Clear the currentWriteSet for injection in pid different from current programs

Create an "Inst" Python object from an INST structure. */

Create an "Inst" Python object from an INST structure. */

Create an "Instruction" Python object from an INSTRUCTION structure. */

Create an "Instruction" Python object from an INSTRUCTION structure. */

Fill an INST structure from the data in an "Inst" Python object. */

Fill an INST structure from the data in an "Inst" Python object. */

000000014000F9E1 4C 8D 1D AE FF FF FF lea r11, off_14000F996 ;dll base 000000014000F9E8 4C 8B D0 mov r10, rax

000000014000F9E1 4C 8D 1D AE FF FF FF lea r11, off_14000F996 ;dll base 000000014000F9E8 4C 8B D0 mov r10, rax

Change ',' to '.' everywhere in buffer. * * We had a sophisticated way, but it did not work in WinCE. * @see https://github.com/open-source-parsers

* Resolve PESpin Api String to VA */

* Resolve PESpin Api String to VA */

* Api name hash function at VA 14000FBEC * * Start: 000000014000FBEC 52 push rdx * End: 000000014000FC10 C3

* Api name hash function at VA 14000FBEC * * Start: 000000014000FBEC 52 push rdx * End: 000000014000FC10 C3

return the current date and time as a string

return the current date and time as a string

hijack the write operation

return the section's name where the IP resides

return the WriteItem index inside our vector that broke the W xor X index

check if the current instruction is a pushad or a popad if so then set the proper flags in ProcInfo

scan the image and try to hook all the function specified above

- if the flag is pecified start pin as launched with the flag appdebug

Init the module, set constants. */

Init the module, set constants. */