Skip to content

Commit 1bf0d81

Browse files
AmrsatrioAmrsatrio
committed
fix(TwinUIPatches): refine CStartExperienceManager::Hide() and CJumpViewExperienceManager::m_trayStuckPlace ARM64 patterns to work with 29553+
1 parent 3be4f3f commit 1bf0d81

2 files changed

Lines changed: 74 additions & 50 deletions

File tree

‎ExplorerPatcher/TwinUIPatches.cpp‎

Lines changed: 62 additions & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -2307,7 +2307,7 @@ BOOL FixStartMenuAnimation(HMODULE hTwinuiPcshell, PBYTE pSearchBegin, size_t cb
23072307
// 48 8D ?? ?? ?? 00 00 8B ?? E8 ?? ?? ?? ?? 8B ?? 85 C0
23082308
// Perform on exactly two matches
23092309
// Fortunately both are 12 bytes
2310-
auto hide_findForOne = [](PBYTE pBegin, SIZE_T cbSearch) -> PBYTE
2310+
auto hide_findForOne = [](PBYTE pBegin, size_t cbSearch) -> PBYTE
23112311
{
23122312
PBYTE pMovMov = (PBYTE)FindPattern(
23132313
pBegin,
@@ -2375,61 +2375,62 @@ BOOL FixStartMenuAnimation(HMODULE hTwinuiPcshell, PBYTE pSearchBegin, size_t cb
23752375
}
23762376
};
23772377
#elif defined(_M_ARM64)
2378-
// ```
2379-
// E1 03 ?? 2A ?? ?? 04 91 ?? ?? ?? ?? ?? 03 00 2A
2380-
// ```
2381-
// Check two instructions before, and NOP these:
2382-
// ```
2383-
// MOV W??, #3
2384-
// STRB W??, [X??,#0x???]
2385-
// ```
2378+
// Find for nop targets:
2379+
// MOV W??, #3
2380+
// P: 010100101_00_0000000000000011_00000 = 52800060 = 60 00 80 52
2381+
// M: 111111111_11_1111111111111111_00000 = FFFFFFE0 = E0 FF FF FF
2382+
// STRB W??, [X??,#0x???]
2383+
// 22000.2899 0011100100_001010001011_10101_11011
2384+
// 22621.1918 0011100100_001010100011_10011_11011
2385+
// 26100.5551 0011100100_001011010011_10100_11010
2386+
// 29553.1000 0011100100_001011010011_10101_10100
2387+
// P: 0011100100_001010000011_10000_10000 = 390A0E10 = 10 0E 0A 39
2388+
// M: 1111111111_111110000111_11000_10000 = FFFE1F10 = 10 1F FE FF
2389+
// Nop if followed by a Hide() call
2390+
// E1 03 ?? 2A ?? ?? 04 91 ?? ?? ?? ?? ?? 03 00 2A
23862391
// Perform on exactly two matches
2387-
PBYTE matchHideA = nullptr;
2388-
PBYTE matchHideB = nullptr;
2389-
auto hide_findTheIfBody = [](PBYTE pAnchor) -> PBYTE
2392+
auto hide_findForOne = [](PBYTE pBegin, size_t cbSearch) -> PBYTE
23902393
{
2391-
// 27881.1000+ has CBNZ before us, follow it if it is.
2392-
// Otherwise, just check the two instructions before.
2393-
PBYTE pMaybeFollowed = (PBYTE)ARM64_FollowCBNZW((DWORD*)(pAnchor - 4));
2394-
PBYTE pIfBlockBegin = pMaybeFollowed ? pMaybeFollowed : pAnchor - 8;
2395-
2396-
DWORD insnMovzw = *(DWORD*)pIfBlockBegin;
2397-
if (!ARM64_IsMOVZW(insnMovzw))
2398-
return nullptr;
2399-
2400-
DWORD movzwImm16 = ARM64_ReadBitsSignExtend(insnMovzw, 20, 5);
2401-
if (movzwImm16 != 3)
2402-
return nullptr;
2394+
PBYTE pMovStrb = (PBYTE)FindPatternBitMask_4_(
2395+
pBegin,
2396+
cbSearch,
2397+
"\x60\x00\x80\x52\x10\x0E\x0A\x39",
2398+
"\xE0\xFF\xFF\xFF\x10\x1F\xFE\xFF",
2399+
8
2400+
);
2401+
if (pMovStrb)
2402+
{
2403+
PBYTE pAfterMovStrb = pMovStrb + 8;
24032404

2404-
DWORD insnStrbimm = *(DWORD*)(pIfBlockBegin + 4);
2405-
if (!ARM64_IsSTRBIMM(insnStrbimm))
2406-
return nullptr;
2405+
// We might be a jmp, follow it if so
2406+
PBYTE pJmpTarget = (PBYTE)ARM64_FollowB((DWORD*)pAfterMovStrb);
2407+
if (pJmpTarget)
2408+
{
2409+
pAfterMovStrb = pJmpTarget;
2410+
}
24072411

2408-
return pIfBlockBegin;
2412+
// Now test
2413+
bool bThisIsHideCall = FindPattern_4_(
2414+
pAfterMovStrb,
2415+
16, // Pattern size
2416+
"\xE1\x03\x00\x2A\x00\x00\x04\x91\x00\x00\x00\x00\x00\x03\x00\x2A",
2417+
"xx?x??xx?????xxx"
2418+
) == pAfterMovStrb;
2419+
if (!bThisIsHideCall)
2420+
{
2421+
pMovStrb = nullptr; // No, not this one
2422+
}
2423+
}
2424+
return pMovStrb;
2425+
// @Note: We don't retry searches because the "No, not this one" blocks are never executed during testing
2426+
// with a variety of twinui.pcshell.dll binaries
24092427
};
2410-
PBYTE matchHideAAfter = (PBYTE)FindPattern(
2411-
pSearchBegin,
2412-
cbSearch,
2413-
"\xE1\x03\x00\x2A\x00\x00\x04\x91\x00\x00\x00\x00\x00\x03\x00\x2A",
2414-
"xx?x??xx?????xxx"
2415-
);
2416-
if (matchHideAAfter)
2417-
{
2418-
matchHideA = hide_findTheIfBody(matchHideAAfter);
2419-
}
2428+
PBYTE matchHideA = hide_findForOne(pSearchBegin, cbSearch);
2429+
PBYTE matchHideB = nullptr;
24202430
if (matchHideA)
24212431
{
24222432
printf("[SMA] matchHideA in CStartExperienceManager::Hide() = %llX\n", matchHideA - (PBYTE)hTwinuiPcshell);
2423-
PBYTE matchHideBAfter = (PBYTE)FindPattern(
2424-
matchHideAAfter + 16,
2425-
1024,
2426-
"\xE1\x03\x00\x2A\x00\x00\x04\x91\x00\x00\x00\x00\x00\x03\x00\x2A",
2427-
"xx?x??xx?????xxx"
2428-
);
2429-
if (matchHideBAfter)
2430-
{
2431-
matchHideB = hide_findTheIfBody(matchHideBAfter);
2432-
}
2433+
matchHideB = hide_findForOne(matchHideA + 8, cbSearch - (matchHideA + 8 - (PBYTE)pSearchBegin));
24332434
if (matchHideB)
24342435
{
24352436
printf("[SMA] matchHideB in CStartExperienceManager::Hide() = %llX\n", matchHideB - (PBYTE)hTwinuiPcshell);
@@ -2962,6 +2963,19 @@ BOOL FixJumpViewPositioning(HMODULE hTwinuiPcshell, PBYTE pSearchBegin, size_t c
29622963
"\x41\xB9\x89\x0B\x80\x52\xA8\x01\x00\x34\x1F\x05\x00\x71\x20\x01\x00\x54\x1F\x09\x00\x71\xA0\x00\x00\x54\x1F\x0D\x00\x71\x01\x01\x00\x54\x69\x0B\x80\x52",
29632964
"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
29642965
);
2966+
if (!matchOffsetTrayStuckPlace)
2967+
{
2968+
// 29553+
2969+
// ?? ?? 41 B9 C8 01 00 34 1F 05 00 71 40 01 00 54 1F 09 00 71 C0 00 00 54 89 0B 80 52
2970+
// ^^^^^^^^^^^
2971+
// Ref: CJumpViewExperienceManager::OnViewCloaking()
2972+
matchOffsetTrayStuckPlace = (PBYTE)FindPattern_4_(
2973+
pSearchBegin + 2,
2974+
cbSearch - 2,
2975+
"\x41\xB9\xC8\x01\x00\x34\x1F\x05\x00\x71\x40\x01\x00\x54\x1F\x09\x00\x71\xC0\x00\x00\x54\x89\x0B\x80\x52",
2976+
"xxxxxxxxxxxxxxxxxxxxxxxxxx"
2977+
);
2978+
}
29652979
#endif
29662980
if (matchOffsetTrayStuckPlace)
29672981
{

‎ExplorerPatcher/utility.h‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1067,6 +1067,7 @@ __forceinline BOOL ARM64_IsCBZW(DWORD insn) { return ARM64_ReadBits(insn, 31, 24
10671067
__forceinline BOOL ARM64_IsCBNZW(DWORD insn) { return ARM64_ReadBits(insn, 31, 24) == 0b00110101; }
10681068
__forceinline BOOL ARM64_IsTBZ(DWORD insn) { return ARM64_ReadBits(insn, 31, 24) == 0b00110110; }
10691069
__forceinline BOOL ARM64_IsTBNZ(DWORD insn) { return ARM64_ReadBits(insn, 31, 24) == 0b00110111; }
1070+
__forceinline BOOL ARM64_IsB(DWORD insn) { return ARM64_ReadBits(insn, 31, 26) == 0b000101; }
10701071
__forceinline BOOL ARM64_IsBL(DWORD insn) { return ARM64_ReadBits(insn, 31, 26) == 0b100101; }
10711072
__forceinline BOOL ARM64_IsADRP(DWORD insn) { return (ARM64_ReadBits(insn, 31, 24) & ~0b01100000) == 0b10010000; }
10721073
__forceinline BOOL ARM64_IsMOVZW(DWORD insn) { return ARM64_ReadBits(insn, 31, 23) == 0b010100101; }
@@ -1081,6 +1082,15 @@ __forceinline DWORD* ARM64_FollowCBNZW(DWORD* pInsnCBNZW)
10811082
return pInsnCBNZW + imm19; // offset = imm19 * 4
10821083
}
10831084

1085+
__forceinline DWORD* ARM64_FollowB(DWORD* pInsnB)
1086+
{
1087+
DWORD insnB = *pInsnB;
1088+
if (!ARM64_IsB(insnB))
1089+
return NULL;
1090+
int imm26 = ARM64_ReadBitsSignExtend(insnB, 25, 0);
1091+
return pInsnB + imm26; // offset = imm26 * 4
1092+
}
1093+
10841094
__forceinline DWORD* ARM64_FollowBL(DWORD* pInsnBL)
10851095
{
10861096
DWORD insnBL = *pInsnBL;
@@ -1319,14 +1329,14 @@ inline DECLSPEC_NOINLINE PVOID _FindPatternBitMaskHelper_4_(
13191329
FORCEINLINE PVOID FindPatternBitMask(
13201330
PVOID pvSearch, size_t cbSearch, LPCSTR pszPattern, LPCSTR pszMask, size_t cbPattern)
13211331
{
1322-
cbSearch -= strlen(pszMask);
1332+
cbSearch -= cbPattern;
13231333
return _FindPatternBitMaskHelper_1_(pvSearch, cbSearch, pszPattern, pszMask, cbPattern);
13241334
}
13251335

13261336
FORCEINLINE PVOID FindPatternBitMask_4_(
13271337
PVOID pvSearch, size_t cbSearch, LPCSTR pszPattern, LPCSTR pszMask, size_t cbPattern)
13281338
{
1329-
cbSearch -= strlen(pszMask);
1339+
cbSearch -= cbPattern;
13301340
return _FindPatternBitMaskHelper_4_(pvSearch, cbSearch, pszPattern, pszMask, cbPattern);
13311341
}
13321342

0 commit comments

Comments
 (0)