search

llccd / RDPWrapOffsetFinder

Automatically find rdpwrap offsets
83 stars 8 forks source link

Can't find SLInit on 10.0.10240.20708 #15

Closed loyejaotdiqr47123 closed 3 months ago

loyejaotdiqr47123 commented 3 months ago

(only nosymbol mode error termsrv_10.0.10240.20708.zip image

loyejaotdiqr47123 commented 3 months ago

@llccd

loyejaotdiqr47123 commented 3 months ago

Try fix it.....

if (!*current && instruction.mnemonic == ZYDIS_MNEMONIC_MOV &&
                operands[0].type == ZYDIS_OPERAND_TYPE_MEMORY &&
                operands[0].mem.base == ZYDIS_REGISTER_RIP &&
                operands[0].mem.disp.size != 0 &&
                operands[1].type == ZYDIS_OPERAND_TYPE_REGISTER &&
                ((operands[1].reg.value == ZYDIS_REGISTER_EAX) || (operands[1].reg.value == ZYDIS_REGISTER_R14D)))
                *current = operands[0].mem.disp.value + IP - base;
bServerSku.x64=F13B8
ERROR: bRemoteConnAllowed not found
ERROR: bFUSEnabled not found
ERROR: bAppServerAllowed not found
ERROR: bMultimonAllowed not found
ERROR: lMaxUserSessions not found
ERROR: ulMaxDebugSessions not found
ERROR: bInitialized not found
llccd commented 3 months ago

fixed in e14adab