# vhdmp-2026-07.sys-vhdmp-2026-08.sys Diff # TOC * [Visual Chart Diff](#visual-chart-diff) * [Metadata](#metadata) * [Ghidra Diff Engine](#ghidra-diff-engine) * [Command Line](#command-line) * [Binary Metadata Diff](#binary-metadata-diff) * [Program Options](#program-options) * [Diff Stats](#diff-stats) * [Strings](#strings) * [Deleted](#deleted) * [Added](#added) * [Feature_3417294137__private_IsEnabledDeviceUsageNoInline](#feature_3417294137__private_isenableddeviceusagenoinline) * [Feature_3417294137__private_IsEnabledFallback](#feature_3417294137__private_isenabledfallback) * [Feature_1070577979__private_IsEnabledDeviceUsageNoInline](#feature_1070577979__private_isenableddeviceusagenoinline) * [Feature_1070577979__private_IsEnabledFallback](#feature_1070577979__private_isenabledfallback) * [VhdmpiReleaseBackingStoreAccessLocked](#vhdmpireleasebackingstoreaccesslocked) * [Modified](#modified) * [VhdmpiReleaseBackingStoreAccessForSecurityContext](#vhdmpireleasebackingstoreaccessforsecuritycontext) * [VhdmpiQueueIoRequest](#vhdmpiqueueiorequest) * [VhdmpiAcquireBackingStoreAccessLocked](#vhdmpiacquirebackingstoreaccesslocked) * [Modified (No Code Changes)](#modified-no-code-changes) * [VhdmpiRecordForPrefetchWorker](#vhdmpirecordforprefetchworker) * [NTOSKRNL.EXE::ExAcquireRundownProtection](#ntoskrnlexeexacquirerundownprotection) * [wil_details_IsEnabledFallback](#wil_details_isenabledfallback) * [NTOSKRNL.EXE::ExReleaseRundownProtection](#ntoskrnlexeexreleaserundownprotection) # Visual Chart Diff ```mermaid flowchart LR VhdmpiReleaseBackingStoreAccessForSecurityContext-3-old<--Match 90%-->VhdmpiReleaseBackingStoreAccessForSecurityContext-3-new VhdmpiQueueIoRequest-5-old<--Match 28%-->VhdmpiQueueIoRequest-5-new VhdmpiAcquireBackingStoreAccessLocked-3-old<--Match 90%-->VhdmpiAcquireBackingStoreAccessLocked-3-new subgraph vhdmp-2026-08.sys VhdmpiReleaseBackingStoreAccessForSecurityContext-3-new VhdmpiQueueIoRequest-5-new VhdmpiAcquireBackingStoreAccessLocked-3-new subgraph Added direction LR Feature_3417294137__private_IsEnabledDeviceUsageNoInline Feature_3417294137__private_IsEnabledFallback Feature_1070577979__private_IsEnabledDeviceUsageNoInline Feature_1070577979__private_IsEnabledFallback VhdmpiReleaseBackingStoreAccessLocked end end subgraph vhdmp-2026-07.sys VhdmpiReleaseBackingStoreAccessForSecurityContext-3-old VhdmpiQueueIoRequest-5-old VhdmpiAcquireBackingStoreAccessLocked-3-old end ``` ```mermaid pie showData title Function Matches - 99.9085% "unmatched_funcs_len" : 5 "matched_funcs_len" : 5458 ``` ```mermaid pie showData title Matched Function Similarity - 99.8717% "matched_funcs_with_code_changes_len" : 3 "matched_funcs_with_non_code_changes_len" : 4 "matched_funcs_no_changes_len" : 5451 ``` # Metadata ## Ghidra Diff Engine ### Command Line #### Captured Command Line ``` ghidriff --project-location ./proj --project-name vhdmp5912 --symbols-path ./sym --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --bsim --max-ram-percent 60.0 --max-section-funcs 200 vhdmp-2026-07.sys vhdmp-2026-08.sys ``` #### Verbose Args

``` --old ['vhdmp-2026-07.sys'] --new [['vhdmp-2026-08.sys']] --engine VersionTrackingDiff --output-path ./out --summary False --project-location ./proj --project-name vhdmp5912 --symbols-path ./sym --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim True --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title None ```

#### Download Original PEs ``` wget https://msdl.microsoft.com/download/symbols/vhdmp.sys/62074CA4107000/vhdmp.sys -O vhdmp.sys.x64.10.0.26100.8972 wget https://msdl.microsoft.com/download/symbols/vhdmp.sys/01E4A1C3107000/vhdmp.sys -O vhdmp.sys.x64.10.0.26100.9168 ``` ## Binary Metadata Diff ```diff --- vhdmp-2026-07.sys Meta +++ vhdmp-2026-08.sys Meta @@ -1,44 +1,44 @@ -Program Name: vhdmp-2026-07.sys +Program Name: vhdmp-2026-08.sys Language ID: x86:LE:64:default (4.6) Compiler ID: windows Processor: x86 Endian: Little Address Size: 64 Minimum Address: 140000000 Maximum Address: ff0000184f -# of Bytes: 1081576 +# of Bytes: 1081592 # of Memory Blocks: 13 -# of Instructions: 176224 -# of Defined Data: 7421 -# of Functions: 2729 -# of Symbols: 26469 +# of Instructions: 176318 +# of Defined Data: 7432 +# of Functions: 2734 +# of Symbols: 26497 # of Data Types: 677 # of Data Type Categories: 25 Analyzed: true Compiler: visualstudio:unknown Created With Ghidra Version: 12.0.4 -Date Created: Sat Aug 15 17:14:40 SGT 2026 +Date Created: Sat Aug 15 17:14:44 SGT 2026 Executable Format: Portable Executable (PE) -Executable Location: /sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/ghidriff/CVE-2026-59125/vhdmp-2026-07.sys -Executable MD5: 52826b92e2cc9d16d4b2032b934295b9 -Executable SHA256: a5e97f3b5a2e49fa74dc104118667250bc8331b0baef5d0597f3919b301e8a8d -FSRL: file:///sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/ghidriff/CVE-2026-59125/vhdmp-2026-07.sys?MD5=52826b92e2cc9d16d4b2032b934295b9 +Executable Location: /sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/ghidriff/CVE-2026-59125/vhdmp-2026-08.sys +Executable MD5: 150ca9edac79c3ea1d3333fe35624763 +Executable SHA256: 690c256f6c5045adbeb68452a0147f802a89b3bcd49532caa26c89654113c739 +FSRL: file:///sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/ghidriff/CVE-2026-59125/vhdmp-2026-08.sys?MD5=150ca9edac79c3ea1d3333fe35624763 PDB Age: 1 PDB File: vhdmp.pdb -PDB GUID: 665b6a32-9e8d-3a3c-164f-ddaeac5a932d +PDB GUID: b700cba4-e657-94af-ff6b-0b6c8ac6521d PDB Loaded: true PDB Version: RSDS PE Property[CompanyName]: Microsoft Corporation PE Property[FileDescription]: VHD Miniport Driver -PE Property[FileVersion]: 10.0.26100.8972 (WinBuild.160101.0800) +PE Property[FileVersion]: 10.0.26100.9168 (WinBuild.160101.0800) PE Property[InternalName]: vhdmp.sys PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved. PE Property[OriginalFilename]: vhdmp.sys PE Property[ProductName]: Microsoft® Windows® Operating System -PE Property[ProductVersion]: 10.0.26100.8972 +PE Property[ProductVersion]: 10.0.26100.9168 PE Property[Translation]: 4b00000 Preferred Root Namespace Category: RTTI Found: false Relocatable: true SectionAlignment: 4096 Should Ask To Analyze: false ``` ## Program Options

Ghidra vhdmp-2026-07.sys Decompiler Options

Ghidra vhdmp-2026-07.sys Specification extensions Options

|Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|

Ghidra vhdmp-2026-07.sys Analyzers Options

|Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.Apply Function Calling Conventions|true| |Demangler Microsoft.Apply Function Signatures|true| |Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS| |Demangler Microsoft.Demangle Only Known Mangled Symbols|false| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|

Ghidra vhdmp-2026-08.sys Decompiler Options

Ghidra vhdmp-2026-08.sys Specification extensions Options

|Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|

Ghidra vhdmp-2026-08.sys Analyzers Options

## Diff Stats |Stat|Value| | :---: | :---: | |added_funcs_len|5| |deleted_funcs_len|0| |modified_funcs_len|7| |added_symbols_len|6| |deleted_symbols_len|0| |diff_time|5.644163370132446| |deleted_strings_len|0| |added_strings_len|0| |match_types|Counter({'SymbolsHash': 2728, 'ExternalsName': 318})| |items_to_process|18| |diff_types|Counter({'refcount': 5, 'address': 4, 'code': 3, 'length': 3, 'called': 3, 'sig': 1, 'calling': 1})| |unmatched_funcs_len|5| |total_funcs_len|5463| |matched_funcs_len|5458| |matched_funcs_with_code_changes_len|3| |matched_funcs_with_non_code_changes_len|4| |matched_funcs_no_changes_len|5451| |match_func_similarity_percent|99.8717%| |func_match_overall_percent|99.9085%| |first_matches|Counter({'SymbolsHash': 2728})| ```mermaid pie showData title All Matches "SymbolsHash" : 2728 "ExternalsName" : 318 ``` ```mermaid pie showData title First Matches "SymbolsHash" : 2728 ``` ```mermaid pie showData title Diff Stats "added_funcs_len" : 5 "deleted_funcs_len" : 0 "modified_funcs_len" : 7 ``` ```mermaid pie showData title Symbols "added_symbols_len" : 6 "deleted_symbols_len" : 0 ``` ## Strings *No string differences found* # Deleted # Added ## Feature_3417294137__private_IsEnabledDeviceUsageNoInline ### Function Meta |Key|vhdmp-2026-08.sys| | :---: | :---: | |name|Feature_3417294137__private_IsEnabledDeviceUsageNoInline| |fullname|Feature_3417294137__private_IsEnabledDeviceUsageNoInline| |refcount|2| |length|49| |called|Feature_3417294137__private_IsEnabledFallback| |calling|VhdmpiQueueIoRequest| |paramcount|0| |address|1400330ec| |sig|ulonglong __fastcall Feature_3417294137__private_IsEnabledDeviceUsageNoInline(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_3417294137__private_IsEnabledDeviceUsageNoInline +++ Feature_3417294137__private_IsEnabledDeviceUsageNoInline @@ -0,0 +1,17 @@ + +ulonglong Feature_3417294137__private_IsEnabledDeviceUsageNoInline(void) + +{ + ulonglong uVar1; + undefined8 local_res8; + + local_res8 = (ulonglong)Feature_3417294137__private_featureState; + if ((Feature_3417294137__private_featureState & 0x10) == 0) { + uVar1 = Feature_3417294137__private_IsEnabledFallback(local_res8,3); + } + else { + uVar1 = (ulonglong)(Feature_3417294137__private_featureState & 1); + } + return uVar1; +} + ``` ## Feature_3417294137__private_IsEnabledFallback ### Function Meta |Key|vhdmp-2026-08.sys| | :---: | :---: | |name|Feature_3417294137__private_IsEnabledFallback| |fullname|Feature_3417294137__private_IsEnabledFallback| |refcount|2| |length|21| |called|wil_details_IsEnabledFallback| |calling|Feature_3417294137__private_IsEnabledDeviceUsageNoInline| |paramcount|2| |address|140033124| |sig|undefined __fastcall Feature_3417294137__private_IsEnabledFallback(ulonglong param_1, int param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_3417294137__private_IsEnabledFallback +++ Feature_3417294137__private_IsEnabledFallback @@ -0,0 +1,8 @@ + +void Feature_3417294137__private_IsEnabledFallback(ulonglong param_1,int param_2) + +{ + wil_details_IsEnabledFallback(param_1,param_2,&Feature_3417294137__private_descriptor); + return; +} + ``` ## Feature_1070577979__private_IsEnabledDeviceUsageNoInline ### Function Meta |Key|vhdmp-2026-08.sys| | :---: | :---: | |name|Feature_1070577979__private_IsEnabledDeviceUsageNoInline| |fullname|Feature_1070577979__private_IsEnabledDeviceUsageNoInline| |refcount|3| |length|49| |called|Feature_1070577979__private_IsEnabledFallback| |calling|VhdmpiAcquireBackingStoreAccessLocked
VhdmpiReleaseBackingStoreAccessLocked| |paramcount|0| |address|140048d4c| |sig|ulonglong __fastcall Feature_1070577979__private_IsEnabledDeviceUsageNoInline(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_1070577979__private_IsEnabledDeviceUsageNoInline +++ Feature_1070577979__private_IsEnabledDeviceUsageNoInline @@ -0,0 +1,17 @@ + +ulonglong Feature_1070577979__private_IsEnabledDeviceUsageNoInline(void) + +{ + ulonglong uVar1; + undefined8 local_res8; + + local_res8 = (ulonglong)Feature_1070577979__private_featureState; + if ((Feature_1070577979__private_featureState & 0x10) == 0) { + uVar1 = Feature_1070577979__private_IsEnabledFallback(local_res8,3); + } + else { + uVar1 = (ulonglong)(Feature_1070577979__private_featureState & 1); + } + return uVar1; +} + ``` ## Feature_1070577979__private_IsEnabledFallback ### Function Meta |Key|vhdmp-2026-08.sys| | :---: | :---: | |name|Feature_1070577979__private_IsEnabledFallback| |fullname|Feature_1070577979__private_IsEnabledFallback| |refcount|2| |length|21| |called|wil_details_IsEnabledFallback| |calling|Feature_1070577979__private_IsEnabledDeviceUsageNoInline| |paramcount|2| |address|140048d84| |sig|undefined __fastcall Feature_1070577979__private_IsEnabledFallback(ulonglong param_1, int param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_1070577979__private_IsEnabledFallback +++ Feature_1070577979__private_IsEnabledFallback @@ -0,0 +1,8 @@ + +void Feature_1070577979__private_IsEnabledFallback(ulonglong param_1,int param_2) + +{ + wil_details_IsEnabledFallback(param_1,param_2,&Feature_1070577979__private_descriptor); + return; +} + ``` ## VhdmpiReleaseBackingStoreAccessLocked ### Function Meta |Key|vhdmp-2026-08.sys| | :---: | :---: | |name|VhdmpiReleaseBackingStoreAccessLocked| |fullname|VhdmpiReleaseBackingStoreAccessLocked| |refcount|2| |length|115| |called|Feature_1070577979__private_IsEnabledDeviceUsageNoInline
VhdmpiCheckFileWrapperForError
VhdmpiReleaseFileWrapperAccess
_guard_dispatch_icall| |calling|VhdmpiReleaseBackingStoreAccessForSecurityContext| |paramcount|2| |address|1400c926c| |sig|void __cdecl VhdmpiReleaseBackingStoreAccessLocked(_VHD_BACKING_STORE_HEADER * param_1, _BACKING_STORE_ACCESS_MODE param_2)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- VhdmpiReleaseBackingStoreAccessLocked +++ VhdmpiReleaseBackingStoreAccessLocked @@ -0,0 +1,28 @@ + +/* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ +/* void __cdecl VhdmpiReleaseBackingStoreAccessLocked(struct _VHD_BACKING_STORE_HEADER * + __ptr64,enum _BACKING_STORE_ACCESS_MODE) */ + +void __cdecl +VhdmpiReleaseBackingStoreAccessLocked + (_VHD_BACKING_STORE_HEADER *param_1,_BACKING_STORE_ACCESS_MODE param_2) + +{ + ulonglong uVar1; + + if (param_1 != (_VHD_BACKING_STORE_HEADER *)&VhdmpiEmptyISOBackingStore) { + if (param_2 == 2) { + if ((*(longlong *)(param_1 + 0x440) == 1) && (param_1[8] != (_VHD_BACKING_STORE_HEADER)0x0)) { + uVar1 = Feature_1070577979__private_IsEnabledDeviceUsageNoInline(); + if (((int)uVar1 == 0) || (*(int *)(*(longlong *)param_1 + 0x10) != 1)) { + (**(code **)(*(longlong *)param_1 + 0x60))(param_1); + } + } + *(longlong *)(param_1 + 0x440) = *(longlong *)(param_1 + 0x440) + -1; + } + VhdmpiReleaseFileWrapperAccess((_VHD_FILE_WRAPPER *)(param_1 + 0x48),param_2); + VhdmpiCheckFileWrapperForError(param_1); + } + return; +} + ``` # Modified *Modified functions contain code changes* ## VhdmpiReleaseBackingStoreAccessForSecurityContext ### Match Info |Key|vhdmp-2026-07.sys - vhdmp-2026-08.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.68| |i_ratio|0.32| |m_ratio|0.92| |b_ratio|0.9| |match_types|SymbolsHash| ### Function Meta Diff |Key|vhdmp-2026-07.sys|vhdmp-2026-08.sys| | :---: | :---: | :---: | |name|VhdmpiReleaseBackingStoreAccessForSecurityContext|VhdmpiReleaseBackingStoreAccessForSecurityContext| |fullname|VhdmpiReleaseBackingStoreAccessForSecurityContext|VhdmpiReleaseBackingStoreAccessForSecurityContext| |refcount|7|7| |`length`|550|482| |`called`|

Expand for full list:
McTemplateK0zq_EtwWriteTransfer
NTOSKRNL.EXE::ExFreePoolWithTag
VhdmpiAcquirePassiveLock
VhdmpiAcquireRctAccess
VhdmpiCheckFileWrapperForError
VhdmpiGetBackingStoreAccessNode
VhdmpiGetLastWriteTime
VhdmpiIsRctEnabled
VhdmpiReleaseBackingStoreAccessNode
VhdmpiReleaseFileWrapperAccess
VhdmpiReleasePassiveLock

VhdmpiReleaseRctAccess
VhdmpiSetRctLinkageWriteTime
_guard_dispatch_icall

Expand for full list:
McTemplateK0zq_EtwWriteTransfer
NTOSKRNL.EXE::ExFreePoolWithTag
VhdmpiAcquirePassiveLock
VhdmpiAcquireRctAccess
VhdmpiGetBackingStoreAccessNode
VhdmpiGetLastWriteTime
VhdmpiIsRctEnabled
VhdmpiReleaseBackingStoreAccessLocked
VhdmpiReleaseBackingStoreAccessNode
VhdmpiReleasePassiveLock
VhdmpiReleaseRctAccess

VhdmpiSetRctLinkageWriteTime

| |calling|VhdmpiAcquireBackingStoreAndRctAccess
VhdmpiAddVirtualDiskParent
VhdmpiReleaseBackingStoreAccess
VhdmpiReleaseBackingStoreAndRctAccess
VhdmpiReleaseBackingStoreChainAccessForSecurityContext
VhdmpiUpdateParentLocator|VhdmpiAcquireBackingStoreAndRctAccess
VhdmpiAddVirtualDiskParent
VhdmpiReleaseBackingStoreAccess
VhdmpiReleaseBackingStoreAndRctAccess
VhdmpiReleaseBackingStoreChainAccessForSecurityContext
VhdmpiUpdateParentLocator| |paramcount|3|3| |`address`|1400cad4c|1400cadcc| |sig|undefined __fastcall VhdmpiReleaseBackingStoreAccessForSecurityContext(VHD_SECURITY_CONTEXT * param_1, _VHD_BACKING_STORE_HEADER * param_2, ulonglong param_3)|undefined __fastcall VhdmpiReleaseBackingStoreAccessForSecurityContext(VHD_SECURITY_CONTEXT * param_1, _VHD_BACKING_STORE_HEADER * param_2, ulonglong param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### VhdmpiReleaseBackingStoreAccessForSecurityContext Called Diff ```diff --- VhdmpiReleaseBackingStoreAccessForSecurityContext called +++ VhdmpiReleaseBackingStoreAccessForSecurityContext called @@ -5 +4,0 @@ -VhdmpiCheckFileWrapperForError @@ -8,0 +8 @@ +VhdmpiReleaseBackingStoreAccessLocked @@ -10 +9,0 @@ -VhdmpiReleaseFileWrapperAccess @@ -14 +12,0 @@ -_guard_dispatch_icall ``` ### VhdmpiReleaseBackingStoreAccessForSecurityContext Diff ```diff --- VhdmpiReleaseBackingStoreAccessForSecurityContext +++ VhdmpiReleaseBackingStoreAccessForSecurityContext @@ -1,148 +1,133 @@ - -/* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ void VhdmpiReleaseBackingStoreAccessForSecurityContext (VHD_SECURITY_CONTEXT *param_1,_VHD_BACKING_STORE_HEADER *param_2,ulonglong param_3) { longlong lVar1; - code *pcVar2; - wchar_t *pwVar3; + wchar_t *pwVar2; + code *pcVar3; uchar uVar4; uint uVar5; _VHD_BACKING_STORE_ACCESS_NODE *p_Var6; _VHD_BACKING_STORE_ACCESS_NODE *p_Var7; ulonglong uVar8; undefined8 uVar9; - VHD_RCT_STATE *pVVar10; + _VHD_FILE_WRAPPER *p_Var10; int iVar11; ulonglong uVar12; undefined1 *puVar13; undefined1 *puVar14; ulonglong uVar15; - undefined1 auStack_58 [48]; + undefined1 auStack_48 [48]; - puVar14 = auStack_58; + puVar14 = auStack_48; uVar12 = param_3 & 0xffffffff; VhdmpiAcquirePassiveLock((longlong)(param_2 + 0x430)); p_Var6 = VhdmpiGetBackingStoreAccessNode(param_2,param_1,'\0'); - puVar13 = auStack_58; + puVar13 = auStack_48; if (p_Var6 == (_VHD_BACKING_STORE_ACCESS_NODE *)0x0) goto LAB_0; iVar11 = (int)param_3; p_Var7 = p_Var6; if (iVar11 == 2) { - puVar13 = auStack_58; + puVar13 = auStack_48; if (*(longlong *)(p_Var6 + 0x20) < 1) goto LAB_0; } else if (iVar11 == 1) { - puVar13 = auStack_58; + puVar13 = auStack_48; if (0 < *(longlong *)(p_Var6 + 0x18)) goto LAB_1; goto LAB_0; } - puVar14 = auStack_58; + puVar14 = auStack_48; if (iVar11 != 2) goto LAB_1; p_Var7 = p_Var6 + 0x20; *(longlong *)p_Var7 = *(longlong *)p_Var7 + -1; lVar1 = *(longlong *)p_Var7; - puVar14 = auStack_58; + puVar14 = auStack_48; do { if (lVar1 != 0) { LAB_2: - *(undefined8 *)(puVar14 + -8) = 0x1400caf35; + *(undefined8 *)(puVar14 + -8) = 0x1400caf6f; uVar4 = VhdmpiReleaseBackingStoreAccessNode(p_Var6); - *(undefined8 *)(puVar14 + -8) = 0x1400caf43; + *(undefined8 *)(puVar14 + -8) = 0x1400caf7d; VhdmpiReleasePassiveLock((longlong)(param_2 + 0x430)); if (uVar4 != '\0') { - *(undefined8 *)(puVar14 + -8) = 0x1400caf56; + *(undefined8 *)(puVar14 + -8) = 0x1400caf90; ExFreePoolWithTag(p_Var6,0x63444856); } return; } - iVar11 = (int)uVar12; - if (param_2 != (_VHD_BACKING_STORE_HEADER *)&VhdmpiEmptyISOBackingStore) { - if (iVar11 == 2) { - if ((*(longlong *)(param_2 + 0x440) == 1) && (param_2[8] != (_VHD_BACKING_STORE_HEADER)0x0)) - { - pcVar2 = *(code **)(*(longlong *)param_2 + 0x60); - *(undefined8 *)(puVar14 + -8) = 0x1400cadf4; - (*pcVar2)(param_2); - } - *(longlong *)(param_2 + 0x440) = *(longlong *)(param_2 + 0x440) + -1; - } - *(undefined8 *)(puVar14 + -8) = 0x1400cae09; - VhdmpiReleaseFileWrapperAccess((_VHD_FILE_WRAPPER *)(param_2 + 0x48),iVar11); - *(undefined8 *)(puVar14 + -8) = 0x1400cae11; - VhdmpiCheckFileWrapperForError(param_2); - } - pVVar10 = (VHD_RCT_STATE *)(param_2 + 0x48); - if (((iVar11 == 2) && (*(longlong *)(param_2 + 0x440) == 0)) && + *(undefined8 *)(puVar14 + -8) = 0x1400cae50; + VhdmpiReleaseBackingStoreAccessLocked(param_2,(_BACKING_STORE_ACCESS_MODE)uVar12); + if ((((_BACKING_STORE_ACCESS_MODE)uVar12 == 2) && (*(longlong *)(param_2 + 0x440) == 0)) && (*(char *)(*(longlong *)param_2 + 0x34) == '\0')) { - *(undefined8 *)(puVar14 + 0x68) = 0; - *(undefined8 *)(puVar14 + -8) = 0x1400cae4c; - uVar8 = VhdmpiGetLastWriteTime((_VHD_FILE_WRAPPER *)pVVar10,(undefined8 *)(puVar14 + 0x68)); + p_Var10 = (_VHD_FILE_WRAPPER *)(param_2 + 0x48); + *(undefined8 *)(puVar14 + 0x58) = 0; + *(undefined8 *)(puVar14 + -8) = 0x1400cae86; + uVar8 = VhdmpiGetLastWriteTime(p_Var10,(undefined8 *)(puVar14 + 0x58)); uVar15 = uVar8 & 0xffffffff; if (-1 < (int)uVar8) { - uVar12 = *(ulonglong *)(puVar14 + 0x68); + uVar12 = *(ulonglong *)(puVar14 + 0x58); if (uVar12 == *(ulonglong *)(param_2 + 0x740)) goto LAB_3; uVar15 = 0; if (p_Var6[0x39] == (_VHD_BACKING_STORE_ACCESS_NODE)0x0) { - *(undefined8 *)(puVar14 + -8) = 0x1400cae7e; - pVVar10 = (VHD_RCT_STATE *)param_2; + *(undefined8 *)(puVar14 + -8) = 0x1400caeb8; + p_Var10 = (_VHD_FILE_WRAPPER *)param_2; uVar5 = VhdmpiAcquireRctAccess(param_2,param_1,2,'\x01'); uVar15 = (ulonglong)uVar5; if (-1 < (int)uVar5) { p_Var6[0x39] = (_VHD_BACKING_STORE_ACCESS_NODE)0x1; goto LAB_4; } } else { LAB_4: - *(undefined8 *)(puVar14 + -8) = 0x1400caea0; - pVVar10 = (VHD_RCT_STATE *)param_2; + param_1 = (VHD_SECURITY_CONTEXT *)(param_2 + 0x740); + *(undefined8 *)(puVar14 + -8) = 0x1400caeda; + p_Var10 = (_VHD_FILE_WRAPPER *)param_2; uVar9 = VhdmpiIsRctEnabled((longlong)param_2); if ((char)uVar9 != '\0') { - pVVar10 = *(VHD_RCT_STATE **)(param_2 + 0x718); - *(undefined8 *)(puVar14 + -8) = 0x1400caeb3; - uVar5 = VhdmpiSetRctLinkageWriteTime(pVVar10,uVar12); + p_Var10 = *(_VHD_FILE_WRAPPER **)(param_2 + 0x718); + *(undefined8 *)(puVar14 + -8) = 0x1400caeed; + uVar5 = VhdmpiSetRctLinkageWriteTime((VHD_RCT_STATE *)p_Var10,uVar12); uVar15 = (ulonglong)uVar5; } } *(ulonglong *)(param_2 + 0x740) = uVar12; if (-1 < (int)uVar15) goto LAB_3; } - if ((Microsoft_Windows_VHDMPEnableBits & 4) != 0) { - pwVar3 = *(wchar_t **)(param_2 + 0x78); + if (((byte)Microsoft_Windows_VHDMPEnableBits & 4) != 0) { + pwVar2 = *(wchar_t **)(param_2 + 0x78); *(int *)(puVar14 + 0x20) = (int)uVar15; - *(undefined8 *)(puVar14 + -8) = 0x1400caedf; - McTemplateK0zq_EtwWriteTransfer(pVVar10,&RctUpdateError,uVar15,pwVar3); + *(undefined8 *)(puVar14 + -8) = 0x1400caf19; + McTemplateK0zq_EtwWriteTransfer(p_Var10,&RctUpdateError,uVar15,pwVar2); } } LAB_3: if (*(longlong *)(p_Var6 + 0x20) != 0) goto LAB_2; puVar13 = puVar14; if (*(longlong *)(p_Var6 + 0x30) == 0) { if ((*(longlong *)(p_Var6 + 0x18) == 0) && (p_Var6[0x38] != (_VHD_BACKING_STORE_ACCESS_NODE)0x0)) { if (*(longlong *)(p_Var6 + 0x28) != 0) goto LAB_0; - *(undefined8 *)(puVar14 + -8) = 0x1400caf12; + *(undefined8 *)(puVar14 + -8) = 0x1400caf4c; VhdmpiReleaseRctAccess(param_2,1); p_Var6[0x38] = (_VHD_BACKING_STORE_ACCESS_NODE)0x0; } if (p_Var6[0x39] != (_VHD_BACKING_STORE_ACCESS_NODE)0x0) { - *(undefined8 *)(puVar14 + -8) = 0x1400caf29; + *(undefined8 *)(puVar14 + -8) = 0x1400caf63; VhdmpiReleaseRctAccess(param_2,2); p_Var6[0x39] = (_VHD_BACKING_STORE_ACCESS_NODE)0x0; } goto LAB_2; } LAB_0: - pcVar2 = (code *)swi(0x29); - p_Var7 = (_VHD_BACKING_STORE_ACCESS_NODE *)(*pcVar2)(0xe); + pcVar3 = (code *)swi(0x29); + p_Var7 = (_VHD_BACKING_STORE_ACCESS_NODE *)(*pcVar3)(0xe); puVar14 = puVar13 + 8; LAB_1: p_Var7 = p_Var7 + 0x18; *(longlong *)p_Var7 = *(longlong *)p_Var7 + -1; lVar1 = *(longlong *)p_Var7; } while( true ); } ``` ## VhdmpiQueueIoRequest ### Match Info |Key|vhdmp-2026-07.sys - vhdmp-2026-08.sys| | :---: | :---: | |diff_type|code,refcount,length,sig,called| |ratio|0.22| |i_ratio|0.19| |m_ratio|0.95| |b_ratio|0.28| |match_types|SymbolsHash| ### Function Meta Diff |Key|vhdmp-2026-07.sys|vhdmp-2026-08.sys| | :---: | :---: | :---: | |name|VhdmpiQueueIoRequest|VhdmpiQueueIoRequest| |fullname|VhdmpiQueueIoRequest|VhdmpiQueueIoRequest| |`refcount`|10|7| |`length`|1651|1685| |`called`|

Expand for full list:
McTemplateK0zqqxq_EtwWriteTransfer
NTOSKRNL.EXE::EtwActivityIdControl
NTOSKRNL.EXE::ExAcquireRundownProtection
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExReleaseRundownProtection
NTOSKRNL.EXE::IoFreeMdl
NTOSKRNL.EXE::MmMapLockedPagesSpecifyCache
TraceEvents
VhdmpiCalculateChecksum
VhdmpiExtendDataBuffer
VhdmpiIsCTLogTrackingEnabled

VhdmpiProcessEventInsert
VhdmpiRecordForPrefetchWorker
VhdmpiReleaseParserRequestResources
_guard_dispatch_icall
_tlgKeywordOn

Expand for full list:
Feature_3417294137__private_IsEnabledDeviceUsageNoInline
McTemplateK0zqqxq_EtwWriteTransfer
NTOSKRNL.EXE::EtwActivityIdControl
NTOSKRNL.EXE::ExAcquireRundownProtection
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExReleaseRundownProtection
NTOSKRNL.EXE::IoFreeMdl
NTOSKRNL.EXE::MmMapLockedPagesSpecifyCache
TraceEvents
VhdmpiCalculateChecksum
VhdmpiExtendDataBuffer

VhdmpiIsCTLogTrackingEnabled
VhdmpiProcessEventInsert
VhdmpiRecordForPrefetchWorker
VhdmpiReleaseParserRequestResources
_guard_dispatch_icall
_tlgKeywordOn

| |calling|VhdmpParserStartIo
VhdmpiCompleteParserRequest
VhdmpiExecuteScsi
VhdmpiExecuteScsiRequest
VhdmpiHandleScsiParsingResult
VhdmpiIssueLowerIoContext|VhdmpParserStartIo
VhdmpiCompleteParserRequest
VhdmpiExecuteScsi
VhdmpiExecuteScsiRequest
VhdmpiHandleScsiParsingResult
VhdmpiIssueLowerIoContext| |paramcount|5|5| |address|140004cc0|140004cc0| |`sig`|undefined4 __fastcall VhdmpiQueueIoRequest(undefined8 param_1, _VHD_SRB_EXTENSION * param_2, uint param_3, longlong param_4, int param_5)|undefined4 __fastcall VhdmpiQueueIoRequest(char * param_1, _VHD_SRB_EXTENSION * param_2, uint param_3, longlong param_4, int param_5)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### VhdmpiQueueIoRequest Called Diff ```diff --- VhdmpiQueueIoRequest called +++ VhdmpiQueueIoRequest called @@ -0,0 +1 @@ +Feature_3417294137__private_IsEnabledDeviceUsageNoInline ``` ### VhdmpiQueueIoRequest Diff ```diff --- VhdmpiQueueIoRequest +++ VhdmpiQueueIoRequest @@ -1,323 +1,329 @@ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ /* WARNING: Control flow encountered bad instruction data */ undefined4 VhdmpiQueueIoRequest - (undefined8 param_1,_VHD_SRB_EXTENSION *param_2,uint param_3,longlong param_4,int param_5) + (char *param_1,_VHD_SRB_EXTENSION *param_2,uint param_3,longlong param_4,int param_5) { int iVar1; - int iVar2; + wchar_t *pwVar2; code *pcVar3; _VHD_PREFETCH_STATE *p_Var4; - wchar_t *pwVar5; - char cVar6; - undefined4 uVar7; + char cVar5; int extraout_EAX; - uint uVar8; - ulonglong uVar9; + uint uVar6; + ulonglong uVar7; + ulonglong uVar8; + byte *pbVar9; undefined8 uVar10; - longlong lVar11; - char *pcVar12; - byte *pbVar13; - ulonglong uVar14; + char *pcVar11; + longlong lVar12; + undefined1 *puVar13; + undefined1 *puVar14; longlong lVar15; - undefined1 *puVar16; - undefined1 *puVar17; - _VHD_SRB_EXTENSION *p_Var18; - undefined8 unaff_R12; - undefined8 unaff_R13; - longlong lVar19; - longlong local_res8 [4]; - undefined8 uStack_a0; - undefined1 auStack_98 [32]; - longlong local_78; - longlong local_70; - undefined8 local_68; - undefined4 local_60 [2]; - longlong local_58 [5]; + _VHD_SRB_EXTENSION *p_Var16; + undefined1 auStackY_78 [8]; + undefined1 auStackY_70 [24]; - puVar17 = auStack_98; - lVar19 = 0; - local_58[0] = 0; - puVar16 = auStack_98; - if (5 < DAT_1) goto LAB_140005096; - while( true ) { - *(undefined8 *)(puVar16 + 0x60) = unaff_R12; - *(undefined8 *)(puVar16 + 0x58) = unaff_R13; - *(undefined8 *)param_2 = param_1; - *(int *)(param_2 + 0x3c) = param_5; - *(uint *)(param_2 + 0x34) = param_3; - *(longlong *)(param_2 + 0x20) = param_4; - if (param_5 == 3) break; + puVar14 = auStackY_78; + lVar15 = 0; + pcVar11 = param_1; + if (5 < DAT_0) { + pcVar11 = (char *)&DAT_0; + cVar5 = _tlgKeywordOn(0x140086708,8); + if (cVar5 != '\0') { + pcVar11 = "VhdmpiQueueIoRequest"; + TraceEvents("VhdmpiQueueIoRequest",0x644,5,8, + "enter... SrbExtension=0x%p VirtualDisk=0x%p IoType=%d"); + } + } + *(char **)param_2 = param_1; + *(int *)(param_2 + 0x3c) = param_5; + *(uint *)(param_2 + 0x34) = param_3; + *(longlong *)(param_2 + 0x20) = param_4; + if (param_5 == 3) { + *(undefined8 *)(param_2 + 0x120) = 0; + *(undefined8 *)(param_2 + 0x128) = 0; + *(undefined8 *)(param_2 + 0x130) = 0; + *(undefined8 *)(param_2 + 0x138) = 0; + *(undefined8 *)(param_2 + 0x140) = 0; + *(undefined8 *)(param_2 + 0x148) = 0; + *(undefined8 *)(param_2 + 0x150) = 0; + *(undefined8 *)(param_2 + 0x138) = 0xffffffffffffffff; + *(undefined8 *)(param_2 + 0x140) = 0xffffffffffffffff; + *(undefined8 *)(param_2 + 0x148) = 0xffffffffffffffff; + *(undefined4 *)(param_2 + 0x158) = 2; + puVar14 = auStackY_78; + } + else { + puVar13 = auStackY_78; if (param_5 == 7) { -switchD_14000507f_caseD_0: - uVar14 = (ulonglong)((*(uint *)(param_2 + 0x40) & 0x1000 | 0x400) >> 10); -LAB_2: - *(undefined8 *)(param_2 + 0x120) = 0; - *(undefined8 *)(param_2 + 0x128) = 0; - lVar11 = param_4 + (ulonglong)param_3; - *(undefined8 *)(param_2 + 0x130) = 0; - *(undefined8 *)(param_2 + 0x138) = 0; - *(undefined8 *)(param_2 + 0x140) = 0; - *(undefined8 *)(param_2 + 0x148) = 0; - *(undefined8 *)(param_2 + 0x150) = 0; - goto LAB_3; - } - uVar8 = param_5 - 1; - if (uVar8 < 0xb) { - pcVar12 = (char *)(longlong)(int)uVar8; - switch(uVar8) { +switchD_140004dcd_caseD_0: + uVar6 = (*(uint *)(param_2 + 0x40) & 0x1000 | 0x400) >> 10; + puVar14 = puVar13; + } + else { + uVar6 = param_5 - 1; + if (10 < uVar6) { + pcVar3 = (code *)swi(0x29); + (*pcVar3)(0x25); + puVar13 = auStackY_70; + goto switchD_140004dcd_caseD_0; + } + pcVar11 = (char *)(longlong)(int)uVar6; + puVar13 = auStackY_78; + switch(uVar6) { default: - goto switchD_14000507f_caseD_0; + goto switchD_140004dcd_caseD_0; case 2: case 6: case 9: - cVar6 = (char)uVar8; - *param_2 = (_VHD_SRB_EXTENSION)((char)*param_2 + cVar6); - *pcVar12 = *pcVar12 + cVar6; - *(char *)((longlong)pcVar12 * 2) = *(char *)((longlong)pcVar12 * 2) + cVar6; - *pcVar12 = *pcVar12 + cVar6; + cVar5 = (char)uVar6; + *param_2 = (_VHD_SRB_EXTENSION)((char)*param_2 + cVar5); + *pcVar11 = *pcVar11 + cVar5; + *(char *)((longlong)pcVar11 * 2) = *(char *)((longlong)pcVar11 * 2) + cVar5; + *pcVar11 = *pcVar11 + cVar5; /* WARNING: Bad instruction - Truncating control flow here */ halt_baddata(); case 7: - uVar14 = 4; + uVar6 = 4; break; case 10: - uVar14 = 6; - } - goto LAB_2; - } - pcVar3 = (code *)swi(0x29); - (*pcVar3)(0x25); - puVar17 = puVar16 + 8; -LAB_0: - *(undefined8 *)(puVar17 + -8) = 0x1400050a7; - cVar6 = _tlgKeywordOn(0x140086708,8); - puVar16 = puVar17; - if (cVar6 != '\0') { - *(int *)(puVar17 + 0x38) = param_5; - *(undefined8 *)(puVar17 + 0x30) = param_1; - *(_VHD_SRB_EXTENSION **)(puVar17 + 0x28) = param_2; - *(char **)(puVar17 + 0x20) = "enter... SrbExtension=0x%p VirtualDisk=0x%p IoType=%d"; - *(undefined8 *)(puVar17 + -8) = 0x1400050e4; - TraceEvents("VhdmpiQueueIoRequest",0x644,5,8,*(char **)(puVar17 + 0x20)); - } - } - *(undefined8 *)(param_2 + 0x120) = 0; - *(undefined8 *)(param_2 + 0x128) = 0; - *(undefined8 *)(param_2 + 0x130) = 0; - *(undefined8 *)(param_2 + 0x138) = 0; - uVar14 = 2; - *(undefined8 *)(param_2 + 0x140) = 0; - *(undefined8 *)(param_2 + 0x148) = 0; - *(undefined8 *)(param_2 + 0x150) = 0; - lVar11 = -1; - param_4 = -1; -LAB_3: - *(undefined8 *)(puVar16 + 0xb8) = 0x18; - *(longlong *)(param_2 + *(longlong *)(puVar16 + 0xb8) + 0x120) = param_4; - iVar1 = *(int *)(puVar16 + 0xc0); - *(longlong *)(param_2 + 0x140) = lVar11; - *(longlong *)(param_2 + 0x148) = lVar11; - *(int *)(param_2 + 0x158) = (int)uVar14; - *(undefined4 *)(param_2 + 0x164) = 0; - *(undefined4 *)(param_2 + 0x168) = 0; - param_2[0x160] = (_VHD_SRB_EXTENSION)0x0; - param_2[0x161] = (_VHD_SRB_EXTENSION)0x0; - lVar11 = *(longlong *)(puVar16 + 0xa0); - if ((DAT_4 & 1) != 0) { + uVar6 = 6; + puVar14 = auStackY_78; + } + } + pcVar11 = (char *)(param_4 + (ulonglong)param_3); + *(undefined8 *)(param_2 + 0x120) = 0; + *(undefined8 *)(param_2 + 0x128) = 0; + *(undefined8 *)(param_2 + 0x130) = 0; + *(undefined8 *)(param_2 + 0x138) = 0; + *(undefined8 *)(param_2 + 0x140) = 0; + *(undefined8 *)(param_2 + 0x148) = 0; + *(undefined8 *)(param_2 + 0x150) = 0; + *(longlong *)(param_2 + 0x138) = param_4; + *(char **)(param_2 + 0x140) = pcVar11; + *(char **)(param_2 + 0x148) = pcVar11; + *(uint *)(param_2 + 0x158) = uVar6; + } + *(undefined2 *)(param_2 + 0x160) = 0; + *(undefined8 *)(param_2 + 0x164) = 0; + if ((Microsoft_Windows_VHDMPEnableBits._1_1_ & 1) != 0) { if (param_2[0x110] == (_VHD_SRB_EXTENSION)0x0) { - uVar14 = 3; - *(undefined8 *)(puVar16 + -8) = 0x140004fa0; + pcVar11 = (char *)0x3; + *(undefined8 *)(puVar14 + -8) = 0x140004e6e; EtwActivityIdControl(3,param_2 + 0x100); param_2[0x110] = (_VHD_SRB_EXTENSION)0x1; } - if ((DAT_4 & 1) != 0) { - lVar15 = *(longlong *)(*(longlong *)param_2 + 0x90); - *(undefined4 *)(puVar16 + 0x38) = *(undefined4 *)(param_2 + 0x34); - pwVar5 = *(wchar_t **)(lVar15 + 0x78); - *(undefined8 *)(puVar16 + 0x30) = *(undefined8 *)(param_2 + 0x20); - *(undefined4 *)(puVar16 + 0x28) = *(undefined4 *)(param_2 + 0x44); - *(undefined4 *)(puVar16 + 0x20) = *(undefined4 *)(param_2 + 0x3c); - *(undefined8 *)(puVar16 + -8) = 0x140004ff4; - McTemplateK0zqqxq_EtwWriteTransfer(uVar14,&VHD_START_IO,param_2 + 0x100,pwVar5); - } - } - if ((iVar1 - 1U < 2) || (iVar1 - 4U < 4)) { - uVar8 = *(uint *)(param_2 + 0x34); - if (uVar8 == 0) { - if (3 < iVar1 - 4U) { + if ((Microsoft_Windows_VHDMPEnableBits._1_1_ & 1) != 0) { + lVar12 = *(longlong *)(*(longlong *)param_2 + 0x90); + *(undefined4 *)(puVar14 + 0x38) = *(undefined4 *)(param_2 + 0x34); + pwVar2 = *(wchar_t **)(lVar12 + 0x78); + *(undefined8 *)(puVar14 + 0x30) = *(undefined8 *)(param_2 + 0x20); + *(undefined4 *)(puVar14 + 0x28) = *(undefined4 *)(param_2 + 0x44); + *(undefined4 *)(puVar14 + 0x20) = *(undefined4 *)(param_2 + 0x3c); + *(undefined8 *)(puVar14 + -8) = 0x140004ebe; + McTemplateK0zqqxq_EtwWriteTransfer(pcVar11,&VHD_START_IO,param_2 + 0x100,pwVar2); + } + } + if ((param_5 - 1U < 2) || (param_5 - 4U < 4)) { + uVar6 = *(uint *)(param_2 + 0x34); + if (uVar6 == 0) { + if (3 < param_5 - 4U) { return 0; } return 0xc0000001; } - uVar14 = *(ulonglong *)(param_2 + 0x20); + uVar8 = *(ulonglong *)(param_2 + 0x20); pcVar3 = *(code **)(**(longlong **)(param_2 + 8) + 0xa0); - *(undefined8 *)(puVar16 + -8) = 0x140004e01; - uVar9 = (*pcVar3)(); - if (((uVar9 < uVar14) || (uVar9 - uVar14 < (ulonglong)uVar8)) && + *(undefined8 *)(puVar14 + -8) = 0x140004f19; + uVar7 = (*pcVar3)(); + if (((uVar7 < uVar8) || (uVar7 - uVar8 < (ulonglong)uVar6)) && ((*(uint *)(param_2 + 0x40) & 0x40) == 0)) { - if (2 < DAT_1) { - uVar8 = 0x20; - *(undefined8 *)(puVar16 + -8) = 0x14000511c; - cVar6 = _tlgKeywordOn(0x140086708,0x20); - if (cVar6 != '\0') { - *(undefined4 *)(puVar16 + 0x30) = *(undefined4 *)(param_2 + 0x34); - *(undefined8 *)(puVar16 + 0x28) = *(undefined8 *)(param_2 + 0x20); - *(char **)(puVar16 + 0x20) = "Command out of range (%I64u / %u)"; - *(undefined8 *)(puVar16 + -8) = 0x140005158; - TraceEvents("VhdmpiQueueIoRequest",0x6a6,uVar8 - 0x1e,uVar8,*(char **)(puVar16 + 0x20)); + if (2 < DAT_0) { + *(undefined8 *)(puVar14 + -8) = 0x14000503c; + cVar5 = _tlgKeywordOn(0x140086708,0x20); + if (cVar5 != '\0') { + *(undefined4 *)(puVar14 + 0x30) = *(undefined4 *)(param_2 + 0x34); + *(undefined8 *)(puVar14 + 0x28) = *(undefined8 *)(param_2 + 0x20); + *(char **)(puVar14 + 0x20) = "Command out of range (%I64u / %u)"; + *(undefined8 *)(puVar14 + -8) = 0x140005077; + TraceEvents("VhdmpiQueueIoRequest",0x6a6,2,0x20,*(char **)(puVar14 + 0x20)); } } return 0xc0000185; } - if ((iVar1 == 2) || (iVar1 == 1)) { + if ((param_5 == 2) || (param_5 == 1)) { if (((char)*(undefined4 *)(*(longlong *)(param_2 + 0x48) + 0x2c) + *(char *)(*(longlong *)(param_2 + 0x48) + 0x20) & 1U) != 0) { return 0xc0000010; } - if (iVar1 != 1) goto LAB_5; + if (param_5 != 1) goto LAB_1; } else { -LAB_5: - if ((iVar1 != 4) && (iVar1 != 7)) goto LAB_6; - } -LAB_7: - p_Var18 = param_2 + 0x40; - if ((*(uint *)p_Var18 & 1) != 0) { - iVar2 = *(int *)(*(longlong *)(lVar11 + 200) + 0x3c); - if (iVar2 != 0) { - if (iVar2 == 1) { - *(uint *)p_Var18 = *(uint *)p_Var18 | 4; - } - else if ((iVar2 == 2) || (iVar2 == 3)) { - *(uint *)p_Var18 = *(uint *)p_Var18 | 2; +LAB_1: + if ((param_5 != 4) && (param_5 != 7)) goto LAB_2; + } +LAB_3: + p_Var16 = param_2 + 0x40; + if ((*(uint *)p_Var16 & 1) != 0) { + iVar1 = *(int *)(*(longlong *)(param_1 + 200) + 0x3c); + if (iVar1 != 0) { + if (iVar1 == 1) { + *(uint *)p_Var16 = *(uint *)p_Var16 | 4; + } + else if ((iVar1 == 2) || (iVar1 == 3)) { + *(uint *)p_Var16 = *(uint *)p_Var16 | 2; } else { - *(uint *)p_Var18 = *(uint *)p_Var18 & 0xfffffffd; - *(uint *)p_Var18 = *(uint *)p_Var18 & 0xfffffffb; - if (iVar1 == 3) { - if (5 < DAT_1) { - uVar8 = 0x20; - *(undefined8 *)(puVar16 + -8) = 0x140005194; - cVar6 = _tlgKeywordOn(0x140086708,0x20); - if (cVar6 != '\0') { - *(longlong *)(puVar16 + 0x28) = lVar11; - *(char **)(puVar16 + 0x20) = + *(uint *)p_Var16 = *(uint *)p_Var16 & 0xfffffffd; + *(uint *)p_Var16 = *(uint *)p_Var16 & 0xfffffffb; + if (param_5 == 3) { + if (5 < DAT_0) { + *(undefined8 *)(puVar14 + -8) = 0x140004fd3; + cVar5 = _tlgKeywordOn(0x140086708,0x20); + if (cVar5 != '\0') { + *(char **)(puVar14 + 0x28) = param_1; + *(char **)(puVar14 + 0x20) = "Ignoring flush request on virtual disk %p due to cache settings."; - *(undefined8 *)(puVar16 + -8) = 0x1400051c3; - TraceEvents("VhdmpiQueueIoRequest",0x6eb,5,uVar8,*(char **)(puVar16 + 0x20)); + *(undefined8 *)(puVar14 + -8) = 0x140005001; + TraceEvents("VhdmpiQueueIoRequest",0x6eb,5,0x20,*(char **)(puVar14 + 0x20)); } } return 0; } } } - lVar19 = *(longlong *)(lVar11 + 200); - *(undefined8 *)(puVar16 + -8) = 0x140004f4a; - cVar6 = ExAcquireRundownProtection(lVar19 + 0x50); - if (cVar6 == '\0') { - if (2 < DAT_1) { - uVar8 = 0x20; - *(undefined8 *)(puVar16 + -8) = 0x1400051f8; - cVar6 = _tlgKeywordOn(0x140086708,0x20); - if (cVar6 != '\0') { - *(char **)(puVar16 + 0x20) = "Failed to reference an active surface for write"; - *(undefined8 *)(puVar16 + -8) = 0x140005226; - TraceEvents("VhdmpiQueueIoRequest",0x6fe,uVar8 - 0x1e,uVar8,*(char **)(puVar16 + 0x20)); + lVar15 = *(longlong *)(param_1 + 200); + *(undefined8 *)(puVar14 + -8) = 0x1400050b0; + cVar5 = ExAcquireRundownProtection(lVar15 + 0x50); + if (cVar5 == '\0') { + if (2 < DAT_0) { + *(undefined8 *)(puVar14 + -8) = 0x1400050d3; + cVar5 = _tlgKeywordOn(0x140086708,0x20); + if (cVar5 != '\0') { + *(char **)(puVar14 + 0x20) = "Failed to reference an active surface for write"; + *(undefined8 *)(puVar14 + -8) = 0x1400050fe; + TraceEvents("VhdmpiQueueIoRequest",0x6fe,2,0x20,*(char **)(puVar14 + 0x20)); } } return 0xc0000010; } - lVar19 = *(longlong *)(puVar16 + 0xa8); - } - *(uint *)(param_2 + 0x40) = *(uint *)p_Var18 | 8; + lVar15 = *(longlong *)(puVar14 + 0x80); + } + *(uint *)(param_2 + 0x40) = *(uint *)p_Var16 | 8; } else { -LAB_6: - if ((iVar1 == 8) || (iVar1 == 3)) goto LAB_7; - } - lVar15 = *(longlong *)(*(longlong *)param_2 + 200); - if (lVar15 != 0) { - *(undefined8 *)(puVar16 + -8) = 0x140004ee4; - cVar6 = ExAcquireRundownProtection(lVar15 + 0x610); - if (cVar6 != '\0') { - p_Var4 = *(_VHD_PREFETCH_STATE **)(lVar15 + 0x5f8); - if (p_Var4[0xac] != (_VHD_PREFETCH_STATE)0x0) { - *(undefined8 *)(puVar16 + -8) = 0x140004f05; - VhdmpiRecordForPrefetchWorker(param_2,p_Var4); - } - *(undefined8 *)(puVar16 + -8) = 0x140004f13; - ExReleaseRundownProtection(lVar15 + 0x610); +LAB_2: + if ((param_5 == 3) || (param_5 == 8)) goto LAB_3; + } + *(undefined8 *)(puVar14 + -8) = 0x140005128; + uVar8 = Feature_3417294137__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar8 == 0) { + lVar12 = *(longlong *)(*(longlong *)param_2 + 200); + if (lVar12 != 0) { + *(undefined8 *)(puVar14 + -8) = 0x1400051c4; + cVar5 = ExAcquireRundownProtection(lVar12 + 0x610); + if (cVar5 != '\0') { + p_Var4 = *(_VHD_PREFETCH_STATE **)(lVar12 + 0x5f8); + if (p_Var4[0xac] != (_VHD_PREFETCH_STATE)0x0) { + *(undefined8 *)(puVar14 + -8) = 0x1400051e5; + VhdmpiRecordForPrefetchWorker(param_2,p_Var4); + } + lVar12 = lVar12 + 0x610; + goto LAB_4; + } + } + } + else { + lVar12 = *(longlong *)param_2; + *(undefined8 *)(puVar14 + -8) = 0x14000513d; + cVar5 = ExAcquireRundownProtection(lVar12 + 0xd8); + if (cVar5 != '\0') { + lVar12 = *(longlong *)(*(longlong *)param_2 + 200); + if (lVar12 != 0) { + *(undefined8 *)(puVar14 + -8) = 0x140005167; + cVar5 = ExAcquireRundownProtection(lVar12 + 0x610); + if (cVar5 != '\0') { + p_Var4 = *(_VHD_PREFETCH_STATE **)(lVar12 + 0x5f8); + if (p_Var4[0xac] != (_VHD_PREFETCH_STATE)0x0) { + *(undefined8 *)(puVar14 + -8) = 0x140005188; + VhdmpiRecordForPrefetchWorker(param_2,p_Var4); + } + *(undefined8 *)(puVar14 + -8) = 0x140005196; + ExReleaseRundownProtection(lVar12 + 0x610); + } + } + lVar12 = *(longlong *)param_2 + 0xd8; +LAB_4: + *(undefined8 *)(puVar14 + -8) = 0x1400051f3; + ExReleaseRundownProtection(lVar12); } } *(undefined4 *)(param_2 + 0x30) = 0x103; *(undefined4 *)(param_2 + 0x114) = 0; - if ((*(uint *)(lVar11 + 0x860) & 8) == 0) goto LAB_8; - *(undefined8 *)(puVar16 + -8) = 0x140005233; - cVar6 = VhdmpiIsCTLogTrackingEnabled(lVar11); - if ((((cVar6 == '\0') || (*(int *)(param_2 + 0x3c) != 1)) || (*(int *)(param_2 + 0x44) == 3)) || - (*(int *)(param_2 + 0x44) == 2)) goto LAB_8; + if ((*(uint *)(param_1 + 0x860) & 8) == 0) goto LAB_5; + *(undefined8 *)(puVar14 + -8) = 0x14000521d; + cVar5 = VhdmpiIsCTLogTrackingEnabled((longlong)param_1); + if ((((cVar5 == '\0') || (*(int *)(param_2 + 0x3c) != 1)) || (*(int *)(param_2 + 0x44) == 3)) || + (*(int *)(param_2 + 0x44) == 2)) goto LAB_5; if ((*(uint *)(param_2 + 0x40) & 0x800) == 0) { - lVar15 = *(longlong *)(param_2 + 0x48); - if ((*(byte *)(lVar15 + 10) & 5) == 0) { -LAB_9: - *(undefined4 *)(puVar16 + 0x28) = 0x40000010; - *(undefined4 *)(puVar16 + 0x20) = 0; - *(undefined8 *)(puVar16 + -8) = 0x1400052d2; - pbVar13 = (byte *)MmMapLockedPagesSpecifyCache(lVar15,0); - lVar15 = lVar19; + lVar12 = *(longlong *)(param_2 + 0x48); + if ((*(byte *)(lVar12 + 10) & 5) == 0) { +LAB_6: + *(undefined4 *)(puVar14 + 0x28) = 0x40000010; + *(undefined4 *)(puVar14 + 0x20) = 0; + *(undefined8 *)(puVar14 + -8) = 0x1400052bf; + pbVar9 = (byte *)MmMapLockedPagesSpecifyCache(lVar12,0); + lVar12 = lVar15; } else { - pbVar13 = *(byte **)(lVar15 + 0x18); - lVar15 = lVar19; - } -LAB_10: - if (pbVar13 != (byte *)0x0) { + pbVar9 = *(byte **)(lVar12 + 0x18); + lVar12 = lVar15; + } +LAB_7: + if (pbVar9 != (byte *)0x0) { iVar1 = *(int *)(param_2 + 0x34); - *(undefined8 *)(puVar16 + -8) = 0x1400052ea; - uVar8 = VhdmpiCalculateChecksum(pbVar13,iVar1,(byte *)0x0); - *(uint *)(param_2 + 0x114) = uVar8; + *(undefined8 *)(puVar14 + -8) = 0x1400052d7; + uVar6 = VhdmpiCalculateChecksum(pbVar9,iVar1,(byte *)0x0); + *(uint *)(param_2 + 0x114) = uVar6; } } else { - *(undefined1 **)(puVar16 + 0x20) = puVar16 + 0xb0; - *(undefined8 *)(puVar16 + -8) = 0x14000529a; + *(undefined1 **)(puVar14 + 0x20) = puVar14 + 0x90; + *(undefined8 *)(puVar14 + -8) = 0x140005287; param_2 = (_VHD_SRB_EXTENSION *) VhdmpiExtendDataBuffer - ((longlong *)param_2,0x68444856,(longlong *)(puVar16 + 0x40), - (longlong *)(puVar16 + 0xa8),*(undefined1 **)(puVar16 + 0x20)); - lVar15 = *(longlong *)(puVar16 + 0xa8); + ((longlong *)param_2,0x68444856,(longlong *)(puVar14 + 0x88), + (longlong *)(puVar14 + 0x80),*(undefined1 **)(puVar14 + 0x20)); + lVar12 = *(longlong *)(puVar14 + 0x80); if (-1 < extraout_EAX) { - lVar19 = lVar15; - if ((*(byte *)(lVar15 + 10) & 5) == 0) goto LAB_9; - pbVar13 = *(byte **)(lVar15 + 0x18); - goto LAB_10; - } - } - if (lVar15 != 0) { - *(undefined8 *)(puVar16 + -8) = 0x1400052ff; - IoFreeMdl(lVar15); - } - if (*(longlong *)(puVar16 + 0x40) != 0) { - *(undefined8 *)(puVar16 + -8) = 0x14000531e; - ExFreePoolWithTag(*(longlong *)(puVar16 + 0x40),0x68444856); - } -LAB_8: - *(undefined8 *)(puVar16 + -8) = 0x140004eb1; + lVar15 = lVar12; + if ((*(byte *)(lVar12 + 10) & 5) == 0) goto LAB_6; + pbVar9 = *(byte **)(lVar12 + 0x18); + goto LAB_7; + } + } + if (lVar12 != 0) { + *(undefined8 *)(puVar14 + -8) = 0x1400052ec; + IoFreeMdl(lVar12); + } + if (*(longlong *)(puVar14 + 0x88) != 0) { + *(undefined8 *)(puVar14 + -8) = 0x14000530a; + ExFreePoolWithTag(*(longlong *)(puVar14 + 0x88),0x68444856); + } +LAB_5: + *(undefined8 *)(puVar14 + -8) = 0x14000532b; uVar10 = VhdmpiProcessEventInsert - ((_VHD_IO_TRACKER *)(lVar11 + 0x180),(_VHD_IO_EVENT *)(param_2 + 0x120), - puVar16[200]); + ((_VHD_IO_TRACKER *)(param_1 + 0x180),(_VHD_IO_EVENT *)(param_2 + 0x120), + puVar14[0xa8]); if ((char)uVar10 == '\0') { - uVar7 = 0x103; - } - else { - *(undefined8 *)(puVar16 + -8) = 0x140005330; - VhdmpiReleaseParserRequestResources((longlong *)param_2); - uVar7 = *(undefined4 *)(param_2 + 0x30); - } - return uVar7; + return 0x103; + } + *(undefined8 *)(puVar14 + -8) = 0x14000534c; + VhdmpiReleaseParserRequestResources((longlong *)param_2); + return *(undefined4 *)(param_2 + 0x30); } ``` ## VhdmpiAcquireBackingStoreAccessLocked ### Match Info |Key|vhdmp-2026-07.sys - vhdmp-2026-08.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.35| |i_ratio|0.69| |m_ratio|0.95| |b_ratio|0.9| |match_types|SymbolsHash| ### Function Meta Diff |Key|vhdmp-2026-07.sys|vhdmp-2026-08.sys| | :---: | :---: | :---: | |name|VhdmpiAcquireBackingStoreAccessLocked|VhdmpiAcquireBackingStoreAccessLocked| |fullname|VhdmpiAcquireBackingStoreAccessLocked|VhdmpiAcquireBackingStoreAccessLocked| |refcount|2|2| |`length`|192|212| |`called`|VhdmpiAcquireFileWrapperAccess
VhdmpiCheckFileWrapperForError
VhdmpiReleaseFileWrapperAccess
_guard_dispatch_icall|Feature_1070577979__private_IsEnabledDeviceUsageNoInline
VhdmpiAcquireFileWrapperAccess
VhdmpiCheckFileWrapperForError
VhdmpiReleaseFileWrapperAccess
_guard_dispatch_icall| |calling|VhdmpiAcquireBackingStoreAccessForSecurityContext|VhdmpiAcquireBackingStoreAccessForSecurityContext| |paramcount|3|3| |`address`|1400e78ec|1400eb36c| |sig|long __cdecl VhdmpiAcquireBackingStoreAccessLocked(_VHD_BACKING_STORE_HEADER * param_1, VHD_SECURITY_CONTEXT * param_2, _BACKING_STORE_ACCESS_MODE param_3)|long __cdecl VhdmpiAcquireBackingStoreAccessLocked(_VHD_BACKING_STORE_HEADER * param_1, VHD_SECURITY_CONTEXT * param_2, _BACKING_STORE_ACCESS_MODE param_3)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### VhdmpiAcquireBackingStoreAccessLocked Called Diff ```diff --- VhdmpiAcquireBackingStoreAccessLocked called +++ VhdmpiAcquireBackingStoreAccessLocked called @@ -0,0 +1 @@ +Feature_1070577979__private_IsEnabledDeviceUsageNoInline ``` ### VhdmpiAcquireBackingStoreAccessLocked Diff ```diff --- VhdmpiAcquireBackingStoreAccessLocked +++ VhdmpiAcquireBackingStoreAccessLocked @@ -1,46 +1,49 @@ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ /* long __cdecl VhdmpiAcquireBackingStoreAccessLocked(struct _VHD_BACKING_STORE_HEADER * __ptr64,struct VHD_SECURITY_CONTEXT * __ptr64,enum _BACKING_STORE_ACCESS_MODE) */ long __cdecl VhdmpiAcquireBackingStoreAccessLocked (_VHD_BACKING_STORE_HEADER *param_1,VHD_SECURITY_CONTEXT *param_2, _BACKING_STORE_ACCESS_MODE param_3) { longlong lVar1; int iVar2; + ulonglong uVar3; if (param_1 == (_VHD_BACKING_STORE_HEADER *)&VhdmpiEmptyISOBackingStore) { - iVar2 = 0; - if (param_3 == 2) { - iVar2 = -0x3fffff5e; + if (param_3 != 2) { + return 0; } + return -0x3fffff5e; } - else { - iVar2 = VhdmpiAcquireFileWrapperAccess((_VHD_FILE_WRAPPER *)(param_1 + 0x48),param_2,param_3); + iVar2 = VhdmpiAcquireFileWrapperAccess((_VHD_FILE_WRAPPER *)(param_1 + 0x48),param_2,param_3); + if (-1 < iVar2) { + if (param_3 != 2) { + return 0; + } + lVar1 = *(longlong *)(param_1 + 0x440); + *(longlong *)(param_1 + 0x440) = lVar1 + 1; + if (lVar1 + 1 != 1) { + return 0; + } + if (param_1[8] == (_VHD_BACKING_STORE_HEADER)0x0) { + return 0; + } + uVar3 = Feature_1070577979__private_IsEnabledDeviceUsageNoInline(); + if (((int)uVar3 != 0) && (*(int *)(*(longlong *)param_1 + 0x10) == 1)) { + return 0; + } + iVar2 = (**(code **)(*(longlong *)param_1 + 0x40))(param_1); if (-1 < iVar2) { - if (param_3 != 2) { - return 0; - } - lVar1 = *(longlong *)(param_1 + 0x440); - *(longlong *)(param_1 + 0x440) = lVar1 + 1; - if (lVar1 + 1 != 1) { - return 0; - } - if (param_1[8] == (_VHD_BACKING_STORE_HEADER)0x0) { - return 0; - } - iVar2 = (**(code **)(*(longlong *)param_1 + 0x40))(param_1); - if (-1 < iVar2) { - return 0; - } - *(longlong *)(param_1 + 0x440) = *(longlong *)(param_1 + 0x440) + -1; - VhdmpiReleaseFileWrapperAccess((_VHD_FILE_WRAPPER *)(param_1 + 0x48),2); + return 0; } - VhdmpiCheckFileWrapperForError(param_1); + *(longlong *)(param_1 + 0x440) = *(longlong *)(param_1 + 0x440) + -1; + VhdmpiReleaseFileWrapperAccess((_VHD_FILE_WRAPPER *)(param_1 + 0x48),2); } + VhdmpiCheckFileWrapperForError(param_1); return iVar2; } ``` # Modified (No Code Changes) *Slightly modified functions have no code changes, rather differnces in:* - refcount - length - called - calling - name - fullname ## VhdmpiRecordForPrefetchWorker ### Match Info |Key|vhdmp-2026-07.sys - vhdmp-2026-08.sys| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|0.86| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|vhdmp-2026-07.sys|vhdmp-2026-08.sys| | :---: | :---: | :---: | |name|VhdmpiRecordForPrefetchWorker|VhdmpiRecordForPrefetchWorker| |fullname|VhdmpiRecordForPrefetchWorker|VhdmpiRecordForPrefetchWorker| |`refcount`|2|3| |length|215|215| |called|VhdmpiAddIoLogSegment|VhdmpiAddIoLogSegment| |calling|VhdmpiQueueIoRequest|VhdmpiQueueIoRequest| |paramcount|2|2| |`address`|140032fdc|14003300c| |sig|void __cdecl VhdmpiRecordForPrefetchWorker(_VHD_SRB_EXTENSION * param_1, _VHD_PREFETCH_STATE * param_2)|void __cdecl VhdmpiRecordForPrefetchWorker(_VHD_SRB_EXTENSION * param_1, _VHD_PREFETCH_STATE * param_2)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ## NTOSKRNL.EXE::ExAcquireRundownProtection ### Match Info |Key|vhdmp-2026-07.sys - vhdmp-2026-08.sys| | :---: | :---: | |diff_type|refcount| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|vhdmp-2026-07.sys|vhdmp-2026-08.sys| | :---: | :---: | :---: | |name|ExAcquireRundownProtection|ExAcquireRundownProtection| |fullname|NTOSKRNL.EXE::ExAcquireRundownProtection|NTOSKRNL.EXE::ExAcquireRundownProtection| |`refcount`|22|24| |length|0|0| |called||| |calling|

Expand for full list:
VhdmpParserStartIo
VhdmpiActivateIoTracking
VhdmpiAddHiddenSurfaceAndHandleContextRundownRefs
VhdmpiAddRundownRefSurfaceByPdo
VhdmpiAddRundownRefSurfaceByVirtualDisk
VhdmpiControlObjectIrpHandler
VhdmpiIoPerfTimerHandler
VhdmpiNonPnpDeviceControl
VhdmpiNonPnpFlushBuffers
VhdmpiNonPnpIo
VhdmpiNonPnpRead

VhdmpiNonPnpSurface
VhdmpiNonPnpWrite
VhdmpiQueueIoRequest
VhdmpiRecoverVirtualDiskV2
VhdmpiStartAsyncOp
VhdmpiTryInitializeMergeAsyncCopyContext
VhdmpiTryInitializeMirrorAsyncCopyContext
VhdmpiVhd2ProcessSingleSrbRange

| |paramcount|0|0| |address|EXTERNAL:00000114|EXTERNAL:00000114| |sig|undefined ExAcquireRundownProtection(void)|undefined ExAcquireRundownProtection(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ## wil_details_IsEnabledFallback ### Match Info |Key|vhdmp-2026-07.sys - vhdmp-2026-08.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.83| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|vhdmp-2026-07.sys|vhdmp-2026-08.sys| | :---: | :---: | :---: | |name|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |fullname|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |`refcount`|5|7| |length|140|140| |called|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath| |`calling`|Feature_2423509305__private_IsEnabledFallback
Feature_269734202__private_IsEnabledFallback
Feature_2862590264__private_IsEnabledFallback
Feature_Servicing_VhdmpKcsanFixes__private_IsEnabledFallback|Feature_1070577979__private_IsEnabledFallback
Feature_2423509305__private_IsEnabledFallback
Feature_269734202__private_IsEnabledFallback
Feature_2862590264__private_IsEnabledFallback
Feature_3417294137__private_IsEnabledFallback
Feature_Servicing_VhdmpKcsanFixes__private_IsEnabledFallback| |paramcount|3|3| |`address`|14002c1c8|14002c1f8| |sig|uint __fastcall wil_details_IsEnabledFallback(ulonglong param_1, int param_2, undefined8 * param_3)|uint __fastcall wil_details_IsEnabledFallback(ulonglong param_1, int param_2, undefined8 * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### wil_details_IsEnabledFallback Calling Diff ```diff --- wil_details_IsEnabledFallback calling +++ wil_details_IsEnabledFallback calling @@ -0,0 +1 @@ +Feature_1070577979__private_IsEnabledFallback @@ -3,0 +5 @@ +Feature_3417294137__private_IsEnabledFallback ``` ## NTOSKRNL.EXE::ExReleaseRundownProtection ### Match Info |Key|vhdmp-2026-07.sys - vhdmp-2026-08.sys| | :---: | :---: | |diff_type|refcount| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|vhdmp-2026-07.sys|vhdmp-2026-08.sys| | :---: | :---: | :---: | |name|ExReleaseRundownProtection|ExReleaseRundownProtection| |fullname|NTOSKRNL.EXE::ExReleaseRundownProtection|NTOSKRNL.EXE::ExReleaseRundownProtection| |`refcount`|54|55| |length|0|0| |called||| |calling|

Expand for full list:
VhdmpStartIo
VhdmpiAddRundownRefSurfaceByPdo
VhdmpiAsyncOpThread
VhdmpiCancelAllQueuedIoctlsOnDisk
VhdmpiCancelAllQueuedIoctlsOnHandle
VhdmpiCancelAllQueuedSurfaceSensitiveIoctlsOnDisk
VhdmpiCheckpointDiskWorker
VhdmpiCompleteBackingSetStoreOptimizations
VhdmpiCompleteParserRequest
VhdmpiCompleteRecoveryRequestV2
VhdmpiCompleteScsiRequest

VhdmpiControlObjectIrpHandler
VhdmpiDiskVolumesAreReady
VhdmpiEnqueueControlDeviceIoctl
VhdmpiGetBackingStoreIsInUse
VhdmpiGetVirtualDiskQoSStatusCompletion
VhdmpiIoctlQueueCancelWorkItem
VhdmpiMergeCopyThread
VhdmpiMirrorCopyThread
VhdmpiNonPnpDeviceControl
VhdmpiNonPnpFlushBuffers
VhdmpiNonPnpIo
VhdmpiNonPnpRead
VhdmpiNonPnpSurface
VhdmpiNonPnpWrite
VhdmpiProcessEventComplete
VhdmpiProcessEventInsert
VhdmpiProcessRawScsiCommand
VhdmpiQueueIoRequest
VhdmpiRawIoEndIo
VhdmpiRawIoHandler
VhdmpiRawScsiEndIo
VhdmpiRecoverVirtualDiskV2
VhdmpiReleaseParserRequestResources
VhdmpiReleaseRundownRefVirtualDiskSurface
VhdmpiStartAsyncOp
VhdmpiTryInitializeMirrorAsyncCopyContext
VhdmpiVhd2CompleteSrbRange

| |paramcount|0|0| |address|EXTERNAL:000000fd|EXTERNAL:000000fd| |sig|undefined ExReleaseRundownProtection(void)|undefined ExReleaseRundownProtection(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| _{Generated with `ghidriff` version: 1.0.0 on 2026-08-15T17:15:55}