============================================================ simplify_type: convert MSVC verbose types to compilable C++ =============================

Get a pointer from an RVA

Split by :: respecting template depth

Remove all occurrences of a whole word

Read imported DLL names

============================================================ Main analysis function ============================================================

============================================================ Filter P/Invoke targets: remove system DLLs Called after DotNet::Analyze() since Is_Syste

Format bytes to human-readable string: "18.3MB", "956KB", "1.2GB"

============================================================ Export table viewer — now outputs both decorated + undecorated Returns vector of Exported

Extract return type from first scope part (e.g. "int WaCache" → "int", "WaCache")

Get data directory RVA (handles 32/64 bit)

============================================================ .NET single-file analysis output (for -i and -d auto-detect) ============================

============================================================ Generate hijack config + payload source into infos/ subdirectory Uses AppDomainManager in

Calculate total size of a directory in bytes

============================================================ Get the signer name from a signed file Returns empty string if unsigned or on error =====

============================================================ Check if a .NET exe has any exploitable vectors =========================================

============================================================ System assembly filter ============================================================

============================================================ Read a 2 or 4 byte index from a buffer ==================================================

============================================================ Read string from #Strings heap ==========================================================

charToWChar: ANSI to wide string conversion

============================================================ Parse comma-separated params respecting template depth ==================================

Recursively copy non-system DLL dependencies up to maxDepth levels sourceDir: original exe/dll directory (for finding DLLs) targetDir: Eyebin output d

============================================================ .NET exe output: scan mode — copy exe + write Info.txt Output folder: Eyebin/Dll/{arch}/{

Search for a DLL starting from baseDir, then walking up parent directories Returns the full path if found, or empty path if not found maxDepth: how ma

============================================================ -d command: Generate 3 proxy DLL templates at once 1. <name>_exports.cpp — extern "C"

============================================================ Compute column width in bytes ===========================================================

============================================================ Compute row size for a table ============================================================

============================================================ Check if a file is signed by Microsoft ==================================================

============================================================ Import table viewer — fixed for 64-bit thunk data =======================================

Parse -t value into ScanType bitmask

SEH wrapper per file — access violation on one file won't kill the scan

============================================================ Process a single exe file (extracted for SEH protection) ================================

Separate function for Phase 3 so SEH can wrap it

SEH wrapper

============================================================ View imported DLLs — uses PEFile RAII, fixed bool reuse =================================

Check if any parameter or return type would cause mangling mismatch

Find top-level '(' — skip template brackets, respect operator< etc.

Check if string matches pattern \w+::\w+::\w+ (3-level nesting)

============================================================ parse_export: parse one undecorated export name =========================================

============================================================ Post-processing: fix compilation issues =================================================

Read DLL name from export directory

Read exported functions (both decorated and undecorated names)

============================================================ Topological sort for class definitions ==================================================

============================================================ Write export info to file (for infos/ directory in scan mode) ===========================

Get a pointer at a raw file offset

Convert RVA to file offset. With SEC_IMAGE mapping, RVA == offset (no conversion needed).