From 30a7892f890b8bfa4024a3ad83f7f7826c1ade00 Mon Sep 17 00:00:00 2001 From: xerox Date: Mon, 17 Aug 2020 22:46:31 +0000 Subject: [PATCH] Update README.md --- README.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/README.md b/README.md index 0fced70..c0fd9d5 100644 --- a/README.md +++ b/README.md @@ -56,5 +56,7 @@ struct beioctl }; ``` +In order to use this ioctl/functionality of bedaisy you need to put a valid return address into this structure. You can do that by sig scanning `lsasrv.dll` with this signature: +`0f 1f 44 00 ? 8b f0 48 8b 0d ? ? ? ? 49 3b cd` the address of this instruction is what you want to be your return address.