From 974a896876c82c07994ae7a4847b5b767ab3c299 Mon Sep 17 00:00:00 2001 From: Paddy Xu Date: Fri, 27 Jan 2017 00:14:32 +0200 Subject: [PATCH] Do not hook new `Zw*CHPE` APIs which introduced in Redstone 3 update --- LocaleEmulator/HookPort.cpp | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/LocaleEmulator/HookPort.cpp b/LocaleEmulator/HookPort.cpp index d06ce6f..8359620 100644 --- a/LocaleEmulator/HookPort.cpp +++ b/LocaleEmulator/HookPort.cpp @@ -2290,6 +2290,11 @@ InstallHookPort( if (FunctionName[0] != 'Z' || FunctionName[1] != 'w') continue; + // ignore "Zw*CHPE" functions. "CHPE" is introduced in Windows 10 Redstone 3 update, which translates ARM64 codes to amd64. + UINT FunctionNameLength = strlen(FunctionName); + if (FunctionNameLength >= 6 && strcmp(FunctionName + FunctionNameLength - 4, "CHPE") == 0) + continue; + Function = (PBYTE)(AddressOfFunctions[*AddressOfNameOrdinals] + BaseAddress); if (Function[0] != 0xB8) // mov eax, const