diff --git a/archive/Ahmadmansoor/x64dbgScript.txt b/archive/Ahmadmansoor/x64dbgScript.txt new file mode 100644 index 00000000..8f2f6724 --- /dev/null +++ b/archive/Ahmadmansoor/x64dbgScript.txt @@ -0,0 +1,201 @@ +Project Path: arc_Ahmadmansoor_x64dbgScript_w7z6ip5t + +Source Tree: + +```txt +arc_Ahmadmansoor_x64dbgScript_w7z6ip5t +├── README.md +├── Sample +│ ├── Export Fun_cmt from ida to x64dbg +│ │ ├── export_Func_cmt.py +│ │ ├── readme.md +│ │ └── script.txt +│ ├── Search for Sequence of commands +│ │ └── Script.txt +│ ├── Use Global Variable too Run Multipal Script +│ │ ├── Execute multiple commands.jpg +│ │ ├── Main.txt +│ │ └── stepMe.txt +│ └── test +│ └── screen.jpg +├── manual.pdf +├── v1.0 +│ ├── Plugin_XP.zip +│ ├── plugins_x32.zip +│ ├── pluginsx_x64.zip +│ └── x64dbgScript v1.0.zip +├── v2.0 +│ ├── X64dbgScript plugin v2.jpg +│ └── v2.0.zip +└── v2.5 + ├── X64dbgScript plugin.pdf + ├── plugins 2.5.zip + └── readme.md + +``` + +`README.md`: + +```md +# x64dbg +This is just a x64dbg script system support. +on youtube: + +Export Functions Comments Labels from IDA inside x64dbg. +https://youtu.be/PE1RgHLpWC8 + +Use Global Variable too Run Multipal Script +https://youtu.be/WlfqNp7E650 + +![manual_Page_1](https://user-images.githubusercontent.com/7176580/158775845-9c440394-15f8-4488-a700-ae7bb3f47122.jpg) +![manual_Page_2](https://user-images.githubusercontent.com/7176580/158775852-2f5e0477-6f2c-449c-b86f-1ee5c4419683.jpg) +![manual_Page_3](https://user-images.githubusercontent.com/7176580/158775854-ab131a24-0dde-4745-9c01-a65f2b4a9648.jpg) +![manual_Page_4](https://user-images.githubusercontent.com/7176580/158775856-3acce673-5406-4a59-a76f-5d70aa3ed686.jpg) +![manual_Page_5](https://user-images.githubusercontent.com/7176580/158775858-adb6ed08-34b9-422a-9fb6-c71eb71e771e.jpg) +![manual_Page_6](https://user-images.githubusercontent.com/7176580/158775862-7c2aa14e-725a-4cd8-a7b9-6ebcade5fcab.jpg) + +``` + +`Sample/Export Fun_cmt from ida to x64dbg/export_Func_cmt.py`: + +```py +import idautils +import idaapi + +ea = BeginEA() +module =idaapi.get_root_filename() +imagebase = idaapi.get_imagebase() + +f = open("D:\\Func.txt", "w+") +# here we will export all functions name and (start,End) +for funcea in Functions(SegStart(ea), SegEnd(ea)): + functionName = GetFunctionName(funcea) + functionStart = "0x%08x"% (funcea - idaapi.get_imagebase()) + functionEnd = "0x%08x"%( idc.find_func_end(funcea) - idaapi.get_imagebase()) + print functionName,functionStart,functionEnd + output="lable"+";" + functionName+";" + functionStart + ";" + functionEnd + "\n" + f.write(output) +# here we will export all comments +for function in idautils.Functions(): + for address in idautils.FuncItems(function): + if idc.get_cmt(address,0) is not None: + output= "comments"+";" + idc.get_cmt(address,0) + ";" + "0x%08x"%(address-imagebase) +";" + "none" + "\n" + print (output) + f.write(output) + if idc.get_cmt(address,1) is not None:# + output= "comments"+";" + idc.get_cmt(address,0) + ";" + "0x%08x"%(address-imagebase) +";" + "none" + "\n" + print (output) + f.write(output) +f.close() +``` + +`Sample/Export Fun_cmt from ida to x64dbg/readme.md`: + +```md +watch the move on +https://youtu.be/TbbBPPh-vf4 + +Export Functions Comments Labels from IDA inside x64dbg +using x64dbgScript plugins + +``` + +`Sample/Export Fun_cmt from ida to x64dbg/script.txt`: + +```txt +strarr re[1] // this will used to fill data from ReadFile function it will resized auto +strarr r[4] // this will fill the strcture of the Func.txt +re=ReadFile 'D:\Func.txt' +int i,0 // counter for loop +logs $mod.main() // will log base address of the main module +if.1 i<$ArrayLen(re) // now will check if i reach array length +strAlign {r[0],r[1],r[2],r[3]},re[i],';' // check manual this will devide string by seperator ; +//in case functions r[0] lable; r[1]lablename; r[2] FunctionBeginAddress; r[3] FunctionEndAddress +if.2 r[0]=='lable' +r[2]=r[2]+$mod.main() +r[3]=r[3]+$mod.main() -1 // -1 IDA is end func at the begin in next function +functionadd r[2],r[3] +labelset r[2],r[1] +logs 'function' + r[2] + ' add at : ' + r[1] +End.2 +// in case comments r[0] comments; r[1] text comments ; r[2] comments Address +if.4 r[0]=='comments' +r[2]=r[2] +$mod.main() +commentset r[2],r[1] +logs 'commentset ' + r[2] +' add at ' + r[1] +End.4 +i=i+1 +repeat.1 +End.1 +ret +``` + +`Sample/Search for Sequence of commands/Script.txt`: + +```txt +strarr cmds[3] +str lineaddr +cmds[0]='mov qword ptr ds:[rbx], rcx' +cmds[1]='lea rdx,qword ptr ds:[rbx+8]' +cmds[2]='xor ecx,ecx' +strarr res[1] +hex Nextaddr +int count,0 +res=findasm cmds[0] +int i,0 +if.1 i < $ArrayLen(res) +Nextaddr=res[i]+$dis.len(res[i]) +if.2 cmds[1]==$DisAt(Nextaddr) +Nextaddr=Nextaddr +$dis.len(Nextaddr) +//logs Nextaddr +if.3 cmds[2]==$DisAt(Nextaddr) +logs 'Found at: ' + res[i] +count=count+1 +End.3 +End.2 +i=i+1 +repeat.1 +End.1 +logs 'result count is :' + count +ret + +``` + +`Sample/Use Global Variable too Run Multipal Script/Main.txt`: + +```txt +int stepCount,4 // this will be global variable will used in other script stepMe +int FinishScript,0 // same as above +bp 2E26 + $mod.main() // set BP where we want to finish +bp 2E0F +$mod.main() // set BP at 00000000FFCE2E04 | 0F85 164B0 | jne notepad.FFCE7920 | +SetBreakpointCommand 2E0F +$mod.main(),'"Call stepMe"' // set command at BP +run +if.1 CIP !=2E26 + $mod.main() +if.2 FinishScript==1 // to check if the script finish +FinishScript=0 +run +End.2 +repeat.1 +End.1 +logs 'we reach where we want to stop' + 'RAX=' + RAX +ret + +``` + +`Sample/Use Global Variable too Run Multipal Script/stepMe.txt`: + +```txt +int instLength,0 +stepCount=stepCount-1 +logs stepCount +if.1 stepCount!=0 // this will check if we pass 4 time and then no more set BP +instLength=$dis.len(CIP) // measure cmd length so we will set BP after +bp CIP + instLength // set BP at next instraction +SetBreakpointCommand CIP + instLength,'"Call stepMe"' +logs 'RAX=' + RAX +End.1 +bpc CIP // remove current BP +FinishScript=1 +//run +ret +``` \ No newline at end of file diff --git a/archive/gmh5225/X64DBG-ViewDllNotification.txt b/archive/gmh5225/X64DBG-ViewDllNotification.txt new file mode 100644 index 00000000..97f2c353 --- /dev/null +++ b/archive/gmh5225/X64DBG-ViewDllNotification.txt @@ -0,0 +1,1160 @@ +Project Path: arc_gmh5225_X64DBG-ViewDllNotification_dk6p7ini + +Source Tree: + +```txt +arc_gmh5225_X64DBG-ViewDllNotification_dk6p7ini +├── CMakeLists.txt +├── LICENSE +├── README.md +├── cmake +│ ├── CPM.cmake +│ ├── cmkr.cmake +│ └── x64dbg.cmake +├── cmake.toml +└── src + ├── plugin.cpp + ├── plugin.h + ├── pluginmain.cpp + └── pluginmain.h + +``` + +`CMakeLists.txt`: + +```txt +# This file is automatically generated from cmake.toml - DO NOT EDIT +# See https://github.com/build-cpp/cmkr for more information + +cmake_minimum_required(VERSION 3.15) + +if(CMAKE_SOURCE_DIR STREQUAL CMAKE_BINARY_DIR) + message(FATAL_ERROR "In-tree builds are not supported. Run CMake from a separate directory: cmake -B build") +endif() + +# Regenerate CMakeLists.txt automatically in the root project +set(CMKR_ROOT_PROJECT OFF) +if(CMAKE_CURRENT_SOURCE_DIR STREQUAL CMAKE_SOURCE_DIR) + set(CMKR_ROOT_PROJECT ON) + + # Bootstrap cmkr + include("cmake/cmkr.cmake" OPTIONAL RESULT_VARIABLE CMKR_INCLUDE_RESULT) + if(CMKR_INCLUDE_RESULT) + cmkr() + endif() + + # Enable folder support + set_property(GLOBAL PROPERTY USE_FOLDERS ON) +endif() + +# Create a configure-time dependency on cmake.toml to improve IDE support +if(CMKR_ROOT_PROJECT) + configure_file(cmake.toml cmake.toml COPYONLY) +endif() + +# Set up a more familiar Visual Studio configuration +# Override these options with -DCMAKE_OPTION=Value +# +# See: https://cmake.org/cmake/help/latest/command/set.html#set-cache-entry +set(CMAKE_CONFIGURATION_TYPES "Debug;Release" CACHE STRING "") +set(CMAKE_EXE_LINKER_FLAGS_RELEASE "/DEBUG:FULL /INCREMENTAL:NO" CACHE STRING "") +set(CMAKE_SHARED_LINKER_FLAGS_RELEASE "/DEBUG:FULL /INCREMENTAL:NO" CACHE STRING "") +set(CMAKE_BUILD_TYPE "Release" CACHE STRING "") +set(CMAKE_MSVC_RUNTIME_LIBRARY "MultiThreaded$<$:Debug>" CACHE STRING "") + +project(ViewDllNotification) + +include("cmake/CPM.cmake") +include("cmake/x64dbg.cmake") + +# Target ViewDllNotification +set(CMKR_TARGET ViewDllNotification) +set(ViewDllNotification_SOURCES "") + +list(APPEND ViewDllNotification_SOURCES + "src/plugin.cpp" + "src/pluginmain.cpp" + "src/plugin.h" + "src/pluginmain.h" +) + +list(APPEND ViewDllNotification_SOURCES + cmake.toml +) + +set(CMKR_SOURCES ${ViewDllNotification_SOURCES}) +add_library(ViewDllNotification SHARED) + +if(ViewDllNotification_SOURCES) + target_sources(ViewDllNotification PRIVATE ${ViewDllNotification_SOURCES}) +endif() + +source_group(TREE ${CMAKE_CURRENT_SOURCE_DIR} FILES ${ViewDllNotification_SOURCES}) + +x64dbg_plugin(${CMKR_TARGET}) + +unset(CMKR_TARGET) +unset(CMKR_SOURCES) + + +``` + +`LICENSE`: + +``` +Boost Software License - Version 1.0 - August 17th, 2003 + +Permission is hereby granted, free of charge, to any person or organization +obtaining a copy of the software and accompanying documentation covered by +this license (the "Software") to use, reproduce, display, distribute, +execute, and transmit the Software, and to prepare derivative works of the +Software, and to permit third-parties to whom the Software is furnished to +do so, all subject to the following: + +The copyright notices in the Software and this entire statement, including +the above license grant, this restriction and the following disclaimer, +must be included in all copies of the Software, in whole or in part, and +all derivative works of the Software, unless such copies or derivative +works are solely in the form of machine-executable object code generated by +a source language processor. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT. IN NO EVENT +SHALL THE COPYRIGHT HOLDERS OR ANYONE DISTRIBUTING THE SOFTWARE BE LIABLE +FOR ANY DAMAGES OR OTHER LIABILITY, WHETHER IN CONTRACT, TORT OR OTHERWISE, +ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER +DEALINGS IN THE SOFTWARE. +``` + +`README.md`: + +```md +# X64DBG-ViewDllNotification + +X64DBG plugin viewing dll notification + +![image](https://user-images.githubusercontent.com/13917777/178156979-11bd4ade-3031-40c0-bb85-0606fba90d5c.png) + + +## Usage +``` +ViewDllNotification +``` + +## Building + +From a Visual Studio command prompt: + +``` +cmake -B build64 -A x64 +cmake --build build64 --config Release +``` + +You will get `build64\ViewDllNotification.sln` that you can open in Visual Studio. + +To build a 32-bit plugin: + +``` +cmake -B build32 -A Win32 +cmake --build build32 --config Release +``` + +Alternatively you can open this folder in Visual Studio/CLion/Qt Creator. + + +``` + +`cmake.toml`: + +```toml +[cmake] +version = "3.15" +cmkr-include = "cmake/cmkr.cmake" + +[project] +cmake-before = """ +# Set up a more familiar Visual Studio configuration +# Override these options with -DCMAKE_OPTION=Value +# +# See: https://cmake.org/cmake/help/latest/command/set.html#set-cache-entry +set(CMAKE_CONFIGURATION_TYPES "Debug;Release" CACHE STRING "") +set(CMAKE_EXE_LINKER_FLAGS_RELEASE "/DEBUG:FULL /INCREMENTAL:NO" CACHE STRING "") +set(CMAKE_SHARED_LINKER_FLAGS_RELEASE "/DEBUG:FULL /INCREMENTAL:NO" CACHE STRING "") +set(CMAKE_BUILD_TYPE "Release" CACHE STRING "") +set(CMAKE_MSVC_RUNTIME_LIBRARY "MultiThreaded$<$:Debug>" CACHE STRING "") +""" +name = "ViewDllNotification" +include-after = [ + "cmake/CPM.cmake", + "cmake/x64dbg.cmake", +] + +[target.ViewDllNotification] +type = "shared" +sources = [ + "src/*.cpp", + "src/*.h", +] +cmake-after = """ +x64dbg_plugin(${CMKR_TARGET}) +""" + +``` + +`cmake/CPM.cmake`: + +```cmake +# CPM.cmake - CMake's missing package manager +# =========================================== +# See https://github.com/TheLartians/CPM.cmake for usage and update instructions. +# +# MIT License +# ----------- +#[[ + Copyright (c) 2019 Lars Melchior + + Permission is hereby granted, free of charge, to any person obtaining a copy + of this software and associated documentation files (the "Software"), to deal + in the Software without restriction, including without limitation the rights + to use, copy, modify, merge, publish, distribute, sublicense, and/or sell + copies of the Software, and to permit persons to whom the Software is + furnished to do so, subject to the following conditions: + + The above copyright notice and this permission notice shall be included in all + copies or substantial portions of the Software. + + THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR + IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, + FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE + AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER + LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, + OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE + SOFTWARE. +]] + +cmake_minimum_required(VERSION 3.14 FATAL_ERROR) + +set(CURRENT_CPM_VERSION 0.27.5) + +if(CPM_DIRECTORY) + if(NOT CPM_DIRECTORY STREQUAL CMAKE_CURRENT_LIST_DIR) + if (CPM_VERSION VERSION_LESS CURRENT_CPM_VERSION) + message(AUTHOR_WARNING "${CPM_INDENT} \ +A dependency is using a more recent CPM version (${CURRENT_CPM_VERSION}) than the current project (${CPM_VERSION}). \ +It is recommended to upgrade CPM to the most recent version. \ +See https://github.com/TheLartians/CPM.cmake for more information." + ) + endif() + return() + endif() + + get_property(CPM_INITIALIZED GLOBAL "" PROPERTY CPM_INITIALIZED SET) + if (CPM_INITIALIZED) + return() + endif() +endif() + +set_property(GLOBAL PROPERTY CPM_INITIALIZED true) + +option(CPM_USE_LOCAL_PACKAGES "Always try to use `find_package` to get dependencies" $ENV{CPM_USE_LOCAL_PACKAGES}) +option(CPM_LOCAL_PACKAGES_ONLY "Only use `find_package` to get dependencies" $ENV{CPM_LOCAL_PACKAGES_ONLY}) +option(CPM_DOWNLOAD_ALL "Always download dependencies from source" $ENV{CPM_DOWNLOAD_ALL}) +option(CPM_DONT_UPDATE_MODULE_PATH "Don't update the module path to allow using find_package" $ENV{CPM_DONT_UPDATE_MODULE_PATH}) +option(CPM_DONT_CREATE_PACKAGE_LOCK "Don't create a package lock file in the binary path" $ENV{CPM_DONT_CREATE_PACKAGE_LOCK}) +option(CPM_INCLUDE_ALL_IN_PACKAGE_LOCK "Add all packages added through CPM.cmake to the package lock" $ENV{CPM_INCLUDE_ALL_IN_PACKAGE_LOCK}) + +set(CPM_VERSION ${CURRENT_CPM_VERSION} CACHE INTERNAL "") +set(CPM_DIRECTORY ${CMAKE_CURRENT_LIST_DIR} CACHE INTERNAL "") +set(CPM_FILE ${CMAKE_CURRENT_LIST_FILE} CACHE INTERNAL "") +set(CPM_PACKAGES "" CACHE INTERNAL "") +set(CPM_DRY_RUN OFF CACHE INTERNAL "Don't download or configure dependencies (for testing)") + +if(DEFINED ENV{CPM_SOURCE_CACHE}) + set(CPM_SOURCE_CACHE_DEFAULT $ENV{CPM_SOURCE_CACHE}) +else() + set(CPM_SOURCE_CACHE_DEFAULT OFF) +endif() + +set(CPM_SOURCE_CACHE ${CPM_SOURCE_CACHE_DEFAULT} CACHE PATH "Directory to downlaod CPM dependencies") + +if (NOT CPM_DONT_UPDATE_MODULE_PATH) + set(CPM_MODULE_PATH "${CMAKE_BINARY_DIR}/CPM_modules" CACHE INTERNAL "") + # remove old modules + FILE(REMOVE_RECURSE ${CPM_MODULE_PATH}) + file(MAKE_DIRECTORY ${CPM_MODULE_PATH}) + # locally added CPM modules should override global packages + set(CMAKE_MODULE_PATH "${CPM_MODULE_PATH};${CMAKE_MODULE_PATH}") +endif() + +if (NOT CPM_DONT_CREATE_PACKAGE_LOCK) + set(CPM_PACKAGE_LOCK_FILE "${CMAKE_BINARY_DIR}/cpm-package-lock.cmake" CACHE INTERNAL "") + file(WRITE ${CPM_PACKAGE_LOCK_FILE} "# CPM Package Lock\n# This file should be committed to version control\n\n") +endif() + +include(FetchContent) +include(CMakeParseArguments) + +# Initialize logging prefix +if(NOT CPM_INDENT) + set(CPM_INDENT "CPM:") +endif() + +function(cpm_find_package NAME VERSION) + string(REPLACE " " ";" EXTRA_ARGS "${ARGN}") + find_package(${NAME} ${VERSION} ${EXTRA_ARGS} QUIET) + if(${CPM_ARGS_NAME}_FOUND) + message(STATUS "${CPM_INDENT} using local package ${CPM_ARGS_NAME}@${VERSION}") + CPMRegisterPackage(${CPM_ARGS_NAME} "${VERSION}") + set(CPM_PACKAGE_FOUND YES PARENT_SCOPE) + else() + set(CPM_PACKAGE_FOUND NO PARENT_SCOPE) + endif() +endfunction() + +# Create a custom FindXXX.cmake module for a CPM package +# This prevents `find_package(NAME)` from finding the system library +function(CPMCreateModuleFile Name) + if (NOT CPM_DONT_UPDATE_MODULE_PATH) + # erase any previous modules + FILE(WRITE ${CPM_MODULE_PATH}/Find${Name}.cmake "include(${CPM_FILE})\n${ARGN}\nset(${Name}_FOUND TRUE)") + endif() +endfunction() + +# Find a package locally or fallback to CPMAddPackage +function(CPMFindPackage) + set(oneValueArgs + NAME + VERSION + GIT_TAG + FIND_PACKAGE_ARGUMENTS + ) + + cmake_parse_arguments(CPM_ARGS "" "${oneValueArgs}" "" ${ARGN}) + + if (NOT DEFINED CPM_ARGS_VERSION) + if (DEFINED CPM_ARGS_GIT_TAG) + cpm_get_version_from_git_tag("${CPM_ARGS_GIT_TAG}" CPM_ARGS_VERSION) + endif() + endif() + + if (CPM_DOWNLOAD_ALL) + CPMAddPackage(${ARGN}) + cpm_export_variables(${CPM_ARGS_NAME}) + return() + endif() + + CPMCheckIfPackageAlreadyAdded(${CPM_ARGS_NAME} "${CPM_ARGS_VERSION}" "${CPM_ARGS_OPTIONS}") + if (CPM_PACKAGE_ALREADY_ADDED) + cpm_export_variables(${CPM_ARGS_NAME}) + return() + endif() + + cpm_find_package(${CPM_ARGS_NAME} "${CPM_ARGS_VERSION}" ${CPM_ARGS_FIND_PACKAGE_ARGUMENTS}) + + if(NOT CPM_PACKAGE_FOUND) + CPMAddPackage(${ARGN}) + cpm_export_variables(${CPM_ARGS_NAME}) + endif() + +endfunction() + +# checks if a package has been added before +function(CPMCheckIfPackageAlreadyAdded CPM_ARGS_NAME CPM_ARGS_VERSION CPM_ARGS_OPTIONS) + if ("${CPM_ARGS_NAME}" IN_LIST CPM_PACKAGES) + CPMGetPackageVersion(${CPM_ARGS_NAME} CPM_PACKAGE_VERSION) + if("${CPM_PACKAGE_VERSION}" VERSION_LESS "${CPM_ARGS_VERSION}") + message(WARNING "${CPM_INDENT} requires a newer version of ${CPM_ARGS_NAME} (${CPM_ARGS_VERSION}) than currently included (${CPM_PACKAGE_VERSION}).") + endif() + if (CPM_ARGS_OPTIONS) + foreach(OPTION ${CPM_ARGS_OPTIONS}) + cpm_parse_option(${OPTION}) + if(NOT "${${OPTION_KEY}}" STREQUAL "${OPTION_VALUE}") + message(WARNING "${CPM_INDENT} ignoring package option for ${CPM_ARGS_NAME}: ${OPTION_KEY} = ${OPTION_VALUE} (${${OPTION_KEY}})") + endif() + endforeach() + endif() + cpm_get_fetch_properties(${CPM_ARGS_NAME}) + SET(${CPM_ARGS_NAME}_ADDED NO) + SET(CPM_PACKAGE_ALREADY_ADDED YES PARENT_SCOPE) + cpm_export_variables(${CPM_ARGS_NAME}) + else() + SET(CPM_PACKAGE_ALREADY_ADDED NO PARENT_SCOPE) + endif() +endfunction() + +# Download and add a package from source +function(CPMAddPackage) + + set(oneValueArgs + NAME + FORCE + VERSION + GIT_TAG + DOWNLOAD_ONLY + GITHUB_REPOSITORY + GITLAB_REPOSITORY + GIT_REPOSITORY + SOURCE_DIR + DOWNLOAD_COMMAND + FIND_PACKAGE_ARGUMENTS + NO_CACHE + GIT_SHALLOW + ) + + set(multiValueArgs + OPTIONS + ) + + cmake_parse_arguments(CPM_ARGS "" "${oneValueArgs}" "${multiValueArgs}" "${ARGN}") + + # Set default values for arguments + + if (NOT DEFINED CPM_ARGS_VERSION) + if (DEFINED CPM_ARGS_GIT_TAG) + cpm_get_version_from_git_tag("${CPM_ARGS_GIT_TAG}" CPM_ARGS_VERSION) + endif() + endif() + + if(CPM_ARGS_DOWNLOAD_ONLY) + set(DOWNLOAD_ONLY ${CPM_ARGS_DOWNLOAD_ONLY}) + else() + set(DOWNLOAD_ONLY NO) + endif() + + if (DEFINED CPM_ARGS_GITHUB_REPOSITORY) + set(CPM_ARGS_GIT_REPOSITORY "https://github.com/${CPM_ARGS_GITHUB_REPOSITORY}.git") + endif() + + if (DEFINED CPM_ARGS_GITLAB_REPOSITORY) + set(CPM_ARGS_GIT_REPOSITORY "https://gitlab.com/${CPM_ARGS_GITLAB_REPOSITORY}.git") + endif() + + if (DEFINED CPM_ARGS_GIT_REPOSITORY) + list(APPEND CPM_ARGS_UNPARSED_ARGUMENTS GIT_REPOSITORY ${CPM_ARGS_GIT_REPOSITORY}) + if (NOT DEFINED CPM_ARGS_GIT_TAG) + set(CPM_ARGS_GIT_TAG v${CPM_ARGS_VERSION}) + endif() + endif() + + if (DEFINED CPM_ARGS_GIT_TAG) + list(APPEND CPM_ARGS_UNPARSED_ARGUMENTS GIT_TAG ${CPM_ARGS_GIT_TAG}) + # If GIT_SHALLOW is explicitly specified, honor the value. + if (DEFINED CPM_ARGS_GIT_SHALLOW) + list(APPEND CPM_ARGS_UNPARSED_ARGUMENTS GIT_SHALLOW ${CPM_ARGS_GIT_SHALLOW}) + endif() + endif() + + # Check if package has been added before + CPMCheckIfPackageAlreadyAdded(${CPM_ARGS_NAME} "${CPM_ARGS_VERSION}" "${CPM_ARGS_OPTIONS}") + if (CPM_PACKAGE_ALREADY_ADDED) + cpm_export_variables(${CPM_ARGS_NAME}) + return() + endif() + + # Check for manual overrides + if (NOT CPM_ARGS_FORCE AND NOT "${CPM_${CPM_ARGS_NAME}_SOURCE}" STREQUAL "") + set(PACKAGE_SOURCE ${CPM_${CPM_ARGS_NAME}_SOURCE}) + set(CPM_${CPM_ARGS_NAME}_SOURCE "") + CPMAddPackage( + NAME ${CPM_ARGS_NAME} + SOURCE_DIR ${PACKAGE_SOURCE} + FORCE True + OPTIONS ${CPM_ARGS_OPTIONS} + ) + cpm_export_variables(${CPM_ARGS_NAME}) + return() + endif() + + # Check for available declaration + if (NOT CPM_ARGS_FORCE AND NOT "${CPM_DECLARATION_${CPM_ARGS_NAME}}" STREQUAL "") + set(declaration ${CPM_DECLARATION_${CPM_ARGS_NAME}}) + set(CPM_DECLARATION_${CPM_ARGS_NAME} "") + CPMAddPackage(${declaration}) + cpm_export_variables(${CPM_ARGS_NAME}) + # checking again to ensure version and option compatibility + CPMCheckIfPackageAlreadyAdded(${CPM_ARGS_NAME} "${CPM_ARGS_VERSION}" "${CPM_ARGS_OPTIONS}") + return() + endif() + + if(CPM_USE_LOCAL_PACKAGES OR CPM_LOCAL_PACKAGES_ONLY) + cpm_find_package(${CPM_ARGS_NAME} "${CPM_ARGS_VERSION}" ${CPM_ARGS_FIND_PACKAGE_ARGUMENTS}) + + if(CPM_PACKAGE_FOUND) + cpm_export_variables(${CPM_ARGS_NAME}) + return() + endif() + + if(CPM_LOCAL_PACKAGES_ONLY) + message(SEND_ERROR "CPM: ${CPM_ARGS_NAME} not found via find_package(${CPM_ARGS_NAME} ${CPM_ARGS_VERSION})") + endif() + endif() + + CPMRegisterPackage("${CPM_ARGS_NAME}" "${CPM_ARGS_VERSION}") + + if (CPM_ARGS_OPTIONS) + foreach(OPTION ${CPM_ARGS_OPTIONS}) + cpm_parse_option(${OPTION}) + set(${OPTION_KEY} ${OPTION_VALUE} CACHE INTERNAL "") + endforeach() + endif() + + if (DEFINED CPM_ARGS_GIT_TAG) + set(PACKAGE_INFO "${CPM_ARGS_GIT_TAG}") + elseif (DEFINED CPM_ARGS_SOURCE_DIR) + set(PACKAGE_INFO "${CPM_ARGS_SOURCE_DIR}") + else() + set(PACKAGE_INFO "${CPM_ARGS_VERSION}") + endif() + + if (DEFINED CPM_ARGS_DOWNLOAD_COMMAND) + list(APPEND CPM_ARGS_UNPARSED_ARGUMENTS DOWNLOAD_COMMAND ${CPM_ARGS_DOWNLOAD_COMMAND}) + elseif (DEFINED CPM_ARGS_SOURCE_DIR) + list(APPEND CPM_ARGS_UNPARSED_ARGUMENTS SOURCE_DIR ${CPM_ARGS_SOURCE_DIR}) + elseif (CPM_SOURCE_CACHE AND NOT CPM_ARGS_NO_CACHE) + string(TOLOWER ${CPM_ARGS_NAME} lower_case_name) + set(origin_parameters ${CPM_ARGS_UNPARSED_ARGUMENTS}) + list(SORT origin_parameters) + string(SHA1 origin_hash "${origin_parameters}") + set(download_directory ${CPM_SOURCE_CACHE}/${lower_case_name}/${origin_hash}) + list(APPEND CPM_ARGS_UNPARSED_ARGUMENTS SOURCE_DIR ${download_directory}) + if (EXISTS ${download_directory}) + # disable the download command to allow offline builds + list(APPEND CPM_ARGS_UNPARSED_ARGUMENTS DOWNLOAD_COMMAND "${CMAKE_COMMAND}") + set(PACKAGE_INFO "${download_directory}") + else() + # Enable shallow clone when GIT_TAG is not a commit hash. + # Our guess may not be accurate, but it should guarantee no commit hash get mis-detected. + if (NOT DEFINED CPM_ARGS_GIT_SHALLOW) + cpm_is_git_tag_commit_hash("${CPM_ARGS_GIT_TAG}" IS_HASH) + if (NOT ${IS_HASH}) + list(APPEND CPM_ARGS_UNPARSED_ARGUMENTS GIT_SHALLOW TRUE) + endif() + endif() + + # remove timestamps so CMake will re-download the dependency + file(REMOVE_RECURSE ${CMAKE_BINARY_DIR}/_deps/${lower_case_name}-subbuild) + set(PACKAGE_INFO "${PACKAGE_INFO} -> ${download_directory}") + endif() + endif() + + CPMCreateModuleFile(${CPM_ARGS_NAME} "CPMAddPackage(${ARGN})") + + if (CPM_PACKAGE_LOCK_ENABLED) + if ((CPM_ARGS_VERSION AND NOT CPM_ARGS_SOURCE_DIR) OR CPM_INCLUDE_ALL_IN_PACKAGE_LOCK) + cpm_add_to_package_lock(${CPM_ARGS_NAME} "${ARGN}") + elseif(CPM_ARGS_SOURCE_DIR) + cpm_add_comment_to_package_lock(${CPM_ARGS_NAME} "local directory") + else() + cpm_add_comment_to_package_lock(${CPM_ARGS_NAME} "${ARGN}") + endif() + endif() + + cpm_declare_fetch("${CPM_ARGS_NAME}" "${CPM_ARGS_VERSION}" "${PACKAGE_INFO}" "${CPM_ARGS_UNPARSED_ARGUMENTS}") + cpm_fetch_package("${CPM_ARGS_NAME}" "${DOWNLOAD_ONLY}") + cpm_get_fetch_properties("${CPM_ARGS_NAME}") + + SET(${CPM_ARGS_NAME}_ADDED YES) + cpm_export_variables("${CPM_ARGS_NAME}") +endfunction() + +# Fetch a previously declared package +macro(CPMGetPackage Name) + if (DEFINED "CPM_DECLARATION_${Name}") + CPMAddPackage( + NAME ${Name} + ) + else() + message(SEND_ERROR "Cannot retrieve package ${Name}: no declaration available") + endif() +endmacro() + +# export variables available to the caller to the parent scope +# expects ${CPM_ARGS_NAME} to be set +macro(cpm_export_variables name) + SET(${name}_SOURCE_DIR "${${name}_SOURCE_DIR}" PARENT_SCOPE) + SET(${name}_BINARY_DIR "${${name}_BINARY_DIR}" PARENT_SCOPE) + SET(${name}_ADDED "${${name}_ADDED}" PARENT_SCOPE) +endmacro() + +# declares a package, so that any call to CPMAddPackage for the +# package name will use these arguments instead. +# Previous declarations will not be overriden. +macro(CPMDeclarePackage Name) + if (NOT DEFINED "CPM_DECLARATION_${Name}") + set("CPM_DECLARATION_${Name}" "${ARGN}") + endif() +endmacro() + +function(cpm_add_to_package_lock Name) + if (NOT CPM_DONT_CREATE_PACKAGE_LOCK) + file(APPEND ${CPM_PACKAGE_LOCK_FILE} "# ${Name}\nCPMDeclarePackage(${Name} \"${ARGN}\")\n") + endif() +endfunction() + +function(cpm_add_comment_to_package_lock Name) + if (NOT CPM_DONT_CREATE_PACKAGE_LOCK) + file(APPEND ${CPM_PACKAGE_LOCK_FILE} "# ${Name} (unversioned)\n# CPMDeclarePackage(${Name} \"${ARGN}\")\n") + endif() +endfunction() + +# includes the package lock file if it exists and creates a target +# `cpm-write-package-lock` to update it +macro(CPMUsePackageLock file) + if (NOT CPM_DONT_CREATE_PACKAGE_LOCK) + get_filename_component(CPM_ABSOLUTE_PACKAGE_LOCK_PATH ${file} ABSOLUTE) + if(EXISTS ${CPM_ABSOLUTE_PACKAGE_LOCK_PATH}) + include(${CPM_ABSOLUTE_PACKAGE_LOCK_PATH}) + endif() + if (NOT TARGET cpm-update-package-lock) + add_custom_target(cpm-update-package-lock COMMAND ${CMAKE_COMMAND} -E copy ${CPM_PACKAGE_LOCK_FILE} ${CPM_ABSOLUTE_PACKAGE_LOCK_PATH}) + endif() + set(CPM_PACKAGE_LOCK_ENABLED true) + endif() +endmacro() + +# registers a package that has been added to CPM +function(CPMRegisterPackage PACKAGE VERSION) + list(APPEND CPM_PACKAGES ${PACKAGE}) + set(CPM_PACKAGES ${CPM_PACKAGES} CACHE INTERNAL "") + set("CPM_PACKAGE_${PACKAGE}_VERSION" ${VERSION} CACHE INTERNAL "") +endfunction() + +# retrieve the current version of the package to ${OUTPUT} +function(CPMGetPackageVersion PACKAGE OUTPUT) + set(${OUTPUT} "${CPM_PACKAGE_${PACKAGE}_VERSION}" PARENT_SCOPE) +endfunction() + +# declares a package in FetchContent_Declare +function (cpm_declare_fetch PACKAGE VERSION INFO) + message(STATUS "${CPM_INDENT} adding package ${PACKAGE}@${VERSION} (${INFO})") + + if (${CPM_DRY_RUN}) + message(STATUS "${CPM_INDENT} package not declared (dry run)") + return() + endif() + + FetchContent_Declare(${PACKAGE} + ${ARGN} + ) +endfunction() + +# returns properties for a package previously defined by cpm_declare_fetch +function (cpm_get_fetch_properties PACKAGE) + if (${CPM_DRY_RUN}) + return() + endif() + FetchContent_GetProperties(${PACKAGE}) + string(TOLOWER ${PACKAGE} lpackage) + SET(${PACKAGE}_SOURCE_DIR "${${lpackage}_SOURCE_DIR}" PARENT_SCOPE) + SET(${PACKAGE}_BINARY_DIR "${${lpackage}_BINARY_DIR}" PARENT_SCOPE) +endfunction() + +# downloads a previously declared package via FetchContent +function (cpm_fetch_package PACKAGE DOWNLOAD_ONLY) + if (${CPM_DRY_RUN}) + message(STATUS "${CPM_INDENT} package ${PACKAGE} not fetched (dry run)") + return() + endif() + + if(DOWNLOAD_ONLY) + FetchContent_GetProperties(${PACKAGE}) + if(NOT ${PACKAGE}_POPULATED) + FetchContent_Populate(${PACKAGE}) + endif() + else() + set(CPM_OLD_INDENT "${CPM_INDENT}") + set(CPM_INDENT "${CPM_INDENT} ${PACKAGE}:") + FetchContent_MakeAvailable(${PACKAGE}) + set(CPM_INDENT "${CPM_OLD_INDENT}") + endif() +endfunction() + +# splits a package option +function(cpm_parse_option OPTION) + string(REGEX MATCH "^[^ ]+" OPTION_KEY ${OPTION}) + string(LENGTH ${OPTION} OPTION_LENGTH) + string(LENGTH ${OPTION_KEY} OPTION_KEY_LENGTH) + if (OPTION_KEY_LENGTH STREQUAL OPTION_LENGTH) + # no value for key provided, assume user wants to set option to "ON" + set(OPTION_VALUE "ON") + else() + math(EXPR OPTION_KEY_LENGTH "${OPTION_KEY_LENGTH}+1") + string(SUBSTRING ${OPTION} "${OPTION_KEY_LENGTH}" "-1" OPTION_VALUE) + endif() + set(OPTION_KEY "${OPTION_KEY}" PARENT_SCOPE) + set(OPTION_VALUE "${OPTION_VALUE}" PARENT_SCOPE) +endfunction() + +# guesses the package version from a git tag +function(cpm_get_version_from_git_tag GIT_TAG RESULT) + string(LENGTH ${GIT_TAG} length) + if (length EQUAL 40) + # GIT_TAG is probably a git hash + SET(${RESULT} 0 PARENT_SCOPE) + else() + string(REGEX MATCH "v?([0123456789.]*).*" _ ${GIT_TAG}) + SET(${RESULT} ${CMAKE_MATCH_1} PARENT_SCOPE) + endif() +endfunction() + +# guesses if the git tag is a commit hash or an actual tag or a branch nane. +function(cpm_is_git_tag_commit_hash GIT_TAG RESULT) + string(LENGTH "${GIT_TAG}" length) + # full hash has 40 characters, and short hash has at least 7 characters. + if (length LESS 7 OR length GREATER 40) + SET(${RESULT} 0 PARENT_SCOPE) + else() + if (${GIT_TAG} MATCHES "^[a-fA-F0-9]+$") + SET(${RESULT} 1 PARENT_SCOPE) + else() + SET(${RESULT} 0 PARENT_SCOPE) + endif() + endif() +endfunction() + +``` + +`cmake/cmkr.cmake`: + +```cmake +include_guard() + +# Change these defaults to point to your infrastructure if desired +set(CMKR_REPO "https://github.com/build-cpp/cmkr" CACHE STRING "cmkr git repository" FORCE) +set(CMKR_TAG "archive_7c7144b1" CACHE STRING "cmkr git tag (this needs to be available forever)" FORCE) + +# Set these from the command line to customize for development/debugging purposes +set(CMKR_EXECUTABLE "" CACHE FILEPATH "cmkr executable") +set(CMKR_SKIP_GENERATION OFF CACHE BOOL "skip automatic cmkr generation") + +# Disable cmkr if generation is disabled +if(DEFINED ENV{CI} OR CMKR_SKIP_GENERATION OR CMKR_BUILD_SKIP_GENERATION) + message(STATUS "[cmkr] Skipping automatic cmkr generation") + unset(CMKR_BUILD_SKIP_GENERATION CACHE) + macro(cmkr) + endmacro() + return() +endif() + +# Disable cmkr if no cmake.toml file is found +if(NOT EXISTS "${CMAKE_CURRENT_SOURCE_DIR}/cmake.toml") + message(AUTHOR_WARNING "[cmkr] Not found: ${CMAKE_CURRENT_SOURCE_DIR}/cmake.toml") + macro(cmkr) + endmacro() + return() +endif() + +# Convert a Windows native path to CMake path +if(CMKR_EXECUTABLE MATCHES "\\\\") + string(REPLACE "\\" "/" CMKR_EXECUTABLE_CMAKE "${CMKR_EXECUTABLE}") + set(CMKR_EXECUTABLE "${CMKR_EXECUTABLE_CMAKE}" CACHE FILEPATH "" FORCE) + unset(CMKR_EXECUTABLE_CMAKE) +endif() + +# Helper macro to execute a process (COMMAND_ERROR_IS_FATAL ANY is 3.19 and higher) +function(cmkr_exec) + execute_process(COMMAND ${ARGV} RESULT_VARIABLE CMKR_EXEC_RESULT) + if(NOT CMKR_EXEC_RESULT EQUAL 0) + message(FATAL_ERROR "cmkr_exec(${ARGV}) failed (exit code ${CMKR_EXEC_RESULT})") + endif() +endfunction() + +# Windows-specific hack (CMAKE_EXECUTABLE_PREFIX is not set at the moment) +if(WIN32) + set(CMKR_EXECUTABLE_NAME "cmkr.exe") +else() + set(CMKR_EXECUTABLE_NAME "cmkr") +endif() + +# Use cached cmkr if found +set(CMKR_DIRECTORY "${CMAKE_CURRENT_BINARY_DIR}/_cmkr_${CMKR_TAG}") +set(CMKR_CACHED_EXECUTABLE "${CMKR_DIRECTORY}/bin/${CMKR_EXECUTABLE_NAME}") + +if(NOT CMKR_CACHED_EXECUTABLE STREQUAL CMKR_EXECUTABLE AND CMKR_EXECUTABLE MATCHES "^${CMAKE_CURRENT_BINARY_DIR}/_cmkr") + message(AUTHOR_WARNING "[cmkr] Upgrading '${CMKR_EXECUTABLE}' to '${CMKR_CACHED_EXECUTABLE}'") + unset(CMKR_EXECUTABLE CACHE) +endif() + +if(CMKR_EXECUTABLE AND EXISTS "${CMKR_EXECUTABLE}") + message(VERBOSE "[cmkr] Found cmkr: '${CMKR_EXECUTABLE}'") +elseif(CMKR_EXECUTABLE AND NOT CMKR_EXECUTABLE STREQUAL CMKR_CACHED_EXECUTABLE) + message(FATAL_ERROR "[cmkr] '${CMKR_EXECUTABLE}' not found") +else() + set(CMKR_EXECUTABLE "${CMKR_CACHED_EXECUTABLE}" CACHE FILEPATH "Full path to cmkr executable" FORCE) + message(VERBOSE "[cmkr] Bootstrapping '${CMKR_EXECUTABLE}'") + + message(STATUS "[cmkr] Fetching cmkr...") + if(EXISTS "${CMKR_DIRECTORY}") + cmkr_exec("${CMAKE_COMMAND}" -E rm -rf "${CMKR_DIRECTORY}") + endif() + find_package(Git QUIET REQUIRED) + cmkr_exec("${GIT_EXECUTABLE}" + clone + --config advice.detachedHead=false + --branch ${CMKR_TAG} + --depth 1 + ${CMKR_REPO} + "${CMKR_DIRECTORY}" + ) + message(STATUS "[cmkr] Building cmkr...") + cmkr_exec("${CMAKE_COMMAND}" + --no-warn-unused-cli + "${CMKR_DIRECTORY}" + "-B${CMKR_DIRECTORY}/build" + "-DCMAKE_BUILD_TYPE=Release" + "-DCMAKE_INSTALL_PREFIX=${CMKR_DIRECTORY}" + "-DCMKR_GENERATE_DOCUMENTATION=OFF" + ) + cmkr_exec("${CMAKE_COMMAND}" + --build "${CMKR_DIRECTORY}/build" + --config Release + --parallel + ) + cmkr_exec("${CMAKE_COMMAND}" + --install "${CMKR_DIRECTORY}/build" + --config Release + --prefix "${CMKR_DIRECTORY}" + --component cmkr + ) + if(NOT EXISTS ${CMKR_EXECUTABLE}) + message(FATAL_ERROR "[cmkr] Failed to bootstrap '${CMKR_EXECUTABLE}'") + endif() + cmkr_exec("${CMKR_EXECUTABLE}" version) + message(STATUS "[cmkr] Bootstrapped ${CMKR_EXECUTABLE}") +endif() +execute_process(COMMAND "${CMKR_EXECUTABLE}" version + RESULT_VARIABLE CMKR_EXEC_RESULT +) +if(NOT CMKR_EXEC_RESULT EQUAL 0) + message(FATAL_ERROR "[cmkr] Failed to get version, try clearing the cache and rebuilding") +endif() + +# This is the macro that contains black magic +macro(cmkr) + # When this macro is called from the generated file, fake some internal CMake variables + get_source_file_property(CMKR_CURRENT_LIST_FILE "${CMAKE_CURRENT_LIST_FILE}" CMKR_CURRENT_LIST_FILE) + if(CMKR_CURRENT_LIST_FILE) + set(CMAKE_CURRENT_LIST_FILE "${CMKR_CURRENT_LIST_FILE}") + get_filename_component(CMAKE_CURRENT_LIST_DIR "${CMAKE_CURRENT_LIST_FILE}" DIRECTORY) + endif() + + # File-based include guard (include_guard is not documented to work) + get_source_file_property(CMKR_INCLUDE_GUARD "${CMAKE_CURRENT_LIST_FILE}" CMKR_INCLUDE_GUARD) + if(NOT CMKR_INCLUDE_GUARD) + set_source_files_properties("${CMAKE_CURRENT_LIST_FILE}" PROPERTIES CMKR_INCLUDE_GUARD TRUE) + + file(SHA256 "${CMAKE_CURRENT_LIST_FILE}" CMKR_LIST_FILE_SHA256_PRE) + + # Generate CMakeLists.txt + cmkr_exec("${CMKR_EXECUTABLE}" gen + WORKING_DIRECTORY "${CMAKE_CURRENT_SOURCE_DIR}" + ) + + file(SHA256 "${CMAKE_CURRENT_LIST_FILE}" CMKR_LIST_FILE_SHA256_POST) + + # Delete the temporary file if it was left for some reason + set(CMKR_TEMP_FILE "${CMAKE_CURRENT_SOURCE_DIR}/CMakerLists.txt") + if(EXISTS "${CMKR_TEMP_FILE}") + file(REMOVE "${CMKR_TEMP_FILE}") + endif() + + if(NOT CMKR_LIST_FILE_SHA256_PRE STREQUAL CMKR_LIST_FILE_SHA256_POST) + # Copy the now-generated CMakeLists.txt to CMakerLists.txt + # This is done because you cannot include() a file you are currently in + configure_file(CMakeLists.txt "${CMKR_TEMP_FILE}" COPYONLY) + + # Add the macro required for the hack at the start of the cmkr macro + set_source_files_properties("${CMKR_TEMP_FILE}" PROPERTIES + CMKR_CURRENT_LIST_FILE "${CMAKE_CURRENT_LIST_FILE}" + ) + + # 'Execute' the newly-generated CMakeLists.txt + include("${CMKR_TEMP_FILE}") + + # Delete the generated file + file(REMOVE "${CMKR_TEMP_FILE}") + + # Do not execute the rest of the original CMakeLists.txt + return() + endif() + # Resume executing the unmodified CMakeLists.txt + endif() +endmacro() + +``` + +`cmake/x64dbg.cmake`: + +```cmake +CPMAddPackage( + NAME x64dbg + URL https://downloads.sourceforge.net/project/x64dbg/snapshots/snapshot_2021-11-20_10-12.zip + URL_HASH SHA1=C75AC6BA7E7E5AB60632EED5648254E4BEF11465 + DOWNLOAD_ONLY ON +) + +if(x64dbg_ADDED) + if(NOT TARGET x64dbg) + file(GLOB_RECURSE HEADERS CONFIGURE_DEPENDS ${x64dbg_SOURCE_DIR}/pluginsdk/*.h) + add_custom_target(x64dbg-sdk SOURCES ${HEADERS}) + source_group(TREE ${x64dbg_SOURCE_DIR} FILES ${HEADERS}) + + add_library(x64dbg INTERFACE) + target_include_directories(x64dbg INTERFACE ${x64dbg_SOURCE_DIR}) + target_link_directories(x64dbg INTERFACE ${x64dbg_SOURCE_DIR}) + endif() + + function(x64dbg_plugin target) + if(NOT TARGET ${target}) + # Add plugin dll + add_library(${target} SHARED ${ARGN}) + # Group source files + source_group(TREE ${CMAKE_CURRENT_SOURCE_DIR} FILES ${ARGN}) + endif() + + # Change extension + if(CMAKE_SIZEOF_VOID_P EQUAL 8) + set_target_properties(${target} PROPERTIES SUFFIX ".dp64") + else() + set_target_properties(${target} PROPERTIES SUFFIX ".dp32") + endif() + + # Link to the x64dbg SDK + target_link_libraries(${target} PRIVATE x64dbg) + + # Set plugin name based on the target + target_compile_definitions(${target} PRIVATE "-DPLUGIN_NAME=\"${target}\"") + + # Support PluginDevHelper + add_custom_command(TARGET ${target} PRE_LINK COMMAND if exist "\"$(SolutionDir)PluginDevBuildTool.exe\"" "(\"$(SolutionDir)PluginDevBuildTool.exe\"" unload "\"$(TargetPath)\")" else (echo Copy PluginDevTool.exe next to the .sln to automatically reload plugins when building)) + add_custom_command(TARGET ${target} POST_BUILD COMMAND if exist "\"$(SolutionDir)PluginDevBuildTool.exe\"" ("\"$(SolutionDir)PluginDevBuildTool.exe\"" reload "\"$(TargetPath)\"")) + endfunction() +endif() +``` + +`src/plugin.cpp`: + +```cpp +#include "plugin.h" + +typedef struct _DBG_LIST_ENTRY +{ + struct _DBG_LIST_ENTRY *Flink; + struct _DBG_LIST_ENTRY *Blink; +} DBG_LIST_ENTRY, *PDBG_LIST_ENTRY; + +typedef struct _DBG_LDRP_DLL_NOTIFICATION_BLOCK +{ + DBG_LIST_ENTRY Links; + duint NotificationFunction; + duint Context; +} DBG_LDRP_DLL_NOTIFICATION_BLOCK, *PDBG_LDRP_DLL_NOTIFICATION_BLOCK; + +static bool +cbViewDllNotification(int argc, char **argv) +{ + static duint addr_LdrpDllNotificationList = 0; + +#ifdef _WIN64 + auto symbol = "LdrpDllNotificationList"; +#else + auto symbol = "_LdrpDllNotificationList"; +#endif + if (addr_LdrpDllNotificationList == 0) + { + addr_LdrpDllNotificationList = DbgValFromString(symbol); + if (addr_LdrpDllNotificationList == 0) + { + _plugin_logputs( + "[" PLUGIN_NAME + "] Failed to get LdrpDllNotificationList! You need to ensure that the symbols are loaded successfully!"); + return false; + } + } + + duint next = 0; + if (!DbgMemRead(addr_LdrpDllNotificationList, (unsigned char *)&next, sizeof(next))) + { + return false; + } + + while (next != addr_LdrpDllNotificationList) + { + DBG_LDRP_DLL_NOTIFICATION_BLOCK st = {0}; + duint readsize = 16; +#ifdef _WIN64 + readsize = 32; +#endif + if (!DbgMemRead(next, (unsigned char *)&st, readsize)) + { + return false; + } + + _plugin_logprintf( + "[" PLUGIN_NAME "] NotificationFunction:%p Flink:%p Blink:%p Context:%p\n", + st.NotificationFunction, + st.Links.Flink, + st.Links.Blink, + st.Context); + + if (!DbgMemRead(next, (unsigned char *)&next, sizeof(next))) + { + return false; + } + } + + return true; +} + +// Initialize your plugin data here. +bool +pluginInit(PLUG_INITSTRUCT *initStruct) +{ + if (!_plugin_registercommand(pluginHandle, "ViewDllNotification", cbViewDllNotification, true)) + { + _plugin_logputs("[" PLUGIN_NAME "] Error registering the ViewDllNotification command!"); + } + + return true; // Return false to cancel loading the plugin. +} + +// Deinitialize your plugin data here. +void +pluginStop() +{ +} + +// Do GUI/Menu related things here. +void +pluginSetup() +{ +} + +``` + +`src/plugin.h`: + +```h +#pragma once + +#include "pluginmain.h" + +//functions +bool pluginInit(PLUG_INITSTRUCT* initStruct); +void pluginStop(); +void pluginSetup(); + +``` + +`src/pluginmain.cpp`: + +```cpp +#include "pluginmain.h" +#include "plugin.h" + +int pluginHandle; +HWND hwndDlg; +int hMenu; +int hMenuDisasm; +int hMenuDump; +int hMenuStack; + +PLUG_EXPORT bool +pluginit(PLUG_INITSTRUCT *initStruct) +{ + initStruct->pluginVersion = PLUGIN_VERSION; + initStruct->sdkVersion = PLUG_SDKVERSION; + strncpy_s(initStruct->pluginName, PLUGIN_NAME, _TRUNCATE); + pluginHandle = initStruct->pluginHandle; + return pluginInit(initStruct); +} + +PLUG_EXPORT bool +plugstop() +{ + pluginStop(); + return true; +} + +PLUG_EXPORT void +plugsetup(PLUG_SETUPSTRUCT *setupStruct) +{ + hwndDlg = setupStruct->hwndDlg; + hMenu = setupStruct->hMenu; + hMenuDisasm = setupStruct->hMenuDisasm; + hMenuDump = setupStruct->hMenuDump; + hMenuStack = setupStruct->hMenuStack; + pluginSetup(); +} +``` + +`src/pluginmain.h`: + +```h +#pragma once + +// Plugin information +#ifndef PLUGIN_NAME +#error You need to define PLUGIN_NAME +#endif // PLUGIN_NAME +#define PLUGIN_VERSION 1 + +#include "pluginsdk/bridgemain.h" +#include "pluginsdk/_plugins.h" + +#include "pluginsdk/_scriptapi_argument.h" +#include "pluginsdk/_scriptapi_assembler.h" +#include "pluginsdk/_scriptapi_bookmark.h" +#include "pluginsdk/_scriptapi_comment.h" +#include "pluginsdk/_scriptapi_debug.h" +#include "pluginsdk/_scriptapi_flag.h" +#include "pluginsdk/_scriptapi_function.h" +#include "pluginsdk/_scriptapi_gui.h" +#include "pluginsdk/_scriptapi_label.h" +#include "pluginsdk/_scriptapi_memory.h" +#include "pluginsdk/_scriptapi_misc.h" +#include "pluginsdk/_scriptapi_module.h" +#include "pluginsdk/_scriptapi_pattern.h" +#include "pluginsdk/_scriptapi_register.h" +#include "pluginsdk/_scriptapi_stack.h" +#include "pluginsdk/_scriptapi_symbol.h" + +#include "pluginsdk/DeviceNameResolver/DeviceNameResolver.h" +#include "pluginsdk/jansson/jansson.h" +#include "pluginsdk/lz4/lz4file.h" +#include "pluginsdk/TitanEngine/TitanEngine.h" +#include "pluginsdk/XEDParse/XEDParse.h" + +#ifdef _WIN64 +#pragma comment(lib, "pluginsdk/x64dbg.lib") +#pragma comment(lib, "pluginsdk/x64bridge.lib") +#pragma comment(lib, "pluginsdk/DeviceNameResolver/DeviceNameResolver_x64.lib") +#pragma comment(lib, "pluginsdk/jansson/jansson_x64.lib") +#pragma comment(lib, "pluginsdk/lz4/lz4_x64.lib") +#pragma comment(lib, "pluginsdk/TitanEngine/TitanEngine_x64.lib") +#pragma comment(lib, "pluginsdk/XEDParse/XEDParse_x64.lib") +#else +#pragma comment(lib, "pluginsdk/x32dbg.lib") +#pragma comment(lib, "pluginsdk/x32bridge.lib") +#pragma comment(lib, "pluginsdk/DeviceNameResolver/DeviceNameResolver_x86.lib") +#pragma comment(lib, "pluginsdk/jansson/jansson_x86.lib") +#pragma comment(lib, "pluginsdk/lz4/lz4_x86.lib") +#pragma comment(lib, "pluginsdk/TitanEngine/TitanEngine_x86.lib") +#pragma comment(lib, "pluginsdk/XEDParse/XEDParse_x86.lib") +#endif //_WIN64 + +#define Cmd(x) DbgCmdExecDirect(x) +#define Eval(x) DbgValFromString(x) +#define dprintf(x, ...) _plugin_logprintf("[" PLUGIN_NAME "] " x, __VA_ARGS__) +#define dputs(x) _plugin_logprintf("[" PLUGIN_NAME "] %s\n", x) +#define PLUG_EXPORT extern "C" __declspec(dllexport) + +//superglobal variables +extern int pluginHandle; +extern HWND hwndDlg; +extern int hMenu; +extern int hMenuDisasm; +extern int hMenuDump; +extern int hMenuStack; +``` \ No newline at end of file diff --git a/archive/legendabrn/AutoAttach.txt b/archive/legendabrn/AutoAttach.txt new file mode 100644 index 00000000..c6c45022 --- /dev/null +++ b/archive/legendabrn/AutoAttach.txt @@ -0,0 +1,10863 @@ +Project Path: arc_legendabrn_AutoAttach_f0ow_29h + +Source Tree: + +```txt +arc_legendabrn_AutoAttach_f0ow_29h +├── AutoAttach +│ ├── AutoAttach.vcxproj +│ ├── AutoAttach.vcxproj.filters +│ ├── pluginmain.cpp +│ ├── pluginmain.h +│ ├── pluginsdk +│ │ ├── DeviceNameResolver +│ │ │ ├── DeviceNameResolver.h +│ │ │ ├── DeviceNameResolver_x64.a +│ │ │ ├── DeviceNameResolver_x64.lib +│ │ │ ├── DeviceNameResolver_x86.a +│ │ │ └── DeviceNameResolver_x86.lib +│ │ ├── TitanEngine +│ │ │ ├── TitanEngine.h +│ │ │ ├── TitanEngine_x64.a +│ │ │ ├── TitanEngine_x64.lib +│ │ │ ├── TitanEngine_x86.a +│ │ │ └── TitanEngine_x86.lib +│ │ ├── XEDParse +│ │ │ ├── XEDParse.h +│ │ │ ├── XEDParse_x64.a +│ │ │ ├── XEDParse_x64.lib +│ │ │ ├── XEDParse_x86.a +│ │ │ └── XEDParse_x86.lib +│ │ ├── _dbgfunctions.h +│ │ ├── _plugin_types.h +│ │ ├── _plugins.h +│ │ ├── _scriptapi.h +│ │ ├── _scriptapi_argument.h +│ │ ├── _scriptapi_assembler.h +│ │ ├── _scriptapi_bookmark.h +│ │ ├── _scriptapi_comment.h +│ │ ├── _scriptapi_debug.h +│ │ ├── _scriptapi_flag.h +│ │ ├── _scriptapi_function.h +│ │ ├── _scriptapi_gui.h +│ │ ├── _scriptapi_label.h +│ │ ├── _scriptapi_memory.h +│ │ ├── _scriptapi_misc.h +│ │ ├── _scriptapi_module.h +│ │ ├── _scriptapi_pattern.h +│ │ ├── _scriptapi_register.h +│ │ ├── _scriptapi_stack.h +│ │ ├── _scriptapi_symbol.h +│ │ ├── bridgegraph.h +│ │ ├── bridgelist.h +│ │ ├── bridgemain.h +│ │ ├── dbghelp +│ │ │ ├── dbghelp.h +│ │ │ ├── dbghelp_x64.a +│ │ │ ├── dbghelp_x64.lib +│ │ │ ├── dbghelp_x86.a +│ │ │ └── dbghelp_x86.lib +│ │ ├── jansson +│ │ │ ├── jansson.h +│ │ │ ├── jansson_config.h +│ │ │ ├── jansson_x64.a +│ │ │ ├── jansson_x64.lib +│ │ │ ├── jansson_x64dbg.h +│ │ │ ├── jansson_x86.a +│ │ │ └── jansson_x86.lib +│ │ ├── lz4 +│ │ │ ├── lz4.h +│ │ │ ├── lz4_x64.a +│ │ │ ├── lz4_x64.lib +│ │ │ ├── lz4_x86.a +│ │ │ ├── lz4_x86.lib +│ │ │ ├── lz4file.h +│ │ │ └── lz4hc.h +│ │ ├── x32bridge.lib +│ │ ├── x32dbg.lib +│ │ ├── x64bridge.lib +│ │ └── x64dbg.lib +│ └── trash.hpp +├── AutoAttach.sln +└── README.md + +``` + +`AutoAttach.sln`: + +```sln + +Microsoft Visual Studio Solution File, Format Version 12.00 +# Visual Studio 15 +VisualStudioVersion = 15.0.25920.0 +MinimumVisualStudioVersion = 10.0.40219.1 +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "AutoAttach", "AutoAttach\AutoAttach.vcxproj", "{176822C9-3CF8-41A9-81AB-8BBD3E3E2A32}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|x64 = Debug|x64 + Debug|x86 = Debug|x86 + Release|x64 = Release|x64 + Release|x86 = Release|x86 + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {176822C9-3CF8-41A9-81AB-8BBD3E3E2A32}.Debug|x64.ActiveCfg = Debug|x64 + {176822C9-3CF8-41A9-81AB-8BBD3E3E2A32}.Debug|x64.Build.0 = Debug|x64 + {176822C9-3CF8-41A9-81AB-8BBD3E3E2A32}.Debug|x86.ActiveCfg = Debug|Win32 + {176822C9-3CF8-41A9-81AB-8BBD3E3E2A32}.Debug|x86.Build.0 = Debug|Win32 + {176822C9-3CF8-41A9-81AB-8BBD3E3E2A32}.Release|x64.ActiveCfg = Release|x64 + {176822C9-3CF8-41A9-81AB-8BBD3E3E2A32}.Release|x64.Build.0 = Release|x64 + {176822C9-3CF8-41A9-81AB-8BBD3E3E2A32}.Release|x86.ActiveCfg = Release|Win32 + {176822C9-3CF8-41A9-81AB-8BBD3E3E2A32}.Release|x86.Build.0 = Release|Win32 + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection +EndGlobal + +``` + +`AutoAttach/AutoAttach.vcxproj`: + +```vcxproj + + + + + Debug + Win32 + + + Debug + x64 + + + Release + Win32 + + + Release + x64 + + + + {176822C9-3CF8-41A9-81AB-8BBD3E3E2A32} + AutoAttach + AutoAttach + 10.0 + + + + DynamicLibrary + false + v143 + true + MultiByte + + + DynamicLibrary + false + v120_xp + true + MultiByte + + + DynamicLibrary + false + v143 + true + MultiByte + + + DynamicLibrary + false + v120_xp + true + MultiByte + + + + + + + + + + + + + + + + + + + .dp32 + $(SolutionDir)bin\x32\ + + + .dp32 + $(SolutionDir)bin\x32d\ + + + .dp64 + $(SolutionDir)bin\x64\ + + + .dp64 + $(SolutionDir)bin\x64d\ + + + + Level3 + MaxSpeed + true + true + true + MultiThreaded + stdcpp20 + stdc17 + + + true + true + true + Windows + + + + + Level3 + Disabled + true + true + true + MultiThreadedDebugDLL + Disabled + false + EnableFastChecks + + + true + true + true + Windows + Default + + + + + Level3 + MaxSpeed + true + true + true + MultiThreaded + stdcpp20 + stdc17 + + + true + true + true + Windows + + + + + Level3 + Disabled + true + true + true + MultiThreadedDebugDLL + Disabled + false + EnableFastChecks + + + true + true + true + Windows + Default + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +``` + +`AutoAttach/AutoAttach.vcxproj.filters`: + +```filters + + + + + {edf3ef06-03c9-4142-9838-96275f3e9997} + + + + + pluginsdk + + + pluginsdk + + + pluginsdk + + + pluginsdk + + + pluginsdk + + + pluginsdk + + + pluginsdk + + + pluginsdk + + + pluginsdk + + + pluginsdk + + + pluginsdk + + + pluginsdk + + + pluginsdk + + + pluginsdk + + + pluginsdk + + + pluginsdk + + + pluginsdk + + + pluginsdk + + + pluginsdk + + + pluginsdk + + + pluginsdk + + + pluginsdk + + + pluginsdk + + + pluginsdk + + + pluginsdk + + + pluginsdk + + + pluginsdk + + + pluginsdk + + + pluginsdk + + + pluginsdk + + + pluginsdk + + + pluginsdk + + + pluginsdk + + + + + + + pluginsdk + + + pluginsdk + + + pluginsdk + + + pluginsdk + + + + + + +``` + +`AutoAttach/pluginmain.cpp`: + +```cpp +#include "pluginmain.h" +#include "trash.hpp" + +PLUG_EXPORT bool pluginit(PLUG_INITSTRUCT* initStruct) +{ + initStruct->pluginVersion = PLUGIN_VERSION; + initStruct->sdkVersion = PLUG_SDKVERSION; + + strncpy_s(initStruct->pluginName, PLUGIN_NAME, _TRUNCATE); + + _plugin_registercommand(initStruct->pluginHandle, "AutoAttachStatus", cmd::status_command, false); + _plugin_registercommand(initStruct->pluginHandle, "AutoAttachProcess", cmd::set_command, false); + _plugin_registercommand(initStruct->pluginHandle, "AutoAttachSleep", cmd::sleep_command, false); + + std::thread([]() { + while (true) { + std::this_thread::sleep_for(std::chrono::milliseconds(100)); + if (!config::status || config::process.empty()) continue; + + WTS_PROCESS_INFO* process_info; + DWORD count_process; + + if (!WTSEnumerateProcesses(WTS_CURRENT_SERVER_HANDLE, 0, 1, &process_info, &count_process)) return; + + for (DWORD i = 0; i < count_process; ++i) { + if (!config::process.compare(process_info[i].pProcessName)) { + std::this_thread::sleep_for(std::chrono::milliseconds(config::sleep)); + PROCESS_INFORMATION* get_process_attach = TitanGetProcessInformation(); + if (get_process_attach->dwProcessId != process_info[i].ProcessId) { + std::string command = std::format("AttachDebugger {:x}", process_info[i].ProcessId); + DbgCmdExecDirect(command.data()); + } + break; + } + } + + WTSFreeMemory(process_info); + } + }).detach(); + return true; +} + +BOOL WINAPI DllMain(_In_ HINSTANCE hinstDLL, _In_ DWORD fdwReason, _In_ LPVOID lpvReserved) { + return TRUE; +} + +``` + +`AutoAttach/pluginmain.h`: + +```h +#pragma once + +#include +#include +#include +#include +#include + +#pragma comment(lib, "Wtsapi32.lib") + +#include "pluginsdk/bridgemain.h" +#include "pluginsdk/_plugins.h" + +#include "pluginsdk/_scriptapi_argument.h" +#include "pluginsdk/_scriptapi_assembler.h" +#include "pluginsdk/_scriptapi_bookmark.h" +#include "pluginsdk/_scriptapi_comment.h" +#include "pluginsdk/_scriptapi_debug.h" +#include "pluginsdk/_scriptapi_flag.h" +#include "pluginsdk/_scriptapi_function.h" +#include "pluginsdk/_scriptapi_gui.h" +#include "pluginsdk/_scriptapi_label.h" +#include "pluginsdk/_scriptapi_memory.h" +#include "pluginsdk/_scriptapi_misc.h" +#include "pluginsdk/_scriptapi_module.h" +#include "pluginsdk/_scriptapi_pattern.h" +#include "pluginsdk/_scriptapi_register.h" +#include "pluginsdk/_scriptapi_stack.h" +#include "pluginsdk/_scriptapi_symbol.h" + +#include "pluginsdk/DeviceNameResolver/DeviceNameResolver.h" +#include "pluginsdk/jansson/jansson.h" +#include "pluginsdk/lz4/lz4file.h" +#include "pluginsdk/TitanEngine/TitanEngine.h" +#include "pluginsdk/XEDParse/XEDParse.h" + +#ifdef _WIN64 +#pragma comment(lib, "pluginsdk/x64dbg.lib") +#pragma comment(lib, "pluginsdk/x64bridge.lib") +#pragma comment(lib, "pluginsdk/DeviceNameResolver/DeviceNameResolver_x64.lib") +#pragma comment(lib, "pluginsdk/jansson/jansson_x64.lib") +#pragma comment(lib, "pluginsdk/lz4/lz4_x64.lib") +#pragma comment(lib, "pluginsdk/TitanEngine/TitanEngine_x64.lib") +#pragma comment(lib, "pluginsdk/XEDParse/XEDParse_x64.lib") +#else +#pragma comment(lib, "pluginsdk/x32dbg.lib") +#pragma comment(lib, "pluginsdk/x32bridge.lib") +#pragma comment(lib, "pluginsdk/DeviceNameResolver/DeviceNameResolver_x86.lib") +#pragma comment(lib, "pluginsdk/jansson/jansson_x86.lib") +#pragma comment(lib, "pluginsdk/lz4/lz4_x86.lib") +#pragma comment(lib, "pluginsdk/TitanEngine/TitanEngine_x86.lib") +#pragma comment(lib, "pluginsdk/XEDParse/XEDParse_x86.lib") +#endif //_WIN64 + + +#define PLUGIN_NAME "AutoAttach" +#define PLUGIN_VERSION 1 + +#define Cmd(x) DbgCmdExecDirect(x) +#define PLUG_EXPORT extern "C" __declspec(dllexport) +``` + +`AutoAttach/pluginsdk/DeviceNameResolver/DeviceNameResolver.h`: + +```h +#ifndef _DEVICENAMERESOLVER_H +#define _DEVICENAMERESOLVER_H + +#include + +#ifdef __cplusplus +extern "C" +{ +#endif + +__declspec(dllexport) bool DevicePathToPathW(const wchar_t* szDevicePath, wchar_t* szPath, size_t nSizeInChars); +__declspec(dllexport) bool DevicePathToPathA(const char* szDevicePath, char* szPath, size_t nSizeInChars); +__declspec(dllexport) bool DevicePathFromFileHandleW(HANDLE hFile, wchar_t* szDevicePath, size_t nSizeInChars); +__declspec(dllexport) bool DevicePathFromFileHandleA(HANDLE hFile, char* szDevicePath, size_t nSizeInChars); +__declspec(dllexport) bool PathFromFileHandleW(HANDLE hFile, wchar_t* szPath, size_t nSizeInChars); +__declspec(dllexport) bool PathFromFileHandleA(HANDLE hFile, char* szPath, size_t nSizeInChars); + +#ifdef __cplusplus +} +#endif + +#endif // _DEVICENAMERESOLVER_H + +``` + +`AutoAttach/pluginsdk/TitanEngine/TitanEngine.h`: + +```h +#ifndef TITANENGINE +#define TITANENGINE + +#define TITCALL + +#if _MSC_VER > 1000 +#pragma once +#endif + +#include +#include + +#pragma pack(push, 1) + +// Global.Constant.Structure.Declaration: +// Engine.External: +#define UE_STRUCT_PE32STRUCT 1 +#define UE_STRUCT_PE64STRUCT 2 +#define UE_STRUCT_PESTRUCT 3 +#define UE_STRUCT_IMPORTENUMDATA 4 +#define UE_STRUCT_THREAD_ITEM_DATA 5 +#define UE_STRUCT_LIBRARY_ITEM_DATA 6 +#define UE_STRUCT_LIBRARY_ITEM_DATAW 7 +#define UE_STRUCT_PROCESS_ITEM_DATA 8 +#define UE_STRUCT_HANDLERARRAY 9 +#define UE_STRUCT_PLUGININFORMATION 10 +#define UE_STRUCT_HOOK_ENTRY 11 +#define UE_STRUCT_FILE_STATUS_INFO 12 +#define UE_STRUCT_FILE_FIX_INFO 13 +#define UE_STRUCT_X87FPUREGISTER 14 +#define UE_STRUCT_X87FPU 15 +#define UE_STRUCT_TITAN_ENGINE_CONTEXT 16 + +#define UE_ACCESS_READ 0 +#define UE_ACCESS_WRITE 1 +#define UE_ACCESS_ALL 2 + +#define UE_HIDE_PEBONLY 0 +#define UE_HIDE_BASIC 1 + +#define UE_PLUGIN_CALL_REASON_PREDEBUG 1 +#define UE_PLUGIN_CALL_REASON_EXCEPTION 2 +#define UE_PLUGIN_CALL_REASON_POSTDEBUG 3 +#define UE_PLUGIN_CALL_REASON_UNHANDLEDEXCEPTION 4 + +#define TEE_HOOK_NRM_JUMP 1 +#define TEE_HOOK_NRM_CALL 3 +#define TEE_HOOK_IAT 5 + +#define UE_ENGINE_ALOW_MODULE_LOADING 1 +#define UE_ENGINE_AUTOFIX_FORWARDERS 2 +#define UE_ENGINE_PASS_ALL_EXCEPTIONS 3 +#define UE_ENGINE_NO_CONSOLE_WINDOW 4 +#define UE_ENGINE_BACKUP_FOR_CRITICAL_FUNCTIONS 5 +#define UE_ENGINE_CALL_PLUGIN_CALLBACK 6 +#define UE_ENGINE_RESET_CUSTOM_HANDLER 7 +#define UE_ENGINE_CALL_PLUGIN_DEBUG_CALLBACK 8 +#define UE_ENGINE_SET_DEBUG_PRIVILEGE 9 +#define UE_ENGINE_SAFE_ATTACH 10 +#define UE_ENGINE_MEMBP_ALT 11 + +#define UE_OPTION_REMOVEALL 1 +#define UE_OPTION_DISABLEALL 2 +#define UE_OPTION_REMOVEALLDISABLED 3 +#define UE_OPTION_REMOVEALLENABLED 4 + +#define UE_STATIC_DECRYPTOR_XOR 1 +#define UE_STATIC_DECRYPTOR_SUB 2 +#define UE_STATIC_DECRYPTOR_ADD 3 + +#define UE_STATIC_DECRYPTOR_FOREWARD 1 +#define UE_STATIC_DECRYPTOR_BACKWARD 2 + +#define UE_STATIC_KEY_SIZE_1 1 +#define UE_STATIC_KEY_SIZE_2 2 +#define UE_STATIC_KEY_SIZE_4 4 +#define UE_STATIC_KEY_SIZE_8 8 + +#define UE_STATIC_APLIB 1 +#define UE_STATIC_APLIB_DEPACK 2 +#define UE_STATIC_LZMA 3 + +#define UE_STATIC_HASH_MD5 1 +#define UE_STATIC_HASH_SHA1 2 +#define UE_STATIC_HASH_CRC32 3 + +#define UE_RESOURCE_LANGUAGE_ANY -1 + +#define UE_PE_OFFSET 0 +#define UE_IMAGEBASE 1 +#define UE_OEP 2 +#define UE_SIZEOFIMAGE 3 +#define UE_SIZEOFHEADERS 4 +#define UE_SIZEOFOPTIONALHEADER 5 +#define UE_SECTIONALIGNMENT 6 +#define UE_IMPORTTABLEADDRESS 7 +#define UE_IMPORTTABLESIZE 8 +#define UE_RESOURCETABLEADDRESS 9 +#define UE_RESOURCETABLESIZE 10 +#define UE_EXPORTTABLEADDRESS 11 +#define UE_EXPORTTABLESIZE 12 +#define UE_TLSTABLEADDRESS 13 +#define UE_TLSTABLESIZE 14 +#define UE_RELOCATIONTABLEADDRESS 15 +#define UE_RELOCATIONTABLESIZE 16 +#define UE_TIMEDATESTAMP 17 +#define UE_SECTIONNUMBER 18 +#define UE_CHECKSUM 19 +#define UE_SUBSYSTEM 20 +#define UE_CHARACTERISTICS 21 +#define UE_NUMBEROFRVAANDSIZES 22 +#define UE_BASEOFCODE 23 +#define UE_BASEOFDATA 24 +#define UE_DLLCHARACTERISTICS 25 +//leaving some enum space here for future additions +#define UE_SECTIONNAME 40 +#define UE_SECTIONVIRTUALOFFSET 41 +#define UE_SECTIONVIRTUALSIZE 42 +#define UE_SECTIONRAWOFFSET 43 +#define UE_SECTIONRAWSIZE 44 +#define UE_SECTIONFLAGS 45 + +#define UE_VANOTFOUND = -2; + +#define UE_CH_BREAKPOINT 1 +#define UE_CH_SINGLESTEP 2 +#define UE_CH_ACCESSVIOLATION 3 +#define UE_CH_ILLEGALINSTRUCTION 4 +#define UE_CH_NONCONTINUABLEEXCEPTION 5 +#define UE_CH_ARRAYBOUNDSEXCEPTION 6 +#define UE_CH_FLOATDENORMALOPERAND 7 +#define UE_CH_FLOATDEVIDEBYZERO 8 +#define UE_CH_INTEGERDEVIDEBYZERO 9 +#define UE_CH_INTEGEROVERFLOW 10 +#define UE_CH_PRIVILEGEDINSTRUCTION 11 +#define UE_CH_PAGEGUARD 12 +#define UE_CH_EVERYTHINGELSE 13 +#define UE_CH_CREATETHREAD 14 +#define UE_CH_EXITTHREAD 15 +#define UE_CH_CREATEPROCESS 16 +#define UE_CH_EXITPROCESS 17 +#define UE_CH_LOADDLL 18 +#define UE_CH_UNLOADDLL 19 +#define UE_CH_OUTPUTDEBUGSTRING 20 +#define UE_CH_AFTEREXCEPTIONPROCESSING 21 +#define UE_CH_SYSTEMBREAKPOINT 23 +#define UE_CH_UNHANDLEDEXCEPTION 24 +#define UE_CH_RIPEVENT 25 +#define UE_CH_DEBUGEVENT 26 + +#define UE_OPTION_HANDLER_RETURN_HANDLECOUNT 1 +#define UE_OPTION_HANDLER_RETURN_ACCESS 2 +#define UE_OPTION_HANDLER_RETURN_FLAGS 3 +#define UE_OPTION_HANDLER_RETURN_TYPENAME 4 + +#define UE_BREAKPOINT_INT3 1 +#define UE_BREAKPOINT_LONG_INT3 2 +#define UE_BREAKPOINT_UD2 3 + +#define UE_BPXREMOVED 0 +#define UE_BPXACTIVE 1 +#define UE_BPXINACTIVE 2 + +#define UE_BREAKPOINT 0 +#define UE_SINGLESHOOT 1 +#define UE_HARDWARE 2 +#define UE_MEMORY 3 +#define UE_MEMORY_READ 4 +#define UE_MEMORY_WRITE 5 +#define UE_MEMORY_EXECUTE 6 +#define UE_BREAKPOINT_TYPE_INT3 0x10000000 +#define UE_BREAKPOINT_TYPE_LONG_INT3 0x20000000 +#define UE_BREAKPOINT_TYPE_UD2 0x30000000 + +#define UE_HARDWARE_EXECUTE 4 +#define UE_HARDWARE_WRITE 5 +#define UE_HARDWARE_READWRITE 6 + +#define UE_HARDWARE_SIZE_1 7 +#define UE_HARDWARE_SIZE_2 8 +#define UE_HARDWARE_SIZE_4 9 +#define UE_HARDWARE_SIZE_8 10 + +#define UE_ON_LIB_LOAD 1 +#define UE_ON_LIB_UNLOAD 2 +#define UE_ON_LIB_ALL 3 + +#define UE_APISTART 0 +#define UE_APIEND 1 + +#define UE_PLATFORM_x86 1 +#define UE_PLATFORM_x64 2 +#define UE_PLATFORM_ALL 3 + +#define UE_FUNCTION_STDCALL 1 +#define UE_FUNCTION_CCALL 2 +#define UE_FUNCTION_FASTCALL 3 +#define UE_FUNCTION_STDCALL_RET 4 +#define UE_FUNCTION_CCALL_RET 5 +#define UE_FUNCTION_FASTCALL_RET 6 +#define UE_FUNCTION_STDCALL_CALL 7 +#define UE_FUNCTION_CCALL_CALL 8 +#define UE_FUNCTION_FASTCALL_CALL 9 +#define UE_PARAMETER_BYTE 0 +#define UE_PARAMETER_WORD 1 +#define UE_PARAMETER_DWORD 2 +#define UE_PARAMETER_QWORD 3 +#define UE_PARAMETER_PTR_BYTE 4 +#define UE_PARAMETER_PTR_WORD 5 +#define UE_PARAMETER_PTR_DWORD 6 +#define UE_PARAMETER_PTR_QWORD 7 +#define UE_PARAMETER_STRING 8 +#define UE_PARAMETER_UNICODE 9 + +#define UE_EAX 1 +#define UE_EBX 2 +#define UE_ECX 3 +#define UE_EDX 4 +#define UE_EDI 5 +#define UE_ESI 6 +#define UE_EBP 7 +#define UE_ESP 8 +#define UE_EIP 9 +#define UE_EFLAGS 10 +#define UE_DR0 11 +#define UE_DR1 12 +#define UE_DR2 13 +#define UE_DR3 14 +#define UE_DR6 15 +#define UE_DR7 16 +#define UE_RAX 17 +#define UE_RBX 18 +#define UE_RCX 19 +#define UE_RDX 20 +#define UE_RDI 21 +#define UE_RSI 22 +#define UE_RBP 23 +#define UE_RSP 24 +#define UE_RIP 25 +#define UE_RFLAGS 26 +#define UE_R8 27 +#define UE_R9 28 +#define UE_R10 29 +#define UE_R11 30 +#define UE_R12 31 +#define UE_R13 32 +#define UE_R14 33 +#define UE_R15 34 +#define UE_CIP 35 +#define UE_CSP 36 +#ifdef _WIN64 +#define UE_CFLAGS UE_RFLAGS +#else +#define UE_CFLAGS UE_EFLAGS +#endif +#define UE_SEG_GS 37 +#define UE_SEG_FS 38 +#define UE_SEG_ES 39 +#define UE_SEG_DS 40 +#define UE_SEG_CS 41 +#define UE_SEG_SS 42 +#define UE_x87_r0 43 +#define UE_x87_r1 44 +#define UE_x87_r2 45 +#define UE_x87_r3 46 +#define UE_x87_r4 47 +#define UE_x87_r5 48 +#define UE_x87_r6 49 +#define UE_x87_r7 50 +#define UE_X87_STATUSWORD 51 +#define UE_X87_CONTROLWORD 52 +#define UE_X87_TAGWORD 53 +#define UE_MXCSR 54 +#define UE_MMX0 55 +#define UE_MMX1 56 +#define UE_MMX2 57 +#define UE_MMX3 58 +#define UE_MMX4 59 +#define UE_MMX5 60 +#define UE_MMX6 61 +#define UE_MMX7 62 +#define UE_XMM0 63 +#define UE_XMM1 64 +#define UE_XMM2 65 +#define UE_XMM3 66 +#define UE_XMM4 67 +#define UE_XMM5 68 +#define UE_XMM6 69 +#define UE_XMM7 70 +#define UE_XMM8 71 +#define UE_XMM9 72 +#define UE_XMM10 73 +#define UE_XMM11 74 +#define UE_XMM12 75 +#define UE_XMM13 76 +#define UE_XMM14 77 +#define UE_XMM15 78 +#define UE_x87_ST0 79 +#define UE_x87_ST1 80 +#define UE_x87_ST2 81 +#define UE_x87_ST3 82 +#define UE_x87_ST4 83 +#define UE_x87_ST5 84 +#define UE_x87_ST6 85 +#define UE_x87_ST7 86 +#define UE_YMM0 87 +#define UE_YMM1 88 +#define UE_YMM2 89 +#define UE_YMM3 90 +#define UE_YMM4 91 +#define UE_YMM5 92 +#define UE_YMM6 93 +#define UE_YMM7 94 +#define UE_YMM8 95 +#define UE_YMM9 96 +#define UE_YMM10 97 +#define UE_YMM11 98 +#define UE_YMM12 99 +#define UE_YMM13 100 +#define UE_YMM14 101 +#define UE_YMM15 102 + +#ifndef CONTEXT_EXTENDED_REGISTERS +#define CONTEXT_EXTENDED_REGISTERS 0 +#endif + +typedef struct +{ + DWORD PE32Offset; + DWORD ImageBase; + DWORD OriginalEntryPoint; + DWORD BaseOfCode; + DWORD BaseOfData; + DWORD NtSizeOfImage; + DWORD NtSizeOfHeaders; + WORD SizeOfOptionalHeaders; + DWORD FileAlignment; + DWORD SectionAligment; + DWORD ImportTableAddress; + DWORD ImportTableSize; + DWORD ResourceTableAddress; + DWORD ResourceTableSize; + DWORD ExportTableAddress; + DWORD ExportTableSize; + DWORD TLSTableAddress; + DWORD TLSTableSize; + DWORD RelocationTableAddress; + DWORD RelocationTableSize; + DWORD TimeDateStamp; + WORD SectionNumber; + DWORD CheckSum; + WORD SubSystem; + WORD Characteristics; + DWORD NumberOfRvaAndSizes; +} PE32Struct, *PPE32Struct; + +typedef struct +{ + DWORD PE64Offset; + DWORD64 ImageBase; + DWORD OriginalEntryPoint; + DWORD BaseOfCode; + DWORD BaseOfData; + DWORD NtSizeOfImage; + DWORD NtSizeOfHeaders; + WORD SizeOfOptionalHeaders; + DWORD FileAlignment; + DWORD SectionAligment; + DWORD ImportTableAddress; + DWORD ImportTableSize; + DWORD ResourceTableAddress; + DWORD ResourceTableSize; + DWORD ExportTableAddress; + DWORD ExportTableSize; + DWORD TLSTableAddress; + DWORD TLSTableSize; + DWORD RelocationTableAddress; + DWORD RelocationTableSize; + DWORD TimeDateStamp; + WORD SectionNumber; + DWORD CheckSum; + WORD SubSystem; + WORD Characteristics; + DWORD NumberOfRvaAndSizes; +} PE64Struct, *PPE64Struct; + +#if defined(_WIN64) +typedef PE64Struct PEStruct; +#else +typedef PE32Struct PEStruct; +#endif + +typedef struct +{ + bool NewDll; + int NumberOfImports; + ULONG_PTR ImageBase; + ULONG_PTR BaseImportThunk; + ULONG_PTR ImportThunk; + char* APIName; + char* DLLName; +} ImportEnumData, *PImportEnumData; + +typedef struct +{ + HANDLE hThread; + DWORD dwThreadId; + void* ThreadStartAddress; + void* ThreadLocalBase; + void* TebAddress; + ULONG WaitTime; + LONG Priority; + LONG BasePriority; + ULONG ContextSwitches; + ULONG ThreadState; + ULONG WaitReason; +} THREAD_ITEM_DATA, *PTHREAD_ITEM_DATA; + +typedef struct +{ + HANDLE hFile; + void* BaseOfDll; + HANDLE hFileMapping; + void* hFileMappingView; + char szLibraryPath[MAX_PATH]; + char szLibraryName[MAX_PATH]; +} LIBRARY_ITEM_DATA, *PLIBRARY_ITEM_DATA; + +typedef struct +{ + HANDLE hFile; + void* BaseOfDll; + HANDLE hFileMapping; + void* hFileMappingView; + wchar_t szLibraryPath[MAX_PATH]; + wchar_t szLibraryName[MAX_PATH]; +} LIBRARY_ITEM_DATAW, *PLIBRARY_ITEM_DATAW; + +typedef struct +{ + HANDLE hProcess; + DWORD dwProcessId; + HANDLE hThread; + DWORD dwThreadId; + HANDLE hFile; + void* BaseOfImage; + void* ThreadStartAddress; + void* ThreadLocalBase; +} PROCESS_ITEM_DATA, *PPROCESS_ITEM_DATA; + +typedef struct +{ + ULONG ProcessId; + HANDLE hHandle; +} HandlerArray, *PHandlerArray; + +typedef struct +{ + char PluginName[64]; + DWORD PluginMajorVersion; + DWORD PluginMinorVersion; + HMODULE PluginBaseAddress; + void* TitanDebuggingCallBack; + void* TitanRegisterPlugin; + void* TitanReleasePlugin; + void* TitanResetPlugin; + bool PluginDisabled; +} PluginInformation, *PPluginInformation; + +#define TEE_MAXIMUM_HOOK_SIZE 14 +#define TEE_MAXIMUM_HOOK_RELOCS 7 +#if defined(_WIN64) +#define TEE_MAXIMUM_HOOK_INSERT_SIZE 14 +#else +#define TEE_MAXIMUM_HOOK_INSERT_SIZE 5 +#endif + +typedef struct HOOK_ENTRY +{ + bool IATHook; + BYTE HookType; + DWORD HookSize; + void* HookAddress; + void* RedirectionAddress; + BYTE HookBytes[TEE_MAXIMUM_HOOK_SIZE]; + BYTE OriginalBytes[TEE_MAXIMUM_HOOK_SIZE]; + void* IATHookModuleBase; + DWORD IATHookNameHash; + bool HookIsEnabled; + bool HookIsRemote; + void* PatchedEntry; + DWORD RelocationInfo[TEE_MAXIMUM_HOOK_RELOCS]; + int RelocationCount; +} HOOK_ENTRY, *PHOOK_ENTRY; + +#define UE_DEPTH_SURFACE 0 +#define UE_DEPTH_DEEP 1 + +#define UE_UNPACKER_CONDITION_SEARCH_FROM_EP 1 + +#define UE_UNPACKER_CONDITION_LOADLIBRARY 1 +#define UE_UNPACKER_CONDITION_GETPROCADDRESS 2 +#define UE_UNPACKER_CONDITION_ENTRYPOINTBREAK 3 +#define UE_UNPACKER_CONDITION_RELOCSNAPSHOT1 4 +#define UE_UNPACKER_CONDITION_RELOCSNAPSHOT2 5 + +#define UE_FIELD_OK 0 +#define UE_FIELD_BROKEN_NON_FIXABLE 1 +#define UE_FIELD_BROKEN_NON_CRITICAL 2 +#define UE_FIELD_BROKEN_FIXABLE_FOR_STATIC_USE 3 +#define UE_FIELD_BROKEN_BUT_CAN_BE_EMULATED 4 +#define UE_FIELD_FIXABLE_NON_CRITICAL 5 +#define UE_FIELD_FIXABLE_CRITICAL 6 +#define UE_FIELD_NOT_PRESET 7 +#define UE_FIELD_NOT_PRESET_WARNING 8 + +#define UE_RESULT_FILE_OK 10 +#define UE_RESULT_FILE_INVALID_BUT_FIXABLE 11 +#define UE_RESULT_FILE_INVALID_AND_NON_FIXABLE 12 +#define UE_RESULT_FILE_INVALID_FORMAT 13 + +typedef struct +{ + BYTE OveralEvaluation; + bool EvaluationTerminatedByException; + bool FileIs64Bit; + bool FileIsDLL; + bool FileIsConsole; + bool MissingDependencies; + bool MissingDeclaredAPIs; + BYTE SignatureMZ; + BYTE SignaturePE; + BYTE EntryPoint; + BYTE ImageBase; + BYTE SizeOfImage; + BYTE FileAlignment; + BYTE SectionAlignment; + BYTE ExportTable; + BYTE RelocationTable; + BYTE ImportTable; + BYTE ImportTableSection; + BYTE ImportTableData; + BYTE IATTable; + BYTE TLSTable; + BYTE LoadConfigTable; + BYTE BoundImportTable; + BYTE COMHeaderTable; + BYTE ResourceTable; + BYTE ResourceData; + BYTE SectionTable; +} FILE_STATUS_INFO, *PFILE_STATUS_INFO; + +typedef struct +{ + BYTE OveralEvaluation; + bool FixingTerminatedByException; + bool FileFixPerformed; + bool StrippedRelocation; + bool DontFixRelocations; + DWORD OriginalRelocationTableAddress; + DWORD OriginalRelocationTableSize; + bool StrippedExports; + bool DontFixExports; + DWORD OriginalExportTableAddress; + DWORD OriginalExportTableSize; + bool StrippedResources; + bool DontFixResources; + DWORD OriginalResourceTableAddress; + DWORD OriginalResourceTableSize; + bool StrippedTLS; + bool DontFixTLS; + DWORD OriginalTLSTableAddress; + DWORD OriginalTLSTableSize; + bool StrippedLoadConfig; + bool DontFixLoadConfig; + DWORD OriginalLoadConfigTableAddress; + DWORD OriginalLoadConfigTableSize; + bool StrippedBoundImports; + bool DontFixBoundImports; + DWORD OriginalBoundImportTableAddress; + DWORD OriginalBoundImportTableSize; + bool StrippedIAT; + bool DontFixIAT; + DWORD OriginalImportAddressTableAddress; + DWORD OriginalImportAddressTableSize; + bool StrippedCOM; + bool DontFixCOM; + DWORD OriginalCOMTableAddress; + DWORD OriginalCOMTableSize; +} FILE_FIX_INFO, *PFILE_FIX_INFO; + +typedef struct DECLSPEC_ALIGN(16) _XmmRegister_t +{ + ULONGLONG Low; + LONGLONG High; +} XmmRegister_t; + +typedef struct +{ + XmmRegister_t Low; //XMM/SSE part + XmmRegister_t High; //AVX part +} YmmRegister_t; + +typedef struct +{ + BYTE data[10]; + int st_value; + int tag; +} x87FPURegister_t; + +typedef struct +{ + WORD ControlWord; + WORD StatusWord; + WORD TagWord; + DWORD ErrorOffset; + DWORD ErrorSelector; + DWORD DataOffset; + DWORD DataSelector; + DWORD Cr0NpxState; +} x87FPU_t; + +typedef struct +{ + ULONG_PTR cax; + ULONG_PTR ccx; + ULONG_PTR cdx; + ULONG_PTR cbx; + ULONG_PTR csp; + ULONG_PTR cbp; + ULONG_PTR csi; + ULONG_PTR cdi; +#ifdef _WIN64 + ULONG_PTR r8; + ULONG_PTR r9; + ULONG_PTR r10; + ULONG_PTR r11; + ULONG_PTR r12; + ULONG_PTR r13; + ULONG_PTR r14; + ULONG_PTR r15; +#endif //_WIN64 + ULONG_PTR cip; + ULONG_PTR eflags; + unsigned short gs; + unsigned short fs; + unsigned short es; + unsigned short ds; + unsigned short cs; + unsigned short ss; + ULONG_PTR dr0; + ULONG_PTR dr1; + ULONG_PTR dr2; + ULONG_PTR dr3; + ULONG_PTR dr6; + ULONG_PTR dr7; + BYTE RegisterArea[80]; + x87FPU_t x87fpu; + DWORD MxCsr; +#ifdef _WIN64 + XmmRegister_t XmmRegisters[16]; + YmmRegister_t YmmRegisters[16]; +#else // x86 + XmmRegister_t XmmRegisters[8]; + YmmRegister_t YmmRegisters[8]; +#endif +} TITAN_ENGINE_CONTEXT_t; + +#ifdef __cplusplus +extern "C" +{ +#endif + +// Global.Function.Declaration: +// TitanEngine.Dumper.functions: +__declspec(dllexport) bool TITCALL DumpProcess(HANDLE hProcess, LPVOID ImageBase, const char* szDumpFileName, ULONG_PTR EntryPoint); +__declspec(dllexport) bool TITCALL DumpProcessW(HANDLE hProcess, LPVOID ImageBase, const wchar_t* szDumpFileName, ULONG_PTR EntryPoint); +__declspec(dllexport) bool TITCALL DumpProcessEx(DWORD ProcessId, LPVOID ImageBase, const char* szDumpFileName, ULONG_PTR EntryPoint); +__declspec(dllexport) bool TITCALL DumpProcessExW(DWORD ProcessId, LPVOID ImageBase, const wchar_t* szDumpFileName, ULONG_PTR EntryPoint); +__declspec(dllexport) bool TITCALL DumpMemory(HANDLE hProcess, LPVOID MemoryStart, ULONG_PTR MemorySize, const char* szDumpFileName); +__declspec(dllexport) bool TITCALL DumpMemoryW(HANDLE hProcess, LPVOID MemoryStart, ULONG_PTR MemorySize, const wchar_t* szDumpFileName); +__declspec(dllexport) bool TITCALL DumpMemoryEx(DWORD ProcessId, LPVOID MemoryStart, ULONG_PTR MemorySize, const char* szDumpFileName); +__declspec(dllexport) bool TITCALL DumpMemoryExW(DWORD ProcessId, LPVOID MemoryStart, ULONG_PTR MemorySize, const wchar_t* szDumpFileName); +__declspec(dllexport) bool TITCALL DumpRegions(HANDLE hProcess, const char* szDumpFolder, bool DumpAboveImageBaseOnly); +__declspec(dllexport) bool TITCALL DumpRegionsW(HANDLE hProcess, const wchar_t* szDumpFolder, bool DumpAboveImageBaseOnly); +__declspec(dllexport) bool TITCALL DumpRegionsEx(DWORD ProcessId, const char* szDumpFolder, bool DumpAboveImageBaseOnly); +__declspec(dllexport) bool TITCALL DumpRegionsExW(DWORD ProcessId, const wchar_t* szDumpFolder, bool DumpAboveImageBaseOnly); +__declspec(dllexport) bool TITCALL DumpModule(HANDLE hProcess, LPVOID ModuleBase, const char* szDumpFileName); +__declspec(dllexport) bool TITCALL DumpModuleW(HANDLE hProcess, LPVOID ModuleBase, const wchar_t* szDumpFileName); +__declspec(dllexport) bool TITCALL DumpModuleEx(DWORD ProcessId, LPVOID ModuleBase, const char* szDumpFileName); +__declspec(dllexport) bool TITCALL DumpModuleExW(DWORD ProcessId, LPVOID ModuleBase, const wchar_t* szDumpFileName); +__declspec(dllexport) bool TITCALL PastePEHeader(HANDLE hProcess, LPVOID ImageBase, const char* szDebuggedFileName); +__declspec(dllexport) bool TITCALL PastePEHeaderW(HANDLE hProcess, LPVOID ImageBase, const wchar_t* szDebuggedFileName); +__declspec(dllexport) bool TITCALL ExtractSection(const char* szFileName, const char* szDumpFileName, DWORD SectionNumber); +__declspec(dllexport) bool TITCALL ExtractSectionW(const wchar_t* szFileName, const wchar_t* szDumpFileName, DWORD SectionNumber); +__declspec(dllexport) bool TITCALL ResortFileSections(const char* szFileName); +__declspec(dllexport) bool TITCALL ResortFileSectionsW(const wchar_t* szFileName); +__declspec(dllexport) bool TITCALL FindOverlay(const char* szFileName, LPDWORD OverlayStart, LPDWORD OverlaySize); +__declspec(dllexport) bool TITCALL FindOverlayW(const wchar_t* szFileName, LPDWORD OverlayStart, LPDWORD OverlaySize); +__declspec(dllexport) bool TITCALL ExtractOverlay(const char* szFileName, const char* szExtactedFileName); +__declspec(dllexport) bool TITCALL ExtractOverlayW(const wchar_t* szFileName, const wchar_t* szExtactedFileName); +__declspec(dllexport) bool TITCALL AddOverlay(const char* szFileName, const char* szOverlayFileName); +__declspec(dllexport) bool TITCALL AddOverlayW(const wchar_t* szFileName, const wchar_t* szOverlayFileName); +__declspec(dllexport) bool TITCALL CopyOverlay(const char* szInFileName, const char* szOutFileName); +__declspec(dllexport) bool TITCALL CopyOverlayW(const wchar_t* szInFileName, const wchar_t* szOutFileName); +__declspec(dllexport) bool TITCALL RemoveOverlay(const char* szFileName); +__declspec(dllexport) bool TITCALL RemoveOverlayW(const wchar_t* szFileName); +__declspec(dllexport) bool TITCALL MakeAllSectionsRWE(const char* szFileName); +__declspec(dllexport) bool TITCALL MakeAllSectionsRWEW(const wchar_t* szFileName); +__declspec(dllexport) long TITCALL AddNewSectionEx(const char* szFileName, const char* szSectionName, DWORD SectionSize, DWORD SectionAttributes, LPVOID SectionContent, DWORD ContentSize); +__declspec(dllexport) long TITCALL AddNewSectionExW(const wchar_t* szFileName, const char* szSectionName, DWORD SectionSize, DWORD SectionAttributes, LPVOID SectionContent, DWORD ContentSize); +__declspec(dllexport) long TITCALL AddNewSection(const char* szFileName, const char* szSectionName, DWORD SectionSize); +__declspec(dllexport) long TITCALL AddNewSectionW(const wchar_t* szFileName, const char* szSectionName, DWORD SectionSize); +__declspec(dllexport) bool TITCALL ResizeLastSection(const char* szFileName, DWORD NumberOfExpandBytes, bool AlignResizeData); +__declspec(dllexport) bool TITCALL ResizeLastSectionW(const wchar_t* szFileName, DWORD NumberOfExpandBytes, bool AlignResizeData); +__declspec(dllexport) void TITCALL SetSharedOverlay(const char* szFileName); +__declspec(dllexport) void TITCALL SetSharedOverlayW(const wchar_t* szFileName); +__declspec(dllexport) char* TITCALL GetSharedOverlay(); +__declspec(dllexport) wchar_t* TITCALL GetSharedOverlayW(); +__declspec(dllexport) bool TITCALL DeleteLastSection(const char* szFileName); +__declspec(dllexport) bool TITCALL DeleteLastSectionW(const wchar_t* szFileName); +__declspec(dllexport) bool TITCALL DeleteLastSectionEx(const char* szFileName, DWORD NumberOfSections); +__declspec(dllexport) bool TITCALL DeleteLastSectionExW(const wchar_t* szFileName, DWORD NumberOfSections); +__declspec(dllexport) ULONG_PTR TITCALL GetPE32DataFromMappedFile(ULONG_PTR FileMapVA, DWORD WhichSection, DWORD WhichData); +__declspec(dllexport) ULONG_PTR TITCALL GetPE32Data(const char* szFileName, DWORD WhichSection, DWORD WhichData); +__declspec(dllexport) ULONG_PTR TITCALL GetPE32DataW(const wchar_t* szFileName, DWORD WhichSection, DWORD WhichData); +__declspec(dllexport) bool TITCALL GetPE32DataFromMappedFileEx(ULONG_PTR FileMapVA, LPVOID DataStorage); +__declspec(dllexport) bool TITCALL GetPE32DataEx(const char* szFileName, LPVOID DataStorage); +__declspec(dllexport) bool TITCALL GetPE32DataExW(const wchar_t* szFileName, LPVOID DataStorage); +__declspec(dllexport) bool TITCALL SetPE32DataForMappedFile(ULONG_PTR FileMapVA, DWORD WhichSection, DWORD WhichData, ULONG_PTR NewDataValue); +__declspec(dllexport) bool TITCALL SetPE32Data(const char* szFileName, DWORD WhichSection, DWORD WhichData, ULONG_PTR NewDataValue); +__declspec(dllexport) bool TITCALL SetPE32DataW(const wchar_t* szFileName, DWORD WhichSection, DWORD WhichData, ULONG_PTR NewDataValue); +__declspec(dllexport) bool TITCALL SetPE32DataForMappedFileEx(ULONG_PTR FileMapVA, LPVOID DataStorage); +__declspec(dllexport) bool TITCALL SetPE32DataEx(const char* szFileName, LPVOID DataStorage); +__declspec(dllexport) bool TITCALL SetPE32DataExW(const wchar_t* szFileName, LPVOID DataStorage); +__declspec(dllexport) long TITCALL GetPE32SectionNumberFromVA(ULONG_PTR FileMapVA, ULONG_PTR AddressToConvert); +__declspec(dllexport) ULONG_PTR TITCALL ConvertVAtoFileOffset(ULONG_PTR FileMapVA, ULONG_PTR AddressToConvert, bool ReturnType); +__declspec(dllexport) ULONG_PTR TITCALL ConvertVAtoFileOffsetEx(ULONG_PTR FileMapVA, DWORD FileSize, ULONG_PTR ImageBase, ULONG_PTR AddressToConvert, bool AddressIsRVA, bool ReturnType); +__declspec(dllexport) ULONG_PTR TITCALL ConvertFileOffsetToVA(ULONG_PTR FileMapVA, ULONG_PTR AddressToConvert, bool ReturnType); +__declspec(dllexport) ULONG_PTR TITCALL ConvertFileOffsetToVAEx(ULONG_PTR FileMapVA, DWORD FileSize, ULONG_PTR ImageBase, ULONG_PTR AddressToConvert, bool ReturnType); +__declspec(dllexport) bool TITCALL MemoryReadSafe(HANDLE hProcess, LPVOID lpBaseAddress, LPVOID lpBuffer, SIZE_T nSize, SIZE_T* lpNumberOfBytesRead); +__declspec(dllexport) bool TITCALL MemoryWriteSafe(HANDLE hProcess, LPVOID lpBaseAddress, LPCVOID lpBuffer, SIZE_T nSize, SIZE_T* lpNumberOfBytesWritten); +// TitanEngine.Realigner.functions: +__declspec(dllexport) bool TITCALL FixHeaderCheckSum(const char* szFileName); +__declspec(dllexport) bool TITCALL FixHeaderCheckSumW(const wchar_t* szFileName); +__declspec(dllexport) long TITCALL RealignPE(ULONG_PTR FileMapVA, DWORD FileSize, DWORD RealingMode); +__declspec(dllexport) long TITCALL RealignPEEx(const char* szFileName, DWORD RealingFileSize, DWORD ForcedFileAlignment); +__declspec(dllexport) long TITCALL RealignPEExW(const wchar_t* szFileName, DWORD RealingFileSize, DWORD ForcedFileAlignment); +__declspec(dllexport) bool TITCALL WipeSection(const char* szFileName, int WipeSectionNumber, bool RemovePhysically); +__declspec(dllexport) bool TITCALL WipeSectionW(const wchar_t* szFileName, int WipeSectionNumber, bool RemovePhysically); +__declspec(dllexport) bool TITCALL IsPE32FileValidEx(const char* szFileName, DWORD CheckDepth, LPVOID FileStatusInfo); +__declspec(dllexport) bool TITCALL IsPE32FileValidExW(const wchar_t* szFileName, DWORD CheckDepth, LPVOID FileStatusInfo); +__declspec(dllexport) bool TITCALL FixBrokenPE32FileEx(const char* szFileName, LPVOID FileStatusInfo, LPVOID FileFixInfo); +__declspec(dllexport) bool TITCALL FixBrokenPE32FileExW(const wchar_t* szFileName, LPVOID FileStatusInfo, LPVOID FileFixInfo); +__declspec(dllexport) bool TITCALL IsFileDLL(const char* szFileName, ULONG_PTR FileMapVA); +__declspec(dllexport) bool TITCALL IsFileDLLW(const wchar_t* szFileName, ULONG_PTR FileMapVA); +// TitanEngine.Hider.functions: +__declspec(dllexport) void* TITCALL GetPEBLocation(HANDLE hProcess); +__declspec(dllexport) void* TITCALL GetPEBLocation64(HANDLE hProcess); +__declspec(dllexport) void* TITCALL GetTEBLocation(HANDLE hThread); +__declspec(dllexport) void* TITCALL GetTEBLocation64(HANDLE hThread); +__declspec(dllexport) bool TITCALL HideDebugger(HANDLE hProcess, DWORD PatchAPILevel); +__declspec(dllexport) bool TITCALL UnHideDebugger(HANDLE hProcess, DWORD PatchAPILevel); +// TitanEngine.Relocater.functions: +__declspec(dllexport) void TITCALL RelocaterCleanup(); +__declspec(dllexport) void TITCALL RelocaterInit(DWORD MemorySize, ULONG_PTR OldImageBase, ULONG_PTR NewImageBase); +__declspec(dllexport) void TITCALL RelocaterAddNewRelocation(HANDLE hProcess, ULONG_PTR RelocateAddress, DWORD RelocateState); +__declspec(dllexport) long TITCALL RelocaterEstimatedSize(); +__declspec(dllexport) bool TITCALL RelocaterExportRelocation(ULONG_PTR StorePlace, DWORD StorePlaceRVA, ULONG_PTR FileMapVA); +__declspec(dllexport) bool TITCALL RelocaterExportRelocationEx(const char* szFileName, const char* szSectionName); +__declspec(dllexport) bool TITCALL RelocaterExportRelocationExW(const wchar_t* szFileName, const char* szSectionName); +__declspec(dllexport) bool TITCALL RelocaterGrabRelocationTable(HANDLE hProcess, ULONG_PTR MemoryStart, DWORD MemorySize); +__declspec(dllexport) bool TITCALL RelocaterGrabRelocationTableEx(HANDLE hProcess, ULONG_PTR MemoryStart, ULONG_PTR MemorySize, DWORD NtSizeOfImage); +__declspec(dllexport) bool TITCALL RelocaterMakeSnapshot(HANDLE hProcess, const char* szSaveFileName, LPVOID MemoryStart, ULONG_PTR MemorySize); +__declspec(dllexport) bool TITCALL RelocaterMakeSnapshotW(HANDLE hProcess, const wchar_t* szSaveFileName, LPVOID MemoryStart, ULONG_PTR MemorySize); +__declspec(dllexport) bool TITCALL RelocaterCompareTwoSnapshots(HANDLE hProcess, ULONG_PTR LoadedImageBase, ULONG_PTR NtSizeOfImage, const char* szDumpFile1, const char* szDumpFile2, ULONG_PTR MemStart); +__declspec(dllexport) bool TITCALL RelocaterCompareTwoSnapshotsW(HANDLE hProcess, ULONG_PTR LoadedImageBase, ULONG_PTR NtSizeOfImage, const wchar_t* szDumpFile1, const wchar_t* szDumpFile2, ULONG_PTR MemStart); +__declspec(dllexport) bool TITCALL RelocaterChangeFileBase(const char* szFileName, ULONG_PTR NewImageBase); +__declspec(dllexport) bool TITCALL RelocaterChangeFileBaseW(const wchar_t* szFileName, ULONG_PTR NewImageBase); +__declspec(dllexport) bool TITCALL RelocaterRelocateMemoryBlock(ULONG_PTR FileMapVA, ULONG_PTR MemoryLocation, void* RelocateMemory, DWORD RelocateMemorySize, ULONG_PTR CurrentLoadedBase, ULONG_PTR RelocateBase); +__declspec(dllexport) bool TITCALL RelocaterWipeRelocationTable(const char* szFileName); +__declspec(dllexport) bool TITCALL RelocaterWipeRelocationTableW(const wchar_t* szFileName); +// TitanEngine.Resourcer.functions: +__declspec(dllexport) ULONG_PTR TITCALL ResourcerLoadFileForResourceUse(const char* szFileName); +__declspec(dllexport) ULONG_PTR TITCALL ResourcerLoadFileForResourceUseW(const wchar_t* szFileName); +__declspec(dllexport) bool TITCALL ResourcerFreeLoadedFile(LPVOID LoadedFileBase); +__declspec(dllexport) bool TITCALL ResourcerExtractResourceFromFileEx(HMODULE hFile, const char* szResourceType, const char* szResourceName, const char* szExtractedFileName); +__declspec(dllexport) bool TITCALL ResourcerExtractResourceFromFile(const char* szFileName, const char* szResourceType, const char* szResourceName, const char* szExtractedFileName); +__declspec(dllexport) bool TITCALL ResourcerExtractResourceFromFileW(const wchar_t* szFileName, char* szResourceType, const char* szResourceName, const char* szExtractedFileName); +__declspec(dllexport) bool TITCALL ResourcerFindResource(const char* szFileName, const char* szResourceType, DWORD ResourceType, const char* szResourceName, DWORD ResourceName, DWORD ResourceLanguage, PULONG_PTR pResourceData, LPDWORD pResourceSize); +__declspec(dllexport) bool TITCALL ResourcerFindResourceW(const wchar_t* szFileName, const wchar_t* szResourceType, DWORD ResourceType, const wchar_t* szResourceName, DWORD ResourceName, DWORD ResourceLanguage, PULONG_PTR pResourceData, LPDWORD pResourceSize); +__declspec(dllexport) bool TITCALL ResourcerFindResourceEx(ULONG_PTR FileMapVA, DWORD FileSize, const wchar_t* szResourceType, DWORD ResourceType, const wchar_t* szResourceName, DWORD ResourceName, DWORD ResourceLanguage, PULONG_PTR pResourceData, LPDWORD pResourceSize); +__declspec(dllexport) void TITCALL ResourcerEnumerateResource(const char* szFileName, void* CallBack); +__declspec(dllexport) void TITCALL ResourcerEnumerateResourceW(const wchar_t* szFileName, void* CallBack); +__declspec(dllexport) void TITCALL ResourcerEnumerateResourceEx(ULONG_PTR FileMapVA, DWORD FileSize, void* CallBack); +// TitanEngine.Threader.functions: +__declspec(dllexport) bool TITCALL ThreaderImportRunningThreadData(DWORD ProcessId); +__declspec(dllexport) void* TITCALL ThreaderGetThreadInfo(HANDLE hThread, DWORD ThreadId); +__declspec(dllexport) void TITCALL ThreaderEnumThreadInfo(void* EnumCallBack); +__declspec(dllexport) bool TITCALL ThreaderPauseThread(HANDLE hThread); +__declspec(dllexport) bool TITCALL ThreaderResumeThread(HANDLE hThread); +__declspec(dllexport) bool TITCALL ThreaderTerminateThread(HANDLE hThread, DWORD ThreadExitCode); +__declspec(dllexport) bool TITCALL ThreaderPauseAllThreads(bool LeaveMainRunning); +__declspec(dllexport) bool TITCALL ThreaderResumeAllThreads(bool LeaveMainPaused); +__declspec(dllexport) bool TITCALL ThreaderPauseProcess(); +__declspec(dllexport) bool TITCALL ThreaderResumeProcess(); +__declspec(dllexport) ULONG_PTR TITCALL ThreaderCreateRemoteThread(ULONG_PTR ThreadStartAddress, bool AutoCloseTheHandle, LPVOID ThreadPassParameter, LPDWORD ThreadId); +__declspec(dllexport) bool TITCALL ThreaderInjectAndExecuteCode(LPVOID InjectCode, DWORD StartDelta, DWORD InjectSize); +__declspec(dllexport) ULONG_PTR TITCALL ThreaderCreateRemoteThreadEx(HANDLE hProcess, ULONG_PTR ThreadStartAddress, bool AutoCloseTheHandle, LPVOID ThreadPassParameter, LPDWORD ThreadId); +__declspec(dllexport) bool TITCALL ThreaderInjectAndExecuteCodeEx(HANDLE hProcess, LPVOID InjectCode, DWORD StartDelta, DWORD InjectSize); +__declspec(dllexport) void TITCALL ThreaderSetCallBackForNextExitThreadEvent(LPVOID exitThreadCallBack); +__declspec(dllexport) bool TITCALL ThreaderIsThreadStillRunning(HANDLE hThread); +__declspec(dllexport) bool TITCALL ThreaderIsThreadActive(HANDLE hThread); +__declspec(dllexport) bool TITCALL ThreaderIsAnyThreadActive(); +__declspec(dllexport) bool TITCALL ThreaderExecuteOnlyInjectedThreads(); +__declspec(dllexport) ULONG_PTR TITCALL ThreaderGetOpenHandleForThread(DWORD ThreadId); +__declspec(dllexport) bool TITCALL ThreaderIsExceptionInMainThread(); +// TitanEngine.Debugger.functions: +__declspec(dllexport) void* TITCALL StaticDisassembleEx(ULONG_PTR DisassmStart, LPVOID DisassmAddress); +__declspec(dllexport) void* TITCALL StaticDisassemble(LPVOID DisassmAddress); +__declspec(dllexport) void* TITCALL DisassembleEx(HANDLE hProcess, LPVOID DisassmAddress, bool ReturnInstructionType); +__declspec(dllexport) void* TITCALL Disassemble(LPVOID DisassmAddress); +__declspec(dllexport) long TITCALL StaticLengthDisassemble(LPVOID DisassmAddress); +__declspec(dllexport) long TITCALL LengthDisassembleEx(HANDLE hProcess, LPVOID DisassmAddress); +__declspec(dllexport) long TITCALL LengthDisassemble(LPVOID DisassmAddress); +__declspec(dllexport) void* TITCALL InitDebug(char* szFileName, char* szCommandLine, char* szCurrentFolder); +__declspec(dllexport) void* TITCALL InitDebugW(const wchar_t* szFileName, const wchar_t* szCommandLine, const wchar_t* szCurrentFolder); +__declspec(dllexport) void* TITCALL InitNativeDebug(char* szFileName, char* szCommandLine, char* szCurrentFolder); +__declspec(dllexport) void* TITCALL InitNativeDebugW(const wchar_t* szFileName, const wchar_t* szCommandLine, const wchar_t* szCurrentFolder); +__declspec(dllexport) void* TITCALL InitDebugEx(const char* szFileName, const char* szCommandLine, const char* szCurrentFolder, LPVOID EntryCallBack); +__declspec(dllexport) void* TITCALL InitDebugExW(const wchar_t* szFileName, const wchar_t* szCommandLine, const wchar_t* szCurrentFolder, LPVOID EntryCallBack); +__declspec(dllexport) void* TITCALL InitDLLDebug(const char* szFileName, bool ReserveModuleBase, const char* szCommandLine, const char* szCurrentFolder, LPVOID EntryCallBack); +__declspec(dllexport) void* TITCALL InitDLLDebugW(const wchar_t* szFileName, bool ReserveModuleBase, const wchar_t* szCommandLine, const wchar_t* szCurrentFolder, LPVOID EntryCallBack); +__declspec(dllexport) bool TITCALL StopDebug(); +__declspec(dllexport) void TITCALL SetBPXOptions(long DefaultBreakPointType); +__declspec(dllexport) bool TITCALL IsBPXEnabled(ULONG_PTR bpxAddress); +__declspec(dllexport) bool TITCALL EnableBPX(ULONG_PTR bpxAddress); +__declspec(dllexport) bool TITCALL DisableBPX(ULONG_PTR bpxAddress); +__declspec(dllexport) bool TITCALL SetBPX(ULONG_PTR bpxAddress, DWORD bpxType, LPVOID bpxCallBack); +__declspec(dllexport) bool TITCALL DeleteBPX(ULONG_PTR bpxAddress); +__declspec(dllexport) bool TITCALL SafeDeleteBPX(ULONG_PTR bpxAddress); +__declspec(dllexport) bool TITCALL SetAPIBreakPoint(const char* szDLLName, const char* szAPIName, DWORD bpxType, DWORD bpxPlace, LPVOID bpxCallBack); +__declspec(dllexport) bool TITCALL DeleteAPIBreakPoint(const char* szDLLName, const char* szAPIName, DWORD bpxPlace); +__declspec(dllexport) bool TITCALL SafeDeleteAPIBreakPoint(const char* szDLLName, const char* szAPIName, DWORD bpxPlace); +__declspec(dllexport) bool TITCALL SetMemoryBPX(ULONG_PTR MemoryStart, SIZE_T SizeOfMemory, LPVOID bpxCallBack); +__declspec(dllexport) bool TITCALL SetMemoryBPXEx(ULONG_PTR MemoryStart, SIZE_T SizeOfMemory, DWORD BreakPointType, bool RestoreOnHit, LPVOID bpxCallBack); +__declspec(dllexport) bool TITCALL RemoveMemoryBPX(ULONG_PTR MemoryStart, SIZE_T SizeOfMemory); +__declspec(dllexport) bool TITCALL GetContextFPUDataEx(HANDLE hActiveThread, void* FPUSaveArea); +__declspec(dllexport) void TITCALL Getx87FPURegisters(x87FPURegister_t x87FPURegisters[8], TITAN_ENGINE_CONTEXT_t* titcontext); +__declspec(dllexport) void TITCALL GetMMXRegisters(uint64_t mmx[8], TITAN_ENGINE_CONTEXT_t* titcontext); +__declspec(dllexport) bool TITCALL GetFullContextDataEx(HANDLE hActiveThread, TITAN_ENGINE_CONTEXT_t* titcontext); +__declspec(dllexport) bool TITCALL SetFullContextDataEx(HANDLE hActiveThread, TITAN_ENGINE_CONTEXT_t* titcontext); +__declspec(dllexport) ULONG_PTR TITCALL GetContextDataEx(HANDLE hActiveThread, DWORD IndexOfRegister); +__declspec(dllexport) ULONG_PTR TITCALL GetContextData(DWORD IndexOfRegister); +__declspec(dllexport) bool TITCALL SetContextFPUDataEx(HANDLE hActiveThread, void* FPUSaveArea); +__declspec(dllexport) bool TITCALL SetContextDataEx(HANDLE hActiveThread, DWORD IndexOfRegister, ULONG_PTR NewRegisterValue); +__declspec(dllexport) bool TITCALL SetContextData(DWORD IndexOfRegister, ULONG_PTR NewRegisterValue); +__declspec(dllexport) bool TITCALL GetAVXContext(HANDLE hActiveThread, TITAN_ENGINE_CONTEXT_t* titcontext); +__declspec(dllexport) bool TITCALL SetAVXContext(HANDLE hActiveThread, TITAN_ENGINE_CONTEXT_t* titcontext); +__declspec(dllexport) void TITCALL ClearExceptionNumber(); +__declspec(dllexport) long TITCALL CurrentExceptionNumber(); +__declspec(dllexport) bool TITCALL MatchPatternEx(HANDLE hProcess, void* MemoryToCheck, int SizeOfMemoryToCheck, void* PatternToMatch, int SizeOfPatternToMatch, PBYTE WildCard); +__declspec(dllexport) bool TITCALL MatchPattern(void* MemoryToCheck, int SizeOfMemoryToCheck, void* PatternToMatch, int SizeOfPatternToMatch, PBYTE WildCard); +__declspec(dllexport) ULONG_PTR TITCALL FindEx(HANDLE hProcess, LPVOID MemoryStart, DWORD MemorySize, LPVOID SearchPattern, DWORD PatternSize, LPBYTE WildCard); +extern "C" __declspec(dllexport) ULONG_PTR TITCALL Find(LPVOID MemoryStart, DWORD MemorySize, LPVOID SearchPattern, DWORD PatternSize, LPBYTE WildCard); +__declspec(dllexport) bool TITCALL FillEx(HANDLE hProcess, LPVOID MemoryStart, DWORD MemorySize, PBYTE FillByte); +__declspec(dllexport) bool TITCALL Fill(LPVOID MemoryStart, DWORD MemorySize, PBYTE FillByte); +__declspec(dllexport) bool TITCALL PatchEx(HANDLE hProcess, LPVOID MemoryStart, DWORD MemorySize, LPVOID ReplacePattern, DWORD ReplaceSize, bool AppendNOP, bool PrependNOP); +__declspec(dllexport) bool TITCALL Patch(LPVOID MemoryStart, DWORD MemorySize, LPVOID ReplacePattern, DWORD ReplaceSize, bool AppendNOP, bool PrependNOP); +__declspec(dllexport) bool TITCALL ReplaceEx(HANDLE hProcess, LPVOID MemoryStart, DWORD MemorySize, LPVOID SearchPattern, DWORD PatternSize, DWORD NumberOfRepetitions, LPVOID ReplacePattern, DWORD ReplaceSize, PBYTE WildCard); +__declspec(dllexport) bool TITCALL Replace(LPVOID MemoryStart, DWORD MemorySize, LPVOID SearchPattern, DWORD PatternSize, DWORD NumberOfRepetitions, LPVOID ReplacePattern, DWORD ReplaceSize, PBYTE WildCard); +__declspec(dllexport) void* TITCALL GetDebugData(); +__declspec(dllexport) void* TITCALL GetTerminationData(); +__declspec(dllexport) long TITCALL GetExitCode(); +__declspec(dllexport) ULONG_PTR TITCALL GetDebuggedDLLBaseAddress(); +__declspec(dllexport) ULONG_PTR TITCALL GetDebuggedFileBaseAddress(); +__declspec(dllexport) bool TITCALL GetRemoteString(HANDLE hProcess, LPVOID StringAddress, LPVOID StringStorage, int MaximumStringSize); +__declspec(dllexport) ULONG_PTR TITCALL GetFunctionParameter(HANDLE hProcess, DWORD FunctionType, DWORD ParameterNumber, DWORD ParameterType); +__declspec(dllexport) ULONG_PTR TITCALL GetJumpDestinationEx(HANDLE hProcess, ULONG_PTR InstructionAddress, bool JustJumps); +__declspec(dllexport) ULONG_PTR TITCALL GetJumpDestination(HANDLE hProcess, ULONG_PTR InstructionAddress); +__declspec(dllexport) bool TITCALL IsJumpGoingToExecuteEx(HANDLE hProcess, HANDLE hThread, ULONG_PTR InstructionAddress, ULONG_PTR RegFlags); +__declspec(dllexport) bool TITCALL IsJumpGoingToExecute(); +__declspec(dllexport) void TITCALL SetCustomHandler(DWORD ExceptionId, LPVOID CallBack); +__declspec(dllexport) void TITCALL ForceClose(); +__declspec(dllexport) void TITCALL StepInto(LPVOID traceCallBack); +__declspec(dllexport) void TITCALL StepOver(LPVOID traceCallBack); +__declspec(dllexport) void TITCALL StepOut(LPVOID StepOut, bool StepFinal); +__declspec(dllexport) void TITCALL SingleStep(DWORD StepCount, LPVOID StepCallBack); +__declspec(dllexport) bool TITCALL GetUnusedHardwareBreakPointRegister(LPDWORD RegisterIndex); +__declspec(dllexport) bool TITCALL SetHardwareBreakPointEx(HANDLE hActiveThread, ULONG_PTR bpxAddress, DWORD IndexOfRegister, DWORD bpxType, DWORD bpxSize, LPVOID bpxCallBack, LPDWORD IndexOfSelectedRegister); +__declspec(dllexport) bool TITCALL SetHardwareBreakPoint(ULONG_PTR bpxAddress, DWORD IndexOfRegister, DWORD bpxType, DWORD bpxSize, LPVOID bpxCallBack); +__declspec(dllexport) bool TITCALL DeleteHardwareBreakPoint(DWORD IndexOfRegister); +__declspec(dllexport) bool TITCALL RemoveAllBreakPoints(DWORD RemoveOption); +__declspec(dllexport) PROCESS_INFORMATION* TITCALL TitanGetProcessInformation(); +__declspec(dllexport) STARTUPINFOW* TITCALL TitanGetStartupInformation(); +__declspec(dllexport) void TITCALL DebugLoop(); +__declspec(dllexport) void TITCALL SetDebugLoopTimeOut(DWORD TimeOut); +__declspec(dllexport) void TITCALL SetNextDbgContinueStatus(DWORD SetDbgCode); +__declspec(dllexport) bool TITCALL AttachDebugger(DWORD ProcessId, bool KillOnExit, LPVOID DebugInfo, LPVOID CallBack); +__declspec(dllexport) bool TITCALL DetachDebugger(DWORD ProcessId); +__declspec(dllexport) bool TITCALL DetachDebuggerEx(DWORD ProcessId); +__declspec(dllexport) void TITCALL DebugLoopEx(DWORD TimeOut); +__declspec(dllexport) void TITCALL AutoDebugEx(const char* szFileName, bool ReserveModuleBase, const char* szCommandLine, const char* szCurrentFolder, DWORD TimeOut, LPVOID EntryCallBack); +__declspec(dllexport) void TITCALL AutoDebugExW(const wchar_t* szFileName, bool ReserveModuleBase, const wchar_t* szCommandLine, const wchar_t* szCurrentFolder, DWORD TimeOut, LPVOID EntryCallBack); +__declspec(dllexport) bool TITCALL IsFileBeingDebugged(); +__declspec(dllexport) void TITCALL SetErrorModel(bool DisplayErrorMessages); +// TitanEngine.FindOEP.functions: +__declspec(dllexport) void TITCALL FindOEPInit(); +__declspec(dllexport) bool TITCALL FindOEPGenerically(const char* szFileName, LPVOID TraceInitCallBack, LPVOID CallBack); +__declspec(dllexport) bool TITCALL FindOEPGenericallyW(const wchar_t* szFileName, LPVOID TraceInitCallBack, LPVOID CallBack); +// TitanEngine.Importer.functions: +__declspec(dllexport) void TITCALL ImporterAddNewDll(const char* szDLLName, ULONG_PTR FirstThunk); +__declspec(dllexport) void TITCALL ImporterAddNewAPI(const char* szAPIName, ULONG_PTR ThunkValue); +__declspec(dllexport) void TITCALL ImporterAddNewOrdinalAPI(ULONG_PTR OrdinalNumber, ULONG_PTR ThunkValue); +__declspec(dllexport) long TITCALL ImporterGetAddedDllCount(); +__declspec(dllexport) long TITCALL ImporterGetAddedAPICount(); +__declspec(dllexport) bool TITCALL ImporterExportIAT(ULONG_PTR StorePlace, ULONG_PTR FileMapVA, HANDLE hFileMap); +__declspec(dllexport) long TITCALL ImporterEstimatedSize(); +__declspec(dllexport) bool TITCALL ImporterExportIATEx(const char* szDumpFileName, const char* szExportFileName, const char* szSectionName); +__declspec(dllexport) bool TITCALL ImporterExportIATExW(const wchar_t* szDumpFileName, const wchar_t* szExportFileName, const wchar_t* szSectionName = L".RL!TEv2"); +__declspec(dllexport) ULONG_PTR TITCALL ImporterFindAPIWriteLocation(const char* szAPIName); +__declspec(dllexport) ULONG_PTR TITCALL ImporterFindOrdinalAPIWriteLocation(ULONG_PTR OrdinalNumber); +__declspec(dllexport) ULONG_PTR TITCALL ImporterFindAPIByWriteLocation(ULONG_PTR APIWriteLocation); +__declspec(dllexport) ULONG_PTR TITCALL ImporterFindDLLByWriteLocation(ULONG_PTR APIWriteLocation); +__declspec(dllexport) void* TITCALL ImporterGetDLLName(ULONG_PTR APIAddress); +__declspec(dllexport) void* TITCALL ImporterGetDLLNameW(ULONG_PTR APIAddress); +__declspec(dllexport) void* TITCALL ImporterGetAPIName(ULONG_PTR APIAddress); +__declspec(dllexport) ULONG_PTR TITCALL ImporterGetAPIOrdinalNumber(ULONG_PTR APIAddress); +__declspec(dllexport) void* TITCALL ImporterGetAPINameEx(ULONG_PTR APIAddress, ULONG_PTR DLLBasesList); +__declspec(dllexport) ULONG_PTR TITCALL ImporterGetRemoteAPIAddress(HANDLE hProcess, ULONG_PTR APIAddress); +__declspec(dllexport) ULONG_PTR TITCALL ImporterGetRemoteAPIAddressEx(const char* szDLLName, const char* szAPIName); +__declspec(dllexport) ULONG_PTR TITCALL ImporterGetLocalAPIAddress(HANDLE hProcess, ULONG_PTR APIAddress); +__declspec(dllexport) void* TITCALL ImporterGetDLLNameFromDebugee(HANDLE hProcess, ULONG_PTR APIAddress); +__declspec(dllexport) void* TITCALL ImporterGetDLLNameFromDebugeeW(HANDLE hProcess, ULONG_PTR APIAddress); +__declspec(dllexport) void* TITCALL ImporterGetAPINameFromDebugee(HANDLE hProcess, ULONG_PTR APIAddress); +__declspec(dllexport) ULONG_PTR TITCALL ImporterGetAPIOrdinalNumberFromDebugee(HANDLE hProcess, ULONG_PTR APIAddress); +__declspec(dllexport) long TITCALL ImporterGetDLLIndexEx(ULONG_PTR APIAddress, ULONG_PTR DLLBasesList); +__declspec(dllexport) long TITCALL ImporterGetDLLIndex(HANDLE hProcess, ULONG_PTR APIAddress, ULONG_PTR DLLBasesList); +__declspec(dllexport) ULONG_PTR TITCALL ImporterGetRemoteDLLBase(HANDLE hProcess, HMODULE LocalModuleBase); +__declspec(dllexport) ULONG_PTR TITCALL ImporterGetRemoteDLLBaseEx(HANDLE hProcess, const char* szModuleName); +__declspec(dllexport) void* TITCALL ImporterGetRemoteDLLBaseExW(HANDLE hProcess, const wchar_t* szModuleName); +__declspec(dllexport) bool TITCALL ImporterIsForwardedAPI(HANDLE hProcess, ULONG_PTR APIAddress); +__declspec(dllexport) void* TITCALL ImporterGetForwardedAPIName(HANDLE hProcess, ULONG_PTR APIAddress); +__declspec(dllexport) void* TITCALL ImporterGetForwardedDLLName(HANDLE hProcess, ULONG_PTR APIAddress); +__declspec(dllexport) long TITCALL ImporterGetForwardedDLLIndex(HANDLE hProcess, ULONG_PTR APIAddress, ULONG_PTR DLLBasesList); +__declspec(dllexport) ULONG_PTR TITCALL ImporterGetForwardedAPIOrdinalNumber(HANDLE hProcess, ULONG_PTR APIAddress); +__declspec(dllexport) ULONG_PTR TITCALL ImporterGetNearestAPIAddress(HANDLE hProcess, ULONG_PTR APIAddress); +__declspec(dllexport) void* TITCALL ImporterGetNearestAPIName(HANDLE hProcess, ULONG_PTR APIAddress); +__declspec(dllexport) bool TITCALL ImporterCopyOriginalIAT(const char* szOriginalFile, const char* szDumpFile); +__declspec(dllexport) bool TITCALL ImporterCopyOriginalIATW(const wchar_t* szOriginalFile, const wchar_t* szDumpFile); +__declspec(dllexport) bool TITCALL ImporterLoadImportTable(const char* szFileName); +__declspec(dllexport) bool TITCALL ImporterLoadImportTableW(const wchar_t* szFileName); +__declspec(dllexport) bool TITCALL ImporterMoveOriginalIAT(const char* szOriginalFile, const char* szDumpFile, const char* szSectionName); +__declspec(dllexport) bool TITCALL ImporterMoveOriginalIATW(const wchar_t* szOriginalFile, const wchar_t* szDumpFile, const char* szSectionName); +__declspec(dllexport) void TITCALL ImporterAutoSearchIAT(DWORD ProcessId, const char* szFileName, ULONG_PTR SearchStart, LPVOID pIATStart, LPVOID pIATSize); +__declspec(dllexport) void TITCALL ImporterAutoSearchIATW(DWORD ProcessIds, const wchar_t* szFileName, ULONG_PTR SearchStart, LPVOID pIATStart, LPVOID pIATSize); +__declspec(dllexport) void TITCALL ImporterAutoSearchIATEx(DWORD ProcessId, ULONG_PTR ImageBase, ULONG_PTR SearchStart, LPVOID pIATStart, LPVOID pIATSize); +__declspec(dllexport) void TITCALL ImporterEnumAddedData(LPVOID EnumCallBack); +__declspec(dllexport) long TITCALL ImporterAutoFixIATEx(DWORD ProcessId, const char* szDumpedFile, const char* szSectionName, bool DumpRunningProcess, bool RealignFile, ULONG_PTR EntryPointAddress, ULONG_PTR ImageBase, ULONG_PTR SearchStart, bool TryAutoFix, bool FixEliminations, LPVOID UnknownPointerFixCallback); +__declspec(dllexport) long TITCALL ImporterAutoFixIATExW(DWORD ProcessId, const wchar_t* szDumpedFile, const wchar_t* szSectionName, bool DumpRunningProcess, bool RealignFile, ULONG_PTR EntryPointAddress, ULONG_PTR ImageBase, ULONG_PTR SearchStart, bool TryAutoFix, bool FixEliminations, LPVOID UnknownPointerFixCallback); +__declspec(dllexport) long TITCALL ImporterAutoFixIAT(DWORD ProcessId, const char* szDumpedFile, ULONG_PTR SearchStart); +__declspec(dllexport) long TITCALL ImporterAutoFixIATW(DWORD ProcessId, const wchar_t* szDumpedFile, ULONG_PTR SearchStart); +__declspec(dllexport) bool TITCALL ImporterDeleteAPI(DWORD_PTR apiAddr); +// Global.Engine.Hook.functions: +__declspec(dllexport) bool TITCALL HooksSafeTransitionEx(LPVOID HookAddressArray, int NumberOfHooks, bool TransitionStart); +__declspec(dllexport) bool TITCALL HooksSafeTransition(LPVOID HookAddress, bool TransitionStart); +__declspec(dllexport) bool TITCALL HooksIsAddressRedirected(LPVOID HookAddress); +__declspec(dllexport) void* TITCALL HooksGetTrampolineAddress(LPVOID HookAddress); +__declspec(dllexport) void* TITCALL HooksGetHookEntryDetails(LPVOID HookAddress); +__declspec(dllexport) bool TITCALL HooksInsertNewRedirection(LPVOID HookAddress, LPVOID RedirectTo, int HookType); +__declspec(dllexport) bool TITCALL HooksInsertNewIATRedirectionEx(ULONG_PTR FileMapVA, ULONG_PTR LoadedModuleBase, const char* szHookFunction, LPVOID RedirectTo); +__declspec(dllexport) bool TITCALL HooksInsertNewIATRedirection(const char* szModuleName, const char* szHookFunction, LPVOID RedirectTo); +__declspec(dllexport) bool TITCALL HooksRemoveRedirection(LPVOID HookAddress, bool RemoveAll); +__declspec(dllexport) bool TITCALL HooksRemoveRedirectionsForModule(HMODULE ModuleBase); +__declspec(dllexport) bool TITCALL HooksRemoveIATRedirection(const char* szModuleName, const char* szHookFunction, bool RemoveAll); +__declspec(dllexport) bool TITCALL HooksDisableRedirection(LPVOID HookAddress, bool DisableAll); +__declspec(dllexport) bool TITCALL HooksDisableRedirectionsForModule(HMODULE ModuleBase); +__declspec(dllexport) bool TITCALL HooksDisableIATRedirection(const char* szModuleName, const char* szHookFunction, bool DisableAll); +__declspec(dllexport) bool TITCALL HooksEnableRedirection(LPVOID HookAddress, bool EnableAll); +__declspec(dllexport) bool TITCALL HooksEnableRedirectionsForModule(HMODULE ModuleBase); +__declspec(dllexport) bool TITCALL HooksEnableIATRedirection(const char* szModuleName, const char* szHookFunction, bool EnableAll); +__declspec(dllexport) void TITCALL HooksScanModuleMemory(HMODULE ModuleBase, LPVOID CallBack); +__declspec(dllexport) void TITCALL HooksScanEntireProcessMemory(LPVOID CallBack); +__declspec(dllexport) void TITCALL HooksScanEntireProcessMemoryEx(); +// TitanEngine.Tracer.functions: +__declspec(dllexport) void TITCALL TracerInit(); +__declspec(dllexport) ULONG_PTR TITCALL TracerLevel1(HANDLE hProcess, ULONG_PTR AddressToTrace); +__declspec(dllexport) ULONG_PTR TITCALL HashTracerLevel1(HANDLE hProcess, ULONG_PTR AddressToTrace, DWORD InputNumberOfInstructions); +__declspec(dllexport) long TITCALL TracerDetectRedirection(HANDLE hProcess, ULONG_PTR AddressToTrace); +__declspec(dllexport) ULONG_PTR TITCALL TracerFixKnownRedirection(HANDLE hProcess, ULONG_PTR AddressToTrace, DWORD RedirectionId); +__declspec(dllexport) ULONG_PTR TITCALL TracerFixRedirectionViaModule(HMODULE hModuleHandle, HANDLE hProcess, ULONG_PTR AddressToTrace, DWORD IdParameter); +__declspec(dllexport) long TITCALL TracerFixRedirectionViaImpRecPlugin(HANDLE hProcess, const char* szPluginName, ULONG_PTR AddressToTrace); +// TitanEngine.Exporter.functions: +__declspec(dllexport) void TITCALL ExporterCleanup(); +__declspec(dllexport) void TITCALL ExporterSetImageBase(ULONG_PTR ImageBase); +__declspec(dllexport) void TITCALL ExporterInit(DWORD MemorySize, ULONG_PTR ImageBase, DWORD ExportOrdinalBase, const char* szExportModuleName); +__declspec(dllexport) bool TITCALL ExporterAddNewExport(const char* szExportName, DWORD ExportRelativeAddress); +__declspec(dllexport) bool TITCALL ExporterAddNewOrdinalExport(DWORD OrdinalNumber, DWORD ExportRelativeAddress); +__declspec(dllexport) long TITCALL ExporterGetAddedExportCount(); +__declspec(dllexport) long TITCALL ExporterEstimatedSize(); +__declspec(dllexport) bool TITCALL ExporterBuildExportTable(ULONG_PTR StorePlace, ULONG_PTR FileMapVA); +__declspec(dllexport) bool TITCALL ExporterBuildExportTableEx(const char* szExportFileName, const char* szSectionName); +__declspec(dllexport) bool TITCALL ExporterBuildExportTableExW(const wchar_t* szExportFileName, const char* szSectionName); +__declspec(dllexport) bool TITCALL ExporterLoadExportTable(const char* szFileName); +__declspec(dllexport) bool TITCALL ExporterLoadExportTableW(const wchar_t* szFileName); +// TitanEngine.Librarian.functions: +__declspec(dllexport) bool TITCALL LibrarianSetBreakPoint(const char* szLibraryName, DWORD bpxType, bool SingleShoot, LPVOID bpxCallBack); +__declspec(dllexport) bool TITCALL LibrarianRemoveBreakPoint(const char* szLibraryName, DWORD bpxType); +__declspec(dllexport) void* TITCALL LibrarianGetLibraryInfo(const char* szLibraryName); +__declspec(dllexport) void* TITCALL LibrarianGetLibraryInfoW(const wchar_t* szLibraryName); +__declspec(dllexport) void* TITCALL LibrarianGetLibraryInfoEx(void* BaseOfDll); +__declspec(dllexport) void* TITCALL LibrarianGetLibraryInfoExW(void* BaseOfDll); +__declspec(dllexport) void TITCALL LibrarianEnumLibraryInfo(void* EnumCallBack); +__declspec(dllexport) void TITCALL LibrarianEnumLibraryInfoW(void* EnumCallBack); +// TitanEngine.Process.functions: +__declspec(dllexport) long TITCALL GetActiveProcessId(const char* szImageName); +__declspec(dllexport) long TITCALL GetActiveProcessIdW(const wchar_t* szImageName); +__declspec(dllexport) void TITCALL EnumProcessesWithLibrary(const char* szLibraryName, void* EnumFunction); +__declspec(dllexport) HANDLE TITCALL TitanOpenProcess(DWORD dwDesiredAccess, bool bInheritHandle, DWORD dwProcessId); +__declspec(dllexport) HANDLE TITCALL TitanOpenThread(DWORD dwDesiredAccess, bool bInheritHandle, DWORD dwThreadId); +// TitanEngine.TLSFixer.functions: +__declspec(dllexport) bool TITCALL TLSBreakOnCallBack(LPVOID ArrayOfCallBacks, DWORD NumberOfCallBacks, LPVOID bpxCallBack); +__declspec(dllexport) bool TITCALL TLSGrabCallBackData(const char* szFileName, LPVOID ArrayOfCallBacks, LPDWORD NumberOfCallBacks); +__declspec(dllexport) bool TITCALL TLSGrabCallBackDataW(const wchar_t* szFileName, LPVOID ArrayOfCallBacks, LPDWORD NumberOfCallBacks); +__declspec(dllexport) bool TITCALL TLSBreakOnCallBackEx(const char* szFileName, LPVOID bpxCallBack); +__declspec(dllexport) bool TITCALL TLSBreakOnCallBackExW(const wchar_t* szFileName, LPVOID bpxCallBack); +__declspec(dllexport) bool TITCALL TLSRemoveCallback(const char* szFileName); +__declspec(dllexport) bool TITCALL TLSRemoveCallbackW(const wchar_t* szFileName); +__declspec(dllexport) bool TITCALL TLSRemoveTable(const char* szFileName); +__declspec(dllexport) bool TITCALL TLSRemoveTableW(const wchar_t* szFileName); +__declspec(dllexport) bool TITCALL TLSBackupData(const char* szFileName); +__declspec(dllexport) bool TITCALL TLSBackupDataW(const wchar_t* szFileName); +__declspec(dllexport) bool TITCALL TLSRestoreData(); +__declspec(dllexport) bool TITCALL TLSBuildNewTable(ULONG_PTR FileMapVA, ULONG_PTR StorePlace, ULONG_PTR StorePlaceRVA, LPVOID ArrayOfCallBacks, DWORD NumberOfCallBacks); +__declspec(dllexport) bool TITCALL TLSBuildNewTableEx(const char* szFileName, const char* szSectionName, LPVOID ArrayOfCallBacks, DWORD NumberOfCallBacks); +__declspec(dllexport) bool TITCALL TLSBuildNewTableExW(const wchar_t* szFileName, const char* szSectionName, LPVOID ArrayOfCallBacks, DWORD NumberOfCallBacks); +// TitanEngine.TranslateName.functions: +__declspec(dllexport) void* TITCALL TranslateNativeName(const char* szNativeName); +__declspec(dllexport) void* TITCALL TranslateNativeNameW(const wchar_t* szNativeName); +// TitanEngine.Handler.functions: +__declspec(dllexport) long TITCALL HandlerGetActiveHandleCount(DWORD ProcessId); +__declspec(dllexport) bool TITCALL HandlerIsHandleOpen(DWORD ProcessId, HANDLE hHandle); +__declspec(dllexport) void* TITCALL HandlerGetHandleName(HANDLE hProcess, DWORD ProcessId, HANDLE hHandle, bool TranslateName); +__declspec(dllexport) void* TITCALL HandlerGetHandleNameW(HANDLE hProcess, DWORD ProcessId, HANDLE hHandle, bool TranslateName); +__declspec(dllexport) long TITCALL HandlerEnumerateOpenHandles(DWORD ProcessId, LPVOID HandleBuffer, DWORD MaxHandleCount); +__declspec(dllexport) ULONG_PTR TITCALL HandlerGetHandleDetails(HANDLE hProcess, DWORD ProcessId, HANDLE hHandle, DWORD InformationReturn); +__declspec(dllexport) bool TITCALL HandlerCloseRemoteHandle(HANDLE hProcess, HANDLE hHandle); +__declspec(dllexport) long TITCALL HandlerEnumerateLockHandles(char* szFileOrFolderName, bool NameIsFolder, bool NameIsTranslated, LPVOID HandleDataBuffer, DWORD MaxHandleCount); +__declspec(dllexport) long TITCALL HandlerEnumerateLockHandlesW(const wchar_t* szFileOrFolderName, bool NameIsFolder, bool NameIsTranslated, LPVOID HandleDataBuffer, DWORD MaxHandleCount); +__declspec(dllexport) bool TITCALL HandlerCloseAllLockHandles(const char* szFileOrFolderName, bool NameIsFolder, bool NameIsTranslated); +__declspec(dllexport) bool TITCALL HandlerCloseAllLockHandlesW(const wchar_t* szFileOrFolderName, bool NameIsFolder, bool NameIsTranslated); +__declspec(dllexport) bool TITCALL HandlerIsFileLocked(const char* szFileOrFolderName, bool NameIsFolder, bool NameIsTranslated); +__declspec(dllexport) bool TITCALL HandlerIsFileLockedW(const wchar_t* szFileOrFolderName, bool NameIsFolder, bool NameIsTranslated); +// TitanEngine.Handler[Mutex].functions: +__declspec(dllexport) long TITCALL HandlerEnumerateOpenMutexes(HANDLE hProcess, DWORD ProcessId, LPVOID HandleBuffer, DWORD MaxHandleCount); +__declspec(dllexport) ULONG_PTR TITCALL HandlerGetOpenMutexHandle(HANDLE hProcess, DWORD ProcessId, const char* szMutexString); +__declspec(dllexport) ULONG_PTR TITCALL HandlerGetOpenMutexHandleW(HANDLE hProcess, DWORD ProcessId, const wchar_t* szMutexString); +__declspec(dllexport) long TITCALL HandlerGetProcessIdWhichCreatedMutex(const char* szMutexString); +__declspec(dllexport) long TITCALL HandlerGetProcessIdWhichCreatedMutexW(const wchar_t* szMutexString); +// TitanEngine.Injector.functions: +__declspec(dllexport) bool TITCALL RemoteLoadLibrary(HANDLE hProcess, const char* szLibraryFile, bool WaitForThreadExit); +__declspec(dllexport) bool TITCALL RemoteLoadLibraryW(HANDLE hProcess, const wchar_t* szLibraryFile, bool WaitForThreadExit); +__declspec(dllexport) bool TITCALL RemoteFreeLibrary(HANDLE hProcess, HMODULE hModule, const char* szLibraryFile, bool WaitForThreadExit); +__declspec(dllexport) bool TITCALL RemoteFreeLibraryW(HANDLE hProcess, HMODULE hModule, const wchar_t* szLibraryFile, bool WaitForThreadExit); +__declspec(dllexport) bool TITCALL RemoteExitProcess(HANDLE hProcess, DWORD ExitCode); +// TitanEngine.StaticUnpacker.functions: +__declspec(dllexport) bool TITCALL StaticFileLoad(const char* szFileName, DWORD DesiredAccess, bool SimulateLoad, LPHANDLE FileHandle, LPDWORD LoadedSize, LPHANDLE FileMap, PULONG_PTR FileMapVA); +__declspec(dllexport) bool TITCALL StaticFileLoadW(const wchar_t* szFileName, DWORD DesiredAccess, bool SimulateLoad, LPHANDLE FileHandle, LPDWORD LoadedSize, LPHANDLE FileMap, PULONG_PTR FileMapVA); +__declspec(dllexport) bool TITCALL StaticFileUnload(const char* szFileName, bool CommitChanges, HANDLE FileHandle, DWORD LoadedSize, HANDLE FileMap, ULONG_PTR FileMapVA); +__declspec(dllexport) bool TITCALL StaticFileUnloadW(const wchar_t* szFileName, bool CommitChanges, HANDLE FileHandle, DWORD LoadedSize, HANDLE FileMap, ULONG_PTR FileMapVA); +__declspec(dllexport) bool TITCALL StaticFileOpen(const char* szFileName, DWORD DesiredAccess, LPHANDLE FileHandle, LPDWORD FileSizeLow, LPDWORD FileSizeHigh); +__declspec(dllexport) bool TITCALL StaticFileOpenW(const wchar_t* szFileName, DWORD DesiredAccess, LPHANDLE FileHandle, LPDWORD FileSizeLow, LPDWORD FileSizeHigh); +__declspec(dllexport) bool TITCALL StaticFileGetContent(HANDLE FileHandle, DWORD FilePositionLow, LPDWORD FilePositionHigh, void* Buffer, DWORD Size); +__declspec(dllexport) void TITCALL StaticFileClose(HANDLE FileHandle); +__declspec(dllexport) void TITCALL StaticMemoryDecrypt(LPVOID MemoryStart, DWORD MemorySize, DWORD DecryptionType, DWORD DecryptionKeySize, ULONG_PTR DecryptionKey); +__declspec(dllexport) void TITCALL StaticMemoryDecryptEx(LPVOID MemoryStart, DWORD MemorySize, DWORD DecryptionKeySize, void* DecryptionCallBack); +__declspec(dllexport) void TITCALL StaticMemoryDecryptSpecial(LPVOID MemoryStart, DWORD MemorySize, DWORD DecryptionKeySize, DWORD SpecDecryptionType, void* DecryptionCallBack); +__declspec(dllexport) void TITCALL StaticSectionDecrypt(ULONG_PTR FileMapVA, DWORD SectionNumber, bool SimulateLoad, DWORD DecryptionType, DWORD DecryptionKeySize, ULONG_PTR DecryptionKey); +__declspec(dllexport) bool TITCALL StaticMemoryDecompress(void* Source, DWORD SourceSize, void* Destination, DWORD DestinationSize, int Algorithm); +__declspec(dllexport) bool TITCALL StaticRawMemoryCopy(HANDLE hFile, ULONG_PTR FileMapVA, ULONG_PTR VitualAddressToCopy, DWORD Size, bool AddressIsRVA, const char* szDumpFileName); +__declspec(dllexport) bool TITCALL StaticRawMemoryCopyW(HANDLE hFile, ULONG_PTR FileMapVA, ULONG_PTR VitualAddressToCopy, DWORD Size, bool AddressIsRVA, const wchar_t* szDumpFileName); +__declspec(dllexport) bool TITCALL StaticRawMemoryCopyEx(HANDLE hFile, DWORD RawAddressToCopy, DWORD Size, const char* szDumpFileName); +__declspec(dllexport) bool TITCALL StaticRawMemoryCopyExW(HANDLE hFile, DWORD RawAddressToCopy, DWORD Size, const wchar_t* szDumpFileName); +__declspec(dllexport) bool TITCALL StaticRawMemoryCopyEx64(HANDLE hFile, DWORD64 RawAddressToCopy, DWORD64 Size, const char* szDumpFileName); +__declspec(dllexport) bool TITCALL StaticRawMemoryCopyEx64W(HANDLE hFile, DWORD64 RawAddressToCopy, DWORD64 Size, const wchar_t* szDumpFileName); +__declspec(dllexport) bool TITCALL StaticHashMemory(void* MemoryToHash, DWORD SizeOfMemory, void* HashDigest, bool OutputString, int Algorithm); +__declspec(dllexport) bool TITCALL StaticHashFileW(const wchar_t* szFileName, char* HashDigest, bool OutputString, int Algorithm); +__declspec(dllexport) bool TITCALL StaticHashFile(const char* szFileName, char* HashDigest, bool OutputString, int Algorithm); +// TitanEngine.Engine.functions: +__declspec(dllexport) void TITCALL EngineUnpackerInitialize(const char* szFileName, const char* szUnpackedFileName, bool DoLogData, bool DoRealignFile, bool DoMoveOverlay, void* EntryCallBack); +__declspec(dllexport) void TITCALL EngineUnpackerInitializeW(const wchar_t* szFileName, const wchar_t* szUnpackedFileName, bool DoLogData, bool DoRealignFile, bool DoMoveOverlay, void* EntryCallBack); +__declspec(dllexport) bool TITCALL EngineUnpackerSetBreakCondition(void* SearchStart, DWORD SearchSize, void* SearchPattern, DWORD PatternSize, DWORD PatternDelta, ULONG_PTR BreakType, bool SingleBreak, DWORD Parameter1, DWORD Parameter2); +__declspec(dllexport) void TITCALL EngineUnpackerSetEntryPointAddress(ULONG_PTR UnpackedEntryPointAddress); +__declspec(dllexport) void TITCALL EngineUnpackerFinalizeUnpacking(); +// TitanEngine.Engine.functions: +__declspec(dllexport) void TITCALL SetEngineVariable(DWORD VariableId, bool VariableSet); +__declspec(dllexport) bool TITCALL EngineCreateMissingDependencies(const char* szFileName, const char* szOutputFolder, bool LogCreatedFiles); +__declspec(dllexport) bool TITCALL EngineCreateMissingDependenciesW(const wchar_t* szFileName, const wchar_t* szOutputFolder, bool LogCreatedFiles); +__declspec(dllexport) bool TITCALL EngineFakeMissingDependencies(HANDLE hProcess); +__declspec(dllexport) bool TITCALL EngineDeleteCreatedDependencies(); +__declspec(dllexport) bool TITCALL EngineCreateUnpackerWindow(const char* WindowUnpackerTitle, const char* WindowUnpackerLongTitle, const char* WindowUnpackerName, const char* WindowUnpackerAuthor, void* StartUnpackingCallBack); +__declspec(dllexport) void TITCALL EngineAddUnpackerWindowLogMessage(const char* szLogMessage); +__declspec(dllexport) bool TITCALL EngineCheckStructAlignment(DWORD StructureType, ULONG_PTR StructureSize); +// Global.Engine.Extension.Functions: +__declspec(dllexport) bool TITCALL ExtensionManagerIsPluginLoaded(const char* szPluginName); +__declspec(dllexport) bool TITCALL ExtensionManagerIsPluginEnabled(const char* szPluginName); +__declspec(dllexport) bool TITCALL ExtensionManagerDisableAllPlugins(); +__declspec(dllexport) bool TITCALL ExtensionManagerDisablePlugin(const char* szPluginName); +__declspec(dllexport) bool TITCALL ExtensionManagerEnableAllPlugins(); +__declspec(dllexport) bool TITCALL ExtensionManagerEnablePlugin(const char* szPluginName); +__declspec(dllexport) bool TITCALL ExtensionManagerUnloadAllPlugins(); +__declspec(dllexport) bool TITCALL ExtensionManagerUnloadPlugin(const char* szPluginName); +__declspec(dllexport) void* TITCALL ExtensionManagerGetPluginInfo(const char* szPluginName); + +#ifdef __cplusplus +} +#endif + +#pragma pack(pop) + +#endif /*TITANENGINE*/ + +``` + +`AutoAttach/pluginsdk/XEDParse/XEDParse.h`: + +```h +#ifndef _XEDPARSE_H +#define _XEDPARSE_H + +#include + +//XEDParse defines +#ifdef XEDPARSE_BUILD +#define XEDPARSE_EXPORT __declspec(dllexport) +#else +#define XEDPARSE_EXPORT __declspec(dllimport) +#endif //XEDPARSE_BUILD + +#define XEDPARSE_CALL //calling convention + +#define XEDPARSE_MAXBUFSIZE 256 +#define XEDPARSE_MAXASMSIZE 16 + +//typedefs +typedef bool (XEDPARSE_CALL* CBXEDPARSE_UNKNOWN)(const char* text, ULONGLONG* value); + +//XEDParse enums +enum XEDPARSE_STATUS +{ + XEDPARSE_ERROR = 0, + XEDPARSE_OK = 1 +}; + +//XEDParse structs +#pragma pack(push,8) +struct XEDPARSE +{ + bool x64; // use 64-bit instructions + ULONGLONG cip; //instruction pointer (for relative addressing) + unsigned int dest_size; //destination size (returned by XEDParse) + CBXEDPARSE_UNKNOWN cbUnknown; //unknown operand callback + unsigned char dest[XEDPARSE_MAXASMSIZE]; //destination buffer + char instr[XEDPARSE_MAXBUFSIZE]; //instruction text + char error[XEDPARSE_MAXBUFSIZE]; //error text (in case of an error) +}; +#pragma pack(pop) + +#ifdef __cplusplus +extern "C" +{ +#endif + +XEDPARSE_EXPORT XEDPARSE_STATUS XEDPARSE_CALL XEDParseAssemble(XEDPARSE* XEDParse); + +#ifdef __cplusplus +} +#endif + +#endif // _XEDPARSE_H + +``` + +`AutoAttach/pluginsdk/_dbgfunctions.h`: + +```h +#ifndef _DBGFUNCTIONS_H +#define _DBGFUNCTIONS_H + +#ifndef __cplusplus +#include +#endif + +typedef struct +{ + char mod[MAX_MODULE_SIZE]; + duint addr; + unsigned char oldbyte; + unsigned char newbyte; +} DBGPATCHINFO; + +typedef struct +{ + duint addr; + duint from; + duint to; + char comment[MAX_COMMENT_SIZE]; +} DBGCALLSTACKENTRY; + +typedef struct +{ + int total; + DBGCALLSTACKENTRY* entries; +} DBGCALLSTACK; + +typedef struct +{ + duint addr; + duint handler; +} DBGSEHRECORD; + +typedef struct +{ + duint total; + DBGSEHRECORD* records; +} DBGSEHCHAIN; + +typedef struct +{ + DWORD dwProcessId; + char szExeFile[MAX_PATH]; + char szExeMainWindowTitle[MAX_PATH]; + char szExeArgs[MAX_COMMAND_LINE_SIZE]; +} DBGPROCESSINFO; + +typedef struct +{ + DWORD rva; + BYTE type; + WORD size; +} DBGRELOCATIONINFO; + +typedef enum +{ + InstructionBody = 0, + InstructionHeading = 1, + InstructionTailing = 2, + InstructionOverlapped = 3, // The byte was executed with differing instruction base addresses + DataByte, // This and the following is not implemented yet. + DataWord, + DataDWord, + DataQWord, + DataFloat, + DataDouble, + DataLongDouble, + DataXMM, + DataYMM, + DataMMX, + DataMixed, //the byte is accessed in multiple ways + InstructionDataMixed //the byte is both executed and written +} TRACERECORDBYTETYPE; + +typedef enum +{ + TraceRecordNone, + TraceRecordBitExec, + TraceRecordByteWithExecTypeAndCounter, + TraceRecordWordWithExecTypeAndCounter +} TRACERECORDTYPE; + +typedef struct +{ + duint Handle; + unsigned char TypeNumber; + unsigned int GrantedAccess; +} HANDLEINFO; + +// The longest ip address is 1234:6789:1234:6789:1234:6789:123.567.901.345 (46 bytes) +#define TCP_ADDR_SIZE 50 + +typedef struct +{ + char RemoteAddress[TCP_ADDR_SIZE]; + unsigned short RemotePort; + char LocalAddress[TCP_ADDR_SIZE]; + unsigned short LocalPort; + char StateText[TCP_ADDR_SIZE]; + unsigned int State; +} TCPCONNECTIONINFO; + +typedef struct +{ + duint handle; + duint parent; + DWORD threadId; + DWORD style; + DWORD styleEx; + duint wndProc; + bool enabled; + RECT position; + char windowTitle[MAX_COMMENT_SIZE]; + char windowClass[MAX_COMMENT_SIZE]; +} WINDOW_INFO; + +typedef struct +{ + duint addr; + duint size; + duint flags; +} HEAPINFO; + +typedef struct +{ + const char* name; + duint value; +} CONSTANTINFO; + +typedef enum +{ + MODSYMUNLOADED = 0, + MODSYMLOADING, + MODSYMLOADED +} MODULESYMBOLSTATUS; + +typedef bool (*ASSEMBLEATEX)(duint addr, const char* instruction, char* error, bool fillnop); +typedef bool (*SECTIONFROMADDR)(duint addr, char* section); +typedef bool (*MODNAMEFROMADDR)(duint addr, char* modname, bool extension); +typedef duint(*MODBASEFROMADDR)(duint addr); +typedef duint(*MODBASEFROMNAME)(const char* modname); +typedef duint(*MODSIZEFROMADDR)(duint addr); +typedef bool (*ASSEMBLE)(duint addr, unsigned char* dest, int* size, const char* instruction, char* error); +typedef bool (*PATCHGET)(duint addr); +typedef bool (*PATCHINRANGE)(duint start, duint end); +typedef bool (*MEMPATCH)(duint va, const unsigned char* src, duint size); +typedef void (*PATCHRESTORERANGE)(duint start, duint end); +typedef bool (*PATCHENUM)(DBGPATCHINFO* patchlist, size_t* cbsize); +typedef bool (*PATCHRESTORE)(duint addr); +typedef int (*PATCHFILE)(DBGPATCHINFO* patchlist, int count, const char* szFileName, char* error); +typedef int (*MODPATHFROMADDR)(duint addr, char* path, int size); +typedef int (*MODPATHFROMNAME)(const char* modname, char* path, int size); +typedef bool (*DISASMFAST)(const unsigned char* data, duint addr, BASIC_INSTRUCTION_INFO* basicinfo); +typedef void (*MEMUPDATEMAP)(); +typedef void (*GETCALLSTACK)(DBGCALLSTACK* callstack); +typedef void (*GETSEHCHAIN)(DBGSEHCHAIN* sehchain); +typedef void (*SYMBOLDOWNLOADALLSYMBOLS)(const char* szSymbolStore); +typedef bool (*GETJIT)(char* jit, bool x64); +typedef bool (*GETJITAUTO)(bool* jitauto); +typedef bool (*GETDEFJIT)(char* defjit); +typedef bool (*GETPROCESSLIST)(DBGPROCESSINFO** entries, int* count); +typedef bool (*GETPAGERIGHTS)(duint addr, char* rights); +typedef bool (*SETPAGERIGHTS)(duint addr, const char* rights); +typedef bool (*PAGERIGHTSTOSTRING)(DWORD protect, char* rights); +typedef bool (*ISPROCESSELEVATED)(); +typedef bool (*GETCMDLINE)(char* cmdline, size_t* cbsize); +typedef bool (*SETCMDLINE)(const char* cmdline); +typedef duint(*FILEOFFSETTOVA)(const char* modname, duint offset); +typedef duint(*VATOFILEOFFSET)(duint va); +typedef duint(*GETADDRFROMLINE)(const char* szSourceFile, int line, duint* displacement); +typedef bool (*GETSOURCEFROMADDR)(duint addr, char* szSourceFile, int* line); +typedef bool (*VALFROMSTRING)(const char* string, duint* value); +typedef bool (*PATCHGETEX)(duint addr, DBGPATCHINFO* info); +typedef bool (*GETBRIDGEBP)(BPXTYPE type, duint addr, BRIDGEBP* bp); +typedef bool (*STRINGFORMATINLINE)(const char* format, size_t resultSize, char* result); +typedef void (*GETMNEMONICBRIEF)(const char* mnem, size_t resultSize, char* result); +typedef unsigned int (*GETTRACERECORDHITCOUNT)(duint address); +typedef TRACERECORDBYTETYPE(*GETTRACERECORDBYTETYPE)(duint address); +typedef bool (*SETTRACERECORDTYPE)(duint pageAddress, TRACERECORDTYPE type); +typedef TRACERECORDTYPE(*GETTRACERECORDTYPE)(duint pageAddress); +typedef bool (*ENUMHANDLES)(ListOf(HANDLEINFO) handles); +typedef bool (*GETHANDLENAME)(duint handle, char* name, size_t nameSize, char* typeName, size_t typeNameSize); +typedef bool (*ENUMTCPCONNECTIONS)(ListOf(TCPCONNECTIONINFO) connections); +typedef duint(*GETDBGEVENTS)(); +typedef MODULEPARTY(*MODGETPARTY)(duint base); +typedef void (*MODSETPARTY)(duint base, MODULEPARTY party); +typedef bool(*WATCHISWATCHDOGTRIGGERED)(unsigned int id); +typedef bool(*MEMISCODEPAGE)(duint addr, bool refresh); +typedef bool(*ANIMATECOMMAND)(const char* command); +typedef void(*DBGSETDEBUGGEEINITSCRIPT)(const char* fileName); +typedef const char* (*DBGGETDEBUGGEEINITSCRIPT)(); +typedef bool(*HANDLESENUMWINDOWS)(ListOf(WINDOW_INFO) windows); +typedef bool(*HANDLESENUMHEAPS)(ListOf(HEAPINFO) heaps); +typedef bool(*THREADGETNAME)(DWORD tid, char* name); +typedef bool(*ISDEPENABLED)(); +typedef void(*GETCALLSTACKEX)(DBGCALLSTACK* callstack, bool cache); +typedef bool(*GETUSERCOMMENT)(duint addr, char* comment); +typedef void(*ENUMCONSTANTS)(ListOf(CONSTANTINFO) constants); +typedef duint(*MEMBPSIZE)(duint addr); +typedef bool(*MODRELOCATIONSFROMADDR)(duint addr, ListOf(DBGRELOCATIONINFO) relocations); +typedef bool(*MODRELOCATIONATADDR)(duint addr, DBGRELOCATIONINFO* relocation); +typedef bool(*MODRELOCATIONSINRANGE)(duint addr, duint size, ListOf(DBGRELOCATIONINFO) relocations); +typedef duint(*DBGETHASH)(); +typedef int(*SYMAUTOCOMPLETE)(const char* Search, char** Buffer, int MaxSymbols); +typedef void(*REFRESHMODULELIST)(); +typedef duint(*GETADDRFROMLINEEX)(duint mod, const char* szSourceFile, int line); +typedef MODULESYMBOLSTATUS(*MODSYMBOLSTATUS)(duint mod); +typedef void(*GETCALLSTACKBYTHREAD)(HANDLE thread, DBGCALLSTACK* callstack); + +//The list of all the DbgFunctions() return value. +//WARNING: This list is append only. Do not insert things in the middle or plugins would break. +typedef struct DBGFUNCTIONS_ +{ + ASSEMBLEATEX AssembleAtEx; + SECTIONFROMADDR SectionFromAddr; + MODNAMEFROMADDR ModNameFromAddr; + MODBASEFROMADDR ModBaseFromAddr; + MODBASEFROMNAME ModBaseFromName; + MODSIZEFROMADDR ModSizeFromAddr; + ASSEMBLE Assemble; + PATCHGET PatchGet; + PATCHINRANGE PatchInRange; + MEMPATCH MemPatch; + PATCHRESTORERANGE PatchRestoreRange; + PATCHENUM PatchEnum; + PATCHRESTORE PatchRestore; + PATCHFILE PatchFile; + MODPATHFROMADDR ModPathFromAddr; + MODPATHFROMNAME ModPathFromName; + DISASMFAST DisasmFast; + MEMUPDATEMAP MemUpdateMap; + GETCALLSTACK GetCallStack; + GETSEHCHAIN GetSEHChain; + SYMBOLDOWNLOADALLSYMBOLS SymbolDownloadAllSymbols; + GETJITAUTO GetJitAuto; + GETJIT GetJit; + GETDEFJIT GetDefJit; + GETPROCESSLIST GetProcessList; + GETPAGERIGHTS GetPageRights; + SETPAGERIGHTS SetPageRights; + PAGERIGHTSTOSTRING PageRightsToString; + ISPROCESSELEVATED IsProcessElevated; + GETCMDLINE GetCmdline; + SETCMDLINE SetCmdline; + FILEOFFSETTOVA FileOffsetToVa; + VATOFILEOFFSET VaToFileOffset; + GETADDRFROMLINE GetAddrFromLine; + GETSOURCEFROMADDR GetSourceFromAddr; + VALFROMSTRING ValFromString; + PATCHGETEX PatchGetEx; + GETBRIDGEBP GetBridgeBp; + STRINGFORMATINLINE StringFormatInline; + GETMNEMONICBRIEF GetMnemonicBrief; + GETTRACERECORDHITCOUNT GetTraceRecordHitCount; + GETTRACERECORDBYTETYPE GetTraceRecordByteType; + SETTRACERECORDTYPE SetTraceRecordType; + GETTRACERECORDTYPE GetTraceRecordType; + ENUMHANDLES EnumHandles; + GETHANDLENAME GetHandleName; + ENUMTCPCONNECTIONS EnumTcpConnections; + GETDBGEVENTS GetDbgEvents; + MODGETPARTY ModGetParty; + MODSETPARTY ModSetParty; + WATCHISWATCHDOGTRIGGERED WatchIsWatchdogTriggered; + MEMISCODEPAGE MemIsCodePage; + ANIMATECOMMAND AnimateCommand; + DBGSETDEBUGGEEINITSCRIPT DbgSetDebuggeeInitScript; + DBGGETDEBUGGEEINITSCRIPT DbgGetDebuggeeInitScript; + HANDLESENUMWINDOWS EnumWindows; + HANDLESENUMHEAPS EnumHeaps; + THREADGETNAME ThreadGetName; + ISDEPENABLED IsDepEnabled; + GETCALLSTACKEX GetCallStackEx; + GETUSERCOMMENT GetUserComment; + ENUMCONSTANTS EnumConstants; + ENUMCONSTANTS EnumErrorCodes; + ENUMCONSTANTS EnumExceptions; + MEMBPSIZE MemBpSize; + MODRELOCATIONSFROMADDR ModRelocationsFromAddr; + MODRELOCATIONATADDR ModRelocationAtAddr; + MODRELOCATIONSINRANGE ModRelocationsInRange; + DBGETHASH DbGetHash; + SYMAUTOCOMPLETE SymAutoComplete; + REFRESHMODULELIST RefreshModuleList; + GETADDRFROMLINEEX GetAddrFromLineEx; + MODSYMBOLSTATUS ModSymbolStatus; + GETCALLSTACKBYTHREAD GetCallStackByThread; +} DBGFUNCTIONS; + +#ifdef BUILD_DBG + +const DBGFUNCTIONS* dbgfunctionsget(); +void dbgfunctionsinit(); + +#endif //BUILD_DBG + +#endif //_DBGFUNCTIONS_H + +``` + +`AutoAttach/pluginsdk/_plugin_types.h`: + +```h +#ifndef _PLUGIN_DATA_H +#define _PLUGIN_DATA_H + +#ifdef BUILD_DBG + +#include "_global.h" +#include "jansson/jansson.h" +#pragma warning(push) +#pragma warning(disable:4091) +#include +#pragma warning(pop) + +#else + +#ifdef __GNUC__ +#include "dbghelp/dbghelp.h" +#else +#pragma warning(push) +#pragma warning(disable:4091) +#include +#pragma warning(pop) +#endif // __GNUC__ + +#ifndef deflen +#define deflen 1024 +#endif // deflen + +#include "bridgemain.h" +#include "_dbgfunctions.h" +#include "jansson/jansson.h" + +#endif // BUILD_DBG + +#endif // _PLUGIN_DATA_H + +``` + +`AutoAttach/pluginsdk/_plugins.h`: + +```h +#ifndef _PLUGINS_H +#define _PLUGINS_H + +#ifndef __cplusplus +#include +#endif + +#ifndef PLUG_IMPEXP +#ifdef BUILD_DBG +#define PLUG_IMPEXP __declspec(dllexport) +#else +#define PLUG_IMPEXP __declspec(dllimport) +#endif //BUILD_DBG +#endif //PLUG_IMPEXP + +#include "_plugin_types.h" + +//default structure alignments forced +#ifdef _WIN64 +#pragma pack(push, 16) +#else //x86 +#pragma pack(push, 8) +#endif //_WIN64 + +//defines +#define PLUG_SDKVERSION 1 + +#define PLUG_DB_LOADSAVE_DATA 1 +#define PLUG_DB_LOADSAVE_ALL 2 + +//structures +typedef struct +{ + //provided by the debugger + int pluginHandle; + //provided by the pluginit function + int sdkVersion; + int pluginVersion; + char pluginName[256]; +} PLUG_INITSTRUCT; + +typedef struct +{ + //provided by the debugger + HWND hwndDlg; //gui window handle + int hMenu; //plugin menu handle + int hMenuDisasm; //plugin disasm menu handle + int hMenuDump; //plugin dump menu handle + int hMenuStack; //plugin stack menu handle + int hMenuGraph; //plugin graph menu handle + int hMenuMemmap; //plugin memory map menu handle + int hMenuSymmod; //plugin symbol module menu handle +} PLUG_SETUPSTRUCT; + +typedef struct +{ + void* data; //user data +} PLUG_SCRIPTSTRUCT; + +//callback structures +typedef struct +{ + const char* szFileName; +} PLUG_CB_INITDEBUG; + +typedef struct +{ + void* reserved; +} PLUG_CB_STOPDEBUG; + +typedef struct +{ + void* reserved; +} PLUG_CB_STOPPINGDEBUG; + +typedef struct +{ + CREATE_PROCESS_DEBUG_INFO* CreateProcessInfo; + IMAGEHLP_MODULE64* modInfo; + const char* DebugFileName; + PROCESS_INFORMATION* fdProcessInfo; +} PLUG_CB_CREATEPROCESS; + +typedef struct +{ + EXIT_PROCESS_DEBUG_INFO* ExitProcess; +} PLUG_CB_EXITPROCESS; + +typedef struct +{ + CREATE_THREAD_DEBUG_INFO* CreateThread; + DWORD dwThreadId; +} PLUG_CB_CREATETHREAD; + +typedef struct +{ + EXIT_THREAD_DEBUG_INFO* ExitThread; + DWORD dwThreadId; +} PLUG_CB_EXITTHREAD; + +typedef struct +{ + void* reserved; +} PLUG_CB_SYSTEMBREAKPOINT; + +typedef struct +{ + LOAD_DLL_DEBUG_INFO* LoadDll; + IMAGEHLP_MODULE64* modInfo; + const char* modname; +} PLUG_CB_LOADDLL; + +typedef struct +{ + UNLOAD_DLL_DEBUG_INFO* UnloadDll; +} PLUG_CB_UNLOADDLL; + +typedef struct +{ + OUTPUT_DEBUG_STRING_INFO* DebugString; +} PLUG_CB_OUTPUTDEBUGSTRING; + +typedef struct +{ + EXCEPTION_DEBUG_INFO* Exception; +} PLUG_CB_EXCEPTION; + +typedef struct +{ + BRIDGEBP* breakpoint; +} PLUG_CB_BREAKPOINT; + +typedef struct +{ + void* reserved; +} PLUG_CB_PAUSEDEBUG; + +typedef struct +{ + void* reserved; +} PLUG_CB_RESUMEDEBUG; + +typedef struct +{ + void* reserved; +} PLUG_CB_STEPPED; + +typedef struct +{ + DWORD dwProcessId; +} PLUG_CB_ATTACH; + +typedef struct +{ + PROCESS_INFORMATION* fdProcessInfo; +} PLUG_CB_DETACH; + +typedef struct +{ + DEBUG_EVENT* DebugEvent; +} PLUG_CB_DEBUGEVENT; + +typedef struct +{ + int hEntry; +} PLUG_CB_MENUENTRY; + +typedef struct +{ + MSG* message; + long* result; + bool retval; +} PLUG_CB_WINEVENT; + +typedef struct +{ + MSG* message; + bool retval; +} PLUG_CB_WINEVENTGLOBAL; + +typedef struct +{ + json_t* root; + int loadSaveType; +} PLUG_CB_LOADSAVEDB; + +typedef struct +{ + const char* symbol; + bool retval; +} PLUG_CB_FILTERSYMBOL; + +typedef struct +{ + duint cip; + bool stop; +} PLUG_CB_TRACEEXECUTE; + +typedef struct +{ + int hWindow; + duint VA; +} PLUG_CB_SELCHANGED; + +typedef struct +{ + BridgeCFGraphList graph; +} PLUG_CB_ANALYZE; + +typedef struct +{ + duint addr; + BRIDGE_ADDRINFO* addrinfo; + bool retval; +} PLUG_CB_ADDRINFO; + +typedef struct +{ + const char* string; + duint value; + int* value_size; + bool* isvar; + bool* hexonly; + bool retval; +} PLUG_CB_VALFROMSTRING; + +typedef struct +{ + const char* string; + duint value; + bool retval; +} PLUG_CB_VALTOSTRING; + +typedef struct +{ + GUIMENUTYPE hMenu; +} PLUG_CB_MENUPREPARE; + +typedef enum +{ + ValueTypeNumber, + ValueTypeString, + ValueTypeAny, // Cannot be used for values, only for argTypes (to accept any type) +} ValueType; + +typedef struct +{ + const char* ptr; // Should be allocated with BridgeAlloc + bool isOwner; // When set to true BridgeFree will be called on ptr +} StringValue; + +typedef struct +{ + ValueType type; + duint number; + StringValue string; +} ExpressionValue; + +//enums +typedef enum +{ + CB_INITDEBUG, //PLUG_CB_INITDEBUG + CB_STOPDEBUG, //PLUG_CB_STOPDEBUG + CB_CREATEPROCESS, //PLUG_CB_CREATEPROCESS + CB_EXITPROCESS, //PLUG_CB_EXITPROCESS + CB_CREATETHREAD, //PLUG_CB_CREATETHREAD + CB_EXITTHREAD, //PLUG_CB_EXITTHREAD + CB_SYSTEMBREAKPOINT, //PLUG_CB_SYSTEMBREAKPOINT + CB_LOADDLL, //PLUG_CB_LOADDLL + CB_UNLOADDLL, //PLUG_CB_UNLOADDLL + CB_OUTPUTDEBUGSTRING, //PLUG_CB_OUTPUTDEBUGSTRING + CB_EXCEPTION, //PLUG_CB_EXCEPTION + CB_BREAKPOINT, //PLUG_CB_BREAKPOINT + CB_PAUSEDEBUG, //PLUG_CB_PAUSEDEBUG + CB_RESUMEDEBUG, //PLUG_CB_RESUMEDEBUG + CB_STEPPED, //PLUG_CB_STEPPED + CB_ATTACH, //PLUG_CB_ATTACHED (before attaching, after CB_INITDEBUG) + CB_DETACH, //PLUG_CB_DETACH (before detaching, before CB_STOPDEBUG) + CB_DEBUGEVENT, //PLUG_CB_DEBUGEVENT (called on any debug event) + CB_MENUENTRY, //PLUG_CB_MENUENTRY + CB_WINEVENT, //PLUG_CB_WINEVENT + CB_WINEVENTGLOBAL, //PLUG_CB_WINEVENTGLOBAL + CB_LOADDB, //PLUG_CB_LOADSAVEDB + CB_SAVEDB, //PLUG_CB_LOADSAVEDB + CB_FILTERSYMBOL, //PLUG_CB_FILTERSYMBOL + CB_TRACEEXECUTE, //PLUG_CB_TRACEEXECUTE + CB_SELCHANGED, //PLUG_CB_SELCHANGED + CB_ANALYZE, //PLUG_CB_ANALYZE + CB_ADDRINFO, //PLUG_CB_ADDRINFO + CB_VALFROMSTRING, //PLUG_CB_VALFROMSTRING + CB_VALTOSTRING, //PLUG_CB_VALTOSTRING + CB_MENUPREPARE, //PLUG_CB_MENUPREPARE + CB_STOPPINGDEBUG, //PLUG_CB_STOPDEBUG + CB_LAST +} CBTYPE; + +typedef enum +{ + FORMAT_ERROR, //generic failure (no message) + FORMAT_SUCCESS, //success + FORMAT_ERROR_MESSAGE, //formatting failed but an error was put in the buffer (there are always at least 511 characters available). + FORMAT_BUFFER_TOO_SMALL //buffer too small (x64dbg will retry until the buffer is big enough) +} FORMATRESULT; + +//typedefs +typedef void (*CBPLUGIN)(CBTYPE cbType, void* callbackInfo); +typedef bool (*CBPLUGINCOMMAND)(int argc, char** argv); +typedef void (*CBPLUGINSCRIPT)(); +typedef duint(*CBPLUGINEXPRFUNCTION)(int argc, const duint* argv, void* userdata); +typedef bool(*CBPLUGINEXPRFUNCTIONEX)(ExpressionValue* result, int argc, const ExpressionValue* argv, void* userdata); +typedef FORMATRESULT(*CBPLUGINFORMATFUNCTION)(char* dest, size_t destCount, int argc, char* argv[], duint value, void* userdata); +typedef bool (*CBPLUGINPREDICATE)(void* userdata); + +//exports +#ifdef __cplusplus +extern "C" +{ +#endif + +PLUG_IMPEXP void _plugin_registercallback(int pluginHandle, CBTYPE cbType, CBPLUGIN cbPlugin); +PLUG_IMPEXP bool _plugin_unregistercallback(int pluginHandle, CBTYPE cbType); +PLUG_IMPEXP bool _plugin_registercommand(int pluginHandle, const char* command, CBPLUGINCOMMAND cbCommand, bool debugonly); +PLUG_IMPEXP bool _plugin_unregistercommand(int pluginHandle, const char* command); +PLUG_IMPEXP void _plugin_logprintf(const char* format, ...); +PLUG_IMPEXP void _plugin_lograw_html(const char* text); +PLUG_IMPEXP void _plugin_logputs(const char* text); +PLUG_IMPEXP void _plugin_logprint(const char* text); +PLUG_IMPEXP void _plugin_debugpause(); +PLUG_IMPEXP void _plugin_debugskipexceptions(bool skip); +PLUG_IMPEXP int _plugin_menuadd(int hMenu, const char* title); +PLUG_IMPEXP bool _plugin_menuaddentry(int hMenu, int hEntry, const char* title); +PLUG_IMPEXP bool _plugin_menuaddseparator(int hMenu); +PLUG_IMPEXP bool _plugin_menuclear(int hMenu); +PLUG_IMPEXP void _plugin_menuseticon(int hMenu, const ICONDATA* icon); +PLUG_IMPEXP void _plugin_menuentryseticon(int pluginHandle, int hEntry, const ICONDATA* icon); +PLUG_IMPEXP void _plugin_menuentrysetchecked(int pluginHandle, int hEntry, bool checked); +PLUG_IMPEXP void _plugin_menusetvisible(int pluginHandle, int hMenu, bool visible); +PLUG_IMPEXP void _plugin_menuentrysetvisible(int pluginHandle, int hEntry, bool visible); +PLUG_IMPEXP void _plugin_menusetname(int pluginHandle, int hMenu, const char* name); +PLUG_IMPEXP void _plugin_menuentrysetname(int pluginHandle, int hEntry, const char* name); +PLUG_IMPEXP void _plugin_menuentrysethotkey(int pluginHandle, int hEntry, const char* hotkey); +PLUG_IMPEXP bool _plugin_menuremove(int hMenu); +PLUG_IMPEXP bool _plugin_menuentryremove(int pluginHandle, int hEntry); +PLUG_IMPEXP void _plugin_startscript(CBPLUGINSCRIPT cbScript); +PLUG_IMPEXP bool _plugin_waituntilpaused(); +PLUG_IMPEXP bool _plugin_registerexprfunction(int pluginHandle, const char* name, int argc, CBPLUGINEXPRFUNCTION cbFunction, void* userdata); +PLUG_IMPEXP bool _plugin_registerexprfunctionex(int pluginHandle, const char* name, const ValueType & returnType, const ValueType* argTypes, size_t argCount, CBPLUGINEXPRFUNCTIONEX cbFunction, void* userdata); +PLUG_IMPEXP bool _plugin_unregisterexprfunction(int pluginHandle, const char* name); +PLUG_IMPEXP bool _plugin_unload(const char* pluginName); +PLUG_IMPEXP bool _plugin_load(const char* pluginName); +PLUG_IMPEXP duint _plugin_hash(const void* data, duint size); +PLUG_IMPEXP bool _plugin_registerformatfunction(int pluginHandle, const char* type, CBPLUGINFORMATFUNCTION cbFunction, void* userdata); +PLUG_IMPEXP bool _plugin_unregisterformatfunction(int pluginHandle, const char* type); + +#ifdef __cplusplus +} +#endif + +#pragma pack(pop) + +#endif // _PLUGINS_H + +``` + +`AutoAttach/pluginsdk/_scriptapi.h`: + +```h +#ifndef _SCRIPT_API_H +#define _SCRIPT_API_H + +#include "_plugins.h" + +#define SCRIPT_EXPORT PLUG_IMPEXP + +#endif //_SCRIPT_API_H +``` + +`AutoAttach/pluginsdk/_scriptapi_argument.h`: + +```h +#ifndef _SCRIPTAPI_ARGUMENT_H +#define _SCRIPTAPI_ARGUMENT_H + +#include "_scriptapi.h" + +namespace Script +{ + namespace Argument + { + struct ArgumentInfo + { + char mod[MAX_MODULE_SIZE]; + duint rvaStart; + duint rvaEnd; + bool manual; + duint instructioncount; + }; + + SCRIPT_EXPORT bool Add(duint start, duint end, bool manual, duint instructionCount = 0); + SCRIPT_EXPORT bool Add(const ArgumentInfo* info); + SCRIPT_EXPORT bool Get(duint addr, duint* start = nullptr, duint* end = nullptr, duint* instructionCount = nullptr); + SCRIPT_EXPORT bool GetInfo(duint addr, ArgumentInfo* info); + SCRIPT_EXPORT bool Overlaps(duint start, duint end); + SCRIPT_EXPORT bool Delete(duint address); + SCRIPT_EXPORT void DeleteRange(duint start, duint end, bool deleteManual = false); + SCRIPT_EXPORT void Clear(); + SCRIPT_EXPORT bool GetList(ListOf(ArgumentInfo) list); //caller has the responsibility to free the list + }; //Argument +}; //Script + +#endif //_SCRIPTAPI_ARGUMENT_H +``` + +`AutoAttach/pluginsdk/_scriptapi_assembler.h`: + +```h +#ifndef _SCRIPTAPI_ASSEMBLER_H +#define _SCRIPTAPI_ASSEMBLER_H + +#include "_scriptapi.h" + +namespace Script +{ + namespace Assembler + { + SCRIPT_EXPORT bool Assemble(duint addr, unsigned char* dest, int* size, const char* instruction); //dest[16] + SCRIPT_EXPORT bool AssembleEx(duint addr, unsigned char* dest, int* size, const char* instruction, char* error); //dest[16], error[MAX_ERROR_SIZE] + SCRIPT_EXPORT bool AssembleMem(duint addr, const char* instruction); + SCRIPT_EXPORT bool AssembleMemEx(duint addr, const char* instruction, int* size, char* error, bool fillnop); //error[MAX_ERROR_SIZE] + }; //Assembler +}; //Script + +#endif //_SCRIPTAPI_ASSEMBLER_H +``` + +`AutoAttach/pluginsdk/_scriptapi_bookmark.h`: + +```h +#ifndef _SCRIPTAPI_BOOKMARK_H +#define _SCRIPTAPI_BOOKMARK_H + +#include "_scriptapi.h" + +namespace Script +{ + namespace Bookmark + { + struct BookmarkInfo + { + char mod[MAX_MODULE_SIZE]; + duint rva; + bool manual; + }; + + SCRIPT_EXPORT bool Set(duint addr, bool manual = false); + SCRIPT_EXPORT bool Set(const BookmarkInfo* info); + SCRIPT_EXPORT bool Get(duint addr); + SCRIPT_EXPORT bool GetInfo(duint addr, BookmarkInfo* info); + SCRIPT_EXPORT bool Delete(duint addr); + SCRIPT_EXPORT void DeleteRange(duint start, duint end); + SCRIPT_EXPORT void Clear(); + SCRIPT_EXPORT bool GetList(ListOf(BookmarkInfo) list); //caller has the responsibility to free the list + }; //Bookmark +}; //Script + +#endif //_SCRIPTAPI_BOOKMARK_H +``` + +`AutoAttach/pluginsdk/_scriptapi_comment.h`: + +```h +#ifndef _SCRIPTAPI_COMMENT_H +#define _SCRIPTAPI_COMMENT_H + +#include "_scriptapi.h" + +namespace Script +{ + namespace Comment + { + struct CommentInfo + { + char mod[MAX_MODULE_SIZE]; + duint rva; + char text[MAX_LABEL_SIZE]; + bool manual; + }; + + SCRIPT_EXPORT bool Set(duint addr, const char* text, bool manual = false); + SCRIPT_EXPORT bool Set(const CommentInfo* info); + SCRIPT_EXPORT bool Get(duint addr, char* text); //text[MAX_COMMENT_SIZE] + SCRIPT_EXPORT bool GetInfo(duint addr, CommentInfo* info); + SCRIPT_EXPORT bool Delete(duint addr); + SCRIPT_EXPORT void DeleteRange(duint start, duint end); + SCRIPT_EXPORT void Clear(); + SCRIPT_EXPORT bool GetList(ListOf(CommentInfo) list); //caller has the responsibility to free the list + }; //Comment +}; //Script + +#endif //_SCRIPTAPI_COMMENT_H +``` + +`AutoAttach/pluginsdk/_scriptapi_debug.h`: + +```h +#ifndef _SCRIPTAPI_DEBUG_H +#define _SCRIPTAPI_DEBUG_H + +#include "_scriptapi.h" + +namespace Script +{ + namespace Debug + { + enum HardwareType + { + HardwareAccess, + HardwareWrite, + HardwareExecute + }; + + SCRIPT_EXPORT void Wait(); + SCRIPT_EXPORT void Run(); + SCRIPT_EXPORT void Pause(); + SCRIPT_EXPORT void Stop(); + SCRIPT_EXPORT void StepIn(); + SCRIPT_EXPORT void StepOver(); + SCRIPT_EXPORT void StepOut(); + SCRIPT_EXPORT bool SetBreakpoint(duint address); + SCRIPT_EXPORT bool DeleteBreakpoint(duint address); + SCRIPT_EXPORT bool DisableBreakpoint(duint address); + SCRIPT_EXPORT bool SetHardwareBreakpoint(duint address, HardwareType type = HardwareExecute); + SCRIPT_EXPORT bool DeleteHardwareBreakpoint(duint address); + }; //Debug +}; //Script + +#endif //_SCRIPTAPI_DEBUG_H +``` + +`AutoAttach/pluginsdk/_scriptapi_flag.h`: + +```h +#ifndef _SCRIPTAPI_FLAG_H +#define _SCRIPTAPI_FLAG_H + +#include "_scriptapi.h" + +namespace Script +{ + namespace Flag + { + enum FlagEnum + { + ZF, + OF, + CF, + PF, + SF, + TF, + AF, + DF, + IF + }; + + SCRIPT_EXPORT bool Get(FlagEnum flag); + SCRIPT_EXPORT bool Set(FlagEnum flag, bool value); + + SCRIPT_EXPORT bool GetZF(); + SCRIPT_EXPORT bool SetZF(bool value); + SCRIPT_EXPORT bool GetOF(); + SCRIPT_EXPORT bool SetOF(bool value); + SCRIPT_EXPORT bool GetCF(); + SCRIPT_EXPORT bool SetCF(bool value); + SCRIPT_EXPORT bool GetPF(); + SCRIPT_EXPORT bool SetPF(bool value); + SCRIPT_EXPORT bool GetSF(); + SCRIPT_EXPORT bool SetSF(bool value); + SCRIPT_EXPORT bool GetTF(); + SCRIPT_EXPORT bool SetTF(bool value); + SCRIPT_EXPORT bool GetAF(); + SCRIPT_EXPORT bool SetAF(bool value); + SCRIPT_EXPORT bool GetDF(); + SCRIPT_EXPORT bool SetDF(bool value); + SCRIPT_EXPORT bool GetIF(); + SCRIPT_EXPORT bool SetIF(bool value); + }; +}; + +#endif //_SCRIPTAPI_FLAG_H +``` + +`AutoAttach/pluginsdk/_scriptapi_function.h`: + +```h +#ifndef _SCRIPTAPI_FUNCTION_H +#define _SCRIPTAPI_FUNCTION_H + +#include "_scriptapi.h" + +namespace Script +{ + namespace Function + { + struct FunctionInfo + { + char mod[MAX_MODULE_SIZE]; + duint rvaStart; + duint rvaEnd; + bool manual; + duint instructioncount; + }; + + SCRIPT_EXPORT bool Add(duint start, duint end, bool manual, duint instructionCount = 0); + SCRIPT_EXPORT bool Add(const FunctionInfo* info); + SCRIPT_EXPORT bool Get(duint addr, duint* start = nullptr, duint* end = nullptr, duint* instructionCount = nullptr); + SCRIPT_EXPORT bool GetInfo(duint addr, FunctionInfo* info); + SCRIPT_EXPORT bool Overlaps(duint start, duint end); + SCRIPT_EXPORT bool Delete(duint address); + SCRIPT_EXPORT void DeleteRange(duint start, duint end, bool deleteManual); + SCRIPT_EXPORT void DeleteRange(duint start, duint end); + SCRIPT_EXPORT void Clear(); + SCRIPT_EXPORT bool GetList(ListOf(FunctionInfo) list); //caller has the responsibility to free the list + }; //Function +}; //Script + +#endif //_SCRIPTAPI_FUNCTION_H + +``` + +`AutoAttach/pluginsdk/_scriptapi_gui.h`: + +```h +#ifndef _SCRIPTAPI_GUI_H +#define _SCRIPTAPI_GUI_H + +#include "_scriptapi.h" + +namespace Script +{ + namespace Gui + { + namespace Disassembly + { + SCRIPT_EXPORT bool SelectionGet(duint* start, duint* end); + SCRIPT_EXPORT bool SelectionSet(duint start, duint end); + SCRIPT_EXPORT duint SelectionGetStart(); + SCRIPT_EXPORT duint SelectionGetEnd(); + }; //Disassembly + + namespace Dump + { + SCRIPT_EXPORT bool SelectionGet(duint* start, duint* end); + SCRIPT_EXPORT bool SelectionSet(duint start, duint end); + SCRIPT_EXPORT duint SelectionGetStart(); + SCRIPT_EXPORT duint SelectionGetEnd(); + }; //Dump + + namespace Stack + { + SCRIPT_EXPORT bool SelectionGet(duint* start, duint* end); + SCRIPT_EXPORT bool SelectionSet(duint start, duint end); + SCRIPT_EXPORT duint SelectionGetStart(); + SCRIPT_EXPORT duint SelectionGetEnd(); + }; //Stack + + namespace Graph + { + SCRIPT_EXPORT duint SelectionGetStart(); + }; //Graph + + namespace MemMap + { + SCRIPT_EXPORT duint SelectionGetStart(); + }; //MemoryMap + + namespace SymMod + { + SCRIPT_EXPORT duint SelectionGetStart(); + }; //SymMod + }; //Gui + + namespace Gui + { + enum Window + { + DisassemblyWindow, + DumpWindow, + StackWindow, + GraphWindow, + MemMapWindow, + SymModWindow + }; + + SCRIPT_EXPORT bool SelectionGet(Window window, duint* start, duint* end); + SCRIPT_EXPORT bool SelectionSet(Window window, duint start, duint end); + SCRIPT_EXPORT duint SelectionGetStart(Window window); + SCRIPT_EXPORT duint SelectionGetEnd(Window window); + SCRIPT_EXPORT void Message(const char* message); + SCRIPT_EXPORT bool MessageYesNo(const char* message); + SCRIPT_EXPORT bool InputLine(const char* title, char* text); //text[GUI_MAX_LINE_SIZE] + SCRIPT_EXPORT bool InputValue(const char* title, duint* value); + SCRIPT_EXPORT void Refresh(); + SCRIPT_EXPORT void AddQWidgetTab(void* qWidget); + SCRIPT_EXPORT void ShowQWidgetTab(void* qWidget); + SCRIPT_EXPORT void CloseQWidgetTab(void* qWidget); + + }; //Gui +}; //Script + +#endif //_SCRIPTAPI_GUI_H +``` + +`AutoAttach/pluginsdk/_scriptapi_label.h`: + +```h +#ifndef _SCRIPTAPI_LABEL_H +#define _SCRIPTAPI_LABEL_H + +#include "_scriptapi.h" + +namespace Script +{ + namespace Label + { + struct LabelInfo + { + char mod[MAX_MODULE_SIZE]; + duint rva; + char text[MAX_LABEL_SIZE]; + bool manual; + }; + + SCRIPT_EXPORT bool Set(duint addr, const char* text, bool manual = false); + SCRIPT_EXPORT bool Set(duint addr, const char* text, bool manual = false, bool temporary = false); + SCRIPT_EXPORT bool Set(const LabelInfo* info); + SCRIPT_EXPORT bool FromString(const char* label, duint* addr); + SCRIPT_EXPORT bool Get(duint addr, char* text); //text[MAX_LABEL_SIZE] + SCRIPT_EXPORT bool IsTemporary(duint addr); + SCRIPT_EXPORT bool GetInfo(duint addr, LabelInfo* info); + SCRIPT_EXPORT bool Delete(duint addr); + SCRIPT_EXPORT void DeleteRange(duint start, duint end); + SCRIPT_EXPORT void Clear(); + SCRIPT_EXPORT bool GetList(ListOf(LabelInfo) list); //caller has the responsibility to free the list + }; //Label +}; //Script + +#endif //_SCRIPTAPI_LABEL_H +``` + +`AutoAttach/pluginsdk/_scriptapi_memory.h`: + +```h +#ifndef _SCRIPTAPI_MEMORY_H +#define _SCRIPTAPI_MEMORY_H + +#include "_scriptapi.h" + +namespace Script +{ + namespace Memory + { + SCRIPT_EXPORT bool Read(duint addr, void* data, duint size, duint* sizeRead); + SCRIPT_EXPORT bool Write(duint addr, const void* data, duint size, duint* sizeWritten); + SCRIPT_EXPORT bool IsValidPtr(duint addr); + SCRIPT_EXPORT duint RemoteAlloc(duint addr, duint size); + SCRIPT_EXPORT bool RemoteFree(duint addr); + SCRIPT_EXPORT unsigned int GetProtect(duint addr, bool reserved = false, bool cache = true); + SCRIPT_EXPORT bool SetProtect(duint addr, unsigned int protect, duint size); + SCRIPT_EXPORT duint GetBase(duint addr, bool reserved = false, bool cache = true); + SCRIPT_EXPORT duint GetSize(duint addr, bool reserved = false, bool cache = true); + + SCRIPT_EXPORT unsigned char ReadByte(duint addr); + SCRIPT_EXPORT bool WriteByte(duint addr, unsigned char data); + SCRIPT_EXPORT unsigned short ReadWord(duint addr); + SCRIPT_EXPORT bool WriteWord(duint addr, unsigned short data); + SCRIPT_EXPORT unsigned int ReadDword(duint addr); + SCRIPT_EXPORT bool WriteDword(duint addr, unsigned int data); + SCRIPT_EXPORT unsigned long long ReadQword(duint addr); + SCRIPT_EXPORT bool WriteQword(duint addr, unsigned long long data); + SCRIPT_EXPORT duint ReadPtr(duint addr); + SCRIPT_EXPORT bool WritePtr(duint addr, duint data); + }; //Memory +}; //Script + +#endif //_SCRIPTAPI_MEMORY_H +``` + +`AutoAttach/pluginsdk/_scriptapi_misc.h`: + +```h +#ifndef _SCRIPTAPI_MISC_H +#define _SCRIPTAPI_MISC_H + +#include "_scriptapi.h" + +namespace Script +{ + namespace Misc + { + /// + /// Evaluates an expression and returns the result. Analagous to using the Command field in x64dbg. + /// + /// Expressions can consist of memory locations, registers, flags, API names, labels, symbols, variables etc. + /// + /// Example: bool success = ParseExpression("[esp+8]", &val) + /// + /// The expression to evaluate. + /// The result of the expression. + /// True on success, False on failure. + SCRIPT_EXPORT bool ParseExpression(const char* expression, duint* value); + + /// + /// Returns the address of a function in the debuggee's memory space. + /// + /// Example: duint addr = RemoteGetProcAddress("kernel32.dll", "GetProcAddress") + /// + /// The name of the module. + /// The name of the function. + /// The address of the function in the debuggee. + SCRIPT_EXPORT duint RemoteGetProcAddress(const char* module, const char* api); + + /// + /// Returns the address for a label created in the disassembly window. + /// + /// Example: duint addr = ResolveLabel("sneaky_crypto") + /// + /// The name of the label to resolve. + /// The memory address for the label. + SCRIPT_EXPORT duint ResolveLabel(const char* label); + + /// + /// Allocates the requested number of bytes from x64dbg's default process heap. + /// + /// Note: this allocation is in the debugger, not the debuggee. + /// + /// Memory allocated using this function should be Free'd after use. + /// + /// Example: void* addr = Alloc(0x100000) + /// + /// Number of bytes to allocate. + /// A pointer to the newly allocated memory. + SCRIPT_EXPORT void* Alloc(duint size); + + /// + /// Frees memory previously allocated by Alloc. + /// + /// Example: Free(addr) + /// + /// Pointer returned by Alloc. + /// Nothing. + SCRIPT_EXPORT void Free(void* ptr); + }; //Misc +}; //Script + +#endif //_SCRIPTAPI_MISC_H +``` + +`AutoAttach/pluginsdk/_scriptapi_module.h`: + +```h +#ifndef _SCRIPTAPI_MODULE_H +#define _SCRIPTAPI_MODULE_H + +#include "_scriptapi.h" + +namespace Script +{ + namespace Module + { + struct ModuleInfo + { + duint base; + duint size; + duint entry; + int sectionCount; + char name[MAX_MODULE_SIZE]; + char path[MAX_PATH]; + }; + + struct ModuleSectionInfo + { + duint addr; + duint size; + char name[MAX_SECTION_SIZE * 5]; + }; + + struct ModuleExport + { + duint ordinal; + duint rva; + duint va; + bool forwarded; + char forwardName[MAX_STRING_SIZE]; + char name[MAX_STRING_SIZE]; + char undecoratedName[MAX_STRING_SIZE]; + }; + + struct ModuleImport + { + duint iatRva; + duint iatVa; + duint ordinal; //equal to -1 if imported by name + char name[MAX_STRING_SIZE]; + char undecoratedName[MAX_STRING_SIZE]; + }; + + SCRIPT_EXPORT bool InfoFromAddr(duint addr, ModuleInfo* info); + SCRIPT_EXPORT bool InfoFromName(const char* name, ModuleInfo* info); + SCRIPT_EXPORT duint BaseFromAddr(duint addr); + SCRIPT_EXPORT duint BaseFromName(const char* name); + SCRIPT_EXPORT duint SizeFromAddr(duint addr); + SCRIPT_EXPORT duint SizeFromName(const char* name); + SCRIPT_EXPORT bool NameFromAddr(duint addr, char* name); //name[MAX_MODULE_SIZE] + SCRIPT_EXPORT bool PathFromAddr(duint addr, char* path); //path[MAX_PATH] + SCRIPT_EXPORT bool PathFromName(const char* name, char* path); //path[MAX_PATH] + SCRIPT_EXPORT duint EntryFromAddr(duint addr); + SCRIPT_EXPORT duint EntryFromName(const char* name); + SCRIPT_EXPORT int SectionCountFromAddr(duint addr); + SCRIPT_EXPORT int SectionCountFromName(const char* name); + SCRIPT_EXPORT bool SectionFromAddr(duint addr, int number, ModuleSectionInfo* section); + SCRIPT_EXPORT bool SectionFromName(const char* name, int number, ModuleSectionInfo* section); + SCRIPT_EXPORT bool SectionListFromAddr(duint addr, ListOf(ModuleSectionInfo) list); + SCRIPT_EXPORT bool SectionListFromName(const char* name, ListOf(ModuleSectionInfo) list); + SCRIPT_EXPORT bool GetMainModuleInfo(ModuleInfo* info); + SCRIPT_EXPORT duint GetMainModuleBase(); + SCRIPT_EXPORT duint GetMainModuleSize(); + SCRIPT_EXPORT duint GetMainModuleEntry(); + SCRIPT_EXPORT int GetMainModuleSectionCount(); + SCRIPT_EXPORT bool GetMainModuleName(char* name); //name[MAX_MODULE_SIZE] + SCRIPT_EXPORT bool GetMainModulePath(char* path); //path[MAX_PATH] + SCRIPT_EXPORT bool GetMainModuleSectionList(ListOf(ModuleSectionInfo) list); //caller has the responsibility to free the list + SCRIPT_EXPORT bool GetList(ListOf(ModuleInfo) list); //caller has the responsibility to free the list + SCRIPT_EXPORT bool GetExports(const ModuleInfo* mod, ListOf(ModuleExport) list); //caller has the responsibility to free the list + SCRIPT_EXPORT bool GetImports(const ModuleInfo* mod, ListOf(ModuleImport) list); //caller has the responsibility to free the list + }; //Module +}; //Script + +#endif //_SCRIPTAPI_MODULE_H + +``` + +`AutoAttach/pluginsdk/_scriptapi_pattern.h`: + +```h +#ifndef _SCRIPTAPI_PATTERN_H +#define _SCRIPTAPI_PATTERN_H + +#include "_scriptapi.h" + +namespace Script +{ + namespace Pattern + { + SCRIPT_EXPORT duint Find(unsigned char* data, duint datasize, const char* pattern); + SCRIPT_EXPORT duint FindMem(duint start, duint size, const char* pattern); + SCRIPT_EXPORT void Write(unsigned char* data, duint datasize, const char* pattern); + SCRIPT_EXPORT void WriteMem(duint start, duint size, const char* pattern); + SCRIPT_EXPORT bool SearchAndReplace(unsigned char* data, duint datasize, const char* searchpattern, const char* replacepattern); + SCRIPT_EXPORT bool SearchAndReplaceMem(duint start, duint size, const char* searchpattern, const char* replacepattern); + }; +}; + +#endif //_SCRIPTAPI_FIND_H +``` + +`AutoAttach/pluginsdk/_scriptapi_register.h`: + +```h +#ifndef _SCRIPTAPI_REGISTER_H +#define _SCRIPTAPI_REGISTER_H + +#include "_scriptapi.h" + +namespace Script +{ + namespace Register + { + enum RegisterEnum + { + DR0, + DR1, + DR2, + DR3, + DR6, + DR7, + + EAX, + AX, + AH, + AL, + EBX, + BX, + BH, + BL, + ECX, + CX, + CH, + CL, + EDX, + DX, + DH, + DL, + EDI, + DI, + ESI, + SI, + EBP, + BP, + ESP, + SP, + EIP, + +#ifdef _WIN64 + RAX, + RBX, + RCX, + RDX, + RSI, + SIL, + RDI, + DIL, + RBP, + BPL, + RSP, + SPL, + RIP, + R8, + R8D, + R8W, + R8B, + R9, + R9D, + R9W, + R9B, + R10, + R10D, + R10W, + R10B, + R11, + R11D, + R11W, + R11B, + R12, + R12D, + R12W, + R12B, + R13, + R13D, + R13W, + R13B, + R14, + R14D, + R14W, + R14B, + R15, + R15D, + R15W, + R15B, +#endif //_WIN64 + + CIP, + CSP, + CAX, + CBX, + CCX, + CDX, + CDI, + CSI, + CBP, + CFLAGS + }; //RegisterEnum + + SCRIPT_EXPORT duint Get(RegisterEnum reg); + SCRIPT_EXPORT bool Set(RegisterEnum reg, duint value); + SCRIPT_EXPORT int Size(); //gets architecture register size in bytes + + SCRIPT_EXPORT duint GetDR0(); + SCRIPT_EXPORT bool SetDR0(duint value); + SCRIPT_EXPORT duint GetDR1(); + SCRIPT_EXPORT bool SetDR1(duint value); + SCRIPT_EXPORT duint GetDR2(); + SCRIPT_EXPORT bool SetDR2(duint value); + SCRIPT_EXPORT duint GetDR3(); + SCRIPT_EXPORT bool SetDR3(duint value); + SCRIPT_EXPORT duint GetDR6(); + SCRIPT_EXPORT bool SetDR6(duint value); + SCRIPT_EXPORT duint GetDR7(); + SCRIPT_EXPORT bool SetDR7(duint value); + + SCRIPT_EXPORT unsigned int GetEAX(); + SCRIPT_EXPORT bool SetEAX(unsigned int value); + SCRIPT_EXPORT unsigned short GetAX(); + SCRIPT_EXPORT bool SetAX(unsigned short value); + SCRIPT_EXPORT unsigned char GetAH(); + SCRIPT_EXPORT bool SetAH(unsigned char value); + SCRIPT_EXPORT unsigned char GetAL(); + SCRIPT_EXPORT bool SetAL(unsigned char value); + SCRIPT_EXPORT unsigned int GetEBX(); + SCRIPT_EXPORT bool SetEBX(unsigned int value); + SCRIPT_EXPORT unsigned short GetBX(); + SCRIPT_EXPORT bool SetBX(unsigned short value); + SCRIPT_EXPORT unsigned char GetBH(); + SCRIPT_EXPORT bool SetBH(unsigned char value); + SCRIPT_EXPORT unsigned char GetBL(); + SCRIPT_EXPORT bool SetBL(unsigned char value); + SCRIPT_EXPORT unsigned int GetECX(); + SCRIPT_EXPORT bool SetECX(unsigned int value); + SCRIPT_EXPORT unsigned short GetCX(); + SCRIPT_EXPORT bool SetCX(unsigned short value); + SCRIPT_EXPORT unsigned char GetCH(); + SCRIPT_EXPORT bool SetCH(unsigned char value); + SCRIPT_EXPORT unsigned char GetCL(); + SCRIPT_EXPORT bool SetCL(unsigned char value); + SCRIPT_EXPORT unsigned int GetEDX(); + SCRIPT_EXPORT bool SetEDX(unsigned int value); + SCRIPT_EXPORT unsigned short GetDX(); + SCRIPT_EXPORT bool SetDX(unsigned short value); + SCRIPT_EXPORT unsigned char GetDH(); + SCRIPT_EXPORT bool SetDH(unsigned char value); + SCRIPT_EXPORT unsigned char GetDL(); + SCRIPT_EXPORT bool SetDL(unsigned char value); + SCRIPT_EXPORT unsigned int GetEDI(); + SCRIPT_EXPORT bool SetEDI(unsigned int value); + SCRIPT_EXPORT unsigned short GetDI(); + SCRIPT_EXPORT bool SetDI(unsigned short value); + SCRIPT_EXPORT unsigned int GetESI(); + SCRIPT_EXPORT bool SetESI(unsigned int value); + SCRIPT_EXPORT unsigned short GetSI(); + SCRIPT_EXPORT bool SetSI(unsigned short value); + SCRIPT_EXPORT unsigned int GetEBP(); + SCRIPT_EXPORT bool SetEBP(unsigned int value); + SCRIPT_EXPORT unsigned short GetBP(); + SCRIPT_EXPORT bool SetBP(unsigned short value); + SCRIPT_EXPORT unsigned int GetESP(); + SCRIPT_EXPORT bool SetESP(unsigned int value); + SCRIPT_EXPORT unsigned short GetSP(); + SCRIPT_EXPORT bool SetSP(unsigned short value); + SCRIPT_EXPORT unsigned int GetEIP(); + SCRIPT_EXPORT bool SetEIP(unsigned int value); + +#ifdef _WIN64 + SCRIPT_EXPORT unsigned long long GetRAX(); + SCRIPT_EXPORT bool SetRAX(unsigned long long value); + SCRIPT_EXPORT unsigned long long GetRBX(); + SCRIPT_EXPORT bool SetRBX(unsigned long long value); + SCRIPT_EXPORT unsigned long long GetRCX(); + SCRIPT_EXPORT bool SetRCX(unsigned long long value); + SCRIPT_EXPORT unsigned long long GetRDX(); + SCRIPT_EXPORT bool SetRDX(unsigned long long value); + SCRIPT_EXPORT unsigned long long GetRSI(); + SCRIPT_EXPORT bool SetRSI(unsigned long long value); + SCRIPT_EXPORT unsigned char GetSIL(); + SCRIPT_EXPORT bool SetSIL(unsigned char value); + SCRIPT_EXPORT unsigned long long GetRDI(); + SCRIPT_EXPORT bool SetRDI(unsigned long long value); + SCRIPT_EXPORT unsigned char GetDIL(); + SCRIPT_EXPORT bool SetDIL(unsigned char value); + SCRIPT_EXPORT unsigned long long GetRBP(); + SCRIPT_EXPORT bool SetRBP(unsigned long long value); + SCRIPT_EXPORT unsigned char GetBPL(); + SCRIPT_EXPORT bool SetBPL(unsigned char value); + SCRIPT_EXPORT unsigned long long GetRSP(); + SCRIPT_EXPORT bool SetRSP(unsigned long long value); + SCRIPT_EXPORT unsigned char GetSPL(); + SCRIPT_EXPORT bool SetSPL(unsigned char value); + SCRIPT_EXPORT unsigned long long GetRIP(); + SCRIPT_EXPORT bool SetRIP(unsigned long long value); + SCRIPT_EXPORT unsigned long long GetR8(); + SCRIPT_EXPORT bool SetR8(unsigned long long value); + SCRIPT_EXPORT unsigned int GetR8D(); + SCRIPT_EXPORT bool SetR8D(unsigned int value); + SCRIPT_EXPORT unsigned short GetR8W(); + SCRIPT_EXPORT bool SetR8W(unsigned short value); + SCRIPT_EXPORT unsigned char GetR8B(); + SCRIPT_EXPORT bool SetR8B(unsigned char value); + SCRIPT_EXPORT unsigned long long GetR9(); + SCRIPT_EXPORT bool SetR9(unsigned long long value); + SCRIPT_EXPORT unsigned int GetR9D(); + SCRIPT_EXPORT bool SetR9D(unsigned int value); + SCRIPT_EXPORT unsigned short GetR9W(); + SCRIPT_EXPORT bool SetR9W(unsigned short value); + SCRIPT_EXPORT unsigned char GetR9B(); + SCRIPT_EXPORT bool SetR9B(unsigned char value); + SCRIPT_EXPORT unsigned long long GetR10(); + SCRIPT_EXPORT bool SetR10(unsigned long long value); + SCRIPT_EXPORT unsigned int GetR10D(); + SCRIPT_EXPORT bool SetR10D(unsigned int value); + SCRIPT_EXPORT unsigned short GetR10W(); + SCRIPT_EXPORT bool SetR10W(unsigned short value); + SCRIPT_EXPORT unsigned char GetR10B(); + SCRIPT_EXPORT bool SetR10B(unsigned char value); + SCRIPT_EXPORT unsigned long long GetR11(); + SCRIPT_EXPORT bool SetR11(unsigned long long value); + SCRIPT_EXPORT unsigned int GetR11D(); + SCRIPT_EXPORT bool SetR11D(unsigned int value); + SCRIPT_EXPORT unsigned short GetR11W(); + SCRIPT_EXPORT bool SetR11W(unsigned short value); + SCRIPT_EXPORT unsigned char GetR11B(); + SCRIPT_EXPORT bool SetR11B(unsigned char value); + SCRIPT_EXPORT unsigned long long GetR12(); + SCRIPT_EXPORT bool SetR12(unsigned long long value); + SCRIPT_EXPORT unsigned int GetR12D(); + SCRIPT_EXPORT bool SetR12D(unsigned int value); + SCRIPT_EXPORT unsigned short GetR12W(); + SCRIPT_EXPORT bool SetR12W(unsigned short value); + SCRIPT_EXPORT unsigned char GetR12B(); + SCRIPT_EXPORT bool SetR12B(unsigned char value); + SCRIPT_EXPORT unsigned long long GetR13(); + SCRIPT_EXPORT bool SetR13(unsigned long long value); + SCRIPT_EXPORT unsigned int GetR13D(); + SCRIPT_EXPORT bool SetR13D(unsigned int value); + SCRIPT_EXPORT unsigned short GetR13W(); + SCRIPT_EXPORT bool SetR13W(unsigned short value); + SCRIPT_EXPORT unsigned char GetR13B(); + SCRIPT_EXPORT bool SetR13B(unsigned char value); + SCRIPT_EXPORT unsigned long long GetR14(); + SCRIPT_EXPORT bool SetR14(unsigned long long value); + SCRIPT_EXPORT unsigned int GetR14D(); + SCRIPT_EXPORT bool SetR14D(unsigned int value); + SCRIPT_EXPORT unsigned short GetR14W(); + SCRIPT_EXPORT bool SetR14W(unsigned short value); + SCRIPT_EXPORT unsigned char GetR14B(); + SCRIPT_EXPORT bool SetR14B(unsigned char value); + SCRIPT_EXPORT unsigned long long GetR15(); + SCRIPT_EXPORT bool SetR15(unsigned long long value); + SCRIPT_EXPORT unsigned int GetR15D(); + SCRIPT_EXPORT bool SetR15D(unsigned int value); + SCRIPT_EXPORT unsigned short GetR15W(); + SCRIPT_EXPORT bool SetR15W(unsigned short value); + SCRIPT_EXPORT unsigned char GetR15B(); + SCRIPT_EXPORT bool SetR15B(unsigned char value); +#endif //_WIN64 + + SCRIPT_EXPORT duint GetCAX(); + SCRIPT_EXPORT bool SetCAX(duint value); + SCRIPT_EXPORT duint GetCBX(); + SCRIPT_EXPORT bool SetCBX(duint value); + SCRIPT_EXPORT duint GetCCX(); + SCRIPT_EXPORT bool SetCCX(duint value); + SCRIPT_EXPORT duint GetCDX(); + SCRIPT_EXPORT bool SetCDX(duint value); + SCRIPT_EXPORT duint GetCDI(); + SCRIPT_EXPORT bool SetCDI(duint value); + SCRIPT_EXPORT duint GetCSI(); + SCRIPT_EXPORT bool SetCSI(duint value); + SCRIPT_EXPORT duint GetCBP(); + SCRIPT_EXPORT bool SetCBP(duint value); + SCRIPT_EXPORT duint GetCSP(); + SCRIPT_EXPORT bool SetCSP(duint value); + SCRIPT_EXPORT duint GetCIP(); + SCRIPT_EXPORT bool SetCIP(duint value); + SCRIPT_EXPORT duint GetCFLAGS(); + SCRIPT_EXPORT bool SetCFLAGS(duint value); + }; //Register +}; //Script + +#endif //_SCRIPTAPI_REGISTER_H +``` + +`AutoAttach/pluginsdk/_scriptapi_stack.h`: + +```h +#ifndef _SCRIPTAPI_STACK_H +#define _SCRIPTAPI_STACK_H + +#include "_scriptapi.h" + +namespace Script +{ + namespace Stack + { + SCRIPT_EXPORT duint Pop(); + SCRIPT_EXPORT duint Push(duint value); //returns the previous top, equal to Peek(1) + SCRIPT_EXPORT duint Peek(int offset = 0); //offset is in multiples of Register::Size(), for easy x32/x64 portability + }; //Stack +}; //Script + +#endif //_SCRIPTAPI_STACK_H +``` + +`AutoAttach/pluginsdk/_scriptapi_symbol.h`: + +```h +#ifndef _SCRIPTAPI_SYMBOL_H +#define _SCRIPTAPI_SYMBOL_H + +#include "_scriptapi.h" + +namespace Script +{ + namespace Symbol + { + enum SymbolType + { + Function, //user-defined function + Import, //IAT entry + Export //export + }; + + struct SymbolInfo + { + char mod[MAX_MODULE_SIZE]; + duint rva; + char name[MAX_LABEL_SIZE]; + bool manual; + SymbolType type; + }; + + SCRIPT_EXPORT bool GetList(ListOf(SymbolInfo) list); //caller has the responsibility to free the list + }; //Symbol +}; //Script + +#endif //_SCRIPTAPI_SYMBOL_H +``` + +`AutoAttach/pluginsdk/bridgegraph.h`: + +```h +#ifndef _GRAPH_H +#define _GRAPH_H + +typedef struct +{ + duint addr; //virtual address of the instruction + unsigned char data[15]; //instruction bytes +} BridgeCFInstruction; + +typedef struct +{ + duint parentGraph; //function of which this node is a part + duint start; //start of the block + duint end; //end of the block (inclusive) + duint brtrue; //destination if condition is true + duint brfalse; //destination if condition is false + duint icount; //number of instructions in node + bool terminal; //node is a RET + bool split; //node is a split (brtrue points to the next node) + bool indirectcall; //node contains indirect calls (call reg, call [reg+X]) + void* userdata; //user data + ListInfo exits; //exits (including brtrue and brfalse, duint) + ListInfo instrs; //block instructions +} BridgeCFNodeList; + +typedef struct +{ + duint entryPoint; //graph entry point + void* userdata; //user data + ListInfo nodes; //graph nodes (BridgeCFNodeList) +} BridgeCFGraphList; + +#ifdef __cplusplus +#if _MSC_VER >= 1700 && !defined(NO_CPP11) + +#include +#include +#include +#include + +struct BridgeCFNode +{ + duint parentGraph = 0; //function of which this node is a part + duint start = 0; //va of the first instruction in the block + duint end = 0; //va of the last instruction in the block (inclusive) + duint brtrue = 0; //destination if condition is true + duint brfalse = 0; //destination if condition is false + duint icount = 0; //number of instructions in node + bool terminal = false; //node is a RET + bool split = false; //node is a split (brtrue points to the next node) + bool indirectcall = false; //node contains indirect calls (call reg, call [reg+X]) + void* userdata = nullptr; //user data + std::vector exits; //exits (including brtrue and brfalse) + std::vector instrs; //block instructions + + static void Free(const BridgeCFNodeList* nodeList) + { + if(!BridgeList::Free(&nodeList->exits)) + __debugbreak(); + if(!BridgeList::Free(&nodeList->instrs)) + __debugbreak(); + } + + BridgeCFNode() = default; + + BridgeCFNode(const BridgeCFNodeList* nodeList, bool freedata) + { + if(!nodeList) + __debugbreak(); + parentGraph = nodeList->parentGraph; + start = nodeList->start; + end = nodeList->end; + brtrue = nodeList->brtrue; + brfalse = nodeList->brfalse; + icount = nodeList->icount; + terminal = nodeList->terminal; + indirectcall = nodeList->indirectcall; + split = nodeList->split; + userdata = nodeList->userdata; + if(!BridgeList::ToVector(&nodeList->exits, exits, freedata)) + __debugbreak(); + if(!BridgeList::ToVector(&nodeList->instrs, instrs, freedata)) + __debugbreak(); + } + + BridgeCFNode(duint parentGraph, duint start, duint end) + : parentGraph(parentGraph), + start(start), + end(end) + { + } + + BridgeCFNodeList ToNodeList() const + { + BridgeCFNodeList out; + out.parentGraph = parentGraph; + out.start = start; + out.end = end; + out.brtrue = brtrue; + out.brfalse = brfalse; + out.icount = icount; + out.terminal = terminal; + out.indirectcall = indirectcall; + out.split = split; + out.userdata = userdata; + BridgeList::CopyData(&out.exits, exits); + BridgeList::CopyData(&out.instrs, instrs); + return std::move(out); + } +}; + +struct BridgeCFGraph +{ + duint entryPoint; //graph entry point + void* userdata; //user data + std::unordered_map nodes; //CFNode.start -> CFNode + std::unordered_map> parents; //CFNode.start -> parents + + static void Free(const BridgeCFGraphList* graphList) + { + if(!graphList || graphList->nodes.size != graphList->nodes.count * sizeof(BridgeCFNodeList)) + __debugbreak(); + auto data = (BridgeCFNodeList*)graphList->nodes.data; + for(int i = 0; i < graphList->nodes.count; i++) + BridgeCFNode::Free(&data[i]); + BridgeFree(data); + } + + explicit BridgeCFGraph(const BridgeCFGraphList* graphList, bool freedata) + { + if(!graphList || graphList->nodes.size != graphList->nodes.count * sizeof(BridgeCFNodeList)) + __debugbreak(); + entryPoint = graphList->entryPoint; + userdata = graphList->userdata; + auto data = (BridgeCFNodeList*)graphList->nodes.data; + for(int i = 0; i < graphList->nodes.count; i++) + AddNode(BridgeCFNode(&data[i], freedata)); + if(freedata && data) + BridgeFree(data); + } + + explicit BridgeCFGraph(duint entryPoint) + : entryPoint(entryPoint), + userdata(nullptr) + { + } + + void AddNode(const BridgeCFNode & node) + { + nodes[node.start] = node; + AddParent(node.start, node.brtrue); + AddParent(node.start, node.brfalse); + } + + void AddParent(duint child, duint parent) + { + if(!child || !parent) + return; + auto found = parents.find(child); + if(found == parents.end()) + { + parents[child] = std::unordered_set(); + parents[child].insert(parent); + } + else + found->second.insert(parent); + } + + BridgeCFGraphList ToGraphList() const + { + BridgeCFGraphList out; + out.entryPoint = entryPoint; + out.userdata = userdata; + std::vector nodeList; + nodeList.reserve(nodes.size()); + for(const auto & nodeIt : nodes) + nodeList.push_back(nodeIt.second.ToNodeList()); + BridgeList::CopyData(&out.nodes, nodeList); + return std::move(out); + } +}; + +#endif //_MSC_VER +#endif //__cplusplus + +#endif //_GRAPH_H +``` + +`AutoAttach/pluginsdk/bridgelist.h`: + +```h +#ifndef _LIST_H +#define _LIST_H + +typedef struct +{ + int count; //Number of element in the list. + size_t size; //Size of list in bytes (used for type checking). + void* data; //Pointer to the list contents. Must be deleted by the caller using BridgeFree (or BridgeList::Free). +} ListInfo; + +#define ListOf(Type) ListInfo* + +#ifdef __cplusplus + +#include + +/** +\brief A list object. This object is NOT thread safe. +\tparam Type BridgeList contents type. +*/ +template +class BridgeList +{ +public: + /** + \brief BridgeList constructor. + \param _freeData (Optional) the free function. + */ + explicit BridgeList() + { + memset(&_listInfo, 0, sizeof(_listInfo)); + } + + /** + \brief BridgeList destructor. + */ + ~BridgeList() + { + Cleanup(); + } + + /** + \brief Gets the list data. + \return Returns ListInfo->data. Can be null if the list was never initialized. Will be destroyed once this object goes out of scope! + */ + Type* Data() const + { + return reinterpret_cast(_listInfo.data); + } + + /** + \brief Gets the number of elements in the list. This will crash the program if the data is not consistent with the specified template argument. + \return The number of elements in the list. + */ + int Count() const + { + if(_listInfo.size != _listInfo.count * sizeof(Type)) //make sure the user is using the correct type. + __debugbreak(); + return _listInfo.count; + } + + /** + \brief Cleans up the list, freeing the list data when it is not null. + */ + void Cleanup() + { + if(_listInfo.data) + { + BridgeFree(_listInfo.data); + _listInfo.data = nullptr; + } + } + + /** + \brief Reference operator (cleans up the previous list) + \return Pointer to the ListInfo. + */ + ListInfo* operator&() + { + Cleanup(); + return &_listInfo; + } + + /** + \brief Array indexer operator. This will crash if you try to access out-of-bounds. + \param index Zero-based index of the item you want to get. + \return Reference to a value at that index. + */ + Type & operator[](size_t index) const + { + if(index >= size_t(Count())) //make sure the out-of-bounds access is caught as soon as possible. + __debugbreak(); + return Data()[index]; + } + + /** + \brief Copies data to a ListInfo structure.. + \param [out] listInfo If non-null, information describing the list. + \param listData Data to copy in the ListInfo structure. + \return true if it succeeds, false if it fails. + */ + static bool CopyData(ListInfo* listInfo, const std::vector & listData) + { + if(!listInfo) + return false; + listInfo->count = int(listData.size()); + listInfo->size = listInfo->count * sizeof(Type); + if(listInfo->count) + { + listInfo->data = BridgeAlloc(listInfo->size); + Type* curItem = reinterpret_cast(listInfo->data); + for(const auto & item : listData) + { + *curItem = item; + ++curItem; + } + } + else + listInfo->data = nullptr; + return true; + } + + static bool Free(const ListInfo* listInfo) + { + if(!listInfo || listInfo->size != listInfo->count * sizeof(Type) || (listInfo->count && !listInfo->data)) + return false; + BridgeFree(listInfo->data); + return true; + } + + static bool ToVector(const ListInfo* listInfo, std::vector & listData, bool freedata = true) + { + if(!listInfo || listInfo->size != listInfo->count * sizeof(Type) || (listInfo->count && !listInfo->data)) + return false; + listData.resize(listInfo->count); + for(int i = 0; i < listInfo->count; i++) + listData[i] = ((Type*)listInfo->data)[i]; + if(freedata && listInfo->data) + BridgeFree(listInfo->data); + return true; + } + +private: + ListInfo _listInfo; +}; + +#endif //__cplusplus + +#endif //_LIST_H +``` + +`AutoAttach/pluginsdk/bridgemain.h`: + +```h +#ifndef _BRIDGEMAIN_H_ +#define _BRIDGEMAIN_H_ + +#include + +#ifndef __cplusplus +#include +#define DEFAULT_PARAM(name, value) name +#else +#define DEFAULT_PARAM(name, value) name = value +#endif + +//default structure alignments forced +#ifdef _WIN64 +#pragma pack(push, 16) +#else //x86 +#pragma pack(push, 8) +#endif //_WIN64 + +#ifdef _WIN64 +typedef unsigned long long duint; +typedef signed long long dsint; +#else +typedef unsigned long duint; +typedef signed long dsint; +#endif //_WIN64 + +#ifndef BRIDGE_IMPEXP +#ifdef BUILD_BRIDGE +#define BRIDGE_IMPEXP __declspec(dllexport) +#else +#define BRIDGE_IMPEXP __declspec(dllimport) +#endif //BUILD_BRIDGE +#endif //BRIDGE_IMPEXP + +#ifdef __cplusplus +extern "C" +{ +#endif + +//Bridge defines +#define MAX_SETTING_SIZE 65536 +#define DBG_VERSION 25 + +//Bridge functions + +/// +/// Initialize the bridge. +/// +/// On error it returns a non-null error message. +BRIDGE_IMPEXP const wchar_t* BridgeInit(); + +/// +/// Start the bridge. +/// +/// On error it returns a non-null error message. +BRIDGE_IMPEXP const wchar_t* BridgeStart(); + +/// +/// Allocate buffer. Use BridgeFree to free the buffer. +/// +/// Size in bytes of the buffer to allocate. +/// A pointer to the allocated buffer. This function will trigger a crash dump if unsuccessful. +BRIDGE_IMPEXP void* BridgeAlloc(size_t size); + +/// +/// Free buffer allocated by BridgeAlloc. +/// +/// Buffer to free. +BRIDGE_IMPEXP void BridgeFree(void* ptr); + +/// +/// Get a string setting from the in-memory setting store. +/// +/// Section the setting is in. Cannot be null. +/// Setting key (name). Cannot be null. +/// Output buffer for the value. Should be of MAX_SETTING_SIZE. Cannot be null. +/// True if the setting was found and copied in the value parameter. +BRIDGE_IMPEXP bool BridgeSettingGet(const char* section, const char* key, char* value); + +/// +/// Get an integer setting from the in-memory setting store. +/// +/// Section the setting is in. Cannot be null. +/// Setting key (name). Cannot be null. +/// Output value. +/// True if the setting was found and successfully converted to an integer. +BRIDGE_IMPEXP bool BridgeSettingGetUint(const char* section, const char* key, duint* value); + +/// +/// Set a string setting in the in-memory setting store. +/// +/// Section the setting is in. Cannot be null. +/// Setting key (name). Set to null to clear the whole section. +/// New setting value. Set to null to remove the key from the section. +/// True if the operation was successful. +BRIDGE_IMPEXP bool BridgeSettingSet(const char* section, const char* key, const char* value); + +/// +/// Set an integer setting in the in-memory setting store. +/// +/// Section the setting is in. Cannot be null. +/// Setting key (name). Set to null to clear the whole section. +/// New setting value. +/// True if the operation was successful. +BRIDGE_IMPEXP bool BridgeSettingSetUint(const char* section, const char* key, duint value); + +/// +/// Flush the in-memory setting store to disk. +/// +/// +BRIDGE_IMPEXP bool BridgeSettingFlush(); + +/// +/// Read the in-memory setting store from disk. +/// +/// Line where the error occurred. Set to null to ignore this. +/// True if the setting were read and parsed correctly. +BRIDGE_IMPEXP bool BridgeSettingRead(int* errorLine); + +/// +/// Get the debugger version. +/// +/// 25 +BRIDGE_IMPEXP int BridgeGetDbgVersion(); + +/// +/// Checks if the current process is elevated. +/// +/// true if the process is elevated, false otherwise. +BRIDGE_IMPEXP bool BridgeIsProcessElevated(); + +/// +/// Gets the NT build number from the operating system. +/// +/// NtBuildNumber +BRIDGE_IMPEXP unsigned int BridgeGetNtBuildNumber(); + +#ifdef __cplusplus +} +#endif + +//list structure (and C++ wrapper) +#include "bridgelist.h" + +#include "bridgegraph.h" + +#ifdef __cplusplus +extern "C" +{ +#endif + +//Debugger defines +#define MAX_LABEL_SIZE 256 +#define MAX_COMMENT_SIZE 512 +#define MAX_MODULE_SIZE 256 +#define MAX_IMPORT_SIZE 65536 +#define MAX_BREAKPOINT_SIZE 256 +#define MAX_CONDITIONAL_EXPR_SIZE 256 +#define MAX_CONDITIONAL_TEXT_SIZE 256 +#define MAX_SCRIPT_LINE_SIZE 2048 +#define MAX_THREAD_NAME_SIZE 256 +#define MAX_WATCH_NAME_SIZE 256 +#define MAX_STRING_SIZE 512 +#define MAX_ERROR_SIZE 512 +#define RIGHTS_STRING_SIZE (sizeof("ERWCG") + 1) +#define MAX_SECTION_SIZE 10 +#define MAX_COMMAND_LINE_SIZE 256 +#define MAX_MNEMONIC_SIZE 64 +#define PAGE_SIZE 0x1000 + +//Debugger enums +typedef enum +{ + initialized, + paused, + running, + stopped +} DBGSTATE; + +typedef enum +{ + SEG_DEFAULT, + SEG_ES, + SEG_DS, + SEG_FS, + SEG_GS, + SEG_CS, + SEG_SS +} SEGMENTREG; + +typedef enum +{ + flagmodule = 0x1, + flaglabel = 0x2, + flagcomment = 0x4, + flagbookmark = 0x8, + flagfunction = 0x10, + flagloop = 0x20, + flagargs = 0x40, + flagNoFuncOffset = 0x80 +} ADDRINFOFLAGS; + +typedef enum +{ + bp_none = 0, + bp_normal = 1, + bp_hardware = 2, + bp_memory = 4, + bp_dll = 8, + bp_exception = 16 +} BPXTYPE; + +typedef enum +{ + FUNC_NONE, + FUNC_BEGIN, + FUNC_MIDDLE, + FUNC_END, + FUNC_SINGLE +} FUNCTYPE; + +typedef enum +{ + LOOP_NONE, + LOOP_BEGIN, + LOOP_MIDDLE, + LOOP_ENTRY, + LOOP_END, + LOOP_SINGLE +} LOOPTYPE; + +//order by most important type last +typedef enum +{ + XREF_NONE, + XREF_DATA, + XREF_JMP, + XREF_CALL +} XREFTYPE; + +typedef enum +{ + ARG_NONE, + ARG_BEGIN, + ARG_MIDDLE, + ARG_END, + ARG_SINGLE +} ARGTYPE; + +typedef enum +{ + DBG_SCRIPT_LOAD, // param1=const char* filename, param2=unused + DBG_SCRIPT_UNLOAD, // param1=unused, param2=unused + DBG_SCRIPT_RUN, // param1=int destline, param2=unused + DBG_SCRIPT_STEP, // param1=unused, param2=unused + DBG_SCRIPT_BPTOGGLE, // param1=int line, param2=unused + DBG_SCRIPT_BPGET, // param1=int line, param2=unused + DBG_SCRIPT_CMDEXEC, // param1=const char* command, param2=unused + DBG_SCRIPT_ABORT, // param1=unused, param2=unused + DBG_SCRIPT_GETLINETYPE, // param1=int line, param2=unused + DBG_SCRIPT_SETIP, // param1=int line, param2=unused + DBG_SCRIPT_GETBRANCHINFO, // param1=int line, param2=SCRIPTBRANCH* info + DBG_SYMBOL_ENUM, // param1=SYMBOLCBINFO* cbInfo, param2=unused + DBG_ASSEMBLE_AT, // param1=duint addr, param2=const char* instruction + DBG_MODBASE_FROM_NAME, // param1=const char* modname, param2=unused + DBG_DISASM_AT, // param1=duint addr, param2=DISASM_INSTR* instr + DBG_STACK_COMMENT_GET, // param1=duint addr, param2=STACK_COMMENT* comment + DBG_GET_THREAD_LIST, // param1=THREADALLINFO* list, param2=unused + DBG_SETTINGS_UPDATED, // param1=unused, param2=unused + DBG_DISASM_FAST_AT, // param1=duint addr, param2=BASIC_INSTRUCTION_INFO* basicinfo + DBG_MENU_ENTRY_CLICKED, // param1=int hEntry, param2=unused + DBG_FUNCTION_GET, // param1=FUNCTION_LOOP_INFO* info, param2=unused + DBG_FUNCTION_OVERLAPS, // param1=FUNCTION_LOOP_INFO* info, param2=unused + DBG_FUNCTION_ADD, // param1=FUNCTION_LOOP_INFO* info, param2=unused + DBG_FUNCTION_DEL, // param1=FUNCTION_LOOP_INFO* info, param2=unused + DBG_LOOP_GET, // param1=FUNCTION_LOOP_INFO* info, param2=unused + DBG_LOOP_OVERLAPS, // param1=FUNCTION_LOOP_INFO* info, param2=unused + DBG_LOOP_ADD, // param1=FUNCTION_LOOP_INFO* info, param2=unused + DBG_LOOP_DEL, // param1=FUNCTION_LOOP_INFO* info, param2=unused + DBG_IS_RUN_LOCKED, // param1=unused, param2=unused + DBG_IS_BP_DISABLED, // param1=duint addr, param2=unused + DBG_SET_AUTO_COMMENT_AT, // param1=duint addr, param2=const char* text + DBG_DELETE_AUTO_COMMENT_RANGE, // param1=duint start, param2=duint end + DBG_SET_AUTO_LABEL_AT, // param1=duint addr, param2=const char* text + DBG_DELETE_AUTO_LABEL_RANGE, // param1=duint start, param2=duint end + DBG_SET_AUTO_BOOKMARK_AT, // param1=duint addr, param2=const char* text + DBG_DELETE_AUTO_BOOKMARK_RANGE, // param1=duint start, param2=duint end + DBG_SET_AUTO_FUNCTION_AT, // param1=duint addr, param2=const char* text + DBG_DELETE_AUTO_FUNCTION_RANGE, // param1=duint start, param2=duint end + DBG_GET_STRING_AT, // param1=duint addr, param2=unused + DBG_GET_FUNCTIONS, // param1=unused, param2=unused + DBG_WIN_EVENT, // param1=MSG* message, param2=long* result + DBG_WIN_EVENT_GLOBAL, // param1=MSG* message, param2=unused + DBG_INITIALIZE_LOCKS, // param1=unused, param2=unused + DBG_DEINITIALIZE_LOCKS, // param1=unused, param2=unused + DBG_GET_TIME_WASTED_COUNTER, // param1=unused, param2=unused + DBG_SYMBOL_ENUM_FROMCACHE, // param1=SYMBOLCBINFO* cbInfo, param2=unused + DBG_DELETE_COMMENT_RANGE, // param1=duint start, param2=duint end + DBG_DELETE_LABEL_RANGE, // param1=duint start, param2=duint end + DBG_DELETE_BOOKMARK_RANGE, // param1=duint start, param2=duint end + DBG_GET_XREF_COUNT_AT, // param1=duint addr, param2=unused + DBG_GET_XREF_TYPE_AT, // param1=duint addr, param2=unused + DBG_XREF_ADD, // param1=duint addr, param2=duint from + DBG_XREF_DEL_ALL, // param1=duint addr, param2=unused + DBG_XREF_GET, // param1=duint addr, param2=XREF_INFO* info + DBG_GET_ENCODE_TYPE_BUFFER, // param1=duint addr, param2=unused + DBG_ENCODE_TYPE_GET, // param1=duint addr, param2=duint size + DBG_DELETE_ENCODE_TYPE_RANGE, // param1=duint start, param2=duint end + DBG_ENCODE_SIZE_GET, // param1=duint addr, param2=duint codesize + DBG_DELETE_ENCODE_TYPE_SEG, // param1=duint addr, param2=unused + DBG_RELEASE_ENCODE_TYPE_BUFFER, // param1=void* buffer, param2=unused + DBG_ARGUMENT_GET, // param1=FUNCTION* info, param2=unused + DBG_ARGUMENT_OVERLAPS, // param1=FUNCTION* info, param2=unused + DBG_ARGUMENT_ADD, // param1=FUNCTION* info, param2=unused + DBG_ARGUMENT_DEL, // param1=FUNCTION* info, param2=unused + DBG_GET_WATCH_LIST, // param1=ListOf(WATCHINFO), param2=unused + DBG_SELCHANGED, // param1=hWindow, param2=VA + DBG_GET_PROCESS_HANDLE, // param1=unused, param2=unused + DBG_GET_THREAD_HANDLE, // param1=unused, param2=unused + DBG_GET_PROCESS_ID, // param1=unused, param2=unused + DBG_GET_THREAD_ID, // param1=unused, param2=unused + DBG_GET_PEB_ADDRESS, // param1=DWORD ProcessId, param2=unused + DBG_GET_TEB_ADDRESS, // param1=DWORD ThreadId, param2=unused + DBG_ANALYZE_FUNCTION, // param1=BridgeCFGraphList* graph, param2=duint entry + DBG_MENU_PREPARE, // param1=int hMenu, param2=unused + DBG_GET_SYMBOL_INFO, // param1=void* symbol, param2=SYMBOLINFO* info + DBG_GET_DEBUG_ENGINE, // param1=unused, param2-unused +} DBGMSG; + +typedef enum +{ + linecommand, + linebranch, + linelabel, + linecomment, + lineempty, +} SCRIPTLINETYPE; + +typedef enum +{ + scriptnobranch, + scriptjmp, + scriptjnejnz, + scriptjejz, + scriptjbjl, + scriptjajg, + scriptjbejle, + scriptjaejge, + scriptcall +} SCRIPTBRANCHTYPE; + +typedef enum +{ + instr_normal, + instr_branch, + instr_stack +} DISASM_INSTRTYPE; + +typedef enum +{ + arg_normal, + arg_memory +} DISASM_ARGTYPE; + +typedef enum +{ + str_none, + str_ascii, + str_unicode +} STRING_TYPE; + +typedef enum +{ + _PriorityIdle = -15, + _PriorityAboveNormal = 1, + _PriorityBelowNormal = -1, + _PriorityHighest = 2, + _PriorityLowest = -2, + _PriorityNormal = 0, + _PriorityTimeCritical = 15, + _PriorityUnknown = 0x7FFFFFFF +} THREADPRIORITY; + +typedef enum +{ + _Executive = 0, + _FreePage = 1, + _PageIn = 2, + _PoolAllocation = 3, + _DelayExecution = 4, + _Suspended = 5, + _UserRequest = 6, + _WrExecutive = 7, + _WrFreePage = 8, + _WrPageIn = 9, + _WrPoolAllocation = 10, + _WrDelayExecution = 11, + _WrSuspended = 12, + _WrUserRequest = 13, + _WrEventPair = 14, + _WrQueue = 15, + _WrLpcReceive = 16, + _WrLpcReply = 17, + _WrVirtualMemory = 18, + _WrPageOut = 19, + _WrRendezvous = 20, + _Spare2 = 21, + _Spare3 = 22, + _Spare4 = 23, + _Spare5 = 24, + _WrCalloutStack = 25, + _WrKernel = 26, + _WrResource = 27, + _WrPushLock = 28, + _WrMutex = 29, + _WrQuantumEnd = 30, + _WrDispatchInt = 31, + _WrPreempted = 32, + _WrYieldExecution = 33, + _WrFastMutex = 34, + _WrGuardedMutex = 35, + _WrRundown = 36, +} THREADWAITREASON; + +typedef enum +{ + size_byte = 1, + size_word = 2, + size_dword = 4, + size_qword = 8, + size_xmmword = 16, + size_ymmword = 32 +} MEMORY_SIZE; + +typedef enum +{ + enc_unknown, //must be 0 + enc_byte, //1 byte + enc_word, //2 bytes + enc_dword, //4 bytes + enc_fword, //6 bytes + enc_qword, //8 bytes + enc_tbyte, //10 bytes + enc_oword, //16 bytes + enc_mmword, //8 bytes + enc_xmmword, //16 bytes + enc_ymmword, //32 bytes + enc_zmmword, //64 bytes avx512 not supported + enc_real4, //4 byte float + enc_real8, //8 byte double + enc_real10, //10 byte decimal + enc_ascii, //ascii sequence + enc_unicode, //unicode sequence + enc_code, //start of code + enc_junk, //junk code + enc_middle //middle of data +} ENCODETYPE; + +typedef enum +{ + TYPE_UINT, // unsigned integer + TYPE_INT, // signed integer + TYPE_FLOAT,// single precision floating point value + TYPE_ASCII, // ascii string + TYPE_UNICODE, // unicode string + TYPE_INVALID // invalid watch expression or data type +} WATCHVARTYPE; + +typedef enum +{ + MODE_DISABLED, // watchdog is disabled + MODE_ISTRUE, // alert if expression is not 0 + MODE_ISFALSE, // alert if expression is 0 + MODE_CHANGED, // alert if expression is changed + MODE_UNCHANGED // alert if expression is not changed +} WATCHDOGMODE; + +typedef enum +{ + hw_access, + hw_write, + hw_execute +} BPHWTYPE; + +typedef enum +{ + mem_access, + mem_read, + mem_write, + mem_execute +} BPMEMTYPE; + +typedef enum +{ + dll_load = 1, + dll_unload, + dll_all +} BPDLLTYPE; + +typedef enum +{ + ex_firstchance = 1, + ex_secondchance, + ex_all +} BPEXTYPE; + +typedef enum +{ + hw_byte, + hw_word, + hw_dword, + hw_qword +} BPHWSIZE; + +typedef enum +{ + sym_import, + sym_export, + sym_symbol +} SYMBOLTYPE; + +typedef enum +{ + mod_user, + mod_system +} MODULEPARTY; + +typedef enum +{ + DebugEngineTitanEngine, + DebugEngineGleeBug, + DebugEngineStaticEngine, +} DEBUG_ENGINE; + +//Debugger typedefs +typedef MEMORY_SIZE VALUE_SIZE; + +typedef struct DBGFUNCTIONS_ DBGFUNCTIONS; + +typedef bool (*CBSYMBOLENUM)(const struct SYMBOLPTR_* symbol, void* user); + +//Debugger structs +typedef struct +{ + MEMORY_BASIC_INFORMATION mbi; + char info[MAX_MODULE_SIZE]; +} MEMPAGE; + +typedef struct +{ + int count; + MEMPAGE* page; +} MEMMAP; + +typedef struct +{ + BPXTYPE type; + duint addr; + bool enabled; + bool singleshoot; + bool active; + char name[MAX_BREAKPOINT_SIZE]; + char mod[MAX_MODULE_SIZE]; + unsigned short slot; + // extended part + unsigned char typeEx; //BPHWTYPE/BPMEMTYPE/BPDLLTYPE/BPEXTYPE + unsigned char hwSize; //BPHWSIZE + unsigned int hitCount; + bool fastResume; + bool silent; + char breakCondition[MAX_CONDITIONAL_EXPR_SIZE]; + char logText[MAX_CONDITIONAL_TEXT_SIZE]; + char logCondition[MAX_CONDITIONAL_EXPR_SIZE]; + char commandText[MAX_CONDITIONAL_TEXT_SIZE]; + char commandCondition[MAX_CONDITIONAL_EXPR_SIZE]; +} BRIDGEBP; + +typedef struct +{ + int count; + BRIDGEBP* bp; +} BPMAP; + +typedef struct +{ + char WatchName[MAX_WATCH_NAME_SIZE]; + char Expression[MAX_CONDITIONAL_EXPR_SIZE]; + unsigned int window; + unsigned int id; + WATCHVARTYPE varType; + WATCHDOGMODE watchdogMode; + duint value; + bool watchdogTriggered; +} WATCHINFO; + +typedef struct +{ + duint start; //OUT + duint end; //OUT + duint instrcount; //OUT +} FUNCTION; + +typedef struct +{ + int depth; //IN + duint start; //OUT + duint end; //OUT + duint instrcount; //OUT +} LOOP; + +typedef struct +{ + int flags; //ADDRINFOFLAGS (IN) + char module[MAX_MODULE_SIZE]; //module the address is in + char label[MAX_LABEL_SIZE]; + char comment[MAX_COMMENT_SIZE]; + bool isbookmark; + FUNCTION function; + LOOP loop; + FUNCTION args; +} BRIDGE_ADDRINFO; + +typedef struct SYMBOLINFO_ +{ + duint addr; + char* decoratedSymbol; + char* undecoratedSymbol; + SYMBOLTYPE type; + bool freeDecorated; + bool freeUndecorated; + DWORD ordinal; +} SYMBOLINFO; + +typedef struct +{ + duint base; + char name[MAX_MODULE_SIZE]; +} SYMBOLMODULEINFO; + +typedef struct +{ + duint base; + CBSYMBOLENUM cbSymbolEnum; + void* user; +} SYMBOLCBINFO; + +typedef struct +{ + bool c; + bool p; + bool a; + bool z; + bool s; + bool t; + bool i; + bool d; + bool o; +} FLAGS; + +typedef struct +{ + bool FZ; + bool PM; + bool UM; + bool OM; + bool ZM; + bool IM; + bool DM; + bool DAZ; + bool PE; + bool UE; + bool OE; + bool ZE; + bool DE; + bool IE; + + unsigned short RC; +} MXCSRFIELDS; + +typedef struct +{ + bool B; + bool C3; + bool C2; + bool C1; + bool C0; + bool ES; + bool SF; + bool P; + bool U; + bool O; + bool Z; + bool D; + bool I; + + unsigned short TOP; + +} X87STATUSWORDFIELDS; + +typedef struct +{ + bool IC; + bool IEM; + bool PM; + bool UM; + bool OM; + bool ZM; + bool DM; + bool IM; + + unsigned short RC; + unsigned short PC; + +} X87CONTROLWORDFIELDS; + +typedef struct DECLSPEC_ALIGN(16) _XMMREGISTER +{ + ULONGLONG Low; + LONGLONG High; +} XMMREGISTER; + +typedef struct +{ + XMMREGISTER Low; //XMM/SSE part + XMMREGISTER High; //AVX part +} YMMREGISTER; + +typedef struct +{ + BYTE data[10]; + int st_value; + int tag; +} X87FPUREGISTER; + +typedef struct +{ + WORD ControlWord; + WORD StatusWord; + WORD TagWord; + DWORD ErrorOffset; + DWORD ErrorSelector; + DWORD DataOffset; + DWORD DataSelector; + DWORD Cr0NpxState; +} X87FPU; + +typedef struct +{ + ULONG_PTR cax; + ULONG_PTR ccx; + ULONG_PTR cdx; + ULONG_PTR cbx; + ULONG_PTR csp; + ULONG_PTR cbp; + ULONG_PTR csi; + ULONG_PTR cdi; +#ifdef _WIN64 + ULONG_PTR r8; + ULONG_PTR r9; + ULONG_PTR r10; + ULONG_PTR r11; + ULONG_PTR r12; + ULONG_PTR r13; + ULONG_PTR r14; + ULONG_PTR r15; +#endif //_WIN64 + ULONG_PTR cip; + ULONG_PTR eflags; + unsigned short gs; + unsigned short fs; + unsigned short es; + unsigned short ds; + unsigned short cs; + unsigned short ss; + ULONG_PTR dr0; + ULONG_PTR dr1; + ULONG_PTR dr2; + ULONG_PTR dr3; + ULONG_PTR dr6; + ULONG_PTR dr7; + BYTE RegisterArea[80]; + X87FPU x87fpu; + DWORD MxCsr; +#ifdef _WIN64 + XMMREGISTER XmmRegisters[16]; + YMMREGISTER YmmRegisters[16]; +#else // x86 + XMMREGISTER XmmRegisters[8]; + YMMREGISTER YmmRegisters[8]; +#endif +} REGISTERCONTEXT; + +typedef struct +{ + DWORD code; + char name[128]; +} LASTERROR; + +typedef struct +{ + DWORD code; + char name[128]; +} LASTSTATUS; + +typedef struct +{ + REGISTERCONTEXT regcontext; + FLAGS flags; + X87FPUREGISTER x87FPURegisters[8]; + unsigned long long mmx[8]; + MXCSRFIELDS MxCsrFields; + X87STATUSWORDFIELDS x87StatusWordFields; + X87CONTROLWORDFIELDS x87ControlWordFields; + LASTERROR lastError; + LASTSTATUS lastStatus; +} REGDUMP; + +typedef struct +{ + DISASM_ARGTYPE type; //normal/memory + SEGMENTREG segment; + char mnemonic[64]; + duint constant; //constant in the instruction (imm/disp) + duint value; //equal to constant or equal to the register value + duint memvalue; //memsize:[value] +} DISASM_ARG; + +typedef struct +{ + char instruction[64]; + DISASM_INSTRTYPE type; + int argcount; + int instr_size; + DISASM_ARG arg[3]; +} DISASM_INSTR; + +typedef struct +{ + char color[8]; //hex color-code + char comment[MAX_COMMENT_SIZE]; +} STACK_COMMENT; + +typedef struct +{ + int ThreadNumber; + HANDLE Handle; + DWORD ThreadId; + duint ThreadStartAddress; + duint ThreadLocalBase; + char threadName[MAX_THREAD_NAME_SIZE]; +} THREADINFO; + +typedef struct +{ + THREADINFO BasicInfo; + duint ThreadCip; + DWORD SuspendCount; + THREADPRIORITY Priority; + THREADWAITREASON WaitReason; + DWORD LastError; + FILETIME UserTime; + FILETIME KernelTime; + FILETIME CreationTime; + ULONG64 Cycles; // Windows Vista or greater +} THREADALLINFO; + +typedef struct +{ + int count; + THREADALLINFO* list; + int CurrentThread; +} THREADLIST; + +typedef struct +{ + duint value; //displacement / addrvalue (rip-relative) + MEMORY_SIZE size; //byte/word/dword/qword + char mnemonic[MAX_MNEMONIC_SIZE]; +} MEMORY_INFO; + +typedef struct +{ + duint value; + VALUE_SIZE size; +} VALUE_INFO; + +//definitions for BASIC_INSTRUCTION_INFO.type +#define TYPE_VALUE 1 +#define TYPE_MEMORY 2 +#define TYPE_ADDR 4 + +typedef struct +{ + DWORD type; //value|memory|addr + VALUE_INFO value; //immediat + MEMORY_INFO memory; + duint addr; //addrvalue (jumps + calls) + bool branch; //jumps/calls + bool call; //instruction is a call + int size; + char instruction[MAX_MNEMONIC_SIZE * 4]; +} BASIC_INSTRUCTION_INFO; + +typedef struct +{ + SCRIPTBRANCHTYPE type; + int dest; + char branchlabel[256]; +} SCRIPTBRANCH; + +typedef struct +{ + duint addr; + duint start; + duint end; + bool manual; + int depth; +} FUNCTION_LOOP_INFO; + +typedef struct +{ + duint addr; + XREFTYPE type; +} XREF_RECORD; + +typedef struct +{ + duint refcount; + XREF_RECORD* references; +} XREF_INFO; + +typedef struct SYMBOLPTR_ +{ + duint modbase; + const void* symbol; +} SYMBOLPTR; + +//Debugger functions +BRIDGE_IMPEXP const char* DbgInit(); +BRIDGE_IMPEXP void DbgExit(); +BRIDGE_IMPEXP bool DbgMemRead(duint va, void* dest, duint size); +BRIDGE_IMPEXP bool DbgMemWrite(duint va, const void* src, duint size); +BRIDGE_IMPEXP duint DbgMemGetPageSize(duint base); +BRIDGE_IMPEXP duint DbgMemFindBaseAddr(duint addr, duint* size); + +/// +/// Asynchronously execute a debugger command by adding it to the command queue. +/// Note: the command may not have completed before this call returns. Use this +/// function if you don't care when the command gets executed. +/// +/// Example: DbgCmdExec("ClearLog") +/// +/// The command to execute. +/// True if the command was successfully submitted to the command queue. False if the submission failed. +BRIDGE_IMPEXP bool DbgCmdExec(const char* cmd); + +/// +/// Performs synchronous execution of a debugger command. This function call only +/// returns after the command has completed. +/// +/// Example: DbgCmdExecDirect("loadlib advapi32.dll") +/// +/// The command to execute. +/// True if the command executed successfully, False if there was a problem. +BRIDGE_IMPEXP bool DbgCmdExecDirect(const char* cmd); +BRIDGE_IMPEXP bool DbgMemMap(MEMMAP* memmap); +BRIDGE_IMPEXP bool DbgIsValidExpression(const char* expression); +BRIDGE_IMPEXP bool DbgIsDebugging(); +BRIDGE_IMPEXP bool DbgIsJumpGoingToExecute(duint addr); +BRIDGE_IMPEXP bool DbgGetLabelAt(duint addr, SEGMENTREG segment, char* text); +BRIDGE_IMPEXP bool DbgSetLabelAt(duint addr, const char* text); +BRIDGE_IMPEXP void DbgClearLabelRange(duint start, duint end); +BRIDGE_IMPEXP bool DbgGetCommentAt(duint addr, char* text); +BRIDGE_IMPEXP bool DbgSetCommentAt(duint addr, const char* text); +BRIDGE_IMPEXP void DbgClearCommentRange(duint start, duint end); +BRIDGE_IMPEXP bool DbgGetBookmarkAt(duint addr); +BRIDGE_IMPEXP bool DbgSetBookmarkAt(duint addr, bool isbookmark); +BRIDGE_IMPEXP void DbgClearBookmarkRange(duint start, duint end); +BRIDGE_IMPEXP bool DbgGetModuleAt(duint addr, char* text); +BRIDGE_IMPEXP BPXTYPE DbgGetBpxTypeAt(duint addr); +BRIDGE_IMPEXP duint DbgValFromString(const char* string); +BRIDGE_IMPEXP bool DbgGetRegDumpEx(REGDUMP* regdump, size_t size); +BRIDGE_IMPEXP bool DbgValToString(const char* string, duint value); +BRIDGE_IMPEXP bool DbgMemIsValidReadPtr(duint addr); +BRIDGE_IMPEXP int DbgGetBpList(BPXTYPE type, BPMAP* list); +BRIDGE_IMPEXP FUNCTYPE DbgGetFunctionTypeAt(duint addr); +BRIDGE_IMPEXP LOOPTYPE DbgGetLoopTypeAt(duint addr, int depth); +BRIDGE_IMPEXP duint DbgGetBranchDestination(duint addr); +BRIDGE_IMPEXP void DbgScriptLoad(const char* filename); +BRIDGE_IMPEXP void DbgScriptUnload(); +BRIDGE_IMPEXP void DbgScriptRun(int destline); +BRIDGE_IMPEXP void DbgScriptStep(); +BRIDGE_IMPEXP bool DbgScriptBpToggle(int line); +BRIDGE_IMPEXP bool DbgScriptBpGet(int line); +BRIDGE_IMPEXP bool DbgScriptCmdExec(const char* command); +BRIDGE_IMPEXP void DbgScriptAbort(); +BRIDGE_IMPEXP SCRIPTLINETYPE DbgScriptGetLineType(int line); +BRIDGE_IMPEXP void DbgScriptSetIp(int line); +BRIDGE_IMPEXP bool DbgScriptGetBranchInfo(int line, SCRIPTBRANCH* info); +BRIDGE_IMPEXP void DbgSymbolEnum(duint base, CBSYMBOLENUM cbSymbolEnum, void* user); +BRIDGE_IMPEXP void DbgSymbolEnumFromCache(duint base, CBSYMBOLENUM cbSymbolEnum, void* user); +BRIDGE_IMPEXP bool DbgAssembleAt(duint addr, const char* instruction); +BRIDGE_IMPEXP duint DbgModBaseFromName(const char* name); +BRIDGE_IMPEXP void DbgDisasmAt(duint addr, DISASM_INSTR* instr); +BRIDGE_IMPEXP bool DbgStackCommentGet(duint addr, STACK_COMMENT* comment); +BRIDGE_IMPEXP void DbgGetThreadList(THREADLIST* list); +BRIDGE_IMPEXP void DbgSettingsUpdated(); +BRIDGE_IMPEXP void DbgDisasmFastAt(duint addr, BASIC_INSTRUCTION_INFO* basicinfo); +BRIDGE_IMPEXP void DbgMenuEntryClicked(int hEntry); +BRIDGE_IMPEXP bool DbgFunctionGet(duint addr, duint* start, duint* end); +BRIDGE_IMPEXP bool DbgFunctionOverlaps(duint start, duint end); +BRIDGE_IMPEXP bool DbgFunctionAdd(duint start, duint end); +BRIDGE_IMPEXP bool DbgFunctionDel(duint addr); +BRIDGE_IMPEXP bool DbgArgumentGet(duint addr, duint* start, duint* end); +BRIDGE_IMPEXP bool DbgArgumentOverlaps(duint start, duint end); +BRIDGE_IMPEXP bool DbgArgumentAdd(duint start, duint end); +BRIDGE_IMPEXP bool DbgArgumentDel(duint addr); +BRIDGE_IMPEXP bool DbgLoopGet(int depth, duint addr, duint* start, duint* end); +BRIDGE_IMPEXP bool DbgLoopOverlaps(int depth, duint start, duint end); +BRIDGE_IMPEXP bool DbgLoopAdd(duint start, duint end); +BRIDGE_IMPEXP bool DbgLoopDel(int depth, duint addr); +BRIDGE_IMPEXP bool DbgXrefAdd(duint addr, duint from); +BRIDGE_IMPEXP bool DbgXrefDelAll(duint addr); +BRIDGE_IMPEXP bool DbgXrefGet(duint addr, XREF_INFO* info); +BRIDGE_IMPEXP size_t DbgGetXrefCountAt(duint addr); +BRIDGE_IMPEXP XREFTYPE DbgGetXrefTypeAt(duint addr); +BRIDGE_IMPEXP bool DbgIsRunLocked(); +BRIDGE_IMPEXP bool DbgIsBpDisabled(duint addr); +BRIDGE_IMPEXP bool DbgSetAutoCommentAt(duint addr, const char* text); +BRIDGE_IMPEXP void DbgClearAutoCommentRange(duint start, duint end); +BRIDGE_IMPEXP bool DbgSetAutoLabelAt(duint addr, const char* text); +BRIDGE_IMPEXP void DbgClearAutoLabelRange(duint start, duint end); +BRIDGE_IMPEXP bool DbgSetAutoBookmarkAt(duint addr); +BRIDGE_IMPEXP void DbgClearAutoBookmarkRange(duint start, duint end); +BRIDGE_IMPEXP bool DbgSetAutoFunctionAt(duint start, duint end); +BRIDGE_IMPEXP void DbgClearAutoFunctionRange(duint start, duint end); +BRIDGE_IMPEXP bool DbgGetStringAt(duint addr, char* text); +BRIDGE_IMPEXP const DBGFUNCTIONS* DbgFunctions(); +BRIDGE_IMPEXP bool DbgWinEvent(MSG* message, long* result); +BRIDGE_IMPEXP bool DbgWinEventGlobal(MSG* message); +BRIDGE_IMPEXP bool DbgIsRunning(); +BRIDGE_IMPEXP duint DbgGetTimeWastedCounter(); +BRIDGE_IMPEXP ARGTYPE DbgGetArgTypeAt(duint addr); +BRIDGE_IMPEXP void* DbgGetEncodeTypeBuffer(duint addr, duint* size); +BRIDGE_IMPEXP void DbgReleaseEncodeTypeBuffer(void* buffer); +BRIDGE_IMPEXP ENCODETYPE DbgGetEncodeTypeAt(duint addr, duint size); +BRIDGE_IMPEXP duint DbgGetEncodeSizeAt(duint addr, duint codesize); +BRIDGE_IMPEXP bool DbgSetEncodeType(duint addr, duint size, ENCODETYPE type); +BRIDGE_IMPEXP void DbgDelEncodeTypeRange(duint start, duint end); +BRIDGE_IMPEXP void DbgDelEncodeTypeSegment(duint start); +BRIDGE_IMPEXP bool DbgGetWatchList(ListOf(WATCHINFO) list); +BRIDGE_IMPEXP void DbgSelChanged(int hWindow, duint VA); +BRIDGE_IMPEXP HANDLE DbgGetProcessHandle(); +BRIDGE_IMPEXP HANDLE DbgGetThreadHandle(); +BRIDGE_IMPEXP DWORD DbgGetProcessId(); +BRIDGE_IMPEXP DWORD DbgGetThreadId(); +BRIDGE_IMPEXP duint DbgGetPebAddress(DWORD ProcessId); +BRIDGE_IMPEXP duint DbgGetTebAddress(DWORD ThreadId); +BRIDGE_IMPEXP bool DbgAnalyzeFunction(duint entry, BridgeCFGraphList* graph); +BRIDGE_IMPEXP duint DbgEval(const char* expression, bool* DEFAULT_PARAM(success, nullptr)); +BRIDGE_IMPEXP void DbgGetSymbolInfo(const SYMBOLPTR* symbolptr, SYMBOLINFO* info); +BRIDGE_IMPEXP DEBUG_ENGINE DbgGetDebugEngine(); + +//Gui defines +typedef enum +{ + GUI_PLUGIN_MENU, + GUI_DISASM_MENU, + GUI_DUMP_MENU, + GUI_STACK_MENU, + GUI_GRAPH_MENU, + GUI_MEMMAP_MENU, + GUI_SYMMOD_MENU, +} GUIMENUTYPE; + +BRIDGE_IMPEXP void DbgMenuPrepare(GUIMENUTYPE hMenu); + +typedef enum +{ + GUI_DISASSEMBLY, + GUI_DUMP, + GUI_STACK, + GUI_GRAPH, + GUI_MEMMAP, + GUI_SYMMOD, +} GUISELECTIONTYPE; + +#define GUI_MAX_LINE_SIZE 65536 +#define GUI_MAX_DISASSEMBLY_SIZE 2048 + +//Gui enums +typedef enum +{ + GUI_DISASSEMBLE_AT, // param1=(duint)va, param2=(duint)cip + GUI_SET_DEBUG_STATE, // param1=(DBGSTATE)state, param2=unused + GUI_ADD_MSG_TO_LOG, // param1=(const char*)msg, param2=unused + GUI_ADD_MSG_TO_LOG_HTML, // param1=(const char*)msg, param2=unused + GUI_CLEAR_LOG, // param1=unused, param2=unused + GUI_UPDATE_REGISTER_VIEW, // param1=unused, param2=unused + GUI_UPDATE_DISASSEMBLY_VIEW, // param1=unused, param2=unused + GUI_UPDATE_BREAKPOINTS_VIEW, // param1=unused, param2=unused + GUI_UPDATE_WINDOW_TITLE, // param1=(const char*)file, param2=unused + GUI_GET_WINDOW_HANDLE, // param1=unused, param2=unused + GUI_DUMP_AT, // param1=(duint)va param2=unused + GUI_SCRIPT_ADD, // param1=int count, param2=const char** lines + GUI_SCRIPT_CLEAR, // param1=unused, param2=unused + GUI_SCRIPT_SETIP, // param1=int line, param2=unused + GUI_SCRIPT_ERROR, // param1=int line, param2=const char* message + GUI_SCRIPT_SETTITLE, // param1=const char* title, param2=unused + GUI_SCRIPT_SETINFOLINE, // param1=int line, param2=const char* info + GUI_SCRIPT_MESSAGE, // param1=const char* message, param2=unused + GUI_SCRIPT_MSGYN, // param1=const char* message, param2=unused + GUI_SYMBOL_LOG_ADD, // param1(const char*)msg, param2=unused + GUI_SYMBOL_LOG_CLEAR, // param1=unused, param2=unused + GUI_SYMBOL_SET_PROGRESS, // param1=int percent param2=unused + GUI_SYMBOL_UPDATE_MODULE_LIST, // param1=int count, param2=SYMBOLMODULEINFO* modules + GUI_REF_ADDCOLUMN, // param1=int width, param2=(const char*)title + GUI_REF_SETROWCOUNT, // param1=int rows, param2=unused + GUI_REF_GETROWCOUNT, // param1=unused, param2=unused + GUI_REF_DELETEALLCOLUMNS, // param1=unused, param2=unused + GUI_REF_SETCELLCONTENT, // param1=(CELLINFO*)info, param2=unused + GUI_REF_GETCELLCONTENT, // param1=int row, param2=int col + GUI_REF_RELOADDATA, // param1=unused, param2=unused + GUI_REF_SETSINGLESELECTION, // param1=int index, param2=bool scroll + GUI_REF_SETPROGRESS, // param1=int progress, param2=unused + GUI_REF_SETCURRENTTASKPROGRESS, // param1=int progress, param2=const char* taskTitle + GUI_REF_SETSEARCHSTARTCOL, // param1=int col param2=unused + GUI_STACK_DUMP_AT, // param1=duint addr, param2=duint csp + GUI_UPDATE_DUMP_VIEW, // param1=unused, param2=unused + GUI_UPDATE_THREAD_VIEW, // param1=unused, param2=unused + GUI_ADD_RECENT_FILE, // param1=(const char*)file, param2=unused + GUI_SET_LAST_EXCEPTION, // param1=unsigned int code, param2=unused + GUI_GET_DISASSEMBLY, // param1=duint addr, param2=char* text + GUI_MENU_ADD, // param1=int hMenu, param2=const char* title + GUI_MENU_ADD_ENTRY, // param1=int hMenu, param2=const char* title + GUI_MENU_ADD_SEPARATOR, // param1=int hMenu, param2=unused + GUI_MENU_CLEAR, // param1=int hMenu, param2=unused + GUI_SELECTION_GET, // param1=GUISELECTIONTYPE, param2=SELECTIONDATA* selection + GUI_SELECTION_SET, // param1=GUISELECTIONTYPE, param2=const SELECTIONDATA* selection + GUI_GETLINE_WINDOW, // param1=const char* title, param2=char* text + GUI_AUTOCOMPLETE_ADDCMD, // param1=const char* cmd, param2=ununsed + GUI_AUTOCOMPLETE_DELCMD, // param1=const char* cmd, param2=ununsed + GUI_AUTOCOMPLETE_CLEARALL, // param1=unused, param2=unused + GUI_SCRIPT_ENABLEHIGHLIGHTING, // param1=bool enable, param2=unused + GUI_ADD_MSG_TO_STATUSBAR, // param1=const char* msg, param2=unused + GUI_UPDATE_SIDEBAR, // param1=unused, param2=unused + GUI_REPAINT_TABLE_VIEW, // param1=unused, param2=unused + GUI_UPDATE_PATCHES, // param1=unused, param2=unused + GUI_UPDATE_CALLSTACK, // param1=unused, param2=unused + GUI_UPDATE_SEHCHAIN, // param1=unused, param2=unused + GUI_SYMBOL_REFRESH_CURRENT, // param1=unused, param2=unused + GUI_UPDATE_MEMORY_VIEW, // param1=unused, param2=unused + GUI_REF_INITIALIZE, // param1=const char* name, param2=unused + GUI_LOAD_SOURCE_FILE, // param1=const char* path, param2=duint addr + GUI_MENU_SET_ICON, // param1=int hMenu, param2=ICONINFO* + GUI_MENU_SET_ENTRY_ICON, // param1=int hEntry, param2=ICONINFO* + GUI_SHOW_CPU, // param1=unused, param2=unused + GUI_ADD_QWIDGET_TAB, // param1=QWidget*, param2=unused + GUI_SHOW_QWIDGET_TAB, // param1=QWidget*, param2=unused + GUI_CLOSE_QWIDGET_TAB, // param1=QWidget*, param2=unused + GUI_EXECUTE_ON_GUI_THREAD, // param1=GUICALLBACKEX cb, param2=void* userdata + GUI_UPDATE_TIME_WASTED_COUNTER, // param1=unused, param2=unused + GUI_SET_GLOBAL_NOTES, // param1=const char* text, param2=unused + GUI_GET_GLOBAL_NOTES, // param1=char** text, param2=unused + GUI_SET_DEBUGGEE_NOTES, // param1=const char* text, param2=unused + GUI_GET_DEBUGGEE_NOTES, // param1=char** text, param2=unused + GUI_DUMP_AT_N, // param1=int index, param2=duint va + GUI_DISPLAY_WARNING, // param1=const char *text, param2=unused + GUI_REGISTER_SCRIPT_LANG, // param1=SCRIPTTYPEINFO* info, param2=unused + GUI_UNREGISTER_SCRIPT_LANG, // param1=int id, param2=unused + GUI_UPDATE_ARGUMENT_VIEW, // param1=unused, param2=unused + GUI_FOCUS_VIEW, // param1=int hWindow, param2=unused + GUI_UPDATE_WATCH_VIEW, // param1=unused, param2=unused + GUI_LOAD_GRAPH, // param1=BridgeCFGraphList* param2=unused + GUI_GRAPH_AT, // param1=duint addr param2=unused + GUI_UPDATE_GRAPH_VIEW, // param1=unused, param2=unused + GUI_SET_LOG_ENABLED, // param1=bool isEnabled param2=unused + GUI_ADD_FAVOURITE_TOOL, // param1=const char* name param2=const char* description + GUI_ADD_FAVOURITE_COMMAND, // param1=const char* command param2=const char* shortcut + GUI_SET_FAVOURITE_TOOL_SHORTCUT,// param1=const char* name param2=const char* shortcut + GUI_FOLD_DISASSEMBLY, // param1=duint startAddress param2=duint length + GUI_SELECT_IN_MEMORY_MAP, // param1=duint addr, param2=unused + GUI_GET_ACTIVE_VIEW, // param1=ACTIVEVIEW*, param2=unused + GUI_MENU_SET_ENTRY_CHECKED, // param1=int hEntry, param2=bool checked + GUI_ADD_INFO_LINE, // param1=const char* infoline, param2=unused + GUI_PROCESS_EVENTS, // param1=unused, param2=unused + GUI_TYPE_ADDNODE, // param1=void* parent, param2=TYPEDESCRIPTOR* type + GUI_TYPE_CLEAR, // param1=unused, param2=unused + GUI_UPDATE_TYPE_WIDGET, // param1=unused, param2=unused + GUI_CLOSE_APPLICATION, // param1=unused, param2=unused + GUI_MENU_SET_VISIBLE, // param1=int hMenu, param2=bool visible + GUI_MENU_SET_ENTRY_VISIBLE, // param1=int hEntry, param2=bool visible + GUI_MENU_SET_NAME, // param1=int hMenu, param2=const char* name + GUI_MENU_SET_ENTRY_NAME, // param1=int hEntry, param2=const char* name + GUI_FLUSH_LOG, // param1=unused, param2=unused + GUI_MENU_SET_ENTRY_HOTKEY, // param1=int hEntry, param2=const char* hack + GUI_REF_SEARCH_GETROWCOUNT, // param1=unused, param2=unused + GUI_REF_SEARCH_GETCELLCONTENT, // param1=int row, param2=int col + GUI_MENU_REMOVE, // param1=int hEntryMenu, param2=unused + GUI_REF_ADDCOMMAND, // param1=const char* title, param2=const char* command + GUI_OPEN_TRACE_FILE, // param1=const char* file name,param2=unused + GUI_UPDATE_TRACE_BROWSER, // param1=unused, param2=unused + GUI_INVALIDATE_SYMBOL_SOURCE, // param1=duint base, param2=unused + GUI_GET_CURRENT_GRAPH, // param1=BridgeCFGraphList*, param2=unused + GUI_SHOW_REF, // param1=unused, param2=unused + GUI_SELECT_IN_SYMBOLS_TAB, // param1=duint addr, param2=unused +} GUIMSG; + +//GUI Typedefs +struct _TYPEDESCRIPTOR; + +typedef void (*GUICALLBACK)(); +typedef void (*GUICALLBACKEX)(void*); +typedef bool (*GUISCRIPTEXECUTE)(const char* text); +typedef void (*GUISCRIPTCOMPLETER)(const char* text, char** entries, int* entryCount); +typedef bool (*TYPETOSTRING)(const struct _TYPEDESCRIPTOR* type, char* dest, size_t* destCount); //don't change destCount for final failure + +//GUI structures +typedef struct +{ + int row; + int col; + const char* str; +} CELLINFO; + +typedef struct +{ + duint start; + duint end; +} SELECTIONDATA; + +typedef struct +{ + const void* data; + duint size; +} ICONDATA; + +typedef struct +{ + char name[64]; + int id; + GUISCRIPTEXECUTE execute; + GUISCRIPTCOMPLETER completeCommand; +} SCRIPTTYPEINFO; + +typedef struct +{ + void* titleHwnd; + void* classHwnd; + char title[MAX_STRING_SIZE]; + char className[MAX_STRING_SIZE]; +} ACTIVEVIEW; + +typedef struct _TYPEDESCRIPTOR +{ + bool expanded; //is the type node expanded? + bool reverse; //big endian? + const char* name; //type name (int b) + duint addr; //virtual address + duint offset; //offset to addr for the actual location + int id; //type id + int size; //sizeof(type) + TYPETOSTRING callback; //convert to string + void* userdata; //user data +} TYPEDESCRIPTOR; + +//GUI functions +//code page is utf8 +BRIDGE_IMPEXP const char* GuiTranslateText(const char* Source); +BRIDGE_IMPEXP void GuiDisasmAt(duint addr, duint cip); +BRIDGE_IMPEXP void GuiSetDebugState(DBGSTATE state); +BRIDGE_IMPEXP void GuiSetDebugStateFast(DBGSTATE state); +BRIDGE_IMPEXP void GuiAddLogMessage(const char* msg); +BRIDGE_IMPEXP void GuiAddLogMessageHtml(const char* msg); +BRIDGE_IMPEXP void GuiLogClear(); +BRIDGE_IMPEXP void GuiUpdateAllViews(); +BRIDGE_IMPEXP void GuiUpdateRegisterView(); +BRIDGE_IMPEXP void GuiUpdateDisassemblyView(); +BRIDGE_IMPEXP void GuiUpdateBreakpointsView(); +BRIDGE_IMPEXP void GuiUpdateWindowTitle(const char* filename); +BRIDGE_IMPEXP HWND GuiGetWindowHandle(); +BRIDGE_IMPEXP void GuiDumpAt(duint va); +BRIDGE_IMPEXP void GuiScriptAdd(int count, const char** lines); +BRIDGE_IMPEXP void GuiScriptClear(); +BRIDGE_IMPEXP void GuiScriptSetIp(int line); +BRIDGE_IMPEXP void GuiScriptError(int line, const char* message); +BRIDGE_IMPEXP void GuiScriptSetTitle(const char* title); +BRIDGE_IMPEXP void GuiScriptSetInfoLine(int line, const char* info); +BRIDGE_IMPEXP void GuiScriptMessage(const char* message); +BRIDGE_IMPEXP int GuiScriptMsgyn(const char* message); +BRIDGE_IMPEXP void GuiScriptEnableHighlighting(bool enable); +BRIDGE_IMPEXP void GuiSymbolLogAdd(const char* message); +BRIDGE_IMPEXP void GuiSymbolLogClear(); +BRIDGE_IMPEXP void GuiSymbolSetProgress(int percent); +BRIDGE_IMPEXP void GuiSymbolUpdateModuleList(int count, SYMBOLMODULEINFO* modules); +BRIDGE_IMPEXP void GuiSymbolRefreshCurrent(); +BRIDGE_IMPEXP void GuiReferenceAddColumn(int width, const char* title); +BRIDGE_IMPEXP void GuiReferenceSetRowCount(int count); +BRIDGE_IMPEXP int GuiReferenceGetRowCount(); +BRIDGE_IMPEXP int GuiReferenceSearchGetRowCount(); +BRIDGE_IMPEXP void GuiReferenceDeleteAllColumns(); +BRIDGE_IMPEXP void GuiReferenceInitialize(const char* name); +BRIDGE_IMPEXP void GuiReferenceSetCellContent(int row, int col, const char* str); +BRIDGE_IMPEXP char* GuiReferenceGetCellContent(int row, int col); +BRIDGE_IMPEXP char* GuiReferenceSearchGetCellContent(int row, int col); +BRIDGE_IMPEXP void GuiReferenceReloadData(); +BRIDGE_IMPEXP void GuiReferenceSetSingleSelection(int index, bool scroll); +BRIDGE_IMPEXP void GuiReferenceSetProgress(int progress); +BRIDGE_IMPEXP void GuiReferenceSetCurrentTaskProgress(int progress, const char* taskTitle); +BRIDGE_IMPEXP void GuiReferenceSetSearchStartCol(int col); +BRIDGE_IMPEXP void GuiStackDumpAt(duint addr, duint csp); +BRIDGE_IMPEXP void GuiUpdateDumpView(); +BRIDGE_IMPEXP void GuiUpdateWatchView(); +BRIDGE_IMPEXP void GuiUpdateThreadView(); +BRIDGE_IMPEXP void GuiUpdateMemoryView(); +BRIDGE_IMPEXP void GuiAddRecentFile(const char* file); +BRIDGE_IMPEXP void GuiSetLastException(unsigned int exception); +BRIDGE_IMPEXP bool GuiGetDisassembly(duint addr, char* text); +BRIDGE_IMPEXP int GuiMenuAdd(int hMenu, const char* title); +BRIDGE_IMPEXP int GuiMenuAddEntry(int hMenu, const char* title); +BRIDGE_IMPEXP void GuiMenuAddSeparator(int hMenu); +BRIDGE_IMPEXP void GuiMenuClear(int hMenu); +BRIDGE_IMPEXP void GuiMenuRemove(int hEntryMenu); +BRIDGE_IMPEXP bool GuiSelectionGet(GUISELECTIONTYPE hWindow, SELECTIONDATA* selection); +BRIDGE_IMPEXP bool GuiSelectionSet(GUISELECTIONTYPE hWindow, const SELECTIONDATA* selection); +BRIDGE_IMPEXP bool GuiGetLineWindow(const char* title, char* text); +BRIDGE_IMPEXP void GuiAutoCompleteAddCmd(const char* cmd); +BRIDGE_IMPEXP void GuiAutoCompleteDelCmd(const char* cmd); +BRIDGE_IMPEXP void GuiAutoCompleteClearAll(); +BRIDGE_IMPEXP void GuiAddStatusBarMessage(const char* msg); +BRIDGE_IMPEXP void GuiUpdateSideBar(); +BRIDGE_IMPEXP void GuiRepaintTableView(); +BRIDGE_IMPEXP void GuiUpdatePatches(); +BRIDGE_IMPEXP void GuiUpdateCallStack(); +BRIDGE_IMPEXP void GuiUpdateSEHChain(); +BRIDGE_IMPEXP void GuiLoadSourceFileEx(const char* path, duint addr); +BRIDGE_IMPEXP void GuiMenuSetIcon(int hMenu, const ICONDATA* icon); +BRIDGE_IMPEXP void GuiMenuSetEntryIcon(int hEntry, const ICONDATA* icon); +BRIDGE_IMPEXP void GuiMenuSetEntryChecked(int hEntry, bool checked); +BRIDGE_IMPEXP void GuiMenuSetVisible(int hMenu, bool visible); +BRIDGE_IMPEXP void GuiMenuSetEntryVisible(int hEntry, bool visible); +BRIDGE_IMPEXP void GuiMenuSetName(int hMenu, const char* name); +BRIDGE_IMPEXP void GuiMenuSetEntryName(int hEntry, const char* name); +BRIDGE_IMPEXP void GuiMenuSetEntryHotkey(int hEntry, const char* hack); +BRIDGE_IMPEXP void GuiShowCpu(); +BRIDGE_IMPEXP void GuiAddQWidgetTab(void* qWidget); +BRIDGE_IMPEXP void GuiShowQWidgetTab(void* qWidget); +BRIDGE_IMPEXP void GuiCloseQWidgetTab(void* qWidget); +BRIDGE_IMPEXP void GuiExecuteOnGuiThread(GUICALLBACK cbGuiThread); +BRIDGE_IMPEXP void GuiUpdateTimeWastedCounter(); +BRIDGE_IMPEXP void GuiSetGlobalNotes(const char* text); +BRIDGE_IMPEXP void GuiGetGlobalNotes(char** text); +BRIDGE_IMPEXP void GuiSetDebuggeeNotes(const char* text); +BRIDGE_IMPEXP void GuiGetDebuggeeNotes(char** text); +BRIDGE_IMPEXP void GuiDumpAtN(duint va, int index); +BRIDGE_IMPEXP void GuiDisplayWarning(const char* title, const char* text); +BRIDGE_IMPEXP void GuiRegisterScriptLanguage(SCRIPTTYPEINFO* info); +BRIDGE_IMPEXP void GuiUnregisterScriptLanguage(int id); +BRIDGE_IMPEXP void GuiUpdateArgumentWidget(); +BRIDGE_IMPEXP void GuiFocusView(int hWindow); +BRIDGE_IMPEXP bool GuiIsUpdateDisabled(); +BRIDGE_IMPEXP void GuiUpdateEnable(bool updateNow); +BRIDGE_IMPEXP void GuiUpdateDisable(); +BRIDGE_IMPEXP bool GuiLoadGraph(BridgeCFGraphList* graph, duint addr); +BRIDGE_IMPEXP duint GuiGraphAt(duint addr); +BRIDGE_IMPEXP void GuiUpdateGraphView(); +BRIDGE_IMPEXP void GuiDisableLog(); +BRIDGE_IMPEXP void GuiEnableLog(); +BRIDGE_IMPEXP void GuiAddFavouriteTool(const char* name, const char* description); +BRIDGE_IMPEXP void GuiAddFavouriteCommand(const char* name, const char* shortcut); +BRIDGE_IMPEXP void GuiSetFavouriteToolShortcut(const char* name, const char* shortcut); +BRIDGE_IMPEXP void GuiFoldDisassembly(duint startAddress, duint length); +BRIDGE_IMPEXP void GuiSelectInMemoryMap(duint addr); +BRIDGE_IMPEXP void GuiGetActiveView(ACTIVEVIEW* activeView); +BRIDGE_IMPEXP void GuiAddInfoLine(const char* infoLine); +BRIDGE_IMPEXP void GuiProcessEvents(); +BRIDGE_IMPEXP void* GuiTypeAddNode(void* parent, const TYPEDESCRIPTOR* type); +BRIDGE_IMPEXP bool GuiTypeClear(); +BRIDGE_IMPEXP void GuiUpdateTypeWidget(); +BRIDGE_IMPEXP void GuiCloseApplication(); +BRIDGE_IMPEXP void GuiFlushLog(); +BRIDGE_IMPEXP void GuiReferenceAddCommand(const char* title, const char* command); +BRIDGE_IMPEXP void GuiUpdateTraceBrowser(); +BRIDGE_IMPEXP void GuiOpenTraceFile(const char* fileName); +BRIDGE_IMPEXP void GuiInvalidateSymbolSource(duint base); +BRIDGE_IMPEXP void GuiExecuteOnGuiThreadEx(GUICALLBACKEX cbGuiThread, void* userdata); +BRIDGE_IMPEXP void GuiGetCurrentGraph(BridgeCFGraphList* graphList); +BRIDGE_IMPEXP void GuiShowReferences(); +BRIDGE_IMPEXP void GuiSelectInSymbolsTab(duint addr); + +#ifdef __cplusplus +} +#endif + +#pragma pack(pop) + +#endif // _BRIDGEMAIN_H_ + +``` + +`AutoAttach/pluginsdk/dbghelp/dbghelp.h`: + +```h +#ifndef _DBGHELP_ +#define _DBGHELP_ + + +// As a general principal always call the 64 bit version +// of every API, if a choice exists. The 64 bit version +// works great on 32 bit platforms, and is forward +// compatible to 64 bit platforms. + +#ifdef _WIN64 +#ifndef _IMAGEHLP64 +#define _IMAGEHLP64 +#endif +#endif + +#pragma pack(push,8) + +// For those without specstrings.h +// Since there are different versions of this header, I need to +// individually test each item and define it if it is not around. + +#ifndef __in +#define __in +#endif +#ifndef __out +#define __out +#endif +#ifndef __inout +#define __inout +#endif +#ifndef __in_opt +#define __in_opt +#endif +#ifndef __out_opt +#define __out_opt +#endif +#ifndef __inout_opt +#define __inout_opt +#endif +#ifndef __in_ecount +#define __in_ecount(x) +#endif +#ifndef __out_ecount +#define __out_ecount(x) +#endif +#ifndef __inout_ecount +#define __inout_ecount(x) +#endif +#ifndef __in_bcount +#define __in_bcount(x) +#endif +#ifndef __out_bcount +#define __out_bcount(x) +#endif +#ifndef __inout_bcount +#define __inout_bcount(x) +#endif +#ifndef __out_xcount +#define __out_xcount(x) +#endif +#ifndef __deref_opt_out +#define __deref_opt_out +#endif +#ifndef __deref_out +#define __deref_out +#endif +#ifndef __out_ecount_opt +#define __out_ecount_opt(x) +#endif +#ifndef __in_bcount_opt +#define __in_bcount_opt(x) +#endif +#ifndef __out_bcount_opt +#define __out_bcount_opt(x) +#endif +#ifndef __deref_out_opt +#define __deref_out_opt +#endif + + +#ifdef __cplusplus +extern "C" { +#endif + +#ifdef _IMAGEHLP_SOURCE_ +#define IMAGEAPI __stdcall +#define DBHLP_DEPRECIATED +#else +#define IMAGEAPI DECLSPEC_IMPORT __stdcall +#if (_MSC_VER >= 1300) && !defined(MIDL_PASS) +#define DBHLP_DEPRECIATED __declspec(deprecated) +#else +#define DBHLP_DEPRECIATED +#endif +#endif + +#define DBHLPAPI IMAGEAPI + +#define IMAGE_SEPARATION (64*1024) + +// Observant readers may notice that 2 new fields, +// 'fReadOnly' and 'Version' have been added to +// the LOADED_IMAGE structure after 'fDOSImage'. +// This does not change the size of the structure +// from previous headers. That is because while +// 'fDOSImage' is a byte, it is padded by the +// compiler to 4 bytes. So the 2 new fields are +// slipped into the extra space. + +typedef struct _LOADED_IMAGE +{ + PSTR ModuleName; + HANDLE hFile; + PUCHAR MappedAddress; +#ifdef _IMAGEHLP64 + PIMAGE_NT_HEADERS64 FileHeader; +#else + PIMAGE_NT_HEADERS32 FileHeader; +#endif + PIMAGE_SECTION_HEADER LastRvaSection; + ULONG NumberOfSections; + PIMAGE_SECTION_HEADER Sections; + ULONG Characteristics; + BOOLEAN fSystemImage; + BOOLEAN fDOSImage; + BOOLEAN fReadOnly; + UCHAR Version; + LIST_ENTRY Links; + ULONG SizeOfImage; +} LOADED_IMAGE, *PLOADED_IMAGE; + +#define MAX_SYM_NAME 2000 + + +// Error codes set by dbghelp functions. Call GetLastError +// to see them. +// Dbghelp also sets error codes found in winerror.h + +#define ERROR_IMAGE_NOT_STRIPPED 0x8800 // the image is not stripped. No dbg file available. +#define ERROR_NO_DBG_POINTER 0x8801 // image is stripped but there is no pointer to a dbg file +#define ERROR_NO_PDB_POINTER 0x8802 // image does not point to a pdb file + +typedef BOOL +(CALLBACK* PFIND_DEBUG_FILE_CALLBACK)( + __in HANDLE FileHandle, + __in PCSTR FileName, + __in PVOID CallerData +); + +HANDLE +IMAGEAPI +SymFindDebugInfoFile( + __in HANDLE hProcess, + __in PCSTR FileName, + __out_ecount(MAX_PATH + 1) PSTR DebugFilePath, + __in_opt PFIND_DEBUG_FILE_CALLBACK Callback, + __in_opt PVOID CallerData +); + +typedef BOOL +(CALLBACK* PFIND_DEBUG_FILE_CALLBACKW)( + __in HANDLE FileHandle, + __in PCWSTR FileName, + __in PVOID CallerData +); + +HANDLE +IMAGEAPI +SymFindDebugInfoFileW( + __in HANDLE hProcess, + __in PCWSTR FileName, + __out_ecount(MAX_PATH + 1) PWSTR DebugFilePath, + __in_opt PFIND_DEBUG_FILE_CALLBACKW Callback, + __in_opt PVOID CallerData +); + +HANDLE +IMAGEAPI +FindDebugInfoFile( + __in PCSTR FileName, + __in PCSTR SymbolPath, + __out_ecount(MAX_PATH + 1) PSTR DebugFilePath +); + +HANDLE +IMAGEAPI +FindDebugInfoFileEx( + __in PCSTR FileName, + __in PCSTR SymbolPath, + __out_ecount(MAX_PATH + 1) PSTR DebugFilePath, + __in_opt PFIND_DEBUG_FILE_CALLBACK Callback, + __in_opt PVOID CallerData +); + +HANDLE +IMAGEAPI +FindDebugInfoFileExW( + __in PCWSTR FileName, + __in PCWSTR SymbolPath, + __out_ecount(MAX_PATH + 1) PWSTR DebugFilePath, + __in_opt PFIND_DEBUG_FILE_CALLBACKW Callback, + __in_opt PVOID CallerData +); + +typedef BOOL +(CALLBACK* PFINDFILEINPATHCALLBACK)( + __in PCSTR filename, + __in PVOID context +); + +BOOL +IMAGEAPI +SymFindFileInPath( + __in HANDLE hprocess, + __in_opt PCSTR SearchPath, + __in PCSTR FileName, + __in_opt PVOID id, + __in DWORD two, + __in DWORD three, + __in DWORD flags, + __out_ecount(MAX_PATH + 1) PSTR FoundFile, + __in_opt PFINDFILEINPATHCALLBACK callback, + __in_opt PVOID context +); + +typedef BOOL +(CALLBACK* PFINDFILEINPATHCALLBACKW)( + __in PCWSTR filename, + __in PVOID context +); + +BOOL +IMAGEAPI +SymFindFileInPathW( + __in HANDLE hprocess, + __in_opt PCWSTR SearchPath, + __in PCWSTR FileName, + __in_opt PVOID id, + __in DWORD two, + __in DWORD three, + __in DWORD flags, + __out_ecount(MAX_PATH + 1) PWSTR FoundFile, + __in_opt PFINDFILEINPATHCALLBACKW callback, + __in_opt PVOID context +); + +typedef BOOL +(CALLBACK* PFIND_EXE_FILE_CALLBACK)( + __in HANDLE FileHandle, + __in PCSTR FileName, + __in_opt PVOID CallerData +); + +HANDLE +IMAGEAPI +SymFindExecutableImage( + __in HANDLE hProcess, + __in PCSTR FileName, + __out_ecount(MAX_PATH + 1) PSTR ImageFilePath, + __in PFIND_EXE_FILE_CALLBACK Callback, + __in PVOID CallerData +); + +typedef BOOL +(CALLBACK* PFIND_EXE_FILE_CALLBACKW)( + __in HANDLE FileHandle, + __in PCWSTR FileName, + __in_opt PVOID CallerData +); + +HANDLE +IMAGEAPI +SymFindExecutableImageW( + __in HANDLE hProcess, + __in PCWSTR FileName, + __out_ecount(MAX_PATH + 1) PWSTR ImageFilePath, + __in PFIND_EXE_FILE_CALLBACKW Callback, + __in PVOID CallerData +); + +HANDLE +IMAGEAPI +FindExecutableImage( + __in PCSTR FileName, + __in PCSTR SymbolPath, + __out_ecount(MAX_PATH + 1) PSTR ImageFilePath +); + +HANDLE +IMAGEAPI +FindExecutableImageEx( + __in PCSTR FileName, + __in PCSTR SymbolPath, + __out_ecount(MAX_PATH + 1) PSTR ImageFilePath, + __in_opt PFIND_EXE_FILE_CALLBACK Callback, + __in_opt PVOID CallerData +); + +HANDLE +IMAGEAPI +FindExecutableImageExW( + __in PCWSTR FileName, + __in PCWSTR SymbolPath, + __out_ecount(MAX_PATH + 1) PWSTR ImageFilePath, + __in_opt PFIND_EXE_FILE_CALLBACKW Callback, + __in PVOID CallerData +); + +PIMAGE_NT_HEADERS +IMAGEAPI +ImageNtHeader( + __in PVOID Base +); + +PVOID +IMAGEAPI +ImageDirectoryEntryToDataEx( + __in PVOID Base, + __in BOOLEAN MappedAsImage, + __in USHORT DirectoryEntry, + __out PULONG Size, + __out_opt PIMAGE_SECTION_HEADER* FoundHeader +); + +PVOID +IMAGEAPI +ImageDirectoryEntryToData( + __in PVOID Base, + __in BOOLEAN MappedAsImage, + __in USHORT DirectoryEntry, + __out PULONG Size +); + +PIMAGE_SECTION_HEADER +IMAGEAPI +ImageRvaToSection( + __in PIMAGE_NT_HEADERS NtHeaders, + __in PVOID Base, + __in ULONG Rva +); + +PVOID +IMAGEAPI +ImageRvaToVa( + __in PIMAGE_NT_HEADERS NtHeaders, + __in PVOID Base, + __in ULONG Rva, + __in_opt OUT PIMAGE_SECTION_HEADER* LastRvaSection +); + +#ifndef _WIN64 +// This api won't be ported to Win64 - Fix your code. + +typedef struct _IMAGE_DEBUG_INFORMATION +{ + LIST_ENTRY List; + DWORD ReservedSize; + PVOID ReservedMappedBase; + USHORT ReservedMachine; + USHORT ReservedCharacteristics; + DWORD ReservedCheckSum; + DWORD ImageBase; + DWORD SizeOfImage; + + DWORD ReservedNumberOfSections; + PIMAGE_SECTION_HEADER ReservedSections; + + DWORD ReservedExportedNamesSize; + PSTR ReservedExportedNames; + + DWORD ReservedNumberOfFunctionTableEntries; + PIMAGE_FUNCTION_ENTRY ReservedFunctionTableEntries; + DWORD ReservedLowestFunctionStartingAddress; + DWORD ReservedHighestFunctionEndingAddress; + + DWORD ReservedNumberOfFpoTableEntries; + PFPO_DATA ReservedFpoTableEntries; + + DWORD SizeOfCoffSymbols; + PIMAGE_COFF_SYMBOLS_HEADER CoffSymbols; + + DWORD ReservedSizeOfCodeViewSymbols; + PVOID ReservedCodeViewSymbols; + + PSTR ImageFilePath; + PSTR ImageFileName; + PSTR ReservedDebugFilePath; + + DWORD ReservedTimeDateStamp; + + BOOL ReservedRomImage; + PIMAGE_DEBUG_DIRECTORY ReservedDebugDirectory; + DWORD ReservedNumberOfDebugDirectories; + + DWORD ReservedOriginalFunctionTableBaseAddress; + + DWORD Reserved[ 2 ]; + +} IMAGE_DEBUG_INFORMATION, *PIMAGE_DEBUG_INFORMATION; + + +PIMAGE_DEBUG_INFORMATION +IMAGEAPI +MapDebugInformation( + __in_opt HANDLE FileHandle, + __in PCSTR FileName, + __in_opt PCSTR SymbolPath, + __in ULONG ImageBase +); + +BOOL +IMAGEAPI +UnmapDebugInformation( + __out_xcount(unknown) PIMAGE_DEBUG_INFORMATION DebugInfo +); + +#endif + +BOOL +IMAGEAPI +SearchTreeForFile( + __in PCSTR RootPath, + __in PCSTR InputPathName, + __out_ecount(MAX_PATH + 1) PSTR OutputPathBuffer +); + +BOOL +IMAGEAPI +SearchTreeForFileW( + __in PCWSTR RootPath, + __in PCWSTR InputPathName, + __out_ecount(MAX_PATH + 1) PWSTR OutputPathBuffer +); + +typedef BOOL +(CALLBACK* PENUMDIRTREE_CALLBACK)( + __in PCSTR FilePath, + __in_opt PVOID CallerData +); + +BOOL +IMAGEAPI +EnumDirTree( + __in_opt HANDLE hProcess, + __in PCSTR RootPath, + __in PCSTR InputPathName, + __out_ecount_opt(MAX_PATH + 1) PSTR OutputPathBuffer, + __in_opt PENUMDIRTREE_CALLBACK cb, + __in_opt PVOID data +); + +typedef BOOL +(CALLBACK* PENUMDIRTREE_CALLBACKW)( + __in PCWSTR FilePath, + __in_opt PVOID CallerData +); + +BOOL +IMAGEAPI +EnumDirTreeW( + __in_opt HANDLE hProcess, + __in PCWSTR RootPath, + __in PCWSTR InputPathName, + __out_ecount_opt(MAX_PATH + 1) PWSTR OutputPathBuffer, + __in_opt PENUMDIRTREE_CALLBACKW cb, + __in_opt PVOID data +); + +BOOL +IMAGEAPI +MakeSureDirectoryPathExists( + __in PCSTR DirPath +); + +// +// UnDecorateSymbolName Flags +// + +#define UNDNAME_COMPLETE (0x0000) // Enable full undecoration +#define UNDNAME_NO_LEADING_UNDERSCORES (0x0001) // Remove leading underscores from MS extended keywords +#define UNDNAME_NO_MS_KEYWORDS (0x0002) // Disable expansion of MS extended keywords +#define UNDNAME_NO_FUNCTION_RETURNS (0x0004) // Disable expansion of return type for primary declaration +#define UNDNAME_NO_ALLOCATION_MODEL (0x0008) // Disable expansion of the declaration model +#define UNDNAME_NO_ALLOCATION_LANGUAGE (0x0010) // Disable expansion of the declaration language specifier +#define UNDNAME_NO_MS_THISTYPE (0x0020) // NYI Disable expansion of MS keywords on the 'this' type for primary declaration +#define UNDNAME_NO_CV_THISTYPE (0x0040) // NYI Disable expansion of CV modifiers on the 'this' type for primary declaration +#define UNDNAME_NO_THISTYPE (0x0060) // Disable all modifiers on the 'this' type +#define UNDNAME_NO_ACCESS_SPECIFIERS (0x0080) // Disable expansion of access specifiers for members +#define UNDNAME_NO_THROW_SIGNATURES (0x0100) // Disable expansion of 'throw-signatures' for functions and pointers to functions +#define UNDNAME_NO_MEMBER_TYPE (0x0200) // Disable expansion of 'static' or 'virtual'ness of members +#define UNDNAME_NO_RETURN_UDT_MODEL (0x0400) // Disable expansion of MS model for UDT returns +#define UNDNAME_32_BIT_DECODE (0x0800) // Undecorate 32-bit decorated names +#define UNDNAME_NAME_ONLY (0x1000) // Crack only the name for primary declaration; +// return just [scope::]name. Does expand template params +#define UNDNAME_NO_ARGUMENTS (0x2000) // Don't undecorate arguments to function +#define UNDNAME_NO_SPECIAL_SYMS (0x4000) // Don't undecorate special names (v-table, vcall, vector xxx, metatype, etc) + +DWORD +IMAGEAPI +WINAPI +UnDecorateSymbolName( + __in PCSTR name, + __out_ecount(maxStringLength) PSTR outputString, + __in DWORD maxStringLength, + __in DWORD flags +); + +DWORD +IMAGEAPI +WINAPI +UnDecorateSymbolNameW( + __in PCWSTR name, + __out_ecount(maxStringLength) PWSTR outputString, + __in DWORD maxStringLength, + __in DWORD flags +); + +// +// these values are used for synthesized file types +// that can be passed in as image headers instead of +// the standard ones from ntimage.h +// + +#define DBHHEADER_DEBUGDIRS 0x1 +#define DBHHEADER_CVMISC 0x2 +#define DBHHEADER_PDBGUID 0x3 +typedef struct _MODLOAD_DATA +{ + DWORD ssize; // size of this struct + DWORD ssig; // signature identifying the passed data + PVOID data; // pointer to passed data + DWORD size; // size of passed data + DWORD flags; // options +} MODLOAD_DATA, *PMODLOAD_DATA; + +typedef struct _MODLOAD_CVMISC +{ + DWORD oCV; // ofset to the codeview record + size_t cCV; // size of the codeview record + DWORD oMisc; // offset to the misc record + size_t cMisc; // size of the misc record + DWORD dtImage; // datetime stamp of the image + DWORD cImage; // size of the image +} MODLOAD_CVMISC, *PMODLOAD_CVMISC; + +typedef struct _MODLOAD_PDBGUID_PDBAGE +{ + GUID PdbGuid; // Pdb Guid + DWORD PdbAge; // Pdb Age +} MODLOAD_PDBGUID_PDBAGE, *PMODLOAD_PDBGUID_PDBAGE; + +// +// StackWalking API +// + +typedef enum +{ + AddrMode1616, + AddrMode1632, + AddrModeReal, + AddrModeFlat +} ADDRESS_MODE; + +typedef struct _tagADDRESS64 +{ + DWORD64 Offset; + WORD Segment; + ADDRESS_MODE Mode; +} ADDRESS64, *LPADDRESS64; + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define ADDRESS ADDRESS64 +#define LPADDRESS LPADDRESS64 +#else +typedef struct _tagADDRESS +{ + DWORD Offset; + WORD Segment; + ADDRESS_MODE Mode; +} ADDRESS, *LPADDRESS; + +__inline +void +Address32To64( + __in LPADDRESS a32, + __out LPADDRESS64 a64 +) +{ + a64->Offset = (ULONG64)(LONG64)(LONG)a32->Offset; + a64->Segment = a32->Segment; + a64->Mode = a32->Mode; +} + +__inline +void +Address64To32( + __in LPADDRESS64 a64, + __out LPADDRESS a32 +) +{ + a32->Offset = (ULONG)a64->Offset; + a32->Segment = a64->Segment; + a32->Mode = a64->Mode; +} +#endif + +// +// This structure is included in the STACKFRAME structure, +// and is used to trace through usermode callbacks in a thread's +// kernel stack. The values must be copied by the kernel debugger +// from the DBGKD_GET_VERSION and WAIT_STATE_CHANGE packets. +// + +// +// New KDHELP structure for 64 bit system support. +// This structure is preferred in new code. +// +typedef struct _KDHELP64 +{ + + // + // address of kernel thread object, as provided in the + // WAIT_STATE_CHANGE packet. + // + DWORD64 Thread; + + // + // offset in thread object to pointer to the current callback frame + // in kernel stack. + // + DWORD ThCallbackStack; + + // + // offset in thread object to pointer to the current callback backing + // store frame in kernel stack. + // + DWORD ThCallbackBStore; + + // + // offsets to values in frame: + // + // address of next callback frame + DWORD NextCallback; + + // address of saved frame pointer (if applicable) + DWORD FramePointer; + + + // + // Address of the kernel function that calls out to user mode + // + DWORD64 KiCallUserMode; + + // + // Address of the user mode dispatcher function + // + DWORD64 KeUserCallbackDispatcher; + + // + // Lowest kernel mode address + // + DWORD64 SystemRangeStart; + + // + // Address of the user mode exception dispatcher function. + // Added in API version 10. + // + DWORD64 KiUserExceptionDispatcher; + + // + // Stack bounds, added in API version 11. + // + DWORD64 StackBase; + DWORD64 StackLimit; + + DWORD64 Reserved[5]; + +} KDHELP64, *PKDHELP64; + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define KDHELP KDHELP64 +#define PKDHELP PKDHELP64 +#else +typedef struct _KDHELP +{ + + // + // address of kernel thread object, as provided in the + // WAIT_STATE_CHANGE packet. + // + DWORD Thread; + + // + // offset in thread object to pointer to the current callback frame + // in kernel stack. + // + DWORD ThCallbackStack; + + // + // offsets to values in frame: + // + // address of next callback frame + DWORD NextCallback; + + // address of saved frame pointer (if applicable) + DWORD FramePointer; + + // + // Address of the kernel function that calls out to user mode + // + DWORD KiCallUserMode; + + // + // Address of the user mode dispatcher function + // + DWORD KeUserCallbackDispatcher; + + // + // Lowest kernel mode address + // + DWORD SystemRangeStart; + + // + // offset in thread object to pointer to the current callback backing + // store frame in kernel stack. + // + DWORD ThCallbackBStore; + + // + // Address of the user mode exception dispatcher function. + // Added in API version 10. + // + DWORD KiUserExceptionDispatcher; + + // + // Stack bounds, added in API version 11. + // + DWORD StackBase; + DWORD StackLimit; + + DWORD Reserved[5]; + +} KDHELP, *PKDHELP; + +__inline +void +KdHelp32To64( + __in PKDHELP p32, + __out PKDHELP64 p64 +) +{ + p64->Thread = p32->Thread; + p64->ThCallbackStack = p32->ThCallbackStack; + p64->NextCallback = p32->NextCallback; + p64->FramePointer = p32->FramePointer; + p64->KiCallUserMode = p32->KiCallUserMode; + p64->KeUserCallbackDispatcher = p32->KeUserCallbackDispatcher; + p64->SystemRangeStart = p32->SystemRangeStart; + p64->KiUserExceptionDispatcher = p32->KiUserExceptionDispatcher; + p64->StackBase = p32->StackBase; + p64->StackLimit = p32->StackLimit; +} +#endif + +typedef struct _tagSTACKFRAME64 +{ + ADDRESS64 AddrPC; // program counter + ADDRESS64 AddrReturn; // return address + ADDRESS64 AddrFrame; // frame pointer + ADDRESS64 AddrStack; // stack pointer + ADDRESS64 AddrBStore; // backing store pointer + PVOID FuncTableEntry; // pointer to pdata/fpo or NULL + DWORD64 Params[4]; // possible arguments to the function + BOOL Far; // WOW far call + BOOL Virtual; // is this a virtual frame? + DWORD64 Reserved[3]; + KDHELP64 KdHelp; +} STACKFRAME64, *LPSTACKFRAME64; + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define STACKFRAME STACKFRAME64 +#define LPSTACKFRAME LPSTACKFRAME64 +#else +typedef struct _tagSTACKFRAME +{ + ADDRESS AddrPC; // program counter + ADDRESS AddrReturn; // return address + ADDRESS AddrFrame; // frame pointer + ADDRESS AddrStack; // stack pointer + PVOID FuncTableEntry; // pointer to pdata/fpo or NULL + DWORD Params[4]; // possible arguments to the function + BOOL Far; // WOW far call + BOOL Virtual; // is this a virtual frame? + DWORD Reserved[3]; + KDHELP KdHelp; + ADDRESS AddrBStore; // backing store pointer +} STACKFRAME, *LPSTACKFRAME; +#endif + + +typedef +BOOL +(__stdcall* PREAD_PROCESS_MEMORY_ROUTINE64)( + __in HANDLE hProcess, + __in DWORD64 qwBaseAddress, + __out_bcount(nSize) PVOID lpBuffer, + __in DWORD nSize, + __out LPDWORD lpNumberOfBytesRead +); + +typedef +PVOID +(__stdcall* PFUNCTION_TABLE_ACCESS_ROUTINE64)( + __in HANDLE ahProcess, + __in DWORD64 AddrBase +); + +typedef +DWORD64 +(__stdcall* PGET_MODULE_BASE_ROUTINE64)( + __in HANDLE hProcess, + __in DWORD64 Address +); + +typedef +DWORD64 +(__stdcall* PTRANSLATE_ADDRESS_ROUTINE64)( + __in HANDLE hProcess, + __in HANDLE hThread, + __in LPADDRESS64 lpaddr +); + +BOOL +IMAGEAPI +StackWalk64( + __in DWORD MachineType, + __in HANDLE hProcess, + __in HANDLE hThread, + __inout LPSTACKFRAME64 StackFrame, + __inout PVOID ContextRecord, + __in_opt PREAD_PROCESS_MEMORY_ROUTINE64 ReadMemoryRoutine, + __in_opt PFUNCTION_TABLE_ACCESS_ROUTINE64 FunctionTableAccessRoutine, + __in_opt PGET_MODULE_BASE_ROUTINE64 GetModuleBaseRoutine, + __in_opt PTRANSLATE_ADDRESS_ROUTINE64 TranslateAddress +); + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) + +#define PREAD_PROCESS_MEMORY_ROUTINE PREAD_PROCESS_MEMORY_ROUTINE64 +#define PFUNCTION_TABLE_ACCESS_ROUTINE PFUNCTION_TABLE_ACCESS_ROUTINE64 +#define PGET_MODULE_BASE_ROUTINE PGET_MODULE_BASE_ROUTINE64 +#define PTRANSLATE_ADDRESS_ROUTINE PTRANSLATE_ADDRESS_ROUTINE64 + +#define StackWalk StackWalk64 + +#else + +typedef +BOOL +(__stdcall* PREAD_PROCESS_MEMORY_ROUTINE)( + __in HANDLE hProcess, + __in DWORD lpBaseAddress, + __out_bcount(nSize) PVOID lpBuffer, + __in DWORD nSize, + __out PDWORD lpNumberOfBytesRead +); + +typedef +PVOID +(__stdcall* PFUNCTION_TABLE_ACCESS_ROUTINE)( + __in HANDLE hProcess, + __in DWORD AddrBase +); + +typedef +DWORD +(__stdcall* PGET_MODULE_BASE_ROUTINE)( + __in HANDLE hProcess, + __in DWORD Address +); + +typedef +DWORD +(__stdcall* PTRANSLATE_ADDRESS_ROUTINE)( + __in HANDLE hProcess, + __in HANDLE hThread, + __out LPADDRESS lpaddr +); + +BOOL +IMAGEAPI +StackWalk( + DWORD MachineType, + __in HANDLE hProcess, + __in HANDLE hThread, + __inout LPSTACKFRAME StackFrame, + __inout PVOID ContextRecord, + __in_opt PREAD_PROCESS_MEMORY_ROUTINE ReadMemoryRoutine, + __in_opt PFUNCTION_TABLE_ACCESS_ROUTINE FunctionTableAccessRoutine, + __in_opt PGET_MODULE_BASE_ROUTINE GetModuleBaseRoutine, + __in_opt PTRANSLATE_ADDRESS_ROUTINE TranslateAddress +); + +#endif + + +#define API_VERSION_NUMBER 11 + +typedef struct API_VERSION +{ + USHORT MajorVersion; + USHORT MinorVersion; + USHORT Revision; + USHORT Reserved; +} API_VERSION, *LPAPI_VERSION; + +LPAPI_VERSION +IMAGEAPI +ImagehlpApiVersion( + VOID +); + +LPAPI_VERSION +IMAGEAPI +ImagehlpApiVersionEx( + __in LPAPI_VERSION AppVersion +); + +DWORD +IMAGEAPI +GetTimestampForLoadedLibrary( + __in HMODULE Module +); + +// +// typedefs for function pointers +// +typedef BOOL +(CALLBACK* PSYM_ENUMMODULES_CALLBACK64)( + __in PCSTR ModuleName, + __in DWORD64 BaseOfDll, + __in_opt PVOID UserContext +); + +typedef BOOL +(CALLBACK* PSYM_ENUMMODULES_CALLBACKW64)( + __in PCWSTR ModuleName, + __in DWORD64 BaseOfDll, + __in_opt PVOID UserContext +); + +typedef BOOL +(CALLBACK* PENUMLOADED_MODULES_CALLBACK64)( + __in PCSTR ModuleName, + __in DWORD64 ModuleBase, + __in ULONG ModuleSize, + __in_opt PVOID UserContext +); + +typedef BOOL +(CALLBACK* PENUMLOADED_MODULES_CALLBACKW64)( + __in PCWSTR ModuleName, + __in DWORD64 ModuleBase, + __in ULONG ModuleSize, + __in_opt PVOID UserContext +); + +typedef BOOL +(CALLBACK* PSYM_ENUMSYMBOLS_CALLBACK64)( + __in PCSTR SymbolName, + __in DWORD64 SymbolAddress, + __in ULONG SymbolSize, + __in_opt PVOID UserContext +); + +typedef BOOL +(CALLBACK* PSYM_ENUMSYMBOLS_CALLBACK64W)( + __in PCWSTR SymbolName, + __in DWORD64 SymbolAddress, + __in ULONG SymbolSize, + __in_opt PVOID UserContext +); + +typedef BOOL +(CALLBACK* PSYMBOL_REGISTERED_CALLBACK64)( + __in HANDLE hProcess, + __in ULONG ActionCode, + __in_opt ULONG64 CallbackData, + __in_opt ULONG64 UserContext +); + +typedef +PVOID +(CALLBACK* PSYMBOL_FUNCENTRY_CALLBACK)( + __in HANDLE hProcess, + __in DWORD AddrBase, + __in_opt PVOID UserContext +); + +typedef +PVOID +(CALLBACK* PSYMBOL_FUNCENTRY_CALLBACK64)( + __in HANDLE hProcess, + __in ULONG64 AddrBase, + __in ULONG64 UserContext +); + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) + +#define PSYM_ENUMMODULES_CALLBACK PSYM_ENUMMODULES_CALLBACK64 +#define PSYM_ENUMSYMBOLS_CALLBACK PSYM_ENUMSYMBOLS_CALLBACK64 +#define PSYM_ENUMSYMBOLS_CALLBACKW PSYM_ENUMSYMBOLS_CALLBACK64W +#define PENUMLOADED_MODULES_CALLBACK PENUMLOADED_MODULES_CALLBACK64 +#define PSYMBOL_REGISTERED_CALLBACK PSYMBOL_REGISTERED_CALLBACK64 +#define PSYMBOL_FUNCENTRY_CALLBACK PSYMBOL_FUNCENTRY_CALLBACK64 + +#else + +typedef BOOL +(CALLBACK* PSYM_ENUMMODULES_CALLBACK)( + __in PCSTR ModuleName, + __in ULONG BaseOfDll, + __in_opt PVOID UserContext +); + +typedef BOOL +(CALLBACK* PSYM_ENUMSYMBOLS_CALLBACK)( + __in PCSTR SymbolName, + __in ULONG SymbolAddress, + __in ULONG SymbolSize, + __in_opt PVOID UserContext +); + +typedef BOOL +(CALLBACK* PSYM_ENUMSYMBOLS_CALLBACKW)( + __in PCWSTR SymbolName, + __in ULONG SymbolAddress, + __in ULONG SymbolSize, + __in_opt PVOID UserContext +); + +typedef BOOL +(CALLBACK* PENUMLOADED_MODULES_CALLBACK)( + __in PCSTR ModuleName, + __in ULONG ModuleBase, + __in ULONG ModuleSize, + __in_opt PVOID UserContext +); + +typedef BOOL +(CALLBACK* PSYMBOL_REGISTERED_CALLBACK)( + __in HANDLE hProcess, + __in ULONG ActionCode, + __in_opt PVOID CallbackData, + __in_opt PVOID UserContext +); + +#endif + + +// values found in SYMBOL_INFO.Tag +// +// This was taken from cvconst.h and should +// not override any values found there. +// +// #define _NO_CVCONST_H_ if you don't +// have access to that file... + +#ifdef _NO_CVCONST_H + +// DIA enums + +enum SymTagEnum +{ + SymTagNull, + SymTagExe, + SymTagCompiland, + SymTagCompilandDetails, + SymTagCompilandEnv, + SymTagFunction, + SymTagBlock, + SymTagData, + SymTagAnnotation, + SymTagLabel, + SymTagPublicSymbol, + SymTagUDT, + SymTagEnum, + SymTagFunctionType, + SymTagPointerType, + SymTagArrayType, + SymTagBaseType, + SymTagTypedef, + SymTagBaseClass, + SymTagFriend, + SymTagFunctionArgType, + SymTagFuncDebugStart, + SymTagFuncDebugEnd, + SymTagUsingNamespace, + SymTagVTableShape, + SymTagVTable, + SymTagCustom, + SymTagThunk, + SymTagCustomType, + SymTagManagedType, + SymTagDimension, + SymTagMax +}; + +#endif + +// +// flags found in SYMBOL_INFO.Flags +// + +#define SYMFLAG_VALUEPRESENT 0x00000001 +#define SYMFLAG_REGISTER 0x00000008 +#define SYMFLAG_REGREL 0x00000010 +#define SYMFLAG_FRAMEREL 0x00000020 +#define SYMFLAG_PARAMETER 0x00000040 +#define SYMFLAG_LOCAL 0x00000080 +#define SYMFLAG_CONSTANT 0x00000100 +#define SYMFLAG_EXPORT 0x00000200 +#define SYMFLAG_FORWARDER 0x00000400 +#define SYMFLAG_FUNCTION 0x00000800 +#define SYMFLAG_VIRTUAL 0x00001000 +#define SYMFLAG_THUNK 0x00002000 +#define SYMFLAG_TLSREL 0x00004000 +#define SYMFLAG_SLOT 0x00008000 +#define SYMFLAG_ILREL 0x00010000 +#define SYMFLAG_METADATA 0x00020000 +#define SYMFLAG_CLR_TOKEN 0x00040000 + +// this resets SymNext/Prev to the beginning +// of the module passed in the address field + +#define SYMFLAG_RESET 0x80000000 + +// +// symbol type enumeration +// +typedef enum +{ + SymNone = 0, + SymCoff, + SymCv, + SymPdb, + SymExport, + SymDeferred, + SymSym, // .sym file + SymDia, + SymVirtual, + NumSymTypes +} SYM_TYPE; + +// +// symbol data structure +// + +typedef struct _IMAGEHLP_SYMBOL64 +{ + DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_SYMBOL64) + DWORD64 Address; // virtual address including dll base address + DWORD Size; // estimated size of symbol, can be zero + DWORD Flags; // info about the symbols, see the SYMF defines + DWORD MaxNameLength; // maximum size of symbol name in 'Name' + CHAR Name[1]; // symbol name (null terminated string) +} IMAGEHLP_SYMBOL64, *PIMAGEHLP_SYMBOL64; + +typedef struct _IMAGEHLP_SYMBOL64_PACKAGE +{ + IMAGEHLP_SYMBOL64 sym; + CHAR name[MAX_SYM_NAME + 1]; +} IMAGEHLP_SYMBOL64_PACKAGE, *PIMAGEHLP_SYMBOL64_PACKAGE; + +typedef struct _IMAGEHLP_SYMBOLW64 +{ + DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_SYMBOLW64) + DWORD64 Address; // virtual address including dll base address + DWORD Size; // estimated size of symbol, can be zero + DWORD Flags; // info about the symbols, see the SYMF defines + DWORD MaxNameLength; // maximum size of symbol name in 'Name' + WCHAR Name[1]; // symbol name (null terminated string) +} IMAGEHLP_SYMBOLW64, *PIMAGEHLP_SYMBOLW64; + +typedef struct _IMAGEHLP_SYMBOLW64_PACKAGE +{ + IMAGEHLP_SYMBOLW64 sym; + WCHAR name[MAX_SYM_NAME + 1]; +} IMAGEHLP_SYMBOLW64_PACKAGE, *PIMAGEHLP_SYMBOLW64_PACKAGE; + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) + +#define IMAGEHLP_SYMBOL IMAGEHLP_SYMBOL64 +#define PIMAGEHLP_SYMBOL PIMAGEHLP_SYMBOL64 +#define IMAGEHLP_SYMBOL_PACKAGE IMAGEHLP_SYMBOL64_PACKAGE +#define PIMAGEHLP_SYMBOL_PACKAGE PIMAGEHLP_SYMBOL64_PACKAGE +#define IMAGEHLP_SYMBOLW IMAGEHLP_SYMBOLW64 +#define PIMAGEHLP_SYMBOLW PIMAGEHLP_SYMBOLW64 +#define IMAGEHLP_SYMBOLW_PACKAGE IMAGEHLP_SYMBOLW64_PACKAGE +#define PIMAGEHLP_SYMBOLW_PACKAGE PIMAGEHLP_SYMBOLW64_PACKAGE + +#else + +typedef struct _IMAGEHLP_SYMBOL +{ + DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_SYMBOL) + DWORD Address; // virtual address including dll base address + DWORD Size; // estimated size of symbol, can be zero + DWORD Flags; // info about the symbols, see the SYMF defines + DWORD MaxNameLength; // maximum size of symbol name in 'Name' + CHAR Name[1]; // symbol name (null terminated string) +} IMAGEHLP_SYMBOL, *PIMAGEHLP_SYMBOL; + +typedef struct _IMAGEHLP_SYMBOL_PACKAGE +{ + IMAGEHLP_SYMBOL sym; + CHAR name[MAX_SYM_NAME + 1]; +} IMAGEHLP_SYMBOL_PACKAGE, *PIMAGEHLP_SYMBOL_PACKAGE; + +typedef struct _IMAGEHLP_SYMBOLW +{ + DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_SYMBOLW) + DWORD Address; // virtual address including dll base address + DWORD Size; // estimated size of symbol, can be zero + DWORD Flags; // info about the symbols, see the SYMF defines + DWORD MaxNameLength; // maximum size of symbol name in 'Name' + WCHAR Name[1]; // symbol name (null terminated string) +} IMAGEHLP_SYMBOLW, *PIMAGEHLP_SYMBOLW; + +typedef struct _IMAGEHLP_SYMBOLW_PACKAGE +{ + IMAGEHLP_SYMBOLW sym; + WCHAR name[MAX_SYM_NAME + 1]; +} IMAGEHLP_SYMBOLW_PACKAGE, *PIMAGEHLP_SYMBOLW_PACKAGE; + +#endif + +// +// module data structure +// + +typedef struct _IMAGEHLP_MODULE64 +{ + DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_MODULE64) + DWORD64 BaseOfImage; // base load address of module + DWORD ImageSize; // virtual size of the loaded module + DWORD TimeDateStamp; // date/time stamp from pe header + DWORD CheckSum; // checksum from the pe header + DWORD NumSyms; // number of symbols in the symbol table + SYM_TYPE SymType; // type of symbols loaded + CHAR ModuleName[32]; // module name + CHAR ImageName[256]; // image name + CHAR LoadedImageName[256]; // symbol file name + // new elements: 07-Jun-2002 + CHAR LoadedPdbName[256]; // pdb file name + DWORD CVSig; // Signature of the CV record in the debug directories + CHAR CVData[MAX_PATH * 3]; // Contents of the CV record + DWORD PdbSig; // Signature of PDB + GUID PdbSig70; // Signature of PDB (VC 7 and up) + DWORD PdbAge; // DBI age of pdb + BOOL PdbUnmatched; // loaded an unmatched pdb + BOOL DbgUnmatched; // loaded an unmatched dbg + BOOL LineNumbers; // we have line number information + BOOL GlobalSymbols; // we have internal symbol information + BOOL TypeInfo; // we have type information + // new elements: 17-Dec-2003 + BOOL SourceIndexed; // pdb supports source server + BOOL Publics; // contains public symbols +} IMAGEHLP_MODULE64, *PIMAGEHLP_MODULE64; + +typedef struct _IMAGEHLP_MODULEW64 +{ + DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_MODULE64) + DWORD64 BaseOfImage; // base load address of module + DWORD ImageSize; // virtual size of the loaded module + DWORD TimeDateStamp; // date/time stamp from pe header + DWORD CheckSum; // checksum from the pe header + DWORD NumSyms; // number of symbols in the symbol table + SYM_TYPE SymType; // type of symbols loaded + WCHAR ModuleName[32]; // module name + WCHAR ImageName[256]; // image name + // new elements: 07-Jun-2002 + WCHAR LoadedImageName[256]; // symbol file name + WCHAR LoadedPdbName[256]; // pdb file name + DWORD CVSig; // Signature of the CV record in the debug directories + WCHAR CVData[MAX_PATH * 3]; // Contents of the CV record + DWORD PdbSig; // Signature of PDB + GUID PdbSig70; // Signature of PDB (VC 7 and up) + DWORD PdbAge; // DBI age of pdb + BOOL PdbUnmatched; // loaded an unmatched pdb + BOOL DbgUnmatched; // loaded an unmatched dbg + BOOL LineNumbers; // we have line number information + BOOL GlobalSymbols; // we have internal symbol information + BOOL TypeInfo; // we have type information + // new elements: 17-Dec-2003 + BOOL SourceIndexed; // pdb supports source server + BOOL Publics; // contains public symbols +} IMAGEHLP_MODULEW64, *PIMAGEHLP_MODULEW64; + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define IMAGEHLP_MODULE IMAGEHLP_MODULE64 +#define PIMAGEHLP_MODULE PIMAGEHLP_MODULE64 +#define IMAGEHLP_MODULEW IMAGEHLP_MODULEW64 +#define PIMAGEHLP_MODULEW PIMAGEHLP_MODULEW64 +#else +typedef struct _IMAGEHLP_MODULE +{ + DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_MODULE) + DWORD BaseOfImage; // base load address of module + DWORD ImageSize; // virtual size of the loaded module + DWORD TimeDateStamp; // date/time stamp from pe header + DWORD CheckSum; // checksum from the pe header + DWORD NumSyms; // number of symbols in the symbol table + SYM_TYPE SymType; // type of symbols loaded + CHAR ModuleName[32]; // module name + CHAR ImageName[256]; // image name + CHAR LoadedImageName[256]; // symbol file name +} IMAGEHLP_MODULE, *PIMAGEHLP_MODULE; + +typedef struct _IMAGEHLP_MODULEW +{ + DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_MODULE) + DWORD BaseOfImage; // base load address of module + DWORD ImageSize; // virtual size of the loaded module + DWORD TimeDateStamp; // date/time stamp from pe header + DWORD CheckSum; // checksum from the pe header + DWORD NumSyms; // number of symbols in the symbol table + SYM_TYPE SymType; // type of symbols loaded + WCHAR ModuleName[32]; // module name + WCHAR ImageName[256]; // image name + WCHAR LoadedImageName[256]; // symbol file name +} IMAGEHLP_MODULEW, *PIMAGEHLP_MODULEW; +#endif + +// +// source file line data structure +// + +typedef struct _IMAGEHLP_LINE64 +{ + DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_LINE64) + PVOID Key; // internal + DWORD LineNumber; // line number in file + PCHAR FileName; // full filename + DWORD64 Address; // first instruction of line +} IMAGEHLP_LINE64, *PIMAGEHLP_LINE64; + +typedef struct _IMAGEHLP_LINEW64 +{ + DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_LINE64) + PVOID Key; // internal + DWORD LineNumber; // line number in file + PWSTR FileName; // full filename + DWORD64 Address; // first instruction of line +} IMAGEHLP_LINEW64, *PIMAGEHLP_LINEW64; + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define IMAGEHLP_LINE IMAGEHLP_LINE64 +#define PIMAGEHLP_LINE PIMAGEHLP_LINE64 +#else +typedef struct _IMAGEHLP_LINE +{ + DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_LINE) + PVOID Key; // internal + DWORD LineNumber; // line number in file + PCHAR FileName; // full filename + DWORD Address; // first instruction of line +} IMAGEHLP_LINE, *PIMAGEHLP_LINE; + +typedef struct _IMAGEHLP_LINEW +{ + DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_LINE64) + PVOID Key; // internal + DWORD LineNumber; // line number in file + PCHAR FileName; // full filename + DWORD64 Address; // first instruction of line +} IMAGEHLP_LINEW, *PIMAGEHLP_LINEW; +#endif + +// +// source file structure +// + +typedef struct _SOURCEFILE +{ + DWORD64 ModBase; // base address of loaded module + PCHAR FileName; // full filename of source +} SOURCEFILE, *PSOURCEFILE; + +typedef struct _SOURCEFILEW +{ + DWORD64 ModBase; // base address of loaded module + PWSTR FileName; // full filename of source +} SOURCEFILEW, *PSOURCEFILEW; + +// +// data structures used for registered symbol callbacks +// + +#define CBA_DEFERRED_SYMBOL_LOAD_START 0x00000001 +#define CBA_DEFERRED_SYMBOL_LOAD_COMPLETE 0x00000002 +#define CBA_DEFERRED_SYMBOL_LOAD_FAILURE 0x00000003 +#define CBA_SYMBOLS_UNLOADED 0x00000004 +#define CBA_DUPLICATE_SYMBOL 0x00000005 +#define CBA_READ_MEMORY 0x00000006 +#define CBA_DEFERRED_SYMBOL_LOAD_CANCEL 0x00000007 +#define CBA_SET_OPTIONS 0x00000008 +#define CBA_EVENT 0x00000010 +#define CBA_DEFERRED_SYMBOL_LOAD_PARTIAL 0x00000020 +#define CBA_DEBUG_INFO 0x10000000 +#define CBA_SRCSRV_INFO 0x20000000 +#define CBA_SRCSRV_EVENT 0x40000000 + +typedef struct _IMAGEHLP_CBA_READ_MEMORY +{ + DWORD64 addr; // address to read from + PVOID buf; // buffer to read to + DWORD bytes; // amount of bytes to read + DWORD* bytesread; // pointer to store amount of bytes read +} IMAGEHLP_CBA_READ_MEMORY, *PIMAGEHLP_CBA_READ_MEMORY; + +enum +{ + sevInfo = 0, + sevProblem, + sevAttn, + sevFatal, + sevMax // unused +}; + +#define EVENT_SRCSPEW_START 100 +#define EVENT_SRCSPEW 100 +#define EVENT_SRCSPEW_END 199 + +typedef struct _IMAGEHLP_CBA_EVENT +{ + DWORD severity; // values from sevInfo to sevFatal + DWORD code; // numerical code IDs the error + PCHAR desc; // may contain a text description of the error + PVOID object; // value dependant upon the error code +} IMAGEHLP_CBA_EVENT, *PIMAGEHLP_CBA_EVENT; + +typedef struct _IMAGEHLP_CBA_EVENTW +{ + DWORD severity; // values from sevInfo to sevFatal + DWORD code; // numerical code IDs the error + PCWSTR desc; // may contain a text description of the error + PVOID object; // value dependant upon the error code +} IMAGEHLP_CBA_EVENTW, *PIMAGEHLP_CBA_EVENTW; + +typedef struct _IMAGEHLP_DEFERRED_SYMBOL_LOAD64 +{ + DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_DEFERRED_SYMBOL_LOAD64) + DWORD64 BaseOfImage; // base load address of module + DWORD CheckSum; // checksum from the pe header + DWORD TimeDateStamp; // date/time stamp from pe header + CHAR FileName[MAX_PATH]; // symbols file or image name + BOOLEAN Reparse; // load failure reparse + HANDLE hFile; // file handle, if passed + DWORD Flags; // +} IMAGEHLP_DEFERRED_SYMBOL_LOAD64, *PIMAGEHLP_DEFERRED_SYMBOL_LOAD64; + +typedef struct _IMAGEHLP_DEFERRED_SYMBOL_LOADW64 +{ + DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_DEFERRED_SYMBOL_LOADW64) + DWORD64 BaseOfImage; // base load address of module + DWORD CheckSum; // checksum from the pe header + DWORD TimeDateStamp; // date/time stamp from pe header + WCHAR FileName[MAX_PATH + 1]; // symbols file or image name + BOOLEAN Reparse; // load failure reparse + HANDLE hFile; // file handle, if passed + DWORD Flags; // +} IMAGEHLP_DEFERRED_SYMBOL_LOADW64, *PIMAGEHLP_DEFERRED_SYMBOL_LOADW64; + +#define DSLFLAG_MISMATCHED_PDB 0x1 +#define DSLFLAG_MISMATCHED_DBG 0x2 + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define IMAGEHLP_DEFERRED_SYMBOL_LOAD IMAGEHLP_DEFERRED_SYMBOL_LOAD64 +#define PIMAGEHLP_DEFERRED_SYMBOL_LOAD PIMAGEHLP_DEFERRED_SYMBOL_LOAD64 +#else +typedef struct _IMAGEHLP_DEFERRED_SYMBOL_LOAD +{ + DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_DEFERRED_SYMBOL_LOAD) + DWORD BaseOfImage; // base load address of module + DWORD CheckSum; // checksum from the pe header + DWORD TimeDateStamp; // date/time stamp from pe header + CHAR FileName[MAX_PATH]; // symbols file or image name + BOOLEAN Reparse; // load failure reparse + HANDLE hFile; // file handle, if passed +} IMAGEHLP_DEFERRED_SYMBOL_LOAD, *PIMAGEHLP_DEFERRED_SYMBOL_LOAD; +#endif + +typedef struct _IMAGEHLP_DUPLICATE_SYMBOL64 +{ + DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_DUPLICATE_SYMBOL64) + DWORD NumberOfDups; // number of duplicates in the Symbol array + PIMAGEHLP_SYMBOL64 Symbol; // array of duplicate symbols + DWORD SelectedSymbol; // symbol selected (-1 to start) +} IMAGEHLP_DUPLICATE_SYMBOL64, *PIMAGEHLP_DUPLICATE_SYMBOL64; + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define IMAGEHLP_DUPLICATE_SYMBOL IMAGEHLP_DUPLICATE_SYMBOL64 +#define PIMAGEHLP_DUPLICATE_SYMBOL PIMAGEHLP_DUPLICATE_SYMBOL64 +#else +typedef struct _IMAGEHLP_DUPLICATE_SYMBOL +{ + DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_DUPLICATE_SYMBOL) + DWORD NumberOfDups; // number of duplicates in the Symbol array + PIMAGEHLP_SYMBOL Symbol; // array of duplicate symbols + DWORD SelectedSymbol; // symbol selected (-1 to start) +} IMAGEHLP_DUPLICATE_SYMBOL, *PIMAGEHLP_DUPLICATE_SYMBOL; +#endif + +// If dbghelp ever needs to display graphical UI, it will use this as the parent window. + +BOOL +IMAGEAPI +SymSetParentWindow( + __in HWND hwnd +); + +PCHAR +IMAGEAPI +SymSetHomeDirectory( + __in_opt HANDLE hProcess, + __in_opt PCSTR dir +); + +PWSTR +IMAGEAPI +SymSetHomeDirectoryW( + __in_opt HANDLE hProcess, + __in_opt PCWSTR dir +); + +PCHAR +IMAGEAPI +SymGetHomeDirectory( + __in DWORD type, + __out_ecount(size) PSTR dir, + __in size_t size +); + +PWSTR +IMAGEAPI +SymGetHomeDirectoryW( + __in DWORD type, + __out_ecount(size) PWSTR dir, + __in size_t size +); + +enum +{ + hdBase = 0, // root directory for dbghelp + hdSym, // where symbols are stored + hdSrc, // where source is stored + hdMax // end marker +}; + +typedef struct _OMAP +{ + ULONG rva; + ULONG rvaTo; +} OMAP, *POMAP; + +BOOL +IMAGEAPI +SymGetOmaps( + __in HANDLE hProcess, + __in DWORD64 BaseOfDll, + __out POMAP* OmapTo, + __out PDWORD64 cOmapTo, + __out POMAP* OmapFrom, + __out PDWORD64 cOmapFrom +); + +// +// options that are set/returned by SymSetOptions() & SymGetOptions() +// these are used as a mask +// +#define SYMOPT_CASE_INSENSITIVE 0x00000001 +#define SYMOPT_UNDNAME 0x00000002 +#define SYMOPT_DEFERRED_LOADS 0x00000004 +#define SYMOPT_NO_CPP 0x00000008 +#define SYMOPT_LOAD_LINES 0x00000010 +#define SYMOPT_OMAP_FIND_NEAREST 0x00000020 +#define SYMOPT_LOAD_ANYTHING 0x00000040 +#define SYMOPT_IGNORE_CVREC 0x00000080 +#define SYMOPT_NO_UNQUALIFIED_LOADS 0x00000100 +#define SYMOPT_FAIL_CRITICAL_ERRORS 0x00000200 +#define SYMOPT_EXACT_SYMBOLS 0x00000400 +#define SYMOPT_ALLOW_ABSOLUTE_SYMBOLS 0x00000800 +#define SYMOPT_IGNORE_NT_SYMPATH 0x00001000 +#define SYMOPT_INCLUDE_32BIT_MODULES 0x00002000 +#define SYMOPT_PUBLICS_ONLY 0x00004000 +#define SYMOPT_NO_PUBLICS 0x00008000 +#define SYMOPT_AUTO_PUBLICS 0x00010000 +#define SYMOPT_NO_IMAGE_SEARCH 0x00020000 +#define SYMOPT_SECURE 0x00040000 +#define SYMOPT_NO_PROMPTS 0x00080000 +#define SYMOPT_OVERWRITE 0x00100000 +#define SYMOPT_IGNORE_IMAGEDIR 0x00200000 +#define SYMOPT_FLAT_DIRECTORY 0x00400000 +#define SYMOPT_FAVOR_COMPRESSED 0x00800000 +#define SYMOPT_ALLOW_ZERO_ADDRESS 0x01000000 +#define SYMOPT_DISABLE_SYMSRV_AUTODETECT 0x02000000 + +#define SYMOPT_DEBUG 0x80000000 + +DWORD +IMAGEAPI +SymSetOptions( + __in DWORD SymOptions +); + +DWORD +IMAGEAPI +SymGetOptions( + VOID +); + +BOOL +IMAGEAPI +SymCleanup( + __in HANDLE hProcess +); + +BOOL +IMAGEAPI +SymMatchString( + __in PCSTR string, + __in PCSTR expression, + __in BOOL fCase +); + +BOOL +IMAGEAPI +SymMatchStringA( + __in PCSTR string, + __in PCSTR expression, + __in BOOL fCase +); + +BOOL +IMAGEAPI +SymMatchStringW( + __in PCWSTR string, + __in PCWSTR expression, + __in BOOL fCase +); + +typedef BOOL +(CALLBACK* PSYM_ENUMSOURCEFILES_CALLBACK)( + __in PSOURCEFILE pSourceFile, + __in_opt PVOID UserContext +); + +// for backwards compatibility - don't use this +#define PSYM_ENUMSOURCFILES_CALLBACK PSYM_ENUMSOURCEFILES_CALLBACK + +BOOL +IMAGEAPI +SymEnumSourceFiles( + __in HANDLE hProcess, + __in ULONG64 ModBase, + __in_opt PCSTR Mask, + __in PSYM_ENUMSOURCEFILES_CALLBACK cbSrcFiles, + __in_opt PVOID UserContext +); + +typedef BOOL +(CALLBACK* PSYM_ENUMSOURCEFILES_CALLBACKW)( + __in PSOURCEFILEW pSourceFile, + __in_opt PVOID UserContext +); + +BOOL +IMAGEAPI +SymEnumSourceFilesW( + __in HANDLE hProcess, + __in ULONG64 ModBase, + __in_opt PCWSTR Mask, + __in PSYM_ENUMSOURCEFILES_CALLBACKW cbSrcFiles, + __in_opt PVOID UserContext +); + +BOOL +IMAGEAPI +SymEnumerateModules64( + __in HANDLE hProcess, + __in PSYM_ENUMMODULES_CALLBACK64 EnumModulesCallback, + __in_opt PVOID UserContext +); + +BOOL +IMAGEAPI +SymEnumerateModulesW64( + __in HANDLE hProcess, + __in PSYM_ENUMMODULES_CALLBACKW64 EnumModulesCallback, + __in_opt PVOID UserContext +); + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define SymEnumerateModules SymEnumerateModules64 +#else +BOOL +IMAGEAPI +SymEnumerateModules( + __in HANDLE hProcess, + __in PSYM_ENUMMODULES_CALLBACK EnumModulesCallback, + __in_opt PVOID UserContext +); +#endif + +BOOL +IMAGEAPI +EnumerateLoadedModulesEx( + __in HANDLE hProcess, + __in PENUMLOADED_MODULES_CALLBACK64 EnumLoadedModulesCallback, + __in_opt PVOID UserContext +); + +BOOL +IMAGEAPI +EnumerateLoadedModulesExW( + __in HANDLE hProcess, + __in PENUMLOADED_MODULES_CALLBACKW64 EnumLoadedModulesCallback, + __in_opt PVOID UserContext +); + +BOOL +IMAGEAPI +EnumerateLoadedModules64( + __in HANDLE hProcess, + __in PENUMLOADED_MODULES_CALLBACK64 EnumLoadedModulesCallback, + __in_opt PVOID UserContext +); + +BOOL +IMAGEAPI +EnumerateLoadedModulesW64( + __in HANDLE hProcess, + __in PENUMLOADED_MODULES_CALLBACKW64 EnumLoadedModulesCallback, + __in_opt PVOID UserContext +); + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define EnumerateLoadedModules EnumerateLoadedModules64 +#else +BOOL +IMAGEAPI +EnumerateLoadedModules( + __in HANDLE hProcess, + __in PENUMLOADED_MODULES_CALLBACK EnumLoadedModulesCallback, + __in_opt PVOID UserContext +); +#endif + +PVOID +IMAGEAPI +SymFunctionTableAccess64( + __in HANDLE hProcess, + __in DWORD64 AddrBase +); + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define SymFunctionTableAccess SymFunctionTableAccess64 +#else +PVOID +IMAGEAPI +SymFunctionTableAccess( + __in HANDLE hProcess, + __in DWORD AddrBase +); +#endif + +BOOL +IMAGEAPI +SymGetUnwindInfo( + __in HANDLE hProcess, + __in DWORD64 Address, + __out_bcount_opt(*Size) PVOID Buffer, + __inout PULONG Size +); + +BOOL +IMAGEAPI +SymGetModuleInfo64( + __in HANDLE hProcess, + __in DWORD64 qwAddr, + __out PIMAGEHLP_MODULE64 ModuleInfo +); + +BOOL +IMAGEAPI +SymGetModuleInfoW64( + __in HANDLE hProcess, + __in DWORD64 qwAddr, + __out PIMAGEHLP_MODULEW64 ModuleInfo +); + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define SymGetModuleInfo SymGetModuleInfo64 +#define SymGetModuleInfoW SymGetModuleInfoW64 +#else +BOOL +IMAGEAPI +SymGetModuleInfo( + __in HANDLE hProcess, + __in DWORD dwAddr, + __out PIMAGEHLP_MODULE ModuleInfo +); + +BOOL +IMAGEAPI +SymGetModuleInfoW( + __in HANDLE hProcess, + __in DWORD dwAddr, + __out PIMAGEHLP_MODULEW ModuleInfo +); +#endif + +DWORD64 +IMAGEAPI +SymGetModuleBase64( + __in HANDLE hProcess, + __in DWORD64 qwAddr +); + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define SymGetModuleBase SymGetModuleBase64 +#else +DWORD +IMAGEAPI +SymGetModuleBase( + __in HANDLE hProcess, + __in DWORD dwAddr +); +#endif + +typedef struct _SRCCODEINFO +{ + DWORD SizeOfStruct; // set to sizeof(SRCCODEINFO) + PVOID Key; // not used + DWORD64 ModBase; // base address of module this applies to + CHAR Obj[MAX_PATH + 1]; // the object file within the module + CHAR FileName[MAX_PATH + 1]; // full filename + DWORD LineNumber; // line number in file + DWORD64 Address; // first instruction of line +} SRCCODEINFO, *PSRCCODEINFO; + +typedef struct _SRCCODEINFOW +{ + DWORD SizeOfStruct; // set to sizeof(SRCCODEINFO) + PVOID Key; // not used + DWORD64 ModBase; // base address of module this applies to + WCHAR Obj[MAX_PATH + 1]; // the object file within the module + WCHAR FileName[MAX_PATH + 1]; // full filename + DWORD LineNumber; // line number in file + DWORD64 Address; // first instruction of line +} SRCCODEINFOW, *PSRCCODEINFOW; + +typedef BOOL +(CALLBACK* PSYM_ENUMLINES_CALLBACK)( + __in PSRCCODEINFO LineInfo, + __in_opt PVOID UserContext +); + +BOOL +IMAGEAPI +SymEnumLines( + __in HANDLE hProcess, + __in ULONG64 Base, + __in_opt PCSTR Obj, + __in_opt PCSTR File, + __in PSYM_ENUMLINES_CALLBACK EnumLinesCallback, + __in_opt PVOID UserContext +); + +typedef BOOL +(CALLBACK* PSYM_ENUMLINES_CALLBACKW)( + __in PSRCCODEINFOW LineInfo, + __in_opt PVOID UserContext +); + +BOOL +IMAGEAPI +SymEnumLinesW( + __in HANDLE hProcess, + __in ULONG64 Base, + __in_opt PCWSTR Obj, + __in_opt PCWSTR File, + __in PSYM_ENUMLINES_CALLBACKW EnumLinesCallback, + __in_opt PVOID UserContext +); + +BOOL +IMAGEAPI +SymGetLineFromAddr64( + __in HANDLE hProcess, + __in DWORD64 qwAddr, + __out PDWORD pdwDisplacement, + __out PIMAGEHLP_LINE64 Line64 +); + +BOOL +IMAGEAPI +SymGetLineFromAddrW64( + __in HANDLE hProcess, + __in DWORD64 dwAddr, + __out PDWORD pdwDisplacement, + __out PIMAGEHLP_LINEW64 Line +); + +BOOL +IMAGEAPI +SymEnumSourceLines( + __in HANDLE hProcess, + __in ULONG64 Base, + __in_opt PCSTR Obj, + __in_opt PCSTR File, + __in_opt DWORD Line, + __in DWORD Flags, + __in PSYM_ENUMLINES_CALLBACK EnumLinesCallback, + __in_opt PVOID UserContext +); + +BOOL +IMAGEAPI +SymEnumSourceLinesW( + __in HANDLE hProcess, + __in ULONG64 Base, + __in_opt PCWSTR Obj, + __in_opt PCWSTR File, + __in_opt DWORD Line, + __in DWORD Flags, + __in PSYM_ENUMLINES_CALLBACKW EnumLinesCallback, + __in_opt PVOID UserContext +); + +// flags for SymEnumSourceLines + +#define ESLFLAG_FULLPATH 0x1 +#define ESLFLAG_NEAREST 0x2 +#define ESLFLAG_PREV 0x4 +#define ESLFLAG_NEXT 0x8 + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define SymGetLineFromAddr SymGetLineFromAddr64 +#define SymGetLineFromAddrW SymGetLineFromAddrW64 +#else +BOOL +IMAGEAPI +SymGetLineFromAddr( + __in HANDLE hProcess, + __in DWORD dwAddr, + __out PDWORD pdwDisplacement, + __out PIMAGEHLP_LINE Line +); + +BOOL +IMAGEAPI +SymGetLineFromAddrW( + __in HANDLE hProcess, + __in DWORD dwAddr, + __out PDWORD pdwDisplacement, + __out PIMAGEHLP_LINEW Line +); +#endif + +BOOL +IMAGEAPI +SymGetLineFromName64( + __in HANDLE hProcess, + __in_opt PCSTR ModuleName, + __in_opt PCSTR FileName, + __in DWORD dwLineNumber, + __out PLONG plDisplacement, + __inout PIMAGEHLP_LINE64 Line +); + +BOOL +IMAGEAPI +SymGetLineFromNameW64( + __in HANDLE hProcess, + __in_opt PCWSTR ModuleName, + __in_opt PCWSTR FileName, + __in DWORD dwLineNumber, + __out PLONG plDisplacement, + __inout PIMAGEHLP_LINEW64 Line +); + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define SymGetLineFromName SymGetLineFromName64 +#else +BOOL +IMAGEAPI +SymGetLineFromName( + __in HANDLE hProcess, + __in_opt PCSTR ModuleName, + __in_opt PCSTR FileName, + __in DWORD dwLineNumber, + __out PLONG plDisplacement, + __inout PIMAGEHLP_LINE Line +); +#endif + +BOOL +IMAGEAPI +SymGetLineNext64( + __in HANDLE hProcess, + __inout PIMAGEHLP_LINE64 Line +); + +BOOL +IMAGEAPI +SymGetLineNextW64( + __in HANDLE hProcess, + __inout PIMAGEHLP_LINEW64 Line +); + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define SymGetLineNext SymGetLineNext64 +#else +BOOL +IMAGEAPI +SymGetLineNext( + __in HANDLE hProcess, + __inout PIMAGEHLP_LINE Line +); + +BOOL +IMAGEAPI +SymGetLineNextW( + __in HANDLE hProcess, + __inout PIMAGEHLP_LINEW Line +); +#endif + +BOOL +IMAGEAPI +SymGetLinePrev64( + __in HANDLE hProcess, + __inout PIMAGEHLP_LINE64 Line +); + +BOOL +IMAGEAPI +SymGetLinePrevW64( + __in HANDLE hProcess, + __inout PIMAGEHLP_LINEW64 Line +); + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define SymGetLinePrev SymGetLinePrev64 +#else +BOOL +IMAGEAPI +SymGetLinePrev( + __in HANDLE hProcess, + __inout PIMAGEHLP_LINE Line +); + +BOOL +IMAGEAPI +SymGetLinePrevW( + __in HANDLE hProcess, + __inout PIMAGEHLP_LINEW Line +); +#endif + +ULONG +IMAGEAPI +SymGetFileLineOffsets64( + __in HANDLE hProcess, + __in_opt PCSTR ModuleName, + __in PCSTR FileName, + __out_ecount(BufferLines) PDWORD64 Buffer, + __in ULONG BufferLines +); + +BOOL +IMAGEAPI +SymMatchFileName( + __in PCSTR FileName, + __in PCSTR Match, + __deref_opt_out PSTR* FileNameStop, + __deref_opt_out PSTR* MatchStop +); + +BOOL +IMAGEAPI +SymMatchFileNameW( + __in PCWSTR FileName, + __in PCWSTR Match, + __deref_opt_out PWSTR* FileNameStop, + __deref_opt_out PWSTR* MatchStop +); + +BOOL +IMAGEAPI +SymGetSourceFile( + __in HANDLE hProcess, + __in ULONG64 Base, + __in_opt PCSTR Params, + __in PCSTR FileSpec, + __out_ecount(Size) PSTR FilePath, + __in DWORD Size +); + +BOOL +IMAGEAPI +SymGetSourceFileW( + __in HANDLE hProcess, + __in ULONG64 Base, + __in_opt PCWSTR Params, + __in PCWSTR FileSpec, + __out_ecount(Size) PWSTR FilePath, + __in DWORD Size +); + +BOOL +IMAGEAPI +SymGetSourceFileToken( + __in HANDLE hProcess, + __in ULONG64 Base, + __in PCSTR FileSpec, + __deref_out PVOID* Token, + __out DWORD* Size +); + +BOOL +IMAGEAPI +SymGetSourceFileTokenW( + __in HANDLE hProcess, + __in ULONG64 Base, + __in PCWSTR FileSpec, + __deref_out PVOID* Token, + __out DWORD* Size +); + +BOOL +IMAGEAPI +SymGetSourceFileFromToken( + __in HANDLE hProcess, + __in PVOID Token, + __in_opt PCSTR Params, + __out_ecount(Size) PSTR FilePath, + __in DWORD Size +); + +BOOL +IMAGEAPI +SymGetSourceFileFromTokenW( + __in HANDLE hProcess, + __in PVOID Token, + __in_opt PCWSTR Params, + __out_ecount(Size) PWSTR FilePath, + __in DWORD Size +); + +BOOL +IMAGEAPI +SymGetSourceVarFromToken( + __in HANDLE hProcess, + __in PVOID Token, + __in_opt PCSTR Params, + __in PCSTR VarName, + __out_ecount(Size) PSTR Value, + __in DWORD Size +); + +BOOL +IMAGEAPI +SymGetSourceVarFromTokenW( + __in HANDLE hProcess, + __in PVOID Token, + __in_opt PCWSTR Params, + __in PCWSTR VarName, + __out_ecount(Size) PWSTR Value, + __in DWORD Size +); + +typedef BOOL (CALLBACK* PENUMSOURCEFILETOKENSCALLBACK)(__in PVOID token, __in size_t size); + +BOOL +IMAGEAPI +SymEnumSourceFileTokens( + __in HANDLE hProcess, + __in ULONG64 Base, + __in PENUMSOURCEFILETOKENSCALLBACK Callback +); + +BOOL +IMAGEAPI +SymInitialize( + __in HANDLE hProcess, + __in_opt PCSTR UserSearchPath, + __in BOOL fInvadeProcess +); + +BOOL +IMAGEAPI +SymInitializeW( + __in HANDLE hProcess, + __in_opt PCWSTR UserSearchPath, + __in BOOL fInvadeProcess +); + +BOOL +IMAGEAPI +SymGetSearchPath( + __in HANDLE hProcess, + __out_ecount(SearchPathLength) PSTR SearchPath, + __in DWORD SearchPathLength +); + +BOOL +IMAGEAPI +SymGetSearchPathW( + __in HANDLE hProcess, + __out_ecount(SearchPathLength) PWSTR SearchPath, + __in DWORD SearchPathLength +); + +BOOL +IMAGEAPI +SymSetSearchPath( + __in HANDLE hProcess, + __in_opt PCSTR SearchPath +); + +BOOL +IMAGEAPI +SymSetSearchPathW( + __in HANDLE hProcess, + __in_opt PCWSTR SearchPath +); + +#define SLMFLAG_VIRTUAL 0x1 +#define SLMFLAG_ALT_INDEX 0x2 +#define SLMFLAG_NO_SYMBOLS 0x4 + +DWORD64 +IMAGEAPI +SymLoadModuleEx( + __in HANDLE hProcess, + __in_opt HANDLE hFile, + __in_opt PCSTR ImageName, + __in_opt PCSTR ModuleName, + __in DWORD64 BaseOfDll, + __in DWORD DllSize, + __in_opt PMODLOAD_DATA Data, + __in_opt DWORD Flags +); + +DWORD64 +IMAGEAPI +SymLoadModuleExW( + __in HANDLE hProcess, + __in_opt HANDLE hFile, + __in_opt PCWSTR ImageName, + __in_opt PCWSTR ModuleName, + __in DWORD64 BaseOfDll, + __in DWORD DllSize, + __in_opt PMODLOAD_DATA Data, + __in_opt DWORD Flags +); + +BOOL +IMAGEAPI +SymUnloadModule64( + __in HANDLE hProcess, + __in DWORD64 BaseOfDll +); + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define SymUnloadModule SymUnloadModule64 +#else +BOOL +IMAGEAPI +SymUnloadModule( + __in HANDLE hProcess, + __in DWORD BaseOfDll +); +#endif + +BOOL +IMAGEAPI +SymUnDName64( + __in PIMAGEHLP_SYMBOL64 sym, // Symbol to undecorate + __out_ecount(UnDecNameLength) PSTR UnDecName, // Buffer to store undecorated name in + __in DWORD UnDecNameLength // Size of the buffer +); + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define SymUnDName SymUnDName64 +#else +BOOL +IMAGEAPI +SymUnDName( + __in PIMAGEHLP_SYMBOL sym, // Symbol to undecorate + __out_ecount(UnDecNameLength) PSTR UnDecName, // Buffer to store undecorated name in + __in DWORD UnDecNameLength // Size of the buffer +); +#endif + +BOOL +IMAGEAPI +SymRegisterCallback64( + __in HANDLE hProcess, + __in PSYMBOL_REGISTERED_CALLBACK64 CallbackFunction, + __in ULONG64 UserContext +); + +BOOL +IMAGEAPI +SymRegisterCallbackW64( + __in HANDLE hProcess, + __in PSYMBOL_REGISTERED_CALLBACK64 CallbackFunction, + __in ULONG64 UserContext +); + +BOOL +IMAGEAPI +SymRegisterFunctionEntryCallback64( + __in HANDLE hProcess, + __in PSYMBOL_FUNCENTRY_CALLBACK64 CallbackFunction, + __in ULONG64 UserContext +); + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define SymRegisterCallback SymRegisterCallback64 +#define SymRegisterFunctionEntryCallback SymRegisterFunctionEntryCallback64 +#else +BOOL +IMAGEAPI +SymRegisterCallback( + __in HANDLE hProcess, + __in PSYMBOL_REGISTERED_CALLBACK CallbackFunction, + __in_opt PVOID UserContext +); + +BOOL +IMAGEAPI +SymRegisterFunctionEntryCallback( + __in HANDLE hProcess, + __in PSYMBOL_FUNCENTRY_CALLBACK CallbackFunction, + __in_opt PVOID UserContext +); +#endif + + +typedef struct _IMAGEHLP_SYMBOL_SRC +{ + DWORD sizeofstruct; + DWORD type; + char file[MAX_PATH]; +} IMAGEHLP_SYMBOL_SRC, *PIMAGEHLP_SYMBOL_SRC; + +typedef struct _MODULE_TYPE_INFO // AKA TYPTYP +{ + USHORT dataLength; + USHORT leaf; + BYTE data[1]; +} MODULE_TYPE_INFO, *PMODULE_TYPE_INFO; + +typedef struct _SYMBOL_INFO +{ + ULONG SizeOfStruct; + ULONG TypeIndex; // Type Index of symbol + ULONG64 Reserved[2]; + ULONG Index; + ULONG Size; + ULONG64 ModBase; // Base Address of module comtaining this symbol + ULONG Flags; + ULONG64 Value; // Value of symbol, ValuePresent should be 1 + ULONG64 Address; // Address of symbol including base address of module + ULONG Register; // register holding value or pointer to value + ULONG Scope; // scope of the symbol + ULONG Tag; // pdb classification + ULONG NameLen; // Actual length of name + ULONG MaxNameLen; + CHAR Name[1]; // Name of symbol +} SYMBOL_INFO, *PSYMBOL_INFO; + +typedef struct _SYMBOL_INFO_PACKAGE +{ + SYMBOL_INFO si; + CHAR name[MAX_SYM_NAME + 1]; +} SYMBOL_INFO_PACKAGE, *PSYMBOL_INFO_PACKAGE; + +typedef struct _SYMBOL_INFOW +{ + ULONG SizeOfStruct; + ULONG TypeIndex; // Type Index of symbol + ULONG64 Reserved[2]; + ULONG Index; + ULONG Size; + ULONG64 ModBase; // Base Address of module comtaining this symbol + ULONG Flags; + ULONG64 Value; // Value of symbol, ValuePresent should be 1 + ULONG64 Address; // Address of symbol including base address of module + ULONG Register; // register holding value or pointer to value + ULONG Scope; // scope of the symbol + ULONG Tag; // pdb classification + ULONG NameLen; // Actual length of name + ULONG MaxNameLen; + WCHAR Name[1]; // Name of symbol +} SYMBOL_INFOW, *PSYMBOL_INFOW; + +typedef struct _SYMBOL_INFO_PACKAGEW +{ + SYMBOL_INFOW si; + WCHAR name[MAX_SYM_NAME + 1]; +} SYMBOL_INFO_PACKAGEW, *PSYMBOL_INFO_PACKAGEW; + +typedef struct _IMAGEHLP_STACK_FRAME +{ + ULONG64 InstructionOffset; + ULONG64 ReturnOffset; + ULONG64 FrameOffset; + ULONG64 StackOffset; + ULONG64 BackingStoreOffset; + ULONG64 FuncTableEntry; + ULONG64 Params[4]; + ULONG64 Reserved[5]; + BOOL Virtual; + ULONG Reserved2; +} IMAGEHLP_STACK_FRAME, *PIMAGEHLP_STACK_FRAME; + +typedef VOID IMAGEHLP_CONTEXT, *PIMAGEHLP_CONTEXT; + + +BOOL +IMAGEAPI +SymSetContext( + __in HANDLE hProcess, + __in PIMAGEHLP_STACK_FRAME StackFrame, + __in_opt PIMAGEHLP_CONTEXT Context +); + +BOOL +IMAGEAPI +SymSetScopeFromAddr( + __in HANDLE hProcess, + __in ULONG64 Address +); + +BOOL +IMAGEAPI +SymSetScopeFromIndex( + __in HANDLE hProcess, + __in ULONG64 BaseOfDll, + __in DWORD Index +); + +typedef BOOL +(CALLBACK* PSYM_ENUMPROCESSES_CALLBACK)( + __in HANDLE hProcess, + __in PVOID UserContext +); + +BOOL +IMAGEAPI +SymEnumProcesses( + __in PSYM_ENUMPROCESSES_CALLBACK EnumProcessesCallback, + __in PVOID UserContext +); + +BOOL +IMAGEAPI +SymFromAddr( + __in HANDLE hProcess, + __in DWORD64 Address, + __out_opt PDWORD64 Displacement, + __inout PSYMBOL_INFO Symbol +); + +BOOL +IMAGEAPI +SymFromAddrW( + __in HANDLE hProcess, + __in DWORD64 Address, + __out_opt PDWORD64 Displacement, + __inout PSYMBOL_INFOW Symbol +); + +BOOL +IMAGEAPI +SymFromToken( + __in HANDLE hProcess, + __in DWORD64 Base, + __in DWORD Token, + __inout PSYMBOL_INFO Symbol +); + +BOOL +IMAGEAPI +SymFromTokenW( + __in HANDLE hProcess, + __in DWORD64 Base, + __in DWORD Token, + __inout PSYMBOL_INFOW Symbol +); + +BOOL +IMAGEAPI +SymNext( + __in HANDLE hProcess, + __inout PSYMBOL_INFO si +); + +BOOL +IMAGEAPI +SymNextW( + __in HANDLE hProcess, + __inout PSYMBOL_INFOW siw +); + +BOOL +IMAGEAPI +SymPrev( + __in HANDLE hProcess, + __inout PSYMBOL_INFO si +); + +BOOL +IMAGEAPI +SymPrevW( + __in HANDLE hProcess, + __inout PSYMBOL_INFOW siw +); + +// While SymFromName will provide a symbol from a name, +// SymEnumSymbols can provide the same matching information +// for ALL symbols with a matching name, even regular +// expressions. That way you can search across modules +// and differentiate between identically named symbols. + +BOOL +IMAGEAPI +SymFromName( + __in HANDLE hProcess, + __in PCSTR Name, + __inout PSYMBOL_INFO Symbol +); + +BOOL +IMAGEAPI +SymFromNameW( + __in HANDLE hProcess, + __in PCWSTR Name, + __inout PSYMBOL_INFOW Symbol +); + +typedef BOOL +(CALLBACK* PSYM_ENUMERATESYMBOLS_CALLBACK)( + __in PSYMBOL_INFO pSymInfo, + __in ULONG SymbolSize, + __in_opt PVOID UserContext +); + +BOOL +IMAGEAPI +SymEnumSymbols( + __in HANDLE hProcess, + __in ULONG64 BaseOfDll, + __in_opt PCSTR Mask, + __in PSYM_ENUMERATESYMBOLS_CALLBACK EnumSymbolsCallback, + __in_opt PVOID UserContext +); + +typedef BOOL +(CALLBACK* PSYM_ENUMERATESYMBOLS_CALLBACKW)( + __in PSYMBOL_INFOW pSymInfo, + __in ULONG SymbolSize, + __in_opt PVOID UserContext +); + +BOOL +IMAGEAPI +SymEnumSymbolsW( + __in HANDLE hProcess, + __in ULONG64 BaseOfDll, + __in_opt PCWSTR Mask, + __in PSYM_ENUMERATESYMBOLS_CALLBACKW EnumSymbolsCallback, + __in_opt PVOID UserContext +); + +BOOL +IMAGEAPI +SymEnumSymbolsForAddr( + __in HANDLE hProcess, + __in DWORD64 Address, + __in PSYM_ENUMERATESYMBOLS_CALLBACK EnumSymbolsCallback, + __in_opt PVOID UserContext +); + +BOOL +IMAGEAPI +SymEnumSymbolsForAddrW( + __in HANDLE hProcess, + __in DWORD64 Address, + __in PSYM_ENUMERATESYMBOLS_CALLBACKW EnumSymbolsCallback, + __in_opt PVOID UserContext +); + +#define SYMSEARCH_MASKOBJS 0x01 // used internally to implement other APIs +#define SYMSEARCH_RECURSE 0X02 // recurse scopes +#define SYMSEARCH_GLOBALSONLY 0X04 // search only for global symbols +#define SYMSEARCH_ALLITEMS 0X08 // search for everything in the pdb, not just normal scoped symbols + +BOOL +IMAGEAPI +SymSearch( + __in HANDLE hProcess, + __in ULONG64 BaseOfDll, + __in_opt DWORD Index, + __in_opt DWORD SymTag, + __in_opt PCSTR Mask, + __in_opt DWORD64 Address, + __in PSYM_ENUMERATESYMBOLS_CALLBACK EnumSymbolsCallback, + __in_opt PVOID UserContext, + __in DWORD Options +); + +BOOL +IMAGEAPI +SymSearchW( + __in HANDLE hProcess, + __in ULONG64 BaseOfDll, + __in_opt DWORD Index, + __in_opt DWORD SymTag, + __in_opt PCWSTR Mask, + __in_opt DWORD64 Address, + __in PSYM_ENUMERATESYMBOLS_CALLBACKW EnumSymbolsCallback, + __in_opt PVOID UserContext, + __in DWORD Options +); + +BOOL +IMAGEAPI +SymGetScope( + __in HANDLE hProcess, + __in ULONG64 BaseOfDll, + __in DWORD Index, + __inout PSYMBOL_INFO Symbol +); + +BOOL +IMAGEAPI +SymGetScopeW( + __in HANDLE hProcess, + __in ULONG64 BaseOfDll, + __in DWORD Index, + __inout PSYMBOL_INFOW Symbol +); + +BOOL +IMAGEAPI +SymFromIndex( + __in HANDLE hProcess, + __in ULONG64 BaseOfDll, + __in DWORD Index, + __inout PSYMBOL_INFO Symbol +); + +BOOL +IMAGEAPI +SymFromIndexW( + __in HANDLE hProcess, + __in ULONG64 BaseOfDll, + __in DWORD Index, + __inout PSYMBOL_INFOW Symbol +); + +typedef enum _IMAGEHLP_SYMBOL_TYPE_INFO +{ + TI_GET_SYMTAG, + TI_GET_SYMNAME, + TI_GET_LENGTH, + TI_GET_TYPE, + TI_GET_TYPEID, + TI_GET_BASETYPE, + TI_GET_ARRAYINDEXTYPEID, + TI_FINDCHILDREN, + TI_GET_DATAKIND, + TI_GET_ADDRESSOFFSET, + TI_GET_OFFSET, + TI_GET_VALUE, + TI_GET_COUNT, + TI_GET_CHILDRENCOUNT, + TI_GET_BITPOSITION, + TI_GET_VIRTUALBASECLASS, + TI_GET_VIRTUALTABLESHAPEID, + TI_GET_VIRTUALBASEPOINTEROFFSET, + TI_GET_CLASSPARENTID, + TI_GET_NESTED, + TI_GET_SYMINDEX, + TI_GET_LEXICALPARENT, + TI_GET_ADDRESS, + TI_GET_THISADJUST, + TI_GET_UDTKIND, + TI_IS_EQUIV_TO, + TI_GET_CALLING_CONVENTION, + TI_IS_CLOSE_EQUIV_TO, + TI_GTIEX_REQS_VALID, + TI_GET_VIRTUALBASEOFFSET, + TI_GET_VIRTUALBASEDISPINDEX, + TI_GET_IS_REFERENCE, + TI_GET_INDIRECTVIRTUALBASECLASS, + IMAGEHLP_SYMBOL_TYPE_INFO_MAX, +} IMAGEHLP_SYMBOL_TYPE_INFO; + +typedef struct _TI_FINDCHILDREN_PARAMS +{ + ULONG Count; + ULONG Start; + ULONG ChildId[1]; +} TI_FINDCHILDREN_PARAMS; + +BOOL +IMAGEAPI +SymGetTypeInfo( + __in HANDLE hProcess, + __in DWORD64 ModBase, + __in ULONG TypeId, + __in IMAGEHLP_SYMBOL_TYPE_INFO GetType, + __out PVOID pInfo +); + +#define IMAGEHLP_GET_TYPE_INFO_UNCACHED 0x00000001 +#define IMAGEHLP_GET_TYPE_INFO_CHILDREN 0x00000002 + +typedef struct _IMAGEHLP_GET_TYPE_INFO_PARAMS +{ + IN ULONG SizeOfStruct; + IN ULONG Flags; + IN ULONG NumIds; + IN PULONG TypeIds; + IN ULONG64 TagFilter; + IN ULONG NumReqs; + IN IMAGEHLP_SYMBOL_TYPE_INFO* ReqKinds; + IN PULONG_PTR ReqOffsets; + IN PULONG ReqSizes; + IN ULONG_PTR ReqStride; + IN ULONG_PTR BufferSize; + OUT PVOID Buffer; + OUT ULONG EntriesMatched; + OUT ULONG EntriesFilled; + OUT ULONG64 TagsFound; + OUT ULONG64 AllReqsValid; + IN ULONG NumReqsValid; + OUT PULONG64 ReqsValid OPTIONAL; +} IMAGEHLP_GET_TYPE_INFO_PARAMS, *PIMAGEHLP_GET_TYPE_INFO_PARAMS; + +BOOL +IMAGEAPI +SymGetTypeInfoEx( + __in HANDLE hProcess, + __in DWORD64 ModBase, + __inout PIMAGEHLP_GET_TYPE_INFO_PARAMS Params +); + +BOOL +IMAGEAPI +SymEnumTypes( + __in HANDLE hProcess, + __in ULONG64 BaseOfDll, + __in PSYM_ENUMERATESYMBOLS_CALLBACK EnumSymbolsCallback, + __in_opt PVOID UserContext +); + +BOOL +IMAGEAPI +SymEnumTypesW( + __in HANDLE hProcess, + __in ULONG64 BaseOfDll, + __in PSYM_ENUMERATESYMBOLS_CALLBACKW EnumSymbolsCallback, + __in_opt PVOID UserContext +); + +BOOL +IMAGEAPI +SymEnumTypesByName( + __in HANDLE hProcess, + __in ULONG64 BaseOfDll, + __in_opt PCSTR mask, + __in PSYM_ENUMERATESYMBOLS_CALLBACK EnumSymbolsCallback, + __in_opt PVOID UserContext +); + +BOOL +IMAGEAPI +SymEnumTypesByNameW( + __in HANDLE hProcess, + __in ULONG64 BaseOfDll, + __in_opt PCWSTR mask, + __in PSYM_ENUMERATESYMBOLS_CALLBACKW EnumSymbolsCallback, + __in_opt PVOID UserContext +); + +BOOL +IMAGEAPI +SymGetTypeFromName( + __in HANDLE hProcess, + __in ULONG64 BaseOfDll, + __in PCSTR Name, + __inout PSYMBOL_INFO Symbol +); + +BOOL +IMAGEAPI +SymGetTypeFromNameW( + __in HANDLE hProcess, + __in ULONG64 BaseOfDll, + __in PCWSTR Name, + __inout PSYMBOL_INFOW Symbol +); + +BOOL +IMAGEAPI +SymAddSymbol( + __in HANDLE hProcess, + __in ULONG64 BaseOfDll, + __in PCSTR Name, + __in DWORD64 Address, + __in DWORD Size, + __in DWORD Flags +); + +BOOL +IMAGEAPI +SymAddSymbolW( + __in HANDLE hProcess, + __in ULONG64 BaseOfDll, + __in PCWSTR Name, + __in DWORD64 Address, + __in DWORD Size, + __in DWORD Flags +); + +BOOL +IMAGEAPI +SymDeleteSymbol( + __in HANDLE hProcess, + __in ULONG64 BaseOfDll, + __in_opt PCSTR Name, + __in DWORD64 Address, + __in DWORD Flags +); + +BOOL +IMAGEAPI +SymDeleteSymbolW( + __in HANDLE hProcess, + __in ULONG64 BaseOfDll, + __in_opt PCWSTR Name, + __in DWORD64 Address, + __in DWORD Flags +); + +BOOL +IMAGEAPI +SymRefreshModuleList( + __in HANDLE hProcess +); + +BOOL +IMAGEAPI +SymAddSourceStream( + __in HANDLE hProcess, + __in ULONG64 Base, + __in_opt PCSTR StreamFile, + __in_bcount_opt(Size) PBYTE Buffer, + __in size_t Size +); + +typedef BOOL (WINAPI* SYMADDSOURCESTREAM)(HANDLE, ULONG64, PCSTR, PBYTE, size_t); + +BOOL +IMAGEAPI +SymAddSourceStreamA( + __in HANDLE hProcess, + __in ULONG64 Base, + __in_opt PCSTR StreamFile, + __in_bcount_opt(Size) PBYTE Buffer, + __in size_t Size +); + +typedef BOOL (WINAPI* SYMADDSOURCESTREAMA)(HANDLE, ULONG64, PCSTR, PBYTE, size_t); + +BOOL +IMAGEAPI +SymAddSourceStreamW( + __in HANDLE hProcess, + __in ULONG64 Base, + __in_opt PCWSTR FileSpec, + __in_bcount_opt(Size) PBYTE Buffer, + __in size_t Size +); + +BOOL +IMAGEAPI +SymSrvIsStoreW( + __in_opt HANDLE hProcess, + __in PCWSTR path +); + +BOOL +IMAGEAPI +SymSrvIsStore( + __in_opt HANDLE hProcess, + __in PCSTR path +); + +PCSTR +IMAGEAPI +SymSrvDeltaName( + __in HANDLE hProcess, + __in_opt PCSTR SymPath, + __in PCSTR Type, + __in PCSTR File1, + __in PCSTR File2 +); + +PCWSTR +IMAGEAPI +SymSrvDeltaNameW( + __in HANDLE hProcess, + __in_opt PCWSTR SymPath, + __in PCWSTR Type, + __in PCWSTR File1, + __in PCWSTR File2 +); + +PCSTR +IMAGEAPI +SymSrvGetSupplement( + __in HANDLE hProcess, + __in_opt PCSTR SymPath, + __in PCSTR Node, + __in PCSTR File +); + +PCWSTR +IMAGEAPI +SymSrvGetSupplementW( + __in HANDLE hProcess, + __in_opt PCWSTR SymPath, + __in PCWSTR Node, + __in PCWSTR File +); + +BOOL +IMAGEAPI +SymSrvGetFileIndexes( + __in PCSTR File, + __out GUID* Id, + __out PDWORD Val1, + __out_opt PDWORD Val2, + __in DWORD Flags +); + +BOOL +IMAGEAPI +SymSrvGetFileIndexesW( + __in PCWSTR File, + __out GUID* Id, + __out PDWORD Val1, + __out_opt PDWORD Val2, + __in DWORD Flags +); + +BOOL +IMAGEAPI +SymSrvGetFileIndexStringW( + __in HANDLE hProcess, + __in_opt PCWSTR SrvPath, + __in PCWSTR File, + __out_ecount(Size) PWSTR Index, + __in size_t Size, + __in DWORD Flags +); + +BOOL +IMAGEAPI +SymSrvGetFileIndexString( + __in HANDLE hProcess, + __in_opt PCSTR SrvPath, + __in PCSTR File, + __out_ecount(Size) PSTR Index, + __in size_t Size, + __in DWORD Flags +); + +typedef struct +{ + DWORD sizeofstruct; + char file[MAX_PATH + 1]; + BOOL stripped; + DWORD timestamp; + DWORD size; + char dbgfile[MAX_PATH + 1]; + char pdbfile[MAX_PATH + 1]; + GUID guid; + DWORD sig; + DWORD age; +} SYMSRV_INDEX_INFO, *PSYMSRV_INDEX_INFO; + +typedef struct +{ + DWORD sizeofstruct; + WCHAR file[MAX_PATH + 1]; + BOOL stripped; + DWORD timestamp; + DWORD size; + WCHAR dbgfile[MAX_PATH + 1]; + WCHAR pdbfile[MAX_PATH + 1]; + GUID guid; + DWORD sig; + DWORD age; +} SYMSRV_INDEX_INFOW, *PSYMSRV_INDEX_INFOW; + +BOOL +IMAGEAPI +SymSrvGetFileIndexInfo( + __in PCSTR File, + __out PSYMSRV_INDEX_INFO Info, + __in DWORD Flags +); + +BOOL +IMAGEAPI +SymSrvGetFileIndexInfoW( + __in PCWSTR File, + __out PSYMSRV_INDEX_INFOW Info, + __in DWORD Flags +); + +PCSTR +IMAGEAPI +SymSrvStoreSupplement( + __in HANDLE hProcess, + __in_opt PCSTR SrvPath, + __in PCSTR Node, + __in PCSTR File, + __in DWORD Flags +); + +PCWSTR +IMAGEAPI +SymSrvStoreSupplementW( + __in HANDLE hProcess, + __in_opt PCWSTR SymPath, + __in PCWSTR Node, + __in PCWSTR File, + __in DWORD Flags +); + +PCSTR +IMAGEAPI +SymSrvStoreFile( + __in HANDLE hProcess, + __in_opt PCSTR SrvPath, + __in PCSTR File, + __in DWORD Flags +); + +PCWSTR +IMAGEAPI +SymSrvStoreFileW( + __in HANDLE hProcess, + __in_opt PCWSTR SrvPath, + __in PCWSTR File, + __in DWORD Flags +); + +// used by SymGetSymbolFile's "Type" parameter + +enum +{ + sfImage = 0, + sfDbg, + sfPdb, + sfMpd, + sfMax +}; + +BOOL +IMAGEAPI +SymGetSymbolFile( + __in_opt HANDLE hProcess, + __in_opt PCSTR SymPath, + __in PCSTR ImageFile, + __in DWORD Type, + __out_ecount(cSymbolFile) PSTR SymbolFile, + __in size_t cSymbolFile, + __out_ecount(cDbgFile) PSTR DbgFile, + __in size_t cDbgFile +); + +BOOL +IMAGEAPI +SymGetSymbolFileW( + __in_opt HANDLE hProcess, + __in_opt PCWSTR SymPath, + __in PCWSTR ImageFile, + __in DWORD Type, + __out_ecount(cSymbolFile) PWSTR SymbolFile, + __in size_t cSymbolFile, + __out_ecount(cDbgFile) PWSTR DbgFile, + __in size_t cDbgFile +); + +// +// Full user-mode dump creation. +// + +typedef BOOL (WINAPI* PDBGHELP_CREATE_USER_DUMP_CALLBACK)( + __in DWORD DataType, + __in PVOID* Data, + __out LPDWORD DataLength, + __in_opt PVOID UserData +); + +BOOL +WINAPI +DbgHelpCreateUserDump( + __in_opt LPCSTR FileName, + __in PDBGHELP_CREATE_USER_DUMP_CALLBACK Callback, + __in_opt PVOID UserData +); + +BOOL +WINAPI +DbgHelpCreateUserDumpW( + __in_opt LPCWSTR FileName, + __in PDBGHELP_CREATE_USER_DUMP_CALLBACK Callback, + __in_opt PVOID UserData +); + +// ----------------------------------------------------------------- +// The following 4 legacy APIs are fully supported, but newer +// ones are recommended. SymFromName and SymFromAddr provide +// much more detailed info on the returned symbol. + +BOOL +IMAGEAPI +SymGetSymFromAddr64( + __in HANDLE hProcess, + __in DWORD64 qwAddr, + __out_opt PDWORD64 pdwDisplacement, + __inout PIMAGEHLP_SYMBOL64 Symbol +); + + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define SymGetSymFromAddr SymGetSymFromAddr64 +#else +BOOL +IMAGEAPI +SymGetSymFromAddr( + __in HANDLE hProcess, + __in DWORD dwAddr, + __out_opt PDWORD pdwDisplacement, + __inout PIMAGEHLP_SYMBOL Symbol +); +#endif + +// While following two APIs will provide a symbol from a name, +// SymEnumSymbols can provide the same matching information +// for ALL symbols with a matching name, even regular +// expressions. That way you can search across modules +// and differentiate between identically named symbols. + +BOOL +IMAGEAPI +SymGetSymFromName64( + __in HANDLE hProcess, + __in PCSTR Name, + __inout PIMAGEHLP_SYMBOL64 Symbol +); + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define SymGetSymFromName SymGetSymFromName64 +#else +BOOL +IMAGEAPI +SymGetSymFromName( + __in HANDLE hProcess, + __in PCSTR Name, + __inout PIMAGEHLP_SYMBOL Symbol +); +#endif + + +// Symbol server exports + +typedef BOOL (WINAPI* PSYMBOLSERVERPROC)(PCSTR, PCSTR, PVOID, DWORD, DWORD, PSTR); +typedef BOOL (WINAPI* PSYMBOLSERVERPROCA)(PCSTR, PCSTR, PVOID, DWORD, DWORD, PSTR); +typedef BOOL (WINAPI* PSYMBOLSERVERPROCW)(PCWSTR, PCWSTR, PVOID, DWORD, DWORD, PWSTR); +typedef BOOL (WINAPI* PSYMBOLSERVERBYINDEXPROC)(PCSTR, PCSTR, PCSTR, PSTR); +typedef BOOL (WINAPI* PSYMBOLSERVERBYINDEXPROCA)(PCSTR, PCSTR, PCSTR, PSTR); +typedef BOOL (WINAPI* PSYMBOLSERVERBYINDEXPROCW)(PCWSTR, PCWSTR, PCWSTR, PWSTR); +typedef BOOL (WINAPI* PSYMBOLSERVEROPENPROC)(VOID); +typedef BOOL (WINAPI* PSYMBOLSERVERCLOSEPROC)(VOID); +typedef BOOL (WINAPI* PSYMBOLSERVERSETOPTIONSPROC)(UINT_PTR, ULONG64); +typedef BOOL (WINAPI* PSYMBOLSERVERSETOPTIONSWPROC)(UINT_PTR, ULONG64); +typedef BOOL (CALLBACK WINAPI* PSYMBOLSERVERCALLBACKPROC)(UINT_PTR action, ULONG64 data, ULONG64 context); +typedef UINT_PTR(WINAPI* PSYMBOLSERVERGETOPTIONSPROC)(); +typedef BOOL (WINAPI* PSYMBOLSERVERPINGPROC)(PCSTR); +typedef BOOL (WINAPI* PSYMBOLSERVERPINGPROCA)(PCSTR); +typedef BOOL (WINAPI* PSYMBOLSERVERPINGPROCW)(PCWSTR); +typedef BOOL (WINAPI* PSYMBOLSERVERGETVERSION)(LPAPI_VERSION); +typedef BOOL (WINAPI* PSYMBOLSERVERDELTANAME)(PCSTR, PVOID, DWORD, DWORD, PVOID, DWORD, DWORD, PSTR, size_t); +typedef BOOL (WINAPI* PSYMBOLSERVERDELTANAMEW)(PCWSTR, PVOID, DWORD, DWORD, PVOID, DWORD, DWORD, PWSTR, size_t); +typedef BOOL (WINAPI* PSYMBOLSERVERGETSUPPLEMENT)(PCSTR, PCSTR, PCSTR, PSTR, size_t); +typedef BOOL (WINAPI* PSYMBOLSERVERGETSUPPLEMENTW)(PCWSTR, PCWSTR, PCWSTR, PWSTR, size_t); +typedef BOOL (WINAPI* PSYMBOLSERVERSTORESUPPLEMENT)(PCSTR, PCSTR, PCSTR, PSTR, size_t, DWORD); +typedef BOOL (WINAPI* PSYMBOLSERVERSTORESUPPLEMENTW)(PCWSTR, PCWSTR, PCWSTR, PWSTR, size_t, DWORD); +typedef BOOL (WINAPI* PSYMBOLSERVERGETINDEXSTRING)(PVOID, DWORD, DWORD, PSTR, size_t); +typedef BOOL (WINAPI* PSYMBOLSERVERGETINDEXSTRINGW)(PVOID, DWORD, DWORD, PWSTR, size_t); +typedef BOOL (WINAPI* PSYMBOLSERVERSTOREFILE)(PCSTR, PCSTR, PVOID, DWORD, DWORD, PSTR, size_t, DWORD); +typedef BOOL (WINAPI* PSYMBOLSERVERSTOREFILEW)(PCWSTR, PCWSTR, PVOID, DWORD, DWORD, PWSTR, size_t, DWORD); +typedef BOOL (WINAPI* PSYMBOLSERVERISSTORE)(PCSTR); +typedef BOOL (WINAPI* PSYMBOLSERVERISSTOREW)(PCWSTR); +typedef DWORD (WINAPI* PSYMBOLSERVERVERSION)(); +typedef BOOL (CALLBACK WINAPI* PSYMBOLSERVERMESSAGEPROC)(UINT_PTR action, ULONG64 data, ULONG64 context); + +#define SYMSRV_VERSION 2 + +#define SSRVOPT_CALLBACK 0x00000001 +#define SSRVOPT_DWORD 0x00000002 +#define SSRVOPT_DWORDPTR 0x00000004 +#define SSRVOPT_GUIDPTR 0x00000008 +#define SSRVOPT_OLDGUIDPTR 0x00000010 +#define SSRVOPT_UNATTENDED 0x00000020 +#define SSRVOPT_NOCOPY 0x00000040 +#define SSRVOPT_GETPATH 0x00000040 +#define SSRVOPT_PARENTWIN 0x00000080 +#define SSRVOPT_PARAMTYPE 0x00000100 +#define SSRVOPT_SECURE 0x00000200 +#define SSRVOPT_TRACE 0x00000400 +#define SSRVOPT_SETCONTEXT 0x00000800 +#define SSRVOPT_PROXY 0x00001000 +#define SSRVOPT_DOWNSTREAM_STORE 0x00002000 +#define SSRVOPT_OVERWRITE 0x00004000 +#define SSRVOPT_RESETTOU 0x00008000 +#define SSRVOPT_CALLBACKW 0x00010000 +#define SSRVOPT_FLAT_DEFAULT_STORE 0x00020000 +#define SSRVOPT_PROXYW 0x00040000 +#define SSRVOPT_MESSAGE 0x00080000 +#define SSRVOPT_SERVICE 0x00100000 // deprecated +#define SSRVOPT_FAVOR_COMPRESSED 0x00200000 +#define SSRVOPT_STRING 0x00400000 +#define SSRVOPT_WINHTTP 0x00800000 +#define SSRVOPT_WININET 0x01000000 + +#define SSRVOPT_MAX 0x0100000 + +#define SSRVOPT_RESET ((ULONG_PTR)-1) + + +#define NUM_SSRVOPTS 30 + +#define SSRVACTION_TRACE 1 +#define SSRVACTION_QUERYCANCEL 2 +#define SSRVACTION_EVENT 3 +#define SSRVACTION_EVENTW 4 +#define SSRVACTION_SIZE 5 + +#define SYMSTOREOPT_COMPRESS 0x01 +#define SYMSTOREOPT_OVERWRITE 0x02 +#define SYMSTOREOPT_RETURNINDEX 0x04 +#define SYMSTOREOPT_POINTER 0x08 +#define SYMSTOREOPT_ALT_INDEX 0x10 +#define SYMSTOREOPT_UNICODE 0x20 +#define SYMSTOREOPT_PASS_IF_EXISTS 0x40 + +#ifdef DBGHELP_TRANSLATE_TCHAR +#define SymInitialize SymInitializeW +#define SymAddSymbol SymAddSymbolW +#define SymDeleteSymbol SymDeleteSymbolW +#define SearchTreeForFile SearchTreeForFileW +#define UnDecorateSymbolName UnDecorateSymbolNameW +#define SymGetLineFromName64 SymGetLineFromNameW64 +#define SymGetLineFromAddr64 SymGetLineFromAddrW64 +#define SymGetLineNext64 SymGetLineNextW64 +#define SymGetLinePrev64 SymGetLinePrevW64 +#define SymFromName SymFromNameW +#define SymFindExecutableImage SymFindExecutableImageW +#define FindExecutableImageEx FindExecutableImageExW +#define SymSearch SymSearchW +#define SymEnumLines SymEnumLinesW +#define SymEnumSourceLines SymEnumSourceLinesW +#define SymGetTypeFromName SymGetTypeFromNameW +#define SymEnumSymbolsForAddr SymEnumSymbolsForAddrW +#define SymFromAddr SymFromAddrW +#define SymMatchString SymMatchStringW +#define SymEnumSourceFiles SymEnumSourceFilesW +#define SymEnumSymbols SymEnumSymbolsW +#define SymLoadModuleEx SymLoadModuleExW +#define SymSetSearchPath SymSetSearchPathW +#define SymGetSearchPath SymGetSearchPathW +#define EnumDirTree EnumDirTreeW +#define SymFromToken SymFromTokenW +#define SymFromIndex SymFromIndexW +#define SymGetScope SymGetScopeW +#define SymNext SymNextW +#define SymPrev SymPrevW +#define SymEnumTypes SymEnumTypesW +#define SymEnumTypesByName SymEnumTypesByNameW +#define SymRegisterCallback64 SymRegisterCallbackW64 +#define SymFindDebugInfoFile SymFindDebugInfoFileW +#define FindDebugInfoFileEx FindDebugInfoFileExW +#define SymFindFileInPath SymFindFileInPathW +#define SymEnumerateModules64 SymEnumerateModulesW64 +#define SymSetHomeDirectory SymSetHomeDirectoryW +#define SymGetHomeDirectory SymGetHomeDirectoryW +#define SymGetSourceFile SymGetSourceFileW +#define SymGetSourceFileToken SymGetSourceFileTokenW +#define SymGetSourceFileFromToken SymGetSourceFileFromTokenW +#define SymGetSourceVarFromToken SymGetSourceVarFromTokenW +#define SymGetSourceFileToken SymGetSourceFileTokenW +#define SymGetFileLineOffsets64 SymGetFileLineOffsetsW64 +#define SymFindFileInPath SymFindFileInPathW +#define SymMatchFileName SymMatchFileNameW +#define SymGetSourceFileFromToken SymGetSourceFileFromTokenW +#define SymGetSourceVarFromToken SymGetSourceVarFromTokenW +#define SymGetModuleInfo64 SymGetModuleInfoW64 +#define SymSrvIsStore SymSrvIsStoreW +#define SymSrvDeltaName SymSrvDeltaNameW +#define SymSrvGetSupplement SymSrvGetSupplementW +#define SymSrvStoreSupplement SymSrvStoreSupplementW +#define SymSrvGetFileIndexes SymSrvGetFileIndexes +#define SymSrvGetFileIndexString SymSrvGetFileIndexStringW +#define SymSrvStoreFile SymSrvStoreFileW +#define SymGetSymbolFile SymGetSymbolFileW +#define EnumerateLoadedModules64 EnumerateLoadedModulesW64 +#define EnumerateLoadedModulesEx EnumerateLoadedModulesExW +#define SymSrvGetFileIndexInfo SymSrvGetFileIndexInfoW + +#define IMAGEHLP_LINE64 IMAGEHLP_LINEW64 +#define PIMAGEHLP_LINE64 PIMAGEHLP_LINEW64 +#define SYMBOL_INFO SYMBOL_INFOW +#define PSYMBOL_INFO PSYMBOL_INFOW +#define SYMBOL_INFO_PACKAGE SYMBOL_INFO_PACKAGEW +#define PSYMBOL_INFO_PACKAGE PSYMBOL_INFO_PACKAGEW +#define FIND_EXE_FILE_CALLBACK FIND_EXE_FILE_CALLBACKW +#define PFIND_EXE_FILE_CALLBACK PFIND_EXE_FILE_CALLBACKW +#define SYM_ENUMERATESYMBOLS_CALLBACK SYM_ENUMERATESYMBOLS_CALLBACKW +#define PSYM_ENUMERATESYMBOLS_CALLBACK PSYM_ENUMERATESYMBOLS_CALLBACKW +#define SRCCODEINFO SRCCODEINFOW +#define PSRCCODEINFO PSRCCODEINFOW +#define SOURCEFILE SOURCEFILEW +#define PSOURCEFILE PSOURCEFILEW +#define SYM_ENUMSOURECFILES_CALLBACK SYM_ENUMSOURCEFILES_CALLBACKW +#define PSYM_ENUMSOURCEFILES_CALLBACK PSYM_ENUMSOURECFILES_CALLBACKW +#define IMAGEHLP_CBA_EVENT IMAGEHLP_CBA_EVENTW +#define PIMAGEHLP_CBA_EVENT PIMAGEHLP_CBA_EVENTW +#define PENUMDIRTREE_CALLBACK PENUMDIRTREE_CALLBACKW +#define IMAGEHLP_DEFERRED_SYMBOL_LOAD64 IMAGEHLP_DEFERRED_SYMBOL_LOADW64 +#define PIMAGEHLP_DEFERRED_SYMBOL_LOAD64 PIMAGEHLP_DEFERRED_SYMBOL_LOADW64 +#define PFIND_DEBUG_FILE_CALLBACK PFIND_DEBUG_FILE_CALLBACKW +#define PFINDFILEINPATHCALLBACK PFINDFILEINPATHCALLBACKW +#define IMAGEHLP_MODULE64 IMAGEHLP_MODULEW64 +#define PIMAGEHLP_MODULE64 PIMAGEHLP_MODULEW64 +#define SYMSRV_INDEX_INFO SYMSRV_INDEX_INFOW +#define PSYMSRV_INDEX_INFO PSYMSRV_INDEX_INFOW + +#define PSYMBOLSERVERPROC PSYMBOLSERVERPROCW +#define PSYMBOLSERVERPINGPROC PSYMBOLSERVERPINGPROCW +#endif + +// ----------------------------------------------------------------- +// The following APIs exist only for backwards compatibility +// with a pre-release version documented in an MSDN release. + +// You should use SymFindFileInPath if you want to maintain +// future compatibility. + +DBHLP_DEPRECIATED +BOOL +IMAGEAPI +FindFileInPath( + __in HANDLE hprocess, + __in PCSTR SearchPath, + __in PCSTR FileName, + __in PVOID id, + __in DWORD two, + __in DWORD three, + __in DWORD flags, + __out_ecount(MAX_PATH + 1) PSTR FilePath +); + +// You should use SymFindFileInPath if you want to maintain +// future compatibility. + +DBHLP_DEPRECIATED +BOOL +IMAGEAPI +FindFileInSearchPath( + __in HANDLE hprocess, + __in PCSTR SearchPath, + __in PCSTR FileName, + __in DWORD one, + __in DWORD two, + __in DWORD three, + __out_ecount(MAX_PATH + 1) PSTR FilePath +); + +DBHLP_DEPRECIATED +BOOL +IMAGEAPI +SymEnumSym( + __in HANDLE hProcess, + __in ULONG64 BaseOfDll, + __in PSYM_ENUMERATESYMBOLS_CALLBACK EnumSymbolsCallback, + __in_opt PVOID UserContext +); + +DBHLP_DEPRECIATED +BOOL +IMAGEAPI +SymEnumerateSymbols64( + __in HANDLE hProcess, + __in ULONG64 BaseOfDll, + __in PSYM_ENUMSYMBOLS_CALLBACK64 EnumSymbolsCallback, + __in_opt PVOID UserContext +); + +DBHLP_DEPRECIATED +BOOL +IMAGEAPI +SymEnumerateSymbolsW64( + __in HANDLE hProcess, + __in ULONG64 BaseOfDll, + __in PSYM_ENUMSYMBOLS_CALLBACK64W EnumSymbolsCallback, + __in_opt PVOID UserContext +); + + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define SymEnumerateSymbols SymEnumerateSymbols64 +#define SymEnumerateSymbolsW SymEnumerateSymbolsW64 +#else +DBHLP_DEPRECIATED +BOOL +IMAGEAPI +SymEnumerateSymbols( + __in HANDLE hProcess, + __in ULONG BaseOfDll, + __in PSYM_ENUMSYMBOLS_CALLBACK EnumSymbolsCallback, + __in_opt PVOID UserContext +); + +DBHLP_DEPRECIATED +BOOL +IMAGEAPI +SymEnumerateSymbolsW( + __in HANDLE hProcess, + __in ULONG BaseOfDll, + __in PSYM_ENUMSYMBOLS_CALLBACKW EnumSymbolsCallback, + __in_opt PVOID UserContext +); +#endif + +// use SymLoadModuleEx + +DWORD64 +IMAGEAPI +SymLoadModule64( + __in HANDLE hProcess, + __in_opt HANDLE hFile, + __in_opt PCSTR ImageName, + __in_opt PCSTR ModuleName, + __in DWORD64 BaseOfDll, + __in DWORD SizeOfDll +); + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define SymLoadModule SymLoadModule64 +#else +DWORD +IMAGEAPI +SymLoadModule( + __in HANDLE hProcess, + __in_opt HANDLE hFile, + __in_opt PCSTR ImageName, + __in_opt PCSTR ModuleName, + __in DWORD BaseOfDll, + __in DWORD SizeOfDll +); +#endif + +BOOL +IMAGEAPI +SymGetSymNext64( + __in HANDLE hProcess, + __inout PIMAGEHLP_SYMBOL64 Symbol +); + +BOOL +IMAGEAPI +SymGetSymNextW64( + __in HANDLE hProcess, + __inout PIMAGEHLP_SYMBOLW64 Symbol +); + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define SymGetSymNext SymGetSymNext64 +#define SymGetSymNextW SymGetSymNextW64 +#else +BOOL +IMAGEAPI +SymGetSymNext( + __in HANDLE hProcess, + __inout PIMAGEHLP_SYMBOL Symbol +); + +BOOL +IMAGEAPI +SymGetSymNextW( + __in HANDLE hProcess, + __inout PIMAGEHLP_SYMBOLW Symbol +); +#endif + +BOOL +IMAGEAPI +SymGetSymPrev64( + __in HANDLE hProcess, + __inout PIMAGEHLP_SYMBOL64 Symbol +); + +BOOL +IMAGEAPI +SymGetSymPrevW64( + __in HANDLE hProcess, + __inout PIMAGEHLP_SYMBOLW64 Symbol +); + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define SymGetSymPrev SymGetSymPrev64 +#define SymGetSymPrevW SymGetSymPrevW64 +#else +BOOL +IMAGEAPI +SymGetSymPrev( + __in HANDLE hProcess, + __inout PIMAGEHLP_SYMBOL Symbol +); + +BOOL +IMAGEAPI +SymGetSymPrevW( + __in HANDLE hProcess, + __inout PIMAGEHLP_SYMBOLW Symbol +); +#endif + + +// These values should not be used. +// They have been replaced by SYMFLAG_ values. + +#define SYMF_OMAP_GENERATED 0x00000001 +#define SYMF_OMAP_MODIFIED 0x00000002 +#define SYMF_REGISTER 0x00000008 +#define SYMF_REGREL 0x00000010 +#define SYMF_FRAMEREL 0x00000020 +#define SYMF_PARAMETER 0x00000040 +#define SYMF_LOCAL 0x00000080 +#define SYMF_CONSTANT 0x00000100 +#define SYMF_EXPORT 0x00000200 +#define SYMF_FORWARDER 0x00000400 +#define SYMF_FUNCTION 0x00000800 +#define SYMF_VIRTUAL 0x00001000 +#define SYMF_THUNK 0x00002000 +#define SYMF_TLSREL 0x00004000 + +// These values should also not be used. +// They have been replaced by SYMFLAG_ values. + +#define IMAGEHLP_SYMBOL_INFO_VALUEPRESENT 1 +#define IMAGEHLP_SYMBOL_INFO_REGISTER SYMF_REGISTER // 0x0008 +#define IMAGEHLP_SYMBOL_INFO_REGRELATIVE SYMF_REGREL // 0x0010 +#define IMAGEHLP_SYMBOL_INFO_FRAMERELATIVE SYMF_FRAMEREL // 0x0020 +#define IMAGEHLP_SYMBOL_INFO_PARAMETER SYMF_PARAMETER // 0x0040 +#define IMAGEHLP_SYMBOL_INFO_LOCAL SYMF_LOCAL // 0x0080 +#define IMAGEHLP_SYMBOL_INFO_CONSTANT SYMF_CONSTANT // 0x0100 +#define IMAGEHLP_SYMBOL_FUNCTION SYMF_FUNCTION // 0x0800 +#define IMAGEHLP_SYMBOL_VIRTUAL SYMF_VIRTUAL // 0x1000 +#define IMAGEHLP_SYMBOL_THUNK SYMF_THUNK // 0x2000 +#define IMAGEHLP_SYMBOL_INFO_TLSRELATIVE SYMF_TLSREL // 0x4000 + +#pragma pack(pop) + + +#pragma pack(push,4) + +#define MINIDUMP_SIGNATURE ('PMDM') +#define MINIDUMP_VERSION (42899) +typedef DWORD RVA; +typedef ULONG64 RVA64; + +typedef struct _MINIDUMP_LOCATION_DESCRIPTOR +{ + ULONG32 DataSize; + RVA Rva; +} MINIDUMP_LOCATION_DESCRIPTOR; + +typedef struct _MINIDUMP_LOCATION_DESCRIPTOR64 +{ + ULONG64 DataSize; + RVA64 Rva; +} MINIDUMP_LOCATION_DESCRIPTOR64; + + +typedef struct _MINIDUMP_MEMORY_DESCRIPTOR +{ + ULONG64 StartOfMemoryRange; + MINIDUMP_LOCATION_DESCRIPTOR Memory; +} MINIDUMP_MEMORY_DESCRIPTOR, *PMINIDUMP_MEMORY_DESCRIPTOR; + +// DESCRIPTOR64 is used for full-memory minidumps where +// all of the raw memory is laid out sequentially at the +// end of the dump. There is no need for individual RVAs +// as the RVA is the base RVA plus the sum of the preceeding +// data blocks. +typedef struct _MINIDUMP_MEMORY_DESCRIPTOR64 +{ + ULONG64 StartOfMemoryRange; + ULONG64 DataSize; +} MINIDUMP_MEMORY_DESCRIPTOR64, *PMINIDUMP_MEMORY_DESCRIPTOR64; + + +typedef struct _MINIDUMP_HEADER +{ + ULONG32 Signature; + ULONG32 Version; + ULONG32 NumberOfStreams; + RVA StreamDirectoryRva; + ULONG32 CheckSum; + union + { + ULONG32 Reserved; + ULONG32 TimeDateStamp; + }; + ULONG64 Flags; +} MINIDUMP_HEADER, *PMINIDUMP_HEADER; + +// +// The MINIDUMP_HEADER field StreamDirectoryRva points to +// an array of MINIDUMP_DIRECTORY structures. +// + +typedef struct _MINIDUMP_DIRECTORY +{ + ULONG32 StreamType; + MINIDUMP_LOCATION_DESCRIPTOR Location; +} MINIDUMP_DIRECTORY, *PMINIDUMP_DIRECTORY; + + +typedef struct _MINIDUMP_STRING +{ + ULONG32 Length; // Length in bytes of the string + WCHAR Buffer [0]; // Variable size buffer +} MINIDUMP_STRING, *PMINIDUMP_STRING; + + + +// +// The MINIDUMP_DIRECTORY field StreamType may be one of the following types. +// Types will be added in the future, so if a program reading the minidump +// header encounters a stream type it does not understand it should ignore +// the data altogether. Any tag above LastReservedStream will not be used by +// the system and is reserved for program-specific information. +// + +typedef enum _MINIDUMP_STREAM_TYPE +{ + + UnusedStream = 0, + ReservedStream0 = 1, + ReservedStream1 = 2, + ThreadListStream = 3, + ModuleListStream = 4, + MemoryListStream = 5, + ExceptionStream = 6, + SystemInfoStream = 7, + ThreadExListStream = 8, + Memory64ListStream = 9, + CommentStreamA = 10, + CommentStreamW = 11, + HandleDataStream = 12, + FunctionTableStream = 13, + UnloadedModuleListStream = 14, + MiscInfoStream = 15, + MemoryInfoListStream = 16, + ThreadInfoListStream = 17, + HandleOperationListStream = 18, + TokenStream = 19, + + ceStreamNull = 0x8000, + ceStreamSystemInfo = 0x8001, + ceStreamException = 0x8002, + ceStreamModuleList = 0x8003, + ceStreamProcessList = 0x8004, + ceStreamThreadList = 0x8005, + ceStreamThreadContextList = 0x8006, + ceStreamThreadCallStackList = 0x8007, + ceStreamMemoryVirtualList = 0x8008, + ceStreamMemoryPhysicalList = 0x8009, + ceStreamBucketParameters = 0x800A, + ceStreamProcessModuleMap = 0x800B, + ceStreamDiagnosisList = 0x800C, + + LastReservedStream = 0xffff + +} MINIDUMP_STREAM_TYPE; + + +// +// The minidump system information contains processor and +// Operating System specific information. +// + +// +// CPU information is obtained from one of two places. +// +// 1) On x86 computers, CPU_INFORMATION is obtained from the CPUID +// instruction. You must use the X86 portion of the union for X86 +// computers. +// +// 2) On non-x86 architectures, CPU_INFORMATION is obtained by calling +// IsProcessorFeatureSupported(). +// + +typedef union _CPU_INFORMATION +{ + + // + // X86 platforms use CPUID function to obtain processor information. + // + + struct + { + + // + // CPUID Subfunction 0, register EAX (VendorId [0]), + // EBX (VendorId [1]) and ECX (VendorId [2]). + // + + ULONG32 VendorId [ 3 ]; + + // + // CPUID Subfunction 1, register EAX + // + + ULONG32 VersionInformation; + + // + // CPUID Subfunction 1, register EDX + // + + ULONG32 FeatureInformation; + + + // + // CPUID, Subfunction 80000001, register EBX. This will only + // be obtained if the vendor id is "AuthenticAMD". + // + + ULONG32 AMDExtendedCpuFeatures; + + } X86CpuInfo; + + // + // Non-x86 platforms use processor feature flags. + // + + struct + { + + ULONG64 ProcessorFeatures [ 2 ]; + + } OtherCpuInfo; + +} CPU_INFORMATION, *PCPU_INFORMATION; + +typedef struct _MINIDUMP_SYSTEM_INFO +{ + + // + // ProcessorArchitecture, ProcessorLevel and ProcessorRevision are all + // taken from the SYSTEM_INFO structure obtained by GetSystemInfo( ). + // + + USHORT ProcessorArchitecture; + USHORT ProcessorLevel; + USHORT ProcessorRevision; + + union + { + USHORT Reserved0; + struct + { + UCHAR NumberOfProcessors; + UCHAR ProductType; + }; + }; + + // + // MajorVersion, MinorVersion, BuildNumber, PlatformId and + // CSDVersion are all taken from the OSVERSIONINFO structure + // returned by GetVersionEx( ). + // + + ULONG32 MajorVersion; + ULONG32 MinorVersion; + ULONG32 BuildNumber; + ULONG32 PlatformId; + + // + // RVA to a CSDVersion string in the string table. + // + + RVA CSDVersionRva; + + union + { + ULONG32 Reserved1; + struct + { + USHORT SuiteMask; + USHORT Reserved2; + }; + }; + + CPU_INFORMATION Cpu; + +} MINIDUMP_SYSTEM_INFO, *PMINIDUMP_SYSTEM_INFO; + + +// +// The minidump thread contains standard thread +// information plus an RVA to the memory for this +// thread and an RVA to the CONTEXT structure for +// this thread. +// + + +// +// ThreadId must be 4 bytes on all architectures. +// + +C_ASSERT(sizeof(((PPROCESS_INFORMATION)0)->dwThreadId) == 4); + +typedef struct _MINIDUMP_THREAD +{ + ULONG32 ThreadId; + ULONG32 SuspendCount; + ULONG32 PriorityClass; + ULONG32 Priority; + ULONG64 Teb; + MINIDUMP_MEMORY_DESCRIPTOR Stack; + MINIDUMP_LOCATION_DESCRIPTOR ThreadContext; +} MINIDUMP_THREAD, *PMINIDUMP_THREAD; + +// +// The thread list is a container of threads. +// + +typedef struct _MINIDUMP_THREAD_LIST +{ + ULONG32 NumberOfThreads; + MINIDUMP_THREAD Threads [0]; +} MINIDUMP_THREAD_LIST, *PMINIDUMP_THREAD_LIST; + + +typedef struct _MINIDUMP_THREAD_EX +{ + ULONG32 ThreadId; + ULONG32 SuspendCount; + ULONG32 PriorityClass; + ULONG32 Priority; + ULONG64 Teb; + MINIDUMP_MEMORY_DESCRIPTOR Stack; + MINIDUMP_LOCATION_DESCRIPTOR ThreadContext; + MINIDUMP_MEMORY_DESCRIPTOR BackingStore; +} MINIDUMP_THREAD_EX, *PMINIDUMP_THREAD_EX; + +// +// The thread list is a container of threads. +// + +typedef struct _MINIDUMP_THREAD_EX_LIST +{ + ULONG32 NumberOfThreads; + MINIDUMP_THREAD_EX Threads [0]; +} MINIDUMP_THREAD_EX_LIST, *PMINIDUMP_THREAD_EX_LIST; + + +// +// The MINIDUMP_EXCEPTION is the same as EXCEPTION on Win64. +// + +typedef struct _MINIDUMP_EXCEPTION +{ + ULONG32 ExceptionCode; + ULONG32 ExceptionFlags; + ULONG64 ExceptionRecord; + ULONG64 ExceptionAddress; + ULONG32 NumberParameters; + ULONG32 __unusedAlignment; + ULONG64 ExceptionInformation [ EXCEPTION_MAXIMUM_PARAMETERS ]; +} MINIDUMP_EXCEPTION, *PMINIDUMP_EXCEPTION; + + +// +// The exception information stream contains the id of the thread that caused +// the exception (ThreadId), the exception record for the exception +// (ExceptionRecord) and an RVA to the thread context where the exception +// occured. +// + +typedef struct MINIDUMP_EXCEPTION_STREAM +{ + ULONG32 ThreadId; + ULONG32 __alignment; + MINIDUMP_EXCEPTION ExceptionRecord; + MINIDUMP_LOCATION_DESCRIPTOR ThreadContext; +} MINIDUMP_EXCEPTION_STREAM, *PMINIDUMP_EXCEPTION_STREAM; + + +// +// The MINIDUMP_MODULE contains information about a +// a specific module. It includes the CheckSum and +// the TimeDateStamp for the module so the module +// can be reloaded during the analysis phase. +// + +typedef struct _MINIDUMP_MODULE +{ + ULONG64 BaseOfImage; + ULONG32 SizeOfImage; + ULONG32 CheckSum; + ULONG32 TimeDateStamp; + RVA ModuleNameRva; + VS_FIXEDFILEINFO VersionInfo; + MINIDUMP_LOCATION_DESCRIPTOR CvRecord; + MINIDUMP_LOCATION_DESCRIPTOR MiscRecord; + ULONG64 Reserved0; // Reserved for future use. + ULONG64 Reserved1; // Reserved for future use. +} MINIDUMP_MODULE, *PMINIDUMP_MODULE; + + +// +// The minidump module list is a container for modules. +// + +typedef struct _MINIDUMP_MODULE_LIST +{ + ULONG32 NumberOfModules; + MINIDUMP_MODULE Modules [ 0 ]; +} MINIDUMP_MODULE_LIST, *PMINIDUMP_MODULE_LIST; + + +// +// Memory Ranges +// + +typedef struct _MINIDUMP_MEMORY_LIST +{ + ULONG32 NumberOfMemoryRanges; + MINIDUMP_MEMORY_DESCRIPTOR MemoryRanges [0]; +} MINIDUMP_MEMORY_LIST, *PMINIDUMP_MEMORY_LIST; + +typedef struct _MINIDUMP_MEMORY64_LIST +{ + ULONG64 NumberOfMemoryRanges; + RVA64 BaseRva; + MINIDUMP_MEMORY_DESCRIPTOR64 MemoryRanges [0]; +} MINIDUMP_MEMORY64_LIST, *PMINIDUMP_MEMORY64_LIST; + + +// +// Support for user supplied exception information. +// + +typedef struct _MINIDUMP_EXCEPTION_INFORMATION +{ + DWORD ThreadId; + PEXCEPTION_POINTERS ExceptionPointers; + BOOL ClientPointers; +} MINIDUMP_EXCEPTION_INFORMATION, *PMINIDUMP_EXCEPTION_INFORMATION; + +typedef struct _MINIDUMP_EXCEPTION_INFORMATION64 +{ + DWORD ThreadId; + ULONG64 ExceptionRecord; + ULONG64 ContextRecord; + BOOL ClientPointers; +} MINIDUMP_EXCEPTION_INFORMATION64, *PMINIDUMP_EXCEPTION_INFORMATION64; + + +// +// Support for capturing system handle state at the time of the dump. +// + +// Per-handle object information varies according to +// the OS, the OS version, the processor type and +// so on. The minidump gives a minidump identifier +// to each possible data format for identification +// purposes but does not control nor describe the actual data. +typedef enum _MINIDUMP_HANDLE_OBJECT_INFORMATION_TYPE +{ + MiniHandleObjectInformationNone, + MiniThreadInformation1, + MiniMutantInformation1, + MiniMutantInformation2, + MiniProcessInformation1, + MiniProcessInformation2, + MiniHandleObjectInformationTypeMax +} MINIDUMP_HANDLE_OBJECT_INFORMATION_TYPE; + +typedef struct _MINIDUMP_HANDLE_OBJECT_INFORMATION +{ + RVA NextInfoRva; + ULONG32 InfoType; + ULONG32 SizeOfInfo; + // Raw information follows. +} MINIDUMP_HANDLE_OBJECT_INFORMATION; + +typedef struct _MINIDUMP_HANDLE_DESCRIPTOR +{ + ULONG64 Handle; + RVA TypeNameRva; + RVA ObjectNameRva; + ULONG32 Attributes; + ULONG32 GrantedAccess; + ULONG32 HandleCount; + ULONG32 PointerCount; +} MINIDUMP_HANDLE_DESCRIPTOR, *PMINIDUMP_HANDLE_DESCRIPTOR; + +typedef struct _MINIDUMP_HANDLE_DESCRIPTOR_2 +{ + ULONG64 Handle; + RVA TypeNameRva; + RVA ObjectNameRva; + ULONG32 Attributes; + ULONG32 GrantedAccess; + ULONG32 HandleCount; + ULONG32 PointerCount; + RVA ObjectInfoRva; + ULONG32 Reserved0; +} MINIDUMP_HANDLE_DESCRIPTOR_2, *PMINIDUMP_HANDLE_DESCRIPTOR_2; + +// The latest MINIDUMP_HANDLE_DESCRIPTOR definition. +typedef MINIDUMP_HANDLE_DESCRIPTOR_2 MINIDUMP_HANDLE_DESCRIPTOR_N; +typedef MINIDUMP_HANDLE_DESCRIPTOR_N* PMINIDUMP_HANDLE_DESCRIPTOR_N; + +typedef struct _MINIDUMP_HANDLE_DATA_STREAM +{ + ULONG32 SizeOfHeader; + ULONG32 SizeOfDescriptor; + ULONG32 NumberOfDescriptors; + ULONG32 Reserved; +} MINIDUMP_HANDLE_DATA_STREAM, *PMINIDUMP_HANDLE_DATA_STREAM; + +// Some operating systems can track the last operations +// performed on a handle. For example, Application Verifier +// can enable this for some versions of Windows. The +// handle operation list collects handle operations +// known for the dump target. +// Each entry is an AVRF_HANDLE_OPERATION. +typedef struct _MINIDUMP_HANDLE_OPERATION_LIST +{ + ULONG32 SizeOfHeader; + ULONG32 SizeOfEntry; + ULONG32 NumberOfEntries; + ULONG32 Reserved; +} MINIDUMP_HANDLE_OPERATION_LIST, *PMINIDUMP_HANDLE_OPERATION_LIST; + + +// +// Support for capturing dynamic function table state at the time of the dump. +// + +typedef struct _MINIDUMP_FUNCTION_TABLE_DESCRIPTOR +{ + ULONG64 MinimumAddress; + ULONG64 MaximumAddress; + ULONG64 BaseAddress; + ULONG32 EntryCount; + ULONG32 SizeOfAlignPad; +} MINIDUMP_FUNCTION_TABLE_DESCRIPTOR, *PMINIDUMP_FUNCTION_TABLE_DESCRIPTOR; + +typedef struct _MINIDUMP_FUNCTION_TABLE_STREAM +{ + ULONG32 SizeOfHeader; + ULONG32 SizeOfDescriptor; + ULONG32 SizeOfNativeDescriptor; + ULONG32 SizeOfFunctionEntry; + ULONG32 NumberOfDescriptors; + ULONG32 SizeOfAlignPad; +} MINIDUMP_FUNCTION_TABLE_STREAM, *PMINIDUMP_FUNCTION_TABLE_STREAM; + + +// +// The MINIDUMP_UNLOADED_MODULE contains information about a +// a specific module that was previously loaded but no +// longer is. This can help with diagnosing problems where +// callers attempt to call code that is no longer loaded. +// + +typedef struct _MINIDUMP_UNLOADED_MODULE +{ + ULONG64 BaseOfImage; + ULONG32 SizeOfImage; + ULONG32 CheckSum; + ULONG32 TimeDateStamp; + RVA ModuleNameRva; +} MINIDUMP_UNLOADED_MODULE, *PMINIDUMP_UNLOADED_MODULE; + + +// +// The minidump unloaded module list is a container for unloaded modules. +// + +typedef struct _MINIDUMP_UNLOADED_MODULE_LIST +{ + ULONG32 SizeOfHeader; + ULONG32 SizeOfEntry; + ULONG32 NumberOfEntries; +} MINIDUMP_UNLOADED_MODULE_LIST, *PMINIDUMP_UNLOADED_MODULE_LIST; + + +// +// The miscellaneous information stream contains a variety +// of small pieces of information. A member is valid if +// it's within the available size and its corresponding +// bit is set. +// + +#define MINIDUMP_MISC1_PROCESS_ID 0x00000001 +#define MINIDUMP_MISC1_PROCESS_TIMES 0x00000002 +#define MINIDUMP_MISC1_PROCESSOR_POWER_INFO 0x00000004 +#define MINIDUMP_MISC3_PROCESS_INTEGRITY 0x00000010 +#define MINIDUMP_MISC3_PROCESS_EXECUTE_FLAGS 0x00000020 +#define MINIDUMP_MISC3_TIMEZONE 0x00000040 +#define MINIDUMP_MISC3_PROTECTED_PROCESS 0x00000080 + +typedef struct _MINIDUMP_MISC_INFO +{ + ULONG32 SizeOfInfo; + ULONG32 Flags1; + ULONG32 ProcessId; + ULONG32 ProcessCreateTime; + ULONG32 ProcessUserTime; + ULONG32 ProcessKernelTime; +} MINIDUMP_MISC_INFO, *PMINIDUMP_MISC_INFO; + +typedef struct _MINIDUMP_MISC_INFO_2 +{ + ULONG32 SizeOfInfo; + ULONG32 Flags1; + ULONG32 ProcessId; + ULONG32 ProcessCreateTime; + ULONG32 ProcessUserTime; + ULONG32 ProcessKernelTime; + ULONG32 ProcessorMaxMhz; + ULONG32 ProcessorCurrentMhz; + ULONG32 ProcessorMhzLimit; + ULONG32 ProcessorMaxIdleState; + ULONG32 ProcessorCurrentIdleState; +} MINIDUMP_MISC_INFO_2, *PMINIDUMP_MISC_INFO_2; + +typedef struct _MINIDUMP_MISC_INFO_3 +{ + ULONG32 SizeOfInfo; + ULONG32 Flags1; + ULONG32 ProcessId; + ULONG32 ProcessCreateTime; + ULONG32 ProcessUserTime; + ULONG32 ProcessKernelTime; + ULONG32 ProcessorMaxMhz; + ULONG32 ProcessorCurrentMhz; + ULONG32 ProcessorMhzLimit; + ULONG32 ProcessorMaxIdleState; + ULONG32 ProcessorCurrentIdleState; + ULONG32 ProcessIntegrityLevel; + ULONG32 ProcessExecuteFlags; + ULONG32 ProtectedProcess; + ULONG32 TimeZoneId; + TIME_ZONE_INFORMATION TimeZone; +} MINIDUMP_MISC_INFO_3, *PMINIDUMP_MISC_INFO_3; + +// The latest MINIDUMP_MISC_INFO definition. +typedef MINIDUMP_MISC_INFO_3 MINIDUMP_MISC_INFO_N; +typedef MINIDUMP_MISC_INFO_N* PMINIDUMP_MISC_INFO_N; + + +// +// The memory information stream contains memory region +// description information. This stream corresponds to +// what VirtualQuery would return for the process the +// dump was created for. +// + +typedef struct _MINIDUMP_MEMORY_INFO +{ + ULONG64 BaseAddress; + ULONG64 AllocationBase; + ULONG32 AllocationProtect; + ULONG32 __alignment1; + ULONG64 RegionSize; + ULONG32 State; + ULONG32 Protect; + ULONG32 Type; + ULONG32 __alignment2; +} MINIDUMP_MEMORY_INFO, *PMINIDUMP_MEMORY_INFO; + +typedef struct _MINIDUMP_MEMORY_INFO_LIST +{ + ULONG SizeOfHeader; + ULONG SizeOfEntry; + ULONG64 NumberOfEntries; +} MINIDUMP_MEMORY_INFO_LIST, *PMINIDUMP_MEMORY_INFO_LIST; + + +// +// The memory information stream contains memory region +// description information. This stream corresponds to +// what VirtualQuery would return for the process the +// dump was created for. +// + +// Thread dump writer status flags. +#define MINIDUMP_THREAD_INFO_ERROR_THREAD 0x00000001 +#define MINIDUMP_THREAD_INFO_WRITING_THREAD 0x00000002 +#define MINIDUMP_THREAD_INFO_EXITED_THREAD 0x00000004 +#define MINIDUMP_THREAD_INFO_INVALID_INFO 0x00000008 +#define MINIDUMP_THREAD_INFO_INVALID_CONTEXT 0x00000010 +#define MINIDUMP_THREAD_INFO_INVALID_TEB 0x00000020 + +typedef struct _MINIDUMP_THREAD_INFO +{ + ULONG32 ThreadId; + ULONG32 DumpFlags; + ULONG32 DumpError; + ULONG32 ExitStatus; + ULONG64 CreateTime; + ULONG64 ExitTime; + ULONG64 KernelTime; + ULONG64 UserTime; + ULONG64 StartAddress; + ULONG64 Affinity; +} MINIDUMP_THREAD_INFO, *PMINIDUMP_THREAD_INFO; + +typedef struct _MINIDUMP_THREAD_INFO_LIST +{ + ULONG SizeOfHeader; + ULONG SizeOfEntry; + ULONG NumberOfEntries; +} MINIDUMP_THREAD_INFO_LIST, *PMINIDUMP_THREAD_INFO_LIST; + +// +// Support for token information. +// +typedef struct _MINIDUMP_TOKEN_INFO_HEADER +{ + ULONG TokenSize; // The size of the token structure. + ULONG TokenId; // The PID in NtOpenProcessToken() call or TID in NtOpenThreadToken() call. + ULONG64 TokenHandle; // The handle value returned. +} MINIDUMP_TOKEN_INFO_HEADER, *PMINIDUMP_TOKEN_INFO_HEADER; + +typedef struct _MINIDUMP_TOKEN_INFO_LIST +{ + ULONG TokenListSize; + ULONG TokenListEntries; + ULONG ListHeaderSize; + ULONG ElementHeaderSize; +} MINIDUMP_TOKEN_INFO_LIST, *PMINIDUMP_TOKEN_INFO_LIST; + +// +// Support for arbitrary user-defined information. +// + +typedef struct _MINIDUMP_USER_RECORD +{ + ULONG32 Type; + MINIDUMP_LOCATION_DESCRIPTOR Memory; +} MINIDUMP_USER_RECORD, *PMINIDUMP_USER_RECORD; + + +typedef struct _MINIDUMP_USER_STREAM +{ + ULONG32 Type; + ULONG BufferSize; + PVOID Buffer; + +} MINIDUMP_USER_STREAM, *PMINIDUMP_USER_STREAM; + + +typedef struct _MINIDUMP_USER_STREAM_INFORMATION +{ + ULONG UserStreamCount; + PMINIDUMP_USER_STREAM UserStreamArray; +} MINIDUMP_USER_STREAM_INFORMATION, *PMINIDUMP_USER_STREAM_INFORMATION; + +// +// Callback support. +// + +typedef enum _MINIDUMP_CALLBACK_TYPE +{ + ModuleCallback, + ThreadCallback, + ThreadExCallback, + IncludeThreadCallback, + IncludeModuleCallback, + MemoryCallback, + CancelCallback, + WriteKernelMinidumpCallback, + KernelMinidumpStatusCallback, + RemoveMemoryCallback, + IncludeVmRegionCallback, + IoStartCallback, + IoWriteAllCallback, + IoFinishCallback, + ReadMemoryFailureCallback, + SecondaryFlagsCallback, +} MINIDUMP_CALLBACK_TYPE; + + +typedef struct _MINIDUMP_THREAD_CALLBACK +{ + ULONG ThreadId; + HANDLE ThreadHandle; + CONTEXT Context; + ULONG SizeOfContext; + ULONG64 StackBase; + ULONG64 StackEnd; +} MINIDUMP_THREAD_CALLBACK, *PMINIDUMP_THREAD_CALLBACK; + + +typedef struct _MINIDUMP_THREAD_EX_CALLBACK +{ + ULONG ThreadId; + HANDLE ThreadHandle; + CONTEXT Context; + ULONG SizeOfContext; + ULONG64 StackBase; + ULONG64 StackEnd; + ULONG64 BackingStoreBase; + ULONG64 BackingStoreEnd; +} MINIDUMP_THREAD_EX_CALLBACK, *PMINIDUMP_THREAD_EX_CALLBACK; + + +typedef struct _MINIDUMP_INCLUDE_THREAD_CALLBACK +{ + ULONG ThreadId; +} MINIDUMP_INCLUDE_THREAD_CALLBACK, *PMINIDUMP_INCLUDE_THREAD_CALLBACK; + + +typedef enum _THREAD_WRITE_FLAGS +{ + ThreadWriteThread = 0x0001, + ThreadWriteStack = 0x0002, + ThreadWriteContext = 0x0004, + ThreadWriteBackingStore = 0x0008, + ThreadWriteInstructionWindow = 0x0010, + ThreadWriteThreadData = 0x0020, + ThreadWriteThreadInfo = 0x0040, +} THREAD_WRITE_FLAGS; + +typedef struct _MINIDUMP_MODULE_CALLBACK +{ + PWCHAR FullPath; + ULONG64 BaseOfImage; + ULONG SizeOfImage; + ULONG CheckSum; + ULONG TimeDateStamp; + VS_FIXEDFILEINFO VersionInfo; + PVOID CvRecord; + ULONG SizeOfCvRecord; + PVOID MiscRecord; + ULONG SizeOfMiscRecord; +} MINIDUMP_MODULE_CALLBACK, *PMINIDUMP_MODULE_CALLBACK; + + +typedef struct _MINIDUMP_INCLUDE_MODULE_CALLBACK +{ + ULONG64 BaseOfImage; +} MINIDUMP_INCLUDE_MODULE_CALLBACK, *PMINIDUMP_INCLUDE_MODULE_CALLBACK; + + +typedef enum _MODULE_WRITE_FLAGS +{ + ModuleWriteModule = 0x0001, + ModuleWriteDataSeg = 0x0002, + ModuleWriteMiscRecord = 0x0004, + ModuleWriteCvRecord = 0x0008, + ModuleReferencedByMemory = 0x0010, + ModuleWriteTlsData = 0x0020, + ModuleWriteCodeSegs = 0x0040, +} MODULE_WRITE_FLAGS; + + +typedef struct _MINIDUMP_IO_CALLBACK +{ + HANDLE Handle; + ULONG64 Offset; + PVOID Buffer; + ULONG BufferBytes; +} MINIDUMP_IO_CALLBACK, *PMINIDUMP_IO_CALLBACK; + + +typedef struct _MINIDUMP_READ_MEMORY_FAILURE_CALLBACK +{ + ULONG64 Offset; + ULONG Bytes; + HRESULT FailureStatus; +} MINIDUMP_READ_MEMORY_FAILURE_CALLBACK, +*PMINIDUMP_READ_MEMORY_FAILURE_CALLBACK; + + +typedef struct _MINIDUMP_CALLBACK_INPUT +{ + ULONG ProcessId; + HANDLE ProcessHandle; + ULONG CallbackType; + union + { + HRESULT Status; + MINIDUMP_THREAD_CALLBACK Thread; + MINIDUMP_THREAD_EX_CALLBACK ThreadEx; + MINIDUMP_MODULE_CALLBACK Module; + MINIDUMP_INCLUDE_THREAD_CALLBACK IncludeThread; + MINIDUMP_INCLUDE_MODULE_CALLBACK IncludeModule; + MINIDUMP_IO_CALLBACK Io; + MINIDUMP_READ_MEMORY_FAILURE_CALLBACK ReadMemoryFailure; + ULONG SecondaryFlags; + }; +} MINIDUMP_CALLBACK_INPUT, *PMINIDUMP_CALLBACK_INPUT; + +typedef struct _MINIDUMP_CALLBACK_OUTPUT +{ + union + { + ULONG ModuleWriteFlags; + ULONG ThreadWriteFlags; + ULONG SecondaryFlags; + struct + { + ULONG64 MemoryBase; + ULONG MemorySize; + }; + struct + { + BOOL CheckCancel; + BOOL Cancel; + }; + HANDLE Handle; + struct + { + MINIDUMP_MEMORY_INFO VmRegion; + BOOL Continue; + }; + HRESULT Status; + }; +} MINIDUMP_CALLBACK_OUTPUT, *PMINIDUMP_CALLBACK_OUTPUT; + + +// +// A normal minidump contains just the information +// necessary to capture stack traces for all of the +// existing threads in a process. +// +// A minidump with data segments includes all of the data +// sections from loaded modules in order to capture +// global variable contents. This can make the dump much +// larger if many modules have global data. +// +// A minidump with full memory includes all of the accessible +// memory in the process and can be very large. A minidump +// with full memory always has the raw memory data at the end +// of the dump so that the initial structures in the dump can +// be mapped directly without having to include the raw +// memory information. +// +// Stack and backing store memory can be filtered to remove +// data unnecessary for stack walking. This can improve +// compression of stacks and also deletes data that may +// be private and should not be stored in a dump. +// Memory can also be scanned to see what modules are +// referenced by stack and backing store memory to allow +// omission of other modules to reduce dump size. +// In either of these modes the ModuleReferencedByMemory flag +// is set for all modules referenced before the base +// module callbacks occur. +// +// On some operating systems a list of modules that were +// recently unloaded is kept in addition to the currently +// loaded module list. This information can be saved in +// the dump if desired. +// +// Stack and backing store memory can be scanned for referenced +// pages in order to pick up data referenced by locals or other +// stack memory. This can increase the size of a dump significantly. +// +// Module paths may contain undesired information such as user names +// or other important directory names so they can be stripped. This +// option reduces the ability to locate the proper image later +// and should only be used in certain situations. +// +// Complete operating system per-process and per-thread information can +// be gathered and stored in the dump. +// +// The virtual address space can be scanned for various types +// of memory to be included in the dump. +// +// Code which is concerned with potentially private information +// getting into the minidump can set a flag that automatically +// modifies all existing and future flags to avoid placing +// unnecessary data in the dump. Basic data, such as stack +// information, will still be included but optional data, such +// as indirect memory, will not. +// +// When doing a full memory dump it's possible to store all +// of the enumerated memory region descriptive information +// in a memory information stream. +// +// Additional thread information beyond the basic thread +// structure can be collected if desired. +// +// A minidump with code segments includes all of the code +// and code-related sections from loaded modules in order +// to capture executable content. +// +// MiniDumpWithoutAuxiliaryState turns off any secondary, +// auxiliary-supported memory gathering. +// +// MiniDumpWithFullAuxiliaryState asks any present auxiliary +// data providers to include all of their state in the dump. +// The exact set of what is provided depends on the auxiliary. +// This can be quite large. +// + +typedef enum _MINIDUMP_TYPE +{ + MiniDumpNormal = 0x00000000, + MiniDumpWithDataSegs = 0x00000001, + MiniDumpWithFullMemory = 0x00000002, + MiniDumpWithHandleData = 0x00000004, + MiniDumpFilterMemory = 0x00000008, + MiniDumpScanMemory = 0x00000010, + MiniDumpWithUnloadedModules = 0x00000020, + MiniDumpWithIndirectlyReferencedMemory = 0x00000040, + MiniDumpFilterModulePaths = 0x00000080, + MiniDumpWithProcessThreadData = 0x00000100, + MiniDumpWithPrivateReadWriteMemory = 0x00000200, + MiniDumpWithoutOptionalData = 0x00000400, + MiniDumpWithFullMemoryInfo = 0x00000800, + MiniDumpWithThreadInfo = 0x00001000, + MiniDumpWithCodeSegs = 0x00002000, + MiniDumpWithoutAuxiliaryState = 0x00004000, + MiniDumpWithFullAuxiliaryState = 0x00008000, + MiniDumpWithPrivateWriteCopyMemory = 0x00010000, + MiniDumpIgnoreInaccessibleMemory = 0x00020000, + MiniDumpWithTokenInformation = 0x00040000, + MiniDumpValidTypeFlags = 0x0007ffff, +} MINIDUMP_TYPE; + +// +// In addition to the primary flags provided to +// MiniDumpWriteDump there are additional, less +// frequently used options queried via the secondary +// flags callback. +// +// MiniSecondaryWithoutPowerInfo suppresses the minidump +// query that retrieves processor power information for +// MINIDUMP_MISC_INFO. +// + +typedef enum _MINIDUMP_SECONDARY_FLAGS +{ + MiniSecondaryWithoutPowerInfo = 0x00000001, + + MiniSecondaryValidFlags = 0x00000001, +} MINIDUMP_SECONDARY_FLAGS; + + +// +// The minidump callback should modify the FieldsToWrite parameter to reflect +// what portions of the specified thread or module should be written to the +// file. +// + +typedef +BOOL +(WINAPI* MINIDUMP_CALLBACK_ROUTINE)( + __inout PVOID CallbackParam, + __in PMINIDUMP_CALLBACK_INPUT CallbackInput, + __inout PMINIDUMP_CALLBACK_OUTPUT CallbackOutput +); + +typedef struct _MINIDUMP_CALLBACK_INFORMATION +{ + MINIDUMP_CALLBACK_ROUTINE CallbackRoutine; + PVOID CallbackParam; +} MINIDUMP_CALLBACK_INFORMATION, *PMINIDUMP_CALLBACK_INFORMATION; + + + +//++ +// +// PVOID +// RVA_TO_ADDR( +// PVOID Mapping, +// ULONG Rva +// ) +// +// Routine Description: +// +// Map an RVA that is contained within a mapped file to it's associated +// flat address. +// +// Arguments: +// +// Mapping - Base address of mapped file containing the RVA. +// +// Rva - An Rva to fixup. +// +// Return Values: +// +// A pointer to the desired data. +// +//-- + +#define RVA_TO_ADDR(Mapping,Rva) ((PVOID)(((ULONG_PTR) (Mapping)) + (Rva))) + +BOOL +WINAPI +MiniDumpWriteDump( + __in HANDLE hProcess, + __in DWORD ProcessId, + __in HANDLE hFile, + __in MINIDUMP_TYPE DumpType, + __in_opt PMINIDUMP_EXCEPTION_INFORMATION ExceptionParam, + __in_opt PMINIDUMP_USER_STREAM_INFORMATION UserStreamParam, + __in_opt PMINIDUMP_CALLBACK_INFORMATION CallbackParam +); + +BOOL +WINAPI +MiniDumpReadDumpStream( + __in PVOID BaseOfDump, + __in ULONG StreamNumber, + __deref_out_opt PMINIDUMP_DIRECTORY* Dir, + __deref_out_opt PVOID* StreamPointer, + __out_opt ULONG* StreamSize +); + +#pragma pack(pop) + +#ifdef __cplusplus +} +#endif + + +#endif // _DBGHELP_ + + +``` + +`AutoAttach/pluginsdk/jansson/jansson.h`: + +```h +/* + * Copyright (c) 2009-2016 Petri Lehtinen + * + * Jansson is free software; you can redistribute it and/or modify + * it under the terms of the MIT license. See LICENSE for details. + */ + +#ifndef JANSSON_H +#define JANSSON_H + +#include +#include /* for size_t */ +#include + +#include "jansson_config.h" + +#ifdef __cplusplus +extern "C" { +#endif + +/* version */ + +#define JANSSON_MAJOR_VERSION 2 +#define JANSSON_MINOR_VERSION 9 +#define JANSSON_MICRO_VERSION 0 + +/* Micro version is omitted if it's 0 */ +#define JANSSON_VERSION "2.9" + +/* Version as a 3-byte hex number, e.g. 0x010201 == 1.2.1. Use this + for numeric comparisons, e.g. #if JANSSON_VERSION_HEX >= ... */ +#define JANSSON_VERSION_HEX ((JANSSON_MAJOR_VERSION << 16) | \ + (JANSSON_MINOR_VERSION << 8) | \ + (JANSSON_MICRO_VERSION << 0)) + + +/* types */ + +typedef enum +{ + JSON_OBJECT, + JSON_ARRAY, + JSON_STRING, + JSON_INTEGER, + JSON_REAL, + JSON_TRUE, + JSON_FALSE, + JSON_NULL +} json_type; + +typedef struct json_t +{ + json_type type; + size_t refcount; +} json_t; + +#ifndef JANSSON_USING_CMAKE /* disabled if using cmake */ +#if JSON_INTEGER_IS_LONG_LONG +#ifdef _WIN32 +#define JSON_INTEGER_FORMAT "I64d" +#else +#define JSON_INTEGER_FORMAT "lld" +#endif +typedef long long json_int_t; +#else +#define JSON_INTEGER_FORMAT "ld" +typedef long json_int_t; +#endif /* JSON_INTEGER_IS_LONG_LONG */ +#endif + +#define json_typeof(json) ((json)->type) +#define json_is_object(json) ((json) && json_typeof(json) == JSON_OBJECT) +#define json_is_array(json) ((json) && json_typeof(json) == JSON_ARRAY) +#define json_is_string(json) ((json) && json_typeof(json) == JSON_STRING) +#define json_is_integer(json) ((json) && json_typeof(json) == JSON_INTEGER) +#define json_is_real(json) ((json) && json_typeof(json) == JSON_REAL) +#define json_is_number(json) (json_is_integer(json) || json_is_real(json)) +#define json_is_true(json) ((json) && json_typeof(json) == JSON_TRUE) +#define json_is_false(json) ((json) && json_typeof(json) == JSON_FALSE) +#define json_boolean_value json_is_true +#define json_is_boolean(json) (json_is_true(json) || json_is_false(json)) +#define json_is_null(json) ((json) && json_typeof(json) == JSON_NULL) + +/* construction, destruction, reference counting */ + +__declspec(dllimport) json_t* json_object(void); +__declspec(dllimport) json_t* json_array(void); +__declspec(dllimport) json_t* json_string(const char* value); +__declspec(dllimport) json_t* json_stringn(const char* value, size_t len); +__declspec(dllimport) json_t* json_string_nocheck(const char* value); +__declspec(dllimport) json_t* json_stringn_nocheck(const char* value, size_t len); +__declspec(dllimport) json_t* json_integer(json_int_t value); +__declspec(dllimport) json_t* json_real(double value); +__declspec(dllimport) json_t* json_true(void); +__declspec(dllimport) json_t* json_false(void); +#define json_boolean(val) ((val) ? json_true() : json_false()) +__declspec(dllimport) json_t* json_null(void); + +static JSON_INLINE +json_t* json_incref(json_t* json) +{ + if(json && json->refcount != (size_t) - 1) + ++json->refcount; + return json; +} + +/* do not call json_delete directly */ +__declspec(dllimport) void json_delete(json_t* json); + +static JSON_INLINE +void json_decref(json_t* json) +{ + if(json && json->refcount != (size_t) - 1 && --json->refcount == 0) + json_delete(json); +} + +#if defined(__GNUC__) || defined(__clang__) +static JSON_INLINE +void json_decrefp(json_t** json) +{ + if(json) + { + json_decref(*json); + *json = NULL; + } +} + +#define json_auto_t json_t __attribute__((cleanup(json_decrefp))) +#endif + + +/* error reporting */ + +#define JSON_ERROR_TEXT_LENGTH 160 +#define JSON_ERROR_SOURCE_LENGTH 80 + +typedef struct +{ + int line; + int column; + int position; + char source[JSON_ERROR_SOURCE_LENGTH]; + char text[JSON_ERROR_TEXT_LENGTH]; +} json_error_t; + + +/* getters, setters, manipulation */ + +__declspec(dllimport) void json_object_seed(size_t seed); +__declspec(dllimport) size_t json_object_size(const json_t* object); +__declspec(dllimport) json_t* json_object_get(const json_t* object, const char* key); +__declspec(dllimport) int json_object_set_new(json_t* object, const char* key, json_t* value); +__declspec(dllimport) int json_object_set_new_nocheck(json_t* object, const char* key, json_t* value); +__declspec(dllimport) int json_object_del(json_t* object, const char* key); +__declspec(dllimport) int json_object_clear(json_t* object); +__declspec(dllimport) int json_object_update(json_t* object, json_t* other); +__declspec(dllimport) int json_object_update_existing(json_t* object, json_t* other); +__declspec(dllimport) int json_object_update_missing(json_t* object, json_t* other); +__declspec(dllimport) void* json_object_iter(json_t* object); +__declspec(dllimport) void* json_object_iter_at(json_t* object, const char* key); +__declspec(dllimport) void* json_object_key_to_iter(const char* key); +__declspec(dllimport) void* json_object_iter_next(json_t* object, void* iter); +__declspec(dllimport) const char* json_object_iter_key(void* iter); +__declspec(dllimport) json_t* json_object_iter_value(void* iter); +__declspec(dllimport) int json_object_iter_set_new(json_t* object, void* iter, json_t* value); + +#define json_object_foreach(object, key, value) \ + for(key = json_object_iter_key(json_object_iter(object)); \ + key && (value = json_object_iter_value(json_object_key_to_iter(key))); \ + key = json_object_iter_key(json_object_iter_next(object, json_object_key_to_iter(key)))) + +#define json_object_foreach_safe(object, n, key, value) \ + for(key = json_object_iter_key(json_object_iter(object)), \ + n = json_object_iter_next(object, json_object_key_to_iter(key)); \ + key && (value = json_object_iter_value(json_object_key_to_iter(key))); \ + key = json_object_iter_key(n), \ + n = json_object_iter_next(object, json_object_key_to_iter(key))) + +#define json_array_foreach(array, index, value) \ + for(index = 0; \ + index < json_array_size(array) && (value = json_array_get(array, index)); \ + index++) + +static JSON_INLINE +int json_object_set(json_t* object, const char* key, json_t* value) +{ + return json_object_set_new(object, key, json_incref(value)); +} + +static JSON_INLINE +int json_object_set_nocheck(json_t* object, const char* key, json_t* value) +{ + return json_object_set_new_nocheck(object, key, json_incref(value)); +} + +static JSON_INLINE +int json_object_iter_set(json_t* object, void* iter, json_t* value) +{ + return json_object_iter_set_new(object, iter, json_incref(value)); +} + +__declspec(dllimport) size_t json_array_size(const json_t* array); +__declspec(dllimport) json_t* json_array_get(const json_t* array, size_t index); +__declspec(dllimport) int json_array_set_new(json_t* array, size_t index, json_t* value); +__declspec(dllimport) int json_array_append_new(json_t* array, json_t* value); +__declspec(dllimport) int json_array_insert_new(json_t* array, size_t index, json_t* value); +__declspec(dllimport) int json_array_remove(json_t* array, size_t index); +__declspec(dllimport) int json_array_clear(json_t* array); +__declspec(dllimport) int json_array_extend(json_t* array, json_t* other); + +static JSON_INLINE +int json_array_set(json_t* array, size_t ind, json_t* value) +{ + return json_array_set_new(array, ind, json_incref(value)); +} + +static JSON_INLINE +int json_array_append(json_t* array, json_t* value) +{ + return json_array_append_new(array, json_incref(value)); +} + +static JSON_INLINE +int json_array_insert(json_t* array, size_t ind, json_t* value) +{ + return json_array_insert_new(array, ind, json_incref(value)); +} + +__declspec(dllimport) const char* json_string_value(const json_t* string); +__declspec(dllimport) size_t json_string_length(const json_t* string); +__declspec(dllimport) json_int_t json_integer_value(const json_t* integer); +__declspec(dllimport) double json_real_value(const json_t* real); +__declspec(dllimport) double json_number_value(const json_t* json); + +__declspec(dllimport) int json_string_set(json_t* string, const char* value); +__declspec(dllimport) int json_string_setn(json_t* string, const char* value, size_t len); +__declspec(dllimport) int json_string_set_nocheck(json_t* string, const char* value); +__declspec(dllimport) int json_string_setn_nocheck(json_t* string, const char* value, size_t len); +__declspec(dllimport) int json_integer_set(json_t* integer, json_int_t value); +__declspec(dllimport) int json_real_set(json_t* real, double value); + +/* pack, unpack */ + +__declspec(dllimport) json_t* json_pack(const char* fmt, ...); +__declspec(dllimport) json_t* json_pack_ex(json_error_t* error, size_t flags, const char* fmt, ...); +__declspec(dllimport) json_t* json_vpack_ex(json_error_t* error, size_t flags, const char* fmt, va_list ap); + +#define JSON_VALIDATE_ONLY 0x1 +#define JSON_STRICT 0x2 + +__declspec(dllimport) int json_unpack(json_t* root, const char* fmt, ...); +__declspec(dllimport) int json_unpack_ex(json_t* root, json_error_t* error, size_t flags, const char* fmt, ...); +__declspec(dllimport) int json_vunpack_ex(json_t* root, json_error_t* error, size_t flags, const char* fmt, va_list ap); + + +/* equality */ + +__declspec(dllimport) int json_equal(json_t* value1, json_t* value2); + + +/* copying */ + +__declspec(dllimport) json_t* json_copy(json_t* value); +__declspec(dllimport) json_t* json_deep_copy(const json_t* value); + + +/* decoding */ + +#define JSON_REJECT_DUPLICATES 0x1 +#define JSON_DISABLE_EOF_CHECK 0x2 +#define JSON_DECODE_ANY 0x4 +#define JSON_DECODE_INT_AS_REAL 0x8 +#define JSON_ALLOW_NUL 0x10 + +typedef size_t (*json_load_callback_t)(void* buffer, size_t buflen, void* data); + +__declspec(dllimport) json_t* json_loads(const char* input, size_t flags, json_error_t* error); +__declspec(dllimport) json_t* json_loadb(const char* buffer, size_t buflen, size_t flags, json_error_t* error); +__declspec(dllimport) json_t* json_loadf(FILE* input, size_t flags, json_error_t* error); +__declspec(dllimport) json_t* json_load_file(const char* path, size_t flags, json_error_t* error); +__declspec(dllimport) json_t* json_load_callback(json_load_callback_t callback, void* data, size_t flags, json_error_t* error); + + +/* encoding */ + +#define JSON_MAX_INDENT 0x1F +#define JSON_INDENT(n) ((n) & JSON_MAX_INDENT) +#define JSON_COMPACT 0x20 +#define JSON_ENSURE_ASCII 0x40 +#define JSON_SORT_KEYS 0x80 +#define JSON_PRESERVE_ORDER 0x100 +#define JSON_ENCODE_ANY 0x200 +#define JSON_ESCAPE_SLASH 0x400 +#define JSON_REAL_PRECISION(n) (((n) & 0x1F) << 11) + +typedef int (*json_dump_callback_t)(const char* buffer, size_t size, void* data); + +__declspec(dllimport) char* json_dumps(const json_t* json, size_t flags); +__declspec(dllimport) int json_dumpf(const json_t* json, FILE* output, size_t flags); +__declspec(dllimport) int json_dump_file(const json_t* json, const char* path, size_t flags); +__declspec(dllimport) int json_dump_callback(const json_t* json, json_dump_callback_t callback, void* data, size_t flags); + +/* custom memory allocation */ + +typedef void* (*json_malloc_t)(size_t); +typedef void (*json_free_t)(void*); + +__declspec(dllimport) void json_set_alloc_funcs(json_malloc_t malloc_fn, json_free_t free_fn); +__declspec(dllimport) void json_get_alloc_funcs(json_malloc_t* malloc_fn, json_free_t* free_fn); + +#ifdef __cplusplus +} +#endif + +#endif + +``` + +`AutoAttach/pluginsdk/jansson/jansson_config.h`: + +```h +/* + * Copyright (c) 2010-2016 Petri Lehtinen + * + * Jansson is free software; you can redistribute it and/or modify + * it under the terms of the MIT license. See LICENSE for details. + * + * + * This file specifies a part of the site-specific configuration for + * Jansson, namely those things that affect the public API in + * jansson.h. + * + * The CMake system will generate the jansson_config.h file and + * copy it to the build and install directories. + */ + +#ifndef JANSSON_CONFIG_H +#define JANSSON_CONFIG_H + +/* Define this so that we can disable scattered automake configuration in source files */ +#ifndef JANSSON_USING_CMAKE +#define JANSSON_USING_CMAKE +#endif + +/* Note: when using cmake, JSON_INTEGER_IS_LONG_LONG is not defined nor used, + * as we will also check for __int64 etc types. + * (the definition was used in the automake system) */ + +/* Bring in the cmake-detected defines */ +#define HAVE_STDINT_H 1 +/* #undef HAVE_INTTYPES_H */ +/* #undef HAVE_SYS_TYPES_H */ + +/* Include our standard type header for the integer typedef */ + +#if defined(HAVE_STDINT_H) +# include +#elif defined(HAVE_INTTYPES_H) +# include +#elif defined(HAVE_SYS_TYPES_H) +# include +#endif + + +/* If your compiler supports the inline keyword in C, JSON_INLINE is + defined to `inline', otherwise empty. In C++, the inline is always + supported. */ +#ifdef __cplusplus +#define JSON_INLINE inline +#else +#define JSON_INLINE __inline +#endif + + +#define json_int_t long long +#define json_strtoint strtoll +#define JSON_INTEGER_FORMAT "I64d" + + +/* If locale.h and localeconv() are available, define to 1, otherwise to 0. */ +#define JSON_HAVE_LOCALECONV 1 + + +/* Maximum recursion depth for parsing JSON input. + This limits the depth of e.g. array-within-array constructions. */ +#define JSON_PARSER_MAX_DEPTH 2048 + + +#endif + +``` + +`AutoAttach/pluginsdk/jansson/jansson_x64dbg.h`: + +```h +#pragma once + +#include "jansson.h" + +typedef json_t* JSON; + +static JSON_INLINE +json_t* json_hex(unsigned json_int_t value) +{ + char hexvalue[20]; + sprintf_s(hexvalue, "0x%llX", value); + return json_string(hexvalue); +} + +static JSON_INLINE +unsigned json_int_t json_hex_value(const json_t* hex) +{ + unsigned json_int_t ret = 0; + const char* hexvalue; + hexvalue = json_string_value(hex); + if(!hexvalue) + return 0; + sscanf_s(hexvalue, "0x%llX", &ret); + return ret; +} + +``` + +`AutoAttach/pluginsdk/lz4/lz4.h`: + +```h +/* + LZ4 - Fast LZ compression algorithm + Header File + Copyright (C) 2011-2014, Yann Collet. + BSD 2-Clause License (http://www.opensource.org/licenses/bsd-license.php) + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are + met: + + * Redistributions of source code must retain the above copyright + notice, this list of conditions and the following disclaimer. + * Redistributions in binary form must reproduce the above + copyright notice, this list of conditions and the following disclaimer + in the documentation and/or other materials provided with the + distribution. + + THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT + OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT + LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, + DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY + THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT + (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE + OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + + You can contact the author at : + - LZ4 homepage : http://fastcompression.blogspot.com/p/lz4.html + - LZ4 source repository : http://code.google.com/p/lz4/ +*/ +#ifndef _LZ4_H +#define _LZ4_H + +#if defined (__cplusplus) +extern "C" +{ +#endif + + +/************************************** + Version +**************************************/ +#define LZ4_VERSION_MAJOR 1 /* for major interface/format changes */ +#define LZ4_VERSION_MINOR 1 /* for minor interface/format changes */ +#define LZ4_VERSION_RELEASE 3 /* for tweaks, bug-fixes, or development */ + + +/************************************** + Compiler Options +**************************************/ +#if (defined(__GNUC__) && defined(__STRICT_ANSI__)) || (defined(_MSC_VER) && !defined(__cplusplus)) /* Visual Studio */ +# define inline __inline /* Visual C is not C99, but supports some kind of inline */ +#endif + + +/************************************** + Simple Functions +**************************************/ + +__declspec(dllimport) int LZ4_compress(const char* source, char* dest, int inputSize); +__declspec(dllimport) int LZ4_decompress_safe(const char* source, char* dest, int inputSize, int maxOutputSize); + +/* +LZ4_compress() : + Compresses 'inputSize' bytes from 'source' into 'dest'. + Destination buffer must be already allocated, + and must be sized to handle worst cases situations (input data not compressible) + Worst case size evaluation is provided by function LZ4_compressBound() + inputSize : Max supported value is LZ4_MAX_INPUT_VALUE + return : the number of bytes written in buffer dest + or 0 if the compression fails + +LZ4_decompress_safe() : + maxOutputSize : is the size of the destination buffer (which must be already allocated) + return : the number of bytes decoded in the destination buffer (necessarily <= maxOutputSize) + If the source stream is detected malformed, the function will stop decoding and return a negative result. + This function is protected against buffer overflow exploits (never writes outside of output buffer, and never reads outside of input buffer). Therefore, it is protected against malicious data packets +*/ + + +/************************************** + Advanced Functions +**************************************/ +#define LZ4_MAX_INPUT_SIZE 0x7E000000 /* 2 113 929 216 bytes */ +#define LZ4_COMPRESSBOUND(isize) ((unsigned int)(isize) > (unsigned int)LZ4_MAX_INPUT_SIZE ? 0 : (isize) + ((isize)/255) + 16) + +/* +LZ4_compressBound() : + Provides the maximum size that LZ4 may output in a "worst case" scenario (input data not compressible) + primarily useful for memory allocation of output buffer. + inline function is recommended for the general case, + macro is also provided when result needs to be evaluated at compilation (such as stack memory allocation). + + isize : is the input size. Max supported value is LZ4_MAX_INPUT_SIZE + return : maximum output size in a "worst case" scenario + or 0, if input size is too large ( > LZ4_MAX_INPUT_SIZE) +*/ +__declspec(dllimport) int LZ4_compressBound(int isize); + + +/* +LZ4_compress_limitedOutput() : + Compress 'inputSize' bytes from 'source' into an output buffer 'dest' of maximum size 'maxOutputSize'. + If it cannot achieve it, compression will stop, and result of the function will be zero. + This function never writes outside of provided output buffer. + + inputSize : Max supported value is LZ4_MAX_INPUT_VALUE + maxOutputSize : is the size of the destination buffer (which must be already allocated) + return : the number of bytes written in buffer 'dest' + or 0 if the compression fails +*/ +__declspec(dllimport) int LZ4_compress_limitedOutput(const char* source, char* dest, int inputSize, int maxOutputSize); + + +/* +LZ4_decompress_fast() : + originalSize : is the original and therefore uncompressed size + return : the number of bytes read from the source buffer (in other words, the compressed size) + If the source stream is malformed, the function will stop decoding and return a negative result. + note : This function is a bit faster than LZ4_decompress_safe() + This function never writes outside of output buffers, but may read beyond input buffer in case of malicious data packet. + Use this function preferably into a trusted environment (data to decode comes from a trusted source). + Destination buffer must be already allocated. Its size must be a minimum of 'outputSize' bytes. +*/ +__declspec(dllimport) int LZ4_decompress_fast(const char* source, char* dest, int originalSize); + + +/* +LZ4_decompress_safe_partial() : + This function decompress a compressed block of size 'inputSize' at position 'source' + into output buffer 'dest' of size 'maxOutputSize'. + The function tries to stop decompressing operation as soon as 'targetOutputSize' has been reached, + reducing decompression time. + return : the number of bytes decoded in the destination buffer (necessarily <= maxOutputSize) + Note : this number can be < 'targetOutputSize' should the compressed block to decode be smaller. + Always control how many bytes were decoded. + If the source stream is detected malformed, the function will stop decoding and return a negative result. + This function never writes outside of output buffer, and never reads outside of input buffer. It is therefore protected against malicious data packets +*/ +__declspec(dllimport) int LZ4_decompress_safe_partial(const char* source, char* dest, int inputSize, int targetOutputSize, int maxOutputSize); + + +/* +These functions are provided should you prefer to allocate memory for compression tables with your own allocation methods. +To know how much memory must be allocated for the compression tables, use : +int LZ4_sizeofState(); + +Note that tables must be aligned on 4-bytes boundaries, otherwise compression will fail (return code 0). + +The allocated memory can be provided to the compressions functions using 'void* state' parameter. +LZ4_compress_withState() and LZ4_compress_limitedOutput_withState() are equivalent to previously described functions. +They just use the externally allocated memory area instead of allocating their own (on stack, or on heap). +*/ +__declspec(dllimport) int LZ4_sizeofState(void); +__declspec(dllimport) int LZ4_compress_withState(void* state, const char* source, char* dest, int inputSize); +__declspec(dllimport) int LZ4_compress_limitedOutput_withState(void* state, const char* source, char* dest, int inputSize, int maxOutputSize); + + +/************************************** + Streaming Functions +**************************************/ +__declspec(dllimport) void* LZ4_create(const char* inputBuffer); +__declspec(dllimport) int LZ4_compress_continue(void* LZ4_Data, const char* source, char* dest, int inputSize); +__declspec(dllimport) int LZ4_compress_limitedOutput_continue(void* LZ4_Data, const char* source, char* dest, int inputSize, int maxOutputSize); +__declspec(dllimport) char* LZ4_slideInputBuffer(void* LZ4_Data); +__declspec(dllimport) int LZ4_free(void* LZ4_Data); + +/* +These functions allow the compression of dependent blocks, where each block benefits from prior 64 KB within preceding blocks. +In order to achieve this, it is necessary to start creating the LZ4 Data Structure, thanks to the function : + +void* LZ4_create (const char* inputBuffer); +The result of the function is the (void*) pointer on the LZ4 Data Structure. +This pointer will be needed in all other functions. +If the pointer returned is NULL, then the allocation has failed, and compression must be aborted. +The only parameter 'const char* inputBuffer' must, obviously, point at the beginning of input buffer. +The input buffer must be already allocated, and size at least 192KB. +'inputBuffer' will also be the 'const char* source' of the first block. + +All blocks are expected to lay next to each other within the input buffer, starting from 'inputBuffer'. +To compress each block, use either LZ4_compress_continue() or LZ4_compress_limitedOutput_continue(). +Their behavior are identical to LZ4_compress() or LZ4_compress_limitedOutput(), +but require the LZ4 Data Structure as their first argument, and check that each block starts right after the previous one. +If next block does not begin immediately after the previous one, the compression will fail (return 0). + +When it's no longer possible to lay the next block after the previous one (not enough space left into input buffer), a call to : +char* LZ4_slideInputBuffer(void* LZ4_Data); +must be performed. It will typically copy the latest 64KB of input at the beginning of input buffer. +Note that, for this function to work properly, minimum size of an input buffer must be 192KB. +==> The memory position where the next input data block must start is provided as the result of the function. + +Compression can then resume, using LZ4_compress_continue() or LZ4_compress_limitedOutput_continue(), as usual. + +When compression is completed, a call to LZ4_free() will release the memory used by the LZ4 Data Structure. +*/ + + +__declspec(dllimport) int LZ4_sizeofStreamState(void); +__declspec(dllimport) int LZ4_resetStreamState(void* state, const char* inputBuffer); + +/* +These functions achieve the same result as : +void* LZ4_create (const char* inputBuffer); + +They are provided here to allow the user program to allocate memory using its own routines. + +To know how much space must be allocated, use LZ4_sizeofStreamState(); +Note also that space must be 4-bytes aligned. + +Once space is allocated, you must initialize it using : LZ4_resetStreamState(void* state, const char* inputBuffer); +void* state is a pointer to the space allocated. +It must be aligned on 4-bytes boundaries, and be large enough. +The parameter 'const char* inputBuffer' must, obviously, point at the beginning of input buffer. +The input buffer must be already allocated, and size at least 192KB. +'inputBuffer' will also be the 'const char* source' of the first block. + +The same space can be re-used multiple times, just by initializing it each time with LZ4_resetStreamState(). +return value of LZ4_resetStreamState() must be 0 is OK. +Any other value means there was an error (typically, pointer is not aligned on 4-bytes boundaries). +*/ + + +__declspec(dllimport) int LZ4_decompress_safe_withPrefix64k(const char* source, char* dest, int inputSize, int maxOutputSize); +__declspec(dllimport) int LZ4_decompress_fast_withPrefix64k(const char* source, char* dest, int outputSize); + +/* +*_withPrefix64k() : + These decoding functions work the same as their "normal name" versions, + but can use up to 64KB of data in front of 'char* dest'. + These functions are necessary to decode inter-dependant blocks. +*/ + + +/************************************** + Obsolete Functions +**************************************/ +/* +These functions are deprecated and should no longer be used. +They are provided here for compatibility with existing user programs. +*/ +__declspec(dllimport) int LZ4_uncompress(const char* source, char* dest, int outputSize); +__declspec(dllimport) int LZ4_uncompress_unknownOutputSize(const char* source, char* dest, int isize, int maxOutputSize); + + +#if defined (__cplusplus) +} +#endif + +#endif //_LZ4_H +``` + +`AutoAttach/pluginsdk/lz4/lz4file.h`: + +```h +#ifndef _LZ4FILE_H +#define _LZ4FILE_H + +typedef enum _LZ4_STATUS +{ + LZ4_SUCCESS, + LZ4_FAILED_OPEN_INPUT, + LZ4_FAILED_OPEN_OUTPUT, + LZ4_NOT_ENOUGH_MEMORY, + LZ4_INVALID_ARCHIVE, + LZ4_CORRUPTED_ARCHIVE +} LZ4_STATUS; + +#if defined (__cplusplus) +extern "C" +{ +#endif + +__declspec(dllimport) LZ4_STATUS LZ4_compress_file(const char* input_filename, const char* output_filename); +__declspec(dllimport) LZ4_STATUS LZ4_compress_fileW(const wchar_t* input_filename, const wchar_t* output_filename); +__declspec(dllimport) LZ4_STATUS LZ4_decompress_file(const char* input_filename, const char* output_filename); +__declspec(dllimport) LZ4_STATUS LZ4_decompress_fileW(const wchar_t* input_filename, const wchar_t* output_filename); + +#if defined (__cplusplus) +} +#endif + +#endif //_LZ4FILE_H +``` + +`AutoAttach/pluginsdk/lz4/lz4hc.h`: + +```h +/* + LZ4 HC - High Compression Mode of LZ4 + Header File + Copyright (C) 2011-2014, Yann Collet. + BSD 2-Clause License (http://www.opensource.org/licenses/bsd-license.php) + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are + met: + + * Redistributions of source code must retain the above copyright + notice, this list of conditions and the following disclaimer. + * Redistributions in binary form must reproduce the above + copyright notice, this list of conditions and the following disclaimer + in the documentation and/or other materials provided with the + distribution. + + THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT + OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT + LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, + DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY + THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT + (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE + OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + + You can contact the author at : + - LZ4 homepage : http://fastcompression.blogspot.com/p/lz4.html + - LZ4 source repository : http://code.google.com/p/lz4/ +*/ +#ifndef _LZ4HC_H +#define _LZ4HC_H + +#if defined (__cplusplus) +extern "C" +{ +#endif + + +__declspec(dllimport) int LZ4_compressHC(const char* source, char* dest, int inputSize); +/* +LZ4_compressHC : + return : the number of bytes in compressed buffer dest + or 0 if compression fails. + note : destination buffer must be already allocated. + To avoid any problem, size it to handle worst cases situations (input data not compressible) + Worst case size evaluation is provided by function LZ4_compressBound() (see "lz4.h") +*/ + +__declspec(dllimport) int LZ4_compressHC_limitedOutput(const char* source, char* dest, int inputSize, int maxOutputSize); +/* +LZ4_compress_limitedOutput() : + Compress 'inputSize' bytes from 'source' into an output buffer 'dest' of maximum size 'maxOutputSize'. + If it cannot achieve it, compression will stop, and result of the function will be zero. + This function never writes outside of provided output buffer. + + inputSize : Max supported value is 1 GB + maxOutputSize : is maximum allowed size into the destination buffer (which must be already allocated) + return : the number of output bytes written in buffer 'dest' + or 0 if compression fails. +*/ + + +__declspec(dllimport) int LZ4_compressHC2(const char* source, char* dest, int inputSize, int compressionLevel); +__declspec(dllimport) int LZ4_compressHC2_limitedOutput(const char* source, char* dest, int inputSize, int maxOutputSize, int compressionLevel); +/* + Same functions as above, but with programmable 'compressionLevel'. + Recommended values are between 4 and 9, although any value between 0 and 16 will work. + 'compressionLevel'==0 means use default 'compressionLevel' value. + Values above 16 behave the same as 16. + Equivalent variants exist for all other compression functions below. +*/ + +/* Note : +Decompression functions are provided within LZ4 source code (see "lz4.h") (BSD license) +*/ + + +/************************************** + Using an external allocation +**************************************/ +__declspec(dllimport) int LZ4_sizeofStateHC(void); +__declspec(dllimport) int LZ4_compressHC_withStateHC(void* state, const char* source, char* dest, int inputSize); +__declspec(dllimport) int LZ4_compressHC_limitedOutput_withStateHC(void* state, const char* source, char* dest, int inputSize, int maxOutputSize); + +__declspec(dllimport) int LZ4_compressHC2_withStateHC(void* state, const char* source, char* dest, int inputSize, int compressionLevel); +__declspec(dllimport) int LZ4_compressHC2_limitedOutput_withStateHC(void* state, const char* source, char* dest, int inputSize, int maxOutputSize, int compressionLevel); + +/* +These functions are provided should you prefer to allocate memory for compression tables with your own allocation methods. +To know how much memory must be allocated for the compression tables, use : +int LZ4_sizeofStateHC(); + +Note that tables must be aligned for pointer (32 or 64 bits), otherwise compression will fail (return code 0). + +The allocated memory can be provided to the compressions functions using 'void* state' parameter. +LZ4_compress_withStateHC() and LZ4_compress_limitedOutput_withStateHC() are equivalent to previously described functions. +They just use the externally allocated memory area instead of allocating their own (on stack, or on heap). +*/ + + +/************************************** + Streaming Functions +**************************************/ +__declspec(dllimport) void* LZ4_createHC(const char* inputBuffer); +__declspec(dllimport) int LZ4_compressHC_continue(void* LZ4HC_Data, const char* source, char* dest, int inputSize); +__declspec(dllimport) int LZ4_compressHC_limitedOutput_continue(void* LZ4HC_Data, const char* source, char* dest, int inputSize, int maxOutputSize); +__declspec(dllimport) char* LZ4_slideInputBufferHC(void* LZ4HC_Data); +__declspec(dllimport) int LZ4_freeHC(void* LZ4HC_Data); + +__declspec(dllimport) int LZ4_compressHC2_continue(void* LZ4HC_Data, const char* source, char* dest, int inputSize, int compressionLevel); +__declspec(dllimport) int LZ4_compressHC2_limitedOutput_continue(void* LZ4HC_Data, const char* source, char* dest, int inputSize, int maxOutputSize, int compressionLevel); + +/* +These functions allow the compression of dependent blocks, where each block benefits from prior 64 KB within preceding blocks. +In order to achieve this, it is necessary to start creating the LZ4HC Data Structure, thanks to the function : + +void* LZ4_createHC (const char* inputBuffer); +The result of the function is the (void*) pointer on the LZ4HC Data Structure. +This pointer will be needed in all other functions. +If the pointer returned is NULL, then the allocation has failed, and compression must be aborted. +The only parameter 'const char* inputBuffer' must, obviously, point at the beginning of input buffer. +The input buffer must be already allocated, and size at least 192KB. +'inputBuffer' will also be the 'const char* source' of the first block. + +All blocks are expected to lay next to each other within the input buffer, starting from 'inputBuffer'. +To compress each block, use either LZ4_compressHC_continue() or LZ4_compressHC_limitedOutput_continue(). +Their behavior are identical to LZ4_compressHC() or LZ4_compressHC_limitedOutput(), +but require the LZ4HC Data Structure as their first argument, and check that each block starts right after the previous one. +If next block does not begin immediately after the previous one, the compression will fail (return 0). + +When it's no longer possible to lay the next block after the previous one (not enough space left into input buffer), a call to : +char* LZ4_slideInputBufferHC(void* LZ4HC_Data); +must be performed. It will typically copy the latest 64KB of input at the beginning of input buffer. +Note that, for this function to work properly, minimum size of an input buffer must be 192KB. +==> The memory position where the next input data block must start is provided as the result of the function. + +Compression can then resume, using LZ4_compressHC_continue() or LZ4_compressHC_limitedOutput_continue(), as usual. + +When compression is completed, a call to LZ4_freeHC() will release the memory used by the LZ4HC Data Structure. +*/ + +__declspec(dllimport) int LZ4_sizeofStreamStateHC(void); +__declspec(dllimport) int LZ4_resetStreamStateHC(void* state, const char* inputBuffer); + +/* +These functions achieve the same result as : +void* LZ4_createHC (const char* inputBuffer); + +They are provided here to allow the user program to allocate memory using its own routines. + +To know how much space must be allocated, use LZ4_sizeofStreamStateHC(); +Note also that space must be aligned for pointers (32 or 64 bits). + +Once space is allocated, you must initialize it using : LZ4_resetStreamStateHC(void* state, const char* inputBuffer); +void* state is a pointer to the space allocated. +It must be aligned for pointers (32 or 64 bits), and be large enough. +The parameter 'const char* inputBuffer' must, obviously, point at the beginning of input buffer. +The input buffer must be already allocated, and size at least 192KB. +'inputBuffer' will also be the 'const char* source' of the first block. + +The same space can be re-used multiple times, just by initializing it each time with LZ4_resetStreamState(). +return value of LZ4_resetStreamStateHC() must be 0 is OK. +Any other value means there was an error (typically, state is not aligned for pointers (32 or 64 bits)). +*/ + + +#if defined (__cplusplus) +} +#endif + +#endif //_LZ4HC_H + +``` + +`AutoAttach/trash.hpp`: + +```hpp +#pragma once + +namespace config { + bool status = false; + std::string process{}; + std::uint32_t sleep{}; +} + +namespace cmd { + bool status_command(int argc, char* argv[]) { + if (argc < 2) { + _plugin_logputs("[" PLUGIN_NAME "] Enter status(1/0)!"); + return false; + } + + config::status = std::atoi(argv[1]); + + _plugin_logprintf("[" PLUGIN_NAME "] Set status: %d\n", config::status); + return true; + } + + bool set_command(int argc, char* argv[]) { + if (argc < 2) { + _plugin_logputs("[" PLUGIN_NAME "] Enter process name!"); + return false; + } + + config::process = argv[1]; + + _plugin_logprintf("[" PLUGIN_NAME "] Set process: %s\n", config::process.c_str()); + return true; + } + + bool sleep_command(int argc, char* argv[]) { + if (argc < 2) { + _plugin_logputs("[" PLUGIN_NAME "] Enter sleep time(ms)!"); + return false; + } + + config::sleep = std::atoi(argv[1]); + + _plugin_logprintf("[" PLUGIN_NAME "] Set sleep: %d ms\n", config::sleep); + return true; + } +} +``` + +`README.md`: + +```md +# Plugin AutoAttach for x64dbg +### How to use it? +To change the status of the plugin, you need to write the command `AutoAttachStatus (0/1)`\ +To specify a process, you must write the `AutoAttachProcess` command and enter the process name +### Sleep +If suddenly you need a delay before the attached, then this can be done through AutoAttachSleep by specifying milliseconds in the arguments +### Example sleep +AutoAttachSleep 1000 +### Example select process +AutoAttachProcess dota2.exe +### Example enable AutoAttach +AutoAttachStatus 1 +### Example disable AutoAttach +AutoAttachStatus 0 +### if anything, commands are entered here :) +![image](https://user-images.githubusercontent.com/84228488/179225200-2353b30b-d11a-40f4-89f1-41b61677642c.png) + +``` \ No newline at end of file diff --git a/archive/secrary/idenLib.txt b/archive/secrary/idenLib.txt new file mode 100644 index 00000000..cb83f871 --- /dev/null +++ b/archive/secrary/idenLib.txt @@ -0,0 +1,1740 @@ +Project Path: arc_secrary_idenLib_r19a_c4t + +Source Tree: + +```txt +arc_secrary_idenLib_r19a_c4t +├── LICENSE +├── README.md +├── idenLib +│ ├── compression.cpp +│ ├── compression.h +│ ├── dependencies +│ │ ├── zstd +│ │ └── zydis +│ ├── disassamble.cpp +│ ├── disassamble.h +│ ├── idenLib.cpp +│ ├── idenLib.vcxproj +│ ├── idenLib.vcxproj.filters +│ ├── parseArchive.cpp +│ ├── parseArchive.h +│ ├── pdb.cpp +│ ├── pdb.h +│ ├── utils.cpp +│ └── utils.h +└── idenLib.sln + +``` + +`LICENSE`: + +``` +MIT License + +Copyright (c) 2019 Lasha Khasaia + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. + +``` + +`README.md`: + +```md +# idenLib - Library Function Identification + +When analyzing malware or 3rd party software, it's challenging to identify statically linked libraries and to understand what a function from the library is doing. + +[`idenLib.exe`](https://github.com/secrary/idenLib) is a tool for generating library signatures from `.lib`/`.obj`/`.exe` files. + +[`idenLib.dp32`/`idenLib.dp64`](https://github.com/secrary/idenLibX) is a [`x32dbg`/`x64dbg`](https://x64dbg.com) plugin to identify library functions. + +[`idenLib.py`](https://github.com/secrary/IDA-scripts/tree/master/idenLib) is an [`IDA Pro`](https://www.hex-rays.com/products/ida/index.shtml) plugin to identify library functions. + + +##### Any feedback is greatly appreciated: [@_qaz_qaz](https://twitter.com/_qaz_qaz) + +## How does idenLib.exe generate signatures? + +1. Parses input file(`.lib`/`.obj` file) to get a list of function addresses and function names. +2. Gets the last opcode from each instruction + +![sig](https://user-images.githubusercontent.com/16405698/52433535-35442500-2b05-11e9-92a2-7ed0dfb319ab.png) + +3. Compresses the signature with [zstd](https://github.com/facebook/zstd) + +4. Saves the signature under the `SymEx` directory, if the input filename is `zlib.lib`, the output will be `zlib.lib.sig` or `zlib.lib.sig64`, +if `zlib.lib.sig(64)` already exists under the `SymEx` directory from a previous execution or from the previous version of the library, the next execution will append different signatures. +If you execute `idenLib.exe` several times with different version of the `.lib` file, the `.sig`/`sig64` file will include all unique function signatures. + +Inside of a signature (it's compressed): +![signature](https://user-images.githubusercontent.com/16405698/52490971-e9a18200-2bbd-11e9-8d29-e85a71826c8f.png) + +## Usage: +- Generate library signatures: `idenLib.exe /path/to/file` or `idenLib.exe /path/to/directory` +- Generate `main` function signature: `idenLib.exe /path/to/pe -getmain` + +## Generating library signatures + +![lib](https://user-images.githubusercontent.com/16405698/52433541-35dcbb80-2b05-11e9-918a-6d39afc5de91.gif) + +## [`x32dbg`/`x64dbg`](https://x64dbg.com), [`IDA Pro`](https://www.hex-rays.com/products/ida/index.shtml) plugin usage: + +1. Copy `SymEx` directory under `x32dbg`/`x64dbg`/`IDA Pro`'s main directory +2. Apply signatures: + +[`x32dbg`/`x64dbg`](https://github.com/secrary/idenLibX): + +![xdb](https://user-images.githubusercontent.com/16405698/52433536-35442500-2b05-11e9-990e-8d4889bfe1c6.gif) + +[`IDA Pro`](https://github.com/secrary/IDA-scripts/tree/master/idenLib): + +![ida_boost_2](https://user-images.githubusercontent.com/16405698/52433540-35dcbb80-2b05-11e9-9dd3-9bb44d678ea5.gif) + +## Generating `main` function signature: +If you want to generate a signature for `main` function compiled using `MSVC 14` you need to create a `hello world` application with the corresponding compiler and use the application as input for `idenLib` + +![getmain](https://user-images.githubusercontent.com/16405698/53035354-234f7400-346d-11e9-9d56-b05ff0309ca6.gif) + +`main` function signature files are `EntryPointSignatures.sig` and `EntryPointSignatures.sig64` + +![IDAProMain](https://user-images.githubusercontent.com/16405698/53022517-3c4b2b80-3453-11e9-9e0a-5d1421f9c8f3.gif) + +![x64dbg_main](https://user-images.githubusercontent.com/16405698/53122678-14d98900-354f-11e9-88a3-e6f0f6b7d7bf.gif) + +## Notes Regarding to `main` Function Signatures + +- `idenLib` uses the `DIA APIs` to browse debug information stored in a PDB file. To run `idenLib` with `-getmain` parameter you will need to ensure that the msdia140.dll (found in `Microsoft Visual Studio\2017\Community\DIA SDK\bin`) is registered as a COM component, by invoking regsvr32.exe on the dll. + + +## Applying Signatures + +There are two ways to apply signatures, exact match and using [`Jaccard index`](https://en.wikipedia.org/wiki/Jaccard_index) + +![x32dbg_jaccard](https://user-images.githubusercontent.com/16405698/53361361-80489f80-392f-11e9-9339-36b719394cbe.png) + + +## Useful links: +- Detailed information about [`C Run-Time Libraries (CRT)`](https://docs.microsoft.com/en-us/cpp/c-runtime-library/crt-library-features) + +## Third-party +- Zydis ([MIT License](https://github.com/zyantific/zydis/blob/master/LICENSE)) +- Zstandard ([BSD License](https://github.com/facebook/zstd/blob/dev/LICENSE)) + +- Icon by [freepik](https://www.flaticon.com/authors/freepik) + +``` + +`idenLib.sln`: + +```sln + +Microsoft Visual Studio Solution File, Format Version 12.00 +# Visual Studio 15 +VisualStudioVersion = 15.0.28307.329 +MinimumVisualStudioVersion = 10.0.40219.1 +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "idenLib", "idenLib\idenLib.vcxproj", "{877936DA-E788-4B7D-AD77-B6555575A44C}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|x64 = Debug|x64 + Debug|x86 = Debug|x86 + Release|x64 = Release|x64 + Release|x86 = Release|x86 + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {877936DA-E788-4B7D-AD77-B6555575A44C}.Debug|x64.ActiveCfg = Debug|x64 + {877936DA-E788-4B7D-AD77-B6555575A44C}.Debug|x64.Build.0 = Debug|x64 + {877936DA-E788-4B7D-AD77-B6555575A44C}.Debug|x86.ActiveCfg = Debug|Win32 + {877936DA-E788-4B7D-AD77-B6555575A44C}.Debug|x86.Build.0 = Debug|Win32 + {877936DA-E788-4B7D-AD77-B6555575A44C}.Release|x64.ActiveCfg = Release|x64 + {877936DA-E788-4B7D-AD77-B6555575A44C}.Release|x64.Build.0 = Release|x64 + {877936DA-E788-4B7D-AD77-B6555575A44C}.Release|x86.ActiveCfg = Release|Win32 + {877936DA-E788-4B7D-AD77-B6555575A44C}.Release|x86.Build.0 = Release|Win32 + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection + GlobalSection(ExtensibilityGlobals) = postSolution + SolutionGuid = {735438F8-8F1B-4ABA-9AC8-59A17DEAB00D} + EndGlobalSection +EndGlobal + +``` + +`idenLib/compression.cpp`: + +```cpp +#include "compression.h" + +bool CompressFile(fs::path& sigPathTmp, const fs::path& sigPath) +{ + FILE* hFile = nullptr; + fopen_s(&hFile, sigPathTmp.string().c_str(), "rb"); + if (!hFile) + { + fprintf(stderr, "[idenLib - FAILED] failed to open: %s \n", sigPathTmp.string().c_str()); + return false; + } + + // file size + fseek(hFile, 0L, SEEK_END); + const auto fSize = ftell(hFile); + rewind(hFile); + // read file + const auto fBuff = new BYTE[fSize]; + fread(fBuff, 1, fSize - 1, hFile); // without last new line \n (0xa) + // zero (0x00) at the end + fBuff[fSize - 1] = 0; + // alloc for compressed data + const auto cBufSize = ZSTD_compressBound(fSize); + const auto cBuff = new BYTE[cBufSize]; + // compress data + const auto cSize = ZSTD_compress(cBuff, cBufSize, fBuff, fSize, DEFAULT_COMPRESS_LEVEL); + if (ZSTD_isError(cSize)) + { + fprintf(stderr, "[idenLib - FAILED] error compressing: %s \n", ZSTD_getErrorName(cSize)); + delete[] cBuff; + delete[] fBuff; + return false; + } + fclose(hFile); + + if (exists(sigPath)) + { + fs::remove(sigPath); + } + fopen_s(&hFile, sigPath.string().c_str(), "wb"); + if (!hFile) + { + fprintf(stderr, "[idenLib - FAILED] failed to open: %s \n", sigPath.string().c_str()); + delete[] cBuff; + delete[] fBuff; + return false; + } + fwrite(cBuff, 1, cSize, hFile); + + delete[] cBuff; + delete[] fBuff; + fclose(hFile); + + return true; +} + +_Success_(return) + +bool DecompressFile(fs::path& sigPath, PBYTE& decompressedData) +{ + FILE* hFile = nullptr; + fopen_s(&hFile, sigPath.string().c_str(), "rb"); + if (!hFile) + { + fwprintf(stderr, L"[idenLib - FAILED] failed to open the file: %s\n", sigPath.c_str()); + return false; + } + // compressed size + fseek(hFile, 0L, SEEK_END); + const auto cSize = ftell(hFile); + rewind(hFile); + // read data + const auto cBuff = new BYTE[cSize]; + if (cBuff == nullptr) + { + fclose(hFile); + return false; + } + fread(cBuff, 1, cSize, hFile); + // decompressed size + const auto rSize = ZSTD_findDecompressedSize(cBuff, cSize); + if (rSize == ZSTD_CONTENTSIZE_ERROR) + { + fwprintf(stderr, L"[idenLib - FAILED] %s : it was not compressed by zstd.\n", sigPath.c_str()); + delete[] cBuff; + fclose(hFile); + return false; + } + if (rSize == ZSTD_CONTENTSIZE_UNKNOWN) + { + fwprintf(stderr, + L"[idenLib - FAILED] %s : original size unknown. Use streaming decompression instead.\n", + sigPath.c_str()); + delete[] cBuff; + fclose(hFile); + return false; + } + decompressedData = new BYTE[rSize]; // +1 for 0x00 + if (decompressedData == nullptr) + { + delete[] cBuff; + fclose(hFile); + return false; + } + auto const dSize = ZSTD_decompress(decompressedData, rSize, cBuff, cSize); + + if (dSize != rSize) + { + fprintf(stderr, "[idenLib - FAILED] error decoding %s : %s \n", sigPath.string().c_str(), + ZSTD_getErrorName(dSize)); + delete[] cBuff; + fclose(hFile); + return false; + } + + + fclose(hFile); + delete[] cBuff; + return true; +} + +``` + +`idenLib/compression.h`: + +```h +#pragma once + +#include "utils.h" + + +namespace fs = std::filesystem; + +#define DEFAULT_COMPRESS_LEVEL 3 + +bool CompressFile(fs::path& sigPathTmp, const fs::path& sigPath); + +bool DecompressFile(fs::path& sigPath, PBYTE& decompressedData); + +``` + +`idenLib/disassamble.cpp`: + +```cpp +#include "disassamble.h" + +_Success_(return) + +bool GetOpcodeBuf(__in PBYTE funcVa, __in SIZE_T length, __out PCHAR& opcodesBuf, __in bool countBranches, + __out size_t& cBranches) +{ + ZydisDecoder decoder; + + ZydisDecoderInit(&decoder, zydisMode, zydisWidth); + + ZyanUSize offset = 0; + ZydisDecodedInstruction instruction; + + if (countBranches) + { + cBranches = 0; + } + + auto cSize = length * 2; + opcodesBuf = static_cast(malloc(cSize)); // // we need to resize the buffer + if (opcodesBuf == nullptr) + { + return false; + } + SIZE_T counter = 0; + while ( ZYAN_SUCCESS(ZydisDecoderDecodeBuffer(&decoder, funcVa + offset, length - offset, + &instruction))) + { + CHAR opcode[3]; + sprintf_s(opcode, "%02x", instruction.opcode); + + memcpy_s(opcodesBuf + counter, cSize - counter, opcode, sizeof(opcode)); + counter += 2; + + if (countBranches) + { + if (instruction.meta.branch_type != ZYDIS_BRANCH_TYPE_NONE) + { + cBranches++; + } + } + + offset += instruction.length; + } + auto tmpPtr = static_cast(realloc(opcodesBuf, counter + 1)); // +1 for 0x00 + if (tmpPtr == nullptr) + { + return false; + } + opcodesBuf = tmpPtr; + + return counter != 0; +} + +``` + +`idenLib/disassamble.h`: + +```h +#pragma once + +#include "utils.h" + +_Success_(return) +bool GetOpcodeBuf(__in PBYTE funcVa, __in SIZE_T length, __out PCHAR& opcodesBuf, __in bool countBranches, + __out size_t& cBranches); + +``` + +`idenLib/idenLib.cpp`: + +```cpp +// +// author: Lasha Khasaia +// contact: @_qaz_qaz +// + +#include "utils.h" + +void ProcessFile(const fs::path& sPath); + +int main(int argc, char* argv[]) +{ + if (argc < 2) + { + printf( + "idenLib - Library Function Identification\n\ + Usage: \n\ + ./idenLib.exe /path/to/sample\n\ + ./idenLib.exe /path/to/dir\n\ + ./idenLib.exe /path/to/dir filename\n\n\ + ./idenLib.exe /path/to/sample -getmain\ + \n"); + return STATUS_UNSUCCESSFUL; + } + + fs::path sPath{argv[1]}; + + if (!exists(sPath)) + { + fwprintf(stderr, L"[idenLib - FAILED] Invalid path: %s\n", sPath.c_str()); + return STATUS_UNSUCCESSFUL; + } + + if (!exists(symExPath)) + { + create_directory(symExPath); + } + + + if (argc == 3) // -getmain + { + if (strncmp(argv[2], "-getmain", strlen("-getmain")) == 0) + { + if (S_OK != CoInitialize(nullptr)) + { + printf("CoInitialize failed\n"); + return STATUS_UNSUCCESSFUL; + } + + if (is_regular_file(sPath) && (sPath.extension().compare(".exe") == 0 || sPath.extension().compare(".dll") + == 0)) + { + if (!ProcessMainSignature(sPath)) // argv[3] is name of the entry point (wmain, main, etc) + { + fprintf(stderr, "[IdenLib - FAILED] Failed to parse .pdb file\n"); + return STATUS_UNSUCCESSFUL; + } + return STATUS_SUCCESS; + } + } + } + + + if (is_regular_file(sPath)) + { + ProcessFile(sPath); + } + else + { + std::error_code ec{}; + for (auto& p : fs::recursive_directory_iterator(sPath, fs::directory_options::skip_permission_denied, ec)) + { + if (ec.value() != STATUS_SUCCESS) + { + continue; + } + const auto& currentPath = p.path(); + if (is_regular_file(currentPath, ec)) + { + if (ec.value() != STATUS_SUCCESS) + { + continue; + } + if (argc == 3) + { + if (std::wstring::npos != currentPath.filename().string().find(argv[2])) + { + ProcessFile(currentPath); + } + } + else + { + ProcessFile(currentPath); + } + } + } + } + + printf("------------- EOF -------------"); + return STATUS_SUCCESS; +} + + +void ProcessArchiveFile(const fs::path& sPath) +{ + Lib lib{sPath}; + USER_CONTEXT userContext{}; + + userContext.Dirty = false; + + if (!lib.GetSignature(&userContext) || !userContext.Dirty) + { + printf("[idenLib - INFO] No SIG file for : %s\n", sPath.string().c_str()); + return; + } + + if (lib.isx64) + { + sigExt = L".sig64"; + subFolder = L"x64"; + } + else + { + sigExt = L".sig"; + subFolder = L"x86"; + } + + const auto fileName = sPath.filename(); + auto sigPath{symExPath}; + sigPath += L"\\"; + sigPath += subFolder; + if (!exists(sigPath)) + { + create_directories(sigPath); + } + sigPath += L"\\"; + sigPath += fileName; + sigPath += sigExt; + + if (exists(sigPath)) + { + PBYTE decompressedData{}; + if (!DecompressFile(sigPath, decompressedData) || !decompressedData) + { + fwprintf_s(stderr, L"[idenLib - FAILED] failed to decompress the file: %s\n", sigPath.c_str()); + return; + } + char seps[] = "\n"; + char* next_token = nullptr; + char* line = strtok_s(reinterpret_cast(decompressedData), seps, &next_token); + while (line != nullptr) + { + std::vector vec{}; + Split(line, vec); + if (vec.size() != 2) + { + fwprintf(stderr, L"[idenLib - FAILED] SIG file contains a malformed data, SIG path: %s\n", + sigPath.c_str()); + return; + } + // vec[0] opcode + // vec[1] name + if (userContext.funcSignature.find(vec[0]) == userContext.funcSignature.end()) + { + userContext.funcSignature[vec[0]] = vec[1]; + } + + line = strtok_s(nullptr, seps, &next_token); + } + + + delete[] decompressedData; + } + + fs::path sigPathTmp = sigPath; + sigPathTmp += L".tmp"; + if (exists(sigPathTmp)) + { + fs::remove(sigPathTmp); + } + + FILE* hFile = nullptr; + fopen_s(&hFile, sigPathTmp.string().c_str(), "wb"); + if (!hFile) + { + fwprintf(stderr, L"[idenLib - FAILED] failed to create sig file: %s\n", sigPath.c_str()); + return; + } + for (const auto& n : userContext.funcSignature) + { + const auto bothSize = n.first.size() + n.second.size() + 3; // space + \n + 0x00 + const auto opcodesName = new CHAR[bothSize]; + sprintf_s(opcodesName, bothSize, "%s %s\n", n.first.c_str(), n.second.c_str()); + fwrite(opcodesName, bothSize - 1, 1, hFile); // -1 without 0x00 + delete[] opcodesName; + } + fclose(hFile); + + if (CompressFile(sigPathTmp, sigPath)) + { + wprintf(L"[idenLib] Created SIG file: %s based on %s\n", sigPath.c_str(), sPath.c_str()); + } + else + { + fwprintf(stderr, L"[idenLib - FAILED] compression failed\n"); + } + if (exists(sigPathTmp)) + fs::remove(sigPathTmp); + + + if (exists(sigPath) && is_empty(sigPath)) + { + DeleteFile(sigPath.c_str()); + } +} + +void ProcessFile(const fs::path& sPath) +{ + if (sPath.extension().compare(".lib") == 0 || sPath.extension().compare(".obj") == 0) + { + ProcessArchiveFile(sPath); + } + + + // parse PE files based on pdb - REMOVED +} + +``` + +`idenLib/idenLib.vcxproj`: + +```vcxproj + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + 15.0 + {877936DA-E788-4B7D-AD77-B6555575A44C} + Win32Proj + idenLib + 10.0.17763.0 + + + + Application + true + v141 + Unicode + + + Application + false + v141 + true + Unicode + + + Application + true + v141 + Unicode + + + Application + false + v141 + true + Unicode + + + + + + + + + + + + + + + + + + + + + true + $(ProjectDir)..\idenLib\dependencies\zydis\msvc;$(ProjectDir)..\idenLib\dependencies\zydis\include;$(ProjectDir)..\idenLib\dependencies\zydis\dependencies\zycore\include;$(ProjectDir)..\idenLib\dependencies\zstd\lib;$(VSInstallDir)\DIA SDK\include;$(VC_IncludePath);$(WindowsSDK_IncludePath) + + + true + $(ProjectDir)..\idenLib\dependencies\zydis\msvc;$(ProjectDir)..\idenLib\dependencies\zydis\include;$(ProjectDir)..\idenLib\dependencies\zydis\dependencies\zycore\include;$(ProjectDir)..\idenLib\dependencies\zstd\lib;$(VSInstallDir)\DIA SDK\include;$(VC_IncludePath);$(WindowsSDK_IncludePath) + + + false + $(ProjectDir)..\idenLib\dependencies\zydis\msvc;$(ProjectDir)..\idenLib\dependencies\zydis\include;$(ProjectDir)..\idenLib\dependencies\zydis\dependencies\zycore\include;$(ProjectDir)..\idenLib\dependencies\zstd\lib;$(VSInstallDir)\DIA SDK\include;$(VC_IncludePath);$(WindowsSDK_IncludePath) + + + false + $(ProjectDir)..\idenLib\dependencies\zydis\msvc;$(ProjectDir)..\idenLib\dependencies\zydis\include;$(ProjectDir)..\idenLib\dependencies\zydis\dependencies\zycore\include;$(ProjectDir)..\idenLib\dependencies\zstd\lib;$(VSInstallDir)\DIA SDK\include;$(VC_IncludePath);$(WindowsSDK_IncludePath) + + + + NotUsing + Level3 + Disabled + true + ZYCORE_STATIC_DEFINE;ZYDIS_STATIC_DEFINE;WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + pch.h + $(ProjectDir)..\deps\zydis\include;$(ProjectDir)..\deps\zydis\build;$(ProjectDir)..\deps\zydis\dependencies\zycore\include;$(ProjectDir)..\deps\zydis\build\dependencies\zycore;$(ProjectDir)..\deps\zstd\include + stdcpplatest + + + Console + true + $(ProjectDir)..\idenlib\dependencies\zstd\build\VS2010\bin\Win32_Release;$(ProjectDir)..\idenLib\dependencies\zydis\msvc\bin + zydis.lib;zycore.lib;libzstd_static.lib;kernel32.lib;user32.lib;gdi32.lib;winspool.lib;comdlg32.lib;advapi32.lib;shell32.lib;ole32.lib;oleaut32.lib;uuid.lib;odbc32.lib;odbccp32.lib;%(AdditionalDependencies) + + + + + NotUsing + Level3 + Disabled + true + ZYCORE_STATIC_DEFINE;ZYDIS_STATIC_DEFINE;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + pch.h + stdcpplatest + + + Console + true + zydis.lib;zycore.lib;libzstd_static.lib;kernel32.lib;user32.lib;gdi32.lib;winspool.lib;comdlg32.lib;advapi32.lib;shell32.lib;ole32.lib;oleaut32.lib;uuid.lib;odbc32.lib;odbccp32.lib;%(AdditionalDependencies) + $(ProjectDir)..\idenlib\dependencies\zstd\build\VS2010\bin\x64_Release;$(ProjectDir)..\idenLib\dependencies\zydis\msvc\bin + + + + + NotUsing + Level3 + Disabled + true + true + true + ZYCORE_STATIC_DEFINE;ZYDIS_STATIC_DEFINE;WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + MultiThreaded + + + stdcpplatest + None + + + Console + true + true + false + $(ProjectDir)..\idenlib\dependencies\zstd\build\VS2010\bin\Win32_Release;$(ProjectDir)..\idenLib\dependencies\zydis\msvc\bin + zydis.lib;zycore.lib;libzstd_static.lib;kernel32.lib;user32.lib;gdi32.lib;winspool.lib;comdlg32.lib;advapi32.lib;shell32.lib;ole32.lib;oleaut32.lib;uuid.lib;odbc32.lib;odbccp32.lib;%(AdditionalDependencies) + + + + + NotUsing + Level3 + MaxSpeed + true + true + true + ZYCORE_STATIC_DEFINE;ZYDIS_STATIC_DEFINE;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + MultiThreaded + None + stdcpplatest + + + Console + true + true + false + $(ProjectDir)..\idenlib\dependencies\zstd\build\VS2010\bin\x64_Release;$(ProjectDir)..\idenLib\dependencies\zydis\msvc\bin + zydis.lib;zycore.lib;libzstd_static.lib;kernel32.lib;user32.lib;gdi32.lib;winspool.lib;comdlg32.lib;advapi32.lib;shell32.lib;ole32.lib;oleaut32.lib;uuid.lib;odbc32.lib;odbccp32.lib;%(AdditionalDependencies) + + + + + + + + + + + + + + + + + + + + + +``` + +`idenLib/idenLib.vcxproj.filters`: + +```filters + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + Source Files + + + Source Files + + + Source Files + + + Source Files + + + Source Files + + + Source Files + + + + + Header Files + + + Header Files + + + Header Files + + + Header Files + + + Header Files + + + +``` + +`idenLib/parseArchive.cpp`: + +```cpp +#include "parseArchive.h" + +Lib::Lib(const fs::path& libPath) +{ + if (_wfopen_s(&this->hFile, libPath.c_str(), L"rb") || !this->hFile) // Zero if successful; + return; + // get file length + fseek(this->hFile, 0, SEEK_END); + this->FileLength = ftell(this->hFile); + rewind(this->hFile); + // file content + this->FileContent = static_cast(malloc(this->FileLength)); + if (this->FileContent == nullptr) + { + return; + } + fread(this->FileContent, this->FileLength, 1, this->hFile); + rewind(this->hFile); + // Is it right type? + if ((this->FileContent != nullptr) && memcmp(this->FileContent, IMAGE_ARCHIVE_START, IMAGE_ARCHIVE_START_SIZE) == 0) + { + this->isLib = true; + } +} + +void Lib::MemberHeader(__in IMAGE_ARCHIVE_MEMBER_HEADER& archiveMemberHdr) +{ + const LONG seek = EVEN_BYTE_ALIGN(this->MemberSeekBase + this->MemberSize); + fseek(this->hFile, seek, SEEK_SET); + fread(&archiveMemberHdr, sizeof(IMAGE_ARCHIVE_MEMBER_HEADER), 1, this->hFile); + this->MemberSeekBase = seek + sizeof(IMAGE_ARCHIVE_MEMBER_HEADER); + this->MemberSize = strtol(reinterpret_cast(archiveMemberHdr.Size), nullptr, 10); +} + +DWORD Reverse(const DWORD value) +{ + return (value & 0x000000FF) << 24 | (value & 0x0000FF00) << 8 | (value & 0x00FF0000) >> 8 | (value & 0xFF000000) >> + 24; +} + +_Success_(return) + +bool Lib::GetSignature(LPVOID pUserContext) +{ + if (!this->isLib) // process .obj file + { + // Is it a .obj file? + const auto fHdr = reinterpret_cast(this->FileContent); + if (fHdr->Machine == Arch86 || fHdr->Machine == Arch64) + { + this->isx64 = fHdr->Machine == Arch64; + // process .obj file + DisasmObjCode(*fHdr, this->FileContent, pUserContext); + return true; + } + return false; + } + + // process .lib file + IMAGE_ARCHIVE_MEMBER_HEADER imArcMemHdr{}; + MemberHeader(imArcMemHdr); + if (memcmp(imArcMemHdr.Name, IMAGE_ARCHIVE_LINKER_MEMBER, 16) != 0) + { + return false; + } + // number of public symbols in linker member + DWORD numberOfPublicSymbols{}; + fread(&numberOfPublicSymbols, sizeof(DWORD), 1, this->hFile); + numberOfPublicSymbols = Reverse(numberOfPublicSymbols); + + // symbols offsets - skip + fseek(this->hFile, sizeof(DWORD) * numberOfPublicSymbols, SEEK_CUR); + // size of the linker member string table - skip + auto stringTable = IMAGE_ARCHIVE_START_SIZE + sizeof(IMAGE_ARCHIVE_MEMBER_HEADER) + + (this->MemberSize - ftell(this->hFile)); + fseek(this->hFile, stringTable, SEEK_CUR); + + auto newMember = EVEN_BYTE_ALIGN(this->MemberSeekBase + this->MemberSize); + fseek(this->hFile, newMember, SEEK_SET); + + IMAGE_ARCHIVE_MEMBER_HEADER imArcMemHdrPos{}; + fread(&imArcMemHdrPos, sizeof(IMAGE_ARCHIVE_MEMBER_HEADER), 1, this->hFile); + if (memcmp(imArcMemHdrPos.Name, IMAGE_ARCHIVE_LINKER_MEMBER, 16) == 0) + { + // second link member - skip + MemberHeader(imArcMemHdr); + DWORD cMemberOffsets{}; + fread(&cMemberOffsets, sizeof(DWORD), 1, this->hFile); + fseek(this->hFile, sizeof(DWORD) * cMemberOffsets, SEEK_CUR); + + // new index table - skip + fread(&numberOfPublicSymbols, sizeof(DWORD), 1, this->hFile); + fseek(this->hFile, sizeof(WORD) * numberOfPublicSymbols, SEEK_CUR); + // string table - skip + stringTable = MemberSize - (ftell(this->hFile) - (newMember + sizeof(IMAGE_ARCHIVE_MEMBER_HEADER))); + fseek(this->hFile, stringTable, SEEK_CUR); + } + + + newMember = EVEN_BYTE_ALIGN(this->MemberSeekBase + this->MemberSize); + fseek(this->hFile, newMember, SEEK_SET); + fread(&imArcMemHdrPos, sizeof(IMAGE_ARCHIVE_MEMBER_HEADER), 1, this->hFile); + if (memcmp(imArcMemHdrPos.Name, IMAGE_ARCHIVE_LONGNAMES_MEMBER, 16) == 0) + { + MemberHeader(imArcMemHdr); + // strings - skip + fseek(this->hFile, this->MemberSize, SEEK_CUR); + } + + // iterate objects + do + { + IMAGE_ARCHIVE_MEMBER_HEADER archiveMemberHdr{}; + MemberHeader(archiveMemberHdr); + + const auto currentObjectStart = this->FileContent + ftell(this->hFile); + IMAGE_FILE_HEADER imageFileHdr{}; + fread(&imageFileHdr, sizeof(IMAGE_FILE_HEADER), 1, this->hFile); + if (imageFileHdr.Machine != Arch86 && imageFileHdr.Machine != Arch64) + { + continue; + } + this->isx64 = imageFileHdr.Machine == Arch64; + DisasmObjCode(imageFileHdr, currentObjectStart, pUserContext); + } + while (this->MemberSeekBase + this->MemberSize + 1 < this->FileLength); + + + return true; +} + +Lib::~Lib() +{ + if (FileContent != nullptr) + { + free(FileContent); + } + if (hFile) + fclose(hFile); +} + +void Lib::DisasmObjCode(__in IMAGE_FILE_HEADER& imageFileHdr, __in byte* currentObjectStart, LPVOID pUserContext) +{ + if (this->isx64) + { + zydisMode = ZYDIS_MACHINE_MODE_LONG_64; + zydisWidth = ZYDIS_ADDRESS_WIDTH_64; + } + else + { + zydisMode = ZYDIS_MACHINE_MODE_LEGACY_32; + zydisWidth = ZYDIS_ADDRESS_WIDTH_32; + } + + const auto userContext = static_cast(pUserContext); + auto saveLoc = ftell(this->hFile); + + if (!this->isLib) + { + this->MemberSeekBase = 0; + } + + fseek(this->hFile, this->MemberSeekBase + + imageFileHdr.PointerToSymbolTable, SEEK_SET); + if (imageFileHdr.NumberOfSymbols == 0u) + { + return; + } + const auto symbols = static_cast(malloc(imageFileHdr.NumberOfSymbols * sizeof(IMAGE_SYMBOL))); + if (symbols == nullptr) + { + return; + } + fread(symbols, imageFileHdr.NumberOfSymbols, sizeof(IMAGE_SYMBOL), this->hFile); + fseek(this->hFile, saveLoc, SEEK_SET); + + const auto startOfSectionHeaders = this->MemberSeekBase + sizeof(IMAGE_FILE_HEADER) + imageFileHdr. + SizeOfOptionalHeader; + const DWORD cbSections = imageFileHdr.NumberOfSections * sizeof(IMAGE_SECTION_HEADER); + if (cbSections == 0u) + { + return; + } + const auto sectionHeaders = static_cast(malloc(cbSections)); + if (sectionHeaders == nullptr) + { + return; + } + fseek(this->hFile, startOfSectionHeaders, SEEK_SET); // set after optional header + fread(sectionHeaders, sizeof(IMAGE_SECTION_HEADER), imageFileHdr.NumberOfSections, this->hFile); + + const auto stringTable = reinterpret_cast(imageFileHdr.PointerToSymbolTable + currentObjectStart + + imageFileHdr.NumberOfSymbols * + sizeof(IMAGE_SYMBOL)); + for (size_t i = 1; i <= imageFileHdr.NumberOfSections; i++) // since IMAGE_SYMBOL counts from 1 (not 0) + { + const auto imageSectionHeader = sectionHeaders[i - 1]; + const auto cbVirtual = imageSectionHeader.SizeOfRawData; + + if (imageSectionHeader.PointerToRawData != 0 && cbVirtual != 0 && (( + imageSectionHeader.Characteristics & IMAGE_SCN_CNT_CODE) != 0u)) + { + // disassemble code + const auto numberOfSymbols = imageFileHdr.NumberOfSymbols; + for (size_t j = 0; j < numberOfSymbols; ++j) + { + if (size_t(symbols[j].SectionNumber) == i && + (symbols[j].StorageClass == IMAGE_SYM_CLASS_EXTERNAL || + symbols[j].StorageClass == IMAGE_SYM_CLASS_STATIC || + symbols[j].StorageClass == IMAGE_SYM_CLASS_LABEL) && ISFCN(symbols[j].Type) + ) // current section and function + { + const auto fnName = symbols[j].N.Name.Short != 0u + ? reinterpret_cast(symbols[j].N.ShortName) + : (stringTable + symbols[j].N.Name.Long); + + std::string sName{fnName}; + + //if (sName.find("ZydisDecoderInit") != std::string::npos) { // test func + // printf("%s\n", sName.c_str()); + //} + + const auto code = currentObjectStart + imageSectionHeader.PointerToRawData + symbols[j].Value; + auto codeSize = imageSectionHeader.SizeOfRawData - symbols[j].Value; + if (codeSize < MIN_FUNC_SIZE) + { + continue; + } + if (codeSize > MAX_FUNC_SIZE) + { + codeSize = MAX_FUNC_SIZE; + } + + PCHAR opcodesBuf = nullptr; + size_t branches{}; + if (GetOpcodeBuf(code, static_cast(codeSize), opcodesBuf, true, branches) && opcodesBuf) + { + std::string cOpcodes{opcodesBuf}; + cOpcodes += "+"; + cOpcodes += std::to_string(branches); // opcodes+numberOfBranches + userContext->funcSignature[cOpcodes] = sName; + userContext->Dirty = true; + + free(opcodesBuf); + } + } + } + } + } + + free(symbols); + free(sectionHeaders); +} + +``` + +`idenLib/parseArchive.h`: + +```h +#pragma once + +#include "utils.h" + +namespace fs = std::filesystem; + +#define EVEN_BYTE_ALIGN(x) (((x) & 1) ? (x) + 1 : (x)) + + +class Lib +{ + bool isLib = false; + SIZE_T MemberSeekBase = IMAGE_ARCHIVE_START_SIZE; + SIZE_T MemberSize = 0; + void MemberHeader(__in IMAGE_ARCHIVE_MEMBER_HEADER& archiveMemberHdr); + void DisasmObjCode(__in IMAGE_FILE_HEADER& imageFileHdr, __in byte* currentObjectStart, LPVOID pUserContext); +public: + bool isx64 = false; + byte* FileContent = nullptr; + FILE* hFile = nullptr; + SIZE_T FileLength = 0; + Lib() = delete; + Lib(const fs::path& libPath); + _Success_(return) + bool GetSignature(LPVOID pUserContext); + + ~Lib(); +}; + +``` + +`idenLib/pdb.cpp`: + +```cpp +#include "pdb.h" + +bool LoadDataFromPdb(const wchar_t* szFilename, IDiaDataSource** ppSource, IDiaSession** ppSession, + IDiaSymbol** ppGlobal); +bool GetMainSignature(__in IDiaSymbol* pGlobal, MAIN_SIG_INFO& mainInfo); +void GetMainRva(__in IDiaSymbol* pSymbol, MAIN_SIG_INFO& mainInfo); +void FindCallerSignature(__in IDiaSymbol* pSymbol, MAIN_SIG_INFO& mainInfo); +void GetCallerOpcodes(__in PBYTE funcVa, __in SIZE_T length, MAIN_SIG_INFO& mainInfo); + +_Success_(return) + +bool ProcessMainSignature(const fs::path& pePath) +{ + auto loadAddress = reinterpret_cast(LoadLibraryEx(pePath.c_str(), nullptr, + LOAD_LIBRARY_AS_IMAGE_RESOURCE)); + if (INVALID_HANDLE_VALUE == reinterpret_cast(loadAddress)) + { + printf("Failed to map...."); + return false; + } + // if PE is DLL, LOAD_LIBRARY_AS_IMAGE_RESOURCE flag increases baseAddress by 2 + MEMORY_BASIC_INFORMATION info{}; + if (!VirtualQuery(reinterpret_cast(loadAddress), &info, sizeof(info))) + { + printf("[!] VirtualQuery failed\n"); + return false; + } + loadAddress = reinterpret_cast(info.AllocationBase); + + const auto dosHeader = reinterpret_cast(loadAddress); + const auto ntHeader = reinterpret_cast(loadAddress + dosHeader->e_lfanew); + const auto isx64 = ntHeader->FileHeader.Machine == Arch64; + + MAIN_SIG_INFO mainInfo; + mainInfo.Dirty = false; + mainInfo.baseAddress = loadAddress; + + if (isx64) + { + entryPointSignatures = L"EntryPointSignatures.sig64"; + subFolder = L"x64"; + zydisMode = ZYDIS_MACHINE_MODE_LONG_64; + zydisWidth = ZYDIS_ADDRESS_WIDTH_64; + auto ntHeaderCurrent = reinterpret_cast(ntHeader); + mainInfo.EntryAddress = static_cast(ntHeaderCurrent->OptionalHeader.AddressOfEntryPoint); + } + else + { + entryPointSignatures = L"EntryPointSignatures.sig"; + subFolder = L"x86"; + zydisMode = ZYDIS_MACHINE_MODE_LEGACY_32; + zydisWidth = ZYDIS_ADDRESS_WIDTH_32; + auto ntHeaderCurrent = reinterpret_cast(ntHeader); + mainInfo.EntryAddress = static_cast(ntHeaderCurrent->OptionalHeader.AddressOfEntryPoint); + } + + IDiaDataSource* g_pDiaDataSource; + IDiaSession* g_pDiaSession; + IDiaSymbol* g_pGlobalSymbol; + + if (!LoadDataFromPdb(pePath.c_str(), &g_pDiaDataSource, &g_pDiaSession, &g_pGlobalSymbol)) + { + printf("LoadDataFromPdb failed\n"); + return false; + } + + if (!GetMainSignature(g_pGlobalSymbol, mainInfo)) + { + //fwprintf(stderr, L"[idenLib - FAILED] GetMainSignature failed\n"); + return false; + } + + if (!mainInfo.Dirty) + { + fwprintf(stderr, L"[idenLib - INFO] Can not generate a signature: %s\n", pePath.c_str()); + return true; + } + + fs::path mainSigPath = symExPath; + mainSigPath += L"\\"; + mainSigPath += subFolder; + if (!exists(mainSigPath)) + { + create_directories(mainSigPath); + } + mainSigPath += L"\\"; + mainSigPath += entryPointSignatures; + + std::unordered_map mainSigs; + + if (exists(mainSigPath)) + { + PBYTE decompressedData{}; + if (!DecompressFile(mainSigPath, decompressedData) || !decompressedData) + { + fwprintf_s(stderr, L"[idenLib - FAILED] failed to decompress the file: %s\n", mainSigPath.c_str()); + return false; + } + const char seps[] = "\n"; + char* next_token = nullptr; + char* line = strtok_s(reinterpret_cast(decompressedData), seps, &next_token); + while (line != nullptr) + { + std::vector vec{}; + Split(line, vec); + if (vec.size() != 2) + { + fwprintf(stderr, L"[idenLib - FAILED] SIG file contains a malformed data, SIG path: %s\n", + mainSigPath.c_str()); + return false; + } + // vec[0] opcode + // vec[1] name + mainSigs[vec[0]] = vec[1]; + + line = strtok_s(nullptr, seps, &next_token); + } + + + delete[] decompressedData; + } + mainSigs[mainInfo.opcodes_index] = mainInfo.EntryName; + + fs::path sigPathTmp = mainSigPath; + sigPathTmp += L".tmp"; + if (exists(sigPathTmp)) + { + fs::remove(sigPathTmp); + } + + FILE* hFile = nullptr; + fopen_s(&hFile, sigPathTmp.string().c_str(), "wb"); + if (!hFile) + { + fwprintf(stderr, L"[idenLib - FAILED] failed to create sig file: %s\n", mainSigPath.c_str()); + return false; + } + for (const auto& n : mainSigs) + { + const auto bothSize = n.first.size() + n.second.size() + 3; // space + \n + 0x00 + const auto opcodesName = new CHAR[bothSize]; + sprintf_s(opcodesName, bothSize, "%s %s\n", n.first.c_str(), n.second.c_str()); + fwrite(opcodesName, bothSize - 1, 1, hFile); // -1 without 0x00 + delete[] opcodesName; + } + fclose(hFile); + + if (CompressFile(sigPathTmp, mainSigPath)) + { + wprintf(L"[idenLib] Created SIG file: %s based on %s\n", mainSigPath.c_str(), pePath.c_str()); + } + else + { + fwprintf(stderr, L"[idenLib - FAILED] compression failed\n"); + } + if (exists(sigPathTmp)) + fs::remove(sigPathTmp); + + + if (exists(mainSigPath) && is_empty(mainSigPath)) + { + DeleteFile(mainSigPath.c_str()); + } + + + return true; +} + +bool LoadDataFromPdb( + const wchar_t* szFilename, + IDiaDataSource** ppSource, + IDiaSession** ppSession, + IDiaSymbol** ppGlobal) +{ + TCHAR wszExt[MAX_PATH]{}; + + // Obtain access to the provider + auto hr = CoCreateInstance(__uuidof(DiaSource), + nullptr, + CLSCTX_INPROC_SERVER, + __uuidof(IDiaDataSource), + reinterpret_cast(ppSource)); + + if (FAILED(hr)) + { + fwprintf(stderr, L"[idenLib - Failed] CoCreateInstance failed - HRESULT = %08X\n", hr); + + return false; + } + + _wsplitpath_s(szFilename, nullptr, 0, nullptr, 0, nullptr, 0, wszExt, MAX_PATH); + + if (_wcsicmp(wszExt, L".pdb") == 0) + { + // Open and prepare a program database (.pdb) file as a debug data source + + hr = (*ppSource)->loadDataFromPdb(szFilename); + + if (FAILED(hr)) + { + fwprintf(stderr, L"[idenLib - FAILED] loadDataFromPdb failed - HRESULT = %08X\n", hr); + + return false; + } + } + + else + { + // Open and prepare the debug data associated with the .exe/.dll file + hr = (*ppSource)->loadDataForExe(szFilename, nullptr, nullptr); + if (hr != S_OK) + { + wprintf(L"loadDataForExe failed - HRESULT = %x\n", hr); + return false; + } + } + + // Open a session for querying symbols + + hr = (*ppSource)->openSession(ppSession); + + if (FAILED(hr)) + { + fwprintf(stderr, L"[idenLib - FAILED] openSession failed - HRESULT = %08X\n", hr); + + return false; + } + + // Retrieve a reference to the global scope + + hr = (*ppSession)->get_globalScope(ppGlobal); + + if (hr != S_OK) + { + fwprintf(stderr, L"[idenLib - FAILED] get_globalScope failed\n"); + + return false; + } + + return true; +} + +bool GetMainSignature(__in IDiaSymbol* pGlobal, MAIN_SIG_INFO& mainInfo) +{ + IDiaEnumSymbols* pEnumSymbols; + IDiaSymbol* pSymbol; + ULONG celt = 0; + + + // find RVA of a main function + mainInfo.mainVA = 0; + if (SUCCEEDED(pGlobal->findChildren(SymTagFunction, nullptr, nsNone, &pEnumSymbols))) + { + while (!mainInfo.mainVA && SUCCEEDED(pEnumSymbols->Next(1, &pSymbol, &celt)) && (celt == 1)) + { + GetMainRva(pSymbol, mainInfo); + + pSymbol->Release(); + } + + pEnumSymbols->Release(); + } + + else + { + fwprintf(stderr, L"[IdenLib - FAILED] findChildren(SymTagFunction, ...) failed \n"); + + return false; + } + + // find a function which calls main + if (mainInfo.mainVA == 0u) + { + fwprintf(stderr, L"[IdenLib - FAILED] failed to find main RVA\n"); + return false; + } + + if (SUCCEEDED(pGlobal->findChildren(SymTagFunction, nullptr, nsNone, &pEnumSymbols))) + { + while (!mainInfo.Dirty && SUCCEEDED(pEnumSymbols->Next(1, &pSymbol, &celt)) && (celt == 1)) + { + FindCallerSignature(pSymbol, mainInfo); + + pSymbol->Release(); + } + + pEnumSymbols->Release(); + } + + + return mainInfo.Dirty; +} + +void FindCallerSignature(__in IDiaSymbol* pSymbol, MAIN_SIG_INFO& mainInfo) +{ + DWORD dwRva{}; + ULONGLONG length{}; + + if (!pSymbol) + return; + + DWORD dwSymTag{}; + if (pSymbol->get_symTag(&dwSymTag) != S_OK) + { + return; + } + + auto isFunc = FALSE; + pSymbol->get_function(&isFunc); + if (!isFunc && dwSymTag != SymTagFunction) + return; + + if (pSymbol->get_length(&length) != S_OK) + { + return; + } + + if (pSymbol->get_relativeVirtualAddress(&dwRva) != S_OK) + { + dwRva = 0xFFFFFFFF; + } + + // 444444...44_123 main + // opcodes_mainInstrCount mainName + GetCallerOpcodes(reinterpret_cast(mainInfo.baseAddress + dwRva), length, mainInfo); +} + +void GetCallerOpcodes(__in const PBYTE funcVa, __in SIZE_T length, MAIN_SIG_INFO& mainInfo) +{ + ZydisDecoder decoder; + + ZydisDecoderInit(&decoder, zydisMode, zydisWidth); + + ZyanUSize offset = 0; + ZydisDecodedInstruction instruction; + auto detected = false; + + size_t callInstr = 0; + while ( ZYAN_SUCCESS(ZydisDecoderDecodeBuffer(&decoder, funcVa + offset, length - offset, + &instruction))) + { + if (instruction.mnemonic == ZYDIS_MNEMONIC_CALL) + { + auto& callOperand = instruction.operands[0]; + ZyanU64 callVa{}; + auto instr = reinterpret_cast(funcVa) + offset; + if (callOperand.type == ZYDIS_OPERAND_TYPE_IMMEDIATE && callOperand.imm.is_relative && ZYAN_SUCCESS( +ZydisCalcAbsoluteAddress(&instruction, &callOperand, instr, &callVa))) + { + if (callVa == mainInfo.mainVA) + { + detected = true; + callInstr = offset; + break; + } + } + } + offset += instruction.length; + } + + if (!detected) + { + return; + } + + offset = 0; + auto cSize = length * 2; + if (cSize < 3) // CHAR opcode[3]; + { + return; + } + auto opcodesBuf = static_cast(malloc(cSize)); // // we need to resize the buffer + if (opcodesBuf == nullptr) + { + return; + } + SIZE_T counter = 0; + const auto maxLength = length > MAX_FUNC_SIZE ? MAX_FUNC_SIZE : length; + while ( ZYAN_SUCCESS(ZydisDecoderDecodeBuffer(&decoder, funcVa + offset, maxLength - offset, + &instruction))) + { + CHAR opcode[3]; + sprintf_s(opcode, "%02x", instruction.opcode); + + memcpy_s(opcodesBuf + counter, cSize - counter, opcode, sizeof(opcode)); + counter += 2; + + offset += instruction.length; + } + auto tmpPtr = static_cast(realloc(opcodesBuf, counter + 1)); // +1 for 0x00 + if (tmpPtr == nullptr) + { + return; + } + opcodesBuf = tmpPtr; + + + mainInfo.Dirty = true; + // Two ways to index a main function location + std::string mainOpcodes{opcodesBuf}; + mainOpcodes += "_" + std::to_string(callInstr); // _123 => call "main" offset = func + 123 + signed long distanceFromEntry = reinterpret_cast(funcVa) + callInstr - (mainInfo.EntryAddress + mainInfo. + baseAddress); + mainOpcodes += "!" + std::to_string(distanceFromEntry); // !567 => call "main" offset = EP + 567 + mainInfo.opcodes_index = mainOpcodes; + + + free(opcodesBuf); +} + +void GetMainRva(__in IDiaSymbol* pSymbol, MAIN_SIG_INFO& mainInfo) +{ + DWORD dwRva{}; + + if (!pSymbol) + return; + + DWORD dwSymTag{}; + if (pSymbol->get_symTag(&dwSymTag) != S_OK) + { + return; + } + + auto isFunc = FALSE; + pSymbol->get_function(&isFunc); + if (!isFunc && dwSymTag != SymTagFunction) + return; + + if (pSymbol->get_relativeVirtualAddress(&dwRva) != S_OK) + { + dwRva = 0xFFFFFFFF; + } + + BSTR bstrName; + if (pSymbol->get_name(&bstrName) == S_OK) + { + const std::wstring name{bstrName}; + + // mainCRTStartup(or wmainCRTStartup) An application that uses / SUBSYSTEM:CONSOLE; calls main(or wmain) + // WinMainCRTStartup(or wWinMainCRTStartup) An application that uses / SUBSYSTEM:WINDOWS; calls WinMain(or wWinMain), which must be defined to use __stdcall + // _DllMainCRTStartup A DLL; calls DllMain if it exists, which must be defined to use __stdcall + + // main wmain WinMain or wWinMain + if (name == L"main" || name == L"wmain" || name == L"WinMain" || name == L"wWinMain") + { + mainInfo.mainVA = dwRva + mainInfo.baseAddress; + mainInfo.EntryName = std::string{name.begin(), name.end()}; + } + + SysFreeString(bstrName); + } +} + +``` + +`idenLib/pdb.h`: + +```h +#pragma once + +#include "utils.h" + +_Success_(return) +bool ProcessMainSignature(const fs::path& pePath); + +typedef struct _MAIN_SIG_INFO +{ + std::unordered_map MainSignatures; + bool Dirty; + std::string EntryName; + std::string opcodes_index; + DWORD_PTR baseAddress; + DWORD_PTR mainVA; + DWORD_PTR EntryAddress; +} MAIN_SIG_INFO, *P_MAIN_SIG_INFO; + +``` + +`idenLib/utils.cpp`: + +```cpp +#include "utils.h" + +// http://www.martinbroadhurst.com/how-to-split-a-string-in-c.html +void Split(__in const std::string& str, __out std::vector& cont) +{ + std::istringstream iss{str}; + std::copy(std::istream_iterator(iss), + std::istream_iterator(), + std::back_inserter(cont)); +} + +``` + +`idenLib/utils.h`: + +```h +#pragma once + +#include +#include + +#include +#include +#include +#include +#include +#include +#include +#include +#include + + +#include "disassamble.h" +#include "parseArchive.h" +#include "compression.h" +#include "pdb.h" + +#include "Zydis/Zydis.h" + +#define ZSTD_STATIC_LINKING_ONLY +#include "zstd.h" + +namespace fs = std::filesystem; + +#define NT_SUCCESS(_) (((NTSTATUS)(_)) >= 0) +#define STATUS_SUCCESS ((NTSTATUS)0x00000000L) +#define STATUS_UNSUCCESSFUL ((NTSTATUS)0xC0000001L) + +#define MIN_FUNC_SIZE 0x20 +#define MAX_FUNC_SIZE 0x100 + +inline auto entryPointSignatures = L"EntryPointSignatures.sig"; +inline auto sigExt = L".sig"; +inline auto subFolder = L"x86"; +inline auto zydisMode = ZYDIS_MACHINE_MODE_LEGACY_32; +inline auto zydisWidth = ZYDIS_ADDRESS_WIDTH_32; + +inline fs::path symExPath{"SymEx"}; +inline fs::path pdbDirName{"symbols"}; + +void Split(__in const std::string& str, __out std::vector& cont); + +typedef struct _USER_CONTEXT +{ + std::unordered_map funcSignature; + bool Dirty; +} USER_CONTEXT, *PUSER_CONTEXT; + +enum +{ + Arch86 = 0x14C, + Arch64 = 0x8664 +}; + +``` \ No newline at end of file diff --git a/archive/x64dbg/x64dbgbinja.txt b/archive/x64dbg/x64dbgbinja.txt new file mode 100644 index 00000000..efb67595 --- /dev/null +++ b/archive/x64dbg/x64dbgbinja.txt @@ -0,0 +1,254 @@ +Project Path: arc_x64dbg_x64dbgbinja_9u6st9rh + +Source Tree: + +```txt +arc_x64dbg_x64dbgbinja_9u6st9rh +├── LICENSE +├── README.md +├── __init__.py +└── plugin.json + +``` + +`LICENSE`: + +``` +MIT License + +Copyright (c) 2026 x64dbg + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. + +``` + +`README.md`: + +```md +# x64dbgbinja + +Official x64dbg plugin for [Binary Ninja](https://binary.ninja). + +## Installation + +From the Plugins Menu, select "Manage Plugins". Search for "x64dbgbinja" and click the "Install" button. + +## Menu options + +### Import database + +Import comments/labels from an uncompressed x64dbg JSON database in Binary Ninja. + +Symbols for imported functions and or library functions can be overwritten via the "Overwrite X" entries in Settings. + +### Export database + +Export comments/labels to a JSON database that can be loaded by x64dbg. + +To export labels only: uncheck "Export Comments" under "x64dbg Database Export" in Settings. + +``` + +`__init__.py`: + +```py +"""Binary Ninja plugin to import and export symbols and comments to x64dbg database format.""" +import json +import pathlib + +from binaryninja.enums import SymbolType +from binaryninja.interaction import get_save_filename_input, get_open_filename_input +from binaryninja.log import Logger +from binaryninja.plugin import PluginCommand +from binaryninja.settings import Settings + +logger = Logger(0, 'x64dbgbinja') + +s = Settings() +s.register_group('dd', 'x64dbg Database Export') +setting = { + 'description': 'Always export comments to the x64dbg database.', + 'title': 'Export Comments', + 'default': True, + 'type': 'boolean' +} +s.register_setting('dd.comments', json.dumps(setting)) +setting = { + 'description': 'Overwrite LibraryFunctionSymbol name', + 'title': 'Overwrite LibraryFunctionSymbol', + 'default': False, + 'type': 'boolean' +} +s.register_setting('dd.libfs', json.dumps(setting)) +setting = { + 'description': 'Overwrite ImportedFunctionSymbol name', + 'title': 'Overwrite ImportedFunctionSymbol', + 'default': False, + 'type': 'boolean' +} +s.register_setting('dd.impfs', json.dumps(setting)) + + +def export_db(bv): + """Export symbols and optionally comments from Binary Ninja to an x64dbg database.""" + db = dict() + module = pathlib.Path(get_filename(bv)) + outpath = bv.file.database.globals.get('x64dbg_db_save_path', pathlib.Path(bv.file.filename).parent) + dbext = 'dd{}'.format(bv.arch.address_size * 8) + + if not (f := get_save_filename_input('Export database', f'*.{dbext}', f'{outpath}/{module.stem}.{dbext}')): + return + file = pathlib.Path(f) + logger.log_info(f'Exporting database: {file}') + + # Export symbols to x64dbg labels + db['labels'] = [ + { + 'text': symbol.name, + 'manual': not symbol.auto, + 'module': module.name.lower(), + 'address': '0x{:X}'.format(symbol.address - bv.start) + } + for symbol in bv.get_symbols() + ] + logger.log_debug('Label(s) exported: {}'.format(len(db['labels']))) + + s = Settings() + if s.get_bool('dd.comments'): + db['comments'] = [ + { + 'text': func.comments[address].replace('{', '{{').replace('}', '}}'), + 'manual': True, + 'module': module.name.lower(), + 'address': '0x{:X}'.format(address - bv.start) + } + for func in bv.functions for address in func.comments + ] + logger.log_debug('Comment(s) exported: {}'.format(len(db['comments']))) + + file.write_text(json.dumps(db)) + bv.file.database.write_global('x64dbg_db_save_path', str(file.parent)) + logger.log_info('Done!') + + +def import_db(bv): + """Import x64dbg database to Binary Ninja.""" + module = pathlib.Path(get_filename(bv)).name.lower() + + if not (f := get_open_filename_input('Import database', '*.dd{}'.format(bv.arch.default_int_size * 8))): + return + file = pathlib.Path(f) + logger.log_info(f'Importing database: {file}') + + db = json.load(file.open()) + + count = 0 + labels = db.get('labels', list()) + with bv.bulk_modify_symbols(): + for label in labels: + if label['module'] != module: + continue + address = int(label['address'], 16) + bv.start + if not (func := bv.get_function_at(address)): + continue + if func.name == label['text']: + continue + if func.symbol.type is SymbolType.LibraryFunctionSymbol and not s.get_bool('dd.libfs'): + continue + if func.symbol.type is SymbolType.ImportedFunctionSymbol and not s.get_bool('dd.impfs'): + continue + func.name = label['text'] + count += 1 + logger.log_debug('Label(s) imported: {}/{}'.format(count, len(labels))) + + count = 0 + comments = db.get('comments', list()) + for comment in comments: + if comment['module'] != module: + continue + address = int(comment['address'], 16) + bv.start + for func in bv.get_functions_containing(address): + func.set_comment_at(address, comment['text']) + count += 1 + logger.log_debug('Comment(s) imported: {}/{}'.format(count, len(comments))) + + logger.log_info('Done!') + + +def get_filename(bv): + """Returns the original filename for the current view.""" + if bv.project is not None: + return get_filename_for_project_file(bv, bv.file.original_filename) + + return bv.file.original_filename + + +def get_filename_for_project_file(bv, project_file_name): + """Returns the original filename of a project file""" + for file in bv.project.files: + if file.path_on_disk == project_file_name: + return file.name + + return None + + +def is_valid(bv): + """Determine if this is the correct arch.""" + if not bv.file.database: + return False + if bv.arch: + return 'x86' in bv.arch.name + else: + return False + + +PluginCommand.register('x64dbg\\Export database', 'Export x64dbg database', export_db, is_valid) +PluginCommand.register('x64dbg\\Import database', 'Import x64dbg database', import_db, is_valid) + +``` + +`plugin.json`: + +```json +{ + "pluginmetadataversion": 2, + "name": "x64dbgbinja", + "author": "x64dbg", + "type": [ + "sync" + ], + "api": [ + "python3" + ], + "description": "Official x64dbg plugin for Binary Ninja.", + "longdescription": "# x64dbgbinja\n\nOfficial x64dbg plugin for [Binary Ninja](https://binary.ninja).\n\n## Installation\n\nFrom the Plugins Menu, select \"Manage Plugins\". Search for \"x64dbgbinja\" and click the \"Install\" button.\n\n## Menu options\n\n### Import database\n\nImport comments/labels from an uncompressed x64dbg JSON database in Binary Ninja.\n\nSymbols for imported functions and or library functions can be overwritten via the \"Overwrite X\" entries in Settings.\n\n### Export database\n\nExport comments/labels to a JSON database that can be loaded by x64dbg.\n\nTo export labels only: uncheck \"Export Comments\" under \"x64dbg Database Export\" in Settings.\n", + "license": { + "name": "MIT", + "text": "MIT License\n\nCopyright (c) 2026 x64dbg\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n" + }, + "platforms": [ + "Darwin", + "Windows", + "Linux" + ], + "version": "2.0.9", + "minimumBinaryNinjaVersion": 6455 +} + +``` \ No newline at end of file