added a helpful comment for WOW64 PEB64

2017-05-01 16:52:06 +02:00 · 2017-05-01 16:52:06 +02:00 · 7cffd0df6d
parent 0a63361a61
commit 7cffd0df6d
1 changed files with 1 additions and 0 deletions
--- a/TitanEngine/TitanEngine.Hider.cpp
+++ b/TitanEngine/TitanEngine.Hider.cpp
@ -71,6 +71,7 @@ __declspec(dllexport) void* TITCALL GetPEBLocation64(HANDLE hProcess)
        DWORD peb32 = (DWORD)GetPEBLocation(hProcess);
        if(peb32)
        {
+			// this offset is WRONG as of Win10 Creators Update.See comment in Global.Engine.Hider.cpp:192
            peb32 += 0x1000; //PEB64 after PEB32
            return (void*)peb32;
        }