0.7.6

0.7.6: Parallels' keyboard fix is found by bytes, not by address (shim only; the kext is the same code as 0.7.5)

To make the keyboard work, the stand-in library for Parallels calls libMonitor's POST-code handler and sets its flags. Until now it found them at fixed offsets from Parallels 26.5.0 (build 57613). It now finds the handler by the bytes of its start, and the two flags by reading the addresses out of the instructions that test and set them. It acts only if the code matches exactly once; otherwise it leaves the monitor alone and ~/.ryzenhv/prl-patch.log says POST code handler: pattern not found. The log also shows where it found them (handler at +0x…, flags at …). Both the native-mode library and the old shim use it. The CPUID vendor check was already found by bytes.

This helps if a Parallels build moves the code around; a build that changes this function itself still needs a new pattern. Only build 57613 was tried.

Tested, Ryzen 7 5800H, macOS 15.8.1: the pattern finder on synthetic cases and on the installed libMonitor (same offsets as before); Parallels in native mode, a Windows 10 VM resumed with the new library: handler and flags found, keyboard armed. The kext in the archive has the same code as 0.7.5 (only the version string differs), so a 0.7.5 kext in your EFI keeps working. Not tested: other Parallels builds, other machines.

Update: unpack, ./rhv parallels native again (it replaces the library in the private copy). No reboot is needed if the kext is already 0.7.5.