CountLeadingZeros_32 - this function performs the platform optimal form of counting the number of zeros from the most significant bit to the first one

Calls all registered destructors

Sets a break point that works only when a debugger is present _Use_decl_annotations_*/

PFN -> VA

Executes VMCALL

Reads 64bit-width VMCS

Selects a register to be used based on the index

look for @id in @insns, given its size in @max. first time call will update @cache. return 0 if not found

Returns true when a system is on the x86 PAE mode _Use_decl_annotations_*/

Indicates successful VMCALL

malloc()

Frees all used EPT entries by walking through whole EPT

Terminates a log file related code.

Checks if list of addresses

Terminates utility functions

Adjust the requested control value with consulting a value of related MSR

getSOImmValRotate - Try to handle Imm with an immediate shifter operand, computing the rotate amount to use. If this immediate value cannot be handle

getT2SOImmValSplat - Return the 12-bit encoded representation if the specified value can be obtained by splatting the low 8 bits into every other byte

FIXME: push {r1, r2, r3, ...} can exceed the number of operands in MCInst struct

result must be a big enough buffer: 128 bytes is more than enough

getShiftValue - Extract the shift value.

===--------------------------------------------------------------------===// Addressing Mode #2 ===---------------------------------------------------

Hacky: enable all features for disassembler

Returns an EPT pointer from ept_data

Initialize an EPT entry with a "pass through" attribute

_Use_decl_annotations_*/

Unregister power callback

map internal raw register to 'public' register

Returns the physical memory ranges _Use_decl_annotations_*/

A wrapper of MmGetSystemRoutineAddress

Loads the PDPTE registers from CR3 to VMCS

Returns a kernel CR3 value of the current process; _Use_decl_annotations_*/

Prints the shift value with an immediate value.

printf()

translateShiftImm - Convert shift immediate from 0-31 to 1-32 for printing. getSORegOffset returns an integer from 0-31, representing '32' as 0.

return a string representing the number X NOTE: caller must free() the result itself to avoid memory leak