|
@@ -95,7 +95,13 @@ static const uint8_t mask[][MAX_CMP_SIZE] = {
|
|
|
0xFF, 0xC0, 0x00, 0x00, 0x00, 0x00,
|
|
|
0xFF, 0x00,
|
|
|
0xF8, 0xF8, 0x00, 0x00, 0x00, 0x00
|
|
|
- }
|
|
|
+ },
|
|
|
+ {
|
|
|
+ 0xF8, 0xFF, 0xC0, 0x00, 0x00, 0x00, 0x00,
|
|
|
+ 0xFF, 0xC0, 0x00, 0x00, 0x00, 0x00,
|
|
|
+ 0xFF, 0x00,
|
|
|
+ 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00
|
|
|
+ },
|
|
|
};
|
|
|
|
|
|
static const uint8_t mask_cmp[][MAX_CMP_SIZE] = {
|
|
@@ -124,6 +130,21 @@ static const uint8_t mask_cmp[][MAX_CMP_SIZE] = {
|
|
|
0x39, 0x80, 0x00, 0x00, 0x00, 0x00,
|
|
|
0x75, 0x00,
|
|
|
0x40, 0xB8, 0x00, 0x00, 0x00, 0x00
|
|
|
+ },
|
|
|
+ /*
|
|
|
+ * Windows 10 April 2018
|
|
|
+ * 49 8B 87 58 40 00 00 mov rax, [r15+4058h]
|
|
|
+ * 39 98 C0 53 00 00 cmp [rax+53C0h], ebx
|
|
|
+ * 75 12 jnz short loc_1800A7FEC
|
|
|
+ * 48 8D 15 7F B6 09 00 lea rdx, addrErrorMsg
|
|
|
+ *
|
|
|
+ * Note: different instructions, last byte skipped due to MAX_CMP_SIZE
|
|
|
+ */
|
|
|
+ {
|
|
|
+ 0x48, 0x8B, 0x80, 0x00, 0x00, 0x00, 0x00,
|
|
|
+ 0x39, 0x80, 0x00, 0x00, 0x00, 0x00,
|
|
|
+ 0x75, 0x00,
|
|
|
+ 0x48, 0x8D, 0x00, 0x00, 0x00, 0x00
|
|
|
}
|
|
|
};
|
|
|
|
|
@@ -131,6 +152,7 @@ static const uint8_t mask_cmp[][MAX_CMP_SIZE] = {
|
|
|
static const uint32_t code_offsets[][2] = {
|
|
|
{3, 10},
|
|
|
{3, 9},
|
|
|
+ {3, 9},
|
|
|
};
|
|
|
#else
|
|
|
|
|
@@ -148,7 +170,13 @@ static const uint8_t mask[][MAX_CMP_SIZE] = {
|
|
|
0xFF, 0xC0, 0x00, 0x00, 0x00, 0x00, 0xFF,
|
|
|
0xFF, 0x00,
|
|
|
0xFF, 0x00, 0x00, 0x00, 0x00
|
|
|
- }
|
|
|
+ },
|
|
|
+ {
|
|
|
+ 0xFF, 0xC0, 0x00, 0x00, 0x00, 0x00,
|
|
|
+ 0xFF, 0xC0, 0x00, 0x00, 0x00, 0x00, 0xFF,
|
|
|
+ 0xFF, 0x00,
|
|
|
+ 0xFF, 0x00, 0x00, 0x00, 0x00
|
|
|
+ },
|
|
|
};
|
|
|
|
|
|
static const uint8_t mask_cmp[][MAX_CMP_SIZE] = {
|
|
@@ -177,6 +205,20 @@ static const uint8_t mask_cmp[][MAX_CMP_SIZE] = {
|
|
|
0x83, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00,
|
|
|
0x75, 0x00,
|
|
|
0x68, 0x00, 0x00, 0x00, 0x00
|
|
|
+ },
|
|
|
+
|
|
|
+ /*
|
|
|
+ * Windows 10 April 2018 Update
|
|
|
+ * 8B 86 68 2B 00 00 mov eax, [esi+2B68h]
|
|
|
+ * 83 B8 F4 4D 00 00 00 cmp dword ptr [eax+4DF4h], 0
|
|
|
+ * 75 0F jnz short loc_100D9A9C
|
|
|
+ * BA 08 71 01 10 mov edx, offset errMsg
|
|
|
+ */
|
|
|
+ {
|
|
|
+ 0x8B, 0x80, 0x00, 0x00, 0x00, 0x00,
|
|
|
+ 0x83, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00,
|
|
|
+ 0x75, 0x00,
|
|
|
+ 0xBA, 0x00, 0x00, 0x00, 0x00
|
|
|
}
|
|
|
};
|
|
|
|
|
@@ -184,6 +226,7 @@ static const uint8_t mask_cmp[][MAX_CMP_SIZE] = {
|
|
|
static const uint32_t code_offsets[][2] = {
|
|
|
{2, 8},
|
|
|
{2, 8},
|
|
|
+ {2, 8},
|
|
|
};
|
|
|
#endif
|
|
|
|