<summary> Retrieve image TLS callbacks Callbacks are rebased for target image </summary> <param name="targetBase">Target image base</param> <param nam

<summary> Thread responsible for mapping and unmapping regions intercepted by remote hooks </summary>

<summary> Initialize COM classes </summary> <param name="path">Image file path</param> <returns>true on success</returns>

<summary> Initialize api set map </summary> <returns></returns>

<summary> Initialize debugger block g_KdBlock </summary>

<summary> Initialize structure for processor start/stop </summary> <param name="Info">>Processors data</param>

<summary> Inject image into target process </summary> <param name="path">Full-qualified image path</param> <param name="pStatus">Injection status code

<summary> Create module record in LdrpInvertedFunctionTable Used to create fake SAFESEH entries </summary> <param name="mod">Module data</param> <retu

<summary> Load symbol addresses from pattern scans </summary> <param name="ntdll32">Loaded x86 ntdll image</param> <param name="ntdll64">Loaded x64 nt

<summary> Load symbol addresses from PDBs </summary> <param name="ntdll32">Loaded x86 ntdll image</param> <param name="ntdll64">Loaded x64 ntdll image

<summary> Load ntdll images from the disk </summary> <returns>Loaded x86 and x64 ntdll</returns>

<summary> Map entire process address space </summary> <param name="mapSections">Set to true to map section objects. They are converted to private page

Try to map calc.exe into current process */

Try to map cmd.exe into current process from buffer */

<summary> Maps single memory region into current process </summary> <param name="pid">Target PID</param> <param name="base">Region base address</param

<summary> Fill OS-dependent patterns </summary> <param name="patterns">Pattern collection</param> <param name="result">Result</param>

<summary> Parses PE image </summary> <returns>Status code</returns>

<summary> Generate assembly code for remote call. </summary> <param name="a">Underlying assembler object</param> <param name="pfn">Remote function poi

<summary> Call NtQueryInformationProcess for underlying process </summary> <param name="infoClass">Information class</param> <param name="lpBuffer">Ou

<summary> NtQueueApcThread </summary> <param name="hThread">Thread handle.</param> <param name="func">APC function</param> <param name="arg">APC argum

ReadProcessMemory

<summary> Read process memory </summary> <param name="pid">Target PID</param> <param name="base">Target base</param> <param name="size">Data size</par

<summary> Reallocate existing block for new size </summary> <param name="size">New block size</param> <param name="desired">Desired base address of ne

<summary> Memory will not be deallocated upon object destruction </summary>

<summary> Removes VEH from target process </summary> <param name="proc">Target process</param> <param name="partial">Partial exception support</param>

<summary> Resolve virtual memory address to physical file offset </summary> <param name="Rva">Memory address</param> <param name="keepRelative">Keep a

<summary> Resume process </summary> <returns>Status code</returns>

<summary> Save return value and signal thread return event </summary> <param name="pSetEvent">NtSetEvent address</param> <param name="ResultPtr">Resul

<summary> Scan ntdll for internal loader data </summary> <param name="ntdll32">Mapped x86 ntdll</param> <param name="ntdll64">Mapped x64 ntdll</param>

<summary> Default pattern matching with wildcards. std::search is approximately 2x faster than naive approach. </summary> <param name="wildcard">Patte

<summary> Search pattern in remote process </summary> <param name="remote">Remote process</param> <param name="wildcard">Pattern wildcard</param> <par

<summary> Resume all stopped active processors </summary> <param name="Info">Processors data</param>

<summary> Stall all but current active processors </summary> <param name="Info">Processors data</param>

<summary> Suspend thread </summary> <returns>true on success</returns>

<summary> Terminate thread </summary> <param name="code">Exit code</param> <returns>Status code</returns>

<summary> Translate target address accordingly to current address space </summary> <param name="address">Address to translate</param> <param name="res

<summary> Unlink module from Ntdll loader </summary> <param name="mod">Module data</param> <param name="noThread">Don't create new threads during unli

<summary> Unlink module from most loader structures </summary> <param name="mod">Module to unlink</param> <returns>true on success</returns>

<summary> Free static TLS </summary> <param name="mod">Target module</param> <param name="noThread">Don't create new threads during remote call</param

<summary> Unmap memory of the target process from current </summary> <param name="pid">Target PID</param> <returns>Status code</returns>

<summary> Unmap single memory region If unmapped region size is smaller than the size specified during map, function will return info about 2 regions

<summary> Exception handler </summary> <param name="ExceptionInfo">The exception information</param> <returns>Handling status</returns>

<summary> Free virtual memory </summary> <param name="lpAddress">Memory address</param> <param name="dwSize">Region size</param> <param name="dwFreeTy

<summary> Change memory protection </summary> <param name="lpAddress">Memory address.</param> <param name="dwSize">Region size</param> <param name="fl

WriteProcessMemory

<summary> Write virtual memory </summary> <param name="lpBaseAddress">Memory address</param> <param name="lpBuffer">Buffer to write</param> <param nam

\internal Add jump-flow data to the jcc flow list.

\internal Add unreachable-flow data to the unreachable flow list.

\internal

\internal

\internal

\internal

Create a dummy Fp register.

Create a dummy K register.

Create a dummy Mm register.

Create a dummy Xmm register.

Create a dummy Ymm register.

\internal

Set function `flag`.

Add a home register index to the home registers mask.

Add number of jumps to this target.