From f9bc8ddd24db0881113f88e3986503d40b6cac0f Mon Sep 17 00:00:00 2001 From: lliiooll Date: Mon, 6 Jan 2025 12:18:49 +0800 Subject: [PATCH] fix: RecallC2cSysMsg --- app/src/main/cpp/ntkernel/NtRecallMsgHook.cc | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/app/src/main/cpp/ntkernel/NtRecallMsgHook.cc b/app/src/main/cpp/ntkernel/NtRecallMsgHook.cc index f5b0b065b7..0e3b8c38dc 100644 --- a/app/src/main/cpp/ntkernel/NtRecallMsgHook.cc +++ b/app/src/main/cpp/ntkernel/NtRecallMsgHook.cc @@ -81,11 +81,11 @@ bool PerformNtRecallMsgHook(uint64_t baseAddress) { gLibkernelBaseAddress = reinterpret_cast(baseAddress); //@formatter:off - // RecallC2cSysMsg 09 8d 40 f8 f5 03 00 aa 21 00 80 52 f3 03 02 aa 29 ?? 40 f9 + // RecallC2cSysMsg 09 8d 40 f8 ?? 03 00 aa 21 00 80 52 f3 03 02 aa 29 ?? 40 f9 auto targetRecallC2cSysMsg = AobScanTarget() .WithName("RecallC2cSysMsg") - .WithSequence({0x09, 0x8d, 0x40, 0xf8, 0xf5, 0x03, 0x00, 0xaa, 0x21, 0x00, 0x80, 0x52, 0xf3, 0x03, 0x02, 0xaa, 0x29, 0x00, 0x40, 0xf9}) - .WithMask( {0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x00, 0xff, 0xff}) + .WithSequence({0x09, 0x8d, 0x40, 0xf8, 0xf6, 0x03, 0x00, 0xaa, 0x21, 0x00, 0x80, 0x52, 0xf3, 0x03, 0x02, 0xaa, 0x29, 0x00, 0x40, 0xf9}) + .WithMask( {0xff, 0xff, 0xff, 0xff, 0x00, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x00, 0xff, 0xff}) .WithStep(4) .WithExecMemOnly(true) .WithOffsetsForResult({-0x20, -0x24, -0x28})