Skip to content

Commit

Permalink
fix: RecallC2cSysMsg
Browse files Browse the repository at this point in the history
  • Loading branch information
lliioollcn committed Jan 6, 2025
1 parent 4be5740 commit f9bc8dd
Showing 1 changed file with 3 additions and 3 deletions.
6 changes: 3 additions & 3 deletions app/src/main/cpp/ntkernel/NtRecallMsgHook.cc
Original file line number Diff line number Diff line change
Expand Up @@ -81,11 +81,11 @@ bool PerformNtRecallMsgHook(uint64_t baseAddress) {
gLibkernelBaseAddress = reinterpret_cast<void*>(baseAddress);

//@formatter:off
// RecallC2cSysMsg 09 8d 40 f8 f5 03 00 aa 21 00 80 52 f3 03 02 aa 29 ?? 40 f9
// RecallC2cSysMsg 09 8d 40 f8 ?? 03 00 aa 21 00 80 52 f3 03 02 aa 29 ?? 40 f9
auto targetRecallC2cSysMsg = AobScanTarget()
.WithName("RecallC2cSysMsg")
.WithSequence({0x09, 0x8d, 0x40, 0xf8, 0xf5, 0x03, 0x00, 0xaa, 0x21, 0x00, 0x80, 0x52, 0xf3, 0x03, 0x02, 0xaa, 0x29, 0x00, 0x40, 0xf9})
.WithMask( {0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x00, 0xff, 0xff})
.WithSequence({0x09, 0x8d, 0x40, 0xf8, 0xf6, 0x03, 0x00, 0xaa, 0x21, 0x00, 0x80, 0x52, 0xf3, 0x03, 0x02, 0xaa, 0x29, 0x00, 0x40, 0xf9})
.WithMask( {0xff, 0xff, 0xff, 0xff, 0x00, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x00, 0xff, 0xff})
.WithStep(4)
.WithExecMemOnly(true)
.WithOffsetsForResult({-0x20, -0x24, -0x28})
Expand Down

0 comments on commit f9bc8dd

Please sign in to comment.