Getter to the handle.

Attempts to generate structures from the provided call EA and instruction_stream of a VMP import stub. Returns empty {} if the import stub failed anal

Retrieves the module base from the given remote ea.

Attempts to convert the provided call to the VMP import stub to a direct import thunk call to the specified remote thunk ea.

Disassembles at the offset from the base, negotating jumps according to the flags. NOTE: The offset is used for the disassembled instructions' address

Returns the export name (if available) and ordinal.

Determines the RVA at which the last section of the virtual image provided ends.

Lifts the instruction stream to VTIL.

Attempts to parse the given argument list into vmpdump settings.

Scans the specified code range for any import calls and imports. resolved_imports is a map of { import thunk rva, import structure }.

Searches for a module where the provided remote ea is within the module's address space, then returns a module_view of that module.

Converts the given virtual image to a raw-byte image.

Get the stream base

Returns a byte vector of all the instructions' bytes.

Commits any local module changes back to the target process.

Cannot be copied or moved. Only one disassembler can exist per thread.

Disassembles at the offset from the base, simply disassembling every instruction in order.

Fetches any remote module changes back to the local module buffer.

Creates a vmpdump class from the given process id and target module name. If module_name is empty "", the process module is used. If the process canno

Attempts to generate a stub in a code cave which jmps to the given thunk. Returns the stub rva.

Gets the register's largest architecture equivalent.

Returns a vector of registers this instruction writes to and reads from. Read is returned in the first part of the pair, Written in the second.

Constructor.

Copy constructor.

Default constructor / move / copy.

Is the instruction a conditional jump?

Determines whether this instruction is any type of jump.

Constructor, automatically fetching the remote module's bytes.

Advances the stream, incrementing index and returning the instruction ptr.

Useful utilities.

Determines whether or not the register's bases are equal. e.g. RAX == AH, as base( RAX ) == AL, and base( AH ) == AL.

Resets index to 0

Enum -> String

Constructor.

Disassembler bases instructions via RVA, thus base == rva.

Disallow construction + copy.

Determined whether the provided remote ea is within module bounds.