Swap two registers It's only possible to swap Gp registers.

\internal Helper to avoid `#ifdef`s in the code.

<summary> Hook specified address </summary> <param name="type">Hook type</param> <param name="ptr">Address</param> <param name="newFn">Callback</param

<summary> Allocate kernel page from NonPaged pool and build MDL for it </summary> <param name="pPage">Resulting address</param> <param name="pResultMD

<summary> Convert protection flags </summary> <param name="prot">Protection flags.</param> <param name="fromPTE">If TRUE - convert to PTE protection,

<summary> Setup image security cookie </summary> <param name="imageBase">Image base</param> <returns>Status code</returns>

<summary> Check if file exists </summary> <param name="path">Fully qualifid path to a file</param> <returns>Status code</returns>

<summary> Map new module or return existing </summary> <param name="pProcess">Target process</param> <param name="path">Image path</param> <param name

<summary> Get region VAD type </summary> <param name="pProcess">Target process object</param> <param name="address">Target address</param> <param name

<summary> Find first thread of the target process </summary> <param name="pProcess">Target process</param> <param name="ppThread">Found thread. Thread

<summary> Map memory regions into caller process </summary> <param name="pList">Region list</param> <param name="noWarning">If set to FALSE, warning w

<summary> Create activation context </summary> <param name="pPath">Manifest path</param> <param name="asImage">Target file is a PE image</param> <para

<summary> Walk region list and create MDL for each region </summary> <param name="pList">Region list</param> <param name="pProcess">Target process</pa

<summary> Resolve image name to fully qualified path </summary> <param name="pContext">Loader context</param> <param name="pProcess">Target process. M

<summary> Resolve import table and load missing dependencies </summary> <param name="pImageBase">Target image base</param> <param name="systemImage">I

<summary> Search for pattern </summary> <param name="pattern">Pattern to search for</param> <param name="wildcard">Used wildcard</param> <param name="

<summary> Unmap memory region, release corresponding MDL, and remove region form list </summary> <param name="pPageEntry">Region data</param> <param n

//////////////////////////////////////////////////////////////////////////////////////// Given an uncompressed unsigned integer (iLen), Store it to p

<summary> Creates new thread in the remote process </summary> <param name="hThread">Created thread handle</param> <param name="entry">Thread entry poi

<summary> Get data directory size </summary> <param name="index">Data directory index</param> <returns>Data directory size</returns>

<summary> Ensure LdrInitializeProcess gets called </summary> <returns>Status code</returns>

<summary> Free virtual memory </summary> <param name="pid">Tarhet PID</param> <param name="base">Desired base. If 0 address is chosed by the system</p

<summary> Retrieve last NTSTATUS code </summary> <returns></returns>

<summary> Get WOW64 thread context </summary> <param name="hThread">Thread handle.</param> <param name="ctx">Thread context</param> <returns>Status co

<summary> Initialize symbols for target file </summary> <param name="file">Fully qualified path to target PE file</param> <param name="base">Base ptr

begin_rebase

<summary> Maps target process memory into current process </summary> <param name="pid">Target PID</param> <param name="pipeName">Pipe name to use for

<summary> Parses PE image </summary> <returns>Status code</returns>

<summary> Change handle access rights </summary> <param name="pid">Target PID.</param> <param name="handle">Handle</param> <param name="access">New ac

<summary> Change memory protection </summary> <param name="pid">Target PID.</param> <param name="base">Regiod base address</param> <param name="size">

<summary> Change process protection flag </summary> <param name="pid">Target PID</param> <param name="protection">Process protection policy</param> <p

<summary> Get memory region info </summary> <param name="pAddr">Memory address</param> <param name="pInfo">Retrieved info</param> <returns>Status</ret

<summary> Save value in rax to user buffer </summary> <param name="a">Target assembly helper</param>

<summary> Search pattern in whole address space of remote process </summary> <param name="remote">Remote process</param> <param name="useWildcard">Tru

<summary> Set WOW64 thread context </summary> <param name="hThread">Thread handle.</param> <param name="ctx">Thread context</param> <returns>Status co

<summary> Unmap all manually mapped modules </summary> <returns>Status code</returns>

\internal

\internal

\internal

\internal

Compare two instruction names. `a` is null terminated instruction name from `_x86InstName[]` table. `b` is non-null terminated instruction name passe

* Get the absolute value of a 64 bit int. * * @param x The value to process. * @return The absolute, unsigned value. * * This gracefully deals w

\internal Set `len` bits in `buf` starting at `index` bit index.

Add allocable input registers (mask).

Add emit options.

Get new memory operand adjusted by `disp`.

And allocable input registers (mask).