@ -2004,7 +2004,6 @@ BOOL FixStartMenuAnimation(LPMODULEINFO mi)
@@ -2004,7 +2004,6 @@ BOOL FixStartMenuAnimation(LPMODULEINFO mi)
// ### Offset of bTransitioningToCortana
# if defined(_M_X64)
// `(CStartExperienceManager *)((char *)this - 40)` after field access
// ```
// 80 B9 ?? ?? ?? ?? 00 75 ?? 48 83 C1 D8
// ^^^^^^^^^^^ bTransitioningToCortana
@ -2020,25 +2019,6 @@ BOOL FixStartMenuAnimation(LPMODULEINFO mi)
@@ -2020,25 +2019,6 @@ BOOL FixStartMenuAnimation(LPMODULEINFO mi)
{
g_SMAnimationPatchOffsets . startExperienceManager_bTransitioningToCortana = g_SMAnimationPatchOffsets . startExperienceManager_IStartExperienceManager + * ( int * ) ( matchTransitioningToCortanaField + 2 ) ;
}
else
{
// `(CStartExperienceManager *)((char *)this - 40)` before field access
// ```
// 48 83 C1 ?? 80 B9 ?? ?? ?? ?? 00 75 ?? 41 B0 01
// ^^^^^^^^^^^ bTransitioningToCortana
// ```
// Ref: CStartExperienceManager::DimStart()
matchTransitioningToCortanaField = ( PBYTE ) FindPattern (
mi - > lpBaseOfDll ,
mi - > SizeOfImage ,
" \x48 \x83 \xC1 \x00 \x80 \xB9 \x00 \x00 \x00 \x00 \x00 \x75 \x00 \x41 \xB0 \x01 " ,
" xxx?xx????xx?xxx "
) ;
if ( matchTransitioningToCortanaField )
{
g_SMAnimationPatchOffsets . startExperienceManager_bTransitioningToCortana = * ( int * ) ( matchTransitioningToCortanaField + 6 ) ;
}
}
# elif defined(_M_ARM64)
// ```
// ?? ?? ?? 39 E8 00 00 35 ?? ?? ?? ?? 01 ?? ?? 91 22 00 80 52
@ -2088,44 +2068,24 @@ BOOL FixStartMenuAnimation(LPMODULEINFO mi)
@@ -2088,44 +2068,24 @@ BOOL FixStartMenuAnimation(LPMODULEINFO mi)
matchGetMonitorInformation + = 5 + * ( int * ) ( matchGetMonitorInformation + 1 ) ;
}
# elif defined(_M_ARM64)
// * Pattern for 226xx, CSingleViewShellExperience* first arg *not* passed (E1 03 14 AA)
// * Pattern for 226xx
// ```
// A9 E4 ?? ?? ?? E3 ?? ?? 91 E2 ?? ?? 91 E0 03 13 AA ?? ?? ?? ?? ?? 03 00 2A
// ^^^^^^^^^^^
// E3 ?? 00 91 E2 ?? 00 91 E0 03 13 AA ?? ?? ?? ?? F4 03 00 2A
// ^^^^^^^^^^^
// ```
// Ref: CStartExperienceManager::PositionMenu()
PBYTE matchGetMonitorInformation = ( PBYTE ) FindPattern (
mi - > lpBaseOfDll ,
mi - > SizeOfImage ,
" \xA9 \xE4 \x00 \x00 \x00 \x E3 \x00 \x00 \x91 \xE2 \x00 \x00 \x91 \xE0 \x03 \x13 \xAA \x00 \x00 \x00 \x00 \x00 \x03 \x00 \x2A " ,
" xx???x??xx??xxxxx????? xxx "
" \xE3 \x00 \x00 \x91 \xE2 \x00 \x00 \x91 \xE0 \x03 \x13 \xAA \x00 \x00 \x00 \x00 \xF4 \x03 \x00 \x2A " ,
" x?xxx?xxxxxx????x xxx "
) ;
if ( matchGetMonitorInformation )
{
matchGetMonitorInformation + = 17 ;
matchGetMonitorInformation + = 12 ;
matchGetMonitorInformation = ( PBYTE ) ARM64_FollowBL ( ( DWORD * ) matchGetMonitorInformation ) ;
}
if ( ! matchGetMonitorInformation )
{
// * Pattern for 226xx, CSingleViewShellExperience* first arg passed (E1 03 14 AA)
// ```
// A9 E4 ?? ?? ?? E3 ?? ?? 91 E2 ?? ?? 91 E1 03 14 AA E0 03 13 AA ?? ?? ?? ?? ?? 03 00 2A
// ^^^^^^^^^^^
// ```
// Ref: CStartExperienceManager::PositionMenu()
matchGetMonitorInformation = ( PBYTE ) FindPattern (
mi - > lpBaseOfDll ,
mi - > SizeOfImage ,
" \xA9 \xE4 \x00 \x00 \x00 \xE3 \x00 \x00 \x91 \xE2 \x00 \x00 \x91 \xE1 \x03 \x14 \xAA \xE0 \x03 \x13 \xAA \x00 \x00 \x00 \x00 \x00 \x03 \x00 \x2A " ,
" xx???x??xx??xxxxxxxxx?????xxx "
) ;
if ( matchGetMonitorInformation )
{
matchGetMonitorInformation + = 21 ;
matchGetMonitorInformation = ( PBYTE ) ARM64_FollowBL ( ( DWORD * ) matchGetMonitorInformation ) ;
}
}
if ( ! matchGetMonitorInformation )
{
// * Pattern for 26100.1, 265, 470, 560, 670, 712, 751, 863, 1000, 1150
// ```
@ -2349,63 +2309,61 @@ BOOL FixStartMenuAnimation(LPMODULEINFO mi)
@@ -2349,63 +2309,61 @@ BOOL FixStartMenuAnimation(LPMODULEINFO mi)
}
# elif defined(_M_ARM64)
// ```
// E1 03 ?? 2A ?? ?? 04 91 ?? ?? ?? ?? ?? 03 00 2A
// ```
// Check two instructions before, and NOP these:
// ```
// MOV W??, #3
// STRB W??, [X??,#0x???]
// ?? ?? ?? 34 ?? 00 80 52 ?? 8E 0A 39
// ^^^^^^^^^^^ Turn CBZ into B
// ```
// Perform on exactly two matches
PBYTE matchHideA = nullptr ;
PBYTE matchHideB = nullptr ;
auto findTheIfBody = [ ] ( PBYTE pAnchor ) - > PBYTE
{
// 27881.1000+ has CBNZ before us, follow it if it is.
// Otherwise, just check the two instructions before.
PBYTE pMaybeFollowed = ( PBYTE ) ARM64_FollowCBNZW ( ( DWORD * ) ( pAnchor - 4 ) ) ;
PBYTE pIfBlockBegin = pMaybeFollowed ? pMaybeFollowed : pAnchor - 8 ;
DWORD insnMovzw = * ( DWORD * ) pIfBlockBegin ;
if ( ! ARM64_IsMOVZW ( insnMovzw ) )
return nullptr ;
DWORD movzwImm16 = ARM64_ReadBitsSignExtend ( insnMovzw , 20 , 5 ) ;
if ( movzwImm16 ! = 3 )
return nullptr ;
DWORD insnStrbimm = * ( DWORD * ) ( pIfBlockBegin + 4 ) ;
if ( ! ARM64_IsSTRBIMM ( insnStrbimm ) )
return nullptr ;
return pIfBlockBegin ;
} ;
PBYTE matchHideAAfter = ( PBYTE ) FindPattern (
PBYTE matchHideA = ( PBYTE ) FindPattern (
mi - > lpBaseOfDll ,
mi - > SizeOfImage ,
" \xE1 \x0 3 \x00 \x2A \x00 \x00 \x0 4\x91 \x00 \x 00 \x00 \x00 \x00 \x03 \x00 \x2A " ,
" xx ?x?? xx???? ?xxx "
" \x34 \x00 \x00 \x80 \x52 \x00 \x8E \x0A \x39 " ,
" x?xxx?xxx "
) ;
if ( matchHideAAfter )
{
matchHideA = findTheIfBody ( matchHideAAfter ) ;
}
PBYTE matchHideB = nullptr ;
if ( matchHideA )
{
printf ( " [SMA] matchHideA in CStartExperienceManager::Hide() = %llX \n " , matchHideA - ( PBYTE ) mi - > lpBaseOfDll ) ;
PBYTE matchHideBAfter = ( PBYTE ) FindPattern (
matchHideAAfter + 16 ,
1024 ,
" \xE1 \x03 \x00 \x2A \x00 \x00 \x04 \x91 \x00 \x00 \x00 \x00 \x00 \x03 \x00 \x2A " ,
" xx?x??xx?????xxx "
matchHideA - = 3 ;
printf ( " [SMA] matchHideA in CStartExperienceManager::Hide() = %llX (Pattern A) \n " , matchHideA - ( PBYTE ) mi - > lpBaseOfDll ) ;
matchHideB = ( PBYTE ) FindPattern (
matchHideA + 12 ,
mi - > SizeOfImage - ( matchHideA + 12 - ( PBYTE ) mi - > lpBaseOfDll ) ,
" \x34 \x00 \x00 \x80 \x52 \x00 \x8E \x0A \x39 " ,
" x?xxx?xxx "
) ;
if ( matchHideBAfter )
if ( matchHideB )
{
matchHideB = findTheIfBody ( matchHideBAfter ) ;
matchHideB - = 3 ;
printf ( " [SMA] matchHideB in CStartExperienceManager::Hide() = %llX (Pattern A) \n " , matchHideB - ( PBYTE ) mi - > lpBaseOfDll ) ;
}
if ( matchHideB )
}
else
{
// ```
// ?? ?? ?? 34 ?? 00 80 52 ?? 4E 0B 39
// ^^^^^^^^^^^ Turn CBZ into B
// ```
// Perform on exactly two matches
matchHideA = ( PBYTE ) FindPattern (
mi - > lpBaseOfDll ,
mi - > SizeOfImage ,
" \x34 \x00 \x00 \x80 \x52 \x00 \x4E \x0B \x39 " ,
" x?xxx?xxx "
) ;
if ( matchHideA )
{
printf ( " [SMA] matchHideB in CStartExperienceManager::Hide() = %llX \n " , matchHideB - ( PBYTE ) mi - > lpBaseOfDll ) ;
matchHideA - = 3 ;
printf ( " [SMA] matchHideA in CStartExperienceManager::Hide() = %llX (Pattern B) \n " , matchHideA - ( PBYTE ) mi - > lpBaseOfDll ) ;
matchHideB = ( PBYTE ) FindPattern (
matchHideA + 12 ,
mi - > SizeOfImage - ( matchHideA + 12 - ( PBYTE ) mi - > lpBaseOfDll ) ,
" \x34 \x00 \x00 \x80 \x52 \x00 \x4E \x0B \x39 " ,
" x?xxx?xxx "
) ;
if ( matchHideB )
{
matchHideB - = 3 ;
printf ( " [SMA] matchHideB in CStartExperienceManager::Hide() = %llX (Pattern B) \n " , matchHideB - ( PBYTE ) mi - > lpBaseOfDll ) ;
}
}
}
# endif
@ -2447,18 +2405,20 @@ BOOL FixStartMenuAnimation(LPMODULEINFO mi)
@@ -2447,18 +2405,20 @@ BOOL FixStartMenuAnimation(LPMODULEINFO mi)
}
}
# elif defined(_M_ARM64)
if ( VirtualProtect ( matchHideA , 8 , PAGE_EXECUTE_READWRITE , & dwOldProtect ) )
if ( VirtualProtect ( matchHideA , 4 , PAGE_EXECUTE_READWRITE , & dwOldProtect ) )
{
* ( DWORD * ) ( matchHideA + 0 ) = 0xD503201F ; // NOP
* ( DWORD * ) ( matchHideA + 4 ) = 0xD503201F ; // NOP
VirtualProtect ( matchHideA , 8 , dwOldProtect , & dwOldProtect ) ;
DWORD newInsn = ARM64_CBZWToB ( * ( DWORD * ) matchHideA ) ;
if ( newInsn )
* ( DWORD * ) matchHideA = newInsn ;
VirtualProtect ( matchHideA , 4 , dwOldProtect , & dwOldProtect ) ;
dwOldProtect = 0 ;
if ( VirtualProtect ( matchHideB , 8 , PAGE_EXECUTE_READWRITE , & dwOldProtect ) )
if ( VirtualProtect ( matchHideB , 4 , PAGE_EXECUTE_READWRITE , & dwOldProtect ) )
{
* ( DWORD * ) ( matchHideB + 0 ) = 0xD503201F ; // NOP
* ( DWORD * ) ( matchHideB + 4 ) = 0xD503201F ; // NOP
VirtualProtect ( matchHideB , 8 , dwOldProtect , & dwOldProtect ) ;
newInsn = ARM64_CBZWToB ( * ( DWORD * ) matchHideB ) ;
if ( newInsn )
* ( DWORD * ) matchHideB = newInsn ;
VirtualProtect ( matchHideB , 4 , dwOldProtect , & dwOldProtect ) ;
}
}
# endif
@ -3164,17 +3124,17 @@ void TryToFindTwinuiPCShellOffsets(DWORD* pOffsets)
@@ -3164,17 +3124,17 @@ void TryToFindTwinuiPCShellOffsets(DWORD* pOffsets)
pOffsets [ 0 ] = ( DWORD ) ( match + 5 + * ( int * ) ( match + 1 ) - pFile ) ;
}
# elif defined(_M_ARM64)
// ?? ?? 00 71 ?? ?? 00 54 ?? ?? 40 F9 E3 03 ?? AA E2 03 ?? AA E1 03 ?? 2A ?? ?? ?? ??
// ?? AE 00 71 ?? ?? 00 54 ?? 06 40 F9 E3 03 ?? AA E2 03 ?? AA E1 03 ?? 2A ?? ?? ?? ??
// ^^^^^^^^^^^
// Ref: CMultitaskingViewFrame::v_WndProc()
PBYTE match = ( PBYTE ) FindPattern (
pFile , dwSize ,
" \x00 \x71 \x00 \x00 \x00 \x54 \x00 \x00 \x40 \xF9 \xE3 \x03 \x00 \xAA \xE2 \x03 \x00 \xAA \xE1 \x03 \x00 \x2A " ,
" xx??xx?? xxxx?xxx?xxx?x "
" \xAE \x 00 \x71 \x00 \x00 \x00 \x54 \x00 \x06 \x40 \xF9 \xE3 \x03 \x00 \xAA \xE2 \x03 \x00 \xAA \xE1 \x03 \x00 \x2A " ,
" xxx??xx?x xxxx?xxx?xxx?x "
) ;
if ( match )
{
match + = 22 ;
match + = 23 ;
pOffsets [ 0 ] = ( DWORD ) FileOffsetToRVA ( pFile , ( PBYTE ) ARM64_FollowBL ( ( DWORD * ) match ) - pFile ) ;
}
# endif
@ -3186,25 +3146,25 @@ void TryToFindTwinuiPCShellOffsets(DWORD* pOffsets)
@@ -3186,25 +3146,25 @@ void TryToFindTwinuiPCShellOffsets(DWORD* pOffsets)
if ( ! pOffsets [ 1 ] | | pOffsets [ 1 ] = = 0xFFFFFFFF )
{
# if defined(_M_X64)
// Don't worry if this is too long, this works on 17763 ~ 27943
// 40 55 53 56 57 41 54 41 55 41 56 41 57 48 8D AC 24 ? ? ? ? 48 81 EC ? ? ? ? 48 8B 05 ? ? ? ? 48 33 C4 48 89 85 ? ? ? ? 4C 8B ? ? ? ? ? 41 8B C1
// Don't worry if this is too long, this works on 17763 and 25951
// 40 55 53 56 57 41 54 41 55 41 56 41 57 48 8D AC 24 ? ? ? ? 48 81 EC ? ? ? ? 48 8B 05 ? ? ? ? 48 33 C4 48 89 85 ? ? ? ? 4C 8B B5 ? ? ? ? 41 8B C1
PBYTE match = ( PBYTE ) FindPattern (
pFile , dwSize ,
" \x40 \x55 \x53 \x56 \x57 \x41 \x54 \x41 \x55 \x41 \x56 \x41 \x57 \x48 \x8D \xAC \x24 \x00 \x00 \x00 \x00 \x48 \x81 \xEC \x00 \x00 \x00 \x00 \x48 \x8B \x05 \x00 \x00 \x00 \x00 \x48 \x33 \xC4 \x48 \x89 \x85 \x00 \x00 \x00 \x00 \x4C \x8B \x00 \x00 \x00 \x00 \x00 \x41 \x8B \xC1 " ,
" xxxxxxxxxxxxxxxxx????xxx????xxx????xxxxxx????xx? ????xxx "
" \x40 \x55 \x53 \x56 \x57 \x41 \x54 \x41 \x55 \x41 \x56 \x41 \x57 \x48 \x8D \xAC \x24 \x00 \x00 \x00 \x00 \x48 \x81 \xEC \x00 \x00 \x00 \x00 \x48 \x8B \x05 \x00 \x00 \x00 \x00 \x48 \x33 \xC4 \x48 \x89 \x85 \x00 \x00 \x00 \x00 \x4C \x8B \xB5 \x00 \x00 \x00 \x00 \x41 \x8B \xC1 " ,
" xxxxxxxxxxxxxxxxx????xxx????xxx????xxxxxx????xxx ????xxx "
) ;
if ( match )
{
pOffsets [ 1 ] = ( DWORD ) ( match - pFile ) ;
}
# elif defined(_M_ARM64)
// 40 F9 43 03 1C 32 E4 03 ?? AA ?? ?? FF 97
// 40 F9 43 03 1C 32 E4 03 15 AA ?? ?? FF 97
// ^^^^^^^^^^^
// Ref: ImmersiveContextMenuHelper::ApplyOwnerDrawToMenu()
PBYTE match = ( PBYTE ) FindPattern (
pFile , dwSize ,
" \x40 \xF9 \x43 \x03 \x1C \x32 \xE4 \x03 \x00 \xAA \x00 \x00 \xFF \x97 " ,
" xxxxxxxx? x??xx "
" \x40 \xF9 \x43 \x03 \x1C \x32 \xE4 \x03 \x15 \xAA \x00 \x00 \xFF \x97 " ,
" xxxxxxxxx x??xx "
) ;
if ( match )
{
@ -3231,12 +3191,12 @@ void TryToFindTwinuiPCShellOffsets(DWORD* pOffsets)
@@ -3231,12 +3191,12 @@ void TryToFindTwinuiPCShellOffsets(DWORD* pOffsets)
pOffsets [ 2 ] = ( DWORD ) ( match - pFile ) ;
}
# elif defined(_M_ARM64)
// 7F 23 03 D5 F3 53 BF A9 FD 7B BB A9 FD 03 00 91 ?? 03 00 AA ?? 03 01 AA ?? ?? ?? ?? FF ?? 03 A9
// 7F 23 03 D5 F3 53 BF A9 FD 7B BB A9 FD 03 00 91 F3 03 00 AA F4 03 01 AA ?? ?? ?? ?? FF ?? 03 A9
// ----------- PACIBSP, don't scan for this because it's everywhere
PBYTE match = ( PBYTE ) FindPattern (
pFile , dwSize ,
" \xF3 \x53 \xBF \xA9 \xFD \x7B \xBB \xA9 \xFD \x03 \x00 \x91 \x00 \x03 \x00 \xAA \x00 \x03 \x01 \xAA \x00 \x00 \x00 \x00 \xFF \x00 \x03 \xA9 " ,
" xxxxxxxxxxxx?xxx? xxx????x?xx "
" \xF3 \x53 \xBF \xA9 \xFD \x7B \xBB \xA9 \xFD \x03 \x00 \x91 \xF3 \x03 \x00 \xAA \xF4 \x03 \x01 \xAA \x00 \x00 \x00 \x00 \xFF \x00 \x03 \xA9 " ,
" xxxxxxxxxxxxxxxxx xxx????x?xx "
) ;
if ( match )
{
@ -3264,32 +3224,17 @@ void TryToFindTwinuiPCShellOffsets(DWORD* pOffsets)
@@ -3264,32 +3224,17 @@ void TryToFindTwinuiPCShellOffsets(DWORD* pOffsets)
match + = 17 ;
pOffsets [ 3 ] = ( DWORD ) ( match + 5 + * ( int * ) ( match + 1 ) - pFile ) ;
}
else
{
// 48 8B ? E8 ? ? ? ? 4C 8D 47 ? 48 8B ? 48 8B CE E8 ? ? ? ? 90
// ^^^^^^^
match = ( PBYTE ) FindPattern (
pFile , dwSize ,
" \x48 \x8B \xCB \xE8 \x00 \x00 \x00 \x00 \x4C \x8D \x47 \x00 \x48 \x8B \x00 \x48 \x8B \xCE \xE8 \x00 \x00 \x00 \x00 \x90 " ,
" xx?x????xxx?xx?xxxx????x "
) ;
if ( match )
{
match + = 18 ;
pOffsets [ 3 ] = ( DWORD ) ( match + 5 + * ( int * ) ( match + 1 ) - pFile ) ;
}
}
# elif defined(_M_ARM64)
// ?? 0A 40 F9 ?? 02 40 F9 ?? ?? 00 F9 ?? ?? ?? ?? ?? 62 00 91 ?? ?? 00 91 E0 03 ?? AA ?? ?? ?? ?? 1F 20 03 D5
// ^^^^^^^^^^^
// 82 62 00 91 ?? ?? 00 91 E0 03 ?? AA ?? ?? ?? ?? 1F 20 03 D5
// ^^^^^^^^^^^
PBYTE match = ( PBYTE ) FindPattern (
pFile , dwSize ,
" \x0A \x40 \xF9 \x00 \x02 \x40 \xF9 \x00 \x00 \x00 \xF9 \x00 \x00 \x00 \x00 \x00 \x62 \x00 \x91 \x00 \x00 \x00 \x91 \xE0 \x03 \x00 \xAA \x00 \x00 \x00 \x00 \x1F \x20 \x03 \xD5 " ,
" xxx?xxx??xx?????xx x??xxxx?x????xxxx "
" \x82 \x62 \x00 \x91 \x00 \x00 \x00 \x91 \xE0 \x03 \x00 \xAA \x00 \x00 \x00 \x00 \x1F \x20 \x03 \xD5 " ,
" xxxx??xxxx?x????xxxx "
) ;
if ( match )
{
match + = 27 ;
match + = 12 ;
pOffsets [ 3 ] = ( DWORD ) FileOffsetToRVA ( pFile , ( PBYTE ) ARM64_FollowBL ( ( DWORD * ) match ) - pFile ) ;
}
# endif
@ -3301,32 +3246,30 @@ void TryToFindTwinuiPCShellOffsets(DWORD* pOffsets)
@@ -3301,32 +3246,30 @@ void TryToFindTwinuiPCShellOffsets(DWORD* pOffsets)
if ( ! pOffsets [ 4 ] | | pOffsets [ 4 ] = = 0xFFFFFFFF )
{
# if defined(_M_X64)
// Cobalt:
// 48 89 46 ? 48 8B CB E8 ? ? ? ? 48 8B D3 48 8B CF E8 ? ? ? ? 90
// ^^^^^^^
// 48 8B ? E8 ? ? ? ? 48 8B D3 48 8B CF E8 ? ? ? ? 90 48 8D 56 ? 48 8B CE
// ^^^^^^^ ------------------- Non-inlined ~::final_suspend()
PBYTE match = ( PBYTE ) FindPattern (
pFile , dwSize ,
" \x48 \x89 \x46 \x00 \x48 \x8B \xCB \xE8 \x00 \x00 \x00 \x00 \x48 \x8B \xD3 \x48 \x8B \xCF \xE8 \x00 \x00 \x00 \x00 \x90 " ,
" xxx ?xxx x????xxxxxxx????x "
" \x48 \x8B \x00 \xE8 \x00 \x00 \x00 \x00 \x48 \x8B \xD3 \x48 \x8B \xCF \xE8 \x00 \x00 \x00 \x00 \x90 \x48 \x8D \x56 \x00 \x48 \x8B \xCE " ,
" xx?x????xxxxxxx????xxxx?xx x "
) ;
if ( match )
{
match + = 18 ;
match + = 14 ;
pOffsets [ 4 ] = ( DWORD ) ( match + 5 + * ( int * ) ( match + 1 ) - pFile ) ;
}
else
{
// Nickel+:
// 48 89 03 48 8B CB E8 ? ? ? ? 48 8B D3 48 8B CF E8 ? ? ? ? 90
// ^^^^^^^
// 48 8B ? E8 ? ? ? ? 48 8B D3 48 8B CF E8 ? ? ? ? 90 48 8B 05 ? ? ? ? 48
// ^^^^^^^ ------------------- Inlined ~::final_suspend()
match = ( PBYTE ) FindPattern (
pFile , dwSize ,
" \x48 \x89 \x03 \x48 \x8B \xCB \xE8 \x00 \x00 \x00 \x00 \x48 \x8B \xD3 \x48 \x8B \xCF \xE8 \x00 \x00 \x00 \x00 \x90 " ,
" xxxxxxx????xxx xxxx????x "
" \x48 \x8B \x00 \xE8 \x00 \x00 \x00 \x00 \x48 \x8B \xD3 \x48 \x8B \xCF \xE8 \x00 \x00 \x00 \x00 \x90 \x48 \x8B \x05 \x00 \x00 \x00 \x00 \x48 " ,
" xx?x????xx xxxxx????xxxx????x "
) ;
if ( match )
{
match + = 17 ;
match + = 14 ;
pOffsets [ 4 ] = ( DWORD ) ( match + 5 + * ( int * ) ( match + 1 ) - pFile ) ;
}
}
@ -3390,11 +3333,11 @@ void TryToFindTwinuiPCShellOffsets(DWORD* pOffsets)
@@ -3390,11 +3333,11 @@ void TryToFindTwinuiPCShellOffsets(DWORD* pOffsets)
}
}
# elif defined(_M_ARM64)
// F3 53 BE A9 F5 5B 01 A9 FD 7B ?? A9 FD 03 00 91 30 00 80 92 ?? 03 04 AA B0 ?? 00 F9 ?? 03 00 AA ?? 02 00 F9 ?? 2E 40 F9 ?? 03 03 AA ?? 23 02 A9 ?? ?? 00 B5
// F3 53 BE A9 F5 5B 01 A9 FD 7B ?? A9 FD 03 00 91 30 00 80 92 F5 03 04 AA B0 ?? 00 F9 F3 03 00 AA BF 02 00 F9 68 2E 40 F9 F6 03 03 AA B3 23 02 A9 ?? ?? 00 B5
PBYTE match = ( PBYTE ) FindPattern (
pFile , dwSize ,
" \xF3 \x53 \xBE \xA9 \xF5 \x5B \x01 \xA9 \xFD \x7B \x00 \xA9 \xFD \x03 \x00 \x91 \x30 \x00 \x80 \x92 \x00 \x03 \x04 \xAA \xB0 \x00 \x00 \xF9 \x00 \x03 \x00 \xAA \x00 \x02 \x00 \xF9 \x00 \x2E \x40 \xF9 \x00 \x03 \x03 \xAA \x00 \x23 \x02 \xA9 \x00 \x00 \x00 \xB5 " ,
" xxxxxxxxxx?xxxxxxxxx?xxxx?xx?xxx?xxx?xxx?xxx? xxx??xx "
" \xF3 \x53 \xBE \xA9 \xF5 \x5B \x01 \xA9 \xFD \x7B \x00 \xA9 \xFD \x03 \x00 \x91 \x30 \x00 \x80 \x92 \xF5 \x03 \x04 \xAA \xB0 \x00 \x00 \xF9 \xF3 \x03 \x00 \xAA \xBF \x02 \x00 \xF9 \x68 \x2E \x40 \xF9 \xF6 \x03 \x03 \xAA \xB3 \x23 \x02 \xA9 \x00 \x00 \x00 \xB5 " ,
" xxxxxxxxxx?xxxxxxxxxxxxxx?xxxxxxxxxxxxxxxxxxx xxx??xx "
) ;
if ( match )
{
@ -3443,11 +3386,11 @@ void TryToFindTwinuiPCShellOffsets(DWORD* pOffsets)
@@ -3443,11 +3386,11 @@ void TryToFindTwinuiPCShellOffsets(DWORD* pOffsets)
}
}
# elif defined(_M_ARM64)
// F3 53 BC A9 F5 5B 01 A9 F7 13 00 F9 F9 17 00 F9 FB 1B 00 F9 FD 7B BC A9 FD 03 00 91 FF ?? 00 D1 30 00 80 92 ?? 03 04 AA
// F3 53 BC A9 F5 5B 01 A9 F7 13 00 F9 F9 17 00 F9 FB 1B 00 F9 FD 7B BC A9 FD 03 00 91 FF ?? 00 D1 30 00 80 92 FB 03 04 AA
PBYTE match = ( PBYTE ) FindPattern (
pFile , dwSize ,
" \xF3 \x53 \xBC \xA9 \xF5 \x5B \x01 \xA9 \xF7 \x13 \x00 \xF9 \xF9 \x17 \x00 \xF9 \xFB \x1B \x00 \xF9 \xFD \x7B \xBC \xA9 \xFD \x03 \x00 \x91 \xFF \x00 \x00 \xD1 \x30 \x00 \x80 \x92 \x00 \x03 \x04 \xAA " ,
" xxxxxxxxxxxxxxxxxxxxxxxxxxxxx?xxxxxx? xxx "
" \xF3 \x53 \xBC \xA9 \xF5 \x5B \x01 \xA9 \xF7 \x13 \x00 \xF9 \xF9 \x17 \x00 \xF9 \xFB \x1B \x00 \xF9 \xFD \x7B \xBC \xA9 \xFD \x03 \x00 \x91 \xFF \x00 \x00 \xD1 \x30 \x00 \x80 \x92 \xFB \x03 \x04 \xAA " ,
" xxxxxxxxxxxxxxxxxxxxxxxxxxxxx?xxxxxxx xxx "
) ;
if ( match )
{