Primitives for generic use.

Imports a public symbol by its name.

Fully tiable.

String converison.

Helpers to check thread state.

Adds an NT image.

Physical memory allocation / deallocation.

Size helpers.

combines two states together.

Doesn't really exist.

Getter/setter for the thread context pointer.

With interrupts disabled, looks up a PTE and invokes virtual fault if it does not exist in a loop until we can get a hard PTE. - Must be called with i

Finds a process in the trace list and returns the entry with the list lock.

Takes a physical address and the number of pages, frees the whole range.

Unwind info getter.

Returns the default policy for a given image entry.

Image name helpers.

Quick helper to get loader group.

Includes a single object file, skips if already included, if the context has any unresolved public symbols, tries to import them from the library cach

Event utils.

Basic properties.

Returns true if process is traced.

Lock free and faster implementation of is_trapped, only returns a boolean.

Standalone function to get the keyword.

Spin locks:

Locks an image into memory.

Wrapper for the encryption.

Bitwise operators.

Kernel-mode GS structures.

Consumes the argument / relocation.

Thread stack information.

Resolves a handle within the context of a handle table; acquires the lock before returning if non-null.

-- Miniports.

Reference counting.

Reset release and destructor.

Virtual address range allocation / deallocation, 2MB granularity.