insert a breakpoint on the current instruction

Dump the current process memory and try to reconstruct the PE from the dump using "oep" as Original Entry Point **/

Dump on disk the memory range written on the remote process address space with return a string containing the path of the dumped memory **/

- if an exception is found returns all the information about it (DEBUG purposes)

Executes the heuristics on the dumped memory */

F, G, H and I are basic MD5 functions.

FF, GG, HH, and II transformations for rounds 1, 2, 3, and 4. Rotation is separate from addition to prevent recomputation.

This function is called when the application exits - print out the information relative to the current run

Get the Base Address(0x00400000) of the Process running with pid dwProcessId **/

Extract the .EXE file which has lauched the process having PID pid **/

Initializes the dasm classes.

Initializes the dasm classes.

trigger the instrumentation routine for each instruction

REMEMBER!!! : PIN wants a function pointer in the AFUNCPTR agument!!! avoid the detection of the debugger replacing the function IsDebuggerPresent() w

In order to avoid obsidium to take the path of the 'or byte ptr [esp+0x1],0x1'

at the first time open the log file

at the first time open the log file

at the first time open the log file

default ctor, just initailize

Avoid PIN detection through NtQueryInformationProcessHook

Avoid Pin detection based on NtSystemQueryInformation