[ { "path": ".gitignore", "content": "bin/\r\nRelease/\r\nDebug/\r\nx64/\r\n.vs/\r\n*.sdf\r\n*.opensdf\r\n*.suo\r\n*.vcxproj.user\r\n*.VC.*db\r\n*.bat\r\n*.cmd" }, { "path": "README.md", "content": "# Api Break for x64dbg\n\nApi Break is a [x64dbg](http://www.x64dbg.com) plugin which is aimed to set breakpoints Win32/64 API calls easly. \n\n![ab1](https://raw.githubusercontent.com/0ffffffffh/0ffffffffh.github.io/master/apibreakaction.gif \"Breakpoint on callers\")\n\n![ab2](https://user-images.githubusercontent.com/437161/34647882-eb65aadc-f39f-11e7-8c14-f1cc3254d0f0.png \"Struct and API call mapper\")\n\n####**Features**\n\n* API function entry breakpoint (AEB) \n* Breakpoint at API callers (BAC)\n* Auto-populating modules and their API functions used by the process.\n\n\n#### **API Function Entry Breakpoint (AEB)**\n\nIt can be useful when the code does obfuscated or indirect api calls or something similar conditions. This mode is automatically (naturally) handles all API calls for the entire module. Also, this mode gives an option to jump automatically to the API caller when the API entry breakpoint hit. It exposes the original caller using single step callstack backtracing.\n\n#### **Breakpoint at API callers (BAC)**\nIn technically, this mode is much more flexible and customizable. It does scan dynamically for API calls in specified module or address range. For now, it scans only process's code range. But other features are planned for future development.\n\nIf you have any idea, let me know what ideas you have about it.\n\n#####**In-Development features**\n - Dynamically loaded API detection which is made by using [GetProcAddress](https://msdn.microsoft.com/en-us/library/windows/desktop/ms683212%28v=vs.85%29.aspx) (*About 45% implemented*)\n\n\n#####**Planning features**\n\n - User specified code range scan for **BAC**\n - User specified module scan for **BAC**\n - User option to listing all linked modules and APIs of process regardless of IAT.\n\n" }, { "path": "x64dbgApiBreak/mapperscripts/base/base.abtf", "content": "\nmaptype HelloType\n{\n\tint val;\n}\n\n\n" }, { "path": "x64dbgApiBreak/mapperscripts/main.abtf", "content": "/*\n\n#################################################################\nWARNING: This mapper script format is still in the design phase. \nAnd it may change until the final release. \nHence, the scripts that are written based on the draft phase \nmay not work in subsequent versions of ApiBreak plugin.\n\nFor now, this description of the script format is quite messy. I can \nmake it better if I have more free time.\n#################################################################\n\n[1 - Builtin Primitive Types]\n\nint : System default size integer\nuint : System default size unsigned integer\nchar : Ansi Char\nwchar : Wide char\nbyte : 1 byte (8 bit) singed integer\nubyte : 1 byte (8 bit) unsigned integer\nshort : 2 byte (16 bit) signed integer\nushort : 2 byte (16 bit) unsigned integer\nlong : 4 byte (32 bit) signed integer\nulong : 4 byte (32 bit) unsigned integer\nlong64 : 8 byte (64 bit) signed integer\nulong64 : 8 byte (64 bit) unsigned integer\n\n[2 - Special Primitive Types]\n\nstring : ANSI char sequence\nwstring : WIDE char sequence\npointer : Untyped generic system sized pointer\narchex : Architecture depended hexadecimal value\n\n\n[3 - Builtin Aliases]\n\nBYTE : alias for ubyte\nWORD : alias for ushort\nDWORD : alias for ulong\nQWORD : alias for ulong64\n\n[4 - User defined aliases]\nUsers also can define their own aliases \n\nalias [ALIAS_TYPE_NAME] [OWN_ALIAS_IDENTIFIER_FOR_TYPE]\n\nfor example;\n\nalias ulong u32_t\n\n[4 - Including different script sources]\n\nUsers can write their api and type definition into multiple file or source\nAnd they can include these scripts in their own script file for later usage.\n\nThey can include scripts from the another local directory or the internet web address. \n\n@incl [FILEPATH] or [URL]\n\nfor example;\n\n@incl 'anotherdirectory/myscript.abtf'\n\n@incl 'http://myserver.com/scripts/main.abtf'\n\n\n\n[5 - API function signature declaration]\n\nfnsign {RETTYPE} [ModuleName]![ApiFunctionName]({[ARGUMENT_TYPE] argName1, ...})\n\nfor example:\nHere is TerminateProcess function definition in C style prototype\n\nBOOL WINAPI TerminateProcess(\n _In_ HANDLE hProcess,\n _In_ UINT uExitCode\n);\n\nAnd this is mapper signature definition \n\nalias int BOOL //for BOOL typedef. u remember that 'alias' thing?\n\nfnsign BOOL kernel32.dll!TerminateProcess(pointer hprocess, uint exitCode)\n\nor without return type example.\n\nvoid GdiplusShutdown(\n __in ULONG_PTR token\n);\n\nfnsign Gdiplus.dll!GdiplusShutdown(pointer token)\n\n\n[6 - Type struct definition]\n\nmaptype [TYPE_IDENTITY]\n{\n\t[FIELD_TYPE1] [fieldName1],\n\t\n\t... \n\tanother fields if you have\n}\n\nfor example\n\nmaptype mytype\n{\n\tint \t\tx;\n\twstring \tstr;\t\n}\n\nnow you can use mytype as declared type as you want. \nusing in api function signature arg, alias or \n\nNOTE: Currently, nested types are not fully supported. (But I will completely.)\n\n*/\n\n@incl 'base/base.abtf'\n\n/* 'HelloType' defined in base/base.abtf as user type structure */\nalias HelloType MyHelloType\n\nfnsign pointer kernel32.dll!CreateFileW(wstring fileName, DWORD desiredAccess, DWORD shareMode, pointer secAttrib, DWORD creationDisp, DWORD flagAttrib, out pointer templFile)\n\n\n" }, { "path": "x64dbgApiBreak/src/apibreak.cpp", "content": "#include \n#include \n#include \n#include \n#include \n#include \n#include \n\nusing namespace Script::Module;\nusing namespace Script::Symbol;\nusing namespace Script::Debug;\nusing namespace Script::Register;\n\nmodlist AbpModuleList;\nunordered_map AbpBreakpointList;\n\nINTERNAL bool AbiDetectAPIsUsingByGetProcAddress();\nINTERNAL int AbiSearchCallersForAFI(duint codeBase, duint codeSize, ApiFunctionInfo *afi);\nINTERNAL ModuleInfo * AbiGetCurrentModuleInfo();\n\nFORWARDED BOOL AbfNeedsReload;\n\nvoid AbpReleaseBreakpointResources()\n{\n unordered_map::iterator it;\n\n if (AbpBreakpointList.size() == 0)\n return;\n\n while (AbpBreakpointList.size() > 0)\n {\n it = AbpBreakpointList.begin();\n\n if (it->second->cbctx != NULL)\n FREEOBJECT(it->second->cbctx);\n\n FREEOBJECT(it->second);\n \n AbpBreakpointList.erase(it);\n }\n}\n\nPBREAKPOINT_INFO AbpLookupBreakpoint(duint addr)\n{\n unordered_map::iterator iter;\n\n iter = AbpBreakpointList.find(addr);\n\n if (iter == AbpBreakpointList.end())\n return FALSE;\n\n return iter->second;\n}\n\nbool AbpRegisterBreakpoint(duint addr, DWORD options, BpCallbackContext *cbctx)\n{\n PBREAKPOINT_INFO pbi;\n\n if (AbpBreakpointList.find(addr) != AbpBreakpointList.end())\n return false;\n\n pbi = ALLOCOBJECT(BREAKPOINT_INFO);\n\n if (!pbi)\n return false;\n\n pbi->addr = addr;\n pbi->options = options;\n pbi->hitCount = 0;\n pbi->cbctx = cbctx;\n\n cbctx->ownerBreakpoint = pbi;\n\n AbpBreakpointList.insert({ addr,pbi });\n\n return true;\n}\n\nbool AbpDeregisterBreakpoint(duint addr)\n{\n unordered_map::iterator iter;\n\n iter = AbpBreakpointList.find(addr);\n\n if (iter == AbpBreakpointList.end())\n return false;\n\n if (iter->second->cbctx != NULL)\n FREEOBJECT(iter->second->cbctx);\n\n FREEOBJECT(iter->second);\n\n AbpBreakpointList.erase(iter);\n return true;\n}\n\n\nModuleApiInfo *AbpSearchModuleApiInfo(const char *name)\n{\n for (modlist::iterator n = AbpModuleList.begin(); n != AbpModuleList.end(); n++)\n {\n if (!strcmp((*n)->name, name))\n return *n;\n }\n\n return NULL;\n}\n\nApiFunctionInfo *AbpSearchApiFunctionInfo(ModuleApiInfo *moduleInfo, const char *func)\n{\n apilist::iterator iter;\n string sfunc(func);\n\n if (!moduleInfo)\n return NULL;\n\n\n iter = moduleInfo->apiList->find(sfunc);\n\n if (iter != moduleInfo->apiList->end())\n return iter->second;\n\n return NULL;\n}\n\n\nvoid AbpLinkApiExportsToModule(ListInfo *moduleList)\n{\n ModuleInfo *module = NULL; \n\n for (modlist::iterator n = AbpModuleList.begin(); n != AbpModuleList.end(); n++)\n {\n module = static_cast(moduleList->data);\n\n for (int i = 0;i < moduleList->count;i++)\n {\n if (!strcmp(module->name, (*n)->name))\n {\n (*n)->baseAddr = module->base;\n break;\n }\n\n module++;\n }\n\n \n }\n}\n\nbool AbpDeregisterModule(ModuleApiInfo *mai)\n{\n apilist::iterator apit;\n modlist::iterator modit;\n ApiFunctionInfo *afi;\n \n if (!mai)\n return false;\n\n \n for (apit = mai->apiList->begin(); apit != mai->apiList->end(); apit++)\n {\n afi = apit->second;\n\n if (afi->callInfo.calls)\n FREEOBJECT(afi->callInfo.calls);\n\n FREEOBJECT(afi);\n }\n \n mai->listCount = 0;\n mai->apiList->clear();\n delete mai->apiList;\n\n for (modit = AbpModuleList.begin(); modit != AbpModuleList.end(); modit++)\n {\n if ((*modit) == mai)\n break;\n }\n\n \n AbpModuleList.erase(modit);\n \n FREEOBJECT(mai);\n\n return true;\n}\n\nbool AbpRegisterApi(SymbolInfo *sym, ApiFunctionInfo **pafi)\n{\n ModuleApiInfo *mai = NULL;\n ApiFunctionInfo *afi = NULL;\n\tBOOL afiExist = FALSE;\n\n\tif (pafi)\n\t\t*pafi = NULL;\n\n CharLowerA(sym->mod);\n\n mai = AbpSearchModuleApiInfo(sym->mod);\n\n if (!mai)\n {\n mai = ALLOCOBJECT(ModuleApiInfo);\n\n if (!mai)\n return false;\n\n strcpy(mai->name, sym->mod);\n mai->baseAddr = 0;\n mai->apiList = new apilist();\n AbpModuleList.push_back(mai);\n }\n\n\tif ((afi = AbpSearchApiFunctionInfo(mai, sym->name)))\n\t{\n\t\tafiExist = TRUE;\n\t}\n\n\n\tif (!afiExist)\n\t{\n\t\tafi = ALLOCOBJECT(ApiFunctionInfo);\n\n\t\tif (!afi)\n\t\t\treturn false;\n\n\t\tstrcpy(afi->name, sym->name);\n\n\t\tmai->apiList->insert({ string(sym->name), afi });\n\t\tmai->listCount++;\n\t}\n\n\tafi->rva = sym->rva;\n\tafi->ownerModule = mai;\n\t\n if (pafi)\n *pafi = afi;\n\n return true;\n}\n\nINTERNAL_EXPORT ApiFunctionInfo *AbiGetAfi(const char *module, const char *afiName)\n{\n ModuleApiInfo *mai = NULL;\n ApiFunctionInfo *afi = NULL;\n\n mai = AbpSearchModuleApiInfo(module);\n\n if (!mai)\n return NULL;\n\n return AbpSearchApiFunctionInfo(mai, afiName);\n}\n\nbool AbpNeedsReloadModuleAPIs()\n{\n ModuleInfo mod;\n\n if (!AbGetDebuggedModuleInfo(&mod))\n return false;\n\n return strcmp(mod.name, AbiGetCurrentModuleInfo()->name) != 0;\n}\n\nduint AbpGetPEDataOfMainModule2(ModuleInfo *mi, duint type, int sectIndex)\n{\n return (duint)GetPE32Data(mi->path, sectIndex, type);\n}\n\nduint AbpGetPEDataOfMainModule(duint type, int sectIndex)\n{\n ModuleInfo mainModule;\n \n if (!AbGetDebuggedModuleInfo(&mainModule))\n return 0;\n\n return AbpGetPEDataOfMainModule2(&mainModule, type, sectIndex);\n}\n\nINTERNAL_EXPORT bool AbiRegisterDynamicApi(const char *module, const char *api, duint mod, duint apiAddr, duint apiRva)\n{\n SymbolInfo sym;\n ApiFunctionInfo *afi = NULL;\n\n DBGPRINT(\"Registering dynaload api %s(%p) : %s(%p)\", module, mod, api, apiAddr);\n\n memset(&sym, 0, sizeof(SymbolInfo));\n strcpy(sym.mod, module);\n strcpy(sym.name, api);\n sym.rva = apiRva;\n sym.type = Import;\n\n if (AbpRegisterApi(&sym, &afi))\n {\n DBGPRINT(\"registered!\");\n \n if (afi->ownerModule->baseAddr == 0)\n afi->ownerModule->baseAddr = mod;\n\n return true;\n }\n\n return false;\n}\n\nINTERNAL_EXPORT int AbiGetMainModuleCodeSections(ModuleSectionInfo **msi)\n{\n ModuleInfo mainModule;\n DWORD flags;\n ModuleSectionInfo *sectList = NULL;\n int sectCount = 0;\n\n *msi = NULL;\n\n if (!AbGetDebuggedModuleInfo(&mainModule))\n return 0;\n\n for (int i = 0;i < mainModule.sectionCount;i++)\n {\n flags = AbpGetPEDataOfMainModule2(&mainModule, UE_SECTIONFLAGS, i);\n\n if (flags & IMAGE_SCN_CNT_CODE)\n {\n sectCount++;\n sectList = RESIZEOBJECTLIST(ModuleSectionInfo, sectList, sectCount);\n sectList[sectCount-1].addr = mainModule.base + AbpGetPEDataOfMainModule2(&mainModule, UE_SECTIONVIRTUALOFFSET, i);\n sectList[sectCount-1].size = AbpGetPEDataOfMainModule2(&mainModule, UE_SECTIONVIRTUALSIZE, i);\n }\n }\n\n *msi = sectList;\n\n return sectCount;\n}\n\nvoid AbDebuggerRun()\n{\n Script::Debug::Run();\n}\n\nvoid AbDebuggerPause()\n{\n Script::Debug::Pause();\n}\n\nvoid AbDebuggerWaitUntilPaused()\n{\n _plugin_waituntilpaused();\n}\n\n\nbool AbCmdExecFormat(const char *format, ...)\n{\n bool success = false;\n char *buffer;\n va_list va;\n\n va_start(va, format);\n\n if (HlpPrintFormatBufferExA(&buffer, format, va) > 0)\n {\n success = DbgCmdExecDirect(buffer);\n\n FREESTRING(buffer);\n }\n\n va_end(va);\n\n return success;\n}\n\nbool AbGetDebuggedImageName(char *buffer)\n{\n ModuleInfo mod;\n\n if (!AbGetDebuggedModuleInfo(&mod))\n return false;\n\n strcpy(buffer, mod.name);\n return true;\n}\n\nbool AbGetDebuggedModuleInfo(ModuleInfo *modInfo)\n{\n duint mainModAddr;\n\n mainModAddr = AbGetDebuggedImageBase();\n\n if (!mainModAddr)\n return false;\n\n return InfoFromAddr(mainModAddr, modInfo);\n}\n\nbool AbGetDebuggedModulePath(char *pathBuf, int bufLen)\n{\n ModuleInfo mod;\n int dn;\n\n if (!pathBuf)\n return false;\n\n if (!AbGetDebuggedModuleInfo(&mod))\n return false;\n \n dn = strlen(mod.path);\n \n if (dn > bufLen)\n return false;\n\n strcpy(pathBuf, mod.path);\n \n while (pathBuf[--dn] != '\\\\')\n pathBuf[dn] = 0;\n\n return true;\n}\n\nduint AbGetDebuggedImageBase()\n{\n duint base = GetMainModuleBase();\n\n if (base)\n return base;\n\n base = (duint)GetDebuggedFileBaseAddress();\n\n if (!base)\n base = (duint)GetDebuggedDLLBaseAddress();\n\n return base;\n}\n\nbool AbHasDebuggingProcess()\n{\n ModuleInfo mi;\n\n if (DbgIsDebugging())\n {\n return AbGetDebuggedModuleInfo(&mi);\n }\n\n return false;\n}\n\nvoid AbReleaseModuleResources()\n{\n while (AbpModuleList.size() > 0)\n {\n AbpDeregisterModule((*AbpModuleList.begin()));\n }\n}\n\nbool AbLoadAvailableModuleAPIs(bool onlyImportsByExe)\n{\n\tDECL_QPREF;\n\n ListInfo moduleList = { 0 };\n ListInfo functionSymbolList = { 0 };\n\n bool modListOk = false, symListOk = false;\n bool success = false;\n\n SymbolInfo *sym = NULL;\n ModuleApiInfo *mai = NULL;\n ApiFunctionInfo *afi = NULL;\n\n if (!AbfNeedsReload)\n return true;\n\n\tQPERF_BEGIN();\n\tDBGPRINT(\"loading module list\");\n\n //First, detect dynamically loaded apis. \n //And mark the loaded api export as an imported by exe\n\n if (Script::Module::GetList(&moduleList))\n {\n if (moduleList.data != NULL)\n modListOk = true;\n }\n\n\tDBGPRINT(\"%d module loaded.\", moduleList.count);\n\n\tQPERF_TIME(\"module list load\");\n\n\tDBGPRINT(\"loading symbol list\");\n\n if (Script::Symbol::GetList(&functionSymbolList))\n {\n if (functionSymbolList.data != NULL)\n symListOk = true;\n }\n\n\n if (!modListOk || !symListOk)\n goto cleanAndExit;\n\n sym = static_cast(functionSymbolList.data);\n \n\tQPERF_TIME(\"Symbol list load\");\n\n\tDBGPRINT(\"%d symbol loaded.\", functionSymbolList.count);\n\n for (int i = 0;i < functionSymbolList.count;i++)\n {\n\n if (onlyImportsByExe)\n {\n if (sym->type == Import && HlpEndsWithA(sym->mod, \".exe\",FALSE, 4))\n {\n //Executables provides psoude module import data\n //for now we reserve api registration slot\n\t\t\t\tif (AbpRegisterApi(sym, &afi))\n\t\t\t\t\tmai = afi->ownerModule;\n \n }\n else if (sym->type == Export && !HlpEndsWithA(sym->mod,\".exe\",FALSE, 4))\n {\n //Ok. we walkin on the real export modules now.\n //try to get AFI if there is exist a reserved for psoude import data\n afi = AbpSearchApiFunctionInfo(mai, sym->name);\n\t\t\t\t\n\t\t\t\t//If exist make a real registration for exist slot\n\t\t\t\tif (afi != NULL)\n\t\t\t\t{\n\t\t\t\t\tAbpRegisterApi(sym, NULL);\n\t\t\t\t}\n\n }\n }\n else\n {\n if (sym->type == Export && !HlpEndsWithA(sym->mod, \".exe\", FALSE, 4))\n {\n AbpRegisterApi(sym,NULL);\n }\n }\n\n sym++;\n }\n\n\tDBGPRINT(\"api registration done\");\n\n\tQPERF_TIME(\"Api search and registration\");\n\n if (AbpModuleList.size() == 0 )\n {\n MessageBoxA(AbHwndDlgHandle, \"The ApiBreak could not load any imports from the being debugged image.\\r\\n\"\n \"Because, imports are treated as export or could not load imports correctly by the x64dbg. (Its a x64dbg Bug)\\r\\n\"\n \"Please update your x64dbg to latest version.\",\n \"WARNING\",\n MB_OK | MB_ICONWARNING);\n\n success = false;\n goto cleanAndExit;\n }\n\n if (onlyImportsByExe)\n AbpDeregisterModule(mai);\n\n\t\n AbpLinkApiExportsToModule(&moduleList);\n\tQPERF_TIME(\"Linking export to module\");\n\n success = true;\n\n DBGPRINT(\"%d module found.\", AbpModuleList.size());\n \n\tif (AbGetSettings()->exposeDynamicApiLoads)\n\t{\n\t\tAbiDetectAPIsUsingByGetProcAddress();\n\t\tQPERF_TIME(\"Detection GetProcAddress\");\n\t}\n else\n DBGPRINT(\"dynamic api detection disabled!\");\n\n AbfNeedsReload = FALSE;\n\ncleanAndExit:\n\n\tQPERF_DUMP();\n\n if (symListOk)\n BridgeFree(functionSymbolList.data);\n\n if (modListOk)\n BridgeFree(moduleList.data);\n\n return success;\n}\n\nint AbEnumModuleNames(APIMODULE_ENUM_PROC enumProc, void *user)\n{\n ModuleApiInfo *mai;\n \n for (modlist::iterator n = AbpModuleList.begin(); n != AbpModuleList.end(); n++)\n {\n mai = *n;\n enumProc(mai->name, user);\n }\n\n return (int)AbpModuleList.size();\n}\n\nvoid AbEnumApiFunctionNames(APIMODULE_ENUM_PROC enumProc, const char *moduleName, void *user)\n{\n ModuleApiInfo *mai = NULL;\n \n mai = AbpSearchModuleApiInfo(moduleName);\n\n if (!mai)\n return;\n\n \n for (apilist::iterator n = mai->apiList->begin(); n != mai->apiList->end(); n++)\n enumProc(n->second->name, user);\n}\n\nbool AbpReturnToCaller(duint callerIp, duint csp)\n{\n RegisterEnum cspReg, cipReg;\n \n#ifdef _WIN64\n cspReg = RegisterEnum::RSP;\n cipReg = RegisterEnum::RIP;\n#else\n cspReg = RegisterEnum::ESP;\n cipReg = RegisterEnum::EIP;\n#endif\n\n#if _DEBUG\n DBGPRINT(\"Old CIP: %p, New CIP: %p\", Get(cipReg), callerIp);\n DBGPRINT(\"Current CSP: %p, Ctx CSP: %p, New CSP: %p\", Get(cspReg), csp, csp + sizeof(duint));\n\n#endif\n\n //pop stack\n if (!Set(cspReg, csp + sizeof(duint)))\n return false;\n\n //set the previous caller address to the Instruction pointer\n return Set(cipReg, callerIp);\n}\n\nvoid AbpCallback0(__BpCallbackContext *bpx)\n{\n return;\n}\n\n#include \n\nvoid AbpBacktrackingBreakpointCallback(__BpCallbackContext *bpx)\n{\n duint callerIp;\n DECL_QPREF;\n\n switch (bpx->bp->type)\n {\n case bp_normal:\n case bp_memory:\n case bp_dll:\n break;\n default:\n return;\n }\n\n DBGPRINT(\"Backtracing to the caller\");\n\n QPERF_BEGIN();\n\n callerIp = UtlGetCallerAddress(&bpx->regContext);\n\n QPERF_TIME(\"UtlGetCallerAddress\");\n\n if (callerIp > 0)\n { \n if (AbpReturnToCaller(callerIp, bpx->regContext.regcontext.csp))\n {\n bpx->regContext.regcontext.csp += sizeof(duint);\n bpx->regContext.regcontext.cip = callerIp;\n }\n else\n DBGPRINT(\"Cant return to caller\");\n\n QPERF_TIME(\"AbpReturnToCaller\");\n\n GuiDisasmAt(callerIp, callerIp);\n GuiStackDumpAt(bpx->regContext.regcontext.csp, bpx->regContext.regcontext.csp);\n\n QPERF_TIME(\"AbCmdExecFormat\");\n }\n\n\n QPERF_DUMP();\n}\n\nbool AbSetAPIBreakpointOnCallers(const char *module, const char *apiFunction)\n{\n duint addr;\n\n return AbSetBreakpointEx(\n module, \n apiFunction, \n &addr, \n BPO_BACKTRACK,\n (AB_BREAKPOINT_CALLBACK)AbpBacktrackingBreakpointCallback, \n NULL\n );\n\n}\n\nbool AbSetAPIBreakpoint(const char *module, const char *apiFunction, duint *funcAddr)\n{\n return AbSetBreakpointEx(module, apiFunction, funcAddr, BPO_NONE, (AB_BREAKPOINT_CALLBACK)AbpCallback0,NULL);\n}\n\nbool AbSetInstructionBreakpoint(duint instrAddr, AB_BREAKPOINT_CALLBACK callback, void *user, bool singleShot)\n{\n DWORD opt = BPO_NONE;\n\n if (singleShot)\n opt |= BPO_SINGLESHOT;\n\n return AbSetBreakpointEx(NULL, NULL, &instrAddr, opt, callback, user);\n}\n\n\nbool AbSetBreakpointEx(const char *module, const char *apiFunction, duint *funcAddr, DWORD bpo, AB_BREAKPOINT_CALLBACK bpCallback, void *user)\n{\n bool bpSet;\n ApiFunctionInfo *afi = NULL;\n BpCallbackContext *cbctx = NULL;\n duint bpAddr = 0;\n bool isNonApiBp;\n\n isNonApiBp = module == NULL && apiFunction == NULL;\n\n if (!isNonApiBp)\n {\n afi = AbiGetAfi(module, apiFunction);\n\n if (!afi)\n return false;\n\n bpAddr = afi->ownerModule->baseAddr + afi->rva;\n }\n else\n {\n if (*funcAddr == NULL)\n return false;\n\n bpAddr = *funcAddr;\n }\n\n if (bpCallback != NULL)\n {\n cbctx = ALLOCOBJECT(BpCallbackContext);\n\n if (!cbctx)\n return false;\n\n cbctx->bpAddr = bpAddr;\n cbctx->callback = bpCallback;\n cbctx->afi = afi;\n cbctx->user = user;\n }\n\n if (bpo & BPO_SINGLESHOT)\n bpSet = AbCmdExecFormat(\"bp %p, abss, ss\", bpAddr);\n else\n bpSet = SetBreakpoint(bpAddr);\n\n\n if (!bpSet)\n {\n FREEOBJECT(cbctx);\n return false;\n }\n\n if (!AbpRegisterBreakpoint(bpAddr, bpo, cbctx))\n {\n FREEOBJECT(cbctx);\n }\n\n if (!isNonApiBp)\n {\n if (bpSet && funcAddr != NULL)\n *funcAddr = afi->ownerModule->baseAddr + afi->rva;\n }\n\n return bpSet;\n}\n\nbool AbDeleteBreakpoint(duint addr)\n{\n PBREAKPOINT_INFO pbi;\n bool deleteOk;\n\n pbi = AbpLookupBreakpoint(addr);\n\n if (!pbi)\n return false;\n\n //Single shoot breakpoints will be deleted automatically after hit\n if (!(pbi->options & BPO_SINGLESHOT))\n deleteOk = DeleteBreakpoint(addr);\n else\n deleteOk = true; //yep its already deleted\n\n if (deleteOk)\n {\n AbpDeregisterBreakpoint(addr);\n }\n\n return deleteOk;\n}" }, { "path": "x64dbgApiBreak/src/callfind.cpp", "content": "#include \n\nINTERNAL duint AbiGetCallDestinationAddress(BASIC_INSTRUCTION_INFO *inst);\nINTERNAL void AbiCacheInstruction(duint addr, BASIC_INSTRUCTION_INFO *inst);\nINTERNAL void AbiEmptyInstructionCache();\n\nbool AbpInsertCallList(ApiFunctionInfo *afi,duint callAddr)\n{\n duint *tmp;\n duint *calls;\n int index=0, callsSize = 0;\n\n calls = afi->callInfo.calls;\n index = afi->callInfo.callCount;\n callsSize = afi->callInfo.callListSize;\n\n if (!calls)\n {\n callsSize = 20;\n calls = (duint *)AbMemoryAlloc(callsSize * sizeof(duint));\n\n if (!calls)\n return false;\n }\n else if (index - 1 >= callsSize)\n {\n tmp = (duint *)AbMemoryRealloc(calls, (callsSize + 10) * sizeof(duint));\n\n if (!tmp)\n {\n DBGPRINT(\"realloc fail\");\n return false;\n }\n\n calls = tmp;\n\n callsSize += 10;\n\n }\n\n *(calls + index) = callAddr;\n index++;\n\n afi->callInfo.calls = calls;\n afi->callInfo.callCount = index;\n afi->callInfo.callListSize = callsSize;\n\n DBGPRINT(\"Call or jump found on 0x%p\", callAddr);\n\n return true;\n}\n\nINTERNAL_EXPORT bool AbiIsIndirectCall(duint code, ApiFunctionInfo *afi, duint *indirectRef)\n{\n BASIC_INSTRUCTION_INFO destInst;\n duint apiAddr;\n\n DbgDisasmFastAt(code, &destInst);\n\n //We looking for only jmp. Eliminate other conditional jumps\n if (!destInst.call && destInst.branch && HlpBeginsWithA(destInst.instruction, \"jmp\", FALSE, 3))\n {\n apiAddr = AbiGetCallDestinationAddress(&destInst);\n\n if (apiAddr == afi->ownerModule->baseAddr + afi->rva)\n {\n if (indirectRef)\n *indirectRef = code;\n\n DBGPRINT(\"Indirect call (Tramboline) found for %s at 0x%p\",\n afi->name, code);\n\n return true;\n }\n }\n\n return false;\n}\n\n\n\nFORWARDED int AbiSearchCallersForAFI(duint codeBase, duint codeSize, ApiFunctionInfo *afi)\n{\n#define RETURN(s) { result = s; goto oneWayExit; }\n\n duint code,codeEnd;\n BASIC_INSTRUCTION_INFO inst;\n duint callAddr,indirectReferencedAddress = 0;\n\n int failInsert=0;\n\n int result = CSR_FAILED;\n\n code = codeBase;\n codeEnd = code + codeSize; \n\n AbiEmptyInstructionCache();\n\n for (;code < codeEnd;)\n {\n DbgDisasmFastAt(code, &inst);\n\n if (inst.call || inst.branch)\n {\n callAddr = AbiGetCallDestinationAddress(&inst);\n\n if (!inst.call && inst.branch) //is it jmp?\n {\n //Is it an indirectly referenced call?\n if (code == indirectReferencedAddress)\n {\n DBGPRINT(\"%s is indirectly referenced and bp wont be set for %p\", afi->name, code);\n code += inst.size;\n continue;\n }\n }\n\n //Gotcha!\n if (afi->ownerModule->baseAddr + afi->rva == callAddr)\n failInsert += (int)!AbpInsertCallList(afi, code);\n else if (inst.call && AbiIsIndirectCall(callAddr, afi,&indirectReferencedAddress))\n failInsert += (int)!AbpInsertCallList(afi, code);\n }\n else \n AbiCacheInstruction(code, &inst);\n\n code += inst.size;\n }\n\n if (afi->callInfo.callCount > 0)\n {\n if (failInsert > 0)\n result = CSR_PARTIAL_SUCCESS;\n else\n result = CSR_COMPLETELY_SUCCESS;\n }\n\n\n return result;\n\n#undef RETURN\n}" }, { "path": "x64dbgApiBreak/src/dynapidetect.cpp", "content": "#include \n#include \n#include \n#include \n#include \n#include \n\nusing namespace Script::Module;\nusing namespace Script::Misc;\nusing namespace std;\n\nINTERNAL ApiFunctionInfo *AbiGetAfi(const char *module, const char *afiName);\nINTERNAL int AbiGetMainModuleCodeSections(ModuleSectionInfo **msi);\nINTERNAL bool AbiRegisterDynamicApi(const char *module, const char *api, duint mod, duint apiAddr, duint apiRva);\nINTERNAL bool AbiIsIndirectCall(duint code, ApiFunctionInfo *afi, duint *indirectRef);\n\n#define ALIGNTO_PAGE(x) ( ((x)/0x1000+1) * 0x1000 )\n\n\ntypedef unordered_map *> ondemand_api_list;\n\nHANDLE AbpDeferListSyncMutant;\nondemand_api_list AbpDeferList;\n\n#define SYNCH_BEGIN WaitForSingleObject(AbpDeferListSyncMutant,INFINITE)\n#define SYNCH_END ReleaseMutex(AbpDeferListSyncMutant)\n\n\n/*\nOn x64 calling convention (fastcall)\nparameters are passed in order left to right\nthe first four parameters are passed in order\nRCX, RDX, R8, and R9\n\nGetProcAddress call on Amd64\n\nMOV RCX, MODULEHANDLE\nLEA RDX, HARDCODED_API_STRING\nCALL GetProcAddress\n\n*/\n\n/*\nOn x86 architecture, the WIN32 apis uses the stdcall convention\nSo in this convention, parameters are passed in order right to left\nand they are passed (pushed) through the stack\n\nGetProcAddress call on x86\n\nPUSH MODULEHANDLE\nPUSH HARDCODED_API_STRING\nCALL GetProcAddress\n\nor they may use the stack pointer to passing arguments\ninstead of direct stack pushing\n\nSUB ESP, 8\nMOV [ESP+4], HARDCODED_API_STRING\nMOV [ESP],MODULEHANDLE\nCALL GetProcAddress\n\n*/\n\ntypedef struct\n{\n BASIC_INSTRUCTION_INFO inst;\n duint addr;\n}CachedInst;\n\n#define ABP_CACHED_DISASM_SIZE 20\n\nCachedInst AbpCachedDisasmedInstructions[ABP_CACHED_DISASM_SIZE];\nint AbpDisasmedCacheIndex = 0;\n\nCachedInst *AbpGetCachedInst(int index)\n{\n if (index < 0 || index >= AbpDisasmedCacheIndex)\n return NULL;\n\n return &AbpCachedDisasmedInstructions[index];\n}\n\nINTERNAL_EXPORT void AbiEmptyInstructionCache()\n{\n memset(AbpCachedDisasmedInstructions, 0, sizeof(CachedInst) * ABP_CACHED_DISASM_SIZE);\n AbpDisasmedCacheIndex = 0;\n}\n\nINTERNAL_EXPORT void AbiCacheInstruction(duint addr, BASIC_INSTRUCTION_INFO *inst)\n{\n CachedInst *slot;\n\n bool moveUp = AbpDisasmedCacheIndex >= ABP_CACHED_DISASM_SIZE;\n\n if (!moveUp)\n {\n slot = &AbpCachedDisasmedInstructions[AbpDisasmedCacheIndex];\n AbpDisasmedCacheIndex++;\n }\n else\n {\n memmove(\n AbpCachedDisasmedInstructions,\n AbpCachedDisasmedInstructions + 1,\n sizeof(CachedInst) * (ABP_CACHED_DISASM_SIZE - 1)\n );\n\n slot = &AbpCachedDisasmedInstructions[ABP_CACHED_DISASM_SIZE - 1];\n }\n\n memcpy(&slot->inst, inst, sizeof(BASIC_INSTRUCTION_INFO));\n slot->addr = addr;\n}\n\nbool AbpRegisterDeferredAPIRegistration(const char *module, const char *api)\n{\n string smod(module);\n ondemand_api_list::iterator it;\n vector *apiList;\n char *apiString;\n\n it = AbpDeferList.find(smod);\n\n if (it == AbpDeferList.end())\n {\n apiList = new vector();\n\n SYNCH_BEGIN;\n\n AbpDeferList.insert({ smod,apiList });\n\n SYNCH_END;\n\n }\n else\n apiList = it->second;\n\n apiString = HlpCloneStringA((LPSTR)api);\n\n if (!apiString)\n return false;\n\n apiList->push_back(apiString);\n\n return true;\n}\n\n\nINTERNAL_EXPORT duint AbpGetActualDataAddress(BASIC_INSTRUCTION_INFO *inst)\n{\n if ((inst->type & TYPE_ADDR) || (inst->type & TYPE_VALUE))\n return inst->value.value;\n else if (inst->type == TYPE_MEMORY)\n return inst->memory.value;\n\n return 0;\n}\n\nbool AbpReadStringFromInstructionSourceAddress(BASIC_INSTRUCTION_INFO *inst, char *nameBuf)\n{\n duint addr = AbpGetActualDataAddress(inst);\n\n if (!addr || addr < 0x1000)\n {\n DBGPRINT(\"String memory not valid!\");\n return false;\n }\n\n if (!DbgGetStringAt(addr, nameBuf))\n {\n DBGPRINT(\"String read error from 0x%p\",addr);\n return false;\n }\n\n //if string begins with 'L' \n //that hints to the string source is a wide string\n if (*nameBuf == 'L')\n {\n HlpTrimChar(nameBuf, 'L', HLP_TRIM_LEFT);\n }\n\n HlpRemoveQuotations(nameBuf);\n\n return true;\n}\n\nbool AbpGetApiStringFromProcLoader(short argNumber, char *nameBuf)\n{\n CachedInst *inst;\n InstInfo loadinst;\n RegId compVal=RegNone;\n int cacheIndex;\n\n#ifdef _WIN64\n \n switch (argNumber)\n {\n case 1:\n compVal = Cx;\n break;\n case 2:\n compVal = Dx;\n break;\n case 3:\n compVal = r8;\n break;\n case 4:\n compVal = r9;\n break;\n }\n#else\n argNumber--;\n#endif\n\n cacheIndex = AbpDisasmedCacheIndex;\n\n while (--cacheIndex >= 0)\n {\n inst = AbpGetCachedInst(cacheIndex);\n\n if (AbParseInstruction(&inst->inst, &loadinst))\n {\n if (loadinst.size == 64 && loadinst.mem_access == MA_READ)\n {\n switch (loadinst.op)\n {\n case OP_MOV:\n case OP_LEA:\n {\n if (compVal == loadinst.reg)\n {\n if (AbpReadStringFromInstructionSourceAddress(&inst->inst, nameBuf))\n return true;\n\n return false;\n }\n }\n break;\n }\n }\n else if (loadinst.size == 32)\n {\n switch (loadinst.op)\n {\n case OP_MOV:\n case OP_LEA:\n {\n if (loadinst.reg == ImmMem && loadinst.mem_access == MA_WRITE && loadinst.memory_info.base == Sp)\n {\n if (loadinst.memory_info.disp == (argNumber * 4))\n {\n if (AbpReadStringFromInstructionSourceAddress(&inst->inst, nameBuf))\n return true;\n\n return false;\n }\n }\n }\n break;\n case OP_PUSH:\n {\n if (!argNumber)\n {\n if (AbpReadStringFromInstructionSourceAddress(&inst->inst, nameBuf))\n return true;\n\n return false;\n }\n else\n argNumber--;\n }\n break;\n }\n }\n }\n }\n\n return false;\n\n}\n\nbool AbpExposeStringArgument(short argNumber, char *buf)\n{\n return AbpGetApiStringFromProcLoader(argNumber, buf);\n}\n\nbool AbpIsValidApi(const char *module, const char *function, duint *rva)\n{\n PBYTE mod = NULL;\n PIMAGE_NT_HEADERS ntHdr;\n PIMAGE_DOS_HEADER dosHdr;\n PIMAGE_EXPORT_DIRECTORY ped;\n DWORD moduleSize, exportTableVa;\n HANDLE moduleFile, mapping;\n char *exportName;\n ULONG *addressOfNameStrings, *addressOfFunctions;\n WORD *addressOfOrd;\n duint imageBase;\n\n bool valid = false;\n char path[3][MAX_PATH];\n \n GetSystemDirectoryA(path[0], MAX_PATH);\n GetWindowsDirectoryA(path[1], MAX_PATH);\n AbGetDebuggedModulePath(path[2], MAX_PATH);\n\n \n for (int i=0;i<3;i++)\n {\n sprintf(path[i] + strlen(path[i]), \"\\\\%s\", module);\n\n moduleFile = CreateFileA(\n path[i],\n GENERIC_READ,\n FILE_SHARE_READ,\n NULL,\n OPEN_EXISTING,\n FILE_ATTRIBUTE_NORMAL,\n NULL\n );\n\n if (moduleFile != INVALID_HANDLE_VALUE)\n break;\n }\n\n if (moduleFile == INVALID_HANDLE_VALUE)\n return false;\n\n moduleSize = GetFileSize(moduleFile, NULL);\n\n mapping = CreateFileMappingA(moduleFile, NULL, PAGE_READONLY, 0, ALIGNTO_PAGE(moduleSize), NULL);\n\n if (!mapping)\n {\n CloseHandle(moduleFile);\n return false;\n }\n\n mod = (PBYTE)MapViewOfFile(mapping, FILE_MAP_READ, 0, 0, (SIZE_T)moduleSize);\n\n if (!mod)\n {\n CloseHandle(mapping);\n CloseHandle(moduleFile);\n return false;\n }\n\n dosHdr = (PIMAGE_DOS_HEADER)mod;\n\n if (dosHdr->e_magic != IMAGE_DOS_SIGNATURE)\n goto fail;\n\n ntHdr = (PIMAGE_NT_HEADERS)(mod + dosHdr->e_lfanew);\n\n if (ntHdr->Signature != IMAGE_NT_SIGNATURE)\n goto fail;\n\n imageBase = ntHdr->OptionalHeader.ImageBase;\n\n if (imageBase != (duint)mod)\n imageBase = (duint)mod;\n\n exportTableVa = ntHdr->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress;\n ped = (PIMAGE_EXPORT_DIRECTORY)(exportTableVa + imageBase);\n addressOfNameStrings = (ULONG *)(ped->AddressOfNames + imageBase);\n\n for (DWORD i = 0;i < ped->NumberOfNames;i++)\n {\n exportName = (char *)(imageBase + addressOfNameStrings[i]);\n\n if (!strcmp(exportName, function))\n {\n if (rva != NULL)\n {\n addressOfFunctions = (ULONG *)(ped->AddressOfFunctions + imageBase);\n addressOfOrd = (WORD *)(ped->AddressOfNameOrdinals + imageBase);\n\n *rva = (duint)(addressOfFunctions[addressOfOrd[i]]);\n }\n\n valid = true;\n break;\n }\n }\n\nfail:\n\n UnmapViewOfFile(mod);\n CloseHandle(mapping);\n CloseHandle(moduleFile);\n\n return valid;\n}\n\nINTERNAL_EXPORT duint AbiGetCallDestinationAddress(BASIC_INSTRUCTION_INFO *inst)\n{\n duint callAddr = 0;\n duint msize;\n\n if ((inst->type & TYPE_ADDR) || (inst->type & TYPE_VALUE))\n callAddr = inst->value.value;\n else if (inst->type == TYPE_MEMORY)\n {\n msize = inst->memory.size;\n\n //Some process injects some chunk of data to the code section for some reason.\n //And the disassembler interprets them as instruction sequences\n //For example call fword ptr [mem]. And that memory size will be 6 bytes \n //Any read attempt on 32 bit machine the memory.value gets overflowed.\n\n if (!(msize == size_byte ||\n msize == size_word ||\n msize == size_dword ||\n msize == size_qword))\n {\n return 0;\n }\n\n DbgMemRead(inst->memory.value, &callAddr, msize);\n }\n\n return callAddr;\n}\n\nbool AbpIsAPICall2(duint code, ApiFunctionInfo *afi, BASIC_INSTRUCTION_INFO *inst, bool cacheInstruction)\n{\n duint callAddr;\n\n if (inst->call && inst->branch)\n {\n callAddr = AbiGetCallDestinationAddress(inst);\n\n if (callAddr == afi->ownerModule->baseAddr + afi->rva)\n {\n DBGPRINT(\"'%s' call found at %p\",afi->name, code);\n return true;\n }\n else\n {\n if (AbiIsIndirectCall(callAddr, afi, NULL))\n return true;\n }\n }\n\n if (cacheInstruction)\n AbiCacheInstruction(code, inst);\n\n return false;\n}\n\nbool AbpIsAPICall(duint code, ApiFunctionInfo *afi, BASIC_INSTRUCTION_INFO *inst)\n{\n return AbpIsAPICall2(code, afi, inst, true);\n}\n\n#define NEXT_INSTR_ADDR(code, inst) (*code) += (inst)->size\n\nbool AbpIsLoadLibraryXXXCall(ApiFunctionInfo **afiList, int afiCount,duint codeAddr, BASIC_INSTRUCTION_INFO *inst, bool cacheInstruction)\n{\n for (int i = 0;i < afiCount;i++)\n {\n if (AbpIsAPICall2(codeAddr, afiList[i], inst, false))\n {\n return true;\n }\n }\n\n if (cacheInstruction)\n AbiCacheInstruction(codeAddr, inst);\n\n return false;\n}\n\n\n\nbool AbpRegisterAPI(char *module, char *api)\n{\n duint funcAddr, modAddr, rva;\n\n\n funcAddr = RemoteGetProcAddress(module, api);\n\n //Is module already loaded?\n if (funcAddr)\n {\n modAddr = DbgModBaseFromName(module);\n rva = funcAddr - modAddr;\n\n AbiRegisterDynamicApi(module, api, modAddr, funcAddr, rva);\n\n return true;\n }\n\n if (!AbpIsValidApi(module, api,NULL))\n {\n DBGPRINT(\"Not valid api\");\n return false;\n }\n\n return AbpRegisterDeferredAPIRegistration(module, api);\n}\n\nINTERNAL_EXPORT void AbiRaiseDeferredLoader(const char *dllName, duint base)\n{\n duint funcAddr;\n ondemand_api_list::iterator modIter;\n vector *apiList;\n\n \n modIter = AbpDeferList.find(string(dllName));\n\n if (modIter == AbpDeferList.end())\n return;\n\n apiList = modIter->second;\n\n DBGPRINT(\"Deferred api's are now registering.\");\n\n for (vector::iterator it = apiList->begin(); it != apiList->end(); it++)\n {\n //TODO: Find a way to get remote proc address in DLLLOAD callback\n\n //Probably returns null ?\n funcAddr = Script::Misc::RemoteGetProcAddress(dllName, *it);\n\n if (!funcAddr)\n {\n //And also it may returns null\n funcAddr = (duint)ImporterGetRemoteAPIAddressEx(dllName, *it);\n\n if (!funcAddr)\n {\n duint rva=0;\n\n //worst case! \n //We know the loaded dll's base address. \n //So if I can read rva of the API from the export table\n //I can calculate the real API address in the memory.\n //Its a bit slower but it works.\n if (AbpIsValidApi(dllName, *it, &rva))\n {\n funcAddr = base + rva; \n }\n\n }\n }\n\n if (funcAddr > 0)\n {\n AbiRegisterDynamicApi(dllName, *it, base,funcAddr,funcAddr-base);\n }\n }\n\n SYNCH_BEGIN;\n //TODO : Remove loaded modules from list\n SYNCH_END;\n\n //REMOVE waiting mod info\n}\n\n//loaderApi can be LoadLibraryA LoadLibraryW LoadLibraryExA LoadLibraryExW\nINTERNAL_EXPORT bool AbiDetectAPIsUsingByGetProcAddress()\n{\n const char *ldrVariants[6] = { \n \"LoadLibraryA\",\n \"LoadLibraryW\",\n \"LoadLibraryExA\",\n \"LoadLibraryExW\",\n \"GetModuleHandleA\",\n \"GetModuleHandleW\"};\n\n BASIC_INSTRUCTION_INFO inst;\n\n ModuleSectionInfo *codeSects;\n ApiFunctionInfo *procafi=NULL;\n ApiFunctionInfo *libafis[6] = { 0 };\n int ldrVariantCount = 0,procLdrCount=0;\n int totalFoundApi = 0,sectCount;\n\n int ldrVariantLimit;\n bool skip;\n duint code, end;\n\n DBGPRINT(\"Threadid: %x\", GetCurrentThreadId());\n\n char moduleName[128], apiFuncName[128];\n \n procafi = AbiGetAfi(\"kernel32.dll\", \"GetProcAddress\");\n\n if (AbGetSettings()->includeGetModuleHandle)\n ldrVariantLimit = 6;\n else\n ldrVariantLimit = 4;\n\n for (int i = 0;i < ldrVariantLimit;i++)\n {\n if ((libafis[ldrVariantCount] = AbiGetAfi(\"kernel32.dll\", ldrVariants[i])) != NULL)\n ldrVariantCount++;\n }\n \n if (!ldrVariantCount || !procafi)\n {\n DBGPRINT(\"This process does not use any runtime module and api loading.\");\n return false;\n }\n\n sectCount = AbiGetMainModuleCodeSections(&codeSects);\n\n if (!sectCount)\n return false;\n\n for (int cnx = 0;cnx < sectCount;cnx++)\n {\n code = codeSects[cnx].addr;\n end = code + codeSects[cnx].size;\n\n DBGPRINT(\"Scanning range %p - %p of %d. section\", code, end,cnx+1);\n\n while (code < end)\n {\n DbgDisasmFastAt(code, &inst);\n\n if (AbpIsLoadLibraryXXXCall(libafis, ldrVariantCount, code, &inst, true))\n {\n \n memset(moduleName, 0, sizeof(moduleName));\n\n skip = !AbpExposeStringArgument(1, moduleName);\n\n AbiEmptyInstructionCache();\n\n if (skip)\n {\n NEXT_INSTR_ADDR(&code, &inst);\n continue;\n }\n\n if (!HlpEndsWithA(moduleName, \".dll\", FALSE, 4))\n strcat(moduleName, \".dll\");\n\n procLdrCount = 0;\n\n while (1)\n {\n NEXT_INSTR_ADDR(&code, &inst);\n\n DbgDisasmFastAt(code, &inst);\n\n if (!strncmp(inst.instruction, \"ret\", 3))\n {\n if (!procLdrCount)\n DBGPRINT(\"GetProcAddress is not called after LoadLibraryXXX\");\n //else its ok. there is no more getprocaddress calls for the module\n\n DBGPRINT(\"%d API load found in single module\", procLdrCount);\n\n NEXT_INSTR_ADDR(&code, &inst);\n\n break;\n }\n\n if (AbpIsAPICall(code, procafi, &inst))\n {\n memset(apiFuncName, 0, sizeof(apiFuncName));\n\n if (AbpExposeStringArgument(2, apiFuncName))\n {\n DBGPRINT(\"Found: %s : %s\", moduleName, apiFuncName);\n totalFoundApi++;\n procLdrCount++;\n\n AbiEmptyInstructionCache();\n\n if (!AbpRegisterAPI(moduleName, apiFuncName))\n DBGPRINT(\"Not load, not registered or not valid: %s:%s\", moduleName, apiFuncName);\n }\n }\n else if (AbpIsLoadLibraryXXXCall(libafis, ldrVariantCount, code, &inst, false))\n {\n if (!procLdrCount)\n {\n //We dont skip to next instruction address\n //cuz, It will be our new loadlibrary reference.\n DBGPRINT(\"Consecutive loadlibrary calls :/\");\n }\n else\n {\n DBGPRINT(\"%d API load found in single module\", procLdrCount);\n }\n\n break;\n }\n }\n }\n else\n NEXT_INSTR_ADDR(&code, &inst);\n }\n }\n\n if (totalFoundApi>0)\n DBGPRINT(\"%d dynamic API(s) found!\", totalFoundApi);\n\n DBGPRINT(\"Dynamic scan finished\");\n\n\tAbMemoryFree(codeSects);\n\n return true;\n}\n\n\nINTERNAL_EXPORT void AbiReleaseDeferredResources()\n{\n for (ondemand_api_list::iterator it = AbpDeferList.begin(); it != AbpDeferList.end(); it++)\n {\n for (vector::iterator vit = it->second->begin(); vit != it->second->end(); vit++)\n {\n FREEOBJECT(*vit);\n }\n\n delete it->second;\n }\n\n AbpDeferList.clear();\n}\n\nINTERNAL_EXPORT void AbiInitDynapi()\n{\n AbpDeferListSyncMutant = CreateMutexA(NULL, FALSE, NULL);\n}\n\nINTERNAL_EXPORT void AbiUninitDynapi()\n{\n CloseHandle(AbpDeferListSyncMutant);\n}\n\n" }, { "path": "x64dbgApiBreak/src/hlprs.cpp", "content": "#include \n#include \n\nvoid HlpDebugPrint(const char *format, ...)\n{\n va_list vl;\n char content[0x500] = { 0 };\n\n va_start(vl, format);\n _vsnprintf(content, sizeof(content), format, vl);\n va_end(vl);\n\n _plugin_logputs(content);\n\n#ifdef _DEBUG\n OutputDebugStringA(content);\n#endif\n\n}\n\n\nLPSTR HlpCloneStringA(LPCSTR str)\n{\n LPSTR clone;\n int len;\n\n if (!str)\n return NULL;\n\n len = (int)strlen(str);\n\n clone = ALLOCSTRINGA(len);\n\n if (!clone)\n return NULL;\n\n memcpy(clone, str, len + 1);\n\n return clone;\n}\n\nLPWSTR HlpAnsiToWideString(LPCSTR str)\n{\n ULONG slen;\n LPWSTR wstr;\n\n if (!str)\n return NULL;\n\n slen = lstrlenA((LPCSTR)str);\n\n wstr = (LPWSTR)ALLOCSTRINGW(slen);\n\n if (!wstr)\n return NULL;\n\n if (MultiByteToWideChar(CP_ACP, MB_COMPOSITE, str, slen, wstr, slen) == slen)\n return wstr;\n\n FREESTRING(wstr);\n return NULL;\n}\n\nLPSTR HlpWideToAnsiString(LPCWSTR str)\n{\n ULONG slen;\n LPSTR astr;\n\n if (!str)\n return NULL;\n\n slen = lstrlenW((LPCWSTR)str);\n\n astr = (LPSTR)ALLOCSTRINGA(slen);\n\n if (!astr)\n return NULL;\n\n if (WideCharToMultiByte(CP_ACP, WC_COMPOSITECHECK, str, slen, astr, slen, NULL, NULL) == slen)\n return astr;\n\n FREESTRING(astr);\n return NULL;\n}\n\nbool HlpTrimChar(LPSTR str, CHAR chr, int option)\n{\n char *p;\n int len;\n bool hasEndChr = false;\n\n if (!str)\n return false;\n\n if (!option)\n return false;\n\n p = (char *)str;\n len = (int)strlen(str);\n\n if (option & HLP_TRIM_RIGHT)\n hasEndChr = *(p + (len - 1)) == chr;\n\n if (*p == chr && (option & HLP_TRIM_LEFT))\n {\n len -= hasEndChr ? 2 : 1;\n\n memmove(p, p + 1, len);\n\n *(p + len) = 0;\n return true;\n }\n else if (hasEndChr)\n {\n *(p + (len - 1)) = 0;\n return true;\n }\n\n return false;\n}\n\n#include \n\nbool HlpReplaceStringW(LPWSTR string, ULONG stringMaxSize, LPCWSTR find, LPCWSTR replace)\n{\n bool result = false;\n ULONG fCount=0, foundIndex=0;\n LONG findLen, replLen, strLen, copyLen;\n LPWSTR px;\n LONG shiftDelta;\n PDMA dma;\n BYTE *memSrc, *memDst;\n\n if (!DmaCreateAdapter(sizeof(ULONG), 20, &dma))\n return false;\n\n findLen = wcslen(find);\n replLen = wcslen(replace);\n strLen = wcslen(string);\n \n shiftDelta = replLen - findLen;\n \n px = string - 1;\n\n while(1)\n {\n px = wcsstr(px + 1, find);\n \n if (!px)\n break;\n\n foundIndex = px - string;\n\n if (fCount)\n foundIndex += fCount * shiftDelta;\n\n DmaWrite(dma, DMA_AUTO_OFFSET, sizeof(ULONG), &foundIndex);\n\n fCount++;\n }\n\n if (!fCount)\n goto exit;\n\n if (shiftDelta > 0)\n {\n if (strLen + (shiftDelta * fCount) > stringMaxSize)\n goto exit;\n }\n\n for (ULONG i = 0;i < fCount;i++)\n {\n DmaReadTypeAlignedSequence(dma, i, 1, &foundIndex);\n memSrc = (BYTE *)((foundIndex + findLen) * sizeof(WCHAR));\n memDst = (BYTE *)((foundIndex + replLen) * sizeof(WCHAR));\n\n memSrc += (duint)string;\n memDst += (duint)string;\n\n copyLen = (strLen - ((LPWSTR)memSrc - string)) * sizeof(WCHAR);\n\n memmove(memDst, memSrc, copyLen);\n\n \n if (shiftDelta < 0)\n {\n //That's a reducing of the string. We need to null-term new end of the string\n\n *((LPWSTR)(memSrc + copyLen - sizeof(WCHAR) * abs(shiftDelta)))\n = L'\\0';\n }\n\n memcpy(string + foundIndex, replace, sizeof(WCHAR) * replLen);\n\n\n strLen += shiftDelta;\n\n }\n\n result = true;\n\nexit:\n\n DmaDestroyAdapter(dma);\n\n return result;\n}\n\nbool HlpReplaceStringA(LPSTR string, ULONG stringMaxSize, LPCSTR find, LPCSTR replace)\n{\n bool result;\n LPWSTR stringW;\n LPWSTR findW, replaceW;\n LPSTR resultA;\n\n stringW = HlpAnsiToWideString(string);\n\n findW = HlpAnsiToWideString(find);\n replaceW = HlpAnsiToWideString(replace);\n\n result = HlpReplaceStringW(stringW, stringMaxSize, findW, replaceW);\n\n FREESTRING(findW);\n FREESTRING(replaceW);\n\n resultA = HlpWideToAnsiString(stringW);\n\n FREESTRING(stringW);\n\n strcpy(string, resultA);\n\n FREESTRING(resultA);\n\n return result;\n}\n\nbool HlpBeginsWithA(LPCSTR look, LPCSTR find,BOOL caseSens, LONG findLen)\n{\n bool result;\n\n LPWSTR lookW = HlpAnsiToWideString(look);\n LPWSTR findW = HlpAnsiToWideString(find);\n\n\n result = HlpBeginsWithW(lookW, findW, caseSens, findLen);\n\n FREESTRING(lookW);\n FREESTRING(findW);\n\n return result;\n}\n\nbool HlpBeginsWithW(LPCWSTR look, LPCWSTR find, BOOL caseSens, LONG findLen)\n{\n int lookLen;\n\n if (!look || !find)\n return false;\n\n if (findLen <= 0)\n return false;\n\n lookLen = (int)wcslen(look);\n\n if (lookLen < findLen)\n return false;\n\n if (caseSens)\n return wcsncmp(look, find, findLen) == 0;\n\n return _wcsnicmp(look, find, findLen) == 0;\n}\n\nbool HlpEndsWithA(LPCSTR look, LPCSTR find, BOOL caseSens, LONG findLen)\n{\n bool result;\n\n LPWSTR lookW = HlpAnsiToWideString(look);\n LPWSTR findW = HlpAnsiToWideString(find);\n\n\n result = HlpEndsWithW(lookW, findW, caseSens, findLen);\n\n FREESTRING(lookW);\n FREESTRING(findW);\n\n return result;\n}\n\nbool HlpEndsWithW(LPCWSTR look, LPCWSTR find, BOOL caseSens, LONG findLen)\n{\n int lookLen;\n\n if (!look || !find)\n return false;\n\n if (findLen <= 0)\n return false;\n\n lookLen = (int)wcslen(look);\n\n if (lookLen < findLen)\n return false;\n\n look += lookLen - findLen;\n\n if (caseSens)\n return wcscmp(look, find) == 0;\n\n return _wcsicmp(look, find) == 0;\n}\n\nLONG HlpPrintFormatBufferExA(LPSTR *buffer, LPCSTR format, va_list vl)\n{\n int reqLen = 0;\n\n reqLen = _vsnprintf(NULL, NULL, format, vl);\n\n *buffer = ALLOCSTRINGA(reqLen);\n\n if (*buffer == NULL)\n return false;\n\n _vsnprintf(*buffer, reqLen + 1, format, vl);\n\n return reqLen;\n}\n\nLONG HlpPrintFormatBufferA(LPSTR *buffer, LPCSTR format, ...)\n{\n va_list vl;\n int reqLen;\n \n va_start(vl, format);\n \n reqLen = HlpPrintFormatBufferExA(buffer, format, vl);\n\n va_end(vl);\n\n return reqLen;\n}\n\n\nLONG HlpPrintFormatBufferExW(LPWSTR *buffer, LPCWSTR format, va_list vl)\n{\n int reqLen = 0;\n\n reqLen = _vsnwprintf(NULL, NULL, format, vl);\n\n *buffer = ALLOCSTRINGW(reqLen);\n\n if (*buffer == NULL)\n return false;\n\n _vsnwprintf(*buffer, reqLen + 1, format, vl);\n\n return reqLen;\n}\n\nLONG HlpPrintFormatBufferW(LPWSTR *buffer, LPCWSTR format, ...)\n{\n va_list vl;\n int reqLen;\n\n va_start(vl, format);\n\n reqLen = HlpPrintFormatBufferExW(buffer, format, vl);\n\n va_end(vl);\n\n return reqLen;\n}\n\nLONG HlpConcateStringFormatA(LPSTR buffer, LONG bufLen, LPCSTR format, ...)\n{\n LONG currLen, remain,needLen;\n va_list vl;\n currLen = strlen(buffer);\n\n remain = (bufLen-1) - currLen;\n\n va_start(vl, format);\n\n needLen = _vsnprintf(NULL, NULL, format, vl);\n\n if (remain < needLen)\n return 0;\n\n vsprintf(buffer + currLen, format, vl);\n\n va_end(vl);\n\n return needLen;\n}\n\nLONG HlpPathFromFilenameA(LPSTR fileName, LPSTR path, LONG pathBufSize, CHAR sep)\n{\n char c;\n LONG pathLen = 0,i=0;\n LPSTR pathPtr = path;\n\n \n while ((c = *(fileName + i)) != 0)\n {\n if (c == sep)\n pathLen = i;\n\n i++;\n\n if (i >= pathBufSize)\n return 0;\n\n *pathPtr++ = c;\n }\n\n if (pathLen == 0 && i > 0)\n return i;\n\n pathLen++;\n\n path[pathLen] = 0;\n\n return pathLen;\n}\n\nLONG HlpPathFromFilenameW(LPWSTR fileName, LPWSTR path, LONG pathBufSize, WCHAR sep)\n{\n wchar_t c;\n LONG pathLen = 0, i = 0;\n LPWSTR pathPtr = path;\n\n while ((c = *(fileName + i)) != 0)\n {\n if (c == sep)\n pathLen = i;\n\n i++;\n\n if (i >= pathBufSize)\n return 0;\n\n *pathPtr++ = c;\n }\n\n if (pathLen == 0 && i > 0)\n return i;\n\n pathLen++;\n\n path[pathLen] = 0;\n\n return pathLen;\n}" }, { "path": "x64dbgApiBreak/src/incl/apibreak.h", "content": "#ifndef __APIBREAK_H__\n#define __APIBREAK_H__\n\n\n//Disable shitty paranoid warnings\n#pragma warning(disable:4091)\n#pragma warning(disable:4800)\n#pragma warning(disable:4244)\n#pragma warning(disable:4267)\n#pragma warning(disable:4390)\n\n#define _CRT_SECURE_NO_WARNINGS\n\n#define CSR_FAILED 0\n#define CSR_COMPLETELY_SUCCESS 1\n#define CSR_PARTIAL_SUCCESS 2\n\n\n\n#include \n#include \n#include \n#include \n#include \n#include \n#include \n\n\n#include \n#include \n\nusing namespace std;\n\n#define _T(t) __##t\n\nstruct __ModuleApiInfo;\nstruct __BpCallbackContext;\n\ntypedef struct\n{\n _T(ModuleApiInfo *) ownerModule;\n struct\n {\n duint * calls;\n int callCount;\n int callListSize;\n }callInfo;\n duint rva;\n char name[MAX_LABEL_SIZE];\n}ApiFunctionInfo;\n\ntypedef unordered_map<\n std::string,\n ApiFunctionInfo *,\n std::tr1::hash> apilist;\n\ntypedef struct __ModuleApiInfo\n{\n duint baseAddr;\n duint listCount;\n apilist* apiList;\n char name[MAX_MODULE_SIZE];\n}ModuleApiInfo;\n\ntypedef vector modlist;\n\n\ntypedef void(*APIMODULE_ENUM_PROC)(LPCSTR,void *);\n\ntypedef void(*AB_BREAKPOINT_CALLBACK)(struct __BpCallbackContext *);\n\nstruct __BREAKPOINT_INFO;\n\ntypedef struct __BpCallbackContext\n{\n duint bpAddr;\n BRIDGEBP * bp;\n REGDUMP regContext;\n AB_BREAKPOINT_CALLBACK callback;\n ApiFunctionInfo *afi;\n struct __BREAKPOINT_INFO *ownerBreakpoint;\n void * user;\n}BpCallbackContext;\n\ntypedef struct __BREAKPOINT_INFO\n{\n duint addr;\n duint hitCount;\n DWORD options;\n DWORD status;\n BpCallbackContext* cbctx;\n}*PBREAKPOINT_INFO, BREAKPOINT_INFO;\n\n#define BPS_NONE 0x00000000\n#define BPS_EXECUTING_HANDLER 0x00000001\n#define BPS_EXECUTING_CALLBACK 0x00000002\n\n#define BPO_NONE 0\n#define BPO_BACKTRACK 1\n#define BPO_SINGLESHOT 2\n\n\nvoid AbDebuggerRun();\n\nvoid AbDebuggerPause();\n\nvoid AbDebuggerWaitUntilPaused();\n\nbool AbCmdExecFormat(const char *format, ...);\n\nbool AbGetDebuggedImageName(char *buffer);\n\nbool AbGetDebuggedModuleInfo(Script::Module::ModuleInfo *modInfo);\n\nbool AbGetDebuggedModulePath(char *pathBuf, int bufLen);\n\nduint AbGetDebuggedImageBase();\n\nbool AbHasDebuggingProcess();\n\nvoid AbReleaseModuleResources();\n\nbool AbLoadAvailableModuleAPIs(bool onlyImportsByExe);\n\nint AbEnumModuleNames(APIMODULE_ENUM_PROC enumProc, void *user);\n\nvoid AbEnumApiFunctionNames(APIMODULE_ENUM_PROC enumProc, const char *moduleName, void *user);\n\nbool AbSetAPIBreakpointOnCallers(const char *module, const char *apiFunction);\n\nbool AbSetAPIBreakpoint(const char *module, const char *apiFunction, duint *funcAddr);\n\nbool AbSetInstructionBreakpoint(duint instrAddr, AB_BREAKPOINT_CALLBACK callback, void *user, bool singleShot);\n\nbool AbSetBreakpointEx(const char *module, const char *apiFunction, duint *funcAddr, DWORD bpo, AB_BREAKPOINT_CALLBACK bpCallback, void *user);\n\nbool AbDeleteBreakpoint(duint addr);\n\n\nvoid AbpReleaseBreakpointResources();\n\nPBREAKPOINT_INFO AbpLookupBreakpoint(duint addr);\n\nbool AbpRegisterBreakpoint(duint addr, DWORD options, BpCallbackContext *cbctx);\n\nbool AbpDeregisterBreakpoint(duint addr);\n\n#endif // !__APIBREAK_H__" }, { "path": "x64dbgApiBreak/src/incl/corelib.h", "content": "#ifndef __CORELIB_H_\n#define __CORELIB_H_\n\n#include \n#include \n\n#ifdef _WIN64\n#pragma comment(lib, \"pluginsdk/x64dbg.lib\")\n#pragma comment(lib, \"pluginsdk/x64bridge.lib\")\n#pragma comment(lib, \"pluginsdk/TitanEngine/TitanEngine_x64.lib\")\n#else\n#pragma comment(lib, \"pluginsdk/x32dbg.lib\")\n#pragma comment(lib, \"pluginsdk/x32bridge.lib\")\n#pragma comment(lib, \"pluginsdk/TitanEngine/TitanEngine_x86.lib\")\n#endif\n\n\n\nbool AbMemReadGuaranteed(duint va, void *dest, duint size);\n\n\n#define TRACK_MEMORY_ALLOCATIONS\n\n#ifdef TRACK_MEMORY_ALLOCATIONS\n\nvoid *AbMemoryAlloc_DBG(int size,const char *file, const char *func, const int line);\nvoid *AbMemoryRealloc_DBG(void *memPtr, int newSize, const char *file, const char *func, const int line);\nvoid AbMemoryFree_DBG(void *memPtr);\nvoid AbTrackMemory_DBG(void *memPtr);\n\n#define AbMemoryAlloc(size)\t\t\t\t\tAbMemoryAlloc_DBG((size), __FILE__, __FUNCTION__,__LINE__)\n#define AbMemoryRealloc(memPtr, newSize)\tAbMemoryRealloc_DBG((memPtr),(newSize),__FILE__, __FUNCTION__,__LINE__)\n#define AbMemoryFree(memPtr)\t\t\t\tAbMemoryFree_DBG((memPtr))\n#define AbTrackMemory(memPtr)\t\t\t\tAbTrackMemory_DBG((memPtr))\n\n#ifdef __cplusplus\n\nvoid *operator new(size_t size, char *func, char *file, int line);\n\n//this just for compiler warning. it will forward to standart delete call\nvoid operator delete(void *memory, char *func, char *file, int line);\n\nvoid operator delete(void *memory);\n\n#define new new(__FUNCTION__, __FILE__, __LINE__)\n\n#endif\n\n#else\n#define AbMemoryAlloc(size)\t\t\t\t\t_AbMemoryAlloc((size))\n#define AbMemoryRealloc(memPtr, newSize)\t_AbMemoryRealloc((memPtr),(newSize))\n#define AbMemoryFree(memPtr)\t\t\t\t_AbMemoryFree((memPtr))\n#define AbTrackMemory(memPtr)\t\t\t\t\n#endif\n\nvoid *_AbMemoryAlloc(int size);\nvoid *_AbMemoryRealloc(void *memPtr, int newSize);\nvoid _AbMemoryFree(void *memPtr);\n\nvoid AbRevealPossibleMemoryLeaks();\n\nvoid AbReleaseAllSystemResources(bool isInShutdown);\n\nBOOL AbRaiseSystemError(const char *errorDesc, int errCode, const char *func, const int line);\n\nFORWARDED int AbPluginHandle;\nFORWARDED HWND AbHwndDlgHandle;\nFORWARDED int AbMenuHandle;\nFORWARDED int AbMenuDisasmHandle;\nFORWARDED int AbMenuDumpHandle;\nFORWARDED int AbMenuStackHandle;\nFORWARDED HMODULE AbPluginModule;\n\n#endif // !__CORELIB_H_\n" }, { "path": "x64dbgApiBreak/src/incl/defs.h", "content": "#ifndef __DEFS_H_\n#define __DEFS_H_\n\n#include \n\n#define FORWARDED extern\n#define INTERNAL_EXPORT FORWARDED\n#define INTERNAL \n\ntypedef unsigned char uchar;\n\n\n#define DBG_LIBEXPORT extern \"C\" __declspec(dllexport)\n\n#if _DEBUG\n#define DBGPRINT(s,...) HlpDebugPrint(\"ApiBreak: \" s \"\\n\",##__VA_ARGS__)\n#define DBGPRINT2(s,...) HlpDebugPrint(\"ApiBreak: %s\\n\",##__VA_ARGS__)\n#define _DBGPRINT(s,...) HlpDebugPrint(s,##__VA_ARGS__)\n#else\n#define DBGPRINT(s,...) \n#define DBGPRINT2(s,...)\n#define _DBGPRINT(s,...)\n\n#endif\n\n#define RAISEGLOBALERROR(errString) AbRaiseSystemError(errString, 0,__FUNCTION__,__LINE__)\n\n#define BIGERROR(msg) DBGPRINT(msg); \\\n __debugbreak()\n\n\n#define NOTIMPLEMENTED() HlpDebugPrint(__FUNCTION__ \" not implemented yet\")\n\n\n#define ALLOCOBJECT(type) (type *)AbMemoryAlloc(sizeof(type))\n#define FREEOBJECT(ob) AbMemoryFree((ob))\n\n#define RESIZEOBJECTLIST(type, obj, newSize) (type *)AbMemoryRealloc((obj),sizeof(type) * (newSize))\n\n#define ALLOCSTRINGW(size) (LPWSTR)AbMemoryAlloc(sizeof(WCHAR) * ((size)+1))\n#define ALLOCSTRINGA(size) (LPSTR)AbMemoryAlloc(sizeof(CHAR) * ((size)+1))\n\n#define FREESTRING(str) AbMemoryFree((void *)(str))\n\n#if _DEBUG\n#define DBGBREAK __debugbreak\n#else\n#define DBGBREAK\n#endif\n\n#define _stringfy(x) #x\n\n#define AB_VERSION_MAJOR 0\n#define AB_VERSION_MINOR 5\n#define AB_VERSION_BUILD 39\n\n#if _WIN64\n#define AB_PLATFORM \"x64\"\n#define PLATFORM_SIZE\t64\n#else\n#define AB_PLATFORM \"x86\"\n#define PLATFORM_SIZE\t32\n#endif\n\n#define AB_PHASE \"BETA\"\n\n#define AB_APPNAME \"Api Break (\" AB_PHASE \")\"\n#define AB_APPTITLE AB_APPNAME \" - \" AB_PLATFORM\n\n\n\n#define AB_VERSION_STRING(maj,min,build) _stringfy(maj) \".\" _stringfy(min) \" Build: \" _stringfy(build)\n\n#define AB_VERSTR AB_VERSION_STRING(AB_VERSION_MAJOR,AB_VERSION_MINOR,AB_VERSION_BUILD)\n#define AB_BUILD_TIME __DATE__ \" \" __TIME__\n\n\n#endif // !__DEFS_H_\n" }, { "path": "x64dbgApiBreak/src/incl/dlgs/ApiCallMapForm.hpp", "content": "#ifndef __APICALLMAPFORM_HPP_\n#define __APICALLMAPFORM_HPP_\n\n#include \n#include \n\n#include \n#include \n\n\nclass ApiCallMapForm : public UiWrapper\n{\nprivate:\n UiControlBase *txtMapCallResultContent;\n LPSTR mapContent;\n LONG lengthOfMapContent;\n LONG lastReadOffset;\n\n static DWORD CALLBACK EditStreamCallback(\n _In_ DWORD_PTR dwCookie,\n _In_ LPBYTE pbBuff,\n _In_ LONG cb,\n _In_ LONG *pcb\n )\n {\n LONG remainLen,readLen;\n\n ApiCallMapForm *_this = (ApiCallMapForm *)dwCookie;\n\n remainLen = _this->lengthOfMapContent - _this->lastReadOffset;\n\n if (!remainLen)\n {\n *pcb = 0;\n return 0;\n }\n\n if (remainLen > cb)\n readLen = cb;\n else\n readLen = remainLen;\n\n\n memcpy(pbBuff, (BYTE *)(_this->mapContent + _this->lastReadOffset), readLen);\n _this->lastReadOffset += readLen;\n *pcb = readLen;\n\n return 0;\n }\npublic:\n ApiCallMapForm(LPSTR callMapContent) : UiWrapper(IDD_APICALLMAP, true)\n {\n lastReadOffset = 0;\n mapContent = callMapContent;\n lengthOfMapContent = strlen(mapContent);\n }\n\n void OnLoaded()\n {\n this->txtMapCallResultContent->SendControlMsg(EM_SETSEL, (WPARAM)-1, (LPARAM)-1);\n }\n\n void OnClose()\n {\n if (mapContent)\n FREESTRING(mapContent);\n }\n\n\tvoid OnCommand(WPARAM wp, LPARAM lp)\n\t{\n\t\tswitch (LOWORD(wp))\n\t\t{\n\t\tcase IDC_MAPDLG_BTNCONT:\n\t\t\tAbDebuggerRun();\n\t\t\tClose();\n\t\t\tbreak;\n\t\t}\n\t}\n\n void OnInit()\n {\n EDITSTREAM es;\n \n\t\tes.dwCookie = (DWORD_PTR)this;\n es.dwError = 0;\n es.pfnCallback = EditStreamCallback;\n\n \n this->txtMapCallResultContent = GetControlById(IDC_RTXTAPIMAPCONTENT);\n this->txtMapCallResultContent->SendControlMsg(EM_STREAMIN, SF_RTF | SFF_PLAINRTF,(LPARAM)&es);\n\n \n //this->txtMapCallResultContent->SetStringA(mapContent);\n }\n\n bool ShowDialog()\n {\n return UiWrapper::ShowDialog(true);\n }\n};\n\n#endif //__MAINFORM_HPP_\n" }, { "path": "x64dbgApiBreak/src/incl/dlgs/MainForm.hpp", "content": "#ifndef __MAINFORM_HPP_\n#define __MAINFORM_HPP_\n\n#include \n#include \n\n#include \n\n#define ST_SUCCESS RGB(0x0,0xae,0x0)\n#define ST_FAIL RGB(0xce,0x0,0x0)\n#define ST_INFO RGB(0x0,0x0,0xff)\n#define ST_WARN RGB(0xff,0x4f,0)\n\n#define SETSTATUS(t,x,...) this->lblStatus->DrawStringFormatA(1,1,t,\"Status: \" ## x, __VA_ARGS__)\n#define _SETSTATUS(t,x,...) _this->lblStatus->DrawStringFormatA(1,1,t,\"Status: \" ## x, __VA_ARGS__)\n\nclass MainForm : public UiWrapper\n{\nprivate:\n UiComboBox *cbModules, *cbApis;\n UiControlBase *chkUseXref, *lblStatus;\n\n void InvalidateApiFunctionList()\n {\n char modName[256] = { 0 };\n\n if (!cbModules->GetSelectedIndexTextA(modName))\n return;\n\n this->cbApis->Clear();\n AbEnumApiFunctionNames((APIMODULE_ENUM_PROC)ApiFunctionEnumerator, modName, this);\n }\n\n void SetBP()\n {\n char moduleName[256] = { 0 };\n char funcName[256] = { 0 };\n duint apiAddr;\n bool isSet;\n bool bpOnXrefs = false;\n\n GetControlTextA(IDC_CBAPIFUNC, funcName, sizeof(funcName));\n GetControlTextA(IDC_CBMODULELIST, moduleName, sizeof(moduleName));\n\n bpOnXrefs = (bool)chkUseXref->SendControlMsg(BM_GETCHECK, NULL, NULL);\n \n if (bpOnXrefs)\n {\n isSet = AbSetAPIBreakpointOnCallers(moduleName, funcName);\n\n if (isSet)\n SETSTATUS(ST_SUCCESS,\"Api breakpoint set\");\n else\n SETSTATUS(ST_FAIL,\"Bp could not be set\");\n\n }\n else\n {\n \n isSet = AbSetAPIBreakpoint(moduleName, funcName, &apiAddr);\n\n if (isSet)\n SETSTATUS(ST_SUCCESS,\"Breakpoint is set\");\n else\n SETSTATUS(ST_FAIL,\"The bp could not be set\");\n }\n\n }\n\n static void ModuleEnumerator(LPCSTR modName,void *user)\n {\n MainForm *_this = reinterpret_cast(user);\n _this->cbModules->AddItemA(modName);\n }\n\n static void ApiFunctionEnumerator(LPCSTR funcName, void *user)\n {\n MainForm *_this = reinterpret_cast(user);\n \n _this->cbApis->AddItemA(funcName);\n\n }\n\n static int WINAPI ApiLoadWorker(void *arg)\n {\n char processName[MAX_MODULE_SIZE] = { 0 };\n\n MainForm *_this = static_cast(arg);\n int modCount = 0;\n\n if (!AbLoadAvailableModuleAPIs(true))\n {\n _this->MsgBoxError(\"Could not be loaded\",\"error\");\n return 0;\n }\n\n\n modCount = AbEnumModuleNames((APIMODULE_ENUM_PROC)ModuleEnumerator, _this);\n\n if (modCount > 0)\n {\n AbGetDebuggedImageName(processName);\n\n _this->SetControlTextFormatA(IDC_GRPMOD, \"Imported modules && APIs by \\\"%s\\\"\", processName);\n _this->EnableControl(IDC_BTNSETBP);\n _SETSTATUS(ST_INFO,\"%d module(s) loaded\",modCount);\n }\n return 0;\n }\n\npublic :\n MainForm() : UiWrapper(IDD_MAIN,true)\n {\n }\n\n void OnCommand(WPARAM wp, LPARAM lp)\n {\n switch (LOWORD(wp))\n {\n case IDC_BTNSETBP:\n SetBP();\n break;\n case IDC_CBMODULELIST:\n {\n if (HIWORD(wp) == CBN_SELCHANGE)\n {\n InvalidateApiFunctionList();\n }\n }\n break;\n case IDC_CHKBPONXREFS:\n {\n }\n break;\n }\n\n UiWrapper::OnCommand(wp, lp);\n }\n\n void OnInit()\n {\n SetWindowTitleA(AB_APPTITLE);\n\n this->cbModules = GetControlById(IDC_CBMODULELIST);\n this->cbApis = GetControlById(IDC_CBAPIFUNC);\n this->chkUseXref = GetControlById(IDC_CHKBPONXREFS);\n this->lblStatus = GetControlById(IDC_LBLSTATUS);\n\n this->lblStatus->EnableOwnerDraw();\n\n DisableControl(IDC_BTNSETBP);\n\n SETSTATUS(ST_INFO,\"Loading modules\");\n\n if (AbHasDebuggingProcess())\n QueueUserWorkItem((LPTHREAD_START_ROUTINE)ApiLoadWorker, this, WT_EXECUTEDEFAULT);\n else\n SETSTATUS(ST_WARN,\"There is no debug process\");\n }\n\n bool ShowDialog()\n {\n return UiWrapper::ShowDialog(true);\n }\n};\n\n#endif //__MAINFORM_HPP_\n" }, { "path": "x64dbgApiBreak/src/incl/dlgs/SettingsForm.hpp", "content": "#ifndef __SETTINGSFORM_HPP_\n#define __SETTINGSFORM_HPP_\n\n#include \n#include \n#include \n#include \n\nclass SettingsForm : public UiWrapper\n{\nprivate:\n UiCheckBox *chkDetectDynLdr, *chkInclGetModHandle,\n *chkAutoload,*chkMapCallctx;\n\n UiControlBase *txtScripts;\n\n void FillGui()\n {\n Settings *settings = AbGetSettings();\n\n this->chkDetectDynLdr->SetState(settings->exposeDynamicApiLoads);\n this->chkInclGetModHandle->SetState(settings->includeGetModuleHandle);\n this->chkAutoload->SetState(settings->autoLoadData);\n this->chkMapCallctx->SetState(settings->mapCallContext);\n\n if (settings->mainScripts != NULL)\n {\n HlpReplaceStringA(settings->mainScripts, MAX_SETTING_SIZE, \";\", \"\\r\\n\");\n this->txtScripts->SetStringA(settings->mainScripts);\n }\n }\n\n void GetFromGUI()\n {\n Settings *setting = AbGetSettings();\n\n setting->exposeDynamicApiLoads = this->chkDetectDynLdr->GetState();\n setting->includeGetModuleHandle = this->chkInclGetModHandle->GetState();\n setting->autoLoadData = this->chkAutoload->GetState();\n setting->mapCallContext = this->chkMapCallctx->GetState();\n\n txtScripts->GetStringA(&setting->mainScripts, MAX_SETTING_SIZE);\n HlpReplaceStringA(setting->mainScripts, MAX_SETTING_SIZE, \"\\r\\n\", \";\");\n\n }\n\n bool LoadSettings()\n {\n if (AbSettingsLoad())\n {\n FillGui();\n return true;\n }\n\n return false;\n }\n\n bool SaveSettings()\n {\n GetFromGUI();\n\n return AbSettingsSave();\n }\n\npublic:\n SettingsForm() : UiWrapper(IDD_SETTINGS, true)\n {\n }\n\n void OnCommand(WPARAM wp, LPARAM lp)\n {\n switch (LOWORD(wp))\n {\n case IDC_BTNSAVESETTINGS:\n SaveSettings(); //fall trough\n case IDC_BTNDISCARDSETTINGS:\n Close();\n break;\n case IDC_CHKDETECTDYNLDR:\n {\n if (HIWORD(wp) == BN_CLICKED)\n {\n bool state = this->chkDetectDynLdr->GetState();\n\n this->chkInclGetModHandle->SetState(state);\n this->chkInclGetModHandle->SetEnableState(state);\n \n }\n break;\n }\n }\n\n UiWrapper::OnCommand(wp, lp);\n }\n\n void OnInit()\n {\n SetWindowTitleA(AB_APPTITLE);\n\n this->chkDetectDynLdr = GetControlById(IDC_CHKDETECTDYNLDR);\n this->chkInclGetModHandle = GetControlById(IDC_CHKINSPGETMODULEHANDLE);\n this->chkAutoload = GetControlById(IDC_CHKAUTOLOAD);\n this->chkMapCallctx = GetControlById(IDC_CHKMAPCALLCTX);\n this->txtScripts = GetControlById(IDC_TXTMAINSCRIPTS);\n\n LoadSettings();\n\n }\n\n bool ShowDialog()\n {\n return UiWrapper::ShowDialog(true);\n }\n};\n\n#endif //__SETTINGSFORM_HPP_\n" }, { "path": "x64dbgApiBreak/src/incl/hlp.h", "content": "#ifndef __HELPER_H_\n#define __HELPER_H_\n\n#include \n\n\n#define HLP_TRIM_LEFT 1\n#define HLP_TRIM_RIGHT 2\n#define HLP_TRIM_BOTH (HLP_TRIM_LEFT | HLP_TRIM_RIGHT)\n\n\nvoid HlpDebugPrint(const char *format, ...);\n\nLPSTR HlpCloneStringA(LPCSTR str);\n\nLPWSTR HlpAnsiToWideString(LPCSTR str);\nLPSTR HlpWideToAnsiString(LPCWSTR str);\n\nbool HlpTrimChar(LPSTR str, CHAR chr, int option);\n\n\n#define HlpRemoveQuotations(str) HlpTrimChar(str, '\\\"', HLP_TRIM_BOTH)\n\nbool HlpReplaceStringW(LPWSTR string, ULONG stringMaxSize, LPCWSTR find, LPCWSTR replace);\n\nbool HlpReplaceStringA(LPSTR string, ULONG stringMaxSize, LPCSTR find, LPCSTR replace);\n\nbool HlpBeginsWithA(LPCSTR look, LPCSTR find, BOOL caseSens, LONG findLen);\n\nbool HlpBeginsWithW(LPCWSTR look, LPCWSTR find, BOOL caseSens, LONG findLen);\n\nbool HlpEndsWithA(LPCSTR look, LPCSTR find, BOOL caseSens, LONG findLen);\n\nbool HlpEndsWithW(LPCWSTR look, LPCWSTR find, BOOL caseSens, LONG findLen);\n\nLONG HlpPrintFormatBufferExA(LPSTR *buffer, LPCSTR format, va_list vl);\n\nLONG HlpPrintFormatBufferA(LPSTR *buffer, LPCSTR format, ...);\n\nLONG HlpPrintFormatBufferExW(LPWSTR *buffer, LPCWSTR format, va_list vl);\n\nLONG HlpPrintFormatBufferW(LPWSTR *buffer, LPCWSTR format, ...);\n\nLONG HlpConcateStringFormatA(LPSTR buffer, LONG bufLen, LPCSTR format, ...);\n\nLONG HlpPathFromFilenameA(LPSTR fileName, LPSTR path, LONG pathBufSize, CHAR sep);\n\nLONG HlpPathFromFilenameW(LPWSTR fileName, LPWSTR path, LONG pathBufSize, WCHAR sep);\n\n\n#endif // !__HELPER_H_\n" }, { "path": "x64dbgApiBreak/src/incl/instparse.h", "content": "#ifndef __INSTPARSE_H__\n#define __INSTPARSE_H__\n\n#include \n\ntypedef struct\n{\n uchar size;\n uchar op;\n char reg;\n uchar reg_oper;\n uchar mem_access;\n duint imm;\n struct\n {\n uchar base;\n uchar index;\n uchar scale;\n int disp;\n }memory_info;\n}InstInfo;\n\n#define MA_NONE 0\n#define MA_READ 1\n#define MA_WRITE 2\n\n#define OP_MOV 1\n#define OP_LEA 2\n#define OP_PUSH 3\n\n#define ORD_OP 0\n#define ORD_DREG 1\n#define ORD_SREG 2\n#define ORD_DONE 3\n\n#define GET_REGSIZE(pfx) (pfx == 'r' ? 64 : pfx == 'e' ? 32 : 8)\n\ntypedef enum\n{\n RegNone = -1,\n Ax,\n Bx,\n Cx,\n Dx,\n Si,\n Di,\n Bp,\n Sp,\n r8,\n r9,\n r10,\n r11,\n r12,\n r13,\n r14,\n r15,\n ImmMem\n}RegId;\n\nbool AbParseInstruction(BASIC_INSTRUCTION_INFO *inst, InstInfo *linst);\n\n\n#endif // !__INSTPARSE_H__\n" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/DeviceNameResolver/DeviceNameResolver.h", "content": "#ifndef _DEVICENAMERESOLVER_H\r\n#define _DEVICENAMERESOLVER_H\r\n\r\n#include \r\n\r\n#ifdef __cplusplus\r\nextern \"C\"\r\n{\r\n#endif\r\n\r\n__declspec(dllexport) bool DevicePathToPathW(const wchar_t* szDevicePath, wchar_t* szPath, size_t nSizeInChars);\r\n__declspec(dllexport) bool DevicePathToPathA(const char* szDevicePath, char* szPath, size_t nSizeInChars);\r\n__declspec(dllexport) bool DevicePathFromFileHandleW(HANDLE hFile, wchar_t* szDevicePath, size_t nSizeInChars);\r\n__declspec(dllexport) bool DevicePathFromFileHandleA(HANDLE hFile, char* szDevicePath, size_t nSizeInChars);\r\n__declspec(dllexport) bool PathFromFileHandleW(HANDLE hFile, wchar_t* szPath, size_t nSizeInChars);\r\n__declspec(dllexport) bool PathFromFileHandleA(HANDLE hFile, char* szPath, size_t nSizeInChars);\r\n\r\n#ifdef __cplusplus\r\n}\r\n#endif\r\n\r\n#endif // _DEVICENAMERESOLVER_H\r\n" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/TitanEngine/TitanEngine.h", "content": "#ifndef TITANENGINE\r\n#define TITANENGINE\r\n\r\n#define TITCALL\r\n\r\n#if _MSC_VER > 1000\r\n#pragma once\r\n#endif\r\n\r\n#include \r\n#include \r\n\r\n#pragma pack(push, 1)\r\n\r\n// Global.Constant.Structure.Declaration:\r\n// Engine.External:\r\n#define UE_STRUCT_PE32STRUCT 1\r\n#define UE_STRUCT_PE64STRUCT 2\r\n#define UE_STRUCT_PESTRUCT 3\r\n#define UE_STRUCT_IMPORTENUMDATA 4\r\n#define UE_STRUCT_THREAD_ITEM_DATA 5\r\n#define UE_STRUCT_LIBRARY_ITEM_DATA 6\r\n#define UE_STRUCT_LIBRARY_ITEM_DATAW 7\r\n#define UE_STRUCT_PROCESS_ITEM_DATA 8\r\n#define UE_STRUCT_HANDLERARRAY 9\r\n#define UE_STRUCT_PLUGININFORMATION 10\r\n#define UE_STRUCT_HOOK_ENTRY 11\r\n#define UE_STRUCT_FILE_STATUS_INFO 12\r\n#define UE_STRUCT_FILE_FIX_INFO 13\r\n#define UE_STRUCT_X87FPUREGISTER 14\r\n#define UE_STRUCT_X87FPU 15\r\n#define UE_STRUCT_TITAN_ENGINE_CONTEXT 16\r\n\r\n#define UE_ACCESS_READ 0\r\n#define UE_ACCESS_WRITE 1\r\n#define UE_ACCESS_ALL 2\r\n\r\n#define UE_HIDE_PEBONLY 0\r\n#define UE_HIDE_BASIC 1\r\n\r\n#define UE_PLUGIN_CALL_REASON_PREDEBUG 1\r\n#define UE_PLUGIN_CALL_REASON_EXCEPTION 2\r\n#define UE_PLUGIN_CALL_REASON_POSTDEBUG 3\r\n#define UE_PLUGIN_CALL_REASON_UNHANDLEDEXCEPTION 4\r\n\r\n#define TEE_HOOK_NRM_JUMP 1\r\n#define TEE_HOOK_NRM_CALL 3\r\n#define TEE_HOOK_IAT 5\r\n\r\n#define UE_ENGINE_ALOW_MODULE_LOADING 1\r\n#define UE_ENGINE_AUTOFIX_FORWARDERS 2\r\n#define UE_ENGINE_PASS_ALL_EXCEPTIONS 3\r\n#define UE_ENGINE_NO_CONSOLE_WINDOW 4\r\n#define UE_ENGINE_BACKUP_FOR_CRITICAL_FUNCTIONS 5\r\n#define UE_ENGINE_CALL_PLUGIN_CALLBACK 6\r\n#define UE_ENGINE_RESET_CUSTOM_HANDLER 7\r\n#define UE_ENGINE_CALL_PLUGIN_DEBUG_CALLBACK 8\r\n#define UE_ENGINE_SET_DEBUG_PRIVILEGE 9\r\n\r\n#define UE_OPTION_REMOVEALL 1\r\n#define UE_OPTION_DISABLEALL 2\r\n#define UE_OPTION_REMOVEALLDISABLED 3\r\n#define UE_OPTION_REMOVEALLENABLED 4\r\n\r\n#define UE_STATIC_DECRYPTOR_XOR 1\r\n#define UE_STATIC_DECRYPTOR_SUB 2\r\n#define UE_STATIC_DECRYPTOR_ADD 3\r\n\r\n#define UE_STATIC_DECRYPTOR_FOREWARD 1\r\n#define UE_STATIC_DECRYPTOR_BACKWARD 2\r\n\r\n#define UE_STATIC_KEY_SIZE_1 1\r\n#define UE_STATIC_KEY_SIZE_2 2\r\n#define UE_STATIC_KEY_SIZE_4 4\r\n#define UE_STATIC_KEY_SIZE_8 8\r\n\r\n#define UE_STATIC_APLIB 1\r\n#define UE_STATIC_APLIB_DEPACK 2\r\n#define UE_STATIC_LZMA 3\r\n\r\n#define UE_STATIC_HASH_MD5 1\r\n#define UE_STATIC_HASH_SHA1 2\r\n#define UE_STATIC_HASH_CRC32 3\r\n\r\n#define UE_RESOURCE_LANGUAGE_ANY -1\r\n\r\n#define UE_PE_OFFSET 0\r\n#define UE_IMAGEBASE 1\r\n#define UE_OEP 2\r\n#define UE_SIZEOFIMAGE 3\r\n#define UE_SIZEOFHEADERS 4\r\n#define UE_SIZEOFOPTIONALHEADER 5\r\n#define UE_SECTIONALIGNMENT 6\r\n#define UE_IMPORTTABLEADDRESS 7\r\n#define UE_IMPORTTABLESIZE 8\r\n#define UE_RESOURCETABLEADDRESS 9\r\n#define UE_RESOURCETABLESIZE 10\r\n#define UE_EXPORTTABLEADDRESS 11\r\n#define UE_EXPORTTABLESIZE 12\r\n#define UE_TLSTABLEADDRESS 13\r\n#define UE_TLSTABLESIZE 14\r\n#define UE_RELOCATIONTABLEADDRESS 15\r\n#define UE_RELOCATIONTABLESIZE 16\r\n#define UE_TIMEDATESTAMP 17\r\n#define UE_SECTIONNUMBER 18\r\n#define UE_CHECKSUM 19\r\n#define UE_SUBSYSTEM 20\r\n#define UE_CHARACTERISTICS 21\r\n#define UE_NUMBEROFRVAANDSIZES 22\r\n#define UE_BASEOFCODE 23\r\n#define UE_BASEOFDATA 24\r\n#define UE_DLLCHARACTERISTICS 25\r\n//leaving some enum space here for future additions\r\n#define UE_SECTIONNAME 40\r\n#define UE_SECTIONVIRTUALOFFSET 41\r\n#define UE_SECTIONVIRTUALSIZE 42\r\n#define UE_SECTIONRAWOFFSET 43\r\n#define UE_SECTIONRAWSIZE 44\r\n#define UE_SECTIONFLAGS 45\r\n\r\n#define UE_VANOTFOUND = -2;\r\n\r\n#define UE_CH_BREAKPOINT 1\r\n#define UE_CH_SINGLESTEP 2\r\n#define UE_CH_ACCESSVIOLATION 3\r\n#define UE_CH_ILLEGALINSTRUCTION 4\r\n#define UE_CH_NONCONTINUABLEEXCEPTION 5\r\n#define UE_CH_ARRAYBOUNDSEXCEPTION 6\r\n#define UE_CH_FLOATDENORMALOPERAND 7\r\n#define UE_CH_FLOATDEVIDEBYZERO 8\r\n#define UE_CH_INTEGERDEVIDEBYZERO 9\r\n#define UE_CH_INTEGEROVERFLOW 10\r\n#define UE_CH_PRIVILEGEDINSTRUCTION 11\r\n#define UE_CH_PAGEGUARD 12\r\n#define UE_CH_EVERYTHINGELSE 13\r\n#define UE_CH_CREATETHREAD 14\r\n#define UE_CH_EXITTHREAD 15\r\n#define UE_CH_CREATEPROCESS 16\r\n#define UE_CH_EXITPROCESS 17\r\n#define UE_CH_LOADDLL 18\r\n#define UE_CH_UNLOADDLL 19\r\n#define UE_CH_OUTPUTDEBUGSTRING 20\r\n#define UE_CH_AFTEREXCEPTIONPROCESSING 21\r\n#define UE_CH_SYSTEMBREAKPOINT 23\r\n#define UE_CH_UNHANDLEDEXCEPTION 24\r\n#define UE_CH_RIPEVENT 25\r\n#define UE_CH_DEBUGEVENT 26\r\n\r\n#define UE_OPTION_HANDLER_RETURN_HANDLECOUNT 1\r\n#define UE_OPTION_HANDLER_RETURN_ACCESS 2\r\n#define UE_OPTION_HANDLER_RETURN_FLAGS 3\r\n#define UE_OPTION_HANDLER_RETURN_TYPENAME 4\r\n\r\n#define UE_BREAKPOINT_INT3 1\r\n#define UE_BREAKPOINT_LONG_INT3 2\r\n#define UE_BREAKPOINT_UD2 3\r\n\r\n#define UE_BPXREMOVED 0\r\n#define UE_BPXACTIVE 1\r\n#define UE_BPXINACTIVE 2\r\n\r\n#define UE_BREAKPOINT 0\r\n#define UE_SINGLESHOOT 1\r\n#define UE_HARDWARE 2\r\n#define UE_MEMORY 3\r\n#define UE_MEMORY_READ 4\r\n#define UE_MEMORY_WRITE 5\r\n#define UE_MEMORY_EXECUTE 6\r\n#define UE_BREAKPOINT_TYPE_INT3 0x10000000\r\n#define UE_BREAKPOINT_TYPE_LONG_INT3 0x20000000\r\n#define UE_BREAKPOINT_TYPE_UD2 0x30000000\r\n\r\n#define UE_HARDWARE_EXECUTE 4\r\n#define UE_HARDWARE_WRITE 5\r\n#define UE_HARDWARE_READWRITE 6\r\n\r\n#define UE_HARDWARE_SIZE_1 7\r\n#define UE_HARDWARE_SIZE_2 8\r\n#define UE_HARDWARE_SIZE_4 9\r\n#define UE_HARDWARE_SIZE_8 10\r\n\r\n#define UE_ON_LIB_LOAD 1\r\n#define UE_ON_LIB_UNLOAD 2\r\n#define UE_ON_LIB_ALL 3\r\n\r\n#define UE_APISTART 0\r\n#define UE_APIEND 1\r\n\r\n#define UE_PLATFORM_x86 1\r\n#define UE_PLATFORM_x64 2\r\n#define UE_PLATFORM_ALL 3\r\n\r\n#define UE_FUNCTION_STDCALL 1\r\n#define UE_FUNCTION_CCALL 2\r\n#define UE_FUNCTION_FASTCALL 3\r\n#define UE_FUNCTION_STDCALL_RET 4\r\n#define UE_FUNCTION_CCALL_RET 5\r\n#define UE_FUNCTION_FASTCALL_RET 6\r\n#define UE_FUNCTION_STDCALL_CALL 7\r\n#define UE_FUNCTION_CCALL_CALL 8\r\n#define UE_FUNCTION_FASTCALL_CALL 9\r\n#define UE_PARAMETER_BYTE 0\r\n#define UE_PARAMETER_WORD 1\r\n#define UE_PARAMETER_DWORD 2\r\n#define UE_PARAMETER_QWORD 3\r\n#define UE_PARAMETER_PTR_BYTE 4\r\n#define UE_PARAMETER_PTR_WORD 5\r\n#define UE_PARAMETER_PTR_DWORD 6\r\n#define UE_PARAMETER_PTR_QWORD 7\r\n#define UE_PARAMETER_STRING 8\r\n#define UE_PARAMETER_UNICODE 9\r\n\r\n#define UE_EAX 1\r\n#define UE_EBX 2\r\n#define UE_ECX 3\r\n#define UE_EDX 4\r\n#define UE_EDI 5\r\n#define UE_ESI 6\r\n#define UE_EBP 7\r\n#define UE_ESP 8\r\n#define UE_EIP 9\r\n#define UE_EFLAGS 10\r\n#define UE_DR0 11\r\n#define UE_DR1 12\r\n#define UE_DR2 13\r\n#define UE_DR3 14\r\n#define UE_DR6 15\r\n#define UE_DR7 16\r\n#define UE_RAX 17\r\n#define UE_RBX 18\r\n#define UE_RCX 19\r\n#define UE_RDX 20\r\n#define UE_RDI 21\r\n#define UE_RSI 22\r\n#define UE_RBP 23\r\n#define UE_RSP 24\r\n#define UE_RIP 25\r\n#define UE_RFLAGS 26\r\n#define UE_R8 27\r\n#define UE_R9 28\r\n#define UE_R10 29\r\n#define UE_R11 30\r\n#define UE_R12 31\r\n#define UE_R13 32\r\n#define UE_R14 33\r\n#define UE_R15 34\r\n#define UE_CIP 35\r\n#define UE_CSP 36\r\n#ifdef _WIN64\r\n#define UE_CFLAGS UE_RFLAGS\r\n#else\r\n#define UE_CFLAGS UE_EFLAGS\r\n#endif\r\n#define UE_SEG_GS 37\r\n#define UE_SEG_FS 38\r\n#define UE_SEG_ES 39\r\n#define UE_SEG_DS 40\r\n#define UE_SEG_CS 41\r\n#define UE_SEG_SS 42\r\n#define UE_x87_r0 43\r\n#define UE_x87_r1 44\r\n#define UE_x87_r2 45\r\n#define UE_x87_r3 46\r\n#define UE_x87_r4 47\r\n#define UE_x87_r5 48\r\n#define UE_x87_r6 49\r\n#define UE_x87_r7 50\r\n#define UE_X87_STATUSWORD 51\r\n#define UE_X87_CONTROLWORD 52\r\n#define UE_X87_TAGWORD 53\r\n#define UE_MXCSR 54\r\n#define UE_MMX0 55\r\n#define UE_MMX1 56\r\n#define UE_MMX2 57\r\n#define UE_MMX3 58\r\n#define UE_MMX4 59\r\n#define UE_MMX5 60\r\n#define UE_MMX6 61\r\n#define UE_MMX7 62\r\n#define UE_XMM0 63\r\n#define UE_XMM1 64\r\n#define UE_XMM2 65\r\n#define UE_XMM3 66\r\n#define UE_XMM4 67\r\n#define UE_XMM5 68\r\n#define UE_XMM6 69\r\n#define UE_XMM7 70\r\n#define UE_XMM8 71\r\n#define UE_XMM9 72\r\n#define UE_XMM10 73\r\n#define UE_XMM11 74\r\n#define UE_XMM12 75\r\n#define UE_XMM13 76\r\n#define UE_XMM14 77\r\n#define UE_XMM15 78\r\n#define UE_x87_ST0 79\r\n#define UE_x87_ST1 80\r\n#define UE_x87_ST2 81\r\n#define UE_x87_ST3 82\r\n#define UE_x87_ST4 83\r\n#define UE_x87_ST5 84\r\n#define UE_x87_ST6 85\r\n#define UE_x87_ST7 86\r\n#define UE_YMM0 87\r\n#define UE_YMM1 88\r\n#define UE_YMM2 89\r\n#define UE_YMM3 90\r\n#define UE_YMM4 91\r\n#define UE_YMM5 92\r\n#define UE_YMM6 93\r\n#define UE_YMM7 94\r\n#define UE_YMM8 95\r\n#define UE_YMM9 96\r\n#define UE_YMM10 97\r\n#define UE_YMM11 98\r\n#define UE_YMM12 99\r\n#define UE_YMM13 100\r\n#define UE_YMM14 101\r\n#define UE_YMM15 102\r\n\r\n#ifndef CONTEXT_EXTENDED_REGISTERS\r\n#define CONTEXT_EXTENDED_REGISTERS 0\r\n#endif\r\n\r\ntypedef struct\r\n{\r\n DWORD PE32Offset;\r\n DWORD ImageBase;\r\n DWORD OriginalEntryPoint;\r\n DWORD BaseOfCode;\r\n DWORD BaseOfData;\r\n DWORD NtSizeOfImage;\r\n DWORD NtSizeOfHeaders;\r\n WORD SizeOfOptionalHeaders;\r\n DWORD FileAlignment;\r\n DWORD SectionAligment;\r\n DWORD ImportTableAddress;\r\n DWORD ImportTableSize;\r\n DWORD ResourceTableAddress;\r\n DWORD ResourceTableSize;\r\n DWORD ExportTableAddress;\r\n DWORD ExportTableSize;\r\n DWORD TLSTableAddress;\r\n DWORD TLSTableSize;\r\n DWORD RelocationTableAddress;\r\n DWORD RelocationTableSize;\r\n DWORD TimeDateStamp;\r\n WORD SectionNumber;\r\n DWORD CheckSum;\r\n WORD SubSystem;\r\n WORD Characteristics;\r\n DWORD NumberOfRvaAndSizes;\r\n} PE32Struct, *PPE32Struct;\r\n\r\ntypedef struct\r\n{\r\n DWORD PE64Offset;\r\n DWORD64 ImageBase;\r\n DWORD OriginalEntryPoint;\r\n DWORD BaseOfCode;\r\n DWORD BaseOfData;\r\n DWORD NtSizeOfImage;\r\n DWORD NtSizeOfHeaders;\r\n WORD SizeOfOptionalHeaders;\r\n DWORD FileAlignment;\r\n DWORD SectionAligment;\r\n DWORD ImportTableAddress;\r\n DWORD ImportTableSize;\r\n DWORD ResourceTableAddress;\r\n DWORD ResourceTableSize;\r\n DWORD ExportTableAddress;\r\n DWORD ExportTableSize;\r\n DWORD TLSTableAddress;\r\n DWORD TLSTableSize;\r\n DWORD RelocationTableAddress;\r\n DWORD RelocationTableSize;\r\n DWORD TimeDateStamp;\r\n WORD SectionNumber;\r\n DWORD CheckSum;\r\n WORD SubSystem;\r\n WORD Characteristics;\r\n DWORD NumberOfRvaAndSizes;\r\n} PE64Struct, *PPE64Struct;\r\n\r\n#if defined(_WIN64)\r\ntypedef PE64Struct PEStruct;\r\n#else\r\ntypedef PE32Struct PEStruct;\r\n#endif\r\n\r\ntypedef struct\r\n{\r\n bool NewDll;\r\n int NumberOfImports;\r\n ULONG_PTR ImageBase;\r\n ULONG_PTR BaseImportThunk;\r\n ULONG_PTR ImportThunk;\r\n char* APIName;\r\n char* DLLName;\r\n} ImportEnumData, *PImportEnumData;\r\n\r\ntypedef struct\r\n{\r\n HANDLE hThread;\r\n DWORD dwThreadId;\r\n void* ThreadStartAddress;\r\n void* ThreadLocalBase;\r\n void* TebAddress;\r\n ULONG WaitTime;\r\n LONG Priority;\r\n LONG BasePriority;\r\n ULONG ContextSwitches;\r\n ULONG ThreadState;\r\n ULONG WaitReason;\r\n} THREAD_ITEM_DATA, *PTHREAD_ITEM_DATA;\r\n\r\ntypedef struct\r\n{\r\n HANDLE hFile;\r\n void* BaseOfDll;\r\n HANDLE hFileMapping;\r\n void* hFileMappingView;\r\n char szLibraryPath[MAX_PATH];\r\n char szLibraryName[MAX_PATH];\r\n} LIBRARY_ITEM_DATA, *PLIBRARY_ITEM_DATA;\r\n\r\ntypedef struct\r\n{\r\n HANDLE hFile;\r\n void* BaseOfDll;\r\n HANDLE hFileMapping;\r\n void* hFileMappingView;\r\n wchar_t szLibraryPath[MAX_PATH];\r\n wchar_t szLibraryName[MAX_PATH];\r\n} LIBRARY_ITEM_DATAW, *PLIBRARY_ITEM_DATAW;\r\n\r\ntypedef struct\r\n{\r\n HANDLE hProcess;\r\n DWORD dwProcessId;\r\n HANDLE hThread;\r\n DWORD dwThreadId;\r\n HANDLE hFile;\r\n void* BaseOfImage;\r\n void* ThreadStartAddress;\r\n void* ThreadLocalBase;\r\n} PROCESS_ITEM_DATA, *PPROCESS_ITEM_DATA;\r\n\r\ntypedef struct\r\n{\r\n ULONG ProcessId;\r\n HANDLE hHandle;\r\n} HandlerArray, *PHandlerArray;\r\n\r\ntypedef struct\r\n{\r\n char PluginName[64];\r\n DWORD PluginMajorVersion;\r\n DWORD PluginMinorVersion;\r\n HMODULE PluginBaseAddress;\r\n void* TitanDebuggingCallBack;\r\n void* TitanRegisterPlugin;\r\n void* TitanReleasePlugin;\r\n void* TitanResetPlugin;\r\n bool PluginDisabled;\r\n} PluginInformation, *PPluginInformation;\r\n\r\n#define TEE_MAXIMUM_HOOK_SIZE 14\r\n#define TEE_MAXIMUM_HOOK_RELOCS 7\r\n#if defined(_WIN64)\r\n#define TEE_MAXIMUM_HOOK_INSERT_SIZE 14\r\n#else\r\n#define TEE_MAXIMUM_HOOK_INSERT_SIZE 5\r\n#endif\r\n\r\ntypedef struct HOOK_ENTRY\r\n{\r\n bool IATHook;\r\n BYTE HookType;\r\n DWORD HookSize;\r\n void* HookAddress;\r\n void* RedirectionAddress;\r\n BYTE HookBytes[TEE_MAXIMUM_HOOK_SIZE];\r\n BYTE OriginalBytes[TEE_MAXIMUM_HOOK_SIZE];\r\n void* IATHookModuleBase;\r\n DWORD IATHookNameHash;\r\n bool HookIsEnabled;\r\n bool HookIsRemote;\r\n void* PatchedEntry;\r\n DWORD RelocationInfo[TEE_MAXIMUM_HOOK_RELOCS];\r\n int RelocationCount;\r\n} HOOK_ENTRY, *PHOOK_ENTRY;\r\n\r\n#define UE_DEPTH_SURFACE 0\r\n#define UE_DEPTH_DEEP 1\r\n\r\n#define UE_UNPACKER_CONDITION_SEARCH_FROM_EP 1\r\n\r\n#define UE_UNPACKER_CONDITION_LOADLIBRARY 1\r\n#define UE_UNPACKER_CONDITION_GETPROCADDRESS 2\r\n#define UE_UNPACKER_CONDITION_ENTRYPOINTBREAK 3\r\n#define UE_UNPACKER_CONDITION_RELOCSNAPSHOT1 4\r\n#define UE_UNPACKER_CONDITION_RELOCSNAPSHOT2 5\r\n\r\n#define UE_FIELD_OK 0\r\n#define UE_FIELD_BROKEN_NON_FIXABLE 1\r\n#define UE_FIELD_BROKEN_NON_CRITICAL 2\r\n#define UE_FIELD_BROKEN_FIXABLE_FOR_STATIC_USE 3\r\n#define UE_FIELD_BROKEN_BUT_CAN_BE_EMULATED 4\r\n#define UE_FIELD_FIXABLE_NON_CRITICAL 5\r\n#define UE_FIELD_FIXABLE_CRITICAL 6\r\n#define UE_FIELD_NOT_PRESET 7\r\n#define UE_FIELD_NOT_PRESET_WARNING 8\r\n\r\n#define UE_RESULT_FILE_OK 10\r\n#define UE_RESULT_FILE_INVALID_BUT_FIXABLE 11\r\n#define UE_RESULT_FILE_INVALID_AND_NON_FIXABLE 12\r\n#define UE_RESULT_FILE_INVALID_FORMAT 13\r\n\r\ntypedef struct\r\n{\r\n BYTE OveralEvaluation;\r\n bool EvaluationTerminatedByException;\r\n bool FileIs64Bit;\r\n bool FileIsDLL;\r\n bool FileIsConsole;\r\n bool MissingDependencies;\r\n bool MissingDeclaredAPIs;\r\n BYTE SignatureMZ;\r\n BYTE SignaturePE;\r\n BYTE EntryPoint;\r\n BYTE ImageBase;\r\n BYTE SizeOfImage;\r\n BYTE FileAlignment;\r\n BYTE SectionAlignment;\r\n BYTE ExportTable;\r\n BYTE RelocationTable;\r\n BYTE ImportTable;\r\n BYTE ImportTableSection;\r\n BYTE ImportTableData;\r\n BYTE IATTable;\r\n BYTE TLSTable;\r\n BYTE LoadConfigTable;\r\n BYTE BoundImportTable;\r\n BYTE COMHeaderTable;\r\n BYTE ResourceTable;\r\n BYTE ResourceData;\r\n BYTE SectionTable;\r\n} FILE_STATUS_INFO, *PFILE_STATUS_INFO;\r\n\r\ntypedef struct\r\n{\r\n BYTE OveralEvaluation;\r\n bool FixingTerminatedByException;\r\n bool FileFixPerformed;\r\n bool StrippedRelocation;\r\n bool DontFixRelocations;\r\n DWORD OriginalRelocationTableAddress;\r\n DWORD OriginalRelocationTableSize;\r\n bool StrippedExports;\r\n bool DontFixExports;\r\n DWORD OriginalExportTableAddress;\r\n DWORD OriginalExportTableSize;\r\n bool StrippedResources;\r\n bool DontFixResources;\r\n DWORD OriginalResourceTableAddress;\r\n DWORD OriginalResourceTableSize;\r\n bool StrippedTLS;\r\n bool DontFixTLS;\r\n DWORD OriginalTLSTableAddress;\r\n DWORD OriginalTLSTableSize;\r\n bool StrippedLoadConfig;\r\n bool DontFixLoadConfig;\r\n DWORD OriginalLoadConfigTableAddress;\r\n DWORD OriginalLoadConfigTableSize;\r\n bool StrippedBoundImports;\r\n bool DontFixBoundImports;\r\n DWORD OriginalBoundImportTableAddress;\r\n DWORD OriginalBoundImportTableSize;\r\n bool StrippedIAT;\r\n bool DontFixIAT;\r\n DWORD OriginalImportAddressTableAddress;\r\n DWORD OriginalImportAddressTableSize;\r\n bool StrippedCOM;\r\n bool DontFixCOM;\r\n DWORD OriginalCOMTableAddress;\r\n DWORD OriginalCOMTableSize;\r\n} FILE_FIX_INFO, *PFILE_FIX_INFO;\r\n\r\ntypedef struct DECLSPEC_ALIGN(16) _XmmRegister_t\r\n{\r\n ULONGLONG Low;\r\n LONGLONG High;\r\n} XmmRegister_t;\r\n\r\ntypedef struct\r\n{\r\n XmmRegister_t Low; //XMM/SSE part\r\n XmmRegister_t High; //AVX part\r\n} YmmRegister_t;\r\n\r\ntypedef struct\r\n{\r\n BYTE data[10];\r\n int st_value;\r\n int tag;\r\n} x87FPURegister_t;\r\n\r\ntypedef struct\r\n{\r\n WORD ControlWord;\r\n WORD StatusWord;\r\n WORD TagWord;\r\n DWORD ErrorOffset;\r\n DWORD ErrorSelector;\r\n DWORD DataOffset;\r\n DWORD DataSelector;\r\n DWORD Cr0NpxState;\r\n} x87FPU_t;\r\n\r\ntypedef struct\r\n{\r\n ULONG_PTR cax;\r\n ULONG_PTR ccx;\r\n ULONG_PTR cdx;\r\n ULONG_PTR cbx;\r\n ULONG_PTR csp;\r\n ULONG_PTR cbp;\r\n ULONG_PTR csi;\r\n ULONG_PTR cdi;\r\n#ifdef _WIN64\r\n ULONG_PTR r8;\r\n ULONG_PTR r9;\r\n ULONG_PTR r10;\r\n ULONG_PTR r11;\r\n ULONG_PTR r12;\r\n ULONG_PTR r13;\r\n ULONG_PTR r14;\r\n ULONG_PTR r15;\r\n#endif //_WIN64\r\n ULONG_PTR cip;\r\n ULONG_PTR eflags;\r\n unsigned short gs;\r\n unsigned short fs;\r\n unsigned short es;\r\n unsigned short ds;\r\n unsigned short cs;\r\n unsigned short ss;\r\n ULONG_PTR dr0;\r\n ULONG_PTR dr1;\r\n ULONG_PTR dr2;\r\n ULONG_PTR dr3;\r\n ULONG_PTR dr6;\r\n ULONG_PTR dr7;\r\n BYTE RegisterArea[80];\r\n x87FPU_t x87fpu;\r\n DWORD MxCsr;\r\n#ifdef _WIN64\r\n XmmRegister_t XmmRegisters[16];\r\n YmmRegister_t YmmRegisters[16];\r\n#else // x86\r\n XmmRegister_t XmmRegisters[8];\r\n YmmRegister_t YmmRegisters[8];\r\n#endif\r\n} TITAN_ENGINE_CONTEXT_t;\r\n\r\n#ifdef __cplusplus\r\nextern \"C\"\r\n{\r\n#endif\r\n\r\n// Global.Function.Declaration:\r\n// TitanEngine.Dumper.functions:\r\n__declspec(dllexport) bool TITCALL DumpProcess(HANDLE hProcess, LPVOID ImageBase, const char* szDumpFileName, ULONG_PTR EntryPoint);\r\n__declspec(dllexport) bool TITCALL DumpProcessW(HANDLE hProcess, LPVOID ImageBase, const wchar_t* szDumpFileName, ULONG_PTR EntryPoint);\r\n__declspec(dllexport) bool TITCALL DumpProcessEx(DWORD ProcessId, LPVOID ImageBase, const char* szDumpFileName, ULONG_PTR EntryPoint);\r\n__declspec(dllexport) bool TITCALL DumpProcessExW(DWORD ProcessId, LPVOID ImageBase, const wchar_t* szDumpFileName, ULONG_PTR EntryPoint);\r\n__declspec(dllexport) bool TITCALL DumpMemory(HANDLE hProcess, LPVOID MemoryStart, ULONG_PTR MemorySize, const char* szDumpFileName);\r\n__declspec(dllexport) bool TITCALL DumpMemoryW(HANDLE hProcess, LPVOID MemoryStart, ULONG_PTR MemorySize, const wchar_t* szDumpFileName);\r\n__declspec(dllexport) bool TITCALL DumpMemoryEx(DWORD ProcessId, LPVOID MemoryStart, ULONG_PTR MemorySize, const char* szDumpFileName);\r\n__declspec(dllexport) bool TITCALL DumpMemoryExW(DWORD ProcessId, LPVOID MemoryStart, ULONG_PTR MemorySize, const wchar_t* szDumpFileName);\r\n__declspec(dllexport) bool TITCALL DumpRegions(HANDLE hProcess, const char* szDumpFolder, bool DumpAboveImageBaseOnly);\r\n__declspec(dllexport) bool TITCALL DumpRegionsW(HANDLE hProcess, const wchar_t* szDumpFolder, bool DumpAboveImageBaseOnly);\r\n__declspec(dllexport) bool TITCALL DumpRegionsEx(DWORD ProcessId, const char* szDumpFolder, bool DumpAboveImageBaseOnly);\r\n__declspec(dllexport) bool TITCALL DumpRegionsExW(DWORD ProcessId, const wchar_t* szDumpFolder, bool DumpAboveImageBaseOnly);\r\n__declspec(dllexport) bool TITCALL DumpModule(HANDLE hProcess, LPVOID ModuleBase, const char* szDumpFileName);\r\n__declspec(dllexport) bool TITCALL DumpModuleW(HANDLE hProcess, LPVOID ModuleBase, const wchar_t* szDumpFileName);\r\n__declspec(dllexport) bool TITCALL DumpModuleEx(DWORD ProcessId, LPVOID ModuleBase, const char* szDumpFileName);\r\n__declspec(dllexport) bool TITCALL DumpModuleExW(DWORD ProcessId, LPVOID ModuleBase, const wchar_t* szDumpFileName);\r\n__declspec(dllexport) bool TITCALL PastePEHeader(HANDLE hProcess, LPVOID ImageBase, const char* szDebuggedFileName);\r\n__declspec(dllexport) bool TITCALL PastePEHeaderW(HANDLE hProcess, LPVOID ImageBase, const wchar_t* szDebuggedFileName);\r\n__declspec(dllexport) bool TITCALL ExtractSection(const char* szFileName, const char* szDumpFileName, DWORD SectionNumber);\r\n__declspec(dllexport) bool TITCALL ExtractSectionW(const wchar_t* szFileName, const wchar_t* szDumpFileName, DWORD SectionNumber);\r\n__declspec(dllexport) bool TITCALL ResortFileSections(const char* szFileName);\r\n__declspec(dllexport) bool TITCALL ResortFileSectionsW(const wchar_t* szFileName);\r\n__declspec(dllexport) bool TITCALL FindOverlay(const char* szFileName, LPDWORD OverlayStart, LPDWORD OverlaySize);\r\n__declspec(dllexport) bool TITCALL FindOverlayW(const wchar_t* szFileName, LPDWORD OverlayStart, LPDWORD OverlaySize);\r\n__declspec(dllexport) bool TITCALL ExtractOverlay(const char* szFileName, const char* szExtactedFileName);\r\n__declspec(dllexport) bool TITCALL ExtractOverlayW(const wchar_t* szFileName, const wchar_t* szExtactedFileName);\r\n__declspec(dllexport) bool TITCALL AddOverlay(const char* szFileName, const char* szOverlayFileName);\r\n__declspec(dllexport) bool TITCALL AddOverlayW(const wchar_t* szFileName, const wchar_t* szOverlayFileName);\r\n__declspec(dllexport) bool TITCALL CopyOverlay(const char* szInFileName, const char* szOutFileName);\r\n__declspec(dllexport) bool TITCALL CopyOverlayW(const wchar_t* szInFileName, const wchar_t* szOutFileName);\r\n__declspec(dllexport) bool TITCALL RemoveOverlay(const char* szFileName);\r\n__declspec(dllexport) bool TITCALL RemoveOverlayW(const wchar_t* szFileName);\r\n__declspec(dllexport) bool TITCALL MakeAllSectionsRWE(const char* szFileName);\r\n__declspec(dllexport) bool TITCALL MakeAllSectionsRWEW(const wchar_t* szFileName);\r\n__declspec(dllexport) long TITCALL AddNewSectionEx(const char* szFileName, const char* szSectionName, DWORD SectionSize, DWORD SectionAttributes, LPVOID SectionContent, DWORD ContentSize);\r\n__declspec(dllexport) long TITCALL AddNewSectionExW(const wchar_t* szFileName, const char* szSectionName, DWORD SectionSize, DWORD SectionAttributes, LPVOID SectionContent, DWORD ContentSize);\r\n__declspec(dllexport) long TITCALL AddNewSection(const char* szFileName, const char* szSectionName, DWORD SectionSize);\r\n__declspec(dllexport) long TITCALL AddNewSectionW(const wchar_t* szFileName, const char* szSectionName, DWORD SectionSize);\r\n__declspec(dllexport) bool TITCALL ResizeLastSection(const char* szFileName, DWORD NumberOfExpandBytes, bool AlignResizeData);\r\n__declspec(dllexport) bool TITCALL ResizeLastSectionW(const wchar_t* szFileName, DWORD NumberOfExpandBytes, bool AlignResizeData);\r\n__declspec(dllexport) void TITCALL SetSharedOverlay(const char* szFileName);\r\n__declspec(dllexport) void TITCALL SetSharedOverlayW(const wchar_t* szFileName);\r\n__declspec(dllexport) char* TITCALL GetSharedOverlay();\r\n__declspec(dllexport) wchar_t* TITCALL GetSharedOverlayW();\r\n__declspec(dllexport) bool TITCALL DeleteLastSection(const char* szFileName);\r\n__declspec(dllexport) bool TITCALL DeleteLastSectionW(const wchar_t* szFileName);\r\n__declspec(dllexport) bool TITCALL DeleteLastSectionEx(const char* szFileName, DWORD NumberOfSections);\r\n__declspec(dllexport) bool TITCALL DeleteLastSectionExW(const wchar_t* szFileName, DWORD NumberOfSections);\r\n__declspec(dllexport) ULONG_PTR TITCALL GetPE32DataFromMappedFile(ULONG_PTR FileMapVA, DWORD WhichSection, DWORD WhichData);\r\n__declspec(dllexport) ULONG_PTR TITCALL GetPE32Data(const char* szFileName, DWORD WhichSection, DWORD WhichData);\r\n__declspec(dllexport) ULONG_PTR TITCALL GetPE32DataW(const wchar_t* szFileName, DWORD WhichSection, DWORD WhichData);\r\n__declspec(dllexport) bool TITCALL GetPE32DataFromMappedFileEx(ULONG_PTR FileMapVA, LPVOID DataStorage);\r\n__declspec(dllexport) bool TITCALL GetPE32DataEx(const char* szFileName, LPVOID DataStorage);\r\n__declspec(dllexport) bool TITCALL GetPE32DataExW(const wchar_t* szFileName, LPVOID DataStorage);\r\n__declspec(dllexport) bool TITCALL SetPE32DataForMappedFile(ULONG_PTR FileMapVA, DWORD WhichSection, DWORD WhichData, ULONG_PTR NewDataValue);\r\n__declspec(dllexport) bool TITCALL SetPE32Data(const char* szFileName, DWORD WhichSection, DWORD WhichData, ULONG_PTR NewDataValue);\r\n__declspec(dllexport) bool TITCALL SetPE32DataW(const wchar_t* szFileName, DWORD WhichSection, DWORD WhichData, ULONG_PTR NewDataValue);\r\n__declspec(dllexport) bool TITCALL SetPE32DataForMappedFileEx(ULONG_PTR FileMapVA, LPVOID DataStorage);\r\n__declspec(dllexport) bool TITCALL SetPE32DataEx(const char* szFileName, LPVOID DataStorage);\r\n__declspec(dllexport) bool TITCALL SetPE32DataExW(const wchar_t* szFileName, LPVOID DataStorage);\r\n__declspec(dllexport) long TITCALL GetPE32SectionNumberFromVA(ULONG_PTR FileMapVA, ULONG_PTR AddressToConvert);\r\n__declspec(dllexport) ULONG_PTR TITCALL ConvertVAtoFileOffset(ULONG_PTR FileMapVA, ULONG_PTR AddressToConvert, bool ReturnType);\r\n__declspec(dllexport) ULONG_PTR TITCALL ConvertVAtoFileOffsetEx(ULONG_PTR FileMapVA, DWORD FileSize, ULONG_PTR ImageBase, ULONG_PTR AddressToConvert, bool AddressIsRVA, bool ReturnType);\r\n__declspec(dllexport) ULONG_PTR TITCALL ConvertFileOffsetToVA(ULONG_PTR FileMapVA, ULONG_PTR AddressToConvert, bool ReturnType);\r\n__declspec(dllexport) ULONG_PTR TITCALL ConvertFileOffsetToVAEx(ULONG_PTR FileMapVA, DWORD FileSize, ULONG_PTR ImageBase, ULONG_PTR AddressToConvert, bool ReturnType);\r\n__declspec(dllexport) bool TITCALL MemoryReadSafe(HANDLE hProcess, LPVOID lpBaseAddress, LPVOID lpBuffer, SIZE_T nSize, SIZE_T* lpNumberOfBytesRead);\r\n__declspec(dllexport) bool TITCALL MemoryWriteSafe(HANDLE hProcess, LPVOID lpBaseAddress, LPCVOID lpBuffer, SIZE_T nSize, SIZE_T* lpNumberOfBytesWritten);\r\n// TitanEngine.Realigner.functions:\r\n__declspec(dllexport) bool TITCALL FixHeaderCheckSum(const char* szFileName);\r\n__declspec(dllexport) bool TITCALL FixHeaderCheckSumW(const wchar_t* szFileName);\r\n__declspec(dllexport) long TITCALL RealignPE(ULONG_PTR FileMapVA, DWORD FileSize, DWORD RealingMode);\r\n__declspec(dllexport) long TITCALL RealignPEEx(const char* szFileName, DWORD RealingFileSize, DWORD ForcedFileAlignment);\r\n__declspec(dllexport) long TITCALL RealignPEExW(const wchar_t* szFileName, DWORD RealingFileSize, DWORD ForcedFileAlignment);\r\n__declspec(dllexport) bool TITCALL WipeSection(const char* szFileName, int WipeSectionNumber, bool RemovePhysically);\r\n__declspec(dllexport) bool TITCALL WipeSectionW(const wchar_t* szFileName, int WipeSectionNumber, bool RemovePhysically);\r\n__declspec(dllexport) bool TITCALL IsPE32FileValidEx(const char* szFileName, DWORD CheckDepth, LPVOID FileStatusInfo);\r\n__declspec(dllexport) bool TITCALL IsPE32FileValidExW(const wchar_t* szFileName, DWORD CheckDepth, LPVOID FileStatusInfo);\r\n__declspec(dllexport) bool TITCALL FixBrokenPE32FileEx(const char* szFileName, LPVOID FileStatusInfo, LPVOID FileFixInfo);\r\n__declspec(dllexport) bool TITCALL FixBrokenPE32FileExW(const wchar_t* szFileName, LPVOID FileStatusInfo, LPVOID FileFixInfo);\r\n__declspec(dllexport) bool TITCALL IsFileDLL(const char* szFileName, ULONG_PTR FileMapVA);\r\n__declspec(dllexport) bool TITCALL IsFileDLLW(const wchar_t* szFileName, ULONG_PTR FileMapVA);\r\n// TitanEngine.Hider.functions:\r\n__declspec(dllexport) void* TITCALL GetPEBLocation(HANDLE hProcess);\r\n__declspec(dllexport) void* TITCALL GetPEBLocation64(HANDLE hProcess);\r\n__declspec(dllexport) void* TITCALL GetTEBLocation(HANDLE hThread);\r\n__declspec(dllexport) void* TITCALL GetTEBLocation64(HANDLE hThread);\r\n__declspec(dllexport) bool TITCALL HideDebugger(HANDLE hProcess, DWORD PatchAPILevel);\r\n__declspec(dllexport) bool TITCALL UnHideDebugger(HANDLE hProcess, DWORD PatchAPILevel);\r\n// TitanEngine.Relocater.functions:\r\n__declspec(dllexport) void TITCALL RelocaterCleanup();\r\n__declspec(dllexport) void TITCALL RelocaterInit(DWORD MemorySize, ULONG_PTR OldImageBase, ULONG_PTR NewImageBase);\r\n__declspec(dllexport) void TITCALL RelocaterAddNewRelocation(HANDLE hProcess, ULONG_PTR RelocateAddress, DWORD RelocateState);\r\n__declspec(dllexport) long TITCALL RelocaterEstimatedSize();\r\n__declspec(dllexport) bool TITCALL RelocaterExportRelocation(ULONG_PTR StorePlace, DWORD StorePlaceRVA, ULONG_PTR FileMapVA);\r\n__declspec(dllexport) bool TITCALL RelocaterExportRelocationEx(const char* szFileName, const char* szSectionName);\r\n__declspec(dllexport) bool TITCALL RelocaterExportRelocationExW(const wchar_t* szFileName, const char* szSectionName);\r\n__declspec(dllexport) bool TITCALL RelocaterGrabRelocationTable(HANDLE hProcess, ULONG_PTR MemoryStart, DWORD MemorySize);\r\n__declspec(dllexport) bool TITCALL RelocaterGrabRelocationTableEx(HANDLE hProcess, ULONG_PTR MemoryStart, ULONG_PTR MemorySize, DWORD NtSizeOfImage);\r\n__declspec(dllexport) bool TITCALL RelocaterMakeSnapshot(HANDLE hProcess, const char* szSaveFileName, LPVOID MemoryStart, ULONG_PTR MemorySize);\r\n__declspec(dllexport) bool TITCALL RelocaterMakeSnapshotW(HANDLE hProcess, const wchar_t* szSaveFileName, LPVOID MemoryStart, ULONG_PTR MemorySize);\r\n__declspec(dllexport) bool TITCALL RelocaterCompareTwoSnapshots(HANDLE hProcess, ULONG_PTR LoadedImageBase, ULONG_PTR NtSizeOfImage, const char* szDumpFile1, const char* szDumpFile2, ULONG_PTR MemStart);\r\n__declspec(dllexport) bool TITCALL RelocaterCompareTwoSnapshotsW(HANDLE hProcess, ULONG_PTR LoadedImageBase, ULONG_PTR NtSizeOfImage, const wchar_t* szDumpFile1, const wchar_t* szDumpFile2, ULONG_PTR MemStart);\r\n__declspec(dllexport) bool TITCALL RelocaterChangeFileBase(const char* szFileName, ULONG_PTR NewImageBase);\r\n__declspec(dllexport) bool TITCALL RelocaterChangeFileBaseW(const wchar_t* szFileName, ULONG_PTR NewImageBase);\r\n__declspec(dllexport) bool TITCALL RelocaterRelocateMemoryBlock(ULONG_PTR FileMapVA, ULONG_PTR MemoryLocation, void* RelocateMemory, DWORD RelocateMemorySize, ULONG_PTR CurrentLoadedBase, ULONG_PTR RelocateBase);\r\n__declspec(dllexport) bool TITCALL RelocaterWipeRelocationTable(const char* szFileName);\r\n__declspec(dllexport) bool TITCALL RelocaterWipeRelocationTableW(const wchar_t* szFileName);\r\n// TitanEngine.Resourcer.functions:\r\n__declspec(dllexport) ULONG_PTR TITCALL ResourcerLoadFileForResourceUse(const char* szFileName);\r\n__declspec(dllexport) ULONG_PTR TITCALL ResourcerLoadFileForResourceUseW(const wchar_t* szFileName);\r\n__declspec(dllexport) bool TITCALL ResourcerFreeLoadedFile(LPVOID LoadedFileBase);\r\n__declspec(dllexport) bool TITCALL ResourcerExtractResourceFromFileEx(HMODULE hFile, const char* szResourceType, const char* szResourceName, const char* szExtractedFileName);\r\n__declspec(dllexport) bool TITCALL ResourcerExtractResourceFromFile(const char* szFileName, const char* szResourceType, const char* szResourceName, const char* szExtractedFileName);\r\n__declspec(dllexport) bool TITCALL ResourcerExtractResourceFromFileW(const wchar_t* szFileName, char* szResourceType, const char* szResourceName, const char* szExtractedFileName);\r\n__declspec(dllexport) bool TITCALL ResourcerFindResource(const char* szFileName, const char* szResourceType, DWORD ResourceType, const char* szResourceName, DWORD ResourceName, DWORD ResourceLanguage, PULONG_PTR pResourceData, LPDWORD pResourceSize);\r\n__declspec(dllexport) bool TITCALL ResourcerFindResourceW(const wchar_t* szFileName, const wchar_t* szResourceType, DWORD ResourceType, const wchar_t* szResourceName, DWORD ResourceName, DWORD ResourceLanguage, PULONG_PTR pResourceData, LPDWORD pResourceSize);\r\n__declspec(dllexport) bool TITCALL ResourcerFindResourceEx(ULONG_PTR FileMapVA, DWORD FileSize, const wchar_t* szResourceType, DWORD ResourceType, const wchar_t* szResourceName, DWORD ResourceName, DWORD ResourceLanguage, PULONG_PTR pResourceData, LPDWORD pResourceSize);\r\n__declspec(dllexport) void TITCALL ResourcerEnumerateResource(const char* szFileName, void* CallBack);\r\n__declspec(dllexport) void TITCALL ResourcerEnumerateResourceW(const wchar_t* szFileName, void* CallBack);\r\n__declspec(dllexport) void TITCALL ResourcerEnumerateResourceEx(ULONG_PTR FileMapVA, DWORD FileSize, void* CallBack);\r\n// TitanEngine.Threader.functions:\r\n__declspec(dllexport) bool TITCALL ThreaderImportRunningThreadData(DWORD ProcessId);\r\n__declspec(dllexport) void* TITCALL ThreaderGetThreadInfo(HANDLE hThread, DWORD ThreadId);\r\n__declspec(dllexport) void TITCALL ThreaderEnumThreadInfo(void* EnumCallBack);\r\n__declspec(dllexport) bool TITCALL ThreaderPauseThread(HANDLE hThread);\r\n__declspec(dllexport) bool TITCALL ThreaderResumeThread(HANDLE hThread);\r\n__declspec(dllexport) bool TITCALL ThreaderTerminateThread(HANDLE hThread, DWORD ThreadExitCode);\r\n__declspec(dllexport) bool TITCALL ThreaderPauseAllThreads(bool LeaveMainRunning);\r\n__declspec(dllexport) bool TITCALL ThreaderResumeAllThreads(bool LeaveMainPaused);\r\n__declspec(dllexport) bool TITCALL ThreaderPauseProcess();\r\n__declspec(dllexport) bool TITCALL ThreaderResumeProcess();\r\n__declspec(dllexport) ULONG_PTR TITCALL ThreaderCreateRemoteThread(ULONG_PTR ThreadStartAddress, bool AutoCloseTheHandle, LPVOID ThreadPassParameter, LPDWORD ThreadId);\r\n__declspec(dllexport) bool TITCALL ThreaderInjectAndExecuteCode(LPVOID InjectCode, DWORD StartDelta, DWORD InjectSize);\r\n__declspec(dllexport) ULONG_PTR TITCALL ThreaderCreateRemoteThreadEx(HANDLE hProcess, ULONG_PTR ThreadStartAddress, bool AutoCloseTheHandle, LPVOID ThreadPassParameter, LPDWORD ThreadId);\r\n__declspec(dllexport) bool TITCALL ThreaderInjectAndExecuteCodeEx(HANDLE hProcess, LPVOID InjectCode, DWORD StartDelta, DWORD InjectSize);\r\n__declspec(dllexport) void TITCALL ThreaderSetCallBackForNextExitThreadEvent(LPVOID exitThreadCallBack);\r\n__declspec(dllexport) bool TITCALL ThreaderIsThreadStillRunning(HANDLE hThread);\r\n__declspec(dllexport) bool TITCALL ThreaderIsThreadActive(HANDLE hThread);\r\n__declspec(dllexport) bool TITCALL ThreaderIsAnyThreadActive();\r\n__declspec(dllexport) bool TITCALL ThreaderExecuteOnlyInjectedThreads();\r\n__declspec(dllexport) ULONG_PTR TITCALL ThreaderGetOpenHandleForThread(DWORD ThreadId);\r\n__declspec(dllexport) bool TITCALL ThreaderIsExceptionInMainThread();\r\n// TitanEngine.Debugger.functions:\r\n__declspec(dllexport) void* TITCALL StaticDisassembleEx(ULONG_PTR DisassmStart, LPVOID DisassmAddress);\r\n__declspec(dllexport) void* TITCALL StaticDisassemble(LPVOID DisassmAddress);\r\n__declspec(dllexport) void* TITCALL DisassembleEx(HANDLE hProcess, LPVOID DisassmAddress, bool ReturnInstructionType);\r\n__declspec(dllexport) void* TITCALL Disassemble(LPVOID DisassmAddress);\r\n__declspec(dllexport) long TITCALL StaticLengthDisassemble(LPVOID DisassmAddress);\r\n__declspec(dllexport) long TITCALL LengthDisassembleEx(HANDLE hProcess, LPVOID DisassmAddress);\r\n__declspec(dllexport) long TITCALL LengthDisassemble(LPVOID DisassmAddress);\r\n__declspec(dllexport) void* TITCALL InitDebug(char* szFileName, char* szCommandLine, char* szCurrentFolder);\r\n__declspec(dllexport) void* TITCALL InitDebugW(const wchar_t* szFileName, const wchar_t* szCommandLine, const wchar_t* szCurrentFolder);\r\n__declspec(dllexport) void* TITCALL InitDebugEx(const char* szFileName, const char* szCommandLine, const char* szCurrentFolder, LPVOID EntryCallBack);\r\n__declspec(dllexport) void* TITCALL InitDebugExW(const wchar_t* szFileName, const wchar_t* szCommandLine, const wchar_t* szCurrentFolder, LPVOID EntryCallBack);\r\n__declspec(dllexport) void* TITCALL InitDLLDebug(const char* szFileName, bool ReserveModuleBase, const char* szCommandLine, const char* szCurrentFolder, LPVOID EntryCallBack);\r\n__declspec(dllexport) void* TITCALL InitDLLDebugW(const wchar_t* szFileName, bool ReserveModuleBase, const wchar_t* szCommandLine, const wchar_t* szCurrentFolder, LPVOID EntryCallBack);\r\n__declspec(dllexport) bool TITCALL StopDebug();\r\n__declspec(dllexport) void TITCALL SetBPXOptions(long DefaultBreakPointType);\r\n__declspec(dllexport) bool TITCALL IsBPXEnabled(ULONG_PTR bpxAddress);\r\n__declspec(dllexport) bool TITCALL EnableBPX(ULONG_PTR bpxAddress);\r\n__declspec(dllexport) bool TITCALL DisableBPX(ULONG_PTR bpxAddress);\r\n__declspec(dllexport) bool TITCALL SetBPX(ULONG_PTR bpxAddress, DWORD bpxType, LPVOID bpxCallBack);\r\n__declspec(dllexport) bool TITCALL DeleteBPX(ULONG_PTR bpxAddress);\r\n__declspec(dllexport) bool TITCALL SafeDeleteBPX(ULONG_PTR bpxAddress);\r\n__declspec(dllexport) bool TITCALL SetAPIBreakPoint(const char* szDLLName, const char* szAPIName, DWORD bpxType, DWORD bpxPlace, LPVOID bpxCallBack);\r\n__declspec(dllexport) bool TITCALL DeleteAPIBreakPoint(const char* szDLLName, const char* szAPIName, DWORD bpxPlace);\r\n__declspec(dllexport) bool TITCALL SafeDeleteAPIBreakPoint(const char* szDLLName, const char* szAPIName, DWORD bpxPlace);\r\n__declspec(dllexport) bool TITCALL SetMemoryBPX(ULONG_PTR MemoryStart, SIZE_T SizeOfMemory, LPVOID bpxCallBack);\r\n__declspec(dllexport) bool TITCALL SetMemoryBPXEx(ULONG_PTR MemoryStart, SIZE_T SizeOfMemory, DWORD BreakPointType, bool RestoreOnHit, LPVOID bpxCallBack);\r\n__declspec(dllexport) bool TITCALL RemoveMemoryBPX(ULONG_PTR MemoryStart, SIZE_T SizeOfMemory);\r\n__declspec(dllexport) bool TITCALL GetContextFPUDataEx(HANDLE hActiveThread, void* FPUSaveArea);\r\n__declspec(dllexport) void TITCALL Getx87FPURegisters(x87FPURegister_t x87FPURegisters[8], TITAN_ENGINE_CONTEXT_t* titcontext);\r\n__declspec(dllexport) void TITCALL GetMMXRegisters(uint64_t mmx[8], TITAN_ENGINE_CONTEXT_t* titcontext);\r\n__declspec(dllexport) bool TITCALL GetFullContextDataEx(HANDLE hActiveThread, TITAN_ENGINE_CONTEXT_t* titcontext);\r\n__declspec(dllexport) bool TITCALL SetFullContextDataEx(HANDLE hActiveThread, TITAN_ENGINE_CONTEXT_t* titcontext);\r\n__declspec(dllexport) ULONG_PTR TITCALL GetContextDataEx(HANDLE hActiveThread, DWORD IndexOfRegister);\r\n__declspec(dllexport) ULONG_PTR TITCALL GetContextData(DWORD IndexOfRegister);\r\n__declspec(dllexport) bool TITCALL SetContextFPUDataEx(HANDLE hActiveThread, void* FPUSaveArea);\r\n__declspec(dllexport) bool TITCALL SetContextDataEx(HANDLE hActiveThread, DWORD IndexOfRegister, ULONG_PTR NewRegisterValue);\r\n__declspec(dllexport) bool TITCALL SetContextData(DWORD IndexOfRegister, ULONG_PTR NewRegisterValue);\r\n__declspec(dllexport) bool TITCALL GetAVXContext(HANDLE hActiveThread, TITAN_ENGINE_CONTEXT_t* titcontext);\r\n__declspec(dllexport) bool TITCALL SetAVXContext(HANDLE hActiveThread, TITAN_ENGINE_CONTEXT_t* titcontext);\r\n__declspec(dllexport) void TITCALL ClearExceptionNumber();\r\n__declspec(dllexport) long TITCALL CurrentExceptionNumber();\r\n__declspec(dllexport) bool TITCALL MatchPatternEx(HANDLE hProcess, void* MemoryToCheck, int SizeOfMemoryToCheck, void* PatternToMatch, int SizeOfPatternToMatch, PBYTE WildCard);\r\n__declspec(dllexport) bool TITCALL MatchPattern(void* MemoryToCheck, int SizeOfMemoryToCheck, void* PatternToMatch, int SizeOfPatternToMatch, PBYTE WildCard);\r\n__declspec(dllexport) ULONG_PTR TITCALL FindEx(HANDLE hProcess, LPVOID MemoryStart, DWORD MemorySize, LPVOID SearchPattern, DWORD PatternSize, LPBYTE WildCard);\r\nextern \"C\" __declspec(dllexport) ULONG_PTR TITCALL Find(LPVOID MemoryStart, DWORD MemorySize, LPVOID SearchPattern, DWORD PatternSize, LPBYTE WildCard);\r\n__declspec(dllexport) bool TITCALL FillEx(HANDLE hProcess, LPVOID MemoryStart, DWORD MemorySize, PBYTE FillByte);\r\n__declspec(dllexport) bool TITCALL Fill(LPVOID MemoryStart, DWORD MemorySize, PBYTE FillByte);\r\n__declspec(dllexport) bool TITCALL PatchEx(HANDLE hProcess, LPVOID MemoryStart, DWORD MemorySize, LPVOID ReplacePattern, DWORD ReplaceSize, bool AppendNOP, bool PrependNOP);\r\n__declspec(dllexport) bool TITCALL Patch(LPVOID MemoryStart, DWORD MemorySize, LPVOID ReplacePattern, DWORD ReplaceSize, bool AppendNOP, bool PrependNOP);\r\n__declspec(dllexport) bool TITCALL ReplaceEx(HANDLE hProcess, LPVOID MemoryStart, DWORD MemorySize, LPVOID SearchPattern, DWORD PatternSize, DWORD NumberOfRepetitions, LPVOID ReplacePattern, DWORD ReplaceSize, PBYTE WildCard);\r\n__declspec(dllexport) bool TITCALL Replace(LPVOID MemoryStart, DWORD MemorySize, LPVOID SearchPattern, DWORD PatternSize, DWORD NumberOfRepetitions, LPVOID ReplacePattern, DWORD ReplaceSize, PBYTE WildCard);\r\n__declspec(dllexport) void* TITCALL GetDebugData();\r\n__declspec(dllexport) void* TITCALL GetTerminationData();\r\n__declspec(dllexport) long TITCALL GetExitCode();\r\n__declspec(dllexport) ULONG_PTR TITCALL GetDebuggedDLLBaseAddress();\r\n__declspec(dllexport) ULONG_PTR TITCALL GetDebuggedFileBaseAddress();\r\n__declspec(dllexport) bool TITCALL GetRemoteString(HANDLE hProcess, LPVOID StringAddress, LPVOID StringStorage, int MaximumStringSize);\r\n__declspec(dllexport) ULONG_PTR TITCALL GetFunctionParameter(HANDLE hProcess, DWORD FunctionType, DWORD ParameterNumber, DWORD ParameterType);\r\n__declspec(dllexport) ULONG_PTR TITCALL GetJumpDestinationEx(HANDLE hProcess, ULONG_PTR InstructionAddress, bool JustJumps);\r\n__declspec(dllexport) ULONG_PTR TITCALL GetJumpDestination(HANDLE hProcess, ULONG_PTR InstructionAddress);\r\n__declspec(dllexport) bool TITCALL IsJumpGoingToExecuteEx(HANDLE hProcess, HANDLE hThread, ULONG_PTR InstructionAddress, ULONG_PTR RegFlags);\r\n__declspec(dllexport) bool TITCALL IsJumpGoingToExecute();\r\n__declspec(dllexport) void TITCALL SetCustomHandler(DWORD ExceptionId, LPVOID CallBack);\r\n__declspec(dllexport) void TITCALL ForceClose();\r\n__declspec(dllexport) void TITCALL StepInto(LPVOID traceCallBack);\r\n__declspec(dllexport) void TITCALL StepOver(LPVOID traceCallBack);\r\n__declspec(dllexport) void TITCALL StepOut(LPVOID StepOut, bool StepFinal);\r\n__declspec(dllexport) void TITCALL SingleStep(DWORD StepCount, LPVOID StepCallBack);\r\n__declspec(dllexport) bool TITCALL GetUnusedHardwareBreakPointRegister(LPDWORD RegisterIndex);\r\n__declspec(dllexport) bool TITCALL SetHardwareBreakPointEx(HANDLE hActiveThread, ULONG_PTR bpxAddress, DWORD IndexOfRegister, DWORD bpxType, DWORD bpxSize, LPVOID bpxCallBack, LPDWORD IndexOfSelectedRegister);\r\n__declspec(dllexport) bool TITCALL SetHardwareBreakPoint(ULONG_PTR bpxAddress, DWORD IndexOfRegister, DWORD bpxType, DWORD bpxSize, LPVOID bpxCallBack);\r\n__declspec(dllexport) bool TITCALL DeleteHardwareBreakPoint(DWORD IndexOfRegister);\r\n__declspec(dllexport) bool TITCALL RemoveAllBreakPoints(DWORD RemoveOption);\r\n__declspec(dllexport) PROCESS_INFORMATION* TITCALL TitanGetProcessInformation();\r\n__declspec(dllexport) STARTUPINFOW* TITCALL TitanGetStartupInformation();\r\n__declspec(dllexport) void TITCALL DebugLoop();\r\n__declspec(dllexport) void TITCALL SetDebugLoopTimeOut(DWORD TimeOut);\r\n__declspec(dllexport) void TITCALL SetNextDbgContinueStatus(DWORD SetDbgCode);\r\n__declspec(dllexport) bool TITCALL AttachDebugger(DWORD ProcessId, bool KillOnExit, LPVOID DebugInfo, LPVOID CallBack);\r\n__declspec(dllexport) bool TITCALL DetachDebugger(DWORD ProcessId);\r\n__declspec(dllexport) bool TITCALL DetachDebuggerEx(DWORD ProcessId);\r\n__declspec(dllexport) void TITCALL DebugLoopEx(DWORD TimeOut);\r\n__declspec(dllexport) void TITCALL AutoDebugEx(const char* szFileName, bool ReserveModuleBase, const char* szCommandLine, const char* szCurrentFolder, DWORD TimeOut, LPVOID EntryCallBack);\r\n__declspec(dllexport) void TITCALL AutoDebugExW(const wchar_t* szFileName, bool ReserveModuleBase, const wchar_t* szCommandLine, const wchar_t* szCurrentFolder, DWORD TimeOut, LPVOID EntryCallBack);\r\n__declspec(dllexport) bool TITCALL IsFileBeingDebugged();\r\n__declspec(dllexport) void TITCALL SetErrorModel(bool DisplayErrorMessages);\r\n// TitanEngine.FindOEP.functions:\r\n__declspec(dllexport) void TITCALL FindOEPInit();\r\n__declspec(dllexport) bool TITCALL FindOEPGenerically(const char* szFileName, LPVOID TraceInitCallBack, LPVOID CallBack);\r\n__declspec(dllexport) bool TITCALL FindOEPGenericallyW(const wchar_t* szFileName, LPVOID TraceInitCallBack, LPVOID CallBack);\r\n// TitanEngine.Importer.functions:\r\n__declspec(dllexport) void TITCALL ImporterAddNewDll(const char* szDLLName, ULONG_PTR FirstThunk);\r\n__declspec(dllexport) void TITCALL ImporterAddNewAPI(const char* szAPIName, ULONG_PTR ThunkValue);\r\n__declspec(dllexport) void TITCALL ImporterAddNewOrdinalAPI(ULONG_PTR OrdinalNumber, ULONG_PTR ThunkValue);\r\n__declspec(dllexport) long TITCALL ImporterGetAddedDllCount();\r\n__declspec(dllexport) long TITCALL ImporterGetAddedAPICount();\r\n__declspec(dllexport) bool TITCALL ImporterExportIAT(ULONG_PTR StorePlace, ULONG_PTR FileMapVA, HANDLE hFileMap);\r\n__declspec(dllexport) long TITCALL ImporterEstimatedSize();\r\n__declspec(dllexport) bool TITCALL ImporterExportIATEx(const char* szDumpFileName, const char* szExportFileName, const char* szSectionName);\r\n__declspec(dllexport) bool TITCALL ImporterExportIATExW(const wchar_t* szDumpFileName, const wchar_t* szExportFileName, const wchar_t* szSectionName = L\".RL!TEv2\");\r\n__declspec(dllexport) ULONG_PTR TITCALL ImporterFindAPIWriteLocation(const char* szAPIName);\r\n__declspec(dllexport) ULONG_PTR TITCALL ImporterFindOrdinalAPIWriteLocation(ULONG_PTR OrdinalNumber);\r\n__declspec(dllexport) ULONG_PTR TITCALL ImporterFindAPIByWriteLocation(ULONG_PTR APIWriteLocation);\r\n__declspec(dllexport) ULONG_PTR TITCALL ImporterFindDLLByWriteLocation(ULONG_PTR APIWriteLocation);\r\n__declspec(dllexport) void* TITCALL ImporterGetDLLName(ULONG_PTR APIAddress);\r\n__declspec(dllexport) void* TITCALL ImporterGetDLLNameW(ULONG_PTR APIAddress);\r\n__declspec(dllexport) void* TITCALL ImporterGetAPIName(ULONG_PTR APIAddress);\r\n__declspec(dllexport) ULONG_PTR TITCALL ImporterGetAPIOrdinalNumber(ULONG_PTR APIAddress);\r\n__declspec(dllexport) void* TITCALL ImporterGetAPINameEx(ULONG_PTR APIAddress, ULONG_PTR DLLBasesList);\r\n__declspec(dllexport) ULONG_PTR TITCALL ImporterGetRemoteAPIAddress(HANDLE hProcess, ULONG_PTR APIAddress);\r\n__declspec(dllexport) ULONG_PTR TITCALL ImporterGetRemoteAPIAddressEx(const char* szDLLName, const char* szAPIName);\r\n__declspec(dllexport) ULONG_PTR TITCALL ImporterGetLocalAPIAddress(HANDLE hProcess, ULONG_PTR APIAddress);\r\n__declspec(dllexport) void* TITCALL ImporterGetDLLNameFromDebugee(HANDLE hProcess, ULONG_PTR APIAddress);\r\n__declspec(dllexport) void* TITCALL ImporterGetDLLNameFromDebugeeW(HANDLE hProcess, ULONG_PTR APIAddress);\r\n__declspec(dllexport) void* TITCALL ImporterGetAPINameFromDebugee(HANDLE hProcess, ULONG_PTR APIAddress);\r\n__declspec(dllexport) ULONG_PTR TITCALL ImporterGetAPIOrdinalNumberFromDebugee(HANDLE hProcess, ULONG_PTR APIAddress);\r\n__declspec(dllexport) long TITCALL ImporterGetDLLIndexEx(ULONG_PTR APIAddress, ULONG_PTR DLLBasesList);\r\n__declspec(dllexport) long TITCALL ImporterGetDLLIndex(HANDLE hProcess, ULONG_PTR APIAddress, ULONG_PTR DLLBasesList);\r\n__declspec(dllexport) ULONG_PTR TITCALL ImporterGetRemoteDLLBase(HANDLE hProcess, HMODULE LocalModuleBase);\r\n__declspec(dllexport) ULONG_PTR TITCALL ImporterGetRemoteDLLBaseEx(HANDLE hProcess, const char* szModuleName);\r\n__declspec(dllexport) void* TITCALL ImporterGetRemoteDLLBaseExW(HANDLE hProcess, const wchar_t* szModuleName);\r\n__declspec(dllexport) bool TITCALL ImporterIsForwardedAPI(HANDLE hProcess, ULONG_PTR APIAddress);\r\n__declspec(dllexport) void* TITCALL ImporterGetForwardedAPIName(HANDLE hProcess, ULONG_PTR APIAddress);\r\n__declspec(dllexport) void* TITCALL ImporterGetForwardedDLLName(HANDLE hProcess, ULONG_PTR APIAddress);\r\n__declspec(dllexport) long TITCALL ImporterGetForwardedDLLIndex(HANDLE hProcess, ULONG_PTR APIAddress, ULONG_PTR DLLBasesList);\r\n__declspec(dllexport) ULONG_PTR TITCALL ImporterGetForwardedAPIOrdinalNumber(HANDLE hProcess, ULONG_PTR APIAddress);\r\n__declspec(dllexport) ULONG_PTR TITCALL ImporterGetNearestAPIAddress(HANDLE hProcess, ULONG_PTR APIAddress);\r\n__declspec(dllexport) void* TITCALL ImporterGetNearestAPIName(HANDLE hProcess, ULONG_PTR APIAddress);\r\n__declspec(dllexport) bool TITCALL ImporterCopyOriginalIAT(const char* szOriginalFile, const char* szDumpFile);\r\n__declspec(dllexport) bool TITCALL ImporterCopyOriginalIATW(const wchar_t* szOriginalFile, const wchar_t* szDumpFile);\r\n__declspec(dllexport) bool TITCALL ImporterLoadImportTable(const char* szFileName);\r\n__declspec(dllexport) bool TITCALL ImporterLoadImportTableW(const wchar_t* szFileName);\r\n__declspec(dllexport) bool TITCALL ImporterMoveOriginalIAT(const char* szOriginalFile, const char* szDumpFile, const char* szSectionName);\r\n__declspec(dllexport) bool TITCALL ImporterMoveOriginalIATW(const wchar_t* szOriginalFile, const wchar_t* szDumpFile, const char* szSectionName);\r\n__declspec(dllexport) void TITCALL ImporterAutoSearchIAT(DWORD ProcessId, const char* szFileName, ULONG_PTR SearchStart, LPVOID pIATStart, LPVOID pIATSize);\r\n__declspec(dllexport) void TITCALL ImporterAutoSearchIATW(DWORD ProcessIds, const wchar_t* szFileName, ULONG_PTR SearchStart, LPVOID pIATStart, LPVOID pIATSize);\r\n__declspec(dllexport) void TITCALL ImporterAutoSearchIATEx(DWORD ProcessId, ULONG_PTR ImageBase, ULONG_PTR SearchStart, LPVOID pIATStart, LPVOID pIATSize);\r\n__declspec(dllexport) void TITCALL ImporterEnumAddedData(LPVOID EnumCallBack);\r\n__declspec(dllexport) long TITCALL ImporterAutoFixIATEx(DWORD ProcessId, const char* szDumpedFile, const char* szSectionName, bool DumpRunningProcess, bool RealignFile, ULONG_PTR EntryPointAddress, ULONG_PTR ImageBase, ULONG_PTR SearchStart, bool TryAutoFix, bool FixEliminations, LPVOID UnknownPointerFixCallback);\r\n__declspec(dllexport) long TITCALL ImporterAutoFixIATExW(DWORD ProcessId, const wchar_t* szDumpedFile, const wchar_t* szSectionName, bool DumpRunningProcess, bool RealignFile, ULONG_PTR EntryPointAddress, ULONG_PTR ImageBase, ULONG_PTR SearchStart, bool TryAutoFix, bool FixEliminations, LPVOID UnknownPointerFixCallback);\r\n__declspec(dllexport) long TITCALL ImporterAutoFixIAT(DWORD ProcessId, const char* szDumpedFile, ULONG_PTR SearchStart);\r\n__declspec(dllexport) long TITCALL ImporterAutoFixIATW(DWORD ProcessId, const wchar_t* szDumpedFile, ULONG_PTR SearchStart);\r\n__declspec(dllexport) bool TITCALL ImporterDeleteAPI(DWORD_PTR apiAddr);\r\n// Global.Engine.Hook.functions:\r\n__declspec(dllexport) bool TITCALL HooksSafeTransitionEx(LPVOID HookAddressArray, int NumberOfHooks, bool TransitionStart);\r\n__declspec(dllexport) bool TITCALL HooksSafeTransition(LPVOID HookAddress, bool TransitionStart);\r\n__declspec(dllexport) bool TITCALL HooksIsAddressRedirected(LPVOID HookAddress);\r\n__declspec(dllexport) void* TITCALL HooksGetTrampolineAddress(LPVOID HookAddress);\r\n__declspec(dllexport) void* TITCALL HooksGetHookEntryDetails(LPVOID HookAddress);\r\n__declspec(dllexport) bool TITCALL HooksInsertNewRedirection(LPVOID HookAddress, LPVOID RedirectTo, int HookType);\r\n__declspec(dllexport) bool TITCALL HooksInsertNewIATRedirectionEx(ULONG_PTR FileMapVA, ULONG_PTR LoadedModuleBase, const char* szHookFunction, LPVOID RedirectTo);\r\n__declspec(dllexport) bool TITCALL HooksInsertNewIATRedirection(const char* szModuleName, const char* szHookFunction, LPVOID RedirectTo);\r\n__declspec(dllexport) bool TITCALL HooksRemoveRedirection(LPVOID HookAddress, bool RemoveAll);\r\n__declspec(dllexport) bool TITCALL HooksRemoveRedirectionsForModule(HMODULE ModuleBase);\r\n__declspec(dllexport) bool TITCALL HooksRemoveIATRedirection(const char* szModuleName, const char* szHookFunction, bool RemoveAll);\r\n__declspec(dllexport) bool TITCALL HooksDisableRedirection(LPVOID HookAddress, bool DisableAll);\r\n__declspec(dllexport) bool TITCALL HooksDisableRedirectionsForModule(HMODULE ModuleBase);\r\n__declspec(dllexport) bool TITCALL HooksDisableIATRedirection(const char* szModuleName, const char* szHookFunction, bool DisableAll);\r\n__declspec(dllexport) bool TITCALL HooksEnableRedirection(LPVOID HookAddress, bool EnableAll);\r\n__declspec(dllexport) bool TITCALL HooksEnableRedirectionsForModule(HMODULE ModuleBase);\r\n__declspec(dllexport) bool TITCALL HooksEnableIATRedirection(const char* szModuleName, const char* szHookFunction, bool EnableAll);\r\n__declspec(dllexport) void TITCALL HooksScanModuleMemory(HMODULE ModuleBase, LPVOID CallBack);\r\n__declspec(dllexport) void TITCALL HooksScanEntireProcessMemory(LPVOID CallBack);\r\n__declspec(dllexport) void TITCALL HooksScanEntireProcessMemoryEx();\r\n// TitanEngine.Tracer.functions:\r\n__declspec(dllexport) void TITCALL TracerInit();\r\n__declspec(dllexport) ULONG_PTR TITCALL TracerLevel1(HANDLE hProcess, ULONG_PTR AddressToTrace);\r\n__declspec(dllexport) ULONG_PTR TITCALL HashTracerLevel1(HANDLE hProcess, ULONG_PTR AddressToTrace, DWORD InputNumberOfInstructions);\r\n__declspec(dllexport) long TITCALL TracerDetectRedirection(HANDLE hProcess, ULONG_PTR AddressToTrace);\r\n__declspec(dllexport) ULONG_PTR TITCALL TracerFixKnownRedirection(HANDLE hProcess, ULONG_PTR AddressToTrace, DWORD RedirectionId);\r\n__declspec(dllexport) ULONG_PTR TITCALL TracerFixRedirectionViaModule(HMODULE hModuleHandle, HANDLE hProcess, ULONG_PTR AddressToTrace, DWORD IdParameter);\r\n__declspec(dllexport) long TITCALL TracerFixRedirectionViaImpRecPlugin(HANDLE hProcess, const char* szPluginName, ULONG_PTR AddressToTrace);\r\n// TitanEngine.Exporter.functions:\r\n__declspec(dllexport) void TITCALL ExporterCleanup();\r\n__declspec(dllexport) void TITCALL ExporterSetImageBase(ULONG_PTR ImageBase);\r\n__declspec(dllexport) void TITCALL ExporterInit(DWORD MemorySize, ULONG_PTR ImageBase, DWORD ExportOrdinalBase, const char* szExportModuleName);\r\n__declspec(dllexport) bool TITCALL ExporterAddNewExport(const char* szExportName, DWORD ExportRelativeAddress);\r\n__declspec(dllexport) bool TITCALL ExporterAddNewOrdinalExport(DWORD OrdinalNumber, DWORD ExportRelativeAddress);\r\n__declspec(dllexport) long TITCALL ExporterGetAddedExportCount();\r\n__declspec(dllexport) long TITCALL ExporterEstimatedSize();\r\n__declspec(dllexport) bool TITCALL ExporterBuildExportTable(ULONG_PTR StorePlace, ULONG_PTR FileMapVA);\r\n__declspec(dllexport) bool TITCALL ExporterBuildExportTableEx(const char* szExportFileName, const char* szSectionName);\r\n__declspec(dllexport) bool TITCALL ExporterBuildExportTableExW(const wchar_t* szExportFileName, const char* szSectionName);\r\n__declspec(dllexport) bool TITCALL ExporterLoadExportTable(const char* szFileName);\r\n__declspec(dllexport) bool TITCALL ExporterLoadExportTableW(const wchar_t* szFileName);\r\n// TitanEngine.Librarian.functions:\r\n__declspec(dllexport) bool TITCALL LibrarianSetBreakPoint(const char* szLibraryName, DWORD bpxType, bool SingleShoot, LPVOID bpxCallBack);\r\n__declspec(dllexport) bool TITCALL LibrarianRemoveBreakPoint(const char* szLibraryName, DWORD bpxType);\r\n__declspec(dllexport) void* TITCALL LibrarianGetLibraryInfo(const char* szLibraryName);\r\n__declspec(dllexport) void* TITCALL LibrarianGetLibraryInfoW(const wchar_t* szLibraryName);\r\n__declspec(dllexport) void* TITCALL LibrarianGetLibraryInfoEx(void* BaseOfDll);\r\n__declspec(dllexport) void* TITCALL LibrarianGetLibraryInfoExW(void* BaseOfDll);\r\n__declspec(dllexport) void TITCALL LibrarianEnumLibraryInfo(void* EnumCallBack);\r\n__declspec(dllexport) void TITCALL LibrarianEnumLibraryInfoW(void* EnumCallBack);\r\n// TitanEngine.Process.functions:\r\n__declspec(dllexport) long TITCALL GetActiveProcessId(const char* szImageName);\r\n__declspec(dllexport) long TITCALL GetActiveProcessIdW(const wchar_t* szImageName);\r\n__declspec(dllexport) void TITCALL EnumProcessesWithLibrary(const char* szLibraryName, void* EnumFunction);\r\n__declspec(dllexport) HANDLE TITCALL TitanOpenProcess(DWORD dwDesiredAccess, bool bInheritHandle, DWORD dwProcessId);\r\n__declspec(dllexport) HANDLE TITCALL TitanOpenThread(DWORD dwDesiredAccess, bool bInheritHandle, DWORD dwThreadId);\r\n// TitanEngine.TLSFixer.functions:\r\n__declspec(dllexport) bool TITCALL TLSBreakOnCallBack(LPVOID ArrayOfCallBacks, DWORD NumberOfCallBacks, LPVOID bpxCallBack);\r\n__declspec(dllexport) bool TITCALL TLSGrabCallBackData(const char* szFileName, LPVOID ArrayOfCallBacks, LPDWORD NumberOfCallBacks);\r\n__declspec(dllexport) bool TITCALL TLSGrabCallBackDataW(const wchar_t* szFileName, LPVOID ArrayOfCallBacks, LPDWORD NumberOfCallBacks);\r\n__declspec(dllexport) bool TITCALL TLSBreakOnCallBackEx(const char* szFileName, LPVOID bpxCallBack);\r\n__declspec(dllexport) bool TITCALL TLSBreakOnCallBackExW(const wchar_t* szFileName, LPVOID bpxCallBack);\r\n__declspec(dllexport) bool TITCALL TLSRemoveCallback(const char* szFileName);\r\n__declspec(dllexport) bool TITCALL TLSRemoveCallbackW(const wchar_t* szFileName);\r\n__declspec(dllexport) bool TITCALL TLSRemoveTable(const char* szFileName);\r\n__declspec(dllexport) bool TITCALL TLSRemoveTableW(const wchar_t* szFileName);\r\n__declspec(dllexport) bool TITCALL TLSBackupData(const char* szFileName);\r\n__declspec(dllexport) bool TITCALL TLSBackupDataW(const wchar_t* szFileName);\r\n__declspec(dllexport) bool TITCALL TLSRestoreData();\r\n__declspec(dllexport) bool TITCALL TLSBuildNewTable(ULONG_PTR FileMapVA, ULONG_PTR StorePlace, ULONG_PTR StorePlaceRVA, LPVOID ArrayOfCallBacks, DWORD NumberOfCallBacks);\r\n__declspec(dllexport) bool TITCALL TLSBuildNewTableEx(const char* szFileName, const char* szSectionName, LPVOID ArrayOfCallBacks, DWORD NumberOfCallBacks);\r\n__declspec(dllexport) bool TITCALL TLSBuildNewTableExW(const wchar_t* szFileName, const char* szSectionName, LPVOID ArrayOfCallBacks, DWORD NumberOfCallBacks);\r\n// TitanEngine.TranslateName.functions:\r\n__declspec(dllexport) void* TITCALL TranslateNativeName(const char* szNativeName);\r\n__declspec(dllexport) void* TITCALL TranslateNativeNameW(const wchar_t* szNativeName);\r\n// TitanEngine.Handler.functions:\r\n__declspec(dllexport) long TITCALL HandlerGetActiveHandleCount(DWORD ProcessId);\r\n__declspec(dllexport) bool TITCALL HandlerIsHandleOpen(DWORD ProcessId, HANDLE hHandle);\r\n__declspec(dllexport) void* TITCALL HandlerGetHandleName(HANDLE hProcess, DWORD ProcessId, HANDLE hHandle, bool TranslateName);\r\n__declspec(dllexport) void* TITCALL HandlerGetHandleNameW(HANDLE hProcess, DWORD ProcessId, HANDLE hHandle, bool TranslateName);\r\n__declspec(dllexport) long TITCALL HandlerEnumerateOpenHandles(DWORD ProcessId, LPVOID HandleBuffer, DWORD MaxHandleCount);\r\n__declspec(dllexport) ULONG_PTR TITCALL HandlerGetHandleDetails(HANDLE hProcess, DWORD ProcessId, HANDLE hHandle, DWORD InformationReturn);\r\n__declspec(dllexport) bool TITCALL HandlerCloseRemoteHandle(HANDLE hProcess, HANDLE hHandle);\r\n__declspec(dllexport) long TITCALL HandlerEnumerateLockHandles(char* szFileOrFolderName, bool NameIsFolder, bool NameIsTranslated, LPVOID HandleDataBuffer, DWORD MaxHandleCount);\r\n__declspec(dllexport) long TITCALL HandlerEnumerateLockHandlesW(const wchar_t* szFileOrFolderName, bool NameIsFolder, bool NameIsTranslated, LPVOID HandleDataBuffer, DWORD MaxHandleCount);\r\n__declspec(dllexport) bool TITCALL HandlerCloseAllLockHandles(const char* szFileOrFolderName, bool NameIsFolder, bool NameIsTranslated);\r\n__declspec(dllexport) bool TITCALL HandlerCloseAllLockHandlesW(const wchar_t* szFileOrFolderName, bool NameIsFolder, bool NameIsTranslated);\r\n__declspec(dllexport) bool TITCALL HandlerIsFileLocked(const char* szFileOrFolderName, bool NameIsFolder, bool NameIsTranslated);\r\n__declspec(dllexport) bool TITCALL HandlerIsFileLockedW(const wchar_t* szFileOrFolderName, bool NameIsFolder, bool NameIsTranslated);\r\n// TitanEngine.Handler[Mutex].functions:\r\n__declspec(dllexport) long TITCALL HandlerEnumerateOpenMutexes(HANDLE hProcess, DWORD ProcessId, LPVOID HandleBuffer, DWORD MaxHandleCount);\r\n__declspec(dllexport) ULONG_PTR TITCALL HandlerGetOpenMutexHandle(HANDLE hProcess, DWORD ProcessId, const char* szMutexString);\r\n__declspec(dllexport) ULONG_PTR TITCALL HandlerGetOpenMutexHandleW(HANDLE hProcess, DWORD ProcessId, const wchar_t* szMutexString);\r\n__declspec(dllexport) long TITCALL HandlerGetProcessIdWhichCreatedMutex(const char* szMutexString);\r\n__declspec(dllexport) long TITCALL HandlerGetProcessIdWhichCreatedMutexW(const wchar_t* szMutexString);\r\n// TitanEngine.Injector.functions:\r\n__declspec(dllexport) bool TITCALL RemoteLoadLibrary(HANDLE hProcess, const char* szLibraryFile, bool WaitForThreadExit);\r\n__declspec(dllexport) bool TITCALL RemoteLoadLibraryW(HANDLE hProcess, const wchar_t* szLibraryFile, bool WaitForThreadExit);\r\n__declspec(dllexport) bool TITCALL RemoteFreeLibrary(HANDLE hProcess, HMODULE hModule, const char* szLibraryFile, bool WaitForThreadExit);\r\n__declspec(dllexport) bool TITCALL RemoteFreeLibraryW(HANDLE hProcess, HMODULE hModule, const wchar_t* szLibraryFile, bool WaitForThreadExit);\r\n__declspec(dllexport) bool TITCALL RemoteExitProcess(HANDLE hProcess, DWORD ExitCode);\r\n// TitanEngine.StaticUnpacker.functions:\r\n__declspec(dllexport) bool TITCALL StaticFileLoad(const char* szFileName, DWORD DesiredAccess, bool SimulateLoad, LPHANDLE FileHandle, LPDWORD LoadedSize, LPHANDLE FileMap, PULONG_PTR FileMapVA);\r\n__declspec(dllexport) bool TITCALL StaticFileLoadW(const wchar_t* szFileName, DWORD DesiredAccess, bool SimulateLoad, LPHANDLE FileHandle, LPDWORD LoadedSize, LPHANDLE FileMap, PULONG_PTR FileMapVA);\r\n__declspec(dllexport) bool TITCALL StaticFileUnload(const char* szFileName, bool CommitChanges, HANDLE FileHandle, DWORD LoadedSize, HANDLE FileMap, ULONG_PTR FileMapVA);\r\n__declspec(dllexport) bool TITCALL StaticFileUnloadW(const wchar_t* szFileName, bool CommitChanges, HANDLE FileHandle, DWORD LoadedSize, HANDLE FileMap, ULONG_PTR FileMapVA);\r\n__declspec(dllexport) bool TITCALL StaticFileOpen(const char* szFileName, DWORD DesiredAccess, LPHANDLE FileHandle, LPDWORD FileSizeLow, LPDWORD FileSizeHigh);\r\n__declspec(dllexport) bool TITCALL StaticFileOpenW(const wchar_t* szFileName, DWORD DesiredAccess, LPHANDLE FileHandle, LPDWORD FileSizeLow, LPDWORD FileSizeHigh);\r\n__declspec(dllexport) bool TITCALL StaticFileGetContent(HANDLE FileHandle, DWORD FilePositionLow, LPDWORD FilePositionHigh, void* Buffer, DWORD Size);\r\n__declspec(dllexport) void TITCALL StaticFileClose(HANDLE FileHandle);\r\n__declspec(dllexport) void TITCALL StaticMemoryDecrypt(LPVOID MemoryStart, DWORD MemorySize, DWORD DecryptionType, DWORD DecryptionKeySize, ULONG_PTR DecryptionKey);\r\n__declspec(dllexport) void TITCALL StaticMemoryDecryptEx(LPVOID MemoryStart, DWORD MemorySize, DWORD DecryptionKeySize, void* DecryptionCallBack);\r\n__declspec(dllexport) void TITCALL StaticMemoryDecryptSpecial(LPVOID MemoryStart, DWORD MemorySize, DWORD DecryptionKeySize, DWORD SpecDecryptionType, void* DecryptionCallBack);\r\n__declspec(dllexport) void TITCALL StaticSectionDecrypt(ULONG_PTR FileMapVA, DWORD SectionNumber, bool SimulateLoad, DWORD DecryptionType, DWORD DecryptionKeySize, ULONG_PTR DecryptionKey);\r\n__declspec(dllexport) bool TITCALL StaticMemoryDecompress(void* Source, DWORD SourceSize, void* Destination, DWORD DestinationSize, int Algorithm);\r\n__declspec(dllexport) bool TITCALL StaticRawMemoryCopy(HANDLE hFile, ULONG_PTR FileMapVA, ULONG_PTR VitualAddressToCopy, DWORD Size, bool AddressIsRVA, const char* szDumpFileName);\r\n__declspec(dllexport) bool TITCALL StaticRawMemoryCopyW(HANDLE hFile, ULONG_PTR FileMapVA, ULONG_PTR VitualAddressToCopy, DWORD Size, bool AddressIsRVA, const wchar_t* szDumpFileName);\r\n__declspec(dllexport) bool TITCALL StaticRawMemoryCopyEx(HANDLE hFile, DWORD RawAddressToCopy, DWORD Size, const char* szDumpFileName);\r\n__declspec(dllexport) bool TITCALL StaticRawMemoryCopyExW(HANDLE hFile, DWORD RawAddressToCopy, DWORD Size, const wchar_t* szDumpFileName);\r\n__declspec(dllexport) bool TITCALL StaticRawMemoryCopyEx64(HANDLE hFile, DWORD64 RawAddressToCopy, DWORD64 Size, const char* szDumpFileName);\r\n__declspec(dllexport) bool TITCALL StaticRawMemoryCopyEx64W(HANDLE hFile, DWORD64 RawAddressToCopy, DWORD64 Size, const wchar_t* szDumpFileName);\r\n__declspec(dllexport) bool TITCALL StaticHashMemory(void* MemoryToHash, DWORD SizeOfMemory, void* HashDigest, bool OutputString, int Algorithm);\r\n__declspec(dllexport) bool TITCALL StaticHashFileW(const wchar_t* szFileName, char* HashDigest, bool OutputString, int Algorithm);\r\n__declspec(dllexport) bool TITCALL StaticHashFile(const char* szFileName, char* HashDigest, bool OutputString, int Algorithm);\r\n// TitanEngine.Engine.functions:\r\n__declspec(dllexport) void TITCALL EngineUnpackerInitialize(const char* szFileName, const char* szUnpackedFileName, bool DoLogData, bool DoRealignFile, bool DoMoveOverlay, void* EntryCallBack);\r\n__declspec(dllexport) void TITCALL EngineUnpackerInitializeW(const wchar_t* szFileName, const wchar_t* szUnpackedFileName, bool DoLogData, bool DoRealignFile, bool DoMoveOverlay, void* EntryCallBack);\r\n__declspec(dllexport) bool TITCALL EngineUnpackerSetBreakCondition(void* SearchStart, DWORD SearchSize, void* SearchPattern, DWORD PatternSize, DWORD PatternDelta, ULONG_PTR BreakType, bool SingleBreak, DWORD Parameter1, DWORD Parameter2);\r\n__declspec(dllexport) void TITCALL EngineUnpackerSetEntryPointAddress(ULONG_PTR UnpackedEntryPointAddress);\r\n__declspec(dllexport) void TITCALL EngineUnpackerFinalizeUnpacking();\r\n// TitanEngine.Engine.functions:\r\n__declspec(dllexport) void TITCALL SetEngineVariable(DWORD VariableId, bool VariableSet);\r\n__declspec(dllexport) bool TITCALL EngineCreateMissingDependencies(const char* szFileName, const char* szOutputFolder, bool LogCreatedFiles);\r\n__declspec(dllexport) bool TITCALL EngineCreateMissingDependenciesW(const wchar_t* szFileName, const wchar_t* szOutputFolder, bool LogCreatedFiles);\r\n__declspec(dllexport) bool TITCALL EngineFakeMissingDependencies(HANDLE hProcess);\r\n__declspec(dllexport) bool TITCALL EngineDeleteCreatedDependencies();\r\n__declspec(dllexport) bool TITCALL EngineCreateUnpackerWindow(const char* WindowUnpackerTitle, const char* WindowUnpackerLongTitle, const char* WindowUnpackerName, const char* WindowUnpackerAuthor, void* StartUnpackingCallBack);\r\n__declspec(dllexport) void TITCALL EngineAddUnpackerWindowLogMessage(const char* szLogMessage);\r\n__declspec(dllexport) bool TITCALL EngineCheckStructAlignment(DWORD StructureType, ULONG_PTR StructureSize);\r\n// Global.Engine.Extension.Functions:\r\n__declspec(dllexport) bool TITCALL ExtensionManagerIsPluginLoaded(const char* szPluginName);\r\n__declspec(dllexport) bool TITCALL ExtensionManagerIsPluginEnabled(const char* szPluginName);\r\n__declspec(dllexport) bool TITCALL ExtensionManagerDisableAllPlugins();\r\n__declspec(dllexport) bool TITCALL ExtensionManagerDisablePlugin(const char* szPluginName);\r\n__declspec(dllexport) bool TITCALL ExtensionManagerEnableAllPlugins();\r\n__declspec(dllexport) bool TITCALL ExtensionManagerEnablePlugin(const char* szPluginName);\r\n__declspec(dllexport) bool TITCALL ExtensionManagerUnloadAllPlugins();\r\n__declspec(dllexport) bool TITCALL ExtensionManagerUnloadPlugin(const char* szPluginName);\r\n__declspec(dllexport) void* TITCALL ExtensionManagerGetPluginInfo(const char* szPluginName);\r\n\r\n#ifdef __cplusplus\r\n}\r\n#endif\r\n\r\n#pragma pack(pop)\r\n\r\n#endif /*TITANENGINE*/\r\n" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/XEDParse/XEDParse.h", "content": "#ifndef _XEDPARSE_H\r\n#define _XEDPARSE_H\r\n\r\n#include \r\n\r\n//XEDParse defines\r\n#ifdef XEDPARSE_BUILD\r\n#define XEDPARSE_EXPORT __declspec(dllexport)\r\n#else\r\n#define XEDPARSE_EXPORT __declspec(dllimport)\r\n#endif //XEDPARSE_BUILD\r\n\r\n#define XEDPARSE_CALL //calling convention\r\n\r\n#define XEDPARSE_MAXBUFSIZE 256\r\n#define XEDPARSE_MAXASMSIZE 16\r\n\r\n//typedefs\r\ntypedef bool (XEDPARSE_CALL* CBXEDPARSE_UNKNOWN)(const char* text, ULONGLONG* value);\r\n\r\n//XEDParse enums\r\nenum XEDPARSE_STATUS\r\n{\r\n XEDPARSE_ERROR = 0,\r\n XEDPARSE_OK = 1\r\n};\r\n\r\n//XEDParse structs\r\n#pragma pack(push,8)\r\nstruct XEDPARSE\r\n{\r\n bool x64; // use 64-bit instructions\r\n ULONGLONG cip; //instruction pointer (for relative addressing)\r\n unsigned int dest_size; //destination size (returned by XEDParse)\r\n CBXEDPARSE_UNKNOWN cbUnknown; //unknown operand callback\r\n unsigned char dest[XEDPARSE_MAXASMSIZE]; //destination buffer\r\n char instr[XEDPARSE_MAXBUFSIZE]; //instruction text\r\n char error[XEDPARSE_MAXBUFSIZE]; //error text (in case of an error)\r\n};\r\n#pragma pack(pop)\r\n\r\n#ifdef __cplusplus\r\nextern \"C\"\r\n{\r\n#endif\r\n\r\nXEDPARSE_EXPORT XEDPARSE_STATUS XEDPARSE_CALL XEDParseAssemble(XEDPARSE* XEDParse);\r\n\r\n#ifdef __cplusplus\r\n}\r\n#endif\r\n\r\n#endif // _XEDPARSE_H\r\n" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/_dbgfunctions.h", "content": "#ifndef _DBGFUNCTIONS_H\r\n#define _DBGFUNCTIONS_H\r\n\r\n#ifndef __cplusplus\r\n#include \r\n#endif\r\n\r\ntypedef struct\r\n{\r\n char mod[MAX_MODULE_SIZE];\r\n duint addr;\r\n unsigned char oldbyte;\r\n unsigned char newbyte;\r\n} DBGPATCHINFO;\r\n\r\ntypedef struct\r\n{\r\n duint addr;\r\n duint from;\r\n duint to;\r\n char comment[MAX_COMMENT_SIZE];\r\n} DBGCALLSTACKENTRY;\r\n\r\ntypedef struct\r\n{\r\n int total;\r\n DBGCALLSTACKENTRY* entries;\r\n} DBGCALLSTACK;\r\n\r\ntypedef struct\r\n{\r\n duint addr;\r\n duint handler;\r\n} DBGSEHRECORD;\r\n\r\ntypedef struct\r\n{\r\n duint total;\r\n DBGSEHRECORD* records;\r\n} DBGSEHCHAIN;\r\n\r\ntypedef struct\r\n{\r\n DWORD dwProcessId;\r\n char szExeFile[MAX_PATH];\r\n char szExeMainWindowTitle[MAX_PATH];\r\n char szExeArgs[MAX_COMMAND_LINE_SIZE];\r\n} DBGPROCESSINFO;\r\n\r\ntypedef struct\r\n{\r\n DWORD rva;\r\n BYTE type;\r\n WORD size;\r\n} DBGRELOCATIONINFO;\r\n\r\ntypedef enum\r\n{\r\n InstructionBody = 0,\r\n InstructionHeading = 1,\r\n InstructionTailing = 2,\r\n InstructionOverlapped = 3, // The byte was executed with differing instruction base addresses\r\n DataByte, // This and the following is not implemented yet.\r\n DataWord,\r\n DataDWord,\r\n DataQWord,\r\n DataFloat,\r\n DataDouble,\r\n DataLongDouble,\r\n DataXMM,\r\n DataYMM,\r\n DataMMX,\r\n DataMixed, //the byte is accessed in multiple ways\r\n InstructionDataMixed //the byte is both executed and written\r\n} TRACERECORDBYTETYPE;\r\n\r\ntypedef enum\r\n{\r\n TraceRecordNone,\r\n TraceRecordBitExec,\r\n TraceRecordByteWithExecTypeAndCounter,\r\n TraceRecordWordWithExecTypeAndCounter\r\n} TRACERECORDTYPE;\r\n\r\ntypedef struct\r\n{\r\n duint Handle;\r\n unsigned char TypeNumber;\r\n unsigned int GrantedAccess;\r\n} HANDLEINFO;\r\n\r\n// The longest ip address is 1234:6789:1234:6789:1234:6789:123.567.901.345 (46 bytes)\r\n#define TCP_ADDR_SIZE 50\r\n\r\ntypedef struct\r\n{\r\n char RemoteAddress[TCP_ADDR_SIZE];\r\n unsigned short RemotePort;\r\n char LocalAddress[TCP_ADDR_SIZE];\r\n unsigned short LocalPort;\r\n char StateText[TCP_ADDR_SIZE];\r\n unsigned int State;\r\n} TCPCONNECTIONINFO;\r\n\r\ntypedef struct\r\n{\r\n duint handle;\r\n duint parent;\r\n DWORD threadId;\r\n DWORD style;\r\n DWORD styleEx;\r\n duint wndProc;\r\n bool enabled;\r\n RECT position;\r\n char windowTitle[MAX_COMMENT_SIZE];\r\n char windowClass[MAX_COMMENT_SIZE];\r\n} WINDOW_INFO;\r\n\r\ntypedef struct\r\n{\r\n duint addr;\r\n duint size;\r\n duint flags;\r\n} HEAPINFO;\r\n\r\ntypedef struct\r\n{\r\n const char* name;\r\n duint value;\r\n} CONSTANTINFO;\r\n\r\ntypedef bool (*ASSEMBLEATEX)(duint addr, const char* instruction, char* error, bool fillnop);\r\ntypedef bool (*SECTIONFROMADDR)(duint addr, char* section);\r\ntypedef bool (*MODNAMEFROMADDR)(duint addr, char* modname, bool extension);\r\ntypedef duint(*MODBASEFROMADDR)(duint addr);\r\ntypedef duint(*MODBASEFROMNAME)(const char* modname);\r\ntypedef duint(*MODSIZEFROMADDR)(duint addr);\r\ntypedef bool (*ASSEMBLE)(duint addr, unsigned char* dest, int* size, const char* instruction, char* error);\r\ntypedef bool (*PATCHGET)(duint addr);\r\ntypedef bool (*PATCHINRANGE)(duint start, duint end);\r\ntypedef bool (*MEMPATCH)(duint va, const unsigned char* src, duint size);\r\ntypedef void (*PATCHRESTORERANGE)(duint start, duint end);\r\ntypedef bool (*PATCHENUM)(DBGPATCHINFO* patchlist, size_t* cbsize);\r\ntypedef bool (*PATCHRESTORE)(duint addr);\r\ntypedef int (*PATCHFILE)(DBGPATCHINFO* patchlist, int count, const char* szFileName, char* error);\r\ntypedef int (*MODPATHFROMADDR)(duint addr, char* path, int size);\r\ntypedef int (*MODPATHFROMNAME)(const char* modname, char* path, int size);\r\ntypedef bool (*DISASMFAST)(const unsigned char* data, duint addr, BASIC_INSTRUCTION_INFO* basicinfo);\r\ntypedef void (*MEMUPDATEMAP)();\r\ntypedef void (*GETCALLSTACK)(DBGCALLSTACK* callstack);\r\ntypedef void (*GETSEHCHAIN)(DBGSEHCHAIN* sehchain);\r\ntypedef void (*SYMBOLDOWNLOADALLSYMBOLS)(const char* szSymbolStore);\r\ntypedef bool (*GETJIT)(char* jit, bool x64);\r\ntypedef bool (*GETJITAUTO)(bool* jitauto);\r\ntypedef bool (*GETDEFJIT)(char* defjit);\r\ntypedef bool (*GETPROCESSLIST)(DBGPROCESSINFO** entries, int* count);\r\ntypedef bool (*GETPAGERIGHTS)(duint addr, char* rights);\r\ntypedef bool (*SETPAGERIGHTS)(duint addr, const char* rights);\r\ntypedef bool (*PAGERIGHTSTOSTRING)(DWORD protect, char* rights);\r\ntypedef bool (*ISPROCESSELEVATED)();\r\ntypedef bool (*GETCMDLINE)(char* cmdline, size_t* cbsize);\r\ntypedef bool (*SETCMDLINE)(const char* cmdline);\r\ntypedef duint(*FILEOFFSETTOVA)(const char* modname, duint offset);\r\ntypedef duint(*VATOFILEOFFSET)(duint va);\r\ntypedef duint(*GETADDRFROMLINE)(const char* szSourceFile, int line, duint* displacement);\r\ntypedef bool (*GETSOURCEFROMADDR)(duint addr, char* szSourceFile, int* line);\r\ntypedef bool (*VALFROMSTRING)(const char* string, duint* value);\r\ntypedef bool (*PATCHGETEX)(duint addr, DBGPATCHINFO* info);\r\ntypedef bool (*GETBRIDGEBP)(BPXTYPE type, duint addr, BRIDGEBP* bp);\r\ntypedef bool (*STRINGFORMATINLINE)(const char* format, size_t resultSize, char* result);\r\ntypedef void (*GETMNEMONICBRIEF)(const char* mnem, size_t resultSize, char* result);\r\ntypedef unsigned int (*GETTRACERECORDHITCOUNT)(duint address);\r\ntypedef TRACERECORDBYTETYPE(*GETTRACERECORDBYTETYPE)(duint address);\r\ntypedef bool (*SETTRACERECORDTYPE)(duint pageAddress, TRACERECORDTYPE type);\r\ntypedef TRACERECORDTYPE(*GETTRACERECORDTYPE)(duint pageAddress);\r\ntypedef bool (*ENUMHANDLES)(ListOf(HANDLEINFO) handles);\r\ntypedef bool (*GETHANDLENAME)(duint handle, char* name, size_t nameSize, char* typeName, size_t typeNameSize);\r\ntypedef bool (*ENUMTCPCONNECTIONS)(ListOf(TCPCONNECTIONINFO) connections);\r\ntypedef duint(*GETDBGEVENTS)();\r\ntypedef int (*MODGETPARTY)(duint base);\r\ntypedef void (*MODSETPARTY)(duint base, int party);\r\ntypedef bool(*WATCHISWATCHDOGTRIGGERED)(unsigned int id);\r\ntypedef bool(*MEMISCODEPAGE)(duint addr, bool refresh);\r\ntypedef bool(*ANIMATECOMMAND)(const char* command);\r\ntypedef void(*DBGSETDEBUGGEEINITSCRIPT)(const char* fileName);\r\ntypedef const char* (*DBGGETDEBUGGEEINITSCRIPT)();\r\ntypedef bool(*HANDLESENUMWINDOWS)(ListOf(WINDOW_INFO) windows);\r\ntypedef bool(*HANDLESENUMHEAPS)(ListOf(HEAPINFO) heaps);\r\ntypedef bool(*THREADGETNAME)(DWORD tid, char* name);\r\ntypedef bool(*ISDEPENABLED)();\r\ntypedef void(*GETCALLSTACKEX)(DBGCALLSTACK* callstack, bool cache);\r\ntypedef bool(*GETUSERCOMMENT)(duint addr, char* comment);\r\ntypedef void(*ENUMCONSTANTS)(ListOf(CONSTANTINFO) constants);\r\ntypedef duint(*MEMBPSIZE)(duint addr);\r\ntypedef bool(*MODRELOCATIONSFROMADDR)(duint addr, ListOf(DBGRELOCATIONINFO) relocations);\r\ntypedef bool(*MODRELOCATIONATADDR)(duint addr, DBGRELOCATIONINFO* relocation);\r\ntypedef bool(*MODRELOCATIONSINRANGE)(duint addr, duint size, ListOf(DBGRELOCATIONINFO) relocations);\r\ntypedef duint(*DBGETHASH)();\r\ntypedef int(*SYMAUTOCOMPLETE)(const char* Search, char** Buffer, int MaxSymbols);\r\n\r\n//The list of all the DbgFunctions() return value.\r\n//WARNING: This list is append only. Do not insert things in the middle or plugins would break.\r\ntypedef struct DBGFUNCTIONS_\r\n{\r\n ASSEMBLEATEX AssembleAtEx;\r\n SECTIONFROMADDR SectionFromAddr;\r\n MODNAMEFROMADDR ModNameFromAddr;\r\n MODBASEFROMADDR ModBaseFromAddr;\r\n MODBASEFROMNAME ModBaseFromName;\r\n MODSIZEFROMADDR ModSizeFromAddr;\r\n ASSEMBLE Assemble;\r\n PATCHGET PatchGet;\r\n PATCHINRANGE PatchInRange;\r\n MEMPATCH MemPatch;\r\n PATCHRESTORERANGE PatchRestoreRange;\r\n PATCHENUM PatchEnum;\r\n PATCHRESTORE PatchRestore;\r\n PATCHFILE PatchFile;\r\n MODPATHFROMADDR ModPathFromAddr;\r\n MODPATHFROMNAME ModPathFromName;\r\n DISASMFAST DisasmFast;\r\n MEMUPDATEMAP MemUpdateMap;\r\n GETCALLSTACK GetCallStack;\r\n GETSEHCHAIN GetSEHChain;\r\n SYMBOLDOWNLOADALLSYMBOLS SymbolDownloadAllSymbols;\r\n GETJITAUTO GetJitAuto;\r\n GETJIT GetJit;\r\n GETDEFJIT GetDefJit;\r\n GETPROCESSLIST GetProcessList;\r\n GETPAGERIGHTS GetPageRights;\r\n SETPAGERIGHTS SetPageRights;\r\n PAGERIGHTSTOSTRING PageRightsToString;\r\n ISPROCESSELEVATED IsProcessElevated;\r\n GETCMDLINE GetCmdline;\r\n SETCMDLINE SetCmdline;\r\n FILEOFFSETTOVA FileOffsetToVa;\r\n VATOFILEOFFSET VaToFileOffset;\r\n GETADDRFROMLINE GetAddrFromLine;\r\n GETSOURCEFROMADDR GetSourceFromAddr;\r\n VALFROMSTRING ValFromString;\r\n PATCHGETEX PatchGetEx;\r\n GETBRIDGEBP GetBridgeBp;\r\n STRINGFORMATINLINE StringFormatInline;\r\n GETMNEMONICBRIEF GetMnemonicBrief;\r\n GETTRACERECORDHITCOUNT GetTraceRecordHitCount;\r\n GETTRACERECORDBYTETYPE GetTraceRecordByteType;\r\n SETTRACERECORDTYPE SetTraceRecordType;\r\n GETTRACERECORDTYPE GetTraceRecordType;\r\n ENUMHANDLES EnumHandles;\r\n GETHANDLENAME GetHandleName;\r\n ENUMTCPCONNECTIONS EnumTcpConnections;\r\n GETDBGEVENTS GetDbgEvents;\r\n MODGETPARTY ModGetParty;\r\n MODSETPARTY ModSetParty;\r\n WATCHISWATCHDOGTRIGGERED WatchIsWatchdogTriggered;\r\n MEMISCODEPAGE MemIsCodePage;\r\n ANIMATECOMMAND AnimateCommand;\r\n DBGSETDEBUGGEEINITSCRIPT DbgSetDebuggeeInitScript;\r\n DBGGETDEBUGGEEINITSCRIPT DbgGetDebuggeeInitScript;\r\n HANDLESENUMWINDOWS EnumWindows;\r\n HANDLESENUMHEAPS EnumHeaps;\r\n THREADGETNAME ThreadGetName;\r\n ISDEPENABLED IsDepEnabled;\r\n GETCALLSTACKEX GetCallStackEx;\r\n GETUSERCOMMENT GetUserComment;\r\n ENUMCONSTANTS EnumConstants;\r\n ENUMCONSTANTS EnumErrorCodes;\r\n ENUMCONSTANTS EnumExceptions;\r\n MEMBPSIZE MemBpSize;\r\n MODRELOCATIONSFROMADDR ModRelocationsFromAddr;\r\n MODRELOCATIONATADDR ModRelocationAtAddr;\r\n MODRELOCATIONSINRANGE ModRelocationsInRange;\r\n DBGETHASH DbGetHash;\r\n SYMAUTOCOMPLETE SymAutoComplete;\r\n} DBGFUNCTIONS;\r\n\r\n#ifdef BUILD_DBG\r\n\r\nconst DBGFUNCTIONS* dbgfunctionsget();\r\nvoid dbgfunctionsinit();\r\n\r\n#endif //BUILD_DBG\r\n\r\n#endif //_DBGFUNCTIONS_H\r\n" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/_plugin_types.h", "content": "#ifndef _PLUGIN_DATA_H\r\n#define _PLUGIN_DATA_H\r\n\r\n#ifdef BUILD_DBG\r\n\r\n#include \"_global.h\"\r\n#include \"jansson/jansson.h\"\r\n#include \r\n\r\n#else\r\n\r\n#ifdef __GNUC__\r\n#include \"dbghelp/dbghelp.h\"\r\n#else\r\n#include \r\n#endif // __GNUC__\r\n\r\n#ifndef deflen\r\n#define deflen 1024\r\n#endif // deflen\r\n\r\n#include \"bridgemain.h\"\r\n#include \"_dbgfunctions.h\"\r\n#include \"jansson/jansson.h\"\r\n\r\n#endif // BUILD_DBG\r\n\r\n#endif // _PLUGIN_DATA_H\r\n" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/_plugins.h", "content": "#ifndef _PLUGINS_H\r\n#define _PLUGINS_H\r\n\r\n#ifndef __cplusplus\r\n#include \r\n#endif\r\n\r\n#ifndef PLUG_IMPEXP\r\n#ifdef BUILD_DBG\r\n#define PLUG_IMPEXP __declspec(dllexport)\r\n#else\r\n#define PLUG_IMPEXP __declspec(dllimport)\r\n#endif //BUILD_DBG\r\n#endif //PLUG_IMPEXP\r\n\r\n#include \"_plugin_types.h\"\r\n\r\n//default structure alignments forced\r\n#ifdef _WIN64\r\n#pragma pack(push, 16)\r\n#else //x86\r\n#pragma pack(push, 8)\r\n#endif //_WIN64\r\n\r\n//defines\r\n#define PLUG_SDKVERSION 1\r\n\r\n#define PLUG_DB_LOADSAVE_DATA 1\r\n#define PLUG_DB_LOADSAVE_ALL 2\r\n\r\n//structures\r\ntypedef struct\r\n{\r\n //provided by the debugger\r\n int pluginHandle;\r\n //provided by the pluginit function\r\n int sdkVersion;\r\n int pluginVersion;\r\n char pluginName[256];\r\n} PLUG_INITSTRUCT;\r\n\r\ntypedef struct\r\n{\r\n //provided by the debugger\r\n HWND hwndDlg; //gui window handle\r\n int hMenu; //plugin menu handle\r\n int hMenuDisasm; //plugin disasm menu handle\r\n int hMenuDump; //plugin dump menu handle\r\n int hMenuStack; //plugin stack menu handle\r\n} PLUG_SETUPSTRUCT;\r\n\r\ntypedef struct\r\n{\r\n void* data; //user data\r\n} PLUG_SCRIPTSTRUCT;\r\n\r\n//callback structures\r\ntypedef struct\r\n{\r\n const char* szFileName;\r\n} PLUG_CB_INITDEBUG;\r\n\r\ntypedef struct\r\n{\r\n void* reserved;\r\n} PLUG_CB_STOPDEBUG;\r\n\r\ntypedef struct\r\n{\r\n CREATE_PROCESS_DEBUG_INFO* CreateProcessInfo;\r\n IMAGEHLP_MODULE64* modInfo;\r\n const char* DebugFileName;\r\n PROCESS_INFORMATION* fdProcessInfo;\r\n} PLUG_CB_CREATEPROCESS;\r\n\r\ntypedef struct\r\n{\r\n EXIT_PROCESS_DEBUG_INFO* ExitProcess;\r\n} PLUG_CB_EXITPROCESS;\r\n\r\ntypedef struct\r\n{\r\n CREATE_THREAD_DEBUG_INFO* CreateThread;\r\n DWORD dwThreadId;\r\n} PLUG_CB_CREATETHREAD;\r\n\r\ntypedef struct\r\n{\r\n EXIT_THREAD_DEBUG_INFO* ExitThread;\r\n DWORD dwThreadId;\r\n} PLUG_CB_EXITTHREAD;\r\n\r\ntypedef struct\r\n{\r\n void* reserved;\r\n} PLUG_CB_SYSTEMBREAKPOINT;\r\n\r\ntypedef struct\r\n{\r\n LOAD_DLL_DEBUG_INFO* LoadDll;\r\n IMAGEHLP_MODULE64* modInfo;\r\n const char* modname;\r\n} PLUG_CB_LOADDLL;\r\n\r\ntypedef struct\r\n{\r\n UNLOAD_DLL_DEBUG_INFO* UnloadDll;\r\n} PLUG_CB_UNLOADDLL;\r\n\r\ntypedef struct\r\n{\r\n OUTPUT_DEBUG_STRING_INFO* DebugString;\r\n} PLUG_CB_OUTPUTDEBUGSTRING;\r\n\r\ntypedef struct\r\n{\r\n EXCEPTION_DEBUG_INFO* Exception;\r\n} PLUG_CB_EXCEPTION;\r\n\r\ntypedef struct\r\n{\r\n BRIDGEBP* breakpoint;\r\n} PLUG_CB_BREAKPOINT;\r\n\r\ntypedef struct\r\n{\r\n void* reserved;\r\n} PLUG_CB_PAUSEDEBUG;\r\n\r\ntypedef struct\r\n{\r\n void* reserved;\r\n} PLUG_CB_RESUMEDEBUG;\r\n\r\ntypedef struct\r\n{\r\n void* reserved;\r\n} PLUG_CB_STEPPED;\r\n\r\ntypedef struct\r\n{\r\n DWORD dwProcessId;\r\n} PLUG_CB_ATTACH;\r\n\r\ntypedef struct\r\n{\r\n PROCESS_INFORMATION* fdProcessInfo;\r\n} PLUG_CB_DETACH;\r\n\r\ntypedef struct\r\n{\r\n DEBUG_EVENT* DebugEvent;\r\n} PLUG_CB_DEBUGEVENT;\r\n\r\ntypedef struct\r\n{\r\n int hEntry;\r\n} PLUG_CB_MENUENTRY;\r\n\r\ntypedef struct\r\n{\r\n MSG* message;\r\n long* result;\r\n bool retval;\r\n} PLUG_CB_WINEVENT;\r\n\r\ntypedef struct\r\n{\r\n MSG* message;\r\n bool retval;\r\n} PLUG_CB_WINEVENTGLOBAL;\r\n\r\ntypedef struct\r\n{\r\n json_t* root;\r\n int loadSaveType;\r\n} PLUG_CB_LOADSAVEDB;\r\n\r\ntypedef struct\r\n{\r\n const char* symbol;\r\n bool retval;\r\n} PLUG_CB_FILTERSYMBOL;\r\n\r\ntypedef struct\r\n{\r\n duint cip;\r\n bool stop;\r\n} PLUG_CB_TRACEEXECUTE;\r\n\r\ntypedef struct\r\n{\r\n int hWindow;\r\n duint VA;\r\n} PLUG_CB_SELCHANGED;\r\n\r\ntypedef struct\r\n{\r\n BridgeCFGraphList graph;\r\n} PLUG_CB_ANALYZE;\r\n\r\ntypedef struct\r\n{\r\n duint addr;\r\n BRIDGE_ADDRINFO* addrinfo;\r\n bool retval;\r\n} PLUG_CB_ADDRINFO;\r\n\r\ntypedef struct\r\n{\r\n const char* string;\r\n duint value;\r\n int* value_size;\r\n bool* isvar;\r\n bool* hexonly;\r\n bool retval;\r\n} PLUG_CB_VALFROMSTRING;\r\n\r\ntypedef struct\r\n{\r\n const char* string;\r\n duint value;\r\n bool retval;\r\n} PLUG_CB_VALTOSTRING;\r\n\r\ntypedef struct\r\n{\r\n int hMenu;\r\n} PLUG_CB_MENUPREPARE;\r\n\r\n//enums\r\ntypedef enum\r\n{\r\n CB_INITDEBUG, //PLUG_CB_INITDEBUG\r\n CB_STOPDEBUG, //PLUG_CB_STOPDEBUG\r\n CB_CREATEPROCESS, //PLUG_CB_CREATEPROCESS\r\n CB_EXITPROCESS, //PLUG_CB_EXITPROCESS\r\n CB_CREATETHREAD, //PLUG_CB_CREATETHREAD\r\n CB_EXITTHREAD, //PLUG_CB_EXITTHREAD\r\n CB_SYSTEMBREAKPOINT, //PLUG_CB_SYSTEMBREAKPOINT\r\n CB_LOADDLL, //PLUG_CB_LOADDLL\r\n CB_UNLOADDLL, //PLUG_CB_UNLOADDLL\r\n CB_OUTPUTDEBUGSTRING, //PLUG_CB_OUTPUTDEBUGSTRING\r\n CB_EXCEPTION, //PLUG_CB_EXCEPTION\r\n CB_BREAKPOINT, //PLUG_CB_BREAKPOINT\r\n CB_PAUSEDEBUG, //PLUG_CB_PAUSEDEBUG\r\n CB_RESUMEDEBUG, //PLUG_CB_RESUMEDEBUG\r\n CB_STEPPED, //PLUG_CB_STEPPED\r\n CB_ATTACH, //PLUG_CB_ATTACHED (before attaching, after CB_INITDEBUG)\r\n CB_DETACH, //PLUG_CB_DETACH (before detaching, before CB_STOPDEBUG)\r\n CB_DEBUGEVENT, //PLUG_CB_DEBUGEVENT (called on any debug event)\r\n CB_MENUENTRY, //PLUG_CB_MENUENTRY\r\n CB_WINEVENT, //PLUG_CB_WINEVENT\r\n CB_WINEVENTGLOBAL, //PLUG_CB_WINEVENTGLOBAL\r\n CB_LOADDB, //PLUG_CB_LOADSAVEDB\r\n CB_SAVEDB, //PLUG_CB_LOADSAVEDB\r\n CB_FILTERSYMBOL, //PLUG_CB_FILTERSYMBOL\r\n CB_TRACEEXECUTE, //PLUG_CB_TRACEEXECUTE\r\n CB_SELCHANGED, //PLUG_CB_SELCHANGED\r\n CB_ANALYZE, //PLUG_CB_ANALYZE\r\n CB_ADDRINFO, //PLUG_CB_ADDRINFO\r\n CB_VALFROMSTRING, //PLUG_CB_VALFROMSTRING\r\n CB_VALTOSTRING, //PLUG_CB_VALTOSTRING\r\n CB_MENUPREPARE, //PLUG_CB_MENUPREPARE\r\n CB_LAST\r\n} CBTYPE;\r\n\r\ntypedef enum\r\n{\r\n FORMAT_ERROR, //generic failure (no message)\r\n FORMAT_SUCCESS, //success\r\n FORMAT_ERROR_MESSAGE, //formatting failed but an error was put in the buffer (there are always at least 511 characters available).\r\n FORMAT_BUFFER_TOO_SMALL //buffer too small (x64dbg will retry until the buffer is big enough)\r\n} FORMATRESULT;\r\n\r\n//typedefs\r\ntypedef void (*CBPLUGIN)(CBTYPE cbType, void* callbackInfo);\r\ntypedef bool (*CBPLUGINCOMMAND)(int argc, char** argv);\r\ntypedef void (*CBPLUGINSCRIPT)();\r\ntypedef duint(*CBPLUGINEXPRFUNCTION)(int argc, duint* argv, void* userdata);\r\ntypedef FORMATRESULT(*CBPLUGINFORMATFUNCTION)(char* dest, size_t destCount, int argc, char* argv[], duint value, void* userdata);\r\ntypedef bool (*CBPLUGINPREDICATE)(void* userdata);\r\n\r\n//exports\r\n#ifdef __cplusplus\r\nextern \"C\"\r\n{\r\n#endif\r\n\r\nPLUG_IMPEXP void _plugin_registercallback(int pluginHandle, CBTYPE cbType, CBPLUGIN cbPlugin);\r\nPLUG_IMPEXP bool _plugin_unregistercallback(int pluginHandle, CBTYPE cbType);\r\nPLUG_IMPEXP bool _plugin_registercommand(int pluginHandle, const char* command, CBPLUGINCOMMAND cbCommand, bool debugonly);\r\nPLUG_IMPEXP bool _plugin_unregistercommand(int pluginHandle, const char* command);\r\nPLUG_IMPEXP void _plugin_logprintf(const char* format, ...);\r\nPLUG_IMPEXP void _plugin_logputs(const char* text);\r\nPLUG_IMPEXP void _plugin_logprint(const char* text);\r\nPLUG_IMPEXP void _plugin_debugpause();\r\nPLUG_IMPEXP void _plugin_debugskipexceptions(bool skip);\r\nPLUG_IMPEXP int _plugin_menuadd(int hMenu, const char* title);\r\nPLUG_IMPEXP bool _plugin_menuaddentry(int hMenu, int hEntry, const char* title);\r\nPLUG_IMPEXP bool _plugin_menuaddseparator(int hMenu);\r\nPLUG_IMPEXP bool _plugin_menuclear(int hMenu);\r\nPLUG_IMPEXP void _plugin_menuseticon(int hMenu, const ICONDATA* icon);\r\nPLUG_IMPEXP void _plugin_menuentryseticon(int pluginHandle, int hEntry, const ICONDATA* icon);\r\nPLUG_IMPEXP void _plugin_menuentrysetchecked(int pluginHandle, int hEntry, bool checked);\r\nPLUG_IMPEXP void _plugin_menusetvisible(int pluginHandle, int hMenu, bool visible);\r\nPLUG_IMPEXP void _plugin_menuentrysetvisible(int pluginHandle, int hEntry, bool visible);\r\nPLUG_IMPEXP void _plugin_menusetname(int pluginHandle, int hMenu, const char* name);\r\nPLUG_IMPEXP void _plugin_menuentrysetname(int pluginHandle, int hEntry, const char* name);\r\nPLUG_IMPEXP void _plugin_menuentrysethotkey(int pluginHandle, int hEntry, const char* hotkey);\r\nPLUG_IMPEXP bool _plugin_menuremove(int hMenu);\r\nPLUG_IMPEXP bool _plugin_menuentryremove(int pluginHandle, int hEntry);\r\nPLUG_IMPEXP void _plugin_startscript(CBPLUGINSCRIPT cbScript);\r\nPLUG_IMPEXP bool _plugin_waituntilpaused();\r\nPLUG_IMPEXP bool _plugin_registerexprfunction(int pluginHandle, const char* name, int argc, CBPLUGINEXPRFUNCTION cbFunction, void* userdata);\r\nPLUG_IMPEXP bool _plugin_unregisterexprfunction(int pluginHandle, const char* name);\r\nPLUG_IMPEXP bool _plugin_unload(const char* pluginName);\r\nPLUG_IMPEXP bool _plugin_load(const char* pluginName);\r\nPLUG_IMPEXP duint _plugin_hash(const void* data, duint size);\r\nPLUG_IMPEXP bool _plugin_registerformatfunction(int pluginHandle, const char* type, CBPLUGINFORMATFUNCTION cbFunction, void* userdata);\r\nPLUG_IMPEXP bool _plugin_unregisterformatfunction(int pluginHandle, const char* type);\r\n\r\n#ifdef __cplusplus\r\n}\r\n#endif\r\n\r\n#pragma pack(pop)\r\n\r\n#endif // _PLUGINS_H\r\n" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/_scriptapi.h", "content": "#ifndef _SCRIPT_API_H\r\n#define _SCRIPT_API_H\r\n\r\n#include \"_plugins.h\"\r\n\r\n#define SCRIPT_EXPORT PLUG_IMPEXP\r\n\r\n#endif //_SCRIPT_API_H" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/_scriptapi_argument.h", "content": "#ifndef _SCRIPTAPI_ARGUMENT_H\r\n#define _SCRIPTAPI_ARGUMENT_H\r\n\r\n#include \"_scriptapi.h\"\r\n\r\nnamespace Script\r\n{\r\n namespace Argument\r\n {\r\n struct ArgumentInfo\r\n {\r\n char mod[MAX_MODULE_SIZE];\r\n duint rvaStart;\r\n duint rvaEnd;\r\n bool manual;\r\n duint instructioncount;\r\n };\r\n\r\n SCRIPT_EXPORT bool Add(duint start, duint end, bool manual, duint instructionCount = 0);\r\n SCRIPT_EXPORT bool Add(const ArgumentInfo* info);\r\n SCRIPT_EXPORT bool Get(duint addr, duint* start = nullptr, duint* end = nullptr, duint* instructionCount = nullptr);\r\n SCRIPT_EXPORT bool GetInfo(duint addr, ArgumentInfo* info);\r\n SCRIPT_EXPORT bool Overlaps(duint start, duint end);\r\n SCRIPT_EXPORT bool Delete(duint address);\r\n SCRIPT_EXPORT void DeleteRange(duint start, duint end, bool deleteManual = false);\r\n SCRIPT_EXPORT void Clear();\r\n SCRIPT_EXPORT bool GetList(ListOf(ArgumentInfo) list); //caller has the responsibility to free the list\r\n }; //Argument\r\n}; //Script\r\n\r\n#endif //_SCRIPTAPI_ARGUMENT_H" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/_scriptapi_assembler.h", "content": "#ifndef _SCRIPTAPI_ASSEMBLER_H\r\n#define _SCRIPTAPI_ASSEMBLER_H\r\n\r\n#include \"_scriptapi.h\"\r\n\r\nnamespace Script\r\n{\r\n namespace Assembler\r\n {\r\n SCRIPT_EXPORT bool Assemble(duint addr, unsigned char* dest, int* size, const char* instruction); //dest[16]\r\n SCRIPT_EXPORT bool AssembleEx(duint addr, unsigned char* dest, int* size, const char* instruction, char* error); //dest[16], error[MAX_ERROR_SIZE]\r\n SCRIPT_EXPORT bool AssembleMem(duint addr, const char* instruction);\r\n SCRIPT_EXPORT bool AssembleMemEx(duint addr, const char* instruction, int* size, char* error, bool fillnop); //error[MAX_ERROR_SIZE]\r\n }; //Assembler\r\n}; //Script\r\n\r\n#endif //_SCRIPTAPI_ASSEMBLER_H" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/_scriptapi_bookmark.h", "content": "#ifndef _SCRIPTAPI_BOOKMARK_H\r\n#define _SCRIPTAPI_BOOKMARK_H\r\n\r\n#include \"_scriptapi.h\"\r\n\r\nnamespace Script\r\n{\r\n namespace Bookmark\r\n {\r\n struct BookmarkInfo\r\n {\r\n char mod[MAX_MODULE_SIZE];\r\n duint rva;\r\n bool manual;\r\n };\r\n\r\n SCRIPT_EXPORT bool Set(duint addr, bool manual = false);\r\n SCRIPT_EXPORT bool Set(const BookmarkInfo* info);\r\n SCRIPT_EXPORT bool Get(duint addr);\r\n SCRIPT_EXPORT bool GetInfo(duint addr, BookmarkInfo* info);\r\n SCRIPT_EXPORT bool Delete(duint addr);\r\n SCRIPT_EXPORT void DeleteRange(duint start, duint end);\r\n SCRIPT_EXPORT void Clear();\r\n SCRIPT_EXPORT bool GetList(ListOf(BookmarkInfo) list); //caller has the responsibility to free the list\r\n }; //Bookmark\r\n}; //Script\r\n\r\n#endif //_SCRIPTAPI_BOOKMARK_H" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/_scriptapi_comment.h", "content": "#ifndef _SCRIPTAPI_COMMENT_H\r\n#define _SCRIPTAPI_COMMENT_H\r\n\r\n#include \"_scriptapi.h\"\r\n\r\nnamespace Script\r\n{\r\n namespace Comment\r\n {\r\n struct CommentInfo\r\n {\r\n char mod[MAX_MODULE_SIZE];\r\n duint rva;\r\n char text[MAX_LABEL_SIZE];\r\n bool manual;\r\n };\r\n\r\n SCRIPT_EXPORT bool Set(duint addr, const char* text, bool manual = false);\r\n SCRIPT_EXPORT bool Set(const CommentInfo* info);\r\n SCRIPT_EXPORT bool Get(duint addr, char* text); //text[MAX_COMMENT_SIZE]\r\n SCRIPT_EXPORT bool GetInfo(duint addr, CommentInfo* info);\r\n SCRIPT_EXPORT bool Delete(duint addr);\r\n SCRIPT_EXPORT void DeleteRange(duint start, duint end);\r\n SCRIPT_EXPORT void Clear();\r\n SCRIPT_EXPORT bool GetList(ListOf(CommentInfo) list); //caller has the responsibility to free the list\r\n }; //Comment\r\n}; //Script\r\n\r\n#endif //_SCRIPTAPI_COMMENT_H" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/_scriptapi_debug.h", "content": "#ifndef _SCRIPTAPI_DEBUG_H\r\n#define _SCRIPTAPI_DEBUG_H\r\n\r\n#include \"_scriptapi.h\"\r\n\r\nnamespace Script\r\n{\r\n namespace Debug\r\n {\r\n enum HardwareType\r\n {\r\n HardwareAccess,\r\n HardwareWrite,\r\n HardwareExecute\r\n };\r\n\r\n SCRIPT_EXPORT void Wait();\r\n SCRIPT_EXPORT void Run();\r\n SCRIPT_EXPORT void Pause();\r\n SCRIPT_EXPORT void Stop();\r\n SCRIPT_EXPORT void StepIn();\r\n SCRIPT_EXPORT void StepOver();\r\n SCRIPT_EXPORT void StepOut();\r\n SCRIPT_EXPORT bool SetBreakpoint(duint address);\r\n SCRIPT_EXPORT bool DeleteBreakpoint(duint address);\r\n SCRIPT_EXPORT bool DisableBreakpoint(duint address);\r\n SCRIPT_EXPORT bool SetHardwareBreakpoint(duint address, HardwareType type = HardwareExecute);\r\n SCRIPT_EXPORT bool DeleteHardwareBreakpoint(duint address);\r\n }; //Debug\r\n}; //Script\r\n\r\n#endif //_SCRIPTAPI_DEBUG_H" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/_scriptapi_flag.h", "content": "#ifndef _SCRIPTAPI_FLAG_H\r\n#define _SCRIPTAPI_FLAG_H\r\n\r\n#include \"_scriptapi.h\"\r\n\r\nnamespace Script\r\n{\r\n namespace Flag\r\n {\r\n enum FlagEnum\r\n {\r\n ZF,\r\n OF,\r\n CF,\r\n PF,\r\n SF,\r\n TF,\r\n AF,\r\n DF,\r\n IF\r\n };\r\n\r\n SCRIPT_EXPORT bool Get(FlagEnum flag);\r\n SCRIPT_EXPORT bool Set(FlagEnum flag, bool value);\r\n\r\n SCRIPT_EXPORT bool GetZF();\r\n SCRIPT_EXPORT bool SetZF(bool value);\r\n SCRIPT_EXPORT bool GetOF();\r\n SCRIPT_EXPORT bool SetOF(bool value);\r\n SCRIPT_EXPORT bool GetCF();\r\n SCRIPT_EXPORT bool SetCF(bool value);\r\n SCRIPT_EXPORT bool GetPF();\r\n SCRIPT_EXPORT bool SetPF(bool value);\r\n SCRIPT_EXPORT bool GetSF();\r\n SCRIPT_EXPORT bool SetSF(bool value);\r\n SCRIPT_EXPORT bool GetTF();\r\n SCRIPT_EXPORT bool SetTF(bool value);\r\n SCRIPT_EXPORT bool GetAF();\r\n SCRIPT_EXPORT bool SetAF(bool value);\r\n SCRIPT_EXPORT bool GetDF();\r\n SCRIPT_EXPORT bool SetDF(bool value);\r\n SCRIPT_EXPORT bool GetIF();\r\n SCRIPT_EXPORT bool SetIF(bool value);\r\n };\r\n};\r\n\r\n#endif //_SCRIPTAPI_FLAG_H" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/_scriptapi_function.h", "content": "#ifndef _SCRIPTAPI_FUNCTION_H\r\n#define _SCRIPTAPI_FUNCTION_H\r\n\r\n#include \"_scriptapi.h\"\r\n\r\nnamespace Script\r\n{\r\n namespace Function\r\n {\r\n struct FunctionInfo\r\n {\r\n char mod[MAX_MODULE_SIZE];\r\n duint rvaStart;\r\n duint rvaEnd;\r\n bool manual;\r\n duint instructioncount;\r\n };\r\n\r\n SCRIPT_EXPORT bool Add(duint start, duint end, bool manual, duint instructionCount = 0);\r\n SCRIPT_EXPORT bool Add(const FunctionInfo* info);\r\n SCRIPT_EXPORT bool Get(duint addr, duint* start = nullptr, duint* end = nullptr, duint* instructionCount = nullptr);\r\n SCRIPT_EXPORT bool GetInfo(duint addr, FunctionInfo* info);\r\n SCRIPT_EXPORT bool Overlaps(duint start, duint end);\r\n SCRIPT_EXPORT bool Delete(duint address);\r\n SCRIPT_EXPORT void DeleteRange(duint start, duint end, bool deleteManual);\r\n SCRIPT_EXPORT void DeleteRange(duint start, duint end);\r\n SCRIPT_EXPORT void Clear();\r\n SCRIPT_EXPORT bool GetList(ListOf(FunctionInfo) list); //caller has the responsibility to free the list\r\n }; //Function\r\n}; //Script\r\n\r\n#endif //_SCRIPTAPI_FUNCTION_H\r\n" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/_scriptapi_gui.h", "content": "#ifndef _SCRIPTAPI_GUI_H\r\n#define _SCRIPTAPI_GUI_H\r\n\r\n#include \"_scriptapi.h\"\r\n\r\nnamespace Script\r\n{\r\n namespace Gui\r\n {\r\n namespace Disassembly\r\n {\r\n SCRIPT_EXPORT bool SelectionGet(duint* start, duint* end);\r\n SCRIPT_EXPORT bool SelectionSet(duint start, duint end);\r\n SCRIPT_EXPORT duint SelectionGetStart();\r\n SCRIPT_EXPORT duint SelectionGetEnd();\r\n }; //Disassembly\r\n\r\n namespace Dump\r\n {\r\n SCRIPT_EXPORT bool SelectionGet(duint* start, duint* end);\r\n SCRIPT_EXPORT bool SelectionSet(duint start, duint end);\r\n SCRIPT_EXPORT duint SelectionGetStart();\r\n SCRIPT_EXPORT duint SelectionGetEnd();\r\n }; //Dump\r\n\r\n namespace Stack\r\n {\r\n SCRIPT_EXPORT bool SelectionGet(duint* start, duint* end);\r\n SCRIPT_EXPORT bool SelectionSet(duint start, duint end);\r\n SCRIPT_EXPORT duint SelectionGetStart();\r\n SCRIPT_EXPORT duint SelectionGetEnd();\r\n }; //Stack\r\n\r\n namespace Graph\r\n {\r\n SCRIPT_EXPORT duint SelectionGetStart();\r\n }; //Graph\r\n\r\n namespace MemMap\r\n {\r\n SCRIPT_EXPORT duint SelectionGetStart();\r\n }; //MemoryMap\r\n\r\n namespace SymMod\r\n {\r\n SCRIPT_EXPORT duint SelectionGetStart();\r\n }; //SymMod\r\n }; //Gui\r\n\r\n namespace Gui\r\n {\r\n enum Window\r\n {\r\n DisassemblyWindow,\r\n DumpWindow,\r\n StackWindow,\r\n GraphWindow,\r\n MemMapWindow,\r\n SymModWindow\r\n };\r\n\r\n SCRIPT_EXPORT bool SelectionGet(Window window, duint* start, duint* end);\r\n SCRIPT_EXPORT bool SelectionSet(Window window, duint start, duint end);\r\n SCRIPT_EXPORT duint SelectionGetStart(Window window);\r\n SCRIPT_EXPORT duint SelectionGetEnd(Window window);\r\n SCRIPT_EXPORT void Message(const char* message);\r\n SCRIPT_EXPORT bool MessageYesNo(const char* message);\r\n SCRIPT_EXPORT bool InputLine(const char* title, char* text); //text[GUI_MAX_LINE_SIZE]\r\n SCRIPT_EXPORT bool InputValue(const char* title, duint* value);\r\n SCRIPT_EXPORT void Refresh();\r\n SCRIPT_EXPORT void AddQWidgetTab(void* qWidget);\r\n SCRIPT_EXPORT void ShowQWidgetTab(void* qWidget);\r\n SCRIPT_EXPORT void CloseQWidgetTab(void* qWidget);\r\n\r\n }; //Gui\r\n}; //Script\r\n\r\n#endif //_SCRIPTAPI_GUI_H" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/_scriptapi_label.h", "content": "#ifndef _SCRIPTAPI_LABEL_H\r\n#define _SCRIPTAPI_LABEL_H\r\n\r\n#include \"_scriptapi.h\"\r\n\r\nnamespace Script\r\n{\r\n namespace Label\r\n {\r\n struct LabelInfo\r\n {\r\n char mod[MAX_MODULE_SIZE];\r\n duint rva;\r\n char text[MAX_LABEL_SIZE];\r\n bool manual;\r\n };\r\n\r\n SCRIPT_EXPORT bool Set(duint addr, const char* text, bool manual = false);\r\n SCRIPT_EXPORT bool Set(const LabelInfo* info);\r\n SCRIPT_EXPORT bool FromString(const char* label, duint* addr);\r\n SCRIPT_EXPORT bool Get(duint addr, char* text); //text[MAX_LABEL_SIZE]\r\n SCRIPT_EXPORT bool GetInfo(duint addr, LabelInfo* info);\r\n SCRIPT_EXPORT bool Delete(duint addr);\r\n SCRIPT_EXPORT void DeleteRange(duint start, duint end);\r\n SCRIPT_EXPORT void Clear();\r\n SCRIPT_EXPORT bool GetList(ListOf(LabelInfo) list); //caller has the responsibility to free the list\r\n }; //Label\r\n}; //Script\r\n\r\n#endif //_SCRIPTAPI_LABEL_H" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/_scriptapi_memory.h", "content": "#ifndef _SCRIPTAPI_MEMORY_H\r\n#define _SCRIPTAPI_MEMORY_H\r\n\r\n#include \"_scriptapi.h\"\r\n\r\nnamespace Script\r\n{\r\n namespace Memory\r\n {\r\n SCRIPT_EXPORT bool Read(duint addr, void* data, duint size, duint* sizeRead);\r\n SCRIPT_EXPORT bool Write(duint addr, const void* data, duint size, duint* sizeWritten);\r\n SCRIPT_EXPORT bool IsValidPtr(duint addr);\r\n SCRIPT_EXPORT duint RemoteAlloc(duint addr, duint size);\r\n SCRIPT_EXPORT bool RemoteFree(duint addr);\r\n SCRIPT_EXPORT unsigned int GetProtect(duint addr, bool reserved = false, bool cache = true);\r\n SCRIPT_EXPORT duint GetBase(duint addr, bool reserved = false, bool cache = true);\r\n SCRIPT_EXPORT duint GetSize(duint addr, bool reserved = false, bool cache = true);\r\n\r\n SCRIPT_EXPORT unsigned char ReadByte(duint addr);\r\n SCRIPT_EXPORT bool WriteByte(duint addr, unsigned char data);\r\n SCRIPT_EXPORT unsigned short ReadWord(duint addr);\r\n SCRIPT_EXPORT bool WriteWord(duint addr, unsigned short data);\r\n SCRIPT_EXPORT unsigned int ReadDword(duint addr);\r\n SCRIPT_EXPORT bool WriteDword(duint addr, unsigned int data);\r\n SCRIPT_EXPORT unsigned long long ReadQword(duint addr);\r\n SCRIPT_EXPORT bool WriteQword(duint addr, unsigned long long data);\r\n SCRIPT_EXPORT duint ReadPtr(duint addr);\r\n SCRIPT_EXPORT bool WritePtr(duint addr, duint data);\r\n }; //Memory\r\n}; //Script\r\n\r\n#endif //_SCRIPTAPI_MEMORY_H" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/_scriptapi_misc.h", "content": "#ifndef _SCRIPTAPI_MISC_H\r\n#define _SCRIPTAPI_MISC_H\r\n\r\n#include \"_scriptapi.h\"\r\n\r\nnamespace Script\r\n{\r\n namespace Misc\r\n {\r\n /// \r\n /// Evaluates an expression and returns the result. Analagous to using the Command field in x64dbg.\r\n ///\r\n /// Expressions can consist of memory locations, registers, flags, API names, labels, symbols, variables etc.\r\n ///\r\n /// Example: bool success = ParseExpression(\"[esp+8]\", &val)\r\n /// \r\n /// The expression to evaluate.\r\n /// The result of the expression.\r\n /// True on success, False on failure.\r\n SCRIPT_EXPORT bool ParseExpression(const char* expression, duint* value);\r\n\r\n /// \r\n /// Returns the address of a function in the debuggee's memory space.\r\n ///\r\n /// Example: duint addr = RemoteGetProcAddress(\"kernel32.dll\", \"GetProcAddress\")\r\n /// \r\n /// The name of the module.\r\n /// The name of the function.\r\n /// The address of the function in the debuggee.\r\n SCRIPT_EXPORT duint RemoteGetProcAddress(const char* module, const char* api);\r\n\r\n /// \r\n /// Returns the address for a label created in the disassembly window.\r\n ///\r\n /// Example: duint addr = ResolveLabel(\"sneaky_crypto\")\r\n /// \r\n /// The name of the label to resolve.\r\n /// The memory address for the label.\r\n SCRIPT_EXPORT duint ResolveLabel(const char* label);\r\n\r\n /// \r\n /// Allocates the requested number of bytes from x64dbg's default process heap.\r\n ///\r\n /// Note: this allocation is in the debugger, not the debuggee.\r\n ///\r\n /// Memory allocated using this function should be Free'd after use.\r\n ///\r\n /// Example: void* addr = Alloc(0x100000)\r\n /// \r\n /// Number of bytes to allocate.\r\n /// A pointer to the newly allocated memory.\r\n SCRIPT_EXPORT void* Alloc(duint size);\r\n\r\n /// \r\n /// Frees memory previously allocated by Alloc.\r\n ///\r\n /// Example: Free(addr)\r\n /// \r\n /// Pointer returned by Alloc.\r\n /// Nothing.\r\n SCRIPT_EXPORT void Free(void* ptr);\r\n }; //Misc\r\n}; //Script\r\n\r\n#endif //_SCRIPTAPI_MISC_H" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/_scriptapi_module.h", "content": "#ifndef _SCRIPTAPI_MODULE_H\r\n#define _SCRIPTAPI_MODULE_H\r\n\r\n#include \"_scriptapi.h\"\r\n\r\nnamespace Script\r\n{\r\n namespace Module\r\n {\r\n struct ModuleInfo\r\n {\r\n duint base;\r\n duint size;\r\n duint entry;\r\n int sectionCount;\r\n char name[MAX_MODULE_SIZE];\r\n char path[MAX_PATH];\r\n };\r\n\r\n struct ModuleSectionInfo\r\n {\r\n duint addr;\r\n duint size;\r\n char name[MAX_SECTION_SIZE * 5];\r\n };\r\n\r\n SCRIPT_EXPORT bool InfoFromAddr(duint addr, ModuleInfo* info);\r\n SCRIPT_EXPORT bool InfoFromName(const char* name, ModuleInfo* info);\r\n SCRIPT_EXPORT duint BaseFromAddr(duint addr);\r\n SCRIPT_EXPORT duint BaseFromName(const char* name);\r\n SCRIPT_EXPORT duint SizeFromAddr(duint addr);\r\n SCRIPT_EXPORT duint SizeFromName(const char* name);\r\n SCRIPT_EXPORT bool NameFromAddr(duint addr, char* name); //name[MAX_MODULE_SIZE]\r\n SCRIPT_EXPORT bool PathFromAddr(duint addr, char* path); //path[MAX_PATH]\r\n SCRIPT_EXPORT bool PathFromName(const char* name, char* path); //path[MAX_PATH]\r\n SCRIPT_EXPORT duint EntryFromAddr(duint addr);\r\n SCRIPT_EXPORT duint EntryFromName(const char* name);\r\n SCRIPT_EXPORT int SectionCountFromAddr(duint addr);\r\n SCRIPT_EXPORT int SectionCountFromName(const char* name);\r\n SCRIPT_EXPORT bool SectionFromAddr(duint addr, int number, ModuleSectionInfo* section);\r\n SCRIPT_EXPORT bool SectionFromName(const char* name, int number, ModuleSectionInfo* section);\r\n SCRIPT_EXPORT bool SectionListFromAddr(duint addr, ListOf(ModuleSectionInfo) list);\r\n SCRIPT_EXPORT bool SectionListFromName(const char* name, ListOf(ModuleSectionInfo) list);\r\n SCRIPT_EXPORT bool GetMainModuleInfo(ModuleInfo* info);\r\n SCRIPT_EXPORT duint GetMainModuleBase();\r\n SCRIPT_EXPORT duint GetMainModuleSize();\r\n SCRIPT_EXPORT duint GetMainModuleEntry();\r\n SCRIPT_EXPORT int GetMainModuleSectionCount();\r\n SCRIPT_EXPORT bool GetMainModuleName(char* name); //name[MAX_MODULE_SIZE]\r\n SCRIPT_EXPORT bool GetMainModulePath(char* path); //path[MAX_PATH]\r\n SCRIPT_EXPORT bool GetMainModuleSectionList(ListOf(ModuleSectionInfo) list); //caller has the responsibility to free the list\r\n SCRIPT_EXPORT bool GetList(ListOf(ModuleInfo) list); //caller has the responsibility to free the list\r\n }; //Module\r\n}; //Script\r\n\r\n#endif //_SCRIPTAPI_MODULE_H" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/_scriptapi_pattern.h", "content": "#ifndef _SCRIPTAPI_PATTERN_H\r\n#define _SCRIPTAPI_PATTERN_H\r\n\r\n#include \"_scriptapi.h\"\r\n\r\nnamespace Script\r\n{\r\n namespace Pattern\r\n {\r\n SCRIPT_EXPORT duint Find(unsigned char* data, duint datasize, const char* pattern);\r\n SCRIPT_EXPORT duint FindMem(duint start, duint size, const char* pattern);\r\n SCRIPT_EXPORT void Write(unsigned char* data, duint datasize, const char* pattern);\r\n SCRIPT_EXPORT void WriteMem(duint start, duint size, const char* pattern);\r\n SCRIPT_EXPORT bool SearchAndReplace(unsigned char* data, duint datasize, const char* searchpattern, const char* replacepattern);\r\n SCRIPT_EXPORT bool SearchAndReplaceMem(duint start, duint size, const char* searchpattern, const char* replacepattern);\r\n };\r\n};\r\n\r\n#endif //_SCRIPTAPI_FIND_H" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/_scriptapi_register.h", "content": "#ifndef _SCRIPTAPI_REGISTER_H\r\n#define _SCRIPTAPI_REGISTER_H\r\n\r\n#include \"_scriptapi.h\"\r\n\r\nnamespace Script\r\n{\r\n namespace Register\r\n {\r\n enum RegisterEnum\r\n {\r\n DR0,\r\n DR1,\r\n DR2,\r\n DR3,\r\n DR6,\r\n DR7,\r\n\r\n EAX,\r\n AX,\r\n AH,\r\n AL,\r\n EBX,\r\n BX,\r\n BH,\r\n BL,\r\n ECX,\r\n CX,\r\n CH,\r\n CL,\r\n EDX,\r\n DX,\r\n DH,\r\n DL,\r\n EDI,\r\n DI,\r\n ESI,\r\n SI,\r\n EBP,\r\n BP,\r\n ESP,\r\n SP,\r\n EIP,\r\n\r\n#ifdef _WIN64\r\n RAX,\r\n RBX,\r\n RCX,\r\n RDX,\r\n RSI,\r\n SIL,\r\n RDI,\r\n DIL,\r\n RBP,\r\n BPL,\r\n RSP,\r\n SPL,\r\n RIP,\r\n R8,\r\n R8D,\r\n R8W,\r\n R8B,\r\n R9,\r\n R9D,\r\n R9W,\r\n R9B,\r\n R10,\r\n R10D,\r\n R10W,\r\n R10B,\r\n R11,\r\n R11D,\r\n R11W,\r\n R11B,\r\n R12,\r\n R12D,\r\n R12W,\r\n R12B,\r\n R13,\r\n R13D,\r\n R13W,\r\n R13B,\r\n R14,\r\n R14D,\r\n R14W,\r\n R14B,\r\n R15,\r\n R15D,\r\n R15W,\r\n R15B,\r\n#endif //_WIN64\r\n\r\n CIP,\r\n CSP,\r\n CAX,\r\n CBX,\r\n CCX,\r\n CDX,\r\n CDI,\r\n CSI,\r\n CBP,\r\n CFLAGS\r\n }; //RegisterEnum\r\n\r\n SCRIPT_EXPORT duint Get(RegisterEnum reg);\r\n SCRIPT_EXPORT bool Set(RegisterEnum reg, duint value);\r\n SCRIPT_EXPORT int Size(); //gets architecture register size in bytes\r\n\r\n SCRIPT_EXPORT duint GetDR0();\r\n SCRIPT_EXPORT bool SetDR0(duint value);\r\n SCRIPT_EXPORT duint GetDR1();\r\n SCRIPT_EXPORT bool SetDR1(duint value);\r\n SCRIPT_EXPORT duint GetDR2();\r\n SCRIPT_EXPORT bool SetDR2(duint value);\r\n SCRIPT_EXPORT duint GetDR3();\r\n SCRIPT_EXPORT bool SetDR3(duint value);\r\n SCRIPT_EXPORT duint GetDR6();\r\n SCRIPT_EXPORT bool SetDR6(duint value);\r\n SCRIPT_EXPORT duint GetDR7();\r\n SCRIPT_EXPORT bool SetDR7(duint value);\r\n\r\n SCRIPT_EXPORT unsigned int GetEAX();\r\n SCRIPT_EXPORT bool SetEAX(unsigned int value);\r\n SCRIPT_EXPORT unsigned short GetAX();\r\n SCRIPT_EXPORT bool SetAX(unsigned short value);\r\n SCRIPT_EXPORT unsigned char GetAH();\r\n SCRIPT_EXPORT bool SetAH(unsigned char value);\r\n SCRIPT_EXPORT unsigned char GetAL();\r\n SCRIPT_EXPORT bool SetAL(unsigned char value);\r\n SCRIPT_EXPORT unsigned int GetEBX();\r\n SCRIPT_EXPORT bool SetEBX(unsigned int value);\r\n SCRIPT_EXPORT unsigned short GetBX();\r\n SCRIPT_EXPORT bool SetBX(unsigned short value);\r\n SCRIPT_EXPORT unsigned char GetBH();\r\n SCRIPT_EXPORT bool SetBH(unsigned char value);\r\n SCRIPT_EXPORT unsigned char GetBL();\r\n SCRIPT_EXPORT bool SetBL(unsigned char value);\r\n SCRIPT_EXPORT unsigned int GetECX();\r\n SCRIPT_EXPORT bool SetECX(unsigned int value);\r\n SCRIPT_EXPORT unsigned short GetCX();\r\n SCRIPT_EXPORT bool SetCX(unsigned short value);\r\n SCRIPT_EXPORT unsigned char GetCH();\r\n SCRIPT_EXPORT bool SetCH(unsigned char value);\r\n SCRIPT_EXPORT unsigned char GetCL();\r\n SCRIPT_EXPORT bool SetCL(unsigned char value);\r\n SCRIPT_EXPORT unsigned int GetEDX();\r\n SCRIPT_EXPORT bool SetEDX(unsigned int value);\r\n SCRIPT_EXPORT unsigned short GetDX();\r\n SCRIPT_EXPORT bool SetDX(unsigned short value);\r\n SCRIPT_EXPORT unsigned char GetDH();\r\n SCRIPT_EXPORT bool SetDH(unsigned char value);\r\n SCRIPT_EXPORT unsigned char GetDL();\r\n SCRIPT_EXPORT bool SetDL(unsigned char value);\r\n SCRIPT_EXPORT unsigned int GetEDI();\r\n SCRIPT_EXPORT bool SetEDI(unsigned int value);\r\n SCRIPT_EXPORT unsigned short GetDI();\r\n SCRIPT_EXPORT bool SetDI(unsigned short value);\r\n SCRIPT_EXPORT unsigned int GetESI();\r\n SCRIPT_EXPORT bool SetESI(unsigned int value);\r\n SCRIPT_EXPORT unsigned short GetSI();\r\n SCRIPT_EXPORT bool SetSI(unsigned short value);\r\n SCRIPT_EXPORT unsigned int GetEBP();\r\n SCRIPT_EXPORT bool SetEBP(unsigned int value);\r\n SCRIPT_EXPORT unsigned short GetBP();\r\n SCRIPT_EXPORT bool SetBP(unsigned short value);\r\n SCRIPT_EXPORT unsigned int GetESP();\r\n SCRIPT_EXPORT bool SetESP(unsigned int value);\r\n SCRIPT_EXPORT unsigned short GetSP();\r\n SCRIPT_EXPORT bool SetSP(unsigned short value);\r\n SCRIPT_EXPORT unsigned int GetEIP();\r\n SCRIPT_EXPORT bool SetEIP(unsigned int value);\r\n\r\n#ifdef _WIN64\r\n SCRIPT_EXPORT unsigned long long GetRAX();\r\n SCRIPT_EXPORT bool SetRAX(unsigned long long value);\r\n SCRIPT_EXPORT unsigned long long GetRBX();\r\n SCRIPT_EXPORT bool SetRBX(unsigned long long value);\r\n SCRIPT_EXPORT unsigned long long GetRCX();\r\n SCRIPT_EXPORT bool SetRCX(unsigned long long value);\r\n SCRIPT_EXPORT unsigned long long GetRDX();\r\n SCRIPT_EXPORT bool SetRDX(unsigned long long value);\r\n SCRIPT_EXPORT unsigned long long GetRSI();\r\n SCRIPT_EXPORT bool SetRSI(unsigned long long value);\r\n SCRIPT_EXPORT unsigned char GetSIL();\r\n SCRIPT_EXPORT bool SetSIL(unsigned char value);\r\n SCRIPT_EXPORT unsigned long long GetRDI();\r\n SCRIPT_EXPORT bool SetRDI(unsigned long long value);\r\n SCRIPT_EXPORT unsigned char GetDIL();\r\n SCRIPT_EXPORT bool SetDIL(unsigned char value);\r\n SCRIPT_EXPORT unsigned long long GetRBP();\r\n SCRIPT_EXPORT bool SetRBP(unsigned long long value);\r\n SCRIPT_EXPORT unsigned char GetBPL();\r\n SCRIPT_EXPORT bool SetBPL(unsigned char value);\r\n SCRIPT_EXPORT unsigned long long GetRSP();\r\n SCRIPT_EXPORT bool SetRSP(unsigned long long value);\r\n SCRIPT_EXPORT unsigned char GetSPL();\r\n SCRIPT_EXPORT bool SetSPL(unsigned char value);\r\n SCRIPT_EXPORT unsigned long long GetRIP();\r\n SCRIPT_EXPORT bool SetRIP(unsigned long long value);\r\n SCRIPT_EXPORT unsigned long long GetR8();\r\n SCRIPT_EXPORT bool SetR8(unsigned long long value);\r\n SCRIPT_EXPORT unsigned int GetR8D();\r\n SCRIPT_EXPORT bool SetR8D(unsigned int value);\r\n SCRIPT_EXPORT unsigned short GetR8W();\r\n SCRIPT_EXPORT bool SetR8W(unsigned short value);\r\n SCRIPT_EXPORT unsigned char GetR8B();\r\n SCRIPT_EXPORT bool SetR8B(unsigned char value);\r\n SCRIPT_EXPORT unsigned long long GetR9();\r\n SCRIPT_EXPORT bool SetR9(unsigned long long value);\r\n SCRIPT_EXPORT unsigned int GetR9D();\r\n SCRIPT_EXPORT bool SetR9D(unsigned int value);\r\n SCRIPT_EXPORT unsigned short GetR9W();\r\n SCRIPT_EXPORT bool SetR9W(unsigned short value);\r\n SCRIPT_EXPORT unsigned char GetR9B();\r\n SCRIPT_EXPORT bool SetR9B(unsigned char value);\r\n SCRIPT_EXPORT unsigned long long GetR10();\r\n SCRIPT_EXPORT bool SetR10(unsigned long long value);\r\n SCRIPT_EXPORT unsigned int GetR10D();\r\n SCRIPT_EXPORT bool SetR10D(unsigned int value);\r\n SCRIPT_EXPORT unsigned short GetR10W();\r\n SCRIPT_EXPORT bool SetR10W(unsigned short value);\r\n SCRIPT_EXPORT unsigned char GetR10B();\r\n SCRIPT_EXPORT bool SetR10B(unsigned char value);\r\n SCRIPT_EXPORT unsigned long long GetR11();\r\n SCRIPT_EXPORT bool SetR11(unsigned long long value);\r\n SCRIPT_EXPORT unsigned int GetR11D();\r\n SCRIPT_EXPORT bool SetR11D(unsigned int value);\r\n SCRIPT_EXPORT unsigned short GetR11W();\r\n SCRIPT_EXPORT bool SetR11W(unsigned short value);\r\n SCRIPT_EXPORT unsigned char GetR11B();\r\n SCRIPT_EXPORT bool SetR11B(unsigned char value);\r\n SCRIPT_EXPORT unsigned long long GetR12();\r\n SCRIPT_EXPORT bool SetR12(unsigned long long value);\r\n SCRIPT_EXPORT unsigned int GetR12D();\r\n SCRIPT_EXPORT bool SetR12D(unsigned int value);\r\n SCRIPT_EXPORT unsigned short GetR12W();\r\n SCRIPT_EXPORT bool SetR12W(unsigned short value);\r\n SCRIPT_EXPORT unsigned char GetR12B();\r\n SCRIPT_EXPORT bool SetR12B(unsigned char value);\r\n SCRIPT_EXPORT unsigned long long GetR13();\r\n SCRIPT_EXPORT bool SetR13(unsigned long long value);\r\n SCRIPT_EXPORT unsigned int GetR13D();\r\n SCRIPT_EXPORT bool SetR13D(unsigned int value);\r\n SCRIPT_EXPORT unsigned short GetR13W();\r\n SCRIPT_EXPORT bool SetR13W(unsigned short value);\r\n SCRIPT_EXPORT unsigned char GetR13B();\r\n SCRIPT_EXPORT bool SetR13B(unsigned char value);\r\n SCRIPT_EXPORT unsigned long long GetR14();\r\n SCRIPT_EXPORT bool SetR14(unsigned long long value);\r\n SCRIPT_EXPORT unsigned int GetR14D();\r\n SCRIPT_EXPORT bool SetR14D(unsigned int value);\r\n SCRIPT_EXPORT unsigned short GetR14W();\r\n SCRIPT_EXPORT bool SetR14W(unsigned short value);\r\n SCRIPT_EXPORT unsigned char GetR14B();\r\n SCRIPT_EXPORT bool SetR14B(unsigned char value);\r\n SCRIPT_EXPORT unsigned long long GetR15();\r\n SCRIPT_EXPORT bool SetR15(unsigned long long value);\r\n SCRIPT_EXPORT unsigned int GetR15D();\r\n SCRIPT_EXPORT bool SetR15D(unsigned int value);\r\n SCRIPT_EXPORT unsigned short GetR15W();\r\n SCRIPT_EXPORT bool SetR15W(unsigned short value);\r\n SCRIPT_EXPORT unsigned char GetR15B();\r\n SCRIPT_EXPORT bool SetR15B(unsigned char value);\r\n#endif //_WIN64\r\n\r\n SCRIPT_EXPORT duint GetCAX();\r\n SCRIPT_EXPORT bool SetCAX(duint value);\r\n SCRIPT_EXPORT duint GetCBX();\r\n SCRIPT_EXPORT bool SetCBX(duint value);\r\n SCRIPT_EXPORT duint GetCCX();\r\n SCRIPT_EXPORT bool SetCCX(duint value);\r\n SCRIPT_EXPORT duint GetCDX();\r\n SCRIPT_EXPORT bool SetCDX(duint value);\r\n SCRIPT_EXPORT duint GetCDI();\r\n SCRIPT_EXPORT bool SetCDI(duint value);\r\n SCRIPT_EXPORT duint GetCSI();\r\n SCRIPT_EXPORT bool SetCSI(duint value);\r\n SCRIPT_EXPORT duint GetCBP();\r\n SCRIPT_EXPORT bool SetCBP(duint value);\r\n SCRIPT_EXPORT duint GetCSP();\r\n SCRIPT_EXPORT bool SetCSP(duint value);\r\n SCRIPT_EXPORT duint GetCIP();\r\n SCRIPT_EXPORT bool SetCIP(duint value);\r\n SCRIPT_EXPORT duint GetCFLAGS();\r\n SCRIPT_EXPORT bool SetCFLAGS(duint value);\r\n }; //Register\r\n}; //Script\r\n\r\n#endif //_SCRIPTAPI_REGISTER_H" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/_scriptapi_stack.h", "content": "#ifndef _SCRIPTAPI_STACK_H\r\n#define _SCRIPTAPI_STACK_H\r\n\r\n#include \"_scriptapi.h\"\r\n\r\nnamespace Script\r\n{\r\n namespace Stack\r\n {\r\n SCRIPT_EXPORT duint Pop();\r\n SCRIPT_EXPORT duint Push(duint value); //returns the previous top, equal to Peek(1)\r\n SCRIPT_EXPORT duint Peek(int offset = 0); //offset is in multiples of Register::Size(), for easy x32/x64 portability\r\n }; //Stack\r\n}; //Script\r\n\r\n#endif //_SCRIPTAPI_STACK_H" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/_scriptapi_symbol.h", "content": "#ifndef _SCRIPTAPI_SYMBOL_H\r\n#define _SCRIPTAPI_SYMBOL_H\r\n\r\n#include \"_scriptapi.h\"\r\n\r\nnamespace Script\r\n{\r\n namespace Symbol\r\n {\r\n enum SymbolType\r\n {\r\n Function, //user-defined function\r\n Import, //IAT entry\r\n Export //export\r\n };\r\n\r\n struct SymbolInfo\r\n {\r\n char mod[MAX_MODULE_SIZE];\r\n duint rva;\r\n char name[MAX_LABEL_SIZE];\r\n bool manual;\r\n SymbolType type;\r\n };\r\n\r\n SCRIPT_EXPORT bool GetList(ListOf(SymbolInfo) list); //caller has the responsibility to free the list\r\n }; //Symbol\r\n}; //Script\r\n\r\n#endif //_SCRIPTAPI_SYMBOL_H" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/bridgegraph.h", "content": "#ifndef _GRAPH_H\r\n#define _GRAPH_H\r\n\r\ntypedef struct\r\n{\r\n duint addr; //virtual address of the instruction\r\n unsigned char data[15]; //instruction bytes\r\n} BridgeCFInstruction;\r\n\r\ntypedef struct\r\n{\r\n duint parentGraph; //function of which this node is a part\r\n duint start; //start of the block\r\n duint end; //end of the block (inclusive)\r\n duint brtrue; //destination if condition is true\r\n duint brfalse; //destination if condition is false\r\n duint icount; //number of instructions in node\r\n bool terminal; //node is a RET\r\n bool split; //node is a split (brtrue points to the next node)\r\n bool indirectcall; //node contains indirect calls (call reg, call [reg+X])\r\n void* userdata; //user data\r\n ListInfo exits; //exits (including brtrue and brfalse, duint)\r\n ListInfo instrs; //block instructions\r\n} BridgeCFNodeList;\r\n\r\ntypedef struct\r\n{\r\n duint entryPoint; //graph entry point\r\n void* userdata; //user data\r\n ListInfo nodes; //graph nodes (BridgeCFNodeList)\r\n} BridgeCFGraphList;\r\n\r\n#ifdef __cplusplus\r\n#if _MSC_VER >= 1700 && !defined(NO_CPP11)\r\n\r\n#include \r\n#include \r\n#include \r\n#include \r\n\r\nstruct BridgeCFNode\r\n{\r\n duint parentGraph; //function of which this node is a part\r\n duint start; //start of the block\r\n duint end; //end of the block (inclusive)\r\n duint brtrue; //destination if condition is true\r\n duint brfalse; //destination if condition is false\r\n duint icount; //number of instructions in node\r\n bool terminal; //node is a RET\r\n bool split; //node is a split (brtrue points to the next node)\r\n bool indirectcall; //node contains indirect calls (call reg, call [reg+X])\r\n void* userdata; //user data\r\n std::vector exits; //exits (including brtrue and brfalse)\r\n std::vector instrs; //block instructions\r\n\r\n static void Free(const BridgeCFNodeList* nodeList)\r\n {\r\n if(!BridgeList::Free(&nodeList->exits))\r\n __debugbreak();\r\n if(!BridgeList::Free(&nodeList->instrs))\r\n __debugbreak();\r\n }\r\n\r\n explicit BridgeCFNode(const BridgeCFNodeList* nodeList, bool freedata)\r\n {\r\n if(!nodeList)\r\n __debugbreak();\r\n parentGraph = nodeList->parentGraph;\r\n start = nodeList->start;\r\n end = nodeList->end;\r\n brtrue = nodeList->brtrue;\r\n brfalse = nodeList->brfalse;\r\n icount = nodeList->icount;\r\n terminal = nodeList->terminal;\r\n indirectcall = nodeList->indirectcall;\r\n split = nodeList->split;\r\n userdata = nodeList->userdata;\r\n if(!BridgeList::ToVector(&nodeList->exits, exits, freedata))\r\n __debugbreak();\r\n if(!BridgeList::ToVector(&nodeList->instrs, instrs, freedata))\r\n __debugbreak();\r\n }\r\n\r\n explicit BridgeCFNode(duint parentGraph, duint start, duint end)\r\n : parentGraph(parentGraph),\r\n start(start),\r\n end(end),\r\n brtrue(0),\r\n brfalse(0),\r\n icount(0),\r\n terminal(false),\r\n indirectcall(false),\r\n split(false),\r\n userdata(nullptr)\r\n {\r\n }\r\n\r\n explicit BridgeCFNode()\r\n : parentGraph(0),\r\n start(0),\r\n end(0),\r\n brtrue(0),\r\n brfalse(0),\r\n icount(0),\r\n terminal(false),\r\n split(false),\r\n userdata(nullptr)\r\n {\r\n }\r\n\r\n BridgeCFNodeList ToNodeList() const\r\n {\r\n BridgeCFNodeList out;\r\n out.parentGraph = parentGraph;\r\n out.start = start;\r\n out.end = end;\r\n out.brtrue = brtrue;\r\n out.brfalse = brfalse;\r\n out.icount = icount;\r\n out.terminal = terminal;\r\n out.indirectcall = indirectcall;\r\n out.split = split;\r\n out.userdata = userdata;\r\n BridgeList::CopyData(&out.exits, exits);\r\n BridgeList::CopyData(&out.instrs, instrs);\r\n return std::move(out);\r\n }\r\n};\r\n\r\nstruct BridgeCFGraph\r\n{\r\n duint entryPoint; //graph entry point\r\n void* userdata; //user data\r\n std::unordered_map nodes; //CFNode.start -> CFNode\r\n std::unordered_map> parents; //CFNode.start -> parents\r\n\r\n static void Free(const BridgeCFGraphList* graphList)\r\n {\r\n if(!graphList || graphList->nodes.size != graphList->nodes.count * sizeof(BridgeCFNodeList))\r\n __debugbreak();\r\n auto data = (BridgeCFNodeList*)graphList->nodes.data;\r\n for(int i = 0; i < graphList->nodes.count; i++)\r\n BridgeCFNode::Free(&data[i]);\r\n BridgeFree(data);\r\n }\r\n\r\n explicit BridgeCFGraph(const BridgeCFGraphList* graphList, bool freedata)\r\n {\r\n if(!graphList || graphList->nodes.size != graphList->nodes.count * sizeof(BridgeCFNodeList))\r\n __debugbreak();\r\n entryPoint = graphList->entryPoint;\r\n userdata = graphList->userdata;\r\n auto data = (BridgeCFNodeList*)graphList->nodes.data;\r\n for(int i = 0; i < graphList->nodes.count; i++)\r\n AddNode(BridgeCFNode(&data[i], freedata));\r\n if(freedata && data)\r\n BridgeFree(data);\r\n }\r\n\r\n explicit BridgeCFGraph(duint entryPoint)\r\n : entryPoint(entryPoint),\r\n userdata(nullptr)\r\n {\r\n }\r\n\r\n void AddNode(const BridgeCFNode & node)\r\n {\r\n nodes[node.start] = node;\r\n AddParent(node.start, node.brtrue);\r\n AddParent(node.start, node.brfalse);\r\n }\r\n\r\n void AddParent(duint child, duint parent)\r\n {\r\n if(!child || !parent)\r\n return;\r\n auto found = parents.find(child);\r\n if(found == parents.end())\r\n {\r\n parents[child] = std::unordered_set();\r\n parents[child].insert(parent);\r\n }\r\n else\r\n found->second.insert(parent);\r\n }\r\n\r\n BridgeCFGraphList ToGraphList() const\r\n {\r\n BridgeCFGraphList out;\r\n out.entryPoint = entryPoint;\r\n out.userdata = userdata;\r\n std::vector nodeList;\r\n nodeList.reserve(nodes.size());\r\n for(const auto & nodeIt : nodes)\r\n nodeList.push_back(nodeIt.second.ToNodeList());\r\n BridgeList::CopyData(&out.nodes, nodeList);\r\n return std::move(out);\r\n }\r\n};\r\n\r\n#endif //_MSC_VER\r\n#endif //__cplusplus\r\n\r\n#endif //_GRAPH_H" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/bridgelist.h", "content": "#ifndef _LIST_H\r\n#define _LIST_H\r\n\r\ntypedef struct\r\n{\r\n int count; //Number of element in the list.\r\n size_t size; //Size of list in bytes (used for type checking).\r\n void* data; //Pointer to the list contents. Must be deleted by the caller using BridgeFree (or BridgeList::Free).\r\n} ListInfo;\r\n\r\n#define ListOf(Type) ListInfo*\r\n\r\n#ifdef __cplusplus\r\n\r\n#include \r\n\r\n/**\r\n\\brief A list object. This object is NOT thread safe.\r\n\\tparam Type BridgeList contents type.\r\n*/\r\ntemplate\r\nclass BridgeList\r\n{\r\npublic:\r\n /**\r\n \\brief BridgeList constructor.\r\n \\param _freeData (Optional) the free function.\r\n */\r\n explicit BridgeList()\r\n {\r\n memset(&_listInfo, 0, sizeof(_listInfo));\r\n }\r\n\r\n /**\r\n \\brief BridgeList destructor.\r\n */\r\n ~BridgeList()\r\n {\r\n Cleanup();\r\n }\r\n\r\n /**\r\n \\brief Gets the list data.\r\n \\return Returns ListInfo->data. Can be null if the list was never initialized. Will be destroyed once this object goes out of scope!\r\n */\r\n Type* Data() const\r\n {\r\n return reinterpret_cast(_listInfo.data);\r\n }\r\n\r\n /**\r\n \\brief Gets the number of elements in the list. This will crash the program if the data is not consistent with the specified template argument.\r\n \\return The number of elements in the list.\r\n */\r\n int Count() const\r\n {\r\n if(_listInfo.size != _listInfo.count * sizeof(Type)) //make sure the user is using the correct type.\r\n __debugbreak();\r\n return _listInfo.count;\r\n }\r\n\r\n /**\r\n \\brief Cleans up the list, freeing the list data when it is not null.\r\n */\r\n void Cleanup()\r\n {\r\n if(_listInfo.data)\r\n {\r\n BridgeFree(_listInfo.data);\r\n _listInfo.data = nullptr;\r\n }\r\n }\r\n\r\n /**\r\n \\brief Reference operator (cleans up the previous list)\r\n \\return Pointer to the ListInfo.\r\n */\r\n ListInfo* operator&()\r\n {\r\n Cleanup();\r\n return &_listInfo;\r\n }\r\n\r\n /**\r\n \\brief Array indexer operator. This will crash if you try to access out-of-bounds.\r\n \\param index Zero-based index of the item you want to get.\r\n \\return Reference to a value at that index.\r\n */\r\n Type & operator[](size_t index) const\r\n {\r\n if(index >= size_t(Count())) //make sure the out-of-bounds access is caught as soon as possible.\r\n __debugbreak();\r\n return Data()[index];\r\n }\r\n\r\n /**\r\n \\brief Copies data to a ListInfo structure..\r\n \\param [out] listInfo If non-null, information describing the list.\r\n \\param listData Data to copy in the ListInfo structure.\r\n \\return true if it succeeds, false if it fails.\r\n */\r\n static bool CopyData(ListInfo* listInfo, const std::vector & listData)\r\n {\r\n if(!listInfo)\r\n return false;\r\n listInfo->count = int(listData.size());\r\n listInfo->size = listInfo->count * sizeof(Type);\r\n if(listInfo->count)\r\n {\r\n listInfo->data = BridgeAlloc(listInfo->size);\r\n Type* curItem = reinterpret_cast(listInfo->data);\r\n for(const auto & item : listData)\r\n {\r\n *curItem = item;\r\n ++curItem;\r\n }\r\n }\r\n else\r\n listInfo->data = nullptr;\r\n return true;\r\n }\r\n\r\n static bool Free(const ListInfo* listInfo)\r\n {\r\n if(!listInfo || listInfo->size != listInfo->count * sizeof(Type) || (listInfo->count && !listInfo->data))\r\n return false;\r\n BridgeFree(listInfo->data);\r\n return true;\r\n }\r\n\r\n static bool ToVector(const ListInfo* listInfo, std::vector & listData, bool freedata = true)\r\n {\r\n if(!listInfo || listInfo->size != listInfo->count * sizeof(Type) || (listInfo->count && !listInfo->data))\r\n return false;\r\n listData.resize(listInfo->count);\r\n for(int i = 0; i < listInfo->count; i++)\r\n listData[i] = ((Type*)listInfo->data)[i];\r\n if(freedata && listInfo->data)\r\n BridgeFree(listInfo->data);\r\n return true;\r\n }\r\n\r\nprivate:\r\n ListInfo _listInfo;\r\n};\r\n\r\n#endif //__cplusplus\r\n\r\n#endif //_LIST_H" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/bridgemain.h", "content": "#ifndef _BRIDGEMAIN_H_\r\n#define _BRIDGEMAIN_H_\r\n\r\n#include \r\n\r\n#ifndef __cplusplus\r\n#include \r\n#endif\r\n\r\n//default structure alignments forced\r\n#ifdef _WIN64\r\n#pragma pack(push, 16)\r\n#else //x86\r\n#pragma pack(push, 8)\r\n#endif //_WIN64\r\n\r\n#ifdef _WIN64\r\ntypedef unsigned long long duint;\r\ntypedef signed long long dsint;\r\n#else\r\ntypedef unsigned long duint;\r\ntypedef signed long dsint;\r\n#endif //_WIN64\r\n\r\n#ifndef BRIDGE_IMPEXP\r\n#ifdef BUILD_BRIDGE\r\n#define BRIDGE_IMPEXP __declspec(dllexport)\r\n#else\r\n#define BRIDGE_IMPEXP __declspec(dllimport)\r\n#endif //BUILD_BRIDGE\r\n#endif //BRIDGE_IMPEXP\r\n\r\n#ifdef __cplusplus\r\nextern \"C\"\r\n{\r\n#endif\r\n\r\n//Bridge defines\r\n#define MAX_SETTING_SIZE 65536\r\n#define DBG_VERSION 25\r\n\r\n//Bridge functions\r\n\r\n/// \r\n/// Initialize the bridge.\r\n/// \r\n/// On error it returns a non-null error message.\r\nBRIDGE_IMPEXP const wchar_t* BridgeInit();\r\n\r\n/// \r\n/// Start the bridge.\r\n/// \r\n/// On error it returns a non-null error message.\r\nBRIDGE_IMPEXP const wchar_t* BridgeStart();\r\n\r\n/// \r\n/// Allocate buffer. Use BridgeFree to free the buffer.\r\n/// \r\n/// Size in bytes of the buffer to allocate.\r\n/// A pointer to the allocated buffer. This function will trigger a crash dump if unsuccessful.\r\nBRIDGE_IMPEXP void* BridgeAlloc(size_t size);\r\n\r\n/// \r\n/// Free buffer allocated by BridgeAlloc.\r\n/// \r\n/// Buffer to free.\r\nBRIDGE_IMPEXP void BridgeFree(void* ptr);\r\n\r\n/// \r\n/// Get a string setting from the in-memory setting store.\r\n/// \r\n/// Section the setting is in. Cannot be null.\r\n/// Setting key (name). Cannot be null.\r\n/// Output buffer for the value. Should be of MAX_SETTING_SIZE. Cannot be null.\r\n/// True if the setting was found and copied in the value parameter.\r\nBRIDGE_IMPEXP bool BridgeSettingGet(const char* section, const char* key, char* value);\r\n\r\n/// \r\n/// Get an integer setting from the in-memory setting store.\r\n/// \r\n/// Section the setting is in. Cannot be null.\r\n/// Setting key (name). Cannot be null.\r\n/// Output value.\r\n/// True if the setting was found and successfully converted to an integer.\r\nBRIDGE_IMPEXP bool BridgeSettingGetUint(const char* section, const char* key, duint* value);\r\n\r\n/// \r\n/// Set a string setting in the in-memory setting store.\r\n/// \r\n/// Section the setting is in. Cannot be null.\r\n/// Setting key (name). Set to null to clear the whole section.\r\n/// New setting value. Set to null to remove the key from the section.\r\n/// True if the operation was successful.\r\nBRIDGE_IMPEXP bool BridgeSettingSet(const char* section, const char* key, const char* value);\r\n\r\n/// \r\n/// Set an integer setting in the in-memory setting store.\r\n/// \r\n/// Section the setting is in. Cannot be null.\r\n/// Setting key (name). Set to null to clear the whole section.\r\n/// New setting value.\r\n/// True if the operation was successful.\r\nBRIDGE_IMPEXP bool BridgeSettingSetUint(const char* section, const char* key, duint value);\r\n\r\n/// \r\n/// Flush the in-memory setting store to disk.\r\n/// \r\n/// \r\nBRIDGE_IMPEXP bool BridgeSettingFlush();\r\n\r\n/// \r\n/// Read the in-memory setting store from disk.\r\n/// \r\n/// Line where the error occurred. Set to null to ignore this.\r\n/// True if the setting were read and parsed correctly.\r\nBRIDGE_IMPEXP bool BridgeSettingRead(int* errorLine);\r\n\r\n/// \r\n/// Get the debugger version.\r\n/// \r\n/// 25\r\nBRIDGE_IMPEXP int BridgeGetDbgVersion();\r\n\r\n#ifdef __cplusplus\r\n}\r\n#endif\r\n\r\n//list structure (and C++ wrapper)\r\n#include \"bridgelist.h\"\r\n\r\n#include \"bridgegraph.h\"\r\n\r\n#ifdef __cplusplus\r\nextern \"C\"\r\n{\r\n#endif\r\n\r\n//Debugger defines\r\n#define MAX_LABEL_SIZE 256\r\n#define MAX_COMMENT_SIZE 512\r\n#define MAX_MODULE_SIZE 256\r\n#define MAX_IMPORT_SIZE 65536\r\n#define MAX_BREAKPOINT_SIZE 256\r\n#define MAX_CONDITIONAL_EXPR_SIZE 256\r\n#define MAX_CONDITIONAL_TEXT_SIZE 256\r\n#define MAX_SCRIPT_LINE_SIZE 2048\r\n#define MAX_THREAD_NAME_SIZE 256\r\n#define MAX_WATCH_NAME_SIZE 256\r\n#define MAX_STRING_SIZE 512\r\n#define MAX_ERROR_SIZE 512\r\n#define RIGHTS_STRING_SIZE (sizeof(\"ERWCG\") + 1)\r\n#define MAX_SECTION_SIZE 10\r\n#define MAX_COMMAND_LINE_SIZE 256\r\n#define MAX_MNEMONIC_SIZE 64\r\n#define PAGE_SIZE 0x1000\r\n\r\n//Debugger enums\r\ntypedef enum\r\n{\r\n initialized,\r\n paused,\r\n running,\r\n stopped\r\n} DBGSTATE;\r\n\r\ntypedef enum\r\n{\r\n SEG_DEFAULT,\r\n SEG_ES,\r\n SEG_DS,\r\n SEG_FS,\r\n SEG_GS,\r\n SEG_CS,\r\n SEG_SS\r\n} SEGMENTREG;\r\n\r\ntypedef enum\r\n{\r\n flagmodule = 0x1,\r\n flaglabel = 0x2,\r\n flagcomment = 0x4,\r\n flagbookmark = 0x8,\r\n flagfunction = 0x10,\r\n flagloop = 0x20,\r\n flagargs = 0x40,\r\n flagNoFuncOffset = 0x80\r\n} ADDRINFOFLAGS;\r\n\r\ntypedef enum\r\n{\r\n bp_none = 0,\r\n bp_normal = 1,\r\n bp_hardware = 2,\r\n bp_memory = 4,\r\n bp_dll = 8,\r\n bp_exception = 16\r\n} BPXTYPE;\r\n\r\ntypedef enum\r\n{\r\n FUNC_NONE,\r\n FUNC_BEGIN,\r\n FUNC_MIDDLE,\r\n FUNC_END,\r\n FUNC_SINGLE\r\n} FUNCTYPE;\r\n\r\ntypedef enum\r\n{\r\n LOOP_NONE,\r\n LOOP_BEGIN,\r\n LOOP_MIDDLE,\r\n LOOP_ENTRY,\r\n LOOP_END,\r\n LOOP_SINGLE\r\n} LOOPTYPE;\r\n\r\n//order by most important type last\r\ntypedef enum\r\n{\r\n XREF_NONE,\r\n XREF_DATA,\r\n XREF_JMP,\r\n XREF_CALL\r\n} XREFTYPE;\r\n\r\ntypedef enum\r\n{\r\n ARG_NONE,\r\n ARG_BEGIN,\r\n ARG_MIDDLE,\r\n ARG_END,\r\n ARG_SINGLE\r\n} ARGTYPE;\r\n\r\ntypedef enum\r\n{\r\n DBG_SCRIPT_LOAD, // param1=const char* filename, param2=unused\r\n DBG_SCRIPT_UNLOAD, // param1=unused, param2=unused\r\n DBG_SCRIPT_RUN, // param1=int destline, param2=unused\r\n DBG_SCRIPT_STEP, // param1=unused, param2=unused\r\n DBG_SCRIPT_BPTOGGLE, // param1=int line, param2=unused\r\n DBG_SCRIPT_BPGET, // param1=int line, param2=unused\r\n DBG_SCRIPT_CMDEXEC, // param1=const char* command, param2=unused\r\n DBG_SCRIPT_ABORT, // param1=unused, param2=unused\r\n DBG_SCRIPT_GETLINETYPE, // param1=int line, param2=unused\r\n DBG_SCRIPT_SETIP, // param1=int line, param2=unused\r\n DBG_SCRIPT_GETBRANCHINFO, // param1=int line, param2=SCRIPTBRANCH* info\r\n DBG_SYMBOL_ENUM, // param1=SYMBOLCBINFO* cbInfo, param2=unused\r\n DBG_ASSEMBLE_AT, // param1=duint addr, param2=const char* instruction\r\n DBG_MODBASE_FROM_NAME, // param1=const char* modname, param2=unused\r\n DBG_DISASM_AT, // param1=duint addr, param2=DISASM_INSTR* instr\r\n DBG_STACK_COMMENT_GET, // param1=duint addr, param2=STACK_COMMENT* comment\r\n DBG_GET_THREAD_LIST, // param1=THREADALLINFO* list, param2=unused\r\n DBG_SETTINGS_UPDATED, // param1=unused, param2=unused\r\n DBG_DISASM_FAST_AT, // param1=duint addr, param2=BASIC_INSTRUCTION_INFO* basicinfo\r\n DBG_MENU_ENTRY_CLICKED, // param1=int hEntry, param2=unused\r\n DBG_FUNCTION_GET, // param1=FUNCTION_LOOP_INFO* info, param2=unused\r\n DBG_FUNCTION_OVERLAPS, // param1=FUNCTION_LOOP_INFO* info, param2=unused\r\n DBG_FUNCTION_ADD, // param1=FUNCTION_LOOP_INFO* info, param2=unused\r\n DBG_FUNCTION_DEL, // param1=FUNCTION_LOOP_INFO* info, param2=unused\r\n DBG_LOOP_GET, // param1=FUNCTION_LOOP_INFO* info, param2=unused\r\n DBG_LOOP_OVERLAPS, // param1=FUNCTION_LOOP_INFO* info, param2=unused\r\n DBG_LOOP_ADD, // param1=FUNCTION_LOOP_INFO* info, param2=unused\r\n DBG_LOOP_DEL, // param1=FUNCTION_LOOP_INFO* info, param2=unused\r\n DBG_IS_RUN_LOCKED, // param1=unused, param2=unused\r\n DBG_IS_BP_DISABLED, // param1=duint addr, param2=unused\r\n DBG_SET_AUTO_COMMENT_AT, // param1=duint addr, param2=const char* text\r\n DBG_DELETE_AUTO_COMMENT_RANGE, // param1=duint start, param2=duint end\r\n DBG_SET_AUTO_LABEL_AT, // param1=duint addr, param2=const char* text\r\n DBG_DELETE_AUTO_LABEL_RANGE, // param1=duint start, param2=duint end\r\n DBG_SET_AUTO_BOOKMARK_AT, // param1=duint addr, param2=const char* text\r\n DBG_DELETE_AUTO_BOOKMARK_RANGE, // param1=duint start, param2=duint end\r\n DBG_SET_AUTO_FUNCTION_AT, // param1=duint addr, param2=const char* text\r\n DBG_DELETE_AUTO_FUNCTION_RANGE, // param1=duint start, param2=duint end\r\n DBG_GET_STRING_AT, // param1=duint addr, param2=unused\r\n DBG_GET_FUNCTIONS, // param1=unused, param2=unused\r\n DBG_WIN_EVENT, // param1=MSG* message, param2=long* result\r\n DBG_WIN_EVENT_GLOBAL, // param1=MSG* message, param2=unused\r\n DBG_INITIALIZE_LOCKS, // param1=unused, param2=unused\r\n DBG_DEINITIALIZE_LOCKS, // param1=unused, param2=unused\r\n DBG_GET_TIME_WASTED_COUNTER, // param1=unused, param2=unused\r\n DBG_SYMBOL_ENUM_FROMCACHE, // param1=SYMBOLCBINFO* cbInfo, param2=unused\r\n DBG_DELETE_COMMENT_RANGE, // param1=duint start, param2=duint end\r\n DBG_DELETE_LABEL_RANGE, // param1=duint start, param2=duint end\r\n DBG_DELETE_BOOKMARK_RANGE, // param1=duint start, param2=duint end\r\n DBG_GET_XREF_COUNT_AT, // param1=duint addr, param2=unused\r\n DBG_GET_XREF_TYPE_AT, // param1=duint addr, param2=unused\r\n DBG_XREF_ADD, // param1=duint addr, param2=duint from\r\n DBG_XREF_DEL_ALL, // param1=duint addr, param2=unused\r\n DBG_XREF_GET, // param1=duint addr, param2=XREF_INFO* info\r\n DBG_GET_ENCODE_TYPE_BUFFER, // param1=duint addr, param2=unused\r\n DBG_ENCODE_TYPE_GET, // param1=duint addr, param2=duint size\r\n DBG_DELETE_ENCODE_TYPE_RANGE, // param1=duint start, param2=duint end\r\n DBG_ENCODE_SIZE_GET, // param1=duint addr, param2=duint codesize\r\n DBG_DELETE_ENCODE_TYPE_SEG, // param1=duint addr, param2=unused\r\n DBG_RELEASE_ENCODE_TYPE_BUFFER, // param1=void* buffer, param2=unused\r\n DBG_ARGUMENT_GET, // param1=FUNCTION* info, param2=unused\r\n DBG_ARGUMENT_OVERLAPS, // param1=FUNCTION* info, param2=unused\r\n DBG_ARGUMENT_ADD, // param1=FUNCTION* info, param2=unused\r\n DBG_ARGUMENT_DEL, // param1=FUNCTION* info, param2=unused\r\n DBG_GET_WATCH_LIST, // param1=ListOf(WATCHINFO), param2=unused\r\n DBG_SELCHANGED, // param1=hWindow, param2=VA\r\n DBG_GET_PROCESS_HANDLE, // param1=unused, param2=unused\r\n DBG_GET_THREAD_HANDLE, // param1=unused, param2=unused\r\n DBG_GET_PROCESS_ID, // param1=unused, param2=unused\r\n DBG_GET_THREAD_ID, // param1=unused, param2=unused\r\n DBG_GET_PEB_ADDRESS, // param1=DWORD ProcessId, param2=unused\r\n DBG_GET_TEB_ADDRESS, // param1=DWORD ThreadId, param2=unused\r\n DBG_ANALYZE_FUNCTION, // param1=BridgeCFGraphList* graph, param2=duint entry\r\n DBG_MENU_PREPARE // param1=int hMenu, param2=unused\r\n} DBGMSG;\r\n\r\ntypedef enum\r\n{\r\n linecommand,\r\n linebranch,\r\n linelabel,\r\n linecomment,\r\n lineempty,\r\n} SCRIPTLINETYPE;\r\n\r\ntypedef enum\r\n{\r\n scriptnobranch,\r\n scriptjmp,\r\n scriptjnejnz,\r\n scriptjejz,\r\n scriptjbjl,\r\n scriptjajg,\r\n scriptjbejle,\r\n scriptjaejge,\r\n scriptcall\r\n} SCRIPTBRANCHTYPE;\r\n\r\ntypedef enum\r\n{\r\n instr_normal,\r\n instr_branch,\r\n instr_stack\r\n} DISASM_INSTRTYPE;\r\n\r\ntypedef enum\r\n{\r\n arg_normal,\r\n arg_memory\r\n} DISASM_ARGTYPE;\r\n\r\ntypedef enum\r\n{\r\n str_none,\r\n str_ascii,\r\n str_unicode\r\n} STRING_TYPE;\r\n\r\ntypedef enum\r\n{\r\n _PriorityIdle = -15,\r\n _PriorityAboveNormal = 1,\r\n _PriorityBelowNormal = -1,\r\n _PriorityHighest = 2,\r\n _PriorityLowest = -2,\r\n _PriorityNormal = 0,\r\n _PriorityTimeCritical = 15,\r\n _PriorityUnknown = 0x7FFFFFFF\r\n} THREADPRIORITY;\r\n\r\ntypedef enum\r\n{\r\n _Executive = 0,\r\n _FreePage = 1,\r\n _PageIn = 2,\r\n _PoolAllocation = 3,\r\n _DelayExecution = 4,\r\n _Suspended = 5,\r\n _UserRequest = 6,\r\n _WrExecutive = 7,\r\n _WrFreePage = 8,\r\n _WrPageIn = 9,\r\n _WrPoolAllocation = 10,\r\n _WrDelayExecution = 11,\r\n _WrSuspended = 12,\r\n _WrUserRequest = 13,\r\n _WrEventPair = 14,\r\n _WrQueue = 15,\r\n _WrLpcReceive = 16,\r\n _WrLpcReply = 17,\r\n _WrVirtualMemory = 18,\r\n _WrPageOut = 19,\r\n _WrRendezvous = 20,\r\n _Spare2 = 21,\r\n _Spare3 = 22,\r\n _Spare4 = 23,\r\n _Spare5 = 24,\r\n _WrCalloutStack = 25,\r\n _WrKernel = 26,\r\n _WrResource = 27,\r\n _WrPushLock = 28,\r\n _WrMutex = 29,\r\n _WrQuantumEnd = 30,\r\n _WrDispatchInt = 31,\r\n _WrPreempted = 32,\r\n _WrYieldExecution = 33,\r\n _WrFastMutex = 34,\r\n _WrGuardedMutex = 35,\r\n _WrRundown = 36,\r\n} THREADWAITREASON;\r\n\r\ntypedef enum\r\n{\r\n size_byte = 1,\r\n size_word = 2,\r\n size_dword = 4,\r\n size_qword = 8\r\n} MEMORY_SIZE;\r\n\r\ntypedef enum\r\n{\r\n enc_unknown, //must be 0\r\n enc_byte, //1 byte\r\n enc_word, //2 bytes\r\n enc_dword, //4 bytes\r\n enc_fword, //6 bytes\r\n enc_qword, //8 bytes\r\n enc_tbyte, //10 bytes\r\n enc_oword, //16 bytes\r\n enc_mmword, //8 bytes\r\n enc_xmmword, //16 bytes\r\n enc_ymmword, //32 bytes\r\n enc_zmmword, //64 bytes avx512 not supported\r\n enc_real4, //4 byte float\r\n enc_real8, //8 byte double\r\n enc_real10, //10 byte decimal\r\n enc_ascii, //ascii sequence\r\n enc_unicode, //unicode sequence\r\n enc_code, //start of code\r\n enc_junk, //junk code\r\n enc_middle //middle of data\r\n} ENCODETYPE;\r\n\r\ntypedef enum\r\n{\r\n TYPE_UINT, // unsigned integer\r\n TYPE_INT, // signed integer\r\n TYPE_FLOAT,// single precision floating point value\r\n TYPE_ASCII, // ascii string\r\n TYPE_UNICODE, // unicode string\r\n TYPE_INVALID // invalid watch expression or data type\r\n} WATCHVARTYPE;\r\n\r\ntypedef enum\r\n{\r\n MODE_DISABLED, // watchdog is disabled\r\n MODE_ISTRUE, // alert if expression is not 0\r\n MODE_ISFALSE, // alert if expression is 0\r\n MODE_CHANGED, // alert if expression is changed\r\n MODE_UNCHANGED // alert if expression is not changed\r\n} WATCHDOGMODE;\r\n\r\ntypedef enum\r\n{\r\n hw_access,\r\n hw_write,\r\n hw_execute\r\n} BPHWTYPE;\r\n\r\ntypedef enum\r\n{\r\n mem_access,\r\n mem_read,\r\n mem_write,\r\n mem_execute\r\n} BPMEMTYPE;\r\n\r\ntypedef enum\r\n{\r\n dll_load = 1,\r\n dll_unload,\r\n dll_all\r\n} BPDLLTYPE;\r\n\r\ntypedef enum\r\n{\r\n ex_firstchance = 1,\r\n ex_secondchance,\r\n ex_all\r\n} BPEXTYPE;\r\n\r\ntypedef enum\r\n{\r\n hw_byte,\r\n hw_word,\r\n hw_dword,\r\n hw_qword\r\n} BPHWSIZE;\r\n\r\n//Debugger typedefs\r\ntypedef MEMORY_SIZE VALUE_SIZE;\r\ntypedef struct SYMBOLINFO_ SYMBOLINFO;\r\ntypedef struct DBGFUNCTIONS_ DBGFUNCTIONS;\r\n\r\ntypedef void (*CBSYMBOLENUM)(SYMBOLINFO* symbol, void* user);\r\n\r\n//Debugger structs\r\ntypedef struct\r\n{\r\n MEMORY_BASIC_INFORMATION mbi;\r\n char info[MAX_MODULE_SIZE];\r\n} MEMPAGE;\r\n\r\ntypedef struct\r\n{\r\n int count;\r\n MEMPAGE* page;\r\n} MEMMAP;\r\n\r\ntypedef struct\r\n{\r\n BPXTYPE type;\r\n duint addr;\r\n bool enabled;\r\n bool singleshoot;\r\n bool active;\r\n char name[MAX_BREAKPOINT_SIZE];\r\n char mod[MAX_MODULE_SIZE];\r\n unsigned short slot;\r\n // extended part\r\n unsigned char typeEx; //BPHWTYPE/BPMEMTYPE/BPDLLTYPE/BPEXTYPE\r\n unsigned char hwSize; //BPHWSIZE\r\n unsigned int hitCount;\r\n bool fastResume;\r\n bool silent;\r\n char breakCondition[MAX_CONDITIONAL_EXPR_SIZE];\r\n char logText[MAX_CONDITIONAL_TEXT_SIZE];\r\n char logCondition[MAX_CONDITIONAL_EXPR_SIZE];\r\n char commandText[MAX_CONDITIONAL_TEXT_SIZE];\r\n char commandCondition[MAX_CONDITIONAL_EXPR_SIZE];\r\n} BRIDGEBP;\r\n\r\ntypedef struct\r\n{\r\n int count;\r\n BRIDGEBP* bp;\r\n} BPMAP;\r\n\r\ntypedef struct\r\n{\r\n char WatchName[MAX_WATCH_NAME_SIZE];\r\n char Expression[MAX_CONDITIONAL_EXPR_SIZE];\r\n unsigned int window;\r\n unsigned int id;\r\n WATCHVARTYPE varType;\r\n WATCHDOGMODE watchdogMode;\r\n duint value;\r\n bool watchdogTriggered;\r\n} WATCHINFO;\r\n\r\ntypedef struct\r\n{\r\n duint start; //OUT\r\n duint end; //OUT\r\n duint instrcount; //OUT\r\n} FUNCTION;\r\n\r\ntypedef struct\r\n{\r\n int depth; //IN\r\n duint start; //OUT\r\n duint end; //OUT\r\n duint instrcount; //OUT\r\n} LOOP;\r\n\r\ntypedef struct\r\n{\r\n int flags; //ADDRINFOFLAGS (IN)\r\n char module[MAX_MODULE_SIZE]; //module the address is in\r\n char label[MAX_LABEL_SIZE];\r\n char comment[MAX_COMMENT_SIZE];\r\n bool isbookmark;\r\n FUNCTION function;\r\n LOOP loop;\r\n FUNCTION args;\r\n} BRIDGE_ADDRINFO;\r\n\r\nstruct SYMBOLINFO_\r\n{\r\n duint addr;\r\n char* decoratedSymbol;\r\n char* undecoratedSymbol;\r\n bool isImported;\r\n};\r\n\r\ntypedef struct\r\n{\r\n duint base;\r\n char name[MAX_MODULE_SIZE];\r\n} SYMBOLMODULEINFO;\r\n\r\ntypedef struct\r\n{\r\n duint base;\r\n CBSYMBOLENUM cbSymbolEnum;\r\n void* user;\r\n} SYMBOLCBINFO;\r\n\r\ntypedef struct\r\n{\r\n bool c;\r\n bool p;\r\n bool a;\r\n bool z;\r\n bool s;\r\n bool t;\r\n bool i;\r\n bool d;\r\n bool o;\r\n} FLAGS;\r\n\r\ntypedef struct\r\n{\r\n bool FZ;\r\n bool PM;\r\n bool UM;\r\n bool OM;\r\n bool ZM;\r\n bool IM;\r\n bool DM;\r\n bool DAZ;\r\n bool PE;\r\n bool UE;\r\n bool OE;\r\n bool ZE;\r\n bool DE;\r\n bool IE;\r\n\r\n unsigned short RC;\r\n} MXCSRFIELDS;\r\n\r\ntypedef struct\r\n{\r\n bool B;\r\n bool C3;\r\n bool C2;\r\n bool C1;\r\n bool C0;\r\n bool ES;\r\n bool SF;\r\n bool P;\r\n bool U;\r\n bool O;\r\n bool Z;\r\n bool D;\r\n bool I;\r\n\r\n unsigned short TOP;\r\n\r\n} X87STATUSWORDFIELDS;\r\n\r\ntypedef struct\r\n{\r\n bool IC;\r\n bool IEM;\r\n bool PM;\r\n bool UM;\r\n bool OM;\r\n bool ZM;\r\n bool DM;\r\n bool IM;\r\n\r\n unsigned short RC;\r\n unsigned short PC;\r\n\r\n} X87CONTROLWORDFIELDS;\r\n\r\ntypedef struct DECLSPEC_ALIGN(16) _XMMREGISTER\r\n{\r\n ULONGLONG Low;\r\n LONGLONG High;\r\n} XMMREGISTER;\r\n\r\ntypedef struct\r\n{\r\n XMMREGISTER Low; //XMM/SSE part\r\n XMMREGISTER High; //AVX part\r\n} YMMREGISTER;\r\n\r\ntypedef struct\r\n{\r\n BYTE data[10];\r\n int st_value;\r\n int tag;\r\n} X87FPUREGISTER;\r\n\r\ntypedef struct\r\n{\r\n WORD ControlWord;\r\n WORD StatusWord;\r\n WORD TagWord;\r\n DWORD ErrorOffset;\r\n DWORD ErrorSelector;\r\n DWORD DataOffset;\r\n DWORD DataSelector;\r\n DWORD Cr0NpxState;\r\n} X87FPU;\r\n\r\ntypedef struct\r\n{\r\n ULONG_PTR cax;\r\n ULONG_PTR ccx;\r\n ULONG_PTR cdx;\r\n ULONG_PTR cbx;\r\n ULONG_PTR csp;\r\n ULONG_PTR cbp;\r\n ULONG_PTR csi;\r\n ULONG_PTR cdi;\r\n#ifdef _WIN64\r\n ULONG_PTR r8;\r\n ULONG_PTR r9;\r\n ULONG_PTR r10;\r\n ULONG_PTR r11;\r\n ULONG_PTR r12;\r\n ULONG_PTR r13;\r\n ULONG_PTR r14;\r\n ULONG_PTR r15;\r\n#endif //_WIN64\r\n ULONG_PTR cip;\r\n ULONG_PTR eflags;\r\n unsigned short gs;\r\n unsigned short fs;\r\n unsigned short es;\r\n unsigned short ds;\r\n unsigned short cs;\r\n unsigned short ss;\r\n ULONG_PTR dr0;\r\n ULONG_PTR dr1;\r\n ULONG_PTR dr2;\r\n ULONG_PTR dr3;\r\n ULONG_PTR dr6;\r\n ULONG_PTR dr7;\r\n BYTE RegisterArea[80];\r\n X87FPU x87fpu;\r\n DWORD MxCsr;\r\n#ifdef _WIN64\r\n XMMREGISTER XmmRegisters[16];\r\n YMMREGISTER YmmRegisters[16];\r\n#else // x86\r\n XMMREGISTER XmmRegisters[8];\r\n YMMREGISTER YmmRegisters[8];\r\n#endif\r\n} REGISTERCONTEXT;\r\n\r\ntypedef struct\r\n{\r\n DWORD code;\r\n char name[128];\r\n} LASTERROR;\r\n\r\ntypedef struct\r\n{\r\n DWORD code;\r\n char name[128];\r\n} LASTSTATUS;\r\n\r\ntypedef struct\r\n{\r\n REGISTERCONTEXT regcontext;\r\n FLAGS flags;\r\n X87FPUREGISTER x87FPURegisters[8];\r\n unsigned long long mmx[8];\r\n MXCSRFIELDS MxCsrFields;\r\n X87STATUSWORDFIELDS x87StatusWordFields;\r\n X87CONTROLWORDFIELDS x87ControlWordFields;\r\n LASTERROR lastError;\r\n LASTSTATUS lastStatus;\r\n} REGDUMP;\r\n\r\ntypedef struct\r\n{\r\n DISASM_ARGTYPE type; //normal/memory\r\n SEGMENTREG segment;\r\n char mnemonic[64];\r\n duint constant; //constant in the instruction (imm/disp)\r\n duint value; //equal to constant or equal to the register value\r\n duint memvalue; //memsize:[value]\r\n} DISASM_ARG;\r\n\r\ntypedef struct\r\n{\r\n char instruction[64];\r\n DISASM_INSTRTYPE type;\r\n int argcount;\r\n int instr_size;\r\n DISASM_ARG arg[3];\r\n} DISASM_INSTR;\r\n\r\ntypedef struct\r\n{\r\n char color[8]; //hex color-code\r\n char comment[MAX_COMMENT_SIZE];\r\n} STACK_COMMENT;\r\n\r\ntypedef struct\r\n{\r\n int ThreadNumber;\r\n HANDLE Handle;\r\n DWORD ThreadId;\r\n duint ThreadStartAddress;\r\n duint ThreadLocalBase;\r\n char threadName[MAX_THREAD_NAME_SIZE];\r\n} THREADINFO;\r\n\r\ntypedef struct\r\n{\r\n THREADINFO BasicInfo;\r\n duint ThreadCip;\r\n DWORD SuspendCount;\r\n THREADPRIORITY Priority;\r\n THREADWAITREASON WaitReason;\r\n DWORD LastError;\r\n FILETIME UserTime;\r\n FILETIME KernelTime;\r\n FILETIME CreationTime;\r\n ULONG64 Cycles; // Windows Vista or greater\r\n} THREADALLINFO;\r\n\r\ntypedef struct\r\n{\r\n int count;\r\n THREADALLINFO* list;\r\n int CurrentThread;\r\n} THREADLIST;\r\n\r\ntypedef struct\r\n{\r\n duint value; //displacement / addrvalue (rip-relative)\r\n MEMORY_SIZE size; //byte/word/dword/qword\r\n char mnemonic[MAX_MNEMONIC_SIZE];\r\n} MEMORY_INFO;\r\n\r\ntypedef struct\r\n{\r\n duint value;\r\n VALUE_SIZE size;\r\n} VALUE_INFO;\r\n\r\n//definitions for BASIC_INSTRUCTION_INFO.type\r\n#define TYPE_VALUE 1\r\n#define TYPE_MEMORY 2\r\n#define TYPE_ADDR 4\r\n\r\ntypedef struct\r\n{\r\n DWORD type; //value|memory|addr\r\n VALUE_INFO value; //immediat\r\n MEMORY_INFO memory;\r\n duint addr; //addrvalue (jumps + calls)\r\n bool branch; //jumps/calls\r\n bool call; //instruction is a call\r\n int size;\r\n char instruction[MAX_MNEMONIC_SIZE * 4];\r\n} BASIC_INSTRUCTION_INFO;\r\n\r\ntypedef struct\r\n{\r\n SCRIPTBRANCHTYPE type;\r\n int dest;\r\n char branchlabel[256];\r\n} SCRIPTBRANCH;\r\n\r\ntypedef struct\r\n{\r\n duint addr;\r\n duint start;\r\n duint end;\r\n bool manual;\r\n int depth;\r\n} FUNCTION_LOOP_INFO;\r\n\r\ntypedef struct\r\n{\r\n duint addr;\r\n XREFTYPE type;\r\n} XREF_RECORD;\r\n\r\ntypedef struct\r\n{\r\n duint refcount;\r\n XREF_RECORD* references;\r\n} XREF_INFO;\r\n\r\n//Debugger functions\r\nBRIDGE_IMPEXP const char* DbgInit();\r\nBRIDGE_IMPEXP void DbgExit();\r\nBRIDGE_IMPEXP bool DbgMemRead(duint va, void* dest, duint size);\r\nBRIDGE_IMPEXP bool DbgMemWrite(duint va, const void* src, duint size);\r\nBRIDGE_IMPEXP duint DbgMemGetPageSize(duint base);\r\nBRIDGE_IMPEXP duint DbgMemFindBaseAddr(duint addr, duint* size);\r\n\r\n/// \r\n/// Asynchronously execute a debugger command by adding it to the command queue.\r\n/// Note: the command may not have completed before this call returns. Use this\r\n/// function if you don't care when the command gets executed.\r\n///\r\n/// Example: DbgCmdExec(\"ClearLog\")\r\n/// \r\n/// The command to execute.\r\n/// True if the command was successfully submitted to the command queue. False if the submission failed.\r\nBRIDGE_IMPEXP bool DbgCmdExec(const char* cmd);\r\n\r\n/// \r\n/// Performs synchronous execution of a debugger command. This function call only\r\n/// returns after the command has completed.\r\n///\r\n/// Example: DbgCmdExecDirect(\"loadlib advapi32.dll\")\r\n/// \r\n/// The command to execute.\r\n/// True if the command executed successfully, False if there was a problem.\r\nBRIDGE_IMPEXP bool DbgCmdExecDirect(const char* cmd);\r\nBRIDGE_IMPEXP bool DbgMemMap(MEMMAP* memmap);\r\nBRIDGE_IMPEXP bool DbgIsValidExpression(const char* expression);\r\nBRIDGE_IMPEXP bool DbgIsDebugging();\r\nBRIDGE_IMPEXP bool DbgIsJumpGoingToExecute(duint addr);\r\nBRIDGE_IMPEXP bool DbgGetLabelAt(duint addr, SEGMENTREG segment, char* text);\r\nBRIDGE_IMPEXP bool DbgSetLabelAt(duint addr, const char* text);\r\nBRIDGE_IMPEXP void DbgClearLabelRange(duint start, duint end);\r\nBRIDGE_IMPEXP bool DbgGetCommentAt(duint addr, char* text);\r\nBRIDGE_IMPEXP bool DbgSetCommentAt(duint addr, const char* text);\r\nBRIDGE_IMPEXP void DbgClearCommentRange(duint start, duint end);\r\nBRIDGE_IMPEXP bool DbgGetBookmarkAt(duint addr);\r\nBRIDGE_IMPEXP bool DbgSetBookmarkAt(duint addr, bool isbookmark);\r\nBRIDGE_IMPEXP void DbgClearBookmarkRange(duint start, duint end);\r\nBRIDGE_IMPEXP bool DbgGetModuleAt(duint addr, char* text);\r\nBRIDGE_IMPEXP BPXTYPE DbgGetBpxTypeAt(duint addr);\r\nBRIDGE_IMPEXP duint DbgValFromString(const char* string);\r\nBRIDGE_IMPEXP bool DbgGetRegDumpEx(REGDUMP* regdump, size_t size);\r\nBRIDGE_IMPEXP bool DbgValToString(const char* string, duint value);\r\nBRIDGE_IMPEXP bool DbgMemIsValidReadPtr(duint addr);\r\nBRIDGE_IMPEXP int DbgGetBpList(BPXTYPE type, BPMAP* list);\r\nBRIDGE_IMPEXP FUNCTYPE DbgGetFunctionTypeAt(duint addr);\r\nBRIDGE_IMPEXP LOOPTYPE DbgGetLoopTypeAt(duint addr, int depth);\r\nBRIDGE_IMPEXP duint DbgGetBranchDestination(duint addr);\r\nBRIDGE_IMPEXP void DbgScriptLoad(const char* filename);\r\nBRIDGE_IMPEXP void DbgScriptUnload();\r\nBRIDGE_IMPEXP void DbgScriptRun(int destline);\r\nBRIDGE_IMPEXP void DbgScriptStep();\r\nBRIDGE_IMPEXP bool DbgScriptBpToggle(int line);\r\nBRIDGE_IMPEXP bool DbgScriptBpGet(int line);\r\nBRIDGE_IMPEXP bool DbgScriptCmdExec(const char* command);\r\nBRIDGE_IMPEXP void DbgScriptAbort();\r\nBRIDGE_IMPEXP SCRIPTLINETYPE DbgScriptGetLineType(int line);\r\nBRIDGE_IMPEXP void DbgScriptSetIp(int line);\r\nBRIDGE_IMPEXP bool DbgScriptGetBranchInfo(int line, SCRIPTBRANCH* info);\r\nBRIDGE_IMPEXP void DbgSymbolEnum(duint base, CBSYMBOLENUM cbSymbolEnum, void* user);\r\nBRIDGE_IMPEXP void DbgSymbolEnumFromCache(duint base, CBSYMBOLENUM cbSymbolEnum, void* user);\r\nBRIDGE_IMPEXP bool DbgAssembleAt(duint addr, const char* instruction);\r\nBRIDGE_IMPEXP duint DbgModBaseFromName(const char* name);\r\nBRIDGE_IMPEXP void DbgDisasmAt(duint addr, DISASM_INSTR* instr);\r\nBRIDGE_IMPEXP bool DbgStackCommentGet(duint addr, STACK_COMMENT* comment);\r\nBRIDGE_IMPEXP void DbgGetThreadList(THREADLIST* list);\r\nBRIDGE_IMPEXP void DbgSettingsUpdated();\r\nBRIDGE_IMPEXP void DbgDisasmFastAt(duint addr, BASIC_INSTRUCTION_INFO* basicinfo);\r\nBRIDGE_IMPEXP void DbgMenuEntryClicked(int hEntry);\r\nBRIDGE_IMPEXP bool DbgFunctionGet(duint addr, duint* start, duint* end);\r\nBRIDGE_IMPEXP bool DbgFunctionOverlaps(duint start, duint end);\r\nBRIDGE_IMPEXP bool DbgFunctionAdd(duint start, duint end);\r\nBRIDGE_IMPEXP bool DbgFunctionDel(duint addr);\r\nBRIDGE_IMPEXP bool DbgArgumentGet(duint addr, duint* start, duint* end);\r\nBRIDGE_IMPEXP bool DbgArgumentOverlaps(duint start, duint end);\r\nBRIDGE_IMPEXP bool DbgArgumentAdd(duint start, duint end);\r\nBRIDGE_IMPEXP bool DbgArgumentDel(duint addr);\r\nBRIDGE_IMPEXP bool DbgLoopGet(int depth, duint addr, duint* start, duint* end);\r\nBRIDGE_IMPEXP bool DbgLoopOverlaps(int depth, duint start, duint end);\r\nBRIDGE_IMPEXP bool DbgLoopAdd(duint start, duint end);\r\nBRIDGE_IMPEXP bool DbgLoopDel(int depth, duint addr);\r\nBRIDGE_IMPEXP bool DbgXrefAdd(duint addr, duint from);\r\nBRIDGE_IMPEXP bool DbgXrefDelAll(duint addr);\r\nBRIDGE_IMPEXP bool DbgXrefGet(duint addr, XREF_INFO* info);\r\nBRIDGE_IMPEXP size_t DbgGetXrefCountAt(duint addr);\r\nBRIDGE_IMPEXP XREFTYPE DbgGetXrefTypeAt(duint addr);\r\nBRIDGE_IMPEXP bool DbgIsRunLocked();\r\nBRIDGE_IMPEXP bool DbgIsBpDisabled(duint addr);\r\nBRIDGE_IMPEXP bool DbgSetAutoCommentAt(duint addr, const char* text);\r\nBRIDGE_IMPEXP void DbgClearAutoCommentRange(duint start, duint end);\r\nBRIDGE_IMPEXP bool DbgSetAutoLabelAt(duint addr, const char* text);\r\nBRIDGE_IMPEXP void DbgClearAutoLabelRange(duint start, duint end);\r\nBRIDGE_IMPEXP bool DbgSetAutoBookmarkAt(duint addr);\r\nBRIDGE_IMPEXP void DbgClearAutoBookmarkRange(duint start, duint end);\r\nBRIDGE_IMPEXP bool DbgSetAutoFunctionAt(duint start, duint end);\r\nBRIDGE_IMPEXP void DbgClearAutoFunctionRange(duint start, duint end);\r\nBRIDGE_IMPEXP bool DbgGetStringAt(duint addr, char* text);\r\nBRIDGE_IMPEXP const DBGFUNCTIONS* DbgFunctions();\r\nBRIDGE_IMPEXP bool DbgWinEvent(MSG* message, long* result);\r\nBRIDGE_IMPEXP bool DbgWinEventGlobal(MSG* message);\r\nBRIDGE_IMPEXP bool DbgIsRunning();\r\nBRIDGE_IMPEXP duint DbgGetTimeWastedCounter();\r\nBRIDGE_IMPEXP ARGTYPE DbgGetArgTypeAt(duint addr);\r\nBRIDGE_IMPEXP void* DbgGetEncodeTypeBuffer(duint addr, duint* size);\r\nBRIDGE_IMPEXP void DbgReleaseEncodeTypeBuffer(void* buffer);\r\nBRIDGE_IMPEXP ENCODETYPE DbgGetEncodeTypeAt(duint addr, duint size);\r\nBRIDGE_IMPEXP duint DbgGetEncodeSizeAt(duint addr, duint codesize);\r\nBRIDGE_IMPEXP bool DbgSetEncodeType(duint addr, duint size, ENCODETYPE type);\r\nBRIDGE_IMPEXP void DbgDelEncodeTypeRange(duint start, duint end);\r\nBRIDGE_IMPEXP void DbgDelEncodeTypeSegment(duint start);\r\nBRIDGE_IMPEXP bool DbgGetWatchList(ListOf(WATCHINFO) list);\r\nBRIDGE_IMPEXP void DbgSelChanged(int hWindow, duint VA);\r\nBRIDGE_IMPEXP HANDLE DbgGetProcessHandle();\r\nBRIDGE_IMPEXP HANDLE DbgGetThreadHandle();\r\nBRIDGE_IMPEXP DWORD DbgGetProcessId();\r\nBRIDGE_IMPEXP DWORD DbgGetThreadId();\r\nBRIDGE_IMPEXP duint DbgGetPebAddress(DWORD ProcessId);\r\nBRIDGE_IMPEXP duint DbgGetTebAddress(DWORD ThreadId);\r\nBRIDGE_IMPEXP bool DbgAnalyzeFunction(duint entry, BridgeCFGraphList* graph);\r\nBRIDGE_IMPEXP duint DbgEval(const char* expression, bool* success = 0);\r\nBRIDGE_IMPEXP void DbgMenuPrepare(int hMenu);\r\n\r\n//Gui defines\r\n#define GUI_PLUGIN_MENU 0\r\n#define GUI_DISASM_MENU 1\r\n#define GUI_DUMP_MENU 2\r\n#define GUI_STACK_MENU 3\r\n\r\n#define GUI_DISASSEMBLY 0\r\n#define GUI_DUMP 1\r\n#define GUI_STACK 2\r\n#define GUI_GRAPH 3\r\n#define GUI_MEMMAP 4\r\n#define GUI_SYMMOD 5\r\n\r\n#define GUI_MAX_LINE_SIZE 65536\r\n#define GUI_MAX_DISASSEMBLY_SIZE 2048\r\n\r\n//Gui enums\r\ntypedef enum\r\n{\r\n GUI_DISASSEMBLE_AT, // param1=(duint)va, param2=(duint)cip\r\n GUI_SET_DEBUG_STATE, // param1=(DBGSTATE)state, param2=unused\r\n GUI_ADD_MSG_TO_LOG, // param1=(const char*)msg, param2=unused\r\n GUI_CLEAR_LOG, // param1=unused, param2=unused\r\n GUI_UPDATE_REGISTER_VIEW, // param1=unused, param2=unused\r\n GUI_UPDATE_DISASSEMBLY_VIEW, // param1=unused, param2=unused\r\n GUI_UPDATE_BREAKPOINTS_VIEW, // param1=unused, param2=unused\r\n GUI_UPDATE_WINDOW_TITLE, // param1=(const char*)file, param2=unused\r\n GUI_GET_WINDOW_HANDLE, // param1=unused, param2=unused\r\n GUI_DUMP_AT, // param1=(duint)va param2=unused\r\n GUI_SCRIPT_ADD, // param1=int count, param2=const char** lines\r\n GUI_SCRIPT_CLEAR, // param1=unused, param2=unused\r\n GUI_SCRIPT_SETIP, // param1=int line, param2=unused\r\n GUI_SCRIPT_ERROR, // param1=int line, param2=const char* message\r\n GUI_SCRIPT_SETTITLE, // param1=const char* title, param2=unused\r\n GUI_SCRIPT_SETINFOLINE, // param1=int line, param2=const char* info\r\n GUI_SCRIPT_MESSAGE, // param1=const char* message, param2=unused\r\n GUI_SCRIPT_MSGYN, // param1=const char* message, param2=unused\r\n GUI_SYMBOL_LOG_ADD, // param1(const char*)msg, param2=unused\r\n GUI_SYMBOL_LOG_CLEAR, // param1=unused, param2=unused\r\n GUI_SYMBOL_SET_PROGRESS, // param1=int percent param2=unused\r\n GUI_SYMBOL_UPDATE_MODULE_LIST, // param1=int count, param2=SYMBOLMODULEINFO* modules\r\n GUI_REF_ADDCOLUMN, // param1=int width, param2=(const char*)title\r\n GUI_REF_SETROWCOUNT, // param1=int rows, param2=unused\r\n GUI_REF_GETROWCOUNT, // param1=unused, param2=unused\r\n GUI_REF_DELETEALLCOLUMNS, // param1=unused, param2=unused\r\n GUI_REF_SETCELLCONTENT, // param1=(CELLINFO*)info, param2=unused\r\n GUI_REF_GETCELLCONTENT, // param1=int row, param2=int col\r\n GUI_REF_RELOADDATA, // param1=unused, param2=unused\r\n GUI_REF_SETSINGLESELECTION, // param1=int index, param2=bool scroll\r\n GUI_REF_SETPROGRESS, // param1=int progress, param2=unused\r\n GUI_REF_SETCURRENTTASKPROGRESS, // param1=int progress, param2=const char* taskTitle\r\n GUI_REF_SETSEARCHSTARTCOL, // param1=int col param2=unused\r\n GUI_STACK_DUMP_AT, // param1=duint addr, param2=duint csp\r\n GUI_UPDATE_DUMP_VIEW, // param1=unused, param2=unused\r\n GUI_UPDATE_THREAD_VIEW, // param1=unused, param2=unused\r\n GUI_ADD_RECENT_FILE, // param1=(const char*)file, param2=unused\r\n GUI_SET_LAST_EXCEPTION, // param1=unsigned int code, param2=unused\r\n GUI_GET_DISASSEMBLY, // param1=duint addr, param2=char* text\r\n GUI_MENU_ADD, // param1=int hMenu, param2=const char* title\r\n GUI_MENU_ADD_ENTRY, // param1=int hMenu, param2=const char* title\r\n GUI_MENU_ADD_SEPARATOR, // param1=int hMenu, param2=unused\r\n GUI_MENU_CLEAR, // param1=int hMenu, param2=unused\r\n GUI_SELECTION_GET, // param1=int hWindow, param2=SELECTIONDATA* selection\r\n GUI_SELECTION_SET, // param1=int hWindow, param2=const SELECTIONDATA* selection\r\n GUI_GETLINE_WINDOW, // param1=const char* title, param2=char* text\r\n GUI_AUTOCOMPLETE_ADDCMD, // param1=const char* cmd, param2=ununsed\r\n GUI_AUTOCOMPLETE_DELCMD, // param1=const char* cmd, param2=ununsed\r\n GUI_AUTOCOMPLETE_CLEARALL, // param1=unused, param2=unused\r\n GUI_SCRIPT_ENABLEHIGHLIGHTING, // param1=bool enable, param2=unused\r\n GUI_ADD_MSG_TO_STATUSBAR, // param1=const char* msg, param2=unused\r\n GUI_UPDATE_SIDEBAR, // param1=unused, param2=unused\r\n GUI_REPAINT_TABLE_VIEW, // param1=unused, param2=unused\r\n GUI_UPDATE_PATCHES, // param1=unused, param2=unused\r\n GUI_UPDATE_CALLSTACK, // param1=unused, param2=unused\r\n GUI_UPDATE_SEHCHAIN, // param1=unused, param2=unused\r\n GUI_SYMBOL_REFRESH_CURRENT, // param1=unused, param2=unused\r\n GUI_UPDATE_MEMORY_VIEW, // param1=unused, param2=unused\r\n GUI_REF_INITIALIZE, // param1=const char* name, param2=unused\r\n GUI_LOAD_SOURCE_FILE, // param1=const char* path, param2=line\r\n GUI_MENU_SET_ICON, // param1=int hMenu, param2=ICONINFO*\r\n GUI_MENU_SET_ENTRY_ICON, // param1=int hEntry, param2=ICONINFO*\r\n GUI_SHOW_CPU, // param1=unused, param2=unused\r\n GUI_ADD_QWIDGET_TAB, // param1=QWidget*, param2=unused\r\n GUI_SHOW_QWIDGET_TAB, // param1=QWidget*, param2=unused\r\n GUI_CLOSE_QWIDGET_TAB, // param1=QWidget*, param2=unused\r\n GUI_EXECUTE_ON_GUI_THREAD, // param1=GUICALLBACK, param2=unused\r\n GUI_UPDATE_TIME_WASTED_COUNTER, // param1=unused, param2=unused\r\n GUI_SET_GLOBAL_NOTES, // param1=const char* text, param2=unused\r\n GUI_GET_GLOBAL_NOTES, // param1=char** text, param2=unused\r\n GUI_SET_DEBUGGEE_NOTES, // param1=const char* text, param2=unused\r\n GUI_GET_DEBUGGEE_NOTES, // param1=char** text, param2=unused\r\n GUI_DUMP_AT_N, // param1=int index, param2=duint va\r\n GUI_DISPLAY_WARNING, // param1=const char *text, param2=unused\r\n GUI_REGISTER_SCRIPT_LANG, // param1=SCRIPTTYPEINFO* info, param2=unused\r\n GUI_UNREGISTER_SCRIPT_LANG, // param1=int id, param2=unused\r\n GUI_UPDATE_ARGUMENT_VIEW, // param1=unused, param2=unused\r\n GUI_FOCUS_VIEW, // param1=int hWindow, param2=unused\r\n GUI_UPDATE_WATCH_VIEW, // param1=unused, param2=unused\r\n GUI_LOAD_GRAPH, // param1=BridgeCFGraphList* param2=unused\r\n GUI_GRAPH_AT, // param1=duint addr param2=unused\r\n GUI_UPDATE_GRAPH_VIEW, // param1=unused, param2=unused\r\n GUI_SET_LOG_ENABLED, // param1=bool isEnabled param2=unused\r\n GUI_ADD_FAVOURITE_TOOL, // param1=const char* name param2=const char* description\r\n GUI_ADD_FAVOURITE_COMMAND, // param1=const char* command param2=const char* shortcut\r\n GUI_SET_FAVOURITE_TOOL_SHORTCUT,// param1=const char* name param2=const char* shortcut\r\n GUI_FOLD_DISASSEMBLY, // param1=duint startAddress param2=duint length\r\n GUI_SELECT_IN_MEMORY_MAP, // param1=duint addr, param2=unused\r\n GUI_GET_ACTIVE_VIEW, // param1=ACTIVEVIEW*, param2=unused\r\n GUI_MENU_SET_ENTRY_CHECKED, // param1=int hEntry, param2=bool checked\r\n GUI_ADD_INFO_LINE, // param1=const char* infoline, param2=unused\r\n GUI_PROCESS_EVENTS, // param1=unused, param2=unused\r\n GUI_TYPE_ADDNODE, // param1=void* parent, param2=TYPEDESCRIPTOR* type\r\n GUI_TYPE_CLEAR, // param1=unused, param2=unused\r\n GUI_UPDATE_TYPE_WIDGET, // param1=unused, param2=unused\r\n GUI_CLOSE_APPLICATION, // param1=unused, param2=unused\r\n GUI_MENU_SET_VISIBLE, // param1=int hMenu, param2=bool visible\r\n GUI_MENU_SET_ENTRY_VISIBLE, // param1=int hEntry, param2=bool visible\r\n GUI_MENU_SET_NAME, // param1=int hMenu, param2=const char* name\r\n GUI_MENU_SET_ENTRY_NAME, // param1=int hEntry, param2=const char* name\r\n GUI_FLUSH_LOG, // param1=unused, param2=unused\r\n GUI_MENU_SET_ENTRY_HOTKEY, // param1=int hEntry, param2=const char* hack\r\n GUI_REF_SEARCH_GETROWCOUNT, // param1=unused, param2=unused\r\n GUI_REF_SEARCH_GETCELLCONTENT, // param1=int row, param2=int col\r\n GUI_MENU_REMOVE, // param1=int hEntryMenu, param2=unused\r\n GUI_REF_ADDCOMMAND, // param1=const char* title, param2=const char* command\r\n GUI_OPEN_TRACE_FILE, // param1=const char* file name,param2=unused\r\n GUI_UPDATE_TRACE_BROWSER // param1=unused, param2=unused\r\n} GUIMSG;\r\n\r\n//GUI Typedefs\r\nstruct _TYPEDESCRIPTOR;\r\n\r\ntypedef void (*GUICALLBACK)();\r\ntypedef bool (*GUISCRIPTEXECUTE)(const char* text);\r\ntypedef void (*GUISCRIPTCOMPLETER)(const char* text, char** entries, int* entryCount);\r\ntypedef bool (*TYPETOSTRING)(const struct _TYPEDESCRIPTOR* type, char* dest, size_t* destCount); //don't change destCount for final failure\r\n\r\n//GUI structures\r\ntypedef struct\r\n{\r\n int row;\r\n int col;\r\n const char* str;\r\n} CELLINFO;\r\n\r\ntypedef struct\r\n{\r\n duint start;\r\n duint end;\r\n} SELECTIONDATA;\r\n\r\ntypedef struct\r\n{\r\n const void* data;\r\n duint size;\r\n} ICONDATA;\r\n\r\ntypedef struct\r\n{\r\n char name[64];\r\n int id;\r\n GUISCRIPTEXECUTE execute;\r\n GUISCRIPTCOMPLETER completeCommand;\r\n} SCRIPTTYPEINFO;\r\n\r\ntypedef struct\r\n{\r\n void* titleHwnd;\r\n void* classHwnd;\r\n char title[MAX_STRING_SIZE];\r\n char className[MAX_STRING_SIZE];\r\n} ACTIVEVIEW;\r\n\r\ntypedef struct _TYPEDESCRIPTOR\r\n{\r\n bool expanded; //is the type node expanded?\r\n bool reverse; //big endian?\r\n const char* name; //type name (int b)\r\n duint addr; //virtual address\r\n duint offset; //offset to addr for the actual location\r\n int id; //type id\r\n int size; //sizeof(type)\r\n TYPETOSTRING callback; //convert to string\r\n void* userdata; //user data\r\n} TYPEDESCRIPTOR;\r\n\r\n//GUI functions\r\n//code page is utf8\r\nBRIDGE_IMPEXP const char* GuiTranslateText(const char* Source);\r\nBRIDGE_IMPEXP void GuiDisasmAt(duint addr, duint cip);\r\nBRIDGE_IMPEXP void GuiSetDebugState(DBGSTATE state);\r\nBRIDGE_IMPEXP void GuiSetDebugStateFast(DBGSTATE state);\r\nBRIDGE_IMPEXP void GuiAddLogMessage(const char* msg);\r\nBRIDGE_IMPEXP void GuiLogClear();\r\nBRIDGE_IMPEXP void GuiUpdateAllViews();\r\nBRIDGE_IMPEXP void GuiUpdateRegisterView();\r\nBRIDGE_IMPEXP void GuiUpdateDisassemblyView();\r\nBRIDGE_IMPEXP void GuiUpdateBreakpointsView();\r\nBRIDGE_IMPEXP void GuiUpdateWindowTitle(const char* filename);\r\nBRIDGE_IMPEXP HWND GuiGetWindowHandle();\r\nBRIDGE_IMPEXP void GuiDumpAt(duint va);\r\nBRIDGE_IMPEXP void GuiScriptAdd(int count, const char** lines);\r\nBRIDGE_IMPEXP void GuiScriptClear();\r\nBRIDGE_IMPEXP void GuiScriptSetIp(int line);\r\nBRIDGE_IMPEXP void GuiScriptError(int line, const char* message);\r\nBRIDGE_IMPEXP void GuiScriptSetTitle(const char* title);\r\nBRIDGE_IMPEXP void GuiScriptSetInfoLine(int line, const char* info);\r\nBRIDGE_IMPEXP void GuiScriptMessage(const char* message);\r\nBRIDGE_IMPEXP int GuiScriptMsgyn(const char* message);\r\nBRIDGE_IMPEXP void GuiScriptEnableHighlighting(bool enable);\r\nBRIDGE_IMPEXP void GuiSymbolLogAdd(const char* message);\r\nBRIDGE_IMPEXP void GuiSymbolLogClear();\r\nBRIDGE_IMPEXP void GuiSymbolSetProgress(int percent);\r\nBRIDGE_IMPEXP void GuiSymbolUpdateModuleList(int count, SYMBOLMODULEINFO* modules);\r\nBRIDGE_IMPEXP void GuiSymbolRefreshCurrent();\r\nBRIDGE_IMPEXP void GuiReferenceAddColumn(int width, const char* title);\r\nBRIDGE_IMPEXP void GuiReferenceSetRowCount(int count);\r\nBRIDGE_IMPEXP int GuiReferenceGetRowCount();\r\nBRIDGE_IMPEXP int GuiReferenceSearchGetRowCount();\r\nBRIDGE_IMPEXP void GuiReferenceDeleteAllColumns();\r\nBRIDGE_IMPEXP void GuiReferenceInitialize(const char* name);\r\nBRIDGE_IMPEXP void GuiReferenceSetCellContent(int row, int col, const char* str);\r\nBRIDGE_IMPEXP char* GuiReferenceGetCellContent(int row, int col);\r\nBRIDGE_IMPEXP char* GuiReferenceSearchGetCellContent(int row, int col);\r\nBRIDGE_IMPEXP void GuiReferenceReloadData();\r\nBRIDGE_IMPEXP void GuiReferenceSetSingleSelection(int index, bool scroll);\r\nBRIDGE_IMPEXP void GuiReferenceSetProgress(int progress);\r\nBRIDGE_IMPEXP void GuiReferenceSetCurrentTaskProgress(int progress, const char* taskTitle);\r\nBRIDGE_IMPEXP void GuiReferenceSetSearchStartCol(int col);\r\nBRIDGE_IMPEXP void GuiStackDumpAt(duint addr, duint csp);\r\nBRIDGE_IMPEXP void GuiUpdateDumpView();\r\nBRIDGE_IMPEXP void GuiUpdateWatchView();\r\nBRIDGE_IMPEXP void GuiUpdateThreadView();\r\nBRIDGE_IMPEXP void GuiUpdateMemoryView();\r\nBRIDGE_IMPEXP void GuiAddRecentFile(const char* file);\r\nBRIDGE_IMPEXP void GuiSetLastException(unsigned int exception);\r\nBRIDGE_IMPEXP bool GuiGetDisassembly(duint addr, char* text);\r\nBRIDGE_IMPEXP int GuiMenuAdd(int hMenu, const char* title);\r\nBRIDGE_IMPEXP int GuiMenuAddEntry(int hMenu, const char* title);\r\nBRIDGE_IMPEXP void GuiMenuAddSeparator(int hMenu);\r\nBRIDGE_IMPEXP void GuiMenuClear(int hMenu);\r\nBRIDGE_IMPEXP void GuiMenuRemove(int hEntryMenu);\r\nBRIDGE_IMPEXP bool GuiSelectionGet(int hWindow, SELECTIONDATA* selection);\r\nBRIDGE_IMPEXP bool GuiSelectionSet(int hWindow, const SELECTIONDATA* selection);\r\nBRIDGE_IMPEXP bool GuiGetLineWindow(const char* title, char* text);\r\nBRIDGE_IMPEXP void GuiAutoCompleteAddCmd(const char* cmd);\r\nBRIDGE_IMPEXP void GuiAutoCompleteDelCmd(const char* cmd);\r\nBRIDGE_IMPEXP void GuiAutoCompleteClearAll();\r\nBRIDGE_IMPEXP void GuiAddStatusBarMessage(const char* msg);\r\nBRIDGE_IMPEXP void GuiUpdateSideBar();\r\nBRIDGE_IMPEXP void GuiRepaintTableView();\r\nBRIDGE_IMPEXP void GuiUpdatePatches();\r\nBRIDGE_IMPEXP void GuiUpdateCallStack();\r\nBRIDGE_IMPEXP void GuiUpdateSEHChain();\r\nBRIDGE_IMPEXP void GuiLoadSourceFile(const char* path, int line);\r\nBRIDGE_IMPEXP void GuiMenuSetIcon(int hMenu, const ICONDATA* icon);\r\nBRIDGE_IMPEXP void GuiMenuSetEntryIcon(int hEntry, const ICONDATA* icon);\r\nBRIDGE_IMPEXP void GuiMenuSetEntryChecked(int hEntry, bool checked);\r\nBRIDGE_IMPEXP void GuiMenuSetVisible(int hMenu, bool visible);\r\nBRIDGE_IMPEXP void GuiMenuSetEntryVisible(int hEntry, bool visible);\r\nBRIDGE_IMPEXP void GuiMenuSetName(int hMenu, const char* name);\r\nBRIDGE_IMPEXP void GuiMenuSetEntryName(int hEntry, const char* name);\r\nBRIDGE_IMPEXP void GuiMenuSetEntryHotkey(int hEntry, const char* hack);\r\nBRIDGE_IMPEXP void GuiShowCpu();\r\nBRIDGE_IMPEXP void GuiAddQWidgetTab(void* qWidget);\r\nBRIDGE_IMPEXP void GuiShowQWidgetTab(void* qWidget);\r\nBRIDGE_IMPEXP void GuiCloseQWidgetTab(void* qWidget);\r\nBRIDGE_IMPEXP void GuiExecuteOnGuiThread(GUICALLBACK cbGuiThread);\r\nBRIDGE_IMPEXP void GuiUpdateTimeWastedCounter();\r\nBRIDGE_IMPEXP void GuiSetGlobalNotes(const char* text);\r\nBRIDGE_IMPEXP void GuiGetGlobalNotes(char** text);\r\nBRIDGE_IMPEXP void GuiSetDebuggeeNotes(const char* text);\r\nBRIDGE_IMPEXP void GuiGetDebuggeeNotes(char** text);\r\nBRIDGE_IMPEXP void GuiDumpAtN(duint va, int index);\r\nBRIDGE_IMPEXP void GuiDisplayWarning(const char* title, const char* text);\r\nBRIDGE_IMPEXP void GuiRegisterScriptLanguage(SCRIPTTYPEINFO* info);\r\nBRIDGE_IMPEXP void GuiUnregisterScriptLanguage(int id);\r\nBRIDGE_IMPEXP void GuiUpdateArgumentWidget();\r\nBRIDGE_IMPEXP void GuiFocusView(int hWindow);\r\nBRIDGE_IMPEXP bool GuiIsUpdateDisabled();\r\nBRIDGE_IMPEXP void GuiUpdateEnable(bool updateNow);\r\nBRIDGE_IMPEXP void GuiUpdateDisable();\r\nBRIDGE_IMPEXP bool GuiLoadGraph(BridgeCFGraphList* graph, duint addr);\r\nBRIDGE_IMPEXP duint GuiGraphAt(duint addr);\r\nBRIDGE_IMPEXP void GuiUpdateGraphView();\r\nBRIDGE_IMPEXP void GuiDisableLog();\r\nBRIDGE_IMPEXP void GuiEnableLog();\r\nBRIDGE_IMPEXP void GuiAddFavouriteTool(const char* name, const char* description);\r\nBRIDGE_IMPEXP void GuiAddFavouriteCommand(const char* name, const char* shortcut);\r\nBRIDGE_IMPEXP void GuiSetFavouriteToolShortcut(const char* name, const char* shortcut);\r\nBRIDGE_IMPEXP void GuiFoldDisassembly(duint startAddress, duint length);\r\nBRIDGE_IMPEXP void GuiSelectInMemoryMap(duint addr);\r\nBRIDGE_IMPEXP void GuiGetActiveView(ACTIVEVIEW* activeView);\r\nBRIDGE_IMPEXP void GuiAddInfoLine(const char* infoLine);\r\nBRIDGE_IMPEXP void GuiProcessEvents();\r\nBRIDGE_IMPEXP void* GuiTypeAddNode(void* parent, const TYPEDESCRIPTOR* type);\r\nBRIDGE_IMPEXP bool GuiTypeClear();\r\nBRIDGE_IMPEXP void GuiUpdateTypeWidget();\r\nBRIDGE_IMPEXP void GuiCloseApplication();\r\nBRIDGE_IMPEXP void GuiFlushLog();\r\nBRIDGE_IMPEXP void GuiReferenceAddCommand(const char* title, const char* command);\r\nBRIDGE_IMPEXP void GuiUpdateTraceBrowser();\r\nBRIDGE_IMPEXP void GuiOpenTraceFile(const char* fileName);\r\n\r\n#ifdef __cplusplus\r\n}\r\n#endif\r\n\r\n#pragma pack(pop)\r\n\r\n#endif // _BRIDGEMAIN_H_\r\n" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/capstone/arm.h", "content": "#ifndef CAPSTONE_ARM_H\r\n#define CAPSTONE_ARM_H\r\n\r\n/* Capstone Disassembly Engine */\r\n/* By Nguyen Anh Quynh , 2013-2015 */\r\n\r\n#ifdef __cplusplus\r\nextern \"C\" {\r\n#endif\r\n\r\n#include \"platform.h\"\r\n\r\n#ifdef _MSC_VER\r\n#pragma warning(disable:4201)\r\n#endif\r\n\r\n//> ARM shift type\r\ntypedef enum arm_shifter\r\n{\r\n ARM_SFT_INVALID = 0,\r\n ARM_SFT_ASR, // shift with immediate const\r\n ARM_SFT_LSL, // shift with immediate const\r\n ARM_SFT_LSR, // shift with immediate const\r\n ARM_SFT_ROR, // shift with immediate const\r\n ARM_SFT_RRX, // shift with immediate const\r\n ARM_SFT_ASR_REG, // shift with register\r\n ARM_SFT_LSL_REG, // shift with register\r\n ARM_SFT_LSR_REG, // shift with register\r\n ARM_SFT_ROR_REG, // shift with register\r\n ARM_SFT_RRX_REG, // shift with register\r\n} arm_shifter;\r\n\r\n//> ARM condition code\r\ntypedef enum arm_cc\r\n{\r\n ARM_CC_INVALID = 0,\r\n ARM_CC_EQ, // Equal Equal\r\n ARM_CC_NE, // Not equal Not equal, or unordered\r\n ARM_CC_HS, // Carry set >, ==, or unordered\r\n ARM_CC_LO, // Carry clear Less than\r\n ARM_CC_MI, // Minus, negative Less than\r\n ARM_CC_PL, // Plus, positive or zero >, ==, or unordered\r\n ARM_CC_VS, // Overflow Unordered\r\n ARM_CC_VC, // No overflow Not unordered\r\n ARM_CC_HI, // Unsigned higher Greater than, or unordered\r\n ARM_CC_LS, // Unsigned lower or same Less than or equal\r\n ARM_CC_GE, // Greater than or equal Greater than or equal\r\n ARM_CC_LT, // Less than Less than, or unordered\r\n ARM_CC_GT, // Greater than Greater than\r\n ARM_CC_LE, // Less than or equal <, ==, or unordered\r\n ARM_CC_AL // Always (unconditional) Always (unconditional)\r\n} arm_cc;\r\n\r\ntypedef enum arm_sysreg\r\n{\r\n //> Special registers for MSR\r\n ARM_SYSREG_INVALID = 0,\r\n\r\n // SPSR* registers can be OR combined\r\n ARM_SYSREG_SPSR_C = 1,\r\n ARM_SYSREG_SPSR_X = 2,\r\n ARM_SYSREG_SPSR_S = 4,\r\n ARM_SYSREG_SPSR_F = 8,\r\n\r\n // CPSR* registers can be OR combined\r\n ARM_SYSREG_CPSR_C = 16,\r\n ARM_SYSREG_CPSR_X = 32,\r\n ARM_SYSREG_CPSR_S = 64,\r\n ARM_SYSREG_CPSR_F = 128,\r\n\r\n // independent registers\r\n ARM_SYSREG_APSR = 256,\r\n ARM_SYSREG_APSR_G,\r\n ARM_SYSREG_APSR_NZCVQ,\r\n ARM_SYSREG_APSR_NZCVQG,\r\n\r\n ARM_SYSREG_IAPSR,\r\n ARM_SYSREG_IAPSR_G,\r\n ARM_SYSREG_IAPSR_NZCVQG,\r\n ARM_SYSREG_IAPSR_NZCVQ,\r\n\r\n ARM_SYSREG_EAPSR,\r\n ARM_SYSREG_EAPSR_G,\r\n ARM_SYSREG_EAPSR_NZCVQG,\r\n ARM_SYSREG_EAPSR_NZCVQ,\r\n\r\n ARM_SYSREG_XPSR,\r\n ARM_SYSREG_XPSR_G,\r\n ARM_SYSREG_XPSR_NZCVQG,\r\n ARM_SYSREG_XPSR_NZCVQ,\r\n\r\n ARM_SYSREG_IPSR,\r\n ARM_SYSREG_EPSR,\r\n ARM_SYSREG_IEPSR,\r\n\r\n ARM_SYSREG_MSP,\r\n ARM_SYSREG_PSP,\r\n ARM_SYSREG_PRIMASK,\r\n ARM_SYSREG_BASEPRI,\r\n ARM_SYSREG_BASEPRI_MAX,\r\n ARM_SYSREG_FAULTMASK,\r\n ARM_SYSREG_CONTROL,\r\n\r\n // Banked Registers\r\n ARM_SYSREG_R8_USR,\r\n ARM_SYSREG_R9_USR,\r\n ARM_SYSREG_R10_USR,\r\n ARM_SYSREG_R11_USR,\r\n ARM_SYSREG_R12_USR,\r\n ARM_SYSREG_SP_USR,\r\n ARM_SYSREG_LR_USR,\r\n ARM_SYSREG_R8_FIQ,\r\n ARM_SYSREG_R9_FIQ,\r\n ARM_SYSREG_R10_FIQ,\r\n ARM_SYSREG_R11_FIQ,\r\n ARM_SYSREG_R12_FIQ,\r\n ARM_SYSREG_SP_FIQ,\r\n ARM_SYSREG_LR_FIQ,\r\n ARM_SYSREG_LR_IRQ,\r\n ARM_SYSREG_SP_IRQ,\r\n ARM_SYSREG_LR_SVC,\r\n ARM_SYSREG_SP_SVC,\r\n ARM_SYSREG_LR_ABT,\r\n ARM_SYSREG_SP_ABT,\r\n ARM_SYSREG_LR_UND,\r\n ARM_SYSREG_SP_UND,\r\n ARM_SYSREG_LR_MON,\r\n ARM_SYSREG_SP_MON,\r\n ARM_SYSREG_ELR_HYP,\r\n ARM_SYSREG_SP_HYP,\r\n\r\n ARM_SYSREG_SPSR_FIQ,\r\n ARM_SYSREG_SPSR_IRQ,\r\n ARM_SYSREG_SPSR_SVC,\r\n ARM_SYSREG_SPSR_ABT,\r\n ARM_SYSREG_SPSR_UND,\r\n ARM_SYSREG_SPSR_MON,\r\n ARM_SYSREG_SPSR_HYP,\r\n} arm_sysreg;\r\n\r\n//> The memory barrier constants map directly to the 4-bit encoding of\r\n//> the option field for Memory Barrier operations.\r\ntypedef enum arm_mem_barrier\r\n{\r\n ARM_MB_INVALID = 0,\r\n ARM_MB_RESERVED_0,\r\n ARM_MB_OSHLD,\r\n ARM_MB_OSHST,\r\n ARM_MB_OSH,\r\n ARM_MB_RESERVED_4,\r\n ARM_MB_NSHLD,\r\n ARM_MB_NSHST,\r\n ARM_MB_NSH,\r\n ARM_MB_RESERVED_8,\r\n ARM_MB_ISHLD,\r\n ARM_MB_ISHST,\r\n ARM_MB_ISH,\r\n ARM_MB_RESERVED_12,\r\n ARM_MB_LD,\r\n ARM_MB_ST,\r\n ARM_MB_SY,\r\n} arm_mem_barrier;\r\n\r\n//> Operand type for instruction's operands\r\ntypedef enum arm_op_type\r\n{\r\n ARM_OP_INVALID = 0, // = CS_OP_INVALID (Uninitialized).\r\n ARM_OP_REG, // = CS_OP_REG (Register operand).\r\n ARM_OP_IMM, // = CS_OP_IMM (Immediate operand).\r\n ARM_OP_MEM, // = CS_OP_MEM (Memory operand).\r\n ARM_OP_FP, // = CS_OP_FP (Floating-Point operand).\r\n ARM_OP_CIMM = 64, // C-Immediate (coprocessor registers)\r\n ARM_OP_PIMM, // P-Immediate (coprocessor registers)\r\n ARM_OP_SETEND, // operand for SETEND instruction\r\n ARM_OP_SYSREG, // MSR/MRS special register operand\r\n} arm_op_type;\r\n\r\n//> Operand type for SETEND instruction\r\ntypedef enum arm_setend_type\r\n{\r\n ARM_SETEND_INVALID = 0, // Uninitialized.\r\n ARM_SETEND_BE, // BE operand.\r\n ARM_SETEND_LE, // LE operand\r\n} arm_setend_type;\r\n\r\ntypedef enum arm_cpsmode_type\r\n{\r\n ARM_CPSMODE_INVALID = 0,\r\n ARM_CPSMODE_IE = 2,\r\n ARM_CPSMODE_ID = 3\r\n} arm_cpsmode_type;\r\n\r\n//> Operand type for SETEND instruction\r\ntypedef enum arm_cpsflag_type\r\n{\r\n ARM_CPSFLAG_INVALID = 0,\r\n ARM_CPSFLAG_F = 1,\r\n ARM_CPSFLAG_I = 2,\r\n ARM_CPSFLAG_A = 4,\r\n ARM_CPSFLAG_NONE = 16, // no flag\r\n} arm_cpsflag_type;\r\n\r\n//> Data type for elements of vector instructions.\r\ntypedef enum arm_vectordata_type\r\n{\r\n ARM_VECTORDATA_INVALID = 0,\r\n\r\n // Integer type\r\n ARM_VECTORDATA_I8,\r\n ARM_VECTORDATA_I16,\r\n ARM_VECTORDATA_I32,\r\n ARM_VECTORDATA_I64,\r\n\r\n // Signed integer type\r\n ARM_VECTORDATA_S8,\r\n ARM_VECTORDATA_S16,\r\n ARM_VECTORDATA_S32,\r\n ARM_VECTORDATA_S64,\r\n\r\n // Unsigned integer type\r\n ARM_VECTORDATA_U8,\r\n ARM_VECTORDATA_U16,\r\n ARM_VECTORDATA_U32,\r\n ARM_VECTORDATA_U64,\r\n\r\n // Data type for VMUL/VMULL\r\n ARM_VECTORDATA_P8,\r\n\r\n // Floating type\r\n ARM_VECTORDATA_F32,\r\n ARM_VECTORDATA_F64,\r\n\r\n // Convert float <-> float\r\n ARM_VECTORDATA_F16F64, // f16.f64\r\n ARM_VECTORDATA_F64F16, // f64.f16\r\n ARM_VECTORDATA_F32F16, // f32.f16\r\n ARM_VECTORDATA_F16F32, // f32.f16\r\n ARM_VECTORDATA_F64F32, // f64.f32\r\n ARM_VECTORDATA_F32F64, // f32.f64\r\n\r\n // Convert integer <-> float\r\n ARM_VECTORDATA_S32F32, // s32.f32\r\n ARM_VECTORDATA_U32F32, // u32.f32\r\n ARM_VECTORDATA_F32S32, // f32.s32\r\n ARM_VECTORDATA_F32U32, // f32.u32\r\n ARM_VECTORDATA_F64S16, // f64.s16\r\n ARM_VECTORDATA_F32S16, // f32.s16\r\n ARM_VECTORDATA_F64S32, // f64.s32\r\n ARM_VECTORDATA_S16F64, // s16.f64\r\n ARM_VECTORDATA_S16F32, // s16.f64\r\n ARM_VECTORDATA_S32F64, // s32.f64\r\n ARM_VECTORDATA_U16F64, // u16.f64\r\n ARM_VECTORDATA_U16F32, // u16.f32\r\n ARM_VECTORDATA_U32F64, // u32.f64\r\n ARM_VECTORDATA_F64U16, // f64.u16\r\n ARM_VECTORDATA_F32U16, // f32.u16\r\n ARM_VECTORDATA_F64U32, // f64.u32\r\n} arm_vectordata_type;\r\n\r\n//> ARM registers\r\ntypedef enum arm_reg\r\n{\r\n ARM_REG_INVALID = 0,\r\n ARM_REG_APSR,\r\n ARM_REG_APSR_NZCV,\r\n ARM_REG_CPSR,\r\n ARM_REG_FPEXC,\r\n ARM_REG_FPINST,\r\n ARM_REG_FPSCR,\r\n ARM_REG_FPSCR_NZCV,\r\n ARM_REG_FPSID,\r\n ARM_REG_ITSTATE,\r\n ARM_REG_LR,\r\n ARM_REG_PC,\r\n ARM_REG_SP,\r\n ARM_REG_SPSR,\r\n ARM_REG_D0,\r\n ARM_REG_D1,\r\n ARM_REG_D2,\r\n ARM_REG_D3,\r\n ARM_REG_D4,\r\n ARM_REG_D5,\r\n ARM_REG_D6,\r\n ARM_REG_D7,\r\n ARM_REG_D8,\r\n ARM_REG_D9,\r\n ARM_REG_D10,\r\n ARM_REG_D11,\r\n ARM_REG_D12,\r\n ARM_REG_D13,\r\n ARM_REG_D14,\r\n ARM_REG_D15,\r\n ARM_REG_D16,\r\n ARM_REG_D17,\r\n ARM_REG_D18,\r\n ARM_REG_D19,\r\n ARM_REG_D20,\r\n ARM_REG_D21,\r\n ARM_REG_D22,\r\n ARM_REG_D23,\r\n ARM_REG_D24,\r\n ARM_REG_D25,\r\n ARM_REG_D26,\r\n ARM_REG_D27,\r\n ARM_REG_D28,\r\n ARM_REG_D29,\r\n ARM_REG_D30,\r\n ARM_REG_D31,\r\n ARM_REG_FPINST2,\r\n ARM_REG_MVFR0,\r\n ARM_REG_MVFR1,\r\n ARM_REG_MVFR2,\r\n ARM_REG_Q0,\r\n ARM_REG_Q1,\r\n ARM_REG_Q2,\r\n ARM_REG_Q3,\r\n ARM_REG_Q4,\r\n ARM_REG_Q5,\r\n ARM_REG_Q6,\r\n ARM_REG_Q7,\r\n ARM_REG_Q8,\r\n ARM_REG_Q9,\r\n ARM_REG_Q10,\r\n ARM_REG_Q11,\r\n ARM_REG_Q12,\r\n ARM_REG_Q13,\r\n ARM_REG_Q14,\r\n ARM_REG_Q15,\r\n ARM_REG_R0,\r\n ARM_REG_R1,\r\n ARM_REG_R2,\r\n ARM_REG_R3,\r\n ARM_REG_R4,\r\n ARM_REG_R5,\r\n ARM_REG_R6,\r\n ARM_REG_R7,\r\n ARM_REG_R8,\r\n ARM_REG_R9,\r\n ARM_REG_R10,\r\n ARM_REG_R11,\r\n ARM_REG_R12,\r\n ARM_REG_S0,\r\n ARM_REG_S1,\r\n ARM_REG_S2,\r\n ARM_REG_S3,\r\n ARM_REG_S4,\r\n ARM_REG_S5,\r\n ARM_REG_S6,\r\n ARM_REG_S7,\r\n ARM_REG_S8,\r\n ARM_REG_S9,\r\n ARM_REG_S10,\r\n ARM_REG_S11,\r\n ARM_REG_S12,\r\n ARM_REG_S13,\r\n ARM_REG_S14,\r\n ARM_REG_S15,\r\n ARM_REG_S16,\r\n ARM_REG_S17,\r\n ARM_REG_S18,\r\n ARM_REG_S19,\r\n ARM_REG_S20,\r\n ARM_REG_S21,\r\n ARM_REG_S22,\r\n ARM_REG_S23,\r\n ARM_REG_S24,\r\n ARM_REG_S25,\r\n ARM_REG_S26,\r\n ARM_REG_S27,\r\n ARM_REG_S28,\r\n ARM_REG_S29,\r\n ARM_REG_S30,\r\n ARM_REG_S31,\r\n\r\n ARM_REG_ENDING, // <-- mark the end of the list or registers\r\n\r\n //> alias registers\r\n ARM_REG_R13 = ARM_REG_SP,\r\n ARM_REG_R14 = ARM_REG_LR,\r\n ARM_REG_R15 = ARM_REG_PC,\r\n\r\n ARM_REG_SB = ARM_REG_R9,\r\n ARM_REG_SL = ARM_REG_R10,\r\n ARM_REG_FP = ARM_REG_R11,\r\n ARM_REG_IP = ARM_REG_R12,\r\n} arm_reg;\r\n\r\n// Instruction's operand referring to memory\r\n// This is associated with ARM_OP_MEM operand type above\r\ntypedef struct arm_op_mem\r\n{\r\n arm_reg base; // base register\r\n arm_reg index; // index register\r\n int scale; // scale for index register (can be 1, or -1)\r\n int disp; // displacement/offset value\r\n int lshift; // left-shift on index register, or 0 if irrelevant.\r\n} arm_op_mem;\r\n\r\n// Instruction operand\r\ntypedef struct cs_arm_op\r\n{\r\n int vector_index; // Vector Index for some vector operands (or -1 if irrelevant)\r\n\r\n struct\r\n {\r\n arm_shifter type;\r\n unsigned int value;\r\n } shift;\r\n\r\n arm_op_type type; // operand type\r\n\r\n union\r\n {\r\n int reg; // register value for REG/SYSREG operand\r\n int32_t imm; // immediate value for C-IMM, P-IMM or IMM operand\r\n double fp; // floating point value for FP operand\r\n arm_op_mem mem; // base/index/scale/disp value for MEM operand\r\n arm_setend_type setend; // SETEND instruction's operand type\r\n };\r\n\r\n // in some instructions, an operand can be subtracted or added to\r\n // the base register,\r\n bool subtracted; // if TRUE, this operand is subtracted. otherwise, it is added.\r\n\r\n // How is this operand accessed? (READ, WRITE or READ|WRITE)\r\n // This field is combined of cs_ac_type.\r\n // NOTE: this field is irrelevant if engine is compiled in DIET mode.\r\n uint8_t access;\r\n\r\n // Neon lane index for NEON instructions (or -1 if irrelevant)\r\n int8_t neon_lane;\r\n} cs_arm_op;\r\n\r\n// Instruction structure\r\ntypedef struct cs_arm\r\n{\r\n bool usermode; // User-mode registers to be loaded (for LDM/STM instructions)\r\n int vector_size; // Scalar size for vector instructions\r\n arm_vectordata_type vector_data; // Data type for elements of vector instructions\r\n arm_cpsmode_type cps_mode; // CPS mode for CPS instruction\r\n arm_cpsflag_type cps_flag; // CPS mode for CPS instruction\r\n arm_cc cc; // conditional code for this insn\r\n bool update_flags; // does this insn update flags?\r\n bool writeback; // does this insn write-back?\r\n arm_mem_barrier mem_barrier; // Option for some memory barrier instructions\r\n\r\n // Number of operands of this instruction,\r\n // or 0 when instruction has no operand.\r\n uint8_t op_count;\r\n\r\n cs_arm_op operands[36]; // operands for this instruction.\r\n} cs_arm;\r\n\r\n//> ARM instruction\r\ntypedef enum arm_insn\r\n{\r\n ARM_INS_INVALID = 0,\r\n\r\n ARM_INS_ADC,\r\n ARM_INS_ADD,\r\n ARM_INS_ADR,\r\n ARM_INS_AESD,\r\n ARM_INS_AESE,\r\n ARM_INS_AESIMC,\r\n ARM_INS_AESMC,\r\n ARM_INS_AND,\r\n ARM_INS_BFC,\r\n ARM_INS_BFI,\r\n ARM_INS_BIC,\r\n ARM_INS_BKPT,\r\n ARM_INS_BL,\r\n ARM_INS_BLX,\r\n ARM_INS_BX,\r\n ARM_INS_BXJ,\r\n ARM_INS_B,\r\n ARM_INS_CDP,\r\n ARM_INS_CDP2,\r\n ARM_INS_CLREX,\r\n ARM_INS_CLZ,\r\n ARM_INS_CMN,\r\n ARM_INS_CMP,\r\n ARM_INS_CPS,\r\n ARM_INS_CRC32B,\r\n ARM_INS_CRC32CB,\r\n ARM_INS_CRC32CH,\r\n ARM_INS_CRC32CW,\r\n ARM_INS_CRC32H,\r\n ARM_INS_CRC32W,\r\n ARM_INS_DBG,\r\n ARM_INS_DMB,\r\n ARM_INS_DSB,\r\n ARM_INS_EOR,\r\n ARM_INS_ERET,\r\n ARM_INS_VMOV,\r\n ARM_INS_FLDMDBX,\r\n ARM_INS_FLDMIAX,\r\n ARM_INS_VMRS,\r\n ARM_INS_FSTMDBX,\r\n ARM_INS_FSTMIAX,\r\n ARM_INS_HINT,\r\n ARM_INS_HLT,\r\n ARM_INS_HVC,\r\n ARM_INS_ISB,\r\n ARM_INS_LDA,\r\n ARM_INS_LDAB,\r\n ARM_INS_LDAEX,\r\n ARM_INS_LDAEXB,\r\n ARM_INS_LDAEXD,\r\n ARM_INS_LDAEXH,\r\n ARM_INS_LDAH,\r\n ARM_INS_LDC2L,\r\n ARM_INS_LDC2,\r\n ARM_INS_LDCL,\r\n ARM_INS_LDC,\r\n ARM_INS_LDMDA,\r\n ARM_INS_LDMDB,\r\n ARM_INS_LDM,\r\n ARM_INS_LDMIB,\r\n ARM_INS_LDRBT,\r\n ARM_INS_LDRB,\r\n ARM_INS_LDRD,\r\n ARM_INS_LDREX,\r\n ARM_INS_LDREXB,\r\n ARM_INS_LDREXD,\r\n ARM_INS_LDREXH,\r\n ARM_INS_LDRH,\r\n ARM_INS_LDRHT,\r\n ARM_INS_LDRSB,\r\n ARM_INS_LDRSBT,\r\n ARM_INS_LDRSH,\r\n ARM_INS_LDRSHT,\r\n ARM_INS_LDRT,\r\n ARM_INS_LDR,\r\n ARM_INS_MCR,\r\n ARM_INS_MCR2,\r\n ARM_INS_MCRR,\r\n ARM_INS_MCRR2,\r\n ARM_INS_MLA,\r\n ARM_INS_MLS,\r\n ARM_INS_MOV,\r\n ARM_INS_MOVT,\r\n ARM_INS_MOVW,\r\n ARM_INS_MRC,\r\n ARM_INS_MRC2,\r\n ARM_INS_MRRC,\r\n ARM_INS_MRRC2,\r\n ARM_INS_MRS,\r\n ARM_INS_MSR,\r\n ARM_INS_MUL,\r\n ARM_INS_MVN,\r\n ARM_INS_ORR,\r\n ARM_INS_PKHBT,\r\n ARM_INS_PKHTB,\r\n ARM_INS_PLDW,\r\n ARM_INS_PLD,\r\n ARM_INS_PLI,\r\n ARM_INS_QADD,\r\n ARM_INS_QADD16,\r\n ARM_INS_QADD8,\r\n ARM_INS_QASX,\r\n ARM_INS_QDADD,\r\n ARM_INS_QDSUB,\r\n ARM_INS_QSAX,\r\n ARM_INS_QSUB,\r\n ARM_INS_QSUB16,\r\n ARM_INS_QSUB8,\r\n ARM_INS_RBIT,\r\n ARM_INS_REV,\r\n ARM_INS_REV16,\r\n ARM_INS_REVSH,\r\n ARM_INS_RFEDA,\r\n ARM_INS_RFEDB,\r\n ARM_INS_RFEIA,\r\n ARM_INS_RFEIB,\r\n ARM_INS_RSB,\r\n ARM_INS_RSC,\r\n ARM_INS_SADD16,\r\n ARM_INS_SADD8,\r\n ARM_INS_SASX,\r\n ARM_INS_SBC,\r\n ARM_INS_SBFX,\r\n ARM_INS_SDIV,\r\n ARM_INS_SEL,\r\n ARM_INS_SETEND,\r\n ARM_INS_SHA1C,\r\n ARM_INS_SHA1H,\r\n ARM_INS_SHA1M,\r\n ARM_INS_SHA1P,\r\n ARM_INS_SHA1SU0,\r\n ARM_INS_SHA1SU1,\r\n ARM_INS_SHA256H,\r\n ARM_INS_SHA256H2,\r\n ARM_INS_SHA256SU0,\r\n ARM_INS_SHA256SU1,\r\n ARM_INS_SHADD16,\r\n ARM_INS_SHADD8,\r\n ARM_INS_SHASX,\r\n ARM_INS_SHSAX,\r\n ARM_INS_SHSUB16,\r\n ARM_INS_SHSUB8,\r\n ARM_INS_SMC,\r\n ARM_INS_SMLABB,\r\n ARM_INS_SMLABT,\r\n ARM_INS_SMLAD,\r\n ARM_INS_SMLADX,\r\n ARM_INS_SMLAL,\r\n ARM_INS_SMLALBB,\r\n ARM_INS_SMLALBT,\r\n ARM_INS_SMLALD,\r\n ARM_INS_SMLALDX,\r\n ARM_INS_SMLALTB,\r\n ARM_INS_SMLALTT,\r\n ARM_INS_SMLATB,\r\n ARM_INS_SMLATT,\r\n ARM_INS_SMLAWB,\r\n ARM_INS_SMLAWT,\r\n ARM_INS_SMLSD,\r\n ARM_INS_SMLSDX,\r\n ARM_INS_SMLSLD,\r\n ARM_INS_SMLSLDX,\r\n ARM_INS_SMMLA,\r\n ARM_INS_SMMLAR,\r\n ARM_INS_SMMLS,\r\n ARM_INS_SMMLSR,\r\n ARM_INS_SMMUL,\r\n ARM_INS_SMMULR,\r\n ARM_INS_SMUAD,\r\n ARM_INS_SMUADX,\r\n ARM_INS_SMULBB,\r\n ARM_INS_SMULBT,\r\n ARM_INS_SMULL,\r\n ARM_INS_SMULTB,\r\n ARM_INS_SMULTT,\r\n ARM_INS_SMULWB,\r\n ARM_INS_SMULWT,\r\n ARM_INS_SMUSD,\r\n ARM_INS_SMUSDX,\r\n ARM_INS_SRSDA,\r\n ARM_INS_SRSDB,\r\n ARM_INS_SRSIA,\r\n ARM_INS_SRSIB,\r\n ARM_INS_SSAT,\r\n ARM_INS_SSAT16,\r\n ARM_INS_SSAX,\r\n ARM_INS_SSUB16,\r\n ARM_INS_SSUB8,\r\n ARM_INS_STC2L,\r\n ARM_INS_STC2,\r\n ARM_INS_STCL,\r\n ARM_INS_STC,\r\n ARM_INS_STL,\r\n ARM_INS_STLB,\r\n ARM_INS_STLEX,\r\n ARM_INS_STLEXB,\r\n ARM_INS_STLEXD,\r\n ARM_INS_STLEXH,\r\n ARM_INS_STLH,\r\n ARM_INS_STMDA,\r\n ARM_INS_STMDB,\r\n ARM_INS_STM,\r\n ARM_INS_STMIB,\r\n ARM_INS_STRBT,\r\n ARM_INS_STRB,\r\n ARM_INS_STRD,\r\n ARM_INS_STREX,\r\n ARM_INS_STREXB,\r\n ARM_INS_STREXD,\r\n ARM_INS_STREXH,\r\n ARM_INS_STRH,\r\n ARM_INS_STRHT,\r\n ARM_INS_STRT,\r\n ARM_INS_STR,\r\n ARM_INS_SUB,\r\n ARM_INS_SVC,\r\n ARM_INS_SWP,\r\n ARM_INS_SWPB,\r\n ARM_INS_SXTAB,\r\n ARM_INS_SXTAB16,\r\n ARM_INS_SXTAH,\r\n ARM_INS_SXTB,\r\n ARM_INS_SXTB16,\r\n ARM_INS_SXTH,\r\n ARM_INS_TEQ,\r\n ARM_INS_TRAP,\r\n ARM_INS_TST,\r\n ARM_INS_UADD16,\r\n ARM_INS_UADD8,\r\n ARM_INS_UASX,\r\n ARM_INS_UBFX,\r\n ARM_INS_UDF,\r\n ARM_INS_UDIV,\r\n ARM_INS_UHADD16,\r\n ARM_INS_UHADD8,\r\n ARM_INS_UHASX,\r\n ARM_INS_UHSAX,\r\n ARM_INS_UHSUB16,\r\n ARM_INS_UHSUB8,\r\n ARM_INS_UMAAL,\r\n ARM_INS_UMLAL,\r\n ARM_INS_UMULL,\r\n ARM_INS_UQADD16,\r\n ARM_INS_UQADD8,\r\n ARM_INS_UQASX,\r\n ARM_INS_UQSAX,\r\n ARM_INS_UQSUB16,\r\n ARM_INS_UQSUB8,\r\n ARM_INS_USAD8,\r\n ARM_INS_USADA8,\r\n ARM_INS_USAT,\r\n ARM_INS_USAT16,\r\n ARM_INS_USAX,\r\n ARM_INS_USUB16,\r\n ARM_INS_USUB8,\r\n ARM_INS_UXTAB,\r\n ARM_INS_UXTAB16,\r\n ARM_INS_UXTAH,\r\n ARM_INS_UXTB,\r\n ARM_INS_UXTB16,\r\n ARM_INS_UXTH,\r\n ARM_INS_VABAL,\r\n ARM_INS_VABA,\r\n ARM_INS_VABDL,\r\n ARM_INS_VABD,\r\n ARM_INS_VABS,\r\n ARM_INS_VACGE,\r\n ARM_INS_VACGT,\r\n ARM_INS_VADD,\r\n ARM_INS_VADDHN,\r\n ARM_INS_VADDL,\r\n ARM_INS_VADDW,\r\n ARM_INS_VAND,\r\n ARM_INS_VBIC,\r\n ARM_INS_VBIF,\r\n ARM_INS_VBIT,\r\n ARM_INS_VBSL,\r\n ARM_INS_VCEQ,\r\n ARM_INS_VCGE,\r\n ARM_INS_VCGT,\r\n ARM_INS_VCLE,\r\n ARM_INS_VCLS,\r\n ARM_INS_VCLT,\r\n ARM_INS_VCLZ,\r\n ARM_INS_VCMP,\r\n ARM_INS_VCMPE,\r\n ARM_INS_VCNT,\r\n ARM_INS_VCVTA,\r\n ARM_INS_VCVTB,\r\n ARM_INS_VCVT,\r\n ARM_INS_VCVTM,\r\n ARM_INS_VCVTN,\r\n ARM_INS_VCVTP,\r\n ARM_INS_VCVTT,\r\n ARM_INS_VDIV,\r\n ARM_INS_VDUP,\r\n ARM_INS_VEOR,\r\n ARM_INS_VEXT,\r\n ARM_INS_VFMA,\r\n ARM_INS_VFMS,\r\n ARM_INS_VFNMA,\r\n ARM_INS_VFNMS,\r\n ARM_INS_VHADD,\r\n ARM_INS_VHSUB,\r\n ARM_INS_VLD1,\r\n ARM_INS_VLD2,\r\n ARM_INS_VLD3,\r\n ARM_INS_VLD4,\r\n ARM_INS_VLDMDB,\r\n ARM_INS_VLDMIA,\r\n ARM_INS_VLDR,\r\n ARM_INS_VMAXNM,\r\n ARM_INS_VMAX,\r\n ARM_INS_VMINNM,\r\n ARM_INS_VMIN,\r\n ARM_INS_VMLA,\r\n ARM_INS_VMLAL,\r\n ARM_INS_VMLS,\r\n ARM_INS_VMLSL,\r\n ARM_INS_VMOVL,\r\n ARM_INS_VMOVN,\r\n ARM_INS_VMSR,\r\n ARM_INS_VMUL,\r\n ARM_INS_VMULL,\r\n ARM_INS_VMVN,\r\n ARM_INS_VNEG,\r\n ARM_INS_VNMLA,\r\n ARM_INS_VNMLS,\r\n ARM_INS_VNMUL,\r\n ARM_INS_VORN,\r\n ARM_INS_VORR,\r\n ARM_INS_VPADAL,\r\n ARM_INS_VPADDL,\r\n ARM_INS_VPADD,\r\n ARM_INS_VPMAX,\r\n ARM_INS_VPMIN,\r\n ARM_INS_VQABS,\r\n ARM_INS_VQADD,\r\n ARM_INS_VQDMLAL,\r\n ARM_INS_VQDMLSL,\r\n ARM_INS_VQDMULH,\r\n ARM_INS_VQDMULL,\r\n ARM_INS_VQMOVUN,\r\n ARM_INS_VQMOVN,\r\n ARM_INS_VQNEG,\r\n ARM_INS_VQRDMULH,\r\n ARM_INS_VQRSHL,\r\n ARM_INS_VQRSHRN,\r\n ARM_INS_VQRSHRUN,\r\n ARM_INS_VQSHL,\r\n ARM_INS_VQSHLU,\r\n ARM_INS_VQSHRN,\r\n ARM_INS_VQSHRUN,\r\n ARM_INS_VQSUB,\r\n ARM_INS_VRADDHN,\r\n ARM_INS_VRECPE,\r\n ARM_INS_VRECPS,\r\n ARM_INS_VREV16,\r\n ARM_INS_VREV32,\r\n ARM_INS_VREV64,\r\n ARM_INS_VRHADD,\r\n ARM_INS_VRINTA,\r\n ARM_INS_VRINTM,\r\n ARM_INS_VRINTN,\r\n ARM_INS_VRINTP,\r\n ARM_INS_VRINTR,\r\n ARM_INS_VRINTX,\r\n ARM_INS_VRINTZ,\r\n ARM_INS_VRSHL,\r\n ARM_INS_VRSHRN,\r\n ARM_INS_VRSHR,\r\n ARM_INS_VRSQRTE,\r\n ARM_INS_VRSQRTS,\r\n ARM_INS_VRSRA,\r\n ARM_INS_VRSUBHN,\r\n ARM_INS_VSELEQ,\r\n ARM_INS_VSELGE,\r\n ARM_INS_VSELGT,\r\n ARM_INS_VSELVS,\r\n ARM_INS_VSHLL,\r\n ARM_INS_VSHL,\r\n ARM_INS_VSHRN,\r\n ARM_INS_VSHR,\r\n ARM_INS_VSLI,\r\n ARM_INS_VSQRT,\r\n ARM_INS_VSRA,\r\n ARM_INS_VSRI,\r\n ARM_INS_VST1,\r\n ARM_INS_VST2,\r\n ARM_INS_VST3,\r\n ARM_INS_VST4,\r\n ARM_INS_VSTMDB,\r\n ARM_INS_VSTMIA,\r\n ARM_INS_VSTR,\r\n ARM_INS_VSUB,\r\n ARM_INS_VSUBHN,\r\n ARM_INS_VSUBL,\r\n ARM_INS_VSUBW,\r\n ARM_INS_VSWP,\r\n ARM_INS_VTBL,\r\n ARM_INS_VTBX,\r\n ARM_INS_VCVTR,\r\n ARM_INS_VTRN,\r\n ARM_INS_VTST,\r\n ARM_INS_VUZP,\r\n ARM_INS_VZIP,\r\n ARM_INS_ADDW,\r\n ARM_INS_ASR,\r\n ARM_INS_DCPS1,\r\n ARM_INS_DCPS2,\r\n ARM_INS_DCPS3,\r\n ARM_INS_IT,\r\n ARM_INS_LSL,\r\n ARM_INS_LSR,\r\n ARM_INS_ORN,\r\n ARM_INS_ROR,\r\n ARM_INS_RRX,\r\n ARM_INS_SUBW,\r\n ARM_INS_TBB,\r\n ARM_INS_TBH,\r\n ARM_INS_CBNZ,\r\n ARM_INS_CBZ,\r\n ARM_INS_POP,\r\n ARM_INS_PUSH,\r\n\r\n // special instructions\r\n ARM_INS_NOP,\r\n ARM_INS_YIELD,\r\n ARM_INS_WFE,\r\n ARM_INS_WFI,\r\n ARM_INS_SEV,\r\n ARM_INS_SEVL,\r\n ARM_INS_VPUSH,\r\n ARM_INS_VPOP,\r\n\r\n ARM_INS_ENDING, // <-- mark the end of the list of instructions\r\n} arm_insn;\r\n\r\n//> Group of ARM instructions\r\ntypedef enum arm_insn_group\r\n{\r\n ARM_GRP_INVALID = 0, // = CS_GRP_INVALID\r\n\r\n //> Generic groups\r\n // all jump instructions (conditional+direct+indirect jumps)\r\n ARM_GRP_JUMP, // = CS_GRP_JUMP\r\n ARM_GRP_CALL, // = CS_GRP_CALL\r\n ARM_GRP_INT = 4, // = CS_GRP_INT\r\n ARM_GRP_PRIVILEGE = 6, // = CS_GRP_PRIVILEGE\r\n\r\n //> Architecture-specific groups\r\n ARM_GRP_CRYPTO = 128,\r\n ARM_GRP_DATABARRIER,\r\n ARM_GRP_DIVIDE,\r\n ARM_GRP_FPARMV8,\r\n ARM_GRP_MULTPRO,\r\n ARM_GRP_NEON,\r\n ARM_GRP_T2EXTRACTPACK,\r\n ARM_GRP_THUMB2DSP,\r\n ARM_GRP_TRUSTZONE,\r\n ARM_GRP_V4T,\r\n ARM_GRP_V5T,\r\n ARM_GRP_V5TE,\r\n ARM_GRP_V6,\r\n ARM_GRP_V6T2,\r\n ARM_GRP_V7,\r\n ARM_GRP_V8,\r\n ARM_GRP_VFP2,\r\n ARM_GRP_VFP3,\r\n ARM_GRP_VFP4,\r\n ARM_GRP_ARM,\r\n ARM_GRP_MCLASS,\r\n ARM_GRP_NOTMCLASS,\r\n ARM_GRP_THUMB,\r\n ARM_GRP_THUMB1ONLY,\r\n ARM_GRP_THUMB2,\r\n ARM_GRP_PREV8,\r\n ARM_GRP_FPVMLX,\r\n ARM_GRP_MULOPS,\r\n ARM_GRP_CRC,\r\n ARM_GRP_DPVFP,\r\n ARM_GRP_V6M,\r\n ARM_GRP_VIRTUALIZATION,\r\n\r\n ARM_GRP_ENDING,\r\n} arm_insn_group;\r\n\r\n#ifdef __cplusplus\r\n}\r\n#endif\r\n\r\n#endif\r\n" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/capstone/arm64.h", "content": "#ifndef CAPSTONE_ARM64_H\r\n#define CAPSTONE_ARM64_H\r\n\r\n/* Capstone Disassembly Engine */\r\n/* By Nguyen Anh Quynh , 2013-2015 */\r\n\r\n#ifdef __cplusplus\r\nextern \"C\" {\r\n#endif\r\n\r\n#include \"platform.h\"\r\n\r\n#ifdef _MSC_VER\r\n#pragma warning(disable:4201)\r\n#endif\r\n\r\n//> ARM64 shift type\r\ntypedef enum arm64_shifter\r\n{\r\n ARM64_SFT_INVALID = 0,\r\n ARM64_SFT_LSL = 1,\r\n ARM64_SFT_MSL = 2,\r\n ARM64_SFT_LSR = 3,\r\n ARM64_SFT_ASR = 4,\r\n ARM64_SFT_ROR = 5,\r\n} arm64_shifter;\r\n\r\n//> ARM64 extender type\r\ntypedef enum arm64_extender\r\n{\r\n ARM64_EXT_INVALID = 0,\r\n ARM64_EXT_UXTB = 1,\r\n ARM64_EXT_UXTH = 2,\r\n ARM64_EXT_UXTW = 3,\r\n ARM64_EXT_UXTX = 4,\r\n ARM64_EXT_SXTB = 5,\r\n ARM64_EXT_SXTH = 6,\r\n ARM64_EXT_SXTW = 7,\r\n ARM64_EXT_SXTX = 8,\r\n} arm64_extender;\r\n\r\n//> ARM64 condition code\r\ntypedef enum arm64_cc\r\n{\r\n ARM64_CC_INVALID = 0,\r\n ARM64_CC_EQ = 1, // Equal\r\n ARM64_CC_NE = 2, // Not equal: Not equal, or unordered\r\n ARM64_CC_HS = 3, // Unsigned higher or same: >, ==, or unordered\r\n ARM64_CC_LO = 4, // Unsigned lower or same: Less than\r\n ARM64_CC_MI = 5, // Minus, negative: Less than\r\n ARM64_CC_PL = 6, // Plus, positive or zero: >, ==, or unordered\r\n ARM64_CC_VS = 7, // Overflow: Unordered\r\n ARM64_CC_VC = 8, // No overflow: Ordered\r\n ARM64_CC_HI = 9, // Unsigned higher: Greater than, or unordered\r\n ARM64_CC_LS = 10, // Unsigned lower or same: Less than or equal\r\n ARM64_CC_GE = 11, // Greater than or equal: Greater than or equal\r\n ARM64_CC_LT = 12, // Less than: Less than, or unordered\r\n ARM64_CC_GT = 13, // Signed greater than: Greater than\r\n ARM64_CC_LE = 14, // Signed less than or equal: <, ==, or unordered\r\n ARM64_CC_AL = 15, // Always (unconditional): Always (unconditional)\r\n ARM64_CC_NV = 16, // Always (unconditional): Always (unconditional)\r\n // Note the NV exists purely to disassemble 0b1111. Execution\r\n // is \"always\".\r\n} arm64_cc;\r\n\r\n//> System registers\r\ntypedef enum arm64_sysreg\r\n{\r\n //> System registers for MRS\r\n ARM64_SYSREG_INVALID = 0,\r\n ARM64_SYSREG_MDCCSR_EL0 = 0x9808, // 10 011 0000 0001 000\r\n ARM64_SYSREG_DBGDTRRX_EL0 = 0x9828, // 10 011 0000 0101 000\r\n ARM64_SYSREG_MDRAR_EL1 = 0x8080, // 10 000 0001 0000 000\r\n ARM64_SYSREG_OSLSR_EL1 = 0x808c, // 10 000 0001 0001 100\r\n ARM64_SYSREG_DBGAUTHSTATUS_EL1 = 0x83f6, // 10 000 0111 1110 110\r\n ARM64_SYSREG_PMCEID0_EL0 = 0xdce6, // 11 011 1001 1100 110\r\n ARM64_SYSREG_PMCEID1_EL0 = 0xdce7, // 11 011 1001 1100 111\r\n ARM64_SYSREG_MIDR_EL1 = 0xc000, // 11 000 0000 0000 000\r\n ARM64_SYSREG_CCSIDR_EL1 = 0xc800, // 11 001 0000 0000 000\r\n ARM64_SYSREG_CLIDR_EL1 = 0xc801, // 11 001 0000 0000 001\r\n ARM64_SYSREG_CTR_EL0 = 0xd801, // 11 011 0000 0000 001\r\n ARM64_SYSREG_MPIDR_EL1 = 0xc005, // 11 000 0000 0000 101\r\n ARM64_SYSREG_REVIDR_EL1 = 0xc006, // 11 000 0000 0000 110\r\n ARM64_SYSREG_AIDR_EL1 = 0xc807, // 11 001 0000 0000 111\r\n ARM64_SYSREG_DCZID_EL0 = 0xd807, // 11 011 0000 0000 111\r\n ARM64_SYSREG_ID_PFR0_EL1 = 0xc008, // 11 000 0000 0001 000\r\n ARM64_SYSREG_ID_PFR1_EL1 = 0xc009, // 11 000 0000 0001 001\r\n ARM64_SYSREG_ID_DFR0_EL1 = 0xc00a, // 11 000 0000 0001 010\r\n ARM64_SYSREG_ID_AFR0_EL1 = 0xc00b, // 11 000 0000 0001 011\r\n ARM64_SYSREG_ID_MMFR0_EL1 = 0xc00c, // 11 000 0000 0001 100\r\n ARM64_SYSREG_ID_MMFR1_EL1 = 0xc00d, // 11 000 0000 0001 101\r\n ARM64_SYSREG_ID_MMFR2_EL1 = 0xc00e, // 11 000 0000 0001 110\r\n ARM64_SYSREG_ID_MMFR3_EL1 = 0xc00f, // 11 000 0000 0001 111\r\n ARM64_SYSREG_ID_ISAR0_EL1 = 0xc010, // 11 000 0000 0010 000\r\n ARM64_SYSREG_ID_ISAR1_EL1 = 0xc011, // 11 000 0000 0010 001\r\n ARM64_SYSREG_ID_ISAR2_EL1 = 0xc012, // 11 000 0000 0010 010\r\n ARM64_SYSREG_ID_ISAR3_EL1 = 0xc013, // 11 000 0000 0010 011\r\n ARM64_SYSREG_ID_ISAR4_EL1 = 0xc014, // 11 000 0000 0010 100\r\n ARM64_SYSREG_ID_ISAR5_EL1 = 0xc015, // 11 000 0000 0010 101\r\n ARM64_SYSREG_ID_A64PFR0_EL1 = 0xc020, // 11 000 0000 0100 000\r\n ARM64_SYSREG_ID_A64PFR1_EL1 = 0xc021, // 11 000 0000 0100 001\r\n ARM64_SYSREG_ID_A64DFR0_EL1 = 0xc028, // 11 000 0000 0101 000\r\n ARM64_SYSREG_ID_A64DFR1_EL1 = 0xc029, // 11 000 0000 0101 001\r\n ARM64_SYSREG_ID_A64AFR0_EL1 = 0xc02c, // 11 000 0000 0101 100\r\n ARM64_SYSREG_ID_A64AFR1_EL1 = 0xc02d, // 11 000 0000 0101 101\r\n ARM64_SYSREG_ID_A64ISAR0_EL1 = 0xc030, // 11 000 0000 0110 000\r\n ARM64_SYSREG_ID_A64ISAR1_EL1 = 0xc031, // 11 000 0000 0110 001\r\n ARM64_SYSREG_ID_A64MMFR0_EL1 = 0xc038, // 11 000 0000 0111 000\r\n ARM64_SYSREG_ID_A64MMFR1_EL1 = 0xc039, // 11 000 0000 0111 001\r\n ARM64_SYSREG_MVFR0_EL1 = 0xc018, // 11 000 0000 0011 000\r\n ARM64_SYSREG_MVFR1_EL1 = 0xc019, // 11 000 0000 0011 001\r\n ARM64_SYSREG_MVFR2_EL1 = 0xc01a, // 11 000 0000 0011 010\r\n ARM64_SYSREG_RVBAR_EL1 = 0xc601, // 11 000 1100 0000 001\r\n ARM64_SYSREG_RVBAR_EL2 = 0xe601, // 11 100 1100 0000 001\r\n ARM64_SYSREG_RVBAR_EL3 = 0xf601, // 11 110 1100 0000 001\r\n ARM64_SYSREG_ISR_EL1 = 0xc608, // 11 000 1100 0001 000\r\n ARM64_SYSREG_CNTPCT_EL0 = 0xdf01, // 11 011 1110 0000 001\r\n ARM64_SYSREG_CNTVCT_EL0 = 0xdf02, // 11 011 1110 0000 010\r\n\r\n // Trace registers\r\n ARM64_SYSREG_TRCSTATR = 0x8818, // 10 001 0000 0011 000\r\n ARM64_SYSREG_TRCIDR8 = 0x8806, // 10 001 0000 0000 110\r\n ARM64_SYSREG_TRCIDR9 = 0x880e, // 10 001 0000 0001 110\r\n ARM64_SYSREG_TRCIDR10 = 0x8816, // 10 001 0000 0010 110\r\n ARM64_SYSREG_TRCIDR11 = 0x881e, // 10 001 0000 0011 110\r\n ARM64_SYSREG_TRCIDR12 = 0x8826, // 10 001 0000 0100 110\r\n ARM64_SYSREG_TRCIDR13 = 0x882e, // 10 001 0000 0101 110\r\n ARM64_SYSREG_TRCIDR0 = 0x8847, // 10 001 0000 1000 111\r\n ARM64_SYSREG_TRCIDR1 = 0x884f, // 10 001 0000 1001 111\r\n ARM64_SYSREG_TRCIDR2 = 0x8857, // 10 001 0000 1010 111\r\n ARM64_SYSREG_TRCIDR3 = 0x885f, // 10 001 0000 1011 111\r\n ARM64_SYSREG_TRCIDR4 = 0x8867, // 10 001 0000 1100 111\r\n ARM64_SYSREG_TRCIDR5 = 0x886f, // 10 001 0000 1101 111\r\n ARM64_SYSREG_TRCIDR6 = 0x8877, // 10 001 0000 1110 111\r\n ARM64_SYSREG_TRCIDR7 = 0x887f, // 10 001 0000 1111 111\r\n ARM64_SYSREG_TRCOSLSR = 0x888c, // 10 001 0001 0001 100\r\n ARM64_SYSREG_TRCPDSR = 0x88ac, // 10 001 0001 0101 100\r\n ARM64_SYSREG_TRCDEVAFF0 = 0x8bd6, // 10 001 0111 1010 110\r\n ARM64_SYSREG_TRCDEVAFF1 = 0x8bde, // 10 001 0111 1011 110\r\n ARM64_SYSREG_TRCLSR = 0x8bee, // 10 001 0111 1101 110\r\n ARM64_SYSREG_TRCAUTHSTATUS = 0x8bf6, // 10 001 0111 1110 110\r\n ARM64_SYSREG_TRCDEVARCH = 0x8bfe, // 10 001 0111 1111 110\r\n ARM64_SYSREG_TRCDEVID = 0x8b97, // 10 001 0111 0010 111\r\n ARM64_SYSREG_TRCDEVTYPE = 0x8b9f, // 10 001 0111 0011 111\r\n ARM64_SYSREG_TRCPIDR4 = 0x8ba7, // 10 001 0111 0100 111\r\n ARM64_SYSREG_TRCPIDR5 = 0x8baf, // 10 001 0111 0101 111\r\n ARM64_SYSREG_TRCPIDR6 = 0x8bb7, // 10 001 0111 0110 111\r\n ARM64_SYSREG_TRCPIDR7 = 0x8bbf, // 10 001 0111 0111 111\r\n ARM64_SYSREG_TRCPIDR0 = 0x8bc7, // 10 001 0111 1000 111\r\n ARM64_SYSREG_TRCPIDR1 = 0x8bcf, // 10 001 0111 1001 111\r\n ARM64_SYSREG_TRCPIDR2 = 0x8bd7, // 10 001 0111 1010 111\r\n ARM64_SYSREG_TRCPIDR3 = 0x8bdf, // 10 001 0111 1011 111\r\n ARM64_SYSREG_TRCCIDR0 = 0x8be7, // 10 001 0111 1100 111\r\n ARM64_SYSREG_TRCCIDR1 = 0x8bef, // 10 001 0111 1101 111\r\n ARM64_SYSREG_TRCCIDR2 = 0x8bf7, // 10 001 0111 1110 111\r\n ARM64_SYSREG_TRCCIDR3 = 0x8bff, // 10 001 0111 1111 111\r\n\r\n // GICv3 registers\r\n ARM64_SYSREG_ICC_IAR1_EL1 = 0xc660, // 11 000 1100 1100 000\r\n ARM64_SYSREG_ICC_IAR0_EL1 = 0xc640, // 11 000 1100 1000 000\r\n ARM64_SYSREG_ICC_HPPIR1_EL1 = 0xc662, // 11 000 1100 1100 010\r\n ARM64_SYSREG_ICC_HPPIR0_EL1 = 0xc642, // 11 000 1100 1000 010\r\n ARM64_SYSREG_ICC_RPR_EL1 = 0xc65b, // 11 000 1100 1011 011\r\n ARM64_SYSREG_ICH_VTR_EL2 = 0xe659, // 11 100 1100 1011 001\r\n ARM64_SYSREG_ICH_EISR_EL2 = 0xe65b, // 11 100 1100 1011 011\r\n ARM64_SYSREG_ICH_ELSR_EL2 = 0xe65d, // 11 100 1100 1011 101\r\n} arm64_sysreg;\r\n\r\ntypedef enum arm64_msr_reg\r\n{\r\n //> System registers for MSR\r\n ARM64_SYSREG_DBGDTRTX_EL0 = 0x9828, // 10 011 0000 0101 000\r\n ARM64_SYSREG_OSLAR_EL1 = 0x8084, // 10 000 0001 0000 100\r\n ARM64_SYSREG_PMSWINC_EL0 = 0xdce4, // 11 011 1001 1100 100\r\n\r\n // Trace Registers\r\n ARM64_SYSREG_TRCOSLAR = 0x8884, // 10 001 0001 0000 100\r\n ARM64_SYSREG_TRCLAR = 0x8be6, // 10 001 0111 1100 110\r\n\r\n // GICv3 registers\r\n ARM64_SYSREG_ICC_EOIR1_EL1 = 0xc661, // 11 000 1100 1100 001\r\n ARM64_SYSREG_ICC_EOIR0_EL1 = 0xc641, // 11 000 1100 1000 001\r\n ARM64_SYSREG_ICC_DIR_EL1 = 0xc659, // 11 000 1100 1011 001\r\n ARM64_SYSREG_ICC_SGI1R_EL1 = 0xc65d, // 11 000 1100 1011 101\r\n ARM64_SYSREG_ICC_ASGI1R_EL1 = 0xc65e, // 11 000 1100 1011 110\r\n ARM64_SYSREG_ICC_SGI0R_EL1 = 0xc65f, // 11 000 1100 1011 111\r\n} arm64_msr_reg;\r\n\r\n//> System PState Field (MSR instruction)\r\ntypedef enum arm64_pstate\r\n{\r\n ARM64_PSTATE_INVALID = 0,\r\n ARM64_PSTATE_SPSEL = 0x05,\r\n ARM64_PSTATE_DAIFSET = 0x1e,\r\n ARM64_PSTATE_DAIFCLR = 0x1f\r\n} arm64_pstate;\r\n\r\n//> Vector arrangement specifier (for FloatingPoint/Advanced SIMD insn)\r\ntypedef enum arm64_vas\r\n{\r\n ARM64_VAS_INVALID = 0,\r\n ARM64_VAS_8B,\r\n ARM64_VAS_16B,\r\n ARM64_VAS_4H,\r\n ARM64_VAS_8H,\r\n ARM64_VAS_2S,\r\n ARM64_VAS_4S,\r\n ARM64_VAS_1D,\r\n ARM64_VAS_2D,\r\n ARM64_VAS_1Q,\r\n} arm64_vas;\r\n\r\n//> Vector element size specifier\r\ntypedef enum arm64_vess\r\n{\r\n ARM64_VESS_INVALID = 0,\r\n ARM64_VESS_B,\r\n ARM64_VESS_H,\r\n ARM64_VESS_S,\r\n ARM64_VESS_D,\r\n} arm64_vess;\r\n\r\n//> Memory barrier operands\r\ntypedef enum arm64_barrier_op\r\n{\r\n ARM64_BARRIER_INVALID = 0,\r\n ARM64_BARRIER_OSHLD = 0x1,\r\n ARM64_BARRIER_OSHST = 0x2,\r\n ARM64_BARRIER_OSH = 0x3,\r\n ARM64_BARRIER_NSHLD = 0x5,\r\n ARM64_BARRIER_NSHST = 0x6,\r\n ARM64_BARRIER_NSH = 0x7,\r\n ARM64_BARRIER_ISHLD = 0x9,\r\n ARM64_BARRIER_ISHST = 0xa,\r\n ARM64_BARRIER_ISH = 0xb,\r\n ARM64_BARRIER_LD = 0xd,\r\n ARM64_BARRIER_ST = 0xe,\r\n ARM64_BARRIER_SY = 0xf\r\n} arm64_barrier_op;\r\n\r\n//> Operand type for instruction's operands\r\ntypedef enum arm64_op_type\r\n{\r\n ARM64_OP_INVALID = 0, // = CS_OP_INVALID (Uninitialized).\r\n ARM64_OP_REG, // = CS_OP_REG (Register operand).\r\n ARM64_OP_IMM, // = CS_OP_IMM (Immediate operand).\r\n ARM64_OP_MEM, // = CS_OP_MEM (Memory operand).\r\n ARM64_OP_FP, // = CS_OP_FP (Floating-Point operand).\r\n ARM64_OP_CIMM = 64, // C-Immediate\r\n ARM64_OP_REG_MRS, // MRS register operand.\r\n ARM64_OP_REG_MSR, // MSR register operand.\r\n ARM64_OP_PSTATE, // PState operand.\r\n ARM64_OP_SYS, // SYS operand for IC/DC/AT/TLBI instructions.\r\n ARM64_OP_PREFETCH, // Prefetch operand (PRFM).\r\n ARM64_OP_BARRIER, // Memory barrier operand (ISB/DMB/DSB instructions).\r\n} arm64_op_type;\r\n\r\n//> TLBI operations\r\ntypedef enum arm64_tlbi_op\r\n{\r\n ARM64_TLBI_INVALID = 0,\r\n ARM64_TLBI_VMALLE1IS,\r\n ARM64_TLBI_VAE1IS,\r\n ARM64_TLBI_ASIDE1IS,\r\n ARM64_TLBI_VAAE1IS,\r\n ARM64_TLBI_VALE1IS,\r\n ARM64_TLBI_VAALE1IS,\r\n ARM64_TLBI_ALLE2IS,\r\n ARM64_TLBI_VAE2IS,\r\n ARM64_TLBI_ALLE1IS,\r\n ARM64_TLBI_VALE2IS,\r\n ARM64_TLBI_VMALLS12E1IS,\r\n ARM64_TLBI_ALLE3IS,\r\n ARM64_TLBI_VAE3IS,\r\n ARM64_TLBI_VALE3IS,\r\n ARM64_TLBI_IPAS2E1IS,\r\n ARM64_TLBI_IPAS2LE1IS,\r\n ARM64_TLBI_IPAS2E1,\r\n ARM64_TLBI_IPAS2LE1,\r\n ARM64_TLBI_VMALLE1,\r\n ARM64_TLBI_VAE1,\r\n ARM64_TLBI_ASIDE1,\r\n ARM64_TLBI_VAAE1,\r\n ARM64_TLBI_VALE1,\r\n ARM64_TLBI_VAALE1,\r\n ARM64_TLBI_ALLE2,\r\n ARM64_TLBI_VAE2,\r\n ARM64_TLBI_ALLE1,\r\n ARM64_TLBI_VALE2,\r\n ARM64_TLBI_VMALLS12E1,\r\n ARM64_TLBI_ALLE3,\r\n ARM64_TLBI_VAE3,\r\n ARM64_TLBI_VALE3,\r\n} arm64_tlbi_op;\r\n\r\n//> AT operations\r\ntypedef enum arm64_at_op\r\n{\r\n ARM64_AT_S1E1R,\r\n ARM64_AT_S1E1W,\r\n ARM64_AT_S1E0R,\r\n ARM64_AT_S1E0W,\r\n ARM64_AT_S1E2R,\r\n ARM64_AT_S1E2W,\r\n ARM64_AT_S12E1R,\r\n ARM64_AT_S12E1W,\r\n ARM64_AT_S12E0R,\r\n ARM64_AT_S12E0W,\r\n ARM64_AT_S1E3R,\r\n ARM64_AT_S1E3W,\r\n} arm64_at_op;\r\n\r\n//> DC operations\r\ntypedef enum arm64_dc_op\r\n{\r\n ARM64_DC_INVALID = 0,\r\n ARM64_DC_ZVA,\r\n ARM64_DC_IVAC,\r\n ARM64_DC_ISW,\r\n ARM64_DC_CVAC,\r\n ARM64_DC_CSW,\r\n ARM64_DC_CVAU,\r\n ARM64_DC_CIVAC,\r\n ARM64_DC_CISW,\r\n} arm64_dc_op;\r\n\r\n//> IC operations\r\ntypedef enum arm64_ic_op\r\n{\r\n ARM64_IC_INVALID = 0,\r\n ARM64_IC_IALLUIS,\r\n ARM64_IC_IALLU,\r\n ARM64_IC_IVAU,\r\n} arm64_ic_op;\r\n\r\n//> Prefetch operations (PRFM)\r\ntypedef enum arm64_prefetch_op\r\n{\r\n ARM64_PRFM_INVALID = 0,\r\n ARM64_PRFM_PLDL1KEEP = 0x00 + 1,\r\n ARM64_PRFM_PLDL1STRM = 0x01 + 1,\r\n ARM64_PRFM_PLDL2KEEP = 0x02 + 1,\r\n ARM64_PRFM_PLDL2STRM = 0x03 + 1,\r\n ARM64_PRFM_PLDL3KEEP = 0x04 + 1,\r\n ARM64_PRFM_PLDL3STRM = 0x05 + 1,\r\n ARM64_PRFM_PLIL1KEEP = 0x08 + 1,\r\n ARM64_PRFM_PLIL1STRM = 0x09 + 1,\r\n ARM64_PRFM_PLIL2KEEP = 0x0a + 1,\r\n ARM64_PRFM_PLIL2STRM = 0x0b + 1,\r\n ARM64_PRFM_PLIL3KEEP = 0x0c + 1,\r\n ARM64_PRFM_PLIL3STRM = 0x0d + 1,\r\n ARM64_PRFM_PSTL1KEEP = 0x10 + 1,\r\n ARM64_PRFM_PSTL1STRM = 0x11 + 1,\r\n ARM64_PRFM_PSTL2KEEP = 0x12 + 1,\r\n ARM64_PRFM_PSTL2STRM = 0x13 + 1,\r\n ARM64_PRFM_PSTL3KEEP = 0x14 + 1,\r\n ARM64_PRFM_PSTL3STRM = 0x15 + 1,\r\n} arm64_prefetch_op;\r\n\r\n\r\n//> ARM64 registers\r\ntypedef enum arm64_reg\r\n{\r\n ARM64_REG_INVALID = 0,\r\n\r\n ARM64_REG_X29,\r\n ARM64_REG_X30,\r\n ARM64_REG_NZCV,\r\n ARM64_REG_SP,\r\n ARM64_REG_WSP,\r\n ARM64_REG_WZR,\r\n ARM64_REG_XZR,\r\n ARM64_REG_B0,\r\n ARM64_REG_B1,\r\n ARM64_REG_B2,\r\n ARM64_REG_B3,\r\n ARM64_REG_B4,\r\n ARM64_REG_B5,\r\n ARM64_REG_B6,\r\n ARM64_REG_B7,\r\n ARM64_REG_B8,\r\n ARM64_REG_B9,\r\n ARM64_REG_B10,\r\n ARM64_REG_B11,\r\n ARM64_REG_B12,\r\n ARM64_REG_B13,\r\n ARM64_REG_B14,\r\n ARM64_REG_B15,\r\n ARM64_REG_B16,\r\n ARM64_REG_B17,\r\n ARM64_REG_B18,\r\n ARM64_REG_B19,\r\n ARM64_REG_B20,\r\n ARM64_REG_B21,\r\n ARM64_REG_B22,\r\n ARM64_REG_B23,\r\n ARM64_REG_B24,\r\n ARM64_REG_B25,\r\n ARM64_REG_B26,\r\n ARM64_REG_B27,\r\n ARM64_REG_B28,\r\n ARM64_REG_B29,\r\n ARM64_REG_B30,\r\n ARM64_REG_B31,\r\n ARM64_REG_D0,\r\n ARM64_REG_D1,\r\n ARM64_REG_D2,\r\n ARM64_REG_D3,\r\n ARM64_REG_D4,\r\n ARM64_REG_D5,\r\n ARM64_REG_D6,\r\n ARM64_REG_D7,\r\n ARM64_REG_D8,\r\n ARM64_REG_D9,\r\n ARM64_REG_D10,\r\n ARM64_REG_D11,\r\n ARM64_REG_D12,\r\n ARM64_REG_D13,\r\n ARM64_REG_D14,\r\n ARM64_REG_D15,\r\n ARM64_REG_D16,\r\n ARM64_REG_D17,\r\n ARM64_REG_D18,\r\n ARM64_REG_D19,\r\n ARM64_REG_D20,\r\n ARM64_REG_D21,\r\n ARM64_REG_D22,\r\n ARM64_REG_D23,\r\n ARM64_REG_D24,\r\n ARM64_REG_D25,\r\n ARM64_REG_D26,\r\n ARM64_REG_D27,\r\n ARM64_REG_D28,\r\n ARM64_REG_D29,\r\n ARM64_REG_D30,\r\n ARM64_REG_D31,\r\n ARM64_REG_H0,\r\n ARM64_REG_H1,\r\n ARM64_REG_H2,\r\n ARM64_REG_H3,\r\n ARM64_REG_H4,\r\n ARM64_REG_H5,\r\n ARM64_REG_H6,\r\n ARM64_REG_H7,\r\n ARM64_REG_H8,\r\n ARM64_REG_H9,\r\n ARM64_REG_H10,\r\n ARM64_REG_H11,\r\n ARM64_REG_H12,\r\n ARM64_REG_H13,\r\n ARM64_REG_H14,\r\n ARM64_REG_H15,\r\n ARM64_REG_H16,\r\n ARM64_REG_H17,\r\n ARM64_REG_H18,\r\n ARM64_REG_H19,\r\n ARM64_REG_H20,\r\n ARM64_REG_H21,\r\n ARM64_REG_H22,\r\n ARM64_REG_H23,\r\n ARM64_REG_H24,\r\n ARM64_REG_H25,\r\n ARM64_REG_H26,\r\n ARM64_REG_H27,\r\n ARM64_REG_H28,\r\n ARM64_REG_H29,\r\n ARM64_REG_H30,\r\n ARM64_REG_H31,\r\n ARM64_REG_Q0,\r\n ARM64_REG_Q1,\r\n ARM64_REG_Q2,\r\n ARM64_REG_Q3,\r\n ARM64_REG_Q4,\r\n ARM64_REG_Q5,\r\n ARM64_REG_Q6,\r\n ARM64_REG_Q7,\r\n ARM64_REG_Q8,\r\n ARM64_REG_Q9,\r\n ARM64_REG_Q10,\r\n ARM64_REG_Q11,\r\n ARM64_REG_Q12,\r\n ARM64_REG_Q13,\r\n ARM64_REG_Q14,\r\n ARM64_REG_Q15,\r\n ARM64_REG_Q16,\r\n ARM64_REG_Q17,\r\n ARM64_REG_Q18,\r\n ARM64_REG_Q19,\r\n ARM64_REG_Q20,\r\n ARM64_REG_Q21,\r\n ARM64_REG_Q22,\r\n ARM64_REG_Q23,\r\n ARM64_REG_Q24,\r\n ARM64_REG_Q25,\r\n ARM64_REG_Q26,\r\n ARM64_REG_Q27,\r\n ARM64_REG_Q28,\r\n ARM64_REG_Q29,\r\n ARM64_REG_Q30,\r\n ARM64_REG_Q31,\r\n ARM64_REG_S0,\r\n ARM64_REG_S1,\r\n ARM64_REG_S2,\r\n ARM64_REG_S3,\r\n ARM64_REG_S4,\r\n ARM64_REG_S5,\r\n ARM64_REG_S6,\r\n ARM64_REG_S7,\r\n ARM64_REG_S8,\r\n ARM64_REG_S9,\r\n ARM64_REG_S10,\r\n ARM64_REG_S11,\r\n ARM64_REG_S12,\r\n ARM64_REG_S13,\r\n ARM64_REG_S14,\r\n ARM64_REG_S15,\r\n ARM64_REG_S16,\r\n ARM64_REG_S17,\r\n ARM64_REG_S18,\r\n ARM64_REG_S19,\r\n ARM64_REG_S20,\r\n ARM64_REG_S21,\r\n ARM64_REG_S22,\r\n ARM64_REG_S23,\r\n ARM64_REG_S24,\r\n ARM64_REG_S25,\r\n ARM64_REG_S26,\r\n ARM64_REG_S27,\r\n ARM64_REG_S28,\r\n ARM64_REG_S29,\r\n ARM64_REG_S30,\r\n ARM64_REG_S31,\r\n ARM64_REG_W0,\r\n ARM64_REG_W1,\r\n ARM64_REG_W2,\r\n ARM64_REG_W3,\r\n ARM64_REG_W4,\r\n ARM64_REG_W5,\r\n ARM64_REG_W6,\r\n ARM64_REG_W7,\r\n ARM64_REG_W8,\r\n ARM64_REG_W9,\r\n ARM64_REG_W10,\r\n ARM64_REG_W11,\r\n ARM64_REG_W12,\r\n ARM64_REG_W13,\r\n ARM64_REG_W14,\r\n ARM64_REG_W15,\r\n ARM64_REG_W16,\r\n ARM64_REG_W17,\r\n ARM64_REG_W18,\r\n ARM64_REG_W19,\r\n ARM64_REG_W20,\r\n ARM64_REG_W21,\r\n ARM64_REG_W22,\r\n ARM64_REG_W23,\r\n ARM64_REG_W24,\r\n ARM64_REG_W25,\r\n ARM64_REG_W26,\r\n ARM64_REG_W27,\r\n ARM64_REG_W28,\r\n ARM64_REG_W29,\r\n ARM64_REG_W30,\r\n ARM64_REG_X0,\r\n ARM64_REG_X1,\r\n ARM64_REG_X2,\r\n ARM64_REG_X3,\r\n ARM64_REG_X4,\r\n ARM64_REG_X5,\r\n ARM64_REG_X6,\r\n ARM64_REG_X7,\r\n ARM64_REG_X8,\r\n ARM64_REG_X9,\r\n ARM64_REG_X10,\r\n ARM64_REG_X11,\r\n ARM64_REG_X12,\r\n ARM64_REG_X13,\r\n ARM64_REG_X14,\r\n ARM64_REG_X15,\r\n ARM64_REG_X16,\r\n ARM64_REG_X17,\r\n ARM64_REG_X18,\r\n ARM64_REG_X19,\r\n ARM64_REG_X20,\r\n ARM64_REG_X21,\r\n ARM64_REG_X22,\r\n ARM64_REG_X23,\r\n ARM64_REG_X24,\r\n ARM64_REG_X25,\r\n ARM64_REG_X26,\r\n ARM64_REG_X27,\r\n ARM64_REG_X28,\r\n\r\n ARM64_REG_V0,\r\n ARM64_REG_V1,\r\n ARM64_REG_V2,\r\n ARM64_REG_V3,\r\n ARM64_REG_V4,\r\n ARM64_REG_V5,\r\n ARM64_REG_V6,\r\n ARM64_REG_V7,\r\n ARM64_REG_V8,\r\n ARM64_REG_V9,\r\n ARM64_REG_V10,\r\n ARM64_REG_V11,\r\n ARM64_REG_V12,\r\n ARM64_REG_V13,\r\n ARM64_REG_V14,\r\n ARM64_REG_V15,\r\n ARM64_REG_V16,\r\n ARM64_REG_V17,\r\n ARM64_REG_V18,\r\n ARM64_REG_V19,\r\n ARM64_REG_V20,\r\n ARM64_REG_V21,\r\n ARM64_REG_V22,\r\n ARM64_REG_V23,\r\n ARM64_REG_V24,\r\n ARM64_REG_V25,\r\n ARM64_REG_V26,\r\n ARM64_REG_V27,\r\n ARM64_REG_V28,\r\n ARM64_REG_V29,\r\n ARM64_REG_V30,\r\n ARM64_REG_V31,\r\n\r\n ARM64_REG_ENDING, // <-- mark the end of the list of registers\r\n\r\n //> alias registers\r\n\r\n ARM64_REG_IP1 = ARM64_REG_X16,\r\n ARM64_REG_IP0 = ARM64_REG_X17,\r\n ARM64_REG_FP = ARM64_REG_X29,\r\n ARM64_REG_LR = ARM64_REG_X30,\r\n} arm64_reg;\r\n\r\n// Instruction's operand referring to memory\r\n// This is associated with ARM64_OP_MEM operand type above\r\ntypedef struct arm64_op_mem\r\n{\r\n arm64_reg base; // base register\r\n arm64_reg index; // index register\r\n int32_t disp; // displacement/offset value\r\n} arm64_op_mem;\r\n\r\n// Instruction operand\r\ntypedef struct cs_arm64_op\r\n{\r\n int vector_index; // Vector Index for some vector operands (or -1 if irrelevant)\r\n arm64_vas vas; // Vector Arrangement Specifier\r\n arm64_vess vess; // Vector Element Size Specifier\r\n struct\r\n {\r\n arm64_shifter type; // shifter type of this operand\r\n unsigned int value; // shifter value of this operand\r\n } shift;\r\n arm64_extender ext; // extender type of this operand\r\n arm64_op_type type; // operand type\r\n union\r\n {\r\n arm64_reg reg; // register value for REG operand\r\n int64_t imm; // immediate value, or index for C-IMM or IMM operand\r\n double fp; // floating point value for FP operand\r\n arm64_op_mem mem; // base/index/scale/disp value for MEM operand\r\n arm64_pstate pstate; // PState field of MSR instruction.\r\n unsigned int sys; // IC/DC/AT/TLBI operation (see arm64_ic_op, arm64_dc_op, arm64_at_op, arm64_tlbi_op)\r\n arm64_prefetch_op prefetch; // PRFM operation.\r\n arm64_barrier_op barrier; // Memory barrier operation (ISB/DMB/DSB instructions).\r\n };\r\n\r\n // How is this operand accessed? (READ, WRITE or READ|WRITE)\r\n // This field is combined of cs_ac_type.\r\n // NOTE: this field is irrelevant if engine is compiled in DIET mode.\r\n uint8_t access;\r\n} cs_arm64_op;\r\n\r\n// Instruction structure\r\ntypedef struct cs_arm64\r\n{\r\n arm64_cc cc; // conditional code for this insn\r\n bool update_flags; // does this insn update flags?\r\n bool writeback; // does this insn request writeback? 'True' means 'yes'\r\n\r\n // Number of operands of this instruction,\r\n // or 0 when instruction has no operand.\r\n uint8_t op_count;\r\n\r\n cs_arm64_op operands[8]; // operands for this instruction.\r\n} cs_arm64;\r\n\r\n//> ARM64 instruction\r\ntypedef enum arm64_insn\r\n{\r\n ARM64_INS_INVALID = 0,\r\n\r\n ARM64_INS_ABS,\r\n ARM64_INS_ADC,\r\n ARM64_INS_ADDHN,\r\n ARM64_INS_ADDHN2,\r\n ARM64_INS_ADDP,\r\n ARM64_INS_ADD,\r\n ARM64_INS_ADDV,\r\n ARM64_INS_ADR,\r\n ARM64_INS_ADRP,\r\n ARM64_INS_AESD,\r\n ARM64_INS_AESE,\r\n ARM64_INS_AESIMC,\r\n ARM64_INS_AESMC,\r\n ARM64_INS_AND,\r\n ARM64_INS_ASR,\r\n ARM64_INS_B,\r\n ARM64_INS_BFM,\r\n ARM64_INS_BIC,\r\n ARM64_INS_BIF,\r\n ARM64_INS_BIT,\r\n ARM64_INS_BL,\r\n ARM64_INS_BLR,\r\n ARM64_INS_BR,\r\n ARM64_INS_BRK,\r\n ARM64_INS_BSL,\r\n ARM64_INS_CBNZ,\r\n ARM64_INS_CBZ,\r\n ARM64_INS_CCMN,\r\n ARM64_INS_CCMP,\r\n ARM64_INS_CLREX,\r\n ARM64_INS_CLS,\r\n ARM64_INS_CLZ,\r\n ARM64_INS_CMEQ,\r\n ARM64_INS_CMGE,\r\n ARM64_INS_CMGT,\r\n ARM64_INS_CMHI,\r\n ARM64_INS_CMHS,\r\n ARM64_INS_CMLE,\r\n ARM64_INS_CMLT,\r\n ARM64_INS_CMTST,\r\n ARM64_INS_CNT,\r\n ARM64_INS_MOV,\r\n ARM64_INS_CRC32B,\r\n ARM64_INS_CRC32CB,\r\n ARM64_INS_CRC32CH,\r\n ARM64_INS_CRC32CW,\r\n ARM64_INS_CRC32CX,\r\n ARM64_INS_CRC32H,\r\n ARM64_INS_CRC32W,\r\n ARM64_INS_CRC32X,\r\n ARM64_INS_CSEL,\r\n ARM64_INS_CSINC,\r\n ARM64_INS_CSINV,\r\n ARM64_INS_CSNEG,\r\n ARM64_INS_DCPS1,\r\n ARM64_INS_DCPS2,\r\n ARM64_INS_DCPS3,\r\n ARM64_INS_DMB,\r\n ARM64_INS_DRPS,\r\n ARM64_INS_DSB,\r\n ARM64_INS_DUP,\r\n ARM64_INS_EON,\r\n ARM64_INS_EOR,\r\n ARM64_INS_ERET,\r\n ARM64_INS_EXTR,\r\n ARM64_INS_EXT,\r\n ARM64_INS_FABD,\r\n ARM64_INS_FABS,\r\n ARM64_INS_FACGE,\r\n ARM64_INS_FACGT,\r\n ARM64_INS_FADD,\r\n ARM64_INS_FADDP,\r\n ARM64_INS_FCCMP,\r\n ARM64_INS_FCCMPE,\r\n ARM64_INS_FCMEQ,\r\n ARM64_INS_FCMGE,\r\n ARM64_INS_FCMGT,\r\n ARM64_INS_FCMLE,\r\n ARM64_INS_FCMLT,\r\n ARM64_INS_FCMP,\r\n ARM64_INS_FCMPE,\r\n ARM64_INS_FCSEL,\r\n ARM64_INS_FCVTAS,\r\n ARM64_INS_FCVTAU,\r\n ARM64_INS_FCVT,\r\n ARM64_INS_FCVTL,\r\n ARM64_INS_FCVTL2,\r\n ARM64_INS_FCVTMS,\r\n ARM64_INS_FCVTMU,\r\n ARM64_INS_FCVTNS,\r\n ARM64_INS_FCVTNU,\r\n ARM64_INS_FCVTN,\r\n ARM64_INS_FCVTN2,\r\n ARM64_INS_FCVTPS,\r\n ARM64_INS_FCVTPU,\r\n ARM64_INS_FCVTXN,\r\n ARM64_INS_FCVTXN2,\r\n ARM64_INS_FCVTZS,\r\n ARM64_INS_FCVTZU,\r\n ARM64_INS_FDIV,\r\n ARM64_INS_FMADD,\r\n ARM64_INS_FMAX,\r\n ARM64_INS_FMAXNM,\r\n ARM64_INS_FMAXNMP,\r\n ARM64_INS_FMAXNMV,\r\n ARM64_INS_FMAXP,\r\n ARM64_INS_FMAXV,\r\n ARM64_INS_FMIN,\r\n ARM64_INS_FMINNM,\r\n ARM64_INS_FMINNMP,\r\n ARM64_INS_FMINNMV,\r\n ARM64_INS_FMINP,\r\n ARM64_INS_FMINV,\r\n ARM64_INS_FMLA,\r\n ARM64_INS_FMLS,\r\n ARM64_INS_FMOV,\r\n ARM64_INS_FMSUB,\r\n ARM64_INS_FMUL,\r\n ARM64_INS_FMULX,\r\n ARM64_INS_FNEG,\r\n ARM64_INS_FNMADD,\r\n ARM64_INS_FNMSUB,\r\n ARM64_INS_FNMUL,\r\n ARM64_INS_FRECPE,\r\n ARM64_INS_FRECPS,\r\n ARM64_INS_FRECPX,\r\n ARM64_INS_FRINTA,\r\n ARM64_INS_FRINTI,\r\n ARM64_INS_FRINTM,\r\n ARM64_INS_FRINTN,\r\n ARM64_INS_FRINTP,\r\n ARM64_INS_FRINTX,\r\n ARM64_INS_FRINTZ,\r\n ARM64_INS_FRSQRTE,\r\n ARM64_INS_FRSQRTS,\r\n ARM64_INS_FSQRT,\r\n ARM64_INS_FSUB,\r\n ARM64_INS_HINT,\r\n ARM64_INS_HLT,\r\n ARM64_INS_HVC,\r\n ARM64_INS_INS,\r\n\r\n ARM64_INS_ISB,\r\n ARM64_INS_LD1,\r\n ARM64_INS_LD1R,\r\n ARM64_INS_LD2R,\r\n ARM64_INS_LD2,\r\n ARM64_INS_LD3R,\r\n ARM64_INS_LD3,\r\n ARM64_INS_LD4,\r\n ARM64_INS_LD4R,\r\n\r\n ARM64_INS_LDARB,\r\n ARM64_INS_LDARH,\r\n ARM64_INS_LDAR,\r\n ARM64_INS_LDAXP,\r\n ARM64_INS_LDAXRB,\r\n ARM64_INS_LDAXRH,\r\n ARM64_INS_LDAXR,\r\n ARM64_INS_LDNP,\r\n ARM64_INS_LDP,\r\n ARM64_INS_LDPSW,\r\n ARM64_INS_LDRB,\r\n ARM64_INS_LDR,\r\n ARM64_INS_LDRH,\r\n ARM64_INS_LDRSB,\r\n ARM64_INS_LDRSH,\r\n ARM64_INS_LDRSW,\r\n ARM64_INS_LDTRB,\r\n ARM64_INS_LDTRH,\r\n ARM64_INS_LDTRSB,\r\n\r\n ARM64_INS_LDTRSH,\r\n ARM64_INS_LDTRSW,\r\n ARM64_INS_LDTR,\r\n ARM64_INS_LDURB,\r\n ARM64_INS_LDUR,\r\n ARM64_INS_LDURH,\r\n ARM64_INS_LDURSB,\r\n ARM64_INS_LDURSH,\r\n ARM64_INS_LDURSW,\r\n ARM64_INS_LDXP,\r\n ARM64_INS_LDXRB,\r\n ARM64_INS_LDXRH,\r\n ARM64_INS_LDXR,\r\n ARM64_INS_LSL,\r\n ARM64_INS_LSR,\r\n ARM64_INS_MADD,\r\n ARM64_INS_MLA,\r\n ARM64_INS_MLS,\r\n ARM64_INS_MOVI,\r\n ARM64_INS_MOVK,\r\n ARM64_INS_MOVN,\r\n ARM64_INS_MOVZ,\r\n ARM64_INS_MRS,\r\n ARM64_INS_MSR,\r\n ARM64_INS_MSUB,\r\n ARM64_INS_MUL,\r\n ARM64_INS_MVNI,\r\n ARM64_INS_NEG,\r\n ARM64_INS_NOT,\r\n ARM64_INS_ORN,\r\n ARM64_INS_ORR,\r\n ARM64_INS_PMULL2,\r\n ARM64_INS_PMULL,\r\n ARM64_INS_PMUL,\r\n ARM64_INS_PRFM,\r\n ARM64_INS_PRFUM,\r\n ARM64_INS_RADDHN,\r\n ARM64_INS_RADDHN2,\r\n ARM64_INS_RBIT,\r\n ARM64_INS_RET,\r\n ARM64_INS_REV16,\r\n ARM64_INS_REV32,\r\n ARM64_INS_REV64,\r\n ARM64_INS_REV,\r\n ARM64_INS_ROR,\r\n ARM64_INS_RSHRN2,\r\n ARM64_INS_RSHRN,\r\n ARM64_INS_RSUBHN,\r\n ARM64_INS_RSUBHN2,\r\n ARM64_INS_SABAL2,\r\n ARM64_INS_SABAL,\r\n\r\n ARM64_INS_SABA,\r\n ARM64_INS_SABDL2,\r\n ARM64_INS_SABDL,\r\n ARM64_INS_SABD,\r\n ARM64_INS_SADALP,\r\n ARM64_INS_SADDLP,\r\n ARM64_INS_SADDLV,\r\n ARM64_INS_SADDL2,\r\n ARM64_INS_SADDL,\r\n ARM64_INS_SADDW2,\r\n ARM64_INS_SADDW,\r\n ARM64_INS_SBC,\r\n ARM64_INS_SBFM,\r\n ARM64_INS_SCVTF,\r\n ARM64_INS_SDIV,\r\n ARM64_INS_SHA1C,\r\n ARM64_INS_SHA1H,\r\n ARM64_INS_SHA1M,\r\n ARM64_INS_SHA1P,\r\n ARM64_INS_SHA1SU0,\r\n ARM64_INS_SHA1SU1,\r\n ARM64_INS_SHA256H2,\r\n ARM64_INS_SHA256H,\r\n ARM64_INS_SHA256SU0,\r\n ARM64_INS_SHA256SU1,\r\n ARM64_INS_SHADD,\r\n ARM64_INS_SHLL2,\r\n ARM64_INS_SHLL,\r\n ARM64_INS_SHL,\r\n ARM64_INS_SHRN2,\r\n ARM64_INS_SHRN,\r\n ARM64_INS_SHSUB,\r\n ARM64_INS_SLI,\r\n ARM64_INS_SMADDL,\r\n ARM64_INS_SMAXP,\r\n ARM64_INS_SMAXV,\r\n ARM64_INS_SMAX,\r\n ARM64_INS_SMC,\r\n ARM64_INS_SMINP,\r\n ARM64_INS_SMINV,\r\n ARM64_INS_SMIN,\r\n ARM64_INS_SMLAL2,\r\n ARM64_INS_SMLAL,\r\n ARM64_INS_SMLSL2,\r\n ARM64_INS_SMLSL,\r\n ARM64_INS_SMOV,\r\n ARM64_INS_SMSUBL,\r\n ARM64_INS_SMULH,\r\n ARM64_INS_SMULL2,\r\n ARM64_INS_SMULL,\r\n ARM64_INS_SQABS,\r\n ARM64_INS_SQADD,\r\n ARM64_INS_SQDMLAL,\r\n ARM64_INS_SQDMLAL2,\r\n ARM64_INS_SQDMLSL,\r\n ARM64_INS_SQDMLSL2,\r\n ARM64_INS_SQDMULH,\r\n ARM64_INS_SQDMULL,\r\n ARM64_INS_SQDMULL2,\r\n ARM64_INS_SQNEG,\r\n ARM64_INS_SQRDMULH,\r\n ARM64_INS_SQRSHL,\r\n ARM64_INS_SQRSHRN,\r\n ARM64_INS_SQRSHRN2,\r\n ARM64_INS_SQRSHRUN,\r\n ARM64_INS_SQRSHRUN2,\r\n ARM64_INS_SQSHLU,\r\n ARM64_INS_SQSHL,\r\n ARM64_INS_SQSHRN,\r\n ARM64_INS_SQSHRN2,\r\n ARM64_INS_SQSHRUN,\r\n ARM64_INS_SQSHRUN2,\r\n ARM64_INS_SQSUB,\r\n ARM64_INS_SQXTN2,\r\n ARM64_INS_SQXTN,\r\n ARM64_INS_SQXTUN2,\r\n ARM64_INS_SQXTUN,\r\n ARM64_INS_SRHADD,\r\n ARM64_INS_SRI,\r\n ARM64_INS_SRSHL,\r\n ARM64_INS_SRSHR,\r\n ARM64_INS_SRSRA,\r\n ARM64_INS_SSHLL2,\r\n ARM64_INS_SSHLL,\r\n ARM64_INS_SSHL,\r\n ARM64_INS_SSHR,\r\n ARM64_INS_SSRA,\r\n ARM64_INS_SSUBL2,\r\n ARM64_INS_SSUBL,\r\n ARM64_INS_SSUBW2,\r\n ARM64_INS_SSUBW,\r\n ARM64_INS_ST1,\r\n ARM64_INS_ST2,\r\n ARM64_INS_ST3,\r\n ARM64_INS_ST4,\r\n ARM64_INS_STLRB,\r\n ARM64_INS_STLRH,\r\n ARM64_INS_STLR,\r\n ARM64_INS_STLXP,\r\n ARM64_INS_STLXRB,\r\n ARM64_INS_STLXRH,\r\n ARM64_INS_STLXR,\r\n ARM64_INS_STNP,\r\n ARM64_INS_STP,\r\n ARM64_INS_STRB,\r\n ARM64_INS_STR,\r\n ARM64_INS_STRH,\r\n ARM64_INS_STTRB,\r\n ARM64_INS_STTRH,\r\n ARM64_INS_STTR,\r\n ARM64_INS_STURB,\r\n ARM64_INS_STUR,\r\n ARM64_INS_STURH,\r\n ARM64_INS_STXP,\r\n ARM64_INS_STXRB,\r\n ARM64_INS_STXRH,\r\n ARM64_INS_STXR,\r\n ARM64_INS_SUBHN,\r\n ARM64_INS_SUBHN2,\r\n ARM64_INS_SUB,\r\n ARM64_INS_SUQADD,\r\n ARM64_INS_SVC,\r\n ARM64_INS_SYSL,\r\n ARM64_INS_SYS,\r\n ARM64_INS_TBL,\r\n ARM64_INS_TBNZ,\r\n ARM64_INS_TBX,\r\n ARM64_INS_TBZ,\r\n ARM64_INS_TRN1,\r\n ARM64_INS_TRN2,\r\n ARM64_INS_UABAL2,\r\n ARM64_INS_UABAL,\r\n ARM64_INS_UABA,\r\n ARM64_INS_UABDL2,\r\n ARM64_INS_UABDL,\r\n ARM64_INS_UABD,\r\n ARM64_INS_UADALP,\r\n ARM64_INS_UADDLP,\r\n ARM64_INS_UADDLV,\r\n ARM64_INS_UADDL2,\r\n ARM64_INS_UADDL,\r\n ARM64_INS_UADDW2,\r\n ARM64_INS_UADDW,\r\n ARM64_INS_UBFM,\r\n ARM64_INS_UCVTF,\r\n ARM64_INS_UDIV,\r\n ARM64_INS_UHADD,\r\n ARM64_INS_UHSUB,\r\n ARM64_INS_UMADDL,\r\n ARM64_INS_UMAXP,\r\n ARM64_INS_UMAXV,\r\n ARM64_INS_UMAX,\r\n ARM64_INS_UMINP,\r\n ARM64_INS_UMINV,\r\n ARM64_INS_UMIN,\r\n ARM64_INS_UMLAL2,\r\n ARM64_INS_UMLAL,\r\n ARM64_INS_UMLSL2,\r\n ARM64_INS_UMLSL,\r\n ARM64_INS_UMOV,\r\n ARM64_INS_UMSUBL,\r\n ARM64_INS_UMULH,\r\n ARM64_INS_UMULL2,\r\n ARM64_INS_UMULL,\r\n ARM64_INS_UQADD,\r\n ARM64_INS_UQRSHL,\r\n ARM64_INS_UQRSHRN,\r\n ARM64_INS_UQRSHRN2,\r\n ARM64_INS_UQSHL,\r\n ARM64_INS_UQSHRN,\r\n ARM64_INS_UQSHRN2,\r\n ARM64_INS_UQSUB,\r\n ARM64_INS_UQXTN2,\r\n ARM64_INS_UQXTN,\r\n ARM64_INS_URECPE,\r\n ARM64_INS_URHADD,\r\n ARM64_INS_URSHL,\r\n ARM64_INS_URSHR,\r\n ARM64_INS_URSQRTE,\r\n ARM64_INS_URSRA,\r\n ARM64_INS_USHLL2,\r\n ARM64_INS_USHLL,\r\n ARM64_INS_USHL,\r\n ARM64_INS_USHR,\r\n ARM64_INS_USQADD,\r\n ARM64_INS_USRA,\r\n ARM64_INS_USUBL2,\r\n ARM64_INS_USUBL,\r\n ARM64_INS_USUBW2,\r\n ARM64_INS_USUBW,\r\n ARM64_INS_UZP1,\r\n ARM64_INS_UZP2,\r\n ARM64_INS_XTN2,\r\n ARM64_INS_XTN,\r\n ARM64_INS_ZIP1,\r\n ARM64_INS_ZIP2,\r\n\r\n // alias insn\r\n ARM64_INS_MNEG,\r\n ARM64_INS_UMNEGL,\r\n ARM64_INS_SMNEGL,\r\n ARM64_INS_NOP,\r\n ARM64_INS_YIELD,\r\n ARM64_INS_WFE,\r\n ARM64_INS_WFI,\r\n ARM64_INS_SEV,\r\n ARM64_INS_SEVL,\r\n ARM64_INS_NGC,\r\n ARM64_INS_SBFIZ,\r\n ARM64_INS_UBFIZ,\r\n ARM64_INS_SBFX,\r\n ARM64_INS_UBFX,\r\n ARM64_INS_BFI,\r\n ARM64_INS_BFXIL,\r\n ARM64_INS_CMN,\r\n ARM64_INS_MVN,\r\n ARM64_INS_TST,\r\n ARM64_INS_CSET,\r\n ARM64_INS_CINC,\r\n ARM64_INS_CSETM,\r\n ARM64_INS_CINV,\r\n ARM64_INS_CNEG,\r\n ARM64_INS_SXTB,\r\n ARM64_INS_SXTH,\r\n ARM64_INS_SXTW,\r\n ARM64_INS_CMP,\r\n ARM64_INS_UXTB,\r\n ARM64_INS_UXTH,\r\n ARM64_INS_UXTW,\r\n ARM64_INS_IC,\r\n ARM64_INS_DC,\r\n ARM64_INS_AT,\r\n ARM64_INS_TLBI,\r\n\r\n ARM64_INS_NEGS,\r\n ARM64_INS_NGCS,\r\n\r\n ARM64_INS_ENDING, // <-- mark the end of the list of insn\r\n} arm64_insn;\r\n\r\n//> Group of ARM64 instructions\r\ntypedef enum arm64_insn_group\r\n{\r\n ARM64_GRP_INVALID = 0, // = CS_GRP_INVALID\r\n\r\n //> Generic groups\r\n // all jump instructions (conditional+direct+indirect jumps)\r\n ARM64_GRP_JUMP, // = CS_GRP_JUMP\r\n ARM64_GRP_CALL,\r\n ARM64_GRP_RET,\r\n ARM64_GRP_INT,\r\n ARM64_GRP_PRIVILEGE = 6, // = CS_GRP_PRIVILEGE\r\n\r\n //> Architecture-specific groups\r\n ARM64_GRP_CRYPTO = 128,\r\n ARM64_GRP_FPARMV8,\r\n ARM64_GRP_NEON,\r\n ARM64_GRP_CRC,\r\n\r\n ARM64_GRP_ENDING, // <-- mark the end of the list of groups\r\n} arm64_insn_group;\r\n\r\n#ifdef __cplusplus\r\n}\r\n#endif\r\n\r\n#endif\r\n" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/capstone/capstone.h", "content": "#ifndef CAPSTONE_ENGINE_H\r\n#define CAPSTONE_ENGINE_H\r\n\r\n/* Capstone Disassembly Engine */\r\n/* By Nguyen Anh Quynh , 2013-2016 */\r\n\r\n#ifdef __cplusplus\r\nextern \"C\" {\r\n#endif\r\n\r\n#include \r\n\r\n#if defined(CAPSTONE_HAS_OSXKERNEL)\r\n#include \r\n#else\r\n#include \r\n#include \r\n#endif\r\n\r\n#include \"platform.h\"\r\n\r\n#ifdef _MSC_VER\r\n#pragma warning(disable:4201)\r\n#pragma warning(disable:4100)\r\n#define CAPSTONE_API __cdecl\r\n#ifdef CAPSTONE_SHARED\r\n#define CAPSTONE_EXPORT __declspec(dllexport)\r\n#else // defined(CAPSTONE_STATIC)\r\n#define CAPSTONE_EXPORT\r\n#endif\r\n#else\r\n#define CAPSTONE_API\r\n#ifdef __GNUC__\r\n#define CAPSTONE_EXPORT __attribute__((visibility(\"default\")))\r\n#else\r\n#define CAPSTONE_EXPORT\r\n#endif\r\n#endif\r\n\r\n#ifdef __GNUC__\r\n#define CAPSTONE_DEPRECATED __attribute__((deprecated))\r\n#elif defined(_MSC_VER)\r\n#define CAPSTONE_DEPRECATED __declspec(deprecated)\r\n#else\r\n#pragma message(\"WARNING: You need to implement CAPSTONE_DEPRECATED for this compiler\")\r\n#define CAPSTONE_DEPRECATED\r\n#endif\r\n\r\n// Capstone API version\r\n#define CS_API_MAJOR 4\r\n#define CS_API_MINOR 0\r\n\r\n// Version for bleeding edge code of the Github's \"next\" branch.\r\n// Use this if you want the absolutely latest developement code.\r\n// This version number will be bumped up whenever we have a new major change.\r\n#define CS_NEXT_VERSION 4\r\n\r\n// Capstone package version\r\n#define CS_VERSION_MAJOR CS_API_MAJOR\r\n#define CS_VERSION_MINOR CS_API_MINOR\r\n#define CS_VERSION_EXTRA 0\r\n\r\n// Macro to create combined version which can be compared to\r\n// result of cs_version() API.\r\n#define CS_MAKE_VERSION(major, minor) ((major << 8) + minor)\r\n\r\n// Maximum size of an instruction mnemonic string.\r\n#define CS_MNEMONIC_SIZE 32\r\n\r\n// Handle using with all API\r\ntypedef size_t csh;\r\n\r\n// Architecture type\r\ntypedef enum cs_arch\r\n{\r\n CS_ARCH_ARM = 0, // ARM architecture (including Thumb, Thumb-2)\r\n CS_ARCH_ARM64, // ARM-64, also called AArch64\r\n CS_ARCH_MIPS, // Mips architecture\r\n CS_ARCH_X86, // X86 architecture (including x86 & x86-64)\r\n CS_ARCH_PPC, // PowerPC architecture\r\n CS_ARCH_SPARC, // Sparc architecture\r\n CS_ARCH_SYSZ, // SystemZ architecture\r\n CS_ARCH_XCORE, // XCore architecture\r\n CS_ARCH_M68K, // 68K architecture\r\n CS_ARCH_MAX,\r\n CS_ARCH_ALL = 0xFFFF, // All architectures - for cs_support()\r\n} cs_arch;\r\n\r\n// Support value to verify diet mode of the engine.\r\n// If cs_support(CS_SUPPORT_DIET) return True, the engine was compiled\r\n// in diet mode.\r\n#define CS_SUPPORT_DIET (CS_ARCH_ALL + 1)\r\n\r\n// Support value to verify X86 reduce mode of the engine.\r\n// If cs_support(CS_SUPPORT_X86_REDUCE) return True, the engine was compiled\r\n// in X86 reduce mode.\r\n#define CS_SUPPORT_X86_REDUCE (CS_ARCH_ALL + 2)\r\n\r\n// Mode type\r\ntypedef enum cs_mode\r\n{\r\n CS_MODE_LITTLE_ENDIAN = 0, // little-endian mode (default mode)\r\n CS_MODE_ARM = 0, // 32-bit ARM\r\n CS_MODE_16 = 1 << 1, // 16-bit mode (X86)\r\n CS_MODE_32 = 1 << 2, // 32-bit mode (X86)\r\n CS_MODE_64 = 1 << 3, // 64-bit mode (X86, PPC)\r\n CS_MODE_THUMB = 1 << 4, // ARM's Thumb mode, including Thumb-2\r\n CS_MODE_MCLASS = 1 << 5, // ARM's Cortex-M series\r\n CS_MODE_V8 = 1 << 6, // ARMv8 A32 encodings for ARM\r\n CS_MODE_MICRO = 1 << 4, // MicroMips mode (MIPS)\r\n CS_MODE_MIPS3 = 1 << 5, // Mips III ISA\r\n CS_MODE_MIPS32R6 = 1 << 6, // Mips32r6 ISA\r\n CS_MODE_V9 = 1 << 4, // SparcV9 mode (Sparc)\r\n CS_MODE_QPX = 1 << 4, // Quad Processing eXtensions mode (PPC)\r\n CS_MODE_M68K_000 = 1 << 1, // M68K 68000 mode\r\n CS_MODE_M68K_010 = 1 << 2, // M68K 68010 mode\r\n CS_MODE_M68K_020 = 1 << 3, // M68K 68020 mode\r\n CS_MODE_M68K_030 = 1 << 4, // M68K 68030 mode\r\n CS_MODE_M68K_040 = 1 << 5, // M68K 68040 mode\r\n CS_MODE_M68K_060 = 1 << 6, // M68K 68060 mode\r\n CS_MODE_BIG_ENDIAN = 1 << 31, // big-endian mode\r\n CS_MODE_MIPS32 = CS_MODE_32, // Mips32 ISA (Mips)\r\n CS_MODE_MIPS64 = CS_MODE_64, // Mips64 ISA (Mips)\r\n} cs_mode;\r\n\r\ntypedef void* (CAPSTONE_API* cs_malloc_t)(size_t size);\r\ntypedef void* (CAPSTONE_API* cs_calloc_t)(size_t nmemb, size_t size);\r\ntypedef void* (CAPSTONE_API* cs_realloc_t)(void* ptr, size_t size);\r\ntypedef void (CAPSTONE_API* cs_free_t)(void* ptr);\r\ntypedef int (CAPSTONE_API* cs_vsnprintf_t)(char* str, size_t size, const char* format, va_list ap);\r\n\r\n\r\n// User-defined dynamic memory related functions: malloc/calloc/realloc/free/vsnprintf()\r\n// By default, Capstone uses system's malloc(), calloc(), realloc(), free() & vsnprintf().\r\ntypedef struct cs_opt_mem\r\n{\r\n cs_malloc_t malloc;\r\n cs_calloc_t calloc;\r\n cs_realloc_t realloc;\r\n cs_free_t free;\r\n cs_vsnprintf_t vsnprintf;\r\n} cs_opt_mem;\r\n\r\n// Customize mnemonic for instructions with alternative name.\r\n// To reset existing customized instruction to its default mnemonic,\r\n// call cs_option(CS_OPT_MNEMONIC) again with the same @id and NULL value\r\n// for @mnemonic.\r\ntypedef struct cs_opt_mnem\r\n{\r\n // ID of instruction to be customized.\r\n unsigned int id;\r\n // Customized instruction mnemonic.\r\n const char* mnemonic;\r\n} cs_opt_mnem;\r\n\r\n// Runtime option for the disassembled engine\r\ntypedef enum cs_opt_type\r\n{\r\n CS_OPT_INVALID = 0, // No option specified\r\n CS_OPT_SYNTAX, // Assembly output syntax\r\n CS_OPT_DETAIL, // Break down instruction structure into details\r\n CS_OPT_MODE, // Change engine's mode at run-time\r\n CS_OPT_MEM, // User-defined dynamic memory related functions\r\n CS_OPT_SKIPDATA, // Skip data when disassembling. Then engine is in SKIPDATA mode.\r\n CS_OPT_SKIPDATA_SETUP, // Setup user-defined function for SKIPDATA option\r\n CS_OPT_MNEMONIC, // Customize instruction mnemonic\r\n CS_OPT_UNSIGNED, // print immediate operands in unsigned form\r\n} cs_opt_type;\r\n\r\n// Runtime option value (associated with option type above)\r\ntypedef enum cs_opt_value\r\n{\r\n CS_OPT_OFF = 0, // Turn OFF an option - default for CS_OPT_DETAIL, CS_OPT_SKIPDATA, CS_OPT_UNSIGNED.\r\n CS_OPT_ON = 3, // Turn ON an option (CS_OPT_DETAIL, CS_OPT_SKIPDATA).\r\n CS_OPT_SYNTAX_DEFAULT = 0, // Default asm syntax (CS_OPT_SYNTAX).\r\n CS_OPT_SYNTAX_INTEL, // X86 Intel asm syntax - default on X86 (CS_OPT_SYNTAX).\r\n CS_OPT_SYNTAX_ATT, // X86 ATT asm syntax (CS_OPT_SYNTAX).\r\n CS_OPT_SYNTAX_NOREGNAME, // Prints register name with only number (CS_OPT_SYNTAX)\r\n CS_OPT_SYNTAX_MASM, // X86 Intel Masm syntax (CS_OPT_SYNTAX).\r\n} cs_opt_value;\r\n\r\n//> Common instruction operand types - to be consistent across all architectures.\r\ntypedef enum cs_op_type\r\n{\r\n CS_OP_INVALID = 0, // uninitialized/invalid operand.\r\n CS_OP_REG, // Register operand.\r\n CS_OP_IMM, // Immediate operand.\r\n CS_OP_MEM, // Memory operand.\r\n CS_OP_FP, // Floating-Point operand.\r\n} cs_op_type;\r\n\r\n//> Common instruction operand access types - to be consistent across all architectures.\r\n//> It is possible to combine access types, for example: CS_AC_READ | CS_AC_WRITE\r\ntypedef enum cs_ac_type\r\n{\r\n CS_AC_INVALID = 0, // Uninitialized/invalid access type.\r\n CS_AC_READ = 1 << 0, // Operand read from memory or register.\r\n CS_AC_WRITE = 1 << 1, // Operand write to memory or register.\r\n} cs_ac_type;\r\n\r\n//> Common instruction groups - to be consistent across all architectures.\r\ntypedef enum cs_group_type\r\n{\r\n CS_GRP_INVALID = 0, // uninitialized/invalid group.\r\n CS_GRP_JUMP, // all jump instructions (conditional+direct+indirect jumps)\r\n CS_GRP_CALL, // all call instructions\r\n CS_GRP_RET, // all return instructions\r\n CS_GRP_INT, // all interrupt instructions (int+syscall)\r\n CS_GRP_IRET, // all interrupt return instructions\r\n CS_GRP_PRIVILEGE, // all privileged instructions\r\n} cs_group_type;\r\n\r\n/*\r\n User-defined callback function for SKIPDATA option.\r\n See tests/test_skipdata.c for sample code demonstrating this API.\r\n\r\n @code: the input buffer containing code to be disassembled.\r\n This is the same buffer passed to cs_disasm().\r\n @code_size: size (in bytes) of the above @code buffer.\r\n @offset: the position of the currently-examining byte in the input\r\n buffer @code mentioned above.\r\n @user_data: user-data passed to cs_option() via @user_data field in\r\n cs_opt_skipdata struct below.\r\n\r\n @return: return number of bytes to skip, or 0 to immediately stop disassembling.\r\n*/\r\ntypedef size_t (CAPSTONE_API* cs_skipdata_cb_t)(const uint8_t* code, size_t code_size, size_t offset, void* user_data);\r\n\r\n// User-customized setup for SKIPDATA option\r\ntypedef struct cs_opt_skipdata\r\n{\r\n // Capstone considers data to skip as special \"instructions\".\r\n // User can specify the string for this instruction's \"mnemonic\" here.\r\n // By default (if @mnemonic is NULL), Capstone use \".byte\".\r\n const char* mnemonic;\r\n\r\n // User-defined callback function to be called when Capstone hits data.\r\n // If the returned value from this callback is positive (>0), Capstone\r\n // will skip exactly that number of bytes & continue. Otherwise, if\r\n // the callback returns 0, Capstone stops disassembling and returns\r\n // immediately from cs_disasm()\r\n // NOTE: if this callback pointer is NULL, Capstone would skip a number\r\n // of bytes depending on architectures, as following:\r\n // Arm: 2 bytes (Thumb mode) or 4 bytes.\r\n // Arm64: 4 bytes.\r\n // Mips: 4 bytes.\r\n // PowerPC: 4 bytes.\r\n // Sparc: 4 bytes.\r\n // SystemZ: 2 bytes.\r\n // X86: 1 bytes.\r\n // XCore: 2 bytes.\r\n cs_skipdata_cb_t callback; // default value is NULL\r\n\r\n // User-defined data to be passed to @callback function pointer.\r\n void* user_data;\r\n} cs_opt_skipdata;\r\n\r\n\r\n#include \"arm.h\"\r\n#include \"arm64.h\"\r\n#include \"m68k.h\"\r\n#include \"mips.h\"\r\n#include \"ppc.h\"\r\n#include \"sparc.h\"\r\n#include \"systemz.h\"\r\n#include \"x86.h\"\r\n#include \"xcore.h\"\r\n\r\n// NOTE: All information in cs_detail is only available when CS_OPT_DETAIL = CS_OPT_ON\r\ntypedef struct cs_detail\r\n{\r\n uint16_t regs_read[12]; // list of implicit registers read by this insn\r\n uint8_t regs_read_count; // number of implicit registers read by this insn\r\n\r\n uint16_t regs_write[20]; // list of implicit registers modified by this insn\r\n uint8_t regs_write_count; // number of implicit registers modified by this insn\r\n\r\n uint8_t groups[8]; // list of group this instruction belong to\r\n uint8_t groups_count; // number of groups this insn belongs to\r\n\r\n // Architecture-specific instruction info\r\n union\r\n {\r\n cs_x86 x86; // X86 architecture, including 16-bit, 32-bit & 64-bit mode\r\n cs_arm64 arm64; // ARM64 architecture (aka AArch64)\r\n cs_arm arm; // ARM architecture (including Thumb/Thumb2)\r\n cs_m68k m68k; // M68K architecture\r\n cs_mips mips; // MIPS architecture\r\n cs_ppc ppc; // PowerPC architecture\r\n cs_sparc sparc; // Sparc architecture\r\n cs_sysz sysz; // SystemZ architecture\r\n cs_xcore xcore; // XCore architecture\r\n };\r\n} cs_detail;\r\n\r\n// Detail information of disassembled instruction\r\ntypedef struct cs_insn\r\n{\r\n // Instruction ID (basically a numeric ID for the instruction mnemonic)\r\n // Find the instruction id in the '[ARCH]_insn' enum in the header file\r\n // of corresponding architecture, such as 'arm_insn' in arm.h for ARM,\r\n // 'x86_insn' in x86.h for X86, etc...\r\n // This information is available even when CS_OPT_DETAIL = CS_OPT_OFF\r\n // NOTE: in Skipdata mode, \"data\" instruction has 0 for this id field.\r\n unsigned int id;\r\n\r\n // Address (EIP) of this instruction\r\n // This information is available even when CS_OPT_DETAIL = CS_OPT_OFF\r\n uint64_t address;\r\n\r\n // Size of this instruction\r\n // This information is available even when CS_OPT_DETAIL = CS_OPT_OFF\r\n uint16_t size;\r\n\r\n // Machine bytes of this instruction, with number of bytes indicated by @size above\r\n // This information is available even when CS_OPT_DETAIL = CS_OPT_OFF\r\n uint8_t bytes[16];\r\n\r\n // Ascii text of instruction mnemonic\r\n // This information is available even when CS_OPT_DETAIL = CS_OPT_OFF\r\n char mnemonic[CS_MNEMONIC_SIZE];\r\n\r\n // Ascii text of instruction operands\r\n // This information is available even when CS_OPT_DETAIL = CS_OPT_OFF\r\n char op_str[160];\r\n\r\n // Pointer to cs_detail.\r\n // NOTE: detail pointer is only valid when both requirements below are met:\r\n // (1) CS_OP_DETAIL = CS_OPT_ON\r\n // (2) Engine is not in Skipdata mode (CS_OP_SKIPDATA option set to CS_OPT_ON)\r\n //\r\n // NOTE 2: when in Skipdata mode, or when detail mode is OFF, even if this pointer\r\n // is not NULL, its content is still irrelevant.\r\n cs_detail* detail;\r\n} cs_insn;\r\n\r\n\r\n// Calculate the offset of a disassembled instruction in its buffer, given its position\r\n// in its array of disassembled insn\r\n// NOTE: this macro works with position (>=1), not index\r\n#define CS_INSN_OFFSET(insns, post) (insns[post - 1].address - insns[0].address)\r\n\r\n\r\n// All type of errors encountered by Capstone API.\r\n// These are values returned by cs_errno()\r\ntypedef enum cs_err\r\n{\r\n CS_ERR_OK = 0, // No error: everything was fine\r\n CS_ERR_MEM, // Out-Of-Memory error: cs_open(), cs_disasm(), cs_disasm_iter()\r\n CS_ERR_ARCH, // Unsupported architecture: cs_open()\r\n CS_ERR_HANDLE, // Invalid handle: cs_op_count(), cs_op_index()\r\n CS_ERR_CSH, // Invalid csh argument: cs_close(), cs_errno(), cs_option()\r\n CS_ERR_MODE, // Invalid/unsupported mode: cs_open()\r\n CS_ERR_OPTION, // Invalid/unsupported option: cs_option()\r\n CS_ERR_DETAIL, // Information is unavailable because detail option is OFF\r\n CS_ERR_MEMSETUP, // Dynamic memory management uninitialized (see CS_OPT_MEM)\r\n CS_ERR_VERSION, // Unsupported version (bindings)\r\n CS_ERR_DIET, // Access irrelevant data in \"diet\" engine\r\n CS_ERR_SKIPDATA, // Access irrelevant data for \"data\" instruction in SKIPDATA mode\r\n CS_ERR_X86_ATT, // X86 AT&T syntax is unsupported (opt-out at compile time)\r\n CS_ERR_X86_INTEL, // X86 Intel syntax is unsupported (opt-out at compile time)\r\n CS_ERR_X86_MASM, // X86 Intel syntax is unsupported (opt-out at compile time)\r\n} cs_err;\r\n\r\n/*\r\n Return combined API version & major and minor version numbers.\r\n\r\n @major: major number of API version\r\n @minor: minor number of API version\r\n\r\n @return hexical number as (major << 8 | minor), which encodes both\r\n major & minor versions.\r\n NOTE: This returned value can be compared with version number made\r\n with macro CS_MAKE_VERSION\r\n\r\n For example, second API version would return 1 in @major, and 1 in @minor\r\n The return value would be 0x0101\r\n\r\n NOTE: if you only care about returned value, but not major and minor values,\r\n set both @major & @minor arguments to NULL.\r\n*/\r\nCAPSTONE_EXPORT\r\nunsigned int CAPSTONE_API cs_version(int* major, int* minor);\r\n\r\n\r\n/*\r\n This API can be used to either ask for archs supported by this library,\r\n or check to see if the library was compile with 'diet' option (or called\r\n in 'diet' mode).\r\n\r\n To check if a particular arch is supported by this library, set @query to\r\n arch mode (CS_ARCH_* value).\r\n To verify if this library supports all the archs, use CS_ARCH_ALL.\r\n\r\n To check if this library is in 'diet' mode, set @query to CS_SUPPORT_DIET.\r\n\r\n @return True if this library supports the given arch, or in 'diet' mode.\r\n*/\r\nCAPSTONE_EXPORT\r\nbool CAPSTONE_API cs_support(int query);\r\n\r\n/*\r\n Initialize CS handle: this must be done before any usage of CS.\r\n\r\n @arch: architecture type (CS_ARCH_*)\r\n @mode: hardware mode. This is combined of CS_MODE_*\r\n @handle: pointer to handle, which will be updated at return time\r\n\r\n @return CS_ERR_OK on success, or other value on failure (refer to cs_err enum\r\n for detailed error).\r\n*/\r\nCAPSTONE_EXPORT\r\ncs_err CAPSTONE_API cs_open(cs_arch arch, cs_mode mode, csh* handle);\r\n\r\n/*\r\n Close CS handle: MUST do to release the handle when it is not used anymore.\r\n NOTE: this must be only called when there is no longer usage of Capstone,\r\n not even access to cs_insn array. The reason is the this API releases some\r\n cached memory, thus access to any Capstone API after cs_close() might crash\r\n your application.\r\n\r\n In fact,this API invalidate @handle by ZERO out its value (i.e *handle = 0).\r\n\r\n @handle: pointer to a handle returned by cs_open()\r\n\r\n @return CS_ERR_OK on success, or other value on failure (refer to cs_err enum\r\n for detailed error).\r\n*/\r\nCAPSTONE_EXPORT\r\ncs_err CAPSTONE_API cs_close(csh* handle);\r\n\r\n/*\r\n Set option for disassembling engine at runtime\r\n\r\n @handle: handle returned by cs_open()\r\n @type: type of option to be set\r\n @value: option value corresponding with @type\r\n\r\n @return: CS_ERR_OK on success, or other value on failure.\r\n Refer to cs_err enum for detailed error.\r\n\r\n NOTE: in the case of CS_OPT_MEM, handle's value can be anything,\r\n so that cs_option(handle, CS_OPT_MEM, value) can (i.e must) be called\r\n even before cs_open()\r\n*/\r\nCAPSTONE_EXPORT\r\ncs_err CAPSTONE_API cs_option(csh handle, cs_opt_type type, size_t value);\r\n\r\n/*\r\n Report the last error number when some API function fail.\r\n Like glibc's errno, cs_errno might not retain its old value once accessed.\r\n\r\n @handle: handle returned by cs_open()\r\n\r\n @return: error code of cs_err enum type (CS_ERR_*, see above)\r\n*/\r\nCAPSTONE_EXPORT\r\ncs_err CAPSTONE_API cs_errno(csh handle);\r\n\r\n\r\n/*\r\n Return a string describing given error code.\r\n\r\n @code: error code (see CS_ERR_* above)\r\n\r\n @return: returns a pointer to a string that describes the error code\r\n passed in the argument @code\r\n*/\r\nCAPSTONE_EXPORT\r\nconst char* CAPSTONE_API cs_strerror(cs_err code);\r\n\r\n/*\r\n Disassemble binary code, given the code buffer, size, address and number\r\n of instructions to be decoded.\r\n This API dynamically allocate memory to contain disassembled instruction.\r\n Resulted instructions will be put into @*insn\r\n\r\n NOTE 1: this API will automatically determine memory needed to contain\r\n output disassembled instructions in @insn.\r\n\r\n NOTE 2: caller must free the allocated memory itself to avoid memory leaking.\r\n\r\n NOTE 3: for system with scarce memory to be dynamically allocated such as\r\n OS kernel or firmware, the API cs_disasm_iter() might be a better choice than\r\n cs_disasm(). The reason is that with cs_disasm(), based on limited available\r\n memory, we have to calculate in advance how many instructions to be disassembled,\r\n which complicates things. This is especially troublesome for the case @count=0,\r\n when cs_disasm() runs uncontrollably (until either end of input buffer, or\r\n when it encounters an invalid instruction).\r\n\r\n @handle: handle returned by cs_open()\r\n @code: buffer containing raw binary code to be disassembled.\r\n @code_size: size of the above code buffer.\r\n @address: address of the first instruction in given raw code buffer.\r\n @insn: array of instructions filled in by this API.\r\n NOTE: @insn will be allocated by this function, and should be freed\r\n with cs_free() API.\r\n @count: number of instructions to be disassembled, or 0 to get all of them\r\n\r\n @return: the number of successfully disassembled instructions,\r\n or 0 if this function failed to disassemble the given code\r\n\r\n On failure, call cs_errno() for error code.\r\n*/\r\nCAPSTONE_EXPORT\r\nsize_t CAPSTONE_API cs_disasm(csh handle,\r\n const uint8_t* code, size_t code_size,\r\n uint64_t address,\r\n size_t count,\r\n cs_insn** insn);\r\n\r\n/*\r\n Deprecated function - to be retired in the next version!\r\n Use cs_disasm() instead of cs_disasm_ex()\r\n*/\r\nCAPSTONE_EXPORT\r\nCAPSTONE_DEPRECATED\r\nsize_t CAPSTONE_API cs_disasm_ex(csh handle,\r\n const uint8_t* code, size_t code_size,\r\n uint64_t address,\r\n size_t count,\r\n cs_insn** insn);\r\n\r\n/*\r\n Free memory allocated by cs_malloc() or cs_disasm() (argument @insn)\r\n\r\n @insn: pointer returned by @insn argument in cs_disasm() or cs_malloc()\r\n @count: number of cs_insn structures returned by cs_disasm(), or 1\r\n to free memory allocated by cs_malloc().\r\n*/\r\nCAPSTONE_EXPORT\r\nvoid CAPSTONE_API cs_free(cs_insn* insn, size_t count);\r\n\r\n\r\n/*\r\n Allocate memory for 1 instruction to be used by cs_disasm_iter().\r\n\r\n @handle: handle returned by cs_open()\r\n\r\n NOTE: when no longer in use, you can reclaim the memory allocated for\r\n this instruction with cs_free(insn, 1)\r\n*/\r\nCAPSTONE_EXPORT\r\ncs_insn* CAPSTONE_API cs_malloc(csh handle);\r\n\r\n/*\r\n Fast API to disassemble binary code, given the code buffer, size, address\r\n and number of instructions to be decoded.\r\n This API put the resulted instruction into a given cache in @insn.\r\n See tests/test_iter.c for sample code demonstrating this API.\r\n\r\n NOTE 1: this API will update @code, @size & @address to point to the next\r\n instruction in the input buffer. Therefore, it is convenient to use\r\n cs_disasm_iter() inside a loop to quickly iterate all the instructions.\r\n While decoding one instruction at a time can also be achieved with\r\n cs_disasm(count=1), some benchmarks shown that cs_disasm_iter() can be 30%\r\n faster on random input.\r\n\r\n NOTE 2: the cache in @insn can be created with cs_malloc() API.\r\n\r\n NOTE 3: for system with scarce memory to be dynamically allocated such as\r\n OS kernel or firmware, this API is recommended over cs_disasm(), which\r\n allocates memory based on the number of instructions to be disassembled.\r\n The reason is that with cs_disasm(), based on limited available memory,\r\n we have to calculate in advance how many instructions to be disassembled,\r\n which complicates things. This is especially troublesome for the case\r\n @count=0, when cs_disasm() runs uncontrollably (until either end of input\r\n buffer, or when it encounters an invalid instruction).\r\n\r\n @handle: handle returned by cs_open()\r\n @code: buffer containing raw binary code to be disassembled\r\n @code_size: size of above code\r\n @address: address of the first insn in given raw code buffer\r\n @insn: pointer to instruction to be filled in by this API.\r\n\r\n @return: true if this API successfully decode 1 instruction,\r\n or false otherwise.\r\n\r\n On failure, call cs_errno() for error code.\r\n*/\r\nCAPSTONE_EXPORT\r\nbool CAPSTONE_API cs_disasm_iter(csh handle,\r\n const uint8_t** code, size_t* size,\r\n uint64_t* address, cs_insn* insn);\r\n\r\n/*\r\n Return friendly name of register in a string.\r\n Find the instruction id from header file of corresponding architecture (arm.h for ARM,\r\n x86.h for X86, ...)\r\n\r\n WARN: when in 'diet' mode, this API is irrelevant because engine does not\r\n store register name.\r\n\r\n @handle: handle returned by cs_open()\r\n @reg_id: register id\r\n\r\n @return: string name of the register, or NULL if @reg_id is invalid.\r\n*/\r\nCAPSTONE_EXPORT\r\nconst char* CAPSTONE_API cs_reg_name(csh handle, unsigned int reg_id);\r\n\r\n/*\r\n Return friendly name of an instruction in a string.\r\n Find the instruction id from header file of corresponding architecture (arm.h for ARM, x86.h for X86, ...)\r\n\r\n WARN: when in 'diet' mode, this API is irrelevant because the engine does not\r\n store instruction name.\r\n\r\n @handle: handle returned by cs_open()\r\n @insn_id: instruction id\r\n\r\n @return: string name of the instruction, or NULL if @insn_id is invalid.\r\n*/\r\nCAPSTONE_EXPORT\r\nconst char* CAPSTONE_API cs_insn_name(csh handle, unsigned int insn_id);\r\n\r\n/*\r\n Return friendly name of a group id (that an instruction can belong to)\r\n Find the group id from header file of corresponding architecture (arm.h for ARM, x86.h for X86, ...)\r\n\r\n WARN: when in 'diet' mode, this API is irrelevant because the engine does not\r\n store group name.\r\n\r\n @handle: handle returned by cs_open()\r\n @group_id: group id\r\n\r\n @return: string name of the group, or NULL if @group_id is invalid.\r\n*/\r\nCAPSTONE_EXPORT\r\nconst char* CAPSTONE_API cs_group_name(csh handle, unsigned int group_id);\r\n\r\n/*\r\n Check if a disassembled instruction belong to a particular group.\r\n Find the group id from header file of corresponding architecture (arm.h for ARM, x86.h for X86, ...)\r\n Internally, this simply verifies if @group_id matches any member of insn->groups array.\r\n\r\n NOTE: this API is only valid when detail option is ON (which is OFF by default).\r\n\r\n WARN: when in 'diet' mode, this API is irrelevant because the engine does not\r\n update @groups array.\r\n\r\n @handle: handle returned by cs_open()\r\n @insn: disassembled instruction structure received from cs_disasm() or cs_disasm_iter()\r\n @group_id: group that you want to check if this instruction belong to.\r\n\r\n @return: true if this instruction indeed belongs to aboved group, or false otherwise.\r\n*/\r\nCAPSTONE_EXPORT\r\nbool CAPSTONE_API cs_insn_group(csh handle, const cs_insn* insn, unsigned int group_id);\r\n\r\n/*\r\n Check if a disassembled instruction IMPLICITLY used a particular register.\r\n Find the register id from header file of corresponding architecture (arm.h for ARM, x86.h for X86, ...)\r\n Internally, this simply verifies if @reg_id matches any member of insn->regs_read array.\r\n\r\n NOTE: this API is only valid when detail option is ON (which is OFF by default)\r\n\r\n WARN: when in 'diet' mode, this API is irrelevant because the engine does not\r\n update @regs_read array.\r\n\r\n @insn: disassembled instruction structure received from cs_disasm() or cs_disasm_iter()\r\n @reg_id: register that you want to check if this instruction used it.\r\n\r\n @return: true if this instruction indeed implicitly used aboved register, or false otherwise.\r\n*/\r\nCAPSTONE_EXPORT\r\nbool CAPSTONE_API cs_reg_read(csh handle, const cs_insn* insn, unsigned int reg_id);\r\n\r\n/*\r\n Check if a disassembled instruction IMPLICITLY modified a particular register.\r\n Find the register id from header file of corresponding architecture (arm.h for ARM, x86.h for X86, ...)\r\n Internally, this simply verifies if @reg_id matches any member of insn->regs_write array.\r\n\r\n NOTE: this API is only valid when detail option is ON (which is OFF by default)\r\n\r\n WARN: when in 'diet' mode, this API is irrelevant because the engine does not\r\n update @regs_write array.\r\n\r\n @insn: disassembled instruction structure received from cs_disasm() or cs_disasm_iter()\r\n @reg_id: register that you want to check if this instruction modified it.\r\n\r\n @return: true if this instruction indeed implicitly modified aboved register, or false otherwise.\r\n*/\r\nCAPSTONE_EXPORT\r\nbool CAPSTONE_API cs_reg_write(csh handle, const cs_insn* insn, unsigned int reg_id);\r\n\r\n/*\r\n Count the number of operands of a given type.\r\n Find the operand type in header file of corresponding architecture (arm.h for ARM, x86.h for X86, ...)\r\n\r\n NOTE: this API is only valid when detail option is ON (which is OFF by default)\r\n\r\n @handle: handle returned by cs_open()\r\n @insn: disassembled instruction structure received from cs_disasm() or cs_disasm_iter()\r\n @op_type: Operand type to be found.\r\n\r\n @return: number of operands of given type @op_type in instruction @insn,\r\n or -1 on failure.\r\n*/\r\nCAPSTONE_EXPORT\r\nint CAPSTONE_API cs_op_count(csh handle, const cs_insn* insn, unsigned int op_type);\r\n\r\n/*\r\n Retrieve the position of operand of given type in .operands[] array.\r\n Later, the operand can be accessed using the returned position.\r\n Find the operand type in header file of corresponding architecture (arm.h for ARM, x86.h for X86, ...)\r\n\r\n NOTE: this API is only valid when detail option is ON (which is OFF by default)\r\n\r\n @handle: handle returned by cs_open()\r\n @insn: disassembled instruction structure received from cs_disasm() or cs_disasm_iter()\r\n @op_type: Operand type to be found.\r\n @position: position of the operand to be found. This must be in the range\r\n [1, cs_op_count(handle, insn, op_type)]\r\n\r\n @return: index of operand of given type @op_type in .operands[] array\r\n in instruction @insn, or -1 on failure.\r\n*/\r\nCAPSTONE_EXPORT\r\nint CAPSTONE_API cs_op_index(csh handle, const cs_insn* insn, unsigned int op_type,\r\n unsigned int position);\r\n\r\n// Type of array to keep the list of registers\r\ntypedef uint16_t cs_regs[64];\r\n\r\n/*\r\n Retrieve all the registers accessed by an instruction, either explicitly or\r\n implicitly.\r\n\r\n WARN: when in 'diet' mode, this API is irrelevant because engine does not\r\n store registers.\r\n\r\n @handle: handle returned by cs_open()\r\n @insn: disassembled instruction structure returned from cs_disasm() or cs_disasm_iter()\r\n @regs_read: on return, this array contains all registers read by instruction.\r\n @regs_read_count: number of registers kept inside @regs_read array.\r\n @regs_write: on return, this array contains all registers written by instruction.\r\n @regs_write_count: number of registers kept inside @regs_write array.\r\n\r\n @return CS_ERR_OK on success, or other value on failure (refer to cs_err enum\r\n for detailed error).\r\n*/\r\nCAPSTONE_EXPORT\r\ncs_err CAPSTONE_API cs_regs_access(csh handle, const cs_insn* insn,\r\n cs_regs regs_read, uint8_t* regs_read_count,\r\n cs_regs regs_write, uint8_t* regs_write_count);\r\n\r\n#ifdef __cplusplus\r\n}\r\n#endif\r\n\r\n#endif\r\n" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/capstone/m68k.h", "content": "#ifndef CAPSTONE_M68K_H\r\n#define CAPSTONE_M68K_H\r\n\r\n/* Capstone Disassembly Engine */\r\n/* By Daniel Collin , 2015-2016 */\r\n\r\n#ifdef __cplusplus\r\nextern \"C\" {\r\n#endif\r\n\r\n#include \"platform.h\"\r\n\r\n#ifdef _MSC_VER\r\n#pragma warning(disable:4201)\r\n#endif\r\n\r\n#define M68K_OPERAND_COUNT 4\r\n\r\n//> M68K registers and special registers\r\ntypedef enum m68k_reg\r\n{\r\n M68K_REG_INVALID = 0,\r\n\r\n M68K_REG_D0,\r\n M68K_REG_D1,\r\n M68K_REG_D2,\r\n M68K_REG_D3,\r\n M68K_REG_D4,\r\n M68K_REG_D5,\r\n M68K_REG_D6,\r\n M68K_REG_D7,\r\n\r\n M68K_REG_A0,\r\n M68K_REG_A1,\r\n M68K_REG_A2,\r\n M68K_REG_A3,\r\n M68K_REG_A4,\r\n M68K_REG_A5,\r\n M68K_REG_A6,\r\n M68K_REG_A7,\r\n\r\n M68K_REG_FP0,\r\n M68K_REG_FP1,\r\n M68K_REG_FP2,\r\n M68K_REG_FP3,\r\n M68K_REG_FP4,\r\n M68K_REG_FP5,\r\n M68K_REG_FP6,\r\n M68K_REG_FP7,\r\n\r\n M68K_REG_PC,\r\n\r\n M68K_REG_SR,\r\n M68K_REG_CCR,\r\n M68K_REG_SFC,\r\n M68K_REG_DFC,\r\n M68K_REG_USP,\r\n M68K_REG_VBR,\r\n M68K_REG_CACR,\r\n M68K_REG_CAAR,\r\n M68K_REG_MSP,\r\n M68K_REG_ISP,\r\n M68K_REG_TC,\r\n M68K_REG_ITT0,\r\n M68K_REG_ITT1,\r\n M68K_REG_DTT0,\r\n M68K_REG_DTT1,\r\n M68K_REG_MMUSR,\r\n M68K_REG_URP,\r\n M68K_REG_SRP,\r\n\r\n M68K_REG_FPCR,\r\n M68K_REG_FPSR,\r\n M68K_REG_FPIAR,\r\n\r\n M68K_REG_ENDING, // <-- mark the end of the list of registers\r\n} m68k_reg;\r\n\r\n//> M68K Addressing Modes\r\ntypedef enum m68k_address_mode\r\n{\r\n M68K_AM_NONE = 0, // No address mode.\r\n\r\n M68K_AM_REG_DIRECT_DATA, // Register Direct - Data\r\n M68K_AM_REG_DIRECT_ADDR, // Register Direct - Address\r\n\r\n M68K_AM_REGI_ADDR, // Register Indirect - Address\r\n M68K_AM_REGI_ADDR_POST_INC, // Register Indirect - Address with Postincrement\r\n M68K_AM_REGI_ADDR_PRE_DEC, // Register Indirect - Address with Predecrement\r\n M68K_AM_REGI_ADDR_DISP, // Register Indirect - Address with Displacement\r\n\r\n M68K_AM_AREGI_INDEX_8_BIT_DISP, // Address Register Indirect With Index- 8-bit displacement\r\n M68K_AM_AREGI_INDEX_BASE_DISP, // Address Register Indirect With Index- Base displacement\r\n\r\n M68K_AM_MEMI_POST_INDEX, // Memory indirect - Postindex\r\n M68K_AM_MEMI_PRE_INDEX, // Memory indirect - Preindex\r\n\r\n M68K_AM_PCI_DISP, // Program Counter Indirect - with Displacement\r\n\r\n M68K_AM_PCI_INDEX_8_BIT_DISP, // Program Counter Indirect with Index - with 8-Bit Displacement\r\n M68K_AM_PCI_INDEX_BASE_DISP, // Program Counter Indirect with Index - with Base Displacement\r\n\r\n M68K_AM_PC_MEMI_POST_INDEX, // Program Counter Memory Indirect - Postindexed\r\n M68K_AM_PC_MEMI_PRE_INDEX, // Program Counter Memory Indirect - Preindexed\r\n\r\n M68K_AM_ABSOLUTE_DATA_SHORT, // Absolute Data Addressing - Short\r\n M68K_AM_ABSOLUTE_DATA_LONG, // Absolute Data Addressing - Long\r\n M68K_AM_IMMEDIATE, // Immediate value\r\n} m68k_address_mode;\r\n\r\n//> Operand type for instruction's operands\r\ntypedef enum m68k_op_type\r\n{\r\n M68K_OP_INVALID = 0, // = CS_OP_INVALID (Uninitialized).\r\n M68K_OP_REG, // = CS_OP_REG (Register operand).\r\n M68K_OP_IMM, // = CS_OP_IMM (Immediate operand).\r\n M68K_OP_MEM, // = CS_OP_MEM (Memory operand).\r\n M68K_OP_FP_SINGLE, // single precision Floating-Point operand\r\n M68K_OP_FP_DOUBLE, // double precision Floating-Point operand\r\n M68K_OP_REG_BITS, // Register bits move\r\n M68K_OP_REG_PAIR, // Register pair in the same op (upper 4 bits for first reg, lower for second)\r\n} m68k_op_type;\r\n\r\n// Instruction's operand referring to memory\r\n// This is associated with M68K_OP_MEM operand type above\r\ntypedef struct m68k_op_mem\r\n{\r\n m68k_reg base_reg; // base register (or M68K_REG_INVALID if irrelevant)\r\n m68k_reg index_reg; // index register (or M68K_REG_INVALID if irrelevant)\r\n m68k_reg in_base_reg; // indirect base register (or M68K_REG_INVALID if irrelevant)\r\n uint32_t in_disp; // indirect displacement\r\n uint32_t out_disp; // other displacement\r\n int16_t disp; // displacement value\r\n uint8_t scale; // scale for index register\r\n uint8_t bitfield; // set to true if the two values below should be used\r\n uint8_t width; // used for bf* instructions\r\n uint8_t offset; // used for bf* instructions\r\n uint8_t index_size; // 0 = w, 1 = l\r\n} m68k_op_mem;\r\n\r\n// Instruction operand\r\ntypedef struct cs_m68k_op\r\n{\r\n union\r\n {\r\n uint64_t imm; // immediate value for IMM operand\r\n double dimm; // double imm\r\n float simm; // float imm\r\n m68k_reg reg; // register value for REG operand\r\n struct // register pair in one operand\r\n {\r\n m68k_reg reg_0;\r\n m68k_reg reg_1;\r\n } reg_pair;\r\n m68k_op_mem mem; // data when operand is targeting memory\r\n uint32_t register_bits; // register bits for movem etc. (always in d0-d7, a0-a7, fp0 - fp7 order)\r\n };\r\n m68k_op_type type;\r\n m68k_address_mode address_mode; // M68K addressing mode for this op\r\n} cs_m68k_op;\r\n\r\n// Operation size of the CPU instructions\r\ntypedef enum m68k_cpu_size\r\n{\r\n M68K_CPU_SIZE_NONE = 0, // unsized or unspecified\r\n M68K_CPU_SIZE_BYTE = 1, // 1 byte in size\r\n M68K_CPU_SIZE_WORD = 2, // 2 bytes in size\r\n M68K_CPU_SIZE_LONG = 4, // 4 bytes in size\r\n} m68k_cpu_size;\r\n\r\n// Operation size of the FPU instructions (Notice that FPU instruction can also use CPU sizes if needed)\r\ntypedef enum m68k_fpu_size\r\n{\r\n M68K_FPU_SIZE_NONE = 0, // unsized like fsave/frestore\r\n M68K_FPU_SIZE_SINGLE = 4, // 4 byte in size (single float)\r\n M68K_FPU_SIZE_DOUBLE = 8, // 8 byte in size (double)\r\n M68K_FPU_SIZE_EXTENDED = 12, // 12 byte in size (extended real format)\r\n} m68k_fpu_size;\r\n\r\n// Type of size that is being used for the current instruction\r\ntypedef enum m68k_size_type\r\n{\r\n M68K_SIZE_TYPE_INVALID = 0,\r\n\r\n M68K_SIZE_TYPE_CPU,\r\n M68K_SIZE_TYPE_FPU,\r\n} m68k_size_type;\r\n\r\n// Operation size of the current instruction (NOT the actually size of instruction)\r\ntypedef struct m68k_op_size\r\n{\r\n m68k_size_type type;\r\n union\r\n {\r\n m68k_cpu_size cpu_size;\r\n m68k_fpu_size fpu_size;\r\n };\r\n} m68k_op_size;\r\n\r\n// The M68K instruction and it's operands\r\ntypedef struct cs_m68k\r\n{\r\n // Number of operands of this instruction or 0 when instruction has no operand.\r\n cs_m68k_op operands[M68K_OPERAND_COUNT]; // operands for this instruction.\r\n m68k_op_size op_size; // size of data operand works on in bytes (.b, .w, .l, etc)\r\n uint8_t op_count; // number of operands for the instruction\r\n} cs_m68k;\r\n\r\n//> M68K instruction\r\ntypedef enum m68k_insn\r\n{\r\n M68K_INS_INVALID = 0,\r\n\r\n M68K_INS_ABCD,\r\n M68K_INS_ADD,\r\n M68K_INS_ADDA,\r\n M68K_INS_ADDI,\r\n M68K_INS_ADDQ,\r\n M68K_INS_ADDX,\r\n M68K_INS_AND,\r\n M68K_INS_ANDI,\r\n M68K_INS_ASL,\r\n M68K_INS_ASR,\r\n M68K_INS_BHS,\r\n M68K_INS_BLO,\r\n M68K_INS_BHI,\r\n M68K_INS_BLS,\r\n M68K_INS_BCC,\r\n M68K_INS_BCS,\r\n M68K_INS_BNE,\r\n M68K_INS_BEQ,\r\n M68K_INS_BVC,\r\n M68K_INS_BVS,\r\n M68K_INS_BPL,\r\n M68K_INS_BMI,\r\n M68K_INS_BGE,\r\n M68K_INS_BLT,\r\n M68K_INS_BGT,\r\n M68K_INS_BLE,\r\n M68K_INS_BRA,\r\n M68K_INS_BSR,\r\n M68K_INS_BCHG,\r\n M68K_INS_BCLR,\r\n M68K_INS_BSET,\r\n M68K_INS_BTST,\r\n M68K_INS_BFCHG,\r\n M68K_INS_BFCLR,\r\n M68K_INS_BFEXTS,\r\n M68K_INS_BFEXTU,\r\n M68K_INS_BFFFO,\r\n M68K_INS_BFINS,\r\n M68K_INS_BFSET,\r\n M68K_INS_BFTST,\r\n M68K_INS_BKPT,\r\n M68K_INS_CALLM,\r\n M68K_INS_CAS,\r\n M68K_INS_CAS2,\r\n M68K_INS_CHK,\r\n M68K_INS_CHK2,\r\n M68K_INS_CLR,\r\n M68K_INS_CMP,\r\n M68K_INS_CMPA,\r\n M68K_INS_CMPI,\r\n M68K_INS_CMPM,\r\n M68K_INS_CMP2,\r\n M68K_INS_CINVL,\r\n M68K_INS_CINVP,\r\n M68K_INS_CINVA,\r\n M68K_INS_CPUSHL,\r\n M68K_INS_CPUSHP,\r\n M68K_INS_CPUSHA,\r\n M68K_INS_DBT,\r\n M68K_INS_DBF,\r\n M68K_INS_DBHI,\r\n M68K_INS_DBLS,\r\n M68K_INS_DBCC,\r\n M68K_INS_DBCS,\r\n M68K_INS_DBNE,\r\n M68K_INS_DBEQ,\r\n M68K_INS_DBVC,\r\n M68K_INS_DBVS,\r\n M68K_INS_DBPL,\r\n M68K_INS_DBMI,\r\n M68K_INS_DBGE,\r\n M68K_INS_DBLT,\r\n M68K_INS_DBGT,\r\n M68K_INS_DBLE,\r\n M68K_INS_DBRA,\r\n M68K_INS_DIVS,\r\n M68K_INS_DIVSL,\r\n M68K_INS_DIVU,\r\n M68K_INS_DIVUL,\r\n M68K_INS_EOR,\r\n M68K_INS_EORI,\r\n M68K_INS_EXG,\r\n M68K_INS_EXT,\r\n M68K_INS_EXTB,\r\n M68K_INS_FABS,\r\n M68K_INS_FSABS,\r\n M68K_INS_FDABS,\r\n M68K_INS_FACOS,\r\n M68K_INS_FADD,\r\n M68K_INS_FSADD,\r\n M68K_INS_FDADD,\r\n M68K_INS_FASIN,\r\n M68K_INS_FATAN,\r\n M68K_INS_FATANH,\r\n M68K_INS_FBF,\r\n M68K_INS_FBEQ,\r\n M68K_INS_FBOGT,\r\n M68K_INS_FBOGE,\r\n M68K_INS_FBOLT,\r\n M68K_INS_FBOLE,\r\n M68K_INS_FBOGL,\r\n M68K_INS_FBOR,\r\n M68K_INS_FBUN,\r\n M68K_INS_FBUEQ,\r\n M68K_INS_FBUGT,\r\n M68K_INS_FBUGE,\r\n M68K_INS_FBULT,\r\n M68K_INS_FBULE,\r\n M68K_INS_FBNE,\r\n M68K_INS_FBT,\r\n M68K_INS_FBSF,\r\n M68K_INS_FBSEQ,\r\n M68K_INS_FBGT,\r\n M68K_INS_FBGE,\r\n M68K_INS_FBLT,\r\n M68K_INS_FBLE,\r\n M68K_INS_FBGL,\r\n M68K_INS_FBGLE,\r\n M68K_INS_FBNGLE,\r\n M68K_INS_FBNGL,\r\n M68K_INS_FBNLE,\r\n M68K_INS_FBNLT,\r\n M68K_INS_FBNGE,\r\n M68K_INS_FBNGT,\r\n M68K_INS_FBSNE,\r\n M68K_INS_FBST,\r\n M68K_INS_FCMP,\r\n M68K_INS_FCOS,\r\n M68K_INS_FCOSH,\r\n M68K_INS_FDBF,\r\n M68K_INS_FDBEQ,\r\n M68K_INS_FDBOGT,\r\n M68K_INS_FDBOGE,\r\n M68K_INS_FDBOLT,\r\n M68K_INS_FDBOLE,\r\n M68K_INS_FDBOGL,\r\n M68K_INS_FDBOR,\r\n M68K_INS_FDBUN,\r\n M68K_INS_FDBUEQ,\r\n M68K_INS_FDBUGT,\r\n M68K_INS_FDBUGE,\r\n M68K_INS_FDBULT,\r\n M68K_INS_FDBULE,\r\n M68K_INS_FDBNE,\r\n M68K_INS_FDBT,\r\n M68K_INS_FDBSF,\r\n M68K_INS_FDBSEQ,\r\n M68K_INS_FDBGT,\r\n M68K_INS_FDBGE,\r\n M68K_INS_FDBLT,\r\n M68K_INS_FDBLE,\r\n M68K_INS_FDBGL,\r\n M68K_INS_FDBGLE,\r\n M68K_INS_FDBNGLE,\r\n M68K_INS_FDBNGL,\r\n M68K_INS_FDBNLE,\r\n M68K_INS_FDBNLT,\r\n M68K_INS_FDBNGE,\r\n M68K_INS_FDBNGT,\r\n M68K_INS_FDBSNE,\r\n M68K_INS_FDBST,\r\n M68K_INS_FDIV,\r\n M68K_INS_FSDIV,\r\n M68K_INS_FDDIV,\r\n M68K_INS_FETOX,\r\n M68K_INS_FETOXM1,\r\n M68K_INS_FGETEXP,\r\n M68K_INS_FGETMAN,\r\n M68K_INS_FINT,\r\n M68K_INS_FINTRZ,\r\n M68K_INS_FLOG10,\r\n M68K_INS_FLOG2,\r\n M68K_INS_FLOGN,\r\n M68K_INS_FLOGNP1,\r\n M68K_INS_FMOD,\r\n M68K_INS_FMOVE,\r\n M68K_INS_FSMOVE,\r\n M68K_INS_FDMOVE,\r\n M68K_INS_FMOVECR,\r\n M68K_INS_FMOVEM,\r\n M68K_INS_FMUL,\r\n M68K_INS_FSMUL,\r\n M68K_INS_FDMUL,\r\n M68K_INS_FNEG,\r\n M68K_INS_FSNEG,\r\n M68K_INS_FDNEG,\r\n M68K_INS_FNOP,\r\n M68K_INS_FREM,\r\n M68K_INS_FRESTORE,\r\n M68K_INS_FSAVE,\r\n M68K_INS_FSCALE,\r\n M68K_INS_FSGLDIV,\r\n M68K_INS_FSGLMUL,\r\n M68K_INS_FSIN,\r\n M68K_INS_FSINCOS,\r\n M68K_INS_FSINH,\r\n M68K_INS_FSQRT,\r\n M68K_INS_FSSQRT,\r\n M68K_INS_FDSQRT,\r\n M68K_INS_FSF,\r\n M68K_INS_FSBEQ,\r\n M68K_INS_FSOGT,\r\n M68K_INS_FSOGE,\r\n M68K_INS_FSOLT,\r\n M68K_INS_FSOLE,\r\n M68K_INS_FSOGL,\r\n M68K_INS_FSOR,\r\n M68K_INS_FSUN,\r\n M68K_INS_FSUEQ,\r\n M68K_INS_FSUGT,\r\n M68K_INS_FSUGE,\r\n M68K_INS_FSULT,\r\n M68K_INS_FSULE,\r\n M68K_INS_FSNE,\r\n M68K_INS_FST,\r\n M68K_INS_FSSF,\r\n M68K_INS_FSSEQ,\r\n M68K_INS_FSGT,\r\n M68K_INS_FSGE,\r\n M68K_INS_FSLT,\r\n M68K_INS_FSLE,\r\n M68K_INS_FSGL,\r\n M68K_INS_FSGLE,\r\n M68K_INS_FSNGLE,\r\n M68K_INS_FSNGL,\r\n M68K_INS_FSNLE,\r\n M68K_INS_FSNLT,\r\n M68K_INS_FSNGE,\r\n M68K_INS_FSNGT,\r\n M68K_INS_FSSNE,\r\n M68K_INS_FSST,\r\n M68K_INS_FSUB,\r\n M68K_INS_FSSUB,\r\n M68K_INS_FDSUB,\r\n M68K_INS_FTAN,\r\n M68K_INS_FTANH,\r\n M68K_INS_FTENTOX,\r\n M68K_INS_FTRAPF,\r\n M68K_INS_FTRAPEQ,\r\n M68K_INS_FTRAPOGT,\r\n M68K_INS_FTRAPOGE,\r\n M68K_INS_FTRAPOLT,\r\n M68K_INS_FTRAPOLE,\r\n M68K_INS_FTRAPOGL,\r\n M68K_INS_FTRAPOR,\r\n M68K_INS_FTRAPUN,\r\n M68K_INS_FTRAPUEQ,\r\n M68K_INS_FTRAPUGT,\r\n M68K_INS_FTRAPUGE,\r\n M68K_INS_FTRAPULT,\r\n M68K_INS_FTRAPULE,\r\n M68K_INS_FTRAPNE,\r\n M68K_INS_FTRAPT,\r\n M68K_INS_FTRAPSF,\r\n M68K_INS_FTRAPSEQ,\r\n M68K_INS_FTRAPGT,\r\n M68K_INS_FTRAPGE,\r\n M68K_INS_FTRAPLT,\r\n M68K_INS_FTRAPLE,\r\n M68K_INS_FTRAPGL,\r\n M68K_INS_FTRAPGLE,\r\n M68K_INS_FTRAPNGLE,\r\n M68K_INS_FTRAPNGL,\r\n M68K_INS_FTRAPNLE,\r\n M68K_INS_FTRAPNLT,\r\n M68K_INS_FTRAPNGE,\r\n M68K_INS_FTRAPNGT,\r\n M68K_INS_FTRAPSNE,\r\n M68K_INS_FTRAPST,\r\n M68K_INS_FTST,\r\n M68K_INS_FTWOTOX,\r\n M68K_INS_HALT,\r\n M68K_INS_ILLEGAL,\r\n M68K_INS_JMP,\r\n M68K_INS_JSR,\r\n M68K_INS_LEA,\r\n M68K_INS_LINK,\r\n M68K_INS_LPSTOP,\r\n M68K_INS_LSL,\r\n M68K_INS_LSR,\r\n M68K_INS_MOVE,\r\n M68K_INS_MOVEA,\r\n M68K_INS_MOVEC,\r\n M68K_INS_MOVEM,\r\n M68K_INS_MOVEP,\r\n M68K_INS_MOVEQ,\r\n M68K_INS_MOVES,\r\n M68K_INS_MOVE16,\r\n M68K_INS_MULS,\r\n M68K_INS_MULU,\r\n M68K_INS_NBCD,\r\n M68K_INS_NEG,\r\n M68K_INS_NEGX,\r\n M68K_INS_NOP,\r\n M68K_INS_NOT,\r\n M68K_INS_OR,\r\n M68K_INS_ORI,\r\n M68K_INS_PACK,\r\n M68K_INS_PEA,\r\n M68K_INS_PFLUSH,\r\n M68K_INS_PFLUSHA,\r\n M68K_INS_PFLUSHAN,\r\n M68K_INS_PFLUSHN,\r\n M68K_INS_PLOADR,\r\n M68K_INS_PLOADW,\r\n M68K_INS_PLPAR,\r\n M68K_INS_PLPAW,\r\n M68K_INS_PMOVE,\r\n M68K_INS_PMOVEFD,\r\n M68K_INS_PTESTR,\r\n M68K_INS_PTESTW,\r\n M68K_INS_PULSE,\r\n M68K_INS_REMS,\r\n M68K_INS_REMU,\r\n M68K_INS_RESET,\r\n M68K_INS_ROL,\r\n M68K_INS_ROR,\r\n M68K_INS_ROXL,\r\n M68K_INS_ROXR,\r\n M68K_INS_RTD,\r\n M68K_INS_RTE,\r\n M68K_INS_RTM,\r\n M68K_INS_RTR,\r\n M68K_INS_RTS,\r\n M68K_INS_SBCD,\r\n M68K_INS_ST,\r\n M68K_INS_SF,\r\n M68K_INS_SHI,\r\n M68K_INS_SLS,\r\n M68K_INS_SCC,\r\n M68K_INS_SHS,\r\n M68K_INS_SCS,\r\n M68K_INS_SLO,\r\n M68K_INS_SNE,\r\n M68K_INS_SEQ,\r\n M68K_INS_SVC,\r\n M68K_INS_SVS,\r\n M68K_INS_SPL,\r\n M68K_INS_SMI,\r\n M68K_INS_SGE,\r\n M68K_INS_SLT,\r\n M68K_INS_SGT,\r\n M68K_INS_SLE,\r\n M68K_INS_STOP,\r\n M68K_INS_SUB,\r\n M68K_INS_SUBA,\r\n M68K_INS_SUBI,\r\n M68K_INS_SUBQ,\r\n M68K_INS_SUBX,\r\n M68K_INS_SWAP,\r\n M68K_INS_TAS,\r\n M68K_INS_TRAP,\r\n M68K_INS_TRAPV,\r\n M68K_INS_TRAPT,\r\n M68K_INS_TRAPF,\r\n M68K_INS_TRAPHI,\r\n M68K_INS_TRAPLS,\r\n M68K_INS_TRAPCC,\r\n M68K_INS_TRAPHS,\r\n M68K_INS_TRAPCS,\r\n M68K_INS_TRAPLO,\r\n M68K_INS_TRAPNE,\r\n M68K_INS_TRAPEQ,\r\n M68K_INS_TRAPVC,\r\n M68K_INS_TRAPVS,\r\n M68K_INS_TRAPPL,\r\n M68K_INS_TRAPMI,\r\n M68K_INS_TRAPGE,\r\n M68K_INS_TRAPLT,\r\n M68K_INS_TRAPGT,\r\n M68K_INS_TRAPLE,\r\n M68K_INS_TST,\r\n M68K_INS_UNLK,\r\n M68K_INS_UNPK,\r\n M68K_INS_ENDING, // <-- mark the end of the list of instructions\r\n\r\n} m68k_insn;\r\n\r\n//> Group of M68K instructions\r\ntypedef enum m68k_group_type\r\n{\r\n M68K_GRP_INVALID = 0, // CS_GRUP_INVALID\r\n M68K_GRP_JUMP, // = CS_GRP_JUMP\r\n M68K_GRP_RET = 3, // = CS_GRP_RET\r\n M68K_GRP_IRET = 5, // = CS_GRP_IRET\r\n\r\n M68K_GRP_ENDING,// <-- mark the end of the list of groups\r\n} m68k_group_type;\r\n\r\n#ifdef __cplusplus\r\n}\r\n#endif\r\n\r\n#endif\r\n" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/capstone/mips.h", "content": "#ifndef CAPSTONE_MIPS_H\r\n#define CAPSTONE_MIPS_H\r\n\r\n/* Capstone Disassembly Engine */\r\n/* By Nguyen Anh Quynh , 2013-2015 */\r\n\r\n#ifdef __cplusplus\r\nextern \"C\" {\r\n#endif\r\n\r\n#include \"platform.h\"\r\n\r\n// GCC MIPS toolchain has a default macro called \"mips\" which breaks\r\n// compilation\r\n#undef mips\r\n\r\n#ifdef _MSC_VER\r\n#pragma warning(disable:4201)\r\n#endif\r\n\r\n//> Operand type for instruction's operands\r\ntypedef enum mips_op_type\r\n{\r\n MIPS_OP_INVALID = 0, // = CS_OP_INVALID (Uninitialized).\r\n MIPS_OP_REG, // = CS_OP_REG (Register operand).\r\n MIPS_OP_IMM, // = CS_OP_IMM (Immediate operand).\r\n MIPS_OP_MEM, // = CS_OP_MEM (Memory operand).\r\n} mips_op_type;\r\n\r\n//> MIPS registers\r\ntypedef enum mips_reg\r\n{\r\n MIPS_REG_INVALID = 0,\r\n //> General purpose registers\r\n MIPS_REG_PC,\r\n\r\n MIPS_REG_0,\r\n MIPS_REG_1,\r\n MIPS_REG_2,\r\n MIPS_REG_3,\r\n MIPS_REG_4,\r\n MIPS_REG_5,\r\n MIPS_REG_6,\r\n MIPS_REG_7,\r\n MIPS_REG_8,\r\n MIPS_REG_9,\r\n MIPS_REG_10,\r\n MIPS_REG_11,\r\n MIPS_REG_12,\r\n MIPS_REG_13,\r\n MIPS_REG_14,\r\n MIPS_REG_15,\r\n MIPS_REG_16,\r\n MIPS_REG_17,\r\n MIPS_REG_18,\r\n MIPS_REG_19,\r\n MIPS_REG_20,\r\n MIPS_REG_21,\r\n MIPS_REG_22,\r\n MIPS_REG_23,\r\n MIPS_REG_24,\r\n MIPS_REG_25,\r\n MIPS_REG_26,\r\n MIPS_REG_27,\r\n MIPS_REG_28,\r\n MIPS_REG_29,\r\n MIPS_REG_30,\r\n MIPS_REG_31,\r\n\r\n //> DSP registers\r\n MIPS_REG_DSPCCOND,\r\n MIPS_REG_DSPCARRY,\r\n MIPS_REG_DSPEFI,\r\n MIPS_REG_DSPOUTFLAG,\r\n MIPS_REG_DSPOUTFLAG16_19,\r\n MIPS_REG_DSPOUTFLAG20,\r\n MIPS_REG_DSPOUTFLAG21,\r\n MIPS_REG_DSPOUTFLAG22,\r\n MIPS_REG_DSPOUTFLAG23,\r\n MIPS_REG_DSPPOS,\r\n MIPS_REG_DSPSCOUNT,\r\n\r\n //> ACC registers\r\n MIPS_REG_AC0,\r\n MIPS_REG_AC1,\r\n MIPS_REG_AC2,\r\n MIPS_REG_AC3,\r\n\r\n //> COP registers\r\n MIPS_REG_CC0,\r\n MIPS_REG_CC1,\r\n MIPS_REG_CC2,\r\n MIPS_REG_CC3,\r\n MIPS_REG_CC4,\r\n MIPS_REG_CC5,\r\n MIPS_REG_CC6,\r\n MIPS_REG_CC7,\r\n\r\n //> FPU registers\r\n MIPS_REG_F0,\r\n MIPS_REG_F1,\r\n MIPS_REG_F2,\r\n MIPS_REG_F3,\r\n MIPS_REG_F4,\r\n MIPS_REG_F5,\r\n MIPS_REG_F6,\r\n MIPS_REG_F7,\r\n MIPS_REG_F8,\r\n MIPS_REG_F9,\r\n MIPS_REG_F10,\r\n MIPS_REG_F11,\r\n MIPS_REG_F12,\r\n MIPS_REG_F13,\r\n MIPS_REG_F14,\r\n MIPS_REG_F15,\r\n MIPS_REG_F16,\r\n MIPS_REG_F17,\r\n MIPS_REG_F18,\r\n MIPS_REG_F19,\r\n MIPS_REG_F20,\r\n MIPS_REG_F21,\r\n MIPS_REG_F22,\r\n MIPS_REG_F23,\r\n MIPS_REG_F24,\r\n MIPS_REG_F25,\r\n MIPS_REG_F26,\r\n MIPS_REG_F27,\r\n MIPS_REG_F28,\r\n MIPS_REG_F29,\r\n MIPS_REG_F30,\r\n MIPS_REG_F31,\r\n\r\n MIPS_REG_FCC0,\r\n MIPS_REG_FCC1,\r\n MIPS_REG_FCC2,\r\n MIPS_REG_FCC3,\r\n MIPS_REG_FCC4,\r\n MIPS_REG_FCC5,\r\n MIPS_REG_FCC6,\r\n MIPS_REG_FCC7,\r\n\r\n //> AFPR128\r\n MIPS_REG_W0,\r\n MIPS_REG_W1,\r\n MIPS_REG_W2,\r\n MIPS_REG_W3,\r\n MIPS_REG_W4,\r\n MIPS_REG_W5,\r\n MIPS_REG_W6,\r\n MIPS_REG_W7,\r\n MIPS_REG_W8,\r\n MIPS_REG_W9,\r\n MIPS_REG_W10,\r\n MIPS_REG_W11,\r\n MIPS_REG_W12,\r\n MIPS_REG_W13,\r\n MIPS_REG_W14,\r\n MIPS_REG_W15,\r\n MIPS_REG_W16,\r\n MIPS_REG_W17,\r\n MIPS_REG_W18,\r\n MIPS_REG_W19,\r\n MIPS_REG_W20,\r\n MIPS_REG_W21,\r\n MIPS_REG_W22,\r\n MIPS_REG_W23,\r\n MIPS_REG_W24,\r\n MIPS_REG_W25,\r\n MIPS_REG_W26,\r\n MIPS_REG_W27,\r\n MIPS_REG_W28,\r\n MIPS_REG_W29,\r\n MIPS_REG_W30,\r\n MIPS_REG_W31,\r\n\r\n MIPS_REG_HI,\r\n MIPS_REG_LO,\r\n\r\n MIPS_REG_P0,\r\n MIPS_REG_P1,\r\n MIPS_REG_P2,\r\n\r\n MIPS_REG_MPL0,\r\n MIPS_REG_MPL1,\r\n MIPS_REG_MPL2,\r\n\r\n MIPS_REG_ENDING, // <-- mark the end of the list or registers\r\n\r\n // alias registers\r\n MIPS_REG_ZERO = MIPS_REG_0,\r\n MIPS_REG_AT = MIPS_REG_1,\r\n MIPS_REG_V0 = MIPS_REG_2,\r\n MIPS_REG_V1 = MIPS_REG_3,\r\n MIPS_REG_A0 = MIPS_REG_4,\r\n MIPS_REG_A1 = MIPS_REG_5,\r\n MIPS_REG_A2 = MIPS_REG_6,\r\n MIPS_REG_A3 = MIPS_REG_7,\r\n MIPS_REG_T0 = MIPS_REG_8,\r\n MIPS_REG_T1 = MIPS_REG_9,\r\n MIPS_REG_T2 = MIPS_REG_10,\r\n MIPS_REG_T3 = MIPS_REG_11,\r\n MIPS_REG_T4 = MIPS_REG_12,\r\n MIPS_REG_T5 = MIPS_REG_13,\r\n MIPS_REG_T6 = MIPS_REG_14,\r\n MIPS_REG_T7 = MIPS_REG_15,\r\n MIPS_REG_S0 = MIPS_REG_16,\r\n MIPS_REG_S1 = MIPS_REG_17,\r\n MIPS_REG_S2 = MIPS_REG_18,\r\n MIPS_REG_S3 = MIPS_REG_19,\r\n MIPS_REG_S4 = MIPS_REG_20,\r\n MIPS_REG_S5 = MIPS_REG_21,\r\n MIPS_REG_S6 = MIPS_REG_22,\r\n MIPS_REG_S7 = MIPS_REG_23,\r\n MIPS_REG_T8 = MIPS_REG_24,\r\n MIPS_REG_T9 = MIPS_REG_25,\r\n MIPS_REG_K0 = MIPS_REG_26,\r\n MIPS_REG_K1 = MIPS_REG_27,\r\n MIPS_REG_GP = MIPS_REG_28,\r\n MIPS_REG_SP = MIPS_REG_29,\r\n MIPS_REG_FP = MIPS_REG_30, MIPS_REG_S8 = MIPS_REG_30,\r\n MIPS_REG_RA = MIPS_REG_31,\r\n\r\n MIPS_REG_HI0 = MIPS_REG_AC0,\r\n MIPS_REG_HI1 = MIPS_REG_AC1,\r\n MIPS_REG_HI2 = MIPS_REG_AC2,\r\n MIPS_REG_HI3 = MIPS_REG_AC3,\r\n\r\n MIPS_REG_LO0 = MIPS_REG_HI0,\r\n MIPS_REG_LO1 = MIPS_REG_HI1,\r\n MIPS_REG_LO2 = MIPS_REG_HI2,\r\n MIPS_REG_LO3 = MIPS_REG_HI3,\r\n} mips_reg;\r\n\r\n// Instruction's operand referring to memory\r\n// This is associated with MIPS_OP_MEM operand type above\r\ntypedef struct mips_op_mem\r\n{\r\n mips_reg base; // base register\r\n int64_t disp; // displacement/offset value\r\n} mips_op_mem;\r\n\r\n// Instruction operand\r\ntypedef struct cs_mips_op\r\n{\r\n mips_op_type type; // operand type\r\n union\r\n {\r\n mips_reg reg; // register value for REG operand\r\n int64_t imm; // immediate value for IMM operand\r\n mips_op_mem mem; // base/index/scale/disp value for MEM operand\r\n };\r\n} cs_mips_op;\r\n\r\n// Instruction structure\r\ntypedef struct cs_mips\r\n{\r\n // Number of operands of this instruction,\r\n // or 0 when instruction has no operand.\r\n uint8_t op_count;\r\n cs_mips_op operands[8]; // operands for this instruction.\r\n} cs_mips;\r\n\r\n//> MIPS instruction\r\ntypedef enum mips_insn\r\n{\r\n MIPS_INS_INVALID = 0,\r\n\r\n MIPS_INS_ABSQ_S,\r\n MIPS_INS_ADD,\r\n MIPS_INS_ADDIUPC,\r\n MIPS_INS_ADDIUR1SP,\r\n MIPS_INS_ADDIUR2,\r\n MIPS_INS_ADDIUS5,\r\n MIPS_INS_ADDIUSP,\r\n MIPS_INS_ADDQH,\r\n MIPS_INS_ADDQH_R,\r\n MIPS_INS_ADDQ,\r\n MIPS_INS_ADDQ_S,\r\n MIPS_INS_ADDSC,\r\n MIPS_INS_ADDS_A,\r\n MIPS_INS_ADDS_S,\r\n MIPS_INS_ADDS_U,\r\n MIPS_INS_ADDU16,\r\n MIPS_INS_ADDUH,\r\n MIPS_INS_ADDUH_R,\r\n MIPS_INS_ADDU,\r\n MIPS_INS_ADDU_S,\r\n MIPS_INS_ADDVI,\r\n MIPS_INS_ADDV,\r\n MIPS_INS_ADDWC,\r\n MIPS_INS_ADD_A,\r\n MIPS_INS_ADDI,\r\n MIPS_INS_ADDIU,\r\n MIPS_INS_ALIGN,\r\n MIPS_INS_ALUIPC,\r\n MIPS_INS_AND,\r\n MIPS_INS_AND16,\r\n MIPS_INS_ANDI16,\r\n MIPS_INS_ANDI,\r\n MIPS_INS_APPEND,\r\n MIPS_INS_ASUB_S,\r\n MIPS_INS_ASUB_U,\r\n MIPS_INS_AUI,\r\n MIPS_INS_AUIPC,\r\n MIPS_INS_AVER_S,\r\n MIPS_INS_AVER_U,\r\n MIPS_INS_AVE_S,\r\n MIPS_INS_AVE_U,\r\n MIPS_INS_B16,\r\n MIPS_INS_BADDU,\r\n MIPS_INS_BAL,\r\n MIPS_INS_BALC,\r\n MIPS_INS_BALIGN,\r\n MIPS_INS_BBIT0,\r\n MIPS_INS_BBIT032,\r\n MIPS_INS_BBIT1,\r\n MIPS_INS_BBIT132,\r\n MIPS_INS_BC,\r\n MIPS_INS_BC0F,\r\n MIPS_INS_BC0FL,\r\n MIPS_INS_BC0T,\r\n MIPS_INS_BC0TL,\r\n MIPS_INS_BC1EQZ,\r\n MIPS_INS_BC1F,\r\n MIPS_INS_BC1FL,\r\n MIPS_INS_BC1NEZ,\r\n MIPS_INS_BC1T,\r\n MIPS_INS_BC1TL,\r\n MIPS_INS_BC2EQZ,\r\n MIPS_INS_BC2F,\r\n MIPS_INS_BC2FL,\r\n MIPS_INS_BC2NEZ,\r\n MIPS_INS_BC2T,\r\n MIPS_INS_BC2TL,\r\n MIPS_INS_BC3F,\r\n MIPS_INS_BC3FL,\r\n MIPS_INS_BC3T,\r\n MIPS_INS_BC3TL,\r\n MIPS_INS_BCLRI,\r\n MIPS_INS_BCLR,\r\n MIPS_INS_BEQ,\r\n MIPS_INS_BEQC,\r\n MIPS_INS_BEQL,\r\n MIPS_INS_BEQZ16,\r\n MIPS_INS_BEQZALC,\r\n MIPS_INS_BEQZC,\r\n MIPS_INS_BGEC,\r\n MIPS_INS_BGEUC,\r\n MIPS_INS_BGEZ,\r\n MIPS_INS_BGEZAL,\r\n MIPS_INS_BGEZALC,\r\n MIPS_INS_BGEZALL,\r\n MIPS_INS_BGEZALS,\r\n MIPS_INS_BGEZC,\r\n MIPS_INS_BGEZL,\r\n MIPS_INS_BGTZ,\r\n MIPS_INS_BGTZALC,\r\n MIPS_INS_BGTZC,\r\n MIPS_INS_BGTZL,\r\n MIPS_INS_BINSLI,\r\n MIPS_INS_BINSL,\r\n MIPS_INS_BINSRI,\r\n MIPS_INS_BINSR,\r\n MIPS_INS_BITREV,\r\n MIPS_INS_BITSWAP,\r\n MIPS_INS_BLEZ,\r\n MIPS_INS_BLEZALC,\r\n MIPS_INS_BLEZC,\r\n MIPS_INS_BLEZL,\r\n MIPS_INS_BLTC,\r\n MIPS_INS_BLTUC,\r\n MIPS_INS_BLTZ,\r\n MIPS_INS_BLTZAL,\r\n MIPS_INS_BLTZALC,\r\n MIPS_INS_BLTZALL,\r\n MIPS_INS_BLTZALS,\r\n MIPS_INS_BLTZC,\r\n MIPS_INS_BLTZL,\r\n MIPS_INS_BMNZI,\r\n MIPS_INS_BMNZ,\r\n MIPS_INS_BMZI,\r\n MIPS_INS_BMZ,\r\n MIPS_INS_BNE,\r\n MIPS_INS_BNEC,\r\n MIPS_INS_BNEGI,\r\n MIPS_INS_BNEG,\r\n MIPS_INS_BNEL,\r\n MIPS_INS_BNEZ16,\r\n MIPS_INS_BNEZALC,\r\n MIPS_INS_BNEZC,\r\n MIPS_INS_BNVC,\r\n MIPS_INS_BNZ,\r\n MIPS_INS_BOVC,\r\n MIPS_INS_BPOSGE32,\r\n MIPS_INS_BREAK,\r\n MIPS_INS_BREAK16,\r\n MIPS_INS_BSELI,\r\n MIPS_INS_BSEL,\r\n MIPS_INS_BSETI,\r\n MIPS_INS_BSET,\r\n MIPS_INS_BZ,\r\n MIPS_INS_BEQZ,\r\n MIPS_INS_B,\r\n MIPS_INS_BNEZ,\r\n MIPS_INS_BTEQZ,\r\n MIPS_INS_BTNEZ,\r\n MIPS_INS_CACHE,\r\n MIPS_INS_CEIL,\r\n MIPS_INS_CEQI,\r\n MIPS_INS_CEQ,\r\n MIPS_INS_CFC1,\r\n MIPS_INS_CFCMSA,\r\n MIPS_INS_CINS,\r\n MIPS_INS_CINS32,\r\n MIPS_INS_CLASS,\r\n MIPS_INS_CLEI_S,\r\n MIPS_INS_CLEI_U,\r\n MIPS_INS_CLE_S,\r\n MIPS_INS_CLE_U,\r\n MIPS_INS_CLO,\r\n MIPS_INS_CLTI_S,\r\n MIPS_INS_CLTI_U,\r\n MIPS_INS_CLT_S,\r\n MIPS_INS_CLT_U,\r\n MIPS_INS_CLZ,\r\n MIPS_INS_CMPGDU,\r\n MIPS_INS_CMPGU,\r\n MIPS_INS_CMPU,\r\n MIPS_INS_CMP,\r\n MIPS_INS_COPY_S,\r\n MIPS_INS_COPY_U,\r\n MIPS_INS_CTC1,\r\n MIPS_INS_CTCMSA,\r\n MIPS_INS_CVT,\r\n MIPS_INS_C,\r\n MIPS_INS_CMPI,\r\n MIPS_INS_DADD,\r\n MIPS_INS_DADDI,\r\n MIPS_INS_DADDIU,\r\n MIPS_INS_DADDU,\r\n MIPS_INS_DAHI,\r\n MIPS_INS_DALIGN,\r\n MIPS_INS_DATI,\r\n MIPS_INS_DAUI,\r\n MIPS_INS_DBITSWAP,\r\n MIPS_INS_DCLO,\r\n MIPS_INS_DCLZ,\r\n MIPS_INS_DDIV,\r\n MIPS_INS_DDIVU,\r\n MIPS_INS_DERET,\r\n MIPS_INS_DEXT,\r\n MIPS_INS_DEXTM,\r\n MIPS_INS_DEXTU,\r\n MIPS_INS_DI,\r\n MIPS_INS_DINS,\r\n MIPS_INS_DINSM,\r\n MIPS_INS_DINSU,\r\n MIPS_INS_DIV,\r\n MIPS_INS_DIVU,\r\n MIPS_INS_DIV_S,\r\n MIPS_INS_DIV_U,\r\n MIPS_INS_DLSA,\r\n MIPS_INS_DMFC0,\r\n MIPS_INS_DMFC1,\r\n MIPS_INS_DMFC2,\r\n MIPS_INS_DMOD,\r\n MIPS_INS_DMODU,\r\n MIPS_INS_DMTC0,\r\n MIPS_INS_DMTC1,\r\n MIPS_INS_DMTC2,\r\n MIPS_INS_DMUH,\r\n MIPS_INS_DMUHU,\r\n MIPS_INS_DMUL,\r\n MIPS_INS_DMULT,\r\n MIPS_INS_DMULTU,\r\n MIPS_INS_DMULU,\r\n MIPS_INS_DOTP_S,\r\n MIPS_INS_DOTP_U,\r\n MIPS_INS_DPADD_S,\r\n MIPS_INS_DPADD_U,\r\n MIPS_INS_DPAQX_SA,\r\n MIPS_INS_DPAQX_S,\r\n MIPS_INS_DPAQ_SA,\r\n MIPS_INS_DPAQ_S,\r\n MIPS_INS_DPAU,\r\n MIPS_INS_DPAX,\r\n MIPS_INS_DPA,\r\n MIPS_INS_DPOP,\r\n MIPS_INS_DPSQX_SA,\r\n MIPS_INS_DPSQX_S,\r\n MIPS_INS_DPSQ_SA,\r\n MIPS_INS_DPSQ_S,\r\n MIPS_INS_DPSUB_S,\r\n MIPS_INS_DPSUB_U,\r\n MIPS_INS_DPSU,\r\n MIPS_INS_DPSX,\r\n MIPS_INS_DPS,\r\n MIPS_INS_DROTR,\r\n MIPS_INS_DROTR32,\r\n MIPS_INS_DROTRV,\r\n MIPS_INS_DSBH,\r\n MIPS_INS_DSHD,\r\n MIPS_INS_DSLL,\r\n MIPS_INS_DSLL32,\r\n MIPS_INS_DSLLV,\r\n MIPS_INS_DSRA,\r\n MIPS_INS_DSRA32,\r\n MIPS_INS_DSRAV,\r\n MIPS_INS_DSRL,\r\n MIPS_INS_DSRL32,\r\n MIPS_INS_DSRLV,\r\n MIPS_INS_DSUB,\r\n MIPS_INS_DSUBU,\r\n MIPS_INS_EHB,\r\n MIPS_INS_EI,\r\n MIPS_INS_ERET,\r\n MIPS_INS_EXT,\r\n MIPS_INS_EXTP,\r\n MIPS_INS_EXTPDP,\r\n MIPS_INS_EXTPDPV,\r\n MIPS_INS_EXTPV,\r\n MIPS_INS_EXTRV_RS,\r\n MIPS_INS_EXTRV_R,\r\n MIPS_INS_EXTRV_S,\r\n MIPS_INS_EXTRV,\r\n MIPS_INS_EXTR_RS,\r\n MIPS_INS_EXTR_R,\r\n MIPS_INS_EXTR_S,\r\n MIPS_INS_EXTR,\r\n MIPS_INS_EXTS,\r\n MIPS_INS_EXTS32,\r\n MIPS_INS_ABS,\r\n MIPS_INS_FADD,\r\n MIPS_INS_FCAF,\r\n MIPS_INS_FCEQ,\r\n MIPS_INS_FCLASS,\r\n MIPS_INS_FCLE,\r\n MIPS_INS_FCLT,\r\n MIPS_INS_FCNE,\r\n MIPS_INS_FCOR,\r\n MIPS_INS_FCUEQ,\r\n MIPS_INS_FCULE,\r\n MIPS_INS_FCULT,\r\n MIPS_INS_FCUNE,\r\n MIPS_INS_FCUN,\r\n MIPS_INS_FDIV,\r\n MIPS_INS_FEXDO,\r\n MIPS_INS_FEXP2,\r\n MIPS_INS_FEXUPL,\r\n MIPS_INS_FEXUPR,\r\n MIPS_INS_FFINT_S,\r\n MIPS_INS_FFINT_U,\r\n MIPS_INS_FFQL,\r\n MIPS_INS_FFQR,\r\n MIPS_INS_FILL,\r\n MIPS_INS_FLOG2,\r\n MIPS_INS_FLOOR,\r\n MIPS_INS_FMADD,\r\n MIPS_INS_FMAX_A,\r\n MIPS_INS_FMAX,\r\n MIPS_INS_FMIN_A,\r\n MIPS_INS_FMIN,\r\n MIPS_INS_MOV,\r\n MIPS_INS_FMSUB,\r\n MIPS_INS_FMUL,\r\n MIPS_INS_MUL,\r\n MIPS_INS_NEG,\r\n MIPS_INS_FRCP,\r\n MIPS_INS_FRINT,\r\n MIPS_INS_FRSQRT,\r\n MIPS_INS_FSAF,\r\n MIPS_INS_FSEQ,\r\n MIPS_INS_FSLE,\r\n MIPS_INS_FSLT,\r\n MIPS_INS_FSNE,\r\n MIPS_INS_FSOR,\r\n MIPS_INS_FSQRT,\r\n MIPS_INS_SQRT,\r\n MIPS_INS_FSUB,\r\n MIPS_INS_SUB,\r\n MIPS_INS_FSUEQ,\r\n MIPS_INS_FSULE,\r\n MIPS_INS_FSULT,\r\n MIPS_INS_FSUNE,\r\n MIPS_INS_FSUN,\r\n MIPS_INS_FTINT_S,\r\n MIPS_INS_FTINT_U,\r\n MIPS_INS_FTQ,\r\n MIPS_INS_FTRUNC_S,\r\n MIPS_INS_FTRUNC_U,\r\n MIPS_INS_HADD_S,\r\n MIPS_INS_HADD_U,\r\n MIPS_INS_HSUB_S,\r\n MIPS_INS_HSUB_U,\r\n MIPS_INS_ILVEV,\r\n MIPS_INS_ILVL,\r\n MIPS_INS_ILVOD,\r\n MIPS_INS_ILVR,\r\n MIPS_INS_INS,\r\n MIPS_INS_INSERT,\r\n MIPS_INS_INSV,\r\n MIPS_INS_INSVE,\r\n MIPS_INS_J,\r\n MIPS_INS_JAL,\r\n MIPS_INS_JALR,\r\n MIPS_INS_JALRS16,\r\n MIPS_INS_JALRS,\r\n MIPS_INS_JALS,\r\n MIPS_INS_JALX,\r\n MIPS_INS_JIALC,\r\n MIPS_INS_JIC,\r\n MIPS_INS_JR,\r\n MIPS_INS_JR16,\r\n MIPS_INS_JRADDIUSP,\r\n MIPS_INS_JRC,\r\n MIPS_INS_JALRC,\r\n MIPS_INS_LB,\r\n MIPS_INS_LBU16,\r\n MIPS_INS_LBUX,\r\n MIPS_INS_LBU,\r\n MIPS_INS_LD,\r\n MIPS_INS_LDC1,\r\n MIPS_INS_LDC2,\r\n MIPS_INS_LDC3,\r\n MIPS_INS_LDI,\r\n MIPS_INS_LDL,\r\n MIPS_INS_LDPC,\r\n MIPS_INS_LDR,\r\n MIPS_INS_LDXC1,\r\n MIPS_INS_LH,\r\n MIPS_INS_LHU16,\r\n MIPS_INS_LHX,\r\n MIPS_INS_LHU,\r\n MIPS_INS_LI16,\r\n MIPS_INS_LL,\r\n MIPS_INS_LLD,\r\n MIPS_INS_LSA,\r\n MIPS_INS_LUXC1,\r\n MIPS_INS_LUI,\r\n MIPS_INS_LW,\r\n MIPS_INS_LW16,\r\n MIPS_INS_LWC1,\r\n MIPS_INS_LWC2,\r\n MIPS_INS_LWC3,\r\n MIPS_INS_LWL,\r\n MIPS_INS_LWM16,\r\n MIPS_INS_LWM32,\r\n MIPS_INS_LWPC,\r\n MIPS_INS_LWP,\r\n MIPS_INS_LWR,\r\n MIPS_INS_LWUPC,\r\n MIPS_INS_LWU,\r\n MIPS_INS_LWX,\r\n MIPS_INS_LWXC1,\r\n MIPS_INS_LWXS,\r\n MIPS_INS_LI,\r\n MIPS_INS_MADD,\r\n MIPS_INS_MADDF,\r\n MIPS_INS_MADDR_Q,\r\n MIPS_INS_MADDU,\r\n MIPS_INS_MADDV,\r\n MIPS_INS_MADD_Q,\r\n MIPS_INS_MAQ_SA,\r\n MIPS_INS_MAQ_S,\r\n MIPS_INS_MAXA,\r\n MIPS_INS_MAXI_S,\r\n MIPS_INS_MAXI_U,\r\n MIPS_INS_MAX_A,\r\n MIPS_INS_MAX,\r\n MIPS_INS_MAX_S,\r\n MIPS_INS_MAX_U,\r\n MIPS_INS_MFC0,\r\n MIPS_INS_MFC1,\r\n MIPS_INS_MFC2,\r\n MIPS_INS_MFHC1,\r\n MIPS_INS_MFHI,\r\n MIPS_INS_MFLO,\r\n MIPS_INS_MINA,\r\n MIPS_INS_MINI_S,\r\n MIPS_INS_MINI_U,\r\n MIPS_INS_MIN_A,\r\n MIPS_INS_MIN,\r\n MIPS_INS_MIN_S,\r\n MIPS_INS_MIN_U,\r\n MIPS_INS_MOD,\r\n MIPS_INS_MODSUB,\r\n MIPS_INS_MODU,\r\n MIPS_INS_MOD_S,\r\n MIPS_INS_MOD_U,\r\n MIPS_INS_MOVE,\r\n MIPS_INS_MOVEP,\r\n MIPS_INS_MOVF,\r\n MIPS_INS_MOVN,\r\n MIPS_INS_MOVT,\r\n MIPS_INS_MOVZ,\r\n MIPS_INS_MSUB,\r\n MIPS_INS_MSUBF,\r\n MIPS_INS_MSUBR_Q,\r\n MIPS_INS_MSUBU,\r\n MIPS_INS_MSUBV,\r\n MIPS_INS_MSUB_Q,\r\n MIPS_INS_MTC0,\r\n MIPS_INS_MTC1,\r\n MIPS_INS_MTC2,\r\n MIPS_INS_MTHC1,\r\n MIPS_INS_MTHI,\r\n MIPS_INS_MTHLIP,\r\n MIPS_INS_MTLO,\r\n MIPS_INS_MTM0,\r\n MIPS_INS_MTM1,\r\n MIPS_INS_MTM2,\r\n MIPS_INS_MTP0,\r\n MIPS_INS_MTP1,\r\n MIPS_INS_MTP2,\r\n MIPS_INS_MUH,\r\n MIPS_INS_MUHU,\r\n MIPS_INS_MULEQ_S,\r\n MIPS_INS_MULEU_S,\r\n MIPS_INS_MULQ_RS,\r\n MIPS_INS_MULQ_S,\r\n MIPS_INS_MULR_Q,\r\n MIPS_INS_MULSAQ_S,\r\n MIPS_INS_MULSA,\r\n MIPS_INS_MULT,\r\n MIPS_INS_MULTU,\r\n MIPS_INS_MULU,\r\n MIPS_INS_MULV,\r\n MIPS_INS_MUL_Q,\r\n MIPS_INS_MUL_S,\r\n MIPS_INS_NLOC,\r\n MIPS_INS_NLZC,\r\n MIPS_INS_NMADD,\r\n MIPS_INS_NMSUB,\r\n MIPS_INS_NOR,\r\n MIPS_INS_NORI,\r\n MIPS_INS_NOT16,\r\n MIPS_INS_NOT,\r\n MIPS_INS_OR,\r\n MIPS_INS_OR16,\r\n MIPS_INS_ORI,\r\n MIPS_INS_PACKRL,\r\n MIPS_INS_PAUSE,\r\n MIPS_INS_PCKEV,\r\n MIPS_INS_PCKOD,\r\n MIPS_INS_PCNT,\r\n MIPS_INS_PICK,\r\n MIPS_INS_POP,\r\n MIPS_INS_PRECEQU,\r\n MIPS_INS_PRECEQ,\r\n MIPS_INS_PRECEU,\r\n MIPS_INS_PRECRQU_S,\r\n MIPS_INS_PRECRQ,\r\n MIPS_INS_PRECRQ_RS,\r\n MIPS_INS_PRECR,\r\n MIPS_INS_PRECR_SRA,\r\n MIPS_INS_PRECR_SRA_R,\r\n MIPS_INS_PREF,\r\n MIPS_INS_PREPEND,\r\n MIPS_INS_RADDU,\r\n MIPS_INS_RDDSP,\r\n MIPS_INS_RDHWR,\r\n MIPS_INS_REPLV,\r\n MIPS_INS_REPL,\r\n MIPS_INS_RINT,\r\n MIPS_INS_ROTR,\r\n MIPS_INS_ROTRV,\r\n MIPS_INS_ROUND,\r\n MIPS_INS_SAT_S,\r\n MIPS_INS_SAT_U,\r\n MIPS_INS_SB,\r\n MIPS_INS_SB16,\r\n MIPS_INS_SC,\r\n MIPS_INS_SCD,\r\n MIPS_INS_SD,\r\n MIPS_INS_SDBBP,\r\n MIPS_INS_SDBBP16,\r\n MIPS_INS_SDC1,\r\n MIPS_INS_SDC2,\r\n MIPS_INS_SDC3,\r\n MIPS_INS_SDL,\r\n MIPS_INS_SDR,\r\n MIPS_INS_SDXC1,\r\n MIPS_INS_SEB,\r\n MIPS_INS_SEH,\r\n MIPS_INS_SELEQZ,\r\n MIPS_INS_SELNEZ,\r\n MIPS_INS_SEL,\r\n MIPS_INS_SEQ,\r\n MIPS_INS_SEQI,\r\n MIPS_INS_SH,\r\n MIPS_INS_SH16,\r\n MIPS_INS_SHF,\r\n MIPS_INS_SHILO,\r\n MIPS_INS_SHILOV,\r\n MIPS_INS_SHLLV,\r\n MIPS_INS_SHLLV_S,\r\n MIPS_INS_SHLL,\r\n MIPS_INS_SHLL_S,\r\n MIPS_INS_SHRAV,\r\n MIPS_INS_SHRAV_R,\r\n MIPS_INS_SHRA,\r\n MIPS_INS_SHRA_R,\r\n MIPS_INS_SHRLV,\r\n MIPS_INS_SHRL,\r\n MIPS_INS_SLDI,\r\n MIPS_INS_SLD,\r\n MIPS_INS_SLL,\r\n MIPS_INS_SLL16,\r\n MIPS_INS_SLLI,\r\n MIPS_INS_SLLV,\r\n MIPS_INS_SLT,\r\n MIPS_INS_SLTI,\r\n MIPS_INS_SLTIU,\r\n MIPS_INS_SLTU,\r\n MIPS_INS_SNE,\r\n MIPS_INS_SNEI,\r\n MIPS_INS_SPLATI,\r\n MIPS_INS_SPLAT,\r\n MIPS_INS_SRA,\r\n MIPS_INS_SRAI,\r\n MIPS_INS_SRARI,\r\n MIPS_INS_SRAR,\r\n MIPS_INS_SRAV,\r\n MIPS_INS_SRL,\r\n MIPS_INS_SRL16,\r\n MIPS_INS_SRLI,\r\n MIPS_INS_SRLRI,\r\n MIPS_INS_SRLR,\r\n MIPS_INS_SRLV,\r\n MIPS_INS_SSNOP,\r\n MIPS_INS_ST,\r\n MIPS_INS_SUBQH,\r\n MIPS_INS_SUBQH_R,\r\n MIPS_INS_SUBQ,\r\n MIPS_INS_SUBQ_S,\r\n MIPS_INS_SUBSUS_U,\r\n MIPS_INS_SUBSUU_S,\r\n MIPS_INS_SUBS_S,\r\n MIPS_INS_SUBS_U,\r\n MIPS_INS_SUBU16,\r\n MIPS_INS_SUBUH,\r\n MIPS_INS_SUBUH_R,\r\n MIPS_INS_SUBU,\r\n MIPS_INS_SUBU_S,\r\n MIPS_INS_SUBVI,\r\n MIPS_INS_SUBV,\r\n MIPS_INS_SUXC1,\r\n MIPS_INS_SW,\r\n MIPS_INS_SW16,\r\n MIPS_INS_SWC1,\r\n MIPS_INS_SWC2,\r\n MIPS_INS_SWC3,\r\n MIPS_INS_SWL,\r\n MIPS_INS_SWM16,\r\n MIPS_INS_SWM32,\r\n MIPS_INS_SWP,\r\n MIPS_INS_SWR,\r\n MIPS_INS_SWXC1,\r\n MIPS_INS_SYNC,\r\n MIPS_INS_SYNCI,\r\n MIPS_INS_SYSCALL,\r\n MIPS_INS_TEQ,\r\n MIPS_INS_TEQI,\r\n MIPS_INS_TGE,\r\n MIPS_INS_TGEI,\r\n MIPS_INS_TGEIU,\r\n MIPS_INS_TGEU,\r\n MIPS_INS_TLBP,\r\n MIPS_INS_TLBR,\r\n MIPS_INS_TLBWI,\r\n MIPS_INS_TLBWR,\r\n MIPS_INS_TLT,\r\n MIPS_INS_TLTI,\r\n MIPS_INS_TLTIU,\r\n MIPS_INS_TLTU,\r\n MIPS_INS_TNE,\r\n MIPS_INS_TNEI,\r\n MIPS_INS_TRUNC,\r\n MIPS_INS_V3MULU,\r\n MIPS_INS_VMM0,\r\n MIPS_INS_VMULU,\r\n MIPS_INS_VSHF,\r\n MIPS_INS_WAIT,\r\n MIPS_INS_WRDSP,\r\n MIPS_INS_WSBH,\r\n MIPS_INS_XOR,\r\n MIPS_INS_XOR16,\r\n MIPS_INS_XORI,\r\n\r\n //> some alias instructions\r\n MIPS_INS_NOP,\r\n MIPS_INS_NEGU,\r\n\r\n //> special instructions\r\n MIPS_INS_JALR_HB, // jump and link with Hazard Barrier\r\n MIPS_INS_JR_HB, // jump register with Hazard Barrier\r\n\r\n MIPS_INS_ENDING,\r\n} mips_insn;\r\n\r\n//> Group of MIPS instructions\r\ntypedef enum mips_insn_group\r\n{\r\n MIPS_GRP_INVALID = 0, // = CS_GRP_INVALID\r\n\r\n //> Generic groups\r\n // all jump instructions (conditional+direct+indirect jumps)\r\n MIPS_GRP_JUMP, // = CS_GRP_JUMP\r\n // all call instructions\r\n MIPS_GRP_CALL, // = CS_GRP_CALL\r\n // all return instructions\r\n MIPS_GRP_RET, // = CS_GRP_RET\r\n // all interrupt instructions (int+syscall)\r\n MIPS_GRP_INT, // = CS_GRP_INT\r\n // all interrupt return instructions\r\n MIPS_GRP_IRET, // = CS_GRP_IRET\r\n // all privileged instructions\r\n MIPS_GRP_PRIVILEGE, // = CS_GRP_PRIVILEGE\r\n\r\n //> Architecture-specific groups\r\n MIPS_GRP_BITCOUNT = 128,\r\n MIPS_GRP_DSP,\r\n MIPS_GRP_DSPR2,\r\n MIPS_GRP_FPIDX,\r\n MIPS_GRP_MSA,\r\n MIPS_GRP_MIPS32R2,\r\n MIPS_GRP_MIPS64,\r\n MIPS_GRP_MIPS64R2,\r\n MIPS_GRP_SEINREG,\r\n MIPS_GRP_STDENC,\r\n MIPS_GRP_SWAP,\r\n MIPS_GRP_MICROMIPS,\r\n MIPS_GRP_MIPS16MODE,\r\n MIPS_GRP_FP64BIT,\r\n MIPS_GRP_NONANSFPMATH,\r\n MIPS_GRP_NOTFP64BIT,\r\n MIPS_GRP_NOTINMICROMIPS,\r\n MIPS_GRP_NOTNACL,\r\n MIPS_GRP_NOTMIPS32R6,\r\n MIPS_GRP_NOTMIPS64R6,\r\n MIPS_GRP_CNMIPS,\r\n MIPS_GRP_MIPS32,\r\n MIPS_GRP_MIPS32R6,\r\n MIPS_GRP_MIPS64R6,\r\n MIPS_GRP_MIPS2,\r\n MIPS_GRP_MIPS3,\r\n MIPS_GRP_MIPS3_32,\r\n MIPS_GRP_MIPS3_32R2,\r\n MIPS_GRP_MIPS4_32,\r\n MIPS_GRP_MIPS4_32R2,\r\n MIPS_GRP_MIPS5_32R2,\r\n MIPS_GRP_GP32BIT,\r\n MIPS_GRP_GP64BIT,\r\n\r\n MIPS_GRP_ENDING,\r\n} mips_insn_group;\r\n\r\n#ifdef __cplusplus\r\n}\r\n#endif\r\n\r\n#endif\r\n" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/capstone/platform.h", "content": "/* Capstone Disassembly Engine */\r\n/* By Axel Souchet & Nguyen Anh Quynh, 2014 */\r\n\r\n#ifndef CAPSTONE_PLATFORM_H\r\n#define CAPSTONE_PLATFORM_H\r\n\r\n\r\n// handle C99 issue (for pre-2013 VisualStudio)\r\n#if !defined(__CYGWIN__) && !defined(__MINGW32__) && !defined(__MINGW64__) && (defined (WIN32) || defined (WIN64) || defined (_WIN32) || defined (_WIN64))\r\n// MSVC\r\n\r\n// stdbool.h\r\n#if (_MSC_VER < 1800) || defined(_KERNEL_MODE)\r\n// this system does not have stdbool.h\r\n#ifndef __cplusplus\r\ntypedef unsigned char bool;\r\n#define false 0\r\n#define true 1\r\n#endif // __cplusplus\r\n\r\n#else\r\n// VisualStudio 2013+ -> C99 is supported\r\n#include \r\n#endif // (_MSC_VER < 1800) || defined(_KERNEL_MODE)\r\n\r\n#else\r\n// not MSVC -> C99 is supported\r\n#include \r\n#endif // !defined(__CYGWIN__) && !defined(__MINGW32__) && !defined(__MINGW64__) && (defined (WIN32) || defined (WIN64) || defined (_WIN32) || defined (_WIN64))\r\n\r\n\r\n// handle inttypes.h / stdint.h compatibility\r\n#if defined(_WIN32_WCE) && (_WIN32_WCE < 0x800)\r\n#include \"windowsce/stdint.h\"\r\n#endif // defined(_WIN32_WCE) && (_WIN32_WCE < 0x800)\r\n\r\n#if defined(CAPSTONE_HAS_OSXKERNEL) || (defined(_MSC_VER) && (_MSC_VER <= 1700 || defined(_KERNEL_MODE)))\r\n// this system does not have inttypes.h\r\n\r\n#if defined(_MSC_VER) && (_MSC_VER < 1600 || defined(_KERNEL_MODE))\r\n// this system does not have stdint.h\r\ntypedef signed char int8_t;\r\ntypedef signed short int16_t;\r\ntypedef signed int int32_t;\r\ntypedef unsigned char uint8_t;\r\ntypedef unsigned short uint16_t;\r\ntypedef unsigned int uint32_t;\r\ntypedef signed long long int64_t;\r\ntypedef unsigned long long uint64_t;\r\n\r\n#define INT8_MIN (-127i8 - 1)\r\n#define INT16_MIN (-32767i16 - 1)\r\n#define INT32_MIN (-2147483647i32 - 1)\r\n#define INT64_MIN (-9223372036854775807i64 - 1)\r\n#define INT8_MAX 127i8\r\n#define INT16_MAX 32767i16\r\n#define INT32_MAX 2147483647i32\r\n#define INT64_MAX 9223372036854775807i64\r\n#define UINT8_MAX 0xffui8\r\n#define UINT16_MAX 0xffffui16\r\n#define UINT32_MAX 0xffffffffui32\r\n#define UINT64_MAX 0xffffffffffffffffui64\r\n#endif // defined(_MSC_VER) && (_MSC_VER <= 1700 || defined(_KERNEL_MODE))\r\n\r\n#define __PRI_8_LENGTH_MODIFIER__ \"hh\"\r\n#define __PRI_64_LENGTH_MODIFIER__ \"ll\"\r\n\r\n#define PRId8 __PRI_8_LENGTH_MODIFIER__ \"d\"\r\n#define PRIi8 __PRI_8_LENGTH_MODIFIER__ \"i\"\r\n#define PRIo8 __PRI_8_LENGTH_MODIFIER__ \"o\"\r\n#define PRIu8 __PRI_8_LENGTH_MODIFIER__ \"u\"\r\n#define PRIx8 __PRI_8_LENGTH_MODIFIER__ \"x\"\r\n#define PRIX8 __PRI_8_LENGTH_MODIFIER__ \"X\"\r\n\r\n#define PRId16 \"hd\"\r\n#define PRIi16 \"hi\"\r\n#define PRIo16 \"ho\"\r\n#define PRIu16 \"hu\"\r\n#define PRIx16 \"hx\"\r\n#define PRIX16 \"hX\"\r\n\r\n#if defined(_MSC_VER) && _MSC_VER <= 1700\r\n#define PRId32 \"ld\"\r\n#define PRIi32 \"li\"\r\n#define PRIo32 \"lo\"\r\n#define PRIu32 \"lu\"\r\n#define PRIx32 \"lx\"\r\n#define PRIX32 \"lX\"\r\n#else // OSX\r\n#define PRId32 \"d\"\r\n#define PRIi32 \"i\"\r\n#define PRIo32 \"o\"\r\n#define PRIu32 \"u\"\r\n#define PRIx32 \"x\"\r\n#define PRIX32 \"X\"\r\n#endif // defined(_MSC_VER) && _MSC_VER <= 1700\r\n\r\n#if defined(_MSC_VER) && _MSC_VER <= 1700\r\n// redefine functions from inttypes.h used in cstool\r\n#define strtoull _strtoui64\r\n#endif\r\n\r\n#define PRId64 __PRI_64_LENGTH_MODIFIER__ \"d\"\r\n#define PRIi64 __PRI_64_LENGTH_MODIFIER__ \"i\"\r\n#define PRIo64 __PRI_64_LENGTH_MODIFIER__ \"o\"\r\n#define PRIu64 __PRI_64_LENGTH_MODIFIER__ \"u\"\r\n#define PRIx64 __PRI_64_LENGTH_MODIFIER__ \"x\"\r\n#define PRIX64 __PRI_64_LENGTH_MODIFIER__ \"X\"\r\n\r\n#else\r\n// this system has inttypes.h by default\r\n#include \r\n#endif // defined(CAPSTONE_HAS_OSXKERNEL) || (defined(_MSC_VER) && (_MSC_VER <= 1700 || defined(_KERNEL_MODE)))\r\n\r\n#endif\r\n" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/capstone/ppc.h", "content": "#ifndef CAPSTONE_PPC_H\r\n#define CAPSTONE_PPC_H\r\n\r\n/* Capstone Disassembly Engine */\r\n/* By Nguyen Anh Quynh , 2013-2015 */\r\n\r\n#ifdef __cplusplus\r\nextern \"C\" {\r\n#endif\r\n\r\n#include \"platform.h\"\r\n\r\n#ifdef _MSC_VER\r\n#pragma warning(disable:4201)\r\n#endif\r\n\r\n//> PPC branch codes for some branch instructions\r\ntypedef enum ppc_bc\r\n{\r\n PPC_BC_INVALID = 0,\r\n PPC_BC_LT = (0 << 5) | 12,\r\n PPC_BC_LE = (1 << 5) | 4,\r\n PPC_BC_EQ = (2 << 5) | 12,\r\n PPC_BC_GE = (0 << 5) | 4,\r\n PPC_BC_GT = (1 << 5) | 12,\r\n PPC_BC_NE = (2 << 5) | 4,\r\n PPC_BC_UN = (3 << 5) | 12,\r\n PPC_BC_NU = (3 << 5) | 4,\r\n\r\n // extra conditions\r\n PPC_BC_SO = (4 << 5) | 12, // summary overflow\r\n PPC_BC_NS = (4 << 5) | 4, // not summary overflow\r\n} ppc_bc;\r\n\r\n//> PPC branch hint for some branch instructions\r\ntypedef enum ppc_bh\r\n{\r\n PPC_BH_INVALID = 0, // no hint\r\n PPC_BH_PLUS, // PLUS hint\r\n PPC_BH_MINUS, // MINUS hint\r\n} ppc_bh;\r\n\r\n//> Operand type for instruction's operands\r\ntypedef enum ppc_op_type\r\n{\r\n PPC_OP_INVALID = 0, // = CS_OP_INVALID (Uninitialized).\r\n PPC_OP_REG, // = CS_OP_REG (Register operand).\r\n PPC_OP_IMM, // = CS_OP_IMM (Immediate operand).\r\n PPC_OP_MEM, // = CS_OP_MEM (Memory operand).\r\n PPC_OP_CRX = 64, // Condition Register field\r\n} ppc_op_type;\r\n\r\n//> PPC registers\r\ntypedef enum ppc_reg\r\n{\r\n PPC_REG_INVALID = 0,\r\n\r\n PPC_REG_CARRY,\r\n PPC_REG_CR0,\r\n PPC_REG_CR1,\r\n PPC_REG_CR2,\r\n PPC_REG_CR3,\r\n PPC_REG_CR4,\r\n PPC_REG_CR5,\r\n PPC_REG_CR6,\r\n PPC_REG_CR7,\r\n PPC_REG_CTR,\r\n PPC_REG_F0,\r\n PPC_REG_F1,\r\n PPC_REG_F2,\r\n PPC_REG_F3,\r\n PPC_REG_F4,\r\n PPC_REG_F5,\r\n PPC_REG_F6,\r\n PPC_REG_F7,\r\n PPC_REG_F8,\r\n PPC_REG_F9,\r\n PPC_REG_F10,\r\n PPC_REG_F11,\r\n PPC_REG_F12,\r\n PPC_REG_F13,\r\n PPC_REG_F14,\r\n PPC_REG_F15,\r\n PPC_REG_F16,\r\n PPC_REG_F17,\r\n PPC_REG_F18,\r\n PPC_REG_F19,\r\n PPC_REG_F20,\r\n PPC_REG_F21,\r\n PPC_REG_F22,\r\n PPC_REG_F23,\r\n PPC_REG_F24,\r\n PPC_REG_F25,\r\n PPC_REG_F26,\r\n PPC_REG_F27,\r\n PPC_REG_F28,\r\n PPC_REG_F29,\r\n PPC_REG_F30,\r\n PPC_REG_F31,\r\n PPC_REG_LR,\r\n PPC_REG_R0,\r\n PPC_REG_R1,\r\n PPC_REG_R2,\r\n PPC_REG_R3,\r\n PPC_REG_R4,\r\n PPC_REG_R5,\r\n PPC_REG_R6,\r\n PPC_REG_R7,\r\n PPC_REG_R8,\r\n PPC_REG_R9,\r\n PPC_REG_R10,\r\n PPC_REG_R11,\r\n PPC_REG_R12,\r\n PPC_REG_R13,\r\n PPC_REG_R14,\r\n PPC_REG_R15,\r\n PPC_REG_R16,\r\n PPC_REG_R17,\r\n PPC_REG_R18,\r\n PPC_REG_R19,\r\n PPC_REG_R20,\r\n PPC_REG_R21,\r\n PPC_REG_R22,\r\n PPC_REG_R23,\r\n PPC_REG_R24,\r\n PPC_REG_R25,\r\n PPC_REG_R26,\r\n PPC_REG_R27,\r\n PPC_REG_R28,\r\n PPC_REG_R29,\r\n PPC_REG_R30,\r\n PPC_REG_R31,\r\n PPC_REG_V0,\r\n PPC_REG_V1,\r\n PPC_REG_V2,\r\n PPC_REG_V3,\r\n PPC_REG_V4,\r\n PPC_REG_V5,\r\n PPC_REG_V6,\r\n PPC_REG_V7,\r\n PPC_REG_V8,\r\n PPC_REG_V9,\r\n PPC_REG_V10,\r\n PPC_REG_V11,\r\n PPC_REG_V12,\r\n PPC_REG_V13,\r\n PPC_REG_V14,\r\n PPC_REG_V15,\r\n PPC_REG_V16,\r\n PPC_REG_V17,\r\n PPC_REG_V18,\r\n PPC_REG_V19,\r\n PPC_REG_V20,\r\n PPC_REG_V21,\r\n PPC_REG_V22,\r\n PPC_REG_V23,\r\n PPC_REG_V24,\r\n PPC_REG_V25,\r\n PPC_REG_V26,\r\n PPC_REG_V27,\r\n PPC_REG_V28,\r\n PPC_REG_V29,\r\n PPC_REG_V30,\r\n PPC_REG_V31,\r\n PPC_REG_VRSAVE,\r\n PPC_REG_VS0,\r\n PPC_REG_VS1,\r\n PPC_REG_VS2,\r\n PPC_REG_VS3,\r\n PPC_REG_VS4,\r\n PPC_REG_VS5,\r\n PPC_REG_VS6,\r\n PPC_REG_VS7,\r\n PPC_REG_VS8,\r\n PPC_REG_VS9,\r\n PPC_REG_VS10,\r\n PPC_REG_VS11,\r\n PPC_REG_VS12,\r\n PPC_REG_VS13,\r\n PPC_REG_VS14,\r\n PPC_REG_VS15,\r\n PPC_REG_VS16,\r\n PPC_REG_VS17,\r\n PPC_REG_VS18,\r\n PPC_REG_VS19,\r\n PPC_REG_VS20,\r\n PPC_REG_VS21,\r\n PPC_REG_VS22,\r\n PPC_REG_VS23,\r\n PPC_REG_VS24,\r\n PPC_REG_VS25,\r\n PPC_REG_VS26,\r\n PPC_REG_VS27,\r\n PPC_REG_VS28,\r\n PPC_REG_VS29,\r\n PPC_REG_VS30,\r\n PPC_REG_VS31,\r\n PPC_REG_VS32,\r\n PPC_REG_VS33,\r\n PPC_REG_VS34,\r\n PPC_REG_VS35,\r\n PPC_REG_VS36,\r\n PPC_REG_VS37,\r\n PPC_REG_VS38,\r\n PPC_REG_VS39,\r\n PPC_REG_VS40,\r\n PPC_REG_VS41,\r\n PPC_REG_VS42,\r\n PPC_REG_VS43,\r\n PPC_REG_VS44,\r\n PPC_REG_VS45,\r\n PPC_REG_VS46,\r\n PPC_REG_VS47,\r\n PPC_REG_VS48,\r\n PPC_REG_VS49,\r\n PPC_REG_VS50,\r\n PPC_REG_VS51,\r\n PPC_REG_VS52,\r\n PPC_REG_VS53,\r\n PPC_REG_VS54,\r\n PPC_REG_VS55,\r\n PPC_REG_VS56,\r\n PPC_REG_VS57,\r\n PPC_REG_VS58,\r\n PPC_REG_VS59,\r\n PPC_REG_VS60,\r\n PPC_REG_VS61,\r\n PPC_REG_VS62,\r\n PPC_REG_VS63,\r\n PPC_REG_Q0,\r\n PPC_REG_Q1,\r\n PPC_REG_Q2,\r\n PPC_REG_Q3,\r\n PPC_REG_Q4,\r\n PPC_REG_Q5,\r\n PPC_REG_Q6,\r\n PPC_REG_Q7,\r\n PPC_REG_Q8,\r\n PPC_REG_Q9,\r\n PPC_REG_Q10,\r\n PPC_REG_Q11,\r\n PPC_REG_Q12,\r\n PPC_REG_Q13,\r\n PPC_REG_Q14,\r\n PPC_REG_Q15,\r\n PPC_REG_Q16,\r\n PPC_REG_Q17,\r\n PPC_REG_Q18,\r\n PPC_REG_Q19,\r\n PPC_REG_Q20,\r\n PPC_REG_Q21,\r\n PPC_REG_Q22,\r\n PPC_REG_Q23,\r\n PPC_REG_Q24,\r\n PPC_REG_Q25,\r\n PPC_REG_Q26,\r\n PPC_REG_Q27,\r\n PPC_REG_Q28,\r\n PPC_REG_Q29,\r\n PPC_REG_Q30,\r\n PPC_REG_Q31,\r\n\r\n // extra registers for PPCMapping.c\r\n PPC_REG_RM,\r\n PPC_REG_CTR8,\r\n PPC_REG_LR8,\r\n PPC_REG_CR1EQ,\r\n PPC_REG_X2,\r\n\r\n PPC_REG_ENDING, // <-- mark the end of the list of registers\r\n} ppc_reg;\r\n\r\n// Instruction's operand referring to memory\r\n// This is associated with PPC_OP_MEM operand type above\r\ntypedef struct ppc_op_mem\r\n{\r\n ppc_reg base; // base register\r\n int32_t disp; // displacement/offset value\r\n} ppc_op_mem;\r\n\r\ntypedef struct ppc_op_crx\r\n{\r\n unsigned int scale;\r\n ppc_reg reg;\r\n ppc_bc cond;\r\n} ppc_op_crx;\r\n\r\n// Instruction operand\r\ntypedef struct cs_ppc_op\r\n{\r\n ppc_op_type type; // operand type\r\n union\r\n {\r\n ppc_reg reg; // register value for REG operand\r\n int64_t imm; // immediate value for IMM operand\r\n ppc_op_mem mem; // base/disp value for MEM operand\r\n ppc_op_crx crx; // operand with condition register\r\n };\r\n} cs_ppc_op;\r\n\r\n// Instruction structure\r\ntypedef struct cs_ppc\r\n{\r\n // branch code for branch instructions\r\n ppc_bc bc;\r\n\r\n // branch hint for branch instructions\r\n ppc_bh bh;\r\n\r\n // if update_cr0 = True, then this 'dot' insn updates CR0\r\n bool update_cr0;\r\n\r\n // Number of operands of this instruction,\r\n // or 0 when instruction has no operand.\r\n uint8_t op_count;\r\n cs_ppc_op operands[8]; // operands for this instruction.\r\n} cs_ppc;\r\n\r\n//> PPC instruction\r\ntypedef enum ppc_insn\r\n{\r\n PPC_INS_INVALID = 0,\r\n\r\n PPC_INS_ADD,\r\n PPC_INS_ADDC,\r\n PPC_INS_ADDE,\r\n PPC_INS_ADDI,\r\n PPC_INS_ADDIC,\r\n PPC_INS_ADDIS,\r\n PPC_INS_ADDME,\r\n PPC_INS_ADDZE,\r\n PPC_INS_AND,\r\n PPC_INS_ANDC,\r\n PPC_INS_ANDIS,\r\n PPC_INS_ANDI,\r\n PPC_INS_ATTN,\r\n PPC_INS_B,\r\n PPC_INS_BA,\r\n PPC_INS_BC,\r\n PPC_INS_BCCTR,\r\n PPC_INS_BCCTRL,\r\n PPC_INS_BCL,\r\n PPC_INS_BCLR,\r\n PPC_INS_BCLRL,\r\n PPC_INS_BCTR,\r\n PPC_INS_BCTRL,\r\n PPC_INS_BCT,\r\n PPC_INS_BDNZ,\r\n PPC_INS_BDNZA,\r\n PPC_INS_BDNZL,\r\n PPC_INS_BDNZLA,\r\n PPC_INS_BDNZLR,\r\n PPC_INS_BDNZLRL,\r\n PPC_INS_BDZ,\r\n PPC_INS_BDZA,\r\n PPC_INS_BDZL,\r\n PPC_INS_BDZLA,\r\n PPC_INS_BDZLR,\r\n PPC_INS_BDZLRL,\r\n PPC_INS_BL,\r\n PPC_INS_BLA,\r\n PPC_INS_BLR,\r\n PPC_INS_BLRL,\r\n PPC_INS_BRINC,\r\n PPC_INS_CMPB,\r\n PPC_INS_CMPD,\r\n PPC_INS_CMPDI,\r\n PPC_INS_CMPLD,\r\n PPC_INS_CMPLDI,\r\n PPC_INS_CMPLW,\r\n PPC_INS_CMPLWI,\r\n PPC_INS_CMPW,\r\n PPC_INS_CMPWI,\r\n PPC_INS_CNTLZD,\r\n PPC_INS_CNTLZW,\r\n PPC_INS_CREQV,\r\n PPC_INS_CRXOR,\r\n PPC_INS_CRAND,\r\n PPC_INS_CRANDC,\r\n PPC_INS_CRNAND,\r\n PPC_INS_CRNOR,\r\n PPC_INS_CROR,\r\n PPC_INS_CRORC,\r\n PPC_INS_DCBA,\r\n PPC_INS_DCBF,\r\n PPC_INS_DCBI,\r\n PPC_INS_DCBST,\r\n PPC_INS_DCBT,\r\n PPC_INS_DCBTST,\r\n PPC_INS_DCBZ,\r\n PPC_INS_DCBZL,\r\n PPC_INS_DCCCI,\r\n PPC_INS_DIVD,\r\n PPC_INS_DIVDU,\r\n PPC_INS_DIVW,\r\n PPC_INS_DIVWU,\r\n PPC_INS_DSS,\r\n PPC_INS_DSSALL,\r\n PPC_INS_DST,\r\n PPC_INS_DSTST,\r\n PPC_INS_DSTSTT,\r\n PPC_INS_DSTT,\r\n PPC_INS_EQV,\r\n PPC_INS_EVABS,\r\n PPC_INS_EVADDIW,\r\n PPC_INS_EVADDSMIAAW,\r\n PPC_INS_EVADDSSIAAW,\r\n PPC_INS_EVADDUMIAAW,\r\n PPC_INS_EVADDUSIAAW,\r\n PPC_INS_EVADDW,\r\n PPC_INS_EVAND,\r\n PPC_INS_EVANDC,\r\n PPC_INS_EVCMPEQ,\r\n PPC_INS_EVCMPGTS,\r\n PPC_INS_EVCMPGTU,\r\n PPC_INS_EVCMPLTS,\r\n PPC_INS_EVCMPLTU,\r\n PPC_INS_EVCNTLSW,\r\n PPC_INS_EVCNTLZW,\r\n PPC_INS_EVDIVWS,\r\n PPC_INS_EVDIVWU,\r\n PPC_INS_EVEQV,\r\n PPC_INS_EVEXTSB,\r\n PPC_INS_EVEXTSH,\r\n PPC_INS_EVLDD,\r\n PPC_INS_EVLDDX,\r\n PPC_INS_EVLDH,\r\n PPC_INS_EVLDHX,\r\n PPC_INS_EVLDW,\r\n PPC_INS_EVLDWX,\r\n PPC_INS_EVLHHESPLAT,\r\n PPC_INS_EVLHHESPLATX,\r\n PPC_INS_EVLHHOSSPLAT,\r\n PPC_INS_EVLHHOSSPLATX,\r\n PPC_INS_EVLHHOUSPLAT,\r\n PPC_INS_EVLHHOUSPLATX,\r\n PPC_INS_EVLWHE,\r\n PPC_INS_EVLWHEX,\r\n PPC_INS_EVLWHOS,\r\n PPC_INS_EVLWHOSX,\r\n PPC_INS_EVLWHOU,\r\n PPC_INS_EVLWHOUX,\r\n PPC_INS_EVLWHSPLAT,\r\n PPC_INS_EVLWHSPLATX,\r\n PPC_INS_EVLWWSPLAT,\r\n PPC_INS_EVLWWSPLATX,\r\n PPC_INS_EVMERGEHI,\r\n PPC_INS_EVMERGEHILO,\r\n PPC_INS_EVMERGELO,\r\n PPC_INS_EVMERGELOHI,\r\n PPC_INS_EVMHEGSMFAA,\r\n PPC_INS_EVMHEGSMFAN,\r\n PPC_INS_EVMHEGSMIAA,\r\n PPC_INS_EVMHEGSMIAN,\r\n PPC_INS_EVMHEGUMIAA,\r\n PPC_INS_EVMHEGUMIAN,\r\n PPC_INS_EVMHESMF,\r\n PPC_INS_EVMHESMFA,\r\n PPC_INS_EVMHESMFAAW,\r\n PPC_INS_EVMHESMFANW,\r\n PPC_INS_EVMHESMI,\r\n PPC_INS_EVMHESMIA,\r\n PPC_INS_EVMHESMIAAW,\r\n PPC_INS_EVMHESMIANW,\r\n PPC_INS_EVMHESSF,\r\n PPC_INS_EVMHESSFA,\r\n PPC_INS_EVMHESSFAAW,\r\n PPC_INS_EVMHESSFANW,\r\n PPC_INS_EVMHESSIAAW,\r\n PPC_INS_EVMHESSIANW,\r\n PPC_INS_EVMHEUMI,\r\n PPC_INS_EVMHEUMIA,\r\n PPC_INS_EVMHEUMIAAW,\r\n PPC_INS_EVMHEUMIANW,\r\n PPC_INS_EVMHEUSIAAW,\r\n PPC_INS_EVMHEUSIANW,\r\n PPC_INS_EVMHOGSMFAA,\r\n PPC_INS_EVMHOGSMFAN,\r\n PPC_INS_EVMHOGSMIAA,\r\n PPC_INS_EVMHOGSMIAN,\r\n PPC_INS_EVMHOGUMIAA,\r\n PPC_INS_EVMHOGUMIAN,\r\n PPC_INS_EVMHOSMF,\r\n PPC_INS_EVMHOSMFA,\r\n PPC_INS_EVMHOSMFAAW,\r\n PPC_INS_EVMHOSMFANW,\r\n PPC_INS_EVMHOSMI,\r\n PPC_INS_EVMHOSMIA,\r\n PPC_INS_EVMHOSMIAAW,\r\n PPC_INS_EVMHOSMIANW,\r\n PPC_INS_EVMHOSSF,\r\n PPC_INS_EVMHOSSFA,\r\n PPC_INS_EVMHOSSFAAW,\r\n PPC_INS_EVMHOSSFANW,\r\n PPC_INS_EVMHOSSIAAW,\r\n PPC_INS_EVMHOSSIANW,\r\n PPC_INS_EVMHOUMI,\r\n PPC_INS_EVMHOUMIA,\r\n PPC_INS_EVMHOUMIAAW,\r\n PPC_INS_EVMHOUMIANW,\r\n PPC_INS_EVMHOUSIAAW,\r\n PPC_INS_EVMHOUSIANW,\r\n PPC_INS_EVMRA,\r\n PPC_INS_EVMWHSMF,\r\n PPC_INS_EVMWHSMFA,\r\n PPC_INS_EVMWHSMI,\r\n PPC_INS_EVMWHSMIA,\r\n PPC_INS_EVMWHSSF,\r\n PPC_INS_EVMWHSSFA,\r\n PPC_INS_EVMWHUMI,\r\n PPC_INS_EVMWHUMIA,\r\n PPC_INS_EVMWLSMIAAW,\r\n PPC_INS_EVMWLSMIANW,\r\n PPC_INS_EVMWLSSIAAW,\r\n PPC_INS_EVMWLSSIANW,\r\n PPC_INS_EVMWLUMI,\r\n PPC_INS_EVMWLUMIA,\r\n PPC_INS_EVMWLUMIAAW,\r\n PPC_INS_EVMWLUMIANW,\r\n PPC_INS_EVMWLUSIAAW,\r\n PPC_INS_EVMWLUSIANW,\r\n PPC_INS_EVMWSMF,\r\n PPC_INS_EVMWSMFA,\r\n PPC_INS_EVMWSMFAA,\r\n PPC_INS_EVMWSMFAN,\r\n PPC_INS_EVMWSMI,\r\n PPC_INS_EVMWSMIA,\r\n PPC_INS_EVMWSMIAA,\r\n PPC_INS_EVMWSMIAN,\r\n PPC_INS_EVMWSSF,\r\n PPC_INS_EVMWSSFA,\r\n PPC_INS_EVMWSSFAA,\r\n PPC_INS_EVMWSSFAN,\r\n PPC_INS_EVMWUMI,\r\n PPC_INS_EVMWUMIA,\r\n PPC_INS_EVMWUMIAA,\r\n PPC_INS_EVMWUMIAN,\r\n PPC_INS_EVNAND,\r\n PPC_INS_EVNEG,\r\n PPC_INS_EVNOR,\r\n PPC_INS_EVOR,\r\n PPC_INS_EVORC,\r\n PPC_INS_EVRLW,\r\n PPC_INS_EVRLWI,\r\n PPC_INS_EVRNDW,\r\n PPC_INS_EVSLW,\r\n PPC_INS_EVSLWI,\r\n PPC_INS_EVSPLATFI,\r\n PPC_INS_EVSPLATI,\r\n PPC_INS_EVSRWIS,\r\n PPC_INS_EVSRWIU,\r\n PPC_INS_EVSRWS,\r\n PPC_INS_EVSRWU,\r\n PPC_INS_EVSTDD,\r\n PPC_INS_EVSTDDX,\r\n PPC_INS_EVSTDH,\r\n PPC_INS_EVSTDHX,\r\n PPC_INS_EVSTDW,\r\n PPC_INS_EVSTDWX,\r\n PPC_INS_EVSTWHE,\r\n PPC_INS_EVSTWHEX,\r\n PPC_INS_EVSTWHO,\r\n PPC_INS_EVSTWHOX,\r\n PPC_INS_EVSTWWE,\r\n PPC_INS_EVSTWWEX,\r\n PPC_INS_EVSTWWO,\r\n PPC_INS_EVSTWWOX,\r\n PPC_INS_EVSUBFSMIAAW,\r\n PPC_INS_EVSUBFSSIAAW,\r\n PPC_INS_EVSUBFUMIAAW,\r\n PPC_INS_EVSUBFUSIAAW,\r\n PPC_INS_EVSUBFW,\r\n PPC_INS_EVSUBIFW,\r\n PPC_INS_EVXOR,\r\n PPC_INS_EXTSB,\r\n PPC_INS_EXTSH,\r\n PPC_INS_EXTSW,\r\n PPC_INS_EIEIO,\r\n PPC_INS_FABS,\r\n PPC_INS_FADD,\r\n PPC_INS_FADDS,\r\n PPC_INS_FCFID,\r\n PPC_INS_FCFIDS,\r\n PPC_INS_FCFIDU,\r\n PPC_INS_FCFIDUS,\r\n PPC_INS_FCMPU,\r\n PPC_INS_FCPSGN,\r\n PPC_INS_FCTID,\r\n PPC_INS_FCTIDUZ,\r\n PPC_INS_FCTIDZ,\r\n PPC_INS_FCTIW,\r\n PPC_INS_FCTIWUZ,\r\n PPC_INS_FCTIWZ,\r\n PPC_INS_FDIV,\r\n PPC_INS_FDIVS,\r\n PPC_INS_FMADD,\r\n PPC_INS_FMADDS,\r\n PPC_INS_FMR,\r\n PPC_INS_FMSUB,\r\n PPC_INS_FMSUBS,\r\n PPC_INS_FMUL,\r\n PPC_INS_FMULS,\r\n PPC_INS_FNABS,\r\n PPC_INS_FNEG,\r\n PPC_INS_FNMADD,\r\n PPC_INS_FNMADDS,\r\n PPC_INS_FNMSUB,\r\n PPC_INS_FNMSUBS,\r\n PPC_INS_FRE,\r\n PPC_INS_FRES,\r\n PPC_INS_FRIM,\r\n PPC_INS_FRIN,\r\n PPC_INS_FRIP,\r\n PPC_INS_FRIZ,\r\n PPC_INS_FRSP,\r\n PPC_INS_FRSQRTE,\r\n PPC_INS_FRSQRTES,\r\n PPC_INS_FSEL,\r\n PPC_INS_FSQRT,\r\n PPC_INS_FSQRTS,\r\n PPC_INS_FSUB,\r\n PPC_INS_FSUBS,\r\n PPC_INS_ICBI,\r\n PPC_INS_ICBT,\r\n PPC_INS_ICCCI,\r\n PPC_INS_ISEL,\r\n PPC_INS_ISYNC,\r\n PPC_INS_LA,\r\n PPC_INS_LBZ,\r\n PPC_INS_LBZCIX,\r\n PPC_INS_LBZU,\r\n PPC_INS_LBZUX,\r\n PPC_INS_LBZX,\r\n PPC_INS_LD,\r\n PPC_INS_LDARX,\r\n PPC_INS_LDBRX,\r\n PPC_INS_LDCIX,\r\n PPC_INS_LDU,\r\n PPC_INS_LDUX,\r\n PPC_INS_LDX,\r\n PPC_INS_LFD,\r\n PPC_INS_LFDU,\r\n PPC_INS_LFDUX,\r\n PPC_INS_LFDX,\r\n PPC_INS_LFIWAX,\r\n PPC_INS_LFIWZX,\r\n PPC_INS_LFS,\r\n PPC_INS_LFSU,\r\n PPC_INS_LFSUX,\r\n PPC_INS_LFSX,\r\n PPC_INS_LHA,\r\n PPC_INS_LHAU,\r\n PPC_INS_LHAUX,\r\n PPC_INS_LHAX,\r\n PPC_INS_LHBRX,\r\n PPC_INS_LHZ,\r\n PPC_INS_LHZCIX,\r\n PPC_INS_LHZU,\r\n PPC_INS_LHZUX,\r\n PPC_INS_LHZX,\r\n PPC_INS_LI,\r\n PPC_INS_LIS,\r\n PPC_INS_LMW,\r\n PPC_INS_LSWI,\r\n PPC_INS_LVEBX,\r\n PPC_INS_LVEHX,\r\n PPC_INS_LVEWX,\r\n PPC_INS_LVSL,\r\n PPC_INS_LVSR,\r\n PPC_INS_LVX,\r\n PPC_INS_LVXL,\r\n PPC_INS_LWA,\r\n PPC_INS_LWARX,\r\n PPC_INS_LWAUX,\r\n PPC_INS_LWAX,\r\n PPC_INS_LWBRX,\r\n PPC_INS_LWZ,\r\n PPC_INS_LWZCIX,\r\n PPC_INS_LWZU,\r\n PPC_INS_LWZUX,\r\n PPC_INS_LWZX,\r\n PPC_INS_LXSDX,\r\n PPC_INS_LXVD2X,\r\n PPC_INS_LXVDSX,\r\n PPC_INS_LXVW4X,\r\n PPC_INS_MBAR,\r\n PPC_INS_MCRF,\r\n PPC_INS_MCRFS,\r\n PPC_INS_MFCR,\r\n PPC_INS_MFCTR,\r\n PPC_INS_MFDCR,\r\n PPC_INS_MFFS,\r\n PPC_INS_MFLR,\r\n PPC_INS_MFMSR,\r\n PPC_INS_MFOCRF,\r\n PPC_INS_MFSPR,\r\n PPC_INS_MFSR,\r\n PPC_INS_MFSRIN,\r\n PPC_INS_MFTB,\r\n PPC_INS_MFVSCR,\r\n PPC_INS_MSYNC,\r\n PPC_INS_MTCRF,\r\n PPC_INS_MTCTR,\r\n PPC_INS_MTDCR,\r\n PPC_INS_MTFSB0,\r\n PPC_INS_MTFSB1,\r\n PPC_INS_MTFSF,\r\n PPC_INS_MTFSFI,\r\n PPC_INS_MTLR,\r\n PPC_INS_MTMSR,\r\n PPC_INS_MTMSRD,\r\n PPC_INS_MTOCRF,\r\n PPC_INS_MTSPR,\r\n PPC_INS_MTSR,\r\n PPC_INS_MTSRIN,\r\n PPC_INS_MTVSCR,\r\n PPC_INS_MULHD,\r\n PPC_INS_MULHDU,\r\n PPC_INS_MULHW,\r\n PPC_INS_MULHWU,\r\n PPC_INS_MULLD,\r\n PPC_INS_MULLI,\r\n PPC_INS_MULLW,\r\n PPC_INS_NAND,\r\n PPC_INS_NEG,\r\n PPC_INS_NOP,\r\n PPC_INS_ORI,\r\n PPC_INS_NOR,\r\n PPC_INS_OR,\r\n PPC_INS_ORC,\r\n PPC_INS_ORIS,\r\n PPC_INS_POPCNTD,\r\n PPC_INS_POPCNTW,\r\n PPC_INS_QVALIGNI,\r\n PPC_INS_QVESPLATI,\r\n PPC_INS_QVFABS,\r\n PPC_INS_QVFADD,\r\n PPC_INS_QVFADDS,\r\n PPC_INS_QVFCFID,\r\n PPC_INS_QVFCFIDS,\r\n PPC_INS_QVFCFIDU,\r\n PPC_INS_QVFCFIDUS,\r\n PPC_INS_QVFCMPEQ,\r\n PPC_INS_QVFCMPGT,\r\n PPC_INS_QVFCMPLT,\r\n PPC_INS_QVFCPSGN,\r\n PPC_INS_QVFCTID,\r\n PPC_INS_QVFCTIDU,\r\n PPC_INS_QVFCTIDUZ,\r\n PPC_INS_QVFCTIDZ,\r\n PPC_INS_QVFCTIW,\r\n PPC_INS_QVFCTIWU,\r\n PPC_INS_QVFCTIWUZ,\r\n PPC_INS_QVFCTIWZ,\r\n PPC_INS_QVFLOGICAL,\r\n PPC_INS_QVFMADD,\r\n PPC_INS_QVFMADDS,\r\n PPC_INS_QVFMR,\r\n PPC_INS_QVFMSUB,\r\n PPC_INS_QVFMSUBS,\r\n PPC_INS_QVFMUL,\r\n PPC_INS_QVFMULS,\r\n PPC_INS_QVFNABS,\r\n PPC_INS_QVFNEG,\r\n PPC_INS_QVFNMADD,\r\n PPC_INS_QVFNMADDS,\r\n PPC_INS_QVFNMSUB,\r\n PPC_INS_QVFNMSUBS,\r\n PPC_INS_QVFPERM,\r\n PPC_INS_QVFRE,\r\n PPC_INS_QVFRES,\r\n PPC_INS_QVFRIM,\r\n PPC_INS_QVFRIN,\r\n PPC_INS_QVFRIP,\r\n PPC_INS_QVFRIZ,\r\n PPC_INS_QVFRSP,\r\n PPC_INS_QVFRSQRTE,\r\n PPC_INS_QVFRSQRTES,\r\n PPC_INS_QVFSEL,\r\n PPC_INS_QVFSUB,\r\n PPC_INS_QVFSUBS,\r\n PPC_INS_QVFTSTNAN,\r\n PPC_INS_QVFXMADD,\r\n PPC_INS_QVFXMADDS,\r\n PPC_INS_QVFXMUL,\r\n PPC_INS_QVFXMULS,\r\n PPC_INS_QVFXXCPNMADD,\r\n PPC_INS_QVFXXCPNMADDS,\r\n PPC_INS_QVFXXMADD,\r\n PPC_INS_QVFXXMADDS,\r\n PPC_INS_QVFXXNPMADD,\r\n PPC_INS_QVFXXNPMADDS,\r\n PPC_INS_QVGPCI,\r\n PPC_INS_QVLFCDUX,\r\n PPC_INS_QVLFCDUXA,\r\n PPC_INS_QVLFCDX,\r\n PPC_INS_QVLFCDXA,\r\n PPC_INS_QVLFCSUX,\r\n PPC_INS_QVLFCSUXA,\r\n PPC_INS_QVLFCSX,\r\n PPC_INS_QVLFCSXA,\r\n PPC_INS_QVLFDUX,\r\n PPC_INS_QVLFDUXA,\r\n PPC_INS_QVLFDX,\r\n PPC_INS_QVLFDXA,\r\n PPC_INS_QVLFIWAX,\r\n PPC_INS_QVLFIWAXA,\r\n PPC_INS_QVLFIWZX,\r\n PPC_INS_QVLFIWZXA,\r\n PPC_INS_QVLFSUX,\r\n PPC_INS_QVLFSUXA,\r\n PPC_INS_QVLFSX,\r\n PPC_INS_QVLFSXA,\r\n PPC_INS_QVLPCLDX,\r\n PPC_INS_QVLPCLSX,\r\n PPC_INS_QVLPCRDX,\r\n PPC_INS_QVLPCRSX,\r\n PPC_INS_QVSTFCDUX,\r\n PPC_INS_QVSTFCDUXA,\r\n PPC_INS_QVSTFCDUXI,\r\n PPC_INS_QVSTFCDUXIA,\r\n PPC_INS_QVSTFCDX,\r\n PPC_INS_QVSTFCDXA,\r\n PPC_INS_QVSTFCDXI,\r\n PPC_INS_QVSTFCDXIA,\r\n PPC_INS_QVSTFCSUX,\r\n PPC_INS_QVSTFCSUXA,\r\n PPC_INS_QVSTFCSUXI,\r\n PPC_INS_QVSTFCSUXIA,\r\n PPC_INS_QVSTFCSX,\r\n PPC_INS_QVSTFCSXA,\r\n PPC_INS_QVSTFCSXI,\r\n PPC_INS_QVSTFCSXIA,\r\n PPC_INS_QVSTFDUX,\r\n PPC_INS_QVSTFDUXA,\r\n PPC_INS_QVSTFDUXI,\r\n PPC_INS_QVSTFDUXIA,\r\n PPC_INS_QVSTFDX,\r\n PPC_INS_QVSTFDXA,\r\n PPC_INS_QVSTFDXI,\r\n PPC_INS_QVSTFDXIA,\r\n PPC_INS_QVSTFIWX,\r\n PPC_INS_QVSTFIWXA,\r\n PPC_INS_QVSTFSUX,\r\n PPC_INS_QVSTFSUXA,\r\n PPC_INS_QVSTFSUXI,\r\n PPC_INS_QVSTFSUXIA,\r\n PPC_INS_QVSTFSX,\r\n PPC_INS_QVSTFSXA,\r\n PPC_INS_QVSTFSXI,\r\n PPC_INS_QVSTFSXIA,\r\n PPC_INS_RFCI,\r\n PPC_INS_RFDI,\r\n PPC_INS_RFI,\r\n PPC_INS_RFID,\r\n PPC_INS_RFMCI,\r\n PPC_INS_RLDCL,\r\n PPC_INS_RLDCR,\r\n PPC_INS_RLDIC,\r\n PPC_INS_RLDICL,\r\n PPC_INS_RLDICR,\r\n PPC_INS_RLDIMI,\r\n PPC_INS_RLWIMI,\r\n PPC_INS_RLWINM,\r\n PPC_INS_RLWNM,\r\n PPC_INS_SC,\r\n PPC_INS_SLBIA,\r\n PPC_INS_SLBIE,\r\n PPC_INS_SLBMFEE,\r\n PPC_INS_SLBMTE,\r\n PPC_INS_SLD,\r\n PPC_INS_SLW,\r\n PPC_INS_SRAD,\r\n PPC_INS_SRADI,\r\n PPC_INS_SRAW,\r\n PPC_INS_SRAWI,\r\n PPC_INS_SRD,\r\n PPC_INS_SRW,\r\n PPC_INS_STB,\r\n PPC_INS_STBCIX,\r\n PPC_INS_STBU,\r\n PPC_INS_STBUX,\r\n PPC_INS_STBX,\r\n PPC_INS_STD,\r\n PPC_INS_STDBRX,\r\n PPC_INS_STDCIX,\r\n PPC_INS_STDCX,\r\n PPC_INS_STDU,\r\n PPC_INS_STDUX,\r\n PPC_INS_STDX,\r\n PPC_INS_STFD,\r\n PPC_INS_STFDU,\r\n PPC_INS_STFDUX,\r\n PPC_INS_STFDX,\r\n PPC_INS_STFIWX,\r\n PPC_INS_STFS,\r\n PPC_INS_STFSU,\r\n PPC_INS_STFSUX,\r\n PPC_INS_STFSX,\r\n PPC_INS_STH,\r\n PPC_INS_STHBRX,\r\n PPC_INS_STHCIX,\r\n PPC_INS_STHU,\r\n PPC_INS_STHUX,\r\n PPC_INS_STHX,\r\n PPC_INS_STMW,\r\n PPC_INS_STSWI,\r\n PPC_INS_STVEBX,\r\n PPC_INS_STVEHX,\r\n PPC_INS_STVEWX,\r\n PPC_INS_STVX,\r\n PPC_INS_STVXL,\r\n PPC_INS_STW,\r\n PPC_INS_STWBRX,\r\n PPC_INS_STWCIX,\r\n PPC_INS_STWCX,\r\n PPC_INS_STWU,\r\n PPC_INS_STWUX,\r\n PPC_INS_STWX,\r\n PPC_INS_STXSDX,\r\n PPC_INS_STXVD2X,\r\n PPC_INS_STXVW4X,\r\n PPC_INS_SUBF,\r\n PPC_INS_SUBFC,\r\n PPC_INS_SUBFE,\r\n PPC_INS_SUBFIC,\r\n PPC_INS_SUBFME,\r\n PPC_INS_SUBFZE,\r\n PPC_INS_SYNC,\r\n PPC_INS_TD,\r\n PPC_INS_TDI,\r\n PPC_INS_TLBIA,\r\n PPC_INS_TLBIE,\r\n PPC_INS_TLBIEL,\r\n PPC_INS_TLBIVAX,\r\n PPC_INS_TLBLD,\r\n PPC_INS_TLBLI,\r\n PPC_INS_TLBRE,\r\n PPC_INS_TLBSX,\r\n PPC_INS_TLBSYNC,\r\n PPC_INS_TLBWE,\r\n PPC_INS_TRAP,\r\n PPC_INS_TW,\r\n PPC_INS_TWI,\r\n PPC_INS_VADDCUW,\r\n PPC_INS_VADDFP,\r\n PPC_INS_VADDSBS,\r\n PPC_INS_VADDSHS,\r\n PPC_INS_VADDSWS,\r\n PPC_INS_VADDUBM,\r\n PPC_INS_VADDUBS,\r\n PPC_INS_VADDUDM,\r\n PPC_INS_VADDUHM,\r\n PPC_INS_VADDUHS,\r\n PPC_INS_VADDUWM,\r\n PPC_INS_VADDUWS,\r\n PPC_INS_VAND,\r\n PPC_INS_VANDC,\r\n PPC_INS_VAVGSB,\r\n PPC_INS_VAVGSH,\r\n PPC_INS_VAVGSW,\r\n PPC_INS_VAVGUB,\r\n PPC_INS_VAVGUH,\r\n PPC_INS_VAVGUW,\r\n PPC_INS_VCFSX,\r\n PPC_INS_VCFUX,\r\n PPC_INS_VCLZB,\r\n PPC_INS_VCLZD,\r\n PPC_INS_VCLZH,\r\n PPC_INS_VCLZW,\r\n PPC_INS_VCMPBFP,\r\n PPC_INS_VCMPEQFP,\r\n PPC_INS_VCMPEQUB,\r\n PPC_INS_VCMPEQUD,\r\n PPC_INS_VCMPEQUH,\r\n PPC_INS_VCMPEQUW,\r\n PPC_INS_VCMPGEFP,\r\n PPC_INS_VCMPGTFP,\r\n PPC_INS_VCMPGTSB,\r\n PPC_INS_VCMPGTSD,\r\n PPC_INS_VCMPGTSH,\r\n PPC_INS_VCMPGTSW,\r\n PPC_INS_VCMPGTUB,\r\n PPC_INS_VCMPGTUD,\r\n PPC_INS_VCMPGTUH,\r\n PPC_INS_VCMPGTUW,\r\n PPC_INS_VCTSXS,\r\n PPC_INS_VCTUXS,\r\n PPC_INS_VEQV,\r\n PPC_INS_VEXPTEFP,\r\n PPC_INS_VLOGEFP,\r\n PPC_INS_VMADDFP,\r\n PPC_INS_VMAXFP,\r\n PPC_INS_VMAXSB,\r\n PPC_INS_VMAXSD,\r\n PPC_INS_VMAXSH,\r\n PPC_INS_VMAXSW,\r\n PPC_INS_VMAXUB,\r\n PPC_INS_VMAXUD,\r\n PPC_INS_VMAXUH,\r\n PPC_INS_VMAXUW,\r\n PPC_INS_VMHADDSHS,\r\n PPC_INS_VMHRADDSHS,\r\n PPC_INS_VMINUD,\r\n PPC_INS_VMINFP,\r\n PPC_INS_VMINSB,\r\n PPC_INS_VMINSD,\r\n PPC_INS_VMINSH,\r\n PPC_INS_VMINSW,\r\n PPC_INS_VMINUB,\r\n PPC_INS_VMINUH,\r\n PPC_INS_VMINUW,\r\n PPC_INS_VMLADDUHM,\r\n PPC_INS_VMRGHB,\r\n PPC_INS_VMRGHH,\r\n PPC_INS_VMRGHW,\r\n PPC_INS_VMRGLB,\r\n PPC_INS_VMRGLH,\r\n PPC_INS_VMRGLW,\r\n PPC_INS_VMSUMMBM,\r\n PPC_INS_VMSUMSHM,\r\n PPC_INS_VMSUMSHS,\r\n PPC_INS_VMSUMUBM,\r\n PPC_INS_VMSUMUHM,\r\n PPC_INS_VMSUMUHS,\r\n PPC_INS_VMULESB,\r\n PPC_INS_VMULESH,\r\n PPC_INS_VMULESW,\r\n PPC_INS_VMULEUB,\r\n PPC_INS_VMULEUH,\r\n PPC_INS_VMULEUW,\r\n PPC_INS_VMULOSB,\r\n PPC_INS_VMULOSH,\r\n PPC_INS_VMULOSW,\r\n PPC_INS_VMULOUB,\r\n PPC_INS_VMULOUH,\r\n PPC_INS_VMULOUW,\r\n PPC_INS_VMULUWM,\r\n PPC_INS_VNAND,\r\n PPC_INS_VNMSUBFP,\r\n PPC_INS_VNOR,\r\n PPC_INS_VOR,\r\n PPC_INS_VORC,\r\n PPC_INS_VPERM,\r\n PPC_INS_VPKPX,\r\n PPC_INS_VPKSHSS,\r\n PPC_INS_VPKSHUS,\r\n PPC_INS_VPKSWSS,\r\n PPC_INS_VPKSWUS,\r\n PPC_INS_VPKUHUM,\r\n PPC_INS_VPKUHUS,\r\n PPC_INS_VPKUWUM,\r\n PPC_INS_VPKUWUS,\r\n PPC_INS_VPOPCNTB,\r\n PPC_INS_VPOPCNTD,\r\n PPC_INS_VPOPCNTH,\r\n PPC_INS_VPOPCNTW,\r\n PPC_INS_VREFP,\r\n PPC_INS_VRFIM,\r\n PPC_INS_VRFIN,\r\n PPC_INS_VRFIP,\r\n PPC_INS_VRFIZ,\r\n PPC_INS_VRLB,\r\n PPC_INS_VRLD,\r\n PPC_INS_VRLH,\r\n PPC_INS_VRLW,\r\n PPC_INS_VRSQRTEFP,\r\n PPC_INS_VSEL,\r\n PPC_INS_VSL,\r\n PPC_INS_VSLB,\r\n PPC_INS_VSLD,\r\n PPC_INS_VSLDOI,\r\n PPC_INS_VSLH,\r\n PPC_INS_VSLO,\r\n PPC_INS_VSLW,\r\n PPC_INS_VSPLTB,\r\n PPC_INS_VSPLTH,\r\n PPC_INS_VSPLTISB,\r\n PPC_INS_VSPLTISH,\r\n PPC_INS_VSPLTISW,\r\n PPC_INS_VSPLTW,\r\n PPC_INS_VSR,\r\n PPC_INS_VSRAB,\r\n PPC_INS_VSRAD,\r\n PPC_INS_VSRAH,\r\n PPC_INS_VSRAW,\r\n PPC_INS_VSRB,\r\n PPC_INS_VSRD,\r\n PPC_INS_VSRH,\r\n PPC_INS_VSRO,\r\n PPC_INS_VSRW,\r\n PPC_INS_VSUBCUW,\r\n PPC_INS_VSUBFP,\r\n PPC_INS_VSUBSBS,\r\n PPC_INS_VSUBSHS,\r\n PPC_INS_VSUBSWS,\r\n PPC_INS_VSUBUBM,\r\n PPC_INS_VSUBUBS,\r\n PPC_INS_VSUBUDM,\r\n PPC_INS_VSUBUHM,\r\n PPC_INS_VSUBUHS,\r\n PPC_INS_VSUBUWM,\r\n PPC_INS_VSUBUWS,\r\n PPC_INS_VSUM2SWS,\r\n PPC_INS_VSUM4SBS,\r\n PPC_INS_VSUM4SHS,\r\n PPC_INS_VSUM4UBS,\r\n PPC_INS_VSUMSWS,\r\n PPC_INS_VUPKHPX,\r\n PPC_INS_VUPKHSB,\r\n PPC_INS_VUPKHSH,\r\n PPC_INS_VUPKLPX,\r\n PPC_INS_VUPKLSB,\r\n PPC_INS_VUPKLSH,\r\n PPC_INS_VXOR,\r\n PPC_INS_WAIT,\r\n PPC_INS_WRTEE,\r\n PPC_INS_WRTEEI,\r\n PPC_INS_XOR,\r\n PPC_INS_XORI,\r\n PPC_INS_XORIS,\r\n PPC_INS_XSABSDP,\r\n PPC_INS_XSADDDP,\r\n PPC_INS_XSCMPODP,\r\n PPC_INS_XSCMPUDP,\r\n PPC_INS_XSCPSGNDP,\r\n PPC_INS_XSCVDPSP,\r\n PPC_INS_XSCVDPSXDS,\r\n PPC_INS_XSCVDPSXWS,\r\n PPC_INS_XSCVDPUXDS,\r\n PPC_INS_XSCVDPUXWS,\r\n PPC_INS_XSCVSPDP,\r\n PPC_INS_XSCVSXDDP,\r\n PPC_INS_XSCVUXDDP,\r\n PPC_INS_XSDIVDP,\r\n PPC_INS_XSMADDADP,\r\n PPC_INS_XSMADDMDP,\r\n PPC_INS_XSMAXDP,\r\n PPC_INS_XSMINDP,\r\n PPC_INS_XSMSUBADP,\r\n PPC_INS_XSMSUBMDP,\r\n PPC_INS_XSMULDP,\r\n PPC_INS_XSNABSDP,\r\n PPC_INS_XSNEGDP,\r\n PPC_INS_XSNMADDADP,\r\n PPC_INS_XSNMADDMDP,\r\n PPC_INS_XSNMSUBADP,\r\n PPC_INS_XSNMSUBMDP,\r\n PPC_INS_XSRDPI,\r\n PPC_INS_XSRDPIC,\r\n PPC_INS_XSRDPIM,\r\n PPC_INS_XSRDPIP,\r\n PPC_INS_XSRDPIZ,\r\n PPC_INS_XSREDP,\r\n PPC_INS_XSRSQRTEDP,\r\n PPC_INS_XSSQRTDP,\r\n PPC_INS_XSSUBDP,\r\n PPC_INS_XSTDIVDP,\r\n PPC_INS_XSTSQRTDP,\r\n PPC_INS_XVABSDP,\r\n PPC_INS_XVABSSP,\r\n PPC_INS_XVADDDP,\r\n PPC_INS_XVADDSP,\r\n PPC_INS_XVCMPEQDP,\r\n PPC_INS_XVCMPEQSP,\r\n PPC_INS_XVCMPGEDP,\r\n PPC_INS_XVCMPGESP,\r\n PPC_INS_XVCMPGTDP,\r\n PPC_INS_XVCMPGTSP,\r\n PPC_INS_XVCPSGNDP,\r\n PPC_INS_XVCPSGNSP,\r\n PPC_INS_XVCVDPSP,\r\n PPC_INS_XVCVDPSXDS,\r\n PPC_INS_XVCVDPSXWS,\r\n PPC_INS_XVCVDPUXDS,\r\n PPC_INS_XVCVDPUXWS,\r\n PPC_INS_XVCVSPDP,\r\n PPC_INS_XVCVSPSXDS,\r\n PPC_INS_XVCVSPSXWS,\r\n PPC_INS_XVCVSPUXDS,\r\n PPC_INS_XVCVSPUXWS,\r\n PPC_INS_XVCVSXDDP,\r\n PPC_INS_XVCVSXDSP,\r\n PPC_INS_XVCVSXWDP,\r\n PPC_INS_XVCVSXWSP,\r\n PPC_INS_XVCVUXDDP,\r\n PPC_INS_XVCVUXDSP,\r\n PPC_INS_XVCVUXWDP,\r\n PPC_INS_XVCVUXWSP,\r\n PPC_INS_XVDIVDP,\r\n PPC_INS_XVDIVSP,\r\n PPC_INS_XVMADDADP,\r\n PPC_INS_XVMADDASP,\r\n PPC_INS_XVMADDMDP,\r\n PPC_INS_XVMADDMSP,\r\n PPC_INS_XVMAXDP,\r\n PPC_INS_XVMAXSP,\r\n PPC_INS_XVMINDP,\r\n PPC_INS_XVMINSP,\r\n PPC_INS_XVMSUBADP,\r\n PPC_INS_XVMSUBASP,\r\n PPC_INS_XVMSUBMDP,\r\n PPC_INS_XVMSUBMSP,\r\n PPC_INS_XVMULDP,\r\n PPC_INS_XVMULSP,\r\n PPC_INS_XVNABSDP,\r\n PPC_INS_XVNABSSP,\r\n PPC_INS_XVNEGDP,\r\n PPC_INS_XVNEGSP,\r\n PPC_INS_XVNMADDADP,\r\n PPC_INS_XVNMADDASP,\r\n PPC_INS_XVNMADDMDP,\r\n PPC_INS_XVNMADDMSP,\r\n PPC_INS_XVNMSUBADP,\r\n PPC_INS_XVNMSUBASP,\r\n PPC_INS_XVNMSUBMDP,\r\n PPC_INS_XVNMSUBMSP,\r\n PPC_INS_XVRDPI,\r\n PPC_INS_XVRDPIC,\r\n PPC_INS_XVRDPIM,\r\n PPC_INS_XVRDPIP,\r\n PPC_INS_XVRDPIZ,\r\n PPC_INS_XVREDP,\r\n PPC_INS_XVRESP,\r\n PPC_INS_XVRSPI,\r\n PPC_INS_XVRSPIC,\r\n PPC_INS_XVRSPIM,\r\n PPC_INS_XVRSPIP,\r\n PPC_INS_XVRSPIZ,\r\n PPC_INS_XVRSQRTEDP,\r\n PPC_INS_XVRSQRTESP,\r\n PPC_INS_XVSQRTDP,\r\n PPC_INS_XVSQRTSP,\r\n PPC_INS_XVSUBDP,\r\n PPC_INS_XVSUBSP,\r\n PPC_INS_XVTDIVDP,\r\n PPC_INS_XVTDIVSP,\r\n PPC_INS_XVTSQRTDP,\r\n PPC_INS_XVTSQRTSP,\r\n PPC_INS_XXLAND,\r\n PPC_INS_XXLANDC,\r\n PPC_INS_XXLEQV,\r\n PPC_INS_XXLNAND,\r\n PPC_INS_XXLNOR,\r\n PPC_INS_XXLOR,\r\n PPC_INS_XXLORC,\r\n PPC_INS_XXLXOR,\r\n PPC_INS_XXMRGHW,\r\n PPC_INS_XXMRGLW,\r\n PPC_INS_XXPERMDI,\r\n PPC_INS_XXSEL,\r\n PPC_INS_XXSLDWI,\r\n PPC_INS_XXSPLTW,\r\n PPC_INS_BCA,\r\n PPC_INS_BCLA,\r\n\r\n // extra & alias instructions\r\n PPC_INS_SLWI,\r\n PPC_INS_SRWI,\r\n PPC_INS_SLDI,\r\n\r\n PPC_INS_BTA,\r\n PPC_INS_CRSET,\r\n PPC_INS_CRNOT,\r\n PPC_INS_CRMOVE,\r\n PPC_INS_CRCLR,\r\n PPC_INS_MFBR0,\r\n PPC_INS_MFBR1,\r\n PPC_INS_MFBR2,\r\n PPC_INS_MFBR3,\r\n PPC_INS_MFBR4,\r\n PPC_INS_MFBR5,\r\n PPC_INS_MFBR6,\r\n PPC_INS_MFBR7,\r\n PPC_INS_MFXER,\r\n PPC_INS_MFRTCU,\r\n PPC_INS_MFRTCL,\r\n PPC_INS_MFDSCR,\r\n PPC_INS_MFDSISR,\r\n PPC_INS_MFDAR,\r\n PPC_INS_MFSRR2,\r\n PPC_INS_MFSRR3,\r\n PPC_INS_MFCFAR,\r\n PPC_INS_MFAMR,\r\n PPC_INS_MFPID,\r\n PPC_INS_MFTBLO,\r\n PPC_INS_MFTBHI,\r\n PPC_INS_MFDBATU,\r\n PPC_INS_MFDBATL,\r\n PPC_INS_MFIBATU,\r\n PPC_INS_MFIBATL,\r\n PPC_INS_MFDCCR,\r\n PPC_INS_MFICCR,\r\n PPC_INS_MFDEAR,\r\n PPC_INS_MFESR,\r\n PPC_INS_MFSPEFSCR,\r\n PPC_INS_MFTCR,\r\n PPC_INS_MFASR,\r\n PPC_INS_MFPVR,\r\n PPC_INS_MFTBU,\r\n PPC_INS_MTCR,\r\n PPC_INS_MTBR0,\r\n PPC_INS_MTBR1,\r\n PPC_INS_MTBR2,\r\n PPC_INS_MTBR3,\r\n PPC_INS_MTBR4,\r\n PPC_INS_MTBR5,\r\n PPC_INS_MTBR6,\r\n PPC_INS_MTBR7,\r\n PPC_INS_MTXER,\r\n PPC_INS_MTDSCR,\r\n PPC_INS_MTDSISR,\r\n PPC_INS_MTDAR,\r\n PPC_INS_MTSRR2,\r\n PPC_INS_MTSRR3,\r\n PPC_INS_MTCFAR,\r\n PPC_INS_MTAMR,\r\n PPC_INS_MTPID,\r\n PPC_INS_MTTBL,\r\n PPC_INS_MTTBU,\r\n PPC_INS_MTTBLO,\r\n PPC_INS_MTTBHI,\r\n PPC_INS_MTDBATU,\r\n PPC_INS_MTDBATL,\r\n PPC_INS_MTIBATU,\r\n PPC_INS_MTIBATL,\r\n PPC_INS_MTDCCR,\r\n PPC_INS_MTICCR,\r\n PPC_INS_MTDEAR,\r\n PPC_INS_MTESR,\r\n PPC_INS_MTSPEFSCR,\r\n PPC_INS_MTTCR,\r\n PPC_INS_NOT,\r\n PPC_INS_MR,\r\n PPC_INS_ROTLD,\r\n PPC_INS_ROTLDI,\r\n PPC_INS_CLRLDI,\r\n PPC_INS_ROTLWI,\r\n PPC_INS_CLRLWI,\r\n PPC_INS_ROTLW,\r\n PPC_INS_SUB,\r\n PPC_INS_SUBC,\r\n PPC_INS_LWSYNC,\r\n PPC_INS_PTESYNC,\r\n PPC_INS_TDLT,\r\n PPC_INS_TDEQ,\r\n PPC_INS_TDGT,\r\n PPC_INS_TDNE,\r\n PPC_INS_TDLLT,\r\n PPC_INS_TDLGT,\r\n PPC_INS_TDU,\r\n PPC_INS_TDLTI,\r\n PPC_INS_TDEQI,\r\n PPC_INS_TDGTI,\r\n PPC_INS_TDNEI,\r\n PPC_INS_TDLLTI,\r\n PPC_INS_TDLGTI,\r\n PPC_INS_TDUI,\r\n PPC_INS_TLBREHI,\r\n PPC_INS_TLBRELO,\r\n PPC_INS_TLBWEHI,\r\n PPC_INS_TLBWELO,\r\n PPC_INS_TWLT,\r\n PPC_INS_TWEQ,\r\n PPC_INS_TWGT,\r\n PPC_INS_TWNE,\r\n PPC_INS_TWLLT,\r\n PPC_INS_TWLGT,\r\n PPC_INS_TWU,\r\n PPC_INS_TWLTI,\r\n PPC_INS_TWEQI,\r\n PPC_INS_TWGTI,\r\n PPC_INS_TWNEI,\r\n PPC_INS_TWLLTI,\r\n PPC_INS_TWLGTI,\r\n PPC_INS_TWUI,\r\n PPC_INS_WAITRSV,\r\n PPC_INS_WAITIMPL,\r\n PPC_INS_XNOP,\r\n PPC_INS_XVMOVDP,\r\n PPC_INS_XVMOVSP,\r\n PPC_INS_XXSPLTD,\r\n PPC_INS_XXMRGHD,\r\n PPC_INS_XXMRGLD,\r\n PPC_INS_XXSWAPD,\r\n PPC_INS_BT,\r\n PPC_INS_BF,\r\n PPC_INS_BDNZT,\r\n PPC_INS_BDNZF,\r\n PPC_INS_BDZF,\r\n PPC_INS_BDZT,\r\n PPC_INS_BFA,\r\n PPC_INS_BDNZTA,\r\n PPC_INS_BDNZFA,\r\n PPC_INS_BDZTA,\r\n PPC_INS_BDZFA,\r\n PPC_INS_BTCTR,\r\n PPC_INS_BFCTR,\r\n PPC_INS_BTCTRL,\r\n PPC_INS_BFCTRL,\r\n PPC_INS_BTL,\r\n PPC_INS_BFL,\r\n PPC_INS_BDNZTL,\r\n PPC_INS_BDNZFL,\r\n PPC_INS_BDZTL,\r\n PPC_INS_BDZFL,\r\n PPC_INS_BTLA,\r\n PPC_INS_BFLA,\r\n PPC_INS_BDNZTLA,\r\n PPC_INS_BDNZFLA,\r\n PPC_INS_BDZTLA,\r\n PPC_INS_BDZFLA,\r\n PPC_INS_BTLR,\r\n PPC_INS_BFLR,\r\n PPC_INS_BDNZTLR,\r\n PPC_INS_BDZTLR,\r\n PPC_INS_BDZFLR,\r\n PPC_INS_BTLRL,\r\n PPC_INS_BFLRL,\r\n PPC_INS_BDNZTLRL,\r\n PPC_INS_BDNZFLRL,\r\n PPC_INS_BDZTLRL,\r\n PPC_INS_BDZFLRL,\r\n\r\n // QPX\r\n PPC_INS_QVFAND,\r\n PPC_INS_QVFCLR,\r\n PPC_INS_QVFANDC,\r\n PPC_INS_QVFCTFB,\r\n PPC_INS_QVFXOR,\r\n PPC_INS_QVFOR,\r\n PPC_INS_QVFNOR,\r\n PPC_INS_QVFEQU,\r\n PPC_INS_QVFNOT,\r\n PPC_INS_QVFORC,\r\n PPC_INS_QVFNAND,\r\n PPC_INS_QVFSET,\r\n\r\n PPC_INS_ENDING, // <-- mark the end of the list of instructions\r\n} ppc_insn;\r\n\r\n//> Group of PPC instructions\r\ntypedef enum ppc_insn_group\r\n{\r\n PPC_GRP_INVALID = 0, // = CS_GRP_INVALID\r\n\r\n //> Generic groups\r\n // all jump instructions (conditional+direct+indirect jumps)\r\n PPC_GRP_JUMP, // = CS_GRP_JUMP\r\n\r\n //> Architecture-specific groups\r\n PPC_GRP_ALTIVEC = 128,\r\n PPC_GRP_MODE32,\r\n PPC_GRP_MODE64,\r\n PPC_GRP_BOOKE,\r\n PPC_GRP_NOTBOOKE,\r\n PPC_GRP_SPE,\r\n PPC_GRP_VSX,\r\n PPC_GRP_E500,\r\n PPC_GRP_PPC4XX,\r\n PPC_GRP_PPC6XX,\r\n PPC_GRP_ICBT,\r\n PPC_GRP_P8ALTIVEC,\r\n PPC_GRP_P8VECTOR,\r\n PPC_GRP_QPX,\r\n\r\n PPC_GRP_ENDING, // <-- mark the end of the list of groups\r\n} ppc_insn_group;\r\n\r\n#ifdef __cplusplus\r\n}\r\n#endif\r\n\r\n#endif\r\n" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/capstone/sparc.h", "content": "#ifndef CAPSTONE_SPARC_H\r\n#define CAPSTONE_SPARC_H\r\n\r\n/* Capstone Disassembly Engine */\r\n/* By Nguyen Anh Quynh , 2014-2015 */\r\n\r\n#ifdef __cplusplus\r\nextern \"C\" {\r\n#endif\r\n\r\n#include \"platform.h\"\r\n\r\n// GCC SPARC toolchain has a default macro called \"sparc\" which breaks\r\n// compilation\r\n#undef sparc\r\n\r\n#ifdef _MSC_VER\r\n#pragma warning(disable:4201)\r\n#endif\r\n\r\n//> Enums corresponding to Sparc condition codes, both icc's and fcc's.\r\ntypedef enum sparc_cc\r\n{\r\n SPARC_CC_INVALID = 0, // invalid CC (default)\r\n //> Integer condition codes\r\n SPARC_CC_ICC_A = 8 + 256, // Always\r\n SPARC_CC_ICC_N = 0 + 256, // Never\r\n SPARC_CC_ICC_NE = 9 + 256, // Not Equal\r\n SPARC_CC_ICC_E = 1 + 256, // Equal\r\n SPARC_CC_ICC_G = 10 + 256, // Greater\r\n SPARC_CC_ICC_LE = 2 + 256, // Less or Equal\r\n SPARC_CC_ICC_GE = 11 + 256, // Greater or Equal\r\n SPARC_CC_ICC_L = 3 + 256, // Less\r\n SPARC_CC_ICC_GU = 12 + 256, // Greater Unsigned\r\n SPARC_CC_ICC_LEU = 4 + 256, // Less or Equal Unsigned\r\n SPARC_CC_ICC_CC = 13 + 256, // Carry Clear/Great or Equal Unsigned\r\n SPARC_CC_ICC_CS = 5 + 256, // Carry Set/Less Unsigned\r\n SPARC_CC_ICC_POS = 14 + 256, // Positive\r\n SPARC_CC_ICC_NEG = 6 + 256, // Negative\r\n SPARC_CC_ICC_VC = 15 + 256, // Overflow Clear\r\n SPARC_CC_ICC_VS = 7 + 256, // Overflow Set\r\n\r\n //> Floating condition codes\r\n SPARC_CC_FCC_A = 8 + 16 + 256, // Always\r\n SPARC_CC_FCC_N = 0 + 16 + 256, // Never\r\n SPARC_CC_FCC_U = 7 + 16 + 256, // Unordered\r\n SPARC_CC_FCC_G = 6 + 16 + 256, // Greater\r\n SPARC_CC_FCC_UG = 5 + 16 + 256, // Unordered or Greater\r\n SPARC_CC_FCC_L = 4 + 16 + 256, // Less\r\n SPARC_CC_FCC_UL = 3 + 16 + 256, // Unordered or Less\r\n SPARC_CC_FCC_LG = 2 + 16 + 256, // Less or Greater\r\n SPARC_CC_FCC_NE = 1 + 16 + 256, // Not Equal\r\n SPARC_CC_FCC_E = 9 + 16 + 256, // Equal\r\n SPARC_CC_FCC_UE = 10 + 16 + 256, // Unordered or Equal\r\n SPARC_CC_FCC_GE = 11 + 16 + 256, // Greater or Equal\r\n SPARC_CC_FCC_UGE = 12 + 16 + 256, // Unordered or Greater or Equal\r\n SPARC_CC_FCC_LE = 13 + 16 + 256, // Less or Equal\r\n SPARC_CC_FCC_ULE = 14 + 16 + 256, // Unordered or Less or Equal\r\n SPARC_CC_FCC_O = 15 + 16 + 256, // Ordered\r\n} sparc_cc;\r\n\r\n//> Branch hint\r\ntypedef enum sparc_hint\r\n{\r\n SPARC_HINT_INVALID = 0, // no hint\r\n SPARC_HINT_A = 1 << 0, // annul delay slot instruction\r\n SPARC_HINT_PT = 1 << 1, // branch taken\r\n SPARC_HINT_PN = 1 << 2, // branch NOT taken\r\n} sparc_hint;\r\n\r\n//> Operand type for instruction's operands\r\ntypedef enum sparc_op_type\r\n{\r\n SPARC_OP_INVALID = 0, // = CS_OP_INVALID (Uninitialized).\r\n SPARC_OP_REG, // = CS_OP_REG (Register operand).\r\n SPARC_OP_IMM, // = CS_OP_IMM (Immediate operand).\r\n SPARC_OP_MEM, // = CS_OP_MEM (Memory operand).\r\n} sparc_op_type;\r\n\r\n//> SPARC registers\r\ntypedef enum sparc_reg\r\n{\r\n SPARC_REG_INVALID = 0,\r\n\r\n SPARC_REG_F0,\r\n SPARC_REG_F1,\r\n SPARC_REG_F2,\r\n SPARC_REG_F3,\r\n SPARC_REG_F4,\r\n SPARC_REG_F5,\r\n SPARC_REG_F6,\r\n SPARC_REG_F7,\r\n SPARC_REG_F8,\r\n SPARC_REG_F9,\r\n SPARC_REG_F10,\r\n SPARC_REG_F11,\r\n SPARC_REG_F12,\r\n SPARC_REG_F13,\r\n SPARC_REG_F14,\r\n SPARC_REG_F15,\r\n SPARC_REG_F16,\r\n SPARC_REG_F17,\r\n SPARC_REG_F18,\r\n SPARC_REG_F19,\r\n SPARC_REG_F20,\r\n SPARC_REG_F21,\r\n SPARC_REG_F22,\r\n SPARC_REG_F23,\r\n SPARC_REG_F24,\r\n SPARC_REG_F25,\r\n SPARC_REG_F26,\r\n SPARC_REG_F27,\r\n SPARC_REG_F28,\r\n SPARC_REG_F29,\r\n SPARC_REG_F30,\r\n SPARC_REG_F31,\r\n SPARC_REG_F32,\r\n SPARC_REG_F34,\r\n SPARC_REG_F36,\r\n SPARC_REG_F38,\r\n SPARC_REG_F40,\r\n SPARC_REG_F42,\r\n SPARC_REG_F44,\r\n SPARC_REG_F46,\r\n SPARC_REG_F48,\r\n SPARC_REG_F50,\r\n SPARC_REG_F52,\r\n SPARC_REG_F54,\r\n SPARC_REG_F56,\r\n SPARC_REG_F58,\r\n SPARC_REG_F60,\r\n SPARC_REG_F62,\r\n SPARC_REG_FCC0, // Floating condition codes\r\n SPARC_REG_FCC1,\r\n SPARC_REG_FCC2,\r\n SPARC_REG_FCC3,\r\n SPARC_REG_FP,\r\n SPARC_REG_G0,\r\n SPARC_REG_G1,\r\n SPARC_REG_G2,\r\n SPARC_REG_G3,\r\n SPARC_REG_G4,\r\n SPARC_REG_G5,\r\n SPARC_REG_G6,\r\n SPARC_REG_G7,\r\n SPARC_REG_I0,\r\n SPARC_REG_I1,\r\n SPARC_REG_I2,\r\n SPARC_REG_I3,\r\n SPARC_REG_I4,\r\n SPARC_REG_I5,\r\n SPARC_REG_I7,\r\n SPARC_REG_ICC, // Integer condition codes\r\n SPARC_REG_L0,\r\n SPARC_REG_L1,\r\n SPARC_REG_L2,\r\n SPARC_REG_L3,\r\n SPARC_REG_L4,\r\n SPARC_REG_L5,\r\n SPARC_REG_L6,\r\n SPARC_REG_L7,\r\n SPARC_REG_O0,\r\n SPARC_REG_O1,\r\n SPARC_REG_O2,\r\n SPARC_REG_O3,\r\n SPARC_REG_O4,\r\n SPARC_REG_O5,\r\n SPARC_REG_O7,\r\n SPARC_REG_SP,\r\n SPARC_REG_Y,\r\n\r\n // special register\r\n SPARC_REG_XCC,\r\n\r\n SPARC_REG_ENDING, // <-- mark the end of the list of registers\r\n\r\n // extras\r\n SPARC_REG_O6 = SPARC_REG_SP,\r\n SPARC_REG_I6 = SPARC_REG_FP,\r\n} sparc_reg;\r\n\r\n// Instruction's operand referring to memory\r\n// This is associated with SPARC_OP_MEM operand type above\r\ntypedef struct sparc_op_mem\r\n{\r\n uint8_t base; // base register, can be safely interpreted as\r\n // a value of type `sparc_reg`, but it is only\r\n // one byte wide\r\n uint8_t index; // index register, same conditions apply here\r\n int32_t disp; // displacement/offset value\r\n} sparc_op_mem;\r\n\r\n// Instruction operand\r\ntypedef struct cs_sparc_op\r\n{\r\n sparc_op_type type; // operand type\r\n union\r\n {\r\n sparc_reg reg; // register value for REG operand\r\n int32_t imm; // immediate value for IMM operand\r\n sparc_op_mem mem; // base/disp value for MEM operand\r\n };\r\n} cs_sparc_op;\r\n\r\n// Instruction structure\r\ntypedef struct cs_sparc\r\n{\r\n sparc_cc cc; // code condition for this insn\r\n sparc_hint hint; // branch hint: encoding as bitwise OR of sparc_hint.\r\n // Number of operands of this instruction,\r\n // or 0 when instruction has no operand.\r\n uint8_t op_count;\r\n cs_sparc_op operands[4]; // operands for this instruction.\r\n} cs_sparc;\r\n\r\n//> SPARC instruction\r\ntypedef enum sparc_insn\r\n{\r\n SPARC_INS_INVALID = 0,\r\n\r\n SPARC_INS_ADDCC,\r\n SPARC_INS_ADDX,\r\n SPARC_INS_ADDXCC,\r\n SPARC_INS_ADDXC,\r\n SPARC_INS_ADDXCCC,\r\n SPARC_INS_ADD,\r\n SPARC_INS_ALIGNADDR,\r\n SPARC_INS_ALIGNADDRL,\r\n SPARC_INS_ANDCC,\r\n SPARC_INS_ANDNCC,\r\n SPARC_INS_ANDN,\r\n SPARC_INS_AND,\r\n SPARC_INS_ARRAY16,\r\n SPARC_INS_ARRAY32,\r\n SPARC_INS_ARRAY8,\r\n SPARC_INS_B,\r\n SPARC_INS_JMP,\r\n SPARC_INS_BMASK,\r\n SPARC_INS_FB,\r\n SPARC_INS_BRGEZ,\r\n SPARC_INS_BRGZ,\r\n SPARC_INS_BRLEZ,\r\n SPARC_INS_BRLZ,\r\n SPARC_INS_BRNZ,\r\n SPARC_INS_BRZ,\r\n SPARC_INS_BSHUFFLE,\r\n SPARC_INS_CALL,\r\n SPARC_INS_CASX,\r\n SPARC_INS_CAS,\r\n SPARC_INS_CMASK16,\r\n SPARC_INS_CMASK32,\r\n SPARC_INS_CMASK8,\r\n SPARC_INS_CMP,\r\n SPARC_INS_EDGE16,\r\n SPARC_INS_EDGE16L,\r\n SPARC_INS_EDGE16LN,\r\n SPARC_INS_EDGE16N,\r\n SPARC_INS_EDGE32,\r\n SPARC_INS_EDGE32L,\r\n SPARC_INS_EDGE32LN,\r\n SPARC_INS_EDGE32N,\r\n SPARC_INS_EDGE8,\r\n SPARC_INS_EDGE8L,\r\n SPARC_INS_EDGE8LN,\r\n SPARC_INS_EDGE8N,\r\n SPARC_INS_FABSD,\r\n SPARC_INS_FABSQ,\r\n SPARC_INS_FABSS,\r\n SPARC_INS_FADDD,\r\n SPARC_INS_FADDQ,\r\n SPARC_INS_FADDS,\r\n SPARC_INS_FALIGNDATA,\r\n SPARC_INS_FAND,\r\n SPARC_INS_FANDNOT1,\r\n SPARC_INS_FANDNOT1S,\r\n SPARC_INS_FANDNOT2,\r\n SPARC_INS_FANDNOT2S,\r\n SPARC_INS_FANDS,\r\n SPARC_INS_FCHKSM16,\r\n SPARC_INS_FCMPD,\r\n SPARC_INS_FCMPEQ16,\r\n SPARC_INS_FCMPEQ32,\r\n SPARC_INS_FCMPGT16,\r\n SPARC_INS_FCMPGT32,\r\n SPARC_INS_FCMPLE16,\r\n SPARC_INS_FCMPLE32,\r\n SPARC_INS_FCMPNE16,\r\n SPARC_INS_FCMPNE32,\r\n SPARC_INS_FCMPQ,\r\n SPARC_INS_FCMPS,\r\n SPARC_INS_FDIVD,\r\n SPARC_INS_FDIVQ,\r\n SPARC_INS_FDIVS,\r\n SPARC_INS_FDMULQ,\r\n SPARC_INS_FDTOI,\r\n SPARC_INS_FDTOQ,\r\n SPARC_INS_FDTOS,\r\n SPARC_INS_FDTOX,\r\n SPARC_INS_FEXPAND,\r\n SPARC_INS_FHADDD,\r\n SPARC_INS_FHADDS,\r\n SPARC_INS_FHSUBD,\r\n SPARC_INS_FHSUBS,\r\n SPARC_INS_FITOD,\r\n SPARC_INS_FITOQ,\r\n SPARC_INS_FITOS,\r\n SPARC_INS_FLCMPD,\r\n SPARC_INS_FLCMPS,\r\n SPARC_INS_FLUSHW,\r\n SPARC_INS_FMEAN16,\r\n SPARC_INS_FMOVD,\r\n SPARC_INS_FMOVQ,\r\n SPARC_INS_FMOVRDGEZ,\r\n SPARC_INS_FMOVRQGEZ,\r\n SPARC_INS_FMOVRSGEZ,\r\n SPARC_INS_FMOVRDGZ,\r\n SPARC_INS_FMOVRQGZ,\r\n SPARC_INS_FMOVRSGZ,\r\n SPARC_INS_FMOVRDLEZ,\r\n SPARC_INS_FMOVRQLEZ,\r\n SPARC_INS_FMOVRSLEZ,\r\n SPARC_INS_FMOVRDLZ,\r\n SPARC_INS_FMOVRQLZ,\r\n SPARC_INS_FMOVRSLZ,\r\n SPARC_INS_FMOVRDNZ,\r\n SPARC_INS_FMOVRQNZ,\r\n SPARC_INS_FMOVRSNZ,\r\n SPARC_INS_FMOVRDZ,\r\n SPARC_INS_FMOVRQZ,\r\n SPARC_INS_FMOVRSZ,\r\n SPARC_INS_FMOVS,\r\n SPARC_INS_FMUL8SUX16,\r\n SPARC_INS_FMUL8ULX16,\r\n SPARC_INS_FMUL8X16,\r\n SPARC_INS_FMUL8X16AL,\r\n SPARC_INS_FMUL8X16AU,\r\n SPARC_INS_FMULD,\r\n SPARC_INS_FMULD8SUX16,\r\n SPARC_INS_FMULD8ULX16,\r\n SPARC_INS_FMULQ,\r\n SPARC_INS_FMULS,\r\n SPARC_INS_FNADDD,\r\n SPARC_INS_FNADDS,\r\n SPARC_INS_FNAND,\r\n SPARC_INS_FNANDS,\r\n SPARC_INS_FNEGD,\r\n SPARC_INS_FNEGQ,\r\n SPARC_INS_FNEGS,\r\n SPARC_INS_FNHADDD,\r\n SPARC_INS_FNHADDS,\r\n SPARC_INS_FNOR,\r\n SPARC_INS_FNORS,\r\n SPARC_INS_FNOT1,\r\n SPARC_INS_FNOT1S,\r\n SPARC_INS_FNOT2,\r\n SPARC_INS_FNOT2S,\r\n SPARC_INS_FONE,\r\n SPARC_INS_FONES,\r\n SPARC_INS_FOR,\r\n SPARC_INS_FORNOT1,\r\n SPARC_INS_FORNOT1S,\r\n SPARC_INS_FORNOT2,\r\n SPARC_INS_FORNOT2S,\r\n SPARC_INS_FORS,\r\n SPARC_INS_FPACK16,\r\n SPARC_INS_FPACK32,\r\n SPARC_INS_FPACKFIX,\r\n SPARC_INS_FPADD16,\r\n SPARC_INS_FPADD16S,\r\n SPARC_INS_FPADD32,\r\n SPARC_INS_FPADD32S,\r\n SPARC_INS_FPADD64,\r\n SPARC_INS_FPMERGE,\r\n SPARC_INS_FPSUB16,\r\n SPARC_INS_FPSUB16S,\r\n SPARC_INS_FPSUB32,\r\n SPARC_INS_FPSUB32S,\r\n SPARC_INS_FQTOD,\r\n SPARC_INS_FQTOI,\r\n SPARC_INS_FQTOS,\r\n SPARC_INS_FQTOX,\r\n SPARC_INS_FSLAS16,\r\n SPARC_INS_FSLAS32,\r\n SPARC_INS_FSLL16,\r\n SPARC_INS_FSLL32,\r\n SPARC_INS_FSMULD,\r\n SPARC_INS_FSQRTD,\r\n SPARC_INS_FSQRTQ,\r\n SPARC_INS_FSQRTS,\r\n SPARC_INS_FSRA16,\r\n SPARC_INS_FSRA32,\r\n SPARC_INS_FSRC1,\r\n SPARC_INS_FSRC1S,\r\n SPARC_INS_FSRC2,\r\n SPARC_INS_FSRC2S,\r\n SPARC_INS_FSRL16,\r\n SPARC_INS_FSRL32,\r\n SPARC_INS_FSTOD,\r\n SPARC_INS_FSTOI,\r\n SPARC_INS_FSTOQ,\r\n SPARC_INS_FSTOX,\r\n SPARC_INS_FSUBD,\r\n SPARC_INS_FSUBQ,\r\n SPARC_INS_FSUBS,\r\n SPARC_INS_FXNOR,\r\n SPARC_INS_FXNORS,\r\n SPARC_INS_FXOR,\r\n SPARC_INS_FXORS,\r\n SPARC_INS_FXTOD,\r\n SPARC_INS_FXTOQ,\r\n SPARC_INS_FXTOS,\r\n SPARC_INS_FZERO,\r\n SPARC_INS_FZEROS,\r\n SPARC_INS_JMPL,\r\n SPARC_INS_LDD,\r\n SPARC_INS_LD,\r\n SPARC_INS_LDQ,\r\n SPARC_INS_LDSB,\r\n SPARC_INS_LDSH,\r\n SPARC_INS_LDSW,\r\n SPARC_INS_LDUB,\r\n SPARC_INS_LDUH,\r\n SPARC_INS_LDX,\r\n SPARC_INS_LZCNT,\r\n SPARC_INS_MEMBAR,\r\n SPARC_INS_MOVDTOX,\r\n SPARC_INS_MOV,\r\n SPARC_INS_MOVRGEZ,\r\n SPARC_INS_MOVRGZ,\r\n SPARC_INS_MOVRLEZ,\r\n SPARC_INS_MOVRLZ,\r\n SPARC_INS_MOVRNZ,\r\n SPARC_INS_MOVRZ,\r\n SPARC_INS_MOVSTOSW,\r\n SPARC_INS_MOVSTOUW,\r\n SPARC_INS_MULX,\r\n SPARC_INS_NOP,\r\n SPARC_INS_ORCC,\r\n SPARC_INS_ORNCC,\r\n SPARC_INS_ORN,\r\n SPARC_INS_OR,\r\n SPARC_INS_PDIST,\r\n SPARC_INS_PDISTN,\r\n SPARC_INS_POPC,\r\n SPARC_INS_RD,\r\n SPARC_INS_RESTORE,\r\n SPARC_INS_RETT,\r\n SPARC_INS_SAVE,\r\n SPARC_INS_SDIVCC,\r\n SPARC_INS_SDIVX,\r\n SPARC_INS_SDIV,\r\n SPARC_INS_SETHI,\r\n SPARC_INS_SHUTDOWN,\r\n SPARC_INS_SIAM,\r\n SPARC_INS_SLLX,\r\n SPARC_INS_SLL,\r\n SPARC_INS_SMULCC,\r\n SPARC_INS_SMUL,\r\n SPARC_INS_SRAX,\r\n SPARC_INS_SRA,\r\n SPARC_INS_SRLX,\r\n SPARC_INS_SRL,\r\n SPARC_INS_STBAR,\r\n SPARC_INS_STB,\r\n SPARC_INS_STD,\r\n SPARC_INS_ST,\r\n SPARC_INS_STH,\r\n SPARC_INS_STQ,\r\n SPARC_INS_STX,\r\n SPARC_INS_SUBCC,\r\n SPARC_INS_SUBX,\r\n SPARC_INS_SUBXCC,\r\n SPARC_INS_SUB,\r\n SPARC_INS_SWAP,\r\n SPARC_INS_TADDCCTV,\r\n SPARC_INS_TADDCC,\r\n SPARC_INS_T,\r\n SPARC_INS_TSUBCCTV,\r\n SPARC_INS_TSUBCC,\r\n SPARC_INS_UDIVCC,\r\n SPARC_INS_UDIVX,\r\n SPARC_INS_UDIV,\r\n SPARC_INS_UMULCC,\r\n SPARC_INS_UMULXHI,\r\n SPARC_INS_UMUL,\r\n SPARC_INS_UNIMP,\r\n SPARC_INS_FCMPED,\r\n SPARC_INS_FCMPEQ,\r\n SPARC_INS_FCMPES,\r\n SPARC_INS_WR,\r\n SPARC_INS_XMULX,\r\n SPARC_INS_XMULXHI,\r\n SPARC_INS_XNORCC,\r\n SPARC_INS_XNOR,\r\n SPARC_INS_XORCC,\r\n SPARC_INS_XOR,\r\n\r\n // alias instructions\r\n SPARC_INS_RET,\r\n SPARC_INS_RETL,\r\n\r\n SPARC_INS_ENDING, // <-- mark the end of the list of instructions\r\n} sparc_insn;\r\n\r\n//> Group of SPARC instructions\r\ntypedef enum sparc_insn_group\r\n{\r\n SPARC_GRP_INVALID = 0, // = CS_GRP_INVALID\r\n\r\n //> Generic groups\r\n // all jump instructions (conditional+direct+indirect jumps)\r\n SPARC_GRP_JUMP, // = CS_GRP_JUMP\r\n\r\n //> Architecture-specific groups\r\n SPARC_GRP_HARDQUAD = 128,\r\n SPARC_GRP_V9,\r\n SPARC_GRP_VIS,\r\n SPARC_GRP_VIS2,\r\n SPARC_GRP_VIS3,\r\n SPARC_GRP_32BIT,\r\n SPARC_GRP_64BIT,\r\n\r\n SPARC_GRP_ENDING, // <-- mark the end of the list of groups\r\n} sparc_insn_group;\r\n\r\n#ifdef __cplusplus\r\n}\r\n#endif\r\n\r\n#endif\r\n" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/capstone/systemz.h", "content": "#ifndef CAPSTONE_SYSTEMZ_H\r\n#define CAPSTONE_SYSTEMZ_H\r\n\r\n/* Capstone Disassembly Engine */\r\n/* By Nguyen Anh Quynh , 2014-2015 */\r\n\r\n#ifdef __cplusplus\r\nextern \"C\" {\r\n#endif\r\n\r\n#include \"platform.h\"\r\n\r\n#ifdef _MSC_VER\r\n#pragma warning(disable:4201)\r\n#endif\r\n\r\n//> Enums corresponding to SystemZ condition codes\r\ntypedef enum sysz_cc\r\n{\r\n SYSZ_CC_INVALID = 0, // invalid CC (default)\r\n\r\n SYSZ_CC_O,\r\n SYSZ_CC_H,\r\n SYSZ_CC_NLE,\r\n SYSZ_CC_L,\r\n SYSZ_CC_NHE,\r\n SYSZ_CC_LH,\r\n SYSZ_CC_NE,\r\n SYSZ_CC_E,\r\n SYSZ_CC_NLH,\r\n SYSZ_CC_HE,\r\n SYSZ_CC_NL,\r\n SYSZ_CC_LE,\r\n SYSZ_CC_NH,\r\n SYSZ_CC_NO,\r\n} sysz_cc;\r\n\r\n//> Operand type for instruction's operands\r\ntypedef enum sysz_op_type\r\n{\r\n SYSZ_OP_INVALID = 0, // = CS_OP_INVALID (Uninitialized).\r\n SYSZ_OP_REG, // = CS_OP_REG (Register operand).\r\n SYSZ_OP_IMM, // = CS_OP_IMM (Immediate operand).\r\n SYSZ_OP_MEM, // = CS_OP_MEM (Memory operand).\r\n SYSZ_OP_ACREG = 64, // Access register operand.\r\n} sysz_op_type;\r\n\r\n//> SystemZ registers\r\ntypedef enum sysz_reg\r\n{\r\n SYSZ_REG_INVALID = 0,\r\n\r\n SYSZ_REG_0,\r\n SYSZ_REG_1,\r\n SYSZ_REG_2,\r\n SYSZ_REG_3,\r\n SYSZ_REG_4,\r\n SYSZ_REG_5,\r\n SYSZ_REG_6,\r\n SYSZ_REG_7,\r\n SYSZ_REG_8,\r\n SYSZ_REG_9,\r\n SYSZ_REG_10,\r\n SYSZ_REG_11,\r\n SYSZ_REG_12,\r\n SYSZ_REG_13,\r\n SYSZ_REG_14,\r\n SYSZ_REG_15,\r\n SYSZ_REG_CC,\r\n SYSZ_REG_F0,\r\n SYSZ_REG_F1,\r\n SYSZ_REG_F2,\r\n SYSZ_REG_F3,\r\n SYSZ_REG_F4,\r\n SYSZ_REG_F5,\r\n SYSZ_REG_F6,\r\n SYSZ_REG_F7,\r\n SYSZ_REG_F8,\r\n SYSZ_REG_F9,\r\n SYSZ_REG_F10,\r\n SYSZ_REG_F11,\r\n SYSZ_REG_F12,\r\n SYSZ_REG_F13,\r\n SYSZ_REG_F14,\r\n SYSZ_REG_F15,\r\n\r\n SYSZ_REG_R0L,\r\n\r\n SYSZ_REG_ENDING,\r\n} sysz_reg;\r\n\r\n// Instruction's operand referring to memory\r\n// This is associated with SYSZ_OP_MEM operand type above\r\ntypedef struct sysz_op_mem\r\n{\r\n uint8_t base; // base register, can be safely interpreted as\r\n // a value of type `sysz_reg`, but it is only\r\n // one byte wide\r\n uint8_t index; // index register, same conditions apply here\r\n uint64_t length; // BDLAddr operand\r\n int64_t disp; // displacement/offset value\r\n} sysz_op_mem;\r\n\r\n// Instruction operand\r\ntypedef struct cs_sysz_op\r\n{\r\n sysz_op_type type; // operand type\r\n union\r\n {\r\n sysz_reg reg; // register value for REG operand\r\n int64_t imm; // immediate value for IMM operand\r\n sysz_op_mem mem; // base/disp value for MEM operand\r\n };\r\n} cs_sysz_op;\r\n\r\n// Instruction structure\r\ntypedef struct cs_sysz\r\n{\r\n sysz_cc cc; // Code condition\r\n // Number of operands of this instruction,\r\n // or 0 when instruction has no operand.\r\n uint8_t op_count;\r\n cs_sysz_op operands[6]; // operands for this instruction.\r\n} cs_sysz;\r\n\r\n//> SystemZ instruction\r\ntypedef enum sysz_insn\r\n{\r\n SYSZ_INS_INVALID = 0,\r\n\r\n SYSZ_INS_A,\r\n SYSZ_INS_ADB,\r\n SYSZ_INS_ADBR,\r\n SYSZ_INS_AEB,\r\n SYSZ_INS_AEBR,\r\n SYSZ_INS_AFI,\r\n SYSZ_INS_AG,\r\n SYSZ_INS_AGF,\r\n SYSZ_INS_AGFI,\r\n SYSZ_INS_AGFR,\r\n SYSZ_INS_AGHI,\r\n SYSZ_INS_AGHIK,\r\n SYSZ_INS_AGR,\r\n SYSZ_INS_AGRK,\r\n SYSZ_INS_AGSI,\r\n SYSZ_INS_AH,\r\n SYSZ_INS_AHI,\r\n SYSZ_INS_AHIK,\r\n SYSZ_INS_AHY,\r\n SYSZ_INS_AIH,\r\n SYSZ_INS_AL,\r\n SYSZ_INS_ALC,\r\n SYSZ_INS_ALCG,\r\n SYSZ_INS_ALCGR,\r\n SYSZ_INS_ALCR,\r\n SYSZ_INS_ALFI,\r\n SYSZ_INS_ALG,\r\n SYSZ_INS_ALGF,\r\n SYSZ_INS_ALGFI,\r\n SYSZ_INS_ALGFR,\r\n SYSZ_INS_ALGHSIK,\r\n SYSZ_INS_ALGR,\r\n SYSZ_INS_ALGRK,\r\n SYSZ_INS_ALHSIK,\r\n SYSZ_INS_ALR,\r\n SYSZ_INS_ALRK,\r\n SYSZ_INS_ALY,\r\n SYSZ_INS_AR,\r\n SYSZ_INS_ARK,\r\n SYSZ_INS_ASI,\r\n SYSZ_INS_AXBR,\r\n SYSZ_INS_AY,\r\n SYSZ_INS_BCR,\r\n SYSZ_INS_BRC,\r\n SYSZ_INS_BRCL,\r\n SYSZ_INS_CGIJ,\r\n SYSZ_INS_CGRJ,\r\n SYSZ_INS_CIJ,\r\n SYSZ_INS_CLGIJ,\r\n SYSZ_INS_CLGRJ,\r\n SYSZ_INS_CLIJ,\r\n SYSZ_INS_CLRJ,\r\n SYSZ_INS_CRJ,\r\n SYSZ_INS_BER,\r\n SYSZ_INS_JE,\r\n SYSZ_INS_JGE,\r\n SYSZ_INS_LOCE,\r\n SYSZ_INS_LOCGE,\r\n SYSZ_INS_LOCGRE,\r\n SYSZ_INS_LOCRE,\r\n SYSZ_INS_STOCE,\r\n SYSZ_INS_STOCGE,\r\n SYSZ_INS_BHR,\r\n SYSZ_INS_BHER,\r\n SYSZ_INS_JHE,\r\n SYSZ_INS_JGHE,\r\n SYSZ_INS_LOCHE,\r\n SYSZ_INS_LOCGHE,\r\n SYSZ_INS_LOCGRHE,\r\n SYSZ_INS_LOCRHE,\r\n SYSZ_INS_STOCHE,\r\n SYSZ_INS_STOCGHE,\r\n SYSZ_INS_JH,\r\n SYSZ_INS_JGH,\r\n SYSZ_INS_LOCH,\r\n SYSZ_INS_LOCGH,\r\n SYSZ_INS_LOCGRH,\r\n SYSZ_INS_LOCRH,\r\n SYSZ_INS_STOCH,\r\n SYSZ_INS_STOCGH,\r\n SYSZ_INS_CGIJNLH,\r\n SYSZ_INS_CGRJNLH,\r\n SYSZ_INS_CIJNLH,\r\n SYSZ_INS_CLGIJNLH,\r\n SYSZ_INS_CLGRJNLH,\r\n SYSZ_INS_CLIJNLH,\r\n SYSZ_INS_CLRJNLH,\r\n SYSZ_INS_CRJNLH,\r\n SYSZ_INS_CGIJE,\r\n SYSZ_INS_CGRJE,\r\n SYSZ_INS_CIJE,\r\n SYSZ_INS_CLGIJE,\r\n SYSZ_INS_CLGRJE,\r\n SYSZ_INS_CLIJE,\r\n SYSZ_INS_CLRJE,\r\n SYSZ_INS_CRJE,\r\n SYSZ_INS_CGIJNLE,\r\n SYSZ_INS_CGRJNLE,\r\n SYSZ_INS_CIJNLE,\r\n SYSZ_INS_CLGIJNLE,\r\n SYSZ_INS_CLGRJNLE,\r\n SYSZ_INS_CLIJNLE,\r\n SYSZ_INS_CLRJNLE,\r\n SYSZ_INS_CRJNLE,\r\n SYSZ_INS_CGIJH,\r\n SYSZ_INS_CGRJH,\r\n SYSZ_INS_CIJH,\r\n SYSZ_INS_CLGIJH,\r\n SYSZ_INS_CLGRJH,\r\n SYSZ_INS_CLIJH,\r\n SYSZ_INS_CLRJH,\r\n SYSZ_INS_CRJH,\r\n SYSZ_INS_CGIJNL,\r\n SYSZ_INS_CGRJNL,\r\n SYSZ_INS_CIJNL,\r\n SYSZ_INS_CLGIJNL,\r\n SYSZ_INS_CLGRJNL,\r\n SYSZ_INS_CLIJNL,\r\n SYSZ_INS_CLRJNL,\r\n SYSZ_INS_CRJNL,\r\n SYSZ_INS_CGIJHE,\r\n SYSZ_INS_CGRJHE,\r\n SYSZ_INS_CIJHE,\r\n SYSZ_INS_CLGIJHE,\r\n SYSZ_INS_CLGRJHE,\r\n SYSZ_INS_CLIJHE,\r\n SYSZ_INS_CLRJHE,\r\n SYSZ_INS_CRJHE,\r\n SYSZ_INS_CGIJNHE,\r\n SYSZ_INS_CGRJNHE,\r\n SYSZ_INS_CIJNHE,\r\n SYSZ_INS_CLGIJNHE,\r\n SYSZ_INS_CLGRJNHE,\r\n SYSZ_INS_CLIJNHE,\r\n SYSZ_INS_CLRJNHE,\r\n SYSZ_INS_CRJNHE,\r\n SYSZ_INS_CGIJL,\r\n SYSZ_INS_CGRJL,\r\n SYSZ_INS_CIJL,\r\n SYSZ_INS_CLGIJL,\r\n SYSZ_INS_CLGRJL,\r\n SYSZ_INS_CLIJL,\r\n SYSZ_INS_CLRJL,\r\n SYSZ_INS_CRJL,\r\n SYSZ_INS_CGIJNH,\r\n SYSZ_INS_CGRJNH,\r\n SYSZ_INS_CIJNH,\r\n SYSZ_INS_CLGIJNH,\r\n SYSZ_INS_CLGRJNH,\r\n SYSZ_INS_CLIJNH,\r\n SYSZ_INS_CLRJNH,\r\n SYSZ_INS_CRJNH,\r\n SYSZ_INS_CGIJLE,\r\n SYSZ_INS_CGRJLE,\r\n SYSZ_INS_CIJLE,\r\n SYSZ_INS_CLGIJLE,\r\n SYSZ_INS_CLGRJLE,\r\n SYSZ_INS_CLIJLE,\r\n SYSZ_INS_CLRJLE,\r\n SYSZ_INS_CRJLE,\r\n SYSZ_INS_CGIJNE,\r\n SYSZ_INS_CGRJNE,\r\n SYSZ_INS_CIJNE,\r\n SYSZ_INS_CLGIJNE,\r\n SYSZ_INS_CLGRJNE,\r\n SYSZ_INS_CLIJNE,\r\n SYSZ_INS_CLRJNE,\r\n SYSZ_INS_CRJNE,\r\n SYSZ_INS_CGIJLH,\r\n SYSZ_INS_CGRJLH,\r\n SYSZ_INS_CIJLH,\r\n SYSZ_INS_CLGIJLH,\r\n SYSZ_INS_CLGRJLH,\r\n SYSZ_INS_CLIJLH,\r\n SYSZ_INS_CLRJLH,\r\n SYSZ_INS_CRJLH,\r\n SYSZ_INS_BLR,\r\n SYSZ_INS_BLER,\r\n SYSZ_INS_JLE,\r\n SYSZ_INS_JGLE,\r\n SYSZ_INS_LOCLE,\r\n SYSZ_INS_LOCGLE,\r\n SYSZ_INS_LOCGRLE,\r\n SYSZ_INS_LOCRLE,\r\n SYSZ_INS_STOCLE,\r\n SYSZ_INS_STOCGLE,\r\n SYSZ_INS_BLHR,\r\n SYSZ_INS_JLH,\r\n SYSZ_INS_JGLH,\r\n SYSZ_INS_LOCLH,\r\n SYSZ_INS_LOCGLH,\r\n SYSZ_INS_LOCGRLH,\r\n SYSZ_INS_LOCRLH,\r\n SYSZ_INS_STOCLH,\r\n SYSZ_INS_STOCGLH,\r\n SYSZ_INS_JL,\r\n SYSZ_INS_JGL,\r\n SYSZ_INS_LOCL,\r\n SYSZ_INS_LOCGL,\r\n SYSZ_INS_LOCGRL,\r\n SYSZ_INS_LOCRL,\r\n SYSZ_INS_LOC,\r\n SYSZ_INS_LOCG,\r\n SYSZ_INS_LOCGR,\r\n SYSZ_INS_LOCR,\r\n SYSZ_INS_STOCL,\r\n SYSZ_INS_STOCGL,\r\n SYSZ_INS_BNER,\r\n SYSZ_INS_JNE,\r\n SYSZ_INS_JGNE,\r\n SYSZ_INS_LOCNE,\r\n SYSZ_INS_LOCGNE,\r\n SYSZ_INS_LOCGRNE,\r\n SYSZ_INS_LOCRNE,\r\n SYSZ_INS_STOCNE,\r\n SYSZ_INS_STOCGNE,\r\n SYSZ_INS_BNHR,\r\n SYSZ_INS_BNHER,\r\n SYSZ_INS_JNHE,\r\n SYSZ_INS_JGNHE,\r\n SYSZ_INS_LOCNHE,\r\n SYSZ_INS_LOCGNHE,\r\n SYSZ_INS_LOCGRNHE,\r\n SYSZ_INS_LOCRNHE,\r\n SYSZ_INS_STOCNHE,\r\n SYSZ_INS_STOCGNHE,\r\n SYSZ_INS_JNH,\r\n SYSZ_INS_JGNH,\r\n SYSZ_INS_LOCNH,\r\n SYSZ_INS_LOCGNH,\r\n SYSZ_INS_LOCGRNH,\r\n SYSZ_INS_LOCRNH,\r\n SYSZ_INS_STOCNH,\r\n SYSZ_INS_STOCGNH,\r\n SYSZ_INS_BNLR,\r\n SYSZ_INS_BNLER,\r\n SYSZ_INS_JNLE,\r\n SYSZ_INS_JGNLE,\r\n SYSZ_INS_LOCNLE,\r\n SYSZ_INS_LOCGNLE,\r\n SYSZ_INS_LOCGRNLE,\r\n SYSZ_INS_LOCRNLE,\r\n SYSZ_INS_STOCNLE,\r\n SYSZ_INS_STOCGNLE,\r\n SYSZ_INS_BNLHR,\r\n SYSZ_INS_JNLH,\r\n SYSZ_INS_JGNLH,\r\n SYSZ_INS_LOCNLH,\r\n SYSZ_INS_LOCGNLH,\r\n SYSZ_INS_LOCGRNLH,\r\n SYSZ_INS_LOCRNLH,\r\n SYSZ_INS_STOCNLH,\r\n SYSZ_INS_STOCGNLH,\r\n SYSZ_INS_JNL,\r\n SYSZ_INS_JGNL,\r\n SYSZ_INS_LOCNL,\r\n SYSZ_INS_LOCGNL,\r\n SYSZ_INS_LOCGRNL,\r\n SYSZ_INS_LOCRNL,\r\n SYSZ_INS_STOCNL,\r\n SYSZ_INS_STOCGNL,\r\n SYSZ_INS_BNOR,\r\n SYSZ_INS_JNO,\r\n SYSZ_INS_JGNO,\r\n SYSZ_INS_LOCNO,\r\n SYSZ_INS_LOCGNO,\r\n SYSZ_INS_LOCGRNO,\r\n SYSZ_INS_LOCRNO,\r\n SYSZ_INS_STOCNO,\r\n SYSZ_INS_STOCGNO,\r\n SYSZ_INS_BOR,\r\n SYSZ_INS_JO,\r\n SYSZ_INS_JGO,\r\n SYSZ_INS_LOCO,\r\n SYSZ_INS_LOCGO,\r\n SYSZ_INS_LOCGRO,\r\n SYSZ_INS_LOCRO,\r\n SYSZ_INS_STOCO,\r\n SYSZ_INS_STOCGO,\r\n SYSZ_INS_STOC,\r\n SYSZ_INS_STOCG,\r\n SYSZ_INS_BASR,\r\n SYSZ_INS_BR,\r\n SYSZ_INS_BRAS,\r\n SYSZ_INS_BRASL,\r\n SYSZ_INS_J,\r\n SYSZ_INS_JG,\r\n SYSZ_INS_BRCT,\r\n SYSZ_INS_BRCTG,\r\n SYSZ_INS_C,\r\n SYSZ_INS_CDB,\r\n SYSZ_INS_CDBR,\r\n SYSZ_INS_CDFBR,\r\n SYSZ_INS_CDGBR,\r\n SYSZ_INS_CDLFBR,\r\n SYSZ_INS_CDLGBR,\r\n SYSZ_INS_CEB,\r\n SYSZ_INS_CEBR,\r\n SYSZ_INS_CEFBR,\r\n SYSZ_INS_CEGBR,\r\n SYSZ_INS_CELFBR,\r\n SYSZ_INS_CELGBR,\r\n SYSZ_INS_CFDBR,\r\n SYSZ_INS_CFEBR,\r\n SYSZ_INS_CFI,\r\n SYSZ_INS_CFXBR,\r\n SYSZ_INS_CG,\r\n SYSZ_INS_CGDBR,\r\n SYSZ_INS_CGEBR,\r\n SYSZ_INS_CGF,\r\n SYSZ_INS_CGFI,\r\n SYSZ_INS_CGFR,\r\n SYSZ_INS_CGFRL,\r\n SYSZ_INS_CGH,\r\n SYSZ_INS_CGHI,\r\n SYSZ_INS_CGHRL,\r\n SYSZ_INS_CGHSI,\r\n SYSZ_INS_CGR,\r\n SYSZ_INS_CGRL,\r\n SYSZ_INS_CGXBR,\r\n SYSZ_INS_CH,\r\n SYSZ_INS_CHF,\r\n SYSZ_INS_CHHSI,\r\n SYSZ_INS_CHI,\r\n SYSZ_INS_CHRL,\r\n SYSZ_INS_CHSI,\r\n SYSZ_INS_CHY,\r\n SYSZ_INS_CIH,\r\n SYSZ_INS_CL,\r\n SYSZ_INS_CLC,\r\n SYSZ_INS_CLFDBR,\r\n SYSZ_INS_CLFEBR,\r\n SYSZ_INS_CLFHSI,\r\n SYSZ_INS_CLFI,\r\n SYSZ_INS_CLFXBR,\r\n SYSZ_INS_CLG,\r\n SYSZ_INS_CLGDBR,\r\n SYSZ_INS_CLGEBR,\r\n SYSZ_INS_CLGF,\r\n SYSZ_INS_CLGFI,\r\n SYSZ_INS_CLGFR,\r\n SYSZ_INS_CLGFRL,\r\n SYSZ_INS_CLGHRL,\r\n SYSZ_INS_CLGHSI,\r\n SYSZ_INS_CLGR,\r\n SYSZ_INS_CLGRL,\r\n SYSZ_INS_CLGXBR,\r\n SYSZ_INS_CLHF,\r\n SYSZ_INS_CLHHSI,\r\n SYSZ_INS_CLHRL,\r\n SYSZ_INS_CLI,\r\n SYSZ_INS_CLIH,\r\n SYSZ_INS_CLIY,\r\n SYSZ_INS_CLR,\r\n SYSZ_INS_CLRL,\r\n SYSZ_INS_CLST,\r\n SYSZ_INS_CLY,\r\n SYSZ_INS_CPSDR,\r\n SYSZ_INS_CR,\r\n SYSZ_INS_CRL,\r\n SYSZ_INS_CS,\r\n SYSZ_INS_CSG,\r\n SYSZ_INS_CSY,\r\n SYSZ_INS_CXBR,\r\n SYSZ_INS_CXFBR,\r\n SYSZ_INS_CXGBR,\r\n SYSZ_INS_CXLFBR,\r\n SYSZ_INS_CXLGBR,\r\n SYSZ_INS_CY,\r\n SYSZ_INS_DDB,\r\n SYSZ_INS_DDBR,\r\n SYSZ_INS_DEB,\r\n SYSZ_INS_DEBR,\r\n SYSZ_INS_DL,\r\n SYSZ_INS_DLG,\r\n SYSZ_INS_DLGR,\r\n SYSZ_INS_DLR,\r\n SYSZ_INS_DSG,\r\n SYSZ_INS_DSGF,\r\n SYSZ_INS_DSGFR,\r\n SYSZ_INS_DSGR,\r\n SYSZ_INS_DXBR,\r\n SYSZ_INS_EAR,\r\n SYSZ_INS_FIDBR,\r\n SYSZ_INS_FIDBRA,\r\n SYSZ_INS_FIEBR,\r\n SYSZ_INS_FIEBRA,\r\n SYSZ_INS_FIXBR,\r\n SYSZ_INS_FIXBRA,\r\n SYSZ_INS_FLOGR,\r\n SYSZ_INS_IC,\r\n SYSZ_INS_ICY,\r\n SYSZ_INS_IIHF,\r\n SYSZ_INS_IIHH,\r\n SYSZ_INS_IIHL,\r\n SYSZ_INS_IILF,\r\n SYSZ_INS_IILH,\r\n SYSZ_INS_IILL,\r\n SYSZ_INS_IPM,\r\n SYSZ_INS_L,\r\n SYSZ_INS_LA,\r\n SYSZ_INS_LAA,\r\n SYSZ_INS_LAAG,\r\n SYSZ_INS_LAAL,\r\n SYSZ_INS_LAALG,\r\n SYSZ_INS_LAN,\r\n SYSZ_INS_LANG,\r\n SYSZ_INS_LAO,\r\n SYSZ_INS_LAOG,\r\n SYSZ_INS_LARL,\r\n SYSZ_INS_LAX,\r\n SYSZ_INS_LAXG,\r\n SYSZ_INS_LAY,\r\n SYSZ_INS_LB,\r\n SYSZ_INS_LBH,\r\n SYSZ_INS_LBR,\r\n SYSZ_INS_LCDBR,\r\n SYSZ_INS_LCEBR,\r\n SYSZ_INS_LCGFR,\r\n SYSZ_INS_LCGR,\r\n SYSZ_INS_LCR,\r\n SYSZ_INS_LCXBR,\r\n SYSZ_INS_LD,\r\n SYSZ_INS_LDEB,\r\n SYSZ_INS_LDEBR,\r\n SYSZ_INS_LDGR,\r\n SYSZ_INS_LDR,\r\n SYSZ_INS_LDXBR,\r\n SYSZ_INS_LDXBRA,\r\n SYSZ_INS_LDY,\r\n SYSZ_INS_LE,\r\n SYSZ_INS_LEDBR,\r\n SYSZ_INS_LEDBRA,\r\n SYSZ_INS_LER,\r\n SYSZ_INS_LEXBR,\r\n SYSZ_INS_LEXBRA,\r\n SYSZ_INS_LEY,\r\n SYSZ_INS_LFH,\r\n SYSZ_INS_LG,\r\n SYSZ_INS_LGB,\r\n SYSZ_INS_LGBR,\r\n SYSZ_INS_LGDR,\r\n SYSZ_INS_LGF,\r\n SYSZ_INS_LGFI,\r\n SYSZ_INS_LGFR,\r\n SYSZ_INS_LGFRL,\r\n SYSZ_INS_LGH,\r\n SYSZ_INS_LGHI,\r\n SYSZ_INS_LGHR,\r\n SYSZ_INS_LGHRL,\r\n SYSZ_INS_LGR,\r\n SYSZ_INS_LGRL,\r\n SYSZ_INS_LH,\r\n SYSZ_INS_LHH,\r\n SYSZ_INS_LHI,\r\n SYSZ_INS_LHR,\r\n SYSZ_INS_LHRL,\r\n SYSZ_INS_LHY,\r\n SYSZ_INS_LLC,\r\n SYSZ_INS_LLCH,\r\n SYSZ_INS_LLCR,\r\n SYSZ_INS_LLGC,\r\n SYSZ_INS_LLGCR,\r\n SYSZ_INS_LLGF,\r\n SYSZ_INS_LLGFR,\r\n SYSZ_INS_LLGFRL,\r\n SYSZ_INS_LLGH,\r\n SYSZ_INS_LLGHR,\r\n SYSZ_INS_LLGHRL,\r\n SYSZ_INS_LLH,\r\n SYSZ_INS_LLHH,\r\n SYSZ_INS_LLHR,\r\n SYSZ_INS_LLHRL,\r\n SYSZ_INS_LLIHF,\r\n SYSZ_INS_LLIHH,\r\n SYSZ_INS_LLIHL,\r\n SYSZ_INS_LLILF,\r\n SYSZ_INS_LLILH,\r\n SYSZ_INS_LLILL,\r\n SYSZ_INS_LMG,\r\n SYSZ_INS_LNDBR,\r\n SYSZ_INS_LNEBR,\r\n SYSZ_INS_LNGFR,\r\n SYSZ_INS_LNGR,\r\n SYSZ_INS_LNR,\r\n SYSZ_INS_LNXBR,\r\n SYSZ_INS_LPDBR,\r\n SYSZ_INS_LPEBR,\r\n SYSZ_INS_LPGFR,\r\n SYSZ_INS_LPGR,\r\n SYSZ_INS_LPR,\r\n SYSZ_INS_LPXBR,\r\n SYSZ_INS_LR,\r\n SYSZ_INS_LRL,\r\n SYSZ_INS_LRV,\r\n SYSZ_INS_LRVG,\r\n SYSZ_INS_LRVGR,\r\n SYSZ_INS_LRVR,\r\n SYSZ_INS_LT,\r\n SYSZ_INS_LTDBR,\r\n SYSZ_INS_LTEBR,\r\n SYSZ_INS_LTG,\r\n SYSZ_INS_LTGF,\r\n SYSZ_INS_LTGFR,\r\n SYSZ_INS_LTGR,\r\n SYSZ_INS_LTR,\r\n SYSZ_INS_LTXBR,\r\n SYSZ_INS_LXDB,\r\n SYSZ_INS_LXDBR,\r\n SYSZ_INS_LXEB,\r\n SYSZ_INS_LXEBR,\r\n SYSZ_INS_LXR,\r\n SYSZ_INS_LY,\r\n SYSZ_INS_LZDR,\r\n SYSZ_INS_LZER,\r\n SYSZ_INS_LZXR,\r\n SYSZ_INS_MADB,\r\n SYSZ_INS_MADBR,\r\n SYSZ_INS_MAEB,\r\n SYSZ_INS_MAEBR,\r\n SYSZ_INS_MDB,\r\n SYSZ_INS_MDBR,\r\n SYSZ_INS_MDEB,\r\n SYSZ_INS_MDEBR,\r\n SYSZ_INS_MEEB,\r\n SYSZ_INS_MEEBR,\r\n SYSZ_INS_MGHI,\r\n SYSZ_INS_MH,\r\n SYSZ_INS_MHI,\r\n SYSZ_INS_MHY,\r\n SYSZ_INS_MLG,\r\n SYSZ_INS_MLGR,\r\n SYSZ_INS_MS,\r\n SYSZ_INS_MSDB,\r\n SYSZ_INS_MSDBR,\r\n SYSZ_INS_MSEB,\r\n SYSZ_INS_MSEBR,\r\n SYSZ_INS_MSFI,\r\n SYSZ_INS_MSG,\r\n SYSZ_INS_MSGF,\r\n SYSZ_INS_MSGFI,\r\n SYSZ_INS_MSGFR,\r\n SYSZ_INS_MSGR,\r\n SYSZ_INS_MSR,\r\n SYSZ_INS_MSY,\r\n SYSZ_INS_MVC,\r\n SYSZ_INS_MVGHI,\r\n SYSZ_INS_MVHHI,\r\n SYSZ_INS_MVHI,\r\n SYSZ_INS_MVI,\r\n SYSZ_INS_MVIY,\r\n SYSZ_INS_MVST,\r\n SYSZ_INS_MXBR,\r\n SYSZ_INS_MXDB,\r\n SYSZ_INS_MXDBR,\r\n SYSZ_INS_N,\r\n SYSZ_INS_NC,\r\n SYSZ_INS_NG,\r\n SYSZ_INS_NGR,\r\n SYSZ_INS_NGRK,\r\n SYSZ_INS_NI,\r\n SYSZ_INS_NIHF,\r\n SYSZ_INS_NIHH,\r\n SYSZ_INS_NIHL,\r\n SYSZ_INS_NILF,\r\n SYSZ_INS_NILH,\r\n SYSZ_INS_NILL,\r\n SYSZ_INS_NIY,\r\n SYSZ_INS_NR,\r\n SYSZ_INS_NRK,\r\n SYSZ_INS_NY,\r\n SYSZ_INS_O,\r\n SYSZ_INS_OC,\r\n SYSZ_INS_OG,\r\n SYSZ_INS_OGR,\r\n SYSZ_INS_OGRK,\r\n SYSZ_INS_OI,\r\n SYSZ_INS_OIHF,\r\n SYSZ_INS_OIHH,\r\n SYSZ_INS_OIHL,\r\n SYSZ_INS_OILF,\r\n SYSZ_INS_OILH,\r\n SYSZ_INS_OILL,\r\n SYSZ_INS_OIY,\r\n SYSZ_INS_OR,\r\n SYSZ_INS_ORK,\r\n SYSZ_INS_OY,\r\n SYSZ_INS_PFD,\r\n SYSZ_INS_PFDRL,\r\n SYSZ_INS_RISBG,\r\n SYSZ_INS_RISBHG,\r\n SYSZ_INS_RISBLG,\r\n SYSZ_INS_RLL,\r\n SYSZ_INS_RLLG,\r\n SYSZ_INS_RNSBG,\r\n SYSZ_INS_ROSBG,\r\n SYSZ_INS_RXSBG,\r\n SYSZ_INS_S,\r\n SYSZ_INS_SDB,\r\n SYSZ_INS_SDBR,\r\n SYSZ_INS_SEB,\r\n SYSZ_INS_SEBR,\r\n SYSZ_INS_SG,\r\n SYSZ_INS_SGF,\r\n SYSZ_INS_SGFR,\r\n SYSZ_INS_SGR,\r\n SYSZ_INS_SGRK,\r\n SYSZ_INS_SH,\r\n SYSZ_INS_SHY,\r\n SYSZ_INS_SL,\r\n SYSZ_INS_SLB,\r\n SYSZ_INS_SLBG,\r\n SYSZ_INS_SLBR,\r\n SYSZ_INS_SLFI,\r\n SYSZ_INS_SLG,\r\n SYSZ_INS_SLBGR,\r\n SYSZ_INS_SLGF,\r\n SYSZ_INS_SLGFI,\r\n SYSZ_INS_SLGFR,\r\n SYSZ_INS_SLGR,\r\n SYSZ_INS_SLGRK,\r\n SYSZ_INS_SLL,\r\n SYSZ_INS_SLLG,\r\n SYSZ_INS_SLLK,\r\n SYSZ_INS_SLR,\r\n SYSZ_INS_SLRK,\r\n SYSZ_INS_SLY,\r\n SYSZ_INS_SQDB,\r\n SYSZ_INS_SQDBR,\r\n SYSZ_INS_SQEB,\r\n SYSZ_INS_SQEBR,\r\n SYSZ_INS_SQXBR,\r\n SYSZ_INS_SR,\r\n SYSZ_INS_SRA,\r\n SYSZ_INS_SRAG,\r\n SYSZ_INS_SRAK,\r\n SYSZ_INS_SRK,\r\n SYSZ_INS_SRL,\r\n SYSZ_INS_SRLG,\r\n SYSZ_INS_SRLK,\r\n SYSZ_INS_SRST,\r\n SYSZ_INS_ST,\r\n SYSZ_INS_STC,\r\n SYSZ_INS_STCH,\r\n SYSZ_INS_STCY,\r\n SYSZ_INS_STD,\r\n SYSZ_INS_STDY,\r\n SYSZ_INS_STE,\r\n SYSZ_INS_STEY,\r\n SYSZ_INS_STFH,\r\n SYSZ_INS_STG,\r\n SYSZ_INS_STGRL,\r\n SYSZ_INS_STH,\r\n SYSZ_INS_STHH,\r\n SYSZ_INS_STHRL,\r\n SYSZ_INS_STHY,\r\n SYSZ_INS_STMG,\r\n SYSZ_INS_STRL,\r\n SYSZ_INS_STRV,\r\n SYSZ_INS_STRVG,\r\n SYSZ_INS_STY,\r\n SYSZ_INS_SXBR,\r\n SYSZ_INS_SY,\r\n SYSZ_INS_TM,\r\n SYSZ_INS_TMHH,\r\n SYSZ_INS_TMHL,\r\n SYSZ_INS_TMLH,\r\n SYSZ_INS_TMLL,\r\n SYSZ_INS_TMY,\r\n SYSZ_INS_X,\r\n SYSZ_INS_XC,\r\n SYSZ_INS_XG,\r\n SYSZ_INS_XGR,\r\n SYSZ_INS_XGRK,\r\n SYSZ_INS_XI,\r\n SYSZ_INS_XIHF,\r\n SYSZ_INS_XILF,\r\n SYSZ_INS_XIY,\r\n SYSZ_INS_XR,\r\n SYSZ_INS_XRK,\r\n SYSZ_INS_XY,\r\n\r\n SYSZ_INS_ENDING, // <-- mark the end of the list of instructions\r\n} sysz_insn;\r\n\r\n//> Group of SystemZ instructions\r\ntypedef enum sysz_insn_group\r\n{\r\n SYSZ_GRP_INVALID = 0, // = CS_GRP_INVALID\r\n\r\n //> Generic groups\r\n // all jump instructions (conditional+direct+indirect jumps)\r\n SYSZ_GRP_JUMP, // = CS_GRP_JUMP\r\n\r\n //> Architecture-specific groups\r\n SYSZ_GRP_DISTINCTOPS = 128,\r\n SYSZ_GRP_FPEXTENSION,\r\n SYSZ_GRP_HIGHWORD,\r\n SYSZ_GRP_INTERLOCKEDACCESS1,\r\n SYSZ_GRP_LOADSTOREONCOND,\r\n\r\n SYSZ_GRP_ENDING, // <-- mark the end of the list of groups\r\n} sysz_insn_group;\r\n\r\n#ifdef __cplusplus\r\n}\r\n#endif\r\n\r\n#endif\r\n" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/capstone/x86.h", "content": "#ifndef CAPSTONE_X86_H\r\n#define CAPSTONE_X86_H\r\n\r\n/* Capstone Disassembly Engine */\r\n/* By Nguyen Anh Quynh , 2013-2015 */\r\n\r\n#ifdef __cplusplus\r\nextern \"C\" {\r\n#endif\r\n\r\n#include \"platform.h\"\r\n\r\n// Calculate relative address for X86-64, given cs_insn structure\r\n#define X86_REL_ADDR(insn) (((insn).detail->x86.operands[0].type == X86_OP_IMM) \\\r\n ? (uint64_t)((insn).detail->x86.operands[0].imm) \\\r\n : (((insn).address + (insn).size) + (uint64_t)(insn).detail->x86.disp))\r\n\r\n//> X86 registers\r\ntypedef enum x86_reg\r\n{\r\n X86_REG_INVALID = 0,\r\n X86_REG_AH, X86_REG_AL, X86_REG_AX, X86_REG_BH, X86_REG_BL,\r\n X86_REG_BP, X86_REG_BPL, X86_REG_BX, X86_REG_CH, X86_REG_CL,\r\n X86_REG_CS, X86_REG_CX, X86_REG_DH, X86_REG_DI, X86_REG_DIL,\r\n X86_REG_DL, X86_REG_DS, X86_REG_DX, X86_REG_EAX, X86_REG_EBP,\r\n X86_REG_EBX, X86_REG_ECX, X86_REG_EDI, X86_REG_EDX, X86_REG_EFLAGS,\r\n X86_REG_EIP, X86_REG_EIZ, X86_REG_ES, X86_REG_ESI, X86_REG_ESP,\r\n X86_REG_FPSW, X86_REG_FS, X86_REG_GS, X86_REG_IP, X86_REG_RAX,\r\n X86_REG_RBP, X86_REG_RBX, X86_REG_RCX, X86_REG_RDI, X86_REG_RDX,\r\n X86_REG_RIP, X86_REG_RIZ, X86_REG_RSI, X86_REG_RSP, X86_REG_SI,\r\n X86_REG_SIL, X86_REG_SP, X86_REG_SPL, X86_REG_SS, X86_REG_CR0,\r\n X86_REG_CR1, X86_REG_CR2, X86_REG_CR3, X86_REG_CR4, X86_REG_CR5,\r\n X86_REG_CR6, X86_REG_CR7, X86_REG_CR8, X86_REG_CR9, X86_REG_CR10,\r\n X86_REG_CR11, X86_REG_CR12, X86_REG_CR13, X86_REG_CR14, X86_REG_CR15,\r\n X86_REG_DR0, X86_REG_DR1, X86_REG_DR2, X86_REG_DR3, X86_REG_DR4,\r\n X86_REG_DR5, X86_REG_DR6, X86_REG_DR7, X86_REG_DR8, X86_REG_DR9,\r\n X86_REG_DR10, X86_REG_DR11, X86_REG_DR12, X86_REG_DR13, X86_REG_DR14,\r\n X86_REG_DR15, X86_REG_FP0, X86_REG_FP1, X86_REG_FP2, X86_REG_FP3,\r\n X86_REG_FP4, X86_REG_FP5, X86_REG_FP6, X86_REG_FP7,\r\n X86_REG_K0, X86_REG_K1, X86_REG_K2, X86_REG_K3, X86_REG_K4,\r\n X86_REG_K5, X86_REG_K6, X86_REG_K7, X86_REG_MM0, X86_REG_MM1,\r\n X86_REG_MM2, X86_REG_MM3, X86_REG_MM4, X86_REG_MM5, X86_REG_MM6,\r\n X86_REG_MM7, X86_REG_R8, X86_REG_R9, X86_REG_R10, X86_REG_R11,\r\n X86_REG_R12, X86_REG_R13, X86_REG_R14, X86_REG_R15,\r\n X86_REG_ST0, X86_REG_ST1, X86_REG_ST2, X86_REG_ST3,\r\n X86_REG_ST4, X86_REG_ST5, X86_REG_ST6, X86_REG_ST7,\r\n X86_REG_XMM0, X86_REG_XMM1, X86_REG_XMM2, X86_REG_XMM3, X86_REG_XMM4,\r\n X86_REG_XMM5, X86_REG_XMM6, X86_REG_XMM7, X86_REG_XMM8, X86_REG_XMM9,\r\n X86_REG_XMM10, X86_REG_XMM11, X86_REG_XMM12, X86_REG_XMM13, X86_REG_XMM14,\r\n X86_REG_XMM15, X86_REG_XMM16, X86_REG_XMM17, X86_REG_XMM18, X86_REG_XMM19,\r\n X86_REG_XMM20, X86_REG_XMM21, X86_REG_XMM22, X86_REG_XMM23, X86_REG_XMM24,\r\n X86_REG_XMM25, X86_REG_XMM26, X86_REG_XMM27, X86_REG_XMM28, X86_REG_XMM29,\r\n X86_REG_XMM30, X86_REG_XMM31, X86_REG_YMM0, X86_REG_YMM1, X86_REG_YMM2,\r\n X86_REG_YMM3, X86_REG_YMM4, X86_REG_YMM5, X86_REG_YMM6, X86_REG_YMM7,\r\n X86_REG_YMM8, X86_REG_YMM9, X86_REG_YMM10, X86_REG_YMM11, X86_REG_YMM12,\r\n X86_REG_YMM13, X86_REG_YMM14, X86_REG_YMM15, X86_REG_YMM16, X86_REG_YMM17,\r\n X86_REG_YMM18, X86_REG_YMM19, X86_REG_YMM20, X86_REG_YMM21, X86_REG_YMM22,\r\n X86_REG_YMM23, X86_REG_YMM24, X86_REG_YMM25, X86_REG_YMM26, X86_REG_YMM27,\r\n X86_REG_YMM28, X86_REG_YMM29, X86_REG_YMM30, X86_REG_YMM31, X86_REG_ZMM0,\r\n X86_REG_ZMM1, X86_REG_ZMM2, X86_REG_ZMM3, X86_REG_ZMM4, X86_REG_ZMM5,\r\n X86_REG_ZMM6, X86_REG_ZMM7, X86_REG_ZMM8, X86_REG_ZMM9, X86_REG_ZMM10,\r\n X86_REG_ZMM11, X86_REG_ZMM12, X86_REG_ZMM13, X86_REG_ZMM14, X86_REG_ZMM15,\r\n X86_REG_ZMM16, X86_REG_ZMM17, X86_REG_ZMM18, X86_REG_ZMM19, X86_REG_ZMM20,\r\n X86_REG_ZMM21, X86_REG_ZMM22, X86_REG_ZMM23, X86_REG_ZMM24, X86_REG_ZMM25,\r\n X86_REG_ZMM26, X86_REG_ZMM27, X86_REG_ZMM28, X86_REG_ZMM29, X86_REG_ZMM30,\r\n X86_REG_ZMM31, X86_REG_R8B, X86_REG_R9B, X86_REG_R10B, X86_REG_R11B,\r\n X86_REG_R12B, X86_REG_R13B, X86_REG_R14B, X86_REG_R15B, X86_REG_R8D,\r\n X86_REG_R9D, X86_REG_R10D, X86_REG_R11D, X86_REG_R12D, X86_REG_R13D,\r\n X86_REG_R14D, X86_REG_R15D, X86_REG_R8W, X86_REG_R9W, X86_REG_R10W,\r\n X86_REG_R11W, X86_REG_R12W, X86_REG_R13W, X86_REG_R14W, X86_REG_R15W,\r\n\r\n X86_REG_ENDING // <-- mark the end of the list of registers\r\n} x86_reg;\r\n\r\n//> Sub-flags of EFLAGS\r\n#define X86_EFLAGS_MODIFY_AF (1ULL << 0)\r\n#define X86_EFLAGS_MODIFY_CF (1ULL << 1)\r\n#define X86_EFLAGS_MODIFY_SF (1ULL << 2)\r\n#define X86_EFLAGS_MODIFY_ZF (1ULL << 3)\r\n#define X86_EFLAGS_MODIFY_PF (1ULL << 4)\r\n#define X86_EFLAGS_MODIFY_OF (1ULL << 5)\r\n#define X86_EFLAGS_MODIFY_TF (1ULL << 6)\r\n#define X86_EFLAGS_MODIFY_IF (1ULL << 7)\r\n#define X86_EFLAGS_MODIFY_DF (1ULL << 8)\r\n#define X86_EFLAGS_MODIFY_NT (1ULL << 9)\r\n#define X86_EFLAGS_MODIFY_RF (1ULL << 10)\r\n#define X86_EFLAGS_PRIOR_OF (1ULL << 11)\r\n#define X86_EFLAGS_PRIOR_SF (1ULL << 12)\r\n#define X86_EFLAGS_PRIOR_ZF (1ULL << 13)\r\n#define X86_EFLAGS_PRIOR_AF (1ULL << 14)\r\n#define X86_EFLAGS_PRIOR_PF (1ULL << 15)\r\n#define X86_EFLAGS_PRIOR_CF (1ULL << 16)\r\n#define X86_EFLAGS_PRIOR_TF (1ULL << 17)\r\n#define X86_EFLAGS_PRIOR_IF (1ULL << 18)\r\n#define X86_EFLAGS_PRIOR_DF (1ULL << 19)\r\n#define X86_EFLAGS_PRIOR_NT (1ULL << 20)\r\n#define X86_EFLAGS_RESET_OF (1ULL << 21)\r\n#define X86_EFLAGS_RESET_CF (1ULL << 22)\r\n#define X86_EFLAGS_RESET_DF (1ULL << 23)\r\n#define X86_EFLAGS_RESET_IF (1ULL << 24)\r\n#define X86_EFLAGS_RESET_SF (1ULL << 25)\r\n#define X86_EFLAGS_RESET_AF (1ULL << 26)\r\n#define X86_EFLAGS_RESET_TF (1ULL << 27)\r\n#define X86_EFLAGS_RESET_NT (1ULL << 28)\r\n#define X86_EFLAGS_RESET_PF (1ULL << 29)\r\n#define X86_EFLAGS_SET_CF (1ULL << 30)\r\n#define X86_EFLAGS_SET_DF (1ULL << 31)\r\n#define X86_EFLAGS_SET_IF (1ULL << 32)\r\n#define X86_EFLAGS_TEST_OF (1ULL << 33)\r\n#define X86_EFLAGS_TEST_SF (1ULL << 34)\r\n#define X86_EFLAGS_TEST_ZF (1ULL << 35)\r\n#define X86_EFLAGS_TEST_PF (1ULL << 36)\r\n#define X86_EFLAGS_TEST_CF (1ULL << 37)\r\n#define X86_EFLAGS_TEST_NT (1ULL << 38)\r\n#define X86_EFLAGS_TEST_DF (1ULL << 39)\r\n#define X86_EFLAGS_UNDEFINED_OF (1ULL << 40)\r\n#define X86_EFLAGS_UNDEFINED_SF (1ULL << 41)\r\n#define X86_EFLAGS_UNDEFINED_ZF (1ULL << 42)\r\n#define X86_EFLAGS_UNDEFINED_PF (1ULL << 43)\r\n#define X86_EFLAGS_UNDEFINED_AF (1ULL << 44)\r\n#define X86_EFLAGS_UNDEFINED_CF (1ULL << 45)\r\n\r\n//> Operand type for instruction's operands\r\ntypedef enum x86_op_type\r\n{\r\n X86_OP_INVALID = 0, // = CS_OP_INVALID (Uninitialized).\r\n X86_OP_REG, // = CS_OP_REG (Register operand).\r\n X86_OP_IMM, // = CS_OP_IMM (Immediate operand).\r\n X86_OP_MEM, // = CS_OP_MEM (Memory operand).\r\n} x86_op_type;\r\n\r\n//> XOP Code Condition type\r\ntypedef enum x86_xop_cc\r\n{\r\n X86_XOP_CC_INVALID = 0, // Uninitialized.\r\n X86_XOP_CC_LT,\r\n X86_XOP_CC_LE,\r\n X86_XOP_CC_GT,\r\n X86_XOP_CC_GE,\r\n X86_XOP_CC_EQ,\r\n X86_XOP_CC_NEQ,\r\n X86_XOP_CC_FALSE,\r\n X86_XOP_CC_TRUE,\r\n} x86_xop_cc;\r\n\r\n//> AVX broadcast type\r\ntypedef enum x86_avx_bcast\r\n{\r\n X86_AVX_BCAST_INVALID = 0, // Uninitialized.\r\n X86_AVX_BCAST_2, // AVX512 broadcast type {1to2}\r\n X86_AVX_BCAST_4, // AVX512 broadcast type {1to4}\r\n X86_AVX_BCAST_8, // AVX512 broadcast type {1to8}\r\n X86_AVX_BCAST_16, // AVX512 broadcast type {1to16}\r\n} x86_avx_bcast;\r\n\r\n//> SSE Code Condition type\r\ntypedef enum x86_sse_cc\r\n{\r\n X86_SSE_CC_INVALID = 0, // Uninitialized.\r\n X86_SSE_CC_EQ,\r\n X86_SSE_CC_LT,\r\n X86_SSE_CC_LE,\r\n X86_SSE_CC_UNORD,\r\n X86_SSE_CC_NEQ,\r\n X86_SSE_CC_NLT,\r\n X86_SSE_CC_NLE,\r\n X86_SSE_CC_ORD,\r\n} x86_sse_cc;\r\n\r\n//> AVX Code Condition type\r\ntypedef enum x86_avx_cc\r\n{\r\n X86_AVX_CC_INVALID = 0, // Uninitialized.\r\n X86_AVX_CC_EQ,\r\n X86_AVX_CC_LT,\r\n X86_AVX_CC_LE,\r\n X86_AVX_CC_UNORD,\r\n X86_AVX_CC_NEQ,\r\n X86_AVX_CC_NLT,\r\n X86_AVX_CC_NLE,\r\n X86_AVX_CC_ORD,\r\n X86_AVX_CC_EQ_UQ,\r\n X86_AVX_CC_NGE,\r\n X86_AVX_CC_NGT,\r\n X86_AVX_CC_FALSE,\r\n X86_AVX_CC_NEQ_OQ,\r\n X86_AVX_CC_GE,\r\n X86_AVX_CC_GT,\r\n X86_AVX_CC_TRUE,\r\n X86_AVX_CC_EQ_OS,\r\n X86_AVX_CC_LT_OQ,\r\n X86_AVX_CC_LE_OQ,\r\n X86_AVX_CC_UNORD_S,\r\n X86_AVX_CC_NEQ_US,\r\n X86_AVX_CC_NLT_UQ,\r\n X86_AVX_CC_NLE_UQ,\r\n X86_AVX_CC_ORD_S,\r\n X86_AVX_CC_EQ_US,\r\n X86_AVX_CC_NGE_UQ,\r\n X86_AVX_CC_NGT_UQ,\r\n X86_AVX_CC_FALSE_OS,\r\n X86_AVX_CC_NEQ_OS,\r\n X86_AVX_CC_GE_OQ,\r\n X86_AVX_CC_GT_OQ,\r\n X86_AVX_CC_TRUE_US,\r\n} x86_avx_cc;\r\n\r\n//> AVX static rounding mode type\r\ntypedef enum x86_avx_rm\r\n{\r\n X86_AVX_RM_INVALID = 0, // Uninitialized.\r\n X86_AVX_RM_RN, // Round to nearest\r\n X86_AVX_RM_RD, // Round down\r\n X86_AVX_RM_RU, // Round up\r\n X86_AVX_RM_RZ, // Round toward zero\r\n} x86_avx_rm;\r\n\r\n//> Instruction prefixes - to be used in cs_x86.prefix[]\r\ntypedef enum x86_prefix\r\n{\r\n X86_PREFIX_LOCK = 0xf0, // lock (cs_x86.prefix[0]\r\n X86_PREFIX_REP = 0xf3, // rep (cs_x86.prefix[0]\r\n X86_PREFIX_REPE = 0xf3, // repe/repz (cs_x86.prefix[0]\r\n X86_PREFIX_REPNE = 0xf2, // repne/repnz (cs_x86.prefix[0]\r\n\r\n X86_PREFIX_CS = 0x2e, // segment override CS (cs_x86.prefix[1]\r\n X86_PREFIX_SS = 0x36, // segment override SS (cs_x86.prefix[1]\r\n X86_PREFIX_DS = 0x3e, // segment override DS (cs_x86.prefix[1]\r\n X86_PREFIX_ES = 0x26, // segment override ES (cs_x86.prefix[1]\r\n X86_PREFIX_FS = 0x64, // segment override FS (cs_x86.prefix[1]\r\n X86_PREFIX_GS = 0x65, // segment override GS (cs_x86.prefix[1]\r\n\r\n X86_PREFIX_OPSIZE = 0x66, // operand-size override (cs_x86.prefix[2]\r\n X86_PREFIX_ADDRSIZE = 0x67, // address-size override (cs_x86.prefix[3]\r\n} x86_prefix;\r\n\r\n// Instruction's operand referring to memory\r\n// This is associated with X86_OP_MEM operand type above\r\ntypedef struct x86_op_mem\r\n{\r\n x86_reg segment; // segment register (or X86_REG_INVALID if irrelevant)\r\n x86_reg base; // base register (or X86_REG_INVALID if irrelevant)\r\n x86_reg index; // index register (or X86_REG_INVALID if irrelevant)\r\n int scale; // scale for index register\r\n int64_t disp; // displacement value\r\n} x86_op_mem;\r\n\r\n// Instruction operand\r\ntypedef struct cs_x86_op\r\n{\r\n x86_op_type type; // operand type\r\n union\r\n {\r\n x86_reg reg; // register value for REG operand\r\n int64_t imm; // immediate value for IMM operand\r\n x86_op_mem mem; // base/index/scale/disp value for MEM operand\r\n };\r\n\r\n // size of this operand (in bytes).\r\n uint8_t size;\r\n\r\n // How is this operand accessed? (READ, WRITE or READ|WRITE)\r\n // This field is combined of cs_ac_type.\r\n // NOTE: this field is irrelevant if engine is compiled in DIET mode.\r\n uint8_t access;\r\n\r\n // AVX broadcast type, or 0 if irrelevant\r\n x86_avx_bcast avx_bcast;\r\n\r\n // AVX zero opmask {z}\r\n bool avx_zero_opmask;\r\n} cs_x86_op;\r\n\r\n// Instruction structure\r\ntypedef struct cs_x86\r\n{\r\n // Instruction prefix, which can be up to 4 bytes.\r\n // A prefix byte gets value 0 when irrelevant.\r\n // prefix[0] indicates REP/REPNE/LOCK prefix (See X86_PREFIX_REP/REPNE/LOCK above)\r\n // prefix[1] indicates segment override (irrelevant for x86_64):\r\n // See X86_PREFIX_CS/SS/DS/ES/FS/GS above.\r\n // prefix[2] indicates operand-size override (X86_PREFIX_OPSIZE)\r\n // prefix[3] indicates address-size override (X86_PREFIX_ADDRSIZE)\r\n uint8_t prefix[4];\r\n\r\n // Instruction opcode, which can be from 1 to 4 bytes in size.\r\n // This contains VEX opcode as well.\r\n // An trailing opcode byte gets value 0 when irrelevant.\r\n uint8_t opcode[4];\r\n\r\n // REX prefix: only a non-zero value is relevant for x86_64\r\n uint8_t rex;\r\n\r\n // Address size, which can be overridden with above prefix[5].\r\n uint8_t addr_size;\r\n\r\n // ModR/M byte\r\n uint8_t modrm;\r\n\r\n // SIB value, or 0 when irrelevant.\r\n uint8_t sib;\r\n\r\n // Displacement value, or 0 when irrelevant.\r\n int32_t disp;\r\n\r\n /* SIB state */\r\n // SIB index register, or X86_REG_INVALID when irrelevant.\r\n x86_reg sib_index;\r\n // SIB scale. only applicable if sib_index is relevant.\r\n int8_t sib_scale;\r\n // SIB base register, or X86_REG_INVALID when irrelevant.\r\n x86_reg sib_base;\r\n\r\n // XOP Code Condition\r\n x86_xop_cc xop_cc;\r\n\r\n // SSE Code Condition\r\n x86_sse_cc sse_cc;\r\n\r\n // AVX Code Condition\r\n x86_avx_cc avx_cc;\r\n\r\n // AVX Suppress all Exception\r\n bool avx_sae;\r\n\r\n // AVX static rounding mode\r\n x86_avx_rm avx_rm;\r\n\r\n // EFLAGS updated by this instruction.\r\n // This can be formed from OR combination of X86_EFLAGS_* symbols in x86.h\r\n uint64_t eflags;\r\n\r\n // Number of operands of this instruction,\r\n // or 0 when instruction has no operand.\r\n uint8_t op_count;\r\n\r\n cs_x86_op operands[8]; // operands for this instruction.\r\n} cs_x86;\r\n\r\n//> X86 instructions\r\ntypedef enum x86_insn\r\n{\r\n X86_INS_INVALID = 0,\r\n\r\n X86_INS_AAA,\r\n X86_INS_AAD,\r\n X86_INS_AAM,\r\n X86_INS_AAS,\r\n X86_INS_FABS,\r\n X86_INS_ADC,\r\n X86_INS_ADCX,\r\n X86_INS_ADD,\r\n X86_INS_ADDPD,\r\n X86_INS_ADDPS,\r\n X86_INS_ADDSD,\r\n X86_INS_ADDSS,\r\n X86_INS_ADDSUBPD,\r\n X86_INS_ADDSUBPS,\r\n X86_INS_FADD,\r\n X86_INS_FIADD,\r\n X86_INS_FADDP,\r\n X86_INS_ADOX,\r\n X86_INS_AESDECLAST,\r\n X86_INS_AESDEC,\r\n X86_INS_AESENCLAST,\r\n X86_INS_AESENC,\r\n X86_INS_AESIMC,\r\n X86_INS_AESKEYGENASSIST,\r\n X86_INS_AND,\r\n X86_INS_ANDN,\r\n X86_INS_ANDNPD,\r\n X86_INS_ANDNPS,\r\n X86_INS_ANDPD,\r\n X86_INS_ANDPS,\r\n X86_INS_ARPL,\r\n X86_INS_BEXTR,\r\n X86_INS_BLCFILL,\r\n X86_INS_BLCI,\r\n X86_INS_BLCIC,\r\n X86_INS_BLCMSK,\r\n X86_INS_BLCS,\r\n X86_INS_BLENDPD,\r\n X86_INS_BLENDPS,\r\n X86_INS_BLENDVPD,\r\n X86_INS_BLENDVPS,\r\n X86_INS_BLSFILL,\r\n X86_INS_BLSI,\r\n X86_INS_BLSIC,\r\n X86_INS_BLSMSK,\r\n X86_INS_BLSR,\r\n X86_INS_BOUND,\r\n X86_INS_BSF,\r\n X86_INS_BSR,\r\n X86_INS_BSWAP,\r\n X86_INS_BT,\r\n X86_INS_BTC,\r\n X86_INS_BTR,\r\n X86_INS_BTS,\r\n X86_INS_BZHI,\r\n X86_INS_CALL,\r\n X86_INS_CBW,\r\n X86_INS_CDQ,\r\n X86_INS_CDQE,\r\n X86_INS_FCHS,\r\n X86_INS_CLAC,\r\n X86_INS_CLC,\r\n X86_INS_CLD,\r\n X86_INS_CLFLUSH,\r\n X86_INS_CLFLUSHOPT,\r\n X86_INS_CLGI,\r\n X86_INS_CLI,\r\n X86_INS_CLTS,\r\n X86_INS_CLWB,\r\n X86_INS_CMC,\r\n X86_INS_CMOVA,\r\n X86_INS_CMOVAE,\r\n X86_INS_CMOVB,\r\n X86_INS_CMOVBE,\r\n X86_INS_FCMOVBE,\r\n X86_INS_FCMOVB,\r\n X86_INS_CMOVE,\r\n X86_INS_FCMOVE,\r\n X86_INS_CMOVG,\r\n X86_INS_CMOVGE,\r\n X86_INS_CMOVL,\r\n X86_INS_CMOVLE,\r\n X86_INS_FCMOVNBE,\r\n X86_INS_FCMOVNB,\r\n X86_INS_CMOVNE,\r\n X86_INS_FCMOVNE,\r\n X86_INS_CMOVNO,\r\n X86_INS_CMOVNP,\r\n X86_INS_FCMOVNU,\r\n X86_INS_CMOVNS,\r\n X86_INS_CMOVO,\r\n X86_INS_CMOVP,\r\n X86_INS_FCMOVU,\r\n X86_INS_CMOVS,\r\n X86_INS_CMP,\r\n X86_INS_CMPSB,\r\n X86_INS_CMPSQ,\r\n X86_INS_CMPSW,\r\n X86_INS_CMPXCHG16B,\r\n X86_INS_CMPXCHG,\r\n X86_INS_CMPXCHG8B,\r\n X86_INS_COMISD,\r\n X86_INS_COMISS,\r\n X86_INS_FCOMP,\r\n X86_INS_FCOMIP,\r\n X86_INS_FCOMI,\r\n X86_INS_FCOM,\r\n X86_INS_FCOS,\r\n X86_INS_CPUID,\r\n X86_INS_CQO,\r\n X86_INS_CRC32,\r\n X86_INS_CVTDQ2PD,\r\n X86_INS_CVTDQ2PS,\r\n X86_INS_CVTPD2DQ,\r\n X86_INS_CVTPD2PS,\r\n X86_INS_CVTPS2DQ,\r\n X86_INS_CVTPS2PD,\r\n X86_INS_CVTSD2SI,\r\n X86_INS_CVTSD2SS,\r\n X86_INS_CVTSI2SD,\r\n X86_INS_CVTSI2SS,\r\n X86_INS_CVTSS2SD,\r\n X86_INS_CVTSS2SI,\r\n X86_INS_CVTTPD2DQ,\r\n X86_INS_CVTTPS2DQ,\r\n X86_INS_CVTTSD2SI,\r\n X86_INS_CVTTSS2SI,\r\n X86_INS_CWD,\r\n X86_INS_CWDE,\r\n X86_INS_DAA,\r\n X86_INS_DAS,\r\n X86_INS_DATA16,\r\n X86_INS_DEC,\r\n X86_INS_DIV,\r\n X86_INS_DIVPD,\r\n X86_INS_DIVPS,\r\n X86_INS_FDIVR,\r\n X86_INS_FIDIVR,\r\n X86_INS_FDIVRP,\r\n X86_INS_DIVSD,\r\n X86_INS_DIVSS,\r\n X86_INS_FDIV,\r\n X86_INS_FIDIV,\r\n X86_INS_FDIVP,\r\n X86_INS_DPPD,\r\n X86_INS_DPPS,\r\n X86_INS_RET,\r\n X86_INS_ENCLS,\r\n X86_INS_ENCLU,\r\n X86_INS_ENTER,\r\n X86_INS_EXTRACTPS,\r\n X86_INS_EXTRQ,\r\n X86_INS_F2XM1,\r\n X86_INS_LCALL,\r\n X86_INS_LJMP,\r\n X86_INS_FBLD,\r\n X86_INS_FBSTP,\r\n X86_INS_FCOMPP,\r\n X86_INS_FDECSTP,\r\n X86_INS_FEMMS,\r\n X86_INS_FFREE,\r\n X86_INS_FICOM,\r\n X86_INS_FICOMP,\r\n X86_INS_FINCSTP,\r\n X86_INS_FLDCW,\r\n X86_INS_FLDENV,\r\n X86_INS_FLDL2E,\r\n X86_INS_FLDL2T,\r\n X86_INS_FLDLG2,\r\n X86_INS_FLDLN2,\r\n X86_INS_FLDPI,\r\n X86_INS_FNCLEX,\r\n X86_INS_FNINIT,\r\n X86_INS_FNOP,\r\n X86_INS_FNSTCW,\r\n X86_INS_FNSTSW,\r\n X86_INS_FPATAN,\r\n X86_INS_FPREM,\r\n X86_INS_FPREM1,\r\n X86_INS_FPTAN,\r\n X86_INS_FFREEP,\r\n X86_INS_FRNDINT,\r\n X86_INS_FRSTOR,\r\n X86_INS_FNSAVE,\r\n X86_INS_FSCALE,\r\n X86_INS_FSETPM,\r\n X86_INS_FSINCOS,\r\n X86_INS_FNSTENV,\r\n X86_INS_FXAM,\r\n X86_INS_FXRSTOR,\r\n X86_INS_FXRSTOR64,\r\n X86_INS_FXSAVE,\r\n X86_INS_FXSAVE64,\r\n X86_INS_FXTRACT,\r\n X86_INS_FYL2X,\r\n X86_INS_FYL2XP1,\r\n X86_INS_MOVAPD,\r\n X86_INS_MOVAPS,\r\n X86_INS_ORPD,\r\n X86_INS_ORPS,\r\n X86_INS_VMOVAPD,\r\n X86_INS_VMOVAPS,\r\n X86_INS_XORPD,\r\n X86_INS_XORPS,\r\n X86_INS_GETSEC,\r\n X86_INS_HADDPD,\r\n X86_INS_HADDPS,\r\n X86_INS_HLT,\r\n X86_INS_HSUBPD,\r\n X86_INS_HSUBPS,\r\n X86_INS_IDIV,\r\n X86_INS_FILD,\r\n X86_INS_IMUL,\r\n X86_INS_IN,\r\n X86_INS_INC,\r\n X86_INS_INSB,\r\n X86_INS_INSERTPS,\r\n X86_INS_INSERTQ,\r\n X86_INS_INSD,\r\n X86_INS_INSW,\r\n X86_INS_INT,\r\n X86_INS_INT1,\r\n X86_INS_INT3,\r\n X86_INS_INTO,\r\n X86_INS_INVD,\r\n X86_INS_INVEPT,\r\n X86_INS_INVLPG,\r\n X86_INS_INVLPGA,\r\n X86_INS_INVPCID,\r\n X86_INS_INVVPID,\r\n X86_INS_IRET,\r\n X86_INS_IRETD,\r\n X86_INS_IRETQ,\r\n X86_INS_FISTTP,\r\n X86_INS_FIST,\r\n X86_INS_FISTP,\r\n X86_INS_UCOMISD,\r\n X86_INS_UCOMISS,\r\n X86_INS_VCOMISD,\r\n X86_INS_VCOMISS,\r\n X86_INS_VCVTSD2SS,\r\n X86_INS_VCVTSI2SD,\r\n X86_INS_VCVTSI2SS,\r\n X86_INS_VCVTSS2SD,\r\n X86_INS_VCVTTSD2SI,\r\n X86_INS_VCVTTSD2USI,\r\n X86_INS_VCVTTSS2SI,\r\n X86_INS_VCVTTSS2USI,\r\n X86_INS_VCVTUSI2SD,\r\n X86_INS_VCVTUSI2SS,\r\n X86_INS_VUCOMISD,\r\n X86_INS_VUCOMISS,\r\n X86_INS_JAE,\r\n X86_INS_JA,\r\n X86_INS_JBE,\r\n X86_INS_JB,\r\n X86_INS_JCXZ,\r\n X86_INS_JECXZ,\r\n X86_INS_JE,\r\n X86_INS_JGE,\r\n X86_INS_JG,\r\n X86_INS_JLE,\r\n X86_INS_JL,\r\n X86_INS_JMP,\r\n X86_INS_JNE,\r\n X86_INS_JNO,\r\n X86_INS_JNP,\r\n X86_INS_JNS,\r\n X86_INS_JO,\r\n X86_INS_JP,\r\n X86_INS_JRCXZ,\r\n X86_INS_JS,\r\n X86_INS_KANDB,\r\n X86_INS_KANDD,\r\n X86_INS_KANDNB,\r\n X86_INS_KANDND,\r\n X86_INS_KANDNQ,\r\n X86_INS_KANDNW,\r\n X86_INS_KANDQ,\r\n X86_INS_KANDW,\r\n X86_INS_KMOVB,\r\n X86_INS_KMOVD,\r\n X86_INS_KMOVQ,\r\n X86_INS_KMOVW,\r\n X86_INS_KNOTB,\r\n X86_INS_KNOTD,\r\n X86_INS_KNOTQ,\r\n X86_INS_KNOTW,\r\n X86_INS_KORB,\r\n X86_INS_KORD,\r\n X86_INS_KORQ,\r\n X86_INS_KORTESTB,\r\n X86_INS_KORTESTD,\r\n X86_INS_KORTESTQ,\r\n X86_INS_KORTESTW,\r\n X86_INS_KORW,\r\n X86_INS_KSHIFTLB,\r\n X86_INS_KSHIFTLD,\r\n X86_INS_KSHIFTLQ,\r\n X86_INS_KSHIFTLW,\r\n X86_INS_KSHIFTRB,\r\n X86_INS_KSHIFTRD,\r\n X86_INS_KSHIFTRQ,\r\n X86_INS_KSHIFTRW,\r\n X86_INS_KUNPCKBW,\r\n X86_INS_KXNORB,\r\n X86_INS_KXNORD,\r\n X86_INS_KXNORQ,\r\n X86_INS_KXNORW,\r\n X86_INS_KXORB,\r\n X86_INS_KXORD,\r\n X86_INS_KXORQ,\r\n X86_INS_KXORW,\r\n X86_INS_LAHF,\r\n X86_INS_LAR,\r\n X86_INS_LDDQU,\r\n X86_INS_LDMXCSR,\r\n X86_INS_LDS,\r\n X86_INS_FLDZ,\r\n X86_INS_FLD1,\r\n X86_INS_FLD,\r\n X86_INS_LEA,\r\n X86_INS_LEAVE,\r\n X86_INS_LES,\r\n X86_INS_LFENCE,\r\n X86_INS_LFS,\r\n X86_INS_LGDT,\r\n X86_INS_LGS,\r\n X86_INS_LIDT,\r\n X86_INS_LLDT,\r\n X86_INS_LMSW,\r\n X86_INS_OR,\r\n X86_INS_SUB,\r\n X86_INS_XOR,\r\n X86_INS_LODSB,\r\n X86_INS_LODSD,\r\n X86_INS_LODSQ,\r\n X86_INS_LODSW,\r\n X86_INS_LOOP,\r\n X86_INS_LOOPE,\r\n X86_INS_LOOPNE,\r\n X86_INS_RETF,\r\n X86_INS_RETFQ,\r\n X86_INS_LSL,\r\n X86_INS_LSS,\r\n X86_INS_LTR,\r\n X86_INS_XADD,\r\n X86_INS_LZCNT,\r\n X86_INS_MASKMOVDQU,\r\n X86_INS_MAXPD,\r\n X86_INS_MAXPS,\r\n X86_INS_MAXSD,\r\n X86_INS_MAXSS,\r\n X86_INS_MFENCE,\r\n X86_INS_MINPD,\r\n X86_INS_MINPS,\r\n X86_INS_MINSD,\r\n X86_INS_MINSS,\r\n X86_INS_CVTPD2PI,\r\n X86_INS_CVTPI2PD,\r\n X86_INS_CVTPI2PS,\r\n X86_INS_CVTPS2PI,\r\n X86_INS_CVTTPD2PI,\r\n X86_INS_CVTTPS2PI,\r\n X86_INS_EMMS,\r\n X86_INS_MASKMOVQ,\r\n X86_INS_MOVD,\r\n X86_INS_MOVDQ2Q,\r\n X86_INS_MOVNTQ,\r\n X86_INS_MOVQ2DQ,\r\n X86_INS_MOVQ,\r\n X86_INS_PABSB,\r\n X86_INS_PABSD,\r\n X86_INS_PABSW,\r\n X86_INS_PACKSSDW,\r\n X86_INS_PACKSSWB,\r\n X86_INS_PACKUSWB,\r\n X86_INS_PADDB,\r\n X86_INS_PADDD,\r\n X86_INS_PADDQ,\r\n X86_INS_PADDSB,\r\n X86_INS_PADDSW,\r\n X86_INS_PADDUSB,\r\n X86_INS_PADDUSW,\r\n X86_INS_PADDW,\r\n X86_INS_PALIGNR,\r\n X86_INS_PANDN,\r\n X86_INS_PAND,\r\n X86_INS_PAVGB,\r\n X86_INS_PAVGW,\r\n X86_INS_PCMPEQB,\r\n X86_INS_PCMPEQD,\r\n X86_INS_PCMPEQW,\r\n X86_INS_PCMPGTB,\r\n X86_INS_PCMPGTD,\r\n X86_INS_PCMPGTW,\r\n X86_INS_PEXTRW,\r\n X86_INS_PHADDSW,\r\n X86_INS_PHADDW,\r\n X86_INS_PHADDD,\r\n X86_INS_PHSUBD,\r\n X86_INS_PHSUBSW,\r\n X86_INS_PHSUBW,\r\n X86_INS_PINSRW,\r\n X86_INS_PMADDUBSW,\r\n X86_INS_PMADDWD,\r\n X86_INS_PMAXSW,\r\n X86_INS_PMAXUB,\r\n X86_INS_PMINSW,\r\n X86_INS_PMINUB,\r\n X86_INS_PMOVMSKB,\r\n X86_INS_PMULHRSW,\r\n X86_INS_PMULHUW,\r\n X86_INS_PMULHW,\r\n X86_INS_PMULLW,\r\n X86_INS_PMULUDQ,\r\n X86_INS_POR,\r\n X86_INS_PSADBW,\r\n X86_INS_PSHUFB,\r\n X86_INS_PSHUFW,\r\n X86_INS_PSIGNB,\r\n X86_INS_PSIGND,\r\n X86_INS_PSIGNW,\r\n X86_INS_PSLLD,\r\n X86_INS_PSLLQ,\r\n X86_INS_PSLLW,\r\n X86_INS_PSRAD,\r\n X86_INS_PSRAW,\r\n X86_INS_PSRLD,\r\n X86_INS_PSRLQ,\r\n X86_INS_PSRLW,\r\n X86_INS_PSUBB,\r\n X86_INS_PSUBD,\r\n X86_INS_PSUBQ,\r\n X86_INS_PSUBSB,\r\n X86_INS_PSUBSW,\r\n X86_INS_PSUBUSB,\r\n X86_INS_PSUBUSW,\r\n X86_INS_PSUBW,\r\n X86_INS_PUNPCKHBW,\r\n X86_INS_PUNPCKHDQ,\r\n X86_INS_PUNPCKHWD,\r\n X86_INS_PUNPCKLBW,\r\n X86_INS_PUNPCKLDQ,\r\n X86_INS_PUNPCKLWD,\r\n X86_INS_PXOR,\r\n X86_INS_MONITOR,\r\n X86_INS_MONTMUL,\r\n X86_INS_MOV,\r\n X86_INS_MOVABS,\r\n X86_INS_MOVBE,\r\n X86_INS_MOVDDUP,\r\n X86_INS_MOVDQA,\r\n X86_INS_MOVDQU,\r\n X86_INS_MOVHLPS,\r\n X86_INS_MOVHPD,\r\n X86_INS_MOVHPS,\r\n X86_INS_MOVLHPS,\r\n X86_INS_MOVLPD,\r\n X86_INS_MOVLPS,\r\n X86_INS_MOVMSKPD,\r\n X86_INS_MOVMSKPS,\r\n X86_INS_MOVNTDQA,\r\n X86_INS_MOVNTDQ,\r\n X86_INS_MOVNTI,\r\n X86_INS_MOVNTPD,\r\n X86_INS_MOVNTPS,\r\n X86_INS_MOVNTSD,\r\n X86_INS_MOVNTSS,\r\n X86_INS_MOVSB,\r\n X86_INS_MOVSD,\r\n X86_INS_MOVSHDUP,\r\n X86_INS_MOVSLDUP,\r\n X86_INS_MOVSQ,\r\n X86_INS_MOVSS,\r\n X86_INS_MOVSW,\r\n X86_INS_MOVSX,\r\n X86_INS_MOVSXD,\r\n X86_INS_MOVUPD,\r\n X86_INS_MOVUPS,\r\n X86_INS_MOVZX,\r\n X86_INS_MPSADBW,\r\n X86_INS_MUL,\r\n X86_INS_MULPD,\r\n X86_INS_MULPS,\r\n X86_INS_MULSD,\r\n X86_INS_MULSS,\r\n X86_INS_MULX,\r\n X86_INS_FMUL,\r\n X86_INS_FIMUL,\r\n X86_INS_FMULP,\r\n X86_INS_MWAIT,\r\n X86_INS_NEG,\r\n X86_INS_NOP,\r\n X86_INS_NOT,\r\n X86_INS_OUT,\r\n X86_INS_OUTSB,\r\n X86_INS_OUTSD,\r\n X86_INS_OUTSW,\r\n X86_INS_PACKUSDW,\r\n X86_INS_PAUSE,\r\n X86_INS_PAVGUSB,\r\n X86_INS_PBLENDVB,\r\n X86_INS_PBLENDW,\r\n X86_INS_PCLMULQDQ,\r\n X86_INS_PCMPEQQ,\r\n X86_INS_PCMPESTRI,\r\n X86_INS_PCMPESTRM,\r\n X86_INS_PCMPGTQ,\r\n X86_INS_PCMPISTRI,\r\n X86_INS_PCMPISTRM,\r\n X86_INS_PCOMMIT,\r\n X86_INS_PDEP,\r\n X86_INS_PEXT,\r\n X86_INS_PEXTRB,\r\n X86_INS_PEXTRD,\r\n X86_INS_PEXTRQ,\r\n X86_INS_PF2ID,\r\n X86_INS_PF2IW,\r\n X86_INS_PFACC,\r\n X86_INS_PFADD,\r\n X86_INS_PFCMPEQ,\r\n X86_INS_PFCMPGE,\r\n X86_INS_PFCMPGT,\r\n X86_INS_PFMAX,\r\n X86_INS_PFMIN,\r\n X86_INS_PFMUL,\r\n X86_INS_PFNACC,\r\n X86_INS_PFPNACC,\r\n X86_INS_PFRCPIT1,\r\n X86_INS_PFRCPIT2,\r\n X86_INS_PFRCP,\r\n X86_INS_PFRSQIT1,\r\n X86_INS_PFRSQRT,\r\n X86_INS_PFSUBR,\r\n X86_INS_PFSUB,\r\n X86_INS_PHMINPOSUW,\r\n X86_INS_PI2FD,\r\n X86_INS_PI2FW,\r\n X86_INS_PINSRB,\r\n X86_INS_PINSRD,\r\n X86_INS_PINSRQ,\r\n X86_INS_PMAXSB,\r\n X86_INS_PMAXSD,\r\n X86_INS_PMAXUD,\r\n X86_INS_PMAXUW,\r\n X86_INS_PMINSB,\r\n X86_INS_PMINSD,\r\n X86_INS_PMINUD,\r\n X86_INS_PMINUW,\r\n X86_INS_PMOVSXBD,\r\n X86_INS_PMOVSXBQ,\r\n X86_INS_PMOVSXBW,\r\n X86_INS_PMOVSXDQ,\r\n X86_INS_PMOVSXWD,\r\n X86_INS_PMOVSXWQ,\r\n X86_INS_PMOVZXBD,\r\n X86_INS_PMOVZXBQ,\r\n X86_INS_PMOVZXBW,\r\n X86_INS_PMOVZXDQ,\r\n X86_INS_PMOVZXWD,\r\n X86_INS_PMOVZXWQ,\r\n X86_INS_PMULDQ,\r\n X86_INS_PMULHRW,\r\n X86_INS_PMULLD,\r\n X86_INS_POP,\r\n X86_INS_POPAW,\r\n X86_INS_POPAL,\r\n X86_INS_POPCNT,\r\n X86_INS_POPF,\r\n X86_INS_POPFD,\r\n X86_INS_POPFQ,\r\n X86_INS_PREFETCH,\r\n X86_INS_PREFETCHNTA,\r\n X86_INS_PREFETCHT0,\r\n X86_INS_PREFETCHT1,\r\n X86_INS_PREFETCHT2,\r\n X86_INS_PREFETCHW,\r\n X86_INS_PSHUFD,\r\n X86_INS_PSHUFHW,\r\n X86_INS_PSHUFLW,\r\n X86_INS_PSLLDQ,\r\n X86_INS_PSRLDQ,\r\n X86_INS_PSWAPD,\r\n X86_INS_PTEST,\r\n X86_INS_PUNPCKHQDQ,\r\n X86_INS_PUNPCKLQDQ,\r\n X86_INS_PUSH,\r\n X86_INS_PUSHAW,\r\n X86_INS_PUSHAL,\r\n X86_INS_PUSHF,\r\n X86_INS_PUSHFD,\r\n X86_INS_PUSHFQ,\r\n X86_INS_RCL,\r\n X86_INS_RCPPS,\r\n X86_INS_RCPSS,\r\n X86_INS_RCR,\r\n X86_INS_RDFSBASE,\r\n X86_INS_RDGSBASE,\r\n X86_INS_RDMSR,\r\n X86_INS_RDPMC,\r\n X86_INS_RDRAND,\r\n X86_INS_RDSEED,\r\n X86_INS_RDTSC,\r\n X86_INS_RDTSCP,\r\n X86_INS_ROL,\r\n X86_INS_ROR,\r\n X86_INS_RORX,\r\n X86_INS_ROUNDPD,\r\n X86_INS_ROUNDPS,\r\n X86_INS_ROUNDSD,\r\n X86_INS_ROUNDSS,\r\n X86_INS_RSM,\r\n X86_INS_RSQRTPS,\r\n X86_INS_RSQRTSS,\r\n X86_INS_SAHF,\r\n X86_INS_SAL,\r\n X86_INS_SALC,\r\n X86_INS_SAR,\r\n X86_INS_SARX,\r\n X86_INS_SBB,\r\n X86_INS_SCASB,\r\n X86_INS_SCASD,\r\n X86_INS_SCASQ,\r\n X86_INS_SCASW,\r\n X86_INS_SETAE,\r\n X86_INS_SETA,\r\n X86_INS_SETBE,\r\n X86_INS_SETB,\r\n X86_INS_SETE,\r\n X86_INS_SETGE,\r\n X86_INS_SETG,\r\n X86_INS_SETLE,\r\n X86_INS_SETL,\r\n X86_INS_SETNE,\r\n X86_INS_SETNO,\r\n X86_INS_SETNP,\r\n X86_INS_SETNS,\r\n X86_INS_SETO,\r\n X86_INS_SETP,\r\n X86_INS_SETS,\r\n X86_INS_SFENCE,\r\n X86_INS_SGDT,\r\n X86_INS_SHA1MSG1,\r\n X86_INS_SHA1MSG2,\r\n X86_INS_SHA1NEXTE,\r\n X86_INS_SHA1RNDS4,\r\n X86_INS_SHA256MSG1,\r\n X86_INS_SHA256MSG2,\r\n X86_INS_SHA256RNDS2,\r\n X86_INS_SHL,\r\n X86_INS_SHLD,\r\n X86_INS_SHLX,\r\n X86_INS_SHR,\r\n X86_INS_SHRD,\r\n X86_INS_SHRX,\r\n X86_INS_SHUFPD,\r\n X86_INS_SHUFPS,\r\n X86_INS_SIDT,\r\n X86_INS_FSIN,\r\n X86_INS_SKINIT,\r\n X86_INS_SLDT,\r\n X86_INS_SMSW,\r\n X86_INS_SQRTPD,\r\n X86_INS_SQRTPS,\r\n X86_INS_SQRTSD,\r\n X86_INS_SQRTSS,\r\n X86_INS_FSQRT,\r\n X86_INS_STAC,\r\n X86_INS_STC,\r\n X86_INS_STD,\r\n X86_INS_STGI,\r\n X86_INS_STI,\r\n X86_INS_STMXCSR,\r\n X86_INS_STOSB,\r\n X86_INS_STOSD,\r\n X86_INS_STOSQ,\r\n X86_INS_STOSW,\r\n X86_INS_STR,\r\n X86_INS_FST,\r\n X86_INS_FSTP,\r\n X86_INS_FSTPNCE,\r\n X86_INS_FXCH,\r\n X86_INS_SUBPD,\r\n X86_INS_SUBPS,\r\n X86_INS_FSUBR,\r\n X86_INS_FISUBR,\r\n X86_INS_FSUBRP,\r\n X86_INS_SUBSD,\r\n X86_INS_SUBSS,\r\n X86_INS_FSUB,\r\n X86_INS_FISUB,\r\n X86_INS_FSUBP,\r\n X86_INS_SWAPGS,\r\n X86_INS_SYSCALL,\r\n X86_INS_SYSENTER,\r\n X86_INS_SYSEXIT,\r\n X86_INS_SYSRET,\r\n X86_INS_T1MSKC,\r\n X86_INS_TEST,\r\n X86_INS_UD2,\r\n X86_INS_FTST,\r\n X86_INS_TZCNT,\r\n X86_INS_TZMSK,\r\n X86_INS_FUCOMIP,\r\n X86_INS_FUCOMI,\r\n X86_INS_FUCOMPP,\r\n X86_INS_FUCOMP,\r\n X86_INS_FUCOM,\r\n X86_INS_UD2B,\r\n X86_INS_UNPCKHPD,\r\n X86_INS_UNPCKHPS,\r\n X86_INS_UNPCKLPD,\r\n X86_INS_UNPCKLPS,\r\n X86_INS_VADDPD,\r\n X86_INS_VADDPS,\r\n X86_INS_VADDSD,\r\n X86_INS_VADDSS,\r\n X86_INS_VADDSUBPD,\r\n X86_INS_VADDSUBPS,\r\n X86_INS_VAESDECLAST,\r\n X86_INS_VAESDEC,\r\n X86_INS_VAESENCLAST,\r\n X86_INS_VAESENC,\r\n X86_INS_VAESIMC,\r\n X86_INS_VAESKEYGENASSIST,\r\n X86_INS_VALIGND,\r\n X86_INS_VALIGNQ,\r\n X86_INS_VANDNPD,\r\n X86_INS_VANDNPS,\r\n X86_INS_VANDPD,\r\n X86_INS_VANDPS,\r\n X86_INS_VBLENDMPD,\r\n X86_INS_VBLENDMPS,\r\n X86_INS_VBLENDPD,\r\n X86_INS_VBLENDPS,\r\n X86_INS_VBLENDVPD,\r\n X86_INS_VBLENDVPS,\r\n X86_INS_VBROADCASTF128,\r\n X86_INS_VBROADCASTI32X4,\r\n X86_INS_VBROADCASTI64X4,\r\n X86_INS_VBROADCASTSD,\r\n X86_INS_VBROADCASTSS,\r\n X86_INS_VCOMPRESSPD,\r\n X86_INS_VCOMPRESSPS,\r\n X86_INS_VCVTDQ2PD,\r\n X86_INS_VCVTDQ2PS,\r\n X86_INS_VCVTPD2DQX,\r\n X86_INS_VCVTPD2DQ,\r\n X86_INS_VCVTPD2PSX,\r\n X86_INS_VCVTPD2PS,\r\n X86_INS_VCVTPD2UDQ,\r\n X86_INS_VCVTPH2PS,\r\n X86_INS_VCVTPS2DQ,\r\n X86_INS_VCVTPS2PD,\r\n X86_INS_VCVTPS2PH,\r\n X86_INS_VCVTPS2UDQ,\r\n X86_INS_VCVTSD2SI,\r\n X86_INS_VCVTSD2USI,\r\n X86_INS_VCVTSS2SI,\r\n X86_INS_VCVTSS2USI,\r\n X86_INS_VCVTTPD2DQX,\r\n X86_INS_VCVTTPD2DQ,\r\n X86_INS_VCVTTPD2UDQ,\r\n X86_INS_VCVTTPS2DQ,\r\n X86_INS_VCVTTPS2UDQ,\r\n X86_INS_VCVTUDQ2PD,\r\n X86_INS_VCVTUDQ2PS,\r\n X86_INS_VDIVPD,\r\n X86_INS_VDIVPS,\r\n X86_INS_VDIVSD,\r\n X86_INS_VDIVSS,\r\n X86_INS_VDPPD,\r\n X86_INS_VDPPS,\r\n X86_INS_VERR,\r\n X86_INS_VERW,\r\n X86_INS_VEXP2PD,\r\n X86_INS_VEXP2PS,\r\n X86_INS_VEXPANDPD,\r\n X86_INS_VEXPANDPS,\r\n X86_INS_VEXTRACTF128,\r\n X86_INS_VEXTRACTF32X4,\r\n X86_INS_VEXTRACTF64X4,\r\n X86_INS_VEXTRACTI128,\r\n X86_INS_VEXTRACTI32X4,\r\n X86_INS_VEXTRACTI64X4,\r\n X86_INS_VEXTRACTPS,\r\n X86_INS_VFMADD132PD,\r\n X86_INS_VFMADD132PS,\r\n X86_INS_VFMADDPD,\r\n X86_INS_VFMADD213PD,\r\n X86_INS_VFMADD231PD,\r\n X86_INS_VFMADDPS,\r\n X86_INS_VFMADD213PS,\r\n X86_INS_VFMADD231PS,\r\n X86_INS_VFMADDSD,\r\n X86_INS_VFMADD213SD,\r\n X86_INS_VFMADD132SD,\r\n X86_INS_VFMADD231SD,\r\n X86_INS_VFMADDSS,\r\n X86_INS_VFMADD213SS,\r\n X86_INS_VFMADD132SS,\r\n X86_INS_VFMADD231SS,\r\n X86_INS_VFMADDSUB132PD,\r\n X86_INS_VFMADDSUB132PS,\r\n X86_INS_VFMADDSUBPD,\r\n X86_INS_VFMADDSUB213PD,\r\n X86_INS_VFMADDSUB231PD,\r\n X86_INS_VFMADDSUBPS,\r\n X86_INS_VFMADDSUB213PS,\r\n X86_INS_VFMADDSUB231PS,\r\n X86_INS_VFMSUB132PD,\r\n X86_INS_VFMSUB132PS,\r\n X86_INS_VFMSUBADD132PD,\r\n X86_INS_VFMSUBADD132PS,\r\n X86_INS_VFMSUBADDPD,\r\n X86_INS_VFMSUBADD213PD,\r\n X86_INS_VFMSUBADD231PD,\r\n X86_INS_VFMSUBADDPS,\r\n X86_INS_VFMSUBADD213PS,\r\n X86_INS_VFMSUBADD231PS,\r\n X86_INS_VFMSUBPD,\r\n X86_INS_VFMSUB213PD,\r\n X86_INS_VFMSUB231PD,\r\n X86_INS_VFMSUBPS,\r\n X86_INS_VFMSUB213PS,\r\n X86_INS_VFMSUB231PS,\r\n X86_INS_VFMSUBSD,\r\n X86_INS_VFMSUB213SD,\r\n X86_INS_VFMSUB132SD,\r\n X86_INS_VFMSUB231SD,\r\n X86_INS_VFMSUBSS,\r\n X86_INS_VFMSUB213SS,\r\n X86_INS_VFMSUB132SS,\r\n X86_INS_VFMSUB231SS,\r\n X86_INS_VFNMADD132PD,\r\n X86_INS_VFNMADD132PS,\r\n X86_INS_VFNMADDPD,\r\n X86_INS_VFNMADD213PD,\r\n X86_INS_VFNMADD231PD,\r\n X86_INS_VFNMADDPS,\r\n X86_INS_VFNMADD213PS,\r\n X86_INS_VFNMADD231PS,\r\n X86_INS_VFNMADDSD,\r\n X86_INS_VFNMADD213SD,\r\n X86_INS_VFNMADD132SD,\r\n X86_INS_VFNMADD231SD,\r\n X86_INS_VFNMADDSS,\r\n X86_INS_VFNMADD213SS,\r\n X86_INS_VFNMADD132SS,\r\n X86_INS_VFNMADD231SS,\r\n X86_INS_VFNMSUB132PD,\r\n X86_INS_VFNMSUB132PS,\r\n X86_INS_VFNMSUBPD,\r\n X86_INS_VFNMSUB213PD,\r\n X86_INS_VFNMSUB231PD,\r\n X86_INS_VFNMSUBPS,\r\n X86_INS_VFNMSUB213PS,\r\n X86_INS_VFNMSUB231PS,\r\n X86_INS_VFNMSUBSD,\r\n X86_INS_VFNMSUB213SD,\r\n X86_INS_VFNMSUB132SD,\r\n X86_INS_VFNMSUB231SD,\r\n X86_INS_VFNMSUBSS,\r\n X86_INS_VFNMSUB213SS,\r\n X86_INS_VFNMSUB132SS,\r\n X86_INS_VFNMSUB231SS,\r\n X86_INS_VFRCZPD,\r\n X86_INS_VFRCZPS,\r\n X86_INS_VFRCZSD,\r\n X86_INS_VFRCZSS,\r\n X86_INS_VORPD,\r\n X86_INS_VORPS,\r\n X86_INS_VXORPD,\r\n X86_INS_VXORPS,\r\n X86_INS_VGATHERDPD,\r\n X86_INS_VGATHERDPS,\r\n X86_INS_VGATHERPF0DPD,\r\n X86_INS_VGATHERPF0DPS,\r\n X86_INS_VGATHERPF0QPD,\r\n X86_INS_VGATHERPF0QPS,\r\n X86_INS_VGATHERPF1DPD,\r\n X86_INS_VGATHERPF1DPS,\r\n X86_INS_VGATHERPF1QPD,\r\n X86_INS_VGATHERPF1QPS,\r\n X86_INS_VGATHERQPD,\r\n X86_INS_VGATHERQPS,\r\n X86_INS_VHADDPD,\r\n X86_INS_VHADDPS,\r\n X86_INS_VHSUBPD,\r\n X86_INS_VHSUBPS,\r\n X86_INS_VINSERTF128,\r\n X86_INS_VINSERTF32X4,\r\n X86_INS_VINSERTF32X8,\r\n X86_INS_VINSERTF64X2,\r\n X86_INS_VINSERTF64X4,\r\n X86_INS_VINSERTI128,\r\n X86_INS_VINSERTI32X4,\r\n X86_INS_VINSERTI32X8,\r\n X86_INS_VINSERTI64X2,\r\n X86_INS_VINSERTI64X4,\r\n X86_INS_VINSERTPS,\r\n X86_INS_VLDDQU,\r\n X86_INS_VLDMXCSR,\r\n X86_INS_VMASKMOVDQU,\r\n X86_INS_VMASKMOVPD,\r\n X86_INS_VMASKMOVPS,\r\n X86_INS_VMAXPD,\r\n X86_INS_VMAXPS,\r\n X86_INS_VMAXSD,\r\n X86_INS_VMAXSS,\r\n X86_INS_VMCALL,\r\n X86_INS_VMCLEAR,\r\n X86_INS_VMFUNC,\r\n X86_INS_VMINPD,\r\n X86_INS_VMINPS,\r\n X86_INS_VMINSD,\r\n X86_INS_VMINSS,\r\n X86_INS_VMLAUNCH,\r\n X86_INS_VMLOAD,\r\n X86_INS_VMMCALL,\r\n X86_INS_VMOVQ,\r\n X86_INS_VMOVDDUP,\r\n X86_INS_VMOVD,\r\n X86_INS_VMOVDQA32,\r\n X86_INS_VMOVDQA64,\r\n X86_INS_VMOVDQA,\r\n X86_INS_VMOVDQU16,\r\n X86_INS_VMOVDQU32,\r\n X86_INS_VMOVDQU64,\r\n X86_INS_VMOVDQU8,\r\n X86_INS_VMOVDQU,\r\n X86_INS_VMOVHLPS,\r\n X86_INS_VMOVHPD,\r\n X86_INS_VMOVHPS,\r\n X86_INS_VMOVLHPS,\r\n X86_INS_VMOVLPD,\r\n X86_INS_VMOVLPS,\r\n X86_INS_VMOVMSKPD,\r\n X86_INS_VMOVMSKPS,\r\n X86_INS_VMOVNTDQA,\r\n X86_INS_VMOVNTDQ,\r\n X86_INS_VMOVNTPD,\r\n X86_INS_VMOVNTPS,\r\n X86_INS_VMOVSD,\r\n X86_INS_VMOVSHDUP,\r\n X86_INS_VMOVSLDUP,\r\n X86_INS_VMOVSS,\r\n X86_INS_VMOVUPD,\r\n X86_INS_VMOVUPS,\r\n X86_INS_VMPSADBW,\r\n X86_INS_VMPTRLD,\r\n X86_INS_VMPTRST,\r\n X86_INS_VMREAD,\r\n X86_INS_VMRESUME,\r\n X86_INS_VMRUN,\r\n X86_INS_VMSAVE,\r\n X86_INS_VMULPD,\r\n X86_INS_VMULPS,\r\n X86_INS_VMULSD,\r\n X86_INS_VMULSS,\r\n X86_INS_VMWRITE,\r\n X86_INS_VMXOFF,\r\n X86_INS_VMXON,\r\n X86_INS_VPABSB,\r\n X86_INS_VPABSD,\r\n X86_INS_VPABSQ,\r\n X86_INS_VPABSW,\r\n X86_INS_VPACKSSDW,\r\n X86_INS_VPACKSSWB,\r\n X86_INS_VPACKUSDW,\r\n X86_INS_VPACKUSWB,\r\n X86_INS_VPADDB,\r\n X86_INS_VPADDD,\r\n X86_INS_VPADDQ,\r\n X86_INS_VPADDSB,\r\n X86_INS_VPADDSW,\r\n X86_INS_VPADDUSB,\r\n X86_INS_VPADDUSW,\r\n X86_INS_VPADDW,\r\n X86_INS_VPALIGNR,\r\n X86_INS_VPANDD,\r\n X86_INS_VPANDND,\r\n X86_INS_VPANDNQ,\r\n X86_INS_VPANDN,\r\n X86_INS_VPANDQ,\r\n X86_INS_VPAND,\r\n X86_INS_VPAVGB,\r\n X86_INS_VPAVGW,\r\n X86_INS_VPBLENDD,\r\n X86_INS_VPBLENDMB,\r\n X86_INS_VPBLENDMD,\r\n X86_INS_VPBLENDMQ,\r\n X86_INS_VPBLENDMW,\r\n X86_INS_VPBLENDVB,\r\n X86_INS_VPBLENDW,\r\n X86_INS_VPBROADCASTB,\r\n X86_INS_VPBROADCASTD,\r\n X86_INS_VPBROADCASTMB2Q,\r\n X86_INS_VPBROADCASTMW2D,\r\n X86_INS_VPBROADCASTQ,\r\n X86_INS_VPBROADCASTW,\r\n X86_INS_VPCLMULQDQ,\r\n X86_INS_VPCMOV,\r\n X86_INS_VPCMPB,\r\n X86_INS_VPCMPD,\r\n X86_INS_VPCMPEQB,\r\n X86_INS_VPCMPEQD,\r\n X86_INS_VPCMPEQQ,\r\n X86_INS_VPCMPEQW,\r\n X86_INS_VPCMPESTRI,\r\n X86_INS_VPCMPESTRM,\r\n X86_INS_VPCMPGTB,\r\n X86_INS_VPCMPGTD,\r\n X86_INS_VPCMPGTQ,\r\n X86_INS_VPCMPGTW,\r\n X86_INS_VPCMPISTRI,\r\n X86_INS_VPCMPISTRM,\r\n X86_INS_VPCMPQ,\r\n X86_INS_VPCMPUB,\r\n X86_INS_VPCMPUD,\r\n X86_INS_VPCMPUQ,\r\n X86_INS_VPCMPUW,\r\n X86_INS_VPCMPW,\r\n X86_INS_VPCOMB,\r\n X86_INS_VPCOMD,\r\n X86_INS_VPCOMPRESSD,\r\n X86_INS_VPCOMPRESSQ,\r\n X86_INS_VPCOMQ,\r\n X86_INS_VPCOMUB,\r\n X86_INS_VPCOMUD,\r\n X86_INS_VPCOMUQ,\r\n X86_INS_VPCOMUW,\r\n X86_INS_VPCOMW,\r\n X86_INS_VPCONFLICTD,\r\n X86_INS_VPCONFLICTQ,\r\n X86_INS_VPERM2F128,\r\n X86_INS_VPERM2I128,\r\n X86_INS_VPERMD,\r\n X86_INS_VPERMI2D,\r\n X86_INS_VPERMI2PD,\r\n X86_INS_VPERMI2PS,\r\n X86_INS_VPERMI2Q,\r\n X86_INS_VPERMIL2PD,\r\n X86_INS_VPERMIL2PS,\r\n X86_INS_VPERMILPD,\r\n X86_INS_VPERMILPS,\r\n X86_INS_VPERMPD,\r\n X86_INS_VPERMPS,\r\n X86_INS_VPERMQ,\r\n X86_INS_VPERMT2D,\r\n X86_INS_VPERMT2PD,\r\n X86_INS_VPERMT2PS,\r\n X86_INS_VPERMT2Q,\r\n X86_INS_VPEXPANDD,\r\n X86_INS_VPEXPANDQ,\r\n X86_INS_VPEXTRB,\r\n X86_INS_VPEXTRD,\r\n X86_INS_VPEXTRQ,\r\n X86_INS_VPEXTRW,\r\n X86_INS_VPGATHERDD,\r\n X86_INS_VPGATHERDQ,\r\n X86_INS_VPGATHERQD,\r\n X86_INS_VPGATHERQQ,\r\n X86_INS_VPHADDBD,\r\n X86_INS_VPHADDBQ,\r\n X86_INS_VPHADDBW,\r\n X86_INS_VPHADDDQ,\r\n X86_INS_VPHADDD,\r\n X86_INS_VPHADDSW,\r\n X86_INS_VPHADDUBD,\r\n X86_INS_VPHADDUBQ,\r\n X86_INS_VPHADDUBW,\r\n X86_INS_VPHADDUDQ,\r\n X86_INS_VPHADDUWD,\r\n X86_INS_VPHADDUWQ,\r\n X86_INS_VPHADDWD,\r\n X86_INS_VPHADDWQ,\r\n X86_INS_VPHADDW,\r\n X86_INS_VPHMINPOSUW,\r\n X86_INS_VPHSUBBW,\r\n X86_INS_VPHSUBDQ,\r\n X86_INS_VPHSUBD,\r\n X86_INS_VPHSUBSW,\r\n X86_INS_VPHSUBWD,\r\n X86_INS_VPHSUBW,\r\n X86_INS_VPINSRB,\r\n X86_INS_VPINSRD,\r\n X86_INS_VPINSRQ,\r\n X86_INS_VPINSRW,\r\n X86_INS_VPLZCNTD,\r\n X86_INS_VPLZCNTQ,\r\n X86_INS_VPMACSDD,\r\n X86_INS_VPMACSDQH,\r\n X86_INS_VPMACSDQL,\r\n X86_INS_VPMACSSDD,\r\n X86_INS_VPMACSSDQH,\r\n X86_INS_VPMACSSDQL,\r\n X86_INS_VPMACSSWD,\r\n X86_INS_VPMACSSWW,\r\n X86_INS_VPMACSWD,\r\n X86_INS_VPMACSWW,\r\n X86_INS_VPMADCSSWD,\r\n X86_INS_VPMADCSWD,\r\n X86_INS_VPMADDUBSW,\r\n X86_INS_VPMADDWD,\r\n X86_INS_VPMASKMOVD,\r\n X86_INS_VPMASKMOVQ,\r\n X86_INS_VPMAXSB,\r\n X86_INS_VPMAXSD,\r\n X86_INS_VPMAXSQ,\r\n X86_INS_VPMAXSW,\r\n X86_INS_VPMAXUB,\r\n X86_INS_VPMAXUD,\r\n X86_INS_VPMAXUQ,\r\n X86_INS_VPMAXUW,\r\n X86_INS_VPMINSB,\r\n X86_INS_VPMINSD,\r\n X86_INS_VPMINSQ,\r\n X86_INS_VPMINSW,\r\n X86_INS_VPMINUB,\r\n X86_INS_VPMINUD,\r\n X86_INS_VPMINUQ,\r\n X86_INS_VPMINUW,\r\n X86_INS_VPMOVDB,\r\n X86_INS_VPMOVDW,\r\n X86_INS_VPMOVM2B,\r\n X86_INS_VPMOVM2D,\r\n X86_INS_VPMOVM2Q,\r\n X86_INS_VPMOVM2W,\r\n X86_INS_VPMOVMSKB,\r\n X86_INS_VPMOVQB,\r\n X86_INS_VPMOVQD,\r\n X86_INS_VPMOVQW,\r\n X86_INS_VPMOVSDB,\r\n X86_INS_VPMOVSDW,\r\n X86_INS_VPMOVSQB,\r\n X86_INS_VPMOVSQD,\r\n X86_INS_VPMOVSQW,\r\n X86_INS_VPMOVSXBD,\r\n X86_INS_VPMOVSXBQ,\r\n X86_INS_VPMOVSXBW,\r\n X86_INS_VPMOVSXDQ,\r\n X86_INS_VPMOVSXWD,\r\n X86_INS_VPMOVSXWQ,\r\n X86_INS_VPMOVUSDB,\r\n X86_INS_VPMOVUSDW,\r\n X86_INS_VPMOVUSQB,\r\n X86_INS_VPMOVUSQD,\r\n X86_INS_VPMOVUSQW,\r\n X86_INS_VPMOVZXBD,\r\n X86_INS_VPMOVZXBQ,\r\n X86_INS_VPMOVZXBW,\r\n X86_INS_VPMOVZXDQ,\r\n X86_INS_VPMOVZXWD,\r\n X86_INS_VPMOVZXWQ,\r\n X86_INS_VPMULDQ,\r\n X86_INS_VPMULHRSW,\r\n X86_INS_VPMULHUW,\r\n X86_INS_VPMULHW,\r\n X86_INS_VPMULLD,\r\n X86_INS_VPMULLQ,\r\n X86_INS_VPMULLW,\r\n X86_INS_VPMULUDQ,\r\n X86_INS_VPORD,\r\n X86_INS_VPORQ,\r\n X86_INS_VPOR,\r\n X86_INS_VPPERM,\r\n X86_INS_VPROTB,\r\n X86_INS_VPROTD,\r\n X86_INS_VPROTQ,\r\n X86_INS_VPROTW,\r\n X86_INS_VPSADBW,\r\n X86_INS_VPSCATTERDD,\r\n X86_INS_VPSCATTERDQ,\r\n X86_INS_VPSCATTERQD,\r\n X86_INS_VPSCATTERQQ,\r\n X86_INS_VPSHAB,\r\n X86_INS_VPSHAD,\r\n X86_INS_VPSHAQ,\r\n X86_INS_VPSHAW,\r\n X86_INS_VPSHLB,\r\n X86_INS_VPSHLD,\r\n X86_INS_VPSHLQ,\r\n X86_INS_VPSHLW,\r\n X86_INS_VPSHUFB,\r\n X86_INS_VPSHUFD,\r\n X86_INS_VPSHUFHW,\r\n X86_INS_VPSHUFLW,\r\n X86_INS_VPSIGNB,\r\n X86_INS_VPSIGND,\r\n X86_INS_VPSIGNW,\r\n X86_INS_VPSLLDQ,\r\n X86_INS_VPSLLD,\r\n X86_INS_VPSLLQ,\r\n X86_INS_VPSLLVD,\r\n X86_INS_VPSLLVQ,\r\n X86_INS_VPSLLW,\r\n X86_INS_VPSRAD,\r\n X86_INS_VPSRAQ,\r\n X86_INS_VPSRAVD,\r\n X86_INS_VPSRAVQ,\r\n X86_INS_VPSRAW,\r\n X86_INS_VPSRLDQ,\r\n X86_INS_VPSRLD,\r\n X86_INS_VPSRLQ,\r\n X86_INS_VPSRLVD,\r\n X86_INS_VPSRLVQ,\r\n X86_INS_VPSRLW,\r\n X86_INS_VPSUBB,\r\n X86_INS_VPSUBD,\r\n X86_INS_VPSUBQ,\r\n X86_INS_VPSUBSB,\r\n X86_INS_VPSUBSW,\r\n X86_INS_VPSUBUSB,\r\n X86_INS_VPSUBUSW,\r\n X86_INS_VPSUBW,\r\n X86_INS_VPTESTMD,\r\n X86_INS_VPTESTMQ,\r\n X86_INS_VPTESTNMD,\r\n X86_INS_VPTESTNMQ,\r\n X86_INS_VPTEST,\r\n X86_INS_VPUNPCKHBW,\r\n X86_INS_VPUNPCKHDQ,\r\n X86_INS_VPUNPCKHQDQ,\r\n X86_INS_VPUNPCKHWD,\r\n X86_INS_VPUNPCKLBW,\r\n X86_INS_VPUNPCKLDQ,\r\n X86_INS_VPUNPCKLQDQ,\r\n X86_INS_VPUNPCKLWD,\r\n X86_INS_VPXORD,\r\n X86_INS_VPXORQ,\r\n X86_INS_VPXOR,\r\n X86_INS_VRCP14PD,\r\n X86_INS_VRCP14PS,\r\n X86_INS_VRCP14SD,\r\n X86_INS_VRCP14SS,\r\n X86_INS_VRCP28PD,\r\n X86_INS_VRCP28PS,\r\n X86_INS_VRCP28SD,\r\n X86_INS_VRCP28SS,\r\n X86_INS_VRCPPS,\r\n X86_INS_VRCPSS,\r\n X86_INS_VRNDSCALEPD,\r\n X86_INS_VRNDSCALEPS,\r\n X86_INS_VRNDSCALESD,\r\n X86_INS_VRNDSCALESS,\r\n X86_INS_VROUNDPD,\r\n X86_INS_VROUNDPS,\r\n X86_INS_VROUNDSD,\r\n X86_INS_VROUNDSS,\r\n X86_INS_VRSQRT14PD,\r\n X86_INS_VRSQRT14PS,\r\n X86_INS_VRSQRT14SD,\r\n X86_INS_VRSQRT14SS,\r\n X86_INS_VRSQRT28PD,\r\n X86_INS_VRSQRT28PS,\r\n X86_INS_VRSQRT28SD,\r\n X86_INS_VRSQRT28SS,\r\n X86_INS_VRSQRTPS,\r\n X86_INS_VRSQRTSS,\r\n X86_INS_VSCATTERDPD,\r\n X86_INS_VSCATTERDPS,\r\n X86_INS_VSCATTERPF0DPD,\r\n X86_INS_VSCATTERPF0DPS,\r\n X86_INS_VSCATTERPF0QPD,\r\n X86_INS_VSCATTERPF0QPS,\r\n X86_INS_VSCATTERPF1DPD,\r\n X86_INS_VSCATTERPF1DPS,\r\n X86_INS_VSCATTERPF1QPD,\r\n X86_INS_VSCATTERPF1QPS,\r\n X86_INS_VSCATTERQPD,\r\n X86_INS_VSCATTERQPS,\r\n X86_INS_VSHUFPD,\r\n X86_INS_VSHUFPS,\r\n X86_INS_VSQRTPD,\r\n X86_INS_VSQRTPS,\r\n X86_INS_VSQRTSD,\r\n X86_INS_VSQRTSS,\r\n X86_INS_VSTMXCSR,\r\n X86_INS_VSUBPD,\r\n X86_INS_VSUBPS,\r\n X86_INS_VSUBSD,\r\n X86_INS_VSUBSS,\r\n X86_INS_VTESTPD,\r\n X86_INS_VTESTPS,\r\n X86_INS_VUNPCKHPD,\r\n X86_INS_VUNPCKHPS,\r\n X86_INS_VUNPCKLPD,\r\n X86_INS_VUNPCKLPS,\r\n X86_INS_VZEROALL,\r\n X86_INS_VZEROUPPER,\r\n X86_INS_WAIT,\r\n X86_INS_WBINVD,\r\n X86_INS_WRFSBASE,\r\n X86_INS_WRGSBASE,\r\n X86_INS_WRMSR,\r\n X86_INS_XABORT,\r\n X86_INS_XACQUIRE,\r\n X86_INS_XBEGIN,\r\n X86_INS_XCHG,\r\n X86_INS_XCRYPTCBC,\r\n X86_INS_XCRYPTCFB,\r\n X86_INS_XCRYPTCTR,\r\n X86_INS_XCRYPTECB,\r\n X86_INS_XCRYPTOFB,\r\n X86_INS_XEND,\r\n X86_INS_XGETBV,\r\n X86_INS_XLATB,\r\n X86_INS_XRELEASE,\r\n X86_INS_XRSTOR,\r\n X86_INS_XRSTOR64,\r\n X86_INS_XRSTORS,\r\n X86_INS_XRSTORS64,\r\n X86_INS_XSAVE,\r\n X86_INS_XSAVE64,\r\n X86_INS_XSAVEC,\r\n X86_INS_XSAVEC64,\r\n X86_INS_XSAVEOPT,\r\n X86_INS_XSAVEOPT64,\r\n X86_INS_XSAVES,\r\n X86_INS_XSAVES64,\r\n X86_INS_XSETBV,\r\n X86_INS_XSHA1,\r\n X86_INS_XSHA256,\r\n X86_INS_XSTORE,\r\n X86_INS_XTEST,\r\n X86_INS_FDISI8087_NOP,\r\n X86_INS_FENI8087_NOP,\r\n\r\n // pseudo instructions\r\n X86_INS_CMPSS,\r\n X86_INS_CMPEQSS,\r\n X86_INS_CMPLTSS,\r\n X86_INS_CMPLESS,\r\n X86_INS_CMPUNORDSS,\r\n X86_INS_CMPNEQSS,\r\n X86_INS_CMPNLTSS,\r\n X86_INS_CMPNLESS,\r\n X86_INS_CMPORDSS,\r\n\r\n X86_INS_CMPSD,\r\n X86_INS_CMPEQSD,\r\n X86_INS_CMPLTSD,\r\n X86_INS_CMPLESD,\r\n X86_INS_CMPUNORDSD,\r\n X86_INS_CMPNEQSD,\r\n X86_INS_CMPNLTSD,\r\n X86_INS_CMPNLESD,\r\n X86_INS_CMPORDSD,\r\n\r\n X86_INS_CMPPS,\r\n X86_INS_CMPEQPS,\r\n X86_INS_CMPLTPS,\r\n X86_INS_CMPLEPS,\r\n X86_INS_CMPUNORDPS,\r\n X86_INS_CMPNEQPS,\r\n X86_INS_CMPNLTPS,\r\n X86_INS_CMPNLEPS,\r\n X86_INS_CMPORDPS,\r\n\r\n X86_INS_CMPPD,\r\n X86_INS_CMPEQPD,\r\n X86_INS_CMPLTPD,\r\n X86_INS_CMPLEPD,\r\n X86_INS_CMPUNORDPD,\r\n X86_INS_CMPNEQPD,\r\n X86_INS_CMPNLTPD,\r\n X86_INS_CMPNLEPD,\r\n X86_INS_CMPORDPD,\r\n\r\n X86_INS_VCMPSS,\r\n X86_INS_VCMPEQSS,\r\n X86_INS_VCMPLTSS,\r\n X86_INS_VCMPLESS,\r\n X86_INS_VCMPUNORDSS,\r\n X86_INS_VCMPNEQSS,\r\n X86_INS_VCMPNLTSS,\r\n X86_INS_VCMPNLESS,\r\n X86_INS_VCMPORDSS,\r\n X86_INS_VCMPEQ_UQSS,\r\n X86_INS_VCMPNGESS,\r\n X86_INS_VCMPNGTSS,\r\n X86_INS_VCMPFALSESS,\r\n X86_INS_VCMPNEQ_OQSS,\r\n X86_INS_VCMPGESS,\r\n X86_INS_VCMPGTSS,\r\n X86_INS_VCMPTRUESS,\r\n X86_INS_VCMPEQ_OSSS,\r\n X86_INS_VCMPLT_OQSS,\r\n X86_INS_VCMPLE_OQSS,\r\n X86_INS_VCMPUNORD_SSS,\r\n X86_INS_VCMPNEQ_USSS,\r\n X86_INS_VCMPNLT_UQSS,\r\n X86_INS_VCMPNLE_UQSS,\r\n X86_INS_VCMPORD_SSS,\r\n X86_INS_VCMPEQ_USSS,\r\n X86_INS_VCMPNGE_UQSS,\r\n X86_INS_VCMPNGT_UQSS,\r\n X86_INS_VCMPFALSE_OSSS,\r\n X86_INS_VCMPNEQ_OSSS,\r\n X86_INS_VCMPGE_OQSS,\r\n X86_INS_VCMPGT_OQSS,\r\n X86_INS_VCMPTRUE_USSS,\r\n\r\n X86_INS_VCMPSD,\r\n X86_INS_VCMPEQSD,\r\n X86_INS_VCMPLTSD,\r\n X86_INS_VCMPLESD,\r\n X86_INS_VCMPUNORDSD,\r\n X86_INS_VCMPNEQSD,\r\n X86_INS_VCMPNLTSD,\r\n X86_INS_VCMPNLESD,\r\n X86_INS_VCMPORDSD,\r\n X86_INS_VCMPEQ_UQSD,\r\n X86_INS_VCMPNGESD,\r\n X86_INS_VCMPNGTSD,\r\n X86_INS_VCMPFALSESD,\r\n X86_INS_VCMPNEQ_OQSD,\r\n X86_INS_VCMPGESD,\r\n X86_INS_VCMPGTSD,\r\n X86_INS_VCMPTRUESD,\r\n X86_INS_VCMPEQ_OSSD,\r\n X86_INS_VCMPLT_OQSD,\r\n X86_INS_VCMPLE_OQSD,\r\n X86_INS_VCMPUNORD_SSD,\r\n X86_INS_VCMPNEQ_USSD,\r\n X86_INS_VCMPNLT_UQSD,\r\n X86_INS_VCMPNLE_UQSD,\r\n X86_INS_VCMPORD_SSD,\r\n X86_INS_VCMPEQ_USSD,\r\n X86_INS_VCMPNGE_UQSD,\r\n X86_INS_VCMPNGT_UQSD,\r\n X86_INS_VCMPFALSE_OSSD,\r\n X86_INS_VCMPNEQ_OSSD,\r\n X86_INS_VCMPGE_OQSD,\r\n X86_INS_VCMPGT_OQSD,\r\n X86_INS_VCMPTRUE_USSD,\r\n\r\n X86_INS_VCMPPS,\r\n X86_INS_VCMPEQPS,\r\n X86_INS_VCMPLTPS,\r\n X86_INS_VCMPLEPS,\r\n X86_INS_VCMPUNORDPS,\r\n X86_INS_VCMPNEQPS,\r\n X86_INS_VCMPNLTPS,\r\n X86_INS_VCMPNLEPS,\r\n X86_INS_VCMPORDPS,\r\n X86_INS_VCMPEQ_UQPS,\r\n X86_INS_VCMPNGEPS,\r\n X86_INS_VCMPNGTPS,\r\n X86_INS_VCMPFALSEPS,\r\n X86_INS_VCMPNEQ_OQPS,\r\n X86_INS_VCMPGEPS,\r\n X86_INS_VCMPGTPS,\r\n X86_INS_VCMPTRUEPS,\r\n X86_INS_VCMPEQ_OSPS,\r\n X86_INS_VCMPLT_OQPS,\r\n X86_INS_VCMPLE_OQPS,\r\n X86_INS_VCMPUNORD_SPS,\r\n X86_INS_VCMPNEQ_USPS,\r\n X86_INS_VCMPNLT_UQPS,\r\n X86_INS_VCMPNLE_UQPS,\r\n X86_INS_VCMPORD_SPS,\r\n X86_INS_VCMPEQ_USPS,\r\n X86_INS_VCMPNGE_UQPS,\r\n X86_INS_VCMPNGT_UQPS,\r\n X86_INS_VCMPFALSE_OSPS,\r\n X86_INS_VCMPNEQ_OSPS,\r\n X86_INS_VCMPGE_OQPS,\r\n X86_INS_VCMPGT_OQPS,\r\n X86_INS_VCMPTRUE_USPS,\r\n\r\n X86_INS_VCMPPD,\r\n X86_INS_VCMPEQPD,\r\n X86_INS_VCMPLTPD,\r\n X86_INS_VCMPLEPD,\r\n X86_INS_VCMPUNORDPD,\r\n X86_INS_VCMPNEQPD,\r\n X86_INS_VCMPNLTPD,\r\n X86_INS_VCMPNLEPD,\r\n X86_INS_VCMPORDPD,\r\n X86_INS_VCMPEQ_UQPD,\r\n X86_INS_VCMPNGEPD,\r\n X86_INS_VCMPNGTPD,\r\n X86_INS_VCMPFALSEPD,\r\n X86_INS_VCMPNEQ_OQPD,\r\n X86_INS_VCMPGEPD,\r\n X86_INS_VCMPGTPD,\r\n X86_INS_VCMPTRUEPD,\r\n X86_INS_VCMPEQ_OSPD,\r\n X86_INS_VCMPLT_OQPD,\r\n X86_INS_VCMPLE_OQPD,\r\n X86_INS_VCMPUNORD_SPD,\r\n X86_INS_VCMPNEQ_USPD,\r\n X86_INS_VCMPNLT_UQPD,\r\n X86_INS_VCMPNLE_UQPD,\r\n X86_INS_VCMPORD_SPD,\r\n X86_INS_VCMPEQ_USPD,\r\n X86_INS_VCMPNGE_UQPD,\r\n X86_INS_VCMPNGT_UQPD,\r\n X86_INS_VCMPFALSE_OSPD,\r\n X86_INS_VCMPNEQ_OSPD,\r\n X86_INS_VCMPGE_OQPD,\r\n X86_INS_VCMPGT_OQPD,\r\n X86_INS_VCMPTRUE_USPD,\r\n\r\n X86_INS_ENDING, // mark the end of the list of insn\r\n} x86_insn;\r\n\r\n//> Group of X86 instructions\r\ntypedef enum x86_insn_group\r\n{\r\n X86_GRP_INVALID = 0, // = CS_GRP_INVALID\r\n\r\n //> Generic groups\r\n // all jump instructions (conditional+direct+indirect jumps)\r\n X86_GRP_JUMP, // = CS_GRP_JUMP\r\n // all call instructions\r\n X86_GRP_CALL, // = CS_GRP_CALL\r\n // all return instructions\r\n X86_GRP_RET, // = CS_GRP_RET\r\n // all interrupt instructions (int+syscall)\r\n X86_GRP_INT, // = CS_GRP_INT\r\n // all interrupt return instructions\r\n X86_GRP_IRET, // = CS_GRP_IRET\r\n // all privileged instructions\r\n X86_GRP_PRIVILEGE, // = CS_GRP_PRIVILEGE\r\n\r\n //> Architecture-specific groups\r\n X86_GRP_VM = 128, // all virtualization instructions (VT-x + AMD-V)\r\n X86_GRP_3DNOW,\r\n X86_GRP_AES,\r\n X86_GRP_ADX,\r\n X86_GRP_AVX,\r\n X86_GRP_AVX2,\r\n X86_GRP_AVX512,\r\n X86_GRP_BMI,\r\n X86_GRP_BMI2,\r\n X86_GRP_CMOV,\r\n X86_GRP_F16C,\r\n X86_GRP_FMA,\r\n X86_GRP_FMA4,\r\n X86_GRP_FSGSBASE,\r\n X86_GRP_HLE,\r\n X86_GRP_MMX,\r\n X86_GRP_MODE32,\r\n X86_GRP_MODE64,\r\n X86_GRP_RTM,\r\n X86_GRP_SHA,\r\n X86_GRP_SSE1,\r\n X86_GRP_SSE2,\r\n X86_GRP_SSE3,\r\n X86_GRP_SSE41,\r\n X86_GRP_SSE42,\r\n X86_GRP_SSE4A,\r\n X86_GRP_SSSE3,\r\n X86_GRP_PCLMUL,\r\n X86_GRP_XOP,\r\n X86_GRP_CDI,\r\n X86_GRP_ERI,\r\n X86_GRP_TBM,\r\n X86_GRP_16BITMODE,\r\n X86_GRP_NOT64BITMODE,\r\n X86_GRP_SGX,\r\n X86_GRP_DQI,\r\n X86_GRP_BWI,\r\n X86_GRP_PFI,\r\n X86_GRP_VLX,\r\n X86_GRP_SMAP,\r\n X86_GRP_NOVLX,\r\n\r\n X86_GRP_ENDING\r\n} x86_insn_group;\r\n\r\n#ifdef __cplusplus\r\n}\r\n#endif\r\n\r\n#endif\r\n" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/capstone/xcore.h", "content": "#ifndef CAPSTONE_XCORE_H\r\n#define CAPSTONE_XCORE_H\r\n\r\n/* Capstone Disassembly Engine */\r\n/* By Nguyen Anh Quynh , 2014-2015 */\r\n\r\n#ifdef __cplusplus\r\nextern \"C\" {\r\n#endif\r\n\r\n#include \"platform.h\"\r\n\r\n#ifdef _MSC_VER\r\n#pragma warning(disable:4201)\r\n#endif\r\n\r\n//> Operand type for instruction's operands\r\ntypedef enum xcore_op_type\r\n{\r\n XCORE_OP_INVALID = 0, // = CS_OP_INVALID (Uninitialized).\r\n XCORE_OP_REG, // = CS_OP_REG (Register operand).\r\n XCORE_OP_IMM, // = CS_OP_IMM (Immediate operand).\r\n XCORE_OP_MEM, // = CS_OP_MEM (Memory operand).\r\n} xcore_op_type;\r\n\r\n//> XCore registers\r\ntypedef enum xcore_reg\r\n{\r\n XCORE_REG_INVALID = 0,\r\n\r\n XCORE_REG_CP,\r\n XCORE_REG_DP,\r\n XCORE_REG_LR,\r\n XCORE_REG_SP,\r\n XCORE_REG_R0,\r\n XCORE_REG_R1,\r\n XCORE_REG_R2,\r\n XCORE_REG_R3,\r\n XCORE_REG_R4,\r\n XCORE_REG_R5,\r\n XCORE_REG_R6,\r\n XCORE_REG_R7,\r\n XCORE_REG_R8,\r\n XCORE_REG_R9,\r\n XCORE_REG_R10,\r\n XCORE_REG_R11,\r\n\r\n //> pseudo registers\r\n XCORE_REG_PC, // pc\r\n\r\n // internal thread registers\r\n // see The-XMOS-XS1-Architecture(X7879A).pdf\r\n XCORE_REG_SCP, // save pc\r\n XCORE_REG_SSR, // save status\r\n XCORE_REG_ET, // exception type\r\n XCORE_REG_ED, // exception data\r\n XCORE_REG_SED, // save exception data\r\n XCORE_REG_KEP, // kernel entry pointer\r\n XCORE_REG_KSP, // kernel stack pointer\r\n XCORE_REG_ID, // thread ID\r\n\r\n XCORE_REG_ENDING, // <-- mark the end of the list of registers\r\n} xcore_reg;\r\n\r\n// Instruction's operand referring to memory\r\n// This is associated with XCORE_OP_MEM operand type above\r\ntypedef struct xcore_op_mem\r\n{\r\n uint8_t base; // base register, can be safely interpreted as\r\n // a value of type `xcore_reg`, but it is only\r\n // one byte wide\r\n uint8_t index; // index register, same conditions apply here\r\n int32_t disp; // displacement/offset value\r\n int direct; // +1: forward, -1: backward\r\n} xcore_op_mem;\r\n\r\n// Instruction operand\r\ntypedef struct cs_xcore_op\r\n{\r\n xcore_op_type type; // operand type\r\n union\r\n {\r\n xcore_reg reg; // register value for REG operand\r\n int32_t imm; // immediate value for IMM operand\r\n xcore_op_mem mem; // base/disp value for MEM operand\r\n };\r\n} cs_xcore_op;\r\n\r\n// Instruction structure\r\ntypedef struct cs_xcore\r\n{\r\n // Number of operands of this instruction,\r\n // or 0 when instruction has no operand.\r\n uint8_t op_count;\r\n cs_xcore_op operands[8]; // operands for this instruction.\r\n} cs_xcore;\r\n\r\n//> XCore instruction\r\ntypedef enum xcore_insn\r\n{\r\n XCORE_INS_INVALID = 0,\r\n\r\n XCORE_INS_ADD,\r\n XCORE_INS_ANDNOT,\r\n XCORE_INS_AND,\r\n XCORE_INS_ASHR,\r\n XCORE_INS_BAU,\r\n XCORE_INS_BITREV,\r\n XCORE_INS_BLA,\r\n XCORE_INS_BLAT,\r\n XCORE_INS_BL,\r\n XCORE_INS_BF,\r\n XCORE_INS_BT,\r\n XCORE_INS_BU,\r\n XCORE_INS_BRU,\r\n XCORE_INS_BYTEREV,\r\n XCORE_INS_CHKCT,\r\n XCORE_INS_CLRE,\r\n XCORE_INS_CLRPT,\r\n XCORE_INS_CLRSR,\r\n XCORE_INS_CLZ,\r\n XCORE_INS_CRC8,\r\n XCORE_INS_CRC32,\r\n XCORE_INS_DCALL,\r\n XCORE_INS_DENTSP,\r\n XCORE_INS_DGETREG,\r\n XCORE_INS_DIVS,\r\n XCORE_INS_DIVU,\r\n XCORE_INS_DRESTSP,\r\n XCORE_INS_DRET,\r\n XCORE_INS_ECALLF,\r\n XCORE_INS_ECALLT,\r\n XCORE_INS_EDU,\r\n XCORE_INS_EEF,\r\n XCORE_INS_EET,\r\n XCORE_INS_EEU,\r\n XCORE_INS_ENDIN,\r\n XCORE_INS_ENTSP,\r\n XCORE_INS_EQ,\r\n XCORE_INS_EXTDP,\r\n XCORE_INS_EXTSP,\r\n XCORE_INS_FREER,\r\n XCORE_INS_FREET,\r\n XCORE_INS_GETD,\r\n XCORE_INS_GET,\r\n XCORE_INS_GETN,\r\n XCORE_INS_GETR,\r\n XCORE_INS_GETSR,\r\n XCORE_INS_GETST,\r\n XCORE_INS_GETTS,\r\n XCORE_INS_INCT,\r\n XCORE_INS_INIT,\r\n XCORE_INS_INPW,\r\n XCORE_INS_INSHR,\r\n XCORE_INS_INT,\r\n XCORE_INS_IN,\r\n XCORE_INS_KCALL,\r\n XCORE_INS_KENTSP,\r\n XCORE_INS_KRESTSP,\r\n XCORE_INS_KRET,\r\n XCORE_INS_LADD,\r\n XCORE_INS_LD16S,\r\n XCORE_INS_LD8U,\r\n XCORE_INS_LDA16,\r\n XCORE_INS_LDAP,\r\n XCORE_INS_LDAW,\r\n XCORE_INS_LDC,\r\n XCORE_INS_LDW,\r\n XCORE_INS_LDIVU,\r\n XCORE_INS_LMUL,\r\n XCORE_INS_LSS,\r\n XCORE_INS_LSUB,\r\n XCORE_INS_LSU,\r\n XCORE_INS_MACCS,\r\n XCORE_INS_MACCU,\r\n XCORE_INS_MJOIN,\r\n XCORE_INS_MKMSK,\r\n XCORE_INS_MSYNC,\r\n XCORE_INS_MUL,\r\n XCORE_INS_NEG,\r\n XCORE_INS_NOT,\r\n XCORE_INS_OR,\r\n XCORE_INS_OUTCT,\r\n XCORE_INS_OUTPW,\r\n XCORE_INS_OUTSHR,\r\n XCORE_INS_OUTT,\r\n XCORE_INS_OUT,\r\n XCORE_INS_PEEK,\r\n XCORE_INS_REMS,\r\n XCORE_INS_REMU,\r\n XCORE_INS_RETSP,\r\n XCORE_INS_SETCLK,\r\n XCORE_INS_SET,\r\n XCORE_INS_SETC,\r\n XCORE_INS_SETD,\r\n XCORE_INS_SETEV,\r\n XCORE_INS_SETN,\r\n XCORE_INS_SETPSC,\r\n XCORE_INS_SETPT,\r\n XCORE_INS_SETRDY,\r\n XCORE_INS_SETSR,\r\n XCORE_INS_SETTW,\r\n XCORE_INS_SETV,\r\n XCORE_INS_SEXT,\r\n XCORE_INS_SHL,\r\n XCORE_INS_SHR,\r\n XCORE_INS_SSYNC,\r\n XCORE_INS_ST16,\r\n XCORE_INS_ST8,\r\n XCORE_INS_STW,\r\n XCORE_INS_SUB,\r\n XCORE_INS_SYNCR,\r\n XCORE_INS_TESTCT,\r\n XCORE_INS_TESTLCL,\r\n XCORE_INS_TESTWCT,\r\n XCORE_INS_TSETMR,\r\n XCORE_INS_START,\r\n XCORE_INS_WAITEF,\r\n XCORE_INS_WAITET,\r\n XCORE_INS_WAITEU,\r\n XCORE_INS_XOR,\r\n XCORE_INS_ZEXT,\r\n\r\n XCORE_INS_ENDING, // <-- mark the end of the list of instructions\r\n} xcore_insn;\r\n\r\n//> Group of XCore instructions\r\ntypedef enum xcore_insn_group\r\n{\r\n XCORE_GRP_INVALID = 0, // = CS_GRP_INVALID\r\n\r\n //> Generic groups\r\n // all jump instructions (conditional+direct+indirect jumps)\r\n XCORE_GRP_JUMP, // = CS_GRP_JUMP\r\n\r\n XCORE_GRP_ENDING, // <-- mark the end of the list of groups\r\n} xcore_insn_group;\r\n\r\n#ifdef __cplusplus\r\n}\r\n#endif\r\n\r\n#endif\r\n" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/dbghelp/dbghelp.h", "content": "#ifndef _DBGHELP_\r\n#define _DBGHELP_\r\n\r\n\r\n// As a general principal always call the 64 bit version\r\n// of every API, if a choice exists. The 64 bit version\r\n// works great on 32 bit platforms, and is forward\r\n// compatible to 64 bit platforms.\r\n\r\n#ifdef _WIN64\r\n#ifndef _IMAGEHLP64\r\n#define _IMAGEHLP64\r\n#endif\r\n#endif\r\n\r\n#pragma pack(push,8)\r\n\r\n// For those without specstrings.h\r\n// Since there are different versions of this header, I need to\r\n// individually test each item and define it if it is not around.\r\n\r\n#ifndef __in\r\n#define __in\r\n#endif\r\n#ifndef __out\r\n#define __out\r\n#endif\r\n#ifndef __inout\r\n#define __inout\r\n#endif\r\n#ifndef __in_opt\r\n#define __in_opt\r\n#endif\r\n#ifndef __out_opt\r\n#define __out_opt\r\n#endif\r\n#ifndef __inout_opt\r\n#define __inout_opt\r\n#endif\r\n#ifndef __in_ecount\r\n#define __in_ecount(x)\r\n#endif\r\n#ifndef __out_ecount\r\n#define __out_ecount(x)\r\n#endif\r\n#ifndef __inout_ecount\r\n#define __inout_ecount(x)\r\n#endif\r\n#ifndef __in_bcount\r\n#define __in_bcount(x)\r\n#endif\r\n#ifndef __out_bcount\r\n#define __out_bcount(x)\r\n#endif\r\n#ifndef __inout_bcount\r\n#define __inout_bcount(x)\r\n#endif\r\n#ifndef __out_xcount\r\n#define __out_xcount(x)\r\n#endif\r\n#ifndef __deref_opt_out\r\n#define __deref_opt_out\r\n#endif\r\n#ifndef __deref_out\r\n#define __deref_out\r\n#endif\r\n#ifndef __out_ecount_opt\r\n#define __out_ecount_opt(x)\r\n#endif\r\n#ifndef __in_bcount_opt\r\n#define __in_bcount_opt(x)\r\n#endif\r\n#ifndef __out_bcount_opt\r\n#define __out_bcount_opt(x)\r\n#endif\r\n#ifndef __deref_out_opt\r\n#define __deref_out_opt\r\n#endif\r\n\r\n\r\n#ifdef __cplusplus\r\nextern \"C\" {\r\n#endif\r\n\r\n#ifdef _IMAGEHLP_SOURCE_\r\n#define IMAGEAPI __stdcall\r\n#define DBHLP_DEPRECIATED\r\n#else\r\n#define IMAGEAPI DECLSPEC_IMPORT __stdcall\r\n#if (_MSC_VER >= 1300) && !defined(MIDL_PASS)\r\n#define DBHLP_DEPRECIATED __declspec(deprecated)\r\n#else\r\n#define DBHLP_DEPRECIATED\r\n#endif\r\n#endif\r\n\r\n#define DBHLPAPI IMAGEAPI\r\n\r\n#define IMAGE_SEPARATION (64*1024)\r\n\r\n// Observant readers may notice that 2 new fields,\r\n// 'fReadOnly' and 'Version' have been added to\r\n// the LOADED_IMAGE structure after 'fDOSImage'.\r\n// This does not change the size of the structure\r\n// from previous headers. That is because while\r\n// 'fDOSImage' is a byte, it is padded by the\r\n// compiler to 4 bytes. So the 2 new fields are\r\n// slipped into the extra space.\r\n\r\ntypedef struct _LOADED_IMAGE\r\n{\r\n PSTR ModuleName;\r\n HANDLE hFile;\r\n PUCHAR MappedAddress;\r\n#ifdef _IMAGEHLP64\r\n PIMAGE_NT_HEADERS64 FileHeader;\r\n#else\r\n PIMAGE_NT_HEADERS32 FileHeader;\r\n#endif\r\n PIMAGE_SECTION_HEADER LastRvaSection;\r\n ULONG NumberOfSections;\r\n PIMAGE_SECTION_HEADER Sections;\r\n ULONG Characteristics;\r\n BOOLEAN fSystemImage;\r\n BOOLEAN fDOSImage;\r\n BOOLEAN fReadOnly;\r\n UCHAR Version;\r\n LIST_ENTRY Links;\r\n ULONG SizeOfImage;\r\n} LOADED_IMAGE, *PLOADED_IMAGE;\r\n\r\n#define MAX_SYM_NAME 2000\r\n\r\n\r\n// Error codes set by dbghelp functions. Call GetLastError\r\n// to see them.\r\n// Dbghelp also sets error codes found in winerror.h\r\n\r\n#define ERROR_IMAGE_NOT_STRIPPED 0x8800 // the image is not stripped. No dbg file available.\r\n#define ERROR_NO_DBG_POINTER 0x8801 // image is stripped but there is no pointer to a dbg file\r\n#define ERROR_NO_PDB_POINTER 0x8802 // image does not point to a pdb file\r\n\r\ntypedef BOOL\r\n(CALLBACK* PFIND_DEBUG_FILE_CALLBACK)(\r\n __in HANDLE FileHandle,\r\n __in PCSTR FileName,\r\n __in PVOID CallerData\r\n);\r\n\r\nHANDLE\r\nIMAGEAPI\r\nSymFindDebugInfoFile(\r\n __in HANDLE hProcess,\r\n __in PCSTR FileName,\r\n __out_ecount(MAX_PATH + 1) PSTR DebugFilePath,\r\n __in_opt PFIND_DEBUG_FILE_CALLBACK Callback,\r\n __in_opt PVOID CallerData\r\n);\r\n\r\ntypedef BOOL\r\n(CALLBACK* PFIND_DEBUG_FILE_CALLBACKW)(\r\n __in HANDLE FileHandle,\r\n __in PCWSTR FileName,\r\n __in PVOID CallerData\r\n);\r\n\r\nHANDLE\r\nIMAGEAPI\r\nSymFindDebugInfoFileW(\r\n __in HANDLE hProcess,\r\n __in PCWSTR FileName,\r\n __out_ecount(MAX_PATH + 1) PWSTR DebugFilePath,\r\n __in_opt PFIND_DEBUG_FILE_CALLBACKW Callback,\r\n __in_opt PVOID CallerData\r\n);\r\n\r\nHANDLE\r\nIMAGEAPI\r\nFindDebugInfoFile(\r\n __in PCSTR FileName,\r\n __in PCSTR SymbolPath,\r\n __out_ecount(MAX_PATH + 1) PSTR DebugFilePath\r\n);\r\n\r\nHANDLE\r\nIMAGEAPI\r\nFindDebugInfoFileEx(\r\n __in PCSTR FileName,\r\n __in PCSTR SymbolPath,\r\n __out_ecount(MAX_PATH + 1) PSTR DebugFilePath,\r\n __in_opt PFIND_DEBUG_FILE_CALLBACK Callback,\r\n __in_opt PVOID CallerData\r\n);\r\n\r\nHANDLE\r\nIMAGEAPI\r\nFindDebugInfoFileExW(\r\n __in PCWSTR FileName,\r\n __in PCWSTR SymbolPath,\r\n __out_ecount(MAX_PATH + 1) PWSTR DebugFilePath,\r\n __in_opt PFIND_DEBUG_FILE_CALLBACKW Callback,\r\n __in_opt PVOID CallerData\r\n);\r\n\r\ntypedef BOOL\r\n(CALLBACK* PFINDFILEINPATHCALLBACK)(\r\n __in PCSTR filename,\r\n __in PVOID context\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymFindFileInPath(\r\n __in HANDLE hprocess,\r\n __in_opt PCSTR SearchPath,\r\n __in PCSTR FileName,\r\n __in_opt PVOID id,\r\n __in DWORD two,\r\n __in DWORD three,\r\n __in DWORD flags,\r\n __out_ecount(MAX_PATH + 1) PSTR FoundFile,\r\n __in_opt PFINDFILEINPATHCALLBACK callback,\r\n __in_opt PVOID context\r\n);\r\n\r\ntypedef BOOL\r\n(CALLBACK* PFINDFILEINPATHCALLBACKW)(\r\n __in PCWSTR filename,\r\n __in PVOID context\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymFindFileInPathW(\r\n __in HANDLE hprocess,\r\n __in_opt PCWSTR SearchPath,\r\n __in PCWSTR FileName,\r\n __in_opt PVOID id,\r\n __in DWORD two,\r\n __in DWORD three,\r\n __in DWORD flags,\r\n __out_ecount(MAX_PATH + 1) PWSTR FoundFile,\r\n __in_opt PFINDFILEINPATHCALLBACKW callback,\r\n __in_opt PVOID context\r\n);\r\n\r\ntypedef BOOL\r\n(CALLBACK* PFIND_EXE_FILE_CALLBACK)(\r\n __in HANDLE FileHandle,\r\n __in PCSTR FileName,\r\n __in_opt PVOID CallerData\r\n);\r\n\r\nHANDLE\r\nIMAGEAPI\r\nSymFindExecutableImage(\r\n __in HANDLE hProcess,\r\n __in PCSTR FileName,\r\n __out_ecount(MAX_PATH + 1) PSTR ImageFilePath,\r\n __in PFIND_EXE_FILE_CALLBACK Callback,\r\n __in PVOID CallerData\r\n);\r\n\r\ntypedef BOOL\r\n(CALLBACK* PFIND_EXE_FILE_CALLBACKW)(\r\n __in HANDLE FileHandle,\r\n __in PCWSTR FileName,\r\n __in_opt PVOID CallerData\r\n);\r\n\r\nHANDLE\r\nIMAGEAPI\r\nSymFindExecutableImageW(\r\n __in HANDLE hProcess,\r\n __in PCWSTR FileName,\r\n __out_ecount(MAX_PATH + 1) PWSTR ImageFilePath,\r\n __in PFIND_EXE_FILE_CALLBACKW Callback,\r\n __in PVOID CallerData\r\n);\r\n\r\nHANDLE\r\nIMAGEAPI\r\nFindExecutableImage(\r\n __in PCSTR FileName,\r\n __in PCSTR SymbolPath,\r\n __out_ecount(MAX_PATH + 1) PSTR ImageFilePath\r\n);\r\n\r\nHANDLE\r\nIMAGEAPI\r\nFindExecutableImageEx(\r\n __in PCSTR FileName,\r\n __in PCSTR SymbolPath,\r\n __out_ecount(MAX_PATH + 1) PSTR ImageFilePath,\r\n __in_opt PFIND_EXE_FILE_CALLBACK Callback,\r\n __in_opt PVOID CallerData\r\n);\r\n\r\nHANDLE\r\nIMAGEAPI\r\nFindExecutableImageExW(\r\n __in PCWSTR FileName,\r\n __in PCWSTR SymbolPath,\r\n __out_ecount(MAX_PATH + 1) PWSTR ImageFilePath,\r\n __in_opt PFIND_EXE_FILE_CALLBACKW Callback,\r\n __in PVOID CallerData\r\n);\r\n\r\nPIMAGE_NT_HEADERS\r\nIMAGEAPI\r\nImageNtHeader(\r\n __in PVOID Base\r\n);\r\n\r\nPVOID\r\nIMAGEAPI\r\nImageDirectoryEntryToDataEx(\r\n __in PVOID Base,\r\n __in BOOLEAN MappedAsImage,\r\n __in USHORT DirectoryEntry,\r\n __out PULONG Size,\r\n __out_opt PIMAGE_SECTION_HEADER* FoundHeader\r\n);\r\n\r\nPVOID\r\nIMAGEAPI\r\nImageDirectoryEntryToData(\r\n __in PVOID Base,\r\n __in BOOLEAN MappedAsImage,\r\n __in USHORT DirectoryEntry,\r\n __out PULONG Size\r\n);\r\n\r\nPIMAGE_SECTION_HEADER\r\nIMAGEAPI\r\nImageRvaToSection(\r\n __in PIMAGE_NT_HEADERS NtHeaders,\r\n __in PVOID Base,\r\n __in ULONG Rva\r\n);\r\n\r\nPVOID\r\nIMAGEAPI\r\nImageRvaToVa(\r\n __in PIMAGE_NT_HEADERS NtHeaders,\r\n __in PVOID Base,\r\n __in ULONG Rva,\r\n __in_opt OUT PIMAGE_SECTION_HEADER* LastRvaSection\r\n);\r\n\r\n#ifndef _WIN64\r\n// This api won't be ported to Win64 - Fix your code.\r\n\r\ntypedef struct _IMAGE_DEBUG_INFORMATION\r\n{\r\n LIST_ENTRY List;\r\n DWORD ReservedSize;\r\n PVOID ReservedMappedBase;\r\n USHORT ReservedMachine;\r\n USHORT ReservedCharacteristics;\r\n DWORD ReservedCheckSum;\r\n DWORD ImageBase;\r\n DWORD SizeOfImage;\r\n\r\n DWORD ReservedNumberOfSections;\r\n PIMAGE_SECTION_HEADER ReservedSections;\r\n\r\n DWORD ReservedExportedNamesSize;\r\n PSTR ReservedExportedNames;\r\n\r\n DWORD ReservedNumberOfFunctionTableEntries;\r\n PIMAGE_FUNCTION_ENTRY ReservedFunctionTableEntries;\r\n DWORD ReservedLowestFunctionStartingAddress;\r\n DWORD ReservedHighestFunctionEndingAddress;\r\n\r\n DWORD ReservedNumberOfFpoTableEntries;\r\n PFPO_DATA ReservedFpoTableEntries;\r\n\r\n DWORD SizeOfCoffSymbols;\r\n PIMAGE_COFF_SYMBOLS_HEADER CoffSymbols;\r\n\r\n DWORD ReservedSizeOfCodeViewSymbols;\r\n PVOID ReservedCodeViewSymbols;\r\n\r\n PSTR ImageFilePath;\r\n PSTR ImageFileName;\r\n PSTR ReservedDebugFilePath;\r\n\r\n DWORD ReservedTimeDateStamp;\r\n\r\n BOOL ReservedRomImage;\r\n PIMAGE_DEBUG_DIRECTORY ReservedDebugDirectory;\r\n DWORD ReservedNumberOfDebugDirectories;\r\n\r\n DWORD ReservedOriginalFunctionTableBaseAddress;\r\n\r\n DWORD Reserved[ 2 ];\r\n\r\n} IMAGE_DEBUG_INFORMATION, *PIMAGE_DEBUG_INFORMATION;\r\n\r\n\r\nPIMAGE_DEBUG_INFORMATION\r\nIMAGEAPI\r\nMapDebugInformation(\r\n __in_opt HANDLE FileHandle,\r\n __in PCSTR FileName,\r\n __in_opt PCSTR SymbolPath,\r\n __in ULONG ImageBase\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nUnmapDebugInformation(\r\n __out_xcount(unknown) PIMAGE_DEBUG_INFORMATION DebugInfo\r\n);\r\n\r\n#endif\r\n\r\nBOOL\r\nIMAGEAPI\r\nSearchTreeForFile(\r\n __in PCSTR RootPath,\r\n __in PCSTR InputPathName,\r\n __out_ecount(MAX_PATH + 1) PSTR OutputPathBuffer\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSearchTreeForFileW(\r\n __in PCWSTR RootPath,\r\n __in PCWSTR InputPathName,\r\n __out_ecount(MAX_PATH + 1) PWSTR OutputPathBuffer\r\n);\r\n\r\ntypedef BOOL\r\n(CALLBACK* PENUMDIRTREE_CALLBACK)(\r\n __in PCSTR FilePath,\r\n __in_opt PVOID CallerData\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nEnumDirTree(\r\n __in_opt HANDLE hProcess,\r\n __in PCSTR RootPath,\r\n __in PCSTR InputPathName,\r\n __out_ecount_opt(MAX_PATH + 1) PSTR OutputPathBuffer,\r\n __in_opt PENUMDIRTREE_CALLBACK cb,\r\n __in_opt PVOID data\r\n);\r\n\r\ntypedef BOOL\r\n(CALLBACK* PENUMDIRTREE_CALLBACKW)(\r\n __in PCWSTR FilePath,\r\n __in_opt PVOID CallerData\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nEnumDirTreeW(\r\n __in_opt HANDLE hProcess,\r\n __in PCWSTR RootPath,\r\n __in PCWSTR InputPathName,\r\n __out_ecount_opt(MAX_PATH + 1) PWSTR OutputPathBuffer,\r\n __in_opt PENUMDIRTREE_CALLBACKW cb,\r\n __in_opt PVOID data\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nMakeSureDirectoryPathExists(\r\n __in PCSTR DirPath\r\n);\r\n\r\n//\r\n// UnDecorateSymbolName Flags\r\n//\r\n\r\n#define UNDNAME_COMPLETE (0x0000) // Enable full undecoration\r\n#define UNDNAME_NO_LEADING_UNDERSCORES (0x0001) // Remove leading underscores from MS extended keywords\r\n#define UNDNAME_NO_MS_KEYWORDS (0x0002) // Disable expansion of MS extended keywords\r\n#define UNDNAME_NO_FUNCTION_RETURNS (0x0004) // Disable expansion of return type for primary declaration\r\n#define UNDNAME_NO_ALLOCATION_MODEL (0x0008) // Disable expansion of the declaration model\r\n#define UNDNAME_NO_ALLOCATION_LANGUAGE (0x0010) // Disable expansion of the declaration language specifier\r\n#define UNDNAME_NO_MS_THISTYPE (0x0020) // NYI Disable expansion of MS keywords on the 'this' type for primary declaration\r\n#define UNDNAME_NO_CV_THISTYPE (0x0040) // NYI Disable expansion of CV modifiers on the 'this' type for primary declaration\r\n#define UNDNAME_NO_THISTYPE (0x0060) // Disable all modifiers on the 'this' type\r\n#define UNDNAME_NO_ACCESS_SPECIFIERS (0x0080) // Disable expansion of access specifiers for members\r\n#define UNDNAME_NO_THROW_SIGNATURES (0x0100) // Disable expansion of 'throw-signatures' for functions and pointers to functions\r\n#define UNDNAME_NO_MEMBER_TYPE (0x0200) // Disable expansion of 'static' or 'virtual'ness of members\r\n#define UNDNAME_NO_RETURN_UDT_MODEL (0x0400) // Disable expansion of MS model for UDT returns\r\n#define UNDNAME_32_BIT_DECODE (0x0800) // Undecorate 32-bit decorated names\r\n#define UNDNAME_NAME_ONLY (0x1000) // Crack only the name for primary declaration;\r\n// return just [scope::]name. Does expand template params\r\n#define UNDNAME_NO_ARGUMENTS (0x2000) // Don't undecorate arguments to function\r\n#define UNDNAME_NO_SPECIAL_SYMS (0x4000) // Don't undecorate special names (v-table, vcall, vector xxx, metatype, etc)\r\n\r\nDWORD\r\nIMAGEAPI\r\nWINAPI\r\nUnDecorateSymbolName(\r\n __in PCSTR name,\r\n __out_ecount(maxStringLength) PSTR outputString,\r\n __in DWORD maxStringLength,\r\n __in DWORD flags\r\n);\r\n\r\nDWORD\r\nIMAGEAPI\r\nWINAPI\r\nUnDecorateSymbolNameW(\r\n __in PCWSTR name,\r\n __out_ecount(maxStringLength) PWSTR outputString,\r\n __in DWORD maxStringLength,\r\n __in DWORD flags\r\n);\r\n\r\n//\r\n// these values are used for synthesized file types\r\n// that can be passed in as image headers instead of\r\n// the standard ones from ntimage.h\r\n//\r\n\r\n#define DBHHEADER_DEBUGDIRS 0x1\r\n#define DBHHEADER_CVMISC 0x2\r\n#define DBHHEADER_PDBGUID 0x3\r\ntypedef struct _MODLOAD_DATA\r\n{\r\n DWORD ssize; // size of this struct\r\n DWORD ssig; // signature identifying the passed data\r\n PVOID data; // pointer to passed data\r\n DWORD size; // size of passed data\r\n DWORD flags; // options\r\n} MODLOAD_DATA, *PMODLOAD_DATA;\r\n\r\ntypedef struct _MODLOAD_CVMISC\r\n{\r\n DWORD oCV; // ofset to the codeview record\r\n size_t cCV; // size of the codeview record\r\n DWORD oMisc; // offset to the misc record\r\n size_t cMisc; // size of the misc record\r\n DWORD dtImage; // datetime stamp of the image\r\n DWORD cImage; // size of the image\r\n} MODLOAD_CVMISC, *PMODLOAD_CVMISC;\r\n\r\ntypedef struct _MODLOAD_PDBGUID_PDBAGE\r\n{\r\n GUID PdbGuid; // Pdb Guid\r\n DWORD PdbAge; // Pdb Age\r\n} MODLOAD_PDBGUID_PDBAGE, *PMODLOAD_PDBGUID_PDBAGE;\r\n\r\n//\r\n// StackWalking API\r\n//\r\n\r\ntypedef enum\r\n{\r\n AddrMode1616,\r\n AddrMode1632,\r\n AddrModeReal,\r\n AddrModeFlat\r\n} ADDRESS_MODE;\r\n\r\ntypedef struct _tagADDRESS64\r\n{\r\n DWORD64 Offset;\r\n WORD Segment;\r\n ADDRESS_MODE Mode;\r\n} ADDRESS64, *LPADDRESS64;\r\n\r\n#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64)\r\n#define ADDRESS ADDRESS64\r\n#define LPADDRESS LPADDRESS64\r\n#else\r\ntypedef struct _tagADDRESS\r\n{\r\n DWORD Offset;\r\n WORD Segment;\r\n ADDRESS_MODE Mode;\r\n} ADDRESS, *LPADDRESS;\r\n\r\n__inline\r\nvoid\r\nAddress32To64(\r\n __in LPADDRESS a32,\r\n __out LPADDRESS64 a64\r\n)\r\n{\r\n a64->Offset = (ULONG64)(LONG64)(LONG)a32->Offset;\r\n a64->Segment = a32->Segment;\r\n a64->Mode = a32->Mode;\r\n}\r\n\r\n__inline\r\nvoid\r\nAddress64To32(\r\n __in LPADDRESS64 a64,\r\n __out LPADDRESS a32\r\n)\r\n{\r\n a32->Offset = (ULONG)a64->Offset;\r\n a32->Segment = a64->Segment;\r\n a32->Mode = a64->Mode;\r\n}\r\n#endif\r\n\r\n//\r\n// This structure is included in the STACKFRAME structure,\r\n// and is used to trace through usermode callbacks in a thread's\r\n// kernel stack. The values must be copied by the kernel debugger\r\n// from the DBGKD_GET_VERSION and WAIT_STATE_CHANGE packets.\r\n//\r\n\r\n//\r\n// New KDHELP structure for 64 bit system support.\r\n// This structure is preferred in new code.\r\n//\r\ntypedef struct _KDHELP64\r\n{\r\n\r\n //\r\n // address of kernel thread object, as provided in the\r\n // WAIT_STATE_CHANGE packet.\r\n //\r\n DWORD64 Thread;\r\n\r\n //\r\n // offset in thread object to pointer to the current callback frame\r\n // in kernel stack.\r\n //\r\n DWORD ThCallbackStack;\r\n\r\n //\r\n // offset in thread object to pointer to the current callback backing\r\n // store frame in kernel stack.\r\n //\r\n DWORD ThCallbackBStore;\r\n\r\n //\r\n // offsets to values in frame:\r\n //\r\n // address of next callback frame\r\n DWORD NextCallback;\r\n\r\n // address of saved frame pointer (if applicable)\r\n DWORD FramePointer;\r\n\r\n\r\n //\r\n // Address of the kernel function that calls out to user mode\r\n //\r\n DWORD64 KiCallUserMode;\r\n\r\n //\r\n // Address of the user mode dispatcher function\r\n //\r\n DWORD64 KeUserCallbackDispatcher;\r\n\r\n //\r\n // Lowest kernel mode address\r\n //\r\n DWORD64 SystemRangeStart;\r\n\r\n //\r\n // Address of the user mode exception dispatcher function.\r\n // Added in API version 10.\r\n //\r\n DWORD64 KiUserExceptionDispatcher;\r\n\r\n //\r\n // Stack bounds, added in API version 11.\r\n //\r\n DWORD64 StackBase;\r\n DWORD64 StackLimit;\r\n\r\n DWORD64 Reserved[5];\r\n\r\n} KDHELP64, *PKDHELP64;\r\n\r\n#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64)\r\n#define KDHELP KDHELP64\r\n#define PKDHELP PKDHELP64\r\n#else\r\ntypedef struct _KDHELP\r\n{\r\n\r\n //\r\n // address of kernel thread object, as provided in the\r\n // WAIT_STATE_CHANGE packet.\r\n //\r\n DWORD Thread;\r\n\r\n //\r\n // offset in thread object to pointer to the current callback frame\r\n // in kernel stack.\r\n //\r\n DWORD ThCallbackStack;\r\n\r\n //\r\n // offsets to values in frame:\r\n //\r\n // address of next callback frame\r\n DWORD NextCallback;\r\n\r\n // address of saved frame pointer (if applicable)\r\n DWORD FramePointer;\r\n\r\n //\r\n // Address of the kernel function that calls out to user mode\r\n //\r\n DWORD KiCallUserMode;\r\n\r\n //\r\n // Address of the user mode dispatcher function\r\n //\r\n DWORD KeUserCallbackDispatcher;\r\n\r\n //\r\n // Lowest kernel mode address\r\n //\r\n DWORD SystemRangeStart;\r\n\r\n //\r\n // offset in thread object to pointer to the current callback backing\r\n // store frame in kernel stack.\r\n //\r\n DWORD ThCallbackBStore;\r\n\r\n //\r\n // Address of the user mode exception dispatcher function.\r\n // Added in API version 10.\r\n //\r\n DWORD KiUserExceptionDispatcher;\r\n\r\n //\r\n // Stack bounds, added in API version 11.\r\n //\r\n DWORD StackBase;\r\n DWORD StackLimit;\r\n\r\n DWORD Reserved[5];\r\n\r\n} KDHELP, *PKDHELP;\r\n\r\n__inline\r\nvoid\r\nKdHelp32To64(\r\n __in PKDHELP p32,\r\n __out PKDHELP64 p64\r\n)\r\n{\r\n p64->Thread = p32->Thread;\r\n p64->ThCallbackStack = p32->ThCallbackStack;\r\n p64->NextCallback = p32->NextCallback;\r\n p64->FramePointer = p32->FramePointer;\r\n p64->KiCallUserMode = p32->KiCallUserMode;\r\n p64->KeUserCallbackDispatcher = p32->KeUserCallbackDispatcher;\r\n p64->SystemRangeStart = p32->SystemRangeStart;\r\n p64->KiUserExceptionDispatcher = p32->KiUserExceptionDispatcher;\r\n p64->StackBase = p32->StackBase;\r\n p64->StackLimit = p32->StackLimit;\r\n}\r\n#endif\r\n\r\ntypedef struct _tagSTACKFRAME64\r\n{\r\n ADDRESS64 AddrPC; // program counter\r\n ADDRESS64 AddrReturn; // return address\r\n ADDRESS64 AddrFrame; // frame pointer\r\n ADDRESS64 AddrStack; // stack pointer\r\n ADDRESS64 AddrBStore; // backing store pointer\r\n PVOID FuncTableEntry; // pointer to pdata/fpo or NULL\r\n DWORD64 Params[4]; // possible arguments to the function\r\n BOOL Far; // WOW far call\r\n BOOL Virtual; // is this a virtual frame?\r\n DWORD64 Reserved[3];\r\n KDHELP64 KdHelp;\r\n} STACKFRAME64, *LPSTACKFRAME64;\r\n\r\n#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64)\r\n#define STACKFRAME STACKFRAME64\r\n#define LPSTACKFRAME LPSTACKFRAME64\r\n#else\r\ntypedef struct _tagSTACKFRAME\r\n{\r\n ADDRESS AddrPC; // program counter\r\n ADDRESS AddrReturn; // return address\r\n ADDRESS AddrFrame; // frame pointer\r\n ADDRESS AddrStack; // stack pointer\r\n PVOID FuncTableEntry; // pointer to pdata/fpo or NULL\r\n DWORD Params[4]; // possible arguments to the function\r\n BOOL Far; // WOW far call\r\n BOOL Virtual; // is this a virtual frame?\r\n DWORD Reserved[3];\r\n KDHELP KdHelp;\r\n ADDRESS AddrBStore; // backing store pointer\r\n} STACKFRAME, *LPSTACKFRAME;\r\n#endif\r\n\r\n\r\ntypedef\r\nBOOL\r\n(__stdcall* PREAD_PROCESS_MEMORY_ROUTINE64)(\r\n __in HANDLE hProcess,\r\n __in DWORD64 qwBaseAddress,\r\n __out_bcount(nSize) PVOID lpBuffer,\r\n __in DWORD nSize,\r\n __out LPDWORD lpNumberOfBytesRead\r\n);\r\n\r\ntypedef\r\nPVOID\r\n(__stdcall* PFUNCTION_TABLE_ACCESS_ROUTINE64)(\r\n __in HANDLE ahProcess,\r\n __in DWORD64 AddrBase\r\n);\r\n\r\ntypedef\r\nDWORD64\r\n(__stdcall* PGET_MODULE_BASE_ROUTINE64)(\r\n __in HANDLE hProcess,\r\n __in DWORD64 Address\r\n);\r\n\r\ntypedef\r\nDWORD64\r\n(__stdcall* PTRANSLATE_ADDRESS_ROUTINE64)(\r\n __in HANDLE hProcess,\r\n __in HANDLE hThread,\r\n __in LPADDRESS64 lpaddr\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nStackWalk64(\r\n __in DWORD MachineType,\r\n __in HANDLE hProcess,\r\n __in HANDLE hThread,\r\n __inout LPSTACKFRAME64 StackFrame,\r\n __inout PVOID ContextRecord,\r\n __in_opt PREAD_PROCESS_MEMORY_ROUTINE64 ReadMemoryRoutine,\r\n __in_opt PFUNCTION_TABLE_ACCESS_ROUTINE64 FunctionTableAccessRoutine,\r\n __in_opt PGET_MODULE_BASE_ROUTINE64 GetModuleBaseRoutine,\r\n __in_opt PTRANSLATE_ADDRESS_ROUTINE64 TranslateAddress\r\n);\r\n\r\n#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64)\r\n\r\n#define PREAD_PROCESS_MEMORY_ROUTINE PREAD_PROCESS_MEMORY_ROUTINE64\r\n#define PFUNCTION_TABLE_ACCESS_ROUTINE PFUNCTION_TABLE_ACCESS_ROUTINE64\r\n#define PGET_MODULE_BASE_ROUTINE PGET_MODULE_BASE_ROUTINE64\r\n#define PTRANSLATE_ADDRESS_ROUTINE PTRANSLATE_ADDRESS_ROUTINE64\r\n\r\n#define StackWalk StackWalk64\r\n\r\n#else\r\n\r\ntypedef\r\nBOOL\r\n(__stdcall* PREAD_PROCESS_MEMORY_ROUTINE)(\r\n __in HANDLE hProcess,\r\n __in DWORD lpBaseAddress,\r\n __out_bcount(nSize) PVOID lpBuffer,\r\n __in DWORD nSize,\r\n __out PDWORD lpNumberOfBytesRead\r\n);\r\n\r\ntypedef\r\nPVOID\r\n(__stdcall* PFUNCTION_TABLE_ACCESS_ROUTINE)(\r\n __in HANDLE hProcess,\r\n __in DWORD AddrBase\r\n);\r\n\r\ntypedef\r\nDWORD\r\n(__stdcall* PGET_MODULE_BASE_ROUTINE)(\r\n __in HANDLE hProcess,\r\n __in DWORD Address\r\n);\r\n\r\ntypedef\r\nDWORD\r\n(__stdcall* PTRANSLATE_ADDRESS_ROUTINE)(\r\n __in HANDLE hProcess,\r\n __in HANDLE hThread,\r\n __out LPADDRESS lpaddr\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nStackWalk(\r\n DWORD MachineType,\r\n __in HANDLE hProcess,\r\n __in HANDLE hThread,\r\n __inout LPSTACKFRAME StackFrame,\r\n __inout PVOID ContextRecord,\r\n __in_opt PREAD_PROCESS_MEMORY_ROUTINE ReadMemoryRoutine,\r\n __in_opt PFUNCTION_TABLE_ACCESS_ROUTINE FunctionTableAccessRoutine,\r\n __in_opt PGET_MODULE_BASE_ROUTINE GetModuleBaseRoutine,\r\n __in_opt PTRANSLATE_ADDRESS_ROUTINE TranslateAddress\r\n);\r\n\r\n#endif\r\n\r\n\r\n#define API_VERSION_NUMBER 11\r\n\r\ntypedef struct API_VERSION\r\n{\r\n USHORT MajorVersion;\r\n USHORT MinorVersion;\r\n USHORT Revision;\r\n USHORT Reserved;\r\n} API_VERSION, *LPAPI_VERSION;\r\n\r\nLPAPI_VERSION\r\nIMAGEAPI\r\nImagehlpApiVersion(\r\n VOID\r\n);\r\n\r\nLPAPI_VERSION\r\nIMAGEAPI\r\nImagehlpApiVersionEx(\r\n __in LPAPI_VERSION AppVersion\r\n);\r\n\r\nDWORD\r\nIMAGEAPI\r\nGetTimestampForLoadedLibrary(\r\n __in HMODULE Module\r\n);\r\n\r\n//\r\n// typedefs for function pointers\r\n//\r\ntypedef BOOL\r\n(CALLBACK* PSYM_ENUMMODULES_CALLBACK64)(\r\n __in PCSTR ModuleName,\r\n __in DWORD64 BaseOfDll,\r\n __in_opt PVOID UserContext\r\n);\r\n\r\ntypedef BOOL\r\n(CALLBACK* PSYM_ENUMMODULES_CALLBACKW64)(\r\n __in PCWSTR ModuleName,\r\n __in DWORD64 BaseOfDll,\r\n __in_opt PVOID UserContext\r\n);\r\n\r\ntypedef BOOL\r\n(CALLBACK* PENUMLOADED_MODULES_CALLBACK64)(\r\n __in PCSTR ModuleName,\r\n __in DWORD64 ModuleBase,\r\n __in ULONG ModuleSize,\r\n __in_opt PVOID UserContext\r\n);\r\n\r\ntypedef BOOL\r\n(CALLBACK* PENUMLOADED_MODULES_CALLBACKW64)(\r\n __in PCWSTR ModuleName,\r\n __in DWORD64 ModuleBase,\r\n __in ULONG ModuleSize,\r\n __in_opt PVOID UserContext\r\n);\r\n\r\ntypedef BOOL\r\n(CALLBACK* PSYM_ENUMSYMBOLS_CALLBACK64)(\r\n __in PCSTR SymbolName,\r\n __in DWORD64 SymbolAddress,\r\n __in ULONG SymbolSize,\r\n __in_opt PVOID UserContext\r\n);\r\n\r\ntypedef BOOL\r\n(CALLBACK* PSYM_ENUMSYMBOLS_CALLBACK64W)(\r\n __in PCWSTR SymbolName,\r\n __in DWORD64 SymbolAddress,\r\n __in ULONG SymbolSize,\r\n __in_opt PVOID UserContext\r\n);\r\n\r\ntypedef BOOL\r\n(CALLBACK* PSYMBOL_REGISTERED_CALLBACK64)(\r\n __in HANDLE hProcess,\r\n __in ULONG ActionCode,\r\n __in_opt ULONG64 CallbackData,\r\n __in_opt ULONG64 UserContext\r\n);\r\n\r\ntypedef\r\nPVOID\r\n(CALLBACK* PSYMBOL_FUNCENTRY_CALLBACK)(\r\n __in HANDLE hProcess,\r\n __in DWORD AddrBase,\r\n __in_opt PVOID UserContext\r\n);\r\n\r\ntypedef\r\nPVOID\r\n(CALLBACK* PSYMBOL_FUNCENTRY_CALLBACK64)(\r\n __in HANDLE hProcess,\r\n __in ULONG64 AddrBase,\r\n __in ULONG64 UserContext\r\n);\r\n\r\n#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64)\r\n\r\n#define PSYM_ENUMMODULES_CALLBACK PSYM_ENUMMODULES_CALLBACK64\r\n#define PSYM_ENUMSYMBOLS_CALLBACK PSYM_ENUMSYMBOLS_CALLBACK64\r\n#define PSYM_ENUMSYMBOLS_CALLBACKW PSYM_ENUMSYMBOLS_CALLBACK64W\r\n#define PENUMLOADED_MODULES_CALLBACK PENUMLOADED_MODULES_CALLBACK64\r\n#define PSYMBOL_REGISTERED_CALLBACK PSYMBOL_REGISTERED_CALLBACK64\r\n#define PSYMBOL_FUNCENTRY_CALLBACK PSYMBOL_FUNCENTRY_CALLBACK64\r\n\r\n#else\r\n\r\ntypedef BOOL\r\n(CALLBACK* PSYM_ENUMMODULES_CALLBACK)(\r\n __in PCSTR ModuleName,\r\n __in ULONG BaseOfDll,\r\n __in_opt PVOID UserContext\r\n);\r\n\r\ntypedef BOOL\r\n(CALLBACK* PSYM_ENUMSYMBOLS_CALLBACK)(\r\n __in PCSTR SymbolName,\r\n __in ULONG SymbolAddress,\r\n __in ULONG SymbolSize,\r\n __in_opt PVOID UserContext\r\n);\r\n\r\ntypedef BOOL\r\n(CALLBACK* PSYM_ENUMSYMBOLS_CALLBACKW)(\r\n __in PCWSTR SymbolName,\r\n __in ULONG SymbolAddress,\r\n __in ULONG SymbolSize,\r\n __in_opt PVOID UserContext\r\n);\r\n\r\ntypedef BOOL\r\n(CALLBACK* PENUMLOADED_MODULES_CALLBACK)(\r\n __in PCSTR ModuleName,\r\n __in ULONG ModuleBase,\r\n __in ULONG ModuleSize,\r\n __in_opt PVOID UserContext\r\n);\r\n\r\ntypedef BOOL\r\n(CALLBACK* PSYMBOL_REGISTERED_CALLBACK)(\r\n __in HANDLE hProcess,\r\n __in ULONG ActionCode,\r\n __in_opt PVOID CallbackData,\r\n __in_opt PVOID UserContext\r\n);\r\n\r\n#endif\r\n\r\n\r\n// values found in SYMBOL_INFO.Tag\r\n//\r\n// This was taken from cvconst.h and should\r\n// not override any values found there.\r\n//\r\n// #define _NO_CVCONST_H_ if you don't\r\n// have access to that file...\r\n\r\n#ifdef _NO_CVCONST_H\r\n\r\n// DIA enums\r\n\r\nenum SymTagEnum\r\n{\r\n SymTagNull,\r\n SymTagExe,\r\n SymTagCompiland,\r\n SymTagCompilandDetails,\r\n SymTagCompilandEnv,\r\n SymTagFunction,\r\n SymTagBlock,\r\n SymTagData,\r\n SymTagAnnotation,\r\n SymTagLabel,\r\n SymTagPublicSymbol,\r\n SymTagUDT,\r\n SymTagEnum,\r\n SymTagFunctionType,\r\n SymTagPointerType,\r\n SymTagArrayType,\r\n SymTagBaseType,\r\n SymTagTypedef,\r\n SymTagBaseClass,\r\n SymTagFriend,\r\n SymTagFunctionArgType,\r\n SymTagFuncDebugStart,\r\n SymTagFuncDebugEnd,\r\n SymTagUsingNamespace,\r\n SymTagVTableShape,\r\n SymTagVTable,\r\n SymTagCustom,\r\n SymTagThunk,\r\n SymTagCustomType,\r\n SymTagManagedType,\r\n SymTagDimension,\r\n SymTagMax\r\n};\r\n\r\n#endif\r\n\r\n//\r\n// flags found in SYMBOL_INFO.Flags\r\n//\r\n\r\n#define SYMFLAG_VALUEPRESENT 0x00000001\r\n#define SYMFLAG_REGISTER 0x00000008\r\n#define SYMFLAG_REGREL 0x00000010\r\n#define SYMFLAG_FRAMEREL 0x00000020\r\n#define SYMFLAG_PARAMETER 0x00000040\r\n#define SYMFLAG_LOCAL 0x00000080\r\n#define SYMFLAG_CONSTANT 0x00000100\r\n#define SYMFLAG_EXPORT 0x00000200\r\n#define SYMFLAG_FORWARDER 0x00000400\r\n#define SYMFLAG_FUNCTION 0x00000800\r\n#define SYMFLAG_VIRTUAL 0x00001000\r\n#define SYMFLAG_THUNK 0x00002000\r\n#define SYMFLAG_TLSREL 0x00004000\r\n#define SYMFLAG_SLOT 0x00008000\r\n#define SYMFLAG_ILREL 0x00010000\r\n#define SYMFLAG_METADATA 0x00020000\r\n#define SYMFLAG_CLR_TOKEN 0x00040000\r\n\r\n// this resets SymNext/Prev to the beginning\r\n// of the module passed in the address field\r\n\r\n#define SYMFLAG_RESET 0x80000000\r\n\r\n//\r\n// symbol type enumeration\r\n//\r\ntypedef enum\r\n{\r\n SymNone = 0,\r\n SymCoff,\r\n SymCv,\r\n SymPdb,\r\n SymExport,\r\n SymDeferred,\r\n SymSym, // .sym file\r\n SymDia,\r\n SymVirtual,\r\n NumSymTypes\r\n} SYM_TYPE;\r\n\r\n//\r\n// symbol data structure\r\n//\r\n\r\ntypedef struct _IMAGEHLP_SYMBOL64\r\n{\r\n DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_SYMBOL64)\r\n DWORD64 Address; // virtual address including dll base address\r\n DWORD Size; // estimated size of symbol, can be zero\r\n DWORD Flags; // info about the symbols, see the SYMF defines\r\n DWORD MaxNameLength; // maximum size of symbol name in 'Name'\r\n CHAR Name[1]; // symbol name (null terminated string)\r\n} IMAGEHLP_SYMBOL64, *PIMAGEHLP_SYMBOL64;\r\n\r\ntypedef struct _IMAGEHLP_SYMBOL64_PACKAGE\r\n{\r\n IMAGEHLP_SYMBOL64 sym;\r\n CHAR name[MAX_SYM_NAME + 1];\r\n} IMAGEHLP_SYMBOL64_PACKAGE, *PIMAGEHLP_SYMBOL64_PACKAGE;\r\n\r\ntypedef struct _IMAGEHLP_SYMBOLW64\r\n{\r\n DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_SYMBOLW64)\r\n DWORD64 Address; // virtual address including dll base address\r\n DWORD Size; // estimated size of symbol, can be zero\r\n DWORD Flags; // info about the symbols, see the SYMF defines\r\n DWORD MaxNameLength; // maximum size of symbol name in 'Name'\r\n WCHAR Name[1]; // symbol name (null terminated string)\r\n} IMAGEHLP_SYMBOLW64, *PIMAGEHLP_SYMBOLW64;\r\n\r\ntypedef struct _IMAGEHLP_SYMBOLW64_PACKAGE\r\n{\r\n IMAGEHLP_SYMBOLW64 sym;\r\n WCHAR name[MAX_SYM_NAME + 1];\r\n} IMAGEHLP_SYMBOLW64_PACKAGE, *PIMAGEHLP_SYMBOLW64_PACKAGE;\r\n\r\n#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64)\r\n\r\n#define IMAGEHLP_SYMBOL IMAGEHLP_SYMBOL64\r\n#define PIMAGEHLP_SYMBOL PIMAGEHLP_SYMBOL64\r\n#define IMAGEHLP_SYMBOL_PACKAGE IMAGEHLP_SYMBOL64_PACKAGE\r\n#define PIMAGEHLP_SYMBOL_PACKAGE PIMAGEHLP_SYMBOL64_PACKAGE\r\n#define IMAGEHLP_SYMBOLW IMAGEHLP_SYMBOLW64\r\n#define PIMAGEHLP_SYMBOLW PIMAGEHLP_SYMBOLW64\r\n#define IMAGEHLP_SYMBOLW_PACKAGE IMAGEHLP_SYMBOLW64_PACKAGE\r\n#define PIMAGEHLP_SYMBOLW_PACKAGE PIMAGEHLP_SYMBOLW64_PACKAGE\r\n\r\n#else\r\n\r\ntypedef struct _IMAGEHLP_SYMBOL\r\n{\r\n DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_SYMBOL)\r\n DWORD Address; // virtual address including dll base address\r\n DWORD Size; // estimated size of symbol, can be zero\r\n DWORD Flags; // info about the symbols, see the SYMF defines\r\n DWORD MaxNameLength; // maximum size of symbol name in 'Name'\r\n CHAR Name[1]; // symbol name (null terminated string)\r\n} IMAGEHLP_SYMBOL, *PIMAGEHLP_SYMBOL;\r\n\r\ntypedef struct _IMAGEHLP_SYMBOL_PACKAGE\r\n{\r\n IMAGEHLP_SYMBOL sym;\r\n CHAR name[MAX_SYM_NAME + 1];\r\n} IMAGEHLP_SYMBOL_PACKAGE, *PIMAGEHLP_SYMBOL_PACKAGE;\r\n\r\ntypedef struct _IMAGEHLP_SYMBOLW\r\n{\r\n DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_SYMBOLW)\r\n DWORD Address; // virtual address including dll base address\r\n DWORD Size; // estimated size of symbol, can be zero\r\n DWORD Flags; // info about the symbols, see the SYMF defines\r\n DWORD MaxNameLength; // maximum size of symbol name in 'Name'\r\n WCHAR Name[1]; // symbol name (null terminated string)\r\n} IMAGEHLP_SYMBOLW, *PIMAGEHLP_SYMBOLW;\r\n\r\ntypedef struct _IMAGEHLP_SYMBOLW_PACKAGE\r\n{\r\n IMAGEHLP_SYMBOLW sym;\r\n WCHAR name[MAX_SYM_NAME + 1];\r\n} IMAGEHLP_SYMBOLW_PACKAGE, *PIMAGEHLP_SYMBOLW_PACKAGE;\r\n\r\n#endif\r\n\r\n//\r\n// module data structure\r\n//\r\n\r\ntypedef struct _IMAGEHLP_MODULE64\r\n{\r\n DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_MODULE64)\r\n DWORD64 BaseOfImage; // base load address of module\r\n DWORD ImageSize; // virtual size of the loaded module\r\n DWORD TimeDateStamp; // date/time stamp from pe header\r\n DWORD CheckSum; // checksum from the pe header\r\n DWORD NumSyms; // number of symbols in the symbol table\r\n SYM_TYPE SymType; // type of symbols loaded\r\n CHAR ModuleName[32]; // module name\r\n CHAR ImageName[256]; // image name\r\n CHAR LoadedImageName[256]; // symbol file name\r\n // new elements: 07-Jun-2002\r\n CHAR LoadedPdbName[256]; // pdb file name\r\n DWORD CVSig; // Signature of the CV record in the debug directories\r\n CHAR CVData[MAX_PATH * 3]; // Contents of the CV record\r\n DWORD PdbSig; // Signature of PDB\r\n GUID PdbSig70; // Signature of PDB (VC 7 and up)\r\n DWORD PdbAge; // DBI age of pdb\r\n BOOL PdbUnmatched; // loaded an unmatched pdb\r\n BOOL DbgUnmatched; // loaded an unmatched dbg\r\n BOOL LineNumbers; // we have line number information\r\n BOOL GlobalSymbols; // we have internal symbol information\r\n BOOL TypeInfo; // we have type information\r\n // new elements: 17-Dec-2003\r\n BOOL SourceIndexed; // pdb supports source server\r\n BOOL Publics; // contains public symbols\r\n} IMAGEHLP_MODULE64, *PIMAGEHLP_MODULE64;\r\n\r\ntypedef struct _IMAGEHLP_MODULEW64\r\n{\r\n DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_MODULE64)\r\n DWORD64 BaseOfImage; // base load address of module\r\n DWORD ImageSize; // virtual size of the loaded module\r\n DWORD TimeDateStamp; // date/time stamp from pe header\r\n DWORD CheckSum; // checksum from the pe header\r\n DWORD NumSyms; // number of symbols in the symbol table\r\n SYM_TYPE SymType; // type of symbols loaded\r\n WCHAR ModuleName[32]; // module name\r\n WCHAR ImageName[256]; // image name\r\n // new elements: 07-Jun-2002\r\n WCHAR LoadedImageName[256]; // symbol file name\r\n WCHAR LoadedPdbName[256]; // pdb file name\r\n DWORD CVSig; // Signature of the CV record in the debug directories\r\n WCHAR CVData[MAX_PATH * 3]; // Contents of the CV record\r\n DWORD PdbSig; // Signature of PDB\r\n GUID PdbSig70; // Signature of PDB (VC 7 and up)\r\n DWORD PdbAge; // DBI age of pdb\r\n BOOL PdbUnmatched; // loaded an unmatched pdb\r\n BOOL DbgUnmatched; // loaded an unmatched dbg\r\n BOOL LineNumbers; // we have line number information\r\n BOOL GlobalSymbols; // we have internal symbol information\r\n BOOL TypeInfo; // we have type information\r\n // new elements: 17-Dec-2003\r\n BOOL SourceIndexed; // pdb supports source server\r\n BOOL Publics; // contains public symbols\r\n} IMAGEHLP_MODULEW64, *PIMAGEHLP_MODULEW64;\r\n\r\n#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64)\r\n#define IMAGEHLP_MODULE IMAGEHLP_MODULE64\r\n#define PIMAGEHLP_MODULE PIMAGEHLP_MODULE64\r\n#define IMAGEHLP_MODULEW IMAGEHLP_MODULEW64\r\n#define PIMAGEHLP_MODULEW PIMAGEHLP_MODULEW64\r\n#else\r\ntypedef struct _IMAGEHLP_MODULE\r\n{\r\n DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_MODULE)\r\n DWORD BaseOfImage; // base load address of module\r\n DWORD ImageSize; // virtual size of the loaded module\r\n DWORD TimeDateStamp; // date/time stamp from pe header\r\n DWORD CheckSum; // checksum from the pe header\r\n DWORD NumSyms; // number of symbols in the symbol table\r\n SYM_TYPE SymType; // type of symbols loaded\r\n CHAR ModuleName[32]; // module name\r\n CHAR ImageName[256]; // image name\r\n CHAR LoadedImageName[256]; // symbol file name\r\n} IMAGEHLP_MODULE, *PIMAGEHLP_MODULE;\r\n\r\ntypedef struct _IMAGEHLP_MODULEW\r\n{\r\n DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_MODULE)\r\n DWORD BaseOfImage; // base load address of module\r\n DWORD ImageSize; // virtual size of the loaded module\r\n DWORD TimeDateStamp; // date/time stamp from pe header\r\n DWORD CheckSum; // checksum from the pe header\r\n DWORD NumSyms; // number of symbols in the symbol table\r\n SYM_TYPE SymType; // type of symbols loaded\r\n WCHAR ModuleName[32]; // module name\r\n WCHAR ImageName[256]; // image name\r\n WCHAR LoadedImageName[256]; // symbol file name\r\n} IMAGEHLP_MODULEW, *PIMAGEHLP_MODULEW;\r\n#endif\r\n\r\n//\r\n// source file line data structure\r\n//\r\n\r\ntypedef struct _IMAGEHLP_LINE64\r\n{\r\n DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_LINE64)\r\n PVOID Key; // internal\r\n DWORD LineNumber; // line number in file\r\n PCHAR FileName; // full filename\r\n DWORD64 Address; // first instruction of line\r\n} IMAGEHLP_LINE64, *PIMAGEHLP_LINE64;\r\n\r\ntypedef struct _IMAGEHLP_LINEW64\r\n{\r\n DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_LINE64)\r\n PVOID Key; // internal\r\n DWORD LineNumber; // line number in file\r\n PWSTR FileName; // full filename\r\n DWORD64 Address; // first instruction of line\r\n} IMAGEHLP_LINEW64, *PIMAGEHLP_LINEW64;\r\n\r\n#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64)\r\n#define IMAGEHLP_LINE IMAGEHLP_LINE64\r\n#define PIMAGEHLP_LINE PIMAGEHLP_LINE64\r\n#else\r\ntypedef struct _IMAGEHLP_LINE\r\n{\r\n DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_LINE)\r\n PVOID Key; // internal\r\n DWORD LineNumber; // line number in file\r\n PCHAR FileName; // full filename\r\n DWORD Address; // first instruction of line\r\n} IMAGEHLP_LINE, *PIMAGEHLP_LINE;\r\n\r\ntypedef struct _IMAGEHLP_LINEW\r\n{\r\n DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_LINE64)\r\n PVOID Key; // internal\r\n DWORD LineNumber; // line number in file\r\n PCHAR FileName; // full filename\r\n DWORD64 Address; // first instruction of line\r\n} IMAGEHLP_LINEW, *PIMAGEHLP_LINEW;\r\n#endif\r\n\r\n//\r\n// source file structure\r\n//\r\n\r\ntypedef struct _SOURCEFILE\r\n{\r\n DWORD64 ModBase; // base address of loaded module\r\n PCHAR FileName; // full filename of source\r\n} SOURCEFILE, *PSOURCEFILE;\r\n\r\ntypedef struct _SOURCEFILEW\r\n{\r\n DWORD64 ModBase; // base address of loaded module\r\n PWSTR FileName; // full filename of source\r\n} SOURCEFILEW, *PSOURCEFILEW;\r\n\r\n//\r\n// data structures used for registered symbol callbacks\r\n//\r\n\r\n#define CBA_DEFERRED_SYMBOL_LOAD_START 0x00000001\r\n#define CBA_DEFERRED_SYMBOL_LOAD_COMPLETE 0x00000002\r\n#define CBA_DEFERRED_SYMBOL_LOAD_FAILURE 0x00000003\r\n#define CBA_SYMBOLS_UNLOADED 0x00000004\r\n#define CBA_DUPLICATE_SYMBOL 0x00000005\r\n#define CBA_READ_MEMORY 0x00000006\r\n#define CBA_DEFERRED_SYMBOL_LOAD_CANCEL 0x00000007\r\n#define CBA_SET_OPTIONS 0x00000008\r\n#define CBA_EVENT 0x00000010\r\n#define CBA_DEFERRED_SYMBOL_LOAD_PARTIAL 0x00000020\r\n#define CBA_DEBUG_INFO 0x10000000\r\n#define CBA_SRCSRV_INFO 0x20000000\r\n#define CBA_SRCSRV_EVENT 0x40000000\r\n\r\ntypedef struct _IMAGEHLP_CBA_READ_MEMORY\r\n{\r\n DWORD64 addr; // address to read from\r\n PVOID buf; // buffer to read to\r\n DWORD bytes; // amount of bytes to read\r\n DWORD* bytesread; // pointer to store amount of bytes read\r\n} IMAGEHLP_CBA_READ_MEMORY, *PIMAGEHLP_CBA_READ_MEMORY;\r\n\r\nenum\r\n{\r\n sevInfo = 0,\r\n sevProblem,\r\n sevAttn,\r\n sevFatal,\r\n sevMax // unused\r\n};\r\n\r\n#define EVENT_SRCSPEW_START 100\r\n#define EVENT_SRCSPEW 100\r\n#define EVENT_SRCSPEW_END 199\r\n\r\ntypedef struct _IMAGEHLP_CBA_EVENT\r\n{\r\n DWORD severity; // values from sevInfo to sevFatal\r\n DWORD code; // numerical code IDs the error\r\n PCHAR desc; // may contain a text description of the error\r\n PVOID object; // value dependant upon the error code\r\n} IMAGEHLP_CBA_EVENT, *PIMAGEHLP_CBA_EVENT;\r\n\r\ntypedef struct _IMAGEHLP_CBA_EVENTW\r\n{\r\n DWORD severity; // values from sevInfo to sevFatal\r\n DWORD code; // numerical code IDs the error\r\n PCWSTR desc; // may contain a text description of the error\r\n PVOID object; // value dependant upon the error code\r\n} IMAGEHLP_CBA_EVENTW, *PIMAGEHLP_CBA_EVENTW;\r\n\r\ntypedef struct _IMAGEHLP_DEFERRED_SYMBOL_LOAD64\r\n{\r\n DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_DEFERRED_SYMBOL_LOAD64)\r\n DWORD64 BaseOfImage; // base load address of module\r\n DWORD CheckSum; // checksum from the pe header\r\n DWORD TimeDateStamp; // date/time stamp from pe header\r\n CHAR FileName[MAX_PATH]; // symbols file or image name\r\n BOOLEAN Reparse; // load failure reparse\r\n HANDLE hFile; // file handle, if passed\r\n DWORD Flags; //\r\n} IMAGEHLP_DEFERRED_SYMBOL_LOAD64, *PIMAGEHLP_DEFERRED_SYMBOL_LOAD64;\r\n\r\ntypedef struct _IMAGEHLP_DEFERRED_SYMBOL_LOADW64\r\n{\r\n DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_DEFERRED_SYMBOL_LOADW64)\r\n DWORD64 BaseOfImage; // base load address of module\r\n DWORD CheckSum; // checksum from the pe header\r\n DWORD TimeDateStamp; // date/time stamp from pe header\r\n WCHAR FileName[MAX_PATH + 1]; // symbols file or image name\r\n BOOLEAN Reparse; // load failure reparse\r\n HANDLE hFile; // file handle, if passed\r\n DWORD Flags; //\r\n} IMAGEHLP_DEFERRED_SYMBOL_LOADW64, *PIMAGEHLP_DEFERRED_SYMBOL_LOADW64;\r\n\r\n#define DSLFLAG_MISMATCHED_PDB 0x1\r\n#define DSLFLAG_MISMATCHED_DBG 0x2\r\n\r\n#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64)\r\n#define IMAGEHLP_DEFERRED_SYMBOL_LOAD IMAGEHLP_DEFERRED_SYMBOL_LOAD64\r\n#define PIMAGEHLP_DEFERRED_SYMBOL_LOAD PIMAGEHLP_DEFERRED_SYMBOL_LOAD64\r\n#else\r\ntypedef struct _IMAGEHLP_DEFERRED_SYMBOL_LOAD\r\n{\r\n DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_DEFERRED_SYMBOL_LOAD)\r\n DWORD BaseOfImage; // base load address of module\r\n DWORD CheckSum; // checksum from the pe header\r\n DWORD TimeDateStamp; // date/time stamp from pe header\r\n CHAR FileName[MAX_PATH]; // symbols file or image name\r\n BOOLEAN Reparse; // load failure reparse\r\n HANDLE hFile; // file handle, if passed\r\n} IMAGEHLP_DEFERRED_SYMBOL_LOAD, *PIMAGEHLP_DEFERRED_SYMBOL_LOAD;\r\n#endif\r\n\r\ntypedef struct _IMAGEHLP_DUPLICATE_SYMBOL64\r\n{\r\n DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_DUPLICATE_SYMBOL64)\r\n DWORD NumberOfDups; // number of duplicates in the Symbol array\r\n PIMAGEHLP_SYMBOL64 Symbol; // array of duplicate symbols\r\n DWORD SelectedSymbol; // symbol selected (-1 to start)\r\n} IMAGEHLP_DUPLICATE_SYMBOL64, *PIMAGEHLP_DUPLICATE_SYMBOL64;\r\n\r\n#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64)\r\n#define IMAGEHLP_DUPLICATE_SYMBOL IMAGEHLP_DUPLICATE_SYMBOL64\r\n#define PIMAGEHLP_DUPLICATE_SYMBOL PIMAGEHLP_DUPLICATE_SYMBOL64\r\n#else\r\ntypedef struct _IMAGEHLP_DUPLICATE_SYMBOL\r\n{\r\n DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_DUPLICATE_SYMBOL)\r\n DWORD NumberOfDups; // number of duplicates in the Symbol array\r\n PIMAGEHLP_SYMBOL Symbol; // array of duplicate symbols\r\n DWORD SelectedSymbol; // symbol selected (-1 to start)\r\n} IMAGEHLP_DUPLICATE_SYMBOL, *PIMAGEHLP_DUPLICATE_SYMBOL;\r\n#endif\r\n\r\n// If dbghelp ever needs to display graphical UI, it will use this as the parent window.\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymSetParentWindow(\r\n __in HWND hwnd\r\n);\r\n\r\nPCHAR\r\nIMAGEAPI\r\nSymSetHomeDirectory(\r\n __in_opt HANDLE hProcess,\r\n __in_opt PCSTR dir\r\n);\r\n\r\nPWSTR\r\nIMAGEAPI\r\nSymSetHomeDirectoryW(\r\n __in_opt HANDLE hProcess,\r\n __in_opt PCWSTR dir\r\n);\r\n\r\nPCHAR\r\nIMAGEAPI\r\nSymGetHomeDirectory(\r\n __in DWORD type,\r\n __out_ecount(size) PSTR dir,\r\n __in size_t size\r\n);\r\n\r\nPWSTR\r\nIMAGEAPI\r\nSymGetHomeDirectoryW(\r\n __in DWORD type,\r\n __out_ecount(size) PWSTR dir,\r\n __in size_t size\r\n);\r\n\r\nenum\r\n{\r\n hdBase = 0, // root directory for dbghelp\r\n hdSym, // where symbols are stored\r\n hdSrc, // where source is stored\r\n hdMax // end marker\r\n};\r\n\r\ntypedef struct _OMAP\r\n{\r\n ULONG rva;\r\n ULONG rvaTo;\r\n} OMAP, *POMAP;\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymGetOmaps(\r\n __in HANDLE hProcess,\r\n __in DWORD64 BaseOfDll,\r\n __out POMAP* OmapTo,\r\n __out PDWORD64 cOmapTo,\r\n __out POMAP* OmapFrom,\r\n __out PDWORD64 cOmapFrom\r\n);\r\n\r\n//\r\n// options that are set/returned by SymSetOptions() & SymGetOptions()\r\n// these are used as a mask\r\n//\r\n#define SYMOPT_CASE_INSENSITIVE 0x00000001\r\n#define SYMOPT_UNDNAME 0x00000002\r\n#define SYMOPT_DEFERRED_LOADS 0x00000004\r\n#define SYMOPT_NO_CPP 0x00000008\r\n#define SYMOPT_LOAD_LINES 0x00000010\r\n#define SYMOPT_OMAP_FIND_NEAREST 0x00000020\r\n#define SYMOPT_LOAD_ANYTHING 0x00000040\r\n#define SYMOPT_IGNORE_CVREC 0x00000080\r\n#define SYMOPT_NO_UNQUALIFIED_LOADS 0x00000100\r\n#define SYMOPT_FAIL_CRITICAL_ERRORS 0x00000200\r\n#define SYMOPT_EXACT_SYMBOLS 0x00000400\r\n#define SYMOPT_ALLOW_ABSOLUTE_SYMBOLS 0x00000800\r\n#define SYMOPT_IGNORE_NT_SYMPATH 0x00001000\r\n#define SYMOPT_INCLUDE_32BIT_MODULES 0x00002000\r\n#define SYMOPT_PUBLICS_ONLY 0x00004000\r\n#define SYMOPT_NO_PUBLICS 0x00008000\r\n#define SYMOPT_AUTO_PUBLICS 0x00010000\r\n#define SYMOPT_NO_IMAGE_SEARCH 0x00020000\r\n#define SYMOPT_SECURE 0x00040000\r\n#define SYMOPT_NO_PROMPTS 0x00080000\r\n#define SYMOPT_OVERWRITE 0x00100000\r\n#define SYMOPT_IGNORE_IMAGEDIR 0x00200000\r\n#define SYMOPT_FLAT_DIRECTORY 0x00400000\r\n#define SYMOPT_FAVOR_COMPRESSED 0x00800000\r\n#define SYMOPT_ALLOW_ZERO_ADDRESS 0x01000000\r\n#define SYMOPT_DISABLE_SYMSRV_AUTODETECT 0x02000000\r\n\r\n#define SYMOPT_DEBUG 0x80000000\r\n\r\nDWORD\r\nIMAGEAPI\r\nSymSetOptions(\r\n __in DWORD SymOptions\r\n);\r\n\r\nDWORD\r\nIMAGEAPI\r\nSymGetOptions(\r\n VOID\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymCleanup(\r\n __in HANDLE hProcess\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymMatchString(\r\n __in PCSTR string,\r\n __in PCSTR expression,\r\n __in BOOL fCase\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymMatchStringA(\r\n __in PCSTR string,\r\n __in PCSTR expression,\r\n __in BOOL fCase\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymMatchStringW(\r\n __in PCWSTR string,\r\n __in PCWSTR expression,\r\n __in BOOL fCase\r\n);\r\n\r\ntypedef BOOL\r\n(CALLBACK* PSYM_ENUMSOURCEFILES_CALLBACK)(\r\n __in PSOURCEFILE pSourceFile,\r\n __in_opt PVOID UserContext\r\n);\r\n\r\n// for backwards compatibility - don't use this\r\n#define PSYM_ENUMSOURCFILES_CALLBACK PSYM_ENUMSOURCEFILES_CALLBACK\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymEnumSourceFiles(\r\n __in HANDLE hProcess,\r\n __in ULONG64 ModBase,\r\n __in_opt PCSTR Mask,\r\n __in PSYM_ENUMSOURCEFILES_CALLBACK cbSrcFiles,\r\n __in_opt PVOID UserContext\r\n);\r\n\r\ntypedef BOOL\r\n(CALLBACK* PSYM_ENUMSOURCEFILES_CALLBACKW)(\r\n __in PSOURCEFILEW pSourceFile,\r\n __in_opt PVOID UserContext\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymEnumSourceFilesW(\r\n __in HANDLE hProcess,\r\n __in ULONG64 ModBase,\r\n __in_opt PCWSTR Mask,\r\n __in PSYM_ENUMSOURCEFILES_CALLBACKW cbSrcFiles,\r\n __in_opt PVOID UserContext\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymEnumerateModules64(\r\n __in HANDLE hProcess,\r\n __in PSYM_ENUMMODULES_CALLBACK64 EnumModulesCallback,\r\n __in_opt PVOID UserContext\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymEnumerateModulesW64(\r\n __in HANDLE hProcess,\r\n __in PSYM_ENUMMODULES_CALLBACKW64 EnumModulesCallback,\r\n __in_opt PVOID UserContext\r\n);\r\n\r\n#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64)\r\n#define SymEnumerateModules SymEnumerateModules64\r\n#else\r\nBOOL\r\nIMAGEAPI\r\nSymEnumerateModules(\r\n __in HANDLE hProcess,\r\n __in PSYM_ENUMMODULES_CALLBACK EnumModulesCallback,\r\n __in_opt PVOID UserContext\r\n);\r\n#endif\r\n\r\nBOOL\r\nIMAGEAPI\r\nEnumerateLoadedModulesEx(\r\n __in HANDLE hProcess,\r\n __in PENUMLOADED_MODULES_CALLBACK64 EnumLoadedModulesCallback,\r\n __in_opt PVOID UserContext\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nEnumerateLoadedModulesExW(\r\n __in HANDLE hProcess,\r\n __in PENUMLOADED_MODULES_CALLBACKW64 EnumLoadedModulesCallback,\r\n __in_opt PVOID UserContext\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nEnumerateLoadedModules64(\r\n __in HANDLE hProcess,\r\n __in PENUMLOADED_MODULES_CALLBACK64 EnumLoadedModulesCallback,\r\n __in_opt PVOID UserContext\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nEnumerateLoadedModulesW64(\r\n __in HANDLE hProcess,\r\n __in PENUMLOADED_MODULES_CALLBACKW64 EnumLoadedModulesCallback,\r\n __in_opt PVOID UserContext\r\n);\r\n\r\n#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64)\r\n#define EnumerateLoadedModules EnumerateLoadedModules64\r\n#else\r\nBOOL\r\nIMAGEAPI\r\nEnumerateLoadedModules(\r\n __in HANDLE hProcess,\r\n __in PENUMLOADED_MODULES_CALLBACK EnumLoadedModulesCallback,\r\n __in_opt PVOID UserContext\r\n);\r\n#endif\r\n\r\nPVOID\r\nIMAGEAPI\r\nSymFunctionTableAccess64(\r\n __in HANDLE hProcess,\r\n __in DWORD64 AddrBase\r\n);\r\n\r\n#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64)\r\n#define SymFunctionTableAccess SymFunctionTableAccess64\r\n#else\r\nPVOID\r\nIMAGEAPI\r\nSymFunctionTableAccess(\r\n __in HANDLE hProcess,\r\n __in DWORD AddrBase\r\n);\r\n#endif\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymGetUnwindInfo(\r\n __in HANDLE hProcess,\r\n __in DWORD64 Address,\r\n __out_bcount_opt(*Size) PVOID Buffer,\r\n __inout PULONG Size\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymGetModuleInfo64(\r\n __in HANDLE hProcess,\r\n __in DWORD64 qwAddr,\r\n __out PIMAGEHLP_MODULE64 ModuleInfo\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymGetModuleInfoW64(\r\n __in HANDLE hProcess,\r\n __in DWORD64 qwAddr,\r\n __out PIMAGEHLP_MODULEW64 ModuleInfo\r\n);\r\n\r\n#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64)\r\n#define SymGetModuleInfo SymGetModuleInfo64\r\n#define SymGetModuleInfoW SymGetModuleInfoW64\r\n#else\r\nBOOL\r\nIMAGEAPI\r\nSymGetModuleInfo(\r\n __in HANDLE hProcess,\r\n __in DWORD dwAddr,\r\n __out PIMAGEHLP_MODULE ModuleInfo\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymGetModuleInfoW(\r\n __in HANDLE hProcess,\r\n __in DWORD dwAddr,\r\n __out PIMAGEHLP_MODULEW ModuleInfo\r\n);\r\n#endif\r\n\r\nDWORD64\r\nIMAGEAPI\r\nSymGetModuleBase64(\r\n __in HANDLE hProcess,\r\n __in DWORD64 qwAddr\r\n);\r\n\r\n#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64)\r\n#define SymGetModuleBase SymGetModuleBase64\r\n#else\r\nDWORD\r\nIMAGEAPI\r\nSymGetModuleBase(\r\n __in HANDLE hProcess,\r\n __in DWORD dwAddr\r\n);\r\n#endif\r\n\r\ntypedef struct _SRCCODEINFO\r\n{\r\n DWORD SizeOfStruct; // set to sizeof(SRCCODEINFO)\r\n PVOID Key; // not used\r\n DWORD64 ModBase; // base address of module this applies to\r\n CHAR Obj[MAX_PATH + 1]; // the object file within the module\r\n CHAR FileName[MAX_PATH + 1]; // full filename\r\n DWORD LineNumber; // line number in file\r\n DWORD64 Address; // first instruction of line\r\n} SRCCODEINFO, *PSRCCODEINFO;\r\n\r\ntypedef struct _SRCCODEINFOW\r\n{\r\n DWORD SizeOfStruct; // set to sizeof(SRCCODEINFO)\r\n PVOID Key; // not used\r\n DWORD64 ModBase; // base address of module this applies to\r\n WCHAR Obj[MAX_PATH + 1]; // the object file within the module\r\n WCHAR FileName[MAX_PATH + 1]; // full filename\r\n DWORD LineNumber; // line number in file\r\n DWORD64 Address; // first instruction of line\r\n} SRCCODEINFOW, *PSRCCODEINFOW;\r\n\r\ntypedef BOOL\r\n(CALLBACK* PSYM_ENUMLINES_CALLBACK)(\r\n __in PSRCCODEINFO LineInfo,\r\n __in_opt PVOID UserContext\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymEnumLines(\r\n __in HANDLE hProcess,\r\n __in ULONG64 Base,\r\n __in_opt PCSTR Obj,\r\n __in_opt PCSTR File,\r\n __in PSYM_ENUMLINES_CALLBACK EnumLinesCallback,\r\n __in_opt PVOID UserContext\r\n);\r\n\r\ntypedef BOOL\r\n(CALLBACK* PSYM_ENUMLINES_CALLBACKW)(\r\n __in PSRCCODEINFOW LineInfo,\r\n __in_opt PVOID UserContext\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymEnumLinesW(\r\n __in HANDLE hProcess,\r\n __in ULONG64 Base,\r\n __in_opt PCWSTR Obj,\r\n __in_opt PCWSTR File,\r\n __in PSYM_ENUMLINES_CALLBACKW EnumLinesCallback,\r\n __in_opt PVOID UserContext\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymGetLineFromAddr64(\r\n __in HANDLE hProcess,\r\n __in DWORD64 qwAddr,\r\n __out PDWORD pdwDisplacement,\r\n __out PIMAGEHLP_LINE64 Line64\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymGetLineFromAddrW64(\r\n __in HANDLE hProcess,\r\n __in DWORD64 dwAddr,\r\n __out PDWORD pdwDisplacement,\r\n __out PIMAGEHLP_LINEW64 Line\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymEnumSourceLines(\r\n __in HANDLE hProcess,\r\n __in ULONG64 Base,\r\n __in_opt PCSTR Obj,\r\n __in_opt PCSTR File,\r\n __in_opt DWORD Line,\r\n __in DWORD Flags,\r\n __in PSYM_ENUMLINES_CALLBACK EnumLinesCallback,\r\n __in_opt PVOID UserContext\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymEnumSourceLinesW(\r\n __in HANDLE hProcess,\r\n __in ULONG64 Base,\r\n __in_opt PCWSTR Obj,\r\n __in_opt PCWSTR File,\r\n __in_opt DWORD Line,\r\n __in DWORD Flags,\r\n __in PSYM_ENUMLINES_CALLBACKW EnumLinesCallback,\r\n __in_opt PVOID UserContext\r\n);\r\n\r\n// flags for SymEnumSourceLines\r\n\r\n#define ESLFLAG_FULLPATH 0x1\r\n#define ESLFLAG_NEAREST 0x2\r\n#define ESLFLAG_PREV 0x4\r\n#define ESLFLAG_NEXT 0x8\r\n\r\n#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64)\r\n#define SymGetLineFromAddr SymGetLineFromAddr64\r\n#define SymGetLineFromAddrW SymGetLineFromAddrW64\r\n#else\r\nBOOL\r\nIMAGEAPI\r\nSymGetLineFromAddr(\r\n __in HANDLE hProcess,\r\n __in DWORD dwAddr,\r\n __out PDWORD pdwDisplacement,\r\n __out PIMAGEHLP_LINE Line\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymGetLineFromAddrW(\r\n __in HANDLE hProcess,\r\n __in DWORD dwAddr,\r\n __out PDWORD pdwDisplacement,\r\n __out PIMAGEHLP_LINEW Line\r\n);\r\n#endif\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymGetLineFromName64(\r\n __in HANDLE hProcess,\r\n __in_opt PCSTR ModuleName,\r\n __in_opt PCSTR FileName,\r\n __in DWORD dwLineNumber,\r\n __out PLONG plDisplacement,\r\n __inout PIMAGEHLP_LINE64 Line\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymGetLineFromNameW64(\r\n __in HANDLE hProcess,\r\n __in_opt PCWSTR ModuleName,\r\n __in_opt PCWSTR FileName,\r\n __in DWORD dwLineNumber,\r\n __out PLONG plDisplacement,\r\n __inout PIMAGEHLP_LINEW64 Line\r\n);\r\n\r\n#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64)\r\n#define SymGetLineFromName SymGetLineFromName64\r\n#else\r\nBOOL\r\nIMAGEAPI\r\nSymGetLineFromName(\r\n __in HANDLE hProcess,\r\n __in_opt PCSTR ModuleName,\r\n __in_opt PCSTR FileName,\r\n __in DWORD dwLineNumber,\r\n __out PLONG plDisplacement,\r\n __inout PIMAGEHLP_LINE Line\r\n);\r\n#endif\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymGetLineNext64(\r\n __in HANDLE hProcess,\r\n __inout PIMAGEHLP_LINE64 Line\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymGetLineNextW64(\r\n __in HANDLE hProcess,\r\n __inout PIMAGEHLP_LINEW64 Line\r\n);\r\n\r\n#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64)\r\n#define SymGetLineNext SymGetLineNext64\r\n#else\r\nBOOL\r\nIMAGEAPI\r\nSymGetLineNext(\r\n __in HANDLE hProcess,\r\n __inout PIMAGEHLP_LINE Line\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymGetLineNextW(\r\n __in HANDLE hProcess,\r\n __inout PIMAGEHLP_LINEW Line\r\n);\r\n#endif\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymGetLinePrev64(\r\n __in HANDLE hProcess,\r\n __inout PIMAGEHLP_LINE64 Line\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymGetLinePrevW64(\r\n __in HANDLE hProcess,\r\n __inout PIMAGEHLP_LINEW64 Line\r\n);\r\n\r\n#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64)\r\n#define SymGetLinePrev SymGetLinePrev64\r\n#else\r\nBOOL\r\nIMAGEAPI\r\nSymGetLinePrev(\r\n __in HANDLE hProcess,\r\n __inout PIMAGEHLP_LINE Line\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymGetLinePrevW(\r\n __in HANDLE hProcess,\r\n __inout PIMAGEHLP_LINEW Line\r\n);\r\n#endif\r\n\r\nULONG\r\nIMAGEAPI\r\nSymGetFileLineOffsets64(\r\n __in HANDLE hProcess,\r\n __in_opt PCSTR ModuleName,\r\n __in PCSTR FileName,\r\n __out_ecount(BufferLines) PDWORD64 Buffer,\r\n __in ULONG BufferLines\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymMatchFileName(\r\n __in PCSTR FileName,\r\n __in PCSTR Match,\r\n __deref_opt_out PSTR* FileNameStop,\r\n __deref_opt_out PSTR* MatchStop\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymMatchFileNameW(\r\n __in PCWSTR FileName,\r\n __in PCWSTR Match,\r\n __deref_opt_out PWSTR* FileNameStop,\r\n __deref_opt_out PWSTR* MatchStop\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymGetSourceFile(\r\n __in HANDLE hProcess,\r\n __in ULONG64 Base,\r\n __in_opt PCSTR Params,\r\n __in PCSTR FileSpec,\r\n __out_ecount(Size) PSTR FilePath,\r\n __in DWORD Size\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymGetSourceFileW(\r\n __in HANDLE hProcess,\r\n __in ULONG64 Base,\r\n __in_opt PCWSTR Params,\r\n __in PCWSTR FileSpec,\r\n __out_ecount(Size) PWSTR FilePath,\r\n __in DWORD Size\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymGetSourceFileToken(\r\n __in HANDLE hProcess,\r\n __in ULONG64 Base,\r\n __in PCSTR FileSpec,\r\n __deref_out PVOID* Token,\r\n __out DWORD* Size\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymGetSourceFileTokenW(\r\n __in HANDLE hProcess,\r\n __in ULONG64 Base,\r\n __in PCWSTR FileSpec,\r\n __deref_out PVOID* Token,\r\n __out DWORD* Size\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymGetSourceFileFromToken(\r\n __in HANDLE hProcess,\r\n __in PVOID Token,\r\n __in_opt PCSTR Params,\r\n __out_ecount(Size) PSTR FilePath,\r\n __in DWORD Size\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymGetSourceFileFromTokenW(\r\n __in HANDLE hProcess,\r\n __in PVOID Token,\r\n __in_opt PCWSTR Params,\r\n __out_ecount(Size) PWSTR FilePath,\r\n __in DWORD Size\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymGetSourceVarFromToken(\r\n __in HANDLE hProcess,\r\n __in PVOID Token,\r\n __in_opt PCSTR Params,\r\n __in PCSTR VarName,\r\n __out_ecount(Size) PSTR Value,\r\n __in DWORD Size\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymGetSourceVarFromTokenW(\r\n __in HANDLE hProcess,\r\n __in PVOID Token,\r\n __in_opt PCWSTR Params,\r\n __in PCWSTR VarName,\r\n __out_ecount(Size) PWSTR Value,\r\n __in DWORD Size\r\n);\r\n\r\ntypedef BOOL (CALLBACK* PENUMSOURCEFILETOKENSCALLBACK)(__in PVOID token, __in size_t size);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymEnumSourceFileTokens(\r\n __in HANDLE hProcess,\r\n __in ULONG64 Base,\r\n __in PENUMSOURCEFILETOKENSCALLBACK Callback\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymInitialize(\r\n __in HANDLE hProcess,\r\n __in_opt PCSTR UserSearchPath,\r\n __in BOOL fInvadeProcess\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymInitializeW(\r\n __in HANDLE hProcess,\r\n __in_opt PCWSTR UserSearchPath,\r\n __in BOOL fInvadeProcess\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymGetSearchPath(\r\n __in HANDLE hProcess,\r\n __out_ecount(SearchPathLength) PSTR SearchPath,\r\n __in DWORD SearchPathLength\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymGetSearchPathW(\r\n __in HANDLE hProcess,\r\n __out_ecount(SearchPathLength) PWSTR SearchPath,\r\n __in DWORD SearchPathLength\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymSetSearchPath(\r\n __in HANDLE hProcess,\r\n __in_opt PCSTR SearchPath\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymSetSearchPathW(\r\n __in HANDLE hProcess,\r\n __in_opt PCWSTR SearchPath\r\n);\r\n\r\n#define SLMFLAG_VIRTUAL 0x1\r\n#define SLMFLAG_ALT_INDEX 0x2\r\n#define SLMFLAG_NO_SYMBOLS 0x4\r\n\r\nDWORD64\r\nIMAGEAPI\r\nSymLoadModuleEx(\r\n __in HANDLE hProcess,\r\n __in_opt HANDLE hFile,\r\n __in_opt PCSTR ImageName,\r\n __in_opt PCSTR ModuleName,\r\n __in DWORD64 BaseOfDll,\r\n __in DWORD DllSize,\r\n __in_opt PMODLOAD_DATA Data,\r\n __in_opt DWORD Flags\r\n);\r\n\r\nDWORD64\r\nIMAGEAPI\r\nSymLoadModuleExW(\r\n __in HANDLE hProcess,\r\n __in_opt HANDLE hFile,\r\n __in_opt PCWSTR ImageName,\r\n __in_opt PCWSTR ModuleName,\r\n __in DWORD64 BaseOfDll,\r\n __in DWORD DllSize,\r\n __in_opt PMODLOAD_DATA Data,\r\n __in_opt DWORD Flags\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymUnloadModule64(\r\n __in HANDLE hProcess,\r\n __in DWORD64 BaseOfDll\r\n);\r\n\r\n#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64)\r\n#define SymUnloadModule SymUnloadModule64\r\n#else\r\nBOOL\r\nIMAGEAPI\r\nSymUnloadModule(\r\n __in HANDLE hProcess,\r\n __in DWORD BaseOfDll\r\n);\r\n#endif\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymUnDName64(\r\n __in PIMAGEHLP_SYMBOL64 sym, // Symbol to undecorate\r\n __out_ecount(UnDecNameLength) PSTR UnDecName, // Buffer to store undecorated name in\r\n __in DWORD UnDecNameLength // Size of the buffer\r\n);\r\n\r\n#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64)\r\n#define SymUnDName SymUnDName64\r\n#else\r\nBOOL\r\nIMAGEAPI\r\nSymUnDName(\r\n __in PIMAGEHLP_SYMBOL sym, // Symbol to undecorate\r\n __out_ecount(UnDecNameLength) PSTR UnDecName, // Buffer to store undecorated name in\r\n __in DWORD UnDecNameLength // Size of the buffer\r\n);\r\n#endif\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymRegisterCallback64(\r\n __in HANDLE hProcess,\r\n __in PSYMBOL_REGISTERED_CALLBACK64 CallbackFunction,\r\n __in ULONG64 UserContext\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymRegisterCallbackW64(\r\n __in HANDLE hProcess,\r\n __in PSYMBOL_REGISTERED_CALLBACK64 CallbackFunction,\r\n __in ULONG64 UserContext\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymRegisterFunctionEntryCallback64(\r\n __in HANDLE hProcess,\r\n __in PSYMBOL_FUNCENTRY_CALLBACK64 CallbackFunction,\r\n __in ULONG64 UserContext\r\n);\r\n\r\n#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64)\r\n#define SymRegisterCallback SymRegisterCallback64\r\n#define SymRegisterFunctionEntryCallback SymRegisterFunctionEntryCallback64\r\n#else\r\nBOOL\r\nIMAGEAPI\r\nSymRegisterCallback(\r\n __in HANDLE hProcess,\r\n __in PSYMBOL_REGISTERED_CALLBACK CallbackFunction,\r\n __in_opt PVOID UserContext\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymRegisterFunctionEntryCallback(\r\n __in HANDLE hProcess,\r\n __in PSYMBOL_FUNCENTRY_CALLBACK CallbackFunction,\r\n __in_opt PVOID UserContext\r\n);\r\n#endif\r\n\r\n\r\ntypedef struct _IMAGEHLP_SYMBOL_SRC\r\n{\r\n DWORD sizeofstruct;\r\n DWORD type;\r\n char file[MAX_PATH];\r\n} IMAGEHLP_SYMBOL_SRC, *PIMAGEHLP_SYMBOL_SRC;\r\n\r\ntypedef struct _MODULE_TYPE_INFO // AKA TYPTYP\r\n{\r\n USHORT dataLength;\r\n USHORT leaf;\r\n BYTE data[1];\r\n} MODULE_TYPE_INFO, *PMODULE_TYPE_INFO;\r\n\r\ntypedef struct _SYMBOL_INFO\r\n{\r\n ULONG SizeOfStruct;\r\n ULONG TypeIndex; // Type Index of symbol\r\n ULONG64 Reserved[2];\r\n ULONG Index;\r\n ULONG Size;\r\n ULONG64 ModBase; // Base Address of module comtaining this symbol\r\n ULONG Flags;\r\n ULONG64 Value; // Value of symbol, ValuePresent should be 1\r\n ULONG64 Address; // Address of symbol including base address of module\r\n ULONG Register; // register holding value or pointer to value\r\n ULONG Scope; // scope of the symbol\r\n ULONG Tag; // pdb classification\r\n ULONG NameLen; // Actual length of name\r\n ULONG MaxNameLen;\r\n CHAR Name[1]; // Name of symbol\r\n} SYMBOL_INFO, *PSYMBOL_INFO;\r\n\r\ntypedef struct _SYMBOL_INFO_PACKAGE\r\n{\r\n SYMBOL_INFO si;\r\n CHAR name[MAX_SYM_NAME + 1];\r\n} SYMBOL_INFO_PACKAGE, *PSYMBOL_INFO_PACKAGE;\r\n\r\ntypedef struct _SYMBOL_INFOW\r\n{\r\n ULONG SizeOfStruct;\r\n ULONG TypeIndex; // Type Index of symbol\r\n ULONG64 Reserved[2];\r\n ULONG Index;\r\n ULONG Size;\r\n ULONG64 ModBase; // Base Address of module comtaining this symbol\r\n ULONG Flags;\r\n ULONG64 Value; // Value of symbol, ValuePresent should be 1\r\n ULONG64 Address; // Address of symbol including base address of module\r\n ULONG Register; // register holding value or pointer to value\r\n ULONG Scope; // scope of the symbol\r\n ULONG Tag; // pdb classification\r\n ULONG NameLen; // Actual length of name\r\n ULONG MaxNameLen;\r\n WCHAR Name[1]; // Name of symbol\r\n} SYMBOL_INFOW, *PSYMBOL_INFOW;\r\n\r\ntypedef struct _SYMBOL_INFO_PACKAGEW\r\n{\r\n SYMBOL_INFOW si;\r\n WCHAR name[MAX_SYM_NAME + 1];\r\n} SYMBOL_INFO_PACKAGEW, *PSYMBOL_INFO_PACKAGEW;\r\n\r\ntypedef struct _IMAGEHLP_STACK_FRAME\r\n{\r\n ULONG64 InstructionOffset;\r\n ULONG64 ReturnOffset;\r\n ULONG64 FrameOffset;\r\n ULONG64 StackOffset;\r\n ULONG64 BackingStoreOffset;\r\n ULONG64 FuncTableEntry;\r\n ULONG64 Params[4];\r\n ULONG64 Reserved[5];\r\n BOOL Virtual;\r\n ULONG Reserved2;\r\n} IMAGEHLP_STACK_FRAME, *PIMAGEHLP_STACK_FRAME;\r\n\r\ntypedef VOID IMAGEHLP_CONTEXT, *PIMAGEHLP_CONTEXT;\r\n\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymSetContext(\r\n __in HANDLE hProcess,\r\n __in PIMAGEHLP_STACK_FRAME StackFrame,\r\n __in_opt PIMAGEHLP_CONTEXT Context\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymSetScopeFromAddr(\r\n __in HANDLE hProcess,\r\n __in ULONG64 Address\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymSetScopeFromIndex(\r\n __in HANDLE hProcess,\r\n __in ULONG64 BaseOfDll,\r\n __in DWORD Index\r\n);\r\n\r\ntypedef BOOL\r\n(CALLBACK* PSYM_ENUMPROCESSES_CALLBACK)(\r\n __in HANDLE hProcess,\r\n __in PVOID UserContext\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymEnumProcesses(\r\n __in PSYM_ENUMPROCESSES_CALLBACK EnumProcessesCallback,\r\n __in PVOID UserContext\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymFromAddr(\r\n __in HANDLE hProcess,\r\n __in DWORD64 Address,\r\n __out_opt PDWORD64 Displacement,\r\n __inout PSYMBOL_INFO Symbol\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymFromAddrW(\r\n __in HANDLE hProcess,\r\n __in DWORD64 Address,\r\n __out_opt PDWORD64 Displacement,\r\n __inout PSYMBOL_INFOW Symbol\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymFromToken(\r\n __in HANDLE hProcess,\r\n __in DWORD64 Base,\r\n __in DWORD Token,\r\n __inout PSYMBOL_INFO Symbol\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymFromTokenW(\r\n __in HANDLE hProcess,\r\n __in DWORD64 Base,\r\n __in DWORD Token,\r\n __inout PSYMBOL_INFOW Symbol\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymNext(\r\n __in HANDLE hProcess,\r\n __inout PSYMBOL_INFO si\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymNextW(\r\n __in HANDLE hProcess,\r\n __inout PSYMBOL_INFOW siw\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymPrev(\r\n __in HANDLE hProcess,\r\n __inout PSYMBOL_INFO si\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymPrevW(\r\n __in HANDLE hProcess,\r\n __inout PSYMBOL_INFOW siw\r\n);\r\n\r\n// While SymFromName will provide a symbol from a name,\r\n// SymEnumSymbols can provide the same matching information\r\n// for ALL symbols with a matching name, even regular\r\n// expressions. That way you can search across modules\r\n// and differentiate between identically named symbols.\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymFromName(\r\n __in HANDLE hProcess,\r\n __in PCSTR Name,\r\n __inout PSYMBOL_INFO Symbol\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymFromNameW(\r\n __in HANDLE hProcess,\r\n __in PCWSTR Name,\r\n __inout PSYMBOL_INFOW Symbol\r\n);\r\n\r\ntypedef BOOL\r\n(CALLBACK* PSYM_ENUMERATESYMBOLS_CALLBACK)(\r\n __in PSYMBOL_INFO pSymInfo,\r\n __in ULONG SymbolSize,\r\n __in_opt PVOID UserContext\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymEnumSymbols(\r\n __in HANDLE hProcess,\r\n __in ULONG64 BaseOfDll,\r\n __in_opt PCSTR Mask,\r\n __in PSYM_ENUMERATESYMBOLS_CALLBACK EnumSymbolsCallback,\r\n __in_opt PVOID UserContext\r\n);\r\n\r\ntypedef BOOL\r\n(CALLBACK* PSYM_ENUMERATESYMBOLS_CALLBACKW)(\r\n __in PSYMBOL_INFOW pSymInfo,\r\n __in ULONG SymbolSize,\r\n __in_opt PVOID UserContext\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymEnumSymbolsW(\r\n __in HANDLE hProcess,\r\n __in ULONG64 BaseOfDll,\r\n __in_opt PCWSTR Mask,\r\n __in PSYM_ENUMERATESYMBOLS_CALLBACKW EnumSymbolsCallback,\r\n __in_opt PVOID UserContext\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymEnumSymbolsForAddr(\r\n __in HANDLE hProcess,\r\n __in DWORD64 Address,\r\n __in PSYM_ENUMERATESYMBOLS_CALLBACK EnumSymbolsCallback,\r\n __in_opt PVOID UserContext\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymEnumSymbolsForAddrW(\r\n __in HANDLE hProcess,\r\n __in DWORD64 Address,\r\n __in PSYM_ENUMERATESYMBOLS_CALLBACKW EnumSymbolsCallback,\r\n __in_opt PVOID UserContext\r\n);\r\n\r\n#define SYMSEARCH_MASKOBJS 0x01 // used internally to implement other APIs\r\n#define SYMSEARCH_RECURSE 0X02 // recurse scopes\r\n#define SYMSEARCH_GLOBALSONLY 0X04 // search only for global symbols\r\n#define SYMSEARCH_ALLITEMS 0X08 // search for everything in the pdb, not just normal scoped symbols\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymSearch(\r\n __in HANDLE hProcess,\r\n __in ULONG64 BaseOfDll,\r\n __in_opt DWORD Index,\r\n __in_opt DWORD SymTag,\r\n __in_opt PCSTR Mask,\r\n __in_opt DWORD64 Address,\r\n __in PSYM_ENUMERATESYMBOLS_CALLBACK EnumSymbolsCallback,\r\n __in_opt PVOID UserContext,\r\n __in DWORD Options\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymSearchW(\r\n __in HANDLE hProcess,\r\n __in ULONG64 BaseOfDll,\r\n __in_opt DWORD Index,\r\n __in_opt DWORD SymTag,\r\n __in_opt PCWSTR Mask,\r\n __in_opt DWORD64 Address,\r\n __in PSYM_ENUMERATESYMBOLS_CALLBACKW EnumSymbolsCallback,\r\n __in_opt PVOID UserContext,\r\n __in DWORD Options\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymGetScope(\r\n __in HANDLE hProcess,\r\n __in ULONG64 BaseOfDll,\r\n __in DWORD Index,\r\n __inout PSYMBOL_INFO Symbol\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymGetScopeW(\r\n __in HANDLE hProcess,\r\n __in ULONG64 BaseOfDll,\r\n __in DWORD Index,\r\n __inout PSYMBOL_INFOW Symbol\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymFromIndex(\r\n __in HANDLE hProcess,\r\n __in ULONG64 BaseOfDll,\r\n __in DWORD Index,\r\n __inout PSYMBOL_INFO Symbol\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymFromIndexW(\r\n __in HANDLE hProcess,\r\n __in ULONG64 BaseOfDll,\r\n __in DWORD Index,\r\n __inout PSYMBOL_INFOW Symbol\r\n);\r\n\r\ntypedef enum _IMAGEHLP_SYMBOL_TYPE_INFO\r\n{\r\n TI_GET_SYMTAG,\r\n TI_GET_SYMNAME,\r\n TI_GET_LENGTH,\r\n TI_GET_TYPE,\r\n TI_GET_TYPEID,\r\n TI_GET_BASETYPE,\r\n TI_GET_ARRAYINDEXTYPEID,\r\n TI_FINDCHILDREN,\r\n TI_GET_DATAKIND,\r\n TI_GET_ADDRESSOFFSET,\r\n TI_GET_OFFSET,\r\n TI_GET_VALUE,\r\n TI_GET_COUNT,\r\n TI_GET_CHILDRENCOUNT,\r\n TI_GET_BITPOSITION,\r\n TI_GET_VIRTUALBASECLASS,\r\n TI_GET_VIRTUALTABLESHAPEID,\r\n TI_GET_VIRTUALBASEPOINTEROFFSET,\r\n TI_GET_CLASSPARENTID,\r\n TI_GET_NESTED,\r\n TI_GET_SYMINDEX,\r\n TI_GET_LEXICALPARENT,\r\n TI_GET_ADDRESS,\r\n TI_GET_THISADJUST,\r\n TI_GET_UDTKIND,\r\n TI_IS_EQUIV_TO,\r\n TI_GET_CALLING_CONVENTION,\r\n TI_IS_CLOSE_EQUIV_TO,\r\n TI_GTIEX_REQS_VALID,\r\n TI_GET_VIRTUALBASEOFFSET,\r\n TI_GET_VIRTUALBASEDISPINDEX,\r\n TI_GET_IS_REFERENCE,\r\n TI_GET_INDIRECTVIRTUALBASECLASS,\r\n IMAGEHLP_SYMBOL_TYPE_INFO_MAX,\r\n} IMAGEHLP_SYMBOL_TYPE_INFO;\r\n\r\ntypedef struct _TI_FINDCHILDREN_PARAMS\r\n{\r\n ULONG Count;\r\n ULONG Start;\r\n ULONG ChildId[1];\r\n} TI_FINDCHILDREN_PARAMS;\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymGetTypeInfo(\r\n __in HANDLE hProcess,\r\n __in DWORD64 ModBase,\r\n __in ULONG TypeId,\r\n __in IMAGEHLP_SYMBOL_TYPE_INFO GetType,\r\n __out PVOID pInfo\r\n);\r\n\r\n#define IMAGEHLP_GET_TYPE_INFO_UNCACHED 0x00000001\r\n#define IMAGEHLP_GET_TYPE_INFO_CHILDREN 0x00000002\r\n\r\ntypedef struct _IMAGEHLP_GET_TYPE_INFO_PARAMS\r\n{\r\n IN ULONG SizeOfStruct;\r\n IN ULONG Flags;\r\n IN ULONG NumIds;\r\n IN PULONG TypeIds;\r\n IN ULONG64 TagFilter;\r\n IN ULONG NumReqs;\r\n IN IMAGEHLP_SYMBOL_TYPE_INFO* ReqKinds;\r\n IN PULONG_PTR ReqOffsets;\r\n IN PULONG ReqSizes;\r\n IN ULONG_PTR ReqStride;\r\n IN ULONG_PTR BufferSize;\r\n OUT PVOID Buffer;\r\n OUT ULONG EntriesMatched;\r\n OUT ULONG EntriesFilled;\r\n OUT ULONG64 TagsFound;\r\n OUT ULONG64 AllReqsValid;\r\n IN ULONG NumReqsValid;\r\n OUT PULONG64 ReqsValid OPTIONAL;\r\n} IMAGEHLP_GET_TYPE_INFO_PARAMS, *PIMAGEHLP_GET_TYPE_INFO_PARAMS;\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymGetTypeInfoEx(\r\n __in HANDLE hProcess,\r\n __in DWORD64 ModBase,\r\n __inout PIMAGEHLP_GET_TYPE_INFO_PARAMS Params\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymEnumTypes(\r\n __in HANDLE hProcess,\r\n __in ULONG64 BaseOfDll,\r\n __in PSYM_ENUMERATESYMBOLS_CALLBACK EnumSymbolsCallback,\r\n __in_opt PVOID UserContext\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymEnumTypesW(\r\n __in HANDLE hProcess,\r\n __in ULONG64 BaseOfDll,\r\n __in PSYM_ENUMERATESYMBOLS_CALLBACKW EnumSymbolsCallback,\r\n __in_opt PVOID UserContext\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymEnumTypesByName(\r\n __in HANDLE hProcess,\r\n __in ULONG64 BaseOfDll,\r\n __in_opt PCSTR mask,\r\n __in PSYM_ENUMERATESYMBOLS_CALLBACK EnumSymbolsCallback,\r\n __in_opt PVOID UserContext\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymEnumTypesByNameW(\r\n __in HANDLE hProcess,\r\n __in ULONG64 BaseOfDll,\r\n __in_opt PCWSTR mask,\r\n __in PSYM_ENUMERATESYMBOLS_CALLBACKW EnumSymbolsCallback,\r\n __in_opt PVOID UserContext\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymGetTypeFromName(\r\n __in HANDLE hProcess,\r\n __in ULONG64 BaseOfDll,\r\n __in PCSTR Name,\r\n __inout PSYMBOL_INFO Symbol\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymGetTypeFromNameW(\r\n __in HANDLE hProcess,\r\n __in ULONG64 BaseOfDll,\r\n __in PCWSTR Name,\r\n __inout PSYMBOL_INFOW Symbol\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymAddSymbol(\r\n __in HANDLE hProcess,\r\n __in ULONG64 BaseOfDll,\r\n __in PCSTR Name,\r\n __in DWORD64 Address,\r\n __in DWORD Size,\r\n __in DWORD Flags\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymAddSymbolW(\r\n __in HANDLE hProcess,\r\n __in ULONG64 BaseOfDll,\r\n __in PCWSTR Name,\r\n __in DWORD64 Address,\r\n __in DWORD Size,\r\n __in DWORD Flags\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymDeleteSymbol(\r\n __in HANDLE hProcess,\r\n __in ULONG64 BaseOfDll,\r\n __in_opt PCSTR Name,\r\n __in DWORD64 Address,\r\n __in DWORD Flags\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymDeleteSymbolW(\r\n __in HANDLE hProcess,\r\n __in ULONG64 BaseOfDll,\r\n __in_opt PCWSTR Name,\r\n __in DWORD64 Address,\r\n __in DWORD Flags\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymRefreshModuleList(\r\n __in HANDLE hProcess\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymAddSourceStream(\r\n __in HANDLE hProcess,\r\n __in ULONG64 Base,\r\n __in_opt PCSTR StreamFile,\r\n __in_bcount_opt(Size) PBYTE Buffer,\r\n __in size_t Size\r\n);\r\n\r\ntypedef BOOL (WINAPI* SYMADDSOURCESTREAM)(HANDLE, ULONG64, PCSTR, PBYTE, size_t);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymAddSourceStreamA(\r\n __in HANDLE hProcess,\r\n __in ULONG64 Base,\r\n __in_opt PCSTR StreamFile,\r\n __in_bcount_opt(Size) PBYTE Buffer,\r\n __in size_t Size\r\n);\r\n\r\ntypedef BOOL (WINAPI* SYMADDSOURCESTREAMA)(HANDLE, ULONG64, PCSTR, PBYTE, size_t);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymAddSourceStreamW(\r\n __in HANDLE hProcess,\r\n __in ULONG64 Base,\r\n __in_opt PCWSTR FileSpec,\r\n __in_bcount_opt(Size) PBYTE Buffer,\r\n __in size_t Size\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymSrvIsStoreW(\r\n __in_opt HANDLE hProcess,\r\n __in PCWSTR path\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymSrvIsStore(\r\n __in_opt HANDLE hProcess,\r\n __in PCSTR path\r\n);\r\n\r\nPCSTR\r\nIMAGEAPI\r\nSymSrvDeltaName(\r\n __in HANDLE hProcess,\r\n __in_opt PCSTR SymPath,\r\n __in PCSTR Type,\r\n __in PCSTR File1,\r\n __in PCSTR File2\r\n);\r\n\r\nPCWSTR\r\nIMAGEAPI\r\nSymSrvDeltaNameW(\r\n __in HANDLE hProcess,\r\n __in_opt PCWSTR SymPath,\r\n __in PCWSTR Type,\r\n __in PCWSTR File1,\r\n __in PCWSTR File2\r\n);\r\n\r\nPCSTR\r\nIMAGEAPI\r\nSymSrvGetSupplement(\r\n __in HANDLE hProcess,\r\n __in_opt PCSTR SymPath,\r\n __in PCSTR Node,\r\n __in PCSTR File\r\n);\r\n\r\nPCWSTR\r\nIMAGEAPI\r\nSymSrvGetSupplementW(\r\n __in HANDLE hProcess,\r\n __in_opt PCWSTR SymPath,\r\n __in PCWSTR Node,\r\n __in PCWSTR File\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymSrvGetFileIndexes(\r\n __in PCSTR File,\r\n __out GUID* Id,\r\n __out PDWORD Val1,\r\n __out_opt PDWORD Val2,\r\n __in DWORD Flags\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymSrvGetFileIndexesW(\r\n __in PCWSTR File,\r\n __out GUID* Id,\r\n __out PDWORD Val1,\r\n __out_opt PDWORD Val2,\r\n __in DWORD Flags\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymSrvGetFileIndexStringW(\r\n __in HANDLE hProcess,\r\n __in_opt PCWSTR SrvPath,\r\n __in PCWSTR File,\r\n __out_ecount(Size) PWSTR Index,\r\n __in size_t Size,\r\n __in DWORD Flags\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymSrvGetFileIndexString(\r\n __in HANDLE hProcess,\r\n __in_opt PCSTR SrvPath,\r\n __in PCSTR File,\r\n __out_ecount(Size) PSTR Index,\r\n __in size_t Size,\r\n __in DWORD Flags\r\n);\r\n\r\ntypedef struct\r\n{\r\n DWORD sizeofstruct;\r\n char file[MAX_PATH + 1];\r\n BOOL stripped;\r\n DWORD timestamp;\r\n DWORD size;\r\n char dbgfile[MAX_PATH + 1];\r\n char pdbfile[MAX_PATH + 1];\r\n GUID guid;\r\n DWORD sig;\r\n DWORD age;\r\n} SYMSRV_INDEX_INFO, *PSYMSRV_INDEX_INFO;\r\n\r\ntypedef struct\r\n{\r\n DWORD sizeofstruct;\r\n WCHAR file[MAX_PATH + 1];\r\n BOOL stripped;\r\n DWORD timestamp;\r\n DWORD size;\r\n WCHAR dbgfile[MAX_PATH + 1];\r\n WCHAR pdbfile[MAX_PATH + 1];\r\n GUID guid;\r\n DWORD sig;\r\n DWORD age;\r\n} SYMSRV_INDEX_INFOW, *PSYMSRV_INDEX_INFOW;\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymSrvGetFileIndexInfo(\r\n __in PCSTR File,\r\n __out PSYMSRV_INDEX_INFO Info,\r\n __in DWORD Flags\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymSrvGetFileIndexInfoW(\r\n __in PCWSTR File,\r\n __out PSYMSRV_INDEX_INFOW Info,\r\n __in DWORD Flags\r\n);\r\n\r\nPCSTR\r\nIMAGEAPI\r\nSymSrvStoreSupplement(\r\n __in HANDLE hProcess,\r\n __in_opt PCSTR SrvPath,\r\n __in PCSTR Node,\r\n __in PCSTR File,\r\n __in DWORD Flags\r\n);\r\n\r\nPCWSTR\r\nIMAGEAPI\r\nSymSrvStoreSupplementW(\r\n __in HANDLE hProcess,\r\n __in_opt PCWSTR SymPath,\r\n __in PCWSTR Node,\r\n __in PCWSTR File,\r\n __in DWORD Flags\r\n);\r\n\r\nPCSTR\r\nIMAGEAPI\r\nSymSrvStoreFile(\r\n __in HANDLE hProcess,\r\n __in_opt PCSTR SrvPath,\r\n __in PCSTR File,\r\n __in DWORD Flags\r\n);\r\n\r\nPCWSTR\r\nIMAGEAPI\r\nSymSrvStoreFileW(\r\n __in HANDLE hProcess,\r\n __in_opt PCWSTR SrvPath,\r\n __in PCWSTR File,\r\n __in DWORD Flags\r\n);\r\n\r\n// used by SymGetSymbolFile's \"Type\" parameter\r\n\r\nenum\r\n{\r\n sfImage = 0,\r\n sfDbg,\r\n sfPdb,\r\n sfMpd,\r\n sfMax\r\n};\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymGetSymbolFile(\r\n __in_opt HANDLE hProcess,\r\n __in_opt PCSTR SymPath,\r\n __in PCSTR ImageFile,\r\n __in DWORD Type,\r\n __out_ecount(cSymbolFile) PSTR SymbolFile,\r\n __in size_t cSymbolFile,\r\n __out_ecount(cDbgFile) PSTR DbgFile,\r\n __in size_t cDbgFile\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymGetSymbolFileW(\r\n __in_opt HANDLE hProcess,\r\n __in_opt PCWSTR SymPath,\r\n __in PCWSTR ImageFile,\r\n __in DWORD Type,\r\n __out_ecount(cSymbolFile) PWSTR SymbolFile,\r\n __in size_t cSymbolFile,\r\n __out_ecount(cDbgFile) PWSTR DbgFile,\r\n __in size_t cDbgFile\r\n);\r\n\r\n//\r\n// Full user-mode dump creation.\r\n//\r\n\r\ntypedef BOOL (WINAPI* PDBGHELP_CREATE_USER_DUMP_CALLBACK)(\r\n __in DWORD DataType,\r\n __in PVOID* Data,\r\n __out LPDWORD DataLength,\r\n __in_opt PVOID UserData\r\n);\r\n\r\nBOOL\r\nWINAPI\r\nDbgHelpCreateUserDump(\r\n __in_opt LPCSTR FileName,\r\n __in PDBGHELP_CREATE_USER_DUMP_CALLBACK Callback,\r\n __in_opt PVOID UserData\r\n);\r\n\r\nBOOL\r\nWINAPI\r\nDbgHelpCreateUserDumpW(\r\n __in_opt LPCWSTR FileName,\r\n __in PDBGHELP_CREATE_USER_DUMP_CALLBACK Callback,\r\n __in_opt PVOID UserData\r\n);\r\n\r\n// -----------------------------------------------------------------\r\n// The following 4 legacy APIs are fully supported, but newer\r\n// ones are recommended. SymFromName and SymFromAddr provide\r\n// much more detailed info on the returned symbol.\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymGetSymFromAddr64(\r\n __in HANDLE hProcess,\r\n __in DWORD64 qwAddr,\r\n __out_opt PDWORD64 pdwDisplacement,\r\n __inout PIMAGEHLP_SYMBOL64 Symbol\r\n);\r\n\r\n\r\n#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64)\r\n#define SymGetSymFromAddr SymGetSymFromAddr64\r\n#else\r\nBOOL\r\nIMAGEAPI\r\nSymGetSymFromAddr(\r\n __in HANDLE hProcess,\r\n __in DWORD dwAddr,\r\n __out_opt PDWORD pdwDisplacement,\r\n __inout PIMAGEHLP_SYMBOL Symbol\r\n);\r\n#endif\r\n\r\n// While following two APIs will provide a symbol from a name,\r\n// SymEnumSymbols can provide the same matching information\r\n// for ALL symbols with a matching name, even regular\r\n// expressions. That way you can search across modules\r\n// and differentiate between identically named symbols.\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymGetSymFromName64(\r\n __in HANDLE hProcess,\r\n __in PCSTR Name,\r\n __inout PIMAGEHLP_SYMBOL64 Symbol\r\n);\r\n\r\n#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64)\r\n#define SymGetSymFromName SymGetSymFromName64\r\n#else\r\nBOOL\r\nIMAGEAPI\r\nSymGetSymFromName(\r\n __in HANDLE hProcess,\r\n __in PCSTR Name,\r\n __inout PIMAGEHLP_SYMBOL Symbol\r\n);\r\n#endif\r\n\r\n\r\n// Symbol server exports\r\n\r\ntypedef BOOL (WINAPI* PSYMBOLSERVERPROC)(PCSTR, PCSTR, PVOID, DWORD, DWORD, PSTR);\r\ntypedef BOOL (WINAPI* PSYMBOLSERVERPROCA)(PCSTR, PCSTR, PVOID, DWORD, DWORD, PSTR);\r\ntypedef BOOL (WINAPI* PSYMBOLSERVERPROCW)(PCWSTR, PCWSTR, PVOID, DWORD, DWORD, PWSTR);\r\ntypedef BOOL (WINAPI* PSYMBOLSERVERBYINDEXPROC)(PCSTR, PCSTR, PCSTR, PSTR);\r\ntypedef BOOL (WINAPI* PSYMBOLSERVERBYINDEXPROCA)(PCSTR, PCSTR, PCSTR, PSTR);\r\ntypedef BOOL (WINAPI* PSYMBOLSERVERBYINDEXPROCW)(PCWSTR, PCWSTR, PCWSTR, PWSTR);\r\ntypedef BOOL (WINAPI* PSYMBOLSERVEROPENPROC)(VOID);\r\ntypedef BOOL (WINAPI* PSYMBOLSERVERCLOSEPROC)(VOID);\r\ntypedef BOOL (WINAPI* PSYMBOLSERVERSETOPTIONSPROC)(UINT_PTR, ULONG64);\r\ntypedef BOOL (WINAPI* PSYMBOLSERVERSETOPTIONSWPROC)(UINT_PTR, ULONG64);\r\ntypedef BOOL (CALLBACK WINAPI* PSYMBOLSERVERCALLBACKPROC)(UINT_PTR action, ULONG64 data, ULONG64 context);\r\ntypedef UINT_PTR(WINAPI* PSYMBOLSERVERGETOPTIONSPROC)();\r\ntypedef BOOL (WINAPI* PSYMBOLSERVERPINGPROC)(PCSTR);\r\ntypedef BOOL (WINAPI* PSYMBOLSERVERPINGPROCA)(PCSTR);\r\ntypedef BOOL (WINAPI* PSYMBOLSERVERPINGPROCW)(PCWSTR);\r\ntypedef BOOL (WINAPI* PSYMBOLSERVERGETVERSION)(LPAPI_VERSION);\r\ntypedef BOOL (WINAPI* PSYMBOLSERVERDELTANAME)(PCSTR, PVOID, DWORD, DWORD, PVOID, DWORD, DWORD, PSTR, size_t);\r\ntypedef BOOL (WINAPI* PSYMBOLSERVERDELTANAMEW)(PCWSTR, PVOID, DWORD, DWORD, PVOID, DWORD, DWORD, PWSTR, size_t);\r\ntypedef BOOL (WINAPI* PSYMBOLSERVERGETSUPPLEMENT)(PCSTR, PCSTR, PCSTR, PSTR, size_t);\r\ntypedef BOOL (WINAPI* PSYMBOLSERVERGETSUPPLEMENTW)(PCWSTR, PCWSTR, PCWSTR, PWSTR, size_t);\r\ntypedef BOOL (WINAPI* PSYMBOLSERVERSTORESUPPLEMENT)(PCSTR, PCSTR, PCSTR, PSTR, size_t, DWORD);\r\ntypedef BOOL (WINAPI* PSYMBOLSERVERSTORESUPPLEMENTW)(PCWSTR, PCWSTR, PCWSTR, PWSTR, size_t, DWORD);\r\ntypedef BOOL (WINAPI* PSYMBOLSERVERGETINDEXSTRING)(PVOID, DWORD, DWORD, PSTR, size_t);\r\ntypedef BOOL (WINAPI* PSYMBOLSERVERGETINDEXSTRINGW)(PVOID, DWORD, DWORD, PWSTR, size_t);\r\ntypedef BOOL (WINAPI* PSYMBOLSERVERSTOREFILE)(PCSTR, PCSTR, PVOID, DWORD, DWORD, PSTR, size_t, DWORD);\r\ntypedef BOOL (WINAPI* PSYMBOLSERVERSTOREFILEW)(PCWSTR, PCWSTR, PVOID, DWORD, DWORD, PWSTR, size_t, DWORD);\r\ntypedef BOOL (WINAPI* PSYMBOLSERVERISSTORE)(PCSTR);\r\ntypedef BOOL (WINAPI* PSYMBOLSERVERISSTOREW)(PCWSTR);\r\ntypedef DWORD (WINAPI* PSYMBOLSERVERVERSION)();\r\ntypedef BOOL (CALLBACK WINAPI* PSYMBOLSERVERMESSAGEPROC)(UINT_PTR action, ULONG64 data, ULONG64 context);\r\n\r\n#define SYMSRV_VERSION 2\r\n\r\n#define SSRVOPT_CALLBACK 0x00000001\r\n#define SSRVOPT_DWORD 0x00000002\r\n#define SSRVOPT_DWORDPTR 0x00000004\r\n#define SSRVOPT_GUIDPTR 0x00000008\r\n#define SSRVOPT_OLDGUIDPTR 0x00000010\r\n#define SSRVOPT_UNATTENDED 0x00000020\r\n#define SSRVOPT_NOCOPY 0x00000040\r\n#define SSRVOPT_GETPATH 0x00000040\r\n#define SSRVOPT_PARENTWIN 0x00000080\r\n#define SSRVOPT_PARAMTYPE 0x00000100\r\n#define SSRVOPT_SECURE 0x00000200\r\n#define SSRVOPT_TRACE 0x00000400\r\n#define SSRVOPT_SETCONTEXT 0x00000800\r\n#define SSRVOPT_PROXY 0x00001000\r\n#define SSRVOPT_DOWNSTREAM_STORE 0x00002000\r\n#define SSRVOPT_OVERWRITE 0x00004000\r\n#define SSRVOPT_RESETTOU 0x00008000\r\n#define SSRVOPT_CALLBACKW 0x00010000\r\n#define SSRVOPT_FLAT_DEFAULT_STORE 0x00020000\r\n#define SSRVOPT_PROXYW 0x00040000\r\n#define SSRVOPT_MESSAGE 0x00080000\r\n#define SSRVOPT_SERVICE 0x00100000 // deprecated\r\n#define SSRVOPT_FAVOR_COMPRESSED 0x00200000\r\n#define SSRVOPT_STRING 0x00400000\r\n#define SSRVOPT_WINHTTP 0x00800000\r\n#define SSRVOPT_WININET 0x01000000\r\n\r\n#define SSRVOPT_MAX 0x0100000\r\n\r\n#define SSRVOPT_RESET ((ULONG_PTR)-1)\r\n\r\n\r\n#define NUM_SSRVOPTS 30\r\n\r\n#define SSRVACTION_TRACE 1\r\n#define SSRVACTION_QUERYCANCEL 2\r\n#define SSRVACTION_EVENT 3\r\n#define SSRVACTION_EVENTW 4\r\n#define SSRVACTION_SIZE 5\r\n\r\n#define SYMSTOREOPT_COMPRESS 0x01\r\n#define SYMSTOREOPT_OVERWRITE 0x02\r\n#define SYMSTOREOPT_RETURNINDEX 0x04\r\n#define SYMSTOREOPT_POINTER 0x08\r\n#define SYMSTOREOPT_ALT_INDEX 0x10\r\n#define SYMSTOREOPT_UNICODE 0x20\r\n#define SYMSTOREOPT_PASS_IF_EXISTS 0x40\r\n\r\n#ifdef DBGHELP_TRANSLATE_TCHAR\r\n#define SymInitialize SymInitializeW\r\n#define SymAddSymbol SymAddSymbolW\r\n#define SymDeleteSymbol SymDeleteSymbolW\r\n#define SearchTreeForFile SearchTreeForFileW\r\n#define UnDecorateSymbolName UnDecorateSymbolNameW\r\n#define SymGetLineFromName64 SymGetLineFromNameW64\r\n#define SymGetLineFromAddr64 SymGetLineFromAddrW64\r\n#define SymGetLineNext64 SymGetLineNextW64\r\n#define SymGetLinePrev64 SymGetLinePrevW64\r\n#define SymFromName SymFromNameW\r\n#define SymFindExecutableImage SymFindExecutableImageW\r\n#define FindExecutableImageEx FindExecutableImageExW\r\n#define SymSearch SymSearchW\r\n#define SymEnumLines SymEnumLinesW\r\n#define SymEnumSourceLines SymEnumSourceLinesW\r\n#define SymGetTypeFromName SymGetTypeFromNameW\r\n#define SymEnumSymbolsForAddr SymEnumSymbolsForAddrW\r\n#define SymFromAddr SymFromAddrW\r\n#define SymMatchString SymMatchStringW\r\n#define SymEnumSourceFiles SymEnumSourceFilesW\r\n#define SymEnumSymbols SymEnumSymbolsW\r\n#define SymLoadModuleEx SymLoadModuleExW\r\n#define SymSetSearchPath SymSetSearchPathW\r\n#define SymGetSearchPath SymGetSearchPathW\r\n#define EnumDirTree EnumDirTreeW\r\n#define SymFromToken SymFromTokenW\r\n#define SymFromIndex SymFromIndexW\r\n#define SymGetScope SymGetScopeW\r\n#define SymNext SymNextW\r\n#define SymPrev SymPrevW\r\n#define SymEnumTypes SymEnumTypesW\r\n#define SymEnumTypesByName SymEnumTypesByNameW\r\n#define SymRegisterCallback64 SymRegisterCallbackW64\r\n#define SymFindDebugInfoFile SymFindDebugInfoFileW\r\n#define FindDebugInfoFileEx FindDebugInfoFileExW\r\n#define SymFindFileInPath SymFindFileInPathW\r\n#define SymEnumerateModules64 SymEnumerateModulesW64\r\n#define SymSetHomeDirectory SymSetHomeDirectoryW\r\n#define SymGetHomeDirectory SymGetHomeDirectoryW\r\n#define SymGetSourceFile SymGetSourceFileW\r\n#define SymGetSourceFileToken SymGetSourceFileTokenW\r\n#define SymGetSourceFileFromToken SymGetSourceFileFromTokenW\r\n#define SymGetSourceVarFromToken SymGetSourceVarFromTokenW\r\n#define SymGetSourceFileToken SymGetSourceFileTokenW\r\n#define SymGetFileLineOffsets64 SymGetFileLineOffsetsW64\r\n#define SymFindFileInPath SymFindFileInPathW\r\n#define SymMatchFileName SymMatchFileNameW\r\n#define SymGetSourceFileFromToken SymGetSourceFileFromTokenW\r\n#define SymGetSourceVarFromToken SymGetSourceVarFromTokenW\r\n#define SymGetModuleInfo64 SymGetModuleInfoW64\r\n#define SymSrvIsStore SymSrvIsStoreW\r\n#define SymSrvDeltaName SymSrvDeltaNameW\r\n#define SymSrvGetSupplement SymSrvGetSupplementW\r\n#define SymSrvStoreSupplement SymSrvStoreSupplementW\r\n#define SymSrvGetFileIndexes SymSrvGetFileIndexes\r\n#define SymSrvGetFileIndexString SymSrvGetFileIndexStringW\r\n#define SymSrvStoreFile SymSrvStoreFileW\r\n#define SymGetSymbolFile SymGetSymbolFileW\r\n#define EnumerateLoadedModules64 EnumerateLoadedModulesW64\r\n#define EnumerateLoadedModulesEx EnumerateLoadedModulesExW\r\n#define SymSrvGetFileIndexInfo SymSrvGetFileIndexInfoW\r\n\r\n#define IMAGEHLP_LINE64 IMAGEHLP_LINEW64\r\n#define PIMAGEHLP_LINE64 PIMAGEHLP_LINEW64\r\n#define SYMBOL_INFO SYMBOL_INFOW\r\n#define PSYMBOL_INFO PSYMBOL_INFOW\r\n#define SYMBOL_INFO_PACKAGE SYMBOL_INFO_PACKAGEW\r\n#define PSYMBOL_INFO_PACKAGE PSYMBOL_INFO_PACKAGEW\r\n#define FIND_EXE_FILE_CALLBACK FIND_EXE_FILE_CALLBACKW\r\n#define PFIND_EXE_FILE_CALLBACK PFIND_EXE_FILE_CALLBACKW\r\n#define SYM_ENUMERATESYMBOLS_CALLBACK SYM_ENUMERATESYMBOLS_CALLBACKW\r\n#define PSYM_ENUMERATESYMBOLS_CALLBACK PSYM_ENUMERATESYMBOLS_CALLBACKW\r\n#define SRCCODEINFO SRCCODEINFOW\r\n#define PSRCCODEINFO PSRCCODEINFOW\r\n#define SOURCEFILE SOURCEFILEW\r\n#define PSOURCEFILE PSOURCEFILEW\r\n#define SYM_ENUMSOURECFILES_CALLBACK SYM_ENUMSOURCEFILES_CALLBACKW\r\n#define PSYM_ENUMSOURCEFILES_CALLBACK PSYM_ENUMSOURECFILES_CALLBACKW\r\n#define IMAGEHLP_CBA_EVENT IMAGEHLP_CBA_EVENTW\r\n#define PIMAGEHLP_CBA_EVENT PIMAGEHLP_CBA_EVENTW\r\n#define PENUMDIRTREE_CALLBACK PENUMDIRTREE_CALLBACKW\r\n#define IMAGEHLP_DEFERRED_SYMBOL_LOAD64 IMAGEHLP_DEFERRED_SYMBOL_LOADW64\r\n#define PIMAGEHLP_DEFERRED_SYMBOL_LOAD64 PIMAGEHLP_DEFERRED_SYMBOL_LOADW64\r\n#define PFIND_DEBUG_FILE_CALLBACK PFIND_DEBUG_FILE_CALLBACKW\r\n#define PFINDFILEINPATHCALLBACK PFINDFILEINPATHCALLBACKW\r\n#define IMAGEHLP_MODULE64 IMAGEHLP_MODULEW64\r\n#define PIMAGEHLP_MODULE64 PIMAGEHLP_MODULEW64\r\n#define SYMSRV_INDEX_INFO SYMSRV_INDEX_INFOW\r\n#define PSYMSRV_INDEX_INFO PSYMSRV_INDEX_INFOW\r\n\r\n#define PSYMBOLSERVERPROC PSYMBOLSERVERPROCW\r\n#define PSYMBOLSERVERPINGPROC PSYMBOLSERVERPINGPROCW\r\n#endif\r\n\r\n// -----------------------------------------------------------------\r\n// The following APIs exist only for backwards compatibility\r\n// with a pre-release version documented in an MSDN release.\r\n\r\n// You should use SymFindFileInPath if you want to maintain\r\n// future compatibility.\r\n\r\nDBHLP_DEPRECIATED\r\nBOOL\r\nIMAGEAPI\r\nFindFileInPath(\r\n __in HANDLE hprocess,\r\n __in PCSTR SearchPath,\r\n __in PCSTR FileName,\r\n __in PVOID id,\r\n __in DWORD two,\r\n __in DWORD three,\r\n __in DWORD flags,\r\n __out_ecount(MAX_PATH + 1) PSTR FilePath\r\n);\r\n\r\n// You should use SymFindFileInPath if you want to maintain\r\n// future compatibility.\r\n\r\nDBHLP_DEPRECIATED\r\nBOOL\r\nIMAGEAPI\r\nFindFileInSearchPath(\r\n __in HANDLE hprocess,\r\n __in PCSTR SearchPath,\r\n __in PCSTR FileName,\r\n __in DWORD one,\r\n __in DWORD two,\r\n __in DWORD three,\r\n __out_ecount(MAX_PATH + 1) PSTR FilePath\r\n);\r\n\r\nDBHLP_DEPRECIATED\r\nBOOL\r\nIMAGEAPI\r\nSymEnumSym(\r\n __in HANDLE hProcess,\r\n __in ULONG64 BaseOfDll,\r\n __in PSYM_ENUMERATESYMBOLS_CALLBACK EnumSymbolsCallback,\r\n __in_opt PVOID UserContext\r\n);\r\n\r\nDBHLP_DEPRECIATED\r\nBOOL\r\nIMAGEAPI\r\nSymEnumerateSymbols64(\r\n __in HANDLE hProcess,\r\n __in ULONG64 BaseOfDll,\r\n __in PSYM_ENUMSYMBOLS_CALLBACK64 EnumSymbolsCallback,\r\n __in_opt PVOID UserContext\r\n);\r\n\r\nDBHLP_DEPRECIATED\r\nBOOL\r\nIMAGEAPI\r\nSymEnumerateSymbolsW64(\r\n __in HANDLE hProcess,\r\n __in ULONG64 BaseOfDll,\r\n __in PSYM_ENUMSYMBOLS_CALLBACK64W EnumSymbolsCallback,\r\n __in_opt PVOID UserContext\r\n);\r\n\r\n\r\n#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64)\r\n#define SymEnumerateSymbols SymEnumerateSymbols64\r\n#define SymEnumerateSymbolsW SymEnumerateSymbolsW64\r\n#else\r\nDBHLP_DEPRECIATED\r\nBOOL\r\nIMAGEAPI\r\nSymEnumerateSymbols(\r\n __in HANDLE hProcess,\r\n __in ULONG BaseOfDll,\r\n __in PSYM_ENUMSYMBOLS_CALLBACK EnumSymbolsCallback,\r\n __in_opt PVOID UserContext\r\n);\r\n\r\nDBHLP_DEPRECIATED\r\nBOOL\r\nIMAGEAPI\r\nSymEnumerateSymbolsW(\r\n __in HANDLE hProcess,\r\n __in ULONG BaseOfDll,\r\n __in PSYM_ENUMSYMBOLS_CALLBACKW EnumSymbolsCallback,\r\n __in_opt PVOID UserContext\r\n);\r\n#endif\r\n\r\n// use SymLoadModuleEx\r\n\r\nDWORD64\r\nIMAGEAPI\r\nSymLoadModule64(\r\n __in HANDLE hProcess,\r\n __in_opt HANDLE hFile,\r\n __in_opt PCSTR ImageName,\r\n __in_opt PCSTR ModuleName,\r\n __in DWORD64 BaseOfDll,\r\n __in DWORD SizeOfDll\r\n);\r\n\r\n#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64)\r\n#define SymLoadModule SymLoadModule64\r\n#else\r\nDWORD\r\nIMAGEAPI\r\nSymLoadModule(\r\n __in HANDLE hProcess,\r\n __in_opt HANDLE hFile,\r\n __in_opt PCSTR ImageName,\r\n __in_opt PCSTR ModuleName,\r\n __in DWORD BaseOfDll,\r\n __in DWORD SizeOfDll\r\n);\r\n#endif\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymGetSymNext64(\r\n __in HANDLE hProcess,\r\n __inout PIMAGEHLP_SYMBOL64 Symbol\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymGetSymNextW64(\r\n __in HANDLE hProcess,\r\n __inout PIMAGEHLP_SYMBOLW64 Symbol\r\n);\r\n\r\n#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64)\r\n#define SymGetSymNext SymGetSymNext64\r\n#define SymGetSymNextW SymGetSymNextW64\r\n#else\r\nBOOL\r\nIMAGEAPI\r\nSymGetSymNext(\r\n __in HANDLE hProcess,\r\n __inout PIMAGEHLP_SYMBOL Symbol\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymGetSymNextW(\r\n __in HANDLE hProcess,\r\n __inout PIMAGEHLP_SYMBOLW Symbol\r\n);\r\n#endif\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymGetSymPrev64(\r\n __in HANDLE hProcess,\r\n __inout PIMAGEHLP_SYMBOL64 Symbol\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymGetSymPrevW64(\r\n __in HANDLE hProcess,\r\n __inout PIMAGEHLP_SYMBOLW64 Symbol\r\n);\r\n\r\n#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64)\r\n#define SymGetSymPrev SymGetSymPrev64\r\n#define SymGetSymPrevW SymGetSymPrevW64\r\n#else\r\nBOOL\r\nIMAGEAPI\r\nSymGetSymPrev(\r\n __in HANDLE hProcess,\r\n __inout PIMAGEHLP_SYMBOL Symbol\r\n);\r\n\r\nBOOL\r\nIMAGEAPI\r\nSymGetSymPrevW(\r\n __in HANDLE hProcess,\r\n __inout PIMAGEHLP_SYMBOLW Symbol\r\n);\r\n#endif\r\n\r\n\r\n// These values should not be used.\r\n// They have been replaced by SYMFLAG_ values.\r\n\r\n#define SYMF_OMAP_GENERATED 0x00000001\r\n#define SYMF_OMAP_MODIFIED 0x00000002\r\n#define SYMF_REGISTER 0x00000008\r\n#define SYMF_REGREL 0x00000010\r\n#define SYMF_FRAMEREL 0x00000020\r\n#define SYMF_PARAMETER 0x00000040\r\n#define SYMF_LOCAL 0x00000080\r\n#define SYMF_CONSTANT 0x00000100\r\n#define SYMF_EXPORT 0x00000200\r\n#define SYMF_FORWARDER 0x00000400\r\n#define SYMF_FUNCTION 0x00000800\r\n#define SYMF_VIRTUAL 0x00001000\r\n#define SYMF_THUNK 0x00002000\r\n#define SYMF_TLSREL 0x00004000\r\n\r\n// These values should also not be used.\r\n// They have been replaced by SYMFLAG_ values.\r\n\r\n#define IMAGEHLP_SYMBOL_INFO_VALUEPRESENT 1\r\n#define IMAGEHLP_SYMBOL_INFO_REGISTER SYMF_REGISTER // 0x0008\r\n#define IMAGEHLP_SYMBOL_INFO_REGRELATIVE SYMF_REGREL // 0x0010\r\n#define IMAGEHLP_SYMBOL_INFO_FRAMERELATIVE SYMF_FRAMEREL // 0x0020\r\n#define IMAGEHLP_SYMBOL_INFO_PARAMETER SYMF_PARAMETER // 0x0040\r\n#define IMAGEHLP_SYMBOL_INFO_LOCAL SYMF_LOCAL // 0x0080\r\n#define IMAGEHLP_SYMBOL_INFO_CONSTANT SYMF_CONSTANT // 0x0100\r\n#define IMAGEHLP_SYMBOL_FUNCTION SYMF_FUNCTION // 0x0800\r\n#define IMAGEHLP_SYMBOL_VIRTUAL SYMF_VIRTUAL // 0x1000\r\n#define IMAGEHLP_SYMBOL_THUNK SYMF_THUNK // 0x2000\r\n#define IMAGEHLP_SYMBOL_INFO_TLSRELATIVE SYMF_TLSREL // 0x4000\r\n\r\n#pragma pack(pop)\r\n\r\n\r\n#pragma pack(push,4)\r\n\r\n#define MINIDUMP_SIGNATURE ('PMDM')\r\n#define MINIDUMP_VERSION (42899)\r\ntypedef DWORD RVA;\r\ntypedef ULONG64 RVA64;\r\n\r\ntypedef struct _MINIDUMP_LOCATION_DESCRIPTOR\r\n{\r\n ULONG32 DataSize;\r\n RVA Rva;\r\n} MINIDUMP_LOCATION_DESCRIPTOR;\r\n\r\ntypedef struct _MINIDUMP_LOCATION_DESCRIPTOR64\r\n{\r\n ULONG64 DataSize;\r\n RVA64 Rva;\r\n} MINIDUMP_LOCATION_DESCRIPTOR64;\r\n\r\n\r\ntypedef struct _MINIDUMP_MEMORY_DESCRIPTOR\r\n{\r\n ULONG64 StartOfMemoryRange;\r\n MINIDUMP_LOCATION_DESCRIPTOR Memory;\r\n} MINIDUMP_MEMORY_DESCRIPTOR, *PMINIDUMP_MEMORY_DESCRIPTOR;\r\n\r\n// DESCRIPTOR64 is used for full-memory minidumps where\r\n// all of the raw memory is laid out sequentially at the\r\n// end of the dump. There is no need for individual RVAs\r\n// as the RVA is the base RVA plus the sum of the preceeding\r\n// data blocks.\r\ntypedef struct _MINIDUMP_MEMORY_DESCRIPTOR64\r\n{\r\n ULONG64 StartOfMemoryRange;\r\n ULONG64 DataSize;\r\n} MINIDUMP_MEMORY_DESCRIPTOR64, *PMINIDUMP_MEMORY_DESCRIPTOR64;\r\n\r\n\r\ntypedef struct _MINIDUMP_HEADER\r\n{\r\n ULONG32 Signature;\r\n ULONG32 Version;\r\n ULONG32 NumberOfStreams;\r\n RVA StreamDirectoryRva;\r\n ULONG32 CheckSum;\r\n union\r\n {\r\n ULONG32 Reserved;\r\n ULONG32 TimeDateStamp;\r\n };\r\n ULONG64 Flags;\r\n} MINIDUMP_HEADER, *PMINIDUMP_HEADER;\r\n\r\n//\r\n// The MINIDUMP_HEADER field StreamDirectoryRva points to\r\n// an array of MINIDUMP_DIRECTORY structures.\r\n//\r\n\r\ntypedef struct _MINIDUMP_DIRECTORY\r\n{\r\n ULONG32 StreamType;\r\n MINIDUMP_LOCATION_DESCRIPTOR Location;\r\n} MINIDUMP_DIRECTORY, *PMINIDUMP_DIRECTORY;\r\n\r\n\r\ntypedef struct _MINIDUMP_STRING\r\n{\r\n ULONG32 Length; // Length in bytes of the string\r\n WCHAR Buffer [0]; // Variable size buffer\r\n} MINIDUMP_STRING, *PMINIDUMP_STRING;\r\n\r\n\r\n\r\n//\r\n// The MINIDUMP_DIRECTORY field StreamType may be one of the following types.\r\n// Types will be added in the future, so if a program reading the minidump\r\n// header encounters a stream type it does not understand it should ignore\r\n// the data altogether. Any tag above LastReservedStream will not be used by\r\n// the system and is reserved for program-specific information.\r\n//\r\n\r\ntypedef enum _MINIDUMP_STREAM_TYPE\r\n{\r\n\r\n UnusedStream = 0,\r\n ReservedStream0 = 1,\r\n ReservedStream1 = 2,\r\n ThreadListStream = 3,\r\n ModuleListStream = 4,\r\n MemoryListStream = 5,\r\n ExceptionStream = 6,\r\n SystemInfoStream = 7,\r\n ThreadExListStream = 8,\r\n Memory64ListStream = 9,\r\n CommentStreamA = 10,\r\n CommentStreamW = 11,\r\n HandleDataStream = 12,\r\n FunctionTableStream = 13,\r\n UnloadedModuleListStream = 14,\r\n MiscInfoStream = 15,\r\n MemoryInfoListStream = 16,\r\n ThreadInfoListStream = 17,\r\n HandleOperationListStream = 18,\r\n TokenStream = 19,\r\n\r\n ceStreamNull = 0x8000,\r\n ceStreamSystemInfo = 0x8001,\r\n ceStreamException = 0x8002,\r\n ceStreamModuleList = 0x8003,\r\n ceStreamProcessList = 0x8004,\r\n ceStreamThreadList = 0x8005,\r\n ceStreamThreadContextList = 0x8006,\r\n ceStreamThreadCallStackList = 0x8007,\r\n ceStreamMemoryVirtualList = 0x8008,\r\n ceStreamMemoryPhysicalList = 0x8009,\r\n ceStreamBucketParameters = 0x800A,\r\n ceStreamProcessModuleMap = 0x800B,\r\n ceStreamDiagnosisList = 0x800C,\r\n\r\n LastReservedStream = 0xffff\r\n\r\n} MINIDUMP_STREAM_TYPE;\r\n\r\n\r\n//\r\n// The minidump system information contains processor and\r\n// Operating System specific information.\r\n//\r\n\r\n//\r\n// CPU information is obtained from one of two places.\r\n//\r\n// 1) On x86 computers, CPU_INFORMATION is obtained from the CPUID\r\n// instruction. You must use the X86 portion of the union for X86\r\n// computers.\r\n//\r\n// 2) On non-x86 architectures, CPU_INFORMATION is obtained by calling\r\n// IsProcessorFeatureSupported().\r\n//\r\n\r\ntypedef union _CPU_INFORMATION\r\n{\r\n\r\n //\r\n // X86 platforms use CPUID function to obtain processor information.\r\n //\r\n\r\n struct\r\n {\r\n\r\n //\r\n // CPUID Subfunction 0, register EAX (VendorId [0]),\r\n // EBX (VendorId [1]) and ECX (VendorId [2]).\r\n //\r\n\r\n ULONG32 VendorId [ 3 ];\r\n\r\n //\r\n // CPUID Subfunction 1, register EAX\r\n //\r\n\r\n ULONG32 VersionInformation;\r\n\r\n //\r\n // CPUID Subfunction 1, register EDX\r\n //\r\n\r\n ULONG32 FeatureInformation;\r\n\r\n\r\n //\r\n // CPUID, Subfunction 80000001, register EBX. This will only\r\n // be obtained if the vendor id is \"AuthenticAMD\".\r\n //\r\n\r\n ULONG32 AMDExtendedCpuFeatures;\r\n\r\n } X86CpuInfo;\r\n\r\n //\r\n // Non-x86 platforms use processor feature flags.\r\n //\r\n\r\n struct\r\n {\r\n\r\n ULONG64 ProcessorFeatures [ 2 ];\r\n\r\n } OtherCpuInfo;\r\n\r\n} CPU_INFORMATION, *PCPU_INFORMATION;\r\n\r\ntypedef struct _MINIDUMP_SYSTEM_INFO\r\n{\r\n\r\n //\r\n // ProcessorArchitecture, ProcessorLevel and ProcessorRevision are all\r\n // taken from the SYSTEM_INFO structure obtained by GetSystemInfo( ).\r\n //\r\n\r\n USHORT ProcessorArchitecture;\r\n USHORT ProcessorLevel;\r\n USHORT ProcessorRevision;\r\n\r\n union\r\n {\r\n USHORT Reserved0;\r\n struct\r\n {\r\n UCHAR NumberOfProcessors;\r\n UCHAR ProductType;\r\n };\r\n };\r\n\r\n //\r\n // MajorVersion, MinorVersion, BuildNumber, PlatformId and\r\n // CSDVersion are all taken from the OSVERSIONINFO structure\r\n // returned by GetVersionEx( ).\r\n //\r\n\r\n ULONG32 MajorVersion;\r\n ULONG32 MinorVersion;\r\n ULONG32 BuildNumber;\r\n ULONG32 PlatformId;\r\n\r\n //\r\n // RVA to a CSDVersion string in the string table.\r\n //\r\n\r\n RVA CSDVersionRva;\r\n\r\n union\r\n {\r\n ULONG32 Reserved1;\r\n struct\r\n {\r\n USHORT SuiteMask;\r\n USHORT Reserved2;\r\n };\r\n };\r\n\r\n CPU_INFORMATION Cpu;\r\n\r\n} MINIDUMP_SYSTEM_INFO, *PMINIDUMP_SYSTEM_INFO;\r\n\r\n\r\n//\r\n// The minidump thread contains standard thread\r\n// information plus an RVA to the memory for this\r\n// thread and an RVA to the CONTEXT structure for\r\n// this thread.\r\n//\r\n\r\n\r\n//\r\n// ThreadId must be 4 bytes on all architectures.\r\n//\r\n\r\nC_ASSERT(sizeof(((PPROCESS_INFORMATION)0)->dwThreadId) == 4);\r\n\r\ntypedef struct _MINIDUMP_THREAD\r\n{\r\n ULONG32 ThreadId;\r\n ULONG32 SuspendCount;\r\n ULONG32 PriorityClass;\r\n ULONG32 Priority;\r\n ULONG64 Teb;\r\n MINIDUMP_MEMORY_DESCRIPTOR Stack;\r\n MINIDUMP_LOCATION_DESCRIPTOR ThreadContext;\r\n} MINIDUMP_THREAD, *PMINIDUMP_THREAD;\r\n\r\n//\r\n// The thread list is a container of threads.\r\n//\r\n\r\ntypedef struct _MINIDUMP_THREAD_LIST\r\n{\r\n ULONG32 NumberOfThreads;\r\n MINIDUMP_THREAD Threads [0];\r\n} MINIDUMP_THREAD_LIST, *PMINIDUMP_THREAD_LIST;\r\n\r\n\r\ntypedef struct _MINIDUMP_THREAD_EX\r\n{\r\n ULONG32 ThreadId;\r\n ULONG32 SuspendCount;\r\n ULONG32 PriorityClass;\r\n ULONG32 Priority;\r\n ULONG64 Teb;\r\n MINIDUMP_MEMORY_DESCRIPTOR Stack;\r\n MINIDUMP_LOCATION_DESCRIPTOR ThreadContext;\r\n MINIDUMP_MEMORY_DESCRIPTOR BackingStore;\r\n} MINIDUMP_THREAD_EX, *PMINIDUMP_THREAD_EX;\r\n\r\n//\r\n// The thread list is a container of threads.\r\n//\r\n\r\ntypedef struct _MINIDUMP_THREAD_EX_LIST\r\n{\r\n ULONG32 NumberOfThreads;\r\n MINIDUMP_THREAD_EX Threads [0];\r\n} MINIDUMP_THREAD_EX_LIST, *PMINIDUMP_THREAD_EX_LIST;\r\n\r\n\r\n//\r\n// The MINIDUMP_EXCEPTION is the same as EXCEPTION on Win64.\r\n//\r\n\r\ntypedef struct _MINIDUMP_EXCEPTION\r\n{\r\n ULONG32 ExceptionCode;\r\n ULONG32 ExceptionFlags;\r\n ULONG64 ExceptionRecord;\r\n ULONG64 ExceptionAddress;\r\n ULONG32 NumberParameters;\r\n ULONG32 __unusedAlignment;\r\n ULONG64 ExceptionInformation [ EXCEPTION_MAXIMUM_PARAMETERS ];\r\n} MINIDUMP_EXCEPTION, *PMINIDUMP_EXCEPTION;\r\n\r\n\r\n//\r\n// The exception information stream contains the id of the thread that caused\r\n// the exception (ThreadId), the exception record for the exception\r\n// (ExceptionRecord) and an RVA to the thread context where the exception\r\n// occured.\r\n//\r\n\r\ntypedef struct MINIDUMP_EXCEPTION_STREAM\r\n{\r\n ULONG32 ThreadId;\r\n ULONG32 __alignment;\r\n MINIDUMP_EXCEPTION ExceptionRecord;\r\n MINIDUMP_LOCATION_DESCRIPTOR ThreadContext;\r\n} MINIDUMP_EXCEPTION_STREAM, *PMINIDUMP_EXCEPTION_STREAM;\r\n\r\n\r\n//\r\n// The MINIDUMP_MODULE contains information about a\r\n// a specific module. It includes the CheckSum and\r\n// the TimeDateStamp for the module so the module\r\n// can be reloaded during the analysis phase.\r\n//\r\n\r\ntypedef struct _MINIDUMP_MODULE\r\n{\r\n ULONG64 BaseOfImage;\r\n ULONG32 SizeOfImage;\r\n ULONG32 CheckSum;\r\n ULONG32 TimeDateStamp;\r\n RVA ModuleNameRva;\r\n VS_FIXEDFILEINFO VersionInfo;\r\n MINIDUMP_LOCATION_DESCRIPTOR CvRecord;\r\n MINIDUMP_LOCATION_DESCRIPTOR MiscRecord;\r\n ULONG64 Reserved0; // Reserved for future use.\r\n ULONG64 Reserved1; // Reserved for future use.\r\n} MINIDUMP_MODULE, *PMINIDUMP_MODULE;\r\n\r\n\r\n//\r\n// The minidump module list is a container for modules.\r\n//\r\n\r\ntypedef struct _MINIDUMP_MODULE_LIST\r\n{\r\n ULONG32 NumberOfModules;\r\n MINIDUMP_MODULE Modules [ 0 ];\r\n} MINIDUMP_MODULE_LIST, *PMINIDUMP_MODULE_LIST;\r\n\r\n\r\n//\r\n// Memory Ranges\r\n//\r\n\r\ntypedef struct _MINIDUMP_MEMORY_LIST\r\n{\r\n ULONG32 NumberOfMemoryRanges;\r\n MINIDUMP_MEMORY_DESCRIPTOR MemoryRanges [0];\r\n} MINIDUMP_MEMORY_LIST, *PMINIDUMP_MEMORY_LIST;\r\n\r\ntypedef struct _MINIDUMP_MEMORY64_LIST\r\n{\r\n ULONG64 NumberOfMemoryRanges;\r\n RVA64 BaseRva;\r\n MINIDUMP_MEMORY_DESCRIPTOR64 MemoryRanges [0];\r\n} MINIDUMP_MEMORY64_LIST, *PMINIDUMP_MEMORY64_LIST;\r\n\r\n\r\n//\r\n// Support for user supplied exception information.\r\n//\r\n\r\ntypedef struct _MINIDUMP_EXCEPTION_INFORMATION\r\n{\r\n DWORD ThreadId;\r\n PEXCEPTION_POINTERS ExceptionPointers;\r\n BOOL ClientPointers;\r\n} MINIDUMP_EXCEPTION_INFORMATION, *PMINIDUMP_EXCEPTION_INFORMATION;\r\n\r\ntypedef struct _MINIDUMP_EXCEPTION_INFORMATION64\r\n{\r\n DWORD ThreadId;\r\n ULONG64 ExceptionRecord;\r\n ULONG64 ContextRecord;\r\n BOOL ClientPointers;\r\n} MINIDUMP_EXCEPTION_INFORMATION64, *PMINIDUMP_EXCEPTION_INFORMATION64;\r\n\r\n\r\n//\r\n// Support for capturing system handle state at the time of the dump.\r\n//\r\n\r\n// Per-handle object information varies according to\r\n// the OS, the OS version, the processor type and\r\n// so on. The minidump gives a minidump identifier\r\n// to each possible data format for identification\r\n// purposes but does not control nor describe the actual data.\r\ntypedef enum _MINIDUMP_HANDLE_OBJECT_INFORMATION_TYPE\r\n{\r\n MiniHandleObjectInformationNone,\r\n MiniThreadInformation1,\r\n MiniMutantInformation1,\r\n MiniMutantInformation2,\r\n MiniProcessInformation1,\r\n MiniProcessInformation2,\r\n MiniHandleObjectInformationTypeMax\r\n} MINIDUMP_HANDLE_OBJECT_INFORMATION_TYPE;\r\n\r\ntypedef struct _MINIDUMP_HANDLE_OBJECT_INFORMATION\r\n{\r\n RVA NextInfoRva;\r\n ULONG32 InfoType;\r\n ULONG32 SizeOfInfo;\r\n // Raw information follows.\r\n} MINIDUMP_HANDLE_OBJECT_INFORMATION;\r\n\r\ntypedef struct _MINIDUMP_HANDLE_DESCRIPTOR\r\n{\r\n ULONG64 Handle;\r\n RVA TypeNameRva;\r\n RVA ObjectNameRva;\r\n ULONG32 Attributes;\r\n ULONG32 GrantedAccess;\r\n ULONG32 HandleCount;\r\n ULONG32 PointerCount;\r\n} MINIDUMP_HANDLE_DESCRIPTOR, *PMINIDUMP_HANDLE_DESCRIPTOR;\r\n\r\ntypedef struct _MINIDUMP_HANDLE_DESCRIPTOR_2\r\n{\r\n ULONG64 Handle;\r\n RVA TypeNameRva;\r\n RVA ObjectNameRva;\r\n ULONG32 Attributes;\r\n ULONG32 GrantedAccess;\r\n ULONG32 HandleCount;\r\n ULONG32 PointerCount;\r\n RVA ObjectInfoRva;\r\n ULONG32 Reserved0;\r\n} MINIDUMP_HANDLE_DESCRIPTOR_2, *PMINIDUMP_HANDLE_DESCRIPTOR_2;\r\n\r\n// The latest MINIDUMP_HANDLE_DESCRIPTOR definition.\r\ntypedef MINIDUMP_HANDLE_DESCRIPTOR_2 MINIDUMP_HANDLE_DESCRIPTOR_N;\r\ntypedef MINIDUMP_HANDLE_DESCRIPTOR_N* PMINIDUMP_HANDLE_DESCRIPTOR_N;\r\n\r\ntypedef struct _MINIDUMP_HANDLE_DATA_STREAM\r\n{\r\n ULONG32 SizeOfHeader;\r\n ULONG32 SizeOfDescriptor;\r\n ULONG32 NumberOfDescriptors;\r\n ULONG32 Reserved;\r\n} MINIDUMP_HANDLE_DATA_STREAM, *PMINIDUMP_HANDLE_DATA_STREAM;\r\n\r\n// Some operating systems can track the last operations\r\n// performed on a handle. For example, Application Verifier\r\n// can enable this for some versions of Windows. The\r\n// handle operation list collects handle operations\r\n// known for the dump target.\r\n// Each entry is an AVRF_HANDLE_OPERATION.\r\ntypedef struct _MINIDUMP_HANDLE_OPERATION_LIST\r\n{\r\n ULONG32 SizeOfHeader;\r\n ULONG32 SizeOfEntry;\r\n ULONG32 NumberOfEntries;\r\n ULONG32 Reserved;\r\n} MINIDUMP_HANDLE_OPERATION_LIST, *PMINIDUMP_HANDLE_OPERATION_LIST;\r\n\r\n\r\n//\r\n// Support for capturing dynamic function table state at the time of the dump.\r\n//\r\n\r\ntypedef struct _MINIDUMP_FUNCTION_TABLE_DESCRIPTOR\r\n{\r\n ULONG64 MinimumAddress;\r\n ULONG64 MaximumAddress;\r\n ULONG64 BaseAddress;\r\n ULONG32 EntryCount;\r\n ULONG32 SizeOfAlignPad;\r\n} MINIDUMP_FUNCTION_TABLE_DESCRIPTOR, *PMINIDUMP_FUNCTION_TABLE_DESCRIPTOR;\r\n\r\ntypedef struct _MINIDUMP_FUNCTION_TABLE_STREAM\r\n{\r\n ULONG32 SizeOfHeader;\r\n ULONG32 SizeOfDescriptor;\r\n ULONG32 SizeOfNativeDescriptor;\r\n ULONG32 SizeOfFunctionEntry;\r\n ULONG32 NumberOfDescriptors;\r\n ULONG32 SizeOfAlignPad;\r\n} MINIDUMP_FUNCTION_TABLE_STREAM, *PMINIDUMP_FUNCTION_TABLE_STREAM;\r\n\r\n\r\n//\r\n// The MINIDUMP_UNLOADED_MODULE contains information about a\r\n// a specific module that was previously loaded but no\r\n// longer is. This can help with diagnosing problems where\r\n// callers attempt to call code that is no longer loaded.\r\n//\r\n\r\ntypedef struct _MINIDUMP_UNLOADED_MODULE\r\n{\r\n ULONG64 BaseOfImage;\r\n ULONG32 SizeOfImage;\r\n ULONG32 CheckSum;\r\n ULONG32 TimeDateStamp;\r\n RVA ModuleNameRva;\r\n} MINIDUMP_UNLOADED_MODULE, *PMINIDUMP_UNLOADED_MODULE;\r\n\r\n\r\n//\r\n// The minidump unloaded module list is a container for unloaded modules.\r\n//\r\n\r\ntypedef struct _MINIDUMP_UNLOADED_MODULE_LIST\r\n{\r\n ULONG32 SizeOfHeader;\r\n ULONG32 SizeOfEntry;\r\n ULONG32 NumberOfEntries;\r\n} MINIDUMP_UNLOADED_MODULE_LIST, *PMINIDUMP_UNLOADED_MODULE_LIST;\r\n\r\n\r\n//\r\n// The miscellaneous information stream contains a variety\r\n// of small pieces of information. A member is valid if\r\n// it's within the available size and its corresponding\r\n// bit is set.\r\n//\r\n\r\n#define MINIDUMP_MISC1_PROCESS_ID 0x00000001\r\n#define MINIDUMP_MISC1_PROCESS_TIMES 0x00000002\r\n#define MINIDUMP_MISC1_PROCESSOR_POWER_INFO 0x00000004\r\n#define MINIDUMP_MISC3_PROCESS_INTEGRITY 0x00000010\r\n#define MINIDUMP_MISC3_PROCESS_EXECUTE_FLAGS 0x00000020\r\n#define MINIDUMP_MISC3_TIMEZONE 0x00000040\r\n#define MINIDUMP_MISC3_PROTECTED_PROCESS 0x00000080\r\n\r\ntypedef struct _MINIDUMP_MISC_INFO\r\n{\r\n ULONG32 SizeOfInfo;\r\n ULONG32 Flags1;\r\n ULONG32 ProcessId;\r\n ULONG32 ProcessCreateTime;\r\n ULONG32 ProcessUserTime;\r\n ULONG32 ProcessKernelTime;\r\n} MINIDUMP_MISC_INFO, *PMINIDUMP_MISC_INFO;\r\n\r\ntypedef struct _MINIDUMP_MISC_INFO_2\r\n{\r\n ULONG32 SizeOfInfo;\r\n ULONG32 Flags1;\r\n ULONG32 ProcessId;\r\n ULONG32 ProcessCreateTime;\r\n ULONG32 ProcessUserTime;\r\n ULONG32 ProcessKernelTime;\r\n ULONG32 ProcessorMaxMhz;\r\n ULONG32 ProcessorCurrentMhz;\r\n ULONG32 ProcessorMhzLimit;\r\n ULONG32 ProcessorMaxIdleState;\r\n ULONG32 ProcessorCurrentIdleState;\r\n} MINIDUMP_MISC_INFO_2, *PMINIDUMP_MISC_INFO_2;\r\n\r\ntypedef struct _MINIDUMP_MISC_INFO_3\r\n{\r\n ULONG32 SizeOfInfo;\r\n ULONG32 Flags1;\r\n ULONG32 ProcessId;\r\n ULONG32 ProcessCreateTime;\r\n ULONG32 ProcessUserTime;\r\n ULONG32 ProcessKernelTime;\r\n ULONG32 ProcessorMaxMhz;\r\n ULONG32 ProcessorCurrentMhz;\r\n ULONG32 ProcessorMhzLimit;\r\n ULONG32 ProcessorMaxIdleState;\r\n ULONG32 ProcessorCurrentIdleState;\r\n ULONG32 ProcessIntegrityLevel;\r\n ULONG32 ProcessExecuteFlags;\r\n ULONG32 ProtectedProcess;\r\n ULONG32 TimeZoneId;\r\n TIME_ZONE_INFORMATION TimeZone;\r\n} MINIDUMP_MISC_INFO_3, *PMINIDUMP_MISC_INFO_3;\r\n\r\n// The latest MINIDUMP_MISC_INFO definition.\r\ntypedef MINIDUMP_MISC_INFO_3 MINIDUMP_MISC_INFO_N;\r\ntypedef MINIDUMP_MISC_INFO_N* PMINIDUMP_MISC_INFO_N;\r\n\r\n\r\n//\r\n// The memory information stream contains memory region\r\n// description information. This stream corresponds to\r\n// what VirtualQuery would return for the process the\r\n// dump was created for.\r\n//\r\n\r\ntypedef struct _MINIDUMP_MEMORY_INFO\r\n{\r\n ULONG64 BaseAddress;\r\n ULONG64 AllocationBase;\r\n ULONG32 AllocationProtect;\r\n ULONG32 __alignment1;\r\n ULONG64 RegionSize;\r\n ULONG32 State;\r\n ULONG32 Protect;\r\n ULONG32 Type;\r\n ULONG32 __alignment2;\r\n} MINIDUMP_MEMORY_INFO, *PMINIDUMP_MEMORY_INFO;\r\n\r\ntypedef struct _MINIDUMP_MEMORY_INFO_LIST\r\n{\r\n ULONG SizeOfHeader;\r\n ULONG SizeOfEntry;\r\n ULONG64 NumberOfEntries;\r\n} MINIDUMP_MEMORY_INFO_LIST, *PMINIDUMP_MEMORY_INFO_LIST;\r\n\r\n\r\n//\r\n// The memory information stream contains memory region\r\n// description information. This stream corresponds to\r\n// what VirtualQuery would return for the process the\r\n// dump was created for.\r\n//\r\n\r\n// Thread dump writer status flags.\r\n#define MINIDUMP_THREAD_INFO_ERROR_THREAD 0x00000001\r\n#define MINIDUMP_THREAD_INFO_WRITING_THREAD 0x00000002\r\n#define MINIDUMP_THREAD_INFO_EXITED_THREAD 0x00000004\r\n#define MINIDUMP_THREAD_INFO_INVALID_INFO 0x00000008\r\n#define MINIDUMP_THREAD_INFO_INVALID_CONTEXT 0x00000010\r\n#define MINIDUMP_THREAD_INFO_INVALID_TEB 0x00000020\r\n\r\ntypedef struct _MINIDUMP_THREAD_INFO\r\n{\r\n ULONG32 ThreadId;\r\n ULONG32 DumpFlags;\r\n ULONG32 DumpError;\r\n ULONG32 ExitStatus;\r\n ULONG64 CreateTime;\r\n ULONG64 ExitTime;\r\n ULONG64 KernelTime;\r\n ULONG64 UserTime;\r\n ULONG64 StartAddress;\r\n ULONG64 Affinity;\r\n} MINIDUMP_THREAD_INFO, *PMINIDUMP_THREAD_INFO;\r\n\r\ntypedef struct _MINIDUMP_THREAD_INFO_LIST\r\n{\r\n ULONG SizeOfHeader;\r\n ULONG SizeOfEntry;\r\n ULONG NumberOfEntries;\r\n} MINIDUMP_THREAD_INFO_LIST, *PMINIDUMP_THREAD_INFO_LIST;\r\n\r\n//\r\n// Support for token information.\r\n//\r\ntypedef struct _MINIDUMP_TOKEN_INFO_HEADER\r\n{\r\n ULONG TokenSize; // The size of the token structure.\r\n ULONG TokenId; // The PID in NtOpenProcessToken() call or TID in NtOpenThreadToken() call.\r\n ULONG64 TokenHandle; // The handle value returned.\r\n} MINIDUMP_TOKEN_INFO_HEADER, *PMINIDUMP_TOKEN_INFO_HEADER;\r\n\r\ntypedef struct _MINIDUMP_TOKEN_INFO_LIST\r\n{\r\n ULONG TokenListSize;\r\n ULONG TokenListEntries;\r\n ULONG ListHeaderSize;\r\n ULONG ElementHeaderSize;\r\n} MINIDUMP_TOKEN_INFO_LIST, *PMINIDUMP_TOKEN_INFO_LIST;\r\n\r\n//\r\n// Support for arbitrary user-defined information.\r\n//\r\n\r\ntypedef struct _MINIDUMP_USER_RECORD\r\n{\r\n ULONG32 Type;\r\n MINIDUMP_LOCATION_DESCRIPTOR Memory;\r\n} MINIDUMP_USER_RECORD, *PMINIDUMP_USER_RECORD;\r\n\r\n\r\ntypedef struct _MINIDUMP_USER_STREAM\r\n{\r\n ULONG32 Type;\r\n ULONG BufferSize;\r\n PVOID Buffer;\r\n\r\n} MINIDUMP_USER_STREAM, *PMINIDUMP_USER_STREAM;\r\n\r\n\r\ntypedef struct _MINIDUMP_USER_STREAM_INFORMATION\r\n{\r\n ULONG UserStreamCount;\r\n PMINIDUMP_USER_STREAM UserStreamArray;\r\n} MINIDUMP_USER_STREAM_INFORMATION, *PMINIDUMP_USER_STREAM_INFORMATION;\r\n\r\n//\r\n// Callback support.\r\n//\r\n\r\ntypedef enum _MINIDUMP_CALLBACK_TYPE\r\n{\r\n ModuleCallback,\r\n ThreadCallback,\r\n ThreadExCallback,\r\n IncludeThreadCallback,\r\n IncludeModuleCallback,\r\n MemoryCallback,\r\n CancelCallback,\r\n WriteKernelMinidumpCallback,\r\n KernelMinidumpStatusCallback,\r\n RemoveMemoryCallback,\r\n IncludeVmRegionCallback,\r\n IoStartCallback,\r\n IoWriteAllCallback,\r\n IoFinishCallback,\r\n ReadMemoryFailureCallback,\r\n SecondaryFlagsCallback,\r\n} MINIDUMP_CALLBACK_TYPE;\r\n\r\n\r\ntypedef struct _MINIDUMP_THREAD_CALLBACK\r\n{\r\n ULONG ThreadId;\r\n HANDLE ThreadHandle;\r\n CONTEXT Context;\r\n ULONG SizeOfContext;\r\n ULONG64 StackBase;\r\n ULONG64 StackEnd;\r\n} MINIDUMP_THREAD_CALLBACK, *PMINIDUMP_THREAD_CALLBACK;\r\n\r\n\r\ntypedef struct _MINIDUMP_THREAD_EX_CALLBACK\r\n{\r\n ULONG ThreadId;\r\n HANDLE ThreadHandle;\r\n CONTEXT Context;\r\n ULONG SizeOfContext;\r\n ULONG64 StackBase;\r\n ULONG64 StackEnd;\r\n ULONG64 BackingStoreBase;\r\n ULONG64 BackingStoreEnd;\r\n} MINIDUMP_THREAD_EX_CALLBACK, *PMINIDUMP_THREAD_EX_CALLBACK;\r\n\r\n\r\ntypedef struct _MINIDUMP_INCLUDE_THREAD_CALLBACK\r\n{\r\n ULONG ThreadId;\r\n} MINIDUMP_INCLUDE_THREAD_CALLBACK, *PMINIDUMP_INCLUDE_THREAD_CALLBACK;\r\n\r\n\r\ntypedef enum _THREAD_WRITE_FLAGS\r\n{\r\n ThreadWriteThread = 0x0001,\r\n ThreadWriteStack = 0x0002,\r\n ThreadWriteContext = 0x0004,\r\n ThreadWriteBackingStore = 0x0008,\r\n ThreadWriteInstructionWindow = 0x0010,\r\n ThreadWriteThreadData = 0x0020,\r\n ThreadWriteThreadInfo = 0x0040,\r\n} THREAD_WRITE_FLAGS;\r\n\r\ntypedef struct _MINIDUMP_MODULE_CALLBACK\r\n{\r\n PWCHAR FullPath;\r\n ULONG64 BaseOfImage;\r\n ULONG SizeOfImage;\r\n ULONG CheckSum;\r\n ULONG TimeDateStamp;\r\n VS_FIXEDFILEINFO VersionInfo;\r\n PVOID CvRecord;\r\n ULONG SizeOfCvRecord;\r\n PVOID MiscRecord;\r\n ULONG SizeOfMiscRecord;\r\n} MINIDUMP_MODULE_CALLBACK, *PMINIDUMP_MODULE_CALLBACK;\r\n\r\n\r\ntypedef struct _MINIDUMP_INCLUDE_MODULE_CALLBACK\r\n{\r\n ULONG64 BaseOfImage;\r\n} MINIDUMP_INCLUDE_MODULE_CALLBACK, *PMINIDUMP_INCLUDE_MODULE_CALLBACK;\r\n\r\n\r\ntypedef enum _MODULE_WRITE_FLAGS\r\n{\r\n ModuleWriteModule = 0x0001,\r\n ModuleWriteDataSeg = 0x0002,\r\n ModuleWriteMiscRecord = 0x0004,\r\n ModuleWriteCvRecord = 0x0008,\r\n ModuleReferencedByMemory = 0x0010,\r\n ModuleWriteTlsData = 0x0020,\r\n ModuleWriteCodeSegs = 0x0040,\r\n} MODULE_WRITE_FLAGS;\r\n\r\n\r\ntypedef struct _MINIDUMP_IO_CALLBACK\r\n{\r\n HANDLE Handle;\r\n ULONG64 Offset;\r\n PVOID Buffer;\r\n ULONG BufferBytes;\r\n} MINIDUMP_IO_CALLBACK, *PMINIDUMP_IO_CALLBACK;\r\n\r\n\r\ntypedef struct _MINIDUMP_READ_MEMORY_FAILURE_CALLBACK\r\n{\r\n ULONG64 Offset;\r\n ULONG Bytes;\r\n HRESULT FailureStatus;\r\n} MINIDUMP_READ_MEMORY_FAILURE_CALLBACK,\r\n*PMINIDUMP_READ_MEMORY_FAILURE_CALLBACK;\r\n\r\n\r\ntypedef struct _MINIDUMP_CALLBACK_INPUT\r\n{\r\n ULONG ProcessId;\r\n HANDLE ProcessHandle;\r\n ULONG CallbackType;\r\n union\r\n {\r\n HRESULT Status;\r\n MINIDUMP_THREAD_CALLBACK Thread;\r\n MINIDUMP_THREAD_EX_CALLBACK ThreadEx;\r\n MINIDUMP_MODULE_CALLBACK Module;\r\n MINIDUMP_INCLUDE_THREAD_CALLBACK IncludeThread;\r\n MINIDUMP_INCLUDE_MODULE_CALLBACK IncludeModule;\r\n MINIDUMP_IO_CALLBACK Io;\r\n MINIDUMP_READ_MEMORY_FAILURE_CALLBACK ReadMemoryFailure;\r\n ULONG SecondaryFlags;\r\n };\r\n} MINIDUMP_CALLBACK_INPUT, *PMINIDUMP_CALLBACK_INPUT;\r\n\r\ntypedef struct _MINIDUMP_CALLBACK_OUTPUT\r\n{\r\n union\r\n {\r\n ULONG ModuleWriteFlags;\r\n ULONG ThreadWriteFlags;\r\n ULONG SecondaryFlags;\r\n struct\r\n {\r\n ULONG64 MemoryBase;\r\n ULONG MemorySize;\r\n };\r\n struct\r\n {\r\n BOOL CheckCancel;\r\n BOOL Cancel;\r\n };\r\n HANDLE Handle;\r\n struct\r\n {\r\n MINIDUMP_MEMORY_INFO VmRegion;\r\n BOOL Continue;\r\n };\r\n HRESULT Status;\r\n };\r\n} MINIDUMP_CALLBACK_OUTPUT, *PMINIDUMP_CALLBACK_OUTPUT;\r\n\r\n\r\n//\r\n// A normal minidump contains just the information\r\n// necessary to capture stack traces for all of the\r\n// existing threads in a process.\r\n//\r\n// A minidump with data segments includes all of the data\r\n// sections from loaded modules in order to capture\r\n// global variable contents. This can make the dump much\r\n// larger if many modules have global data.\r\n//\r\n// A minidump with full memory includes all of the accessible\r\n// memory in the process and can be very large. A minidump\r\n// with full memory always has the raw memory data at the end\r\n// of the dump so that the initial structures in the dump can\r\n// be mapped directly without having to include the raw\r\n// memory information.\r\n//\r\n// Stack and backing store memory can be filtered to remove\r\n// data unnecessary for stack walking. This can improve\r\n// compression of stacks and also deletes data that may\r\n// be private and should not be stored in a dump.\r\n// Memory can also be scanned to see what modules are\r\n// referenced by stack and backing store memory to allow\r\n// omission of other modules to reduce dump size.\r\n// In either of these modes the ModuleReferencedByMemory flag\r\n// is set for all modules referenced before the base\r\n// module callbacks occur.\r\n//\r\n// On some operating systems a list of modules that were\r\n// recently unloaded is kept in addition to the currently\r\n// loaded module list. This information can be saved in\r\n// the dump if desired.\r\n//\r\n// Stack and backing store memory can be scanned for referenced\r\n// pages in order to pick up data referenced by locals or other\r\n// stack memory. This can increase the size of a dump significantly.\r\n//\r\n// Module paths may contain undesired information such as user names\r\n// or other important directory names so they can be stripped. This\r\n// option reduces the ability to locate the proper image later\r\n// and should only be used in certain situations.\r\n//\r\n// Complete operating system per-process and per-thread information can\r\n// be gathered and stored in the dump.\r\n//\r\n// The virtual address space can be scanned for various types\r\n// of memory to be included in the dump.\r\n//\r\n// Code which is concerned with potentially private information\r\n// getting into the minidump can set a flag that automatically\r\n// modifies all existing and future flags to avoid placing\r\n// unnecessary data in the dump. Basic data, such as stack\r\n// information, will still be included but optional data, such\r\n// as indirect memory, will not.\r\n//\r\n// When doing a full memory dump it's possible to store all\r\n// of the enumerated memory region descriptive information\r\n// in a memory information stream.\r\n//\r\n// Additional thread information beyond the basic thread\r\n// structure can be collected if desired.\r\n//\r\n// A minidump with code segments includes all of the code\r\n// and code-related sections from loaded modules in order\r\n// to capture executable content.\r\n//\r\n// MiniDumpWithoutAuxiliaryState turns off any secondary,\r\n// auxiliary-supported memory gathering.\r\n//\r\n// MiniDumpWithFullAuxiliaryState asks any present auxiliary\r\n// data providers to include all of their state in the dump.\r\n// The exact set of what is provided depends on the auxiliary.\r\n// This can be quite large.\r\n//\r\n\r\ntypedef enum _MINIDUMP_TYPE\r\n{\r\n MiniDumpNormal = 0x00000000,\r\n MiniDumpWithDataSegs = 0x00000001,\r\n MiniDumpWithFullMemory = 0x00000002,\r\n MiniDumpWithHandleData = 0x00000004,\r\n MiniDumpFilterMemory = 0x00000008,\r\n MiniDumpScanMemory = 0x00000010,\r\n MiniDumpWithUnloadedModules = 0x00000020,\r\n MiniDumpWithIndirectlyReferencedMemory = 0x00000040,\r\n MiniDumpFilterModulePaths = 0x00000080,\r\n MiniDumpWithProcessThreadData = 0x00000100,\r\n MiniDumpWithPrivateReadWriteMemory = 0x00000200,\r\n MiniDumpWithoutOptionalData = 0x00000400,\r\n MiniDumpWithFullMemoryInfo = 0x00000800,\r\n MiniDumpWithThreadInfo = 0x00001000,\r\n MiniDumpWithCodeSegs = 0x00002000,\r\n MiniDumpWithoutAuxiliaryState = 0x00004000,\r\n MiniDumpWithFullAuxiliaryState = 0x00008000,\r\n MiniDumpWithPrivateWriteCopyMemory = 0x00010000,\r\n MiniDumpIgnoreInaccessibleMemory = 0x00020000,\r\n MiniDumpWithTokenInformation = 0x00040000,\r\n MiniDumpValidTypeFlags = 0x0007ffff,\r\n} MINIDUMP_TYPE;\r\n\r\n//\r\n// In addition to the primary flags provided to\r\n// MiniDumpWriteDump there are additional, less\r\n// frequently used options queried via the secondary\r\n// flags callback.\r\n//\r\n// MiniSecondaryWithoutPowerInfo suppresses the minidump\r\n// query that retrieves processor power information for\r\n// MINIDUMP_MISC_INFO.\r\n//\r\n\r\ntypedef enum _MINIDUMP_SECONDARY_FLAGS\r\n{\r\n MiniSecondaryWithoutPowerInfo = 0x00000001,\r\n\r\n MiniSecondaryValidFlags = 0x00000001,\r\n} MINIDUMP_SECONDARY_FLAGS;\r\n\r\n\r\n//\r\n// The minidump callback should modify the FieldsToWrite parameter to reflect\r\n// what portions of the specified thread or module should be written to the\r\n// file.\r\n//\r\n\r\ntypedef\r\nBOOL\r\n(WINAPI* MINIDUMP_CALLBACK_ROUTINE)(\r\n __inout PVOID CallbackParam,\r\n __in PMINIDUMP_CALLBACK_INPUT CallbackInput,\r\n __inout PMINIDUMP_CALLBACK_OUTPUT CallbackOutput\r\n);\r\n\r\ntypedef struct _MINIDUMP_CALLBACK_INFORMATION\r\n{\r\n MINIDUMP_CALLBACK_ROUTINE CallbackRoutine;\r\n PVOID CallbackParam;\r\n} MINIDUMP_CALLBACK_INFORMATION, *PMINIDUMP_CALLBACK_INFORMATION;\r\n\r\n\r\n\r\n//++\r\n//\r\n// PVOID\r\n// RVA_TO_ADDR(\r\n// PVOID Mapping,\r\n// ULONG Rva\r\n// )\r\n//\r\n// Routine Description:\r\n//\r\n// Map an RVA that is contained within a mapped file to it's associated\r\n// flat address.\r\n//\r\n// Arguments:\r\n//\r\n// Mapping - Base address of mapped file containing the RVA.\r\n//\r\n// Rva - An Rva to fixup.\r\n//\r\n// Return Values:\r\n//\r\n// A pointer to the desired data.\r\n//\r\n//--\r\n\r\n#define RVA_TO_ADDR(Mapping,Rva) ((PVOID)(((ULONG_PTR) (Mapping)) + (Rva)))\r\n\r\nBOOL\r\nWINAPI\r\nMiniDumpWriteDump(\r\n __in HANDLE hProcess,\r\n __in DWORD ProcessId,\r\n __in HANDLE hFile,\r\n __in MINIDUMP_TYPE DumpType,\r\n __in_opt PMINIDUMP_EXCEPTION_INFORMATION ExceptionParam,\r\n __in_opt PMINIDUMP_USER_STREAM_INFORMATION UserStreamParam,\r\n __in_opt PMINIDUMP_CALLBACK_INFORMATION CallbackParam\r\n);\r\n\r\nBOOL\r\nWINAPI\r\nMiniDumpReadDumpStream(\r\n __in PVOID BaseOfDump,\r\n __in ULONG StreamNumber,\r\n __deref_out_opt PMINIDUMP_DIRECTORY* Dir,\r\n __deref_out_opt PVOID* StreamPointer,\r\n __out_opt ULONG* StreamSize\r\n);\r\n\r\n#pragma pack(pop)\r\n\r\n#ifdef __cplusplus\r\n}\r\n#endif\r\n\r\n\r\n#endif // _DBGHELP_\r\n\r\n" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/jansson/jansson.h", "content": "/*\r\n * Copyright (c) 2009-2016 Petri Lehtinen \r\n *\r\n * Jansson is free software; you can redistribute it and/or modify\r\n * it under the terms of the MIT license. See LICENSE for details.\r\n */\r\n\r\n#ifndef JANSSON_H\r\n#define JANSSON_H\r\n\r\n#include \r\n#include /* for size_t */\r\n#include \r\n\r\n#include \"jansson_config.h\"\r\n\r\n#ifdef __cplusplus\r\nextern \"C\" {\r\n#endif\r\n\r\n/* version */\r\n\r\n#define JANSSON_MAJOR_VERSION 2\r\n#define JANSSON_MINOR_VERSION 9\r\n#define JANSSON_MICRO_VERSION 0\r\n\r\n/* Micro version is omitted if it's 0 */\r\n#define JANSSON_VERSION \"2.9\"\r\n\r\n/* Version as a 3-byte hex number, e.g. 0x010201 == 1.2.1. Use this\r\n for numeric comparisons, e.g. #if JANSSON_VERSION_HEX >= ... */\r\n#define JANSSON_VERSION_HEX ((JANSSON_MAJOR_VERSION << 16) | \\\r\n (JANSSON_MINOR_VERSION << 8) | \\\r\n (JANSSON_MICRO_VERSION << 0))\r\n\r\n\r\n/* types */\r\n\r\ntypedef enum\r\n{\r\n JSON_OBJECT,\r\n JSON_ARRAY,\r\n JSON_STRING,\r\n JSON_INTEGER,\r\n JSON_REAL,\r\n JSON_TRUE,\r\n JSON_FALSE,\r\n JSON_NULL\r\n} json_type;\r\n\r\ntypedef struct json_t\r\n{\r\n json_type type;\r\n size_t refcount;\r\n} json_t;\r\n\r\n#ifndef JANSSON_USING_CMAKE /* disabled if using cmake */\r\n#if JSON_INTEGER_IS_LONG_LONG\r\n#ifdef _WIN32\r\n#define JSON_INTEGER_FORMAT \"I64d\"\r\n#else\r\n#define JSON_INTEGER_FORMAT \"lld\"\r\n#endif\r\ntypedef long long json_int_t;\r\n#else\r\n#define JSON_INTEGER_FORMAT \"ld\"\r\ntypedef long json_int_t;\r\n#endif /* JSON_INTEGER_IS_LONG_LONG */\r\n#endif\r\n\r\n#define json_typeof(json) ((json)->type)\r\n#define json_is_object(json) ((json) && json_typeof(json) == JSON_OBJECT)\r\n#define json_is_array(json) ((json) && json_typeof(json) == JSON_ARRAY)\r\n#define json_is_string(json) ((json) && json_typeof(json) == JSON_STRING)\r\n#define json_is_integer(json) ((json) && json_typeof(json) == JSON_INTEGER)\r\n#define json_is_real(json) ((json) && json_typeof(json) == JSON_REAL)\r\n#define json_is_number(json) (json_is_integer(json) || json_is_real(json))\r\n#define json_is_true(json) ((json) && json_typeof(json) == JSON_TRUE)\r\n#define json_is_false(json) ((json) && json_typeof(json) == JSON_FALSE)\r\n#define json_boolean_value json_is_true\r\n#define json_is_boolean(json) (json_is_true(json) || json_is_false(json))\r\n#define json_is_null(json) ((json) && json_typeof(json) == JSON_NULL)\r\n\r\n/* construction, destruction, reference counting */\r\n\r\n__declspec(dllimport) json_t* json_object(void);\r\n__declspec(dllimport) json_t* json_array(void);\r\n__declspec(dllimport) json_t* json_string(const char* value);\r\n__declspec(dllimport) json_t* json_stringn(const char* value, size_t len);\r\n__declspec(dllimport) json_t* json_string_nocheck(const char* value);\r\n__declspec(dllimport) json_t* json_stringn_nocheck(const char* value, size_t len);\r\n__declspec(dllimport) json_t* json_integer(json_int_t value);\r\n__declspec(dllimport) json_t* json_real(double value);\r\n__declspec(dllimport) json_t* json_true(void);\r\n__declspec(dllimport) json_t* json_false(void);\r\n#define json_boolean(val) ((val) ? json_true() : json_false())\r\n__declspec(dllimport) json_t* json_null(void);\r\n\r\nstatic JSON_INLINE\r\njson_t* json_incref(json_t* json)\r\n{\r\n if(json && json->refcount != (size_t) - 1)\r\n ++json->refcount;\r\n return json;\r\n}\r\n\r\n/* do not call json_delete directly */\r\n__declspec(dllimport) void json_delete(json_t* json);\r\n\r\nstatic JSON_INLINE\r\nvoid json_decref(json_t* json)\r\n{\r\n if(json && json->refcount != (size_t) - 1 && --json->refcount == 0)\r\n json_delete(json);\r\n}\r\n\r\n#if defined(__GNUC__) || defined(__clang__)\r\nstatic JSON_INLINE\r\nvoid json_decrefp(json_t** json)\r\n{\r\n if(json)\r\n {\r\n json_decref(*json);\r\n *json = NULL;\r\n }\r\n}\r\n\r\n#define json_auto_t json_t __attribute__((cleanup(json_decrefp)))\r\n#endif\r\n\r\n\r\n/* error reporting */\r\n\r\n#define JSON_ERROR_TEXT_LENGTH 160\r\n#define JSON_ERROR_SOURCE_LENGTH 80\r\n\r\ntypedef struct\r\n{\r\n int line;\r\n int column;\r\n int position;\r\n char source[JSON_ERROR_SOURCE_LENGTH];\r\n char text[JSON_ERROR_TEXT_LENGTH];\r\n} json_error_t;\r\n\r\n\r\n/* getters, setters, manipulation */\r\n\r\n__declspec(dllimport) void json_object_seed(size_t seed);\r\n__declspec(dllimport) size_t json_object_size(const json_t* object);\r\n__declspec(dllimport) json_t* json_object_get(const json_t* object, const char* key);\r\n__declspec(dllimport) int json_object_set_new(json_t* object, const char* key, json_t* value);\r\n__declspec(dllimport) int json_object_set_new_nocheck(json_t* object, const char* key, json_t* value);\r\n__declspec(dllimport) int json_object_del(json_t* object, const char* key);\r\n__declspec(dllimport) int json_object_clear(json_t* object);\r\n__declspec(dllimport) int json_object_update(json_t* object, json_t* other);\r\n__declspec(dllimport) int json_object_update_existing(json_t* object, json_t* other);\r\n__declspec(dllimport) int json_object_update_missing(json_t* object, json_t* other);\r\n__declspec(dllimport) void* json_object_iter(json_t* object);\r\n__declspec(dllimport) void* json_object_iter_at(json_t* object, const char* key);\r\n__declspec(dllimport) void* json_object_key_to_iter(const char* key);\r\n__declspec(dllimport) void* json_object_iter_next(json_t* object, void* iter);\r\n__declspec(dllimport) const char* json_object_iter_key(void* iter);\r\n__declspec(dllimport) json_t* json_object_iter_value(void* iter);\r\n__declspec(dllimport) int json_object_iter_set_new(json_t* object, void* iter, json_t* value);\r\n\r\n#define json_object_foreach(object, key, value) \\\r\n for(key = json_object_iter_key(json_object_iter(object)); \\\r\n key && (value = json_object_iter_value(json_object_key_to_iter(key))); \\\r\n key = json_object_iter_key(json_object_iter_next(object, json_object_key_to_iter(key))))\r\n\r\n#define json_object_foreach_safe(object, n, key, value) \\\r\n for(key = json_object_iter_key(json_object_iter(object)), \\\r\n n = json_object_iter_next(object, json_object_key_to_iter(key)); \\\r\n key && (value = json_object_iter_value(json_object_key_to_iter(key))); \\\r\n key = json_object_iter_key(n), \\\r\n n = json_object_iter_next(object, json_object_key_to_iter(key)))\r\n\r\n#define json_array_foreach(array, index, value) \\\r\n for(index = 0; \\\r\n index < json_array_size(array) && (value = json_array_get(array, index)); \\\r\n index++)\r\n\r\nstatic JSON_INLINE\r\nint json_object_set(json_t* object, const char* key, json_t* value)\r\n{\r\n return json_object_set_new(object, key, json_incref(value));\r\n}\r\n\r\nstatic JSON_INLINE\r\nint json_object_set_nocheck(json_t* object, const char* key, json_t* value)\r\n{\r\n return json_object_set_new_nocheck(object, key, json_incref(value));\r\n}\r\n\r\nstatic JSON_INLINE\r\nint json_object_iter_set(json_t* object, void* iter, json_t* value)\r\n{\r\n return json_object_iter_set_new(object, iter, json_incref(value));\r\n}\r\n\r\n__declspec(dllimport) size_t json_array_size(const json_t* array);\r\n__declspec(dllimport) json_t* json_array_get(const json_t* array, size_t index);\r\n__declspec(dllimport) int json_array_set_new(json_t* array, size_t index, json_t* value);\r\n__declspec(dllimport) int json_array_append_new(json_t* array, json_t* value);\r\n__declspec(dllimport) int json_array_insert_new(json_t* array, size_t index, json_t* value);\r\n__declspec(dllimport) int json_array_remove(json_t* array, size_t index);\r\n__declspec(dllimport) int json_array_clear(json_t* array);\r\n__declspec(dllimport) int json_array_extend(json_t* array, json_t* other);\r\n\r\nstatic JSON_INLINE\r\nint json_array_set(json_t* array, size_t ind, json_t* value)\r\n{\r\n return json_array_set_new(array, ind, json_incref(value));\r\n}\r\n\r\nstatic JSON_INLINE\r\nint json_array_append(json_t* array, json_t* value)\r\n{\r\n return json_array_append_new(array, json_incref(value));\r\n}\r\n\r\nstatic JSON_INLINE\r\nint json_array_insert(json_t* array, size_t ind, json_t* value)\r\n{\r\n return json_array_insert_new(array, ind, json_incref(value));\r\n}\r\n\r\n__declspec(dllimport) const char* json_string_value(const json_t* string);\r\n__declspec(dllimport) size_t json_string_length(const json_t* string);\r\n__declspec(dllimport) json_int_t json_integer_value(const json_t* integer);\r\n__declspec(dllimport) double json_real_value(const json_t* real);\r\n__declspec(dllimport) double json_number_value(const json_t* json);\r\n\r\n__declspec(dllimport) int json_string_set(json_t* string, const char* value);\r\n__declspec(dllimport) int json_string_setn(json_t* string, const char* value, size_t len);\r\n__declspec(dllimport) int json_string_set_nocheck(json_t* string, const char* value);\r\n__declspec(dllimport) int json_string_setn_nocheck(json_t* string, const char* value, size_t len);\r\n__declspec(dllimport) int json_integer_set(json_t* integer, json_int_t value);\r\n__declspec(dllimport) int json_real_set(json_t* real, double value);\r\n\r\n/* pack, unpack */\r\n\r\n__declspec(dllimport) json_t* json_pack(const char* fmt, ...);\r\n__declspec(dllimport) json_t* json_pack_ex(json_error_t* error, size_t flags, const char* fmt, ...);\r\n__declspec(dllimport) json_t* json_vpack_ex(json_error_t* error, size_t flags, const char* fmt, va_list ap);\r\n\r\n#define JSON_VALIDATE_ONLY 0x1\r\n#define JSON_STRICT 0x2\r\n\r\n__declspec(dllimport) int json_unpack(json_t* root, const char* fmt, ...);\r\n__declspec(dllimport) int json_unpack_ex(json_t* root, json_error_t* error, size_t flags, const char* fmt, ...);\r\n__declspec(dllimport) int json_vunpack_ex(json_t* root, json_error_t* error, size_t flags, const char* fmt, va_list ap);\r\n\r\n\r\n/* equality */\r\n\r\n__declspec(dllimport) int json_equal(json_t* value1, json_t* value2);\r\n\r\n\r\n/* copying */\r\n\r\n__declspec(dllimport) json_t* json_copy(json_t* value);\r\n__declspec(dllimport) json_t* json_deep_copy(const json_t* value);\r\n\r\n\r\n/* decoding */\r\n\r\n#define JSON_REJECT_DUPLICATES 0x1\r\n#define JSON_DISABLE_EOF_CHECK 0x2\r\n#define JSON_DECODE_ANY 0x4\r\n#define JSON_DECODE_INT_AS_REAL 0x8\r\n#define JSON_ALLOW_NUL 0x10\r\n\r\ntypedef size_t (*json_load_callback_t)(void* buffer, size_t buflen, void* data);\r\n\r\n__declspec(dllimport) json_t* json_loads(const char* input, size_t flags, json_error_t* error);\r\n__declspec(dllimport) json_t* json_loadb(const char* buffer, size_t buflen, size_t flags, json_error_t* error);\r\n__declspec(dllimport) json_t* json_loadf(FILE* input, size_t flags, json_error_t* error);\r\n__declspec(dllimport) json_t* json_load_file(const char* path, size_t flags, json_error_t* error);\r\n__declspec(dllimport) json_t* json_load_callback(json_load_callback_t callback, void* data, size_t flags, json_error_t* error);\r\n\r\n\r\n/* encoding */\r\n\r\n#define JSON_MAX_INDENT 0x1F\r\n#define JSON_INDENT(n) ((n) & JSON_MAX_INDENT)\r\n#define JSON_COMPACT 0x20\r\n#define JSON_ENSURE_ASCII 0x40\r\n#define JSON_SORT_KEYS 0x80\r\n#define JSON_PRESERVE_ORDER 0x100\r\n#define JSON_ENCODE_ANY 0x200\r\n#define JSON_ESCAPE_SLASH 0x400\r\n#define JSON_REAL_PRECISION(n) (((n) & 0x1F) << 11)\r\n\r\ntypedef int (*json_dump_callback_t)(const char* buffer, size_t size, void* data);\r\n\r\n__declspec(dllimport) char* json_dumps(const json_t* json, size_t flags);\r\n__declspec(dllimport) int json_dumpf(const json_t* json, FILE* output, size_t flags);\r\n__declspec(dllimport) int json_dump_file(const json_t* json, const char* path, size_t flags);\r\n__declspec(dllimport) int json_dump_callback(const json_t* json, json_dump_callback_t callback, void* data, size_t flags);\r\n\r\n/* custom memory allocation */\r\n\r\ntypedef void* (*json_malloc_t)(size_t);\r\ntypedef void (*json_free_t)(void*);\r\n\r\n__declspec(dllimport) void json_set_alloc_funcs(json_malloc_t malloc_fn, json_free_t free_fn);\r\n__declspec(dllimport) void json_get_alloc_funcs(json_malloc_t* malloc_fn, json_free_t* free_fn);\r\n\r\n#ifdef __cplusplus\r\n}\r\n#endif\r\n\r\n#endif\r\n" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/jansson/jansson_config.h", "content": "/*\r\n * Copyright (c) 2010-2016 Petri Lehtinen \r\n *\r\n * Jansson is free software; you can redistribute it and/or modify\r\n * it under the terms of the MIT license. See LICENSE for details.\r\n *\r\n *\r\n * This file specifies a part of the site-specific configuration for\r\n * Jansson, namely those things that affect the public API in\r\n * jansson.h.\r\n *\r\n * The CMake system will generate the jansson_config.h file and\r\n * copy it to the build and install directories.\r\n */\r\n\r\n#ifndef JANSSON_CONFIG_H\r\n#define JANSSON_CONFIG_H\r\n\r\n/* Define this so that we can disable scattered automake configuration in source files */\r\n#ifndef JANSSON_USING_CMAKE\r\n#define JANSSON_USING_CMAKE\r\n#endif\r\n\r\n/* Note: when using cmake, JSON_INTEGER_IS_LONG_LONG is not defined nor used,\r\n * as we will also check for __int64 etc types.\r\n * (the definition was used in the automake system) */\r\n\r\n/* Bring in the cmake-detected defines */\r\n#define HAVE_STDINT_H 1\r\n/* #undef HAVE_INTTYPES_H */\r\n/* #undef HAVE_SYS_TYPES_H */\r\n\r\n/* Include our standard type header for the integer typedef */\r\n\r\n#if defined(HAVE_STDINT_H)\r\n# include \r\n#elif defined(HAVE_INTTYPES_H)\r\n# include \r\n#elif defined(HAVE_SYS_TYPES_H)\r\n# include \r\n#endif\r\n\r\n\r\n/* If your compiler supports the inline keyword in C, JSON_INLINE is\r\n defined to `inline', otherwise empty. In C++, the inline is always\r\n supported. */\r\n#ifdef __cplusplus\r\n#define JSON_INLINE inline\r\n#else\r\n#define JSON_INLINE __inline\r\n#endif\r\n\r\n\r\n#define json_int_t long long\r\n#define json_strtoint strtoll\r\n#define JSON_INTEGER_FORMAT \"I64d\"\r\n\r\n\r\n/* If locale.h and localeconv() are available, define to 1, otherwise to 0. */\r\n#define JSON_HAVE_LOCALECONV 1\r\n\r\n\r\n/* Maximum recursion depth for parsing JSON input.\r\n This limits the depth of e.g. array-within-array constructions. */\r\n#define JSON_PARSER_MAX_DEPTH 2048\r\n\r\n\r\n#endif\r\n" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/jansson/jansson_x64dbg.h", "content": "#pragma once\r\n\r\n#include \"jansson.h\"\r\n\r\ntypedef json_t* JSON;\r\n\r\nstatic JSON_INLINE\r\njson_t* json_hex(unsigned json_int_t value)\r\n{\r\n char hexvalue[20];\r\n sprintf_s(hexvalue, \"0x%llX\", value);\r\n return json_string(hexvalue);\r\n}\r\n\r\nstatic JSON_INLINE\r\nunsigned json_int_t json_hex_value(const json_t* hex)\r\n{\r\n unsigned json_int_t ret = 0;\r\n const char* hexvalue;\r\n hexvalue = json_string_value(hex);\r\n if(!hexvalue)\r\n return 0;\r\n sscanf_s(hexvalue, \"0x%llX\", &ret);\r\n return ret;\r\n}\r\n" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/lz4/lz4.h", "content": "/*\r\n LZ4 - Fast LZ compression algorithm\r\n Header File\r\n Copyright (C) 2011-2014, Yann Collet.\r\n BSD 2-Clause License (http://www.opensource.org/licenses/bsd-license.php)\r\n\r\n Redistribution and use in source and binary forms, with or without\r\n modification, are permitted provided that the following conditions are\r\n met:\r\n\r\n * Redistributions of source code must retain the above copyright\r\n notice, this list of conditions and the following disclaimer.\r\n * Redistributions in binary form must reproduce the above\r\n copyright notice, this list of conditions and the following disclaimer\r\n in the documentation and/or other materials provided with the\r\n distribution.\r\n\r\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\r\n \"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\r\n LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\r\n A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\r\n OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\r\n SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\r\n LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\r\n DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\r\n THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\r\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\r\n OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\r\n\r\n You can contact the author at :\r\n - LZ4 homepage : http://fastcompression.blogspot.com/p/lz4.html\r\n - LZ4 source repository : http://code.google.com/p/lz4/\r\n*/\r\n#ifndef _LZ4_H\r\n#define _LZ4_H\r\n\r\n#if defined (__cplusplus)\r\nextern \"C\"\r\n{\r\n#endif\r\n\r\n\r\n/**************************************\r\n Version\r\n**************************************/\r\n#define LZ4_VERSION_MAJOR 1 /* for major interface/format changes */\r\n#define LZ4_VERSION_MINOR 1 /* for minor interface/format changes */\r\n#define LZ4_VERSION_RELEASE 3 /* for tweaks, bug-fixes, or development */\r\n\r\n\r\n/**************************************\r\n Compiler Options\r\n**************************************/\r\n#if (defined(__GNUC__) && defined(__STRICT_ANSI__)) || (defined(_MSC_VER) && !defined(__cplusplus)) /* Visual Studio */\r\n# define inline __inline /* Visual C is not C99, but supports some kind of inline */\r\n#endif\r\n\r\n\r\n/**************************************\r\n Simple Functions\r\n**************************************/\r\n\r\n__declspec(dllimport) int LZ4_compress(const char* source, char* dest, int inputSize);\r\n__declspec(dllimport) int LZ4_decompress_safe(const char* source, char* dest, int inputSize, int maxOutputSize);\r\n\r\n/*\r\nLZ4_compress() :\r\n Compresses 'inputSize' bytes from 'source' into 'dest'.\r\n Destination buffer must be already allocated,\r\n and must be sized to handle worst cases situations (input data not compressible)\r\n Worst case size evaluation is provided by function LZ4_compressBound()\r\n inputSize : Max supported value is LZ4_MAX_INPUT_VALUE\r\n return : the number of bytes written in buffer dest\r\n or 0 if the compression fails\r\n\r\nLZ4_decompress_safe() :\r\n maxOutputSize : is the size of the destination buffer (which must be already allocated)\r\n return : the number of bytes decoded in the destination buffer (necessarily <= maxOutputSize)\r\n If the source stream is detected malformed, the function will stop decoding and return a negative result.\r\n This function is protected against buffer overflow exploits (never writes outside of output buffer, and never reads outside of input buffer). Therefore, it is protected against malicious data packets\r\n*/\r\n\r\n\r\n/**************************************\r\n Advanced Functions\r\n**************************************/\r\n#define LZ4_MAX_INPUT_SIZE 0x7E000000 /* 2 113 929 216 bytes */\r\n#define LZ4_COMPRESSBOUND(isize) ((unsigned int)(isize) > (unsigned int)LZ4_MAX_INPUT_SIZE ? 0 : (isize) + ((isize)/255) + 16)\r\n\r\n/*\r\nLZ4_compressBound() :\r\n Provides the maximum size that LZ4 may output in a \"worst case\" scenario (input data not compressible)\r\n primarily useful for memory allocation of output buffer.\r\n inline function is recommended for the general case,\r\n macro is also provided when result needs to be evaluated at compilation (such as stack memory allocation).\r\n\r\n isize : is the input size. Max supported value is LZ4_MAX_INPUT_SIZE\r\n return : maximum output size in a \"worst case\" scenario\r\n or 0, if input size is too large ( > LZ4_MAX_INPUT_SIZE)\r\n*/\r\n__declspec(dllimport) int LZ4_compressBound(int isize);\r\n\r\n\r\n/*\r\nLZ4_compress_limitedOutput() :\r\n Compress 'inputSize' bytes from 'source' into an output buffer 'dest' of maximum size 'maxOutputSize'.\r\n If it cannot achieve it, compression will stop, and result of the function will be zero.\r\n This function never writes outside of provided output buffer.\r\n\r\n inputSize : Max supported value is LZ4_MAX_INPUT_VALUE\r\n maxOutputSize : is the size of the destination buffer (which must be already allocated)\r\n return : the number of bytes written in buffer 'dest'\r\n or 0 if the compression fails\r\n*/\r\n__declspec(dllimport) int LZ4_compress_limitedOutput(const char* source, char* dest, int inputSize, int maxOutputSize);\r\n\r\n\r\n/*\r\nLZ4_decompress_fast() :\r\n originalSize : is the original and therefore uncompressed size\r\n return : the number of bytes read from the source buffer (in other words, the compressed size)\r\n If the source stream is malformed, the function will stop decoding and return a negative result.\r\n note : This function is a bit faster than LZ4_decompress_safe()\r\n This function never writes outside of output buffers, but may read beyond input buffer in case of malicious data packet.\r\n Use this function preferably into a trusted environment (data to decode comes from a trusted source).\r\n Destination buffer must be already allocated. Its size must be a minimum of 'outputSize' bytes.\r\n*/\r\n__declspec(dllimport) int LZ4_decompress_fast(const char* source, char* dest, int originalSize);\r\n\r\n\r\n/*\r\nLZ4_decompress_safe_partial() :\r\n This function decompress a compressed block of size 'inputSize' at position 'source'\r\n into output buffer 'dest' of size 'maxOutputSize'.\r\n The function tries to stop decompressing operation as soon as 'targetOutputSize' has been reached,\r\n reducing decompression time.\r\n return : the number of bytes decoded in the destination buffer (necessarily <= maxOutputSize)\r\n Note : this number can be < 'targetOutputSize' should the compressed block to decode be smaller.\r\n Always control how many bytes were decoded.\r\n If the source stream is detected malformed, the function will stop decoding and return a negative result.\r\n This function never writes outside of output buffer, and never reads outside of input buffer. It is therefore protected against malicious data packets\r\n*/\r\n__declspec(dllimport) int LZ4_decompress_safe_partial(const char* source, char* dest, int inputSize, int targetOutputSize, int maxOutputSize);\r\n\r\n\r\n/*\r\nThese functions are provided should you prefer to allocate memory for compression tables with your own allocation methods.\r\nTo know how much memory must be allocated for the compression tables, use :\r\nint LZ4_sizeofState();\r\n\r\nNote that tables must be aligned on 4-bytes boundaries, otherwise compression will fail (return code 0).\r\n\r\nThe allocated memory can be provided to the compressions functions using 'void* state' parameter.\r\nLZ4_compress_withState() and LZ4_compress_limitedOutput_withState() are equivalent to previously described functions.\r\nThey just use the externally allocated memory area instead of allocating their own (on stack, or on heap).\r\n*/\r\n__declspec(dllimport) int LZ4_sizeofState(void);\r\n__declspec(dllimport) int LZ4_compress_withState(void* state, const char* source, char* dest, int inputSize);\r\n__declspec(dllimport) int LZ4_compress_limitedOutput_withState(void* state, const char* source, char* dest, int inputSize, int maxOutputSize);\r\n\r\n\r\n/**************************************\r\n Streaming Functions\r\n**************************************/\r\n__declspec(dllimport) void* LZ4_create(const char* inputBuffer);\r\n__declspec(dllimport) int LZ4_compress_continue(void* LZ4_Data, const char* source, char* dest, int inputSize);\r\n__declspec(dllimport) int LZ4_compress_limitedOutput_continue(void* LZ4_Data, const char* source, char* dest, int inputSize, int maxOutputSize);\r\n__declspec(dllimport) char* LZ4_slideInputBuffer(void* LZ4_Data);\r\n__declspec(dllimport) int LZ4_free(void* LZ4_Data);\r\n\r\n/*\r\nThese functions allow the compression of dependent blocks, where each block benefits from prior 64 KB within preceding blocks.\r\nIn order to achieve this, it is necessary to start creating the LZ4 Data Structure, thanks to the function :\r\n\r\nvoid* LZ4_create (const char* inputBuffer);\r\nThe result of the function is the (void*) pointer on the LZ4 Data Structure.\r\nThis pointer will be needed in all other functions.\r\nIf the pointer returned is NULL, then the allocation has failed, and compression must be aborted.\r\nThe only parameter 'const char* inputBuffer' must, obviously, point at the beginning of input buffer.\r\nThe input buffer must be already allocated, and size at least 192KB.\r\n'inputBuffer' will also be the 'const char* source' of the first block.\r\n\r\nAll blocks are expected to lay next to each other within the input buffer, starting from 'inputBuffer'.\r\nTo compress each block, use either LZ4_compress_continue() or LZ4_compress_limitedOutput_continue().\r\nTheir behavior are identical to LZ4_compress() or LZ4_compress_limitedOutput(),\r\nbut require the LZ4 Data Structure as their first argument, and check that each block starts right after the previous one.\r\nIf next block does not begin immediately after the previous one, the compression will fail (return 0).\r\n\r\nWhen it's no longer possible to lay the next block after the previous one (not enough space left into input buffer), a call to :\r\nchar* LZ4_slideInputBuffer(void* LZ4_Data);\r\nmust be performed. It will typically copy the latest 64KB of input at the beginning of input buffer.\r\nNote that, for this function to work properly, minimum size of an input buffer must be 192KB.\r\n==> The memory position where the next input data block must start is provided as the result of the function.\r\n\r\nCompression can then resume, using LZ4_compress_continue() or LZ4_compress_limitedOutput_continue(), as usual.\r\n\r\nWhen compression is completed, a call to LZ4_free() will release the memory used by the LZ4 Data Structure.\r\n*/\r\n\r\n\r\n__declspec(dllimport) int LZ4_sizeofStreamState(void);\r\n__declspec(dllimport) int LZ4_resetStreamState(void* state, const char* inputBuffer);\r\n\r\n/*\r\nThese functions achieve the same result as :\r\nvoid* LZ4_create (const char* inputBuffer);\r\n\r\nThey are provided here to allow the user program to allocate memory using its own routines.\r\n\r\nTo know how much space must be allocated, use LZ4_sizeofStreamState();\r\nNote also that space must be 4-bytes aligned.\r\n\r\nOnce space is allocated, you must initialize it using : LZ4_resetStreamState(void* state, const char* inputBuffer);\r\nvoid* state is a pointer to the space allocated.\r\nIt must be aligned on 4-bytes boundaries, and be large enough.\r\nThe parameter 'const char* inputBuffer' must, obviously, point at the beginning of input buffer.\r\nThe input buffer must be already allocated, and size at least 192KB.\r\n'inputBuffer' will also be the 'const char* source' of the first block.\r\n\r\nThe same space can be re-used multiple times, just by initializing it each time with LZ4_resetStreamState().\r\nreturn value of LZ4_resetStreamState() must be 0 is OK.\r\nAny other value means there was an error (typically, pointer is not aligned on 4-bytes boundaries).\r\n*/\r\n\r\n\r\n__declspec(dllimport) int LZ4_decompress_safe_withPrefix64k(const char* source, char* dest, int inputSize, int maxOutputSize);\r\n__declspec(dllimport) int LZ4_decompress_fast_withPrefix64k(const char* source, char* dest, int outputSize);\r\n\r\n/*\r\n*_withPrefix64k() :\r\n These decoding functions work the same as their \"normal name\" versions,\r\n but can use up to 64KB of data in front of 'char* dest'.\r\n These functions are necessary to decode inter-dependant blocks.\r\n*/\r\n\r\n\r\n/**************************************\r\n Obsolete Functions\r\n**************************************/\r\n/*\r\nThese functions are deprecated and should no longer be used.\r\nThey are provided here for compatibility with existing user programs.\r\n*/\r\n__declspec(dllimport) int LZ4_uncompress(const char* source, char* dest, int outputSize);\r\n__declspec(dllimport) int LZ4_uncompress_unknownOutputSize(const char* source, char* dest, int isize, int maxOutputSize);\r\n\r\n\r\n#if defined (__cplusplus)\r\n}\r\n#endif\r\n\r\n#endif //_LZ4_H" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/lz4/lz4file.h", "content": "#ifndef _LZ4FILE_H\r\n#define _LZ4FILE_H\r\n\r\ntypedef enum _LZ4_STATUS\r\n{\r\n LZ4_SUCCESS,\r\n LZ4_FAILED_OPEN_INPUT,\r\n LZ4_FAILED_OPEN_OUTPUT,\r\n LZ4_NOT_ENOUGH_MEMORY,\r\n LZ4_INVALID_ARCHIVE,\r\n LZ4_CORRUPTED_ARCHIVE\r\n} LZ4_STATUS;\r\n\r\n#if defined (__cplusplus)\r\nextern \"C\"\r\n{\r\n#endif\r\n\r\n__declspec(dllimport) LZ4_STATUS LZ4_compress_file(const char* input_filename, const char* output_filename);\r\n__declspec(dllimport) LZ4_STATUS LZ4_compress_fileW(const wchar_t* input_filename, const wchar_t* output_filename);\r\n__declspec(dllimport) LZ4_STATUS LZ4_decompress_file(const char* input_filename, const char* output_filename);\r\n__declspec(dllimport) LZ4_STATUS LZ4_decompress_fileW(const wchar_t* input_filename, const wchar_t* output_filename);\r\n\r\n#if defined (__cplusplus)\r\n}\r\n#endif\r\n\r\n#endif //_LZ4FILE_H" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/lz4/lz4hc.h", "content": "/*\r\n LZ4 HC - High Compression Mode of LZ4\r\n Header File\r\n Copyright (C) 2011-2014, Yann Collet.\r\n BSD 2-Clause License (http://www.opensource.org/licenses/bsd-license.php)\r\n\r\n Redistribution and use in source and binary forms, with or without\r\n modification, are permitted provided that the following conditions are\r\n met:\r\n\r\n * Redistributions of source code must retain the above copyright\r\n notice, this list of conditions and the following disclaimer.\r\n * Redistributions in binary form must reproduce the above\r\n copyright notice, this list of conditions and the following disclaimer\r\n in the documentation and/or other materials provided with the\r\n distribution.\r\n\r\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\r\n \"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\r\n LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\r\n A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\r\n OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\r\n SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\r\n LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\r\n DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\r\n THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\r\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\r\n OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\r\n\r\n You can contact the author at :\r\n - LZ4 homepage : http://fastcompression.blogspot.com/p/lz4.html\r\n - LZ4 source repository : http://code.google.com/p/lz4/\r\n*/\r\n#ifndef _LZ4HC_H\r\n#define _LZ4HC_H\r\n\r\n#if defined (__cplusplus)\r\nextern \"C\"\r\n{\r\n#endif\r\n\r\n\r\n__declspec(dllimport) int LZ4_compressHC(const char* source, char* dest, int inputSize);\r\n/*\r\nLZ4_compressHC :\r\n return : the number of bytes in compressed buffer dest\r\n or 0 if compression fails.\r\n note : destination buffer must be already allocated.\r\n To avoid any problem, size it to handle worst cases situations (input data not compressible)\r\n Worst case size evaluation is provided by function LZ4_compressBound() (see \"lz4.h\")\r\n*/\r\n\r\n__declspec(dllimport) int LZ4_compressHC_limitedOutput(const char* source, char* dest, int inputSize, int maxOutputSize);\r\n/*\r\nLZ4_compress_limitedOutput() :\r\n Compress 'inputSize' bytes from 'source' into an output buffer 'dest' of maximum size 'maxOutputSize'.\r\n If it cannot achieve it, compression will stop, and result of the function will be zero.\r\n This function never writes outside of provided output buffer.\r\n\r\n inputSize : Max supported value is 1 GB\r\n maxOutputSize : is maximum allowed size into the destination buffer (which must be already allocated)\r\n return : the number of output bytes written in buffer 'dest'\r\n or 0 if compression fails.\r\n*/\r\n\r\n\r\n__declspec(dllimport) int LZ4_compressHC2(const char* source, char* dest, int inputSize, int compressionLevel);\r\n__declspec(dllimport) int LZ4_compressHC2_limitedOutput(const char* source, char* dest, int inputSize, int maxOutputSize, int compressionLevel);\r\n/*\r\n Same functions as above, but with programmable 'compressionLevel'.\r\n Recommended values are between 4 and 9, although any value between 0 and 16 will work.\r\n 'compressionLevel'==0 means use default 'compressionLevel' value.\r\n Values above 16 behave the same as 16.\r\n Equivalent variants exist for all other compression functions below.\r\n*/\r\n\r\n/* Note :\r\nDecompression functions are provided within LZ4 source code (see \"lz4.h\") (BSD license)\r\n*/\r\n\r\n\r\n/**************************************\r\n Using an external allocation\r\n**************************************/\r\n__declspec(dllimport) int LZ4_sizeofStateHC(void);\r\n__declspec(dllimport) int LZ4_compressHC_withStateHC(void* state, const char* source, char* dest, int inputSize);\r\n__declspec(dllimport) int LZ4_compressHC_limitedOutput_withStateHC(void* state, const char* source, char* dest, int inputSize, int maxOutputSize);\r\n\r\n__declspec(dllimport) int LZ4_compressHC2_withStateHC(void* state, const char* source, char* dest, int inputSize, int compressionLevel);\r\n__declspec(dllimport) int LZ4_compressHC2_limitedOutput_withStateHC(void* state, const char* source, char* dest, int inputSize, int maxOutputSize, int compressionLevel);\r\n\r\n/*\r\nThese functions are provided should you prefer to allocate memory for compression tables with your own allocation methods.\r\nTo know how much memory must be allocated for the compression tables, use :\r\nint LZ4_sizeofStateHC();\r\n\r\nNote that tables must be aligned for pointer (32 or 64 bits), otherwise compression will fail (return code 0).\r\n\r\nThe allocated memory can be provided to the compressions functions using 'void* state' parameter.\r\nLZ4_compress_withStateHC() and LZ4_compress_limitedOutput_withStateHC() are equivalent to previously described functions.\r\nThey just use the externally allocated memory area instead of allocating their own (on stack, or on heap).\r\n*/\r\n\r\n\r\n/**************************************\r\n Streaming Functions\r\n**************************************/\r\n__declspec(dllimport) void* LZ4_createHC(const char* inputBuffer);\r\n__declspec(dllimport) int LZ4_compressHC_continue(void* LZ4HC_Data, const char* source, char* dest, int inputSize);\r\n__declspec(dllimport) int LZ4_compressHC_limitedOutput_continue(void* LZ4HC_Data, const char* source, char* dest, int inputSize, int maxOutputSize);\r\n__declspec(dllimport) char* LZ4_slideInputBufferHC(void* LZ4HC_Data);\r\n__declspec(dllimport) int LZ4_freeHC(void* LZ4HC_Data);\r\n\r\n__declspec(dllimport) int LZ4_compressHC2_continue(void* LZ4HC_Data, const char* source, char* dest, int inputSize, int compressionLevel);\r\n__declspec(dllimport) int LZ4_compressHC2_limitedOutput_continue(void* LZ4HC_Data, const char* source, char* dest, int inputSize, int maxOutputSize, int compressionLevel);\r\n\r\n/*\r\nThese functions allow the compression of dependent blocks, where each block benefits from prior 64 KB within preceding blocks.\r\nIn order to achieve this, it is necessary to start creating the LZ4HC Data Structure, thanks to the function :\r\n\r\nvoid* LZ4_createHC (const char* inputBuffer);\r\nThe result of the function is the (void*) pointer on the LZ4HC Data Structure.\r\nThis pointer will be needed in all other functions.\r\nIf the pointer returned is NULL, then the allocation has failed, and compression must be aborted.\r\nThe only parameter 'const char* inputBuffer' must, obviously, point at the beginning of input buffer.\r\nThe input buffer must be already allocated, and size at least 192KB.\r\n'inputBuffer' will also be the 'const char* source' of the first block.\r\n\r\nAll blocks are expected to lay next to each other within the input buffer, starting from 'inputBuffer'.\r\nTo compress each block, use either LZ4_compressHC_continue() or LZ4_compressHC_limitedOutput_continue().\r\nTheir behavior are identical to LZ4_compressHC() or LZ4_compressHC_limitedOutput(),\r\nbut require the LZ4HC Data Structure as their first argument, and check that each block starts right after the previous one.\r\nIf next block does not begin immediately after the previous one, the compression will fail (return 0).\r\n\r\nWhen it's no longer possible to lay the next block after the previous one (not enough space left into input buffer), a call to :\r\nchar* LZ4_slideInputBufferHC(void* LZ4HC_Data);\r\nmust be performed. It will typically copy the latest 64KB of input at the beginning of input buffer.\r\nNote that, for this function to work properly, minimum size of an input buffer must be 192KB.\r\n==> The memory position where the next input data block must start is provided as the result of the function.\r\n\r\nCompression can then resume, using LZ4_compressHC_continue() or LZ4_compressHC_limitedOutput_continue(), as usual.\r\n\r\nWhen compression is completed, a call to LZ4_freeHC() will release the memory used by the LZ4HC Data Structure.\r\n*/\r\n\r\n__declspec(dllimport) int LZ4_sizeofStreamStateHC(void);\r\n__declspec(dllimport) int LZ4_resetStreamStateHC(void* state, const char* inputBuffer);\r\n\r\n/*\r\nThese functions achieve the same result as :\r\nvoid* LZ4_createHC (const char* inputBuffer);\r\n\r\nThey are provided here to allow the user program to allocate memory using its own routines.\r\n\r\nTo know how much space must be allocated, use LZ4_sizeofStreamStateHC();\r\nNote also that space must be aligned for pointers (32 or 64 bits).\r\n\r\nOnce space is allocated, you must initialize it using : LZ4_resetStreamStateHC(void* state, const char* inputBuffer);\r\nvoid* state is a pointer to the space allocated.\r\nIt must be aligned for pointers (32 or 64 bits), and be large enough.\r\nThe parameter 'const char* inputBuffer' must, obviously, point at the beginning of input buffer.\r\nThe input buffer must be already allocated, and size at least 192KB.\r\n'inputBuffer' will also be the 'const char* source' of the first block.\r\n\r\nThe same space can be re-used multiple times, just by initializing it each time with LZ4_resetStreamState().\r\nreturn value of LZ4_resetStreamStateHC() must be 0 is OK.\r\nAny other value means there was an error (typically, state is not aligned for pointers (32 or 64 bits)).\r\n*/\r\n\r\n\r\n#if defined (__cplusplus)\r\n}\r\n#endif\r\n\r\n#endif //_LZ4HC_H\r\n" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara/ahocorasick.h", "content": "/*\r\nCopyright (c) 2013. The YARA Authors. All Rights Reserved.\r\n\r\nRedistribution and use in source and binary forms, with or without modification,\r\nare permitted provided that the following conditions are met:\r\n\r\n1. Redistributions of source code must retain the above copyright notice, this\r\nlist of conditions and the following disclaimer.\r\n\r\n2. Redistributions in binary form must reproduce the above copyright notice,\r\nthis list of conditions and the following disclaimer in the documentation and/or\r\nother materials provided with the distribution.\r\n\r\n3. Neither the name of the copyright holder nor the names of its contributors\r\nmay be used to endorse or promote products derived from this software without\r\nspecific prior written permission.\r\n\r\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\r\nANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\r\nWARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\r\nDISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR\r\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\r\n(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\r\nLOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\r\nANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\r\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\r\nSOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\r\n*/\r\n\r\n#ifndef _AHOCORASICK_H\r\n#define _AHOCORASICK_H\r\n\r\n#include \"limits.h\"\r\n#include \"atoms.h\"\r\n#include \"types.h\"\r\n\r\n\r\n#define YR_AC_ROOT_STATE 0\r\n#define YR_AC_NEXT_STATE(t) (t >> 32)\r\n#define YR_AC_INVALID_TRANSITION(t, c) (((t) & 0xFFFF) != c)\r\n\r\n#define YR_AC_MAKE_TRANSITION(state, code, flags) \\\r\n ((uint64_t)((((uint64_t) state) << 32) | ((flags) << 16) | (code)))\r\n\r\n#define YR_AC_USED_FLAG 0x1\r\n\r\n#define YR_AC_USED_TRANSITION_SLOT(x) ((x) & (YR_AC_USED_FLAG << 16))\r\n#define YR_AC_UNUSED_TRANSITION_SLOT(x) (!YR_AC_USED_TRANSITION_SLOT(x))\r\n\r\n\r\ntypedef struct _YR_AC_TABLES\r\n{\r\n YR_AC_TRANSITION* transitions;\r\n YR_AC_MATCH_TABLE_ENTRY* matches;\r\n\r\n} YR_AC_TABLES;\r\n\r\n\r\nint yr_ac_automaton_create(\r\n YR_AC_AUTOMATON** automaton);\r\n\r\n\r\nint yr_ac_automaton_destroy(\r\n YR_AC_AUTOMATON* automaton);\r\n\r\n\r\nint yr_ac_add_string(\r\n YR_AC_AUTOMATON* automaton,\r\n YR_STRING* string,\r\n YR_ATOM_LIST_ITEM* atom,\r\n YR_ARENA* matches_arena);\r\n\r\n\r\nint yr_ac_compile(\r\n YR_AC_AUTOMATON* automaton,\r\n YR_ARENA* arena,\r\n YR_AC_TABLES* tables);\r\n\r\n\r\nvoid yr_ac_print_automaton(\r\n YR_AC_AUTOMATON* automaton);\r\n\r\n\r\n#endif\r\n" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara/arena.h", "content": "/*\r\nCopyright (c) 2013. The YARA Authors. All Rights Reserved.\r\n\r\nRedistribution and use in source and binary forms, with or without modification,\r\nare permitted provided that the following conditions are met:\r\n\r\n1. Redistributions of source code must retain the above copyright notice, this\r\nlist of conditions and the following disclaimer.\r\n\r\n2. Redistributions in binary form must reproduce the above copyright notice,\r\nthis list of conditions and the following disclaimer in the documentation and/or\r\nother materials provided with the distribution.\r\n\r\n3. Neither the name of the copyright holder nor the names of its contributors\r\nmay be used to endorse or promote products derived from this software without\r\nspecific prior written permission.\r\n\r\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\r\nANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\r\nWARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\r\nDISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR\r\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\r\n(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\r\nLOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\r\nANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\r\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\r\nSOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\r\n*/\r\n\r\n#ifndef YR_ARENA_H\r\n#define YR_ARENA_H\r\n\r\n#include \r\n\r\n#include \"integers.h\"\r\n#include \"stream.h\"\r\n\r\n#define ARENA_FLAGS_FIXED_SIZE 1\r\n#define ARENA_FLAGS_COALESCED 2\r\n#define ARENA_FILE_VERSION ((13 << 16) | MAX_THREADS)\r\n\r\n#define EOL ((size_t) -1)\r\n\r\n\r\ntypedef struct _YR_RELOC\r\n{\r\n uint32_t offset;\r\n struct _YR_RELOC* next;\r\n\r\n} YR_RELOC;\r\n\r\n\r\ntypedef struct _YR_ARENA_PAGE\r\n{\r\n\r\n uint8_t* new_address;\r\n uint8_t* address;\r\n\r\n size_t size;\r\n size_t used;\r\n\r\n YR_RELOC* reloc_list_head;\r\n YR_RELOC* reloc_list_tail;\r\n\r\n struct _YR_ARENA_PAGE* next;\r\n struct _YR_ARENA_PAGE* prev;\r\n\r\n} YR_ARENA_PAGE;\r\n\r\n\r\ntypedef struct _YR_ARENA\r\n{\r\n int flags;\r\n\r\n YR_ARENA_PAGE* page_list_head;\r\n YR_ARENA_PAGE* current_page;\r\n\r\n} YR_ARENA;\r\n\r\n\r\nint yr_arena_create(\r\n size_t initial_size,\r\n int flags,\r\n YR_ARENA** arena);\r\n\r\n\r\nvoid yr_arena_destroy(\r\n YR_ARENA* arena);\r\n\r\n\r\nvoid* yr_arena_base_address(\r\n YR_ARENA* arena);\r\n\r\n\r\nvoid* yr_arena_next_address(\r\n YR_ARENA* arena,\r\n void* address,\r\n size_t offset);\r\n\r\n\r\nint yr_arena_coalesce(\r\n YR_ARENA* arena);\r\n\r\n\r\nint yr_arena_reserve_memory(\r\n YR_ARENA* arena,\r\n size_t size);\r\n\r\n\r\nint yr_arena_allocate_memory(\r\n YR_ARENA* arena,\r\n size_t size,\r\n void** allocated_memory);\r\n\r\n\r\nint yr_arena_allocate_struct(\r\n YR_ARENA* arena,\r\n size_t size,\r\n void** allocated_memory,\r\n ...);\r\n\r\n\r\nint yr_arena_make_relocatable(\r\n YR_ARENA* arena,\r\n void* base,\r\n ...);\r\n\r\n\r\nint yr_arena_write_data(\r\n YR_ARENA* arena,\r\n void* data,\r\n size_t size,\r\n void** written_data);\r\n\r\n\r\nint yr_arena_write_string(\r\n YR_ARENA* arena,\r\n const char* string,\r\n char** written_string);\r\n\r\n\r\nint yr_arena_append(\r\n YR_ARENA* target_arena,\r\n YR_ARENA* source_arena);\r\n\r\n\r\nint yr_arena_load_stream(\r\n YR_STREAM* stream,\r\n YR_ARENA** arena);\r\n\r\n\r\nint yr_arena_save_stream(\r\n YR_ARENA* arena,\r\n YR_STREAM* stream);\r\n\r\n\r\nint yr_arena_duplicate(\r\n YR_ARENA* arena,\r\n YR_ARENA** duplicated);\r\n\r\n\r\nvoid yr_arena_print(\r\n YR_ARENA* arena);\r\n\r\n#endif\r\n" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara/atoms.h", "content": "/*\r\nCopyright (c) 2013. The YARA Authors. All Rights Reserved.\r\n\r\nRedistribution and use in source and binary forms, with or without modification,\r\nare permitted provided that the following conditions are met:\r\n\r\n1. Redistributions of source code must retain the above copyright notice, this\r\nlist of conditions and the following disclaimer.\r\n\r\n2. Redistributions in binary form must reproduce the above copyright notice,\r\nthis list of conditions and the following disclaimer in the documentation and/or\r\nother materials provided with the distribution.\r\n\r\n3. Neither the name of the copyright holder nor the names of its contributors\r\nmay be used to endorse or promote products derived from this software without\r\nspecific prior written permission.\r\n\r\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\r\nANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\r\nWARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\r\nDISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR\r\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\r\n(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\r\nLOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\r\nANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\r\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\r\nSOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\r\n*/\r\n\r\n#ifndef YR_ATOMS_H\r\n#define YR_ATOMS_H\r\n\r\n#include \"limits.h\"\r\n#include \"re.h\"\r\n\r\n#define ATOM_TREE_LEAF 1\r\n#define ATOM_TREE_AND 2\r\n#define ATOM_TREE_OR 3\r\n\r\n\r\ntypedef struct _ATOM_TREE_NODE\r\n{\r\n uint8_t type;\r\n uint8_t atom_length;\r\n uint8_t atom[MAX_ATOM_LENGTH];\r\n\r\n uint8_t* forward_code;\r\n uint8_t* backward_code;\r\n\r\n RE_NODE* recent_nodes[MAX_ATOM_LENGTH];\r\n\r\n struct _ATOM_TREE_NODE* children_head;\r\n struct _ATOM_TREE_NODE* children_tail;\r\n struct _ATOM_TREE_NODE* next_sibling;\r\n\r\n} ATOM_TREE_NODE;\r\n\r\n\r\ntypedef struct _ATOM_TREE\r\n{\r\n ATOM_TREE_NODE* current_leaf;\r\n ATOM_TREE_NODE* root_node;\r\n\r\n} ATOM_TREE;\r\n\r\n\r\ntypedef struct _YR_ATOM_LIST_ITEM\r\n{\r\n uint8_t atom_length;\r\n uint8_t atom[MAX_ATOM_LENGTH];\r\n\r\n uint16_t backtrack;\r\n\r\n uint8_t* forward_code;\r\n uint8_t* backward_code;\r\n\r\n struct _YR_ATOM_LIST_ITEM* next;\r\n\r\n} YR_ATOM_LIST_ITEM;\r\n\r\n\r\nint yr_atoms_extract_from_re(\r\n RE_AST* re_ast,\r\n int flags,\r\n YR_ATOM_LIST_ITEM** atoms);\r\n\r\n\r\nint yr_atoms_extract_from_string(\r\n uint8_t* string,\r\n int string_length,\r\n int flags,\r\n YR_ATOM_LIST_ITEM** atoms);\r\n\r\n\r\nint yr_atoms_min_quality(\r\n YR_ATOM_LIST_ITEM* atom_list);\r\n\r\n\r\nvoid yr_atoms_list_destroy(\r\n YR_ATOM_LIST_ITEM* list_head);\r\n\r\n#endif\r\n" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara/compiler.h", "content": "/*\r\nCopyright (c) 2013. The YARA Authors. All Rights Reserved.\r\n\r\nRedistribution and use in source and binary forms, with or without modification,\r\nare permitted provided that the following conditions are met:\r\n\r\n1. Redistributions of source code must retain the above copyright notice, this\r\nlist of conditions and the following disclaimer.\r\n\r\n2. Redistributions in binary form must reproduce the above copyright notice,\r\nthis list of conditions and the following disclaimer in the documentation and/or\r\nother materials provided with the distribution.\r\n\r\n3. Neither the name of the copyright holder nor the names of its contributors\r\nmay be used to endorse or promote products derived from this software without\r\nspecific prior written permission.\r\n\r\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\r\nANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\r\nWARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\r\nDISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR\r\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\r\n(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\r\nLOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\r\nANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\r\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\r\nSOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\r\n*/\r\n\r\n#ifndef YR_COMPILER_H\r\n#define YR_COMPILER_H\r\n\r\n#include \r\n#include \r\n\r\n#include \"ahocorasick.h\"\r\n#include \"arena.h\"\r\n#include \"hash.h\"\r\n#include \"utils.h\"\r\n#include \"filemap.h\"\r\n\r\n\r\n#define YARA_ERROR_LEVEL_ERROR 0\r\n#define YARA_ERROR_LEVEL_WARNING 1\r\n\r\n\r\ntypedef void (*YR_COMPILER_CALLBACK_FUNC)(\r\n int error_level,\r\n const char* file_name,\r\n int line_number,\r\n const char* message,\r\n void* user_data);\r\n\r\n\r\ntypedef struct _YR_FIXUP\r\n{\r\n void* address;\r\n struct _YR_FIXUP* next;\r\n\r\n} YR_FIXUP;\r\n\r\n\r\ntypedef struct _YR_COMPILER\r\n{\r\n int errors;\r\n int current_line;\r\n int last_error;\r\n int last_error_line;\r\n int last_result;\r\n\r\n jmp_buf error_recovery;\r\n\r\n YR_ARENA* sz_arena;\r\n YR_ARENA* rules_arena;\r\n YR_ARENA* strings_arena;\r\n YR_ARENA* code_arena;\r\n YR_ARENA* re_code_arena;\r\n YR_ARENA* compiled_rules_arena;\r\n YR_ARENA* externals_arena;\r\n YR_ARENA* namespaces_arena;\r\n YR_ARENA* metas_arena;\r\n YR_ARENA* matches_arena;\r\n YR_ARENA* automaton_arena;\r\n\r\n YR_AC_AUTOMATON* automaton;\r\n YR_HASH_TABLE* rules_table;\r\n YR_HASH_TABLE* objects_table;\r\n YR_HASH_TABLE* strings_table;\r\n YR_NAMESPACE* current_namespace;\r\n YR_RULE* current_rule;\r\n\r\n YR_FIXUP* fixup_stack_head;\r\n\r\n int namespaces_count;\r\n\r\n uint8_t* loop_address[MAX_LOOP_NESTING];\r\n char* loop_identifier[MAX_LOOP_NESTING];\r\n int loop_depth;\r\n int loop_for_of_mem_offset;\r\n\r\n int allow_includes;\r\n\r\n char* file_name_stack[MAX_INCLUDE_DEPTH];\r\n int file_name_stack_ptr;\r\n\r\n FILE* file_stack[MAX_INCLUDE_DEPTH];\r\n int file_stack_ptr;\r\n\r\n char last_error_extra_info[MAX_COMPILER_ERROR_EXTRA_INFO];\r\n\r\n char lex_buf[LEX_BUF_SIZE];\r\n char* lex_buf_ptr;\r\n unsigned short lex_buf_len;\r\n\r\n char include_base_dir[MAX_PATH];\r\n void* user_data;\r\n\r\n YR_COMPILER_CALLBACK_FUNC callback;\r\n\r\n} YR_COMPILER;\r\n\r\n\r\n#define yr_compiler_set_error_extra_info(compiler, info) \\\r\n strlcpy( \\\r\n compiler->last_error_extra_info, \\\r\n info, \\\r\n sizeof(compiler->last_error_extra_info)); \\\r\n\r\n\r\n#define yr_compiler_set_error_extra_info_fmt(compiler, fmt, ...) \\\r\n snprintf( \\\r\n compiler->last_error_extra_info, \\\r\n sizeof(compiler->last_error_extra_info), \\\r\n fmt, __VA_ARGS__);\r\n\r\n\r\nint _yr_compiler_push_file(\r\n YR_COMPILER* compiler,\r\n FILE* fh);\r\n\r\n\r\nFILE* _yr_compiler_pop_file(\r\n YR_COMPILER* compiler);\r\n\r\n\r\nint _yr_compiler_push_file_name(\r\n YR_COMPILER* compiler,\r\n const char* file_name);\r\n\r\n\r\nvoid _yr_compiler_pop_file_name(\r\n YR_COMPILER* compiler);\r\n\r\n\r\nYR_API int yr_compiler_create(\r\n YR_COMPILER** compiler);\r\n\r\n\r\nYR_API void yr_compiler_destroy(\r\n YR_COMPILER* compiler);\r\n\r\n\r\nYR_API void yr_compiler_set_callback(\r\n YR_COMPILER* compiler,\r\n YR_COMPILER_CALLBACK_FUNC callback,\r\n void* user_data);\r\n\r\n\r\nYR_API int yr_compiler_add_file(\r\n YR_COMPILER* compiler,\r\n FILE* rules_file,\r\n const char* namespace_,\r\n const char* file_name);\r\n\r\n\r\nYR_API int yr_compiler_add_fd(\r\n YR_COMPILER* compiler,\r\n YR_FILE_DESCRIPTOR rules_fd,\r\n const char* namespace_,\r\n const char* file_name);\r\n\r\n\r\nYR_API int yr_compiler_add_string(\r\n YR_COMPILER* compiler,\r\n const char* rules_string,\r\n const char* namespace_);\r\n\r\n\r\nYR_API char* yr_compiler_get_error_message(\r\n YR_COMPILER* compiler,\r\n char* buffer,\r\n int buffer_size);\r\n\r\n\r\nYR_API char* yr_compiler_get_current_file_name(\r\n YR_COMPILER* context);\r\n\r\n\r\nYR_API int yr_compiler_define_integer_variable(\r\n YR_COMPILER* compiler,\r\n const char* identifier,\r\n int64_t value);\r\n\r\n\r\nYR_API int yr_compiler_define_boolean_variable(\r\n YR_COMPILER* compiler,\r\n const char* identifier,\r\n int value);\r\n\r\n\r\nYR_API int yr_compiler_define_float_variable(\r\n YR_COMPILER* compiler,\r\n const char* identifier,\r\n double value);\r\n\r\n\r\nYR_API int yr_compiler_define_string_variable(\r\n YR_COMPILER* compiler,\r\n const char* identifier,\r\n const char* value);\r\n\r\n\r\nYR_API int yr_compiler_get_rules(\r\n YR_COMPILER* compiler,\r\n YR_RULES** rules);\r\n\r\n\r\n#endif\r\n" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara/dotnet.h", "content": "#ifndef YR_DOTNET_H\n#define YR_DOTNET_H\n\n\n//\n// CLI header.\n// ECMA-335 Section II.25.3.3\n//\ntypedef struct _CLI_HEADER\n{\n DWORD Size; // Called \"Cb\" in documentation.\n WORD MajorRuntimeVersion;\n WORD MinorRuntimeVersion;\n IMAGE_DATA_DIRECTORY MetaData;\n DWORD Flags;\n DWORD EntryPointToken;\n IMAGE_DATA_DIRECTORY Resources;\n IMAGE_DATA_DIRECTORY StrongNameSignature;\n ULONGLONG CodeManagerTable;\n IMAGE_DATA_DIRECTORY VTableFixups;\n ULONGLONG ExportAddressTableJumps;\n ULONGLONG ManagedNativeHeader;\n} CLI_HEADER, *PCLI_HEADER;\n\n#define NET_METADATA_MAGIC 0x424a5342\n\n//\n// CLI MetaData\n// ECMA-335 Section II.24.2.1\n//\n// Note: This is only part of the struct, as the rest of it is variable length.\n//\ntypedef struct _NET_METADATA\n{\n DWORD Magic;\n WORD MajorVersion;\n WORD MinorVersion;\n DWORD Reserved;\n DWORD Length;\n char Version[0];\n} NET_METADATA, *PNET_METADATA;\n\n#define DOTNET_STREAM_NAME_SIZE 32\n\n//\n// CLI Stream Header\n// ECMA-335 Section II.24.2.2\n//\ntypedef struct _STREAM_HEADER\n{\n DWORD Offset;\n DWORD Size;\n char Name[0];\n} STREAM_HEADER, *PSTREAM_HEADER;\n\n\n//\n// CLI #~ Stream Header\n// ECMA-335 Section II.24.2.6\n//\ntypedef struct _TILDE_HEADER\n{\n DWORD Reserved1;\n BYTE MajorVersion;\n BYTE MinorVersion;\n BYTE HeapSizes;\n BYTE Reserved2;\n ULONGLONG Valid;\n ULONGLONG Sorted;\n} TILDE_HEADER, *PTILDE_HEADER;\n\n// These are the bit positions in Valid which will be set if the table\n// exists.\n#define BIT_MODULE 0x00\n#define BIT_TYPEREF 0x01\n#define BIT_TYPEDEF 0x02\n#define BIT_FIELDPTR 0x03 // Not documented in ECMA-335\n#define BIT_FIELD 0x04\n#define BIT_METHODDEFPTR 0x05 // Not documented in ECMA-335\n#define BIT_METHODDEF 0x06\n#define BIT_PARAMPTR 0x07 // Not documented in ECMA-335\n#define BIT_PARAM 0x08\n#define BIT_INTERFACEIMPL 0x09\n#define BIT_MEMBERREF 0x0A\n#define BIT_CONSTANT 0x0B\n#define BIT_CUSTOMATTRIBUTE 0x0C\n#define BIT_FIELDMARSHAL 0x0D\n#define BIT_DECLSECURITY 0x0E\n#define BIT_CLASSLAYOUT 0x0F\n#define BIT_FIELDLAYOUT 0x10\n#define BIT_STANDALONESIG 0x11\n#define BIT_EVENTMAP 0x12\n#define BIT_EVENTPTR 0x13 // Not documented in ECMA-335\n#define BIT_EVENT 0x14\n#define BIT_PROPERTYMAP 0x15\n#define BIT_PROPERTYPTR 0x16 // Not documented in ECMA-335\n#define BIT_PROPERTY 0x17\n#define BIT_METHODSEMANTICS 0x18\n#define BIT_METHODIMPL 0x19\n#define BIT_MODULEREF 0x1A\n#define BIT_TYPESPEC 0x1B\n#define BIT_IMPLMAP 0x1C\n#define BIT_FIELDRVA 0x1D\n#define BIT_ENCLOG 0x1E // Not documented in ECMA-335\n#define BIT_ENCMAP 0x1F // Not documented in ECMA-335\n#define BIT_ASSEMBLY 0x20\n#define BIT_ASSEMBLYPROCESSOR 0x21\n#define BIT_ASSEMBLYOS 0x22\n#define BIT_ASSEMBLYREF 0x23\n#define BIT_ASSEMBLYREFPROCESSOR 0x24\n#define BIT_ASSEMBLYREFOS 0x25\n#define BIT_FILE 0x26\n#define BIT_EXPORTEDTYPE 0x27\n#define BIT_MANIFESTRESOURCE 0x28\n#define BIT_NESTEDCLASS 0x29\n#define BIT_GENERICPARAM 0x2A\n#define BIT_METHODSPEC 0x2B\n#define BIT_GENERICPARAMCONSTRAINT 0x2C\n// These are not documented in ECMA-335 nor is it clear what the format is.\n// They are for debugging information as far as I can tell.\n//#define BIT_DOCUMENT 0x30\n//#define BIT_METHODDEBUGINFORMATION 0x31\n//#define BIT_LOCALSCOPE 0x32\n//#define BIT_LOCALVARIABLE 0x33\n//#define BIT_LOCALCONSTANT 0x34\n//#define BIT_IMPORTSCOPE 0x35\n//#define BIT_STATEMACHINEMETHOD 0x36\n\n\n//\n// Element types. Note this is not a complete list as we aren't parsing all of\n// them. This only includes the ones we care about.\n// ECMA-335 Section II.23.1.16\n//\n#define ELEMENT_TYPE_STRING 0x0E\n\n\n// The string length of a typelib attribute is at most 0xFF.\n#define MAX_TYPELIB_SIZE 0xFF\n\n//\n// Module table\n// ECMA-335 Section II.22.30\n//\ntypedef struct _MODULE_TABLE\n{\n WORD Generation;\n union\n {\n WORD Name_Short;\n DWORD Name_Long;\n } Name;\n union\n {\n WORD Mvid_Short;\n DWORD Mvid_Long;\n } Mvid;\n union\n {\n WORD EncId_Short;\n DWORD EncId_Long;\n } EncId;\n union\n {\n WORD EncBaseId_Short;\n DWORD EncBaseId_Long;\n } EncBaseId;\n} MODULE_TABLE, *PMODULE_TABLE;\n\n//\n// Assembly Table\n// ECMA-335 Section II.22.2\n//\ntypedef struct _ASSEMBLY_TABLE\n{\n DWORD HashAlgId;\n WORD MajorVersion;\n WORD MinorVersion;\n WORD BuildNumber;\n WORD RevisionNumber;\n DWORD Flags;\n union\n {\n WORD PublicKey_Short;\n DWORD PublicKey_Long;\n } PublicKey;\n union\n {\n WORD Name_Short;\n DWORD Name_Long;\n } Name;\n} ASSEMBLY_TABLE, *PASSEMBLY_TABLE;\n\n\n//\n// Assembly Reference Table\n// ECMA-335 Section II.22.5\n//\ntypedef struct _ASSEMBLYREF_TABLE\n{\n WORD MajorVersion;\n WORD MinorVersion;\n WORD BuildNumber;\n WORD RevisionNumber;\n DWORD Flags;\n union\n {\n WORD PublicKeyOrToken_Short;\n DWORD PublicKeyOrToken_Long;\n } PublicKeyOrToken;\n union\n {\n WORD Name_Short;\n DWORD Name_Long;\n } Name;\n} ASSEMBLYREF_TABLE, *PASSEMBLYREF_TABLE;\n\n\n//\n// Manifest Resource Table\n// ECMA-335 Section II.22.24\n//\ntypedef struct _MANIFESTRESOURCE_TABLE\n{\n DWORD Offset;\n DWORD Flags;\n union\n {\n WORD Name_Short;\n DWORD Name_Long;\n } Name;\n union\n {\n WORD Implementation_Short;\n DWORD Implementation_Long;\n } Implementation;\n} MANIFESTRESOURCE_TABLE, *PMANIFESTRESOURCE_TABLE;\n\n//\n// ModuleRef Table\n// ECMA-335 Section II.22.31\n//\n// This is a short table, but necessary because the field size can change.\n//\ntypedef struct _MODULEREF_TABLE\n{\n union\n {\n WORD Name_Short;\n DWORD Name_Long;\n } Name;\n} MODULEREF_TABLE, *PMODULEREF_TABLE;\n\n\n//\n// CustomAttribute Table\n// ECMA-335 Section II.22.10\n//\ntypedef struct _CUSTOMATTRIBUTE_TABLE\n{\n union\n {\n WORD Parent_Short;\n DWORD Parent_Long;\n } Parent;\n union\n {\n WORD Type_Short;\n DWORD Type_Long;\n } Type;\n union\n {\n WORD Value_Short;\n DWORD Value_Long;\n } Value;\n} CUSTOMATTRIBUTE_TABLE, *PCUSTOMATTRIBUTE_TABLE;\n\n\n//\n// Constant TAble\n// ECMA-335 Section II.22.9\n//\ntypedef struct _CONSTANT_TABLE\n{\n WORD Type;\n union\n {\n WORD Parent_Short;\n DWORD Parent_Long;\n } Parent;\n union\n {\n WORD Value_Short;\n DWORD Value_Long;\n } Value;\n} CONSTANT_TABLE, *PCONSTANT_TABLE;\n\n\n// Used to return offsets to the various headers.\ntypedef struct _STREAMS\n{\n PSTREAM_HEADER guid;\n PSTREAM_HEADER tilde;\n PSTREAM_HEADER string;\n PSTREAM_HEADER blob;\n PSTREAM_HEADER us;\n} STREAMS, *PSTREAMS;\n\n\n// Used to return the value of parsing a #US or #Blob entry.\n// ECMA-335 Section II.24.2.4\ntypedef struct _BLOB_PARSE_RESULT\n{\n uint8_t size; // Number of bytes parsed. This is the new offset.\n DWORD length; // Value of the bytes parsed. This is the blob length.\n} BLOB_PARSE_RESULT, *PBLOB_PARSE_RESULT;\n\n\n// Used to store the number of rows of each table.\ntypedef struct _ROWS\n{\n uint32_t module;\n uint32_t moduleref;\n uint32_t assemblyref;\n uint32_t typeref;\n uint32_t methoddef;\n uint32_t memberref;\n uint32_t typedef_;\n uint32_t typespec;\n uint32_t field;\n uint32_t param;\n uint32_t property;\n uint32_t interfaceimpl;\n uint32_t event;\n uint32_t standalonesig;\n uint32_t assembly;\n uint32_t file;\n uint32_t exportedtype;\n uint32_t manifestresource;\n uint32_t genericparam;\n uint32_t genericparamconstraint;\n uint32_t methodspec;\n uint32_t assemblyrefprocessor;\n} ROWS, *PROWS;\n\n\n// Used to store the index sizes for the various tables.\ntypedef struct _INDEX_SIZES\n{\n uint8_t string;\n uint8_t guid;\n uint8_t blob;\n uint8_t field;\n uint8_t methoddef;\n uint8_t memberref;\n uint8_t param;\n uint8_t event;\n uint8_t typedef_;\n uint8_t property;\n uint8_t moduleref;\n uint8_t assemblyrefprocessor;\n uint8_t assemblyref;\n uint8_t genericparam;\n} INDEX_SIZES, *PINDEX_SIZES;\n#endif\n" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara/elf.h", "content": "/*\r\nCopyright (c) 2013. The YARA Authors. All Rights Reserved.\r\n\r\nRedistribution and use in source and binary forms, with or without modification,\r\nare permitted provided that the following conditions are met:\r\n\r\n1. Redistributions of source code must retain the above copyright notice, this\r\nlist of conditions and the following disclaimer.\r\n\r\n2. Redistributions in binary form must reproduce the above copyright notice,\r\nthis list of conditions and the following disclaimer in the documentation and/or\r\nother materials provided with the distribution.\r\n\r\n3. Neither the name of the copyright holder nor the names of its contributors\r\nmay be used to endorse or promote products derived from this software without\r\nspecific prior written permission.\r\n\r\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\r\nANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\r\nWARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\r\nDISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR\r\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\r\n(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\r\nLOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\r\nANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\r\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\r\nSOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\r\n*/\r\n\r\n#ifndef _ELF_H\r\n#define _ELF_H\r\n\r\n#include \"integers.h\"\r\n\r\n\r\n// 32-bit ELF base types\r\n\r\ntypedef uint32_t elf32_addr_t;\r\ntypedef uint16_t elf32_half_t;\r\ntypedef uint32_t elf32_off_t;\r\ntypedef uint32_t elf32_word_t;\r\n\r\n// 64-bit ELF base types\r\n\r\ntypedef uint64_t elf64_addr_t;\r\ntypedef uint16_t elf64_half_t;\r\ntypedef uint64_t elf64_off_t;\r\ntypedef uint32_t elf64_word_t;\r\ntypedef uint64_t elf64_xword_t;\r\n\r\n#define ELF_MAGIC 0x464C457F\r\n\r\n#define ELF_ET_NONE 0x0000 // no type\r\n#define ELF_ET_REL 0x0001 // relocatable\r\n#define ELF_ET_EXEC 0x0002 // executable\r\n#define ELF_ET_DYN 0x0003 // Shared-Object-File\r\n#define ELF_ET_CORE 0x0004 // Corefile\r\n#define ELF_ET_LOPROC 0xFF00 // Processor-specific\r\n#define ELF_ET_HIPROC 0x00FF // Processor-specific\r\n\r\n#define ELF_EM_NONE 0x0000 // no type\r\n#define ELF_EM_M32 0x0001 // AT&T WE 32100\r\n#define ELF_EM_SPARC 0x0002 // SPARC\r\n#define ELF_EM_386 0x0003 // Intel 80386\r\n#define ELF_EM_68K 0x0004 // Motorola 68000\r\n#define ELF_EM_88K 0x0005 // Motorola 88000\r\n#define ELF_EM_860 0x0007 // Intel 80860\r\n#define ELF_EM_MIPS 0x0008 // MIPS I Architecture\r\n#define ELF_EM_MIPS_RS3_LE 0x000A // MIPS RS3000 Little-endian\r\n#define ELF_EM_PPC 0x0014 // PowerPC\r\n#define ELF_EM_PPC64 0x0015 // 64-bit PowerPC\r\n#define ELF_EM_ARM 0x0028 // ARM\r\n#define ELF_EM_X86_64 0x003E // AMD/Intel x86_64\r\n#define ELF_EM_AARCH64 0x00B7 // 64-bit ARM\r\n\r\n#define ELF_CLASS_NONE 0x0000\r\n#define ELF_CLASS_32 0x0001 // 32bit file\r\n#define ELF_CLASS_64 0x0002 // 64bit file\r\n\r\n#define ELF_DATA_NONE 0x0000\r\n#define ELF_DATA_2LSB 0x0001\r\n#define ELF_DATA_2MSB 0x002\r\n\r\n\r\n#define ELF_SHT_NULL 0 // Section header table entry unused\r\n#define ELF_SHT_PROGBITS 1 // Program data\r\n#define ELF_SHT_SYMTAB 2 // Symbol table\r\n#define ELF_SHT_STRTAB 3 // String table\r\n#define ELF_SHT_RELA 4 // Relocation entries with addends\r\n#define ELF_SHT_HASH 5 // Symbol hash table\r\n#define ELF_SHT_DYNAMIC 6 // Dynamic linking information\r\n#define ELF_SHT_NOTE 7 // Notes\r\n#define ELF_SHT_NOBITS 8 // Program space with no data (bss)\r\n#define ELF_SHT_REL 9 // Relocation entries, no addends\r\n#define ELF_SHT_SHLIB 10 // Reserved\r\n#define ELF_SHT_DYNSYM 11 // Dynamic linker symbol table\r\n#define ELF_SHT_NUM 12 // Number of defined types\r\n\r\n#define ELF_SHF_WRITE 0x1 // Section is writable\r\n#define ELF_SHF_ALLOC 0x2 // Section is present during execution\r\n#define ELF_SHF_EXECINSTR 0x4 // Section contains executable instructions\r\n\r\n#define ELF_SHN_LORESERVE 0xFF00\r\n\r\n#define ELF_PT_NULL 0 // The array element is unused\r\n#define ELF_PT_LOAD 1 // Loadable segment\r\n#define ELF_PT_DYNAMIC 2 // Segment contains dynamic linking info\r\n#define ELF_PT_INTERP 3 // Contains interpreter pathname\r\n#define ELF_PT_NOTE 4 // Location & size of auxiliary info\r\n#define ELF_PT_SHLIB 5 // Reserved, unspecified semantics\r\n#define ELF_PT_PHDR 6 // Location and size of program header table\r\n#define ELF_PT_TLS 7 // Thread-Local Storage\r\n#define ELF_PT_GNU_EH_FRAME 0x6474e550\r\n#define ELF_PT_GNU_STACK 0x6474e551\r\n\r\n#define ELF_DT_NULL 0 // End of the dynamic entries\r\n#define ELF_DT_NEEDED 1 // Name of needed library\r\n#define ELF_DT_PLTRELSZ 2 // Size in bytes of PLT relocs\r\n#define ELF_DT_PLTGOT 3 // Processor defined value */\r\n#define ELF_DT_HASH 4 // Address of symbol hash table\r\n#define ELF_DT_STRTAB 5 // Address of string table\r\n#define ELF_DT_SYMTAB 6 // Address of symbol table\r\n#define ELF_DT_RELA 7 // Address of Rela relocs\r\n#define ELF_DT_RELASZ 8 // Total size of Rela relocs\r\n#define ELF_DT_RELAENT 9 // Size of one Rela reloc\r\n#define ELF_DT_STRSZ 10 // Size of string table\r\n#define ELF_DT_SYMENT 11 // Size of one symbol table entry\r\n#define ELF_DT_INIT 12 // Address of init function\r\n#define ELF_DT_FINI 13 // Address of termination function\r\n#define ELF_DT_SONAME 14 // Name of shared object\r\n#define ELF_DT_RPATH 15 // Library search path (deprecated)\r\n#define ELF_DT_SYMBOLIC 16 // Start symbol search here\r\n#define ELF_DT_REL 17 // Address of Rel relocs\r\n#define ELF_DT_RELSZ 18 // Total size of Rel relocs\r\n#define ELF_DT_RELENT 19 // Size of one Rel reloc\r\n#define ELF_DT_PLTREL 20 // Type of reloc in PLT\r\n#define ELF_DT_DEBUG 21 // For debugging; unspecified\r\n#define ELF_DT_TEXTREL 22 // Reloc might modify .text\r\n#define ELF_DT_JMPREL 23 // Address of PLT relocs\r\n#define ELF_DT_BIND_NOW 24 // Process relocations of object\r\n#define ELF_DT_INIT_ARRAY 25 // Array with addresses of init fct\r\n#define ELF_DT_FINI_ARRAY 26 // Array with addresses of fini fct\r\n#define ELF_DT_INIT_ARRAYSZ 27 // Size in bytes of DT_INIT_ARRAY\r\n#define ELF_DT_FINI_ARRAYSZ 28 // Size in bytes of DT_FINI_ARRAY\r\n#define ELF_DT_RUNPATH 29 // Library search path\r\n#define ELF_DT_FLAGS 30 // Flags for the object being loaded\r\n#define ELF_DT_ENCODING 32 // Start of encoded range\r\n\r\n#define ELF_STT_NOTYPE 0 // Symbol type is unspecified\r\n#define ELF_STT_OBJECT 1 // Symbol is a data object\r\n#define ELF_STT_FUNC 2 // Symbol is a code object\r\n#define ELF_STT_SECTION 3 // Symbol associated with a section\r\n#define ELF_STT_FILE 4 // Symbol's name is file name\r\n#define ELF_STT_COMMON 5 // Symbol is a common data object\r\n#define ELF_STT_TLS 6 // Symbol is thread-local data object\r\n\r\n#define ELF_STB_LOCAL 0 // Local symbol\r\n#define ELF_STB_GLOBAL 1 // Global symbol\r\n#define ELF_STB_WEAK 2 // Weak symbol\r\n\r\n#define ELF_PF_X 0x1 // Segment is executable\r\n#define ELF_PF_W 0x2 // Segment is writable\r\n#define ELF_PF_R 0x4 // Segment is readable\r\n\r\n#define ELF_PN_XNUM 0xffff\r\n\r\n#pragma pack(push,1)\r\n\r\ntypedef struct\r\n{\r\n uint32_t magic;\r\n uint8_t _class;\r\n uint8_t data;\r\n uint8_t version;\r\n uint8_t pad[8];\r\n uint8_t nident;\r\n\r\n} elf_ident_t;\r\n\r\n\r\ntypedef struct\r\n{\r\n elf_ident_t ident;\r\n elf32_half_t type;\r\n elf32_half_t machine;\r\n elf32_word_t version;\r\n elf32_addr_t entry;\r\n elf32_off_t ph_offset;\r\n elf32_off_t sh_offset;\r\n elf32_word_t flags;\r\n elf32_half_t header_size;\r\n elf32_half_t ph_entry_size;\r\n elf32_half_t ph_entry_count;\r\n elf32_half_t sh_entry_size;\r\n elf32_half_t sh_entry_count;\r\n elf32_half_t sh_str_table_index;\r\n\r\n} elf32_header_t;\r\n\r\n\r\ntypedef struct\r\n{\r\n elf_ident_t ident;\r\n elf64_half_t type;\r\n elf64_half_t machine;\r\n elf64_word_t version;\r\n elf64_addr_t entry;\r\n elf64_off_t ph_offset;\r\n elf64_off_t sh_offset;\r\n elf64_word_t flags;\r\n elf64_half_t header_size;\r\n elf64_half_t ph_entry_size;\r\n elf64_half_t ph_entry_count;\r\n elf64_half_t sh_entry_size;\r\n elf64_half_t sh_entry_count;\r\n elf64_half_t sh_str_table_index;\r\n\r\n} elf64_header_t;\r\n\r\n\r\ntypedef struct\r\n{\r\n elf32_word_t type;\r\n elf32_off_t offset;\r\n elf32_addr_t virt_addr;\r\n elf32_addr_t phys_addr;\r\n elf32_word_t file_size;\r\n elf32_word_t mem_size;\r\n elf32_word_t flags;\r\n elf32_word_t alignment;\r\n\r\n} elf32_program_header_t;\r\n\r\n\r\ntypedef struct\r\n{\r\n elf64_word_t type;\r\n elf64_word_t flags;\r\n elf64_off_t offset;\r\n elf64_addr_t virt_addr;\r\n elf64_addr_t phys_addr;\r\n elf64_xword_t file_size;\r\n elf64_xword_t mem_size;\r\n elf64_xword_t alignment;\r\n\r\n} elf64_program_header_t;\r\n\r\n\r\ntypedef struct\r\n{\r\n elf32_word_t name;\r\n elf32_word_t type;\r\n elf32_word_t flags;\r\n elf32_addr_t addr;\r\n elf32_off_t offset;\r\n elf32_word_t size;\r\n elf32_word_t link;\r\n elf32_word_t info;\r\n elf32_word_t align;\r\n elf32_word_t entry_size;\r\n\r\n} elf32_section_header_t;\r\n\r\n\r\ntypedef struct\r\n{\r\n elf64_word_t name;\r\n elf64_word_t type;\r\n elf64_xword_t flags;\r\n elf64_addr_t addr;\r\n elf64_off_t offset;\r\n elf64_xword_t size;\r\n elf64_word_t link;\r\n elf64_word_t info;\r\n elf64_xword_t align;\r\n elf64_xword_t entry_size;\r\n\r\n} elf64_section_header_t;\r\n\r\n\r\ntypedef struct\r\n{\r\n elf32_word_t tag;\r\n elf32_word_t val;\r\n\r\n} elf32_dyn_t;\r\n\r\n\r\ntypedef struct\r\n{\r\n elf64_xword_t tag;\r\n elf64_xword_t val;\r\n\r\n} elf64_dyn_t;\r\n\r\n\r\ntypedef struct\r\n{\r\n elf32_word_t name;\r\n elf32_addr_t value;\r\n elf32_word_t size;\r\n unsigned char info;\r\n unsigned char other;\r\n elf32_half_t shndx;\r\n\r\n} elf32_sym_t;\r\n\r\n\r\ntypedef struct\r\n{\r\n elf32_word_t name;\r\n unsigned char info;\r\n unsigned char other;\r\n elf32_half_t shndx;\r\n elf64_addr_t value;\r\n elf64_xword_t size;\r\n\r\n} elf64_sym_t;\r\n\r\n\r\n#pragma pack(pop)\r\n\r\n#endif\r\n" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara/endian.h", "content": "/*\nCopyright (c) 2016. The YARA Authors. All Rights Reserved.\n\nRedistribution and use in source and binary forms, with or without modification,\nare permitted provided that the following conditions are met:\n\n1. Redistributions of source code must retain the above copyright notice, this\nlist of conditions and the following disclaimer.\n\n2. Redistributions in binary form must reproduce the above copyright notice,\nthis list of conditions and the following disclaimer in the documentation and/or\nother materials provided with the distribution.\n\n3. Neither the name of the copyright holder nor the names of its contributors\nmay be used to endorse or promote products derived from this software without\nspecific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\nANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\nWARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\nDISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\nLOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\nANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\nSOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n*/\n\n#ifndef YR_ENDIAN_H\n#define YR_ENDIAN_H\n\n#include \n\n\n#if defined(__has_builtin)\n# if __has_builtin(__builtin_bswap16)\n# define yr_bswap16(x) __builtin_bswap16(x)\n# endif\n#endif\n\n#if !defined(yr_bswap16) && defined(_MSC_VER)\n# define yr_bswap16(x) _byteswap_ushort(x)\n#endif\n\n#if !defined(yr_bswap16)\nuint16_t _yr_bswap16(uint16_t x);\n# define yr_bswap16(x) _yr_bswap16(x)\n#endif\n\n\n#if defined(__has_builtin)\n# if __has_builtin(__builtin_bswap32)\n# define yr_bswap32(x) __builtin_bswap32(x)\n# endif\n#endif\n\n#if !defined(yr_bswap32) && defined(_MSC_VER)\n# define yr_bswap32(x) _byteswap_ulong(x)\n#endif\n\n#if !defined(yr_bswap32)\nuint32_t _yr_bswap32(uint32_t x);\n#define yr_bswap32(x) _yr_bswap32(x)\n#endif\n\n\n#if defined(__has_builtin)\n# if __has_builtin(__builtin_bswap64)\n# define yr_bswap64(x) __builtin_bswap64(x)\n# endif\n#endif\n\n#if !defined(yr_bswap64) && defined(_MSC_VER)\n# define yr_bswap64(x) _byteswap_uint64(x)\n#endif\n\n#if !defined(yr_bswap64)\nuint64_t _yr_bswap64(uint64_t x);\n#define yr_bswap64(x) _yr_bswap64(x)\n#endif\n\n\n#if defined(WORDS_BIGENDIAN)\n#define yr_le16toh(x) yr_bswap16(x)\n#define yr_le32toh(x) yr_bswap32(x)\n#define yr_le64toh(x) yr_bswap64(x)\n#define yr_be16toh(x) (x)\n#define yr_be32toh(x) (x)\n#define yr_be64toh(x) (x)\n#else\n#define yr_le16toh(x) (x)\n#define yr_le32toh(x) (x)\n#define yr_le64toh(x) (x)\n#define yr_be16toh(x) yr_bswap16(x)\n#define yr_be32toh(x) yr_bswap32(x)\n#define yr_be64toh(x) yr_bswap64(x)\n#endif\n\n#endif\n" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara/error.h", "content": "/*\r\nCopyright (c) 2014. The YARA Authors. All Rights Reserved.\r\n\r\nRedistribution and use in source and binary forms, with or without modification,\r\nare permitted provided that the following conditions are met:\r\n\r\n1. Redistributions of source code must retain the above copyright notice, this\r\nlist of conditions and the following disclaimer.\r\n\r\n2. Redistributions in binary form must reproduce the above copyright notice,\r\nthis list of conditions and the following disclaimer in the documentation and/or\r\nother materials provided with the distribution.\r\n\r\n3. Neither the name of the copyright holder nor the names of its contributors\r\nmay be used to endorse or promote products derived from this software without\r\nspecific prior written permission.\r\n\r\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\r\nANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\r\nWARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\r\nDISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR\r\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\r\n(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\r\nLOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\r\nANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\r\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\r\nSOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\r\n*/\r\n\r\n#ifndef YR_ERROR_H\r\n#define YR_ERROR_H\r\n\r\n#include \r\n\r\n#if defined(_WIN32) || defined(__CYGWIN__)\r\n#include \r\n#endif\r\n\r\n#ifndef ERROR_SUCCESS\r\n#define ERROR_SUCCESS 0\r\n#endif\r\n\r\n// ERROR_INSUFICIENT_MEMORY is misspelled but it's kept for backward\r\n// compatibility, as some other programs can be using it in this form.\r\n#define ERROR_INSUFICIENT_MEMORY 1\r\n\r\n#define ERROR_INSUFFICIENT_MEMORY 1\r\n#define ERROR_COULD_NOT_ATTACH_TO_PROCESS 2\r\n#define ERROR_COULD_NOT_OPEN_FILE 3\r\n#define ERROR_COULD_NOT_MAP_FILE 4\r\n#define ERROR_INVALID_FILE 6\r\n#define ERROR_CORRUPT_FILE 7\r\n#define ERROR_UNSUPPORTED_FILE_VERSION 8\r\n#define ERROR_INVALID_REGULAR_EXPRESSION 9\r\n#define ERROR_INVALID_HEX_STRING 10\r\n#define ERROR_SYNTAX_ERROR 11\r\n#define ERROR_LOOP_NESTING_LIMIT_EXCEEDED 12\r\n#define ERROR_DUPLICATED_LOOP_IDENTIFIER 13\r\n#define ERROR_DUPLICATED_IDENTIFIER 14\r\n#define ERROR_DUPLICATED_TAG_IDENTIFIER 15\r\n#define ERROR_DUPLICATED_META_IDENTIFIER 16\r\n#define ERROR_DUPLICATED_STRING_IDENTIFIER 17\r\n#define ERROR_UNREFERENCED_STRING 18\r\n#define ERROR_UNDEFINED_STRING 19\r\n#define ERROR_UNDEFINED_IDENTIFIER 20\r\n#define ERROR_MISPLACED_ANONYMOUS_STRING 21\r\n#define ERROR_INCLUDES_CIRCULAR_REFERENCE 22\r\n#define ERROR_INCLUDE_DEPTH_EXCEEDED 23\r\n#define ERROR_WRONG_TYPE 24\r\n#define ERROR_EXEC_STACK_OVERFLOW 25\r\n#define ERROR_SCAN_TIMEOUT 26\r\n#define ERROR_TOO_MANY_SCAN_THREADS 27\r\n#define ERROR_CALLBACK_ERROR 28\r\n#define ERROR_INVALID_ARGUMENT 29\r\n#define ERROR_TOO_MANY_MATCHES 30\r\n#define ERROR_INTERNAL_FATAL_ERROR 31\r\n#define ERROR_NESTED_FOR_OF_LOOP 32\r\n#define ERROR_INVALID_FIELD_NAME 33\r\n#define ERROR_UNKNOWN_MODULE 34\r\n#define ERROR_NOT_A_STRUCTURE 35\r\n#define ERROR_NOT_INDEXABLE 36\r\n#define ERROR_NOT_A_FUNCTION 37\r\n#define ERROR_INVALID_FORMAT 38\r\n#define ERROR_TOO_MANY_ARGUMENTS 39\r\n#define ERROR_WRONG_ARGUMENTS 40\r\n#define ERROR_WRONG_RETURN_TYPE 41\r\n#define ERROR_DUPLICATED_STRUCTURE_MEMBER 42\r\n#define ERROR_EMPTY_STRING 43\r\n#define ERROR_DIVISION_BY_ZERO 44\r\n#define ERROR_REGULAR_EXPRESSION_TOO_LARGE 45\r\n#define ERROR_TOO_MANY_RE_FIBERS 46\r\n#define ERROR_COULD_NOT_READ_PROCESS_MEMORY 47\r\n#define ERROR_INVALID_EXTERNAL_VARIABLE_TYPE 48\r\n#define ERROR_REGULAR_EXPRESSION_TOO_COMPLEX 49\r\n#define ERROR_INVALID_MODULE_NAME 50\r\n\r\n\r\n#define FAIL_ON_ERROR(x) { \\\r\n int result = (x); \\\r\n if (result != ERROR_SUCCESS) \\\r\n return result; \\\r\n}\r\n\r\n#define FAIL_ON_ERROR_WITH_CLEANUP(x, cleanup) { \\\r\n int result = (x); \\\r\n if (result != ERROR_SUCCESS) { \\\r\n cleanup; \\\r\n return result; \\\r\n } \\\r\n}\r\n\r\n#define FAIL_ON_COMPILER_ERROR(x) { \\\r\n compiler->last_result = (x); \\\r\n if (compiler->last_result != ERROR_SUCCESS) \\\r\n return compiler->last_result; \\\r\n}\r\n\r\n\r\n#ifdef NDEBUG\r\n#define assertf(expr, msg, ...) ((void)0)\r\n#else\r\n#define assertf(expr, msg, ...) \\\r\n if(!(expr)) { \\\r\n fprintf(stderr, \"%s:%d: \" msg \"\\n\", __FILE__, __LINE__, ##__VA_ARGS__); \\\r\n abort(); \\\r\n }\r\n#endif\r\n\r\n#endif\r\n" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara/exec.h", "content": "/*\r\nCopyright (c) 2013-2014. The YARA Authors. All Rights Reserved.\r\n\r\nRedistribution and use in source and binary forms, with or without modification,\r\nare permitted provided that the following conditions are met:\r\n\r\n1. Redistributions of source code must retain the above copyright notice, this\r\nlist of conditions and the following disclaimer.\r\n\r\n2. Redistributions in binary form must reproduce the above copyright notice,\r\nthis list of conditions and the following disclaimer in the documentation and/or\r\nother materials provided with the distribution.\r\n\r\n3. Neither the name of the copyright holder nor the names of its contributors\r\nmay be used to endorse or promote products derived from this software without\r\nspecific prior written permission.\r\n\r\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\r\nANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\r\nWARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\r\nDISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR\r\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\r\n(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\r\nLOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\r\nANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\r\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\r\nSOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\r\n*/\r\n\r\n#ifndef YR_EXEC_H\r\n#define YR_EXEC_H\r\n\r\n#include \"hash.h\"\r\n#include \"scan.h\"\r\n#include \"types.h\"\r\n#include \"rules.h\"\r\n\r\n\r\n#define UNDEFINED 0xFFFABADAFABADAFFLL\r\n#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) UNDEFINED)\r\n\r\n#define OP_ERROR 0\r\n#define OP_HALT 255\r\n#define OP_NOP 254\r\n\r\n#define OP_AND 1\r\n#define OP_OR 2\r\n#define OP_NOT 3\r\n#define OP_BITWISE_NOT 4\r\n#define OP_BITWISE_AND 5\r\n#define OP_BITWISE_OR 6\r\n#define OP_BITWISE_XOR 7\r\n#define OP_SHL 8\r\n#define OP_SHR 9\r\n#define OP_MOD 10\r\n#define OP_INT_TO_DBL 11\r\n#define OP_STR_TO_BOOL 12\r\n#define OP_PUSH 13\r\n#define OP_POP 14\r\n#define OP_CALL 15\r\n#define OP_OBJ_LOAD 16\r\n#define OP_OBJ_VALUE 17\r\n#define OP_OBJ_FIELD 18\r\n#define OP_INDEX_ARRAY 19\r\n#define OP_COUNT 20\r\n#define OP_LENGTH 21\r\n#define OP_FOUND 22\r\n#define OP_FOUND_AT 23\r\n#define OP_FOUND_IN 24\r\n#define OP_OFFSET 25\r\n#define OP_OF 26\r\n#define OP_PUSH_RULE 27\r\n#define OP_INIT_RULE 28\r\n#define OP_MATCH_RULE 29\r\n#define OP_INCR_M 30\r\n#define OP_CLEAR_M 31\r\n#define OP_ADD_M 32\r\n#define OP_POP_M 33\r\n#define OP_PUSH_M 34\r\n#define OP_SWAPUNDEF 35\r\n#define OP_JNUNDEF 36\r\n#define OP_JLE 37\r\n#define OP_FILESIZE 38\r\n#define OP_ENTRYPOINT 39\r\n#define OP_CONTAINS 40\r\n#define OP_MATCHES 41\r\n#define OP_IMPORT 42\r\n#define OP_LOOKUP_DICT 43\r\n#define OP_JFALSE 44\r\n#define OP_JTRUE 45\r\n\r\n\r\n#define _OP_EQ 0\r\n#define _OP_NEQ 1\r\n#define _OP_LT 2\r\n#define _OP_GT 3\r\n#define _OP_LE 4\r\n#define _OP_GE 5\r\n#define _OP_ADD 6\r\n#define _OP_SUB 7\r\n#define _OP_MUL 8\r\n#define _OP_DIV 9\r\n#define _OP_MINUS 10\r\n\r\n\r\n#define OP_INT_BEGIN 100\r\n#define OP_INT_EQ (OP_INT_BEGIN + _OP_EQ)\r\n#define OP_INT_NEQ (OP_INT_BEGIN + _OP_NEQ)\r\n#define OP_INT_LT (OP_INT_BEGIN + _OP_LT)\r\n#define OP_INT_GT (OP_INT_BEGIN + _OP_GT)\r\n#define OP_INT_LE (OP_INT_BEGIN + _OP_LE)\r\n#define OP_INT_GE (OP_INT_BEGIN + _OP_GE)\r\n#define OP_INT_ADD (OP_INT_BEGIN + _OP_ADD)\r\n#define OP_INT_SUB (OP_INT_BEGIN + _OP_SUB)\r\n#define OP_INT_MUL (OP_INT_BEGIN + _OP_MUL)\r\n#define OP_INT_DIV (OP_INT_BEGIN + _OP_DIV)\r\n#define OP_INT_MINUS (OP_INT_BEGIN + _OP_MINUS)\r\n#define OP_INT_END OP_INT_MINUS\r\n\r\n#define OP_DBL_BEGIN 120\r\n#define OP_DBL_EQ (OP_DBL_BEGIN + _OP_EQ)\r\n#define OP_DBL_NEQ (OP_DBL_BEGIN + _OP_NEQ)\r\n#define OP_DBL_LT (OP_DBL_BEGIN + _OP_LT)\r\n#define OP_DBL_GT (OP_DBL_BEGIN + _OP_GT)\r\n#define OP_DBL_LE (OP_DBL_BEGIN + _OP_LE)\r\n#define OP_DBL_GE (OP_DBL_BEGIN + _OP_GE)\r\n#define OP_DBL_ADD (OP_DBL_BEGIN + _OP_ADD)\r\n#define OP_DBL_SUB (OP_DBL_BEGIN + _OP_SUB)\r\n#define OP_DBL_MUL (OP_DBL_BEGIN + _OP_MUL)\r\n#define OP_DBL_DIV (OP_DBL_BEGIN + _OP_DIV)\r\n#define OP_DBL_MINUS (OP_DBL_BEGIN + _OP_MINUS)\r\n#define OP_DBL_END OP_DBL_MINUS\r\n\r\n#define OP_STR_BEGIN 140\r\n#define OP_STR_EQ (OP_STR_BEGIN + _OP_EQ)\r\n#define OP_STR_NEQ (OP_STR_BEGIN + _OP_NEQ)\r\n#define OP_STR_LT (OP_STR_BEGIN + _OP_LT)\r\n#define OP_STR_GT (OP_STR_BEGIN + _OP_GT)\r\n#define OP_STR_LE (OP_STR_BEGIN + _OP_LE)\r\n#define OP_STR_GE (OP_STR_BEGIN + _OP_GE)\r\n#define OP_STR_END OP_STR_GE\r\n\r\n#define IS_INT_OP(x) ((x) >= OP_INT_BEGIN && (x) <= OP_INT_END)\r\n#define IS_DBL_OP(x) ((x) >= OP_DBL_BEGIN && (x) <= OP_DBL_END)\r\n#define IS_STR_OP(x) ((x) >= OP_STR_BEGIN && (x) <= OP_STR_END)\r\n\r\n#define OP_READ_INT 240\r\n#define OP_INT8 (OP_READ_INT + 0)\r\n#define OP_INT16 (OP_READ_INT + 1)\r\n#define OP_INT32 (OP_READ_INT + 2)\r\n#define OP_UINT8 (OP_READ_INT + 3)\r\n#define OP_UINT16 (OP_READ_INT + 4)\r\n#define OP_UINT32 (OP_READ_INT + 5)\r\n#define OP_INT8BE (OP_READ_INT + 6)\r\n#define OP_INT16BE (OP_READ_INT + 7)\r\n#define OP_INT32BE (OP_READ_INT + 8)\r\n#define OP_UINT8BE (OP_READ_INT + 9)\r\n#define OP_UINT16BE (OP_READ_INT + 10)\r\n#define OP_UINT32BE (OP_READ_INT + 11)\r\n\r\n\r\n#define OPERATION(operator, op1, op2) \\\r\n (IS_UNDEFINED(op1) || IS_UNDEFINED(op2)) ? (UNDEFINED) : (op1 operator op2)\r\n\r\n\r\n#define COMPARISON(operator, op1, op2) \\\r\n (IS_UNDEFINED(op1) || IS_UNDEFINED(op2)) ? (0) : (op1 operator op2)\r\n\r\n\r\nint yr_execute_code(\r\n YR_RULES* rules,\r\n YR_SCAN_CONTEXT* context,\r\n int timeout,\r\n time_t start_time);\r\n\r\n#endif\r\n" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara/exefiles.h", "content": "/*\r\nCopyright (c) 2007. The YARA Authors. All Rights Reserved.\r\n\r\nRedistribution and use in source and binary forms, with or without modification,\r\nare permitted provided that the following conditions are met:\r\n\r\n1. Redistributions of source code must retain the above copyright notice, this\r\nlist of conditions and the following disclaimer.\r\n\r\n2. Redistributions in binary form must reproduce the above copyright notice,\r\nthis list of conditions and the following disclaimer in the documentation and/or\r\nother materials provided with the distribution.\r\n\r\n3. Neither the name of the copyright holder nor the names of its contributors\r\nmay be used to endorse or promote products derived from this software without\r\nspecific prior written permission.\r\n\r\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\r\nANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\r\nWARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\r\nDISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR\r\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\r\n(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\r\nLOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\r\nANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\r\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\r\nSOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\r\n*/\r\n\r\n#ifndef YR_EXEFILES_H\r\n#define YR_EXEFILES_H\r\n\r\nuint64_t yr_get_entry_point_offset(\r\n uint8_t* buffer,\r\n size_t buffer_length);\r\n\r\n\r\nuint64_t yr_get_entry_point_address(\r\n uint8_t* buffer,\r\n size_t buffer_length,\r\n size_t base_address);\r\n\r\n#endif\r\n" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara/filemap.h", "content": "/*\r\nCopyright (c) 2007-2015. The YARA Authors. All Rights Reserved.\r\n\r\nRedistribution and use in source and binary forms, with or without modification,\r\nare permitted provided that the following conditions are met:\r\n\r\n1. Redistributions of source code must retain the above copyright notice, this\r\nlist of conditions and the following disclaimer.\r\n\r\n2. Redistributions in binary form must reproduce the above copyright notice,\r\nthis list of conditions and the following disclaimer in the documentation and/or\r\nother materials provided with the distribution.\r\n\r\n3. Neither the name of the copyright holder nor the names of its contributors\r\nmay be used to endorse or promote products derived from this software without\r\nspecific prior written permission.\r\n\r\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\r\nANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\r\nWARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\r\nDISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR\r\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\r\n(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\r\nLOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\r\nANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\r\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\r\nSOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\r\n*/\r\n\r\n#ifndef YR_FILEMAP_H\r\n#define YR_FILEMAP_H\r\n\r\n#ifdef _MSC_VER\r\n#define off_t int64_t\r\n#else\r\n#include \r\n#endif\r\n\r\n#if defined(_WIN32) || defined(__CYGWIN__)\r\n#include \r\n#define YR_FILE_DESCRIPTOR HANDLE\r\n#else\r\n#define YR_FILE_DESCRIPTOR int\r\n#endif\r\n\r\n#include \r\n\r\n#include \"integers.h\"\r\n#include \"utils.h\"\r\n\r\n\r\ntypedef struct _YR_MAPPED_FILE\r\n{\r\n YR_FILE_DESCRIPTOR file;\r\n size_t size;\r\n uint8_t* data;\r\n#if defined(_WIN32) || defined(__CYGWIN__)\r\n HANDLE mapping;\r\n#endif\r\n\r\n} YR_MAPPED_FILE;\r\n\r\n\r\nYR_API int yr_filemap_map(\r\n const char* file_path,\r\n YR_MAPPED_FILE* pmapped_file);\r\n\r\n\r\nYR_API int yr_filemap_map_fd(\r\n YR_FILE_DESCRIPTOR file,\r\n off_t offset,\r\n size_t size,\r\n YR_MAPPED_FILE* pmapped_file);\r\n\r\n\r\nYR_API int yr_filemap_map_ex(\r\n const char* file_path,\r\n off_t offset,\r\n size_t size,\r\n YR_MAPPED_FILE* pmapped_file);\r\n\r\n\r\nYR_API void yr_filemap_unmap(\r\n YR_MAPPED_FILE* pmapped_file);\r\n\r\n\r\nYR_API void yr_filemap_unmap_fd(\r\n YR_MAPPED_FILE* pmapped_file);\r\n\r\n#endif\r\n" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara/globals.h", "content": "/*\r\nCopyright (c) 2014. The YARA Authors. All Rights Reserved.\r\n\r\nRedistribution and use in source and binary forms, with or without modification,\r\nare permitted provided that the following conditions are met:\r\n\r\n1. Redistributions of source code must retain the above copyright notice, this\r\nlist of conditions and the following disclaimer.\r\n\r\n2. Redistributions in binary form must reproduce the above copyright notice,\r\nthis list of conditions and the following disclaimer in the documentation and/or\r\nother materials provided with the distribution.\r\n\r\n3. Neither the name of the copyright holder nor the names of its contributors\r\nmay be used to endorse or promote products derived from this software without\r\nspecific prior written permission.\r\n\r\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\r\nANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\r\nWARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\r\nDISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR\r\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\r\n(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\r\nLOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\r\nANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\r\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\r\nSOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\r\n*/\r\n\r\n#ifndef YR_GLOBALS_H\r\n#define YR_GLOBALS_H\r\n\r\n#include \"threading.h\"\r\n\r\nextern char yr_lowercase[256];\r\nextern char yr_altercase[256];\r\n\r\nextern YR_THREAD_STORAGE_KEY yr_tidx_key;\r\nextern YR_THREAD_STORAGE_KEY yr_recovery_state_key;\r\n\r\n#endif\r\n" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara/hash.h", "content": "/*\r\nCopyright (c) 2013. The YARA Authors. All Rights Reserved.\r\n\r\nRedistribution and use in source and binary forms, with or without modification,\r\nare permitted provided that the following conditions are met:\r\n\r\n1. Redistributions of source code must retain the above copyright notice, this\r\nlist of conditions and the following disclaimer.\r\n\r\n2. Redistributions in binary form must reproduce the above copyright notice,\r\nthis list of conditions and the following disclaimer in the documentation and/or\r\nother materials provided with the distribution.\r\n\r\n3. Neither the name of the copyright holder nor the names of its contributors\r\nmay be used to endorse or promote products derived from this software without\r\nspecific prior written permission.\r\n\r\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\r\nANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\r\nWARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\r\nDISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR\r\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\r\n(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\r\nLOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\r\nANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\r\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\r\nSOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\r\n*/\r\n\r\n#ifndef YR_HASH_H\r\n#define YR_HASH_H\r\n\r\n#include \r\n\r\n#include \"utils.h\"\r\n\r\ntypedef struct _YR_HASH_TABLE_ENTRY\r\n{\r\n void* key;\r\n size_t key_length;\r\n char* ns;\r\n void* value;\r\n\r\n struct _YR_HASH_TABLE_ENTRY* next;\r\n\r\n} YR_HASH_TABLE_ENTRY;\r\n\r\n\r\ntypedef struct _YR_HASH_TABLE\r\n{\r\n int size;\r\n\r\n YR_HASH_TABLE_ENTRY* buckets[1];\r\n\r\n} YR_HASH_TABLE;\r\n\r\n\r\ntypedef int (*YR_HASH_TABLE_FREE_VALUE_FUNC)(void* value);\r\n\r\n\r\nYR_API int yr_hash_table_create(\r\n int size,\r\n YR_HASH_TABLE** table);\r\n\r\n\r\nYR_API void yr_hash_table_clean(\r\n YR_HASH_TABLE* table,\r\n YR_HASH_TABLE_FREE_VALUE_FUNC free_value);\r\n\r\n\r\nYR_API void yr_hash_table_destroy(\r\n YR_HASH_TABLE* table,\r\n YR_HASH_TABLE_FREE_VALUE_FUNC free_value);\r\n\r\n\r\nYR_API void* yr_hash_table_lookup(\r\n YR_HASH_TABLE* table,\r\n const char* key,\r\n const char* ns);\r\n\r\n\r\nYR_API int yr_hash_table_add(\r\n YR_HASH_TABLE* table,\r\n const char* key,\r\n const char* ns,\r\n void* value);\r\n\r\n\r\nYR_API void* yr_hash_table_lookup_raw_key(\r\n YR_HASH_TABLE* table,\r\n const void* key,\r\n size_t key_length,\r\n const char* ns);\r\n\r\n\r\nYR_API int yr_hash_table_add_raw_key(\r\n YR_HASH_TABLE* table,\r\n const void* key,\r\n size_t key_length,\r\n const char* ns,\r\n void* value);\r\n\r\n#endif\r\n" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara/hex_lexer.h", "content": "/*\r\nCopyright (c) 2007. Victor M. Alvarez [plusvic@gmail.com].\r\n\r\nRedistribution and use in source and binary forms, with or without modification,\r\nare permitted provided that the following conditions are met:\r\n\r\n1. Redistributions of source code must retain the above copyright notice, this\r\nlist of conditions and the following disclaimer.\r\n\r\n2. Redistributions in binary form must reproduce the above copyright notice,\r\nthis list of conditions and the following disclaimer in the documentation and/or\r\nother materials provided with the distribution.\r\n\r\n3. Neither the name of the copyright holder nor the names of its contributors\r\nmay be used to endorse or promote products derived from this software without\r\nspecific prior written permission.\r\n\r\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\r\nANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\r\nWARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\r\nDISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR\r\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\r\n(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\r\nLOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\r\nANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\r\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\r\nSOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\r\n*/\r\n\r\n#include \"re.h\"\r\n\r\n#undef yyparse\r\n#undef yylex\r\n#undef yyerror\r\n#undef yyfatal\r\n#undef yychar\r\n#undef yydebug\r\n#undef yynerrs\r\n#undef yyget_extra\r\n#undef yyget_lineno\r\n\r\n#undef YY_FATAL_ERROR\r\n#undef YY_DECL\r\n#undef LEX_ENV\r\n\r\n#define yyparse hex_yyparse\r\n#define yylex hex_yylex\r\n#define yyerror hex_yyerror\r\n#define yyfatal hex_yyfatal\r\n#define yychar hex_yychar\r\n#define yydebug hex_yydebug\r\n#define yynerrs hex_yynerrs\r\n#define yyget_extra hex_yyget_extra\r\n#define yyget_lineno hex_yyget_lineno\r\n\r\n\r\n#ifndef YY_TYPEDEF_YY_SCANNER_T\r\n#define YY_TYPEDEF_YY_SCANNER_T\r\ntypedef void* yyscan_t;\r\n#endif\r\n\r\n#define YY_EXTRA_TYPE RE_AST*\r\n#define YY_USE_CONST\r\n\r\n\r\ntypedef struct _HEX_LEX_ENVIRONMENT\r\n{\r\n int token_count;\r\n int inside_or;\r\n int last_error_code;\r\n char last_error_message[256];\r\n\r\n} HEX_LEX_ENVIRONMENT;\r\n\r\n\r\n#define YY_FATAL_ERROR(msg) hex_yyfatal(yyscanner, msg)\r\n\r\n#define LEX_ENV ((HEX_LEX_ENVIRONMENT*) lex_env)\r\n\r\n#include \r\n\r\n#define YY_DECL int hex_yylex \\\r\n (YYSTYPE * yylval_param , yyscan_t yyscanner, HEX_LEX_ENVIRONMENT* lex_env)\r\n\r\n\r\nYY_EXTRA_TYPE yyget_extra(\r\n yyscan_t yyscanner);\r\n\r\nint yylex(\r\n YYSTYPE* yylval_param,\r\n yyscan_t yyscanner,\r\n HEX_LEX_ENVIRONMENT* lex_env);\r\n\r\nint yyparse(\r\n void* yyscanner,\r\n HEX_LEX_ENVIRONMENT* lex_env);\r\n\r\nvoid yyerror(\r\n yyscan_t yyscanner,\r\n HEX_LEX_ENVIRONMENT* lex_env,\r\n const char* error_message);\r\n\r\nvoid yyfatal(\r\n yyscan_t yyscanner,\r\n const char* error_message);\r\n\r\nint yr_parse_hex_string(\r\n const char* hex_string,\r\n RE_AST** re_ast,\r\n RE_ERROR* error);\r\n" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara/integers.h", "content": "/*\r\nCopyright (c) 2007-2015. The YARA Authors. All Rights Reserved.\r\n\r\nRedistribution and use in source and binary forms, with or without modification,\r\nare permitted provided that the following conditions are met:\r\n\r\n1. Redistributions of source code must retain the above copyright notice, this\r\nlist of conditions and the following disclaimer.\r\n\r\n2. Redistributions in binary form must reproduce the above copyright notice,\r\nthis list of conditions and the following disclaimer in the documentation and/or\r\nother materials provided with the distribution.\r\n\r\n3. Neither the name of the copyright holder nor the names of its contributors\r\nmay be used to endorse or promote products derived from this software without\r\nspecific prior written permission.\r\n\r\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\r\nANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\r\nWARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\r\nDISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR\r\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\r\n(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\r\nLOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\r\nANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\r\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\r\nSOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\r\n*/\r\n\r\n#ifndef YR_INTEGERS_H\r\n#define YR_INTEGERS_H\r\n\r\n/* Integer type definitions\r\n */\r\n#if ( defined( _MSC_VER ) && ( _MSC_VER < 1600 ) ) || ( defined( __BORLANDC__ ) && ( __BORLANDC__ <= 0x0560 ) )\r\n\r\n#ifdef __cplusplus\r\nextern \"C\" {\r\n#endif\r\n\r\n/* Microsoft Visual Studio C++ before Visual Studio 2010 or earlier versions of the Borland C++ Builder\r\n * do not support the (u)int#_t type definitions but have __int# definitions instead\r\n */\r\ntypedef __int8 int8_t;\r\ntypedef unsigned __int8 uint8_t;\r\ntypedef __int16 int16_t;\r\ntypedef unsigned __int16 uint16_t;\r\ntypedef __int32 int32_t;\r\ntypedef unsigned __int32 uint32_t;\r\ntypedef __int64 int64_t;\r\ntypedef unsigned __int64 uint64_t;\r\n\r\n#ifdef __cplusplus\r\n}\r\n#endif\r\n\r\n#else\r\n\r\n/* Other \"compilers\" and later versions of Microsoft Visual Studio C++ and\r\n * Borland C/C++ define the types in \r\n */\r\n#include \r\n\r\n#endif\r\n\r\n#endif\r\n" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara/lexer.h", "content": "/*\r\nCopyright (c) 2007. Victor M. Alvarez [plusvic@gmail.com].\r\n\r\nRedistribution and use in source and binary forms, with or without modification,\r\nare permitted provided that the following conditions are met:\r\n\r\n1. Redistributions of source code must retain the above copyright notice, this\r\nlist of conditions and the following disclaimer.\r\n\r\n2. Redistributions in binary form must reproduce the above copyright notice,\r\nthis list of conditions and the following disclaimer in the documentation and/or\r\nother materials provided with the distribution.\r\n\r\n3. Neither the name of the copyright holder nor the names of its contributors\r\nmay be used to endorse or promote products derived from this software without\r\nspecific prior written permission.\r\n\r\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\r\nANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\r\nWARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\r\nDISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR\r\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\r\n(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\r\nLOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\r\nANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\r\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\r\nSOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\r\n*/\r\n\r\n#include \"compiler.h\"\r\n\r\n\r\n#undef yyparse\r\n#undef yylex\r\n#undef yyerror\r\n#undef yyfatal\r\n#undef yychar\r\n#undef yydebug\r\n#undef yynerrs\r\n#undef yyget_extra\r\n#undef yyget_lineno\r\n\r\n#undef YY_DECL\r\n#undef YY_FATAL_ERROR\r\n#undef YY_EXTRA_TYPE\r\n\r\n#define yyparse yara_yyparse\r\n#define yylex yara_yylex\r\n#define yyerror yara_yyerror\r\n#define yyfatal yara_yyfatal\r\n#define yywarning yara_yywarning\r\n#define yychar yara_yychar\r\n#define yydebug yara_yydebug\r\n#define yynerrs yara_yynerrs\r\n#define yyget_extra yara_yyget_extra\r\n#define yyget_lineno yara_yyget_lineno\r\n\r\n\r\n#ifndef YY_TYPEDEF_YY_SCANNER_T\r\n#define YY_TYPEDEF_YY_SCANNER_T\r\ntypedef void* yyscan_t;\r\n#endif\r\n\r\n#ifndef YY_TYPEDEF_EXPRESSION_T\r\n#define YY_TYPEDEF_EXPRESSION_T\r\n\r\n\r\n// Expression type constants are powers of two because they are used as flags.\r\n// For example:\r\n// CHECK_TYPE(whatever, EXPRESSION_TYPE_INTEGER | EXPRESSION_TYPE_FLOAT)\r\n// The expression above is used to ensure that the type of \"whatever\" is either\r\n// integer or float.\r\n\r\n#define EXPRESSION_TYPE_BOOLEAN 1\r\n#define EXPRESSION_TYPE_INTEGER 2\r\n#define EXPRESSION_TYPE_STRING 4\r\n#define EXPRESSION_TYPE_REGEXP 8\r\n#define EXPRESSION_TYPE_OBJECT 16\r\n#define EXPRESSION_TYPE_FLOAT 32\r\n\r\ntypedef struct _EXPRESSION\r\n{\r\n int type;\r\n\r\n union\r\n {\r\n int64_t integer;\r\n YR_OBJECT* object;\r\n SIZED_STRING* sized_string;\r\n } value;\r\n\r\n const char* identifier;\r\n\r\n} EXPRESSION;\r\n\r\nunion YYSTYPE;\r\n\r\n#endif\r\n\r\n\r\n#define YY_DECL int yylex( \\\r\n union YYSTYPE* yylval_param, yyscan_t yyscanner, YR_COMPILER* compiler)\r\n\r\n\r\n#define YY_FATAL_ERROR(msg) yara_yyfatal(yyscanner, msg)\r\n\r\n\r\n#define YY_EXTRA_TYPE YR_COMPILER*\r\n#define YY_USE_CONST\r\n\r\n\r\nint yyget_lineno(yyscan_t yyscanner);\r\n\r\nint yylex(\r\n union YYSTYPE* yylval_param,\r\n yyscan_t yyscanner,\r\n YR_COMPILER* compiler);\r\n\r\nint yyparse(\r\n void* yyscanner,\r\n YR_COMPILER* compiler);\r\n\r\nvoid yyerror(\r\n yyscan_t yyscanner,\r\n YR_COMPILER* compiler,\r\n const char* error_message);\r\n\r\nvoid yywarning(\r\n yyscan_t yyscanner,\r\n const char* message_fmt,\r\n ...);\r\n\r\nvoid yyfatal(\r\n yyscan_t yyscanner,\r\n const char* error_message);\r\n\r\nYY_EXTRA_TYPE yyget_extra(\r\n yyscan_t yyscanner);\r\n\r\nint yr_lex_parse_rules_string(\r\n const char* rules_string,\r\n YR_COMPILER* compiler);\r\n\r\nint yr_lex_parse_rules_file(\r\n FILE* rules_file,\r\n YR_COMPILER* compiler);\r\n\r\nint yr_lex_parse_rules_fd(\r\n YR_FILE_DESCRIPTOR rules_fd,\r\n YR_COMPILER* compiler);\r\n" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara/libyara.h", "content": "/*\r\nCopyright (c) 2014. The YARA Authors. All Rights Reserved.\r\n\r\nRedistribution and use in source and binary forms, with or without modification,\r\nare permitted provided that the following conditions are met:\r\n\r\n1. Redistributions of source code must retain the above copyright notice, this\r\nlist of conditions and the following disclaimer.\r\n\r\n2. Redistributions in binary form must reproduce the above copyright notice,\r\nthis list of conditions and the following disclaimer in the documentation and/or\r\nother materials provided with the distribution.\r\n\r\n3. Neither the name of the copyright holder nor the names of its contributors\r\nmay be used to endorse or promote products derived from this software without\r\nspecific prior written permission.\r\n\r\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\r\nANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\r\nWARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\r\nDISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR\r\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\r\n(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\r\nLOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\r\nANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\r\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\r\nSOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\r\n*/\r\n\r\n#ifndef YR_LIBYARA_H\r\n#define YR_LIBYARA_H\r\n\r\n#include \"utils.h\"\r\n\r\n#define YR_MAJOR_VERSION 3\r\n#define YR_MINOR_VERSION 6\r\n#define YR_MICRO_VERSION 0\r\n\r\n#define version_str(s) _version_str(s)\r\n#define _version_str(s) #s\r\n\r\n// Version as a string\r\n#define YR_VERSION version_str(YR_MAJOR_VERSION) \\\r\n \".\" version_str(YR_MINOR_VERSION) \\\r\n \".\" version_str(YR_MICRO_VERSION)\r\n\r\n// Version as a single 4-byte hex number, e.g. 0x030401 == 3.4.1.\r\n#define YR_VERSION_HEX ((YR_MAJOR_VERSION << 16) | \\\r\n (YR_MINOR_VERSION << 8) | \\\r\n (YR_MICRO_VERSION << 0))\r\n\r\n\r\n// Enumerated type listing configuration options\r\ntypedef enum _YR_CONFIG_NAME\r\n{\r\n YR_CONFIG_STACK_SIZE,\r\n YR_CONFIG_MAX\r\n\r\n} YR_CONFIG_NAME;\r\n\r\n\r\n#define DEFAULT_STACK_SIZE 16384\r\n\r\n\r\nYR_API int yr_initialize(void);\r\n\r\n\r\nYR_API int yr_finalize(void);\r\n\r\n\r\nYR_API void yr_finalize_thread(void);\r\n\r\n\r\nYR_API int yr_get_tidx(void);\r\n\r\n\r\nYR_API void yr_set_tidx(int);\r\n\r\n\r\nYR_API int yr_set_configuration(YR_CONFIG_NAME, void*);\r\n\r\n\r\nYR_API int yr_get_configuration(YR_CONFIG_NAME, void*);\r\n\r\n#endif\r\n" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara/limits.h", "content": "/*\r\nCopyright (c) 2013. The YARA Authors. All Rights Reserved.\r\n\r\nRedistribution and use in source and binary forms, with or without modification,\r\nare permitted provided that the following conditions are met:\r\n\r\n1. Redistributions of source code must retain the above copyright notice, this\r\nlist of conditions and the following disclaimer.\r\n\r\n2. Redistributions in binary form must reproduce the above copyright notice,\r\nthis list of conditions and the following disclaimer in the documentation and/or\r\nother materials provided with the distribution.\r\n\r\n3. Neither the name of the copyright holder nor the names of its contributors\r\nmay be used to endorse or promote products derived from this software without\r\nspecific prior written permission.\r\n\r\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\r\nANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\r\nWARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\r\nDISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR\r\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\r\n(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\r\nLOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\r\nANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\r\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\r\nSOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\r\n*/\r\n\r\n#ifndef YR_LIMITS_H\r\n#define YR_LIMITS_H\r\n\r\n#if defined(_WIN32) || defined(__CYGWIN__)\r\n#include \r\n#endif\r\n\r\n#include \"utils.h\"\r\n\r\n// MAX_THREADS is the number of threads that can use a YR_RULES\r\n// object simultaneously.\r\n\r\n#ifndef MAX_THREADS\r\n#define MAX_THREADS 32\r\n#endif\r\n\r\n\r\n#ifndef MAX_PATH\r\n#define MAX_PATH 1024\r\n#endif\r\n\r\n#define MAX_COMPILER_ERROR_EXTRA_INFO 256\r\n#define MAX_ATOM_LENGTH 4\r\n#define MAX_LOOP_NESTING 4\r\n#define MAX_ARENA_PAGES 32\r\n#define MAX_INCLUDE_DEPTH 16\r\n#define MAX_STRING_MATCHES 1000000\r\n#define MAX_FUNCTION_ARGS 128\r\n#define MAX_FAST_RE_STACK 300\r\n#define MAX_OVERLOADED_FUNCTIONS 10\r\n#define MAX_HEX_STRING_TOKENS 10000\r\n#define MAX_MATCH_DATA 4096\r\n\r\n#define LOOP_LOCAL_VARS 4\r\n#define STRING_CHAINING_THRESHOLD 200\r\n#define LEX_BUF_SIZE 8192\r\n\r\n\r\n#endif\r\n" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara/mem.h", "content": "/*\r\nCopyright (c) 2007. The YARA Authors. All Rights Reserved.\r\n\r\nRedistribution and use in source and binary forms, with or without modification,\r\nare permitted provided that the following conditions are met:\r\n\r\n1. Redistributions of source code must retain the above copyright notice, this\r\nlist of conditions and the following disclaimer.\r\n\r\n2. Redistributions in binary form must reproduce the above copyright notice,\r\nthis list of conditions and the following disclaimer in the documentation and/or\r\nother materials provided with the distribution.\r\n\r\n3. Neither the name of the copyright holder nor the names of its contributors\r\nmay be used to endorse or promote products derived from this software without\r\nspecific prior written permission.\r\n\r\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\r\nANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\r\nWARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\r\nDISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR\r\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\r\n(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\r\nLOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\r\nANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\r\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\r\nSOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\r\n*/\r\n\r\n#ifndef YR_MEM_H\r\n#define YR_MEM_H\r\n\r\n#include \r\n\r\n#ifdef DMALLOC\r\n\r\n#define yr_malloc malloc\r\n#define yr_calloc calloc\r\n#define yr_realloc realloc\r\n#define yr_free free\r\n#define yr_strdup strdup\r\n#define yr_strndup strndup\r\n\r\n#include \r\n\r\n#else\r\n\r\nvoid* yr_calloc(\r\n size_t count,\r\n size_t size);\r\n\r\nvoid* yr_malloc(\r\n size_t size);\r\n\r\nvoid* yr_realloc(\r\n void* ptr,\r\n size_t size);\r\n\r\nvoid yr_free(\r\n void* ptr);\r\n\r\nchar* yr_strdup(\r\n const char* str);\r\n\r\nchar* yr_strndup(\r\n const char* str, size_t n);\r\n\r\n#endif\r\n\r\nint yr_heap_alloc(void);\r\n\r\nint yr_heap_free(void);\r\n\r\n#endif\r\n" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara/modules.h", "content": "/*\r\nCopyright (c) 2014. The YARA Authors. All Rights Reserved.\r\n\r\nRedistribution and use in source and binary forms, with or without modification,\r\nare permitted provided that the following conditions are met:\r\n\r\n1. Redistributions of source code must retain the above copyright notice, this\r\nlist of conditions and the following disclaimer.\r\n\r\n2. Redistributions in binary form must reproduce the above copyright notice,\r\nthis list of conditions and the following disclaimer in the documentation and/or\r\nother materials provided with the distribution.\r\n\r\n3. Neither the name of the copyright holder nor the names of its contributors\r\nmay be used to endorse or promote products derived from this software without\r\nspecific prior written permission.\r\n\r\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\r\nANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\r\nWARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\r\nDISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR\r\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\r\n(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\r\nLOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\r\nANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\r\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\r\nSOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\r\n*/\r\n\r\n#ifndef YR_MODULES_H\r\n#define YR_MODULES_H\r\n\r\n#include \r\n#include \r\n#include \r\n#include \r\n\r\n#include \"utils.h\"\r\n#include \"limits.h\"\r\n#include \"error.h\"\r\n#include \"exec.h\"\r\n#include \"types.h\"\r\n#include \"object.h\"\r\n#include \"libyara.h\"\r\n\r\n// Concatenation that macro-expands its arguments.\r\n\r\n#define YR_CONCAT(arg1, arg2) _YR_CONCAT(arg1, arg2) // expands the arguments.\r\n#define _YR_CONCAT(arg1, arg2) arg1 ## arg2 // do the actual concatenation.\r\n\r\n\r\n#define module_declarations YR_CONCAT(MODULE_NAME, __declarations)\r\n#define module_load YR_CONCAT(MODULE_NAME, __load)\r\n#define module_unload YR_CONCAT(MODULE_NAME, __unload)\r\n#define module_initialize YR_CONCAT(MODULE_NAME, __initialize)\r\n#define module_finalize YR_CONCAT(MODULE_NAME, __finalize)\r\n\r\n#define begin_declarations \\\r\n int module_declarations(YR_OBJECT* module) { \\\r\n YR_OBJECT* stack[64]; \\\r\n int stack_top = 0; \\\r\n stack[stack_top] = module;\r\n\r\n\r\n#define end_declarations \\\r\n return ERROR_SUCCESS; }\r\n\r\n\r\n#define begin_struct(name) { \\\r\n YR_OBJECT* structure; \\\r\n FAIL_ON_ERROR(yr_object_create( \\\r\n OBJECT_TYPE_STRUCTURE, \\\r\n name, \\\r\n stack[stack_top], \\\r\n &structure)); \\\r\n assertf( \\\r\n stack_top < sizeof(stack)/sizeof(stack[0]) - 1, \\\r\n \"too many nested structures\"); \\\r\n stack[++stack_top] = structure; \\\r\n }\r\n\r\n\r\n#define begin_struct_array(name) { \\\r\n YR_OBJECT* structure; \\\r\n YR_OBJECT* array; \\\r\n FAIL_ON_ERROR(yr_object_create( \\\r\n OBJECT_TYPE_ARRAY, \\\r\n name, \\\r\n stack[stack_top], \\\r\n &array)); \\\r\n FAIL_ON_ERROR(yr_object_create( \\\r\n OBJECT_TYPE_STRUCTURE, \\\r\n name, \\\r\n array, \\\r\n &structure)); \\\r\n assertf( \\\r\n stack_top < sizeof(stack)/sizeof(stack[0]) - 1, \\\r\n \"too many nested structures\"); \\\r\n stack[++stack_top] = structure; \\\r\n }\r\n\r\n\r\n#define begin_struct_dictionary(name) { \\\r\n YR_OBJECT* structure; \\\r\n YR_OBJECT* array; \\\r\n FAIL_ON_ERROR(yr_object_create( \\\r\n OBJECT_TYPE_DICTIONARY, \\\r\n name, \\\r\n stack[stack_top], \\\r\n &array)); \\\r\n FAIL_ON_ERROR(yr_object_create( \\\r\n OBJECT_TYPE_STRUCTURE, \\\r\n name, \\\r\n array, \\\r\n &structure)); \\\r\n assertf( \\\r\n stack_top < sizeof(stack)/sizeof(stack[0]) - 1, \\\r\n \"too many nested structures\"); \\\r\n stack[++stack_top] = structure; \\\r\n }\r\n\r\n\r\n#define end_struct(name) { \\\r\n assert(stack[stack_top]->type == OBJECT_TYPE_STRUCTURE); \\\r\n assertf( \\\r\n strcmp(stack[stack_top]->identifier, name) == 0, \\\r\n \"unbalanced begin_struct/end_struct\"); \\\r\n stack_top--; \\\r\n }\r\n\r\n\r\n#define end_struct_array(name) end_struct(name)\r\n\r\n\r\n#define end_struct_dictionary(name) end_struct(name)\r\n\r\n\r\n#define declare_integer(name) { \\\r\n FAIL_ON_ERROR(yr_object_create( \\\r\n OBJECT_TYPE_INTEGER, \\\r\n name, \\\r\n stack[stack_top], \\\r\n NULL)); \\\r\n }\r\n\r\n\r\n#define declare_integer_array(name) { \\\r\n YR_OBJECT* array; \\\r\n FAIL_ON_ERROR(yr_object_create( \\\r\n OBJECT_TYPE_ARRAY, \\\r\n name, \\\r\n stack[stack_top], \\\r\n &array)); \\\r\n FAIL_ON_ERROR(yr_object_create( \\\r\n OBJECT_TYPE_INTEGER, \\\r\n name, \\\r\n array, \\\r\n NULL)); \\\r\n }\r\n\r\n\r\n#define declare_integer_dictionary(name) { \\\r\n YR_OBJECT* dict; \\\r\n FAIL_ON_ERROR(yr_object_create( \\\r\n OBJECT_TYPE_DICTIONARY, \\\r\n name, \\\r\n stack[stack_top], \\\r\n &dict)); \\\r\n FAIL_ON_ERROR(yr_object_create( \\\r\n OBJECT_TYPE_INTEGER, \\\r\n name, \\\r\n dict, \\\r\n NULL)); \\\r\n }\r\n\r\n\r\n#define declare_float(name) { \\\r\n FAIL_ON_ERROR(yr_object_create( \\\r\n OBJECT_TYPE_FLOAT, \\\r\n name, \\\r\n stack[stack_top], \\\r\n NULL)); \\\r\n }\r\n\r\n\r\n#define declare_float_array(name) { \\\r\n YR_OBJECT* array; \\\r\n FAIL_ON_ERROR(yr_object_create( \\\r\n OBJECT_TYPE_ARRAY, \\\r\n name, \\\r\n stack[stack_top], \\\r\n &array)); \\\r\n FAIL_ON_ERROR(yr_object_create( \\\r\n OBJECT_TYPE_FLOAT, \\\r\n name, \\\r\n array, \\\r\n NULL)); \\\r\n }\r\n\r\n\r\n#define declare_float_dictionary(name) { \\\r\n YR_OBJECT* dict; \\\r\n FAIL_ON_ERROR(yr_object_create( \\\r\n OBJECT_TYPE_DICTIONARY, \\\r\n name, \\\r\n stack[stack_top], \\\r\n &dict)); \\\r\n FAIL_ON_ERROR(yr_object_create( \\\r\n OBJECT_TYPE_FLOAT, \\\r\n name, \\\r\n dict, \\\r\n NULL)); \\\r\n }\r\n\r\n\r\n#define declare_string(name) { \\\r\n FAIL_ON_ERROR(yr_object_create( \\\r\n OBJECT_TYPE_STRING, \\\r\n name, \\\r\n stack[stack_top], \\\r\n NULL)); \\\r\n }\r\n\r\n\r\n#define declare_string_array(name) { \\\r\n YR_OBJECT* array; \\\r\n FAIL_ON_ERROR(yr_object_create( \\\r\n OBJECT_TYPE_ARRAY, \\\r\n name, \\\r\n stack[stack_top], \\\r\n &array)); \\\r\n FAIL_ON_ERROR(yr_object_create( \\\r\n OBJECT_TYPE_STRING, \\\r\n name, \\\r\n array, \\\r\n NULL)); \\\r\n }\r\n\r\n\r\n#define declare_string_dictionary(name) { \\\r\n YR_OBJECT* dict; \\\r\n FAIL_ON_ERROR(yr_object_create( \\\r\n OBJECT_TYPE_DICTIONARY, \\\r\n name, \\\r\n stack[stack_top], \\\r\n &dict)); \\\r\n FAIL_ON_ERROR(yr_object_create( \\\r\n OBJECT_TYPE_STRING, \\\r\n name, \\\r\n dict, \\\r\n NULL)); \\\r\n }\r\n\r\n\r\n#define declare_function(name, args_fmt, ret_fmt, func) { \\\r\n YR_OBJECT* function; \\\r\n FAIL_ON_ERROR(yr_object_function_create( \\\r\n name, \\\r\n args_fmt, \\\r\n ret_fmt, \\\r\n func, \\\r\n stack[stack_top], \\\r\n &function)); \\\r\n }\r\n\r\n\r\n#define define_function(func) \\\r\n int func ( \\\r\n YR_VALUE* __args, \\\r\n YR_SCAN_CONTEXT* __context, \\\r\n YR_OBJECT_FUNCTION* __function_obj)\r\n\r\n\r\n#define sized_string_argument(n) \\\r\n (__args[n-1].ss)\r\n\r\n#define string_argument(n) \\\r\n (sized_string_argument(n)->c_string)\r\n\r\n#define integer_argument(n) \\\r\n (__args[n-1].i)\r\n\r\n#define float_argument(n) \\\r\n (__args[n-1].d)\r\n\r\n#define regexp_argument(n) \\\r\n ((RE*)(__args[n-1].re))\r\n\r\n\r\n#define module() yr_object_get_root((YR_OBJECT*) __function_obj)\r\n#define parent() (__function_obj->parent)\r\n#define scan_context() (__context)\r\n\r\n\r\n#define foreach_memory_block(iterator, block) \\\r\n for (block = iterator->first(iterator); \\\r\n block != NULL; \\\r\n block = iterator->next(iterator)) \\\r\n\r\n\r\n#define first_memory_block(context) \\\r\n (context)->iterator->first((context)->iterator)\r\n\r\n\r\n#define is_undefined(object, ...) \\\r\n yr_object_has_undefined_value(object, __VA_ARGS__)\r\n\r\n\r\n#define get_object(object, ...) \\\r\n yr_object_lookup(object, 0, __VA_ARGS__)\r\n\r\n\r\n#define get_integer(object, ...) \\\r\n yr_object_get_integer(object, __VA_ARGS__)\r\n\r\n\r\n#define get_float(object, ...) \\\r\n yr_object_get_float(object, __VA_ARGS__)\r\n\r\n\r\n#define get_string(object, ...) \\\r\n yr_object_get_string(object, __VA_ARGS__)\r\n\r\n\r\n#define set_integer(value, object, ...) \\\r\n yr_object_set_integer(value, object, __VA_ARGS__)\r\n\r\n\r\n#define set_float(value, object, ...) \\\r\n yr_object_set_float(value, object, __VA_ARGS__)\r\n\r\n\r\n#define set_sized_string(value, len, object, ...) \\\r\n yr_object_set_string(value, len, object, __VA_ARGS__)\r\n\r\n\r\n#define set_string(value, object, ...) \\\r\n set_sized_string(value, strlen(value), object, __VA_ARGS__)\r\n\r\n\r\n#define return_integer(integer) { \\\r\n assertf( \\\r\n __function_obj->return_obj->type == OBJECT_TYPE_INTEGER, \\\r\n \"return type differs from function declaration\"); \\\r\n yr_object_set_integer( \\\r\n (integer), \\\r\n __function_obj->return_obj, \\\r\n NULL); \\\r\n return ERROR_SUCCESS; \\\r\n }\r\n\r\n\r\n#define return_float(double_) { \\\r\n double d = (double) (double_); \\\r\n assertf( \\\r\n __function_obj->return_obj->type == OBJECT_TYPE_FLOAT, \\\r\n \"return type differs from function declaration\"); \\\r\n yr_object_set_float( \\\r\n (d != (double) UNDEFINED) ? d : NAN, \\\r\n __function_obj->return_obj, \\\r\n NULL); \\\r\n return ERROR_SUCCESS; \\\r\n }\r\n\r\n\r\n#define return_string(string) { \\\r\n char* s = (char*) (string); \\\r\n assertf( \\\r\n __function_obj->return_obj->type == OBJECT_TYPE_STRING, \\\r\n \"return type differs from function declaration\"); \\\r\n yr_object_set_string( \\\r\n (s != (char*) UNDEFINED) ? s : NULL, \\\r\n (s != (char*) UNDEFINED) ? strlen(s) : 0, \\\r\n __function_obj->return_obj, \\\r\n NULL); \\\r\n return ERROR_SUCCESS; \\\r\n }\r\n\r\n\r\nstruct _YR_MODULE;\r\n\r\n\r\ntypedef int (*YR_EXT_INITIALIZE_FUNC)(\r\n struct _YR_MODULE* module);\r\n\r\n\r\ntypedef int (*YR_EXT_FINALIZE_FUNC)(\r\n struct _YR_MODULE* module);\r\n\r\n\r\ntypedef int (*YR_EXT_DECLARATIONS_FUNC)(\r\n YR_OBJECT* module_object);\r\n\r\n\r\ntypedef int (*YR_EXT_LOAD_FUNC)(\r\n YR_SCAN_CONTEXT* context,\r\n YR_OBJECT* module_object,\r\n void* module_data,\r\n size_t module_data_size);\r\n\r\n\r\ntypedef int (*YR_EXT_UNLOAD_FUNC)(\r\n YR_OBJECT* module_object);\r\n\r\n\r\ntypedef struct _YR_MODULE\r\n{\r\n char* name;\r\n\r\n YR_EXT_DECLARATIONS_FUNC declarations;\r\n YR_EXT_LOAD_FUNC load;\r\n YR_EXT_UNLOAD_FUNC unload;\r\n YR_EXT_INITIALIZE_FUNC initialize;\r\n YR_EXT_FINALIZE_FUNC finalize;\r\n\r\n} YR_MODULE;\r\n\r\n\r\ntypedef struct _YR_MODULE_IMPORT\r\n{\r\n const char* module_name;\r\n void* module_data;\r\n size_t module_data_size;\r\n\r\n} YR_MODULE_IMPORT;\r\n\r\n\r\nint yr_modules_initialize(void);\r\n\r\n\r\nint yr_modules_finalize(void);\r\n\r\n\r\nint yr_modules_do_declarations(\r\n const char* module_name,\r\n YR_OBJECT* main_structure);\r\n\r\n\r\nint yr_modules_load(\r\n const char* module_name,\r\n YR_SCAN_CONTEXT* context);\r\n\r\n\r\nint yr_modules_unload_all(\r\n YR_SCAN_CONTEXT* context);\r\n\r\n#endif\r\n" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara/object.h", "content": "/*\r\nCopyright (c) 2014. The YARA Authors. All Rights Reserved.\r\n\r\nRedistribution and use in source and binary forms, with or without modification,\r\nare permitted provided that the following conditions are met:\r\n\r\n1. Redistributions of source code must retain the above copyright notice, this\r\nlist of conditions and the following disclaimer.\r\n\r\n2. Redistributions in binary form must reproduce the above copyright notice,\r\nthis list of conditions and the following disclaimer in the documentation and/or\r\nother materials provided with the distribution.\r\n\r\n3. Neither the name of the copyright holder nor the names of its contributors\r\nmay be used to endorse or promote products derived from this software without\r\nspecific prior written permission.\r\n\r\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\r\nANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\r\nWARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\r\nDISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR\r\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\r\n(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\r\nLOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\r\nANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\r\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\r\nSOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\r\n*/\r\n\r\n#ifndef YR_OBJECT_H\r\n#define YR_OBJECT_H\r\n\r\n#ifdef _MSC_VER\r\n\r\n#include \r\n#ifndef isnan\r\n#define isnan _isnan\r\n#endif\r\n\r\n#ifndef INFINITY\r\n#define INFINITY (DBL_MAX + DBL_MAX)\r\n#endif\r\n\r\n#ifndef NAN\r\n#define NAN (INFINITY-INFINITY)\r\n#endif\r\n\r\n#endif\r\n\r\n#include \"types.h\"\r\n\r\n\r\n#define OBJECT_CREATE 1\r\n\r\n#define OBJECT_TYPE_INTEGER 1\r\n#define OBJECT_TYPE_STRING 2\r\n#define OBJECT_TYPE_STRUCTURE 3\r\n#define OBJECT_TYPE_ARRAY 4\r\n#define OBJECT_TYPE_FUNCTION 5\r\n#define OBJECT_TYPE_DICTIONARY 6\r\n#define OBJECT_TYPE_FLOAT 7\r\n\r\n\r\nint yr_object_create(\r\n int8_t type,\r\n const char* identifier,\r\n YR_OBJECT* parent,\r\n YR_OBJECT** object);\r\n\r\n\r\nint yr_object_function_create(\r\n const char* identifier,\r\n const char* arguments_fmt,\r\n const char* return_fmt,\r\n YR_MODULE_FUNC func,\r\n YR_OBJECT* parent,\r\n YR_OBJECT** function);\r\n\r\n\r\nint yr_object_from_external_variable(\r\n YR_EXTERNAL_VARIABLE* external,\r\n YR_OBJECT** object);\r\n\r\n\r\nvoid yr_object_destroy(\r\n YR_OBJECT* object);\r\n\r\n\r\nint yr_object_copy(\r\n YR_OBJECT* object,\r\n YR_OBJECT** object_copy);\r\n\r\n\r\nYR_OBJECT* yr_object_lookup_field(\r\n YR_OBJECT* object,\r\n const char* field_name);\r\n\r\n\r\nYR_OBJECT* yr_object_lookup(\r\n YR_OBJECT* root,\r\n int flags,\r\n const char* pattern,\r\n ...);\r\n\r\n\r\nint yr_object_has_undefined_value(\r\n YR_OBJECT* object,\r\n const char* field,\r\n ...);\r\n\r\nint64_t yr_object_get_integer(\r\n YR_OBJECT* object,\r\n const char* field,\r\n ...);\r\n\r\n\r\nSIZED_STRING* yr_object_get_string(\r\n YR_OBJECT* object,\r\n const char* field,\r\n ...);\r\n\r\n\r\nint yr_object_set_integer(\r\n int64_t value,\r\n YR_OBJECT* object,\r\n const char* field,\r\n ...);\r\n\r\n\r\nint yr_object_set_float(\r\n double value,\r\n YR_OBJECT* object,\r\n const char* field,\r\n ...);\r\n\r\n\r\nint yr_object_set_string(\r\n const char* value,\r\n size_t len,\r\n YR_OBJECT* object,\r\n const char* field,\r\n ...);\r\n\r\n\r\nYR_OBJECT* yr_object_array_get_item(\r\n YR_OBJECT* object,\r\n int flags,\r\n int index);\r\n\r\n\r\nint yr_object_array_set_item(\r\n YR_OBJECT* object,\r\n YR_OBJECT* item,\r\n int index);\r\n\r\n\r\nYR_OBJECT* yr_object_dict_get_item(\r\n YR_OBJECT* object,\r\n int flags,\r\n const char* key);\r\n\r\n\r\nint yr_object_dict_set_item(\r\n YR_OBJECT* object,\r\n YR_OBJECT* item,\r\n const char* key);\r\n\r\n\r\nint yr_object_structure_set_member(\r\n YR_OBJECT* object,\r\n YR_OBJECT* member);\r\n\r\n\r\nYR_OBJECT* yr_object_get_root(\r\n YR_OBJECT* object);\r\n\r\n\r\nYR_API void yr_object_print_data(\r\n YR_OBJECT* object,\r\n int indent,\r\n int print_identifier);\r\n\r\n\r\n#endif\r\n" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara/parser.h", "content": "/*\r\nCopyright (c) 2013. The YARA Authors. All Rights Reserved.\r\n\r\nRedistribution and use in source and binary forms, with or without modification,\r\nare permitted provided that the following conditions are met:\r\n\r\n1. Redistributions of source code must retain the above copyright notice, this\r\nlist of conditions and the following disclaimer.\r\n\r\n2. Redistributions in binary form must reproduce the above copyright notice,\r\nthis list of conditions and the following disclaimer in the documentation and/or\r\nother materials provided with the distribution.\r\n\r\n3. Neither the name of the copyright holder nor the names of its contributors\r\nmay be used to endorse or promote products derived from this software without\r\nspecific prior written permission.\r\n\r\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\r\nANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\r\nWARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\r\nDISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR\r\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\r\n(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\r\nLOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\r\nANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\r\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\r\nSOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\r\n*/\r\n\r\n#ifndef YR_PARSER_H\r\n#define YR_PARSER_H\r\n\r\n\r\n#include \"lexer.h\"\r\n\r\n\r\nint yr_parser_emit(\r\n yyscan_t yyscanner,\r\n uint8_t instruction,\r\n uint8_t** instruction_address);\r\n\r\n\r\nint yr_parser_emit_with_arg(\r\n yyscan_t yyscanner,\r\n uint8_t instruction,\r\n int64_t argument,\r\n uint8_t** instruction_address,\r\n int64_t** argument_address);\r\n\r\n\r\nint yr_parser_emit_with_arg_double(\r\n yyscan_t yyscanner,\r\n uint8_t instruction,\r\n double argument,\r\n uint8_t** instruction_address,\r\n double** argument_address);\r\n\r\n\r\nint yr_parser_emit_with_arg_reloc(\r\n yyscan_t yyscanner,\r\n uint8_t instruction,\r\n void* argument,\r\n uint8_t** instruction_address,\r\n void** argument_address);\r\n\r\n\r\nint yr_parser_check_types(\r\n YR_COMPILER* compiler,\r\n YR_OBJECT_FUNCTION* function,\r\n const char* actual_args_fmt);\r\n\r\n\r\nYR_STRING* yr_parser_lookup_string(\r\n yyscan_t yyscanner,\r\n const char* identifier);\r\n\r\n\r\nint yr_parser_lookup_loop_variable(\r\n yyscan_t yyscanner,\r\n const char* identifier);\r\n\r\n\r\nYR_RULE* yr_parser_reduce_rule_declaration_phase_1(\r\n yyscan_t yyscanner,\r\n int32_t flags,\r\n const char* identifier);\r\n\r\n\r\nint yr_parser_reduce_rule_declaration_phase_2(\r\n yyscan_t yyscanner,\r\n YR_RULE* rule);\r\n\r\n\r\nYR_STRING* yr_parser_reduce_string_declaration(\r\n yyscan_t yyscanner,\r\n int32_t flags,\r\n const char* identifier,\r\n SIZED_STRING* str);\r\n\r\n\r\nYR_META* yr_parser_reduce_meta_declaration(\r\n yyscan_t yyscanner,\r\n int32_t type,\r\n const char* identifier,\r\n const char* string,\r\n int64_t integer);\r\n\r\n\r\nint yr_parser_reduce_string_identifier(\r\n yyscan_t yyscanner,\r\n const char* identifier,\r\n uint8_t instruction,\r\n uint64_t at_offset);\r\n\r\n\r\nint yr_parser_emit_pushes_for_strings(\r\n yyscan_t yyscanner,\r\n const char* identifier);\r\n\r\n\r\nint yr_parser_reduce_external(\r\n yyscan_t yyscanner,\r\n const char* identifier,\r\n uint8_t instruction);\r\n\r\n\r\nint yr_parser_reduce_import(\r\n yyscan_t yyscanner,\r\n SIZED_STRING* module_name);\r\n\r\n\r\nint yr_parser_reduce_operation(\r\n yyscan_t yyscanner,\r\n const char* operation,\r\n EXPRESSION left_operand,\r\n EXPRESSION right_operand);\r\n\r\n#endif\r\n" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara/pe.h", "content": "/*\r\nCopyright (c) 2013. The YARA Authors. All Rights Reserved.\r\n\r\nRedistribution and use in source and binary forms, with or without modification,\r\nare permitted provided that the following conditions are met:\r\n\r\n1. Redistributions of source code must retain the above copyright notice, this\r\nlist of conditions and the following disclaimer.\r\n\r\n2. Redistributions in binary form must reproduce the above copyright notice,\r\nthis list of conditions and the following disclaimer in the documentation and/or\r\nother materials provided with the distribution.\r\n\r\n3. Neither the name of the copyright holder nor the names of its contributors\r\nmay be used to endorse or promote products derived from this software without\r\nspecific prior written permission.\r\n\r\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\r\nANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\r\nWARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\r\nDISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR\r\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\r\n(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\r\nLOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\r\nANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\r\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\r\nSOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\r\n*/\r\n\r\n#ifndef YR_PE_H\r\n#define YR_PE_H\r\n\r\n#include \"endian.h\"\r\n#include \"types.h\"\r\n\r\n#pragma pack(push, 1)\r\n\r\n#if defined(_WIN32) || defined(__CYGWIN__)\r\n#include \r\n\r\n// These definitions are not present in older Windows headers.\r\n\r\n#ifndef IMAGE_FILE_MACHINE_ARMNT\r\n#define IMAGE_FILE_MACHINE_ARMNT 0x01c4\r\n#endif\r\n\r\n#ifndef IMAGE_FILE_MACHINE_ARM64\r\n#define IMAGE_FILE_MACHINE_ARM64 0xaa64\r\n#endif\r\n\r\n#else\r\n\r\n#include \r\n\r\n#include \"integers.h\"\r\n\r\ntypedef uint8_t BYTE;\r\ntypedef uint16_t WORD;\r\ntypedef uint32_t DWORD;\r\ntypedef int32_t LONG;\r\ntypedef uint32_t ULONG;\r\ntypedef uint64_t ULONGLONG;\r\n\r\n\r\n#define FIELD_OFFSET(type, field) ((size_t)&(((type *)0)->field))\r\n\r\n#ifndef _MAC\r\n\r\n#define IMAGE_DOS_SIGNATURE 0x5A4D // MZ\r\n#define IMAGE_OS2_SIGNATURE 0x454E // NE\r\n#define IMAGE_OS2_SIGNATURE_LE 0x454C // LE\r\n#define IMAGE_VXD_SIGNATURE 0x454C // LE\r\n#define IMAGE_NT_SIGNATURE 0x00004550 // PE00\r\n\r\n#else\r\n\r\n#define IMAGE_DOS_SIGNATURE 0x4D5A // MZ\r\n#define IMAGE_OS2_SIGNATURE 0x4E45 // NE\r\n#define IMAGE_OS2_SIGNATURE_LE 0x4C45 // LE\r\n#define IMAGE_NT_SIGNATURE 0x50450000 // PE00\r\n\r\n#endif\r\n\r\n#pragma pack(push, 2)\r\n\r\ntypedef struct _IMAGE_DOS_HEADER // DOS .EXE header\r\n{\r\n WORD e_magic; // Magic number\r\n WORD e_cblp; // Bytes on last page of file\r\n WORD e_cp; // Pages in file\r\n WORD e_crlc; // Relocations\r\n WORD e_cparhdr; // Size of header in paragraphs\r\n WORD e_minalloc; // Minimum extra paragraphs needed\r\n WORD e_maxalloc; // Maximum extra paragraphs needed\r\n WORD e_ss; // Initial (relative) SS value\r\n WORD e_sp; // Initial SP value\r\n WORD e_csum; // Checksum\r\n WORD e_ip; // Initial IP value\r\n WORD e_cs; // Initial (relative) CS value\r\n WORD e_lfarlc; // File address of relocation table\r\n WORD e_ovno; // Overlay number\r\n WORD e_res[4]; // Reserved words\r\n WORD e_oemid; // OEM identifier (for e_oeminfo)\r\n WORD e_oeminfo; // OEM information; e_oemid specific\r\n WORD e_res2[10]; // Reserved words\r\n LONG e_lfanew; // File address of new exe header\r\n} IMAGE_DOS_HEADER, *PIMAGE_DOS_HEADER;\r\n\r\n#pragma pack(pop)\r\n\r\n//\r\n// File header format.\r\n//\r\n\r\n#pragma pack(push,4)\r\n\r\ntypedef struct _IMAGE_FILE_HEADER\r\n{\r\n WORD Machine;\r\n WORD NumberOfSections;\r\n DWORD TimeDateStamp;\r\n DWORD PointerToSymbolTable;\r\n DWORD NumberOfSymbols;\r\n WORD SizeOfOptionalHeader;\r\n WORD Characteristics;\r\n} IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER;\r\n\r\n\r\n\r\n#define IMAGE_SIZEOF_FILE_HEADER 20\r\n\r\n\r\n#define IMAGE_FILE_RELOCS_STRIPPED 0x0001 // Relocation info stripped from file.\r\n#define IMAGE_FILE_EXECUTABLE_IMAGE 0x0002 // File is executable (i.e. no unresolved external references).\r\n#define IMAGE_FILE_LINE_NUMS_STRIPPED 0x0004 // Line numbers stripped from file.\r\n#define IMAGE_FILE_LOCAL_SYMS_STRIPPED 0x0008 // Local symbols stripped from file.\r\n#define IMAGE_FILE_AGGRESIVE_WS_TRIM 0x0010 // Aggressively trim working set\r\n#define IMAGE_FILE_LARGE_ADDRESS_AWARE 0x0020 // App can handle >2gb addresses\r\n#define IMAGE_FILE_BYTES_REVERSED_LO 0x0080 // Bytes of machine word are reversed.\r\n#define IMAGE_FILE_32BIT_MACHINE 0x0100 // 32 bit word machine.\r\n#define IMAGE_FILE_DEBUG_STRIPPED 0x0200 // Debugging info stripped from file in .DBG file\r\n#define IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP 0x0400 // If Image is on removable media, copy and run from the swap file.\r\n#define IMAGE_FILE_NET_RUN_FROM_SWAP 0x0800 // If Image is on Net, copy and run from the swap file.\r\n#define IMAGE_FILE_SYSTEM 0x1000 // System File.\r\n#define IMAGE_FILE_DLL 0x2000 // File is a DLL.\r\n#define IMAGE_FILE_UP_SYSTEM_ONLY 0x4000 // File should only be run on a UP machine\r\n#define IMAGE_FILE_BYTES_REVERSED_HI 0x8000 // Bytes of machine word are reversed.\r\n\r\n\r\n#define IMAGE_FILE_MACHINE_UNKNOWN 0x0000\r\n#define IMAGE_FILE_MACHINE_AM33 0x01d3\r\n#define IMAGE_FILE_MACHINE_AMD64 0x8664\r\n#define IMAGE_FILE_MACHINE_ARM 0x01c0\r\n#define IMAGE_FILE_MACHINE_ARMNT 0x01c4\r\n#define IMAGE_FILE_MACHINE_ARM64 0xaa64\r\n#define IMAGE_FILE_MACHINE_EBC 0x0ebc\r\n#define IMAGE_FILE_MACHINE_I386 0x014c\r\n#define IMAGE_FILE_MACHINE_IA64 0x0200\r\n#define IMAGE_FILE_MACHINE_M32R 0x9041\r\n#define IMAGE_FILE_MACHINE_MIPS16 0x0266\r\n#define IMAGE_FILE_MACHINE_MIPSFPU 0x0366\r\n#define IMAGE_FILE_MACHINE_MIPSFPU16 0x0466\r\n#define IMAGE_FILE_MACHINE_POWERPC 0x01f0\r\n#define IMAGE_FILE_MACHINE_POWERPCFP 0x01f1\r\n#define IMAGE_FILE_MACHINE_R4000 0x0166\r\n#define IMAGE_FILE_MACHINE_SH3 0x01a2\r\n#define IMAGE_FILE_MACHINE_SH3DSP 0x01a3\r\n#define IMAGE_FILE_MACHINE_SH4 0x01a6\r\n#define IMAGE_FILE_MACHINE_SH5 0x01a8\r\n#define IMAGE_FILE_MACHINE_THUMB 0x01c2\r\n#define IMAGE_FILE_MACHINE_WCEMIPSV2 0x0169\r\n\r\n// Section characteristics\r\n#define IMAGE_SCN_CNT_CODE 0x00000020\r\n#define IMAGE_SCN_CNT_INITIALIZED_DATA 0x00000040\r\n#define IMAGE_SCN_CNT_UNINITIALIZED_DATA 0x00000080\r\n#define IMAGE_SCN_GPREL 0x00008000\r\n#define IMAGE_SCN_MEM_16BIT 0x00020000\r\n#define IMAGE_SCN_LNK_NRELOC_OVFL 0x01000000\r\n#define IMAGE_SCN_MEM_DISCARDABLE 0x02000000\r\n#define IMAGE_SCN_MEM_NOT_CACHED 0x04000000\r\n#define IMAGE_SCN_MEM_NOT_PAGED 0x08000000\r\n#define IMAGE_SCN_MEM_SHARED 0x10000000\r\n#define IMAGE_SCN_MEM_EXECUTE 0x20000000\r\n#define IMAGE_SCN_MEM_READ 0x40000000\r\n#define IMAGE_SCN_MEM_WRITE 0x80000000\r\n\r\n//\r\n// Directory format.\r\n//\r\n\r\ntypedef struct _IMAGE_DATA_DIRECTORY\r\n{\r\n DWORD VirtualAddress;\r\n DWORD Size;\r\n} IMAGE_DATA_DIRECTORY, *PIMAGE_DATA_DIRECTORY;\r\n\r\n#define IMAGE_NUMBEROF_DIRECTORY_ENTRIES 16\r\n\r\n\r\n#define IMAGE_DIRECTORY_ENTRY_EXPORT 0 // Export Directory\r\n#define IMAGE_DIRECTORY_ENTRY_IMPORT 1 // Import Directory\r\n#define IMAGE_DIRECTORY_ENTRY_RESOURCE 2 // Resource Directory\r\n#define IMAGE_DIRECTORY_ENTRY_EXCEPTION 3 // Exception Directory\r\n#define IMAGE_DIRECTORY_ENTRY_SECURITY 4 // Security Directory\r\n#define IMAGE_DIRECTORY_ENTRY_BASERELOC 5 // Base Relocation Table\r\n#define IMAGE_DIRECTORY_ENTRY_DEBUG 6 // Debug Directory\r\n#define IMAGE_DIRECTORY_ENTRY_COPYRIGHT 7 // (X86 usage)\r\n#define IMAGE_DIRECTORY_ENTRY_ARCHITECTURE 7 // Architecture Specific Data\r\n#define IMAGE_DIRECTORY_ENTRY_GLOBALPTR 8 // RVA of GP\r\n#define IMAGE_DIRECTORY_ENTRY_TLS 9 // TLS Directory\r\n#define IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG 10 // Load Configuration Directory\r\n#define IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT 11 // Bound Import Directory in headers\r\n#define IMAGE_DIRECTORY_ENTRY_IAT 12 // Import Address Table\r\n#define IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT 13 // Delay Load Import Descriptors\r\n#define IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 14 // COM Runtime descriptor\r\n\r\n\r\n//\r\n// Optional header format.\r\n//\r\n\r\ntypedef struct _IMAGE_OPTIONAL_HEADER32\r\n{\r\n WORD Magic;\r\n BYTE MajorLinkerVersion;\r\n BYTE MinorLinkerVersion;\r\n DWORD SizeOfCode;\r\n DWORD SizeOfInitializedData;\r\n DWORD SizeOfUninitializedData;\r\n DWORD AddressOfEntryPoint;\r\n DWORD BaseOfCode;\r\n DWORD BaseOfData;\r\n DWORD ImageBase;\r\n DWORD SectionAlignment;\r\n DWORD FileAlignment;\r\n WORD MajorOperatingSystemVersion;\r\n WORD MinorOperatingSystemVersion;\r\n WORD MajorImageVersion;\r\n WORD MinorImageVersion;\r\n WORD MajorSubsystemVersion;\r\n WORD MinorSubsystemVersion;\r\n DWORD Win32VersionValue;\r\n DWORD SizeOfImage;\r\n DWORD SizeOfHeaders;\r\n DWORD CheckSum;\r\n WORD Subsystem;\r\n WORD DllCharacteristics;\r\n DWORD SizeOfStackReserve;\r\n DWORD SizeOfStackCommit;\r\n DWORD SizeOfHeapReserve;\r\n DWORD SizeOfHeapCommit;\r\n DWORD LoaderFlags;\r\n DWORD NumberOfRvaAndSizes;\r\n IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];\r\n\r\n} IMAGE_OPTIONAL_HEADER32, *PIMAGE_OPTIONAL_HEADER32;\r\n\r\n\r\ntypedef struct _IMAGE_OPTIONAL_HEADER64\r\n{\r\n WORD Magic;\r\n BYTE MajorLinkerVersion;\r\n BYTE MinorLinkerVersion;\r\n DWORD SizeOfCode;\r\n DWORD SizeOfInitializedData;\r\n DWORD SizeOfUninitializedData;\r\n DWORD AddressOfEntryPoint;\r\n DWORD BaseOfCode;\r\n ULONGLONG ImageBase;\r\n DWORD SectionAlignment;\r\n DWORD FileAlignment;\r\n WORD MajorOperatingSystemVersion;\r\n WORD MinorOperatingSystemVersion;\r\n WORD MajorImageVersion;\r\n WORD MinorImageVersion;\r\n WORD MajorSubsystemVersion;\r\n WORD MinorSubsystemVersion;\r\n DWORD Win32VersionValue;\r\n DWORD SizeOfImage;\r\n DWORD SizeOfHeaders;\r\n DWORD CheckSum;\r\n WORD Subsystem;\r\n WORD DllCharacteristics;\r\n ULONGLONG SizeOfStackReserve;\r\n ULONGLONG SizeOfStackCommit;\r\n ULONGLONG SizeOfHeapReserve;\r\n ULONGLONG SizeOfHeapCommit;\r\n DWORD LoaderFlags;\r\n DWORD NumberOfRvaAndSizes;\r\n IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];\r\n\r\n} IMAGE_OPTIONAL_HEADER64, *PIMAGE_OPTIONAL_HEADER64;\r\n\r\n\r\n#define IMAGE_NT_OPTIONAL_HDR32_MAGIC 0x10b\r\n#define IMAGE_NT_OPTIONAL_HDR64_MAGIC 0x20b\r\n\r\n\r\ntypedef struct _IMAGE_NT_HEADERS32\r\n{\r\n DWORD Signature;\r\n IMAGE_FILE_HEADER FileHeader;\r\n IMAGE_OPTIONAL_HEADER32 OptionalHeader;\r\n\r\n} IMAGE_NT_HEADERS32, *PIMAGE_NT_HEADERS32;\r\n\r\n\r\ntypedef struct _IMAGE_NT_HEADERS64\r\n{\r\n DWORD Signature;\r\n IMAGE_FILE_HEADER FileHeader;\r\n IMAGE_OPTIONAL_HEADER64 OptionalHeader;\r\n\r\n} IMAGE_NT_HEADERS64, *PIMAGE_NT_HEADERS64;\r\n\r\n// IMAGE_FIRST_SECTION doesn't need 32/64 versions since the file header is\r\n// the same either way.\r\n\r\n#define IMAGE_FIRST_SECTION( ntheader ) ((PIMAGE_SECTION_HEADER) \\\r\n ((BYTE*)ntheader + \\\r\n FIELD_OFFSET( IMAGE_NT_HEADERS32, OptionalHeader ) + \\\r\n yr_le16toh(((PIMAGE_NT_HEADERS32)(ntheader))->FileHeader.SizeOfOptionalHeader) \\\r\n ))\r\n\r\n// Subsystem Values\r\n\r\n#define IMAGE_SUBSYSTEM_UNKNOWN 0\r\n#define IMAGE_SUBSYSTEM_NATIVE 1\r\n#define IMAGE_SUBSYSTEM_WINDOWS_GUI 2\r\n#define IMAGE_SUBSYSTEM_WINDOWS_CUI 3\r\n#define IMAGE_SUBSYSTEM_OS2_CUI 5\r\n#define IMAGE_SUBSYSTEM_POSIX_CUI 7\r\n#define IMAGE_SUBSYSTEM_NATIVE_WINDOWS 8\r\n#define IMAGE_SUBSYSTEM_WINDOWS_CE_GUI 9\r\n#define IMAGE_SUBSYSTEM_EFI_APPLICATION 10\r\n#define IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER 11\r\n#define IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER 12\r\n#define IMAGE_SUBSYSTEM_EFI_ROM_IMAGE 13\r\n#define IMAGE_SUBSYSTEM_XBOX 14\r\n#define IMAGE_SUBSYSTEM_WINDOWS_BOOT_APPLICATION 16\r\n\r\n// DllCharacteristics values\r\n\r\n#define IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE 0x0040\r\n#define IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY 0x0080\r\n#define IMAGE_DLLCHARACTERISTICS_NX_COMPAT 0x0100\r\n#define IMAGE_DLLCHARACTERISTICS_NO_ISOLATION 0x0200\r\n#define IMAGE_DLLCHARACTERISTICS_NO_SEH 0x0400\r\n#define IMAGE_DLLCHARACTERISTICS_NO_BIND 0x0800\r\n#define IMAGE_DLLCHARACTERISTICS_WDM_DRIVER 0x2000\r\n#define IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE 0x8000\r\n\r\n//\r\n// Section header format.\r\n//\r\n\r\n#define IMAGE_SIZEOF_SHORT_NAME 8\r\n\r\ntypedef struct _IMAGE_SECTION_HEADER\r\n{\r\n BYTE Name[IMAGE_SIZEOF_SHORT_NAME];\r\n union\r\n {\r\n DWORD PhysicalAddress;\r\n DWORD VirtualSize;\r\n } Misc;\r\n DWORD VirtualAddress;\r\n DWORD SizeOfRawData;\r\n DWORD PointerToRawData;\r\n DWORD PointerToRelocations;\r\n DWORD PointerToLinenumbers;\r\n WORD NumberOfRelocations;\r\n WORD NumberOfLinenumbers;\r\n DWORD Characteristics;\r\n\r\n} IMAGE_SECTION_HEADER, *PIMAGE_SECTION_HEADER;\r\n\r\n#define IMAGE_SIZEOF_SECTION_HEADER 40\r\n\r\n\r\ntypedef struct _IMAGE_EXPORT_DIRECTORY\r\n{\r\n DWORD Characteristics;\r\n DWORD TimeDateStamp;\r\n WORD MajorVersion;\r\n WORD MinorVersion;\r\n DWORD Name;\r\n DWORD Base;\r\n DWORD NumberOfFunctions;\r\n DWORD NumberOfNames;\r\n DWORD AddressOfFunctions;\r\n DWORD AddressOfNames;\r\n DWORD AddressOfNameOrdinals;\r\n} IMAGE_EXPORT_DIRECTORY, *PIMAGE_EXPORT_DIRECTORY;\r\n\r\n\r\ntypedef struct _IMAGE_IMPORT_DESCRIPTOR\r\n{\r\n union\r\n {\r\n DWORD Characteristics;\r\n DWORD OriginalFirstThunk;\r\n } ;\r\n DWORD TimeDateStamp;\r\n DWORD ForwarderChain;\r\n DWORD Name;\r\n DWORD FirstThunk;\r\n\r\n} IMAGE_IMPORT_DESCRIPTOR, *PIMAGE_IMPORT_DESCRIPTOR;\r\n\r\n\r\ntypedef struct _IMAGE_IMPORT_BY_NAME\r\n{\r\n WORD Hint;\r\n BYTE Name[1];\r\n\r\n} IMAGE_IMPORT_BY_NAME, *PIMAGE_IMPORT_BY_NAME;\r\n\r\ntypedef struct _IMAGE_THUNK_DATA32\r\n{\r\n union\r\n {\r\n DWORD ForwarderString;\r\n DWORD Function;\r\n DWORD Ordinal;\r\n DWORD AddressOfData;\r\n } u1;\r\n\r\n} IMAGE_THUNK_DATA32, *PIMAGE_THUNK_DATA32;\r\n\r\n\r\n#define IMAGE_ORDINAL_FLAG32 0x80000000\r\n#define IMAGE_ORDINAL_FLAG64 0x8000000000000000L\r\n\r\ntypedef struct _IMAGE_THUNK_DATA64\r\n{\r\n union\r\n {\r\n ULONGLONG ForwarderString;\r\n ULONGLONG Function;\r\n ULONGLONG Ordinal;\r\n ULONGLONG AddressOfData;\r\n } u1;\r\n\r\n} IMAGE_THUNK_DATA64, *PIMAGE_THUNK_DATA64;\r\n\r\n\r\ntypedef struct _IMAGE_RESOURCE_DIRECTORY_ENTRY\r\n{\r\n DWORD Name;\r\n DWORD OffsetToData;\r\n} IMAGE_RESOURCE_DIRECTORY_ENTRY, *PIMAGE_RESOURCE_DIRECTORY_ENTRY;\r\n\r\n\r\ntypedef struct _IMAGE_RESOURCE_DATA_ENTRY\r\n{\r\n DWORD OffsetToData;\r\n DWORD Size;\r\n DWORD CodePage;\r\n DWORD Reserved;\r\n} IMAGE_RESOURCE_DATA_ENTRY, *PIMAGE_RESOURCE_DATA_ENTRY;\r\n\r\n\r\ntypedef struct _IMAGE_RESOURCE_DIRECTORY\r\n{\r\n DWORD Characteristics;\r\n DWORD TimeDateStamp;\r\n WORD MajorVersion;\r\n WORD MinorVersion;\r\n WORD NumberOfNamedEntries;\r\n WORD NumberOfIdEntries;\r\n} IMAGE_RESOURCE_DIRECTORY, *PIMAGE_RESOURCE_DIRECTORY;\r\n\r\n#pragma pack(pop)\r\n\r\n#endif // _WIN32\r\n\r\ntypedef struct _VERSION_INFO\r\n{\r\n WORD Length;\r\n WORD ValueLength;\r\n WORD Type;\r\n char Key[0];\r\n} VERSION_INFO, *PVERSION_INFO;\r\n\r\n\r\n#define WIN_CERT_REVISION_1_0 0x0100\r\n#define WIN_CERT_REVISION_2_0 0x0200\r\n\r\n#define WIN_CERT_TYPE_X509 0x0001\r\n#define WIN_CERT_TYPE_PKCS_SIGNED_DATA 0x0002\r\n#define WIN_CERT_TYPE_RESERVED_1 0x0003\r\n#define WIN_CERT_TYPE_TS_STACK_SIGNED 0x0004\r\n\r\ntypedef struct _WIN_CERTIFICATE\r\n{\r\n DWORD Length;\r\n WORD Revision;\r\n WORD CertificateType;\r\n BYTE Certificate[0];\r\n} WIN_CERTIFICATE, *PWIN_CERTIFICATE;\r\n\r\n\r\n//\r\n// Rich signature.\r\n// http://www.ntcore.com/files/richsign.htm\r\n//\r\n\r\n#define RICH_VERSION_ID(id_version) (id_version >> 16)\r\n#define RICH_VERSION_VERSION(id_version) (id_version & 0xFFFF)\r\n\r\ntypedef struct _RICH_VERSION_INFO\r\n{\r\n DWORD id_version; //tool id and version (use RICH_VERSION_ID and RICH_VERSION_VERSION macros)\r\n DWORD times; //number of times this tool was used\r\n} RICH_VERSION_INFO, *PRICH_VERSION_INFO;\r\n\r\ntypedef struct _RICH_SIGNATURE\r\n{\r\n DWORD dans;\r\n DWORD key1;\r\n DWORD key2;\r\n DWORD key3;\r\n RICH_VERSION_INFO versions[0];\r\n} RICH_SIGNATURE, *PRICH_SIGNATURE;\r\n\r\n#define RICH_DANS 0x536e6144 // \"DanS\"\r\n#define RICH_RICH 0x68636952 // \"Rich\"\r\n\r\n\r\n#pragma pack(pop)\r\n#endif\r\n" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara/pe_utils.h", "content": "#ifndef YR_PE_UTILS_H\n#define YR_PE_UTILS_H\n\n#include \n\n#define MAX_PE_SECTIONS 96\n\n\n#define IS_64BITS_PE(pe) \\\n (yr_le16toh(pe->header64->OptionalHeader.Magic) == IMAGE_NT_OPTIONAL_HDR64_MAGIC)\n\n\n#define OptionalHeader(pe,field) \\\n (IS_64BITS_PE(pe) ? \\\n pe->header64->OptionalHeader.field : \\\n pe->header->OptionalHeader.field)\n\n\n//\n// Imports are stored in a linked list. Each node (IMPORTED_DLL) contains the\n// name of the DLL and a pointer to another linked list of\n// IMPORT_EXPORT_FUNCTION structures containing the details of imported\n// functions.\n//\n\ntypedef struct _IMPORTED_DLL\n{\n char* name;\n\n struct _IMPORT_EXPORT_FUNCTION* functions;\n struct _IMPORTED_DLL* next;\n\n} IMPORTED_DLL, *PIMPORTED_DLL;\n\n\n//\n// This is used to track imported and exported functions. The \"has_ordinal\"\n// field is only used in the case of imports as those are optional. Every export\n// has an ordinal so we don't need the field there, but in the interest of\n// keeping duplicate code to a minimum we use this function for both imports and\n// exports.\n//\n\ntypedef struct _IMPORT_EXPORT_FUNCTION\n{\n char* name;\n uint8_t has_ordinal;\n uint16_t ordinal;\n\n struct _IMPORT_EXPORT_FUNCTION* next;\n\n} IMPORT_EXPORT_FUNCTION, *PIMPORT_EXPORT_FUNCTION;\n\n\ntypedef struct _PE\n{\n uint8_t* data;\n size_t data_size;\n\n union\n {\n PIMAGE_NT_HEADERS32 header;\n PIMAGE_NT_HEADERS64 header64;\n };\n\n YR_OBJECT* object;\n IMPORTED_DLL* imported_dlls;\n IMPORT_EXPORT_FUNCTION* exported_functions;\n\n uint32_t resources;\n\n} PE;\n\n\n#define fits_in_pe(pe, pointer, size) \\\n ((size_t) size <= pe->data_size && \\\n (uint8_t*) (pointer) >= pe->data && \\\n (uint8_t*) (pointer) <= pe->data + pe->data_size - size)\n\n#define struct_fits_in_pe(pe, pointer, struct_type) \\\n fits_in_pe(pe, pointer, sizeof(struct_type))\n\n\nPIMAGE_NT_HEADERS32 pe_get_header(\n uint8_t* data,\n size_t data_size);\n\n\nPIMAGE_DATA_DIRECTORY pe_get_directory_entry(\n PE* pe,\n int entry);\n\n\nPIMAGE_DATA_DIRECTORY pe_get_directory_entry(\n PE* pe,\n int entry);\n\n\nint64_t pe_rva_to_offset(\n PE* pe,\n uint64_t rva);\n\n\nchar* ord_lookup(\n char* dll,\n uint16_t ord);\n\n\n#if HAVE_LIBCRYPTO\n#include \ntime_t ASN1_get_time_t(ASN1_TIME* time);\n#endif\n\n#endif\n" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara/proc.h", "content": "/*\r\nCopyright (c) 2007. The YARA Authors. All Rights Reserved.\r\n\r\nRedistribution and use in source and binary forms, with or without modification,\r\nare permitted provided that the following conditions are met:\r\n\r\n1. Redistributions of source code must retain the above copyright notice, this\r\nlist of conditions and the following disclaimer.\r\n\r\n2. Redistributions in binary form must reproduce the above copyright notice,\r\nthis list of conditions and the following disclaimer in the documentation and/or\r\nother materials provided with the distribution.\r\n\r\n3. Neither the name of the copyright holder nor the names of its contributors\r\nmay be used to endorse or promote products derived from this software without\r\nspecific prior written permission.\r\n\r\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\r\nANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\r\nWARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\r\nDISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR\r\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\r\n(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\r\nLOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\r\nANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\r\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\r\nSOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\r\n*/\r\n\r\n#ifndef YR_PROC_H\r\n#define YR_PROC_H\r\n\r\n#include \"types.h\"\r\n\r\nint yr_process_open_iterator(\r\n int pid,\r\n YR_MEMORY_BLOCK_ITERATOR* iterator);\r\n\r\nint yr_process_close_iterator(\r\n YR_MEMORY_BLOCK_ITERATOR* iterator);\r\n\r\n#endif\r\n" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara/re.h", "content": "/*\r\nCopyright (c) 2013. The YARA Authors. All Rights Reserved.\r\n\r\nRedistribution and use in source and binary forms, with or without modification,\r\nare permitted provided that the following conditions are met:\r\n\r\n1. Redistributions of source code must retain the above copyright notice, this\r\nlist of conditions and the following disclaimer.\r\n\r\n2. Redistributions in binary form must reproduce the above copyright notice,\r\nthis list of conditions and the following disclaimer in the documentation and/or\r\nother materials provided with the distribution.\r\n\r\n3. Neither the name of the copyright holder nor the names of its contributors\r\nmay be used to endorse or promote products derived from this software without\r\nspecific prior written permission.\r\n\r\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\r\nANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\r\nWARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\r\nDISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR\r\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\r\n(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\r\nLOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\r\nANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\r\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\r\nSOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\r\n*/\r\n\r\n#ifndef YR_RE_H\r\n#define YR_RE_H\r\n\r\n#include \r\n\r\n#include \"arena.h\"\r\n#include \"sizedstr.h\"\r\n\r\n#define RE_NODE_LITERAL 1\r\n#define RE_NODE_MASKED_LITERAL 2\r\n#define RE_NODE_ANY 3\r\n#define RE_NODE_CONCAT 4\r\n#define RE_NODE_ALT 5\r\n#define RE_NODE_RANGE 6\r\n#define RE_NODE_STAR 7\r\n#define RE_NODE_PLUS 8\r\n#define RE_NODE_CLASS 9\r\n#define RE_NODE_WORD_CHAR 10\r\n#define RE_NODE_NON_WORD_CHAR 11\r\n#define RE_NODE_SPACE 12\r\n#define RE_NODE_NON_SPACE 13\r\n#define RE_NODE_DIGIT 14\r\n#define RE_NODE_NON_DIGIT 15\r\n#define RE_NODE_EMPTY 16\r\n#define RE_NODE_ANCHOR_START 17\r\n#define RE_NODE_ANCHOR_END 18\r\n#define RE_NODE_WORD_BOUNDARY 19\r\n#define RE_NODE_NON_WORD_BOUNDARY 20\r\n#define RE_NODE_RANGE_ANY 21\r\n\r\n\r\n#define RE_OPCODE_ANY 0xA0\r\n#define RE_OPCODE_ANY_EXCEPT_NEW_LINE 0xA1\r\n#define RE_OPCODE_LITERAL 0xA2\r\n#define RE_OPCODE_MASKED_LITERAL 0xA4\r\n#define RE_OPCODE_CLASS 0xA5\r\n#define RE_OPCODE_WORD_CHAR 0xA7\r\n#define RE_OPCODE_NON_WORD_CHAR 0xA8\r\n#define RE_OPCODE_SPACE 0xA9\r\n#define RE_OPCODE_NON_SPACE 0xAA\r\n#define RE_OPCODE_DIGIT 0xAB\r\n#define RE_OPCODE_NON_DIGIT 0xAC\r\n#define RE_OPCODE_MATCH 0xAD\r\n\r\n#define RE_OPCODE_MATCH_AT_END 0xB0\r\n#define RE_OPCODE_MATCH_AT_START 0xB1\r\n#define RE_OPCODE_WORD_BOUNDARY 0xB2\r\n#define RE_OPCODE_NON_WORD_BOUNDARY 0xB3\r\n#define RE_OPCODE_REPEAT_ANY_GREEDY 0xB4\r\n#define RE_OPCODE_REPEAT_ANY_UNGREEDY 0xB5\r\n\r\n#define RE_OPCODE_SPLIT_A 0xC0\r\n#define RE_OPCODE_SPLIT_B 0xC1\r\n#define RE_OPCODE_JUMP 0xC2\r\n#define RE_OPCODE_REPEAT_START_GREEDY 0xC3\r\n#define RE_OPCODE_REPEAT_END_GREEDY 0xC4\r\n#define RE_OPCODE_REPEAT_START_UNGREEDY 0xC5\r\n#define RE_OPCODE_REPEAT_END_UNGREEDY 0xC6\r\n\r\n\r\n#define RE_FLAGS_FAST_REGEXP 0x02\r\n#define RE_FLAGS_BACKWARDS 0x04\r\n#define RE_FLAGS_EXHAUSTIVE 0x08\r\n#define RE_FLAGS_WIDE 0x10\r\n#define RE_FLAGS_NO_CASE 0x20\r\n#define RE_FLAGS_SCAN 0x40\r\n#define RE_FLAGS_DOT_ALL 0x80\r\n#define RE_FLAGS_GREEDY 0x400\r\n#define RE_FLAGS_UNGREEDY 0x800\r\n\r\n\r\ntypedef struct RE RE;\r\ntypedef struct RE_AST RE_AST;\r\ntypedef struct RE_NODE RE_NODE;\r\ntypedef struct RE_ERROR RE_ERROR;\r\n\r\ntypedef uint8_t RE_SPLIT_ID_TYPE;\r\n\r\n\r\nstruct RE_NODE\r\n{\r\n int type;\r\n\r\n union\r\n {\r\n int value;\r\n int count;\r\n int start;\r\n };\r\n\r\n union\r\n {\r\n int mask;\r\n int end;\r\n };\r\n\r\n int greedy;\r\n\r\n uint8_t* class_vector;\r\n\r\n RE_NODE* left;\r\n RE_NODE* right;\r\n\r\n uint8_t* forward_code;\r\n uint8_t* backward_code;\r\n};\r\n\r\n\r\nstruct RE_AST\r\n{\r\n uint32_t flags;\r\n RE_NODE* root_node;\r\n};\r\n\r\n\r\n// Disable warning due to zero length array in Microsoft's compiler\r\n\r\n#ifdef _MSC_VER\r\n#pragma warning(push)\r\n#pragma warning(disable:4200)\r\n#endif\r\n\r\nstruct RE\r\n{\r\n uint32_t flags;\r\n uint8_t code[0];\r\n};\r\n\r\n#ifdef _MSC_VER\r\n#pragma warning(pop)\r\n#endif\r\n\r\n\r\nstruct RE_ERROR\r\n{\r\n char message[512];\r\n};\r\n\r\n\r\ntypedef int RE_MATCH_CALLBACK_FUNC(\r\n uint8_t* match,\r\n int match_length,\r\n int flags,\r\n void* args);\r\n\r\n\r\nint yr_re_ast_create(\r\n RE_AST** re_ast);\r\n\r\nvoid yr_re_ast_destroy(\r\n RE_AST* re_ast);\r\n\r\nvoid yr_re_ast_print(\r\n RE_AST* re_ast);\r\n\r\nSIZED_STRING* yr_re_ast_extract_literal(\r\n RE_AST* re_ast);\r\n\r\n\r\nint yr_re_ast_contains_dot_star(\r\n RE_AST* re_ast);\r\n\r\n\r\nint yr_re_ast_split_at_chaining_point(\r\n RE_AST* re_ast,\r\n RE_AST** result_re_ast,\r\n RE_AST** remainder_re_ast,\r\n int32_t* min_gap,\r\n int32_t* max_gap);\r\n\r\n\r\nint yr_re_ast_emit_code(\r\n RE_AST* re_ast,\r\n YR_ARENA* arena,\r\n int backwards_code);\r\n\r\n\r\nRE_NODE* yr_re_node_create(\r\n int type,\r\n RE_NODE* left,\r\n RE_NODE* right);\r\n\r\n\r\nvoid yr_re_node_destroy(\r\n RE_NODE* node);\r\n\r\n\r\nint yr_re_exec(\r\n uint8_t* re_code,\r\n uint8_t* input,\r\n size_t input_forwards_size,\r\n size_t input_backwards_size,\r\n int flags,\r\n RE_MATCH_CALLBACK_FUNC callback,\r\n void* callback_args,\r\n int* matches);\r\n\r\n\r\nint yr_re_fast_exec(\r\n uint8_t* code,\r\n uint8_t* input_data,\r\n size_t input_forwards_size,\r\n size_t input_backwards_size,\r\n int flags,\r\n RE_MATCH_CALLBACK_FUNC callback,\r\n void* callback_args,\r\n int* matches);\r\n\r\n\r\nint yr_re_parse(\r\n const char* re_string,\r\n RE_AST** re_ast,\r\n RE_ERROR* error);\r\n\r\n\r\nint yr_re_parse_hex(\r\n const char* hex_string,\r\n RE_AST** re_ast,\r\n RE_ERROR* error);\r\n\r\n\r\nint yr_re_compile(\r\n const char* re_string,\r\n int flags,\r\n YR_ARENA* code_arena,\r\n RE** re,\r\n RE_ERROR* error);\r\n\r\n\r\nint yr_re_match(\r\n RE* re,\r\n const char* target);\r\n\r\n\r\nint yr_re_initialize(void);\r\n\r\n\r\nint yr_re_finalize(void);\r\n\r\n\r\nint yr_re_finalize_thread(void);\r\n\r\n#endif\r\n" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara/re_lexer.h", "content": "/*\r\nCopyright (c) 2013. The YARA Authors. All Rights Reserved.\r\n\r\nRedistribution and use in source and binary forms, with or without modification,\r\nare permitted provided that the following conditions are met:\r\n\r\n1. Redistributions of source code must retain the above copyright notice, this\r\nlist of conditions and the following disclaimer.\r\n\r\n2. Redistributions in binary form must reproduce the above copyright notice,\r\nthis list of conditions and the following disclaimer in the documentation and/or\r\nother materials provided with the distribution.\r\n\r\n3. Neither the name of the copyright holder nor the names of its contributors\r\nmay be used to endorse or promote products derived from this software without\r\nspecific prior written permission.\r\n\r\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\r\nANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\r\nWARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\r\nDISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR\r\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\r\n(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\r\nLOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\r\nANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\r\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\r\nSOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\r\n*/\r\n\r\n#undef yyparse\r\n#undef yylex\r\n#undef yyerror\r\n#undef yyfatal\r\n#undef yychar\r\n#undef yydebug\r\n#undef yynerrs\r\n#undef yyget_extra\r\n#undef yyget_lineno\r\n\r\n#undef YY_FATAL_ERROR\r\n#undef YY_DECL\r\n#undef LEX_ENV\r\n\r\n\r\n#define yyparse re_yyparse\r\n#define yylex re_yylex\r\n#define yyerror re_yyerror\r\n#define yyfatal re_yyfatal\r\n#define yychar re_yychar\r\n#define yydebug re_yydebug\r\n#define yynerrs re_yynerrs\r\n#define yyget_extra re_yyget_extra\r\n#define yyget_lineno re_yyget_lineno\r\n\r\n\r\n#ifndef YY_TYPEDEF_YY_SCANNER_T\r\n#define YY_TYPEDEF_YY_SCANNER_T\r\ntypedef void* yyscan_t;\r\n#endif\r\n\r\n#define YY_EXTRA_TYPE RE_AST*\r\n#define YY_USE_CONST\r\n\r\n\r\ntypedef struct _RE_LEX_ENVIRONMENT\r\n{\r\n int negated_class;\r\n uint8_t class_vector[32];\r\n int last_error_code;\r\n char last_error_message[256];\r\n\r\n} RE_LEX_ENVIRONMENT;\r\n\r\n\r\n#define LEX_ENV ((RE_LEX_ENVIRONMENT*) lex_env)\r\n\r\n#define YY_FATAL_ERROR(msg) re_yyfatal(yyscanner, msg)\r\n\r\n#include \r\n\r\n#define YY_DECL int re_yylex \\\r\n (YYSTYPE * yylval_param , yyscan_t yyscanner, RE_LEX_ENVIRONMENT* lex_env)\r\n\r\n\r\nYY_EXTRA_TYPE yyget_extra(\r\n yyscan_t yyscanner);\r\n\r\nint yylex(\r\n YYSTYPE* yylval_param,\r\n yyscan_t yyscanner,\r\n RE_LEX_ENVIRONMENT* lex_env);\r\n\r\nint yyparse(\r\n void* yyscanner,\r\n RE_LEX_ENVIRONMENT* lex_env);\r\n\r\nvoid yyerror(\r\n yyscan_t yyscanner,\r\n RE_LEX_ENVIRONMENT* lex_env,\r\n const char* error_message);\r\n\r\nvoid yyfatal(\r\n yyscan_t yyscanner,\r\n const char* error_message);\r\n\r\nint yr_parse_re_string(\r\n const char* re_string,\r\n RE_AST** re_ast,\r\n RE_ERROR* error);\r\n" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara/rules.h", "content": "/*\r\nCopyright (c) 2014. The YARA Authors. All Rights Reserved.\r\n\r\nRedistribution and use in source and binary forms, with or without modification,\r\nare permitted provided that the following conditions are met:\r\n\r\n1. Redistributions of source code must retain the above copyright notice, this\r\nlist of conditions and the following disclaimer.\r\n\r\n2. Redistributions in binary form must reproduce the above copyright notice,\r\nthis list of conditions and the following disclaimer in the documentation and/or\r\nother materials provided with the distribution.\r\n\r\n3. Neither the name of the copyright holder nor the names of its contributors\r\nmay be used to endorse or promote products derived from this software without\r\nspecific prior written permission.\r\n\r\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\r\nANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\r\nWARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\r\nDISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR\r\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\r\n(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\r\nLOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\r\nANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\r\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\r\nSOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\r\n*/\r\n\r\n#ifndef YR_RULES_H\r\n#define YR_RULES_H\r\n\r\n#include \"types.h\"\r\n#include \"utils.h\"\r\n#include \"filemap.h\"\r\n\r\n\r\n#define CALLBACK_MSG_RULE_MATCHING 1\r\n#define CALLBACK_MSG_RULE_NOT_MATCHING 2\r\n#define CALLBACK_MSG_SCAN_FINISHED 3\r\n#define CALLBACK_MSG_IMPORT_MODULE 4\r\n#define CALLBACK_MSG_MODULE_IMPORTED 5\r\n\r\n#define CALLBACK_CONTINUE 0\r\n#define CALLBACK_ABORT 1\r\n#define CALLBACK_ERROR 2\r\n\r\n\r\n#define yr_rule_tags_foreach(rule, tag_name) \\\r\n for (tag_name = rule->tags; \\\r\n tag_name != NULL && *tag_name != '\\0'; \\\r\n tag_name += strlen(tag_name) + 1)\r\n\r\n\r\n#define yr_rule_metas_foreach(rule, meta) \\\r\n for (meta = rule->metas; !META_IS_NULL(meta); meta++)\r\n\r\n\r\n#define yr_rule_strings_foreach(rule, string) \\\r\n for (string = rule->strings; !STRING_IS_NULL(string); string++)\r\n\r\n\r\n#define yr_string_matches_foreach(string, match) \\\r\n for (match = STRING_MATCHES(string).head; match != NULL; match = match->next)\r\n\r\n\r\n#define yr_rules_foreach(rules, rule) \\\r\n for (rule = rules->rules_list_head; !RULE_IS_NULL(rule); rule++)\r\n\r\n\r\n\r\nYR_API int yr_rules_scan_mem(\r\n YR_RULES* rules,\r\n uint8_t* buffer,\r\n size_t buffer_size,\r\n int flags,\r\n YR_CALLBACK_FUNC callback,\r\n void* user_data,\r\n int timeout);\r\n\r\n\r\nYR_API int yr_rules_scan_file(\r\n YR_RULES* rules,\r\n const char* filename,\r\n int flags,\r\n YR_CALLBACK_FUNC callback,\r\n void* user_data,\r\n int timeout);\r\n\r\n\r\nYR_API int yr_rules_scan_fd(\r\n YR_RULES* rules,\r\n YR_FILE_DESCRIPTOR fd,\r\n int flags,\r\n YR_CALLBACK_FUNC callback,\r\n void* user_data,\r\n int timeout);\r\n\r\n\r\nYR_API int yr_rules_scan_proc(\r\n YR_RULES* rules,\r\n int pid,\r\n int flags,\r\n YR_CALLBACK_FUNC callback,\r\n void* user_data,\r\n int timeout);\r\n\r\nYR_API int yr_rules_save(\r\n YR_RULES* rules,\r\n const char* filename);\r\n\r\n\r\nYR_API int yr_rules_save_stream(\r\n YR_RULES* rules,\r\n YR_STREAM* stream);\r\n\r\n\r\nYR_API int yr_rules_load(\r\n const char* filename,\r\n YR_RULES** rules);\r\n\r\n\r\nYR_API int yr_rules_load_stream(\r\n YR_STREAM* stream,\r\n YR_RULES** rules);\r\n\r\n\r\nYR_API int yr_rules_destroy(\r\n YR_RULES* rules);\r\n\r\n\r\nYR_API int yr_rules_define_integer_variable(\r\n YR_RULES* rules,\r\n const char* identifier,\r\n int64_t value);\r\n\r\n\r\nYR_API int yr_rules_define_boolean_variable(\r\n YR_RULES* rules,\r\n const char* identifier,\r\n int value);\r\n\r\n\r\nYR_API int yr_rules_define_float_variable(\r\n YR_RULES* rules,\r\n const char* identifier,\r\n double value);\r\n\r\n\r\nYR_API int yr_rules_define_string_variable(\r\n YR_RULES* rules,\r\n const char* identifier,\r\n const char* value);\r\n\r\n\r\nYR_API void yr_rules_print_profiling_info(\r\n YR_RULES* rules);\r\n\r\n#endif\r\n" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara/scan.h", "content": "/*\r\nCopyright (c) 2014. The YARA Authors. All Rights Reserved.\r\n\r\nRedistribution and use in source and binary forms, with or without modification,\r\nare permitted provided that the following conditions are met:\r\n\r\n1. Redistributions of source code must retain the above copyright notice, this\r\nlist of conditions and the following disclaimer.\r\n\r\n2. Redistributions in binary form must reproduce the above copyright notice,\r\nthis list of conditions and the following disclaimer in the documentation and/or\r\nother materials provided with the distribution.\r\n\r\n3. Neither the name of the copyright holder nor the names of its contributors\r\nmay be used to endorse or promote products derived from this software without\r\nspecific prior written permission.\r\n\r\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\r\nANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\r\nWARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\r\nDISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR\r\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\r\n(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\r\nLOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\r\nANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\r\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\r\nSOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\r\n*/\r\n\r\n#ifndef YR_SCAN_H\r\n#define YR_SCAN_H\r\n\r\n#include \"types.h\"\r\n\r\n// Bitmasks for flags.\r\n#define SCAN_FLAGS_FAST_MODE 1\r\n#define SCAN_FLAGS_PROCESS_MEMORY 2\r\n#define SCAN_FLAGS_NO_TRYCATCH 4\r\n\r\n\r\nint yr_scan_verify_match(\r\n YR_SCAN_CONTEXT* context,\r\n YR_AC_MATCH* ac_match,\r\n uint8_t* data,\r\n size_t data_size,\r\n size_t data_base,\r\n size_t offset);\r\n\r\n#endif\r\n" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara/sizedstr.h", "content": "/*\r\nCopyright (c) 2007-2014. The YARA Authors. All Rights Reserved.\r\n\r\nRedistribution and use in source and binary forms, with or without modification,\r\nare permitted provided that the following conditions are met:\r\n\r\n1. Redistributions of source code must retain the above copyright notice, this\r\nlist of conditions and the following disclaimer.\r\n\r\n2. Redistributions in binary form must reproduce the above copyright notice,\r\nthis list of conditions and the following disclaimer in the documentation and/or\r\nother materials provided with the distribution.\r\n\r\n3. Neither the name of the copyright holder nor the names of its contributors\r\nmay be used to endorse or promote products derived from this software without\r\nspecific prior written permission.\r\n\r\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\r\nANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\r\nWARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\r\nDISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR\r\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\r\n(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\r\nLOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\r\nANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\r\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\r\nSOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\r\n*/\r\n\r\n#ifndef _SIZEDSTR_H\r\n#define _SIZEDSTR_H\r\n\r\n#include \r\n\r\n#include \"integers.h\"\r\n\r\n//\r\n// This struct is used to support strings containing null chars. The length of\r\n// the string is stored along the string data. However the string data is also\r\n// terminated with a null char.\r\n//\r\n\r\n#define SIZED_STRING_FLAGS_NO_CASE 1\r\n#define SIZED_STRING_FLAGS_DOT_ALL 2\r\n\r\n#pragma pack(push)\r\n#pragma pack(8)\r\n\r\n\r\ntypedef struct _SIZED_STRING\r\n{\r\n uint32_t length;\r\n uint32_t flags;\r\n\r\n char c_string[1];\r\n\r\n} SIZED_STRING;\r\n\r\n#pragma pack(pop)\r\n\r\n\r\nint sized_string_cmp(\r\n SIZED_STRING* s1,\r\n SIZED_STRING* s2);\r\n\r\n\r\nSIZED_STRING* sized_string_dup(\r\n SIZED_STRING* s);\r\n\r\n#endif\r\n" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara/stream.h", "content": "/*\r\nCopyright (c) 2015. The YARA Authors. All Rights Reserved.\r\n\r\nRedistribution and use in source and binary forms, with or without modification,\r\nare permitted provided that the following conditions are met:\r\n\r\n1. Redistributions of source code must retain the above copyright notice, this\r\nlist of conditions and the following disclaimer.\r\n\r\n2. Redistributions in binary form must reproduce the above copyright notice,\r\nthis list of conditions and the following disclaimer in the documentation and/or\r\nother materials provided with the distribution.\r\n\r\n3. Neither the name of the copyright holder nor the names of its contributors\r\nmay be used to endorse or promote products derived from this software without\r\nspecific prior written permission.\r\n\r\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\r\nANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\r\nWARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\r\nDISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR\r\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\r\n(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\r\nLOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\r\nANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\r\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\r\nSOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\r\n*/\r\n\r\n#ifndef YR_STREAM_H\r\n#define YR_STREAM_H\r\n\r\n#include \r\n\r\ntypedef size_t (*YR_STREAM_READ_FUNC)(\r\n void* ptr,\r\n size_t size,\r\n size_t count,\r\n void* user_data);\r\n\r\n\r\ntypedef size_t (*YR_STREAM_WRITE_FUNC)(\r\n const void* ptr,\r\n size_t size,\r\n size_t count,\r\n void* user_data);\r\n\r\n\r\ntypedef struct _YR_STREAM\r\n{\r\n void* user_data;\r\n\r\n YR_STREAM_READ_FUNC read;\r\n YR_STREAM_WRITE_FUNC write;\r\n\r\n} YR_STREAM;\r\n\r\n\r\nsize_t yr_stream_read(\r\n void* ptr,\r\n size_t size,\r\n size_t count,\r\n YR_STREAM* stream);\r\n\r\n\r\nsize_t yr_stream_write(\r\n const void* ptr,\r\n size_t size,\r\n size_t count,\r\n YR_STREAM* stream);\r\n\r\n#endif\r\n" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara/strutils.h", "content": "/*\r\nCopyright (c) 2007-2014. The YARA Authors. All Rights Reserved.\r\n\r\nRedistribution and use in source and binary forms, with or without modification,\r\nare permitted provided that the following conditions are met:\r\n\r\n1. Redistributions of source code must retain the above copyright notice, this\r\nlist of conditions and the following disclaimer.\r\n\r\n2. Redistributions in binary form must reproduce the above copyright notice,\r\nthis list of conditions and the following disclaimer in the documentation and/or\r\nother materials provided with the distribution.\r\n\r\n3. Neither the name of the copyright holder nor the names of its contributors\r\nmay be used to endorse or promote products derived from this software without\r\nspecific prior written permission.\r\n\r\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\r\nANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\r\nWARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\r\nDISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR\r\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\r\n(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\r\nLOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\r\nANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\r\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\r\nSOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\r\n*/\r\n\r\n#ifndef YR_STRUTILS_H\r\n#define YR_STRUTILS_H\r\n\r\n#include \r\n#include \r\n\r\n#include \"integers.h\"\r\n\r\n// Cygwin already has these functions.\r\n#if defined(_WIN32) && !defined(__CYGWIN__)\r\n#if defined(_MSC_VER) && _MSC_VER < 1900\r\n#define snprintf _snprintf\r\n#endif\r\n#define strcasecmp _stricmp\r\n#define strncasecmp _strnicmp\r\n#endif\r\n\r\n\r\nuint64_t xtoi(\r\n const char* hexstr);\r\n\r\n\r\n#if !HAVE_STRLCPY && !defined(strlcpy)\r\nsize_t strlcpy(\r\n char* dst,\r\n const char* src,\r\n size_t size);\r\n#endif\r\n\r\n\r\n#if !HAVE_STRLCAT && !defined(strlcat)\r\nsize_t strlcat(\r\n char* dst,\r\n const char* src,\r\n size_t size);\r\n#endif\r\n\r\n\r\n#if !HAVE_MEMMEM && !defined(memmem)\r\nvoid* memmem(\r\n const void* haystack,\r\n size_t haystack_size,\r\n const void* needle,\r\n size_t needle_size);\r\n#endif\r\n\r\n\r\nint strnlen_w(\r\n const char* w_str);\r\n\r\n\r\nint strcmp_w(\r\n const char* w_str,\r\n const char* str);\r\n\r\n\r\nsize_t strlcpy_w(\r\n char* dst,\r\n const char* w_src,\r\n size_t n);\r\n\r\n#endif\r\n" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara/threading.h", "content": "/*\r\nCopyright (c) 2016. The YARA Authors. All Rights Reserved.\r\n\r\nRedistribution and use in source and binary forms, with or without modification,\r\nare permitted provided that the following conditions are met:\r\n\r\n1. Redistributions of source code must retain the above copyright notice, this\r\nlist of conditions and the following disclaimer.\r\n\r\n2. Redistributions in binary form must reproduce the above copyright notice,\r\nthis list of conditions and the following disclaimer in the documentation and/or\r\nother materials provided with the distribution.\r\n\r\n3. Neither the name of the copyright holder nor the names of its contributors\r\nmay be used to endorse or promote products derived from this software without\r\nspecific prior written permission.\r\n\r\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\r\nANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\r\nWARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\r\nDISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR\r\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\r\n(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\r\nLOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\r\nANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\r\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\r\nSOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\r\n*/\r\n\r\n#ifndef YR_MUTEX_H\r\n#define YR_MUTEX_H\r\n\r\n\r\n\r\n#if defined(_WIN32) || defined(__CYGWIN__)\r\n\r\n#include \r\n\r\ntypedef DWORD YR_THREAD_ID;\r\ntypedef DWORD YR_THREAD_STORAGE_KEY;\r\ntypedef HANDLE YR_MUTEX;\r\n\r\n#else\r\n\r\n#include \r\n\r\ntypedef pthread_t YR_THREAD_ID;\r\ntypedef pthread_key_t YR_THREAD_STORAGE_KEY;\r\ntypedef pthread_mutex_t YR_MUTEX;\r\n\r\n#endif\r\n\r\nYR_THREAD_ID yr_current_thread_id(void);\r\n\r\nint yr_mutex_create(YR_MUTEX*);\r\nint yr_mutex_destroy(YR_MUTEX*);\r\nint yr_mutex_lock(YR_MUTEX*);\r\nint yr_mutex_unlock(YR_MUTEX*);\r\n\r\nint yr_thread_storage_create(YR_THREAD_STORAGE_KEY*);\r\nint yr_thread_storage_destroy(YR_THREAD_STORAGE_KEY*);\r\nint yr_thread_storage_set_value(YR_THREAD_STORAGE_KEY*, void*);\r\nvoid* yr_thread_storage_get_value(YR_THREAD_STORAGE_KEY*);\r\n\r\n#endif\r\n" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara/types.h", "content": "/*\r\nCopyright (c) 2013. The YARA Authors. All Rights Reserved.\r\n\r\nRedistribution and use in source and binary forms, with or without modification,\r\nare permitted provided that the following conditions are met:\r\n\r\n1. Redistributions of source code must retain the above copyright notice, this\r\nlist of conditions and the following disclaimer.\r\n\r\n2. Redistributions in binary form must reproduce the above copyright notice,\r\nthis list of conditions and the following disclaimer in the documentation and/or\r\nother materials provided with the distribution.\r\n\r\n3. Neither the name of the copyright holder nor the names of its contributors\r\nmay be used to endorse or promote products derived from this software without\r\nspecific prior written permission.\r\n\r\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\r\nANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\r\nWARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\r\nDISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR\r\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\r\n(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\r\nLOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\r\nANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\r\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\r\nSOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\r\n*/\r\n\r\n#ifndef YR_TYPES_H\r\n#define YR_TYPES_H\r\n\r\n\r\n#include \"arena.h\"\r\n#include \"re.h\"\r\n#include \"limits.h\"\r\n#include \"hash.h\"\r\n#include \"utils.h\"\r\n#include \"threading.h\"\r\n\r\n\r\n\r\n#ifdef PROFILING_ENABLED\r\n#include \r\n#endif\r\n\r\n\r\n#define DECLARE_REFERENCE(type, name) \\\r\n union { type name; int64_t name##_; } YR_ALIGN(8)\r\n\r\n\r\n\r\n#define NAMESPACE_TFLAGS_UNSATISFIED_GLOBAL 0x01\r\n\r\n\r\n#define STRING_GFLAGS_REFERENCED 0x01\r\n#define STRING_GFLAGS_HEXADECIMAL 0x02\r\n#define STRING_GFLAGS_NO_CASE 0x04\r\n#define STRING_GFLAGS_ASCII 0x08\r\n#define STRING_GFLAGS_WIDE 0x10\r\n#define STRING_GFLAGS_REGEXP 0x20\r\n#define STRING_GFLAGS_FAST_REGEXP 0x40\r\n#define STRING_GFLAGS_FULL_WORD 0x80\r\n#define STRING_GFLAGS_ANONYMOUS 0x100\r\n#define STRING_GFLAGS_SINGLE_MATCH 0x200\r\n#define STRING_GFLAGS_LITERAL 0x400\r\n#define STRING_GFLAGS_FITS_IN_ATOM 0x800\r\n#define STRING_GFLAGS_NULL 0x1000\r\n#define STRING_GFLAGS_CHAIN_PART 0x2000\r\n#define STRING_GFLAGS_CHAIN_TAIL 0x4000\r\n#define STRING_GFLAGS_FIXED_OFFSET 0x8000\r\n#define STRING_GFLAGS_GREEDY_REGEXP 0x10000\r\n#define STRING_GFLAGS_DOT_ALL 0x20000\r\n\r\n#define STRING_IS_HEX(x) \\\r\n (((x)->g_flags) & STRING_GFLAGS_HEXADECIMAL)\r\n\r\n#define STRING_IS_NO_CASE(x) \\\r\n (((x)->g_flags) & STRING_GFLAGS_NO_CASE)\r\n\r\n#define STRING_IS_DOT_ALL(x) \\\r\n (((x)->g_flags) & STRING_GFLAGS_DOT_ALL)\r\n\r\n#define STRING_IS_ASCII(x) \\\r\n (((x)->g_flags) & STRING_GFLAGS_ASCII)\r\n\r\n#define STRING_IS_WIDE(x) \\\r\n (((x)->g_flags) & STRING_GFLAGS_WIDE)\r\n\r\n#define STRING_IS_REGEXP(x) \\\r\n (((x)->g_flags) & STRING_GFLAGS_REGEXP)\r\n\r\n#define STRING_IS_GREEDY_REGEXP(x) \\\r\n (((x)->g_flags) & STRING_GFLAGS_GREEDY_REGEXP)\r\n\r\n#define STRING_IS_FULL_WORD(x) \\\r\n (((x)->g_flags) & STRING_GFLAGS_FULL_WORD)\r\n\r\n#define STRING_IS_ANONYMOUS(x) \\\r\n (((x)->g_flags) & STRING_GFLAGS_ANONYMOUS)\r\n\r\n#define STRING_IS_REFERENCED(x) \\\r\n (((x)->g_flags) & STRING_GFLAGS_REFERENCED)\r\n\r\n#define STRING_IS_SINGLE_MATCH(x) \\\r\n (((x)->g_flags) & STRING_GFLAGS_SINGLE_MATCH)\r\n\r\n#define STRING_IS_FIXED_OFFSET(x) \\\r\n (((x)->g_flags) & STRING_GFLAGS_FIXED_OFFSET)\r\n\r\n#define STRING_IS_LITERAL(x) \\\r\n (((x)->g_flags) & STRING_GFLAGS_LITERAL)\r\n\r\n#define STRING_IS_FAST_REGEXP(x) \\\r\n (((x)->g_flags) & STRING_GFLAGS_FAST_REGEXP)\r\n\r\n#define STRING_IS_CHAIN_PART(x) \\\r\n (((x)->g_flags) & STRING_GFLAGS_CHAIN_PART)\r\n\r\n#define STRING_IS_CHAIN_TAIL(x) \\\r\n (((x)->g_flags) & STRING_GFLAGS_CHAIN_TAIL)\r\n\r\n#define STRING_IS_NULL(x) \\\r\n ((x) == NULL || ((x)->g_flags) & STRING_GFLAGS_NULL)\r\n\r\n#define STRING_FITS_IN_ATOM(x) \\\r\n (((x)->g_flags) & STRING_GFLAGS_FITS_IN_ATOM)\r\n\r\n#define STRING_FOUND(x) \\\r\n ((x)->matches[yr_get_tidx()].tail != NULL)\r\n\r\n#define STRING_MATCHES(x) \\\r\n ((x)->matches[yr_get_tidx()])\r\n\r\n\r\n#define RULE_TFLAGS_MATCH 0x01\r\n\r\n#define RULE_GFLAGS_PRIVATE 0x01\r\n#define RULE_GFLAGS_GLOBAL 0x02\r\n#define RULE_GFLAGS_REQUIRE_EXECUTABLE 0x04\r\n#define RULE_GFLAGS_REQUIRE_FILE 0x08\r\n#define RULE_GFLAGS_NULL 0x1000\r\n\r\n#define RULE_IS_PRIVATE(x) \\\r\n (((x)->g_flags) & RULE_GFLAGS_PRIVATE)\r\n\r\n#define RULE_IS_GLOBAL(x) \\\r\n (((x)->g_flags) & RULE_GFLAGS_GLOBAL)\r\n\r\n#define RULE_IS_NULL(x) \\\r\n (((x)->g_flags) & RULE_GFLAGS_NULL)\r\n\r\n#define RULE_MATCHES(x) \\\r\n ((x)->t_flags[yr_get_tidx()] & RULE_TFLAGS_MATCH)\r\n\r\n\r\n#define META_TYPE_NULL 0\r\n#define META_TYPE_INTEGER 1\r\n#define META_TYPE_STRING 2\r\n#define META_TYPE_BOOLEAN 3\r\n\r\n#define META_IS_NULL(x) \\\r\n ((x) != NULL ? (x)->type == META_TYPE_NULL : TRUE)\r\n\r\n\r\n#define EXTERNAL_VARIABLE_TYPE_NULL 0\r\n#define EXTERNAL_VARIABLE_TYPE_FLOAT 1\r\n#define EXTERNAL_VARIABLE_TYPE_INTEGER 2\r\n#define EXTERNAL_VARIABLE_TYPE_BOOLEAN 3\r\n#define EXTERNAL_VARIABLE_TYPE_STRING 4\r\n#define EXTERNAL_VARIABLE_TYPE_MALLOC_STRING 5\r\n\r\n#define EXTERNAL_VARIABLE_IS_NULL(x) \\\r\n ((x) != NULL ? (x)->type == EXTERNAL_VARIABLE_TYPE_NULL : TRUE)\r\n\r\n\r\n#pragma pack(push)\r\n#pragma pack(8)\r\n\r\n\r\ntypedef struct _YR_NAMESPACE\r\n{\r\n int32_t t_flags[MAX_THREADS]; // Thread-specific flags\r\n DECLARE_REFERENCE(char*, name);\r\n\r\n} YR_NAMESPACE;\r\n\r\n\r\ntypedef struct _YR_META\r\n{\r\n int32_t type;\r\n YR_ALIGN(8) int64_t integer;\r\n\r\n DECLARE_REFERENCE(const char*, identifier);\r\n DECLARE_REFERENCE(char*, string);\r\n\r\n} YR_META;\r\n\r\n\r\nstruct _YR_MATCH;\r\n\r\n\r\ntypedef struct _YR_MATCHES\r\n{\r\n int32_t count;\r\n\r\n DECLARE_REFERENCE(struct _YR_MATCH*, head);\r\n DECLARE_REFERENCE(struct _YR_MATCH*, tail);\r\n\r\n} YR_MATCHES;\r\n\r\n\r\ntypedef struct _YR_STRING\r\n{\r\n int32_t g_flags;\r\n int32_t length;\r\n\r\n DECLARE_REFERENCE(char*, identifier);\r\n DECLARE_REFERENCE(uint8_t*, string);\r\n DECLARE_REFERENCE(struct _YR_STRING*, chained_to);\r\n\r\n int32_t chain_gap_min;\r\n int32_t chain_gap_max;\r\n\r\n int64_t fixed_offset;\r\n\r\n YR_MATCHES matches[MAX_THREADS];\r\n YR_MATCHES unconfirmed_matches[MAX_THREADS];\r\n\r\n#ifdef PROFILING_ENABLED\r\n clock_t clock_ticks;\r\n#endif\r\n\r\n} YR_STRING;\r\n\r\n\r\ntypedef struct _YR_RULE\r\n{\r\n int32_t g_flags; // Global flags\r\n int32_t t_flags[MAX_THREADS]; // Thread-specific flags\r\n\r\n DECLARE_REFERENCE(const char*, identifier);\r\n DECLARE_REFERENCE(const char*, tags);\r\n DECLARE_REFERENCE(YR_META*, metas);\r\n DECLARE_REFERENCE(YR_STRING*, strings);\r\n DECLARE_REFERENCE(YR_NAMESPACE*, ns);\r\n\r\n#ifdef PROFILING_ENABLED\r\n clock_t clock_ticks;\r\n#endif\r\n\r\n} YR_RULE;\r\n\r\n\r\ntypedef struct _YR_EXTERNAL_VARIABLE\r\n{\r\n int32_t type;\r\n\r\n YR_ALIGN(8) union\r\n {\r\n int64_t i;\r\n double f;\r\n char* s;\r\n } value;\r\n\r\n DECLARE_REFERENCE(char*, identifier);\r\n\r\n} YR_EXTERNAL_VARIABLE;\r\n\r\n\r\ntypedef struct _YR_AC_MATCH\r\n{\r\n uint16_t backtrack;\r\n\r\n DECLARE_REFERENCE(YR_STRING*, string);\r\n DECLARE_REFERENCE(uint8_t*, forward_code);\r\n DECLARE_REFERENCE(uint8_t*, backward_code);\r\n DECLARE_REFERENCE(struct _YR_AC_MATCH*, next);\r\n\r\n} YR_AC_MATCH;\r\n\r\n\r\ntypedef struct _YR_AC_MATCH_TABLE_ENTRY\r\n{\r\n DECLARE_REFERENCE(YR_AC_MATCH*, match);\r\n\r\n} YR_AC_MATCH_TABLE_ENTRY;\r\n\r\n\r\ntypedef uint64_t YR_AC_TRANSITION;\r\ntypedef YR_AC_TRANSITION* YR_AC_TRANSITION_TABLE;\r\ntypedef YR_AC_MATCH_TABLE_ENTRY* YR_AC_MATCH_TABLE;\r\n\r\n\r\ntypedef struct _YARA_RULES_FILE_HEADER\r\n{\r\n DECLARE_REFERENCE(YR_RULE*, rules_list_head);\r\n DECLARE_REFERENCE(YR_EXTERNAL_VARIABLE*, externals_list_head);\r\n DECLARE_REFERENCE(uint8_t*, code_start);\r\n DECLARE_REFERENCE(YR_AC_MATCH_TABLE, match_table);\r\n DECLARE_REFERENCE(YR_AC_TRANSITION_TABLE, transition_table);\r\n\r\n} YARA_RULES_FILE_HEADER;\r\n\r\n#pragma pack(pop)\r\n\r\n\r\n//\r\n// Structs defined below are never stored in the compiled rules file\r\n//\r\n\r\ntypedef struct _YR_MATCH\r\n{\r\n int64_t base; // Base address for the match\r\n int64_t offset; // Offset relative to base for the match\r\n int32_t match_length; // Match length\r\n int32_t data_length;\r\n\r\n // Pointer to a buffer containing a portion of the matched data. The size of\r\n // the buffer is data_length. data_length is always <= length and is limited\r\n // to MAX_MATCH_DATA bytes.\r\n\r\n uint8_t* data;\r\n\r\n // If the match belongs to a chained string chain_length contains the\r\n // length of the chain. This field is used only in unconfirmed matches.\r\n\r\n int32_t chain_length;\r\n\r\n struct _YR_MATCH* prev;\r\n struct _YR_MATCH* next;\r\n\r\n} YR_MATCH;\r\n\r\n\r\nstruct _YR_AC_STATE;\r\n\r\n\r\ntypedef struct _YR_AC_STATE\r\n{\r\n uint8_t depth;\r\n uint8_t input;\r\n\r\n uint32_t t_table_slot;\r\n\r\n struct _YR_AC_STATE* failure;\r\n struct _YR_AC_STATE* first_child;\r\n struct _YR_AC_STATE* siblings;\r\n\r\n YR_AC_MATCH* matches;\r\n\r\n} YR_AC_STATE;\r\n\r\n\r\ntypedef struct _YR_AC_AUTOMATON\r\n{\r\n // Both m_table and t_table have the same number of elements, which is\r\n // stored in tables_size.\r\n\r\n uint32_t tables_size;\r\n uint32_t t_table_unused_candidate;\r\n\r\n YR_AC_TRANSITION_TABLE t_table;\r\n YR_AC_MATCH_TABLE m_table;\r\n\r\n YR_AC_STATE* root;\r\n\r\n} YR_AC_AUTOMATON;\r\n\r\n\r\ntypedef struct _YR_RULES\r\n{\r\n\r\n unsigned char tidx_mask[YR_BITARRAY_NCHARS(MAX_THREADS)];\r\n uint8_t* code_start;\r\n\r\n YR_MUTEX mutex;\r\n YR_ARENA* arena;\r\n YR_RULE* rules_list_head;\r\n YR_EXTERNAL_VARIABLE* externals_list_head;\r\n YR_AC_TRANSITION_TABLE transition_table;\r\n YR_AC_MATCH_TABLE match_table;\r\n\r\n} YR_RULES;\r\n\r\n\r\nstruct _YR_MEMORY_BLOCK;\r\nstruct _YR_MEMORY_BLOCK_ITERATOR;\r\n\r\n\r\ntypedef uint8_t* (*YR_MEMORY_BLOCK_FETCH_DATA_FUNC)(\r\n struct _YR_MEMORY_BLOCK* self);\r\n\r\n\r\ntypedef struct _YR_MEMORY_BLOCK* (*YR_MEMORY_BLOCK_ITERATOR_FUNC)(\r\n struct _YR_MEMORY_BLOCK_ITERATOR* self);\r\n\r\n\r\ntypedef struct _YR_MEMORY_BLOCK\r\n{\r\n size_t size;\r\n size_t base;\r\n\r\n void* context;\r\n\r\n YR_MEMORY_BLOCK_FETCH_DATA_FUNC fetch_data;\r\n\r\n} YR_MEMORY_BLOCK;\r\n\r\n\r\ntypedef struct _YR_MEMORY_BLOCK_ITERATOR\r\n{\r\n void* context;\r\n\r\n YR_MEMORY_BLOCK_ITERATOR_FUNC first;\r\n YR_MEMORY_BLOCK_ITERATOR_FUNC next;\r\n\r\n} YR_MEMORY_BLOCK_ITERATOR;\r\n\r\n\r\ntypedef int (*YR_CALLBACK_FUNC)(\r\n int message,\r\n void* message_data,\r\n void* user_data);\r\n\r\n\r\ntypedef struct _YR_SCAN_CONTEXT\r\n{\r\n uint64_t file_size;\r\n uint64_t entry_point;\r\n\r\n int flags;\r\n int tidx;\r\n\r\n void* user_data;\r\n\r\n YR_MEMORY_BLOCK_ITERATOR* iterator;\r\n YR_HASH_TABLE* objects_table;\r\n YR_CALLBACK_FUNC callback;\r\n\r\n YR_ARENA* matches_arena;\r\n YR_ARENA* matching_strings_arena;\r\n\r\n} YR_SCAN_CONTEXT;\r\n\r\n\r\nstruct _YR_OBJECT;\r\n\r\n\r\ntypedef union _YR_VALUE\r\n{\r\n int64_t i;\r\n double d;\r\n void* p;\r\n struct _YR_OBJECT* o;\r\n YR_STRING* s;\r\n SIZED_STRING* ss;\r\n RE* re;\r\n\r\n} YR_VALUE;\r\n\r\n\r\n#define OBJECT_COMMON_FIELDS \\\r\n int8_t type; \\\r\n const char* identifier; \\\r\n struct _YR_OBJECT* parent; \\\r\n void* data;\r\n\r\n\r\ntypedef struct _YR_OBJECT\r\n{\r\n OBJECT_COMMON_FIELDS\r\n YR_VALUE value;\r\n\r\n} YR_OBJECT;\r\n\r\n\r\ntypedef struct _YR_OBJECT_STRUCTURE\r\n{\r\n OBJECT_COMMON_FIELDS\r\n struct _YR_STRUCTURE_MEMBER* members;\r\n\r\n} YR_OBJECT_STRUCTURE;\r\n\r\n\r\ntypedef struct _YR_OBJECT_ARRAY\r\n{\r\n OBJECT_COMMON_FIELDS\r\n YR_OBJECT* prototype_item;\r\n struct _YR_ARRAY_ITEMS* items;\r\n\r\n} YR_OBJECT_ARRAY;\r\n\r\n\r\ntypedef struct _YR_OBJECT_DICTIONARY\r\n{\r\n OBJECT_COMMON_FIELDS\r\n YR_OBJECT* prototype_item;\r\n struct _YR_DICTIONARY_ITEMS* items;\r\n\r\n} YR_OBJECT_DICTIONARY;\r\n\r\n\r\nstruct _YR_OBJECT_FUNCTION;\r\n\r\n\r\ntypedef int (*YR_MODULE_FUNC)(\r\n YR_VALUE* args,\r\n YR_SCAN_CONTEXT* context,\r\n struct _YR_OBJECT_FUNCTION* function_obj);\r\n\r\n\r\ntypedef struct _YR_OBJECT_FUNCTION\r\n{\r\n OBJECT_COMMON_FIELDS\r\n YR_OBJECT* return_obj;\r\n\r\n struct\r\n {\r\n const char* arguments_fmt;\r\n YR_MODULE_FUNC code;\r\n\r\n } prototypes[MAX_OVERLOADED_FUNCTIONS];\r\n\r\n} YR_OBJECT_FUNCTION;\r\n\r\n\r\n#define object_as_structure(obj) ((YR_OBJECT_STRUCTURE*) (obj))\r\n#define object_as_array(obj) ((YR_OBJECT_ARRAY*) (obj))\r\n#define object_as_dictionary(obj) ((YR_OBJECT_DICTIONARY*) (obj))\r\n#define object_as_function(obj) ((YR_OBJECT_FUNCTION*) (obj))\r\n\r\n\r\ntypedef struct _YR_STRUCTURE_MEMBER\r\n{\r\n YR_OBJECT* object;\r\n struct _YR_STRUCTURE_MEMBER* next;\r\n\r\n} YR_STRUCTURE_MEMBER;\r\n\r\n\r\ntypedef struct _YR_ARRAY_ITEMS\r\n{\r\n int count;\r\n YR_OBJECT* objects[1];\r\n\r\n} YR_ARRAY_ITEMS;\r\n\r\n\r\ntypedef struct _YR_DICTIONARY_ITEMS\r\n{\r\n int used;\r\n int free;\r\n\r\n struct\r\n {\r\n\r\n char* key;\r\n YR_OBJECT* obj;\r\n\r\n } objects[1];\r\n\r\n} YR_DICTIONARY_ITEMS;\r\n\r\n\r\n#endif\r\n" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara/utils.h", "content": "/*\r\nCopyright (c) 2014. The YARA Authors. All Rights Reserved.\r\n\r\nRedistribution and use in source and binary forms, with or without modification,\r\nare permitted provided that the following conditions are met:\r\n\r\n1. Redistributions of source code must retain the above copyright notice, this\r\nlist of conditions and the following disclaimer.\r\n\r\n2. Redistributions in binary form must reproduce the above copyright notice,\r\nthis list of conditions and the following disclaimer in the documentation and/or\r\nother materials provided with the distribution.\r\n\r\n3. Neither the name of the copyright holder nor the names of its contributors\r\nmay be used to endorse or promote products derived from this software without\r\nspecific prior written permission.\r\n\r\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\r\nANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\r\nWARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\r\nDISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR\r\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\r\n(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\r\nLOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\r\nANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\r\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\r\nSOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\r\n*/\r\n\r\n\r\n#ifndef YR_UTILS_H\r\n#define YR_UTILS_H\r\n\r\n#include \r\n\r\n#ifndef TRUE\r\n#define TRUE 1\r\n#endif\r\n\r\n#ifndef FALSE\r\n#define FALSE 0\r\n#endif\r\n\r\n#ifndef NULL\r\n#define NULL 0\r\n#endif\r\n\r\n#ifdef __cplusplus\r\n#define EXTERNC extern \"C\"\r\n#else\r\n#define EXTERNC\r\n#endif\r\n\r\n#if defined(__GNUC__)\r\n#define YR_API EXTERNC __attribute__((visibility(\"default\")))\r\n#elif defined(_MSC_VER)\r\n#define YR_API EXTERNC __declspec(dllexport)\r\n#else\r\n#define YR_API EXTERNC\r\n#endif\r\n\r\n#if defined(__GNUC__)\r\n#define YR_ALIGN(n) __attribute__((aligned(n)))\r\n#elif defined(_MSC_VER)\r\n#define YR_ALIGN(n) __declspec(align(n))\r\n#else\r\n#define YR_ALIGN(n)\r\n#endif\r\n\r\n#define yr_min(x, y) ((x < y) ? (x) : (y))\r\n#define yr_max(x, y) ((x > y) ? (x) : (y))\r\n\r\n#define yr_swap(x, y, T) do { T temp = x; x = y; y = temp; } while (0)\r\n\r\n#ifdef NDEBUG\r\n\r\n#define assertf(expr, msg, ...) ((void)0)\r\n\r\n#else\r\n\r\n#include \r\n\r\n#define assertf(expr, msg, ...) \\\r\n if(!(expr)) { \\\r\n fprintf(stderr, \"%s:%d: \" msg \"\\n\", __FILE__, __LINE__, ##__VA_ARGS__); \\\r\n abort(); \\\r\n }\r\n\r\n#endif\r\n\r\n// Set, unset, and test bits in an array of unsigned characters by integer\r\n// index. The underlying array must be of type char or unsigned char to\r\n// ensure compatibility with the CHAR_BIT constant used in these definitions.\r\n\r\n#define YR_BITARRAY_SET(uchar_array_base, bitnum) \\\r\n (((uchar_array_base)[(bitnum)/CHAR_BIT]) = \\\r\n ((uchar_array_base)[(bitnum)/CHAR_BIT] | (1 << ((bitnum) % CHAR_BIT))))\r\n\r\n#define YR_BITARRAY_UNSET(uchar_array_base, bitnum) \\\r\n (((uchar_array_base)[(bitnum)/CHAR_BIT]) = \\\r\n ((uchar_array_base)[(bitnum)/CHAR_BIT] & (~(1 << ((bitnum) % CHAR_BIT)))))\r\n\r\n#define YR_BITARRAY_TEST(uchar_array_base, bitnum) \\\r\n (((uchar_array_base)[(bitnum)/CHAR_BIT] & (1 << ((bitnum) % CHAR_BIT))) != 0)\r\n\r\n#define YR_BITARRAY_NCHARS(bitnum) \\\r\n (((bitnum)+(CHAR_BIT-1))/CHAR_BIT)\r\n\r\n#endif\r\n" }, { "path": "x64dbgApiBreak/src/incl/pluginsdk/yara/yara.h", "content": "/*\r\nCopyright (c) 2007-2013. The YARA Authors. All Rights Reserved.\r\n\r\nRedistribution and use in source and binary forms, with or without modification,\r\nare permitted provided that the following conditions are met:\r\n\r\n1. Redistributions of source code must retain the above copyright notice, this\r\nlist of conditions and the following disclaimer.\r\n\r\n2. Redistributions in binary form must reproduce the above copyright notice,\r\nthis list of conditions and the following disclaimer in the documentation and/or\r\nother materials provided with the distribution.\r\n\r\n3. Neither the name of the copyright holder nor the names of its contributors\r\nmay be used to endorse or promote products derived from this software without\r\nspecific prior written permission.\r\n\r\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\r\nANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\r\nWARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\r\nDISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR\r\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\r\n(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\r\nLOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\r\nANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\r\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\r\nSOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\r\n*/\r\n\r\n#ifndef YR_YARA_H\r\n#define YR_YARA_H\r\n\r\n#include \"yara/utils.h\"\r\n#include \"yara/filemap.h\"\r\n#include \"yara/compiler.h\"\r\n#include \"yara/modules.h\"\r\n#include \"yara/object.h\"\r\n#include \"yara/libyara.h\"\r\n#include \"yara/error.h\"\r\n#include \"yara/stream.h\"\r\n#include \"yara/hash.h\"\r\n\r\n#endif\r\n" }, { "path": "x64dbgApiBreak/src/incl/qpc.hpp", "content": "#ifndef __QPC_HPP__\n#define __QPC_HPP__\n\n#include \n#include \n\n\nstatic LARGE_INTEGER freq = { 0 };\n\n#if _DEBUG\n#define DECL_QPREF QPerf ___qperfvar;\n#define QPERF_BEGIN() ___qperfvar.Begin()\n#define QPERF_TIME(forWhat) ___qperfvar.TimeFor(forWhat)\n#define QPERF_DUMP() ___qperfvar.Dump()\n#else\n\n#define DECL_QPREF\n#define QPERF_BEGIN()\n#define QPERF_TIME(forWhat)\n#define QPERF_DUMP()\n#endif\n\nclass QPerf\n{\nprivate:\n\n struct PerfItem\n {\n double timesFromBegin;\n double timesWork;\n char nameFor[128];\n };\n\n double start, lastWork;\n PDMA list;\n\n double _GetQpc()\n {\n LARGE_INTEGER now;\n\n QueryPerformanceCounter(&now);\n\t\t\n\t\tnow.QuadPart *= 1000;\n return now.QuadPart / double(freq.QuadPart);\n }\n\npublic:\n QPerf()\n {\n if (freq.LowPart == 0)\n QueryPerformanceFrequency(&freq);\n\n if (!DmaCreateAdapter(sizeof(PerfItem), 10, &list))\n list = NULL;\n }\n\n ~QPerf()\n {\n DmaDestroyAdapter((PDMA)list);\n }\n\n void Begin()\n {\n start = _GetQpc();\n lastWork = start;\n }\n\n void TimeFor(const char *forWhat)\n {\n PerfItem item;\n double now = _GetQpc();\n\n double elapsed = now - start;\n item.timesFromBegin = elapsed;\n\n elapsed = now - lastWork;\n item.timesWork = elapsed;\n\n lastWork = now;\n\n strcpy(item.nameFor, forWhat);\n\n DmaWrite(list, DMA_AUTO_OFFSET, sizeof(PerfItem), &item);\n }\n\n void Reset()\n {\n DmaSink(list);\n Begin();\n }\n\n void Dump()\n {\n ARCHWIDE written;\n ULONG count;\n PerfItem perf;\n\n DmaGetAdapterInfo(list, &written, NULL);\n\n count = written / sizeof(PerfItem);\n \n for (ULONG i = 0;i < count;i++)\n {\n DmaReadTypeAlignedSequence(list, i, 1, &perf);\n\n DBGPRINT(\"%s -> TFB: %lf ms, TW: %lf ms\", perf.nameFor, perf.timesFromBegin, perf.timesWork);\n }\n }\n\n};\n\n\n#endif" }, { "path": "x64dbgApiBreak/src/incl/rtf.h", "content": "#ifndef __RTF_H__\n#define __RTF_H__\n\n#include \n#include \n\ntypedef struct __RTF_DATA\n{\n PDMA rtfDma;\n DWORD state;\n DWORD * colorTable;\n LPSTR * fontTable;\n DWORD colorCount;\n DWORD fontCount;\n}*PRTF_DATA,RTF_DATA;\n\ntypedef enum __RTF_STYLE\n{\n RTFS_NONE = 0x00000000,\n RTFS_BOLD = 0x00000001,\n RTFS_ITALIC = 0x00000002,\n RTFS_UNDERLINE = 0x00000004,\n RTFS_NEWLINE = 0x00000008,\n RTFS_TAB = 0x00000010,\n RTFS_PARAGRAPH = 0x00000020\n}RTF_STYLE;\n\n\ntypedef DWORD RTFRESID;\n\nBOOL RtfCreateRtfData(PRTF_DATA *rtfData);\n\nBOOL RtfBuildRtfTextA(PRTF_DATA rtf, LPSTR *rtfText, DWORD *textLen);\n\nvoid RtfFreeRtfText(LPSTR rtfText);\n\n#define RtfGetRtfText RtfBuildRtfTextA\n\nBOOL RtfDestroyRtfData(PRTF_DATA *rtf);\n\nBOOL RtfRegisterColor(PRTF_DATA rtf, DWORD color, RTFRESID *resId);\n\nBOOL RtfRegisterFont(PRTF_DATA rtf, const LPCSTR fontName, int charset, RTFRESID *resId);\n\nBOOL RtfBeginStyleFor(PRTF_DATA rtf, RTF_STYLE rtfStyle, DWORD repeat);\n\nBOOL RtfBeginColor(PRTF_DATA rtf, RTFRESID resId);\n\nBOOL RtfBeginFont(PRTF_DATA rtf, RTFRESID resId);\n\nBOOL RtfBeginFontSize(PRTF_DATA rtf, WORD fontSize);\n\nBOOL RtfAppendTextFormatA(PRTF_DATA rtf, LPCSTR format, ...);\n\nBOOL RtfAppendTextFormatExA(PRTF_DATA rtf, LPCSTR format, va_list vl);\n\nclass Rtf\n{\nprivate:\n PRTF_DATA data;\npublic:\n Rtf()\n {\n RtfCreateRtfData(&data);\n }\n\n ~Rtf()\n {\n RtfDestroyRtfData(&data);\n }\n\n bool RegisterFont(const LPCSTR fontName, int charset)\n {\n return RtfRegisterFont(data, fontName, charset, NULL);\n }\n\n bool RegisterColor(DWORD color)\n {\n return RtfRegisterColor(data, color, NULL);\n }\n\n LPSTR GetRtf()\n {\n LPSTR rtfText;\n\n if (!RtfBuildRtfTextA(data, &rtfText, NULL))\n return NULL;\n\n return rtfText;\n }\n\n Rtf *Style(RTF_STYLE style, DWORD repeat)\n {\n RtfBeginStyleFor(data, style, repeat);\n return this;\n }\n\n Rtf *Style(RTF_STYLE style)\n {\n return Style(style, 0);\n }\n\n Rtf *Color(RTFRESID colorId)\n {\n RtfBeginColor(data, colorId);\n return this;\n }\n\n Rtf *Font(RTFRESID fontId)\n {\n RtfBeginFont(data, fontId);\n return this;\n }\n\n Rtf *FontSize(WORD size)\n {\n RtfBeginFontSize(data, size);\n return this;\n }\n\n Rtf *FormatText(LPCSTR format, ...)\n {\n va_list va;\n va_start(va, format);\n RtfAppendTextFormatExA(data, format,va);\n va_end(va);\n\n return this;\n }\n\n Rtf *NewLine(int count)\n {\n return Style(RTFS_NEWLINE, count);\n }\n\n Rtf *NewTab(int count)\n {\n return Style(RTFS_TAB, count);\n }\n};\n\n#endif // !__RTF_H__\n" }, { "path": "x64dbgApiBreak/src/incl/settings.h", "content": "#ifndef __SETTINGS_H_\n#define __SETTINGS_H_\n\n#include \n\ntypedef struct\n{\n bool exposeDynamicApiLoads;\n bool includeGetModuleHandle;\n bool autoLoadData;\n bool scanAggressive;\n bool mapCallContext;\n char *mainScripts;\n}Settings;\n\nbool AbSettingsLoad();\n\nbool AbSettingsSave();\n\nbool AbSettingsReset();\n\nSettings *AbGetSettings();\n\nvoid AbSettingsDestroyResources();\n\n#endif // !__SETTINGS_H_\n" }, { "path": "x64dbgApiBreak/src/incl/structmemmap.h", "content": "#ifndef __STRUCTMEMMAP_H__\n#define __STRUCTMEMMAP_H__\n\n#include \n#include \n\ntypedef struct __FNSIGN *PFNSIGN;\n\n\n\nBOOL SmmMapFunctionCall(PPASSED_PARAMETER_CONTEXT passedParams, PFNSIGN fnSign, ApiFunctionInfo *afi, LPSTR *mapResult);\n\n//BOOL SmmMapRemoteMemory(duint memory, ULONG size, const char *typeName);\n\nBOOL SmmMapMemoryForType(void *memory, ULONG size, const char *typeName);\n\nBOOL SmmGetFunctionSignature(const char *module, const char *function, PFNSIGN *signInfo);\n\nBOOL SmmGetFunctionSignature2(ApiFunctionInfo *afi, PFNSIGN *signInfo);\n\nSHORT SmmGetArgumentCount(PFNSIGN signInfo);\n\nBOOL SmmSigHasOutArgument(PFNSIGN signInfo);\n\nBOOL SmmParseType(LPCSTR typeDefString, WORD *typeCount);\n\nBOOL SmmParseFromFileW(LPCWSTR fileName, WORD *typeCount);\n\nBOOL SmmParseFromFileA(LPCSTR fileName, WORD *typeCount);\n\nBOOL SmmHasParseError(LPSTR *errorString);\n\nVOID SmmInitializeResources();\n\nVOID SmmReleaseResources(bool fullRelease);\n\n#endif // !__STRUCTMEMMAP_H__\n" }, { "path": "x64dbgApiBreak/src/incl/ui/ctrl/uicheckbox.hpp", "content": "#pragma once\n\n#include \n\nclass UiCheckBox : public UiControlBase\n{\nprivate:\n\npublic:\n\n IMPL_CTRLBASE_CTOR(UiCheckBox)\n {\n }\n\n bool GetState()\n {\n return (bool)SendControlMsg(BM_GETCHECK, NULL, NULL);\n }\n\n void SetState(bool state)\n {\n SendControlMsg(BM_SETCHECK, state ? BST_CHECKED : BST_UNCHECKED, NULL);\n }\n\n virtual void OnCommand(WPARAM wp)\n {\n if (HIWORD(wp) == BN_CLICKED)\n {\n\n }\n }\n\n};" }, { "path": "x64dbgApiBreak/src/incl/ui/ctrl/uicombobox.hpp", "content": "#pragma once\n\n#include \n\nclass UiComboBox : public UiControlBase\n{\nprivate:\n\npublic:\n\n IMPL_CTRLBASE_CTOR(UiComboBox)\n {\n }\n\n bool AddItem(LPCWSTR itemStr)\n {\n return SendMessageW(this->ctrlHwnd, CB_ADDSTRING, NULL, (LPARAM)itemStr) > -1;\n }\n\n bool AddItemA(LPCSTR itemStr)\n {\n return SendMessageA(this->ctrlHwnd, CB_ADDSTRING, NULL, (LPARAM)itemStr) > -1;\n }\n\n void Clear()\n {\n SendMessage(this->ctrlHwnd, CB_RESETCONTENT, NULL, NULL);\n }\n\n LONG GetSelectedIndex()\n {\n return SendMessageW(this->ctrlHwnd, CB_GETCURSEL, NULL, NULL);\n }\n\n bool SetSelectedIndex(LONG index)\n {\n return SendMessageW(this->ctrlHwnd, CB_SETCURSEL, (WPARAM)index, NULL) == index;\n }\n\n bool GetSelectedIndexTextA(LPSTR buffer)\n {\n LONG selIndex = GetSelectedIndex();\n\n return SendMessageA(this->ctrlHwnd, CB_GETLBTEXT, selIndex, (LPARAM)buffer) > 0;\n }\n};" }, { "path": "x64dbgApiBreak/src/incl/ui/ctrl/uicontrolbase.hpp", "content": "#pragma once\n#include \n#include \n\n#define IMPL_CTRLBASE_CTOR(t) t(UIOBJECT *ui, ULONG ctrlId, UiWrapper *parent) : UiControlBase(ui,ctrlId,parent) \n\nclass UiControlBase\n{\nprivate:\n struct OwnerStringDrawInfo\n {\n char value[512];\n COLORREF foreColor;\n POINT xy;\n };\nprotected:\n UIOBJECT *ui;\n DWORD ctrlId;\n HWND ctrlHwnd;\n UiWrapper *parent;\n OwnerStringDrawInfo ownerStringDrawData;\n\n DWORD MyId() const\n {\n return this->ctrlId;\n }\n\n HWND MyHandle() const\n {\n return this->ctrlHwnd;\n }\n\n ULONG GetStringCommon(BYTE **pValue, ULONG size)\n {\n LONG reqLen, readLen;\n\n reqLen = SendControlMsg(WM_GETTEXTLENGTH, NULL, NULL);\n\n if (reqLen <= 0)\n return 0;\n\n \n reqLen++; //Include null term\n\n\n if (size == 0)\n {\n if (IsWindowUnicode(MyHandle()))\n *pValue = (BYTE *)ALLOCSTRINGW(reqLen);\n else\n *pValue = (BYTE *)ALLOCSTRINGA(reqLen);\n\n if (*pValue == NULL)\n return 0;\n }\n\t\telse if ((ULONG)reqLen > size)\n\t\t{\n\t\t\treturn 0;\n\t\t}\n\n\n readLen = SendControlMsg(WM_GETTEXT, (WPARAM)reqLen, (LPARAM)*pValue);\n\n if (readLen <= 0)\n return 0;\n\n return readLen;\n }\n\npublic:\n UiControlBase()\n {\n this->ui = NULL;\n this->ctrlId = 0;\n }\n\n UiControlBase(UIOBJECT *ui, DWORD ctrlId, UiWrapper *parent)\n {\n this->ui = ui;\n this->ctrlId = ctrlId;\n this->parent = parent;\n\n this->ctrlHwnd = GetDlgItem(this->ui->hwnd, this->ctrlId);\n }\n\n LONG SendControlMsg(UINT msg, WPARAM wp, LPARAM lp)\n {\n return (LONG)::SendMessage(this->ctrlHwnd, msg, wp, lp);\n }\n\n void EnableOwnerDraw()\n {\n LONG style = GetWindowLong(MyHandle(), GWL_STYLE);\n\n style |= SS_OWNERDRAW;\n\n SetWindowLong(MyHandle(), GWL_STYLE, style);\n }\n\n void Disable()\n {\n ::EnableWindow(MyHandle(), FALSE);\n }\n\n void Enable()\n {\n ::EnableWindow(MyHandle(), TRUE);\n }\n\n void SetEnableState(bool enable)\n {\n ::EnableWindow(MyHandle(), enable);\n }\n\n ULONG GetStringA(LPSTR *pValue, ULONG size)\n {\n BYTE *pVal=NULL;\n ULONG readLen;\n LPSTR strA;\n\n if (IsWindowUnicode(MyHandle()))\n {\n readLen = GetStringCommon(&pVal, 0);\n\n if (!readLen)\n return 0;\n\n if (readLen > size - 1)\n {\n FREESTRING(*pVal);\n return 0;\n }\n\n strA = HlpWideToAnsiString((LPCWSTR)pVal);\n\n if (!size)\n *pValue = strA;\n else\n {\n strcpy(*pValue, strA);\n FREESTRING(strA);\n }\n }\n else\n readLen = GetStringCommon((BYTE **)pValue, size);\n\n return readLen;\n }\n\n ULONG GetStringW(LPWSTR *pValue, ULONG size)\n {\n BYTE *pVal = NULL;\n ULONG readLen;\n LPWSTR strW;\n\n if (!IsWindowUnicode(MyHandle()))\n {\n readLen = GetStringCommon(&pVal, 0);\n\n if (!readLen)\n return 0;\n\n if (readLen > size - 1)\n {\n FREESTRING(*pVal);\n return 0;\n }\n\n strW = HlpAnsiToWideString((LPCSTR)pVal);\n\n if (!size)\n *pValue = strW;\n else\n {\n wcscpy(*pValue, strW);\n FREESTRING(strW);\n }\n }\n else\n readLen = GetStringCommon((BYTE **)pValue, size);\n\n return readLen;\n }\n\n BOOL SetStringA(LPCSTR value)\n {\n return SetWindowTextA(MyHandle(), value);\n }\n\n BOOL SetStringW(LPCWSTR value)\n {\n return SetWindowTextW(MyHandle(), value);\n }\n\n void DrawStringA(LPCSTR text, INT x, INT y, COLORREF foreColor)\n {\n strcpy(ownerStringDrawData.value, text);\n ownerStringDrawData.xy.x = x;\n ownerStringDrawData.xy.y = y;\n ownerStringDrawData.foreColor = foreColor;\n InvalidateRect(MyHandle(), NULL, TRUE);\n }\n\n void DrawStringFormatA(INT x, INT y, COLORREF foreColor, LPCSTR format, ...)\n {\n va_list va;\n LPSTR buffer;\n va_start(va, format);\n \n if (!HlpPrintFormatBufferExA(&buffer, format, va))\n return;\n\n DrawStringA(buffer, x, y, foreColor);\n\n FREESTRING(buffer);\n\n va_end(va);\n }\n\n\n virtual void OnInitControl()\n {\n\n }\n\n virtual void OnCommand(WPARAM wp)\n {\n\n }\n\n virtual void OnDrawItem(LPDRAWITEMSTRUCT dis)\n {\n UiDrawStringA(\n dis->hDC, \n ownerStringDrawData.value, \n ownerStringDrawData.xy.x,\n ownerStringDrawData.xy.y, \n ownerStringDrawData.foreColor, 0);\n }\n\n\n};" }, { "path": "x64dbgApiBreak/src/incl/ui/ui.h", "content": "#ifndef __UI_H_\n#define __UI_H_\n\n#include \n#include \n\ntypedef struct\n{\n DWORD flag;\n POINT point;\n SIZE size;\n}WINDOWREGIONINFO;\n\n#define WRIF_CENTER 0x00000001\n#define WRIF_LOCATION 0x00000002\n#define WRIF_SIZE 0x00000004\n\n\ntypedef struct tagPreCreateWindowInfo\n{\n WINDOWREGIONINFO wri;\n}PRECREATEWINDOWINFO;\n\n\ntypedef struct tagWindowCreationInfo\n{\n PRECREATEWINDOWINFO *pci;\n}WINDOWCREATIONINFO;\n\ntypedef INT_PTR(CALLBACK* UIDLGPROC)(HWND, UINT, WPARAM, LPARAM, PVOID);\n\ntypedef VOID(*UIAFTEREXITDISPOSER)();\n\ntypedef struct tagUiResult\n{\n HWND hwnd;\n UIDLGPROC dlgProc;\n UIAFTEREXITDISPOSER uiDisposer;\n HANDLE uiThread;\n DWORD uiThreadId;\n HANDLE uiEvent;\n INT_PTR result;\n UINT dlgResourceId;\n BOOL seperateThread;\n HWND parentWnd;\n PVOID param;\n BOOL isUiOutside;\n BOOL isRunning;\n}UIOBJECT;\n\n#define SetTextW(hwnd,idc,wstr) ::SetWindowTextW(::GetDlgItem(hwnd,idc),wstr)\n#define SetDlgCaptionW(wnd,wstr) ::SetWindowTextW(wnd,wstr)\n\n#define GetControlHwnd(ui,item) ::GetDlgItem(ui->hwnd,item)\n\nBOOL UiIsRunning(UIOBJECT *ui);\n\nVOID UiRegisterDisposer(UIOBJECT *uiObject, UIAFTEREXITDISPOSER disposer);\n\nUIOBJECT *UiCreateDialog(\n UIDLGPROC dlgProc,\n HWND parentWnd,\n UINT dialogResourceId,\n BOOL seperateThread,\n PVOID param,\n WINDOWCREATIONINFO *wci,\n BOOL *wasSucceeded);\n\nBOOL UiDrawStringA(HDC dc, LPCSTR text, FLOAT x, FLOAT y, COLORREF forecolor, COLORREF backcolor);\n\nvoid UiReleaseObject(UIOBJECT *ui);\n\nBOOL UiDestroyDialog(UIOBJECT *ui);\n\nvoid UiForceCloseAllActiveWindows();\n\n#endif //__UI_H_" }, { "path": "x64dbgApiBreak/src/incl/ui/uiwrapper.hpp", "content": "#pragma once\n\nclass UiWrapper;\n\n#include \n#include \n\n#include \n\nusing namespace std;\n\nclass UiWrapper\n{\nprivate:\n\n static UINT_PTR CALLBACK DialogProc(HWND hwnd, UINT msg, WPARAM wp, LPARAM lp, PVOID arg)\n {\n UiWrapper *_this = (UiWrapper *)arg;\n\n switch (msg)\n {\n case WM_INITDIALOG:\n {\n _this->uiObject = (UIOBJECT *)lp;\n _this->OnInitInternal();\n }\n break;\n case WM_WINDOWPOSCHANGED:\n case WM_ACTIVATE:\n case WM_SHOWWINDOW:\n {\n if (!_this->isFullyLoaded)\n {\n if (IsWindowVisible(hwnd))\n {\n _this->isFullyLoaded = true;\n _this->OnLoaded();\n }\n }\n }\n break;\n case WM_COMMAND:\n _this->OnCommand(wp, lp);\n break;\n case WM_PAINT:\n _this->OnPaint();\n break;\n case WM_TIMER:\n _this->OnTimerTick((LONG)wp);\n break;\n case WM_CLOSE:\n _this->OnClose();\n break;\n case WM_DRAWITEM:\n _this->OnDrawItem((LPDRAWITEMSTRUCT)lp, (LONG)wp);\n return TRUE;\n case WM_QUIT:\n _this->OnDestroyed();\n break;\n }\n\n\n return 0;\n }\n\nprivate:\n HANDLE initCompletedEvent;\n UIOBJECT *uiObject;\n WINDOWCREATIONINFO wci;\n LONG dlgId;\n bool isFullyLoaded;\n bool killingSelf;\n\n unordered_map childControls;\n\n UiControlBase *LookupControl(HWND hwnd)\n {\n unordered_map::iterator it;\n\n if (childControls.size() == 0)\n return nullptr;\n\n it = childControls.find(hwnd);\n\n if (it == childControls.end())\n return NULL;\n\n return it->second;\n }\n\n void DestroyControlResources()\n {\n unordered_map::iterator it;\n UiControlBase *control = NULL;\n\n if (childControls.size() == 0)\n return;\n\n while (childControls.size() > 0)\n {\n it = childControls.begin();\n control = it->second;\n childControls.erase(it);\n delete control;\n }\n }\n\nprivate:\n\n bool SetControlEnableState(ULONG ctrlId, bool state)\n {\n HWND ctrlHwnd = GetDlgItem(GetHWND(), ctrlId);\n\n if (!ctrlHwnd)\n return false;\n\n return (bool)EnableWindow(ctrlHwnd, (BOOL)state);\n }\n\n void InitCommon(LONG dlgId, bool center)\n {\n this->killingSelf = false;\n this->isFullyLoaded = false;\n this->initCompletedEvent = CreateEvent(NULL, FALSE, FALSE, NULL);\n\n this->dlgId = dlgId;\n\n this->wci.pci = NULL;\n\n if (center)\n {\n this->wci.pci = ALLOCOBJECT(PRECREATEWINDOWINFO);\n this->wci.pci->wri.flag = WRIF_CENTER;\n }\n\n }\n\n void OnInitInternal()\n {\n this->OnInit();\n\n SetEvent(this->initCompletedEvent);\n }\n\npublic:\n\n UiWrapper(LONG dlgId, bool center)\n {\n InitCommon(dlgId, center);\n }\n\n UiWrapper(LONG dlgId)\n {\n InitCommon(dlgId, false);\n }\n\n ~UiWrapper(void)\n {\n DestroyControlResources();\n\n\t\tif (this->wci.pci != NULL)\n\t\t\tFREEOBJECT(this->wci.pci);\n\n CloseHandle(this->initCompletedEvent);\n\n if (!this->killingSelf)\n {\n if (UiIsRunning(this->uiObject))\n Close();\n }\n }\n\n static void DestroyAllActiveWindows()\n {\n UiForceCloseAllActiveWindows();\n }\n\n virtual bool ShowDialog()\n {\n return ShowDialog(true);\n }\n\n virtual bool ShowDialog(bool seperateUiThread)\n {\n BOOL succeeded;\n\n this->uiObject = UiCreateDialog(\n (UIDLGPROC)this->DialogProc,\n NULL,\n this->dlgId,\n (BOOL)seperateUiThread,\n this,\n &this->wci,\n &succeeded);\n\n if (!seperateUiThread)\n return (bool)succeeded;\n\n return this->uiObject != NULL;\n }\n\n HWND GetHWND() const\n {\n return this->uiObject->hwnd;\n }\n\n bool SetTimer(LONG timerId, ULONG period)\n {\n return ::SetTimer(GetHWND(), (UINT_PTR)timerId, (UINT)period, NULL)\n == timerId;\n }\n\n void KillTimer(LONG timerId)\n {\n ::KillTimer(GetHWND(), (UINT_PTR)timerId);\n }\n\n LONG MessageBox(LPWSTR msg, LPWSTR title, ULONG flags)\n {\n return ::MessageBoxW(GetHWND(), (LPCWSTR)msg, (LPCWSTR)title, flags);\n }\n\n LONG MsgBoxInfo(LPCSTR msg, LPCSTR title)\n {\n return ::MessageBoxA(GetHWND(), msg, title, MB_ICONINFORMATION);\n }\n\n LONG MsgBoxError(LPCSTR msg, LPCSTR title)\n {\n return ::MessageBoxA(GetHWND(), msg, title, MB_ICONERROR);\n }\n\n LONG MsgBoxQuestion(LPCSTR msg, LPCSTR title)\n {\n return ::MessageBoxA(GetHWND(), msg, title, MB_YESNO | MB_ICONQUESTION);\n }\n\n void WaitForInitCompletion()\n {\n WaitForSingleObject(this->initCompletedEvent, INFINITE);\n }\n\n void Close()\n {\n if (UiDestroyDialog(this->uiObject))\n {\n this->uiObject = NULL;\n }\n }\n\n ULONG GetControlTextA(ULONG ctrlId, LPSTR strBuf, ULONG bufSize)\n {\n LPWSTR wbuf = ALLOCSTRINGW(bufSize);\n LPSTR as;\n ULONG textLen;\n\n if (!wbuf)\n return 0;\n\n textLen = GetControlText(ctrlId, wbuf, bufSize);\n\n if (textLen > 0)\n {\n as = HlpWideToAnsiString(wbuf);\n\n if (as != NULL)\n {\n strncpy(strBuf, as, textLen);\n FREESTRING(as);\n }\n }\n\n FREESTRING(wbuf);\n\n return textLen;\n }\n\n ULONG GetControlText(ULONG ctrlId, LPWSTR strBuf, ULONG bufSize)\n {\n HWND ctrlHwnd = GetDlgItem(GetHWND(), ctrlId);\n\n if (!ctrlHwnd)\n return 0;\n\n return GetWindowTextW(ctrlHwnd, (LPWSTR)strBuf, bufSize);\n }\n\n void SetWindowTitleW(LPWSTR title)\n {\n SetWindowTextW(GetHWND(), title);\n }\n\n void SetWindowTitleA(LPSTR title)\n {\n SetWindowTextA(GetHWND(),title);\n }\n\n bool SetControlTextA(ULONG ctrlId, LPSTR str)\n {\n bool ret;\n LPWSTR wstr;\n\n wstr = HlpAnsiToWideString(str);\n\n ret = SetControlText(ctrlId, wstr);\n\n FREESTRING(wstr);\n\n return ret;\n }\n\n bool SetControlText(ULONG ctrlId, LPWSTR str)\n {\n HWND ctrlHwnd = GetDlgItem(GetHWND(), ctrlId);\n\n if (!ctrlHwnd)\n return false;\n\n return (bool)SetWindowTextW(ctrlHwnd, (LPCWSTR)str);\n }\n\n bool SetControlTextFormatA(ULONG ctrlId, const char *format, ...)\n {\n char *buffer;\n bool success = false;\n\n va_list vl;\n\n va_start(vl, format);\n\n if (HlpPrintFormatBufferExA(&buffer, format, vl) > 0)\n {\n SetControlTextA(ctrlId, buffer);\n FREESTRING(buffer);\n success = true;\n }\n\n va_end(vl);\n\n return success;\n }\n\n bool EnableControl(ULONG ctrlId)\n {\n return SetControlEnableState(ctrlId, true);\n }\n\n bool DisableControl(ULONG ctrlId)\n {\n return SetControlEnableState(ctrlId, false);\n }\n\n template T *GetControlById(ULONG ctrlId)\n {\n HWND ctrlHwnd;\n T *ctrl = NULL;\n \n ctrlHwnd = GetDlgItem(GetHWND(), ctrlId);\n\n \n if ((ctrl = (T *)LookupControl(ctrlHwnd)) != NULL)\n return ctrl;\n \n ctrl = new T(this->uiObject, ctrlId, this);\n\n\n childControls.insert(std::pair(ctrlHwnd, ctrl));\n\n ctrl->OnInitControl();\n\n return ctrl;\n }\n\n virtual void OnTimerTick(LONG timerId)\n {\n\n }\n\n virtual void OnDestroyed()\n {\n delete this;\n }\n\n virtual void OnClose()\n {\n this->killingSelf = true;\n }\n\n virtual void OnPaint()\n {\n }\n\n virtual void OnLoaded()\n {\n\n }\n\n virtual void OnCommand(WPARAM wp, LPARAM lp)\n {\n UiControlBase *ctrl = NULL;\n\n if (lp != NULL)\n {\n ctrl = LookupControl((HWND)lp);\n\n if (ctrl != nullptr)\n ctrl->OnCommand(wp);\n }\n }\n\n virtual void OnDrawItem(LPDRAWITEMSTRUCT dis, LONG ctrlId)\n {\n UiControlBase *ctrl = NULL;\n\n HWND wnd = GetDlgItem(GetHWND(), ctrlId);\n\n ctrl = LookupControl(wnd);\n\n if (ctrl != nullptr)\n ctrl->OnDrawItem(dis);\n \n }\n\n virtual void OnInit()\n {\n }\n};\n\n" }, { "path": "x64dbgApiBreak/src/incl/util.h", "content": "#ifndef __UTIL_H__\n#define __UTIL_H__\n\n#include \n\ntypedef enum\n{\n Cdecl,\n Stdcall,\n Fastcall,\n Thiscall\n}CALLCONVENTION;\n\ntypedef struct\n{\n REGDUMP regCtx;\n CALLCONVENTION convention;\n USHORT paramCount;\n duint * paramList;\n}*PPASSED_PARAMETER_CONTEXT,PASSED_PARAMETER_CONTEXT;\n\n#ifdef _WIN64\ntypedef ULONGLONG ARCHWIDE;\n#else\ntypedef ULONG ARCHWIDE;\n#endif\n\n\ntypedef struct __DMA\n{\n WORD sizeOfType;\n ULONG count;\n ARCHWIDE writeBoundary;\n ARCHWIDE totalSize;\n LONG needsSynchronize;\n BOOL ownershipTaken;\n CRITICAL_SECTION areaGuard;\n DWORD oldProtect;\n struct\n {\n ULONG offset;\n ARCHWIDE size;\n ULONG beginCookie;\n ULONG endCookie;\n }UnsafeWriteCheckInfo;\n void * memory;\n}*PDMA,DMA; //DYNAMIC MEMORY ADAPTER\n\n#define DMA_AUTO_OFFSET ULONG_MAX\n\n\nBOOL DmaCreateAdapter(WORD sizeOfType, ULONG initialCount, PDMA *dma);\n\nBOOL DmaWriteNeedsExpand(PDMA dma, ARCHWIDE needByteSize, ULONG writeBeginOffset, BOOL autoIssue);\n\nBOOL DmaIssueExpansion(PDMA dma, LONG expansionDelta);\n\nBOOL DmaRead(PDMA dma, ULONG offset, ARCHWIDE size, void *destMemory);\n\nBOOL DmaWrite(PDMA dma, ULONG offset, ARCHWIDE size, void *srcMemory);\n\nBOOL DmaStringWriteA(PDMA dma, LPCSTR format,...);\n\nBOOL DmaStringWriteW(PDMA dma, LPCWSTR format, ...);\n\nBOOL DmaReadTypeAlignedSequence(PDMA dma, ULONG index, ULONG count, void *destMemory);\n\nBOOL DmaTakeMemoryOwnership(PDMA dma, void **nativeMem);\n\nBOOL DmaPrepareForDirectWrite(PDMA dma, ULONG writeOffset, ARCHWIDE writeSize, void **nativeMem);\n\nvoid DmaGetAdapterInfo(PDMA dma, ARCHWIDE *writtenSize, ARCHWIDE *totalSize);\n\nBOOL DmaPrepareForRead(PDMA dma, void **nativeMem);\n\nBOOL DmaSink(PDMA dma);\n\nvoid DmaDestroyAdapter(PDMA dma);\n\nBOOL UtlExtractPassedParameters(USHORT paramCount, CALLCONVENTION callConv, REGDUMP *regdump, BOOL ipOnStack, PPASSED_PARAMETER_CONTEXT *paramInfo);\n\nduint UtlGetCallerAddress(REGDUMP *regdump);\n\nBOOL UtlInternetReadW(LPCWSTR url, BYTE **content, ULONG *contentLength);\n\nBOOL UtlInternetReadA(LPCSTR url, BYTE **content, ULONG *contentLength);\n\n#endif // !__UTIL_H__\n" }, { "path": "x64dbgApiBreak/src/instparse.cpp", "content": "#include \n\nconst char *regs[17]\n{\n \"*ax\",\n \"*bx\",\n \"*cx\",\n \"*dx\",\n \"*si\",\n \"*di\",\n \"*bp\",\n \"*sp\",\n \"*ip\",\n \"r8\",\n \"r9\",\n \"r10\",\n \"r11\",\n \"r12\",\n \"r13\",\n \"r14\",\n \"r15\"\n};\n\n#define TOKLIST_SIZE 32\n#define TOKLIST_MAX (TOKLIST_SIZE - 1)\n\n#define RT_IMM 0\n#define RT_REG 1\n\ntypedef struct\n{\n struct\n {\n char tok[16];\n }tokenList[TOKLIST_SIZE];\n duint count;\n duint index;\n}token_data;\n\n\n#define Currtoken(td) (char *)(td)->tokenList[(td)->index].tok\n\n__forceinline void Skiptoken(token_data *td, int skip)\n{\n //prevent the possible overflow if skip delta is negative (to the back)\n if ((duint)abs(skip) > td->index)\n return;\n\n td->index += skip;\n}\n\n__forceinline char * Nexttoken(token_data *td)\n{\n char *tok = NULL;\n \n if (td->index < td->count)\n tok = (char *)td->tokenList[++td->index].tok;\n\n return tok;\n}\n\n__forceinline char * Prevtoken(token_data *td)\n{\n char *tok = NULL;\n \n if (td->index != 0)\n tok = (char *)td->tokenList[--td->index].tok;\n\n return tok;\n}\n\n\n__forceinline char *Nextslot(token_data *td)\n{\n if (td->count >= TOKLIST_MAX)\n return NULL;\n\n return td->tokenList[++td->count].tok;\n}\n\nvoid AbpTokenize(char *inst, token_data *tokdata)\n{\n char *p,*pbuf;\n int pbi = 0;\n\n memset(tokdata, 0, sizeof(token_data));\n\n p = inst;\n\n pbuf = tokdata->tokenList[0].tok;\n tokdata->index = 0;\n\n while (*p != 0)\n {\n if (*p == ' ' || *p == ',' || *p == ':')\n {\n if (pbi > 0)\n {\n pbuf = Nextslot(tokdata);\n pbi = 0;\n }\n }\n else if (*p == '*' || *p == '+' || *p == '-' || *p == '[' || *p == ']')\n {\n if (pbi > 0)\n {\n pbuf = Nextslot(tokdata);\n pbi = 0;\n }\n\n *pbuf = *p;\n pbuf = Nextslot(tokdata);\n }\n else\n {\n pbuf[pbi++] = *p;\n }\n\n p++;\n }\n\n}\n\nbool _AbpParseRegister(token_data *td, InstInfo *instInfo, dsint *val, short *size, unsigned char *type);\n\n/*\n\n\nDirect Operand: displacement (often just the symbolic name for a memory location)\n\nIndirect Operand: (base)\n\nBase+displacement: \n\n(index*scale)+displacement\n\nBase + index + displacement\n\nBase+(index*scale)+ displacement\n\n*/\n\n#define MAO_ADD 1\n#define MAO_MUL 2\n\n#define ADM_BORD 0\n#define ADM_BD MAO_ADD // + \n#define ADM_ISD MAO_MUL + MAO_ADD // * +\n#define ADM_BID MAO_ADD + MAO_ADD // + +\n#define ADM_BISD MAO_ADD + MAO_MUL + MAO_ADD // + * +\n\n\n\nbool AbpParseMemoryAccess(token_data *td, InstInfo *linst)\n{\n int adr_mode = 0;\n\n struct\n {\n dsint ident;\n short size;\n unsigned char type;\n }idents[5];\n\n int idx = 0;\n\n char *p = NULL;\n \n if (linst->op == OP_PUSH || linst->reg != RegNone)\n linst->mem_access = MA_READ;\n else if (linst->reg == RegNone)\n linst->mem_access = MA_WRITE;\n\n do\n {\n p = Nexttoken(td);\n\n if (*p == '*')\n {\n adr_mode += MAO_MUL;\n continue;\n }\n else if (*p == '-' || *p == '+')\n {\n adr_mode += MAO_ADD;\n continue;\n }\n else if (*p == ']')\n break;\n\n if (!_AbpParseRegister(td, NULL, &idents[idx].ident, &idents[idx].size, &idents[idx].type))\n return false;\n\n idx++;\n\n } while (*p);\n\n switch (adr_mode)\n {\n case ADM_BORD:\n if (idents[0].type == RT_IMM)\n linst->memory_info.disp = (int)idents[0].ident;\n else\n linst->memory_info.base = (unsigned char)idents[0].ident;\n\n break;\n case ADM_BD:\n linst->memory_info.base = (unsigned char)idents[0].ident;\n linst->memory_info.disp = (int)idents[1].ident;\n break;\n case ADM_BID:\n linst->memory_info.base = (unsigned char)idents[0].ident;\n linst->memory_info.index = (unsigned char)idents[1].ident;\n linst->memory_info.disp = (int)idents[2].ident;\n break;\n case ADM_BISD:\n linst->memory_info.base = (unsigned char)idents[0].ident;\n linst->memory_info.index = (unsigned char)idents[1].ident;\n linst->memory_info.scale = (unsigned char)idents[2].ident; //1, 2 ,4, 8\n linst->memory_info.disp = (int)idents[2].ident;\n break;\n case ADM_ISD:\n linst->memory_info.index = (unsigned char)idents[0].ident;\n linst->memory_info.scale = (unsigned char)idents[1].ident;\n linst->memory_info.disp = (unsigned char)idents[2].ident;\n break;\n }\n\n return true;\n}\n\ninline bool AbpIsNumStr(const char *str)\n{\n char *p = const_cast(str);\n\n while (*p)\n {\n if (!isdigit(*p))\n return false;\n\n p++;\n }\n\n return true;\n}\n\nbool _AbpParseRegister(token_data *td, InstInfo *instInfo, dsint *val, short *size, unsigned char *type)\n{\n char *p = Currtoken(td);\n char pfx = *p;\n int beg = 0, end = 8, rx = -1;\n bool ok = false;\n dsint nval;\n short nsize;\n unsigned char ntype;\n\n if (*p == '[')\n {\n ok = AbpParseMemoryAccess(td, instInfo);\n\n if (ok)\n {\n if (instInfo->reg == RegNone)\n instInfo->reg = ImmMem;\n else\n instInfo->reg_oper = ImmMem;\n }\n\n return ok;\n }\n\n \n if (strstr(p, \"0x\") || AbpIsNumStr(p))\n {\n#ifdef _WIN64\n nval = (dsint)strtoll(p, NULL, 0);\n nsize = 64;\n#else\n nval = (dsint)strtol(p, NULL, 0);\n nsize = 32;\n#endif\n\n ntype = RT_IMM;\n ok = true;\n\n goto oneWayExit;\n }\n\n nsize = GET_REGSIZE(pfx);\n\n if (pfx == 'r')\n {\n beg = 0;\n end = 17;\n }\n\n for (;beg < end;beg++)\n {\n if (!strcmp(p + 1, regs[beg] + 1))\n {\n rx = beg;\n break;\n }\n }\n \n nval = rx;\n ntype = RT_REG;\n ok = true;\n\noneWayExit:\n\n if (instInfo != NULL)\n {\n switch (ntype)\n {\n case RT_IMM:\n {\n instInfo->imm = (duint)nval;\n\n if (instInfo->reg == (char)RegNone)\n instInfo->reg = ImmMem;\n else\n instInfo->reg_oper = ImmMem;\n break;\n }\n case RT_REG:\n {\n if (instInfo->reg == (char)RegNone)\n instInfo->reg = (char)nval;\n else\n instInfo->reg_oper = (char)nval;\n\n break;\n }\n }\n\n instInfo->size = nsize;\n }\n else\n {\n *val = nval;\n *size = nsize;\n *type = ntype;\n }\n\n return ok;\n}\n\nbool AbpParseRegister(token_data *td, InstInfo *instInfo)\n{\n return _AbpParseRegister(td, instInfo, NULL, NULL, NULL);\n}\n\nbool AbpParseOperand(token_data *td, InstInfo *linst)\n{\n char *p = Currtoken(td);\n\n if (!strcmp(p, \"byte\") ||\n !strcmp(p, \"word\") ||\n !strcmp(p, \"dword\") ||\n !strcmp(p, \"qword\"))\n {\n Skiptoken(td, 1);\n p = Nexttoken(td);\n\n if (p[1] == 's' && p[2] == '\\0') //if segment identifier skip to the next token\n p = Nexttoken(td); //grab register\n\n if (!p)\n return false;\n }\n\n if (!AbpParseRegister(td, linst))\n return false;\n\n return true;\n}\n\n#if _DEBUG\n#define _PRSLOG DBGPRINT\n\n#define CONCAT_BUF(buf,format, ...) HlpConcateStringFormatA(buf,1024,format,__VA_ARGS__)\n\nvoid __AbpPrintMemData(InstInfo *inst, char *buf)\n{\n if (inst->memory_info.base != uchar(RegNone))\n CONCAT_BUF(buf, \"(base: %s) \", regs[inst->memory_info.base]);\n\n if (inst->memory_info.index != uchar(RegNone))\n CONCAT_BUF(buf, \"(index: %s) \", regs[inst->memory_info.index]);\n\n if (inst->memory_info.scale != 0)\n CONCAT_BUF(buf, \"(scale: %d) \", inst->memory_info.scale);\n\n if (inst->memory_info.disp != 0)\n CONCAT_BUF(buf, \"(disp: 0x%x)\", inst->memory_info.disp);\n\n CONCAT_BUF(buf, \" - \");\n}\n\nvoid __AbpPrintInstructionInfo(InstInfo *inst)\n{\n char inst_info_buf[1024] = { 0 };\n bool single = false;\n\n if (inst->reg_oper == uchar(RegNone))\n {\n if (inst->reg == uchar(RegNone))\n {\n CONCAT_BUF(inst_info_buf, \"Invalid instruction\");\n goto doPrint;\n }\n\n CONCAT_BUF(inst_info_buf, \"Single operand. Operand: \");\n single = true;\n }\n else\n CONCAT_BUF(inst_info_buf,\"Source operand: \");\n\n\n\n if (inst->reg == ImmMem)\n __AbpPrintMemData(inst, inst_info_buf);\n else\n CONCAT_BUF(inst_info_buf, \"Reg: %s \", regs[inst->reg]);\n\n\n if (!single)\n {\n CONCAT_BUF(inst_info_buf, \"Dest operand: \");\n\n if (inst->reg_oper == ImmMem)\n __AbpPrintMemData(inst, inst_info_buf);\n else\n CONCAT_BUF(inst_info_buf, \"Reg: %s \", regs[inst->reg_oper]);\n }\n\ndoPrint:\n\n _PRSLOG(\"%s\",inst_info_buf);\n\n}\n\n#else\n#define _PRSLOG\n#endif\n\n\nbool AbParseInstruction(BASIC_INSTRUCTION_INFO *inst, InstInfo *linst)\n{\n char *p;\n \n token_data tokdata;\n\n char order = 0;\n AbpTokenize(inst->instruction, &tokdata);\n\n if (!tokdata.count)\n return false;\n \n p = Currtoken(&tokdata);\n\n memset(linst, 0, sizeof(InstInfo));\n\n linst->reg = RegNone;\n linst->reg_oper = RegNone;\n linst->memory_info.base = RegNone;\n linst->memory_info.index = RegNone;\n\n while (p != NULL && order != ORD_DONE)\n {\n if (order == ORD_OP)\n {\n if (!strcmp(p, \"mov\"))\n linst->op = OP_MOV;\n else if (!strcmp(p, \"lea\"))\n linst->op = OP_LEA;\n else if (!strcmp(p, \"push\"))\n linst->op = OP_PUSH;\n else\n return false;\n\n order++;\n }\n else if (order == ORD_DREG)\n {\n if (!AbpParseOperand(&tokdata, linst))\n return false;\n\n order++;\n\n\n if (linst->op == OP_PUSH)\n {\n order++;\n }\n }\n else if (order == ORD_SREG)\n {\n if (!AbpParseOperand(&tokdata, linst))\n return false;\n \n order++;\n }\n\n p = Nexttoken(&tokdata);\n\n }\n \n return true;\n}" }, { "path": "x64dbgApiBreak/src/plugin.cpp", "content": "#include \n#include \n#include \n#include \n#include \n\n\n#define MN_BASE 0xFA00FA\n\n#define MN_ABOUT MN_BASE\n#define MN_SHOWMAINFORM MN_BASE + 1\n#define MN_SHOWSETTINGSFORM MN_BASE + 2\n#define MN_TESTSLOT MN_BASE + 3\n\n#define DWS_IDLE 0\n#define DWS_CREATEPROCESS 1\n#define DWS_ATTACHEDPROCESS 2\n#define DWS_EXITEDPROCESS 3\n#define DWS_DETACHEDPROCESS 4\n\nconst char *DBGSTATE_STRINGS[5] =\n{\n \"Idle\",\n \"Process Created\",\n \"Process Attached\",\n \"Process Exited\",\n \"Process Detached\"\n};\n\n\nBYTE AbpDbgState;\nScript::Module::ModuleInfo AbpCurrentMainModule;\nBOOL AbfNeedsReload=FALSE;\n\nINTERNAL int AbPluginHandle;\nINTERNAL HWND AbHwndDlgHandle;\nINTERNAL int AbMenuHandle;\nINTERNAL int AbMenuDisasmHandle;\nINTERNAL int AbMenuDumpHandle;\nINTERNAL int AbMenuStackHandle;\nINTERNAL HMODULE AbPluginModule;\n\nINTERNAL WORD AbParsedTypeCount = 0;\n\nINTERNAL void AbiRaiseDeferredLoader(const char *dllName, duint base);\n\nINTERNAL void AbiInitDynapi();\nINTERNAL void AbiUninitDynapi();\nINTERNAL void AbiReleaseDeferredResources();\nINTERNAL void AbiEmptyInstructionCache();\n\nBOOL AbpHasPendingInit = FALSE;\n\nINTERNAL_EXPORT Script::Module::ModuleInfo *AbiGetCurrentModuleInfo()\n{\n return &AbpCurrentMainModule;\n}\n\n\n\nint WINAPI Loader(void *)\n{\n AbLoadAvailableModuleAPIs(true);\n return 0;\n}\n\nvoid AbpParseScripts()\n{\n char *tokCtx;\n char *scripts = NULL;\n char *line;\n LPSTR errStr;\n\n if (!AbGetSettings()->mainScripts)\n return;\n\n scripts = HlpCloneStringA(AbGetSettings()->mainScripts);\n\n if (!scripts)\n {\n DBGPRINT(\"memory error\");\n return;\n }\n\n line = strtok_s(scripts, \"\\r\\n;\", &tokCtx);\n\n while (line)\n {\n DBGPRINT(\"Parsing '%s'\", line);\n SmmParseFromFileA(line, &AbParsedTypeCount);\n line = strtok_s(NULL, \"\\r\\n;\", &tokCtx);\n }\n\n if (SmmHasParseError(&errStr))\n {\n MessageBoxA(NULL, errStr, \"x64dbg Api Break - script parse error\", MB_ICONERROR);\n FREESTRING(errStr);\n }\n\n DBGPRINT(\"%d type(s) parsed.\", AbParsedTypeCount);\n\t\n\tFREESTRING(scripts);\n FREESTRING(line);\n}\n\nvoid AbpOnDebuggerStateChanged(BYTE state, const char *module)\n{\n switch (state)\n {\n case DWS_ATTACHEDPROCESS:\n case DWS_CREATEPROCESS:\n {\n if (AbGetSettings()->autoLoadData)\n {\n AbpHasPendingInit = TRUE;\n }\n }\n break;\n case DWS_DETACHEDPROCESS:\n case DWS_EXITEDPROCESS:\n {\n AbReleaseAllSystemResources(false);\n }\n break;\n }\n}\n\nvoid AbpRaiseDbgStateChangeEvent()\n{\n DBGPRINT(\"%s (%s)\", AbpCurrentMainModule.name, DBGSTATE_STRINGS[AbpDbgState]);\n\n AbpOnDebuggerStateChanged(AbpDbgState, AbpCurrentMainModule.name);\n\n if (AbpDbgState > DWS_ATTACHEDPROCESS)\n {\n //And after the handler callback. \n //set it to dbg is now idle if current state exited or detached\n AbpDbgState = DWS_IDLE;\n }\n}\n\nvoid AbReleaseAllSystemResources(bool isInShutdown)\n{\n DBGPRINT(\"Releasing used resources. shutdown=%d\",isInShutdown);\n\n\tSmmReleaseResources(isInShutdown);\n\tAbSettingsDestroyResources();\n\n AbiEmptyInstructionCache();\n AbiReleaseDeferredResources();\n AbpReleaseBreakpointResources();\n AbReleaseModuleResources();\n\n if (isInShutdown)\n {\n AbiUninitDynapi();\n UiForceCloseAllActiveWindows();\n }\n}\n\nBOOL AbRaiseSystemError(const char *errorDesc, int errCode,const char *func, const int line)\n{\n LPSTR msg;\n BOOL dbgBreak;\n\n HlpPrintFormatBufferA(&msg,\n \"An error occurred at %s:%d;\\r\\n\\r\\n%s\\r\\nDo you want to break into debugger?\",\n func,line,errorDesc);\n\n dbgBreak = MessageBoxA(NULL, msg, \"Error\", MB_ICONERROR | MB_YESNO) == IDYES;\n\n FREESTRING(msg);\n\n if (dbgBreak)\n {\n __debugbreak();\n return TRUE;\n }\n\n return FALSE;\n}\n\ntypedef bool(*pfnDbgGetRegDumpEx)(REGDUMP* regdump, size_t size);\nHMODULE g_DbgLib = NULL;\n\npfnDbgGetRegDumpEx _DbgGetRegDumpEx = NULL;\n\n#define VALTOSTRFY(val) _stringfy(val)\n\n#define BRIDGE_DLL \"x\" VALTOSTRFY(PLATFORM_SIZE) \"bridge.dll\"\n\nbool AbpNeedsNewerx64Dbg()\n{\n\tbool needsNew = false;\n\n\tg_DbgLib = GetModuleHandleA(BRIDGE_DLL);\n\n\tif (!g_DbgLib)\n\t{\n\t\tRAISEGLOBALERROR(\"dbglib error\");\n\t\treturn false;\n\t}\n\n\tif (!(_DbgGetRegDumpEx = (pfnDbgGetRegDumpEx)GetProcAddress(g_DbgLib, \"DbgGetRegDumpEx\")))\n\t\tneedsNew = true;\n\n\treturn needsNew;\n}\n\nvoid __AbpInitMenu()\n{\n _plugin_menuaddentry(AbMenuHandle, MN_SHOWMAINFORM, \"set an API breakpoint\");\n _plugin_menuaddentry(AbMenuHandle, MN_SHOWSETTINGSFORM, \"settings\");\n _plugin_menuaddentry(AbMenuHandle, MN_ABOUT, \"about?\");\n}\n\n\nDBG_LIBEXPORT bool pluginit(PLUG_INITSTRUCT* initStruct)\n{\n#if _DEBUG\n\tif (MessageBoxA(NULL, \"Wanna break into debugger?\", \"Dive-in\", MB_YESNO | MB_ICONQUESTION) == IDYES)\n\t{\n\t\t__debugbreak();\n\t}\n#endif\n\n initStruct->sdkVersion = PLUG_SDKVERSION;\n\tinitStruct->pluginVersion = (AB_VERSION_MAJOR * 10) + AB_VERSION_MINOR;\n strcpy_s(initStruct->pluginName, 256, \"Api Break\");\n AbPluginHandle = initStruct->pluginHandle;\n\n\tif (AbpNeedsNewerx64Dbg())\n\t{\n\t\tMessageBoxA(NULL,\n\t\t\t\"this version of plugin uses new x64dbg API. Consider update x64dbg to the new version.\",\n\t\t\t\"warning\",\n\t\t\tMB_OK | MB_ICONWARNING);\n\n\t\treturn false;\n\t}\n\n\tSmmInitializeResources();\n AbSettingsLoad();\n AbiInitDynapi();\n\n LoadLibraryA(\"Riched20.dll\");\n\n return true;\n}\n\nDBG_LIBEXPORT bool plugstop()\n{\n HMODULE hmod;\n\n AbReleaseAllSystemResources(true);\n\n hmod = GetModuleHandleA(\"Riched20.dll\");\n\n if (hmod)\n FreeLibrary(hmod);\n\n\tAbRevealPossibleMemoryLeaks();\n\n return true;\n}\n\nDBG_LIBEXPORT void plugsetup(PLUG_SETUPSTRUCT* setupStruct)\n{\n AbHwndDlgHandle = setupStruct->hwndDlg;\n AbMenuHandle = setupStruct->hMenu;\n AbMenuDisasmHandle = setupStruct->hMenuDisasm;\n AbMenuDumpHandle = setupStruct->hMenuDump;\n AbMenuStackHandle = setupStruct->hMenuStack;\n\n __AbpInitMenu();\n\n AbpParseScripts();\n}\n\n\n#include \n\nINTERNAL ApiFunctionInfo *AbiGetAfi(const char *module, const char *afiName);\n\n\nDBG_LIBEXPORT void CBMENUENTRY(CBTYPE cbType, PLUG_CB_MENUENTRY* info)\n{\n if (info->hEntry == MN_ABOUT)\n {\n MessageBoxA(AbHwndDlgHandle,\n AB_APPNAME \" - ver: \" AB_VERSTR \"\\r\\n\"\n \"build on: \" AB_BUILD_TIME \"\\r\\n\\r\\n\"\n \"by oguz (ozzy) kartal (2017)\\r\\n\\r\\n\"\n \"http://oguzkartal.net ;)\",\n \"About - \" AB_APPTITLE, \n MB_ICONINFORMATION);\n }\n else if (info->hEntry == MN_SHOWMAINFORM)\n {\n //Ps. Form object will be deleted automatically when the window closed.\n MainForm *mainForm = new MainForm();\n mainForm->ShowDialog();\n }\n else if (info->hEntry == MN_SHOWSETTINGSFORM)\n {\n SettingsForm *settingsForm = new SettingsForm();\n settingsForm->ShowDialog();\n }\n}\n\n\nDBG_LIBEXPORT void CBLOADDLL(CBTYPE cbType, PLUG_CB_LOADDLL *dllLoad)\n{\n duint base = DbgModBaseFromName(dllLoad->modname);\n\n if (!base)\n {\n DBGPRINT(\"Could not get dll base fro %s\", dllLoad->modname);\n return;\n }\n\n AbiRaiseDeferredLoader(dllLoad->modname, base);\n}\n\nDBG_LIBEXPORT void CBSYSTEMBREAKPOINT(CBTYPE cbType, PLUG_CB_SYSTEMBREAKPOINT *sysbp)\n{\n if (AbpHasPendingInit)\n {\n AbpHasPendingInit = FALSE;\n QueueUserWorkItem((LPTHREAD_START_ROUTINE)Loader, NULL, WT_EXECUTEDEFAULT);\n }\n}\n\nPPASSED_PARAMETER_CONTEXT AbpExtractPassedParameterContext(REGDUMP *regdump, PFNSIGN fnSign, BOOL ipOnStack)\n{\n SHORT argCount;\n PPASSED_PARAMETER_CONTEXT ppc;\n CALLCONVENTION conv;\n \n argCount = SmmGetArgumentCount(fnSign);\n\n#ifdef _WIN64\n conv = Fastcall;\n#else\n conv = Stdcall;\n#endif\n\n if (!UtlExtractPassedParameters(argCount, conv, regdump,ipOnStack, &ppc))\n {\n DBGPRINT(\"Parameter extraction failed\");\n return NULL;\n }\n\n return ppc;\n}\n\n\nvoid AbpGhostBreakpointHandler(BpCallbackContext *bpx)\n{\n}\n\n#include \n\nvoid AbpWaitUntilHandlerDone(PBREAKPOINT_INFO pbi)\n{\n while (pbi->status & BPS_EXECUTING_HANDLER)\n _mm_pause();\n\n //Give a bit time to the handler to make sure it returned\n SleepEx(10, FALSE);\n}\n\nLONG WINAPI AbpShowOutputArgumentQuestion(LPVOID p)\n{\n PFNSIGN fnSign;\n BOOL willContinue = FALSE;\n PPASSED_PARAMETER_CONTEXT ppc=NULL;\n BASIC_INSTRUCTION_INFO instr;\n duint addr;\n char msgBuf[512];\n\tLPSTR mapResult;\n\n BpCallbackContext *bpcb = (BpCallbackContext *)p;\n \n sprintf(msgBuf, \"One of the parameters of the %s is marked as out. \"\n \"That Means, you need to execute the api, to get all parameter result correctly.\\n\\n\"\n \"Want to execute the API now?\",bpcb->afi->name);\n\n willContinue = MessageBoxA(NULL, msgBuf, \"Quest\", MB_ICONQUESTION | MB_YESNO) == IDYES;\n\n if (willContinue)\n {\n ppc = (PPASSED_PARAMETER_CONTEXT)bpcb->user;\n\n //Is it alreadly backtraced for caller?\n if (!(bpcb->ownerBreakpoint->options & BPO_BACKTRACK))\n {\n //if not, we must do that.\n addr = UtlGetCallerAddress(&bpcb->regContext);\n }\n else\n addr = bpcb->regContext.regcontext.cip;\n\n DbgDisasmFastAt(addr, &instr);\n\n addr += instr.size;\n\n if (!AbSetInstructionBreakpoint(addr, AbpGhostBreakpointHandler, bpcb, true))\n {\n DBGPRINT(\"Bpx set failed\");\n return EXIT_FAILURE;\n }\n\n AbDebuggerRun();\n AbDebuggerWaitUntilPaused();\n AbpWaitUntilHandlerDone(bpcb->ownerBreakpoint);\n\n SmmGetFunctionSignature2(bpcb->afi, &fnSign);\n\n SmmMapFunctionCall(ppc, fnSign, bpcb->afi, &mapResult);\n\n ApiCallMapForm *acmf = new ApiCallMapForm(mapResult);\n acmf->ShowDialog();\n\n }\n\n\n\n return EXIT_SUCCESS;\n}\n\nDBG_LIBEXPORT void CBBREAKPOINT(CBTYPE cbType, PLUG_CB_BREAKPOINT* info)\n{\n BpCallbackContext *bpcb = NULL;\n PBREAKPOINT_INFO pbi;\n BOOL isBacktrackBp;\n PPASSED_PARAMETER_CONTEXT ppc;\n PFNSIGN fnSign = NULL;\n\n pbi = AbpLookupBreakpoint(info->breakpoint->addr);\n\n \n if (pbi != NULL)\n {\n DBGPRINT(\"Special breakpoint detected.\");\n pbi->status |= BPS_EXECUTING_HANDLER;\n\n bpcb = pbi->cbctx;\n\n pbi->hitCount++;\n\n if (bpcb != NULL)\n {\n DBGPRINT(\"Breakpoint has registered callback. Raising the breakpoint callback\");\n\n\n //get current register context for current state\n _DbgGetRegDumpEx(&bpcb->regContext,sizeof(REGDUMP));\n\n bpcb->bp = info->breakpoint;\n\n if (bpcb->callback != NULL)\n {\n pbi->status |= BPS_EXECUTING_CALLBACK;\n bpcb->callback(bpcb);\n pbi->status &= ~BPS_EXECUTING_CALLBACK;\n }\n }\n\n if (AbGetSettings()->mapCallContext)\n {\n if (SmmGetFunctionSignature2(bpcb->afi, &fnSign))\n {\n DBGPRINT(\"Function mapping signature found. Mapping...\");\n\n isBacktrackBp = (pbi->options & BPO_BACKTRACK) == BPO_BACKTRACK;\n\n ppc = AbpExtractPassedParameterContext(&bpcb->regContext, fnSign,!isBacktrackBp);\n\n if (SmmSigHasOutArgument(fnSign))\n {\n DBGPRINT(\"%s has an out marked function. \", bpcb->afi->name);\n bpcb->user = ppc;\n QueueUserWorkItem((LPTHREAD_START_ROUTINE)AbpShowOutputArgumentQuestion, bpcb, WT_EXECUTELONGFUNCTION);\n }\n else\n SmmMapFunctionCall(ppc, fnSign, bpcb->afi,NULL); //TODO: URGENT: FIX PARAMETER\n }\n }\n\n if (pbi->options & BPO_SINGLESHOT)\n AbDeleteBreakpoint(pbi->addr);\n\n\n pbi->status &= ~BPS_EXECUTING_HANDLER;\n\n }\n else\n {\n if (AbpHasPendingInit)\n {\n AbpHasPendingInit = FALSE;\n QueueUserWorkItem((LPTHREAD_START_ROUTINE)Loader, NULL, WT_EXECUTEDEFAULT);\n }\n }\n}\n\nDBG_LIBEXPORT void CBCREATEPROCESS(CBTYPE cbType, PLUG_CB_CREATEPROCESS *newProc)\n{\n if (AbpDbgState == DWS_ATTACHEDPROCESS)\n {\n //get module info. cuz we cant get the modinfo from in the attach callback \n goto resumeExec;\n }\n\n AbpDbgState = DWS_CREATEPROCESS;\n\nresumeExec:\n\n AbGetDebuggedModuleInfo(&AbpCurrentMainModule);\n AbfNeedsReload = TRUE;\n\n AbpRaiseDbgStateChangeEvent();\n}\n\nDBG_LIBEXPORT void CBEXITPROCESS(CBTYPE cbType, PLUG_CB_EXITPROCESS *exitProc)\n{\n AbpDbgState = DWS_EXITEDPROCESS;\n\n AbpRaiseDbgStateChangeEvent();\n}\n\nDBG_LIBEXPORT void CBATTACH(CBTYPE cbType, PLUG_CB_ATTACH *attachedProc)\n{\n AbpDbgState = DWS_ATTACHEDPROCESS;\n}\n\nDBG_LIBEXPORT void CBDETACH(CBTYPE cbType, PLUG_CB_DETACH *detachedProc)\n{\n AbpDbgState = DWS_DETACHEDPROCESS;\n \n AbpRaiseDbgStateChangeEvent();\n}\n\nBOOL WINAPI DllMain(\n _In_ HINSTANCE hinstDLL,\n _In_ DWORD fdwReason,\n _In_ LPVOID lpvReserved\n)\n{\n AbPluginModule = (HMODULE)hinstDLL;\n return TRUE;\n}" }, { "path": "x64dbgApiBreak/src/rtf.cpp", "content": "#include \n\n#define RDS_NEEDS_SPACE 0x00000001\n\n\n#define RTF_SETSTATE(rtf,x) if (!(rtf->state & x)) \\\n rtf->state |= x\n\nBOOL RtfCreateRtfData(PRTF_DATA *rtfData)\n{\n PRTF_DATA rtf;\n rtf = ALLOCOBJECT(RTF_DATA);\n\n if (!rtf)\n return FALSE;\n\n if (!DmaCreateAdapter(sizeof(char), 0x100, &rtf->rtfDma))\n {\n FREEOBJECT(rtf);\n return FALSE;\n }\n\n *rtfData = rtf;\n\n return TRUE;\n}\n\n\nBOOL RtfBuildRtfTextA(PRTF_DATA rtf, LPSTR *rtfText, DWORD *textLen)\n{\n PDMA dma;\n LPSTR rtfBody;\n DWORD color;\n\n ARCHWIDE len;\n\n if (!rtf)\n return FALSE;\n\n if (!rtfText)\n return FALSE;\n\n \n DmaGetAdapterInfo(rtf->rtfDma, &len, NULL);\n\n DmaCreateAdapter(sizeof(char), len, &dma);\n\n DmaStringWriteA(dma, \"{\\\\rtf1\\\\ansi\\\\ansicpg1252\\\\deff0\\\\nouicompat\\\\deflang1033 \");\n\n //Font table\n DmaStringWriteA(dma, \"{\\\\fonttbl \");\n\n for (DWORD i = 0;i < rtf->fontCount;i++)\n {\n DmaStringWriteA(dma, \"{\\\\f%d\\\\fnil\\\\fcharset%d %s;}\", i, 0, rtf->fontTable[i]);\n\n }\n\n DmaStringWriteA(dma, \"}\");\n \n //Color table\n DmaStringWriteA(dma, \"{\\\\colortbl ;\");\n\n for (DWORD i = 0;i < rtf->colorCount;i++)\n {\n color = rtf->colorTable[i];\n DmaStringWriteA(dma, \"\\\\red%d\\\\green%d\\\\blue%d;\", GetRValue(color), GetGValue(color), GetBValue(color));\n }\n\n DmaStringWriteA(dma, \"}\");\n\n\n DmaStringWriteA(dma, \"\\\\viewkind4\\\\pard\\\\sa200\\\\sl276\\\\slmult1\\\\lang9 \");\n\n DmaPrepareForRead(rtf->rtfDma, (void **)&rtfBody);\n\n DmaStringWriteA(dma, rtfBody);\n\n DmaStringWriteA(dma, \"}\");\n\n DmaTakeMemoryOwnership(dma, (void **)rtfText);\n\n DmaDestroyAdapter(dma);\n\n return TRUE;\n}\n\n\nvoid RtfFreeRtfText(LPSTR rtfText)\n{\n FREESTRING(rtfText);\n}\n\nBOOL RtfDestroyRtfData(PRTF_DATA *rtf)\n{\n PRTF_DATA prtf;\n\n if (!rtf)\n return FALSE;\n\n prtf = *rtf;\n\n if (prtf->colorTable)\n FREEOBJECT(prtf->colorTable);\n\n if (prtf->fontTable)\n FREEOBJECT(prtf->fontTable);\n\n DmaDestroyAdapter(prtf->rtfDma);\n\n FREEOBJECT(prtf);\n\n *rtf = NULL;\n\n return NULL;\n}\n\nBOOL RtfRegisterColor(PRTF_DATA rtf, DWORD color, RTFRESID *resId)\n{\n DWORD *newPtr;\n RTFRESID index;\n\n if (!rtf)\n return FALSE;\n\n newPtr = (DWORD *)AbMemoryRealloc(rtf->colorTable, sizeof(DWORD) * (rtf->colorCount + 1));\n\n if (!newPtr)\n {\n return FALSE;\n }\n\n rtf->colorTable = newPtr;\n\n index = rtf->colorCount;\n\n rtf->colorCount++;\n rtf->colorTable[index] = color;\n\n if (resId)\n *resId = index;\n\n return TRUE;\n}\n\nBOOL RtfRegisterFont(PRTF_DATA rtf, const LPCSTR fontName, int charset, RTFRESID *resId)\n{\n LPSTR fontNameBuffer;\n LPSTR *newPtr;\n RTFRESID index;\n\n if (!rtf)\n return FALSE;\n\n newPtr = (LPSTR *)AbMemoryRealloc(rtf->fontTable, sizeof(LPSTR) * (rtf->fontCount + 1));\n\n \n if (!newPtr)\n {\n return FALSE;\n }\n\n rtf->fontTable = newPtr;\n\n index = rtf->fontCount;\n\n rtf->fontCount++;\n\n fontNameBuffer = HlpCloneStringA(fontName);\n\n rtf->fontTable[index] = fontNameBuffer;\n\n if (resId)\n *resId = index;\n\n return TRUE;\n}\n\nBOOL RtfBeginStyleFor(PRTF_DATA rtf, RTF_STYLE rtfStyle, DWORD repeat)\n{\n if (!repeat)\n repeat = 1;\n\n if (rtfStyle & RTFS_BOLD)\n DmaStringWriteA(rtf->rtfDma, \"\\\\b\");\n\n if (rtfStyle & RTFS_ITALIC)\n DmaStringWriteA(rtf->rtfDma, \"\\\\i\");\n\n if (rtfStyle & RTFS_UNDERLINE)\n DmaStringWriteA(rtf->rtfDma, \"\\\\u\");\n\n if (rtfStyle & RTFS_NEWLINE)\n {\n for (DWORD i=0;irtfDma, \"\\\\line\");\n }\n\n if (rtfStyle & RTFS_TAB)\n {\n for (DWORD i=0;irtfDma, \"\\\\tab\");\n }\n\n \n RTF_SETSTATE(rtf, RDS_NEEDS_SPACE);\n\n return TRUE;\n}\n\nBOOL RtfBeginColor(PRTF_DATA rtf, RTFRESID resId)\n{\n RTF_SETSTATE(rtf, RDS_NEEDS_SPACE);\n \n return DmaStringWriteA(rtf->rtfDma, \"\\\\cf%d\", resId);\n}\n\nBOOL RtfBeginFont(PRTF_DATA rtf, RTFRESID resId)\n{\n RTF_SETSTATE(rtf, RDS_NEEDS_SPACE);\n return DmaStringWriteA(rtf->rtfDma, \"\\\\f%d\", resId);\n}\n\nBOOL RtfBeginFontSize(PRTF_DATA rtf, WORD fontSize)\n{\n RTF_SETSTATE(rtf, RDS_NEEDS_SPACE);\n return DmaStringWriteA(rtf->rtfDma, \"\\\\fs%d\", fontSize);\n}\n\nBOOL RtfAppendTextFormatA(PRTF_DATA rtf, LPCSTR format, ...)\n{\n va_list va;\n \n va_start(va, format);\n\n RtfAppendTextFormatExA(rtf, format, va);\n\n va_end(va);\n\n \n return TRUE;\n}\n\nBOOL RtfAppendTextFormatExA(PRTF_DATA rtf, LPCSTR format, va_list vl)\n{\n BOOL result;\n LPSTR buffer;\n\n if (!HlpPrintFormatBufferExA(&buffer, format, vl))\n return FALSE;\n\n if (rtf->state & RDS_NEEDS_SPACE)\n {\n DmaStringWriteA(rtf->rtfDma, \" \");\n rtf->state &= ~RDS_NEEDS_SPACE;\n }\n\n result = DmaStringWriteA(rtf->rtfDma, buffer);\n\n FREESTRING(buffer);\n\n return result;\n}" }, { "path": "x64dbgApiBreak/src/settings.cpp", "content": "#include \n\n#define ABP_INT_VALUE 0\n#define ABP_BOOL_VALUE 1\n#define ABP_DOUBLE_VALUE 2\n#define ABP_STRING_VALUE 3\n\n#define ABP_SETTING_COUNT 6\n\n#define ABS_EXPOSEDYNLDR 0\n#define ABS_GETMODHANDLE 1\n#define ABS_AUTOLOAD 2\n#define ABS_SCANAGGRESSIVE 3\n#define ABS_MAPCALLCONTEXT 4\n#define ABS_SCRIPTS 5\n\n\nstruct {\n const char *key;\n int type;\n}AbpSettingList[ABP_SETTING_COUNT] =\n{\n {\"ExposeDynLoads\",ABP_BOOL_VALUE},\n {\"InclGetModHandle\",ABP_BOOL_VALUE},\n {\"Autoload\", ABP_BOOL_VALUE},\n {\"Scanaggrs\", ABP_BOOL_VALUE},\n {\"Mapcallctx\",ABP_BOOL_VALUE},\n {\"Scripts\",ABP_STRING_VALUE}\n};\n\n#define STNG_LOAD(id,val) AbpGetSetting(AbpSettingList[id].key,(char *)val,AbpSettingList[id].type)\n#define STNG_SAVE(id,val) AbpSetSetting(AbpSettingList[id].key,(char *)val,AbpSettingList[id].type)\n\nSettings AbpSettings = { 0 };\n\n#define MAX_SETTING_STRING_SIZE 65536\n\nbool AbpGetSetting(const char *key, char *valueBuf,int valueType)\n{\n union {\n int vint;\n double vdouble;\n }val;\n\n char valStack[32] = { 0 };\n\n char *value;\n\n if (valueType == ABP_STRING_VALUE)\n value = valueBuf;\n else\n value = valStack;\n \n if (BridgeSettingGet(\"apibreak\", key, value))\n {\n switch (valueType)\n {\n case ABP_INT_VALUE:\n val.vint = atoi(value);\n memcpy(valueBuf, &val.vint, sizeof(int));\n break;\n case ABP_BOOL_VALUE:\n *valueBuf = !(*value == '0');\n break;\n case ABP_DOUBLE_VALUE:\n val.vdouble = atof(value);\n memcpy(valueBuf, &val.vdouble, sizeof(double));\n break;\n case ABP_STRING_VALUE:\n //strcpy(valueBuf, value);\n break;\n }\n\n return true;\n }\n\n return false;\n}\n\nbool AbpSetSetting(const char *key, char *value, int valueType)\n{\n bool ok;\n union {\n char *intptr;\n int vint;\n bool vbool;\n double vdouble;\n }val;\n\n char vbStack[32] = { 0 };\n\n char *valueBuf = NULL;\n\n if (valueType == ABP_STRING_VALUE)\n valueBuf = value;\n else\n valueBuf = vbStack;\n\n val.intptr = value;\n\n switch (valueType)\n {\n case ABP_INT_VALUE:\n _itoa(val.vdouble, valueBuf, 10);\n break;\n case ABP_BOOL_VALUE:\n *valueBuf = val.vbool ? '1' : '0';\n *(valueBuf + 1) = 0;\n break;\n case ABP_DOUBLE_VALUE:\n sprintf(valueBuf, \"%3.2f\", val.vdouble);\n break;\n case ABP_STRING_VALUE:\n strcpy(valueBuf, value);\n break;\n }\n\n ok = BridgeSettingSet(\"apibreak\", key, valueBuf);\n\n return ok;\n}\n\nbool AbSettingsLoad()\n{\n if (!AbpSettings.mainScripts)\n AbpSettings.mainScripts = ALLOCSTRINGA(MAX_SETTING_STRING_SIZE);\n\n if (!STNG_LOAD(ABS_EXPOSEDYNLDR, &AbpSettings.exposeDynamicApiLoads))\n AbpSettings.exposeDynamicApiLoads = false;\n\n if (!STNG_LOAD(ABS_GETMODHANDLE, &AbpSettings.includeGetModuleHandle))\n AbpSettings.includeGetModuleHandle = false;\n\n if (!STNG_LOAD(ABS_AUTOLOAD, &AbpSettings.autoLoadData))\n AbpSettings.autoLoadData = false;\n\n if (!STNG_LOAD(ABS_SCANAGGRESSIVE, &AbpSettings.scanAggressive))\n AbpSettings.scanAggressive = false;\n\n if (!STNG_LOAD(ABS_MAPCALLCONTEXT, &AbpSettings.mapCallContext))\n AbpSettings.mapCallContext = false;\n\n STNG_LOAD(ABS_SCRIPTS, AbpSettings.mainScripts);\n\n\n\n return true;\n}\n\nbool AbSettingsSave()\n{\n if (!STNG_SAVE(ABS_EXPOSEDYNLDR, AbpSettings.exposeDynamicApiLoads))\n return false;\n\n if (!STNG_SAVE(ABS_GETMODHANDLE, AbpSettings.includeGetModuleHandle))\n return false;\n\n if (!STNG_SAVE(ABS_AUTOLOAD, AbpSettings.autoLoadData))\n return false;\n\n if (!STNG_SAVE(ABS_SCANAGGRESSIVE, AbpSettings.scanAggressive))\n return false;\n\n if (!STNG_SAVE(ABS_MAPCALLCONTEXT, AbpSettings.mapCallContext))\n return false;\n\n if (!STNG_SAVE(ABS_SCRIPTS, AbpSettings.mainScripts))\n return false;\n\n return true;\n}\n\nbool AbSettingsReset()\n{\n NOTIMPLEMENTED();\n return false;\n}\n\nSettings *AbGetSettings()\n{\n return &AbpSettings;\n}\n\nvoid AbSettingsDestroyResources()\n{\n\tif (AbpSettings.mainScripts)\n\t{\n\t\tFREESTRING(AbpSettings.mainScripts);\n\t\tAbpSettings.mainScripts = NULL;\n\t}\n}" }, { "path": "x64dbgApiBreak/src/structmemmap.cpp", "content": "#include \n\n#define MAX_TYPENAME_SIZE 128\n\n#define ALLOCOBJECTLIST(type,count) RESIZEOBJECTLIST(type,NULL,count)\n\n#define SIZEOF_INT sizeof(int)\n#define SIZEOF_POINTER sizeof(void *)\n#define SIZEOF_CHAR 1\n#define SIZEOF_WCHAR 2\n#define SIZEOF_BYTE 1\n#define SIZEOF_SHORT 2\n#define SIZEOF_LONG 4\n#define SIZEOF_LONGLONG 8\n\n#define SIZEOF_WORD SIZEOF_SHORT\n#define SIZEOF_DWORD SIZEOF_LONG\n#define SIZEOF_QWORD SIZEOF_LONGLONG\n\n\n#define FAILBASE_SYSTEM 0\n#define FAILBASE_PARSER FAILBASE_SYSTEM + 4\n\n\n#define FS_MEMERR FAILBASE_SYSTEM + 1\n#define FS_RESERVED1 FAILBASE_SYSTEM + 2\n#define FS_RESERVED2 FAILBASE_SYSTEM + 3\n#define FS_RESERVED3 FAILBASE_SYSTEM + 4\n\n#define FS_MAPTYPE FAILBASE_PARSER + 1\n#define FS_TYPENAME FAILBASE_PARSER + 2\n#define FS_BRACKOPEN FAILBASE_PARSER + 3\n#define FS_EXPECTFIELD FAILBASE_PARSER + 4\n#define FS_BRACKCLOSE FAILBASE_PARSER + 5\n\n#define FS_NOFIELDTYPE FAILBASE_PARSER + 6\n#define FS_EXPECTFIELDNAME FAILBASE_PARSER + 7\n#define FS_EXPECTSQUBRCKOPEN FAILBASE_PARSER + 8\n#define FS_EXPECTSQUBRCKCLOSE FAILBASE_PARSER + 9\n#define FS_EXPECTARRSIZE FAILBASE_PARSER + 10\n#define FS_EXPECTSEMICOLON FAILBASE_PARSER + 11\n\n#define FS_EXPECTNOTOP FAILBASE_PARSER + 12\n#define FS_EXPECTPARANOPEN FAILBASE_PARSER + 13\n#define FS_EXPECTPARANCLOSE FAILBASE_PARSER + 14\n#define FS_EXPECTTYPE FAILBASE_PARSER + 15\n#define FS_EXPECTARGNAME FAILBASE_PARSER + 16\n#define FS_EXPECTMODNAME FAILBASE_PARSER + 17\n#define FS_UNEXPECTED_TOKEN FAILBASE_PARSER + 18\n#define FS_UNEXPECTED_SYTX_END FAILBASE_PARSER + 19\n\n#define FS_TYPENOTFOUND FAILBASE_PARSER + 20\n#define FS_EXPECTINCLFILEPATH FAILBASE_PARSER + 21\n#define FS_EXPECTIDENT\t\t\t\t\tFAILBASE_PARSER + 22\n\n\ntypedef struct __Token\n{\n\tchar token[256];\n\tint col;\n\tint line;\n}*PToken, Token;\n//LINKED LIST\n\n#define RECORD_OF(node, type) ( (type)((node)->value) )\n\ntypedef struct __SLISTNODE\n{\n struct __SLISTNODE * next;\n void * value;\n}*PSLISTNODE, SLISTNODE;\n\ntypedef struct\n{\n PSLISTNODE head;\n PSLISTNODE tail;\n LONG count;\n}*PSLIST, SLIST;\n\n//TYPED MEMORY MAP\n\ntypedef void(*CONVERTER_METHOD)(char *, void *, bool);\n\ntypedef struct\n{\n WORD cbSize;\n char typeName[MAX_TYPENAME_SIZE];\n}*PGENERIC_DATATYPE_INFO;\n\ntypedef struct\n{\n WORD cbSize;\n char typeName[MAX_TYPENAME_SIZE];\n WORD size;\n BOOL isSigned;\n WORD linkIndex;\n CONVERTER_METHOD method;\n}*PPRIMITIVETYPEINFO, PRIMITIVETYPEINFO;\n\n\n#define SmmListOf(x) PSLIST\n\ntypedef struct\n{\n WORD cbSize;\n char name[MAX_TYPENAME_SIZE];\n DWORD structSize;\n SmmListOf(PSTRUCTMEMBERFIELD) fields;\n}*PSTRUCTINFO, STRUCTINFO;\n\n\n////////////////////////\n\ntypedef struct\n{\n\n char fieldName[128];\n WORD arrSize;\n BOOL isArray;\n BOOL isPointer;\n BOOL isStruct;\n\n union\n {\n PPRIMITIVETYPEINFO primitiveType;\n PSTRUCTINFO structType;\n }type;\n\n}*PSTRUCTMEMBERFIELD, STRUCTMEMBERFIELD;\n\ntypedef struct\n{\n char name[64];\n BOOL isStructure;\n BOOL isPointer;\n BOOL isOutArg;\n union\n {\n PVOID holder;\n PSTRUCTINFO structInfo;\n PPRIMITIVETYPEINFO primitiveInfo;\n }typeInfo;\n}*PARGINFO, ARGINFO;\n\ntypedef struct\n{\n\tunion\n\t{\n\t\tPVOID\t\t\t\t\tu;\n\t\tPSTRUCTINFO\t\t\t\ttypeStruct;\n\t\tPPRIMITIVETYPEINFO\t\ttypePrimitive;\n\t}typeInfo;\n}*PRETINFO, RETINFO;\n\n#define CDI_FUNCTION_ARGUMENT\t1\n#define CDI_FUNCTION_RETURN\t\t2\n#define CDI_STRUCTURE_FIELD\t\t3\n\ntypedef struct\n{\n\tUSHORT type;\n\n\tunion\n\t{\n\t\tPARGINFO\t\t\targInfo;\n\t\tPRETINFO\t\t\tretInfo;\n\t\tPSTRUCTMEMBERFIELD\tfieldInfo;\n\n\t}u;\n}*PCOMMON_DATAFIELD_INFO,COMMON_DATAFIELD_INFO;\n\ntypedef struct __FNSIGN\n{\n char name[256];\n char module[256];\n PARGINFO args;\n\tPRETINFO\t\t\t\t\tret;\n SHORT argCount;\n BOOL hasOutArg;\n}*PFNSIGN, FNSIGN;\n\ntypedef struct\n{\n const char * identName;\n PPRIMITIVETYPEINFO pti;\n}typeidents;\n\ntypedef struct\n{\n\tchar alias[64];\n\tPVOID mappedType;\n}*PTYPEALIAS,TYPEALIAS;\n\n#define SMMP_PATH_STACKSIZE 10\ntypedef struct\n{\n struct {\n BOOL isLocal;\n WCHAR workDir[MAX_PATH];\n }Stack[SMMP_PATH_STACKSIZE];\n WORD spi;\n}PATH_STACK;\n\nstatic typeidents TYPE_IDENTS[] =\n{\n { \"int\",NULL },\n { \"uint\",NULL },\n { \"char\",NULL },\n { \"wchar\",NULL },\n { \"byte\",NULL },\n { \"ubyte\",NULL },\n { \"short\",NULL },\n { \"ushort\",NULL },\n { \"long\", NULL },\n { \"ulong\",NULL },\n { \"long64\",NULL },\n { \"ulong64\",NULL },\n //SPECIALS\n { \"string\",NULL },\n { \"wstring\",NULL },\n { \"pointer\",NULL },\n { \"archex\", NULL }\n};\n\n#define SMM_SPECIAL_PRIMITIVE_COUNT 4\n\n#define MAX_TYPE_IDENTS sizeof(TYPE_IDENTS) / sizeof(typeidents)\n#define MAX_USABLE_TYPE_IDENTS (MAX_TYPE_IDENTS - SMM_SPECIAL_PRIMITIVE_COUNT)\n\nWCHAR SmmpScriptWorkDir[MAX_PATH] = { 0 };\nWCHAR SmmpCurrentParsingFile[MAX_PATH] = { 0 };\nBOOL SmmpWorkDirIsLocal = TRUE;\n\nPSLIST SmmpUserTypeList = NULL, SmmpFnSignList = NULL;\nPSLIST SmmpAliasList = NULL;\nPSLIST SmmpTypeList = NULL;\nPDMA SmmpParseErrorContent = NULL;\n\nPATH_STACK SmmpWorkDirStack;\nPATH_STACK SmmpParsingFileStack;\n\n#include \n\n#define RTFC_DEFAULT 0\n#define RTFC_DARKRED 1\n#define RTFC_DARKBLUE 2\n#define RTFC_LIGHTBLUE 3\n#define RTFC_LIGHTGREEN 4\n\n#define RTFF_DEFAULT 0\n\n\nvoid SmmpRegisterRtfColorAndFonts(Rtf * data)\n{\n //Build rtf color table\n data->RegisterColor(RGB(185, 0, 0)); //DARKRED\n data->RegisterColor(RGB(0, 0, 139)); //DARKBLUE\n data->RegisterColor(RGB(0, 77, 187)); //LIGHTBLUE\n data->RegisterColor(RGB(0, 176, 80)); //LIGHTGREEN\n\n data->RegisterFont(\"Segoe UI\", 0);\n}\n\nconst char *FAIL_MESSAGES[] =\n{\n \"Memory alloc error\",\n \"\",\n \"\",\n \"\",\n /////////////\n \"maptype keyword expected\",\n \"expected 'typename'\",\n \"expected '{'\",\n \"maptype body definition expected\",\n \"expected '}'\",\n /////////////////////\n \"field type is not valid\",\n \"expected 'field name'\",\n \"expected '['\",\n \"expected ']\",\n \"expected array size\",\n \"expected ';' to complete field definition\",\n ///////////////\n \"expected '!'\",\n \"expected '('\",\n \"expected ')'\",\n \"type expected\",\n \"argument name expected\",\n \"module name expected\",\n \"unexpected token\",\n \"unexpected syntax ending\",\n \"Type not found\",\n \"filepath expected for @incl.\",\n\t\"identifier expected.\"\n};\n\n\nvoid SmmpInitPathStack(PATH_STACK *pwds)\n{\n memset(pwds->Stack, 0, sizeof(pwds->Stack));\n pwds->spi = SMMP_PATH_STACKSIZE;\n}\n\nvoid SmmpPushPath(PATH_STACK *pwds,WCHAR *path)\n{\n WORD spi = pwds->spi - 1;\n\n //Ps. Dont be confused. WORD is an unsinged type and\n //when it gets a less than zero value for exam (-1)\n //It's sign bit will be overflowed, and its evaluated as WORD's max value\n //That means the spi value will be greater than WORKDIR_STACKSIZE,\n //And We will know that the stack is full\n if (spi > SMMP_PATH_STACKSIZE)\n return;\n\n\tpwds->Stack[spi].isLocal = !HlpBeginsWithW(path, L\"http\", FALSE, 4);\n wcscpy(pwds->Stack[spi].workDir, path);\n\tpwds->spi--;\n}\n\nBOOL SmmpIsPreviousWorkdirLocal(PATH_STACK *pwds)\n{\n if (pwds->spi == SMMP_PATH_STACKSIZE)\n return FALSE;\n\n return pwds->Stack[pwds->spi + 1].isLocal;\n}\n\nBOOL SmmpPopPath(PATH_STACK *pwds, WCHAR *popPath, BOOL *isLocal)\n{\n WORD spi = pwds->spi;\n\n if (spi == SMMP_PATH_STACKSIZE)\n return FALSE;\n\n wcscpy(popPath, pwds->Stack[spi].workDir);\n\n\tif (isLocal)\n\t{\n\t\t*isLocal = pwds->Stack[spi].isLocal;\n\t\tSmmpWorkDirIsLocal = *isLocal;\n\t}\n\n\tpwds->spi++;\n\n return TRUE;\n}\n\nvoid SmmpRaiseParseError(LONG err, PToken tok)\n{\n const LONG totalErrString = sizeof(FAIL_MESSAGES) / sizeof(char *);\n\tLPSTR errorMessage = NULL, fileName = NULL;\n\n if (err >= 0 && err <= totalErrString)\n {\n\t\tif (!tok)\n\t\t{\n\t\t\tif (SmmpParseErrorContent)\n\t\t\t\tDmaStringWriteA(SmmpParseErrorContent, \"%s\\r\\n\", FAIL_MESSAGES[err - 1]);\n\t\t\telse\n\t\t\t\tDBGPRINT(\"%s\", FAIL_MESSAGES[err - 1]);\n\t\t}\n\t\telse\n\t\t{\n\t\t\tfileName = HlpWideToAnsiString(SmmpCurrentParsingFile);\n\t\t\tHlpPrintFormatBufferA(&errorMessage, \"Parsing error at \\r\\n%s\\r\\ncolumn: %d, line: %d\\r\\nerror: %s\",\n\t\t\t\tfileName, tok->col, tok->line, FAIL_MESSAGES[err - 1]);\n\t\t\tMessageBoxA(NULL, errorMessage, \"parse error\", MB_ICONWARNING);\n\t\t\tFREESTRING(fileName);\n\t\t}\n }\n}\n\nBOOL SmmpCreateSLIST(PSLIST *list)\n{\n *list = ALLOCOBJECT(SLIST);\n\n if (*list != NULL)\n {\n RtlZeroMemory(*list, sizeof(SLIST));\n return TRUE;\n }\n\n return FALSE;\n}\n\nBOOL SmmpAddSList(PSLIST list, void *value)\n{\n PSLISTNODE node;\n\n node = ALLOCOBJECT(SLISTNODE);\n\n if (!node)\n return FALSE;\n\n node->value = value;\n node->next = NULL;\n\n if (list->count == 0)\n {\n list->head = list->tail = node;\n list->count = 1;\n return TRUE;\n }\n\n list->tail->next = node;\n list->tail = node;\n list->count++;\n\n return TRUE;\n}\n\nvoid SmmpClearList(PSLIST list, BOOL memFreeValue)\n{\n\tPSLISTNODE tmp;\n\n\twhile (list->head != NULL)\n\t{\n\t\ttmp = list->head->next;\n\n\t\tif (memFreeValue)\n\t\t\tFREEOBJECT(list->head->value);\n\n\t\tFREEOBJECT(list->head);\n\t\tlist->head = tmp;\n\t}\n\n\tlist->count = 0;\n}\n\nvoid SmmpDestroySList(PSLIST list)\n{\n\tif (list->head)\n\t\tSmmpClearList(list,FALSE);\n \n\tFREEOBJECT(list);\n}\n\n\n\nBOOL SmmCreateMapTypeInfo(const char *name, WORD size, BOOL isSigned, CONVERTER_METHOD method, WORD *index)\n{\n PPRIMITIVETYPEINFO pmti = NULL;\n\n if (strcmp(TYPE_IDENTS[*index].identName, name))\n return FALSE;\n\n pmti = ALLOCOBJECT(PRIMITIVETYPEINFO);\n\n if (!pmti)\n return FALSE;\n\n pmti->cbSize = sizeof(PRIMITIVETYPEINFO);\n strcpy(pmti->typeName, name);\n pmti->size = size;\n pmti->isSigned = isSigned;\n\n TYPE_IDENTS[*index].pti = pmti;\n\n pmti->linkIndex = *index;\n pmti->method = method;\n\n (*index)++;\n\n SmmpAddSList(SmmpTypeList, pmti);\n\n return TRUE;\n}\n\n#include \n\n#define VALOFPTR(type, ptr) (*((type *)ptr))\n\n#ifdef MAP_LOCAL\n#define IMPLEMENT_CONVERTER(name, type, format) \n#else\n#define IMPLEMENT_CONVERTER(name, type,format) void Convert ## name (char *buf, void *mem, bool isValue) { \\\n type tval; \\\n if (!isValue) \\\n AbMemReadGuaranteed((duint)mem,&tval,sizeof(tval)); \\\n else \\\n tval = (type)mem; \\\n sprintf(buf,format,tval); \\\n } \n\n#endif\n\n#pragma warning(disable:4477)\n\nIMPLEMENT_CONVERTER(Int, int, \"%d\")\nIMPLEMENT_CONVERTER(Uint, unsigned int, \"%du\")\nIMPLEMENT_CONVERTER(Char, CHAR, \"%c\")\nIMPLEMENT_CONVERTER(Wchar, WCHAR, \"%c\")\nIMPLEMENT_CONVERTER(Byte, CHAR, \"%d\")\nIMPLEMENT_CONVERTER(UByte, UCHAR, \"%du\")\nIMPLEMENT_CONVERTER(Short, SHORT, \"%d\")\nIMPLEMENT_CONVERTER(UShort, USHORT, \"%du\")\nIMPLEMENT_CONVERTER(Long, LONG, \"%ld\")\nIMPLEMENT_CONVERTER(ULong, ULONG, \"%lu\")\nIMPLEMENT_CONVERTER(Long64, LONGLONG, \"%lld\")\nIMPLEMENT_CONVERTER(ULong64, ULONGLONG, \"%llu\")\nIMPLEMENT_CONVERTER(Pointer, ARCHWIDE, \"%p\")\n\n\n#ifdef _WIN64\nIMPLEMENT_CONVERTER(ArchHex, ULONGLONG,\"%016x\")\n#else\nIMPLEMENT_CONVERTER(ArchHex, ULONG, \"%08x\")\n#endif\n\nvoid ConvertString(char *buf, void *mem, bool dummy)\n{\n#ifdef MAP_LOCAL\n sprintf(buf, \"\\\"%s\\\"\", ((LPSTR)mem));\n#else\n char lbuf[512];\n \n if (!DbgGetStringAt((duint)mem, lbuf))\n return;\n\n sprintf(buf, \"\\\"%s\\\"\", lbuf);\n#endif\n}\n\nvoid ConvertStringW(char *buf, void *mem, bool dummy)\n{\n#ifdef MAP_LOCAL\n ULONG slen;\n wchar_t exBuf[512];\n\n slen = wsprintf(exBuf, L\"L\\\"%s\\\"\", (LPWSTR)mem);\n\n if (!slen)\n {\n *buf = '\\0';\n return;\n }\n\n if (!buf)\n return;\n\n WideCharToMultiByte(CP_ACP, WC_COMPOSITECHECK, exBuf, slen, buf, slen, NULL, NULL);\n#else\n char lbuf[512];\n\n if (!DbgGetStringAt((duint)mem, lbuf))\n return;\n\n sprintf(buf, \"%s\", lbuf);\n#endif\n}\n\n\n\nBOOL SmmpTypeIsPrimitive(LPVOID typeData, BOOL *isPrimitive)\n{\n\tPGENERIC_DATATYPE_INFO gdti = (PGENERIC_DATATYPE_INFO)typeData;\n\n\tif (gdti->cbSize == sizeof(PRIMITIVETYPEINFO))\n\t{\n\t\t*isPrimitive = TRUE;\n\t\treturn TRUE;\n\t}\n\telse if (gdti->cbSize == sizeof(STRUCTINFO))\n\t{\n\t\t*isPrimitive = FALSE;\n\t\treturn TRUE;\n\t}\n\n\treturn FALSE;\n}\n\nBOOL SmmpGetTypeInfoByName(const char *name, PVOID *info, BOOL *isPrimitive, BOOL dontCheckForUserTypes)\n{\n\tBOOL infoPtrPresent = info != NULL;\n\tBOOL isPrimitivePtrPresent = isPrimitive != NULL;\n\t\n\t//Search for primitives.\n for (DWORD nx=0; nx < MAX_TYPE_IDENTS; nx++)\n {\n if (!strcmp(TYPE_IDENTS[nx].identName, name))\n {\n if (infoPtrPresent)\n *info = TYPE_IDENTS[nx].pti;\n \n\t\t\tif (isPrimitivePtrPresent)\n\t\t\t\t*isPrimitive = TRUE;\n\n return TRUE;\n }\n }\n\n\t//scan the alias list.\n\tfor (PSLISTNODE node = SmmpAliasList->head; node != NULL; node = node->next)\n\t{\n\t\tif (!strcmp(RECORD_OF(node, PTYPEALIAS)->alias, name))\n\t\t{\n\t\t\tif (infoPtrPresent)\n\t\t\t\t*info = RECORD_OF(node, PTYPEALIAS)->mappedType;\n\n\t\t\tif (isPrimitivePtrPresent)\n\t\t\t\tSmmpTypeIsPrimitive(*info, isPrimitive);\n\n\t\t\treturn TRUE;\n\t\t}\n\t}\n\n\tif (dontCheckForUserTypes)\n\t{\n\t\tif (isPrimitivePtrPresent)\n\t\t\t*isPrimitive = FALSE;\n\n\t\treturn FALSE;\n\t}\n\n\tif (isPrimitivePtrPresent)\n\t\t*isPrimitive = FALSE;\n\n for (PSLISTNODE node = SmmpUserTypeList->head; node != NULL; node = node->next)\n {\n if (!strcmp(RECORD_OF(node, PSTRUCTINFO)->name, name))\n {\n\t\t\tif (infoPtrPresent)\n\t\t\t\t*info = RECORD_OF(node, PSTRUCTINFO);\n \n\t\t\treturn TRUE;\n }\n }\n\n return FALSE;\n}\n\nBOOL SmmpRegisterAlias(const char *alias, const char *typeName)\n{\n\tPTYPEALIAS palias = NULL;\n\tPVOID type;\n\n\tif (!SmmpGetTypeInfoByName(typeName, &type, NULL, FALSE))\n\t\treturn FALSE;\n\n\tpalias = ALLOCOBJECT(TYPEALIAS);\n\n\tif (!palias)\n\t\treturn FALSE;\n\n\tif (strlen(alias) + 1 > 64)\n\t{\n\t\tFREEOBJECT(palias);\n\t\treturn FALSE;\n\t}\n\n\tstrcpy(palias->alias, alias);\n\tpalias->mappedType = type;\n\n\tSmmpAddSList(SmmpAliasList, palias);\n\n\treturn TRUE;\n}\n\nBOOL SmmpInitBaseAliases()\n{\n\tLONG success = 0;\n\n\tsuccess += SmmpRegisterAlias(\"BYTE\", \"ubyte\");\n\tsuccess += SmmpRegisterAlias(\"WORD\", \"ushort\");\n\tsuccess += SmmpRegisterAlias(\"DWORD\", \"ulong\");\n\tsuccess += SmmpRegisterAlias(\"QWORD\", \"ulong64\");\n\n\treturn success;\n}\n\nBOOL SmmpInitBasePrimitiveTypes()\n{\n LONG success = 0;\n WORD index = 0;\n\n if (TYPE_IDENTS[0].pti != NULL)\n return TRUE;\n\n success += (LONG)SmmCreateMapTypeInfo(\"int\", SIZEOF_INT, FALSE, ConvertInt, &index);\n success += (LONG)SmmCreateMapTypeInfo(\"uint\", SIZEOF_INT, TRUE, ConvertUint, &index);\n\n success += (LONG)SmmCreateMapTypeInfo(\"char\", SIZEOF_CHAR, FALSE, ConvertChar, &index);\n\n success += (LONG)SmmCreateMapTypeInfo(\"wchar\", SIZEOF_WCHAR, FALSE, ConvertWchar, &index);\n\n success += (LONG)SmmCreateMapTypeInfo(\"byte\", SIZEOF_BYTE, FALSE, ConvertByte, &index);\n success += (LONG)SmmCreateMapTypeInfo(\"ubyte\", SIZEOF_BYTE, TRUE, ConvertUByte, &index);\n\n success += (LONG)SmmCreateMapTypeInfo(\"short\", SIZEOF_SHORT, FALSE, ConvertShort, &index);\n success += (LONG)SmmCreateMapTypeInfo(\"ushort\", SIZEOF_SHORT, FALSE, ConvertUShort, &index);\n\n success += (LONG)SmmCreateMapTypeInfo(\"long\", SIZEOF_LONG, FALSE, ConvertLong, &index);\n success += (LONG)SmmCreateMapTypeInfo(\"ulong\", SIZEOF_LONG, FALSE, ConvertULong, &index);\n\n success += (LONG)SmmCreateMapTypeInfo(\"long64\", SIZEOF_LONGLONG, FALSE, ConvertLong64, &index);\n success += (LONG)SmmCreateMapTypeInfo(\"ulong64\", SIZEOF_LONGLONG, FALSE, ConvertULong64, &index);\n\n success += (LONG)SmmCreateMapTypeInfo(\"string\", SIZEOF_INT, FALSE, ConvertString, &index);\n success += (LONG)SmmCreateMapTypeInfo(\"wstring\", SIZEOF_INT, FALSE, ConvertStringW, &index);\n\n success += (LONG)SmmCreateMapTypeInfo(\"pointer\", SIZEOF_INT, FALSE, ConvertPointer, &index);\n\n success += (LONG)SmmCreateMapTypeInfo(\"archex\", SIZEOF_POINTER, FALSE, ConvertArchHex, &index);\n\n\n if (success != index)\n {\n return FALSE;\n }\n\n return TRUE;\n}\n\n//maptype NAME {\n//typename fieldname1;\n//typename fieldname2;\n//typename[2] fieldname3;\n//typename * fieldname4;\n//}\n\n\n\n\n__forceinline BOOL SmmpNextnode(PSLISTNODE *node)\n{\n if ((*node)->next == NULL)\n return FALSE;\n\n (*node) = (*node)->next;\n return TRUE;\n}\n\n#define Stringof(node) (RECORD_OF((node), PToken)->token)\n\n#define OneWayExit(fs, exitLabel) { failStep = fs; goto exitLabel; }\n\n#define IsCurlyBrckOpen(node) (*Stringof(node) == '{')\n#define IsCurlyBrckClose(node) (*Stringof(node) == '}')\n\n#define IsSquareBrckOpen(node) (*Stringof(node) == '[')\n#define IsSquareBrckClose(node) (*Stringof(node) == ']')\n\n#define IsPtrChar(node) (*Stringof(node) == '*')\n\n#define IsSemiColon(node) (*Stringof(node) == ';')\n\n\nBOOL SmmpIsSpecialToken(char chr)\n{\n switch (chr)\n {\n case '(':\n case ')':\n case '[':\n case ']':\n case '{':\n case '}':\n case '*':\n case ';':\n case ',':\n case '!':\n return TRUE;\n }\n\n return FALSE;\n}\n\nBOOL SmmpIsNumeric(char c)\n{\n return c >= '0' && c <= '9';\n}\n\nBOOL SmmpIsWhitespace(char c)\n{\n switch (c)\n {\n case '\\r':\n case '\\n':\n case '\\t':\n case ' ':\n return TRUE;\n }\n\n return FALSE;\n}\n\nBOOL SmmpIsChar(char c)\n{\n return !SmmpIsWhitespace(c) && !SmmpIsNumeric(c) && !SmmpIsSpecialToken(c);\n}\n\n#define SmmpPushToken() { \\\n\t\t\t\t\t\t\ttok = ALLOCOBJECT(Token); \\\n strcpy(tok->token, buf); \\\n\t\t\t\t\t\t\ttok->col = col; \\\n\t\t\t\t\t\t\ttok->line = line; \\\n memset(buf, 0, sizeof(buf)); \\\n bufi = 0; \\\n SmmpAddSList(tokList, tok); \\\n }\n\nBOOL SmmpTokenize(LPCSTR typeDefString, PSLIST *tokenList)\n{\n char buf[512] = { 0 };\n const char *p = typeDefString;\n int bufi = 0;\n PToken tok;\n BOOL numLoad = FALSE;\n\tBOOL skip = FALSE;\n\tint line = 1, col = 1;\n\n PSLIST tokList;\n\n if (!SmmpCreateSLIST(&tokList))\n return FALSE;\n\n\n while (*p)\n {\n\t\tif (*p == '\\n')\n\t\t{\n\t\t\tline++;\n\t\t\tcol = 1;\n\t\t}\n\t\telse if (*p != '\\r')\n\t\t\tcol++;\n\n\t\tif (skip)\n\t\t{\n\t\t\tif (*p == '*' && *(p + 1) == '/')\n\t\t\t{\n\t\t\t\tp++;\n\t\t\t\tskip = FALSE;\n\t\t\t}\n\n\t\t\tp++;\n\t\t\tcontinue;\n\t\t}\n\n if (SmmpIsSpecialToken(*p))\n {\n if (bufi > 0)\n SmmpPushToken();\n\n\t\t\ttok = ALLOCOBJECT(Token);\n\t\t\ttok->token[0] = *p;\n\t\t\ttok->token[1] = 0;\n\n\t\t\ttok->col = col;\n\t\t\ttok->line = line;\n\n SmmpAddSList(tokList, tok);\n }\n else if (SmmpIsWhitespace(*p))\n {\n if (bufi > 0)\n SmmpPushToken();\n }\n else\n {\n\t\t\t//comment begin\n\t\t\tif (!skip && *p == '/' && *(p+1) == '*')\n\t\t\t{\n\t\t\t\tp++;\n\t\t\t\tskip = TRUE;\n\t\t\t}\n\t\t\telse\n\t\t\t\tbuf[bufi++] = *p;\n }\n\n p++;\n }\n\n if (bufi > 0)\n SmmpPushToken();\n\n *tokenList = tokList;\n\n return TRUE;\n}\n\nBOOL SmmpParseTypeField(PSLISTNODE *beginNode, PSTRUCTMEMBERFIELD *fieldPtr)\n{\n PSLISTNODE node = NULL;\n PPRIMITIVETYPEINFO pmti = NULL;\n PSTRUCTINFO pstr = NULL;\n\n PSTRUCTMEMBERFIELD field = NULL;\n\n BOOL success = FALSE;\n LONG failStep = 0;\n\n node = *beginNode;\n\n PVOID info;\n BOOL isPrimitive;\n\n if (!SmmpGetTypeInfoByName(Stringof(node), &info, &isPrimitive,FALSE))\n OneWayExit(FS_NOFIELDTYPE, exit);\n\n field = ALLOCOBJECT(STRUCTMEMBERFIELD);\n memset(field, 0, sizeof(STRUCTMEMBERFIELD));\n\n\n if (!field)\n OneWayExit(FS_MEMERR, exit);\n\n if (isPrimitive)\n field->type.primitiveType = (PPRIMITIVETYPEINFO)info;\n else\n {\n field->type.structType = (PSTRUCTINFO)info;\n field->isStruct = TRUE;\n }\n\n if (!SmmpNextnode(&node))\n OneWayExit(FS_EXPECTFIELDNAME, exit);\n\n if (IsSquareBrckOpen(node))\n {\n if (!SmmpNextnode(&node))\n OneWayExit(FS_EXPECTARRSIZE, exit);\n\n if (!IsSquareBrckClose(node))\n {\n field->arrSize = atoi(Stringof(node));\n\n if (field->arrSize == 0)\n OneWayExit(FS_EXPECTARRSIZE, exit);\n\n if (!SmmpNextnode(&node))\n OneWayExit(FS_EXPECTSQUBRCKCLOSE, exit);\n\n field->isArray = TRUE;\n\n }\n else\n {\n field->arrSize = 1;\n field->isArray = TRUE;\n }\n\n\n if (!SmmpNextnode(&node))\n OneWayExit(FS_EXPECTFIELDNAME, exit);\n\n }\n else if (IsPtrChar(node))\n {\n field->isPointer = TRUE;\n\n if (!SmmpNextnode(&node))\n OneWayExit(FS_EXPECTFIELDNAME, exit);\n }\n\n if (SmmpIsSpecialToken(*Stringof(node)))\n OneWayExit(FS_EXPECTFIELDNAME, exit);\n\n strcpy(field->fieldName, Stringof(node));\n\n\n if (!SmmpNextnode(&node))\n OneWayExit(FS_EXPECTSEMICOLON, exit);\n\n if (!IsSemiColon(node))\n OneWayExit(FS_EXPECTSEMICOLON, exit);\n\n if (!SmmpNextnode(&node))\n OneWayExit(-1, exit);\n\n success = TRUE;\n\nexit:\n\n *beginNode = node;\n *fieldPtr = field;\n\n\n if (!success)\n SmmpRaiseParseError(failStep,RECORD_OF(node,PToken));\n\n return success;\n}\n\nWORD SmmpParseTypeFields(PSLISTNODE *beginNode, PSTRUCTINFO typeInfo)\n{\n PSLISTNODE node;\n PSTRUCTMEMBERFIELD field;\n\n BOOL success = FALSE;\n\n node = *beginNode;\n\n if (!SmmpCreateSLIST(&typeInfo->fields))\n return 0;\n\n while (node != NULL)\n {\n if (IsCurlyBrckClose(node))\n break;\n\n if (SmmpParseTypeField(&node, &field))\n {\n SmmpAddSList(typeInfo->fields, field);\n\n if (field->isArray)\n {\n if (field->isStruct)\n typeInfo->structSize += field->type.structType->structSize * field->arrSize;\n else\n typeInfo->structSize += field->type.primitiveType->size * field->arrSize;\n }\n else if (field->isPointer)\n typeInfo->structSize += SIZEOF_POINTER;\n else\n {\n if (field->isStruct)\n typeInfo->structSize += field->type.structType->structSize;\n else\n typeInfo->structSize += field->type.primitiveType->size;\n }\n }\n else\n break;\n }\n\n *beginNode = node;\n\n return (WORD)typeInfo->fields->count;\n}\n\n#define ARG_IN 1\n#define ARG_OUT 2\n\nBOOL SmmpParseFunctionSignature(PSLISTNODE *startNode, PFNSIGN *funcSign)\n{\n\tchar name[128] = { 0 }, module[128] = { 0 }, buf[128] = { 0 };\n char argType[64], argName[128];\n PARGINFO argList = NULL;\n\tPRETINFO retInfo;\n SHORT argCount = 0;\n PFNSIGN fnSign = NULL;\n\tPVOID argTypeInfo = NULL, retTypeInfo = NULL;\n BOOL isPrimitive=FALSE,isPtr=FALSE;\n int argInOut = 0,failStep=0;\n\n PSLISTNODE node = (*startNode)->next;\n\n\tif (SmmpGetTypeInfoByName(Stringof(node), &retTypeInfo, NULL, FALSE))\n\t{\n\t\tretInfo = ALLOCOBJECT(RETINFO);\n\n\t\tif (!retInfo)\n\t\t{\n\t\t\tRAISEGLOBALERROR(\"Memory allocation failed.\");\n\t\t\treturn FALSE;\n\t\t}\n\n\t\tretInfo->typeInfo.u = retTypeInfo;\n\n\t\tif (!SmmpNextnode(&node))\n\t\t\tOneWayExit(FS_EXPECTMODNAME, finish);\n\t}\n\n\n strcpy(module, Stringof(node));\n\n if (!SmmpNextnode(&node))\n OneWayExit(FS_EXPECTNOTOP, finish);\n\n if (*Stringof(node) != '!')\n OneWayExit(FS_EXPECTNOTOP, finish);\n\n if (!SmmpNextnode(&node))\n OneWayExit(FS_EXPECTMODNAME, finish);\n\n strcpy(name, Stringof(node));\n\n if (!SmmpNextnode(&node))\n OneWayExit(FS_EXPECTPARANOPEN, finish);\n\n if (*Stringof(node) != '(')\n OneWayExit(FS_EXPECTPARANOPEN, finish);\n\n argList = ALLOCOBJECTLIST(ARGINFO, 10);\n fnSign = ALLOCOBJECT(FNSIGN);\n\n\n DBGPRINT(\"parsing signature %s!%s\", module, name);\n\n if (SmmpIsSpecialToken(*Stringof(node)))\n {\n if (*Stringof(node) == ')')\n {\n FREEOBJECT(argList);\n argList = NULL;\n argCount = 0;\n\n goto finish;\n }\n }\n\n do\n {\n if (!SmmpNextnode(&node))\n OneWayExit(FS_UNEXPECTED_SYTX_END, finish);\n\n memset(argType, 0, sizeof(argType));\n memset(argName, 0, sizeof(argName));\n argInOut = 0;\n isPtr = FALSE;\n\n if (SmmpIsSpecialToken(*Stringof(node)))\n OneWayExit(FS_UNEXPECTED_TOKEN, finish);\n\n if (!_stricmp(Stringof(node), \"out\"))\n argInOut = ARG_OUT;\n else if (!_stricmp(Stringof(node), \"in\"))\n argInOut = ARG_IN;\n\n if (argInOut > 0)\n {\n if (!SmmpNextnode(&node))\n OneWayExit(FS_EXPECTTYPE, finish);\n\n if (SmmpIsSpecialToken(*Stringof(node)))\n OneWayExit(FS_EXPECTTYPE, finish);\n }\n\n strcpy(argType, Stringof(node));\n\n if (!SmmpNextnode(&node))\n OneWayExit(FS_EXPECTARGNAME, finish);\n\n if (IsPtrChar(node))\n {\n isPtr = TRUE;\n\n if (!SmmpNextnode(&node))\n OneWayExit(FS_EXPECTARGNAME, finish);\n\n if (SmmpIsSpecialToken(*Stringof(node)))\n OneWayExit(FS_EXPECTARGNAME, finish);\n }\n\n\n strcpy(argName, Stringof(node));\n\n if (!SmmpNextnode(&node))\n OneWayExit(FS_UNEXPECTED_SYTX_END, finish);\n\n strcpy(argList[argCount].name, argName);\n\n if (!SmmpGetTypeInfoByName(argType, &argTypeInfo, &isPrimitive,FALSE))\n {\n OneWayExit(FS_TYPENOTFOUND, finish);\n }\n\n argList[argCount].isStructure = !isPrimitive;\n argList[argCount].typeInfo.holder = argTypeInfo;\n argList[argCount].isOutArg = argInOut == ARG_OUT;\n argList[argCount].isPointer = isPtr;\n\n DBGPRINT(\"name: %s\", argName);\n DBGPRINT(\"isStruct?: %d\", !isPrimitive);\n DBGPRINT(\"isOut?: %d\", argInOut == ARG_OUT);\n DBGPRINT(\"isPointer?: %d\", isPtr);\n DBGPRINT(\"\\n\");\n\n if (argInOut == ARG_OUT && !fnSign->hasOutArg)\n fnSign->hasOutArg = TRUE;\n\n argCount++;\n\n } while (*Stringof(node) == ',');\n\n if (*Stringof(node) != ')')\n {\n OneWayExit(FS_EXPECTPARANCLOSE, finish);\n }\n\n if (!SmmpNextnode(&node))\n node = NULL;\n\nfinish:\n\n if (failStep > 0)\n {\n SmmpRaiseParseError(failStep,RECORD_OF(node,PToken));\n\n if (fnSign != NULL)\n FREEOBJECT(fnSign);\n\n if (argList != NULL)\n FREEOBJECT(argList);\n\n return FALSE;\n }\n\n fnSign->argCount = argCount;\n fnSign->args = argList;\n\tfnSign->ret = retInfo;\n strcpy(fnSign->name, name);\n strcpy(fnSign->module, module);\n\n *funcSign = fnSign;\n\n *startNode = node;\n\n return TRUE;\n}\n\nBOOL SmmpParseAlias(PSLISTNODE *startNode)\n{\n\tPSLISTNODE node = *startNode;\n\tchar *realType, *aliasName;\n\n\tif (strcmp(Stringof(node), \"alias\"))\n\t\treturn FALSE;\n\n\tif (!SmmpNextnode(&node))\n\t{\n\t\tSmmpRaiseParseError(FS_EXPECTTYPE,RECORD_OF(node,PToken));\n\t\treturn FALSE;\n\t}\n\n\trealType = Stringof(node);\n\n\tif (!SmmpNextnode(&node))\n\t{\n\t\tSmmpRaiseParseError(FS_EXPECTIDENT, RECORD_OF(node, PToken));\n\t\treturn FALSE;\n\t}\n\n\taliasName = Stringof(node);\n\n\tif (!SmmpRegisterAlias(aliasName, realType))\n\t{\n\t\tSmmpRaiseParseError(FS_TYPENOTFOUND, RECORD_OF(node, PToken));\n\t\treturn FALSE;\n\t}\n\t\n\tif (!SmmpNextnode(&node))\n\t\tnode = NULL;\n\n\t*startNode = node;\n\n\treturn TRUE;\n}\n\nBOOL _SmmpParseType(PSLISTNODE *startNode, PSTRUCTINFO *typeInfo)\n{\n PSLISTNODE node = NULL;\n PSTRUCTINFO pti = NULL;\n BOOL success = FALSE;\n LONG failStep = 0;\n\n node = *startNode;\n\n if (strcmp(Stringof(node), \"maptype\"))\n {\n OneWayExit(FS_MAPTYPE, exit);\n }\n\n if (!SmmpNextnode(&node))\n OneWayExit(FS_TYPENAME, exit); //typename expected\n\n pti = ALLOCOBJECT(STRUCTINFO);\n\n if (!pti)\n OneWayExit(FS_MEMERR, exit);\n\n memset(pti, 0, sizeof(STRUCTINFO));\n pti->cbSize = sizeof(STRUCTINFO);\n\n if (SmmpIsSpecialToken(*Stringof(node)))\n OneWayExit(FS_TYPENAME, exit);\n\n strcpy(pti->name, Stringof(node));\n\n if (!SmmpNextnode(&node))\n OneWayExit(FS_BRACKOPEN, exit); //{ Expected\n\n if (!IsCurlyBrckOpen(node))\n OneWayExit(FS_BRACKOPEN, exit); //{ expected\n\n if (!SmmpNextnode(&node))\n OneWayExit(FS_EXPECTFIELD, exit); //Field definition expected\n\n //Compile fields\n\n if (!SmmpParseTypeFields(&node, pti))\n OneWayExit(FS_EXPECTFIELD, exit);\n\n if (!IsCurlyBrckClose(node))\n OneWayExit(FS_BRACKCLOSE, exit); //} expected\n\n if (!SmmpNextnode(&node))\n node = NULL;\n\n success = TRUE;\nexit:\n\n *startNode = node;\n\n if (!success)\n SmmpRaiseParseError(failStep, RECORD_OF(node, PToken));\n\n *typeInfo = pti;\n\n return success;\n\n}\n\n\nvoid SmmpDumpMapTypeInfo(PPRIMITIVETYPEINFO mti)\n{\n _DBGPRINT(\"Typename: %s\\n\", mti->typeName);\n _DBGPRINT(\"Size: %d\\n\", mti->size);\n _DBGPRINT(\"Signed: %d\\n\", mti->isSigned);\n}\n\nvoid SmmpDumpType(PSTRUCTINFO type)\n{\n PSTRUCTMEMBERFIELD field;\n\n _DBGPRINT(\"Name: %s\\n\", type->name);\n _DBGPRINT(\"---Fields---\\n\\n\");\n\n for (PSLISTNODE n = type->fields->head; n != NULL; n = n->next)\n {\n field = RECORD_OF(n, PSTRUCTMEMBERFIELD);\n\n if (field->isStruct)\n {\n SmmpDumpType(field->type.structType);\n return;\n }\n\n _DBGPRINT(\"Name: %s\\n\", field->fieldName);\n SmmpDumpMapTypeInfo(field->type.primitiveType);\n _DBGPRINT(\"Is Array: %d\\n\", field->isArray);\n\n if (field->isArray)\n _DBGPRINT(\"Array size: %d\\n\", field->arrSize);\n\n _DBGPRINT(\"Is pointer: %d\\n\\n\", field->isPointer);\n }\n}\n\n//TODO: detect value or not value?\nBOOL SmmpMapForPrimitiveType(PGENERIC_DATATYPE_INFO pdi, Rtf *rtf, BYTE *mem, SHORT lastDepth, PCOMMON_DATAFIELD_INFO pcdi)\n{\n\tPPRIMITIVETYPEINFO pmti;\n\tBOOL pcdiPresent = pcdi != NULL;\n\tBOOL isPointer = FALSE, isArray = FALSE;\n\tULONG arraySize = 0;\n\tchar buffer[1024];\n BOOL result = TRUE;\n\tbool isValue = false;\n\n\tif (pcdiPresent)\n\t{\n\t\tswitch (pcdi->type)\n\t\t{\n\t\tcase CDI_FUNCTION_ARGUMENT:\n\t\t\tif (!pcdi->u.argInfo->isStructure)\n\t\t\t\tpmti = pcdi->u.argInfo->typeInfo.primitiveInfo;\n\t\t\telse\n\t\t\t\treturn FALSE;\n\n\t\t\tisPointer = pcdi->u.argInfo->isPointer;\n\t\t\tisArray = FALSE;\n\t\t\tarraySize = 0;\n\t\t\tbreak;\n\t\tcase CDI_STRUCTURE_FIELD:\n\t\t\tif (!pcdi->u.fieldInfo->isStruct)\n\t\t\t\tpmti = pcdi->u.fieldInfo->type.primitiveType;\n\t\t\telse\n\t\t\t\treturn FALSE;\n\n\t\t\tisPointer = pcdi->u.fieldInfo->isPointer;\n\t\t\tisArray = pcdi->u.fieldInfo->isArray;\n\t\t\tarraySize = isArray ? pcdi->u.fieldInfo->arrSize : 0;\n\t\t\tbreak;\n\t\tdefault:\n\t\t\treturn FALSE;\n\t\t}\n\t}\n\telse\n\t\tpmti = (PPRIMITIVETYPEINFO)pdi;\n\t//Ignore return\n\t\n if (isPointer)\n {\n\t\t//'*' marked pointer type. we need to dereference and map\n\t\tisValue = false;\n\n if (!strcmp(pdi->typeName, \"char\"))\n pmti = TYPE_IDENTS[MAX_TYPE_IDENTS - 3].pti; //assume string converter\n else if (!strcmp(pdi->typeName, \"wchar\"))\n pmti = TYPE_IDENTS[MAX_TYPE_IDENTS - 2].pti; //assume wstring converter\n else if (!strcmp(pdi->typeName, \"pointer\"))\n pmti = TYPE_IDENTS[MAX_TYPE_IDENTS - 1].pti; //pointer itself converter\n\n pmti->method(buffer, mem, isValue);\n }\n else if (isArray)\n {\n\t\t//if char[] or wchar[] we can assume as string again\n if (!strcmp(pdi->typeName, \"char\"))\n pmti = TYPE_IDENTS[MAX_TYPE_IDENTS - 3].pti;\n else if (!strcmp(pdi->typeName, \"wchar\"))\n pmti = TYPE_IDENTS[MAX_TYPE_IDENTS - 2].pti;\n else\n {\n\t\t\tBYTE *arrPtr = (BYTE *)mem;\n\n for (ULONG i = 0;i < arraySize;i++)\n {\n\t\t\t\t//Map n. index of memory \n pmti->method(buffer, arrPtr, false);\n\n\t\t\t\t//increment pointer type of array memory\n\t\t\t\tmem += pmti->size;\n }\n\n memset(buffer, 0, sizeof(buffer));\n\n goto oneWayExit;\n\n }\n }\n\telse\n\t{\n\t\tif (!strcmp(pdi->typeName, \"string\") || !strcmp(pdi->typeName, \"wstring\"))\n\t\t\tisValue = false;\n\t\telse\n\t\t\tisValue = true;\n\n\t\tpmti->method(buffer, mem, isValue);\n\t}\n\noneWayExit:\n\n if (result)\n {\n rtf->Color(RTFC_DEFAULT)->FormatText(buffer);\n }\n\n return result;\n}\n\nBOOL SmmpMapForStructureType(PGENERIC_DATATYPE_INFO pdi, Rtf *rtf, BYTE *mem, SHORT lastDepth, PCOMMON_DATAFIELD_INFO pcdi);\n\nBOOL SmmpMapField(PSTRUCTMEMBERFIELD ptif, Rtf* rtf, BYTE *mem,SHORT lastDepth)\n{\n\tCOMMON_DATAFIELD_INFO cdi;\n PPRIMITIVETYPEINFO pmti = NULL;\n BYTE *memArr = NULL;\n\n\tcdi.type = CDI_STRUCTURE_FIELD;\n\tcdi.u.fieldInfo = ptif;\n\n\tif (ptif->isStruct)\n\t\treturn SmmpMapForStructureType((PGENERIC_DATATYPE_INFO)ptif->type.structType, rtf, mem, lastDepth + 1, &cdi);\n\n\treturn SmmpMapForPrimitiveType((PGENERIC_DATATYPE_INFO)ptif->type.primitiveType, rtf, mem, lastDepth + 1, &cdi);\n}\n\n\nBOOL SmmpMapForStructureType(PGENERIC_DATATYPE_INFO pdi, Rtf *rtf, BYTE *mem, SHORT lastDepth, PCOMMON_DATAFIELD_INFO pcdi)\n{\n PSTRUCTMEMBERFIELD ptif = NULL;\n\tPSTRUCTINFO psi = (PSTRUCTINFO)pdi;\n\n DWORD typeSize = 0;\n\n char buf[512];\n\n rtf->FormatText(\"(Struct of %s) = \", psi->name)->NewLine(1);\n\n rtf->NewTab(lastDepth)->FormatText(\"[\")->NewLine(1);\n\n for (PSLISTNODE node = psi->fields->head; node != NULL; node = node->next)\n {\n ptif = RECORD_OF(node, PSTRUCTMEMBERFIELD);\n memset(buf, 0, sizeof(buf));\n\n rtf->Style(RTFS_TAB, lastDepth + 1)->FormatText(\"%s = \", ptif->fieldName);\n \n if (!SmmpMapField(ptif, rtf, mem,lastDepth))\n return FALSE;\n\n rtf->Style(RTFS_NEWLINE);\n\n typeSize = ptif->isStruct ? ptif->type.structType->structSize : ptif->type.primitiveType->size;\n\n if (ptif->isArray)\n mem += typeSize * ptif->arrSize;\n else if (ptif->isPointer)\n mem += SIZEOF_POINTER;\n else\n mem += typeSize;\n\n\n }\n\n rtf->NewTab(lastDepth)->FormatText(\"]\")->NewLine(1);\n\n return TRUE;\n}\n\n\nBOOL SmmMapFunctionCall(PPASSED_PARAMETER_CONTEXT passedParams, PFNSIGN fnSign, ApiFunctionInfo *afi, LPSTR *mapResult)\n{\n PARGINFO argInfo;\n BOOL isPrimitive;\n BYTE *mem;\n PGENERIC_DATATYPE_INFO pdi;\n\tCOMMON_DATAFIELD_INFO cdi;\n Rtf *rtf;\n\n rtf = new Rtf();\n\n SmmpRegisterRtfColorAndFonts(rtf);\n\n if (_stricmp(fnSign->module, afi->ownerModule->name) || _stricmp(fnSign->name, afi->name))\n return FALSE;\n\n rtf->Style(RTFS_BOLD)->Font(RTFF_DEFAULT)->FontSize(22)\n ->FormatText(\"Map for \")->Color(RTFC_DARKBLUE)\n ->FormatText(\"%s\", fnSign->module)->Color(RTFC_DEFAULT)\n ->FormatText(\"!\")->Color(RTFC_DARKRED)\n ->FormatText(\"%s\", fnSign->name)->Color(RTFC_DEFAULT)\n ->FormatText(\"(\")->NewLine(1);\n\n for (int i = 0;i < fnSign->argCount;i++)\n {\n argInfo = &fnSign->args[i];\n\n pdi = (PGENERIC_DATATYPE_INFO)argInfo->typeInfo.holder;\n\n\t\tisPrimitive = pdi->cbSize == sizeof(PRIMITIVETYPEINFO);\n\n rtf->Style(RTFS_TAB, 1)->Color(RTFC_DEFAULT)\n ->FormatText(\"Arg#%d (\", i + 1)->Color(RTFC_LIGHTGREEN)\n ->FormatText(\"Name\")->Color(RTFC_DARKRED)\n ->FormatText(\": %s, \", argInfo->name)\n ->Color(RTFC_LIGHTGREEN)->FormatText(\"Type\")\n ->Color(RTFC_DEFAULT)->FormatText(\": %s) = \", pdi->typeName);\n\n\t\tmem = (BYTE *)passedParams->paramList[i];\n\n\t\tcdi.type = CDI_FUNCTION_ARGUMENT;\n\t\tcdi.u.argInfo = argInfo;\n\n\t\tif (isPrimitive)\n\t\t\tSmmpMapForPrimitiveType(pdi, rtf, mem, 0, &cdi);\n else\n {\n //I need a special formatting for function map of the user types!!\n SmmpMapForStructureType(pdi, rtf, mem, 0,&cdi);\n }\n\n rtf->Style(RTFS_NEWLINE);\n }\n\n rtf->FormatText(\");\")->NewLine(2);\n\n\n *mapResult = rtf->GetRtf();\n\n delete rtf;\n\n return TRUE;\n}\n\nBOOL SmmMapMemoryForType(void *memory, ULONG size, const char *typeName)\n{\n Rtf *rtf;\n BOOL result, isPrimitive;\n\tPGENERIC_DATATYPE_INFO pdi;\n\n rtf = new Rtf();\n\n for (PSLISTNODE node = SmmpTypeList->head; node != NULL; node = node->next)\n {\n\t\tpdi = RECORD_OF(node, PGENERIC_DATATYPE_INFO);\n\n if (!strcmp(pdi->typeName, typeName))\n {\n\t\t\tisPrimitive = pdi->cbSize == sizeof(PRIMITIVETYPEINFO);\n\n\t\t\tif (isPrimitive)\n\t\t\t\tresult = SmmpMapForPrimitiveType(pdi, rtf, (BYTE *)memory, 0, NULL);\n\t\t\telse\n\t\t\t\tresult = SmmpMapForStructureType(pdi, rtf, (BYTE *)memory, 0, NULL);\n\n break;\n }\n }\n\n\n delete rtf;\n\n return result;\n}\n\nBOOL SmmGetFunctionSignature(const char *module, const char *function, PFNSIGN *signInfo)\n{\n PFNSIGN fnSign;\n\n if (!signInfo)\n return FALSE;\n\n for (PSLISTNODE node = SmmpFnSignList->head; node != NULL; node = node->next)\n {\n fnSign = RECORD_OF(node, PFNSIGN);\n\n if (!_stricmp(fnSign->module, module) && !_stricmp(fnSign->name, function))\n {\n *signInfo = fnSign;\n return TRUE;\n }\n }\n\n *signInfo = NULL;\n return FALSE;\n}\n\nBOOL SmmGetFunctionSignature2(ApiFunctionInfo *afi, PFNSIGN *signInfo)\n{\n if (!afi)\n return FALSE;\n\n if (!signInfo)\n return FALSE;\n\n return SmmGetFunctionSignature(afi->ownerModule->name, afi->name, signInfo);\n}\n\nSHORT SmmGetArgumentCount(PFNSIGN signInfo)\n{\n if (!signInfo)\n return -1;\n\n return signInfo->argCount;\n}\n\nBOOL SmmSigHasOutArgument(PFNSIGN signInfo)\n{\n if (!signInfo)\n return FALSE;\n\n return signInfo->hasOutArg;\n}\n\nBOOL SmmpIsFullPathOrURL(LPCWSTR str, BOOL *isLocal)\n{\n if (HlpBeginsWithW(str + 1, L\":\\\\\\\\\", TRUE, 3))\n {\n *isLocal = TRUE;\n return TRUE;\n }\n\n if (HlpBeginsWithW(str, L\"http\", FALSE, 4))\n {\n *isLocal = FALSE;\n return TRUE;\n }\n\n return FALSE;\n}\n\nvoid SmmpBuildNewFileOrURL(LPWSTR buffer, ULONG bufSize, LPWSTR objectName)\n{\n BOOL isLocal;\n WCHAR sepFind, sepRepl;\n LPWSTR ptr;\n\n if (SmmpIsFullPathOrURL(objectName, &isLocal))\n {\n wcscpy(buffer, objectName);\n return;\n }\n\n\n SmmpIsFullPathOrURL(SmmpScriptWorkDir, &isLocal);\n\n\n if (!isLocal)\n {\n sepFind = '\\\\';\n sepRepl = '/';\n }\n else\n {\n sepFind = '/';\n sepRepl = '\\\\';\n }\n\n memset(buffer, 0, bufSize);\n\n wsprintfW(buffer, L\"%s%s\", SmmpScriptWorkDir, objectName);\n\n ptr = (LPWSTR)buffer;\n\n while (*ptr)\n {\n if (*ptr == sepFind)\n *ptr = sepRepl;\n ptr++;\n }\n\n}\n\nBOOL SmmpParseType(LPCSTR typeDefString, WORD *typeCount)\n{\n PSLIST tokenList;\n PSLISTNODE node;\n PSTRUCTINFO typeInfo = NULL;\n PFNSIGN fnSign = NULL;\n WORD compiledTypeCount = 0;\n LONG err = -1;\n LPWSTR inclFileW = NULL;\n WCHAR fullInclFileW[MAX_PATH];\n\tBOOL success = FALSE;\n\n if (!SmmpTokenize(typeDefString, &tokenList))\n return FALSE;\n\n node = tokenList->head;\n\n while (node != NULL)\n {\n if (!_stricmp(Stringof(node),\"@incl\"))\n {\n if (!SmmpNextnode(&node))\n err = FS_EXPECTINCLFILEPATH;\n\n if (!HlpTrimChar(Stringof(node), '\\'', HLP_TRIM_BOTH))\n err = FS_EXPECTINCLFILEPATH;\n\n if (err >= 0)\n {\n SmmpRaiseParseError(err, RECORD_OF(node, PToken));\n\t\t\t\tgoto exit;\n }\n\n inclFileW = HlpAnsiToWideString(Stringof(node));\n\n if (!inclFileW)\n goto exit;\n\n SmmpBuildNewFileOrURL(fullInclFileW, sizeof(fullInclFileW), inclFileW);\n \n FREESTRING(inclFileW);\n\n SmmParseFromFileW(fullInclFileW, typeCount);\n\n if (!SmmpNextnode(&node))\n node = NULL;\n\n continue;\n }\n\t\telse if (!_stricmp(Stringof(node), \"fnsign\"))\n {\n if (!SmmpParseFunctionSignature(&node, &fnSign))\n {\n goto exit;\n }\n\n SmmpAddSList(SmmpFnSignList, fnSign);\n\n }\n else if (!_stricmp(Stringof(node), \"maptype\"))\n {\n if (!_SmmpParseType(&node, &typeInfo))\n {\n //release all\n goto exit;\n }\n\n SmmpAddSList(SmmpUserTypeList, typeInfo);\n SmmpAddSList(SmmpTypeList, typeInfo);\n\n compiledTypeCount++;\n\n SmmpDumpType(typeInfo);\n }\n\t\telse if (!_stricmp(Stringof(node), \"alias\"))\n\t\t{\n\t\t\tif (!SmmpParseAlias(&node))\n\t\t\t\tgoto exit;\n\t\t}\n\t\telse\n\t\t{\n\t\t\tSmmpRaiseParseError(FS_UNEXPECTED_TOKEN, RECORD_OF(node, PToken));\n\t\t\tgoto exit;\n\t\t}\n\n }\n\n\tsuccess = TRUE;\n\n if (typeCount)\n *typeCount += compiledTypeCount;\n\nexit:\n\n\n\tfor (PSLISTNODE node = tokenList->head; node != NULL; node = node->next)\n\t\tFREEOBJECT(node->value);\n\n\tSmmpDestroySList(tokenList);\n\n return success;\n}\n\nBOOL SmmParseType(LPCSTR typeDefString, WORD *typeCount)\n{\n BOOL success = FALSE;\n\n if (!typeCount)\n return FALSE;\n\n success = SmmpParseType(typeDefString,typeCount);\n\n if (!success)\n SmmReleaseResources(false);\n\n return success;\n}\n\n\nBOOL SmmpParseFromInternet(LPCWSTR sourceUrl, WORD *typeCount)\n{\n BYTE* content;\n ULONG contentLen;\n BOOL result;\n\n if (!UtlInternetReadW(sourceUrl, &content, &contentLen))\n return FALSE;\n\n result = SmmParseType((LPCSTR)content, typeCount);\n\n if (result)\n AbMemoryFree(content);\n\n return result;\n}\n\nBOOL SmmParseFromFileW(LPCWSTR fileName, WORD *typeCount)\n{\n HANDLE fileHandle = NULL;\n char *fileContent = NULL;\n DWORD fsLo, fsHi, read;\n BOOL result = FALSE;\n WCHAR workDir[MAX_PATH];\n BOOL isInetSource,workDirStacked=FALSE;\n\n\twcscpy(SmmpCurrentParsingFile, fileName);\n\tSmmpPushPath(&SmmpParsingFileStack, (WCHAR *)fileName);\n\n isInetSource = HlpBeginsWithW(fileName, L\"http\", FALSE, 4);\n\n //Initial\n if (!SmmpFnSignList)\n {\n //change prototype to const wstr\n if (!HlpPathFromFilenameW((LPWSTR)fileName, SmmpScriptWorkDir, MAX_PATH,isInetSource?L'/':L'\\\\'))\n return FALSE;\n\n SmmpWorkDirIsLocal = !isInetSource;\n }\n else\n {\n HlpPathFromFilenameW((LPWSTR)fileName, workDir, MAX_PATH, isInetSource ? L'/' : L'\\\\');\n\n if (_wcsicmp(workDir, SmmpScriptWorkDir))\n {\n SmmpPushPath(&SmmpWorkDirStack, SmmpScriptWorkDir);\n SmmpWorkDirIsLocal = !isInetSource;\n wcscpy(SmmpScriptWorkDir, workDir);\n workDirStacked = TRUE;\n }\n\n }\n\n if (isInetSource)\n {\n result = SmmpParseFromInternet((LPCWSTR)fileName, typeCount);\n\n if (workDirStacked)\n {\n SmmpPopPath(&SmmpWorkDirStack,SmmpScriptWorkDir,&isInetSource);\n }\n\n\t\tSmmpPopPath(&SmmpParsingFileStack, SmmpCurrentParsingFile, NULL);\n\n return result;\n }\n\n \n fileHandle = CreateFileW(fileName, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, 0, NULL);\n\n if (fileHandle == INVALID_HANDLE_VALUE)\n goto exit;\n\n fsLo = GetFileSize(fileHandle, &fsHi);\n\n if (fsHi > 0)\n {\n //Hollyshit. Are you really sure that is it contains plain text?\n goto exit;\n }\n\n //Is it also larger than 1Meg for a standart text file.\n if (fsLo >= 0x100000)\n goto exit;\n\n fileContent = (char *)AbMemoryAlloc(fsLo);\n\n if (!fileContent)\n goto exit;\n \n if (!ReadFile(fileHandle, fileContent, fsLo, &read, NULL))\n goto exit;\n\n\t\n result = SmmParseType(fileContent, typeCount);\nexit:\n\n\tSmmpPopPath(&SmmpParsingFileStack, SmmpCurrentParsingFile, NULL);\n\n if (fileContent)\n AbMemoryFree(fileContent);\n\n CloseHandle(fileHandle);\n\n if (workDirStacked)\n {\n\t\tSmmpPopPath(&SmmpWorkDirStack,SmmpScriptWorkDir, &isInetSource);\n }\n\n return result;\n}\n\nBOOL SmmParseFromFileA(LPCSTR fileName, WORD *typeCount)\n{\n LPCWSTR fileNameW = NULL;\n BOOL result;\n\n fileNameW = HlpAnsiToWideString(fileName);\n\n if (!fileNameW)\n return FALSE;\n\n result = SmmParseFromFileW(fileNameW, typeCount);\n\n FREESTRING(fileNameW);\n\n return result;\n}\n\nBOOL SmmHasParseError(LPSTR *errorString)\n{\n ARCHWIDE written = 0;\n\n if (!SmmpParseErrorContent)\n return FALSE;\n\n DmaGetAdapterInfo(SmmpParseErrorContent, &written, NULL);\n\n if (written > 0)\n {\n DmaTakeMemoryOwnership(SmmpParseErrorContent, (void **)errorString);\n return TRUE;\n }\n\n return FALSE;\n}\n\nVOID SmmInitializeResources()\n{\n\tbool success = false;\n\n\tif (!SmmpCreateSLIST(&SmmpFnSignList))\n\t\tgoto exit;\n\n\tif (!SmmpCreateSLIST(&SmmpTypeList))\n\t\tgoto exit;\n\n\tif (!SmmpCreateSLIST(&SmmpUserTypeList))\n\t\tgoto exit;\n\n\tif (!SmmpCreateSLIST(&SmmpAliasList))\n\t\tgoto exit;\n\n\tif (!SmmpInitBasePrimitiveTypes())\n\t\tgoto exit;\n\n\tif (!SmmpInitBaseAliases())\n\t\tgoto exit;\n\n\tDmaCreateAdapter(sizeof(char), 64, &SmmpParseErrorContent);\n\t\n\tSmmpInitPathStack(&SmmpParsingFileStack);\n\tSmmpInitPathStack(&SmmpWorkDirStack);\n\n\tsuccess = true;\nexit:\n\n\tif (!success)\n\t\tSmmReleaseResources(true);\n}\n\nVOID SmmReleaseResources(bool fullRelease)\n{\n PGENERIC_DATATYPE_INFO gdi;\n PFNSIGN fnSign;\n BOOL isPrimv = FALSE;\n\n\t\n\tif (fullRelease)\n\t{\n\t\tRtlZeroMemory(TYPE_IDENTS, sizeof(typeidents) * MAX_TYPE_IDENTS);\n\t}\n\n if (SmmpUserTypeList != NULL)\n {\n\t\tSmmpClearList(SmmpUserTypeList,FALSE);\n\n\t\tif (fullRelease)\n\t\t{\n\t\t\tSmmpDestroySList(SmmpUserTypeList);\n\t\t\tSmmpUserTypeList = NULL;\n\t\t}\n }\n\n\tif (SmmpAliasList != NULL)\n\t{\n\t\tSmmpClearList(SmmpAliasList,TRUE);\n\n\t\tif (fullRelease)\n\t\t{\n\t\t\tSmmpDestroySList(SmmpAliasList);\n\t\t\tSmmpAliasList = NULL;\n\t\t}\n\t}\n\n if (SmmpTypeList != NULL)\n {\n for (PSLISTNODE node = SmmpTypeList->head; node != NULL; node = node->next)\n {\n gdi = RECORD_OF(node, PGENERIC_DATATYPE_INFO);\n \n SmmpTypeIsPrimitive(gdi, &isPrimv);\n\n if (!isPrimv)\n {\n for (PSLISTNODE fieldNode = ((PSTRUCTINFO)gdi)->fields->head; \n fieldNode != NULL; \n fieldNode = fieldNode->next)\n {\n FREEOBJECT(RECORD_OF(fieldNode, PSTRUCTMEMBERFIELD));\n }\n\n\t\t\t\tSmmpDestroySList(((PSTRUCTINFO)gdi)->fields);\n }\n\n FREEOBJECT(gdi);\n\n }\n\n\t\tSmmpClearList(SmmpTypeList,FALSE);\n\n\t\tif (fullRelease)\n\t\t{\n\t\t\tSmmpDestroySList(SmmpTypeList);\n\t\t\tSmmpTypeList = NULL;\n\t\t}\n }\n\n\n if (SmmpFnSignList != NULL)\n {\n for (PSLISTNODE node = SmmpFnSignList->head; node != NULL; node = node->next)\n {\n fnSign = RECORD_OF(node, PFNSIGN);\n\n\t\t\tif (fnSign->ret)\n\t\t\t\tFREEOBJECT(fnSign->ret);\n\t\t\t\n\t\t\tif (fnSign->args)\n\t\t\t\tFREEOBJECT(fnSign->args);\n\n\t\t\tRtlZeroMemory(fnSign, sizeof(FNSIGN));\n\t\t\tFREEOBJECT(fnSign);\n }\n\n\t\tSmmpClearList(SmmpFnSignList,FALSE);\n\n\t\tif (fullRelease)\n\t\t{\n\t\t\tSmmpDestroySList(SmmpFnSignList);\n\t\t\tSmmpFnSignList = NULL;\n\t\t}\n }\n\n SmmpInitPathStack(&SmmpWorkDirStack);\n\tSmmpInitPathStack(&SmmpParsingFileStack);\n\n if (SmmpParseErrorContent)\n {\n DmaDestroyAdapter(SmmpParseErrorContent);\n SmmpParseErrorContent = NULL;\n }\n}" }, { "path": "x64dbgApiBreak/src/syslib.cpp", "content": "#include \n\n#define TRY_MAX_WAITMS 1000\n#define TRY_WAIT_PERCALL 20\n#define TRY_COUNT (TRY_MAX_WAITMS / TRY_WAIT_PERCALL)\n\n#include \n\ntypedef struct __MEMLIST_ENTRY\n{\n\tULONG\t\t\t\t\t\tmagic;\n\tstruct __MEMLIST_ENTRY *\tnext;\n\tstruct __MEMLIST_ENTRY *\tprev;\n\tvoid *\t\t\t\t\t\tmem;\n\tULONG\t\t\t\t\t\tsize;\n\tBOOL\t\t\t\t\t\ttrack;\n\tchar\t\t\t\t\t\tfunction[128];\n\tchar\t\t\t\t\t\tfilename[256];\n\tULONG\t\t\t\t\t\tline;\n}*PMEMLIST_ENTRY,MEMLIST_ENTRY;\n\ntypedef struct __MEMLIST\n{\n\tPMEMLIST_ENTRY\t\thead;\n\tPMEMLIST_ENTRY\t\ttail;\n\tvolatile ULONG\t\tspinLock;\n}*PMEMLIST,MEMLIST;\n\n#define MEMLIST_ENTRY_MAGIC\t\t0xBAAD7337\n\nMEMLIST AbpMemList = { 0 };\n\nvoid AcqMemListSpinlock()\n{\n\twhile (InterlockedCompareExchange(&AbpMemList.spinLock, 1, 0) == 1)\n\t\t_mm_pause();\n}\n\nvoid RelMemListSpinlock()\n{\n\tInterlockedExchange(&AbpMemList.spinLock, 0);\n}\n\nbool AbMemReadGuaranteed(duint va, void *dest, duint size)\n{\n bool success = false;\n int limit = TRY_COUNT;\n\n if (!AbHasDebuggingProcess())\n return false;\n\n //Another ugly hack here \n //x64dbg has a bug https://github.com/x64dbg/x64dbg/issues/1475\n while (limit-- != 0)\n {\n if (!DbgMemRead(va, dest, size))\n Sleep(TRY_WAIT_PERCALL);\n else\n {\n success = true;\n break;\n }\n }\n\n return success;\n}\n\n\n\nvoid *_AbMemoryAlloc(int size)\n{\n if (size <= 0)\n return NULL;\n\n return HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, (SIZE_T)size);\n}\n\nvoid *_AbMemoryRealloc(void *memPtr, int newSize)\n{\n if (newSize <= 0)\n return NULL;\n\n if (!memPtr)\n return _AbMemoryAlloc(newSize);\n\n return HeapReAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, memPtr, newSize);\n}\n\nvoid _AbMemoryFree(void *memPtr)\n{\n if (!memPtr)\n return;\n\n HeapFree(GetProcessHeap(), 0, (LPVOID)memPtr);\n}\n\n#ifdef TRACK_MEMORY_ALLOCATIONS\n\nvoid AbRevealPossibleMemoryLeaks()\n{\n\tDBGPRINT(\"Checking for possible leaked memory blocks\");\n\n\tif (!AbpMemList.head)\n\t{\n\t\tDBGPRINT(\"Great! Everything's fine. No leaked memory!\");\n\t\treturn;\n\t}\n\n\tDBGPRINT(\"Oh no. There is a some memory leak.\");\n\n\tfor (PMEMLIST_ENTRY entry = AbpMemList.head; entry != NULL; entry = entry->next)\n\t{\n\t\tDBGPRINT(\"Leaked memory at %p (%d bytes) | %s %s:%d\", entry->mem, entry->size, entry->filename, entry->function, entry->line);\n\t}\n}\n\nvoid *AbMemoryAlloc_DBG(int size, const char *file, const char *func, const int line)\n{\n\tPMEMLIST_ENTRY entry;\n\tPVOID umem;\n\n\tint realSize = size + sizeof(MEMLIST_ENTRY);\n\n\tentry = (PMEMLIST_ENTRY)_AbMemoryAlloc(realSize);\n\n\tif (!entry)\n\t\treturn FALSE;\n\n\tumem = ((BYTE *)entry) + sizeof(MEMLIST_ENTRY);\n\n\tentry->magic = MEMLIST_ENTRY_MAGIC;\n\tentry->next = NULL;\n\tentry->prev = NULL;\n\tentry->mem = umem;\n\tentry->size = size;\n\t\n\tif (file != NULL)\n\t\tstrcpy_s(entry->filename, file);\n\telse\n\t\tstrcpy_s(entry->filename, \"vclib\");\n\t\n\tif (func != NULL)\n\t\tstrcpy_s(entry->function, func);\n\telse\n\t\tstrcpy_s(entry->function, \"unknown\");\n\t\n\tentry->line = line;\n\n\t\n\tAcqMemListSpinlock();\n\n\tif (!AbpMemList.head)\n\t{\n\t\tAbpMemList.head = AbpMemList.tail = entry;\n\t}\n\telse\n\t{\n\t\tentry->prev = AbpMemList.tail;\n\t\tAbpMemList.tail->next = entry;\n\t\tAbpMemList.tail = entry;\n\t}\n\n\tRelMemListSpinlock();\n\n\treturn umem;\n}\n\n#define ASSERT(x) if (!(x)) DBGPRINT(\"Assertation failed. %s\",#x)\n\nvoid dumpNode(PMEMLIST_ENTRY entry)\n{\n\tDBGPRINT(\"ENTRY_DUMP_BEGIN\");\n\tDBGPRINT(\"entry = %p, entry->next = %p, entry->prev = %p\", entry, entry->next, entry->prev);\n\tDBGPRINT(\"entry data: %s %s:%d\", entry->filename, entry->function, entry->line);\n\tDBGPRINT(\"entry->mem = %p\", entry->mem);\n\tDBGPRINT(\"\\n\");\n}\n\nPMEMLIST_ENTRY AbpValidateAndProbe(void *memPtr)\n{\n\tPMEMLIST_ENTRY entry = NULL;\n\tBYTE *realMemAddr = NULL;\n\n\trealMemAddr = ((BYTE *)memPtr) - sizeof(MEMLIST_ENTRY);\n\n\tentry = (PMEMLIST_ENTRY)realMemAddr;\n\n\t__try\n\t{\n\t\tif (entry->magic != MEMLIST_ENTRY_MAGIC)\n\t\t\treturn NULL;\n\n\t\tif (entry->mem != memPtr)\n\t\t\treturn NULL;\n\t}\n\t__except(EXCEPTION_CONTINUE_EXECUTION)\n\t{\n\t\treturn NULL;\n\t}\n\n\treturn entry;\n}\n\nvoid *AbMemoryRealloc_DBG(void *memPtr, int newSize, const char *file, const char *func, const int line)\n{\n\tPMEMLIST_ENTRY entry, oldEntry,prevEntry, nextEntry;\n\tBYTE *realMem, *reallocMem;\n\t\n\tif (!memPtr)\n\t\treturn AbMemoryAlloc_DBG(newSize, file, func, line);\n\t\n\n\tentry = AbpValidateAndProbe(memPtr);\n\n\tif (!entry)\n\t{\n\t\tDBGPRINT(\"Invalid memory address %p\", memPtr);\n\t\treturn NULL;\n\t}\n\n\trealMem = (BYTE *)entry;\n\n\tAcqMemListSpinlock();\n\n\t\n\tprevEntry = entry->prev;\n\tnextEntry = entry->next;\n\n\treallocMem = (BYTE *)AbMemoryRealloc_DBG(realMem, sizeof(MEMLIST_ENTRY) + newSize,file,func,line);\n\n\tif (!reallocMem)\n\t\treturn NULL;\n\t\n\toldEntry = entry;\n\tentry = (PMEMLIST_ENTRY)reallocMem;\n\t\n\tif (entry->track)\n\t\tDBGPRINT(\"reallocating memory %p. old = %p, new = %p (%s:%d)\", entry, entry, reallocMem, entry->filename, entry->line);\n\n\tif (realMem != reallocMem)\n\t{\n\t\tentry->mem = reallocMem + sizeof(MEMLIST_ENTRY);\n\n\t\t//Update previous's next with new allocated node address\n\t\tif (prevEntry)\n\t\t\tprevEntry->next = entry;\n\n\t\t//Update next's previous with new alloacted node address\n\t\tif (nextEntry)\n\t\t\tnextEntry->prev = entry;\n\n\t\t//if oldentry was list's head. we have to also update head\n\t\tif (oldEntry == AbpMemList.head)\n\t\t\tAbpMemList.head = entry;\n\n\t\t//if oldentry was list's tail we have to also update tail\n\t\tif (oldEntry == AbpMemList.tail)\n\t\t\tAbpMemList.tail = entry;\n\n\t}\n\n\tASSERT(entry->prev == prevEntry);\n\tASSERT(entry->next == nextEntry);\n\n\tentry->size = newSize;\n\n\n\tRelMemListSpinlock();\n\n\treturn reallocMem + sizeof(MEMLIST_ENTRY);\n}\n\nvoid AbMemoryFree_DBG(void *memPtr)\n{\n\tPMEMLIST_ENTRY entry;\n\t\n\tif (!memPtr)\n\t\treturn;\n\n\tentry = AbpValidateAndProbe(memPtr);\n\n\tif (!entry)\n\t{\n\t\tDBGPRINT(\"invalid memory %p\", memPtr);\n\t\treturn;\n\t}\n\t\n\tif (entry->track)\n\t\tDBGPRINT(\"%p is being freed\", memPtr);\n\n\tAcqMemListSpinlock();\n\n\tif (entry == AbpMemList.head && entry == AbpMemList.tail)\n\t{\n\t\tAbpMemList.head = AbpMemList.tail = NULL;\n\t}\n\telse if (entry == AbpMemList.head)\n\t{\n\t\tAbpMemList.head = entry->next;\n\n\t\tif (entry->next)\n\t\t\tentry->next->prev = NULL;\n\n\t}\n\telse if (entry == AbpMemList.tail)\n\t{\n\t\tAbpMemList.tail = entry->prev;\n\n\t\tif (entry->prev)\n\t\t\tentry->prev->next = NULL;\n\t}\n\telse\n\t{\n\t\tentry->prev->next = entry->next;\n\t\tentry->next->prev = entry->prev;\n\t}\n\n\tRtlZeroMemory(entry, sizeof(MEMLIST_ENTRY));\n\t_AbMemoryFree(entry);\n\n\tRelMemListSpinlock();\n\n}\n\n//#define SKIP_UNNAMED_ALLOCATION\n\n#ifdef __cplusplus\n\n#if defined(new)\n#undef new \n#endif\n\nvoid *operator new(size_t size, char *func, char *file, int line)\n{\n\treturn AbMemoryAlloc_DBG(size, func, file, line);\n}\n\nvoid *operator new(size_t size)\n{\n#ifdef SKIP_UNNAMED_ALLOCATION\n\treturn malloc(size);\n#else\n\treturn AbMemoryAlloc_DBG(size, NULL, NULL, 0);\n#endif\n}\n\nvoid operator delete(void *memory, char *func, char *file, int line)\n{\n\toperator delete(memory);\n}\n\nvoid operator delete(void *memory)\n{\n\tAbMemoryFree_DBG(memory);\n}\n\n\n#endif\n\n\n#else\nvoid AbRevealPossibleMemoryLeaks()\n{\n\tDBGPRINT(\"Memory allocation tracker disabled.!\");\n}\n#endif\n\nvoid AbTrackMemory_DBG(void *memPtr)\n{\n\tPMEMLIST_ENTRY entry;\n\n\tif (!memPtr)\n\t\treturn;\n\n\tentry = AbpValidateAndProbe(memPtr);\n\n\tif (!entry)\n\t{\n\t\tDBGPRINT(\"invalid memory %p\", memPtr);\n\t\treturn;\n\t}\n\n\tDBGPRINT(\"memory %p will be tracked.\", memPtr);\n\n\tentry->track = TRUE;\n\n}" }, { "path": "x64dbgApiBreak/src/ui/ui.cpp", "content": "#include \n#include \n#include \n\nusing namespace std;\n\n#pragma comment(lib,\"Comctl32.lib\")\n\n#define SWP_FLAG_ONLY_RESIZE (SWP_NOMOVE | SWP_NOREPOSITION | SWP_NOZORDER)\n#define SWP_FLAG_RESIZE_AND_MOVE (SWP_NOREPOSITION | SWP_NOZORDER)\n\n#define PSEUDO_HANDLE_VALUE ((HANDLE)((ULONG_PTR)-2))\n\n#if _DEBUG\n#define UITHREAD_WAIT_TIME INFINITE\n#else\n#define UITHREAD_WAIT_TIME 10 * 1000\n#endif\n\n\n#ifdef _DEBUG\nvolatile UCHAR UiStepTraceEnd = 0;\n#endif\n\ntypedef struct tagIntParam\n{\n\tWORD intParamMagic;\n\tvoid *userParam;\n\tWINDOWCREATIONINFO *wci;\n}INTPARAM;\n\nmap *gp_windowMap;\n\nvoid __UiRaiseDisposeCallback(UIOBJECT *ui);\n\nUIOBJECT *__UiGetMappedUiObject(HWND hwnd)\n{\n\tmap::iterator iter;\n\n\tif (gp_windowMap == NULL)\n\t\treturn NULL;\n\n\titer = gp_windowMap->find(hwnd);\n\n\tif (iter == gp_windowMap->end())\n\t\treturn NULL;\n\n\treturn iter->second;\n}\n\n#define __UiIsMappedHwnd(hwnd) (__UiGetMappedUiObject(hwnd) != NULL)\n\nBOOL __UiMapUiObject(UIOBJECT *uiObj)\n{\n\tif (gp_windowMap == NULL)\n\t{\n\t\tgp_windowMap = new map();\n\t}\n\n\tif (__UiIsMappedHwnd(uiObj->hwnd))\n\t\treturn FALSE;\n\n\tgp_windowMap->insert(make_pair(uiObj->hwnd, uiObj));\n\treturn TRUE;\n}\n\nUIOBJECT *__UiUnmapHwnd(HWND hwnd)\n{\n\tUIOBJECT *uiObj;\n\tmap::iterator iter;\n\n\titer = gp_windowMap->find(hwnd);\n\n\tif (iter == gp_windowMap->end())\n\t\treturn NULL;\n\n\tuiObj = iter->second;\n\n\tgp_windowMap->erase(iter);\n\n\treturn uiObj;\n}\n\n__forceinline PVOID _UiDecodeParamPointer(PVOID param)\n{\n\tINTPARAM *intParam;\n\n\tif (param == NULL)\n\t\treturn NULL;\n\n\tintParam = (INTPARAM *)param;\n\n\tif (intParam->intParamMagic == 0x4950)\n\t{\n\t\treturn intParam->userParam;\n\t}\n\n\treturn param;\n}\n\nvoid __UiRaiseDisposeCallback(UIOBJECT *ui)\n{\n\tif (ui->uiDisposer)\n\t\tui->uiDisposer();\n}\n\nBOOL UipWaitUiThreadUntilExit(HANDLE thread)\n{\n\tHANDLE realHandle;\n\n\tif (thread == PSEUDO_HANDLE_VALUE)\n\t{\n\t\t//If thread has pseudo handle. We must convert \n\t\t//to real handle using DuplicateHandle\n\t\tif (!DuplicateHandle(\n\t\t\tGetCurrentProcess(),\n\t\t\tthread,\n\t\t\tGetCurrentProcess(), &realHandle, 0, FALSE, DUPLICATE_SAME_ACCESS)\n\t\t\t)\n\t\t{\n\t\t\treturn FALSE;\n\t\t}\n\t}\n\telse\n\t\trealHandle = thread;\n\n\tif (WaitForSingleObject(realHandle, UITHREAD_WAIT_TIME) == WAIT_OBJECT_0)\n\t\tCloseHandle(realHandle);\n\t//else, the ui thread is also using for another job.\n\n\treturn TRUE;\n}\n\nINT_PTR CALLBACK _UiMainWndProc(HWND hwnd, UINT Msg, WPARAM wParam, LPARAM lParam)\n{\n\tINITCOMMONCONTROLSEX icc;\n\tINT_PTR ret;\n\tUIOBJECT *uiObject = __UiGetMappedUiObject(hwnd);\n\tPVOID validParam = NULL;\n\n\tif (uiObject != NULL)\n\t\tvalidParam = _UiDecodeParamPointer(uiObject->param);\n\n\tswitch (Msg)\n\t{\n\tcase WM_INITDIALOG:\n\t{\n\t\tuiObject = (UIOBJECT *)lParam;\n\t\tuiObject->hwnd = hwnd;\n\n\t\t__UiMapUiObject(uiObject);\n\n\t\tvalidParam = _UiDecodeParamPointer(uiObject->param);\n\n\t\ticc.dwSize = sizeof(INITCOMMONCONTROLSEX);\n\t\ticc.dwICC = ICC_STANDARD_CLASSES;\n\t\tInitCommonControlsEx(&icc);\n\n\t\tret = uiObject->dlgProc(hwnd, Msg, wParam, lParam, validParam);\n\n\t\treturn ret;\n\t}\n\tbreak;\n\tcase WM_CLOSE:\n\t{\n\t\tret = uiObject->dlgProc(hwnd, Msg, wParam, lParam, validParam);\n\t\tuiObject->result = 0;\n\t\tDestroyWindow(hwnd); //Dispatch WM_DESTROY\n\t\treturn ret;\n\t}\n\tbreak;\n\tcase WM_DESTROY:\n\t{\n\t\tuiObject->isUiOutside = FALSE;\n\t\tPostQuitMessage(0);\n\t\treturn 0;\n\t}\n\tbreak;\n\tdefault:\n\t{\n\t\tif (!uiObject)\n\t\t\treturn FALSE;\n\t}\n\t}\n\n\n\treturn uiObject->dlgProc(hwnd, Msg, wParam, lParam, validParam);\n}\n\n//We need unicode resource\n#undef RT_DIALOG\n#define RT_DIALOG MAKEINTRESOURCEW(5)\n\nLPCDLGTEMPLATEW IntUiGetDialogTemplate(UINT dlgResourceId)\n{\n\tHRSRC res;\n\tHGLOBAL templ;\n\n\tres = FindResourceW(AbPluginModule, MAKEINTRESOURCEW(dlgResourceId), RT_DIALOG);\n\n\tif (res == NULL)\n\t{\n\t\tDBGPRINT(\"dlg res not found\");\n\t\treturn NULL;\n\t}\n\n\ttempl = LoadResource(AbPluginModule, res);\n\n\treturn (LPCDLGTEMPLATE)templ;\n}\n\nVOID IntUiResizeAndLocateWindow(HWND hwnd, PRECREATEWINDOWINFO *pci)\n{\n\tSIZE referenceSize;\n\tRECT wndRc;\n\tUINT swpFlag = SWP_NOZORDER | SWP_NOOWNERZORDER | SWP_NOMOVE | SWP_NOSIZE;\n\n\tint sysScrWidth, sysScrHeight;\n\n\tsysScrWidth = GetSystemMetrics(SM_CXSCREEN);\n\tsysScrHeight = GetSystemMetrics(SM_CYSCREEN);\n\n\tif (pci->wri.flag & WRIF_SIZE)\n\t{\n\t\tswpFlag &= ~SWP_NOSIZE;\n\t\treferenceSize = pci->wri.size;\n\t}\n\telse\n\t{\n\t\tGetWindowRect(hwnd, &wndRc);\n\n\t\treferenceSize.cx = wndRc.right - wndRc.left;\n\t\treferenceSize.cy = wndRc.bottom - wndRc.top;\n\t}\n\n\tif (pci->wri.flag & WRIF_LOCATION)\n\t{\n\t\tswpFlag &= ~SWP_NOMOVE;\n\t}\n\n\tif (pci->wri.flag & WRIF_CENTER)\n\t{\n\t\tif (swpFlag & SWP_NOMOVE)\n\t\t\tswpFlag &= ~SWP_NOMOVE;\n\n\t\tpci->wri.point.x = (sysScrWidth / 2) - (referenceSize.cx / 2);\n\t\tpci->wri.point.y = (sysScrHeight / 2) - (referenceSize.cy / 2);\n\t}\n\n\tSetWindowPos(\n\t\thwnd, NULL,\n\t\tpci->wri.point.x,\n\t\tpci->wri.point.y,\n\t\treferenceSize.cx,\n\t\treferenceSize.cy,\n\t\tswpFlag);\n\n}\n\nDWORD WINAPI IntUiWorker(VOID *Arg)\n{\n\tMSG msg;\n\tINTPARAM *internParam;\n\tUIOBJECT *uiObj = (UIOBJECT *)Arg;\n\tWINDOWCREATIONINFO *wciPtr = NULL;\n\n\tuiObj->isUiOutside = TRUE;\n\n\n\tinternParam = (INTPARAM *)uiObj->param;\n\n\tuiObj->hwnd = CreateDialogIndirectParamW(GetModuleHandle(NULL),\n\t\tIntUiGetDialogTemplate(uiObj->dlgResourceId),\n\t\tuiObj->parentWnd,\n\t\t(DLGPROC)_UiMainWndProc,\n\t\t(LPARAM)uiObj);\n\n\tif (internParam->wci != NULL)\n\t{\n\t\twciPtr = internParam->wci;\n\t}\n\n\n\tif (wciPtr)\n\t{\n\t\tif (wciPtr->pci != NULL)\n\t\t\tIntUiResizeAndLocateWindow(uiObj->hwnd, wciPtr->pci);\n\t}\n\n\tInterlockedExchangePointer((volatile PVOID *)&uiObj->param, internParam->userParam);\n\n\tFREEOBJECT(internParam);\n\n\tuiObj->isRunning = TRUE;\n\tSetEvent(uiObj->uiEvent);\n\n\tShowWindow(uiObj->hwnd, SW_NORMAL);\n\n#ifdef _DEBUG\n\tif (IsDebuggerPresent())\n\t\tUiStepTraceEnd = 1;\n#endif\n\n\t//Enter UI Message Loop\n\n\twhile (GetMessageW(&msg, NULL, 0, 0))\n\t{\n\t\tTranslateMessage(&msg);\n\t\tDispatchMessageW(&msg);\n\t}\n\n\tuiObj->isRunning = FALSE;\n\n\t//Post fake WM_QUIT message\n\tuiObj->dlgProc(uiObj->hwnd, WM_QUIT, 0, 0, _UiDecodeParamPointer(uiObj->param));\n\n\t__UiUnmapHwnd(uiObj->hwnd);\n\n\t__UiRaiseDisposeCallback(uiObj);\n\n\tif (uiObj->seperateThread)\n\t{\n\t\tUiReleaseObject(uiObj);\n\t}\n\n\tDBGPRINT(\"Ui thread exited %x (%d)\", GetCurrentThreadId(), GetCurrentThreadId());\n\n\treturn 0;\n}\n\n\nBOOL IntUiCreateDialog(UIOBJECT *uiObj)\n{\n\tDWORD tid;\n\n\tuiObj->uiEvent = CreateEventW(NULL, FALSE, FALSE, NULL);\n\n\n\tif (uiObj->seperateThread)\n\t{\n\t\tuiObj->uiThread = CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)IntUiWorker, uiObj, 0, &tid);\n\t\tuiObj->uiThreadId = tid;\n\n\t\tDBGPRINT(\"Ui worker thread id: %d\", tid);\n\n\t}\n\telse\n\t{\n\t\tuiObj->uiThread = GetCurrentThread();\n\t\tuiObj->uiThreadId = GetCurrentThreadId();\n\t\tIntUiWorker(uiObj);\n\t}\n\n\tif (WaitForSingleObject(uiObj->uiEvent, 30 * 1000) == WAIT_TIMEOUT)\n\t{\n\n#ifdef _DEBUG\n\t\tif (IsDebuggerPresent())\n\t\t{\n\t\t\t//Stall until debug step finished\n\t\t\twhile (!UiStepTraceEnd)\n\t\t\t\tSleep(1);\n\t\t}\n\t\telse\n\t\t\t__debugbreak();\n#else\n\t\t__debugbreak();\n#endif\n\t}\n\n\n\tCloseHandle(uiObj->uiEvent);\n\n\treturn uiObj->uiThread != NULL;\n}\n\nBOOL UiIsRunning(UIOBJECT *ui)\n{\n\tif (!ui)\n\t\treturn FALSE;\n\n\treturn ui->isRunning;\n}\n\nVOID UiRegisterDisposer(UIOBJECT *uiObject, UIAFTEREXITDISPOSER disposer)\n{\n\tuiObject->uiDisposer = disposer;\n}\n\nUIOBJECT *UiCreateDialog(\n\tUIDLGPROC dlgProc,\n\tHWND parentWnd,\n\tUINT dialogResourceId,\n\tBOOL seperateThread,\n\tPVOID param,\n\tWINDOWCREATIONINFO *wci,\n\tBOOL *wasSucceeded)\n{\n\tUIOBJECT *uiObject = NULL;\n\tINTPARAM *internParam;\n\n\tif (!wasSucceeded)\n\t\treturn NULL;\n\n\tuiObject = ALLOCOBJECT(UIOBJECT);\n\tuiObject->dlgResourceId = dialogResourceId;\n\tuiObject->seperateThread = seperateThread;\n\tuiObject->parentWnd = parentWnd;\n\n\tinternParam = ALLOCOBJECT(INTPARAM);\n\n\tinternParam->intParamMagic = 0x4950;\n\tinternParam->wci = wci;\n\tinternParam->userParam = param;\n\n\tuiObject->param = internParam;\n\tuiObject->dlgProc = dlgProc;\n\n\tif (IntUiCreateDialog(uiObject) == FALSE)\n\t{\n\t\tif (!seperateThread)\n\t\t\t*wasSucceeded = FALSE;\n\n\t\tUiReleaseObject(uiObject);\n\t\treturn NULL;\n\t}\n\n\tif (!uiObject->seperateThread)\n\t{\n\t\t*wasSucceeded = TRUE;\n\t\tUiReleaseObject(uiObject);\n\t\treturn NULL;\n\t}\n\n\treturn uiObject;\n}\n\nvoid UipGetWinVer(LPOSVERSIONINFOA lposv)\n{\n //Microsoft has deprecated the version getting API's a while ago.\n //And introduced some stupid version helper APIs\n //like IsWindowsXPOrGreater. I dont need that shit.\n //We are still need the GetVersionXXX API's for backward\n //compability.\n\n lposv->dwOSVersionInfoSize = sizeof(OSVERSIONINFOA);\n \n //Shit I'm bored of typedef declaration for the API procs.\n //Thats why I did it.\n ((BOOL (WINAPI *)(LPOSVERSIONINFOA))\n GetProcAddress(GetModuleHandleA(\"kernel32.dll\"), \"GetVersionExA\"))(lposv);\n\n}\n\nBOOL UipIsServer2003XpOrEarlier()\n{\n OSVERSIONINFOA osw;\n UipGetWinVer(&osw);\n\n //No needed to check minor version. \n return osw.dwMajorVersion <= 5;\n}\n\nBOOL UiDrawStringA(HDC dc, LPCSTR text, FLOAT x, FLOAT y, COLORREF forecolor, COLORREF backcolor)\n{\n RECT rc;\n SIZE textSize;\n HFONT font;\n HGDIOBJ obj;\n LOGFONTA logFont;\n NONCLIENTMETRICSA ncm;\n \n if (!dc)\n return FALSE;\n\n ncm.cbSize = sizeof(NONCLIENTMETRICSA);\n\n //https://msdn.microsoft.com/en-us/library/windows/desktop/ff729175.aspx\n //See remarks section\n if (UipIsServer2003XpOrEarlier())\n ncm.cbSize -= sizeof(ncm.iPaddedBorderWidth);\n\n SystemParametersInfoA(SPI_GETNONCLIENTMETRICS, ncm.cbSize, &ncm, 0);\n \n memcpy(&logFont, &ncm.lfMessageFont, sizeof(LOGFONTA));\n\n logFont.lfWeight = FW_BOLD;\n\n font = CreateFontIndirectA(&logFont);\n\n SetTextColor(dc, forecolor);\n obj = SelectObject(dc, font);\n\n GetTextExtentPoint32A(dc, text, strlen(text), &textSize);\n\n rc.left = x;\n rc.top = y;\n rc.right = textSize.cx;\n rc.bottom = textSize.cy;\n\n DrawTextA(dc, text, -1, &rc , DT_SINGLELINE | DT_LEFT);\n\n SelectObject(dc, obj);\n\n DeleteObject(font);\n\n return TRUE;\n}\n\nvoid UiReleaseObject(UIOBJECT *ui)\n{\n\tif (!ui)\n\t\treturn;\n\n\tRtlZeroMemory(ui, sizeof(UIOBJECT));\n\tFREEOBJECT(ui);\n}\n\n\n\nBOOL UiDestroyDialog(UIOBJECT *ui)\n{\n\tHANDLE uiThread = NULL;\n\tBOOL success = FALSE;\n\n\t//Who called?\n\tif (ui->isUiOutside)\n\t{\n\t\tui->isUiOutside = FALSE;\n\n\t\t//we must wait only async destroy request to avoid from a deadlock \n\t\tif (ui->uiThreadId != GetCurrentThreadId())\n\t\t\tuiThread = ui->uiThread;\n\n\t\t//Hmm. This function called from outside of UIMgr\n\t\t//Post close message and wait WM_DESTROY\n\t\tsuccess = PostMessage(ui->hwnd, WM_CLOSE, 0, 0);\n\t}\n\t//else, the destroy message already initiated.\n\n\tif (uiThread != NULL)\n\t{\n\t\tsuccess = UipWaitUiThreadUntilExit(uiThread);\n\t}\n\n\treturn success;\n}\n\nvoid UiForceCloseAllActiveWindows()\n{\n\tmap::iterator it;\n\tUIOBJECT *uiObj = NULL;\n\n\tif (!gp_windowMap)\n\t\treturn;\n\n\tif (gp_windowMap->size() == 0)\n\t\treturn;\n\n\twhile (gp_windowMap->size() > 0)\n\t{\n\t\tit = gp_windowMap->begin();\n\t\tuiObj = it->second;\n\n\t\tUiDestroyDialog(uiObj);\n\t}\n}\n" }, { "path": "x64dbgApiBreak/src/util.cpp", "content": "#include \n#include \n\n#pragma comment(lib,\"Winhttp.lib\")\n\nBOOL UtlpExtractPassedParameters(PPASSED_PARAMETER_CONTEXT paramInfo, BOOL ipOnStack)\n{\n REGDUMP *regs;\n duint *paramList;\n duint csp, offset;\n\n paramInfo->paramList = (duint *)AbMemoryAlloc(paramInfo->paramCount * sizeof(duint));\n\n if (!paramInfo->paramList)\n return FALSE;\n\n regs = ¶mInfo->regCtx;\n paramList = paramInfo->paramList;\n \n#ifdef _WIN64\n\n if (paramInfo->convention != Fastcall)\n {\n paramInfo->convention = Fastcall;\n DBGPRINT(\"Calling convention revert to fastcall on Win64\");\n }\n\n csp = regs->regcontext.csp;\n\n offset = 0x20;\n\n if (ipOnStack)\n offset += sizeof(duint);\n\n for (int i = 0;i < paramInfo->paramCount;i++)\n {\n switch (i)\n {\n case 0:\n paramList[0] = regs->regcontext.ccx;\n break;\n case 1:\n paramList[1] = regs->regcontext.cdx;\n break;\n case 2:\n paramList[2] = regs->regcontext.r8;\n break;\n case 3:\n paramList[3] = regs->regcontext.r9;\n break;\n }\n\n if (i > 3)\n {\n AbMemReadGuaranteed(csp + offset, ¶mList[i], sizeof(duint));\n offset += sizeof(duint);\n }\n }\n\n#else\n csp = regs->regcontext.csp;\n offset = 0;\n\n if (ipOnStack)\n offset = sizeof(duint);\n\n for (int i = 0;i < paramInfo->paramCount;i++)\n {\n AbMemReadGuaranteed(csp + offset, ¶mList[i], sizeof(duint));\n offset += sizeof(duint);\n }\n\n#endif\n\n return TRUE;\n}\n\n\n\nBOOL DmaCreateAdapter(WORD sizeOfType, ULONG initialCount, PDMA *dma)\n{\n PDMA pdma = NULL;\n\n pdma = ALLOCOBJECT(DMA);\n\n if (!pdma)\n return FALSE;\n\n pdma->sizeOfType = sizeOfType;\n pdma->count = initialCount;\n pdma->totalSize = sizeOfType * initialCount;\n pdma->writeBoundary = 0;\n pdma->memory = AbMemoryAlloc(pdma->totalSize);\n\n\n if (!pdma->memory)\n {\n DBGPRINT(\"Dma memory alloc fail\");\n FREEOBJECT(pdma);\n return FALSE;\n }\n\n InitializeCriticalSection(&pdma->areaGuard);\n pdma->needsSynchronize = FALSE;\n pdma->ownershipTaken = FALSE;\n\n *dma = pdma;\n\n return TRUE;\n}\n\nBOOL DmaWriteNeedsExpand(PDMA dma, ARCHWIDE needByteSize, ULONG writeBeginOffset, BOOL autoIssue)\n{\n BOOL needed;\n\n if (writeBeginOffset == DMA_AUTO_OFFSET)\n writeBeginOffset = dma->writeBoundary;\n\n needed = needByteSize > dma->totalSize - writeBeginOffset;\n\n if (needed && autoIssue)\n DmaIssueExpansion(dma, needByteSize / dma->sizeOfType);\n\n return needed;\n}\n\n\n\nBOOL DmaIssueExpansion(PDMA dma, LONG expansionDelta)\n{\n BOOL isReducing = expansionDelta < 0;\n\n if (isReducing && dma->totalSize + expansionDelta < dma->writeBoundary)\n return FALSE;\n\n EnterCriticalSection(&dma->areaGuard);\n InterlockedCompareExchange((volatile LONG *)&dma->needsSynchronize, TRUE, FALSE);\n\n dma->memory = AbMemoryRealloc(dma->memory, (dma->count + expansionDelta) * dma->sizeOfType);\n dma->count += expansionDelta;\n dma->totalSize = dma->count * dma->sizeOfType;\n\n InterlockedCompareExchange((volatile LONG *)&dma->needsSynchronize, FALSE, TRUE);\n LeaveCriticalSection(&dma->areaGuard);\n\n\n return TRUE;\n}\n\n#define DmapNeedsSynch(pdma) InterlockedCompareExchange((volatile LONG *)&pdma->needsSynchronize, FALSE, FALSE)\n\n#define DmapIsAccessValid(pdma, addr, size) (addr + size <= dma->totalSize && !dma->ownershipTaken)\n\nBOOL DmapMemIo(PDMA dma, ULONG offset, ARCHWIDE size, void *mem, BOOL write)\n{\n ARCHWIDE realAddr;\n ULONG requiredCount;\n void *source, *dest;\n\n if (offset == DMA_AUTO_OFFSET)\n offset = dma->writeBoundary;\n\n requiredCount = (size / dma->sizeOfType) + 1;\n\n if (write && dma->oldProtect != 0)\n {\n if (!VirtualProtectEx(GetCurrentProcess(), dma->memory, dma->totalSize, dma->oldProtect, &dma->oldProtect))\n return FALSE;\n\n dma->oldProtect = 0;\n }\n\n if (write && offset + size > dma->totalSize)\n {\n if (!DmaIssueExpansion(dma, requiredCount + (dma->count / 3)))\n return FALSE;\n }\n\n realAddr = ((ARCHWIDE)dma->memory) + offset;\n\n if (write)\n {\n source = (void *)mem;\n dest = (void *)realAddr;\n }\n else\n {\n source = (void *)realAddr;\n dest = (void *)mem;\n }\n\n \n if (!DmapIsAccessValid(dma, offset, size))\n return FALSE;\n\n memcpy(dest, source, size);\n\n if (write)\n {\n if (offset + size > dma->writeBoundary)\n dma->writeBoundary = offset + size;\n }\n\n return TRUE;\n}\n\nBOOL DmaRead(PDMA dma, ULONG offset, ARCHWIDE size, void *destMemory)\n{\n BOOL success;\n BOOL owned = FALSE;\n\n if (DmapNeedsSynch(dma))\n {\n EnterCriticalSection(&dma->areaGuard);\n owned = TRUE;\n }\n\n success = DmapMemIo(dma, offset, size, destMemory,FALSE);\n\n if (owned)\n LeaveCriticalSection(&dma->areaGuard);\n\n return success;\n\n}\n\nBOOL DmaWrite(PDMA dma, ULONG offset, ARCHWIDE size, void *srcMemory)\n{\n BOOL success;\n BOOL owned = FALSE;\n\n if (DmapNeedsSynch(dma))\n {\n EnterCriticalSection(&dma->areaGuard);\n owned = TRUE;\n }\n\n success = DmapMemIo(dma, offset, size, srcMemory,TRUE);\n\n if (owned)\n LeaveCriticalSection(&dma->areaGuard);\n\n return success;\n}\n\nBOOL DmaStringWriteA(PDMA dma, LPCSTR format, ...)\n{\n BOOL success = FALSE;\n LPSTR buffer = NULL;\n LONG len = 0;\n va_list va;\n va_start(va, format);\n\n len = HlpPrintFormatBufferExA(&buffer, format, va);\n\n if (len > 0)\n {\n success = DmaWrite(dma, DMA_AUTO_OFFSET, len * sizeof(char), buffer);\n FREESTRING(buffer);\n }\n\n va_end(va);\n\n return success;\n}\n\nBOOL DmaStringWriteW(PDMA dma, LPCWSTR format, ...)\n{\n BOOL success = FALSE;\n LPWSTR buffer = NULL;\n LONG len = 0;\n va_list va;\n va_start(va, format);\n\n len = HlpPrintFormatBufferExW(&buffer, format, va);\n\n if (len > 0)\n {\n success = DmaWrite(dma, DMA_AUTO_OFFSET, len * sizeof(wchar_t), buffer);\n FREESTRING(buffer);\n }\n\n va_end(va);\n\n return success;\n}\n\nBOOL DmaReadTypeAlignedSequence(PDMA dma, ULONG index, ULONG count, void *destMemory)\n{\n ARCHWIDE offset,size;\n\n if (!dma)\n return FALSE;\n\n offset = index * dma->sizeOfType;\n size = count * dma->sizeOfType;\n\n return DmaRead(dma, offset, size, destMemory);\n}\n\nBOOL DmaCopyWrittenMemory(PDMA dma, void **destMemory, BOOL allocForDest)\n{\n if (allocForDest)\n *destMemory = AbMemoryAlloc(dma->writeBoundary);\n\n if (!*destMemory)\n return FALSE;\n\n memcpy(*destMemory, dma->memory, dma->writeBoundary);\n\n return TRUE;\n}\n\nBOOL DmaTakeMemoryOwnership(PDMA dma, void **nativeMem)\n{\n if (dma->ownershipTaken)\n return FALSE;\n\n *nativeMem = dma->memory;\n dma->ownershipTaken = TRUE;\n\n return TRUE;\n}\n\nBOOL DmaPrepareForDirectWrite(PDMA dma, ULONG writeOffset, ARCHWIDE writeSize, void **nativeMem)\n{\n if (dma->UnsafeWriteCheckInfo.offset)\n return FALSE;\n\n if (!DmapIsAccessValid(dma, writeOffset, writeSize))\n return FALSE;\n\n /*\n dma->UnsafeWriteCheckInfo.offset = writeOffset;\n dma->UnsafeWriteCheckInfo.size = writeSize;\n\n if (writeOffset < sizeof(ULONG))\n {\n }\n\n */\n\n NOTIMPLEMENTED();\n\n return FALSE;\n}\n\nvoid DmaGetAdapterInfo(PDMA dma, ARCHWIDE *writtenSize, ARCHWIDE *totalSize)\n{\n if (!dma)\n return;\n\n if (writtenSize)\n *writtenSize = dma->writeBoundary;\n\n if (totalSize)\n *totalSize = dma->totalSize;\n\n}\n\nvoid DmaEndDirectWrite(PDMA dma)\n{\n NOTIMPLEMENTED();\n}\n\nBOOL DmaPrepareForRead(PDMA dma, void **nativeMem)\n{\n\t//For now, let the caller get the memory as is.\n\tBOOL success = true; \n\n if (success)\n *nativeMem = dma->memory;\n\n return success;\n}\n\nBOOL DmaSink(PDMA dma)\n{\n if (!dma)\n return FALSE;\n\n if (dma->ownershipTaken)\n return FALSE;\n\n if (dma->oldProtect != 0)\n {\n VirtualProtectEx(GetCurrentProcess(), dma->memory, dma->totalSize, dma->oldProtect, &dma->oldProtect);\n dma->oldProtect = 0;\n }\n\n memset(dma->memory, 0, dma->writeBoundary);\n\n dma->writeBoundary = 0;\n\n return TRUE;\n}\n\nvoid DmaDestroyAdapter(PDMA dma)\n{\n if (!dma)\n return;\n\n if (dma->oldProtect != 0)\n VirtualProtectEx(GetCurrentProcess(), dma->memory, dma->totalSize, dma->oldProtect, &dma->oldProtect);\n\n if (!dma->ownershipTaken)\n AbMemoryFree(dma->memory);\n\n memset(dma, 0, sizeof(DMA));\n\n AbMemoryFree(dma);\n\n}\n\n//UTILITY FUNCS\n\n\nBOOL UtlExtractPassedParameters(USHORT paramCount, CALLCONVENTION callConv, REGDUMP *regdump, BOOL ipOnStack, PPASSED_PARAMETER_CONTEXT *paramInfo)\n{\n PPASSED_PARAMETER_CONTEXT ppi = NULL;\n\n ppi = ALLOCOBJECT(PASSED_PARAMETER_CONTEXT);\n\n if (!ppi)\n return FALSE;\n\n ppi->paramCount = paramCount;\n ppi->convention = callConv;\n\n memcpy(&ppi->regCtx, regdump, sizeof(REGDUMP));\n\n if (!UtlpExtractPassedParameters(ppi,ipOnStack))\n {\n FREEOBJECT(ppi);\n return FALSE;\n }\n\n *paramInfo = ppi;\n\n return TRUE;\n}\n\nduint UtlGetCallerAddress(REGDUMP *regdump)\n{\n int limit = 20;\n BASIC_INSTRUCTION_INFO inst = { 0 };\n duint callerIp;\n duint sp;\n\n sp = (duint)regdump->regcontext.csp;\n\n AbMemReadGuaranteed(sp, &callerIp, sizeof(duint));\n\n //Prevent to getting next call as previous caller\n callerIp--;\n limit = 20;\n\n while (!(inst.call && inst.branch))\n {\n DbgDisasmFastAt(callerIp, &inst);\n callerIp--;\n\n if (limit-- <= 0)\n {\n callerIp = 0;\n break;\n }\n }\n\n if (callerIp > 0)\n {\n callerIp++;\n DBGPRINT(\"Caller of this API at %p\", callerIp);\n\n return callerIp;\n }\n\n DBGPRINT(\"Cant find caller ip\");\n\n return 0;\n}\n\nBOOL UtlInternetReadA(LPCSTR url, BYTE **content, ULONG *contentLength)\n{\n BOOL result;\n LPWSTR urlW = HlpAnsiToWideString(url);\n\n if (!urlW)\n return FALSE;\n\n result = UtlInternetReadW(urlW, content, contentLength);\n\n FREESTRING(urlW);\n \n return result;\n}\n\nBOOL UtlInternetReadW(LPCWSTR url, BYTE **content, ULONG *contentLength)\n{\n HINTERNET session=NULL, connection=NULL, reqHandle=NULL;\n INTERNET_PORT port;\n BOOL result;\n DWORD reqFlag = WINHTTP_FLAG_REFRESH;\n DWORD availData = 0, readData = 0, totalReadSize = 0;\n PDMA dma;\n BYTE *readBuffer = NULL;\n DWORD readbufSize = 0x1000;\n URL_COMPONENTS urlComp;\n WCHAR hostName[128], objectName[64];\n\n port = HlpBeginsWithW(url, L\"https\", TRUE, 5) ? 443 : 80;\n\n if (port == 443)\n reqFlag |= WINHTTP_FLAG_SECURE;\n\n session = WinHttpOpen(\n L\"Mozilla/5.0 (Windows NT 10.0; WOW64; rv:51.0) Gecko/20100101 Firefox/51.0\",\n WINHTTP_ACCESS_TYPE_NO_PROXY,\n NULL,\n NULL,\n 0\n );\n\n\n if (!session)\n return FALSE;\n\n // Specify an HTTP server.\n\n memset(&urlComp, 0, sizeof(urlComp));\n\n urlComp.dwHostNameLength = (DWORD)-1;\n urlComp.lpszHostName = hostName;\n\n urlComp.dwUrlPathLength = (DWORD)-1;\n urlComp.lpszUrlPath = objectName;\n\n urlComp.dwStructSize = sizeof(urlComp);\n\n WinHttpCrackUrl(url, wcslen(url), 0, &urlComp);\n\n connection = WinHttpConnect(session, hostName, port, 0);\n\n if (!connection)\n goto exit;\n\n // Create an HTTP request handle.\n reqHandle = WinHttpOpenRequest(connection, L\"GET\", objectName,\n NULL, WINHTTP_NO_REFERER,\n WINHTTP_DEFAULT_ACCEPT_TYPES,\n reqFlag);\n\n if (!reqHandle)\n goto exit;\n\n result = WinHttpSendRequest(reqHandle,\n WINHTTP_NO_ADDITIONAL_HEADERS,\n 0, WINHTTP_NO_REQUEST_DATA, 0,\n 0, 0);\n\n if (!result)\n goto exit;\n\n result = WinHttpReceiveResponse(reqHandle, NULL);\n\n if (!result)\n goto exit;\n\n if (!DmaCreateAdapter(sizeof(BYTE), 0x1000, &dma))\n goto exit;\n\n readBuffer = (BYTE *)AbMemoryAlloc(readbufSize);\n\n while(1)\n {\n if (!WinHttpQueryDataAvailable(reqHandle, &availData))\n break;\n\n if (!availData)\n break;\n\n if (availData > readbufSize)\n {\n readBuffer = (BYTE *)AbMemoryRealloc(readBuffer, readbufSize + 0x1000);\n readbufSize += 0x1000;\n\n }\n\n if (WinHttpReadData(reqHandle, readBuffer, availData, &readData))\n {\n DmaWrite(dma, DMA_AUTO_OFFSET, readData, readBuffer);\n *readBuffer = 0;\n totalReadSize += readData;\n }\n\n\n }\n\n\n AbMemoryFree(readBuffer);\n\nexit:\n if (reqHandle) WinHttpCloseHandle(reqHandle);\n if (connection) WinHttpCloseHandle(connection);\n if (session) WinHttpCloseHandle(session);\n\n if (totalReadSize > 0)\n {\n DmaTakeMemoryOwnership(dma, (void **)content);\n *contentLength = totalReadSize;\n }\n \n DmaDestroyAdapter(dma);\n\n return totalReadSize > 0;\n}" }, { "path": "x64dbgApiBreak/x64dbgApiBreak.vcxproj", "content": "\n\n \n \n Debug\n Win32\n \n \n Release\n Win32\n \n \n Debug\n x64\n \n \n Release\n x64\n \n \n \n {3E482A12-6BE2-4B4A-AE41-A5D652C92E4F}\n Win32Proj\n x64dbgApiBreak\n 8.1\n \n \n \n DynamicLibrary\n true\n v120_xp\n Unicode\n \n \n DynamicLibrary\n false\n v120_xp\n true\n Unicode\n \n \n DynamicLibrary\n true\n v120_xp\n Unicode\n \n \n DynamicLibrary\n false\n v120_xp\n true\n Unicode\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n true\n $(ProjectDir)src\\incl;$(ProjectDir);$(IncludePath)\n $(ProjectDir)src\\incl;$(LibraryPath)\n $(SourcePath)\n .dp32\n \n \n true\n $(ProjectDir)src\\incl;$(ProjectDir);$(IncludePath)\n $(ProjectDir)src\\incl;$(LibraryPath)\n $(SourcePath)\n .dp64\n \n \n false\n $(ProjectDir)src\\incl;$(ProjectDir);$(IncludePath)\n $(ProjectDir)src\\incl;$(LibraryPath)\n $(SourcePath)\n .dp32\n \n \n false\n $(ProjectDir)src\\incl;$(ProjectDir);$(IncludePath)\n $(ProjectDir)src\\incl;$(LibraryPath)\n $(ProjectDir)\\src\\incl;$(SourcePath)\n .dp64\n \n \n \n \n \n Level3\n Disabled\n WIN32;_DEBUG;_WINDOWS;_USRDLL;X64DBGAPIBREAK_EXPORTS;%(PreprocessorDefinitions)\n \n \n Windows\n true\n \n \n \n \n \n \n \n \n \n \n Level3\n Disabled\n _DEBUG;_WINDOWS;_USRDLL;X64DBGAPIBREAK_EXPORTS;%(PreprocessorDefinitions)\n \n \n Windows\n true\n \n \n \n \n \n \n \n \n Level3\n \n \n MaxSpeed\n true\n true\n WIN32;NDEBUG;_WINDOWS;_USRDLL;X64DBGAPIBREAK_EXPORTS;%(PreprocessorDefinitions)\n \n \n Windows\n true\n true\n false\n \n \n \n \n \n \n \n \n Level3\n \n \n MaxSpeed\n true\n true\n NDEBUG;_WINDOWS;_USRDLL;X64DBGAPIBREAK_EXPORTS;%(PreprocessorDefinitions)\n \n \n Windows\n true\n true\n false\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n $(ProjectDir)src\\incl;%(AdditionalIncludeDirectories)\n $(ProjectDir)src\\incl;%(AdditionalIncludeDirectories)\n \n \n \n \n \n \n \n \n \n" }, { "path": "x64dbgApiBreak/x64dbgApiBreak.vcxproj.filters", "content": "\n\n \n \n {4FC737F1-C7A5-4376-A066-2A32D752A2FF}\n cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx\n \n \n {93995380-89BD-4b04-88EB-625FBE52EBFB}\n h;hh;hpp;hxx;hm;inl;inc;xsd\n \n \n {67DA6AB6-F800-4c08-8B7A-83BB121AAD01}\n rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms\n \n \n \n \n Header Files\n \n \n Header Files\n \n \n Header Files\n \n \n Header Files\n \n \n Header Files\n \n \n Header Files\n \n \n Header Files\n \n \n Header Files\n \n \n Header Files\n \n \n Header Files\n \n \n Header Files\n \n \n Header Files\n \n \n Header Files\n \n \n Header Files\n \n \n Header Files\n \n \n Header Files\n \n \n Header Files\n \n \n Header Files\n \n \n Header Files\n \n \n \n \n Source Files\n \n \n Source Files\n \n \n Source Files\n \n \n Source Files\n \n \n Source Files\n \n \n Source Files\n \n \n Source Files\n \n \n Source Files\n \n \n Source Files\n \n \n Source Files\n \n \n Source Files\n \n \n Source Files\n \n \n \n \n Resource Files\n \n \n" }, { "path": "x64dbgApiBreak.sln", "content": "\nMicrosoft Visual Studio Solution File, Format Version 12.00\n# Visual Studio 14\nVisualStudioVersion = 14.0.25420.1\nMinimumVisualStudioVersion = 10.0.40219.1\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"x64dbgApiBreak\", \"x64dbgApiBreak\\x64dbgApiBreak.vcxproj\", \"{3E482A12-6BE2-4B4A-AE41-A5D652C92E4F}\"\nEndProject\nGlobal\n\tGlobalSection(SolutionConfigurationPlatforms) = preSolution\n\t\tDebug|x64 = Debug|x64\n\t\tDebug|x86 = Debug|x86\n\t\tRelease|x64 = Release|x64\n\t\tRelease|x86 = Release|x86\n\tEndGlobalSection\n\tGlobalSection(ProjectConfigurationPlatforms) = postSolution\n\t\t{3E482A12-6BE2-4B4A-AE41-A5D652C92E4F}.Debug|x64.ActiveCfg = Debug|x64\n\t\t{3E482A12-6BE2-4B4A-AE41-A5D652C92E4F}.Debug|x64.Build.0 = Debug|x64\n\t\t{3E482A12-6BE2-4B4A-AE41-A5D652C92E4F}.Debug|x86.ActiveCfg = Debug|Win32\n\t\t{3E482A12-6BE2-4B4A-AE41-A5D652C92E4F}.Debug|x86.Build.0 = Debug|Win32\n\t\t{3E482A12-6BE2-4B4A-AE41-A5D652C92E4F}.Release|x64.ActiveCfg = Release|x64\n\t\t{3E482A12-6BE2-4B4A-AE41-A5D652C92E4F}.Release|x64.Build.0 = Release|x64\n\t\t{3E482A12-6BE2-4B4A-AE41-A5D652C92E4F}.Release|x86.ActiveCfg = Release|Win32\n\t\t{3E482A12-6BE2-4B4A-AE41-A5D652C92E4F}.Release|x86.Build.0 = Release|Win32\n\tEndGlobalSection\n\tGlobalSection(SolutionProperties) = preSolution\n\t\tHideSolutionNode = FALSE\n\tEndGlobalSection\nEndGlobal\n" } ]