<summary> Close current process handle </summary>

<summary> Close handle </summary>

<summary> Make VAD region appear as PAGE_NO_ACESS to NtQueryVirtualMemory </summary> <param name="pid">Target process ID</param> <param name="base">Re

//////////////////////////////////////////////////////////////////////////////////////// Given a compressed integer(*pData), expand the compressed in

<summary> Add module to some loader structures (LdrpHashTable, LdrpModuleIndex( win8+ only ), InMemoryOrderModuleList( win7 only )) </summary> <param

<summary> Inject VEH wrapper into process Used to enable execution of SEH handlers out of image </summary> <param name="proc">Target process</param> <

<summary> Disable DEP for process Has no effect on native x64 processes </summary> <param name="pid">Target PID</param> <returns>Status code</returns>

<summary> Enumerate all open handles </summary> <returns>Found handles or status code</returns>

<summary> Enumerate committed, accessible, non-guarded memory regions </summary> <param name="pid">Target process ID</param> <param name="regions">Fou

<summary> Enumerate process modules </summary> <param name="result">Found modules</param> <param name="mtype">Module type: x86 or x64</param> <returns

<summary> Enumerate valid memory regions </summary> <param name="includeFree">If true - non-allocated regions will be included in list</param> <return

<summary> Debug thread </summary> <returns>Error code</returns>

<summary> Get thread exit code </summary> <returns>Thread exit code</returns>

<summary> Save eax value and terminate current thread </summary> <param name="pExitThread">NtTerminateThread address</param> <param name="resultPtr">M

<summary> Get list of manually mapped modules </summary> <returns>List of modules</returns>

<summary> Retrieve image TLS callbacks Callbacks are rebased for target image </summary> <param name="targetBase">Target image base</param> <param nam

<summary> Thread responsible for mapping and unmapping regions intercepted by remote hooks </summary>

<summary> Initialize COM classes </summary> <param name="path">Image file path</param> <returns>true on success</returns>

<summary> Initialize api set map </summary> <returns></returns>

<summary> Initialize debugger block g_KdBlock </summary>

<summary> Initialize structure for processor start/stop </summary> <param name="Info">>Processors data</param>

<summary> Inject image into target process </summary> <param name="path">Full-qualified image path</param> <param name="pStatus">Injection status code

<summary> Create module record in LdrpInvertedFunctionTable Used to create fake SAFESEH entries </summary> <param name="mod">Module data</param> <retu

<summary> Load symbol addresses from pattern scans </summary> <param name="ntdll32">Loaded x86 ntdll image</param> <param name="ntdll64">Loaded x64 nt

<summary> Load symbol addresses from PDBs </summary> <param name="ntdll32">Loaded x86 ntdll image</param> <param name="ntdll64">Loaded x64 ntdll image

<summary> Load ntdll images from the disk </summary> <returns>Loaded x86 and x64 ntdll</returns>

<summary> Map entire process address space </summary> <param name="mapSections">Set to true to map section objects. They are converted to private page

Try to map calc.exe into current process */

Try to map cmd.exe into current process from buffer */

<summary> Maps single memory region into current process </summary> <param name="pid">Target PID</param> <param name="base">Region base address</param

<summary> Fill OS-dependent patterns </summary> <param name="patterns">Pattern collection</param> <param name="result">Result</param>

<summary> Generate assembly code for remote call. </summary> <param name="a">Underlying assembler object</param> <param name="pfn">Remote function poi

<summary> Call NtQueryInformationProcess for underlying process </summary> <param name="infoClass">Information class</param> <param name="lpBuffer">Ou

<summary> NtQueueApcThread </summary> <param name="hThread">Thread handle.</param> <param name="func">APC function</param> <param name="arg">APC argum

ReadProcessMemory

<summary> Read process memory </summary> <param name="pid">Target PID</param> <param name="base">Target base</param> <param name="size">Data size</par

<summary> Reallocate existing block for new size </summary> <param name="size">New block size</param> <param name="desired">Desired base address of ne

<summary> Memory will not be deallocated upon object destruction </summary>

<summary> Removes VEH from target process </summary> <param name="proc">Target process</param> <param name="partial">Partial exception support</param>

<summary> Resolve virtual memory address to physical file offset </summary> <param name="Rva">Memory address</param> <param name="keepRelative">Keep a

<summary> Resume process </summary> <returns>Status code</returns>

<summary> Save return value and signal thread return event </summary> <param name="pSetEvent">NtSetEvent address</param> <param name="ResultPtr">Resul

<summary> Scan ntdll for internal loader data </summary> <param name="ntdll32">Mapped x86 ntdll</param> <param name="ntdll64">Mapped x64 ntdll</param>

<summary> Default pattern matching with wildcards. std::search is approximately 2x faster than naive approach. </summary> <param name="wildcard">Patte

<summary> Resume all stopped active processors </summary> <param name="Info">Processors data</param>

<summary> Stall all but current active processors </summary> <param name="Info">Processors data</param>

<summary> Suspend thread </summary> <returns>true on success</returns>

<summary> Terminate thread </summary> <param name="code">Exit code</param> <returns>Status code</returns>

<summary> Translate target address accordingly to current address space </summary> <param name="address">Address to translate</param> <param name="res

<summary> Unlink module from Ntdll loader </summary> <param name="mod">Module data</param> <param name="noThread">Don't create new threads during unli

<summary> Unlink module from most loader structures </summary> <param name="mod">Module to unlink</param> <returns>true on success</returns>

<summary> Free static TLS </summary> <param name="mod">Target module</param> <param name="noThread">Don't create new threads during remote call</param

<summary> Unmap memory of the target process from current </summary> <param name="pid">Target PID</param> <returns>Status code</returns>

<summary> Unmap single memory region If unmapped region size is smaller than the size specified during map, function will return info about 2 regions

<summary> Exception handler </summary> <param name="ExceptionInfo">The exception information</param> <returns>Handling status</returns>

<summary> Free virtual memory </summary> <param name="lpAddress">Memory address</param> <param name="dwSize">Region size</param> <param name="dwFreeTy

<summary> Change memory protection </summary> <param name="lpAddress">Memory address.</param> <param name="dwSize">Region size</param> <param name="fl

WriteProcessMemory

<summary> Write virtual memory </summary> <param name="lpBaseAddress">Memory address</param> <param name="lpBuffer">Buffer to write</param> <param nam

\internal Add jump-flow data to the jcc flow list.