Showing preview only (4,085K chars total). Download the full file or copy to clipboard to get everything.
Repository: Andy53/ERC.Xdbg
Branch: master
Commit: 81a8ed009325
Files: 136
Total size: 3.8 MB
Directory structure:
gitextract_3ejl9pf4/
├── .gitattributes
├── .gitignore
├── DllExport.bat
├── ERC/
│ ├── .gitignore
│ ├── Documentation/
│ │ ├── .gitignore
│ │ ├── api/
│ │ │ ├── .gitignore
│ │ │ └── index.md
│ │ ├── articles/
│ │ │ ├── LICENSE.md
│ │ │ ├── intro.md
│ │ │ └── toc.yml
│ │ ├── docfx.json
│ │ ├── index.md
│ │ └── toc.yml
│ ├── ERC/
│ │ ├── .gitignore
│ │ ├── Convert.cs
│ │ ├── Display_Output.cs
│ │ ├── ERC.Net.csproj
│ │ ├── ERC.Net.xml
│ │ ├── ERCException.cs
│ │ ├── ERC_Core.cs
│ │ ├── FodyWeavers.xml
│ │ ├── FodyWeavers.xsd
│ │ ├── Heap_Info.cs
│ │ ├── Module_Info.cs
│ │ ├── Opcode_Assembler.cs
│ │ ├── Opcode_Disassembler.cs
│ │ ├── Pattern_Tools.cs
│ │ ├── Payloads.cs
│ │ ├── Process_Info.cs
│ │ ├── PtrRemover.cs
│ │ ├── RopChainGenerator32.cs
│ │ ├── RopChainGenerator64.cs
│ │ ├── Thread_Info.cs
│ │ └── Win32Errors.cs
│ ├── LICENSE
│ ├── README.md
│ └── docs/
│ ├── api/
│ │ ├── ERC.DisplayOutput.html
│ │ ├── ERC.ERCException.html
│ │ ├── ERC.ErcCore.html
│ │ ├── ERC.ErcResult-1.html
│ │ ├── ERC.MachineType.html
│ │ ├── ERC.ModuleInfo.html
│ │ ├── ERC.ProcessInfo.html
│ │ ├── ERC.Structures.AllocationProtect.html
│ │ ├── ERC.Structures.CONTEXT32.html
│ │ ├── ERC.Structures.CONTEXT64.html
│ │ ├── ERC.Structures.CONTEXT_FLAGS.html
│ │ ├── ERC.Structures.ClientID.html
│ │ ├── ERC.Structures.FLOATING_SAVE_AREA.html
│ │ ├── ERC.Structures.IMAGE_DATA_DIRECTORY.html
│ │ ├── ERC.Structures.IMAGE_DOS_HEADER.html
│ │ ├── ERC.Structures.IMAGE_FILE_HEADER.html
│ │ ├── ERC.Structures.IMAGE_LOAD_CONFIG_CODE_INTEGRITY.html
│ │ ├── ERC.Structures.IMAGE_LOAD_CONFIG_DIRECTORY32.html
│ │ ├── ERC.Structures.IMAGE_LOAD_CONFIG_DIRECTORY64.html
│ │ ├── ERC.Structures.IMAGE_NT_HEADERS32.html
│ │ ├── ERC.Structures.IMAGE_NT_HEADERS64.html
│ │ ├── ERC.Structures.IMAGE_OPTIONAL_HEADER32.html
│ │ ├── ERC.Structures.IMAGE_OPTIONAL_HEADER64.html
│ │ ├── ERC.Structures.LIST_ENTRY.html
│ │ ├── ERC.Structures.LOADED_IMAGE.html
│ │ ├── ERC.Structures.LoadLibraryFlags.html
│ │ ├── ERC.Structures.M128A.html
│ │ ├── ERC.Structures.MEMORY_BASIC_INFORMATION32.html
│ │ ├── ERC.Structures.MEMORY_BASIC_INFORMATION64.html
│ │ ├── ERC.Structures.MagicType.html
│ │ ├── ERC.Structures.ProcessAccessFlags.html
│ │ ├── ERC.Structures.RegisterInfo.html
│ │ ├── ERC.Structures.StateEnum.html
│ │ ├── ERC.Structures.SubSystemType.html
│ │ ├── ERC.Structures.TEB.html
│ │ ├── ERC.Structures.ThreadAccess.html
│ │ ├── ERC.Structures.ThreadBasicInformation.html
│ │ ├── ERC.Structures.TypeEnum.html
│ │ ├── ERC.Structures.XSAVE_FORMAT64.html
│ │ ├── ERC.Structures.html
│ │ ├── ERC.ThreadInfo.html
│ │ ├── ERC.Utilities.Convert.html
│ │ ├── ERC.Utilities.OpcodeAssembler.html
│ │ ├── ERC.Utilities.OpcodeDisassembler.html
│ │ ├── ERC.Utilities.PatternTools.html
│ │ ├── ERC.Utilities.Payloads.html
│ │ ├── ERC.Utilities.PtrRemover.html
│ │ ├── ERC.Utilities.RopChainGenerator32.X86Lists.html
│ │ ├── ERC.Utilities.RopChainGenerator32.html
│ │ ├── ERC.Utilities.RopChainGenerator64.X64Lists.html
│ │ ├── ERC.Utilities.RopChainGenerator64.html
│ │ ├── ERC.Utilities.html
│ │ ├── ERC.html
│ │ ├── index.html
│ │ └── toc.html
│ ├── articles/
│ │ ├── LICENSE.html
│ │ ├── intro.html
│ │ └── toc.html
│ ├── index.html
│ ├── manifest.json
│ ├── search-stopwords.json
│ ├── styles/
│ │ ├── docfx.css
│ │ ├── docfx.js
│ │ ├── docfx.vendor.css
│ │ ├── docfx.vendor.js
│ │ ├── lunr.js
│ │ ├── main.css
│ │ ├── main.js
│ │ └── search-worker.js
│ ├── toc.html
│ └── xrefmap.yml
├── ERC.net/
│ └── ERC/
│ └── ERC.Net.xml
├── ErcXdbg/
│ ├── AssemblyInfo.cs
│ ├── ErcMain.cs
│ ├── ErcXdbg.cs
│ ├── ErcXdbgPlugin.csproj
│ ├── FodyWeavers.xml
│ ├── FodyWeavers.xsd
│ ├── Globals.cs
│ ├── RegisteredCommands.cs
│ ├── app.config
│ └── packages.config
├── ErcXdbgPlugin.sln
├── LICENSE
├── Managed.x64dbg/
│ ├── FodyWeavers.xml
│ ├── FodyWeavers.xsd
│ ├── Managed.x64dbg.csproj
│ ├── Properties/
│ │ └── AssemblyInfo.cs
│ ├── SDK/
│ │ ├── Bridge.cs
│ │ ├── Extensions.cs
│ │ ├── PLog.cs
│ │ ├── Plugins.cs
│ │ ├── TitanEngine.cs
│ │ └── WAPI.cs
│ ├── Script/
│ │ └── Module.cs
│ ├── app.config
│ └── packages.config
├── README.md
└── packages/
├── .gitignore
└── repositories.config
================================================
FILE CONTENTS
================================================
================================================
FILE: .gitattributes
================================================
* linguist-language=csharp
================================================
FILE: .gitignore
================================================
## Ignore Visual Studio temporary files, build results, and
## files generated by popular Visual Studio add-ons.
##
## Get latest from https://github.com/github/gitignore/blob/master/VisualStudio.gitignore
# User-specific files
*.suo
*.user
*.userosscache
*.sln.docstates
# User-specific files (MonoDevelop/Xamarin Studio)
*.userprefs
# Build results
[Dd]ebug/
[Dd]ebugPublic/
[Rr]elease/
[Rr]eleases/
x64/
x86/
bld/
[Bb]in/
[Oo]bj/
[Ll]og/
# Visual Studio 2015/2017 cache/options directory
.vs/
# Uncomment if you have tasks that create the project's static files in wwwroot
#wwwroot/
# Visual Studio 2017 auto generated files
Generated\ Files/
# MSTest test Results
[Tt]est[Rr]esult*/
[Bb]uild[Ll]og.*
# NUNIT
*.VisualState.xml
TestResult.xml
# Build Results of an ATL Project
[Dd]ebugPS/
[Rr]eleasePS/
dlldata.c
# Benchmark Results
BenchmarkDotNet.Artifacts/
# .NET Core
project.lock.json
project.fragment.lock.json
artifacts/
**/Properties/launchSettings.json
# StyleCop
StyleCopReport.xml
# Files built by Visual Studio
*_i.c
*_p.c
*_i.h
*.ilk
*.meta
*.obj
*.iobj
*.pch
*.pdb
*.ipdb
*.pgc
*.pgd
*.rsp
*.sbr
*.tlb
*.tli
*.tlh
*.tmp
*.tmp_proj
*.log
*.vspscc
*.vssscc
.builds
*.pidb
*.svclog
*.scc
# Chutzpah Test files
_Chutzpah*
# Visual C++ cache files
ipch/
*.aps
*.ncb
*.opendb
*.opensdf
*.sdf
*.cachefile
*.VC.db
*.VC.VC.opendb
# Visual Studio profiler
*.psess
*.vsp
*.vspx
*.sap
# Visual Studio Trace Files
*.e2e
# TFS 2012 Local Workspace
$tf/
# Guidance Automation Toolkit
*.gpState
# ReSharper is a .NET coding add-in
_ReSharper*/
*.[Rr]e[Ss]harper
*.DotSettings.user
# JustCode is a .NET coding add-in
.JustCode
# TeamCity is a build add-in
_TeamCity*
# DotCover is a Code Coverage Tool
*.dotCover
# AxoCover is a Code Coverage Tool
.axoCover/*
!.axoCover/settings.json
# Visual Studio code coverage results
*.coverage
*.coveragexml
# NCrunch
_NCrunch_*
.*crunch*.local.xml
nCrunchTemp_*
# MightyMoose
*.mm.*
AutoTest.Net/
# Web workbench (sass)
.sass-cache/
# Installshield output folder
[Ee]xpress/
# DocProject is a documentation generator add-in
DocProject/buildhelp/
DocProject/Help/*.HxT
DocProject/Help/*.HxC
DocProject/Help/*.hhc
DocProject/Help/*.hhk
DocProject/Help/*.hhp
DocProject/Help/Html2
DocProject/Help/html
# Click-Once directory
publish/
# Publish Web Output
*.[Pp]ublish.xml
*.azurePubxml
# Note: Comment the next line if you want to checkin your web deploy settings,
# but database connection strings (with potential passwords) will be unencrypted
*.pubxml
*.publishproj
# Microsoft Azure Web App publish settings. Comment the next line if you want to
# checkin your Azure Web App publish settings, but sensitive information contained
# in these scripts will be unencrypted
PublishScripts/
# NuGet Packages
*.nupkg
# The packages folder can be ignored because of Package Restore
**/[Pp]ackages/*
# except build/, which is used as an MSBuild target.
!**/[Pp]ackages/build/
# Uncomment if necessary however generally it will be regenerated when needed
#!**/[Pp]ackages/repositories.config
# NuGet v3's project.json files produces more ignorable files
*.nuget.props
*.nuget.targets
# Microsoft Azure Build Output
csx/
*.build.csdef
# Microsoft Azure Emulator
ecf/
rcf/
# Windows Store app package directories and files
AppPackages/
BundleArtifacts/
Package.StoreAssociation.xml
_pkginfo.txt
*.appx
# Visual Studio cache files
# files ending in .cache can be ignored
*.[Cc]ache
# but keep track of directories ending in .cache
!*.[Cc]ache/
# Others
ClientBin/
~$*
*~
*.dbmdl
*.dbproj.schemaview
*.jfm
*.pfx
*.publishsettings
orleans.codegen.cs
# Including strong name files can present a security risk
# (https://github.com/github/gitignore/pull/2483#issue-259490424)
#*.snk
# Since there are multiple workflows, uncomment next line to ignore bower_components
# (https://github.com/github/gitignore/pull/1529#issuecomment-104372622)
#bower_components/
# RIA/Silverlight projects
Generated_Code/
# Backup & report files from converting an old project file
# to a newer Visual Studio version. Backup files are not needed,
# because we have git ;-)
_UpgradeReport_Files/
Backup*/
UpgradeLog*.XML
UpgradeLog*.htm
ServiceFabricBackup/
*.rptproj.bak
# SQL Server files
*.mdf
*.ldf
*.ndf
# Business Intelligence projects
*.rdl.data
*.bim.layout
*.bim_*.settings
*.rptproj.rsuser
# Microsoft Fakes
FakesAssemblies/
# GhostDoc plugin setting file
*.GhostDoc.xml
# Node.js Tools for Visual Studio
.ntvs_analysis.dat
node_modules/
# Visual Studio 6 build log
*.plg
# Visual Studio 6 workspace options file
*.opt
# Visual Studio 6 auto-generated workspace file (contains which files were open etc.)
*.vbw
# Visual Studio LightSwitch build output
**/*.HTMLClient/GeneratedArtifacts
**/*.DesktopClient/GeneratedArtifacts
**/*.DesktopClient/ModelManifest.xml
**/*.Server/GeneratedArtifacts
**/*.Server/ModelManifest.xml
_Pvt_Extensions
# Paket dependency manager
.paket/paket.exe
paket-files/
# FAKE - F# Make
.fake/
# JetBrains Rider
.idea/
*.sln.iml
# CodeRush
.cr/
# Python Tools for Visual Studio (PTVS)
__pycache__/
*.pyc
# Cake - Uncomment if you are using it
# tools/**
# !tools/packages.config
# Tabs Studio
*.tss
# Telerik's JustMock configuration file
*.jmconfig
# BizTalk build output
*.btp.cs
*.btm.cs
*.odx.cs
*.xsd.cs
# OpenCover UI analysis results
OpenCover/
# Azure Stream Analytics local run output
ASALocalRun/
# MSBuild Binary and Structured Log
*.binlog
# NVidia Nsight GPU debugger configuration file
*.nvuser
# MFractors (Xamarin productivity tool) working folder
.mfractor/
================================================
FILE: DllExport.bat
================================================
@echo off
:: Copyright (c) 2016-2021 Denis Kuzmin [x-3F@outlook.com] github/3F
:: https://github.com/3F/DllExport
if "%~1"=="/?" goto bq
set "aa=%~dpnx0"
set ab=%*
set ac=%*
if defined ab (
if defined __p_call (
set ac=%ac:^^=^%
) else (
set ab=%ab:^=^^%
)
)
set wMgrArgs=%ac%
set ad=%ab:!=^!%
setlocal enableDelayedExpansion
set "ae=^"
set "ad=!ad:%%=%%%%!"
set "ad=!ad:&=%%ae%%&!"
set "af=1.7.4"
set "wAction=Configure"
set "ag=DllExport"
set "ah=tools/net.r_eg.DllExport.Wizard.targets"
set "ai=packages"
set "aj=https://www.nuget.org/api/v2/package/"
set "ak=build_info.txt"
set "al=!aa!"
set "wRootPath=!cd!"
set /a wDxpOpt=0
set "am="
set "an="
set "ao="
set "ap="
set "aq="
set "ar="
set "as="
set "at="
set "au="
set "av="
set /a aw=0
if not defined ab (
if defined wAction goto br
goto bq
)
call :bs bk !ad! bl
goto bt
:bq
echo.
@echo .NET DllExport v1.7.4.29858+c1cc52f
@echo Copyright (c) 2009-2015 Robert Giesecke
@echo Copyright (c) 2016-2021 Denis Kuzmin ^<x-3F@outlook.com^> github/3F
echo.
echo MIT License
@echo https://github.com/3F/DllExport
echo Based on hMSBuild, MvsSln, +GetNuTool: https://github.com/3F
echo.
@echo.
@echo Usage: DllExport [args to DllExport] [args to GetNuTool] [args to hMSBuild]
echo ------
echo.
echo Arguments
echo ---------
echo -action {type} - Specified action for Wizard. Where {type}:
echo * Configure - To configure DllExport for specific projects.
echo * Update - To update pkg reference for already configured projects.
echo * Restore - To restore configured DllExport.
echo * Export - To export configured projects data.
echo * Recover - To re-configure projects via predefined/exported data.
echo * Unset - To unset all data from specified projects.
echo * Upgrade - Aggregates an Update action with additions for upgrading.
echo.
echo -sln-dir {path} - Path to directory with .sln files to be processed.
echo -sln-file {path} - Optional predefined .sln file to be processed.
echo -metalib {path} - Relative path to meta library.
echo -metacor {path} - Relative path to meta core library.
echo -dxp-target {path} - Relative path to entrypoint wrapper of the main core.
echo -dxp-version {num} - Specific version of DllExport. Where {num}:
echo * Versions: 1.7.3 ...
echo * Keywords:
echo `actual` - Unspecified local/latest remote version;
echo ( Only if you know what you are doing )
echo.
echo -msb {path} - Full path to specific msbuild.
echo -hMSBuild {args} - Access to hMSBuild tool (packed) https://github.com/3F/hMSBuild
echo -packages {path} - A common directory for packages.
echo -server {url} - Url for searching remote packages.
echo -proxy {cfg} - To use proxy. The format: [usr[:pwd]@]host[:port]
echo -pkg-link {uri} - Direct link to package from the source via specified URI.
echo -force - Aggressive behavior, e.g. like removing pkg when updating.
echo -no-mgr - Do not use %~nx0 for automatic restore the remote package.
echo -mgr-up - Updates %~nx0 to version from '-dxp-version'.
echo -wz-target {path} - Relative path to entrypoint wrapper of the main wizard.
echo -pe-exp-list {module} - To list all available exports from PE32/PE32+ module.
echo -eng - Try to use english language for all build messages.
echo -GetNuTool {args} - Access to GetNuTool (integrated) https://github.com/3F/GetNuTool
echo -debug - To show additional information.
echo -version - Displays version for which (together with) it was compiled.
echo -build-info - Displays actual build information from selected DllExport.
echo -help - Displays this help. Aliases: -help -h
echo.
echo Flags
echo -----
echo __p_call - To use the call-type logic when invoking %~nx0
echo.
echo Samples
echo -------
echo DllExport -action Configure -force -pkg-link http://host/v1.7.3.nupkg
echo DllExport -action Restore -sln-file "Conari.sln"
echo DllExport -proxy guest:1234@10.0.2.15:7428 -action Configure
echo.
echo DllExport -mgr-up -dxp-version 1.7.3
echo DllExport -action Upgrade -dxp-version 1.7.3
echo.
echo DllExport -GetNuTool /p:ngpackages="Conari;regXwild"
echo DllExport -pe-exp-list bin\Debug\regXwild.dll
goto bu
:bt
set /a ax=0
:bv
set ay=!bk[%ax%]!
if [!ay!]==[-help] ( goto bq ) else if [!ay!]==[-h] ( goto bq ) else if [!ay!]==[-?] ( goto bq )
if [!ay!]==[-debug] (
set am=1
goto bw
) else if [!ay!]==[-action] ( set /a "ax+=1" & call :bx bk[!ax!] v
set wAction=!v!
for %%g in (Restore, Configure, Update, Export, Recover, Unset, Upgrade, Default) do (
if "!v!"=="%%g" goto bw
)
echo Unknown -action !v!
exit/B 1
) else if [!ay!]==[-sln-dir] ( set /a "ax+=1" & call :bx bk[!ax!] v
set wSlnDir=!v!
goto bw
) else if [!ay!]==[-sln-file] ( set /a "ax+=1" & call :bx bk[!ax!] v
set wSlnFile=!v!
goto bw
) else if [!ay!]==[-metalib] ( set /a "ax+=1" & call :bx bk[!ax!] v
set wMetaLib=!v!
goto bw
) else if [!ay!]==[-metacor] ( set /a "ax+=1" & call :bx bk[!ax!] v
set wMetaCor=!v!
goto bw
) else if [!ay!]==[-dxp-target] ( set /a "ax+=1" & call :bx bk[!ax!] v
set wDxpTarget=!v!
goto bw
) else if [!ay!]==[-dxp-version] ( set /a "ax+=1" & call :bx bk[!ax!] v
set af=!v!
goto bw
) else if [!ay!]==[-msb] ( set /a "ax+=1" & call :bx bk[!ax!] v
set ao=!v!
goto bw
) else if [!ay!]==[-packages] ( set /a "ax+=1" & call :bx bk[!ax!] v
set ai=!v!
goto bw
) else if [!ay!]==[-server] ( set /a "ax+=1" & call :bx bk[!ax!] v
set aj=!v!
goto bw
) else if [!ay!]==[-proxy] ( set /a "ax+=1" & call :bx bk[!ax!] v
set at=!v!
set wProxy=!v!
goto bw
) else if [!ay!]==[-pkg-link] ( set /a "ax+=1" & call :bx bk[!ax!] v
set ap=!v!
set af=!ay!
goto bw
) else if [!ay!]==[-force] (
set ar=1
goto bw
) else if [!ay!]==[-no-mgr] (
set /a wDxpOpt^|=1
goto bw
) else if [!ay!]==[-mgr-up] (
set as=1
goto bw
) else if [!ay!]==[-wz-target] ( set /a "ax+=1" & call :bx bk[!ax!] v
set ah=!v!
goto bw
) else if [!ay!]==[-pe-exp-list] ( set /a "ax+=1" & call :bx bk[!ax!] v
set aq=!v!
goto bw
) else if [!ay!]==[-eng] (
chcp 437 >nul
goto bw
) else if [!ay!]==[-GetNuTool] (
call :by -GetNuTool 10
set /a aw=!ERRORLEVEL! & goto bu
) else if [!ay!]==[-hMSBuild] (
set av=1 & goto br
) else if [!ay!]==[-version] (
@echo v1.7.4.29858+c1cc52f %__dxp_pv%
goto bu
) else if [!ay!]==[-build-info] (
set an=1
goto bw
) else if [!ay!]==[-tests] ( set /a "ax+=1" & call :bx bk[!ax!] v
set au=!v!
goto bw
) else (
echo Incorrect key: !ay!
set /a aw=1
goto bu
)
:bw
set /a "ax+=1" & if %ax% LSS !bl! goto bv
:br
call :bz "dxpName = " ag
call :bz "dxpVersion = " af
call :bz "-sln-dir = " wSlnDir
call :bz "-sln-file = " wSlnFile
call :bz "-metalib = " wMetaLib
call :bz "-metacor = " wMetaCor
call :bz "-dxp-target = " wDxpTarget
call :bz "-wz-target = " ah
call :bz "#opt " wDxpOpt
if defined af (
if "!af!"=="actual" (
set "af="
)
)
set wPkgVer=!af!
if z%wAction%==zUpgrade (
call :bz "Upgrade is on"
set as=1
set ar=1
)
call :b0 ai
set "ai=!ai!\\"
set "az=!ag!"
set "wPkgPath=!ai!!ag!"
if defined af (
set "az=!az!/!af!"
set "wPkgPath=!wPkgPath!.!af!"
)
if defined ar (
if exist "!wPkgPath!" (
call :bz "Removing old version before continue. '-force' key rule. " wPkgPath
rmdir /S/Q "!wPkgPath!"
)
)
set a0="!wPkgPath!\\!ah!"
call :bz "wPkgPath = " wPkgPath
if not exist !a0! (
if exist "!wPkgPath!" (
call :bz "Trying to replace obsolete version ... " wPkgPath
rmdir /S/Q "!wPkgPath!"
)
call :bz "-pkg-link = " ap
call :bz "-server = " aj
if defined ap (
set aj=!ap!
if "!aj::=!"=="!aj!" (
set aj=!cd!/!aj!
)
if "!wPkgPath::=!"=="!wPkgPath!" (
set "a1=../"
)
set "az=:!a1!!wPkgPath!|"
)
if defined ao (
set a2=-msbuild "!ao!"
)
set a3=!a2! /p:ngserver="!aj!" /p:ngpackages="!az!" /p:ngpath="!ai!" /p:proxycfg="!at! "
call :bz "GetNuTool call: " a3
if defined am (
call :b1 !a3!
) else (
call :b1 !a3! >nul
)
)
if defined av (
call :by -hMSBuild 9
set /a aw=!ERRORLEVEL! & goto bu
)
if defined aq (
"!wPkgPath!\\tools\\PeViewer.exe" -list -pemodule "!aq!"
set /a aw=%ERRORLEVEL%
goto bu
)
if defined an (
call :bz "buildInfo = " wPkgPath ak
if not exist "!wPkgPath!\\!ak!" (
echo information about build is not available.
set /a aw=2
goto bu
)
type "!wPkgPath!\\!ak!"
goto bu
)
if not exist !a0! (
echo Something went wrong. Try to use another keys.
set /a aw=2
goto bu
)
call :bz "wRootPath = " wRootPath
call :bz "wAction = " wAction
call :bz "wMgrArgs = " wMgrArgs
if defined ao (
call :bz "Use specific MSBuild tools: " ao
set a4="!ao!"
goto b2
)
call :b3 bm & set a4="!bm!"
if "!ERRORLEVEL!"=="0" goto b2
echo MSBuild tools was not found. Try with `-msb` key.
set /a aw=2
goto bu
:b2
if not defined a4 (
echo Something went wrong. Use `-debug` key for details.
set /a aw=2
goto bu
)
if not defined au (
if not defined ao if defined wPkgPath (
set a4="!wPkgPath!\\hMSBuild"
for /f "tokens=*" %%i in ('!a4! -version') do set a5=%%i
call :b4 !a5! bn
call :bz "hMSBuild -v" a5 bn
if !bn! GEQ 230 (
call :bz "2.3+"
set a4=!a4! -vsw-as "-requiresAny -requires Microsoft.NetCore.Component.SDK Microsoft.Net.Core.Component.SDK -products * -latest -prerelease"
)
)
call :bz "Target: " a4 a0
call !a4! /nologo /v:m /m:4 !a0!
)
:bu
if defined au (
echo Running Tests ... "!au!"
call :b3 bo
"!bo!" /nologo /v:m /m:4 "!au!"
exit/B 0
)
if defined as (
(copy /B/Y "!wPkgPath!\\DllExport.bat" "!al!" > nul) && ( echo Manager has been updated. & exit/B 0 ) || ( (echo -mgr-up failed:!aw! 1>&2) & exit/B 1 )
)
exit/B !aw!
:b4
set a6=%~1
for /f "tokens=1,2 delims=." %%a in ("!a6!") do (
set _=%%b & set /a _*=10 & set /a %2=%%a!_!
)
exit/B 0
:by
set ay=%~1
set /a a7=%~2
call :bz "accessing to !ay! ..."
for /L %%p IN (0,1,8181) DO (
if "!ad:~%%p,%a7%!"=="!ay!" (
set a8=!ad:~%%p!
set a9=!a8:~%a7%!
if defined av (
call "!wPkgPath!\\hMSBuild" !a9!
) else (
call :b1 !a9!
)
exit/B !ERRORLEVEL!
)
)
call :bz "!ay! is corrupted: " ad
exit/B 1
:b3
call :bz "Searching from .NET Framework - .NET 4.0, ..."
for %%v in (4.0, 3.5, 2.0) do (
call :b5 %%v Y & if defined Y (
set %1=!Y!
exit/B 0
)
)
call :bz "msb -netfx: not found"
set "%1="
exit/B 2
:b5
call :bz "check %1"
for /F "usebackq tokens=2* skip=2" %%a in (
`reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSBuild\ToolsVersions\%1" /v MSBuildToolsPath 2^> nul`
) do if exist %%b (
set a_=%%~b
call :bz ":msbfound " a_
call :b6 a_ bp
set %2=!bp!
exit/B 0
)
set "%2="
exit/B 0
:b6
set %2=!%~1!\MSBuild.exe
exit/B 0
:bz
if defined am (
set ba=%1
set ba=!ba:~0,-1!
set ba=!ba:~1!
echo.[%TIME% ] !ba! !%2! !%3!
)
exit/B 0
:b0
call :b7 %1
call :b8 %1
exit/B 0
:b7
call :b9 %1 "-=1"
exit/B 0
:b8
call :b9 %1 "+=1"
exit/B 0
:b9
set bb=z!%1!z
if "%~2"=="-=1" (set "bc=1") else (set "bc=")
if defined bc (
set /a "i=-2"
) else (
set /a "i=1"
)
:b_
if "!bb:~%i%,1!"==" " (
set /a "i%~2"
goto b_
)
if defined bc set /a "i+=1"
if defined bc (
set "%1=!bb:~1,%i%!"
) else (
set "%1=!bb:~%i%,-1!"
)
exit/B 0
:bs
set "bd=%~1"
set /a ax=-1
:ca
set /a ax+=1
set %bd%[!ax!]=%~2
shift & if not "%~3"=="" goto ca
set /a ax-=1
set %1=!ax!
exit/B 0
:bx
set %2=!%1!
exit/B 0
:b1
setlocal disableDelayedExpansion
@echo off
:: GetNuTool - Executable version
:: Copyright (c) 2015-2018,2020 Denis Kuzmin [ x-3F@outlook.com ]
:: https://github.com/3F/GetNuTool
set be=gnt.core
set bf="%temp%\%random%%random%%be%"
if "%~1"=="-unpack" goto cb
set bg=%*
if defined __p_call if defined bg set bg=%bg:^^=^%
set bh=%__p_msb%
if defined bh goto cc
if "%~1"=="-msbuild" goto cd
for %%v in (4.0, 14.0, 12.0, 3.5, 2.0) do (
for /F "usebackq tokens=2* skip=2" %%a in (
`reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSBuild\ToolsVersions\%%v" /v MSBuildToolsPath 2^> nul`
) do if exist %%b (
set bh="%%~b\MSBuild.exe"
goto cc
)
)
echo MSBuild was not found. Try -msbuild "fullpath" args 1>&2
exit/B 2
:cd
shift
set bh=%1
shift
set bi=%bg:!= #__b_ECL## %
setlocal enableDelayedExpansion
set bi=!bi:%%=%%%%!
:ce
for /F "tokens=1* delims==" %%a in ("!bi!") do (
if "%%~b"=="" (
call :cf !bi!
exit/B %ERRORLEVEL%
)
set bi=%%a #__b_EQ## %%b
)
goto ce
:cf
shift & shift
set "bg="
:cg
set bg=!bg! %1
shift & if not "%~2"=="" goto cg
set bg=!bg: #__b_EQ## ==!
setlocal disableDelayedExpansion
set bg=%bg: #__b_ECL## =!%
:cc
call :ch
call %bh% %bf% /nologo /p:wpath="%cd%/" /v:m /m:4 %bg%
set "bh="
set bj=%ERRORLEVEL%
del /Q/F %bf%
exit/B %bj%
:cb
set bf="%cd%\%be%"
echo Generating minified version in %bf% ...
:ch
<nul set /P ="">%bf%
set a=PropertyGroup&set b=Condition&set c=ngpackages&set d=Target&set e=DependsOnTargets&set f=TaskCoreDllPath&set g=MSBuildToolsPath&set h=UsingTask&set i=CodeTaskFactory&set j=ParameterGroup&set k=Reference&set l=Include&set m=System&set n=Using&set o=Namespace&set p=IsNullOrEmpty&set q=return&set r=string&set s=delegate&set t=foreach&set u=WriteLine&set v=Combine&set w=Console.WriteLine&set x=Directory&set y=GetNuTool&set z=StringComparison&set _=EXT_NUSPEC
<nul set /P =^<!-- GetNuTool - github.com/3F/GetNuTool --^>^<!-- Copyright (c) 2015-2018,2020 Denis Kuzmin [ x-3F@outlook.com ] --^>^<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003"^>^<%a%^>^<ngconfig %b%="'$(ngconfig)'==''"^>packages.config^</ngconfig^>^<ngserver %b%="'$(ngserver)'==''"^>https://www.nuget.org/api/v2/package/^</ngserver^>^<%c% %b%="'$(%c%)'==''"^>^</%c%^>^<ngpath %b%="'$(ngpath)'==''"^>packages^</ngpath^>^</%a%^>^<%d% Name="get" BeforeTargets="Build" %e%="header"^>^<a^>^<Output PropertyName="plist" TaskParameter="Result"/^>^</a^>^<b plist="$(plist)"/^>^</%d%^>^<%d% Name="pack" %e%="header"^>^<c/^>^</%d%^>^<%a%^>^<%f% %b%="Exists('$(%g%)\Microsoft.Build.Tasks.v$(MSBuildToolsVersion).dll')"^>$(%g%)\Microsoft.Build.Tasks.v$(MSBuildToolsVersion).dll^</%f%^>^<%f% %b%="'$(%f%)'=='' and Exists('$(%g%)\Microsoft.Build.Tasks.Core.dll')"^>$(%g%)\Microsoft.Build.Tasks.Core.dll^</%f%^>^</%a%^>^<%h% TaskName="a" TaskFactory="%i%" AssemblyFile="$(%f%)"^>^<%j%^>^<Result Output="true"/^>^</%j%^>^<Task^>^<%k% %l%="%m%.Xml"/^>^<%k% %l%="%m%.Xml.Linq"/^>^<%n% %o%="%m%"/^>^<%n% %o%="%m%.Collections.Generic"/^>^<%n% %o%="%m%.IO"/^>^<%n% %o%="%m%.Xml.Linq"/^>^<Code Type="Fragment" Language="cs"^>^<![CDATA[var a=@"$(ngconfig)";var b=@"$(%c%)";var c=@"$(wpath)";if(!String.%p%(b)){Result=b;%q% true;}var d=Console.Error;Action^<%r%,Queue^<%r%^>^>e=%s%(%r% f,Queue^<%r%^>g){%t%(var h in XDocument.Load(f).Descendants("package")){var i=h.Attribute("id");var j=h.Attribute("version");var k=h.Attribute("output");if(i==null){d.%u%("'id' does not exist in '{0}'",f);%q%;}var l=i.Value;if(j!=null){l+="/"+j.Value;}if(k!=null){g.Enqueue(l+":"+k.Value);continue;}g.Enqueue(l);}};var m=new Queue^<%r%^>();%t%(var f in a.Split(new char[]{a.IndexOf('^|')!=-1?'^|':';'},(StringSplitOptions)1))>>%bf%
<nul set /P ={var n=Path.%v%(c,f);if(File.Exists(n)){e(n,m);}else{d.%u%(".config '{0}' is not found.",n);}}if(m.Count^<1){d.%u%("Empty list. Use .config or /p:%c%\n");}else{Result=%r%.Join("|",m.ToArray());}]]^>^</Code^>^</Task^>^</%h%^>^<%h% TaskName="b" TaskFactory="%i%" AssemblyFile="$(%f%)"^>^<%j%^>^<plist/^>^</%j%^>^<Task^>^<%k% %l%="WindowsBase"/^>^<%n% %o%="%m%"/^>^<%n% %o%="%m%.IO"/^>^<%n% %o%="%m%.IO.Packaging"/^>^<%n% %o%="%m%.Net"/^>^<Code Type="Fragment" Language="cs"^>^<![CDATA[var a=@"$(ngserver)";var b=@"$(wpath)";var c=@"$(ngpath)";var d=@"$(proxycfg)".Trim();var e=@"$(debug)"=="true";if(plist==null){%q% false;}ServicePointManager.SecurityProtocol^|=SecurityProtocolType.Tls11^|SecurityProtocolType.Tls12;var f=new %r%[]{"/_rels/","/package/","/[Content_Types].xml"};Action^<%r%,object^>g=%s%(%r% h,object i){if(e){%w%(h,i);}};Func^<%r%,WebProxy^>j=%s%(%r% k){var l=k.Split('@');if(l.Length^<=1){%q% new WebProxy(l[0],false);}var m=l[0].Split(':');%q% new WebProxy(l[1],false){Credentials=new NetworkCredential(m[0],(m.Length^>1)?m[1]:null)};};Func^<%r%,%r%^>n=%s%(%r% i){%q% Path.%v%(b,i??"");};Action^<%r%,%r%,%r%^>o=%s%(%r% p,%r% q,%r% r){var s=Path.GetFullPath(n(r??q));if(%x%.Exists(s)){%w%("`{0}` was found in \"{1}\"",q,s);%q%;}Console.Write("Getting `{0}` ... ",p);var t=Path.%v%(Path.GetTempPath(),Guid.NewGuid().ToString());using(var u=new WebClient()){try{if(!String.%p%(d)){u.Proxy=j(d);}u.Headers.Add("User-Agent","%y% $(%y%)");u.UseDefaultCredentials=true;if(u.Proxy.Credentials==null){u.Proxy.Credentials=CredentialCache.DefaultCredentials;}u.DownloadFile(a+p,t);}catch(Exception v){Console.Error.%u%(v.Message);%q%;}}%w%("Extracting into \"{0}\"",s);using(var w=ZipPackage.Open(t,FileMode.Open,FileAccess.Read)){%t%(var x in w.GetParts()){var y=Uri.UnescapeDataString(x.Uri.OriginalString);if>>%bf%
<nul set /P =(f.Any(z=^>y.StartsWith(z,%z%.Ordinal))){continue;}var _=Path.%v%(s,y.TrimStart('/'));g("- `{0}`",y);var aa=Path.GetDirectoryName(_);if(!%x%.Exists(aa)){%x%.CreateDirectory(aa);}using(Stream ab=x.GetStream(FileMode.Open,FileAccess.Read))using(var ac=File.OpenWrite(_)){try{ab.CopyTo(ac);}catch(FileFormatException v){g("[x]?crc: {0}",_);}}}}File.Delete(t);};%t%(var w in plist.Split(new char[]{plist.IndexOf('^|')!=-1?'^|':';'},(StringSplitOptions)1)){var ad=w.Split(new char[]{':'},2);var p=ad[0];var r=(ad.Length^>1)?ad[1]:null;var q=p.Replace('/','.');if(!String.%p%(c)){r=Path.%v%(c,r??q);}o(p,q,r);}]]^>^</Code^>^</Task^>^</%h%^>^<%h% TaskName="c" TaskFactory="%i%" AssemblyFile="$(%f%)"^>^<Task^>^<%k% %l%="%m%.Xml"/^>^<%k% %l%="%m%.Xml.Linq"/^>^<%k% %l%="WindowsBase"/^>^<%n% %o%="%m%"/^>^<%n% %o%="%m%.Collections.Generic"/^>^<%n% %o%="%m%.IO"/^>^<%n% %o%="%m%.Linq"/^>^<%n% %o%="%m%.IO.Packaging"/^>^<%n% %o%="%m%.Xml.Linq"/^>^<%n% %o%="%m%.Text.RegularExpressions"/^>^<Code Type="Fragment" Language="cs"^>^<![CDATA[var a=@"$(ngin)";var b=@"$(ngout)";var c=@"$(wpath)";var d=@"$(debug)"=="true";var %_%=".nuspec";var EXT_NUPKG=".nupkg";var TAG_META="metadata";var DEF_CONTENT_TYPE="application/octet";var MANIFEST_URL="http://schemas.microsoft.com/packaging/2010/07/manifest";var ID="id";var VER="version";Action^<%r%,object^>e=%s%(%r% f,object g){if(d){%w%(f,g);}};var h=Console.Error;a=Path.%v%(c,a);if(!%x%.Exists(a)){h.%u%("`{0}` is not found.",a);%q% false;}b=Path.%v%(c,b);var i=%x%.GetFiles(a,"*"+%_%,SearchOption.TopDirectoryOnly).FirstOrDefault();if(i==null){h.%u%("{0} is not found in `{1}`",%_%,a);%q% false;}%w%("Found {0}: `{1}`",%_%,i);var j=XDocument.Load(i).Root.Elements().FirstOrDefault(k=^>k.Name.LocalName==TAG_META);if(j==null){h.%u%("{0} does not contain {1}.",i,TAG_META);%q% false;}var l=>>%bf%
<nul set /P =new Dictionary^<%r%,%r%^>();%t%(var m in j.Elements()){l[m.Name.LocalName.ToLower()]=m.Value;}if(l[ID].Length^>100^|^|!Regex.IsMatch(l[ID],@"^\w+([_.-]\w+)*$",RegexOptions.IgnoreCase^|RegexOptions.ExplicitCapture)){h.%u%("The format `{0}` is not correct.",ID);%q% false;}var n=new %r%[]{Path.%v%(a,"_rels"),Path.%v%(a,"package"),Path.%v%(a,"[Content_Types].xml")};var o=%r%.Format("{0}.{1}{2}",l[ID],l[VER],EXT_NUPKG);if(!String.IsNullOrWhiteSpace(b)){if(!%x%.Exists(b)){%x%.CreateDirectory(b);}o=Path.%v%(b,o);}%w%("Creating nupkg `{0}` ...",o);using(var p=Package.Open(o,FileMode.Create)){Uri q=new Uri(String.Format("/{0}{1}",l[ID],%_%),UriKind.Relative);p.CreateRelationship(q,TargetMode.Internal,MANIFEST_URL);%t%(var r in %x%.GetFiles(a,"*.*",SearchOption.AllDirectories)){if(n.Any(k=^>r.StartsWith(k,%z%.Ordinal))){continue;}%r% s;if(r.StartsWith(a,%z%.OrdinalIgnoreCase)){s=r.Substring(a.Length).TrimStart(Path.DirectorySeparatorChar);}else{s=r;}e("- `{0}`",s);var t=%r%.Join("/",s.Split('\\','/').Select(g=^>Uri.EscapeDataString(g)));Uri u=PackUriHelper.CreatePartUri(new Uri(t,UriKind.Relative));var v=p.CreatePart(u,DEF_CONTENT_TYPE,CompressionOption.Maximum);using(Stream w=v.GetStream())using(var x=new FileStream(r,FileMode.Open,FileAccess.Read)){x.CopyTo(w);}}Func^<%r%,%r%^>y=%s%(%r% z){%q%(l.ContainsKey(z))?l[z]:"";};var _=p.PackageProperties;_.Creator=y("authors");_.Description=y("description");_.Identifier=l[ID];_.Version=l[VER];_.Keywords=y("tags");_.Title=y("title");_.LastModifiedBy="%y% $(%y%)";}]]^>^</Code^>^</Task^>^</%h%^>^<%d% Name="Build" %e%="get"/^>^<%a%^>^<%y%^>1.8.0.43837+df76082^</%y%^>^<wpath %b%="'$(wpath)'==''"^>$(MSBuildProjectDirectory)^</wpath^>^</%a%^>^<%d% Name="header"^>^<Message Text="%%0D%%0A%y% $(%y%)%%0D%%0A(c) 2015-2018,2020 Denis Kuzmin [ x-3F@outlook.com ] GitHub/3F%%0D%%0A" >>%bf%
<nul set /P =Importance="high"/^>^</%d%^>^</Project^>>>%bf%
exit/B 0
================================================
FILE: ERC/.gitignore
================================================
*.ide
.vs/*
.vs/ERC.net/v15/Server/sqlite3/storage.ide-shm
.vs/ERC.net/v15/Server/sqlite3/storage.ide-wal
D:\Source\Repos\ERC_net\ERC.net\ERC_test_app
*ERC.net.sln
ERC_test_app/*
ERC\obj\ERC.Net.csproj.nuget.cache
docfx_project/**
docfx_project
================================================
FILE: ERC/Documentation/.gitignore
================================================
###############
# folder #
###############
/**/DROP/
/**/TEMP/
/**/packages/
/**/bin/
/**/obj/
_site
================================================
FILE: ERC/Documentation/api/.gitignore
================================================
###############
# temp file #
###############
*.yml
.manifest
================================================
FILE: ERC/Documentation/api/index.md
================================================
# ERC.Net
In the left panel, you find the API documentation for all accessible structures and functionality of the ERC.Net library.
================================================
FILE: ERC/Documentation/articles/LICENSE.md
================================================
GNU GENERAL PUBLIC LICENSE
Version 3, 29 June 2007
Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
Everyone is permitted to copy and distribute verbatim copies
of this license document, but changing it is not allowed.
Preamble
The GNU General Public License is a free, copyleft license for
software and other kinds of works.
The licenses for most software and other practical works are designed
to take away your freedom to share and change the works. By contrast,
the GNU General Public License is intended to guarantee your freedom to
share and change all versions of a program--to make sure it remains free
software for all its users. We, the Free Software Foundation, use the
GNU General Public License for most of our software; it applies also to
any other work released this way by its authors. You can apply it to
your programs, too.
When we speak of free software, we are referring to freedom, not
price. Our General Public Licenses are designed to make sure that you
have the freedom to distribute copies of free software (and charge for
them if you wish), that you receive source code or can get it if you
want it, that you can change the software or use pieces of it in new
free programs, and that you know you can do these things.
To protect your rights, we need to prevent others from denying you
these rights or asking you to surrender the rights. Therefore, you have
certain responsibilities if you distribute copies of the software, or if
you modify it: responsibilities to respect the freedom of others.
For example, if you distribute copies of such a program, whether
gratis or for a fee, you must pass on to the recipients the same
freedoms that you received. You must make sure that they, too, receive
or can get the source code. And you must show them these terms so they
know their rights.
Developers that use the GNU GPL protect your rights with two steps:
(1) assert copyright on the software, and (2) offer you this License
giving you legal permission to copy, distribute and/or modify it.
For the developers' and authors' protection, the GPL clearly explains
that there is no warranty for this free software. For both users' and
authors' sake, the GPL requires that modified versions be marked as
changed, so that their problems will not be attributed erroneously to
authors of previous versions.
Some devices are designed to deny users access to install or run
modified versions of the software inside them, although the manufacturer
can do so. This is fundamentally incompatible with the aim of
protecting users' freedom to change the software. The systematic
pattern of such abuse occurs in the area of products for individuals to
use, which is precisely where it is most unacceptable. Therefore, we
have designed this version of the GPL to prohibit the practice for those
products. If such problems arise substantially in other domains, we
stand ready to extend this provision to those domains in future versions
of the GPL, as needed to protect the freedom of users.
Finally, every program is threatened constantly by software patents.
States should not allow patents to restrict development and use of
software on general-purpose computers, but in those that do, we wish to
avoid the special danger that patents applied to a free program could
make it effectively proprietary. To prevent this, the GPL assures that
patents cannot be used to render the program non-free.
The precise terms and conditions for copying, distribution and
modification follow.
TERMS AND CONDITIONS
0. Definitions.
"This License" refers to version 3 of the GNU General Public License.
"Copyright" also means copyright-like laws that apply to other kinds of
works, such as semiconductor masks.
"The Program" refers to any copyrightable work licensed under this
License. Each licensee is addressed as "you". "Licensees" and
"recipients" may be individuals or organizations.
To "modify" a work means to copy from or adapt all or part of the work
in a fashion requiring copyright permission, other than the making of an
exact copy. The resulting work is called a "modified version" of the
earlier work or a work "based on" the earlier work.
A "covered work" means either the unmodified Program or a work based
on the Program.
To "propagate" a work means to do anything with it that, without
permission, would make you directly or secondarily liable for
infringement under applicable copyright law, except executing it on a
computer or modifying a private copy. Propagation includes copying,
distribution (with or without modification), making available to the
public, and in some countries other activities as well.
To "convey" a work means any kind of propagation that enables other
parties to make or receive copies. Mere interaction with a user through
a computer network, with no transfer of a copy, is not conveying.
An interactive user interface displays "Appropriate Legal Notices"
to the extent that it includes a convenient and prominently visible
feature that (1) displays an appropriate copyright notice, and (2)
tells the user that there is no warranty for the work (except to the
extent that warranties are provided), that licensees may convey the
work under this License, and how to view a copy of this License. If
the interface presents a list of user commands or options, such as a
menu, a prominent item in the list meets this criterion.
1. Source Code.
The "source code" for a work means the preferred form of the work
for making modifications to it. "Object code" means any non-source
form of a work.
A "Standard Interface" means an interface that either is an official
standard defined by a recognized standards body, or, in the case of
interfaces specified for a particular programming language, one that
is widely used among developers working in that language.
The "System Libraries" of an executable work include anything, other
than the work as a whole, that (a) is included in the normal form of
packaging a Major Component, but which is not part of that Major
Component, and (b) serves only to enable use of the work with that
Major Component, or to implement a Standard Interface for which an
implementation is available to the public in source code form. A
"Major Component", in this context, means a major essential component
(kernel, window system, and so on) of the specific operating system
(if any) on which the executable work runs, or a compiler used to
produce the work, or an object code interpreter used to run it.
The "Corresponding Source" for a work in object code form means all
the source code needed to generate, install, and (for an executable
work) run the object code and to modify the work, including scripts to
control those activities. However, it does not include the work's
System Libraries, or general-purpose tools or generally available free
programs which are used unmodified in performing those activities but
which are not part of the work. For example, Corresponding Source
includes interface definition files associated with source files for
the work, and the source code for shared libraries and dynamically
linked subprograms that the work is specifically designed to require,
such as by intimate data communication or control flow between those
subprograms and other parts of the work.
The Corresponding Source need not include anything that users
can regenerate automatically from other parts of the Corresponding
Source.
The Corresponding Source for a work in source code form is that
same work.
2. Basic Permissions.
All rights granted under this License are granted for the term of
copyright on the Program, and are irrevocable provided the stated
conditions are met. This License explicitly affirms your unlimited
permission to run the unmodified Program. The output from running a
covered work is covered by this License only if the output, given its
content, constitutes a covered work. This License acknowledges your
rights of fair use or other equivalent, as provided by copyright law.
You may make, run and propagate covered works that you do not
convey, without conditions so long as your license otherwise remains
in force. You may convey covered works to others for the sole purpose
of having them make modifications exclusively for you, or provide you
with facilities for running those works, provided that you comply with
the terms of this License in conveying all material for which you do
not control copyright. Those thus making or running the covered works
for you must do so exclusively on your behalf, under your direction
and control, on terms that prohibit them from making any copies of
your copyrighted material outside their relationship with you.
Conveying under any other circumstances is permitted solely under
the conditions stated below. Sublicensing is not allowed; section 10
makes it unnecessary.
3. Protecting Users' Legal Rights From Anti-Circumvention Law.
No covered work shall be deemed part of an effective technological
measure under any applicable law fulfilling obligations under article
11 of the WIPO copyright treaty adopted on 20 December 1996, or
similar laws prohibiting or restricting circumvention of such
measures.
When you convey a covered work, you waive any legal power to forbid
circumvention of technological measures to the extent such circumvention
is effected by exercising rights under this License with respect to
the covered work, and you disclaim any intention to limit operation or
modification of the work as a means of enforcing, against the work's
users, your or third parties' legal rights to forbid circumvention of
technological measures.
4. Conveying Verbatim Copies.
You may convey verbatim copies of the Program's source code as you
receive it, in any medium, provided that you conspicuously and
appropriately publish on each copy an appropriate copyright notice;
keep intact all notices stating that this License and any
non-permissive terms added in accord with section 7 apply to the code;
keep intact all notices of the absence of any warranty; and give all
recipients a copy of this License along with the Program.
You may charge any price or no price for each copy that you convey,
and you may offer support or warranty protection for a fee.
5. Conveying Modified Source Versions.
You may convey a work based on the Program, or the modifications to
produce it from the Program, in the form of source code under the
terms of section 4, provided that you also meet all of these conditions:
a) The work must carry prominent notices stating that you modified
it, and giving a relevant date.
b) The work must carry prominent notices stating that it is
released under this License and any conditions added under section
7. This requirement modifies the requirement in section 4 to
"keep intact all notices".
c) You must license the entire work, as a whole, under this
License to anyone who comes into possession of a copy. This
License will therefore apply, along with any applicable section 7
additional terms, to the whole of the work, and all its parts,
regardless of how they are packaged. This License gives no
permission to license the work in any other way, but it does not
invalidate such permission if you have separately received it.
d) If the work has interactive user interfaces, each must display
Appropriate Legal Notices; however, if the Program has interactive
interfaces that do not display Appropriate Legal Notices, your
work need not make them do so.
A compilation of a covered work with other separate and independent
works, which are not by their nature extensions of the covered work,
and which are not combined with it such as to form a larger program,
in or on a volume of a storage or distribution medium, is called an
"aggregate" if the compilation and its resulting copyright are not
used to limit the access or legal rights of the compilation's users
beyond what the individual works permit. Inclusion of a covered work
in an aggregate does not cause this License to apply to the other
parts of the aggregate.
6. Conveying Non-Source Forms.
You may convey a covered work in object code form under the terms
of sections 4 and 5, provided that you also convey the
machine-readable Corresponding Source under the terms of this License,
in one of these ways:
a) Convey the object code in, or embodied in, a physical product
(including a physical distribution medium), accompanied by the
Corresponding Source fixed on a durable physical medium
customarily used for software interchange.
b) Convey the object code in, or embodied in, a physical product
(including a physical distribution medium), accompanied by a
written offer, valid for at least three years and valid for as
long as you offer spare parts or customer support for that product
model, to give anyone who possesses the object code either (1) a
copy of the Corresponding Source for all the software in the
product that is covered by this License, on a durable physical
medium customarily used for software interchange, for a price no
more than your reasonable cost of physically performing this
conveying of source, or (2) access to copy the
Corresponding Source from a network server at no charge.
c) Convey individual copies of the object code with a copy of the
written offer to provide the Corresponding Source. This
alternative is allowed only occasionally and noncommercially, and
only if you received the object code with such an offer, in accord
with subsection 6b.
d) Convey the object code by offering access from a designated
place (gratis or for a charge), and offer equivalent access to the
Corresponding Source in the same way through the same place at no
further charge. You need not require recipients to copy the
Corresponding Source along with the object code. If the place to
copy the object code is a network server, the Corresponding Source
may be on a different server (operated by you or a third party)
that supports equivalent copying facilities, provided you maintain
clear directions next to the object code saying where to find the
Corresponding Source. Regardless of what server hosts the
Corresponding Source, you remain obligated to ensure that it is
available for as long as needed to satisfy these requirements.
e) Convey the object code using peer-to-peer transmission, provided
you inform other peers where the object code and Corresponding
Source of the work are being offered to the general public at no
charge under subsection 6d.
A separable portion of the object code, whose source code is excluded
from the Corresponding Source as a System Library, need not be
included in conveying the object code work.
A "User Product" is either (1) a "consumer product", which means any
tangible personal property which is normally used for personal, family,
or household purposes, or (2) anything designed or sold for incorporation
into a dwelling. In determining whether a product is a consumer product,
doubtful cases shall be resolved in favor of coverage. For a particular
product received by a particular user, "normally used" refers to a
typical or common use of that class of product, regardless of the status
of the particular user or of the way in which the particular user
actually uses, or expects or is expected to use, the product. A product
is a consumer product regardless of whether the product has substantial
commercial, industrial or non-consumer uses, unless such uses represent
the only significant mode of use of the product.
"Installation Information" for a User Product means any methods,
procedures, authorization keys, or other information required to install
and execute modified versions of a covered work in that User Product from
a modified version of its Corresponding Source. The information must
suffice to ensure that the continued functioning of the modified object
code is in no case prevented or interfered with solely because
modification has been made.
If you convey an object code work under this section in, or with, or
specifically for use in, a User Product, and the conveying occurs as
part of a transaction in which the right of possession and use of the
User Product is transferred to the recipient in perpetuity or for a
fixed term (regardless of how the transaction is characterized), the
Corresponding Source conveyed under this section must be accompanied
by the Installation Information. But this requirement does not apply
if neither you nor any third party retains the ability to install
modified object code on the User Product (for example, the work has
been installed in ROM).
The requirement to provide Installation Information does not include a
requirement to continue to provide support service, warranty, or updates
for a work that has been modified or installed by the recipient, or for
the User Product in which it has been modified or installed. Access to a
network may be denied when the modification itself materially and
adversely affects the operation of the network or violates the rules and
protocols for communication across the network.
Corresponding Source conveyed, and Installation Information provided,
in accord with this section must be in a format that is publicly
documented (and with an implementation available to the public in
source code form), and must require no special password or key for
unpacking, reading or copying.
7. Additional Terms.
"Additional permissions" are terms that supplement the terms of this
License by making exceptions from one or more of its conditions.
Additional permissions that are applicable to the entire Program shall
be treated as though they were included in this License, to the extent
that they are valid under applicable law. If additional permissions
apply only to part of the Program, that part may be used separately
under those permissions, but the entire Program remains governed by
this License without regard to the additional permissions.
When you convey a copy of a covered work, you may at your option
remove any additional permissions from that copy, or from any part of
it. (Additional permissions may be written to require their own
removal in certain cases when you modify the work.) You may place
additional permissions on material, added by you to a covered work,
for which you have or can give appropriate copyright permission.
Notwithstanding any other provision of this License, for material you
add to a covered work, you may (if authorized by the copyright holders of
that material) supplement the terms of this License with terms:
a) Disclaiming warranty or limiting liability differently from the
terms of sections 15 and 16 of this License; or
b) Requiring preservation of specified reasonable legal notices or
author attributions in that material or in the Appropriate Legal
Notices displayed by works containing it; or
c) Prohibiting misrepresentation of the origin of that material, or
requiring that modified versions of such material be marked in
reasonable ways as different from the original version; or
d) Limiting the use for publicity purposes of names of licensors or
authors of the material; or
e) Declining to grant rights under trademark law for use of some
trade names, trademarks, or service marks; or
f) Requiring indemnification of licensors and authors of that
material by anyone who conveys the material (or modified versions of
it) with contractual assumptions of liability to the recipient, for
any liability that these contractual assumptions directly impose on
those licensors and authors.
All other non-permissive additional terms are considered "further
restrictions" within the meaning of section 10. If the Program as you
received it, or any part of it, contains a notice stating that it is
governed by this License along with a term that is a further
restriction, you may remove that term. If a license document contains
a further restriction but permits relicensing or conveying under this
License, you may add to a covered work material governed by the terms
of that license document, provided that the further restriction does
not survive such relicensing or conveying.
If you add terms to a covered work in accord with this section, you
must place, in the relevant source files, a statement of the
additional terms that apply to those files, or a notice indicating
where to find the applicable terms.
Additional terms, permissive or non-permissive, may be stated in the
form of a separately written license, or stated as exceptions;
the above requirements apply either way.
8. Termination.
You may not propagate or modify a covered work except as expressly
provided under this License. Any attempt otherwise to propagate or
modify it is void, and will automatically terminate your rights under
this License (including any patent licenses granted under the third
paragraph of section 11).
However, if you cease all violation of this License, then your
license from a particular copyright holder is reinstated (a)
provisionally, unless and until the copyright holder explicitly and
finally terminates your license, and (b) permanently, if the copyright
holder fails to notify you of the violation by some reasonable means
prior to 60 days after the cessation.
Moreover, your license from a particular copyright holder is
reinstated permanently if the copyright holder notifies you of the
violation by some reasonable means, this is the first time you have
received notice of violation of this License (for any work) from that
copyright holder, and you cure the violation prior to 30 days after
your receipt of the notice.
Termination of your rights under this section does not terminate the
licenses of parties who have received copies or rights from you under
this License. If your rights have been terminated and not permanently
reinstated, you do not qualify to receive new licenses for the same
material under section 10.
9. Acceptance Not Required for Having Copies.
You are not required to accept this License in order to receive or
run a copy of the Program. Ancillary propagation of a covered work
occurring solely as a consequence of using peer-to-peer transmission
to receive a copy likewise does not require acceptance. However,
nothing other than this License grants you permission to propagate or
modify any covered work. These actions infringe copyright if you do
not accept this License. Therefore, by modifying or propagating a
covered work, you indicate your acceptance of this License to do so.
10. Automatic Licensing of Downstream Recipients.
Each time you convey a covered work, the recipient automatically
receives a license from the original licensors, to run, modify and
propagate that work, subject to this License. You are not responsible
for enforcing compliance by third parties with this License.
An "entity transaction" is a transaction transferring control of an
organization, or substantially all assets of one, or subdividing an
organization, or merging organizations. If propagation of a covered
work results from an entity transaction, each party to that
transaction who receives a copy of the work also receives whatever
licenses to the work the party's predecessor in interest had or could
give under the previous paragraph, plus a right to possession of the
Corresponding Source of the work from the predecessor in interest, if
the predecessor has it or can get it with reasonable efforts.
You may not impose any further restrictions on the exercise of the
rights granted or affirmed under this License. For example, you may
not impose a license fee, royalty, or other charge for exercise of
rights granted under this License, and you may not initiate litigation
(including a cross-claim or counterclaim in a lawsuit) alleging that
any patent claim is infringed by making, using, selling, offering for
sale, or importing the Program or any portion of it.
11. Patents.
A "contributor" is a copyright holder who authorizes use under this
License of the Program or a work on which the Program is based. The
work thus licensed is called the contributor's "contributor version".
A contributor's "essential patent claims" are all patent claims
owned or controlled by the contributor, whether already acquired or
hereafter acquired, that would be infringed by some manner, permitted
by this License, of making, using, or selling its contributor version,
but do not include claims that would be infringed only as a
consequence of further modification of the contributor version. For
purposes of this definition, "control" includes the right to grant
patent sublicenses in a manner consistent with the requirements of
this License.
Each contributor grants you a non-exclusive, worldwide, royalty-free
patent license under the contributor's essential patent claims, to
make, use, sell, offer for sale, import and otherwise run, modify and
propagate the contents of its contributor version.
In the following three paragraphs, a "patent license" is any express
agreement or commitment, however denominated, not to enforce a patent
(such as an express permission to practice a patent or covenant not to
sue for patent infringement). To "grant" such a patent license to a
party means to make such an agreement or commitment not to enforce a
patent against the party.
If you convey a covered work, knowingly relying on a patent license,
and the Corresponding Source of the work is not available for anyone
to copy, free of charge and under the terms of this License, through a
publicly available network server or other readily accessible means,
then you must either (1) cause the Corresponding Source to be so
available, or (2) arrange to deprive yourself of the benefit of the
patent license for this particular work, or (3) arrange, in a manner
consistent with the requirements of this License, to extend the patent
license to downstream recipients. "Knowingly relying" means you have
actual knowledge that, but for the patent license, your conveying the
covered work in a country, or your recipient's use of the covered work
in a country, would infringe one or more identifiable patents in that
country that you have reason to believe are valid.
If, pursuant to or in connection with a single transaction or
arrangement, you convey, or propagate by procuring conveyance of, a
covered work, and grant a patent license to some of the parties
receiving the covered work authorizing them to use, propagate, modify
or convey a specific copy of the covered work, then the patent license
you grant is automatically extended to all recipients of the covered
work and works based on it.
A patent license is "discriminatory" if it does not include within
the scope of its coverage, prohibits the exercise of, or is
conditioned on the non-exercise of one or more of the rights that are
specifically granted under this License. You may not convey a covered
work if you are a party to an arrangement with a third party that is
in the business of distributing software, under which you make payment
to the third party based on the extent of your activity of conveying
the work, and under which the third party grants, to any of the
parties who would receive the covered work from you, a discriminatory
patent license (a) in connection with copies of the covered work
conveyed by you (or copies made from those copies), or (b) primarily
for and in connection with specific products or compilations that
contain the covered work, unless you entered into that arrangement,
or that patent license was granted, prior to 28 March 2007.
Nothing in this License shall be construed as excluding or limiting
any implied license or other defenses to infringement that may
otherwise be available to you under applicable patent law.
12. No Surrender of Others' Freedom.
If conditions are imposed on you (whether by court order, agreement or
otherwise) that contradict the conditions of this License, they do not
excuse you from the conditions of this License. If you cannot convey a
covered work so as to satisfy simultaneously your obligations under this
License and any other pertinent obligations, then as a consequence you may
not convey it at all. For example, if you agree to terms that obligate you
to collect a royalty for further conveying from those to whom you convey
the Program, the only way you could satisfy both those terms and this
License would be to refrain entirely from conveying the Program.
13. Use with the GNU Affero General Public License.
Notwithstanding any other provision of this License, you have
permission to link or combine any covered work with a work licensed
under version 3 of the GNU Affero General Public License into a single
combined work, and to convey the resulting work. The terms of this
License will continue to apply to the part which is the covered work,
but the special requirements of the GNU Affero General Public License,
section 13, concerning interaction through a network will apply to the
combination as such.
14. Revised Versions of this License.
The Free Software Foundation may publish revised and/or new versions of
the GNU General Public License from time to time. Such new versions will
be similar in spirit to the present version, but may differ in detail to
address new problems or concerns.
Each version is given a distinguishing version number. If the
Program specifies that a certain numbered version of the GNU General
Public License "or any later version" applies to it, you have the
option of following the terms and conditions either of that numbered
version or of any later version published by the Free Software
Foundation. If the Program does not specify a version number of the
GNU General Public License, you may choose any version ever published
by the Free Software Foundation.
If the Program specifies that a proxy can decide which future
versions of the GNU General Public License can be used, that proxy's
public statement of acceptance of a version permanently authorizes you
to choose that version for the Program.
Later license versions may give you additional or different
permissions. However, no additional obligations are imposed on any
author or copyright holder as a result of your choosing to follow a
later version.
15. Disclaimer of Warranty.
THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
16. Limitation of Liability.
IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
SUCH DAMAGES.
17. Interpretation of Sections 15 and 16.
If the disclaimer of warranty and limitation of liability provided
above cannot be given local legal effect according to their terms,
reviewing courts shall apply local law that most closely approximates
an absolute waiver of all civil liability in connection with the
Program, unless a warranty or assumption of liability accompanies a
copy of the Program in return for a fee.
END OF TERMS AND CONDITIONS
How to Apply These Terms to Your New Programs
If you develop a new program, and you want it to be of the greatest
possible use to the public, the best way to achieve this is to make it
free software which everyone can redistribute and change under these terms.
To do so, attach the following notices to the program. It is safest
to attach them to the start of each source file to most effectively
state the exclusion of warranty; and each file should have at least
the "copyright" line and a pointer to where the full notice is found.
<one line to give the program's name and a brief idea of what it does.>
Copyright (C) <year> <name of author>
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <https://www.gnu.org/licenses/>.
Also add information on how to contact you by electronic and paper mail.
If the program does terminal interaction, make it output a short
notice like this when it starts in an interactive mode:
<program> Copyright (C) <year> <name of author>
This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
This is free software, and you are welcome to redistribute it
under certain conditions; type `show c' for details.
The hypothetical commands `show w' and `show c' should show the appropriate
parts of the General Public License. Of course, your program's commands
might be different; for a GUI interface, you would use an "about box".
You should also get your employer (if you work as a programmer) or school,
if any, to sign a "copyright disclaimer" for the program, if necessary.
For more information on this, and how to apply and follow the GNU GPL, see
<https://www.gnu.org/licenses/>.
The GNU General Public License does not permit incorporating your program
into proprietary programs. If your program is a subroutine library, you
may consider it more useful to permit linking proprietary applications with
the library. If this is what you want to do, use the GNU Lesser General
Public License instead of this License. But first, please read
<https://www.gnu.org/licenses/why-not-lgpl.html>.
================================================
FILE: ERC/Documentation/articles/intro.md
================================================
# ERC.Net
ERC.Net is a collection of tools designed to assist in debugging Windows application crashes. ERC.Net supports both 64 and 32 bit applications, can parse DLL/EXE headers, identify compile time flags such as ASLR, DEP and SafeSEH, generate non repeating patterns, generate platform specific egg hunters, identify process information such as loaded modules and running threads, read the TEB of a specific thread, assist with identifying numerous types of memory vulnerabilities and has numerous other use cases.
## Installing
Install one of the nuget packages ([x86](https://www.nuget.org/packages/ERC.Net-x86/)/[x64](https://www.nuget.org/packages/ERC.Net-x64/)) or download the source code from [Github](https://github.com/Andy53/ERC.net), build the library and then link it in your project.
### Prerequisites
Visual studio
.Net 4.7.2
C#
### Getting Started
Below are a set of examples detailing how to use the basic functionality provided by ERC.Net
Creating a sting of non repeating characters:
```csharp
using System;
using ERC;
using ERC.Utilities;
namespace ERC_Test_App
{
class Program
{
static void Main()
{
ErcCore core = new ErcCore();
var p = PatternTools.PatternCreate(1000, core);
Console.WriteLine("Pattern:" + Environment.NewLine + p.ReturnValue);
Console.ReadKey();
}
}
}
```
Identifying the position of a sting within a non repeating string:
```csharp
using System;
using ERC;
using ERC.Utilities;
namespace ERC_Test_App
{
class Program
{
static void Main()
{
ErcCore core = new ErcCore();
var p = PatternTools.PatternOffset("Aa9", core);
Console.WriteLine("Pattern Offset:" + Environment.NewLine + p.ReturnValue);
Console.ReadKey();
}
}
}
```
Display a list of all applicable local processes:
```csharp
using System;
using System.Diagnostics;
using ERC;
namespace ERC_Test_App
{
class Program
{
static void Main()
{
ErcCore core = new ErcCore();
var test = ProcessInfo.ListLocalProcesses(core);
foreach (Process process in test.ReturnValue)
{
Console.WriteLine("Name: {0} ID: {1}", process.ProcessName, process.Id);
}
Console.WriteLine(Environment.NewLine);
Console.ReadKey();
}
}
}
```
Search Process Memory for a string (the string being searched for in "anonymous", the program being searched is notepad) and return a list of pointers to that string in process memory:
```csharp
using System;
using System.Collections.Generic;
using System.Diagnostics;
using ERC;
namespace ERC_Test_App
{
class Program
{
static void Main()
{
ErcCore core = new ErcCore();
Process[] processes = Process.GetProcesses();
Process thisProcess = null;
foreach (Process process1 in processes)
{
if (process1.ProcessName.Contains("notepad"))
{
thisProcess = process1;
}
}
ProcessInfo info = new ProcessInfo(core, thisProcess);
var listy = info.SearchMemory(1, searchString: "anonymous");
foreach (KeyValuePair<IntPtr, string> s in listy.ReturnValue)
{
Console.WriteLine("0x" + s.Key.ToString("x16") + " Filepath: " + s.Value);
}
Console.ReadKey();
}
}
}
```
An example of how to assemble mnemonics into opcodes:
```csharp
using System;
using System.Collections.Generic;
using ERC;
namespace ERC_Test_App
{
class Program
{
static void Main()
{
List<string> instructions = new List<string>();
instructions.Add("ret");
foreach (string s in instructions)
{
List<string> strings = new List<string>();
strings.Add(s);
var asmResult = ERC.Utilities.OpcodeAssembler.AssembleOpcodes(strings, MachineType.x64);
Console.WriteLine(s + " = " + BitConverter.ToString(asmResult.ReturnValue).Replace("-", ""));
}
Console.ReadKey();
}
}
}
```
An example of how to disassemble opcodes into mnemonics:
```csharp
using System;
using ERC;
namespace ERC_Test_App
{
class Program
{
static void Main()
{
byte[] opcodes = new byte[] { 0xC3 };
var result = ERC.Utilities.OpcodeDisassembler.Disassemble(opcodes, MachineType.x64);
Console.WriteLine(result.ReturnValue + Environment.NewLine);
Console.ReadKey();
}
}
}
```
Display information about all modules associated with a process:
```csharp
using System;
using ERC;
using System.Diagnostics;
using System.Collections.Generic;
using ERC.Utilities;
namespace ERC_test_app
{
class Program
{
static void Main(string[] args)
{
public static ErcCore core = new ErcCore();
Console.WriteLine("Outputting module info");
output_module_info();
Console.ReadKey();
}
public static void output_module_info()
{
Process[] processes = Process.GetProcesses();
Process thisProcess = null;
foreach (Process process1 in processes)
{
if (process1.ProcessName.Contains("notepad"))
{
thisProcess = process1;
}
}
ProcessInfo info = new ProcessInfo(core, thisProcess);
Console.WriteLine("Here");
Console.WriteLine(DisplayOutput.GenerateModuleInfoTable(info));
}
}
}
```
Generate a byte array of all possible bytes excluding 0xA1, 0xB1, 0xC1 and 0xD1 then save it to a file in C:\:
```csharp
using System;
using ERC;
namespace ERC_Test_App
{
class Program
{
static void Main()
{
ErcCore core = new ErcCore();
byte[] unwantedBytes = new byte[] { 0xA1, 0xB1, 0xC1, 0xD1 };
var bytes = DisplayOutput.GenerateByteArray(unwantedBytes, core);
Console.WriteLine(BitConverter.ToString(bytes).Replace("-", " "));
Console.ReadKey();
}
}
}
```
Return the value of all registers (Context) for a given thread:
```csharp
using System;
using System.Diagnostics;
using ERC;
namespace ERC_Test_App
{
class Program
{
static void Main()
{
ErcCore core = new ErcCore();
Process[] processes = Process.GetProcesses();
Process thisProcess = null;
foreach (Process process1 in processes)
{
if (process1.ProcessName.Contains("notepad"))
{
thisProcess = process1;
}
}
ProcessInfo info = new ProcessInfo(core, thisProcess);
for (int i = 0; i < info.ThreadsInfo.Count; i++)
{
info.ThreadsInfo[i].Get_Context();
Console.WriteLine(info.ThreadsInfo[i].Context64.ToString());
}
Console.ReadKey();
}
}
}
```
Return a pointer and mnemonics for all SEH jumps in the given process and associated modules:
```csharp
using System;
using System.Diagnostics;
using ERC;
namespace ERC_Test_App
{
class Program
{
static void Main()
{
ErcCore core = new ErcCore();
Process[] processes = Process.GetProcesses();
Process thisProcess = null;
foreach (Process process1 in processes)
{
if (process1.ProcessName.Contains("notepad"))
{
thisProcess = process1;
}
}
ProcessInfo info = new ProcessInfo(core, thisProcess);
var tester = DisplayOutput.GetSEHJumps(info);
foreach (string s in tester.ReturnValue)
{
Console.WriteLine(s);
}
Console.ReadKey();
}
}
}
```
Generate a collection of egghunters with the tag "AAAA":
```csharp
using System;
using ERC;
namespace ERC_Test_App
{
class Program
{
static void Main()
{
ErcCore core = new ErcCore();
var eggs = DisplayOutput.GenerateEggHunters(core, "AAAA");
Console.WriteLine(eggs);
Console.ReadKey();
}
}
}
```
Display the SEH chain for a thread (the process must have entered an error state for this to be populated):
```csharp
using System;
using System.Diagnostics;
using ERC;
namespace ERC_Test_App
{
class Program
{
static void Main()
{
ErcCore core = new ErcCore();
Process[] processes = Process.GetProcesses();
Process thisProcess = null;
foreach (Process process1 in processes)
{
if (process1.ProcessName.Contains("notepad"))
{
thisProcess = process1;
}
}
ProcessInfo info = new ProcessInfo(core, thisProcess);
var test = info.ThreadsInfo[0].GetSehChain();
foreach (IntPtr i in test)
{
Console.WriteLine("Ptr: {0}", i.ToString("X8"));
}
Console.ReadKey();
}
}
}
```
Find a non repeating pattern in memory and display which registers point to (or near) it:
```csharp
using System;
using System.Diagnostics;
using ERC;
namespace ERC_Test_App
{
class Program
{
static void Main()
{
ErcCore core = new ErcCore();
Process[] processes = Process.GetProcesses();
Process thisProcess = null;
foreach (Process process1 in processes)
{
if (process1.ProcessName.Contains("Vulnerable Application Name"))
{
thisProcess = process1;
}
}
ProcessInfo info = new ProcessInfo(core, thisProcess);
var strings = DisplayOutput.GenerateFindNRPTable(info, 2, false);
foreach (string s in strings)
{
Console.WriteLine(s);
}
Console.ReadKey();
}
}
}
```
Generate a 32bit ROP chain for the current process:
```csharp
using System;
using ERC;
using System.Diagnostics;
using System.Collections.Generic;
using ERC.Utilities;
namespace ERC_test_app
{
class Program
{
static void Main(string[] args)
{
public static ErcCore core = new ErcCore();
Console.WriteLine("Generate RopChain 32");
GenerateRopChain32();*/
Console.ReadKey();
}
public static void GenerateRopChain32()
{
Process[] processes = Process.GetProcesses();
Process thisProcess = null;
foreach (Process process1 in processes)
{
if (process1.ProcessName.Contains("Word"))
{
thisProcess = process1;
}
}
ProcessInfo info = new ProcessInfo(core, thisProcess);
RopChainGenerator32 RCG = new RopChainGenerator32(info);
RCG.GenerateRopChain32();
}
}
}
```
## Versioning
We use [SemVer](http://semver.org/) for versioning. For the versions available, see the [tags on this repository](https://github.com/Andy53/ERC.net/tags).
## Authors
* **Andy Bowden** - [Andy53](https://github.com/Andy53)
## License
This project is licensed under the GNU General Public License v3.0 - see the [LICENSE.md](LICENSE.md) file for details
## Acknowledgments
* Hat tip to anyone whose code was used
* Inspiration
* Other things
================================================
FILE: ERC/Documentation/articles/toc.yml
================================================
- name: Introduction
href: intro.md
================================================
FILE: ERC/Documentation/docfx.json
================================================
{
"metadata": [
{
"src": [
{
"files": [
"**/**.cs",
"**/**.csproj"
],
"src": ".."
}
],
"dest": "api",
"disableGitFeatures": false,
"disableDefaultFilter": false
}
],
"build": {
"content": [
{
"files": [
"api/**.yml",
"api/index.md"
]
},
{
"files": [
"articles/**.md",
"articles/**/toc.yml",
"toc.yml",
"*.md",
"**/**"
]
}
],
"resource": [
{
"files": [
"images/**"
]
}
],
"overwrite": [
{
"files": [
"apidoc/**"
],
"exclude": [
"obj/**",
"_site/**"
]
}
],
"dest": "_site",
"globalMetadataFiles": [],
"fileMetadataFiles": [],
"template": [
"default"
],
"postProcessors": [],
"markdownEngineName": "markdig",
"noLangKeyword": false,
"keepFileLink": false,
"cleanupCacheHistory": false,
"disableGitFeatures": false
}
}
================================================
FILE: ERC/Documentation/index.md
================================================
# ERC.Net API Documentation.
Full documentation for the ERC.Net API can be found by clicking the "API Documentation" button in the nav bar above. A description of how to use the library along with some code samples can be found in the "Articles" section.
<!--
# This is the **HOMEPAGE**.
Refer to [Markdown](http://daringfireball.net/projects/markdown/) for how to write markdown files.
## Quick Start Notes:
1. Add images to the *images* folder if the file is referencing an image.
-->
================================================
FILE: ERC/Documentation/toc.yml
================================================
- name: Articles
href: articles/
- name: Api Documentation
href: api/
homepage: api/index.md
================================================
FILE: ERC/ERC/.gitignore
================================================
###############
# folder #
###############
/**/DROP/
/**/TEMP/
/**/packages/
_site
================================================
FILE: ERC/ERC/Convert.cs
================================================
using System;
using System.Globalization;
using System.Linq;
using System.Text;
namespace ERC.Utilities
{
/// <summary>
/// Static class containing methods for common conversions.
/// </summary>
public static class Convert
{
const string HEX_CHARS = "abcdefABCDEF1234567890";
#region Hex
/// <summary>
/// Converts a hex string to ASCII."
/// </summary>
/// <param name="hex">A string containing hex characters.</param>
/// <returns>A string containing the equivalent ASCII values</returns>
public static string HexToAscii(string hex)
{
if (hex.Length % 2 != 0)
{
hex = "0" + hex;
}
foreach (char c in hex)
{
if (!HEX_CHARS.Contains(c))
{
return string.Empty;
}
}
try
{
string ascii = string.Empty;
for (int i = 0; i < hex.Length; i += 2)
{
String hs = string.Empty;
hs = hex.Substring(i, 2);
uint decval = System.Convert.ToUInt32(hs, 16);
char character = System.Convert.ToChar(decval);
ascii += character;
}
return ascii;
}
catch (Exception ex) { Console.WriteLine(ex.Message); }
return string.Empty;
}
/// <summary>
/// Converts a hex string to the equivalent bytes.
/// </summary>
/// <param name="hex">A string containing hex characters.</param>
/// <returns>A byte array containing the associated values.</returns>
public static byte[] HexToBytes(string hex)
{
if (hex.Length % 2 != 0)
{
hex = "0" + hex;
}
byte[] bytes = new byte[hex.Length / 2];
for (int index = 0; index < bytes.Length; index++)
{
string byteValue = hex.Substring(index * 2, 2);
bytes[index] = byte.Parse(byteValue, NumberStyles.HexNumber, CultureInfo.InvariantCulture);
}
return bytes;
}
#endregion
#region Ascii
/// <summary>
/// Converts an ASCII string to a byte array.
/// </summary>
/// <param name="ascii">An ASCII string.</param>
/// <returns>A byte array containing the associated values.</returns>
public static byte[] AsciiToBytes(string ascii)
{
return Encoding.ASCII.GetBytes(ascii);
}
/// <summary>
/// Converts an ASCII string to a hex string
/// </summary>
/// <param name="ascii">An ASCII string.</param>
/// <returns>A hex string.</returns>
public static string AsciiToHex(string ascii)
{
return BitConverter.ToString(Encoding.ASCII.GetBytes(ascii)).Replace("-", " ");
}
#endregion
#region Unicode
/// <summary>
/// Converts a Unicode string to a byte array.
/// </summary>
/// <param name="unicode">A Unicode string.</param>
/// <returns>A byte array.</returns>
public static byte[] UnicodeToBytes(string unicode)
{
return Encoding.Unicode.GetBytes(unicode);
}
/// <summary>
/// Converts a Unicode string to a hex string.
/// </summary>
/// <param name="unicode">A Unicode string.</param>
/// <returns>A hex string.</returns>
public static string UnicodeToHex(string unicode)
{
return BitConverter.ToString(Encoding.Unicode.GetBytes(unicode)).Replace("-", " ");
}
#endregion
#region UTF7
/// <summary>
/// Converts a UTF-7 string to a byte array.
/// </summary>
/// <param name="utf7">A UTF-7 string.</param>
/// <returns>A byte array.</returns>
public static byte[] UTF7ToBytes(string utf7)
{
return Encoding.UTF7.GetBytes(utf7);
}
/// <summary>
/// Converts a UTF-7 string to a hex string.
/// </summary>
/// <param name="utf7">A UTF-7 string.</param>
/// <returns>A hex string.</returns>
public static string UTF7ToHex(string utf7)
{
return BitConverter.ToString(Encoding.UTF7.GetBytes(utf7)).Replace("-", " ");
}
#endregion
#region UTF8
/// <summary>
/// Converts a UTF-8 string to a byte array.
/// </summary>
/// <param name="utf8">A UTF-8 string.</param>
/// <returns>A byte array.</returns>
public static byte[] UTF8ToBytes(string utf8)
{
return Encoding.UTF8.GetBytes(utf8);
}
/// <summary>
/// Converts a UTF-8 string to a hex string.
/// </summary>
/// <param name="utf8">A UTF-8 string.</param>
/// <returns>A hex string.</returns>
public static string UTF8ToHex(string utf8)
{
return BitConverter.ToString(Encoding.UTF8.GetBytes(utf8)).Replace("-", " ");
}
#endregion
#region UTF32
/// <summary>
/// Converts a UTF-32 string to a byte array.
/// </summary>
/// <param name="utf32">A UTF-32 string.</param>
/// <returns>A byte array.</returns>
public static byte[] UTF32ToBytes(string utf32)
{
return Encoding.UTF32.GetBytes(utf32);
}
/// <summary>
/// Converts a UTF-32 string to a hex string.
/// </summary>
/// <param name="utf32">A UTF-32 string.</param>
/// <returns>A hex string.</returns>
public static string UTF32ToHex(string utf32)
{
return BitConverter.ToString(Encoding.UTF32.GetBytes(utf32)).Replace("-", " ");
}
#endregion
#region HTML
/// <summary>
/// Converts the spaces in a string to Html fixed width character.
/// </summary>
/// <param name="str">A UTF-8 string.</param>
/// <returns>A string with spaces converted to HTML entities.</returns>
public static string htmlWhitespaceFix(string str)
{
return str.Replace(" ", " ");
}
#endregion
}
}
================================================
FILE: ERC/ERC/Display_Output.cs
================================================
using ERC.Utilities;
using System;
using System.Collections.Generic;
using System.Diagnostics;
using System.IO;
using System.Linq;
using System.Text;
using System.Text.RegularExpressions;
using Convert = ERC.Utilities.Convert;
namespace ERC
{
/// <summary> Provides output in various human readable formats of data from the library. </summary>
public static class DisplayOutput
{
#region GetFilePath
/// <summary>
/// Identifies output files previously created by a the Display_Modules function
/// and identifies the last number used. Returns the next number to be used as a filename.
/// </summary>
/// <param name="directory">The directory to be used</param>
/// <param name="prefix">A prefix for the file name e.g. "modules_" or "Pattern_" etc</param>
/// <param name="extension">The file extension to be used e.g. ".txt" </param>
/// <returns>Returns a string containing the full file path to be used when writing output to disk</returns>
internal static string GetFilePath(string directory, string prefix, string extension)
{
string result = "";
int fileNumber = 0;
char[] delimiterChars = { '_', '.' };
DirectoryInfo d = new DirectoryInfo(directory);
FileInfo[] files = d.GetFiles(prefix + "*");
foreach (FileInfo f in files)
{
string fileNumberString = Regex.Match(f.Name, @"\d+").Value;
if (fileNumber < int.Parse(fileNumberString))
{
fileNumber = int.Parse(fileNumberString);
}
}
fileNumber++;
result = directory + prefix + fileNumber.ToString() + extension;
return result;
}
#endregion
#region WriteToFile
/// <summary>
/// Writes a list of strings to a file. Takes a directory, filename and prefix along with a List of strings.
/// </summary>
/// <param name="directory">The directory to be used</param>
/// <param name="prefix">A prefix for the file name e.g. "modules_" or "Pattern_" etc</param>
/// <param name="extension">The file extension to be used e.g. ".txt" </param>
/// <param name="content">A list of strings to be written to disk </param>
public static void WriteToFile(string directory, string prefix, string extension, List<string> content)
{
string path = GetFilePath(directory, prefix, extension);
TextWriter tw = new StreamWriter(path);
foreach (String s in content)
tw.WriteLine(s);
tw.Close();
}
#endregion
#region Generate Pattern
/// <summary>
/// Creates a file in the ErcCore working directory containing a string of non repeating characters.
/// </summary>
/// <param name="length">The length of the string to be created</param>
/// <param name="core">An ErcCore object</param>
/// <param name="extended">A optional boolean specifying whether to use the extended character set. Default is false.</param>
/// <returns>Returns a string containing the pattern generated.</returns>
public static string GeneratePattern(int length, ErcCore core, bool extended = false)
{
var patternFilePath = GetFilePath(core.WorkingDirectory, "Pattern_Create_", ".txt");
var pattern = PatternTools.PatternCreate(length, core, extended);
if(pattern.Error != null)
{
throw pattern.Error;
}
var patternOutput = PatternOutputBuilder(pattern.ReturnValue, core);
File.WriteAllText(patternFilePath, patternOutput);
return patternOutput;
}
#endregion
#region Pattern Output
/// <summary>
/// Private function, should not be called directly. Takes input from pattern_create and outputs in an easily readable format.
/// </summary>
/// <param name="pattern">The pattern to be used</param>
/// <param name="core">An ErcCore object</param>
/// <returns>Returns a string containing the human readable output of the pattern create method.</returns>
private static string PatternOutputBuilder(string pattern, ErcCore core)
{
byte[] bytes = Encoding.ASCII.GetBytes(pattern);
string hexPattern = BitConverter.ToString(bytes);
string asciiPattern = " ";
string[] hexArray = hexPattern.Split('-');
for (int i = 0; i < hexArray.Length; i++)
{
asciiPattern += pattern[i];
if (i % 88 == 0 && i > 0)
{
asciiPattern += "\"";
asciiPattern += Environment.NewLine;
asciiPattern += "\"";
}
}
hexPattern = " ";
for (int i = 0; i < hexArray.Length; i++)
{
hexPattern += "\\x" + hexArray[i];
if (i % 22 == 0 && i > 0)
{
hexPattern += Environment.NewLine;
}
}
asciiPattern = asciiPattern.TrimStart(' ');
hexPattern = hexPattern.TrimStart(' ');
string output = "";
output += "------------------------------------------------------------------------------------------" + Environment.NewLine;
output += "Pattern created at: " + DateTime.Now + ". Pattern created by: " + core.Author + ". Pattern length: " + pattern.Length + Environment.NewLine;
output += "------------------------------------------------------------------------------------------" + Environment.NewLine;
output += Environment.NewLine;
output += "Ascii:" + Environment.NewLine;
output += "\"" + asciiPattern + "\"" + Environment.NewLine;
output += Environment.NewLine;
output += "Hexadecimal:" + Environment.NewLine;
output += hexPattern;
return output;
}
#endregion
#region List Local Processes
/// <summary>
/// Lists usable processes running on the local machine.
/// </summary>
/// <returns>A string containing details of processes running on the local machine.</returns>
public static string ListLocalProcesses()
{
var processes = ProcessInfo.ListLocalProcesses(new ErcCore());
string processDetails = "";
if (processes.Error != null)
{
return processes.Error.Message;
}
foreach(Process p in processes.ReturnValue)
{
processDetails += p.ProcessName + " ID: " + p.Id + " Filename: " + p.MainWindowTitle + Environment.NewLine;
}
return processDetails;
}
#endregion
#region List Remote Processes
/// <summary>
/// Lists usable processes running on the remote machine.
/// </summary>
/// <returns>A string containing details of processes running on the remote machine.</returns>
public static string ListRemoteProcesses(string machineName)
{
var processes = ProcessInfo.ListRemoteProcesses(new ErcCore(), machineName);
string processDetails = "";
if (processes.Error != null)
{
return processes.Error.Message;
}
foreach (Process p in processes.ReturnValue)
{
processDetails += p.ProcessName + " ID: " + p.Id + " Filename: " + p.MainWindowTitle + Environment.NewLine;
}
return processDetails;
}
#endregion
#region DisplayProcessInfo
/// <summary>
/// Displays information related to the provided ProcessInfo object.
/// </summary>
/// <param name="info">The ProcessInfo object of which the module information will be displayed</param>
/// <param name="outputToFile">Set to false to surpress file output.</param>
/// <returns></returns>
public static string DisplayProcessInfo(ProcessInfo info, bool outputToFile = true)
{
string information = "Process Information: " + info.ProcessName + Environment.NewLine;
information += "------------------------------------------------------------------------------------------------------------------------" + Environment.NewLine;
information += info.ToString();
information += Environment.NewLine;
information += GenerateModuleInfoTable(info, false);
information += Environment.NewLine;
information += DisplayThreadInfo(info, false);
if (outputToFile == true)
{
string processFilename = GetFilePath(info.WorkingDirectory, "process_info_", ".txt");
File.WriteAllText(processFilename, information);
}
return information;
}
#endregion
#region DisplayThreadInfo
/// <summary>
/// Displays information about all threads related to a specific process.
/// </summary>
/// <param name="info"></param>
/// <param name="outputToFile"></param>
/// <returns></returns>
public static string DisplayThreadInfo(ProcessInfo info, bool outputToFile = true)
{
string information = "Thread Information for Process: " + info.ProcessName + Environment.NewLine;
information += "------------------------------------------------------------------------------------------------------------------------" + Environment.NewLine;
var threads = info.GetProcessThreadInformation();
foreach(ThreadInfo t in threads.ReturnValue)
{
information += "Thread ID = " + t.ThreadID + Environment.NewLine;
var teb = t.GetTeb();
if (t.X64 == MachineType.x64)
{
information += " Thread Handle = " + "0x" + t.ThreadHandle.ToString("x16") + Environment.NewLine;
information += " Thread is running in a 64 bit process = true" + Environment.NewLine;
information += " Top of stack = " + "0x" + teb.TopOfStack.ToString("x16") + Environment.NewLine;
information += " Bottom of stack = " + "0x" + teb.BottomOfStack.ToString("x16") + Environment.NewLine;
}
else
{
information += " Thread Handle = " + "0x" + t.ThreadHandle.ToString("x8") + Environment.NewLine;
information += " Thread is running in a 64 bit process = false" + Environment.NewLine;
information += " Top of stack = " + "0x" + teb.TopOfStack.ToString("x8") + Environment.NewLine;
information += " Bottom of stack = " + "0x" + teb.BottomOfStack.ToString("x8") + Environment.NewLine;
}
information += Environment.NewLine;
}
if(outputToFile == true)
{
string threadFilename = GetFilePath(info.WorkingDirectory, "threads_", ".txt");
File.WriteAllText(threadFilename, information);
}
return information;
}
#endregion
#region DisplayModuleInfo
/// <summary>
/// Displays a list of all modules and associated information from a specific process. Can output to stdout, a file or both.
/// </summary>
/// <param name="info">The ProcessInfo object of which the module information will be displayed</param>
/// <returns>Returns a string containing all module info from a specific process</returns>
internal static string DisplayModuleInfo(ProcessInfo info)
{
int ptrSegmentWidth = 16;
int flagSegmentWidth = 10;
string output = "";
output += "------------------------------------------------------------------------------------------------------------------------" + Environment.NewLine;
if (info.Author != "No_Author_Set")
{
output += "Process Name: " + info.ProcessName + " Pattern created by: " + info.Author + " " +
"Modules total: " + info.ModulesInfo.Count + Environment.NewLine;
}
else
{
output += "Process Name: " + info.ProcessName + " Modules total: " + info.ModulesInfo.Count + Environment.NewLine;
}
output += "------------------------------------------------------------------------------------------------------------------------" + Environment.NewLine;
output += " Base | Entry point | Size | Rebase | SafeSEH | ASLR | NXCompat | OS DLL | Version, Name and Path" + Environment.NewLine;
output += "------------------------------------------------------------------------------------------------------------------------" + Environment.NewLine;
foreach (ModuleInfo module in info.ModulesInfo)
{
string baseElement = " ";
baseElement += "0x" + module.ModuleBase.ToString("x");
for (int i = baseElement.Length; i < ptrSegmentWidth; i++)
{
baseElement += " ";
}
string entryElement = " ";
entryElement += "0x" + module.ModuleEntry.ToString("x");
for (int i = entryElement.Length; i < ptrSegmentWidth; i++)
{
entryElement += " ";
}
string sizeElement = " ";
sizeElement += "0x" + module.ModuleSize.ToString("x");
for (int i = sizeElement.Length; i < flagSegmentWidth; i++)
{
sizeElement += " ";
}
string rebaseElement = " ";
if (module.ModuleRebase == true)
{
rebaseElement += "True ";
}
else
{
rebaseElement += "False ";
}
string sehElement = " ";
if (module.ModuleSafeSEH == true)
{
sehElement += "True ";
}
else
{
sehElement += "False ";
}
string aslrElement = " ";
if (module.ModuleASLR == true)
{
aslrElement += "True ";
}
else
{
aslrElement += "False ";
}
string nxElement = " ";
if (module.ModuleNXCompat == true)
{
nxElement += "True ";
}
else
{
nxElement += "False ";
}
string osElement = " ";
if (module.ModuleOsDll == true)
{
osElement += "True ";
}
else
{
osElement += "False ";
}
string fileElement = " ";
if (!string.IsNullOrEmpty(module.ModuleVersion))
{
fileElement += module.ModuleVersion + ";";
}
if (!string.IsNullOrEmpty(module.ModuleName))
{
fileElement += module.ModuleName + ";";
}
if (!string.IsNullOrEmpty(module.ModulePath))
{
fileElement += module.ModulePath;
}
output += baseElement + entryElement + sizeElement + rebaseElement +
sehElement + aslrElement + nxElement + osElement + fileElement + Environment.NewLine;
}
return output;
}
#endregion
#region GenerateModuleInfoTable
/// <summary>
/// Aquires filename and writes out all module data to the current working directory. Requires a Process_Info object to be passed as a parameter.
/// </summary>
/// <param name="info">The ProcessInfo object of which the module information will be displayed</param>
/// <param name="outputToFile">Set to false to surpress file output.</param>
/// <returns>Returns a formatted string of all results</returns>
public static string GenerateModuleInfoTable(ProcessInfo info, bool outputToFile = true)
{
string modOutput = DisplayModuleInfo(info);
string modFilename = GetFilePath(info.WorkingDirectory, "modules_", ".txt");
if(outputToFile == true)
{
File.WriteAllText(modFilename, modOutput);
}
return modOutput;
}
#endregion
#region SearhMemory
/// <summary>
/// Searches the memory of a process and it's loaded modules for a string or byte combination.
/// </summary>
/// <param name="info">The processInfo object for the process</param>
/// <param name="searchType">The type of data to be searched for.</param>
/// <param name="searchString">The string to search for.</param>
/// <param name="aslr">Remove ASLR libraries.</param>
/// <param name="safeseh">Remove SafeSEH libraries.</param>
/// <param name="rebase">Remove rebasable libraries.</param>
/// <param name="nxcompat">Remove NXCompat libraries.</param>
/// <param name="osdll">Remove OS Dlls.</param>
/// <param name="unwantedBytes">Addresses containing values in this byte array will be ignored.</param>
/// <param name="protection">String array containing protection level returned pointers will.</param>
/// <returns></returns>
public static string[] SearchMemory(ProcessInfo info, int searchType, string searchString, bool aslr = false,
bool safeseh = false, bool rebase = false, bool nxcompat = false, bool osdll = false,
byte[] unwantedBytes = null, string protection = "exec")
{
List<string> excludedModules = info.CreateExcludesList(aslr, safeseh, rebase, nxcompat, osdll);
Dictionary<IntPtr, string> result = new Dictionary<IntPtr, string>();
if (searchType == 0)
{
byte[] searchBytes = StringToByteArray(searchString.Replace(" ", ""));
result = info.SearchMemory(searchType, searchBytes, null, excludedModules).ReturnValue;
}
else
{
result = info.SearchMemory(searchType, null, searchString, excludedModules).ReturnValue;
}
if (unwantedBytes != null)
{
List<IntPtr> p = new List<IntPtr>();
foreach (KeyValuePair<IntPtr, string> k in result)
{
p.Add(k.Key);
}
List<string> outText = new List<string>();
var pt = PtrRemover.RemovePointers(info.ProcessMachineType, p, unwantedBytes);
pt = PtrRemover.RemovePointersProtection(info, pt, protection);
foreach (KeyValuePair<IntPtr, string> k in result.ToList())
{
if (!pt.Contains(k.Key))
{
result.Remove(k.Key);
}
}
}
else
{
List<IntPtr> p = new List<IntPtr>();
foreach (KeyValuePair<IntPtr, string> k in result)
{
p.Add(k.Key);
}
var pt = PtrRemover.RemovePointersProtection(info, p, protection);
foreach (KeyValuePair<IntPtr, string> k in result.ToList())
{
if (!pt.Contains(k.Key))
{
result.Remove(k.Key);
}
}
}
List<string> output = new List<string>();
output.Add(String.Format("List created on {0} by {1}. Search string: {2}", DateTime.Now, info.Author, searchString));
output.Add("----------------------------------------------------------------------");
if (info.ProcessMachineType == MachineType.I386)
{
output.Add(" Address | ASLR | SafeSEH | Rebase | NXCompat | OsDLL | Module Path");
}
else
{
output.Add(" Address | ASLR | SafeSEH | Rebase | NXCompat | OsDLL | Module Path");
}
output.Add("----------------------------------------------------------------------");
foreach (KeyValuePair<IntPtr, string> v in result)
{
for (int i = 0; i < info.ModulesInfo.Count; i++)
{
if (info.ProcessMachineType == ERC.MachineType.I386)
{
if (info.ModulesInfo[i].ModulePath == v.Value)
{
output.Add(String.Format("0x{0} | {1} | {2} | {3} | {4} | {5} | {6}",
v.Key.ToString("X8"), info.ModulesInfo[i].ModuleASLR, info.ModulesInfo[i].ModuleSafeSEH,
info.ModulesInfo[i].ModuleRebase, info.ModulesInfo[i].ModuleNXCompat, info.ModulesInfo[i].ModuleOsDll,
info.ModulesInfo[i].ModulePath));
}
}
else
{
if (info.ModulesInfo[i].ModulePath == v.Value)
{
output.Add(String.Format("0x{0} | {1} | {2} | {3} | {4} | {5} | {6}",
v.Key.ToString("X16"), info.ModulesInfo[i].ModuleASLR, info.ModulesInfo[i].ModuleSafeSEH,
info.ModulesInfo[i].ModuleRebase, info.ModulesInfo[i].ModuleNXCompat, info.ModulesInfo[i].ModuleOsDll,
info.ModulesInfo[i].ModulePath));
}
}
}
}
WriteToFile(info.WorkingDirectory, "MemorySearch", ".txt", output);
return output.ToArray();
}
#endregion
#region SearchModules
/// <summary>
/// Searches the loaded modules of a process for a string or byte combination.
/// </summary>
/// <param name="info">The processInfo object for the process</param>
/// <param name="searchType">The type of data to be searched for.</param>
/// <param name="searchString">The string to search for.</param>
/// <param name="aslr">Remove ASLR libraries.</param>
/// <param name="safeseh">Remove SafeSEH libraries.</param>
/// <param name="rebase">Remove rebasable libraries.</param>
/// <param name="nxcompat">Remove NXCompat libraries.</param>
/// <param name="osdll">Remove OS Dlls.</param>
/// <param name="unwantedBytes">Addresses containing values in this byte array will be ignored.</param>
/// <param name="modules">List of modules to be searched</param>
/// <param name="protection">String array containing protection level returned pointers will.</param>
/// <returns></returns>
public static string[] SearchModules(ProcessInfo info, int searchType, string searchString, bool aslr = false,
bool safeseh = false, bool rebase = false, bool nxcompat = false, bool osdll = false,
byte[] unwantedBytes = null, List<string> modules = null, string protection = "exec")
{
List<string> excludedModules = info.CreateExcludesList(aslr, safeseh, rebase, nxcompat, osdll);
Dictionary<IntPtr, string> result = new Dictionary<IntPtr, string>();
if (searchType == 0)
{
byte[] searchBytes = StringToByteArray(searchString.Replace(" ", ""));
result = info.SearchModules(searchType, unwantedBytes, searchBytes, null, modules, excludedModules).ReturnValue;
}
else
{
result = info.SearchModules(searchType, unwantedBytes, null, searchString, modules, excludedModules).ReturnValue;
}
if (unwantedBytes != null)
{
List<IntPtr> p = new List<IntPtr>();
foreach (KeyValuePair<IntPtr, string> k in result)
{
p.Add(k.Key);
}
var pt = PtrRemover.RemovePointers(info.ProcessMachineType, p, unwantedBytes);
pt = PtrRemover.RemovePointersProtection(info, pt, protection);
foreach (KeyValuePair<IntPtr, string> k in result.ToList())
{
if (!pt.Contains(k.Key))
{
result.Remove(k.Key);
}
}
}
else
{
List<IntPtr> p = new List<IntPtr>();
foreach (KeyValuePair<IntPtr, string> k in result)
{
p.Add(k.Key);
}
var pt = PtrRemover.RemovePointersProtection(info, p, protection);
foreach (KeyValuePair<IntPtr, string> k in result.ToList())
{
if (!pt.Contains(k.Key))
{
result.Remove(k.Key);
}
}
}
List<string> output = new List<string>();
output.Add(String.Format("List created on {0} by {1}. Search string: {2}", DateTime.Now, info.Author, searchString));
output.Add("----------------------------------------------------------------------");
if (info.ProcessMachineType == MachineType.I386)
{
output.Add(" Address | ASLR | SafeSEH | Rebase | NXCompat | OsDLL | Module Path");
}
else
{
output.Add(" Address | ASLR | SafeSEH | Rebase | NXCompat | OsDLL | Module Path");
}
output.Add("----------------------------------------------------------------------");
foreach (KeyValuePair<IntPtr, string> v in result)
{
for (int i = 0; i < info.ModulesInfo.Count; i++)
{
if (info.ProcessMachineType == MachineType.I386)
{
if (info.ModulesInfo[i].ModulePath == v.Value)
{
output.Add(String.Format("0x{0} | {1} | {2} | {3} | {4} | {5} | {6}",
v.Key.ToString("X8"), info.ModulesInfo[i].ModuleASLR, info.ModulesInfo[i].ModuleSafeSEH,
info.ModulesInfo[i].ModuleRebase, info.ModulesInfo[i].ModuleNXCompat, info.ModulesInfo[i].ModuleOsDll,
info.ModulesInfo[i].ModulePath));
}
}
else
{
if (info.ModulesInfo[i].ModulePath == v.Value)
{
output.Add(String.Format("0x{0} | {1} | {2} | {3} | {4} | {5} | {6}",
v.Key.ToString("X16"), info.ModulesInfo[i].ModuleASLR, info.ModulesInfo[i].ModuleSafeSEH,
info.ModulesInfo[i].ModuleRebase, info.ModulesInfo[i].ModuleNXCompat, info.ModulesInfo[i].ModuleOsDll,
info.ModulesInfo[i].ModulePath));
}
}
}
}
WriteToFile(info.WorkingDirectory, "ModuleSearch", ".txt", output);
return output.ToArray();
}
#endregion
#region GetSEHJumps
/// <summary>
/// Searches all memory associated with a given process and associated modules for POP X POP X RET instructions.
/// Passing a list of module paths or names will exclude those modules from the search.
/// Similar to Search_All_Memory_PPR however provides output in an easily readable format.
/// </summary>
/// <param name="info">The ProcessInfo object which will be searched for POP POP RET instructions.</param>
/// <param name="aslr">Remove ASLR libraries.</param>
/// <param name="safeseh">Remove SafeSEH libraries.</param>
/// <param name="rebase">Remove rebasable libraries.</param>
/// <param name="nxcompat">Remove NXCompat libraries.</param>
/// <param name="osdll">Remove OS Dlls.</param>
/// <param name="unwantedBytes">Addresses containing values in this byte array will be ignored.</param>
/// <param name="protection">String containing protection level returned pointers will.</param>
/// <returns>Returns an array of strings detailing the pointers, opcodes and base files of suitable instruction sets.</returns>
public static string[] GetSEHJumps(ProcessInfo info, bool aslr = false,
bool safeseh = false, bool rebase = false, bool nxcompat = false, bool osdll = false,
byte[] unwantedBytes = null, string protection = "exec")
{
List<string> ret = new List<string>();
List<string> excludedModules = info.CreateExcludesList(aslr, safeseh, rebase, nxcompat, osdll);
ErcResult<Dictionary<IntPtr, string>> ptrs = info.SearchAllMemoryPPR(excludedModules);
if (unwantedBytes != null)
{
List<IntPtr> p = new List<IntPtr>();
foreach(KeyValuePair<IntPtr, string> k in ptrs.ReturnValue)
{
p.Add(k.Key);
}
var pt = ERC.Utilities.PtrRemover.RemovePointers(info.ProcessMachineType, p, unwantedBytes);
pt = ERC.Utilities.PtrRemover.RemovePointersProtection(info, pt, protection);
foreach (KeyValuePair<IntPtr, string> k in ptrs.ReturnValue.ToList())
{
if (!pt.Contains(k.Key))
{
ptrs.ReturnValue.Remove(k.Key);
}
}
}
else
{
List<IntPtr> p = new List<IntPtr>();
foreach (KeyValuePair<IntPtr, string> k in ptrs.ReturnValue)
{
p.Add(k.Key);
}
var pt = ERC.Utilities.PtrRemover.RemovePointersProtection(info, p, protection);
foreach (KeyValuePair<IntPtr, string> k in ptrs.ReturnValue.ToList())
{
if (!pt.Contains(k.Key))
{
ptrs.ReturnValue.Remove(k.Key);
}
}
}
string sehFilename = GetFilePath(info.WorkingDirectory, "SEH_jumps_", ".txt");
ret.Add("---------------------------------------------------------------------------------------");
if (info.Author != "No_Author_Set")
{
ret.Add("Process Name: " + info.ProcessName + " Created by: " + info.Author + " " +
"Total Results: " + ptrs.ReturnValue.Count);
}
else
{
ret.Add("Process Name: " + info.ProcessName + " Total Results: " + ptrs.ReturnValue.Count);
}
ret.Add("---------------------------------------------------------------------------------------");
if (ptrs.Error != null)
{
throw new Exception("Error passed from Search_All_Memory_PPR: " + ptrs.Error.ToString());
}
if (info.ProcessMachineType == ERC.MachineType.I386)
{
ret.Add(" Address | Instructions | ASLR | SafeSEH | Rebase | NXCompat | OsDLL | Module Path");
}
else
{
ret.Add(" Address | Instructions | ASLR | SafeSEH | Rebase | NXCompat | OsDLL | Module Path");
}
byte[] ppr = new byte[5];
int bytesread = 0;
if(ptrs.ReturnValue.Count > 0)
{
foreach (KeyValuePair<IntPtr, string> s in ptrs.ReturnValue)
{
string holder = "";
List<byte> opcodes = new List<byte>();
try
{
ErcCore.ReadProcessMemory(info.ProcessHandle, s.Key, ppr, ppr.Length, out bytesread);
for (int i = 0; i < 5; i++)
{
if (ppr[i].Equals(0xC3))
{
for (int j = 0; j <= i; j++)
{
opcodes.Add(ppr[j]);
}
ERC.Utilities.OpcodeDisassembler disas = new ERC.Utilities.OpcodeDisassembler(info);
var result = disas.Disassemble(opcodes.ToArray());
if (info.ProcessMachineType == ERC.MachineType.I386)
{
holder = result.ReturnValue.Replace(Environment.NewLine, ", ");
int index = holder.IndexOf("ret");
holder = holder.Substring(0, index + 3);
holder = "0x" + s.Key.ToString("x8") + " | " + holder + " ";
}
else
{
holder = result.ReturnValue.Replace(Environment.NewLine, ", ");
int index = holder.IndexOf("ret");
holder = holder.Substring(0, index + 3);
holder = "0x" + s.Key.ToString("x16") + " | " + holder + " ";
}
opcodes.Clear();
}
}
}
catch (Exception e)
{
throw e;
}
for (int i = 0; i < info.ModulesInfo.Count; i++)
{
if (info.ModulesInfo[i].ModulePath == s.Value)
{
holder += String.Format("| {0} | {1} | {2} | {3} | {4} | {5} ",
info.ModulesInfo[i].ModuleASLR, info.ModulesInfo[i].ModuleSafeSEH,
info.ModulesInfo[i].ModuleRebase, info.ModulesInfo[i].ModuleNXCompat, info.ModulesInfo[i].ModuleOsDll,
info.ModulesInfo[i].ModulePath);
}
}
ret.Add(holder);
}
}
else
{
ret.Add("No compliant POP POP RET instuctions were found.");
}
File.WriteAllLines(sehFilename, ret);
return ret.ToArray();
}
/// <summary>
/// Searches all memory associated with a given process and associated modules for POP X POP X RET instructions.
/// Passing a list of module paths or names will exclude those modules from the search.
/// Similar to Search_All_Memory_PPR however provides output in an easily readable format.
/// </summary>
/// <param name="info">The ProcessInfo object which will be searched for POP POP RET instructions</param>
/// <param name="ptrsToExclude">Ptrs containing these byte values will be discarded.</param>
/// <param name="excludes">Modules to be ignored when searching for the instruction sets.</param>
/// <returns>Returns an array of strings detailing the pointers, opcodes and base files of suitable instruction sets.</returns>
public static string[] GetSEHJumps(ProcessInfo info, byte[] ptrsToExclude, List<string> excludes = null)
{
List<string> ret = new List<string>();
ErcResult<Dictionary<IntPtr, string>> ptrs = info.SearchAllMemoryPPR(ptrsToExclude, excludes);
string sehFilename = GetFilePath(info.WorkingDirectory, "SEH_jumps_", ".txt");
ret.Add("---------------------------------------------------------------------------------------");
if (info.Author != "No_Author_Set")
{
ret.Add("Process Name: " + info.ProcessName + " Created by: " + info.Author + " " +
"Total Jumps: " + ptrs.ReturnValue.Count);
}
else
{
ret.Add("Process Name: " + info.ProcessName + " Total Jumps: " + ptrs.ReturnValue.Count);
}
ret.Add("---------------------------------------------------------------------------------------");
if (ptrs.Error != null)
{
throw new Exception("Error passed from Search_All_Memory_PPR: " + ptrs.Error.ToString());
}
if (info.ProcessMachineType == ERC.MachineType.I386)
{
ret.Add(" Address | Instructions | ASLR | SafeSEH | Rebase | NXCompat | OsDLL | Module Path");
}
else
{
ret.Add(" Address | Instructions | ASLR | SafeSEH | Rebase | NXCompat | OsDLL | Module Path");
}
byte[] ppr = new byte[5];
int bytesread = 0;
if(ptrs.ReturnValue.Count > 0)
{
foreach (KeyValuePair<IntPtr, string> s in ptrs.ReturnValue)
{
string holder = "";
List<byte> opcodes = new List<byte>();
try
{
ErcCore.ReadProcessMemory(info.ProcessHandle, s.Key, ppr, ppr.Length, out bytesread);
for (int i = 0; i < 5; i++)
{
if (ppr[i].Equals(0xC3))
{
for (int j = 0; j <= i; j++)
{
opcodes.Add(ppr[j]);
}
ERC.Utilities.OpcodeDisassembler disas = new ERC.Utilities.OpcodeDisassembler(info);
var result = disas.Disassemble(opcodes.ToArray());
if (info.ProcessMachineType == ERC.MachineType.I386)
{
holder = result.ReturnValue.Replace(Environment.NewLine, ", ");
int index = holder.IndexOf("ret");
holder = holder.Substring(0, index + 3);
holder = "0x" + s.Key.ToString("x8") + " | " + holder + " ";
}
else
{
holder = result.ReturnValue.Replace(Environment.NewLine, ", ");
int index = holder.IndexOf("ret");
holder = holder.Substring(0, index + 3);
holder = "0x" + s.Key.ToString("x16") + " | " + holder + " ";
}
opcodes.Clear();
}
}
}
catch (Exception e)
{
throw e;
}
for (int i = 0; i < info.ModulesInfo.Count; i++)
{
if (info.ModulesInfo[i].ModulePath == s.Value)
{
holder += String.Format("| {0} | {1} | {2} | {3} | {4} | {5} ",
info.ModulesInfo[i].ModuleASLR, info.ModulesInfo[i].ModuleSafeSEH,
info.ModulesInfo[i].ModuleRebase, info.ModulesInfo[i].ModuleNXCompat, info.ModulesInfo[i].ModuleOsDll,
info.ModulesInfo[i].ModulePath);
}
}
ret.Add(holder);
}
}
else
{
ret.Add("No compliant POP POP RET instuctions were found.");
}
File.WriteAllLines(sehFilename, ret);
return ret.ToArray();
}
/// <summary>
/// Searches all memory associated with a given process and associated modules for POP X POP X RET instructions.
/// Passing a list of module paths or names will exclude those modules from the search.
/// Similar to Search_All_Memory_PPR however provides output in an easily readable format. This version only returns unicode compliant pointers.
/// </summary>
/// <param name="info">The ProcessInfo object which will be searched for POP POP RET instructions.</param>
/// <param name="aslr">Remove ASLR libraries.</param>
/// <param name="safeseh">Remove SafeSEH libraries.</param>
/// <param name="rebase">Remove rebasable libraries.</param>
/// <param name="nxcompat">Remove NXCompat libraries.</param>
/// <param name="osdll">Remove OS Dlls.</param>
/// <param name="unwantedBytes">Addresses containing values in this byte array will be ignored.</param>
/// <param name="protection">String containing protection level returned pointers will.</param>
/// <returns>Returns an array of strings detailing the pointers, opcodes and base files of suitable instruction sets.</returns>
public static string[] GetSEHJumpsUnicode(ProcessInfo info, bool aslr = false,
bool safeseh = false, bool rebase = false, bool nxcompat = false, bool osdll = false,
byte[] unwantedBytes = null, string protection = "exec")
{
List<string> ret = new List<string>();
List<string> excludedModules = info.CreateExcludesList(aslr, safeseh, rebase, nxcompat, osdll);
ErcResult<Dictionary<IntPtr, string>> ptrs = info.SearchAllMemoryPPR(excludedModules);
if (unwantedBytes != null)
{
List<IntPtr> p = new List<IntPtr>();
foreach (KeyValuePair<IntPtr, string> k in ptrs.ReturnValue)
{
p.Add(k.Key);
}
var pt = ERC.Utilities.PtrRemover.RemovePointers(info.ProcessMachineType, p, unwantedBytes);
pt = ERC.Utilities.PtrRemover.RemovePointersProtection(info, pt, protection);
foreach (KeyValuePair<IntPtr, string> k in ptrs.ReturnValue.ToList())
{
if (!pt.Contains(k.Key))
{
ptrs.ReturnValue.Remove(k.Key);
}
}
}
else
{
List<IntPtr> p = new List<IntPtr>();
foreach (KeyValuePair<IntPtr, string> k in ptrs.ReturnValue)
{
p.Add(k.Key);
}
var pt = ERC.Utilities.PtrRemover.RemovePointersProtection(info, p, protection);
foreach (KeyValuePair<IntPtr, string> k in ptrs.ReturnValue.ToList())
{
if (!pt.Contains(k.Key))
{
ptrs.ReturnValue.Remove(k.Key);
}
}
}
byte[] managedArray = new byte[IntPtr.Size];
foreach (KeyValuePair<IntPtr, string> entry in ptrs.ReturnValue.ToList())
{
managedArray = BitConverter.GetBytes((uint)entry.Key);
if (!(managedArray[0] == 0x00 && managedArray[2] == 0x00) && !(managedArray[1] == 0x00 && managedArray[3] == 0x00))
{
ptrs.ReturnValue.Remove(entry.Key);
}
}
string sehFilename = GetFilePath(info.WorkingDirectory, "SEH_jumps_", ".txt");
ret.Add("---------------------------------------------------------------------------------------");
if (info.Author != "No_Author_Set")
{
ret.Add("Process Name: " + info.ProcessName + " Created by: " + info.Author + " " +
"Total Results: " + ptrs.ReturnValue.Count);
}
else
{
ret.Add("Process Name: " + info.ProcessName + " Total Results: " + ptrs.ReturnValue.Count);
}
ret.Add("---------------------------------------------------------------------------------------");
if (ptrs.Error != null)
{
throw new Exception("Error passed from Search_All_Memory_PPR: " + ptrs.Error.ToString());
}
if (info.ProcessMachineType == ERC.MachineType.I386)
{
ret.Add(" Address | Instructions | ASLR | SafeSEH | Rebase | NXCompat | OsDLL | Module Path");
}
else
{
ret.Add(" Address | Instructions | ASLR | SafeSEH | Rebase | NXCompat | OsDLL | Module Path");
}
byte[] ppr = new byte[5];
int bytesread = 0;
if(ptrs.ReturnValue.Count > 0)
{
foreach (KeyValuePair<IntPtr, string> s in ptrs.ReturnValue)
{
string holder = "";
List<byte> opcodes = new List<byte>();
try
{
ErcCore.ReadProcessMemory(info.ProcessHandle, s.Key, ppr, ppr.Length, out bytesread);
for (int i = 0; i < 5; i++)
{
if (ppr[i].Equals(0xC3))
{
for (int j = 0; j <= i; j++)
{
opcodes.Add(ppr[j]);
}
ERC.Utilities.OpcodeDisassembler disas = new ERC.Utilities.OpcodeDisassembler(info);
var result = disas.Disassemble(opcodes.ToArray());
if (info.ProcessMachineType == ERC.MachineType.I386)
{
holder = result.ReturnValue.Replace(Environment.NewLine, ", ");
int index = holder.IndexOf("ret");
holder = holder.Substring(0, index + 3);
holder = "0x" + s.Key.ToString("x8") + " | " + holder + " ";
}
else
{
holder = result.ReturnValue.Replace(Environment.NewLine, ", ");
int index = holder.IndexOf("ret");
holder = holder.Substring(0, index + 3);
holder = "0x" + s.Key.ToString("x16") + " | " + holder + " ";
}
opcodes.Clear();
}
}
}
catch (Exception e)
{
throw e;
}
for (int i = 0; i < info.ModulesInfo.Count; i++)
{
if (info.ModulesInfo[i].ModulePath == s.Value)
{
holder += String.Format("| {0} | {1} | {2} | {3} | {4} | {5} ",
info.ModulesInfo[i].ModuleASLR, info.ModulesInfo[i].ModuleSafeSEH,
info.ModulesInfo[i].ModuleRebase, info.ModulesInfo[i].ModuleNXCompat, info.ModulesInfo[i].ModuleOsDll,
info.ModulesInfo[i].ModulePath);
}
}
ret.Add(holder);
}
}
else
{
ret.Add("No Unicode compliant POP POP RET instructions were found.");
}
File.WriteAllLines(sehFilename, ret);
return ret.ToArray();
}
#endregion
#region GenerateByteArray
/// <summary>
/// Generates an array of all possible bytes for use when identifying bad characters. Writes the output to disk in the working directory.
/// </summary>
/// <param name="unwantedBytes">An array of bytes to be excluded from the final byte array</param>
/// <param name="core">An ErcCore object</param>
/// <returns>Returns a byte array of all possible bytes.</returns>
public static byte[] GenerateByteArray(ErcCore core, byte[] unwantedBytes = null)
{
string byteFilename = GetFilePath(core.WorkingDirectory, "ByteArray_", ".bin");
byte[] byteArray = Payloads.ByteArrayConstructor(unwantedBytes);
FileStream fs1 = new FileStream(byteFilename, FileMode.Create, FileAccess.Write);
fs1.Write(byteArray, 0, byteArray.Length);
fs1.Close();
string outputString = "---------------------------------------------------------------------------------------" + Environment.NewLine;
if(unwantedBytes != null)
{
outputString += "Byte Array generated at:" + DateTime.Now + " Omitted values: " + BitConverter.ToString(unwantedBytes).Replace("-", ", ") + Environment.NewLine;
}
else
{
outputString += "Byte Array generated at:" + DateTime.Now + Environment.NewLine;
}
outputString += "---------------------------------------------------------------------------------------" + Environment.NewLine;
outputString += Environment.NewLine;
outputString += "Raw:" + Environment.NewLine;
string raw = "\\x" + BitConverter.ToString(byteArray).Replace("-", "\\x");
string formattedHex = "";
for(int i = 0; i < raw.Length; i++)
{
if(i == 0)
{
formattedHex += raw[i];
}
else if(i % 48 == 0)
{
formattedHex += "\n" + raw[i];
}
else
{
formattedHex += raw[i];
}
}
outputString += formattedHex;
outputString += Environment.NewLine + Environment.NewLine + "C#:" + Environment.NewLine;
string CSharp = "byte[] buf = new byte[]" + Environment.NewLine + "{" + Environment.NewLine;
string CSharpTemp = "0x" + BitConverter.ToString(byteArray).Replace("-", ", 0x");
string CSharpFormatted = "";
int counter = 0;
for(int i = 0; i < CSharpTemp.Length; i++)
{
if(i == 0)
{
CSharpFormatted += " " + CSharpTemp[i];
counter++;
}
else if(CSharpTemp[i] == ',' && counter % 8 == 0 && counter != 0)
{
CSharpFormatted += CSharpTemp[i] + "\n ";
i++;
counter++;
}
else if (CSharpTemp[i] == ',')
{
counter++;
CSharpFormatted += CSharpTemp[i];
}
else
{
CSharpFormatted += CSharpTemp[i];
}
}
outputString += CSharp + CSharpFormatted + Environment.NewLine + "}";
File.WriteAllText(byteFilename.Substring(0, (byteFilename.Length - 4)) + ".txt", outputString);
return byteArray;
}
#endregion
#region CompareByteArrays
/// <summary>
/// Compares a the values contained in a memory region to the values in the supplied byte array.
/// </summary>
/// <param name="info">The processInfo object that contains the memory region.</param>
/// <param name="startAddress">The memory address to start the search at.</param>
/// <param name="byteArray">The byte array the region will be compared against.</param>
/// <returns>Returns a string detailing differences between the two.</returns>
public static string[] CompareByteArrayToMemoryRegion(ProcessInfo info, IntPtr startAddress, byte[] byteArray)
{
List<string> output = new List<string>();
byte[] memoryRegion = new byte[byteArray.Length];
List<byte> mismatchingBytes = new List<byte>();
int bytesRead = 0;
output.Add(Convert.htmlWhitespaceFix(" ----------------------------------------------------"));
string fromArray = Convert.htmlWhitespaceFix(" From Array | ");
string fromRegion = Convert.htmlWhitespaceFix("From Memory Region | ");
ErcCore.ReadProcessMemory(info.ProcessHandle, startAddress, memoryRegion, byteArray.Length, out bytesRead);
int counter = 0;
for (int i = 0; i <= byteArray.Length; i++)
{
if (i == byteArray.Length)
{
counter = 0;
fromArray += Convert.htmlWhitespaceFix(" | ");
fromRegion += Convert.htmlWhitespaceFix(" | ");
string newLine = Convert.htmlWhitespaceFix(" | | ");
output.Add(fromArray);
output.Add(fromRegion);
output.Add(newLine);
fromArray = Convert.htmlWhitespaceFix(" From Array | ");
fromRegion = Convert.htmlWhitespaceFix("From Memory Region | ");
}
else
{
if (counter == 16)
{
counter = 0;
fromArray += Convert.htmlWhitespaceFix(" | ");
fromRegion += Convert.htmlWhitespaceFix(" | ");
string newLine = Convert.htmlWhitespaceFix(" | | ");
output.Add(fromArray);
output.Add(fromRegion);
output.Add(newLine);
fromArray = Convert.htmlWhitespaceFix(" From Array | ");
fromRegion = Convert.htmlWhitespaceFix("From Memory Region | ");
}
byte[] thisByte = new byte[1];
thisByte[0] = byteArray[i];
if (byteArray[i] != memoryRegion[i])
{
mismatchingBytes.Add(byteArray[i]);
fromArray += "<b><span style='color:red;'>" + BitConverter.ToString(thisByte) + "</span></b>";
thisByte[0] = memoryRegion[i];
fromRegion += "<b><span style='color:red;'>" + BitConverter.ToString(thisByte) + "</span></b>";
}
else
{
fromArray += BitConverter.ToString(thisByte);
thisByte[0] = memoryRegion[i];
fromRegion += BitConverter.ToString(thisByte);
}
fromArray += Convert.htmlWhitespaceFix(" ");
fromRegion += Convert.htmlWhitespaceFix(" ");
counter++;
}
}
output.Add(Convert.htmlWhitespaceFix(" ----------------------------------------------------"));
output.Add("Mismatching Bytes: [" + String.Join(", ", mismatchingBytes.Select(b => BitConverter.ToString(new byte[]{b}))) + "]");
if(mismatchingBytes.Count > 0)
{
output.Add("Remove byte 0x" + BitConverter.ToString(new byte[] { mismatchingBytes.ElementAt(0) }) + " and attempt again.");
}
return output.ToArray();
}
#endregion
#region GenerateEggHunters
/// <summary>
/// Generates a collection of EggHunter payloads.
/// </summary>
/// <param name="core">(Optional) If an ErcCore object is provided the output will also be written out to the working directory </param>
/// <param name="tag">(Optional) If a tag is provided the payloads will be altered to search for that tag, the default tag is ERCD</param>
/// <returns>Returns a string containing all EggHunters </returns>
public static string GenerateEggHunters(ErcCore core = null, string tag = null)
{
var eggHunters = Payloads.EggHunterConstructor(tag);
string eggFilename = "";
if (core != null)
{
eggFilename = GetFilePath(core.WorkingDirectory, "Egg_Hunters_", ".txt");
}
string eggTag = "";
if (tag != null)
{
eggTag = tag;
}
else
{
eggTag = "ERCD";
}
string outputString = "";
outputString = "---------------------------------------------------------------------------------------" + Environment.NewLine;
outputString += "EggHunters generated at:" + DateTime.Now + " Tag: " + eggTag + Environment.NewLine;
outputString += "---------------------------------------------------------------------------------------" + Environment.NewLine;
outputString += Environment.NewLine;
foreach (KeyValuePair<string, byte[]> k in eggHunters)
{
outputString += k.Key + Environment.NewLine;
outputString += "Raw:" + Environment.NewLine;
string raw = "\\x" + BitConverter.ToString(k.Value).Replace("-", "\\x");
var rawlist = Enumerable
.Range(0, raw.Length / 48)
.Select(i => raw.Substring(i * 48, 48))
.ToList();
raw = string.Join(Environment.NewLine, rawlist);
outputString += raw;
outputString += Environment.NewLine + Environment.NewLine + "C#:" + Environment.NewLine;
string CSharp = "byte[] buf = new byte[]" + Environment.NewLine + "{" + Environment.NewLine;
string CSharpTemp = "0x" + BitConverter.ToString(k.Value).Replace("-", ", 0x");
var list = Enumerable
.Range(0, CSharpTemp.Length / 48)
.Select(i => CSharpTemp.Substring(i * 48, 48))
.ToList();
for (int i = 0; i < list.Count; i++)
{
list[i] = " " + list[i];
}
CSharp += string.Join(Environment.NewLine, list) + Environment.NewLine + "}" + Environment.NewLine + Environment.NewLine;
outputString += CSharp;
}
if (core != null)
{
File.WriteAllText(eggFilename, outputString);
}
return outputString;
}
#endregion
#region GenerateFindNRPTable
/// <summary>
/// Searches the memory of a process for a non repeating pattern.
/// </summary>
/// <param name="info">The ProcessInfo object of the process to be searched</param>
/// <param name="searchType">Integer specifiying the format of the string: 0 = search term is in bytes\n1 = search term is in unicode\n2 = search term is in ASCII\n3 = Search term is in UTF8\n4 = Search term is in UTF7\n5 = Search term is in UTF32</param>
/// <param name="extended">Whether the extended character range is to be used when searching for the non repeating pattern</param>
/// <returns>Returns a List of strings containing the locations the repeating pattern was identified</returns>
public static string[] GenerateFindNRPTable(ProcessInfo info, int searchType = 0, bool extended = false)
{
List<string> output = new List<string>();
string fnrpFilename = GetFilePath(info.WorkingDirectory, "Find_NRP_", ".txt");
output.Add("---------------------------------------------------------------------------------------");
if (info.Author != "No_Author_Set")
{
output.Add("Process Name: " + info.ProcessName + " Created by: " + info.Author + " FindNRP table generated at: " + DateTime.Now);
}
else
{
output.Add("Process Name: " + info.ProcessName + " FindNRP table generated at: " + DateTime.Now);
}
output.Add("---------------------------------------------------------------------------------------");
var fnrp = info.FindNRP(searchType, extended);
if (fnrp.Error != null)
{
output.Add(fnrp.Error.ToString());
File.WriteAllLines(fnrpFilename, output);
return output.ToArray();
}
for (int i = 0; i < fnrp.ReturnValue.Count; i++)
{
string registerInfoText = "";
if (fnrp.ReturnValue[i].StringOffset >= 0 && !fnrp.ReturnValue[i].Register.Contains("IP") && !fnrp.ReturnValue[i].Register.Contains("SP")
&& !fnrp.ReturnValue[i].Register.Contains("SEH"))
{
if(fnrp.ReturnValue[i].overwritten == false)
{
registerInfoText += "Register " + fnrp.ReturnValue[i].Register + " points into pattern at position " + fnrp.ReturnValue[i].StringOffset
+ " for " + fnrp.ReturnValue[i].BufferSize + " bytes." + " in thread " + fnrp.ReturnValue[i].ThreadID;
output.Add(registerInfoText);
}
else
{
registerInfoText += "Register " + fnrp.ReturnValue[i].Register + " is overwritten with pattern at position " + fnrp.ReturnValue[i].StringOffset + " in thread " + fnrp.ReturnValue[i].ThreadID;
output.Add(registerInfoText);
}
}
else if (fnrp.ReturnValue[i].StringOffset > 0 && fnrp.ReturnValue[i].Register.Contains("SP"))
{
registerInfoText += "Register " + fnrp.ReturnValue[i].Register + " points into pattern at position " + fnrp.ReturnValue[i].StringOffset;
if (fnrp.ReturnValue[i].RegisterOffset > 0)
{
registerInfoText += " at " + fnrp.ReturnValue[i].Register + " +" + fnrp.ReturnValue[i].RegisterOffset + " length of pattern found is " +
fnrp.ReturnValue[i].BufferSize + " characters" + " in thread " + fnrp.ReturnValue[i].ThreadID;
output.Add(registerInfoText);
}
else
{
registerInfoText += " length of pattern found is " + fnrp.ReturnValue[i].BufferSize + " characters" + " in thread " + fnrp.ReturnValue[i].ThreadID;
output.Add(registerInfoText);
}
}
else if (fnrp.ReturnValue[i].StringOffset > 0 && fnrp.ReturnValue[i].Register.Contains("IP"))
{
registerInfoText += "Register " + fnrp.ReturnValue[i].Register + " is overwritten with pattern at position " + fnrp.ReturnValue[i].StringOffset + " in thread " + fnrp.ReturnValue[i].ThreadID;
output.Add(registerInfoText);
}
else if (fnrp.ReturnValue[i].StringOffset > 0 && fnrp.ReturnValue[i].Register.Contains("SEH"))
{
registerInfoText += "SEH register is overwritten with pattern at position " + fnrp.ReturnValue[i].StringOffset + " in thread " + fnrp.ReturnValue[i].ThreadID;
output.Add(registerInfoText);
}
}
output = output.Distinct().ToList();
File.WriteAllLines(fnrpFilename, output);
return output.ToArray();
}
#endregion
#region RopChainGadgets32
/// <summary>
/// Produces output files containing information about the associated ROP chain, produces files containing ROP gadgets and the associated ROP chain.
/// </summary>
/// <param name="rcg">The ROP chain generator object</param>
/// <param name="gadgetsOnly">Bool to indicate if ROP chains should be included or just gadget lists generated</param>
/// <returns>Returns an array of strings</returns>
public static string[] RopChainGadgets32(RopChainGenerator32 rcg, bool gadgetsOnly = false)
{
string output = "";
List<string> totalGadgets = new List<string>();
List<string> curatedGadgets = new List<string>();
string totalGadgetsPath = GetFilePath(rcg.RcgInfo.WorkingDirectory, "total_gadgest_", ".txt");
string curatedGadgetsPath = GetFilePath(rcg.RcgInfo.WorkingDirectory, "curated_gadgest_", ".txt");
string ropChainPath = GetFilePath(rcg.RcgInfo.WorkingDirectory, "rop_chain_", ".txt");
output += "------------------------------------------------------------------------------------------------------------------------" + Environment.NewLine;
if (rcg.RcgInfo.Author != "No_Author_Set")
{
output += "Process Name: " + rcg.RcgInfo.ProcessName + " Gadget list created by: " + rcg.RcgInfo.Author + " " + Environment.NewLine;
}
else
{
output += "Process Name: " + rcg.RcgInfo.ProcessName + " ROP chain gadget list" + Environment.NewLine;
}
output += "------------------------------------------------------------------------------------------------------------------------" + Environment.NewLine;
totalGadgets.Add(output);
curatedGadgets.Add(output);
if (rcg.RcgInfo.ProcessMachineType == MachineType.I386)
{
totalGadgets.Add("pushEax: ");
curatedGadgets.Add("pushEax: ");
foreach (KeyValuePair<IntPtr, string> k in rcg.x86Opcodes.pushEax)
{
if(k.Value.Contains("push eax") && k.Value.Contains("ret"))
{
totalGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
if(!k.Value.Any(char.IsDigit) && !k.Value.ToLower().Contains("invalid"))
{
curatedGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
}
}
}
totalGadgets.Add("pushEbx: ");
curatedGadgets.Add("pushEbx: ");
foreach (KeyValuePair<IntPtr, string> k in rcg.x86Opcodes.pushEbx)
{
if (k.Value.Contains("push ebx") && k.Value.Contains("ret"))
{
totalGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
if (!k.Value.Any(char.IsDigit) && !k.Value.ToLower().Contains("invalid"))
{
curatedGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
}
}
}
totalGadgets.Add("pushEcx: ");
curatedGadgets.Add("pushEcx: ");
foreach (KeyValuePair<IntPtr, string> k in rcg.x86Opcodes.pushEcx)
{
if (k.Value.Contains("push ecx") && k.Value.Contains("ret"))
{
totalGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
if (!k.Value.Any(char.IsDigit) && !k.Value.ToLower().Contains("invalid"))
{
curatedGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
}
}
}
totalGadgets.Add("pushEdx: ");
curatedGadgets.Add("pushEdx: ");
foreach (KeyValuePair<IntPtr, string> k in rcg.x86Opcodes.pushEdx)
{
if (k.Value.Contains("push edx") && k.Value.Contains("ret"))
{
totalGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
if (!k.Value.Any(char.IsDigit) && !k.Value.ToLower().Contains("invalid"))
{
curatedGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
}
}
}
totalGadgets.Add("pushEsp: ");
curatedGadgets.Add("pushEsp: ");
foreach (KeyValuePair<IntPtr, string> k in rcg.x86Opcodes.pushEsp)
{
if (k.Value.Contains("push esp") && k.Value.Contains("ret"))
{
totalGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
if (!k.Value.Any(char.IsDigit) && !k.Value.ToLower().Contains("invalid"))
{
curatedGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
}
}
}
totalGadgets.Add("pushEbp: ");
curatedGadgets.Add("pushEbp: ");
foreach (KeyValuePair<IntPtr, string> k in rcg.x86Opcodes.pushEbp)
{
if (k.Value.Contains("push ebp") && k.Value.Contains("ret"))
{
totalGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
if (!k.Value.Any(char.IsDigit) && !k.Value.ToLower().Contains("invalid"))
{
curatedGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
}
}
}
totalGadgets.Add("pushEsi: ");
curatedGadgets.Add("pushEsi: ");
foreach (KeyValuePair<IntPtr, string> k in rcg.x86Opcodes.pushEsi)
{
if (k.Value.Contains("push esi") && k.Value.Contains("ret"))
{
totalGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
if (!k.Value.Any(char.IsDigit) && !k.Value.ToLower().Contains("invalid"))
{
curatedGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
}
}
}
totalGadgets.Add("pushEdi: ");
curatedGadgets.Add("pushEdi: ");
foreach (KeyValuePair<IntPtr, string> k in rcg.x86Opcodes.pushEdi)
{
if (k.Value.Contains("push edi") && k.Value.Contains("ret"))
{
totalGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
if (!k.Value.Any(char.IsDigit) && !k.Value.ToLower().Contains("invalid"))
{
curatedGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
}
}
}
totalGadgets.Add("JmpEsp: ");
curatedGadgets.Add("JmpEsp: ");
foreach (KeyValuePair<IntPtr, string> k in rcg.x86Opcodes.jmpEsp)
{
if (k.Value.Contains("jmp esp"))
{
totalGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
if (!k.Value.Any(char.IsDigit) && !k.Value.ToLower().Contains("invalid"))
{
curatedGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
}
}
}
totalGadgets.Add("CallEsp: ");
curatedGadgets.Add("CallEsp: ");
foreach (KeyValuePair<IntPtr, string> k in rcg.x86Opcodes.callEsp)
{
if (k.Value.Contains("call esp"))
{
totalGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
if (!k.Value.Any(char.IsDigit) && !k.Value.ToLower().Contains("invalid"))
{
curatedGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
}
}
}
totalGadgets.Add("xorEax: ");
curatedGadgets.Add("xorEax: ");
foreach (KeyValuePair<IntPtr, string> k in rcg.x86Opcodes.xorEax)
{
if (k.Value.Contains("xor eax") && k.Value.Contains("ret"))
{
totalGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
if (!k.Value.Any(char.IsDigit) && !k.Value.ToLower().Contains("invalid"))
{
curatedGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
}
}
}
totalGadgets.Add("xorEbx: ");
curatedGadgets.Add("xorEbx: ");
foreach (KeyValuePair<IntPtr, string> k in rcg.x86Opcodes.xorEbx)
{
if (k.Value.Contains("xor ebx") && k.Value.Contains("ret"))
{
totalGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
if (!k.Value.Any(char.IsDigit) && !k.Value.ToLower().Contains("invalid"))
{
curatedGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
}
}
}
totalGadgets.Add("xorEcx: ");
curatedGadgets.Add("xorEcx: ");
foreach (KeyValuePair<IntPtr, string> k in rcg.x86Opcodes.xorEcx)
{
if (k.Value.Contains("xor ecx") && k.Value.Contains("ret"))
{
totalGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
if (!k.Value.Any(char.IsDigit) && !k.Value.ToLower().Contains("invalid"))
{
curatedGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
}
}
}
totalGadgets.Add("xorEdx: ");
curatedGadgets.Add("xorEdx: ");
foreach (KeyValuePair<IntPtr, string> k in rcg.x86Opcodes.xorEdx)
{
if (k.Value.Contains("xor edx") && k.Value.Contains("ret"))
{
totalGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
if (!k.Value.Any(char.IsDigit) && !k.Value.ToLower().Contains("invalid"))
{
curatedGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
}
}
}
totalGadgets.Add("xorEsi: ");
curatedGadgets.Add("xorEsi: ");
foreach (KeyValuePair<IntPtr, string> k in rcg.x86Opcodes.xorEsi)
{
if (k.Value.Contains("xor esi") && k.Value.Contains("ret"))
{
totalGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
if (!k.Value.Any(char.IsDigit) && !k.Value.ToLower().Contains("invalid"))
{
curatedGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
}
}
}
totalGadgets.Add("xorEdi: ");
curatedGadgets.Add("xorEdi: ");
foreach (KeyValuePair<IntPtr, string> k in rcg.x86Opcodes.xorEdi)
{
if (k.Value.Contains("xor edi") && k.Value.Contains("ret"))
{
totalGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
if (!k.Value.Any(char.IsDigit) && !k.Value.ToLower().Contains("invalid"))
{
curatedGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
}
}
}
totalGadgets.Add("popEax: ");
curatedGadgets.Add("popEax: ");
foreach (KeyValuePair<IntPtr, string> k in rcg.x86Opcodes.popEax)
{
if (k.Value.Contains("pop eax") && k.Value.Contains("ret"))
{
totalGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
if (!k.Value.Any(char.IsDigit) && !k.Value.ToLower().Contains("invalid"))
{
curatedGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
}
}
}
totalGadgets.Add("popEbx: ");
curatedGadgets.Add("popEbx: ");
foreach (KeyValuePair<IntPtr, string> k in rcg.x86Opcodes.popEbx)
{
if (k.Value.Contains("pop ebx") && k.Value.Contains("ret"))
{
totalGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
if (!k.Value.Any(char.IsDigit) && !k.Value.ToLower().Contains("invalid"))
{
curatedGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
}
}
}
totalGadgets.Add("popEcx: ");
curatedGadgets.Add("popEcx: ");
foreach (KeyValuePair<IntPtr, string> k in rcg.x86Opcodes.popEcx)
{
if (k.Value.Contains("pop ecx") && k.Value.Contains("ret"))
{
totalGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
if (!k.Value.Any(char.IsDigit) && !k.Value.ToLower().Contains("invalid"))
{
curatedGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
}
}
}
totalGadgets.Add("popEdx: ");
curatedGadgets.Add("popEdx: ");
foreach (KeyValuePair<IntPtr, string> k in rcg.x86Opcodes.popEdx)
{
if (k.Value.Contains("pop edx") && k.Value.Contains("ret"))
{
totalGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
if (!k.Value.Any(char.IsDigit) && !k.Value.ToLower().Contains("invalid"))
{
curatedGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
}
}
}
totalGadgets.Add("popEsp: ");
curatedGadgets.Add("popEsp: ");
foreach (KeyValuePair<IntPtr, string> k in rcg.x86Opcodes.popEsp)
{
if (k.Value.Contains("pop esp") && k.Value.Contains("ret"))
{
totalGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
if (!k.Value.Any(char.IsDigit) && !k.Value.ToLower().Contains("invalid"))
{
curatedGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
}
}
}
totalGadgets.Add("popEbp: ");
curatedGadgets.Add("popEbp: ");
foreach (KeyValuePair<IntPtr, string> k in rcg.x86Opcodes.popEbp)
{
if (k.Value.Contains("pop ebp") && k.Value.Contains("ret"))
{
totalGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
if (!k.Value.Any(char.IsDigit) && !k.Value.ToLower().Contains("invalid"))
{
curatedGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
}
}
}
totalGadgets.Add("popEsi: ");
curatedGadgets.Add("popEsi: ");
foreach (KeyValuePair<IntPtr, string> k in rcg.x86Opcodes.popEsi)
{
if (k.Value.Contains("pop esi") && k.Value.Contains("ret"))
{
totalGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
if (!k.Value.Any(char.IsDigit) && !k.Value.ToLower().Contains("invalid"))
{
curatedGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
}
}
}
totalGadgets.Add("popEdi: ");
curatedGadgets.Add("popEdi: ");
foreach (KeyValuePair<IntPtr, string> k in rcg.x86Opcodes.popEdi)
{
if (k.Value.Contains("pop edo") && k.Value.Contains("ret"))
{
totalGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
if (!k.Value.Any(char.IsDigit) && !k.Value.ToLower().Contains("invalid"))
{
curatedGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
}
}
}
totalGadgets.Add("incEax: ");
curatedGadgets.Add("incEax: ");
foreach (KeyValuePair<IntPtr, string> k in rcg.x86Opcodes.incEax)
{
if (k.Value.Contains("inc eax") && k.Value.Contains("ret"))
{
totalGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
if (!k.Value.Any(char.IsDigit) && !k.Value.ToLower().Contains("invalid"))
{
curatedGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
}
}
}
totalGadgets.Add("decEax: ");
curatedGadgets.Add("decEax: ");
foreach (KeyValuePair<IntPtr, string> k in rcg.x86Opcodes.decEax)
{
if (k.Value.Contains("dec eax") && k.Value.Contains("ret"))
{
totalGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
if (!k.Value.Any(char.IsDigit) && !k.Value.ToLower().Contains("invalid"))
{
curatedGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
}
}
}
totalGadgets.Add("incEbx: ");
curatedGadgets.Add("incEbx: ");
foreach (KeyValuePair<IntPtr, string> k in rcg.x86Opcodes.incEbx)
{
if (k.Value.Contains("inc ebx") && k.Value.Contains("ret"))
{
totalGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
if (!k.Value.Any(char.IsDigit) && !k.Value.ToLower().Contains("invalid"))
{
curatedGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
}
}
}
totalGadgets.Add("decEbx: ");
curatedGadgets.Add("decEbx: ");
foreach (KeyValuePair<IntPtr, string> k in rcg.x86Opcodes.decEbx)
{
if (k.Value.Contains("dec ebx") && k.Value.Contains("ret"))
{
totalGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
if (!k.Value.Any(char.IsDigit) && !k.Value.ToLower().Contains("invalid"))
{
curatedGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
}
}
}
totalGadgets.Add("incEcx: ");
curatedGadgets.Add("incEcx: ");
foreach (KeyValuePair<IntPtr, string> k in rcg.x86Opcodes.incEcx)
{
if (k.Value.Contains("inc ecx") && k.Value.Contains("ret"))
{
totalGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
if (!k.Value.Any(char.IsDigit) && !k.Value.ToLower().Contains("invalid"))
{
curatedGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
}
}
}
totalGadgets.Add("decEcx: ");
curatedGadgets.Add("decEcx: ");
foreach (KeyValuePair<IntPtr, string> k in rcg.x86Opcodes.decEcx)
{
if (k.Value.Contains("dec ecx") && k.Value.Contains("ret"))
{
totalGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
if (!k.Value.Any(char.IsDigit) && !k.Value.ToLower().Contains("invalid"))
{
curatedGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
}
}
}
totalGadgets.Add("incEdx: ");
curatedGadgets.Add("incEdx: ");
foreach (KeyValuePair<IntPtr, string> k in rcg.x86Opcodes.incEdx)
{
if (k.Value.Contains("inc edx") && k.Value.Contains("ret"))
{
totalGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
if (!k.Value.Any(char.IsDigit) && !k.Value.ToLower().Contains("invalid"))
{
curatedGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
}
}
}
totalGadgets.Add("decEdx: ");
curatedGadgets.Add("decEdx: ");
foreach (KeyValuePair<IntPtr, string> k in rcg.x86Opcodes.decEdx)
{
if (k.Value.Contains("dec edx") && k.Value.Contains("ret"))
{
totalGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
if (!k.Value.Any(char.IsDigit) && !k.Value.ToLower().Contains("invalid"))
{
curatedGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
}
}
}
totalGadgets.Add("incEbp: ");
curatedGadgets.Add("incEbp: ");
foreach (KeyValuePair<IntPtr, string> k in rcg.x86Opcodes.incEbp)
{
if (k.Value.Contains("inc ebp") && k.Value.Contains("ret"))
{
totalGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
if (!k.Value.Any(char.IsDigit) && !k.Value.ToLower().Contains("invalid"))
{
curatedGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
}
}
}
totalGadgets.Add("decEbp: ");
curatedGadgets.Add("decEbp: ");
foreach (KeyValuePair<IntPtr, string> k in rcg.x86Opcodes.decEbp)
{
if (k.Value.Contains("dec ebp") && k.Value.Contains("ret"))
{
totalGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
if (!k.Value.Any(char.IsDigit) && !k.Value.ToLower().Contains("invalid"))
{
curatedGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
}
}
}
totalGadgets.Add("incEsp: ");
curatedGadgets.Add("incEsp: ");
foreach (KeyValuePair<IntPtr, string> k in rcg.x86Opcodes.incEsp)
{
if (k.Value.Contains("inc esp") && k.Value.Contains("ret"))
{
totalGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
if (!k.Value.Any(char.IsDigit) && !k.Value.ToLower().Contains("invalid"))
{
curatedGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
}
}
}
totalGadgets.Add("decEsp: ");
curatedGadgets.Add("decEsp: ");
foreach (KeyValuePair<IntPtr, string> k in rcg.x86Opcodes.decEsp)
{
if (k.Value.Contains("dec esp") && k.Value.Contains("ret"))
{
totalGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
if (!k.Value.Any(char.IsDigit) && !k.Value.ToLower().Contains("invalid"))
{
curatedGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
}
}
}
totalGadgets.Add("incEsi: ");
curatedGadgets.Add("incEsi: ");
foreach (KeyValuePair<IntPtr, string> k in rcg.x86Opcodes.incEsi)
{
if (k.Value.Contains("inc esi") && k.Value.Contains("ret"))
{
totalGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
if (!k.Value.Any(char.IsDigit) && !k.Value.ToLower().Contains("invalid"))
{
curatedGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
}
}
}
totalGadgets.Add("decEsi: ");
curatedGadgets.Add("decEsi: ");
foreach (KeyValuePair<IntPtr, string> k in rcg.x86Opcodes.decEsi)
{
if (k.Value.Contains("dec esi") && k.Value.Contains("ret"))
{
totalGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
if (!k.Value.Any(char.IsDigit) && !k.Value.ToLower().Contains("invalid"))
{
curatedGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
}
}
}
totalGadgets.Add("incEdi: ");
curatedGadgets.Add("incEdi: ");
foreach (KeyValuePair<IntPtr, string> k in rcg.x86Opcodes.incEdi)
{
if (k.Value.Contains("inc edi") && k.Value.Contains("ret"))
{
totalGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
if (!k.Value.Any(char.IsDigit) && !k.Value.ToLower().Contains("invalid"))
{
curatedGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
}
}
}
totalGadgets.Add("decEdi: ");
curatedGadgets.Add("decEdi: ");
foreach (KeyValuePair<IntPtr, string> k in rcg.x86Opcodes.decEdi)
{
if (k.Value.Contains("dec edi") && k.Value.Contains("ret"))
{
totalGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
if (!k.Value.Any(char.IsDigit) && !k.Value.ToLower().Contains("invalid"))
{
curatedGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
}
}
}
totalGadgets.Add("Add: ");
curatedGadgets.Add("Add: ");
foreach (KeyValuePair<IntPtr, string> k in rcg.x86Opcodes.add)
{
if (k.Value.Contains("add") && k.Value.Contains("ret"))
{
totalGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
if (!k.Value.Any(char.IsDigit) && !k.Value.ToLower().Contains("invalid"))
{
curatedGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
}
}
}
totalGadgets.Add("Sub: ");
curatedGadgets.Add("Sub: ");
foreach (KeyValuePair<IntPtr, string> k in rcg.x86Opcodes.sub)
{
if (k.Value.Contains("sub") && k.Value.Contains("ret"))
{
totalGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
if (!k.Value.Any(char.IsDigit) && !k.Value.ToLower().Contains("invalid"))
{
curatedGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
}
}
}
totalGadgets.Add("Mov: ");
curatedGadgets.Add("Mov: ");
foreach (KeyValuePair<IntPtr, string> k in rcg.x86Opcodes.mov)
{
if (k.Value.Contains("mov") && k.Value.Contains("ret"))
{
totalGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
if (!k.Value.Any(char.IsDigit) && !k.Value.ToLower().Contains("invalid"))
{
curatedGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
}
}
}
totalGadgets.Add("And: ");
curatedGadgets.Add("And: ");
foreach (KeyValuePair<IntPtr, string> k in rcg.x86Opcodes.and)
{
if (k.Value.Contains("and") && k.Value.Contains("ret"))
{
totalGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
if (!k.Value.Any(char.IsDigit) && !k.Value.ToLower().Contains("invalid"))
{
curatedGadgets.Add("0x" + k.Key.ToString("X8") + " | " + k.Value);
}
}
}
}
File.WriteAllLines(totalGadgetsPath, totalGadgets);
File.WriteAllLines(curatedGadgetsPath, curatedGadgets);
List<string> ropChain = new List<string>();
if (gadgetsOnly == false)
{
if(rcg.VirtualAllocChain.Count > 0)
{
ropChain.Add("------------------------------------------------------------------------------------------------------------------------");
ropChain.Add("Method: VirtualAlloc Process Name: " + rcg.RcgInfo.ProcessName);
ropChain.Add("------------------------------------------------------------------------------------------------------------------------");
ropChain.Add("");
ropChain.Add("################################################################");
ropChain.Add("## VirtualAlloc Template: ##");
ropChain.Add("## EAX: 90909090 -> Nop sled ##");
ropChain.Add("## ECX: 00000040 -> flProtect ##");
ropChain.Add("## EDX: 00001000 -> flAllocationType ##");
ropChain.Add("## EBX: ???????? -> Int size (area to be set as executable) ##");
ropChain.Add("## ESP: ???????? -> No Change ##");
ropChain.Add("## EBP: ???????? -> Jmp Esp # Call Esp ##");
ropChain.Add("## ESI: ???????? -> ApiAddresses[\"VirtualAlloc\"] ##");
ropChain.Add("## EDI: ???????? -> RopNop ##");
ropChain.Add("## ##");
ropChain.Add("## + place ptr to \"jmp esp\" on stack, below PUSHAD ##");
ropChain.Add("################################################################");
ropChain.Add("");
}
foreach (Tuple<byte[], string> k in rcg.VirtualAllocChain)
{
Array.Reverse(k.Item1, 0, k.Item1.Length);
ropChain.Add(BitConverter.ToString(k.Item1).Replace("-", "\\x") + " | " + k.Item2);
}
ropChain.Add(Environment.NewLine);
if (rcg.HeapCreateChain.Count > 0)
{
ropChain.Add("------------------------------------------------------------------------------------------------------------------------");
ropChain.Add("Method: HeapCreate Process Name: " + rcg.RcgInfo.ProcessName);
ropChain.Add("------------------------------------------------------------------------------------------------------------------------");
ropChain.Add("");
ropChain.Add("################################################################");
ropChain.Add("## HeapCreate Template: ##");
ropChain.Add("## EAX: 90909090 -> Nop sled ##");
ropChain.Add("## ECX: 00010000 -> dwMaximumSize ##");
ropChain.Add("## EDX: 00001000 -> dwInitialSize ##");
ropChain.Add("## EBX: 00040000 -> flOptions ##");
ropChain.Add("## ESP: ???????? -> No Change ##");
ropChain.Add("## EBP: ???????? -> Jmp Esp # Call Esp ##");
ropChain.Add("## ESI: ???????? -> ApiAddresses[\"HeapCreate\"] ##");
ropChain.Add("## EDI: ???????? -> RopNop ##");
ropChain.Add("################################################################");
ropChain.Add("");
}
foreach (Tuple<byte[], string> k in rcg.HeapCreateChain)
{
Array.Reverse(k.Item1, 0, k.Item1.Length);
ropChain.Add(BitConverter.ToString(k.Item1).Replace("-", "\\x") + " | " + k.Item2);
}
ropChain.Add(Environment.NewLine);
if (rcg.VirtualProtectChain.Count > 0)
{
ropChain.Add("------------------------------------------------------------------------------------------------------------------------");
ropChain.Add("Method: VirtualProtect Process Name: " + rcg.RcgInfo.ProcessName);
ropChain.Add("------------------------------------------------------------------------------------------------------------------------");
ropChain.Add("");
ropChain.Add("################################################################");
ropChain.Add("## VirtualProtect Template: ##");
ropChain.Add("## EAX: 90909090 -> Nop sled ##");
ropChain.Add("## ECX: ???????? -> flAllocationType ##");
ropChain.Add("## EDX: 00000040 -> flNewProtect ##");
ropChain.Add("## EBX: ???????? -> Int size (area to be set as executable) ##");
ropChain.Add("## ESP: ???????? -> No Change ##");
ropChain.Add("## EBP: ???????? -> Jmp Esp # Call Esp ##");
ropChain.Add("## ESI: ???????? -> ApiAddresses[\"VirtualProtect\"] ##");
ropChain.Add("## EDI: ???????? -> RopNop ##");
ropChain.Add("## ##");
ropChain.Add("## + place ptr to \"jmp esp\" on stack, below PUSHAD ##");
ropChain.Add("################################################################");
ropChain.Add("");
}
foreach (Tuple<byte[], string> k in rcg.VirtualProtectChain)
{
Array.Reverse(k.Item1, 0, k.Item1.Length);
ropChain.Add(BitConverter.ToString(k.Item1).Replace("-", "\\x") + " | " + k.Item2);
}
ropChain.Add(Environment.NewLine);
File.WriteAllLines(ropChainPath, ropChain);
}
return ropChain.ToArray();
}
#endregion
#region RopChainGadgets64
/// <summary>
/// Produces output files containing information about the associated ROP chain, produces files containing ROP gadgets and the associated ROP chain.
/// </summary>
/// <param name="rcg">The ROP chain generator object</param>
/// <param name="gadgetsOnly">Bool to indicate if ROP chains should be included or just gadget lists generated</param>
/// <returns>Returns an array of strings</returns>
public static string[] RopChainGadgets64(RopChainGenerator64 rcg, bool gadgetsOnly = false)
{
string output = "";
List<string> totalGadgets = new List<string>();
List<string> curatedGadgets = new List<string>();
string totalGadgetsPath = GetFilePath(rcg.RcgInfo.WorkingDirectory, "total_gadgest_64_", ".txt");
string curatedGadgetsPath = GetFilePath(rcg.RcgInfo.WorkingDirectory, "curated_gadgest_64_", ".txt");
string ropChainPath = GetFilePath(rcg.RcgInfo.WorkingDirectory, "rop_chain_64_", ".txt");
output += "-------------------------------------------------------------------------------------------------------------------------" + Environment.NewLine;
if (rcg.RcgInfo.Author != "No_Author_Set")
{
output += "Process Name: " + rcg.RcgInfo.ProcessName + " Gadget list created by: " + rcg.RcgInfo.Author + " " + Environment.NewLine;
}
else
{
output += "Process Name: " + rcg.RcgInfo.ProcessName + " ROP chain gadget list" + Environment.NewLine;
}
output += "-------------------------------------------------------------------------------------------------------------------------" + Environment.NewLine;
totalGadgets.Add(output);
curatedGadgets.Add(output);
totalGadgets.Add("pushRax: ");
curatedGadgets.Add("pushRax: ");
foreach (KeyValuePair<IntPtr, string> k in rcg.x64Opcodes.pushRax)
{
if (k.Value.Contains("push rax") && k.Value.Contains("ret"))
{
totalGadgets.Add("0x" + k.Key.ToString("X16") + " | " + k.Value);
if (!k.Value.Any(char.IsDigit) && !k.Value.ToLower().Contains("invalid"))
{
curatedGadgets.Add("0x" + k.Key.ToString("X16") + " | " + k.Value);
}
}
}
totalGadgets.Add("pushRbx: ");
curatedGadgets.Add("pushRbx: ");
foreach (KeyValuePair<IntPtr, string> k in rcg.x64Opcodes.pushRbx)
{
if (k.Value.Contains("push rbx") && k.Value.Contains("ret"))
{
totalGadgets.Add("0x" + k.Key.ToString("X16") + " | " + k.Value);
if (!k.Value.Any(char.IsDigit) && !k.Value.ToLower().Contains("invalid"))
{
curatedGadgets.Add("0x" + k.Key.ToString("X16") + " | " + k.Value);
}
}
}
totalGadgets.Add("pushRcx: ");
curatedGadgets.Add("pushRcx: ");
foreach (KeyValuePair<IntPtr, string> k in rcg.x64Opcodes.pushRcx)
{
if (k.Value.Contains("push rcx") && k.Value.Contains("ret"))
{
totalGadgets.Add("0x" + k.Key.ToString("X16") + " | " + k.Value);
if (!k.Value.Any(char.IsDigit) && !k.Value.ToLower().Contains("invalid"))
{
curatedGadgets.Add("0x" + k.Key.ToString("X16") + " | " + k.Value);
}
}
}
totalGadgets.Add("pushRdx: ");
curatedGadgets.Add("pushRdx: ");
foreach (KeyValuePair<IntPtr, string> k in rcg.x64Opcodes.pushRdx)
{
if (k.Value.Contains("push rdx") && k.Value.Contains("ret"))
{
totalGadgets.Add("0x" + k.Key.ToString("X16") + " | " + k.Value);
if (!k.Value.Any(char.IsDigit) && !k.Value.ToLower().Contains("invalid"))
{
curatedGadgets.Add("0x" + k.Key.ToString("X16") + " | " + k.Value);
}
}
}
totalGadgets.Add("pushRsp: ");
curatedGadgets.Add("pushRsp: ");
foreach (KeyValuePair<IntPtr, string> k in rcg.x64Opcodes.pushRsp)
{
if (k.Value.Contains("push rsp") && k.Value.Contains("ret"))
{
totalGadgets.Add("0x" + k.Key.ToString("X16") + " | " + k.Value);
if (!k.Value.Any(char.IsDigit) && !k.Value.ToLower().Contains("invalid"))
{
curatedGadgets.Add("0x" + k.Key.ToString("X16") + " | " + k.Value);
}
}
}
totalGadgets.Add("pushRbp: ");
curatedGadgets.Add("pushRbp: ");
foreach (KeyValuePair<IntPtr, string> k in rcg.x64Opcodes.pushRbp)
{
if (k.Value.Contains("push rbp") && k.Value.Contains("ret"))
{
totalGadgets.Add("0x" + k.Key.ToString("X16") + " | " + k.Value);
if (!k.Value.Any(char.IsDigit) && !k.Value.ToLower().Contains("invalid"))
{
curatedGadgets.Add("0x" + k.Key.ToString("X16") + " | " + k.Value);
}
}
}
totalGadgets.Add("pushRsi: ");
curatedGadgets.Add("pushRsi: ");
foreach (KeyValuePair<IntPtr, string> k in rcg.x64Opcodes.pushRsi)
{
if (k.Value.Contains("push rsi") && k.Value.Contains("ret"))
{
totalGadgets.Add("0x" + k.Key.ToString("X16") + " | " + k.Value);
if (!k.Value.Any(char.IsDigit) && !k.Value.ToLower().Contains("invalid"))
{
curatedGadgets.Add("0x" + k.Key.ToString("X16") + " | " + k.Value);
}
}
}
totalGadgets.Add("pushRdi: ");
curatedGadgets.Add("pushRdi: ");
foreach (KeyValuePair<IntPtr, string> k in rcg.x64Opcodes.pushRdi)
{
if (k.Value.Contains("push rdi") && k.Value.Contains("ret"))
{
totalGadgets.Add("0x" + k.Key.ToString("X16") + " | " + k.Value);
if (!k.Value.Any(char.IsDigit) && !k.Value.ToLower().Contains("invalid"))
{
curatedGadgets.Add("0x" + k.Key.ToString("X16") + " | " + k.Value);
}
}
}
totalGadgets.Add("JmpRsp: ");
curatedGadgets.Add("JmpRsp: ");
foreach (KeyValuePair<IntPtr, string> k in rcg.x64Opcodes.jmpRsp)
{
if (k.Value.Contains("jmp rsp"))
{
totalGadgets.Add("0x" + k.Key.ToString("X16") + " | " + k.Value);
if (!k.Value.Any(char.IsDigit) && !k.Value.ToLower().Contains("invalid"))
{
curatedGadgets.Add("0x" + k.Key.ToString("X16") + " | " + k.Value);
}
}
}
totalGadgets.Add("CallRsp: ");
curatedGadgets.Add("CallRsp: ");
foreach (KeyValuePair<IntPtr, string> k in rcg.x64Opcodes.callRsp)
{
if (k.Value.Contains("call rsp"))
{
totalGadgets.Add("0x" + k.Key.ToString("X16") + " | " + k.Value);
if (!k.Value.Any(char.IsDigit) && !k.Value.ToLower().Contains("invalid"))
{
curatedGadgets.Add("0x" + k.Key.ToString("X16") + " | " + k.Value);
}
}
}
totalGadgets.Add("xorEax: ");
curatedGadgets.Add("xorEax: ");
foreach (KeyValuePair<IntPtr, string> k in rcg.x64Opcodes.xorRax)
{
if (k.Value.Contains("xor eax") && k.Value.Contains("ret"))
{
totalGadgets.Add("0x" + k.Key.ToString("X16") + " | " + k.Value);
if (!k.Value.Any(char.IsDigit) && !k.Value.ToLower().Contains("invalid"))
{
curatedGadgets.Add("0x" + k.Key.ToString("X16") + " | " + k.Value);
}
}
}
totalGadgets.Add("xorRbx: ");
curatedGadgets.Add("xorRbx: ");
foreach (KeyValuePair<IntPtr, string> k in rcg.x64Opcodes.xorRbx)
{
if (k.Value.Contains("xor rbx") && k.Value.Contains("ret"))
{
totalGadgets.Add("0x" + k.Key.ToString("X16") + " | " + k.Value);
if (!k.Value.Any(char.IsDigit) && !k.Value.ToLower().Contains("invalid"))
{
curatedGadgets.Add("0x" + k.Key.ToString("X16") + " | " + k.Value);
}
}
}
totalGadgets.Add("xorRcx: ");
curatedGadgets.Add("xorRcx: ");
foreach (KeyValuePair<IntPtr, string> k in rcg.x64Opcodes.xorRcx)
{
if (k.Value.Contains("xor rcx") && k.Value.Contains("ret"))
{
totalGadgets.Add("0x" + k.Key.ToString("X16") + " | " + k.Value);
if (!k.Value.Any(char.IsDigit) && !k.Value.ToLower().Contains("invalid"))
{
curatedGadgets.Add("0x" + k.Key.ToString("X16") + " | " + k.Value);
}
}
}
totalGadgets.Add("xorRdx: ");
curatedGadgets.Add("xorRdx: ");
foreach (KeyValuePair<IntPtr, string> k in rcg.x64Opcodes.xorRdx)
{
if (k.Value.Contains("xor rdx") && k.Value.Contains("ret"))
{
totalGadgets.Add("0x" + k.Key.ToString("X16") + " | " + k.Value);
if (!k.Value.Any(char.IsDigit) && !k.Value.ToLower().Contains("invalid"))
{
curatedGadgets.Add("0x" + k.Key.ToString("X16") + " | " + k.Value);
}
}
}
totalGadgets.Add("xorRsi: ");
curatedGadgets.Add("xorRsi: ");
foreach (KeyValuePair<IntPtr, string> k in rcg.x64Opcodes.xorRsi)
{
if (k.Value.Contains("xor rsi") && k.Value.Contains("ret"))
{
totalGadgets.Add("0x" + k.Key.ToString("X16") + " | " + k.Value);
if (!k.Value.Any(char.IsDigit) && !k.Value.ToLower().Contains("invalid"))
{
curatedGadgets.Add("0x" + k.Key.ToString("X16") + " | " + k.Value);
}
}
}
totalGadgets.Add("xorRdi: ");
curatedGadgets.Add("xorRdi: ");
foreach (KeyValuePair<IntPtr, string> k in rcg.x64Opcodes.xorRdi)
{
if (k.Value.Contains("xor rdi") && k.Value.Contains("ret"))
{
totalGadgets.Add("0x" + k.Key.ToString("X16") + " | " + k.Value);
if (!k.Value.Any(char.IsDigit) && !k.Value.ToLower().Contains("invalid"))
{
curatedGadgets.Add("0x" + k.Key.ToString("X16") + " | " + k.Value);
}
}
}
totalGadgets.Add("popRax: ");
curatedGadgets.Add("popRax: ");
foreach (KeyValuePa
gitextract_3ejl9pf4/
├── .gitattributes
├── .gitignore
├── DllExport.bat
├── ERC/
│ ├── .gitignore
│ ├── Documentation/
│ │ ├── .gitignore
│ │ ├── api/
│ │ │ ├── .gitignore
│ │ │ └── index.md
│ │ ├── articles/
│ │ │ ├── LICENSE.md
│ │ │ ├── intro.md
│ │ │ └── toc.yml
│ │ ├── docfx.json
│ │ ├── index.md
│ │ └── toc.yml
│ ├── ERC/
│ │ ├── .gitignore
│ │ ├── Convert.cs
│ │ ├── Display_Output.cs
│ │ ├── ERC.Net.csproj
│ │ ├── ERC.Net.xml
│ │ ├── ERCException.cs
│ │ ├── ERC_Core.cs
│ │ ├── FodyWeavers.xml
│ │ ├── FodyWeavers.xsd
│ │ ├── Heap_Info.cs
│ │ ├── Module_Info.cs
│ │ ├── Opcode_Assembler.cs
│ │ ├── Opcode_Disassembler.cs
│ │ ├── Pattern_Tools.cs
│ │ ├── Payloads.cs
│ │ ├── Process_Info.cs
│ │ ├── PtrRemover.cs
│ │ ├── RopChainGenerator32.cs
│ │ ├── RopChainGenerator64.cs
│ │ ├── Thread_Info.cs
│ │ └── Win32Errors.cs
│ ├── LICENSE
│ ├── README.md
│ └── docs/
│ ├── api/
│ │ ├── ERC.DisplayOutput.html
│ │ ├── ERC.ERCException.html
│ │ ├── ERC.ErcCore.html
│ │ ├── ERC.ErcResult-1.html
│ │ ├── ERC.MachineType.html
│ │ ├── ERC.ModuleInfo.html
│ │ ├── ERC.ProcessInfo.html
│ │ ├── ERC.Structures.AllocationProtect.html
│ │ ├── ERC.Structures.CONTEXT32.html
│ │ ├── ERC.Structures.CONTEXT64.html
│ │ ├── ERC.Structures.CONTEXT_FLAGS.html
│ │ ├── ERC.Structures.ClientID.html
│ │ ├── ERC.Structures.FLOATING_SAVE_AREA.html
│ │ ├── ERC.Structures.IMAGE_DATA_DIRECTORY.html
│ │ ├── ERC.Structures.IMAGE_DOS_HEADER.html
│ │ ├── ERC.Structures.IMAGE_FILE_HEADER.html
│ │ ├── ERC.Structures.IMAGE_LOAD_CONFIG_CODE_INTEGRITY.html
│ │ ├── ERC.Structures.IMAGE_LOAD_CONFIG_DIRECTORY32.html
│ │ ├── ERC.Structures.IMAGE_LOAD_CONFIG_DIRECTORY64.html
│ │ ├── ERC.Structures.IMAGE_NT_HEADERS32.html
│ │ ├── ERC.Structures.IMAGE_NT_HEADERS64.html
│ │ ├── ERC.Structures.IMAGE_OPTIONAL_HEADER32.html
│ │ ├── ERC.Structures.IMAGE_OPTIONAL_HEADER64.html
│ │ ├── ERC.Structures.LIST_ENTRY.html
│ │ ├── ERC.Structures.LOADED_IMAGE.html
│ │ ├── ERC.Structures.LoadLibraryFlags.html
│ │ ├── ERC.Structures.M128A.html
│ │ ├── ERC.Structures.MEMORY_BASIC_INFORMATION32.html
│ │ ├── ERC.Structures.MEMORY_BASIC_INFORMATION64.html
│ │ ├── ERC.Structures.MagicType.html
│ │ ├── ERC.Structures.ProcessAccessFlags.html
│ │ ├── ERC.Structures.RegisterInfo.html
│ │ ├── ERC.Structures.StateEnum.html
│ │ ├── ERC.Structures.SubSystemType.html
│ │ ├── ERC.Structures.TEB.html
│ │ ├── ERC.Structures.ThreadAccess.html
│ │ ├── ERC.Structures.ThreadBasicInformation.html
│ │ ├── ERC.Structures.TypeEnum.html
│ │ ├── ERC.Structures.XSAVE_FORMAT64.html
│ │ ├── ERC.Structures.html
│ │ ├── ERC.ThreadInfo.html
│ │ ├── ERC.Utilities.Convert.html
│ │ ├── ERC.Utilities.OpcodeAssembler.html
│ │ ├── ERC.Utilities.OpcodeDisassembler.html
│ │ ├── ERC.Utilities.PatternTools.html
│ │ ├── ERC.Utilities.Payloads.html
│ │ ├── ERC.Utilities.PtrRemover.html
│ │ ├── ERC.Utilities.RopChainGenerator32.X86Lists.html
│ │ ├── ERC.Utilities.RopChainGenerator32.html
│ │ ├── ERC.Utilities.RopChainGenerator64.X64Lists.html
│ │ ├── ERC.Utilities.RopChainGenerator64.html
│ │ ├── ERC.Utilities.html
│ │ ├── ERC.html
│ │ ├── index.html
│ │ └── toc.html
│ ├── articles/
│ │ ├── LICENSE.html
│ │ ├── intro.html
│ │ └── toc.html
│ ├── index.html
│ ├── manifest.json
│ ├── search-stopwords.json
│ ├── styles/
│ │ ├── docfx.css
│ │ ├── docfx.js
│ │ ├── docfx.vendor.css
│ │ ├── docfx.vendor.js
│ │ ├── lunr.js
│ │ ├── main.css
│ │ ├── main.js
│ │ └── search-worker.js
│ ├── toc.html
│ └── xrefmap.yml
├── ERC.net/
│ └── ERC/
│ └── ERC.Net.xml
├── ErcXdbg/
│ ├── AssemblyInfo.cs
│ ├── ErcMain.cs
│ ├── ErcXdbg.cs
│ ├── ErcXdbgPlugin.csproj
│ ├── FodyWeavers.xml
│ ├── FodyWeavers.xsd
│ ├── Globals.cs
│ ├── RegisteredCommands.cs
│ ├── app.config
│ └── packages.config
├── ErcXdbgPlugin.sln
├── LICENSE
├── Managed.x64dbg/
│ ├── FodyWeavers.xml
│ ├── FodyWeavers.xsd
│ ├── Managed.x64dbg.csproj
│ ├── Properties/
│ │ └── AssemblyInfo.cs
│ ├── SDK/
│ │ ├── Bridge.cs
│ │ ├── Extensions.cs
│ │ ├── PLog.cs
│ │ ├── Plugins.cs
│ │ ├── TitanEngine.cs
│ │ └── WAPI.cs
│ ├── Script/
│ │ └── Module.cs
│ ├── app.config
│ └── packages.config
├── README.md
└── packages/
├── .gitignore
└── repositories.config
SYMBOL INDEX (517 symbols across 30 files)
FILE: ERC/ERC/Convert.cs
class Convert (line 11) | public static class Convert
method HexToAscii (line 21) | public static string HexToAscii(string hex)
method HexToBytes (line 63) | public static byte[] HexToBytes(string hex)
method AsciiToBytes (line 87) | public static byte[] AsciiToBytes(string ascii)
method AsciiToHex (line 97) | public static string AsciiToHex(string ascii)
method UnicodeToBytes (line 109) | public static byte[] UnicodeToBytes(string unicode)
method UnicodeToHex (line 119) | public static string UnicodeToHex(string unicode)
method UTF7ToBytes (line 131) | public static byte[] UTF7ToBytes(string utf7)
method UTF7ToHex (line 141) | public static string UTF7ToHex(string utf7)
method UTF8ToBytes (line 153) | public static byte[] UTF8ToBytes(string utf8)
method UTF8ToHex (line 163) | public static string UTF8ToHex(string utf8)
method UTF32ToBytes (line 175) | public static byte[] UTF32ToBytes(string utf32)
method UTF32ToHex (line 185) | public static string UTF32ToHex(string utf32)
method htmlWhitespaceFix (line 197) | public static string htmlWhitespaceFix(string str)
FILE: ERC/ERC/Display_Output.cs
class DisplayOutput (line 14) | public static class DisplayOutput
method GetFilePath (line 26) | internal static string GetFilePath(string directory, string prefix, st...
method WriteToFile (line 59) | public static void WriteToFile(string directory, string prefix, string...
method GeneratePattern (line 79) | public static string GeneratePattern(int length, ErcCore core, bool ex...
method PatternOutputBuilder (line 100) | private static string PatternOutputBuilder(string pattern, ErcCore core)
method ListLocalProcesses (line 153) | public static string ListLocalProcesses()
method ListRemoteProcesses (line 175) | public static string ListRemoteProcesses(string machineName)
method DisplayProcessInfo (line 199) | public static string DisplayProcessInfo(ProcessInfo info, bool outputT...
method DisplayThreadInfo (line 225) | public static string DisplayThreadInfo(ProcessInfo info, bool outputTo...
method DisplayModuleInfo (line 265) | internal static string DisplayModuleInfo(ProcessInfo info)
method GenerateModuleInfoTable (line 385) | public static string GenerateModuleInfoTable(ProcessInfo info, bool ou...
method SearchMemory (line 412) | public static string[] SearchMemory(ProcessInfo info, int searchType, ...
method SearchModules (line 526) | public static string[] SearchModules(ProcessInfo info, int searchType,...
method GetSEHJumps (line 637) | public static string[] GetSEHJumps(ProcessInfo info, bool aslr = false,
method GetSEHJumps (line 783) | public static string[] GetSEHJumps(ProcessInfo info, byte[] ptrsToExcl...
method GetSEHJumpsUnicode (line 894) | public static string[] GetSEHJumpsUnicode(ProcessInfo info, bool aslr ...
method GenerateByteArray (line 1050) | public static byte[] GenerateByteArray(ErcCore core, byte[] unwantedBy...
method CompareByteArrayToMemoryRegion (line 1136) | public static string[] CompareByteArrayToMemoryRegion(ProcessInfo info...
method GenerateEggHunters (line 1214) | public static string GenerateEggHunters(ErcCore core = null, string ta...
method GenerateFindNRPTable (line 1280) | public static string[] GenerateFindNRPTable(ProcessInfo info, int sear...
method RopChainGadgets32 (line 1360) | public static string[] RopChainGadgets32(RopChainGenerator32 rcg, bool...
method RopChainGadgets64 (line 2064) | public static string[] RopChainGadgets64(RopChainGenerator64 rcg, bool...
method ConvertRopElementToString (line 2723) | private static string ConvertRopElementToString(Tuple<IntPtr, string> ...
method AssembleOpcodes (line 2737) | public static string[] AssembleOpcodes(string[] instructions, uint mac...
method AssembleOpcodes (line 2770) | public static string[] AssembleOpcodes(string[] instructions, MachineT...
method DisassembleOpcodes (line 2796) | public static string[] DisassembleOpcodes(byte[] opcodes, uint machine)
method DisassembleOpcodes (line 2828) | public static string[] DisassembleOpcodes(byte[] opcodes, MachineType ...
method StringToByteArray (line 2851) | private static byte[] StringToByteArray(string hex)
method DumpMemory (line 2869) | public static string DumpMemory(ProcessInfo info, IntPtr startAddress,...
method DumpHeap (line 2926) | public static string[] DumpHeap(HeapInfo hi, ulong heapid = 0, string ...
method HeapStats (line 3051) | public static string[] HeapStats(HeapInfo hi, ulong heapID = 0, string...
method ListHeapIDs (line 3072) | public static string[] ListHeapIDs(HeapInfo hi)
method SearchHeap (line 3101) | public static string[] SearchHeap(HeapInfo hi, byte[] searchBytes, ulo...
FILE: ERC/ERC/ERCException.cs
class ERCException (line 9) | [Serializable]
method ERCException (line 16) | public ERCException(string message)
method ERCException (line 25) | protected ERCException(SerializationInfo info, StreamingContext ctxt)
FILE: ERC/ERC/ERC_Core.cs
class ErcCore (line 16) | public class ErcCore
method OpenProcess (line 59) | [DllImport("kernel32.dll", SetLastError = true)]
method ReadProcessMemory (line 71) | [DllImport("kernel32.dll", SetLastError = true, CallingConvention = Ca...
method VirtualQueryEx32 (line 82) | [DllImport("kernel32.dll", SetLastError = true, EntryPoint = "VirtualQ...
method VirtualQueryEx64 (line 93) | [DllImport("kernel32.dll", SetLastError = true, EntryPoint = "VirtualQ...
method IsWow64Process (line 102) | [DllImport("kernel32.dll", SetLastError = true, CallingConvention = Ca...
method OpenThread (line 113) | [DllImport("kernel32.dll", SetLastError = true)]
method GetThreadContext32 (line 122) | [DllImport("kernel32.dll", SetLastError = true, EntryPoint = "GetThrea...
method Wow64GetThreadContext (line 131) | [DllImport("kernel32.dll", SetLastError = true)]
method GetThreadContext64 (line 140) | [DllImport("kernel32.dll", SetLastError = true, EntryPoint = "GetThrea...
method SuspendThread (line 148) | [DllImport("kernel32.dll", SetLastError= true)]
method CloseHandle (line 156) | [DllImport("kernel32.dll", SetLastError = true)]
method GetProcAddress (line 165) | [DllImport("kernel32.dll", CharSet = CharSet.Ansi, ExactSpelling = tru...
method LoadLibraryEx (line 175) | [DllImport("kernel32.dll", SetLastError = true)]
method FindResouce (line 185) | [DllImport("kernel32.dll", SetLastError = true, EntryPoint = "FindReso...
method LoadResource (line 194) | [DllImport("kernel32.dll", SetLastError = true)]
method GetProcessId (line 202) | [DllImport("kernel32.dll", SetLastError = true)]
method GetHandleInformation (line 211) | [DllImport("kernel32.dll")]
method GetModuleHandle (line 219) | [DllImport("user32.dll", EntryPoint = "GetModuleHandleW", SetLastError...
method ZwQueryInformationThread (line 231) | [DllImport("ntdll.dll", SetLastError = true)]
method EnumProcessModulesEx (line 244) | [DllImport("psapi.dll", SetLastError = true)]
method GetModuleFileNameEx (line 257) | [DllImport("psapi.dll", SetLastError = true)]
method ImageLoad (line 267) | [DllImport("Imagehlp.dll", SetLastError = true)]
method GetImageConfigInformation32 (line 276) | [DllImport("Imagehlp.dll", SetLastError = true, EntryPoint = "GetImage...
method GetImageConfigInformation64 (line 285) | [DllImport("Imagehlp.dll", SetLastError = true, EntryPoint = "GetImage...
method GetImageConfigInformation32 (line 294) | [DllImport("Imagehlp.dll", SetLastError = true, EntryPoint = "GetImage...
method GetImageConfigInformation64 (line 303) | [DllImport("Imagehlp.dll", SetLastError = true, EntryPoint = "GetImage...
method MapAndLoad (line 315) | [DllImport("Imagehlp.dll", SetLastError = true)]
method CreateToolhelp32Snapshot (line 324) | [DllImport("kernel32", SetLastError = true, CallingConvention = Callin...
method Process32First (line 333) | [DllImport("kernel32", SetLastError = true, CallingConvention = Callin...
method Process32Next (line 342) | [DllImport("kernel32", SetLastError = true, CallingConvention = Callin...
method Heap32ListFirst (line 351) | [DllImport("kernel32.dll", SetLastError = true, CallingConvention = Ca...
method Heap32ListNext (line 360) | [DllImport("kernel32.dll", SetLastError = true, CallingConvention = Ca...
method Heap32First (line 370) | [DllImport("kernel32.dll", SetLastError = true, CallingConvention = Ca...
method Heap32Next (line 378) | [DllImport("kernel32.dll", SetLastError = true, CallingConvention = Ca...
method ErcCore (line 386) | public ErcCore()
method ErcCore (line 494) | protected ErcCore(ErcCore parent)
method BuildDefaultConfig (line 500) | private void BuildDefaultConfig()
method SetWorkingDirectory (line 561) | public void SetWorkingDirectory(string path)
method SetPatternStandardPath (line 588) | public void SetPatternStandardPath(string path)
method SetPatternExtendedPath (line 615) | public void SetPatternExtendedPath(string path)
method SetAuthor (line 642) | public void SetAuthor(string author)
method SetErrorFile (line 658) | public void SetErrorFile(string path)
method LogEvent (line 702) | public void LogEvent(Exception e)
method X64toX32PointerModifier (line 719) | internal static byte[] X64toX32PointerModifier(byte[] ptr64)
class ErcResult (line 734) | public class ErcResult<T> : ErcCore
method ErcResult (line 749) | public ErcResult(ErcCore core) : base(core)
method ErcResult (line 759) | public ErcResult(ErcCore core, string errorFile) : base(core)
method LogEvent (line 767) | public void LogEvent()
method ToString (line 779) | public override string ToString()
type MachineType (line 803) | public enum MachineType
type IMAGE_DOS_HEADER (line 841) | [StructLayout(LayoutKind.Explicit)]
type IMAGE_FILE_HEADER (line 855) | [StructLayout(LayoutKind.Explicit)]
type IMAGE_NT_HEADERS32 (line 893) | [StructLayout(LayoutKind.Explicit)]
type IMAGE_NT_HEADERS64 (line 913) | [StructLayout(LayoutKind.Explicit)]
type IMAGE_DATA_DIRECTORY (line 935) | [StructLayout(LayoutKind.Explicit)]
type IMAGE_OPTIONAL_HEADER32 (line 953) | [StructLayout(LayoutKind.Explicit)]
type IMAGE_OPTIONAL_HEADER64 (line 1147) | [StructLayout(LayoutKind.Explicit)]
type MagicType (line 1337) | public enum MagicType : ushort
type SubSystemType (line 1354) | public enum SubSystemType : ushort
type IMAGE_LOAD_CONFIG_DIRECTORY32 (line 1407) | [StructLayout(LayoutKind.Sequential)]
type IMAGE_LOAD_CONFIG_DIRECTORY64 (line 1585) | [StructLayout(LayoutKind.Sequential)]
type IMAGE_LOAD_CONFIG_CODE_INTEGRITY (line 1763) | [StructLayout(LayoutKind.Sequential)]
type LOADED_IMAGE (line 1789) | public struct LOADED_IMAGE
type LIST_ENTRY (line 1854) | public struct LIST_ENTRY
type AllocationProtect (line 1875) | public enum AllocationProtect : uint
type StateEnum (line 1928) | public enum StateEnum : uint
type TypeEnum (line 1949) | public enum TypeEnum : uint
type MEMORY_BASIC_INFORMATION32 (line 1970) | [StructLayout(LayoutKind.Sequential)]
type MEMORY_BASIC_INFORMATION64 (line 2008) | [StructLayout(LayoutKind.Sequential)]
type ProcessAccessFlags (line 2054) | [Flags]
type LoadLibraryFlags (line 2116) | [Flags]
type ThreadAccess (line 2178) | [Flags]
type CONTEXT_FLAGS (line 2228) | public enum CONTEXT_FLAGS : uint
type FLOATING_SAVE_AREA (line 2277) | [StructLayout(LayoutKind.Sequential)]
type CONTEXT32 (line 2324) | [StructLayout(LayoutKind.Sequential)]
method ToString (line 2433) | public override string ToString()
type M128A (line 2454) | [StructLayout(LayoutKind.Sequential)]
method ToString (line 2470) | public override string ToString()
type XSAVE_FORMAT64 (line 2481) | [StructLayout(LayoutKind.Sequential, Pack = 16)]
type CONTEXT64 (line 2558) | [StructLayout(LayoutKind.Sequential, Pack = 16)]
method ToString (line 2758) | public override string ToString()
class RegisterInfo (line 2787) | public class RegisterInfo
type ThreadBasicInformation (line 2827) | [StructLayout(LayoutKind.Sequential)]
type ClientID (line 2859) | [StructLayout(LayoutKind.Sequential)]
type TEB (line 2875) | [StructLayout(LayoutKind.Sequential)]
type SnapshotFlags (line 3065) | [Flags]
type PROCESSENTRY32 (line 3081) | [StructLayout(LayoutKind.Sequential)]
type HEAPLIST32 (line 3101) | [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Auto)]
type HEAPENTRY32 (line 3113) | [StructLayout(LayoutKind.Sequential)]
FILE: ERC/ERC/Heap_Info.cs
class HeapInfo (line 8) | public class HeapInfo
method HeapInfo (line 18) | public HeapInfo(ProcessInfo info)
method SearchHeap (line 80) | public ErcResult<List<Tuple<IntPtr, IntPtr, IntPtr>>> SearchHeap(byte[...
method HeapStatistics (line 224) | public ErcResult<List<string>> HeapStatistics(bool extended = false, u...
method HeapIDs (line 443) | public ErcResult<List<ulong>> HeapIDs()
FILE: ERC/ERC/Module_Info.cs
class ModuleInfo (line 15) | public class ModuleInfo
method ModuleInfo (line 115) | internal unsafe ModuleInfo(string module, IntPtr ptr, Process process,...
method PopulateHeaderStructs (line 301) | private unsafe void PopulateHeaderStructs(FileStream fin)
method PopulateConfigStruct (line 367) | private void PopulateConfigStruct()
method SearchModule (line 402) | public ErcResult<List<IntPtr>> SearchModule(byte[] searchBytes)
method SearchBytePattern (line 423) | private List<int> SearchBytePattern(byte[] pattern, byte[] bytes)
method ToString (line 451) | public override string ToString()
FILE: ERC/ERC/Opcode_Assembler.cs
class OpcodeAssembler (line 11) | public class OpcodeAssembler : ProcessInfo
method OpcodeAssembler (line 17) | public OpcodeAssembler(ProcessInfo parent) : base(parent)
method AssembleOpcodes (line 27) | public ErcResult<byte[]> AssembleOpcodes(List<string> instructions)
method AssembleOpcodes (line 71) | public static ErcResult<byte[]> AssembleOpcodes(List<string> instructi...
FILE: ERC/ERC/Opcode_Disassembler.cs
class OpcodeDisassembler (line 10) | public class OpcodeDisassembler : ProcessInfo
method OpcodeDisassembler (line 16) | public OpcodeDisassembler(ProcessInfo parent) : base(parent)
method Disassemble (line 26) | public ErcResult<string> Disassemble(byte[] opcodes)
method Disassemble (line 85) | public static ErcResult<string> Disassemble(byte[] opcodes, MachineTyp...
method Disassemble (line 145) | public static ErcResult<string> Disassemble(byte[] opcodes, MachineTyp...
method HexStringToByteArray (line 197) | private static byte[] HexStringToByteArray(string hex)
FILE: ERC/ERC/Pattern_Tools.cs
class PatternTools (line 11) | public static class PatternTools
method PatternCreate (line 27) | public static ErcResult<string> PatternCreate(int length, ErcCore core...
method PatternOffset (line 127) | public static ErcResult<string> PatternOffset(string pattern, ErcCore ...
FILE: ERC/ERC/Payloads.cs
class Payloads (line 10) | public static class Payloads
method ByteArrayConstructor (line 86) | public static byte[] ByteArrayConstructor(byte[] unwantedBytes)
method EggHunterConstructor (line 127) | public static Dictionary<string, byte[]> EggHunterConstructor(string t...
method PopPopRet (line 201) | public static List<int> PopPopRet(byte[] data)
method ByteCompare (line 306) | public static Tuple<bool, byte[], byte[]> ByteCompare(ProcessInfo info...
method ByteCompare (line 329) | public static Tuple<bool, byte[], byte[]> ByteCompare(ProcessInfo info...
FILE: ERC/ERC/Process_Info.cs
class ProcessInfo (line 16) | public class ProcessInfo : ErcCore
method ProcessInfo (line 53) | public ProcessInfo(ErcCore core, Process process) : base(core)
method ProcessInfo (line 105) | public ProcessInfo(ErcCore core, IntPtr handle) : base(core)
method ProcessInfo (line 165) | protected ProcessInfo(ProcessInfo parent)
method ListLocalProcesses (line 193) | public static ErcResult<Process[]> ListLocalProcesses(ErcCore core)
method ListRemoteProcesses (line 235) | public static ErcResult<Process[]> ListRemoteProcesses(ErcCore core, s...
method GetProcessModules (line 283) | public ErcResult<Dictionary<string, IntPtr>> GetProcessModules()
method Is64Bit (line 340) | public static bool Is64Bit(Process process)
method LocateMemoryRegions (line 367) | private void LocateMemoryRegions()
method SearchProcessMemory (line 437) | internal ErcResult<List<IntPtr>> SearchProcessMemory(byte[] searchBytes)
method SearchProcessMemory (line 587) | internal ErcResult<List<IntPtr>> SearchProcessMemory(byte[] searchByte...
method SearchAllMemoryPPR (line 740) | public ErcResult<Dictionary<IntPtr, string>> SearchAllMemoryPPR(List<s...
method SearchAllMemoryPPR (line 888) | public ErcResult<Dictionary<IntPtr, string>> SearchAllMemoryPPR(byte[]...
method SearchMemory (line 1041) | public ErcResult<Dictionary<IntPtr, string>> SearchMemory(int searchTy...
method SearchMemory (line 1134) | public ErcResult<Dictionary<IntPtr, string>> SearchMemory(int searchTy...
method SearchModules (line 1233) | public ErcResult<Dictionary<IntPtr, string>> SearchModules(int searchT...
method FindNRP (line 1320) | public ErcResult<List<RegisterInfo>> FindNRP(int searchType = 0, bool ...
method ByteIndexOf (line 2056) | private static int ByteIndexOf(byte[] haystack, byte[] needle)
method MakeCharTable (line 2081) | private static int[] MakeCharTable(byte[] needle)
method MakeOffsetTable (line 2098) | private static int[] MakeOffsetTable(byte[] needle)
method IsPrefix (line 2121) | private static bool IsPrefix(byte[] needle, int p)
method SuffixLength (line 2134) | private static int SuffixLength(byte[] needle, int p)
method CreateExcludesList (line 2152) | public List<string> CreateExcludesList(bool aslr = false, bool safeseh...
method ToString (line 2194) | public override string ToString()
method GetModuleHandles (line 2220) | public ErcResult<Dictionary<string, IntPtr>> GetModuleHandles()
method GetProcessModuleInformation (line 2241) | public ErcResult<List<ModuleInfo>> GetProcessModuleInformation()
method GetProcessThreadInformation (line 2262) | public ErcResult<List<ThreadInfo>> GetProcessThreadInformation()
method DumpMemoryRegion (line 2285) | public ErcResult<byte[]> DumpMemoryRegion(IntPtr startAddress, int len...
FILE: ERC/ERC/PtrRemover.cs
class PtrRemover (line 10) | public static class PtrRemover
method RemovePointers (line 19) | public static List<IntPtr> RemovePointers(MachineType mt, List<IntPtr>...
method RemovePointers (line 85) | public static Dictionary<IntPtr, string> RemovePointers(MachineType mt...
method RemovePointersProtection (line 150) | public static List<IntPtr> RemovePointersProtection(ProcessInfo info, ...
method RemovePointersProtection (line 319) | public static List<IntPtr> RemovePointersProtection(ProcessInfo info, ...
FILE: ERC/ERC/RopChainGenerator32.cs
class RopChainGenerator32 (line 15) | public class RopChainGenerator32
method RopChainGenerator32 (line 55) | public RopChainGenerator32(ProcessInfo _info)
method GenerateRopGadgets32 (line 169) | public ErcResult<string> GenerateRopGadgets32(byte[] ptrsToExclude = n...
method GenerateRopChain32 (line 257) | public ErcResult<string> GenerateRopChain32(byte[] ptrsToExclude, byte...
method GenerateRopChain32 (line 383) | public ErcResult<string> GenerateRopChain32(byte[] startAddress = null...
method GetApiAddresses (line 461) | private ErcResult<int> GetApiAddresses(ProcessInfo info)
method GetRopNops (line 538) | private ErcResult<List<IntPtr>> GetRopNops(List<string> excludes = null)
method GetRopNops (line 556) | private ErcResult<List<IntPtr>> GetRopNops(ProcessInfo info)
method PopulateOpcodes (line 576) | private ErcResult<int> PopulateOpcodes(ProcessInfo info)
method ParseByteArrayForRopCodes (line 602) | private ErcResult<int> ParseByteArrayForRopCodes(byte[] bytes, Process...
method optimiseLists (line 1047) | private void optimiseLists(ProcessInfo info)
method GenerateVirtualAllocChain32 (line 1639) | private ErcResult<List<Tuple<byte[], string>>> GenerateVirtualAllocCha...
method GenerateHeapCreateChain32 (line 2202) | private ErcResult<List<Tuple<byte[], string>>> GenerateHeapCreateChain...
method GenerateVirtualProtectChain32 (line 2667) | private ErcResult<List<Tuple<byte[], string>>> GenerateVirtualProtectC...
method GenerateWriteProcessMemoryChain32 (line 3198) | private ErcResult<List<Tuple<byte[], string>>> GenerateWriteProcessMem...
method BuildRopChain (line 3205) | private List<Tuple<byte[], string>> BuildRopChain(RegisterLists32 regL...
method CalculateAddInstructions32 (line 3293) | private byte[] CalculateAddInstructions32(int size)
method ZeroRegister (line 3316) | private List<Tuple<byte[], string, Register32>> ZeroRegister(Register3...
method SetRegisterModifier (line 3361) | private void SetRegisterModifier(Register32 modifyingReg, Register32 m...
method GetRegisterModified (line 3401) | private bool GetRegisterModified(Register32 modifyingReg, Register32 m...
method GetPopInstruction (line 3444) | private Tuple<byte[], string, Register32> GetPopInstruction(Register32...
method GetXorInstruction (line 3527) | private Tuple<byte[], string, Register32> GetXorInstruction(Register32...
method GetMovInstruction (line 3587) | private Tuple<byte[], string, Register32> GetMovInstruction(Register32...
method GetAddInstruction (line 3615) | private Tuple<byte[], string, Register32> GetAddInstruction(Register32...
method registerIdentifier32 (line 3635) | private Register32 registerIdentifier32(string reg)
method CompleteRegisters32 (line 3667) | private bool CompleteRegisters32(Register32 regState)
type Register32 (line 3709) | private enum Register32 : ushort
class X86Lists (line 3735) | public class X86Lists
class RegisterModifiers32 (line 3920) | private class RegisterModifiers32
class RegisterLists32 (line 3932) | private class RegisterLists32
type RopMethod (line 3947) | [Flags]
FILE: ERC/ERC/RopChainGenerator64.cs
class RopChainGenerator64 (line 10) | public class RopChainGenerator64
method RopChainGenerator64 (line 49) | public RopChainGenerator64(ProcessInfo _info)
method GenerateRopGadgets64 (line 264) | public ErcResult<string> GenerateRopGadgets64(byte[] ptrsToExclude = n...
method GenerateRopChain64 (line 393) | public ErcResult<string> GenerateRopChain64(byte[] ptrsToExclude, byte...
method GenerateRopChain64 (line 563) | public ErcResult<string> GenerateRopChain64(byte[] startAddress = null...
method GetApiAddresses (line 650) | private ErcResult<int> GetApiAddresses(ProcessInfo info)
method GetRopNops (line 713) | private ErcResult<List<IntPtr>> GetRopNops(ProcessInfo info, List<stri...
method GetRopNops (line 731) | private ErcResult<List<IntPtr>> GetRopNops(ProcessInfo info)
method PopulateOpcodes (line 751) | private ErcResult<int> PopulateOpcodes(ProcessInfo info)
method ParseByteArrayForRopCodes (line 777) | private ErcResult<int> ParseByteArrayForRopCodes(byte[] bytes, Process...
method OptimiseLists (line 1669) | private void OptimiseLists(ProcessInfo info)
method GenerateVirtualAllocChain64 (line 2781) | private ErcResult<List<Tuple<byte[], string>>> GenerateVirtualAllocCha...
method GenerateHeapCreateChain64 (line 3190) | private ErcResult<List<Tuple<byte[], string>>> GenerateHeapCreateChain...
method GenerateVirtualProtectChain64 (line 3501) | private ErcResult<List<Tuple<byte[], string>>> GenerateVirtualProtectC...
method BuildRopChain (line 3847) | private List<Tuple<byte[], string>> BuildRopChain(RopMethod method, Re...
method CalculateAddInstructions64 (line 3897) | private byte[] CalculateAddInstructions64(int size)
method ZeroRegister (line 3920) | private List<Tuple<byte[], string, Register64>> ZeroRegister(Register6...
method SetRegisterModifier (line 3965) | private void SetRegisterModifier(Register64 modifyingReg, Register64 m...
method GetRegisterModified (line 4022) | private bool GetRegisterModified(Register64 modifyingReg, Register64 m...
method GetPopInstruction (line 4089) | private Tuple<byte[], string, Register64> GetPopInstruction(Register64...
method GetXorInstruction (line 4245) | private Tuple<byte[], string, Register64> GetXorInstruction(Register64...
method GetAddInstruction (line 4305) | private Tuple<byte[], string, Register64> GetAddInstruction(Register64...
method GetSubInstruction (line 4331) | private Tuple<byte[], string, Register64> GetSubInstruction(Register64...
method GetMovInstruction (line 4358) | private Tuple<byte[], string, Register64> GetMovInstruction(Register64...
method registerIdentifier64 (line 4377) | private Register64 registerIdentifier64(string reg)
method CompleteRegisters64 (line 4420) | private bool CompleteRegisters64(Register64 regState64)
type Register64 (line 4494) | private enum Register64
class RegisterModifiers64 (line 4532) | private class RegisterModifiers64
class X64Lists (line 4556) | public class X64Lists
class RegisterLists64 (line 4909) | private class RegisterLists64
type RopMethod (line 4932) | [Flags]
FILE: ERC/ERC/Thread_Info.cs
class ThreadInfo (line 16) | public class ThreadInfo
method ThreadInfo (line 48) | internal ThreadInfo(ProcessThread thread, ErcCore core, ProcessInfo pr...
method Get_Context (line 96) | public ErcResult<string> Get_Context()
method PopulateTEB (line 182) | internal ErcResult<string> PopulateTEB()
method PopulateTEBStruct32 (line 239) | private void PopulateTEBStruct32(byte[] tebBytes)
method PopulateTEBStruct64 (line 300) | private void PopulateTEBStruct64(byte[] tebBytes)
method BuildSehChain (line 362) | internal ErcResult<List<Tuple<byte[], byte[]>>> BuildSehChain()
method GetSehChain (line 507) | public List<Tuple<IntPtr, IntPtr>> GetSehChain()
method GetTeb (line 544) | public TEB GetTeb()
method ToString (line 557) | public override string ToString()
FILE: ERC/ERC/Win32Errors.cs
class Win32Errors (line 7) | public static class Win32Errors
method LocalFree (line 10) | [DllImport("kernel32.dll", SetLastError = true)]
method FormatMessage (line 13) | [DllImport("kernel32.dll", SetLastError = true)]
type FormatMessageFlags (line 16) | [Flags]
method GetLastWin32Error (line 32) | public static string GetLastWin32Error(int errorCode = 0)
FILE: ERC/docs/styles/docfx.js
function breakText (line 43) | function breakText() {
function renderTables (line 53) | function renderTables() {
function renderAlerts (line 58) | function renderAlerts() {
function renderLinks (line 74) | function renderLinks() {
function highlight (line 83) | function highlight() {
function enableSearch (line 123) | function enableSearch() {
function renderNavbar (line 343) | function renderNavbar() {
function renderSidebar (line 410) | function renderSidebar() {
function renderBreadcrumb (line 560) | function renderBreadcrumb() {
function renderAffix (line 580) | function renderAffix() {
function renderFooter (line 693) | function renderFooter() {
function renderLogo (line 734) | function renderLogo() {
function renderTabs (line 767) | function renderTabs() {
function utility (line 1032) | function utility() {
function workAroundFixedHeaderForAnchors (line 1118) | function workAroundFixedHeaderForAnchors() {
FILE: ERC/docs/styles/docfx.vendor.js
function s (line 2) | function s(a){var b="length"in a&&a.length,c=n.type(a);return"function"=...
function ga (line 2) | function ga(a,b,d,e){var f,h,j,k,l,o,r,s,w,x;if((b?b.ownerDocument||b:v)...
function ha (line 2) | function ha(){var a=[];function b(c,e){return a.push(c+" ")>d.cacheLengt...
function ia (line 2) | function ia(a){return a[u]=!0,a}
function ja (line 2) | function ja(a){var b=n.createElement("div");try{return!!a(b)}catch(c){re...
function ka (line 2) | function ka(a,b){var c=a.split("|"),e=a.length;while(e--)d.attrHandle[c[...
function la (line 2) | function la(a,b){var c=b&&a,d=c&&1===a.nodeType&&1===b.nodeType&&(~b.sou...
function ma (line 2) | function ma(a){return function(b){var c=b.nodeName.toLowerCase();return"...
function na (line 2) | function na(a){return function(b){var c=b.nodeName.toLowerCase();return(...
function oa (line 2) | function oa(a){return ia(function(b){return b=+b,ia(function(c,d){var e,...
function pa (line 2) | function pa(a){return a&&"undefined"!=typeof a.getElementsByTagName&&a}
function qa (line 2) | function qa(){}
function ra (line 2) | function ra(a){for(var b=0,c=a.length,d="";c>b;b++)d+=a[b].value;return d}
function sa (line 2) | function sa(a,b,c){var d=b.dir,e=c&&"parentNode"===d,f=x++;return b.firs...
function ta (line 2) | function ta(a){return a.length>1?function(b,c,d){var e=a.length;while(e-...
function ua (line 2) | function ua(a,b,c){for(var d=0,e=b.length;e>d;d++)ga(a,b[d],c);return c}
function va (line 2) | function va(a,b,c,d,e){for(var f,g=[],h=0,i=a.length,j=null!=b;i>h;h++)(...
function wa (line 2) | function wa(a,b,c,d,e,f){return d&&!d[u]&&(d=wa(d)),e&&!e[u]&&(e=wa(e,f)...
function xa (line 2) | function xa(a){for(var b,c,e,f=a.length,g=d.relative[a[0].type],h=g||d.r...
function ya (line 2) | function ya(a,b){var c=b.length>0,e=a.length>0,f=function(f,g,h,i,k){var...
function x (line 2) | function x(a,b,c){if(n.isFunction(b))return n.grep(a,function(a,d){retur...
function D (line 2) | function D(a,b){while((a=a[b])&&1!==a.nodeType);return a}
function G (line 2) | function G(a){var b=F[a]={};return n.each(a.match(E)||[],function(a,c){b...
function I (line 2) | function I(){l.removeEventListener("DOMContentLoaded",I,!1),a.removeEven...
function K (line 2) | function K(){Object.defineProperty(this.cache={},0,{get:function(){retur...
function P (line 2) | function P(a,b,c){var d;if(void 0===c&&1===a.nodeType)if(d="data-"+b.rep...
function Z (line 3) | function Z(){return!0}
function $ (line 3) | function $(){return!1}
function _ (line 3) | function _(){try{return l.activeElement}catch(a){}}
function ja (line 3) | function ja(a,b){return n.nodeName(a,"table")&&n.nodeName(11!==b.nodeTyp...
function ka (line 3) | function ka(a){return a.type=(null!==a.getAttribute("type"))+"/"+a.type,a}
function la (line 3) | function la(a){var b=ga.exec(a.type);return b?a.type=b[1]:a.removeAttrib...
function ma (line 3) | function ma(a,b){for(var c=0,d=a.length;d>c;c++)L.set(a[c],"globalEval",...
function na (line 3) | function na(a,b){var c,d,e,f,g,h,i,j;if(1===b.nodeType){if(L.hasData(a)&...
function oa (line 3) | function oa(a,b){var c=a.getElementsByTagName?a.getElementsByTagName(b||...
function pa (line 3) | function pa(a,b){var c=b.nodeName.toLowerCase();"input"===c&&T.test(a.ty...
function sa (line 3) | function sa(b,c){var d,e=n(c.createElement(b)).appendTo(c.body),f=a.getD...
function ta (line 3) | function ta(a){var b=l,c=ra[a];return c||(c=sa(a,b),"none"!==c&&c||(qa=(...
function xa (line 3) | function xa(a,b,c){var d,e,f,g,h=a.style;return c=c||wa(a),c&&(g=c.getPr...
function ya (line 3) | function ya(a,b){return{get:function(){return a()?void delete this.get:(...
function g (line 3) | function g(){f.style.cssText="-webkit-box-sizing:border-box;-moz-box-siz...
function Fa (line 3) | function Fa(a,b){if(b in a)return b;var c=b[0].toUpperCase()+b.slice(1),...
function Ga (line 3) | function Ga(a,b,c){var d=Aa.exec(b);return d?Math.max(0,d[1]-(c||0))+(d[...
function Ha (line 3) | function Ha(a,b,c,d,e){for(var f=c===(d?"border":"content")?4:"width"===...
function Ia (line 3) | function Ia(a,b,c){var d=!0,e="width"===b?a.offsetWidth:a.offsetHeight,f...
function Ja (line 3) | function Ja(a,b){for(var c,d,e,f=[],g=0,h=a.length;h>g;g++)d=a[g],d.styl...
function Ka (line 3) | function Ka(a,b,c,d,e){return new Ka.prototype.init(a,b,c,d,e)}
function Sa (line 3) | function Sa(){return setTimeout(function(){La=void 0}),La=n.now()}
function Ta (line 3) | function Ta(a,b){var c,d=0,e={height:a};for(b=b?1:0;4>d;d+=2-b)c=R[d],e[...
function Ua (line 3) | function Ua(a,b,c){for(var d,e=(Ra[b]||[]).concat(Ra["*"]),f=0,g=e.lengt...
function Va (line 3) | function Va(a,b,c){var d,e,f,g,h,i,j,k,l=this,m={},o=a.style,p=a.nodeTyp...
function Wa (line 3) | function Wa(a,b){var c,d,e,f,g;for(c in a)if(d=n.camelCase(c),e=b[d],f=a...
function Xa (line 3) | function Xa(a,b,c){var d,e,f=0,g=Qa.length,h=n.Deferred().always(functio...
function qb (line 4) | function qb(a){return function(b,c){"string"!=typeof b&&(c=b,b="*");var ...
function rb (line 4) | function rb(a,b,c,d){var e={},f=a===mb;function g(h){var i;return e[h]=!...
function sb (line 4) | function sb(a,b){var c,d,e=n.ajaxSettings.flatOptions||{};for(c in b)voi...
function tb (line 4) | function tb(a,b,c){var d,e,f,g,h=a.contents,i=a.dataTypes;while("*"===i[...
function ub (line 4) | function ub(a,b,c,d){var e,f,g,h,i,j={},k=a.dataTypes.slice();if(k[1])fo...
function x (line 4) | function x(a,b,f,h){var j,r,s,u,w,x=b;2!==t&&(t=2,g&&clearTimeout(g),c=v...
function Ab (line 4) | function Ab(a,b,c,d){var e;if(n.isArray(b))n.each(b,function(b,e){c||wb....
function Jb (line 4) | function Jb(a){return n.isWindow(a)?a:9===a.nodeType&&a.defaultView}
function b (line 11) | function b(){var a=document.createElement("bootstrap"),b={WebkitTransiti...
function b (line 11) | function b(b){return this.each(function(){var c=a(this),e=c.data("bs.ale...
function c (line 11) | function c(){g.detach().trigger("closed.bs.alert").remove()}
function b (line 11) | function b(b){return this.each(function(){var d=a(this),e=d.data("bs.but...
function b (line 11) | function b(b){return this.each(function(){var d=a(this),e=d.data("bs.car...
function b (line 11) | function b(b){var c,d=b.attr("data-target")||(c=b.attr("href"))&&c.repla...
function c (line 11) | function c(b){return this.each(function(){var c=a(this),e=c.data("bs.col...
function b (line 11) | function b(b){var c=b.attr("data-target");c||(c=b.attr("href"),c=c&&/#[A...
function c (line 11) | function c(c){c&&3===c.which||(a(e).remove(),a(f).each(function(){var d=...
function d (line 11) | function d(b){return this.each(function(){var c=a(this),d=c.data("bs.dro...
function b (line 11) | function b(b,d){return this.each(function(){var e=a(this),f=e.data("bs.m...
function b (line 11) | function b(b){return this.each(function(){var d=a(this),e=d.data("bs.too...
function d (line 11) | function d(){"in"!=e.hoverState&&f.detach(),e.$element&&e.$element.remov...
function b (line 11) | function b(b){return this.each(function(){var d=a(this),e=d.data("bs.pop...
function b (line 11) | function b(c,d){this.$body=a(document.body),this.$scrollElement=a(a(c).i...
function c (line 11) | function c(c){return this.each(function(){var d=a(this),e=d.data("bs.scr...
function b (line 12) | function b(b){return this.each(function(){var d=a(this),e=d.data("bs.tab...
function f (line 12) | function f(){g.removeClass("active").find("> .dropdown-menu > .active")....
function b (line 12) | function b(b){return this.each(function(){var d=a(this),e=d.data("bs.aff...
function t (line 14) | function t(e){return e.replace(/&/g,"&").replace(/</g,"<").replac...
function r (line 14) | function r(e){return e.nodeName.toLowerCase()}
function a (line 14) | function a(e,t){var r=e&&e.exec(t);return r&&0===r.index}
function i (line 14) | function i(e){return T.test(e)}
function n (line 14) | function n(e){var t,r,a,n,o=e.className+" ";if(o+=e.parentNode?e.parentN...
function o (line 14) | function o(e){var t,r={},a=Array.prototype.slice.call(arguments,1);for(t...
function s (line 14) | function s(e){var t=[];return function a(e,i){for(var n=e.firstChild;n;n...
function l (line 14) | function l(e,a,i){function n(){return e.length&&a.length?e[0].offset!==a...
function c (line 14) | function c(e){return e.v&&!e.cached_variants&&(e.cached_variants=e.v.map...
function d (line 14) | function d(e){function t(e){return e&&e.source||e}function r(r,a){return...
function p (line 14) | function p(e,r,i,n){function o(e,t){var r,i;for(r=0,i=t.c.length;i>r;r++...
function m (line 14) | function m(e,r){r=r||D.languages||x(E);var a={r:0,value:t(e)},i=a;return...
function u (line 14) | function u(e){return D.tabReplace||D.useBR?e.replace(A,function(e,t){ret...
function b (line 14) | function b(e,t,r){var a=t?N[t]:r,i=[e.trim()];return e.match(/\bhljs\b/)...
function g (line 14) | function g(e){var t,r,a,o,c,d=n(e);i(d)||(D.useBR?(t=document.createElem...
function f (line 14) | function f(e){D=o(D,e)}
function _ (line 14) | function _(){if(!_.called){_.called=!0;var e=document.querySelectorAll("...
function h (line 14) | function h(){addEventListener("DOMContentLoaded",_,!1),addEventListener(...
function v (line 14) | function v(t,r){var a=E[t]=r(e);a.aliases&&a.aliases.forEach(function(e)...
function y (line 14) | function y(){return x(E)}
function S (line 14) | function S(e){return e=(e||"").toLowerCase(),E[e]||E[N[e]]}
function t (line 16) | function t(e,t){var r=[{b:e,e:t}];return r[0].c=r,r}
function a (line 28) | function a(a){return!isNaN(parseFloat(a))&&isFinite(a)}
function e (line 45) | function e(e,t){for(var n=0;n<t.length;n++){var r=t[n];r.enumerable=r.en...
function e (line 45) | function e(t){var r=!(arguments.length>1&&void 0!==arguments[1])||argume...
function e (line 45) | function e(t){n(this,e),this.ctx=t,this.ie=!1;var r=window.navigator.use...
function f (line 54) | function f(A){A.icon=A.hasOwnProperty("icon")?A.icon:"",A.visible=A.has...
function p (line 54) | function p(A){var e;if("string"==typeof A||A instanceof String)e=[].slic...
FILE: ERC/docs/styles/search-worker.js
function buildIndex (line 48) | function buildIndex() {
function isEmpty (line 70) | function isEmpty(obj) {
FILE: ErcXdbg/ErcMain.cs
class ErcMain (line 9) | public static class ErcMain
method pluginit (line 14) | [DllExport("pluginit", CallingConvention.Cdecl)]
method plugstop (line 25) | [DllExport("plugstop", CallingConvention.Cdecl)]
method plugsetup (line 32) | [DllExport("plugsetup", CallingConvention.Cdecl)]
FILE: ErcXdbg/ErcXdbg.cs
class ErcXdbg (line 11) | public class ErcXdbg
method PluginInit (line 16) | public static bool PluginInit(Plugins.PLUG_INITSTRUCT initStruct)
method PluginStart (line 26) | public static bool PluginStart()
method PluginStop (line 34) | public static void PluginStop()
method PluginSetup (line 40) | public static void PluginSetup(Plugins.PLUG_SETUPSTRUCT setupStruct)
method CBMENUENTRY (line 46) | [DllExport("CBMENUENTRY", CallingConvention.Cdecl)]
FILE: ErcXdbg/Globals.cs
type Encoding (line 10) | public enum Encoding : int
class Globals (line 23) | public static class Globals
FILE: ErcXdbg/RegisteredCommands.cs
class RegisteredCommands (line 15) | public static class RegisteredCommands
method ErcCommand (line 17) | public static bool ErcCommand(int argc, string[] argv)
method PrintHelp (line 122) | private static void PrintHelp(string errorMessage = null)
method ParseCommand (line 256) | private static void ParseCommand(string command, ERC.ErcCore core, ERC...
method ParseGlobals (line 398) | private static List<string> ParseGlobals(List<string> parameters)
method Update (line 706) | private static void Update(List<string> parameters)
method Config (line 920) | private static void Config(List<string> parameters, ERC.ErcCore core)
method Pattern (line 1089) | private static void Pattern(ERC.ErcCore core, List<string> parameters)
method ByteArray (line 1216) | private static void ByteArray(List<string> parameters, ERC.ErcCore core)
method Compare (line 1271) | private static void Compare(ERC.ProcessInfo info, List<string> paramet...
method Convert (line 1391) | private static void Convert(ERC.ProcessInfo info, List<string> paramet...
method Assemble (line 1447) | private static void Assemble(ERC.ProcessInfo info, List<string> parame...
method Disassemble (line 1526) | private static void Disassemble(ERC.ProcessInfo info, List<string> par...
method SearchMemory (line 1623) | private static void SearchMemory(ERC.ProcessInfo info, List<string> pa...
method SearchModules (line 1657) | private static void SearchModules(ERC.ProcessInfo info, List<string> p...
method DumpMemory (line 1714) | private static void DumpMemory(ERC.ProcessInfo info, List<string> para...
method SEH (line 1747) | private static void SEH(List<string> parameters, ERC.ProcessInfo info)
method EggHunters (line 1798) | private static void EggHunters(ERC.ErcCore core = null, string tag = n...
method FindNRP (line 1804) | private static void FindNRP(ERC.ProcessInfo info, List<string> paramet...
method HeapInfo (line 1822) | private static void HeapInfo(ERC.ProcessInfo info, List<string> parame...
method rop (line 1959) | private static void rop(ERC.ProcessInfo info, bool gadgetsOnly = false)
method StringToByteArray (line 2023) | private static byte[] StringToByteArray(string hex)
method ByteArrayToString (line 2031) | private static string ByteArrayToString(byte[] ba)
method DeleteOldPlugins (line 2036) | private static void DeleteOldPlugins()
method Debug (line 2070) | private static void Debug(ERC.ProcessInfo info, List<string> parameters)
method Debug (line 2218) | private static void Debug(List<string> parameters)
method Reset (line 2333) | private static void Reset(ERC.ProcessInfo info, List<string> parameters)
method Reset (line 2353) | private static void Reset()
FILE: Managed.x64dbg/SDK/Bridge.cs
class Bridge (line 7) | public class Bridge
method GuiGetLineWindow (line 31) | [DllImport(dll, CallingConvention = cdecl)]
method DbgValFromString (line 34) | [DllImport(dll, CallingConvention = cdecl)]
method DbgGetModuleAt (line 37) | [DllImport(dll, CallingConvention = cdecl)]
method DbgModBaseFromName (line 40) | [DllImport(dll, CallingConvention = cdecl)]
method DbgIsDebugging (line 43) | [DllImport(dll, CallingConvention = cdecl)]
method DbgCmdExec (line 46) | [DllImport(dll, CallingConvention = cdecl)]
method DbgCmdExecDirect (line 49) | [DllImport(dll, CallingConvention = cdecl, CharSet = CharSet.Ansi)]
method BridgeAlloc (line 52) | [DllImport(dll, CallingConvention = cdecl)]
method BridgeFree (line 55) | [DllImport(dll, CallingConvention = cdecl)]
type ICONDATA (line 58) | public struct ICONDATA
type ListInfo (line 64) | public struct ListInfo
method ToArray (line 70) | public T[] ToArray<T>(bool success) where T : new()
FILE: Managed.x64dbg/SDK/Extensions.cs
class Extensions (line 6) | public static class Extensions
method ToHexString (line 8) | public static string ToHexString(this IntPtr intPtr)
method ToPtrString (line 13) | public static string ToPtrString(this IntPtr intPtr)
method MarshalToString (line 18) | public static string MarshalToString(this IntPtr intPtr)
method ToStruct (line 25) | public static T ToStruct<T>(this IntPtr intPtr) where T : new()
FILE: Managed.x64dbg/SDK/PLog.cs
class PLog (line 10) | public static class PLog
method WriteLine (line 12) | public static void WriteLine(string format, params object[] args)
method Write (line 17) | public static void Write(string format, params object[] args)
method WriteLineHtml (line 21) | public static void WriteLineHtml(string format, params object[] args)
method WriteHtml (line 26) | public static void WriteHtml(string format, params object[] args)
class TextWriterPLog (line 33) | public class TextWriterPLog : TextWriter
method Write (line 37) | public override void Write(string value)
FILE: Managed.x64dbg/SDK/Plugins.cs
class Plugins (line 6) | public static class Plugins
method _plugin_logprintf (line 26) | [DllImport(dll, CallingConvention = cdecl)]
method _plugin_lograw_html (line 29) | [DllImport(dll, CallingConvention = cdecl)]
method _plugin_logputs (line 32) | [DllImport(dll, CallingConvention = cdecl)]
method _plugin_registercallback (line 35) | [DllImport(dll, CallingConvention = cdecl)]
method _plugin_unregistercallback (line 38) | [DllImport(dll, CallingConvention = cdecl)]
method _plugin_menuaddentry (line 41) | [DllImport(dll, CallingConvention = cdecl)]
method _plugin_menuadd (line 44) | [DllImport(dll, CallingConvention = cdecl)]
method _plugin_menuclear (line 47) | [DllImport(dll, CallingConvention = cdecl)]
method _plugin_registercommand (line 50) | [DllImport(dll, CallingConvention = cdecl)]
method _plugin_unregistercommand (line 53) | [DllImport(dll, CallingConvention = cdecl)]
type PLUG_INITSTRUCT (line 56) | public struct PLUG_INITSTRUCT
method ToString (line 64) | public override string ToString()
type PLUG_SETUPSTRUCT (line 75) | public struct PLUG_SETUPSTRUCT
method ToString (line 83) | public override string ToString()
type CBTYPE (line 94) | public enum CBTYPE
type PLUG_CB_INITDEBUG (line 123) | public struct PLUG_CB_INITDEBUG
type PLUG_CB_STOPDEBUG (line 128) | public struct PLUG_CB_STOPDEBUG
type PLUG_CB_CREATEPROCESS (line 133) | public struct PLUG_CB_CREATEPROCESS
type PLUG_CB_EXITPROCESS (line 141) | public struct PLUG_CB_EXITPROCESS
type PLUG_CB_LOADDLL (line 146) | public struct PLUG_CB_LOADDLL
type PLUG_CB_MENUENTRY (line 153) | public struct PLUG_CB_MENUENTRY
FILE: Managed.x64dbg/SDK/TitanEngine.cs
class TitanEngine (line 6) | public class TitanEngine
method GetContextData (line 213) | [DllImport("TitanEngine.dll", CallingConvention = CallingConvention.Cd...
method TitanGetProcessInformation (line 216) | [DllImport("TitanEngine.dll", CallingConvention = CallingConvention.Cd...
method DumpProcess (line 219) | [DllImport("TitanEngine.dll", CallingConvention = CallingConvention.Cd...
method StaticFileLoadW (line 222) | [DllImport("TitanEngine.dll", CallingConvention = CallingConvention.Cd...
FILE: Managed.x64dbg/SDK/WAPI.cs
class WAPI (line 7) | public class WAPI
method GetModuleBaseNameA (line 11) | [DllImport("psapi.dll")]
method ZeroMemory (line 14) | [DllImport("kernel32.dll", EntryPoint = "RtlZeroMemory")]
type LOAD_DLL_DEBUG_INFO (line 17) | public struct LOAD_DLL_DEBUG_INFO
type CREATE_PROCESS_DEBUG_INFO (line 29) | public struct CREATE_PROCESS_DEBUG_INFO
type EXIT_PROCESS_DEBUG_INFO (line 43) | public struct EXIT_PROCESS_DEBUG_INFO
type IMAGEHLP_MODULE64 (line 48) | public struct IMAGEHLP_MODULE64
type SYM_TYPE (line 81) | public enum SYM_TYPE
type GUID (line 95) | public struct GUID
type PROCESS_INFORMATION (line 104) | public struct PROCESS_INFORMATION
FILE: Managed.x64dbg/Script/Module.cs
class Module (line 7) | public static class Module
type ModuleInfo (line 9) | public struct ModuleInfo
type ModuleSectionInfo (line 21) | public struct ModuleSectionInfo
method ScriptModuleGetList (line 33) | [DllImport(dll, CallingConvention = cdecl,
method GetList (line 37) | public static ModuleInfo[] GetList()
method ScriptModuleSectionListFromAddr (line 43) | [DllImport(dll, CallingConvention = cdecl,
method SectionListFromAddr (line 47) | public static ModuleSectionInfo[] SectionListFromAddr(IntPtr addr)
method ScriptModuleInfoFromAddr (line 53) | [DllImport(dll, CallingConvention = cdecl,
method InfoFromAddr (line 57) | public static bool InfoFromAddr(IntPtr addr, ref ModuleInfo info)
Condensed preview — 136 files, each showing path, character count, and a content snippet. Download the .json file or copy for the full structured content (4,216K chars).
[
{
"path": ".gitattributes",
"chars": 27,
"preview": "* linguist-language=csharp\n"
},
{
"path": ".gitignore",
"chars": 5582,
"preview": "## Ignore Visual Studio temporary files, build results, and\n## files generated by popular Visual Studio add-ons.\n##\n## G"
},
{
"path": "DllExport.bat",
"chars": 20292,
"preview": "@echo off\n:: Copyright (c) 2016-2021 Denis Kuzmin [x-3F@outlook.com] github/3F\n:: https://github.com/3F/DllExport\nif \"%"
},
{
"path": "ERC/.gitignore",
"chars": 245,
"preview": "*.ide\n.vs/*\n.vs/ERC.net/v15/Server/sqlite3/storage.ide-shm\n.vs/ERC.net/v15/Server/sqlite3/storage.ide-wal\nD:\\Source\\Repo"
},
{
"path": "ERC/Documentation/.gitignore",
"chars": 106,
"preview": "###############\n# folder #\n###############\n/**/DROP/\n/**/TEMP/\n/**/packages/\n/**/bin/\n/**/obj/\n_site\n"
},
{
"path": "ERC/Documentation/api/.gitignore",
"chars": 64,
"preview": "###############\n# temp file #\n###############\n*.yml\n.manifest\n"
},
{
"path": "ERC/Documentation/api/index.md",
"chars": 132,
"preview": "# ERC.Net\nIn the left panel, you find the API documentation for all accessible structures and functionality of the ERC.N"
},
{
"path": "ERC/Documentation/articles/LICENSE.md",
"chars": 35149,
"preview": " GNU GENERAL PUBLIC LICENSE\n Version 3, 29 June 2007\n\n Copyright (C) 2007 Free "
},
{
"path": "ERC/Documentation/articles/intro.md",
"chars": 11983,
"preview": "# ERC.Net\n\nERC.Net is a collection of tools designed to assist in debugging Windows application crashes. ERC.Net support"
},
{
"path": "ERC/Documentation/articles/toc.yml",
"chars": 38,
"preview": "- name: Introduction\n href: intro.md\n"
},
{
"path": "ERC/Documentation/docfx.json",
"chars": 1135,
"preview": "{\n \"metadata\": [\n {\n \"src\": [\n {\n \"files\": [\n \"**/**.cs\",\n \"**/**.csproj\""
},
{
"path": "ERC/Documentation/index.md",
"chars": 491,
"preview": "# ERC.Net API Documentation. \nFull documentation for the ERC.Net API can be found by clicking the \"API Documentation\""
},
{
"path": "ERC/Documentation/toc.yml",
"chars": 99,
"preview": "- name: Articles\n href: articles/\n- name: Api Documentation\n href: api/\n homepage: api/index.md\n"
},
{
"path": "ERC/ERC/.gitignore",
"chars": 88,
"preview": "###############\n# folder #\n###############\n/**/DROP/\n/**/TEMP/\n/**/packages/\n_site\n"
},
{
"path": "ERC/ERC/Convert.cs",
"chars": 6448,
"preview": "using System;\nusing System.Globalization;\nusing System.Linq;\nusing System.Text;\n\nnamespace ERC.Utilities\n{\n /// <sum"
},
{
"path": "ERC/ERC/Display_Output.cs",
"chars": 157520,
"preview": "using ERC.Utilities;\nusing System;\nusing System.Collections.Generic;\nusing System.Diagnostics;\nusing System.IO;\nusing S"
},
{
"path": "ERC/ERC/ERC.Net.csproj",
"chars": 4310,
"preview": "<Project Sdk=\"Microsoft.NET.Sdk\">\n\n <PropertyGroup>\n <TargetFramework>net472</TargetFramework>\n <Platforms>AnyCP"
},
{
"path": "ERC/ERC/ERC.Net.xml",
"chars": 195356,
"preview": "<?xml version=\"1.0\"?>\n<doc>\n <assembly>\n <name>ERC.Net</name>\n </assembly>\n <members>\n <member na"
},
{
"path": "ERC/ERC/ERCException.cs",
"chars": 954,
"preview": "using System;\nusing System.Runtime.Serialization;\n\nnamespace ERC\n{\n /// <summary>\n /// Custom exception handler.\n"
},
{
"path": "ERC/ERC/ERC_Core.cs",
"chars": 118123,
"preview": "using System;\nusing System.IO;\nusing System.Text;\nusing System.Runtime.InteropServices;\nusing System.Reflection;\nusing "
},
{
"path": "ERC/ERC/FodyWeavers.xml",
"chars": 176,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\"?>\n<Weavers xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:noNamespaceSc"
},
{
"path": "ERC/ERC/FodyWeavers.xsd",
"chars": 8666,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\"?>\n<xs:schema xmlns:xs=\"http://www.w3.org/2001/XMLSchema\">\n <!-- This file was gen"
},
{
"path": "ERC/ERC/Heap_Info.cs",
"chars": 21373,
"preview": "using System;\nusing System.Collections.Generic;\nusing System.Runtime.InteropServices;\nusing ERC.Structures;\n\nnamespace "
},
{
"path": "ERC/ERC/Module_Info.cs",
"chars": 19799,
"preview": "using ERC.Structures;\nusing System;\nusing System.Collections;\nusing System.Collections.Generic;\nusing System.Diagnostic"
},
{
"path": "ERC/ERC/Opcode_Assembler.cs",
"chars": 3657,
"preview": "using System;\nusing System.Collections.Generic;\nusing Reloaded.Assembler;\n\nnamespace ERC.Utilities\n{\n /// <summary>\n"
},
{
"path": "ERC/ERC/Opcode_Disassembler.cs",
"chars": 7863,
"preview": "using System;\nusing System.Linq;\n\nnamespace ERC.Utilities\n{\n /// <summary>\n /// OpcodeDisassembler class, can be "
},
{
"path": "ERC/ERC/Pattern_Tools.cs",
"chars": 8511,
"preview": "using System;\nusing System.IO;\nusing System.Text;\nusing System.Text.RegularExpressions;\n\nnamespace ERC.Utilities\n{\n "
},
{
"path": "ERC/ERC/Payloads.cs",
"chars": 17758,
"preview": "using System;\nusing System.Collections.Generic;\nusing System.IO;\n\nnamespace ERC.Utilities\n{\n /// <summary>\n /// A"
},
{
"path": "ERC/ERC/Process_Info.cs",
"chars": 115954,
"preview": "using ERC.Structures;\nusing System;\nusing System.Collections.Generic;\nusing System.ComponentModel;\nusing System.Diagnos"
},
{
"path": "ERC/ERC/PtrRemover.cs",
"chars": 14972,
"preview": "using System;\nusing System.Collections.Generic;\nusing System.Linq;\n\nnamespace ERC.Utilities\n{\n /// <summary>\n ///"
},
{
"path": "ERC/ERC/RopChainGenerator32.cs",
"chars": 217754,
"preview": "using System;\nusing System.Collections.Generic;\nusing System.ComponentModel;\nusing System.Diagnostics;\nusing System.IO;"
},
{
"path": "ERC/ERC/RopChainGenerator64.cs",
"chars": 268749,
"preview": "using System;\nusing System.Collections.Generic;\nusing System.ComponentModel;\nusing System.Linq;\nusing System.Runtime.In"
},
{
"path": "ERC/ERC/Thread_Info.cs",
"chars": 26564,
"preview": "using ERC.Structures;\nusing System;\nusing System.Collections.Generic;\nusing System.ComponentModel;\nusing System.Diagnos"
},
{
"path": "ERC/ERC/Win32Errors.cs",
"chars": 2407,
"preview": "using System;\nusing System.Runtime.InteropServices;\n\n\nnamespace ERC.Utilities\n{\n public static class Win32Errors\n "
},
{
"path": "ERC/LICENSE",
"chars": 35149,
"preview": " GNU GENERAL PUBLIC LICENSE\n Version 3, 29 June 2007\n\n Copyright (C) 2007 Free "
},
{
"path": "ERC/README.md",
"chars": 12697,
"preview": "# ERC.Net \n[](license.txt)\n[![GitHub issues](https:/"
},
{
"path": "ERC/docs/api/ERC.DisplayOutput.html",
"chars": 48364,
"preview": "<!DOCTYPE html>\n<!--[if IE]><![endif]-->\n<html>\n \n <head>\n <meta charset=\"utf-8\">\n <meta http-equiv=\"X-UA-Compa"
},
{
"path": "ERC/docs/api/ERC.ERCException.html",
"chars": 9484,
"preview": "<!DOCTYPE html>\n<!--[if IE]><![endif]-->\n<html>\n \n <head>\n <meta charset=\"utf-8\">\n <meta http-equiv=\"X-UA-Compa"
},
{
"path": "ERC/docs/api/ERC.ErcCore.html",
"chars": 20610,
"preview": "<!DOCTYPE html>\n<!--[if IE]><![endif]-->\n<html>\n \n <head>\n <meta charset=\"utf-8\">\n <meta http-equiv=\"X-UA-Compa"
},
{
"path": "ERC/docs/api/ERC.ErcResult-1.html",
"chars": 13014,
"preview": "<!DOCTYPE html>\n<!--[if IE]><![endif]-->\n<html>\n \n <head>\n <meta charset=\"utf-8\">\n <meta http-equiv=\"X-UA-Compa"
},
{
"path": "ERC/docs/api/ERC.MachineType.html",
"chars": 5207,
"preview": "<!DOCTYPE html>\n<!--[if IE]><![endif]-->\n<html>\n \n <head>\n <meta charset=\"utf-8\">\n <meta http-equiv=\"X-UA-Compa"
},
{
"path": "ERC/docs/api/ERC.ModuleInfo.html",
"chars": 22900,
"preview": "<!DOCTYPE html>\n<!--[if IE]><![endif]-->\n<html>\n \n <head>\n <meta charset=\"utf-8\">\n <meta http-equiv=\"X-UA-Compa"
},
{
"path": "ERC/docs/api/ERC.ProcessInfo.html",
"chars": 46709,
"preview": "<!DOCTYPE html>\n<!--[if IE]><![endif]-->\n<html>\n \n <head>\n <meta charset=\"utf-8\">\n <meta http-equiv=\"X-UA-Compa"
},
{
"path": "ERC/docs/api/ERC.Structures.AllocationProtect.html",
"chars": 6420,
"preview": "<!DOCTYPE html>\n<!--[if IE]><![endif]-->\n<html>\n \n <head>\n <meta charset=\"utf-8\">\n <meta http-equiv=\"X-UA-Compa"
},
{
"path": "ERC/docs/api/ERC.Structures.CONTEXT32.html",
"chars": 23787,
"preview": "<!DOCTYPE html>\n<!--[if IE]><![endif]-->\n<html>\n \n <head>\n <meta charset=\"utf-8\">\n <meta http-equiv=\"X-UA-Compa"
},
{
"path": "ERC/docs/api/ERC.Structures.CONTEXT64.html",
"chars": 38924,
"preview": "<!DOCTYPE html>\n<!--[if IE]><![endif]-->\n<html>\n \n <head>\n <meta charset=\"utf-8\">\n <meta http-equiv=\"X-UA-Compa"
},
{
"path": "ERC/docs/api/ERC.Structures.CONTEXT_FLAGS.html",
"chars": 6231,
"preview": "<!DOCTYPE html>\n<!--[if IE]><![endif]-->\n<html>\n \n <head>\n <meta charset=\"utf-8\">\n <meta http-equiv=\"X-UA-Compa"
},
{
"path": "ERC/docs/api/ERC.Structures.ClientID.html",
"chars": 6525,
"preview": "<!DOCTYPE html>\n<!--[if IE]><![endif]-->\n<html>\n \n <head>\n <meta charset=\"utf-8\">\n <meta http-equiv=\"X-UA-Compa"
},
{
"path": "ERC/docs/api/ERC.Structures.FLOATING_SAVE_AREA.html",
"chars": 12142,
"preview": "<!DOCTYPE html>\n<!--[if IE]><![endif]-->\n<html>\n \n <head>\n <meta charset=\"utf-8\">\n <meta http-equiv=\"X-UA-Compa"
},
{
"path": "ERC/docs/api/ERC.Structures.IMAGE_DATA_DIRECTORY.html",
"chars": 6877,
"preview": "<!DOCTYPE html>\n<!--[if IE]><![endif]-->\n<html>\n \n <head>\n <meta charset=\"utf-8\">\n <meta http-equiv=\"X-UA-Compa"
},
{
"path": "ERC/docs/api/ERC.Structures.IMAGE_DOS_HEADER.html",
"chars": 5922,
"preview": "<!DOCTYPE html>\n<!--[if IE]><![endif]-->\n<html>\n \n <head>\n <meta charset=\"utf-8\">\n <meta http-equiv=\"X-UA-Compa"
},
{
"path": "ERC/docs/api/ERC.Structures.IMAGE_FILE_HEADER.html",
"chars": 10758,
"preview": "<!DOCTYPE html>\n<!--[if IE]><![endif]-->\n<html>\n \n <head>\n <meta charset=\"utf-8\">\n <meta http-equiv=\"X-UA-Compa"
},
{
"path": "ERC/docs/api/ERC.Structures.IMAGE_LOAD_CONFIG_CODE_INTEGRITY.html",
"chars": 8370,
"preview": "<!DOCTYPE html>\n<!--[if IE]><![endif]-->\n<html>\n \n <head>\n <meta charset=\"utf-8\">\n <meta http-equiv=\"X-UA-Compa"
},
{
"path": "ERC/docs/api/ERC.Structures.IMAGE_LOAD_CONFIG_DIRECTORY32.html",
"chars": 39999,
"preview": "<!DOCTYPE html>\n<!--[if IE]><![endif]-->\n<html>\n \n <head>\n <meta charset=\"utf-8\">\n <meta http-equiv=\"X-UA-Compa"
},
{
"path": "ERC/docs/api/ERC.Structures.IMAGE_LOAD_CONFIG_DIRECTORY64.html",
"chars": 40025,
"preview": "<!DOCTYPE html>\n<!--[if IE]><![endif]-->\n<html>\n \n <head>\n <meta charset=\"utf-8\">\n <meta http-equiv=\"X-UA-Compa"
},
{
"path": "ERC/docs/api/ERC.Structures.IMAGE_NT_HEADERS32.html",
"chars": 7758,
"preview": "<!DOCTYPE html>\n<!--[if IE]><![endif]-->\n<html>\n \n <head>\n <meta charset=\"utf-8\">\n <meta http-equiv=\"X-UA-Compa"
},
{
"path": "ERC/docs/api/ERC.Structures.IMAGE_NT_HEADERS64.html",
"chars": 7758,
"preview": "<!DOCTYPE html>\n<!--[if IE]><![endif]-->\n<html>\n \n <head>\n <meta charset=\"utf-8\">\n <meta http-equiv=\"X-UA-Compa"
},
{
"path": "ERC/docs/api/ERC.Structures.IMAGE_OPTIONAL_HEADER32.html",
"chars": 42459,
"preview": "<!DOCTYPE html>\n<!--[if IE]><![endif]-->\n<html>\n \n <head>\n <meta charset=\"utf-8\">\n <meta http-equiv=\"X-UA-Compa"
},
{
"path": "ERC/docs/api/ERC.Structures.IMAGE_OPTIONAL_HEADER64.html",
"chars": 41706,
"preview": "<!DOCTYPE html>\n<!--[if IE]><![endif]-->\n<html>\n \n <head>\n <meta charset=\"utf-8\">\n <meta http-equiv=\"X-UA-Compa"
},
{
"path": "ERC/docs/api/ERC.Structures.LIST_ENTRY.html",
"chars": 6843,
"preview": "<!DOCTYPE html>\n<!--[if IE]><![endif]-->\n<html>\n \n <head>\n <meta charset=\"utf-8\">\n <meta http-equiv=\"X-UA-Compa"
},
{
"path": "ERC/docs/api/ERC.Structures.LOADED_IMAGE.html",
"chars": 15675,
"preview": "<!DOCTYPE html>\n<!--[if IE]><![endif]-->\n<html>\n \n <head>\n <meta charset=\"utf-8\">\n <meta http-equiv=\"X-UA-Compa"
},
{
"path": "ERC/docs/api/ERC.Structures.LoadLibraryFlags.html",
"chars": 7010,
"preview": "<!DOCTYPE html>\n<!--[if IE]><![endif]-->\n<html>\n \n <head>\n <meta charset=\"utf-8\">\n <meta http-equiv=\"X-UA-Compa"
},
{
"path": "ERC/docs/api/ERC.Structures.M128A.html",
"chars": 7333,
"preview": "<!DOCTYPE html>\n<!--[if IE]><![endif]-->\n<html>\n \n <head>\n <meta charset=\"utf-8\">\n <meta http-equiv=\"X-UA-Compa"
},
{
"path": "ERC/docs/api/ERC.Structures.MEMORY_BASIC_INFORMATION32.html",
"chars": 10849,
"preview": "<!DOCTYPE html>\n<!--[if IE]><![endif]-->\n<html>\n \n <head>\n <meta charset=\"utf-8\">\n <meta http-equiv=\"X-UA-Compa"
},
{
"path": "ERC/docs/api/ERC.Structures.MEMORY_BASIC_INFORMATION64.html",
"chars": 12389,
"preview": "<!DOCTYPE html>\n<!--[if IE]><![endif]-->\n<html>\n \n <head>\n <meta charset=\"utf-8\">\n <meta http-equiv=\"X-UA-Compa"
},
{
"path": "ERC/docs/api/ERC.Structures.MagicType.html",
"chars": 5077,
"preview": "<!DOCTYPE html>\n<!--[if IE]><![endif]-->\n<html>\n \n <head>\n <meta charset=\"utf-8\">\n <meta http-equiv=\"X-UA-Compa"
},
{
"path": "ERC/docs/api/ERC.Structures.ProcessAccessFlags.html",
"chars": 6706,
"preview": "<!DOCTYPE html>\n<!--[if IE]><![endif]-->\n<html>\n \n <head>\n <meta charset=\"utf-8\">\n <meta http-equiv=\"X-UA-Compa"
},
{
"path": "ERC/docs/api/ERC.Structures.RegisterInfo.html",
"chars": 11495,
"preview": "<!DOCTYPE html>\n<!--[if IE]><![endif]-->\n<html>\n \n <head>\n <meta charset=\"utf-8\">\n <meta http-equiv=\"X-UA-Compa"
},
{
"path": "ERC/docs/api/ERC.Structures.StateEnum.html",
"chars": 5064,
"preview": "<!DOCTYPE html>\n<!--[if IE]><![endif]-->\n<html>\n \n <head>\n <meta charset=\"utf-8\">\n <meta http-equiv=\"X-UA-Compa"
},
{
"path": "ERC/docs/api/ERC.Structures.SubSystemType.html",
"chars": 6768,
"preview": "<!DOCTYPE html>\n<!--[if IE]><![endif]-->\n<html>\n \n <head>\n <meta charset=\"utf-8\">\n <meta http-equiv=\"X-UA-Compa"
},
{
"path": "ERC/docs/api/ERC.Structures.TEB.html",
"chars": 38126,
"preview": "<!DOCTYPE html>\n<!--[if IE]><![endif]-->\n<html>\n \n <head>\n <meta charset=\"utf-8\">\n <meta http-equiv=\"X-UA-Compa"
},
{
"path": "ERC/docs/api/ERC.Structures.ThreadAccess.html",
"chars": 6173,
"preview": "<!DOCTYPE html>\n<!--[if IE]><![endif]-->\n<html>\n \n <head>\n <meta charset=\"utf-8\">\n <meta http-equiv=\"X-UA-Compa"
},
{
"path": "ERC/docs/api/ERC.Structures.ThreadBasicInformation.html",
"chars": 9803,
"preview": "<!DOCTYPE html>\n<!--[if IE]><![endif]-->\n<html>\n \n <head>\n <meta charset=\"utf-8\">\n <meta http-equiv=\"X-UA-Compa"
},
{
"path": "ERC/docs/api/ERC.Structures.TypeEnum.html",
"chars": 5055,
"preview": "<!DOCTYPE html>\n<!--[if IE]><![endif]-->\n<html>\n \n <head>\n <meta charset=\"utf-8\">\n <meta http-equiv=\"X-UA-Compa"
},
{
"path": "ERC/docs/api/ERC.Structures.XSAVE_FORMAT64.html",
"chars": 17049,
"preview": "<!DOCTYPE html>\n<!--[if IE]><![endif]-->\n<html>\n \n <head>\n <meta charset=\"utf-8\">\n <meta http-equiv=\"X-UA-Compa"
},
{
"path": "ERC/docs/api/ERC.Structures.html",
"chars": 11782,
"preview": "<!DOCTYPE html>\n<!--[if IE]><![endif]-->\n<html>\n \n <head>\n <meta charset=\"utf-8\">\n <meta http-equiv=\"X-UA-Compa"
},
{
"path": "ERC/docs/api/ERC.ThreadInfo.html",
"chars": 12426,
"preview": "<!DOCTYPE html>\n<!--[if IE]><![endif]-->\n<html>\n \n <head>\n <meta charset=\"utf-8\">\n <meta http-equiv=\"X-UA-Compa"
},
{
"path": "ERC/docs/api/ERC.Utilities.Convert.html",
"chars": 22028,
"preview": "<!DOCTYPE html>\n<!--[if IE]><![endif]-->\n<html>\n \n <head>\n <meta charset=\"utf-8\">\n <meta http-equiv=\"X-UA-Compa"
},
{
"path": "ERC/docs/api/ERC.Utilities.OpcodeAssembler.html",
"chars": 16591,
"preview": "<!DOCTYPE html>\n<!--[if IE]><![endif]-->\n<html>\n \n <head>\n <meta charset=\"utf-8\">\n <meta http-equiv=\"X-UA-Compa"
},
{
"path": "ERC/docs/api/ERC.Utilities.OpcodeDisassembler.html",
"chars": 16302,
"preview": "<!DOCTYPE html>\n<!--[if IE]><![endif]-->\n<html>\n \n <head>\n <meta charset=\"utf-8\">\n <meta http-equiv=\"X-UA-Compa"
},
{
"path": "ERC/docs/api/ERC.Utilities.PatternTools.html",
"chars": 9828,
"preview": "<!DOCTYPE html>\n<!--[if IE]><![endif]-->\n<html>\n \n <head>\n <meta charset=\"utf-8\">\n <meta http-equiv=\"X-UA-Compa"
},
{
"path": "ERC/docs/api/ERC.Utilities.Payloads.html",
"chars": 19138,
"preview": "<!DOCTYPE html>\n<!--[if IE]><![endif]-->\n<html>\n \n <head>\n <meta charset=\"utf-8\">\n <meta http-equiv=\"X-UA-Compa"
},
{
"path": "ERC/docs/api/ERC.Utilities.PtrRemover.html",
"chars": 14835,
"preview": "<!DOCTYPE html>\n<!--[if IE]><![endif]-->\n<html>\n \n <head>\n <meta charset=\"utf-8\">\n <meta http-equiv=\"X-UA-Compa"
},
{
"path": "ERC/docs/api/ERC.Utilities.RopChainGenerator32.X86Lists.html",
"chars": 45674,
"preview": "<!DOCTYPE html>\n<!--[if IE]><![endif]-->\n<html>\n \n <head>\n <meta charset=\"utf-8\">\n <meta http-equiv=\"X-UA-Compa"
},
{
"path": "ERC/docs/api/ERC.Utilities.RopChainGenerator32.html",
"chars": 12126,
"preview": "<!DOCTYPE html>\n<!--[if IE]><![endif]-->\n<html>\n \n <head>\n <meta charset=\"utf-8\">\n <meta http-equiv=\"X-UA-Compa"
},
{
"path": "ERC/docs/api/ERC.Utilities.RopChainGenerator64.X64Lists.html",
"chars": 81359,
"preview": "<!DOCTYPE html>\n<!--[if IE]><![endif]-->\n<html>\n \n <head>\n <meta charset=\"utf-8\">\n <meta http-equiv=\"X-UA-Compa"
},
{
"path": "ERC/docs/api/ERC.Utilities.RopChainGenerator64.html",
"chars": 12160,
"preview": "<!DOCTYPE html>\n<!--[if IE]><![endif]-->\n<html>\n \n <head>\n <meta charset=\"utf-8\">\n <meta http-equiv=\"X-UA-Compa"
},
{
"path": "ERC/docs/api/ERC.Utilities.html",
"chars": 6326,
"preview": "<!DOCTYPE html>\n<!--[if IE]><![endif]-->\n<html>\n \n <head>\n <meta charset=\"utf-8\">\n <meta http-equiv=\"X-UA-Compa"
},
{
"path": "ERC/docs/api/ERC.html",
"chars": 5539,
"preview": "<!DOCTYPE html>\n<!--[if IE]><![endif]-->\n<html>\n \n <head>\n <meta charset=\"utf-8\">\n <meta http-equiv=\"X-UA-Compa"
},
{
"path": "ERC/docs/api/index.html",
"chars": 3989,
"preview": "<!DOCTYPE html>\n<!--[if IE]><![endif]-->\n<html>\n \n <head>\n <meta charset=\"utf-8\">\n <meta http-equiv=\"X-UA-Compa"
},
{
"path": "ERC/docs/api/toc.html",
"chars": 10908,
"preview": "\n<div id=\"sidetoggle\">\n <div>\n <div class=\"sidefilter\">\n <form class=\"toc-filter\">\n <span class=\"glyphi"
},
{
"path": "ERC/docs/articles/LICENSE.html",
"chars": 40148,
"preview": "<!DOCTYPE html>\n<!--[if IE]><![endif]-->\n<html>\n \n <head>\n <meta charset=\"utf-8\">\n <meta http-equiv=\"X-UA-Compa"
},
{
"path": "ERC/docs/articles/intro.html",
"chars": 16930,
"preview": "<!DOCTYPE html>\n<!--[if IE]><![endif]-->\n<html>\n \n <head>\n <meta charset=\"utf-8\">\n <meta http-equiv=\"X-UA-Compa"
},
{
"path": "ERC/docs/articles/toc.html",
"chars": 705,
"preview": "\n<div id=\"sidetoggle\">\n <div>\n <div class=\"sidefilter\">\n <form class=\"toc-filter\">\n <span class=\"glyphi"
},
{
"path": "ERC/docs/index.html",
"chars": 4029,
"preview": "<!DOCTYPE html>\n<!--[if IE]><![endif]-->\n<html>\n \n <head>\n <meta charset=\"utf-8\">\n <meta http-equiv=\"X-UA-Compa"
},
{
"path": "ERC/docs/manifest.json",
"chars": 21434,
"preview": "{\n \"homepages\": [],\n \"source_base_path\": \"C:/Users/tester/Documents/GitHub/ERC.net/docs\",\n \"xrefmap\": \"xrefmap.yml\",\n"
},
{
"path": "ERC/docs/search-stopwords.json",
"chars": 1150,
"preview": "[\n \"a\",\n \"able\",\n \"about\",\n \"across\",\n \"after\",\n \"all\",\n \"almost\",\n \"also\",\n \"am\",\n \"among\",\n \"an\",\n \"and\",\n"
},
{
"path": "ERC/docs/styles/docfx.css",
"chars": 16912,
"preview": "/* Copyright (c) Microsoft Corporation. All Rights Reserved. Licensed under the MIT License. See License.txt in the proj"
},
{
"path": "ERC/docs/styles/docfx.js",
"chars": 37026,
"preview": "// Copyright (c) Microsoft. All rights reserved. Licensed under the MIT license. See LICENSE file in the project root fo"
},
{
"path": "ERC/docs/styles/docfx.vendor.css",
"chars": 118968,
"preview": "/*!\n * Bootstrap v3.3.7 (http://getbootstrap.com)\n * Copyright 2011-2016 Twitter, Inc.\n * Licensed under MIT (https://gi"
},
{
"path": "ERC/docs/styles/docfx.vendor.js",
"chars": 652676,
"preview": "/*! jQuery v2.1.4 | (c) 2005, 2015 jQuery Foundation, Inc. | jquery.org/license */\n!function(a,b){\"object\"==typeof modul"
},
{
"path": "ERC/docs/styles/lunr.js",
"chars": 83135,
"preview": "/**\n * lunr - http://lunrjs.com - A bit like Solr, but much smaller and not as bright - 2.1.2\n * Copyright (C) 2017 Oliv"
},
{
"path": "ERC/docs/styles/main.css",
"chars": 0,
"preview": ""
},
{
"path": "ERC/docs/styles/main.js",
"chars": 148,
"preview": "// Copyright (c) Microsoft. All rights reserved. Licensed under the MIT license. See LICENSE file in the project root fo"
},
{
"path": "ERC/docs/styles/search-worker.js",
"chars": 2028,
"preview": "(function () {\n importScripts('lunr.min.js');\n\n var lunrIndex;\n\n var stopWords = null;\n var searchData = {};\n\n lunr"
},
{
"path": "ERC/docs/toc.html",
"chars": 879,
"preview": "\n<div id=\"sidetoggle\">\n <div>\n <div class=\"sidefilter\">\n <form class=\"toc-filter\">\n <span class=\"glyphi"
},
{
"path": "ERC/docs/xrefmap.yml",
"chars": 319138,
"preview": "### YamlMime:XRefMap\nsorted: true\nreferences:\n- uid: ERC\n name: ERC\n href: api/ERC.html\n commentId: N:ERC\n fullName:"
},
{
"path": "ERC.net/ERC/ERC.Net.xml",
"chars": 210388,
"preview": "<?xml version=\"1.0\"?>\n<doc>\n <assembly>\n <name>ERC.Net</name>\n </assembly>\n <members>\n <member na"
},
{
"path": "ErcXdbg/AssemblyInfo.cs",
"chars": 400,
"preview": "using System.Reflection;\nusing System.Runtime.InteropServices;\n\n[assembly: ComVisible(false)]\n[assembly: AssemblyTradem"
},
{
"path": "ErcXdbg/ErcMain.cs",
"chars": 1152,
"preview": "using System;\nusing System.IO;\nusing System.Runtime.InteropServices;\nusing Managed.x64dbg.SDK; \nusing RGiesecke.DllExpo"
},
{
"path": "ErcXdbg/ErcXdbg.cs",
"chars": 2030,
"preview": "using System;\nusing System.IO;\nusing System.Reflection;\nusing System.Runtime.InteropServices;\nusing Managed.x64dbg.SDK;"
},
{
"path": "ErcXdbg/ErcXdbgPlugin.csproj",
"chars": 17674,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\"?>\n<Project ToolsVersion=\"12.0\" DefaultTargets=\"Build\" xmlns=\"http://schemas.micros"
},
{
"path": "ErcXdbg/FodyWeavers.xml",
"chars": 176,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\"?>\n<Weavers xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:noNamespaceSc"
},
{
"path": "ErcXdbg/FodyWeavers.xsd",
"chars": 8666,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\"?>\n<xs:schema xmlns:xs=\"http://www.w3.org/2001/XMLSchema\">\n <!-- This file was gen"
},
{
"path": "ErcXdbg/Globals.cs",
"chars": 926,
"preview": "using System;\nusing System.Collections.Generic;\nusing System.ComponentModel;\nusing System.Linq;\nusing System.Text;\nusin"
},
{
"path": "ErcXdbg/RegisteredCommands.cs",
"chars": 101322,
"preview": "using System;\nusing System.Collections.Generic;\nusing System.IO;\nusing System.IO.Compression;\nusing System.Linq;\nusing S"
},
{
"path": "ErcXdbg/app.config",
"chars": 917,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\"?>\n<configuration>\n <runtime>\n <assemblyBinding xmlns=\"urn:schemas-microsoft-co"
},
{
"path": "ErcXdbg/packages.config",
"chars": 4849,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\"?>\n<packages>\n <package id=\"Costura.Fody\" version=\"5.7.0\" targetFramework=\"net472\""
},
{
"path": "ErcXdbgPlugin.sln",
"chars": 3632,
"preview": "Microsoft Visual Studio Solution File, Format Version 12.00\n# Visual Studio Version 16\nVisualStudioVersion = 16.0.29503."
},
{
"path": "LICENSE",
"chars": 1061,
"preview": "MIT License\n\nCopyright (c) 2019 Andy\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof th"
},
{
"path": "Managed.x64dbg/FodyWeavers.xml",
"chars": 176,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\"?>\n<Weavers xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:noNamespaceSc"
},
{
"path": "Managed.x64dbg/FodyWeavers.xsd",
"chars": 8666,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\"?>\n<xs:schema xmlns:xs=\"http://www.w3.org/2001/XMLSchema\">\n <!-- This file was gen"
},
{
"path": "Managed.x64dbg/Managed.x64dbg.csproj",
"chars": 17058,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\"?>\n<Project ToolsVersion=\"15.0\" xmlns=\"http://schemas.microsoft.com/developer/msbui"
},
{
"path": "Managed.x64dbg/Properties/AssemblyInfo.cs",
"chars": 1255,
"preview": "using System.Reflection;\nusing System.Runtime.CompilerServices;\nusing System.Runtime.InteropServices;\n\n// General Infor"
},
{
"path": "Managed.x64dbg/SDK/Bridge.cs",
"chars": 3399,
"preview": "using System;\nusing System.IO;\nusing System.Runtime.InteropServices;\n\nnamespace Managed.x64dbg.SDK\n{\n public class B"
},
{
"path": "Managed.x64dbg/SDK/Extensions.cs",
"chars": 857,
"preview": "using System;\nusing System.Runtime.InteropServices;\n\nnamespace Managed.x64dbg.SDK\n{\n public static class Extensions\n"
},
{
"path": "Managed.x64dbg/SDK/PLog.cs",
"chars": 1108,
"preview": "using System;\nusing System.Collections.Generic;\nusing System.IO;\nusing System.Linq;\nusing System.Runtime.InteropService"
},
{
"path": "Managed.x64dbg/SDK/Plugins.cs",
"chars": 5949,
"preview": "using System;\nusing System.Runtime.InteropServices;\n\nnamespace Managed.x64dbg.SDK\n{\n public static class Plugins\n "
},
{
"path": "Managed.x64dbg/SDK/TitanEngine.cs",
"chars": 10970,
"preview": "using System;\nusing System.Runtime.InteropServices;\n\nnamespace Managed.x64dbg.SDK\n{\n public class TitanEngine\n {\n "
},
{
"path": "Managed.x64dbg/SDK/WAPI.cs",
"chars": 3441,
"preview": "using System;\nusing System.Runtime.InteropServices;\nusing System.Text;\n\nnamespace Managed.x64dbg.SDK\n{\n public class "
},
{
"path": "Managed.x64dbg/Script/Module.cs",
"chars": 2348,
"preview": "using System;\nusing System.Runtime.InteropServices;\nusing Managed.x64dbg.SDK;\n\nnamespace Managed.x64dbg.Script\n{\n pu"
},
{
"path": "Managed.x64dbg/app.config",
"chars": 674,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\"?>\n<configuration>\n <runtime>\n <assemblyBinding xmlns=\"urn:schemas-microsoft-co"
},
{
"path": "Managed.x64dbg/packages.config",
"chars": 4773,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\"?>\n<packages>\n <package id=\"Costura.Fody\" version=\"5.7.0\" targetFramework=\"net472\""
},
{
"path": "README.md",
"chars": 18653,
"preview": "<img src=\"Icon.png\" align=\"right\" alt=\"Image\" height=\"80\" width=\"80\"/>\n\n# ERC.Xdbg \n[![License](https://img.shields"
},
{
"path": "packages/.gitignore",
"chars": 34,
"preview": "*\n!repositories.config\n!.gitignore"
},
{
"path": "packages/repositories.config",
"chars": 132,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\"?>\n<repositories>\n <repository path=\"..\\x64dbgDotNetPlugin\\packages.config\" />\n</r"
}
]
About this extraction
This page contains the full source code of the Andy53/ERC.Xdbg GitHub repository, extracted and formatted as plain text for AI agents and large language models (LLMs). The extraction includes 136 files (3.8 MB), approximately 1.0M tokens, and a symbol index with 517 extracted functions, classes, methods, constants, and types. Use this with OpenClaw, Claude, ChatGPT, Cursor, Windsurf, or any other AI tool that accepts text input. You can copy the full output to your clipboard or download it as a .txt file.
Extracted by GitExtract — free GitHub repo to text converter for AI. Built by Nikandr Surkov.