| 56 | fnNtCallbackReturn g_pfnNtCallbackReturn = nullptr; |
| 57 | |
| 58 | BOOL FindHMValidateHandle() { |
| 59 | HMODULE hUser32 = LoadLibraryA("user32.dll"); |
| 60 | if (hUser32 == NULL) { |
| 61 | printf("Failed to load user32"); |
| 62 | return FALSE; |
| 63 | } |
| 64 | |
| 65 | BYTE* pIsMenu = (BYTE *)GetProcAddress(hUser32, "IsMenu"); |
| 66 | if (pIsMenu == NULL) { |
| 67 | printf("Failed to find location of exported function 'IsMenu' within user32.dll\n"); |
| 68 | return FALSE; |
| 69 | } |
| 70 | unsigned int uiHMValidateHandleOffset = 0; |
| 71 | for (unsigned int i = 0; i < 0x1000; i++) { |
| 72 | BYTE* test = pIsMenu + i; |
| 73 | if (*test == 0xE8) { |
| 74 | uiHMValidateHandleOffset = i + 1; |
| 75 | break; |
| 76 | } |
| 77 | } |
| 78 | if (uiHMValidateHandleOffset == 0) { |
| 79 | printf("Failed to find offset of HMValidateHandle from location of 'IsMenu'\n"); |
| 80 | return FALSE; |
| 81 | } |
| 82 | |
| 83 | unsigned int addr = *(unsigned int *)(pIsMenu + uiHMValidateHandleOffset); |
| 84 | unsigned int offset = ((unsigned int)pIsMenu - (unsigned int)hUser32) + addr; |
| 85 | //The +11 is to skip the padding bytes as on Windows 10 these aren't nops |
| 86 | g_pfnHmValidateHandle = (lHMValidateHandle)((ULONG_PTR)hUser32 + offset + 11); |
| 87 | return TRUE; |
| 88 | } |
| 89 | |
| 90 | |
| 91 | HWND GuessHwnd(QWORD *pBaseAddress, DWORD dwRegionSize) |