# udf_4652.sys-udf_8036.sys Diff # TOC * [Visual Chart Diff](#visual-chart-diff) * [Metadata](#metadata) * [Ghidra Diff Engine](#ghidra-diff-engine) * [Command Line](#command-line) * [Binary Metadata Diff](#binary-metadata-diff) * [Program Options](#program-options) * [Diff Stats](#diff-stats) * [Strings](#strings) * [Deleted](#deleted) * [Added](#added) * [UdfSetPositionInfo](#udfsetpositioninfo) * [NTOSKRNL.EXE::IoWithinStackLimits](#ntoskrnlexeiowithinstacklimits) * [Modified](#modified) * [wil_details_FeatureReporting_ReportUsageToServiceDirect](#wil_details_featurereporting_reportusagetoservicedirect) * [UdfMapMetadataView](#udfmapmetadataview) * [wil_details_FeatureReporting_ReportUsageToService](#wil_details_featurereporting_reportusagetoservice) * [wil_details_IsEnabledFallback](#wil_details_isenabledfallback) * [UdfSetEndOfFileInfo](#udfsetendoffileinfo) * [UdfFreeStringBuffer](#udffreestringbuffer) * [UdfSetThreadContext](#udfsetthreadcontext) * [UdfFsdDispatch](#udffsddispatch) * [UdfSetAllocationInfo](#udfsetallocationinfo) * [UdfCommonSetInfo](#udfcommonsetinfo) * [wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath](#wil_details_featurestatecache_tryenabledeviceusagefastpath) * [Feature_1627960633__private_IsEnabledFallback](#feature_1627960633__private_isenabledfallback) * [Feature_1627960633__private_IsEnabledFallback](#feature_1627960633__private_isenabledfallback) * [Modified (No Code Changes)](#modified-no-code-changes) * [NTOSKRNL.EXE::IoGetTopLevelIrp](#ntoskrnlexeiogettoplevelirp) * [NTOSKRNL.EXE::ExAcquireResourceExclusiveLite](#ntoskrnlexeexacquireresourceexclusivelite) * [NTOSKRNL.EXE::IoGetStackLimits](#ntoskrnlexeiogetstacklimits) * [NTOSKRNL.EXE::ExRaiseStatus](#ntoskrnlexeexraisestatus) * [UdfAcquireResource](#udfacquireresource) # Visual Chart Diff ```mermaid flowchart LR wil_details_FeatureReporting_ReportUsageToServiceDirect-3-old<--Match 95%-->wil_details_FeatureReporting_ReportUsageToServiceDirect-3-new UdfMapMetadataView-7-old<--Match 93%-->UdfMapMetadataView-7-new wil_details_FeatureReporting_ReportUsageToService-3-old<--Match 94%-->wil_details_FeatureReporting_ReportUsageToService-3-new wil_details_IsEnabledFallback-2-old<--Match 94%-->wil_details_IsEnabledFallback-2-new UdfSetEndOfFileInfo-5-old<--Match 66%-->UdfSetEndOfFileInfo-5-new UdfFreeStringBuffer-1-old<--Match 61%-->UdfFreeStringBuffer-1-new UdfSetThreadContext-2-old<--Match 65%-->UdfSetThreadContext-2-new UdfFsdDispatch-2-old<--Match 87%-->UdfFsdDispatch-2-new UdfSetAllocationInfo-5-old<--Match 80%-->UdfSetAllocationInfo-5-new UdfCommonSetInfo-2-old<--Match 89%-->UdfCommonSetInfo-2-new wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath-2-old<--Match 90%-->wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath-2-new Feature_1627960633__private_IsEnabledFallback-2-old<--Match 89%-->Feature_Use_Proper_Within_Stack_API__private_IsEnabledFallback-2-new Feature_1627960633__private_IsEnabledFallback-2-old<--Match 89%-->Feature_3887279419__private_IsEnabledFallback-2-new subgraph udf_8036.sys wil_details_FeatureReporting_ReportUsageToServiceDirect-3-new UdfMapMetadataView-7-new wil_details_FeatureReporting_ReportUsageToService-3-new wil_details_IsEnabledFallback-2-new UdfSetEndOfFileInfo-5-new UdfFreeStringBuffer-1-new UdfSetThreadContext-2-new UdfFsdDispatch-2-new UdfSetAllocationInfo-5-new UdfCommonSetInfo-2-new wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath-2-new Feature_Use_Proper_Within_Stack_API__private_IsEnabledFallback-2-new Feature_3887279419__private_IsEnabledFallback-2-new subgraph Added direction LR UdfSetPositionInfo NTOSKRNLEXE-IoWithinStackLimits end end subgraph udf_4652.sys wil_details_FeatureReporting_ReportUsageToServiceDirect-3-old UdfMapMetadataView-7-old wil_details_FeatureReporting_ReportUsageToService-3-old wil_details_IsEnabledFallback-2-old UdfSetEndOfFileInfo-5-old UdfFreeStringBuffer-1-old UdfSetThreadContext-2-old UdfFsdDispatch-2-old UdfSetAllocationInfo-5-old UdfCommonSetInfo-2-old wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath-2-old Feature_1627960633__private_IsEnabledFallback-2-old Feature_1627960633__private_IsEnabledFallback-2-old end ``` ```mermaid pie showData title Function Matches - 99.8993% "unmatched_funcs_len" : 2 "matched_funcs_len" : 1984 ``` ```mermaid pie showData title Matched Function Similarity - 98.9919% "matched_funcs_with_code_changes_len" : 13 "matched_funcs_with_non_code_changes_len" : 7 "matched_funcs_no_changes_len" : 1964 ``` # Metadata ## Ghidra Diff Engine ### Command Line #### Captured Command Line ``` ghidriff --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --bsim --max-ram-percent 60.0 --max-section-funcs 200 udf_4652.sys udf_8036.sys ``` #### Verbose Args
``` --old ['udf_4652.sys'] --new [['udf_8036.sys']] --engine VersionTrackingDiff --output-path udf2_out --summary False --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim True --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title None ```
#### Download Original PEs ``` wget https://msdl.microsoft.com/download/symbols/udfs.sys/9ADA26E662000/udfs.sys -O udfs.sys.x64.10.0.26100.4652 wget https://msdl.microsoft.com/download/symbols/udfs.sys/F429A1F463000/udfs.sys -O udfs.sys.x64.10.0.26100.8036 ``` ## Binary Metadata Diff ```diff --- udf_4652.sys Meta +++ udf_8036.sys Meta @@ -1,44 +1,44 @@ -Program Name: udf_4652.sys +Program Name: udf_8036.sys Language ID: x86:LE:64:default (4.6) Compiler ID: windows Processor: x86 Endian: Little Address Size: 64 -Minimum Address: 1c0000000 +Minimum Address: 140000000 Maximum Address: ff0000184f -# of Bytes: 407632 +# of Bytes: 411728 # of Memory Blocks: 13 -# of Instructions: 74405 -# of Defined Data: 1904 -# of Functions: 991 -# of Symbols: 8147 +# of Instructions: 74473 +# of Defined Data: 2044 +# of Functions: 995 +# of Symbols: 8234 # of Data Types: 149 # of Data Type Categories: 11 Analyzed: true Compiler: visualstudio:unknown Created With Ghidra Version: 12.0.4 -Date Created: Tue Aug 18 21:51:06 SGT 2026 +Date Created: Tue Aug 18 21:51:09 SGT 2026 Executable Format: Portable Executable (PE) -Executable Location: /tmp/udf/udf_4652.sys -Executable MD5: e5aad57baee7613392e0c0f4690b5613 -Executable SHA256: e59b37291154485d953be7e0822cfab8769a15e6586a0cacb4ce53ce55ad8ca8 -FSRL: file:///tmp/udf/udf_4652.sys?MD5=e5aad57baee7613392e0c0f4690b5613 +Executable Location: /tmp/udf/udf_8036.sys +Executable MD5: 80d3d09e1b023d24aa99893ddbf513ee +Executable SHA256: b5a65e7991f3fedbd3547edf494c0dd9b7eafcd53011d90a7b2bc265341c705a +FSRL: file:///tmp/udf/udf_8036.sys?MD5=80d3d09e1b023d24aa99893ddbf513ee PDB Age: 1 PDB File: udfs.pdb -PDB GUID: 0bdcd021-6c94-7559-c2a1-e2fec5d3a09e +PDB GUID: c5c431b7-b974-6d18-2995-72de58bdeaeb PDB Loaded: true PDB Version: RSDS PE Property[CompanyName]: Microsoft Corporation PE Property[FileDescription]: UDF File System Driver -PE Property[FileVersion]: 10.0.26100.4652 (WinBuild.160101.0800) +PE Property[FileVersion]: 10.0.26100.8036 (WinBuild.160101.0800) PE Property[InternalName]: udfs.sys PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved. PE Property[OriginalFilename]: udfs.sys PE Property[ProductName]: Microsoft® Windows® Operating System -PE Property[ProductVersion]: 10.0.26100.4652 +PE Property[ProductVersion]: 10.0.26100.8036 PE Property[Translation]: 4b00409 Preferred Root Namespace Category: RTTI Found: false Relocatable: true SectionAlignment: 4096 Should Ask To Analyze: false ``` ## Program Options
Ghidra udf_4652.sys Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra udf_4652.sys Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra udf_4652.sys Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.Apply Function Calling Conventions|true| |Demangler Microsoft.Apply Function Signatures|true| |Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS| |Demangler Microsoft.Demangle Only Known Mangled Symbols|false| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
Ghidra udf_8036.sys Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra udf_8036.sys Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra udf_8036.sys Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.Apply Function Calling Conventions|true| |Demangler Microsoft.Apply Function Signatures|true| |Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS| |Demangler Microsoft.Demangle Only Known Mangled Symbols|false| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
## Diff Stats |Stat|Value| | :---: | :---: | |added_funcs_len|2| |deleted_funcs_len|0| |modified_funcs_len|20| |added_symbols_len|56| |deleted_symbols_len|7| |diff_time|4.658158302307129| |deleted_strings_len|0| |added_strings_len|0| |match_types|Counter({'SymbolsHash': 988, 'ExternalsName': 226, 'BulkBasicBlockMnemonicHash': 2, 'Implied Match': 2})| |items_to_process|85| |diff_types|Counter({'address': 16, 'code': 13, 'length': 13, 'calling': 11, 'refcount': 9, 'called': 9, 'sig': 8, 'name': 4, 'fullname': 4})| |unmatched_funcs_len|2| |total_funcs_len|1986| |matched_funcs_len|1984| |matched_funcs_with_code_changes_len|13| |matched_funcs_with_non_code_changes_len|7| |matched_funcs_no_changes_len|1964| |match_func_similarity_percent|98.9919%| |func_match_overall_percent|99.8993%| |first_matches|Counter({'SymbolsHash': 988, 'BulkBasicBlockMnemonicHash': 2, 'Implied Match': 2})| ```mermaid pie showData title All Matches "SymbolsHash" : 988 "ExternalsName" : 226 "BulkBasicBlockMnemonicHash" : 2 "Implied-Match" : 2 ``` ```mermaid pie showData title First Matches "SymbolsHash" : 988 "BulkBasicBlockMnemonicHash" : 2 "Implied-Match" : 2 ``` ```mermaid pie showData title Diff Stats "added_funcs_len" : 2 "deleted_funcs_len" : 0 "modified_funcs_len" : 20 ``` ```mermaid pie showData title Symbols "added_symbols_len" : 56 "deleted_symbols_len" : 7 ``` ## Strings *No string differences found* # Deleted # Added ## UdfSetPositionInfo ### Function Meta |Key|udf_8036.sys| | :---: | :---: | |name|UdfSetPositionInfo| |fullname|UdfSetPositionInfo| |refcount|2| |length|91| |called|Feature_3887279419__private_IsEnabledDeviceUsageNoInline| |calling|UdfCommonSetInfo| |paramcount|4| |address|140033ff8| |sig|undefined8 __fastcall UdfSetPositionInfo(longlong param_1, longlong param_2, undefined8 param_3, uint * param_4)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- UdfSetPositionInfo +++ UdfSetPositionInfo @@ -0,0 +1,17 @@ + +undefined8 UdfSetPositionInfo(longlong param_1,longlong param_2,undefined8 param_3,uint *param_4) + +{ + ulonglong uVar1; + + if ((((*(uint *)(param_2 + 0x50) & 8) == 0) || + ((*param_4 & + *(uint *)(*(longlong *)(*(longlong *)(*(longlong *)(param_1 + 8) + 0xb8) + 0x28) + 0x98)) == + 0)) && ((uVar1 = Feature_3887279419__private_IsEnabledDeviceUsageNoInline(), (int)uVar1 == 0 + || (-1 < *(longlong *)param_4)))) { + *(undefined8 *)(param_2 + 0x68) = *(undefined8 *)param_4; + return 0; + } + return 0xc000000d; +} + ``` ## NTOSKRNL.EXE::IoWithinStackLimits ### Function Meta |Key|udf_8036.sys| | :---: | :---: | |name|IoWithinStackLimits| |fullname|NTOSKRNL.EXE::IoWithinStackLimits| |refcount|3| |length|0| |called|| |calling|UdfFreeStringBuffer
UdfSetThreadContext| |paramcount|0| |address|EXTERNAL:000000a6| |sig|undefined IoWithinStackLimits(void)| |sym_type|Function| |sym_source|IMPORTED| |external|True| *No code available for NTOSKRNL.EXE::IoWithinStackLimits* # Modified *Modified functions contain code changes* ## wil_details_FeatureReporting_ReportUsageToServiceDirect ### Match Info |Key|udf_4652.sys - udf_8036.sys| | :---: | :---: | |diff_type|code,length,sig,address| |ratio|0.35| |i_ratio|0.53| |m_ratio|0.95| |b_ratio|0.95| |match_types|SymbolsHash| ### Function Meta Diff |Key|udf_4652.sys|udf_8036.sys| | :---: | :---: | :---: | |name|wil_details_FeatureReporting_ReportUsageToServiceDirect|wil_details_FeatureReporting_ReportUsageToServiceDirect| |fullname|wil_details_FeatureReporting_ReportUsageToServiceDirect|wil_details_FeatureReporting_ReportUsageToServiceDirect| |refcount|2|2| |`length`|226|232| |called|NTOSKRNL.EXE::RtlNotifyFeatureUsage
__security_check_cookie
_guard_dispatch_icall
wil_details_FeatureReporting_RecordUsageInCache|NTOSKRNL.EXE::RtlNotifyFeatureUsage
__security_check_cookie
_guard_dispatch_icall
wil_details_FeatureReporting_RecordUsageInCache| |calling|wil_details_FeatureReporting_ReportUsageToService|wil_details_FeatureReporting_ReportUsageToService| |paramcount|3|3| |`address`|1c00101f4|140011400| |`sig`|bool __fastcall wil_details_FeatureReporting_ReportUsageToServiceDirect(undefined8 param_1, undefined8 param_2, ulonglong param_3)|bool __fastcall wil_details_FeatureReporting_ReportUsageToServiceDirect(longlong param_1, undefined8 param_2, ulonglong param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### wil_details_FeatureReporting_ReportUsageToServiceDirect Diff ```diff --- wil_details_FeatureReporting_ReportUsageToServiceDirect +++ wil_details_FeatureReporting_ReportUsageToServiceDirect @@ -1,47 +1,46 @@ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ bool wil_details_FeatureReporting_ReportUsageToServiceDirect - (undefined8 param_1,undefined8 param_2,ulonglong param_3) + (longlong param_1,undefined8 param_2,ulonglong param_3) { uint6 uVar1; uint *puVar2; - undefined1 auStack_88 [32]; - uint *local_68; - undefined8 local_58; - uint local_50 [6]; - uint local_38; - uint uStack_34; - uint uStack_30; - uint uStack_2c; - undefined8 local_28; - ulonglong local_20; + undefined1 auStack_98 [32]; + uint *local_78; + undefined8 local_68; + uint local_60 [6]; + uint local_48; + uint uStack_44; + uint uStack_40; + uint uStack_3c; + undefined8 local_38; + ulonglong local_30; - local_20 = __security_cookie ^ (ulonglong)auStack_88; + local_30 = __security_cookie ^ (ulonglong)auStack_98; puVar2 = wil_details_FeatureReporting_RecordUsageInCache - (local_50,(uint *)&Feature_1627960633__private_reporting,param_3, - (uint)((ulonglong)param_2 >> 0x20)); - local_38 = *puVar2; - uStack_34 = puVar2[1]; - uStack_30 = puVar2[2]; - uStack_2c = puVar2[3]; - local_28 = *(undefined8 *)(puVar2 + 4); + (local_60,*(uint **)(param_1 + 8),param_3,(uint)((ulonglong)param_2 >> 0x20)); + local_48 = *puVar2; + uStack_44 = puVar2[1]; + uStack_40 = puVar2[2]; + uStack_3c = puVar2[3]; + local_38 = *(undefined8 *)(puVar2 + 4); if (g_wil_details_recordFeatureUsage != (code *)0x0) { - local_68 = &local_38; + local_78 = &local_48; (*g_wil_details_recordFeatureUsage) - (0x3711c06,param_3 & 0xffffffff,1,&Feature_1627960633__private_reporting); + (*(undefined4 *)(param_1 + 0x18),param_3 & 0xffffffff,1,*(undefined8 *)(param_1 + 8)); } if ((((uint)param_2 >> 10 & 1) != 0) && ((int)param_3 != 0xfe)) { - local_58._0_6_ = CONCAT24((short)(param_3 & 0xffffffff),0x3711c06); - uVar1 = (uint6)local_58; - local_58 = (ulonglong)(uint6)local_58; + local_68._0_6_ = CONCAT24((short)(param_3 & 0xffffffff),*(undefined4 *)(param_1 + 0x18)); + uVar1 = (uint6)local_68; + local_68 = (ulonglong)(uint6)local_68; if (((uint)param_2 >> 0xb & 1) != 0) { - local_58 = CONCAT26(1,uVar1); + local_68 = CONCAT26(1,uVar1); } - RtlNotifyFeatureUsage(&local_58); + RtlNotifyFeatureUsage(&local_68); } - return (int)local_28 == 0; + return (int)local_38 == 0; } ``` ## UdfMapMetadataView ### Match Info |Key|udf_4652.sys - udf_8036.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.79| |i_ratio|0.67| |m_ratio|0.99| |b_ratio|0.93| |match_types|SymbolsHash| ### Function Meta Diff |Key|udf_4652.sys|udf_8036.sys| | :---: | :---: | :---: | |name|UdfMapMetadataView|UdfMapMetadataView| |fullname|UdfMapMetadataView|UdfMapMetadataView| |refcount|15|15| |`length`|693|668| |`called`|Feature_1627960633__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::CcMapData
NTOSKRNL.EXE::CcPinRead
NTOSKRNL.EXE::ExAcquireResourceSharedLite
NTOSKRNL.EXE::KeDelayExecutionThread
UdfLookupMetaVsnOfExtent
UdfRaiseStatusEx
UdfSeqCacheReserveFileRegion
UdfSeqCacheUnblockVatVPartBcb
UdfUnpinView|NTOSKRNL.EXE::CcMapData
NTOSKRNL.EXE::CcPinRead
NTOSKRNL.EXE::ExAcquireResourceSharedLite
NTOSKRNL.EXE::KeDelayExecutionThread
UdfLookupMetaVsnOfExtent
UdfRaiseStatusEx
UdfSeqCacheReserveFileRegion
UdfSeqCacheUnblockVatVPartBcb
UdfUnpinView| |calling|
Expand for full list:
UdfCommonRead
UdfCreateNewIcb
UdfGetNextAllocationPostProcessing
UdfInitializeAllocations
UdfInitializeIcbContext
UdfInitializeIcbContextFromScb
UdfLookupActiveIcb
UdfLookupActiveIcbInExtent
UdfPowReserveMetaDataBlocks
UdfPrepareModifyIcbForScb
UdfSetFsLabelInfoUdfUpdateAdsFromScb
UdfVerifyObjectOnMedia
|
Expand for full list:
UdfCommonRead
UdfCreateNewIcb
UdfGetNextAllocationPostProcessing
UdfInitializeAllocations
UdfInitializeIcbContext
UdfInitializeIcbContextFromScb
UdfLookupActiveIcb
UdfLookupActiveIcbInExtent
UdfPowReserveMetaDataBlocks
UdfPrepareModifyIcbForScb
UdfSetFsLabelInfoUdfUpdateAdsFromScb
UdfVerifyObjectOnMedia
| |paramcount|7|7| |`address`|1c004beb0|14004cf00| |sig|undefined __fastcall UdfMapMetadataView(longlong param_1, undefined8 * param_2, longlong param_3, short param_4, uint param_5, undefined4 param_6, uint param_7)|undefined __fastcall UdfMapMetadataView(longlong param_1, undefined8 * param_2, longlong param_3, short param_4, uint param_5, undefined4 param_6, uint param_7)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UdfMapMetadataView Called Diff ```diff --- UdfMapMetadataView called +++ UdfMapMetadataView called @@ -1 +0,0 @@ -Feature_1627960633__private_IsEnabledDeviceUsageNoInline ``` ### UdfMapMetadataView Diff ```diff --- UdfMapMetadataView +++ UdfMapMetadataView @@ -1,101 +1,100 @@ void UdfMapMetadataView(longlong param_1,undefined8 *param_2,longlong param_3,short param_4, uint param_5,undefined4 param_6,uint param_7) { char cVar1; - ulonglong uVar2; - uint uVar3; + uint uVar2; + ulonglong uVar3; undefined8 uVar4; longlong lVar5; bool bVar6; - int local_40 [2]; - ulonglong local_38 [2]; + int local_50 [2]; + ulonglong local_48 [2]; bVar6 = *(longlong *)(param_3 + 0x160) != 0; UdfUnpinView(param_1,param_2); if ((param_7 & 2) == 0) { *(short *)(param_2 + 2) = param_4; *(uint *)((longlong)param_2 + 0x14) = param_5; *(undefined4 *)(param_2 + 3) = param_6; *(undefined4 *)((longlong)param_2 + 0x1c) = 0xffffffff; param_2[1] = 0; *param_2 = 0; *(bool *)(param_2 + 4) = bVar6; *(bool *)((longlong)param_2 + 0x21) = param_4 == *(short *)(*(longlong *)(param_3 + 0x10) + 0x54); } if ((param_7 & 1) == 0) { if ((*(longlong *)(param_3 + 0x160) != 0) && ((param_7 & 0x10) != 0)) { UdfSeqCacheReserveFileRegion (param_1,*(longlong *)(param_3 + 0x160),*(uint *)(param_3 + 0x4c) & param_5, *(uint *)(param_3 + 0x50),(uint *)0x0,'\0', (byte)(*(uint *)(param_1 + 0x1c) >> 4) & 1); } if (*(char *)((longlong)param_2 + 0x21) == '\0') { if (bVar6) { lVar5 = *(longlong *)(param_3 + 0x160); } else { lVar5 = *(longlong *)(param_3 + 0x110); } uVar4 = *(undefined8 *)(lVar5 + 0x1f8); if ((*(longlong *)(param_3 + 0x158) == 0) && ((*(uint *)(param_3 + 0x30) & 0x20000000) == 0)) { cVar1 = '\0'; } else { cVar1 = '\x01'; } - uVar3 = UdfLookupMetaVsnOfExtent + uVar2 = UdfLookupMetaVsnOfExtent (param_1,param_3,(ulonglong)*(ushort *)(param_2 + 2), *(uint *)((longlong)param_2 + 0x14),*(uint *)(param_2 + 3),cVar1); - *(uint *)((longlong)param_2 + 0x1c) = uVar3; + *(uint *)((longlong)param_2 + 0x1c) = uVar2; } else { lVar5 = *(longlong *)(param_3 + 0x140); uVar4 = *(undefined8 *)(lVar5 + 0x1f8); *(undefined4 *)((longlong)param_2 + 0x1c) = *(undefined4 *)((longlong)param_2 + 0x14); ExAcquireResourceSharedLite(param_3 + 0x448,1); } - local_38[0] = (ulonglong)*(uint *)((longlong)param_2 + 0x1c) << + local_48[0] = (ulonglong)*(uint *)((longlong)param_2 + 0x1c) << ((byte)*(undefined4 *)(param_3 + 0x48) & 0x3f); - if ((*(longlong *)(lVar5 + 0x18) < (longlong)(*(uint *)(param_2 + 3) + local_38[0])) || - ((uVar2 = Feature_1627960633__private_IsEnabledDeviceUsageNoInline(), (int)uVar2 != 0 && - ((((local_38[0] - 1) + (ulonglong)*(uint *)(param_2 + 3) ^ local_38[0]) & 0xfffffffffffc0000 - ) != 0)))) { + uVar3 = (ulonglong)*(uint *)(param_2 + 3); + if ((*(longlong *)(lVar5 + 0x18) < (longlong)(uVar3 + local_48[0])) || + ((((uVar3 - 1) + local_48[0] ^ local_48[0]) & 0xfffffffffffc0000) != 0)) { /* WARNING: Subroutine does not return */ UdfRaiseStatusEx(param_1,0xc0000102,'\0'); } if ((*(uint *)(param_3 + 0x30) >> 0xe & 1) == 0) { - uVar3 = 10; - local_40[0] = -10000; - local_40[1] = 0xffffffff; + uVar2 = 10; + local_50[0] = -10000; + local_50[1] = 0xffffffff; if ((*(longlong *)(param_3 + 0x160) == 0) && ((*(uint *)(param_3 + 0x30) >> 0x1d & 1) == 0)) { bVar6 = false; } else { bVar6 = true; } - while (cVar1 = CcPinRead(uVar4,local_38,*(undefined4 *)(param_2 + 3),!bVar6,param_2 + 1, + while (cVar1 = CcPinRead(uVar4,local_48,*(undefined4 *)(param_2 + 3),!bVar6,param_2 + 1, param_2), cVar1 == '\0') { UdfSeqCacheUnblockVatVPartBcb(param_1,lVar5); - if (uVar3 == 0) { + if (uVar2 == 0) { bVar6 = false; } else { - uVar3 = uVar3 - 1; - if (uVar3 < 5) { - KeDelayExecutionThread(0,0,local_40); - local_40[0] = local_40[0] * 2; + uVar2 = uVar2 - 1; + if (uVar2 < 5) { + KeDelayExecutionThread(0,0,local_50); + local_50[0] = local_50[0] * 2; } } } } else { - CcMapData(uVar4,local_38,*(undefined4 *)(param_2 + 3),1,param_2 + 1,param_2); + CcMapData(uVar4,local_48,uVar3,1,param_2 + 1,param_2); } } return; } ``` ## wil_details_FeatureReporting_ReportUsageToService ### Match Info |Key|udf_4652.sys - udf_8036.sys| | :---: | :---: | |diff_type|code,length,sig,address| |ratio|0.63| |i_ratio|0.5| |m_ratio|0.94| |b_ratio|0.94| |match_types|SymbolsHash| ### Function Meta Diff |Key|udf_4652.sys|udf_8036.sys| | :---: | :---: | :---: | |name|wil_details_FeatureReporting_ReportUsageToService|wil_details_FeatureReporting_ReportUsageToService| |fullname|wil_details_FeatureReporting_ReportUsageToService|wil_details_FeatureReporting_ReportUsageToService| |refcount|2|2| |`length`|114|125| |called|_guard_dispatch_icall
wil_details_FeatureReporting_ReportUsageToServiceDirect
wil_details_MapReportingKind|_guard_dispatch_icall
wil_details_FeatureReporting_ReportUsageToServiceDirect
wil_details_MapReportingKind| |calling|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |paramcount|3|3| |`address`|1c0010178|14001137c| |`sig`|undefined __fastcall wil_details_FeatureReporting_ReportUsageToService(undefined8 param_1, undefined8 param_2, uint param_3)|undefined __fastcall wil_details_FeatureReporting_ReportUsageToService(longlong param_1, undefined8 param_2, int param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### wil_details_FeatureReporting_ReportUsageToService Diff ```diff --- wil_details_FeatureReporting_ReportUsageToService +++ wil_details_FeatureReporting_ReportUsageToService @@ -1,27 +1,26 @@ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ void wil_details_FeatureReporting_ReportUsageToService - (undefined8 param_1,undefined8 param_2,uint param_3) + (longlong param_1,undefined8 param_2,int param_3) { bool bVar1; uint uVar2; undefined7 extraout_var; - ulonglong uVar3; - uint uVar4; - uint local_res18 [4]; + uint uVar3; + int local_res18 [4]; - uVar4 = (uint)param_2 & 1; - uVar3 = (ulonglong)param_3; + uVar3 = (uint)param_2 & 1; local_res18[0] = param_3; - uVar2 = wil_details_MapReportingKind(param_3,uVar4); - bVar1 = wil_details_FeatureReporting_ReportUsageToServiceDirect(uVar3,param_2,(ulonglong)uVar2); + uVar2 = wil_details_MapReportingKind(param_3,uVar3); + bVar1 = wil_details_FeatureReporting_ReportUsageToServiceDirect(param_1,param_2,(ulonglong)uVar2); if (((int)CONCAT71(extraout_var,bVar1) != 0) && (g_wil_details_pfnFeatureLoggingHook != (code *)0x0)) { (*g_wil_details_pfnFeatureLoggingHook) - (0x3711c06,&Feature_1627960633_logged_traits,0,uVar4,local_res18,0,0,1); + (*(undefined4 *)(param_1 + 0x18),*(undefined8 *)(param_1 + 0x10),0,uVar3,local_res18,0 + ,0,1); } return; } ``` ## wil_details_IsEnabledFallback ### Match Info |Key|udf_4652.sys - udf_8036.sys| | :---: | :---: | |diff_type|code,refcount,length,sig,address,calling| |ratio|0.48| |i_ratio|0.43| |m_ratio|0.96| |b_ratio|0.94| |match_types|SymbolsHash| ### Function Meta Diff |Key|udf_4652.sys|udf_8036.sys| | :---: | :---: | :---: | |name|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |fullname|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |`refcount`|2|3| |`length`|135|140| |called|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath| |`calling`|Feature_1627960633__private_IsEnabledFallback|Feature_3887279419__private_IsEnabledFallback
Feature_Use_Proper_Within_Stack_API__private_IsEnabledFallback| |paramcount|2|3| |`address`|1c00105a4|1400117c4| |`sig`|uint __fastcall wil_details_IsEnabledFallback(undefined4 * param_1, uint param_2)|uint __fastcall wil_details_IsEnabledFallback(ulonglong param_1, int param_2, undefined8 * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### wil_details_IsEnabledFallback Calling Diff ```diff --- wil_details_IsEnabledFallback calling +++ wil_details_IsEnabledFallback calling @@ -1 +1,2 @@ -Feature_1627960633__private_IsEnabledFallback +Feature_3887279419__private_IsEnabledFallback +Feature_Use_Proper_Within_Stack_API__private_IsEnabledFallback ``` ### wil_details_IsEnabledFallback Diff ```diff --- wil_details_IsEnabledFallback +++ wil_details_IsEnabledFallback @@ -1,26 +1,22 @@ -uint wil_details_IsEnabledFallback(undefined4 *param_1,uint param_2) +uint wil_details_IsEnabledFallback(ulonglong param_1,int param_2,undefined8 *param_3) { uint uVar1; - undefined4 *puVar2; - ulonglong local_res18; + ulonglong local_res8; uVar1 = (uint)param_1; - local_res18 = (ulonglong)param_1 & 0xffffffff; - if (((ulonglong)param_1 & 2) == 0) { - puVar2 = &Feature_1627960633__private_featureState; - local_res18 = wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState - (&Feature_1627960633__private_featureState,(ulonglong)param_1, - 0x1c0023dc8); - param_1 = puVar2; - uVar1 = (uint)local_res18; + local_res8 = param_1 & 0xffffffff; + if ((param_1 & 2) == 0) { + local_res8 = wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState + ((uint *)*param_3,param_1,(longlong)param_3); + uVar1 = (uint)local_res8; } if ((param_2 != 0) && - (wil_details_FeatureReporting_ReportUsageToService(param_1,local_res18,param_2), - param_2 - 3 < 2)) { - wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath((uint)local_res18,param_2); + (wil_details_FeatureReporting_ReportUsageToService((longlong)param_3,local_res8,param_2), + param_2 - 3U < 2)) { + wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath((uint)local_res8,param_2,param_3); } return uVar1 & 1; } ``` ## UdfSetEndOfFileInfo ### Match Info |Key|udf_4652.sys - udf_8036.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.36| |i_ratio|0.51| |m_ratio|0.95| |b_ratio|0.66| |match_types|SymbolsHash| ### Function Meta Diff |Key|udf_4652.sys|udf_8036.sys| | :---: | :---: | :---: | |name|UdfSetEndOfFileInfo|UdfSetEndOfFileInfo| |fullname|UdfSetEndOfFileInfo|UdfSetEndOfFileInfo| |refcount|2|2| |`length`|203|182| |`called`|NTOSKRNL.EXE::ExAcquireResourceExclusiveLite
NTOSKRNL.EXE::ExRaiseStatus
NTOSKRNL.EXE::ExReleaseResourceLite
UdfSetFileAllocationSize|Feature_3887279419__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExReleaseResourceLite
UdfAcquireResource
UdfSetFileAllocationSize| |calling|UdfCommonSetInfo|UdfCommonSetInfo| |paramcount|5|5| |`address`|1c0050a00|140059f60| |sig|uint __fastcall UdfSetEndOfFileInfo(short * param_1, undefined8 * param_2, short * param_3, longlong param_4, longlong * param_5)|uint __fastcall UdfSetEndOfFileInfo(short * param_1, undefined8 * param_2, short * param_3, longlong param_4, longlong * param_5)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UdfSetEndOfFileInfo Called Diff ```diff --- UdfSetEndOfFileInfo called +++ UdfSetEndOfFileInfo called @@ -1,2 +1 @@ -NTOSKRNL.EXE::ExAcquireResourceExclusiveLite -NTOSKRNL.EXE::ExRaiseStatus +Feature_3887279419__private_IsEnabledDeviceUsageNoInline @@ -3,0 +3 @@ +UdfAcquireResource ``` ### UdfSetEndOfFileInfo Diff ```diff --- UdfSetEndOfFileInfo +++ UdfSetEndOfFileInfo @@ -1,37 +1,26 @@ uint UdfSetEndOfFileInfo(short *param_1,undefined8 *param_2,short *param_3,longlong param_4, longlong *param_5) { - char cVar1; - short sVar2; - uint uVar3; - undefined8 uVar4; + short sVar1; + uint uVar2; + ulonglong uVar3; if (param_3 == (short *)0x0) { - sVar2 = 0; + sVar1 = 0; } else { - sVar2 = *param_3; + sVar1 = *param_3; } - if (sVar2 == 0x934) { - uVar4 = 0; - if ((param_1 == (short *)0x0) || ((*(uint *)(param_1 + 0xe) & 4) != 0)) { - uVar4 = 1; - } - cVar1 = ExAcquireResourceExclusiveLite(*(undefined8 *)(param_3 + 8),uVar4); - if (cVar1 == '\0') { - param_1[0xc] = 0xd8; - param_1[0xd] = -0x4000; - /* WARNING: Subroutine does not return */ - ExRaiseStatus(); - } - uVar3 = UdfSetFileAllocationSize(param_1,param_2,param_3,param_4,param_5,'\0','\x01'); + if ((sVar1 == 0x934) && + ((uVar3 = Feature_3887279419__private_IsEnabledDeviceUsageNoInline(), (int)uVar3 == 0 || + (-1 < *param_5)))) { + UdfAcquireResource((longlong)param_1,*(undefined8 *)(param_3 + 8),'\0',0); + uVar2 = UdfSetFileAllocationSize(param_1,param_2,param_3,param_4,param_5,'\0','\x01'); ExReleaseResourceLite(*(undefined8 *)(param_3 + 8)); + return uVar2; } - else { - uVar3 = 0xc000000d; - } - return uVar3; + return 0xc000000d; } ``` ## UdfFreeStringBuffer ### Match Info |Key|udf_4652.sys - udf_8036.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.43| |i_ratio|0.38| |m_ratio|0.84| |b_ratio|0.61| |match_types|SymbolsHash| ### Function Meta Diff |Key|udf_4652.sys|udf_8036.sys| | :---: | :---: | :---: | |name|UdfFreeStringBuffer|UdfFreeStringBuffer| |fullname|UdfFreeStringBuffer|UdfFreeStringBuffer| |refcount|6|6| |`length`|102|144| |`called`|NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::IoGetStackLimits|Feature_Use_Proper_Within_Stack_API__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::IoGetStackLimits
NTOSKRNL.EXE::IoWithinStackLimits| |calling|UdfCommonCreate
UdfCommonCreate$fin$0
UdfEnsureStringBufferEnough
UdfPrepareSubtreeForRename
UdfSetRenameInfo|UdfCommonCreate
UdfCommonCreate$fin$0
UdfEnsureStringBufferEnough
UdfPrepareSubtreeForRename
UdfSetRenameInfo| |paramcount|1|1| |`address`|1c00086d8|14000abc0| |sig|undefined __fastcall UdfFreeStringBuffer(undefined4 * param_1)|undefined __fastcall UdfFreeStringBuffer(undefined4 * param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UdfFreeStringBuffer Called Diff ```diff --- UdfFreeStringBuffer called +++ UdfFreeStringBuffer called @@ -0,0 +1 @@ +Feature_Use_Proper_Within_Stack_API__private_IsEnabledDeviceUsageNoInline @@ -2,0 +4 @@ +NTOSKRNL.EXE::IoWithinStackLimits ``` ### UdfFreeStringBuffer Diff ```diff --- UdfFreeStringBuffer +++ UdfFreeStringBuffer @@ -1,22 +1,35 @@ void UdfFreeStringBuffer(undefined4 *param_1) { - ulonglong uVar1; + longlong lVar1; + int iVar2; + ulonglong uVar3; ulonglong local_res8; ulonglong local_res10; - local_res10 = 0; - local_res8 = 0; - if (*(longlong *)(param_1 + 2) != 0) { + uVar3 = Feature_Use_Proper_Within_Stack_API__private_IsEnabledDeviceUsageNoInline(); + lVar1 = *(longlong *)(param_1 + 2); + if ((int)uVar3 == 0) { + local_res10 = 0; + local_res8 = 0; + if (lVar1 == 0) goto LAB_0; IoGetStackLimits(&local_res8,&local_res10); - uVar1 = *(ulonglong *)(param_1 + 2); - if ((uVar1 < local_res8) || (local_res10 < uVar1)) { - ExFreePoolWithTag(uVar1,0); + uVar3 = *(ulonglong *)(param_1 + 2); + if ((uVar3 < local_res8) || (local_res10 < uVar3)) goto LAB_1; + } + else { + if (lVar1 == 0) goto LAB_0; + iVar2 = IoWithinStackLimits(lVar1,1); + if (iVar2 == 0) { + uVar3 = *(ulonglong *)(param_1 + 2); +LAB_1: + ExFreePoolWithTag(uVar3,0); } - *(undefined8 *)(param_1 + 2) = 0; } + *(undefined8 *)(param_1 + 2) = 0; +LAB_0: *param_1 = 0; return; } ``` ## UdfSetThreadContext ### Match Info |Key|udf_4652.sys - udf_8036.sys| | :---: | :---: | |diff_type|code,refcount,length,address,calling,called| |ratio|0.41| |i_ratio|0.18| |m_ratio|0.72| |b_ratio|0.65| |match_types|SymbolsHash| ### Function Meta Diff |Key|udf_4652.sys|udf_8036.sys| | :---: | :---: | :---: | |name|UdfSetThreadContext|UdfSetThreadContext| |fullname|UdfSetThreadContext|UdfSetThreadContext| |`refcount`|8|9| |`length`|194|352| |`called`|NTOSKRNL.EXE::IoGetStackLimits
NTOSKRNL.EXE::IoGetTopLevelIrp
NTOSKRNL.EXE::IoSetTopLevelIrp|Feature_Use_Proper_Within_Stack_API__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::IoGetStackLimits
NTOSKRNL.EXE::IoGetTopLevelIrp
NTOSKRNL.EXE::IoSetTopLevelIrp
NTOSKRNL.EXE::IoWithinStackLimits| |`calling`|UdfCleanVolumeWorker
UdfFspClose
UdfFspDispatch
UdfPrepareMediaEjectWorker
UdfRmwBgFormatWorker
UdfSeqCacheWriterWorkerRoutineForPOW
UdfSeqCacheWriterWorkerRoutineForVAT|UdfCleanVolumeWorker
UdfFsdDispatch
UdfFspClose
UdfFspDispatch
UdfPrepareMediaEjectWorker
UdfRmwBgFormatWorker
UdfSeqCacheWriterWorkerRoutineForPOW
UdfSeqCacheWriterWorkerRoutineForVAT| |paramcount|2|2| |`address`|1c0005710|1400029c0| |sig|undefined __fastcall UdfSetThreadContext(longlong param_1, undefined4 * param_2)|undefined __fastcall UdfSetThreadContext(longlong param_1, undefined4 * param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UdfSetThreadContext Called Diff ```diff --- UdfSetThreadContext called +++ UdfSetThreadContext called @@ -0,0 +1 @@ +Feature_Use_Proper_Within_Stack_API__private_IsEnabledDeviceUsageNoInline @@ -3,0 +5 @@ +NTOSKRNL.EXE::IoWithinStackLimits ``` ### UdfSetThreadContext Calling Diff ```diff --- UdfSetThreadContext calling +++ UdfSetThreadContext calling @@ -1,0 +2 @@ +UdfFsdDispatch ``` ### UdfSetThreadContext Diff ```diff --- UdfSetThreadContext +++ UdfSetThreadContext @@ -1,30 +1,50 @@ void UdfSetThreadContext(longlong param_1,undefined4 *param_2) { - int *piVar1; - longlong local_res8; - int *local_res18 [2]; + int iVar1; + int *piVar2; + ulonglong uVar3; + longlong local_res18; + int *local_res20; - local_res18[0] = (int *)0x0; - local_res8 = 0; - piVar1 = (int *)IoGetTopLevelIrp(); - if (piVar1 == (int *)0x0) { + piVar2 = (int *)IoGetTopLevelIrp(); + if (piVar2 == (int *)0x0) { *(uint *)(param_1 + 0x1c) = *(uint *)(param_1 + 0x1c) | 0x10; } - IoGetStackLimits(local_res18,&local_res8); - if (((((*(uint *)(param_1 + 0x1c) & 0x10) == 0) && (piVar1 <= (int *)(local_res8 + -0x18))) && - (local_res18[0] < piVar1)) && ((((ulonglong)piVar1 & 3) == 0 && (*piVar1 == 0x53464455)))) { - *(undefined8 *)(param_1 + 0x30) = *(undefined8 *)(piVar1 + 4); + uVar3 = Feature_Use_Proper_Within_Stack_API__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar3 != 0) { + if ((*(uint *)(param_1 + 0x1c) & 0x10) == 0) { + iVar1 = IoWithinStackLimits(piVar2,0x18); + if (((iVar1 != 0) && (((ulonglong)piVar2 & 3) == 0)) && (*piVar2 == 0x53464455)) { + *(undefined8 *)(param_1 + 0x30) = *(undefined8 *)(piVar2 + 4); + return; + } + } + *param_2 = 0x53464455; + *(int **)(param_2 + 2) = piVar2; + *(longlong *)(param_2 + 4) = param_1; + IoSetTopLevelIrp(param_2); + *(uint *)(param_1 + 0x1c) = *(uint *)(param_1 + 0x1c) | 0x20; + *(undefined4 **)(param_1 + 0x40) = param_2; + *(longlong *)(param_1 + 0x30) = param_1; + return; + } + local_res20 = (int *)0x0; + local_res18 = 0; + IoGetStackLimits(&local_res20,&local_res18); + if (((((*(uint *)(param_1 + 0x1c) & 0x10) == 0) && (piVar2 <= (int *)(local_res18 + -0x18))) && + (local_res20 < piVar2)) && ((((ulonglong)piVar2 & 3) == 0 && (*piVar2 == 0x53464455)))) { + *(undefined8 *)(param_1 + 0x30) = *(undefined8 *)(piVar2 + 4); return; } *param_2 = 0x53464455; - *(int **)(param_2 + 2) = piVar1; + *(int **)(param_2 + 2) = piVar2; *(longlong *)(param_2 + 4) = param_1; IoSetTopLevelIrp(param_2); *(uint *)(param_1 + 0x1c) = *(uint *)(param_1 + 0x1c) | 0x20; *(undefined4 **)(param_1 + 0x40) = param_2; *(longlong *)(param_1 + 0x30) = param_1; return; } ``` ## UdfFsdDispatch ### Match Info |Key|udf_4652.sys - udf_8036.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.66| |i_ratio|0.53| |m_ratio|0.89| |b_ratio|0.87| |match_types|SymbolsHash| ### Function Meta Diff |Key|udf_4652.sys|udf_8036.sys| | :---: | :---: | :---: | |name|UdfFsdDispatch|UdfFsdDispatch| |fullname|UdfFsdDispatch|UdfFsdDispatch| |refcount|19|19| |`length`|873|670| |`called`|
Expand for full list:
NTOSKRNL.EXE::IoGetStackLimits
NTOSKRNL.EXE::IoGetTopLevelIrp
NTOSKRNL.EXE::IoIsOperationSynchronous
NTOSKRNL.EXE::IoSetTopLevelIrp
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeGetCurrentIrql
NTOSKRNL.EXE::KeLeaveCriticalRegion
UdfCleanupIrpContext
UdfCommonCleanup
UdfCommonClose
UdfCommonCreateUdfCommonDevControl
UdfCommonDirControl
UdfCommonFlushBuffers
UdfCommonFsControl
UdfCommonLockControl
UdfCommonPnp
UdfCommonQueryInfo
UdfCommonQueryVolInfo
UdfCommonRead
UdfCommonSetInfo
UdfCommonSetVolInfo
UdfCommonShutdown
UdfCommonWrite
UdfCompleteMdl
UdfCompleteRequest
UdfCreateIrpContext
|
Expand for full list:
NTOSKRNL.EXE::IoIsOperationSynchronous
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeGetCurrentIrql
NTOSKRNL.EXE::KeLeaveCriticalRegion
UdfCleanupIrpContext
UdfCommonCleanup
UdfCommonClose
UdfCommonCreate
UdfCommonDevControl
UdfCommonDirControl
UdfCommonFlushBuffersUdfCommonFsControl
UdfCommonLockControl
UdfCommonPnp
UdfCommonQueryInfo
UdfCommonQueryVolInfo
UdfCommonRead
UdfCommonSetInfo
UdfCommonSetVolInfo
UdfCommonShutdown
UdfCommonWrite
UdfCompleteMdl
UdfCompleteRequest
UdfCreateIrpContext
UdfSetThreadContext
| |calling||| |paramcount|2|2| |`address`|1c00010f0|1400026f0| |sig|uint __fastcall UdfFsdDispatch(undefined8 param_1, ulonglong param_2)|uint __fastcall UdfFsdDispatch(undefined8 param_1, ulonglong param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UdfFsdDispatch Called Diff ```diff --- UdfFsdDispatch called +++ UdfFsdDispatch called @@ -1,2 +0,0 @@ -NTOSKRNL.EXE::IoGetStackLimits -NTOSKRNL.EXE::IoGetTopLevelIrp @@ -4 +1,0 @@ -NTOSKRNL.EXE::IoSetTopLevelIrp @@ -27,0 +25 @@ +UdfSetThreadContext ``` ### UdfFsdDispatch Diff ```diff --- UdfFsdDispatch +++ UdfFsdDispatch @@ -1,144 +1,119 @@ uint UdfFsdDispatch(undefined8 param_1,ulonglong param_2) { char cVar1; uint uVar2; ulonglong ***********pppppppppppuVar3; - int *piVar4; - ulonglong uVar5; - char *pcVar6; - undefined8 uVar7; - short *psVar8; - longlong local_res18; - int *local_res20; - ulonglong *********local_40; - int *piStack_38; - ulonglong ***********local_30; + ulonglong uVar4; + char *pcVar5; + undefined8 uVar6; + short *psVar7; + undefined8 local_28; + undefined8 uStack_20; + undefined8 local_18; - local_40 = (ulonglong *********)0x0; - piStack_38 = (int *)0x0; - local_30 = (ulonglong ***********)0x0; + local_28 = 0; + uStack_20 = 0; + local_18 = 0; pppppppppppuVar3 = (ulonglong ***********)0x0; KeGetCurrentIrql(); KeEnterCriticalRegion(); do { if (pppppppppppuVar3 == (ulonglong ***********)0x0) { if ((*(longlong *)(*(longlong *)(param_2 + 0xb8) + 0x30) == 0) || ((*(uint *)(param_2 + 0x10) & 2) != 0)) { cVar1 = '\x01'; } else { cVar1 = IoIsOperationSynchronous(param_2); } pppppppppppuVar3 = (ulonglong ***********)UdfCreateIrpContext(param_2,cVar1); - local_res20 = (int *)0x0; - local_res18 = 0; - piVar4 = (int *)IoGetTopLevelIrp(); - if (piVar4 == (int *)0x0) { - *(uint *)((longlong)pppppppppppuVar3 + 0x1c) = - *(uint *)((longlong)pppppppppppuVar3 + 0x1c) | 0x10; - } - IoGetStackLimits(&local_res20,&local_res18); - if (((((*(uint *)((longlong)pppppppppppuVar3 + 0x1c) & 0x10) == 0) && - (piVar4 <= (int *)(local_res18 + -0x18))) && (local_res20 < piVar4)) && - ((((ulonglong)piVar4 & 3) == 0 && (*piVar4 == 0x53464455)))) { - pppppppppppuVar3[6] = *(ulonglong ***********)(piVar4 + 4); - } - else { - local_40 = (ulonglong *********)CONCAT44(local_40._4_4_,0x53464455); - piStack_38 = piVar4; - local_30 = pppppppppppuVar3; - IoSetTopLevelIrp(&local_40); - pppppppppppuVar3[6] = (ulonglong **********)pppppppppppuVar3; - pppppppppppuVar3[8] = &local_40; - *(uint *)((longlong)pppppppppppuVar3 + 0x1c) = - *(uint *)((longlong)pppppppppppuVar3 + 0x1c) | 0x20; - } + UdfSetThreadContext((longlong)pppppppppppuVar3,(undefined4 *)&local_28); } else { *(uint *)((longlong)pppppppppppuVar3 + 0x1c) = *(uint *)((longlong)pppppppppppuVar3 + 0x1c) | 2; UdfCleanupIrpContext((longlong)pppppppppppuVar3,'\0'); } cVar1 = *(char *)(pppppppppppuVar3 + 7); if (cVar1 == '\x03') { if ((*(byte *)((longlong)pppppppppppuVar3 + 0x39) & 4) == 0) { uVar2 = UdfCommonRead(pppppppppppuVar3,param_2); } else { - uVar7 = UdfCompleteMdl((longlong)pppppppppppuVar3,param_2); - uVar2 = (uint)uVar7; + uVar6 = UdfCompleteMdl((longlong)pppppppppppuVar3,param_2); + uVar2 = (uint)uVar6; } } else if (cVar1 == '\0') { - uVar5 = UdfCommonCreate((wchar_t *)pppppppppppuVar3,param_2); - uVar2 = (uint)uVar5; + uVar4 = UdfCommonCreate((wchar_t *)pppppppppppuVar3,param_2); + uVar2 = (uint)uVar4; } else { switch(cVar1) { case '\x02': - uVar7 = UdfCommonClose((ulonglong *)pppppppppppuVar3,param_2); - uVar2 = (uint)uVar7; + uVar6 = UdfCommonClose((ulonglong *)pppppppppppuVar3,param_2); + uVar2 = (uint)uVar6; break; default: uVar2 = 0xc0000010; UdfCompleteRequest((longlong)pppppppppppuVar3,param_2,0xc0000010); break; case '\x04': if ((*(byte *)((longlong)pppppppppppuVar3 + 0x39) & 4) == 0) { - uVar5 = UdfCommonWrite(pppppppppppuVar3,param_2); - uVar2 = (uint)uVar5; + uVar4 = UdfCommonWrite(pppppppppppuVar3,param_2); + uVar2 = (uint)uVar4; } else { - uVar7 = UdfCompleteMdl((longlong)pppppppppppuVar3,param_2); - uVar2 = (uint)uVar7; + uVar6 = UdfCompleteMdl((longlong)pppppppppppuVar3,param_2); + uVar2 = (uint)uVar6; } break; case '\x05': - psVar8 = UdfCommonQueryInfo((uint *)pppppppppppuVar3,param_2); - uVar2 = (uint)psVar8; + psVar7 = UdfCommonQueryInfo((uint *)pppppppppppuVar3,param_2); + uVar2 = (uint)psVar7; break; case '\x06': uVar2 = UdfCommonSetInfo((ushort *****)pppppppppppuVar3,param_2); break; case '\t': - uVar5 = UdfCommonFlushBuffers((ulonglong *)pppppppppppuVar3,param_2); - uVar2 = (uint)uVar5; + uVar4 = UdfCommonFlushBuffers((ulonglong *)pppppppppppuVar3,param_2); + uVar2 = (uint)uVar4; break; case '\n': uVar2 = UdfCommonQueryVolInfo((longlong)pppppppppppuVar3,param_2); break; case '\v': uVar2 = UdfCommonSetVolInfo(pppppppppppuVar3,param_2); break; case '\f': uVar2 = UdfCommonDirControl((short *)pppppppppppuVar3,param_2); break; case '\r': uVar2 = UdfCommonFsControl(pppppppppppuVar3,param_2); break; case '\x0e': - pcVar6 = UdfCommonDevControl((ulonglong *)pppppppppppuVar3,param_2); - uVar2 = (uint)pcVar6; + pcVar5 = UdfCommonDevControl((ulonglong *)pppppppppppuVar3,param_2); + uVar2 = (uint)pcVar5; break; case '\x10': - uVar7 = UdfCommonShutdown((ulonglong *)pppppppppppuVar3,param_2); - uVar2 = (uint)uVar7; + uVar6 = UdfCommonShutdown((ulonglong *)pppppppppppuVar3,param_2); + uVar2 = (uint)uVar6; break; case '\x11': uVar2 = UdfCommonLockControl((ulonglong)pppppppppppuVar3,param_2); break; case '\x12': - uVar7 = UdfCommonCleanup((ulonglong *)pppppppppppuVar3,param_2); - uVar2 = (uint)uVar7; + uVar6 = UdfCommonCleanup((ulonglong *)pppppppppppuVar3,param_2); + uVar2 = (uint)uVar6; break; case '\x1b': uVar2 = UdfCommonPnp((ulonglong *)pppppppppppuVar3,param_2); } } } while (uVar2 == 0xc00000d8); KeLeaveCriticalRegion(); return uVar2; } ``` ## UdfSetAllocationInfo ### Match Info |Key|udf_4652.sys - udf_8036.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.74| |i_ratio|0.64| |m_ratio|0.93| |b_ratio|0.8| |match_types|SymbolsHash| ### Function Meta Diff |Key|udf_4652.sys|udf_8036.sys| | :---: | :---: | :---: | |name|UdfSetAllocationInfo|UdfSetAllocationInfo| |fullname|UdfSetAllocationInfo|UdfSetAllocationInfo| |refcount|2|2| |`length`|159|182| |`called`|NTOSKRNL.EXE::ExReleaseResourceLite
UdfAcquireResource
UdfSetFileAllocationSize|Feature_3887279419__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExReleaseResourceLite
UdfAcquireResource
UdfSetFileAllocationSize| |calling|UdfCommonSetInfo|UdfCommonSetInfo| |paramcount|5|5| |`address`|1c0031850|140032760| |sig|uint __fastcall UdfSetAllocationInfo(short * param_1, undefined8 * param_2, short * param_3, longlong param_4, longlong * param_5)|uint __fastcall UdfSetAllocationInfo(short * param_1, undefined8 * param_2, short * param_3, longlong param_4, longlong * param_5)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UdfSetAllocationInfo Called Diff ```diff --- UdfSetAllocationInfo called +++ UdfSetAllocationInfo called @@ -0,0 +1 @@ +Feature_3887279419__private_IsEnabledDeviceUsageNoInline ``` ### UdfSetAllocationInfo Diff ```diff --- UdfSetAllocationInfo +++ UdfSetAllocationInfo @@ -1,26 +1,27 @@ uint UdfSetAllocationInfo (short *param_1,undefined8 *param_2,short *param_3,longlong param_4,longlong *param_5 ) { short sVar1; uint uVar2; + ulonglong uVar3; if (param_3 == (short *)0x0) { sVar1 = 0; } else { sVar1 = *param_3; } - if (sVar1 == 0x934) { + if ((sVar1 == 0x934) && + ((uVar3 = Feature_3887279419__private_IsEnabledDeviceUsageNoInline(), (int)uVar3 == 0 || + (-1 < *param_5)))) { UdfAcquireResource((longlong)param_1,*(undefined8 *)(param_3 + 8),'\0',0); uVar2 = UdfSetFileAllocationSize(param_1,param_2,param_3,param_4,param_5,'\0','\0'); ExReleaseResourceLite(*(undefined8 *)(param_3 + 8)); + return uVar2; } - else { - uVar2 = 0xc000000d; - } - return uVar2; + return 0xc000000d; } ``` ## UdfCommonSetInfo ### Match Info |Key|udf_4652.sys - udf_8036.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.51| |i_ratio|0.62| |m_ratio|0.98| |b_ratio|0.89| |match_types|SymbolsHash| ### Function Meta Diff |Key|udf_4652.sys|udf_8036.sys| | :---: | :---: | :---: | |name|UdfCommonSetInfo|UdfCommonSetInfo| |fullname|UdfCommonSetInfo|UdfCommonSetInfo| |refcount|3|3| |`length`|907|871| |`called`|
Expand for full list:
NTOSKRNL.EXE::ExReleaseResourceLite
NTOSKRNL.EXE::FsRtlCheckOplock
NTOSKRNL.EXE::FsRtlOplockIsFastIoPossible
UdfAcquireResource
UdfCompleteRequest
UdfDecodeFileObject
UdfSetAllocationInfo
UdfSetBasicInfo
UdfSetDispositionInfo
UdfSetEndOfFileInfo
UdfSetLinkInfoUdfSetRenameInfo
UdfVerifyScbOperation
WPP_SF_D
WPP_SF_iD
|
Expand for full list:
NTOSKRNL.EXE::ExReleaseResourceLite
NTOSKRNL.EXE::FsRtlCheckOplock
NTOSKRNL.EXE::FsRtlOplockIsFastIoPossible
UdfAcquireResource
UdfCompleteRequest
UdfDecodeFileObject
UdfSetAllocationInfo
UdfSetBasicInfo
UdfSetDispositionInfo
UdfSetEndOfFileInfo
UdfSetLinkInfoUdfSetPositionInfo
UdfSetRenameInfo
UdfVerifyScbOperation
WPP_SF_D
WPP_SF_iD
| |calling|UdfFsdDispatch
UdfFspDispatch|UdfFsdDispatch
UdfFspDispatch| |paramcount|2|2| |`address`|1c0030a88|1400319bc| |sig|uint __fastcall UdfCommonSetInfo(ushort * * * * * param_1, longlong param_2)|uint __fastcall UdfCommonSetInfo(ushort * * * * * param_1, longlong param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UdfCommonSetInfo Called Diff ```diff --- UdfCommonSetInfo called +++ UdfCommonSetInfo called @@ -11,0 +12 @@ +UdfSetPositionInfo ``` ### UdfCommonSetInfo Diff ```diff --- UdfCommonSetInfo +++ UdfCommonSetInfo @@ -1,144 +1,140 @@ uint UdfCommonSetInfo(ushort *****param_1,longlong param_2) { int iVar1; longlong lVar2; bool bVar3; ushort *****pppppuVar4; ulonglong uVar5; char cVar6; undefined1 uVar7; uint uVar8; uint uVar9; undefined8 uVar10; ushort *****pppppuVar11; - longlong lVar12; - uint *puVar13; + ulonglong uVar12; + longlong lVar13; + uint *puVar14; char local_res18 [8]; ushort *****local_res20; ulonglong local_50; uint *local_48; lVar2 = *(longlong *)(param_2 + 0xb8); local_res20 = (ushort *****)0x0; local_50 = 0; local_res18[0] = '\0'; bVar3 = false; iVar1 = *(int *)(lVar2 + 0x10); - puVar13 = *(uint **)(param_2 + 0x18); - lVar12 = param_2; - local_48 = puVar13; + puVar14 = *(uint **)(param_2 + 0x18); + lVar13 = param_2; + local_48 = puVar14; uVar8 = UdfDecodeFileObject(*(longlong *)(lVar2 + 0x30),&local_res20,&local_50); pppppuVar4 = local_res20; if (((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)((longlong)WPP_GLOBAL_Control + 0x2c) & 0x200) != 0)) { - WPP_SF_iD(WPP_GLOBAL_Control[3],10,&WPP_2806f8ece7423df2ad26457d6ce95a20_Traceguids,local_res20) + WPP_SF_iD(WPP_GLOBAL_Control[3],10,&WPP_dead4d1cb930300d8750769fba1bb73a_Traceguids,local_res20) ; - lVar12 = param_2; + lVar13 = param_2; } if (((uVar8 == 4) && (((ulonglong)pppppuVar4[0x11][1][6] & 0x10) == 0)) && (iVar1 - 0x13U < 2)) { if ((iVar1 == 0x14) && (*(char *)(lVar2 + 0x21) != '\0')) { uVar9 = 0; cVar6 = local_res18[0]; goto LAB_0; } - uVar9 = FsRtlCheckOplock(pppppuVar4 + 0xb,lVar12,param_1,0,0); + uVar9 = FsRtlCheckOplock(pppppuVar4 + 0xb,lVar13,param_1,0,0); cVar6 = local_res18[0]; if (uVar9 != 0) goto LAB_0; if ((*(int *)(pppppuVar4 + 0x1b) == 0) && (cVar6 = FsRtlOplockIsFastIoPossible(pppppuVar4 + 0xb), cVar6 != '\0')) { if ((pppppuVar4[0x3f] == (ushort ****)0x0) || (*(char *)(pppppuVar4[0x3f] + 2) == '\0')) { uVar7 = 1; } else { uVar7 = 2; } } else { uVar7 = 0; } *(undefined1 *)((longlong)pppppuVar4 + 5) = uVar7; - puVar13 = local_48; + puVar14 = local_48; } - if ((uVar8 != 3) && (uVar8 != 4)) { + if ((uVar8 == 3) || (uVar8 == 4)) { + bVar3 = iVar1 - 10U < 2; + if (bVar3) { + UdfAcquireResource((longlong)param_1,param_1[2] + 0xb9,'\0',0); + } + UdfAcquireResource((longlong)param_1,pppppuVar4[0x11][10] + 1,'\0',0); + uVar5 = local_50; + cVar6 = '\x01'; + local_res18[0] = '\x01'; + uVar12 = local_50; + UdfVerifyScbOperation((ulonglong)param_1,(longlong)pppppuVar4,local_50); + if (iVar1 != 0xe) { + *(undefined4 *)((longlong)param_1[2] + 0x854) = 0; + } + if (iVar1 == 4) { + uVar9 = UdfSetBasicInfo(param_1,*(longlong *)(lVar2 + 0x30),(short *)pppppuVar4,uVar5, + (longlong *)puVar14,local_res18); + cVar6 = local_res18[0]; + } + else if (iVar1 == 10) { + pppppuVar11 = UdfSetRenameInfo(param_1,pppppuVar4,uVar5); + uVar9 = (uint)pppppuVar11; + } + else if (iVar1 == 0xb) { + uVar9 = UdfSetLinkInfo((short *)param_1,(short *)pppppuVar4,uVar5); + } + else if (iVar1 == 0xd) { + uVar10 = UdfSetDispositionInfo + ((longlong)param_1,*(longlong *)(lVar2 + 0x30),(short *)pppppuVar4,uVar5, + (char *)puVar14); + uVar9 = (uint)uVar10; + } + else if (iVar1 == 0xe) { + uVar10 = UdfSetPositionInfo((longlong)param_1,*(longlong *)(lVar2 + 0x30),uVar12,puVar14); + uVar9 = (uint)uVar10; + } + else if (iVar1 == 0x13) { + uVar9 = UdfSetAllocationInfo + ((short *)param_1,*(undefined8 **)(lVar2 + 0x30),(short *)pppppuVar4,uVar5, + (longlong *)puVar14); + } + else if (iVar1 == 0x14) { + if (*(char *)(lVar2 + 0x21) == '\0') { + uVar9 = UdfSetEndOfFileInfo((short *)param_1,*(undefined8 **)(lVar2 + 0x30), + (short *)pppppuVar4,uVar5,(longlong *)puVar14); + } + else { + uVar9 = 0; + } + } + else { + uVar9 = 0xc000000d; + } + } + else { uVar9 = 0xc000000d; cVar6 = local_res18[0]; - goto LAB_0; } - bVar3 = iVar1 - 10U < 2; - if (bVar3) { - UdfAcquireResource((longlong)param_1,param_1[2] + 0xb9,'\0',0); - } - UdfAcquireResource((longlong)param_1,pppppuVar4[0x11][10] + 1,'\0',0); - uVar5 = local_50; - cVar6 = '\x01'; - local_res18[0] = '\x01'; - UdfVerifyScbOperation((ulonglong)param_1,(longlong)pppppuVar4,local_50); - if (iVar1 != 0xe) { - *(undefined4 *)((longlong)param_1[2] + 0x854) = 0; - } - if (iVar1 == 4) { - uVar9 = UdfSetBasicInfo(param_1,*(longlong *)(lVar2 + 0x30),(short *)pppppuVar4,uVar5, - (longlong *)puVar13,local_res18); - cVar6 = local_res18[0]; - goto LAB_0; - } - if (iVar1 == 10) { - pppppuVar11 = UdfSetRenameInfo(param_1,pppppuVar4,uVar5); - uVar9 = (uint)pppppuVar11; - goto LAB_0; - } - if (iVar1 == 0xb) { - uVar9 = UdfSetLinkInfo((short *)param_1,(short *)pppppuVar4,uVar5); - goto LAB_0; - } - if (iVar1 == 0xd) { - uVar10 = UdfSetDispositionInfo - ((longlong)param_1,*(longlong *)(lVar2 + 0x30),(short *)pppppuVar4,uVar5, - (char *)puVar13); - uVar9 = (uint)uVar10; - goto LAB_0; - } - if (iVar1 == 0xe) { - if (((*(uint *)(*(longlong *)(lVar2 + 0x30) + 0x50) & 8) != 0) && - ((*puVar13 & *(uint *)(param_1[1][0x17][5] + 0x13)) != 0)) { -LAB_1: - uVar9 = 0xc000000d; - goto LAB_0; - } - *(undefined8 *)(*(longlong *)(lVar2 + 0x30) + 0x68) = *(undefined8 *)puVar13; - } - else { - if (iVar1 == 0x13) { - uVar9 = UdfSetAllocationInfo - ((short *)param_1,*(undefined8 **)(lVar2 + 0x30),(short *)pppppuVar4,uVar5, - (longlong *)puVar13); - goto LAB_0; - } - if (iVar1 != 0x14) goto LAB_1; - if (*(char *)(lVar2 + 0x21) == '\0') { - uVar9 = UdfSetEndOfFileInfo((short *)param_1,*(undefined8 **)(lVar2 + 0x30), - (short *)pppppuVar4,uVar5,(longlong *)puVar13); - goto LAB_0; - } - } - uVar9 = 0; LAB_0: if (cVar6 != '\0') { ExReleaseResourceLite(pppppuVar4[0x11][10] + 1); } if (bVar3) { ExReleaseResourceLite(param_1[2] + 0xb9); } if (((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)((longlong)WPP_GLOBAL_Control + 0x2c) & 0x200) != 0)) { - WPP_SF_D(WPP_GLOBAL_Control[3],0xb,&WPP_2806f8ece7423df2ad26457d6ce95a20_Traceguids,uVar9); + WPP_SF_D(WPP_GLOBAL_Control[3],0xb,&WPP_dead4d1cb930300d8750769fba1bb73a_Traceguids,uVar9); } if (uVar9 != 0x103) { *(undefined8 *)(param_2 + 0x38) = 0; UdfCompleteRequest((longlong)param_1,param_2,uVar9); } return uVar9; } ``` ## wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath ### Match Info |Key|udf_4652.sys - udf_8036.sys| | :---: | :---: | |diff_type|code,length,sig,address| |ratio|0.4| |i_ratio|0.37| |m_ratio|0.9| |b_ratio|0.9| |match_types|SymbolsHash| ### Function Meta Diff |Key|udf_4652.sys|udf_8036.sys| | :---: | :---: | :---: | |name|wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath|wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath| |fullname|wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath|wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath| |refcount|2|2| |`length`|76|91| |called||| |calling|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |paramcount|2|3| |`address`|1c00103f0|140011600| |`sig`|undefined __fastcall wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath(uint param_1, int param_2)|undefined __fastcall wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath(uint param_1, int param_2, undefined8 * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath Diff ```diff --- wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath +++ wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath @@ -1,41 +1,52 @@ -void wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath(uint param_1,int param_2) +void wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath + (uint param_1,int param_2,undefined8 *param_3) { - uint uVar1; + uint *puVar1; uint uVar2; uint uVar3; - bool bVar4; + uint uVar4; + bool bVar5; + puVar1 = (uint *)*param_3; if (param_2 == 3) { - uVar3 = 0x10; + uVar4 = 0x10; } else { if (param_2 != 4) { return; } - uVar3 = 0x20; + uVar4 = 0x20; } - if ((Feature_1627960633__private_featureState & 2) != 0) { - uVar2 = Feature_1627960633__private_featureState; - while ((uVar2 & 1) == (param_1 & 1)) { - LOCK(); - bVar4 = uVar2 == Feature_1627960633__private_featureState; - uVar1 = uVar3 | uVar2; - if (!bVar4) { - uVar2 = Feature_1627960633__private_featureState; - uVar1 = Feature_1627960633__private_featureState; - } - Feature_1627960633__private_featureState = uVar1; - UNLOCK(); - if (bVar4) { - return; - } - if ((uVar2 & 2) == 0) { - return; + if ((*(char *)((longlong)param_3 + 0x1e) == '\0') && (*(char *)((longlong)param_3 + 0x1d) == '\0') + ) { + if ((*puVar1 & 2) != 0) { + uVar3 = *puVar1; + while ((uVar3 & 1) == (param_1 & 1)) { + LOCK(); + uVar2 = *puVar1; + bVar5 = uVar3 == uVar2; + if (bVar5) { + *puVar1 = uVar4 | uVar3; + uVar2 = uVar3; + } + UNLOCK(); + if (bVar5) { + return; + } + uVar3 = uVar2; + if ((uVar2 & 2) == 0) { + return; + } } } + } + else { + LOCK(); + *puVar1 = *puVar1 | uVar4; + UNLOCK(); } return; } ``` ## Feature_1627960633__private_IsEnabledFallback ### Match Info |Key|udf_4652.sys - udf_8036.sys| | :---: | :---: | |diff_type|code,name,fullname,length,sig,address,calling| |ratio|0.73| |i_ratio|0.67| |m_ratio|0.89| |b_ratio|0.89| |match_types|Implied Match| ### Function Meta Diff |Key|udf_4652.sys|udf_8036.sys| | :---: | :---: | :---: | |`name`|Feature_1627960633__private_IsEnabledFallback|Feature_Use_Proper_Within_Stack_API__private_IsEnabledFallback| |`fullname`|Feature_1627960633__private_IsEnabledFallback|Feature_Use_Proper_Within_Stack_API__private_IsEnabledFallback| |refcount|2|2| |`length`|14|21| |called|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |`calling`|Feature_1627960633__private_IsEnabledDeviceUsageNoInline|Feature_Use_Proper_Within_Stack_API__private_IsEnabledDeviceUsageNoInline| |paramcount|2|2| |`address`|1c000fda8|140013894| |`sig`|undefined __fastcall Feature_1627960633__private_IsEnabledFallback(undefined4 * param_1, uint param_2)|undefined __fastcall Feature_Use_Proper_Within_Stack_API__private_IsEnabledFallback(ulonglong param_1, int param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### Feature_1627960633__private_IsEnabledFallback Calling Diff ```diff --- Feature_1627960633__private_IsEnabledFallback calling +++ Feature_Use_Proper_Within_Stack_API__private_IsEnabledFallback calling @@ -1 +1 @@ -Feature_1627960633__private_IsEnabledDeviceUsageNoInline +Feature_Use_Proper_Within_Stack_API__private_IsEnabledDeviceUsageNoInline ``` ### Feature_1627960633__private_IsEnabledFallback Diff ```diff --- Feature_1627960633__private_IsEnabledFallback +++ Feature_Use_Proper_Within_Stack_API__private_IsEnabledFallback @@ -1,8 +1,9 @@ -void Feature_1627960633__private_IsEnabledFallback(undefined4 *param_1,uint param_2) +void Feature_Use_Proper_Within_Stack_API__private_IsEnabledFallback(ulonglong param_1,int param_2) { - wil_details_IsEnabledFallback(param_1,param_2); + wil_details_IsEnabledFallback + (param_1,param_2,&Feature_Use_Proper_Within_Stack_API__private_descriptor); return; } ``` ## Feature_1627960633__private_IsEnabledFallback ### Match Info |Key|udf_4652.sys - udf_8036.sys| | :---: | :---: | |diff_type|code,name,fullname,length,sig,address,calling| |ratio|0.8| |i_ratio|0.67| |m_ratio|0.89| |b_ratio|0.89| |match_types|Implied Match| ### Function Meta Diff |Key|udf_4652.sys|udf_8036.sys| | :---: | :---: | :---: | |`name`|Feature_1627960633__private_IsEnabledFallback|Feature_3887279419__private_IsEnabledFallback| |`fullname`|Feature_1627960633__private_IsEnabledFallback|Feature_3887279419__private_IsEnabledFallback| |refcount|2|2| |`length`|14|21| |called|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |`calling`|Feature_1627960633__private_IsEnabledDeviceUsageNoInline|Feature_3887279419__private_IsEnabledDeviceUsageNoInline| |paramcount|2|2| |`address`|1c000fda8|140010a24| |`sig`|undefined __fastcall Feature_1627960633__private_IsEnabledFallback(undefined4 * param_1, uint param_2)|undefined __fastcall Feature_3887279419__private_IsEnabledFallback(ulonglong param_1, int param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### Feature_1627960633__private_IsEnabledFallback Calling Diff ```diff --- Feature_1627960633__private_IsEnabledFallback calling +++ Feature_3887279419__private_IsEnabledFallback calling @@ -1 +1 @@ -Feature_1627960633__private_IsEnabledDeviceUsageNoInline +Feature_3887279419__private_IsEnabledDeviceUsageNoInline ``` ### Feature_1627960633__private_IsEnabledFallback Diff ```diff --- Feature_1627960633__private_IsEnabledFallback +++ Feature_3887279419__private_IsEnabledFallback @@ -1,8 +1,8 @@ -void Feature_1627960633__private_IsEnabledFallback(undefined4 *param_1,uint param_2) +void Feature_3887279419__private_IsEnabledFallback(ulonglong param_1,int param_2) { - wil_details_IsEnabledFallback(param_1,param_2); + wil_details_IsEnabledFallback(param_1,param_2,&Feature_3887279419__private_descriptor); return; } ``` # Modified (No Code Changes) *Slightly modified functions have no code changes, rather differnces in:* - refcount - length - called - calling - name - fullname ## NTOSKRNL.EXE::IoGetTopLevelIrp ### Match Info |Key|udf_4652.sys - udf_8036.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|udf_4652.sys|udf_8036.sys| | :---: | :---: | :---: | |name|IoGetTopLevelIrp|IoGetTopLevelIrp| |fullname|NTOSKRNL.EXE::IoGetTopLevelIrp|NTOSKRNL.EXE::IoGetTopLevelIrp| |`refcount`|7|6| |length|0|0| |called||| |`calling`|UdfAcquireForCcFlush
UdfFsdDispatch
UdfProcessException
UdfReleaseForCcFlush
UdfSeqCacheWriteBlocksForFile
UdfSetThreadContext|UdfAcquireForCcFlush
UdfProcessException
UdfReleaseForCcFlush
UdfSeqCacheWriteBlocksForFile
UdfSetThreadContext| |paramcount|0|0| |address|EXTERNAL:00000092|EXTERNAL:00000092| |sig|undefined IoGetTopLevelIrp(void)|undefined IoGetTopLevelIrp(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::IoGetTopLevelIrp Calling Diff ```diff --- NTOSKRNL.EXE::IoGetTopLevelIrp calling +++ NTOSKRNL.EXE::IoGetTopLevelIrp calling @@ -2 +1,0 @@ -UdfFsdDispatch ``` ## NTOSKRNL.EXE::ExAcquireResourceExclusiveLite ### Match Info |Key|udf_4652.sys - udf_8036.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|udf_4652.sys|udf_8036.sys| | :---: | :---: | :---: | |name|ExAcquireResourceExclusiveLite|ExAcquireResourceExclusiveLite| |fullname|NTOSKRNL.EXE::ExAcquireResourceExclusiveLite|NTOSKRNL.EXE::ExAcquireResourceExclusiveLite| |`refcount`|47|46| |length|0|0| |called||| |`calling`|
Expand for full list:
UdfAcquireDeviceShared
UdfAcquireForCacheWrite
UdfAcquireForCcFlush
UdfAcquireForModWrite
UdfAcquireResource
UdfCommonCleanup
UdfCommonClose
UdfCommonClosePrivate
UdfCommonCreate
UdfCommonFlushBuffers
UdfCommonPnpUdfCommonRead
UdfCommonShutdown
UdfCompleteScbOpen
UdfDismountVolume
UdfFilterCallbackAcquireForCreateSection
UdfFindPrefix
UdfFlushIcbForScb
UdfFlushVolume
UdfFspClose
UdfInitializeAllocationSupport
UdfInvalidateVolumes
UdfLookupMetaVsnOfExtent
UdfMountVolume
UdfPerformVerify
UdfPnpCallbackRoutine
UdfPnpQueryRemove
UdfRmwBgFormatWorker
UdfRmwExecuteIoRuns
UdfRmwGetCacheRun
UdfRmwIssueIoRequest
UdfRmwMakeCacheRunValid
UdfSeqCacheReserveFileRegion
UdfSeqCacheUnReserveFileRegion
UdfSeqCacheWriterWorkerRoutineForPOW
UdfSeqCacheWriterWorkerRoutineForVAT
UdfSetEndOfFileInfo
UdfTeardownStructures
UdfVerifyVolume
|
Expand for full list:
UdfAcquireDeviceShared
UdfAcquireForCacheWrite
UdfAcquireForCcFlush
UdfAcquireForModWrite
UdfAcquireResource
UdfCommonCleanup
UdfCommonClose
UdfCommonClosePrivate
UdfCommonCreate
UdfCommonFlushBuffers
UdfCommonPnpUdfCommonRead
UdfCommonShutdown
UdfCompleteScbOpen
UdfDismountVolume
UdfFilterCallbackAcquireForCreateSection
UdfFindPrefix
UdfFlushIcbForScb
UdfFlushVolume
UdfFspClose
UdfInitializeAllocationSupport
UdfInvalidateVolumes
UdfLookupMetaVsnOfExtent
UdfMountVolume
UdfPerformVerify
UdfPnpCallbackRoutine
UdfPnpQueryRemove
UdfRmwBgFormatWorker
UdfRmwExecuteIoRuns
UdfRmwGetCacheRun
UdfRmwIssueIoRequest
UdfRmwMakeCacheRunValid
UdfSeqCacheReserveFileRegion
UdfSeqCacheUnReserveFileRegion
UdfSeqCacheWriterWorkerRoutineForPOW
UdfSeqCacheWriterWorkerRoutineForVAT
UdfTeardownStructures
UdfVerifyVolume
| |paramcount|0|0| |address|EXTERNAL:0000000c|EXTERNAL:0000000c| |sig|undefined ExAcquireResourceExclusiveLite(void)|undefined ExAcquireResourceExclusiveLite(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::ExAcquireResourceExclusiveLite Calling Diff ```diff --- NTOSKRNL.EXE::ExAcquireResourceExclusiveLite calling +++ NTOSKRNL.EXE::ExAcquireResourceExclusiveLite calling @@ -37 +36,0 @@ -UdfSetEndOfFileInfo ``` ## NTOSKRNL.EXE::IoGetStackLimits ### Match Info |Key|udf_4652.sys - udf_8036.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|udf_4652.sys|udf_8036.sys| | :---: | :---: | :---: | |name|IoGetStackLimits|IoGetStackLimits| |fullname|NTOSKRNL.EXE::IoGetStackLimits|NTOSKRNL.EXE::IoGetStackLimits| |`refcount`|5|4| |length|0|0| |called||| |`calling`|UdfFreeStringBuffer
UdfFsdDispatch
UdfSetThreadContext
UdfTelemetryGuard|UdfFreeStringBuffer
UdfSetThreadContext
UdfTelemetryGuard| |paramcount|0|0| |address|EXTERNAL:00000075|EXTERNAL:00000075| |sig|undefined IoGetStackLimits(void)|undefined IoGetStackLimits(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::IoGetStackLimits Calling Diff ```diff --- NTOSKRNL.EXE::IoGetStackLimits calling +++ NTOSKRNL.EXE::IoGetStackLimits calling @@ -2 +1,0 @@ -UdfFsdDispatch ``` ## NTOSKRNL.EXE::ExRaiseStatus ### Match Info |Key|udf_4652.sys - udf_8036.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|udf_4652.sys|udf_8036.sys| | :---: | :---: | :---: | |name|ExRaiseStatus|ExRaiseStatus| |fullname|NTOSKRNL.EXE::ExRaiseStatus|NTOSKRNL.EXE::ExRaiseStatus| |`refcount`|107|106| |length|0|0| |called||| |`calling`|
Expand for full list:
UdfAcquireDeviceShared
UdfAcquireResource
UdfCheckLegalCS0Dstring
UdfCommonCleanup
UdfCommonClosePrivate
UdfCommonCreate
UdfCommonQueryInfo
UdfCommonQueryVolInfo
UdfCommonRead
UdfCompleteScbOpen
UdfCreateFileLockUdfCreateIrpContext
UdfFindDataInMetadataStream
UdfFindDirEntry
UdfFindPrefix
UdfFindTargetElements
UdfFreeAllocation
UdfGetNextAllocationPostProcessing
UdfInitRmwSupport
UdfInitializeAllocationContext
UdfInitializeAllocationSupport
UdfInitializeAllocations
UdfInitializeScbFromIcbContext
UdfInsertPrefix
UdfInsertPrefixTreeEntry
UdfIsMediaWriteProtected
UdfLockUserBuffer
UdfLookupActiveIcb
UdfLookupActiveIcbInExtent
UdfLookupDirEntryPostProcessing
UdfLookupEa
UdfLookupFileEntryInEnumeration
UdfLookupInitialDirEntry
UdfLookupMetaVsnOfExtent
UdfLookupPsnOfExtent
UdfMapUserBuffer
UdfMapViewOfDirectory
UdfMountVolume
UdfMultipleAsync
UdfNotifyReportChange
UdfPrepareBuffers
UdfPrepareForAllocationChange
UdfQueryDirectory
UdfQueryFeature
UdfRaiseStatusEx
UdfReadWriteSectors
UdfRmwBgFormatWorker
UdfRmwIssueIoRequest
UdfSeqCacheFlushCache
UdfSeqCacheInitialize
UdfSeqCacheReadBlocksForFile
UdfSeqCacheReserveFileRegion
UdfSeqCacheUnReserveFileRegion
UdfSetEndOfFileInfo
UdfSetLinkInfo
UdfSetRenameInfo
UdfTeardownStructures
UdfUpdateDirNames
UdfUpdateTimestampsFromIcbContext
UdfUpdateTimestampsToIcb
UdfValidateAndRemoveStreamSuffix
UdfVerifyDescriptor
UdfVerifyScbBranch
UdfVerifyScbOperation
UdfVerifyVcb
|
Expand for full list:
UdfAcquireDeviceShared
UdfAcquireResource
UdfCheckLegalCS0Dstring
UdfCommonCleanup
UdfCommonClosePrivate
UdfCommonCreate
UdfCommonQueryInfo
UdfCommonQueryVolInfo
UdfCommonRead
UdfCompleteScbOpen
UdfCreateFileLockUdfCreateIrpContext
UdfFindDataInMetadataStream
UdfFindDirEntry
UdfFindPrefix
UdfFindTargetElements
UdfFreeAllocation
UdfGetNextAllocationPostProcessing
UdfInitRmwSupport
UdfInitializeAllocationContext
UdfInitializeAllocationSupport
UdfInitializeAllocations
UdfInitializeScbFromIcbContext
UdfInsertPrefix
UdfInsertPrefixTreeEntry
UdfIsMediaWriteProtected
UdfLockUserBuffer
UdfLookupActiveIcb
UdfLookupActiveIcbInExtent
UdfLookupDirEntryPostProcessing
UdfLookupEa
UdfLookupFileEntryInEnumeration
UdfLookupInitialDirEntry
UdfLookupMetaVsnOfExtent
UdfLookupPsnOfExtent
UdfMapUserBuffer
UdfMapViewOfDirectory
UdfMountVolume
UdfMultipleAsync
UdfNotifyReportChange
UdfPrepareBuffers
UdfPrepareForAllocationChange
UdfQueryDirectory
UdfQueryFeature
UdfRaiseStatusEx
UdfReadWriteSectors
UdfRmwBgFormatWorker
UdfRmwIssueIoRequest
UdfSeqCacheFlushCache
UdfSeqCacheInitialize
UdfSeqCacheReadBlocksForFile
UdfSeqCacheReserveFileRegion
UdfSeqCacheUnReserveFileRegion
UdfSetLinkInfo
UdfSetRenameInfo
UdfTeardownStructures
UdfUpdateDirNames
UdfUpdateTimestampsFromIcbContext
UdfUpdateTimestampsToIcb
UdfValidateAndRemoveStreamSuffix
UdfVerifyDescriptor
UdfVerifyScbBranch
UdfVerifyScbOperation
UdfVerifyVcb
| |paramcount|0|0| |address|EXTERNAL:00000008|EXTERNAL:00000008| |sig|noreturn undefined ExRaiseStatus(void)|noreturn undefined ExRaiseStatus(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::ExRaiseStatus Calling Diff ```diff --- NTOSKRNL.EXE::ExRaiseStatus calling +++ NTOSKRNL.EXE::ExRaiseStatus calling @@ -54 +53,0 @@ -UdfSetEndOfFileInfo ``` ## UdfAcquireResource ### Match Info |Key|udf_4652.sys - udf_8036.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.7| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|udf_4652.sys|udf_8036.sys| | :---: | :---: | :---: | |name|UdfAcquireResource|UdfAcquireResource| |fullname|UdfAcquireResource|UdfAcquireResource| |`refcount`|171|172| |length|154|154| |called|NTOSKRNL.EXE::ExAcquireResourceExclusiveLite
NTOSKRNL.EXE::ExAcquireResourceSharedLite
NTOSKRNL.EXE::ExAcquireSharedStarveExclusive
NTOSKRNL.EXE::ExRaiseStatus|NTOSKRNL.EXE::ExAcquireResourceExclusiveLite
NTOSKRNL.EXE::ExAcquireResourceSharedLite
NTOSKRNL.EXE::ExAcquireSharedStarveExclusive
NTOSKRNL.EXE::ExRaiseStatus| |`calling`|
Expand for full list:
UdfAcquireAllFiles
UdfAcquireDeviceShared
UdfAddAllocation
UdfAllocateBlockForIcb
UdfCheckForDismount
UdfCleanVolumeWorker
UdfCommonCleanup
UdfCommonDevControl
UdfCommonFlushBuffers
UdfCommonLockControl
UdfCommonSetInfoUdfCommonSetVolInfo
UdfCommonShutdown
UdfCommonWrite
UdfCreateLink
UdfDeallocateMetaDataBlock
UdfDeleteLinkAndTruncateScbs
UdfDismountVolume
UdfExtendMetaDataFile
UdfFastQueryStdInfo
UdfFastUnlockAll
UdfFastUnlockAllByKey
UdfFindPrefix
UdfFlushVolume
UdfFreeAllocation
UdfFspClose
UdfGenerateFullNameForLcb
UdfGetRetrievalPointers
UdfGetVolumeBitmap
UdfInitializeAllocations
UdfInvalidateVolumes
UdfIsVolumeMounted
UdfLockVolume
UdfLockVolumeInternal
UdfMakeCompatible
UdfMarkHandle
UdfMarkVolumeClean
UdfMarkVolumeCorrupt
UdfMarkVolumeDirty
UdfMarkVolumeOpenAndQueueCloseDpc
UdfMoveFile
UdfNotifyChangeDirectory
UdfOpenExistingScb
UdfOpenObjectByFileId
UdfOpenObjectFromDirContext
UdfOplockRequest
UdfPerformVerify
UdfPnpCallbackRoutine
UdfPnpCancelRemove
UdfPnpQueryRemove
UdfPnpRemove
UdfPnpSurpriseRemove
UdfPowMakeCompatible
UdfPowReserveMetaDataBlocks
UdfPrepareMediaEjectWorker
UdfProcessHolesInFileRegion
UdfQueryAlternateNameInfo
UdfQueryStreamsInfo
UdfSeqCacheCloseSession
UdfSeqCacheDeallocate
UdfSeqCacheFlushCache
UdfSeqCacheForceAllocation
UdfSeqCacheFormatEmptySession
UdfSeqCacheIssuePowWriteForBuffer
UdfSeqCacheIssueWriteForBuffer
UdfSeqCacheReadBlocksForFile
UdfSeqCacheReleaseWriteWaiter
UdfSeqCacheTransferMcb
UdfSeqCacheTruncateDataForFile
UdfSeqCacheWriteBlocksForFile
UdfSeqCacheWriteCheckPOW
UdfSeqCacheWriterWorkerRoutineForPOW
UdfSeqCacheWriterWorkerRoutineForVAT
UdfSetAllocationInfo
UdfSetDefectManagement
UdfSetHiddenAttribute
UdfSetLinkInfo
UdfSetPurgeFailureMode
UdfSetRenameInfo
UdfSupersedeOrOverwriteFile
UdfTearDownAllocationSupport
UdfUnlockVolume
UdfUpdateMetadataAllocation
UdfUpdateVolumeStructures
UdfVerifyMcbAllocatedInBitmap
UdfVerifyScbBranch
UdfVerifyVolume
UdfVerifyVolume$fin$0
UdfWriteVATAndFlushBuffers
|
Expand for full list:
UdfAcquireAllFiles
UdfAcquireDeviceShared
UdfAddAllocation
UdfAllocateBlockForIcb
UdfCheckForDismount
UdfCleanVolumeWorker
UdfCommonCleanup
UdfCommonDevControl
UdfCommonFlushBuffers
UdfCommonLockControl
UdfCommonSetInfoUdfCommonSetVolInfo
UdfCommonShutdown
UdfCommonWrite
UdfCreateLink
UdfDeallocateMetaDataBlock
UdfDeleteLinkAndTruncateScbs
UdfDismountVolume
UdfExtendMetaDataFile
UdfFastQueryStdInfo
UdfFastUnlockAll
UdfFastUnlockAllByKey
UdfFindPrefix
UdfFlushVolume
UdfFreeAllocation
UdfFspClose
UdfGenerateFullNameForLcb
UdfGetRetrievalPointers
UdfGetVolumeBitmap
UdfInitializeAllocations
UdfInvalidateVolumes
UdfIsVolumeMounted
UdfLockVolume
UdfLockVolumeInternal
UdfMakeCompatible
UdfMarkHandle
UdfMarkVolumeClean
UdfMarkVolumeCorrupt
UdfMarkVolumeDirty
UdfMarkVolumeOpenAndQueueCloseDpc
UdfMoveFile
UdfNotifyChangeDirectory
UdfOpenExistingScb
UdfOpenObjectByFileId
UdfOpenObjectFromDirContext
UdfOplockRequest
UdfPerformVerify
UdfPnpCallbackRoutine
UdfPnpCancelRemove
UdfPnpQueryRemove
UdfPnpRemove
UdfPnpSurpriseRemove
UdfPowMakeCompatible
UdfPowReserveMetaDataBlocks
UdfPrepareMediaEjectWorker
UdfProcessHolesInFileRegion
UdfQueryAlternateNameInfo
UdfQueryStreamsInfo
UdfSeqCacheCloseSession
UdfSeqCacheDeallocate
UdfSeqCacheFlushCache
UdfSeqCacheForceAllocation
UdfSeqCacheFormatEmptySession
UdfSeqCacheIssuePowWriteForBuffer
UdfSeqCacheIssueWriteForBuffer
UdfSeqCacheReadBlocksForFile
UdfSeqCacheReleaseWriteWaiter
UdfSeqCacheTransferMcb
UdfSeqCacheTruncateDataForFile
UdfSeqCacheWriteBlocksForFile
UdfSeqCacheWriteCheckPOW
UdfSeqCacheWriterWorkerRoutineForPOW
UdfSeqCacheWriterWorkerRoutineForVAT
UdfSetAllocationInfo
UdfSetDefectManagement
UdfSetEndOfFileInfo
UdfSetHiddenAttribute
UdfSetLinkInfo
UdfSetPurgeFailureMode
UdfSetRenameInfo
UdfSupersedeOrOverwriteFile
UdfTearDownAllocationSupport
UdfUnlockVolume
UdfUpdateMetadataAllocation
UdfUpdateVolumeStructures
UdfVerifyMcbAllocatedInBitmap
UdfVerifyScbBranch
UdfVerifyVolume
UdfVerifyVolume$fin$0
UdfWriteVATAndFlushBuffers
| |paramcount|4|4| |`address`|1c004b850|14004c8a0| |sig|ulonglong __fastcall UdfAcquireResource(longlong param_1, undefined8 param_2, char param_3, int param_4)|ulonglong __fastcall UdfAcquireResource(longlong param_1, undefined8 param_2, char param_3, int param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UdfAcquireResource Calling Diff ```diff --- UdfAcquireResource calling +++ UdfAcquireResource calling @@ -75,0 +76 @@ +UdfSetEndOfFileInfo ``` Generated with `ghidriff` version: 1.0.0 on 2026-08-18T21:51:56