|
@@ -83,15 +83,32 @@ static inline void d3d9_free(d3d9_info &info)
|
|
|
|
|
|
#define MAX_CMP_SIZE 22
|
|
|
|
|
|
+// clang-format off
|
|
|
static const uint8_t mask[][MAX_CMP_SIZE] = {
|
|
|
- {0xF8, 0xFF, 0xC0, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0x00, 0x00,
|
|
|
- 0x00, 0x00, 0x00, 0xFF, 0x00, 0xF8, 0xF8, 0x00, 0x00, 0x00, 0x00},
|
|
|
- {0xF8, 0xFF, 0xC0, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xC0, 0x00, 0x00,
|
|
|
- 0x00, 0x00, 0xFF, 0x00, 0xF8, 0xF8, 0x00, 0x00, 0x00, 0x00},
|
|
|
- {0xF8, 0xFF, 0xC0, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xC0, 0x00, 0x00,
|
|
|
- 0x00, 0x00, 0xFF, 0x00, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00},
|
|
|
- {0xF8, 0xFF, 0xC0, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xC0, 0x00, 0x00,
|
|
|
- 0x00, 0x00, 0x00, 0xFF, 0x00, 0xFF, 0xFF, 0x00, 0x00, 0x00},
|
|
|
+ {
|
|
|
+ 0xF8, 0xFF, 0xC0, 0x00, 0x00, 0x00, 0x00,
|
|
|
+ 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00,
|
|
|
+ 0xFF, 0x00,
|
|
|
+ 0xF8, 0xF8, 0x00, 0x00, 0x00, 0x00
|
|
|
+ },
|
|
|
+ {
|
|
|
+ 0xF8, 0xFF, 0xC0, 0x00, 0x00, 0x00, 0x00,
|
|
|
+ 0xFF, 0xC0, 0x00, 0x00, 0x00, 0x00,
|
|
|
+ 0xFF, 0x00,
|
|
|
+ 0xF8, 0xF8, 0x00, 0x00, 0x00, 0x00
|
|
|
+ },
|
|
|
+ {
|
|
|
+ 0xF8, 0xFF, 0xC0, 0x00, 0x00, 0x00, 0x00,
|
|
|
+ 0xFF, 0xC0, 0x00, 0x00, 0x00, 0x00,
|
|
|
+ 0xFF, 0x00,
|
|
|
+ 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00
|
|
|
+ },
|
|
|
+ {
|
|
|
+ 0xF8, 0xFF, 0xC0, 0x00, 0x00, 0x00, 0x00,
|
|
|
+ 0xFF, 0xC0, 0x00, 0x00, 0x00, 0x00, 0x00,
|
|
|
+ 0xFF, 0x00,
|
|
|
+ 0xFF, 0xFF, 0x00, 0x00, 0x00
|
|
|
+ },
|
|
|
};
|
|
|
|
|
|
static const uint8_t mask_cmp[][MAX_CMP_SIZE] = {
|
|
@@ -102,8 +119,12 @@ static const uint8_t mask_cmp[][MAX_CMP_SIZE] = {
|
|
|
* 75 12 jnz short loc_7FF7AA90530
|
|
|
* 41 B8 F9 19 00 00 mov r8d, 19F9h
|
|
|
*/
|
|
|
- {0x48, 0x8B, 0x80, 0x00, 0x00, 0x00, 0x00, 0x44, 0x39, 0x00, 0x00,
|
|
|
- 0x00, 0x00, 0x00, 0x75, 0x00, 0x40, 0xB8, 0x00, 0x00, 0x00, 0x00},
|
|
|
+ {
|
|
|
+ 0x48, 0x8B, 0x80, 0x00, 0x00, 0x00, 0x00,
|
|
|
+ 0x44, 0x39, 0x00, 0x00, 0x00, 0x00, 0x00,
|
|
|
+ 0x75, 0x00,
|
|
|
+ 0x40, 0xB8, 0x00, 0x00, 0x00, 0x00
|
|
|
+ },
|
|
|
/*
|
|
|
* Windows ???+
|
|
|
* 49 8B 87 78 41 00 00 mov rax, [r15+4178h]
|
|
@@ -111,8 +132,12 @@ static const uint8_t mask_cmp[][MAX_CMP_SIZE] = {
|
|
|
* 75 12 jnz short loc_1800AEC9C
|
|
|
* 41 B9 C3 1A 00 00 mov r9d, 1AC3h
|
|
|
*/
|
|
|
- {0x48, 0x8B, 0x80, 0x00, 0x00, 0x00, 0x00, 0x39, 0x80, 0x00, 0x00,
|
|
|
- 0x00, 0x00, 0x75, 0x00, 0x40, 0xB8, 0x00, 0x00, 0x00, 0x00},
|
|
|
+ {
|
|
|
+ 0x48, 0x8B, 0x80, 0x00, 0x00, 0x00, 0x00,
|
|
|
+ 0x39, 0x80, 0x00, 0x00, 0x00, 0x00,
|
|
|
+ 0x75, 0x00,
|
|
|
+ 0x40, 0xB8, 0x00, 0x00, 0x00, 0x00
|
|
|
+ },
|
|
|
/*
|
|
|
* Windows 10 April 2018
|
|
|
* 49 8B 87 58 40 00 00 mov rax, [r15+4058h]
|
|
@@ -122,8 +147,12 @@ static const uint8_t mask_cmp[][MAX_CMP_SIZE] = {
|
|
|
*
|
|
|
* Note: different instructions, last byte skipped due to MAX_CMP_SIZE
|
|
|
*/
|
|
|
- {0x48, 0x8B, 0x80, 0x00, 0x00, 0x00, 0x00, 0x39, 0x80, 0x00, 0x00,
|
|
|
- 0x00, 0x00, 0x75, 0x00, 0x48, 0x8D, 0x00, 0x00, 0x00, 0x00},
|
|
|
+ {
|
|
|
+ 0x48, 0x8B, 0x80, 0x00, 0x00, 0x00, 0x00,
|
|
|
+ 0x39, 0x80, 0x00, 0x00, 0x00, 0x00,
|
|
|
+ 0x75, 0x00,
|
|
|
+ 0x48, 0x8D, 0x00, 0x00, 0x00, 0x00
|
|
|
+ },
|
|
|
/*
|
|
|
* Windows 11 22H2
|
|
|
* 49 8b 86 30 40 00 00 MOV RAX,qword ptr [R14 + 0x4030]
|
|
@@ -133,9 +162,14 @@ static const uint8_t mask_cmp[][MAX_CMP_SIZE] = {
|
|
|
*
|
|
|
* Note: different instructions, last byte skipped due to MAX_CMP_SIZE
|
|
|
*/
|
|
|
- {0x48, 0x8B, 0x80, 0x00, 0x00, 0x00, 0x00, 0x83, 0x80, 0x00, 0x00,
|
|
|
- 0x00, 0x00, 0x00, 0x75, 0x00, 0x48, 0x8D, 0x00, 0x00, 0x00},
|
|
|
+ {
|
|
|
+ 0x48, 0x8B, 0x80, 0x00, 0x00, 0x00, 0x00,
|
|
|
+ 0x83, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00,
|
|
|
+ 0x75, 0x00,
|
|
|
+ 0x48, 0x8D, 0x00, 0x00, 0x00
|
|
|
+ },
|
|
|
};
|
|
|
+// clang-format on
|
|
|
|
|
|
// Offset into the code for the numbers we're interested in
|
|
|
static const uint32_t code_offsets[][2] = {
|
|
@@ -148,15 +182,32 @@ static const uint32_t code_offsets[][2] = {
|
|
|
|
|
|
#define MAX_CMP_SIZE 20
|
|
|
|
|
|
+// clang-format off
|
|
|
static const uint8_t mask[][MAX_CMP_SIZE] = {
|
|
|
- {0xFF, 0xC0, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xC0, 0x00, 0x00, 0x00, 0x00,
|
|
|
- 0xFF, 0x00, 0xFF, 0x00, 0x00, 0x00, 0x00},
|
|
|
- {0xFF, 0xC0, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xC0, 0x00, 0x00,
|
|
|
- 0x00, 0x00, 0xFF, 0xFF, 0x00, 0xFF, 0x00, 0x00, 0x00, 0x00},
|
|
|
- {0xFF, 0xC0, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xC0, 0x00, 0x00,
|
|
|
- 0x00, 0x00, 0xFF, 0xFF, 0x00, 0xFF, 0x00, 0x00, 0x00, 0x00},
|
|
|
- {0xFF, 0xC0, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xC0, 0x00, 0x00,
|
|
|
- 0x00, 0x00, 0xFF, 0x00, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00},
|
|
|
+ {
|
|
|
+ 0xFF, 0xC0, 0x00, 0x00, 0x00, 0x00,
|
|
|
+ 0xFF, 0xC0, 0x00, 0x00, 0x00, 0x00,
|
|
|
+ 0xFF, 0x00,
|
|
|
+ 0xFF, 0x00, 0x00, 0x00, 0x00
|
|
|
+ },
|
|
|
+ {
|
|
|
+ 0xFF, 0xC0, 0x00, 0x00, 0x00, 0x00,
|
|
|
+ 0xFF, 0xC0, 0x00, 0x00, 0x00, 0x00, 0xFF,
|
|
|
+ 0xFF, 0x00,
|
|
|
+ 0xFF, 0x00, 0x00, 0x00, 0x00
|
|
|
+ },
|
|
|
+ {
|
|
|
+ 0xFF, 0xC0, 0x00, 0x00, 0x00, 0x00,
|
|
|
+ 0xFF, 0xC0, 0x00, 0x00, 0x00, 0x00, 0xFF,
|
|
|
+ 0xFF, 0x00,
|
|
|
+ 0xFF, 0x00, 0x00, 0x00, 0x00
|
|
|
+ },
|
|
|
+ {
|
|
|
+ 0xFF, 0xC0, 0x00, 0x00, 0x00, 0x00,
|
|
|
+ 0xFF, 0xC0, 0x00, 0x00, 0x00, 0x00,
|
|
|
+ 0xFF, 0x00,
|
|
|
+ 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00
|
|
|
+ },
|
|
|
};
|
|
|
|
|
|
static const uint8_t mask_cmp[][MAX_CMP_SIZE] = {
|
|
@@ -167,18 +218,24 @@ static const uint8_t mask_cmp[][MAX_CMP_SIZE] = {
|
|
|
* 75 14 jnz short loc_754CD9E1
|
|
|
* 68 F9 19 00 00 push 19F9h
|
|
|
*/
|
|
|
- {0x8B, 0x80, 0x00, 0x00, 0x00, 0x00, 0x39, 0x80, 0x00, 0x00, 0x00, 0x00,
|
|
|
- 0x75, 0x00, 0x68, 0x00, 0x00, 0x00, 0x00},
|
|
|
-
|
|
|
+ {
|
|
|
+ 0x8B, 0x80, 0x00, 0x00, 0x00, 0x00,
|
|
|
+ 0x39, 0x80, 0x00, 0x00, 0x00, 0x00,
|
|
|
+ 0x75, 0x00,
|
|
|
+ 0x68, 0x00, 0x00, 0x00, 0x00
|
|
|
+ },
|
|
|
/* Windows 10 Creator's Update+
|
|
|
* 8B 86 F8 2B 00 00 mov eax, [esi+2BF8h]
|
|
|
* 83 B8 00 4D 00 00 00 cmp dword ptr [eax+4D00h], 0
|
|
|
* 75 0F jnz short loc_100D793C
|
|
|
* 68 C3 1A 00 00 push 1AC3h
|
|
|
*/
|
|
|
- {0x8B, 0x80, 0x00, 0x00, 0x00, 0x00, 0x83, 0x80, 0x00, 0x00,
|
|
|
- 0x00, 0x00, 0x00, 0x75, 0x00, 0x68, 0x00, 0x00, 0x00, 0x00},
|
|
|
-
|
|
|
+ {
|
|
|
+ 0x8B, 0x80, 0x00, 0x00, 0x00, 0x00,
|
|
|
+ 0x83, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00,
|
|
|
+ 0x75, 0x00,
|
|
|
+ 0x68, 0x00, 0x00, 0x00, 0x00
|
|
|
+ },
|
|
|
/*
|
|
|
* Windows 10 April 2018 Update
|
|
|
* 8B 86 68 2B 00 00 mov eax, [esi+2B68h]
|
|
@@ -186,9 +243,12 @@ static const uint8_t mask_cmp[][MAX_CMP_SIZE] = {
|
|
|
* 75 0F jnz short loc_100D9A9C
|
|
|
* BA 08 71 01 10 mov edx, offset errMsg
|
|
|
*/
|
|
|
- {0x8B, 0x80, 0x00, 0x00, 0x00, 0x00, 0x83, 0x80, 0x00, 0x00,
|
|
|
- 0x00, 0x00, 0x00, 0x75, 0x00, 0xBA, 0x00, 0x00, 0x00, 0x00},
|
|
|
-
|
|
|
+ {
|
|
|
+ 0x8B, 0x80, 0x00, 0x00, 0x00, 0x00,
|
|
|
+ 0x83, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00,
|
|
|
+ 0x75, 0x00,
|
|
|
+ 0xBA, 0x00, 0x00, 0x00, 0x00
|
|
|
+ },
|
|
|
/*
|
|
|
* Windows 11 22H2
|
|
|
* 8b 83 3c 2b 00 00 MOV EAX,dword ptr [EBX + 0x2b3c]
|
|
@@ -196,9 +256,14 @@ static const uint8_t mask_cmp[][MAX_CMP_SIZE] = {
|
|
|
* 75 0f JNZ LAB_100d79a0
|
|
|
* ba d0 c6 00 10 MOV EDX,s_To_use_...
|
|
|
*/
|
|
|
- {0x8B, 0x80, 0x00, 0x00, 0x00, 0x00, 0x39, 0x80, 0x00, 0x00,
|
|
|
- 0x00, 0x00, 0x75, 0x00, 0xBA, 0x00, 0x00, 0x00, 0x00, 0x00},
|
|
|
+ {
|
|
|
+ 0x8B, 0x80, 0x00, 0x00, 0x00, 0x00,
|
|
|
+ 0x39, 0x80, 0x00, 0x00, 0x00, 0x00,
|
|
|
+ 0x75, 0x00,
|
|
|
+ 0xBA, 0x00, 0x00, 0x00, 0x00, 0x00
|
|
|
+ },
|
|
|
};
|
|
|
+// clang-format on
|
|
|
|
|
|
// Offset into the code for the numbers we're interested in
|
|
|
static const uint32_t code_offsets[][2] = {
|