Skip to content

[version] add macOS WMPF 34371 support - #280

Open
doumuxie wants to merge 1 commit into
evi0s:mainfrom
doumuxie:codex/macos-34371-addresses
Open

doumuxie wants to merge 1 commit into
evi0s:mainfrom
doumuxie:codex/macos-34371-addresses

Conversation

@doumuxie

Copy link
Copy Markdown

Description

Add the address configuration for WMPF version 34371 on macOS arm64.

Config

{
    "Version": 34371,
    "LoadStartHookOffset": "0x4f6454c",
    "CDPFilterHookOffset": "0x83ae884",
    "SceneOffsets": [56, 1432, 8, 1368, 16, 488]
}

How the offsets were located

  • LoadStartHookOffset: function entry containing the AppletIndexContainer::OnLoadStart log reference.
  • SceneOffsets: pointer chain recovered from the OnLoadStart call and its callee, ending at the comparison against scene 1101.
  • CDPFilterHookOffset: first callee in the SendToClientFilter xref function; its returned object is checked at retval + 8 against status 6, matching the hook behavior.

Validation

  • Analyzed with IDA Pro against the macOS arm64 framework for WMPF 34371 (SHA-256: f2b20658532eb1be82e5fca99226596675b9f267e0ba82dd23a25bec74989bd2).
  • JSON parsing and WMPFDebugger version-based config discovery verified.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant