<summary> Process termination handler </summary> <param name="ParentId">Parent PID</param> <param name="ProcessId">PID</param> <param name="Create">TR

<summary> Restore SSDT hook </summary> <param name="index">SSDT index to restore</param> <param name="origAddr">Original function address</param> <ret

*/

<summary> Setup exception upon function return </summary> <param name="ExceptionInfo">The exception information</param>

<summary> Build remote hook function </summary> <param name="opType">Hooked function</param>

<summary> Build hook trampoline </summary> <param name="opType">Hooked function type</param> <param name="pOriginal">Original function ptr</param> <pa

<summary> Check if last instruction caused branching </summary> <param name="ctx">Current hook info</param> <param name="ip">Instruction pointer</para

<summary> Remove any traces from remote process </summary> <returns></returns>

<summary> Initialize DIA </summary> <returns>Status code</returns>

<summary> Hide memory VAD node </summary> <param name="imageMem">Image to purge</param> <returns>Status code</returns>

<summary> Copy executable code into remote codecave for future execution </summary> <param name="pCode">Code to copy</param> <param name="size">Code s

<summary> Copies image into target process </summary> <param name="pImage">Image data</param> <returns>Status code</returns>

<summary> Copy original function bytes </summary> <param name="Ptr">Origianl function address</param>

uncompress encoded element type

Return true if element type is a modifier, i.e. ELEMENT_TYPE_MODIFIER bits are turned on. For now, it is checking for ELEMENT_TYPE_PTR and ELEMENT_TYP

return true if it is a primitive type, i.e. only need to store CorElementType

uncompress encoded element type

Compress a pointer (used for internal element types only, never for persisted signatures).

compress a signed integer The least significant bit of the first compress byte will be the signed bit.

compress a token The least significant bit of the first compress byte will indicate the token type.

Uncompress a pointer (see above for comments).

uncompress a signed integer

uncompress a token

Given a compress byte (*pData), return the size of the uncompressed data.

<summary> Create event to synchronize APC procedures </summary> <param name="threadID">The thread identifier.</param> <returns>Status code</returns>

<summary> Create activation context Target memory layout: ----------------------------- | hCtx | ACTCTX | file_path | ----------------------------- </

<summary> Creates new thread in the remote process </summary> <param name="hThread">Created thread handle</param> <param name="entry">Thread entry poi

<summary> Create worker RPC thread </summary> <returns>Thread ID</returns>

<summary> Remove custom exception handler </summary> <param name="pImage">image data</param> <returns>true on success</returns>

<summary> Temporarily disable hook </summary> <returns>true on success</returns>

<summary> DllCharacteristics field of header </summary> <returns>DllCharacteristics</returns>

*/

Create a new `EmbedNode` instance.

<summary> Set custom exception handler to bypass SafeSEH under DEP </summary> <param name="pImage">image data</param> <returns>true on success</return

<summary> Enable disabled hook </summary> <returns>true on success</returns>

<summary> Does nothing under x86 </summary> <param name="">Unused</param>

<summary> Stop process debug </summary>

<summary> Debug selected process </summary> <returns>true on success</returns>

<summary> Search for process by executable name </summary> <param name="name">Process name. If empty - function will retrieve all existing processes</

<summary> Search for process by executable name or by process ID </summary> <param name="pid">Target process ID. rocess name. If empty - function will

<summary> Enum pages containing valid PE headers </summary> <param name="result">Found modules</param> <returns>Sections count</returns>

<summary> Enumerate valid memory regions </summary> <param name="includeFree">If true - non-allocated regions will be included in list</param> <return

<summary> Enum process section objects </summary> <param name="result">Found modules</param> <returns>Sections count</returns>

<summary> Wrapper for debug event thread </summary> <param name="lpParam">RemoteHook pointer</param> <returns>Status code</returns>

<summary> Save rax value and terminate current thread </summary> <param name="pExitThread">NtTerminateThread address</param> <param name="resultPtr">M

<summary> Lookup handle in the process handle table </summary> <param name="HandleTable">Handle table</param> <param name="tHandle">Handle to search f

<summary> Check if file exists </summary> <param name="path">Full-qualified file path</param> <returns>true if exists</returns>

<summary> Return existing or load missing dependency </summary> <param name="pImage">Currently napped image data</param> <param name="path">Dependency

<summary> Get existing module or map it if absent </summary> <param name="path">Image path</param> <param name="buffer">Image data buffer</param> <par

<summary> Format string </summary> <param name="fmt">Format specifier</param> <param name="">Arguments</param> <returns>Formatted string</returns>

<summary> Free memory </summary> <param name="pAddr">Memory address to release.</param> <param name="size">Region size</param> <param name="freeType">