diff --git a/DeepSpaceNetwork/DeepSpaceNetwork.vcxproj b/DeepSpaceNetwork/DeepSpaceNetwork.vcxproj
new file mode 100644
index 0000000..9c6b0f9
--- /dev/null
+++ b/DeepSpaceNetwork/DeepSpaceNetwork.vcxproj
@@ -0,0 +1,157 @@
+
+
+
+
+ Debug
+ Win32
+
+
+ Release
+ Win32
+
+
+ Debug
+ x64
+
+
+ Release
+ x64
+
+
+
+ 16.0
+ Win32Proj
+ {09b41831-3164-48ad-8660-23457d82b73b}
+ DeepSpaceNetwork
+ 10.0
+
+
+
+ Application
+ true
+ v142
+ Unicode
+
+
+ Application
+ false
+ v142
+ true
+ Unicode
+
+
+ Application
+ true
+ v142
+ Unicode
+
+
+ Application
+ false
+ v142
+ true
+ Unicode
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ true
+
+
+ false
+
+
+ true
+
+
+ false
+
+
+
+ Level3
+ true
+ WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)
+ true
+
+
+ Console
+ true
+
+
+
+
+ Level3
+ true
+ true
+ true
+ WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)
+ true
+
+
+ Console
+ true
+ true
+ true
+
+
+
+
+ Level3
+ true
+ _DEBUG;_CONSOLE;%(PreprocessorDefinitions)
+ true
+
+
+ Console
+ true
+
+
+
+
+ Level3
+ true
+ true
+ true
+ NDEBUG;_CONSOLE;%(PreprocessorDefinitions)
+ true
+
+
+ Console
+ true
+ true
+ true
+
+
+
+
+
+
+
+ Document
+
+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/DeepSpaceNetwork/DeepSpaceNetwork.vcxproj.filters b/DeepSpaceNetwork/DeepSpaceNetwork.vcxproj.filters
new file mode 100644
index 0000000..83a07d5
--- /dev/null
+++ b/DeepSpaceNetwork/DeepSpaceNetwork.vcxproj.filters
@@ -0,0 +1,28 @@
+
+
+
+
+ {4FC737F1-C7A5-4376-A066-2A32D752A2FF}
+ cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx
+
+
+ {93995380-89BD-4b04-88EB-625FBE52EBFB}
+ h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd
+
+
+
+
+ Source Files
+
+
+
+
+ Source Files
+
+
+
+
+ Header Files
+
+
+
\ No newline at end of file
diff --git a/DeepSpaceNetwork/DeepSpaceNetwork.vcxproj.user b/DeepSpaceNetwork/DeepSpaceNetwork.vcxproj.user
new file mode 100644
index 0000000..88a5509
--- /dev/null
+++ b/DeepSpaceNetwork/DeepSpaceNetwork.vcxproj.user
@@ -0,0 +1,4 @@
+
+
+
+
\ No newline at end of file
diff --git a/DeepSpaceNetwork/com.asm b/DeepSpaceNetwork/com.asm
new file mode 100644
index 0000000..36e723c
--- /dev/null
+++ b/DeepSpaceNetwork/com.asm
@@ -0,0 +1,7 @@
+_text segment
+cpuid_test proc
+cpuid
+ret
+cpuid_test endp
+_text ends
+end
\ No newline at end of file
diff --git a/DeepSpaceNetwork/com.h b/DeepSpaceNetwork/com.h
new file mode 100644
index 0000000..1cce077
--- /dev/null
+++ b/DeepSpaceNetwork/com.h
@@ -0,0 +1,3 @@
+#pragma once
+#define VMEXIT_KEY 0xDEADBEEFDEADBEEF
+extern "C" size_t cpuid_test(size_t key);
\ No newline at end of file
diff --git a/DeepSpaceNetwork/main.cpp b/DeepSpaceNetwork/main.cpp
new file mode 100644
index 0000000..38a1166
--- /dev/null
+++ b/DeepSpaceNetwork/main.cpp
@@ -0,0 +1,8 @@
+#include
+#include "com.h"
+
+int main()
+{
+ std::printf("[+] hyper-v (CPUID) result -> 0x%x\n", cpuid_test(VMEXIT_KEY));
+ std::getchar();
+}
\ No newline at end of file
diff --git a/TheGoldenRecord/types.h b/TheGoldenRecord/types.h
index 82109ff..b1b7ebe 100644
--- a/TheGoldenRecord/types.h
+++ b/TheGoldenRecord/types.h
@@ -3,6 +3,7 @@
#include
#include
#define PORT_NUM 0x2F8
+#define WINVER 1709
#define DBG_PRINT(arg) \
__outbytestring(PORT_NUM, (unsigned char*)arg, sizeof arg);
@@ -31,7 +32,12 @@ typedef struct _context_t
__m128 xmm4;
__m128 xmm5;
} context_t, *pcontext_t;
+
+#if WINVER > 1803
using vmexit_handler_t = void (__fastcall*)(pcontext_t* context, void* unknown);
+#else
+using vmexit_handler_t = void(__fastcall*)(pcontext_t context, void* unknown);
+#endif
#pragma pack(push, 1)
typedef struct _VOYAGER_DATA_T
diff --git a/TheGoldenRecord/vmexit_handler.cpp b/TheGoldenRecord/vmexit_handler.cpp
index 4679157..1d2a33b 100644
--- a/TheGoldenRecord/vmexit_handler.cpp
+++ b/TheGoldenRecord/vmexit_handler.cpp
@@ -1,9 +1,38 @@
#include "types.h"
#include "ia32.hpp"
+#define VMEXIT_KEY 0xDEADBEEFDEADBEEF
+#if WINVER > 1803
void vmexit_handler(pcontext_t* context, void* unknown)
+#else
+void vmexit_handler(pcontext_t context, void* unknown)
+#endif
{
- //DBG_PRINT("vmexit called....\n");
+#if WINVER > 1803
+ pcontext_t guest_registers = *context;
+#else
+ pcontext_t guest_registers = context;
+#endif
+
+ size_t vmexit_reason;
+ __vmx_vmread(VMCS_EXIT_REASON, &vmexit_reason);
+ if (vmexit_reason == VMX_EXIT_REASON_EXECUTE_CPUID)
+ {
+ if (guest_registers->rcx == VMEXIT_KEY)
+ {
+ DBG_PRINT("got cpuid call...\n");
+ guest_registers->rax = 0xC0FFEE;
+
+ // advance rip, no one better execute cpuid instruction
+ // with 0xDEADBEEFDEADBEEF in RCX...
+ size_t rip, exec_len;
+ __vmx_vmread(VMCS_GUEST_RIP, &rip);
+ __vmx_vmread(VMCS_VMEXIT_INSTRUCTION_LENGTH, &exec_len);
+ __vmx_vmwrite(VMCS_GUEST_RIP, rip + exec_len);
+ return;
+ }
+ }
+
// when hyper-v gets remapped out of winload's context
// the linear virtual addresses change... thus an adjustment is required...
reinterpret_cast(
diff --git a/Voyager 1.sln b/Voyager 1.sln
index a6b592f..c3e4e00 100644
--- a/Voyager 1.sln
+++ b/Voyager 1.sln
@@ -7,6 +7,8 @@ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Voyager 1", "Voyager 1\Voya
EndProject
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "TheGoldenRecord", "TheGoldenRecord\TheGoldenRecord.vcxproj", "{223D1FDE-331E-4028-9083-1673A5161C99}"
EndProject
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "DeepSpaceNetwork", "DeepSpaceNetwork\DeepSpaceNetwork.vcxproj", "{09B41831-3164-48AD-8660-23457D82B73B}"
+EndProject
Global
GlobalSection(SolutionConfigurationPlatforms) = preSolution
Debug|ARM = Debug|ARM
@@ -55,6 +57,18 @@ Global
{223D1FDE-331E-4028-9083-1673A5161C99}.Release|x86.ActiveCfg = Release|Win32
{223D1FDE-331E-4028-9083-1673A5161C99}.Release|x86.Build.0 = Release|Win32
{223D1FDE-331E-4028-9083-1673A5161C99}.Release|x86.Deploy.0 = Release|Win32
+ {09B41831-3164-48AD-8660-23457D82B73B}.Debug|ARM.ActiveCfg = Debug|Win32
+ {09B41831-3164-48AD-8660-23457D82B73B}.Debug|ARM64.ActiveCfg = Debug|Win32
+ {09B41831-3164-48AD-8660-23457D82B73B}.Debug|x64.ActiveCfg = Debug|x64
+ {09B41831-3164-48AD-8660-23457D82B73B}.Debug|x64.Build.0 = Debug|x64
+ {09B41831-3164-48AD-8660-23457D82B73B}.Debug|x86.ActiveCfg = Debug|Win32
+ {09B41831-3164-48AD-8660-23457D82B73B}.Debug|x86.Build.0 = Debug|Win32
+ {09B41831-3164-48AD-8660-23457D82B73B}.Release|ARM.ActiveCfg = Release|Win32
+ {09B41831-3164-48AD-8660-23457D82B73B}.Release|ARM64.ActiveCfg = Release|Win32
+ {09B41831-3164-48AD-8660-23457D82B73B}.Release|x64.ActiveCfg = Release|x64
+ {09B41831-3164-48AD-8660-23457D82B73B}.Release|x64.Build.0 = Release|x64
+ {09B41831-3164-48AD-8660-23457D82B73B}.Release|x86.ActiveCfg = Release|Win32
+ {09B41831-3164-48AD-8660-23457D82B73B}.Release|x86.Build.0 = Release|Win32
EndGlobalSection
GlobalSection(SolutionProperties) = preSolution
HideSolutionNode = FALSE
diff --git a/Voyager 1/BootMgfw.c b/Voyager 1/BootMgfw.c
index a16d43d..b6d9b3a 100644
--- a/Voyager 1/BootMgfw.c
+++ b/Voyager 1/BootMgfw.c
@@ -62,8 +62,8 @@ EFI_STATUS EFIAPI InstallBootMgfwHooks(EFI_HANDLE BootMgfwPath)
FindPattern(
BootMgfw->ImageBase,
BootMgfw->ImageSize,
- START_BOOT_APPLICATION,
- "xxxxxxxxxxxxxxxxxxxxxxxx"
+ START_BOOT_APPLICATION_SIG,
+ START_BOOT_APPLICATION_MASK
);
Print(L"ArchStartBootApplication -> 0x%p\n", ArchStartBootApplication);
@@ -80,7 +80,7 @@ EFI_STATUS EFIAPI ArchStartBootApplicationHook(VOID* AppEntry, VOID* ImageBase,
ImageBase,
ImageSize,
ALLOCATE_IMAGE_BUFFER_SIG,
- "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
+ ALLOCATE_IMAGE_BUFFER_MASK
);
Print(L"PE PayLoad Size -> 0x%x\n", GetGoldenRecordSize());
diff --git a/Voyager 1/BootMgfw.h b/Voyager 1/BootMgfw.h
index b705250..1fed979 100644
--- a/Voyager 1/BootMgfw.h
+++ b/Voyager 1/BootMgfw.h
@@ -13,9 +13,16 @@
#include
#include "WinLoad.h"
-#define START_BOOT_APPLICATION "\x48\x8B\xC4\x48\x89\x58\x20\x44\x89\x40\x18\x48\x89\x50\x10\x48\x89\x48\x08\x55\x56\x57\x41\x54"
-#define WINDOWS_BOOTMGR_PATH L"\\efi\\microsoft\\boot\\bootmgfw.efi"
+#if WINVER > 1709
+#define START_BOOT_APPLICATION_SIG "\x48\x8B\xC4\x48\x89\x58\x20\x44\x89\x40\x18\x48\x89\x50\x10\x48\x89\x48\x08\x55\x56\x57\x41\x54"
+#define START_BOOT_APPLICATION_MASK "xxxxxxxxxxxxxxxxxxxxxxxx"
+#elif WINVER == 1709
+#define START_BOOT_APPLICATION_SIG "\x48\x8B\xC4\x48\x89\x58\x00\x44\x89\x40\x00\x48\x89\x50\x00\x48\x89\x48\x00\x55\x56\x57\x41\x54\x41\x55\x41\x56\x41\x57\x48\x8D\x68"
+#define START_BOOT_APPLICATION_MASK "xxxxxx?xxx?xxx?xxx?xxxxxxxxxxxxxx"
+#endif
+static_assert(sizeof(START_BOOT_APPLICATION_SIG) == sizeof(START_BOOT_APPLICATION_MASK), "signature and mask size's dont match...");
+#define WINDOWS_BOOTMGR_PATH L"\\efi\\microsoft\\boot\\bootmgfw.efi"
extern SHITHOOK BootMgfwShitHook;
typedef EFI_STATUS(EFIAPI* IMG_ARCH_START_BOOT_APPLICATION)(VOID*, VOID*, UINT32, UINT8, VOID*);
EFI_DEVICE_PATH* EFIAPI GetBootMgfwPath(VOID);
diff --git a/Voyager 1/Hvix64.c b/Voyager 1/Hvix64.c
index fbece3a..3922834 100644
--- a/Voyager 1/Hvix64.c
+++ b/Voyager 1/Hvix64.c
@@ -106,11 +106,13 @@ VOID MakeVoyagerData
.text:FFFFF80000237445 jmp loc_FFFFF80000237100
*/
+
UINT64 VmExitHandlerCall = ((UINT64)VmExitHandler) + 19; // + 19 bytes to -> call vmexit_c_handler
UINT64 VmExitHandlerCallRip = (UINT64)VmExitHandlerCall + 5; // + 5 bytes because "call vmexit_c_handler" is 5 bytes
UINT64 VmExitFunction = VmExitHandlerCallRip + *(INT32*)((UINT64)(VmExitHandlerCall + 1)); // + 1 to skip E8 (call) and read 4 bytes (RVA)
VoyagerData->VmExitHandlerRva = ((UINT64)GetGoldenRecordEntry(GoldenRecordAlloc)) - (UINT64)VmExitFunction;
+ DBG_PRINT("VmExitHandler -> 0x%p\n", VmExitHandler);
DBG_PRINT("VmExitHandlerRva -> 0x%x\n", VoyagerData->VmExitHandlerRva);
DBG_PRINT("VmExitFunction -> 0x%p\n", VmExitFunction);
DBG_PRINT("VmExitHandlerCallRip -> 0x%p\n", VmExitHandlerCallRip);
diff --git a/Voyager 1/Hvix64.h b/Voyager 1/Hvix64.h
index a4fec7a..e5209fe 100644
--- a/Voyager 1/Hvix64.h
+++ b/Voyager 1/Hvix64.h
@@ -8,14 +8,19 @@
#define VMEXIT_HANDLER_SIG "\x48\x8B\x4C\x24\x00\xEB\x07\xE8\x00\x00\x00\x00\xEB\xF2\x48\x8B\x54\x24\x00\xE8\x00\x00\x00\x00\xE9"
#define VMEXIT_HANDLER_MASK "xxxx?xxx????xxxxxx?x????x"
#elif WINVER == 1903
-#define VMEXIT_HANDLER_SIG
-#define VMEXIT_HANDLER_MASK
+#define VMEXIT_HANDLER_SIG "\x48\x8B\x4C\x24\x00\xEB\x07\xE8\x00\x00\x00\x00\xEB\xF2\x48\x8B\x54\x24\x00\xE8\x00\x00\x00\x00\xE9"
+#define VMEXIT_HANDLER_MASK "xxxx?xxx????xxxxxx?x????x"
#elif WINVER == 1809
-#define VMEXIT_HANDLER_SIG
-#define VMEXIT_HANDLER_MASK
+#define VMEXIT_HANDLER_SIG "\x48\x8B\x4C\x24\x00\xEB\x07\xE8\x00\x00\x00\x00\xEB\xF2\x48\x8B\x54\x24\x00\xE8\x00\x00\x00\x00\xE9"
+#define VMEXIT_HANDLER_MASK "xxxx?xxx????xxxxxx?x????x"
#elif WINVER == 1803
-#define VMEXIT_HANDLER_SIG
-#define VMEXIT_HANDLER_MASK
+#define VMEXIT_HANDLER_SIG "\xF2\x80\x3D\xFC\x12\x46\x00\x00\x0F\x84\x00\x00\x00\x00\x48\x8B\x54\x24\x00\xE8\x00\x00\x00\x00\xE9"
+#define VMEXIT_HANDLER_MASK "xxxxxxx?xx????xxxx?x????x"
+#elif WINVER == 1709
+#define VMEXIT_HANDLER_SIG "\xD0\x80\x3D\x78\x0A\x47\x00\x00\x0F\x84\x00\x00\x00\x00\x48\x8B\x54\x24\x00\xE8\x00\x00\x00\x00\xE9"
+#define VMEXIT_HANDLER_MASK "xxxxxx??xx????xxxx?x????x"
+#elif WINVER == 1703
+#elif WINVER == 1607
#endif
static_assert(sizeof(VMEXIT_HANDLER_SIG) == sizeof(VMEXIT_HANDLER_MASK), "signature does not match mask size!");
diff --git a/Voyager 1/TheGoldenRecord.c b/Voyager 1/TheGoldenRecord.c
index 10ccbcf..ce399d4 100644
--- a/Voyager 1/TheGoldenRecord.c
+++ b/Voyager 1/TheGoldenRecord.c
@@ -44,13 +44,13 @@ unsigned char GoldenRecord[3072] =
0x6A, 0xDE, 0x5F, 0x8E, 0xDC, 0xAF, 0x5D, 0x8F, 0x6A, 0xDE, 0x5F, 0x8E,
0x52, 0x69, 0x63, 0x68, 0x6B, 0xDE, 0x5F, 0x8E, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x50, 0x45, 0x00, 0x00, 0x64, 0x86, 0x05, 0x00,
- 0xF4, 0xE7, 0x6A, 0x5F, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0xF8, 0x21, 0x6C, 0x5F, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0xF0, 0x00, 0x22, 0x20, 0x0B, 0x02, 0x0E, 0x1B, 0x00, 0x02, 0x00, 0x00,
0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00,
0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80, 0x01, 0x00, 0x00, 0x00,
0x00, 0x10, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x0A, 0x00, 0x00, 0x00,
0x0A, 0x00, 0x00, 0x00, 0x0A, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
- 0x00, 0x60, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x64, 0x8F, 0x00, 0x00,
+ 0x00, 0x60, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x06, 0x3A, 0x00, 0x00,
0x01, 0x00, 0x60, 0x01, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
@@ -66,10 +66,10 @@ unsigned char GoldenRecord[3072] =
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x2E, 0x74, 0x65, 0x78, 0x74, 0x00, 0x00, 0x00,
- 0x34, 0x00, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00,
+ 0xD3, 0x00, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00,
0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x20, 0x00, 0x00, 0x68, 0x2E, 0x72, 0x64, 0x61,
- 0x74, 0x61, 0x00, 0x00, 0x20, 0x01, 0x00, 0x00, 0x00, 0x20, 0x00, 0x00,
+ 0x74, 0x61, 0x00, 0x00, 0x30, 0x01, 0x00, 0x00, 0x00, 0x20, 0x00, 0x00,
0x00, 0x02, 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x00, 0x00, 0x48,
0x2E, 0x64, 0x61, 0x74, 0x61, 0x00, 0x00, 0x00, 0x28, 0x00, 0x00, 0x00,
@@ -114,10 +114,23 @@ unsigned char GoldenRecord[3072] =
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x48, 0x89, 0x54, 0x24, 0x10, 0x48, 0x89, 0x4C,
- 0x24, 0x08, 0x48, 0x83, 0xEC, 0x38, 0x48, 0x8D, 0x05, 0xEB, 0xFF, 0xFF,
- 0xFF, 0x48, 0x2B, 0x05, 0xE4, 0x1F, 0x00, 0x00, 0x48, 0x89, 0x44, 0x24,
- 0x20, 0x48, 0x8B, 0x54, 0x24, 0x48, 0x48, 0x8B, 0x4C, 0x24, 0x40, 0xFF,
- 0x54, 0x24, 0x20, 0x48, 0x83, 0xC4, 0x38, 0xC3, 0x00, 0x00, 0x00, 0x00,
+ 0x24, 0x08, 0x56, 0x48, 0x83, 0xEC, 0x50, 0x48, 0x8B, 0x44, 0x24, 0x60,
+ 0x48, 0x89, 0x44, 0x24, 0x20, 0xB8, 0x02, 0x44, 0x00, 0x00, 0x0F, 0x78,
+ 0x44, 0x24, 0x28, 0x48, 0x83, 0x7C, 0x24, 0x28, 0x0A, 0x75, 0x64, 0x48,
+ 0x8B, 0x44, 0x24, 0x20, 0x48, 0xB9, 0xEF, 0xBE, 0xAD, 0xDE, 0xEF, 0xBE,
+ 0xAD, 0xDE, 0x48, 0x39, 0x48, 0x08, 0x75, 0x4F, 0x48, 0x8D, 0x05, 0x79,
+ 0x00, 0x00, 0x00, 0x66, 0xBA, 0xF8, 0x02, 0x48, 0x8B, 0xF0, 0xB9, 0x13,
+ 0x00, 0x00, 0x00, 0xF3, 0x6E, 0x48, 0x8B, 0x44, 0x24, 0x20, 0x48, 0xC7,
+ 0x00, 0xEE, 0xFF, 0xC0, 0x00, 0xB8, 0x1E, 0x68, 0x00, 0x00, 0x0F, 0x78,
+ 0x44, 0x24, 0x38, 0xB8, 0x0C, 0x44, 0x00, 0x00, 0x0F, 0x78, 0x44, 0x24,
+ 0x30, 0x48, 0x8B, 0x44, 0x24, 0x30, 0x48, 0x8B, 0x4C, 0x24, 0x38, 0x48,
+ 0x03, 0xC8, 0x48, 0x8B, 0xC1, 0xB9, 0x1E, 0x68, 0x00, 0x00, 0x0F, 0x79,
+ 0xC8, 0xEB, 0x21, 0x48, 0x8D, 0x05, 0x6A, 0xFF, 0xFF, 0xFF, 0x48, 0x2B,
+ 0x05, 0x63, 0x1F, 0x00, 0x00, 0x48, 0x89, 0x44, 0x24, 0x40, 0x48, 0x8B,
+ 0x54, 0x24, 0x68, 0x48, 0x8B, 0x4C, 0x24, 0x60, 0xFF, 0x54, 0x24, 0x40,
+ 0x48, 0x83, 0xC4, 0x50, 0x5E, 0xC3, 0xCC, 0xCC, 0xCC, 0xCC, 0xCC, 0xCC,
+ 0xCC, 0xCC, 0xCC, 0xCC, 0x67, 0x6F, 0x74, 0x20, 0x63, 0x70, 0x75, 0x69,
+ 0x64, 0x20, 0x63, 0x61, 0x6C, 0x6C, 0x2E, 0x2E, 0x2E, 0x0A, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
@@ -143,45 +156,32 @@ unsigned char GoldenRecord[3072] =
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
- 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
- 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
- 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
- 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
- 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
- 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
- 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
- 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
- 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
- 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
- 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
- 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
- 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
- 0x00, 0x00, 0x00, 0x00, 0xF4, 0xE7, 0x6A, 0x5F, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0xF8, 0x21, 0x6C, 0x5F, 0x00, 0x00, 0x00, 0x00,
0x02, 0x00, 0x00, 0x00, 0x59, 0x00, 0x00, 0x00, 0x38, 0x20, 0x00, 0x00,
- 0x38, 0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xF4, 0xE7, 0x6A, 0x5F,
- 0x00, 0x00, 0x00, 0x00, 0x0D, 0x00, 0x00, 0x00, 0x80, 0x00, 0x00, 0x00,
+ 0x38, 0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xF8, 0x21, 0x6C, 0x5F,
+ 0x00, 0x00, 0x00, 0x00, 0x0D, 0x00, 0x00, 0x00, 0x90, 0x00, 0x00, 0x00,
0x94, 0x20, 0x00, 0x00, 0x94, 0x06, 0x00, 0x00, 0x52, 0x53, 0x44, 0x53,
- 0xA4, 0x3E, 0xC7, 0x7A, 0x06, 0xD4, 0x85, 0x42, 0xB6, 0x5B, 0xEF, 0x6F,
- 0x7E, 0x70, 0x62, 0x84, 0x08, 0x00, 0x00, 0x00, 0x43, 0x3A, 0x5C, 0x55,
+ 0x04, 0x93, 0x33, 0xD0, 0x10, 0x9B, 0x4C, 0x45, 0xB2, 0x6C, 0xA7, 0x46,
+ 0x80, 0xBB, 0xAF, 0x4B, 0x0E, 0x00, 0x00, 0x00, 0x43, 0x3A, 0x5C, 0x55,
0x73, 0x65, 0x72, 0x73, 0x5C, 0x78, 0x65, 0x72, 0x6F, 0x78, 0x5C, 0x44,
0x65, 0x73, 0x6B, 0x74, 0x6F, 0x70, 0x5C, 0x76, 0x6F, 0x79, 0x61, 0x67,
0x65, 0x72, 0x2D, 0x31, 0x5C, 0x78, 0x36, 0x34, 0x5C, 0x52, 0x65, 0x6C,
0x65, 0x61, 0x73, 0x65, 0x5C, 0x54, 0x68, 0x65, 0x47, 0x6F, 0x6C, 0x64,
0x65, 0x6E, 0x52, 0x65, 0x63, 0x6F, 0x72, 0x64, 0x2E, 0x70, 0x64, 0x62,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00,
- 0x34, 0x00, 0x00, 0x00, 0x2E, 0x74, 0x65, 0x78, 0x74, 0x24, 0x6D, 0x6E,
- 0x00, 0x00, 0x00, 0x00, 0x00, 0x20, 0x00, 0x00, 0x38, 0x00, 0x00, 0x00,
- 0x2E, 0x72, 0x64, 0x61, 0x74, 0x61, 0x00, 0x00, 0x38, 0x20, 0x00, 0x00,
- 0xDC, 0x00, 0x00, 0x00, 0x2E, 0x72, 0x64, 0x61, 0x74, 0x61, 0x24, 0x7A,
- 0x7A, 0x7A, 0x64, 0x62, 0x67, 0x00, 0x00, 0x00, 0x14, 0x21, 0x00, 0x00,
- 0x0C, 0x00, 0x00, 0x00, 0x2E, 0x78, 0x64, 0x61, 0x74, 0x61, 0x00, 0x00,
- 0x00, 0x30, 0x00, 0x00, 0x28, 0x00, 0x00, 0x00, 0x2E, 0x62, 0x73, 0x73,
- 0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x00, 0x00, 0x0C, 0x00, 0x00, 0x00,
- 0x2E, 0x70, 0x64, 0x61, 0x74, 0x61, 0x00, 0x00, 0x00, 0x50, 0x00, 0x00,
- 0x6D, 0x00, 0x00, 0x00, 0x2E, 0x65, 0x64, 0x61, 0x74, 0x61, 0x00, 0x00,
- 0x02, 0x0E, 0x03, 0x00, 0x01, 0x16, 0x00, 0x06, 0x0E, 0x62, 0x00, 0x00,
- 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
- 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0xC0, 0x00, 0x00, 0x00, 0x2E, 0x74, 0x65, 0x78, 0x74, 0x24, 0x6D, 0x6E,
+ 0x00, 0x00, 0x00, 0x00, 0xC0, 0x10, 0x00, 0x00, 0x13, 0x00, 0x00, 0x00,
+ 0x2E, 0x74, 0x65, 0x78, 0x74, 0x24, 0x73, 0x00, 0x00, 0x20, 0x00, 0x00,
+ 0x38, 0x00, 0x00, 0x00, 0x2E, 0x72, 0x64, 0x61, 0x74, 0x61, 0x00, 0x00,
+ 0x38, 0x20, 0x00, 0x00, 0xEC, 0x00, 0x00, 0x00, 0x2E, 0x72, 0x64, 0x61,
+ 0x74, 0x61, 0x24, 0x7A, 0x7A, 0x7A, 0x64, 0x62, 0x67, 0x00, 0x00, 0x00,
+ 0x24, 0x21, 0x00, 0x00, 0x0C, 0x00, 0x00, 0x00, 0x2E, 0x78, 0x64, 0x61,
+ 0x74, 0x61, 0x00, 0x00, 0x00, 0x30, 0x00, 0x00, 0x28, 0x00, 0x00, 0x00,
+ 0x2E, 0x62, 0x73, 0x73, 0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x00, 0x00,
+ 0x0C, 0x00, 0x00, 0x00, 0x2E, 0x70, 0x64, 0x61, 0x74, 0x61, 0x00, 0x00,
+ 0x00, 0x50, 0x00, 0x00, 0x6D, 0x00, 0x00, 0x00, 0x2E, 0x65, 0x64, 0x61,
+ 0x74, 0x61, 0x00, 0x00, 0x02, 0x0F, 0x04, 0x00, 0x02, 0x16, 0x00, 0x06,
+ 0x0F, 0x92, 0x0B, 0x60, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
@@ -199,7 +199,7 @@ unsigned char GoldenRecord[3072] =
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00,
- 0x34, 0x10, 0x00, 0x00, 0x14, 0x21, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0xB6, 0x10, 0x00, 0x00, 0x24, 0x21, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
@@ -284,4 +284,4 @@ unsigned char GoldenRecord[3072] =
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
-};
+};
\ No newline at end of file
diff --git a/Voyager 1/Utils.h b/Voyager 1/Utils.h
index e02f80c..8b25594 100644
--- a/Voyager 1/Utils.h
+++ b/Voyager 1/Utils.h
@@ -1,6 +1,6 @@
#pragma once
#include "ShitHook.h"
-#define WINVER 1909 // can be 1909, 1903, 1809, or 1803
+#define WINVER 1709
#define PORT_NUM 0x2F8
#define BL_MEMORY_ATTRIBUTE_RWX 0x424000
#define SECTION_RWX (EFI_IMAGE_SCN_MEM_READ | EFI_IMAGE_SCN_MEM_WRITE | EFI_IMAGE_SCN_MEM_EXECUTE)
diff --git a/Voyager 1/WinLoad.c b/Voyager 1/WinLoad.c
index 289742f..9aacd55 100644
--- a/Voyager 1/WinLoad.c
+++ b/Voyager 1/WinLoad.c
@@ -56,6 +56,9 @@ EFI_STATUS EFIAPI BlLdrLoadImage(VOID* Arg1, CHAR16* ModulePath, CHAR16* ModuleN
GetGoldenRecordSize()
);
+ DBG_PRINT(".reloc section base address -> 0x%p\n", TableEntry->ModuleBase + pSection->VirtualAddress);
+ DBG_PRINT(".reloc section end (aka golden record base address) -> 0x%p\n", TableEntry->ModuleBase + pSection->VirtualAddress + pSection->Misc.VirtualSize);
+
VOID* VmExitHook = MapModule(&VoyagerData, GoldenRecord);
VOID* VmExitFunction = HookVmExit
(
diff --git a/Voyager 1/WinLoad.h b/Voyager 1/WinLoad.h
index 4583d87..2a3995d 100644
--- a/Voyager 1/WinLoad.h
+++ b/Voyager 1/WinLoad.h
@@ -6,7 +6,18 @@
extern SHITHOOK WinLoadImageShitHook;
extern SHITHOOK WinLoadAllocateImageHook;
+#if WINVER > 1803
#define ALLOCATE_IMAGE_BUFFER_SIG "\x48\x89\x5C\x24\x10\x48\x89\x74\x24\x18\x48\x89\x7C\x24\x20\x55\x41\x54\x41\x55\x41\x56\x41\x57\x48\x8B\xEC\x48\x83\xEC\x40\x48\x8B\x31\x4C\x8D\x7A\xFF\x45\x33\xED\x48\x89\x75"
+#define ALLOCATE_IMAGE_BUFFER_MASK "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
+#elif WINVER == 1803
+#define ALLOCATE_IMAGE_BUFFER_SIG "\x4C\x8B\xDC\x49\x89\x5B\x00\x49\x89\x73\x00\x55\x57\x41\x54\x41\x56\x41\x57\x48\x8B\xEC"
+#define ALLOCATE_IMAGE_BUFFER_MASK "xxxxxx?xxx?xxxxxxxxxxx"
+#elif WINVER == 1709
+#define ALLOCATE_IMAGE_BUFFER_SIG "\x4C\x8B\xDC\x49\x89\x5B\x00\x49\x89\x73\x00\x49\x89\x7B\x00\x55\x41\x54\x41\x55\x41\x56\x41\x57"
+#define ALLOCATE_IMAGE_BUFFER_MASK "xxxxxx?xxx?xxx?xxxxxxxxx"
+#endif
+
+static_assert(sizeof(ALLOCATE_IMAGE_BUFFER_SIG) == sizeof(ALLOCATE_IMAGE_BUFFER_MASK), "signature and mask do not match size!");
typedef UINT64 (EFIAPI* ALLOCATE_IMAGE_BUFFER)(VOID** imageBuffer, UINTN imageSize, UINT32 memoryType, UINT32 attributes, VOID* unused, UINT32 flags);
typedef EFI_STATUS (EFIAPI* LDR_LOAD_IMAGE)(VOID* Arg1, CHAR16* ModulePath, CHAR16* ModuleName, VOID* Arg4, VOID* Arg5, VOID* Arg6, VOID* Arg7, PPLDR_DATA_TABLE_ENTRY lplpTableEntry,
VOID* Arg9, VOID* Arg10, VOID* Arg11, VOID* Arg12, VOID* Arg13, VOID* Arg14, VOID* Arg15, VOID* Arg16);