This class provides extra pattern finding templates for VM analysis, by matching registers to a vm_state structure.

This class walks over instruction_stream to provide analysis capabilities. These include template pattern matching, arithmetic expresion generation, a

This struct describes an arithmetic operation instance, containing a backing descriptor and any operand arguments.

This struct represents a fully-formed virtual instruction instance, containing all decoded information required for full execution, including VIP-deri

This struct describes an expression instance containing numerous arithmetic_operation's in a specific order. It allows for computation of an output gi

This struct describes an arithmetic operation descriptor, outlining any of its semantics.

This class provides a very lightweight thread-safe wrapper over capstone.

Specifies the desired behaviour of the auto disassembler when a jump condition is encountered

This class provides a simple wrapper over the cs_insn and cs_detail structs to make it self-containing, and to provide some simple utilities.

This class spans over an ordered vector of instructions. It contains an index to determine the current position in the stream.

This struct represents a single routine to be lifted.

Describes data retrieved from a code scan.

This struct represents the virtual machine handler and entry "bridge", which is responsible for advancing the context by computing the next handler an

This class describes the virtual machine's execution at any single moment.

Specifies the direction of the Fetch->Decode->Execute loop.

This struct describes any virtual machine handler, responsible for executing an instruction.

This class describes a single VMProtect virtual machine instance.

This struct describes a virtual machine instruction and its semantics.

Describes flags for information required by the instruction parser.

This struct describes the virtual instruction's instace information. It describes properties such as the operands and sizes. It does not hold any VIP-

Describes a single virtual instruction operand.

The type of the operand.

This struct describes the current translation state of the virtual machine ie. the assignation of registers, the vip direction, and the handler offset

This struct represents the information returned by vmentry stub analysis.

This class is the root object, controlling all other interfaces.