### Quick Install Batch File

Source: https://github.com/stascorp/rdpwrap/blob/master/README.md

Use this batch file for a quick installation of the RDP Wrapper Library.

```batch
install.bat
```

--------------------------------

### Hook CSLQuery::Initialize (x64)

Source: https://github.com/stascorp/rdpwrap/blob/master/res/rdpwrap-ini-kb.txt

Hooks the CSLQuery::Initialize function for x64 systems. Requires a custom initialization function.

```assembly
SLInitHook.x64=1
SLInitOffset.x64=2F9C0
SLInitFunc.x64=New_CSLQuery_Initialize
```

--------------------------------

### Hook CSLQuery::Initialize (x64)

Source: https://github.com/stascorp/rdpwrap/blob/master/res/rdpwrap-ini-kb.txt

Specifies a custom function 'New_CSLQuery_Initialize' to hook the CSLQuery::Initialize function on x64 systems. Use when 'SLInitHook.x64' is set to 1.

```assembly
SLInitHook.x64=1
SLInitOffset.x64=1EA50
SLInitFunc.x64=New_CSLQuery_Initialize
```

--------------------------------

### Hook CSLQuery::Initialize (x64)

Source: https://github.com/stascorp/rdpwrap/blob/master/res/rdpwrap-ini-kb.txt

Specifies a custom function 'New_CSLQuery_Initialize' to hook the CSLQuery::Initialize function on x64 systems. Use when 'SLInitHook.x64' is set to 1.

```assembly
SLInitHook.x64=1
SLInitOffset.x64=1EB00
SLInitFunc.x64=New_CSLQuery_Initialize
```

--------------------------------

### Hook CSLQuery::Initialize (x64)

Source: https://github.com/stascorp/rdpwrap/blob/master/res/rdpwrap-ini-kb.txt

Hooks the CSLQuery::Initialize function on x64 systems to redirect execution to a new initialization routine.

```assembly
; Hook CSLQuery::Initialize
SLInitHook.x64=1
SLInitOffset.x64=554C0
SLInitFunc.x64=New_CSLQuery_Initialize
```

--------------------------------

### Hook CSLQuery::Initialize (x64)

Source: https://github.com/stascorp/rdpwrap/blob/master/res/rdpwrap-ini-kb.txt

Applies a hook to the CSLQuery::Initialize function for x64 systems, redirecting execution to a new initialization function.

```assembly
SLInitHook.x64=1
SLInitOffset.x64=24750
SLInitFunc.x64=New_CSLQuery_Initialize
```

--------------------------------

### Hook CSLQuery::Initialize (x86)

Source: https://github.com/stascorp/rdpwrap/blob/master/res/rdpwrap-ini-kb.txt

Hooks the CSLQuery::Initialize function for x86 systems. Requires a custom initialization function.

```assembly
; Hook CSLQuery::Initialize
SLInitHook.x86=1
SLInitOffset.x86=196B0
SLInitFunc.x86=New_CSLQuery_Initialize
```

--------------------------------

### Hook CSLQuery::Initialize (x86)

Source: https://github.com/stascorp/rdpwrap/blob/master/res/rdpwrap-ini-kb.txt

Specifies a custom function 'New_CSLQuery_Initialize' to hook the CSLQuery::Initialize function on x86 systems. Use when 'SLInitHook.x86' is set to 1.

```assembly
SLInitHook.x86=1
SLInitOffset.x86=46A68
SLInitFunc.x86=New_CSLQuery_Initialize
```

--------------------------------

### Hook CSLQuery::Initialize (x86)

Source: https://github.com/stascorp/rdpwrap/blob/master/res/rdpwrap-ini-kb.txt

Specifies a custom function 'New_CSLQuery_Initialize' to hook the CSLQuery::Initialize function on x86 systems. Use when 'SLInitHook.x86' is set to 1.

```assembly
SLInitHook.x86=1
SLInitOffset.x86=46F18
SLInitFunc.x86=New_CSLQuery_Initialize
```

--------------------------------

### Hook CSLQuery::Initialize (x86)

Source: https://github.com/stascorp/rdpwrap/blob/master/res/rdpwrap-ini-kb.txt

Applies a hook to the CSLQuery::Initialize function for x86 systems, redirecting execution to a new initialization function.

```assembly
SLInitHook.x86=1
SLInitOffset.x86=41132
SLInitFunc.x86=New_CSLQuery_Initialize
```

--------------------------------

### Hook CSLQuery::Initialize (x86)

Source: https://github.com/stascorp/rdpwrap/blob/master/res/rdpwrap-ini-kb.txt

Hooks the CSLQuery::Initialize function on x86 systems to redirect execution to a new initialization routine.

```assembly
; Hook CSLQuery::Initialize
SLInitHook.x86=1
SLInitOffset.x86=1CEB0
SLInitFunc.x86=New_CSLQuery_Initialize
```

--------------------------------

### Enable Local-Only Access (x64)

Source: https://github.com/stascorp/rdpwrap/blob/master/res/rdpwrap-ini-kb.txt

Applies a jump instruction to enforce local-only access for RDP sessions on x64 systems. Use when 'LocalOnlyPatch.x64' is set to 1.

```assembly
; .text:000000018008113A          js      short loc_18008115B
; .text:000000018008113C          cmp     [rsp+58h+arg_18], 0
; .text:0000000180081141          jz      short loc_18008115B <- jmp
LocalOnlyPatch.x64=1
LocalOnlyOffset.x64=81141
LocalOnlyCode.x64=jmpshort
```

--------------------------------

### Enable Local-Only Access (x64)

Source: https://github.com/stascorp/rdpwrap/blob/master/res/rdpwrap-ini-kb.txt

Applies a jump instruction to enforce local-only access for RDP sessions on x64 systems. Use when 'LocalOnlyPatch.x64' is set to 1.

```assembly
; .text:0000000180081083          call    ?IsLicenseTypeLocalOnly@CSLQuery@@SAJAEAU_GUID@@PEAH@Z ; CSLQuery::IsLicenseTypeLocalOnly(_GUID &,int *)
; .text:0000000180081088          test    eax, eax
; .text:000000018008108A          js      short loc_1800810AB
; .text:000000018008108C          cmp     [rsp+58h+arg_18], 0
; .text:0000000180081091          jz      short loc_1800810AB <- jmp
LocalOnlyPatch.x64=1
LocalOnlyOffset.x64=81091
LocalOnlyCode.x64=jmpshort
```

--------------------------------

### Quick Update Batch File

Source: https://github.com/stascorp/rdpwrap/blob/master/README.md

Use this batch file for a quick update of the RDP Wrapper Library.

```batch
update.bat
```

--------------------------------

### Enable Single User Session (x64)

Source: https://github.com/stascorp/rdpwrap/blob/master/res/rdpwrap-ini-kb.txt

Replaces a value with 0 to enable single-user RDP sessions on x64 systems. Use when 'SingleUserPatch.x64' is set to 1.

```assembly
; .text:0000000180012153          lea     rcx, [rsp+190h+VersionInformation] ; lpVersionInformation
; .text:0000000180012158          mov     ebx, 1     <- 0
; .text:000000018001215D          mov     [rsp+190h+VersionInformation.dwOSVersionInfoSize], 11Ch
; .text:0000000180012165          mov     [rdi], ebx
; .text:0000000180012167          call    cs:GetVersionExW
SingleUserPatch.x64=1
SingleUserOffset.x64=12159
SingleUserCode.x64=Zero
```

--------------------------------

### Enable Single User Session (x64)

Source: https://github.com/stascorp/rdpwrap/blob/master/res/rdpwrap-ini-kb.txt

Replaces a value with 0 to enable single-user RDP sessions on x64 systems. Use when 'SingleUserPatch.x64' is set to 1.

```assembly
; .text:0000000180011AA3          lea     rcx, [rsp+190h+VersionInformation] ; lpVersionInformation
; .text:0000000180011AA8          mov     ebx, 1     <- 0
; .text:0000000180011AAD          mov     [rsp+190h+VersionInformation.dwOSVersionInfoSize], 11Ch
; .text:0000000180011AB5          mov     [rdi], ebx
; .text:0000000180011AB7          call    cs:__imp_GetVersionExW
SingleUserPatch.x64=1
SingleUserOffset.x64=11AA9
SingleUserCode.x64=Zero
```

--------------------------------

### Quick Uninstall Batch File

Source: https://github.com/stascorp/rdpwrap/blob/master/README.md

Use this batch file for a quick uninstallation of the RDP Wrapper Library.

```batch
uninstall.bat
```

--------------------------------

### Enable Local-Only Access (x86)

Source: https://github.com/stascorp/rdpwrap/blob/master/res/rdpwrap-ini-kb.txt

Applies a jump instruction to enforce local-only access for RDP sessions on x86 systems. Use when 'LocalOnlyPatch.x86' is set to 1.

```assembly
; [6.4.9860.0]
; Patch CEnforcementCore::GetInstanceOfTSLicense
; .text:100962BB          call    ?IsLicenseTypeLocalOnly@CSLQuery@@SGJAAU_GUID@@PAH@Z ; CSLQuery::IsLicenseTypeLocalOnly(_GUID &,int *)
; .text:100962C0          test    eax, eax
; .text:100962C2          js      short loc_100962DF
; .text:100962C4          cmp     [ebp+var_C], 0
; .text:100962C8          jz      short loc_100962DF <- jmp
LocalOnlyPatch.x86=1
LocalOnlyOffset.x86=962C8
LocalOnlyCode.x86=jmpshort
```

--------------------------------

### Patch CEnforcementCore::GetInstanceOfTSLicense (x64)

Source: https://github.com/stascorp/rdpwrap/blob/master/res/rdpwrap-ini-kb.txt

Applies a patch to CEnforcementCore::GetInstanceOfTSLicense for x64 systems. Uses a short jump instruction.

```assembly
; .text:000000018009F713          call    ?IsLicenseTypeLocalOnly@CSLQuery@@SAJAEAU_GUID@@PEAH@Z ; CSLQuery::IsLicenseTypeLocalOnly(_GUID &,int *)
; .text:000000018009F718          test    eax, eax
; .text:000000018009F71A          js      short loc_18009F73B
; .text:000000018009F71C          cmp     [rsp+48h+arg_18], 0
; .text:000000018009F721          jz      short loc_18009F73B <- jmp
LocalOnlyPatch.x64=1
LocalOnlyOffset.x64=9F721
LocalOnlyCode.x64=jmpshort
```

--------------------------------

### Enable Single User Session (x86)

Source: https://github.com/stascorp/rdpwrap/blob/master/res/rdpwrap-ini-kb.txt

Applies a NOP (No Operation) instruction to enable single-user RDP sessions on x86 systems. Use when 'SingleUserPatch.x86' is set to 1.

```assembly
; Patch CSessionArbitrationHelper::IsSingleSessionPerUserEnabled
; .text:10030121          lea     eax, [esp+150h+VersionInformation]
; .text:10030125          inc     ebx            <- nop
; .text:10030126          mov     [edi], ebx
; .text:10030128          push    eax             ; lpVersionInformation
; .text:10030129          call    ds:GetVersionExW
SingleUserPatch.x86=1
SingleUserOffset.x86=30125
SingleUserCode.x86=nop
```

--------------------------------

### Enable Single User Session (x86)

Source: https://github.com/stascorp/rdpwrap/blob/master/res/rdpwrap-ini-kb.txt

Applies a NOP (No Operation) instruction to enable single-user RDP sessions on x86 systems. Use when 'SingleUserPatch.x86' is set to 1.

```assembly
; Patch CSessionArbitrationHelper::IsSingleSessionPerUserEnabled
; .text:10030841          lea     eax, [esp+150h+VersionInformation]
; .text:10030845          inc     ebx            <- nop
; .text:10030846          mov     [edi], ebx
; .text:10030848          push    eax             ; lpVersionInformation
; .text:10030849          call    ds:__imp__GetVersionExW@4 ; GetVersionExW(x)
SingleUserPatch.x86=1
SingleUserOffset.x86=30845
SingleUserCode.x86=nop
```

--------------------------------

### x64 Single User Patch (Zero)

Source: https://github.com/stascorp/rdpwrap/blob/master/res/rdpwrap-ini-kb.txt

Applies a 'Zero' instruction patch for single-user RDP sessions on x64 systems. Modifies GetVersionExW behavior.

```assembly
; .text:000007FF75A97E88          lea     rcx, [rsp+198h+VersionInformation] ; lpVersionInformation
; .text:000007FF75A97E92          mov     [rsp+198h+VersionInformation.dwOSVersionInfoSize], 11Ch
; .text:000007FF75A97E9A          mov     [rdi], ebx
; .text:000007FF75A97E9C          call    cs:__imp_GetVersionExW
```

--------------------------------

### Patch CEnforcementCore::GetInstanceOfTSLicense (Build 9600 x64)

Source: https://github.com/stascorp/rdpwrap/blob/master/res/rdpwrap-ini-kb.txt

Applies a patch to CEnforcementCore::GetInstanceOfTSLicense for Windows build 9600 (x64). Uses NOP and jump.

```assembly
; .text:000000018008181F          cmp     [rsp+48h+arg_18], 0
; .text:0000000180081824          jz      loc_180031DEF <- nop + jmp
LocalOnlyPatch.x64=1
LocalOnlyOffset.x64=81824
LocalOnlyCode.x64=nopjmp
```

--------------------------------

### x64 Single User Patch (Zero) - Version 6.1.7601.21650

Source: https://github.com/stascorp/rdpwrap/blob/master/res/rdpwrap-ini-kb.txt

Applies a 'Zero' instruction patch for single-user RDP sessions on x64 systems for Windows version 6.1.7601.21650.

```assembly
SingleUserPatch.x64=1
SingleUserOffset.x64=180BE
SingleUserCode.x64=Zero
```

--------------------------------

### x64 Single User Patch (Zero) - Version 6.1.7601.18637

Source: https://github.com/stascorp/rdpwrap/blob/master/res/rdpwrap-ini-kb.txt

Applies a 'Zero' instruction patch for single-user RDP sessions on x64 systems for Windows version 6.1.7601.18637.

```assembly
; .text:000007FF75A980F4          lea     rcx, [rsp+198h+VersionInformation] ; lpVersionInformation
; .text:000007FF75A980FE          mov     [rsp+198h+VersionInformation.dwOSVersionInfoSize], 11Ch
; .text:000007FF75A98106          mov     [rdi], ebx
; .text:000007FF75A98108          call    cs:__imp_GetVersionExW
```

--------------------------------

### Patch CEnforcementCore::GetInstanceOfTSLicense (Build 9600 x86)

Source: https://github.com/stascorp/rdpwrap/blob/master/res/rdpwrap-ini-kb.txt

Applies a patch to CEnforcementCore::GetInstanceOfTSLicense for Windows build 9600 (x86). Uses a short jump instruction.

```assembly
; .text:100A271C          call    ?IsLicenseTypeLocalOnly@CSLQuery@@SGJAAU_GUID@@PAH@Z ; CSLQuery::IsLicenseTypeLocalOnly(_GUID &,int *)
; .text:100A2721          test    eax, eax
; .text:100A2723          js      short loc_100A2740
; .text:100A2725          cmp     [ebp+var_8], 0
; .text:100A2729          jz      short loc_100A2740 <- jmp
LocalOnlyPatch.x86=1
LocalOnlyOffset.x86=A2729
LocalOnlyCode.x86=jmpshort
```

--------------------------------

### x64 Single User Patch (Zero) - Version 6.1.7601.22104

Source: https://github.com/stascorp/rdpwrap/blob/master/res/rdpwrap-ini-kb.txt

Applies a 'Zero' instruction patch for single-user RDP sessions on x64 systems for Windows version 6.1.7601.22104.

```assembly
SingleUserPatch.x64=1
SingleUserOffset.x64=180C6
SingleUserCode.x64=Zero
```

--------------------------------

### Hook SLGetWindowsInformationDWORDWrapper (x64) - Build 8400

Source: https://github.com/stascorp/rdpwrap/blob/master/res/rdpwrap-ini-kb.txt

Hooks SLGetWindowsInformationDWORDWrapper for x64 on build 6.2.8400.0 using a new function for Windows 8.

```Assembly
; Hook SLGetWindowsInformationDWORDWrapper
SLPolicyInternal.x64=1
SLPolicyOffset.x64=2492C
SLPolicyFunc.x64=New_Win8SL
```

--------------------------------

### Patch CEnforcementCore::GetInstanceOfTSLicense (x64)

Source: https://github.com/stascorp/rdpwrap/blob/master/res/rdpwrap-ini-kb.txt

Patches CEnforcementCore::GetInstanceOfTSLicense on x64 systems to bypass a license check. Replaces a conditional jump with a short jump.

```assembly
; .text:00000001800B914B          call    ?IsLicenseTypeLocalOnly@CSLQuery@@SAJAEAU_GUID@@PEAH@Z ; CSLQuery::IsLicenseTypeLocalOnly(_GUID &,int *)
; .text:00000001800B9150          test    eax, eax
; .text:00000001800B9152          js      short loc_1800B9173
; .text:00000001800B9154          cmp     [rsp+48h+arg_18], 0
; .text:00000001800B9159          jz      short loc_1800B9173 <- jmp
LocalOnlyPatch.x64=1
LocalOnlyOffset.x64=B9159
LocalOnlyCode.x64=jmpshort
```

--------------------------------

### Hook SLGetWindowsInformationDWORDWrapper (x64)

Source: https://github.com/stascorp/rdpwrap/blob/master/res/rdpwrap-ini-kb.txt

Hooks the SLGetWindowsInformationDWORDWrapper function for x64 systems using a new function for Windows 8.

```Assembly
; Hook SLGetWindowsInformationDWORDWrapper
SLPolicyInternal.x64=1
SLPolicyOffset.x64=18FAC
SLPolicyFunc.x64=New_Win8SL
```

--------------------------------

### Patch CEnforcementCore::GetInstanceOfTSLicense (x86)

Source: https://github.com/stascorp/rdpwrap/blob/master/res/rdpwrap-ini-kb.txt

Applies a patch to CEnforcementCore::GetInstanceOfTSLicense for x86 systems. Uses a short jump instruction.

```assembly
; .text:1008A604          call    ?IsLicenseTypeLocalOnly@CSLQuery@@SGJAAU_GUID@@PAH@Z ; CSLQuery::IsLicenseTypeLocalOnly(_GUID &,int *)
; .text:1008A609          test    eax, eax
; .text:1008A60B          js      short loc_1008A628
; .text:1008A60D          cmp     [ebp+var_8], 0
; .text:1008A611          jz      short loc_1008A628 <- jmp
LocalOnlyPatch.x86=1
LocalOnlyOffset.x86=8A611
LocalOnlyCode.x86=jmpshort
```

--------------------------------

### Patch CEnforcementCore::GetInstanceOfTSLicense (x64) - Alternate

Source: https://github.com/stascorp/rdpwrap/blob/master/res/rdpwrap-ini-kb.txt

An alternative patch for CEnforcementCore::GetInstanceOfTSLicense on x64 systems. This patch involves a NOP followed by a jump.

```assembly
; .text:000000018008B2D4          cmp     [rsp+58h+arg_18], 0
; .text:000000018008B2D9          jz      loc_180025C39 <- nop + jmp
LocalOnlyPatch.x64=1
LocalOnlyOffset.x64=8B2D9
LocalOnlyCode.x64=nopjmp
```

--------------------------------

### RDPWrap Configuration Settings

Source: https://github.com/stascorp/rdpwrap/blob/master/res/rdpwrap-ini-kb.txt

These settings in the [Main] section control RDP Wrapper's behavior, such as logging and API hooking.

```ini
; Last updated date
Updated=2018-10-10
; Address to log file (RDP Wrapper will write it, if exists)
LogFile=\rdpwrap.txt
; Hook SLPolicy API on Windows NT 6.0
SLPolicyHookNT60=1
; Hook SLPolicy API on Windows NT 6.1
SLPolicyHookNT61=1
```

--------------------------------

### Hook SLGetWindowsInformationDWORDWrapper (x86) - Build 8400

Source: https://github.com/stascorp/rdpwrap/blob/master/res/rdpwrap-ini-kb.txt

Hooks SLGetWindowsInformationDWORDWrapper for x86 on build 6.2.8400.0 using a new function for Windows 8.

```Assembly
; Hook SLGetWindowsInformationDWORDWrapper
SLPolicyInternal.x86=1
SLPolicyOffset.x86=19629
SLPolicyFunc.x86=New_Win8SL
```

--------------------------------

### x86 Single User Patch (nop)

Source: https://github.com/stascorp/rdpwrap/blob/master/res/rdpwrap-ini-kb.txt

Applies a 'nop' instruction patch for single-user RDP sessions on x86 systems. Used to modify GetVersionExW behavior.

```assembly
; .text:6F2FA657          mov     [ebp+VersionInformation.dwOSVersionInfoSize], 11Ch
; .text:6F2FA661          mov     [esi], ebx
; .text:6F2FA663          call    ds:__imp__GetVersionExW@4 ; GetVersionExW(x)
```

--------------------------------

### Patching CSessionArbitrationHelper::IsSingleSessionPerUserEnabled (x64)

Source: https://github.com/stascorp/rdpwrap/blob/master/res/rdpwrap-ini-kb.txt

Configuration for patching the IsSingleSessionPerUserEnabled function on x64 systems.

```ini
SingleUserPatch.x64=1
SingleUserOffset.x64=65E3E
SingleUserCode.x64=Zero
```

--------------------------------

### RDP Session and Feature Configuration

Source: https://github.com/stascorp/rdpwrap/blob/master/res/rdpwrap-ini-kb.txt

The [SLPolicy] section enables or limits various RDP features and session parameters.

```ini
; Allow Remote Connections
TerminalServices-RemoteConnectionManager-AllowRemoteConnections=1
; Allow Multiple Sessions
TerminalServices-RemoteConnectionManager-AllowMultipleSessions=1
; Allow Multiple Sessions (Application Server Mode)
TerminalServices-RemoteConnectionManager-AllowAppServerMode=1
; Allow Multiple Monitors
TerminalServices-RemoteConnectionManager-AllowMultimon=1
; Max User Sessions (0 = unlimited)
TerminalServices-RemoteConnectionManager-MaxUserSessions=0
; Max Debug Sessions (Windows 8, 0 = unlimited)
TerminalServices-RemoteConnectionManager-ce0ad219-4670-4988-98fb-89b14c2f072b-MaxSessions=0
; Max Sessions
; 0 - logon not possible even from console
; 1 - only one active user (console or remote)
; 2 - allow concurrent sessions
TerminalServices-RemoteConnectionManager-45344fe7-00e6-4ac6-9f01-d01fd4ffadfb-MaxSessions=2
; Allow Advanced Compression with RDP 7 Protocol
TerminalServices-RDP-7-Advanced-Compression-Allowed=1
; IsTerminalTypeLocalOnly = 0
TerminalServices-RemoteConnectionManager-45344fe7-00e6-4ac6-9f01-d01fd4ffadfb-LocalOnly=0
; Max Sessions (hard limit)
TerminalServices-RemoteConnectionManager-8dc86f1d-9969-4379-91c1-06fe1dc60575-MaxSessions=1000
; Allow EasyPrint
TerminalServices-DeviceRedirection-Licenses-TSEasyPrintAllowed=1
; Allow PnP Redirection
TerminalServices-DeviceRedirection-Licenses-PnpRedirectionAllowed=1
; Allow Media Foundation plugins
TerminalServices-DeviceRedirection-Licenses-TSMFPluginAllowed=1
; Allow DWM Remoting
TerminalServices-RemoteConnectionManager-UiEffects-DWMRemotingAllowed=1
```

--------------------------------

### Patching CDefPolicy::Query (x64)

Source: https://github.com/stascorp/rdpwrap/blob/master/res/rdpwrap-ini-kb.txt

Configuration for patching the CDefPolicy::Query function on x64 systems.

```ini
DefPolicyPatch.x64=1
```

--------------------------------

### Hook SLGetWindowsInformationDWORDWrapper (x86)

Source: https://github.com/stascorp/rdpwrap/blob/master/res/rdpwrap-ini-kb.txt

Hooks the SLGetWindowsInformationDWORDWrapper function for x86 systems using a new function for Windows 8.

```Assembly
; Hook SLGetWindowsInformationDWORDWrapper
SLPolicyInternal.x86=1
SLPolicyOffset.x86=1A0A9
SLPolicyFunc.x86=New_Win8SL
```

--------------------------------

### Configure Terminal Service Type

Source: https://github.com/stascorp/rdpwrap/blob/master/README.md

Use this command to isolate RDP Wrapper from other shared services if the Terminal Service hangs at startup. Ensure 'rdpwrap.dll' is added to antivirus exclusions.

```bash
sc config TermService type= own
```

--------------------------------

### Patch CEnforcementCore::GetInstanceOfTSLicense (x86)

Source: https://github.com/stascorp/rdpwrap/blob/master/res/rdpwrap-ini-kb.txt

Patches CEnforcementCore::GetInstanceOfTSLicense on x86 systems to bypass a license check. Replaces a conditional jump with a short jump.

```assembly
; Patch CEnforcementCore::GetInstanceOfTSLicense
; .text:100A36C4          call    ?IsLicenseTypeLocalOnly@CSLQuery@@SGJAAU_GUID@@PAH@Z ; CSLQuery::IsLicenseTypeLocalOnly(_GUID &,int *)
; .text:100A36C9          test    eax, eax
; .text:100A36CB          js      short loc_100A36E8
; .text:100A36CD          cmp     [ebp+var_8], 0
; .text:100A36D1          jz      short loc_100A36E8 <- jmp
LocalOnlyPatch.x86=1
LocalOnlyOffset.x86=A36D1
LocalOnlyCode.x86=jmpshort
```

--------------------------------

### Patch Codes for CDefPolicy::Query (x86) with Jump

Source: https://github.com/stascorp/rdpwrap/blob/master/res/rdpwrap-ini-kb.txt

Patch codes for CDefPolicy::Query on x86, including a jump instruction.

```ini
CDefPolicy_Query_eax_ecx_jmp=B800010000898120030000EB0E
```

--------------------------------

### Patch CEnforcementCore::GetInstanceOfTSLicense (x64)

Source: https://github.com/stascorp/rdpwrap/blob/master/res/rdpwrap-ini-kb.txt

Applies a patch to the CEnforcementCore::GetInstanceOfTSLicense function for x64 systems. This patch modifies the control flow to bypass license checks.

```assembly
; .text:0000000180095603          call    ?IsLicenseTypeLocalOnly@CSLQuery@@SAJAEAU_GUID@@PEAH@Z ; CSLQuery::IsLicenseTypeLocalOnly(_GUID &,int *)
; .text:0000000180095608          test    eax, eax
; .text:000000018009560A          js      short loc_18009562B
; .text:000000018009560C          cmp     [rsp+58h+arg_18], 0
; .text:0000000180095611          jz      short loc_18009562B <- jmp
LocalOnlyPatch.x64=1
LocalOnlyOffset.x64=95611
LocalOnlyCode.x64=jmpshort
```

--------------------------------

### Patch SingleUserMode (x64) - Build 8400

Source: https://github.com/stascorp/rdpwrap/blob/master/res/rdpwrap-ini-kb.txt

Applies a patch to enable single-user mode for x64 systems on build 6.2.8400.0. This involves modifying the GetVersionExW call.

```Assembly
; .text:000000018002081E          lea     rcx, [rsp+180h+VersionInformation] ; lpVersionInformation
; .text:0000000180020823          mov     ebx, 1     <- 0
; .text:0000000180020828          mov     [rsp+180h+VersionInformation.dwOSVersionInfoSize], 11Ch
; .text:0000000180020830          mov     [rdi], ebx
; .text:0000000180020832          call    cs:__imp_GetVersionExW
```

--------------------------------

### Patch SingleUserMode (x64) - Build 9200

Source: https://github.com/stascorp/rdpwrap/blob/master/res/rdpwrap-ini-kb.txt

Applies a patch to enable single-user mode for x64 systems on build 6.2.9200.16384. This involves modifying the GetVersionExW call.

```Assembly
; .text:000000018002BAA2          lea     rcx, [rsp+180h+VersionInformation] ; lpVersionInformation
; .text:000000018002BAA7          mov     ebx, 1     <- 0
; .text:000000018002BAAC          mov     [rsp+180h+VersionInformation.dwOSVersionInfoSize], 11Ch
; .text:000000018002BAB4          mov     [rdi], ebx
; .text:000000018002BAB6          call    cs:__imp_GetVersionExW
```

--------------------------------

### Patching CSessionArbitrationHelper::IsSingleSessionPerUserEnabled (x86)

Source: https://github.com/stascorp/rdpwrap/blob/master/res/rdpwrap-ini-kb.txt

Configuration for patching the IsSingleSessionPerUserEnabled function on x86 systems.

```ini
SingleUserPatch.x86=1
SingleUserOffset.x86=160BF
SingleUserCode.x86=nop
```

--------------------------------

### Patching CDefPolicy::Query (x86)

Source: https://github.com/stascorp/rdpwrap/blob/master/res/rdpwrap-ini-kb.txt

Configuration for patching the CDefPolicy::Query function on x86 systems.

```ini
DefPolicyPatch.x86=1
DefPolicyOffset.x86=15CD8
DefPolicyCode.x86=CDefPolicy_Query_edx_ecx
```

--------------------------------

### Patch CSessionArbitrationHelper::IsSingleSessionPerUserEnabled (x64)

Source: https://github.com/stascorp/rdpwrap/blob/master/res/rdpwrap-ini-kb.txt

Applies a 'Zero' patch to the GetVersionExW call for x64 systems. This is used to modify the behavior of CSessionArbitrationHelper::IsSingleSessionPerUserEnabled.

```assembly
; .text:000007FF75B31EAA          mov     ebx, 1     <- 0
; .text:000007FF75B31EB6          mov     [rdi], ebx
; .text:000007FF75B31EB8          call    cs:__imp_GetVersionExW
```

--------------------------------

### x86 Single User Patch (nop) - Version 6.1.7601.21650

Source: https://github.com/stascorp/rdpwrap/blob/master/res/rdpwrap-ini-kb.txt

Applies a 'nop' instruction patch for single-user RDP sessions on x86 systems for Windows version 6.1.7601.21650.

```assembly
SingleUserPatch.x86=1
SingleUserOffset.x86=1A49D
SingleUserCode.x86=nop
```

--------------------------------

### Patch SingleSessionPerUserEnabled (x86) - Build 9200

Source: https://github.com/stascorp/rdpwrap/blob/master/res/rdpwrap-ini-kb.txt

Patches CSessionArbitrationHelper::IsSingleSessionPerUserEnabled for x86 on build 6.2.9200.16384. This involves modifying the GetVersionExW call.

```Assembly
; .text:1001554E          lea     eax, [esp+150h+VersionInformation]
; .text:10015552          inc     esi            <- nop
; .text:10015553          push    eax             ; lpVersionInformation
; .text:10015554          mov     [esp+154h+VersionInformation.dwOSVersionInfoSize], 11Ch
; .text:1001555C          mov     [edi], esi
; .text:1001555E          call    ds:__imp__GetVersionExW@4 ; GetVersionExW(x)
```

--------------------------------

### Patch SingleUserMode (x86)

Source: https://github.com/stascorp/rdpwrap/blob/master/res/rdpwrap-ini-kb.txt

Applies a patch to enable single-user mode for x86 systems. This involves modifying the GetVersionExW call.

```Assembly
; .text:0000000180011E6E          lea     rcx, [rsp+180h+VersionInformation] ; lpVersionInformation
; .text:0000000180011E73          mov     ebx, 1     <- 0
; .text:0000000180011E78          mov     [rsp+180h+VersionInformation.dwOSVersionInfoSize], 11Ch
; .text:0000000180011E80          mov     [rdi], ebx
; .text:0000000180011E82          call    cs:__imp_GetVersionExW
```

--------------------------------

### Patch CSessionArbitrationHelper::IsSingleSessionPerUserEnabled (x64 - 6.1.7600.16385)

Source: https://github.com/stascorp/rdpwrap/blob/master/res/rdpwrap-ini-kb.txt

Applies a 'Zero' patch to the GetVersionExW call for x64 systems on Windows version 6.1.7600.16385. This is used to modify the behavior of CSessionArbitrationHelper::IsSingleSessionPerUserEnabled.

```assembly
; .text:000007FF75A97D95          mov     ebx, 1     <- 0
; .text:000007FF75A97DA2          mov     [rdi], ebx
; .text:000007FF75A97DA4          call    cs:__imp_GetVersionExW
```

--------------------------------

### x86 Single User Patch (nop) - Version 6.1.7601.22843

Source: https://github.com/stascorp/rdpwrap/blob/master/res/rdpwrap-ini-kb.txt

Applies a 'nop' instruction patch for single-user RDP sessions on x86 systems for Windows version 6.1.7601.22843.

```assembly
; .text:6F2FA64F          lea     eax, [ebp+VersionInformation]
; .text:6F2FA655          inc     ebx            <- nop
```

--------------------------------

### Patch SingleSessionPerUserEnabled (x86) - Build 8400

Source: https://github.com/stascorp/rdpwrap/blob/master/res/rdpwrap-ini-kb.txt

Patches CSessionArbitrationHelper::IsSingleSessionPerUserEnabled for x86 on build 6.2.8400.0. This involves modifying the GetVersionExW call.

```Assembly
; .text:1001547E          lea     eax, [esp+150h+VersionInformation]
; .text:10015482          inc     esi            <- nop
; .text:10015483          push    eax             ; lpVersionInformation
; .text:10015484          mov     [esp+154h+VersionInformation.dwOSVersionInfoSize], 11Ch
; .text:1001548C          mov     [edi], esi
; .text:1001548E          call    ds:__imp__GetVersionExW@4 ; GetVersionExW(x)
```

--------------------------------

### x86 Single User Patch (nop) - Version 6.1.7601.18637

Source: https://github.com/stascorp/rdpwrap/blob/master/res/rdpwrap-ini-kb.txt

Applies a 'nop' instruction patch for single-user RDP sessions on x86 systems for Windows version 6.1.7601.18637.

```assembly
; .text:6F2FA4D7          lea     eax, [ebp+VersionInformation]
; .text:6F2FA4DD          inc     ebx            <- nop
; .text:6F2FA4DE          push    eax             ; lpVersionInformation
; .text:6F2FA4DF          mov     [ebp+VersionInformation.dwOSVersionInfoSize], 11Ch
; .text:6F2FA4E9          mov     [esi], ebx
; .text:6F2FA4EB          call    ds:__imp__GetVersionExW@4 ; GetVersionExW(x)
```

--------------------------------

### Patch CEnforcementCore::GetInstanceOfTSLicense (x86)

Source: https://github.com/stascorp/rdpwrap/blob/master/res/rdpwrap-ini-kb.txt

Applies a patch to the CEnforcementCore::GetInstanceOfTSLicense function for x86 systems. This patch modifies the control flow to bypass license checks.

```assembly
; .text:100A9CBB          call    ?IsLicenseTypeLocalOnly@CSLQuery@@SGJAAU_GUID@@PAH@Z ; CSLQuery::IsLicenseTypeLocalOnly(_GUID &,int *)
; .text:100A9CC0          test    eax, eax
; .text:100A9CC2          js      short loc_100A9CDF
; .text:100A9CC4          cmp     [ebp+var_C], 0
; .text:100A9CC8          jz      short loc_100A9CDF <- jmp
LocalOnlyPatch.x86=1
LocalOnlyOffset.x86=A9CC8
LocalOnlyCode.x86=jmpshort
```

--------------------------------

### Modify Default Policy (x64)

Source: https://github.com/stascorp/rdpwrap/blob/master/res/rdpwrap-ini-kb.txt

Applies a patch to the CDefPolicy::Query function on x64 systems, setting a specific register value. Use when 'DefPolicyPatch.x64' is set to 1.

```assembly
; Original
; .text:000000018000C125          cmp     [rcx+63Ch], eax
; .text:000000018000C12B          jz      sub_18003BABC
; Changed
; .text:000000018000C125          mov     eax, 100h
; .text:000000018000C12A          mov     [rcx+638h], eax
; .text:000000018000C130          nop
DefPolicyPatch.x64=1
DefPolicyOffset.x64=C125
DefPolicyCode.x64=CDefPolicy_Query_eax_rcx
```

--------------------------------

### Modify Default Policy (x64)

Source: https://github.com/stascorp/rdpwrap/blob/master/res/rdpwrap-ini-kb.txt

Applies a patch to the CDefPolicy::Query function on x64 systems, setting a specific register value. Use when 'DefPolicyPatch.x64' is set to 1.

```assembly
; Original
; .text:000000018000B9F5          cmp     [rcx+63Ch], eax
; .text:000000018000B9FB          jz      sub_18003B9C8
; Changed
; .text:000000018000B9F5          mov     eax, 100h
; .text:000000018000B9FA          mov     [rcx+638h], eax
; .text:000000018000BA00          nop
DefPolicyPatch.x64=1
DefPolicyOffset.x64=B9F5
DefPolicyCode.x64=CDefPolicy_Query_eax_rcx
```

--------------------------------

### RDPWrap Patches for Windows 10.0.9926.0 (x64)

Source: https://github.com/stascorp/rdpwrap/blob/master/res/rdpwrap-ini-kb.txt

Configuration for RDPWrap patches on Windows 10.0.9926.0 (x64), specifying offsets and code types for various functions. Includes contributions from v-yadli.

```assembly
; x64 contributed by v-yadli
; Patch CEnforcementCore::GetInstanceOfTSLicense
LocalOnlyPatch.x64=1
;;;OFFSET = 0x61
;;;BASE   = 0x95F90
LocalOnlyOffset.x64=95FF1
LocalOnlyCode.x64=jmpshort
; Patch CSessionArbitrationHelper::IsSingleSessionPerUserEnabled
SingleUserPatch.x64=1
;;;OFFSET   = 0x43
;;;BASE     = 0x12F90
;;;;instruction = 0xBB 0x01 0x00 0x00 0x00
;;;                   ^^^ +1 offset
SingleUserOffset.x64=12A34
SingleUserCode.x64=Zero
; Patch CDefPolicy::Query
DefPolicyPatch.x64=1
;;;
;;;BASE     = 0xBDF0
;;;OFFSET   = 0x15
DefPolicyOffset.x64=BE05
DefPolicyCode.x64=CDefPolicy_Query_eax_rcx
; Hook CSLQuery::Initialize
SLInitHook.x64=1
SLInitOffset.x64=24EC0
SLInitFunc.x64=New_CSLQuery_Initialize
```

--------------------------------

### x64 CDefPolicy::Query Patch (eax_rdi) - Version 6.1.7601.22104

Source: https://github.com/stascorp/rdpwrap/blob/master/res/rdpwrap-ini-kb.txt

Patches the CDefPolicy::Query function on x64 systems for Windows version 6.1.7601.22104. Modifies EAX and uses RDI.

```assembly
DefPolicyPatch.x64=1
DefPolicyOffset.x64=17D5E
DefPolicyCode.x64=CDefPolicy_Query_eax_rdi
```

--------------------------------

### x64 CDefPolicy::Query Patch (eax_rdi) - Version 6.1.7601.18637

Source: https://github.com/stascorp/rdpwrap/blob/master/res/rdpwrap-ini-kb.txt

Patches the CDefPolicy::Query function on x64 systems for Windows version 6.1.7601.18637. Modifies EAX and uses RDI.

```assembly
; .text:000007FF75A97DC6          cmp     [rdi+63Ch], eax
; .text:000007FF75A97DCC          jz      loc_7FF75AA40BD
; Changed
; .text:000007FF75A97DC6          mov     eax, 100h
; .text:000007FF75A97DCB          mov     [rdi+638h], eax
; .text:000007FF75A97DD1          nop
```

--------------------------------

### x64 CDefPolicy::Query Patch (eax_rdi) - Version 6.1.7601.21650

Source: https://github.com/stascorp/rdpwrap/blob/master/res/rdpwrap-ini-kb.txt

Patches the CDefPolicy::Query function on x64 systems for Windows version 6.1.7601.21650. Modifies EAX and uses RDI.

```assembly
DefPolicyPatch.x64=1
DefPolicyOffset.x64=17D5A
DefPolicyCode.x64=CDefPolicy_Query_eax_rdi
```

--------------------------------

### x64 CDefPolicy::Query Patch (eax_rdi)

Source: https://github.com/stascorp/rdpwrap/blob/master/res/rdpwrap-ini-kb.txt

Patches the CDefPolicy::Query function on x64 systems by modifying EAX and using RDI. Sets a value at [rdi+638h] to 100h.

```assembly
; .text:000007FF75A97C92          cmp     [rdi+63Ch], eax
; .text:000007FF75A97C98          jz      loc_7FF75AA40A2
; Changed
; .text:000007FF75A97C92          mov     eax, 100h
; .text:000007FF75A97C97          mov     [rdi+638h], eax
; .text:000007FF75A97C9D          nop
```

--------------------------------

### Patch CSessionArbitrationHelper::IsSingleSessionPerUserEnabled (x64)

Source: https://github.com/stascorp/rdpwrap/blob/master/res/rdpwrap-ini-kb.txt

Applies a patch to CSessionArbitrationHelper::IsSingleSessionPerUserEnabled for x64 systems. Replaces a move with zero.

```assembly
; .text:00000001800367F3          lea     rcx, [rsp+190h+VersionInformation] ; lpVersionInformation
; .text:00000001800367F8          mov     ebx, 1     <- 0
; .text:00000001800367FD          mov     [rsp+190h+VersionInformation.dwOSVersionInfoSize], 11Ch
; .text:0000000180036805          mov     [rdi], ebx
; .text:0000000180036807          call    cs:__imp_GetVersionExW
SingleUserPatch.x64=1
SingleUserOffset.x64=367F9
SingleUserCode.x64=Zero
```

--------------------------------

### Patch CSessionArbitrationHelper::IsSingleSessionPerUserEnabled (x64)

Source: https://github.com/stascorp/rdpwrap/blob/master/res/rdpwrap-ini-kb.txt

Patches CSessionArbitrationHelper::IsSingleSessionPerUserEnabled on x64 systems. Replaces an instruction with a zero value to alter behavior.

```assembly
; .text:0000000180021823          lea     rcx, [rsp+190h+VersionInformation] ; lpVersionInformation
; .text:0000000180021828          mov     ebx, 1     <- 0
; .text:000000018002182D          mov     [rsp+190h+VersionInformation.dwOSVersionInfoSize], 11Ch
; .text:0000000180021835          mov     [rdi], ebx
; .text:0000000180033CE3          lea     rcx, [rsp+190h+VersionInformation] ; lpVersionInformation
; .text:0000000180033CE8          mov     ebx, 1     <- 0
; .text:0000000180033CED          mov     [rsp+190h+VersionInformation.dwOSVersionInfoSize], 11Ch
; .text:0000000180033CF5          mov     [rdi], ebx
SingleUserPatch.x64=1
SingleUserOffset.x64=21829
SingleUserCode.x64=Zero
```

--------------------------------

### Patch CSessionArbitrationHelper::IsSingleSessionPerUserEnabled (x86)

Source: https://github.com/stascorp/rdpwrap/blob/master/res/rdpwrap-ini-kb.txt

Applies a NOP patch to the GetVersionExW call for x86 systems. This is used to modify the behavior of CSessionArbitrationHelper::IsSingleSessionPerUserEnabled.

```assembly
; .text:6F597FB4          inc     ebx            <- nop
; .text:6F597FB6          mov     [ebp+VersionInformation.dwOSVersionInfoSize], 11Ch
; .text:6F597FC0          mov     [esi], ebx
; .text:6F597FC2          call    ds:__imp__GetVersionExW@4 ; GetVersionExW(x)
```

--------------------------------

### Patch CSessionArbitrationHelper::IsSingleSessionPerUserEnabled (x86) - Alternate

Source: https://github.com/stascorp/rdpwrap/blob/master/res/rdpwrap-ini-kb.txt

An alternative patch for CSessionArbitrationHelper::IsSingleSessionPerUserEnabled on x86 systems, using NOP.

```assembly
; Patch CSessionArbitrationHelper::IsSingleSessionPerUserEnabled
; .text:10037111          lea     eax, [esp+150h+VersionInformation]
; .text:10037115          inc     ebx            <- nop
; .text:10037116          mov     [edi], ebx
; .text:10037118          push    eax             ; lpVersionInformation
; .text:10037119          call    ds:__imp__GetVersionExW@4 ; GetVersionExW(x)
SingleUserPatch.x86=1
SingleUserOffset.x86=37115
SingleUserCode.x86=nop
```

--------------------------------

### Patch CSessionArbitrationHelper::IsSingleSessionPerUserEnabled (x86 - 6.1.7600.16385)

Source: https://github.com/stascorp/rdpwrap/blob/master/res/rdpwrap-ini-kb.txt

Applies a NOP patch to the GetVersionExW call for x86 systems on Windows version 6.1.7600.16385. This is used to modify the behavior of CSessionArbitrationHelper::IsSingleSessionPerUserEnabled.

```assembly
; .text:6F2F9E25          inc     ebx            <- nop
; .text:6F2F9E27          mov     [ebp+VersionInformation.dwOSVersionInfoSize], 11Ch
; .text:6F2F9E31          mov     [esi], ebx
; .text:6F2F9E33          call    ds:__imp__GetVersionExW@4 ; GetVersionExW(x)
```

--------------------------------

### x86 CDefPolicy::Query Patch (eax_esi)

Source: https://github.com/stascorp/rdpwrap/blob/master/res/rdpwrap-ini-kb.txt

Patches the CDefPolicy::Query function on x86 systems by modifying EAX and using ESI. Changes the return value to 100h.

```assembly
; .text:6F2F9E21          cmp     eax, [esi+320h]
; .text:6F2F9E27          jz      loc_6F30B6CE
; Changed
; .text:6F2F9E21          mov     eax, 100h
; .text:6F2F9E26          mov     [esi+320h], eax
; .text:6F2F9E2C          nop
```

--------------------------------

### x86 CDefPolicy::Query Patch (eax_esi) - Version 6.1.7601.18637

Source: https://github.com/stascorp/rdpwrap/blob/master/res/rdpwrap-ini-kb.txt

Patches the CDefPolicy::Query function on x86 systems for Windows version 6.1.7601.18637. Modifies EAX and uses ESI.

```assembly
; .text:6F2F9DBB          cmp     eax, [esi+320h]
; .text:6F2F9DC1          jz      loc_6F30B2A6
; Changed
; .text:6F2F9DBB          mov     eax, 100h
; .text:6F2F9DC0          mov     [esi+320h], eax
; .text:6F2F9DC6          nop
```