mirror of https://github.com/hfiref0x/UACME.git
108 lines
3.0 KiB
C
108 lines
3.0 KiB
C
|
/*******************************************************************************
|
||
|
|
*
|
||
|
|
* (C) COPYRIGHT AUTHORS, 2014 - 2017
|
||
|
|
*
|
||
|
|
* TITLE: TABLES.H
|
||
|
|
*
|
||
|
|
* VERSION: 1.0F
|
||
|
|
*
|
||
|
|
* DATE: 17 Feb 2017
|
||
|
|
*
|
||
|
|
* Patterns for supported AppInfo versions.
|
||
|
|
*
|
||
|
|
* Minimum client: 7600
|
||
|
|
*
|
||
|
|
* Maximum client: 14393
|
||
|
|
*
|
||
|
|
* THIS CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF
|
||
|
|
* ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED
|
||
|
|
* TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A
|
||
|
|
* PARTICULAR PURPOSE.
|
||
|
|
*
|
||
|
|
*******************************************************************************/
|
||
|
|
|
||
|
|
#pragma once
|
||
|
|
|
||
|
|
//
|
||
|
|
// g_MmcBlock
|
||
|
|
//
|
||
|
|
unsigned char ptMmcBlock_7600[] = {
|
||
|
|
0x48, 0x8D, 0x3C, 0x40, 0x4C, 0x39, 0x6C, 0xFB
|
||
|
|
};
|
||
|
|
unsigned char ptMmcBlock_7601[] = {
|
||
|
|
0x48, 0x8B, 0x55, 0x00, 0x48, 0x8B, 0xCF, 0xFF, 0x15
|
||
|
|
};
|
||
|
|
unsigned char ptMmcBlock_9200[] = {
|
||
|
|
0x49, 0x8B, 0x16, 0x48, 0x8B, 0xCE, 0xFF, 0x15
|
||
|
|
};
|
||
|
|
unsigned char ptMmcBlock_9600[] = {
|
||
|
|
0x48, 0x8b, 0x17, 0x49, 0x8b, 0xce, 0xff, 0x15
|
||
|
|
};
|
||
|
|
unsigned char ptMmcBlock_10240[] = {
|
||
|
|
0x49, 0x8B, 0x14, 0x24, 0x49, 0x8B, 0xCE, 0xFF, 0x15
|
||
|
|
};
|
||
|
|
unsigned char ptMmcBlock_10586_14393[] = {
|
||
|
|
0x49, 0x8B, 0x16, 0x49, 0x8B, 0xCD, 0xFF, 0x15
|
||
|
|
};
|
||
|
|
|
||
|
|
//
|
||
|
|
// g_lpAutoApproveEXEList
|
||
|
|
//
|
||
|
|
unsigned char ptAutoApproveEXEList_7600_7601[] = {
|
||
|
|
0x41, 0xB9, 0x08, 0x00, 0x00, 0x00, 0x48, 0x89, 0x4C, 0x24, 0x20, 0x48, 0x8D, 0x15
|
||
|
|
};
|
||
|
|
unsigned char ptAutoApproveEXEList_9200[] = {
|
||
|
|
0x44, 0x8D, 0x4D, 0x08, 0x44, 0x8D, 0x45, 0x0C, 0x48, 0x8D, 0x15
|
||
|
|
};
|
||
|
|
unsigned char ptAutoApproveEXEList_9600[] = {
|
||
|
|
0x41, 0xB9, 0x08, 0x00, 0x00, 0x00, 0x48, 0x8D, 0x15
|
||
|
|
};
|
||
|
|
unsigned char ptAutoApproveEXEList_10240[] = {
|
||
|
|
0x41, 0xB9, 0x08, 0x00, 0x00, 0x00, 0x48, 0x89, 0x6C, 0x24, 0x20, 0x48, 0x8D, 0x15
|
||
|
|
};
|
||
|
|
unsigned char ptAutoApproveEXEList_10586_14393[] = {
|
||
|
|
0x41, 0xB9, 0x08, 0x00, 0x00, 0x00, 0x4C, 0x89, 0x74, 0x24, 0x20, 0x48, 0x8D, 0x15
|
||
|
|
};
|
||
|
|
|
||
|
|
//
|
||
|
|
// g_lpIncludedPFDirs
|
||
|
|
//
|
||
|
|
unsigned char ptIncludedPFDirs_7600_7601[] = {
|
||
|
|
0x33, 0xDB, 0x48, 0x8B, 0xEE
|
||
|
|
};
|
||
|
|
unsigned char ptIncludedPFDirs_9200[] = {
|
||
|
|
0x41, 0x8B, 0xDC, 0x48, 0x8B, 0xF7, 0x4C, 0x8B, 0x3D
|
||
|
|
};
|
||
|
|
unsigned char ptIncludedPFDirs_9600[] = {
|
||
|
|
0x33, 0xED, 0x4C, 0x8D, 0x25
|
||
|
|
};
|
||
|
|
unsigned char ptIncludedPFDirs_10240_14393[] = {
|
||
|
|
0x33, 0xED, 0x4D, 0x8B, 0xF7, 0x4C, 0x8D, 0x25
|
||
|
|
};
|
||
|
|
|
||
|
|
//
|
||
|
|
// g_lpIncludedWindowsDirs
|
||
|
|
//
|
||
|
|
unsigned char ptIncludedWindowsDirs_7600_7601[] = {
|
||
|
|
0x49, 0x83, 0xCD, 0xFF, 0x4C, 0x8B, 0x25
|
||
|
|
};
|
||
|
|
unsigned char ptIncludedWindowsDirs_9200[] = {
|
||
|
|
0x49, 0x83, 0xCF, 0xFF, 0x48, 0x8B, 0x2D
|
||
|
|
};
|
||
|
|
unsigned char ptIncludedWindowsDirs_9600[] = {
|
||
|
|
0x48, 0x83, 0xEC, 0x20, 0x33, 0xED, 0x4C, 0x8D, 0x35
|
||
|
|
};
|
||
|
|
unsigned char ptIncludedWindowsDirs_10240[] = {
|
||
|
|
0x48, 0x83, 0xEC, 0x20, 0x33, 0xFF, 0x48, 0x8D, 0x35
|
||
|
|
};
|
||
|
|
unsigned char ptIncludedWindowsDirs_10586_14393[] = {
|
||
|
|
0x48, 0x83, 0xEC, 0x20, 0x45, 0x33, 0xE4, 0x48, 0x8D, 0x35
|
||
|
|
};
|
||
|
|
|
||
|
|
//
|
||
|
|
// g_lpIncludedSystemDirs
|
||
|
|
// g_lpExemptedAutoApproveExes (second pass)
|
||
|
|
//
|
||
|
|
unsigned char ptIncludedSystemDirs_10586_14393[] = {
|
||
|
|
0x41, 0x8B, 0xFC, 0x4C, 0x8D, 0x35
|
||
|
|
};
|