-
Notifications
You must be signed in to change notification settings - Fork 4
Closed
Description
In latest canary builds, Microsoft changed the size of the UAC data.
Supposingly the code should be changed to something like that:
write_target = *reinterpret_cast<void**>(buffer + 0xC0);// Original: 6 * sizeof(UINT32) + 4 * sizeof(void*));
size_t base_offset = 0;
if (uac_type == 0 || uac_type ==2) {//Known to be excutable
//uac_type==2 means msi. which is similar to exe except that content meanings have changed.
base_offset = 0xD0;//Original:6 * sizeof(DWORD) + 6 * sizeof(void*);
}
else if (uac_type == 1) {//dll
base_offset = 0xC8;//Original:6 * sizeof(DWORD) + 5 * sizeof(void*);
}`
Metadata
Metadata
Assignees
Labels
No labels