From cb126aa6d46cf619e57c137b7c8b9b5167d2dd85 Mon Sep 17 00:00:00 2001 From: Christian E Date: Wed, 15 May 2019 02:32:15 +0200 Subject: [PATCH 01/17] INI: Add support for new windows 10 build 10.0.17763.437 (1809) & 10.0.17134.706 (1803) --- res/rdpwrap.ini | 577 +++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 576 insertions(+), 1 deletion(-) diff --git a/res/rdpwrap.ini b/res/rdpwrap.ini index 40e1b54..506b9cf 100644 --- a/res/rdpwrap.ini +++ b/res/rdpwrap.ini @@ -2,7 +2,7 @@ ; Do not modify without special knowledge [Main] -Updated=2018-10-10 +Updated=2019-04-19 LogFile=\rdpwrap.txt SLPolicyHookNT60=1 SLPolicyHookNT61=1 @@ -107,6 +107,20 @@ DefPolicyPatch.x64=1 DefPolicyOffset.x64=669CB DefPolicyCode.x64=CDefPolicy_Query_eax_rcx_jmp +[6.0.6003.20482] +SingleUserPatch.x86=1 +SingleUserOffset.x86=17FC4 +SingleUserCode.x86=nop +SingleUserPatch.x64=1 +SingleUserOffset.x64=71F8A +SingleUserCode.x64=Zero +DefPolicyPatch.x86=1 +DefPolicyOffset.x86=179DC +DefPolicyCode.x86=CDefPolicy_Query_edx_ecx +DefPolicyPatch.x64=1 +DefPolicyOffset.x64=66B65 +DefPolicyCode.x64=CDefPolicy_Query_eax_rcx_jmp + [6.1.7600.16385] SingleUserPatch.x86=1 SingleUserOffset.x86=19E25 @@ -289,6 +303,20 @@ DefPolicyPatch.x64=1 DefPolicyOffset.x64=17D2E DefPolicyCode.x64=CDefPolicy_Query_eax_rdi +[6.1.7601.24402] +SingleUserPatch.x86=1 +SingleUserOffset.x86=1A675 +SingleUserCode.x86=nop +SingleUserPatch.x64=1 +SingleUserOffset.x64=17F26 +SingleUserCode.x64=Zero +DefPolicyPatch.x86=1 +DefPolicyOffset.x86=19E41 +DefPolicyCode.x86=CDefPolicy_Query_eax_esi +DefPolicyPatch.x64=1 +DefPolicyOffset.x64=17CFE +DefPolicyCode.x64=CDefPolicy_Query_eax_rdi + [6.2.8102.0] SingleUserPatch.x86=1 SingleUserOffset.x86=F7E9 @@ -409,6 +437,27 @@ SLPolicyInternal.x64=1 SLPolicyOffset.x64=21FD0 SLPolicyFunc.x64=New_Win8SL +[6.2.9200.22715] +; x86-Offsets are not safe (determined without symbols) +SingleUserPatch.x86=1 +SingleUserOffset.x86=155B2 +SingleUserCode.x86=nop +SingleUserPatch.x64=1 +SingleUserOffset.x64=2BAE4 +SingleUserCode.x64=Zero +DefPolicyPatch.x86=1 +DefPolicyOffset.x86=13F68 +DefPolicyCode.x86=CDefPolicy_Query_eax_esi +DefPolicyPatch.x64=1 +DefPolicyOffset.x64=2A396 +DefPolicyCode.x64=CDefPolicy_Query_eax_rdi +SLPolicyInternal.x86=1 +SLPolicyOffset.x86=195B9 +SLPolicyFunc.x86=New_Win8SL +SLPolicyInternal.x64=1 +SLPolicyOffset.x64=21F90 +SLPolicyFunc.x64=New_Win8SL + [6.3.9431.0] LocalOnlyPatch.x86=1 LocalOnlyOffset.x86=8A611 @@ -617,6 +666,32 @@ SLInitHook.x64=1 SLInitOffset.x64=5D660 SLInitFunc.x64=New_CSLQuery_Initialize +[6.3.9600.19318] +LocalOnlyPatch.x86=1 +LocalOnlyOffset.x86=B43E8 +LocalOnlyCode.x86=jmpshort +LocalOnlyPatch.x64=1 +LocalOnlyOffset.x64=89EAC +LocalOnlyCode.x64=nopjmp +SingleUserPatch.x86=1 +SingleUserOffset.x86=3ED25 +SingleUserCode.x86=nop +SingleUserPatch.x64=1 +SingleUserOffset.x64=35779 +SingleUserCode.x64=Zero +DefPolicyPatch.x86=1 +DefPolicyOffset.x86=3D579 +DefPolicyCode.x86=CDefPolicy_Query_eax_ecx +DefPolicyPatch.x64=1 +DefPolicyOffset.x64=43CE5 +DefPolicyCode.x64=CDefPolicy_Query_eax_rcx +SLInitHook.x86=1 +SLInitOffset.x86=180F8 +SLInitFunc.x86=New_CSLQuery_Initialize +SLInitHook.x64=1 +SLInitOffset.x64=5C0D0 +SLInitFunc.x64=New_CSLQuery_Initialize + [6.4.9841.0] LocalOnlyPatch.x86=1 LocalOnlyOffset.x86=956A8 @@ -773,6 +848,32 @@ SLInitHook.x64=1 SLInitOffset.x64=250F0 SLInitFunc.x64=New_CSLQuery_Initialize +[10.0.10240.18186] +LocalOnlyPatch.x86=1 +LocalOnlyOffset.x86=A8048 +LocalOnlyCode.x86=jmpshort +LocalOnlyPatch.x64=1 +LocalOnlyOffset.x64=96A41 +LocalOnlyCode.x64=jmpshort +SingleUserPatch.x86=1 +SingleUserOffset.x86=32B15 +SingleUserCode.x86=nop +SingleUserPatch.x64=1 +SingleUserOffset.x64=17264 +SingleUserCode.x64=Zero +DefPolicyPatch.x86=1 +DefPolicyOffset.x86=2F699 +DefPolicyCode.x86=CDefPolicy_Query_eax_ecx +DefPolicyPatch.x64=1 +DefPolicyOffset.x64=EDC5 +DefPolicyCode.x64=CDefPolicy_Query_eax_rcx +SLInitHook.x86=1 +SLInitOffset.x86=3FA58 +SLInitFunc.x86=New_CSLQuery_Initialize +SLInitHook.x64=1 +SLInitOffset.x64=249D0 +SLInitFunc.x64=New_CSLQuery_Initialize + [10.0.10586.0] LocalOnlyPatch.x86=1 LocalOnlyOffset.x86=A7C18 @@ -1399,6 +1500,32 @@ SLInitHook.x64=1 SLInitOffset.x64=C920 SLInitFunc.x64=New_CSLQuery_Initialize +[10.0.14393.2906] +LocalOnlyPatch.x86=1 +LocalOnlyOffset.x86=A6578 +LocalOnlyCode.x86=jmpshort +LocalOnlyPatch.x64=1 +LocalOnlyOffset.x64=8D8A1 +LocalOnlyCode.x64=jmpshort +SingleUserPatch.x86=1 +SingleUserOffset.x86=36CE5 +SingleUserCode.x86=nop +SingleUserPatch.x64=1 +SingleUserOffset.x64=1B6A4 +SingleUserCode.x64=Zero +DefPolicyPatch.x86=1 +DefPolicyOffset.x86=31209 +DefPolicyCode.x86=CDefPolicy_Query_eax_ecx +DefPolicyPatch.x64=1 +DefPolicyOffset.x64=F185 +DefPolicyCode.x64=CDefPolicy_Query_eax_rcx +SLInitHook.x86=1 +SLInitOffset.x86=45912 +SLInitFunc.x86=New_CSLQuery_Initialize +SLInitHook.x64=1 +SLInitOffset.x64=22C80 +SLInitFunc.x64=New_CSLQuery_Initialize + [10.0.14901.1000] LocalOnlyPatch.x86=1 LocalOnlyOffset.x86=A6038 @@ -2157,6 +2284,32 @@ SLInitHook.x64=1 SLInitOffset.x64=234DC SLInitFunc.x64=New_CSLQuery_Initialize +[10.0.15063.1746] +LocalOnlyPatch.x86=1 +LocalOnlyOffset.x86=A60D8 +LocalOnlyCode.x86=jmpshort +LocalOnlyPatch.x64=1 +LocalOnlyOffset.x64=8CB21 +LocalOnlyCode.x64=jmpshort +SingleUserPatch.x86=1 +SingleUserOffset.x86=35CA5 +SingleUserCode.x86=nop +SingleUserPatch.x64=1 +SingleUserOffset.x64=15EA4 +SingleUserCode.x64=Zero +DefPolicyPatch.x86=1 +DefPolicyOffset.x86=30999 +DefPolicyCode.x86=CDefPolicy_Query_eax_ecx +DefPolicyPatch.x64=1 +DefPolicyOffset.x64=FAE5 +DefPolicyCode.x64=CDefPolicy_Query_eax_rcx +SLInitHook.x86=1 +SLInitOffset.x86=3F94D +SLInitFunc.x86=New_CSLQuery_Initialize +SLInitHook.x64=1 +SLInitOffset.x64=2328C +SLInitFunc.x64=New_CSLQuery_Initialize + [10.0.16179.1000] LocalOnlyPatch.x86=1 LocalOnlyOffset.x86=AA568 @@ -2703,6 +2856,32 @@ SLInitHook.x64=1 SLInitOffset.x64=22D5C SLInitFunc.x64=New_CSLQuery_Initialize +[10.0.16299.1087] +LocalOnlyPatch.x86=1 +LocalOnlyOffset.x86=A91F8 +LocalOnlyCode.x86=jmpshort +LocalOnlyPatch.x64=1 +LocalOnlyOffset.x64=8FC11 +LocalOnlyCode.x64=jmpshort +SingleUserPatch.x86=1 +SingleUserOffset.x86=392E5 +SingleUserCode.x86=nop +SingleUserPatch.x64=1 +SingleUserOffset.x64=1C774 +SingleUserCode.x64=Zero +DefPolicyPatch.x86=1 +DefPolicyOffset.x86=3DD39 +DefPolicyCode.x86=CDefPolicy_Query_eax_ecx +DefPolicyPatch.x64=1 +DefPolicyOffset.x64=12D85 +DefPolicyCode.x64=CDefPolicy_Query_eax_rcx +SLInitHook.x86=1 +SLInitOffset.x86=4626D +SLInitFunc.x86=New_CSLQuery_Initialize +SLInitHook.x64=1 +SLInitOffset.x64=22E4C +SLInitFunc.x64=New_CSLQuery_Initialize + [10.0.16353.1000] LocalOnlyPatch.x86=1 LocalOnlyOffset.x86=A9388 @@ -3015,6 +3194,46 @@ SLInitHook.x64=1 SLInitOffset.x64=22E6C SLInitFunc.x64=New_CSLQuery_Initialize +[10.0.17763.437] +LocalOnlyPatch.x64=1 +LocalOnlyOffset.x64=77A41 +LocalOnlyCode.x64=jmpshort +SingleUserPatch.x64=1 +SingleUserOffset.x64=3E520 +SingleUserCode.x64=Zero +DefPolicyPatch.x64=1 +DefPolicyOffset.x64=18025 +DefPolicyCode.x64=CDefPolicy_Query_eax_rcx +SLInitHook.x64=1 +SLInitOffset.x64=1ACDC +SLInitFunc.x64=New_CSLQuery_Initialize + +[10.0.17134.706] +LocalOnlyPatch.x86=1 +LocalOnlyOffset.x86=ADAB8 +LocalOnlyCode.x86=jmpshort +LocalOnlyPatch.x64=1 +LocalOnlyOffset.x64=92521 +LocalOnlyCode.x64=jmpshort +SingleUserPatch.x86=1 +SingleUserOffset.x86=36B1C +SingleUserCode.x86=nop +SingleUserPatch.x64=1 +SingleUserOffset.x64=1511C +SingleUserCode.x64=Zero +DefPolicyPatch.x86=1 +DefPolicyOffset.x86=33579 +DefPolicyCode.x86=CDefPolicy_Query_eax_ecx +DefPolicyPatch.x64=1 +DefPolicyOffset.x64=10E78 +DefPolicyCode.x64=CDefPolicy_Query_edi_rcx +SLInitHook.x86=1 +SLInitOffset.x86=475DD +SLInitFunc.x86=New_CSLQuery_Initialize +SLInitHook.x64=1 +SLInitOffset.x64=22F5C +SLInitFunc.x64=New_CSLQuery_Initialize + [10.0.17723.1000] LocalOnlyPatch.x64=1 LocalOnlyOffset.x64=75D91 @@ -3055,6 +3274,152 @@ SLInitHook.x64=1 SLInitOffset.x64=1ABFC SLInitFunc.x64=New_CSLQuery_Initialize +[10.0.17763.165] +LocalOnlyPatch.x64=1 +LocalOnlyOffset.x64=77941 +LocalOnlyCode.x64=jmpshort +SingleUserPatch.x64=1 +SingleUserOffset.x64=132F9 +SingleUserCode.x64=Zero +DefPolicyPatch.x64=1 +DefPolicyOffset.x64=17F45 +DefPolicyCode.x64=CDefPolicy_Query_eax_rcx +SLInitHook.x64=1 +SLInitOffset.x64=1ABFC +SLInitFunc.x64=New_CSLQuery_Initialize + +[10.0.17763.292] +LocalOnlyPatch.x86=1 +LocalOnlyOffset.x86=AFAD4 +LocalOnlyCode.x86=jmpshort +LocalOnlyPatch.x64=1 +LocalOnlyOffset.x64=77A11 +LocalOnlyCode.x64=jmpshort +SingleUserPatch.x86=1 +SingleUserOffset.x86=4D665 +SingleUserCode.x86=nop +SingleUserPatch.x64=1 +SingleUserOffset.x64=1322C +SingleUserCode.x64=Zero +DefPolicyPatch.x86=1 +DefPolicyOffset.x86=4BE69 +DefPolicyCode.x86=CDefPolicy_Query_eax_ecx +DefPolicyPatch.x64=1 +DefPolicyOffset.x64=17F45 +DefPolicyCode.x64=CDefPolicy_Query_eax_rcx +SLInitHook.x86=1 +SLInitOffset.x86=5B18A +SLInitFunc.x86=New_CSLQuery_Initialize +SLInitHook.x64=1 +SLInitOffset.x64=1ABFC +SLInitFunc.x64=New_CSLQuery_Initialize + +[10.0.17763.379] +LocalOnlyPatch.x86=1 +LocalOnlyOffset.x86=AFAD4 +LocalOnlyCode.x86=jmpshort +LocalOnlyPatch.x64=1 +LocalOnlyOffset.x64=77A11 +LocalOnlyCode.x64=jmpshort +SingleUserPatch.x86=1 +SingleUserOffset.x86=4D665 +SingleUserCode.x86=nop +SingleUserPatch.x64=1 +SingleUserOffset.x64=1322C +SingleUserCode.x64=Zero +DefPolicyPatch.x86=1 +DefPolicyOffset.x86=4BE69 +DefPolicyCode.x86=CDefPolicy_Query_eax_ecx +DefPolicyPatch.x64=1 +DefPolicyOffset.x64=17F45 +DefPolicyCode.x64=CDefPolicy_Query_eax_rcx +SLInitHook.x86=1 +SLInitOffset.x86=5B18A +SLInitFunc.x86=New_CSLQuery_Initialize +SLInitHook.x64=1 +SLInitOffset.x64=1ABFC +SLInitFunc.x64=New_CSLQuery_Initialize + +[10.0.17763.437] +LocalOnlyPatch.x64=1 +LocalOnlyOffset.x64=77A41 +LocalOnlyCode.x64=jmpshort +SingleUserPatch.x64=1 +SingleUserOffset.x64=1322C +SingleUserCode.x64=Zero +DefPolicyPatch.x64=1 +DefPolicyOffset.x64=18025 +DefPolicyCode.x64=CDefPolicy_Query_eax_rcx +SLInitHook.x64=1 +SLInitOffset.x64=1ACDC +SLInitFunc.x64=New_CSLQuery_Initialize +bInitialized.x64 =ECAB0 +bServerSku.x64 =ECAB4 +lMaxUserSessions.x64 =ECAB8 +bAppServerAllowed.x64 =ECAC0 +bRemoteConnAllowed.x64=ECAC4 +bMultimonAllowed.x64 =ECAC8 +ulMaxDebugSessions.x64=ECACC +bFUSEnabled.x64 =ECAD0 + +[10.0.17763.437-SLInit] +bInitialized.x86 =CD798 +bServerSku.x86 =CD79C +lMaxUserSessions.x86 =CD7A0 +bAppServerAllowed.x86 =CD7A8 +bRemoteConnAllowed.x86=CD7AC +bMultimonAllowed.x86 =CD7B0 +ulMaxDebugSessions.x86=CD7B4 +bFUSEnabled.x86 =CD7B8 +bInitialized.x64 =ECAB0 +bServerSku.x64 =ECAB4 +lMaxUserSessions.x64 =ECAB8 +bAppServerAllowed.x64 =ECAC0 +bRemoteConnAllowed.x64=ECAC4 +bMultimonAllowed.x64 =ECAC8 +ulMaxDebugSessions.x64=ECACC +bFUSEnabled.x64 =ECAD0 + +[10.0.17134.706] +LocalOnlyPatch.x86=1 +LocalOnlyOffset.x86=ADAB8 +LocalOnlyCode.x86=jmpshort +LocalOnlyPatch.x64=1 +LocalOnlyOffset.x64=92521 +LocalOnlyCode.x64=jmpshort +SingleUserPatch.x86=1 +SingleUserOffset.x86=36B1C +SingleUserCode.x86=nop +SingleUserPatch.x64=1 +SingleUserOffset.x64=1511C +SingleUserCode.x64=Zero +DefPolicyPatch.x86=1 +DefPolicyOffset.x86=33579 +DefPolicyCode.x86=CDefPolicy_Query_eax_ecx +DefPolicyPatch.x64=1 +DefPolicyOffset.x64=10E78 +DefPolicyCode.x64=CDefPolicy_Query_edi_rcx +SLInitHook.x86=1 +SLInitOffset.x86=475DD +SLInitFunc.x86=New_CSLQuery_Initialize +SLInitHook.x64=1 +SLInitOffset.x64=22F5C +SLInitFunc.x64=New_CSLQuery_Initialize + +[10.0.18362.1] +LocalOnlyPatch.x64=1 +LocalOnlyOffset.x64=82F35 +LocalOnlyCode.x64=jmpshort +SingleUserPatch.x64=1 +SingleUserOffset.x64=0DDC9 +SingleUserCode.x64=Zero +DefPolicyPatch.x64=1 +DefPolicyOffset.x64=1FE05 +DefPolicyCode.x64=CDefPolicy_Query_eax_rcx +SLInitHook.x64=1 +SLInitOffset.x64=22DCC +SLInitFunc.x64=New_CSLQuery_Initialize + [SLInit] bServerSku=1 bRemoteConnAllowed=1 @@ -3217,6 +3582,25 @@ bServerSku.x64 =FA068 ulMaxDebugSessions.x64=FA06C bRemoteConnAllowed.x64=FA070 +[6.3.9600.19318-SLInit] +bFUSEnabled.x86 =D4068 +lMaxUserSessions.x86 =D406C +bAppServerAllowed.x86 =D4070 +bInitialized.x86 =D4074 +bMultimonAllowed.x86 =D4078 +bServerSku.x86 =D407C +ulMaxDebugSessions.x86=D4080 +bRemoteConnAllowed.x86=D4084 + +bFUSEnabled.x64 =FA054 +lMaxUserSessions.x64 =FA058 +bAppServerAllowed.x64 =FA05C +bInitialized.x64 =FA060 +bMultimonAllowed.x64 =FA064 +bServerSku.x64 =FA068 +ulMaxDebugSessions.x64=FA06C +bRemoteConnAllowed.x64=FA070 + [6.4.9841.0-SLInit] bFUSEnabled.x86 =BF9F0 lMaxUserSessions.x86 =BF9F4 @@ -3331,6 +3715,25 @@ bMultimonAllowed.x64 =F3468 ulMaxDebugSessions.x64=F346C bRemoteConnAllowed.x64=F3470 +[10.0.10240.18186-SLInit] +bFUSEnabled.x86 =C4F88 +lMaxUserSessions.x86 =C4F8C +bAppServerAllowed.x86 =C4F90 +bInitialized.x86 =C4F94 +bMultimonAllowed.x86 =C4F98 +bServerSku.x86 =C4F9C +ulMaxDebugSessions.x86=C4FA0 +bRemoteConnAllowed.x86=C4FA4 + +lMaxUserSessions.x64 =F23B0 +bAppServerAllowed.x64 =F23B4 +bServerSku.x64 =F23B8 +bFUSEnabled.x64 =F3460 +bInitialized.x64 =F3464 +bMultimonAllowed.x64 =F3468 +ulMaxDebugSessions.x64=F346C +bRemoteConnAllowed.x64=F3470 + [10.0.10586.0-SLInit] bFUSEnabled.x86 =C3F60 lMaxUserSessions.x86 =C3F64 @@ -3788,6 +4191,25 @@ bMultimonAllowed.x64 =E8478 ulMaxDebugSessions.x64=E847C bFUSEnabled.x64 =E8480 +[10.0.14393.2906-SLInit] +bInitialized.x86 =C2F94 +bServerSku.x86 =C2F98 +lMaxUserSessions.x86 =C2F9C +bAppServerAllowed.x86 =C2FA0 +bRemoteConnAllowed.x86=C2FA4 +bMultimonAllowed.x86 =C2FA8 +ulMaxDebugSessions.x86=C2FAC +bFUSEnabled.x86 =C2FB0 + +bServerSku.x64 =E73D0 +lMaxUserSessions.x64 =E73D4 +bAppServerAllowed.x64 =E73D8 +bInitialized.x64 =E8470 +bRemoteConnAllowed.x64=E8474 +bMultimonAllowed.x64 =E8478 +ulMaxDebugSessions.x64=E847C +bFUSEnabled.x64 =E8480 + [10.0.14901.1000-SLInit] bInitialized.x86 =C1F6C bServerSku.x86 =C1F70 @@ -4341,6 +4763,25 @@ bServerSku.x64 =E9484 lMaxUserSessions.x64 =E9488 bAppServerAllowed.x64 =E948C +[10.0.15063.1746-SLInit] +bInitialized.x86 =C3F98 +bServerSku.x86 =C3F9C +lMaxUserSessions.x86 =C3FA0 +bAppServerAllowed.x86 =C3FA4 +bRemoteConnAllowed.x86=C3FA8 +bMultimonAllowed.x86 =C3FAC +ulMaxDebugSessions.x86=C3FB0 +bFUSEnabled.x86 =C3FB4 + +bInitialized.x64 =E9468 +bRemoteConnAllowed.x64=E946C +bMultimonAllowed.x64 =E9470 +ulMaxDebugSessions.x64=E9474 +bFUSEnabled.x64 =E9478 +bServerSku.x64 =E9484 +lMaxUserSessions.x64 =E9488 +bAppServerAllowed.x64 =E948C + [10.0.16179.1000-SLInit] bInitialized.x86 =C7F6C bServerSku.x86 =C7F70 @@ -4740,6 +5181,25 @@ bMultimonAllowed.x64 =EE4A8 ulMaxDebugSessions.x64=EE4AC bFUSEnabled.x64 =EE4B0 +[10.0.16299.1087-SLInit] +bInitialized.x86 =C6F7C +bServerSku.x86 =C6F80 +lMaxUserSessions.x86 =C6F84 +bAppServerAllowed.x86 =C6F88 +bRemoteConnAllowed.x86=C6F8C +bMultimonAllowed.x86 =C6F90 +ulMaxDebugSessions.x86=C6F94 +bFUSEnabled.x86 =C6F98 + +bServerSku.x64 =ED3E8 +lMaxUserSessions.x64 =ED3EC +bAppServerAllowed.x64 =ED3F0 +bInitialized.x64 =EE4A0 +bRemoteConnAllowed.x64=EE4A4 +bMultimonAllowed.x64 =EE4A8 +ulMaxDebugSessions.x64=EE4AC +bFUSEnabled.x64 =EE4B0 + [10.0.16353.1000-SLInit] bInitialized.x86 =C6F7C bServerSku.x86 =C6F80 @@ -4968,6 +5428,25 @@ bMultimonAllowed.x64 =F2438 ulMaxDebugSessions.x64=F243C bFUSEnabled.x64 =F2440 +[10.0.17134.706-SLInit] +bInitialized.x86 =CBF38 +bServerSku.x86 =CBF3C +lMaxUserSessions.x86 =CBF40 +bAppServerAllowed.x86 =CBF44 +bRemoteConnAllowed.x86=CBF48 +bMultimonAllowed.x86 =CBF4C +ulMaxDebugSessions.x86=CBF50 +bFUSEnabled.x86 =CBF54 + +bServerSku.x64 =F1378 +lMaxUserSessions.x64 =F137C +bAppServerAllowed.x64 =F1380 +bInitialized.x64 =F2430 +bRemoteConnAllowed.x64=F2434 +bMultimonAllowed.x64 =F2438 +ulMaxDebugSessions.x64=F243C +bFUSEnabled.x64 =F2440 + [10.0.17723.1000-SLInit] bInitialized.x64 =E9AB0 bServerSku.x64 =E9AB4 @@ -4996,3 +5475,99 @@ bRemoteConnAllowed.x64=ECAC4 bMultimonAllowed.x64 =ECAC8 ulMaxDebugSessions.x64=ECACC bFUSEnabled.x64 =ECAD0 + +[10.0.17763.165-SLInit] +bInitialized.x64 =ECAB0 +bServerSku.x64 =ECAB4 +lMaxUserSessions.x64 =ECAB8 +bAppServerAllowed.x64 =ECAC0 +bRemoteConnAllowed.x64=ECAC4 +bMultimonAllowed.x64 =ECAC8 +ulMaxDebugSessions.x64=ECACC +bFUSEnabled.x64 =ECAD0 + +[10.0.17763.292-SLInit] +bInitialized.x86 =CD798 +bServerSku.x86 =CD79C +lMaxUserSessions.x86 =CD7A0 +bAppServerAllowed.x86 =CD7A8 +bRemoteConnAllowed.x86=CD7AC +bMultimonAllowed.x86 =CD7B0 +ulMaxDebugSessions.x86=CD7B4 +bFUSEnabled.x86 =CD7B8 + +bInitialized.x64 =ECAB0 +bServerSku.x64 =ECAB4 +lMaxUserSessions.x64 =ECAB8 +bAppServerAllowed.x64 =ECAC0 +bRemoteConnAllowed.x64=ECAC4 +bMultimonAllowed.x64 =ECAC8 +ulMaxDebugSessions.x64=ECACC +bFUSEnabled.x64 =ECAD0 + +[10.0.17763.379-SLInit] +bInitialized.x86 =CD798 +bServerSku.x86 =CD79C +lMaxUserSessions.x86 =CD7A0 +bAppServerAllowed.x86 =CD7A8 +bRemoteConnAllowed.x86=CD7AC +bMultimonAllowed.x86 =CD7B0 +ulMaxDebugSessions.x86=CD7B4 +bFUSEnabled.x86 =CD7B8 + +bInitialized.x64 =ECAB0 +bServerSku.x64 =ECAB4 +lMaxUserSessions.x64 =ECAB8 +bAppServerAllowed.x64 =ECAC0 +bRemoteConnAllowed.x64=ECAC4 +bMultimonAllowed.x64 =ECAC8 +ulMaxDebugSessions.x64=ECACC +bFUSEnabled.x64 =ECAD0 + +[10.0.17763.437-SLInit] +bInitialized.x86 =CD798 +bServerSku.x86 =CD79C +lMaxUserSessions.x86 =CD7A0 +bAppServerAllowed.x86 =CD7A8 +bRemoteConnAllowed.x86=CD7AC +bMultimonAllowed.x86 =CD7B0 +ulMaxDebugSessions.x86=CD7B4 +bFUSEnabled.x86 =CD7B8 + +bInitialized.x64 =ECAB0 +bServerSku.x64 =ECAB4 +lMaxUserSessions.x64 =ECAB8 +bAppServerAllowed.x64 =ECAC0 +bRemoteConnAllowed.x64=ECAC4 +bMultimonAllowed.x64 =ECAC8 +ulMaxDebugSessions.x64=ECACC +bFUSEnabled.x64 =ECAD0 + +[10.0.17134.706-SLInit] +bInitialized.x86 =CBF38 +bServerSku.x86 =CBF3C +lMaxUserSessions.x86 =CBF40 +bAppServerAllowed.x86 =CBF44 +bRemoteConnAllowed.x86=CBF48 +bMultimonAllowed.x86 =CBF4C +ulMaxDebugSessions.x86=CBF50 +bFUSEnabled.x86 =CBF54 + +bServerSku.x64 =F1378 +lMaxUserSessions.x64 =F137C +bAppServerAllowed.x64 =F1380 +bInitialized.x64 =F2430 +bRemoteConnAllowed.x64=F2434 +bMultimonAllowed.x64 =F2438 +ulMaxDebugSessions.x64=F243C +bFUSEnabled.x64 =F2440 + +[10.0.18362.1-SLInit] +bInitialized.x64 =F6A8C +bServerSku.x64 =F6A90 +lMaxUserSessions.x64 =F6A94 +bAppServerAllowed.x64 =F6A9C +bRemoteConnAllowed.x64=F6AA0 +bMultimonAllowed.x64 =F6AA4 +ulMaxDebugSessions.x64=F6AA8 +bFUSEnabled.x64 =F6AAC \ No newline at end of file From cb65dacba5ea00a5322209cf12c01d13da296650 Mon Sep 17 00:00:00 2001 From: David Refoua Date: Sun, 11 Aug 2019 10:29:55 +0430 Subject: [PATCH 02/17] remove duplicated entry --- res/rdpwrap.ini | 20 +++++--------------- 1 file changed, 5 insertions(+), 15 deletions(-) diff --git a/res/rdpwrap.ini b/res/rdpwrap.ini index 506b9cf..67c07f8 100644 --- a/res/rdpwrap.ini +++ b/res/rdpwrap.ini @@ -3194,20 +3194,6 @@ SLInitHook.x64=1 SLInitOffset.x64=22E6C SLInitFunc.x64=New_CSLQuery_Initialize -[10.0.17763.437] -LocalOnlyPatch.x64=1 -LocalOnlyOffset.x64=77A41 -LocalOnlyCode.x64=jmpshort -SingleUserPatch.x64=1 -SingleUserOffset.x64=3E520 -SingleUserCode.x64=Zero -DefPolicyPatch.x64=1 -DefPolicyOffset.x64=18025 -DefPolicyCode.x64=CDefPolicy_Query_eax_rcx -SLInitHook.x64=1 -SLInitOffset.x64=1ACDC -SLInitFunc.x64=New_CSLQuery_Initialize - [10.0.17134.706] LocalOnlyPatch.x86=1 LocalOnlyOffset.x86=ADAB8 @@ -3289,24 +3275,28 @@ SLInitOffset.x64=1ABFC SLInitFunc.x64=New_CSLQuery_Initialize [10.0.17763.292] +; Patch CEnforcementCore::GetInstanceOfTSLicense LocalOnlyPatch.x86=1 LocalOnlyOffset.x86=AFAD4 LocalOnlyCode.x86=jmpshort LocalOnlyPatch.x64=1 LocalOnlyOffset.x64=77A11 LocalOnlyCode.x64=jmpshort +; Patch CSessionArbitrationHelper::IsSingleSessionPerUserEnabled SingleUserPatch.x86=1 SingleUserOffset.x86=4D665 SingleUserCode.x86=nop SingleUserPatch.x64=1 SingleUserOffset.x64=1322C SingleUserCode.x64=Zero +; Patch CDefPolicy::Query DefPolicyPatch.x86=1 DefPolicyOffset.x86=4BE69 DefPolicyCode.x86=CDefPolicy_Query_eax_ecx DefPolicyPatch.x64=1 DefPolicyOffset.x64=17F45 DefPolicyCode.x64=CDefPolicy_Query_eax_rcx +; Hook CSLQuery::Initialize SLInitHook.x86=1 SLInitOffset.x86=5B18A SLInitFunc.x86=New_CSLQuery_Initialize @@ -5570,4 +5560,4 @@ bAppServerAllowed.x64 =F6A9C bRemoteConnAllowed.x64=F6AA0 bMultimonAllowed.x64 =F6AA4 ulMaxDebugSessions.x64=F6AA8 -bFUSEnabled.x64 =F6AAC \ No newline at end of file +bFUSEnabled.x64 =F6AAC From c19450787f0d7ebcae1ec06e2c07245ed2f04b4b Mon Sep 17 00:00:00 2001 From: David Refoua Date: Sun, 11 Aug 2019 10:39:47 +0430 Subject: [PATCH 03/17] removed another duplicated entry --- res/rdpwrap.ini | 22 ++++------------------ 1 file changed, 4 insertions(+), 18 deletions(-) diff --git a/res/rdpwrap.ini b/res/rdpwrap.ini index 67c07f8..fa9d6cf 100644 --- a/res/rdpwrap.ini +++ b/res/rdpwrap.ini @@ -3331,15 +3331,19 @@ SLInitOffset.x64=1ABFC SLInitFunc.x64=New_CSLQuery_Initialize [10.0.17763.437] +; Patch CEnforcementCore::GetInstanceOfTSLicense LocalOnlyPatch.x64=1 LocalOnlyOffset.x64=77A41 LocalOnlyCode.x64=jmpshort +; Patch CSessionArbitrationHelper::IsSingleSessionPerUserEnabled SingleUserPatch.x64=1 SingleUserOffset.x64=1322C SingleUserCode.x64=Zero +; Patch CDefPolicy::Query DefPolicyPatch.x64=1 DefPolicyOffset.x64=18025 DefPolicyCode.x64=CDefPolicy_Query_eax_rcx +; Hook CSLQuery::Initialize SLInitHook.x64=1 SLInitOffset.x64=1ACDC SLInitFunc.x64=New_CSLQuery_Initialize @@ -3352,24 +3356,6 @@ bMultimonAllowed.x64 =ECAC8 ulMaxDebugSessions.x64=ECACC bFUSEnabled.x64 =ECAD0 -[10.0.17763.437-SLInit] -bInitialized.x86 =CD798 -bServerSku.x86 =CD79C -lMaxUserSessions.x86 =CD7A0 -bAppServerAllowed.x86 =CD7A8 -bRemoteConnAllowed.x86=CD7AC -bMultimonAllowed.x86 =CD7B0 -ulMaxDebugSessions.x86=CD7B4 -bFUSEnabled.x86 =CD7B8 -bInitialized.x64 =ECAB0 -bServerSku.x64 =ECAB4 -lMaxUserSessions.x64 =ECAB8 -bAppServerAllowed.x64 =ECAC0 -bRemoteConnAllowed.x64=ECAC4 -bMultimonAllowed.x64 =ECAC8 -ulMaxDebugSessions.x64=ECACC -bFUSEnabled.x64 =ECAD0 - [10.0.17134.706] LocalOnlyPatch.x86=1 LocalOnlyOffset.x86=ADAB8 From 2741d7bea4923db481ce46916d88486d8cf15ed8 Mon Sep 17 00:00:00 2001 From: David Refoua Date: Fri, 16 Aug 2019 05:21:53 +0430 Subject: [PATCH 04/17] updated/added entries --- res/rdpwrap.ini | 205 ++++++++++++++++++++++++++++++++++++++---------- 1 file changed, 164 insertions(+), 41 deletions(-) diff --git a/res/rdpwrap.ini b/res/rdpwrap.ini index fa9d6cf..fccd441 100644 --- a/res/rdpwrap.ini +++ b/res/rdpwrap.ini @@ -2,7 +2,7 @@ ; Do not modify without special knowledge [Main] -Updated=2019-04-19 +Updated=2019-08-02 LogFile=\rdpwrap.txt SLPolicyHookNT60=1 SLPolicyHookNT61=1 @@ -3332,18 +3332,30 @@ SLInitFunc.x64=New_CSLQuery_Initialize [10.0.17763.437] ; Patch CEnforcementCore::GetInstanceOfTSLicense +LocalOnlyPatch.x86=1 +LocalOnlyOffset.x86=AFE24 +LocalOnlyCode.x86=jmpshort LocalOnlyPatch.x64=1 LocalOnlyOffset.x64=77A41 LocalOnlyCode.x64=jmpshort ; Patch CSessionArbitrationHelper::IsSingleSessionPerUserEnabled +SingleUserPatch.x86=1 +SingleUserOffset.x86=4D7B5 +SingleUserCode.x86=nop SingleUserPatch.x64=1 SingleUserOffset.x64=1322C SingleUserCode.x64=Zero ; Patch CDefPolicy::Query +DefPolicyPatch.x86=1 +DefPolicyOffset.x86=4BFB9 +DefPolicyCode.x86=CDefPolicy_Query_eax_ecx DefPolicyPatch.x64=1 DefPolicyOffset.x64=18025 DefPolicyCode.x64=CDefPolicy_Query_eax_rcx ; Hook CSLQuery::Initialize +SLInitHook.x86=1 +SLInitOffset.x86=5B2CA +SLInitFunc.x86=New_CSLQuery_Initialize SLInitHook.x64=1 SLInitOffset.x64=1ACDC SLInitFunc.x64=New_CSLQuery_Initialize @@ -3383,19 +3395,83 @@ SLInitOffset.x64=22F5C SLInitFunc.x64=New_CSLQuery_Initialize [10.0.18362.1] +LocalOnlyPatch.x86=1 +LocalOnlyOffset.x86=B7A16 +LocalOnlyCode.x86=jmpshort LocalOnlyPatch.x64=1 LocalOnlyOffset.x64=82F35 LocalOnlyCode.x64=jmpshort +SingleUserPatch.x86=1 +SingleUserOffset.x86=50515 +SingleUserCode.x86=nop SingleUserPatch.x64=1 SingleUserOffset.x64=0DDC9 SingleUserCode.x64=Zero +DefPolicyPatch.x86=1 +DefPolicyOffset.x86=50249 +DefPolicyCode.x86=CDefPolicy_Query_eax_ecx DefPolicyPatch.x64=1 DefPolicyOffset.x64=1FE05 DefPolicyCode.x64=CDefPolicy_Query_eax_rcx +SLInitHook.x86=1 +SLInitOffset.x86=5A75A +SLInitFunc.x86=New_CSLQuery_Initialize SLInitHook.x64=1 SLInitOffset.x64=22DCC SLInitFunc.x64=New_CSLQuery_Initialize +[10.0.18362.53] +LocalOnlyPatch.x86=1 +LocalOnlyOffset.x86=B7D06 +LocalOnlyCode.x86=jmpshort +LocalOnlyPatch.x64=1 +LocalOnlyOffset.x64=82FB5 +LocalOnlyCode.x64=jmpshort +SingleUserPatch.x86=1 +SingleUserOffset.x86=50535 +SingleUserCode.x86=nop +SingleUserPatch.x64=1 +SingleUserOffset.x64=0DBFC +SingleUserCode.x64=Zero +DefPolicyPatch.x86=1 +DefPolicyOffset.x86=50269 +DefPolicyCode.x86=CDefPolicy_Query_eax_ecx +DefPolicyPatch.x64=1 +DefPolicyOffset.x64=1FE15 +DefPolicyCode.x64=CDefPolicy_Query_eax_rcx +SLInitHook.x86=1 +SLInitOffset.x86=5A77A +SLInitFunc.x86=New_CSLQuery_Initialize +SLInitHook.x64=1 +SLInitOffset.x64=22DDC +SLInitFunc.x64=New_CSLQuery_Initialize + +[10.0.18362.267] +LocalOnlyPatch.x86=1 +LocalOnlyOffset.x86=B7D06 +LocalOnlyCode.x86=jmpshort +LocalOnlyPatch.x64=1 +LocalOnlyOffset.x64=82FB5 +LocalOnlyCode.x64=jmpshort +SingleUserPatch.x86=1 +SingleUserOffset.x86=50535 +SingleUserCode.x86=nop +SingleUserPatch.x64=1 +SingleUserOffset.x64=0DBFC +SingleUserCode.x64=Zero +DefPolicyPatch.x86=1 +DefPolicyOffset.x86=50269 +DefPolicyCode.x86=CDefPolicy_Query_eax_ecx +DefPolicyPatch.x64=1 +DefPolicyOffset.x64=1FE15 +DefPolicyCode.x64=CDefPolicy_Query_eax_rcx +SLInitHook.x86=1 +SLInitOffset.x86=5A77A +SLInitFunc.x86=New_CSLQuery_Initialize +SLInitHook.x64=1 +SLInitOffset.x64=22DDC +SLInitFunc.x64=New_CSLQuery_Initialize + [SLInit] bServerSku=1 bRemoteConnAllowed=1 @@ -5453,71 +5529,71 @@ ulMaxDebugSessions.x64=ECACC bFUSEnabled.x64 =ECAD0 [10.0.17763.165-SLInit] -bInitialized.x64 =ECAB0 -bServerSku.x64 =ECAB4 -lMaxUserSessions.x64 =ECAB8 +bInitialized.x64 =ECAB0 +bServerSku.x64 =ECAB4 +lMaxUserSessions.x64 =ECAB8 bAppServerAllowed.x64 =ECAC0 bRemoteConnAllowed.x64=ECAC4 -bMultimonAllowed.x64 =ECAC8 +bMultimonAllowed.x64 =ECAC8 ulMaxDebugSessions.x64=ECACC -bFUSEnabled.x64 =ECAD0 +bFUSEnabled.x64 =ECAD0 [10.0.17763.292-SLInit] -bInitialized.x86 =CD798 -bServerSku.x86 =CD79C -lMaxUserSessions.x86 =CD7A0 +bInitialized.x86 =CD798 +bServerSku.x86 =CD79C +lMaxUserSessions.x86 =CD7A0 bAppServerAllowed.x86 =CD7A8 bRemoteConnAllowed.x86=CD7AC -bMultimonAllowed.x86 =CD7B0 +bMultimonAllowed.x86 =CD7B0 ulMaxDebugSessions.x86=CD7B4 -bFUSEnabled.x86 =CD7B8 +bFUSEnabled.x86 =CD7B8 -bInitialized.x64 =ECAB0 -bServerSku.x64 =ECAB4 -lMaxUserSessions.x64 =ECAB8 +bInitialized.x64 =ECAB0 +bServerSku.x64 =ECAB4 +lMaxUserSessions.x64 =ECAB8 bAppServerAllowed.x64 =ECAC0 bRemoteConnAllowed.x64=ECAC4 -bMultimonAllowed.x64 =ECAC8 +bMultimonAllowed.x64 =ECAC8 ulMaxDebugSessions.x64=ECACC -bFUSEnabled.x64 =ECAD0 +bFUSEnabled.x64 =ECAD0 [10.0.17763.379-SLInit] -bInitialized.x86 =CD798 -bServerSku.x86 =CD79C -lMaxUserSessions.x86 =CD7A0 +bInitialized.x86 =CD798 +bServerSku.x86 =CD79C +lMaxUserSessions.x86 =CD7A0 bAppServerAllowed.x86 =CD7A8 bRemoteConnAllowed.x86=CD7AC -bMultimonAllowed.x86 =CD7B0 +bMultimonAllowed.x86 =CD7B0 ulMaxDebugSessions.x86=CD7B4 -bFUSEnabled.x86 =CD7B8 +bFUSEnabled.x86 =CD7B8 -bInitialized.x64 =ECAB0 -bServerSku.x64 =ECAB4 -lMaxUserSessions.x64 =ECAB8 +bInitialized.x64 =ECAB0 +bServerSku.x64 =ECAB4 +lMaxUserSessions.x64 =ECAB8 bAppServerAllowed.x64 =ECAC0 bRemoteConnAllowed.x64=ECAC4 -bMultimonAllowed.x64 =ECAC8 +bMultimonAllowed.x64 =ECAC8 ulMaxDebugSessions.x64=ECACC -bFUSEnabled.x64 =ECAD0 +bFUSEnabled.x64 =ECAD0 [10.0.17763.437-SLInit] -bInitialized.x86 =CD798 -bServerSku.x86 =CD79C -lMaxUserSessions.x86 =CD7A0 +bInitialized.x86 =CD798 +bServerSku.x86 =CD79C +lMaxUserSessions.x86 =CD7A0 bAppServerAllowed.x86 =CD7A8 bRemoteConnAllowed.x86=CD7AC -bMultimonAllowed.x86 =CD7B0 +bMultimonAllowed.x86 =CD7B0 ulMaxDebugSessions.x86=CD7B4 -bFUSEnabled.x86 =CD7B8 +bFUSEnabled.x86 =CD7B8 -bInitialized.x64 =ECAB0 -bServerSku.x64 =ECAB4 -lMaxUserSessions.x64 =ECAB8 +bInitialized.x64 =ECAB0 +bServerSku.x64 =ECAB4 +lMaxUserSessions.x64 =ECAB8 bAppServerAllowed.x64 =ECAC0 bRemoteConnAllowed.x64=ECAC4 -bMultimonAllowed.x64 =ECAC8 +bMultimonAllowed.x64 =ECAC8 ulMaxDebugSessions.x64=ECACC -bFUSEnabled.x64 =ECAD0 +bFUSEnabled.x64 =ECAD0 [10.0.17134.706-SLInit] bInitialized.x86 =CBF38 @@ -5539,11 +5615,58 @@ ulMaxDebugSessions.x64=F243C bFUSEnabled.x64 =F2440 [10.0.18362.1-SLInit] -bInitialized.x64 =F6A8C -bServerSku.x64 =F6A90 -lMaxUserSessions.x64 =F6A94 +bInitialized.x86 =D477C +bServerSku.x86 =D4780 +lMaxUserSessions.x86 =D4784 +bAppServerAllowed.x86 =D478C +bRemoteConnAllowed.x86=D4790 +bMultimonAllowed.x86 =D4794 +ulMaxDebugSessions.x86=D4798 +bFUSEnabled.x86 =D479C + +bInitialized.x64 =F6A8C +bServerSku.x64 =F6A90 +lMaxUserSessions.x64 =F6A94 +bAppServerAllowed.x64 =F6A9C +bRemoteConnAllowed.x64=F6AA0 +bMultimonAllowed.x64 =F6AA4 +ulMaxDebugSessions.x64=F6AA8 +bFUSEnabled.x64 =F6AAC + +[10.0.18362.53-SLInit] +bInitialized.x86 =D577C +bServerSku.x86 =D5780 +lMaxUserSessions.x86 =D5784 +bAppServerAllowed.x86 =D578C +bRemoteConnAllowed.x86=D5790 +bMultimonAllowed.x86 =D5794 +ulMaxDebugSessions.x86=D5798 +bFUSEnabled.x86 =D579C + +bInitialized.x64 =F6A8C +bServerSku.x64 =F6A90 +lMaxUserSessions.x64 =F6A94 +bAppServerAllowed.x64 =F6A9C +bRemoteConnAllowed.x64=F6AA0 +bMultimonAllowed.x64 =F6AA4 +ulMaxDebugSessions.x64=F6AA8 +bFUSEnabled.x64 =F6AAC + +[10.0.18362.267-SLInit] +bInitialized.x86 =D577C +bServerSku.x86 =D5780 +lMaxUserSessions.x86 =D5784 +bAppServerAllowed.x86 =D578C +bRemoteConnAllowed.x86=D5790 +bMultimonAllowed.x86 =D5794 +ulMaxDebugSessions.x86=D5798 +bFUSEnabled.x86 =D579C + +bInitialized.x64 =F6A8C +bServerSku.x64 =F6A90 +lMaxUserSessions.x64 =F6A94 bAppServerAllowed.x64 =F6A9C bRemoteConnAllowed.x64=F6AA0 -bMultimonAllowed.x64 =F6AA4 +bMultimonAllowed.x64 =F6AA4 ulMaxDebugSessions.x64=F6AA8 -bFUSEnabled.x64 =F6AAC +bFUSEnabled.x64 =F6AAC From 9abffc40f3897cb2a5e3f28eacb650a55af31649 Mon Sep 17 00:00:00 2001 From: asmtron <49522124+asmtron@users.noreply.github.com> Date: Wed, 4 Sep 2019 16:36:04 +0000 Subject: [PATCH 05/17] Update rdpwrap.ini rdpwrap.ini - add support for termsrv.dll versions: 10.0.18362.267 10.0.18362.53 10.0.18362.1 10.0.17763.437 10.0.17763.379 10.0.17763.292 10.0.17763.165 x64 10.0.17134.706 (+saurav-biswas changes) --- res/rdpwrap.ini | 631 +++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 630 insertions(+), 1 deletion(-) diff --git a/res/rdpwrap.ini b/res/rdpwrap.ini index a285ec8..0ce57c6 100644 --- a/res/rdpwrap.ini +++ b/res/rdpwrap.ini @@ -2,7 +2,7 @@ ; Do not modify without special knowledge [Main] -Updated=2019-08-02 +Updated=2019-09-02 LogFile=\rdpwrap.txt SLPolicyHookNT60=1 SLPolicyHookNT61=1 @@ -93,6 +93,104 @@ DefPolicyPatch.x64=1 DefPolicyOffset.x64=65FF7 DefPolicyCode.x64=CDefPolicy_Query_eax_rcx_jmp +[6.0.6001.22286] +SingleUserPatch.x86=1 +SingleUserOffset.x86=185E4 +SingleUserCode.x86=nop +SingleUserPatch.x64=1 +SingleUserOffset.x64=70DDE +SingleUserCode.x64=Zero +DefPolicyPatch.x86=1 +DefPolicyOffset.x86=17FD8 +DefPolicyCode.x86=CDefPolicy_Query_edx_ecx +DefPolicyPatch.x64=1 +DefPolicyOffset.x64=65C01 +DefPolicyCode.x64=CDefPolicy_Query_eax_rcx_jmp + +[6.0.6001.22323] +SingleUserPatch.x86=1 +SingleUserOffset.x86=185E4 +SingleUserCode.x86=nop +SingleUserPatch.x64=1 +SingleUserOffset.x64=70DFA +SingleUserCode.x64=Zero +DefPolicyPatch.x86=1 +DefPolicyOffset.x86=17FD8 +DefPolicyCode.x86=CDefPolicy_Query_edx_ecx +DefPolicyPatch.x64=1 +DefPolicyOffset.x64=65C1D +DefPolicyCode.x64=CDefPolicy_Query_eax_rcx_jmp + +[6.0.6001.22357] +SingleUserPatch.x86=1 +SingleUserOffset.x86=185E4 +SingleUserCode.x86=nop +SingleUserPatch.x64=1 +SingleUserOffset.x64=70DFA +SingleUserCode.x64=Zero +DefPolicyPatch.x86=1 +DefPolicyOffset.x86=17FD8 +DefPolicyCode.x86=CDefPolicy_Query_edx_ecx +DefPolicyPatch.x64=1 +DefPolicyOffset.x64=65C1D +DefPolicyCode.x64=CDefPolicy_Query_eax_rcx_jmp + +[6.0.6001.22801] +SingleUserPatch.x86=1 +SingleUserOffset.x86=185F8 +SingleUserCode.x86=nop +SingleUserPatch.x64=1 +SingleUserOffset.x64=71ADA +SingleUserCode.x64=Zero +DefPolicyPatch.x86=1 +DefPolicyOffset.x86=18010 +DefPolicyCode.x86=CDefPolicy_Query_edx_ecx +DefPolicyPatch.x64=1 +DefPolicyOffset.x64=666AD +DefPolicyCode.x64=CDefPolicy_Query_eax_rcx_jmp + +[6.0.6002.22515] +SingleUserPatch.x86=1 +SingleUserOffset.x86=17FA8 +SingleUserCode.x86=nop +SingleUserPatch.x64=1 +SingleUserOffset.x64=71AFA +SingleUserCode.x64=Zero +DefPolicyPatch.x86=1 +DefPolicyOffset.x86=179C0 +DefPolicyCode.x86=CDefPolicy_Query_edx_ecx +DefPolicyPatch.x64=1 +DefPolicyOffset.x64=6675D +DefPolicyCode.x64=CDefPolicy_Query_eax_rcx_jmp + +[6.0.6002.22641] +SingleUserPatch.x86=1 +SingleUserOffset.x86=17FA8 +SingleUserCode.x86=nop +SingleUserPatch.x64=1 +SingleUserOffset.x64=71AFA +SingleUserCode.x64=Zero +DefPolicyPatch.x86=1 +DefPolicyOffset.x86=179C0 +DefPolicyCode.x86=CDefPolicy_Query_edx_ecx +DefPolicyPatch.x64=1 +DefPolicyOffset.x64=6675D +DefPolicyCode.x64=CDefPolicy_Query_eax_rcx_jmp + +[6.0.6002.22790] +SingleUserPatch.x86=1 +SingleUserOffset.x86=17FA8 +SingleUserCode.x86=nop +SingleUserPatch.x64=1 +SingleUserOffset.x64=71B02 +SingleUserCode.x64=Zero +DefPolicyPatch.x86=1 +DefPolicyOffset.x86=179C0 +DefPolicyCode.x86=CDefPolicy_Query_edx_ecx +DefPolicyPatch.x64=1 +DefPolicyOffset.x64=66765 +DefPolicyCode.x64=CDefPolicy_Query_eax_rcx_jmp + [6.0.6002.23521] SingleUserPatch.x86=1 SingleUserOffset.x86=17FB4 @@ -107,6 +205,20 @@ DefPolicyPatch.x64=1 DefPolicyOffset.x64=669CB DefPolicyCode.x64=CDefPolicy_Query_eax_rcx_jmp +[6.0.6003.20482] +SingleUserPatch.x86=1 +SingleUserOffset.x86=17FC4 +SingleUserCode.x86=nop +SingleUserPatch.x64=1 +SingleUserOffset.x64=71F8A +SingleUserCode.x64=Zero +DefPolicyPatch.x86=1 +DefPolicyOffset.x86=179DC +DefPolicyCode.x86=CDefPolicy_Query_edx_ecx +DefPolicyPatch.x64=1 +DefPolicyOffset.x64=66B65 +DefPolicyCode.x64=CDefPolicy_Query_eax_rcx_jmp + [6.1.7600.16385] SingleUserPatch.x86=1 SingleUserOffset.x86=19E25 @@ -121,6 +233,20 @@ DefPolicyPatch.x64=1 DefPolicyOffset.x64=17AD2 DefPolicyCode.x64=CDefPolicy_Query_eax_rdi +[6.1.7600.20621] +SingleUserPatch.x86=1 +SingleUserOffset.x86=19E1D +SingleUserCode.x86=nop +SingleUserPatch.x64=1 +SingleUserOffset.x64=17DC2 +SingleUserCode.x64=Zero +DefPolicyPatch.x86=1 +DefPolicyOffset.x86=196EB +DefPolicyCode.x86=CDefPolicy_Query_eax_esi +DefPolicyPatch.x64=1 +DefPolicyOffset.x64=17ADE +DefPolicyCode.x64=CDefPolicy_Query_eax_rdi + [6.1.7600.20890] SingleUserPatch.x86=1 SingleUserOffset.x86=19E2D @@ -149,6 +275,20 @@ DefPolicyPatch.x64=1 DefPolicyOffset.x64=17B5E DefPolicyCode.x64=CDefPolicy_Query_eax_rdi +[6.1.7600.21420] +SingleUserPatch.x86=1 +SingleUserOffset.x86=19EF5 +SingleUserCode.x86=nop +SingleUserPatch.x64=1 +SingleUserOffset.x64=17D56 +SingleUserCode.x64=Zero +DefPolicyPatch.x86=1 +DefPolicyOffset.x86=19761 +DefPolicyCode.x86=CDefPolicy_Query_eax_esi +DefPolicyPatch.x64=1 +DefPolicyOffset.x64=17B3E +DefPolicyCode.x64=CDefPolicy_Query_eax_rdi + [6.1.7601.17514] SingleUserPatch.x86=1 SingleUserOffset.x86=1A49D @@ -233,6 +373,48 @@ DefPolicyPatch.x64=1 DefPolicyOffset.x64=17D5E DefPolicyCode.x64=CDefPolicy_Query_eax_rdi +[6.1.7601.22213] +SingleUserPatch.x86=1 +SingleUserOffset.x86=1A5AD +SingleUserCode.x86=nop +SingleUserPatch.x64=1 +SingleUserOffset.x64=17F26 +SingleUserCode.x64=Zero +DefPolicyPatch.x86=1 +DefPolicyOffset.x86=19DB1 +DefPolicyCode.x86=CDefPolicy_Query_eax_esi +DefPolicyPatch.x64=1 +DefPolicyOffset.x64=17D06 +DefPolicyCode.x64=CDefPolicy_Query_eax_rdi + +[6.1.7601.22435] +SingleUserPatch.x86=1 +SingleUserOffset.x86=1A5BD +SingleUserCode.x86=nop +SingleUserPatch.x64=1 +SingleUserOffset.x64=17F36 +SingleUserCode.x64=Zero +DefPolicyPatch.x86=1 +DefPolicyOffset.x86=19DB1 +DefPolicyCode.x86=CDefPolicy_Query_eax_esi +DefPolicyPatch.x64=1 +DefPolicyOffset.x64=17D16 +DefPolicyCode.x64=CDefPolicy_Query_eax_rdi + +[6.1.7601.22476] +SingleUserPatch.x86=1 +SingleUserOffset.x86=1A5CD +SingleUserCode.x86=nop +SingleUserPatch.x64=1 +SingleUserOffset.x64=17F56 +SingleUserCode.x64=Zero +DefPolicyPatch.x86=1 +DefPolicyOffset.x86=19DC1 +DefPolicyCode.x86=CDefPolicy_Query_eax_esi +DefPolicyPatch.x64=1 +DefPolicyOffset.x64=17D52 +DefPolicyCode.x64=CDefPolicy_Query_eax_rdi + [6.1.7601.22750] SingleUserPatch.x86=1 SingleUserOffset.x86=1A655 @@ -289,6 +471,34 @@ DefPolicyPatch.x64=1 DefPolicyOffset.x64=17D2E DefPolicyCode.x64=CDefPolicy_Query_eax_rdi +[6.1.7601.24326] +SingleUserPatch.x86=1 +SingleUserOffset.x86=1A675 +SingleUserCode.x86=nop +SingleUserPatch.x64=1 +SingleUserOffset.x64=17F1E +SingleUserCode.x64=Zero +DefPolicyPatch.x86=1 +DefPolicyOffset.x86=19E41 +DefPolicyCode.x86=CDefPolicy_Query_eax_esi +DefPolicyPatch.x64=1 +DefPolicyOffset.x64=17CEE +DefPolicyCode.x64=CDefPolicy_Query_eax_rdi + +[6.1.7601.24402] +SingleUserPatch.x86=1 +SingleUserOffset.x86=1A675 +SingleUserCode.x86=nop +SingleUserPatch.x64=1 +SingleUserOffset.x64=17F26 +SingleUserCode.x64=Zero +DefPolicyPatch.x86=1 +DefPolicyOffset.x86=19E41 +DefPolicyCode.x86=CDefPolicy_Query_eax_esi +DefPolicyPatch.x64=1 +DefPolicyOffset.x64=17CFE +DefPolicyCode.x64=CDefPolicy_Query_eax_rdi + [6.2.8102.0] SingleUserPatch.x86=1 SingleUserOffset.x86=F7E9 @@ -409,6 +619,27 @@ SLPolicyInternal.x64=1 SLPolicyOffset.x64=21FD0 SLPolicyFunc.x64=New_Win8SL +[6.2.9200.22715] +; x86-Offsets are not safe (determined without symbols) +SingleUserPatch.x86=1 +SingleUserOffset.x86=155B2 +SingleUserCode.x86=nop +SingleUserPatch.x64=1 +SingleUserOffset.x64=2BAE4 +SingleUserCode.x64=Zero +DefPolicyPatch.x86=1 +DefPolicyOffset.x86=13F68 +DefPolicyCode.x86=CDefPolicy_Query_eax_esi +DefPolicyPatch.x64=1 +DefPolicyOffset.x64=2A396 +DefPolicyCode.x64=CDefPolicy_Query_eax_rdi +SLPolicyInternal.x86=1 +SLPolicyOffset.x86=195B9 +SLPolicyFunc.x86=New_Win8SL +SLPolicyInternal.x64=1 +SLPolicyOffset.x64=21F90 +SLPolicyFunc.x64=New_Win8SL + [6.3.9431.0] LocalOnlyPatch.x86=1 LocalOnlyOffset.x86=8A611 @@ -617,6 +848,32 @@ SLInitHook.x64=1 SLInitOffset.x64=5D660 SLInitFunc.x64=New_CSLQuery_Initialize +[6.3.9600.19318] +LocalOnlyPatch.x86=1 +LocalOnlyOffset.x86=B43E8 +LocalOnlyCode.x86=jmpshort +LocalOnlyPatch.x64=1 +LocalOnlyOffset.x64=89EAC +LocalOnlyCode.x64=nopjmp +SingleUserPatch.x86=1 +SingleUserOffset.x86=3ED25 +SingleUserCode.x86=nop +SingleUserPatch.x64=1 +SingleUserOffset.x64=35779 +SingleUserCode.x64=Zero +DefPolicyPatch.x86=1 +DefPolicyOffset.x86=3D579 +DefPolicyCode.x86=CDefPolicy_Query_eax_ecx +DefPolicyPatch.x64=1 +DefPolicyOffset.x64=43CE5 +DefPolicyCode.x64=CDefPolicy_Query_eax_rcx +SLInitHook.x86=1 +SLInitOffset.x86=180F8 +SLInitFunc.x86=New_CSLQuery_Initialize +SLInitHook.x64=1 +SLInitOffset.x64=5C0D0 +SLInitFunc.x64=New_CSLQuery_Initialize + [6.4.9841.0] LocalOnlyPatch.x86=1 LocalOnlyOffset.x86=956A8 @@ -773,6 +1030,58 @@ SLInitHook.x64=1 SLInitOffset.x64=250F0 SLInitFunc.x64=New_CSLQuery_Initialize +[10.0.10240.18036] +LocalOnlyPatch.x86=1 +LocalOnlyOffset.x86=A7E18 +LocalOnlyCode.x86=jmpshort +LocalOnlyPatch.x64=1 +LocalOnlyOffset.x64=96961 +LocalOnlyCode.x64=jmpshort +SingleUserPatch.x86=1 +SingleUserOffset.x86=32715 +SingleUserCode.x86=nop +SingleUserPatch.x64=1 +SingleUserOffset.x64=17264 +SingleUserCode.x64=Zero +DefPolicyPatch.x86=1 +DefPolicyOffset.x86=2F299 +DefPolicyCode.x86=CDefPolicy_Query_eax_ecx +DefPolicyPatch.x64=1 +DefPolicyOffset.x64=EDC5 +DefPolicyCode.x64=CDefPolicy_Query_eax_rcx +SLInitHook.x86=1 +SLInitOffset.x86=3F968 +SLInitFunc.x86=New_CSLQuery_Initialize +SLInitHook.x64=1 +SLInitOffset.x64=24C30 +SLInitFunc.x64=New_CSLQuery_Initialize + +[10.0.10240.18186] +LocalOnlyPatch.x86=1 +LocalOnlyOffset.x86=A8048 +LocalOnlyCode.x86=jmpshort +LocalOnlyPatch.x64=1 +LocalOnlyOffset.x64=96A41 +LocalOnlyCode.x64=jmpshort +SingleUserPatch.x86=1 +SingleUserOffset.x86=32B15 +SingleUserCode.x86=nop +SingleUserPatch.x64=1 +SingleUserOffset.x64=17264 +SingleUserCode.x64=Zero +DefPolicyPatch.x86=1 +DefPolicyOffset.x86=2F699 +DefPolicyCode.x86=CDefPolicy_Query_eax_ecx +DefPolicyPatch.x64=1 +DefPolicyOffset.x64=EDC5 +DefPolicyCode.x64=CDefPolicy_Query_eax_rcx +SLInitHook.x86=1 +SLInitOffset.x86=3FA58 +SLInitFunc.x86=New_CSLQuery_Initialize +SLInitHook.x64=1 +SLInitOffset.x64=249D0 +SLInitFunc.x64=New_CSLQuery_Initialize + [10.0.10586.0] LocalOnlyPatch.x86=1 LocalOnlyOffset.x86=A7C18 @@ -1399,6 +1708,48 @@ SLInitHook.x64=1 SLInitOffset.x64=C920 SLInitFunc.x64=New_CSLQuery_Initialize +[10.0.14393.2608] +; no x64 version +LocalOnlyPatch.x86=1 +LocalOnlyOffset.x86=A6248 +LocalOnlyCode.x86=jmpshort +SingleUserPatch.x86=1 +SingleUserOffset.x86=36CE5 +SingleUserCode.x86=nop +DefPolicyPatch.x86=1 +DefPolicyOffset.x86=31209 +DefPolicyCode.x86=CDefPolicy_Query_eax_ecx +SLInitHook.x86=1 +SLInitOffset.x86=45824 +SLInitFunc.x86=New_CSLQuery_Initialize + + +[10.0.14393.2906] +LocalOnlyPatch.x86=1 +LocalOnlyOffset.x86=A6578 +LocalOnlyCode.x86=jmpshort +LocalOnlyPatch.x64=1 +LocalOnlyOffset.x64=8D8A1 +LocalOnlyCode.x64=jmpshort +SingleUserPatch.x86=1 +SingleUserOffset.x86=36CE5 +SingleUserCode.x86=nop +SingleUserPatch.x64=1 +SingleUserOffset.x64=1B6A4 +SingleUserCode.x64=Zero +DefPolicyPatch.x86=1 +DefPolicyOffset.x86=31209 +DefPolicyCode.x86=CDefPolicy_Query_eax_ecx +DefPolicyPatch.x64=1 +DefPolicyOffset.x64=F185 +DefPolicyCode.x64=CDefPolicy_Query_eax_rcx +SLInitHook.x86=1 +SLInitOffset.x86=45912 +SLInitFunc.x86=New_CSLQuery_Initialize +SLInitHook.x64=1 +SLInitOffset.x64=22C80 +SLInitFunc.x64=New_CSLQuery_Initialize + [10.0.14901.1000] LocalOnlyPatch.x86=1 LocalOnlyOffset.x86=A6038 @@ -2157,6 +2508,32 @@ SLInitHook.x64=1 SLInitOffset.x64=234DC SLInitFunc.x64=New_CSLQuery_Initialize +[10.0.15063.1746] +LocalOnlyPatch.x86=1 +LocalOnlyOffset.x86=A60D8 +LocalOnlyCode.x86=jmpshort +LocalOnlyPatch.x64=1 +LocalOnlyOffset.x64=8CB21 +LocalOnlyCode.x64=jmpshort +SingleUserPatch.x86=1 +SingleUserOffset.x86=35CA5 +SingleUserCode.x86=nop +SingleUserPatch.x64=1 +SingleUserOffset.x64=15EA4 +SingleUserCode.x64=Zero +DefPolicyPatch.x86=1 +DefPolicyOffset.x86=30999 +DefPolicyCode.x86=CDefPolicy_Query_eax_ecx +DefPolicyPatch.x64=1 +DefPolicyOffset.x64=FAE5 +DefPolicyCode.x64=CDefPolicy_Query_eax_rcx +SLInitHook.x86=1 +SLInitOffset.x86=3F94D +SLInitFunc.x86=New_CSLQuery_Initialize +SLInitHook.x64=1 +SLInitOffset.x64=2328C +SLInitFunc.x64=New_CSLQuery_Initialize + [10.0.16179.1000] LocalOnlyPatch.x86=1 LocalOnlyOffset.x86=AA568 @@ -2703,6 +3080,32 @@ SLInitHook.x64=1 SLInitOffset.x64=22D5C SLInitFunc.x64=New_CSLQuery_Initialize +[10.0.16299.1087] +LocalOnlyPatch.x86=1 +LocalOnlyOffset.x86=A91F8 +LocalOnlyCode.x86=jmpshort +LocalOnlyPatch.x64=1 +LocalOnlyOffset.x64=8FC11 +LocalOnlyCode.x64=jmpshort +SingleUserPatch.x86=1 +SingleUserOffset.x86=392E5 +SingleUserCode.x86=nop +SingleUserPatch.x64=1 +SingleUserOffset.x64=1C774 +SingleUserCode.x64=Zero +DefPolicyPatch.x86=1 +DefPolicyOffset.x86=3DD39 +DefPolicyCode.x86=CDefPolicy_Query_eax_ecx +DefPolicyPatch.x64=1 +DefPolicyOffset.x64=12D85 +DefPolicyCode.x64=CDefPolicy_Query_eax_rcx +SLInitHook.x86=1 +SLInitOffset.x86=4626D +SLInitFunc.x86=New_CSLQuery_Initialize +SLInitHook.x64=1 +SLInitOffset.x64=22E4C +SLInitFunc.x64=New_CSLQuery_Initialize + [10.0.16353.1000] LocalOnlyPatch.x86=1 LocalOnlyOffset.x86=A9388 @@ -3095,6 +3498,62 @@ SLInitHook.x64=1 SLInitOffset.x64=1ABFC SLInitFunc.x64=New_CSLQuery_Initialize +[10.0.17763.168] +LocalOnlyPatch.x86=1 +LocalOnlyOffset.x86=AFC74 +LocalOnlyCode.x86=jmpshort +LocalOnlyPatch.x64=1 +LocalOnlyOffset.x64=77AF1 +LocalOnlyCode.x64=jmpshort +SingleUserPatch.x86=1 +SingleUserOffset.x86=4D665 +SingleUserCode.x86=nop +SingleUserPatch.x64=1 +SingleUserOffset.x64=1322C +SingleUserCode.x64=Zero +DefPolicyPatch.x86=1 +DefPolicyOffset.x86=4BE69 +DefPolicyCode.x86=CDefPolicy_Query_eax_ecx +DefPolicyPatch.x64=1 +DefPolicyOffset.x64=17F45 +DefPolicyCode.x64=CDefPolicy_Query_eax_rcx +SLInitHook.x86=1 +SLInitOffset.x86=5B18A +SLInitFunc.x86=New_CSLQuery_Initialize +SLInitHook.x64=1 +SLInitOffset.x64=1ABFC +SLInitFunc.x64=New_CSLQuery_Initialize + +[10.0.17763.288] +Patch CEnforcementCore::GetInstanceOfTSLicense +LocalOnlyPatch.x86=1 +LocalOnlyOffset.x86=AFAD4 +LocalOnlyCode.x86=jmpshort +LocalOnlyPatch.x64=1 +LocalOnlyOffset.x64=77A11 +LocalOnlyCode.x64=jmpshort +Patch CSessionArbitrationHelper::IsSingleSessionPerUserEnabled +SingleUserPatch.x86=1 +SingleUserOffset.x86=4D665 +SingleUserCode.x86=nop +SingleUserPatch.x64=1 +SingleUserOffset.x64=1322C +SingleUserCode.x64=Zero +Patch CDefPolicy::Query +DefPolicyPatch.x86=1 +DefPolicyOffset.x86=4BE69 +DefPolicyCode.x86=CDefPolicy_Query_eax_ecx +DefPolicyPatch.x64=1 +DefPolicyOffset.x64=17F45 +DefPolicyCode.x64=CDefPolicy_Query_eax_rcx +Hook CSLQuery::Initialize +SLInitHook.x86=1 +SLInitOffset.x86=5B18A +SLInitFunc.x86=New_CSLQuery_Initialize +SLInitHook.x64=1 +SLInitOffset.x64=1ABFC +SLInitFunc.x64=New_CSLQuery_Initialize + [10.0.17763.292] LocalOnlyPatch.x86=1 LocalOnlyOffset.x86=AFAD4 @@ -3413,6 +3872,25 @@ bServerSku.x64 =FA068 ulMaxDebugSessions.x64=FA06C bRemoteConnAllowed.x64=FA070 +[6.3.9600.19318-SLInit] +bFUSEnabled.x86 =D4068 +lMaxUserSessions.x86 =D406C +bAppServerAllowed.x86 =D4070 +bInitialized.x86 =D4074 +bMultimonAllowed.x86 =D4078 +bServerSku.x86 =D407C +ulMaxDebugSessions.x86=D4080 +bRemoteConnAllowed.x86=D4084 + +bFUSEnabled.x64 =FA054 +lMaxUserSessions.x64 =FA058 +bAppServerAllowed.x64 =FA05C +bInitialized.x64 =FA060 +bMultimonAllowed.x64 =FA064 +bServerSku.x64 =FA068 +ulMaxDebugSessions.x64=FA06C +bRemoteConnAllowed.x64=FA070 + [6.4.9841.0-SLInit] bFUSEnabled.x86 =BF9F0 lMaxUserSessions.x86 =BF9F4 @@ -3470,6 +3948,7 @@ bServerSku.x64 =EDC04 ulMaxDebugSessions.x64=EDC08 bRemoteConnAllowed.x64=EDC0C + [10.0.9926.0-SLInit] bFUSEnabled.x86 =C17D8 lMaxUserSessions.x86 =C17DC @@ -3518,6 +3997,45 @@ bServerSku.x86 =C3F74 ulMaxDebugSessions.x86=C3F78 bRemoteConnAllowed.x86=C3F7C +zlMaxUserSessions.x64 =F23B0 +lMaxUserSessions.x64 =F23B0 +bAppServerAllowed.x64 =F23B4 +bServerSku.x64 =F23B8 +bFUSEnabled.x64 =F3460 +bInitialized.x64 =F3464 +bMultimonAllowed.x64 =F3468 +ulMaxDebugSessions.x64=F346C +bRemoteConnAllowed.x64=F3470 + +[10.0.10240.18036-SLInit] +bFUSEnabled.x86 =C3F88 +lMaxUserSessions.x86 =C3F8C +bAppServerAllowed.x86 =C3F90 +bInitialized.x86 =C3F94 +bMultimonAllowed.x86 =C3F98 +bServerSku.x86 =C3F9C +ulMaxDebugSessions.x86=C3FA0 +bRemoteConnAllowed.x86=C3FA4 + +lMaxUserSessions.x64 =F23B0 +bAppServerAllowed.x64 =F23B4 +bServerSku.x64 =F23B8 +bFUSEnabled.x64 =F3460 +bInitialized.x64 =F3464 +bMultimonAllowed.x64 =F3468 +ulMaxDebugSessions.x64=F346C +bRemoteConnAllowed.x64=F3470 + +[10.0.10240.18186-SLInit] +bFUSEnabled.x86 =C4F88 +lMaxUserSessions.x86 =C4F8C +bAppServerAllowed.x86 =C4F90 +bInitialized.x86 =C4F94 +bMultimonAllowed.x86 =C4F98 +bServerSku.x86 =C4F9C +ulMaxDebugSessions.x86=C4FA0 +bRemoteConnAllowed.x86=C4FA4 + lMaxUserSessions.x64 =F23B0 bAppServerAllowed.x64 =F23B4 bServerSku.x64 =F23B8 @@ -3984,6 +4502,36 @@ bMultimonAllowed.x64 =E8478 ulMaxDebugSessions.x64=E847C bFUSEnabled.x64 =E8480 +[10.0.14393.2608-SLInit] +; no x64 version +bInitialized.x86 =C1F94 +bServerSku.x86 =C1F98 +lMaxUserSessions.x86 =C1F9C +bAppServerAllowed.x86 =C1FA0 +bRemoteConnAllowed.x86=C1FA4 +bMultimonAllowed.x86 =C1FA8 +ulMaxDebugSessions.x86=C1FAC +bFUSEnabled.x86 =C1FB0 + +[10.0.14393.2906-SLInit] +bInitialized.x86 =C2F94 +bServerSku.x86 =C2F98 +lMaxUserSessions.x86 =C2F9C +bAppServerAllowed.x86 =C2FA0 +bRemoteConnAllowed.x86=C2FA4 +bMultimonAllowed.x86 =C2FA8 +ulMaxDebugSessions.x86=C2FAC +bFUSEnabled.x86 =C2FB0 + +bServerSku.x64 =E73D0 +lMaxUserSessions.x64 =E73D4 +bAppServerAllowed.x64 =E73D8 +bInitialized.x64 =E8470 +bRemoteConnAllowed.x64=E8474 +bMultimonAllowed.x64 =E8478 +ulMaxDebugSessions.x64=E847C +bFUSEnabled.x64 =E8480 + [10.0.14901.1000-SLInit] bInitialized.x86 =C1F6C bServerSku.x86 =C1F70 @@ -4537,6 +5085,28 @@ bServerSku.x64 =E9484 lMaxUserSessions.x64 =E9488 bAppServerAllowed.x64 =E948C + + +[10.0.15063.1746-SLInit] +bInitialized.x86 =C3F98 +bServerSku.x86 =C3F9C +lMaxUserSessions.x86 =C3FA0 +bAppServerAllowed.x86 =C3FA4 +bRemoteConnAllowed.x86=C3FA8 +bMultimonAllowed.x86 =C3FAC +ulMaxDebugSessions.x86=C3FB0 +bFUSEnabled.x86 =C3FB4 + +bInitialized.x64 =E9468 +bRemoteConnAllowed.x64=E946C +bMultimonAllowed.x64 =E9470 +ulMaxDebugSessions.x64=E9474 +bFUSEnabled.x64 =E9478 +bServerSku.x64 =E9484 +lMaxUserSessions.x64 =E9488 +bAppServerAllowed.x64 =E948C + + [10.0.16179.1000-SLInit] bInitialized.x86 =C7F6C bServerSku.x86 =C7F70 @@ -4936,6 +5506,27 @@ bMultimonAllowed.x64 =EE4A8 ulMaxDebugSessions.x64=EE4AC bFUSEnabled.x64 =EE4B0 + + +[10.0.16299.1087-SLInit] +bInitialized.x86 =C6F7C +bServerSku.x86 =C6F80 +lMaxUserSessions.x86 =C6F84 +bAppServerAllowed.x86 =C6F88 +bRemoteConnAllowed.x86=C6F8C +bMultimonAllowed.x86 =C6F90 +ulMaxDebugSessions.x86=C6F94 +bFUSEnabled.x86 =C6F98 + +bServerSku.x64 =ED3E8 +lMaxUserSessions.x64 =ED3EC +bAppServerAllowed.x64 =ED3F0 +bInitialized.x64 =EE4A0 +bRemoteConnAllowed.x64=EE4A4 +bMultimonAllowed.x64 =EE4A8 +ulMaxDebugSessions.x64=EE4AC +bFUSEnabled.x64 =EE4B0 + [10.0.16353.1000-SLInit] bInitialized.x86 =C6F7C bServerSku.x86 =C6F80 @@ -5222,6 +5813,44 @@ bMultimonAllowed.x64 =ECAC8 ulMaxDebugSessions.x64=ECACC bFUSEnabled.x64 =ECAD0 +[10.0.17763.168-SLInit] +bInitialized.x86 =CD798 +bServerSku.x86 =CD79C +lMaxUserSessions.x86 =CD7A0 +bAppServerAllowed.x86 =CD7A8 +bRemoteConnAllowed.x86=CD7AC +bMultimonAllowed.x86 =CD7B0 +ulMaxDebugSessions.x86=CD7B4 +bFUSEnabled.x86 =CD7B8 + +bInitialized.x64 =ECAB0 +bServerSku.x64 =ECAB4 +lMaxUserSessions.x64 =ECAB8 +bAppServerAllowed.x64 =ECAC0 +bRemoteConnAllowed.x64=ECAC4 +bMultimonAllowed.x64 =ECAC8 +ulMaxDebugSessions.x64=ECACC +bFUSEnabled.x64 =ECAD0 + +[10.0.17763.288-SLInit] +bInitialized.x86 =CD798 +bServerSku.x86 =CD79C +lMaxUserSessions.x86 =CD7A0 +bAppServerAllowed.x86 =CD7A8 +bRemoteConnAllowed.x86=CD7AC +bMultimonAllowed.x86 =CD7B0 +ulMaxDebugSessions.x86=CD7B4 +bFUSEnabled.x86 =CD7B8 + +bInitialized.x64 =ECAB0 +bServerSku.x64 =ECAB4 +lMaxUserSessions.x64 =ECAB8 +bAppServerAllowed.x64 =ECAC0 +bRemoteConnAllowed.x64=ECAC4 +bMultimonAllowed.x64 =ECAC8 +ulMaxDebugSessions.x64=ECACC +bFUSEnabled.x64 =ECAD0 + [10.0.17763.292-SLInit] bInitialized.x86 =CD798 bServerSku.x86 =CD79C From bc267f16e49c903f4eff40fbfe48959d610bfa6b Mon Sep 17 00:00:00 2001 From: asmtron <49522124+asmtron@users.noreply.github.com> Date: Wed, 4 Sep 2019 16:37:09 +0000 Subject: [PATCH 06/17] Update autoupdate.bat --- bin/autoupdate.bat | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/bin/autoupdate.bat b/bin/autoupdate.bat index 7a232bc..bdf819d 100644 --- a/bin/autoupdate.bat +++ b/bin/autoupdate.bat @@ -7,7 +7,7 @@ REM ------------------------------------------------------------------- REM REM autoupdate.bat REM -REM Automatic RDP Wrapper installer and updater // asmtron (16-08-2019) +REM Automatic RDP Wrapper installer and updater // asmtron (20-08-2019) REM ------------------------------------------------------------------- REM Options: REM -log = redirect display output to the file autoupdate.log @@ -110,7 +110,9 @@ for /f "tokens=1-2* usebackq" %%a in ( ) if %rdp_tcp_session%=="" ( echo [-] Listener session rdp-tcp NOT found^^! - call :install + if %rdpwrap_installed%=="0" ( + call :install + ) ) else ( echo [+] Found listener session: %rdp_tcp_session% ^(ID: %rdp_tcp_session_id%^). ) From 249c0baa62432d866dc12ba88bb5c88cf7030694 Mon Sep 17 00:00:00 2001 From: asmtron <49522124+asmtron@users.noreply.github.com> Date: Wed, 4 Sep 2019 16:37:54 +0000 Subject: [PATCH 07/17] Update autoupdate__info.txt --- bin/helper/autoupdate__info.txt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/bin/helper/autoupdate__info.txt b/bin/helper/autoupdate__info.txt index 89fb009..e6b5104 100644 --- a/bin/helper/autoupdate__info.txt +++ b/bin/helper/autoupdate__info.txt @@ -2,7 +2,7 @@ autoupdate.bat - Automatic RDP Wrapper installer and updater // asmtron (16-08-2019) + Automatic RDP Wrapper installer and updater // asmtron (20-08-2019) ------------------------------------------------------------------- Options: -log = redirect display output to the file autoupdate.log @@ -31,7 +31,7 @@ USE ONLY the "%ProgramFiles%\RDP Wrapper" directory (normally C:\Program Files\RDP Wrapper) - 2. Copy the files/folder from the archive "autoupdate-v16.08.2019.zip" (or newer) to the "%ProgramFiles%\RDP Wrapper" directory + 2. Copy the files/folder from the archive "autoupdate-v20.08.2019.zip" (or newer) to the "%ProgramFiles%\RDP Wrapper" directory 3. To enable autorun of autoupdate.bat on system startup, run the folling helper batch file as administrator: From b8cba61e06e850666cd98bb634abe0afb7e28938 Mon Sep 17 00:00:00 2001 From: asmtron <49522124+asmtron@users.noreply.github.com> Date: Sat, 7 Sep 2019 17:41:40 +0000 Subject: [PATCH 08/17] Update autoupdate__info.txt --- bin/helper/autoupdate__info.txt | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/bin/helper/autoupdate__info.txt b/bin/helper/autoupdate__info.txt index e6b5104..bb9f62b 100644 --- a/bin/helper/autoupdate__info.txt +++ b/bin/helper/autoupdate__info.txt @@ -2,7 +2,7 @@ autoupdate.bat - Automatic RDP Wrapper installer and updater // asmtron (20-08-2019) + Automatic RDP Wrapper installer and updater // asmtron (07-09-2019) ------------------------------------------------------------------- Options: -log = redirect display output to the file autoupdate.log @@ -31,7 +31,7 @@ USE ONLY the "%ProgramFiles%\RDP Wrapper" directory (normally C:\Program Files\RDP Wrapper) - 2. Copy the files/folder from the archive "autoupdate-v20.08.2019.zip" (or newer) to the "%ProgramFiles%\RDP Wrapper" directory + 2. Copy the files/folder from the archive "autoupdate-v07.09.2019.zip" (or newer) to the "%ProgramFiles%\RDP Wrapper" directory 3. To enable autorun of autoupdate.bat on system startup, run the folling helper batch file as administrator: @@ -42,6 +42,6 @@ 4. Set in your Antivirus/WindowsDefnder an exclusion on the folder "%ProgramFiles%\RDP Wrapper" to prevent the deletion of RDP Wrapper files - 5. Now you can use the autoupdate batch file to install and update the RDP Wrapper. Please run the folling autoupdate batch file as administrator: + 5. Now you can use the autoupdate batch file to install and update the RDP Wrapper. Please run autoupdate.bat as administrator: "%ProgramFiles%\RDP Wrapper\autoupdate.bat" From 1150c1caf35cb5b3263ba5f197df672a431fb817 Mon Sep 17 00:00:00 2001 From: asmtron <49522124+asmtron@users.noreply.github.com> Date: Sat, 7 Sep 2019 17:43:50 +0000 Subject: [PATCH 09/17] Update autoupdate.bat code optimization: speedup streaming rdpwrap_new.ini to rdpwrap.ini --- bin/autoupdate.bat | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) diff --git a/bin/autoupdate.bat b/bin/autoupdate.bat index bdf819d..d401bbd 100644 --- a/bin/autoupdate.bat +++ b/bin/autoupdate.bat @@ -7,7 +7,7 @@ REM ------------------------------------------------------------------- REM REM autoupdate.bat REM -REM Automatic RDP Wrapper installer and updater // asmtron (20-08-2019) +REM Automatic RDP Wrapper installer and updater // asmtron (07-09-2019) REM ------------------------------------------------------------------- REM Options: REM -log = redirect display output to the file autoupdate.log @@ -110,9 +110,7 @@ for /f "tokens=1-2* usebackq" %%a in ( ) if %rdp_tcp_session%=="" ( echo [-] Listener session rdp-tcp NOT found^^! - if %rdpwrap_installed%=="0" ( - call :install - ) + call :install ) else ( echo [+] Found listener session: %rdp_tcp_session% ^(ID: %rdp_tcp_session_id%^). ) @@ -224,12 +222,10 @@ if exist %rdpwrap_new_ini% ( for /f "usebackq delims=" %%a in ( `findstr /n "^" %rdpwrap_new_ini%` ) do ( - set "line=!%%a!" - set "line=!line:*:=!" - if "!line!"=="*:=" ( + if "!%%a!"=="" ( echo. ) else ( - echo !line! + echo !%%a! ) ) )>%rdpwrap_ini% From 89ad43f458e1cd637695ad327fdd31b10efabe37 Mon Sep 17 00:00:00 2001 From: David Refoua Date: Sun, 8 Sep 2019 16:21:33 +0430 Subject: [PATCH 10/17] added missing builds 6.0.6001.22286 6.0.6001.22323 6.0.6001.22357 6.0.6001.22801 6.0.6002.22515 6.0.6002.22641 6.0.6002.22790 6.1.7600.20621 6.1.7600.21420 6.1.7601.22213 6.1.7601.22435 6.1.7601.22476 6.1.7601.24326 10.0.10240.18036 10.0.14393.2608 10.0.17763.168 10.0.17763.288 --- res/rdpwrap.ini | 350 +++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 349 insertions(+), 1 deletion(-) diff --git a/res/rdpwrap.ini b/res/rdpwrap.ini index fccd441..28a2ce4 100644 --- a/res/rdpwrap.ini +++ b/res/rdpwrap.ini @@ -2,7 +2,7 @@ ; Do not modify without special knowledge [Main] -Updated=2019-08-02 +Updated=2019-09-02 LogFile=\rdpwrap.txt SLPolicyHookNT60=1 SLPolicyHookNT61=1 @@ -93,6 +93,104 @@ DefPolicyPatch.x64=1 DefPolicyOffset.x64=65FF7 DefPolicyCode.x64=CDefPolicy_Query_eax_rcx_jmp +[6.0.6001.22286] +SingleUserPatch.x86=1 +SingleUserOffset.x86=185E4 +SingleUserCode.x86=nop +SingleUserPatch.x64=1 +SingleUserOffset.x64=70DDE +SingleUserCode.x64=Zero +DefPolicyPatch.x86=1 +DefPolicyOffset.x86=17FD8 +DefPolicyCode.x86=CDefPolicy_Query_edx_ecx +DefPolicyPatch.x64=1 +DefPolicyOffset.x64=65C01 +DefPolicyCode.x64=CDefPolicy_Query_eax_rcx_jmp + +[6.0.6001.22323] +SingleUserPatch.x86=1 +SingleUserOffset.x86=185E4 +SingleUserCode.x86=nop +SingleUserPatch.x64=1 +SingleUserOffset.x64=70DFA +SingleUserCode.x64=Zero +DefPolicyPatch.x86=1 +DefPolicyOffset.x86=17FD8 +DefPolicyCode.x86=CDefPolicy_Query_edx_ecx +DefPolicyPatch.x64=1 +DefPolicyOffset.x64=65C1D +DefPolicyCode.x64=CDefPolicy_Query_eax_rcx_jmp + +[6.0.6001.22357] +SingleUserPatch.x86=1 +SingleUserOffset.x86=185E4 +SingleUserCode.x86=nop +SingleUserPatch.x64=1 +SingleUserOffset.x64=70DFA +SingleUserCode.x64=Zero +DefPolicyPatch.x86=1 +DefPolicyOffset.x86=17FD8 +DefPolicyCode.x86=CDefPolicy_Query_edx_ecx +DefPolicyPatch.x64=1 +DefPolicyOffset.x64=65C1D +DefPolicyCode.x64=CDefPolicy_Query_eax_rcx_jmp + +[6.0.6001.22801] +SingleUserPatch.x86=1 +SingleUserOffset.x86=185F8 +SingleUserCode.x86=nop +SingleUserPatch.x64=1 +SingleUserOffset.x64=71ADA +SingleUserCode.x64=Zero +DefPolicyPatch.x86=1 +DefPolicyOffset.x86=18010 +DefPolicyCode.x86=CDefPolicy_Query_edx_ecx +DefPolicyPatch.x64=1 +DefPolicyOffset.x64=666AD +DefPolicyCode.x64=CDefPolicy_Query_eax_rcx_jmp + +[6.0.6002.22515] +SingleUserPatch.x86=1 +SingleUserOffset.x86=17FA8 +SingleUserCode.x86=nop +SingleUserPatch.x64=1 +SingleUserOffset.x64=71AFA +SingleUserCode.x64=Zero +DefPolicyPatch.x86=1 +DefPolicyOffset.x86=179C0 +DefPolicyCode.x86=CDefPolicy_Query_edx_ecx +DefPolicyPatch.x64=1 +DefPolicyOffset.x64=6675D +DefPolicyCode.x64=CDefPolicy_Query_eax_rcx_jmp + +[6.0.6002.22641] +SingleUserPatch.x86=1 +SingleUserOffset.x86=17FA8 +SingleUserCode.x86=nop +SingleUserPatch.x64=1 +SingleUserOffset.x64=71AFA +SingleUserCode.x64=Zero +DefPolicyPatch.x86=1 +DefPolicyOffset.x86=179C0 +DefPolicyCode.x86=CDefPolicy_Query_edx_ecx +DefPolicyPatch.x64=1 +DefPolicyOffset.x64=6675D +DefPolicyCode.x64=CDefPolicy_Query_eax_rcx_jmp + +[6.0.6002.22790] +SingleUserPatch.x86=1 +SingleUserOffset.x86=17FA8 +SingleUserCode.x86=nop +SingleUserPatch.x64=1 +SingleUserOffset.x64=71B02 +SingleUserCode.x64=Zero +DefPolicyPatch.x86=1 +DefPolicyOffset.x86=179C0 +DefPolicyCode.x86=CDefPolicy_Query_edx_ecx +DefPolicyPatch.x64=1 +DefPolicyOffset.x64=66765 +DefPolicyCode.x64=CDefPolicy_Query_eax_rcx_jmp + [6.0.6002.23521] SingleUserPatch.x86=1 SingleUserOffset.x86=17FB4 @@ -135,6 +233,20 @@ DefPolicyPatch.x64=1 DefPolicyOffset.x64=17AD2 DefPolicyCode.x64=CDefPolicy_Query_eax_rdi +[6.1.7600.20621] +SingleUserPatch.x86=1 +SingleUserOffset.x86=19E1D +SingleUserCode.x86=nop +SingleUserPatch.x64=1 +SingleUserOffset.x64=17DC2 +SingleUserCode.x64=Zero +DefPolicyPatch.x86=1 +DefPolicyOffset.x86=196EB +DefPolicyCode.x86=CDefPolicy_Query_eax_esi +DefPolicyPatch.x64=1 +DefPolicyOffset.x64=17ADE +DefPolicyCode.x64=CDefPolicy_Query_eax_rdi + [6.1.7600.20890] SingleUserPatch.x86=1 SingleUserOffset.x86=19E2D @@ -163,6 +275,20 @@ DefPolicyPatch.x64=1 DefPolicyOffset.x64=17B5E DefPolicyCode.x64=CDefPolicy_Query_eax_rdi +[6.1.7600.21420] +SingleUserPatch.x86=1 +SingleUserOffset.x86=19EF5 +SingleUserCode.x86=nop +SingleUserPatch.x64=1 +SingleUserOffset.x64=17D56 +SingleUserCode.x64=Zero +DefPolicyPatch.x86=1 +DefPolicyOffset.x86=19761 +DefPolicyCode.x86=CDefPolicy_Query_eax_esi +DefPolicyPatch.x64=1 +DefPolicyOffset.x64=17B3E +DefPolicyCode.x64=CDefPolicy_Query_eax_rdi + [6.1.7601.17514] SingleUserPatch.x86=1 SingleUserOffset.x86=1A49D @@ -247,6 +373,48 @@ DefPolicyPatch.x64=1 DefPolicyOffset.x64=17D5E DefPolicyCode.x64=CDefPolicy_Query_eax_rdi +[6.1.7601.22213] +SingleUserPatch.x86=1 +SingleUserOffset.x86=1A5AD +SingleUserCode.x86=nop +SingleUserPatch.x64=1 +SingleUserOffset.x64=17F26 +SingleUserCode.x64=Zero +DefPolicyPatch.x86=1 +DefPolicyOffset.x86=19DB1 +DefPolicyCode.x86=CDefPolicy_Query_eax_esi +DefPolicyPatch.x64=1 +DefPolicyOffset.x64=17D06 +DefPolicyCode.x64=CDefPolicy_Query_eax_rdi + +[6.1.7601.22435] +SingleUserPatch.x86=1 +SingleUserOffset.x86=1A5BD +SingleUserCode.x86=nop +SingleUserPatch.x64=1 +SingleUserOffset.x64=17F36 +SingleUserCode.x64=Zero +DefPolicyPatch.x86=1 +DefPolicyOffset.x86=19DB1 +DefPolicyCode.x86=CDefPolicy_Query_eax_esi +DefPolicyPatch.x64=1 +DefPolicyOffset.x64=17D16 +DefPolicyCode.x64=CDefPolicy_Query_eax_rdi + +[6.1.7601.22476] +SingleUserPatch.x86=1 +SingleUserOffset.x86=1A5CD +SingleUserCode.x86=nop +SingleUserPatch.x64=1 +SingleUserOffset.x64=17F56 +SingleUserCode.x64=Zero +DefPolicyPatch.x86=1 +DefPolicyOffset.x86=19DC1 +DefPolicyCode.x86=CDefPolicy_Query_eax_esi +DefPolicyPatch.x64=1 +DefPolicyOffset.x64=17D52 +DefPolicyCode.x64=CDefPolicy_Query_eax_rdi + [6.1.7601.22750] SingleUserPatch.x86=1 SingleUserOffset.x86=1A655 @@ -303,6 +471,20 @@ DefPolicyPatch.x64=1 DefPolicyOffset.x64=17D2E DefPolicyCode.x64=CDefPolicy_Query_eax_rdi +[6.1.7601.24326] +SingleUserPatch.x86=1 +SingleUserOffset.x86=1A675 +SingleUserCode.x86=nop +SingleUserPatch.x64=1 +SingleUserOffset.x64=17F1E +SingleUserCode.x64=Zero +DefPolicyPatch.x86=1 +DefPolicyOffset.x86=19E41 +DefPolicyCode.x86=CDefPolicy_Query_eax_esi +DefPolicyPatch.x64=1 +DefPolicyOffset.x64=17CEE +DefPolicyCode.x64=CDefPolicy_Query_eax_rdi + [6.1.7601.24402] SingleUserPatch.x86=1 SingleUserOffset.x86=1A675 @@ -848,6 +1030,32 @@ SLInitHook.x64=1 SLInitOffset.x64=250F0 SLInitFunc.x64=New_CSLQuery_Initialize +[10.0.10240.18036] +LocalOnlyPatch.x86=1 +LocalOnlyOffset.x86=A7E18 +LocalOnlyCode.x86=jmpshort +LocalOnlyPatch.x64=1 +LocalOnlyOffset.x64=96961 +LocalOnlyCode.x64=jmpshort +SingleUserPatch.x86=1 +SingleUserOffset.x86=32715 +SingleUserCode.x86=nop +SingleUserPatch.x64=1 +SingleUserOffset.x64=17264 +SingleUserCode.x64=Zero +DefPolicyPatch.x86=1 +DefPolicyOffset.x86=2F299 +DefPolicyCode.x86=CDefPolicy_Query_eax_ecx +DefPolicyPatch.x64=1 +DefPolicyOffset.x64=EDC5 +DefPolicyCode.x64=CDefPolicy_Query_eax_rcx +SLInitHook.x86=1 +SLInitOffset.x86=3F968 +SLInitFunc.x86=New_CSLQuery_Initialize +SLInitHook.x64=1 +SLInitOffset.x64=24C30 +SLInitFunc.x64=New_CSLQuery_Initialize + [10.0.10240.18186] LocalOnlyPatch.x86=1 LocalOnlyOffset.x86=A8048 @@ -1500,6 +1708,21 @@ SLInitHook.x64=1 SLInitOffset.x64=C920 SLInitFunc.x64=New_CSLQuery_Initialize +[10.0.14393.2608] +; no x64 version +LocalOnlyPatch.x86=1 +LocalOnlyOffset.x86=A6248 +LocalOnlyCode.x86=jmpshort +SingleUserPatch.x86=1 +SingleUserOffset.x86=36CE5 +SingleUserCode.x86=nop +DefPolicyPatch.x86=1 +DefPolicyOffset.x86=31209 +DefPolicyCode.x86=CDefPolicy_Query_eax_ecx +SLInitHook.x86=1 +SLInitOffset.x86=45824 +SLInitFunc.x86=New_CSLQuery_Initialize + [10.0.14393.2906] LocalOnlyPatch.x86=1 LocalOnlyOffset.x86=A6578 @@ -3274,6 +3497,62 @@ SLInitHook.x64=1 SLInitOffset.x64=1ABFC SLInitFunc.x64=New_CSLQuery_Initialize +[10.0.17763.168] +LocalOnlyPatch.x86=1 +LocalOnlyOffset.x86=AFC74 +LocalOnlyCode.x86=jmpshort +LocalOnlyPatch.x64=1 +LocalOnlyOffset.x64=77AF1 +LocalOnlyCode.x64=jmpshort +SingleUserPatch.x86=1 +SingleUserOffset.x86=4D665 +SingleUserCode.x86=nop +SingleUserPatch.x64=1 +SingleUserOffset.x64=1322C +SingleUserCode.x64=Zero +DefPolicyPatch.x86=1 +DefPolicyOffset.x86=4BE69 +DefPolicyCode.x86=CDefPolicy_Query_eax_ecx +DefPolicyPatch.x64=1 +DefPolicyOffset.x64=17F45 +DefPolicyCode.x64=CDefPolicy_Query_eax_rcx +SLInitHook.x86=1 +SLInitOffset.x86=5B18A +SLInitFunc.x86=New_CSLQuery_Initialize +SLInitHook.x64=1 +SLInitOffset.x64=1ABFC +SLInitFunc.x64=New_CSLQuery_Initialize + +[10.0.17763.288] +; Patch CEnforcementCore::GetInstanceOfTSLicense +LocalOnlyPatch.x86=1 +LocalOnlyOffset.x86=AFAD4 +LocalOnlyCode.x86=jmpshort +LocalOnlyPatch.x64=1 +LocalOnlyOffset.x64=77A11 +LocalOnlyCode.x64=jmpshort +; Patch CSessionArbitrationHelper::IsSingleSessionPerUserEnabled +SingleUserPatch.x86=1 +SingleUserOffset.x86=4D665 +SingleUserCode.x86=nop +SingleUserPatch.x64=1 +SingleUserOffset.x64=1322C +SingleUserCode.x64=Zero +; Patch CDefPolicy::Query +DefPolicyPatch.x86=1 +DefPolicyOffset.x86=4BE69 +DefPolicyCode.x86=CDefPolicy_Query_eax_ecx +DefPolicyPatch.x64=1 +DefPolicyOffset.x64=17F45 +DefPolicyCode.x64=CDefPolicy_Query_eax_rcx +; Hook CSLQuery::Initialize +SLInitHook.x86=1 +SLInitOffset.x86=5B18A +SLInitFunc.x86=New_CSLQuery_Initialize +SLInitHook.x64=1 +SLInitOffset.x64=1ABFC +SLInitFunc.x64=New_CSLQuery_Initialize + [10.0.17763.292] ; Patch CEnforcementCore::GetInstanceOfTSLicense LocalOnlyPatch.x86=1 @@ -3758,6 +4037,26 @@ bServerSku.x86 =C3F74 ulMaxDebugSessions.x86=C3F78 bRemoteConnAllowed.x86=C3F7C +zlMaxUserSessions.x64 =F23B0 +lMaxUserSessions.x64 =F23B0 +bAppServerAllowed.x64 =F23B4 +bServerSku.x64 =F23B8 +bFUSEnabled.x64 =F3460 +bInitialized.x64 =F3464 +bMultimonAllowed.x64 =F3468 +ulMaxDebugSessions.x64=F346C +bRemoteConnAllowed.x64=F3470 + +[10.0.10240.18036-SLInit] +bFUSEnabled.x86 =C3F88 +lMaxUserSessions.x86 =C3F8C +bAppServerAllowed.x86 =C3F90 +bInitialized.x86 =C3F94 +bMultimonAllowed.x86 =C3F98 +bServerSku.x86 =C3F9C +ulMaxDebugSessions.x86=C3FA0 +bRemoteConnAllowed.x86=C3FA4 + lMaxUserSessions.x64 =F23B0 bAppServerAllowed.x64 =F23B4 bServerSku.x64 =F23B8 @@ -4243,6 +4542,17 @@ bMultimonAllowed.x64 =E8478 ulMaxDebugSessions.x64=E847C bFUSEnabled.x64 =E8480 +[10.0.14393.2608-SLInit] +; no x64 version +bInitialized.x86 =C1F94 +bServerSku.x86 =C1F98 +lMaxUserSessions.x86 =C1F9C +bAppServerAllowed.x86 =C1FA0 +bRemoteConnAllowed.x86=C1FA4 +bMultimonAllowed.x86 =C1FA8 +ulMaxDebugSessions.x86=C1FAC +bFUSEnabled.x86 =C1FB0 + [10.0.14393.2906-SLInit] bInitialized.x86 =C2F94 bServerSku.x86 =C2F98 @@ -5538,6 +5848,44 @@ bMultimonAllowed.x64 =ECAC8 ulMaxDebugSessions.x64=ECACC bFUSEnabled.x64 =ECAD0 +[10.0.17763.168-SLInit] +bInitialized.x86 =CD798 +bServerSku.x86 =CD79C +lMaxUserSessions.x86 =CD7A0 +bAppServerAllowed.x86 =CD7A8 +bRemoteConnAllowed.x86=CD7AC +bMultimonAllowed.x86 =CD7B0 +ulMaxDebugSessions.x86=CD7B4 +bFUSEnabled.x86 =CD7B8 + +bInitialized.x64 =ECAB0 +bServerSku.x64 =ECAB4 +lMaxUserSessions.x64 =ECAB8 +bAppServerAllowed.x64 =ECAC0 +bRemoteConnAllowed.x64=ECAC4 +bMultimonAllowed.x64 =ECAC8 +ulMaxDebugSessions.x64=ECACC +bFUSEnabled.x64 =ECAD0 + +[10.0.17763.288-SLInit] +bInitialized.x86 =CD798 +bServerSku.x86 =CD79C +lMaxUserSessions.x86 =CD7A0 +bAppServerAllowed.x86 =CD7A8 +bRemoteConnAllowed.x86=CD7AC +bMultimonAllowed.x86 =CD7B0 +ulMaxDebugSessions.x86=CD7B4 +bFUSEnabled.x86 =CD7B8 + +bInitialized.x64 =ECAB0 +bServerSku.x64 =ECAB4 +lMaxUserSessions.x64 =ECAB8 +bAppServerAllowed.x64 =ECAC0 +bRemoteConnAllowed.x64=ECAC4 +bMultimonAllowed.x64 =ECAC8 +ulMaxDebugSessions.x64=ECACC +bFUSEnabled.x64 =ECAD0 + [10.0.17763.292-SLInit] bInitialized.x86 =CD798 bServerSku.x86 =CD79C From f07ff3d1eab673576055c5ad933e0718c35506f7 Mon Sep 17 00:00:00 2001 From: David Refoua Date: Fri, 13 Sep 2019 18:42:50 +0430 Subject: [PATCH 11/17] remove redundant lines --- res/rdpwrap.ini | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-) diff --git a/res/rdpwrap.ini b/res/rdpwrap.ini index 532d460..edba014 100644 --- a/res/rdpwrap.ini +++ b/res/rdpwrap.ini @@ -3638,14 +3638,6 @@ SLInitFunc.x86=New_CSLQuery_Initialize SLInitHook.x64=1 SLInitOffset.x64=1ACDC SLInitFunc.x64=New_CSLQuery_Initialize -bInitialized.x64 =ECAB0 -bServerSku.x64 =ECAB4 -lMaxUserSessions.x64 =ECAB8 -bAppServerAllowed.x64 =ECAC0 -bRemoteConnAllowed.x64=ECAC4 -bMultimonAllowed.x64 =ECAC8 -ulMaxDebugSessions.x64=ECACC -bFUSEnabled.x64 =ECAD0 [10.0.17134.706] LocalOnlyPatch.x86=1 @@ -6017,4 +6009,4 @@ bAppServerAllowed.x64 =F6A9C bRemoteConnAllowed.x64=F6AA0 bMultimonAllowed.x64 =F6AA4 ulMaxDebugSessions.x64=F6AA8 -bFUSEnabled.x64 =F6AAC \ No newline at end of file +bFUSEnabled.x64 =F6AAC From 965c51656fd75354166fec05fa988897fc959584 Mon Sep 17 00:00:00 2001 From: David Refoua Date: Fri, 13 Sep 2019 18:43:33 +0430 Subject: [PATCH 12/17] remove redundant lines --- res/rdpwrap.ini | 8 -------- 1 file changed, 8 deletions(-) diff --git a/res/rdpwrap.ini b/res/rdpwrap.ini index 28a2ce4..e517c23 100644 --- a/res/rdpwrap.ini +++ b/res/rdpwrap.ini @@ -3638,14 +3638,6 @@ SLInitFunc.x86=New_CSLQuery_Initialize SLInitHook.x64=1 SLInitOffset.x64=1ACDC SLInitFunc.x64=New_CSLQuery_Initialize -bInitialized.x64 =ECAB0 -bServerSku.x64 =ECAB4 -lMaxUserSessions.x64 =ECAB8 -bAppServerAllowed.x64 =ECAC0 -bRemoteConnAllowed.x64=ECAC4 -bMultimonAllowed.x64 =ECAC8 -ulMaxDebugSessions.x64=ECACC -bFUSEnabled.x64 =ECAD0 [10.0.17134.706] LocalOnlyPatch.x86=1 From 9b113b48e05a8c6ff98af666cbf436cb1f61c5d6 Mon Sep 17 00:00:00 2001 From: David Refoua Date: Fri, 13 Sep 2019 18:59:59 +0430 Subject: [PATCH 13/17] remove duplicated entries --- res/rdpwrap.ini | 58 +------------------------------------------------ 1 file changed, 1 insertion(+), 57 deletions(-) diff --git a/res/rdpwrap.ini b/res/rdpwrap.ini index 63f1c2a..f116cc7 100644 --- a/res/rdpwrap.ini +++ b/res/rdpwrap.ini @@ -3488,7 +3488,7 @@ LocalOnlyPatch.x64=1 LocalOnlyOffset.x64=77941 LocalOnlyCode.x64=jmpshort SingleUserPatch.x64=1 -SingleUserOffset.x64=1322C +SingleUserOffset.x64=132F9 SingleUserCode.x64=Zero DefPolicyPatch.x64=1 DefPolicyOffset.x64=17F45 @@ -3553,62 +3553,6 @@ SLInitHook.x64=1 SLInitOffset.x64=1ABFC SLInitFunc.x64=New_CSLQuery_Initialize -[10.0.17763.168] -LocalOnlyPatch.x86=1 -LocalOnlyOffset.x86=AFC74 -LocalOnlyCode.x86=jmpshort -LocalOnlyPatch.x64=1 -LocalOnlyOffset.x64=77AF1 -LocalOnlyCode.x64=jmpshort -SingleUserPatch.x86=1 -SingleUserOffset.x86=4D665 -SingleUserCode.x86=nop -SingleUserPatch.x64=1 -SingleUserOffset.x64=1322C -SingleUserCode.x64=Zero -DefPolicyPatch.x86=1 -DefPolicyOffset.x86=4BE69 -DefPolicyCode.x86=CDefPolicy_Query_eax_ecx -DefPolicyPatch.x64=1 -DefPolicyOffset.x64=17F45 -DefPolicyCode.x64=CDefPolicy_Query_eax_rcx -SLInitHook.x86=1 -SLInitOffset.x86=5B18A -SLInitFunc.x86=New_CSLQuery_Initialize -SLInitHook.x64=1 -SLInitOffset.x64=1ABFC -SLInitFunc.x64=New_CSLQuery_Initialize - -[10.0.17763.288] -; Patch CEnforcementCore::GetInstanceOfTSLicense -LocalOnlyPatch.x86=1 -LocalOnlyOffset.x86=AFAD4 -LocalOnlyCode.x86=jmpshort -LocalOnlyPatch.x64=1 -LocalOnlyOffset.x64=77A11 -LocalOnlyCode.x64=jmpshort -; Patch CSessionArbitrationHelper::IsSingleSessionPerUserEnabled -SingleUserPatch.x86=1 -SingleUserOffset.x86=4D665 -SingleUserCode.x86=nop -SingleUserPatch.x64=1 -SingleUserOffset.x64=1322C -SingleUserCode.x64=Zero -; Patch CDefPolicy::Query -DefPolicyPatch.x86=1 -DefPolicyOffset.x86=4BE69 -DefPolicyCode.x86=CDefPolicy_Query_eax_ecx -DefPolicyPatch.x64=1 -DefPolicyOffset.x64=17F45 -DefPolicyCode.x64=CDefPolicy_Query_eax_rcx -; Hook CSLQuery::Initialize -SLInitHook.x86=1 -SLInitOffset.x86=5B18A -SLInitFunc.x86=New_CSLQuery_Initialize -SLInitHook.x64=1 -SLInitOffset.x64=1ABFC -SLInitFunc.x64=New_CSLQuery_Initialize - [10.0.17763.292] ; Patch CEnforcementCore::GetInstanceOfTSLicense LocalOnlyPatch.x86=1 From fc2e2142b1e304f7703cc4fe045cde068b2d1fe9 Mon Sep 17 00:00:00 2001 From: David Refoua Date: Fri, 13 Sep 2019 19:04:02 +0430 Subject: [PATCH 14/17] fix value --- res/rdpwrap.ini | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/res/rdpwrap.ini b/res/rdpwrap.ini index f116cc7..edba014 100644 --- a/res/rdpwrap.ini +++ b/res/rdpwrap.ini @@ -3488,7 +3488,7 @@ LocalOnlyPatch.x64=1 LocalOnlyOffset.x64=77941 LocalOnlyCode.x64=jmpshort SingleUserPatch.x64=1 -SingleUserOffset.x64=132F9 +SingleUserOffset.x64=1322C SingleUserCode.x64=Zero DefPolicyPatch.x64=1 DefPolicyOffset.x64=17F45 From 97cdaf8f6d83f8270d417664b4c807aa12f18f2d Mon Sep 17 00:00:00 2001 From: David Refoua Date: Fri, 13 Sep 2019 19:19:57 +0430 Subject: [PATCH 15/17] remove duplicated entry --- res/rdpwrap.ini | 45 --------------------------------------------- 1 file changed, 45 deletions(-) diff --git a/res/rdpwrap.ini b/res/rdpwrap.ini index edba014..817b12e 100644 --- a/res/rdpwrap.ini +++ b/res/rdpwrap.ini @@ -3639,32 +3639,6 @@ SLInitHook.x64=1 SLInitOffset.x64=1ACDC SLInitFunc.x64=New_CSLQuery_Initialize -[10.0.17134.706] -LocalOnlyPatch.x86=1 -LocalOnlyOffset.x86=ADAB8 -LocalOnlyCode.x86=jmpshort -LocalOnlyPatch.x64=1 -LocalOnlyOffset.x64=92521 -LocalOnlyCode.x64=jmpshort -SingleUserPatch.x86=1 -SingleUserOffset.x86=36B1C -SingleUserCode.x86=nop -SingleUserPatch.x64=1 -SingleUserOffset.x64=1511C -SingleUserCode.x64=Zero -DefPolicyPatch.x86=1 -DefPolicyOffset.x86=33579 -DefPolicyCode.x86=CDefPolicy_Query_eax_ecx -DefPolicyPatch.x64=1 -DefPolicyOffset.x64=10E78 -DefPolicyCode.x64=CDefPolicy_Query_edi_rcx -SLInitHook.x86=1 -SLInitOffset.x86=475DD -SLInitFunc.x86=New_CSLQuery_Initialize -SLInitHook.x64=1 -SLInitOffset.x64=22F5C -SLInitFunc.x64=New_CSLQuery_Initialize - [10.0.18362.1] LocalOnlyPatch.x86=1 LocalOnlyOffset.x86=B7A16 @@ -5935,25 +5909,6 @@ bMultimonAllowed.x64 =ECAC8 ulMaxDebugSessions.x64=ECACC bFUSEnabled.x64 =ECAD0 -[10.0.17134.706-SLInit] -bInitialized.x86 =CBF38 -bServerSku.x86 =CBF3C -lMaxUserSessions.x86 =CBF40 -bAppServerAllowed.x86 =CBF44 -bRemoteConnAllowed.x86=CBF48 -bMultimonAllowed.x86 =CBF4C -ulMaxDebugSessions.x86=CBF50 -bFUSEnabled.x86 =CBF54 - -bServerSku.x64 =F1378 -lMaxUserSessions.x64 =F137C -bAppServerAllowed.x64 =F1380 -bInitialized.x64 =F2430 -bRemoteConnAllowed.x64=F2434 -bMultimonAllowed.x64 =F2438 -ulMaxDebugSessions.x64=F243C -bFUSEnabled.x64 =F2440 - [10.0.18362.1-SLInit] bInitialized.x86 =D477C bServerSku.x86 =D4780 From fe75be6dac72d912e694ed100a3dc71f5eca2909 Mon Sep 17 00:00:00 2001 From: David Refoua Date: Fri, 13 Sep 2019 19:22:20 +0430 Subject: [PATCH 16/17] add 10.0.18908.1000; general cleanup --- res/rdpwrap.ini | 85 +++++++++++++++++++++++++++++++------------------ 1 file changed, 54 insertions(+), 31 deletions(-) diff --git a/res/rdpwrap.ini b/res/rdpwrap.ini index 817b12e..80977cf 100644 --- a/res/rdpwrap.ini +++ b/res/rdpwrap.ini @@ -65,34 +65,6 @@ DefPolicyPatch.x64=1 DefPolicyOffset.x64=65BD7 DefPolicyCode.x64=CDefPolicy_Query_eax_rcx_jmp -[6.0.6002.18005] -SingleUserPatch.x86=1 -SingleUserOffset.x86=17FA8 -SingleUserCode.x86=nop -SingleUserPatch.x64=1 -SingleUserOffset.x64=70FF6 -SingleUserCode.x64=Zero -DefPolicyPatch.x86=1 -DefPolicyOffset.x86=179C0 -DefPolicyCode.x86=CDefPolicy_Query_edx_ecx -DefPolicyPatch.x64=1 -DefPolicyOffset.x64=65E83 -DefPolicyCode.x64=CDefPolicy_Query_eax_rcx_jmp - -[6.0.6002.19214] -SingleUserPatch.x86=1 -SingleUserOffset.x86=17FC4 -SingleUserCode.x86=nop -SingleUserPatch.x64=1 -SingleUserOffset.x64=712AA -SingleUserCode.x64=Zero -DefPolicyPatch.x86=1 -DefPolicyOffset.x86=179B8 -DefPolicyCode.x86=CDefPolicy_Query_edx_ecx -DefPolicyPatch.x64=1 -DefPolicyOffset.x64=65FF7 -DefPolicyCode.x64=CDefPolicy_Query_eax_rcx_jmp - [6.0.6001.22286] SingleUserPatch.x86=1 SingleUserOffset.x86=185E4 @@ -149,6 +121,34 @@ DefPolicyPatch.x64=1 DefPolicyOffset.x64=666AD DefPolicyCode.x64=CDefPolicy_Query_eax_rcx_jmp +[6.0.6002.18005] +SingleUserPatch.x86=1 +SingleUserOffset.x86=17FA8 +SingleUserCode.x86=nop +SingleUserPatch.x64=1 +SingleUserOffset.x64=70FF6 +SingleUserCode.x64=Zero +DefPolicyPatch.x86=1 +DefPolicyOffset.x86=179C0 +DefPolicyCode.x86=CDefPolicy_Query_edx_ecx +DefPolicyPatch.x64=1 +DefPolicyOffset.x64=65E83 +DefPolicyCode.x64=CDefPolicy_Query_eax_rcx_jmp + +[6.0.6002.19214] +SingleUserPatch.x86=1 +SingleUserOffset.x86=17FC4 +SingleUserCode.x86=nop +SingleUserPatch.x64=1 +SingleUserOffset.x64=712AA +SingleUserCode.x64=Zero +DefPolicyPatch.x86=1 +DefPolicyOffset.x86=179B8 +DefPolicyCode.x86=CDefPolicy_Query_edx_ecx +DefPolicyPatch.x64=1 +DefPolicyOffset.x64=65FF7 +DefPolicyCode.x64=CDefPolicy_Query_eax_rcx_jmp + [6.0.6002.22515] SingleUserPatch.x86=1 SingleUserOffset.x86=17FA8 @@ -3717,6 +3717,20 @@ SLInitHook.x64=1 SLInitOffset.x64=22DDC SLInitFunc.x64=New_CSLQuery_Initialize +[10.0.18908.1000] +LocalOnlyPatch.x64=1 +LocalOnlyOffset.x64=879E4 +LocalOnlyCode.x64=jmpshort +SingleUserPatch.x64=1 +SingleUserOffset.x64=1CC2C +SingleUserCode.x64=Zero +DefPolicyPatch.x64=1 +DefPolicyOffset.x64=24B35 +DefPolicyCode.x64=CDefPolicy_Query_eax_rcx +SLInitHook.x64=1 +SLInitOffset.x64=2853C +SLInitFunc.x64=New_CSLQuery_Initialize + [SLInit] bServerSku=1 bRemoteConnAllowed=1 @@ -4003,7 +4017,6 @@ bServerSku.x86 =C3F74 ulMaxDebugSessions.x86=C3F78 bRemoteConnAllowed.x86=C3F7C -zlMaxUserSessions.x64 =F23B0 lMaxUserSessions.x64 =F23B0 bAppServerAllowed.x64 =F23B4 bServerSku.x64 =F23B8 @@ -5843,8 +5856,8 @@ bMultimonAllowed.x86 =CD7B0 ulMaxDebugSessions.x86=CD7B4 bFUSEnabled.x86 =CD7B8 -bInitialized.x64 =ECAB0 -bServerSku.x64 =ECAB4 +bInitialized.x64 =ECAB0 +bServerSku.x64 =ECAB4 lMaxUserSessions.x64 =ECAB8 bAppServerAllowed.x64 =ECAC0 bRemoteConnAllowed.x64=ECAC4 @@ -5947,6 +5960,16 @@ bMultimonAllowed.x64 =F6AA4 ulMaxDebugSessions.x64=F6AA8 bFUSEnabled.x64 =F6AAC +[10.0.18908.1000-SLInit] +bInitialized.x64 =FFD58 +bServerSku.x64 =FFD5C +lMaxUserSessions.x64 =FFD60 +bAppServerAllowed.x64 =FFD68 +bRemoteConnAllowed.x64=FFD6C +bMultimonAllowed.x64 =FFD70 +ulMaxDebugSessions.x64=FFD74 +bFUSEnabled.x64 =FFD78 + [10.0.18362.267-SLInit] bInitialized.x86 =D577C bServerSku.x86 =D5780 From 433a7122a48a9331ae0acc8a2d9858603e6203a7 Mon Sep 17 00:00:00 2001 From: David Refoua Date: Fri, 13 Sep 2019 19:29:14 +0430 Subject: [PATCH 17/17] fix value --- res/rdpwrap.ini | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/res/rdpwrap.ini b/res/rdpwrap.ini index 80977cf..17c7dca 100644 --- a/res/rdpwrap.ini +++ b/res/rdpwrap.ini @@ -3488,7 +3488,7 @@ LocalOnlyPatch.x64=1 LocalOnlyOffset.x64=77941 LocalOnlyCode.x64=jmpshort SingleUserPatch.x64=1 -SingleUserOffset.x64=1322C +SingleUserOffset.x64=132F9 SingleUserCode.x64=Zero DefPolicyPatch.x64=1 DefPolicyOffset.x64=17F45