# volmgrx_1150.sys-volmgrx_8457.sys Diff # TOC * [Visual Chart Diff](#visual-chart-diff) * [Metadata](#metadata) * [Ghidra Diff Engine](#ghidra-diff-engine) * [Command Line](#command-line) * [Binary Metadata Diff](#binary-metadata-diff) * [Program Options](#program-options) * [Diff Stats](#diff-stats) * [Strings](#strings) * [Deleted](#deleted) * [Added](#added) * [wil_details_FeatureDescriptors_SkipPadding](#wil_details_featuredescriptors_skippadding) * [wil_details_RecordCachedUsage](#wil_details_recordcachedusage) * [wil_details_RecordFeatureUsageReporting](#wil_details_recordfeatureusagereporting) * [Feature_3984574778__private_IsEnabledDeviceUsageNoInline](#feature_3984574778__private_isenableddeviceusagenoinline) * [Feature_3984574778__private_IsEnabledFallback](#feature_3984574778__private_isenabledfallback) * [wil_details_AreDependenciesEnabled](#wil_details_aredependenciesenabled) * [wil_details_FeatureReporting_IncrementOpportunityInCache](#wil_details_featurereporting_incrementopportunityincache) * [wil_details_FeatureReporting_IncrementUsageInCache](#wil_details_featurereporting_incrementusageincache) * [wil_details_FeatureReporting_RecordUsageInCache](#wil_details_featurereporting_recordusageincache) * [wil_details_FeatureReporting_ReportUsageToService](#wil_details_featurereporting_reportusagetoservice) * [wil_details_FeatureReporting_ReportUsageToServiceDirect](#wil_details_featurereporting_reportusagetoservicedirect) * [wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState](#wil_details_featurestatecache_reevaluatecachedfeatureenabledstate) * [wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath](#wil_details_featurestatecache_tryenabledeviceusagefastpath) * [wil_details_GetCurrentFeatureEnabledState](#wil_details_getcurrentfeatureenabledstate) * [wil_details_IsEnabledFallback](#wil_details_isenabledfallback) * [wil_details_MapReportingKind](#wil_details_mapreportingkind) * [wil_UninitializeFeatureStaging](#wil_uninitializefeaturestaging) * [wil_details_BuildFeatureStateCacheFromQueryResults](#wil_details_buildfeaturestatecachefromqueryresults) * [wil_details_EvaluateFeatureDependencies](#wil_details_evaluatefeaturedependencies) * [wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState](#wil_details_evaluatefeaturedependencies_getcachedfeatureenabledstate) * [wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState](#wil_details_evaluatefeaturedependencies_reevaluatecachedfeatureenabledstate) * [wil_details_OnFeatureUsageProviderFlushNotification](#wil_details_onfeatureusageproviderflushnotification) * [wil_details_RecordFeatureUsageCallback](#wil_details_recordfeatureusagecallback) * [wil_details_ReevaluateOnFeatureConfigurationChange](#wil_details_reevaluateonfeatureconfigurationchange) * [wil_details_RegisterFeatureUsageProvider](#wil_details_registerfeatureusageprovider) * [wil_details_UpdateFeatureConfiguredStates](#wil_details_updatefeatureconfiguredstates) * [wil_RtlStagingConfig_QueryFeatureState](#wil_rtlstagingconfig_queryfeaturestate) * [wil_InitializeFeatureStaging](#wil_initializefeaturestaging) * [wil_details_PopulateInitialConfiguredFeatureStates](#wil_details_populateinitialconfiguredfeaturestates) * [NTOSKRNL.EXE::RtlRegisterFeatureConfigurationChangeNotification](#ntoskrnlexertlregisterfeatureconfigurationchangenotification) * [NTOSKRNL.EXE::RtlNotifyFeatureUsage](#ntoskrnlexertlnotifyfeatureusage) * [NTOSKRNL.EXE::RtlUnregisterFeatureUsageProvider](#ntoskrnlexertlunregisterfeatureusageprovider) * [NTOSKRNL.EXE::RtlArmFeatureUsageProviderFlushNotification](#ntoskrnlexertlarmfeatureusageproviderflushnotification) * [NTOSKRNL.EXE::RtlRecordFeatureUsage](#ntoskrnlexertlrecordfeatureusage) * [NTOSKRNL.EXE::RtlQueryFeatureConfigurationChangeStamp](#ntoskrnlexertlqueryfeatureconfigurationchangestamp) * [NTOSKRNL.EXE::RtlRegisterFeatureUsageProvider](#ntoskrnlexertlregisterfeatureusageprovider) * [NTOSKRNL.EXE::RtlUnregisterFeatureConfigurationChangeNotification](#ntoskrnlexertlunregisterfeatureconfigurationchangenotification) * [NTOSKRNL.EXE::RtlQueryFeatureConfiguration](#ntoskrnlexertlqueryfeatureconfiguration) * [Modified](#modified) * [VMX_PHYSICAL_DISK::ReadToc](#vmx_physical_diskreadtoc) * [DriverEntry](#driverentry) * [VMX_DISK_HEADER::Unformat](#vmx_disk_headerunformat) * [Modified (No Code Changes)](#modified-no-code-changes) * [__GSHandlerCheck](#__gshandlercheck) * [`scalar_deleting_destructor'](#scalar_deleting_destructor) * [__security_check_cookie](#__security_check_cookie) # Visual Chart Diff ```mermaid flowchart LR VMX_PHYSICAL_DISKReadToc-1-old<--Match 69%-->VMX_PHYSICAL_DISKReadToc-1-new DriverEntry-1-old<--Match 94%-->DriverEntry-1-new VMX_DISK_HEADERUnformat-3-old<--Match 91%-->VMX_DISK_HEADERUnformat-3-new subgraph volmgrx_8457.sys VMX_PHYSICAL_DISKReadToc-1-new DriverEntry-1-new VMX_DISK_HEADERUnformat-3-new subgraph Added direction LR wil_details_FeatureDescriptors_SkipPadding wil_details_RecordCachedUsage wil_details_RecordFeatureUsageReporting Feature_3984574778__private_IsEnabledDeviceUsageNoInline Feature_3984574778__private_IsEnabledFallback wil_details_AreDependenciesEnabled wil_details_FeatureReporting_IncrementOpportunityInCache wil_details_FeatureReporting_IncrementUsageInCache wil_details_FeatureReporting_RecordUsageInCache wil_details_FeatureReporting_ReportUsageToService wil_details_FeatureReporting_ReportUsageToServiceDirect wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath wil_details_GetCurrentFeatureEnabledState wil_details_IsEnabledFallback wil_details_MapReportingKind wil_UninitializeFeatureStaging wil_details_BuildFeatureStateCacheFromQueryResults wil_details_EvaluateFeatureDependencies wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState wil_details_OnFeatureUsageProviderFlushNotification wil_details_RecordFeatureUsageCallback wil_details_ReevaluateOnFeatureConfigurationChange wil_details_RegisterFeatureUsageProvider wil_details_UpdateFeatureConfiguredStates wil_RtlStagingConfig_QueryFeatureState 13_more_added_funcs_omitted end end subgraph volmgrx_1150.sys VMX_PHYSICAL_DISKReadToc-1-old DriverEntry-1-old VMX_DISK_HEADERUnformat-3-old end ``` ```mermaid pie showData title Function Matches - 98.1625% "unmatched_funcs_len" : 38 "matched_funcs_len" : 2030 ``` ```mermaid pie showData title Matched Function Similarity - 99.7044% "matched_funcs_with_code_changes_len" : 3 "matched_funcs_with_non_code_changes_len" : 3 "matched_funcs_no_changes_len" : 2024 ``` # Metadata ## Ghidra Diff Engine ### Command Line #### Captured Command Line ``` ghidriff --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --bsim --max-ram-percent 60.0 --max-section-funcs 200 volmgrx_1150.sys volmgrx_8457.sys ``` #### Verbose Args
``` --old ['volmgrx_1150.sys'] --new [['volmgrx_8457.sys']] --engine VersionTrackingDiff --output-path ghidriff_out --summary False --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim True --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title None ```
#### Download Original PEs ``` wget https://msdl.microsoft.com/download/symbols/volmgrx.sys/A3A7F6F364000/volmgrx.sys -O volmgrx.sys.x64.10.0.26100.1150 wget https://msdl.microsoft.com/download/symbols/volmgrx.sys/5119F64B66000/volmgrx.sys -O volmgrx.sys.x64.10.0.26100.8457 ``` ## Binary Metadata Diff ```diff --- volmgrx_1150.sys Meta +++ volmgrx_8457.sys Meta @@ -1,44 +1,44 @@ -Program Name: volmgrx_1150.sys +Program Name: volmgrx_8457.sys Language ID: x86:LE:64:default (4.6) Compiler ID: windows Processor: x86 Endian: Little Address Size: 64 -Minimum Address: 1c0000000 +Minimum Address: 140000000 Maximum Address: ff0000184f -# of Bytes: 415824 +# of Bytes: 424016 # of Memory Blocks: 13 -# of Instructions: 84263 -# of Defined Data: 1917 -# of Functions: 1015 -# of Symbols: 6986 -# of Data Types: 306 +# of Instructions: 85601 +# of Defined Data: 1983 +# of Functions: 1053 +# of Symbols: 7174 +# of Data Types: 308 # of Data Type Categories: 9 Analyzed: true Compiler: visualstudio:unknown Created With Ghidra Version: 12.0.4 -Date Created: Sun Aug 16 20:32:01 SGT 2026 +Date Created: Sun Aug 16 20:32:05 SGT 2026 Executable Format: Portable Executable (PE) -Executable Location: /tmp/vmx/volmgrx_1150.sys -Executable MD5: 0f9414733106d559df8d9c6afe0daeb1 -Executable SHA256: 7c0d3f68af9297c167d64c53a31f6dd3dfd01861cdd3fafd6e545ff1bd3eceaa -FSRL: file:///tmp/vmx/volmgrx_1150.sys?MD5=0f9414733106d559df8d9c6afe0daeb1 +Executable Location: /tmp/vmx/volmgrx_8457.sys +Executable MD5: 76e4d486956a3999770bbbf1ca5ac88d +Executable SHA256: 8ad69577e078b5d605a7e9d814df34b8bb049715fc3656eb043d9319b977c864 +FSRL: file:///tmp/vmx/volmgrx_8457.sys?MD5=76e4d486956a3999770bbbf1ca5ac88d PDB Age: 1 PDB File: volmgrx.pdb -PDB GUID: 512a45ba-a9d0-fb05-10d6-6e0c95676d2f +PDB GUID: 093fdf03-3e80-fa35-e019-1ecf2d4e27c2 PDB Loaded: true PDB Version: RSDS PE Property[CompanyName]: Microsoft Corporation PE Property[FileDescription]: Volume Manager Extension Driver -PE Property[FileVersion]: 10.0.26100.1150 (WinBuild.160101.0800) +PE Property[FileVersion]: 10.0.26100.8457 (WinBuild.160101.0800) PE Property[InternalName]: volmgrx.sys PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved. PE Property[OriginalFilename]: volmgrx.sys PE Property[ProductName]: Microsoft® Windows® Operating System -PE Property[ProductVersion]: 10.0.26100.1150 +PE Property[ProductVersion]: 10.0.26100.8457 PE Property[Translation]: 4b00409 Preferred Root Namespace Category: RTTI Found: false Relocatable: true SectionAlignment: 4096 Should Ask To Analyze: false ``` ## Program Options
Ghidra volmgrx_1150.sys Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra volmgrx_1150.sys Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra volmgrx_1150.sys Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.Apply Function Calling Conventions|true| |Demangler Microsoft.Apply Function Signatures|true| |Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS| |Demangler Microsoft.Demangle Only Known Mangled Symbols|false| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
Ghidra volmgrx_8457.sys Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra volmgrx_8457.sys Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra volmgrx_8457.sys Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.Apply Function Calling Conventions|true| |Demangler Microsoft.Apply Function Signatures|true| |Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS| |Demangler Microsoft.Demangle Only Known Mangled Symbols|false| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
## Diff Stats |Stat|Value| | :---: | :---: | |added_funcs_len|38| |deleted_funcs_len|0| |modified_funcs_len|6| |added_symbols_len|24| |deleted_symbols_len|3| |diff_time|4.627213716506958| |deleted_strings_len|0| |added_strings_len|0| |match_types|Counter({'SymbolsHash': 988, 'ExternalsName': 79, 'ExactBytesFunctionHasher': 9, 'ExactInstructionsFunctionHasher': 8, 'SigCallingCalledHasher': 6, 'BSIM': 1})| |items_to_process|71| |diff_types|Counter({'address': 6, 'refcount': 3, 'code': 3, 'length': 3, 'called': 3, 'calling': 1})| |unmatched_funcs_len|38| |total_funcs_len|2068| |matched_funcs_len|2030| |matched_funcs_with_code_changes_len|3| |matched_funcs_with_non_code_changes_len|3| |matched_funcs_no_changes_len|2024| |match_func_similarity_percent|99.7044%| |func_match_overall_percent|98.1625%| |first_matches|Counter({'SymbolsHash': 988, 'ExactBytesFunctionHasher': 9, 'ExactInstructionsFunctionHasher': 8, 'SigCallingCalledHasher': 6, 'BSIM': 1})| ```mermaid pie showData title All Matches "SymbolsHash" : 988 "ExternalsName" : 79 "ExactBytesFunctionHasher" : 9 "ExactInstructionsFunctionHasher" : 8 "BSIM" : 1 "SigCallingCalledHasher" : 6 ``` ```mermaid pie showData title First Matches "SymbolsHash" : 988 "ExactBytesFunctionHasher" : 9 "ExactInstructionsFunctionHasher" : 8 "BSIM" : 1 "SigCallingCalledHasher" : 6 ``` ```mermaid pie showData title Diff Stats "added_funcs_len" : 38 "deleted_funcs_len" : 0 "modified_funcs_len" : 6 ``` ```mermaid pie showData title Symbols "added_symbols_len" : 24 "deleted_symbols_len" : 3 ``` ## Strings *No string differences found* # Deleted # Added ## wil_details_FeatureDescriptors_SkipPadding ### Function Meta |Key|volmgrx_8457.sys| | :---: | :---: | |name|wil_details_FeatureDescriptors_SkipPadding| |fullname|wil_details_FeatureDescriptors_SkipPadding| |refcount|10| |length|31| |called|| |calling|wil_InitializeFeatureStaging
wil_details_EvaluateFeatureDependencies
wil_details_OnFeatureUsageProviderFlushNotification
wil_details_PopulateInitialConfiguredFeatureStates
wil_details_RegisterFeatureUsageProvider
wil_details_UpdateFeatureConfiguredStates| |paramcount|1| |address|140001430| |sig|longlong * __fastcall wil_details_FeatureDescriptors_SkipPadding(longlong * param_1)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_FeatureDescriptors_SkipPadding +++ wil_details_FeatureDescriptors_SkipPadding @@ -0,0 +1,14 @@ + +longlong * wil_details_FeatureDescriptors_SkipPadding(longlong *param_1) + +{ + while( true ) { + if (&UNK_140022e0f < param_1) { + return (longlong *)0x0; + } + if (*param_1 != 0) break; + param_1 = param_1 + 1; + } + return param_1; +} + ``` ## wil_details_RecordCachedUsage ### Function Meta |Key|volmgrx_8457.sys| | :---: | :---: | |name|wil_details_RecordCachedUsage| |fullname|wil_details_RecordCachedUsage| |refcount|2| |length|324| |called|__security_check_cookie
wil_details_RecordFeatureUsageCallback| |calling|wil_details_OnFeatureUsageProviderFlushNotification| |paramcount|2| |address|140001458| |sig|undefined __fastcall wil_details_RecordCachedUsage(undefined4 param_1, uint * param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_RecordCachedUsage +++ wil_details_RecordCachedUsage @@ -0,0 +1,88 @@ + +/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ + +void wil_details_RecordCachedUsage(undefined4 param_1,uint *param_2) + +{ + uint uVar1; + uint uVar2; + uint uVar3; + uint uVar4; + undefined4 *puVar5; + bool bVar6; + undefined1 auStack_68 [32]; + undefined4 local_48; + short local_44 [2]; + undefined4 local_40 [10]; + ulonglong local_18; + + local_18 = __security_cookie ^ (ulonglong)auStack_68; + uVar2 = *param_2; + do { + LOCK(); + uVar4 = *param_2; + bVar6 = uVar2 == uVar4; + if (bVar6) { + *param_2 = uVar2 & 0xffc0401e; + uVar4 = uVar2; + } + uVar2 = uVar4; + UNLOCK(); + } while (!bVar6); + uVar3 = uVar2 >> 1 & 0xf; + uVar4 = 0; + if (uVar3 != 0) { + uVar4 = param_2[1]; + do { + LOCK(); + uVar1 = param_2[1]; + bVar6 = uVar4 == uVar1; + if (bVar6) { + param_2[1] = uVar4 | uVar3; + uVar1 = uVar4; + } + uVar4 = uVar1; + UNLOCK(); + } while (!bVar6); + uVar4 = uVar3 & ~uVar4; + } + puVar5 = &local_48; + if ((uVar4 & 1) != 0) { + puVar5 = local_40; + local_44[0] = 2; + local_44[1] = 1; + local_48 = param_1; + } + if ((uVar4 & 2) != 0) { + *puVar5 = param_1; + puVar5[1] = 0x10006; + puVar5 = puVar5 + 2; + } + if ((uVar4 & 4) != 0) { + *puVar5 = param_1; + puVar5[1] = 0x10003; + puVar5 = puVar5 + 2; + } + if (7 < uVar4) { + *puVar5 = param_1; + puVar5[1] = 0x10007; + puVar5 = puVar5 + 2; + } + if ((uVar2 >> 5 & 0x1ff) != 0) { + *puVar5 = param_1; + *(ushort *)((longlong)puVar5 + 6) = (ushort)(uVar2 >> 5) & 0x1ff; + *(ushort *)(puVar5 + 1) = ((ushort)(uVar2 >> 0xe) & 1) << 2; + puVar5 = puVar5 + 2; + } + if ((uVar2 >> 0xf & 0x7f) != 0) { + *puVar5 = param_1; + *(ushort *)((longlong)puVar5 + 6) = (ushort)(uVar2 >> 0xf) & 0x7f; + *(ushort *)(puVar5 + 1) = ((ushort)(uVar2 >> 0x16) & 1) * 4 + 1; + puVar5 = puVar5 + 2; + } + if (0 < (longlong)puVar5 - (longlong)&local_48 >> 3) { + wil_details_RecordFeatureUsageCallback(); + } + return; +} + ``` ## wil_details_RecordFeatureUsageReporting ### Function Meta |Key|volmgrx_8457.sys| | :---: | :---: | |name|wil_details_RecordFeatureUsageReporting| |fullname|wil_details_RecordFeatureUsageReporting| |refcount|3| |length|125| |called|NTOSKRNL.EXE::RtlArmFeatureUsageProviderFlushNotification
NTOSKRNL.EXE::RtlRecordFeatureUsage| |calling|| |paramcount|1| |address|1400015b0| |sig|undefined __fastcall wil_details_RecordFeatureUsageReporting(undefined4 param_1)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_RecordFeatureUsageReporting +++ wil_details_RecordFeatureUsageReporting @@ -0,0 +1,29 @@ + +void wil_details_RecordFeatureUsageReporting(undefined4 param_1) + +{ + int *piVar1; + int iVar2; + undefined4 in_stack_00000028; + undefined2 in_stack_0000002c; + undefined2 in_stack_0000002e; + + iVar2 = g_wil_details_featureUsageCached; + piVar1 = (int *)CONCAT26(in_stack_0000002e,CONCAT24(in_stack_0000002c,in_stack_00000028)); + if (*piVar1 != 0) { + LOCK(); + g_wil_details_featureUsageCached = 1; + UNLOCK(); + if ((iVar2 == 0) && (g_wil_details_featureUsageProvider != 0)) { + RtlArmFeatureUsageProviderFlushNotification(g_wil_details_featureUsageProvider,1); + } + } + if (piVar1[1] != 0) { + in_stack_0000002c = (undefined2)piVar1[2]; + in_stack_0000002e = (undefined2)piVar1[1]; + in_stack_00000028 = param_1; + RtlRecordFeatureUsage(&stack0x00000028,1); + } + return; +} + ``` ## Feature_3984574778__private_IsEnabledDeviceUsageNoInline ### Function Meta |Key|volmgrx_8457.sys| | :---: | :---: | |name|Feature_3984574778__private_IsEnabledDeviceUsageNoInline| |fullname|Feature_3984574778__private_IsEnabledDeviceUsageNoInline| |refcount|3| |length|49| |called|Feature_3984574778__private_IsEnabledFallback| |calling|VMX_DISK_HEADER::Unformat
VMX_PHYSICAL_DISK::ReadToc| |paramcount|0| |address|140001634| |sig|ulonglong __fastcall Feature_3984574778__private_IsEnabledDeviceUsageNoInline(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_3984574778__private_IsEnabledDeviceUsageNoInline +++ Feature_3984574778__private_IsEnabledDeviceUsageNoInline @@ -0,0 +1,17 @@ + +ulonglong Feature_3984574778__private_IsEnabledDeviceUsageNoInline(void) + +{ + ulonglong uVar1; + undefined8 local_res8; + + local_res8 = (undefined4 *)(ulonglong)Feature_3984574778__private_featureState; + if ((Feature_3984574778__private_featureState & 0x10) == 0) { + uVar1 = Feature_3984574778__private_IsEnabledFallback(local_res8,3); + } + else { + uVar1 = (ulonglong)(Feature_3984574778__private_featureState & 1); + } + return uVar1; +} + ``` ## Feature_3984574778__private_IsEnabledFallback ### Function Meta |Key|volmgrx_8457.sys| | :---: | :---: | |name|Feature_3984574778__private_IsEnabledFallback| |fullname|Feature_3984574778__private_IsEnabledFallback| |refcount|2| |length|14| |called|wil_details_IsEnabledFallback| |calling|Feature_3984574778__private_IsEnabledDeviceUsageNoInline| |paramcount|2| |address|14000166c| |sig|undefined __fastcall Feature_3984574778__private_IsEnabledFallback(undefined4 * param_1, uint param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_3984574778__private_IsEnabledFallback +++ Feature_3984574778__private_IsEnabledFallback @@ -0,0 +1,8 @@ + +void Feature_3984574778__private_IsEnabledFallback(undefined4 *param_1,uint param_2) + +{ + wil_details_IsEnabledFallback(param_1,param_2); + return; +} + ``` ## wil_details_AreDependenciesEnabled ### Function Meta |Key|volmgrx_8457.sys| | :---: | :---: | |name|wil_details_AreDependenciesEnabled| |fullname|wil_details_AreDependenciesEnabled| |refcount|2| |length|150| |called|wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState| |calling|wil_details_GetCurrentFeatureEnabledState| |paramcount|1| |address|140001684| |sig|int __fastcall wil_details_AreDependenciesEnabled(longlong param_1)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_AreDependenciesEnabled +++ wil_details_AreDependenciesEnabled @@ -0,0 +1,48 @@ + +int wil_details_AreDependenciesEnabled(longlong param_1) + +{ + uint uVar1; + undefined8 *puVar2; + int iVar3; + int iVar4; + longlong *plVar5; + ulonglong local_res8; + + plVar5 = *(longlong **)(param_1 + 0x20); + iVar3 = 1; + iVar4 = iVar3; + if (plVar5 != (longlong *)0x0) { + do { + while( true ) { + puVar2 = (undefined8 *)*plVar5; + if (puVar2 == (undefined8 *)0x0) { + return iVar3; + } + if ((*(char *)((longlong)puVar2 + 0x1e) == '\0') && + (*(char *)((longlong)puVar2 + 0x1d) == '\0')) break; + if ((iVar3 == 0) || (*(char *)((longlong)puVar2 + 0x1f) == '\0')) { + return 0; + } + iVar3 = 1; + plVar5 = plVar5 + 1; + } + uVar1 = *(uint *)*puVar2; + local_res8 = (ulonglong)uVar1; + if ((uVar1 & 2) == 0) { + local_res8 = wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState + ((uint *)*puVar2,local_res8,(longlong)puVar2); + } + if ((iVar3 == 0) || ((local_res8 & 1) == 0)) { + iVar3 = 0; + } + else { + iVar3 = 1; + } + plVar5 = plVar5 + 1; + iVar4 = 0; + } while (iVar3 != 0); + } + return iVar4; +} + ``` ## wil_details_FeatureReporting_IncrementOpportunityInCache ### Function Meta |Key|volmgrx_8457.sys| | :---: | :---: | |name|wil_details_FeatureReporting_IncrementOpportunityInCache| |fullname|wil_details_FeatureReporting_IncrementOpportunityInCache| |refcount|2| |length|218| |called|| |calling|wil_details_FeatureReporting_RecordUsageInCache| |paramcount|4| |address|140001724| |sig|undefined __fastcall wil_details_FeatureReporting_IncrementOpportunityInCache(uint * param_1, uint param_2, undefined8 param_3, uint * param_4)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_FeatureReporting_IncrementOpportunityInCache +++ wil_details_FeatureReporting_IncrementOpportunityInCache @@ -0,0 +1,54 @@ + +void wil_details_FeatureReporting_IncrementOpportunityInCache + (uint *param_1,uint param_2,undefined8 param_3,uint *param_4) + +{ + uint uVar1; + uint uVar2; + uint uVar3; + uint uVar4; + bool bVar5; + + uVar3 = *param_1; + do { + uVar1 = uVar3; + param_4[1] = 0; + uVar2 = uVar1 | 1; + if ((uVar1 & 0x400000) >> 0x16 != (uint)(param_2 == 5)) { + uVar3 = (uVar1 & 0x3f8000) >> 0xf; + if (uVar3 != 0) { + param_4[1] = uVar3; + uVar3 = 5; + if (param_2 != 1) { + uVar3 = 1; + } + uVar2 = uVar1 & 0xffc07fff | 1; + param_4[2] = uVar3; + } + uVar3 = 0; + if (param_2 == 5) { + uVar3 = 0x400000; + } + uVar2 = uVar3 | uVar2 & 0xffbfffff; + } + uVar3 = uVar2 >> 0xf & 0x7f; + uVar4 = uVar3 + 1; + if ((0x7f < uVar4) || (uVar4 < uVar3)) { + uVar4 = 1; + param_4[2] = param_2; + param_4[1] = uVar3; + } + LOCK(); + uVar3 = *param_1; + bVar5 = uVar1 == uVar3; + if (bVar5) { + *param_1 = uVar2 ^ (uVar4 << 0xf ^ uVar2) & 0x3f8000; + uVar3 = uVar1; + } + UNLOCK(); + } while (!bVar5); + param_4[4] = 0; + *param_4 = ~uVar1 & 1; + return; +} + ``` ## wil_details_FeatureReporting_IncrementUsageInCache ### Function Meta |Key|volmgrx_8457.sys| | :---: | :---: | |name|wil_details_FeatureReporting_IncrementUsageInCache| |fullname|wil_details_FeatureReporting_IncrementUsageInCache| |refcount|2| |length|230| |called|| |calling|wil_details_FeatureReporting_RecordUsageInCache| |paramcount|4| |address|140001808| |sig|undefined __fastcall wil_details_FeatureReporting_IncrementUsageInCache(uint * param_1, uint param_2, undefined8 param_3, uint * param_4)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_FeatureReporting_IncrementUsageInCache +++ wil_details_FeatureReporting_IncrementUsageInCache @@ -0,0 +1,50 @@ + +void wil_details_FeatureReporting_IncrementUsageInCache + (uint *param_1,uint param_2,undefined8 param_3,uint *param_4) + +{ + uint uVar1; + uint uVar2; + uint uVar3; + uint uVar4; + bool bVar5; + + uVar4 = *param_1; + do { + uVar1 = uVar4; + param_4[1] = 0; + uVar2 = uVar1 | 1; + if ((uVar1 & 0x4000) >> 0xe != (uint)(param_2 == 4)) { + uVar4 = (uVar1 & 0x3fe0) >> 5; + if (uVar4 != 0) { + param_4[1] = uVar4; + param_4[2] = ~-(uint)(param_2 != 0) & 4; + uVar2 = uVar1 & 0xffffc01f | 1; + } + uVar4 = 0; + if (param_2 == 4) { + uVar4 = 0x4000; + } + uVar2 = uVar4 | uVar2 & 0xffffbfff; + } + uVar4 = uVar2 >> 5 & 0x1ff; + uVar3 = uVar4 + 1; + if ((0x1ff < uVar3) || (uVar3 < uVar4)) { + uVar3 = 1; + param_4[2] = param_2; + param_4[1] = uVar4; + } + LOCK(); + uVar4 = *param_1; + bVar5 = uVar1 == uVar4; + if (bVar5) { + *param_1 = uVar2 ^ (uVar3 << 5 ^ uVar2) & 0x3fe0; + uVar4 = uVar1; + } + UNLOCK(); + } while (!bVar5); + param_4[4] = 0; + *param_4 = ~uVar1 & 1; + return; +} + ``` ## wil_details_FeatureReporting_RecordUsageInCache ### Function Meta |Key|volmgrx_8457.sys| | :---: | :---: | |name|wil_details_FeatureReporting_RecordUsageInCache| |fullname|wil_details_FeatureReporting_RecordUsageInCache| |refcount|2| |length|381| |called|wil_details_FeatureReporting_IncrementOpportunityInCache
wil_details_FeatureReporting_IncrementUsageInCache| |calling|wil_details_FeatureReporting_ReportUsageToServiceDirect| |paramcount|4| |address|1400018f8| |sig|uint * __fastcall wil_details_FeatureReporting_RecordUsageInCache(uint * param_1, uint * param_2, undefined8 param_3, uint param_4)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_FeatureReporting_RecordUsageInCache +++ wil_details_FeatureReporting_RecordUsageInCache @@ -0,0 +1,101 @@ + +uint * wil_details_FeatureReporting_RecordUsageInCache + (uint *param_1,uint *param_2,undefined8 param_3,uint param_4) + +{ + uint uVar1; + uint uVar2; + uint uVar3; + uint uVar4; + uint uVar5; + bool bVar6; + + uVar3 = (uint)param_3; + param_1[0] = 0; + param_1[1] = 0; + param_1[2] = 0; + param_1[3] = 0; + param_1[4] = 0; + param_1[5] = 0; + if (uVar3 == 0) { +LAB_140001a54: + wil_details_FeatureReporting_IncrementUsageInCache(param_2,uVar3,param_3,param_1); + } + else { + if (uVar3 == 1) { +LAB_140001a44: + wil_details_FeatureReporting_IncrementOpportunityInCache(param_2,uVar3,param_3,param_1); + return param_1; + } + if ((uVar3 != 2) && (uVar3 != 3)) { + if (uVar3 == 4) goto LAB_140001a54; + if (uVar3 == 5) goto LAB_140001a44; + if ((uVar3 != 6) && (uVar3 != 7)) { + uVar5 = uVar3 - 0x140; + if ((int)uVar5 < 0x40) { + uVar4 = param_2[1]; + do { + if (((uVar4 & 0x10) == 0) || (uVar2 = 1, (uVar4 >> 5 & 0x3f) != uVar5)) { + uVar2 = 0; + } + param_1[4] = uVar2; + LOCK(); + uVar2 = param_2[1]; + bVar6 = uVar4 == uVar2; + if (bVar6) { + param_2[1] = (uVar5 * 0x20 ^ uVar4) & 0x7e0 ^ uVar4 | 0x10; + uVar2 = uVar4; + } + uVar4 = uVar2; + UNLOCK(); + } while (!bVar6); + if (param_1[4] != 0) { + return param_1; + } + } + param_1[2] = uVar3; + param_1[1] = 1; + param_1[3] = param_4; + return param_1; + } + } + uVar5 = 0; + if (uVar3 == 2) { + uVar5 = 2; + } + else if (uVar3 == 3) { + uVar5 = 8; + } + else if (uVar3 == 6) { + uVar5 = 4; + } + else if (uVar3 == 7) { + uVar5 = 0x10; + } + uVar4 = 1; + uVar3 = *param_2; + do { + uVar1 = uVar3; + uVar3 = uVar5 | uVar1; + param_1[4] = (uint)(uVar3 == uVar1); + uVar2 = uVar3 | 1; + if (uVar3 == uVar1) { + uVar2 = uVar3; + } + LOCK(); + uVar3 = *param_2; + bVar6 = uVar1 == uVar3; + if (bVar6) { + *param_2 = uVar2; + uVar3 = uVar1; + } + UNLOCK(); + } while (!bVar6); + if (((uVar2 & 1) == 0) || ((uVar1 & 1) != 0)) { + uVar4 = 0; + } + *param_1 = uVar4; + } + return param_1; +} + ``` ## wil_details_FeatureReporting_ReportUsageToService ### Function Meta |Key|volmgrx_8457.sys| | :---: | :---: | |name|wil_details_FeatureReporting_ReportUsageToService| |fullname|wil_details_FeatureReporting_ReportUsageToService| |refcount|2| |length|114| |called|_guard_dispatch_icall
wil_details_FeatureReporting_ReportUsageToServiceDirect
wil_details_MapReportingKind| |calling|wil_details_IsEnabledFallback| |paramcount|3| |address|140001a7c| |sig|undefined __fastcall wil_details_FeatureReporting_ReportUsageToService(undefined8 param_1, undefined8 param_2, uint param_3)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_FeatureReporting_ReportUsageToService +++ wil_details_FeatureReporting_ReportUsageToService @@ -0,0 +1,27 @@ + +/* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ + +void wil_details_FeatureReporting_ReportUsageToService + (undefined8 param_1,undefined8 param_2,uint param_3) + +{ + bool bVar1; + uint uVar2; + undefined7 extraout_var; + ulonglong uVar3; + uint uVar4; + uint local_res18 [4]; + + uVar4 = (uint)param_2 & 1; + uVar3 = (ulonglong)param_3; + local_res18[0] = param_3; + uVar2 = wil_details_MapReportingKind(param_3,uVar4); + bVar1 = wil_details_FeatureReporting_ReportUsageToServiceDirect(uVar3,param_2,(ulonglong)uVar2); + if (((int)CONCAT71(extraout_var,bVar1) != 0) && + (g_wil_details_pfnFeatureLoggingHook != (code *)0x0)) { + (*g_wil_details_pfnFeatureLoggingHook) + (0x3ae01e5,&Feature_3984574778_logged_traits,0,uVar4,local_res18,0,0,1); + } + return; +} + ``` ## wil_details_FeatureReporting_ReportUsageToServiceDirect ### Function Meta |Key|volmgrx_8457.sys| | :---: | :---: | |name|wil_details_FeatureReporting_ReportUsageToServiceDirect| |fullname|wil_details_FeatureReporting_ReportUsageToServiceDirect| |refcount|2| |length|226| |called|NTOSKRNL.EXE::RtlNotifyFeatureUsage
__security_check_cookie
_guard_dispatch_icall
wil_details_FeatureReporting_RecordUsageInCache| |calling|wil_details_FeatureReporting_ReportUsageToService| |paramcount|3| |address|140001af8| |sig|bool __fastcall wil_details_FeatureReporting_ReportUsageToServiceDirect(undefined8 param_1, undefined8 param_2, ulonglong param_3)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_FeatureReporting_ReportUsageToServiceDirect +++ wil_details_FeatureReporting_ReportUsageToServiceDirect @@ -0,0 +1,47 @@ + +/* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ +/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ + +bool wil_details_FeatureReporting_ReportUsageToServiceDirect + (undefined8 param_1,undefined8 param_2,ulonglong param_3) + +{ + uint6 uVar1; + uint *puVar2; + undefined1 auStack_88 [32]; + uint *local_68; + undefined8 local_58; + uint local_50 [6]; + uint local_38; + uint uStack_34; + uint uStack_30; + uint uStack_2c; + undefined8 local_28; + ulonglong local_20; + + local_20 = __security_cookie ^ (ulonglong)auStack_88; + puVar2 = wil_details_FeatureReporting_RecordUsageInCache + (local_50,(uint *)&Feature_3984574778__private_reporting,param_3, + (uint)((ulonglong)param_2 >> 0x20)); + local_38 = *puVar2; + uStack_34 = puVar2[1]; + uStack_30 = puVar2[2]; + uStack_2c = puVar2[3]; + local_28 = *(undefined8 *)(puVar2 + 4); + if (g_wil_details_recordFeatureUsage != (code *)0x0) { + local_68 = &local_38; + (*g_wil_details_recordFeatureUsage) + (0x3ae01e5,param_3 & 0xffffffff,1,&Feature_3984574778__private_reporting); + } + if ((((uint)param_2 >> 10 & 1) != 0) && ((int)param_3 != 0xfe)) { + local_58._0_6_ = CONCAT24((short)(param_3 & 0xffffffff),0x3ae01e5); + uVar1 = (uint6)local_58; + local_58 = (ulonglong)(uint6)local_58; + if (((uint)param_2 >> 0xb & 1) != 0) { + local_58 = CONCAT26(1,uVar1); + } + RtlNotifyFeatureUsage(&local_58); + } + return (int)local_28 == 0; +} + ``` ## wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState ### Function Meta |Key|volmgrx_8457.sys| | :---: | :---: | |name|wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState| |fullname|wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState| |refcount|3| |length|263| |called|_guard_dispatch_icall
wil_details_GetCurrentFeatureEnabledState| |calling|wil_details_AreDependenciesEnabled
wil_details_IsEnabledFallback| |paramcount|3| |address|140001be4| |sig|ulonglong __fastcall wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState(uint * param_1, ulonglong param_2, longlong param_3)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState +++ wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState @@ -0,0 +1,67 @@ + +/* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ + +ulonglong wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState + (uint *param_1,ulonglong param_2,longlong param_3) + +{ + int iVar1; + uint uVar2; + ulonglong uVar3; + uint uVar4; + uint uVar5; + ulonglong uVar6; + bool bVar7; + uint local_res8 [2]; + undefined8 local_res10; + + iVar1 = 0; + local_res8[0] = 0; + local_res10 = param_2; + if (g_wil_details_ensureSubscribedToFeatureConfigurationChanges != (code *)0x0) { + iVar1 = (*g_wil_details_ensureSubscribedToFeatureConfigurationChanges)(); + } + uVar2 = wil_details_GetCurrentFeatureEnabledState(param_3,local_res8); + if (*(char *)(param_3 + 0x1c) == '\0') { + local_res8[0] = local_res8[0] & -(uint)(iVar1 != 0); + } + uVar3 = param_2 & 0xffffffff; + do { + uVar6 = param_2; + uVar5 = (uint)uVar3; + local_res10 = CONCAT44(local_res10._4_4_,uVar5); + if ((local_res8[0] != 0) && (local_res10 = CONCAT44(local_res10._4_4_,uVar5), (uVar3 & 2) == 0)) + { + uVar4 = uVar5 & 0xfffff63e | uVar2 & 0x9c1; + uVar5 = uVar4 | 2; + local_res10 = CONCAT44(local_res10._4_4_,uVar4) | 2; + } + if ((uVar6 & 4) == 0) { + uVar4 = uVar2 & 0x400 | uVar5 & 0xfffffbff; + uVar5 = uVar4 | 4; + local_res10 = CONCAT44(local_res10._4_4_,uVar4) | 4; + } + uVar3 = uVar6 & 0xffffffff; + LOCK(); + uVar4 = *param_1; + bVar7 = (uint)uVar6 == uVar4; + if (bVar7) { + *param_1 = uVar5; + } + else { + uVar3 = (ulonglong)uVar4; + } + UNLOCK(); + param_2 = uVar3; + } while (!bVar7); + if (((uVar6 & 4) == 0) && + (g_wil_details_subscribeFeatureStateCacheToConfigurationChanges != (code *)0x0)) { + (*g_wil_details_subscribeFeatureStateCacheToConfigurationChanges) + (param_1,*(undefined1 *)(param_3 + 0x1c),iVar1); + } + if (local_res8[0] == 0) { + local_res10 = CONCAT44(local_res10._4_4_,uVar2 & 0x9c1 | uVar5 & 0xfffff63e); + } + return local_res10; +} + ``` ## wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath ### Function Meta |Key|volmgrx_8457.sys| | :---: | :---: | |name|wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath| |fullname|wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath| |refcount|2| |length|76| |called|| |calling|wil_details_IsEnabledFallback| |paramcount|2| |address|140001cf4| |sig|undefined __fastcall wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath(uint param_1, int param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath +++ wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath @@ -0,0 +1,41 @@ + +void wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath(uint param_1,int param_2) + +{ + uint uVar1; + uint uVar2; + uint uVar3; + bool bVar4; + + if (param_2 == 3) { + uVar3 = 0x10; + } + else { + if (param_2 != 4) { + return; + } + uVar3 = 0x20; + } + if ((Feature_3984574778__private_featureState & 2) != 0) { + uVar2 = Feature_3984574778__private_featureState; + while ((uVar2 & 1) == (param_1 & 1)) { + LOCK(); + bVar4 = uVar2 == Feature_3984574778__private_featureState; + uVar1 = uVar3 | uVar2; + if (!bVar4) { + uVar2 = Feature_3984574778__private_featureState; + uVar1 = Feature_3984574778__private_featureState; + } + Feature_3984574778__private_featureState = uVar1; + UNLOCK(); + if (bVar4) { + return; + } + if ((uVar2 & 2) == 0) { + return; + } + } + } + return; +} + ``` ## wil_details_GetCurrentFeatureEnabledState ### Function Meta |Key|volmgrx_8457.sys| | :---: | :---: | |name|wil_details_GetCurrentFeatureEnabledState| |fullname|wil_details_GetCurrentFeatureEnabledState| |refcount|2| |length|270| |called|wil_RtlStagingConfig_QueryFeatureState
wil_details_AreDependenciesEnabled| |calling|wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState| |paramcount|2| |address|140001d48| |sig|uint __fastcall wil_details_GetCurrentFeatureEnabledState(longlong param_1, undefined4 * param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_GetCurrentFeatureEnabledState +++ wil_details_GetCurrentFeatureEnabledState @@ -0,0 +1,57 @@ + +uint wil_details_GetCurrentFeatureEnabledState(longlong param_1,undefined4 *param_2) + +{ + char cVar1; + undefined4 uVar2; + uint uVar3; + undefined8 uVar4; + uint uVar5; + uint uVar6; + uint uVar7; + uint uVar8; + uint uVar9; + uint uVar10; + uint local_38 [8]; + + cVar1 = *(char *)(param_1 + 0x1c); + uVar2 = *(undefined4 *)(param_1 + 0x18); + uVar7 = 1; + *param_2 = 1; + local_38[0] = 0; + local_38[1] = 0; + local_38[2] = 0; + local_38[3] = 0; + local_38[4] = 0; + local_38[5] = 0; + uVar4 = wil_RtlStagingConfig_QueryFeatureState(local_38,uVar2,(uint)((byte)(cVar1 - 2U) < 2)); + uVar8 = -(uint)(local_38[5] != 0) & 0x800; + uVar9 = uVar8 | -(uint)(local_38[4] != 0) & 0x400; + uVar3 = -(uint)((int)uVar4 != 0) & local_38[0] & 3; + uVar5 = uVar3 << 7; + if (uVar3 == 0) { + uVar3 = -(uint)(*(char *)(param_1 + 0x1f) != '\0') & 0x40; + } + else { + uVar3 = 0; + if (local_38[0] == 2) { + uVar3 = 0x40; + } + } + uVar6 = uVar3 | uVar5 | uVar9; + uVar10 = uVar7; + if ((uVar9 == 0xc00) || (uVar10 = 0, uVar3 != 0)) { + uVar9 = uVar7; + if (*(longlong *)(param_1 + 0x20) != 0) { + uVar9 = wil_details_AreDependenciesEnabled(param_1); + } + if ((uVar10 != 0) && (uVar9 == 0)) { + uVar6 = uVar3 | uVar5 | uVar8; + } + if (((uVar6 & 0x40) != 0) && (uVar9 != 0)) goto LAB_140001e35; + } + uVar7 = 0; +LAB_140001e35: + return uVar6 | uVar7; +} + ``` ## wil_details_IsEnabledFallback ### Function Meta |Key|volmgrx_8457.sys| | :---: | :---: | |name|wil_details_IsEnabledFallback| |fullname|wil_details_IsEnabledFallback| |refcount|2| |length|135| |called|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath| |calling|Feature_3984574778__private_IsEnabledFallback| |paramcount|2| |address|140001e60| |sig|uint __fastcall wil_details_IsEnabledFallback(undefined4 * param_1, uint param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_IsEnabledFallback +++ wil_details_IsEnabledFallback @@ -0,0 +1,26 @@ + +uint wil_details_IsEnabledFallback(undefined4 *param_1,uint param_2) + +{ + uint uVar1; + undefined4 *puVar2; + ulonglong local_res18; + + uVar1 = (uint)param_1; + local_res18 = (ulonglong)param_1 & 0xffffffff; + if (((ulonglong)param_1 & 2) == 0) { + puVar2 = &Feature_3984574778__private_featureState; + local_res18 = wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState + (&Feature_3984574778__private_featureState,(ulonglong)param_1, + 0x140022dd8); + param_1 = puVar2; + uVar1 = (uint)local_res18; + } + if ((param_2 != 0) && + (wil_details_FeatureReporting_ReportUsageToService(param_1,local_res18,param_2), + param_2 - 3 < 2)) { + wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath((uint)local_res18,param_2); + } + return uVar1 & 1; +} + ``` ## wil_details_MapReportingKind ### Function Meta |Key|volmgrx_8457.sys| | :---: | :---: | |name|wil_details_MapReportingKind| |fullname|wil_details_MapReportingKind| |refcount|2| |length|144| |called|| |calling|wil_details_FeatureReporting_ReportUsageToService| |paramcount|2| |address|140001ef0| |sig|uint __fastcall wil_details_MapReportingKind(int param_1, int param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_MapReportingKind +++ wil_details_MapReportingKind @@ -0,0 +1,33 @@ + +uint wil_details_MapReportingKind(int param_1,int param_2) + +{ + byte bVar1; + + if (param_1 != 0) { + if (param_1 == 1) { + return ~-(uint)(param_2 != 0) & 4; + } + if (param_1 == 2) { + return (-(uint)(param_2 != 0) & 0xfffffffc) + 5; + } + if (param_1 == 3) { + return (-(uint)(param_2 != 0) & 0xfffffffc) + 6; + } + if (param_1 == 4) { + return (-(uint)(param_2 != 0) & 0xfffffffc) + 7; + } + if (param_1 == 5) { + return (-(uint)(param_2 != 0) & 0xfffffffe) + 10; + } + if (param_1 == 6) { + return (-(uint)(param_2 != 0) & 0xfffffffe) + 0xb; + } + bVar1 = (char)param_1 + 0x9c; + if (bVar1 < 0x32) { + return (-(uint)(param_2 != 0) & 0xffffffce) + 0x96 + (uint)bVar1; + } + } + return 0xff; +} + ``` ## wil_UninitializeFeatureStaging ### Function Meta |Key|volmgrx_8457.sys| | :---: | :---: | |name|wil_UninitializeFeatureStaging| |fullname|wil_UninitializeFeatureStaging| |refcount|4| |length|80| |called|NTOSKRNL.EXE::RtlUnregisterFeatureConfigurationChangeNotification
NTOSKRNL.EXE::RtlUnregisterFeatureUsageProvider| |calling|DriverEntry| |paramcount|0| |address|1400285a0| |sig|undefined __fastcall wil_UninitializeFeatureStaging(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_UninitializeFeatureStaging +++ wil_UninitializeFeatureStaging @@ -0,0 +1,16 @@ + +void wil_UninitializeFeatureStaging(void) + +{ + if (g_wil_details_featureChangeNotification != 0) { + RtlUnregisterFeatureConfigurationChangeNotification(); + g_wil_details_featureChangeNotification = 0; + } + if (g_wil_details_featureUsageProvider != 0) { + RtlUnregisterFeatureUsageProvider(); + g_wil_details_featureUsageProvider = 0; + } + g_wil_details_isFeatureStagingInitialized = 0; + return; +} + ``` ## wil_details_BuildFeatureStateCacheFromQueryResults ### Function Meta |Key|volmgrx_8457.sys| | :---: | :---: | |name|wil_details_BuildFeatureStateCacheFromQueryResults| |fullname|wil_details_BuildFeatureStateCacheFromQueryResults| |refcount|3| |length|97| |called|| |calling|wil_details_PopulateInitialConfiguredFeatureStates
wil_details_UpdateFeatureConfiguredStates| |paramcount|3| |address|1400285f8| |sig|undefined __fastcall wil_details_BuildFeatureStateCacheFromQueryResults(int param_1, longlong param_2, uint * param_3)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_BuildFeatureStateCacheFromQueryResults +++ wil_details_BuildFeatureStateCacheFromQueryResults @@ -0,0 +1,28 @@ + +void wil_details_BuildFeatureStateCacheFromQueryResults(int param_1,longlong param_2,uint *param_3) + +{ + uint uVar1; + + if ((param_1 == -0x7fffffde) || (param_1 == -0x3ffffddb)) { + param_3[0] = 0; + param_3[1] = 0; + } + else { + param_3[0] = 0; + param_3[1] = 0; + if (param_1 == 0) { + uVar1 = ((*(uint *)(param_2 + 4) & 0x40) << 2 | *(uint *)(param_2 + 4) & 0xb0) << 3 | 0x206; + goto LAB_140028655; + } + if (param_1 == 0x117) { + uVar1 = (*(uint *)(param_2 + 4) & 0x80) << 3 | 0x206; + goto LAB_140028655; + } + } + uVar1 = 0x206; +LAB_140028655: + *param_3 = uVar1; + return; +} + ``` ## wil_details_EvaluateFeatureDependencies ### Function Meta |Key|volmgrx_8457.sys| | :---: | :---: | |name|wil_details_EvaluateFeatureDependencies| |fullname|wil_details_EvaluateFeatureDependencies| |refcount|3| |length|174| |called|wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState
wil_details_FeatureDescriptors_SkipPadding| |calling|wil_InitializeFeatureStaging
wil_details_ReevaluateOnFeatureConfigurationChange| |paramcount|0| |address|140028660| |sig|undefined __fastcall wil_details_EvaluateFeatureDependencies(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_EvaluateFeatureDependencies +++ wil_details_EvaluateFeatureDependencies @@ -0,0 +1,45 @@ + +void wil_details_EvaluateFeatureDependencies(void) + +{ + longlong *plVar1; + undefined **ppuVar2; + uint uVar3; + ulonglong uVar4; + undefined8 uVar5; + bool bVar6; + + plVar1 = wil_details_FeatureDescriptors_SkipPadding((longlong *)&wil_details_featureDescriptors_a) + ; + if (plVar1 != (longlong *)0x0) { + uVar4 = 0; + uVar5 = 0x180; + do { + uVar3 = *(uint *)*plVar1; + if ((uVar3 >> 9 & 1) != 0) { + if (((uint)uVar5 & uVar3) == 0) { + bVar6 = *(char *)((longlong)plVar1 + 0x1f) != '\0'; + } + else { + bVar6 = (uVar3 & (uint)uVar5) == 0x100; + } + uVar3 = uVar3 & 0x40 ^ (uint)bVar6 << 6 | (uint)uVar4 & 0xffffffbf; + uVar4 = (ulonglong)uVar3; + LOCK(); + *(uint *)*plVar1 = *(uint *)*plVar1 ^ uVar3; + UNLOCK(); + } + plVar1 = wil_details_FeatureDescriptors_SkipPadding(plVar1 + 7); + } while (plVar1 != (longlong *)0x0); + } + ppuVar2 = &wil_details_featureDescriptors_a; + while( true ) { + plVar1 = wil_details_FeatureDescriptors_SkipPadding((longlong *)ppuVar2); + if (plVar1 == (longlong *)0x0) break; + wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState + ((uint *)*plVar1,(longlong)plVar1); + ppuVar2 = (undefined **)(plVar1 + 7); + } + return; +} + ``` ## wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState ### Function Meta |Key|volmgrx_8457.sys| | :---: | :---: | |name|wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState| |fullname|wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState| |refcount|3| |length|47| |called|wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState| |calling|wil_details_EvaluateFeatureDependencies
wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState| |paramcount|2| |address|140028718| |sig|uint __fastcall wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState(uint * param_1, longlong param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState +++ wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState @@ -0,0 +1,15 @@ + +uint wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState + (uint *param_1,longlong param_2) + +{ + uint uVar1; + + uVar1 = *param_1; + if ((uVar1 >> 9 & 1) != 0) { + uVar1 = wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState + (param_1,uVar1,param_2); + } + return uVar1; +} + ``` ## wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState ### Function Meta |Key|volmgrx_8457.sys| | :---: | :---: | |name|wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState| |fullname|wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState| |refcount|2| |length|265| |called|wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState| |calling|wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState| |paramcount|3| |address|140028750| |sig|uint __fastcall wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState(uint * param_1, uint param_2, longlong param_3)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState +++ wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState @@ -0,0 +1,73 @@ + +uint wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState + (uint *param_1,uint param_2,longlong param_3) + +{ + undefined8 *puVar1; + bool bVar2; + uint uVar3; + uint uVar4; + uint uVar5; + longlong *plVar6; + bool bVar7; + bool bVar8; + + uVar5 = param_2 >> 6 & 1; + if (((param_2 & 0xc00) == 0xc00) || (bVar7 = false, bVar2 = true, uVar5 != 0)) { + plVar6 = *(longlong **)(param_3 + 0x20); + bVar7 = (param_2 & 0xc00) == 0xc00; + bVar8 = true; + bVar2 = true; + if (plVar6 != (longlong *)0x0) { + do { + while( true ) { + puVar1 = (undefined8 *)*plVar6; + if (puVar1 == (undefined8 *)0x0) goto LAB_1400287f5; + if ((*(char *)((longlong)puVar1 + 0x1e) == '\0') && + (*(char *)((longlong)puVar1 + 0x1d) == '\0')) break; + if ((!bVar8) || (*(char *)((longlong)puVar1 + 0x1f) == '\0')) { + bVar8 = false; + goto LAB_1400287f5; + } + plVar6 = plVar6 + 1; + bVar8 = true; + } + uVar3 = wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState + ((uint *)*puVar1,(longlong)puVar1); + if ((!bVar8) || (bVar8 = true, (uVar3 & 1) == 0)) { + bVar8 = false; + } + plVar6 = plVar6 + 1; + } while (bVar8); +LAB_1400287f5: + bVar2 = bVar8; + if ((uVar5 == 0) || (!bVar8)) { + uVar5 = 0; + } + else { + uVar5 = 1; + } + } + } + do { + uVar3 = param_2 & 0xfffffffe | uVar5; + if ((bVar7) && (!bVar2)) { + uVar3 = param_2 & 0xfffffbfe | uVar5; + } + uVar4 = uVar3 & 0xffffffcf; + if ((param_2 & 1) == uVar5) { + uVar4 = uVar3; + } + LOCK(); + uVar3 = *param_1; + bVar8 = param_2 == uVar3; + if (bVar8) { + *param_1 = uVar4 & 0xfffffdff; + uVar3 = param_2; + } + param_2 = uVar3; + UNLOCK(); + } while (!bVar8); + return uVar4 & 0xfffffdff; +} + ``` ## wil_details_OnFeatureUsageProviderFlushNotification ### Function Meta |Key|volmgrx_8457.sys| | :---: | :---: | |name|wil_details_OnFeatureUsageProviderFlushNotification| |fullname|wil_details_OnFeatureUsageProviderFlushNotification| |refcount|3| |length|77| |called|wil_details_FeatureDescriptors_SkipPadding
wil_details_RecordCachedUsage| |calling|| |paramcount|1| |address|140028860| |sig|undefined __fastcall wil_details_OnFeatureUsageProviderFlushNotification(int param_1)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_OnFeatureUsageProviderFlushNotification +++ wil_details_OnFeatureUsageProviderFlushNotification @@ -0,0 +1,27 @@ + +void wil_details_OnFeatureUsageProviderFlushNotification(int param_1) + +{ + int iVar1; + longlong *plVar2; + undefined **ppuVar3; + + iVar1 = g_wil_details_featureUsageCached; + if (param_1 == 1) { + LOCK(); + g_wil_details_featureUsageCached = 0; + UNLOCK(); + if (iVar1 != 0) { + ppuVar3 = &wil_details_featureDescriptors_a; + while (plVar2 = wil_details_FeatureDescriptors_SkipPadding((longlong *)ppuVar3), + plVar2 != (longlong *)0x0) { + if ((*(uint *)plVar2[1] & 1) != 0) { + wil_details_RecordCachedUsage((int)plVar2[3],(uint *)plVar2[1]); + } + ppuVar3 = (undefined **)(plVar2 + 7); + } + } + } + return; +} + ``` ## wil_details_RecordFeatureUsageCallback ### Function Meta |Key|volmgrx_8457.sys| | :---: | :---: | |name|wil_details_RecordFeatureUsageCallback| |fullname|wil_details_RecordFeatureUsageCallback| |refcount|2| |length|21| |called|NTOSKRNL.EXE::RtlRecordFeatureUsage| |calling|wil_details_RecordCachedUsage| |paramcount|0| |address|1400288b4| |sig|undefined __fastcall wil_details_RecordFeatureUsageCallback(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_RecordFeatureUsageCallback +++ wil_details_RecordFeatureUsageCallback @@ -0,0 +1,8 @@ + +void wil_details_RecordFeatureUsageCallback(void) + +{ + RtlRecordFeatureUsage(); + return; +} + ``` ## wil_details_ReevaluateOnFeatureConfigurationChange ### Function Meta |Key|volmgrx_8457.sys| | :---: | :---: | |name|wil_details_ReevaluateOnFeatureConfigurationChange| |fullname|wil_details_ReevaluateOnFeatureConfigurationChange| |refcount|3| |length|19| |called|wil_details_EvaluateFeatureDependencies
wil_details_UpdateFeatureConfiguredStates| |calling|| |paramcount|0| |address|1400288d0| |sig|undefined __fastcall wil_details_ReevaluateOnFeatureConfigurationChange(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_ReevaluateOnFeatureConfigurationChange +++ wil_details_ReevaluateOnFeatureConfigurationChange @@ -0,0 +1,9 @@ + +void wil_details_ReevaluateOnFeatureConfigurationChange(void) + +{ + wil_details_UpdateFeatureConfiguredStates(); + wil_details_EvaluateFeatureDependencies(); + return; +} + ``` ## wil_details_RegisterFeatureUsageProvider ### Function Meta |Key|volmgrx_8457.sys| | :---: | :---: | |name|wil_details_RegisterFeatureUsageProvider| |fullname|wil_details_RegisterFeatureUsageProvider| |refcount|2| |length|101| |called|NTOSKRNL.EXE::RtlRegisterFeatureUsageProvider
wil_details_FeatureDescriptors_SkipPadding| |calling|wil_InitializeFeatureStaging| |paramcount|0| |address|1400288ec| |sig|undefined __fastcall wil_details_RegisterFeatureUsageProvider(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_RegisterFeatureUsageProvider +++ wil_details_RegisterFeatureUsageProvider @@ -0,0 +1,23 @@ + +void wil_details_RegisterFeatureUsageProvider(void) + +{ + int iVar1; + longlong *local_28; + undefined *local_20; + undefined8 local_18; + + g_wil_details_recordFeatureUsage = wil_details_RecordFeatureUsageReporting; + local_28 = wil_details_FeatureDescriptors_SkipPadding + ((longlong *)&wil_details_featureDescriptors_a); + local_18 = 0; + local_20 = &wil_details_featureDescriptors_z; + iVar1 = RtlRegisterFeatureUsageProvider + (wil_details_OnFeatureUsageProviderFlushNotification,&local_28, + &g_wil_details_featureUsageProvider); + if (iVar1 != 0) { + g_wil_details_featureUsageProvider = 0; + } + return; +} + ``` ## wil_details_UpdateFeatureConfiguredStates ### Function Meta |Key|volmgrx_8457.sys| | :---: | :---: | |name|wil_details_UpdateFeatureConfiguredStates| |fullname|wil_details_UpdateFeatureConfiguredStates| |refcount|2| |length|173| |called|NTOSKRNL.EXE::RtlQueryFeatureConfiguration
__security_check_cookie
wil_details_BuildFeatureStateCacheFromQueryResults
wil_details_FeatureDescriptors_SkipPadding| |calling|wil_details_ReevaluateOnFeatureConfigurationChange| |paramcount|0| |address|140028958| |sig|undefined __fastcall wil_details_UpdateFeatureConfiguredStates(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_UpdateFeatureConfiguredStates +++ wil_details_UpdateFeatureConfiguredStates @@ -0,0 +1,40 @@ + +/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ + +void wil_details_UpdateFeatureConfiguredStates(void) + +{ + int iVar1; + longlong *plVar2; + undefined **ppuVar3; + undefined1 auStack_58 [32]; + uint local_38 [2]; + undefined8 local_30; + undefined8 local_28; + undefined4 local_20; + ulonglong local_18; + + local_18 = __security_cookie ^ (ulonglong)auStack_58; + ppuVar3 = &wil_details_featureDescriptors_a; + while( true ) { + plVar2 = wil_details_FeatureDescriptors_SkipPadding((longlong *)ppuVar3); + if (plVar2 == (longlong *)0x0) break; + if (((*(char *)((longlong)plVar2 + 0x1d) == '\0') && + (*(char *)((longlong)plVar2 + 0x1e) == '\0')) && + (*(char *)((longlong)plVar2 + 0x1c) == '\0')) { + local_30 = 0; + local_28 = 0; + local_20 = 0; + iVar1 = RtlQueryFeatureConfiguration((int)plVar2[3],1,&local_30,&local_28); + local_38[0] = 0; + local_38[1] = 0; + wil_details_BuildFeatureStateCacheFromQueryResults(iVar1,(longlong)&local_28,local_38); + LOCK(); + *(uint *)*plVar2 = *(uint *)*plVar2 ^ (*(uint *)*plVar2 ^ local_38[0]) & 0xf80; + UNLOCK(); + } + ppuVar3 = (undefined **)(plVar2 + 7); + } + return; +} + ``` ## wil_RtlStagingConfig_QueryFeatureState ### Function Meta |Key|volmgrx_8457.sys| | :---: | :---: | |name|wil_RtlStagingConfig_QueryFeatureState| |fullname|wil_RtlStagingConfig_QueryFeatureState| |refcount|2| |length|197| |called|NTOSKRNL.EXE::RtlQueryFeatureConfiguration
__security_check_cookie| |calling|wil_details_GetCurrentFeatureEnabledState| |paramcount|3| |address|140028c78| |sig|undefined8 __fastcall wil_RtlStagingConfig_QueryFeatureState(uint * param_1, undefined4 param_2, int param_3)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_RtlStagingConfig_QueryFeatureState +++ wil_RtlStagingConfig_QueryFeatureState @@ -0,0 +1,35 @@ + +/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ + +undefined8 wil_RtlStagingConfig_QueryFeatureState(uint *param_1,undefined4 param_2,int param_3) + +{ + int iVar1; + undefined1 auStack_48 [32]; + undefined8 local_28; + undefined8 local_20; + uint local_18; + ulonglong local_10; + + local_10 = __security_cookie ^ (ulonglong)auStack_48; + local_28 = 0; + local_20 = 0; + local_18 = 0; + iVar1 = RtlQueryFeatureConfiguration(param_2,param_3 == 0,&local_28,&local_20); + if (iVar1 == 0) { + *param_1 = local_20._4_4_ >> 4 & 3; + *(byte *)(param_1 + 1) = (byte)((ulonglong)local_20 >> 0x28) & 0x3f; + param_1[3] = local_18; + param_1[2] = local_20._4_4_ >> 0xe & 3; + param_1[5] = local_20._4_4_ >> 6 & 1; + param_1[4] = local_20._4_4_ >> 7 & 1; + } + else { + if (iVar1 != 0x117) { + return 0; + } + param_1[4] = local_20._4_4_ >> 7 & 1; + } + return 1; +} + ``` ## wil_InitializeFeatureStaging ### Function Meta |Key|volmgrx_8457.sys| | :---: | :---: | |name|wil_InitializeFeatureStaging| |fullname|wil_InitializeFeatureStaging| |refcount|2| |length|186| |called|NTOSKRNL.EXE::RtlQueryFeatureConfigurationChangeStamp
NTOSKRNL.EXE::RtlRegisterFeatureConfigurationChangeNotification
wil_details_EvaluateFeatureDependencies
wil_details_FeatureDescriptors_SkipPadding
wil_details_PopulateInitialConfiguredFeatureStates
wil_details_RegisterFeatureUsageProvider| |calling|DriverEntry| |paramcount|0| |address|140060078| |sig|int __fastcall wil_InitializeFeatureStaging(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_InitializeFeatureStaging +++ wil_InitializeFeatureStaging @@ -0,0 +1,46 @@ + +int wil_InitializeFeatureStaging(void) + +{ + bool bVar1; + int iVar2; + longlong *plVar3; + undefined **ppuVar4; + undefined8 local_res8; + + bVar1 = false; + if (g_wil_details_isFeatureStagingInitialized == 0) { + g_wil_details_isFeatureStagingInitialized = 1; + local_res8 = RtlQueryFeatureConfigurationChangeStamp(); + wil_details_PopulateInitialConfiguredFeatureStates(); + wil_details_EvaluateFeatureDependencies(); + ppuVar4 = &wil_details_featureDescriptors_a; + while (plVar3 = wil_details_FeatureDescriptors_SkipPadding((longlong *)ppuVar4), + plVar3 != (longlong *)0x0) { + if (((*(char *)((longlong)plVar3 + 0x1d) == '\0') && + (*(char *)((longlong)plVar3 + 0x1e) == '\0')) && + (*(char *)((longlong)plVar3 + 0x1c) == '\0')) { + iVar2 = RtlRegisterFeatureConfigurationChangeNotification + (wil_details_ReevaluateOnFeatureConfigurationChange,0,&local_res8, + &g_wil_details_featureChangeNotification); + if (iVar2 == 0) { + bVar1 = true; + } + else { + g_wil_details_featureChangeNotification = 0; + } + break; + } + ppuVar4 = (undefined **)(plVar3 + 7); + } + iVar2 = wil_details_RegisterFeatureUsageProvider(); + if (iVar2 != 0) { + if (!bVar1) { + return iVar2; + } + return 0; + } + } + return 0; +} + ``` ## wil_details_PopulateInitialConfiguredFeatureStates ### Function Meta |Key|volmgrx_8457.sys| | :---: | :---: | |name|wil_details_PopulateInitialConfiguredFeatureStates| |fullname|wil_details_PopulateInitialConfiguredFeatureStates| |refcount|2| |length|225| |called|NTOSKRNL.EXE::RtlQueryFeatureConfiguration
__security_check_cookie
wil_details_BuildFeatureStateCacheFromQueryResults
wil_details_FeatureDescriptors_SkipPadding| |calling|wil_InitializeFeatureStaging| |paramcount|0| |address|14006013c| |sig|undefined __fastcall wil_details_PopulateInitialConfiguredFeatureStates(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_PopulateInitialConfiguredFeatureStates +++ wil_details_PopulateInitialConfiguredFeatureStates @@ -0,0 +1,52 @@ + +/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ + +void wil_details_PopulateInitialConfiguredFeatureStates(void) + +{ + int iVar1; + longlong *plVar2; + undefined **ppuVar3; + undefined8 uVar4; + undefined1 auStack_58 [32]; + undefined8 local_38; + undefined8 local_30; + undefined8 local_28; + undefined4 local_20; + ulonglong local_18; + + local_18 = __security_cookie ^ (ulonglong)auStack_58; + ppuVar3 = &wil_details_featureDescriptors_a; + do { + plVar2 = wil_details_FeatureDescriptors_SkipPadding((longlong *)ppuVar3); + if (plVar2 == (longlong *)0x0) { + return; + } + local_30 = 0; + local_38 = 0; + local_28 = 0; + local_20 = 0; + if ((*(char *)((longlong)plVar2 + 0x1d) == '\0') && (*(char *)((longlong)plVar2 + 0x1e) == '\0') + ) { + iVar1 = RtlQueryFeatureConfiguration + ((int)plVar2[3],1 < (byte)(*(char *)((longlong)plVar2 + 0x1c) - 2U), + &local_30,&local_28); + if (iVar1 == -0x7fffffde) { + local_38 = 0x206; + uVar4 = local_38; + do { + *(undefined8 *)*plVar2 = uVar4; + plVar2 = wil_details_FeatureDescriptors_SkipPadding(plVar2 + 7); + } while (plVar2 != (longlong *)0x0); + return; + } + } + else { + iVar1 = -0x3ffffddb; + } + wil_details_BuildFeatureStateCacheFromQueryResults(iVar1,(longlong)&local_28,(uint *)&local_38); + ppuVar3 = (undefined **)(plVar2 + 7); + *(undefined8 *)*plVar2 = local_38; + } while( true ); +} + ``` ## NTOSKRNL.EXE::RtlRegisterFeatureConfigurationChangeNotification ### Function Meta |Key|volmgrx_8457.sys| | :---: | :---: | |name|RtlRegisterFeatureConfigurationChangeNotification| |fullname|NTOSKRNL.EXE::RtlRegisterFeatureConfigurationChangeNotification| |refcount|2| |length|0| |called|| |calling|wil_InitializeFeatureStaging| |paramcount|0| |address|EXTERNAL:00000008| |sig|undefined RtlRegisterFeatureConfigurationChangeNotification(void)| |sym_type|Function| |sym_source|IMPORTED| |external|True| *No code available for NTOSKRNL.EXE::RtlRegisterFeatureConfigurationChangeNotification* ## NTOSKRNL.EXE::RtlNotifyFeatureUsage ### Function Meta |Key|volmgrx_8457.sys| | :---: | :---: | |name|RtlNotifyFeatureUsage| |fullname|NTOSKRNL.EXE::RtlNotifyFeatureUsage| |refcount|2| |length|0| |called|| |calling|wil_details_FeatureReporting_ReportUsageToServiceDirect| |paramcount|0| |address|EXTERNAL:0000003b| |sig|undefined RtlNotifyFeatureUsage(void)| |sym_type|Function| |sym_source|IMPORTED| |external|True| *No code available for NTOSKRNL.EXE::RtlNotifyFeatureUsage* ## NTOSKRNL.EXE::RtlUnregisterFeatureUsageProvider ### Function Meta |Key|volmgrx_8457.sys| | :---: | :---: | |name|RtlUnregisterFeatureUsageProvider| |fullname|NTOSKRNL.EXE::RtlUnregisterFeatureUsageProvider| |refcount|2| |length|0| |called|| |calling|wil_UninitializeFeatureStaging| |paramcount|0| |address|EXTERNAL:0000001f| |sig|undefined RtlUnregisterFeatureUsageProvider(void)| |sym_type|Function| |sym_source|IMPORTED| |external|True| *No code available for NTOSKRNL.EXE::RtlUnregisterFeatureUsageProvider* ## NTOSKRNL.EXE::RtlArmFeatureUsageProviderFlushNotification ### Function Meta |Key|volmgrx_8457.sys| | :---: | :---: | |name|RtlArmFeatureUsageProviderFlushNotification| |fullname|NTOSKRNL.EXE::RtlArmFeatureUsageProviderFlushNotification| |refcount|2| |length|0| |called|| |calling|wil_details_RecordFeatureUsageReporting| |paramcount|0| |address|EXTERNAL:0000000f| |sig|undefined RtlArmFeatureUsageProviderFlushNotification(void)| |sym_type|Function| |sym_source|IMPORTED| |external|True| *No code available for NTOSKRNL.EXE::RtlArmFeatureUsageProviderFlushNotification* ## NTOSKRNL.EXE::RtlRecordFeatureUsage ### Function Meta |Key|volmgrx_8457.sys| | :---: | :---: | |name|RtlRecordFeatureUsage| |fullname|NTOSKRNL.EXE::RtlRecordFeatureUsage| |refcount|3| |length|0| |called|| |calling|wil_details_RecordFeatureUsageCallback
wil_details_RecordFeatureUsageReporting| |paramcount|0| |address|EXTERNAL:00000023| |sig|undefined RtlRecordFeatureUsage(void)| |sym_type|Function| |sym_source|IMPORTED| |external|True| *No code available for NTOSKRNL.EXE::RtlRecordFeatureUsage* ## NTOSKRNL.EXE::RtlQueryFeatureConfigurationChangeStamp ### Function Meta |Key|volmgrx_8457.sys| | :---: | :---: | |name|RtlQueryFeatureConfigurationChangeStamp| |fullname|NTOSKRNL.EXE::RtlQueryFeatureConfigurationChangeStamp| |refcount|2| |length|0| |called|| |calling|wil_InitializeFeatureStaging| |paramcount|0| |address|EXTERNAL:0000001b| |sig|undefined RtlQueryFeatureConfigurationChangeStamp(void)| |sym_type|Function| |sym_source|IMPORTED| |external|True| *No code available for NTOSKRNL.EXE::RtlQueryFeatureConfigurationChangeStamp* ## NTOSKRNL.EXE::RtlRegisterFeatureUsageProvider ### Function Meta |Key|volmgrx_8457.sys| | :---: | :---: | |name|RtlRegisterFeatureUsageProvider| |fullname|NTOSKRNL.EXE::RtlRegisterFeatureUsageProvider| |refcount|2| |length|0| |called|| |calling|wil_details_RegisterFeatureUsageProvider| |paramcount|0| |address|EXTERNAL:00000001| |sig|undefined RtlRegisterFeatureUsageProvider(void)| |sym_type|Function| |sym_source|IMPORTED| |external|True| *No code available for NTOSKRNL.EXE::RtlRegisterFeatureUsageProvider* ## NTOSKRNL.EXE::RtlUnregisterFeatureConfigurationChangeNotification ### Function Meta |Key|volmgrx_8457.sys| | :---: | :---: | |name|RtlUnregisterFeatureConfigurationChangeNotification| |fullname|NTOSKRNL.EXE::RtlUnregisterFeatureConfigurationChangeNotification| |refcount|2| |length|0| |called|| |calling|wil_UninitializeFeatureStaging| |paramcount|0| |address|EXTERNAL:00000020| |sig|undefined RtlUnregisterFeatureConfigurationChangeNotification(void)| |sym_type|Function| |sym_source|IMPORTED| |external|True| *No code available for NTOSKRNL.EXE::RtlUnregisterFeatureConfigurationChangeNotification* ## NTOSKRNL.EXE::RtlQueryFeatureConfiguration ### Function Meta |Key|volmgrx_8457.sys| | :---: | :---: | |name|RtlQueryFeatureConfiguration| |fullname|NTOSKRNL.EXE::RtlQueryFeatureConfiguration| |refcount|4| |length|0| |called|| |calling|wil_RtlStagingConfig_QueryFeatureState
wil_details_PopulateInitialConfiguredFeatureStates
wil_details_UpdateFeatureConfiguredStates| |paramcount|0| |address|EXTERNAL:0000000a| |sig|undefined RtlQueryFeatureConfiguration(void)| |sym_type|Function| |sym_source|IMPORTED| |external|True| *No code available for NTOSKRNL.EXE::RtlQueryFeatureConfiguration* # Modified *Modified functions contain code changes* ## VMX_PHYSICAL_DISK::ReadToc ### Match Info |Key|volmgrx_1150.sys - volmgrx_8457.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.6| |i_ratio|0.21| |m_ratio|0.99| |b_ratio|0.69| |match_types|SymbolsHash| ### Function Meta Diff |Key|volmgrx_1150.sys|volmgrx_8457.sys| | :---: | :---: | :---: | |name|ReadToc|ReadToc| |fullname|VMX_PHYSICAL_DISK::ReadToc|VMX_PHYSICAL_DISK::ReadToc| |refcount|2|2| |`length`|1927|1953| |`called`|
Expand for full list:
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::RtlCompareMemory
VMX_ALLOCATED_OBJECT::operator_delete
VMX_ALLOCATED_OBJECT::operator_new
VMX_BITMAP::CountResetBitsForward
VMX_BITMAP::SetBitsRange
VMX_BITMAP::SetCount
VMX_BITMAP::~VMX_BITMAP
VMX_CONFIG_COPY::ReadHeader
VMX_LOG_COPY::InitializeVMX_LOG_COPY::`scalar_deleting_destructor'
VMX_PHYSICAL_DISK::ReadSectors
VMX_PHYSICAL_DISK::WriteSectors
VMX_TOC::CheckCopies
VMX_TOC::InsertEntry
VMX_TOC::InsertEntryInCopy
VMX_TOC::`scalar_deleting_destructor'
VMX_TOC_ENTRY::Unformat
VmxpCheckSum
memcpy
memset
|
Expand for full list:
Feature_3984574778__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::RtlCompareMemory
VMX_ALLOCATED_OBJECT::operator_delete
VMX_ALLOCATED_OBJECT::operator_new
VMX_BITMAP::CountResetBitsForward
VMX_BITMAP::SetBitsRange
VMX_BITMAP::SetCount
VMX_BITMAP::~VMX_BITMAP
VMX_CONFIG_COPY::ReadHeaderVMX_LOG_COPY::Initialize
VMX_LOG_COPY::`scalar_deleting_destructor'
VMX_PHYSICAL_DISK::ReadSectors
VMX_PHYSICAL_DISK::WriteSectors
VMX_TOC::CheckCopies
VMX_TOC::InsertEntry
VMX_TOC::InsertEntryInCopy
VMX_TOC::`scalar_deleting_destructor'
VMX_TOC_ENTRY::Unformat
VmxpCheckSum
memmove
memset
| |calling|VMX_PHYSICAL_DISK::ReadMetadata|VMX_PHYSICAL_DISK::ReadMetadata| |paramcount|1|1| |`address`|1c0044cec|14004622c| |sig|void __thiscall ReadToc(VMX_PHYSICAL_DISK * this)|void __thiscall ReadToc(VMX_PHYSICAL_DISK * this)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### VMX_PHYSICAL_DISK::ReadToc Called Diff ```diff --- VMX_PHYSICAL_DISK::ReadToc called +++ VMX_PHYSICAL_DISK::ReadToc called @@ -0,0 +1 @@ +Feature_3984574778__private_IsEnabledDeviceUsageNoInline @@ -21 +22 @@ -memcpy +memmove ``` ### VMX_PHYSICAL_DISK::ReadToc Diff ```diff --- VMX_PHYSICAL_DISK::ReadToc +++ VMX_PHYSICAL_DISK::ReadToc @@ -1,274 +1,277 @@ /* private: void __cdecl VMX_PHYSICAL_DISK::ReadToc(void) __ptr64 */ void __thiscall VMX_PHYSICAL_DISK::ReadToc(VMX_PHYSICAL_DISK *this) { VMX_TOC *pVVar1; uint uVar2; VMX_COPY *pVVar3; uchar *puVar4; - longlong lVar5; - long lVar6; - uint uVar7; + long lVar5; + uint uVar6; + long lVar7; ulong uVar8; ulong uVar9; ulong uVar10; VMX_TOC *this_00; void *pvVar11; VMX_TOC_ENTRY *this_01; VMX_CONFIG_COPY *this_02; VMX_LOG_COPY *this_03; ulonglong uVar12; uchar *puVar13; uint uVar14; longlong lVar15; __uint64 _Var16; VMX_PHYSICAL_DISK *pVVar17; - ulonglong uVar18; - uint uVar19; - int iVar20; + uint uVar18; + int iVar19; + ulonglong uVar20; ulonglong uVar21; - int local_res10; + uchar *local_res18; uchar *local_res20; - uchar *local_88; - uchar *local_80; uchar *local_78; uchar *local_70; - ulonglong local_68; + uchar *local_68; VMX_LOG_COPY *local_60; undefined8 local_58; longlong lStack_50; - local_80 = (uchar *)0x0; + local_78 = (uchar *)0x0; local_60 = (VMX_LOG_COPY *)0x0; - local_88 = (uchar *)0x0; local_res20 = (uchar *)0x0; + local_res18 = (uchar *)0x0; this_02 = (VMX_CONFIG_COPY *)0x0; local_58 = 0; lStack_50 = 0; uVar2 = *(uint *)(*(longlong *)(this + 0x10) + 0x24); this_00 = VMX_ALLOCATED_OBJECT::operator_new(0x48,0x102,0x63546d56); if (this_00 == (VMX_TOC *)0x0) goto LAB_0; memset(this_00,0,0x48); pVVar1 = this_00 + 0x18; *(VMX_TOC **)(this_00 + 0x20) = pVVar1; *(VMX_TOC **)pVVar1 = pVVar1; pVVar1 = this_00 + 0x28; *(VMX_TOC **)(this_00 + 0x30) = pVVar1; *(VMX_TOC **)pVVar1 = pVVar1; pVVar1 = this_00 + 0x38; *(VMX_TOC **)(this_00 + 0x40) = pVVar1; *(VMX_TOC **)pVVar1 = pVVar1; uVar14 = *(ulong *)(*(longlong *)(this + 0x58) + 0xa0); - lVar6 = VMX_BITMAP::SetCount((VMX_BITMAP *)&local_58,uVar14); - lVar5 = lStack_50; - if (-1 < lVar6) { - uVar7 = 1 << ((byte)*(uint *)(*(longlong *)(this + 0x58) + 0x18) & 0x1f); + lVar5 = VMX_BITMAP::SetCount((VMX_BITMAP *)&local_58,uVar14); + if (-1 < lVar5) { + uVar6 = 1 << ((byte)*(uint *)(*(longlong *)(this + 0x58) + 0x18) & 0x1f); uVar12 = (ulonglong)(*(uint *)(*(longlong *)(this + 0x58) + 0x18) >> 5); uVar14 = *(uint *)(lStack_50 + uVar12 * 4); - if ((uVar7 & uVar14) == 0) { - *(uint *)(lStack_50 + uVar12 * 4) = uVar14 | uVar7; + if ((uVar6 & uVar14) == 0) { + *(uint *)(lStack_50 + uVar12 * 4) = uVar14 | uVar6; uVar14 = *(uint *)(*(longlong *)(this + 0x58) + 0x20); uVar12 = (ulonglong)uVar14; - uVar19 = 1 << ((byte)uVar14 & 0x1f); - uVar7 = *(uint *)(lStack_50 + (ulonglong)(uVar14 >> 5) * 4); - if ((uVar19 & uVar7) == 0) { - *(uint *)(lStack_50 + (ulonglong)(uVar14 >> 5) * 4) = uVar7 | uVar19; - uVar18 = *(ulonglong *)(*(longlong *)(this + 0x58) + 0xa8); - uVar21 = *(ulonglong *)(*(longlong *)(this + 0x58) + 0xb0); + uVar18 = 1 << ((byte)uVar14 & 0x1f); + uVar6 = *(uint *)(lStack_50 + (ulonglong)(uVar14 >> 5) * 4); + if ((uVar18 & uVar6) == 0) { + *(uint *)(lStack_50 + (ulonglong)(uVar14 >> 5) * 4) = uVar6 | uVar18; + uVar21 = *(ulonglong *)(*(longlong *)(this + 0x58) + 0xa8); + uVar20 = *(ulonglong *)(*(longlong *)(this + 0x58) + 0xb0); do { uVar14 = (uint)uVar12; - if ((uVar18 == 0) && (uVar21 == 0)) { - lVar6 = VMX_TOC::CheckCopies(this_00); - if (lVar6 < 0) break; + if ((uVar21 == 0) && (uVar20 == 0)) { + lVar5 = VMX_TOC::CheckCopies(this_00); + if (lVar5 < 0) break; pVVar1 = *(VMX_TOC **)(this_00 + 0x28); if ((pVVar1 != this_00 + 0x28) && ((*(byte *)(*(longlong *)(pVVar1 + 0x10) + 0x12) & 8) == 0)) { uVar14 = 0x102; this_02 = VMX_ALLOCATED_OBJECT::operator_new(0x28,0x102,0x63436d56); if (this_02 == (VMX_CONFIG_COPY *)0x0) break; *(undefined8 *)this_02 = 0; *(undefined8 *)(this_02 + 8) = 0; *(undefined8 *)(this_02 + 0x10) = 0; *(undefined8 *)(this_02 + 0x18) = 0; *(undefined8 *)(this_02 + 0x20) = 0; *(VMX_PHYSICAL_DISK **)this_02 = this; *(VMX_TOC **)(this_02 + 8) = pVVar1; VMX_CONFIG_COPY::ReadHeader(this_02); } pVVar3 = *(VMX_COPY **)(this_00 + 0x38); this_03 = local_60; if ((pVVar3 != (VMX_COPY *)(this_00 + 0x38)) && ((*(byte *)(*(longlong *)(pVVar3 + 0x10) + 0x12) & 8) == 0)) { uVar14 = 0x42; this_03 = VMX_ALLOCATED_OBJECT::operator_new(0x30,0x42,0x634c6d56); if (this_03 == (VMX_LOG_COPY *)0x0) break; *(undefined8 *)this_03 = 0; *(undefined8 *)(this_03 + 8) = 0; *(undefined8 *)(this_03 + 0x10) = 0; *(undefined8 *)(this_03 + 0x18) = 0; *(undefined8 *)(this_03 + 0x20) = 0; *(undefined8 *)(this_03 + 0x28) = 0; pVVar17 = this; - lVar6 = VMX_LOG_COPY::Initialize(this_03,this,pVVar3); + lVar5 = VMX_LOG_COPY::Initialize(this_03,this,pVVar3); uVar14 = (uint)pVVar17; - if (lVar6 < 0) { + if (lVar5 < 0) { VMX_LOG_COPY::_scalar_deleting_destructor_(this_03,uVar14); break; } } *(VMX_TOC **)(this + 0x60) = this_00; *(VMX_CONFIG_COPY **)(this + 0x68) = this_02; *(VMX_LOG_COPY **)(this + 0x70) = this_03; - if (lVar5 == 0) { - return; - } - ExFreePoolWithTag(lVar5,0); - return; - } - uVar12 = (uVar18 & 0xffffffff) >> 5; - uVar14 = 1 << ((byte)uVar18 & 0x1f); - uVar7 = *(uint *)(lVar5 + uVar12 * 4); - if ((uVar14 & uVar7) != 0) break; - *(uint *)(lVar5 + uVar12 * 4) = uVar7 | uVar14; + goto LAB_0; + } uVar12 = (uVar21 & 0xffffffff) >> 5; uVar14 = 1 << ((byte)uVar21 & 0x1f); - uVar7 = *(uint *)(lVar5 + uVar12 * 4); - if ((uVar14 & uVar7) != 0) break; - *(uint *)(lVar5 + uVar12 * 4) = uVar7 | uVar14; + uVar6 = *(uint *)(lStack_50 + uVar12 * 4); + if ((uVar14 & uVar6) != 0) break; + *(uint *)(lStack_50 + uVar12 * 4) = uVar6 | uVar14; + uVar12 = (uVar20 & 0xffffffff) >> 5; + uVar14 = 1 << ((byte)uVar20 & 0x1f); + uVar6 = *(uint *)(lStack_50 + uVar12 * 4); + if ((uVar14 & uVar6) != 0) break; + *(uint *)(lStack_50 + uVar12 * 4) = uVar6 | uVar14; lVar15 = (ulonglong)(*(int *)this_00 + 1) << 3; pvVar11 = (void *)ExAllocatePool2(0x102,lVar15,0x20206d56); uVar14 = (uint)lVar15; if (pvVar11 == (void *)0x0) break; if (*(void **)(this_00 + 8) != (void *)0x0) { - memcpy(pvVar11,*(void **)(this_00 + 8),(ulonglong)*(uint *)this_00 << 3); + memmove(pvVar11,*(void **)(this_00 + 8),(ulonglong)*(uint *)this_00 << 3); ExFreePoolWithTag(*(undefined8 *)(this_00 + 8),0); } *(void **)(this_00 + 8) = pvVar11; lVar15 = (ulonglong)(*(int *)this_00 + 1) << 3; pvVar11 = (void *)ExAllocatePool2(0x102,lVar15,0x20206d56); uVar14 = (uint)lVar15; if (pvVar11 == (void *)0x0) break; if (*(void **)(this_00 + 0x10) != (void *)0x0) { - memcpy(pvVar11,*(void **)(this_00 + 0x10),(ulonglong)*(uint *)this_00 << 3); + memmove(pvVar11,*(void **)(this_00 + 0x10),(ulonglong)*(uint *)this_00 << 3); ExFreePoolWithTag(*(undefined8 *)(this_00 + 0x10),0); } *(void **)(this_00 + 0x10) = pvVar11; - *(ulonglong *)(*(longlong *)(this_00 + 8) + (ulonglong)*(uint *)this_00 * 8) = uVar18; - *(ulonglong *)(*(longlong *)(this_00 + 0x10) + (ulonglong)*(uint *)this_00 * 8) = uVar21; + *(ulonglong *)(*(longlong *)(this_00 + 8) + (ulonglong)*(uint *)this_00 * 8) = uVar21; + *(ulonglong *)(*(longlong *)(this_00 + 0x10) + (ulonglong)*(uint *)this_00 * 8) = uVar20; *(int *)this_00 = *(int *)this_00 + 1; - _Var16 = *(longlong *)(*(longlong *)(this + 0x58) + 0x98) + uVar18; - local_res10 = ReadSectors(this,_Var16,1,&local_80); - puVar13 = local_80; + _Var16 = *(longlong *)(*(longlong *)(this + 0x58) + 0x98) + uVar21; + lVar5 = ReadSectors(this,_Var16,1,&local_78); + puVar13 = local_78; uVar14 = (uint)_Var16; - if (local_res10 < 0) { - if (local_res10 == -0x3fffff66) break; + if (lVar5 < 0) { + if (lVar5 == -0x3fffff66) break; } else { - lVar15 = RtlCompareMemory(local_80,&DAT_1,8); + lVar15 = RtlCompareMemory(local_78,&DAT_1,8); if (lVar15 == 8) { - iVar20 = CONCAT31(CONCAT21(CONCAT11(puVar13[8],puVar13[9]),puVar13[10]),puVar13[0xb]); - local_res20 = puVar13 + 0xc; + iVar19 = CONCAT31(CONCAT21(CONCAT11(puVar13[8],puVar13[9]),puVar13[10]),puVar13[0xb]); + local_res18 = puVar13 + 0xc; uVar8 = VmxpCheckSum(puVar13,8); uVar9 = VmxpCheckSum(puVar13 + 0xc,uVar2 - 0xc); - if ((uVar8 + uVar9) / 0xffffffff + uVar8 + uVar9 == iVar20) { - local_res20 = puVar13 + 0x14; + if ((uVar8 + uVar9) / 0xffffffff + uVar8 + uVar9 == iVar19) { + local_res18 = puVar13 + 0x14; goto LAB_2; } } - local_res10 = -0x3fffffff; + lVar5 = -0x3fffffff; } LAB_2: - _Var16 = *(longlong *)(*(longlong *)(this + 0x58) + 0x98) + uVar21; - lVar6 = ReadSectors(this,_Var16,1,&local_88); + _Var16 = *(longlong *)(*(longlong *)(this + 0x58) + 0x98) + uVar20; + lVar7 = ReadSectors(this,_Var16,1,&local_res20); + puVar4 = local_res20; uVar14 = (uint)_Var16; - if (local_res10 < 0) { + if (lVar5 < 0) { if (puVar13 != (uchar *)0x0) { uVar14 = 0; ExFreePoolWithTag(puVar13); } - puVar13 = local_88; - if (lVar6 < 0) break; - local_88 = (uchar *)0x0; - local_80 = puVar13; + puVar13 = local_res20; + if (lVar7 < 0) break; + local_res20 = (uchar *)0x0; + local_78 = puVar13; lVar15 = RtlCompareMemory(puVar13,&DAT_1,8); if (lVar15 != 8) goto LAB_3; uVar8 = VmxpCheckSum(puVar13,8); uVar9 = VmxpCheckSum(puVar13 + 0xc,uVar2 - 0xc); if ((uVar8 + uVar9) / 0xffffffff + uVar8 + uVar9 != CONCAT31(CONCAT21(CONCAT11(puVar13[8],puVar13[9]),puVar13[10]),puVar13[0xb])) goto LAB_3; - local_res20 = puVar13 + 0x14; - WriteSectors(this,*(longlong *)(*(longlong *)(this + 0x58) + 0x98) + uVar18,1,puVar13); + local_res18 = puVar13 + 0x14; + WriteSectors(this,*(longlong *)(*(longlong *)(this + 0x58) + 0x98) + uVar21,1,puVar13); } else { - if ((lVar6 < 0) || (uVar12 = RtlCompareMemory(puVar13,local_88,uVar2), uVar12 != uVar2)) - { - WriteSectors(this,*(longlong *)(*(longlong *)(this + 0x58) + 0x98) + uVar21,1,puVar13) + if ((lVar7 < 0) || + (uVar12 = RtlCompareMemory(puVar13,local_res20,uVar2), uVar12 != uVar2)) { + WriteSectors(this,*(longlong *)(*(longlong *)(this + 0x58) + 0x98) + uVar20,1,puVar13) ; } - if (local_88 != (uchar *)0x0) { - ExFreePoolWithTag(local_88,0); - local_88 = (uchar *)0x0; - } - } - local_68 = CONCAT71(CONCAT61(CONCAT51(CONCAT41(CONCAT31(CONCAT21(CONCAT11(*local_res20, - local_res20[1]), - local_res20[2]), - local_res20[3]),local_res20[4]), - local_res20[5]),local_res20[6]),local_res20[7]); - local_78 = local_res20 + 0x10; - uVar21 = CONCAT71(CONCAT61(CONCAT51(CONCAT41(CONCAT31(CONCAT21(CONCAT11(local_res20[8], - local_res20[9]), - local_res20[10]), - local_res20[0xb]),local_res20[0xc]), - local_res20[0xd]),local_res20[0xe]),local_res20[0xf]); - if (((*(ulonglong *)(*(longlong *)(this + 0x58) + 0xa0) <= local_68) || - (*(ulonglong *)(*(longlong *)(this + 0x58) + 0xa0) <= uVar21)) || - ((local_68 == uVar21 && (local_68 != 0)))) goto LAB_3; - local_70 = puVar13 + uVar2; - if (local_78 < local_70) { + if (puVar4 != (uchar *)0x0) { + ExFreePoolWithTag(puVar4); + local_res20 = (uchar *)0x0; + } + } + local_70 = local_res18 + 0x10; + uVar21 = CONCAT71(CONCAT61(CONCAT51(CONCAT41(CONCAT31(CONCAT21(CONCAT11(*local_res18, + local_res18[1]), + local_res18[2]), + local_res18[3]),local_res18[4]), + local_res18[5]),local_res18[6]),local_res18[7]); + uVar20 = CONCAT71(CONCAT61(CONCAT51(CONCAT41(CONCAT31(CONCAT21(CONCAT11(local_res18[8], + local_res18[9]), + local_res18[10]), + local_res18[0xb]),local_res18[0xc]), + local_res18[0xd]),local_res18[0xe]),local_res18[0xf]); + if (((*(ulonglong *)(*(longlong *)(this + 0x58) + 0xa0) <= uVar21) || + (*(ulonglong *)(*(longlong *)(this + 0x58) + 0xa0) <= uVar20)) || + ((uVar21 == uVar20 && (uVar21 != 0)))) goto LAB_3; + local_68 = puVar13 + uVar2; + if (local_70 < local_68) { do { - puVar4 = local_78; - if (*local_78 == '\0') break; + puVar4 = local_70; + if (*local_70 == '\0') break; this_01 = VMX_ALLOCATED_OBJECT::operator_new(0x40,0x102,0x65546d56); - if (this_01 == (VMX_TOC_ENTRY *)0x0) goto LAB_3; + uVar14 = 0; + if (this_01 == (VMX_TOC_ENTRY *)0x0) { + ExFreePoolWithTag(puVar13); + goto LAB_4; + } memset(this_01,0,0x40); - lVar6 = VMX_TOC_ENTRY::Unformat(this_01,&local_78,(int)local_70 - (int)puVar4); - if (lVar6 < 0) { -LAB_4: + lVar5 = VMX_TOC_ENTRY::Unformat(this_01,&local_70,(int)local_68 - (int)puVar4); + if ((lVar5 < 0) || + ((uVar12 = Feature_3984574778__private_IsEnabledDeviceUsageNoInline(), + (int)uVar12 != 0 && + (((0xffffffff < *(ulonglong *)(this_01 + 0x28) || + (0xffffffff < *(ulonglong *)(this_01 + 0x30))) || + (0xffffffff < *(ulonglong *)(this_01 + 0x30) + *(ulonglong *)(this_01 + 0x28))))) + )) { +LAB_5: uVar14 = 0; ExFreePoolWithTag(puVar13); VMX_ALLOCATED_OBJECT::operator_delete(this_01); - goto LAB_5; + goto LAB_4; } uVar8 = *(ulong *)(this_01 + 0x28); uVar9 = *(ulong *)(this_01 + 0x30); uVar10 = VMX_BITMAP::CountResetBitsForward((VMX_BITMAP *)&local_58,uVar8,uVar9); - if ((ulonglong)uVar10 < *(ulonglong *)(this_01 + 0x30)) goto LAB_4; + if ((ulonglong)uVar10 < *(ulonglong *)(this_01 + 0x30)) goto LAB_5; VMX_BITMAP::SetBitsRange((VMX_BITMAP *)&local_58,uVar8,uVar9); VMX_TOC::InsertEntry(this_00,this_01); - lVar6 = VMX_TOC::InsertEntryInCopy(this_00,this_01); - if (lVar6 < 0) goto LAB_3; - } while (local_78 < local_70); - } - uVar18 = local_68; - local_res20 = local_78; + lVar5 = VMX_TOC::InsertEntryInCopy(this_00,this_01); + if (lVar5 < 0) goto LAB_3; + } while (local_70 < local_68); + } + local_res18 = local_70; uVar12 = 0; ExFreePoolWithTag(puVar13); } while( true ); } } } - goto LAB_5; + goto LAB_4; LAB_3: uVar14 = 0; ExFreePoolWithTag(puVar13); -LAB_5: +LAB_4: VMX_TOC::_scalar_deleting_destructor_(this_00,uVar14); LAB_0: VMX_BITMAP::~VMX_BITMAP((VMX_BITMAP *)&local_58); return; } ``` ## DriverEntry ### Match Info |Key|volmgrx_1150.sys - volmgrx_8457.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.96| |i_ratio|0.63| |m_ratio|0.99| |b_ratio|0.94| |match_types|SymbolsHash| ### Function Meta Diff |Key|volmgrx_1150.sys|volmgrx_8457.sys| | :---: | :---: | :---: | |name|DriverEntry|DriverEntry| |fullname|DriverEntry|DriverEntry| |refcount|2|2| |`length`|2428|2473| |`called`|
Expand for full list:
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::IoGetDeviceObjectPointer
NTOSKRNL.EXE::MmGetSystemRoutineAddress
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::RtlGUIDFromString
NTOSKRNL.EXE::RtlInitUnicodeString
NTOSKRNL.EXE::ZwQueryLicenseValue
VMX_ALLOCATED_OBJECT::operator_new
VMX_GLOBAL_DATA::`scalar_deleting_destructor'
VmxpPauseOnlineInternalVmxpSendDeviceControl
VmxpSetSoftBoot
WppInitKm
WppLoadTracingSupport
_guard_dispatch_icall
memset
|
Expand for full list:
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::IoGetDeviceObjectPointer
NTOSKRNL.EXE::MmGetSystemRoutineAddress
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::RtlGUIDFromString
NTOSKRNL.EXE::RtlInitUnicodeString
NTOSKRNL.EXE::ZwQueryLicenseValue
VMX_ALLOCATED_OBJECT::operator_new
VMX_GLOBAL_DATA::`scalar_deleting_destructor'
VmxpPauseOnlineInternalVmxpSendDeviceControl
VmxpSetSoftBoot
WppInitKm
WppLoadTracingSupport
_guard_dispatch_icall
memset
wil_InitializeFeatureStaging
wil_UninitializeFeatureStaging
| |calling|entry|entry| |paramcount|1|1| |`address`|1c005e080|140060230| |sig|int __fastcall DriverEntry(longlong param_1)|int __fastcall DriverEntry(longlong param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### DriverEntry Called Diff ```diff --- DriverEntry called +++ DriverEntry called @@ -17,0 +18,2 @@ +wil_InitializeFeatureStaging +wil_UninitializeFeatureStaging ``` ### DriverEntry Diff ```diff --- DriverEntry +++ DriverEntry @@ -1,377 +1,382 @@ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ /* WARNING: Globals starting with '_' overlap smaller symbols at the same address */ int DriverEntry(longlong param_1) { undefined4 *puVar1; VMX_GLOBAL_DATA *pVVar2; int iVar3; VMX_GLOBAL_DATA *pVVar4; code *pcVar5; longlong lVar6; undefined4 *puVar7; undefined4 *puVar8; VMX_GLOBAL_DATA VVar9; uint uVar10; int local_res8 [2]; int local_res18 [2]; int local_res20 [2]; int local_258 [2]; undefined8 local_250; undefined8 uStack_248; undefined8 local_240; undefined8 uStack_238; undefined4 local_230 [2]; undefined8 local_228; undefined8 uStack_220; _DEVICE_OBJECT *local_218; undefined8 local_210; undefined8 local_208; undefined8 uStack_200; wchar_t *local_1f8; int *piStack_1f0; undefined8 local_1e8; int *piStack_1e0; undefined8 local_1d8; undefined8 uStack_1d0; undefined8 local_1c8; undefined8 uStack_1c0; undefined8 local_1b8; undefined8 uStack_1b0; undefined8 local_1a8; undefined8 uStack_1a0; undefined8 local_198; undefined8 uStack_190; code *local_188; code *local_180; code *local_178; code *local_170; code *local_168; code *local_160; code *local_158; code *local_150; code *local_148; code *local_140; code *local_138; code *local_130; code *local_128; code *local_120; code *local_118; code *local_110; code *local_108; code *local_100; code *local_f8; code *local_f0; code *local_e8; code *local_e0; code *local_d8; code *local_d0; code *local_c8; code *local_c0; code *local_b8; code *local_b0; code *local_a8; code *local_a0; code *local_98; undefined8 local_88; undefined8 uStack_80; wchar_t *local_78; undefined8 *puStack_70; undefined8 local_68; undefined8 uStack_60; undefined8 local_58; undefined8 uStack_50; undefined8 local_48; undefined8 uStack_40; undefined8 local_38; undefined8 uStack_30; undefined8 local_28; undefined8 uStack_20; + local_198 = 0; + uStack_190 = 0; + local_210 = 0; + local_218 = (_DEVICE_OBJECT *)0x0; *(undefined8 *)(param_1 + 0x68) = 0; + wil_InitializeFeatureStaging(); _WPP_MAIN_CB = 0; DAT_0 = &WPP_ThisDir_CTLGUID_VolMgr; DAT_1 = 0; _DAT_2 = 0; _DAT_3 = 1; - local_198 = 0; - uStack_190 = 0; - local_210 = 0; - local_218 = (_DEVICE_OBJECT *)0x0; WppLoadTracingSupport(); _DAT_2 = 0; WppInitKm(); pVVar4 = VMX_ALLOCATED_OBJECT::operator_new(0x138,0x42,0x20206d56); if (pVVar4 == (VMX_GLOBAL_DATA *)0x0) { Global = (VMX_GLOBAL_DATA *)0x0; +LAB_4: + wil_UninitializeFeatureStaging(); } else { memset(pVVar4,0,0xa8); local_res8[0] = 0; Global = pVVar4; *(undefined8 *)(pVVar4 + 0xb0) = 0; *(undefined8 *)(pVVar4 + 0xc0) = 0; *(undefined8 *)(pVVar4 + 0xd0) = 0; *(undefined8 *)(pVVar4 + 0xd8) = 0; local_res18[0] = 0; *(undefined8 *)(pVVar4 + 0xe0) = 0; *(undefined8 *)(pVVar4 + 0xe8) = 0; local_res20[0] = 0; *(undefined8 *)(pVVar4 + 0xf0) = 0; *(undefined8 *)(pVVar4 + 0xf8) = 0; *(undefined8 *)(pVVar4 + 0x100) = 0; *(undefined8 *)(pVVar4 + 0x108) = 0; *(undefined8 *)(pVVar4 + 0x110) = 0; *(undefined8 *)(pVVar4 + 0x118) = 0; *(undefined8 *)(pVVar4 + 0x120) = 0; *(undefined8 *)(pVVar4 + 0x128) = 0; *(undefined8 *)(pVVar4 + 0x130) = 0; pVVar2 = pVVar4 + 0xa8; *(VMX_GLOBAL_DATA **)(pVVar4 + 0xb0) = pVVar2; *(VMX_GLOBAL_DATA **)pVVar2 = pVVar2; pVVar2 = pVVar4 + 0xb8; *(VMX_GLOBAL_DATA **)(pVVar4 + 0xc0) = pVVar2; *(VMX_GLOBAL_DATA **)pVVar2 = pVVar2; pVVar2 = pVVar4 + 200; *(VMX_GLOBAL_DATA **)(pVVar4 + 0xd0) = pVVar2; *(VMX_GLOBAL_DATA **)pVVar2 = pVVar2; *(longlong *)pVVar4 = param_1; local_250 = 0; uStack_248 = 0; RtlInitUnicodeString(&local_250,L"volmgrx-SupportDynamic"); iVar3 = ZwQueryLicenseValue(&local_250,local_res18,local_res20,4,local_res8); if ((((-1 < iVar3) && (local_res8[0] == 4)) && (local_res18[0] == 4)) && (local_res20[0] == 1)) { Global[0x111] = (VMX_GLOBAL_DATA)0x1; } if (Global[0x111] != (VMX_GLOBAL_DATA)0x0) { RtlInitUnicodeString(&local_250,L"volmgrx-SupportMirror"); iVar3 = ZwQueryLicenseValue(&local_250,local_res18,local_res20,4,local_res8); if (((-1 < iVar3) && (local_res8[0] == 4)) && ((local_res18[0] == 4 && (local_res20[0] == 1))) ) { Global[0x112] = (VMX_GLOBAL_DATA)0x1; } RtlInitUnicodeString(&local_250,L"volmgrx-SupportRaid5"); iVar3 = ZwQueryLicenseValue(&local_250,local_res18,local_res20,4,local_res8); if (((-1 < iVar3) && (local_res8[0] == 4)) && ((local_res18[0] == 4 && (local_res20[0] == 1))) ) { Global[0x113] = (VMX_GLOBAL_DATA)0x1; } } local_230[0] = 0; local_258[0] = 0; Global[0x114] = (VMX_GLOBAL_DATA)0x0; local_1f8 = L"TestMode"; piStack_1f0 = local_258; piStack_1e0 = local_230; local_208 = 0; uStack_1d0 = 0; uStack_200 = 0x120; local_1c8 = 0; uStack_1c0 = 0; local_1e8 = 0x4000000; local_1b8 = 0; uStack_1b0 = 0; local_1d8 = 4; local_1a8 = 0; uStack_1a0 = 0; local_228 = 0; uStack_220 = 0; RtlInitUnicodeString(&local_228,L"RtlQueryRegistryValuesEx"); pcVar5 = (code *)MmGetSystemRoutineAddress(&local_228); if (pcVar5 == (code *)0x0) { pcVar5 = RtlQueryRegistryValues_exref; } iVar3 = (*pcVar5)(0,L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\VolMgrX", &local_208,0,0); if (-1 < iVar3) { Global[0x114] = (VMX_GLOBAL_DATA)(local_258[0] != 0); } pVVar4 = Global; local_250 = 0; uStack_248 = 0; *(undefined8 *)(Global + 0xd8) = 0; *(undefined8 *)(pVVar4 + 0xe0) = 0; local_78 = L"PrimaryPackId"; puStack_70 = &local_250; local_88 = 0; uStack_60 = 0; uStack_80 = 0x124; local_58 = 0; uStack_50 = 0; local_68 = 0x1000000; local_48 = 0; uStack_40 = 0; local_38 = 0; uStack_30 = 0; local_28 = 0; uStack_20 = 0; local_240 = 0; uStack_238 = 0; RtlInitUnicodeString(&local_240,L"RtlQueryRegistryValuesEx"); pcVar5 = (code *)MmGetSystemRoutineAddress(&local_240); if (pcVar5 == (code *)0x0) { pcVar5 = RtlQueryRegistryValues_exref; } iVar3 = (*pcVar5)(0,L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\VolMgrX", &local_88,0,0); if (-1 < iVar3) { RtlGUIDFromString(&local_250,Global + 0xd8); ExFreePoolWithTag(uStack_248,0); } pVVar4 = Global; local_228 = 0; uStack_220 = 0; *(undefined8 *)(Global + 0xe8) = 0; *(undefined8 *)(pVVar4 + 0xf0) = 0; local_1f8 = L"PendingPrimaryPackId"; piStack_1f0 = (int *)&local_228; local_208 = 0; piStack_1e0 = (int *)0x0; uStack_200 = 0x124; local_1d8 = 0; uStack_1d0 = 0; local_1e8 = 0x1000000; local_1c8 = 0; uStack_1c0 = 0; local_1b8 = 0; uStack_1b0 = 0; local_1a8 = 0; uStack_1a0 = 0; local_240 = 0; uStack_238 = 0; RtlInitUnicodeString(&local_240,L"RtlQueryRegistryValuesEx"); pcVar5 = (code *)MmGetSystemRoutineAddress(); if (pcVar5 == (code *)0x0) { pcVar5 = RtlQueryRegistryValues_exref; } iVar3 = (*pcVar5)(0,L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\VolMgrX", &local_208,0,0); if (-1 < iVar3) { RtlGUIDFromString(&local_228,Global + 0xe8); ExFreePoolWithTag(uStack_220,0); } VVar9 = (VMX_GLOBAL_DATA)0x0; VmxpPauseOnlineInternal(0); local_res8[0] = 0; local_res18[0] = 0; Global[0x116] = VVar9; local_1f8 = L"OnlineSplitBrainVolumes"; piStack_1f0 = local_res8; local_1e8 = 0x4000000; piStack_1e0 = local_res18; local_208 = 0; uStack_1d0 = 0; uStack_200 = 0x120; local_1c8 = 0; uStack_1c0 = 0; local_1d8 = 4; local_1b8 = 0; uStack_1b0 = 0; local_1a8 = 0; uStack_1a0 = 0; local_240 = 0; uStack_238 = 0; RtlInitUnicodeString(&local_240,L"RtlQueryRegistryValuesEx"); pcVar5 = (code *)MmGetSystemRoutineAddress(&local_240); if (pcVar5 == (code *)0x0) { pcVar5 = RtlQueryRegistryValues_exref; } iVar3 = (*pcVar5)(0,L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\VolMgrX", &local_208,0,0); if (-1 < iVar3) { Global[0x116] = (VMX_GLOBAL_DATA)(local_res8[0] != 0); } uVar10 = 0x8000; lVar6 = ExAllocatePool2(0x42,0x8000,0x75426d56); - pVVar4 = Global; *(longlong *)(Global + 0x100) = lVar6; if (lVar6 != 0) { uVar10 = 0x102; puVar7 = VMX_ALLOCATED_OBJECT::operator_new(0x38,0x102,0x20206d56); - pVVar4 = Global; - if (puVar7 == (undefined4 *)0x0) { - *(undefined8 *)(Global + 0x120) = 0; - } - else { + if (puVar7 != (undefined4 *)0x0) { puVar7[1] = 0; puVar1 = puVar7 + 6; *(undefined8 *)(puVar7 + 4) = 0; *(undefined8 *)(puVar7 + 8) = 0; *(undefined8 *)(puVar7 + 0xc) = 0; *(undefined4 **)(puVar7 + 8) = puVar1; *(undefined4 **)puVar1 = puVar1; puVar1 = puVar7 + 10; puVar8 = puVar7 + 2; *(undefined4 **)(puVar7 + 0xc) = puVar1; *(undefined4 **)puVar1 = puVar1; uVar10 = 0x4000; *puVar7 = 1; *(undefined4 **)(puVar7 + 4) = puVar8; *(undefined4 **)puVar8 = puVar8; *(undefined4 **)(Global + 0x120) = puVar7; lVar6 = ExAllocatePool2(0x102,0x4000,0x62526d56); pVVar4 = Global; *(longlong *)(Global + 0x108) = lVar6; if (lVar6 != 0) { local_188 = VmxWholeDiskArrivedImmediate; local_180 = VmxWholeDiskArrivedDelayed; local_178 = VmxPartitionArrivedImmediate; local_170 = VmxPartitionArrivedDelayed; local_168 = VmxPartitionRemovedImmediate; local_160 = VmxPartitionRemovedDelayed; local_158 = VmxWholeDiskRemovedImmediate; local_150 = VmxWholeDiskRemovedDelayed; local_148 = VmxBootDriverReinitialization; local_140 = VmxDriverReinitialization; local_138 = VmxShutdown; local_130 = VmxSetPowerState; local_128 = VmxVolMgrDeviceControl; local_120 = VmxVolumeDeviceControl; local_118 = VmxReadWrite; local_110 = VmxQueryVolumeId; local_108 = VmxQueryStackSize; local_100 = VmxQueryAlignmentRequirement; local_f8 = VmxQuerySystemBootFlags; local_f0 = VmxQueryGptAttributes; local_e8 = VmxQueryPowerRelations; local_e0 = VmxQueryNumaNode; local_d8 = VmxSetGptAttributes; local_d0 = VmxCreateLegacyNameLinks; local_c8 = VmxDeleteLegacyNameLinks; local_c0 = VmxResidingOnDisk; local_b8 = VmxDependsOnPartition; local_b0 = VmxBroadcastIrp; local_a8 = VmxShutdownVolume; local_a0 = VmxCommitDeviceCallback; local_98 = VmxSetSplitIoNotifyRoutines; RtlInitUnicodeString(&local_198,L"\\Device\\VolMgrControl"); uVar10 = 0x80; iVar3 = IoGetDeviceObjectPointer(&local_198,0x80,&local_210,&local_218); if (-1 < iVar3) { uVar10 = 0x760640; iVar3 = VmxpSendDeviceControl(local_218,0x760640,&local_188,0xf8,Global + 8,0xa0,'\x01') ; ObfDereferenceObject(local_210); if (-1 < iVar3) { VmxpSetSoftBoot(); return 0; } } + wil_UninitializeFeatureStaging(); if (Global == (VMX_GLOBAL_DATA *)0x0) { return iVar3; } VMX_GLOBAL_DATA::_scalar_deleting_destructor_(Global,uVar10); return iVar3; } + if (pVVar4 != (VMX_GLOBAL_DATA *)0x0) { + VMX_GLOBAL_DATA::_scalar_deleting_destructor_(pVVar4,uVar10); + } + goto LAB_4; } - } - if (pVVar4 != (VMX_GLOBAL_DATA *)0x0) { - VMX_GLOBAL_DATA::_scalar_deleting_destructor_(pVVar4,uVar10); + *(undefined8 *)(Global + 0x120) = 0; + } + wil_UninitializeFeatureStaging(); + if (Global != (VMX_GLOBAL_DATA *)0x0) { + VMX_GLOBAL_DATA::_scalar_deleting_destructor_(Global,uVar10); } } return -0x3fffff66; } ``` ## VMX_DISK_HEADER::Unformat ### Match Info |Key|volmgrx_1150.sys - volmgrx_8457.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.31| |i_ratio|0.4| |m_ratio|0.92| |b_ratio|0.91| |match_types|SymbolsHash| ### Function Meta Diff |Key|volmgrx_1150.sys|volmgrx_8457.sys| | :---: | :---: | :---: | |name|Unformat|Unformat| |fullname|VMX_DISK_HEADER::Unformat|VMX_DISK_HEADER::Unformat| |refcount|4|4| |`length`|484|568| |`called`|NTOSKRNL.EXE::RtlCompareMemory
VmxpCheckSum
VmxpSupportedBytesPerSector
VmxpUnformatTable|Feature_3984574778__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::RtlCompareMemory
VmxpCheckSum
VmxpSupportedBytesPerSector
VmxpUnformatTable| |calling|VMX_PHYSICAL_DISK::ReadHeader|VMX_PHYSICAL_DISK::ReadHeader| |paramcount|3|3| |`address`|1c004547c|1400469d4| |sig|long __thiscall Unformat(VMX_DISK_HEADER * this, uchar * * param_1, ulong param_2)|long __thiscall Unformat(VMX_DISK_HEADER * this, uchar * * param_1, ulong param_2)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### VMX_DISK_HEADER::Unformat Called Diff ```diff --- VMX_DISK_HEADER::Unformat called +++ VMX_DISK_HEADER::Unformat called @@ -0,0 +1 @@ +Feature_3984574778__private_IsEnabledDeviceUsageNoInline ``` ### VMX_DISK_HEADER::Unformat Diff ```diff --- VMX_DISK_HEADER::Unformat +++ VMX_DISK_HEADER::Unformat @@ -1,50 +1,58 @@ /* public: long __cdecl VMX_DISK_HEADER::Unformat(unsigned char * __ptr64 * __ptr64,unsigned long) __ptr64 */ long __thiscall VMX_DISK_HEADER::Unformat(VMX_DISK_HEADER *this,uchar **param_1,ulong param_2) { - ulonglong uVar1; - uchar uVar2; + uchar uVar1; + ulong uVar2; ulong uVar3; - ulong uVar4; - longlong lVar5; - uchar *puVar6; + longlong lVar4; + uchar *puVar5; + ulonglong uVar6; int iVar7; uchar *puVar8; int iVar9; iVar7 = (int)*param_1 + 0x200; - lVar5 = RtlCompareMemory(*param_1,"PRIVHEAD",8); - if (lVar5 == 8) { + lVar4 = RtlCompareMemory(*param_1,"PRIVHEAD",8); + if (lVar4 == 8) { puVar8 = *param_1; - puVar6 = puVar8 + 0xc; + puVar5 = puVar8 + 0xc; iVar9 = CONCAT31(CONCAT21(CONCAT11(puVar8[8],puVar8[9]),puVar8[10]),puVar8[0xb]); - uVar3 = VmxpCheckSum(puVar8 + 0xc,500); - uVar4 = VmxpCheckSum(puVar8,8); - if ((((((uVar3 + uVar4) / 0xffffffff + uVar3 + uVar4 == iVar9) && - (puVar6 = VmxpUnformatTable((VMX_FIELD *)&DAT_0,2,this,puVar6,iVar7 - (int)puVar6) - , puVar6 != (uchar *)0x0)) && (*(short *)this == 2)) && - ((puVar6 = VmxpUnformatTable((VMX_FIELD *)&DAT_1,0x16,this,puVar6, - iVar7 - (int)puVar6), puVar6 != (uchar *)0x0 && - ((*(ushort *)(this + 2) < 10 || - (puVar6 = VmxpUnformatTable((VMX_FIELD *)&DAT_2,1,this,puVar6,iVar7 - (int)puVar6) - , puVar6 != (uchar *)0x0)))))) && - (((*(ushort *)(this + 2) < 0xb || - (puVar6 = VmxpUnformatTable((VMX_FIELD *)&DAT_3,2,this,puVar6,iVar7 - (int)puVar6), - puVar6 != (uchar *)0x0)) && - ((((*(ushort *)(this + 2) < 0xc || - (puVar6 = VmxpUnformatTable((VMX_FIELD *)&DAT_4,3,this,puVar6,iVar7 - (int)puVar6 - ), puVar6 != (uchar *)0x0)) && - ((uVar2 = VmxpSupportedBytesPerSector(*(ulong *)(this + 0x78)), uVar2 != '\0' && - (((uVar1 = *(ulonglong *)(this + 0xa0), *(ulonglong *)(this + 0x18) < uVar1 && - (*(ulonglong *)(this + 0x20) < uVar1)) && (*(ulonglong *)(this + 0xa8) < uVar1)))))) && - (*(ulonglong *)(this + 0xb0) < uVar1)))))) { - *param_1 = puVar6; + uVar2 = VmxpCheckSum(puVar8 + 0xc,500); + uVar3 = VmxpCheckSum(puVar8,8); + if (((((((((uVar2 + uVar3) / 0xffffffff + uVar2 + uVar3 == iVar9) && + (puVar5 = VmxpUnformatTable((VMX_FIELD *)&DAT_0,2,this,puVar5, + iVar7 - (int)puVar5), puVar5 != (uchar *)0x0)) && + (*(short *)this == 2)) && + (puVar5 = VmxpUnformatTable((VMX_FIELD *)&DAT_1,0x16,this,puVar5, + iVar7 - (int)puVar5), puVar5 != (uchar *)0x0)) && + (((*(ushort *)(this + 2) < 10 || + (puVar5 = VmxpUnformatTable((VMX_FIELD *)&DAT_2,1,this,puVar5, + iVar7 - (int)puVar5), puVar5 != (uchar *)0x0)) && + ((*(ushort *)(this + 2) < 0xb || + (puVar5 = VmxpUnformatTable((VMX_FIELD *)&DAT_3,2,this,puVar5, + iVar7 - (int)puVar5), puVar5 != (uchar *)0x0)))))) && + ((*(ushort *)(this + 2) < 0xc || + (puVar5 = VmxpUnformatTable((VMX_FIELD *)&DAT_4,3,this,puVar5,iVar7 - (int)puVar5) + , puVar5 != (uchar *)0x0)))) && + (((uVar1 = VmxpSupportedBytesPerSector(*(ulong *)(this + 0x78)), uVar1 != '\0' && + (((uVar6 = *(ulonglong *)(this + 0xa0), *(ulonglong *)(this + 0x18) < uVar6 && + (*(ulonglong *)(this + 0x20) < uVar6)) && (*(ulonglong *)(this + 0xa8) < uVar6)))) && + (*(ulonglong *)(this + 0xb0) < uVar6)))) && + ((uVar6 = Feature_3984574778__private_IsEnabledDeviceUsageNoInline(), (int)uVar6 == 0 || + ((((*(ulonglong *)(this + 0xa0) < 0x100000000 && (*(ulonglong *)(this + 0x18) < 0x100000000) + ) && ((*(ulonglong *)(this + 0x20) < 0x100000000 && + ((*(ulonglong *)(this + 0xa8) < 0x100000000 && + (*(ulonglong *)(this + 0xb0) < 0x100000000)))))) && + ((*(ulonglong *)(this + 0xc0) < 0x100000000 && (*(ulonglong *)(this + 200) < 0x100000000))) + ))))) { + *param_1 = puVar5; return 0; } } return -0x3ffffff3; } ``` # Modified (No Code Changes) *Slightly modified functions have no code changes, rather differnces in:* - refcount - length - called - calling - name - fullname ## __GSHandlerCheck ### Match Info |Key|volmgrx_1150.sys - volmgrx_8457.sys| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|0.88| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|volmgrx_1150.sys|volmgrx_8457.sys| | :---: | :---: | :---: | |name|__GSHandlerCheck|__GSHandlerCheck| |fullname|__GSHandlerCheck|__GSHandlerCheck| |`refcount`|66|71| |length|29|29| |called|__GSHandlerCheckCommon|__GSHandlerCheckCommon| |calling||| |paramcount|4|4| |`address`|1c0001438|140001f98| |sig|undefined8 __fastcall __GSHandlerCheck(undefined8 param_1, undefined8 param_2, undefined8 param_3, longlong param_4)|undefined8 __fastcall __GSHandlerCheck(undefined8 param_1, undefined8 param_2, undefined8 param_3, longlong param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## `scalar_deleting_destructor' ### Match Info |Key|volmgrx_1150.sys - volmgrx_8457.sys| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|0.79| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|volmgrx_1150.sys|volmgrx_8457.sys| | :---: | :---: | :---: | |name|`scalar_deleting_destructor'|`scalar_deleting_destructor'| |fullname|VMX_GLOBAL_DATA::`scalar_deleting_destructor'|VMX_GLOBAL_DATA::`scalar_deleting_destructor'| |`refcount`|3|4| |length|45|45| |called|NTOSKRNL.EXE::ExFreePoolWithTag
VMX_GLOBAL_DATA::~VMX_GLOBAL_DATA|NTOSKRNL.EXE::ExFreePoolWithTag
VMX_GLOBAL_DATA::~VMX_GLOBAL_DATA| |calling|DriverEntry|DriverEntry| |paramcount|2|2| |`address`|1c0001fc0|140002b00| |sig|void * __thiscall `scalar_deleting_destructor'(VMX_GLOBAL_DATA * this, uint param_1)|void * __thiscall `scalar_deleting_destructor'(VMX_GLOBAL_DATA * this, uint param_1)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ## __security_check_cookie ### Match Info |Key|volmgrx_1150.sys - volmgrx_8457.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.5| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|volmgrx_1150.sys|volmgrx_8457.sys| | :---: | :---: | :---: | |name|__security_check_cookie|__security_check_cookie| |fullname|__security_check_cookie|__security_check_cookie| |`refcount`|74|79| |length|30|30| |called|__report_gsfailure|__report_gsfailure| |`calling`|
Expand for full list:
VMX_CONFIG::NextDiskName
VMX_CONFIG::NextPlexName
VMX_CONFIG::NextVolumeName
VMX_CONFIG::SanityCheck
VMX_CONFIG_COPY::ReadHeader
VMX_CONFIG_COPY::ReadPackIdentity
VMX_DISK_DEVICE::Read
VMX_DISK_DEVICE::Write
VMX_IO_DISK_EXTENT::AllocateBCStream
VMX_IO_DISK_EXTENT::CreateLegacyNameLinks
VMX_IO_DISK_EXTENT::DeleteLegacyNameLinksVMX_IO_DISK_EXTENT::GetBCProperties
VMX_IO_MIRROR::AllocateBCStream
VMX_IO_MIRROR::GetBCProperties
VMX_IO_SPAN::AllocateBCStream
VMX_IO_SPAN::GetBCProperties
VMX_IO_STRIPE::AllocateBCStream
VMX_IO_STRIPE::GetBCProperties
VMX_LOG::AddEntryDetach
VMX_LOG::AddEntryDirty
VMX_LOG::FindEntryOrEmptySlot
VMX_LOG::MergeBlocks
VMX_LOG::ReadBlocks
VMX_LOG::RemoveEntryDetach
VMX_LOG::RemoveEntryDirty
VMX_LOG::SetBlocksCount
VMX_LOG::TouchBlock
VMX_PACK::AttemptGrowDisk
VMX_PACK::MergeDisksInPackTargetTransaction
VMX_PACK::NewPack
VMX_PACK::OfflineVolume
VMX_PACK::PreCommitDevices
VMX_PACK::ReplayLogTransaction
VMX_PACK::ShrinkDisk
VMX_PACK::UpdatePartitions
VMX_PHYSICAL_DISK::ChangeIdentityPhase1
VMX_PHYSICAL_DISK::ChangeIdentityPhase2
VMX_PHYSICAL_DISK::ChangeIdentityRevertPhase1
VMX_PHYSICAL_DISK::NewMetadata
VMX_PHYSICAL_DISK::ReadMetadata
VMX_PHYSICAL_DISK::ReadSectorsKsr
VMX_RAW_CONFIG::FormatHeader
VMX_RAW_CONFIG::UnformatHeader
VMX_TOC_ENTRY::Unformat
VMX_VOLUME_INFO::SetGptAttributes
VmxPartitionArrivedImmediate
VmxPartitionRemovedImmediate
VmxSetGptAttributes
VmxWholeDiskArrivedImmediate
VmxpCleanDisk
VmxpCompleteKsr
VmxpCreateDisk
VmxpCreateDiskInNewPack
VmxpCreateDiskInPack
VmxpDeletePresentDiskAndRemovePack
VmxpDeletePresentDiskFromPack
VmxpDiskGetGptAttributes
VmxpFillVolumeInfoOutputBuffer
VmxpFormatTable
VmxpGetBufferLengthForTable
VmxpGetDeviceParameter
VmxpGetDriveGeometry
VmxpGetNotifications
VmxpGetVolumeInfoOutputSize
VmxpLogTransactionNotifications
VmxpMergeClonesInNewPack
VmxpOnlineDiskDevice
VmxpQueryDriveLetter
VmxpQuerySuggestedLinkName
VmxpSetSoftBoot
VmxpStorageGetDeviceDescriptor
VmxpUnformatTable
__GSHandlerCheckCommon
|
Expand for full list:
VMX_CONFIG::NextDiskName
VMX_CONFIG::NextPlexName
VMX_CONFIG::NextVolumeName
VMX_CONFIG::SanityCheck
VMX_CONFIG_COPY::ReadHeader
VMX_CONFIG_COPY::ReadPackIdentity
VMX_DISK_DEVICE::Read
VMX_DISK_DEVICE::Write
VMX_IO_DISK_EXTENT::AllocateBCStream
VMX_IO_DISK_EXTENT::CreateLegacyNameLinks
VMX_IO_DISK_EXTENT::DeleteLegacyNameLinksVMX_IO_DISK_EXTENT::GetBCProperties
VMX_IO_MIRROR::AllocateBCStream
VMX_IO_MIRROR::GetBCProperties
VMX_IO_SPAN::AllocateBCStream
VMX_IO_SPAN::GetBCProperties
VMX_IO_STRIPE::AllocateBCStream
VMX_IO_STRIPE::GetBCProperties
VMX_LOG::AddEntryDetach
VMX_LOG::AddEntryDirty
VMX_LOG::FindEntryOrEmptySlot
VMX_LOG::MergeBlocks
VMX_LOG::ReadBlocks
VMX_LOG::RemoveEntryDetach
VMX_LOG::RemoveEntryDirty
VMX_LOG::SetBlocksCount
VMX_LOG::TouchBlock
VMX_PACK::AttemptGrowDisk
VMX_PACK::MergeDisksInPackTargetTransaction
VMX_PACK::NewPack
VMX_PACK::OfflineVolume
VMX_PACK::PreCommitDevices
VMX_PACK::ReplayLogTransaction
VMX_PACK::ShrinkDisk
VMX_PACK::UpdatePartitions
VMX_PHYSICAL_DISK::ChangeIdentityPhase1
VMX_PHYSICAL_DISK::ChangeIdentityPhase2
VMX_PHYSICAL_DISK::ChangeIdentityRevertPhase1
VMX_PHYSICAL_DISK::NewMetadata
VMX_PHYSICAL_DISK::ReadMetadata
VMX_PHYSICAL_DISK::ReadSectorsKsr
VMX_RAW_CONFIG::FormatHeader
VMX_RAW_CONFIG::UnformatHeader
VMX_TOC_ENTRY::Unformat
VMX_VOLUME_INFO::SetGptAttributes
VmxPartitionArrivedImmediate
VmxPartitionRemovedImmediate
VmxSetGptAttributes
VmxWholeDiskArrivedImmediate
VmxpCleanDisk
VmxpCompleteKsr
VmxpCreateDisk
VmxpCreateDiskInNewPack
VmxpCreateDiskInPack
VmxpDeletePresentDiskAndRemovePack
VmxpDeletePresentDiskFromPack
VmxpDiskGetGptAttributes
VmxpFillVolumeInfoOutputBuffer
VmxpFormatTable
VmxpGetBufferLengthForTable
VmxpGetDeviceParameter
VmxpGetDriveGeometry
VmxpGetNotifications
VmxpGetVolumeInfoOutputSize
VmxpLogTransactionNotifications
VmxpMergeClonesInNewPack
VmxpOnlineDiskDevice
VmxpQueryDriveLetter
VmxpQuerySuggestedLinkName
VmxpSetSoftBoot
VmxpStorageGetDeviceDescriptor
VmxpUnformatTable
__GSHandlerCheckCommon
wil_RtlStagingConfig_QueryFeatureState
wil_details_FeatureReporting_ReportUsageToServiceDirect
wil_details_PopulateInitialConfiguredFeatureStates
wil_details_RecordCachedUsage
wil_details_UpdateFeatureConfiguredStates
| |paramcount|1|1| |`address`|1c00015b0|140002110| |sig|void __cdecl __security_check_cookie(uintptr_t _StackCookie)|void __cdecl __security_check_cookie(uintptr_t _StackCookie)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### __security_check_cookie Calling Diff ```diff --- __security_check_cookie calling +++ __security_check_cookie calling @@ -73,0 +74,5 @@ +wil_RtlStagingConfig_QueryFeatureState +wil_details_FeatureReporting_ReportUsageToServiceDirect +wil_details_PopulateInitialConfiguredFeatureStates +wil_details_RecordCachedUsage +wil_details_UpdateFeatureConfiguredStates ``` Generated with `ghidriff` version: 1.0.0 on 2026-08-16T20:32:41