insert the mmory range in the current list of memory ranges detected on the heap

if !defined(JSON_USE_INT64_DOUBLE_CONVERSION)

Returns true if ch is a control character (in range [1,31]).

check if the address belong to a Library */ TODO add a whiitelist of Windows libraries that will be loaded

Converts an unsigned integer to string. * @param value Unsigned interger to convert to string * @param current Input/Output string buffer. *

Function which reconstruct the Import Directory of a memory dump iatAddr: address of the IAT iatSize: size of the IAT dwProcessID: PID of the process

Close the report for the current Dump and write the results on file */

Create the DumpReport with initial information about the dump

Create a new class and take care of decrementing references. */

Create a new class and take care of decrementing references. */

Create an "Operand" Python object from an OPERAND structure. */

Create an "Operand" Python object from an OPERAND structure. */

Function used to dump the process indicated by the pid */

Fill an INSTRUCTION structure from the data in an "Instruction" Python object. */

Fill an INSTRUCTION structure from the data in an "Instruction" Python object. */

* This function is quite complex.. I'm not perfectly happy * with the logic yet. Anyway, the idea is to * * - check out modrm and sib * - based on

* This function is quite complex.. I'm not perfectly happy * with the logic yet. Anyway, the idea is to * * - check out modrm and sib * - based on

Allocates and initializes an instance of the Operand class.

Allocates and initializes an instance of the Operand class.

write buffer to the process memory hProcess : Handle of the process we want to write the memory address : the starting writing address size : how man

return the entropy value of the entire program

Extract the .EXE file which has lauched the process having PID pid **/

get the first scratch register available we build a vector in order to deal with multiple read operand

add library in a list sorted by address **/

Converts a unicode code-point to UTF-8.

remove a specific memory range from the heap list

Duplicates the specified string value. * @param value Pointer to the string to duplicate. Must be zero-terminated if * length is "unkno

* Search a memory region for a byte pattern and return the address */

* Search a memory region for a byte pattern and return the address */

Take the number of the sections from the PE file */

retrieve the name of the current section