fix

Author: orange-cpp

README.md

@@ -152,7 +152,41 @@ The library locates two non-exported ntdll routines by byte signatures:
 - `LdrpHandleTlsData` — used to register static TLS for the mapped image
 - `RtlInsertInvertedFunctionTable` — used to make the image's exception/SEH handlers visible to the OS exception dispatcher
 
-Patterns are versioned per architecture and have been verified on **Windows 11 24H2**. Older Windows builds may require updated signatures — locate the function in WinDbg (`x ntdll!LdrpHandleTlsData`, `uf <addr>`), take ~16 unique leading bytes, and add the wildcarded pattern to the corresponding `find_*` array in `source/yail.cpp`.
+Patterns are versioned per architecture in `source/ntdll_signatures.hpp`. The checked-in table contains curated baseline patterns and signatures generated from the listed corpus. No fixed table can guarantee every Windows 10/11 monthly revision, so extend the corpus when supporting additional builds.
+
+`tools/build_ntdll_signatures.py` uses Debugging Tools for Windows, Microsoft public symbols, relocation-aware wildcarding, and uniqueness checks inside `.text`. It does not add Microsoft DLLs to the repository.
+
+Generate signatures for the installed Windows build:
+
+```bash
+python tools/build_ntdll_signatures.py --add-local-system
+```
+
+Generate signatures from authorized DLLs collected from additional Windows installations or media:
+
+```bash
+python tools/build_ntdll_signatures.py --corpus C:\path\to\ntdll-corpus
+```
+
+To fetch every Windows 10/11 `ntdll.dll` revision currently indexed by [Winbindex](https://github.com/m417z/winbindex), use its metadata index. The DLL downloads still come from Microsoft's public symbol server and are verified against the indexed SHA-256 hashes. If a Microsoft symbol-server key has an archive collision, the script reports the hash difference and accepts the Microsoft-served PE only when its parsed architecture and key still match:
+
+```bash
+python tools/build_ntdll_signatures.py --winbindex
+```
+
+Use `--winbindex-limit N` for a bounded smoke run before downloading the full indexed corpus.
+
+To generate from an already-downloaded corpus without fetching missing PDBs, use the existing cache in offline mode:
+
+```bash
+python tools/build_ntdll_signatures.py --corpus cmake-build\ntdll-winbindex-corpus --symbol-cache cmake-build\ntdll-winbindex-full-symbol-cache --offline-symbols
+```
+
+The Microsoft symbol server is not an enumerable Windows-version archive. If you already know indexed binary keys (`TimeDateStamp` plus `SizeOfImage`), use a manifest to download those exact DLL revisions from `msdl.microsoft.com` before generating signatures:
+
+```bash
+python tools/build_ntdll_signatures.py --manifest tools/ntdll_manifest.example.json
+```
 
 On modern x86 ntdll, both functions use `__fastcall` (args in `ECX`/`EDX`) despite their legacy `_Name@N` symbol decoration — the typedef and call sites in the source reflect that. If you target an older x86 Windows where these are still `__stdcall`, you'll need to swap the typedef to `NTAPI*`.