From 96d4963092cd063823ba1421a2d1a833eaf779c2 Mon Sep 17 00:00:00 2001 From: xerox Date: Sat, 3 Oct 2020 09:14:53 +0000 Subject: [PATCH] Update README.md --- README.md | 42 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 42 insertions(+) diff --git a/README.md b/README.md index b789149..7680770 100644 --- a/README.md +++ b/README.md @@ -29,6 +29,48 @@ Deep in this structure is a linear virtual address to the current cores VMCB. The payload for AMD is also just a cpuid interception example. +``` +#if WINVER == 2004 +#define offset_vmcb_base 0x103B0 +#define offset_vmcb_link 0x198 +#define offset_vmcb 0xE80 +#elif WINVER == 1909 +#define offset_vmcb_base 0x83B0 +#define offset_vmcb_link 0x190 +#define offset_vmcb 0xD00 +#elif WINVER == 1903 +#define offset_vmcb_base 0x83B0 +#define offset_vmcb_link 0x190 +#define offset_vmcb 0xD00 +#elif WINVER == 1809 +#define offset_vmcb_base 0x83B0 +#define offset_vmcb_link 0x198 +#define offset_vmcb 0xD00 +#elif WINVER == 1803 +#define offset_vmcb_base 0x82F0 +#define offset_vmcb_link 0x168 +#define offset_vmcb 0xCC0 +#elif WINVER == 1709 +#define offset_vmcb_base 0x82F0 +#define offset_vmcb_link 0x88 +#define offset_vmcb 0xC80 +#elif WINVER == 1703 +#define offset_vmcb_base 0x82F0 +#define offset_vmcb_link 0x80 +#define offset_vmcb 0xBC0 +#elif WINVER == 1607 +#define offset_vmcb_base 0x82F0 +#define offset_vmcb_link 0x90 +#define offset_vmcb 0xBC0 +#elif WINVER == 1511 +#define offset_vmcb_base 0x82F0 +#define offset_vmcb_link 0x90 +#define offset_vmcb 0xC40 +#endif +``` + +Ill probably end up sig scanning for these offsets/resolving them at runtime when i condense this project down to a single solution. + # Versions & Support :o: -> unknown/not tested.