Skip to content

添加了新版本HalpOriginalPerformanceCounter的检测逻辑 - #8

Open
SamsungSHC wants to merge 2 commits into
zhutingxf:mainfrom
SamsungSHC:main
Open

添加了新版本HalpOriginalPerformanceCounter的检测逻辑#8
SamsungSHC wants to merge 2 commits into
zhutingxf:mainfrom
SamsungSHC:main

Conversation

@SamsungSHC

Copy link
Copy Markdown

如题。在Windows 11 Build 29648 Insider(虚拟机)中此项目已不可用,我扫描了此版本ntoskrnl的特征码并添加逻辑,该分支已可以在29648正常挂钩

Added additional pattern search for HalpOriginalPerformanceCounter in Windows 11 build 29648.

@SamsungSHC SamsungSHC left a comment

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

不好意思,我对git不熟,我在vs改完直接扔过来了!
具体修改在现在的429~438行

if (!addressHalpOriginalPerformanceCounter)
{
//在Win11 29648 反汇编得到的特征码
addressHalpOriginalPerformanceCounter = KUtils::FindPatternImage(ntoskrnl,
"\x48\xF7\xE2\x4C\x03\xDA\x48\x8B\x05\x00\x00\x00\x00\x48\x3B\xF0",
"xxxxxxxxx????xxx");
if (addressHalpOriginalPerformanceCounter)
{
addressHalpOriginalPerformanceCounter += 6;
}

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant