Skip to content

Commit

Permalink
Validate SetPreferredAppMode() in ARM64 with ADRP instruction instead
Browse files Browse the repository at this point in the history
  • Loading branch information
hmartinez82 authored and HannesWell committed May 8, 2024
1 parent 3e830bf commit 5c7ff48
Showing 1 changed file with 1 addition and 1 deletion.
Original file line number Diff line number Diff line change
Expand Up @@ -234,7 +234,7 @@ BOOL Validate_SetPreferredAppMode(const BYTE* functionPtr)
(functionPtr[0x06] == 0x87) && (functionPtr[0x07] == 0x0D) && // xchg ecx,dword ptr [uxtheme!g_preferredAppMode]
(functionPtr[0x0C] == 0xC3); // ret
#elif defined(_M_ARM64)
if (*(const DWORD*)(&functionPtr[0x1C]) == 0x912F6100) // add x0,x8,#0xBD8
if ((functionPtr[0x10] & 0x1F) == 0x08 && (functionPtr[0x13] & 0x90) == 0x90) // adrp x8,wil::details::g_enabledStateManager+40h
{
return TRUE;
}
Expand Down

0 comments on commit 5c7ff48

Please sign in to comment.