sig update for Windows 11

[anotherfinemess84]

hi seems that on windows 11 some sig must be wrong as it does not reach success and just bails into windows. thankyou.

[xsh3llsh0ck]

hi seems that on windows 11 some sig must be wrong as it does not reach success and just bails into windows. thankyou.

Hello! It looks like Microsoft changed something in RdpLoadImage (I'm not patch-diffing winload at the moment). At the moment, only the pattern search for BlImgAllocateImageBuffer has changed. The other things don't seem to have changed (ImgArchStartBootApplication, OslExecuteTransition and OslFwpSetupKernelPhase1)
In Windows 11, the pattern is as follows:
E8 ?? ?? ?? ?? 4C 8B 7D 50

[hexappp]

E8 ? ? ? ? 4C 8B 65 C7 in Win 10 22H2 works. Can anybody upload Win 11 winload.efi sample.

[xsh3llsh0ck]

E8 ? ? ? ? 4C 8B 65 C7 in Win 10 22H2 works. Can anybody upload Win 11 winload.efi sample.

https://anonfiles.com/7eg3H5rdz0/winload_zip

[hexappp]

Win 10 22H2 and Win 11 tested. E8 ? ? ? ? 8B D8 85 C0 0F 88 8E ? ? ? 21 7C 24 28