insert a new section in our structure

Allocates storage for the Instruction class.

Allocates storage for the Instruction class.

Check if the instuction at "eip" which writes at "addr" is filtered based on the active filters(i.e. stack,teb) **/

check if the current instruction is a write instruction

Lauch external tool ScyllaDumper to dump the process with PID pid scylla: string containing the path to the scyllaDumper executable pid: pid of the

load scylla dll and expose some of its functions as public attribute of the class we have to use loadLibrary and GetProcAddress because PIN doesn't su

Allocates storage for the operand instance structure.

Allocates storage for the operand instance structure.

search if we have a patch for the current instruction and if yes insert the patch in the next round

read memory from the process specified hProcess : Handle of the process we want to read memory from address : the starting reading address size : how

read memory from the process specified hProcess : Handle of the process we want to read memory from address : the starting reading address size : how

Entry point of the plugin This function will be called PINdemonium

only needed in windows xp

Set the filter which will be activated stack: filter all instructions which belong to libraries and write on the stack teb: filter all instructions

https://github.com/upcaste/upcaste/blob/master/src/upcore/src/cstring/strnpbrk.cpp

write buffer to the process memory hProcess : Handle of the process we want to write the memory address : the starting writing address size : how man

at the first time open the log file

connect debug