<summary> Gets all process threads </summary> <returns>Threads collection</returns>

Get allocable input registers (mask).

Get comment string.

Get instruction group, see \ref kX86InstEncodingId.

<summary> Get main process thread </summary> <returns>Pointer to thread object, nullptr if failed</returns>

Get stack size used by mov sequences in prolog/epilog.

Get operands list.

Get the output register index or `kInvalidReg`.

Get stack size used by push/pop sequences in prolog/epilog.

Get immediate value as 32-bit unsigned integer.

Get hint value.

Get whether the _funcFlags has `flag`

Get whether the node has variable liveness bits.

Format help message

Get whether the type of the memory operand is either `kMemTypeBaseIndex` or `kMemTypeStackIndex`.

Get whether the register is Gp dword (32-bit) register.

Get whether the register is Gp word (16-bit) register.

Get whether register code is equal to `type`.

Get whether the node has been translated.

Pop item from front. If there are no elements in the container, the behavior is undefined.

\internal Single rotation.

Set comment string to `str`.

Set mandatory input registers (mask).

<summary> Allocate kernel memory and map into User space. Or free previously allocated memory </summary> <param name="pProcess">Target process object<

<summary> Search process entry in list by PID </summary> <param name="pid">PID.</param> <param name="asHost">If set to TRUE, pid is treated as host PI

<summary> Map kernel page into current process address space </summary> <param name="pMDL">Page MDL</param> <param name="pResult">Mapped address</para

<summary> Allocate new Unicode string from Paged pool </summary> <param name="result">Resulting string</param> <param name="size">Buffer size in bytes

<summary> Allocate and copy string </summary> <param name="result">Resulting string</param> <param name="source">Source string</param> <returns>Status

<summary> Get rid of EXECUTABLE flag if DEP isn't enabled </summary> <param name="prot">Memory protection flags</param> <param name="bDEP">DEP flag</p

<summary> Create the thread. </summary> <param name="threadProc">Thread enty point</param> <param name="arg">Thread argument.</param> <param name="fla

<summary> Detach form current process, if any </summary> <returns>Status code</returns>

<summary> Retrieve data directory address </summary> <param name="index">Directory index</param> <param name="keepRelative">Keep address relative to i

<summary> Create new thread and execute code in it. Wait until execution ends </summary> <param name="pCode">Code to execute</param> <param name="size

<summary> Get page hardware PTE. Address must be valid, otherwise bug check is imminent </summary> <param name="pAddress">Target address</param> <retu

<summary> Gets SSDT base - KiServiceTable </summary> <returns>SSDT base, NULL if not found</returns>

<summary> Hook function </summary> <param name="ptr">Target function address</param> <param name="hkPtr">Hook function address</param> <param name="ty

<summary> Join thread </summary> <param name="timeout">Join timeout</param> <returns>true on success</returns>

<summary> Load image from file </summary> <param name="path">File path</param> <param name="skipActx">If true - do not initialize activation context</

<summary> Manually map PE image into underlying target process </summary> <param name="path">Image path</param> <param name="flags">Image mapping flag

<summary> Remove list entry </summary> <param name="Entry">Entry link</param>

<summary> Setup one of the 4 possible memory hooks: </summary> <param name="hkType"> Type of hook to install MemVirtualAlloc - hook NtAllocateVirtualM

Append `c` of `len`.

create new logger with same sinks and configuration.

Lexicographically compare this string reference to other.

Colour::LightGrey

enqueue immediately. overrun oldest message in the queue if no room left.

Various fast log computations.