x3c); + *piVar2 = iVar6; + uVar1 = piVar2[7]; + piVar2[1] = 0x48; + piVar2[8] = *(int *)(lVar7 + 0x3c); if (uVar1 == 0) { *param_3 = 0x48; } else { - if (*(uint *)(lVar8 + 0x38) <= uVar1) { - uVar1 = *(uint *)(lVar8 + 0x38); + if (*(uint *)(lVar7 + 0x38) <= uVar1) { + uVar1 = *(uint *)(lVar7 + 0x38); } - memcpy((void *)((ulonglong)(uint)piVar3[6] + 8 + (longlong)piVar3), - (void *)((ulonglong)*(uint *)(lVar8 + 0x34) + 0x24 + lVar8),(ulonglong)uVar1); - piVar3[7] = uVar1; - *param_3 = (ulonglong)(piVar3[6] + 8 + uVar1); + memcpy((void *)((ulonglong)(uint)piVar2[6] + 8 + (longlong)piVar2), + (void *)((ulonglong)*(uint *)(lVar7 + 0x34) + 0x24 + lVar7),(ulonglong)uVar1); + piVar2[7] = uVar1; + *param_3 = (ulonglong)(piVar2[6] + 8 + uVar1); } } } goto LAB_0; } } - iVar6 = -0x3fffff11; + iVar5 = -0x3fffff11; LAB_0: - if (lVar8 != 0) { - ExFreePoolWithTag(lVar8,0x72536152); - return iVar6; + if (lVar7 != 0) { + ExFreePoolWithTag(lVar7,0x72536152); + return iVar5; } - return iVar6; + return iVar5; } ``` ## RaUnitStorageSetDeviceProtocolSpecificPropertyIoctl ### Match Info |Key|storport-10.0.26100.7309.sys - storport-10.0.26100.7705.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.28| |i_ratio|0.58| |m_ratio|0.99| |b_ratio|0.93| |match_types|SymbolsHash| ### Function Meta Diff |Key|storport-10.0.26100.7309.sys|storport-10.0.26100.7705.sys| | :---: | :---: | :---: | |name|RaUnitStorageSetDeviceProtocolSpecificPropertyIoctl|RaUnitStorageSetDeviceProtocolSpecificPropertyIoctl| |fullname|RaUnitStorageSetDeviceProtocolSpecificPropertyIoctl|RaUnitStorageSetDeviceProtocolSpecificPropertyIoctl| |refcount|2|2| |`length`|1488|1512| |`called`|

Expand for full list:
McTemplateK0pd_EtwWriteTransfer
McTemplateK0pduuuuup_EtwWriteTransfer
McTemplateK0pqd_EtwWriteTransfer
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::IoGetActivityIdIrp
NTOSKRNL.EXE::IofCallDriver
NTOSKRNL.EXE::IofCompleteRequest
RaBuildSetProtocolSpecificPropertyBufferForMiniport
RaidUnitSendSrbIoControlSynchronously
__security_check_cookie
memcpy

Expand for full list:
Feature_Servicing_StorageSetProperty_BufferCheck__private_IsEnabledDeviceUsageNoInline
McTemplateK0pd_EtwWriteTransfer
McTemplateK0pduuuuup_EtwWriteTransfer
McTemplateK0pqd_EtwWriteTransfer
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::IoGetActivityIdIrp
NTOSKRNL.EXE::IofCallDriver
NTOSKRNL.EXE::IofCompleteRequest
RaBuildSetProtocolSpecificPropertyBufferForMiniport
RaidUnitSendSrbIoControlSynchronously
__security_check_cookie

memcpy

| |calling|RaUnitStorageSetPropertyIoctl|RaUnitStorageSetPropertyIoctl| |paramcount|0|0| |`address`|14009cd50|14009ce40| |sig|undefined RaUnitStorageSetDeviceProtocolSpecificPropertyIoctl(void)|undefined RaUnitStorageSetDeviceProtocolSpecificPropertyIoctl(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### RaUnitStorageSetDeviceProtocolSpecificPropertyIoctl Called Diff ```diff --- RaUnitStorageSetDeviceProtocolSpecificPropertyIoctl called +++ RaUnitStorageSetDeviceProtocolSpecificPropertyIoctl called @@ -0,0 +1 @@ +Feature_Servicing_StorageSetProperty_BufferCheck__private_IsEnabledDeviceUsageNoInline ``` ### RaUnitStorageSetDeviceProtocolSpecificPropertyIoctl Diff ```diff --- RaUnitStorageSetDeviceProtocolSpecificPropertyIoctl +++ RaUnitStorageSetDeviceProtocolSpecificPropertyIoctl @@ -1,340 +1,344 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ -ulonglong RaUnitStorageSetDeviceProtocolSpecificPropertyIoctl(uint *param_1,longlong param_2) +ulonglong RaUnitStorageSetDeviceProtocolSpecificPropertyIoctl(longlong param_1,ulonglong param_2) { char cVar1; int *piVar2; char *pcVar3; longlong lVar4; - byte bVar5; - uint uVar6; + uint uVar5; + int iVar6; uint uVar7; - int iVar8; - ulonglong uVar9; - uint uVar10; - longlong lVar11; - undefined7 uVar13; - byte *pbVar12; - undefined *puVar14; - byte bVar15; + ulonglong uVar8; + uint uVar9; + undefined7 uVar10; + undefined *puVar11; + byte bVar12; int *_Src; + byte *pbVar13; + byte bVar14; + uint uVar15; byte *pbVar16; byte bVar17; - uint uVar18; - byte *pbVar19; + ulonglong uVar18; + byte bVar19; byte bVar20; - byte bVar21; - byte bVar22; - undefined1 uVar23; - byte *pbVar24; - byte *pbVar25; - bool bVar26; - undefined4 uVar27; + byte *pbVar21; + undefined1 uVar22; + byte *pbVar23; + ulonglong uVar24; + bool bVar25; + undefined4 uVar26; undefined1 auStack_c8 [32]; - char *local_a8; + byte *local_a8; byte *local_a0; undefined4 local_98; byte local_90; undefined1 local_88; byte local_80; - longlong local_78; + ulonglong local_78; byte local_68; - char local_67 [3]; + byte local_67; + char local_66; uint local_64; - byte *local_60; - uint *local_58; - undefined8 local_50; - undefined8 uStack_48; - ulonglong local_40; + undefined4 local_60 [2]; + byte *local_58; + longlong local_50 [3]; - local_40 = __security_cookie ^ (ulonglong)auStack_c8; + local_50[2] = __security_cookie ^ (ulonglong)auStack_c8; piVar2 = *(int **)(param_2 + 0x18); - pbVar19 = (byte *)0x0; + pbVar16 = (byte *)0x0; uVar7 = 0; - uVar18 = 0; - pbVar24 = (byte *)0x0; - local_60 = (byte *)0x0; - uVar10 = *(uint *)(*(longlong *)(param_2 + 0xb8) + 8); - local_64 = 0; - bVar17 = 0; - local_67[0] = '\0'; + uVar15 = 0; + pbVar23 = (byte *)0x0; + local_58 = (byte *)0x0; + local_64 = *(uint *)(*(longlong *)(param_2 + 0xb8) + 0x10); + uVar9 = *(uint *)(*(longlong *)(param_2 + 0xb8) + 8); + local_60[0] = 0; + bVar14 = 0; local_68 = 0; - local_58 = param_1; + local_67 = 0; + local_50[0] = param_1; if (piVar2[1] == 0) { if (*piVar2 == 0x32) { - uVar6 = 0x48; - bVar22 = bVar17; + uVar5 = 0x48; + bVar19 = bVar14; LAB_0: - if (uVar6 <= *(uint *)(*(longlong *)(param_2 + 0xb8) + 0x10)) { + if (uVar5 <= local_64) { _Src = piVar2 + 2; - if (bVar22 != 0) { + if (bVar19 != 0) { if ((*_Src != 1) || (piVar2[3] != 0x48)) goto LAB_1; _Src = piVar2 + 4; } - if ((*_Src == 0) || (_Src[1] == 0)) { + iVar6 = Feature_Servicing_StorageSetProperty_BufferCheck__private_IsEnabledDeviceUsageNoInline + (); + lVar4 = local_50[0]; + if ((iVar6 == 0) || + ((((ulonglong)(uint)_Src[5] + (ulonglong)(uint)_Src[4]) - (longlong)piVar2) + + (longlong)_Src <= (ulonglong)local_64)) { + if ((*_Src == 0) || (_Src[1] == 0)) { LAB_2: - uVar7 = 0xc00000ef; - } - else { - uVar6 = _Src[4]; - if ((uVar6 != 0) && ((uVar6 < 0x40 || (_Src[5] == 0)))) goto LAB_2; - if (uVar10 < 0x48) { - if (uVar10 < 8) { - uVar7 = 0xc0000023; - goto LAB_3; - } - *piVar2 = (-(uint)(bVar22 != 0) & 0xffffffb9) + 0x48; - piVar2[1] = 0x48; - *(undefined8 *)(param_2 + 0x38) = 8; - pbVar24 = pbVar19; + uVar7 = 0xc00000ef; } else { - if ((ulonglong)uVar10 < (ulonglong)uVar6 + 8 + (ulonglong)(uint)_Src[5]) - goto LAB_1; - local_a0 = &local_68; - local_a8 = local_67; - uVar7 = RaBuildSetProtocolSpecificPropertyBufferForMiniport - (*(undefined8 *)(param_1 + 2),param_2,&local_60,&local_64); - pbVar24 = local_60; - if (-1 < (int)uVar7) { - if (local_68 != 0) { - ExFreePoolWithTag(local_60,0x72536152); - *(char *)(param_2 + 0x43) = *(char *)(param_2 + 0x43) + '\x01'; - *(longlong *)(param_2 + 0xb8) = *(longlong *)(param_2 + 0xb8) + 0x48; - uVar9 = IofCallDriver(*(undefined8 *)(*(longlong *)(local_58 + 6) + 8),param_2); - return uVar9; - } - local_98 = 0x40; - local_a0 = (byte *)CONCAT71(local_a0._1_7_,local_67[0]); - local_a8 = (char *)0x0; - uVar7 = RaidUnitSendSrbIoControlSynchronously(local_58,param_2,local_60,local_64); + uVar5 = _Src[4]; + if ((uVar5 != 0) && ((uVar5 < 0x40 || (_Src[5] == 0)))) goto LAB_2; + if (uVar9 < 0x48) { + if (uVar9 < 8) { + uVar7 = 0xc0000023; + goto LAB_3; + } + *piVar2 = (-(uint)(bVar19 != 0) & 0xffffffb9) + 0x48; + piVar2[1] = 0x48; + *(undefined8 *)(param_2 + 0x38) = 8; + pbVar23 = pbVar16; + } + else { + if ((ulonglong)uVar9 < (ulonglong)uVar5 + 8 + (ulonglong)(uint)_Src[5]) + goto LAB_1; + local_a0 = &local_67; + local_a8 = &local_68; + uVar7 = RaBuildSetProtocolSpecificPropertyBufferForMiniport + (*(undefined8 *)(local_50[0] + 8),param_2,&local_58,local_60); + pbVar23 = local_58; if (-1 < (int)uVar7) { - if (bVar22 == 0) { - iVar8 = 0x48; - } - else { - memcpy(piVar2 + 2,_Src,0x40); - iVar8 = 1; - } - *piVar2 = iVar8; - uVar10 = piVar2[7]; - piVar2[1] = 0x48; - piVar2[8] = *(int *)(pbVar24 + 0x3c); - if (uVar10 == 0) { - *(undefined8 *)(param_2 + 0x38) = 0x48; - } - else { - if (*(uint *)(pbVar24 + 0x38) <= uVar10) { - uVar10 = *(uint *)(pbVar24 + 0x38); - } - memcpy((void *)((ulonglong)(uint)piVar2[6] + 8 + (longlong)piVar2), - pbVar24 + (ulonglong)*(uint *)(pbVar24 + 0x34) + 0x24,(ulonglong)uVar10); - piVar2[7] = uVar10; - *(ulonglong *)(param_2 + 0x38) = (ulonglong)(piVar2[6] + 8 + uVar10); - } - } - } - } - } - if (pbVar24 != (byte *)0x0) { - ExFreePoolWithTag(pbVar24,0x72536152); - } - if ((int)uVar7 < 0) goto LAB_3; - goto LAB_4; + if (local_67 != 0) { + ExFreePoolWithTag(local_58,0x72536152); + *(char *)(param_2 + 0x43) = *(char *)(param_2 + 0x43) + '\x01'; + *(longlong *)(param_2 + 0xb8) = *(longlong *)(param_2 + 0xb8) + 0x48; + uVar8 = IofCallDriver(*(undefined8 *)(*(longlong *)(lVar4 + 0x18) + 8),param_2); + return uVar8; + } + local_98 = 0x40; + local_a0 = (byte *)CONCAT71(local_a0._1_7_,local_68); + local_a8 = (byte *)0x0; + uVar7 = RaidUnitSendSrbIoControlSynchronously + (local_50[0],param_2,local_58,local_60[0]); + if (-1 < (int)uVar7) { + if (bVar19 == 0) { + iVar6 = 0x48; + } + else { + memcpy(piVar2 + 2,_Src,0x40); + iVar6 = 1; + } + *piVar2 = iVar6; + uVar9 = piVar2[7]; + piVar2[1] = 0x48; + piVar2[8] = *(int *)(pbVar23 + 0x3c); + if (uVar9 == 0) { + *(undefined8 *)(param_2 + 0x38) = 0x48; + } + else { + if (*(uint *)(pbVar23 + 0x38) <= uVar9) { + uVar9 = *(uint *)(pbVar23 + 0x38); + } + memcpy((void *)((ulonglong)(uint)piVar2[6] + 8 + (longlong)piVar2), + pbVar23 + (ulonglong)*(uint *)(pbVar23 + 0x34) + 0x24,(ulonglong)uVar9); + piVar2[7] = uVar9; + *(ulonglong *)(param_2 + 0x38) = (ulonglong)(piVar2[6] + 8 + uVar9); + } + } + } + } + } + if (pbVar23 != (byte *)0x0) { + ExFreePoolWithTag(pbVar23,0x72536152); + } + if ((int)uVar7 < 0) goto LAB_3; + goto LAB_4; + } } } else if (*piVar2 == 0x44) { - uVar6 = 0x50; - bVar22 = 1; + uVar5 = 0x50; + bVar19 = 1; goto LAB_0; } LAB_1: uVar7 = 0xc00000ef; LAB_3: *(undefined8 *)(param_2 + 0x38) = 0; } else { - uVar7 = uVar18; + uVar7 = uVar15; if (piVar2[1] != 1) { uVar7 = 0xc00000bb; goto LAB_3; } } LAB_4: - bVar26 = StorEtwLoggingEnabled == '\0'; + bVar25 = StorEtwLoggingEnabled == '\0'; *(undefined1 *)(param_2 + 0x8d) = 0xac; *(uint *)(param_2 + 0x30) = uVar7; - if (bVar26) goto LAB_5; - local_50 = 0; - uStack_48 = 0; - lVar11 = param_2; - uVar27 = IoGetActivityIdIrp(param_2,&local_50); + if (bVar25) goto LAB_5; + local_50[0] = 0; + local_50[1] = 0; + uVar8 = param_2; + uVar26 = IoGetActivityIdIrp(param_2,local_50); pcVar3 = *(char **)(param_2 + 0xb8); cVar1 = *pcVar3; if (cVar1 == '\x0e') { - if ((DAT_6 & 8) == 0) goto LAB_14009d2e6; - puVar14 = &EventNonReadWriteRequestComplete; + if ((DAT_6 & 8) == 0) goto LAB_14009d3ee; + puVar11 = &EventNonReadWriteRequestComplete; } else { if (cVar1 == '\x0f') { - if (-1 < DAT_7) goto LAB_14009d2e6; + if (-1 < DAT_7) goto LAB_14009d3ee; lVar4 = *(longlong *)(pcVar3 + 8); - uVar23 = 0; + uVar22 = 0; local_68 = 0; - bVar22 = 0; - bVar5 = 0; + local_67 = 0; if (*(char *)(lVar4 + 2) == '(') { - local_67[0] = '\0'; + local_66 = '\0'; if (*(int *)(lVar4 + 0x14) != 0) goto LAB_5; local_64 = *(uint *)(lVar4 + 0x38); - local_60 = (byte *)((ulonglong)local_60 & 0xffffffff00000000); - pbVar12 = pbVar19; - pbVar16 = pbVar19; - pbVar24 = pbVar19; + pbVar13 = pbVar16; + pbVar23 = pbVar16; + bVar19 = bVar14; + pbVar21 = pbVar16; if (local_64 != 0) { - local_58 = (uint *)(lVar4 + 0x78); do { - uVar10 = *local_58; - uVar9 = (ulonglong)uVar10; - iVar8 = (int)pbVar12; - if ((0x7f < uVar10) && - (pbVar25 = (byte *)(ulonglong)*(uint *)(lVar4 + 0x10), - uVar10 < *(uint *)(lVar4 + 0x10))) { - if (*(int *)(uVar9 + lVar4) == 0x40) { - pbVar12 = (byte *)(uVar9 + 0x28); - if (pbVar12 <= pbVar25) { - if (*(char *)(uVar9 + 10 + lVar4) != '\0') { - pbVar16 = (byte *)(lVar4 + 0x18 + uVar9); - } - pbVar24 = *(byte **)(uVar9 + 0x10 + lVar4); + uVar9 = *(uint *)(lVar4 + 0x78 + (longlong)pbVar21 * 4); + uVar8 = (ulonglong)uVar9; + if ((0x7f < uVar9) && + (uVar24 = (ulonglong)*(uint *)(lVar4 + 0x10), uVar9 < *(uint *)(lVar4 + 0x10))) { + uVar18 = (ulonglong)uVar9; + if (*(int *)(uVar8 + lVar4) == 0x40) { + uVar8 = uVar18 + 0x28; + if (uVar8 <= uVar24) { + if (*(char *)(uVar18 + 10 + lVar4) != '\0') { + pbVar13 = (byte *)(lVar4 + 0x18 + uVar18); + } + pbVar23 = *(byte **)(uVar18 + 0x10 + lVar4); LAB_8: - pbVar12 = (byte *)(uVar9 + 0x28); - bVar22 = *(byte *)(uVar9 + 9 + lVar4); - uVar23 = *(undefined1 *)(uVar9 + 8 + lVar4); + uVar8 = uVar18 + 0x28; + bVar19 = *(byte *)(uVar18 + 9 + lVar4); + uVar22 = *(undefined1 *)(uVar18 + 8 + lVar4); break; } } else { - uVar10 = *(int *)(uVar9 + lVar4) - 0x41; - pbVar12 = (byte *)(ulonglong)uVar10; - if (uVar10 == 0) { - pbVar12 = (byte *)(uVar9 + 0x38); - if (pbVar12 <= pbVar25) { - local_67[0] = '\x01'; - if (*(char *)(uVar9 + 10 + lVar4) != '\0') { - pbVar16 = (byte *)(lVar4 + 0x18 + uVar9); + uVar9 = *(int *)(uVar8 + lVar4) - 0x41; + uVar8 = (ulonglong)uVar9; + if (uVar9 == 0) { + uVar8 = uVar18 + 0x38; + if (uVar8 <= uVar24) { + local_66 = '\x01'; + if (*(char *)(uVar18 + 10 + lVar4) != '\0') { + pbVar13 = (byte *)(lVar4 + 0x18 + uVar18); } - uVar23 = *(undefined1 *)(uVar9 + 8 + lVar4); - pbVar24 = *(byte **)(uVar9 + 0x10 + lVar4); - bVar22 = *(byte *)(uVar9 + 9 + lVar4); - } - } - else if ((uVar10 == 1) && (pbVar12 = (byte *)(uVar9 + 0x28), pbVar12 <= pbVar25)) { - if (*(int *)(uVar9 + 0xc + lVar4) != 0) { - pbVar16 = (byte *)(lVar4 + 0x20 + uVar9); - } - pbVar24 = *(byte **)(uVar9 + 0x18 + lVar4); + uVar22 = *(undefined1 *)(uVar18 + 8 + lVar4); + pbVar23 = *(byte **)(uVar18 + 0x10 + lVar4); + bVar19 = *(byte *)(uVar18 + 9 + lVar4); + } + } + else if ((uVar9 == 1) && (uVar8 = uVar18 + 0x28, uVar8 <= uVar24)) { + if (*(int *)(uVar18 + 0xc + lVar4) != 0) { + pbVar13 = (byte *)(lVar4 + 0x20 + uVar18); + } + pbVar23 = *(byte **)(uVar18 + 0x18 + lVar4); goto LAB_8; } } - if (local_67[0] != '\0') break; - iVar8 = (int)local_60; - } - uVar10 = iVar8 + 1; - pbVar12 = (byte *)(ulonglong)uVar10; - local_58 = local_58 + 1; - local_60 = (byte *)CONCAT44(local_60._4_4_,uVar10); - } while (uVar10 < local_64); - } - if (pbVar16 == (byte *)0x0) goto LAB_5; - bVar21 = *pbVar16; - uVar13 = (undefined7)((ulonglong)pbVar12 >> 8); + if (local_66 != '\0') break; + } + uVar9 = (int)pbVar21 + 1; + pbVar21 = (byte *)(ulonglong)uVar9; + } while (uVar9 < local_64); + } + if (pbVar13 == (byte *)0x0) goto LAB_5; + bVar20 = *pbVar13; + uVar10 = (undefined7)(uVar8 >> 8); } else { - bVar21 = *(byte *)(lVar4 + 0x48); - uVar13 = (undefined7)((ulonglong)lVar11 >> 8); - pbVar24 = *(byte **)(lVar4 + 0x20); - bVar22 = *(byte *)(lVar4 + 0xb); - uVar23 = *(undefined1 *)(lVar4 + 4); + bVar20 = *(byte *)(lVar4 + 0x48); + uVar10 = (undefined7)(uVar8 >> 8); + pbVar23 = *(byte **)(lVar4 + 0x20); + bVar19 = *(byte *)(lVar4 + 0xb); + uVar22 = *(undefined1 *)(lVar4 + 4); if (*(char *)(lVar4 + 2) != '\0') goto LAB_5; } - pbVar12 = (byte *)CONCAT71(uVar13,bVar21 - 8); - if ((bVar21 - 8 & 0x5d) != 0) goto LAB_5; - if (((*(char *)(lVar4 + 3) == '\x01') || (pbVar24 == (byte *)0x0)) || (bVar22 == 0)) { -LAB_9: - bVar5 = 0; - } - else { - bVar20 = 0; - pbVar12 = pbVar24 + bVar22; - bVar21 = bVar17; - if ((byte)((*pbVar24 & 0x7f) + 0x8e) < 2) { - bVar20 = bVar17; - bVar15 = bVar17; - if (pbVar24 + 8 <= pbVar12) { - bVar20 = 1; - bVar5 = pbVar24[3]; - bVar21 = pbVar24[1] & 0xf; - bVar15 = pbVar24[2]; - } - } - else { - bVar15 = local_68; - if (pbVar24 + 8 <= pbVar12) { - bVar21 = pbVar24[2] & 0xf; - uVar10 = (uint)bVar22; - if (pbVar24[7] + 8 <= (uint)bVar22) { - uVar10 = pbVar24[7] + 8; - } - pbVar12 = pbVar24 + 0xd; - if (pbVar24 + uVar10 < pbVar12) { - local_68 = 0; - } - else { - local_68 = pbVar24[0xc]; - } - if (pbVar24 + 0xe <= pbVar24 + uVar10) { - bVar5 = *pbVar12; - } - bVar20 = 1; - bVar15 = local_68; - } - } - if (bVar20 == 0) goto LAB_9; - pbVar19 = (byte *)(ulonglong)bVar15; - bVar17 = bVar21; - } - local_88 = SUB81(pbVar19,0); - local_98 = CONCAT31(local_98._1_3_,uVar23); - local_a0 = (byte *)CONCAT71(local_a0._1_7_,*(undefined1 *)(lVar4 + 3)); - local_a8 = (char *)CONCAT44(local_a8._4_4_,*(undefined4 *)(param_2 + 0x30)); - local_90 = bVar17; - local_80 = bVar5; - local_78 = param_2; - McTemplateK0pduuuuup_EtwWriteTransfer(pbVar12,lVar4,&local_50,param_2); + pbVar21 = (byte *)0x0; + bVar12 = 0; + pbVar13 = (byte *)CONCAT71(uVar10,bVar20 - 8); + if ((bVar20 - 8 & 0x5d) == 0) { + local_80 = bVar14; + if (((*(char *)(lVar4 + 3) != '\x01') && (pbVar23 != (byte *)0x0)) && (bVar19 != 0)) { + bVar17 = 0; + pbVar13 = pbVar23 + bVar19; + bVar20 = bVar14; + if ((byte)((*pbVar23 & 0x7f) + 0x8e) < 2) { + bVar17 = bVar14; + if (pbVar23 + 8 <= pbVar13) { + bVar17 = 1; + pbVar21 = (byte *)(ulonglong)pbVar23[2]; + bVar20 = pbVar23[1] & 0xf; + bVar12 = pbVar23[3]; + } + } + else { + if (pbVar23 + 8 <= pbVar13) { + bVar20 = pbVar23[2] & 0xf; + uVar9 = (uint)bVar19; + if (pbVar23[7] + 8 <= (uint)bVar19) { + uVar9 = pbVar23[7] + 8; + } + pbVar13 = pbVar23 + 0xd; + if (pbVar23 + uVar9 < pbVar13) { + local_68 = 0; + } + else { + local_68 = pbVar23[0xc]; + } + if (pbVar23 + uVar9 < pbVar23 + 0xe) { + local_67 = 0; + } + else { + local_67 = *pbVar13; + } + bVar17 = 1; + } + pbVar21 = (byte *)(ulonglong)local_68; + bVar12 = local_67; + } + if (bVar17 != 0) { + pbVar16 = pbVar21; + bVar14 = bVar20; + local_80 = bVar12; + } + } + local_88 = SUB81(pbVar16,0); + local_98 = CONCAT31(local_98._1_3_,uVar22); + local_a0 = (byte *)CONCAT71(local_a0._1_7_,*(undefined1 *)(lVar4 + 3)); + local_a8 = (byte *)CONCAT44(local_a8._4_4_,*(undefined4 *)(param_2 + 0x30)); + local_90 = bVar14; + local_78 = param_2; + McTemplateK0pduuuuup_EtwWriteTransfer(pbVar13,lVar4,local_50,param_2); + } goto LAB_5; } if (cVar1 != '\x1b') goto LAB_5; if ((pcVar3[1] == '\a') && (*(int *)(pcVar3 + 8) == 0)) { if ((DAT_6 & 0x40) != 0) { if (*(uint **)(param_2 + 0x38) != (uint *)0x0) { - uVar18 = **(uint **)(param_2 + 0x38); + uVar15 = **(uint **)(param_2 + 0x38); } local_a0 = (byte *)CONCAT44(local_a0._4_4_,*(undefined4 *)(param_2 + 0x30)); - local_a8 = (char *)CONCAT44(local_a8._4_4_,uVar18); - McTemplateK0pqd_EtwWriteTransfer(uVar27,pcVar3,&local_50,param_2); + local_a8 = (byte *)CONCAT44(local_a8._4_4_,uVar15); + McTemplateK0pqd_EtwWriteTransfer(uVar26,pcVar3,local_50,param_2); } goto LAB_5; } - if ((DAT_6 & 0x20) == 0) goto LAB_14009d2e6; - puVar14 = &EventPnpRequestComplete; + if ((DAT_6 & 0x20) == 0) goto LAB_14009d3ee; + puVar11 = &EventPnpRequestComplete; } - local_a8 = (char *)CONCAT44(local_a8._4_4_,*(undefined4 *)(param_2 + 0x30)); - McTemplateK0pd_EtwWriteTransfer(uVar27,puVar14,&local_50,param_2); + local_a8 = (byte *)CONCAT44(local_a8._4_4_,*(undefined4 *)(param_2 + 0x30)); + McTemplateK0pd_EtwWriteTransfer(uVar26,puVar11,local_50,param_2); LAB_5: IofCompleteRequest(param_2,0); return (ulonglong)uVar7; } ``` ## RaidAdapterSendCryptoOperationSynchronously ### Match Info |Key|storport-10.0.26100.7309.sys - storport-10.0.26100.7705.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.81| |i_ratio|0.48| |m_ratio|0.95| |b_ratio|0.95| |match_types|SymbolsHash| ### Function Meta Diff |Key|storport-10.0.26100.7309.sys|storport-10.0.26100.7705.sys| | :---: | :---: | :---: | |name|RaidAdapterSendCryptoOperationSynchronously|RaidAdapterSendCryptoOperationSynchronously| |fullname|RaidAdapterSendCryptoOperationSynchronously|RaidAdapterSendCryptoOperationSynchronously| |refcount|2|2| |`length`|205|231| |`called`|NTOSKRNL.EXE::KeBugCheckEx
RaCallMiniportAdapterControl
RaidDriverGetName
RaidIsAdapterControlSupported|Feature_FixSteelixUfsIceRegression__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::KeBugCheckEx
RaCallMiniportAdapterControl
RaidDriverGetName
RaidIsAdapterControlSupported| |calling|RaidAdapterProgramCryptoKeyRoutine|RaidAdapterProgramCryptoKeyRoutine| |paramcount|0|0| |`address`|14006a50c|14006a5dc| |sig|undefined RaidAdapterSendCryptoOperationSynchronously(void)|undefined RaidAdapterSendCryptoOperationSynchronously(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### RaidAdapterSendCryptoOperationSynchronously Called Diff ```diff --- RaidAdapterSendCryptoOperationSynchronously called +++ RaidAdapterSendCryptoOperationSynchronously called @@ -0,0 +1 @@ +Feature_FixSteelixUfsIceRegression__private_IsEnabledDeviceUsageNoInline ``` ### RaidAdapterSendCryptoOperationSynchronously Diff ```diff --- RaidAdapterSendCryptoOperationSynchronously +++ RaidAdapterSendCryptoOperationSynchronously @@ -1,36 +1,39 @@ undefined8 RaidAdapterSendCryptoOperationSynchronously(longlong param_1,undefined8 param_2,short *param_3) { char cVar1; - undefined8 uVar2; + int iVar2; + undefined8 uVar3; undefined4 local_28; undefined4 local_24; short *local_20; undefined8 local_18; undefined8 uStack_10; - if (*(longlong *)(param_1 + 0x15f8) != 0) { + iVar2 = Feature_FixSteelixUfsIceRegression__private_IsEnabledDeviceUsageNoInline(); + if ((*(longlong *)(param_1 + 0x15f8) != 0) || + ((iVar2 != 0 && (*(longlong *)(param_1 + 0x15f0) != 0)))) { cVar1 = RaidIsAdapterControlSupported(param_1 + 0x178,0x12); if (cVar1 != '\0') { if ((*param_3 == 1) && (param_3[1] == 0x28)) { local_28 = 1; local_24 = 0x28; local_20 = param_3; - uVar2 = RaCallMiniportAdapterControl(param_1 + 0x178,0x12,&local_28); - if ((int)uVar2 == 0) { - return uVar2; + uVar3 = RaCallMiniportAdapterControl(param_1 + 0x178,0x12,&local_28); + if ((int)uVar3 == 0) { + return uVar3; } local_18 = 0; uStack_10 = 0; RaidDriverGetName(*(undefined8 *)(param_1 + 0x10),&local_18); /* WARNING: Subroutine does not return */ KeBugCheckEx(0xf0,4,uStack_10,1,0); } return 0xc000000d; } } return 0xc00000bb; } ``` # Modified (No Code Changes) *Slightly modified functions have no code changes, rather differnces in:* - refcount - length - called - calling - name - fullname ## wil_details_IsEnabledFallback ### Match Info |Key|storport-10.0.26100.7309.sys - storport-10.0.26100.7705.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.83| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|storport-10.0.26100.7309.sys|storport-10.0.26100.7705.sys| | :---: | :---: | :---: | |name|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |fullname|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |`refcount`|39|41| |length|140|140| |called|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath| |`calling`|

Expand for full list:
Feature_1399886139__private_IsEnabledFallback
Feature_3734030650__private_IsEnabledFallback
Feature_EnableAENAtEndOfDeviceInit__private_IsEnabledFallback
Feature_FirmwareIOCTLBehaviorConsistency__private_IsEnabledFallback
Feature_FixAERZombieResetRecovery__private_IsEnabledFallback
Feature_FixDeadlockInSplitIoBatchRingingDoorbell__private_IsEnabledFallback
Feature_FixDeviceStopRestartForAzureStorageRepaveNode__private_IsEnabledFallback
Feature_FixKcsanRacyAccessIssues__private_IsEnabledFallback
Feature_FixModernStandbyDRIPSForMultipleSSD__private_IsEnabledFallback
Feature_FixNativeNVMeLEDIndication__private_IsEnabledFallback
Feature_FixNullCQEFirmwareCompletion__private_IsEnabledFallback

Feature_FixPnPRestartNVMeControllerIssue__private_IsEnabledFallback
Feature_FixPowerDownLooping__private_IsEnabledFallback
Feature_FixReconfigureAsyncEventWorkflow__private_IsEnabledFallback
Feature_FixResourceLeakOnControllerSurpriseRemoval__private_IsEnabledFallback
Feature_FixSanitizeParameterValidation__private_IsEnabledFallback
Feature_FixScsiRequestDMARIssue__private_IsEnabledFallback
Feature_FixSingleInterruptMessageScenario__private_IsEnabledFallback
Feature_FixTrimRequestParameterValidation__private_IsEnabledFallback
Feature_FixUnitSurpriseRemoveStuck__private_IsEnabledFallback
Feature_HardenCodeForPassthroughCommand__private_IsEnabledFallback
Feature_HardenReadCapacity__private_IsEnabledFallback
Feature_NVMeDiskSizeDynamicExtend__private_IsEnabledFallback
Feature_NamespaceRundownCrash__private_IsEnabledFallback
Feature_NativeNVMeStackForGeClient__private_IsEnabledFallback
Feature_NativeNVMeStackForGeServer__private_IsEnabledFallback
Feature_PLDRFixes__private_IsEnabledFallback
Feature_PerLunLocking__private_IsEnabledFallback
Feature_Servicing_AtaOutOfBoundAccessFix__private_IsEnabledFallback
Feature_Servicing_NativeNVMe__private_IsEnabledFallback
Feature_Servicing_ScsiPassthroughRobustness__private_IsEnabledFallback
Feature_Servicing_perLunLockingEnable__private_IsEnabledFallback
Feature_SetPciLinkBandwidthIoctl__private_IsEnabledFallback
Feature_SteelixInlineNvmeCryptoEngine__private_IsEnabledFallback
Feature_SteelixWarning26015__private_IsEnabledFallback
Feature_UfsTelemetryAndHealth__private_IsEnabledFallback
Feature_VsFidTimeoutOverride__private_IsEnabledFallback
Feature_WorkAroundNVMeDeviceIssueCause1ByteMemoryCorruption__private_IsEnabledFallback

Feature_FixPnPRestartNVMeControllerIssue__private_IsEnabledFallback
Feature_FixPowerDownLooping__private_IsEnabledFallback
Feature_FixReconfigureAsyncEventWorkflow__private_IsEnabledFallback
Feature_FixResourceLeakOnControllerSurpriseRemoval__private_IsEnabledFallback
Feature_FixSanitizeParameterValidation__private_IsEnabledFallback
Feature_FixScsiRequestDMARIssue__private_IsEnabledFallback
Feature_FixSingleInterruptMessageScenario__private_IsEnabledFallback
Feature_FixSteelixUfsIceRegression__private_IsEnabledFallback
Feature_FixTrimRequestParameterValidation__private_IsEnabledFallback
Feature_FixUnitSurpriseRemoveStuck__private_IsEnabledFallback
Feature_HardenCodeForPassthroughCommand__private_IsEnabledFallback
Feature_HardenReadCapacity__private_IsEnabledFallback
Feature_NVMeDiskSizeDynamicExtend__private_IsEnabledFallback
Feature_NamespaceRundownCrash__private_IsEnabledFallback
Feature_NativeNVMeStackForGeClient__private_IsEnabledFallback
Feature_NativeNVMeStackForGeServer__private_IsEnabledFallback
Feature_PLDRFixes__private_IsEnabledFallback
Feature_PerLunLocking__private_IsEnabledFallback
Feature_Servicing_AtaOutOfBoundAccessFix__private_IsEnabledFallback
Feature_Servicing_NativeNVMe__private_IsEnabledFallback
Feature_Servicing_ScsiPassthroughRobustness__private_IsEnabledFallback
Feature_Servicing_StorageSetProperty_BufferCheck__private_IsEnabledFallback
Feature_Servicing_perLunLockingEnable__private_IsEnabledFallback
Feature_SetPciLinkBandwidthIoctl__private_IsEnabledFallback
Feature_SteelixInlineNvmeCryptoEngine__private_IsEnabledFallback
Feature_SteelixWarning26015__private_IsEnabledFallback
Feature_UfsTelemetryAndHealth__private_IsEnabledFallback
Feature_VsFidTimeoutOverride__private_IsEnabledFallback
Feature_WorkAroundNVMeDeviceIssueCause1ByteMemoryCorruption__private_IsEnabledFallback

| |paramcount|0|0| |`address`|1400689b4|140068a34| |sig|undefined wil_details_IsEnabledFallback(void)|undefined wil_details_IsEnabledFallback(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### wil_details_IsEnabledFallback Calling Diff ```diff --- wil_details_IsEnabledFallback calling +++ wil_details_IsEnabledFallback calling @@ -18,0 +19 @@ +Feature_FixSteelixUfsIceRegression__private_IsEnabledFallback @@ -31,0 +33 @@ +Feature_Servicing_StorageSetProperty_BufferCheck__private_IsEnabledFallback ``` _{Generated with `ghidriff` version: 1.0.0 on 2026-07-24T23:07:13}