Lower-case hash of path string.

Lower-case hash of string.

Wad archive.

Container for unhashed

Fopen hook payload, allocated in target process. This is too big to fit in any code cave.

Import stub for fopen, used to call fopen_hook. This will overwrite original fopen stub.

A function that always returns true, used to bypass wad_verify. Followed by a pointer to fopen_hook. We place this in executable because we need to be

mixed-endian uint24_t with no alignment requirements