PA -> PFN

VA -> PFN

given internal insn id, return public instruction info

Allocates a non-paged, page-aligned page. Issues bug check on failure

_Use_decl_annotations_*/

Gets the current time using \a query_time_routine. @param collector PerfCollector instance to store performance data @param query_time_routine A fun

_Use_decl_annotations_*/

Power callback routine dealing with hibernate and sleep

/

Gets the current time using the RDTSC instruction @return the current time

/

Make all non-executable for MONITOR

Clear access bits for the Default EPT Set access bits only for the EPT with isolated driver and clear bits for all other EPTs

Clear access bits for the Default EPT Set access bits only for the EPT with isolated driver and clear bits for all other EPTs

Make Protected Drivers ranges non-executable for the default pages and executable for ProtectedDrivers-pages

Make System ranges executable for the default pages and executable for ProtectedDrivers-pages

Acquires a lock using \a lock_routine. @param lock_routine A function pointer for acquiring a lock @param leave_routine A function pointer for releas

Enables page shadowing for all hooks

given internal insn id, return public instruction info

given internal insn id, return public instruction info

Sets certain drivers as source ranges

DbgPrints when a process is created

Debug prints registers

Does RtlCopyMemory safely even if destination is a read only region

Executes the INVVPID instruction (type 1)

Return true if the given address is accessible.

Return true if the given address is executable.

Writes natural-width MSR

/

A fake RtlPcToFileHeader without acquiring PsLoadedModuleSpinLock. Thus, it is unsafe and should be updated if we can locate PsLoadedModuleSpinLock.

_Use_decl_annotations_*/

Handle VMRESUME or VMXOFF failure. Fatal error.

Allocates structures for virtualization, initializes VMCS and virtualizes the current processor

Sets 1 to the lock bit of the IA32_FEATURE_CONTROL MSR

Stops virtualization through a hypercall and frees all related memory

given internal insn id, return public instruction info

stw sed, sp[3]

map internal raw register to 'public' register