Showing preview only (994K chars total). Download the full file or copy to clipboard to get everything.
Repository: 0ffffffffh/Api-Break-for-x64dbg
Branch: beta-development
Commit: 280f6e179aa9
Files: 152
Total size: 944.6 KB
Directory structure:
gitextract_x3y7uekt/
├── .gitignore
├── README.md
├── x64dbgApiBreak/
│ ├── mapperscripts/
│ │ ├── base/
│ │ │ └── base.abtf
│ │ └── main.abtf
│ ├── res.aps
│ ├── res.rc
│ ├── resource.h
│ ├── src/
│ │ ├── apibreak.cpp
│ │ ├── callfind.cpp
│ │ ├── dynapidetect.cpp
│ │ ├── hlprs.cpp
│ │ ├── incl/
│ │ │ ├── apibreak.h
│ │ │ ├── corelib.h
│ │ │ ├── defs.h
│ │ │ ├── dlgs/
│ │ │ │ ├── ApiCallMapForm.hpp
│ │ │ │ ├── MainForm.hpp
│ │ │ │ └── SettingsForm.hpp
│ │ │ ├── hlp.h
│ │ │ ├── instparse.h
│ │ │ ├── pluginsdk/
│ │ │ │ ├── DeviceNameResolver/
│ │ │ │ │ ├── DeviceNameResolver.h
│ │ │ │ │ ├── DeviceNameResolver_x64.a
│ │ │ │ │ ├── DeviceNameResolver_x64.lib
│ │ │ │ │ ├── DeviceNameResolver_x86.a
│ │ │ │ │ └── DeviceNameResolver_x86.lib
│ │ │ │ ├── TitanEngine/
│ │ │ │ │ ├── TitanEngine.h
│ │ │ │ │ ├── TitanEngine_x64.a
│ │ │ │ │ ├── TitanEngine_x64.lib
│ │ │ │ │ ├── TitanEngine_x86.a
│ │ │ │ │ └── TitanEngine_x86.lib
│ │ │ │ ├── XEDParse/
│ │ │ │ │ ├── XEDParse.h
│ │ │ │ │ ├── XEDParse_x64.a
│ │ │ │ │ ├── XEDParse_x64.lib
│ │ │ │ │ ├── XEDParse_x86.a
│ │ │ │ │ └── XEDParse_x86.lib
│ │ │ │ ├── _dbgfunctions.h
│ │ │ │ ├── _plugin_types.h
│ │ │ │ ├── _plugins.h
│ │ │ │ ├── _scriptapi.h
│ │ │ │ ├── _scriptapi_argument.h
│ │ │ │ ├── _scriptapi_assembler.h
│ │ │ │ ├── _scriptapi_bookmark.h
│ │ │ │ ├── _scriptapi_comment.h
│ │ │ │ ├── _scriptapi_debug.h
│ │ │ │ ├── _scriptapi_flag.h
│ │ │ │ ├── _scriptapi_function.h
│ │ │ │ ├── _scriptapi_gui.h
│ │ │ │ ├── _scriptapi_label.h
│ │ │ │ ├── _scriptapi_memory.h
│ │ │ │ ├── _scriptapi_misc.h
│ │ │ │ ├── _scriptapi_module.h
│ │ │ │ ├── _scriptapi_pattern.h
│ │ │ │ ├── _scriptapi_register.h
│ │ │ │ ├── _scriptapi_stack.h
│ │ │ │ ├── _scriptapi_symbol.h
│ │ │ │ ├── bridgegraph.h
│ │ │ │ ├── bridgelist.h
│ │ │ │ ├── bridgemain.h
│ │ │ │ ├── capstone/
│ │ │ │ │ ├── arm.h
│ │ │ │ │ ├── arm64.h
│ │ │ │ │ ├── capstone.h
│ │ │ │ │ ├── capstone_x64.lib
│ │ │ │ │ ├── capstone_x86.lib
│ │ │ │ │ ├── m68k.h
│ │ │ │ │ ├── mips.h
│ │ │ │ │ ├── platform.h
│ │ │ │ │ ├── ppc.h
│ │ │ │ │ ├── sparc.h
│ │ │ │ │ ├── systemz.h
│ │ │ │ │ ├── x86.h
│ │ │ │ │ └── xcore.h
│ │ │ │ ├── dbghelp/
│ │ │ │ │ ├── dbghelp.h
│ │ │ │ │ ├── dbghelp_x64.a
│ │ │ │ │ ├── dbghelp_x64.lib
│ │ │ │ │ ├── dbghelp_x86.a
│ │ │ │ │ └── dbghelp_x86.lib
│ │ │ │ ├── jansson/
│ │ │ │ │ ├── jansson.h
│ │ │ │ │ ├── jansson_config.h
│ │ │ │ │ ├── jansson_x64.a
│ │ │ │ │ ├── jansson_x64.lib
│ │ │ │ │ ├── jansson_x64dbg.h
│ │ │ │ │ ├── jansson_x86.a
│ │ │ │ │ └── jansson_x86.lib
│ │ │ │ ├── lz4/
│ │ │ │ │ ├── lz4.h
│ │ │ │ │ ├── lz4_x64.a
│ │ │ │ │ ├── lz4_x64.lib
│ │ │ │ │ ├── lz4_x86.a
│ │ │ │ │ ├── lz4_x86.lib
│ │ │ │ │ ├── lz4file.h
│ │ │ │ │ └── lz4hc.h
│ │ │ │ ├── x32bridge.lib
│ │ │ │ ├── x32dbg.lib
│ │ │ │ ├── x64bridge.lib
│ │ │ │ ├── x64dbg.lib
│ │ │ │ └── yara/
│ │ │ │ ├── yara/
│ │ │ │ │ ├── ahocorasick.h
│ │ │ │ │ ├── arena.h
│ │ │ │ │ ├── atoms.h
│ │ │ │ │ ├── compiler.h
│ │ │ │ │ ├── dotnet.h
│ │ │ │ │ ├── elf.h
│ │ │ │ │ ├── endian.h
│ │ │ │ │ ├── error.h
│ │ │ │ │ ├── exec.h
│ │ │ │ │ ├── exefiles.h
│ │ │ │ │ ├── filemap.h
│ │ │ │ │ ├── globals.h
│ │ │ │ │ ├── hash.h
│ │ │ │ │ ├── hex_lexer.h
│ │ │ │ │ ├── integers.h
│ │ │ │ │ ├── lexer.h
│ │ │ │ │ ├── libyara.h
│ │ │ │ │ ├── limits.h
│ │ │ │ │ ├── mem.h
│ │ │ │ │ ├── modules.h
│ │ │ │ │ ├── object.h
│ │ │ │ │ ├── parser.h
│ │ │ │ │ ├── pe.h
│ │ │ │ │ ├── pe_utils.h
│ │ │ │ │ ├── proc.h
│ │ │ │ │ ├── re.h
│ │ │ │ │ ├── re_lexer.h
│ │ │ │ │ ├── rules.h
│ │ │ │ │ ├── scan.h
│ │ │ │ │ ├── sizedstr.h
│ │ │ │ │ ├── stream.h
│ │ │ │ │ ├── strutils.h
│ │ │ │ │ ├── threading.h
│ │ │ │ │ ├── types.h
│ │ │ │ │ └── utils.h
│ │ │ │ ├── yara.h
│ │ │ │ ├── yara_x64.lib
│ │ │ │ └── yara_x86.lib
│ │ │ ├── qpc.hpp
│ │ │ ├── rtf.h
│ │ │ ├── settings.h
│ │ │ ├── structmemmap.h
│ │ │ ├── ui/
│ │ │ │ ├── ctrl/
│ │ │ │ │ ├── uicheckbox.hpp
│ │ │ │ │ ├── uicombobox.hpp
│ │ │ │ │ └── uicontrolbase.hpp
│ │ │ │ ├── ui.h
│ │ │ │ └── uiwrapper.hpp
│ │ │ └── util.h
│ │ ├── instparse.cpp
│ │ ├── plugin.cpp
│ │ ├── rtf.cpp
│ │ ├── settings.cpp
│ │ ├── structmemmap.cpp
│ │ ├── syslib.cpp
│ │ ├── ui/
│ │ │ └── ui.cpp
│ │ └── util.cpp
│ ├── x64dbgApiBreak.vcxproj
│ └── x64dbgApiBreak.vcxproj.filters
└── x64dbgApiBreak.sln
================================================
FILE CONTENTS
================================================
================================================
FILE: .gitignore
================================================
bin/
Release/
Debug/
x64/
.vs/
*.sdf
*.opensdf
*.suo
*.vcxproj.user
*.VC.*db
*.bat
*.cmd
================================================
FILE: README.md
================================================
# Api Break for x64dbg
Api Break is a [x64dbg](http://www.x64dbg.com) plugin which is aimed to set breakpoints Win32/64 API calls easly.
####**Features**
* API function entry breakpoint (AEB)
* Breakpoint at API callers (BAC)
* Auto-populating modules and their API functions used by the process.
#### **API Function Entry Breakpoint (AEB)**
It can be useful when the code does obfuscated or indirect api calls or something similar conditions. This mode is automatically (naturally) handles all API calls for the entire module. Also, this mode gives an option to jump automatically to the API caller when the API entry breakpoint hit. It exposes the original caller using single step callstack backtracing.
#### **Breakpoint at API callers (BAC)**
In technically, this mode is much more flexible and customizable. It does scan dynamically for API calls in specified module or address range. For now, it scans only process's code range. But other features are planned for future development.
If you have any idea, let me know what ideas you have about it.
#####**In-Development features**
- Dynamically loaded API detection which is made by using [GetProcAddress](https://msdn.microsoft.com/en-us/library/windows/desktop/ms683212%28v=vs.85%29.aspx) (*About 45% implemented*)
#####**Planning features**
- User specified code range scan for **BAC**
- User specified module scan for **BAC**
- User option to listing all linked modules and APIs of process regardless of IAT.
================================================
FILE: x64dbgApiBreak/mapperscripts/base/base.abtf
================================================
maptype HelloType
{
int val;
}
================================================
FILE: x64dbgApiBreak/mapperscripts/main.abtf
================================================
/*
#################################################################
WARNING: This mapper script format is still in the design phase.
And it may change until the final release.
Hence, the scripts that are written based on the draft phase
may not work in subsequent versions of ApiBreak plugin.
For now, this description of the script format is quite messy. I can
make it better if I have more free time.
#################################################################
[1 - Builtin Primitive Types]
int : System default size integer
uint : System default size unsigned integer
char : Ansi Char
wchar : Wide char
byte : 1 byte (8 bit) singed integer
ubyte : 1 byte (8 bit) unsigned integer
short : 2 byte (16 bit) signed integer
ushort : 2 byte (16 bit) unsigned integer
long : 4 byte (32 bit) signed integer
ulong : 4 byte (32 bit) unsigned integer
long64 : 8 byte (64 bit) signed integer
ulong64 : 8 byte (64 bit) unsigned integer
[2 - Special Primitive Types]
string : ANSI char sequence
wstring : WIDE char sequence
pointer : Untyped generic system sized pointer
archex : Architecture depended hexadecimal value
[3 - Builtin Aliases]
BYTE : alias for ubyte
WORD : alias for ushort
DWORD : alias for ulong
QWORD : alias for ulong64
[4 - User defined aliases]
Users also can define their own aliases
alias [ALIAS_TYPE_NAME] [OWN_ALIAS_IDENTIFIER_FOR_TYPE]
for example;
alias ulong u32_t
[4 - Including different script sources]
Users can write their api and type definition into multiple file or source
And they can include these scripts in their own script file for later usage.
They can include scripts from the another local directory or the internet web address.
@incl [FILEPATH] or [URL]
for example;
@incl 'anotherdirectory/myscript.abtf'
@incl 'http://myserver.com/scripts/main.abtf'
[5 - API function signature declaration]
fnsign {RETTYPE} [ModuleName]
for example:
Here is TerminateProcess function definition in C style prototype
BOOL WINAPI TerminateProcess(
_In_ HANDLE hProcess,
_In_ UINT uExitCode
);
And this is mapper signature definition
alias int BOOL //for BOOL typedef. u remember that 'alias' thing?
fnsign BOOL kernel32.dll!TerminateProcess(pointer hprocess, uint exitCode)
or without return type example.
void GdiplusShutdown(
__in ULONG_PTR token
);
fnsign Gdiplus.dll!GdiplusShutdown(pointer token)
[6 - Type struct definition]
maptype [TYPE_IDENTITY]
{
[FIELD_TYPE1] [fieldName1],
...
another fields if you have
}
for example
maptype mytype
{
int x;
wstring str;
}
now you can use mytype as declared type as you want.
using in api function signature arg, alias or
NOTE: Currently, nested types are not fully supported. (But I will completely.)
*/
@incl 'base/base.abtf'
/* 'HelloType' defined in base/base.abtf as user type structure */
alias HelloType MyHelloType
fnsign pointer kernel32.dll!CreateFileW(wstring fileName, DWORD desiredAccess, DWORD shareMode, pointer secAttrib, DWORD creationDisp, DWORD flagAttrib, out pointer templFile)
================================================
FILE: x64dbgApiBreak/src/apibreak.cpp
================================================
#include <corelib.h>
#include <pluginsdk/_scriptapi_symbol.h>
#include <pluginsdk/_scriptapi_debug.h>
#include <pluginsdk/bridgemain.h>
#include <settings.h>
#include <structmemmap.h>
#include <qpc.hpp>
using namespace Script::Module;
using namespace Script::Symbol;
using namespace Script::Debug;
using namespace Script::Register;
modlist AbpModuleList;
unordered_map<duint, PBREAKPOINT_INFO> AbpBreakpointList;
INTERNAL bool AbiDetectAPIsUsingByGetProcAddress();
INTERNAL int AbiSearchCallersForAFI(duint codeBase, duint codeSize, ApiFunctionInfo *afi);
INTERNAL ModuleInfo * AbiGetCurrentModuleInfo();
FORWARDED BOOL AbfNeedsReload;
void AbpReleaseBreakpointResources()
{
unordered_map<duint, PBREAKPOINT_INFO>::iterator it;
if (AbpBreakpointList.size() == 0)
return;
while (AbpBreakpointList.size() > 0)
{
it = AbpBreakpointList.begin();
if (it->second->cbctx != NULL)
FREEOBJECT(it->second->cbctx);
FREEOBJECT(it->second);
AbpBreakpointList.erase(it);
}
}
PBREAKPOINT_INFO AbpLookupBreakpoint(duint addr)
{
unordered_map<duint, PBREAKPOINT_INFO>::iterator iter;
iter = AbpBreakpointList.find(addr);
if (iter == AbpBreakpointList.end())
return FALSE;
return iter->second;
}
bool AbpRegisterBreakpoint(duint addr, DWORD options, BpCallbackContext *cbctx)
{
PBREAKPOINT_INFO pbi;
if (AbpBreakpointList.find(addr) != AbpBreakpointList.end())
return false;
pbi = ALLOCOBJECT(BREAKPOINT_INFO);
if (!pbi)
return false;
pbi->addr = addr;
pbi->options = options;
pbi->hitCount = 0;
pbi->cbctx = cbctx;
cbctx->ownerBreakpoint = pbi;
AbpBreakpointList.insert({ addr,pbi });
return true;
}
bool AbpDeregisterBreakpoint(duint addr)
{
unordered_map<duint, PBREAKPOINT_INFO>::iterator iter;
iter = AbpBreakpointList.find(addr);
if (iter == AbpBreakpointList.end())
return false;
if (iter->second->cbctx != NULL)
FREEOBJECT(iter->second->cbctx);
FREEOBJECT(iter->second);
AbpBreakpointList.erase(iter);
return true;
}
ModuleApiInfo *AbpSearchModuleApiInfo(const char *name)
{
for (modlist::iterator n = AbpModuleList.begin(); n != AbpModuleList.end(); n++)
{
if (!strcmp((*n)->name, name))
return *n;
}
return NULL;
}
ApiFunctionInfo *AbpSearchApiFunctionInfo(ModuleApiInfo *moduleInfo, const char *func)
{
apilist::iterator iter;
string sfunc(func);
if (!moduleInfo)
return NULL;
iter = moduleInfo->apiList->find(sfunc);
if (iter != moduleInfo->apiList->end())
return iter->second;
return NULL;
}
void AbpLinkApiExportsToModule(ListInfo *moduleList)
{
ModuleInfo *module = NULL;
for (modlist::iterator n = AbpModuleList.begin(); n != AbpModuleList.end(); n++)
{
module = static_cast<ModuleInfo *>(moduleList->data);
for (int i = 0;i < moduleList->count;i++)
{
if (!strcmp(module->name, (*n)->name))
{
(*n)->baseAddr = module->base;
break;
}
module++;
}
}
}
bool AbpDeregisterModule(ModuleApiInfo *mai)
{
apilist::iterator apit;
modlist::iterator modit;
ApiFunctionInfo *afi;
if (!mai)
return false;
for (apit = mai->apiList->begin(); apit != mai->apiList->end(); apit++)
{
afi = apit->second;
if (afi->callInfo.calls)
FREEOBJECT(afi->callInfo.calls);
FREEOBJECT(afi);
}
mai->listCount = 0;
mai->apiList->clear();
delete mai->apiList;
for (modit = AbpModuleList.begin(); modit != AbpModuleList.end(); modit++)
{
if ((*modit) == mai)
break;
}
AbpModuleList.erase(modit);
FREEOBJECT(mai);
return true;
}
bool AbpRegisterApi(SymbolInfo *sym, ApiFunctionInfo **pafi)
{
ModuleApiInfo *mai = NULL;
ApiFunctionInfo *afi = NULL;
BOOL afiExist = FALSE;
if (pafi)
*pafi = NULL;
CharLowerA(sym->mod);
mai = AbpSearchModuleApiInfo(sym->mod);
if (!mai)
{
mai = ALLOCOBJECT(ModuleApiInfo);
if (!mai)
return false;
strcpy(mai->name, sym->mod);
mai->baseAddr = 0;
mai->apiList = new apilist();
AbpModuleList.push_back(mai);
}
if ((afi = AbpSearchApiFunctionInfo(mai, sym->name)))
{
afiExist = TRUE;
}
if (!afiExist)
{
afi = ALLOCOBJECT(ApiFunctionInfo);
if (!afi)
return false;
strcpy(afi->name, sym->name);
mai->apiList->insert({ string(sym->name), afi });
mai->listCount++;
}
afi->rva = sym->rva;
afi->ownerModule = mai;
if (pafi)
*pafi = afi;
return true;
}
INTERNAL_EXPORT ApiFunctionInfo *AbiGetAfi(const char *module, const char *afiName)
{
ModuleApiInfo *mai = NULL;
ApiFunctionInfo *afi = NULL;
mai = AbpSearchModuleApiInfo(module);
if (!mai)
return NULL;
return AbpSearchApiFunctionInfo(mai, afiName);
}
bool AbpNeedsReloadModuleAPIs()
{
ModuleInfo mod;
if (!AbGetDebuggedModuleInfo(&mod))
return false;
return strcmp(mod.name, AbiGetCurrentModuleInfo()->name) != 0;
}
duint AbpGetPEDataOfMainModule2(ModuleInfo *mi, duint type, int sectIndex)
{
return (duint)GetPE32Data(mi->path, sectIndex, type);
}
duint AbpGetPEDataOfMainModule(duint type, int sectIndex)
{
ModuleInfo mainModule;
if (!AbGetDebuggedModuleInfo(&mainModule))
return 0;
return AbpGetPEDataOfMainModule2(&mainModule, type, sectIndex);
}
INTERNAL_EXPORT bool AbiRegisterDynamicApi(const char *module, const char *api, duint mod, duint apiAddr, duint apiRva)
{
SymbolInfo sym;
ApiFunctionInfo *afi = NULL;
DBGPRINT("Registering dynaload api %s(%p) : %s(%p)", module, mod, api, apiAddr);
memset(&sym, 0, sizeof(SymbolInfo));
strcpy(sym.mod, module);
strcpy(sym.name, api);
sym.rva = apiRva;
sym.type = Import;
if (AbpRegisterApi(&sym, &afi))
{
DBGPRINT("registered!");
if (afi->ownerModule->baseAddr == 0)
afi->ownerModule->baseAddr = mod;
return true;
}
return false;
}
INTERNAL_EXPORT int AbiGetMainModuleCodeSections(ModuleSectionInfo **msi)
{
ModuleInfo mainModule;
DWORD flags;
ModuleSectionInfo *sectList = NULL;
int sectCount = 0;
*msi = NULL;
if (!AbGetDebuggedModuleInfo(&mainModule))
return 0;
for (int i = 0;i < mainModule.sectionCount;i++)
{
flags = AbpGetPEDataOfMainModule2(&mainModule, UE_SECTIONFLAGS, i);
if (flags & IMAGE_SCN_CNT_CODE)
{
sectCount++;
sectList = RESIZEOBJECTLIST(ModuleSectionInfo, sectList, sectCount);
sectList[sectCount-1].addr = mainModule.base + AbpGetPEDataOfMainModule2(&mainModule, UE_SECTIONVIRTUALOFFSET, i);
sectList[sectCount-1].size = AbpGetPEDataOfMainModule2(&mainModule, UE_SECTIONVIRTUALSIZE, i);
}
}
*msi = sectList;
return sectCount;
}
void AbDebuggerRun()
{
Script::Debug::Run();
}
void AbDebuggerPause()
{
Script::Debug::Pause();
}
void AbDebuggerWaitUntilPaused()
{
_plugin_waituntilpaused();
}
bool AbCmdExecFormat(const char *format, ...)
{
bool success = false;
char *buffer;
va_list va;
va_start(va, format);
if (HlpPrintFormatBufferExA(&buffer, format, va) > 0)
{
success = DbgCmdExecDirect(buffer);
FREESTRING(buffer);
}
va_end(va);
return success;
}
bool AbGetDebuggedImageName(char *buffer)
{
ModuleInfo mod;
if (!AbGetDebuggedModuleInfo(&mod))
return false;
strcpy(buffer, mod.name);
return true;
}
bool AbGetDebuggedModuleInfo(ModuleInfo *modInfo)
{
duint mainModAddr;
mainModAddr = AbGetDebuggedImageBase();
if (!mainModAddr)
return false;
return InfoFromAddr(mainModAddr, modInfo);
}
bool AbGetDebuggedModulePath(char *pathBuf, int bufLen)
{
ModuleInfo mod;
int dn;
if (!pathBuf)
return false;
if (!AbGetDebuggedModuleInfo(&mod))
return false;
dn = strlen(mod.path);
if (dn > bufLen)
return false;
strcpy(pathBuf, mod.path);
while (pathBuf[--dn] != '\\')
pathBuf[dn] = 0;
return true;
}
duint AbGetDebuggedImageBase()
{
duint base = GetMainModuleBase();
if (base)
return base;
base = (duint)GetDebuggedFileBaseAddress();
if (!base)
base = (duint)GetDebuggedDLLBaseAddress();
return base;
}
bool AbHasDebuggingProcess()
{
ModuleInfo mi;
if (DbgIsDebugging())
{
return AbGetDebuggedModuleInfo(&mi);
}
return false;
}
void AbReleaseModuleResources()
{
while (AbpModuleList.size() > 0)
{
AbpDeregisterModule((*AbpModuleList.begin()));
}
}
bool AbLoadAvailableModuleAPIs(bool onlyImportsByExe)
{
DECL_QPREF;
ListInfo moduleList = { 0 };
ListInfo functionSymbolList = { 0 };
bool modListOk = false, symListOk = false;
bool success = false;
SymbolInfo *sym = NULL;
ModuleApiInfo *mai = NULL;
ApiFunctionInfo *afi = NULL;
if (!AbfNeedsReload)
return true;
QPERF_BEGIN();
DBGPRINT("loading module list");
//First, detect dynamically loaded apis.
//And mark the loaded api export as an imported by exe
if (Script::Module::GetList(&moduleList))
{
if (moduleList.data != NULL)
modListOk = true;
}
DBGPRINT("%d module loaded.", moduleList.count);
QPERF_TIME("module list load");
DBGPRINT("loading symbol list");
if (Script::Symbol::GetList(&functionSymbolList))
{
if (functionSymbolList.data != NULL)
symListOk = true;
}
if (!modListOk || !symListOk)
goto cleanAndExit;
sym = static_cast<SymbolInfo *>(functionSymbolList.data);
QPERF_TIME("Symbol list load");
DBGPRINT("%d symbol loaded.", functionSymbolList.count);
for (int i = 0;i < functionSymbolList.count;i++)
{
if (onlyImportsByExe)
{
if (sym->type == Import && HlpEndsWithA(sym->mod, ".exe",FALSE, 4))
{
//Executables provides psoude module import data
//for now we reserve api registration slot
if (AbpRegisterApi(sym, &afi))
mai = afi->ownerModule;
}
else if (sym->type == Export && !HlpEndsWithA(sym->mod,".exe",FALSE, 4))
{
//Ok. we walkin on the real export modules now.
//try to get AFI if there is exist a reserved for psoude import data
afi = AbpSearchApiFunctionInfo(mai, sym->name);
//If exist make a real registration for exist slot
if (afi != NULL)
{
AbpRegisterApi(sym, NULL);
}
}
}
else
{
if (sym->type == Export && !HlpEndsWithA(sym->mod, ".exe", FALSE, 4))
{
AbpRegisterApi(sym,NULL);
}
}
sym++;
}
DBGPRINT("api registration done");
QPERF_TIME("Api search and registration");
if (AbpModuleList.size() == 0 )
{
MessageBoxA(AbHwndDlgHandle, "The ApiBreak could not load any imports from the being debugged image.\r\n"
"Because, imports are treated as export or could not load imports correctly by the x64dbg. (Its a x64dbg Bug)\r\n"
"Please update your x64dbg to latest version.",
"WARNING",
MB_OK | MB_ICONWARNING);
success = false;
goto cleanAndExit;
}
if (onlyImportsByExe)
AbpDeregisterModule(mai);
AbpLinkApiExportsToModule(&moduleList);
QPERF_TIME("Linking export to module");
success = true;
DBGPRINT("%d module found.", AbpModuleList.size());
if (AbGetSettings()->exposeDynamicApiLoads)
{
AbiDetectAPIsUsingByGetProcAddress();
QPERF_TIME("Detection GetProcAddress");
}
else
DBGPRINT("dynamic api detection disabled!");
AbfNeedsReload = FALSE;
cleanAndExit:
QPERF_DUMP();
if (symListOk)
BridgeFree(functionSymbolList.data);
if (modListOk)
BridgeFree(moduleList.data);
return success;
}
int AbEnumModuleNames(APIMODULE_ENUM_PROC enumProc, void *user)
{
ModuleApiInfo *mai;
for (modlist::iterator n = AbpModuleList.begin(); n != AbpModuleList.end(); n++)
{
mai = *n;
enumProc(mai->name, user);
}
return (int)AbpModuleList.size();
}
void AbEnumApiFunctionNames(APIMODULE_ENUM_PROC enumProc, const char *moduleName, void *user)
{
ModuleApiInfo *mai = NULL;
mai = AbpSearchModuleApiInfo(moduleName);
if (!mai)
return;
for (apilist::iterator n = mai->apiList->begin(); n != mai->apiList->end(); n++)
enumProc(n->second->name, user);
}
bool AbpReturnToCaller(duint callerIp, duint csp)
{
RegisterEnum cspReg, cipReg;
#ifdef _WIN64
cspReg = RegisterEnum::RSP;
cipReg = RegisterEnum::RIP;
#else
cspReg = RegisterEnum::ESP;
cipReg = RegisterEnum::EIP;
#endif
#if _DEBUG
DBGPRINT("Old CIP: %p, New CIP: %p", Get(cipReg), callerIp);
DBGPRINT("Current CSP: %p, Ctx CSP: %p, New CSP: %p", Get(cspReg), csp, csp + sizeof(duint));
#endif
//pop stack
if (!Set(cspReg, csp + sizeof(duint)))
return false;
//set the previous caller address to the Instruction pointer
return Set(cipReg, callerIp);
}
void AbpCallback0(__BpCallbackContext *bpx)
{
return;
}
#include <qpc.hpp>
void AbpBacktrackingBreakpointCallback(__BpCallbackContext *bpx)
{
duint callerIp;
DECL_QPREF;
switch (bpx->bp->type)
{
case bp_normal:
case bp_memory:
case bp_dll:
break;
default:
return;
}
DBGPRINT("Backtracing to the caller");
QPERF_BEGIN();
callerIp = UtlGetCallerAddress(&bpx->regContext);
QPERF_TIME("UtlGetCallerAddress");
if (callerIp > 0)
{
if (AbpReturnToCaller(callerIp, bpx->regContext.regcontext.csp))
{
bpx->regContext.regcontext.csp += sizeof(duint);
bpx->regContext.regcontext.cip = callerIp;
}
else
DBGPRINT("Cant return to caller");
QPERF_TIME("AbpReturnToCaller");
GuiDisasmAt(callerIp, callerIp);
GuiStackDumpAt(bpx->regContext.regcontext.csp, bpx->regContext.regcontext.csp);
QPERF_TIME("AbCmdExecFormat");
}
QPERF_DUMP();
}
bool AbSetAPIBreakpointOnCallers(const char *module, const char *apiFunction)
{
duint addr;
return AbSetBreakpointEx(
module,
apiFunction,
&addr,
BPO_BACKTRACK,
(AB_BREAKPOINT_CALLBACK)AbpBacktrackingBreakpointCallback,
NULL
);
}
bool AbSetAPIBreakpoint(const char *module, const char *apiFunction, duint *funcAddr)
{
return AbSetBreakpointEx(module, apiFunction, funcAddr, BPO_NONE, (AB_BREAKPOINT_CALLBACK)AbpCallback0,NULL);
}
bool AbSetInstructionBreakpoint(duint instrAddr, AB_BREAKPOINT_CALLBACK callback, void *user, bool singleShot)
{
DWORD opt = BPO_NONE;
if (singleShot)
opt |= BPO_SINGLESHOT;
return AbSetBreakpointEx(NULL, NULL, &instrAddr, opt, callback, user);
}
bool AbSetBreakpointEx(const char *module, const char *apiFunction, duint *funcAddr, DWORD bpo, AB_BREAKPOINT_CALLBACK bpCallback, void *user)
{
bool bpSet;
ApiFunctionInfo *afi = NULL;
BpCallbackContext *cbctx = NULL;
duint bpAddr = 0;
bool isNonApiBp;
isNonApiBp = module == NULL && apiFunction == NULL;
if (!isNonApiBp)
{
afi = AbiGetAfi(module, apiFunction);
if (!afi)
return false;
bpAddr = afi->ownerModule->baseAddr + afi->rva;
}
else
{
if (*funcAddr == NULL)
return false;
bpAddr = *funcAddr;
}
if (bpCallback != NULL)
{
cbctx = ALLOCOBJECT(BpCallbackContext);
if (!cbctx)
return false;
cbctx->bpAddr = bpAddr;
cbctx->callback = bpCallback;
cbctx->afi = afi;
cbctx->user = user;
}
if (bpo & BPO_SINGLESHOT)
bpSet = AbCmdExecFormat("bp %p, abss, ss", bpAddr);
else
bpSet = SetBreakpoint(bpAddr);
if (!bpSet)
{
FREEOBJECT(cbctx);
return false;
}
if (!AbpRegisterBreakpoint(bpAddr, bpo, cbctx))
{
FREEOBJECT(cbctx);
}
if (!isNonApiBp)
{
if (bpSet && funcAddr != NULL)
*funcAddr = afi->ownerModule->baseAddr + afi->rva;
}
return bpSet;
}
bool AbDeleteBreakpoint(duint addr)
{
PBREAKPOINT_INFO pbi;
bool deleteOk;
pbi = AbpLookupBreakpoint(addr);
if (!pbi)
return false;
//Single shoot breakpoints will be deleted automatically after hit
if (!(pbi->options & BPO_SINGLESHOT))
deleteOk = DeleteBreakpoint(addr);
else
deleteOk = true; //yep its already deleted
if (deleteOk)
{
AbpDeregisterBreakpoint(addr);
}
return deleteOk;
}
================================================
FILE: x64dbgApiBreak/src/callfind.cpp
================================================
#include <corelib.h>
INTERNAL duint AbiGetCallDestinationAddress(BASIC_INSTRUCTION_INFO *inst);
INTERNAL void AbiCacheInstruction(duint addr, BASIC_INSTRUCTION_INFO *inst);
INTERNAL void AbiEmptyInstructionCache();
bool AbpInsertCallList(ApiFunctionInfo *afi,duint callAddr)
{
duint *tmp;
duint *calls;
int index=0, callsSize = 0;
calls = afi->callInfo.calls;
index = afi->callInfo.callCount;
callsSize = afi->callInfo.callListSize;
if (!calls)
{
callsSize = 20;
calls = (duint *)AbMemoryAlloc(callsSize * sizeof(duint));
if (!calls)
return false;
}
else if (index - 1 >= callsSize)
{
tmp = (duint *)AbMemoryRealloc(calls, (callsSize + 10) * sizeof(duint));
if (!tmp)
{
DBGPRINT("realloc fail");
return false;
}
calls = tmp;
callsSize += 10;
}
*(calls + index) = callAddr;
index++;
afi->callInfo.calls = calls;
afi->callInfo.callCount = index;
afi->callInfo.callListSize = callsSize;
DBGPRINT("Call or jump found on 0x%p", callAddr);
return true;
}
INTERNAL_EXPORT bool AbiIsIndirectCall(duint code, ApiFunctionInfo *afi, duint *indirectRef)
{
BASIC_INSTRUCTION_INFO destInst;
duint apiAddr;
DbgDisasmFastAt(code, &destInst);
//We looking for only jmp. Eliminate other conditional jumps
if (!destInst.call && destInst.branch && HlpBeginsWithA(destInst.instruction, "jmp", FALSE, 3))
{
apiAddr = AbiGetCallDestinationAddress(&destInst);
if (apiAddr == afi->ownerModule->baseAddr + afi->rva)
{
if (indirectRef)
*indirectRef = code;
DBGPRINT("Indirect call (Tramboline) found for %s at 0x%p",
afi->name, code);
return true;
}
}
return false;
}
FORWARDED int AbiSearchCallersForAFI(duint codeBase, duint codeSize, ApiFunctionInfo *afi)
{
#define RETURN(s) { result = s; goto oneWayExit; }
duint code,codeEnd;
BASIC_INSTRUCTION_INFO inst;
duint callAddr,indirectReferencedAddress = 0;
int failInsert=0;
int result = CSR_FAILED;
code = codeBase;
codeEnd = code + codeSize;
AbiEmptyInstructionCache();
for (;code < codeEnd;)
{
DbgDisasmFastAt(code, &inst);
if (inst.call || inst.branch)
{
callAddr = AbiGetCallDestinationAddress(&inst);
if (!inst.call && inst.branch) //is it jmp?
{
//Is it an indirectly referenced call?
if (code == indirectReferencedAddress)
{
DBGPRINT("%s is indirectly referenced and bp wont be set for %p", afi->name, code);
code += inst.size;
continue;
}
}
//Gotcha!
if (afi->ownerModule->baseAddr + afi->rva == callAddr)
failInsert += (int)!AbpInsertCallList(afi, code);
else if (inst.call && AbiIsIndirectCall(callAddr, afi,&indirectReferencedAddress))
failInsert += (int)!AbpInsertCallList(afi, code);
}
else
AbiCacheInstruction(code, &inst);
code += inst.size;
}
if (afi->callInfo.callCount > 0)
{
if (failInsert > 0)
result = CSR_PARTIAL_SUCCESS;
else
result = CSR_COMPLETELY_SUCCESS;
}
return result;
#undef RETURN
}
================================================
FILE: x64dbgApiBreak/src/dynapidetect.cpp
================================================
#include <corelib.h>
#include <settings.h>
#include <instparse.h>
#include <unordered_map>
#include <pluginsdk/_scriptapi_module.h>
#include <pluginsdk/_scriptapi_misc.h>
using namespace Script::Module;
using namespace Script::Misc;
using namespace std;
INTERNAL ApiFunctionInfo *AbiGetAfi(const char *module, const char *afiName);
INTERNAL int AbiGetMainModuleCodeSections(ModuleSectionInfo **msi);
INTERNAL bool AbiRegisterDynamicApi(const char *module, const char *api, duint mod, duint apiAddr, duint apiRva);
INTERNAL bool AbiIsIndirectCall(duint code, ApiFunctionInfo *afi, duint *indirectRef);
#define ALIGNTO_PAGE(x) ( ((x)/0x1000+1) * 0x1000 )
typedef unordered_map<string, vector<char *> *> ondemand_api_list;
HANDLE AbpDeferListSyncMutant;
ondemand_api_list AbpDeferList;
#define SYNCH_BEGIN WaitForSingleObject(AbpDeferListSyncMutant,INFINITE)
#define SYNCH_END ReleaseMutex(AbpDeferListSyncMutant)
/*
On x64 calling convention (fastcall)
parameters are passed in order left to right
the first four parameters are passed in order
RCX, RDX, R8, and R9
GetProcAddress call on Amd64
MOV RCX, MODULEHANDLE
LEA RDX, HARDCODED_API_STRING
CALL GetProcAddress
*/
/*
On x86 architecture, the WIN32 apis uses the stdcall convention
So in this convention, parameters are passed in order right to left
and they are passed (pushed) through the stack
GetProcAddress call on x86
PUSH MODULEHANDLE
PUSH HARDCODED_API_STRING
CALL GetProcAddress
or they may use the stack pointer to passing arguments
instead of direct stack pushing
SUB ESP, 8
MOV [ESP+4], HARDCODED_API_STRING
MOV [ESP],MODULEHANDLE
CALL GetProcAddress
*/
typedef struct
{
BASIC_INSTRUCTION_INFO inst;
duint addr;
}CachedInst;
#define ABP_CACHED_DISASM_SIZE 20
CachedInst AbpCachedDisasmedInstructions[ABP_CACHED_DISASM_SIZE];
int AbpDisasmedCacheIndex = 0;
CachedInst *AbpGetCachedInst(int index)
{
if (index < 0 || index >= AbpDisasmedCacheIndex)
return NULL;
return &AbpCachedDisasmedInstructions[index];
}
INTERNAL_EXPORT void AbiEmptyInstructionCache()
{
memset(AbpCachedDisasmedInstructions, 0, sizeof(CachedInst) * ABP_CACHED_DISASM_SIZE);
AbpDisasmedCacheIndex = 0;
}
INTERNAL_EXPORT void AbiCacheInstruction(duint addr, BASIC_INSTRUCTION_INFO *inst)
{
CachedInst *slot;
bool moveUp = AbpDisasmedCacheIndex >= ABP_CACHED_DISASM_SIZE;
if (!moveUp)
{
slot = &AbpCachedDisasmedInstructions[AbpDisasmedCacheIndex];
AbpDisasmedCacheIndex++;
}
else
{
memmove(
AbpCachedDisasmedInstructions,
AbpCachedDisasmedInstructions + 1,
sizeof(CachedInst) * (ABP_CACHED_DISASM_SIZE - 1)
);
slot = &AbpCachedDisasmedInstructions[ABP_CACHED_DISASM_SIZE - 1];
}
memcpy(&slot->inst, inst, sizeof(BASIC_INSTRUCTION_INFO));
slot->addr = addr;
}
bool AbpRegisterDeferredAPIRegistration(const char *module, const char *api)
{
string smod(module);
ondemand_api_list::iterator it;
vector<char *> *apiList;
char *apiString;
it = AbpDeferList.find(smod);
if (it == AbpDeferList.end())
{
apiList = new vector<char *>();
SYNCH_BEGIN;
AbpDeferList.insert({ smod,apiList });
SYNCH_END;
}
else
apiList = it->second;
apiString = HlpCloneStringA((LPSTR)api);
if (!apiString)
return false;
apiList->push_back(apiString);
return true;
}
INTERNAL_EXPORT duint AbpGetActualDataAddress(BASIC_INSTRUCTION_INFO *inst)
{
if ((inst->type & TYPE_ADDR) || (inst->type & TYPE_VALUE))
return inst->value.value;
else if (inst->type == TYPE_MEMORY)
return inst->memory.value;
return 0;
}
bool AbpReadStringFromInstructionSourceAddress(BASIC_INSTRUCTION_INFO *inst, char *nameBuf)
{
duint addr = AbpGetActualDataAddress(inst);
if (!addr || addr < 0x1000)
{
DBGPRINT("String memory not valid!");
return false;
}
if (!DbgGetStringAt(addr, nameBuf))
{
DBGPRINT("String read error from 0x%p",addr);
return false;
}
//if string begins with 'L'
//that hints to the string source is a wide string
if (*nameBuf == 'L')
{
HlpTrimChar(nameBuf, 'L', HLP_TRIM_LEFT);
}
HlpRemoveQuotations(nameBuf);
return true;
}
bool AbpGetApiStringFromProcLoader(short argNumber, char *nameBuf)
{
CachedInst *inst;
InstInfo loadinst;
RegId compVal=RegNone;
int cacheIndex;
#ifdef _WIN64
switch (argNumber)
{
case 1:
compVal = Cx;
break;
case 2:
compVal = Dx;
break;
case 3:
compVal = r8;
break;
case 4:
compVal = r9;
break;
}
#else
argNumber--;
#endif
cacheIndex = AbpDisasmedCacheIndex;
while (--cacheIndex >= 0)
{
inst = AbpGetCachedInst(cacheIndex);
if (AbParseInstruction(&inst->inst, &loadinst))
{
if (loadinst.size == 64 && loadinst.mem_access == MA_READ)
{
switch (loadinst.op)
{
case OP_MOV:
case OP_LEA:
{
if (compVal == loadinst.reg)
{
if (AbpReadStringFromInstructionSourceAddress(&inst->inst, nameBuf))
return true;
return false;
}
}
break;
}
}
else if (loadinst.size == 32)
{
switch (loadinst.op)
{
case OP_MOV:
case OP_LEA:
{
if (loadinst.reg == ImmMem && loadinst.mem_access == MA_WRITE && loadinst.memory_info.base == Sp)
{
if (loadinst.memory_info.disp == (argNumber * 4))
{
if (AbpReadStringFromInstructionSourceAddress(&inst->inst, nameBuf))
return true;
return false;
}
}
}
break;
case OP_PUSH:
{
if (!argNumber)
{
if (AbpReadStringFromInstructionSourceAddress(&inst->inst, nameBuf))
return true;
return false;
}
else
argNumber--;
}
break;
}
}
}
}
return false;
}
bool AbpExposeStringArgument(short argNumber, char *buf)
{
return AbpGetApiStringFromProcLoader(argNumber, buf);
}
bool AbpIsValidApi(const char *module, const char *function, duint *rva)
{
PBYTE mod = NULL;
PIMAGE_NT_HEADERS ntHdr;
PIMAGE_DOS_HEADER dosHdr;
PIMAGE_EXPORT_DIRECTORY ped;
DWORD moduleSize, exportTableVa;
HANDLE moduleFile, mapping;
char *exportName;
ULONG *addressOfNameStrings, *addressOfFunctions;
WORD *addressOfOrd;
duint imageBase;
bool valid = false;
char path[3][MAX_PATH];
GetSystemDirectoryA(path[0], MAX_PATH);
GetWindowsDirectoryA(path[1], MAX_PATH);
AbGetDebuggedModulePath(path[2], MAX_PATH);
for (int i=0;i<3;i++)
{
sprintf(path[i] + strlen(path[i]), "\\%s", module);
moduleFile = CreateFileA(
path[i],
GENERIC_READ,
FILE_SHARE_READ,
NULL,
OPEN_EXISTING,
FILE_ATTRIBUTE_NORMAL,
NULL
);
if (moduleFile != INVALID_HANDLE_VALUE)
break;
}
if (moduleFile == INVALID_HANDLE_VALUE)
return false;
moduleSize = GetFileSize(moduleFile, NULL);
mapping = CreateFileMappingA(moduleFile, NULL, PAGE_READONLY, 0, ALIGNTO_PAGE(moduleSize), NULL);
if (!mapping)
{
CloseHandle(moduleFile);
return false;
}
mod = (PBYTE)MapViewOfFile(mapping, FILE_MAP_READ, 0, 0, (SIZE_T)moduleSize);
if (!mod)
{
CloseHandle(mapping);
CloseHandle(moduleFile);
return false;
}
dosHdr = (PIMAGE_DOS_HEADER)mod;
if (dosHdr->e_magic != IMAGE_DOS_SIGNATURE)
goto fail;
ntHdr = (PIMAGE_NT_HEADERS)(mod + dosHdr->e_lfanew);
if (ntHdr->Signature != IMAGE_NT_SIGNATURE)
goto fail;
imageBase = ntHdr->OptionalHeader.ImageBase;
if (imageBase != (duint)mod)
imageBase = (duint)mod;
exportTableVa = ntHdr->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress;
ped = (PIMAGE_EXPORT_DIRECTORY)(exportTableVa + imageBase);
addressOfNameStrings = (ULONG *)(ped->AddressOfNames + imageBase);
for (DWORD i = 0;i < ped->NumberOfNames;i++)
{
exportName = (char *)(imageBase + addressOfNameStrings[i]);
if (!strcmp(exportName, function))
{
if (rva != NULL)
{
addressOfFunctions = (ULONG *)(ped->AddressOfFunctions + imageBase);
addressOfOrd = (WORD *)(ped->AddressOfNameOrdinals + imageBase);
*rva = (duint)(addressOfFunctions[addressOfOrd[i]]);
}
valid = true;
break;
}
}
fail:
UnmapViewOfFile(mod);
CloseHandle(mapping);
CloseHandle(moduleFile);
return valid;
}
INTERNAL_EXPORT duint AbiGetCallDestinationAddress(BASIC_INSTRUCTION_INFO *inst)
{
duint callAddr = 0;
duint msize;
if ((inst->type & TYPE_ADDR) || (inst->type & TYPE_VALUE))
callAddr = inst->value.value;
else if (inst->type == TYPE_MEMORY)
{
msize = inst->memory.size;
//Some process injects some chunk of data to the code section for some reason.
//And the disassembler interprets them as instruction sequences
//For example call fword ptr [mem]. And that memory size will be 6 bytes
//Any read attempt on 32 bit machine the memory.value gets overflowed.
if (!(msize == size_byte ||
msize == size_word ||
msize == size_dword ||
msize == size_qword))
{
return 0;
}
DbgMemRead(inst->memory.value, &callAddr, msize);
}
return callAddr;
}
bool AbpIsAPICall2(duint code, ApiFunctionInfo *afi, BASIC_INSTRUCTION_INFO *inst, bool cacheInstruction)
{
duint callAddr;
if (inst->call && inst->branch)
{
callAddr = AbiGetCallDestinationAddress(inst);
if (callAddr == afi->ownerModule->baseAddr + afi->rva)
{
DBGPRINT("'%s' call found at %p",afi->name, code);
return true;
}
else
{
if (AbiIsIndirectCall(callAddr, afi, NULL))
return true;
}
}
if (cacheInstruction)
AbiCacheInstruction(code, inst);
return false;
}
bool AbpIsAPICall(duint code, ApiFunctionInfo *afi, BASIC_INSTRUCTION_INFO *inst)
{
return AbpIsAPICall2(code, afi, inst, true);
}
#define NEXT_INSTR_ADDR(code, inst) (*code) += (inst)->size
bool AbpIsLoadLibraryXXXCall(ApiFunctionInfo **afiList, int afiCount,duint codeAddr, BASIC_INSTRUCTION_INFO *inst, bool cacheInstruction)
{
for (int i = 0;i < afiCount;i++)
{
if (AbpIsAPICall2(codeAddr, afiList[i], inst, false))
{
return true;
}
}
if (cacheInstruction)
AbiCacheInstruction(codeAddr, inst);
return false;
}
bool AbpRegisterAPI(char *module, char *api)
{
duint funcAddr, modAddr, rva;
funcAddr = RemoteGetProcAddress(module, api);
//Is module already loaded?
if (funcAddr)
{
modAddr = DbgModBaseFromName(module);
rva = funcAddr - modAddr;
AbiRegisterDynamicApi(module, api, modAddr, funcAddr, rva);
return true;
}
if (!AbpIsValidApi(module, api,NULL))
{
DBGPRINT("Not valid api");
return false;
}
return AbpRegisterDeferredAPIRegistration(module, api);
}
INTERNAL_EXPORT void AbiRaiseDeferredLoader(const char *dllName, duint base)
{
duint funcAddr;
ondemand_api_list::iterator modIter;
vector<char *> *apiList;
modIter = AbpDeferList.find(string(dllName));
if (modIter == AbpDeferList.end())
return;
apiList = modIter->second;
DBGPRINT("Deferred api's are now registering.");
for (vector<char *>::iterator it = apiList->begin(); it != apiList->end(); it++)
{
//TODO: Find a way to get remote proc address in DLLLOAD callback
//Probably returns null ?
funcAddr = Script::Misc::RemoteGetProcAddress(dllName, *it);
if (!funcAddr)
{
//And also it may returns null
funcAddr = (duint)ImporterGetRemoteAPIAddressEx(dllName, *it);
if (!funcAddr)
{
duint rva=0;
//worst case!
//We know the loaded dll's base address.
//So if I can read rva of the API from the export table
//I can calculate the real API address in the memory.
//Its a bit slower but it works.
if (AbpIsValidApi(dllName, *it, &rva))
{
funcAddr = base + rva;
}
}
}
if (funcAddr > 0)
{
AbiRegisterDynamicApi(dllName, *it, base,funcAddr,funcAddr-base);
}
}
SYNCH_BEGIN;
//TODO : Remove loaded modules from list
SYNCH_END;
//REMOVE waiting mod info
}
//loaderApi can be LoadLibraryA LoadLibraryW LoadLibraryExA LoadLibraryExW
INTERNAL_EXPORT bool AbiDetectAPIsUsingByGetProcAddress()
{
const char *ldrVariants[6] = {
"LoadLibraryA",
"LoadLibraryW",
"LoadLibraryExA",
"LoadLibraryExW",
"GetModuleHandleA",
"GetModuleHandleW"};
BASIC_INSTRUCTION_INFO inst;
ModuleSectionInfo *codeSects;
ApiFunctionInfo *procafi=NULL;
ApiFunctionInfo *libafis[6] = { 0 };
int ldrVariantCount = 0,procLdrCount=0;
int totalFoundApi = 0,sectCount;
int ldrVariantLimit;
bool skip;
duint code, end;
DBGPRINT("Threadid: %x", GetCurrentThreadId());
char moduleName[128], apiFuncName[128];
procafi = AbiGetAfi("kernel32.dll", "GetProcAddress");
if (AbGetSettings()->includeGetModuleHandle)
ldrVariantLimit = 6;
else
ldrVariantLimit = 4;
for (int i = 0;i < ldrVariantLimit;i++)
{
if ((libafis[ldrVariantCount] = AbiGetAfi("kernel32.dll", ldrVariants[i])) != NULL)
ldrVariantCount++;
}
if (!ldrVariantCount || !procafi)
{
DBGPRINT("This process does not use any runtime module and api loading.");
return false;
}
sectCount = AbiGetMainModuleCodeSections(&codeSects);
if (!sectCount)
return false;
for (int cnx = 0;cnx < sectCount;cnx++)
{
code = codeSects[cnx].addr;
end = code + codeSects[cnx].size;
DBGPRINT("Scanning range %p - %p of %d. section", code, end,cnx+1);
while (code < end)
{
DbgDisasmFastAt(code, &inst);
if (AbpIsLoadLibraryXXXCall(libafis, ldrVariantCount, code, &inst, true))
{
memset(moduleName, 0, sizeof(moduleName));
skip = !AbpExposeStringArgument(1, moduleName);
AbiEmptyInstructionCache();
if (skip)
{
NEXT_INSTR_ADDR(&code, &inst);
continue;
}
if (!HlpEndsWithA(moduleName, ".dll", FALSE, 4))
strcat(moduleName, ".dll");
procLdrCount = 0;
while (1)
{
NEXT_INSTR_ADDR(&code, &inst);
DbgDisasmFastAt(code, &inst);
if (!strncmp(inst.instruction, "ret", 3))
{
if (!procLdrCount)
DBGPRINT("GetProcAddress is not called after LoadLibraryXXX");
//else its ok. there is no more getprocaddress calls for the module
DBGPRINT("%d API load found in single module", procLdrCount);
NEXT_INSTR_ADDR(&code, &inst);
break;
}
if (AbpIsAPICall(code, procafi, &inst))
{
memset(apiFuncName, 0, sizeof(apiFuncName));
if (AbpExposeStringArgument(2, apiFuncName))
{
DBGPRINT("Found: %s : %s", moduleName, apiFuncName);
totalFoundApi++;
procLdrCount++;
AbiEmptyInstructionCache();
if (!AbpRegisterAPI(moduleName, apiFuncName))
DBGPRINT("Not load, not registered or not valid: %s:%s", moduleName, apiFuncName);
}
}
else if (AbpIsLoadLibraryXXXCall(libafis, ldrVariantCount, code, &inst, false))
{
if (!procLdrCount)
{
//We dont skip to next instruction address
//cuz, It will be our new loadlibrary reference.
DBGPRINT("Consecutive loadlibrary calls :/");
}
else
{
DBGPRINT("%d API load found in single module", procLdrCount);
}
break;
}
}
}
else
NEXT_INSTR_ADDR(&code, &inst);
}
}
if (totalFoundApi>0)
DBGPRINT("%d dynamic API(s) found!", totalFoundApi);
DBGPRINT("Dynamic scan finished");
AbMemoryFree(codeSects);
return true;
}
INTERNAL_EXPORT void AbiReleaseDeferredResources()
{
for (ondemand_api_list::iterator it = AbpDeferList.begin(); it != AbpDeferList.end(); it++)
{
for (vector<char *>::iterator vit = it->second->begin(); vit != it->second->end(); vit++)
{
FREEOBJECT(*vit);
}
delete it->second;
}
AbpDeferList.clear();
}
INTERNAL_EXPORT void AbiInitDynapi()
{
AbpDeferListSyncMutant = CreateMutexA(NULL, FALSE, NULL);
}
INTERNAL_EXPORT void AbiUninitDynapi()
{
CloseHandle(AbpDeferListSyncMutant);
}
================================================
FILE: x64dbgApiBreak/src/hlprs.cpp
================================================
#include <hlp.h>
#include <varargs.h>
void HlpDebugPrint(const char *format, ...)
{
va_list vl;
char content[0x500] = { 0 };
va_start(vl, format);
_vsnprintf(content, sizeof(content), format, vl);
va_end(vl);
_plugin_logputs(content);
#ifdef _DEBUG
OutputDebugStringA(content);
#endif
}
LPSTR HlpCloneStringA(LPCSTR str)
{
LPSTR clone;
int len;
if (!str)
return NULL;
len = (int)strlen(str);
clone = ALLOCSTRINGA(len);
if (!clone)
return NULL;
memcpy(clone, str, len + 1);
return clone;
}
LPWSTR HlpAnsiToWideString(LPCSTR str)
{
ULONG slen;
LPWSTR wstr;
if (!str)
return NULL;
slen = lstrlenA((LPCSTR)str);
wstr = (LPWSTR)ALLOCSTRINGW(slen);
if (!wstr)
return NULL;
if (MultiByteToWideChar(CP_ACP, MB_COMPOSITE, str, slen, wstr, slen) == slen)
return wstr;
FREESTRING(wstr);
return NULL;
}
LPSTR HlpWideToAnsiString(LPCWSTR str)
{
ULONG slen;
LPSTR astr;
if (!str)
return NULL;
slen = lstrlenW((LPCWSTR)str);
astr = (LPSTR)ALLOCSTRINGA(slen);
if (!astr)
return NULL;
if (WideCharToMultiByte(CP_ACP, WC_COMPOSITECHECK, str, slen, astr, slen, NULL, NULL) == slen)
return astr;
FREESTRING(astr);
return NULL;
}
bool HlpTrimChar(LPSTR str, CHAR chr, int option)
{
char *p;
int len;
bool hasEndChr = false;
if (!str)
return false;
if (!option)
return false;
p = (char *)str;
len = (int)strlen(str);
if (option & HLP_TRIM_RIGHT)
hasEndChr = *(p + (len - 1)) == chr;
if (*p == chr && (option & HLP_TRIM_LEFT))
{
len -= hasEndChr ? 2 : 1;
memmove(p, p + 1, len);
*(p + len) = 0;
return true;
}
else if (hasEndChr)
{
*(p + (len - 1)) = 0;
return true;
}
return false;
}
#include <util.h>
bool HlpReplaceStringW(LPWSTR string, ULONG stringMaxSize, LPCWSTR find, LPCWSTR replace)
{
bool result = false;
ULONG fCount=0, foundIndex=0;
LONG findLen, replLen, strLen, copyLen;
LPWSTR px;
LONG shiftDelta;
PDMA dma;
BYTE *memSrc, *memDst;
if (!DmaCreateAdapter(sizeof(ULONG), 20, &dma))
return false;
findLen = wcslen(find);
replLen = wcslen(replace);
strLen = wcslen(string);
shiftDelta = replLen - findLen;
px = string - 1;
while(1)
{
px = wcsstr(px + 1, find);
if (!px)
break;
foundIndex = px - string;
if (fCount)
foundIndex += fCount * shiftDelta;
DmaWrite(dma, DMA_AUTO_OFFSET, sizeof(ULONG), &foundIndex);
fCount++;
}
if (!fCount)
goto exit;
if (shiftDelta > 0)
{
if (strLen + (shiftDelta * fCount) > stringMaxSize)
goto exit;
}
for (ULONG i = 0;i < fCount;i++)
{
DmaReadTypeAlignedSequence(dma, i, 1, &foundIndex);
memSrc = (BYTE *)((foundIndex + findLen) * sizeof(WCHAR));
memDst = (BYTE *)((foundIndex + replLen) * sizeof(WCHAR));
memSrc += (duint)string;
memDst += (duint)string;
copyLen = (strLen - ((LPWSTR)memSrc - string)) * sizeof(WCHAR);
memmove(memDst, memSrc, copyLen);
if (shiftDelta < 0)
{
//That's a reducing of the string. We need to null-term new end of the string
*((LPWSTR)(memSrc + copyLen - sizeof(WCHAR) * abs(shiftDelta)))
= L'\0';
}
memcpy(string + foundIndex, replace, sizeof(WCHAR) * replLen);
strLen += shiftDelta;
}
result = true;
exit:
DmaDestroyAdapter(dma);
return result;
}
bool HlpReplaceStringA(LPSTR string, ULONG stringMaxSize, LPCSTR find, LPCSTR replace)
{
bool result;
LPWSTR stringW;
LPWSTR findW, replaceW;
LPSTR resultA;
stringW = HlpAnsiToWideString(string);
findW = HlpAnsiToWideString(find);
replaceW = HlpAnsiToWideString(replace);
result = HlpReplaceStringW(stringW, stringMaxSize, findW, replaceW);
FREESTRING(findW);
FREESTRING(replaceW);
resultA = HlpWideToAnsiString(stringW);
FREESTRING(stringW);
strcpy(string, resultA);
FREESTRING(resultA);
return result;
}
bool HlpBeginsWithA(LPCSTR look, LPCSTR find,BOOL caseSens, LONG findLen)
{
bool result;
LPWSTR lookW = HlpAnsiToWideString(look);
LPWSTR findW = HlpAnsiToWideString(find);
result = HlpBeginsWithW(lookW, findW, caseSens, findLen);
FREESTRING(lookW);
FREESTRING(findW);
return result;
}
bool HlpBeginsWithW(LPCWSTR look, LPCWSTR find, BOOL caseSens, LONG findLen)
{
int lookLen;
if (!look || !find)
return false;
if (findLen <= 0)
return false;
lookLen = (int)wcslen(look);
if (lookLen < findLen)
return false;
if (caseSens)
return wcsncmp(look, find, findLen) == 0;
return _wcsnicmp(look, find, findLen) == 0;
}
bool HlpEndsWithA(LPCSTR look, LPCSTR find, BOOL caseSens, LONG findLen)
{
bool result;
LPWSTR lookW = HlpAnsiToWideString(look);
LPWSTR findW = HlpAnsiToWideString(find);
result = HlpEndsWithW(lookW, findW, caseSens, findLen);
FREESTRING(lookW);
FREESTRING(findW);
return result;
}
bool HlpEndsWithW(LPCWSTR look, LPCWSTR find, BOOL caseSens, LONG findLen)
{
int lookLen;
if (!look || !find)
return false;
if (findLen <= 0)
return false;
lookLen = (int)wcslen(look);
if (lookLen < findLen)
return false;
look += lookLen - findLen;
if (caseSens)
return wcscmp(look, find) == 0;
return _wcsicmp(look, find) == 0;
}
LONG HlpPrintFormatBufferExA(LPSTR *buffer, LPCSTR format, va_list vl)
{
int reqLen = 0;
reqLen = _vsnprintf(NULL, NULL, format, vl);
*buffer = ALLOCSTRINGA(reqLen);
if (*buffer == NULL)
return false;
_vsnprintf(*buffer, reqLen + 1, format, vl);
return reqLen;
}
LONG HlpPrintFormatBufferA(LPSTR *buffer, LPCSTR format, ...)
{
va_list vl;
int reqLen;
va_start(vl, format);
reqLen = HlpPrintFormatBufferExA(buffer, format, vl);
va_end(vl);
return reqLen;
}
LONG HlpPrintFormatBufferExW(LPWSTR *buffer, LPCWSTR format, va_list vl)
{
int reqLen = 0;
reqLen = _vsnwprintf(NULL, NULL, format, vl);
*buffer = ALLOCSTRINGW(reqLen);
if (*buffer == NULL)
return false;
_vsnwprintf(*buffer, reqLen + 1, format, vl);
return reqLen;
}
LONG HlpPrintFormatBufferW(LPWSTR *buffer, LPCWSTR format, ...)
{
va_list vl;
int reqLen;
va_start(vl, format);
reqLen = HlpPrintFormatBufferExW(buffer, format, vl);
va_end(vl);
return reqLen;
}
LONG HlpConcateStringFormatA(LPSTR buffer, LONG bufLen, LPCSTR format, ...)
{
LONG currLen, remain,needLen;
va_list vl;
currLen = strlen(buffer);
remain = (bufLen-1) - currLen;
va_start(vl, format);
needLen = _vsnprintf(NULL, NULL, format, vl);
if (remain < needLen)
return 0;
vsprintf(buffer + currLen, format, vl);
va_end(vl);
return needLen;
}
LONG HlpPathFromFilenameA(LPSTR fileName, LPSTR path, LONG pathBufSize, CHAR sep)
{
char c;
LONG pathLen = 0,i=0;
LPSTR pathPtr = path;
while ((c = *(fileName + i)) != 0)
{
if (c == sep)
pathLen = i;
i++;
if (i >= pathBufSize)
return 0;
*pathPtr++ = c;
}
if (pathLen == 0 && i > 0)
return i;
pathLen++;
path[pathLen] = 0;
return pathLen;
}
LONG HlpPathFromFilenameW(LPWSTR fileName, LPWSTR path, LONG pathBufSize, WCHAR sep)
{
wchar_t c;
LONG pathLen = 0, i = 0;
LPWSTR pathPtr = path;
while ((c = *(fileName + i)) != 0)
{
if (c == sep)
pathLen = i;
i++;
if (i >= pathBufSize)
return 0;
*pathPtr++ = c;
}
if (pathLen == 0 && i > 0)
return i;
pathLen++;
path[pathLen] = 0;
return pathLen;
}
================================================
FILE: x64dbgApiBreak/src/incl/apibreak.h
================================================
#ifndef __APIBREAK_H__
#define __APIBREAK_H__
//Disable shitty paranoid warnings
#pragma warning(disable:4091)
#pragma warning(disable:4800)
#pragma warning(disable:4244)
#pragma warning(disable:4267)
#pragma warning(disable:4390)
#define _CRT_SECURE_NO_WARNINGS
#define CSR_FAILED 0
#define CSR_COMPLETELY_SUCCESS 1
#define CSR_PARTIAL_SUCCESS 2
#include <Windows.h>
#include <pluginsdk/_plugin_types.h>
#include <pluginsdk/_plugins.h>
#include <pluginsdk/TitanEngine/TitanEngine.h>
#include <pluginsdk/_scriptapi_module.h>
#include <pluginsdk/_scriptapi_debug.h>
#include <pluginsdk/_scriptapi_register.h>
#include <unordered_map>
#include <vector>
using namespace std;
#define _T(t) __##t
struct __ModuleApiInfo;
struct __BpCallbackContext;
typedef struct
{
_T(ModuleApiInfo *) ownerModule;
struct
{
duint * calls;
int callCount;
int callListSize;
}callInfo;
duint rva;
char name[MAX_LABEL_SIZE];
}ApiFunctionInfo;
typedef unordered_map<
std::string,
ApiFunctionInfo *,
std::tr1::hash<std::string>> apilist;
typedef struct __ModuleApiInfo
{
duint baseAddr;
duint listCount;
apilist* apiList;
char name[MAX_MODULE_SIZE];
}ModuleApiInfo;
typedef vector<ModuleApiInfo *> modlist;
typedef void(*APIMODULE_ENUM_PROC)(LPCSTR,void *);
typedef void(*AB_BREAKPOINT_CALLBACK)(struct __BpCallbackContext *);
struct __BREAKPOINT_INFO;
typedef struct __BpCallbackContext
{
duint bpAddr;
BRIDGEBP * bp;
REGDUMP regContext;
AB_BREAKPOINT_CALLBACK callback;
ApiFunctionInfo *afi;
struct __BREAKPOINT_INFO *ownerBreakpoint;
void * user;
}BpCallbackContext;
typedef struct __BREAKPOINT_INFO
{
duint addr;
duint hitCount;
DWORD options;
DWORD status;
BpCallbackContext* cbctx;
}*PBREAKPOINT_INFO, BREAKPOINT_INFO;
#define BPS_NONE 0x00000000
#define BPS_EXECUTING_HANDLER 0x00000001
#define BPS_EXECUTING_CALLBACK 0x00000002
#define BPO_NONE 0
#define BPO_BACKTRACK 1
#define BPO_SINGLESHOT 2
void AbDebuggerRun();
void AbDebuggerPause();
void AbDebuggerWaitUntilPaused();
bool AbCmdExecFormat(const char *format, ...);
bool AbGetDebuggedImageName(char *buffer);
bool AbGetDebuggedModuleInfo(Script::Module::ModuleInfo *modInfo);
bool AbGetDebuggedModulePath(char *pathBuf, int bufLen);
duint AbGetDebuggedImageBase();
bool AbHasDebuggingProcess();
void AbReleaseModuleResources();
bool AbLoadAvailableModuleAPIs(bool onlyImportsByExe);
int AbEnumModuleNames(APIMODULE_ENUM_PROC enumProc, void *user);
void AbEnumApiFunctionNames(APIMODULE_ENUM_PROC enumProc, const char *moduleName, void *user);
bool AbSetAPIBreakpointOnCallers(const char *module, const char *apiFunction);
bool AbSetAPIBreakpoint(const char *module, const char *apiFunction, duint *funcAddr);
bool AbSetInstructionBreakpoint(duint instrAddr, AB_BREAKPOINT_CALLBACK callback, void *user, bool singleShot);
bool AbSetBreakpointEx(const char *module, const char *apiFunction, duint *funcAddr, DWORD bpo, AB_BREAKPOINT_CALLBACK bpCallback, void *user);
bool AbDeleteBreakpoint(duint addr);
void AbpReleaseBreakpointResources();
PBREAKPOINT_INFO AbpLookupBreakpoint(duint addr);
bool AbpRegisterBreakpoint(duint addr, DWORD options, BpCallbackContext *cbctx);
bool AbpDeregisterBreakpoint(duint addr);
#endif // !__APIBREAK_H__
================================================
FILE: x64dbgApiBreak/src/incl/corelib.h
================================================
#ifndef __CORELIB_H_
#define __CORELIB_H_
#include <apibreak.h>
#include <defs.h>
#ifdef _WIN64
#pragma comment(lib, "pluginsdk/x64dbg.lib")
#pragma comment(lib, "pluginsdk/x64bridge.lib")
#pragma comment(lib, "pluginsdk/TitanEngine/TitanEngine_x64.lib")
#else
#pragma comment(lib, "pluginsdk/x32dbg.lib")
#pragma comment(lib, "pluginsdk/x32bridge.lib")
#pragma comment(lib, "pluginsdk/TitanEngine/TitanEngine_x86.lib")
#endif
bool AbMemReadGuaranteed(duint va, void *dest, duint size);
#define TRACK_MEMORY_ALLOCATIONS
#ifdef TRACK_MEMORY_ALLOCATIONS
void *AbMemoryAlloc_DBG(int size,const char *file, const char *func, const int line);
void *AbMemoryRealloc_DBG(void *memPtr, int newSize, const char *file, const char *func, const int line);
void AbMemoryFree_DBG(void *memPtr);
void AbTrackMemory_DBG(void *memPtr);
#define AbMemoryAlloc(size) AbMemoryAlloc_DBG((size), __FILE__, __FUNCTION__,__LINE__)
#define AbMemoryRealloc(memPtr, newSize) AbMemoryRealloc_DBG((memPtr),(newSize),__FILE__, __FUNCTION__,__LINE__)
#define AbMemoryFree(memPtr) AbMemoryFree_DBG((memPtr))
#define AbTrackMemory(memPtr) AbTrackMemory_DBG((memPtr))
#ifdef __cplusplus
void *operator new(size_t size, char *func, char *file, int line);
//this just for compiler warning. it will forward to standart delete call
void operator delete(void *memory, char *func, char *file, int line);
void operator delete(void *memory);
#define new new(__FUNCTION__, __FILE__, __LINE__)
#endif
#else
#define AbMemoryAlloc(size) _AbMemoryAlloc((size))
#define AbMemoryRealloc(memPtr, newSize) _AbMemoryRealloc((memPtr),(newSize))
#define AbMemoryFree(memPtr) _AbMemoryFree((memPtr))
#define AbTrackMemory(memPtr)
#endif
void *_AbMemoryAlloc(int size);
void *_AbMemoryRealloc(void *memPtr, int newSize);
void _AbMemoryFree(void *memPtr);
void AbRevealPossibleMemoryLeaks();
void AbReleaseAllSystemResources(bool isInShutdown);
BOOL AbRaiseSystemError(const char *errorDesc, int errCode, const char *func, const int line);
FORWARDED int AbPluginHandle;
FORWARDED HWND AbHwndDlgHandle;
FORWARDED int AbMenuHandle;
FORWARDED int AbMenuDisasmHandle;
FORWARDED int AbMenuDumpHandle;
FORWARDED int AbMenuStackHandle;
FORWARDED HMODULE AbPluginModule;
#endif // !__CORELIB_H_
================================================
FILE: x64dbgApiBreak/src/incl/defs.h
================================================
#ifndef __DEFS_H_
#define __DEFS_H_
#include <hlp.h>
#define FORWARDED extern
#define INTERNAL_EXPORT FORWARDED
#define INTERNAL
typedef unsigned char uchar;
#define DBG_LIBEXPORT extern "C" __declspec(dllexport)
#if _DEBUG
#define DBGPRINT(s,...) HlpDebugPrint("ApiBreak: " s "\n",##__VA_ARGS__)
#define DBGPRINT2(s,...) HlpDebugPrint("ApiBreak: %s\n",##__VA_ARGS__)
#define _DBGPRINT(s,...) HlpDebugPrint(s,##__VA_ARGS__)
#else
#define DBGPRINT(s,...)
#define DBGPRINT2(s,...)
#define _DBGPRINT(s,...)
#endif
#define RAISEGLOBALERROR(errString) AbRaiseSystemError(errString, 0,__FUNCTION__,__LINE__)
#define BIGERROR(msg) DBGPRINT(msg); \
__debugbreak()
#define NOTIMPLEMENTED() HlpDebugPrint(__FUNCTION__ " not implemented yet")
#define ALLOCOBJECT(type) (type *)AbMemoryAlloc(sizeof(type))
#define FREEOBJECT(ob) AbMemoryFree((ob))
#define RESIZEOBJECTLIST(type, obj, newSize) (type *)AbMemoryRealloc((obj),sizeof(type) * (newSize))
#define ALLOCSTRINGW(size) (LPWSTR)AbMemoryAlloc(sizeof(WCHAR) * ((size)+1))
#define ALLOCSTRINGA(size) (LPSTR)AbMemoryAlloc(sizeof(CHAR) * ((size)+1))
#define FREESTRING(str) AbMemoryFree((void *)(str))
#if _DEBUG
#define DBGBREAK __debugbreak
#else
#define DBGBREAK
#endif
#define _stringfy(x) #x
#define AB_VERSION_MAJOR 0
#define AB_VERSION_MINOR 5
#define AB_VERSION_BUILD 39
#if _WIN64
#define AB_PLATFORM "x64"
#define PLATFORM_SIZE 64
#else
#define AB_PLATFORM "x86"
#define PLATFORM_SIZE 32
#endif
#define AB_PHASE "BETA"
#define AB_APPNAME "Api Break (" AB_PHASE ")"
#define AB_APPTITLE AB_APPNAME " - " AB_PLATFORM
#define AB_VERSION_STRING(maj,min,build) _stringfy(maj) "." _stringfy(min) " Build: " _stringfy(build)
#define AB_VERSTR AB_VERSION_STRING(AB_VERSION_MAJOR,AB_VERSION_MINOR,AB_VERSION_BUILD)
#define AB_BUILD_TIME __DATE__ " " __TIME__
#endif // !__DEFS_H_
================================================
FILE: x64dbgApiBreak/src/incl/dlgs/ApiCallMapForm.hpp
================================================
#ifndef __APICALLMAPFORM_HPP_
#define __APICALLMAPFORM_HPP_
#include <ui/uiwrapper.hpp>
#include <ui/ctrl/uicombobox.hpp>
#include <resource.h>
#include <Richedit.h>
class ApiCallMapForm : public UiWrapper
{
private:
UiControlBase *txtMapCallResultContent;
LPSTR mapContent;
LONG lengthOfMapContent;
LONG lastReadOffset;
static DWORD CALLBACK EditStreamCallback(
_In_ DWORD_PTR dwCookie,
_In_ LPBYTE pbBuff,
_In_ LONG cb,
_In_ LONG *pcb
)
{
LONG remainLen,readLen;
ApiCallMapForm *_this = (ApiCallMapForm *)dwCookie;
remainLen = _this->lengthOfMapContent - _this->lastReadOffset;
if (!remainLen)
{
*pcb = 0;
return 0;
}
if (remainLen > cb)
readLen = cb;
else
readLen = remainLen;
memcpy(pbBuff, (BYTE *)(_this->mapContent + _this->lastReadOffset), readLen);
_this->lastReadOffset += readLen;
*pcb = readLen;
return 0;
}
public:
ApiCallMapForm(LPSTR callMapContent) : UiWrapper(IDD_APICALLMAP, true)
{
lastReadOffset = 0;
mapContent = callMapContent;
lengthOfMapContent = strlen(mapContent);
}
void OnLoaded()
{
this->txtMapCallResultContent->SendControlMsg(EM_SETSEL, (WPARAM)-1, (LPARAM)-1);
}
void OnClose()
{
if (mapContent)
FREESTRING(mapContent);
}
void OnCommand(WPARAM wp, LPARAM lp)
{
switch (LOWORD(wp))
{
case IDC_MAPDLG_BTNCONT:
AbDebuggerRun();
Close();
break;
}
}
void OnInit()
{
EDITSTREAM es;
es.dwCookie = (DWORD_PTR)this;
es.dwError = 0;
es.pfnCallback = EditStreamCallback;
this->txtMapCallResultContent = GetControlById<UiControlBase>(IDC_RTXTAPIMAPCONTENT);
this->txtMapCallResultContent->SendControlMsg(EM_STREAMIN, SF_RTF | SFF_PLAINRTF,(LPARAM)&es);
//this->txtMapCallResultContent->SetStringA(mapContent);
}
bool ShowDialog()
{
return UiWrapper::ShowDialog(true);
}
};
#endif //__MAINFORM_HPP_
================================================
FILE: x64dbgApiBreak/src/incl/dlgs/MainForm.hpp
================================================
#ifndef __MAINFORM_HPP_
#define __MAINFORM_HPP_
#include <ui/uiwrapper.hpp>
#include <ui/ctrl/uicombobox.hpp>
#include <resource.h>
#define ST_SUCCESS RGB(0x0,0xae,0x0)
#define ST_FAIL RGB(0xce,0x0,0x0)
#define ST_INFO RGB(0x0,0x0,0xff)
#define ST_WARN RGB(0xff,0x4f,0)
#define SETSTATUS(t,x,...) this->lblStatus->DrawStringFormatA(1,1,t,"Status: " ## x, __VA_ARGS__)
#define _SETSTATUS(t,x,...) _this->lblStatus->DrawStringFormatA(1,1,t,"Status: " ## x, __VA_ARGS__)
class MainForm : public UiWrapper
{
private:
UiComboBox *cbModules, *cbApis;
UiControlBase *chkUseXref, *lblStatus;
void InvalidateApiFunctionList()
{
char modName[256] = { 0 };
if (!cbModules->GetSelectedIndexTextA(modName))
return;
this->cbApis->Clear();
AbEnumApiFunctionNames((APIMODULE_ENUM_PROC)ApiFunctionEnumerator, modName, this);
}
void SetBP()
{
char moduleName[256] = { 0 };
char funcName[256] = { 0 };
duint apiAddr;
bool isSet;
bool bpOnXrefs = false;
GetControlTextA(IDC_CBAPIFUNC, funcName, sizeof(funcName));
GetControlTextA(IDC_CBMODULELIST, moduleName, sizeof(moduleName));
bpOnXrefs = (bool)chkUseXref->SendControlMsg(BM_GETCHECK, NULL, NULL);
if (bpOnXrefs)
{
isSet = AbSetAPIBreakpointOnCallers(moduleName, funcName);
if (isSet)
SETSTATUS(ST_SUCCESS,"Api breakpoint set");
else
SETSTATUS(ST_FAIL,"Bp could not be set");
}
else
{
isSet = AbSetAPIBreakpoint(moduleName, funcName, &apiAddr);
if (isSet)
SETSTATUS(ST_SUCCESS,"Breakpoint is set");
else
SETSTATUS(ST_FAIL,"The bp could not be set");
}
}
static void ModuleEnumerator(LPCSTR modName,void *user)
{
MainForm *_this = reinterpret_cast<MainForm *>(user);
_this->cbModules->AddItemA(modName);
}
static void ApiFunctionEnumerator(LPCSTR funcName, void *user)
{
MainForm *_this = reinterpret_cast<MainForm *>(user);
_this->cbApis->AddItemA(funcName);
}
static int WINAPI ApiLoadWorker(void *arg)
{
char processName[MAX_MODULE_SIZE] = { 0 };
MainForm *_this = static_cast<MainForm *>(arg);
int modCount = 0;
if (!AbLoadAvailableModuleAPIs(true))
{
_this->MsgBoxError("Could not be loaded","error");
return 0;
}
modCount = AbEnumModuleNames((APIMODULE_ENUM_PROC)ModuleEnumerator, _this);
if (modCount > 0)
{
AbGetDebuggedImageName(processName);
_this->SetControlTextFormatA(IDC_GRPMOD, "Imported modules && APIs by \"%s\"", processName);
_this->EnableControl(IDC_BTNSETBP);
_SETSTATUS(ST_INFO,"%d module(s) loaded",modCount);
}
return 0;
}
public :
MainForm() : UiWrapper(IDD_MAIN,true)
{
}
void OnCommand(WPARAM wp, LPARAM lp)
{
switch (LOWORD(wp))
{
case IDC_BTNSETBP:
SetBP();
break;
case IDC_CBMODULELIST:
{
if (HIWORD(wp) == CBN_SELCHANGE)
{
InvalidateApiFunctionList();
}
}
break;
case IDC_CHKBPONXREFS:
{
}
break;
}
UiWrapper::OnCommand(wp, lp);
}
void OnInit()
{
SetWindowTitleA(AB_APPTITLE);
this->cbModules = GetControlById<UiComboBox>(IDC_CBMODULELIST);
this->cbApis = GetControlById<UiComboBox>(IDC_CBAPIFUNC);
this->chkUseXref = GetControlById<UiControlBase>(IDC_CHKBPONXREFS);
this->lblStatus = GetControlById<UiControlBase>(IDC_LBLSTATUS);
this->lblStatus->EnableOwnerDraw();
DisableControl(IDC_BTNSETBP);
SETSTATUS(ST_INFO,"Loading modules");
if (AbHasDebuggingProcess())
QueueUserWorkItem((LPTHREAD_START_ROUTINE)ApiLoadWorker, this, WT_EXECUTEDEFAULT);
else
SETSTATUS(ST_WARN,"There is no debug process");
}
bool ShowDialog()
{
return UiWrapper::ShowDialog(true);
}
};
#endif //__MAINFORM_HPP_
================================================
FILE: x64dbgApiBreak/src/incl/dlgs/SettingsForm.hpp
================================================
#ifndef __SETTINGSFORM_HPP_
#define __SETTINGSFORM_HPP_
#include <ui/uiwrapper.hpp>
#include <ui/ctrl/uicheckbox.hpp>
#include <settings.h>
#include <resource.h>
class SettingsForm : public UiWrapper
{
private:
UiCheckBox *chkDetectDynLdr, *chkInclGetModHandle,
*chkAutoload,*chkMapCallctx;
UiControlBase *txtScripts;
void FillGui()
{
Settings *settings = AbGetSettings();
this->chkDetectDynLdr->SetState(settings->exposeDynamicApiLoads);
this->chkInclGetModHandle->SetState(settings->includeGetModuleHandle);
this->chkAutoload->SetState(settings->autoLoadData);
this->chkMapCallctx->SetState(settings->mapCallContext);
if (settings->mainScripts != NULL)
{
HlpReplaceStringA(settings->mainScripts, MAX_SETTING_SIZE, ";", "\r\n");
this->txtScripts->SetStringA(settings->mainScripts);
}
}
void GetFromGUI()
{
Settings *setting = AbGetSettings();
setting->exposeDynamicApiLoads = this->chkDetectDynLdr->GetState();
setting->includeGetModuleHandle = this->chkInclGetModHandle->GetState();
setting->autoLoadData = this->chkAutoload->GetState();
setting->mapCallContext = this->chkMapCallctx->GetState();
txtScripts->GetStringA(&setting->mainScripts, MAX_SETTING_SIZE);
HlpReplaceStringA(setting->mainScripts, MAX_SETTING_SIZE, "\r\n", ";");
}
bool LoadSettings()
{
if (AbSettingsLoad())
{
FillGui();
return true;
}
return false;
}
bool SaveSettings()
{
GetFromGUI();
return AbSettingsSave();
}
public:
SettingsForm() : UiWrapper(IDD_SETTINGS, true)
{
}
void OnCommand(WPARAM wp, LPARAM lp)
{
switch (LOWORD(wp))
{
case IDC_BTNSAVESETTINGS:
SaveSettings(); //fall trough
case IDC_BTNDISCARDSETTINGS:
Close();
break;
case IDC_CHKDETECTDYNLDR:
{
if (HIWORD(wp) == BN_CLICKED)
{
bool state = this->chkDetectDynLdr->GetState();
this->chkInclGetModHandle->SetState(state);
this->chkInclGetModHandle->SetEnableState(state);
}
break;
}
}
UiWrapper::OnCommand(wp, lp);
}
void OnInit()
{
SetWindowTitleA(AB_APPTITLE);
this->chkDetectDynLdr = GetControlById<UiCheckBox>(IDC_CHKDETECTDYNLDR);
this->chkInclGetModHandle = GetControlById<UiCheckBox>(IDC_CHKINSPGETMODULEHANDLE);
this->chkAutoload = GetControlById<UiCheckBox>(IDC_CHKAUTOLOAD);
this->chkMapCallctx = GetControlById<UiCheckBox>(IDC_CHKMAPCALLCTX);
this->txtScripts = GetControlById<UiControlBase>(IDC_TXTMAINSCRIPTS);
LoadSettings();
}
bool ShowDialog()
{
return UiWrapper::ShowDialog(true);
}
};
#endif //__SETTINGSFORM_HPP_
================================================
FILE: x64dbgApiBreak/src/incl/hlp.h
================================================
#ifndef __HELPER_H_
#define __HELPER_H_
#include <corelib.h>
#define HLP_TRIM_LEFT 1
#define HLP_TRIM_RIGHT 2
#define HLP_TRIM_BOTH (HLP_TRIM_LEFT | HLP_TRIM_RIGHT)
void HlpDebugPrint(const char *format, ...);
LPSTR HlpCloneStringA(LPCSTR str);
LPWSTR HlpAnsiToWideString(LPCSTR str);
LPSTR HlpWideToAnsiString(LPCWSTR str);
bool HlpTrimChar(LPSTR str, CHAR chr, int option);
#define HlpRemoveQuotations(str) HlpTrimChar(str, '\"', HLP_TRIM_BOTH)
bool HlpReplaceStringW(LPWSTR string, ULONG stringMaxSize, LPCWSTR find, LPCWSTR replace);
bool HlpReplaceStringA(LPSTR string, ULONG stringMaxSize, LPCSTR find, LPCSTR replace);
bool HlpBeginsWithA(LPCSTR look, LPCSTR find, BOOL caseSens, LONG findLen);
bool HlpBeginsWithW(LPCWSTR look, LPCWSTR find, BOOL caseSens, LONG findLen);
bool HlpEndsWithA(LPCSTR look, LPCSTR find, BOOL caseSens, LONG findLen);
bool HlpEndsWithW(LPCWSTR look, LPCWSTR find, BOOL caseSens, LONG findLen);
LONG HlpPrintFormatBufferExA(LPSTR *buffer, LPCSTR format, va_list vl);
LONG HlpPrintFormatBufferA(LPSTR *buffer, LPCSTR format, ...);
LONG HlpPrintFormatBufferExW(LPWSTR *buffer, LPCWSTR format, va_list vl);
LONG HlpPrintFormatBufferW(LPWSTR *buffer, LPCWSTR format, ...);
LONG HlpConcateStringFormatA(LPSTR buffer, LONG bufLen, LPCSTR format, ...);
LONG HlpPathFromFilenameA(LPSTR fileName, LPSTR path, LONG pathBufSize, CHAR sep);
LONG HlpPathFromFilenameW(LPWSTR fileName, LPWSTR path, LONG pathBufSize, WCHAR sep);
#endif // !__HELPER_H_
================================================
FILE: x64dbgApiBreak/src/incl/instparse.h
================================================
#ifndef __INSTPARSE_H__
#define __INSTPARSE_H__
#include <corelib.h>
typedef struct
{
uchar size;
uchar op;
char reg;
uchar reg_oper;
uchar mem_access;
duint imm;
struct
{
uchar base;
uchar index;
uchar scale;
int disp;
}memory_info;
}InstInfo;
#define MA_NONE 0
#define MA_READ 1
#define MA_WRITE 2
#define OP_MOV 1
#define OP_LEA 2
#define OP_PUSH 3
#define ORD_OP 0
#define ORD_DREG 1
#define ORD_SREG 2
#define ORD_DONE 3
#define GET_REGSIZE(pfx) (pfx == 'r' ? 64 : pfx == 'e' ? 32 : 8)
typedef enum
{
RegNone = -1,
Ax,
Bx,
Cx,
Dx,
Si,
Di,
Bp,
Sp,
r8,
r9,
r10,
r11,
r12,
r13,
r14,
r15,
ImmMem
}RegId;
bool AbParseInstruction(BASIC_INSTRUCTION_INFO *inst, InstInfo *linst);
#endif // !__INSTPARSE_H__
================================================
FILE: x64dbgApiBreak/src/incl/pluginsdk/DeviceNameResolver/DeviceNameResolver.h
================================================
#ifndef _DEVICENAMERESOLVER_H
#define _DEVICENAMERESOLVER_H
#include <windows.h>
#ifdef __cplusplus
extern "C"
{
#endif
__declspec(dllexport) bool DevicePathToPathW(const wchar_t* szDevicePath, wchar_t* szPath, size_t nSizeInChars);
__declspec(dllexport) bool DevicePathToPathA(const char* szDevicePath, char* szPath, size_t nSizeInChars);
__declspec(dllexport) bool DevicePathFromFileHandleW(HANDLE hFile, wchar_t* szDevicePath, size_t nSizeInChars);
__declspec(dllexport) bool DevicePathFromFileHandleA(HANDLE hFile, char* szDevicePath, size_t nSizeInChars);
__declspec(dllexport) bool PathFromFileHandleW(HANDLE hFile, wchar_t* szPath, size_t nSizeInChars);
__declspec(dllexport) bool PathFromFileHandleA(HANDLE hFile, char* szPath, size_t nSizeInChars);
#ifdef __cplusplus
}
#endif
#endif // _DEVICENAMERESOLVER_H
================================================
FILE: x64dbgApiBreak/src/incl/pluginsdk/TitanEngine/TitanEngine.h
================================================
#ifndef TITANENGINE
#define TITANENGINE
#define TITCALL
#if _MSC_VER > 1000
#pragma once
#endif
#include <windows.h>
#include <stdint.h>
#pragma pack(push, 1)
// Global.Constant.Structure.Declaration:
// Engine.External:
#define UE_STRUCT_PE32STRUCT 1
#define UE_STRUCT_PE64STRUCT 2
#define UE_STRUCT_PESTRUCT 3
#define UE_STRUCT_IMPORTENUMDATA 4
#define UE_STRUCT_THREAD_ITEM_DATA 5
#define UE_STRUCT_LIBRARY_ITEM_DATA 6
#define UE_STRUCT_LIBRARY_ITEM_DATAW 7
#define UE_STRUCT_PROCESS_ITEM_DATA 8
#define UE_STRUCT_HANDLERARRAY 9
#define UE_STRUCT_PLUGININFORMATION 10
#define UE_STRUCT_HOOK_ENTRY 11
#define UE_STRUCT_FILE_STATUS_INFO 12
#define UE_STRUCT_FILE_FIX_INFO 13
#define UE_STRUCT_X87FPUREGISTER 14
#define UE_STRUCT_X87FPU 15
#define UE_STRUCT_TITAN_ENGINE_CONTEXT 16
#define UE_ACCESS_READ 0
#define UE_ACCESS_WRITE 1
#define UE_ACCESS_ALL 2
#define UE_HIDE_PEBONLY 0
#define UE_HIDE_BASIC 1
#define UE_PLUGIN_CALL_REASON_PREDEBUG 1
#define UE_PLUGIN_CALL_REASON_EXCEPTION 2
#define UE_PLUGIN_CALL_REASON_POSTDEBUG 3
#define UE_PLUGIN_CALL_REASON_UNHANDLEDEXCEPTION 4
#define TEE_HOOK_NRM_JUMP 1
#define TEE_HOOK_NRM_CALL 3
#define TEE_HOOK_IAT 5
#define UE_ENGINE_ALOW_MODULE_LOADING 1
#define UE_ENGINE_AUTOFIX_FORWARDERS 2
#define UE_ENGINE_PASS_ALL_EXCEPTIONS 3
#define UE_ENGINE_NO_CONSOLE_WINDOW 4
#define UE_ENGINE_BACKUP_FOR_CRITICAL_FUNCTIONS 5
#define UE_ENGINE_CALL_PLUGIN_CALLBACK 6
#define UE_ENGINE_RESET_CUSTOM_HANDLER 7
#define UE_ENGINE_CALL_PLUGIN_DEBUG_CALLBACK 8
#define UE_ENGINE_SET_DEBUG_PRIVILEGE 9
#define UE_OPTION_REMOVEALL 1
#define UE_OPTION_DISABLEALL 2
#define UE_OPTION_REMOVEALLDISABLED 3
#define UE_OPTION_REMOVEALLENABLED 4
#define UE_STATIC_DECRYPTOR_XOR 1
#define UE_STATIC_DECRYPTOR_SUB 2
#define UE_STATIC_DECRYPTOR_ADD 3
#define UE_STATIC_DECRYPTOR_FOREWARD 1
#define UE_STATIC_DECRYPTOR_BACKWARD 2
#define UE_STATIC_KEY_SIZE_1 1
#define UE_STATIC_KEY_SIZE_2 2
#define UE_STATIC_KEY_SIZE_4 4
#define UE_STATIC_KEY_SIZE_8 8
#define UE_STATIC_APLIB 1
#define UE_STATIC_APLIB_DEPACK 2
#define UE_STATIC_LZMA 3
#define UE_STATIC_HASH_MD5 1
#define UE_STATIC_HASH_SHA1 2
#define UE_STATIC_HASH_CRC32 3
#define UE_RESOURCE_LANGUAGE_ANY -1
#define UE_PE_OFFSET 0
#define UE_IMAGEBASE 1
#define UE_OEP 2
#define UE_SIZEOFIMAGE 3
#define UE_SIZEOFHEADERS 4
#define UE_SIZEOFOPTIONALHEADER 5
#define UE_SECTIONALIGNMENT 6
#define UE_IMPORTTABLEADDRESS 7
#define UE_IMPORTTABLESIZE 8
#define UE_RESOURCETABLEADDRESS 9
#define UE_RESOURCETABLESIZE 10
#define UE_EXPORTTABLEADDRESS 11
#define UE_EXPORTTABLESIZE 12
#define UE_TLSTABLEADDRESS 13
#define UE_TLSTABLESIZE 14
#define UE_RELOCATIONTABLEADDRESS 15
#define UE_RELOCATIONTABLESIZE 16
#define UE_TIMEDATESTAMP 17
#define UE_SECTIONNUMBER 18
#define UE_CHECKSUM 19
#define UE_SUBSYSTEM 20
#define UE_CHARACTERISTICS 21
#define UE_NUMBEROFRVAANDSIZES 22
#define UE_BASEOFCODE 23
#define UE_BASEOFDATA 24
#define UE_DLLCHARACTERISTICS 25
//leaving some enum space here for future additions
#define UE_SECTIONNAME 40
#define UE_SECTIONVIRTUALOFFSET 41
#define UE_SECTIONVIRTUALSIZE 42
#define UE_SECTIONRAWOFFSET 43
#define UE_SECTIONRAWSIZE 44
#define UE_SECTIONFLAGS 45
#define UE_VANOTFOUND = -2;
#define UE_CH_BREAKPOINT 1
#define UE_CH_SINGLESTEP 2
#define UE_CH_ACCESSVIOLATION 3
#define UE_CH_ILLEGALINSTRUCTION 4
#define UE_CH_NONCONTINUABLEEXCEPTION 5
#define UE_CH_ARRAYBOUNDSEXCEPTION 6
#define UE_CH_FLOATDENORMALOPERAND 7
#define UE_CH_FLOATDEVIDEBYZERO 8
#define UE_CH_INTEGERDEVIDEBYZERO 9
#define UE_CH_INTEGEROVERFLOW 10
#define UE_CH_PRIVILEGEDINSTRUCTION 11
#define UE_CH_PAGEGUARD 12
#define UE_CH_EVERYTHINGELSE 13
#define UE_CH_CREATETHREAD 14
#define UE_CH_EXITTHREAD 15
#define UE_CH_CREATEPROCESS 16
#define UE_CH_EXITPROCESS 17
#define UE_CH_LOADDLL 18
#define UE_CH_UNLOADDLL 19
#define UE_CH_OUTPUTDEBUGSTRING 20
#define UE_CH_AFTEREXCEPTIONPROCESSING 21
#define UE_CH_SYSTEMBREAKPOINT 23
#define UE_CH_UNHANDLEDEXCEPTION 24
#define UE_CH_RIPEVENT 25
#define UE_CH_DEBUGEVENT 26
#define UE_OPTION_HANDLER_RETURN_HANDLECOUNT 1
#define UE_OPTION_HANDLER_RETURN_ACCESS 2
#define UE_OPTION_HANDLER_RETURN_FLAGS 3
#define UE_OPTION_HANDLER_RETURN_TYPENAME 4
#define UE_BREAKPOINT_INT3 1
#define UE_BREAKPOINT_LONG_INT3 2
#define UE_BREAKPOINT_UD2 3
#define UE_BPXREMOVED 0
#define UE_BPXACTIVE 1
#define UE_BPXINACTIVE 2
#define UE_BREAKPOINT 0
#define UE_SINGLESHOOT 1
#define UE_HARDWARE 2
#define UE_MEMORY 3
#define UE_MEMORY_READ 4
#define UE_MEMORY_WRITE 5
#define UE_MEMORY_EXECUTE 6
#define UE_BREAKPOINT_TYPE_INT3 0x10000000
#define UE_BREAKPOINT_TYPE_LONG_INT3 0x20000000
#define UE_BREAKPOINT_TYPE_UD2 0x30000000
#define UE_HARDWARE_EXECUTE 4
#define UE_HARDWARE_WRITE 5
#define UE_HARDWARE_READWRITE 6
#define UE_HARDWARE_SIZE_1 7
#define UE_HARDWARE_SIZE_2 8
#define UE_HARDWARE_SIZE_4 9
#define UE_HARDWARE_SIZE_8 10
#define UE_ON_LIB_LOAD 1
#define UE_ON_LIB_UNLOAD 2
#define UE_ON_LIB_ALL 3
#define UE_APISTART 0
#define UE_APIEND 1
#define UE_PLATFORM_x86 1
#define UE_PLATFORM_x64 2
#define UE_PLATFORM_ALL 3
#define UE_FUNCTION_STDCALL 1
#define UE_FUNCTION_CCALL 2
#define UE_FUNCTION_FASTCALL 3
#define UE_FUNCTION_STDCALL_RET 4
#define UE_FUNCTION_CCALL_RET 5
#define UE_FUNCTION_FASTCALL_RET 6
#define UE_FUNCTION_STDCALL_CALL 7
#define UE_FUNCTION_CCALL_CALL 8
#define UE_FUNCTION_FASTCALL_CALL 9
#define UE_PARAMETER_BYTE 0
#define UE_PARAMETER_WORD 1
#define UE_PARAMETER_DWORD 2
#define UE_PARAMETER_QWORD 3
#define UE_PARAMETER_PTR_BYTE 4
#define UE_PARAMETER_PTR_WORD 5
#define UE_PARAMETER_PTR_DWORD 6
#define UE_PARAMETER_PTR_QWORD 7
#define UE_PARAMETER_STRING 8
#define UE_PARAMETER_UNICODE 9
#define UE_EAX 1
#define UE_EBX 2
#define UE_ECX 3
#define UE_EDX 4
#define UE_EDI 5
#define UE_ESI 6
#define UE_EBP 7
#define UE_ESP 8
#define UE_EIP 9
#define UE_EFLAGS 10
#define UE_DR0 11
#define UE_DR1 12
#define UE_DR2 13
#define UE_DR3 14
#define UE_DR6 15
#define UE_DR7 16
#define UE_RAX 17
#define UE_RBX 18
#define UE_RCX 19
#define UE_RDX 20
#define UE_RDI 21
#define UE_RSI 22
#define UE_RBP 23
#define UE_RSP 24
#define UE_RIP 25
#define UE_RFLAGS 26
#define UE_R8 27
#define UE_R9 28
#define UE_R10 29
#define UE_R11 30
#define UE_R12 31
#define UE_R13 32
#define UE_R14 33
#define UE_R15 34
#define UE_CIP 35
#define UE_CSP 36
#ifdef _WIN64
#define UE_CFLAGS UE_RFLAGS
#else
#define UE_CFLAGS UE_EFLAGS
#endif
#define UE_SEG_GS 37
#define UE_SEG_FS 38
#define UE_SEG_ES 39
#define UE_SEG_DS 40
#define UE_SEG_CS 41
#define UE_SEG_SS 42
#define UE_x87_r0 43
#define UE_x87_r1 44
#define UE_x87_r2 45
#define UE_x87_r3 46
#define UE_x87_r4 47
#define UE_x87_r5 48
#define UE_x87_r6 49
#define UE_x87_r7 50
#define UE_X87_STATUSWORD 51
#define UE_X87_CONTROLWORD 52
#define UE_X87_TAGWORD 53
#define UE_MXCSR 54
#define UE_MMX0 55
#define UE_MMX1 56
#define UE_MMX2 57
#define UE_MMX3 58
#define UE_MMX4 59
#define UE_MMX5 60
#define UE_MMX6 61
#define UE_MMX7 62
#define UE_XMM0 63
#define UE_XMM1 64
#define UE_XMM2 65
#define UE_XMM3 66
#define UE_XMM4 67
#define UE_XMM5 68
#define UE_XMM6 69
#define UE_XMM7 70
#define UE_XMM8 71
#define UE_XMM9 72
#define UE_XMM10 73
#define UE_XMM11 74
#define UE_XMM12 75
#define UE_XMM13 76
#define UE_XMM14 77
#define UE_XMM15 78
#define UE_x87_ST0 79
#define UE_x87_ST1 80
#define UE_x87_ST2 81
#define UE_x87_ST3 82
#define UE_x87_ST4 83
#define UE_x87_ST5 84
#define UE_x87_ST6 85
#define UE_x87_ST7 86
#define UE_YMM0 87
#define UE_YMM1 88
#define UE_YMM2 89
#define UE_YMM3 90
#define UE_YMM4 91
#define UE_YMM5 92
#define UE_YMM6 93
#define UE_YMM7 94
#define UE_YMM8 95
#define UE_YMM9 96
#define UE_YMM10 97
#define UE_YMM11 98
#define UE_YMM12 99
#define UE_YMM13 100
#define UE_YMM14 101
#define UE_YMM15 102
#ifndef CONTEXT_EXTENDED_REGISTERS
#define CONTEXT_EXTENDED_REGISTERS 0
#endif
typedef struct
{
DWORD PE32Offset;
DWORD ImageBase;
DWORD OriginalEntryPoint;
DWORD BaseOfCode;
DWORD BaseOfData;
DWORD NtSizeOfImage;
DWORD NtSizeOfHeaders;
WORD SizeOfOptionalHeaders;
DWORD FileAlignment;
DWORD SectionAligment;
DWORD ImportTableAddress;
DWORD ImportTableSize;
DWORD ResourceTableAddress;
DWORD ResourceTableSize;
DWORD ExportTableAddress;
DWORD ExportTableSize;
DWORD TLSTableAddress;
DWORD TLSTableSize;
DWORD RelocationTableAddress;
DWORD RelocationTableSize;
DWORD TimeDateStamp;
WORD SectionNumber;
DWORD CheckSum;
WORD SubSystem;
WORD Characteristics;
DWORD NumberOfRvaAndSizes;
} PE32Struct, *PPE32Struct;
typedef struct
{
DWORD PE64Offset;
DWORD64 ImageBase;
DWORD OriginalEntryPoint;
DWORD BaseOfCode;
DWORD BaseOfData;
DWORD NtSizeOfImage;
DWORD NtSizeOfHeaders;
WORD SizeOfOptionalHeaders;
DWORD FileAlignment;
DWORD SectionAligment;
DWORD ImportTableAddress;
DWORD ImportTableSize;
DWORD ResourceTableAddress;
DWORD ResourceTableSize;
DWORD ExportTableAddress;
DWORD ExportTableSize;
DWORD TLSTableAddress;
DWORD TLSTableSize;
DWORD RelocationTableAddress;
DWORD RelocationTableSize;
DWORD TimeDateStamp;
WORD SectionNumber;
DWORD CheckSum;
WORD SubSystem;
WORD Characteristics;
DWORD NumberOfRvaAndSizes;
} PE64Struct, *PPE64Struct;
#if defined(_WIN64)
typedef PE64Struct PEStruct;
#else
typedef PE32Struct PEStruct;
#endif
typedef struct
{
bool NewDll;
int NumberOfImports;
ULONG_PTR ImageBase;
ULONG_PTR BaseImportThunk;
ULONG_PTR ImportThunk;
char* APIName;
char* DLLName;
} ImportEnumData, *PImportEnumData;
typedef struct
{
HANDLE hThread;
DWORD dwThreadId;
void* ThreadStartAddress;
void* ThreadLocalBase;
void* TebAddress;
ULONG WaitTime;
LONG Priority;
LONG BasePriority;
ULONG ContextSwitches;
ULONG ThreadState;
ULONG WaitReason;
} THREAD_ITEM_DATA, *PTHREAD_ITEM_DATA;
typedef struct
{
HANDLE hFile;
void* BaseOfDll;
HANDLE hFileMapping;
void* hFileMappingView;
char szLibraryPath[MAX_PATH];
char szLibraryName[MAX_PATH];
} LIBRARY_ITEM_DATA, *PLIBRARY_ITEM_DATA;
typedef struct
{
HANDLE hFile;
void* BaseOfDll;
HANDLE hFileMapping;
void* hFileMappingView;
wchar_t szLibraryPath[MAX_PATH];
wchar_t szLibraryName[MAX_PATH];
} LIBRARY_ITEM_DATAW, *PLIBRARY_ITEM_DATAW;
typedef struct
{
HANDLE hProcess;
DWORD dwProcessId;
HANDLE hThread;
DWORD dwThreadId;
HANDLE hFile;
void* BaseOfImage;
void* ThreadStartAddress;
void* ThreadLocalBase;
} PROCESS_ITEM_DATA, *PPROCESS_ITEM_DATA;
typedef struct
{
ULONG ProcessId;
HANDLE hHandle;
} HandlerArray, *PHandlerArray;
typedef struct
{
char PluginName[64];
DWORD PluginMajorVersion;
DWORD PluginMinorVersion;
HMODULE PluginBaseAddress;
void* TitanDebuggingCallBack;
void* TitanRegisterPlugin;
void* TitanReleasePlugin;
void* TitanResetPlugin;
bool PluginDisabled;
} PluginInformation, *PPluginInformation;
#define TEE_MAXIMUM_HOOK_SIZE 14
#define TEE_MAXIMUM_HOOK_RELOCS 7
#if defined(_WIN64)
#define TEE_MAXIMUM_HOOK_INSERT_SIZE 14
#else
#define TEE_MAXIMUM_HOOK_INSERT_SIZE 5
#endif
typedef struct HOOK_ENTRY
{
bool IATHook;
BYTE HookType;
DWORD HookSize;
void* HookAddress;
void* RedirectionAddress;
BYTE HookBytes[TEE_MAXIMUM_HOOK_SIZE];
BYTE OriginalBytes[TEE_MAXIMUM_HOOK_SIZE];
void* IATHookModuleBase;
DWORD IATHookNameHash;
bool HookIsEnabled;
bool HookIsRemote;
void* PatchedEntry;
DWORD RelocationInfo[TEE_MAXIMUM_HOOK_RELOCS];
int RelocationCount;
} HOOK_ENTRY, *PHOOK_ENTRY;
#define UE_DEPTH_SURFACE 0
#define UE_DEPTH_DEEP 1
#define UE_UNPACKER_CONDITION_SEARCH_FROM_EP 1
#define UE_UNPACKER_CONDITION_LOADLIBRARY 1
#define UE_UNPACKER_CONDITION_GETPROCADDRESS 2
#define UE_UNPACKER_CONDITION_ENTRYPOINTBREAK 3
#define UE_UNPACKER_CONDITION_RELOCSNAPSHOT1 4
#define UE_UNPACKER_CONDITION_RELOCSNAPSHOT2 5
#define UE_FIELD_OK 0
#define UE_FIELD_BROKEN_NON_FIXABLE 1
#define UE_FIELD_BROKEN_NON_CRITICAL 2
#define UE_FIELD_BROKEN_FIXABLE_FOR_STATIC_USE 3
#define UE_FIELD_BROKEN_BUT_CAN_BE_EMULATED 4
#define UE_FIELD_FIXABLE_NON_CRITICAL 5
#define UE_FIELD_FIXABLE_CRITICAL 6
#define UE_FIELD_NOT_PRESET 7
#define UE_FIELD_NOT_PRESET_WARNING 8
#define UE_RESULT_FILE_OK 10
#define UE_RESULT_FILE_INVALID_BUT_FIXABLE 11
#define UE_RESULT_FILE_INVALID_AND_NON_FIXABLE 12
#define UE_RESULT_FILE_INVALID_FORMAT 13
typedef struct
{
BYTE OveralEvaluation;
bool EvaluationTerminatedByException;
bool FileIs64Bit;
bool FileIsDLL;
bool FileIsConsole;
bool MissingDependencies;
bool MissingDeclaredAPIs;
BYTE SignatureMZ;
BYTE SignaturePE;
BYTE EntryPoint;
BYTE ImageBase;
BYTE SizeOfImage;
BYTE FileAlignment;
BYTE SectionAlignment;
BYTE ExportTable;
BYTE RelocationTable;
BYTE ImportTable;
BYTE ImportTableSection;
BYTE ImportTableData;
BYTE IATTable;
BYTE TLSTable;
BYTE LoadConfigTable;
BYTE BoundImportTable;
BYTE COMHeaderTable;
BYTE ResourceTable;
BYTE ResourceData;
BYTE SectionTable;
} FILE_STATUS_INFO, *PFILE_STATUS_INFO;
typedef struct
{
BYTE OveralEvaluation;
bool FixingTerminatedByException;
bool FileFixPerformed;
bool StrippedRelocation;
bool DontFixRelocations;
DWORD OriginalRelocationTableAddress;
DWORD OriginalRelocationTableSize;
bool StrippedExports;
bool DontFixExports;
DWORD OriginalExportTableAddress;
DWORD OriginalExportTableSize;
bool StrippedResources;
bool DontFixResources;
DWORD OriginalResourceTableAddress;
DWORD OriginalResourceTableSize;
bool StrippedTLS;
bool DontFixTLS;
DWORD OriginalTLSTableAddress;
DWORD OriginalTLSTableSize;
bool StrippedLoadConfig;
bool DontFixLoadConfig;
DWORD OriginalLoadConfigTableAddress;
DWORD OriginalLoadConfigTableSize;
bool StrippedBoundImports;
bool DontFixBoundImports;
DWORD OriginalBoundImportTableAddress;
DWORD OriginalBoundImportTableSize;
bool StrippedIAT;
bool DontFixIAT;
DWORD OriginalImportAddressTableAddress;
DWORD OriginalImportAddressTableSize;
bool StrippedCOM;
bool DontFixCOM;
DWORD OriginalCOMTableAddress;
DWORD OriginalCOMTableSize;
} FILE_FIX_INFO, *PFILE_FIX_INFO;
typedef struct DECLSPEC_ALIGN(16) _XmmRegister_t
{
ULONGLONG Low;
LONGLONG High;
} XmmRegister_t;
typedef struct
{
XmmRegister_t Low; //XMM/SSE part
XmmRegister_t High; //AVX part
} YmmRegister_t;
typedef struct
{
BYTE data[10];
int st_value;
int tag;
} x87FPURegister_t;
typedef struct
{
WORD ControlWord;
WORD StatusWord;
WORD TagWord;
DWORD ErrorOffset;
DWORD ErrorSelector;
DWORD DataOffset;
DWORD DataSelector;
DWORD Cr0NpxState;
} x87FPU_t;
typedef struct
{
ULONG_PTR cax;
ULONG_PTR ccx;
ULONG_PTR cdx;
ULONG_PTR cbx;
ULONG_PTR csp;
ULONG_PTR cbp;
ULONG_PTR csi;
ULONG_PTR cdi;
#ifdef _WIN64
ULONG_PTR r8;
ULONG_PTR r9;
ULONG_PTR r10;
ULONG_PTR r11;
ULONG_PTR r12;
ULONG_PTR r13;
ULONG_PTR r14;
ULONG_PTR r15;
#endif //_WIN64
ULONG_PTR cip;
ULONG_PTR eflags;
unsigned short gs;
unsigned short fs;
unsigned short es;
unsigned short ds;
unsigned short cs;
unsigned short ss;
ULONG_PTR dr0;
ULONG_PTR dr1;
ULONG_PTR dr2;
ULONG_PTR dr3;
ULONG_PTR dr6;
ULONG_PTR dr7;
BYTE RegisterArea[80];
x87FPU_t x87fpu;
DWORD MxCsr;
#ifdef _WIN64
XmmRegister_t XmmRegisters[16];
YmmRegister_t YmmRegisters[16];
#else // x86
XmmRegister_t XmmRegisters[8];
YmmRegister_t YmmRegisters[8];
#endif
} TITAN_ENGINE_CONTEXT_t;
#ifdef __cplusplus
extern "C"
{
#endif
// Global.Function.Declaration:
// TitanEngine.Dumper.functions:
__declspec(dllexport) bool TITCALL DumpProcess(HANDLE hProcess, LPVOID ImageBase, const char* szDumpFileName, ULONG_PTR EntryPoint);
__declspec(dllexport) bool TITCALL DumpProcessW(HANDLE hProcess, LPVOID ImageBase, const wchar_t* szDumpFileName, ULONG_PTR EntryPoint);
__declspec(dllexport) bool TITCALL DumpProcessEx(DWORD ProcessId, LPVOID ImageBase, const char* szDumpFileName, ULONG_PTR EntryPoint);
__declspec(dllexport) bool TITCALL DumpProcessExW(DWORD ProcessId, LPVOID ImageBase, const wchar_t* szDumpFileName, ULONG_PTR EntryPoint);
__declspec(dllexport) bool TITCALL DumpMemory(HANDLE hProcess, LPVOID MemoryStart, ULONG_PTR MemorySize, const char* szDumpFileName);
__declspec(dllexport) bool TITCALL DumpMemoryW(HANDLE hProcess, LPVOID MemoryStart, ULONG_PTR MemorySize, const wchar_t* szDumpFileName);
__declspec(dllexport) bool TITCALL DumpMemoryEx(DWORD ProcessId, LPVOID MemoryStart, ULONG_PTR MemorySize, const char* szDumpFileName);
__declspec(dllexport) bool TITCALL DumpMemoryExW(DWORD ProcessId, LPVOID MemoryStart, ULONG_PTR MemorySize, const wchar_t* szDumpFileName);
__declspec(dllexport) bool TITCALL DumpRegions(HANDLE hProcess, const char* szDumpFolder, bool DumpAboveImageBaseOnly);
__declspec(dllexport) bool TITCALL DumpRegionsW(HANDLE hProcess, const wchar_t* szDumpFolder, bool DumpAboveImageBaseOnly);
__declspec(dllexport) bool TITCALL DumpRegionsEx(DWORD ProcessId, const char* szDumpFolder, bool DumpAboveImageBaseOnly);
__declspec(dllexport) bool TITCALL DumpRegionsExW(DWORD ProcessId, const wchar_t* szDumpFolder, bool DumpAboveImageBaseOnly);
__declspec(dllexport) bool TITCALL DumpModule(HANDLE hProcess, LPVOID ModuleBase, const char* szDumpFileName);
__declspec(dllexport) bool TITCALL DumpModuleW(HANDLE hProcess, LPVOID ModuleBase, const wchar_t* szDumpFileName);
__declspec(dllexport) bool TITCALL DumpModuleEx(DWORD ProcessId, LPVOID ModuleBase, const char* szDumpFileName);
__declspec(dllexport) bool TITCALL DumpModuleExW(DWORD ProcessId, LPVOID ModuleBase, const wchar_t* szDumpFileName);
__declspec(dllexport) bool TITCALL PastePEHeader(HANDLE hProcess, LPVOID ImageBase, const char* szDebuggedFileName);
__declspec(dllexport) bool TITCALL PastePEHeaderW(HANDLE hProcess, LPVOID ImageBase, const wchar_t* szDebuggedFileName);
__declspec(dllexport) bool TITCALL ExtractSection(const char* szFileName, const char* szDumpFileName, DWORD SectionNumber);
__declspec(dllexport) bool TITCALL ExtractSectionW(const wchar_t* szFileName, const wchar_t* szDumpFileName, DWORD SectionNumber);
__declspec(dllexport) bool TITCALL ResortFileSections(const char* szFileName);
__declspec(dllexport) bool TITCALL ResortFileSectionsW(const wchar_t* szFileName);
__declspec(dllexport) bool TITCALL FindOverlay(const char* szFileName, LPDWORD OverlayStart, LPDWORD OverlaySize);
__declspec(dllexport) bool TITCALL FindOverlayW(const wchar_t* szFileName, LPDWORD OverlayStart, LPDWORD OverlaySize);
__declspec(dllexport) bool TITCALL ExtractOverlay(const char* szFileName, const char* szExtactedFileName);
__declspec(dllexport) bool TITCALL ExtractOverlayW(const wchar_t* szFileName, const wchar_t* szExtactedFileName);
__declspec(dllexport) bool TITCALL AddOverlay(const char* szFileName, const char* szOverlayFileName);
__declspec(dllexport) bool TITCALL AddOverlayW(const wchar_t* szFileName, const wchar_t* szOverlayFileName);
__declspec(dllexport) bool TITCALL CopyOverlay(const char* szInFileName, const char* szOutFileName);
__declspec(dllexport) bool TITCALL CopyOverlayW(const wchar_t* szInFileName, const wchar_t* szOutFileName);
__declspec(dllexport) bool TITCALL RemoveOverlay(const char* szFileName);
__declspec(dllexport) bool TITCALL RemoveOverlayW(const wchar_t* szFileName);
__declspec(dllexport) bool TITCALL MakeAllSectionsRWE(const char* szFileName);
__declspec(dllexport) bool TITCALL MakeAllSectionsRWEW(const wchar_t* szFileName);
__declspec(dllexport) long TITCALL AddNewSectionEx(const char* szFileName, const char* szSectionName, DWORD SectionSize, DWORD SectionAttributes, LPVOID SectionContent, DWORD ContentSize);
__declspec(dllexport) long TITCALL AddNewSectionExW(const wchar_t* szFileName, const char* szSectionName, DWORD SectionSize, DWORD SectionAttributes, LPVOID SectionContent, DWORD ContentSize);
__declspec(dllexport) long TITCALL AddNewSection(const char* szFileName, const char* szSectionName, DWORD SectionSize);
__declspec(dllexport) long TITCALL AddNewSectionW(const wchar_t* szFileName, const char* szSectionName, DWORD SectionSize);
__declspec(dllexport) bool TITCALL ResizeLastSection(const char* szFileName, DWORD NumberOfExpandBytes, bool AlignResizeData);
__declspec(dllexport) bool TITCALL ResizeLastSectionW(const wchar_t* szFileName, DWORD NumberOfExpandBytes, bool AlignResizeData);
__declspec(dllexport) void TITCALL SetSharedOverlay(const char* szFileName);
__declspec(dllexport) void TITCALL SetSharedOverlayW(const wchar_t* szFileName);
__declspec(dllexport) char* TITCALL GetSharedOverlay();
__declspec(dllexport) wchar_t* TITCALL GetSharedOverlayW();
__declspec(dllexport) bool TITCALL DeleteLastSection(const char* szFileName);
__declspec(dllexport) bool TITCALL DeleteLastSectionW(const wchar_t* szFileName);
__declspec(dllexport) bool TITCALL DeleteLastSectionEx(const char* szFileName, DWORD NumberOfSections);
__declspec(dllexport) bool TITCALL DeleteLastSectionExW(const wchar_t* szFileName, DWORD NumberOfSections);
__declspec(dllexport) ULONG_PTR TITCALL GetPE32DataFromMappedFile(ULONG_PTR FileMapVA, DWORD WhichSection, DWORD WhichData);
__declspec(dllexport) ULONG_PTR TITCALL GetPE32Data(const char* szFileName, DWORD WhichSection, DWORD WhichData);
__declspec(dllexport) ULONG_PTR TITCALL GetPE32DataW(const wchar_t* szFileName, DWORD WhichSection, DWORD WhichData);
__declspec(dllexport) bool TITCALL GetPE32DataFromMappedFileEx(ULONG_PTR FileMapVA, LPVOID DataStorage);
__declspec(dllexport) bool TITCALL GetPE32DataEx(const char* szFileName, LPVOID DataStorage);
__declspec(dllexport) bool TITCALL GetPE32DataExW(const wchar_t* szFileName, LPVOID DataStorage);
__declspec(dllexport) bool TITCALL SetPE32DataForMappedFile(ULONG_PTR FileMapVA, DWORD WhichSection, DWORD WhichData, ULONG_PTR NewDataValue);
__declspec(dllexport) bool TITCALL SetPE32Data(const char* szFileName, DWORD WhichSection, DWORD WhichData, ULONG_PTR NewDataValue);
__declspec(dllexport) bool TITCALL SetPE32DataW(const wchar_t* szFileName, DWORD WhichSection, DWORD WhichData, ULONG_PTR NewDataValue);
__declspec(dllexport) bool TITCALL SetPE32DataForMappedFileEx(ULONG_PTR FileMapVA, LPVOID DataStorage);
__declspec(dllexport) bool TITCALL SetPE32DataEx(const char* szFileName, LPVOID DataStorage);
__declspec(dllexport) bool TITCALL SetPE32DataExW(const wchar_t* szFileName, LPVOID DataStorage);
__declspec(dllexport) long TITCALL GetPE32SectionNumberFromVA(ULONG_PTR FileMapVA, ULONG_PTR AddressToConvert);
__declspec(dllexport) ULONG_PTR TITCALL ConvertVAtoFileOffset(ULONG_PTR FileMapVA, ULONG_PTR AddressToConvert, bool ReturnType);
__declspec(dllexport) ULONG_PTR TITCALL ConvertVAtoFileOffsetEx(ULONG_PTR FileMapVA, DWORD FileSize, ULONG_PTR ImageBase, ULONG_PTR AddressToConvert, bool AddressIsRVA, bool ReturnType);
__declspec(dllexport) ULONG_PTR TITCALL ConvertFileOffsetToVA(ULONG_PTR FileMapVA, ULONG_PTR AddressToConvert, bool ReturnType);
__declspec(dllexport) ULONG_PTR TITCALL ConvertFileOffsetToVAEx(ULONG_PTR FileMapVA, DWORD FileSize, ULONG_PTR ImageBase, ULONG_PTR AddressToConvert, bool ReturnType);
__declspec(dllexport) bool TITCALL MemoryReadSafe(HANDLE hProcess, LPVOID lpBaseAddress, LPVOID lpBuffer, SIZE_T nSize, SIZE_T* lpNumberOfBytesRead);
__declspec(dllexport) bool TITCALL MemoryWriteSafe(HANDLE hProcess, LPVOID lpBaseAddress, LPCVOID lpBuffer, SIZE_T nSize, SIZE_T* lpNumberOfBytesWritten);
// TitanEngine.Realigner.functions:
__declspec(dllexport) bool TITCALL FixHeaderCheckSum(const char* szFileName);
__declspec(dllexport) bool TITCALL FixHeaderCheckSumW(const wchar_t* szFileName);
__declspec(dllexport) long TITCALL RealignPE(ULONG_PTR FileMapVA, DWORD FileSize, DWORD RealingMode);
__declspec(dllexport) long TITCALL RealignPEEx(const char* szFileName, DWORD RealingFileSize, DWORD ForcedFileAlignment);
__declspec(dllexport) long TITCALL RealignPEExW(const wchar_t* szFileName, DWORD RealingFileSize, DWORD ForcedFileAlignment);
__declspec(dllexport) bool TITCALL WipeSection(const char* szFileName, int WipeSectionNumber, bool RemovePhysically);
__declspec(dllexport) bool TITCALL WipeSectionW(const wchar_t* szFileName, int WipeSectionNumber, bool RemovePhysically);
__declspec(dllexport) bool TITCALL IsPE32FileValidEx(const char* szFileName, DWORD CheckDepth, LPVOID FileStatusInfo);
__declspec(dllexport) bool TITCALL IsPE32FileValidExW(const wchar_t* szFileName, DWORD CheckDepth, LPVOID FileStatusInfo);
__declspec(dllexport) bool TITCALL FixBrokenPE32FileEx(const char* szFileName, LPVOID FileStatusInfo, LPVOID FileFixInfo);
__declspec(dllexport) bool TITCALL FixBrokenPE32FileExW(const wchar_t* szFileName, LPVOID FileStatusInfo, LPVOID FileFixInfo);
__declspec(dllexport) bool TITCALL IsFileDLL(const char* szFileName, ULONG_PTR FileMapVA);
__declspec(dllexport) bool TITCALL IsFileDLLW(const wchar_t* szFileName, ULONG_PTR FileMapVA);
// TitanEngine.Hider.functions:
__declspec(dllexport) void* TITCALL GetPEBLocation(HANDLE hProcess);
__declspec(dllexport) void* TITCALL GetPEBLocation64(HANDLE hProcess);
__declspec(dllexport) void* TITCALL GetTEBLocation(HANDLE hThread);
__declspec(dllexport) void* TITCALL GetTEBLocation64(HANDLE hThread);
__declspec(dllexport) bool TITCALL HideDebugger(HANDLE hProcess, DWORD PatchAPILevel);
__declspec(dllexport) bool TITCALL UnHideDebugger(HANDLE hProcess, DWORD PatchAPILevel);
// TitanEngine.Relocater.functions:
__declspec(dllexport) void TITCALL RelocaterCleanup();
__declspec(dllexport) void TITCALL RelocaterInit(DWORD MemorySize, ULONG_PTR OldImageBase, ULONG_PTR NewImageBase);
__declspec(dllexport) void TITCALL RelocaterAddNewRelocation(HANDLE hProcess, ULONG_PTR RelocateAddress, DWORD RelocateState);
__declspec(dllexport) long TITCALL RelocaterEstimatedSize();
__declspec(dllexport) bool TITCALL RelocaterExportRelocation(ULONG_PTR StorePlace, DWORD StorePlaceRVA, ULONG_PTR FileMapVA);
__declspec(dllexport) bool TITCALL RelocaterExportRelocationEx(const char* szFileName, const char* szSectionName);
__declspec(dllexport) bool TITCALL RelocaterExportRelocationExW(const wchar_t* szFileName, const char* szSectionName);
__declspec(dllexport) bool TITCALL RelocaterGrabRelocationTable(HANDLE hProcess, ULONG_PTR MemoryStart, DWORD MemorySize);
__declspec(dllexport) bool TITCALL RelocaterGrabRelocationTableEx(HANDLE hProcess, ULONG_PTR MemoryStart, ULONG_PTR MemorySize, DWORD NtSizeOfImage);
__declspec(dllexport) bool TITCALL RelocaterMakeSnapshot(HANDLE hProcess, const char* szSaveFileName, LPVOID MemoryStart, ULONG_PTR MemorySize);
__declspec(dllexport) bool TITCALL RelocaterMakeSnapshotW(HANDLE hProcess, const wchar_t* szSaveFileName, LPVOID MemoryStart, ULONG_PTR MemorySize);
__declspec(dllexport) bool TITCALL RelocaterCompareTwoSnapshots(HANDLE hProcess, ULONG_PTR LoadedImageBase, ULONG_PTR NtSizeOfImage, const char* szDumpFile1, const char* szDumpFile2, ULONG_PTR MemStart);
__declspec(dllexport) bool TITCALL RelocaterCompareTwoSnapshotsW(HANDLE hProcess, ULONG_PTR LoadedImageBase, ULONG_PTR NtSizeOfImage, const wchar_t* szDumpFile1, const wchar_t* szDumpFile2, ULONG_PTR MemStart);
__declspec(dllexport) bool TITCALL RelocaterChangeFileBase(const char* szFileName, ULONG_PTR NewImageBase);
__declspec(dllexport) bool TITCALL RelocaterChangeFileBaseW(const wchar_t* szFileName, ULONG_PTR NewImageBase);
__declspec(dllexport) bool TITCALL RelocaterRelocateMemoryBlock(ULONG_PTR FileMapVA, ULONG_PTR MemoryLocation, void* RelocateMemory, DWORD RelocateMemorySize, ULONG_PTR CurrentLoadedBase, ULONG_PTR RelocateBase);
__declspec(dllexport) bool TITCALL RelocaterWipeRelocationTable(const char* szFileName);
__declspec(dllexport) bool TITCALL RelocaterWipeRelocationTableW(const wchar_t* szFileName);
// TitanEngine.Resourcer.functions:
__declspec(dllexport) ULONG_PTR TITCALL ResourcerLoadFileForResourceUse(const char* szFileName);
__declspec(dllexport) ULONG_PTR TITCALL ResourcerLoadFileForResourceUseW(const wchar_t* szFileName);
__declspec(dllexport) bool TITCALL ResourcerFreeLoadedFile(LPVOID LoadedFileBase);
__declspec(dllexport) bool TITCALL ResourcerExtractResourceFromFileEx(HMODULE hFile, const char* szResourceType, const char* szResourceName, const char* szExtractedFileName);
__declspec(dllexport) bool TITCALL ResourcerExtractResourceFromFile(const char* szFileName, const char* szResourceType, const char* szResourceName, const char* szExtractedFileName);
__declspec(dllexport) bool TITCALL ResourcerExtractResourceFromFileW(const wchar_t* szFileName, char* szResourceType, const char* szResourceName, const char* szExtractedFileName);
__declspec(dllexport) bool TITCALL ResourcerFindResource(const char* szFileName, const char* szResourceType, DWORD ResourceType, const char* szResourceName, DWORD ResourceName, DWORD ResourceLanguage, PULONG_PTR pResourceData, LPDWORD pResourceSize);
__declspec(dllexport) bool TITCALL ResourcerFindResourceW(const wchar_t* szFileName, const wchar_t* szResourceType, DWORD ResourceType, const wchar_t* szResourceName, DWORD ResourceName, DWORD ResourceLanguage, PULONG_PTR pResourceData, LPDWORD pResourceSize);
__declspec(dllexport) bool TITCALL ResourcerFindResourceEx(ULONG_PTR FileMapVA, DWORD FileSize, const wchar_t* szResourceType, DWORD ResourceType, const wchar_t* szResourceName, DWORD ResourceName, DWORD ResourceLanguage, PULONG_PTR pResourceData, LPDWORD pResourceSize);
__declspec(dllexport) void TITCALL ResourcerEnumerateResource(const char* szFileName, void* CallBack);
__declspec(dllexport) void TITCALL ResourcerEnumerateResourceW(const wchar_t* szFileName, void* CallBack);
__declspec(dllexport) void TITCALL ResourcerEnumerateResourceEx(ULONG_PTR FileMapVA, DWORD FileSize, void* CallBack);
// TitanEngine.Threader.functions:
__declspec(dllexport) bool TITCALL ThreaderImportRunningThreadData(DWORD ProcessId);
__declspec(dllexport) void* TITCALL ThreaderGetThreadInfo(HANDLE hThread, DWORD ThreadId);
__declspec(dllexport) void TITCALL ThreaderEnumThreadInfo(void* EnumCallBack);
__declspec(dllexport) bool TITCALL ThreaderPauseThread(HANDLE hThread);
__declspec(dllexport) bool TITCALL ThreaderResumeThread(HANDLE hThread);
__declspec(dllexport) bool TITCALL ThreaderTerminateThread(HANDLE hThread, DWORD ThreadExitCode);
__declspec(dllexport) bool TITCALL ThreaderPauseAllThreads(bool LeaveMainRunning);
__declspec(dllexport) bool TITCALL ThreaderResumeAllThreads(bool LeaveMainPaused);
__declspec(dllexport) bool TITCALL ThreaderPauseProcess();
__declspec(dllexport) bool TITCALL ThreaderResumeProcess();
__declspec(dllexport) ULONG_PTR TITCALL ThreaderCreateRemoteThread(ULONG_PTR ThreadStartAddress, bool AutoCloseTheHandle, LPVOID ThreadPassParameter, LPDWORD ThreadId);
__declspec(dllexport) bool TITCALL ThreaderInjectAndExecuteCode(LPVOID InjectCode, DWORD StartDelta, DWORD InjectSize);
__declspec(dllexport) ULONG_PTR TITCALL ThreaderCreateRemoteThreadEx(HANDLE hProcess, ULONG_PTR ThreadStartAddress, bool AutoCloseTheHandle, LPVOID ThreadPassParameter, LPDWORD ThreadId);
__declspec(dllexport) bool TITCALL ThreaderInjectAndExecuteCodeEx(HANDLE hProcess, LPVOID InjectCode, DWORD StartDelta, DWORD InjectSize);
__declspec(dllexport) void TITCALL ThreaderSetCallBackForNextExitThreadEvent(LPVOID exitThreadCallBack);
__declspec(dllexport) bool TITCALL ThreaderIsThreadStillRunning(HANDLE hThread);
__declspec(dllexport) bool TITCALL ThreaderIsThreadActive(HANDLE hThread);
__declspec(dllexport) bool TITCALL ThreaderIsAnyThreadActive();
__declspec(dllexport) bool TITCALL ThreaderExecuteOnlyInjectedThreads();
__declspec(dllexport) ULONG_PTR TITCALL ThreaderGetOpenHandleForThread(DWORD ThreadId);
__declspec(dllexport) bool TITCALL ThreaderIsExceptionInMainThread();
// TitanEngine.Debugger.functions:
__declspec(dllexport) void* TITCALL StaticDisassembleEx(ULONG_PTR DisassmStart, LPVOID DisassmAddress);
__declspec(dllexport) void* TITCALL StaticDisassemble(LPVOID DisassmAddress);
__declspec(dllexport) void* TITCALL DisassembleEx(HANDLE hProcess, LPVOID DisassmAddress, bool ReturnInstructionType);
__declspec(dllexport) void* TITCALL Disassemble(LPVOID DisassmAddress);
__declspec(dllexport) long TITCALL StaticLengthDisassemble(LPVOID DisassmAddress);
__declspec(dllexport) long TITCALL LengthDisassembleEx(HANDLE hProcess, LPVOID DisassmAddress);
__declspec(dllexport) long TITCALL LengthDisassemble(LPVOID DisassmAddress);
__declspec(dllexport) void* TITCALL InitDebug(char* szFileName, char* szCommandLine, char* szCurrentFolder);
__declspec(dllexport) void* TITCALL InitDebugW(const wchar_t* szFileName, const wchar_t* szCommandLine, const wchar_t* szCurrentFolder);
__declspec(dllexport) void* TITCALL InitDebugEx(const char* szFileName, const char* szCommandLine, const char* szCurrentFolder, LPVOID EntryCallBack);
__declspec(dllexport) void* TITCALL InitDebugExW(const wchar_t* szFileName, const wchar_t* szCommandLine, const wchar_t* szCurrentFolder, LPVOID EntryCallBack);
__declspec(dllexport) void* TITCALL InitDLLDebug(const char* szFileName, bool ReserveModuleBase, const char* szCommandLine, const char* szCurrentFolder, LPVOID EntryCallBack);
__declspec(dllexport) void* TITCALL InitDLLDebugW(const wchar_t* szFileName, bool ReserveModuleBase, const wchar_t* szCommandLine, const wchar_t* szCurrentFolder, LPVOID EntryCallBack);
__declspec(dllexport) bool TITCALL StopDebug();
__declspec(dllexport) void TITCALL SetBPXOptions(long DefaultBreakPointType);
__declspec(dllexport) bool TITCALL IsBPXEnabled(ULONG_PTR bpxAddress);
__declspec(dllexport) bool TITCALL EnableBPX(ULONG_PTR bpxAddress);
__declspec(dllexport) bool TITCALL DisableBPX(ULONG_PTR bpxAddress);
__declspec(dllexport) bool TITCALL SetBPX(ULONG_PTR bpxAddress, DWORD bpxType, LPVOID bpxCallBack);
__declspec(dllexport) bool TITCALL DeleteBPX(ULONG_PTR bpxAddress);
__declspec(dllexport) bool TITCALL SafeDeleteBPX(ULONG_PTR bpxAddress);
__declspec(dllexport) bool TITCALL SetAPIBreakPoint(const char* szDLLName, const char* szAPIName, DWORD bpxType, DWORD bpxPlace, LPVOID bpxCallBack);
__declspec(dllexport) bool TITCALL DeleteAPIBreakPoint(const char* szDLLName, const char* szAPIName, DWORD bpxPlace);
__declspec(dllexport) bool TITCALL SafeDeleteAPIBreakPoint(const char* szDLLName, const char* szAPIName, DWORD bpxPlace);
__declspec(dllexport) bool TITCALL SetMemoryBPX(ULONG_PTR MemoryStart, SIZE_T SizeOfMemory, LPVOID bpxCallBack);
__declspec(dllexport) bool TITCALL SetMemoryBPXEx(ULONG_PTR MemoryStart, SIZE_T SizeOfMemory, DWORD BreakPointType, bool RestoreOnHit, LPVOID bpxCallBack);
__declspec(dllexport) bool TITCALL RemoveMemoryBPX(ULONG_PTR MemoryStart, SIZE_T SizeOfMemory);
__declspec(dllexport) bool TITCALL GetContextFPUDataEx(HANDLE hActiveThread, void* FPUSaveArea);
__declspec(dllexport) void TITCALL Getx87FPURegisters(x87FPURegister_t x87FPURegisters[8], TITAN_ENGINE_CONTEXT_t* titcontext);
__declspec(dllexport) void TITCALL GetMMXRegisters(uint64_t mmx[8], TITAN_ENGINE_CONTEXT_t* titcontext);
__declspec(dllexport) bool TITCALL GetFullContextDataEx(HANDLE hActiveThread, TITAN_ENGINE_CONTEXT_t* titcontext);
__declspec(dllexport) bool TITCALL SetFullContextDataEx(HANDLE hActiveThread, TITAN_ENGINE_CONTEXT_t* titcontext);
__declspec(dllexport) ULONG_PTR TITCALL GetContextDataEx(HANDLE hActiveThread, DWORD IndexOfRegister);
__declspec(dllexport) ULONG_PTR TITCALL GetContextData(DWORD IndexOfRegister);
__declspec(dllexport) bool TITCALL SetContextFPUDataEx(HANDLE hActiveThread, void* FPUSaveArea);
__declspec(dllexport) bool TITCALL SetContextDataEx(HANDLE hActiveThread, DWORD IndexOfRegister, ULONG_PTR NewRegisterValue);
__declspec(dllexport) bool TITCALL SetContextData(DWORD IndexOfRegister, ULONG_PTR NewRegisterValue);
__declspec(dllexport) bool TITCALL GetAVXContext(HANDLE hActiveThread, TITAN_ENGINE_CONTEXT_t* titcontext);
__declspec(dllexport) bool TITCALL SetAVXContext(HANDLE hActiveThread, TITAN_ENGINE_CONTEXT_t* titcontext);
__declspec(dllexport) void TITCALL ClearExceptionNumber();
__declspec(dllexport) long TITCALL CurrentExceptionNumber();
__declspec(dllexport) bool TITCALL MatchPatternEx(HANDLE hProcess, void* MemoryToCheck, int SizeOfMemoryToCheck, void* PatternToMatch, int SizeOfPatternToMatch, PBYTE WildCard);
__declspec(dllexport) bool TITCALL MatchPattern(void* MemoryToCheck, int SizeOfMemoryToCheck, void* PatternToMatch, int SizeOfPatternToMatch, PBYTE WildCard);
__declspec(dllexport) ULONG_PTR TITCALL FindEx(HANDLE hProcess, LPVOID MemoryStart, DWORD MemorySize, LPVOID SearchPattern, DWORD PatternSize, LPBYTE WildCard);
extern "C" __declspec(dllexport) ULONG_PTR TITCALL Find(LPVOID MemoryStart, DWORD MemorySize, LPVOID SearchPattern, DWORD PatternSize, LPBYTE WildCard);
__declspec(dllexport) bool TITCALL FillEx(HANDLE hProcess, LPVOID MemoryStart, DWORD MemorySize, PBYTE FillByte);
__declspec(dllexport) bool TITCALL Fill(LPVOID MemoryStart, DWORD MemorySize, PBYTE FillByte);
__declspec(dllexport) bool TITCALL PatchEx(HANDLE hProcess, LPVOID MemoryStart, DWORD MemorySize, LPVOID ReplacePattern, DWORD ReplaceSize, bool AppendNOP, bool PrependNOP);
__declspec(dllexport) bool TITCALL Patch(LPVOID MemoryStart, DWORD MemorySize, LPVOID ReplacePattern, DWORD ReplaceSize, bool AppendNOP, bool PrependNOP);
__declspec(dllexport) bool TITCALL ReplaceEx(HANDLE hProcess, LPVOID MemoryStart, DWORD MemorySize, LPVOID SearchPattern, DWORD PatternSize, DWORD NumberOfRepetitions, LPVOID ReplacePattern, DWORD ReplaceSize, PBYTE WildCard);
__declspec(dllexport) bool TITCALL Replace(LPVOID MemoryStart, DWORD MemorySize, LPVOID SearchPattern, DWORD PatternSize, DWORD NumberOfRepetitions, LPVOID ReplacePattern, DWORD ReplaceSize, PBYTE WildCard);
__declspec(dllexport) void* TITCALL GetDebugData();
__declspec(dllexport) void* TITCALL GetTerminationData();
__declspec(dllexport) long TITCALL GetExitCode();
__declspec(dllexport) ULONG_PTR TITCALL GetDebuggedDLLBaseAddress();
__declspec(dllexport) ULONG_PTR TITCALL GetDebuggedFileBaseAddress();
__declspec(dllexport) bool TITCALL GetRemoteString(HANDLE hProcess, LPVOID StringAddress, LPVOID StringStorage, int MaximumStringSize);
__declspec(dllexport) ULONG_PTR TITCALL GetFunctionParameter(HANDLE hProcess, DWORD FunctionType, DWORD ParameterNumber, DWORD ParameterType);
__declspec(dllexport) ULONG_PTR TITCALL GetJumpDestinationEx(HANDLE hProcess, ULONG_PTR InstructionAddress, bool JustJumps);
__declspec(dllexport) ULONG_PTR TITCALL GetJumpDestination(HANDLE hProcess, ULONG_PTR InstructionAddress);
__declspec(dllexport) bool TITCALL IsJumpGoingToExecuteEx(HANDLE hProcess, HANDLE hThread, ULONG_PTR InstructionAddress, ULONG_PTR RegFlags);
__declspec(dllexport) bool TITCALL IsJumpGoingToExecute();
__declspec(dllexport) void TITCALL SetCustomHandler(DWORD ExceptionId, LPVOID CallBack);
__declspec(dllexport) void TITCALL ForceClose();
__declspec(dllexport) void TITCALL StepInto(LPVOID traceCallBack);
__declspec(dllexport) void TITCALL StepOver(LPVOID traceCallBack);
__declspec(dllexport) void TITCALL StepOut(LPVOID StepOut, bool StepFinal);
__declspec(dllexport) void TITCALL SingleStep(DWORD StepCount, LPVOID StepCallBack);
__declspec(dllexport) bool TITCALL GetUnusedHardwareBreakPointRegister(LPDWORD RegisterIndex);
__declspec(dllexport) bool TITCALL SetHardwareBreakPointEx(HANDLE hActiveThread, ULONG_PTR bpxAddress, DWORD IndexOfRegister, DWORD bpxType, DWORD bpxSize, LPVOID bpxCallBack, LPDWORD IndexOfSelectedRegister);
__declspec(dllexport) bool TITCALL SetHardwareBreakPoint(ULONG_PTR bpxAddress, DWORD IndexOfRegister, DWORD bpxType, DWORD bpxSize, LPVOID bpxCallBack);
__declspec(dllexport) bool TITCALL DeleteHardwareBreakPoint(DWORD IndexOfRegister);
__declspec(dllexport) bool TITCALL RemoveAllBreakPoints(DWORD RemoveOption);
__declspec(dllexport) PROCESS_INFORMATION* TITCALL TitanGetProcessInformation();
__declspec(dllexport) STARTUPINFOW* TITCALL TitanGetStartupInformation();
__declspec(dllexport) void TITCALL DebugLoop();
__declspec(dllexport) void TITCALL SetDebugLoopTimeOut(DWORD TimeOut);
__declspec(dllexport) void TITCALL SetNextDbgContinueStatus(DWORD SetDbgCode);
__declspec(dllexport) bool TITCALL AttachDebugger(DWORD ProcessId, bool KillOnExit, LPVOID DebugInfo, LPVOID CallBack);
__declspec(dllexport) bool TITCALL DetachDebugger(DWORD ProcessId);
__declspec(dllexport) bool TITCALL DetachDebuggerEx(DWORD ProcessId);
__declspec(dllexport) void TITCALL DebugLoopEx(DWORD TimeOut);
__declspec(dllexport) void TITCALL AutoDebugEx(const char* szFileName, bool ReserveModuleBase, const char* szCommandLine, const char* szCurrentFolder, DWORD TimeOut, LPVOID EntryCallBack);
__declspec(dllexport) void TITCALL AutoDebugExW(const wchar_t* szFileName, bool ReserveModuleBase, const wchar_t* szCommandLine, const wchar_t* szCurrentFolder, DWORD TimeOut, LPVOID EntryCallBack);
__declspec(dllexport) bool TITCALL IsFileBeingDebugged();
__declspec(dllexport) void TITCALL SetErrorModel(bool DisplayErrorMessages);
// TitanEngine.FindOEP.functions:
__declspec(dllexport) void TITCALL FindOEPInit();
__declspec(dllexport) bool TITCALL FindOEPGenerically(const char* szFileName, LPVOID TraceInitCallBack, LPVOID CallBack);
__declspec(dllexport) bool TITCALL FindOEPGenericallyW(const wchar_t* szFileName, LPVOID TraceInitCallBack, LPVOID CallBack);
// TitanEngine.Importer.functions:
__declspec(dllexport) void TITCALL ImporterAddNewDll(const char* szDLLName, ULONG_PTR FirstThunk);
__declspec(dllexport) void TITCALL ImporterAddNewAPI(const char* szAPIName, ULONG_PTR ThunkValue);
__declspec(dllexport) void TITCALL ImporterAddNewOrdinalAPI(ULONG_PTR OrdinalNumber, ULONG_PTR ThunkValue);
__declspec(dllexport) long TITCALL ImporterGetAddedDllCount();
__declspec(dllexport) long TITCALL ImporterGetAddedAPICount();
__declspec(dllexport) bool TITCALL ImporterExportIAT(ULONG_PTR StorePlace, ULONG_PTR FileMapVA, HANDLE hFileMap);
__declspec(dllexport) long TITCALL ImporterEstimatedSize();
__declspec(dllexport) bool TITCALL ImporterExportIATEx(const char* szDumpFileName, const char* szExportFileName, const char* szSectionName);
__declspec(dllexport) bool TITCALL ImporterExportIATExW(const wchar_t* szDumpFileName, const wchar_t* szExportFileName, const wchar_t* szSectionName = L".RL!TEv2");
__declspec(dllexport) ULONG_PTR TITCALL ImporterFindAPIWriteLocation(const char* szAPIName);
__declspec(dllexport) ULONG_PTR TITCALL ImporterFindOrdinalAPIWriteLocation(ULONG_PTR OrdinalNumber);
__declspec(dllexport) ULONG_PTR TITCALL ImporterFindAPIByWriteLocation(ULONG_PTR APIWriteLocation);
__declspec(dllexport) ULONG_PTR TITCALL ImporterFindDLLByWriteLocation(ULONG_PTR APIWriteLocation);
__declspec(dllexport) void* TITCALL ImporterGetDLLName(ULONG_PTR APIAddress);
__declspec(dllexport) void* TITCALL ImporterGetDLLNameW(ULONG_PTR APIAddress);
__declspec(dllexport) void* TITCALL ImporterGetAPIName(ULONG_PTR APIAddress);
__declspec(dllexport) ULONG_PTR TITCALL ImporterGetAPIOrdinalNumber(ULONG_PTR APIAddress);
__declspec(dllexport) void* TITCALL ImporterGetAPINameEx(ULONG_PTR APIAddress, ULONG_PTR DLLBasesList);
__declspec(dllexport) ULONG_PTR TITCALL ImporterGetRemoteAPIAddress(HANDLE hProcess, ULONG_PTR APIAddress);
__declspec(dllexport) ULONG_PTR TITCALL ImporterGetRemoteAPIAddressEx(const char* szDLLName, const char* szAPIName);
__declspec(dllexport) ULONG_PTR TITCALL ImporterGetLocalAPIAddress(HANDLE hProcess, ULONG_PTR APIAddress);
__declspec(dllexport) void* TITCALL ImporterGetDLLNameFromDebugee(HANDLE hProcess, ULONG_PTR APIAddress);
__declspec(dllexport) void* TITCALL ImporterGetDLLNameFromDebugeeW(HANDLE hProcess, ULONG_PTR APIAddress);
__declspec(dllexport) void* TITCALL ImporterGetAPINameFromDebugee(HANDLE hProcess, ULONG_PTR APIAddress);
__declspec(dllexport) ULONG_PTR TITCALL ImporterGetAPIOrdinalNumberFromDebugee(HANDLE hProcess, ULONG_PTR APIAddress);
__declspec(dllexport) long TITCALL ImporterGetDLLIndexEx(ULONG_PTR APIAddress, ULONG_PTR DLLBasesList);
__declspec(dllexport) long TITCALL ImporterGetDLLIndex(HANDLE hProcess, ULONG_PTR APIAddress, ULONG_PTR DLLBasesList);
__declspec(dllexport) ULONG_PTR TITCALL ImporterGetRemoteDLLBase(HANDLE hProcess, HMODULE LocalModuleBase);
__declspec(dllexport) ULONG_PTR TITCALL ImporterGetRemoteDLLBaseEx(HANDLE hProcess, const char* szModuleName);
__declspec(dllexport) void* TITCALL ImporterGetRemoteDLLBaseExW(HANDLE hProcess, const wchar_t* szModuleName);
__declspec(dllexport) bool TITCALL ImporterIsForwardedAPI(HANDLE hProcess, ULONG_PTR APIAddress);
__declspec(dllexport) void* TITCALL ImporterGetForwardedAPIName(HANDLE hProcess, ULONG_PTR APIAddress);
__declspec(dllexport) void* TITCALL ImporterGetForwardedDLLName(HANDLE hProcess, ULONG_PTR APIAddress);
__declspec(dllexport) long TITCALL ImporterGetForwardedDLLIndex(HANDLE hProcess, ULONG_PTR APIAddress, ULONG_PTR DLLBasesList);
__declspec(dllexport) ULONG_PTR TITCALL ImporterGetForwardedAPIOrdinalNumber(HANDLE hProcess, ULONG_PTR APIAddress);
__declspec(dllexport) ULONG_PTR TITCALL ImporterGetNearestAPIAddress(HANDLE hProcess, ULONG_PTR APIAddress);
__declspec(dllexport) void* TITCALL ImporterGetNearestAPIName(HANDLE hProcess, ULONG_PTR APIAddress);
__declspec(dllexport) bool TITCALL ImporterCopyOriginalIAT(const char* szOriginalFile, const char* szDumpFile);
__declspec(dllexport) bool TITCALL ImporterCopyOriginalIATW(const wchar_t* szOriginalFile, const wchar_t* szDumpFile);
__declspec(dllexport) bool TITCALL ImporterLoadImportTable(const char* szFileName);
__declspec(dllexport) bool TITCALL ImporterLoadImportTableW(const wchar_t* szFileName);
__declspec(dllexport) bool TITCALL ImporterMoveOriginalIAT(const char* szOriginalFile, const char* szDumpFile, const char* szSectionName);
__declspec(dllexport) bool TITCALL ImporterMoveOriginalIATW(const wchar_t* szOriginalFile, const wchar_t* szDumpFile, const char* szSectionName);
__declspec(dllexport) void TITCALL ImporterAutoSearchIAT(DWORD ProcessId, const char* szFileName, ULONG_PTR SearchStart, LPVOID pIATStart, LPVOID pIATSize);
__declspec(dllexport) void TITCALL ImporterAutoSearchIATW(DWORD ProcessIds, const wchar_t* szFileName, ULONG_PTR SearchStart, LPVOID pIATStart, LPVOID pIATSize);
__declspec(dllexport) void TITCALL ImporterAutoSearchIATEx(DWORD ProcessId, ULONG_PTR ImageBase, ULONG_PTR SearchStart, LPVOID pIATStart, LPVOID pIATSize);
__declspec(dllexport) void TITCALL ImporterEnumAddedData(LPVOID EnumCallBack);
__declspec(dllexport) long TITCALL ImporterAutoFixIATEx(DWORD ProcessId, const char* szDumpedFile, const char* szSectionName, bool DumpRunningProcess, bool RealignFile, ULONG_PTR EntryPointAddress, ULONG_PTR ImageBase, ULONG_PTR SearchStart, bool TryAutoFix, bool FixEliminations, LPVOID UnknownPointerFixCallback);
__declspec(dllexport) long TITCALL ImporterAutoFixIATExW(DWORD ProcessId, const wchar_t* szDumpedFile, const wchar_t* szSectionName, bool DumpRunningProcess, bool RealignFile, ULONG_PTR EntryPointAddress, ULONG_PTR ImageBase, ULONG_PTR SearchStart, bool TryAutoFix, bool FixEliminations, LPVOID UnknownPointerFixCallback);
__declspec(dllexport) long TITCALL ImporterAutoFixIAT(DWORD ProcessId, const char* szDumpedFile, ULONG_PTR SearchStart);
__declspec(dllexport) long TITCALL ImporterAutoFixIATW(DWORD ProcessId, const wchar_t* szDumpedFile, ULONG_PTR SearchStart);
__declspec(dllexport) bool TITCALL ImporterDeleteAPI(DWORD_PTR apiAddr);
// Global.Engine.Hook.functions:
__declspec(dllexport) bool TITCALL HooksSafeTransitionEx(LPVOID HookAddressArray, int NumberOfHooks, bool TransitionStart);
__declspec(dllexport) bool TITCALL HooksSafeTransition(LPVOID HookAddress, bool TransitionStart);
__declspec(dllexport) bool TITCALL HooksIsAddressRedirected(LPVOID HookAddress);
__declspec(dllexport) void* TITCALL HooksGetTrampolineAddress(LPVOID HookAddress);
__declspec(dllexport) void* TITCALL HooksGetHookEntryDetails(LPVOID HookAddress);
__declspec(dllexport) bool TITCALL HooksInsertNewRedirection(LPVOID HookAddress, LPVOID RedirectTo, int HookType);
__declspec(dllexport) bool TITCALL HooksInsertNewIATRedirectionEx(ULONG_PTR FileMapVA, ULONG_PTR LoadedModuleBase, const char* szHookFunction, LPVOID RedirectTo);
__declspec(dllexport) bool TITCALL HooksInsertNewIATRedirection(const char* szModuleName, const char* szHookFunction, LPVOID RedirectTo);
__declspec(dllexport) bool TITCALL HooksRemoveRedirection(LPVOID HookAddress, bool RemoveAll);
__declspec(dllexport) bool TITCALL HooksRemoveRedirectionsForModule(HMODULE ModuleBase);
__declspec(dllexport) bool TITCALL HooksRemoveIATRedirection(const char* szModuleName, const char* szHookFunction, bool RemoveAll);
__declspec(dllexport) bool TITCALL HooksDisableRedirection(LPVOID HookAddress, bool DisableAll);
__declspec(dllexport) bool TITCALL HooksDisableRedirectionsForModule(HMODULE ModuleBase);
__declspec(dllexport) bool TITCALL HooksDisableIATRedirection(const char* szModuleName, const char* szHookFunction, bool DisableAll);
__declspec(dllexport) bool TITCALL HooksEnableRedirection(LPVOID HookAddress, bool EnableAll);
__declspec(dllexport) bool TITCALL HooksEnableRedirectionsForModule(HMODULE ModuleBase);
__declspec(dllexport) bool TITCALL HooksEnableIATRedirection(const char* szModuleName, const char* szHookFunction, bool EnableAll);
__declspec(dllexport) void TITCALL HooksScanModuleMemory(HMODULE ModuleBase, LPVOID CallBack);
__declspec(dllexport) void TITCALL HooksScanEntireProcessMemory(LPVOID CallBack);
__declspec(dllexport) void TITCALL HooksScanEntireProcessMemoryEx();
// TitanEngine.Tracer.functions:
__declspec(dllexport) void TITCALL TracerInit();
__declspec(dllexport) ULONG_PTR TITCALL TracerLevel1(HANDLE hProcess, ULONG_PTR AddressToTrace);
__declspec(dllexport) ULONG_PTR TITCALL HashTracerLevel1(HANDLE hProcess, ULONG_PTR AddressToTrace, DWORD InputNumberOfInstructions);
__declspec(dllexport) long TITCALL TracerDetectRedirection(HANDLE hProcess, ULONG_PTR AddressToTrace);
__declspec(dllexport) ULONG_PTR TITCALL TracerFixKnownRedirection(HANDLE hProcess, ULONG_PTR AddressToTrace, DWORD RedirectionId);
__declspec(dllexport) ULONG_PTR TITCALL TracerFixRedirectionViaModule(HMODULE hModuleHandle, HANDLE hProcess, ULONG_PTR AddressToTrace, DWORD IdParameter);
__declspec(dllexport) long TITCALL TracerFixRedirectionViaImpRecPlugin(HANDLE hProcess, const char* szPluginName, ULONG_PTR AddressToTrace);
// TitanEngine.Exporter.functions:
__declspec(dllexport) void TITCALL ExporterCleanup();
__declspec(dllexport) void TITCALL ExporterSetImageBase(ULONG_PTR ImageBase);
__declspec(dllexport) void TITCALL ExporterInit(DWORD MemorySize, ULONG_PTR ImageBase, DWORD ExportOrdinalBase, const char* szExportModuleName);
__declspec(dllexport) bool TITCALL ExporterAddNewExport(const char* szExportName, DWORD ExportRelativeAddress);
__declspec(dllexport) bool TITCALL ExporterAddNewOrdinalExport(DWORD OrdinalNumber, DWORD ExportRelativeAddress);
__declspec(dllexport) long TITCALL ExporterGetAddedExportCount();
__declspec(dllexport) long TITCALL ExporterEstimatedSize();
__declspec(dllexport) bool TITCALL ExporterBuildExportTable(ULONG_PTR StorePlace, ULONG_PTR FileMapVA);
__declspec(dllexport) bool TITCALL ExporterBuildExportTableEx(const char* szExportFileName, const char* szSectionName);
__declspec(dllexport) bool TITCALL ExporterBuildExportTableExW(const wchar_t* szExportFileName, const char* szSectionName);
__declspec(dllexport) bool TITCALL ExporterLoadExportTable(const char* szFileName);
__declspec(dllexport) bool TITCALL ExporterLoadExportTableW(const wchar_t* szFileName);
// TitanEngine.Librarian.functions:
__declspec(dllexport) bool TITCALL LibrarianSetBreakPoint(const char* szLibraryName, DWORD bpxType, bool SingleShoot, LPVOID bpxCallBack);
__declspec(dllexport) bool TITCALL LibrarianRemoveBreakPoint(const char* szLibraryName, DWORD bpxType);
__declspec(dllexport) void* TITCALL LibrarianGetLibraryInfo(const char* szLibraryName);
__declspec(dllexport) void* TITCALL LibrarianGetLibraryInfoW(const wchar_t* szLibraryName);
__declspec(dllexport) void* TITCALL LibrarianGetLibraryInfoEx(void* BaseOfDll);
__declspec(dllexport) void* TITCALL LibrarianGetLibraryInfoExW(void* BaseOfDll);
__declspec(dllexport) void TITCALL LibrarianEnumLibraryInfo(void* EnumCallBack);
__declspec(dllexport) void TITCALL LibrarianEnumLibraryInfoW(void* EnumCallBack);
// TitanEngine.Process.functions:
__declspec(dllexport) long TITCALL GetActiveProcessId(const char* szImageName);
__declspec(dllexport) long TITCALL GetActiveProcessIdW(const wchar_t* szImageName);
__declspec(dllexport) void TITCALL EnumProcessesWithLibrary(const char* szLibraryName, void* EnumFunction);
__declspec(dllexport) HANDLE TITCALL TitanOpenProcess(DWORD dwDesiredAccess, bool bInheritHandle, DWORD dwProcessId);
__declspec(dllexport) HANDLE TITCALL TitanOpenThread(DWORD dwDesiredAccess, bool bInheritHandle, DWORD dwThreadId);
// TitanEngine.TLSFixer.functions:
__declspec(dllexport) bool TITCALL TLSBreakOnCallBack(LPVOID ArrayOfCallBacks, DWORD NumberOfCallBacks, LPVOID bpxCallBack);
__declspec(dllexport) bool TITCALL TLSGrabCallBackData(const char* szFileName, LPVOID ArrayOfCallBacks, LPDWORD NumberOfCallBacks);
__declspec(dllexport) bool TITCALL TLSGrabCallBackDataW(const wchar_t* szFileName, LPVOID ArrayOfCallBacks, LPDWORD NumberOfCallBacks);
__declspec(dllexport) bool TITCALL TLSBreakOnCallBackEx(const char* szFileName, LPVOID bpxCallBack);
__declspec(dllexport) bool TITCALL TLSBreakOnCallBackExW(const wchar_t* szFileName, LPVOID bpxCallBack);
__declspec(dllexport) bool TITCALL TLSRemoveCallback(const char* szFileName);
__declspec(dllexport) bool TITCALL TLSRemoveCallbackW(const wchar_t* szFileName);
__declspec(dllexport) bool TITCALL TLSRemoveTable(const char* szFileName);
__declspec(dllexport) bool TITCALL TLSRemoveTableW(const wchar_t* szFileName);
__declspec(dllexport) bool TITCALL TLSBackupData(const char* szFileName);
__declspec(dllexport) bool TITCALL TLSBackupDataW(const wchar_t* szFileName);
__declspec(dllexport) bool TITCALL TLSRestoreData();
__declspec(dllexport) bool TITCALL TLSBuildNewTable(ULONG_PTR FileMapVA, ULONG_PTR StorePlace, ULONG_PTR StorePlaceRVA, LPVOID ArrayOfCallBacks, DWORD NumberOfCallBacks);
__declspec(dllexport) bool TITCALL TLSBuildNewTableEx(const char* szFileName, const char* szSectionName, LPVOID ArrayOfCallBacks, DWORD NumberOfCallBacks);
__declspec(dllexport) bool TITCALL TLSBuildNewTableExW(const wchar_t* szFileName, const char* szSectionName, LPVOID ArrayOfCallBacks, DWORD NumberOfCallBacks);
// TitanEngine.TranslateName.functions:
__declspec(dllexport) void* TITCALL TranslateNativeName(const char* szNativeName);
__declspec(dllexport) void* TITCALL TranslateNativeNameW(const wchar_t* szNativeName);
// TitanEngine.Handler.functions:
__declspec(dllexport) long TITCALL HandlerGetActiveHandleCount(DWORD ProcessId);
__declspec(dllexport) bool TITCALL HandlerIsHandleOpen(DWORD ProcessId, HANDLE hHandle);
__declspec(dllexport) void* TITCALL HandlerGetHandleName(HANDLE hProcess, DWORD ProcessId, HANDLE hHandle, bool TranslateName);
__declspec(dllexport) void* TITCALL HandlerGetHandleNameW(HANDLE hProcess, DWORD ProcessId, HANDLE hHandle, bool TranslateName);
__declspec(dllexport) long TITCALL HandlerEnumerateOpenHandles(DWORD ProcessId, LPVOID HandleBuffer, DWORD MaxHandleCount);
__declspec(dllexport) ULONG_PTR TITCALL HandlerGetHandleDetails(HANDLE hProcess, DWORD ProcessId, HANDLE hHandle, DWORD InformationReturn);
__declspec(dllexport) bool TITCALL HandlerCloseRemoteHandle(HANDLE hProcess, HANDLE hHandle);
__declspec(dllexport) long TITCALL HandlerEnumerateLockHandles(char* szFileOrFolderName, bool NameIsFolder, bool NameIsTranslated, LPVOID HandleDataBuffer, DWORD MaxHandleCount);
__declspec(dllexport) long TITCALL HandlerEnumerateLockHandlesW(const wchar_t* szFileOrFolderName, bool NameIsFolder, bool NameIsTranslated, LPVOID HandleDataBuffer, DWORD MaxHandleCount);
__declspec(dllexport) bool TITCALL HandlerCloseAllLockHandles(const char* szFileOrFolderName, bool NameIsFolder, bool NameIsTranslated);
__declspec(dllexport) bool TITCALL HandlerCloseAllLockHandlesW(const wchar_t* szFileOrFolderName, bool NameIsFolder, bool NameIsTranslated);
__declspec(dllexport) bool TITCALL HandlerIsFileLocked(const char* szFileOrFolderName, bool NameIsFolder, bool NameIsTranslated);
__declspec(dllexport) bool TITCALL HandlerIsFileLockedW(const wchar_t* szFileOrFolderName, bool NameIsFolder, bool NameIsTranslated);
// TitanEngine.Handler[Mutex].functions:
__declspec(dllexport) long TITCALL HandlerEnumerateOpenMutexes(HANDLE hProcess, DWORD ProcessId, LPVOID HandleBuffer, DWORD MaxHandleCount);
__declspec(dllexport) ULONG_PTR TITCALL HandlerGetOpenMutexHandle(HANDLE hProcess, DWORD ProcessId, const char* szMutexString);
__declspec(dllexport) ULONG_PTR TITCALL HandlerGetOpenMutexHandleW(HANDLE hProcess, DWORD ProcessId, const wchar_t* szMutexString);
__declspec(dllexport) long TITCALL HandlerGetProcessIdWhichCreatedMutex(const char* szMutexString);
__declspec(dllexport) long TITCALL HandlerGetProcessIdWhichCreatedMutexW(const wchar_t* szMutexString);
// TitanEngine.Injector.functions:
__declspec(dllexport) bool TITCALL RemoteLoadLibrary(HANDLE hProcess, const char* szLibraryFile, bool WaitForThreadExit);
__declspec(dllexport) bool TITCALL RemoteLoadLibraryW(HANDLE hProcess, const wchar_t* szLibraryFile, bool WaitForThreadExit);
__declspec(dllexport) bool TITCALL RemoteFreeLibrary(HANDLE hProcess, HMODULE hModule, const char* szLibraryFile, bool WaitForThreadExit);
__declspec(dllexport) bool TITCALL RemoteFreeLibraryW(HANDLE hProcess, HMODULE hModule, const wchar_t* szLibraryFile, bool WaitForThreadExit);
__declspec(dllexport) bool TITCALL RemoteExitProcess(HANDLE hProcess, DWORD ExitCode);
// TitanEngine.StaticUnpacker.functions:
__declspec(dllexport) bool TITCALL StaticFileLoad(const char* szFileName, DWORD DesiredAccess, bool SimulateLoad, LPHANDLE FileHandle, LPDWORD LoadedSize, LPHANDLE FileMap, PULONG_PTR FileMapVA);
__declspec(dllexport) bool TITCALL StaticFileLoadW(const wchar_t* szFileName, DWORD DesiredAccess, bool SimulateLoad, LPHANDLE FileHandle, LPDWORD LoadedSize, LPHANDLE FileMap, PULONG_PTR FileMapVA);
__declspec(dllexport) bool TITCALL StaticFileUnload(const char* szFileName, bool CommitChanges, HANDLE FileHandle, DWORD LoadedSize, HANDLE FileMap, ULONG_PTR FileMapVA);
__declspec(dllexport) bool TITCALL StaticFileUnloadW(const wchar_t* szFileName, bool CommitChanges, HANDLE FileHandle, DWORD LoadedSize, HANDLE FileMap, ULONG_PTR FileMapVA);
__declspec(dllexport) bool TITCALL StaticFileOpen(const char* szFileName, DWORD DesiredAccess, LPHANDLE FileHandle, LPDWORD FileSizeLow, LPDWORD FileSizeHigh);
__declspec(dllexport) bool TITCALL StaticFileOpenW(const wchar_t* szFileName, DWORD DesiredAccess, LPHANDLE FileHandle, LPDWORD FileSizeLow, LPDWORD FileSizeHigh);
__declspec(dllexport) bool TITCALL StaticFileGetContent(HANDLE FileHandle, DWORD FilePositionLow, LPDWORD FilePositionHigh, void* Buffer, DWORD Size);
__declspec(dllexport) void TITCALL StaticFileClose(HANDLE FileHandle);
__declspec(dllexport) void TITCALL StaticMemoryDecrypt(LPVOID MemoryStart, DWORD MemorySize, DWORD DecryptionType, DWORD DecryptionKeySize, ULONG_PTR DecryptionKey);
__declspec(dllexport) void TITCALL StaticMemoryDecryptEx(LPVOID MemoryStart, DWORD MemorySize, DWORD DecryptionKeySize, void* DecryptionCallBack);
__declspec(dllexport) void TITCALL StaticMemoryDecryptSpecial(LPVOID MemoryStart, DWORD MemorySize, DWORD DecryptionKeySize, DWORD SpecDecryptionType, void* DecryptionCallBack);
__declspec(dllexport) void TITCALL StaticSectionDecrypt(ULONG_PTR FileMapVA, DWORD SectionNumber, bool SimulateLoad, DWORD DecryptionType, DWORD DecryptionKeySize, ULONG_PTR DecryptionKey);
__declspec(dllexport) bool TITCALL StaticMemoryDecompress(void* Source, DWORD SourceSize, void* Destination, DWORD DestinationSize, int Algorithm);
__declspec(dllexport) bool TITCALL StaticRawMemoryCopy(HANDLE hFile, ULONG_PTR FileMapVA, ULONG_PTR VitualAddressToCopy, DWORD Size, bool AddressIsRVA, const char* szDumpFileName);
__declspec(dllexport) bool TITCALL StaticRawMemoryCopyW(HANDLE hFile, ULONG_PTR FileMapVA, ULONG_PTR VitualAddressToCopy, DWORD Size, bool AddressIsRVA, const wchar_t* szDumpFileName);
__declspec(dllexport) bool TITCALL StaticRawMemoryCopyEx(HANDLE hFile, DWORD RawAddressToCopy, DWORD Size, const char* szDumpFileName);
__declspec(dllexport) bool TITCALL StaticRawMemoryCopyExW(HANDLE hFile, DWORD RawAddressToCopy, DWORD Size, const wchar_t* szDumpFileName);
__declspec(dllexport) bool TITCALL StaticRawMemoryCopyEx64(HANDLE hFile, DWORD64 RawAddressToCopy, DWORD64 Size, const char* szDumpFileName);
__declspec(dllexport) bool TITCALL StaticRawMemoryCopyEx64W(HANDLE hFile, DWORD64 RawAddressToCopy, DWORD64 Size, const wchar_t* szDumpFileName);
__declspec(dllexport) bool TITCALL StaticHashMemory(void* MemoryToHash, DWORD SizeOfMemory, void* HashDigest, bool OutputString, int Algorithm);
__declspec(dllexport) bool TITCALL StaticHashFileW(const wchar_t* szFileName, char* HashDigest, bool OutputString, int Algorithm);
__declspec(dllexport) bool TITCALL StaticHashFile(const char* szFileName, char* HashDigest, bool OutputString, int Algorithm);
// TitanEngine.Engine.functions:
__declspec(dllexport) void TITCALL EngineUnpackerInitialize(const char* szFileName, const char* szUnpackedFileName, bool DoLogData, bool DoRealignFile, bool DoMoveOverlay, void* EntryCallBack);
__declspec(dllexport) void TITCALL EngineUnpackerInitializeW(const wchar_t* szFileName, const wchar_t* szUnpackedFileName, bool DoLogData, bool DoRealignFile, bool DoMoveOverlay, void* EntryCallBack);
__declspec(dllexport) bool TITCALL EngineUnpackerSetBreakCondition(void* SearchStart, DWORD SearchSize, void* SearchPattern, DWORD PatternSize, DWORD PatternDelta, ULONG_PTR BreakType, bool SingleBreak, DWORD Parameter1, DWORD Parameter2);
__declspec(dllexport) void TITCALL EngineUnpackerSetEntryPointAddress(ULONG_PTR UnpackedEntryPointAddress);
__declspec(dllexport) void TITCALL EngineUnpackerFinalizeUnpacking();
// TitanEngine.Engine.functions:
__declspec(dllexport) void TITCALL SetEngineVariable(DWORD VariableId, bool VariableSet);
__declspec(dllexport) bool TITCALL EngineCreateMissingDependencies(const char* szFileName, const char* szOutputFolder, bool LogCreatedFiles);
__declspec(dllexport) bool TITCALL EngineCreateMissingDependenciesW(const wchar_t* szFileName, const wchar_t* szOutputFolder, bool LogCreatedFiles);
__declspec(dllexport) bool TITCALL EngineFakeMissingDependencies(HANDLE hProcess);
__declspec(dllexport) bool TITCALL EngineDeleteCreatedDependencies();
__declspec(dllexport) bool TITCALL EngineCreateUnpackerWindow(const char* WindowUnpackerTitle, const char* WindowUnpackerLongTitle, const char* WindowUnpackerName, const char* WindowUnpackerAuthor, void* StartUnpackingCallBack);
__declspec(dllexport) void TITCALL EngineAddUnpackerWindowLogMessage(const char* szLogMessage);
__declspec(dllexport) bool TITCALL EngineCheckStructAlignment(DWORD StructureType, ULONG_PTR StructureSize);
// Global.Engine.Extension.Functions:
__declspec(dllexport) bool TITCALL ExtensionManagerIsPluginLoaded(const char* szPluginName);
__declspec(dllexport) bool TITCALL ExtensionManagerIsPluginEnabled(const char* szPluginName);
__declspec(dllexport) bool TITCALL ExtensionManagerDisableAllPlugins();
__declspec(dllexport) bool TITCALL ExtensionManagerDisablePlugin(const char* szPluginName);
__declspec(dllexport) bool TITCALL ExtensionManagerEnableAllPlugins();
__declspec(dllexport) bool TITCALL ExtensionManagerEnablePlugin(const char* szPluginName);
__declspec(dllexport) bool TITCALL ExtensionManagerUnloadAllPlugins();
__declspec(dllexport) bool TITCALL ExtensionManagerUnloadPlugin(const char* szPluginName);
__declspec(dllexport) void* TITCALL ExtensionManagerGetPluginInfo(const char* szPluginName);
#ifdef __cplusplus
}
#endif
#pragma pack(pop)
#endif /*TITANENGINE*/
================================================
FILE: x64dbgApiBreak/src/incl/pluginsdk/XEDParse/XEDParse.h
================================================
#ifndef _XEDPARSE_H
#define _XEDPARSE_H
#include <windows.h>
//XEDParse defines
#ifdef XEDPARSE_BUILD
#define XEDPARSE_EXPORT __declspec(dllexport)
#else
#define XEDPARSE_EXPORT __declspec(dllimport)
#endif //XEDPARSE_BUILD
#define XEDPARSE_CALL //calling convention
#define XEDPARSE_MAXBUFSIZE 256
#define XEDPARSE_MAXASMSIZE 16
//typedefs
typedef bool (XEDPARSE_CALL* CBXEDPARSE_UNKNOWN)(const char* text, ULONGLONG* value);
//XEDParse enums
enum XEDPARSE_STATUS
{
XEDPARSE_ERROR = 0,
XEDPARSE_OK = 1
};
//XEDParse structs
#pragma pack(push,8)
struct XEDPARSE
{
bool x64; // use 64-bit instructions
ULONGLONG cip; //instruction pointer (for relative addressing)
unsigned int dest_size; //destination size (returned by XEDParse)
CBXEDPARSE_UNKNOWN cbUnknown; //unknown operand callback
unsigned char dest[XEDPARSE_MAXASMSIZE]; //destination buffer
char instr[XEDPARSE_MAXBUFSIZE]; //instruction text
char error[XEDPARSE_MAXBUFSIZE]; //error text (in case of an error)
};
#pragma pack(pop)
#ifdef __cplusplus
extern "C"
{
#endif
XEDPARSE_EXPORT XEDPARSE_STATUS XEDPARSE_CALL XEDParseAssemble(XEDPARSE* XEDParse);
#ifdef __cplusplus
}
#endif
#endif // _XEDPARSE_H
================================================
FILE: x64dbgApiBreak/src/incl/pluginsdk/_dbgfunctions.h
================================================
#ifndef _DBGFUNCTIONS_H
#define _DBGFUNCTIONS_H
#ifndef __cplusplus
#include <stdbool.h>
#endif
typedef struct
{
char mod[MAX_MODULE_SIZE];
duint addr;
unsigned char oldbyte;
unsigned char newbyte;
} DBGPATCHINFO;
typedef struct
{
duint addr;
duint from;
duint to;
char comment[MAX_COMMENT_SIZE];
} DBGCALLSTACKENTRY;
typedef struct
{
int total;
DBGCALLSTACKENTRY* entries;
} DBGCALLSTACK;
typedef struct
{
duint addr;
duint handler;
} DBGSEHRECORD;
typedef struct
{
duint total;
DBGSEHRECORD* records;
} DBGSEHCHAIN;
typedef struct
{
DWORD dwProcessId;
char szExeFile[MAX_PATH];
char szExeMainWindowTitle[MAX_PATH];
char szExeArgs[MAX_COMMAND_LINE_SIZE];
} DBGPROCESSINFO;
typedef struct
{
DWORD rva;
BYTE type;
WORD size;
} DBGRELOCATIONINFO;
typedef enum
{
InstructionBody = 0,
InstructionHeading = 1,
InstructionTailing = 2,
InstructionOverlapped = 3, // The byte was executed with differing instruction base addresses
DataByte, // This and the following is not implemented yet.
DataWord,
DataDWord,
DataQWord,
DataFloat,
DataDouble,
DataLongDouble,
DataXMM,
DataYMM,
DataMMX,
DataMixed, //the byte is accessed in multiple ways
InstructionDataMixed //the byte is both executed and written
} TRACERECORDBYTETYPE;
typedef enum
{
TraceRecordNone,
TraceRecordBitExec,
TraceRecordByteWithExecTypeAndCounter,
TraceRecordWordWithExecTypeAndCounter
} TRACERECORDTYPE;
typedef struct
{
duint Handle;
unsigned char TypeNumber;
unsigned int GrantedAccess;
} HANDLEINFO;
// The longest ip address is 1234:6789:1234:6789:1234:6789:123.567.901.345 (46 bytes)
#define TCP_ADDR_SIZE 50
typedef struct
{
char RemoteAddress[TCP_ADDR_SIZE];
unsigned short RemotePort;
char LocalAddress[TCP_ADDR_SIZE];
unsigned short LocalPort;
char StateText[TCP_ADDR_SIZE];
unsigned int State;
} TCPCONNECTIONINFO;
typedef struct
{
duint handle;
duint parent;
DWORD threadId;
DWORD style;
DWORD styleEx;
duint wndProc;
bool enabled;
RECT position;
char windowTitle[MAX_COMMENT_SIZE];
char windowClass[MAX_COMMENT_SIZE];
} WINDOW_INFO;
typedef struct
{
duint addr;
duint size;
duint flags;
} HEAPINFO;
typedef struct
{
const char* name;
duint value;
} CONSTANTINFO;
typedef bool (*ASSEMBLEATEX)(duint addr, const char* instruction, char* error, bool fillnop);
typedef bool (*SECTIONFROMADDR)(duint addr, char* section);
typedef bool (*MODNAMEFROMADDR)(duint addr, char* modname, bool extension);
typedef duint(*MODBASEFROMADDR)(duint addr);
typedef duint(*MODBASEFROMNAME)(const char* modname);
typedef duint(*MODSIZEFROMADDR)(duint addr);
typedef bool (*ASSEMBLE)(duint addr, unsigned char* dest, int* size, const char* instruction, char* error);
typedef bool (*PATCHGET)(duint addr);
typedef bool (*PATCHINRANGE)(duint start, duint end);
typedef bool (*MEMPATCH)(duint va, const unsigned char* src, duint size);
typedef void (*PATCHRESTORERANGE)(duint start, duint end);
typedef bool (*PATCHENUM)(DBGPATCHINFO* patchlist, size_t* cbsize);
typedef bool (*PATCHRESTORE)(duint addr);
typedef int (*PATCHFILE)(DBGPATCHINFO* patchlist, int count, const char* szFileName, char* error);
typedef int (*MODPATHFROMADDR)(duint addr, char* path, int size);
typedef int (*MODPATHFROMNAME)(const char* modname, char* path, int size);
typedef bool (*DISASMFAST)(const unsigned char* data, duint addr, BASIC_INSTRUCTION_INFO* basicinfo);
typedef void (*MEMUPDATEMAP)();
typedef void (*GETCALLSTACK)(DBGCALLSTACK* callstack);
typedef void (*GETSEHCHAIN)(DBGSEHCHAIN* sehchain);
typedef void (*SYMBOLDOWNLOADALLSYMBOLS)(const char* szSymbolStore);
typedef bool (*GETJIT)(char* jit, bool x64);
typedef bool (*GETJITAUTO)(bool* jitauto);
typedef bool (*GETDEFJIT)(char* defjit);
typedef bool (*GETPROCESSLIST)(DBGPROCESSINFO** entries, int* count);
typedef bool (*GETPAGERIGHTS)(duint addr, char* rights);
typedef bool (*SETPAGERIGHTS)(duint addr, const char* rights);
typedef bool (*PAGERIGHTSTOSTRING)(DWORD protect, char* rights);
typedef bool (*ISPROCESSELEVATED)();
typedef bool (*GETCMDLINE)(char* cmdline, size_t* cbsize);
typedef bool (*SETCMDLINE)(const char* cmdline);
typedef duint(*FILEOFFSETTOVA)(const char* modname, duint offset);
typedef duint(*VATOFILEOFFSET)(duint va);
typedef duint(*GETADDRFROMLINE)(const char* szSourceFile, int line, duint* displacement);
typedef bool (*GETSOURCEFROMADDR)(duint addr, char* szSourceFile, int* line);
typedef bool (*VALFROMSTRING)(const char* string, duint* value);
typedef bool (*PATCHGETEX)(duint addr, DBGPATCHINFO* info);
typedef bool (*GETBRIDGEBP)(BPXTYPE type, duint addr, BRIDGEBP* bp);
typedef bool (*STRINGFORMATINLINE)(const char* format, size_t resultSize, char* result);
typedef void (*GETMNEMONICBRIEF)(const char* mnem, size_t resultSize, char* result);
typedef unsigned int (*GETTRACERECORDHITCOUNT)(duint address);
typedef TRACERECORDBYTETYPE(*GETTRACERECORDBYTETYPE)(duint address);
typedef bool (*SETTRACERECORDTYPE)(duint pageAddress, TRACERECORDTYPE type);
typedef TRACERECORDTYPE(*GETTRACERECORDTYPE)(duint pageAddress);
typedef bool (*ENUMHANDLES)(ListOf(HANDLEINFO) handles);
typedef bool (*GETHANDLENAME)(duint handle, char* name, size_t nameSize, char* typeName, size_t typeNameSize);
typedef bool (*ENUMTCPCONNECTIONS)(ListOf(TCPCONNECTIONINFO) connections);
typedef duint(*GETDBGEVENTS)();
typedef int (*MODGETPARTY)(duint base);
typedef void (*MODSETPARTY)(duint base, int party);
typedef bool(*WATCHISWATCHDOGTRIGGERED)(unsigned int id);
typedef bool(*MEMISCODEPAGE)(duint addr, bool refresh);
typedef bool(*ANIMATECOMMAND)(const char* command);
typedef void(*DBGSETDEBUGGEEINITSCRIPT)(const char* fileName);
typedef const char* (*DBGGETDEBUGGEEINITSCRIPT)();
typedef bool(*HANDLESENUMWINDOWS)(ListOf(WINDOW_INFO) windows);
typedef bool(*HANDLESENUMHEAPS)(ListOf(HEAPINFO) heaps);
typedef bool(*THREADGETNAME)(DWORD tid, char* name);
typedef bool(*ISDEPENABLED)();
typedef void(*GETCALLSTACKEX)(DBGCALLSTACK* callstack, bool cache);
typedef bool(*GETUSERCOMMENT)(duint addr, char* comment);
typedef void(*ENUMCONSTANTS)(ListOf(CONSTANTINFO) constants);
typedef duint(*MEMBPSIZE)(duint addr);
typedef bool(*MODRELOCATIONSFROMADDR)(duint addr, ListOf(DBGRELOCATIONINFO) relocations);
typedef bool(*MODRELOCATIONATADDR)(duint addr, DBGRELOCATIONINFO* relocation);
typedef bool(*MODRELOCATIONSINRANGE)(duint addr, duint size, ListOf(DBGRELOCATIONINFO) relocations);
typedef duint(*DBGETHASH)();
typedef int(*SYMAUTOCOMPLETE)(const char* Search, char** Buffer, int MaxSymbols);
//The list of all the DbgFunctions() return value.
//WARNING: This list is append only. Do not insert things in the middle or plugins would break.
typedef struct DBGFUNCTIONS_
{
ASSEMBLEATEX AssembleAtEx;
SECTIONFROMADDR SectionFromAddr;
MODNAMEFROMADDR ModNameFromAddr;
MODBASEFROMADDR ModBaseFromAddr;
MODBASEFROMNAME ModBaseFromName;
MODSIZEFROMADDR ModSizeFromAddr;
ASSEMBLE Assemble;
PATCHGET PatchGet;
PATCHINRANGE PatchInRange;
MEMPATCH MemPatch;
PATCHRESTORERANGE PatchRestoreRange;
PATCHENUM PatchEnum;
PATCHRESTORE PatchRestore;
PATCHFILE PatchFile;
MODPATHFROMADDR ModPathFromAddr;
MODPATHFROMNAME ModPathFromName;
DISASMFAST DisasmFast;
MEMUPDATEMAP MemUpdateMap;
GETCALLSTACK GetCallStack;
GETSEHCHAIN GetSEHChain;
SYMBOLDOWNLOADALLSYMBOLS SymbolDownloadAllSymbols;
GETJITAUTO GetJitAuto;
GETJIT GetJit;
GETDEFJIT GetDefJit;
GETPROCESSLIST GetProcessList;
GETPAGERIGHTS GetPageRights;
SETPAGERIGHTS SetPageRights;
PAGERIGHTSTOSTRING PageRightsToString;
ISPROCESSELEVATED IsProcessElevated;
GETCMDLINE GetCmdline;
SETCMDLINE SetCmdline;
FILEOFFSETTOVA FileOffsetToVa;
VATOFILEOFFSET VaToFileOffset;
GETADDRFROMLINE GetAddrFromLine;
GETSOURCEFROMADDR GetSourceFromAddr;
VALFROMSTRING ValFromString;
PATCHGETEX PatchGetEx;
GETBRIDGEBP GetBridgeBp;
STRINGFORMATINLINE StringFormatInline;
GETMNEMONICBRIEF GetMnemonicBrief;
GETTRACERECORDHITCOUNT GetTraceRecordHitCount;
GETTRACERECORDBYTETYPE GetTraceRecordByteType;
SETTRACERECORDTYPE SetTraceRecordType;
GETTRACERECORDTYPE GetTraceRecordType;
ENUMHANDLES EnumHandles;
GETHANDLENAME GetHandleName;
ENUMTCPCONNECTIONS EnumTcpConnections;
GETDBGEVENTS GetDbgEvents;
MODGETPARTY ModGetParty;
MODSETPARTY ModSetParty;
WATCHISWATCHDOGTRIGGERED WatchIsWatchdogTriggered;
MEMISCODEPAGE MemIsCodePage;
ANIMATECOMMAND AnimateCommand;
DBGSETDEBUGGEEINITSCRIPT DbgSetDebuggeeInitScript;
DBGGETDEBUGGEEINITSCRIPT DbgGetDebuggeeInitScript;
HANDLESENUMWINDOWS EnumWindows;
HANDLESENUMHEAPS EnumHeaps;
THREADGETNAME ThreadGetName;
ISDEPENABLED IsDepEnabled;
GETCALLSTACKEX GetCallStackEx;
GETUSERCOMMENT GetUserComment;
ENUMCONSTANTS EnumConstants;
ENUMCONSTANTS EnumErrorCodes;
ENUMCONSTANTS EnumExceptions;
MEMBPSIZE MemBpSize;
MODRELOCATIONSFROMADDR ModRelocationsFromAddr;
MODRELOCATIONATADDR ModRelocationAtAddr;
MODRELOCATIONSINRANGE ModRelocationsInRange;
DBGETHASH DbGetHash;
SYMAUTOCOMPLETE SymAutoComplete;
} DBGFUNCTIONS;
#ifdef BUILD_DBG
const DBGFUNCTIONS* dbgfunctionsget();
void dbgfunctionsinit();
#endif //BUILD_DBG
#endif //_DBGFUNCTIONS_H
================================================
FILE: x64dbgApiBreak/src/incl/pluginsdk/_plugin_types.h
================================================
#ifndef _PLUGIN_DATA_H
#define _PLUGIN_DATA_H
#ifdef BUILD_DBG
#include "_global.h"
#include "jansson/jansson.h"
#include <dbghelp.h>
#else
#ifdef __GNUC__
#include "dbghelp/dbghelp.h"
#else
#include <dbghelp.h>
#endif // __GNUC__
#ifndef deflen
#define deflen 1024
#endif // deflen
#include "bridgemain.h"
#include "_dbgfunctions.h"
#include "jansson/jansson.h"
#endif // BUILD_DBG
#endif // _PLUGIN_DATA_H
================================================
FILE: x64dbgApiBreak/src/incl/pluginsdk/_plugins.h
================================================
#ifndef _PLUGINS_H
#define _PLUGINS_H
#ifndef __cplusplus
#include <stdbool.h>
#endif
#ifndef PLUG_IMPEXP
#ifdef BUILD_DBG
#define PLUG_IMPEXP __declspec(dllexport)
#else
#define PLUG_IMPEXP __declspec(dllimport)
#endif //BUILD_DBG
#endif //PLUG_IMPEXP
#include "_plugin_types.h"
//default structure alignments forced
#ifdef _WIN64
#pragma pack(push, 16)
#else //x86
#pragma pack(push, 8)
#endif //_WIN64
//defines
#define PLUG_SDKVERSION 1
#define PLUG_DB_LOADSAVE_DATA 1
#define PLUG_DB_LOADSAVE_ALL 2
//structures
typedef struct
{
//provided by the debugger
int pluginHandle;
//provided by the pluginit function
int sdkVersion;
int pluginVersion;
char pluginName[256];
} PLUG_INITSTRUCT;
typedef struct
{
//provided by the debugger
HWND hwndDlg; //gui window handle
int hMenu; //plugin menu handle
int hMenuDisasm; //plugin disasm menu handle
int hMenuDump; //plugin dump menu handle
int hMenuStack; //plugin stack menu handle
} PLUG_SETUPSTRUCT;
typedef struct
{
void* data; //user data
} PLUG_SCRIPTSTRUCT;
//callback structures
typedef struct
{
const char* szFileName;
} PLUG_CB_INITDEBUG;
typedef struct
{
void* reserved;
} PLUG_CB_STOPDEBUG;
typedef struct
{
CREATE_PROCESS_DEBUG_INFO* CreateProcessInfo;
IMAGEHLP_MODULE64* modInfo;
const char* DebugFileName;
PROCESS_INFORMATION* fdProcessInfo;
} PLUG_CB_CREATEPROCESS;
typedef struct
{
EXIT_PROCESS_DEBUG_INFO* ExitProcess;
} PLUG_CB_EXITPROCESS;
typedef struct
{
CREATE_THREAD_DEBUG_INFO* CreateThread;
DWORD dwThreadId;
} PLUG_CB_CREATETHREAD;
typedef struct
{
EXIT_THREAD_DEBUG_INFO* ExitThread;
DWORD dwThreadId;
} PLUG_CB_EXITTHREAD;
typedef struct
{
void* reserved;
} PLUG_CB_SYSTEMBREAKPOINT;
typedef struct
{
LOAD_DLL_DEBUG_INFO* LoadDll;
IMAGEHLP_MODULE64* modInfo;
const char* modname;
} PLUG_CB_LOADDLL;
typedef struct
{
UNLOAD_DLL_DEBUG_INFO* UnloadDll;
} PLUG_CB_UNLOADDLL;
typedef struct
{
OUTPUT_DEBUG_STRING_INFO* DebugString;
} PLUG_CB_OUTPUTDEBUGSTRING;
typedef struct
{
EXCEPTION_DEBUG_INFO* Exception;
} PLUG_CB_EXCEPTION;
typedef struct
{
BRIDGEBP* breakpoint;
} PLUG_CB_BREAKPOINT;
typedef struct
{
void* reserved;
} PLUG_CB_PAUSEDEBUG;
typedef struct
{
void* reserved;
} PLUG_CB_RESUMEDEBUG;
typedef struct
{
void* reserved;
} PLUG_CB_STEPPED;
typedef struct
{
DWORD dwProcessId;
} PLUG_CB_ATTACH;
typedef struct
{
PROCESS_INFORMATION* fdProcessInfo;
} PLUG_CB_DETACH;
typedef struct
{
DEBUG_EVENT* DebugEvent;
} PLUG_CB_DEBUGEVENT;
typedef struct
{
int hEntry;
} PLUG_CB_MENUENTRY;
typedef struct
{
MSG* message;
long* result;
bool retval;
} PLUG_CB_WINEVENT;
typedef struct
{
MSG* message;
bool retval;
} PLUG_CB_WINEVENTGLOBAL;
typedef struct
{
json_t* root;
int loadSaveType;
} PLUG_CB_LOADSAVEDB;
typedef struct
{
const char* symbol;
bool retval;
} PLUG_CB_FILTERSYMBOL;
typedef struct
{
duint cip;
bool stop;
} PLUG_CB_TRACEEXECUTE;
typedef struct
{
int hWindow;
duint VA;
} PLUG_CB_SELCHANGED;
typedef struct
{
BridgeCFGraphList graph;
} PLUG_CB_ANALYZE;
typedef struct
{
duint addr;
BRIDGE_ADDRINFO* addrinfo;
bool retval;
} PLUG_CB_ADDRINFO;
typedef struct
{
const char* string;
duint value;
int* value_size;
bool* isvar;
bool* hexonly;
bool retval;
} PLUG_CB_VALFROMSTRING;
typedef struct
{
const char* string;
duint value;
bool retval;
} PLUG_CB_VALTOSTRING;
typedef struct
{
int hMenu;
} PLUG_CB_MENUPREPARE;
//enums
typedef enum
{
CB_INITDEBUG, //PLUG_CB_INITDEBUG
CB_STOPDEBUG, //PLUG_CB_STOPDEBUG
CB_CREATEPROCESS, //PLUG_CB_CREATEPROCESS
CB_EXITPROCESS, //PLUG_CB_EXITPROCESS
CB_CREATETHREAD, //PLUG_CB_CREATETHREAD
CB_EXITTHREAD, //PLUG_CB_EXITTHREAD
CB_SYSTEMBREAKPOINT, //PLUG_CB_SYSTEMBREAKPOINT
CB_LOADDLL, //PLUG_CB_LOADDLL
CB_UNLOADDLL, //PLUG_CB_UNLOADDLL
CB_OUTPUTDEBUGSTRING, //PLUG_CB_OUTPUTDEBUGSTRING
CB_EXCEPTION, //PLUG_CB_EXCEPTION
CB_BREAKPOINT, //PLUG_CB_BREAKPOINT
CB_PAUSEDEBUG, //PLUG_CB_PAUSEDEBUG
CB_RESUMEDEBUG, //PLUG_CB_RESUMEDEBUG
CB_STEPPED, //PLUG_CB_STEPPED
CB_ATTACH, //PLUG_CB_ATTACHED (before attaching, after CB_INITDEBUG)
CB_DETACH, //PLUG_CB_DETACH (before detaching, before CB_STOPDEBUG)
CB_DEBUGEVENT, //PLUG_CB_DEBUGEVENT (called on any debug event)
CB_MENUENTRY, //PLUG_CB_MENUENTRY
CB_WINEVENT, //PLUG_CB_WINEVENT
CB_WINEVENTGLOBAL, //PLUG_CB_WINEVENTGLOBAL
CB_LOADDB, //PLUG_CB_LOADSAVEDB
CB_SAVEDB, //PLUG_CB_LOADSAVEDB
CB_FILTERSYMBOL, //PLUG_CB_FILTERSYMBOL
CB_TRACEEXECUTE, //PLUG_CB_TRACEEXECUTE
CB_SELCHANGED, //PLUG_CB_SELCHANGED
CB_ANALYZE, //PLUG_CB_ANALYZE
CB_ADDRINFO, //PLUG_CB_ADDRINFO
CB_VALFROMSTRING, //PLUG_CB_VALFROMSTRING
CB_VALTOSTRING, //PLUG_CB_VALTOSTRING
CB_MENUPREPARE, //PLUG_CB_MENUPREPARE
CB_LAST
} CBTYPE;
typedef enum
{
FORMAT_ERROR, //generic failure (no message)
FORMAT_SUCCESS, //success
FORMAT_ERROR_MESSAGE, //formatting failed but an error was put in the buffer (there are always at least 511 characters available).
FORMAT_BUFFER_TOO_SMALL //buffer too small (x64dbg will retry until the buffer is big enough)
} FORMATRESULT;
//typedefs
typedef void (*CBPLUGIN)(CBTYPE cbType, void* callbackInfo);
typedef bool (*CBPLUGINCOMMAND)(int argc, char** argv);
typedef void (*CBPLUGINSCRIPT)();
typedef duint(*CBPLUGINEXPRFUNCTION)(int argc, duint* argv, void* userdata);
typedef FORMATRESULT(*CBPLUGINFORMATFUNCTION)(char* dest, size_t destCount, int argc, char* argv[], duint value, void* userdata);
typedef bool (*CBPLUGINPREDICATE)(void* userdata);
//exports
#ifdef __cplusplus
extern "C"
{
#endif
PLUG_IMPEXP void _plugin_registercallback(int pluginHandle, CBTYPE cbType, CBPLUGIN cbPlugin);
PLUG_IMPEXP bool _plugin_unregistercallback(int pluginHandle, CBTYPE cbType);
PLUG_IMPEXP bool _plugin_registercommand(int pluginHandle, const char* command, CBPLUGINCOMMAND cbCommand, bool debugonly);
PLUG_IMPEXP bool _plugin_unregistercommand(int pluginHandle, const char* command);
PLUG_IMPEXP void _plugin_logprintf(const char* format, ...);
PLUG_IMPEXP void _plugin_logputs(const char* text);
PLUG_IMPEXP void _plugin_logprint(const char* text);
PLUG_IMPEXP void _plugin_debugpause();
PLUG_IMPEXP void _plugin_debugskipexceptions(bool skip);
PLUG_IMPEXP int _plugin_menuadd(int hMenu, const char* title);
PLUG_IMPEXP bool _plugin_menuaddentry(int hMenu, int hEntry, const char* title);
PLUG_IMPEXP bool _plugin_menuaddseparator(int hMenu);
PLUG_IMPEXP bool _plugin_menuclear(int hMenu);
PLUG_IMPEXP void _plugin_menuseticon(int hMenu, const ICONDATA* icon);
PLUG_IMPEXP void _plugin_menuentryseticon(int pluginHandle, int hEntry, const ICONDATA* icon);
PLUG_IMPEXP void _plugin_menuentrysetchecked(int pluginHandle, int hEntry, bool checked);
PLUG_IMPEXP void _plugin_menusetvisible(int pluginHandle, int hMenu, bool visible);
PLUG_IMPEXP void _plugin_menuentrysetvisible(int pluginHandle, int hEntry, bool visible);
PLUG_IMPEXP void _plugin_menusetname(int pluginHandle, int hMenu, const char* name);
PLUG_IMPEXP void _plugin_menuentrysetname(int pluginHandle, int hEntry, const char* name);
PLUG_IMPEXP void _plugin_menuentrysethotkey(int pluginHandle, int hEntry, const char* hotkey);
PLUG_IMPEXP bool _plugin_menuremove(int hMenu);
PLUG_IMPEXP bool _plugin_menuentryremove(int pluginHandle, int hEntry);
PLUG_IMPEXP void _plugin_startscript(CBPLUGINSCRIPT cbScript);
PLUG_IMPEXP bool _plugin_waituntilpaused();
PLUG_IMPEXP bool _plugin_registerexprfunction(int pluginHandle, const char* name, int argc, CBPLUGINEXPRFUNCTION cbFunction, void* userdata);
PLUG_IMPEXP bool _plugin_unregisterexprfunction(int pluginHandle, const char* name);
PLUG_IMPEXP bool _plugin_unload(const char* pluginName);
PLUG_IMPEXP bool _plugin_load(const char* pluginName);
PLUG_IMPEXP duint _plugin_hash(const void* data, duint size);
PLUG_IMPEXP bool _plugin_registerformatfunction(int pluginHandle, const char* type, CBPLUGINFORMATFUNCTION cbFunction, void* userdata);
PLUG_IMPEXP bool _plugin_unregisterformatfunction(int pluginHandle, const char* type);
#ifdef __cplusplus
}
#endif
#pragma pack(pop)
#endif // _PLUGINS_H
================================================
FILE: x64dbgApiBreak/src/incl/pluginsdk/_scriptapi.h
================================================
#ifndef _SCRIPT_API_H
#define _SCRIPT_API_H
#include "_plugins.h"
#define SCRIPT_EXPORT PLUG_IMPEXP
#endif //_SCRIPT_API_H
================================================
FILE: x64dbgApiBreak/src/incl/pluginsdk/_scriptapi_argument.h
================================================
#ifndef _SCRIPTAPI_ARGUMENT_H
#define _SCRIPTAPI_ARGUMENT_H
#include "_scriptapi.h"
namespace Script
{
namespace Argument
{
struct ArgumentInfo
{
char mod[MAX_MODULE_SIZE];
duint rvaStart;
duint rvaEnd;
bool manual;
duint instructioncount;
};
SCRIPT_EXPORT bool Add(duint start, duint end, bool manual, duint instructionCount = 0);
SCRIPT_EXPORT bool Add(const ArgumentInfo* info);
SCRIPT_EXPORT bool Get(duint addr, duint* start = nullptr, duint* end = nullptr, duint* instructionCount = nullptr);
SCRIPT_EXPORT bool GetInfo(duint addr, ArgumentInfo* info);
SCRIPT_EXPORT bool Overlaps(duint start, duint end);
SCRIPT_EXPORT bool Delete(duint address);
SCRIPT_EXPORT void DeleteRange(duint start, duint end, bool deleteManual = false);
SCRIPT_EXPORT void Clear();
SCRIPT_EXPORT bool GetList(ListOf(ArgumentInfo) list); //caller has the responsibility to free the list
}; //Argument
}; //Script
#endif //_SCRIPTAPI_ARGUMENT_H
================================================
FILE: x64dbgApiBreak/src/incl/pluginsdk/_scriptapi_assembler.h
================================================
#ifndef _SCRIPTAPI_ASSEMBLER_H
#define _SCRIPTAPI_ASSEMBLER_H
#include "_scriptapi.h"
namespace Script
{
namespace Assembler
{
SCRIPT_EXPORT bool Assemble(duint addr, unsigned char* dest, int* size, const char* instruction); //dest[16]
SCRIPT_EXPORT bool AssembleEx(duint addr, unsigned char* dest, int* size, const char* instruction, char* error); //dest[16], error[MAX_ERROR_SIZE]
SCRIPT_EXPORT bool AssembleMem(duint addr, const char* instruction);
SCRIPT_EXPORT bool AssembleMemEx(duint addr, const char* instruction, int* size, char* error, bool fillnop); //error[MAX_ERROR_SIZE]
}; //Assembler
}; //Script
#endif //_SCRIPTAPI_ASSEMBLER_H
================================================
FILE: x64dbgApiBreak/src/incl/pluginsdk/_scriptapi_bookmark.h
================================================
#ifndef _SCRIPTAPI_BOOKMARK_H
#define _SCRIPTAPI_BOOKMARK_H
#include "_scriptapi.h"
namespace Script
{
namespace Bookmark
{
struct BookmarkInfo
{
char mod[MAX_MODULE_SIZE];
duint rva;
bool manual;
};
SCRIPT_EXPORT bool Set(duint addr, bool manual = false);
SCRIPT_EXPORT bool Set(const BookmarkInfo* info);
SCRIPT_EXPORT bool Get(duint addr);
SCRIPT_EXPORT bool GetInfo(duint addr, BookmarkInfo* info);
SCRIPT_EXPORT bool Delete(duint addr);
SCRIPT_EXPORT void DeleteRange(duint start, duint end);
SCRIPT_EXPORT void Clear();
SCRIPT_EXPORT bool GetList(ListOf(BookmarkInfo) list); //caller has the responsibility to free the list
}; //Bookmark
}; //Script
#endif //_SCRIPTAPI_BOOKMARK_H
================================================
FILE: x64dbgApiBreak/src/incl/pluginsdk/_scriptapi_comment.h
================================================
#ifndef _SCRIPTAPI_COMMENT_H
#define _SCRIPTAPI_COMMENT_H
#include "_scriptapi.h"
namespace Script
{
namespace Comment
{
struct CommentInfo
{
char mod[MAX_MODULE_SIZE];
duint rva;
char text[MAX_LABEL_SIZE];
bool manual;
};
SCRIPT_EXPORT bool Set(duint addr, const char* text, bool manual = false);
SCRIPT_EXPORT bool Set(const CommentInfo* info);
SCRIPT_EXPORT bool Get(duint addr, char* text); //text[MAX_COMMENT_SIZE]
SCRIPT_EXPORT bool GetInfo(duint addr, CommentInfo* info);
SCRIPT_EXPORT bool Delete(duint addr);
SCRIPT_EXPORT void DeleteRange(duint start, duint end);
SCRIPT_EXPORT void Clear();
SCRIPT_EXPORT bool GetList(ListOf(CommentInfo) list); //caller has the responsibility to free the list
}; //Comment
}; //Script
#endif //_SCRIPTAPI_COMMENT_H
================================================
FILE: x64dbgApiBreak/src/incl/pluginsdk/_scriptapi_debug.h
================================================
#ifndef _SCRIPTAPI_DEBUG_H
#define _SCRIPTAPI_DEBUG_H
#include "_scriptapi.h"
namespace Script
{
namespace Debug
{
enum HardwareType
{
HardwareAccess,
HardwareWrite,
HardwareExecute
};
SCRIPT_EXPORT void Wait();
SCRIPT_EXPORT void Run();
SCRIPT_EXPORT void Pause();
SCRIPT_EXPORT void Stop();
SCRIPT_EXPORT void StepIn();
SCRIPT_EXPORT void StepOver();
SCRIPT_EXPORT void StepOut();
SCRIPT_EXPORT bool SetBreakpoint(duint address);
SCRIPT_EXPORT bool DeleteBreakpoint(duint address);
SCRIPT_EXPORT bool DisableBreakpoint(duint address);
SCRIPT_EXPORT bool SetHardwareBreakpoint(duint address, HardwareType type = HardwareExecute);
SCRIPT_EXPORT bool DeleteHardwareBreakpoint(duint address);
}; //Debug
}; //Script
#endif //_SCRIPTAPI_DEBUG_H
================================================
FILE: x64dbgApiBreak/src/incl/pluginsdk/_scriptapi_flag.h
================================================
#ifndef _SCRIPTAPI_FLAG_H
#define _SCRIPTAPI_FLAG_H
#include "_scriptapi.h"
namespace Script
{
namespace Flag
{
enum FlagEnum
{
ZF,
OF,
CF,
PF,
SF,
TF,
AF,
DF,
IF
};
SCRIPT_EXPORT bool Get(FlagEnum flag);
SCRIPT_EXPORT bool Set(FlagEnum flag, bool value);
SCRIPT_EXPORT bool GetZF();
SCRIPT_EXPORT bool SetZF(bool value);
SCRIPT_EXPORT bool GetOF();
SCRIPT_EXPORT bool SetOF(bool value);
SCRIPT_EXPORT bool GetCF();
SCRIPT_EXPORT bool SetCF(bool value);
SCRIPT_EXPORT bool GetPF();
SCRIPT_EXPORT bool SetPF(bool value);
SCRIPT_EXPORT bool GetSF();
SCRIPT_EXPORT bool SetSF(bool value);
SCRIPT_EXPORT bool GetTF();
SCRIPT_EXPORT bool SetTF(bool value);
SCRIPT_EXPORT bool GetAF();
SCRIPT_EXPORT bool SetAF(bool value);
SCRIPT_EXPORT bool GetDF();
SCRIPT_EXPORT bool SetDF(bool value);
SCRIPT_EXPORT bool GetIF();
SCRIPT_EXPORT bool SetIF(bool value);
};
};
#endif //_SCRIPTAPI_FLAG_H
================================================
FILE: x64dbgApiBreak/src/incl/pluginsdk/_scriptapi_function.h
================================================
#ifndef _SCRIPTAPI_FUNCTION_H
#define _SCRIPTAPI_FUNCTION_H
#include "_scriptapi.h"
namespace Script
{
namespace Function
{
struct FunctionInfo
{
char mod[MAX_MODULE_SIZE];
duint rvaStart;
duint rvaEnd;
bool manual;
duint instructioncount;
};
SCRIPT_EXPORT bool Add(duint start, duint end, bool manual, duint instructionCount = 0);
SCRIPT_EXPORT bool Add(const FunctionInfo* info);
SCRIPT_EXPORT bool Get(duint addr, duint* start = nullptr, duint* end = nullptr, duint* instructionCount = nullptr);
SCRIPT_EXPORT bool GetInfo(duint addr, FunctionInfo* info);
SCRIPT_EXPORT bool Overlaps(duint start, duint end);
SCRIPT_EXPORT bool Delete(duint address);
SCRIPT_EXPORT void DeleteRange(duint start, duint end, bool deleteManual);
SCRIPT_EXPORT void DeleteRange(duint start, duint end);
SCRIPT_EXPORT void Clear();
SCRIPT_EXPORT bool GetList(ListOf(FunctionInfo) list); //caller has the responsibility to free the list
}; //Function
}; //Script
#endif //_SCRIPTAPI_FUNCTION_H
================================================
FILE: x64dbgApiBreak/src/incl/pluginsdk/_scriptapi_gui.h
================================================
#ifndef _SCRIPTAPI_GUI_H
#define _SCRIPTAPI_GUI_H
#include "_scriptapi.h"
namespace Script
{
namespace Gui
{
namespace Disassembly
{
SCRIPT_EXPORT bool SelectionGet(duint* start, duint* end);
SCRIPT_EXPORT bool SelectionSet(duint start, duint end);
SCRIPT_EXPORT duint SelectionGetStart();
SCRIPT_EXPORT duint SelectionGetEnd();
}; //Disassembly
namespace Dump
{
SCRIPT_EXPORT bool SelectionGet(duint* start, duint* end);
SCRIPT_EXPORT bool SelectionSet(duint start, duint end);
SCRIPT_EXPORT duint SelectionGetStart();
SCRIPT_EXPORT duint SelectionGetEnd();
}; //Dump
namespace Stack
{
SCRIPT_EXPORT bool SelectionGet(duint* start, duint* end);
SCRIPT_EXPORT bool SelectionSet(duint start, duint end);
SCRIPT_EXPORT duint SelectionGetStart();
SCRIPT_EXPORT duint SelectionGetEnd();
}; //Stack
namespace Graph
{
SCRIPT_EXPORT duint SelectionGetStart();
}; //Graph
namespace MemMap
{
SCRIPT_EXPORT duint SelectionGetStart();
}; //MemoryMap
namespace SymMod
{
SCRIPT_EXPORT duint SelectionGetStart();
}; //SymMod
}; //Gui
namespace Gui
{
enum Window
{
DisassemblyWindow,
DumpWindow,
StackWindow,
GraphWindow,
MemMapWindow,
SymModWindow
};
SCRIPT_EXPORT bool SelectionGet(Window window, duint* start, duint* end);
SCRIPT_EXPORT bool SelectionSet(Window window, duint start, duint end);
SCRIPT_EXPORT duint SelectionGetStart(Window window);
SCRIPT_EXPORT duint SelectionGetEnd(Window window);
SCRIPT_EXPORT void Message(const char* message);
SCRIPT_EXPORT bool MessageYesNo(const char* message);
SCRIPT_EXPORT bool InputLine(const char* title, char* text); //text[GUI_MAX_LINE_SIZE]
SCRIPT_EXPORT bool InputValue(const char* title, duint* value);
SCRIPT_EXPORT void Refresh();
SCRIPT_EXPORT void AddQWidgetTab(void* qWidget);
SCRIPT_EXPORT void ShowQWidgetTab(void* qWidget);
SCRIPT_EXPORT void CloseQWidgetTab(void* qWidget);
}; //Gui
}; //Script
#endif //_SCRIPTAPI_GUI_H
================================================
FILE: x64dbgApiBreak/src/incl/pluginsdk/_scriptapi_label.h
================================================
#ifndef _SCRIPTAPI_LABEL_H
#define _SCRIPTAPI_LABEL_H
#include "_scriptapi.h"
namespace Script
{
namespace Label
{
struct LabelInfo
{
char mod[MAX_MODULE_SIZE];
duint rva;
char text[MAX_LABEL_SIZE];
bool manual;
};
SCRIPT_EXPORT bool Set(duint addr, const char* text, bool manual = false);
SCRIPT_EXPORT bool Set(const LabelInfo* info);
SCRIPT_EXPORT bool FromString(const char* label, duint* addr);
SCRIPT_EXPORT bool Get(duint addr, char* text); //text[MAX_LABEL_SIZE]
SCRIPT_EXPORT bool GetInfo(duint addr, LabelInfo* info);
SCRIPT_EXPORT bool Delete(duint addr);
SCRIPT_EXPORT void DeleteRange(duint start, duint end);
SCRIPT_EXPORT void Clear();
SCRIPT_EXPORT bool GetList(ListOf(LabelInfo) list); //caller has the responsibility to free the list
}; //Label
}; //Script
#endif //_SCRIPTAPI_LABEL_H
================================================
FILE: x64dbgApiBreak/src/incl/pluginsdk/_scriptapi_memory.h
================================================
#ifndef _SCRIPTAPI_MEMORY_H
#define _SCRIPTAPI_MEMORY_H
#include "_scriptapi.h"
namespace Script
{
namespace Memory
{
SCRIPT_EXPORT bool Read(duint addr, void* data, duint size, duint* sizeRead);
SCRIPT_EXPORT bool Write(duint addr, const void* data, duint size, duint* sizeWritten);
SCRIPT_EXPORT bool IsValidPtr(duint addr);
SCRIPT_EXPORT duint RemoteAlloc(duint addr, duint size);
SCRIPT_EXPORT bool RemoteFree(duint addr);
SCRIPT_EXPORT unsigned int GetProtect(duint addr, bool reserved = false, bool cache = true);
SCRIPT_EXPORT duint GetBase(duint addr, bool reserved = false, bool cache = true);
SCRIPT_EXPORT duint GetSize(duint addr, bool reserved = false, bool cache = true);
SCRIPT_EXPORT unsigned char ReadByte(duint addr);
SCRIPT_EXPORT bool WriteByte(duint addr, unsigned char data);
SCRIPT_EXPORT unsigned short ReadWord(duint addr);
SCRIPT_EXPORT bool WriteWord(duint addr, unsigned short data);
SCRIPT_EXPORT unsigned int ReadDword(duint addr);
SCRIPT_EXPORT bool WriteDword(duint addr, unsigned int data);
SCRIPT_EXPORT unsigned long long ReadQword(duint addr);
SCRIPT_EXPORT bool WriteQword(duint addr, unsigned long long data);
SCRIPT_EXPORT duint ReadPtr(duint addr);
SCRIPT_EXPORT bool WritePtr(duint addr, duint data);
}; //Memory
}; //Script
#endif //_SCRIPTAPI_MEMORY_H
================================================
FILE: x64dbgApiBreak/src/incl/pluginsdk/_scriptapi_misc.h
================================================
#ifndef _SCRIPTAPI_MISC_H
#define _SCRIPTAPI_MISC_H
#include "_scriptapi.h"
namespace Script
{
namespace Misc
{
/// <summary>
/// Evaluates an expression and returns the result. Analagous to using the Command field in x64dbg.
///
/// Expressions can consist of memory locations, registers, flags, API names, labels, symbols, variables etc.
///
/// Example: bool success = ParseExpression("[esp+8]", &val)
/// </summary>
/// <param name="expression">The expression to evaluate.</param>
/// <param name="value">The result of the expression.</param>
/// <returns>True on success, False on failure.</returns>
SCRIPT_EXPORT bool ParseExpression(const char* expression, duint* value);
/// <summary>
/// Returns the address of a function in the debuggee's memory space.
///
/// Example: duint addr = RemoteGetProcAddress("kernel32.dll", "GetProcAddress")
/// </summary>
/// <param name="module">The name of the module.</param>
/// <param name="api">The name of the function.</param>
/// <returns>The address of the function in the debuggee.</returns>
SCRIPT_EXPORT duint RemoteGetProcAddress(const char* module, const char* api);
/// <summary>
/// Returns the address for a label created in the disassembly window.
///
/// Example: duint addr = ResolveLabel("sneaky_crypto")
/// </summary>
/// <param name="label">The name of the label to resolve.</param>
/// <returns>The memory address for the label.</returns>
SCRIPT_EXPORT duint ResolveLabel(const char* label);
/// <summary>
/// Allocates the requested number of bytes from x64dbg's default process heap.
///
/// Note: this allocation is in the debugger, not the debuggee.
///
/// Memory allocated using this function should be Free'd after use.
///
/// Example: void* addr = Alloc(0x100000)
/// </summary>
/// <param name="size">Number of bytes to allocate.</param>
/// <returns>A pointer to the newly allocated memory.</returns>
SCRIPT_EXPORT void* Alloc(duint size);
/// <summary>
/// Frees memory previously allocated by Alloc.
///
/// Example: Free(addr)
/// </summary>
/// <param name="ptr">Pointer returned by Alloc.</param>
/// <returns>Nothing.</returns>
SCRIPT_EXPORT void Free(void* ptr);
}; //Misc
}; //Script
#endif //_SCRIPTAPI_MISC_H
================================================
FILE: x64dbgApiBreak/src/incl/pluginsdk/_scriptapi_module.h
================================================
#ifndef _SCRIPTAPI_MODULE_H
#define _SCRIPTAPI_MODULE_H
#include "_scriptapi.h"
namespace Script
{
namespace Module
{
struct ModuleInfo
{
duint base;
duint size;
duint entry;
int sectionCount;
char name[MAX_MODULE_SIZE];
char path[MAX_PATH];
};
struct ModuleSectionInfo
{
duint addr;
duint size;
char name[MAX_SECTION_SIZE * 5];
};
SCRIPT_EXPORT bool InfoFromAddr(duint addr, ModuleInfo* info);
SCRIPT_EXPORT bool InfoFromName(const char* name, ModuleInfo* info);
SCRIPT_EXPORT duint BaseFromAddr(duint addr);
SCRIPT_EXPORT duint BaseFromName(const char* name);
SCRIPT_EXPORT duint SizeFromAddr(duint addr);
SCRIPT_EXPORT duint SizeFromName(const char* name);
SCRIPT_EXPORT bool NameFromAddr(duint addr, char* name); //name[MAX_MODULE_SIZE]
SCRIPT_EXPORT bool PathFromAddr(duint addr, char* path); //path[MAX_PATH]
SCRIPT_EXPORT bool PathFromName(const char* name, char* path); //path[MAX_PATH]
SCRIPT_EXPORT duint EntryFromAddr(duint addr);
SCRIPT_EXPORT duint EntryFromName(const char* name);
SCRIPT_EXPORT int SectionCountFromAddr(duint addr);
SCRIPT_EXPORT int SectionCountFromName(const char* name);
SCRIPT_EXPORT bool SectionFromAddr(duint addr, int number, ModuleSectionInfo* section);
SCRIPT_EXPORT bool SectionFromName(const char* name, int number, ModuleSectionInfo* section);
SCRIPT_EXPORT bool SectionListFromAddr(duint addr, ListOf(ModuleSectionInfo) list);
SCRIPT_EXPORT bool SectionListFromName(const char* name, ListOf(ModuleSectionInfo) list);
SCRIPT_EXPORT bool GetMainModuleInfo(ModuleInfo* info);
SCRIPT_EXPORT duint GetMainModuleBase();
SCRIPT_EXPORT duint GetMainModuleSize();
SCRIPT_EXPORT duint GetMainModuleEntry();
SCRIPT_EXPORT int GetMainModuleSectionCount();
SCRIPT_EXPORT bool GetMainModuleName(char* name); //name[MAX_MODULE_SIZE]
SCRIPT_EXPORT bool GetMainModulePath(char* path); //path[MAX_PATH]
SCRIPT_EXPORT bool GetMainModuleSectionList(ListOf(ModuleSectionInfo) list); //caller has the responsibility to free the list
SCRIPT_EXPORT bool GetList(ListOf(ModuleInfo) list); //caller has the responsibility to free the list
}; //Module
}; //Script
#endif //_SCRIPTAPI_MODULE_H
================================================
FILE: x64dbgApiBreak/src/incl/pluginsdk/_scriptapi_pattern.h
================================================
#ifndef _SCRIPTAPI_PATTERN_H
#define _SCRIPTAPI_PATTERN_H
#include "_scriptapi.h"
namespace Script
{
namespace Pattern
{
SCRIPT_EXPORT duint Find(unsigned char* data, duint datasize, const char* pattern);
SCRIPT_EXPORT duint FindMem(duint start, duint size, const char* pattern);
SCRIPT_EXPORT void Write(unsigned char* data, duint datasize, const char* pattern);
SCRIPT_EXPORT void WriteMem(duint start, duint size, const char* pattern);
SCRIPT_EXPORT bool SearchAndReplace(unsigned char* data, duint datasize, const char* searchpattern, const char* replacepattern);
SCRIPT_EXPORT bool SearchAndReplaceMem(duint start, duint size, const char* searchpattern, const char* replacepattern);
};
};
#endif //_SCRIPTAPI_FIND_H
================================================
FILE: x64dbgApiBreak/src/incl/pluginsdk/_scriptapi_register.h
================================================
#ifndef _SCRIPTAPI_REGISTER_H
#define _SCRIPTAPI_REGISTER_H
#include "_scriptapi.h"
namespace Script
{
namespace Register
{
enum RegisterEnum
{
DR0,
DR1,
DR2,
DR3,
DR6,
DR7,
EAX,
AX,
AH,
AL,
EBX,
BX,
BH,
BL,
ECX,
CX,
CH,
CL,
EDX,
DX,
DH,
DL,
EDI,
DI,
ESI,
SI,
EBP,
BP,
ESP,
SP,
EIP,
#ifdef _WIN64
RAX,
RBX,
RCX,
RDX,
RSI,
SIL,
RDI,
DIL,
RBP,
BPL,
RSP,
SPL,
RIP,
R8,
R8D,
R8W,
R8B,
R9,
R9D,
R9W,
R9B,
R10,
R10D,
R10W,
R10B,
R11,
R11D,
R11W,
R11B,
R12,
R12D,
R12W,
R12B,
R13,
R13D,
R13W,
R13B,
R14,
R14D,
R14W,
R14B,
R15,
R15D,
R15W,
R15B,
#endif //_WIN64
CIP,
CSP,
CAX,
CBX,
CCX,
CDX,
CDI,
CSI,
CBP,
CFLAGS
}; //RegisterEnum
SCRIPT_EXPORT duint Get(RegisterEnum reg);
SCRIPT_EXPORT bool Set(RegisterEnum reg, duint value);
SCRIPT_EXPORT int Size(); //gets architecture register size in bytes
SCRIPT_EXPORT duint GetDR0();
SCRIPT_EXPORT bool SetDR0(duint value);
SCRIPT_EXPORT duint GetDR1();
SCRIPT_EXPORT bool SetDR1(duint value);
SCRIPT_EXPORT duint GetDR2();
SCRIPT_EXPORT bool SetDR2(duint value);
SCRIPT_EXPORT duint GetDR3();
SCRIPT_EXPORT bool SetDR3(duint value);
SCRIPT_EXPORT duint GetDR6();
SCRIPT_EXPORT bool SetDR6(duint value);
SCRIPT_EXPORT duint GetDR7();
SCRIPT_EXPORT bool SetDR7(duint value);
SCRIPT_EXPORT unsigned int GetEAX();
SCRIPT_EXPORT bool SetEAX(unsigned int value);
SCRIPT_EXPORT unsigned short GetAX();
SCRIPT_EXPORT bool SetAX(unsigned short value);
SCRIPT_EXPORT unsigned char GetAH();
SCRIPT_EXPORT bool SetAH(unsigned char value);
SCRIPT_EXPORT unsigned char GetAL();
SCRIPT_EXPORT bool SetAL(unsigned char value);
SCRIPT_EXPORT unsigned int GetEBX();
SCRIPT_EXPORT bool SetEBX(unsigned int value);
SCRIPT_EXPORT unsigned short GetBX();
SCRIPT_EXPORT bool SetBX(unsigned short value);
SCRIPT_EXPORT unsigned char GetBH();
SCRIPT_EXPORT bool SetBH(unsigned char value);
SCRIPT_EXPORT unsigned char GetBL();
SCRIPT_EXPORT bool SetBL(unsigned char value);
SCRIPT_EXPORT unsigned int GetECX();
SCRIPT_EXPORT bool SetECX(unsigned int value);
SCRIPT_EXPORT unsigned short GetCX();
SCRIPT_EXPORT bool SetCX(unsigned short value);
SCRIPT_EXPORT unsigned char GetCH();
SCRIPT_EXPORT bool SetCH(unsigned char value);
SCRIPT_EXPORT unsigned char GetCL();
SCRIPT_EXPORT bool SetCL(unsigned char value);
SCRIPT_EXPORT unsigned int GetEDX();
SCRIPT_EXPORT bool SetEDX(unsigned int value);
SCRIPT_EXPORT unsigned short GetDX();
SCRIPT_EXPORT bool SetDX(unsigned short value);
SCRIPT_EXPORT unsigned char GetDH();
SCRIPT_EXPORT bool SetDH(unsigned char value);
SCRIPT_EXPORT unsigned char GetDL();
SCRIPT_EXPORT bool SetDL(unsigned char value);
SCRIPT_EXPORT unsigned int GetEDI();
SCRIPT_EXPORT bool SetEDI(unsigned int value);
SCRIPT_EXPORT unsigned short GetDI();
SCRIPT_EXPORT bool SetDI(unsigned short value);
SCRIPT_EXPORT unsigned int GetESI();
SCRIPT_EXPORT bool SetESI(unsigned int value);
SCRIPT_EXPORT unsigned short GetSI();
SCRIPT_EXPORT bool SetSI(unsigned short value);
SCRIPT_EXPORT unsigned int GetEBP();
SCRIPT_EXPORT bool SetEBP(unsigned int value);
SCRIPT_EXPORT unsigned short GetBP();
SCRIPT_EXPORT bool SetBP(unsigned short value);
SCRIPT_EXPORT unsigned int GetESP();
SCRIPT_EXPORT bool SetESP(unsigned int value);
SCRIPT_EXPORT unsigned short GetSP();
SCRIPT_EXPORT bool SetSP(unsigned short value);
SCRIPT_EXPORT unsigned int GetEIP();
SCRIPT_EXPORT bool SetEIP(unsigned int value);
#ifdef _WIN64
SCRIPT_EXPORT unsigned long long GetRAX();
SCRIPT_EXPORT bool SetRAX(unsigned long long value);
SCRIPT_EXPORT unsigned long long GetRBX();
SCRIPT_EXPORT bool SetRBX(unsigned long long value);
SCRIPT_EXPORT unsigned long long GetRCX();
SCRIPT_EXPORT bool SetRCX(unsigned long long value);
SCRIPT_EXPORT unsigned long long GetRDX();
SCRIPT_EXPORT bool SetRDX(unsigned long long value);
SCRIPT_EXPORT unsigned long long GetRSI();
SCRIPT_EXPORT bool SetRSI(unsigned long long value);
SCRIPT_EXPORT unsigned char GetSIL();
SCRIPT_EXPORT bool SetSIL(unsigned char value);
SCRIPT_EXPORT unsigned long long GetRDI();
SCRIPT_EXPORT bool SetRDI(unsigned long long value);
SCRIPT_EXPORT unsigned char GetDIL();
SCRIPT_EXPORT bool SetDIL(unsigned char value);
SCRIPT_EXPORT unsigned long long GetRBP();
SCRIPT_EXPORT bool SetRBP(unsigned long long value);
SCRIPT_EXPORT unsigned char GetBPL();
SCRIPT_EXPORT bool SetBPL(unsigned char value);
SCRIPT_EXPORT unsigned long long GetRSP();
SCRIPT_EXPORT bool SetRSP(unsigned long long value);
SCRIPT_EXPORT unsigned char GetSPL();
SCRIPT_EXPORT bool SetSPL(unsigned char value);
SCRIPT_EXPORT unsigned long long GetRIP();
SCRIPT_EXPORT bool SetRIP(unsigned long long value);
SCRIPT_EXPORT unsigned long long GetR8();
SCRIPT_EXPORT bool SetR8(unsigned long long value);
SCRIPT_EXPORT unsigned int GetR8D();
SCRIPT_EXPORT bool SetR8D(unsigned int value);
SCRIPT_EXPORT unsigned short GetR8W();
SCRIPT_EXPORT bool SetR8W(unsigned short value);
SCRIPT_EXPORT unsigned char GetR8B();
SCRIPT_EXPORT bool SetR8B(unsigned char value);
SCRIPT_EXPORT unsigned long long GetR9();
SCRIPT_EXPORT bool SetR9(unsigned long long value);
SCRIPT_EXPORT unsigned int GetR9D();
SCRIPT_EXPORT bool SetR9D(unsigned int value);
SCRIPT_EXPORT unsigned short GetR9W();
SCRIPT_EXPORT bool SetR9W(unsigned short value);
SCRIPT_EXPORT unsigned char GetR9B();
SCRIPT_EXPORT bool SetR9B(unsigned char value);
SCRIPT_EXPORT unsigned long long GetR10();
SCRIPT_EXPORT bool SetR10(unsigned long long value);
SCRIPT_EXPORT unsigned int GetR10D();
SCRIPT_EXPORT bool SetR10D(unsigned int value);
SCRIPT_EXPORT unsigned short GetR10W();
SCRIPT_EXPORT bool SetR10W(unsigned short value);
SCRIPT_EXPORT unsigned char GetR10B();
SCRIPT_EXPORT bool SetR10B(unsigned char value);
SCRIPT_EXPORT unsigned long long GetR11();
SCRIPT_EXPORT bool SetR11(unsigned long long value);
SCRIPT_EXPORT unsigned int GetR11D();
SCRIPT_EXPORT bool SetR11D(unsigned int value);
SCRIPT_EXPORT unsigned short GetR11W();
SCRIPT_EXPORT bool SetR11W(unsigned short value);
SCRIPT_EXPORT unsigned char GetR11B();
SCRIPT_EXPORT bool SetR11B(unsigned char value);
SCRIPT_EXPORT unsigned long long GetR12();
SCRIPT_EXPORT bool SetR12(unsigned long long value);
SCRIPT_EXPORT unsigned int GetR12D();
SCRIPT_EXPORT bool SetR12D(unsigned int value);
SCRIPT_EXPORT unsigned short GetR12W();
SCRIPT_EXPORT bool SetR12W(unsigned short value);
SCRIPT_EXPORT unsigned char GetR12B();
SCRIPT_EXPORT bool SetR12B(unsigned char value);
SCRIPT_EXPORT unsigned long long GetR13();
SCRIPT_EXPORT bool SetR13(unsigned long long value);
SCRIPT_EXPORT unsigned int GetR13D();
SCRIPT_EXPORT bool SetR13D(unsigned int value);
SCRIPT_EXPORT unsigned short GetR13W();
SCRIPT_EXPORT bool SetR13W(unsigned short value);
SCRIPT_EXPORT unsigned char GetR13B();
SCRIPT_EXPORT bool SetR13B(unsigned char value);
SCRIPT_EXPORT unsigned long long GetR14();
SCRIPT_EXPORT bool SetR14(unsigned long long value);
SCRIPT_EXPORT unsigned int GetR14D();
SCRIPT_EXPORT bool SetR14D(unsigned int value);
SCRIPT_EXPORT unsigned short GetR14W();
SCRIPT_EXPORT bool SetR14W(unsigned short value);
SCRIPT_EXPORT unsigned char GetR14B();
SCRIPT_EXPORT bool SetR14B(unsigned char value);
SCRIPT_EXPORT unsigned long long GetR15();
SCRIPT_EXPORT bool SetR15(unsigned long long value);
SCRIPT_EXPORT unsigned int GetR15D();
SCRIPT_EXPORT bool SetR15D(unsigned int value);
SCRIPT_EXPORT unsigned short GetR15W();
SCRIPT_EXPORT bool SetR15W(unsigned short value);
SCRIPT_EXPORT unsigned char GetR15B();
SCRIPT_EXPORT bool SetR15B(unsigned char value);
#endif //_WIN64
SCRIPT_EXPORT duint GetCAX();
SCRIPT_EXPORT bool SetCAX(duint value);
SCRIPT_EXPORT duint GetCBX();
SCRIPT_EXPORT bool SetCBX(duint value);
SCRIPT_EXPORT duint GetCCX();
SCRIPT_EXPORT bool SetCCX(duint value);
SCRIPT_EXPORT duint GetCDX();
SCRIPT_EXPORT bool SetCDX(duint value);
SCRIPT_EXPORT duint GetCDI();
SCRIPT_EXPORT bool SetCDI(duint value);
SCRIPT_EXPORT duint GetCSI();
SCRIPT_EXPORT bool SetCSI(duint value);
SCRIPT_EXPORT duint GetCBP();
SCRIPT_EXPORT bool SetCBP(duint value);
SCRIPT_EXPORT duint GetCSP();
SCRIPT_EXPORT bool SetCSP(duint value);
SCRIPT_EXPORT duint GetCIP();
SCRIPT_EXPORT bool SetCIP(duint value);
SCRIPT_EXPORT duint GetCFLAGS();
SCRIPT_EXPORT bool SetCFLAGS(duint value);
}; //Register
}; //Script
#endif //_SCRIPTAPI_REGISTER_H
================================================
FILE: x64dbgApiBreak/src/incl/pluginsdk/_scriptapi_stack.h
================================================
#ifndef _SCRIPTAPI_STACK_H
#define _SCRIPTAPI_STACK_H
#include "_scriptapi.h"
namespace Script
{
namespace Stack
{
SCRIPT_EXPORT duint Pop();
SCRIPT_EXPORT duint Push(duint value); //returns the previous top, equal to Peek(1)
SCRIPT_EXPORT duint Peek(int offset = 0); //offset is in multiples of Register::Size(), for easy x32/x64 portability
}; //Stack
}; //Script
#endif //_SCRIPTAPI_STACK_H
================================================
FILE: x64dbgApiBreak/src/incl/pluginsdk/_scriptapi_symbol.h
================================================
#ifndef _SCRIPTAPI_SYMBOL_H
#define _SCRIPTAPI_SYMBOL_H
#include "_scriptapi.h"
namespace Script
{
namespace Symbol
{
enum SymbolType
{
Function, //user-defined function
Import, //IAT entry
Export //export
};
struct SymbolInfo
{
char mod[MAX_MODULE_SIZE];
duint rva;
char name[MAX_LABEL_SIZE];
bool manual;
SymbolType type;
};
SCRIPT_EXPORT bool GetList(ListOf(SymbolInfo) list); //caller has the responsibility to free the list
}; //Symbol
}; //Script
#endif //_SCRIPTAPI_SYMBOL_H
================================================
FILE: x64dbgApiBreak/src/incl/pluginsdk/bridgegraph.h
================================================
#ifndef _GRAPH_H
#define _GRAPH_H
typedef struct
{
duint addr; //virtual address of the instruction
unsigned char data[15]; //instruction bytes
} BridgeCFInstruction;
typedef struct
{
duint parentGraph; //function of which this node is a part
duint start; //start of the block
duint end; //end of the block (inclusive)
duint brtrue; //destination if condition is true
duint brfalse; //destination if condition is false
duint icount; //number of instructions in node
bool terminal; //node is a RET
bool split; //node is a split (brtrue points to the next node)
bool indirectcall; //node contains indirect calls (call reg, call [reg+X])
void* userdata; //user data
ListInfo exits; //exits (including brtrue and brfalse, duint)
ListInfo instrs; //block instructions
} BridgeCFNodeList;
typedef struct
{
duint entryPoint; //graph entry point
void* userdata; //user data
ListInfo nodes; //graph nodes (BridgeCFNodeList)
} BridgeCFGraphList;
#ifdef __cplusplus
#if _MSC_VER >= 1700 && !defined(NO_CPP11)
#include <unordered_map>
#include <unordered_set>
#include <vector>
#include <utility>
struct BridgeCFNode
{
duint parentGraph; //function of which this node is a part
duint start; //start of the block
duint end; //end of the block (inclusive)
duint brtrue; //destination if condition is true
duint brfalse; //destination if condition is false
duint icount; //number of instructions in node
bool terminal; //node is a RET
bool split; //node is a split (brtrue points to the next node)
bool indirectcall; //node contains indirect calls (call reg, call [reg+X])
void* userdata; //user data
std::vector<duint> exits; //exits (including brtrue and brfalse)
std::vector<BridgeCFInstruction> instrs; //block instructions
static void Free(const BridgeCFNodeList* nodeList)
{
if(!BridgeList<duint>::Free(&nodeList->exits))
__debugbreak();
if(!BridgeList<BridgeCFInstruction>::Free(&nodeList->instrs))
__debugbreak();
}
explicit BridgeCFNode(const BridgeCFNodeList* nodeList, bool freedata)
{
if(!nodeList)
__debugbreak();
parentGraph = nodeList->parentGraph;
start = nodeList->start;
end = nodeList->end;
brtrue = nodeList->brtrue;
brfalse = nodeList->brfalse;
icount = nodeList->icount;
terminal = nodeList->terminal;
indirectcall = nodeList->indirectcall;
split = nodeList->split;
userdata = nodeList->userdata;
if(!BridgeList<duint>::ToVector(&nodeList->exits, exits, freedata))
__debugbreak();
if(!BridgeList<BridgeCFInstruction>::ToVector(&nodeList->instrs, instrs, freedata))
__debugbreak();
}
explicit BridgeCFNode(duint parentGraph, duint start, duint end)
: parentGraph(parentGraph),
start(start),
end(end),
brtrue(0),
brfalse(0),
icount(0),
terminal(false),
indirectcall(false),
split(false),
userdata(nullptr)
{
}
explicit BridgeCFNode()
: parentGraph(0),
start(0),
end(0),
brtrue(0),
brfalse(0),
icount(0),
terminal(false),
split(false),
userdata(nullptr)
{
}
BridgeCFNodeList ToNodeList() const
{
BridgeCFNodeList out;
out.parentGraph = parentGraph;
out.start = start;
out.end = end;
out.brtrue = brtrue;
out.brfalse = brfalse;
out.icount = icount;
out.terminal = terminal;
out.indirectcall = indirectcall;
out.split = split;
out.userdata = userdata;
BridgeList<duint>::CopyData(&out.exits, exits);
BridgeList<BridgeCFInstruction>:
gitextract_x3y7uekt/ ├── .gitignore ├── README.md ├── x64dbgApiBreak/ │ ├── mapperscripts/ │ │ ├── base/ │ │ │ └── base.abtf │ │ └── main.abtf │ ├── res.aps │ ├── res.rc │ ├── resource.h │ ├── src/ │ │ ├── apibreak.cpp │ │ ├── callfind.cpp │ │ ├── dynapidetect.cpp │ │ ├── hlprs.cpp │ │ ├── incl/ │ │ │ ├── apibreak.h │ │ │ ├── corelib.h │ │ │ ├── defs.h │ │ │ ├── dlgs/ │ │ │ │ ├── ApiCallMapForm.hpp │ │ │ │ ├── MainForm.hpp │ │ │ │ └── SettingsForm.hpp │ │ │ ├── hlp.h │ │ │ ├── instparse.h │ │ │ ├── pluginsdk/ │ │ │ │ ├── DeviceNameResolver/ │ │ │ │ │ ├── DeviceNameResolver.h │ │ │ │ │ ├── DeviceNameResolver_x64.a │ │ │ │ │ ├── DeviceNameResolver_x64.lib │ │ │ │ │ ├── DeviceNameResolver_x86.a │ │ │ │ │ └── DeviceNameResolver_x86.lib │ │ │ │ ├── TitanEngine/ │ │ │ │ │ ├── TitanEngine.h │ │ │ │ │ ├── TitanEngine_x64.a │ │ │ │ │ ├── TitanEngine_x64.lib │ │ │ │ │ ├── TitanEngine_x86.a │ │ │ │ │ └── TitanEngine_x86.lib │ │ │ │ ├── XEDParse/ │ │ │ │ │ ├── XEDParse.h │ │ │ │ │ ├── XEDParse_x64.a │ │ │ │ │ ├── XEDParse_x64.lib │ │ │ │ │ ├── XEDParse_x86.a │ │ │ │ │ └── XEDParse_x86.lib │ │ │ │ ├── _dbgfunctions.h │ │ │ │ ├── _plugin_types.h │ │ │ │ ├── _plugins.h │ │ │ │ ├── _scriptapi.h │ │ │ │ ├── _scriptapi_argument.h │ │ │ │ ├── _scriptapi_assembler.h │ │ │ │ ├── _scriptapi_bookmark.h │ │ │ │ ├── _scriptapi_comment.h │ │ │ │ ├── _scriptapi_debug.h │ │ │ │ ├── _scriptapi_flag.h │ │ │ │ ├── _scriptapi_function.h │ │ │ │ ├── _scriptapi_gui.h │ │ │ │ ├── _scriptapi_label.h │ │ │ │ ├── _scriptapi_memory.h │ │ │ │ ├── _scriptapi_misc.h │ │ │ │ ├── _scriptapi_module.h │ │ │ │ ├── _scriptapi_pattern.h │ │ │ │ ├── _scriptapi_register.h │ │ │ │ ├── _scriptapi_stack.h │ │ │ │ ├── _scriptapi_symbol.h │ │ │ │ ├── bridgegraph.h │ │ │ │ ├── bridgelist.h │ │ │ │ ├── bridgemain.h │ │ │ │ ├── capstone/ │ │ │ │ │ ├── arm.h │ │ │ │ │ ├── arm64.h │ │ │ │ │ ├── capstone.h │ │ │ │ │ ├── capstone_x64.lib │ │ │ │ │ ├── capstone_x86.lib │ │ │ │ │ ├── m68k.h │ │ │ │ │ ├── mips.h │ │ │ │ │ ├── platform.h │ │ │ │ │ ├── ppc.h │ │ │ │ │ ├── sparc.h │ │ │ │ │ ├── systemz.h │ │ │ │ │ ├── x86.h │ │ │ │ │ └── xcore.h │ │ │ │ ├── dbghelp/ │ │ │ │ │ ├── dbghelp.h │ │ │ │ │ ├── dbghelp_x64.a │ │ │ │ │ ├── dbghelp_x64.lib │ │ │ │ │ ├── dbghelp_x86.a │ │ │ │ │ └── dbghelp_x86.lib │ │ │ │ ├── jansson/ │ │ │ │ │ ├── jansson.h │ │ │ │ │ ├── jansson_config.h │ │ │ │ │ ├── jansson_x64.a │ │ │ │ │ ├── jansson_x64.lib │ │ │ │ │ ├── jansson_x64dbg.h │ │ │ │ │ ├── jansson_x86.a │ │ │ │ │ └── jansson_x86.lib │ │ │ │ ├── lz4/ │ │ │ │ │ ├── lz4.h │ │ │ │ │ ├── lz4_x64.a │ │ │ │ │ ├── lz4_x64.lib │ │ │ │ │ ├── lz4_x86.a │ │ │ │ │ ├── lz4_x86.lib │ │ │ │ │ ├── lz4file.h │ │ │ │ │ └── lz4hc.h │ │ │ │ ├── x32bridge.lib │ │ │ │ ├── x32dbg.lib │ │ │ │ ├── x64bridge.lib │ │ │ │ ├── x64dbg.lib │ │ │ │ └── yara/ │ │ │ │ ├── yara/ │ │ │ │ │ ├── ahocorasick.h │ │ │ │ │ ├── arena.h │ │ │ │ │ ├── atoms.h │ │ │ │ │ ├── compiler.h │ │ │ │ │ ├── dotnet.h │ │ │ │ │ ├── elf.h │ │ │ │ │ ├── endian.h │ │ │ │ │ ├── error.h │ │ │ │ │ ├── exec.h │ │ │ │ │ ├── exefiles.h │ │ │ │ │ ├── filemap.h │ │ │ │ │ ├── globals.h │ │ │ │ │ ├── hash.h │ │ │ │ │ ├── hex_lexer.h │ │ │ │ │ ├── integers.h │ │ │ │ │ ├── lexer.h │ │ │ │ │ ├── libyara.h │ │ │ │ │ ├── limits.h │ │ │ │ │ ├── mem.h │ │ │ │ │ ├── modules.h │ │ │ │ │ ├── object.h │ │ │ │ │ ├── parser.h │ │ │ │ │ ├── pe.h │ │ │ │ │ ├── pe_utils.h │ │ │ │ │ ├── proc.h │ │ │ │ │ ├── re.h │ │ │ │ │ ├── re_lexer.h │ │ │ │ │ ├── rules.h │ │ │ │ │ ├── scan.h │ │ │ │ │ ├── sizedstr.h │ │ │ │ │ ├── stream.h │ │ │ │ │ ├── strutils.h │ │ │ │ │ ├── threading.h │ │ │ │ │ ├── types.h │ │ │ │ │ └── utils.h │ │ │ │ ├── yara.h │ │ │ │ ├── yara_x64.lib │ │ │ │ └── yara_x86.lib │ │ │ ├── qpc.hpp │ │ │ ├── rtf.h │ │ │ ├── settings.h │ │ │ ├── structmemmap.h │ │ │ ├── ui/ │ │ │ │ ├── ctrl/ │ │ │ │ │ ├── uicheckbox.hpp │ │ │ │ │ ├── uicombobox.hpp │ │ │ │ │ └── uicontrolbase.hpp │ │ │ │ ├── ui.h │ │ │ │ └── uiwrapper.hpp │ │ │ └── util.h │ │ ├── instparse.cpp │ │ ├── plugin.cpp │ │ ├── rtf.cpp │ │ ├── settings.cpp │ │ ├── structmemmap.cpp │ │ ├── syslib.cpp │ │ ├── ui/ │ │ │ └── ui.cpp │ │ └── util.cpp │ ├── x64dbgApiBreak.vcxproj │ └── x64dbgApiBreak.vcxproj.filters └── x64dbgApiBreak.sln
SYMBOL INDEX (994 symbols across 85 files)
FILE: x64dbgApiBreak/src/apibreak.cpp
function AbpReleaseBreakpointResources (line 23) | void AbpReleaseBreakpointResources()
function PBREAKPOINT_INFO (line 43) | PBREAKPOINT_INFO AbpLookupBreakpoint(duint addr)
function AbpRegisterBreakpoint (line 55) | bool AbpRegisterBreakpoint(duint addr, DWORD options, BpCallbackContext ...
function AbpDeregisterBreakpoint (line 79) | bool AbpDeregisterBreakpoint(duint addr)
function ModuleApiInfo (line 98) | ModuleApiInfo *AbpSearchModuleApiInfo(const char *name)
function ApiFunctionInfo (line 109) | ApiFunctionInfo *AbpSearchApiFunctionInfo(ModuleApiInfo *moduleInfo, con...
function AbpLinkApiExportsToModule (line 127) | void AbpLinkApiExportsToModule(ListInfo *moduleList)
function AbpDeregisterModule (line 150) | bool AbpDeregisterModule(ModuleApiInfo *mai)
function AbpRegisterApi (line 188) | bool AbpRegisterApi(SymbolInfo *sym, ApiFunctionInfo **pafi)
function INTERNAL_EXPORT (line 242) | INTERNAL_EXPORT ApiFunctionInfo *AbiGetAfi(const char *module, const cha...
function AbpNeedsReloadModuleAPIs (line 255) | bool AbpNeedsReloadModuleAPIs()
function duint (line 265) | duint AbpGetPEDataOfMainModule2(ModuleInfo *mi, duint type, int sectIndex)
function duint (line 270) | duint AbpGetPEDataOfMainModule(duint type, int sectIndex)
function INTERNAL_EXPORT (line 280) | INTERNAL_EXPORT bool AbiRegisterDynamicApi(const char *module, const cha...
function INTERNAL_EXPORT (line 306) | INTERNAL_EXPORT int AbiGetMainModuleCodeSections(ModuleSectionInfo **msi)
function AbDebuggerRun (line 336) | void AbDebuggerRun()
function AbDebuggerPause (line 341) | void AbDebuggerPause()
function AbDebuggerWaitUntilPaused (line 346) | void AbDebuggerWaitUntilPaused()
function AbCmdExecFormat (line 352) | bool AbCmdExecFormat(const char *format, ...)
function AbGetDebuggedImageName (line 372) | bool AbGetDebuggedImageName(char *buffer)
function AbGetDebuggedModuleInfo (line 383) | bool AbGetDebuggedModuleInfo(ModuleInfo *modInfo)
function AbGetDebuggedModulePath (line 395) | bool AbGetDebuggedModulePath(char *pathBuf, int bufLen)
function duint (line 419) | duint AbGetDebuggedImageBase()
function AbHasDebuggingProcess (line 434) | bool AbHasDebuggingProcess()
function AbReleaseModuleResources (line 446) | void AbReleaseModuleResources()
function AbLoadAvailableModuleAPIs (line 454) | bool AbLoadAvailableModuleAPIs(bool onlyImportsByExe)
function AbEnumModuleNames (line 593) | int AbEnumModuleNames(APIMODULE_ENUM_PROC enumProc, void *user)
function AbEnumApiFunctionNames (line 606) | void AbEnumApiFunctionNames(APIMODULE_ENUM_PROC enumProc, const char *mo...
function AbpReturnToCaller (line 620) | bool AbpReturnToCaller(duint callerIp, duint csp)
function AbpCallback0 (line 646) | void AbpCallback0(__BpCallbackContext *bpx)
function AbpBacktrackingBreakpointCallback (line 653) | void AbpBacktrackingBreakpointCallback(__BpCallbackContext *bpx)
function AbSetAPIBreakpointOnCallers (line 698) | bool AbSetAPIBreakpointOnCallers(const char *module, const char *apiFunc...
function AbSetAPIBreakpoint (line 713) | bool AbSetAPIBreakpoint(const char *module, const char *apiFunction, dui...
function AbSetInstructionBreakpoint (line 718) | bool AbSetInstructionBreakpoint(duint instrAddr, AB_BREAKPOINT_CALLBACK ...
function AbSetBreakpointEx (line 729) | bool AbSetBreakpointEx(const char *module, const char *apiFunction, duin...
function AbDeleteBreakpoint (line 795) | bool AbDeleteBreakpoint(duint addr)
FILE: x64dbgApiBreak/src/callfind.cpp
function AbpInsertCallList (line 7) | bool AbpInsertCallList(ApiFunctionInfo *afi,duint callAddr)
function INTERNAL_EXPORT (line 53) | INTERNAL_EXPORT bool AbiIsIndirectCall(duint code, ApiFunctionInfo *afi,...
function FORWARDED (line 82) | FORWARDED int AbiSearchCallersForAFI(duint codeBase, duint codeSize, Api...
FILE: x64dbgApiBreak/src/dynapidetect.cpp
function CachedInst (line 75) | CachedInst *AbpGetCachedInst(int index)
function INTERNAL_EXPORT (line 83) | INTERNAL_EXPORT void AbiEmptyInstructionCache()
function INTERNAL_EXPORT (line 89) | INTERNAL_EXPORT void AbiCacheInstruction(duint addr, BASIC_INSTRUCTION_I...
function AbpRegisterDeferredAPIRegistration (line 115) | bool AbpRegisterDeferredAPIRegistration(const char *module, const char *...
function INTERNAL_EXPORT (line 149) | INTERNAL_EXPORT duint AbpGetActualDataAddress(BASIC_INSTRUCTION_INFO *inst)
function AbpReadStringFromInstructionSourceAddress (line 159) | bool AbpReadStringFromInstructionSourceAddress(BASIC_INSTRUCTION_INFO *i...
function AbpGetApiStringFromProcLoader (line 187) | bool AbpGetApiStringFromProcLoader(short argNumber, char *nameBuf)
function AbpExposeStringArgument (line 282) | bool AbpExposeStringArgument(short argNumber, char *buf)
function AbpIsValidApi (line 287) | bool AbpIsValidApi(const char *module, const char *function, duint *rva)
function INTERNAL_EXPORT (line 395) | INTERNAL_EXPORT duint AbiGetCallDestinationAddress(BASIC_INSTRUCTION_INF...
function AbpIsAPICall2 (line 425) | bool AbpIsAPICall2(duint code, ApiFunctionInfo *afi, BASIC_INSTRUCTION_I...
function AbpIsAPICall (line 451) | bool AbpIsAPICall(duint code, ApiFunctionInfo *afi, BASIC_INSTRUCTION_IN...
function AbpIsLoadLibraryXXXCall (line 458) | bool AbpIsLoadLibraryXXXCall(ApiFunctionInfo **afiList, int afiCount,dui...
function AbpRegisterAPI (line 476) | bool AbpRegisterAPI(char *module, char *api)
function INTERNAL_EXPORT (line 503) | INTERNAL_EXPORT void AbiRaiseDeferredLoader(const char *dllName, duint b...
function INTERNAL_EXPORT (line 562) | INTERNAL_EXPORT bool AbiDetectAPIsUsingByGetProcAddress()
function INTERNAL_EXPORT (line 711) | INTERNAL_EXPORT void AbiReleaseDeferredResources()
function INTERNAL_EXPORT (line 726) | INTERNAL_EXPORT void AbiInitDynapi()
function INTERNAL_EXPORT (line 731) | INTERNAL_EXPORT void AbiUninitDynapi()
FILE: x64dbgApiBreak/src/hlprs.cpp
function HlpDebugPrint (line 4) | void HlpDebugPrint(const char *format, ...)
function LPSTR (line 22) | LPSTR HlpCloneStringA(LPCSTR str)
function LPWSTR (line 42) | LPWSTR HlpAnsiToWideString(LPCSTR str)
function LPSTR (line 64) | LPSTR HlpWideToAnsiString(LPCWSTR str)
function HlpTrimChar (line 86) | bool HlpTrimChar(LPSTR str, CHAR chr, int option)
function HlpReplaceStringW (line 124) | bool HlpReplaceStringW(LPWSTR string, ULONG stringMaxSize, LPCWSTR find,...
function HlpReplaceStringA (line 209) | bool HlpReplaceStringA(LPSTR string, ULONG stringMaxSize, LPCSTR find, L...
function HlpBeginsWithA (line 237) | bool HlpBeginsWithA(LPCSTR look, LPCSTR find,BOOL caseSens, LONG findLen)
function HlpBeginsWithW (line 253) | bool HlpBeginsWithW(LPCWSTR look, LPCWSTR find, BOOL caseSens, LONG find...
function HlpEndsWithA (line 274) | bool HlpEndsWithA(LPCSTR look, LPCSTR find, BOOL caseSens, LONG findLen)
function HlpEndsWithW (line 290) | bool HlpEndsWithW(LPCWSTR look, LPCWSTR find, BOOL caseSens, LONG findLen)
function LONG (line 313) | LONG HlpPrintFormatBufferExA(LPSTR *buffer, LPCSTR format, va_list vl)
function LONG (line 329) | LONG HlpPrintFormatBufferA(LPSTR *buffer, LPCSTR format, ...)
function LONG (line 344) | LONG HlpPrintFormatBufferExW(LPWSTR *buffer, LPCWSTR format, va_list vl)
function LONG (line 360) | LONG HlpPrintFormatBufferW(LPWSTR *buffer, LPCWSTR format, ...)
function LONG (line 374) | LONG HlpConcateStringFormatA(LPSTR buffer, LONG bufLen, LPCSTR format, ...)
function LONG (line 396) | LONG HlpPathFromFilenameA(LPSTR fileName, LPSTR path, LONG pathBufSize, ...
function LONG (line 426) | LONG HlpPathFromFilenameW(LPWSTR fileName, LPWSTR path, LONG pathBufSize...
FILE: x64dbgApiBreak/src/incl/apibreak.h
type __ModuleApiInfo (line 36) | struct __ModuleApiInfo
type __BpCallbackContext (line 37) | struct __BpCallbackContext
type ApiFunctionInfo (line 39) | typedef struct
type unordered_map (line 52) | typedef unordered_map<
type ModuleApiInfo (line 57) | typedef struct __ModuleApiInfo
type vector (line 65) | typedef vector<ModuleApiInfo *> modlist;
type __BpCallbackContext (line 70) | struct __BpCallbackContext
type __BREAKPOINT_INFO (line 72) | struct __BREAKPOINT_INFO
type BpCallbackContext (line 74) | typedef struct __BpCallbackContext
type BREAKPOINT_INFO (line 85) | typedef struct __BREAKPOINT_INFO
FILE: x64dbgApiBreak/src/incl/dlgs/ApiCallMapForm.hpp
class ApiCallMapForm (line 11) | class ApiCallMapForm : public UiWrapper
method DWORD (line 19) | static DWORD CALLBACK EditStreamCallback(
method ApiCallMapForm (line 51) | ApiCallMapForm(LPSTR callMapContent) : UiWrapper(IDD_APICALLMAP, true)
method OnLoaded (line 58) | void OnLoaded()
method OnClose (line 63) | void OnClose()
method OnCommand (line 69) | void OnCommand(WPARAM wp, LPARAM lp)
method OnInit (line 80) | void OnInit()
method ShowDialog (line 96) | bool ShowDialog()
FILE: x64dbgApiBreak/src/incl/dlgs/MainForm.hpp
class MainForm (line 17) | class MainForm : public UiWrapper
method InvalidateApiFunctionList (line 23) | void InvalidateApiFunctionList()
method SetBP (line 34) | void SetBP()
method ModuleEnumerator (line 70) | static void ModuleEnumerator(LPCSTR modName,void *user)
method ApiFunctionEnumerator (line 76) | static void ApiFunctionEnumerator(LPCSTR funcName, void *user)
method ApiLoadWorker (line 84) | static int WINAPI ApiLoadWorker(void *arg)
method MainForm (line 112) | MainForm() : UiWrapper(IDD_MAIN,true)
method OnCommand (line 116) | void OnCommand(WPARAM wp, LPARAM lp)
method OnInit (line 140) | void OnInit()
method ShowDialog (line 161) | bool ShowDialog()
FILE: x64dbgApiBreak/src/incl/dlgs/SettingsForm.hpp
class SettingsForm (line 9) | class SettingsForm : public UiWrapper
method FillGui (line 17) | void FillGui()
method GetFromGUI (line 33) | void GetFromGUI()
method LoadSettings (line 47) | bool LoadSettings()
method SaveSettings (line 58) | bool SaveSettings()
method SettingsForm (line 66) | SettingsForm() : UiWrapper(IDD_SETTINGS, true)
method OnCommand (line 70) | void OnCommand(WPARAM wp, LPARAM lp)
method OnInit (line 96) | void OnInit()
method ShowDialog (line 110) | bool ShowDialog()
FILE: x64dbgApiBreak/src/incl/instparse.h
type InstInfo (line 6) | typedef struct
type RegId (line 38) | typedef enum
FILE: x64dbgApiBreak/src/incl/pluginsdk/TitanEngine/TitanEngine.h
type PE32Struct (line 325) | typedef struct
type PE64Struct (line 355) | typedef struct
type PE64Struct (line 386) | typedef PE64Struct PEStruct;
type PE32Struct (line 388) | typedef PE32Struct PEStruct;
type ImportEnumData (line 391) | typedef struct
type THREAD_ITEM_DATA (line 402) | typedef struct
type LIBRARY_ITEM_DATA (line 417) | typedef struct
type LIBRARY_ITEM_DATAW (line 427) | typedef struct
type PROCESS_ITEM_DATA (line 437) | typedef struct
type HandlerArray (line 449) | typedef struct
type PluginInformation (line 455) | typedef struct
type HOOK_ENTRY (line 476) | typedef struct HOOK_ENTRY
type FILE_STATUS_INFO (line 520) | typedef struct
type FILE_FIX_INFO (line 551) | typedef struct
type DECLSPEC_ALIGN (line 590) | struct DECLSPEC_ALIGN
type YmmRegister_t (line 596) | typedef struct
type x87FPURegister_t (line 602) | typedef struct
type x87FPU_t (line 609) | typedef struct
type TITAN_ENGINE_CONTEXT_t (line 621) | typedef struct
FILE: x64dbgApiBreak/src/incl/pluginsdk/XEDParse/XEDParse.h
type XEDPARSE_STATUS (line 22) | enum XEDPARSE_STATUS
type XEDPARSE (line 30) | struct XEDPARSE
FILE: x64dbgApiBreak/src/incl/pluginsdk/_dbgfunctions.h
type DBGPATCHINFO (line 8) | typedef struct
type DBGCALLSTACKENTRY (line 16) | typedef struct
type DBGCALLSTACK (line 24) | typedef struct
type DBGSEHRECORD (line 30) | typedef struct
type DBGSEHCHAIN (line 36) | typedef struct
type DBGPROCESSINFO (line 42) | typedef struct
type DBGRELOCATIONINFO (line 50) | typedef struct
type TRACERECORDBYTETYPE (line 57) | typedef enum
type TRACERECORDTYPE (line 77) | typedef enum
type HANDLEINFO (line 85) | typedef struct
type TCPCONNECTIONINFO (line 95) | typedef struct
type WINDOW_INFO (line 105) | typedef struct
type HEAPINFO (line 119) | typedef struct
type CONSTANTINFO (line 126) | typedef struct
type duint (line 135) | typedef duint(*MODBASEFROMADDR)(duint addr);
type duint (line 136) | typedef duint(*MODBASEFROMNAME)(const char* modname);
type duint (line 137) | typedef duint(*MODSIZEFROMADDR)(duint addr);
type duint (line 163) | typedef duint(*FILEOFFSETTOVA)(const char* modname, duint offset);
type duint (line 164) | typedef duint(*VATOFILEOFFSET)(duint va);
type duint (line 165) | typedef duint(*GETADDRFROMLINE)(const char* szSourceFile, int line, duin...
type TRACERECORDBYTETYPE (line 173) | typedef TRACERECORDBYTETYPE(*GETTRACERECORDBYTETYPE)(duint address);
type TRACERECORDTYPE (line 175) | typedef TRACERECORDTYPE(*GETTRACERECORDTYPE)(duint pageAddress);
type duint (line 179) | typedef duint(*GETDBGEVENTS)();
type duint (line 194) | typedef duint(*MEMBPSIZE)(duint addr);
type duint (line 198) | typedef duint(*DBGETHASH)();
type DBGFUNCTIONS (line 203) | typedef struct DBGFUNCTIONS_
FILE: x64dbgApiBreak/src/incl/pluginsdk/_plugins.h
type PLUG_INITSTRUCT (line 32) | typedef struct
type PLUG_SETUPSTRUCT (line 42) | typedef struct
type PLUG_SCRIPTSTRUCT (line 52) | typedef struct
type PLUG_CB_INITDEBUG (line 58) | typedef struct
type PLUG_CB_STOPDEBUG (line 63) | typedef struct
type PLUG_CB_CREATEPROCESS (line 68) | typedef struct
type PLUG_CB_EXITPROCESS (line 76) | typedef struct
type PLUG_CB_CREATETHREAD (line 81) | typedef struct
type PLUG_CB_EXITTHREAD (line 87) | typedef struct
type PLUG_CB_SYSTEMBREAKPOINT (line 93) | typedef struct
type PLUG_CB_LOADDLL (line 98) | typedef struct
type PLUG_CB_UNLOADDLL (line 105) | typedef struct
type PLUG_CB_OUTPUTDEBUGSTRING (line 110) | typedef struct
type PLUG_CB_EXCEPTION (line 115) | typedef struct
type PLUG_CB_BREAKPOINT (line 120) | typedef struct
type PLUG_CB_PAUSEDEBUG (line 125) | typedef struct
type PLUG_CB_RESUMEDEBUG (line 130) | typedef struct
type PLUG_CB_STEPPED (line 135) | typedef struct
type PLUG_CB_ATTACH (line 140) | typedef struct
type PLUG_CB_DETACH (line 145) | typedef struct
type PLUG_CB_DEBUGEVENT (line 150) | typedef struct
type PLUG_CB_MENUENTRY (line 155) | typedef struct
type PLUG_CB_WINEVENT (line 160) | typedef struct
type PLUG_CB_WINEVENTGLOBAL (line 167) | typedef struct
type PLUG_CB_LOADSAVEDB (line 173) | typedef struct
type PLUG_CB_FILTERSYMBOL (line 179) | typedef struct
type PLUG_CB_TRACEEXECUTE (line 185) | typedef struct
type PLUG_CB_SELCHANGED (line 191) | typedef struct
type PLUG_CB_ANALYZE (line 197) | typedef struct
type PLUG_CB_ADDRINFO (line 202) | typedef struct
type PLUG_CB_VALFROMSTRING (line 209) | typedef struct
type PLUG_CB_VALTOSTRING (line 219) | typedef struct
type PLUG_CB_MENUPREPARE (line 226) | typedef struct
type CBTYPE (line 232) | typedef enum
type FORMATRESULT (line 268) | typedef enum
type duint (line 280) | typedef duint(*CBPLUGINEXPRFUNCTION)(int argc, duint* argv, void* userda...
type FORMATRESULT (line 281) | typedef FORMATRESULT(*CBPLUGINFORMATFUNCTION)(char* dest, size_t destCou...
FILE: x64dbgApiBreak/src/incl/pluginsdk/_scriptapi_argument.h
function namespace (line 6) | namespace Script
FILE: x64dbgApiBreak/src/incl/pluginsdk/_scriptapi_assembler.h
function namespace (line 6) | namespace Script
FILE: x64dbgApiBreak/src/incl/pluginsdk/_scriptapi_bookmark.h
function namespace (line 6) | namespace Script
FILE: x64dbgApiBreak/src/incl/pluginsdk/_scriptapi_comment.h
function namespace (line 6) | namespace Script
FILE: x64dbgApiBreak/src/incl/pluginsdk/_scriptapi_debug.h
function namespace (line 6) | namespace Script
FILE: x64dbgApiBreak/src/incl/pluginsdk/_scriptapi_flag.h
function namespace (line 6) | namespace Script
FILE: x64dbgApiBreak/src/incl/pluginsdk/_scriptapi_function.h
function namespace (line 6) | namespace Script
FILE: x64dbgApiBreak/src/incl/pluginsdk/_scriptapi_gui.h
function namespace (line 6) | namespace Script
FILE: x64dbgApiBreak/src/incl/pluginsdk/_scriptapi_label.h
function namespace (line 6) | namespace Script
FILE: x64dbgApiBreak/src/incl/pluginsdk/_scriptapi_memory.h
function namespace (line 6) | namespace Script
FILE: x64dbgApiBreak/src/incl/pluginsdk/_scriptapi_misc.h
function namespace (line 6) | namespace Script
FILE: x64dbgApiBreak/src/incl/pluginsdk/_scriptapi_module.h
function namespace (line 6) | namespace Script
FILE: x64dbgApiBreak/src/incl/pluginsdk/_scriptapi_pattern.h
function namespace (line 6) | namespace Script
FILE: x64dbgApiBreak/src/incl/pluginsdk/_scriptapi_register.h
function namespace (line 6) | namespace Script
FILE: x64dbgApiBreak/src/incl/pluginsdk/_scriptapi_stack.h
function namespace (line 6) | namespace Script
FILE: x64dbgApiBreak/src/incl/pluginsdk/_scriptapi_symbol.h
function namespace (line 6) | namespace Script
FILE: x64dbgApiBreak/src/incl/pluginsdk/bridgegraph.h
type BridgeCFInstruction (line 4) | typedef struct
type BridgeCFNodeList (line 10) | typedef struct
type BridgeCFGraphList (line 26) | typedef struct
function BridgeCFNode (line 41) | struct BridgeCFNode
function BridgeCFGraph (line 130) | struct BridgeCFGraph
function explicit (line 160) | explicit BridgeCFGraph(duint entryPoint)
function AddNode (line 166) | void AddNode(const BridgeCFNode & node)
function AddParent (line 173) | void AddParent(duint child, duint parent)
FILE: x64dbgApiBreak/src/incl/pluginsdk/bridgelist.h
type ListInfo (line 4) | typedef struct
function Type (line 46) | Type* Data() const
function Cleanup (line 65) | void Cleanup()
FILE: x64dbgApiBreak/src/incl/pluginsdk/bridgemain.h
type duint (line 18) | typedef unsigned long long duint;
type dsint (line 19) | typedef signed long long dsint;
type duint (line 21) | typedef unsigned long duint;
type dsint (line 22) | typedef signed long dsint;
type DBGSTATE (line 158) | typedef enum
type SEGMENTREG (line 166) | typedef enum
type ADDRINFOFLAGS (line 177) | typedef enum
type BPXTYPE (line 189) | typedef enum
type FUNCTYPE (line 199) | typedef enum
type LOOPTYPE (line 208) | typedef enum
type XREFTYPE (line 219) | typedef enum
type ARGTYPE (line 227) | typedef enum
type DBGMSG (line 236) | typedef enum
type SCRIPTLINETYPE (line 314) | typedef enum
type SCRIPTBRANCHTYPE (line 323) | typedef enum
type DISASM_INSTRTYPE (line 336) | typedef enum
type DISASM_ARGTYPE (line 343) | typedef enum
type STRING_TYPE (line 349) | typedef enum
type THREADPRIORITY (line 356) | typedef enum
type THREADWAITREASON (line 368) | typedef enum
type MEMORY_SIZE (line 409) | typedef enum
type ENCODETYPE (line 417) | typedef enum
type WATCHVARTYPE (line 441) | typedef enum
type WATCHDOGMODE (line 451) | typedef enum
type BPHWTYPE (line 460) | typedef enum
type BPMEMTYPE (line 467) | typedef enum
type BPDLLTYPE (line 475) | typedef enum
type BPEXTYPE (line 482) | typedef enum
type BPHWSIZE (line 489) | typedef enum
type MEMORY_SIZE (line 498) | typedef MEMORY_SIZE VALUE_SIZE;
type SYMBOLINFO (line 499) | typedef struct SYMBOLINFO_ SYMBOLINFO;
type DBGFUNCTIONS (line 500) | typedef struct DBGFUNCTIONS_ DBGFUNCTIONS;
type MEMPAGE (line 505) | typedef struct
type MEMMAP (line 511) | typedef struct
type BRIDGEBP (line 517) | typedef struct
type BPMAP (line 540) | typedef struct
type WATCHINFO (line 546) | typedef struct
type FUNCTION (line 558) | typedef struct
type LOOP (line 565) | typedef struct
type BRIDGE_ADDRINFO (line 573) | typedef struct
type SYMBOLINFO_ (line 585) | struct SYMBOLINFO_
type SYMBOLMODULEINFO (line 593) | typedef struct
type SYMBOLCBINFO (line 599) | typedef struct
type FLAGS (line 606) | typedef struct
type MXCSRFIELDS (line 619) | typedef struct
type X87STATUSWORDFIELDS (line 639) | typedef struct
type X87CONTROLWORDFIELDS (line 659) | typedef struct
type DECLSPEC_ALIGN (line 675) | struct DECLSPEC_ALIGN
type YMMREGISTER (line 681) | typedef struct
type X87FPUREGISTER (line 687) | typedef struct
type X87FPU (line 694) | typedef struct
type REGISTERCONTEXT (line 706) | typedef struct
type LASTERROR (line 752) | typedef struct
type LASTSTATUS (line 758) | typedef struct
type REGDUMP (line 764) | typedef struct
type DISASM_ARG (line 777) | typedef struct
type DISASM_INSTR (line 787) | typedef struct
type STACK_COMMENT (line 796) | typedef struct
type THREADINFO (line 802) | typedef struct
type THREADALLINFO (line 812) | typedef struct
type THREADLIST (line 826) | typedef struct
type MEMORY_INFO (line 833) | typedef struct
type VALUE_INFO (line 840) | typedef struct
type BASIC_INSTRUCTION_INFO (line 851) | typedef struct
type SCRIPTBRANCH (line 863) | typedef struct
type FUNCTION_LOOP_INFO (line 870) | typedef struct
type XREF_RECORD (line 879) | typedef struct
type XREF_INFO (line 885) | typedef struct
type GUIMSG (line 1033) | typedef enum
type _TYPEDESCRIPTOR (line 1146) | struct _TYPEDESCRIPTOR
type _TYPEDESCRIPTOR (line 1151) | struct _TYPEDESCRIPTOR
type CELLINFO (line 1154) | typedef struct
type SELECTIONDATA (line 1161) | typedef struct
type ICONDATA (line 1167) | typedef struct
type SCRIPTTYPEINFO (line 1173) | typedef struct
type ACTIVEVIEW (line 1181) | typedef struct
type TYPEDESCRIPTOR (line 1189) | typedef struct _TYPEDESCRIPTOR
FILE: x64dbgApiBreak/src/incl/pluginsdk/capstone/arm.h
type arm_shifter (line 18) | typedef enum arm_shifter
type arm_cc (line 34) | typedef enum arm_cc
type arm_sysreg (line 54) | typedef enum arm_sysreg
type arm_mem_barrier (line 143) | typedef enum arm_mem_barrier
type arm_op_type (line 165) | typedef enum arm_op_type
type arm_setend_type (line 179) | typedef enum arm_setend_type
type arm_cpsmode_type (line 186) | typedef enum arm_cpsmode_type
type arm_cpsflag_type (line 194) | typedef enum arm_cpsflag_type
type arm_vectordata_type (line 204) | typedef enum arm_vectordata_type
type arm_reg (line 261) | typedef enum arm_reg
type arm_op_mem (line 390) | typedef struct arm_op_mem
type cs_arm_op (line 400) | typedef struct cs_arm_op
type cs_arm (line 435) | typedef struct cs_arm
type arm_insn (line 455) | typedef enum arm_insn
type arm_insn_group (line 898) | typedef enum arm_insn_group
FILE: x64dbgApiBreak/src/incl/pluginsdk/capstone/arm64.h
type arm64_shifter (line 18) | typedef enum arm64_shifter
type arm64_extender (line 29) | typedef enum arm64_extender
type arm64_cc (line 43) | typedef enum arm64_cc
type arm64_sysreg (line 67) | typedef enum arm64_sysreg
type arm64_msr_reg (line 169) | typedef enum arm64_msr_reg
type arm64_pstate (line 190) | typedef enum arm64_pstate
type arm64_vas (line 199) | typedef enum arm64_vas
type arm64_vess (line 214) | typedef enum arm64_vess
type arm64_barrier_op (line 224) | typedef enum arm64_barrier_op
type arm64_op_type (line 242) | typedef enum arm64_op_type
type arm64_tlbi_op (line 259) | typedef enum arm64_tlbi_op
type arm64_at_op (line 297) | typedef enum arm64_at_op
type arm64_dc_op (line 314) | typedef enum arm64_dc_op
type arm64_ic_op (line 328) | typedef enum arm64_ic_op
type arm64_prefetch_op (line 337) | typedef enum arm64_prefetch_op
type arm64_reg (line 362) | typedef enum arm64_reg
type arm64_op_mem (line 639) | typedef struct arm64_op_mem
type cs_arm64_op (line 647) | typedef struct cs_arm64_op
type cs_arm64 (line 678) | typedef struct cs_arm64
type arm64_insn (line 692) | typedef enum arm64_insn
type arm64_insn_group (line 1161) | typedef enum arm64_insn_group
FILE: x64dbgApiBreak/src/incl/pluginsdk/capstone/capstone.h
type csh (line 71) | typedef size_t csh;
type cs_arch (line 74) | typedef enum cs_arch
type cs_mode (line 100) | typedef enum cs_mode
type cs_opt_mem (line 135) | typedef struct cs_opt_mem
type cs_opt_mnem (line 148) | typedef struct cs_opt_mnem
type cs_opt_type (line 157) | typedef enum cs_opt_type
type cs_opt_value (line 171) | typedef enum cs_opt_value
type cs_op_type (line 183) | typedef enum cs_op_type
type cs_ac_type (line 194) | typedef enum cs_ac_type
type cs_group_type (line 202) | typedef enum cs_group_type
type cs_opt_skipdata (line 230) | typedef struct cs_opt_skipdata
type cs_detail (line 270) | typedef struct cs_detail
type cs_insn (line 297) | typedef struct cs_insn
type cs_err (line 346) | typedef enum cs_err
FILE: x64dbgApiBreak/src/incl/pluginsdk/capstone/m68k.h
type m68k_reg (line 20) | typedef enum m68k_reg
type m68k_address_mode (line 80) | typedef enum m68k_address_mode
type m68k_op_type (line 112) | typedef enum m68k_op_type
type m68k_op_mem (line 126) | typedef struct m68k_op_mem
type cs_m68k_op (line 142) | typedef struct cs_m68k_op
type m68k_cpu_size (line 163) | typedef enum m68k_cpu_size
type m68k_fpu_size (line 172) | typedef enum m68k_fpu_size
type m68k_size_type (line 181) | typedef enum m68k_size_type
type m68k_op_size (line 190) | typedef struct m68k_op_size
type cs_m68k (line 201) | typedef struct cs_m68k
type m68k_insn (line 210) | typedef enum m68k_insn
type m68k_group_type (line 593) | typedef enum m68k_group_type
FILE: x64dbgApiBreak/src/incl/pluginsdk/capstone/mips.h
type mips_op_type (line 22) | typedef enum mips_op_type
type mips_reg (line 31) | typedef enum mips_reg
type mips_op_mem (line 236) | typedef struct mips_op_mem
type cs_mips_op (line 243) | typedef struct cs_mips_op
type cs_mips (line 255) | typedef struct cs_mips
type mips_insn (line 264) | typedef enum mips_insn
type mips_insn_group (line 902) | typedef enum mips_insn_group
FILE: x64dbgApiBreak/src/incl/pluginsdk/capstone/ppc.h
type ppc_bc (line 18) | typedef enum ppc_bc
type ppc_bh (line 36) | typedef enum ppc_bh
type ppc_op_type (line 44) | typedef enum ppc_op_type
type ppc_reg (line 54) | typedef enum ppc_reg
type ppc_op_mem (line 275) | typedef struct ppc_op_mem
type ppc_op_crx (line 281) | typedef struct ppc_op_crx
type cs_ppc_op (line 289) | typedef struct cs_ppc_op
type cs_ppc (line 302) | typedef struct cs_ppc
type ppc_insn (line 320) | typedef enum ppc_insn
type ppc_insn_group (line 1443) | typedef enum ppc_insn_group
FILE: x64dbgApiBreak/src/incl/pluginsdk/capstone/sparc.h
type sparc_cc (line 22) | typedef enum sparc_cc
type sparc_hint (line 63) | typedef enum sparc_hint
type sparc_op_type (line 72) | typedef enum sparc_op_type
type sparc_reg (line 81) | typedef enum sparc_reg
type sparc_op_mem (line 184) | typedef struct sparc_op_mem
type cs_sparc_op (line 194) | typedef struct cs_sparc_op
type cs_sparc (line 206) | typedef struct cs_sparc
type sparc_insn (line 217) | typedef enum sparc_insn
type sparc_insn_group (line 506) | typedef enum sparc_insn_group
FILE: x64dbgApiBreak/src/incl/pluginsdk/capstone/systemz.h
type sysz_cc (line 18) | typedef enum sysz_cc
type sysz_op_type (line 39) | typedef enum sysz_op_type
type sysz_reg (line 49) | typedef enum sysz_reg
type sysz_op_mem (line 94) | typedef struct sysz_op_mem
type cs_sysz_op (line 105) | typedef struct cs_sysz_op
type cs_sysz (line 117) | typedef struct cs_sysz
type sysz_insn (line 127) | typedef enum sysz_insn
type sysz_insn_group (line 817) | typedef enum sysz_insn_group
FILE: x64dbgApiBreak/src/incl/pluginsdk/capstone/x86.h
type x86_reg (line 19) | typedef enum x86_reg
type x86_op_type (line 124) | typedef enum x86_op_type
type x86_xop_cc (line 133) | typedef enum x86_xop_cc
type x86_avx_bcast (line 147) | typedef enum x86_avx_bcast
type x86_sse_cc (line 157) | typedef enum x86_sse_cc
type x86_avx_cc (line 171) | typedef enum x86_avx_cc
type x86_avx_rm (line 209) | typedef enum x86_avx_rm
type x86_prefix (line 219) | typedef enum x86_prefix
type x86_op_mem (line 239) | typedef struct x86_op_mem
type cs_x86_op (line 249) | typedef struct cs_x86_op
type cs_x86 (line 275) | typedef struct cs_x86
type x86_insn (line 341) | typedef enum x86_insn
type x86_insn_group (line 1856) | typedef enum x86_insn_group
FILE: x64dbgApiBreak/src/incl/pluginsdk/capstone/xcore.h
type xcore_op_type (line 18) | typedef enum xcore_op_type
type xcore_reg (line 27) | typedef enum xcore_reg
type xcore_op_mem (line 67) | typedef struct xcore_op_mem
type cs_xcore_op (line 78) | typedef struct cs_xcore_op
type cs_xcore (line 90) | typedef struct cs_xcore
type xcore_insn (line 99) | typedef enum xcore_insn
type xcore_insn_group (line 228) | typedef enum xcore_insn_group
FILE: x64dbgApiBreak/src/incl/pluginsdk/dbghelp/dbghelp.h
type LOADED_IMAGE (line 110) | typedef struct _LOADED_IMAGE
type IMAGE_DEBUG_INFORMATION (line 354) | typedef struct _IMAGE_DEBUG_INFORMATION
type MODLOAD_DATA (line 527) | typedef struct _MODLOAD_DATA
type MODLOAD_CVMISC (line 536) | typedef struct _MODLOAD_CVMISC
type MODLOAD_PDBGUID_PDBAGE (line 546) | typedef struct _MODLOAD_PDBGUID_PDBAGE
type ADDRESS_MODE (line 556) | typedef enum
type ADDRESS64 (line 564) | typedef struct _tagADDRESS64
type ADDRESS (line 575) | typedef struct _tagADDRESS
function Address32To64 (line 582) | __inline
function Address64To32 (line 594) | __inline
type KDHELP64 (line 618) | typedef struct _KDHELP64
type KDHELP (line 684) | typedef struct _KDHELP
function KdHelp32To64 (line 745) | __inline
type STACKFRAME64 (line 765) | typedef struct _tagSTACKFRAME64
type STACKFRAME (line 784) | typedef struct _tagSTACKFRAME
type BOOL (line 801) | typedef
type PVOID (line 811) | typedef
type DWORD64 (line 818) | typedef
type DWORD64 (line 825) | typedef
type BOOL (line 858) | typedef
type PVOID (line 868) | typedef
type DWORD (line 875) | typedef
type DWORD (line 882) | typedef
type API_VERSION (line 909) | typedef struct API_VERSION
type SymTagEnum (line 1073) | enum SymTagEnum
type SYM_TYPE (line 1141) | typedef enum
type IMAGEHLP_SYMBOL64 (line 1159) | typedef struct _IMAGEHLP_SYMBOL64
type IMAGEHLP_SYMBOL64_PACKAGE (line 1169) | typedef struct _IMAGEHLP_SYMBOL64_PACKAGE
type IMAGEHLP_SYMBOLW64 (line 1175) | typedef struct _IMAGEHLP_SYMBOLW64
type IMAGEHLP_SYMBOLW64_PACKAGE (line 1185) | typedef struct _IMAGEHLP_SYMBOLW64_PACKAGE
type IMAGEHLP_SYMBOL (line 1204) | typedef struct _IMAGEHLP_SYMBOL
type IMAGEHLP_SYMBOL_PACKAGE (line 1214) | typedef struct _IMAGEHLP_SYMBOL_PACKAGE
type IMAGEHLP_SYMBOLW (line 1220) | typedef struct _IMAGEHLP_SYMBOLW
type IMAGEHLP_SYMBOLW_PACKAGE (line 1230) | typedef struct _IMAGEHLP_SYMBOLW_PACKAGE
type IMAGEHLP_MODULE64 (line 1242) | typedef struct _IMAGEHLP_MODULE64
type IMAGEHLP_MODULEW64 (line 1271) | typedef struct _IMAGEHLP_MODULEW64
type IMAGEHLP_MODULE (line 1306) | typedef struct _IMAGEHLP_MODULE
type IMAGEHLP_MODULEW (line 1320) | typedef struct _IMAGEHLP_MODULEW
type IMAGEHLP_LINE64 (line 1339) | typedef struct _IMAGEHLP_LINE64
type IMAGEHLP_LINEW64 (line 1348) | typedef struct _IMAGEHLP_LINEW64
type IMAGEHLP_LINE (line 1361) | typedef struct _IMAGEHLP_LINE
type IMAGEHLP_LINEW (line 1370) | typedef struct _IMAGEHLP_LINEW
type SOURCEFILE (line 1384) | typedef struct _SOURCEFILE
type SOURCEFILEW (line 1390) | typedef struct _SOURCEFILEW
type IMAGEHLP_CBA_READ_MEMORY (line 1414) | typedef struct _IMAGEHLP_CBA_READ_MEMORY
type IMAGEHLP_CBA_EVENT (line 1435) | typedef struct _IMAGEHLP_CBA_EVENT
type IMAGEHLP_CBA_EVENTW (line 1443) | typedef struct _IMAGEHLP_CBA_EVENTW
type IMAGEHLP_DEFERRED_SYMBOL_LOAD64 (line 1451) | typedef struct _IMAGEHLP_DEFERRED_SYMBOL_LOAD64
type IMAGEHLP_DEFERRED_SYMBOL_LOADW64 (line 1463) | typedef struct _IMAGEHLP_DEFERRED_SYMBOL_LOADW64
type IMAGEHLP_DEFERRED_SYMBOL_LOAD (line 1482) | typedef struct _IMAGEHLP_DEFERRED_SYMBOL_LOAD
type IMAGEHLP_DUPLICATE_SYMBOL64 (line 1494) | typedef struct _IMAGEHLP_DUPLICATE_SYMBOL64
type IMAGEHLP_DUPLICATE_SYMBOL (line 1506) | typedef struct _IMAGEHLP_DUPLICATE_SYMBOL
type OMAP (line 1561) | typedef struct _OMAP
type SRCCODEINFO (line 1842) | typedef struct _SRCCODEINFO
type SRCCODEINFOW (line 1853) | typedef struct _SRCCODEINFOW
type IMAGEHLP_SYMBOL_SRC (line 2355) | typedef struct _IMAGEHLP_SYMBOL_SRC
type MODULE_TYPE_INFO (line 2362) | typedef struct _MODULE_TYPE_INFO // AKA TYPTYP
type SYMBOL_INFO (line 2369) | typedef struct _SYMBOL_INFO
type SYMBOL_INFO_PACKAGE (line 2388) | typedef struct _SYMBOL_INFO_PACKAGE
type SYMBOL_INFOW (line 2394) | typedef struct _SYMBOL_INFOW
type SYMBOL_INFO_PACKAGEW (line 2413) | typedef struct _SYMBOL_INFO_PACKAGEW
type IMAGEHLP_STACK_FRAME (line 2419) | typedef struct _IMAGEHLP_STACK_FRAME
type VOID (line 2433) | typedef VOID IMAGEHLP_CONTEXT, *PIMAGEHLP_CONTEXT;
type IMAGEHLP_SYMBOL_TYPE_INFO (line 2679) | typedef enum _IMAGEHLP_SYMBOL_TYPE_INFO
type TI_FINDCHILDREN_PARAMS (line 2717) | typedef struct _TI_FINDCHILDREN_PARAMS
type IMAGEHLP_GET_TYPE_INFO_PARAMS (line 2737) | typedef struct _IMAGEHLP_GET_TYPE_INFO_PARAMS
type ULONG64 (line 2881) | typedef BOOL (WINAPI* SYMADDSOURCESTREAM)(HANDLE, ULONG64, PCSTR, PBYTE,...
type ULONG64 (line 2893) | typedef BOOL (WINAPI* SYMADDSOURCESTREAMA)(HANDLE, ULONG64, PCSTR, PBYTE...
type SYMSRV_INDEX_INFO (line 2999) | typedef struct
type SYMSRV_INDEX_INFOW (line 3013) | typedef struct
type PCSTR (line 3202) | typedef BOOL (WINAPI* PSYMBOLSERVERPROC)(PCSTR, PCSTR, PVOID, DWORD, DWO...
type PCSTR (line 3203) | typedef BOOL (WINAPI* PSYMBOLSERVERPROCA)(PCSTR, PCSTR, PVOID, DWORD, DW...
type PCWSTR (line 3204) | typedef BOOL (WINAPI* PSYMBOLSERVERPROCW)(PCWSTR, PCWSTR, PVOID, DWORD, ...
type PCSTR (line 3205) | typedef BOOL (WINAPI* PSYMBOLSERVERBYINDEXPROC)(PCSTR, PCSTR, PCSTR, PSTR);
type PCSTR (line 3206) | typedef BOOL (WINAPI* PSYMBOLSERVERBYINDEXPROCA)(PCSTR, PCSTR, PCSTR, PS...
type PCWSTR (line 3207) | typedef BOOL (WINAPI* PSYMBOLSERVERBYINDEXPROCW)(PCWSTR, PCWSTR, PCWSTR,...
type PVOID (line 3218) | typedef BOOL (WINAPI* PSYMBOLSERVERDELTANAME)(PCSTR, PVOID, DWORD, DWORD...
type PVOID (line 3219) | typedef BOOL (WINAPI* PSYMBOLSERVERDELTANAMEW)(PCWSTR, PVOID, DWORD, DWO...
type PCSTR (line 3220) | typedef BOOL (WINAPI* PSYMBOLSERVERGETSUPPLEMENT)(PCSTR, PCSTR, PCSTR, P...
type PCWSTR (line 3221) | typedef BOOL (WINAPI* PSYMBOLSERVERGETSUPPLEMENTW)(PCWSTR, PCWSTR, PCWST...
type PCSTR (line 3222) | typedef BOOL (WINAPI* PSYMBOLSERVERSTORESUPPLEMENT)(PCSTR, PCSTR, PCSTR,...
type PCWSTR (line 3223) | typedef BOOL (WINAPI* PSYMBOLSERVERSTORESUPPLEMENTW)(PCWSTR, PCWSTR, PCW...
type DWORD (line 3224) | typedef BOOL (WINAPI* PSYMBOLSERVERGETINDEXSTRING)(PVOID, DWORD, DWORD, ...
type DWORD (line 3225) | typedef BOOL (WINAPI* PSYMBOLSERVERGETINDEXSTRINGW)(PVOID, DWORD, DWORD,...
type PCSTR (line 3226) | typedef BOOL (WINAPI* PSYMBOLSERVERSTOREFILE)(PCSTR, PCSTR, PVOID, DWORD...
type PCWSTR (line 3227) | typedef BOOL (WINAPI* PSYMBOLSERVERSTOREFILEW)(PCWSTR, PCWSTR, PVOID, DW...
type DWORD (line 3606) | typedef DWORD RVA;
type ULONG64 (line 3607) | typedef ULONG64 RVA64;
type MINIDUMP_LOCATION_DESCRIPTOR (line 3609) | typedef struct _MINIDUMP_LOCATION_DESCRIPTOR
type MINIDUMP_LOCATION_DESCRIPTOR64 (line 3615) | typedef struct _MINIDUMP_LOCATION_DESCRIPTOR64
type MINIDUMP_MEMORY_DESCRIPTOR (line 3622) | typedef struct _MINIDUMP_MEMORY_DESCRIPTOR
type MINIDUMP_MEMORY_DESCRIPTOR64 (line 3633) | typedef struct _MINIDUMP_MEMORY_DESCRIPTOR64
type MINIDUMP_HEADER (line 3640) | typedef struct _MINIDUMP_HEADER
type MINIDUMP_DIRECTORY (line 3660) | typedef struct _MINIDUMP_DIRECTORY
type MINIDUMP_STRING (line 3667) | typedef struct _MINIDUMP_STRING
type MINIDUMP_STREAM_TYPE (line 3683) | typedef enum _MINIDUMP_STREAM_TYPE
type CPU_INFORMATION (line 3742) | typedef union _CPU_INFORMATION
type MINIDUMP_SYSTEM_INFO (line 3794) | typedef struct _MINIDUMP_SYSTEM_INFO
type MINIDUMP_THREAD (line 3862) | typedef struct _MINIDUMP_THREAD
type MINIDUMP_THREAD_LIST (line 3877) | typedef struct _MINIDUMP_THREAD_LIST
type MINIDUMP_THREAD_EX (line 3884) | typedef struct _MINIDUMP_THREAD_EX
type MINIDUMP_THREAD_EX_LIST (line 3900) | typedef struct _MINIDUMP_THREAD_EX_LIST
type MINIDUMP_EXCEPTION (line 3911) | typedef struct _MINIDUMP_EXCEPTION
type MINIDUMP_EXCEPTION_STREAM (line 3930) | typedef struct MINIDUMP_EXCEPTION_STREAM
type MINIDUMP_MODULE (line 3946) | typedef struct _MINIDUMP_MODULE
type MINIDUMP_MODULE_LIST (line 3965) | typedef struct _MINIDUMP_MODULE_LIST
type MINIDUMP_MEMORY_LIST (line 3976) | typedef struct _MINIDUMP_MEMORY_LIST
type MINIDUMP_MEMORY64_LIST (line 3982) | typedef struct _MINIDUMP_MEMORY64_LIST
type MINIDUMP_EXCEPTION_INFORMATION (line 3994) | typedef struct _MINIDUMP_EXCEPTION_INFORMATION
type MINIDUMP_EXCEPTION_INFORMATION64 (line 4001) | typedef struct _MINIDUMP_EXCEPTION_INFORMATION64
type MINIDUMP_HANDLE_OBJECT_INFORMATION_TYPE (line 4019) | typedef enum _MINIDUMP_HANDLE_OBJECT_INFORMATION_TYPE
type MINIDUMP_HANDLE_OBJECT_INFORMATION (line 4030) | typedef struct _MINIDUMP_HANDLE_OBJECT_INFORMATION
type MINIDUMP_HANDLE_DESCRIPTOR (line 4038) | typedef struct _MINIDUMP_HANDLE_DESCRIPTOR
type MINIDUMP_HANDLE_DESCRIPTOR_2 (line 4049) | typedef struct _MINIDUMP_HANDLE_DESCRIPTOR_2
type MINIDUMP_HANDLE_DESCRIPTOR_2 (line 4063) | typedef MINIDUMP_HANDLE_DESCRIPTOR_2 MINIDUMP_HANDLE_DESCRIPTOR_N;
type MINIDUMP_HANDLE_DESCRIPTOR_N (line 4064) | typedef MINIDUMP_HANDLE_DESCRIPTOR_N* PMINIDUMP_HANDLE_DESCRIPTOR_N;
type MINIDUMP_HANDLE_DATA_STREAM (line 4066) | typedef struct _MINIDUMP_HANDLE_DATA_STREAM
type MINIDUMP_HANDLE_OPERATION_LIST (line 4080) | typedef struct _MINIDUMP_HANDLE_OPERATION_LIST
type MINIDUMP_FUNCTION_TABLE_DESCRIPTOR (line 4093) | typedef struct _MINIDUMP_FUNCTION_TABLE_DESCRIPTOR
type MINIDUMP_FUNCTION_TABLE_STREAM (line 4102) | typedef struct _MINIDUMP_FUNCTION_TABLE_STREAM
type MINIDUMP_UNLOADED_MODULE (line 4120) | typedef struct _MINIDUMP_UNLOADED_MODULE
type MINIDUMP_UNLOADED_MODULE_LIST (line 4134) | typedef struct _MINIDUMP_UNLOADED_MODULE_LIST
type MINIDUMP_MISC_INFO (line 4157) | typedef struct _MINIDUMP_MISC_INFO
type MINIDUMP_MISC_INFO_2 (line 4167) | typedef struct _MINIDUMP_MISC_INFO_2
type MINIDUMP_MISC_INFO_3 (line 4182) | typedef struct _MINIDUMP_MISC_INFO_3
type MINIDUMP_MISC_INFO_3 (line 4203) | typedef MINIDUMP_MISC_INFO_3 MINIDUMP_MISC_INFO_N;
type MINIDUMP_MISC_INFO_N (line 4204) | typedef MINIDUMP_MISC_INFO_N* PMINIDUMP_MISC_INFO_N;
type MINIDUMP_MEMORY_INFO (line 4214) | typedef struct _MINIDUMP_MEMORY_INFO
type MINIDUMP_MEMORY_INFO_LIST (line 4227) | typedef struct _MINIDUMP_MEMORY_INFO_LIST
type MINIDUMP_THREAD_INFO (line 4250) | typedef struct _MINIDUMP_THREAD_INFO
type MINIDUMP_THREAD_INFO_LIST (line 4264) | typedef struct _MINIDUMP_THREAD_INFO_LIST
type MINIDUMP_TOKEN_INFO_HEADER (line 4274) | typedef struct _MINIDUMP_TOKEN_INFO_HEADER
type MINIDUMP_TOKEN_INFO_LIST (line 4281) | typedef struct _MINIDUMP_TOKEN_INFO_LIST
type MINIDUMP_USER_RECORD (line 4293) | typedef struct _MINIDUMP_USER_RECORD
type MINIDUMP_USER_STREAM (line 4300) | typedef struct _MINIDUMP_USER_STREAM
type MINIDUMP_USER_STREAM_INFORMATION (line 4309) | typedef struct _MINIDUMP_USER_STREAM_INFORMATION
type MINIDUMP_CALLBACK_TYPE (line 4319) | typedef enum _MINIDUMP_CALLBACK_TYPE
type MINIDUMP_THREAD_CALLBACK (line 4340) | typedef struct _MINIDUMP_THREAD_CALLBACK
type MINIDUMP_THREAD_EX_CALLBACK (line 4351) | typedef struct _MINIDUMP_THREAD_EX_CALLBACK
type MINIDUMP_INCLUDE_THREAD_CALLBACK (line 4364) | typedef struct _MINIDUMP_INCLUDE_THREAD_CALLBACK
type THREAD_WRITE_FLAGS (line 4370) | typedef enum _THREAD_WRITE_FLAGS
type MINIDUMP_MODULE_CALLBACK (line 4381) | typedef struct _MINIDUMP_MODULE_CALLBACK
type MINIDUMP_INCLUDE_MODULE_CALLBACK (line 4396) | typedef struct _MINIDUMP_INCLUDE_MODULE_CALLBACK
type MODULE_WRITE_FLAGS (line 4402) | typedef enum _MODULE_WRITE_FLAGS
type MINIDUMP_IO_CALLBACK (line 4414) | typedef struct _MINIDUMP_IO_CALLBACK
type MINIDUMP_READ_MEMORY_FAILURE_CALLBACK (line 4423) | typedef struct _MINIDUMP_READ_MEMORY_FAILURE_CALLBACK
type MINIDUMP_CALLBACK_INPUT (line 4432) | typedef struct _MINIDUMP_CALLBACK_INPUT
type MINIDUMP_CALLBACK_OUTPUT (line 4451) | typedef struct _MINIDUMP_CALLBACK_OUTPUT
type MINIDUMP_TYPE (line 4554) | typedef enum _MINIDUMP_TYPE
type MINIDUMP_SECONDARY_FLAGS (line 4590) | typedef enum _MINIDUMP_SECONDARY_FLAGS
type MINIDUMP_CALLBACK_INFORMATION (line 4612) | typedef struct _MINIDUMP_CALLBACK_INFORMATION
FILE: x64dbgApiBreak/src/incl/pluginsdk/jansson/jansson.h
type json_type (line 39) | typedef enum
type json_t (line 51) | typedef struct json_t
type json_int_t (line 64) | typedef long long json_int_t;
type json_int_t (line 67) | typedef long json_int_t;
function JSON_INLINE (line 99) | static JSON_INLINE
function JSON_INLINE (line 110) | static JSON_INLINE
function JSON_INLINE (line 118) | static JSON_INLINE
type json_error_t (line 137) | typedef struct
function JSON_INLINE (line 184) | static JSON_INLINE
function JSON_INLINE (line 190) | static JSON_INLINE
function JSON_INLINE (line 196) | static JSON_INLINE
function JSON_INLINE (line 211) | static JSON_INLINE
function JSON_INLINE (line 217) | static JSON_INLINE
function JSON_INLINE (line 223) | static JSON_INLINE
FILE: x64dbgApiBreak/src/incl/pluginsdk/jansson/jansson_x64dbg.h
type json_t (line 5) | typedef json_t* JSON;
function JSON_INLINE (line 7) | static JSON_INLINE
function json_hex_value (line 15) | static JSON_INLINE
FILE: x64dbgApiBreak/src/incl/pluginsdk/lz4/lz4file.h
type LZ4_STATUS (line 4) | typedef enum _LZ4_STATUS
FILE: x64dbgApiBreak/src/incl/pluginsdk/yara/yara/ahocorasick.h
type YR_AC_TABLES (line 51) | typedef struct _YR_AC_TABLES
FILE: x64dbgApiBreak/src/incl/pluginsdk/yara/yara/arena.h
type YR_RELOC (line 45) | typedef struct _YR_RELOC
type YR_ARENA_PAGE (line 53) | typedef struct _YR_ARENA_PAGE
type YR_ARENA (line 71) | typedef struct _YR_ARENA
FILE: x64dbgApiBreak/src/incl/pluginsdk/yara/yara/atoms.h
type ATOM_TREE_NODE (line 41) | typedef struct _ATOM_TREE_NODE
type ATOM_TREE (line 59) | typedef struct _ATOM_TREE
type YR_ATOM_LIST_ITEM (line 67) | typedef struct _YR_ATOM_LIST_ITEM
FILE: x64dbgApiBreak/src/incl/pluginsdk/yara/yara/compiler.h
type YR_FIXUP (line 55) | typedef struct _YR_FIXUP
type YR_COMPILER (line 63) | typedef struct _YR_COMPILER
FILE: x64dbgApiBreak/src/incl/pluginsdk/yara/yara/dotnet.h
type CLI_HEADER (line 9) | typedef struct _CLI_HEADER
type NET_METADATA (line 33) | typedef struct _NET_METADATA
type STREAM_HEADER (line 49) | typedef struct _STREAM_HEADER
type TILDE_HEADER (line 61) | typedef struct _TILDE_HEADER
type MODULE_TABLE (line 145) | typedef struct _MODULE_TABLE
type ASSEMBLY_TABLE (line 174) | typedef struct _ASSEMBLY_TABLE
type ASSEMBLYREF_TABLE (line 199) | typedef struct _ASSEMBLYREF_TABLE
type MANIFESTRESOURCE_TABLE (line 223) | typedef struct _MANIFESTRESOURCE_TABLE
type MODULEREF_TABLE (line 245) | typedef struct _MODULEREF_TABLE
type CUSTOMATTRIBUTE_TABLE (line 259) | typedef struct _CUSTOMATTRIBUTE_TABLE
type CONSTANT_TABLE (line 283) | typedef struct _CONSTANT_TABLE
type STREAMS (line 300) | typedef struct _STREAMS
type BLOB_PARSE_RESULT (line 312) | typedef struct _BLOB_PARSE_RESULT
type ROWS (line 320) | typedef struct _ROWS
type INDEX_SIZES (line 348) | typedef struct _INDEX_SIZES
FILE: x64dbgApiBreak/src/incl/pluginsdk/yara/yara/elf.h
type elf32_addr_t (line 38) | typedef uint32_t elf32_addr_t;
type elf32_half_t (line 39) | typedef uint16_t elf32_half_t;
type elf32_off_t (line 40) | typedef uint32_t elf32_off_t;
type elf32_word_t (line 41) | typedef uint32_t elf32_word_t;
type elf64_addr_t (line 45) | typedef uint64_t elf64_addr_t;
type elf64_half_t (line 46) | typedef uint16_t elf64_half_t;
type elf64_off_t (line 47) | typedef uint64_t elf64_off_t;
type elf64_word_t (line 48) | typedef uint32_t elf64_word_t;
type elf64_xword_t (line 49) | typedef uint64_t elf64_xword_t;
type elf_ident_t (line 169) | typedef struct
type elf32_header_t (line 181) | typedef struct
type elf64_header_t (line 201) | typedef struct
type elf32_program_header_t (line 221) | typedef struct
type elf64_program_header_t (line 235) | typedef struct
type elf32_section_header_t (line 249) | typedef struct
type elf64_section_header_t (line 265) | typedef struct
type elf32_dyn_t (line 281) | typedef struct
type elf64_dyn_t (line 289) | typedef struct
type elf32_sym_t (line 297) | typedef struct
type elf64_sym_t (line 309) | typedef struct
FILE: x64dbgApiBreak/src/incl/pluginsdk/yara/yara/filemap.h
type YR_MAPPED_FILE (line 52) | typedef struct _YR_MAPPED_FILE
FILE: x64dbgApiBreak/src/incl/pluginsdk/yara/yara/hash.h
type YR_HASH_TABLE_ENTRY (line 37) | typedef struct _YR_HASH_TABLE_ENTRY
type YR_HASH_TABLE (line 49) | typedef struct _YR_HASH_TABLE
FILE: x64dbgApiBreak/src/incl/pluginsdk/yara/yara/hex_lexer.h
type HEX_LEX_ENVIRONMENT (line 66) | typedef struct _HEX_LEX_ENVIRONMENT
FILE: x64dbgApiBreak/src/incl/pluginsdk/yara/yara/integers.h
type __int8 (line 44) | typedef __int8 int8_t;
type __int16 (line 46) | typedef __int16 int16_t;
type __int32 (line 48) | typedef __int32 int32_t;
type __int64 (line 50) | typedef __int64 int64_t;
FILE: x64dbgApiBreak/src/incl/pluginsdk/yara/yara/lexer.h
type EXPRESSION (line 81) | typedef struct _EXPRESSION
FILE: x64dbgApiBreak/src/incl/pluginsdk/yara/yara/libyara.h
type YR_CONFIG_NAME (line 54) | typedef enum _YR_CONFIG_NAME
FILE: x64dbgApiBreak/src/incl/pluginsdk/yara/yara/modules.h
type _YR_MODULE (line 380) | struct _YR_MODULE
type _YR_MODULE (line 384) | struct _YR_MODULE
type _YR_MODULE (line 388) | struct _YR_MODULE
type YR_MODULE (line 406) | typedef struct _YR_MODULE
type YR_MODULE_IMPORT (line 419) | typedef struct _YR_MODULE_IMPORT
FILE: x64dbgApiBreak/src/incl/pluginsdk/yara/yara/pe.h
type BYTE (line 57) | typedef uint8_t BYTE;
type WORD (line 58) | typedef uint16_t WORD;
type DWORD (line 59) | typedef uint32_t DWORD;
type LONG (line 60) | typedef int32_t LONG;
type ULONG (line 61) | typedef uint32_t ULONG;
type ULONGLONG (line 62) | typedef uint64_t ULONGLONG;
type IMAGE_DOS_HEADER (line 86) | typedef struct _IMAGE_DOS_HEADER // DOS .EXE header
type IMAGE_FILE_HEADER (line 117) | typedef struct _IMAGE_FILE_HEADER
type IMAGE_DATA_DIRECTORY (line 192) | typedef struct _IMAGE_DATA_DIRECTORY
type IMAGE_OPTIONAL_HEADER32 (line 223) | typedef struct _IMAGE_OPTIONAL_HEADER32
type IMAGE_OPTIONAL_HEADER64 (line 260) | typedef struct _IMAGE_OPTIONAL_HEADER64
type IMAGE_NT_HEADERS32 (line 300) | typedef struct _IMAGE_NT_HEADERS32
type IMAGE_NT_HEADERS64 (line 309) | typedef struct _IMAGE_NT_HEADERS64
type IMAGE_SECTION_HEADER (line 360) | typedef struct _IMAGE_SECTION_HEADER
type IMAGE_EXPORT_DIRECTORY (line 382) | typedef struct _IMAGE_EXPORT_DIRECTORY
type IMAGE_IMPORT_DESCRIPTOR (line 398) | typedef struct _IMAGE_IMPORT_DESCRIPTOR
type IMAGE_IMPORT_BY_NAME (line 413) | typedef struct _IMAGE_IMPORT_BY_NAME
type IMAGE_THUNK_DATA32 (line 420) | typedef struct _IMAGE_THUNK_DATA32
type IMAGE_THUNK_DATA64 (line 436) | typedef struct _IMAGE_THUNK_DATA64
type IMAGE_RESOURCE_DIRECTORY_ENTRY (line 449) | typedef struct _IMAGE_RESOURCE_DIRECTORY_ENTRY
type IMAGE_RESOURCE_DATA_ENTRY (line 456) | typedef struct _IMAGE_RESOURCE_DATA_ENTRY
type IMAGE_RESOURCE_DIRECTORY (line 465) | typedef struct _IMAGE_RESOURCE_DIRECTORY
type VERSION_INFO (line 479) | typedef struct _VERSION_INFO
type WIN_CERTIFICATE (line 496) | typedef struct _WIN_CERTIFICATE
type RICH_VERSION_INFO (line 513) | typedef struct _RICH_VERSION_INFO
type RICH_SIGNATURE (line 519) | typedef struct _RICH_SIGNATURE
FILE: x64dbgApiBreak/src/incl/pluginsdk/yara/yara/pe_utils.h
type IMPORTED_DLL (line 26) | typedef struct _IMPORTED_DLL
type IMPORT_EXPORT_FUNCTION (line 44) | typedef struct _IMPORT_EXPORT_FUNCTION
type PE (line 55) | typedef struct _PE
FILE: x64dbgApiBreak/src/incl/pluginsdk/yara/yara/re.h
type RE (line 101) | typedef struct RE RE;
type RE_AST (line 102) | typedef struct RE_AST RE_AST;
type RE_NODE (line 103) | typedef struct RE_NODE RE_NODE;
type RE_ERROR (line 104) | typedef struct RE_ERROR RE_ERROR;
type RE_SPLIT_ID_TYPE (line 106) | typedef uint8_t RE_SPLIT_ID_TYPE;
type RE_NODE (line 109) | struct RE_NODE
type RE_AST (line 138) | struct RE_AST
type RE (line 152) | struct RE
type RE_ERROR (line 163) | struct RE_ERROR
FILE: x64dbgApiBreak/src/incl/pluginsdk/yara/yara/re_lexer.h
type RE_LEX_ENVIRONMENT (line 65) | typedef struct _RE_LEX_ENVIRONMENT
FILE: x64dbgApiBreak/src/incl/pluginsdk/yara/yara/sizedstr.h
type SIZED_STRING (line 50) | typedef struct _SIZED_STRING
FILE: x64dbgApiBreak/src/incl/pluginsdk/yara/yara/stream.h
type YR_STREAM (line 49) | typedef struct _YR_STREAM
FILE: x64dbgApiBreak/src/incl/pluginsdk/yara/yara/threading.h
type DWORD (line 39) | typedef DWORD YR_THREAD_ID;
type DWORD (line 40) | typedef DWORD YR_THREAD_STORAGE_KEY;
type HANDLE (line 41) | typedef HANDLE YR_MUTEX;
type pthread_t (line 47) | typedef pthread_t YR_THREAD_ID;
type pthread_key_t (line 48) | typedef pthread_key_t YR_THREAD_STORAGE_KEY;
type pthread_mutex_t (line 49) | typedef pthread_mutex_t YR_MUTEX;
FILE: x64dbgApiBreak/src/incl/pluginsdk/yara/yara/types.h
type YR_NAMESPACE (line 181) | typedef struct _YR_NAMESPACE
type YR_META (line 189) | typedef struct _YR_META
type _YR_MATCH (line 200) | struct _YR_MATCH
type YR_MATCHES (line 203) | typedef struct _YR_MATCHES
type YR_STRING (line 213) | typedef struct _YR_STRING
type YR_RULE (line 237) | typedef struct _YR_RULE
type YR_EXTERNAL_VARIABLE (line 255) | typedef struct _YR_EXTERNAL_VARIABLE
type YR_AC_MATCH (line 271) | typedef struct _YR_AC_MATCH
type YR_AC_MATCH_TABLE_ENTRY (line 283) | typedef struct _YR_AC_MATCH_TABLE_ENTRY
type YR_AC_TRANSITION (line 290) | typedef uint64_t YR_AC_TRANSITION;
type YR_AC_TRANSITION (line 291) | typedef YR_AC_TRANSITION* YR_AC_TRANSITION_TABLE;
type YR_AC_MATCH_TABLE_ENTRY (line 292) | typedef YR_AC_MATCH_TABLE_ENTRY* YR_AC_MATCH_TABLE;
type YARA_RULES_FILE_HEADER (line 295) | typedef struct _YARA_RULES_FILE_HEADER
type YR_MATCH (line 312) | typedef struct _YR_MATCH
type _YR_AC_STATE (line 336) | struct _YR_AC_STATE
type YR_AC_STATE (line 339) | typedef struct _YR_AC_STATE
type YR_AC_AUTOMATON (line 355) | typedef struct _YR_AC_AUTOMATON
type YR_RULES (line 371) | typedef struct _YR_RULES
type _YR_MEMORY_BLOCK (line 387) | struct _YR_MEMORY_BLOCK
type _YR_MEMORY_BLOCK_ITERATOR (line 388) | struct _YR_MEMORY_BLOCK_ITERATOR
type _YR_MEMORY_BLOCK (line 392) | struct _YR_MEMORY_BLOCK
type _YR_MEMORY_BLOCK (line 395) | struct _YR_MEMORY_BLOCK
type _YR_MEMORY_BLOCK_ITERATOR (line 396) | struct _YR_MEMORY_BLOCK_ITERATOR
type YR_MEMORY_BLOCK (line 399) | typedef struct _YR_MEMORY_BLOCK
type YR_MEMORY_BLOCK_ITERATOR (line 411) | typedef struct _YR_MEMORY_BLOCK_ITERATOR
type YR_SCAN_CONTEXT (line 427) | typedef struct _YR_SCAN_CONTEXT
type _YR_OBJECT (line 447) | struct _YR_OBJECT
type YR_VALUE (line 450) | typedef union _YR_VALUE
type YR_OBJECT (line 470) | typedef struct _YR_OBJECT
type YR_OBJECT_STRUCTURE (line 478) | typedef struct _YR_OBJECT_STRUCTURE
type YR_OBJECT_ARRAY (line 486) | typedef struct _YR_OBJECT_ARRAY
type YR_OBJECT_DICTIONARY (line 495) | typedef struct _YR_OBJECT_DICTIONARY
type _YR_OBJECT_FUNCTION (line 504) | struct _YR_OBJECT_FUNCTION
type _YR_OBJECT_FUNCTION (line 510) | struct _YR_OBJECT_FUNCTION
type YR_OBJECT_FUNCTION (line 513) | typedef struct _YR_OBJECT_FUNCTION
type YR_STRUCTURE_MEMBER (line 534) | typedef struct _YR_STRUCTURE_MEMBER
type YR_ARRAY_ITEMS (line 542) | typedef struct _YR_ARRAY_ITEMS
type YR_DICTIONARY_ITEMS (line 550) | typedef struct _YR_DICTIONARY_ITEMS
FILE: x64dbgApiBreak/src/incl/qpc.hpp
class QPerf (line 23) | class QPerf
type PerfItem (line 27) | struct PerfItem
method _GetQpc (line 37) | double _GetQpc()
method QPerf (line 48) | QPerf()
method Begin (line 62) | void Begin()
method TimeFor (line 68) | void TimeFor(const char *forWhat)
method Reset (line 86) | void Reset()
method Dump (line 92) | void Dump()
FILE: x64dbgApiBreak/src/incl/rtf.h
type RTF_DATA (line 7) | typedef struct __RTF_DATA
type RTF_STYLE (line 17) | typedef enum __RTF_STYLE
type DWORD (line 29) | typedef DWORD RTFRESID;
function class (line 57) | class Rtf
FILE: x64dbgApiBreak/src/incl/settings.h
type Settings (line 6) | typedef struct
FILE: x64dbgApiBreak/src/incl/structmemmap.h
type __FNSIGN (line 7) | struct __FNSIGN
FILE: x64dbgApiBreak/src/incl/ui/ctrl/uicheckbox.hpp
class UiCheckBox (line 5) | class UiCheckBox : public UiControlBase
method IMPL_CTRLBASE_CTOR (line 11) | IMPL_CTRLBASE_CTOR(UiCheckBox)
method GetState (line 15) | bool GetState()
method SetState (line 20) | void SetState(bool state)
method OnCommand (line 25) | virtual void OnCommand(WPARAM wp)
FILE: x64dbgApiBreak/src/incl/ui/ctrl/uicombobox.hpp
class UiComboBox (line 5) | class UiComboBox : public UiControlBase
method IMPL_CTRLBASE_CTOR (line 11) | IMPL_CTRLBASE_CTOR(UiComboBox)
method AddItem (line 15) | bool AddItem(LPCWSTR itemStr)
method AddItemA (line 20) | bool AddItemA(LPCSTR itemStr)
method Clear (line 25) | void Clear()
method LONG (line 30) | LONG GetSelectedIndex()
method SetSelectedIndex (line 35) | bool SetSelectedIndex(LONG index)
method GetSelectedIndexTextA (line 40) | bool GetSelectedIndexTextA(LPSTR buffer)
FILE: x64dbgApiBreak/src/incl/ui/ctrl/uicontrolbase.hpp
class UiControlBase (line 7) | class UiControlBase
type OwnerStringDrawInfo (line 10) | struct OwnerStringDrawInfo
method DWORD (line 23) | DWORD MyId() const
method HWND (line 28) | HWND MyHandle() const
method ULONG (line 33) | ULONG GetStringCommon(BYTE **pValue, ULONG size)
method UiControlBase (line 71) | UiControlBase()
method UiControlBase (line 77) | UiControlBase(UIOBJECT *ui, DWORD ctrlId, UiWrapper *parent)
method LONG (line 86) | LONG SendControlMsg(UINT msg, WPARAM wp, LPARAM lp)
method EnableOwnerDraw (line 91) | void EnableOwnerDraw()
method Disable (line 100) | void Disable()
method Enable (line 105) | void Enable()
method SetEnableState (line 110) | void SetEnableState(bool enable)
method ULONG (line 115) | ULONG GetStringA(LPSTR *pValue, ULONG size)
method ULONG (line 150) | ULONG GetStringW(LPWSTR *pValue, ULONG size)
method BOOL (line 185) | BOOL SetStringA(LPCSTR value)
method BOOL (line 190) | BOOL SetStringW(LPCWSTR value)
method DrawStringA (line 195) | void DrawStringA(LPCSTR text, INT x, INT y, COLORREF foreColor)
method DrawStringFormatA (line 204) | void DrawStringFormatA(INT x, INT y, COLORREF foreColor, LPCSTR format...
method OnInitControl (line 221) | virtual void OnInitControl()
method OnCommand (line 226) | virtual void OnCommand(WPARAM wp)
method OnDrawItem (line 231) | virtual void OnDrawItem(LPDRAWITEMSTRUCT dis)
FILE: x64dbgApiBreak/src/incl/ui/ui.h
type WINDOWREGIONINFO (line 7) | typedef struct
type PRECREATEWINDOWINFO (line 19) | typedef struct tagPreCreateWindowInfo
type WINDOWCREATIONINFO (line 25) | typedef struct tagWindowCreationInfo
type UINT (line 30) | typedef INT_PTR(CALLBACK* UIDLGPROC)(HWND, UINT, WPARAM, LPARAM, PVOID);
type VOID (line 32) | typedef VOID(*UIAFTEREXITDISPOSER)();
type UIOBJECT (line 34) | typedef struct tagUiResult
FILE: x64dbgApiBreak/src/incl/ui/uiwrapper.hpp
class UiWrapper (line 3) | class UiWrapper
method UINT_PTR (line 16) | static UINT_PTR CALLBACK DialogProc(HWND hwnd, UINT msg, WPARAM wp, LP...
method UiControlBase (line 76) | UiControlBase *LookupControl(HWND hwnd)
method DestroyControlResources (line 91) | void DestroyControlResources()
method SetControlEnableState (line 110) | bool SetControlEnableState(ULONG ctrlId, bool state)
method InitCommon (line 120) | void InitCommon(LONG dlgId, bool center)
method OnInitInternal (line 138) | void OnInitInternal()
method UiWrapper (line 147) | UiWrapper(LONG dlgId, bool center)
method UiWrapper (line 152) | UiWrapper(LONG dlgId)
method DestroyAllActiveWindows (line 173) | static void DestroyAllActiveWindows()
method ShowDialog (line 178) | virtual bool ShowDialog()
method ShowDialog (line 183) | virtual bool ShowDialog(bool seperateUiThread)
method HWND (line 202) | HWND GetHWND() const
method SetTimer (line 207) | bool SetTimer(LONG timerId, ULONG period)
method KillTimer (line 213) | void KillTimer(LONG timerId)
method LONG (line 218) | LONG MessageBox(LPWSTR msg, LPWSTR title, ULONG flags)
method LONG (line 223) | LONG MsgBoxInfo(LPCSTR msg, LPCSTR title)
method LONG (line 228) | LONG MsgBoxError(LPCSTR msg, LPCSTR title)
method LONG (line 233) | LONG MsgBoxQuestion(LPCSTR msg, LPCSTR title)
method WaitForInitCompletion (line 238) | void WaitForInitCompletion()
method Close (line 243) | void Close()
method ULONG (line 251) | ULONG GetControlTextA(ULONG ctrlId, LPSTR strBuf, ULONG bufSize)
method ULONG (line 278) | ULONG GetControlText(ULONG ctrlId, LPWSTR strBuf, ULONG bufSize)
method SetWindowTitleW (line 288) | void SetWindowTitleW(LPWSTR title)
method SetWindowTitleA (line 293) | void SetWindowTitleA(LPSTR title)
method SetControlTextA (line 298) | bool SetControlTextA(ULONG ctrlId, LPSTR str)
method SetControlText (line 312) | bool SetControlText(ULONG ctrlId, LPWSTR str)
method SetControlTextFormatA (line 322) | bool SetControlTextFormatA(ULONG ctrlId, const char *format, ...)
method EnableControl (line 343) | bool EnableControl(ULONG ctrlId)
method DisableControl (line 348) | bool DisableControl(ULONG ctrlId)
method T (line 353) | T *GetControlById(ULONG ctrlId)
method OnTimerTick (line 374) | virtual void OnTimerTick(LONG timerId)
method OnDestroyed (line 379) | virtual void OnDestroyed()
method OnClose (line 384) | virtual void OnClose()
method OnPaint (line 389) | virtual void OnPaint()
method OnLoaded (line 393) | virtual void OnLoaded()
method OnCommand (line 398) | virtual void OnCommand(WPARAM wp, LPARAM lp)
method OnDrawItem (line 411) | virtual void OnDrawItem(LPDRAWITEMSTRUCT dis, LONG ctrlId)
method OnInit (line 424) | virtual void OnInit()
class UiWrapper (line 12) | class UiWrapper
method UINT_PTR (line 16) | static UINT_PTR CALLBACK DialogProc(HWND hwnd, UINT msg, WPARAM wp, LP...
method UiControlBase (line 76) | UiControlBase *LookupControl(HWND hwnd)
method DestroyControlResources (line 91) | void DestroyControlResources()
method SetControlEnableState (line 110) | bool SetControlEnableState(ULONG ctrlId, bool state)
method InitCommon (line 120) | void InitCommon(LONG dlgId, bool center)
method OnInitInternal (line 138) | void OnInitInternal()
method UiWrapper (line 147) | UiWrapper(LONG dlgId, bool center)
method UiWrapper (line 152) | UiWrapper(LONG dlgId)
method DestroyAllActiveWindows (line 173) | static void DestroyAllActiveWindows()
method ShowDialog (line 178) | virtual bool ShowDialog()
method ShowDialog (line 183) | virtual bool ShowDialog(bool seperateUiThread)
method HWND (line 202) | HWND GetHWND() const
method SetTimer (line 207) | bool SetTimer(LONG timerId, ULONG period)
method KillTimer (line 213) | void KillTimer(LONG timerId)
method LONG (line 218) | LONG MessageBox(LPWSTR msg, LPWSTR title, ULONG flags)
method LONG (line 223) | LONG MsgBoxInfo(LPCSTR msg, LPCSTR title)
method LONG (line 228) | LONG MsgBoxError(LPCSTR msg, LPCSTR title)
method LONG (line 233) | LONG MsgBoxQuestion(LPCSTR msg, LPCSTR title)
method WaitForInitCompletion (line 238) | void WaitForInitCompletion()
method Close (line 243) | void Close()
method ULONG (line 251) | ULONG GetControlTextA(ULONG ctrlId, LPSTR strBuf, ULONG bufSize)
method ULONG (line 278) | ULONG GetControlText(ULONG ctrlId, LPWSTR strBuf, ULONG bufSize)
method SetWindowTitleW (line 288) | void SetWindowTitleW(LPWSTR title)
method SetWindowTitleA (line 293) | void SetWindowTitleA(LPSTR title)
method SetControlTextA (line 298) | bool SetControlTextA(ULONG ctrlId, LPSTR str)
method SetControlText (line 312) | bool SetControlText(ULONG ctrlId, LPWSTR str)
method SetControlTextFormatA (line 322) | bool SetControlTextFormatA(ULONG ctrlId, const char *format, ...)
method EnableControl (line 343) | bool EnableControl(ULONG ctrlId)
method DisableControl (line 348) | bool DisableControl(ULONG ctrlId)
method T (line 353) | T *GetControlById(ULONG ctrlId)
method OnTimerTick (line 374) | virtual void OnTimerTick(LONG timerId)
method OnDestroyed (line 379) | virtual void OnDestroyed()
method OnClose (line 384) | virtual void OnClose()
method OnPaint (line 389) | virtual void OnPaint()
method OnLoaded (line 393) | virtual void OnLoaded()
method OnCommand (line 398) | virtual void OnCommand(WPARAM wp, LPARAM lp)
method OnDrawItem (line 411) | virtual void OnDrawItem(LPDRAWITEMSTRUCT dis, LONG ctrlId)
method OnInit (line 424) | virtual void OnInit()
FILE: x64dbgApiBreak/src/incl/util.h
type CALLCONVENTION (line 6) | typedef enum
type PASSED_PARAMETER_CONTEXT (line 14) | typedef struct
type ULONGLONG (line 23) | typedef ULONGLONG ARCHWIDE;
type ULONG (line 25) | typedef ULONG ARCHWIDE;
type DMA (line 29) | typedef struct __DMA
FILE: x64dbgApiBreak/src/instparse.cpp
function Skiptoken (line 43) | __forceinline void Skiptoken(token_data *td, int skip)
function AbpTokenize (line 81) | void AbpTokenize(char *inst, token_data *tokdata)
function AbpParseMemoryAccess (line 154) | bool AbpParseMemoryAccess(token_data *td, InstInfo *linst)
function AbpIsNumStr (line 232) | inline bool AbpIsNumStr(const char *str)
function _AbpParseRegister (line 247) | bool _AbpParseRegister(token_data *td, InstInfo *instInfo, dsint *val, s...
function AbpParseRegister (line 349) | bool AbpParseRegister(token_data *td, InstInfo *instInfo)
function AbpParseOperand (line 354) | bool AbpParseOperand(token_data *td, InstInfo *linst)
function __AbpPrintMemData (line 384) | void __AbpPrintMemData(InstInfo *inst, char *buf)
function __AbpPrintInstructionInfo (line 401) | void __AbpPrintInstructionInfo(InstInfo *inst)
function AbParseInstruction (line 449) | bool AbParseInstruction(BASIC_INSTRUCTION_INFO *inst, InstInfo *linst)
FILE: x64dbgApiBreak/src/plugin.cpp
function INTERNAL_EXPORT (line 54) | INTERNAL_EXPORT Script::Module::ModuleInfo *AbiGetCurrentModuleInfo()
function Loader (line 61) | int WINAPI Loader(void *)
function AbpParseScripts (line 67) | void AbpParseScripts()
function AbpOnDebuggerStateChanged (line 106) | void AbpOnDebuggerStateChanged(BYTE state, const char *module)
function AbpRaiseDbgStateChangeEvent (line 128) | void AbpRaiseDbgStateChangeEvent()
function AbReleaseAllSystemResources (line 142) | void AbReleaseAllSystemResources(bool isInShutdown)
function BOOL (line 161) | BOOL AbRaiseSystemError(const char *errorDesc, int errCode,const char *f...
function AbpNeedsNewerx64Dbg (line 192) | bool AbpNeedsNewerx64Dbg()
function __AbpInitMenu (line 210) | void __AbpInitMenu()
function DBG_LIBEXPORT (line 218) | DBG_LIBEXPORT bool pluginit(PLUG_INITSTRUCT* initStruct)
function DBG_LIBEXPORT (line 251) | DBG_LIBEXPORT bool plugstop()
function DBG_LIBEXPORT (line 267) | DBG_LIBEXPORT void plugsetup(PLUG_SETUPSTRUCT* setupStruct)
function DBG_LIBEXPORT (line 286) | DBG_LIBEXPORT void CBMENUENTRY(CBTYPE cbType, PLUG_CB_MENUENTRY* info)
function DBG_LIBEXPORT (line 312) | DBG_LIBEXPORT void CBLOADDLL(CBTYPE cbType, PLUG_CB_LOADDLL *dllLoad)
function DBG_LIBEXPORT (line 325) | DBG_LIBEXPORT void CBSYSTEMBREAKPOINT(CBTYPE cbType, PLUG_CB_SYSTEMBREAK...
function PPASSED_PARAMETER_CONTEXT (line 334) | PPASSED_PARAMETER_CONTEXT AbpExtractPassedParameterContext(REGDUMP *regd...
function AbpGhostBreakpointHandler (line 358) | void AbpGhostBreakpointHandler(BpCallbackContext *bpx)
function AbpWaitUntilHandlerDone (line 364) | void AbpWaitUntilHandlerDone(PBREAKPOINT_INFO pbi)
function LONG (line 373) | LONG WINAPI AbpShowOutputArgumentQuestion(LPVOID p)
function DBG_LIBEXPORT (line 432) | DBG_LIBEXPORT void CBBREAKPOINT(CBTYPE cbType, PLUG_CB_BREAKPOINT* info)
function DBG_LIBEXPORT (line 508) | DBG_LIBEXPORT void CBCREATEPROCESS(CBTYPE cbType, PLUG_CB_CREATEPROCESS ...
function DBG_LIBEXPORT (line 526) | DBG_LIBEXPORT void CBEXITPROCESS(CBTYPE cbType, PLUG_CB_EXITPROCESS *exi...
function DBG_LIBEXPORT (line 533) | DBG_LIBEXPORT void CBATTACH(CBTYPE cbType, PLUG_CB_ATTACH *attachedProc)
function DBG_LIBEXPORT (line 538) | DBG_LIBEXPORT void CBDETACH(CBTYPE cbType, PLUG_CB_DETACH *detachedProc)
function BOOL (line 545) | BOOL WINAPI DllMain(
FILE: x64dbgApiBreak/src/rtf.cpp
function BOOL (line 9) | BOOL RtfCreateRtfData(PRTF_DATA *rtfData)
function BOOL (line 29) | BOOL RtfBuildRtfTextA(PRTF_DATA rtf, LPSTR *rtfText, DWORD *textLen)
function RtfFreeRtfText (line 89) | void RtfFreeRtfText(LPSTR rtfText)
function BOOL (line 94) | BOOL RtfDestroyRtfData(PRTF_DATA *rtf)
function BOOL (line 118) | BOOL RtfRegisterColor(PRTF_DATA rtf, DWORD color, RTFRESID *resId)
function BOOL (line 146) | BOOL RtfRegisterFont(PRTF_DATA rtf, const LPCSTR fontName, int charset, ...
function BOOL (line 179) | BOOL RtfBeginStyleFor(PRTF_DATA rtf, RTF_STYLE rtfStyle, DWORD repeat)
function BOOL (line 211) | BOOL RtfBeginColor(PRTF_DATA rtf, RTFRESID resId)
function BOOL (line 218) | BOOL RtfBeginFont(PRTF_DATA rtf, RTFRESID resId)
function BOOL (line 224) | BOOL RtfBeginFontSize(PRTF_DATA rtf, WORD fontSize)
function BOOL (line 230) | BOOL RtfAppendTextFormatA(PRTF_DATA rtf, LPCSTR format, ...)
function BOOL (line 244) | BOOL RtfAppendTextFormatExA(PRTF_DATA rtf, LPCSTR format, va_list vl)
FILE: x64dbgApiBreak/src/settings.cpp
function AbpGetSetting (line 38) | bool AbpGetSetting(const char *key, char *valueBuf,int valueType)
function AbpSetSetting (line 80) | bool AbpSetSetting(const char *key, char *value, int valueType)
function AbSettingsLoad (line 123) | bool AbSettingsLoad()
function AbSettingsSave (line 150) | bool AbSettingsSave()
function AbSettingsReset (line 173) | bool AbSettingsReset()
function Settings (line 179) | Settings *AbGetSettings()
function AbSettingsDestroyResources (line 184) | void AbSettingsDestroyResources()
FILE: x64dbgApiBreak/src/structmemmap.cpp
type __Token (line 57) | struct __Token
type __SLISTNODE (line 67) | struct __SLISTNODE
type __SLISTNODE (line 69) | struct __SLISTNODE
type __FNSIGN (line 172) | struct __FNSIGN
function SmmpRegisterRtfColorAndFonts (line 253) | void SmmpRegisterRtfColorAndFonts(Rtf * data)
function SmmpInitPathStack (line 298) | void SmmpInitPathStack(PATH_STACK *pwds)
function SmmpPushPath (line 304) | void SmmpPushPath(PATH_STACK *pwds,WCHAR *path)
function BOOL (line 321) | BOOL SmmpIsPreviousWorkdirLocal(PATH_STACK *pwds)
function BOOL (line 329) | BOOL SmmpPopPath(PATH_STACK *pwds, WCHAR *popPath, BOOL *isLocal)
function SmmpRaiseParseError (line 349) | void SmmpRaiseParseError(LONG err, PToken tok)
function BOOL (line 374) | BOOL SmmpCreateSLIST(PSLIST *list)
function BOOL (line 387) | BOOL SmmpAddSList(PSLIST list, void *value)
function SmmpClearList (line 413) | void SmmpClearList(PSLIST list, BOOL memFreeValue)
function SmmpDestroySList (line 431) | void SmmpDestroySList(PSLIST list)
function BOOL (line 441) | BOOL SmmCreateMapTypeInfo(const char *name, WORD size, BOOL isSigned, CO...
function BOOL (line 555) | BOOL SmmpTypeIsPrimitive(LPVOID typeData, BOOL *isPrimitive)
function BOOL (line 573) | BOOL SmmpGetTypeInfoByName(const char *name, PVOID *info, BOOL *isPrimit...
function BOOL (line 633) | BOOL SmmpRegisterAlias(const char *alias, const char *typeName)
function BOOL (line 660) | BOOL SmmpInitBaseAliases()
function BOOL (line 672) | BOOL SmmpInitBasePrimitiveTypes()
function BOOL (line 725) | __forceinline BOOL SmmpNextnode(PSLISTNODE *node)
function BOOL (line 749) | BOOL SmmpIsSpecialToken(char chr)
function BOOL (line 769) | BOOL SmmpIsNumeric(char c)
function BOOL (line 774) | BOOL SmmpIsWhitespace(char c)
function BOOL (line 788) | BOOL SmmpIsChar(char c)
function BOOL (line 803) | BOOL SmmpTokenize(LPCSTR typeDefString, PSLIST *tokenList)
function BOOL (line 883) | BOOL SmmpParseTypeField(PSLISTNODE *beginNode, PSTRUCTMEMBERFIELD *field...
function WORD (line 986) | WORD SmmpParseTypeFields(PSLISTNODE *beginNode, PSTRUCTINFO typeInfo)
function BOOL (line 1036) | BOOL SmmpParseFunctionSignature(PSLISTNODE *startNode, PFNSIGN *funcSign)
function BOOL (line 1214) | BOOL SmmpParseAlias(PSLISTNODE *startNode)
function BOOL (line 1252) | BOOL _SmmpParseType(PSLISTNODE *startNode, PSTRUCTINFO *typeInfo)
function SmmpDumpMapTypeInfo (line 1317) | void SmmpDumpMapTypeInfo(PPRIMITIVETYPEINFO mti)
function SmmpDumpType (line 1324) | void SmmpDumpType(PSTRUCTINFO type)
function BOOL (line 1353) | BOOL SmmpMapForPrimitiveType(PGENERIC_DATATYPE_INFO pdi, Rtf *rtf, BYTE ...
function BOOL (line 1457) | BOOL SmmpMapField(PSTRUCTMEMBERFIELD ptif, Rtf* rtf, BYTE *mem,SHORT las...
function BOOL (line 1473) | BOOL SmmpMapForStructureType(PGENERIC_DATATYPE_INFO pdi, Rtf *rtf, BYTE ...
function BOOL (line 1516) | BOOL SmmMapFunctionCall(PPASSED_PARAMETER_CONTEXT passedParams, PFNSIGN ...
function BOOL (line 1580) | BOOL SmmMapMemoryForType(void *memory, ULONG size, const char *typeName)
function BOOL (line 1611) | BOOL SmmGetFunctionSignature(const char *module, const char *function, P...
function BOOL (line 1633) | BOOL SmmGetFunctionSignature2(ApiFunctionInfo *afi, PFNSIGN *signInfo)
function SHORT (line 1644) | SHORT SmmGetArgumentCount(PFNSIGN signInfo)
function BOOL (line 1652) | BOOL SmmSigHasOutArgument(PFNSIGN signInfo)
function BOOL (line 1660) | BOOL SmmpIsFullPathOrURL(LPCWSTR str, BOOL *isLocal)
function SmmpBuildNewFileOrURL (line 1677) | void SmmpBuildNewFileOrURL(LPWSTR buffer, ULONG bufSize, LPWSTR objectName)
function BOOL (line 1719) | BOOL SmmpParseType(LPCSTR typeDefString, WORD *typeCount)
function BOOL (line 1822) | BOOL SmmParseType(LPCSTR typeDefString, WORD *typeCount)
function BOOL (line 1838) | BOOL SmmpParseFromInternet(LPCWSTR sourceUrl, WORD *typeCount)
function BOOL (line 1855) | BOOL SmmParseFromFileW(LPCWSTR fileName, WORD *typeCount)
function BOOL (line 1951) | BOOL SmmParseFromFileA(LPCSTR fileName, WORD *typeCount)
function BOOL (line 1968) | BOOL SmmHasParseError(LPSTR *errorString)
function VOID (line 1986) | VOID SmmInitializeResources()
function VOID (line 2020) | VOID SmmReleaseResources(bool fullRelease)
FILE: x64dbgApiBreak/src/syslib.cpp
type __MEMLIST_ENTRY (line 9) | struct __MEMLIST_ENTRY
type __MEMLIST_ENTRY (line 12) | struct __MEMLIST_ENTRY
type __MEMLIST_ENTRY (line 13) | struct __MEMLIST_ENTRY
type __MEMLIST (line 22) | struct __MEMLIST
function AcqMemListSpinlock (line 33) | void AcqMemListSpinlock()
function RelMemListSpinlock (line 39) | void RelMemListSpinlock()
function AbMemReadGuaranteed (line 44) | bool AbMemReadGuaranteed(duint va, void *dest, duint size)
function _AbMemoryFree (line 89) | void _AbMemoryFree(void *memPtr)
function AbRevealPossibleMemoryLeaks (line 99) | void AbRevealPossibleMemoryLeaks()
function dumpNode (line 170) | void dumpNode(PMEMLIST_ENTRY entry)
function PMEMLIST_ENTRY (line 179) | PMEMLIST_ENTRY AbpValidateAndProbe(void *memPtr)
function AbMemoryFree_DBG (line 273) | void AbMemoryFree_DBG(void *memPtr)
function AbRevealPossibleMemoryLeaks (line 362) | void AbRevealPossibleMemoryLeaks()
function AbTrackMemory_DBG (line 368) | void AbTrackMemory_DBG(void *memPtr)
FILE: x64dbgApiBreak/src/ui/ui.cpp
type tagIntParam (line 25) | struct tagIntParam
function UIOBJECT (line 36) | UIOBJECT *__UiGetMappedUiObject(HWND hwnd)
function BOOL (line 53) | BOOL __UiMapUiObject(UIOBJECT *uiObj)
function UIOBJECT (line 67) | UIOBJECT *__UiUnmapHwnd(HWND hwnd)
function PVOID (line 84) | __forceinline PVOID _UiDecodeParamPointer(PVOID param)
function __UiRaiseDisposeCallback (line 101) | void __UiRaiseDisposeCallback(UIOBJECT *ui)
function BOOL (line 107) | BOOL UipWaitUiThreadUntilExit(HANDLE thread)
function INT_PTR (line 134) | INT_PTR CALLBACK _UiMainWndProc(HWND hwnd, UINT Msg, WPARAM wParam, LPAR...
function LPCDLGTEMPLATEW (line 194) | LPCDLGTEMPLATEW IntUiGetDialogTemplate(UINT dlgResourceId)
function VOID (line 212) | VOID IntUiResizeAndLocateWindow(HWND hwnd, PRECREATEWINDOWINFO *pci)
function DWORD (line 260) | DWORD WINAPI IntUiWorker(VOID *Arg)
function BOOL (line 332) | BOOL IntUiCreateDialog(UIOBJECT *uiObj)
function BOOL (line 377) | BOOL UiIsRunning(UIOBJECT *ui)
function VOID (line 385) | VOID UiRegisterDisposer(UIOBJECT *uiObject, UIAFTEREXITDISPOSER disposer)
function UIOBJECT (line 390) | UIOBJECT *UiCreateDialog(
function UipGetWinVer (line 438) | void UipGetWinVer(LPOSVERSIONINFOA lposv)
function BOOL (line 455) | BOOL UipIsServer2003XpOrEarlier()
function BOOL (line 464) | BOOL UiDrawStringA(HDC dc, LPCSTR text, FLOAT x, FLOAT y, COLORREF forec...
function UiReleaseObject (line 510) | void UiReleaseObject(UIOBJECT *ui)
function BOOL (line 521) | BOOL UiDestroyDialog(UIOBJECT *ui)
function UiForceCloseAllActiveWindows (line 549) | void UiForceCloseAllActiveWindows()
FILE: x64dbgApiBreak/src/util.cpp
function BOOL (line 6) | BOOL UtlpExtractPassedParameters(PPASSED_PARAMETER_CONTEXT paramInfo, BO...
function BOOL (line 80) | BOOL DmaCreateAdapter(WORD sizeOfType, ULONG initialCount, PDMA *dma)
function BOOL (line 112) | BOOL DmaWriteNeedsExpand(PDMA dma, ARCHWIDE needByteSize, ULONG writeBeg...
function BOOL (line 129) | BOOL DmaIssueExpansion(PDMA dma, LONG expansionDelta)
function BOOL (line 154) | BOOL DmapMemIo(PDMA dma, ULONG offset, ARCHWIDE size, void *mem, BOOL wr...
function BOOL (line 207) | BOOL DmaRead(PDMA dma, ULONG offset, ARCHWIDE size, void *destMemory)
function BOOL (line 227) | BOOL DmaWrite(PDMA dma, ULONG offset, ARCHWIDE size, void *srcMemory)
function BOOL (line 246) | BOOL DmaStringWriteA(PDMA dma, LPCSTR format, ...)
function BOOL (line 267) | BOOL DmaStringWriteW(PDMA dma, LPCWSTR format, ...)
function BOOL (line 288) | BOOL DmaReadTypeAlignedSequence(PDMA dma, ULONG index, ULONG count, void...
function BOOL (line 301) | BOOL DmaCopyWrittenMemory(PDMA dma, void **destMemory, BOOL allocForDest)
function BOOL (line 314) | BOOL DmaTakeMemoryOwnership(PDMA dma, void **nativeMem)
function BOOL (line 325) | BOOL DmaPrepareForDirectWrite(PDMA dma, ULONG writeOffset, ARCHWIDE writ...
function DmaGetAdapterInfo (line 348) | void DmaGetAdapterInfo(PDMA dma, ARCHWIDE *writtenSize, ARCHWIDE *totalS...
function DmaEndDirectWrite (line 361) | void DmaEndDirectWrite(PDMA dma)
function BOOL (line 366) | BOOL DmaPrepareForRead(PDMA dma, void **nativeMem)
function BOOL (line 377) | BOOL DmaSink(PDMA dma)
function DmaDestroyAdapter (line 398) | void DmaDestroyAdapter(PDMA dma)
function BOOL (line 418) | BOOL UtlExtractPassedParameters(USHORT paramCount, CALLCONVENTION callCo...
function duint (line 443) | duint UtlGetCallerAddress(REGDUMP *regdump)
function BOOL (line 483) | BOOL UtlInternetReadA(LPCSTR url, BYTE **content, ULONG *contentLength)
function BOOL (line 498) | BOOL UtlInternetReadW(LPCWSTR url, BYTE **content, ULONG *contentLength)
Condensed preview — 152 files, each showing path, character count, and a content snippet. Download the .json file or copy for the full structured content (1,039K chars).
[
{
"path": ".gitignore",
"chars": 99,
"preview": "bin/\r\nRelease/\r\nDebug/\r\nx64/\r\n.vs/\r\n*.sdf\r\n*.opensdf\r\n*.suo\r\n*.vcxproj.user\r\n*.VC.*db\r\n*.bat\r\n*.cmd"
},
{
"path": "README.md",
"chars": 1751,
"preview": "# Api Break for x64dbg\n\nApi Break is a [x64dbg](http://www.x64dbg.com) plugin which is aimed to set breakpoints Win32/64"
},
{
"path": "x64dbgApiBreak/mapperscripts/base/base.abtf",
"chars": 35,
"preview": "\nmaptype HelloType\n{\n\tint val;\n}\n\n\n"
},
{
"path": "x64dbgApiBreak/mapperscripts/main.abtf",
"chars": 3096,
"preview": "/*\n\n#################################################################\nWARNING: This mapper script format is still in the"
},
{
"path": "x64dbgApiBreak/src/apibreak.cpp",
"chars": 17410,
"preview": "#include <corelib.h>\n#include <pluginsdk/_scriptapi_symbol.h>\n#include <pluginsdk/_scriptapi_debug.h>\n#include <pluginsd"
},
{
"path": "x64dbgApiBreak/src/callfind.cpp",
"chars": 3493,
"preview": "#include <corelib.h>\n\nINTERNAL duint AbiGetCallDestinationAddress(BASIC_INSTRUCTION_INFO *inst);\nINTERNAL void AbiCacheI"
},
{
"path": "x64dbgApiBreak/src/dynapidetect.cpp",
"chars": 19040,
"preview": "#include <corelib.h>\n#include <settings.h>\n#include <instparse.h>\n#include <unordered_map>\n#include <pluginsdk/_scriptap"
},
{
"path": "x64dbgApiBreak/src/hlprs.cpp",
"chars": 8157,
"preview": "#include <hlp.h>\n#include <varargs.h>\n\nvoid HlpDebugPrint(const char *format, ...)\n{\n va_list vl;\n char content[0x"
},
{
"path": "x64dbgApiBreak/src/incl/apibreak.h",
"chars": 3778,
"preview": "#ifndef __APIBREAK_H__\n#define __APIBREAK_H__\n\n\n//Disable shitty paranoid warnings\n#pragma warning(disable:4091)\n#pragma"
},
{
"path": "x64dbgApiBreak/src/incl/corelib.h",
"chars": 2310,
"preview": "#ifndef __CORELIB_H_\n#define __CORELIB_H_\n\n#include <apibreak.h>\n#include <defs.h>\n\n#ifdef _WIN64\n#pragma comment(lib, \""
},
{
"path": "x64dbgApiBreak/src/incl/defs.h",
"chars": 1894,
"preview": "#ifndef __DEFS_H_\n#define __DEFS_H_\n\n#include <hlp.h>\n\n#define FORWARDED extern\n#define INTERNAL_EXPORT FORWARDED\n#defin"
},
{
"path": "x64dbgApiBreak/src/incl/dlgs/ApiCallMapForm.hpp",
"chars": 2176,
"preview": "#ifndef __APICALLMAPFORM_HPP_\n#define __APICALLMAPFORM_HPP_\n\n#include <ui/uiwrapper.hpp>\n#include <ui/ctrl/uicombobox.hp"
},
{
"path": "x64dbgApiBreak/src/incl/dlgs/MainForm.hpp",
"chars": 4404,
"preview": "#ifndef __MAINFORM_HPP_\n#define __MAINFORM_HPP_\n\n#include <ui/uiwrapper.hpp>\n#include <ui/ctrl/uicombobox.hpp>\n\n#include"
},
{
"path": "x64dbgApiBreak/src/incl/dlgs/SettingsForm.hpp",
"chars": 3073,
"preview": "#ifndef __SETTINGSFORM_HPP_\n#define __SETTINGSFORM_HPP_\n\n#include <ui/uiwrapper.hpp>\n#include <ui/ctrl/uicheckbox.hpp>\n#"
},
{
"path": "x64dbgApiBreak/src/incl/hlp.h",
"chars": 1516,
"preview": "#ifndef __HELPER_H_\n#define __HELPER_H_\n\n#include <corelib.h>\n\n\n#define HLP_TRIM_LEFT 1\n#define HLP_TRIM_RIGHT "
},
{
"path": "x64dbgApiBreak/src/incl/instparse.h",
"chars": 1231,
"preview": "#ifndef __INSTPARSE_H__\n#define __INSTPARSE_H__\n\n#include <corelib.h>\n\ntypedef struct\n{\n uchar size"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/DeviceNameResolver/DeviceNameResolver.h",
"chars": 845,
"preview": "#ifndef _DEVICENAMERESOLVER_H\r\n#define _DEVICENAMERESOLVER_H\r\n\r\n#include <windows.h>\r\n\r\n#ifdef __cplusplus\r\nextern \"C\"\r\n"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/TitanEngine/TitanEngine.h",
"chars": 65294,
"preview": "#ifndef TITANENGINE\r\n#define TITANENGINE\r\n\r\n#define TITCALL\r\n\r\n#if _MSC_VER > 1000\r\n#pragma once\r\n#endif\r\n\r\n#include <wi"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/XEDParse/XEDParse.h",
"chars": 1263,
"preview": "#ifndef _XEDPARSE_H\r\n#define _XEDPARSE_H\r\n\r\n#include <windows.h>\r\n\r\n//XEDParse defines\r\n#ifdef XEDPARSE_BUILD\r\n#define X"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/_dbgfunctions.h",
"chars": 9760,
"preview": "#ifndef _DBGFUNCTIONS_H\r\n#define _DBGFUNCTIONS_H\r\n\r\n#ifndef __cplusplus\r\n#include <stdbool.h>\r\n#endif\r\n\r\ntypedef struct\r"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/_plugin_types.h",
"chars": 444,
"preview": "#ifndef _PLUGIN_DATA_H\r\n#define _PLUGIN_DATA_H\r\n\r\n#ifdef BUILD_DBG\r\n\r\n#include \"_global.h\"\r\n#include \"jansson/jansson.h\""
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/_plugins.h",
"chars": 8662,
"preview": "#ifndef _PLUGINS_H\r\n#define _PLUGINS_H\r\n\r\n#ifndef __cplusplus\r\n#include <stdbool.h>\r\n#endif\r\n\r\n#ifndef PLUG_IMPEXP\r\n#ifd"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/_scriptapi.h",
"chars": 132,
"preview": "#ifndef _SCRIPT_API_H\r\n#define _SCRIPT_API_H\r\n\r\n#include \"_plugins.h\"\r\n\r\n#define SCRIPT_EXPORT PLUG_IMPEXP\r\n\r\n#endif //_"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/_scriptapi_argument.h",
"chars": 1127,
"preview": "#ifndef _SCRIPTAPI_ARGUMENT_H\r\n#define _SCRIPTAPI_ARGUMENT_H\r\n\r\n#include \"_scriptapi.h\"\r\n\r\nnamespace Script\r\n{\r\n name"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/_scriptapi_assembler.h",
"chars": 706,
"preview": "#ifndef _SCRIPTAPI_ASSEMBLER_H\r\n#define _SCRIPTAPI_ASSEMBLER_H\r\n\r\n#include \"_scriptapi.h\"\r\n\r\nnamespace Script\r\n{\r\n na"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/_scriptapi_bookmark.h",
"chars": 853,
"preview": "#ifndef _SCRIPTAPI_BOOKMARK_H\r\n#define _SCRIPTAPI_BOOKMARK_H\r\n\r\n#include \"_scriptapi.h\"\r\n\r\nnamespace Script\r\n{\r\n name"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/_scriptapi_comment.h",
"chars": 939,
"preview": "#ifndef _SCRIPTAPI_COMMENT_H\r\n#define _SCRIPTAPI_COMMENT_H\r\n\r\n#include \"_scriptapi.h\"\r\n\r\nnamespace Script\r\n{\r\n namesp"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/_scriptapi_debug.h",
"chars": 944,
"preview": "#ifndef _SCRIPTAPI_DEBUG_H\r\n#define _SCRIPTAPI_DEBUG_H\r\n\r\n#include \"_scriptapi.h\"\r\n\r\nnamespace Script\r\n{\r\n namespace "
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/_scriptapi_flag.h",
"chars": 1237,
"preview": "#ifndef _SCRIPTAPI_FLAG_H\r\n#define _SCRIPTAPI_FLAG_H\r\n\r\n#include \"_scriptapi.h\"\r\n\r\nnamespace Script\r\n{\r\n namespace Fl"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/_scriptapi_function.h",
"chars": 1186,
"preview": "#ifndef _SCRIPTAPI_FUNCTION_H\r\n#define _SCRIPTAPI_FUNCTION_H\r\n\r\n#include \"_scriptapi.h\"\r\n\r\nnamespace Script\r\n{\r\n name"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/_scriptapi_gui.h",
"chars": 2497,
"preview": "#ifndef _SCRIPTAPI_GUI_H\r\n#define _SCRIPTAPI_GUI_H\r\n\r\n#include \"_scriptapi.h\"\r\n\r\nnamespace Script\r\n{\r\n namespace Gui\r"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/_scriptapi_label.h",
"chars": 991,
"preview": "#ifndef _SCRIPTAPI_LABEL_H\r\n#define _SCRIPTAPI_LABEL_H\r\n\r\n#include \"_scriptapi.h\"\r\n\r\nnamespace Script\r\n{\r\n namespace "
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/_scriptapi_memory.h",
"chars": 1485,
"preview": "#ifndef _SCRIPTAPI_MEMORY_H\r\n#define _SCRIPTAPI_MEMORY_H\r\n\r\n#include \"_scriptapi.h\"\r\n\r\nnamespace Script\r\n{\r\n namespac"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/_scriptapi_misc.h",
"chars": 2663,
"preview": "#ifndef _SCRIPTAPI_MISC_H\r\n#define _SCRIPTAPI_MISC_H\r\n\r\n#include \"_scriptapi.h\"\r\n\r\nnamespace Script\r\n{\r\n namespace Mi"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/_scriptapi_module.h",
"chars": 2545,
"preview": "#ifndef _SCRIPTAPI_MODULE_H\r\n#define _SCRIPTAPI_MODULE_H\r\n\r\n#include \"_scriptapi.h\"\r\n\r\nnamespace Script\r\n{\r\n namespac"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/_scriptapi_pattern.h",
"chars": 801,
"preview": "#ifndef _SCRIPTAPI_PATTERN_H\r\n#define _SCRIPTAPI_PATTERN_H\r\n\r\n#include \"_scriptapi.h\"\r\n\r\nnamespace Script\r\n{\r\n namesp"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/_scriptapi_register.h",
"chars": 10958,
"preview": "#ifndef _SCRIPTAPI_REGISTER_H\r\n#define _SCRIPTAPI_REGISTER_H\r\n\r\n#include \"_scriptapi.h\"\r\n\r\nnamespace Script\r\n{\r\n name"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/_scriptapi_stack.h",
"chars": 447,
"preview": "#ifndef _SCRIPTAPI_STACK_H\r\n#define _SCRIPTAPI_STACK_H\r\n\r\n#include \"_scriptapi.h\"\r\n\r\nnamespace Script\r\n{\r\n namespace "
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/_scriptapi_symbol.h",
"chars": 679,
"preview": "#ifndef _SCRIPTAPI_SYMBOL_H\r\n#define _SCRIPTAPI_SYMBOL_H\r\n\r\n#include \"_scriptapi.h\"\r\n\r\nnamespace Script\r\n{\r\n namespac"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/bridgegraph.h",
"chars": 6518,
"preview": "#ifndef _GRAPH_H\r\n#define _GRAPH_H\r\n\r\ntypedef struct\r\n{\r\n duint addr; //virtual address of the instruction\r\n unsig"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/bridgelist.h",
"chars": 4228,
"preview": "#ifndef _LIST_H\r\n#define _LIST_H\r\n\r\ntypedef struct\r\n{\r\n int count; //Number of element in the list.\r\n size_t size;"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/bridgemain.h",
"chars": 48397,
"preview": "#ifndef _BRIDGEMAIN_H_\r\n#define _BRIDGEMAIN_H_\r\n\r\n#include <windows.h>\r\n\r\n#ifndef __cplusplus\r\n#include <stdbool.h>\r\n#en"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/capstone/arm.h",
"chars": 22080,
"preview": "#ifndef CAPSTONE_ARM_H\r\n#define CAPSTONE_ARM_H\r\n\r\n/* Capstone Disassembly Engine */\r\n/* By Nguyen Anh Quynh <aquynh@gmai"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/capstone/arm64.h",
"chars": 32749,
"preview": "#ifndef CAPSTONE_ARM64_H\r\n#define CAPSTONE_ARM64_H\r\n\r\n/* Capstone Disassembly Engine */\r\n/* By Nguyen Anh Quynh <aquynh@"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/capstone/capstone.h",
"chars": 29437,
"preview": "#ifndef CAPSTONE_ENGINE_H\r\n#define CAPSTONE_ENGINE_H\r\n\r\n/* Capstone Disassembly Engine */\r\n/* By Nguyen Anh Quynh <aquyn"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/capstone/m68k.h",
"chars": 15128,
"preview": "#ifndef CAPSTONE_M68K_H\r\n#define CAPSTONE_M68K_H\r\n\r\n/* Capstone Disassembly Engine */\r\n/* By Daniel Collin <daniel@colli"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/capstone/mips.h",
"chars": 20560,
"preview": "#ifndef CAPSTONE_MIPS_H\r\n#define CAPSTONE_MIPS_H\r\n\r\n/* Capstone Disassembly Engine */\r\n/* By Nguyen Anh Quynh <aquynh@gm"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/capstone/platform.h",
"chars": 3897,
"preview": "/* Capstone Disassembly Engine */\r\n/* By Axel Souchet & Nguyen Anh Quynh, 2014 */\r\n\r\n#ifndef CAPSTONE_PLATFORM_H\r\n#defin"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/capstone/ppc.h",
"chars": 31276,
"preview": "#ifndef CAPSTONE_PPC_H\r\n#define CAPSTONE_PPC_H\r\n\r\n/* Capstone Disassembly Engine */\r\n/* By Nguyen Anh Quynh <aquynh@gmai"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/capstone/sparc.h",
"chars": 13174,
"preview": "#ifndef CAPSTONE_SPARC_H\r\n#define CAPSTONE_SPARC_H\r\n\r\n/* Capstone Disassembly Engine */\r\n/* By Nguyen Anh Quynh <aquynh@"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/capstone/systemz.h",
"chars": 17465,
"preview": "#ifndef CAPSTONE_SYSTEMZ_H\r\n#define CAPSTONE_SYSTEMZ_H\r\n\r\n/* Capstone Disassembly Engine */\r\n/* By Nguyen Anh Quynh <aqu"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/capstone/x86.h",
"chars": 47966,
"preview": "#ifndef CAPSTONE_X86_H\r\n#define CAPSTONE_X86_H\r\n\r\n/* Capstone Disassembly Engine */\r\n/* By Nguyen Anh Quynh <aquynh@gmai"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/capstone/xcore.h",
"chars": 5689,
"preview": "#ifndef CAPSTONE_XCORE_H\r\n#define CAPSTONE_XCORE_H\r\n\r\n/* Capstone Disassembly Engine */\r\n/* By Nguyen Anh Quynh <aquynh@"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/dbghelp/dbghelp.h",
"chars": 126693,
"preview": "#ifndef _DBGHELP_\r\n#define _DBGHELP_\r\n\r\n\r\n// As a general principal always call the 64 bit version\r\n// of every API, if "
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/jansson/jansson.h",
"chars": 11847,
"preview": "/*\r\n * Copyright (c) 2009-2016 Petri Lehtinen <petri@digip.org>\r\n *\r\n * Jansson is free software; you can redistribute i"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/jansson/jansson_config.h",
"chars": 1906,
"preview": "/*\r\n * Copyright (c) 2010-2016 Petri Lehtinen <petri@digip.org>\r\n *\r\n * Jansson is free software; you can redistribute i"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/jansson/jansson_x64dbg.h",
"chars": 518,
"preview": "#pragma once\r\n\r\n#include \"jansson.h\"\r\n\r\ntypedef json_t* JSON;\r\n\r\nstatic JSON_INLINE\r\njson_t* json_hex(unsigned json_int_"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/lz4/lz4.h",
"chars": 13003,
"preview": "/*\r\n LZ4 - Fast LZ compression algorithm\r\n Header File\r\n Copyright (C) 2011-2014, Yann Collet.\r\n BSD 2-Clause Li"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/lz4/lz4file.h",
"chars": 815,
"preview": "#ifndef _LZ4FILE_H\r\n#define _LZ4FILE_H\r\n\r\ntypedef enum _LZ4_STATUS\r\n{\r\n LZ4_SUCCESS,\r\n LZ4_FAILED_OPEN_INPUT,\r\n "
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/lz4/lz4hc.h",
"chars": 9332,
"preview": "/*\r\n LZ4 HC - High Compression Mode of LZ4\r\n Header File\r\n Copyright (C) 2011-2014, Yann Collet.\r\n BSD 2-Clause "
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara/ahocorasick.h",
"chars": 2703,
"preview": "/*\r\nCopyright (c) 2013. The YARA Authors. All Rights Reserved.\r\n\r\nRedistribution and use in source and binary forms, wit"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara/arena.h",
"chars": 3650,
"preview": "/*\r\nCopyright (c) 2013. The YARA Authors. All Rights Reserved.\r\n\r\nRedistribution and use in source and binary forms, wit"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara/atoms.h",
"chars": 2823,
"preview": "/*\r\nCopyright (c) 2013. The YARA Authors. All Rights Reserved.\r\n\r\nRedistribution and use in source and binary forms, wit"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara/compiler.h",
"chars": 6073,
"preview": "/*\r\nCopyright (c) 2013. The YARA Authors. All Rights Reserved.\r\n\r\nRedistribution and use in source and binary forms, wit"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara/dotnet.h",
"chars": 8632,
"preview": "#ifndef YR_DOTNET_H\n#define YR_DOTNET_H\n\n\n//\n// CLI header.\n// ECMA-335 Section II.25.3.3\n//\ntypedef struct _CLI_HEADER\n"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara/elf.h",
"chars": 10994,
"preview": "/*\r\nCopyright (c) 2013. The YARA Authors. All Rights Reserved.\r\n\r\nRedistribution and use in source and binary forms, wit"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara/endian.h",
"chars": 2986,
"preview": "/*\nCopyright (c) 2016. The YARA Authors. All Rights Reserved.\n\nRedistribution and use in source and binary forms, with o"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara/error.h",
"chars": 5175,
"preview": "/*\r\nCopyright (c) 2014. The YARA Authors. All Rights Reserved.\r\n\r\nRedistribution and use in source and binary forms, wit"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara/exec.h",
"chars": 6353,
"preview": "/*\r\nCopyright (c) 2013-2014. The YARA Authors. All Rights Reserved.\r\n\r\nRedistribution and use in source and binary forms"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara/exefiles.h",
"chars": 1787,
"preview": "/*\r\nCopyright (c) 2007. The YARA Authors. All Rights Reserved.\r\n\r\nRedistribution and use in source and binary forms, wit"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara/filemap.h",
"chars": 2655,
"preview": "/*\r\nCopyright (c) 2007-2015. The YARA Authors. All Rights Reserved.\r\n\r\nRedistribution and use in source and binary forms"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara/globals.h",
"chars": 1768,
"preview": "/*\r\nCopyright (c) 2014. The YARA Authors. All Rights Reserved.\r\n\r\nRedistribution and use in source and binary forms, wit"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara/hash.h",
"chars": 2821,
"preview": "/*\r\nCopyright (c) 2013. The YARA Authors. All Rights Reserved.\r\n\r\nRedistribution and use in source and binary forms, wit"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara/hex_lexer.h",
"chars": 3202,
"preview": "/*\r\nCopyright (c) 2007. Victor M. Alvarez [plusvic@gmail.com].\r\n\r\nRedistribution and use in source and binary forms, wit"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara/integers.h",
"chars": 2425,
"preview": "/*\r\nCopyright (c) 2007-2015. The YARA Authors. All Rights Reserved.\r\n\r\nRedistribution and use in source and binary forms"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara/lexer.h",
"chars": 4097,
"preview": "/*\r\nCopyright (c) 2007. Victor M. Alvarez [plusvic@gmail.com].\r\n\r\nRedistribution and use in source and binary forms, wit"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara/libyara.h",
"chars": 2605,
"preview": "/*\r\nCopyright (c) 2014. The YARA Authors. All Rights Reserved.\r\n\r\nRedistribution and use in source and binary forms, wit"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara/limits.h",
"chars": 2511,
"preview": "/*\r\nCopyright (c) 2013. The YARA Authors. All Rights Reserved.\r\n\r\nRedistribution and use in source and binary forms, wit"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara/mem.h",
"chars": 2150,
"preview": "/*\r\nCopyright (c) 2007. The YARA Authors. All Rights Reserved.\r\n\r\nRedistribution and use in source and binary forms, wit"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara/modules.h",
"chars": 11375,
"preview": "/*\r\nCopyright (c) 2014. The YARA Authors. All Rights Reserved.\r\n\r\nRedistribution and use in source and binary forms, wit"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara/object.h",
"chars": 4180,
"preview": "/*\r\nCopyright (c) 2014. The YARA Authors. All Rights Reserved.\r\n\r\nRedistribution and use in source and binary forms, wit"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara/parser.h",
"chars": 3738,
"preview": "/*\r\nCopyright (c) 2013. The YARA Authors. All Rights Reserved.\r\n\r\nRedistribution and use in source and binary forms, wit"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara/pe.h",
"chars": 17811,
"preview": "/*\r\nCopyright (c) 2013. The YARA Authors. All Rights Reserved.\r\n\r\nRedistribution and use in source and binary forms, wit"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara/pe_utils.h",
"chars": 2375,
"preview": "#ifndef YR_PE_UTILS_H\n#define YR_PE_UTILS_H\n\n#include <yara/pe.h>\n\n#define MAX_PE_SECTIONS 96\n\n\n#define IS_"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara/proc.h",
"chars": 1759,
"preview": "/*\r\nCopyright (c) 2007. The YARA Authors. All Rights Reserved.\r\n\r\nRedistribution and use in source and binary forms, wit"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara/re.h",
"chars": 6708,
"preview": "/*\r\nCopyright (c) 2013. The YARA Authors. All Rights Reserved.\r\n\r\nRedistribution and use in source and binary forms, wit"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara/re_lexer.h",
"chars": 3177,
"preview": "/*\r\nCopyright (c) 2013. The YARA Authors. All Rights Reserved.\r\n\r\nRedistribution and use in source and binary forms, wit"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara/rules.h",
"chars": 4305,
"preview": "/*\r\nCopyright (c) 2014. The YARA Authors. All Rights Reserved.\r\n\r\nRedistribution and use in source and binary forms, wit"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara/scan.h",
"chars": 1917,
"preview": "/*\r\nCopyright (c) 2014. The YARA Authors. All Rights Reserved.\r\n\r\nRedistribution and use in source and binary forms, wit"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara/sizedstr.h",
"chars": 2230,
"preview": "/*\r\nCopyright (c) 2007-2014. The YARA Authors. All Rights Reserved.\r\n\r\nRedistribution and use in source and binary forms"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara/stream.h",
"chars": 2201,
"preview": "/*\r\nCopyright (c) 2015. The YARA Authors. All Rights Reserved.\r\n\r\nRedistribution and use in source and binary forms, wit"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara/strutils.h",
"chars": 2545,
"preview": "/*\r\nCopyright (c) 2007-2014. The YARA Authors. All Rights Reserved.\r\n\r\nRedistribution and use in source and binary forms"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara/threading.h",
"chars": 2317,
"preview": "/*\r\nCopyright (c) 2016. The YARA Authors. All Rights Reserved.\r\n\r\nRedistribution and use in source and binary forms, wit"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara/types.h",
"chars": 13215,
"preview": "/*\r\nCopyright (c) 2013. The YARA Authors. All Rights Reserved.\r\n\r\nRedistribution and use in source and binary forms, wit"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara/utils.h",
"chars": 3469,
"preview": "/*\r\nCopyright (c) 2014. The YARA Authors. All Rights Reserved.\r\n\r\nRedistribution and use in source and binary forms, wit"
},
{
"path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara.h",
"chars": 1814,
"preview": "/*\r\nCopyright (c) 2007-2013. The YARA Authors. All Rights Reserved.\r\n\r\nRedistribution and use in source and binary forms"
},
{
"path": "x64dbgApiBreak/src/incl/qpc.hpp",
"chars": 2017,
"preview": "#ifndef __QPC_HPP__\n#define __QPC_HPP__\n\n#include <corelib.h>\n#include <util.h>\n\n\nstatic LARGE_INTEGER freq = { 0 };\n\n#i"
},
{
"path": "x64dbgApiBreak/src/incl/rtf.h",
"chars": 2809,
"preview": "#ifndef __RTF_H__\n#define __RTF_H__\n\n#include <corelib.h>\n#include <util.h>\n\ntypedef struct __RTF_DATA\n{\n PDMA "
},
{
"path": "x64dbgApiBreak/src/incl/settings.h",
"chars": 419,
"preview": "#ifndef __SETTINGS_H_\n#define __SETTINGS_H_\n\n#include <corelib.h>\n\ntypedef struct\n{\n bool exposeDynamicApiLoads;\n "
},
{
"path": "x64dbgApiBreak/src/incl/structmemmap.h",
"chars": 991,
"preview": "#ifndef __STRUCTMEMMAP_H__\n#define __STRUCTMEMMAP_H__\n\n#include <corelib.h>\n#include <util.h>\n\ntypedef struct __FNSIGN *"
},
{
"path": "x64dbgApiBreak/src/incl/ui/ctrl/uicheckbox.hpp",
"chars": 491,
"preview": "#pragma once\n\n#include <ui/ctrl/uicontrolbase.hpp>\n\nclass UiCheckBox : public UiControlBase\n{\nprivate:\n\npublic:\n\n IMP"
},
{
"path": "x64dbgApiBreak/src/incl/ui/ctrl/uicombobox.hpp",
"chars": 970,
"preview": "#pragma once\n\n#include <ui/ctrl/uicontrolbase.hpp>\n\nclass UiComboBox : public UiControlBase\n{\nprivate:\n\npublic:\n\n IMP"
},
{
"path": "x64dbgApiBreak/src/incl/ui/ctrl/uicontrolbase.hpp",
"chars": 4949,
"preview": "#pragma once\n#include <ui/ui.h>\n#include <ui/uiwrapper.hpp>\n\n#define IMPL_CTRLBASE_CTOR(t) t(UIOBJECT *ui, ULONG ctrlId,"
},
{
"path": "x64dbgApiBreak/src/incl/ui/ui.h",
"chars": 1859,
"preview": "#ifndef __UI_H_\n#define __UI_H_\n\n#include <corelib.h>\n#include <CommCtrl.h>\n\ntypedef struct\n{\n DWORD flag;\n POIN"
},
{
"path": "x64dbgApiBreak/src/incl/ui/uiwrapper.hpp",
"chars": 8670,
"preview": "#pragma once\n\nclass UiWrapper;\n\n#include <ui/ui.h>\n#include <ui/ctrl/uicontrolbase.hpp>\n\n#include <unordered_map>\n\nusing"
},
{
"path": "x64dbgApiBreak/src/incl/util.h",
"chars": 2328,
"preview": "#ifndef __UTIL_H__\n#define __UTIL_H__\n\n#include <corelib.h>\n\ntypedef enum\n{\n Cdecl,\n Stdcall,\n Fastcall,\n Th"
},
{
"path": "x64dbgApiBreak/src/instparse.cpp",
"chars": 10356,
"preview": "#include <instparse.h>\n\nconst char *regs[17]\n{\n \"*ax\",\n \"*bx\",\n \"*cx\",\n \"*dx\",\n \"*si\",\n \"*di\",\n \"*b"
},
{
"path": "x64dbgApiBreak/src/plugin.cpp",
"chars": 13499,
"preview": "#include <corelib.h>\n#include <settings.h>\n#include <dlgs/MainForm.hpp>\n#include <dlgs/SettingsForm.hpp>\n#include <struc"
},
{
"path": "x64dbgApiBreak/src/rtf.cpp",
"chars": 4941,
"preview": "#include <rtf.h>\n\n#define RDS_NEEDS_SPACE 0x00000001\n\n\n#define RTF_SETSTATE(rtf,x) if (!(rtf->state & x)) \\\n "
},
{
"path": "x64dbgApiBreak/src/settings.cpp",
"chars": 4326,
"preview": "#include <settings.h>\n\n#define ABP_INT_VALUE 0\n#define ABP_BOOL_VALUE 1\n#define ABP_DOUBLE_VALUE 2\n#define"
},
{
"path": "x64dbgApiBreak/src/structmemmap.cpp",
"chars": 48332,
"preview": "#include <structmemmap.h>\n\n#define MAX_TYPENAME_SIZE 128\n\n#define ALLOCOBJECTLIST(type,count) RESIZEOB"
},
{
"path": "x64dbgApiBreak/src/syslib.cpp",
"chars": 7280,
"preview": "#include <corelib.h>\n\n#define TRY_MAX_WAITMS 1000\n#define TRY_WAIT_PERCALL 20\n#define TRY_COUNT (TRY_M"
},
{
"path": "x64dbgApiBreak/src/ui/ui.cpp",
"chars": 10822,
"preview": "#include <Windows.h>\n#include <ui/ui.h>\n#include <map>\n\nusing namespace std;\n\n#pragma comment(lib,\"Comctl32.lib\")\n\n#defi"
},
{
"path": "x64dbgApiBreak/src/util.cpp",
"chars": 13052,
"preview": "#include <util.h>\n#include <winhttp.h>\n\n#pragma comment(lib,\"Winhttp.lib\")\n\nBOOL UtlpExtractPassedParameters(PPASSED_PAR"
},
{
"path": "x64dbgApiBreak/x64dbgApiBreak.vcxproj",
"chars": 10678,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\"?>\n<Project DefaultTargets=\"Build\" ToolsVersion=\"14.0\" xmlns=\"http://schemas.micros"
},
{
"path": "x64dbgApiBreak/x64dbgApiBreak.vcxproj.filters",
"chars": 4073,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\"?>\n<Project ToolsVersion=\"4.0\" xmlns=\"http://schemas.microsoft.com/developer/msbuil"
},
{
"path": "x64dbgApiBreak.sln",
"chars": 1294,
"preview": "\nMicrosoft Visual Studio Solution File, Format Version 12.00\n# Visual Studio 14\nVisualStudioVersion = 14.0.25420.1\nMini"
}
]
// ... and 35 more files (download for full content)
About this extraction
This page contains the full source code of the 0ffffffffh/Api-Break-for-x64dbg GitHub repository, extracted and formatted as plain text for AI agents and large language models (LLMs). The extraction includes 152 files (944.6 KB), approximately 273.2k tokens, and a symbol index with 994 extracted functions, classes, methods, constants, and types. Use this with OpenClaw, Claude, ChatGPT, Cursor, Windsurf, or any other AI tool that accepts text input. You can copy the full output to your clipboard or download it as a .txt file.
Extracted by GitExtract — free GitHub repo to text converter for AI. Built by Nikandr Surkov.