From 7cffd0df6dc04b0f7b07ece363c3a4891b1323a1 Mon Sep 17 00:00:00 2001 From: cypherpunk Date: Mon, 1 May 2017 16:52:06 +0200 Subject: [PATCH] added a helpful comment for WOW64 PEB64 --- TitanEngine/TitanEngine.Hider.cpp | 1 + 1 file changed, 1 insertion(+) diff --git a/TitanEngine/TitanEngine.Hider.cpp b/TitanEngine/TitanEngine.Hider.cpp index 98c5986..cb6b188 100644 --- a/TitanEngine/TitanEngine.Hider.cpp +++ b/TitanEngine/TitanEngine.Hider.cpp @@ -71,6 +71,7 @@ __declspec(dllexport) void* TITCALL GetPEBLocation64(HANDLE hProcess) DWORD peb32 = (DWORD)GetPEBLocation(hProcess); if(peb32) { + // this offset is WRONG as of Win10 Creators Update.See comment in Global.Engine.Hider.cpp:192 peb32 += 0x1000; //PEB64 after PEB32 return (void*)peb32; }