[Windows 10, 8, 7, XP etc.] eychei:
Hi everyone,

I am new to this forum as a posting member.

Can some of the Mods move this post into the right subforum please (e.g. Windows 10 Hacking)

Maybe some of you already now that you can not use the full potential (90fps) of your mixed reality headset when you have a processor with less then 4 Physical Cores.

By having 4 Cores you will have unlocked the ULTRA mode which gives your headset more FPS and higher detail.

I do own a Laptop with a i7-7600U processor and thus have only 4 Logical Cores und 2 Physical Cores.

I did find out the following:

When starting the Mixed-Reality-Software the first time it will do a Evaluation of your hardware and will write an XML file.

It is stored here:

C:\Users\XXXAppData\Local\Packages\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy_bak\LocalState\DiagOutputDir\ MrrEvaluation.xml

This is only done on the First Run. So if you proceed further by clicking the next button, this XML file will not be refreshed anymore.

Now to the Code.

I am using x64dbg and Ida7 free.

It was not possible for me to debug the MixedRealityPortal.exe because x64dbg crashes or gets a buffer overrun.

So I downloaded the Mixed-Reality-Checker. The code for determining the Core count is nearly the same in both.

So I tried to understand what the Checker does and then searched for the same patterns in the Mixed-Reality-Portal file.

The Checker actually does have a sub in which it will check for Ultra Settings. This is done in sub_180007FB0. (using ida)

BUT! This check is not present in the Portal app. Or this check is concealed somehow.

To get the Core Counts most often CPUID is being used. I did find these checks but couldnt find which one was getting the Core Counts.

In the MixedRealityPortal.Brokered.dll the Core counts are checked in the sub_18002DA20.

This is the Code.

loc_18002DB5D:

mov rax, [rbx]

mov rcx, rbx

mov rax, [rax]

call cs:eek:ff_18006DAC0

mov eax, eax

mov [rsp+540h+var_4D8], rax <-- write Logical Cores to Address [rsp+540h+var_4D8]

mov rax, [rbx]

mov rcx, rbx

mov rax, [rax+8]

call cs:eek:ff_18006DAC0

mov eax, eax

mov [rsp+540h+var_4D0], rax <-- write Physical Cores to Address [rsp+540h+var_4D0]

xor ebx, ebx

Before every call there is a mov rax,[xxx].

This means that in the CALL itself it will jump to different locations to check for the logical Cores and the Physical Cores.

These are the corresponding subs:

Logical Cores:

sub_180048E78 proc near

push rbx

sub rsp, 20h

mov rax, [rcx-78h]

mov rbx, rcx

add rcx, 0FFFFFFFFFFFFFF88h

movsxd rdx, dword ptr [rax+8]

add rcx, rdx

call sub_18005DFD8

mov rax, [rbx-68h]

sub rax, [rbx-70h]

sar rax, 4

add rsp, 20h

pop rbx

retn

sub_180048E78 endp

PhysicalCores:

sub_180048EA8 proc near

push rbx

sub rsp, 20h

mov rax, [rcx-78h]

mov rbx, rcx

add rcx, 0FFFFFFFFFFFFFF88h

movsxd rdx, dword ptr [rax+8]

add rcx, rdx

call sub_18005DFD8

mov eax, [rbx-48h]

add rsp, 20h

pop rbx

retn

sub_180048EA8 endp

If you patch the code like this, you will get the same core count for the Logical and Physical Cores:

loc_18002DB5D:

mov rax, [rbx]

mov rcx, rbx

mov rax, [rax]

call cs:eek:ff_18006DAC0

mov eax, eax

mov [rsp+540h+var_4D8], rax <-- Logical Cores

mov rax, [rbx]

mov rcx, rbx

mov rax, [rax+8] <-- patch mov rax, [rax]

call cs:eek:ff_18006DAC0

mov eax, eax

mov [rsp+540h+var_4D0], rax <-- Physical Cores

xor ebx, ebx

This way the jumps in the Calls is going to the same address and thus LogicC=PhysicalC.

After doing the patch we see the following in the file MrrEvaluation.xml:

<Attribute Name="LogicalCores" Status="Ok" ActualValue="4" TargetValue="4" />

<Attribute Name="PhysicalCores" Status="Ok" ActualValue="4" TargetValue="2" /> <- Was ActualValue="2" TargetValue="2" before patch

Now I am stuck here. After doing this patch the ULTRA Settings are not visible.

I therefore assume that there must be some other check or the Core Count is stored somewhere else and being read out in a different check.

I did find out some more but this would go beyond the scope of this first post.

I hope that someone would like to work with me on this.

Best Wishes

-e