Dynamic offsets for ETHREAD fields

[krispybyte]

Inside of StackManager::ModifyThreadStartAddress() we currently hardcode the offsets to the ones needed in version 24h2. We must support other windows builds. These offsets can be found here

[krispybyte]

It might be nice to introduce utility functions to help decide which windows build is in use, this may be needed for some custom rop gadgets
Marking this as bug label because it must be solved

[krispybyte]

There is now a way to get the display windows version using Utils::GetWindowsDisplayVersion

[TempAccountNull]

Inside of StackManager::ModifyThreadStartAddress() we currently hardcode the offsets to the ones needed in version 24h2. We must support other windows builds. These offsets can be found here

Hey there, instead of using direct offsets why not just get the current windows version and then use dbgHelp symbols to parse the offsets directly? this will prevent hardcoded offsets in the future.

[krispybyte]

Inside of StackManager::ModifyThreadStartAddress() we currently hardcode the offsets to the ones needed in version 24h2. We must support other windows builds. These offsets can be found here

Hey there, instead of using direct offsets why not just get the current windows version and then use dbgHelp symbols to parse the offsets directly? this will prevent hardcoded offsets in the future.

Because we need to find gadget addresses, I'm not sure dbgHelp symbols would be useful with that.