win-capture: Update D3D9 signature for Win10 April 2018 Update

This commit is contained in:
Richard Stanway
2018-05-02 13:07:35 +02:00
parent cf35f15042
commit 4df7914767

View File

@@ -95,7 +95,13 @@ static const uint8_t mask[][MAX_CMP_SIZE] = {
0xFF, 0xC0, 0x00, 0x00, 0x00, 0x00,
0xFF, 0x00,
0xF8, 0xF8, 0x00, 0x00, 0x00, 0x00
}
},
{
0xF8, 0xFF, 0xC0, 0x00, 0x00, 0x00, 0x00,
0xFF, 0xC0, 0x00, 0x00, 0x00, 0x00,
0xFF, 0x00,
0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00
},
};
static const uint8_t mask_cmp[][MAX_CMP_SIZE] = {
@@ -124,6 +130,21 @@ static const uint8_t mask_cmp[][MAX_CMP_SIZE] = {
0x39, 0x80, 0x00, 0x00, 0x00, 0x00,
0x75, 0x00,
0x40, 0xB8, 0x00, 0x00, 0x00, 0x00
},
/*
* Windows 10 April 2018
* 49 8B 87 58 40 00 00 mov rax, [r15+4058h]
* 39 98 C0 53 00 00 cmp [rax+53C0h], ebx
* 75 12 jnz short loc_1800A7FEC
* 48 8D 15 7F B6 09 00 lea rdx, addrErrorMsg
*
* Note: different instructions, last byte skipped due to MAX_CMP_SIZE
*/
{
0x48, 0x8B, 0x80, 0x00, 0x00, 0x00, 0x00,
0x39, 0x80, 0x00, 0x00, 0x00, 0x00,
0x75, 0x00,
0x48, 0x8D, 0x00, 0x00, 0x00, 0x00
}
};
@@ -131,6 +152,7 @@ static const uint8_t mask_cmp[][MAX_CMP_SIZE] = {
static const uint32_t code_offsets[][2] = {
{3, 10},
{3, 9},
{3, 9},
};
#else
@@ -148,7 +170,13 @@ static const uint8_t mask[][MAX_CMP_SIZE] = {
0xFF, 0xC0, 0x00, 0x00, 0x00, 0x00, 0xFF,
0xFF, 0x00,
0xFF, 0x00, 0x00, 0x00, 0x00
}
},
{
0xFF, 0xC0, 0x00, 0x00, 0x00, 0x00,
0xFF, 0xC0, 0x00, 0x00, 0x00, 0x00, 0xFF,
0xFF, 0x00,
0xFF, 0x00, 0x00, 0x00, 0x00
},
};
static const uint8_t mask_cmp[][MAX_CMP_SIZE] = {
@@ -177,6 +205,20 @@ static const uint8_t mask_cmp[][MAX_CMP_SIZE] = {
0x83, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00,
0x75, 0x00,
0x68, 0x00, 0x00, 0x00, 0x00
},
/*
* Windows 10 April 2018 Update
* 8B 86 68 2B 00 00 mov eax, [esi+2B68h]
* 83 B8 F4 4D 00 00 00 cmp dword ptr [eax+4DF4h], 0
* 75 0F jnz short loc_100D9A9C
* BA 08 71 01 10 mov edx, offset errMsg
*/
{
0x8B, 0x80, 0x00, 0x00, 0x00, 0x00,
0x83, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00,
0x75, 0x00,
0xBA, 0x00, 0x00, 0x00, 0x00
}
};
@@ -184,6 +226,7 @@ static const uint8_t mask_cmp[][MAX_CMP_SIZE] = {
static const uint32_t code_offsets[][2] = {
{2, 8},
{2, 8},
{2, 8},
};
#endif