From 7f07503bb816bbec14409f0bd7c46e4a48d7f072 Mon Sep 17 00:00:00 2001 From: joney Date: Sat, 26 Dec 2020 07:28:06 +0800 Subject: [PATCH] =?UTF-8?q?x64dbg=E6=8F=92=E4=BB=B6=E5=AE=9E=E7=8E=B0?= =?UTF-8?q?=E4=BB=A3=E7=A0=81?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- BrachTraceExe/BrachTraceExe.vcxproj | 150 + BrachTraceExe/BrachTraceExe.vcxproj.filters | 22 + BrachTraceExe/BrachTraceExe.vcxproj.user | 27 + BrachTraceExe/brach-trace-exe.cpp | 87 + .../BranchTrace-x64plugin-wtl.aps | Bin 0 -> 15876 bytes .../BranchTrace-x64plugin-wtl.rc | 133 + .../BranchTrace-x64plugin-wtl.vcxproj | 219 + .../BranchTrace-x64plugin-wtl.vcxproj.filters | 177 + .../BranchTrace-x64plugin-wtl.vcxproj.user | 38 + BranchTrace-x64plugin-wtl/LDasm/LDasm.c | 863 +++ BranchTrace-x64plugin-wtl/LDasm/LDasm.h | 51 + BranchTrace-x64plugin-wtl/ThreadTraceCore.cpp | 265 + BranchTrace-x64plugin-wtl/ThreadTraceCore.h | 103 + .../ThreadTraceDialog.cpp | 545 ++ BranchTrace-x64plugin-wtl/ThreadTraceDialog.h | 114 + BranchTrace-x64plugin-wtl/disassembler.cpp | 321 ++ BranchTrace-x64plugin-wtl/disassembler.h | 30 + BranchTrace-x64plugin-wtl/dllmain.cpp | 31 + BranchTrace-x64plugin-wtl/dllmain.h | 5 + BranchTrace-x64plugin-wtl/plugin.h | 49 + BranchTrace-x64plugin-wtl/plugin_global.h | 45 + .../DeviceNameResolver/DeviceNameResolver.h | 22 + .../DeviceNameResolver_x64.a | Bin 0 -> 6134 bytes .../DeviceNameResolver_x64.lib | Bin 0 -> 3174 bytes .../DeviceNameResolver_x86.a | Bin 0 -> 6106 bytes .../DeviceNameResolver_x86.lib | Bin 0 -> 3190 bytes .../pluginsdk/TitanEngine/TitanEngine.h | 1120 ++++ .../pluginsdk/TitanEngine/TitanEngine_x64.a | Bin 0 -> 333954 bytes .../pluginsdk/TitanEngine/TitanEngine_x64.lib | Bin 0 -> 102254 bytes .../pluginsdk/TitanEngine/TitanEngine_x86.a | Bin 0 -> 333074 bytes .../pluginsdk/TitanEngine/TitanEngine_x86.lib | Bin 0 -> 106034 bytes .../pluginsdk/XEDParse/XEDParse.h | 53 + .../pluginsdk/XEDParse/XEDParse_x64.a | Bin 0 -> 2912 bytes .../pluginsdk/XEDParse/XEDParse_x64.lib | Bin 0 -> 1916 bytes .../pluginsdk/XEDParse/XEDParse_x86.a | Bin 0 -> 2940 bytes .../pluginsdk/XEDParse/XEDParse_x86.lib | Bin 0 -> 1934 bytes .../pluginsdk/_dbgfunctions.h | 297 ++ .../pluginsdk/_plugin_types.h | 34 + .../pluginsdk/_plugins.h | 332 ++ .../pluginsdk/_scriptapi.h | 8 + .../pluginsdk/_scriptapi_argument.h | 31 + .../pluginsdk/_scriptapi_assembler.h | 17 + .../pluginsdk/_scriptapi_bookmark.h | 28 + .../pluginsdk/_scriptapi_comment.h | 29 + .../pluginsdk/_scriptapi_debug.h | 32 + .../pluginsdk/_scriptapi_flag.h | 47 + .../pluginsdk/_scriptapi_function.h | 32 + .../pluginsdk/_scriptapi_gui.h | 78 + .../pluginsdk/_scriptapi_label.h | 30 + .../pluginsdk/_scriptapi_memory.h | 32 + .../pluginsdk/_scriptapi_misc.h | 65 + .../pluginsdk/_scriptapi_module.h | 78 + .../pluginsdk/_scriptapi_pattern.h | 19 + .../pluginsdk/_scriptapi_register.h | 289 + .../pluginsdk/_scriptapi_stack.h | 16 + .../pluginsdk/_scriptapi_symbol.h | 30 + .../pluginsdk/bridgegraph.h | 186 + .../pluginsdk/bridgelist.h | 149 + .../pluginsdk/bridgemain.h | 1388 +++++ .../pluginsdk/dbghelp/dbghelp.h | 4677 +++++++++++++++++ .../pluginsdk/dbghelp/dbghelp_x64.a | Bin 0 -> 162912 bytes .../pluginsdk/dbghelp/dbghelp_x64.lib | Bin 0 -> 49464 bytes .../pluginsdk/dbghelp/dbghelp_x86.a | Bin 0 -> 166524 bytes .../pluginsdk/dbghelp/dbghelp_x86.lib | Bin 0 -> 54294 bytes .../pluginsdk/jansson/jansson.h | 315 ++ .../pluginsdk/jansson/jansson_config.h | 68 + .../pluginsdk/jansson/jansson_x64.a | Bin 0 -> 50726 bytes .../pluginsdk/jansson/jansson_x64.lib | Bin 0 -> 15226 bytes .../pluginsdk/jansson/jansson_x64dbg.h | 25 + .../pluginsdk/jansson/jansson_x86.a | Bin 0 -> 50588 bytes .../pluginsdk/jansson/jansson_x86.lib | Bin 0 -> 15550 bytes BranchTrace-x64plugin-wtl/pluginsdk/lz4/lz4.h | 252 + .../pluginsdk/lz4/lz4_x64.a | Bin 0 -> 33634 bytes .../pluginsdk/lz4/lz4_x64.lib | Bin 0 -> 11406 bytes .../pluginsdk/lz4/lz4_x86.a | Bin 0 -> 33554 bytes .../pluginsdk/lz4/lz4_x86.lib | Bin 0 -> 11606 bytes .../pluginsdk/lz4/lz4file.h | 28 + .../pluginsdk/lz4/lz4hc.h | 175 + .../pluginsdk/x32bridge.lib | Bin 0 -> 53804 bytes .../pluginsdk/x32dbg.lib | Bin 0 -> 91134 bytes .../pluginsdk/x64bridge.lib | Bin 0 -> 52634 bytes .../pluginsdk/x64dbg.lib | Bin 0 -> 117568 bytes BranchTrace-x64plugin-wtl/pulgin.cpp | 123 + BranchTrace-x64plugin-wtl/res/Thread.png | Bin 0 -> 4484 bytes BranchTrace-x64plugin-wtl/res/trace.png | Bin 0 -> 6814 bytes BranchTrace-x64plugin-wtl/resource.h | 41 + BranchTrace-x64plugin-wtl/stdafx.h | 45 + .../BranchTrace-x64plugin.aps | Bin 0 -> 33724 bytes .../BranchTrace-x64plugin.cpp | 68 + BranchTrace-x64plugin/BranchTrace-x64plugin.h | 27 + .../BranchTrace-x64plugin.rc | Bin 0 -> 9968 bytes .../BranchTrace-x64plugin.vcxproj | 263 + .../BranchTrace-x64plugin.vcxproj.filters | 161 + .../BranchTrace-x64plugin.vcxproj.user | 22 + BranchTrace-x64plugin/ThreadTraceDialog.cpp | 66 + BranchTrace-x64plugin/ThreadTraceDialog.h | 26 + BranchTrace-x64plugin/framework.h | 35 + BranchTrace-x64plugin/pch.h | 13 + BranchTrace-x64plugin/plugin.cpp | 96 + BranchTrace-x64plugin/plugin.h | 38 + BranchTrace-x64plugin/plugin_global.h | 45 + .../res/BranchTrace-x64plugin.rc2 | Bin 0 -> 826 bytes BranchTrace-x64plugin/res/Thread.png | Bin 0 -> 4484 bytes BranchTrace-x64plugin/res/trace.png | Bin 0 -> 6814 bytes BranchTrace-x64plugin/resource.h | 22 + BranchTrace-x64plugin/targetver.h | 8 + 106 files changed, 14356 insertions(+) create mode 100644 BrachTraceExe/BrachTraceExe.vcxproj create mode 100644 BrachTraceExe/BrachTraceExe.vcxproj.filters create mode 100644 BrachTraceExe/BrachTraceExe.vcxproj.user create mode 100644 BrachTraceExe/brach-trace-exe.cpp create mode 100644 BranchTrace-x64plugin-wtl/BranchTrace-x64plugin-wtl.aps create mode 100644 BranchTrace-x64plugin-wtl/BranchTrace-x64plugin-wtl.rc create mode 100644 BranchTrace-x64plugin-wtl/BranchTrace-x64plugin-wtl.vcxproj create mode 100644 BranchTrace-x64plugin-wtl/BranchTrace-x64plugin-wtl.vcxproj.filters create mode 100644 BranchTrace-x64plugin-wtl/BranchTrace-x64plugin-wtl.vcxproj.user create mode 100644 BranchTrace-x64plugin-wtl/LDasm/LDasm.c create mode 100644 BranchTrace-x64plugin-wtl/LDasm/LDasm.h create mode 100644 BranchTrace-x64plugin-wtl/ThreadTraceCore.cpp create mode 100644 BranchTrace-x64plugin-wtl/ThreadTraceCore.h create mode 100644 BranchTrace-x64plugin-wtl/ThreadTraceDialog.cpp create mode 100644 BranchTrace-x64plugin-wtl/ThreadTraceDialog.h create mode 100644 BranchTrace-x64plugin-wtl/disassembler.cpp create mode 100644 BranchTrace-x64plugin-wtl/disassembler.h create mode 100644 BranchTrace-x64plugin-wtl/dllmain.cpp create mode 100644 BranchTrace-x64plugin-wtl/dllmain.h create mode 100644 BranchTrace-x64plugin-wtl/plugin.h create mode 100644 BranchTrace-x64plugin-wtl/plugin_global.h create mode 100644 BranchTrace-x64plugin-wtl/pluginsdk/DeviceNameResolver/DeviceNameResolver.h create mode 100644 BranchTrace-x64plugin-wtl/pluginsdk/DeviceNameResolver/DeviceNameResolver_x64.a create mode 100644 BranchTrace-x64plugin-wtl/pluginsdk/DeviceNameResolver/DeviceNameResolver_x64.lib create mode 100644 BranchTrace-x64plugin-wtl/pluginsdk/DeviceNameResolver/DeviceNameResolver_x86.a create mode 100644 BranchTrace-x64plugin-wtl/pluginsdk/DeviceNameResolver/DeviceNameResolver_x86.lib create mode 100644 BranchTrace-x64plugin-wtl/pluginsdk/TitanEngine/TitanEngine.h create mode 100644 BranchTrace-x64plugin-wtl/pluginsdk/TitanEngine/TitanEngine_x64.a create mode 100644 BranchTrace-x64plugin-wtl/pluginsdk/TitanEngine/TitanEngine_x64.lib create mode 100644 BranchTrace-x64plugin-wtl/pluginsdk/TitanEngine/TitanEngine_x86.a create mode 100644 BranchTrace-x64plugin-wtl/pluginsdk/TitanEngine/TitanEngine_x86.lib create mode 100644 BranchTrace-x64plugin-wtl/pluginsdk/XEDParse/XEDParse.h create mode 100644 BranchTrace-x64plugin-wtl/pluginsdk/XEDParse/XEDParse_x64.a create mode 100644 BranchTrace-x64plugin-wtl/pluginsdk/XEDParse/XEDParse_x64.lib create mode 100644 BranchTrace-x64plugin-wtl/pluginsdk/XEDParse/XEDParse_x86.a create mode 100644 BranchTrace-x64plugin-wtl/pluginsdk/XEDParse/XEDParse_x86.lib create mode 100644 BranchTrace-x64plugin-wtl/pluginsdk/_dbgfunctions.h create mode 100644 BranchTrace-x64plugin-wtl/pluginsdk/_plugin_types.h create mode 100644 BranchTrace-x64plugin-wtl/pluginsdk/_plugins.h create mode 100644 BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi.h create mode 100644 BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_argument.h create mode 100644 BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_assembler.h create mode 100644 BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_bookmark.h create mode 100644 BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_comment.h create mode 100644 BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_debug.h create mode 100644 BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_flag.h create mode 100644 BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_function.h create mode 100644 BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_gui.h create mode 100644 BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_label.h create mode 100644 BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_memory.h create mode 100644 BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_misc.h create mode 100644 BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_module.h create mode 100644 BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_pattern.h create mode 100644 BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_register.h create mode 100644 BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_stack.h create mode 100644 BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_symbol.h create mode 100644 BranchTrace-x64plugin-wtl/pluginsdk/bridgegraph.h create mode 100644 BranchTrace-x64plugin-wtl/pluginsdk/bridgelist.h create mode 100644 BranchTrace-x64plugin-wtl/pluginsdk/bridgemain.h create mode 100644 BranchTrace-x64plugin-wtl/pluginsdk/dbghelp/dbghelp.h create mode 100644 BranchTrace-x64plugin-wtl/pluginsdk/dbghelp/dbghelp_x64.a create mode 100644 BranchTrace-x64plugin-wtl/pluginsdk/dbghelp/dbghelp_x64.lib create mode 100644 BranchTrace-x64plugin-wtl/pluginsdk/dbghelp/dbghelp_x86.a create mode 100644 BranchTrace-x64plugin-wtl/pluginsdk/dbghelp/dbghelp_x86.lib create mode 100644 BranchTrace-x64plugin-wtl/pluginsdk/jansson/jansson.h create mode 100644 BranchTrace-x64plugin-wtl/pluginsdk/jansson/jansson_config.h create mode 100644 BranchTrace-x64plugin-wtl/pluginsdk/jansson/jansson_x64.a create mode 100644 BranchTrace-x64plugin-wtl/pluginsdk/jansson/jansson_x64.lib create mode 100644 BranchTrace-x64plugin-wtl/pluginsdk/jansson/jansson_x64dbg.h create mode 100644 BranchTrace-x64plugin-wtl/pluginsdk/jansson/jansson_x86.a create mode 100644 BranchTrace-x64plugin-wtl/pluginsdk/jansson/jansson_x86.lib create mode 100644 BranchTrace-x64plugin-wtl/pluginsdk/lz4/lz4.h create mode 100644 BranchTrace-x64plugin-wtl/pluginsdk/lz4/lz4_x64.a create mode 100644 BranchTrace-x64plugin-wtl/pluginsdk/lz4/lz4_x64.lib create mode 100644 BranchTrace-x64plugin-wtl/pluginsdk/lz4/lz4_x86.a create mode 100644 BranchTrace-x64plugin-wtl/pluginsdk/lz4/lz4_x86.lib create mode 100644 BranchTrace-x64plugin-wtl/pluginsdk/lz4/lz4file.h create mode 100644 BranchTrace-x64plugin-wtl/pluginsdk/lz4/lz4hc.h create mode 100644 BranchTrace-x64plugin-wtl/pluginsdk/x32bridge.lib create mode 100644 BranchTrace-x64plugin-wtl/pluginsdk/x32dbg.lib create mode 100644 BranchTrace-x64plugin-wtl/pluginsdk/x64bridge.lib create mode 100644 BranchTrace-x64plugin-wtl/pluginsdk/x64dbg.lib create mode 100644 BranchTrace-x64plugin-wtl/pulgin.cpp create mode 100644 BranchTrace-x64plugin-wtl/res/Thread.png create mode 100644 BranchTrace-x64plugin-wtl/res/trace.png create mode 100644 BranchTrace-x64plugin-wtl/resource.h create mode 100644 BranchTrace-x64plugin-wtl/stdafx.h create mode 100644 BranchTrace-x64plugin/BranchTrace-x64plugin.aps create mode 100644 BranchTrace-x64plugin/BranchTrace-x64plugin.cpp create mode 100644 BranchTrace-x64plugin/BranchTrace-x64plugin.h create mode 100644 BranchTrace-x64plugin/BranchTrace-x64plugin.rc create mode 100644 BranchTrace-x64plugin/BranchTrace-x64plugin.vcxproj create mode 100644 BranchTrace-x64plugin/BranchTrace-x64plugin.vcxproj.filters create mode 100644 BranchTrace-x64plugin/BranchTrace-x64plugin.vcxproj.user create mode 100644 BranchTrace-x64plugin/ThreadTraceDialog.cpp create mode 100644 BranchTrace-x64plugin/ThreadTraceDialog.h create mode 100644 BranchTrace-x64plugin/framework.h create mode 100644 BranchTrace-x64plugin/pch.h create mode 100644 BranchTrace-x64plugin/plugin.cpp create mode 100644 BranchTrace-x64plugin/plugin.h create mode 100644 BranchTrace-x64plugin/plugin_global.h create mode 100644 BranchTrace-x64plugin/res/BranchTrace-x64plugin.rc2 create mode 100644 BranchTrace-x64plugin/res/Thread.png create mode 100644 BranchTrace-x64plugin/res/trace.png create mode 100644 BranchTrace-x64plugin/resource.h create mode 100644 BranchTrace-x64plugin/targetver.h diff --git a/BrachTraceExe/BrachTraceExe.vcxproj b/BrachTraceExe/BrachTraceExe.vcxproj new file mode 100644 index 0000000..1bdaca2 --- /dev/null +++ b/BrachTraceExe/BrachTraceExe.vcxproj @@ -0,0 +1,150 @@ + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + 16.0 + {8D95F0D0-2975-4A8B-9499-317C50E55264} + BrachTraceExe + 10.0 + + + + Application + true + v142 + Unicode + + + Application + false + v142 + true + Unicode + + + Application + true + v142 + Unicode + + + Application + false + v142 + true + Unicode + + + + + + + + + + + + + + + + + + + + + false + + + true + + + true + + + false + + + + Level3 + true + true + true + NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + MultiThreaded + + + Console + true + true + true + + + + + Level3 + true + _DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + MultiThreadedDebug + + + Console + true + + + + + Level3 + true + _DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + MultiThreadedDebug + + + Console + true + + + + + Level3 + true + true + true + NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + MultiThreaded + + + Console + true + true + true + + + + + + + + + \ No newline at end of file diff --git a/BrachTraceExe/BrachTraceExe.vcxproj.filters b/BrachTraceExe/BrachTraceExe.vcxproj.filters new file mode 100644 index 0000000..93b404b --- /dev/null +++ b/BrachTraceExe/BrachTraceExe.vcxproj.filters @@ -0,0 +1,22 @@ + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;c++;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + Source Files + + + \ No newline at end of file diff --git a/BrachTraceExe/BrachTraceExe.vcxproj.user b/BrachTraceExe/BrachTraceExe.vcxproj.user new file mode 100644 index 0000000..cb74406 --- /dev/null +++ b/BrachTraceExe/BrachTraceExe.vcxproj.user @@ -0,0 +1,27 @@ + + + + WindowsRemoteDebugger + $(TargetPath) + 192.168.3.7 + RemoteWithoutAuthentication + + + $(TargetPath) + WindowsRemoteDebugger + 192.168.3.7 + RemoteWithoutAuthentication + + + $(TargetPath) + WindowsRemoteDebugger + 192.168.3.7 + RemoteWithoutAuthentication + + + $(TargetPath) + WindowsRemoteDebugger + 192.168.3.7 + RemoteWithoutAuthentication + + \ No newline at end of file diff --git a/BrachTraceExe/brach-trace-exe.cpp b/BrachTraceExe/brach-trace-exe.cpp new file mode 100644 index 0000000..de721ed --- /dev/null +++ b/BrachTraceExe/brach-trace-exe.cpp @@ -0,0 +1,87 @@ +#include +#include "..\BranchTracerSys\ioctls.h" +#include + + + +typedef struct _BTS_RECORD64 +{ + ULONG64 from; // ¼Ç¼·ÖÖ§µÄÔ´µØÖ· + ULONG64 to; // ¼Ç¼·ÖÖ§µÄÄ¿±êµØÖ· + ULONG64 branchPredicted; +}BTS_RECORD64, * PBTS_RECORD64; + + + +int main() { + HANDLE hDevice = CreateFileA("\\\\.\\Branch-Trace", GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE, 0, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0); + + ULONG ThreadId = 0; + printf("Enter thread id:"); + scanf_s("%d", &ThreadId); + + START_THREAD_TRACE_PARAM StartRequest = { 0 }; + StartRequest.ThreadId = ThreadId; + + DWORD BytesReturned = 0; + if (!DeviceIoControl(hDevice, IOCTL_START_THREAD_TRACE, + (LPVOID)&StartRequest, sizeof(StartRequest), + (LPVOID)&StartRequest, sizeof(StartRequest), + &BytesReturned, NULL)) + { + printf("Start Trace failed!\n"); + return -1; + } + + printf("Press Enter to conttinue\n"); + system("pause"); + +#define BIFFER_SIZE 0x2000 + PVOID Buffer = VirtualAlloc(NULL, BIFFER_SIZE, MEM_COMMIT, PAGE_READWRITE); + STOP_THREAD_TRACE_PARAM StopRequest = { 0 }; + StopRequest.ThreadId = ThreadId; + StopRequest.Buffer = Buffer; + StopRequest.BufferSize = BIFFER_SIZE; + StopRequest.FilterStart = 0x00400000; + StopRequest.FilterEnd = 0x00D4C000+0x4000; + + + if (!DeviceIoControl(hDevice, IOCTL_STOP_THREAD_TRACE, + (LPVOID)&StopRequest, sizeof(StopRequest), + (LPVOID)&StopRequest, sizeof(StopRequest), + &BytesReturned, NULL)) + { + printf("Stop Trace failed!\n"); + getchar(); + return -1; + } + + printf("Successful Buffer:%p ReadSize:%x\n", StopRequest.Buffer, StopRequest.ReadSize); + + + PBTS_RECORD64 RecordStart = (PBTS_RECORD64)Buffer; + PBTS_RECORD64 RecordEnd = (PBTS_RECORD64)((ULONG_PTR)Buffer + StopRequest.ReadSize); + + + // ÄæÅÅ, ´ÓÇý¶¯À­»ØÀ´µÄ¼Ç¼˳Ðò¸úÖ´ÐÐ˳ÐòµÄÏà·´. + for (PBTS_RECORD64 p1 = RecordStart, p2 = RecordEnd - 1; + p1 < p2; + p1++, p2--) + { + BTS_RECORD64 temp = *p1; + *p1 = *p2; + *p2 = temp; + } + + PBTS_RECORD64 pRecord = RecordStart; + while (pRecord < RecordEnd) + { + printf("%llx-> %llx\n", pRecord->from, pRecord->to); + pRecord++; + } + + system("pause"); + getchar(); + + +} \ No newline at end of file diff --git a/BranchTrace-x64plugin-wtl/BranchTrace-x64plugin-wtl.aps b/BranchTrace-x64plugin-wtl/BranchTrace-x64plugin-wtl.aps new file mode 100644 index 0000000000000000000000000000000000000000..1a98d2e295c0d11aa2ec3d70a3eae9ee84cd2f2e GIT binary patch literal 15876 zcmd73cUV*1vnafi5ITx9X+qE-9i(>+ozQ!cDpjO+q-Y{4AS$5&Jf1s~)Jk8i+qQaQqitl%9?n6*)707%H^7vH|$n zhHs?A;62wY?=b)z(?lyP7zJ4`J|bHQ>}PB}x54RpOC(V%mfsOAOxlm5dwwRo=q|Gz zsdiSOW3(NA_^lkro;Wv-lM8J+iTqTjn}?`c;&?MHzRedv1;{DkQ$dphb^SR-^pUA`?AT?f zn#wGn#&IQ}QtTFdsfqkO-x&vY)pug=BR^wKJvaY&H>d7^&kO3+^uFOb)Q7m>;C)NT zo;lyjG24kOc~Ba15|?#nbF0{7lB&)=bK?vhP6~L_hQOYr3^(eb%7_IY3UYDJWQ6lxGTn~TQh(T1vW-X}ezp98$4j_CJI}hASoz9pnjnL`BO`e^bW#)*x+VgEQsPC4Eh%B`!#YYm$Qd>_j~gv0$_f_=@jzm~k3d_2 z2*>>ERIEx^Qwg~JI?-5lzpVd0#x3Y2CHK+%E1M|;VKI-@vAU+Vq<3qP%=QT$nSevT z@Z#_&#*r>UUflprbp1;4hcEKt2$tefS}(v0;kBD)INNQ{w<132H(67+T`2pcs@4)P z?^k%hPZWJ+@X>ihj7@f(Cm({SIbtS9|1QRDHrKT2n)0{hS6`}3ox7v$<2}!jtVw9} z9EU!?Z(6D}&Fzdb*{?cTz~_}Y-!q0i5h1ly=1RYHY^8sG6F%u%cW$8Uq4^C1-~<0I z13mw(v%XRJm}km8umrxqx9LVGF_&N!H&h?L4dj_cR`YRK(H5s39|n@;AdDbR(}BS3 zP+F?dP~s*GBQ>n(3e^^aYmKUA&PTq;e1xXu=A$qPknFpixt$6~nOLzTyX%IcRG(=s zYPtpT@OzI1ZhXMd5x3=HGNB`$5AD>D0oLDZcs<6QRu_4v?Y&2IHG;YpP%HZ*L) zWzb;b0~uRq6w~o&pc~Ux3!J0zY)N`CjuBg630Fo}!Rg^#(Dao5* zWgskhy6nW)mvqIoS_>LM%jvLBP2L}UCk8||0s>FG%4m$Af769|lHqM1luztXantuJ zhXg_m+A2=!uQ|C}dFvv|=g|X~#amQupRt2t6=`7s6ZZ$krr%QGb;z|UguLak%ao`{ z)7rOrJYWTj%l=V0OwWSbHMP*3->V^6d0=^Cg&sNh;K4xN5T-=s#{B$hnah~K0r{u< zYu=`MU+=FiVxEXqtng1>{#-Q}Rzj19xQkvs`y|WtNEEuZq`pED7Ng-Fbn$=_06BU; z+?nuD*Q&}xRK>Xo$_xvPq`(M>EeiRPRu190ofj76y9zdM*Tv;K44|N>9_KmA508Je zBwA#-0$00RyE^!JAk?jCGsQkPiKKY)G1EnPU!kF*?2;W&;CgC|3Q^U^tYsQ*aDY-iXe7Cs@lsrC`gYLV(CWdPo zUwVBh-J{Si+t~C7Tu0}#fmuE=QmeeOT!SpK?|_?1&r144ke<#bW?YKXDRv73Xp#24 z>fmVRzyq@}C#$$9AGDRU6pNrZmruXN%c8Hre48Ts;+L1b2|&Kri`QbF0snQ7zR_OF3N{)C53l4fEqV zTG(mgt!J9`>!O)Q-(`=>mZwoLtK6djytQ_?HJ`piDB1Nb5Lck-FNG}Ld}{-dOOJPq z;=Kn%+V|0FUqO|F=;WJ*Vo&2NB>lL z%v)XKxNPEMtN}q*QnT3_z#o&bj@V(lB|{JB7?^Q9Mw|DO>3bC(2PF zH#XGAge#=q4ALf-gX%pV&sbee^cr(`$&7R8tNIMU{aDs9DITSi>UI28Xc2hA&J1g+ z2VXVuiG7m}3^Lg@ko5&>1p8#(=e5Ic#{0<5WlfjaMH(fN4`F4%r%(<=dPy1 zXTgSRJz&$HVNrkVl6XJMBFLVT{L=Bq{(FqNf7tQ2o3ZGLOH4RNXhHV^D^MwtI#T_r zgfWDDGRME0aytYjqFl3G)&-%?dbRw}FU=VilAb~gi!&JW+3ki?^9&{Sm|o4dtPL){ zm&S-g7BNh?=wK|%tNMp475bxr=7Iz68}sS-%|=%|F*?I2JQpS>Lmi~689oS!Seq+w z9m6{$c<_UkjgXU8u#M|r^PN%lE!zp5!G0n9&dN`2{`TW+fL1Vj$Gup6)3OsR%$(Am zHAE=Z_;F{Z^jsF%(>3{}M{RtEW@xddn~Np6SMZBQe){&&1wN21Qalrgak;ovGao7W zW$TWC27YC-iv?^WG#BB$k>dS`&0 zh~m6G=+KGYC*hhr7|MY6CptB-?$~@l+w|C%;l6tgUc!iQPCpV_p56fZx1y1ElLtiG zQ|(a1?K3U3yah|V&&th%v&CO9;uKaZzcrDUSgANXeEne0Hu4U!Lu9arY$&bIN9>$T?*K;9$;rR?@m&Ex&vq@o800fW*w&Z@%FlxaS}!IFek$g^iuh{5!wEl zB%n1jONl_j;GV%eGqbqM7&MlbWOHsl7!J7l~+yPqnrUgyyqf1-5yF9 zwxk7qn+=^zq@ssMqUMYV(_fPz=JJKdzVDUPhBfNwlt1U}nO?#&NJd_l-n*e$QKEEKe1hCxmK0ir1b!(oJdQA95(8pSZjL z517g}5t@MVS1|{|1+~S zyUd=b9p333X};8A<%h2mpOCYT4hF&cOoaz~%(2P9aS6s3@h=|_3~mv2>BNU6)7k_u z5a)ZqLbL0;o@0)0#$)V!z7K4F(Y_t#{3>Lhru? zN}~#MuC~}WfVf0!Pk44kRhGVC#CcFSxs+PB3HNAVGldC ztvN9#3hHd33i54Bq^9O|sW9n!(24jHBb7_H%X#Q=8Mu*2x-`NT^?u4Pe7a^4(=!N* zp@=OYLhZ>&Iyk*6X_r2|FJFhH@^DRlRrYFAkTCJ%?;hqTOmJ$!G!D6DLkj}jwM&W8;^;Zf%GsxQv^5Rx3}&y*>&GA-5fc5 zwIm)k^3^1Kwy10AzKv1zy~Q_ZgvIVn-d@T+!HkP?{?JImQy}Wa;1zyzAb7e$scpKc zYo7_1y6yd(jJ`LI++8DQ#JBW9q5+PLwow&EqolGaoCvj=41%o;nGrML%rvT=yeIz( zueR&D_xa>xi<0$1_Z&k9m{F4)1cm1`h%g*>V#?;onZTTAsFK0( zvKy)l;-}_y6xB|@qkI5&a}LPC5N&=pY1Kb@MMQL zE#`bj77HzI0SK1Q9!bCRsja>pptMD0Jch&w!MjPuO|jk{I&qBPLBak<*=%n7 zT`oOh<$Z}CyK$CQLi9KRjI43eN6S*HhgMf%SB}gwxUB2$Z?+s9ycE;dfGB%v1mvdn zK6wR`O+39pxwtQ!S|U>=|7L!GJ8?i7_H1*81PB3ML4wPd;_{&yD_mx4v{J>~($FGL z_{~W@Rk@@hy58JGgg&p{{w={u;F$m^RI$?dUQ~l48~JP<^NrTmv=yn!Ng2e-B(Gev zi>?TMH%6J#E1WbtYZRAk2>6uJbFD4S&Ez?}sX<2;d;4E!f7Q5zT6<|?%bNITMuM9QzIMY3$K8D@ zJB|hy0d3t0;LYCd9%F32OiI@r=Adr?S#>~F>RaWYBB8-1VfyNgL+%E^s>UR`kjnpR zv>|H5bj{tZkA?-uzLR*VZ#!jVvVJDHmFDDW#Bf&DmcwyAYC}laoe55-h_Ibo@W=q4 z@zS2UJXd%y_lnl!w*0(WHZu%o2yia@6he9E^)i|z(^*sVmY-rsDIuTi;0AnN-t;7X z7v`}hyX@p`A22@Lm1bCBIw^>h-EFKy3nMhL$c1nBdNe(wCbrhZ^q71_jKNJ{b>PzH zkK8wdsrmGHR{9d--JeI(kw+T5cTSEvS*5Xbh70azk)JmBJV6gd$91Kfn*pR;sU_cI z81muQSAte?uytVnLjj;=m+NfcBCFiG@7q2v1&-B`xVYSI;Q>f)( zcqLE5V)Bm!m}bx%=ffFbpFnLGcc~ve#iY?Sg;`+R>CYhIb+J@!<`7ui_pd``?etrc zPsM^}q83ED0PsSq=qTqY+FpCi{LkNMobc$sejED#@jDH(dsKGj^7za_#6jnS2cnxH%ltE;J>u`vEmAFP)8Tn< z-QNlH3KR@OPas@$TeXp6)_se}MgBPwklm?mZC`70vAJk(YqQubHFXx1o3_2;d5Mb z`*CM!P`(4G#SN#E{AU6&dy#1*g8O+)7mE8-wqEWTZ-o{4*;^e1Q*_cJj^6Xr16tO3 zuc-e}?X%!~#68z{YghV1UKbf+LTJtw9TV%f+2WKCMvnNnx!tle?iV-%;8@VXia<;5 z!^Z-1=QtlB=ZMhkuA%(eeply#ZF;nBe2E%u@v(_^Pjv9pwBzbK=R-@aMf#zJ@V0%< z6FhU{S;Q_mdzBF6)p4`hYvG-U`cuw7bky0zbaY4sD3aPa6Ahg{1!IEIyLPVcC_mU`>lg`*p~ zw9N0gm0V6Bt_sXud2W{XL$#KB&I`T#qBeVdqreff7oH~D?>c-bc%$Rvc-q4wrSD@+ zAPpnmoK7+Bh@frAYop7yWvv=&quC$VM%N1cXyUv=DXrKS-Ey&FUBZH>t(-G#8FO<+ zb6p3`Khu4tEQA70a&rQrYL(Uhgyrrv!-cM@P*OWDk`hy?1-O{pW-_*}?@<#)m-IS<}@ zYlS}0ctj%;;2UII3UM$+UtJDj+G;8Y*ev+!-q79?&N(Ka&ylI>Nml-?cPFS#S7UW; zAgnsAc4c-b!S6jWE=fH&E*>l0a^2?5Nhu{LX(A%9ko)}0jv5LNzGYvj>yy!6*8O)R z(Yt7w373?3Jwsa5{ghhYqIp9kq|EZ;5;lbN%0zrN@)?^A?ap>fWKs65I$*BZtD)$Q za3C4O3o=AX$M>=_@?-wGT}BNwo{-xd@}3+KFz!%epQ(>=)=vz*lV#X!tTXd&=Vvfr z_Ci;%Mdzgg#|KlfU5$E{l zY&gF;=TWaU4t`!Gf|q~ZAmBNNWUK20hnUq?U z?I5Z2-AfKLS9#O?UgPJ#F?MaR2059UATI?;NXLFS;I}ACsa1E2a&xb-(X9UvMLEy z#zeXcS^WC(oo9$qUYzH+vXV@NI(d%hhYBlF<4l7^mS8J1#0cpI3W&2}ep}6R+7#NT z=*uXbOr=LQNo#US`%c++AviA022OcXg9at!9^JKQ z?FN@b_^8*(nEH%b7t7{@FiOm%YFCT6sR#Ak4_kSj=U4f&&1j}8dOevZvN;th?T?MF zZOb%~a$QwspC%WSQSxP&+33$5X9PH=rIVKDJ!vIIiP+7H$JnOm+DgZ+dlxm64aKlH zi8?+|VX(Z`-~(qqT{PFNag&(T<7ku26gi8-wJ5tO*SHE?Cp}H~B-+AYCGiWNZEOuP zOiU4?`HuGFn_S*iE%az-56INEhzx76{WxS{mFSfiDYf@lido0|Y0n7;PsfuSzBhzm z0UwYi$tc)vr1l-H#fb=FQnfn_ylk)8gj;hGb~PIvsM^gtM0(>!QZ!9RbtT9&WnP5& zz+a1u&N_1{!H70pD5RM@{Wmz0o8FMe&?1lDR*GD&zabJivdZ`|s-85Fq6?nUUh;;s2sfVn|*2d1WBv^`uA^Y}4 zVulf$XUhh23da{e8mgEKbA0KFV|(}k(H-53Yl-|48Akc4>2}t|2SX&?*|ctJZM(6j zEd9R0qmBuZdNLb&C5zbebMmv5k7_shT=u?oPjf0P3b|M11nS+iN~~$Ffr2G;m^2JV zY{hak2df>EjZrEUO+G@fp zdi{EA7G-1yt&b;Kjyjo0*IdrY_r@u^6tW2F1$k1Wx3EqO>v^xBSiVda&pqFf6Q$$5 z09J#x<+bHy#i?A;oNI|q37AHom^hKM3);bMRV3Nj=r=bU-fU$H%8H>@zFc^IpU+Z6 z@p~;g=d8`_IaHrZGPBQCV73s$riSp57+jme=_I~f(H5}!tf_)^f zO&A96`^R@-VLz-BgQ%_xTxV&cvntP1)b*1KXZ`9Z5+yw=94N1*( zWU=K#!A`YMVsB<)Xny{eDhq4hCm;8n|KUl7YxhZ`CyCmi2hGkYJgm!5u^>05ZF&eupfI~N)$ddl_cY=B_&EUeBpeBnU= zfzEpY(q9Z%Y%zGA?7!*@N+^oN_AC}(~dDj-%tI} zXQgeGp;5J6e0g$I%}eOmDTkap-_Dw4y0W94o5UnaMeHF>!KZcOG{!r@e-~b!lf5(a z+N?u?KB0lnsZ{)|3#-c2cf;Qp7GmJkjF1UOF-AA6P2~FvV`-`qqUyq=-&TIyp?7^# z$uZ_(*D7XKSqL-$xwJ_SPi{NLeq|45I`{l(Ldnq=o9e7$X`h{LqTiS>(ISLm*N}}X zsYf-&wu%^>wa1@LNl|=~?s75BE2zGP2vHwA7=6un!d|Ks($s>f`aEH zXXSJ(CT!+<*AA49&Gq|JphYBM-|(ebW3qE?^-BnXt%Lt02}hbHy&wxm7~4Y_U;2}n zSRyj(mu5Be7dQa1YN{*V1YlAXyxa(@9V!veRyOee3h+=-!mF;rZ5t zIHy;qM=CcQzsi$_*VmG5!>Vd1an8~j_TUt<9JvViDnfhoh1S#@v6!V<%cS9m)Bx&TP)DawYNL;d@pc6lrCX`W_>6zWyF>*jWPUW$Cnp07UmDSjJ;M#@p zlXD!Z6bg*3;ftIAoU66D=hQns*2ap-;_lX{K215r+ZXOlExa9;k4>Tq>;+GO>i45$ zZ>W&+ISN53Y{@=ut<_CxQ$U(eoA|Rynaw@jyWaIBJg(vu4@Y9c(dZvuLMlzpNw(OB zfMQZk-mzK4w7g`q;(WNm%5fehfa0p1E>O5d75f=?R_VoY7WSe`x050`FJ&cZzI4y# zwqZf#RKky|-sy5QYeq84*5BY#uozH+GYaLBaJD>sZ(1XPvE^_r;gFGvx*%M|m5=WL4_5Z>H0$O)*?}(li(jlnGk!>+zwaIyMn^beON})ubKPm?mgwsFanA<)Qe955RG(4Zg=2&!HQ^VjXiL!}4lX!nuVp7_` zjBw*`8;*@flHMCNX(-neH2OYzt!P-daOCp~CWIe@(1e-Kw12!<`q0frQP_*JVG*;Awnknjr&zCPV71?qO_&3>%!E= zn=kLzyK%$5K{C%XSli<1CPx{QQ5UV0Sf8Kkd>{Y7$OD4Vf}cIVb;%t5guBQxy(rvl zWc|g}666M@3C9hH@HX47tgFq-{0VYYYTkt`mFktUFC8X#9`7}LUASUD`9pHV zk`Jh_tCqhU9jvaYRvQ9;IH3KwQ8<9(Q{0_xx2Q?G+a;D6oES^VP!&7hRreye$3o)u zXUS_Jd$JF5XHOk1jad1zHq>)@EuHLy0E8$!c$@9%g5ia82H!a!h=1!^Rg&ru>o%b) zBc^VNcD-&Y^XZ|k?+{m$6K;5obuwM^Y@>9Lq-T*zUu`)l&h^IiGrOF3{QN&Md&bwu zJv{#WW@mle^WOINi&-wm5N1qXb?=Xu$sxt>T~kZW_Cv`kFVP7Vk?!?MCCtWMz=Gd% z^~{|LM^|Z<%yqsQBxXg-qV{t5Z-4F3j=z`Wcl69_zxD!D2XLXnS|?<-A?urm>T2a} zo{IDIcBV`A#zjWwIAf~pi{I(@%b?8eq8@!#L51a|S;UCdK65qUZ( z71{goTCC%#yAMYZ_uz^c@eVp zv9cPC=p@!V(~jB?{*giMySvE)nKHp{T$OA^SF0&(2DMH5_&m&EVcTWYw5CQW4oj@1 ze7V@_WUNhw(7Lt>XOVd-(yTphk&0fYGsrvf=>@LSq@oHHDs1t98FgP>s4V77#HX^j zZtqYH!NlvQo+Yuee_GnU6-*JR1l;K8_|Q%VX+WN*HS^d+1Yxg-K_3LvTo3(Ly=b$X z?sem_xs0q1J)*O4Go3{y7lGxj7Y*;f7W6Tzo9jY$fht>k#PK0n`j&v#J3O$dn;ch~ zc0UOnN9KI_uogn5pxet-xc2?E!|40g56G<)5!C%D*&7bxL>8Adc-7_NVD5_tu*3~G zctCjleiptc-D*1fPzJ?#%2U>pOF8nW2YaRWCS~w>Il!VOrbdXxp1ovLZmDobO-Pai zV>@*U8eW-MFC8`P3{zL<-*Ma6myV=ENM6LXTrrWc_^BUVJ#LY80eNlo8jYH&~x;liAGYwbdx$o{ZLBe*wFsQo)R z5l_8+sbD`Ok2AAHuIt7dT;8>naCG}9&@dGy_my3ai^k4v{8=d4OU^-ek|#8aG-DXa zDTtOVt=tOa*58Z~7}cnhhF-7akeVm%jwez_U?(}&6B8~Ei%wa`c$=&(aqZ?N1@oOS zw7K=M^{aDKSxwkejkRNsD$*?Dp0b*5-gvc}7w19OXJX-dD`$b+8d@=EbN}rGZ+0gW zLQ8!SQTZT^BIOCI$7-eRlv)swl_P(nF)A~Jm(_4^6k;H%ZXk5Z_wgx3nC<1OX=$=k z+-CX_@5Dr?B!x~OOm!}}+t4Jco{6L6{MtGs`|;fu4u?)oUytv7kkv7s95~Y6hnQA3 zoNI0Uj_$@TbPT88wbd_+$~#M9AAUW(+g0rff7=OYz4);hhWhk_Xa>0W`$gb`H$w}w z{X(3rWR`-uh=b#6_LCX46}d8~GRbef2<(f8O%mc{Hpfzq`8v`_&rbPo=sd=BzL z+U~~rxh)x*6|k*kI<)nKe;4yV$@S&VTuY^zBe*Sd400E<^@&e&>ExW|k>Hzp3Mo-H9+zy#=N!S6wBE*Wjt=`y z^-Tr^UDo*$JMV|N?XZ=Y+;ze3ASG>#h1Ji-PF%`G-0y*Gw6kh}gCWv3?V}gF_n|7h9{TbgikZxSBuA@yRHXLuo#g@a{kJI$dp+&aOw(pTa$t zs7WQS)5oVNX=!%AqL`!ZAv)HN9Q2{hQS+kZvTQP@PTHStX(g@Ws4iCju2xO?n*IBE zHmu74X9F%j!no?ytNv>>SNs`PplV0&zx22i62Z?f%TdmkGnizS*b08Dc~o+tku?BQ za)8UcoBHkt(k#aqvohUCWj8~eU$~cf&kIo>+C}F`)*tm*BqN(11CR#UY*Jiz4sp0$ zYRcn@)sa6x-eOu>XR$nqx>RzI^fUorBS`(U~Ng%$&=R^w2z-v$E^PN{7*T#Q=G;dhD# z&x~zx?M+4^Ha9+?tm-u=*2H?@>_=ABF?43&AdLD60*4|%T%}q^g1h} zwdNCATw5%$IFyYO+(6 z25T&QuArSiEP(UG#sQUej1%5Cq=)w_KZ@HbasCI*=iIRR zJpX=r3yfJPDQ|b;noahOIWwYUmlU0!HKbSL`n?QLrsp4v8SAE00rWPI)^`vrk z8V5Y>(y_KWfQf9f#a+hSb~bJ61woI0*e=D`j(wgPo_uT%yoA}wE}nJw;a z+*(txTYrd%626lk>!>sMP8cX>g3&;+jX?Mv`*V$)&YD#6yd{%lkj1{3zTC zfTmfb^~tMLJmP1|UhW;hD7zWp)puvm`2SG-{tp%a*n+PhBS6T(0UT^DcqDL!`p>)3 z5D-cLg10)L4MRR240Uy8-xBxhSQjEa<1;8GB1^`k32fhrh1b6}-fG>D= z12Mh?o}V`ughNjqI0BRaY`{FI!@3e^ayhi@DD;fof3g==@*?2s7ny24LA69x(E2_3GnmB6#}4;~e8 zW*z=X4&dqE5$Jb+(Hnu5{%6{21X^Mu{QATIzx|5bM`c1&0i~kB_x*JUH4CbME(lcv>lV<2$^|U~6i@T>I$VDMZZuH8pZgcT za~Z+sOJGw08wuF(7ru@_3Qq`La8R$`aJ-Hme}VxB*vHpD;4ggt^v^D#FZ!zw{0sp9 z@*ln`0tGe&KozXJumN>OgMBT~3N`Ra3+$VNePeJ(;dT8LXAae1fMDPv=o2LP`KO)) zU()dN|LJ)7_>1G${ZP#YXcbyn(FQDturX3MP*G3@gwF^A@Iz1o1tk>_C<1`R5ol#) z8)dYDmhNwA8zVeg7{rU?XXQWO321O`(aK6TO1j#Lx_AaqBH1C(pW#6SSeb#RRWvp- z($ygli{gt@{=jSujT8)w2!rEAi2{^|u_Abw7(jIxW@DgYsABXJapW*U6b};zjvj{D z=ozS({Dgxp`!lQ<9wq@sy+be?9ThVpw2qPPPaMr*oH!mP3D6#f5oG_Smjvj3;taLW z$|?o~Q>6gkF@o7TVAVPbn-49RCR+Osb8xuClQf-dDn6_+|V@ZE#3k zCBls1k&*z@zmVWd8F-Ww0KS!Rh|fs(7eX3f`3r%c9~(m*w4NSePDRfEtpCFQg+B2Y z8gJ4ev@n>*02>88L&99*J*8`Gprm4BqM&6A+9NECU)g`~ptafxI?BJ$VrR~PE0*(b z0v#g*U9I2z`1t_0;~xQr=GrR1*+HuTu0LDjcM%c*0U#!ZHYO?thG<?-#`D#_AkL*_4i(EC+s|Y-1)s1f9A}C10qrtKnAcR z#79ps@;HJq+YgNQmSCiJA;e)%u;&Yo;{f99z`WuN{yBo#Qh<;#@wpkF*X_YA2_w4$2r!1Z5OSX{*yjf2OMxTsfYMC=vIhZZg3muK6$an>u>@ltUT?e}cuOt8 z={^IFh;PE63{g;u2;tchq;LoEKj#O3g7W>P+2NWmBGR82%fHScf}o`ypq&6X-@og_ zoItPqru8FO@zd7dlmO8Guh{zLU;Z>AL;)o&V`Xr~60k^crVc}YX6=7Mf93`}6pX?6 zJqYf`;U}l!q1$!+&O*uLRJqaB*;Oh>wt977ug$?=-S>7>cJOB#Y(4P(n&r`M2=D^1ucG z|1(*vALjm(4YvOY#)tcz!@!>zVD~TxuhQ?}O-yviro&O4gb2TulvNDTYC44Asb&l& zI4!h}%Fja>9;={g_WLxUrC_dWjL&laFZkStumbTKg8P^e4A_6i@}Cj>a4g5y@+yPv z&)Ex10EFw$cR_q@?JU^-PikxN=Sgl*)PLsrqYGg;@CJq|!0*51!BhPGo+Z9!HU;GQ z6B8Z(MT37|QyDzS{GoCB7Y+XVFp=P&^E6?cL*Iw5fq)laaKu*=|KFb1@fN#*q4fXu stc*V=CxHBaeD&v?OfU$%;qx~_;xNsh{Qa8-pA%Lj57Yd~3BPIn7Y35z2LJ#7 literal 0 HcmV?d00001 diff --git a/BranchTrace-x64plugin-wtl/BranchTrace-x64plugin-wtl.rc b/BranchTrace-x64plugin-wtl/BranchTrace-x64plugin-wtl.rc new file mode 100644 index 0000000..45ba1aa --- /dev/null +++ b/BranchTrace-x64plugin-wtl/BranchTrace-x64plugin-wtl.rc @@ -0,0 +1,133 @@ +// Microsoft Visual C++ generated resource script. +// +#include "resource.h" + +#define APSTUDIO_READONLY_SYMBOLS +///////////////////////////////////////////////////////////////////////////// +// +// Generated from the TEXTINCLUDE 2 resource. +// +#include "winres.h" + +///////////////////////////////////////////////////////////////////////////// +#undef APSTUDIO_READONLY_SYMBOLS + +///////////////////////////////////////////////////////////////////////////// +// Chinese (Simplified, PRC) resources + +#if !defined(AFX_RESOURCE_DLL) || defined(AFX_TARG_CHS) +LANGUAGE LANG_CHINESE, SUBLANG_CHINESE_SIMPLIFIED +#pragma code_page(936) + +#ifdef APSTUDIO_INVOKED +///////////////////////////////////////////////////////////////////////////// +// +// TEXTINCLUDE +// + +1 TEXTINCLUDE +BEGIN + "resource.h\0" +END + +2 TEXTINCLUDE +BEGIN + "#include ""winres.h""\r\n" + "\0" +END + +3 TEXTINCLUDE +BEGIN + "\r\n" + "\0" +END + +#endif // APSTUDIO_INVOKED + + +///////////////////////////////////////////////////////////////////////////// +// +// PNG +// + +IDB_PNG_THREAD PNG "res\\Thread.png" + +IDB_PNG_TRACE PNG "res\\trace.png" + + +///////////////////////////////////////////////////////////////////////////// +// +// Dialog +// + +IDD_DIALOG_THREAD_TRACE DIALOGEX 0, 0, 319, 232 +STYLE DS_SETFONT | DS_MODALFRAME | WS_POPUP | WS_CAPTION | WS_SYSMENU +CAPTION "Thread Trace" +FONT 8, "Consolas", 400, 0, 0x0 +BEGIN + COMBOBOX IDC_COMBO_THREAD,72,14,180,30,CBS_DROPDOWNLIST | CBS_SORT | WS_VSCROLL | WS_TABSTOP + PUSHBUTTON "Start Trace",IDC_BUTTON_STARTTRACE,257,14,55,14 + PUSHBUTTON "Reset",IDC_BUTTON_RESET,257,32,55,14,WS_DISABLED + LTEXT "Choose Thread",IDC_STATIC,14,17,53,8 + PUSHBUTTON "Prev",IDC_BUTTON_PREV,257,169,55,14,WS_DISABLED + PUSHBUTTON "Next(Into)",IDC_BUTTON_NEXTINTO,257,67,55,14,WS_DISABLED + PUSHBUTTON "Prev(Into)",IDC_BUTTON_PREVINTO,257,51,55,14,WS_DISABLED + PUSHBUTTON "&Next",IDC_BUTTON_NEXT,257,185,55,14,WS_DISABLED + LTEXT "Choose Module",IDC_STATIC,14,34,53,8 + COMBOBOX IDC_COMBO_MODULE,72,32,180,30,CBS_DROPDOWNLIST | CBS_SORT | WS_VSCROLL | WS_TABSTOP + CONTROL "",IDC_LIST1,"SysListView32",LVS_REPORT | LVS_ALIGNLEFT | WS_BORDER | WS_TABSTOP,14,51,238,174 + PUSHBUTTON "ProcStart",IDC_BUTTON_PROCSTART,257,91,55,14,WS_DISABLED + PUSHBUTTON "ProcEnd",IDC_BUTTON_PROCEND,257,107,55,14,WS_DISABLED + PUSHBUTTON "ToEnd",IDC_BUTTON_TOEND,257,211,55,14,WS_DISABLED + PUSHBUTTON "Prev Snippet",IDC_BUTTON_PREVSNIPPET,257,130,55,14,WS_DISABLED + PUSHBUTTON "Next Snippet",IDC_BUTTON_NEXTSNIPPET,257,146,55,14,WS_DISABLED +END + + +///////////////////////////////////////////////////////////////////////////// +// +// DESIGNINFO +// + +#ifdef APSTUDIO_INVOKED +GUIDELINES DESIGNINFO +BEGIN + IDD_DIALOG_THREAD_TRACE, DIALOG + BEGIN + LEFTMARGIN, 7 + RIGHTMARGIN, 312 + TOPMARGIN, 7 + BOTTOMMARGIN, 225 + HORZGUIDE, 22 + HORZGUIDE, 38 + HORZGUIDE, 51 + END +END +#endif // APSTUDIO_INVOKED + + +///////////////////////////////////////////////////////////////////////////// +// +// AFX_DIALOG_LAYOUT +// + +IDD_DIALOG_THREAD_TRACE AFX_DIALOG_LAYOUT +BEGIN + 0 +END + +#endif // Chinese (Simplified, PRC) resources +///////////////////////////////////////////////////////////////////////////// + + + +#ifndef APSTUDIO_INVOKED +///////////////////////////////////////////////////////////////////////////// +// +// Generated from the TEXTINCLUDE 3 resource. +// + + +///////////////////////////////////////////////////////////////////////////// +#endif // not APSTUDIO_INVOKED + diff --git a/BranchTrace-x64plugin-wtl/BranchTrace-x64plugin-wtl.vcxproj b/BranchTrace-x64plugin-wtl/BranchTrace-x64plugin-wtl.vcxproj new file mode 100644 index 0000000..d543592 --- /dev/null +++ b/BranchTrace-x64plugin-wtl/BranchTrace-x64plugin-wtl.vcxproj @@ -0,0 +1,219 @@ + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + 16.0 + Win32Proj + {e29237f6-bf51-4b3c-a9a7-5c988650686e} + BranchTracex64pluginwtl + 10.0 + + + + DynamicLibrary + true + v142 + MultiByte + + + DynamicLibrary + false + v142 + true + MultiByte + + + DynamicLibrary + true + v142 + MultiByte + + + DynamicLibrary + false + v142 + true + MultiByte + + + + + + + + + + + + + + + + + + + + + true + .dp$(PlatformArchitecture) + ..\..\..\x64dbg_plugins\x64dbg\x$(PlatformArchitecture)\plugins + $(IncludePath);E:\third-lib\includes; + + + false + .dp$(PlatformArchitecture) + ..\..\..\x64dbg_plugins\x64dbg\x$(PlatformArchitecture)\plugins + $(IncludePath);E:\third-lib\includes; + + + true + .dp$(PlatformArchitecture) + ..\..\..\x64dbg_plugins\x64dbg\x$(PlatformArchitecture)\plugins + $(IncludePath);E:\third-lib\includes; + + + false + .dp$(PlatformArchitecture) + ..\..\..\x64dbg_plugins\x64dbg\x$(PlatformArchitecture)\plugins + $(IncludePath);E:\third-lib\includes; + + + + Level3 + true + WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + MultiThreadedDebug + + + NotSet + true + kernel32.lib;user32.lib;gdi32.lib;winspool.lib;comdlg32.lib;advapi32.lib;shell32.lib;ole32.lib;oleaut32.lib;uuid.lib;odbc32.lib;odbccp32.lib;%(AdditionalDependencies);E:\third-lib\lib\$(Configuration)$(PlatformTarget)\Zydis.lib + + + + + Level3 + true + true + true + WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + MultiThreaded + + + NotSet + true + true + true + kernel32.lib;user32.lib;gdi32.lib;winspool.lib;comdlg32.lib;advapi32.lib;shell32.lib;ole32.lib;oleaut32.lib;uuid.lib;odbc32.lib;odbccp32.lib;%(AdditionalDependencies);E:\third-lib\lib\$(Configuration)$(PlatformTarget)\Zydis.lib; + + + + + Level3 + true + _DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + MultiThreadedDebug + + + NotSet + true + kernel32.lib;user32.lib;gdi32.lib;winspool.lib;comdlg32.lib;advapi32.lib;shell32.lib;ole32.lib;oleaut32.lib;uuid.lib;odbc32.lib;odbccp32.lib;%(AdditionalDependencies);E:\third-lib\lib\$(Configuration)$(PlatformTarget)\Zydis.lib; + + + + + Level3 + true + true + true + NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + MultiThreaded + + + NotSet + true + true + true + kernel32.lib;user32.lib;gdi32.lib;winspool.lib;comdlg32.lib;advapi32.lib;shell32.lib;ole32.lib;oleaut32.lib;uuid.lib;odbc32.lib;odbccp32.lib;%(AdditionalDependencies);E:\third-lib\lib\$(Configuration)$(PlatformTarget)\Zydis.lib; + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/BranchTrace-x64plugin-wtl/BranchTrace-x64plugin-wtl.vcxproj.filters b/BranchTrace-x64plugin-wtl/BranchTrace-x64plugin-wtl.vcxproj.filters new file mode 100644 index 0000000..c4b729a --- /dev/null +++ b/BranchTrace-x64plugin-wtl/BranchTrace-x64plugin-wtl.vcxproj.filters @@ -0,0 +1,177 @@ + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + {2e430117-686d-4410-a80c-cdc92ba350af} + + + {631d739d-396f-4d5d-b3e3-2cdae72c6524} + + + {f01f3db0-bd30-466f-a1af-f05619d18cb9} + + + {7191814d-618e-4bb6-b06e-999c73fa2915} + + + {f443bc61-3a33-4dfa-9385-e1cd6fabc425} + + + + + Source Files + + + Source Files + + + Source Files\ThreadTrace + + + Source Files\disassembler + + + Source Files\LDasm + + + Source Files\ThreadTrace + + + + + Source Files + + + Source Files + + + Header Files + + + Header Files\pluginsdk + + + Header Files\pluginsdk + + + Header Files\pluginsdk + + + Header Files\pluginsdk + + + Header Files\pluginsdk + + + Header Files\pluginsdk + + + Header Files\pluginsdk + + + Header Files\pluginsdk + + + Header Files\pluginsdk + + + Header Files\pluginsdk + + + Header Files\pluginsdk + + + Header Files\pluginsdk + + + Header Files\pluginsdk + + + Header Files\pluginsdk + + + Header Files\pluginsdk + + + Header Files\pluginsdk + + + Header Files\pluginsdk + + + Header Files\pluginsdk + + + Header Files\pluginsdk + + + Header Files\pluginsdk + + + Header Files\pluginsdk + + + Header Files\pluginsdk + + + Header Files\pluginsdk + + + Source Files\ThreadTrace + + + Source Files + + + Header Files + + + Source Files\ThreadTrace + + + Source Files\disassembler + + + Source Files\LDasm + + + + + Header Files\pluginsdk + + + Header Files\pluginsdk + + + Header Files\pluginsdk + + + Header Files\pluginsdk + + + + + Resource Files + + + + + Resource Files + + + Resource Files + + + \ No newline at end of file diff --git a/BranchTrace-x64plugin-wtl/BranchTrace-x64plugin-wtl.vcxproj.user b/BranchTrace-x64plugin-wtl/BranchTrace-x64plugin-wtl.vcxproj.user new file mode 100644 index 0000000..2e019c4 --- /dev/null +++ b/BranchTrace-x64plugin-wtl/BranchTrace-x64plugin-wtl.vcxproj.user @@ -0,0 +1,38 @@ + + + + E:\Projects\x64dbg_plugins\x64dbg\x$(PlatformArchitecture)\x$(PlatformArchitecture)dbg.exe + WindowsRemoteDebugger + E:\Projects\x64dbg_plugins\x64dbg\x$(PlatformArchitecture)\x$(PlatformArchitecture)dbg.exe + 192.168.3.7 + RemoteWithoutAuthentication + E:\Projects\x64dbg_plugins\x64dbg\x$(PlatformArchitecture) + + + E:\Projects\x64dbg_plugins\x64dbg\x$(PlatformArchitecture)\x$(PlatformArchitecture)dbg.exe + WindowsRemoteDebugger + E:\Projects\x64dbg_plugins\x64dbg\x$(PlatformArchitecture)\x$(PlatformArchitecture)dbg.exe + 192.168.3.7 + RemoteWithoutAuthentication + E:\Projects\x64dbg_plugins\x64dbg\x$(PlatformArchitecture) + + + E:\Projects\x64dbg_plugins\x64dbg\x$(PlatformArchitecture)\x$(PlatformArchitecture)dbg.exe + WindowsRemoteDebugger + E:\Projects\x64dbg_plugins\x64dbg\x$(PlatformArchitecture)\x$(PlatformArchitecture)dbg.exe + E:\Projects\x64dbg_plugins\x64dbg\x$(PlatformArchitecture) + 192.168.3.7 + RemoteWithoutAuthentication + + + E:\Projects\x64dbg_plugins\x64dbg\x$(PlatformArchitecture)\x$(PlatformArchitecture)dbg.exe + WindowsRemoteDebugger + E:\Projects\x64dbg_plugins\x64dbg\x$(PlatformArchitecture)\x$(PlatformArchitecture)dbg.exe + E:\Projects\x64dbg_plugins\x64dbg\x$(PlatformArchitecture) + 192.168.3.7 + RemoteWithoutAuthentication + + + BranchTrace-x64plugin-wtl.rc + + \ No newline at end of file diff --git a/BranchTrace-x64plugin-wtl/LDasm/LDasm.c b/BranchTrace-x64plugin-wtl/LDasm/LDasm.c new file mode 100644 index 0000000..8d91e51 --- /dev/null +++ b/BranchTrace-x64plugin-wtl/LDasm/LDasm.c @@ -0,0 +1,863 @@ +/* +* +* Copyright (c) 2009-2011 +* vol4ok PGP KEY ID: 26EC143CCDC61C9D +* + +This program is free software: you can redistribute it and/or modify +it under the terms of the GNU General Public License as published by +the Free Software Foundation, either version 3 of the License, or +(at your option) any later version. + +This program is distributed in the hope that it will be useful, +but WITHOUT ANY WARRANTY; without even the implied warranty of +MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +GNU General Public License for more details. + +You should have received a copy of the GNU General Public License +along with this program. If not, see . + +*/ + +#include "LDasm.h" + +/* + Instruction format: + + | prefix | REX | opcode | modR/M | SIB | disp8/16/32 | imm8/16/32/64 | + + */ + +#define OP_NONE 0x00 +#define OP_INVALID 0x80 + +#define OP_DATA_I8 0x01 +#define OP_DATA_I16 0x02 +#define OP_DATA_I16_I32 0x04 +#define OP_DATA_I16_I32_I64 0x08 +#define OP_EXTENDED 0x10 +#define OP_RELATIVE 0x20 +#define OP_MODRM 0x40 +#define OP_PREFIX 0x80 + + +static unsigned char flags_table[256] = +{ + /* 00 */ OP_MODRM, + /* 01 */ OP_MODRM, + /* 02 */ OP_MODRM, + /* 03 */ OP_MODRM, + /* 04 */ OP_DATA_I8, + /* 05 */ OP_DATA_I16_I32, + /* 06 */ OP_NONE, + /* 07 */ OP_NONE, + /* 08 */ OP_MODRM, + /* 09 */ OP_MODRM, + /* 0A */ OP_MODRM, + /* 0B */ OP_MODRM, + /* 0C */ OP_DATA_I8, + /* 0D */ OP_DATA_I16_I32, + /* 0E */ OP_NONE, + /* 0F */ OP_NONE, + + /* 10 */ OP_MODRM, + /* 11 */ OP_MODRM, + /* 12 */ OP_MODRM, + /* 13 */ OP_MODRM, + /* 14 */ OP_DATA_I8, + /* 15 */ OP_DATA_I16_I32, + /* 16 */ OP_NONE, + /* 17 */ OP_NONE, + /* 18 */ OP_MODRM, + /* 19 */ OP_MODRM, + /* 1A */ OP_MODRM, + /* 1B */ OP_MODRM, + /* 1C */ OP_DATA_I8, + /* 1D */ OP_DATA_I16_I32, + /* 1E */ OP_NONE, + /* 1F */ OP_NONE, + + /* 20 */ OP_MODRM, + /* 21 */ OP_MODRM, + /* 22 */ OP_MODRM, + /* 23 */ OP_MODRM, + /* 24 */ OP_DATA_I8, + /* 25 */ OP_DATA_I16_I32, + /* 26 */ OP_PREFIX, + /* 27 */ OP_NONE, + /* 28 */ OP_MODRM, + /* 29 */ OP_MODRM, + /* 2A */ OP_MODRM, + /* 2B */ OP_MODRM, + /* 2C */ OP_DATA_I8, + /* 2D */ OP_DATA_I16_I32, + /* 2E */ OP_PREFIX, + /* 2F */ OP_NONE, + + /* 30 */ OP_MODRM, + /* 31 */ OP_MODRM, + /* 32 */ OP_MODRM, + /* 33 */ OP_MODRM, + /* 34 */ OP_DATA_I8, + /* 35 */ OP_DATA_I16_I32, + /* 36 */ OP_PREFIX, + /* 37 */ OP_NONE, + /* 38 */ OP_MODRM, + /* 39 */ OP_MODRM, + /* 3A */ OP_MODRM, + /* 3B */ OP_MODRM, + /* 3C */ OP_DATA_I8, + /* 3D */ OP_DATA_I16_I32, + /* 3E */ OP_PREFIX, + /* 3F */ OP_NONE, + + /* 40 */ OP_NONE, + /* 41 */ OP_NONE, + /* 42 */ OP_NONE, + /* 43 */ OP_NONE, + /* 44 */ OP_NONE, + /* 45 */ OP_NONE, + /* 46 */ OP_NONE, + /* 47 */ OP_NONE, + /* 48 */ OP_NONE, + /* 49 */ OP_NONE, + /* 4A */ OP_NONE, + /* 4B */ OP_NONE, + /* 4C */ OP_NONE, + /* 4D */ OP_NONE, + /* 4E */ OP_NONE, + /* 4F */ OP_NONE, + + /* 50 */ OP_NONE, + /* 51 */ OP_NONE, + /* 52 */ OP_NONE, + /* 53 */ OP_NONE, + /* 54 */ OP_NONE, + /* 55 */ OP_NONE, + /* 56 */ OP_NONE, + /* 57 */ OP_NONE, + /* 58 */ OP_NONE, + /* 59 */ OP_NONE, + /* 5A */ OP_NONE, + /* 5B */ OP_NONE, + /* 5C */ OP_NONE, + /* 5D */ OP_NONE, + /* 5E */ OP_NONE, + /* 5F */ OP_NONE, + /* 60 */ OP_NONE, + + /* 61 */ OP_NONE, + /* 62 */ OP_MODRM, + /* 63 */ OP_MODRM, + /* 64 */ OP_PREFIX, + /* 65 */ OP_PREFIX, + /* 66 */ OP_PREFIX, + /* 67 */ OP_PREFIX, + /* 68 */ OP_DATA_I16_I32, + /* 69 */ OP_MODRM | OP_DATA_I16_I32, + /* 6A */ OP_DATA_I8, + /* 6B */ OP_MODRM | OP_DATA_I8, + /* 6C */ OP_NONE, + /* 6D */ OP_NONE, + /* 6E */ OP_NONE, + /* 6F */ OP_NONE, + + /* 70 */ OP_RELATIVE | OP_DATA_I8, + /* 71 */ OP_RELATIVE | OP_DATA_I8, + /* 72 */ OP_RELATIVE | OP_DATA_I8, + /* 73 */ OP_RELATIVE | OP_DATA_I8, + /* 74 */ OP_RELATIVE | OP_DATA_I8, + /* 75 */ OP_RELATIVE | OP_DATA_I8, + /* 76 */ OP_RELATIVE | OP_DATA_I8, + /* 77 */ OP_RELATIVE | OP_DATA_I8, + /* 78 */ OP_RELATIVE | OP_DATA_I8, + /* 79 */ OP_RELATIVE | OP_DATA_I8, + /* 7A */ OP_RELATIVE | OP_DATA_I8, + /* 7B */ OP_RELATIVE | OP_DATA_I8, + /* 7C */ OP_RELATIVE | OP_DATA_I8, + /* 7D */ OP_RELATIVE | OP_DATA_I8, + /* 7E */ OP_RELATIVE | OP_DATA_I8, + /* 7F */ OP_RELATIVE | OP_DATA_I8, + + /* 80 */ OP_MODRM | OP_DATA_I8, + /* 81 */ OP_MODRM | OP_DATA_I16_I32, + /* 82 */ OP_MODRM | OP_DATA_I8, + /* 83 */ OP_MODRM | OP_DATA_I8, + /* 84 */ OP_MODRM, + /* 85 */ OP_MODRM, + /* 86 */ OP_MODRM, + /* 87 */ OP_MODRM, + /* 88 */ OP_MODRM, + /* 89 */ OP_MODRM, + /* 8A */ OP_MODRM, + /* 8B */ OP_MODRM, + /* 8C */ OP_MODRM, + /* 8D */ OP_MODRM, + /* 8E */ OP_MODRM, + /* 8F */ OP_MODRM, + + /* 90 */ OP_NONE, + /* 91 */ OP_NONE, + /* 92 */ OP_NONE, + /* 93 */ OP_NONE, + /* 94 */ OP_NONE, + /* 95 */ OP_NONE, + /* 96 */ OP_NONE, + /* 97 */ OP_NONE, + /* 98 */ OP_NONE, + /* 99 */ OP_NONE, + /* 9A */ OP_DATA_I16 | OP_DATA_I16_I32, + /* 9B */ OP_NONE, + /* 9C */ OP_NONE, + /* 9D */ OP_NONE, + /* 9E */ OP_NONE, + /* 9F */ OP_NONE, + + /* A0 */ OP_DATA_I8, + /* A1 */ OP_DATA_I16_I32_I64, + /* A2 */ OP_DATA_I8, + /* A3 */ OP_DATA_I16_I32_I64, + /* A4 */ OP_NONE, + /* A5 */ OP_NONE, + /* A6 */ OP_NONE, + /* A7 */ OP_NONE, + /* A8 */ OP_DATA_I8, + /* A9 */ OP_DATA_I16_I32, + /* AA */ OP_NONE, + /* AB */ OP_NONE, + /* AC */ OP_NONE, + /* AD */ OP_NONE, + /* AE */ OP_NONE, + /* AF */ OP_NONE, + + /* B0 */ OP_DATA_I8, + /* B1 */ OP_DATA_I8, + /* B2 */ OP_DATA_I8, + /* B3 */ OP_DATA_I8, + /* B4 */ OP_DATA_I8, + /* B5 */ OP_DATA_I8, + /* B6 */ OP_DATA_I8, + /* B7 */ OP_DATA_I8, + /* B8 */ OP_DATA_I16_I32_I64, + /* B9 */ OP_DATA_I16_I32_I64, + /* BA */ OP_DATA_I16_I32_I64, + /* BB */ OP_DATA_I16_I32_I64, + /* BC */ OP_DATA_I16_I32_I64, + /* BD */ OP_DATA_I16_I32_I64, + /* BE */ OP_DATA_I16_I32_I64, + /* BF */ OP_DATA_I16_I32_I64, + + /* C0 */ OP_MODRM | OP_DATA_I8, + /* C1 */ OP_MODRM | OP_DATA_I8, + /* C2 */ OP_DATA_I16, + /* C3 */ OP_NONE, + /* C4 */ OP_MODRM, + /* C5 */ OP_MODRM, + /* C6 */ OP_MODRM | OP_DATA_I8, + /* C7 */ OP_MODRM | OP_DATA_I16_I32, + /* C8 */ OP_DATA_I8 | OP_DATA_I16, + /* C9 */ OP_NONE, + /* CA */ OP_DATA_I16, + /* CB */ OP_NONE, + /* CC */ OP_NONE, + /* CD */ OP_DATA_I8, + /* CE */ OP_NONE, + /* CF */ OP_NONE, + + /* D0 */ OP_MODRM, + /* D1 */ OP_MODRM, + /* D2 */ OP_MODRM, + /* D3 */ OP_MODRM, + /* D4 */ OP_DATA_I8, + /* D5 */ OP_DATA_I8, + /* D6 */ OP_NONE, + /* D7 */ OP_NONE, + /* D8 */ OP_MODRM, + /* D9 */ OP_MODRM, + /* DA */ OP_MODRM, + /* DB */ OP_MODRM, + /* DC */ OP_MODRM, + /* DD */ OP_MODRM, + /* DE */ OP_MODRM, + /* DF */ OP_MODRM, + + /* E0 */ OP_RELATIVE | OP_DATA_I8, + /* E1 */ OP_RELATIVE | OP_DATA_I8, + /* E2 */ OP_RELATIVE | OP_DATA_I8, + /* E3 */ OP_RELATIVE | OP_DATA_I8, + /* E4 */ OP_DATA_I8, + /* E5 */ OP_DATA_I8, + /* E6 */ OP_DATA_I8, + /* E7 */ OP_DATA_I8, + /* E8 */ OP_RELATIVE | OP_DATA_I16_I32, + /* E9 */ OP_RELATIVE | OP_DATA_I16_I32, + /* EA */ OP_DATA_I16 | OP_DATA_I16_I32, + /* EB */ OP_RELATIVE | OP_DATA_I8, + /* EC */ OP_NONE, + /* ED */ OP_NONE, + /* EE */ OP_NONE, + /* EF */ OP_NONE, + + /* F0 */ OP_PREFIX, + /* F1 */ OP_NONE, + /* F2 */ OP_PREFIX, + /* F3 */ OP_PREFIX, + /* F4 */ OP_NONE, + /* F5 */ OP_NONE, + /* F6 */ OP_MODRM, + /* F7 */ OP_MODRM, + /* F8 */ OP_NONE, + /* F9 */ OP_NONE, + /* FA */ OP_NONE, + /* FB */ OP_NONE, + /* FC */ OP_NONE, + /* FD */ OP_NONE, + /* FE */ OP_MODRM, + /* FF */ OP_MODRM +}; + +static unsigned char flags_table_ex[256] = +{ + /* 0F00 */ OP_MODRM, + /* 0F01 */ OP_MODRM, + /* 0F02 */ OP_MODRM, + /* 0F03 */ OP_MODRM, + /* 0F04 */ OP_INVALID, + /* 0F05 */ OP_NONE, + /* 0F06 */ OP_NONE, + /* 0F07 */ OP_NONE, + /* 0F08 */ OP_NONE, + /* 0F09 */ OP_NONE, + /* 0F0A */ OP_INVALID, + /* 0F0B */ OP_NONE, + /* 0F0C */ OP_INVALID, + /* 0F0D */ OP_MODRM, + /* 0F0E */ OP_INVALID, + /* 0F0F */ OP_MODRM | OP_DATA_I8, //3Dnow + + /* 0F10 */ OP_MODRM, + /* 0F11 */ OP_MODRM, + /* 0F12 */ OP_MODRM, + /* 0F13 */ OP_MODRM, + /* 0F14 */ OP_MODRM, + /* 0F15 */ OP_MODRM, + /* 0F16 */ OP_MODRM, + /* 0F17 */ OP_MODRM, + /* 0F18 */ OP_MODRM, + /* 0F19 */ OP_INVALID, + /* 0F1A */ OP_INVALID, + /* 0F1B */ OP_INVALID, + /* 0F1C */ OP_INVALID, + /* 0F1D */ OP_INVALID, + /* 0F1E */ OP_INVALID, + /* 0F1F */ OP_NONE, + + /* 0F20 */ OP_MODRM, + /* 0F21 */ OP_MODRM, + /* 0F22 */ OP_MODRM, + /* 0F23 */ OP_MODRM, + /* 0F24 */ OP_MODRM | OP_EXTENDED, //SSE5 + /* 0F25 */ OP_INVALID, + /* 0F26 */ OP_MODRM, + /* 0F27 */ OP_INVALID, + /* 0F28 */ OP_MODRM, + /* 0F29 */ OP_MODRM, + /* 0F2A */ OP_MODRM, + /* 0F2B */ OP_MODRM, + /* 0F2C */ OP_MODRM, + /* 0F2D */ OP_MODRM, + /* 0F2E */ OP_MODRM, + /* 0F2F */ OP_MODRM, + + /* 0F30 */ OP_NONE, + /* 0F31 */ OP_NONE, + /* 0F32 */ OP_NONE, + /* 0F33 */ OP_NONE, + /* 0F34 */ OP_NONE, + /* 0F35 */ OP_NONE, + /* 0F36 */ OP_INVALID, + /* 0F37 */ OP_NONE, + /* 0F38 */ OP_MODRM | OP_EXTENDED, + /* 0F39 */ OP_INVALID, + /* 0F3A */ OP_MODRM | OP_EXTENDED | OP_DATA_I8, + /* 0F3B */ OP_INVALID, + /* 0F3C */ OP_INVALID, + /* 0F3D */ OP_INVALID, + /* 0F3E */ OP_INVALID, + /* 0F3F */ OP_INVALID, + + /* 0F40 */ OP_MODRM, + /* 0F41 */ OP_MODRM, + /* 0F42 */ OP_MODRM, + /* 0F43 */ OP_MODRM, + /* 0F44 */ OP_MODRM, + /* 0F45 */ OP_MODRM, + /* 0F46 */ OP_MODRM, + /* 0F47 */ OP_MODRM, + /* 0F48 */ OP_MODRM, + /* 0F49 */ OP_MODRM, + /* 0F4A */ OP_MODRM, + /* 0F4B */ OP_MODRM, + /* 0F4C */ OP_MODRM, + /* 0F4D */ OP_MODRM, + /* 0F4E */ OP_MODRM, + /* 0F4F */ OP_MODRM, + + /* 0F50 */ OP_MODRM, + /* 0F51 */ OP_MODRM, + /* 0F52 */ OP_MODRM, + /* 0F53 */ OP_MODRM, + /* 0F54 */ OP_MODRM, + /* 0F55 */ OP_MODRM, + /* 0F56 */ OP_MODRM, + /* 0F57 */ OP_MODRM, + /* 0F58 */ OP_MODRM, + /* 0F59 */ OP_MODRM, + /* 0F5A */ OP_MODRM, + /* 0F5B */ OP_MODRM, + /* 0F5C */ OP_MODRM, + /* 0F5D */ OP_MODRM, + /* 0F5E */ OP_MODRM, + /* 0F5F */ OP_MODRM, + + /* 0F60 */ OP_MODRM, + /* 0F61 */ OP_MODRM, + /* 0F62 */ OP_MODRM, + /* 0F63 */ OP_MODRM, + /* 0F64 */ OP_MODRM, + /* 0F65 */ OP_MODRM, + /* 0F66 */ OP_MODRM, + /* 0F67 */ OP_MODRM, + /* 0F68 */ OP_MODRM, + /* 0F69 */ OP_MODRM, + /* 0F6A */ OP_MODRM, + /* 0F6B */ OP_MODRM, + /* 0F6C */ OP_MODRM, + /* 0F6D */ OP_MODRM, + /* 0F6E */ OP_MODRM, + /* 0F6F */ OP_MODRM, + + /* 0F70 */ OP_MODRM | OP_DATA_I8, + /* 0F71 */ OP_MODRM | OP_DATA_I8, + /* 0F72 */ OP_MODRM | OP_DATA_I8, + /* 0F73 */ OP_MODRM | OP_DATA_I8, + /* 0F74 */ OP_MODRM, + /* 0F75 */ OP_MODRM, + /* 0F76 */ OP_MODRM, + /* 0F77 */ OP_NONE, + /* 0F78 */ OP_MODRM, + /* 0F79 */ OP_MODRM, + /* 0F7A */ OP_INVALID, + /* 0F7B */ OP_INVALID, + /* 0F7C */ OP_MODRM, + /* 0F7D */ OP_MODRM, + /* 0F7E */ OP_MODRM, + /* 0F7F */ OP_MODRM, + + /* 0F80 */ OP_RELATIVE | OP_DATA_I16_I32, + /* 0F81 */ OP_RELATIVE | OP_DATA_I16_I32, + /* 0F82 */ OP_RELATIVE | OP_DATA_I16_I32, + /* 0F83 */ OP_RELATIVE | OP_DATA_I16_I32, + /* 0F84 */ OP_RELATIVE | OP_DATA_I16_I32, + /* 0F85 */ OP_RELATIVE | OP_DATA_I16_I32, + /* 0F86 */ OP_RELATIVE | OP_DATA_I16_I32, + /* 0F87 */ OP_RELATIVE | OP_DATA_I16_I32, + /* 0F88 */ OP_RELATIVE | OP_DATA_I16_I32, + /* 0F89 */ OP_RELATIVE | OP_DATA_I16_I32, + /* 0F8A */ OP_RELATIVE | OP_DATA_I16_I32, + /* 0F8B */ OP_RELATIVE | OP_DATA_I16_I32, + /* 0F8C */ OP_RELATIVE | OP_DATA_I16_I32, + /* 0F8D */ OP_RELATIVE | OP_DATA_I16_I32, + /* 0F8E */ OP_RELATIVE | OP_DATA_I16_I32, + /* 0F8F */ OP_RELATIVE | OP_DATA_I16_I32, + + /* 0F90 */ OP_MODRM, + /* 0F91 */ OP_MODRM, + /* 0F92 */ OP_MODRM, + /* 0F93 */ OP_MODRM, + /* 0F94 */ OP_MODRM, + /* 0F95 */ OP_MODRM, + /* 0F96 */ OP_MODRM, + /* 0F97 */ OP_MODRM, + /* 0F98 */ OP_MODRM, + /* 0F99 */ OP_MODRM, + /* 0F9A */ OP_MODRM, + /* 0F9B */ OP_MODRM, + /* 0F9C */ OP_MODRM, + /* 0F9D */ OP_MODRM, + /* 0F9E */ OP_MODRM, + /* 0F9F */ OP_MODRM, + + /* 0FA0 */ OP_NONE, + /* 0FA1 */ OP_NONE, + /* 0FA2 */ OP_NONE, + /* 0FA3 */ OP_MODRM, + /* 0FA4 */ OP_MODRM | OP_DATA_I8, + /* 0FA5 */ OP_MODRM, + /* 0FA6 */ OP_INVALID, + /* 0FA7 */ OP_INVALID, + /* 0FA8 */ OP_NONE, + /* 0FA9 */ OP_NONE, + /* 0FAA */ OP_NONE, + /* 0FAB */ OP_MODRM, + /* 0FAC */ OP_MODRM | OP_DATA_I8, + /* 0FAD */ OP_MODRM, + /* 0FAE */ OP_MODRM, + /* 0FAF */ OP_MODRM, + + /* 0FB0 */ OP_MODRM, + /* 0FB1 */ OP_MODRM, + /* 0FB2 */ OP_MODRM, + /* 0FB3 */ OP_MODRM, + /* 0FB4 */ OP_MODRM, + /* 0FB5 */ OP_MODRM, + /* 0FB6 */ OP_MODRM, + /* 0FB7 */ OP_MODRM, + /* 0FB8 */ OP_MODRM, + /* 0FB9 */ OP_MODRM, + /* 0FBA */ OP_MODRM | OP_DATA_I8, + /* 0FBB */ OP_MODRM, + /* 0FBC */ OP_MODRM, + /* 0FBD */ OP_MODRM, + /* 0FBE */ OP_MODRM, + /* 0FBF */ OP_MODRM, + + /* 0FC0 */ OP_MODRM, + /* 0FC1 */ OP_MODRM, + /* 0FC2 */ OP_MODRM | OP_DATA_I8, + /* 0FC3 */ OP_MODRM, + /* 0FC4 */ OP_MODRM | OP_DATA_I8, + /* 0FC5 */ OP_MODRM | OP_DATA_I8, + /* 0FC6 */ OP_MODRM | OP_DATA_I8, + /* 0FC7 */ OP_MODRM, + /* 0FC8 */ OP_NONE, + /* 0FC9 */ OP_NONE, + /* 0FCA */ OP_NONE, + /* 0FCB */ OP_NONE, + /* 0FCC */ OP_NONE, + /* 0FCD */ OP_NONE, + /* 0FCE */ OP_NONE, + /* 0FCF */ OP_NONE, + + /* 0FD0 */ OP_MODRM, + /* 0FD1 */ OP_MODRM, + /* 0FD2 */ OP_MODRM, + /* 0FD3 */ OP_MODRM, + /* 0FD4 */ OP_MODRM, + /* 0FD5 */ OP_MODRM, + /* 0FD6 */ OP_MODRM, + /* 0FD7 */ OP_MODRM, + /* 0FD8 */ OP_MODRM, + /* 0FD9 */ OP_MODRM, + /* 0FDA */ OP_MODRM, + /* 0FDB */ OP_MODRM, + /* 0FDC */ OP_MODRM, + /* 0FDD */ OP_MODRM, + /* 0FDE */ OP_MODRM, + /* 0FDF */ OP_MODRM, + + /* 0FE0 */ OP_MODRM, + /* 0FE1 */ OP_MODRM, + /* 0FE2 */ OP_MODRM, + /* 0FE3 */ OP_MODRM, + /* 0FE4 */ OP_MODRM, + /* 0FE5 */ OP_MODRM, + /* 0FE6 */ OP_MODRM, + /* 0FE7 */ OP_MODRM, + /* 0FE8 */ OP_MODRM, + /* 0FE9 */ OP_MODRM, + /* 0FEA */ OP_MODRM, + /* 0FEB */ OP_MODRM, + /* 0FEC */ OP_MODRM, + /* 0FED */ OP_MODRM, + /* 0FEE */ OP_MODRM, + /* 0FEF */ OP_MODRM, + + /* 0FF0 */ OP_MODRM, + /* 0FF1 */ OP_MODRM, + /* 0FF2 */ OP_MODRM, + /* 0FF3 */ OP_MODRM, + /* 0FF4 */ OP_MODRM, + /* 0FF5 */ OP_MODRM, + /* 0FF6 */ OP_MODRM, + /* 0FF7 */ OP_MODRM, + /* 0FF8 */ OP_MODRM, + /* 0FF9 */ OP_MODRM, + /* 0FFA */ OP_MODRM, + /* 0FFB */ OP_MODRM, + /* 0FFC */ OP_MODRM, + /* 0FFD */ OP_MODRM, + /* 0FFE */ OP_MODRM, + /* 0FFF */ OP_INVALID, +}; + +unsigned char cflags(UINT8 op) +{ + return flags_table[op]; +} + + +unsigned char cflags_ex(UINT8 op) +{ + return flags_table_ex[op]; +} + +unsigned int __fastcall PrevInstrLength(void* code, size_t bufferSize, UINT32 is64) +{ + void* buffer = malloc(bufferSize + 0x10); + if (buffer == NULL) { + return -1; + } + memset(buffer, 0x90, bufferSize + 0x10); + memcpy(buffer, code, bufferSize); + + int length = 0; + ldasm_data ld; + for (size_t i = 0; i < bufferSize; i++) + { + int len = ldasm_length((char*)buffer + i, is64); + if (i+len == bufferSize) { + length = len; + } + } + free(buffer); + return length; +} + +unsigned int __fastcall ldasm_length(void* code, UINT32 is64) +{ + ldasm_data ld; + return ldasm(code, &ld, 1); +} + +unsigned int __fastcall ldasm(void* code, ldasm_data* ld, UINT32 is64) +/* + Description: + Disassemble one instruction + + Arguments: + code - pointer to the code for disassemble + ld - pointer to structure ldasm_data + is64 - set this flag for 64-bit code, and clear for 32-bit + + Return: + length of instruction + */ +{ + UINT8* p = (UINT8*)code; + UINT8 s, op, f; + UINT8 rexw, pr_66, pr_67; + + s = rexw = pr_66 = pr_67 = 0; + + /* dummy check */ + if (!code || !ld) + return 0; + + /* init output data */ + memset(ld, 0, sizeof(ldasm_data)); + + /* phase 1: parse prefixies */ + while (cflags(*p) & OP_PREFIX) { + if (*p == 0x66) + pr_66 = 1; + if (*p == 0x67) + pr_67 = 1; + p++; + s++; + ld->flags |= F_PREFIX; + if (s == 15) { + ld->flags |= F_INVALID; + return s; + } + } + + /* parse REX prefix */ + if (is64 && *p >> 4 == 4) { + ld->rex = *p; + rexw = (ld->rex >> 3) & 1; + ld->flags |= F_REX; + p++; + s++; + } + + /* can be only one REX prefix */ + if (is64 && *p >> 4 == 4) { + ld->flags |= F_INVALID; + s++; + return s; + } + + /* phase 2: parse opcode */ + ld->opcd_offset = (UINT8)(p - (UINT8*)code); + ld->opcd_size = 1; + op = *p++; + s++; + + /* is 2 byte opcode? */ + if (op == 0x0F) { + op = *p++; + s++; + ld->opcd_size++; + f = cflags_ex(op); + if (f & OP_INVALID) { + ld->flags |= F_INVALID; + return s; + } + /* for SSE instructions */ + if (f & OP_EXTENDED) { + op = *p++; + s++; + ld->opcd_size++; + } + } + else { + f = cflags(op); + /* pr_66 = pr_67 for opcodes A0-A3 */ + if (op >= 0xA0 && op <= 0xA3) + pr_66 = pr_67; + } + + /* phase 3: parse ModR/M, SIB and DISP */ + if (f & OP_MODRM) { + UINT8 mod = (*p >> 6); + UINT8 ro = (*p & 0x38) >> 3; + UINT8 rm = (*p & 7); + + ld->modrm = *p++; + s++; + ld->flags |= F_MODRM; + + /* in F6,F7 opcodes immediate data present if R/O == 0 */ + if (op == 0xF6 && (ro == 0 || ro == 1)) + f |= OP_DATA_I8; + if (op == 0xF7 && (ro == 0 || ro == 1)) + f |= OP_DATA_I16_I32_I64; + + /* is SIB byte exist? */ + if (mod != 3 && rm == 4 && !(!is64 && pr_67)) { + ld->sib = *p++; + s++; + ld->flags |= F_SIB; + + /* if base == 5 and mod == 0 */ + if ((ld->sib & 7) == 5 && mod == 0) { + ld->disp_size = 4; + } + } + + switch (mod) { + case 0: + if (is64) { + if (rm == 5) { + ld->disp_size = 4; + if (is64) + ld->flags |= F_RELATIVE; + } + } + else if (pr_67) { + if (rm == 6) + ld->disp_size = 2; + } + else { + if (rm == 5) + ld->disp_size = 4; + } + break; + case 1: + ld->disp_size = 1; + break; + case 2: + if (is64) + ld->disp_size = 4; + else if (pr_67) + ld->disp_size = 2; + else + ld->disp_size = 4; + break; + } + + if (ld->disp_size) { + ld->disp_offset = (UINT8)(p - (UINT8*)code); + p += ld->disp_size; + s += ld->disp_size; + ld->flags |= F_DISP; + } + } + + /* phase 4: parse immediate data */ + if (rexw && f & OP_DATA_I16_I32_I64) + ld->imm_size = 8; + else if (f & OP_DATA_I16_I32 || f & OP_DATA_I16_I32_I64) + ld->imm_size = 4 - (pr_66 << 1); + + /* if exist, add OP_DATA_I16 and OP_DATA_I8 size */ + ld->imm_size += f & 3; + + if (ld->imm_size) { + s += ld->imm_size; + ld->imm_offset = (UINT8)(p - (UINT8*)code); + ld->flags |= F_IMM; + if (f & OP_RELATIVE) + ld->flags |= F_RELATIVE; + } + + /* instruction is too long */ + if (s > 15) + ld->flags |= F_INVALID; + + return s; +} + +// Get function size +unsigned long __fastcall SizeOfProc(void* Proc) +{ + UINT32 Length; + UINT8* pOpcode; + UINT32 Result = 0; + ldasm_data data = { 0 }; + + do { + Length = ldasm((UINT8*)Proc, &data, is_x64); + + pOpcode = (UINT8*)Proc + data.opcd_offset; + Result += Length; + + if (Length == 1) { + UCHAR opCode; + memcpy(&opCode, pOpcode, 1); + if (opCode == (UINT8)0xCC) { + break; + } + } + + /*if ((Length == 1) && (*pOpcode == 0xC3)) + break; + + if ((Length == 3) && (*pOpcode == 0xC2)) + break;*/ + + Proc = (void*)((size_t)Proc + Length); + } while (Length); + + return Result; +} + +// If function address is jmp - get jmp destination +void* __fastcall ResolveJmp(void* Proc) +{ + UINT32 Length; + UINT8* pOpcode; + ldasm_data data = { 0 }; + + Length = ldasm((UINT8*)Proc, &data, is_x64); + pOpcode = (UINT8*)Proc + data.opcd_offset; + + // Recursive unwind + if (Length == 5 && data.opcd_size == 1 && *pOpcode == 0xE9) { + UINT32 delta = *(INT32*)((uintptr_t)Proc + data.opcd_size); + return ResolveJmp((void*)((uintptr_t)Proc + delta + Length)); + } + + return Proc; +} diff --git a/BranchTrace-x64plugin-wtl/LDasm/LDasm.h b/BranchTrace-x64plugin-wtl/LDasm/LDasm.h new file mode 100644 index 0000000..5514989 --- /dev/null +++ b/BranchTrace-x64plugin-wtl/LDasm/LDasm.h @@ -0,0 +1,51 @@ +#ifndef _LDASM_ +#define _LDASM_ + +#include + +#ifdef _WIN64 +#define is_x64 1 +#else +#define is_x64 0 +#endif//USE64 + +#ifdef __cplusplus +extern "C" +{ +#endif + +#define F_INVALID 0x01 +#define F_PREFIX 0x02 +#define F_REX 0x04 +#define F_MODRM 0x08 +#define F_SIB 0x10 +#define F_DISP 0x20 +#define F_IMM 0x40 +#define F_RELATIVE 0x80 + +typedef struct _ldasm_data +{ + UINT8 flags; + UINT8 rex; + UINT8 modrm; + UINT8 sib; + UINT8 opcd_offset; + UINT8 opcd_size; + UINT8 disp_offset; + UINT8 disp_size; + UINT8 imm_offset; + UINT8 imm_size; +} ldasm_data; + + +unsigned int __fastcall ldasm_length(void* code, UINT32 is64); +unsigned int __fastcall ldasm(void* code, ldasm_data* ld, UINT32 is64); +unsigned long __fastcall SizeOfProc(void* Proc); +unsigned int __fastcall PrevInstrLength(void* code, size_t bufferSize, UINT32 is64); +void* __fastcall ResolveJmp(void* Proc); + +#ifdef __cplusplus +} +#endif + +#endif//_LDASM_ diff --git a/BranchTrace-x64plugin-wtl/ThreadTraceCore.cpp b/BranchTrace-x64plugin-wtl/ThreadTraceCore.cpp new file mode 100644 index 0000000..3de4cd5 --- /dev/null +++ b/BranchTrace-x64plugin-wtl/ThreadTraceCore.cpp @@ -0,0 +1,265 @@ +#include "ThreadTraceCore.h" +#include + + + +bool StartTrace(DWORD ThreadId) +{ + + HANDLE hDevice = CreateFileA("\\\\.\\Branch-Trace", GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE, 0, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0); + + START_THREAD_TRACE_PARAM StartRequest = { 0 }; + StartRequest.ThreadId = ThreadId; + + DWORD BytesReturned = 0; + if (!DeviceIoControl(hDevice, IOCTL_START_THREAD_TRACE, + (LPVOID)&StartRequest, sizeof(StartRequest), + (LPVOID)&StartRequest, sizeof(StartRequest), + &BytesReturned, NULL)) + { + return false; + } + + return true; +} + +bool StopTrace() +{ + HANDLE hDevice = CreateFileA("\\\\.\\Branch-Trace", GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE, 0, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0); + if (hDevice == INVALID_HANDLE_VALUE) { + return false; + } + DWORD BytesReturned = 0; + STOP_THREAD_TRACE_PARAM StopRequest = { 0 }; + StopRequest.ThreadId = NULL; + StopRequest.Buffer = NULL; + StopRequest.BufferSize = 0; + StopRequest.FilterStart = 0; + StopRequest.FilterEnd = 0; + + if (!DeviceIoControl(hDevice, IOCTL_STOP_THREAD_TRACE, + (LPVOID)&StopRequest, sizeof(StopRequest), + (LPVOID)&StopRequest, sizeof(StopRequest), + &BytesReturned, NULL)) + { + CloseHandle(hDevice); + return false; + } + + CloseHandle(hDevice); + return true; +} + +bool StopAndFetchTrace(DWORD ThreadId, ULONG64 filterStart, ULONG64 fileterEnd, DWORD Records, PBTS_RECORD64* lpRecordStart, PBTS_RECORD64* lpRecordEnd) +{ + if (Records <= 0 || lpRecordStart == NULL || lpRecordEnd == NULL) { + return false; + } + + HANDLE hDevice = CreateFileA("\\\\.\\Branch-Trace", GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE, 0, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0); + if (hDevice == INVALID_HANDLE_VALUE) { + return false; + } + + DWORD bufferSize = Records * sizeof(BTS_RECORD64); + PVOID Buffer = VirtualAlloc(NULL, bufferSize, MEM_COMMIT, PAGE_READWRITE); + if (Buffer == NULL) { + CloseHandle(hDevice); + return false; + } + + //STOP_THREAD_TRACE_PARAM StopRequest = { 0 }; + //StopRequest.ThreadId = ThreadId; + //StopRequest.Buffer = Buffer; + //StopRequest.BufferSize = bufferSize; + //StopRequest.FilterStart = (ULONG64)filterStart; + //StopRequest.FilterEnd = (ULONG64)fileterEnd; + + STOP_THREAD_TRACE_PARAM StopRequest = { 0 }; + StopRequest.ThreadId = ThreadId; + StopRequest.Buffer = Buffer; + StopRequest.BufferSize = 0x2000; + StopRequest.FilterStart = 0x00400000; + StopRequest.FilterEnd = 0x00D4C000 + 0x4000; + + DWORD BytesReturned = 0; + if (!DeviceIoControl(hDevice, IOCTL_STOP_THREAD_TRACE, + (LPVOID)&StopRequest, sizeof(StopRequest), + (LPVOID)&StopRequest, sizeof(StopRequest), + &BytesReturned, NULL)) + { + VirtualFree(Buffer, 0, MEM_RELEASE); + CloseHandle(hDevice); + return false; + } + + if (StopRequest.ReadSize == 0) { + VirtualFree(Buffer, 0, MEM_RELEASE); + CloseHandle(hDevice); + return false; + } + + + PBTS_RECORD64 RecordStart = (PBTS_RECORD64)Buffer; + PBTS_RECORD64 RecordEnd = (PBTS_RECORD64)((PUCHAR)Buffer + StopRequest.ReadSize); + + // ÄæÅÅ + for (PBTS_RECORD64 p1 = RecordStart, p2 = RecordEnd - 1; + p1 < p2; + p1++, p2--) + { + BTS_RECORD64 temp = *p1; + *p1 = *p2; + *p2 = temp; + } + + + + *lpRecordStart = RecordStart; + *lpRecordEnd = RecordEnd; + + CloseHandle(hDevice); + return true; +} + +bool TraceCursor::isAtTo() +{ + return pathIndex == 1; +} + +bool TraceCursor::isAtFrom() +{ + return pathIndex == 0; +} + +bool TraceCursor::toEndInstr() +{ + nodeIndex = nodes.size() - 1; + pathIndex = currentNode().paths.size() - 1; + return true; +} + +bool TraceCursor::toPrevInstrInto() +{ + if (pathIndex > 0) { + pathIndex--; + return true; + } + + if (nodeIndex > 0) { + nodeIndex--; + pathIndex = currentNode().paths.size() - 1; + return true; + } + + return false; +} + +bool TraceCursor::toNextInstrInto() +{ + if (pathIndex < currentNode().paths.size() - 1) { + pathIndex++; + return true; + } + + + //int pathSize = currentNode().paths.size(); + //if (pathSize > 0 && pathIndex < pathSize - 1) { + // pathIndex++; + // return true; + //} + + if (nodeIndex < nodes.size() - 1) { + nodeIndex++; + pathIndex = 0; + return true; + } + + return false; + + //int nodeSize = nodes.size(); + //if (nodeSize > 0 && nodeIndex < nodeSize - 1) + //{ + // nodeIndex++; + // pathIndex = 0; + // return true; + //} + + //return false; +} + +bool TraceCursor::toPrevInstr() +{ + if (pathIndex > 0) { + pathIndex--; + return true; + } + + if (currentNode().hasPrev) { + nodeIndex = currentNode().prevIndex; + pathIndex = currentNode().paths.size() - 1; + return true; + } + + //if (nodeIndex > 0) + //{ + // nodeIndex--; + // pathIndex = currentNode().paths.size() - 1; + // return true; + //} + + return false; +} + +bool TraceCursor::toNextInstr() +{ + if (pathIndex < currentNode().paths.size() - 1) { + pathIndex++; + return true; + } + + if (currentNode().hasNext) { + nodeIndex = currentNode().nextIndex; + pathIndex = 0; + return true; + } + + return false; +} + +bool TraceCursor::toProcStart() +{ + nodeIndex = currentNode().procStartIndex; + pathIndex = 0; + return true; +} + +bool TraceCursor::toProcEnd() +{ + if (currentNode().procSubIndex.size() > 0) { + nodeIndex = currentNode().procSubIndex.back(); + pathIndex = currentNode().paths.size() - 1; + return true; + } + + return false; +} + +bool TraceCursor::toProcPrevNode() +{ + if (currentNode().hasPrev) { + nodeIndex = currentNode().prevIndex; + } + pathIndex = 0; + return true; +} + +bool TraceCursor::toProcNextNode() +{ + if (currentNode().hasNext) { + nodeIndex = currentNode().nextIndex; + } + pathIndex = 0; + return true; +} + diff --git a/BranchTrace-x64plugin-wtl/ThreadTraceCore.h b/BranchTrace-x64plugin-wtl/ThreadTraceCore.h new file mode 100644 index 0000000..a6e611d --- /dev/null +++ b/BranchTrace-x64plugin-wtl/ThreadTraceCore.h @@ -0,0 +1,103 @@ +#pragma once +#include +#include "..\BranchTracerSys\ioctls.h" +#include +#include "pluginsdk\_scriptapi_flag.h" +//#include "LDasm/LDasm.h" + +#include "LDasm/LDasm.h" + +typedef struct _BTS_RECORD64 +{ + ULONG64 from; // ¼Ç¼·ÖÖ§µÄÔ´µØÖ· + ULONG64 to; // ¼Ç¼·ÖÖ§µÄÄ¿±êµØÖ· + union + { + ULONG64 branchPredicted; + ULONG64 branchType; + }; +}BTS_RECORD64, * PBTS_RECORD64; + + + +enum BRANCH_TYPE +{ + BRANCH_TYPE_UNKOWN, + BRANCH_TYPE_RET, + BRANCH_TYPE_JCC, + BRANCH_TYPE_CALL +}; +bool StartTrace(DWORD ThreadId); +bool StopTrace(); +bool StopAndFetchTrace(DWORD ThreadId, ULONG64 filterStart, ULONG64 fileterEnd, DWORD Records, PBTS_RECORD64* lpRecordStart, PBTS_RECORD64* lpRecordEnd); + + + +class TraceNode { + +public: + // pRecord.from + ULONG_PTR from; + // pRecord.to + ULONG_PTR to; + DWORD branchType; + + bool hasPrev; + bool hasNext; + int prevIndex; // Ìø¹ýÖмäµÄº¯Êýµ÷Óà + int nextIndex; + int procStartIndex; + std::vector procSubIndex; + + + // pRecord.to ~ nextRecord.from + std::vector paths; + + +}; + +class Proc +{ + std::vector nodes; +}; + + +class TraceCursor { +public: + int nodeIndex; + int pathIndex; + + std::vector nodes; + TraceNode& currentNode() { + return nodes[nodeIndex]; + } + + ULONG_PTR currentAddr() { + return nodes[nodeIndex].paths[pathIndex]; + } + DWORD branchType() { + return nodes[nodeIndex].branchType; + } + ULONG_PTR currentFrom() { + return nodes[nodeIndex].from; + } + ULONG_PTR currentTo() { + return nodes[nodeIndex].to; + } + + + bool isAtTo(); + bool isAtFrom(); + + bool toEndInstr(); + bool toPrevInstrInto(); + bool toNextInstrInto(); + bool toPrevInstr(); + bool toNextInstr(); + bool toProcStart(); + bool toProcEnd(); + bool toProcPrevNode(); + bool toProcNextNode(); +}; + + diff --git a/BranchTrace-x64plugin-wtl/ThreadTraceDialog.cpp b/BranchTrace-x64plugin-wtl/ThreadTraceDialog.cpp new file mode 100644 index 0000000..eb772af --- /dev/null +++ b/BranchTrace-x64plugin-wtl/ThreadTraceDialog.cpp @@ -0,0 +1,545 @@ +#include "ThreadTraceDialog.h" +#include "pluginsdk/bridgemain.h" +#include "pluginsdk/_scriptapi_memory.h" +#include "disassembler.h" +#include "pluginsdk/_scriptapi_gui.h" +#include "plugin_global.h" +#include "pluginsdk/_scriptapi_misc.h" +#include +#include + +ThreadTraceDialog::~ThreadTraceDialog() +{ + +} + +BOOL ThreadTraceDialog::OnInitDialog(CWindow wndFocus, LPARAM lInitParam) +{ + DoDataExchange(FALSE); + return TRUE; +} + + +void ThreadTraceDialog::OnCloseDialog() +{ + ShowWindow(SW_HIDE); + ResetAll(); +} + +LRESULT ThreadTraceDialog::OnDropdownComboboxThread(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/) +{ + // TODO: Add your control notification handler code here + THREADLIST threadList; + DbgGetThreadList(&threadList); + + m_comboThread.ResetContent(); + + // ±éÀúËùÓÐÏ̳߳õʼ»¯Áбí + for (size_t i = 0; i < threadList.count; i++) + { + THREADALLINFO* thread = &threadList.list[i]; + + bool isMainThread = thread->BasicInfo.ThreadNumber == 0; + bool isCurrentThead = i == threadList.CurrentThread; + + CString str; + str.Format("[%d] thread-%x %s %s", i, thread->BasicInfo.ThreadId, isMainThread ? "[main]" : "", isCurrentThead ? "[current]" : ""); + m_comboThread.InsertString(i, str); + m_comboThread.SetItemData(i, thread->BasicInfo.ThreadId); + + if (isMainThread) { + m_comboThread.SetCurSel(i); + } + + } + return 1; +} + +LRESULT ThreadTraceDialog::OnDropdownComboboxModule(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/) +{ + HANDLE processHandle = DbgGetProcessHandle(); + if (processHandle == NULL) { + return true; + } + + HANDLE Snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, DbgGetProcessId()); + if (Snapshot == INVALID_HANDLE_VALUE) + { + return true; + } + + CString str; + str = "mod.main()"; + duint mainModule = 0; + Script::Misc::ParseExpression(str.GetBuffer(), &mainModule); + + m_comboModule.ResetContent(); + MODULEENTRY32 ModuleInfo = { sizeof(MODULEENTRY32) }; + if (Module32First(Snapshot, &ModuleInfo)) + { + do { + + duint moduleSize = 0; + str.Format("mod.size(%p)", ModuleInfo.hModule); + Script::Misc::ParseExpression(str.GetBuffer(), &moduleSize); + + duint moduleEnd = (duint)ModuleInfo.hModule + moduleSize; + + bool isMainModule = mainModule == (duint)ModuleInfo.hModule; + duint isUserModule = false; + duint isSystemModule = false; + str.Format("mod.user(%p)", ModuleInfo.hModule); + Script::Misc::ParseExpression(str.GetBuffer(), &isUserModule); + str.Format("mod.system(%p)", ModuleInfo.hModule); + Script::Misc::ParseExpression(str.GetBuffer(), &isSystemModule); + + + str.Format("[%-4s][%p] %s\n", + isMainModule ? "main" : isUserModule ? "user" : isSystemModule ? "syst" : "", + ModuleInfo.hModule, ModuleInfo.szModule); + int index = m_comboModule.InsertString(m_comboModule.GetCount(), str); + m_comboModule.SetItemData(index, (ULONG_PTR)ModuleInfo.hModule); + + if (isMainModule) { + m_comboModule.SetCurSel(index); + } + + } while (Module32Next(Snapshot, &ModuleInfo)); + } + return true; +} + +LRESULT ThreadTraceDialog::OnBnClickedButtonStarttrace(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/) +{ + // ¿ªÆô¸ú×Ù + int cursel = m_comboThread.GetCurSel(); + if (cursel == -1) { + MessageBox(TEXT("You must select a thread!")); + return TRUE; + } + + cursel = m_comboModule.GetCurSel(); + if (cursel == -1) { + MessageBox(TEXT("You must select a module!")); + return TRUE; + } + + +#ifdef DEBUG + +#else + if (!StartTrace(m_comboThread.GetItemData(cursel))) { + MessageBox(TEXT("Start Trace failed!")); + return FALSE; + } +#endif // DEBUG + + m_bTracingFlag = TRUE; + + // µ÷Õû½çÃæ + m_buttonStarttrace.EnableWindow(FALSE); + m_buttonReset.EnableWindow(TRUE); + m_comboThread.EnableWindow(FALSE); + m_comboModule.EnableWindow(FALSE); + + return TRUE; +} + +LRESULT ThreadTraceDialog::OnBnClickedButtonReset(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/) +{ + ResetAll(); + return TRUE; +} + + + +LRESULT ThreadTraceDialog::OnBnClickedButtonPrevInto(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/) +{ + cursor.toPrevInstrInto(); + ULONG_PTR addr = cursor.currentAddr(); + GuiDisasmAt(addr, addr); + return TRUE; +} + + +LRESULT ThreadTraceDialog::OnBnClickedButtonNextInto(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/) +{ + cursor.toNextInstrInto(); + ULONG_PTR addr = cursor.currentAddr(); + GuiDisasmAt(addr, addr); + return TRUE; +} + +LRESULT ThreadTraceDialog::OnBnClickedButtonPrev(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/) +{ + + // »ñÈ¡ÉÏÒ»ÌõÖ¸ÁîµÄµØÖ·. + cursor.toPrevInstr(); + GuiDisasmAt(cursor.currentAddr(), cursor.currentAddr()); + + return TRUE; +} + + +LRESULT ThreadTraceDialog::OnBnClickedButtonNext(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/) +{ + + // »ñÈ¡ÏÂÒ»ÌõÖ¸ÁîµÄµØÖ·. + cursor.toNextInstr(); + GuiDisasmAt(cursor.currentAddr(), cursor.currentAddr()); + + return TRUE; +} + +LRESULT ThreadTraceDialog::OnBnClickedButtonProcStart(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/) +{ + cursor.toProcStart(); + GuiDisasmAt(cursor.currentAddr(), cursor.currentAddr()); + + + CString str; + TraceNode node = cursor.currentNode(); + + + for (size_t j = 0; j < node.paths.size(); j++) + { + str.Format("traceexecute %p", node.paths[j]); + DbgCmdExec(str.GetBuffer()); + } + + while (node.hasNext) + { + node = cursor.nodes[node.nextIndex]; + for (size_t j = 0; j < node.paths.size(); j++) + { + str.Format("traceexecute %p", node.paths[j]); + DbgCmdExec(str.GetBuffer()); + } + } + + return TRUE; +} + +LRESULT ThreadTraceDialog::OnBnClickedButtonProcEnd(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/) +{ + cursor.toProcEnd(); + GuiDisasmAt(cursor.currentAddr(), cursor.currentAddr()); + return TRUE; +} + +LRESULT ThreadTraceDialog::OnBnClickedButtonPrevSnippet(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/) +{ + cursor.toProcPrevNode(); + GuiDisasmAt(cursor.currentAddr(), cursor.currentAddr()); + return TRUE; +} + +LRESULT ThreadTraceDialog::OnBnClickedButtonNextSnippet(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/) +{ + cursor.toProcNextNode(); + GuiDisasmAt(cursor.currentAddr(), cursor.currentAddr()); + return TRUE; +} + +LRESULT ThreadTraceDialog::OnBnClickedButtonToEnd(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/) +{ + cursor.toEndInstr(); + ULONG_PTR addr = cursor.currentAddr(); + GuiDisasmAt(addr, addr); + + return TRUE; +} + +void ThreadTraceDialog::OnBreakDebugPoint() +{ + if (m_bTracingFlag != TRUE) { + return; + } + + int threadComboCursel = m_comboThread.GetCurSel(); + if (threadComboCursel == -1) { + return; + } + + int moduleComboCursel = m_comboModule.GetCurSel(); + if (moduleComboCursel == -1) { + return; + } + + + // ×·×ÙµÄÏß³ÌID + DWORD_PTR traceThreadId = m_comboThread.GetItemData(threadComboCursel); + DWORD_PTR moduleBase = m_comboModule.GetItemData(moduleComboCursel); + CString temp; + //duint moduleSize = 0; + //temp.Format("mem.size(%p)", moduleBase); + //Script::Misc::ParseExpression(temp.GetBuffer(), &moduleSize); + duint moduleSize = 0; + temp.Format("mod.size(%p)", moduleBase); + Script::Misc::ParseExpression(temp.GetBuffer(), &moduleSize); + DWORD_PTR moduleEnd = moduleBase + moduleSize; + + + + // »ñÈ¡±»ÖжϵÄÏß³ÌÐÅÏ¢ + THREADLIST threadList; + DbgGetThreadList(&threadList); + DWORD breakedThread = threadList.list[threadList.CurrentThread].BasicInfo.ThreadId; + + if (traceThreadId != breakedThread) { + return; + } + + // Í£Ö¹¼à¿Ø + if (!StopAndFetchTrace(traceThreadId, moduleBase, moduleEnd, 5000, &RecordStart, &RecordEnd)) { + MessageBox("Fetch trace record failed!"); + m_bTracingFlag = FALSE; + return; + } + + m_bTracingFlag = FALSE; + + + // ½âÎöÖ¸Áî + Disassembler* disasm = PluginGlobal::GetInstance()->disassembler; + Instruction instrction; + duint readSize; + unsigned char instrBuffer[0x10]; + PBTS_RECORD64 pRecord = RecordEnd - 1; + while (pRecord >= RecordStart) + { + Script::Memory::Read((duint)pRecord->from, instrBuffer, 0x10, &readSize); + + if (!disasm->Disasm(instrBuffer, readSize, &instrction)) { + _plugin_logprintf("BranchTrace Error: Disasm failed! codes:"); + for (duint i = 0; i < readSize; i++) { + _plugin_logprintf("%x ", instrBuffer[i]); + } + continue; + } + ZydisMnemonic mnemonic = instrction.zydisInstrction.mnemonic; + if (mnemonic == ZYDIS_MNEMONIC_RET) { + pRecord->branchType = BRANCH_TYPE_RET; + } + else if (ZYDIS_MNEMONIC_JB <= mnemonic && mnemonic <= ZYDIS_MNEMONIC_JZ) { + pRecord->branchType = BRANCH_TYPE_JCC; + } + else if (mnemonic == ZYDIS_MNEMONIC_CALL) { + pRecord->branchType = BRANCH_TYPE_CALL; + } + else { + // UNKOWN Instrction; + pRecord->branchType = BRANCH_TYPE_UNKOWN; + _plugin_logprintf("UNKOWN at : %p mnemonic:%d \n", pRecord->from, instrction.zydisInstrction.mnemonic); + } + + pRecord--; + } + + + + // ´æ´¢Êý¾Ý + cursor.nodes.clear(); + int instrCount = 0; + + std::map PrcoToMap;; + std::stack ProcStak; + + CString str; + pRecord = RecordStart; + + while (pRecord < RecordEnd) + { + int currentNodeIndex = cursor.nodes.size(); + // ¼ÓÈëÁбí + cursor.nodes.emplace_back(); + TraceNode& node = cursor.nodes.back(); + + node.from = pRecord->from; + node.to = pRecord->to; + node.branchType = pRecord->branchType; + + node.paths.push_back(pRecord->to); + instrCount++; + + // Ìî³ä´úÂë¿é + PBTS_RECORD64 pNextRecord = pRecord + 1; + + str.Format("dis.next(%p)", pRecord->to); + duint nextInstr = 0; + Script::Misc::ParseExpression(str.GetBuffer(), &nextInstr); + + if (pNextRecord < RecordEnd) + { + // ±ÜÃâÔàÊý¾Ý,´óÓÚ500×ֽڵĴúÂë¿éÖ±½ÓÌø¹ý + ULONG64 offset = pNextRecord->from - nextInstr; + while (nextInstr != 0 && nextInstr <= pNextRecord->from && offset < 500) + { + node.paths.push_back(nextInstr); + instrCount++; + + str.Format("dis.next(%p)", nextInstr); + nextInstr = 0; + Script::Misc::ParseExpression(str.GetBuffer(), &nextInstr); + } + + } + + // ±ê¼ÇprocStartIndex procSubNodeIndex + switch (node.branchType) + { + case BRANCH_TYPE_CALL: + ProcStak.push(currentNodeIndex); + node.procStartIndex = currentNodeIndex; + cursor.nodes[currentNodeIndex].procSubIndex.push_back(currentNodeIndex); + break; + + case BRANCH_TYPE_RET: + + if (!ProcStak.empty()) { + ProcStak.pop(); + } + + if (!ProcStak.empty()) { + node.procStartIndex = ProcStak.top(); + cursor.nodes[ProcStak.top()].procSubIndex.push_back(currentNodeIndex); + } + else { + node.procStartIndex = currentNodeIndex; + cursor.nodes[currentNodeIndex].procSubIndex.push_back(currentNodeIndex); + } + break; + + case BRANCH_TYPE_JCC: + if (!ProcStak.empty()) { + node.procStartIndex = ProcStak.top(); + cursor.nodes[ProcStak.top()].procSubIndex.push_back(currentNodeIndex); + + } + else { + node.procStartIndex = currentNodeIndex; + cursor.nodes[currentNodeIndex].procSubIndex.push_back(currentNodeIndex); + } + + break; + default: + break; + } + + // ±ê¼Ç PrcoÁ´ 1~2~3~4 + if (node.branchType == BRANCH_TYPE_CALL) { + + duint nextInstr = 0; + str.Format("dis.next(%p)", pRecord->from); + Script::Misc::ParseExpression(str.GetBuffer(), &nextInstr); + if (nextInstr != 0) { + PrcoToMap[nextInstr] = currentNodeIndex - 1; + } + + } + else if (node.branchType == BRANCH_TYPE_RET) + { + if (PrcoToMap.count(node.to) > 0) { + auto preIndex = PrcoToMap[node.to]; + auto curIndex = currentNodeIndex; + + cursor.nodes[preIndex].nextIndex = curIndex; + cursor.nodes[preIndex].hasNext = true; + cursor.nodes[curIndex].prevIndex = preIndex; + cursor.nodes[curIndex].hasPrev = true; + + PrcoToMap.erase(node.to); + } + } + else if (node.branchType == BRANCH_TYPE_JCC) + { + if (currentNodeIndex > 0) { + auto preIndex = currentNodeIndex - 1; + auto curIndex = currentNodeIndex; + cursor.nodes[preIndex].nextIndex = curIndex; + cursor.nodes[preIndex].hasNext = true; + cursor.nodes[curIndex].prevIndex = preIndex; + cursor.nodes[curIndex].hasPrev = true; + } + } + pRecord++; + } + + + + + + // ÉèÖÃÆðʼλÖà + cursor.toEndInstr(); + GuiDisasmAt(cursor.currentAddr(), cursor.currentAddr()); + + // ÉèÖÿؼþ״̬ + m_comboThread.EnableWindow(FALSE); + m_buttonPrevInto.EnableWindow(TRUE); + m_buttonNextInto.EnableWindow(TRUE); + m_buttonProcStart.EnableWindow(TRUE); + m_buttonProcEnd.EnableWindow(TRUE); + m_buttonPrevSnippet.EnableWindow(TRUE); + m_buttonNextSnippet.EnableWindow(TRUE); + m_buttonPrev.EnableWindow(TRUE); + m_buttonNext.EnableWindow(TRUE); + m_buttonToEnd.EnableWindow(TRUE); + + + CString note; + int count = RecordEnd - RecordStart; + note.Format(TEXT("Fetched Branch Records!\r\n Branch count: %d\r\nInstrction count: %d"), count, instrCount); + MessageBox(note, TEXT("SUCCESS")); + + + + // ÊÍ·ÅÄÚ´æ + if (RecordStart) { + VirtualFree((PVOID)RecordStart, 0, MEM_RELEASE); + RecordStart = NULL; + RecordEnd = NULL; + } + +} + +void ThreadTraceDialog::ResetAll() +{ + // Í£Ö¹¼à¿Ø + StopTrace(); + m_bTracingFlag = FALSE; + + // ÖØÖÿؼþ + m_buttonStarttrace.EnableWindow(TRUE); + m_buttonReset.EnableWindow(FALSE); + m_buttonPrevInto.EnableWindow(FALSE); + m_buttonNextInto.EnableWindow(FALSE); + m_buttonProcStart.EnableWindow(FALSE); + m_buttonProcEnd.EnableWindow(FALSE); + m_buttonPrevSnippet.EnableWindow(FALSE); + m_buttonNextSnippet.EnableWindow(FALSE); + m_buttonPrev.EnableWindow(FALSE); + m_buttonNext.EnableWindow(FALSE); + m_buttonToEnd.EnableWindow(FALSE); + + m_comboThread.EnableWindow(TRUE); + m_comboThread.SetCurSel(-1); + m_comboModule.EnableWindow(TRUE); + m_comboModule.SetCurSel(-1); + + + +} + +void ThreadTraceDialog::HighlightTrace() +{ + //PBTS_RECORD64 pRecord = RecordCursor; + //CString str; + //str.Format("traceexecute %p", pRecord->to); + //DbgCmdExec(str.GetBuffer()); + //str.Format("traceexecute %p", pRecord->from); + //DbgCmdExec(str.GetBuffer()); + + return; +} + + diff --git a/BranchTrace-x64plugin-wtl/ThreadTraceDialog.h b/BranchTrace-x64plugin-wtl/ThreadTraceDialog.h new file mode 100644 index 0000000..5af39b5 --- /dev/null +++ b/BranchTrace-x64plugin-wtl/ThreadTraceDialog.h @@ -0,0 +1,114 @@ +#pragma once +#include "stdafx.h" +#include "ThreadTraceCore.h" + + +class ThreadTraceDialog : public CDialogImpl, public CWinDataExchange +{ + +protected: + + // ¿Ø¼þ + CComboBoxImpl m_comboThread; + CComboBoxImpl m_comboModule; + CButtonImpl m_buttonStarttrace; + CButtonImpl m_buttonReset; + CButtonImpl m_buttonPrevInto; + CButtonImpl m_buttonNextInto; + CButtonImpl m_buttonProcStart; + CButtonImpl m_buttonProcEnd; + CButtonImpl m_buttonPrevSnippet; + CButtonImpl m_buttonNextSnippet; + CButtonImpl m_buttonPrev; + CButtonImpl m_buttonNext; + CButtonImpl m_buttonToEnd; + + + PBTS_RECORD64 RecordStart = NULL; + PBTS_RECORD64 RecordEnd = NULL; + PBTS_RECORD64 RecordCursor = NULL; + BOOL ToFromFlag = TRUE; + TraceCursor cursor; + + +#define AT_TO TRUE +#define AT_FROM FALSE + BOOL m_bTracingFlag; // AT_TO | AT_FROM + + +public: + ThreadTraceDialog() : RecordStart(NULL), RecordEnd(NULL), m_bTracingFlag(FALSE) {}; + ~ThreadTraceDialog(); + + + // msg handler + BOOL OnInitDialog(CWindow wndFocus, LPARAM lInitParam); + void OnCloseDialog(); + + // command hander + LRESULT OnDropdownComboboxThread(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/); + LRESULT OnDropdownComboboxModule(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/); + LRESULT OnBnClickedButtonStarttrace(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/); + LRESULT OnBnClickedButtonReset(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/); + LRESULT OnBnClickedButtonPrevInto(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/); + LRESULT OnBnClickedButtonNextInto(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/); + LRESULT OnBnClickedButtonProcStart(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/); + LRESULT OnBnClickedButtonProcEnd(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/); + LRESULT OnBnClickedButtonPrevSnippet(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/); + LRESULT OnBnClickedButtonNextSnippet(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/); + LRESULT OnBnClickedButtonPrev(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/); + LRESULT OnBnClickedButtonNext(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/); + LRESULT OnBnClickedButtonToEnd(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/); + + void OnBreakDebugPoint(); + void ResetAll(); + void HighlightTrace(); + + +public: + enum { IDD = IDD_DIALOG_THREAD_TRACE }; + + BEGIN_MSG_MAP(ThreadTraceDialog) + // commands + MSG_WM_INITDIALOG(OnInitDialog) + MSG_WM_CLOSE(OnCloseDialog) + + // combo-box + COMMAND_HANDLER(IDC_COMBO_THREAD, CBN_DROPDOWN, OnDropdownComboboxThread) + COMMAND_HANDLER(IDC_COMBO_MODULE, CBN_DROPDOWN, OnDropdownComboboxModule) + + // buttons + COMMAND_ID_HANDLER(IDC_BUTTON_STARTTRACE, OnBnClickedButtonStarttrace) + COMMAND_ID_HANDLER(IDC_BUTTON_RESET, OnBnClickedButtonReset) + COMMAND_ID_HANDLER(IDC_BUTTON_PREVINTO, OnBnClickedButtonPrevInto) + COMMAND_ID_HANDLER(IDC_BUTTON_NEXTINTO, OnBnClickedButtonNextInto) + COMMAND_ID_HANDLER(IDC_BUTTON_PROCSTART, OnBnClickedButtonProcStart) + COMMAND_ID_HANDLER(IDC_BUTTON_PROCEND, OnBnClickedButtonProcEnd) + COMMAND_ID_HANDLER(IDC_BUTTON_PREVSNIPPET, OnBnClickedButtonPrevSnippet) + COMMAND_ID_HANDLER(IDC_BUTTON_NEXTSNIPPET, OnBnClickedButtonNextSnippet) + COMMAND_ID_HANDLER(IDC_BUTTON_PREV, OnBnClickedButtonPrev) + COMMAND_ID_HANDLER(IDC_BUTTON_NEXT, OnBnClickedButtonNext) + COMMAND_ID_HANDLER(IDC_BUTTON_TOEND, OnBnClickedButtonToEnd) + + END_MSG_MAP() + + + BEGIN_DDX_MAP(ThreadTraceDialog) + // controls + DDX_CONTROL(IDC_COMBO_THREAD, m_comboThread) + DDX_CONTROL(IDC_COMBO_MODULE, m_comboModule) + DDX_CONTROL(IDC_BUTTON_STARTTRACE, m_buttonStarttrace) + DDX_CONTROL(IDC_BUTTON_RESET, m_buttonReset) + DDX_CONTROL(IDC_BUTTON_PREVINTO, m_buttonPrevInto) + DDX_CONTROL(IDC_BUTTON_NEXTINTO, m_buttonNextInto) + DDX_CONTROL(IDC_BUTTON_PROCSTART, m_buttonProcStart) + DDX_CONTROL(IDC_BUTTON_PROCEND, m_buttonProcEnd) + DDX_CONTROL(IDC_BUTTON_PREVSNIPPET, m_buttonPrevSnippet) + DDX_CONTROL(IDC_BUTTON_NEXTSNIPPET, m_buttonNextSnippet) + + DDX_CONTROL(IDC_BUTTON_PREV, m_buttonPrev) + DDX_CONTROL(IDC_BUTTON_NEXT, m_buttonNext) + DDX_CONTROL(IDC_BUTTON_TOEND, m_buttonToEnd) + END_DDX_MAP() + +}; \ No newline at end of file diff --git a/BranchTrace-x64plugin-wtl/disassembler.cpp b/BranchTrace-x64plugin-wtl/disassembler.cpp new file mode 100644 index 0000000..a606164 --- /dev/null +++ b/BranchTrace-x64plugin-wtl/disassembler.cpp @@ -0,0 +1,321 @@ +#include "disassembler.h" +#include +#include + + +Disassembler::Disassembler() +{ +#ifdef _WIN64 + ZydisDecoderInit(&zydisDecoder, ZYDIS_MACHINE_MODE_LONG_64, ZYDIS_ADDRESS_WIDTH_64); +#else + ZydisDecoderInit(&zydisDecoder, ZYDIS_MACHINE_MODE_LONG_COMPAT_32, ZYDIS_ADDRESS_WIDTH_32); +#endif // _WIN64 +} + + +bool Disassembler::Disasm(unsigned char* code, size_t codesize, Instruction* instruction) +{ + return ZYAN_SUCCESS(ZydisDecoderDecodeBuffer(&zydisDecoder, code, codesize, &(instruction->zydisInstrction))); +} + +const char* Disassembler::FormatZydisRegister(ZydisRegister reg) +{ + switch (reg) + { + case ZYDIS_REGISTER_NONE: return ""; + case ZYDIS_REGISTER_AL: return "al"; + case ZYDIS_REGISTER_CL: return "cl"; + case ZYDIS_REGISTER_DL: return "dl"; + case ZYDIS_REGISTER_BL: return "bl"; + case ZYDIS_REGISTER_AH: return "ah"; + case ZYDIS_REGISTER_CH: return "ch"; + case ZYDIS_REGISTER_DH: return "dh"; + case ZYDIS_REGISTER_BH: return "bh"; + case ZYDIS_REGISTER_SPL: return "spl"; + case ZYDIS_REGISTER_BPL: return "bpl"; + case ZYDIS_REGISTER_SIL: return "sil"; + case ZYDIS_REGISTER_DIL: return "dil"; + case ZYDIS_REGISTER_R8B: return "r8b"; + case ZYDIS_REGISTER_R9B: return "r9b"; + case ZYDIS_REGISTER_R10B: return "r10b"; + case ZYDIS_REGISTER_R11B: return "r11b"; + case ZYDIS_REGISTER_R12B: return "r12b"; + case ZYDIS_REGISTER_R13B: return "r13b"; + case ZYDIS_REGISTER_R14B: return "r14b"; + case ZYDIS_REGISTER_R15B: return "r15b"; + case ZYDIS_REGISTER_AX: return "ax"; + case ZYDIS_REGISTER_CX: return "cx"; + case ZYDIS_REGISTER_DX: return "dx"; + case ZYDIS_REGISTER_BX: return "bx"; + case ZYDIS_REGISTER_SP: return "sp"; + case ZYDIS_REGISTER_BP: return "bp"; + case ZYDIS_REGISTER_SI: return "si"; + case ZYDIS_REGISTER_DI: return "di"; + case ZYDIS_REGISTER_R8W: return "r8w"; + case ZYDIS_REGISTER_R9W: return "r9w"; + case ZYDIS_REGISTER_R10W: return "r10w"; + case ZYDIS_REGISTER_R11W: return "r11w"; + case ZYDIS_REGISTER_R12W: return "r12w"; + case ZYDIS_REGISTER_R13W: return "r13w"; + case ZYDIS_REGISTER_R14W: return "r14w"; + case ZYDIS_REGISTER_R15W: return "r15w"; + case ZYDIS_REGISTER_EAX: return "eax"; + case ZYDIS_REGISTER_ECX: return "ecx"; + case ZYDIS_REGISTER_EDX: return "edx"; + case ZYDIS_REGISTER_EBX: return "ebx"; + case ZYDIS_REGISTER_ESP: return "esp"; + case ZYDIS_REGISTER_EBP: return "ebp"; + case ZYDIS_REGISTER_ESI: return "esi"; + case ZYDIS_REGISTER_EDI: return "edi"; + case ZYDIS_REGISTER_R8D: return "r8d"; + case ZYDIS_REGISTER_R9D: return "r9d"; + case ZYDIS_REGISTER_R10D: return "r10d"; + case ZYDIS_REGISTER_R11D: return "r11d"; + case ZYDIS_REGISTER_R12D: return "r12d"; + case ZYDIS_REGISTER_R13D: return "r13d"; + case ZYDIS_REGISTER_R14D: return "r14d"; + case ZYDIS_REGISTER_R15D: return "r15d"; + case ZYDIS_REGISTER_RAX: return "rax"; + case ZYDIS_REGISTER_RCX: return "rcx"; + case ZYDIS_REGISTER_RDX: return "rdx"; + case ZYDIS_REGISTER_RBX: return "rbx"; + case ZYDIS_REGISTER_RSP: return "rsp"; + case ZYDIS_REGISTER_RBP: return "rbp"; + case ZYDIS_REGISTER_RSI: return "rsi"; + case ZYDIS_REGISTER_RDI: return "rdi"; + case ZYDIS_REGISTER_R8: return "r8"; + case ZYDIS_REGISTER_R9: return "r9"; + case ZYDIS_REGISTER_R10: return "r10"; + case ZYDIS_REGISTER_R11: return "r11"; + case ZYDIS_REGISTER_R12: return "r12"; + case ZYDIS_REGISTER_R13: return "r13"; + case ZYDIS_REGISTER_R14: return "r14"; + case ZYDIS_REGISTER_R15: return "r15"; + case ZYDIS_REGISTER_ST0: return "st0"; + case ZYDIS_REGISTER_ST1: return "st1"; + case ZYDIS_REGISTER_ST2: return "st2"; + case ZYDIS_REGISTER_ST3: return "st3"; + case ZYDIS_REGISTER_ST4: return "st4"; + case ZYDIS_REGISTER_ST5: return "st5"; + case ZYDIS_REGISTER_ST6: return "st6"; + case ZYDIS_REGISTER_ST7: return "st7"; + case ZYDIS_REGISTER_X87CONTROL: return "x87control"; + case ZYDIS_REGISTER_X87STATUS: return "x87status"; + case ZYDIS_REGISTER_X87TAG: return "x87tag"; + case ZYDIS_REGISTER_MM0: return "mm0"; + case ZYDIS_REGISTER_MM1: return "mm1"; + case ZYDIS_REGISTER_MM2: return "mm2"; + case ZYDIS_REGISTER_MM3: return "mm3"; + case ZYDIS_REGISTER_MM4: return "mm4"; + case ZYDIS_REGISTER_MM5: return "mm5"; + case ZYDIS_REGISTER_MM6: return "mm6"; + case ZYDIS_REGISTER_MM7: return "mm7"; + case ZYDIS_REGISTER_XMM0: return "xmm0"; + case ZYDIS_REGISTER_XMM1: return "xmm1"; + case ZYDIS_REGISTER_XMM2: return "xmm2"; + case ZYDIS_REGISTER_XMM3: return "xmm3"; + case ZYDIS_REGISTER_XMM4: return "xmm4"; + case ZYDIS_REGISTER_XMM5: return "xmm5"; + case ZYDIS_REGISTER_XMM6: return "xmm6"; + case ZYDIS_REGISTER_XMM7: return "xmm7"; + case ZYDIS_REGISTER_XMM8: return "xmm8"; + case ZYDIS_REGISTER_XMM9: return "xmm9"; + case ZYDIS_REGISTER_XMM10: return "xmm10"; + case ZYDIS_REGISTER_XMM11: return "xmm11"; + case ZYDIS_REGISTER_XMM12: return "xmm12"; + case ZYDIS_REGISTER_XMM13: return "xmm13"; + case ZYDIS_REGISTER_XMM14: return "xmm14"; + case ZYDIS_REGISTER_XMM15: return "xmm15"; + case ZYDIS_REGISTER_XMM16: return "xmm16"; + case ZYDIS_REGISTER_XMM17: return "xmm17"; + case ZYDIS_REGISTER_XMM18: return "xmm18"; + case ZYDIS_REGISTER_XMM19: return "xmm19"; + case ZYDIS_REGISTER_XMM20: return "xmm20"; + case ZYDIS_REGISTER_XMM21: return "xmm21"; + case ZYDIS_REGISTER_XMM22: return "xmm22"; + case ZYDIS_REGISTER_XMM23: return "xmm23"; + case ZYDIS_REGISTER_XMM24: return "xmm24"; + case ZYDIS_REGISTER_XMM25: return "xmm25"; + case ZYDIS_REGISTER_XMM26: return "xmm26"; + case ZYDIS_REGISTER_XMM27: return "xmm27"; + case ZYDIS_REGISTER_XMM28: return "xmm28"; + case ZYDIS_REGISTER_XMM29: return "xmm29"; + case ZYDIS_REGISTER_XMM30: return "xmm30"; + case ZYDIS_REGISTER_XMM31: return "xmm31"; + case ZYDIS_REGISTER_YMM0: return "ymm0"; + case ZYDIS_REGISTER_YMM1: return "ymm1"; + case ZYDIS_REGISTER_YMM2: return "ymm2"; + case ZYDIS_REGISTER_YMM3: return "ymm3"; + case ZYDIS_REGISTER_YMM4: return "ymm4"; + case ZYDIS_REGISTER_YMM5: return "ymm5"; + case ZYDIS_REGISTER_YMM6: return "ymm6"; + case ZYDIS_REGISTER_YMM7: return "ymm7"; + case ZYDIS_REGISTER_YMM8: return "ymm8"; + case ZYDIS_REGISTER_YMM9: return "ymm9"; + case ZYDIS_REGISTER_YMM10: return "ymm10"; + case ZYDIS_REGISTER_YMM11: return "ymm11"; + case ZYDIS_REGISTER_YMM12: return "ymm12"; + case ZYDIS_REGISTER_YMM13: return "ymm13"; + case ZYDIS_REGISTER_YMM14: return "ymm14"; + case ZYDIS_REGISTER_YMM15: return "ymm15"; + case ZYDIS_REGISTER_YMM16: return "ymm16"; + case ZYDIS_REGISTER_YMM17: return "ymm17"; + case ZYDIS_REGISTER_YMM18: return "ymm18"; + case ZYDIS_REGISTER_YMM19: return "ymm19"; + case ZYDIS_REGISTER_YMM20: return "ymm20"; + case ZYDIS_REGISTER_YMM21: return "ymm21"; + case ZYDIS_REGISTER_YMM22: return "ymm22"; + case ZYDIS_REGISTER_YMM23: return "ymm23"; + case ZYDIS_REGISTER_YMM24: return "ymm24"; + case ZYDIS_REGISTER_YMM25: return "ymm25"; + case ZYDIS_REGISTER_YMM26: return "ymm26"; + case ZYDIS_REGISTER_YMM27: return "ymm27"; + case ZYDIS_REGISTER_YMM28: return "ymm28"; + case ZYDIS_REGISTER_YMM29: return "ymm29"; + case ZYDIS_REGISTER_YMM30: return "ymm30"; + case ZYDIS_REGISTER_YMM31: return "ymm31"; + case ZYDIS_REGISTER_ZMM0: return "zmm0"; + case ZYDIS_REGISTER_ZMM1: return "zmm1"; + case ZYDIS_REGISTER_ZMM2: return "zmm2"; + case ZYDIS_REGISTER_ZMM3: return "zmm3"; + case ZYDIS_REGISTER_ZMM4: return "zmm4"; + case ZYDIS_REGISTER_ZMM5: return "zmm5"; + case ZYDIS_REGISTER_ZMM6: return "zmm6"; + case ZYDIS_REGISTER_ZMM7: return "zmm7"; + case ZYDIS_REGISTER_ZMM8: return "zmm8"; + case ZYDIS_REGISTER_ZMM9: return "zmm9"; + case ZYDIS_REGISTER_ZMM10: return "zmm10"; + case ZYDIS_REGISTER_ZMM11: return "zmm11"; + case ZYDIS_REGISTER_ZMM12: return "zmm12"; + case ZYDIS_REGISTER_ZMM13: return "zmm13"; + case ZYDIS_REGISTER_ZMM14: return "zmm14"; + case ZYDIS_REGISTER_ZMM15: return "zmm15"; + case ZYDIS_REGISTER_ZMM16: return "zmm16"; + case ZYDIS_REGISTER_ZMM17: return "zmm17"; + case ZYDIS_REGISTER_ZMM18: return "zmm18"; + case ZYDIS_REGISTER_ZMM19: return "zmm19"; + case ZYDIS_REGISTER_ZMM20: return "zmm20"; + case ZYDIS_REGISTER_ZMM21: return "zmm21"; + case ZYDIS_REGISTER_ZMM22: return "zmm22"; + case ZYDIS_REGISTER_ZMM23: return "zmm23"; + case ZYDIS_REGISTER_ZMM24: return "zmm24"; + case ZYDIS_REGISTER_ZMM25: return "zmm25"; + case ZYDIS_REGISTER_ZMM26: return "zmm26"; + case ZYDIS_REGISTER_ZMM27: return "zmm27"; + case ZYDIS_REGISTER_ZMM28: return "zmm28"; + case ZYDIS_REGISTER_ZMM29: return "zmm29"; + case ZYDIS_REGISTER_ZMM30: return "zmm30"; + case ZYDIS_REGISTER_ZMM31: return "zmm31"; + case ZYDIS_REGISTER_FLAGS: return "flags"; + case ZYDIS_REGISTER_EFLAGS: return "eflags"; + case ZYDIS_REGISTER_RFLAGS: return "rflags"; + case ZYDIS_REGISTER_IP: return "ip"; + case ZYDIS_REGISTER_EIP: return "eip"; + case ZYDIS_REGISTER_RIP: return "rip"; + case ZYDIS_REGISTER_ES: return "es"; + case ZYDIS_REGISTER_CS: return "cs"; + case ZYDIS_REGISTER_SS: return "ss"; + case ZYDIS_REGISTER_DS: return "ds"; + case ZYDIS_REGISTER_FS: return "fs"; + case ZYDIS_REGISTER_GS: return "gs"; + case ZYDIS_REGISTER_GDTR: return "gdtr"; + case ZYDIS_REGISTER_LDTR: return "ldtr"; + case ZYDIS_REGISTER_IDTR: return "idtr"; + case ZYDIS_REGISTER_TR: return "tr"; + case ZYDIS_REGISTER_TR0: return "tr0"; + case ZYDIS_REGISTER_TR1: return "tr1"; + case ZYDIS_REGISTER_TR2: return "tr2"; + case ZYDIS_REGISTER_TR3: return "tr3"; + case ZYDIS_REGISTER_TR4: return "tr4"; + case ZYDIS_REGISTER_TR5: return "tr5"; + case ZYDIS_REGISTER_TR6: return "tr6"; + case ZYDIS_REGISTER_TR7: return "tr7"; + case ZYDIS_REGISTER_CR0: return "cr0"; + case ZYDIS_REGISTER_CR1: return "cr1"; + case ZYDIS_REGISTER_CR2: return "cr2"; + case ZYDIS_REGISTER_CR3: return "cr3"; + case ZYDIS_REGISTER_CR4: return "cr4"; + case ZYDIS_REGISTER_CR5: return "cr5"; + case ZYDIS_REGISTER_CR6: return "cr6"; + case ZYDIS_REGISTER_CR7: return "cr7"; + case ZYDIS_REGISTER_CR8: return "cr8"; + case ZYDIS_REGISTER_CR9: return "cr9"; + case ZYDIS_REGISTER_CR10: return "cr10"; + case ZYDIS_REGISTER_CR11: return "cr11"; + case ZYDIS_REGISTER_CR12: return "cr12"; + case ZYDIS_REGISTER_CR13: return "cr13"; + case ZYDIS_REGISTER_CR14: return "cr14"; + case ZYDIS_REGISTER_CR15: return "cr15"; + case ZYDIS_REGISTER_DR0: return "dr0"; + case ZYDIS_REGISTER_DR1: return "dr1"; + case ZYDIS_REGISTER_DR2: return "dr2"; + case ZYDIS_REGISTER_DR3: return "dr3"; + case ZYDIS_REGISTER_DR4: return "dr4"; + case ZYDIS_REGISTER_DR5: return "dr5"; + case ZYDIS_REGISTER_DR6: return "dr6"; + case ZYDIS_REGISTER_DR7: return "dr7"; + case ZYDIS_REGISTER_DR8: return "dr8"; + case ZYDIS_REGISTER_DR9: return "dr9"; + case ZYDIS_REGISTER_DR10: return "dr10"; + case ZYDIS_REGISTER_DR11: return "dr11"; + case ZYDIS_REGISTER_DR12: return "dr12"; + case ZYDIS_REGISTER_DR13: return "dr13"; + case ZYDIS_REGISTER_DR14: return "dr14"; + case ZYDIS_REGISTER_DR15: return "dr15"; + case ZYDIS_REGISTER_K0: return "k0"; + case ZYDIS_REGISTER_K1: return "k1"; + case ZYDIS_REGISTER_K2: return "k2"; + case ZYDIS_REGISTER_K3: return "k3"; + case ZYDIS_REGISTER_K4: return "k4"; + case ZYDIS_REGISTER_K5: return "k5"; + case ZYDIS_REGISTER_K6: return "k6"; + case ZYDIS_REGISTER_K7: return "k7"; + case ZYDIS_REGISTER_BND0: return "bnd0"; + case ZYDIS_REGISTER_BND1: return "bnd1"; + case ZYDIS_REGISTER_BND2: return "bnd2"; + case ZYDIS_REGISTER_BND3: return "bnd3"; + case ZYDIS_REGISTER_BNDCFG: return "bndcfg"; + case ZYDIS_REGISTER_BNDSTATUS: return "bndstatus"; + case ZYDIS_REGISTER_MXCSR: return "mxcsr"; + case ZYDIS_REGISTER_PKRU: return "pkru"; + case ZYDIS_REGISTER_XCR0: return "xcr0"; + } + return ""; +} + + +void Disassembler::loadPage(void* buffer, size_t pageAddr) +{ + if (m_pageInstrAddrMap.count(pageAddr) != 0) { + return; + } + + + std::vector addrList; + std::map indexMap; + + Instruction instr; + int index = 0; + size_t position = 0; + while (position < 0x1000) + { + if (Disasm((unsigned char*)buffer + position, 0x1000 - position, &instr) == false) { + break; + } + instr.zydisInstrction.length; + + addrList.push_back(pageAddr + position); + indexMap.insert(std::make_pair(pageAddr + position, index)); + + index++; + position += instr.zydisInstrction.length; + } + + m_pageInstrAddrMap.insert(std::make_pair(pageAddr, addrList)); + m_pageInstrAddrIndexMap.insert(std::make_pair(pageAddr, indexMap)); +} + +void Disassembler::Reset() +{ + +} diff --git a/BranchTrace-x64plugin-wtl/disassembler.h b/BranchTrace-x64plugin-wtl/disassembler.h new file mode 100644 index 0000000..044a2ad --- /dev/null +++ b/BranchTrace-x64plugin-wtl/disassembler.h @@ -0,0 +1,30 @@ +#pragma once +#pragma warning(disable 26812) +#include +#include +#include +#include + +struct Instruction { + ZydisDecodedInstruction zydisInstrction; +}; + +class Disassembler { + +private: + ZydisDecoder zydisDecoder; + std::map> m_pageInstrAddrMap; + std::map> m_pageInstrAddrIndexMap; + + + +public: + Disassembler(); + + bool Disasm(unsigned char* code, size_t codesize, Instruction* instrction); + const char* FormatZydisRegister(ZydisRegister reg); + + void loadPage(void* buffer, size_t pageAddr); + + void Reset(); +}; diff --git a/BranchTrace-x64plugin-wtl/dllmain.cpp b/BranchTrace-x64plugin-wtl/dllmain.cpp new file mode 100644 index 0000000..544bfae --- /dev/null +++ b/BranchTrace-x64plugin-wtl/dllmain.cpp @@ -0,0 +1,31 @@ +#include "dllmain.h" +#include "plugin_global.h" + +HMODULE g_hModule; +HANDLE g_hThread; + +BOOL APIENTRY DllMain(HMODULE hModule, + DWORD ul_reason_for_call, + LPVOID lpReserved +) +{ + switch (ul_reason_for_call) + { + case DLL_PROCESS_ATTACH: + { + g_hModule = hModule; + + // µ÷ÓÃÒ»´ÎÈÃÕâ¸öÄ£¿éÔö¼ÓÒ»´ÎÒýÓüÆÊý. ·ñÕßжÔØdllʱ»á³ö´í, ÈÃÆä + HMODULE moudle; + GetModuleHandleEx(GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS, (LPSTR)DllMain, &moudle); + + break; + } + case DLL_THREAD_ATTACH: + case DLL_THREAD_DETACH: + case DLL_PROCESS_DETACH: + break; + } + + return TRUE; +} diff --git a/BranchTrace-x64plugin-wtl/dllmain.h b/BranchTrace-x64plugin-wtl/dllmain.h new file mode 100644 index 0000000..26b4ac1 --- /dev/null +++ b/BranchTrace-x64plugin-wtl/dllmain.h @@ -0,0 +1,5 @@ +#pragma once + +#include + +extern HMODULE g_hModule; \ No newline at end of file diff --git a/BranchTrace-x64plugin-wtl/plugin.h b/BranchTrace-x64plugin-wtl/plugin.h new file mode 100644 index 0000000..3b924bc --- /dev/null +++ b/BranchTrace-x64plugin-wtl/plugin.h @@ -0,0 +1,49 @@ +#pragma once +#include "dllmain.h" + +#include "pluginsdk/_plugins.h" +#include "pluginsdk/bridgemain.h" + + +#ifndef DLL_EXPORT +#define DLL_EXPORT __declspec(dllexport) +#endif //DLL_EXPORT + + +#define PLUGIN_NAME "Branch Trace" +#define PLUGIN_VERSION 1 + +enum AS_MENU +{ + AS_MENU_THREAD_TRACE, + AS_MENU_TEST +}; + +#ifdef __cplusplus +extern "C" { +#endif +/* ²å¼þ³õʼ»¯³É¹¦ºó¸Ãº¯Êý»á±»µ÷Óà */ +DLL_EXPORT void plugsetup(PLUG_SETUPSTRUCT* setupStruct); + +/* ²å¼þ±»Ð¶Ôغó¸Ãº¯Êý»á±»µ÷Óà */ +DLL_EXPORT bool plugstop(); + +/*²å¼þ³õʼ»¯Ê±±»µ÷ÓÃ*/ +DLL_EXPORT bool pluginit(PLUG_INITSTRUCT* setupStruct); + +/* ²Ëµ¥±»µã»÷ºó¸Ãº¯Êý»á±»µ÷Óà */ +DLL_EXPORT void CBMENUENTRY(CBTYPE cbType, PLUG_CB_MENUENTRY* info); + +/* µ÷ÊÔÆ÷ÖжÏʱÓÉx64dbg´¥·¢*/ +void OnBreakPoint(CBTYPE cbType, void* callbackInfo); +void OnInitDebug(CBTYPE cbType, void* callbackInfo); +void OnStopDebug(CBTYPE cbType, void* callbackInfo); + +#ifdef __cplusplus +} +#endif + + +extern HMODULE g_hModul; +extern HWND hwndX64Dbg; + diff --git a/BranchTrace-x64plugin-wtl/plugin_global.h b/BranchTrace-x64plugin-wtl/plugin_global.h new file mode 100644 index 0000000..3f53600 --- /dev/null +++ b/BranchTrace-x64plugin-wtl/plugin_global.h @@ -0,0 +1,45 @@ +#pragma once +#include "stdafx.h" +#include "ThreadTraceDialog.h" +#include "plugin.h" +#include "disassembler.h" + +class PluginGlobal { + +public: + ThreadTraceDialog* threadTraceDialog; + Disassembler* disassembler; + +private: + PluginGlobal() { + disassembler = new Disassembler(); + }; + +public: + ~PluginGlobal() { + CloseAll(); + } + +public: + static PluginGlobal* GetInstance() { + static PluginGlobal pluginGlobal; + return &pluginGlobal; + } + + void ShowDlgThreadTrace() { + if (threadTraceDialog == NULL) { + threadTraceDialog = new ThreadTraceDialog; + threadTraceDialog->Create(hwndX64Dbg); + } + + threadTraceDialog->ShowWindow(SW_SHOW); + threadTraceDialog->SetActiveWindow(); + }; + + void CloseAll() { + if (threadTraceDialog) { + CloseWindow(threadTraceDialog->m_hWnd); + DestroyWindow(threadTraceDialog->m_hWnd); + } + } +}; diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/DeviceNameResolver/DeviceNameResolver.h b/BranchTrace-x64plugin-wtl/pluginsdk/DeviceNameResolver/DeviceNameResolver.h new file mode 100644 index 0000000..8aac7c6 --- /dev/null +++ b/BranchTrace-x64plugin-wtl/pluginsdk/DeviceNameResolver/DeviceNameResolver.h @@ -0,0 +1,22 @@ +#ifndef _DEVICENAMERESOLVER_H +#define _DEVICENAMERESOLVER_H + +#include + +#ifdef __cplusplus +extern "C" +{ +#endif + +__declspec(dllexport) bool DevicePathToPathW(const wchar_t* szDevicePath, wchar_t* szPath, size_t nSizeInChars); +__declspec(dllexport) bool DevicePathToPathA(const char* szDevicePath, char* szPath, size_t nSizeInChars); +__declspec(dllexport) bool DevicePathFromFileHandleW(HANDLE hFile, wchar_t* szDevicePath, size_t nSizeInChars); +__declspec(dllexport) bool DevicePathFromFileHandleA(HANDLE hFile, char* szDevicePath, size_t nSizeInChars); +__declspec(dllexport) bool PathFromFileHandleW(HANDLE hFile, wchar_t* szPath, size_t nSizeInChars); +__declspec(dllexport) bool PathFromFileHandleA(HANDLE hFile, char* szPath, size_t nSizeInChars); + +#ifdef __cplusplus +} +#endif + +#endif // _DEVICENAMERESOLVER_H diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/DeviceNameResolver/DeviceNameResolver_x64.a b/BranchTrace-x64plugin-wtl/pluginsdk/DeviceNameResolver/DeviceNameResolver_x64.a new file mode 100644 index 0000000000000000000000000000000000000000..0d807fe58addbd227dd44c5eee40c4887b6a53c7 GIT binary patch literal 6134 zcmeHL-D=c86h6DzT3zZ7(rPb6Q_wqElXf>&D5Wb>s-P4RiXdduChM-V%Q$P7}^9X>B+pqXBqXW$7w*A7} zYj1gPoUZrQ8}vJS-mdM~?H-{e3yQ}Svx90TRj<*4}-R|z#s-C2; zo{FvmpAlX2u1}@7bJ9QT5qC}cBaeF4>HTRv$+6;hu7lg{Zu^yfnA)_QnucLnmabdI zLYPzc@Cv3C;Bf)7##$3l@x6UaaHi?7-l({a?_{C?R$%?4vN;%xfWZOb+H}K*Re?oP zK?&z2+X@&0R}+51O{L?W3fwFXWi7>Y#Pf|#;cO<?E7Q4-6)~MpbO4 zbxA7R2v|jx4n|IuMOBm(gGNxzN!BJZL zftD#6RpZp+rZld^&V&~4sBsAve^KK?EuO~bJF6CJiti`Vuk*@adLNNRI$YrnRux2+o-}Tj_U@~33HE+d<3jDdhb!Q$+FOv=8~+=$ajsc>pX2~7(%@z8 yU}X{BV;!+|_{sTy!HoVqI|}2H)f8+_+H_6+7pzXt?fKT`zhQM!qvNd4*6Kgtyj0%+ literal 0 HcmV?d00001 diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/DeviceNameResolver/DeviceNameResolver_x64.lib b/BranchTrace-x64plugin-wtl/pluginsdk/DeviceNameResolver/DeviceNameResolver_x64.lib new file mode 100644 index 0000000000000000000000000000000000000000..d70e41502cb1e4ee5003799c4a4f340fc1f8cadd GIT binary patch literal 3174 zcmcguOG{fp6#h(NG&hAxEu|nrT7)VEP0YgW3>D^jYFH{2tHMd+^ zhAFaD>FkwS{N1JFYK?uN$4<8-SK6({O0BN1R+?H}_wI1>`4l(J)Z)jn^q3Yc_p!)s zyYqDK4maPcSMKrS42^+|g@Fixpcw*A==Q_oz!{<9oQS7U;E?8Bnm1`qK*2ahF@_K# z2x9~R$2w@cDYrLP#GIU6+a4K9OIF^upT}Mr-}24S=*E@PRvCZGJ}2LcGU<`~Tr_i&TI8Llm%Hngy?l=rjsu&tBlqQV)EOU?WZG* zAhXSD`uk5GXST%>d76Bc3o&Lf@n*iJRXUZKMagDaXPBHABlb^2h>oFg>gd5nt=euKv_5oVv&Feseyy-B_>SQo zt=J~+R9TJL1bs)1nZH7^tlDbqlM7Qv-*Ita-%Z=VHU}Uhkp&Dd_9Vsd+0-dyQY=H8 za4D0vC`^COAJO=9ASYHl1ZW>_oJ|8Ebx2e#X5^z*Rb@EPOfie4CW{X0fzy zw%m8lj{Dy2b=n7Rx8~GZyLb$>TGMsvS_RZroPKku+u2!awcR()ZoTcU;R&ssy_&u$ zs;|cDu}NGPoweGb-0xk}Fj(dHtZ4|UVy-?x5Z9y`FWh+*puYd5-OqRYiH@6LoO9c@ zO|!gE_Gft6xPg-lFl*o(a%s%S_ubEZF2`pkSR47e(|6(}+)@GSB){3~4UxeS=~~p` zY)NV}SjgaYsfqg&y0WY%-FUq2xztT#VM3#m?P3m8Ui0;K8zA365IxbaQ-DuK!`YS< zUcDMK8X`R~4$0JbrQ$S7tkQ8BB~EnjX@l}`@?yy`8pEap4abKlNE;8rop?vGchaO_ z2J^&cJ4ZY=&%mQyUWo8$WBl&&_?gS*vFL>XCb2*~PJ44p^P}TY>eaoX^Z8cWWtnuc zJh-30iY!o0PimIqbBjx(5ZYwpML8y(ZD{nH`@7qsh8clNpqQg8D5m&QOoOC4g1F`g z*DRKV(w?3y0F!f(rQjtN5??vmH<9)|BhdODI0yFsVV-0z~^^vM1JRRk;`c#w`>SE_==N0%zsw}7|h2-`tL_& z+$8^P>UF+(NdN8Xb-w>jB7YT6L(hXqdjCyB@MR*umaek*$`x+ly_O6B?o+Ug`I$Zt zN8z@3%`F94AQ$hu=gDm}9<$;i56| z1?)Tc2)*zjyy%4w;1l$w{{QaI9@v3G3X{yv%zv2wFyBA3PhK|$&Gs8H8n(B1Di)6? zW7%xRPLJu!ROXdFtBU||AHXvL@Ld7;Hvobjt&4sD>cMNRi|4q;9za>@!87WzT-+}o zRH|~}{o%Vxv0Oc<$OYxJ(^N{0o>Eax`rT7y0J2;DtEb|!Jek8Rs==XLyU1hiNxz$xTIu3y;T3nWCOY;j|<@;re!ETnL z;}CEfH?(-Hx$%%S@en{jj1U1=K7b88eNPZkfhf7g@f^ny3Y_5_K?8p9!U}jG06q}F zWm~(gr{)OAOq`vChh(yhoQ{)FiWfGANQZtmd^!%)?yzwVrjK?34(yD$_*gMCxG`!v zPF8KEN{Ws_646PuWwx)*l0BaWy_B+i%|D^wM7~ZNp4@MVp`uR7x!M9-T2-Z6%-cJUK#ZkTD(rba%yfMp^FphnSV6g6hD>1LD^$shp? znY2kE`Zj&^M!N$P^c4**)PpMdM2`&{?zg3UPZ{VV;rLxSA1yxB# zB~<-l3w*ac)#YEbprL@D!6|i_){~_oo$AusEOnV; zbiy?Lg4o)!GCfOnx6qSiAT`U<9Hzf7s%c4}J5amG{MHxH{*>fl!X+_ptxWSkz 1000 +#pragma once +#endif + +#include +#include + +#pragma pack(push, 1) + +// Global.Constant.Structure.Declaration: +// Engine.External: +#define UE_STRUCT_PE32STRUCT 1 +#define UE_STRUCT_PE64STRUCT 2 +#define UE_STRUCT_PESTRUCT 3 +#define UE_STRUCT_IMPORTENUMDATA 4 +#define UE_STRUCT_THREAD_ITEM_DATA 5 +#define UE_STRUCT_LIBRARY_ITEM_DATA 6 +#define UE_STRUCT_LIBRARY_ITEM_DATAW 7 +#define UE_STRUCT_PROCESS_ITEM_DATA 8 +#define UE_STRUCT_HANDLERARRAY 9 +#define UE_STRUCT_PLUGININFORMATION 10 +#define UE_STRUCT_HOOK_ENTRY 11 +#define UE_STRUCT_FILE_STATUS_INFO 12 +#define UE_STRUCT_FILE_FIX_INFO 13 +#define UE_STRUCT_X87FPUREGISTER 14 +#define UE_STRUCT_X87FPU 15 +#define UE_STRUCT_TITAN_ENGINE_CONTEXT 16 + +#define UE_ACCESS_READ 0 +#define UE_ACCESS_WRITE 1 +#define UE_ACCESS_ALL 2 + +#define UE_HIDE_PEBONLY 0 +#define UE_HIDE_BASIC 1 + +#define UE_PLUGIN_CALL_REASON_PREDEBUG 1 +#define UE_PLUGIN_CALL_REASON_EXCEPTION 2 +#define UE_PLUGIN_CALL_REASON_POSTDEBUG 3 +#define UE_PLUGIN_CALL_REASON_UNHANDLEDEXCEPTION 4 + +#define TEE_HOOK_NRM_JUMP 1 +#define TEE_HOOK_NRM_CALL 3 +#define TEE_HOOK_IAT 5 + +#define UE_ENGINE_ALOW_MODULE_LOADING 1 +#define UE_ENGINE_AUTOFIX_FORWARDERS 2 +#define UE_ENGINE_PASS_ALL_EXCEPTIONS 3 +#define UE_ENGINE_NO_CONSOLE_WINDOW 4 +#define UE_ENGINE_BACKUP_FOR_CRITICAL_FUNCTIONS 5 +#define UE_ENGINE_CALL_PLUGIN_CALLBACK 6 +#define UE_ENGINE_RESET_CUSTOM_HANDLER 7 +#define UE_ENGINE_CALL_PLUGIN_DEBUG_CALLBACK 8 +#define UE_ENGINE_SET_DEBUG_PRIVILEGE 9 +#define UE_ENGINE_SAFE_ATTACH 10 + +#define UE_OPTION_REMOVEALL 1 +#define UE_OPTION_DISABLEALL 2 +#define UE_OPTION_REMOVEALLDISABLED 3 +#define UE_OPTION_REMOVEALLENABLED 4 + +#define UE_STATIC_DECRYPTOR_XOR 1 +#define UE_STATIC_DECRYPTOR_SUB 2 +#define UE_STATIC_DECRYPTOR_ADD 3 + +#define UE_STATIC_DECRYPTOR_FOREWARD 1 +#define UE_STATIC_DECRYPTOR_BACKWARD 2 + +#define UE_STATIC_KEY_SIZE_1 1 +#define UE_STATIC_KEY_SIZE_2 2 +#define UE_STATIC_KEY_SIZE_4 4 +#define UE_STATIC_KEY_SIZE_8 8 + +#define UE_STATIC_APLIB 1 +#define UE_STATIC_APLIB_DEPACK 2 +#define UE_STATIC_LZMA 3 + +#define UE_STATIC_HASH_MD5 1 +#define UE_STATIC_HASH_SHA1 2 +#define UE_STATIC_HASH_CRC32 3 + +#define UE_RESOURCE_LANGUAGE_ANY -1 + +#define UE_PE_OFFSET 0 +#define UE_IMAGEBASE 1 +#define UE_OEP 2 +#define UE_SIZEOFIMAGE 3 +#define UE_SIZEOFHEADERS 4 +#define UE_SIZEOFOPTIONALHEADER 5 +#define UE_SECTIONALIGNMENT 6 +#define UE_IMPORTTABLEADDRESS 7 +#define UE_IMPORTTABLESIZE 8 +#define UE_RESOURCETABLEADDRESS 9 +#define UE_RESOURCETABLESIZE 10 +#define UE_EXPORTTABLEADDRESS 11 +#define UE_EXPORTTABLESIZE 12 +#define UE_TLSTABLEADDRESS 13 +#define UE_TLSTABLESIZE 14 +#define UE_RELOCATIONTABLEADDRESS 15 +#define UE_RELOCATIONTABLESIZE 16 +#define UE_TIMEDATESTAMP 17 +#define UE_SECTIONNUMBER 18 +#define UE_CHECKSUM 19 +#define UE_SUBSYSTEM 20 +#define UE_CHARACTERISTICS 21 +#define UE_NUMBEROFRVAANDSIZES 22 +#define UE_BASEOFCODE 23 +#define UE_BASEOFDATA 24 +#define UE_DLLCHARACTERISTICS 25 +//leaving some enum space here for future additions +#define UE_SECTIONNAME 40 +#define UE_SECTIONVIRTUALOFFSET 41 +#define UE_SECTIONVIRTUALSIZE 42 +#define UE_SECTIONRAWOFFSET 43 +#define UE_SECTIONRAWSIZE 44 +#define UE_SECTIONFLAGS 45 + +#define UE_VANOTFOUND = -2; + +#define UE_CH_BREAKPOINT 1 +#define UE_CH_SINGLESTEP 2 +#define UE_CH_ACCESSVIOLATION 3 +#define UE_CH_ILLEGALINSTRUCTION 4 +#define UE_CH_NONCONTINUABLEEXCEPTION 5 +#define UE_CH_ARRAYBOUNDSEXCEPTION 6 +#define UE_CH_FLOATDENORMALOPERAND 7 +#define UE_CH_FLOATDEVIDEBYZERO 8 +#define UE_CH_INTEGERDEVIDEBYZERO 9 +#define UE_CH_INTEGEROVERFLOW 10 +#define UE_CH_PRIVILEGEDINSTRUCTION 11 +#define UE_CH_PAGEGUARD 12 +#define UE_CH_EVERYTHINGELSE 13 +#define UE_CH_CREATETHREAD 14 +#define UE_CH_EXITTHREAD 15 +#define UE_CH_CREATEPROCESS 16 +#define UE_CH_EXITPROCESS 17 +#define UE_CH_LOADDLL 18 +#define UE_CH_UNLOADDLL 19 +#define UE_CH_OUTPUTDEBUGSTRING 20 +#define UE_CH_AFTEREXCEPTIONPROCESSING 21 +#define UE_CH_SYSTEMBREAKPOINT 23 +#define UE_CH_UNHANDLEDEXCEPTION 24 +#define UE_CH_RIPEVENT 25 +#define UE_CH_DEBUGEVENT 26 + +#define UE_OPTION_HANDLER_RETURN_HANDLECOUNT 1 +#define UE_OPTION_HANDLER_RETURN_ACCESS 2 +#define UE_OPTION_HANDLER_RETURN_FLAGS 3 +#define UE_OPTION_HANDLER_RETURN_TYPENAME 4 + +#define UE_BREAKPOINT_INT3 1 +#define UE_BREAKPOINT_LONG_INT3 2 +#define UE_BREAKPOINT_UD2 3 + +#define UE_BPXREMOVED 0 +#define UE_BPXACTIVE 1 +#define UE_BPXINACTIVE 2 + +#define UE_BREAKPOINT 0 +#define UE_SINGLESHOOT 1 +#define UE_HARDWARE 2 +#define UE_MEMORY 3 +#define UE_MEMORY_READ 4 +#define UE_MEMORY_WRITE 5 +#define UE_MEMORY_EXECUTE 6 +#define UE_BREAKPOINT_TYPE_INT3 0x10000000 +#define UE_BREAKPOINT_TYPE_LONG_INT3 0x20000000 +#define UE_BREAKPOINT_TYPE_UD2 0x30000000 + +#define UE_HARDWARE_EXECUTE 4 +#define UE_HARDWARE_WRITE 5 +#define UE_HARDWARE_READWRITE 6 + +#define UE_HARDWARE_SIZE_1 7 +#define UE_HARDWARE_SIZE_2 8 +#define UE_HARDWARE_SIZE_4 9 +#define UE_HARDWARE_SIZE_8 10 + +#define UE_ON_LIB_LOAD 1 +#define UE_ON_LIB_UNLOAD 2 +#define UE_ON_LIB_ALL 3 + +#define UE_APISTART 0 +#define UE_APIEND 1 + +#define UE_PLATFORM_x86 1 +#define UE_PLATFORM_x64 2 +#define UE_PLATFORM_ALL 3 + +#define UE_FUNCTION_STDCALL 1 +#define UE_FUNCTION_CCALL 2 +#define UE_FUNCTION_FASTCALL 3 +#define UE_FUNCTION_STDCALL_RET 4 +#define UE_FUNCTION_CCALL_RET 5 +#define UE_FUNCTION_FASTCALL_RET 6 +#define UE_FUNCTION_STDCALL_CALL 7 +#define UE_FUNCTION_CCALL_CALL 8 +#define UE_FUNCTION_FASTCALL_CALL 9 +#define UE_PARAMETER_BYTE 0 +#define UE_PARAMETER_WORD 1 +#define UE_PARAMETER_DWORD 2 +#define UE_PARAMETER_QWORD 3 +#define UE_PARAMETER_PTR_BYTE 4 +#define UE_PARAMETER_PTR_WORD 5 +#define UE_PARAMETER_PTR_DWORD 6 +#define UE_PARAMETER_PTR_QWORD 7 +#define UE_PARAMETER_STRING 8 +#define UE_PARAMETER_UNICODE 9 + +#define UE_EAX 1 +#define UE_EBX 2 +#define UE_ECX 3 +#define UE_EDX 4 +#define UE_EDI 5 +#define UE_ESI 6 +#define UE_EBP 7 +#define UE_ESP 8 +#define UE_EIP 9 +#define UE_EFLAGS 10 +#define UE_DR0 11 +#define UE_DR1 12 +#define UE_DR2 13 +#define UE_DR3 14 +#define UE_DR6 15 +#define UE_DR7 16 +#define UE_RAX 17 +#define UE_RBX 18 +#define UE_RCX 19 +#define UE_RDX 20 +#define UE_RDI 21 +#define UE_RSI 22 +#define UE_RBP 23 +#define UE_RSP 24 +#define UE_RIP 25 +#define UE_RFLAGS 26 +#define UE_R8 27 +#define UE_R9 28 +#define UE_R10 29 +#define UE_R11 30 +#define UE_R12 31 +#define UE_R13 32 +#define UE_R14 33 +#define UE_R15 34 +#define UE_CIP 35 +#define UE_CSP 36 +#ifdef _WIN64 +#define UE_CFLAGS UE_RFLAGS +#else +#define UE_CFLAGS UE_EFLAGS +#endif +#define UE_SEG_GS 37 +#define UE_SEG_FS 38 +#define UE_SEG_ES 39 +#define UE_SEG_DS 40 +#define UE_SEG_CS 41 +#define UE_SEG_SS 42 +#define UE_x87_r0 43 +#define UE_x87_r1 44 +#define UE_x87_r2 45 +#define UE_x87_r3 46 +#define UE_x87_r4 47 +#define UE_x87_r5 48 +#define UE_x87_r6 49 +#define UE_x87_r7 50 +#define UE_X87_STATUSWORD 51 +#define UE_X87_CONTROLWORD 52 +#define UE_X87_TAGWORD 53 +#define UE_MXCSR 54 +#define UE_MMX0 55 +#define UE_MMX1 56 +#define UE_MMX2 57 +#define UE_MMX3 58 +#define UE_MMX4 59 +#define UE_MMX5 60 +#define UE_MMX6 61 +#define UE_MMX7 62 +#define UE_XMM0 63 +#define UE_XMM1 64 +#define UE_XMM2 65 +#define UE_XMM3 66 +#define UE_XMM4 67 +#define UE_XMM5 68 +#define UE_XMM6 69 +#define UE_XMM7 70 +#define UE_XMM8 71 +#define UE_XMM9 72 +#define UE_XMM10 73 +#define UE_XMM11 74 +#define UE_XMM12 75 +#define UE_XMM13 76 +#define UE_XMM14 77 +#define UE_XMM15 78 +#define UE_x87_ST0 79 +#define UE_x87_ST1 80 +#define UE_x87_ST2 81 +#define UE_x87_ST3 82 +#define UE_x87_ST4 83 +#define UE_x87_ST5 84 +#define UE_x87_ST6 85 +#define UE_x87_ST7 86 +#define UE_YMM0 87 +#define UE_YMM1 88 +#define UE_YMM2 89 +#define UE_YMM3 90 +#define UE_YMM4 91 +#define UE_YMM5 92 +#define UE_YMM6 93 +#define UE_YMM7 94 +#define UE_YMM8 95 +#define UE_YMM9 96 +#define UE_YMM10 97 +#define UE_YMM11 98 +#define UE_YMM12 99 +#define UE_YMM13 100 +#define UE_YMM14 101 +#define UE_YMM15 102 + +#ifndef CONTEXT_EXTENDED_REGISTERS +#define CONTEXT_EXTENDED_REGISTERS 0 +#endif + +typedef struct +{ + DWORD PE32Offset; + DWORD ImageBase; + DWORD OriginalEntryPoint; + DWORD BaseOfCode; + DWORD BaseOfData; + DWORD NtSizeOfImage; + DWORD NtSizeOfHeaders; + WORD SizeOfOptionalHeaders; + DWORD FileAlignment; + DWORD SectionAligment; + DWORD ImportTableAddress; + DWORD ImportTableSize; + DWORD ResourceTableAddress; + DWORD ResourceTableSize; + DWORD ExportTableAddress; + DWORD ExportTableSize; + DWORD TLSTableAddress; + DWORD TLSTableSize; + DWORD RelocationTableAddress; + DWORD RelocationTableSize; + DWORD TimeDateStamp; + WORD SectionNumber; + DWORD CheckSum; + WORD SubSystem; + WORD Characteristics; + DWORD NumberOfRvaAndSizes; +} PE32Struct, *PPE32Struct; + +typedef struct +{ + DWORD PE64Offset; + DWORD64 ImageBase; + DWORD OriginalEntryPoint; + DWORD BaseOfCode; + DWORD BaseOfData; + DWORD NtSizeOfImage; + DWORD NtSizeOfHeaders; + WORD SizeOfOptionalHeaders; + DWORD FileAlignment; + DWORD SectionAligment; + DWORD ImportTableAddress; + DWORD ImportTableSize; + DWORD ResourceTableAddress; + DWORD ResourceTableSize; + DWORD ExportTableAddress; + DWORD ExportTableSize; + DWORD TLSTableAddress; + DWORD TLSTableSize; + DWORD RelocationTableAddress; + DWORD RelocationTableSize; + DWORD TimeDateStamp; + WORD SectionNumber; + DWORD CheckSum; + WORD SubSystem; + WORD Characteristics; + DWORD NumberOfRvaAndSizes; +} PE64Struct, *PPE64Struct; + +#if defined(_WIN64) +typedef PE64Struct PEStruct; +#else +typedef PE32Struct PEStruct; +#endif + +typedef struct +{ + bool NewDll; + int NumberOfImports; + ULONG_PTR ImageBase; + ULONG_PTR BaseImportThunk; + ULONG_PTR ImportThunk; + char* APIName; + char* DLLName; +} ImportEnumData, *PImportEnumData; + +typedef struct +{ + HANDLE hThread; + DWORD dwThreadId; + void* ThreadStartAddress; + void* ThreadLocalBase; + void* TebAddress; + ULONG WaitTime; + LONG Priority; + LONG BasePriority; + ULONG ContextSwitches; + ULONG ThreadState; + ULONG WaitReason; +} THREAD_ITEM_DATA, *PTHREAD_ITEM_DATA; + +typedef struct +{ + HANDLE hFile; + void* BaseOfDll; + HANDLE hFileMapping; + void* hFileMappingView; + char szLibraryPath[MAX_PATH]; + char szLibraryName[MAX_PATH]; +} LIBRARY_ITEM_DATA, *PLIBRARY_ITEM_DATA; + +typedef struct +{ + HANDLE hFile; + void* BaseOfDll; + HANDLE hFileMapping; + void* hFileMappingView; + wchar_t szLibraryPath[MAX_PATH]; + wchar_t szLibraryName[MAX_PATH]; +} LIBRARY_ITEM_DATAW, *PLIBRARY_ITEM_DATAW; + +typedef struct +{ + HANDLE hProcess; + DWORD dwProcessId; + HANDLE hThread; + DWORD dwThreadId; + HANDLE hFile; + void* BaseOfImage; + void* ThreadStartAddress; + void* ThreadLocalBase; +} PROCESS_ITEM_DATA, *PPROCESS_ITEM_DATA; + +typedef struct +{ + ULONG ProcessId; + HANDLE hHandle; +} HandlerArray, *PHandlerArray; + +typedef struct +{ + char PluginName[64]; + DWORD PluginMajorVersion; + DWORD PluginMinorVersion; + HMODULE PluginBaseAddress; + void* TitanDebuggingCallBack; + void* TitanRegisterPlugin; + void* TitanReleasePlugin; + void* TitanResetPlugin; + bool PluginDisabled; +} PluginInformation, *PPluginInformation; + +#define TEE_MAXIMUM_HOOK_SIZE 14 +#define TEE_MAXIMUM_HOOK_RELOCS 7 +#if defined(_WIN64) +#define TEE_MAXIMUM_HOOK_INSERT_SIZE 14 +#else +#define TEE_MAXIMUM_HOOK_INSERT_SIZE 5 +#endif + +typedef struct HOOK_ENTRY +{ + bool IATHook; + BYTE HookType; + DWORD HookSize; + void* HookAddress; + void* RedirectionAddress; + BYTE HookBytes[TEE_MAXIMUM_HOOK_SIZE]; + BYTE OriginalBytes[TEE_MAXIMUM_HOOK_SIZE]; + void* IATHookModuleBase; + DWORD IATHookNameHash; + bool HookIsEnabled; + bool HookIsRemote; + void* PatchedEntry; + DWORD RelocationInfo[TEE_MAXIMUM_HOOK_RELOCS]; + int RelocationCount; +} HOOK_ENTRY, *PHOOK_ENTRY; + +#define UE_DEPTH_SURFACE 0 +#define UE_DEPTH_DEEP 1 + +#define UE_UNPACKER_CONDITION_SEARCH_FROM_EP 1 + +#define UE_UNPACKER_CONDITION_LOADLIBRARY 1 +#define UE_UNPACKER_CONDITION_GETPROCADDRESS 2 +#define UE_UNPACKER_CONDITION_ENTRYPOINTBREAK 3 +#define UE_UNPACKER_CONDITION_RELOCSNAPSHOT1 4 +#define UE_UNPACKER_CONDITION_RELOCSNAPSHOT2 5 + +#define UE_FIELD_OK 0 +#define UE_FIELD_BROKEN_NON_FIXABLE 1 +#define UE_FIELD_BROKEN_NON_CRITICAL 2 +#define UE_FIELD_BROKEN_FIXABLE_FOR_STATIC_USE 3 +#define UE_FIELD_BROKEN_BUT_CAN_BE_EMULATED 4 +#define UE_FIELD_FIXABLE_NON_CRITICAL 5 +#define UE_FIELD_FIXABLE_CRITICAL 6 +#define UE_FIELD_NOT_PRESET 7 +#define UE_FIELD_NOT_PRESET_WARNING 8 + +#define UE_RESULT_FILE_OK 10 +#define UE_RESULT_FILE_INVALID_BUT_FIXABLE 11 +#define UE_RESULT_FILE_INVALID_AND_NON_FIXABLE 12 +#define UE_RESULT_FILE_INVALID_FORMAT 13 + +typedef struct +{ + BYTE OveralEvaluation; + bool EvaluationTerminatedByException; + bool FileIs64Bit; + bool FileIsDLL; + bool FileIsConsole; + bool MissingDependencies; + bool MissingDeclaredAPIs; + BYTE SignatureMZ; + BYTE SignaturePE; + BYTE EntryPoint; + BYTE ImageBase; + BYTE SizeOfImage; + BYTE FileAlignment; + BYTE SectionAlignment; + BYTE ExportTable; + BYTE RelocationTable; + BYTE ImportTable; + BYTE ImportTableSection; + BYTE ImportTableData; + BYTE IATTable; + BYTE TLSTable; + BYTE LoadConfigTable; + BYTE BoundImportTable; + BYTE COMHeaderTable; + BYTE ResourceTable; + BYTE ResourceData; + BYTE SectionTable; +} FILE_STATUS_INFO, *PFILE_STATUS_INFO; + +typedef struct +{ + BYTE OveralEvaluation; + bool FixingTerminatedByException; + bool FileFixPerformed; + bool StrippedRelocation; + bool DontFixRelocations; + DWORD OriginalRelocationTableAddress; + DWORD OriginalRelocationTableSize; + bool StrippedExports; + bool DontFixExports; + DWORD OriginalExportTableAddress; + DWORD OriginalExportTableSize; + bool StrippedResources; + bool DontFixResources; + DWORD OriginalResourceTableAddress; + DWORD OriginalResourceTableSize; + bool StrippedTLS; + bool DontFixTLS; + DWORD OriginalTLSTableAddress; + DWORD OriginalTLSTableSize; + bool StrippedLoadConfig; + bool DontFixLoadConfig; + DWORD OriginalLoadConfigTableAddress; + DWORD OriginalLoadConfigTableSize; + bool StrippedBoundImports; + bool DontFixBoundImports; + DWORD OriginalBoundImportTableAddress; + DWORD OriginalBoundImportTableSize; + bool StrippedIAT; + bool DontFixIAT; + DWORD OriginalImportAddressTableAddress; + DWORD OriginalImportAddressTableSize; + bool StrippedCOM; + bool DontFixCOM; + DWORD OriginalCOMTableAddress; + DWORD OriginalCOMTableSize; +} FILE_FIX_INFO, *PFILE_FIX_INFO; + +typedef struct DECLSPEC_ALIGN(16) _XmmRegister_t +{ + ULONGLONG Low; + LONGLONG High; +} XmmRegister_t; + +typedef struct +{ + XmmRegister_t Low; //XMM/SSE part + XmmRegister_t High; //AVX part +} YmmRegister_t; + +typedef struct +{ + BYTE data[10]; + int st_value; + int tag; +} x87FPURegister_t; + +typedef struct +{ + WORD ControlWord; + WORD StatusWord; + WORD TagWord; + DWORD ErrorOffset; + DWORD ErrorSelector; + DWORD DataOffset; + DWORD DataSelector; + DWORD Cr0NpxState; +} x87FPU_t; + +typedef struct +{ + ULONG_PTR cax; + ULONG_PTR ccx; + ULONG_PTR cdx; + ULONG_PTR cbx; + ULONG_PTR csp; + ULONG_PTR cbp; + ULONG_PTR csi; + ULONG_PTR cdi; +#ifdef _WIN64 + ULONG_PTR r8; + ULONG_PTR r9; + ULONG_PTR r10; + ULONG_PTR r11; + ULONG_PTR r12; + ULONG_PTR r13; + ULONG_PTR r14; + ULONG_PTR r15; +#endif //_WIN64 + ULONG_PTR cip; + ULONG_PTR eflags; + unsigned short gs; + unsigned short fs; + unsigned short es; + unsigned short ds; + unsigned short cs; + unsigned short ss; + ULONG_PTR dr0; + ULONG_PTR dr1; + ULONG_PTR dr2; + ULONG_PTR dr3; + ULONG_PTR dr6; + ULONG_PTR dr7; + BYTE RegisterArea[80]; + x87FPU_t x87fpu; + DWORD MxCsr; +#ifdef _WIN64 + XmmRegister_t XmmRegisters[16]; + YmmRegister_t YmmRegisters[16]; +#else // x86 + XmmRegister_t XmmRegisters[8]; + YmmRegister_t YmmRegisters[8]; +#endif +} TITAN_ENGINE_CONTEXT_t; + +#ifdef __cplusplus +extern "C" +{ +#endif + +// Global.Function.Declaration: +// TitanEngine.Dumper.functions: +__declspec(dllexport) bool TITCALL DumpProcess(HANDLE hProcess, LPVOID ImageBase, const char* szDumpFileName, ULONG_PTR EntryPoint); +__declspec(dllexport) bool TITCALL DumpProcessW(HANDLE hProcess, LPVOID ImageBase, const wchar_t* szDumpFileName, ULONG_PTR EntryPoint); +__declspec(dllexport) bool TITCALL DumpProcessEx(DWORD ProcessId, LPVOID ImageBase, const char* szDumpFileName, ULONG_PTR EntryPoint); +__declspec(dllexport) bool TITCALL DumpProcessExW(DWORD ProcessId, LPVOID ImageBase, const wchar_t* szDumpFileName, ULONG_PTR EntryPoint); +__declspec(dllexport) bool TITCALL DumpMemory(HANDLE hProcess, LPVOID MemoryStart, ULONG_PTR MemorySize, const char* szDumpFileName); +__declspec(dllexport) bool TITCALL DumpMemoryW(HANDLE hProcess, LPVOID MemoryStart, ULONG_PTR MemorySize, const wchar_t* szDumpFileName); +__declspec(dllexport) bool TITCALL DumpMemoryEx(DWORD ProcessId, LPVOID MemoryStart, ULONG_PTR MemorySize, const char* szDumpFileName); +__declspec(dllexport) bool TITCALL DumpMemoryExW(DWORD ProcessId, LPVOID MemoryStart, ULONG_PTR MemorySize, const wchar_t* szDumpFileName); +__declspec(dllexport) bool TITCALL DumpRegions(HANDLE hProcess, const char* szDumpFolder, bool DumpAboveImageBaseOnly); +__declspec(dllexport) bool TITCALL DumpRegionsW(HANDLE hProcess, const wchar_t* szDumpFolder, bool DumpAboveImageBaseOnly); +__declspec(dllexport) bool TITCALL DumpRegionsEx(DWORD ProcessId, const char* szDumpFolder, bool DumpAboveImageBaseOnly); +__declspec(dllexport) bool TITCALL DumpRegionsExW(DWORD ProcessId, const wchar_t* szDumpFolder, bool DumpAboveImageBaseOnly); +__declspec(dllexport) bool TITCALL DumpModule(HANDLE hProcess, LPVOID ModuleBase, const char* szDumpFileName); +__declspec(dllexport) bool TITCALL DumpModuleW(HANDLE hProcess, LPVOID ModuleBase, const wchar_t* szDumpFileName); +__declspec(dllexport) bool TITCALL DumpModuleEx(DWORD ProcessId, LPVOID ModuleBase, const char* szDumpFileName); +__declspec(dllexport) bool TITCALL DumpModuleExW(DWORD ProcessId, LPVOID ModuleBase, const wchar_t* szDumpFileName); +__declspec(dllexport) bool TITCALL PastePEHeader(HANDLE hProcess, LPVOID ImageBase, const char* szDebuggedFileName); +__declspec(dllexport) bool TITCALL PastePEHeaderW(HANDLE hProcess, LPVOID ImageBase, const wchar_t* szDebuggedFileName); +__declspec(dllexport) bool TITCALL ExtractSection(const char* szFileName, const char* szDumpFileName, DWORD SectionNumber); +__declspec(dllexport) bool TITCALL ExtractSectionW(const wchar_t* szFileName, const wchar_t* szDumpFileName, DWORD SectionNumber); +__declspec(dllexport) bool TITCALL ResortFileSections(const char* szFileName); +__declspec(dllexport) bool TITCALL ResortFileSectionsW(const wchar_t* szFileName); +__declspec(dllexport) bool TITCALL FindOverlay(const char* szFileName, LPDWORD OverlayStart, LPDWORD OverlaySize); +__declspec(dllexport) bool TITCALL FindOverlayW(const wchar_t* szFileName, LPDWORD OverlayStart, LPDWORD OverlaySize); +__declspec(dllexport) bool TITCALL ExtractOverlay(const char* szFileName, const char* szExtactedFileName); +__declspec(dllexport) bool TITCALL ExtractOverlayW(const wchar_t* szFileName, const wchar_t* szExtactedFileName); +__declspec(dllexport) bool TITCALL AddOverlay(const char* szFileName, const char* szOverlayFileName); +__declspec(dllexport) bool TITCALL AddOverlayW(const wchar_t* szFileName, const wchar_t* szOverlayFileName); +__declspec(dllexport) bool TITCALL CopyOverlay(const char* szInFileName, const char* szOutFileName); +__declspec(dllexport) bool TITCALL CopyOverlayW(const wchar_t* szInFileName, const wchar_t* szOutFileName); +__declspec(dllexport) bool TITCALL RemoveOverlay(const char* szFileName); +__declspec(dllexport) bool TITCALL RemoveOverlayW(const wchar_t* szFileName); +__declspec(dllexport) bool TITCALL MakeAllSectionsRWE(const char* szFileName); +__declspec(dllexport) bool TITCALL MakeAllSectionsRWEW(const wchar_t* szFileName); +__declspec(dllexport) long TITCALL AddNewSectionEx(const char* szFileName, const char* szSectionName, DWORD SectionSize, DWORD SectionAttributes, LPVOID SectionContent, DWORD ContentSize); +__declspec(dllexport) long TITCALL AddNewSectionExW(const wchar_t* szFileName, const char* szSectionName, DWORD SectionSize, DWORD SectionAttributes, LPVOID SectionContent, DWORD ContentSize); +__declspec(dllexport) long TITCALL AddNewSection(const char* szFileName, const char* szSectionName, DWORD SectionSize); +__declspec(dllexport) long TITCALL AddNewSectionW(const wchar_t* szFileName, const char* szSectionName, DWORD SectionSize); +__declspec(dllexport) bool TITCALL ResizeLastSection(const char* szFileName, DWORD NumberOfExpandBytes, bool AlignResizeData); +__declspec(dllexport) bool TITCALL ResizeLastSectionW(const wchar_t* szFileName, DWORD NumberOfExpandBytes, bool AlignResizeData); +__declspec(dllexport) void TITCALL SetSharedOverlay(const char* szFileName); +__declspec(dllexport) void TITCALL SetSharedOverlayW(const wchar_t* szFileName); +__declspec(dllexport) char* TITCALL GetSharedOverlay(); +__declspec(dllexport) wchar_t* TITCALL GetSharedOverlayW(); +__declspec(dllexport) bool TITCALL DeleteLastSection(const char* szFileName); +__declspec(dllexport) bool TITCALL DeleteLastSectionW(const wchar_t* szFileName); +__declspec(dllexport) bool TITCALL DeleteLastSectionEx(const char* szFileName, DWORD NumberOfSections); +__declspec(dllexport) bool TITCALL DeleteLastSectionExW(const wchar_t* szFileName, DWORD NumberOfSections); +__declspec(dllexport) ULONG_PTR TITCALL GetPE32DataFromMappedFile(ULONG_PTR FileMapVA, DWORD WhichSection, DWORD WhichData); +__declspec(dllexport) ULONG_PTR TITCALL GetPE32Data(const char* szFileName, DWORD WhichSection, DWORD WhichData); +__declspec(dllexport) ULONG_PTR TITCALL GetPE32DataW(const wchar_t* szFileName, DWORD WhichSection, DWORD WhichData); +__declspec(dllexport) bool TITCALL GetPE32DataFromMappedFileEx(ULONG_PTR FileMapVA, LPVOID DataStorage); +__declspec(dllexport) bool TITCALL GetPE32DataEx(const char* szFileName, LPVOID DataStorage); +__declspec(dllexport) bool TITCALL GetPE32DataExW(const wchar_t* szFileName, LPVOID DataStorage); +__declspec(dllexport) bool TITCALL SetPE32DataForMappedFile(ULONG_PTR FileMapVA, DWORD WhichSection, DWORD WhichData, ULONG_PTR NewDataValue); +__declspec(dllexport) bool TITCALL SetPE32Data(const char* szFileName, DWORD WhichSection, DWORD WhichData, ULONG_PTR NewDataValue); +__declspec(dllexport) bool TITCALL SetPE32DataW(const wchar_t* szFileName, DWORD WhichSection, DWORD WhichData, ULONG_PTR NewDataValue); +__declspec(dllexport) bool TITCALL SetPE32DataForMappedFileEx(ULONG_PTR FileMapVA, LPVOID DataStorage); +__declspec(dllexport) bool TITCALL SetPE32DataEx(const char* szFileName, LPVOID DataStorage); +__declspec(dllexport) bool TITCALL SetPE32DataExW(const wchar_t* szFileName, LPVOID DataStorage); +__declspec(dllexport) long TITCALL GetPE32SectionNumberFromVA(ULONG_PTR FileMapVA, ULONG_PTR AddressToConvert); +__declspec(dllexport) ULONG_PTR TITCALL ConvertVAtoFileOffset(ULONG_PTR FileMapVA, ULONG_PTR AddressToConvert, bool ReturnType); +__declspec(dllexport) ULONG_PTR TITCALL ConvertVAtoFileOffsetEx(ULONG_PTR FileMapVA, DWORD FileSize, ULONG_PTR ImageBase, ULONG_PTR AddressToConvert, bool AddressIsRVA, bool ReturnType); +__declspec(dllexport) ULONG_PTR TITCALL ConvertFileOffsetToVA(ULONG_PTR FileMapVA, ULONG_PTR AddressToConvert, bool ReturnType); +__declspec(dllexport) ULONG_PTR TITCALL ConvertFileOffsetToVAEx(ULONG_PTR FileMapVA, DWORD FileSize, ULONG_PTR ImageBase, ULONG_PTR AddressToConvert, bool ReturnType); +__declspec(dllexport) bool TITCALL MemoryReadSafe(HANDLE hProcess, LPVOID lpBaseAddress, LPVOID lpBuffer, SIZE_T nSize, SIZE_T* lpNumberOfBytesRead); +__declspec(dllexport) bool TITCALL MemoryWriteSafe(HANDLE hProcess, LPVOID lpBaseAddress, LPCVOID lpBuffer, SIZE_T nSize, SIZE_T* lpNumberOfBytesWritten); +// TitanEngine.Realigner.functions: +__declspec(dllexport) bool TITCALL FixHeaderCheckSum(const char* szFileName); +__declspec(dllexport) bool TITCALL FixHeaderCheckSumW(const wchar_t* szFileName); +__declspec(dllexport) long TITCALL RealignPE(ULONG_PTR FileMapVA, DWORD FileSize, DWORD RealingMode); +__declspec(dllexport) long TITCALL RealignPEEx(const char* szFileName, DWORD RealingFileSize, DWORD ForcedFileAlignment); +__declspec(dllexport) long TITCALL RealignPEExW(const wchar_t* szFileName, DWORD RealingFileSize, DWORD ForcedFileAlignment); +__declspec(dllexport) bool TITCALL WipeSection(const char* szFileName, int WipeSectionNumber, bool RemovePhysically); +__declspec(dllexport) bool TITCALL WipeSectionW(const wchar_t* szFileName, int WipeSectionNumber, bool RemovePhysically); +__declspec(dllexport) bool TITCALL IsPE32FileValidEx(const char* szFileName, DWORD CheckDepth, LPVOID FileStatusInfo); +__declspec(dllexport) bool TITCALL IsPE32FileValidExW(const wchar_t* szFileName, DWORD CheckDepth, LPVOID FileStatusInfo); +__declspec(dllexport) bool TITCALL FixBrokenPE32FileEx(const char* szFileName, LPVOID FileStatusInfo, LPVOID FileFixInfo); +__declspec(dllexport) bool TITCALL FixBrokenPE32FileExW(const wchar_t* szFileName, LPVOID FileStatusInfo, LPVOID FileFixInfo); +__declspec(dllexport) bool TITCALL IsFileDLL(const char* szFileName, ULONG_PTR FileMapVA); +__declspec(dllexport) bool TITCALL IsFileDLLW(const wchar_t* szFileName, ULONG_PTR FileMapVA); +// TitanEngine.Hider.functions: +__declspec(dllexport) void* TITCALL GetPEBLocation(HANDLE hProcess); +__declspec(dllexport) void* TITCALL GetPEBLocation64(HANDLE hProcess); +__declspec(dllexport) void* TITCALL GetTEBLocation(HANDLE hThread); +__declspec(dllexport) void* TITCALL GetTEBLocation64(HANDLE hThread); +__declspec(dllexport) bool TITCALL HideDebugger(HANDLE hProcess, DWORD PatchAPILevel); +__declspec(dllexport) bool TITCALL UnHideDebugger(HANDLE hProcess, DWORD PatchAPILevel); +// TitanEngine.Relocater.functions: +__declspec(dllexport) void TITCALL RelocaterCleanup(); +__declspec(dllexport) void TITCALL RelocaterInit(DWORD MemorySize, ULONG_PTR OldImageBase, ULONG_PTR NewImageBase); +__declspec(dllexport) void TITCALL RelocaterAddNewRelocation(HANDLE hProcess, ULONG_PTR RelocateAddress, DWORD RelocateState); +__declspec(dllexport) long TITCALL RelocaterEstimatedSize(); +__declspec(dllexport) bool TITCALL RelocaterExportRelocation(ULONG_PTR StorePlace, DWORD StorePlaceRVA, ULONG_PTR FileMapVA); +__declspec(dllexport) bool TITCALL RelocaterExportRelocationEx(const char* szFileName, const char* szSectionName); +__declspec(dllexport) bool TITCALL RelocaterExportRelocationExW(const wchar_t* szFileName, const char* szSectionName); +__declspec(dllexport) bool TITCALL RelocaterGrabRelocationTable(HANDLE hProcess, ULONG_PTR MemoryStart, DWORD MemorySize); +__declspec(dllexport) bool TITCALL RelocaterGrabRelocationTableEx(HANDLE hProcess, ULONG_PTR MemoryStart, ULONG_PTR MemorySize, DWORD NtSizeOfImage); +__declspec(dllexport) bool TITCALL RelocaterMakeSnapshot(HANDLE hProcess, const char* szSaveFileName, LPVOID MemoryStart, ULONG_PTR MemorySize); +__declspec(dllexport) bool TITCALL RelocaterMakeSnapshotW(HANDLE hProcess, const wchar_t* szSaveFileName, LPVOID MemoryStart, ULONG_PTR MemorySize); +__declspec(dllexport) bool TITCALL RelocaterCompareTwoSnapshots(HANDLE hProcess, ULONG_PTR LoadedImageBase, ULONG_PTR NtSizeOfImage, const char* szDumpFile1, const char* szDumpFile2, ULONG_PTR MemStart); +__declspec(dllexport) bool TITCALL RelocaterCompareTwoSnapshotsW(HANDLE hProcess, ULONG_PTR LoadedImageBase, ULONG_PTR NtSizeOfImage, const wchar_t* szDumpFile1, const wchar_t* szDumpFile2, ULONG_PTR MemStart); +__declspec(dllexport) bool TITCALL RelocaterChangeFileBase(const char* szFileName, ULONG_PTR NewImageBase); +__declspec(dllexport) bool TITCALL RelocaterChangeFileBaseW(const wchar_t* szFileName, ULONG_PTR NewImageBase); +__declspec(dllexport) bool TITCALL RelocaterRelocateMemoryBlock(ULONG_PTR FileMapVA, ULONG_PTR MemoryLocation, void* RelocateMemory, DWORD RelocateMemorySize, ULONG_PTR CurrentLoadedBase, ULONG_PTR RelocateBase); +__declspec(dllexport) bool TITCALL RelocaterWipeRelocationTable(const char* szFileName); +__declspec(dllexport) bool TITCALL RelocaterWipeRelocationTableW(const wchar_t* szFileName); +// TitanEngine.Resourcer.functions: +__declspec(dllexport) ULONG_PTR TITCALL ResourcerLoadFileForResourceUse(const char* szFileName); +__declspec(dllexport) ULONG_PTR TITCALL ResourcerLoadFileForResourceUseW(const wchar_t* szFileName); +__declspec(dllexport) bool TITCALL ResourcerFreeLoadedFile(LPVOID LoadedFileBase); +__declspec(dllexport) bool TITCALL ResourcerExtractResourceFromFileEx(HMODULE hFile, const char* szResourceType, const char* szResourceName, const char* szExtractedFileName); +__declspec(dllexport) bool TITCALL ResourcerExtractResourceFromFile(const char* szFileName, const char* szResourceType, const char* szResourceName, const char* szExtractedFileName); +__declspec(dllexport) bool TITCALL ResourcerExtractResourceFromFileW(const wchar_t* szFileName, char* szResourceType, const char* szResourceName, const char* szExtractedFileName); +__declspec(dllexport) bool TITCALL ResourcerFindResource(const char* szFileName, const char* szResourceType, DWORD ResourceType, const char* szResourceName, DWORD ResourceName, DWORD ResourceLanguage, PULONG_PTR pResourceData, LPDWORD pResourceSize); +__declspec(dllexport) bool TITCALL ResourcerFindResourceW(const wchar_t* szFileName, const wchar_t* szResourceType, DWORD ResourceType, const wchar_t* szResourceName, DWORD ResourceName, DWORD ResourceLanguage, PULONG_PTR pResourceData, LPDWORD pResourceSize); +__declspec(dllexport) bool TITCALL ResourcerFindResourceEx(ULONG_PTR FileMapVA, DWORD FileSize, const wchar_t* szResourceType, DWORD ResourceType, const wchar_t* szResourceName, DWORD ResourceName, DWORD ResourceLanguage, PULONG_PTR pResourceData, LPDWORD pResourceSize); +__declspec(dllexport) void TITCALL ResourcerEnumerateResource(const char* szFileName, void* CallBack); +__declspec(dllexport) void TITCALL ResourcerEnumerateResourceW(const wchar_t* szFileName, void* CallBack); +__declspec(dllexport) void TITCALL ResourcerEnumerateResourceEx(ULONG_PTR FileMapVA, DWORD FileSize, void* CallBack); +// TitanEngine.Threader.functions: +__declspec(dllexport) bool TITCALL ThreaderImportRunningThreadData(DWORD ProcessId); +__declspec(dllexport) void* TITCALL ThreaderGetThreadInfo(HANDLE hThread, DWORD ThreadId); +__declspec(dllexport) void TITCALL ThreaderEnumThreadInfo(void* EnumCallBack); +__declspec(dllexport) bool TITCALL ThreaderPauseThread(HANDLE hThread); +__declspec(dllexport) bool TITCALL ThreaderResumeThread(HANDLE hThread); +__declspec(dllexport) bool TITCALL ThreaderTerminateThread(HANDLE hThread, DWORD ThreadExitCode); +__declspec(dllexport) bool TITCALL ThreaderPauseAllThreads(bool LeaveMainRunning); +__declspec(dllexport) bool TITCALL ThreaderResumeAllThreads(bool LeaveMainPaused); +__declspec(dllexport) bool TITCALL ThreaderPauseProcess(); +__declspec(dllexport) bool TITCALL ThreaderResumeProcess(); +__declspec(dllexport) ULONG_PTR TITCALL ThreaderCreateRemoteThread(ULONG_PTR ThreadStartAddress, bool AutoCloseTheHandle, LPVOID ThreadPassParameter, LPDWORD ThreadId); +__declspec(dllexport) bool TITCALL ThreaderInjectAndExecuteCode(LPVOID InjectCode, DWORD StartDelta, DWORD InjectSize); +__declspec(dllexport) ULONG_PTR TITCALL ThreaderCreateRemoteThreadEx(HANDLE hProcess, ULONG_PTR ThreadStartAddress, bool AutoCloseTheHandle, LPVOID ThreadPassParameter, LPDWORD ThreadId); +__declspec(dllexport) bool TITCALL ThreaderInjectAndExecuteCodeEx(HANDLE hProcess, LPVOID InjectCode, DWORD StartDelta, DWORD InjectSize); +__declspec(dllexport) void TITCALL ThreaderSetCallBackForNextExitThreadEvent(LPVOID exitThreadCallBack); +__declspec(dllexport) bool TITCALL ThreaderIsThreadStillRunning(HANDLE hThread); +__declspec(dllexport) bool TITCALL ThreaderIsThreadActive(HANDLE hThread); +__declspec(dllexport) bool TITCALL ThreaderIsAnyThreadActive(); +__declspec(dllexport) bool TITCALL ThreaderExecuteOnlyInjectedThreads(); +__declspec(dllexport) ULONG_PTR TITCALL ThreaderGetOpenHandleForThread(DWORD ThreadId); +__declspec(dllexport) bool TITCALL ThreaderIsExceptionInMainThread(); +// TitanEngine.Debugger.functions: +__declspec(dllexport) void* TITCALL StaticDisassembleEx(ULONG_PTR DisassmStart, LPVOID DisassmAddress); +__declspec(dllexport) void* TITCALL StaticDisassemble(LPVOID DisassmAddress); +__declspec(dllexport) void* TITCALL DisassembleEx(HANDLE hProcess, LPVOID DisassmAddress, bool ReturnInstructionType); +__declspec(dllexport) void* TITCALL Disassemble(LPVOID DisassmAddress); +__declspec(dllexport) long TITCALL StaticLengthDisassemble(LPVOID DisassmAddress); +__declspec(dllexport) long TITCALL LengthDisassembleEx(HANDLE hProcess, LPVOID DisassmAddress); +__declspec(dllexport) long TITCALL LengthDisassemble(LPVOID DisassmAddress); +__declspec(dllexport) void* TITCALL InitDebug(char* szFileName, char* szCommandLine, char* szCurrentFolder); +__declspec(dllexport) void* TITCALL InitDebugW(const wchar_t* szFileName, const wchar_t* szCommandLine, const wchar_t* szCurrentFolder); +__declspec(dllexport) void* TITCALL InitNativeDebug(char* szFileName, char* szCommandLine, char* szCurrentFolder); +__declspec(dllexport) void* TITCALL InitNativeDebugW(const wchar_t* szFileName, const wchar_t* szCommandLine, const wchar_t* szCurrentFolder); +__declspec(dllexport) void* TITCALL InitDebugEx(const char* szFileName, const char* szCommandLine, const char* szCurrentFolder, LPVOID EntryCallBack); +__declspec(dllexport) void* TITCALL InitDebugExW(const wchar_t* szFileName, const wchar_t* szCommandLine, const wchar_t* szCurrentFolder, LPVOID EntryCallBack); +__declspec(dllexport) void* TITCALL InitDLLDebug(const char* szFileName, bool ReserveModuleBase, const char* szCommandLine, const char* szCurrentFolder, LPVOID EntryCallBack); +__declspec(dllexport) void* TITCALL InitDLLDebugW(const wchar_t* szFileName, bool ReserveModuleBase, const wchar_t* szCommandLine, const wchar_t* szCurrentFolder, LPVOID EntryCallBack); +__declspec(dllexport) bool TITCALL StopDebug(); +__declspec(dllexport) void TITCALL SetBPXOptions(long DefaultBreakPointType); +__declspec(dllexport) bool TITCALL IsBPXEnabled(ULONG_PTR bpxAddress); +__declspec(dllexport) bool TITCALL EnableBPX(ULONG_PTR bpxAddress); +__declspec(dllexport) bool TITCALL DisableBPX(ULONG_PTR bpxAddress); +__declspec(dllexport) bool TITCALL SetBPX(ULONG_PTR bpxAddress, DWORD bpxType, LPVOID bpxCallBack); +__declspec(dllexport) bool TITCALL DeleteBPX(ULONG_PTR bpxAddress); +__declspec(dllexport) bool TITCALL SafeDeleteBPX(ULONG_PTR bpxAddress); +__declspec(dllexport) bool TITCALL SetAPIBreakPoint(const char* szDLLName, const char* szAPIName, DWORD bpxType, DWORD bpxPlace, LPVOID bpxCallBack); +__declspec(dllexport) bool TITCALL DeleteAPIBreakPoint(const char* szDLLName, const char* szAPIName, DWORD bpxPlace); +__declspec(dllexport) bool TITCALL SafeDeleteAPIBreakPoint(const char* szDLLName, const char* szAPIName, DWORD bpxPlace); +__declspec(dllexport) bool TITCALL SetMemoryBPX(ULONG_PTR MemoryStart, SIZE_T SizeOfMemory, LPVOID bpxCallBack); +__declspec(dllexport) bool TITCALL SetMemoryBPXEx(ULONG_PTR MemoryStart, SIZE_T SizeOfMemory, DWORD BreakPointType, bool RestoreOnHit, LPVOID bpxCallBack); +__declspec(dllexport) bool TITCALL RemoveMemoryBPX(ULONG_PTR MemoryStart, SIZE_T SizeOfMemory); +__declspec(dllexport) bool TITCALL GetContextFPUDataEx(HANDLE hActiveThread, void* FPUSaveArea); +__declspec(dllexport) void TITCALL Getx87FPURegisters(x87FPURegister_t x87FPURegisters[8], TITAN_ENGINE_CONTEXT_t* titcontext); +__declspec(dllexport) void TITCALL GetMMXRegisters(uint64_t mmx[8], TITAN_ENGINE_CONTEXT_t* titcontext); +__declspec(dllexport) bool TITCALL GetFullContextDataEx(HANDLE hActiveThread, TITAN_ENGINE_CONTEXT_t* titcontext); +__declspec(dllexport) bool TITCALL SetFullContextDataEx(HANDLE hActiveThread, TITAN_ENGINE_CONTEXT_t* titcontext); +__declspec(dllexport) ULONG_PTR TITCALL GetContextDataEx(HANDLE hActiveThread, DWORD IndexOfRegister); +__declspec(dllexport) ULONG_PTR TITCALL GetContextData(DWORD IndexOfRegister); +__declspec(dllexport) bool TITCALL SetContextFPUDataEx(HANDLE hActiveThread, void* FPUSaveArea); +__declspec(dllexport) bool TITCALL SetContextDataEx(HANDLE hActiveThread, DWORD IndexOfRegister, ULONG_PTR NewRegisterValue); +__declspec(dllexport) bool TITCALL SetContextData(DWORD IndexOfRegister, ULONG_PTR NewRegisterValue); +__declspec(dllexport) bool TITCALL GetAVXContext(HANDLE hActiveThread, TITAN_ENGINE_CONTEXT_t* titcontext); +__declspec(dllexport) bool TITCALL SetAVXContext(HANDLE hActiveThread, TITAN_ENGINE_CONTEXT_t* titcontext); +__declspec(dllexport) void TITCALL ClearExceptionNumber(); +__declspec(dllexport) long TITCALL CurrentExceptionNumber(); +__declspec(dllexport) bool TITCALL MatchPatternEx(HANDLE hProcess, void* MemoryToCheck, int SizeOfMemoryToCheck, void* PatternToMatch, int SizeOfPatternToMatch, PBYTE WildCard); +__declspec(dllexport) bool TITCALL MatchPattern(void* MemoryToCheck, int SizeOfMemoryToCheck, void* PatternToMatch, int SizeOfPatternToMatch, PBYTE WildCard); +__declspec(dllexport) ULONG_PTR TITCALL FindEx(HANDLE hProcess, LPVOID MemoryStart, DWORD MemorySize, LPVOID SearchPattern, DWORD PatternSize, LPBYTE WildCard); +extern "C" __declspec(dllexport) ULONG_PTR TITCALL Find(LPVOID MemoryStart, DWORD MemorySize, LPVOID SearchPattern, DWORD PatternSize, LPBYTE WildCard); +__declspec(dllexport) bool TITCALL FillEx(HANDLE hProcess, LPVOID MemoryStart, DWORD MemorySize, PBYTE FillByte); +__declspec(dllexport) bool TITCALL Fill(LPVOID MemoryStart, DWORD MemorySize, PBYTE FillByte); +__declspec(dllexport) bool TITCALL PatchEx(HANDLE hProcess, LPVOID MemoryStart, DWORD MemorySize, LPVOID ReplacePattern, DWORD ReplaceSize, bool AppendNOP, bool PrependNOP); +__declspec(dllexport) bool TITCALL Patch(LPVOID MemoryStart, DWORD MemorySize, LPVOID ReplacePattern, DWORD ReplaceSize, bool AppendNOP, bool PrependNOP); +__declspec(dllexport) bool TITCALL ReplaceEx(HANDLE hProcess, LPVOID MemoryStart, DWORD MemorySize, LPVOID SearchPattern, DWORD PatternSize, DWORD NumberOfRepetitions, LPVOID ReplacePattern, DWORD ReplaceSize, PBYTE WildCard); +__declspec(dllexport) bool TITCALL Replace(LPVOID MemoryStart, DWORD MemorySize, LPVOID SearchPattern, DWORD PatternSize, DWORD NumberOfRepetitions, LPVOID ReplacePattern, DWORD ReplaceSize, PBYTE WildCard); +__declspec(dllexport) void* TITCALL GetDebugData(); +__declspec(dllexport) void* TITCALL GetTerminationData(); +__declspec(dllexport) long TITCALL GetExitCode(); +__declspec(dllexport) ULONG_PTR TITCALL GetDebuggedDLLBaseAddress(); +__declspec(dllexport) ULONG_PTR TITCALL GetDebuggedFileBaseAddress(); +__declspec(dllexport) bool TITCALL GetRemoteString(HANDLE hProcess, LPVOID StringAddress, LPVOID StringStorage, int MaximumStringSize); +__declspec(dllexport) ULONG_PTR TITCALL GetFunctionParameter(HANDLE hProcess, DWORD FunctionType, DWORD ParameterNumber, DWORD ParameterType); +__declspec(dllexport) ULONG_PTR TITCALL GetJumpDestinationEx(HANDLE hProcess, ULONG_PTR InstructionAddress, bool JustJumps); +__declspec(dllexport) ULONG_PTR TITCALL GetJumpDestination(HANDLE hProcess, ULONG_PTR InstructionAddress); +__declspec(dllexport) bool TITCALL IsJumpGoingToExecuteEx(HANDLE hProcess, HANDLE hThread, ULONG_PTR InstructionAddress, ULONG_PTR RegFlags); +__declspec(dllexport) bool TITCALL IsJumpGoingToExecute(); +__declspec(dllexport) void TITCALL SetCustomHandler(DWORD ExceptionId, LPVOID CallBack); +__declspec(dllexport) void TITCALL ForceClose(); +__declspec(dllexport) void TITCALL StepInto(LPVOID traceCallBack); +__declspec(dllexport) void TITCALL StepOver(LPVOID traceCallBack); +__declspec(dllexport) void TITCALL StepOut(LPVOID StepOut, bool StepFinal); +__declspec(dllexport) void TITCALL SingleStep(DWORD StepCount, LPVOID StepCallBack); +__declspec(dllexport) bool TITCALL GetUnusedHardwareBreakPointRegister(LPDWORD RegisterIndex); +__declspec(dllexport) bool TITCALL SetHardwareBreakPointEx(HANDLE hActiveThread, ULONG_PTR bpxAddress, DWORD IndexOfRegister, DWORD bpxType, DWORD bpxSize, LPVOID bpxCallBack, LPDWORD IndexOfSelectedRegister); +__declspec(dllexport) bool TITCALL SetHardwareBreakPoint(ULONG_PTR bpxAddress, DWORD IndexOfRegister, DWORD bpxType, DWORD bpxSize, LPVOID bpxCallBack); +__declspec(dllexport) bool TITCALL DeleteHardwareBreakPoint(DWORD IndexOfRegister); +__declspec(dllexport) bool TITCALL RemoveAllBreakPoints(DWORD RemoveOption); +__declspec(dllexport) PROCESS_INFORMATION* TITCALL TitanGetProcessInformation(); +__declspec(dllexport) STARTUPINFOW* TITCALL TitanGetStartupInformation(); +__declspec(dllexport) void TITCALL DebugLoop(); +__declspec(dllexport) void TITCALL SetDebugLoopTimeOut(DWORD TimeOut); +__declspec(dllexport) void TITCALL SetNextDbgContinueStatus(DWORD SetDbgCode); +__declspec(dllexport) bool TITCALL AttachDebugger(DWORD ProcessId, bool KillOnExit, LPVOID DebugInfo, LPVOID CallBack); +__declspec(dllexport) bool TITCALL DetachDebugger(DWORD ProcessId); +__declspec(dllexport) bool TITCALL DetachDebuggerEx(DWORD ProcessId); +__declspec(dllexport) void TITCALL DebugLoopEx(DWORD TimeOut); +__declspec(dllexport) void TITCALL AutoDebugEx(const char* szFileName, bool ReserveModuleBase, const char* szCommandLine, const char* szCurrentFolder, DWORD TimeOut, LPVOID EntryCallBack); +__declspec(dllexport) void TITCALL AutoDebugExW(const wchar_t* szFileName, bool ReserveModuleBase, const wchar_t* szCommandLine, const wchar_t* szCurrentFolder, DWORD TimeOut, LPVOID EntryCallBack); +__declspec(dllexport) bool TITCALL IsFileBeingDebugged(); +__declspec(dllexport) void TITCALL SetErrorModel(bool DisplayErrorMessages); +// TitanEngine.FindOEP.functions: +__declspec(dllexport) void TITCALL FindOEPInit(); +__declspec(dllexport) bool TITCALL FindOEPGenerically(const char* szFileName, LPVOID TraceInitCallBack, LPVOID CallBack); +__declspec(dllexport) bool TITCALL FindOEPGenericallyW(const wchar_t* szFileName, LPVOID TraceInitCallBack, LPVOID CallBack); +// TitanEngine.Importer.functions: +__declspec(dllexport) void TITCALL ImporterAddNewDll(const char* szDLLName, ULONG_PTR FirstThunk); +__declspec(dllexport) void TITCALL ImporterAddNewAPI(const char* szAPIName, ULONG_PTR ThunkValue); +__declspec(dllexport) void TITCALL ImporterAddNewOrdinalAPI(ULONG_PTR OrdinalNumber, ULONG_PTR ThunkValue); +__declspec(dllexport) long TITCALL ImporterGetAddedDllCount(); +__declspec(dllexport) long TITCALL ImporterGetAddedAPICount(); +__declspec(dllexport) bool TITCALL ImporterExportIAT(ULONG_PTR StorePlace, ULONG_PTR FileMapVA, HANDLE hFileMap); +__declspec(dllexport) long TITCALL ImporterEstimatedSize(); +__declspec(dllexport) bool TITCALL ImporterExportIATEx(const char* szDumpFileName, const char* szExportFileName, const char* szSectionName); +__declspec(dllexport) bool TITCALL ImporterExportIATExW(const wchar_t* szDumpFileName, const wchar_t* szExportFileName, const wchar_t* szSectionName = L".RL!TEv2"); +__declspec(dllexport) ULONG_PTR TITCALL ImporterFindAPIWriteLocation(const char* szAPIName); +__declspec(dllexport) ULONG_PTR TITCALL ImporterFindOrdinalAPIWriteLocation(ULONG_PTR OrdinalNumber); +__declspec(dllexport) ULONG_PTR TITCALL ImporterFindAPIByWriteLocation(ULONG_PTR APIWriteLocation); +__declspec(dllexport) ULONG_PTR TITCALL ImporterFindDLLByWriteLocation(ULONG_PTR APIWriteLocation); +__declspec(dllexport) void* TITCALL ImporterGetDLLName(ULONG_PTR APIAddress); +__declspec(dllexport) void* TITCALL ImporterGetDLLNameW(ULONG_PTR APIAddress); +__declspec(dllexport) void* TITCALL ImporterGetAPIName(ULONG_PTR APIAddress); +__declspec(dllexport) ULONG_PTR TITCALL ImporterGetAPIOrdinalNumber(ULONG_PTR APIAddress); +__declspec(dllexport) void* TITCALL ImporterGetAPINameEx(ULONG_PTR APIAddress, ULONG_PTR DLLBasesList); +__declspec(dllexport) ULONG_PTR TITCALL ImporterGetRemoteAPIAddress(HANDLE hProcess, ULONG_PTR APIAddress); +__declspec(dllexport) ULONG_PTR TITCALL ImporterGetRemoteAPIAddressEx(const char* szDLLName, const char* szAPIName); +__declspec(dllexport) ULONG_PTR TITCALL ImporterGetLocalAPIAddress(HANDLE hProcess, ULONG_PTR APIAddress); +__declspec(dllexport) void* TITCALL ImporterGetDLLNameFromDebugee(HANDLE hProcess, ULONG_PTR APIAddress); +__declspec(dllexport) void* TITCALL ImporterGetDLLNameFromDebugeeW(HANDLE hProcess, ULONG_PTR APIAddress); +__declspec(dllexport) void* TITCALL ImporterGetAPINameFromDebugee(HANDLE hProcess, ULONG_PTR APIAddress); +__declspec(dllexport) ULONG_PTR TITCALL ImporterGetAPIOrdinalNumberFromDebugee(HANDLE hProcess, ULONG_PTR APIAddress); +__declspec(dllexport) long TITCALL ImporterGetDLLIndexEx(ULONG_PTR APIAddress, ULONG_PTR DLLBasesList); +__declspec(dllexport) long TITCALL ImporterGetDLLIndex(HANDLE hProcess, ULONG_PTR APIAddress, ULONG_PTR DLLBasesList); +__declspec(dllexport) ULONG_PTR TITCALL ImporterGetRemoteDLLBase(HANDLE hProcess, HMODULE LocalModuleBase); +__declspec(dllexport) ULONG_PTR TITCALL ImporterGetRemoteDLLBaseEx(HANDLE hProcess, const char* szModuleName); +__declspec(dllexport) void* TITCALL ImporterGetRemoteDLLBaseExW(HANDLE hProcess, const wchar_t* szModuleName); +__declspec(dllexport) bool TITCALL ImporterIsForwardedAPI(HANDLE hProcess, ULONG_PTR APIAddress); +__declspec(dllexport) void* TITCALL ImporterGetForwardedAPIName(HANDLE hProcess, ULONG_PTR APIAddress); +__declspec(dllexport) void* TITCALL ImporterGetForwardedDLLName(HANDLE hProcess, ULONG_PTR APIAddress); +__declspec(dllexport) long TITCALL ImporterGetForwardedDLLIndex(HANDLE hProcess, ULONG_PTR APIAddress, ULONG_PTR DLLBasesList); +__declspec(dllexport) ULONG_PTR TITCALL ImporterGetForwardedAPIOrdinalNumber(HANDLE hProcess, ULONG_PTR APIAddress); +__declspec(dllexport) ULONG_PTR TITCALL ImporterGetNearestAPIAddress(HANDLE hProcess, ULONG_PTR APIAddress); +__declspec(dllexport) void* TITCALL ImporterGetNearestAPIName(HANDLE hProcess, ULONG_PTR APIAddress); +__declspec(dllexport) bool TITCALL ImporterCopyOriginalIAT(const char* szOriginalFile, const char* szDumpFile); +__declspec(dllexport) bool TITCALL ImporterCopyOriginalIATW(const wchar_t* szOriginalFile, const wchar_t* szDumpFile); +__declspec(dllexport) bool TITCALL ImporterLoadImportTable(const char* szFileName); +__declspec(dllexport) bool TITCALL ImporterLoadImportTableW(const wchar_t* szFileName); +__declspec(dllexport) bool TITCALL ImporterMoveOriginalIAT(const char* szOriginalFile, const char* szDumpFile, const char* szSectionName); +__declspec(dllexport) bool TITCALL ImporterMoveOriginalIATW(const wchar_t* szOriginalFile, const wchar_t* szDumpFile, const char* szSectionName); +__declspec(dllexport) void TITCALL ImporterAutoSearchIAT(DWORD ProcessId, const char* szFileName, ULONG_PTR SearchStart, LPVOID pIATStart, LPVOID pIATSize); +__declspec(dllexport) void TITCALL ImporterAutoSearchIATW(DWORD ProcessIds, const wchar_t* szFileName, ULONG_PTR SearchStart, LPVOID pIATStart, LPVOID pIATSize); +__declspec(dllexport) void TITCALL ImporterAutoSearchIATEx(DWORD ProcessId, ULONG_PTR ImageBase, ULONG_PTR SearchStart, LPVOID pIATStart, LPVOID pIATSize); +__declspec(dllexport) void TITCALL ImporterEnumAddedData(LPVOID EnumCallBack); +__declspec(dllexport) long TITCALL ImporterAutoFixIATEx(DWORD ProcessId, const char* szDumpedFile, const char* szSectionName, bool DumpRunningProcess, bool RealignFile, ULONG_PTR EntryPointAddress, ULONG_PTR ImageBase, ULONG_PTR SearchStart, bool TryAutoFix, bool FixEliminations, LPVOID UnknownPointerFixCallback); +__declspec(dllexport) long TITCALL ImporterAutoFixIATExW(DWORD ProcessId, const wchar_t* szDumpedFile, const wchar_t* szSectionName, bool DumpRunningProcess, bool RealignFile, ULONG_PTR EntryPointAddress, ULONG_PTR ImageBase, ULONG_PTR SearchStart, bool TryAutoFix, bool FixEliminations, LPVOID UnknownPointerFixCallback); +__declspec(dllexport) long TITCALL ImporterAutoFixIAT(DWORD ProcessId, const char* szDumpedFile, ULONG_PTR SearchStart); +__declspec(dllexport) long TITCALL ImporterAutoFixIATW(DWORD ProcessId, const wchar_t* szDumpedFile, ULONG_PTR SearchStart); +__declspec(dllexport) bool TITCALL ImporterDeleteAPI(DWORD_PTR apiAddr); +// Global.Engine.Hook.functions: +__declspec(dllexport) bool TITCALL HooksSafeTransitionEx(LPVOID HookAddressArray, int NumberOfHooks, bool TransitionStart); +__declspec(dllexport) bool TITCALL HooksSafeTransition(LPVOID HookAddress, bool TransitionStart); +__declspec(dllexport) bool TITCALL HooksIsAddressRedirected(LPVOID HookAddress); +__declspec(dllexport) void* TITCALL HooksGetTrampolineAddress(LPVOID HookAddress); +__declspec(dllexport) void* TITCALL HooksGetHookEntryDetails(LPVOID HookAddress); +__declspec(dllexport) bool TITCALL HooksInsertNewRedirection(LPVOID HookAddress, LPVOID RedirectTo, int HookType); +__declspec(dllexport) bool TITCALL HooksInsertNewIATRedirectionEx(ULONG_PTR FileMapVA, ULONG_PTR LoadedModuleBase, const char* szHookFunction, LPVOID RedirectTo); +__declspec(dllexport) bool TITCALL HooksInsertNewIATRedirection(const char* szModuleName, const char* szHookFunction, LPVOID RedirectTo); +__declspec(dllexport) bool TITCALL HooksRemoveRedirection(LPVOID HookAddress, bool RemoveAll); +__declspec(dllexport) bool TITCALL HooksRemoveRedirectionsForModule(HMODULE ModuleBase); +__declspec(dllexport) bool TITCALL HooksRemoveIATRedirection(const char* szModuleName, const char* szHookFunction, bool RemoveAll); +__declspec(dllexport) bool TITCALL HooksDisableRedirection(LPVOID HookAddress, bool DisableAll); +__declspec(dllexport) bool TITCALL HooksDisableRedirectionsForModule(HMODULE ModuleBase); +__declspec(dllexport) bool TITCALL HooksDisableIATRedirection(const char* szModuleName, const char* szHookFunction, bool DisableAll); +__declspec(dllexport) bool TITCALL HooksEnableRedirection(LPVOID HookAddress, bool EnableAll); +__declspec(dllexport) bool TITCALL HooksEnableRedirectionsForModule(HMODULE ModuleBase); +__declspec(dllexport) bool TITCALL HooksEnableIATRedirection(const char* szModuleName, const char* szHookFunction, bool EnableAll); +__declspec(dllexport) void TITCALL HooksScanModuleMemory(HMODULE ModuleBase, LPVOID CallBack); +__declspec(dllexport) void TITCALL HooksScanEntireProcessMemory(LPVOID CallBack); +__declspec(dllexport) void TITCALL HooksScanEntireProcessMemoryEx(); +// TitanEngine.Tracer.functions: +__declspec(dllexport) void TITCALL TracerInit(); +__declspec(dllexport) ULONG_PTR TITCALL TracerLevel1(HANDLE hProcess, ULONG_PTR AddressToTrace); +__declspec(dllexport) ULONG_PTR TITCALL HashTracerLevel1(HANDLE hProcess, ULONG_PTR AddressToTrace, DWORD InputNumberOfInstructions); +__declspec(dllexport) long TITCALL TracerDetectRedirection(HANDLE hProcess, ULONG_PTR AddressToTrace); +__declspec(dllexport) ULONG_PTR TITCALL TracerFixKnownRedirection(HANDLE hProcess, ULONG_PTR AddressToTrace, DWORD RedirectionId); +__declspec(dllexport) ULONG_PTR TITCALL TracerFixRedirectionViaModule(HMODULE hModuleHandle, HANDLE hProcess, ULONG_PTR AddressToTrace, DWORD IdParameter); +__declspec(dllexport) long TITCALL TracerFixRedirectionViaImpRecPlugin(HANDLE hProcess, const char* szPluginName, ULONG_PTR AddressToTrace); +// TitanEngine.Exporter.functions: +__declspec(dllexport) void TITCALL ExporterCleanup(); +__declspec(dllexport) void TITCALL ExporterSetImageBase(ULONG_PTR ImageBase); +__declspec(dllexport) void TITCALL ExporterInit(DWORD MemorySize, ULONG_PTR ImageBase, DWORD ExportOrdinalBase, const char* szExportModuleName); +__declspec(dllexport) bool TITCALL ExporterAddNewExport(const char* szExportName, DWORD ExportRelativeAddress); +__declspec(dllexport) bool TITCALL ExporterAddNewOrdinalExport(DWORD OrdinalNumber, DWORD ExportRelativeAddress); +__declspec(dllexport) long TITCALL ExporterGetAddedExportCount(); +__declspec(dllexport) long TITCALL ExporterEstimatedSize(); +__declspec(dllexport) bool TITCALL ExporterBuildExportTable(ULONG_PTR StorePlace, ULONG_PTR FileMapVA); +__declspec(dllexport) bool TITCALL ExporterBuildExportTableEx(const char* szExportFileName, const char* szSectionName); +__declspec(dllexport) bool TITCALL ExporterBuildExportTableExW(const wchar_t* szExportFileName, const char* szSectionName); +__declspec(dllexport) bool TITCALL ExporterLoadExportTable(const char* szFileName); +__declspec(dllexport) bool TITCALL ExporterLoadExportTableW(const wchar_t* szFileName); +// TitanEngine.Librarian.functions: +__declspec(dllexport) bool TITCALL LibrarianSetBreakPoint(const char* szLibraryName, DWORD bpxType, bool SingleShoot, LPVOID bpxCallBack); +__declspec(dllexport) bool TITCALL LibrarianRemoveBreakPoint(const char* szLibraryName, DWORD bpxType); +__declspec(dllexport) void* TITCALL LibrarianGetLibraryInfo(const char* szLibraryName); +__declspec(dllexport) void* TITCALL LibrarianGetLibraryInfoW(const wchar_t* szLibraryName); +__declspec(dllexport) void* TITCALL LibrarianGetLibraryInfoEx(void* BaseOfDll); +__declspec(dllexport) void* TITCALL LibrarianGetLibraryInfoExW(void* BaseOfDll); +__declspec(dllexport) void TITCALL LibrarianEnumLibraryInfo(void* EnumCallBack); +__declspec(dllexport) void TITCALL LibrarianEnumLibraryInfoW(void* EnumCallBack); +// TitanEngine.Process.functions: +__declspec(dllexport) long TITCALL GetActiveProcessId(const char* szImageName); +__declspec(dllexport) long TITCALL GetActiveProcessIdW(const wchar_t* szImageName); +__declspec(dllexport) void TITCALL EnumProcessesWithLibrary(const char* szLibraryName, void* EnumFunction); +__declspec(dllexport) HANDLE TITCALL TitanOpenProcess(DWORD dwDesiredAccess, bool bInheritHandle, DWORD dwProcessId); +__declspec(dllexport) HANDLE TITCALL TitanOpenThread(DWORD dwDesiredAccess, bool bInheritHandle, DWORD dwThreadId); +// TitanEngine.TLSFixer.functions: +__declspec(dllexport) bool TITCALL TLSBreakOnCallBack(LPVOID ArrayOfCallBacks, DWORD NumberOfCallBacks, LPVOID bpxCallBack); +__declspec(dllexport) bool TITCALL TLSGrabCallBackData(const char* szFileName, LPVOID ArrayOfCallBacks, LPDWORD NumberOfCallBacks); +__declspec(dllexport) bool TITCALL TLSGrabCallBackDataW(const wchar_t* szFileName, LPVOID ArrayOfCallBacks, LPDWORD NumberOfCallBacks); +__declspec(dllexport) bool TITCALL TLSBreakOnCallBackEx(const char* szFileName, LPVOID bpxCallBack); +__declspec(dllexport) bool TITCALL TLSBreakOnCallBackExW(const wchar_t* szFileName, LPVOID bpxCallBack); +__declspec(dllexport) bool TITCALL TLSRemoveCallback(const char* szFileName); +__declspec(dllexport) bool TITCALL TLSRemoveCallbackW(const wchar_t* szFileName); +__declspec(dllexport) bool TITCALL TLSRemoveTable(const char* szFileName); +__declspec(dllexport) bool TITCALL TLSRemoveTableW(const wchar_t* szFileName); +__declspec(dllexport) bool TITCALL TLSBackupData(const char* szFileName); +__declspec(dllexport) bool TITCALL TLSBackupDataW(const wchar_t* szFileName); +__declspec(dllexport) bool TITCALL TLSRestoreData(); +__declspec(dllexport) bool TITCALL TLSBuildNewTable(ULONG_PTR FileMapVA, ULONG_PTR StorePlace, ULONG_PTR StorePlaceRVA, LPVOID ArrayOfCallBacks, DWORD NumberOfCallBacks); +__declspec(dllexport) bool TITCALL TLSBuildNewTableEx(const char* szFileName, const char* szSectionName, LPVOID ArrayOfCallBacks, DWORD NumberOfCallBacks); +__declspec(dllexport) bool TITCALL TLSBuildNewTableExW(const wchar_t* szFileName, const char* szSectionName, LPVOID ArrayOfCallBacks, DWORD NumberOfCallBacks); +// TitanEngine.TranslateName.functions: +__declspec(dllexport) void* TITCALL TranslateNativeName(const char* szNativeName); +__declspec(dllexport) void* TITCALL TranslateNativeNameW(const wchar_t* szNativeName); +// TitanEngine.Handler.functions: +__declspec(dllexport) long TITCALL HandlerGetActiveHandleCount(DWORD ProcessId); +__declspec(dllexport) bool TITCALL HandlerIsHandleOpen(DWORD ProcessId, HANDLE hHandle); +__declspec(dllexport) void* TITCALL HandlerGetHandleName(HANDLE hProcess, DWORD ProcessId, HANDLE hHandle, bool TranslateName); +__declspec(dllexport) void* TITCALL HandlerGetHandleNameW(HANDLE hProcess, DWORD ProcessId, HANDLE hHandle, bool TranslateName); +__declspec(dllexport) long TITCALL HandlerEnumerateOpenHandles(DWORD ProcessId, LPVOID HandleBuffer, DWORD MaxHandleCount); +__declspec(dllexport) ULONG_PTR TITCALL HandlerGetHandleDetails(HANDLE hProcess, DWORD ProcessId, HANDLE hHandle, DWORD InformationReturn); +__declspec(dllexport) bool TITCALL HandlerCloseRemoteHandle(HANDLE hProcess, HANDLE hHandle); +__declspec(dllexport) long TITCALL HandlerEnumerateLockHandles(char* szFileOrFolderName, bool NameIsFolder, bool NameIsTranslated, LPVOID HandleDataBuffer, DWORD MaxHandleCount); +__declspec(dllexport) long TITCALL HandlerEnumerateLockHandlesW(const wchar_t* szFileOrFolderName, bool NameIsFolder, bool NameIsTranslated, LPVOID HandleDataBuffer, DWORD MaxHandleCount); +__declspec(dllexport) bool TITCALL HandlerCloseAllLockHandles(const char* szFileOrFolderName, bool NameIsFolder, bool NameIsTranslated); +__declspec(dllexport) bool TITCALL HandlerCloseAllLockHandlesW(const wchar_t* szFileOrFolderName, bool NameIsFolder, bool NameIsTranslated); +__declspec(dllexport) bool TITCALL HandlerIsFileLocked(const char* szFileOrFolderName, bool NameIsFolder, bool NameIsTranslated); +__declspec(dllexport) bool TITCALL HandlerIsFileLockedW(const wchar_t* szFileOrFolderName, bool NameIsFolder, bool NameIsTranslated); +// TitanEngine.Handler[Mutex].functions: +__declspec(dllexport) long TITCALL HandlerEnumerateOpenMutexes(HANDLE hProcess, DWORD ProcessId, LPVOID HandleBuffer, DWORD MaxHandleCount); +__declspec(dllexport) ULONG_PTR TITCALL HandlerGetOpenMutexHandle(HANDLE hProcess, DWORD ProcessId, const char* szMutexString); +__declspec(dllexport) ULONG_PTR TITCALL HandlerGetOpenMutexHandleW(HANDLE hProcess, DWORD ProcessId, const wchar_t* szMutexString); +__declspec(dllexport) long TITCALL HandlerGetProcessIdWhichCreatedMutex(const char* szMutexString); +__declspec(dllexport) long TITCALL HandlerGetProcessIdWhichCreatedMutexW(const wchar_t* szMutexString); +// TitanEngine.Injector.functions: +__declspec(dllexport) bool TITCALL RemoteLoadLibrary(HANDLE hProcess, const char* szLibraryFile, bool WaitForThreadExit); +__declspec(dllexport) bool TITCALL RemoteLoadLibraryW(HANDLE hProcess, const wchar_t* szLibraryFile, bool WaitForThreadExit); +__declspec(dllexport) bool TITCALL RemoteFreeLibrary(HANDLE hProcess, HMODULE hModule, const char* szLibraryFile, bool WaitForThreadExit); +__declspec(dllexport) bool TITCALL RemoteFreeLibraryW(HANDLE hProcess, HMODULE hModule, const wchar_t* szLibraryFile, bool WaitForThreadExit); +__declspec(dllexport) bool TITCALL RemoteExitProcess(HANDLE hProcess, DWORD ExitCode); +// TitanEngine.StaticUnpacker.functions: +__declspec(dllexport) bool TITCALL StaticFileLoad(const char* szFileName, DWORD DesiredAccess, bool SimulateLoad, LPHANDLE FileHandle, LPDWORD LoadedSize, LPHANDLE FileMap, PULONG_PTR FileMapVA); +__declspec(dllexport) bool TITCALL StaticFileLoadW(const wchar_t* szFileName, DWORD DesiredAccess, bool SimulateLoad, LPHANDLE FileHandle, LPDWORD LoadedSize, LPHANDLE FileMap, PULONG_PTR FileMapVA); +__declspec(dllexport) bool TITCALL StaticFileUnload(const char* szFileName, bool CommitChanges, HANDLE FileHandle, DWORD LoadedSize, HANDLE FileMap, ULONG_PTR FileMapVA); +__declspec(dllexport) bool TITCALL StaticFileUnloadW(const wchar_t* szFileName, bool CommitChanges, HANDLE FileHandle, DWORD LoadedSize, HANDLE FileMap, ULONG_PTR FileMapVA); +__declspec(dllexport) bool TITCALL StaticFileOpen(const char* szFileName, DWORD DesiredAccess, LPHANDLE FileHandle, LPDWORD FileSizeLow, LPDWORD FileSizeHigh); +__declspec(dllexport) bool TITCALL StaticFileOpenW(const wchar_t* szFileName, DWORD DesiredAccess, LPHANDLE FileHandle, LPDWORD FileSizeLow, LPDWORD FileSizeHigh); +__declspec(dllexport) bool TITCALL StaticFileGetContent(HANDLE FileHandle, DWORD FilePositionLow, LPDWORD FilePositionHigh, void* Buffer, DWORD Size); +__declspec(dllexport) void TITCALL StaticFileClose(HANDLE FileHandle); +__declspec(dllexport) void TITCALL StaticMemoryDecrypt(LPVOID MemoryStart, DWORD MemorySize, DWORD DecryptionType, DWORD DecryptionKeySize, ULONG_PTR DecryptionKey); +__declspec(dllexport) void TITCALL StaticMemoryDecryptEx(LPVOID MemoryStart, DWORD MemorySize, DWORD DecryptionKeySize, void* DecryptionCallBack); +__declspec(dllexport) void TITCALL StaticMemoryDecryptSpecial(LPVOID MemoryStart, DWORD MemorySize, DWORD DecryptionKeySize, DWORD SpecDecryptionType, void* DecryptionCallBack); +__declspec(dllexport) void TITCALL StaticSectionDecrypt(ULONG_PTR FileMapVA, DWORD SectionNumber, bool SimulateLoad, DWORD DecryptionType, DWORD DecryptionKeySize, ULONG_PTR DecryptionKey); +__declspec(dllexport) bool TITCALL StaticMemoryDecompress(void* Source, DWORD SourceSize, void* Destination, DWORD DestinationSize, int Algorithm); +__declspec(dllexport) bool TITCALL StaticRawMemoryCopy(HANDLE hFile, ULONG_PTR FileMapVA, ULONG_PTR VitualAddressToCopy, DWORD Size, bool AddressIsRVA, const char* szDumpFileName); +__declspec(dllexport) bool TITCALL StaticRawMemoryCopyW(HANDLE hFile, ULONG_PTR FileMapVA, ULONG_PTR VitualAddressToCopy, DWORD Size, bool AddressIsRVA, const wchar_t* szDumpFileName); +__declspec(dllexport) bool TITCALL StaticRawMemoryCopyEx(HANDLE hFile, DWORD RawAddressToCopy, DWORD Size, const char* szDumpFileName); +__declspec(dllexport) bool TITCALL StaticRawMemoryCopyExW(HANDLE hFile, DWORD RawAddressToCopy, DWORD Size, const wchar_t* szDumpFileName); +__declspec(dllexport) bool TITCALL StaticRawMemoryCopyEx64(HANDLE hFile, DWORD64 RawAddressToCopy, DWORD64 Size, const char* szDumpFileName); +__declspec(dllexport) bool TITCALL StaticRawMemoryCopyEx64W(HANDLE hFile, DWORD64 RawAddressToCopy, DWORD64 Size, const wchar_t* szDumpFileName); +__declspec(dllexport) bool TITCALL StaticHashMemory(void* MemoryToHash, DWORD SizeOfMemory, void* HashDigest, bool OutputString, int Algorithm); +__declspec(dllexport) bool TITCALL StaticHashFileW(const wchar_t* szFileName, char* HashDigest, bool OutputString, int Algorithm); +__declspec(dllexport) bool TITCALL StaticHashFile(const char* szFileName, char* HashDigest, bool OutputString, int Algorithm); +// TitanEngine.Engine.functions: +__declspec(dllexport) void TITCALL EngineUnpackerInitialize(const char* szFileName, const char* szUnpackedFileName, bool DoLogData, bool DoRealignFile, bool DoMoveOverlay, void* EntryCallBack); +__declspec(dllexport) void TITCALL EngineUnpackerInitializeW(const wchar_t* szFileName, const wchar_t* szUnpackedFileName, bool DoLogData, bool DoRealignFile, bool DoMoveOverlay, void* EntryCallBack); +__declspec(dllexport) bool TITCALL EngineUnpackerSetBreakCondition(void* SearchStart, DWORD SearchSize, void* SearchPattern, DWORD PatternSize, DWORD PatternDelta, ULONG_PTR BreakType, bool SingleBreak, DWORD Parameter1, DWORD Parameter2); +__declspec(dllexport) void TITCALL EngineUnpackerSetEntryPointAddress(ULONG_PTR UnpackedEntryPointAddress); +__declspec(dllexport) void TITCALL EngineUnpackerFinalizeUnpacking(); +// TitanEngine.Engine.functions: +__declspec(dllexport) void TITCALL SetEngineVariable(DWORD VariableId, bool VariableSet); +__declspec(dllexport) bool TITCALL EngineCreateMissingDependencies(const char* szFileName, const char* szOutputFolder, bool LogCreatedFiles); +__declspec(dllexport) bool TITCALL EngineCreateMissingDependenciesW(const wchar_t* szFileName, const wchar_t* szOutputFolder, bool LogCreatedFiles); +__declspec(dllexport) bool TITCALL EngineFakeMissingDependencies(HANDLE hProcess); +__declspec(dllexport) bool TITCALL EngineDeleteCreatedDependencies(); +__declspec(dllexport) bool TITCALL EngineCreateUnpackerWindow(const char* WindowUnpackerTitle, const char* WindowUnpackerLongTitle, const char* WindowUnpackerName, const char* WindowUnpackerAuthor, void* StartUnpackingCallBack); +__declspec(dllexport) void TITCALL EngineAddUnpackerWindowLogMessage(const char* szLogMessage); +__declspec(dllexport) bool TITCALL EngineCheckStructAlignment(DWORD StructureType, ULONG_PTR StructureSize); +// Global.Engine.Extension.Functions: +__declspec(dllexport) bool TITCALL ExtensionManagerIsPluginLoaded(const char* szPluginName); +__declspec(dllexport) bool TITCALL ExtensionManagerIsPluginEnabled(const char* szPluginName); +__declspec(dllexport) bool TITCALL ExtensionManagerDisableAllPlugins(); +__declspec(dllexport) bool TITCALL ExtensionManagerDisablePlugin(const char* szPluginName); +__declspec(dllexport) bool TITCALL ExtensionManagerEnableAllPlugins(); +__declspec(dllexport) bool TITCALL ExtensionManagerEnablePlugin(const char* szPluginName); +__declspec(dllexport) bool TITCALL ExtensionManagerUnloadAllPlugins(); +__declspec(dllexport) bool TITCALL ExtensionManagerUnloadPlugin(const char* szPluginName); +__declspec(dllexport) void* TITCALL ExtensionManagerGetPluginInfo(const char* szPluginName); + +#ifdef __cplusplus +} +#endif + +#pragma pack(pop) + +#endif /*TITANENGINE*/ diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/TitanEngine/TitanEngine_x64.a b/BranchTrace-x64plugin-wtl/pluginsdk/TitanEngine/TitanEngine_x64.a new file mode 100644 index 0000000000000000000000000000000000000000..df8c0eab703b78eddd1d29989cfa0d6a12f1dbcd GIT binary patch literal 333954 zcmeI53!G&~S>UU0cX-4|c!U7q)fol|F*|hk^z`&(V@UUOPo_i9OglZ98DdQ4PTw=# zH*@>m-g|G)^n}NbfH7c<0TClcKtw=9VG$9PU0Gz&Wzl6>R8$rfkzH9tbXimuWxucL zoKw&9-MS}j`>S-F-|xGRsydIV`k(K7RbN$|t8b{bmsW1P^o7IvHo9l`*vRO}#O|@- z;SnCCehv?hjZch16l|w1Wo)p)*r^r9PJfNDj5d$W+vDaKIF zT`6Savy7p<^g$u7ILH{v_g^pM)z>nH@`INOdCfN&L%Hu`LVn~P#!y~ABjm>_jG_Ga z2Zg-pF2+!P>RCeG@^Qvc-Uio>^0Utn^3KmOhVt$=3HgO-#!%k-B_Z$s3}Yz2{5ByU zf_+hb9gd6g?>{Z%Bky1gl>ZFJLiuDx$nV1Sqx`oAgnZ^OV<>;{I3a%s zWrFfKC|8s}*%0!D+ZaRni))1Zug5Tk@?|Jvl)w6@kgvU(F_iyP6Y`A(#!&v@sY3qW z*BC?jC%6WXfq|}&q35vylt=x(kjK8B4WL|hP{`$vVFM^n__&ZOUd;wjo^q3rr+u9b zpgiM)LY{q&4WR586SDIQYyjo?_X)Z7S~h@k-G31B!UZ;fGWta!<8NmJD0^!{uD^~A zpxp5HLSFPyHh?nyY9X`JYyjopl|pX$EE_;M^hO~Icd!AJ#cPDz`Z+d$a`Jv5-+Ln) zK>0q%1Inp)30b<04WOL4RLIJQ*#OGfhL9#)6Uy4>g>)Wb11RT?3fcGu8$fyKdxX5= z6dOSKekekV!%jAU^2SdJ`3cA$%0sXp%3Gc) z^GCYyjowzAWTDa7>i<-Y(?*m$3nq4}4I_uN-6pD8Kr*LO%QsHh}UQ zP)8^qy-LW({)r8s{MMfe`NX@~0Lt&Qg?#D;Hh}VJNQ3fwUlj7$Pq6`%KmLG_&%c%p zp#0fsAzy@RMfnoc1V!$ z8vv;c{E?8M2UrE=(epwst*{EpWgil9`RiE)<%xF*dGa)?pgi?bAy<8pRZyOJPRQ_a zRzZ2rE+Nl*6sw?I^En~k^=?){+0_;@3g<-`-zj9`v#f%$@9jcvXtD~*i*67y^+i@e znR%^{o3CLNl(}CMGJk+oP!4}X$oIUJRZxx{6>qdDalp)H49}@DDx3db$n}>wF71E;o%t0YP`?suu z@~$@t`S~-fg7S+aLf-c+Rzdltj|=(W{j7rWt2H4Xo@5o2-+<$z{KwA=`Pc_o1?9J1 zDdZDSb|}BIOUS1nEy|}qC*=1&$tozHg>pjq<5NODe-o>q{Ml7P{`~h@1?5W*3i-?9 ztb+0tC@Yk&epSfde2G<1zW!k$fA>aKLHQ=6Mft}kav5asct)xGsgO%P#0F6w^PrIL zILQW49(SdX$A6LyqCDw-Ay+Q2L6oOGO32ec%?44P^^lOOYitl@=Pn`7`x+ZWdBHCV zxo(XOqP%cK$mmztAj&vg1Ipf}kn4A{L6jT5B;-XOXM-ryZx%9piVdP1e3pg3mWrhu+ybX?x@^&aEly`nu$h#k4gDAf+FXVmKvq6;ie?!PG zzncxBeCReIzy1t1hywNsmyg`T22p-f{@t{vmum&ZxHfgxK@i%f$K(D{CgqCKgNbo zUUI*X+b7r%%AJ=9ss1h-LaAL8vV5Ekq1<(?kj6LI5K8NlLfZGSA(Zu#LN;dD5XwuR zC*qQ}-9$`Z$pZSWAKX?xtLiwY+g#3?T zHiYsg5RdYO*9!TIgKP-pe|}ZSm+xakD1UWK$X|bp4Waxklp)IhZ3y}MU2F*Dn~-;u zfBZErm$17Tm%$zE5|m4RTgYQJ*d-|6@hl?GJwoSQnv?!2?Ux^|}(oCdU$)9dv{ z?LfVeoY0eMF?Q;y!qijQHNbgW?QZ9IwNbC>skNB&*vm=xP^-4yNcOkZn_WG<5hwSU z6Q{6JXW?c__pwE45tr_9roM5gy0(_oX4Y5N^uy~>GQBe;56sgvYe(8OsJn(ZikYvTJMUB z(Jx*Gr$?>UYNC$xbTU|`a~%)TrNJlaYsq4=gj{8r(Snpe>8aF^Tbl>#wPXfV!}4;{ zP7@e`$J*6qrvdeH80b9*pR2h7aYi`;(*wI=AZ#gV&nM@S#;8mtgGBsXvz{pmB|!W< zP~SM3)aq?f2*>MHD4CA4}S+pzpego*SMuJ2u;EG3oBFHX75_rLzZG?Ze4NcXp%R6|uADlKko5pFT@@ zH0i9bx-UkH($i<9DKw8eP7j@GG(|Fav)!L1lOwLG+u*gA4SN}dkTID4d-Wl_Hd zI}WeH3{{S9McL^KQ}e5VnpFIWxT`ci5~&Lm6i3u|&$N0dl^w0iy!;M%^hzqNKDt7d1E zBT!aKL8LQyVw^b7>;^^`?3b4uW=Fen+|9igwU29$;`C{1QCw*OFRmp^^=d=g$(cap zNQ=r-l=vv$ttKjZ6`Zc>~*l(SrNI> zk}JV7o!VbvhU)*VW8to8-tgzG%|@$Q)A3Qm#nEJlc046mro*SBeLNAWr?QTPiIi)b zcV3wYl}Ez=){%IiOassR{jFwKn$FHB8MwdE>gctGSrwrol~TI~b$X1ITDw#wEn5WZ zvXP+j$&$zbXb~)~RNF}nm0F`J)ru8vrp%6IBxI0oVRrYJs(-a0-3C)E?Hfod9g>O2LW`(U+QI}a7fpR5b5dJ~#Jzj0s(SVcZH^Lz$eiz3r zIj#zuJL_w)f-wN^-;M5pgPbaga6daZ%)c6tJAX6Yw!bA$WH$>rH zQ^!xH$B|J=7^Ya5lNcz8wBW_+8R&^>Krad&SF~I8F!|4Uz)n6R~`c*^MrA=0OjbDDMO9)+!dab(w|fvOU`cDeQ|cPT1>MW|j($q~s1- zp-G#!I7R;KeAy}FRhV&(yf~5+?{8hdxi`P^b{A_Pwd?cVZak_PV}~hc&=cd4p?iM5 z+UXiS&yENyNFG){1{`&*0e!(r!DRo_n0!wj4(YLJY?ui~p!PT4U)e7`ihObjy(9LM zq2fPuoJlp7sYquO2BO2KTAQz*Zdcp68RLksf|Tpjj=`_Bn{d_OI;s{Sj;aJ{M^(c` zO6+&d`VwUsbfG$A_|c?+F07=DE`;_18WWF@KG0O|F(6H&)7 zFVArVd6lyp=)IL!AuZDU6s{yhq{#^A{@4LU~bIWFEX9+OO4ia_oF7 zt9?Z)rp4_{Lmk1qWXA#IRqt;k)h3L?%Wkslq-n4`&q}qqoS^!iuBui_mfnai*v~qR zwwt`FsT%g!r3aBtqx`5={LuuQ{madTS(O$gNQuv{A&-XhroYWNwovUZt>m{r_K$z3 zX~pjac={v@vj@R*2Kp$E(gL+Kt|UyT5AIAy<1$TShKm1i%{41g9(V|^8!ipBV>7>e zBT)UDol4n_p%Q^-O!l}wdSW)qm@CE(%a3UuhKZ+8z1l<*z73tDyg`10qgNNWuE6Yq_bU}n9j7U%zWnQg*O;A+@d(!*Kz0f-$4&lzE6`!Ba zh%rxSMq9mUIcBaHD=a&_)nhl;!9EI9G<^JyENw@G6_g&;4xj7X0>dnBhIaq*u~zB< z$}hMe(iNPaz&;$C>)=(-%+F_JDFOM<`~Yd%bg$_It}Gq+kaenwee{^Q4zxyRo7fW| zlPN*?I2QvW_`&ikF@ueC*;VPu7^bq0lLq8*N)2VnF-VD5j?Q<6g3n{kI1w{HZ=W^~ zQ-)T(g#B9i?OvS0r40I_~iB`s(T2E9jN9AW@IpWc8%% zofd(4`va4CjGY>Li?|9(@(!aOiO6WX>eF*8=TWIIthOvdKO3(k*PQ{$vpB~d&Z`m? zuA~MuVKgfCYRloVh0$gN)CaX+9ut}03o4pDY`=VkIcAWMsVtm!QV2XYO=^+~Cw0c70cd3z*MqdhLgN@DEa`x@W~ zW}@sEqJa<3eESinMLE(NMXn^z>n9H@N-I-pt$v-ESuHNV5-{Jz4JXH4x#O}>;iG`U zFs??1XDM-51Yr+Z(FOY%=P`E6^FFoSZ7pV#0ZipV$itgkVuc~j>|)5!S~xv(ym>xV_wlc5>e6S$sMOjuNwMQ zV1RV9Q^%2>#;MIXaYijvJCPp4Q;XgQW!Ne|@)p2^$^)Dv4L5qT5AK(%sudp9GV zpKY#_8lc&pdF!$;T0}HENgMq7&{dZYc~{Rk=Ze?&)GtS`kbHM55p@jb1?Wc*;&}`XmVpk3o|jFgD>#yR;r9OG%F}S;(v(YgCveOq(SmS*mzXP|&G)c^ z(;*Ub9r1&Yl}b;}2Q0U>m^?Lh@IV{xY?2T1az;4^+}~)5P5Rt3bCO01&LE+Hh?^#m7p-nx&UKW<*ecuXe8SwRO95i zWT@B8|hYSMKZ2bDiYsMx57~!nL;uqxQ~H zn0q72X`E58`N_2;#Qu6QyLQj&lMnn8omS#_`mT0#dR86*z6qIhq|dG*6H zsQQh`y)a7ZXtG=fzfU_WWJd%9-P(j{H#K|QS+;k2LZ6h7CY$aACJhd;k~^Cbn09s= ziiOX`f`P`OP^@4*z?lkj3`6+b)4SYp80s2LX@{F3@(Q#A;57(57Q1ceL6^z2P)L=j zOKT#UI}StL<)jDe>E!8^RCtZ((n$Siq9+Xd5{_pRIEe&l6jo|>*J(k@A3UUExG0sP zFiy>g7^|uuJYY(`pggs4AiRPD>rFnJb)gEDA`Ax1MoK!Pc%Xayr!xuyaX<@B^^zBnhd?avf?O73 z^03QZH&TfNN)&eJP`euO*`B%{;TOV#Al@4HnJW=1My3|1$ZRTOJ%J8Aoii1t5f9Pq zUd|0GSBxDdk7^u-AK4r=iu=njXv8h0!_Y-$l>lhY3%~#Vm1ODc;`(ZKKR6<+p!A~b za0r=hx6URora`zvW#@x4$`L4!Z61m7enWjoyB4JU$&Ug(jbab6_v`{X;?&qQgzr1M zaC6d3+I8?@H1gqQt{6K^KcsRPe%@S_;EwPIzmz@Tf1{zK;eRkJPXj;G(UrznoleinR%SF zy-Hq)o~Gak$~lBu>YYyXUMFoBdNa2Qpy9J2uT>m*XGCS`vHrzx&A(k3T@YcM$~Y?A znc@-@)uIJue^5K4UrPK}+f!7EEKcux&q_|5S&z&1(1*#Hq1k^vM^yYVW}8weisOvJ zvJan^ml@S#&wM{9MCiRsdy~b57`wVsWLGTWh~3gCY~rO4?WA*}-d#yYC}pQAiWXB` zZf&l?)KiWn?{MRT#o*L993Vdeu1`cJw2s9Go`Dro<2}Je2QpIWM?p$q$|Q^&&mQ^3 z@kKGt6UzfLeLr~G@$-qS$`((rR3iQWjOaU5?{xTBBj}x}CC#OJ-j_h95wXInl=e2w zBn8JPP9=^a_Rp&81U$i8=e2ThCQ$cv;N9h~qG6y$F-9+g^vI8*l*X zYLYJ!lAea!ghm1p1qka!FyC4}1Wbcc)~LIHofn&+R=iPKl(MKJ7J)fMma~GL``AG^H|}3Q7<72!J~`c`US`^ zHHC8cEP---D^|quDe2m|(-3}S{@XZr9;T*HkDew_j&H>>v>(!0(78FRhbjNE-Q_-f zf9Uj=Xr%@T24L^z(n{Jmh3Qe*?q;x_&Y231g>&p2vv(X3R*+I~=3zKHc3^%H##tc~ z*3pa7rYY^tJ8cI?v^axOr1|_p5rab-%;C_k7+&%?(NigUSTidP$z$`&N#of5^>!N+ zRKA3b=!;5|6-09XzTQ&Qf|NhmfpDBb+ERq)EBxvnpF+2KBRO*BOb7cs@|5ma=U&u4 zEZsw%<5=tXlzAR2*14B{9(^B%b|3(sE)=AfpDPMS0`U5fq-sIRpY*(H$W&Lo&$0x1 zAUqw6)~6aGe`kB=$r;3f?PoNCjX>?Mk_UBH3^vlqlgTqcZD^@nX;`faa~5{B^4ARH z?-v-=-!CvaGBPnSF+99ya+1GY0N*cAyXR31x19rwUCw`9!gk@*W&XSPW0)z% z=pZkj@8rLH$XsbcA3UVSjn^_e(_L9_o)saS4XvaxlUqP9FI_<|mM@m6+*C~AY1Z87 za(*!%H$j@a-RUN>%ffm+n5N0XAjcp1_H*&y0}seB`RfA%>8h!6O=MoPcurB@8FKx~QnGky;Td2rpPj`m_3!& zBYtfqvv(=yrI_uy(^<^E!ksQ>_DaZKzs&wp#;mpqx2W$>xy|&b2yY zy>&i~Abo$qw$Z&>t~K4O$58Z+`O*tr2Zps9Er*@C<$zDjel3UhW%MrV@6$j_F;v}) z{R6m3%ONi!2(7SN;4{^*My@q}%{YqSQBQ(*tNjhJy_U9f^6DwmUVE=Xu$T+g;q9DI z=|%e=H%Tw{A!J*HO~X$~Z0Wzsh;|PMs_W2TQ>)mKMJUq+c7czp+Xz#uXTK7IJRkKp}<_%zosj!3anNq6f zT2sG96vgkPC%l&!wJIX@-abc?H8ncOX81d#INYY7ngzsJdu>*-Pen^*KQNO0kmE( z4c|~S<5p_;bIN%Y|AwXEFS^rN8veEJbh(D#0rl3ehW|O0cb961V}`8VpOca;SwEPD z;8%s+4xfs4ca?xexib;Px38Zs>T_N<0&~01ql`X(m(BNf*XIIXS1A;b?o3MY?&}%c zV_WR^LFM<-=QTwSZlykND(9v2`Gz~4rO#jKPM7O*^eObK&)=Exj+5NsHM;Vh)M4xK zXK>A+TItuPA^25chv75T<5tc!tnFBeBCEy=(*MzHsUCPeZ7Qngq(}?To+#nvHj}epUnuasgv8n*28^_kkfLl@vFyB z^m=;>?VgZ(L231}Bu*($;H|VILKxrqb_cyva2JHEf6LKpjF404rANq(`g#g?+w{f} z^|BxDiW0i_XEJ)1)?x7qT(2Q)a{CxjFLSIZT_u>%xTC(_!N@FWFO*^SZ5gxGT21t% zZX0H0jx}bLV2W8^4`F0>)0zEgh1qSUX93PM$0oB`FvYB|k8f>_J@m`zTU1VYZH7BOUd(P+IYn<}wpAG3&Frz8*4dt%x{p z*&Kse#;@>G1N@~f4e*VL*I%N0^F-Lp`ivoV=30>Jj-vSW_KVp)Td`kOS_Ngi3Jr=W6#@LS!caS# zIZnx~cdJdM9H_S4h_7EQj#=R4UZi`=jI;SMNo@LRh_H38&)Be>*eu5evUxD2WqrMD z6ZX8G2cQCbjagU`mCW#KD@WtDmGdfN5v+NdFLS4}#w^_9PM3Sx(BkXY`hA077G7rM zc#$d`FJzC~v-usaYTTRB5d5mJWAMrOb?06oxgY_>w67;FGR^Bmply4O%P{?;In$~3 z!MF9bVbU7BiAdCZxK>0zOgnO~Gwn)1G41P}i|sm+=`!uQ*AECIIB93^(@q`{R&Qq9+Vkwe6J#~9WY!ApopsIRV9P0Y%TWN6=%$Kw*j(gpfgk^EO-kmPDIB@m- zel3pIihf`JUmPXGYplpNDKkpwft>!MNoRdESK=X)?lnp%)zVt7b*S~IVt#k; z^YsnJwO%)!-ybpf&D!@N^XoHvKGW0!(k$05fb%$tU~hk)ZGS|6pX^sIlGiLLLbCwsX z>z&+~2%2NBF`KD1q2^jgSc{?P_4V*YTbQJ`j4gbhPH*<$44U44Y+=r5mTL#Tc@)L3 zufH$$$&vh)>67~*onPg78MYOl{+1m?fkAaI`Kxq>X1Lytr$-Oow zd9EXD#KmsC(Kx!^Y}T90VbgpyzwcGMcqR?OuL?T}pP60k%)O4ZI|;?LuP1PiJ*O$Q z^(5D2H1umMuBVo|^>c}+`Eb2}Psa?vCdU#@iU9suVe{~9GM(n!O>-7WaqR2;+iUCR zxSF=)cn8!?zxw%Jh2zlZ9)%qi2Y+Sasgyi`ajc4?nNS@s#V1iwciXz<8 zD>xBH;q%%l>d7e6EBAv6;Zw~EqOw!16mqW|j$gq|l6|8H;GgLz{IoY?u4CrhWZH_S zX!iB;#kU{ux+tQ#jK01{(%ifY#^FyjYqJ{(tdy7RZ`G374Lo7URQtUBAlKLK5-`v% zNJQ{G>FWiYuQ%)*3Lu}-@abON!zxLt8Yl#y3Fbu-=FiHHW`mJ z8yDud6`9lo;xJMvY{s9D8Gudpis0y^Y^yMw>npOFw24yCIj0g*to!;Mqko21kT9<7 znObH1GZ!W6@aiGO9Dy^1ti${9&&=vMH<&geDUN;pjIlq2iiAVWom@ zax__Ob<^Q^*xMH}%UAQ#QgwB)|J<2-ooIIwifdoLW1LA#a*dvdez|@H!8M*NWUjqt z(x#nwHnc`BpDO{yw6CWzt}9M5U1nXGmk%79UxaBK-BvqEyYzzQ*k@gFBgd&m){B8y zRc803uP-sKgS6?qzD)4C+B%mUtDbJ)lHx)0iYx2jCfk13iU9tZu7iYVDmhkwRYM64 zyVut{7&R;}_o7x^84deVgIGL4$d-b)hRxZ`tOE^WMrqi+zFxm^d!@PP6Olb`WoA*` zEqTTD2u{O#1gK<#X7(wV0obIL9T5Tiv%;_q$E^ZnR_5AJv`Pe}YkmEByY2P6;wp)f zU3@b3+d{iwvl}$Gc>m%ixy{zmz|abthEI!IQ{86R(i+#-hZkr5VbK?kvnb<*-au+^ zZdXrZP2u`4*bv(e@5*uII@h^&fshu1ua7RyyC(T9V=myhTd~X@AP`TQ9GQR=Y0yZ8=?0qc+zX-I#<4S z3}x~9`r2Y^ZPV#pchHL`30e1gw$=o;clHD?`wXVf(*xY)p5Nqn!HV`Z0VXx@gs(p>TD&B`W!h{1#=$S1BxDWjYw_xk7Sc+4&K zzF?BwGQQw7&Mx%uuCJwiykT?e=?lg_?JURAWKaVMTVcZ2pEhQ%7<3Ujih9kDJ1IJo zwtRlvY301ij7@8G`i485wL1Mdce)7`i)E>2fZ$0Wo>M^B;xAHv-cPQtjNL_KKvq&v?6I4#>Wl$6SdVZS& zi`~}ROmcdCIcQ4pE!wzAO0zXnFtozZ3n6nVl&SKcqSMnuwrAhIVX>XMw06&<@w6<` zDaR$0p>q}JOxBK^OWL74@8$IhUpHFUj1BQmmCnopz=#UNnQR%8X?|T!+e>TJYPT~o zvU|eQ@3m*2J+m@0DVfA4N52}gA(&k6@|p`_^*_!ezh0Wj>`4z9119k)uP_PwyO7L@ z^z>y#Es3RDJPxLemORUeoNIPlA!$i*y)==OmgM`pkd#`|*GCn5OGzfn^!MKdOv0-Y zmlk2&GFWADCRu7clanHqHzhzsCcr+WLV>=Ci|dbEp9DeaD}Y!`*F z!c9Hp_h|L}A(%tbzOcWwc3~TgEfoA3xmNi#qo|gXueU0$i9qV#GHW8NxcC(Vw1U>b zK5HU47{;6zQp_U>j`#R_t@hX}jm5RsWoxUZA>IVVWw(G<(R zUaa`0mrd8nXNp*cGlgsy`@HF;fMptGvd3YMuYW6!<|0Wh)4EICBnM5g&uA_u#T3Id z!M=X4ID3I4xXfsnnv3AT^{~(E1qZ>!{L=J#`o$*Vib^ECWmZ&LO6e6{6KUt#;##s) zuQu>xAzKqZD=GDsbdK*#Ii63N%iWckdZ*gyB&)FGUEm!1_p;eJS3!2f zQY8EO@ZvmQlH@BOw%?IvccdgAtaes}ZVFoy`^@tdEjuO0D!OVg!R)xNzb>vbN-~S% z0sCe4`xIsm)VIevqmo&XV-wjllp@yGD;MXMZ91{H8^q!XLbi9aF_Us8#5KIk#7BkQ z06%nMwZoJQOcGG!1q3}A-E!nVn?N7ss9Ge<84W)?n^^!#myXnLpH;CO{8W!2K zG^_}uc=h#$#d(+{uVqHn+^X;j?|I(eYIc)mH*78IKMxbF0wvd`s#T*Xe!YEQ_WCsO z%_MUEPZ^8$n8NS=MynIL7q>qPLFCxPHVq|+-RYxBfKR-?(@1FGXR_Hr5)z~#YcsW!w)65sfv}^r$&eG_V$3; zD~d!*Rx(;fvn~uQCf&uAYCEanf_9B6EGH5&r(T-X%5jRT9ZqRhZy%Vwl5M2+;Zb|U zqBd;p>gBgJ=*-LkE0|)|+Y4s*8ANM9GFxW#<-^GA!tCy`N5K0apO8NLr8Tfqvj!&7 z8c=haD_B_oq($KC{fe`AdAS#PYs<{yJ*0Aapw&K9U0X|P*k{Q*41%@}yk_xAZq3|V z6k7=>-RtWgi|aL!OqW@&X}*x@uieP_|vOR`+X_wZts z^c}5_mdwqRn@vS2yuVw7sTXbH7wjc0*#ZB71_FG33yH~E5prT4@ z)-hin*{HpSer%!17FwD9+Bua}sO6CR!SGJSO_I7p1n|!an}BbHRNEM!DfRV*MO&7a zcTxMSj4gW*DLtHQbZ1U4u6_j}G z6!nOe(YY@|diSq)x~p_bemt?k##=Vg< zi*wF5x(60+%^GAu+X|iFRjEoqMw| zY!!^dIqy);%VfGeSvtJFNl3HePB*Tmy9v^?-RW>B9^bGW`t3cqJ|z_o5Qat-cNWhu zuTjxskhR3*c*Sgdg2>r(;Y;Px>F&C;R;_kBBO|*(`275J^(Y zj6s}GNYzzN*jmD+E@*xZL*bZtaHkFsW#R{ zcRH($^;&nj+@jqHocG(t+B0x8>9p3{OGz776~?6yV5)Q$c55erS1^Rp_Hx?|*tWt= zw!P*>0ROD8Q}CVTwy*>Q+P#xejQje;_S!wPk#X5Wy94U0U&hCKF%HKJnQ^@Dag&VS zA_Dklh1~()J>X6IA9|*u2>11yMSFzTi%{lvzeE{(WVa;zKs!lLlZ$0-;7lQt?PHJR z%o;g2l(rd5k?iYDi|<6=bdtvulIzV{R=M~hsGv#qc_(_7+4cb~=O)N{B*n3>mn~}K zP3L&j&GELFrRL-qa!!DZu@uRkUbu-kON}JC%q+DLH_1V3W1m@SPKqgpX@Y&dc9Zss zy0QHy+ka*HI9@0Tp55rSt4rOiZV$9utJvic_PWs7I!&_ucbIDd@lj!?;YXI^c3}w^ z+POF#rKf#8ev@`D$Ai!y>eZ9Cru2YqWl!GS%6X}tJRD1hoA}Dxc2-Z`{qA&mPaf82 zzr7s0dQ#4fkD>^Lgp2Jsk^a2!2&q4L*C3ZW|&6sQ0o-d_9G+*P7RnaZlu|m(l3| zsweAVw-)>AwJyNdG*t?dQTp81$2eiXVdVj+@Lu|SMbU#>sm}{Wt68Jpa0DN22D_F% zzsH>}XS~c>)z>MEH`iB_cD0*ix-IngVh{6DRrUCE8iHRHb{sylytZfU+?%$FBSkUQ zWBYvljT5$&5~-H9_%PH`zgEh35mcjn5^`_#)leR|NjrQ-1n|!aI|<*#R6Fbv6KmQc z8QbUUV~lSW;5A}s^@pXcuO+y~lZDK+&zl8`xwh;OlWMBpWNe?WS24~dC7HewV*AzA zFW^kKyVygrm@M(>BB5IzK66QtWi!{(;;>>UOT*WbIBt(@x);<_FZ=nFVs~z({d|{l zUaCK&>rQ9c&#!Q&%QbQtdarTN8@eWb3ctry3u7b=5jjJ9!=_i!z&gCN=JoX+Ms|4} z2!!)KzlX){^O4>9-N}5l(@iyR@E&kacFkPpir0#u^scYJFs@WZvU>%@_G>jf&t^Ah z>ldFrxXD)CE)l>#D-3%sth-gJTpe3ljNC%SI_Q_k=Kztbt#e8K zVr@7^7-V8e4B-cCl1!gfPmCOAplZcHYEWNqTAW*&*N)P=kn>t*Zs`u4*PvO=bf(mz z*$5ykwhFr*J~dWzovNTpYSu|#57}Ig$!C2T&3bi8s(cek*qRmFkhn=&uN49O zv%+qKZ$Ycfv8q~?P@=^@>FfK7Zvo)tUesGvW`yu?O6*jlA(xv7{EclsZvhb08o5@{ zHKQngz5QIa#=RFRGkOYyQo-Juer?%jbAG#g+T48obi3NVuuXbfS6fD|CB0?@#jdZH zEB3aMy0=Vk>$7ZjgSKt`dRq-{75i4hmbP)Df6GPVmiT6$nNrIq%G2SxwtMB$#t0()}A7{K2$xMEH*7crQWKXM$@64M@LaRr4VqlPkvu86 zJhz6@6=9UF_4Uo|wRLS=cS`D7Y_0d(#=An2dULyaIyLvQ-V2=V9=1LF9DZ-B?Yx6& zh{)OP@RixPZFdP6I2R)DMpmwe3h+S=b@>bSDA@n zt&_IlPG^lJdZjyE?%Brm{`|Yw4?b zX{lB;F>=E}t!Z{RlTcjydIsYgqe-sIjBCD3;kuDjo9k;~v+VQ6=-htZpXS(9%vmtS ztgkO{kL_WJZ9nN@Dbx1*4u#p3YI8Zkr7EYZ!N0ZinU)^DAq~N=3R{3r$*z%elVLNO zV%gVQ7~dGi>ti!pewP-p%xj#n$H2E(x8$+#YmlG+QO2)b-DIQ7W5n7fgKSr=+O4J` z*nWhN(=hZu-S8+7QpZF)_hKNPArImGJlOw`hwvU9an^J%-gon8o(4V~E34prjhpPp zxLySC&kDnL)fBL7nG+hyWFN+auU|0s$nkn8BDsuKeyk*Us#ZIkoKLG4Jl{e0Vf57_ zXXV^b%XU1amwml~WA+@Bi%_+_`j=0N>fiGI<;a+&c) zj{%yijrwwPVK#X0-xE^JD|PYCGz7mYY!W`T+-A@!1whRxneg@QjoN;Y$f>l2aTUjY zd)ywaa>{EnT$=&!Q`{t{J468gtT4Qx6;5+IA;*-q4ScpK2oL8|btLd0Oh!o_tA*a|}%R2Z6Ke~QIDzMikR<}Vg5uLXtK zoW(LLQw{=)oo=!)doZciU`9S3KMXC2SDNWW$)(SlzebKTOtoSldG+;Z#hF4_Nrk+Y zX}MQ)UV~;edwxqDYOndLv6^dC1y$1S+~e!VifjIoq?XaF0|R1`{E2qGn=Dq(Byfh1 zHR~0;gjD}K#EsipH$>^(|P?iJA^HJXkfrvQqAz^UV8DW=Q!on2&8z8UMClaR=fY7 z!|U`<8n0nn13q3S_3lhfS3QX0)Yt12-x2KMIqws=5@P%9pZZ7O^lSnP-DfWdK6+vn zI|f3wUU6L&++t4}q^YD!ylxmw%BJTZZ0mIqDHl5;DC{ z;iaU~JCcTooXxeGqO?c@(15aPoM4Tzc>!66;GBd^g9~1AYs8^edNmssjMbvV* zzJH&YVg)%D3b-hevLHM?ToZA$Ajxr=(SqNU9E%s~C@6=lhkZs1=BQdZH&C|Y37W@! zePnS)!lu*w50d7aldh=W3vO2bEVfgZ*6zXa z=#0hH*X4*p)JFZb?f$-qWj+ozY@VOZ2~n-&o6->cs<315S->;qo+O$lpqTdcv_)%! z*GZApT*lh?yW(06T0i$?ZRiRZI>US5Ott~XeZ6pT&KOB^nKs}zifHCKEZjDr&z!LW z?M$;wlkDrCi+Y(Pxr|=^zmnwH=K88;IEQRE_obJuoEv)Cj;E{)U+-OP1#UXcUoWIN zY^%AiR-i$vshF*3isk6xb1`apqF*6Q<-$>vWqc(6hs`I=?jY)!#D2h;fwD*bWxuBr*TwazkL{gYttKaI}h(*+@x=Mmk8jW z6*dju7P*<~HMym&VPD@~^h@)yFY2WzqjUd;&2<)LcaPz6Hpi=tdhHR=EaOUI($`U@C+)9++FRCF z*KTgro6E;qvm43MdRG{_LDTCqnxY`*ndWsC3uW)__Vw9~+djK{;W654zVIofm9v%e zh3`_%tIVmi<_mY->H2Q1VJoFyd-tnOj>GPCcp863sWxw3ln_&4_|_p8!?_Z+2_`My z-M;?0QF}$liyr)Lm(`ZatYY(5P?Ko&&dkr_Fyf$f@8y^Q*koI6nEw|a6^0Zmxy|%# zo_$is`g+~s8aBMRg-W*PzLifOWDZv9-sm2BYSdwo{Rw{o2F zY8C{^thX=BUdi^=9&M}JmA3a*_6?j-&P(+Tthv+W4O(0y>?TNaw>w?#3oEl`!~Zgw z4cscg`xZCZzOq*tF__J)SRGl~mi6_6#ohp38vZI zmAW+xpe$Bje^<0vNk+?9tY4Chaxd*8-eS!dmGdA_$#P12&3qX1^>D@Y!AVZb=+eJX zIfbK#%qiZdxXCB~4iUgV#roh1l*&^-#gu&FkNNtqV&5t+@1iGunZDI8N=kz!)T?hb zQ=2BAG@ZWQskovjNoSd7{htdu=jT(KEMy&uElAv?4z*VlK8Op!+zR(^`oLLO{rAXX&yvz>g%nFGi69l%gp=wGd8!n)@s9|jE7q1 zk|XW_YE9JbG4#l8Bdu)ZT-VBWG-YA1qe&+u)$@kXatan-MnI zt2QkH_-BP3hwsc*cI93N+L?l&deqmy7FWyT^-=5~gsr2mMpX=( z?DN2P3}st|orIrGqO;r+Q0GY~u6;d)vDbrF%4XUgzo*vhd~2!NP#&#twvcU)K6^dP z+*?#z2`Hw0J%-Vq-gKrvqcWX4TA+)X+a6&vJ)zzduZROsA+D<`H?dv^^76?f- z)?&XF$bT=QdahYZHo~U5PYXn4R^*<}cN ztrgF3W;SkyWns-~zTcfLpVfQ~9HU>ZKkeiitdJw^8jdAByuNxmX@|}C3wY_OTKiZU zf?pN30-uV7o%3y#LNVudQiAspZ$D%7o?{Ie_eIWo89(EHE2`;jY@GnSJohBtA_YaY zuctAtT7^&-Qhg=F^{d4{rBa=m+M$mH@mjSi9oGb2#yr;+#WIGX*W0&f>*P0pg6d_1 zG?ZueR@xxvl=D(6t6X%avuu#py3^%4c}EF)|Eq)E1MSu-pC*{#sOhlnkLO?pV3R$3 zxaMlMRoLzDQ?Wl%UbPY^f?7{R@$KtjjJ|VTF#>aY9hPB;?N>YhE?v7p_wwQWj+VzvCbqPZDy!^;38$sYH*YAtGn!ow2obA;#p0 zrV(GC;<#;f+zS=i%j!6#Jgv9V>Ih-2_fHzN$or`RAIXF>d~lQ6I5*57w8CzIPo3Q? z*DeDikE67&ulF#v`mka)wbl1uTy+WO2wD5~-|9>Im+!2vuHETio7TU+e!@69nxwbP z2&GS`^uj=eq&CxN>~F0%yI~XD=jdoX=aw2aqA5-6>m7_NZ#v8W*&aPmkc<5qqTnLmqaq`i`Nkw2KSgFl%`P(YD7;eC53mR&U(v-RW|p?^-xUzr7W| zt+8x40+s$IyuOevjqkz?z$R^F9BG$r71n^Ciai0`YA#W=By7^D#Kqi??u(v5UID$h zzo!THWjuqwMb$Q3RmiLl^HNn=pH4&Y%bEvZvTk>7*eNKgeLaJ*@0r(%L4U5zhat9K zZT@kCYINhOsw-rwckt3usV4iLfmt*6F2!x7p~&|28pd}ul4N76zhAQdlY?yNz6)AU zd%des`n*%3A=gD9V-&@&uU9boPDp;s_)b3N;1^F4vPSOHcarj3NH5KpV7!=oaAe^%HT_|Dpg zR4M4HnM_G(YF|&`UfWX`$0teJ(Pr$I_K#}y48s$qFPNYQt+o3ZpM?B6O2CHPm5Aco z*N+(Iws8HknQg@XsPS#9@sKT&t9fauTD*96EwXLp-X_~lLUHZuVT^j4NPf%ofcys+zi^h2?G3z-ag(jaF%iH&D-3(6vsR-5snG?Z#SrvP`uYoZk6SA& z#rFZrR^b&;EB&?#|Giz0L6eJjFm96ET_S*gR@gLrTjUmTOZMDN`uYRosApdGMQyz@ zHp7Qy9d^3))oM4XE!OW2drh!@Mm^7Jxi*XjJ&w}5-hMy3H|}1j&NyygsFpGW|GFf& zxxOmKM^?MlpmlFw1Z%lA2-f2$f_*)I(Q+Vla2dXqp(2*y zSRwa5;C+poY{OkI0{CZz9ft3$4QIe=wB)Q+6?`9u8hBo2h?)$w4m;iwK$Ce)X?l6mwm~ zFOQ=L_V&@)p5^G_ke=l-7R39V1cz-0_cN|X>R+c3oWV`{nD=^n=ASXJ(V+w^04k?E3oVqL+iT9?Ez*-Y40u)ea};<=m#Q`R!*_BJio}IX8?5 zE1I$+d_8v2&rGsh#?Sm-gJoD>D`*|ukDpmEj5&6}%fl&ZeSLG0+D)hS7Y%B+)9466 zE#}xoEf1%t_4UKWUI&ueGHteBU=Ky1&JuW zef@HAmNUusa0$MDp5#01*4@>-v{dhgJl5fAP<`2!^{PWP*MC%|hL3 zlxm9Dh@t59_0~<=-j29Bkfe7fP}i^B{4PQ7QE2a-OO7Tru$-4r1$W>*qM|7nHp$P$ z2NrB{o632qH%)H1(^(_iUg=Jkk8CUB z-Ft`1F^pb>&!&@`YxpJ<;?2M;q_VorvUka(2cR*~v_VUjdH0ux4ZRAVIskTbMg|?lD z;@j6(7=0-u-@_&NejCYm*w)9@ytGtXy1) z%kt&|#_>cU_knnOSuAK(TiOvxaqR6ajD2~?*Jk$R{gleF-lh+lWADB^fvS;nOF5hI z6wSUq!%2H|QXJp$@WyvMBxs(gcZyAqkhL?u{|z_kJH%DuvaP~S!%yyQAxl7^n@&ej z?(Ivo*BpqRaY=a@+v6vT>KJN2WV(G;L@c0NH9l;n$uS;#d_9R1Hpvgbqqx@?j}`H_ z-tsXXZRNbw7>}2^(^+FY{yE;`{w9rN;~^V3&CgENveeZ#r6KrLVaMQ8rP;{6t)$Ha zly>&@Cyv=;OfPyceNtg&E5|LJR?bT?-EgO~m_FxDmyh&#Jl0W~25U`h!yozfbMe;$ z52OLw*H5s6^;$BMoL*mEPTFB>dEJn^LP50QFAmJ-&Xy-L|b9 z--#owh%2xj`sDOMcCgx60pH0|(w*I^> zfF$WHv+lqfCA|mg4Se_d*`#(NY_03FR$PA1s<}4s)uIT?cHGym7qu_RZyD|TV=jK- zEFt$f^rd|zq*;GMrkB+iie6uj-9Edo;X!zi_Uda`OKm{>+RAp>-O72Xb{X32xQVaa zCa~IN_q)^O?Xqj&82#D~Z^-C{kp}5<8FRH0EA^$7{p|$bt#@d>n*_f0?6tgf)&Ak* zX$XE**j@0MYU3WIpsD9xX({4;eS7=t7G5M?w(!aj|D#@Y9k%{{LCUvm^puNB?cV8vgZ4O=H85D|Au$U}cBRxmRzputor0 zEBB^4w-Zo0+}qa|$7djCMNF3&<@~y0rh~S-y~bx0@oXt;17})8`}+Ih%8LkdAAZo5nrL4tK`qs%sgb$@HU*@gQiWSR8K_lC_H;Hznps4os z5k{(ctrWHQ%20h@R_q8 z8f?2#o#nom>O2KSwXa7puB<^)Jq)q^_BX%Qq8f*Eq_r0KxQ?rNX{i>7V`U9tPv@Fg z%e@K zsb7Wld@O0N)|*v)C(ul_TSX2+wmLjDwVCT2W-Efy)V^NBIG3BN7h!DVb6|2S;|hrF zS5v=|vpYKt%|OoX1lTqqbL%sg8}C*v$C6q-m|%9y*C#k;k8FCSboY#k*+S-4}qe!boH4A`h~rN%8|CHz}nmn+bW zs~tI)v>Vk6VUN5=D<3yW?=BI*KPzk+zL8!%$C6wloYK3#e!FPf^0MDd+x8V!9foZu zc-poawbD{Bf+=Qw{d2qRzJ#c0rKT-o+rAu`6)xt*ZoA%GhPxtU+ZLZTxJgZ$tu%n4 z6?P+hnmNw(tX2-BZQ$#Bi`Fd``=(mAFT?uFmc`g!)~zGgIlHbnO6U4|+M=C65?sc* zeJLkc>-q^==X%-+3tEmPxOyJTlZZ&GtAcE6TUw>H~^GkACM)#gqIYpIwsJgb6 z)NtiV{*vmD?S^4qT5A6S_T6TinD4A`Yvta;*iJ!F?dw&GZ}H_-Qq;R!W>&_zVyc6- zgz*l?P4<{!A6d3l7>+V4Bw96!caNc3)_Eq^w;J{Ju*LQquZ|*`%e3d#)jFMp#bjX% zSucCH=LDsgV@nnDKuY`i`qswm6=E+!<@Fk!9^X}i6uRG4)75zmnpM1Cag!Q1ds`lc zR@n9Msc2lVnH;Fnn$_2%HfoO+i=;}A+T)-m`W@leQR|M^Cu5I+?;#Mz9t$$ae?7|h zwF}nt?(!JnFBxRJYU#jU2u0ltA*VZhP6j5!qd-U<6YboKA$W#7WDkZQVR^_nhKRGK zd+{MOkLGDGPF$flJD!g*Y^CBRN!=j=_-BRT0TfbgPH9Sgy=c+z%gcK+pZ{&Fw?l_c zW|JcjtB{}no_=2~$GKM3Ln#Zu*J~Envm}Wvvm)!iL1J%NUtOC?I^A^U19m5bOs&s) zmd;$~=-LHBjawM?^`OOBJ0!n2p08iKV9miVo+M;`J!kD0kV-SbilB6_uQx5~UXtB1 zy0?Yw9$0U3SK30g4NGCe^x&}B_0+v~u5;b%h@$xQ^_)e1H=W<6;J4A(-)dqr3p*;e ziS2M;-ORPZuN6h`JL2n6i+u_tzh(LqR*~P?je2)~tCj?AGkEqXZwF=qN^&E3kl=~dw!UPo4zJ9Xk^(C1u6>z3&&t0SjrTMgDD%bIIJ_myG43vSYvHYNi2XN4VrZ&$8!Y_0O3 zdU{8^eQWkug*c~DYS}XLdsdWs%+L+lR`8tPqxY?t*ro+RGVAMIi{rt#&e%+U@Up=y zo*-mqJ;#G7%u26>7D!nL-rh7@$Hq1Aq>e3PA)G;8#ml0ynXfe*#27NOo)&_Y>s-~^ zF%-St{xrKC7U_L>^d=5^L)W;TzF>n*9ebJ`sBauhs6E)Js4U}T@KZ!E6TNU~d|pQ~!K8#K3g|KcWlXzf)REpAf-))7u=Twfnp91F&4 zq)6kI8OwMIshw`O&L&Mboog2esdb}o%*7=dVSK~+UN-@> z{~Yh>xzoijoG)a4eR{qe{7T(x;!Djt8`Z<*eMJAmG%T+}&eYJEl^ zXt~X_tx^D_mi6_A#Syn8r)ByMzE9;eaP8_d;#T1_*QzDTQ1trxyJ8P5!n>*T-sYee&k=Ha%ddylq*pZzG^|PcVA9hAwrAhoVX>XMv~~}! zO2XL7Kn?X;HR+g8RlLr(@}0hSDCec#>AT`iXZ01d-RUNHLBI!=L%(y*U&7hti!KJj zE83yrdewDkvXyCM&urHA!qTa*=fbDdtgyeUS#@cxTJ3g5Mn)z*{at(Zjao!*KrQtm zazUxdtt9d`<-8P;HFr9T$fi48P9*kn^-JVQPGl(B6KO=kaKpktoiEo(k~C)CS&Xf) z=fJ0=u?LHu{;Q}Rv22T<>}9m$31G3&2unL=*GuzQtR4COw089LO-1cU6In((9_K`c zqa7O!Q3f=P#o7_}r&;v%GsP9+ctwZ@w*97N9Ou^WlloRRyU}e|m%8a26hd#YUy-6J zpW4@E@WQuvGnkoU@f5d0iI)1Lw{OW_c{9$tlH>i#5PQrZ7OOYpR=Up|7M;!1>@))@ zUVVK`QNwa=v6&inG2=CV$8FfW_Mu_(9BUd@hEl}(`kUe`!A&Rjs6p&D(y%F;x`xdI zDPDa&PZPF9@BpZrUcF6f|Ke8mHWl<&@^zS z{o1hKgS;lq4!i*DP_p|QSPZ-%XHuf{@!P1>_FB7lEZ*h%;%bDyi; z;sSCt&hlPVU!T;ZJ%8{GP}jYZxC@7Yb^2 zs?iW=!*bpsTfW$zkDFwBUIg&Z3OfbgZnl*Yp!imk5xRS?r|)WFuRVJ!GA>(lJD|S$ zW&DU$!*d-0_dICug!jvb%s6@paFdK56aoCR!fuCelX0U2+=QEnD84;CVH108+a&V+ z@c2GlSi7^$>gfgtJY>G{xrUqM`xX(vKP&7G_%7l*D*+ntJQYQ_r+;l?uWhA7>st~& z47Js-20vugFRa-iRQO!;Oe<&$1)pfRNxE_Uu57EY+u)~3x1M`9+eR9SY)?PkL~K{` zY7u6*?Hd_}*nY{Lx9V2tqV3wQ)N=0zTTeo9?d$W4?MjmCGVRJ27jUgKmx9*X&*dei zYVF?bN&&7?0uO-E7g>w}Ez zH}D!Nvc1c!-*6D>c&*ij_fIV*-MLk8>foCEVfT0Ytl!|wbq2GeKq%kMUSFT&9=l)r zKB&xIz8iIf`BwUF3P!A3K1m$KkDI}z<-2*MJ6-O(Df32&n{$4#A6wMwF|5HM4yV(xMkk4Hj{IT>z~)a4=(i3 z{?>Z4%WF4Wtvd|YkDKInS_JUV3Of$pnbvjXUdPy(f}+~jQ#fu@eJ`k@UN-S5#g^Pk zoA@r}ywrH6t~;G&6ZcxvtW2A3e_pS%@NW0jYB#AZ*6&V&?rTPS3O7k}{(yqe3PW#r zMzfx4ons@8BG}g>7{~Hs#h9(Xyn4#aJ(Af}$!LMw# zl(2EL9P8ZXp%k&czP@Nl@X{A5+V)|Wu_UH)VyD;Z4Yea;b|dt;e#5-9RC%EIs2g!07tK-I;W$3&(oSZ+>uGO1WScC;l$-wpVFfT1XtHYIh z-Rf|rpft3vPcQnUNvg~AUwpSgb%t}u)mdQSYa2%XauQtFrcp_-BvF(hTB>P4Yz&|VOD17T0T+O+QX)T_j+1E=L zd-8Z)6zS_ScJ^dporbNay?XLAJuPX?dh!aRDVBZxhtc*RSuSIH>@`@1wX(Th7It^N zxeRCAUbcr_0xmu6NJSCu>r0F?1xdn(A+}%ZdLkwKK=o{LsNU%S(=*9h(yS%TrFzl{ znr^(~ag+9kWBmfIl8bV$vR#;lBHP!a7LERw)y5I&cem}-+aR_9Q-c9wumw>ufdxUVNNS|%jp zWh|4iUW^B>yZw8#g=%)dt96(VsR+Wyef^VhgepmR8OvleBYY)UI=k3yuP=3{8ujJo zYQiUQZ5PYLm3vKhI}=b$`}!f{$}=R>Wh|4Clxc9U>!$X6YxxlP+hLK8pt<&1d4^ji zR0*hflj$hReSMLm_IjrAZK|?Oc^TXT{q_gG5GcomI;Iy+22Jzh`2DZi*_k&IBPwhR zK4nfbYO|bEV?oA!eT#7g16~J3eR^e9FxbUr)>qe#Cd)AFqZ4>b&}Rh$Ew=(vJ&4kx zzJ9~_4k41$GBaiWmCC7@Y8bRO^?6I10w(6zqLl|yy!v_p$Lv)VFM^WkHJywI4eUj2LPyOdAl%mNNvM%-Q zof1sy2C5Q9ksAF|E&{itA9bfjYS>SGU;k7_rSjO9K@_LH{;5%WEtJ@c`tW*DpQCV! zH%rJG^>Ti99s>*!tAlHchEipZa+a#i_4PD%z$lo*&k8|Je$sc<^mun{p^EN@?3P`k`FxZHX>@ z7Q=V0b~?!_43(bU2%1r^9w{xisdcJ{5!!St`k^+3)H1E8XR4$Iu1&pKQIg6`ovI-e zrQUw1*dK*BZ)RKn8JyB|+DYJ)di6&ElWA_HGR*=gMt!|dyX`U3xL$3qG19jyW01FU zjPx1hywn(JbxmL;o%PHwSi?8BORoUN`W<=tbT*T8t4k|0$?5gw<)jUd{h*)wPsW=V zHaYtAIuXD>E9@rtwsM@(Y8C`FUuw+TA7zi0j?Bt_{xakHt}<#6t2X5Jl-E2I4bIF6 zFajwZ>+6>qw`ZT;>!D*$DY|Yeb?jEZBlAjNtzRAcG~g9i>zc22x{JvYuI`Lo|3NeR z6wCl@QqPWv0RCBFGw|)mb*5>p;vjXcufHn3ABC5`xD{=GRhjprJk_p6>>>}EU7z=( zSnMi}0rO_&QIziW^<<6P_HER?(pD&=d!ORs7w(df?FGD#ag(}tOa$=H3d8k49sK4- zgQ0xE+oQ;T{~ZGC;WvS{3SkN>s_C<@&&z)oU4|vE1I$&e0^eZ(Z)72mQab?8-4JN^0=9?$l#x7)A) z@$AM@vWBjO!|SW3lQ!0L$bDQ-#|*$GX`K`S{IkO5;kzK`LbVn}QnrAvk1Vb&#A~6b z&!EhVgUi|e*4l+5=aP1#iW6f(X4hvNx0c(KShWC1YrxkZ7Uyq~oR+a!AE$B(M-Q1( zADdO-G_?t|5K5c+dcF48euHQgJUpx5JAu+B=+f@-sc!2)y^$O_bEcDkjSx7o*c*+T zvG;e)Z`kQ=m-k0xg81)Yo?w*NG>!X_V>mQ3xeo~W`dGZe;qlc68kCfTCUQd2K$GJjPi-COd z`+C9RDjg)RW#)lZbY6pR`}?fYq1~Z!_N^UE*#W+Ouif^l2XXGAv;)fM*a4GSxGO?# zUEzI;oAlaVD+2guh203>2At9$kV>}4Y}*mjzco5MEZ7vEqaz~|6JWGX#8r=Zxfl7j c%Ji-p^%pd)c*o)-MtI_IW)oH)}f2QF%82|tP literal 0 HcmV?d00001 diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/TitanEngine/TitanEngine_x64.lib b/BranchTrace-x64plugin-wtl/pluginsdk/TitanEngine/TitanEngine_x64.lib new file mode 100644 index 0000000000000000000000000000000000000000..ab454f92fbeb34918d7f3ef31fd091632f467ee1 GIT binary patch literal 102254 zcmeHwdz_s`dH+m6#E2LHF(P6_2p18OkP9GUZX2?&N!HCKK|sRE?wjl(yJy$4XEz%} zKtx1DN-3q3Qc5YMXf36dQfeus_E$uuN)Zv!dMj0mNU0)PMErf9xxI5gdD(-1bw8hH z-!sqi%zWqm&O7tW%v(>aH3x=Hnt99|_iz59V;9VuKX1|T$GQA@%DG_Sk_8LJ@3Utz zw%Z6}|8yr~|NIPN|8gW_kFJ#TjVl-yI)<^a%8czJ87%{;sE)pp(vI9K?Qnv7%@3e3tQb3l!ag z=Piu=Prssj@dQ0}v!oyI2Yt}}NEgu;5EjwD4k~&O&j%Urxn9zmnT!*?bG4$o@w}U{ z&(D)||Ahz#^!Xbk-M=^7do#YaN6|fag3i81Qf*JhiP%AkuEg_7#vXiJ(nCubBl@?E zioS>^=vR+PdSH?1;)p;dvS3^Cl(D|19G~3+5_9zAgaG`>v$<$akV+ zfJ-zFc}>(fSJI}N7$-UwJfck}2x4Eoh6(!S9jKq62bmzg;VCBQ)H@j`I`c|J$m=sf zJx58}csk=C_La*8@eM8bYcck-dnG+Lk1;_=+jGD_ZI+@7@g(|*AoitwP>!H4pCpKH zyOjxAd^Pe3v}6xSwI84!fwr6`h&|ju`y-kmh@W@^lQa)cVE;GDThIbLK~JMj2|~Sp zdJtuVGA26d0ZD7Vk9tppd;_tc?=OhYKsrI}7vO>Td$$T=KSlim@%J?Zu`l0=_=CQJ zvIX&xlO#2eZlW6e5}kp(AUbolq#0jE_+LiepCjoD_oID+9zvNAef1DYKff69Ap$PZ zuWys|zi7*X9>Np!Jo*|CU$j`#!h2CqLGOK3(gpYpV!u945Wnz5CWy~q9K^l|zMz}& zycu<7Qqt-7Fi!M_vn1`0dP4Mu2PM7vVaACL0=A&f;t6^)^ob5ZdWqh4gQU0I&N$H= zvFYrIUM*=q zq?2gh10=oXKE{dmK1tGRkWQl4o}lP6c!Ku6SJM873(@PR6g`LMbBw*XQPF*PB0LVc zAf$tX_WG8jiyvm3Xw^-UmII4uDe{eI#a)tCqTUGl6rP~2xr%Pa6SV4JNhi-@T+k(W zf|lPcX$9g>v<&$#=s`R|C%-6Z^?8g7dLGZ`8T&!6q{p9TjOd5AOZqODZxd-ek#)O(GjKE#P= z{Y8pq;tBfjEJcXphe3OtBk4oeF-~+5!W0Coi$GJCN}5EtL{pFxorg3LoxfVr1$YvD z;5kVjM13GS4|z}Y!G|PGT#xjFCTC09xhLa-P^Wf+&c8>}xfe1{^nocw3{TLxdq~=` zH{*h?!V@&`8A*dE7owu62yrYxgU}%=W=I-15&EDl4@erimT{u`UW$-!bDA9M zPPFGiicp4og7#P->6N!Y548I|ik9OEdc|>y?!XiDYNSKZg?NH?13u9nw@G>x>Vlw) z@dV9eiY~zubPC!L(WwZVs2lMmI^|4B-6$6jd*%s6Xt&Q0VGKj`?4y!?)`Rg3==-w- z@eA+5`|>WvzH@-2Z(qk4(Z3(4=z2Us-#$pvx9}8nBc7li;eAf@B;Kz?Pu!|#E}o$O zf?E*%20f+dN6;mD5^kdJ&Q^34o}llceF@qNPtbR+mGmse6(GJ5^#sIz@dH8pjH56P z0qutR0AkPIEr^fYig63*Lq|%wVn4gJWp`j@el z6C-22&C!8kd>kRvN5(eW9P9U{P`t_Z-8B^|fMx+RF za#983Fis`_xD0@KA35rixqYD}`K-WXgrSu}@hx|-P>>$eWXVX1h! z0eDQ;se|#k%Lct@Sd8+g_HA=kjE?PeBVco^-`cao>O%{gEL{IC&vEH6Jm#9(_F~!a zur8dwOxXL1!m9@X+h^z?L;lI}5CgW)&>@EWmBnz;iljW`2OJ$}L=dn{3B@E4 zUNUSdEu^Bi>(~XVsMb!5Y$=+nnxi8dm#I3MQCKnBK;O{XxU4lwozJ?hTgQu*@)nmx zxh6d+sp6Ly{i7y&aaok>+&2|1l_6=6jwL=SeStZS{l_TEA2MN`mNC& zmgQJA+6uK5HSZY=rOnwZnVX9Iv}PIbg#WZF#e(ZSNheH(EM5Q4u04Uj!wb!?GQw&^)FL*bm0%!qc+e z?lM|sPPuHEK9{FHjKrwKm6WM>`F`HGQoK9xVr>;uEvs|)n6A^LJz$rNRlOT1xQJ>g zK`w;I9@BN2-~x8ZD8pCjHYlZJ#c)w;c1;ZwqK?b)kt&0zXvIXcSu|P+A93OO7P^Xo zo}#g>HAGc?e7qPz{ntgEkf!uQe!wxA6O+i;q~c-o15FcdOk(*odM?j$Sq)$3#+q7d zV5qm&Y8B0f3BY68P8Ed1qR&&~S2^gRbj44+^@c4S;UJ#T!B0eEV8|$Gmv|~Q`Ma+e z8?Fr$MzeIQUrJlM&?-bn>$b0w1$lqb9H}=@VMZISmM?&A*Hj(tW>D88n?tQ&V!Smv zvbxq795&M!0UM*7fnvq*=(rBVVnBHLEq>WUpUv-8{04^0;!gi3`A~qtvR>@pOmrAH6n}pF!4-D zk>?v46XV5T7$Qw^jiWZJ$nA=z?B&CtR1it=vR11$FeLJFn*sEgD~pJZ$8?=0@c|oY zQDB1@XDqLc7nnV0mh+`)xh0|DXV$B)0KfG5#FtsCiIOh!)!{;G)kH%~y7ktYwGn)> zTSX9xpnnRcG*=emsN$mCl>z&LP}k&9RMb6AA)Jiy#^uBl>RqE&Vl31N(_ViXmj zW|~ISUmq#fP3Uj*m_*EbBd%(GySuS7A8Q%w2vj1Jf> zB&%Wz%K~T@OiI%Z4Y66ivt2+DB|8l2tlNeWQPN?c6d+xTPSqaz4&@UjYzN1 z_4tGy7z*Dit}N=qkDlYDjG4m@GQ^kKNSF&m#G+n|D5f8anD*etOLD#3q9`dr7#!xM4TtsHmnMAq#qD`3%e-f_HYmgBr}njH9O&D{SdG4fG2+%?hEsSo4VTj~b+O%9t=-Jh1HFwgNcYRpT zxFp3w(A^lvYAx&qbWBULleFBGppLim?5X7ZyV+}^=Y{|!5eB`LCW{1mD2)4|7nm{< zl4F9lYL#bNmUJ?mwetf&nSZ>gD%G2{mv9gT>7`BivmE(j84$!I5uO#eACOERLY)|M!zCoequ3gk6_(9}4(z{M zqs_t%#%5ADWT~~Tp_8H-Sws-BocwfyfheYLN7eTrEZ#>aU?$O|{)ff^_{v0V1#g3y z*wvhrRvWpFLR&SXu&P-U6eGuWI3<0z5vaWv+D-H5l%}q!rAyztZ1dXQu4NlmcduRF zzijP_uFad5E(K%d{P{~yS0&JafHXAhuEZ7@?bcCINSd8gYo`!oX#&qGVd|ZVCcbEN z*g;$Z1+Cc({D%0x=Nz)B#c2Sj7$GfKYKI?bN2ZmUHaCc>D~$RHBWQb~mWKUL&Unyb z$e%sMWHCHnMb}}iu8j{l3^h66v!xEE$uKh)PGzK|l8*`cQyZf@8YzDC!J%|VNbsyiaB->=Ny;$D2I_9c*E-Yebu12HAld>MhH zw?M4@2{dV>i&&%qFLfWrss96;)>~5TcwzP~4DTTd~ zWnh?9$q9oP#6YOWP&El-KmFpzyOxX)$<$FwyCw@`{;})&TC;oHnC^Br*3{|^De$s4 zrB#L^f30u9a8xzhAc%;H?|&K0)F$;pPeNF-mo;`uN5Y#g*FIH2u4@cqC{Kl33`&vT zP%?@-Ec6NM#)`&jVO5H=~tq;&(gN7~2kH>VK`nBY9OZSGxa4amv_VvQ> zq$2Hs&~c;W1#uHhS0@aMl9OH?v#GhCl5-EvZBWiim)Ii}~_Vv-2Y zG{Lwm!d*XB4Ag7JxJ_h`69KIt{i-d7vB-HM4+|4~&C+xO)^eJhApT%0dP}f5mN69R6;%2dB_{5-==>}VJ zU9BK2@=D{q#`rK^Tyl4lwbCAwM0grJDw17J6D>z}f6{Hwz2!8Ntb1Jkuo`(xQiddd zSxJeCVoaTwxJ+@)Hv>gT@^q)1)9}OemWidwKXOXyX{quhx*0jPkQ`N-NwF=!XsHKN z(vmgqrBQ_JYbf6)rIvRWII5BH?SaR7H0~wna`|57k|T*|dnmTL2|bc-H)$~i zKV?({*1$e|s>sypk{4vNSH5y+^P zaY-wM(aPz{dQIaCHF>F`6Y>L&28swIOH8qP3+~P`##f}21@@|#|Y&mtj3QLr0>f__WrXQXLi^f3Rw6DC5luBzORlipji7?Vy zG8E~*T};wiZ9>r*-B!(3*w7fmRBeF;!^Ys~4ppuh1u4R^m+P@-blVz?-mp~X1d-EI zAYvPLt2u#>P1@u>QhwHD6flKXz}9ON-);?HHn9y|OuER4P#uN5QYs8-wW2>v+G+W6 zWohHg0p)cPQoKNAAo@MfUeDK%Dal5~QHlF+8xa|XrRIktzpk?Ja8%;{EdV*bZmZ@i zpa+tXux7dPI`SZmgt7EyG#V$W*16OVSV!ew4l?z9P=SV!+P zhdVy7b9lJ6xrxImu=r0OSj$+9C!0hl*%Z;%wNPmfVsoN;kD9O@o)fkuF=0DAM|&$? zE7DGnKA!wtM=An&r64>xP2MKFv{DeBGVYK*+^tns1T$Jeh;4$3iJdU8Fe*33!Sqq= zjZ^Um_^vMurex6lSQFIcUbtMx$2KyrDQ#C2ipTYR$l{b=+@%kj>-gAOpOWYMtVA`_ zk#d>7zNaaijt(}^%6RMWN`|9X7l|7er`u>%hv#V529@2tRxKI6o=mN!rx=c&$;WZ6 zXmK3PakF(sWoXHG3HKQsE3Y~@d*?Y9cpE7nCXmTEBpPkRy+y#g$=(}+DzOrfXXKXR@?Ox>RqX_%n3phIt@)IxQYzD{g zFQR^cCXqMyoX*)2jF?%YY>mUfr;k{ujTAB zpnKt-M1D*mjORcbU&Kk-pef|t6QFPHg?zdg<+2L?mLqOUIlF5G@@6IC4Vv4<+0CGX zA)j?JXP1EPhTaL#Ic*v88T2A}=dI@Kc~CD-0Dk&$^aVde-Tpr6D2^5(L+8O05GPRMIK<_6)ImJY#`9d%$7ex3r*pP-9AyvcX#pE_@cWT&(4I}; zf}R0A-r%fn6!m`s<$>qoF|{=>B2O z=D^*D=ZkPR&p{p9jxxmaY&;ilL-}t-UV@%P{Li|Wvm;-L_`MqSa!;fYv|ta^8Sw7e zowMbj<6gnp9iY9Sb0O%y-B8D%GxJrbmmoG1X#hQV3iMA!xZUWd@p}r-C!Rssf?A+Q zpG9Aber6WR`!2N01HQx9b>C*}z<);{4LS(F5Be5kH-ZlN5!&mM=y#rAY%b{5|H6|9 zef-Uk&4q0CcNx11bouuf+Y59p!aD~T4{SvJKp%6|8OR63^=|YHw~ip4C@1>c?+TO? zsP$3A57c`Z>h#Ardj!u1@qFk~#2>W$a`^cK^7!L$gJwYYMz{~U1pO%JF34X%I3v3; zb~K;M4rfQO!*IpSTiEZgKVdhs_p>GJIJSr_W^>qES(9DHKF;cF3%iQVV++`^Y(Bf1 z{VqG3?PODIPd1ain!Sq6V*9Xt+3VQuY!CKI_6oKa+nc?Xy@u7;C-@coGX8OXIsX{H zlwZ%U<-gDWfM3Ti;WPQG`QH4sd=}r6zlQI{U&&v`_u;SNSMlHGSM%TDzsIlSzs0ZN zzsnC~Z)W?mH?RxX`Rs%2Ja!TPF#ixgfW3+JviGn)ww_(e{*YhHKf<@OVK%}pX4kOa zW0$Z$;=j+XV}HPI;_qZ9v3Ij~v8C)pwvhcdiuOi!EjyYW!){{#!+yd(!hW0mF`wk` z=VQFd$9aSA;OFpBKFmk>6yM3u08k?DOoa>|yp8`v&_9_9^z~ z?9=Qs>~{9o?626J>~GmU>@N0?>@V4E?4Q`Z><)G}`v>+n>|gOB{0jRr`+N3p>>>7d z?6d51?4Q~HWB#oyOkFHn5Fs6FZCjDLa|1W`D@8XKUFy)?yRv zjr;)qdj1AJoA1x}|Ay{JAv)TUe7+nE@Y>&9=3-49B-c8I9{ln^Ix$4 zWzVx;vKQE|*w5ID?AL5}{tCVazmT8LFW~3#5As2_jUCM1#y-q0Vn?#Kv)Sy8Y(77h zFW|@Ud3+&X%op)@@VE1$_&IEV4Y3>eX7)bTV54k|eU#n6-o$TVH}c=YwMGTo%09+$ zf;j79E7&TwoE^p9!LDGFYzKQUKaKbC^?W1W#QXUMzKw6?1s`W;@zePk{7il}ukiss z$hYv#{C)g#_9y%k>`ZnjpUV&DNAM&09R5~*Fn=3AgdfP?%n#yk;fL{)`D%U=@8$2| z@8<8~-TV~3j`#4jd<|d0yZBPRlCR>+_^Et3|0DLt?4$fF`ihKf!iS8>6!h^s!6U?@cUz zfTBE9n&z|QfzslzXUy!;QPVCLF;sl-2k@DHYu>rMGrV8a7&AxOXnozo=54{#geDzzQ7?-0c9qI}Q0i=E_U&iGq(iA!E51~?! zQ`4xFdcIt)Vp)q(QbV2<>@6}Wk+89ht;w~K>#2IVT<1nWMNAfGY}HVPom!WaQXOPC zm+s1~Rf&{9$5jW3*>7(t!1W0^b}@U)4#~w>y=_bOBhqE|0ZL|k|D4#kVs8)AA^8GS zh_nca6Z`LqrruMi-R=%M%{>|G4F0Y?EfY)Y+Chtn^0(Z_li-*5$hLB~qQ9`DnyR&m zmC#V@WWKcRDw|YD_(r0wr7u5hy?iQz7(|9o+NdCzwZgLeV`*oV>am zD3xccQq?OL!N?^ne^vL`JxHencr0;ugSFyCDwY!|FB#=|#^8x}nb99=bIqPI_o7)7e-!gStLT@QcNc)7Wn*)*( zHxLs<>@Exu#&Xz)$%Fn}CrmVnA#a4D6=Z#4Cb-guM;%BCw|j|+&k%8dDW!iHCiJYs z83@gCN_f5X0j3YSY}+0@i*Wp9O=WSFF-VJujNzA%$s{XlGZh}aBE-Ha+qy3!Ga(v} zwEihQjBBGkM;02s$@U`s$VDjyh-AxOp5de63v*6inV2S8Q1$KVN_|gad(xF8Vis5W zPb-Nuy?GIkR;9*l4(c?(L=a?gP6vSe-d7(6-*Yfe3X(Pq=4+yQzj>* zPe+ytg2w2GjqKCyut{JJ0Ja23d^errX@hB=8+ma3L@HJyGNH6AGbBlg9Ug{#<`7LE z%$7NMVMpC4A@m?!w$Klq#xM3cu~rt92OOd@3uCgV&<|0*>rogHU%t%EX(>et#M!47 zm?Oyeu{#L7`m9Vfc}3r8GGzIkrcpe8SvubFgeD-54-a$=Q2YiRArdzRnO~F&@<3b> zZS9Z&S(p6?JN0uIjoDE!+=0uF*o zo$`?sSOkp8H8e!`d^96jG31<6 zmEc=J=~sW>95A(Q`45i$W0h+UTdqLjTrJ>|A&60VQw2MYSPIs)_Sd%m*H65l4g&7s)ut zb65g@c9@AXMKna}G!ZKZ8f194Ah(c!)1(_yGjF{9J6U|Gqhd2w`d zG>UBMTh0WdoOq%>P-@|!uXO{{npYwpmJ=y08Raw+@to_0z%Xkl`W6!K8IvrAw`7FVKN8Mm@ZL&-R#EPj0v^z_UUB~JgAUP_lZno2t{{;;N;EMJbm4MGIq zP6)xH!+;7b>D47ha*r*2ZtLZofI|Rgr@EMpvD|oHiju>A^HPa=2G6PY28-1;nl~u5 zX&S*6%lTVNK{B+8-XE+Kw9^*L5>X1lm_qTT61I-(z2GuNhAp_5<4A3tDs>~!;mv=Xz-G60){veuKXAY&-BrO z#*RQSLB@nuQZOs!odse-O`LC1%H=OPd0OI)OSW^MiT2~4uH*34WTpuzeFzW+B+}=& zQN~*l^TvJOak>?zn7xyyBp=H`!P!zqV$BWuXGcjLF;0~~)e%{61ZOKmc$=7aLNkp_^@^JH zn>GSmM>#}(! zpWIaOls;os^Oaec>(xhQ>`^Zs9-X~vldcmQe1Zi%avh- zhcxBR`xb9(*Asnt$w$zLAd7Q}#jeuw?6O z8uL?2Y1RzSU7)i}KN&+T$lKut183<=7z^70dj{)UuYvEDJ?&-9d_PpCm&S zR!ZehQ#)yvNMX=VhwqvySz4|@$AB8 zs`a9kvzQ$mgH|une=x zfGnmRQT-*VZMIAxZ7sKqrfVTz4izvnNCzOW)=;|7= z3G?HTR`r6FOTknq=FOQ>Ph*r6s!pj4HTDJ zHc(b5a+r}uk@5scAdF+6P`GxlkIct&87X`n2TZgHV3CNUOk5ilc*;u)zQtY_Kg1?)+E&t{g#^G4mX`2MlR zO*)0K&n6=?_Hb^Y$*&@56_=Fwk)uH_t!;W%Zmxf&X*A`$>#;_NsVW+*VER1 zD#tCBqb4l>EFEd{r*X)awgU8&>`*KVK+C7aHOjVipbAh}0lGGVwgd^$VV3rSS|MUJ zm==`<8(0u(PxP@!pT**!t+JfMb$;m~;2Q{Irbq7@W!q#O)|e9Od@^$M2pQk5Gz9nM zZGsQPaztgB->78guBnSyB1&JOK;t=9iCVcdR5a<5RuQlx9Hfz&suhx1+9^u^j(wui zba)zDS}tl&05xdFUQu~B?ogwwDcY>ADFP?ftF*Pbh>=Gm082m;xp6;Vh}NVG=-o-iKv87)|{eAfMX@;<&G^2BBeu+6;4`A zdj4Z}lkHVXB;STo`z5|*H)-<1~N5Fs*{}Y%WbiJ$@O{z#>zJ>O8hAQni=_3cLncJnIx`ZmFH zIc%d|TA(V-7Ttwp+o2}-Wh8_TY68+G)z&92##N#wMQ%c(wxc6xLLsJ!p5a>ameMej zf+l9Ds_a(%cxdZYo3D*lok(b=8!~Za-EfqHQLQ7D9xU5d8{7!<7dm+v?fBBxu6D4F zVX6}wN8$zR$;?Vd(h4>SS&r`_e%(A(t3v*@QOY`2Bgo^kEf-nJYNxiBm2R?RHFmN} z$Kh#wVp2c53zy8Aj0*jfNhO(WFKc1jY$q&NV8tx3vNehGC6*^SqA(V>#*51jJlLPv zNQBf@Hn>(8r6sOnD!bZ~z^irE;4eTl;7l8xI zV9Os>KR5CTD`DkFNMp9bp4?i&@hygJP3!v&t5S{g&+5(dmiv+y~2(#kA3Y3dfRozy)TK)I1`citnHo{yF=ObSpk0 zq)(b-jjt3a_);~tNMI?+#O_jfYARaBARFuyow(+vY^!tXzLTtN?xFv2nQp8q>hL3D zZeO&gWOe(HeJ3>M(u$PCE3R?>DEzYGC_FG!l~IhcvM7dC8DbY&m}@J%s-b)bl|u2$ zGL98rpyZaAB~DiXODR+MMoSiZ=?t$~@QPZg8m@gWfnB^x&nZ~NbBZ+NnXD~~@d9f* zf!s{czk0*kQ#Y?%*1t^Ngd)HFjvgEyK4$)+V;9VuKX1|T$IWs6<|)^rdB>|?XU`nG zWH+|;#@;jb#i7!BigTrL3iKdNyC1S%IdT3jPN&um^<2tkEkC+GSZmb|S)fJx;Rh}l zz`4ir4+l!)gynhnD!s*ujnknS!-3XDkN8X3oO@^Bxj#;iroY!(38q9H#`c}{O7I^P zQXJNe=jh}II_XPsX9IDDG)E*-Vkw=4qyv>wXHm%^{vq^F{ZUv92UC}S zGjN_<7D(BqscFxH*_dNjQaxT;67O6}UZI;@c{kN1Y)opH}=2P3o z#U#!j>AfsDyeql;RzxLRIjiRI{CUTky2(Vt9lV5kHtNQX=6iMG1Yj>ptaAHVq`Tlb zXQKn7&PB%YAW<&6yJrUb{krdN+gcYbP#NN(%>f$jX>rl;Mdc^YbGOIS1>oUPQO^kR zHU)sy^K*VYg>M1kZa!iM@D?tK*)AmZjv$hWUV4k~e+7{};j#n$Gd*9Q=3Nx~LjZD;#LxJ`xphfpP zdP%CDpNkT8WiC)>5^8iSr4Q@5+ve=zL~nLDP+y%w?L=M z^z$=OQ>hQ%$42TvJz11U6@6apE3jyDvAfFYXQk(E+XLisazBGf%cWk(zPl~b;=~*3 z2&C@y1}U;~=>u2q(e=RHdw(1Zoy9054LMm1}HnlzJc`mb>()-8yn_ zr#CAseFBpY=DFLqi^OPN1)!V}K_2e0E~Yz9jL!rUj#U0*MZY zfw8(iQzbaIX1eueaboQCcEn)5i9z&093Q%JYh0XYAM=2{pu~pNRQ#+RKLVb+ZJSw~ zs8#cUe{6gF4%D<@gQ)&?&gK3hgPlHm$jfa%LhW-u(aMfS?k_g@sZ))n zjh?A{OANZsb69J8=Os-WKk??Hul3^se6qArCo%cJ)mvR+&ErTQAD=-EtGgGK_9dRl z^AiGO7+`tFM|pUaYuu7Vp3@@hJ7f6a!Bl<}s^@+p4pim&Gf;l*QLbxl-93SS!lF_LN;1y-R%Q=?)EvHX}Kq-al;B+ImNkNaMbfW5r3 z`T#HN)V=I(TfcMZ>o4*2ftz0N)qC??`Zff3(@)>RMESiQ<+l-d*tj@6{Zd<)7}LH1 zD4P^YC&sV2)SM=8aJK2R%P5zc_bQZ5q-If~Wz+iY=?cd^cy;<|%dL)|5yk949ZbAK z$d2R85;Hn1^$N3Xd(N$>zE5MR18Tjn{mgBTm3TMM%=1|;R+x#E-$c2R+bqz6vvd6v z`R=wU%#C=@j$?KrrHQXpvKgsKRPQL@>6T=!C2ol!b|96x74iYXEYC0YlUKd&B)-*X z?SBwh^fg)@jqJmD?)J4N)2|f@%{z42gLnz=)x;>7?6(mOr@x6pJCf>4SAwCq~b>t0|$M z(vVo;X(}E_^%Uk%M>VQ{{Q2}zGdd3z_Eb-yg;7NY9XHH*m z@P0BqciUQ&tFhw}PoHQLG>@uSISa3rixtVr%4nIl$b^p;zO*{p<4wAFbSA2G4v?2J zKcCx{VQy}GM-I6Ixtx2eOu5*d$m7JDnk*-FmT0ki2>eX0T)w#(jdL}&xy`^Y#Fx<1 zCeliyk`DxUILc@GDNKA%(te%u6k>QWgAePu+t%LP%*_WSDxFu;D%6z^Uif~p+v8>O z^?Zrv9HQj|yo8d>e0N)})gM3W+m~!6-5-&0 z@UJoPAuIQ{xpDj@z*M(k#BNBLK6awTk_E*_v)I#bySY6@mwMQ;W0X1J7i#tPlp9BU ztVE{sn~Nsw1L<-Si5-4Ac}38+hUL}*FUwP{@-v`%ED~*t&f>Xx7h@4-h8L~2H6XXT@w;U#>^r6Wvi9BWF*7qK*TgZy zgjUY)TuOh>MwQ(ORd_#TzPo)&6E%&#(XJJk-sM|f@l}6E=f1appAhYPy{3(p8-ra( zXx5!y-W65T$IiST{=mbw4o~#U(08{j)0|z{^=Vw|W-UMIp1W-fa&zZ@sAC|_vD##M zRpdp9l~+3Z;06~tm*th)Zf;k|A0=@!SzbK`iEmf35x-H#0OO$GMmaBwtGDP}Y5%c> z99~xELwoM_^(^sKNA`C&Y2?HmcYd>a3F%I}CCCEpPuieICN8U&cxG&LbAX?#?v?XB zQ`i2~AV;nR^nhMMo@dg0i$<2GL;nVQmOpcmb6H)zloLG~?KitMiQCDZB{welq>h1m z&tlNHyn=7rvU6V>pNeBfnp9QP+&BE68`SufkU^5Gmvp8-`E(ofNa8Ew=kok7Yt%VR$q+Lv_VD}!u$ZUd@3Vz^M3FX5aWAHjD|3-K=lM7p1Ix@pYKh}|9_s{Kr{ zq*gD}#2b<<3IEDQHW!2jiLH*AsK>PK{Fx}`%Uyf_I)NH~w0R}nzAk0#VD5;bb^tT8 zHu5(frn!VQDAuYe&7DejX9_h^uvKw$Bl^Eh;f9%9xfbWrdzXdl-B&yPe9nxm{w|H% zffSoVh$AO*ebz!Qui*8{(ocK))|08pe{UhuguU1l7hRC@Vlge$yKPi`0RQ^>xrLuL z-`yTH^Pc+$8`WG$?4_$ZVy17pCx+OG)|%=2|1pl)fttHGfl6Ou_gbjfksrIC+0W?e zeMRCeOW&dY6ym$5?@u2+llsqj=yYAKcdPWY@pJ3D|LozHW1D;?c#&$~x)LQoWFc=2%VGxsx~qsU*3AmiI5zSLP6IX4IJ zB^Mc8jJ$o^Pp;=~Ti&_v(Ffv~kp@;7HBrl`C;8U^wKHq0i!*Kd%Tdf+g|3?7+}raj z?a({$_RiI<2c!5QXyr5~Mq^|j^KULDw%hEeHL+(n_2Q_Com<^~D2<)(Oe?qO++5dJ z6R}7(?ds^6{C_x&9&K(_^FOyH_%#f_T~J^y9~Ig;p( zw(oCcv8Ug+=Vpxl-NJ^+h}E@sAip!~{ol55=>!TntNrqyd-I(%ZkW;4OF5I`?^?)f zMkkAP%{q>ytPNvXF39T2Ejlv-|6Urm11Zi~uY8}7apoQxu-JzfB(rk<=Jp%?hlds> zu4=C4ZXI}BqtO+1LBc8{CFcET-~WHwNRh6nGFD>!l=kBPz{Lu)uyTpz_HO^sM(Y4p zZr{lh3TthxRi7;4)v;<$=1$!IuMn>TDa^IDCkb&J=jlp2q7Izyk^2t$kw6pMZ42B* zFESK6f2ZFP5@QoOHTWrmi5_M8NQqfOI>Y_PHc|)5EjKgvw7{axt|yNoC;La$)!9J; zE4RJed;h-^sF4n)I&NZYODovV2wd8LN_A%=&V$8~cR^Asx5UgG#s9<*J5i>YRQ?2* zJw;<%Yl!Z^=-9m!iMBx}H~ch)*nynQjn^=T7f=0k~^w+Y6irsdihB z_igG5l3E=z(`)@IiWwGd)s~bSC%q^zTLVMAwN|TWhFb=zr!evLMW@^R+Cz&p){f#a zj#9+t>gLYAqBclIh#e@wL_3*-^l^hH)-R)gRZB1Tl{W);y|wXH(c2|YwhEG087)(K zyZLBg)vR243lq7yKXP+-frq*|?NlvHj80|)k}UhW%t58$8{4%fFedc%&S zGE(Ln`IR;I>L~g&ps|4CGrrpt3Vb*BvGJkNR=5?pI(p*mOV$y4w?PlHyK0-weSyB#M$aEDUp>`{K9+XL&T?>taaku@ zRHEOdb=248kUP+8+{J9ld8g)59DVL+n7gCKG{-k!ydRO8CIowGbYDvREMTu;o8 z&>rk}IM`Dyy7WZnIa%paotu8%=g#yvW*1^G{XEEx!ROgApiMS91A>HCuJ0KOqxmV+ zNOh}6ezh@HD( zB6ma22@)-qjU7$ZI}OgdF*-#x9OPGR9l25Pi4yHMcAvz%0=!6fTRlHBW2uuI#LnF( zk!uU@R+tmxtn!!n5}PfXrOb}d^X zgO$p)HSrFkJ7tzD#Ab7}iDN{H>7T8Uvo%{G(O!;QBoeE0bkg`riMkq_hOlv{$aJPv zb2hhr)s;exG|#HIIs1ZD5;r};P`#BTR?En~;A9UilDNuvIg6at5^rrW)mph_8+Eev z#sm&>ueBz^ZoM*c?(T|iiToS6yW$iVE0U>IYfSEqb*hiniP2l4&d>^LkBf(qYv$^T z%4L}QB43k1j%0FW>|DEC>tc5xk8|(KbrS72c<(@O1Tjox)q0z=-+vDw!ekk9NUfp+ zE9JSFxjw=|FH;}*Op=Pv7Qu85^63tq zyvMl%C72nPpAkXqKpGS8NE%n2X%JV}#)qO)N*yi3_XT(zNMEK5&vNkOV0HRsm>Z98 zHi$37&WOZp8QD{xZE$5OR~7>>v}$(bcEH>YsalBJ+&R{P@7K(i)|NPC2i{t_QQbfs zb^TZ|P_Km_wAI^9W-esVVE5H_$O5JV=z^+T`7NEv@()0b)x1c>L6KJyejTJQ*1RB1|w zf!wy}s(tz2s}y~4RM#7?9#)AN16#_Uu( z$;?cg7vO~ntemHr^nFm{VHK}gM5}7$T9f-SIG^x_(60{`%@ugGU?5Ev!;&}s9zJJ* zbwL)pBfU{(?0TVvPNruv#huw1za&w@$D*Bn$i|&21}0j?y2dcJvC`0~lFz+mKkVXXvc78D%2@?nY@y22tokMz4LZ?7G=OMhtBjxM zFKLg>M{Imi+{+p`TSHWV6E&h11!r+o{T`?#r%FO^f9n@jwJkJ_Pnm7Dju z!oq}QBW?)JWO4P>CR!BPi~LrAoXX@*mh6=QY9f;>r*%mpttTL@zipwy)=+;%;7v&; z7PPZU#-eMoh%C!hO@D5F{wgab{p!l|)IhB=ZsO~d&X@Te!mYPz4Gb0Z?X8Wiqs@^T z*$Q@`7s+5>ZDC_|x!Ib)L|6y0a~1->tFdW(l&avB>soGg`5GHBQMoIZY^IO?J;HHE&lrB@u7RtJoA|1t9p2X(+*S3dQyZf@8l6PW-R|)FHnIh}v0lTFu&)^C9iG6U zpFyRrn);ko#&sqR(XGanYgEpr<_`>3Pcc~x&kqt-87=n~yk4R;#)t7CDGze&$XU#} zdBQ)8V}_sU)l-`Iilf!%8-Ti@(b=1SbGCJV1U%ZltX3X^Vys+06JN%3e#(t5Rwr^Y z(ZiFi!XE=|d|>DBaBXvKP@OUyB(HkeWe{(25arc?FE8Ssl!*A=m*1WpK+Md0-drLM z;^0d4_F5KzR;@R=*8itb%&_`Y#!QUPXe4?|iCJJ0M;%g)okr76X>KI;XBMiyato(K zcjVTs++7Q|mbhE7XHBM-df1NNkd&J}`eZB?`OA?ix8GbYe9Fa_4ftirg(Zpk_Qj}q zf9}RY-E|?0B%c|T>wo4w^l3X5Q!CNbgNk1{?{jb4zi{xRRdR<=Gp+o#5_Mal`p@_^ zL6!41QNpyM@|O|R4$NI-(s{dsC@Xe{(wTWz{8fos9~r}@^Ko(NZ%~mc=WPb_GbLsd m2ef0|lPvgN-uKgAM=?9_e#(qB?kF+GaXZSuQ0y{+ng1VEkuaYC literal 0 HcmV?d00001 diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/TitanEngine/TitanEngine_x86.a b/BranchTrace-x64plugin-wtl/pluginsdk/TitanEngine/TitanEngine_x86.a new file mode 100644 index 0000000000000000000000000000000000000000..10f2d03d4b25a4fb8b362763593abbcba995c9bc GIT binary patch literal 333074 zcmeIb3w#|(b>LmP(l8STh5?2d2rtbr3@}UvNw#Hs7{Ib5+ZtqBSbi}K$k)1U>5i}N zRqnmA5gw)Phlj^@?%2JXho9cY*kFsX#m_Ky_84Q$8-$$uBx5M;OG3WqPR3ArUl(%z z!;GO^YzTSP&5WTu@TWpv{aVIQ9$FXjLy!*TwR?rU{&vPt-taXcZ~PErC~v+`$Xjn= z4CQTbUnoEEkdSxnU<~EmpA+)a_cMm_zFUR7|BH;F{QNtFd@o2_S{_3+rzVuPeT6wFBwDm z-|rXlPY*B#GB9vh$ly2F0Lr7@C*(Vhu>q7vKU&DOzs3eo9(TWx>vymLlpDSxP6S3rHB zoQ88y&U{En@=7*a z^57SQ{2*Khc_?pvNXXmoW&`dMd~%fyp!_b>9m=P!7xMd`V*@CE_)a08xt9%~{PBx~eEwE8fbyRoCFIW_Ey@=^ zAmlGz#RgFR>$s3FeT5C6{PlZ6C&g#7ITYyjo&Zxiy3PqP7(e}piQ8oN_S z?Q5)ta@9`>x#nJ0L;22Yg*@gFRztb&Ekd4fAFH9<@FF2kuCW@*Qy>k>)6WXIX&|1%J;rf$OG508p@^L5%L4~vl`07P>(3D`G$}m zfqO#v(H%lA!@Z*X*c*ks1`W;K+5 z|6M}<;LEIr@<)#d`45m5<#P`R`A@r94dqX-7xD$DTa^FuZXthpn$=ML8{~)b-@hp2 zEAMADl>hNgAzz0wqWm2^N0e{Wg#5$DSPkWy@C-l(YnOyvb&L(7Tr(nM+n3oO%46Ou zDLPx{u~=bdFDHX+b1?c?H}H%IS9qS$q{6L^-=xNE6baoP#<+X@6MA_dLi3QTn$E zIsaKUh;k9Gh4QLdA>aQfHi+`-uM2tT3v3YOhdw0awfD0@l-KVT@&-tU^2Uz|dGqVo zAj(@`Ddg=VY!Kz0LqdS>L6rAEeWSd0Rmji6{iFQc-wXL5)EUYzzD>wS?q-81zx=<1 z{K`kzAj-$j3iW7f>FQzj{Q-m*5$o{Poj?{0-!X^0ki&`P+NhAj;pv zJ)(T$lS2Nn%LYM)*zH1Uf6j(bu6nJIYi?shDBHd$vpuF%?LiWC&4WUe460-jo8$y}cA!HWr5#{igg}n5AYzXDps*sa#O_Y~?UdX+0 z&nOG`2|4p5HiXjnl8~j3u_2WE9u%?y*Fsr^`$Oq|PRQCLYzSrjokG5MnGK;lFe2pD z*Rmm$AAmYXdH6Sl{O}vu5X$S|*`T~(PRJXF*$~Q`YeIhf9c&2YZF_~h1ImZ;lW;D| zyP^CjKLz)L@-q(!dH-!}2;~Ex67maeHiYuw>xF#eqihJ}-<%TiE8k#4C?9{9kYAr- zLnyxi_l)w1*9!UV+u0Dx??S#PpL&&$KX?usLixil2>A@$Gs+*I5c2tJ*bvH}d|C+D z>O&}ByhX^Lf07NM{MBh8UxILyFaM5^zk#$UUxRu@`TAFc{M|>`5Xv{84pIK`4k6$C zBQ^wbRjn`Ns$q5&%GJLqWZM~b70P3-74q0$V^^U(zJ;=|aID#{x2M}n&33X-Uud@L zD+yazSWfBaQFi)? z;`9)eriZI{y8YgXdaKzm((6%a`lY0QsMA<$C6k@CcHcO|jFjihh|AdN^9VC-LH;6r z8kwGRwz+<&zPg$;rq)(gjY}AD@(g!c5t^rJH;!~0@H|`MvM0OEelpuxtoNIpwsj$Y zVkJ*efro*TeHY8J^rTgCq}`q~m6Z$azC>Qmv}uk>uisp$_mc)-KHt0_e-TXubvrsc zuf4V+azEBhth0>B^qdAf__=OpG3oWpUx^-Nr#F8kN_zP#SzPOjTQUlvgr_;z8x8Tu zjFd{aOzF%MQfA>No2$uuvWT?h#nQu+|FR2eLC4z%n~h`&l*rOj(#?{Xp~t%QcCQ7` z>M)Rf9`-9z*|_5zp;_k6C#JN*RA8w=YOh+_-OB`8E+Q*i=@M_4f zgf9;@I8T=nZ6(aZdCCJxf4*Pu_SaTt+Gjgm_{k~C$(JIFOSAKw?MfjEk#vtG-4)P~ z{lq90FQX$mJ8wSePu5$lef7n2`#ask$$Ec!z1bJB)8`ZUZmDoWmh@=STU#l(Aw5n% zBd=JYsR|NBDyo}L-nTl8%e8lrdNs?MNhOF)9VQ+cCc_7$@IEa`hrxxTqt?4g**ptE2Wh$0;lTz zx|K;$vMe7^4B}7xWt(Rkk;*x!iVoJ>jaCA`OA+ok*_kTKC9S|C?bgK^UR_B;L|MNP zU&=f;c;}11T?LsoVzaX*LC5x!qsdAqQ%&}>bf+oK!K?@Se0Ykp^YFv(ce;u8(2P)? zYNc~NIaWWTSoT)19*|!jbIZ?8uZjPoMm+->HMbV>^OYDY%*r-P%yT}_t)Iy>H5N(D z+Ytx3o1senb`+%Fhb^4L$pu~))9dO5>?k|ElD(0f-@g`Clvbn!WX>IFXN5KH#1V=2 zVg{>Mu;c7AiqngGf~UE*YSufxHS#||BHXjwEMYIk^h4w(r+%NHtSTf*uA)_obHMfXB@3xI0Qs@FHUw=FXjNa;~b&N zqbiDZhL7*?U2A%s#}}L_YZ8m46#!3U3(oVrXF1RDoROs$RhL%x{A#k;the;j+$qEz zYH?CY7DPINJ(sfXu(Pt-g;rX@DS528%52hJ>Mu_g7pA9KRi1tCH{T9-RjgE23A^x$WaFAd8*+uCBAMQd8Wa7Iy*m1rrzVM z`wr7!nHvV!xrtDj3QUQ~PP?y|?Cv-jI@#*Q-YImk;P;3(6$E~8-Q8Il|;w)TGsT5ABM_#u;!V%t7RPj** zAt(4($$|d|p%W)grI{&_Y9OYWn~{L1$@K8~`dR2#Ye6rNdMQ0nrg3MQr#7OY0nu6O zV&@nrU{nO~yUoIm_hjE(7FL|DBt=%d(qwsp{m>_ica`w_vd%Z7<$29^Bl{gX#qn#1wV~?gdROn_xrn@6|8#uW{VSM=XMK{IEvs&S(cks zu!6kQGD2fH>GF25D5axxjwJF<%t%*>Txp7PuuEZ{FYdqF$ET6DEMzY~W^6^-f$CNC zPgDIst%kyBN3SYi=9B}KUuA+ zKaupV3R3xUv2N0lhjOpe>*)KIccR$9`Bj{0Jh9d-*co{4p!96@+|0kKI#=bL>9KkE zBs8(X1U`15lkuSH(zNQ`iF|ojH}1$nx%bIdQg5&2Z7`X07A`}U>+PikRsX)aX8B~d zYQ`6wY2ToBqH=E&4eX0dvr$}WdB%2vqX`V3SZdErYXqrbN(y-=c>=t8`i~XM7Ut^x z#bx;e$^YelWa-m?=HM-s%uOEz{~~BF8L5YAsho+}f>1VmcmkTSSt=`71i<|_>|`?Z z5S9V%5p-%>7R3xz|IaU|oC$XYiVWUVnHg~OOD2mO)@fCAkX?4IY!ToxD)R@dYsofxZ-lan?QSH-^uy;M|fk zmGjVLBQhx{teqggrV(Xb)QYz{2_=5cC@V0(gxwiA)5DGxR8D;Slv4Mu7%MEx*%2|* zyBmhI9DqKGrDL7cNhWW+DApA&FJkA&7G`>Q_fxa8IdN)8{ZrK?;Oi7_$ zgJ*zGBagRY)418$>|(;!(^_<}R@ z%eYUJS48VxNq*YKX;A zUyifQ1kQ8Q0(ei)(0i&G{EX^O|>@(aqD}EeVYV1Hxe}Iseb5J!Y zshS8VDj1(#mP(DM+>V{b$boPlkcX8j%SH4-fZgDDIqGqaGtBB&PLNM44=hZrq}977 zbdIL=$ozhw$sm4?%1F3^$ShcRXP{opdr~5@v^ea?d~?Vpkr?L5!CN9`>A4q+Iz%iP2>@+kEhBG7@EJVRL4=^I`RcHLH%pX;uQ z(<`ZYXO7ei);U&uUK$<)+TVQ&kI>UPNCRY{FNsGS>~zlc<`?U2F+D(Zn`C(xMCQTM z;4|+gX~(rVRX+T(RK9rY1{_yn3nB;T1%jdP?Oqc{>6(|fA|2=G7t_v2uOT`}ltJ~_ zB+%zm@O-`L+$pq+Tjy)n2jZ1maGYo+;8&dKr50{>u59NP$BUSDFX_Vg2k3OnCpTzU zopC16&(-hAcszLqb}C;k?wio_NNW!4OMnA@)h(C=msW&!x;p{CIz-_S(Cc1=c@yK5x`y_8lN3g31rmdc^$X->6T>TA_s3ge z$`z#1Xap+%I_?;i==5O72c1w;(BX_zMzv;yJI)SOZotTk-^c#7HlHs& zR|jhp2506YSs^D!91krRsq2n|P#i0SlLM7okwFm8J5ra#2uXBF80N4qg%XF|Pu`Qw z1lhTU=HYiE!XSk`KsQ%Ac9cvnAW{mfjLAi8^px&&Je7DQXTN)CxIqSXlpUz#Y$O-C zTjP5%3ndVmlZ)9r15t1_1bQ39$cf42Wbxem+DiVbam83++08j3AZTB=b1s1~BEn&; zbdk8@9HC17W@c=G_kbGH7W6RXKbaGBn~Iat9H!^cDXGP0LHzvbxdTZ%={CV{(~`sf zoKbe5k*$)GxVlt8crN~jNA)ZWX|>dJ;y(

G1D#FswPG(+buDvOLVt^nY_$rWLFQ z7`f#&4XG07N9n*!=XM>|We{_Q^koeEY22}34~a~26E(~y*SpoF$4I?SV;gDurb_Vhw{?^9>6vr3Dn3pp$#$T?u4^oox1((=lQB~?zOb9Y$_?r#gk0rBXY<} zb`mUs&IP?b+$q$v9c3{dhseX7t|TYd%{Vg3o{=yr``tBIWCVu`uOxDjoAgTD>@-t| zH~?F(irLQ6As`);xPBkrgyIdQ%ve(baP2c}!*$wnNVp!R{HNHjW~lamc5g zUAT+OY4aH-(dAiK;d)AUI=C92pXr*}<%+Sw)T%Ud5_H+2@>XzasB&p6jdg{>)LB}) zYf?YO6)&!$RD&lagh&8<38O5IkP9jzx1}r9*1?BPbw$fO(FuB(4f{M#mY!ba| zS;C@NK48LV$Le9qe|cs&d?Rbe!kZiZ?4OvxF$%5Z$l0?!?6Z++3!8N1yP4-R0>*jtu6rm3;-g1vhcVdQVQ0)OK>cBUVnk^GHA zy@|UR`oGQJSXLA8VHVEclhS93&&9=GmR>z7>2jXc`0Q^?m;G%X;bSlCYKD9KWnRte z=P~>*3Yp7o@GU@U-1t*wXZy=*?Qo2D1>UHM0<2a*ae@M!W|>E}oAY7FLjW1OJ~f{Dp}S_<&Qs)z~Eboh@uG zi>$9Zt%f^RXqUY1B=Wi)KI>)hdI@g1jMr1jbKXo|&nVaR@!E2yvv@u4PM7nF&y33J zFJ-)HOWTWQ9V)Y#_LR)#RR}dxV>1e~TCsI(jVLdTRC3lQS z?vBxDE!c$T)&hLYlWZ+~C?j`C|0YeyI`=8~^M_4Z3%f-C-`5y?bu+hcjbiKUT9ICQ zM~U=~?Xl>MZL?c)dasA4L$!5(L7`X7BkKiiE!>!LD#;y5L-0^z)3DFlW&meaWQ$rE z;U#v2NNm)%{3(b=THX(w6I(^!e$XOTjJVlC`c}ZH4Kzxv+#KmF(ns&u9wNQlZGC$Q z9%bxX;83$F^!|KC?^*3@aY5@`^c&zNb#DH{hR_;&3G6eSs~1~WyJno1-Q7fX$F@gX z0qVa<^FAKpsJ6lf6n1eG2b>x-w`eEfCb_*$1n_;0y%>%Px4g&}v1zE6)m=nZciVdQ zGC|L(efpc(hg;wyuzU_^o8x9MX!V3W>`s>}ljlGlR91gZvYIc+B3_&Nsw^Q}4bS7X zs`7g(4Z%Z=t-xOL>#YV8>ypG?+NmD4-L}Uf(k@$ZRcL>|O1l`$hm)brm3V^I)|qaW z+WLe>JG#A9+Ka2fhTWIe%R1FNx6AHtdmTZuHx!MynVP+=Tvzd3Sekv^ozBwi54zLk zn*C;Yc2v#&vnuN@l@57@tkrKxsg|7Iord6{#ui|&a_*`En{an3FWXfAUDV_J`3S`A zzKtq+{CzgtTV9U~a$VI>M7cYymvySgZ-;H6KLiiHtS97NMgMK49zUyG*Qdu<-RUen ze!n|iuE((_fU3uTCSx6^;lt;mKJ^RDrgI&iuW(ki*4|0MtbR`djH}`Hy7o( z4!!|msXF+lGkP29M7OZ@ZbrP^34vFCYIFB(uym!tgHh6Ecj8XS8LQB+ZfwfSJuvYTgoV3 zb2@OXioZ?Vqy>Ak2;ln~!^L?P1f%K_+ggZEhmKHvSG(=Ls>_7Fs;x4s0()qv{Q&uoLAODol1 z7RMm)Cs3qwtBjd>v!pfs!b8}!lE!%DKhUhmCayBv%PZA;w$q-A^BO|C?zDKoyeEG% z#~|FNTvr)eV9lxQyVF@?5FT)+%f}!*9cZRnyKfS_9&mo2mFuH$J!!-ISFKvS`_d3R z)EGEkQcdeFzDjXX3NO!84_oA!KNo>@K6~eic>b}R=Tzt5cl)|9$qc?KB%b;f;n`7q zgJ)+7FV9r3TWrI5d9Koid*gsGdXsMU0q^A7!V0Ff;kdnT7d->HFxpEo(F3<@#P)8y z2~mc_^Jeood~t$py}MELOW zVfYvgez{s8J$)WONEdS34!=!-o9tsd&Hop>8e4-u7P237c~uykQ%>-bPxb4?5kLHa z71<+IM*LjP$v>L()>d-m9Wv##5kIMN){1QaZNz!l-M)wF^NZ`PZWz07Fxbsn@gcKI zn&F;lXu)SzY$v=j(n~Mdk7wH)(T^wljjQ{S^wxs_~Rj%QYE7rHXe%P!TA7yI43>{jV_`w^X8 z@2>4b3qy}(^L=N4trIS*shaISJBKrY%x8t*l(Us z#8VH~yN7LC++@4%P7%QOHFgA!7SCzX3rNmmy$n;mdb@1B99OcI45L1xw&`A@Fg(4! zn5?3EdZvA--u(6$lm8iI!!tHWMl*bQ8UO<8cH%e?mn)7FBxQ zen_EvqJ2>q9;q%0x#x{GfypV%Bbi>u3x!N{w*HCK(|7Z_6T9?_1DQ8u#$5#_)E{WT>ILF4r22O{+Tv+r|~jP_4!4+nm?-|rmN`dha}VdW8!H? zhtObC^*-92A?xdEc6C7&m2UU7;4%@+cyU|Ku6sSNMFBGzFu4GFCtgb4sk#?u@vQ70C z?za2$;_4W(Kd;K_7_ZLRPMe2E+O3PCy_7Tr-Z1JYY`*bpX1Gb4`ltxt`x*mxlI+v- zRD;2|H>H20og_mcl2QjYc&7VsV&sElZ z`M!Z;v-2=^z2E63X}4X_4C4wSxJkY2Skv1ma;Ay(itw)7xqUa)M;O;9;?H9vSbddX zb)|DYIaWW@!sWb!W|g)+5mKoXS%p;#_G#8#RIgvutQ$t__ZqZf#vxk=bj_M$nOg)J z!w~9amFmsgZm;}y3Div4ssX2jDq?up%vA%){i;FbXLDvNC@ST)AWE!9sqX0NFgS1gph z!Ki1bJq#CZZi8m_#*|RW>_{4dhZ>uPz0ItpW;0~VG%eLP7ia46ryvx#y=qn!&++pHlvxwL-3xVnfiz9w{?QcZ8tjBqUVG8Gtw6mre+6W=* zS=xwSVAd|SVk5XBz1o)Q8H>FN8%A%}NpIL1m)fgf(W`1*6W$WdJ5KeJMGM!h}A%0?l~Dx(25a}>e}<+_SL!1{K}0 zDmk;Z6f~iawFn(fL-0^zSlJ7*sHqZF1H5EXJzpdCtg}d_)Sp$zTmdqZ)g$MVZrJbm zYf}zoFIKk3wIFl5ATup$4rczpmrJ5wYv-P^VX>XwHal=NzoW>d>JIWii^uCBd+cP zF5#nui}SFm7_9v`l`M8Iu7bi0LtkPw*o>0;MxDjZd398YQ>AXpbt=^>71`Y|cAF`? zN9z|3!6cCG#mUa<#jP+}P_SzhTVvOX^XgryPb#ip;AOYU3I@wAcEzx(pmi^41p^1a zSoC6oMXZnEomAh{&iG|3gjjT7*`u|qtgpM|W_Wx@;5s;K^~?5_xi!lg4N{ z3HI_^MlaR773Uy$>8&!(rQxDCaQ#b~gW#ao!)_V5RPR?@^Tn*%U$QHyfuO-##A_S$X3CQ(CGEBTV_X4J#n!| z*h_Ae9^um_xt*2OZqf^Wz2*u%!a2QJ(cQ{d#(K3c)gu>s(l(6Yg_Pmhq`lN%o@(~$ zy|8I!IDUU`I%=0E^P zT3kVqKaV2KTE!B0dCDq2p5yISr``yA&4U|x&8Vz8R!|hIszugxs~+Liu2er-v|Trh z*n2Eu!`7}9Y*z`Uu3xoqFRxVZS+rffyjHPYU#9Si-qWzdQlZxP!SwJ2g~>((^X%PQ3q7B%aJv3gQrb(UMMVY6CMvx*{Hnl%gd z(n|GyMa{Zlw4N|%-C~**v9vX78tP@0>g9^_&b+Kv86k6AVHG~0JlSdYllIn`Gl`af zQfy1bYH?n6$-XUn6`A-=5VdG*EMR-=8dZ$O3MIOYoU&MdFjA>v%SP$WR#^f5)jqb9JzG(uVwG=%Mx7g&Px|xA^={I@rRG|7Sn4BWMrj(=DsqOZBf_gu z$-XUnUD?>yk{Y$j=z${^v0-afnlIJ>GdBV3a4)Y^@7Ac@HxMlV$t%7IsTROt$)G?~>Yt;U#LTru6)>xJP*cp{l zZvTb5g2ChXZ&$T!Z%IS&P-A;wueQb<20$61R3BHgU3txKgzb6|2|b*w_ovP*;UJi1 zdkwq?_5K>HSrBs1EY)^(7hSf(isF6tz!=r@6>V29$5m|C1IV$M=)G_5RQUY}RNGZ8 zvZPiI^|DI!g2g^sFRN8-*Zmr+Ve46HA8k&gViu@jUPh^Yueb_~m(eOK8BHUj2kYI& z1#s5#4-n6Fn(cn@Be!U)z!Vf+Dp+UD_B7@BXz`i_cDgCR)8;M+F>myNvc-Cs(nh^0lj^MDtR8VzGbL z%Wf4LcOSAl-R**Rx6?>kK{HG3pH+%0Vbub?Rxa7&6~`kYrbWG9RYrGBa7x=t&31C4 z-fh-#mBWy=D|I~Lv|eO|Rx`p&EYvvWT*4vF%=wBMAj-=I#ERi+CeVTTZ z>KTig*2`-ZP5UCwE6xjF@9&>Go;ALLwhyS9Hf?aqVk_91HBzE!$-b~SX93aO2&?vm z3b`4!A=?LJO)Jn$i)H0B;; zapJ_O^t~1ck63#A1>+`pq-sp1xDrn-(5o@2{;JqJl|LUBrB!;Tc5_PSX5>(pP&6l2 zflVs4%`~AES%K9E_wq{hTt%(w<+X}d-8C>@KbuS?t)!pedozr;yqi^;R@I7|focSL zDW!U=;wVBdrBy}|jw_VvnkH=RN*hI(!>JeDV%LoJQ9MHRTt-F|X zaW!9Dr~sxiXJN;C$;q&3&Q{fst*pbcO5n}12>&f)#VxFY6l+2{FW*#8*DiaOV&q%S zQoI?S8I|uHWqd3_#<#X*_ z#Rl0f>E7Q>64c;gu^ImC!<~;yvO#iOjiQ^%+KTq-XsVAaep!6OC>~QNZnhiQa|O#I zY~4)yvUpb7?tZQ47Q{xZmtm^!ENbEnV|dif@Ya}9=42R(?t_>|dnqRR*2d$UGB3qd z=9G=NDGu5~Ce0~x671!-%o?V8<969&!(v-cw)Lv?WjtTfJH6iT)))KPW8L5FtYFth z*ef!lM;JHR)|(Rnd|zV;9A#UtunJ7A>`Ca=&s0y|Zo4<*GBke5dh3?c9xOa;W^Y|r zxvsCb4p*JVO&p4Q>mGKe%iDX{Lq+Y)xTBPCZg2#xue0^RB;`kWJ&Rq9Ex{k9lsk-% z0?fin%$enN!Et!F8QfZ4mj~SGa=xpq5`DYEcYAFm>DK#6W~*SgN60Zx%i-uD+GUHFNS9e5V|%E+!?>0|e=3GHzalMtn}=zb5@6mFnv+U*b?sT~(u0rl} z9OMc;6|RpP`{i+yR>hbI;QJao07q_B=y8QvHBqaqTDsw}{&+Ge&N;xeeOdy^;T-Rb4xhhTx&b zreTk|Rwq+YwN`|eSgP-D#I_KyH>%7+m{s1an`t3z_N>rH!&9N!w$B1$S6lT({LEU& z?Xt%rkg!RsV3_|eb~T3Gmq2P()Lf~`056$DpWV(qW5Z%Qy=`{jYJTxZrtBHRUnrH# zTQV}?oG{4D_`=7Iss`^`&cl;rW^Qu)1)ur=xv`R`ZNsJEvfc&M=n*rys*7FkoNYOqhI?xuRQ;;Q@n z2^8tnD&u>HQ(7llEx8y(FKl8-tL_UMz$mtctrh2Gm+ZZ=HSHyMkYz3W=mS9HFJI>1 zr@LoxcKdvi+idepx8A+DRr*p_I!3V-a;+FIw^ZL%>`Ud;73th6eW_2kxeeNuCHAEn z%&PXRhHRNl8@*O862GP1)~BV!@`ZLOkdpK5cv zRWz+armkuA2rsczuT``STx4Gnu}?{fonCMD=enK61eR?Lxj(joZJ-ueQ?h!5msp}V zYkb^pg~f5+vcGE>c-|{aT~4;xxz~&OE+DqmS%mot-IL8#n6$wEf#sr);RmL|o?rRQ zwDhu<_MlQ9HTDYl5Bk1*#m`ChC-PEF^^3*X3;gL6wb6zlmP+-Ly;O(YKXx;(CACM_ zIeVcPSZPpr(|DPt`p+WM8^-jLB-5GBO1tLaF`nB>OuLG2Dr$EcAJe<2-nO_>l$Yr$ z>z&;wnLboMm&~{8tG(q;KlpxN;!07e{?&_al5EC$8K(N+;um{WJy7e=uahLT{;C%G3?O$9=1vlAKakmKI`x;w-qwJ}0SAmIg zQ7SLnRPS7D*YPK_5q%X;@Uk5?*VXze9K>4YggcFwX{zTgGQD9;KVC9Dy}k-_wWY?M zUWe9Q$Uc#3OuLG2YHD{HFVj@tUR>kJ%XF1Bo*w688mL*2Qtc1t8c(U^Z1ZZV zX=f5I(Ny2xPJ4}~hu}3_HUjfr@v3Hc*vvVWXO-*vR$*9mr?bWd-S1A9d#kbMiE33} zS4?!!G(W?ld2bqmhZ;K$dudIZsFt!^){8;)_r-o>{!|3e_S~W>{m741NbdEUE8xy< z%)=aS@w~%bQ>0oy^0ZcT%gQifz1o=U--{zLkg+0$harxtjjxpqPj*&T>)qtog-+%X z>20Nv7|!CGI2R=HQ9Vxe@WqxOLcJkWKgLUS*j973mY@Sz%hYhE@iI;I_{Hxpdzr2> zF8R?4)2*c5URw>D;~RL*sI9*{(hxk<*d*+wy*!x~*;2@PxR+O|k8h{#J&El+={>2^ z&ihV<*X4S9DZvFJ_tk^{7AW@K;3mB$FA@QKUt{xdRJb*YZt-iydpV|h0pmBh_|qt| zkgK%vwiR&bKC9bXNay!MDrv z{^KfRhpqvV>#gQedu}>-uO6-ugPXJ^vTwRzXpOx9_FzjW#m#}$!n}-9y>_Fvk0UZF zZQpC*Sx|e`u2vc4Pcq!z;K#xJ<0cu+#tmU;jqQQG%BZvrazsmf7voefTwLiCtGuv> ztjbEKkCKE2{r)Gebef`Qu~|kY(W@3$I^|#%l8JT>Rd-%BFjwy{F7x4)VYIInnb*+^@TNc zEQONJvNa3FKIFFMHBkFh7Ka3jfoMpJ6ANkNJk78Szdt{_tlmG$VRFaFaydCIa|A zU2oSYa!#mL5l)4fuVlKD>ZOV^dw9(YMQo3WsnR;H>8u9LY4*OBoI2Lq)i{-kRKe7( zP$i{Q-&9<0*Gp*?jXE$OCb6IFHv7qZ{cHj`hpbUa>+PCFPF1QM?CVY1N%cU*_y2~` z%2HaPBe0Re8Z@n>_rJh0FR})!66$4@>Sv0qZWycIWQVZz4lM~-+o>J?97!6hdXY0$ z%}_6^(Uat2&}!Xpq$la0G*-j507#xB^{1Jcsz#WXQK}~?er?yqa^3@lBj2b!Q2z*w zo=ad^`Rr4>M^8>;2SCWyD(P#xu43nk)vl3}o&c(cDSowd!^r&y2f3Je$mEi~T56Lk zb*%|*S>FKB|1=(Fb$Pk1GT!fhGx1%BX1zV1^yLRmLT8sWtE-^ssp2h+^;!)?ztwmg z?dN5<%4olDNQT8XYZQz_*1x3DemSL9(M^mU34A2)p!&YzEP@Rq`Tv(BA4vM*(O#Ts zpX~&`o(E|bK~Az+bQ5Gd-peu7FSgVE7J6LqT#g8=vW~~!7jewTu!e0F5A$EU>d)Pm zhTx&bu)Vraz%mx!PqRqj<(cY1ixvidE=7LcDi+4y74sZ)3$L1mq3d1f?Jh&Pq`kL; z>RpTTySyY zZy&=YW=_;w&BnJuuNukM>?n4sYMn7&8-ePli<;KUZ52)XRh!#ye@$zVnQ2;Agpb(m zRDWC?9pNRmN^jZU0I_$kt*jpCG}}wZI@9aP;#yxAwn39i8XZwk^jzaQE5>i%Zm0U< zw%fkAOYrI}o7HOB`Db3LnscRrDl{@r&2v)am7O~ zxmDIw_!5x2Z|>A|yAD1CKsIDzN%PdS;^wF-RZ!BVqI$dH>hxYltMp|3H-;avJzVcM z&nH~Df^`})r}$>UP1>f8)#;rhEa$R2^ zz_L4?)d$dZr^_3Ym(ptW07Ra*Uj z#c9p-YS^UGTK#}zT3kh^<{@4SmFmZe7OI!eDi-QrNI`l78MgxD_XDfJ0>+}|0Phyv@$*u6HzUfm$OWyKhRKHa0JM|J; zrSJ65C80svqO`u#Oj}xPmXS&JI_2<2|e*Z6m%-Px00t@;5PFmHI>(0Em zstKwD`mE3~s_!XUpXVAIX1yF&83*`g9@a3pR}6|D00{LzX(-3-xXzX-v$`-~~dq zDQI&GQlr5rx}l4$STDm=PuRFUK0B`SC40)Mtn>9JIm56v5UwxS$D!Kz*?Tc1F=UQ! z;=gotOw3doB7UJSgTq2*8@q~c!0b-qBYKqTH;XIR@h4L>_Mi&U|H(tNc<$k@ku=O} zNhNw;8X`&t%>W&~IA6~Sd`O_)V&Q+|9&-tk4&puph#U^Jb1TFZkxOHQOA&gN>U(sx{L5es{WjqUHPXDfl1WU9|^+$K3%99L#>eAZ2JYI1~aJ>M)8gEHS|e;R^^8hbhHRf|Ky zniby%v`ph=n(P6z*8+)5OQx&X8~;INdbYDzZz(TR{^Y~8H-_QvtcOi>RjWhARTSTkbe6`;G}TME+a6DU8B|tTn{ZiaOKoPG zuwb^Z)h5Il)VPU5K2OtX6F%%tmuuY(!zlognDi+Bf7O}pSEfV0C7vGO| zn#4;q)q@yUlJXLL1H@9b_or2&Q_~tf#UXoKXe&vjW0b&qm>1h7Sc&qIOZ6Gi@sOGYP+P<@3vY)j)3 zsHQSY>z1OwOW&%wRS&jda=h5H>rDHBm(%p#^&LuBB~eNR=;MvR|8YMevxDTG>SBE6^?(` z;uyM2w<^bZ(F-_M;=LSGJ$-xZUWqpm>|pg`B^J6+x@ zfu60sX&Rm(-wi+V&1c~smoLjO#(qcR*l_SEJxX{^$kxT}X`!WlzDKEs8tcG+ntt|F zg@bZ$Y7g_Hd!omWKZi2rA1GnIipTG_eayq%gv|L(DbCS>TKtm+(dd{}m3PQQSM6H{qRrwvnYI&o^)%HR7{7z)rMk*@5dWQn zYWzff$TZWwgDCr!Q<|aJg%I;NFS}H4U-XN3*{#w;_X!8Pn0d(TR`rXd>=u(-W=T-} zdAsfQU>x}==bPLL+)*uw-^#h&-)uKh(-0oy$!@cs;Pi@qv(pZo);=50Y=H5e+{pVX_NsUE;M)`&kNqqUgZ%r`?UmGs}#NQc1&`!1T02d%9ujWt4a z9aZ1}+?mSDHq}2E=cIVq9N{jB1b^eWN$u^K35#4?#dlEcNaJOi>N$-1 znm?oiI4`?Y4`LjPYeahKrF!(Dwcw?at?$5c;U{Cbp^<0@Z|`e+fyaD|Y287h6t&*0Q-wb{{L zim5)i`1Pm_qxj$C6i=-6JM*y6^5U}iu4>p6;~NP#>5scp1n_;09f4!s>tGb!(8X4) zmtm?8E^1=_B#QbUs%YY0b~B8FGPjN<)+n_HX4=tSimBeV*bm{QxJobDzjjj`G{Ken zAv8oyOTvuw(i{D4E-I}Vdj&H9^Kolc{B0l6=-uC3PmPF>E#XT3HUu;)w!?ssQ9g2a zQT=UE@45)j$*rPyf5|~E4s!^Z+{$`a;EBa9WLHFb>81MK;uxI`qxZv3dc(GRD~-{S zde?3AW@MN6jdxK!Z*ew~m)$Bh!!J76#mqz2y!ht9P4+vCi2%N@u>)|_`W*zH#cH>V zTdL13dNBACDC%#h;=%Zk)uMfW5F*L*$J+Q@DfY)xkX|(jMxtv#BQn44uV)LvXfX5;U$*rUyCcc zBCEU9V}vzyFyJB#q4bOAAUumw#rX*O~WtGfzJq>EB{*{1s2;%sCu+rt&u z{y8t(VYlS)H;$X^g>cM9_Hmt=7$s@EOjEsZ(U-xW)katw?@yVopG}T+>+N0>*F^y} z9deIa1#81Bwx*ixNFTl9R8L%-v+1R`N`LUry6A=6L#CJHLl#Bc23X3AsCs+wc}~&n3!7qGs|z=2PaGBjd|zXW za9rRN`>H@y$NqF)zNwzNI7*m5og%xU$_UG!Dc~C~5VCeAjS_Zqttn`WW{CANO!nGs z9~Rr`ZLNSLoHWAL#w7nU*T$}*t024My&O}$c{`&idh92Y*%@VR`&3!SsQo4{j3p ztVOHYPEuofi&!4cqN^&pAc2=;s>d(31viZ3cjY8w!wAM6bT3XN{d%+23tKbO+kyb9 zRdfSnN4$^YomAgn^q_b-uHr%YNx|`SyMCs%wLK`lDp0xhr}Oen^$!RqTzo7ZJ{%KVw61d=$UhcfekZEWrQOzwYQK>wTU^_7}OSItAXKNRl)^AhLd5o-jm#~5jK zLhd89fz=ESXSA1MvWL+A7Q$l?Gtcc-()Y;5E=(ch*~ zY`j)eCPF277;%P8_C4H|&<*<5OBCzqh6#c&M=#zrv2$$g8Yv-{>br|;w|U8}vNph5B)R*WE&Pu8xugMRU&uWVq_x}fAFNtz6J0&d zXUXoM`s%Q5=F616EyVbO=Hl6g}wgk^LVYQHt(r41P?W~0(-D|xsgy(4Z2z`P3)ze>a*Kzx8@@4vNczQ_8%kB z9=6`TEoED_@J^&5c&M>+uqV-OC~`0Ckk-pO)vLGD*6gvjSh9}ez^I!2jSB172;_=f zXgTam1roybdkkX%V3UlydW&<7ZWZ5BvaO^Il*=?T)sGj~CGwJ7rKjVvLb6cEhwCdz*fut8U80;~wb+(2)+4=onCi8Q z{d5~f?;D)-hHXz&>8ArbSORLRUoFndF4dbC#{qfStuhYiM=f^q=^;Ve5VUbXhW5>h zUZ8(vw3lM4k8ga`8m}2!c30N2d%Z&O1gxxeJ`qZ1va{Ci!*3En#kXj7CGiqX_5DSn`I9MX+g0hScwI*HbbD2;+F5*^ z=z=6ZqPJ5$f|2MABl<_2L<>E=Wr@y;?;%g>ye1=hveoIq(g7=-e%d+=+lr>GfFXJ~?4s-1 z*%j~QnCk6|nt8)C^ABkpPqbRvn>1{et7vAF%h_5<3p_b!1USvGR?lrT0K9yW92=o#g@ zzLBFXcRFk2=y`X#d_2YtP(EsV@CO-q!q#{1+CO*vXtLDo^^-22`y4XI=*7oPjw^C} zui8=UR3STKyn2}G1Ke$M8^?f33mNBHQn`Hyxjo)q>m`kY^={)ry_@WVq0Z;#I?Z-J zBN_4wnd9do#IQ+@kBI=judyZ^7bw*r!7i;a{|M0SR6pT%oAgVdwW5X=53q`c{sAQY zSkhf-w(I!)ovC!Wijc{sYG||A5@b8ZtD&jhz&Pic11b!ReC|qaSzHgXR1N(g=XQD@ zH2FBU<6y^x%q;$9ag*BEG3Oe8s#=j1VvTSguVYkS-r2P&_xHh9Hn z9Wt-@Tg6TCn$0P}&>DL&?9qBqc+FaHR;ZU%suwSgJ;sV>MY^@h*yBsc>U_W6?XRuQ zw9j_BD_q3}%`0i_vAft($vW!9Z_$oX{dHsZoTjL0rKYW78GJvdcNv;&jU(riZmWJV z>{0VK^53`~Ls>qSAZCQ<2 z#X2y_Z3Im zcv-D7qv)bwb^F+S0yE?~?Zay;XOiyzZfE5LntVZXJIrfIwQ2XIA$Ukf+n`}I?JmBm zaf?!Td8Ycr;#%4KxfEHtRo2R0&v-^BZs4;m@STI3^e;Hp%1-$e#np+;!hDR5QvG0Y z%r1WxMT}O_xffJMQPm!*udXHyT>p`O^f_c(;U->7DzlDx$qKVp@oj`1NxVc;y=8ID zDKF7gW>cImCOT*fg0$vTA+s;p#x2f?hs&SwW{xcX=lormzRqgUoIU}6 zXs}6J7uT!Jwi&=Z+)sa zEUqi*rL~GL_j{1myVq7$r;=Vjow0!31|jQJ(z=q)VoPl8Dk*7QQ9WaErj3_f^k!0R zfmH{)n0d(T;%^r>X%mcz0KTuW18_u}z~ECc4eS`N&ZTqyH=T#v#gMtVH>i2K%JALccNIxrd3hGE7fZj=j3=bZIy9dO9ro)amc(< z$8{;ZDjo+t)N2)xy=1m-y#x)CvTTSw9m zJfy27TFhn!t1H5*X{o-gIHrp~g(6K`Wjx|(Bz9l7b1rG)geWm{9CU5S76EBIqO;gi z*VKwxox?ia?r$*Migkp&9$sj1tpA9{akUxte4R$eFU#i84X;kl19ubj7n{q zBU+|Ksot$f=!Ow`uOM`KZl>MrZy7?<;;KqC5Awd}$zH7Je?>%#-t$%Zv0k1LdLU^h z-R5Gw)q?LQYzYe$6zBAuR&1SEBg#uI)sGc>U=iF6A@?2!xtMpzZ7X6AtVynB3}{T3 z*aW+Yo~@mGY|mC7)KA%nmsz2r`19V(m5fd(*H!$bJCP6Eu&uuv(wuguv-$+?bEnJw zuUHRz(=?dB*oGhZ=Ckmx%a_vtes~$@mM?x72&)TdcZwV4PZED&q7LyWy;@m23qxz{ z*|1j>DxB|cLG31bv35GXd%FsCU&i7=j)h(vEw)QEl-t7ya%oW+1NVyh(z@8!^=5#jt23aNghxJny;65{o2f9<%+2>#=2 zdcEJRFZRzY*w_R>oAA4Sc&VYD7K zXchV=+%Iod(X1(!hGvzaURJ4|q;Y%g>$p0Q9I-zPz)|~>UW%+H?H+ts>rlO2UrM^i z+pSK$G1ppKYPQ4HvN!Wzv}zITPebrfV=ssOg17im+2uInKZbGL*Bl!`bQshr_1|CaTRka({lw(PqbPBYgqRxWJ@>u z#+K~EKg{b`>}qTg{wUyDsRA$CS~{Q3-bM69jqkF3QIT({vr$)3`95OtJ<}6l&w}Po z8puJ&eB*B&H_7+iB7pB}YyplI-$oS_&~2sivQ6}DjqkGUk;wLyv3nmzQ3TBlm@UpF?^YTsg{zXf~ z%Xbx>eYeH;RI`T$cB-^Pwz03s648ra0JfRPOEuL`xXYdw5nGSazOJIRXNss+bWzA; z=at13jB0y3B80cbC4ZX;`ht!qWT(l+WpoK!GkRG%c$eRH`6auFwWeXLxE%O zaWj~-{4)2u)8*~NDqn6mkh6>Z)Z&32Lz^S;bwTiJEVxOn{2~#+_cb;TN6^ZGQLE?% z!;W~b4yO7SckCG!+v#ny16T7qiyTWU19cF!zhi$9$B;+J*2U8}6)MMfr6G8zv6sTW zh+{e6!-;vxXytLL7cs6C!k>ttwR3HZBgUx|Pv;biY3?DDo6Xpe8aV6U!0M{87r;Iz zmlxO2x@nkC(~eWUf#bHt5d9@m(^mO**;LLbt~cHQ-?n&-PIlJXeg0&_9aVP|q6wR1 zc1i^BeT}^gjybcg;u{FNlX!`ydH{FWL|+0GRAvL8Qf$Y~w1GE!<@_q`x5=F7Y4|q! zO1+;n=9~8?LE8;aNx79I@772@q>`)`+hEv?^wLZ9^u=-b{Am=~3{_@0?aS$%Y$f&f z+A8E6vfV%&hc8UptjGqlGT2Ki)rS|Y2QRHvtcQu5)_rTumfGPky&n49yh_%CtM~@R z?j&BKsb0ICcF#k!hp)^Y-s>S6e>NfO;$i-~SMA|_X$T(DZ~11uXg0292ZS?)muITK zF7^oX=Tc-(ROu0ZaUsuPvs|f1*d(=#pN?j&B#O!d`8KeLzUD*Y5MG>Fbn4%xz}tuX(%pq*4N zU!3#DpOEo;$T`0mVyT?pX>-1>o7B(2w=NsaKCDatd4+6uJd4+q%D8LJpZQZas-OsP zE16e|Q$2n=Z7m*03&}paD%QvzgKivZ(5$z>>31?{s-Iy|y*CZPLyaAWy`j0)qC0uk z6L?9cdjFzb&7Vq00a;Vws0nby(YSL~b z?Zsx&3z}@&%s#G(i;AytU7W~EHPurXb+(u4Dmr^-O7&FIO8UtpG!J3qoW}K*(b>gS zpt0>s=B1nJKaAr#ymVLbAMQx$7F=ijeJ9}qE}aW_k&vyCVO~pW@5jD01P|G`4z9DE z#n+%NNa5v~>OG9BXYl7z)KaW64|}`Dv%?Are8yikyF~U{yH;RSn08iygY1HIUcRXw z#%PUr`L1G(jFs`tHCwo2J}UHB3ytjHR__?`CG*j}gX(vT)`*wxD%QwoM)z{Ecy7Mm zU0du=w3WQl7zOuAA1gouxzILx)8) zf@YewDh#(qd{v;K?N8_>oa$p7vDX!iUniA5#zzDF)IPuG1L3%k#=f~zL6iJg{ti>y zioAiF#(@qR@9tW8Q>+8>NAY14Debn(!Ety8MuQ@t*xvcO_pF7M=$VJA8C~V zt+*+mMwpjTsy{G(ugA-1m07LdtuiX61_rG~uje(RYSG)$5Iocv{}P(QBo^5wRfKw3 zrF!>9ZCe(<3sN>FbWSKBZUb)Sn9zHa>-xros^4Bw(phV06?`itA1hZypWd#s8Z@U* zusF>|g9=Vx2!{oYQzxbn=%tkEtsAw+yhTc-J$fxX4XQo*Je5*7FJ%A4;}AyJWM41# zglAig?SVg4N*#=r5lZ#AMZ1(&`$pKMw{b$#IU-xdF3pRpyzP}RuNI|x(V|`IWweT2 z`dpRKtz?&`Od58n7V2e{>Jf`}sh8C%cIk6;R)c=ylkL)+NcEks2Kp%7PW5a>yVOf* z6}$A=Dy5L?mat1xARUaB*rnU4zN$#*h7o!zC-hLKvBsCh-Wr5v#Z}Bw8RXTWR9{nk z(|ZZ6@}_^5LMU2jA?r}`n_l2(7^G^Tm(u8Wa?$rK?I*oOqcrR{J=yP+0ja*~l`t=( zRKL@xy%uonCB3p<(q}4+;twQbO^R<2++;85%_4yBYit)Bc`vEp(I&La7A5az(db`tarZ6Np-*S{8Pi@bS%G2B)9XR=N$Yjeikn%ZMxalNjz#~{hEQ5X zi#|=IG;l3SYcWY6b2X|3c?l)^mtvn2qP!7p`loV2)2SkX6H4oI0vyxgDoQjD@$yOa zE{)kOdR#BIY<%-E@j&@=-OTaLuT-w9j9a$85v;DstE98u^95_@=62}yz}epPn#i%( zh9CJRpJsgdau$Ner?9D{Ute6FO3th;EhSxe)d&5qzacH0>=(U5DQ=BT!hZ`^kuy@w zs_>6=9;5o1;ut;t3yv?1Ts>>H-s{gNi@35fcIyYtD}K`gH_7Xm z2;ln~I{-(}uU4^h4eN;Ua!d6?#cz@DCs3qgt9*;(NjA6G`yDj5q;HW}+^U`aCetF$ z%P!SJwcWO7qt2B+{wg~6Mi;yA%Lv&6)rS?=r{_xM7e7qc2SiSt0(@kSQvF-en)Q-d#hQIWO6J7ejH+CNwhJm)vwE>LUd<>kxn#dr z9LtL67TE?>JhP7na>1i8+v%*LOCe}tX`Wf7xH+k^2K?6RDAn^7-}+wNTIH?(I7w*G zbduKa%YTgWt)H@4(ykh%`nY!3eOU1ecCse``yZ)(gX`GjTDJ>}|4y$jCadT+IJ~xU zCg~#jA@^fp+Y&eFJGfH>@O_OPf#X6!(NmRL80&riQ+;1?y&wK0ir)WKW(qu(O?Fl< z9yyG1yvhGg{RuD6s&jey%w8-^*wf8}(Y1QOGr9MoBiR!f0j(=s{jB zO7&*#uzdp261Xx;;4wgG8+2&@#6-Wdzu8KToITr1z%B@!)~E5`uxbh1m4@J<#$F2h zg`%S8%GF&nC3=?X+1g=`fsH;{NpY3&1dn!89JIcDO3JIWWp}3`c&M>Muy+$IHLru; zvep>Y%N2Dne;P%WY?ap7cV_fT{d=r)Vq#0_V5{i54t7L)EeWcRE9zh`#Z`3hHaEpv zMhEMN8amjD^wB#)_Ji4WaI_$<%!2q1HrYz*Fgd~K4-2`)MjDamEOw@RT~*?@en-fj zFnbjEI=oEFMuEpK2%y5&XV_fBCf52L-T@!{C|Xiam{#1BRU^!+U#Y&Z*c0Zp4yyEo zU9B<-xrVG)Nj+f-kC`o?2YCsl`o!YAFE62}O{hMxN3n^%I!_TZ4w+KYyf353nJ(2U zqU4QF_I<^%FUV9;k3kh}dKH7OIZD@8(45k=sZ!hwQZ2}+?hpZdpRS;x{XCUfvW{@?yPxXM8ngSO;ygq7 z?ysU-2TWe!xrW@5dSXhai+@2LQ>fP literal 0 HcmV?d00001 diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/TitanEngine/TitanEngine_x86.lib b/BranchTrace-x64plugin-wtl/pluginsdk/TitanEngine/TitanEngine_x86.lib new file mode 100644 index 0000000000000000000000000000000000000000..25af27d89dcc2d25dca4dd8df7de3694749beffc GIT binary patch literal 106034 zcmeHwdz@WWeeYTX5fMXFL`1}Z$lH*FJOB~$nve;TWSmSMAQDbyb~1;|oEguYNhXMZ zh=_=YfQX2;wUkn8Ev44lmRhdu^?JQrZ%dKl3n?N}v=kLBBI5o2)@!f#$>tpR%lUkM zv(Nthe(U#L@4fa~zrEJsr`4K6Bd70o;%xVC-olgS&z(1S?)=3rf3CWnzi{Cx^TqG; z_hW3v7-QeKpRs?L#n`>88T;Yok{-R6F`^&-OwyxUaSwXwPOFee-6pJbfqhVvw?`2yoaYk?=| z8eBok?~t_ONX9|zx3>!7><}jDT3kVVZ%L;&7$-Ud@gQ1)d=qp7uAtMuE$Ixzo#<@{ zE9f~~K^LJ6h>E8qE!_w41{Fvrh&}XmNsm2?`Uv{o96@~eR3_+bq><=?CnfDb`iRas zU()brq4!zFzWXIXeCTc_XvXP`3;H~+puLd~MB9cH-G?h^`$|FVfw?G8(08^8;yVvz zf>zvwd;<0CFKMEWaY4YDxSO$mNB#*~gzF;4SKpxsb$9hL#(uM}q-Q_Fn4nW}1^xOy zL43_>loP1$VM*r#m*^d+KSX=qDCq#CpXepXOQP*}N#fHeC(w>>2x8xP5b+0nceNn? z?k_Vz7hQ*P0F6H+ss0?}L>KIoGz<9xV&6lXBD(((N#B1A?E>`BW~VaXu*J_6M;`O z_bEy9A7xz71g@Y{?vixsBE|*Xi7V)>h(FQM&?h?P0Y!-4F`%O^Q}i^hL^CBF4Vy#@ z5g(#OC=)@b$BRGqutRVxqP-IRe1W8&-32|+llM#d zX+L9v@J#(F=&9L?(Dt9YnekN*DH_HVv=Z?mI`eT!D-k!MGaHh6E<^uFgghY{xmD78 zp+j^T%0&>K7ngzFhx{PA>qy!WHzM5k(K+3VPpNk}h7wxFFnL z47y~#q^uCAE+zM3YR>1g@ZW0b3B-*SkQwW-7WISE6Sny?Yg&L!g~EO1cpF zPc%KP=m}gw7oH<&_cq1_p&srAO`)C$IvH0`>uZv(y8-zRx_&=N2cn#aUWfc8dd*iP z9fUAMul|Ol*B~xLui7l>mEUHZ=v9al(W_C$LlA_iE0Tdn^q;UV=uuojPaxicw&Du<3E}|a9BCmc4wbae1sE@Y>Q_pd z1s$S&mq@zk7>rjyAGt@;E%z}_^r_X7Zajis ziQk}`pON&*M;Rx&8Ff|Afw+P`hH@pk1?5e21L8sSvC}1evWak@Pu)$lWlQgx{&fR` zTUPX}Up~;=Ke%pS%V51#YxFd>*Bb@fvSsatzP?b2U1DiToxxQb)}FOx#nQp0Y|DzN zv5EfX_)sx92^00Pi7hV6l5dJAfM;p+Oh;6R>FC7l^h_&DYl^Y)=5E`J=8z5f+c98R zrQD5%RM4@|cM%&V4go;Qd6tG75v8JIVs2x0OkCEC4^NF!>6)U^ z9Fbljbqq)`Sf$*JhE&k8(036VA`bnv$yU+dv#O{K7fl@vkLlbRLq4}>y49==wbmCy zE#$5?<#XM8V=Q0~6qDo4*2?;5p$wYhib+DAu^bhxtT%?&?JSz3HB%KGmUUwcxjYqN z&xp@;?~SQ|y>!@*j?F258w(C=`S`?cFCq@hx-kY^-T+$V&cd_dF`Zju$LFr8?I@Ox zj_N`i*wmwILQE3!jNzyV$zEIR@~W7}bZ(6~pX=P04JcrHjJQ3~l2Fm=7Z!bJPhR{Y zf`Dc0#w6>D*7}iJv+(Ok$oDzMY(#Ko!fMF(ImT*4u%Z|(TCrS+2m+Qd9FqjRvecrY z2s3S8lpvDR-*eJ@ReWow#<5bVts9!c~bdYdB3SyZxx}M#a21EqSmVE zym468jVUdcXWdcZtf@^*6vGtlh&^Ay3R|Y!V>-97IM{WC(&2(c?S?97kW|;~d~jIS zjfsQHv+h=oH^Xd5%PmP6TaW47#$q6H!P0W#5H%ZU^iEQ-t?291C1)|rPlIi9Hq|He zxIl+>Sk{dR@A6QeN9)@g{pRsxG0e|084k<3G1gsP?<5s2rEVi&hD$pULBKLLW0IBi z>1ECF9R*@80ZQ9ZQG{vi$7SHk(ctotVra+usWF|y5kbJRZM#+=>21_oD~hdC+qFfD zVSXA5Hiv$%t+nbqiy*wi_VgTEmZBY(GXD%9v8)@%ioh3jUug981rb7hRya7SQyb$Rw(S)e{wS`SPG zY=m3d-&;mc=TOL(X^kpJMP*h*!z9IcCgJhjDyCcZ1He*>9}DO)0> zJc93Y-TTsH$S*k-h^j3H$`UOfEo#l4>7hcj1vxU)r4pAdpK3OXMk^I2Azj}>Co|Mn zG`6=!s69+h7Gr278Y(GHhKL9PR+&*zkpxY~#t{U%rR}K53S4S>OzT$XgTq==YYmO` z*IKQj*(iD;|ae4H9U53|pbk+LuH=e4aww}BrZmCDV5v8G#QqkOsA6ix23=|Wi zwV|TawixQC4qUV{4E6-7+T=eqZ0HiUd6 zN|Iezq7jG|Y8ekCp>~;Haar#q895WY$r7R?eW!;#8xyzGpo68E6p04?2F^F2~ijdVk%_iQ%(S4f-k;m*Eo4}lQ z(UfzFE6N8}MBuV8S~Td65g~AO*ENSxpGT8HY`G5EGfgq;T{`HaSb{*e%-g6a!Zdju zml-ZvBx+*euW4M@(mX0lq zgo&g^dDm{hQ z<7IznB=R)!gwZfTB%MH3{2YFmHG$Yh!@MV=7Y|g*Vj-f@(?Pu0Nw%MJ6frFc5i<5I z>*(|B!bx?_I7Kk;XCkPNjxemF8 zd<@cQ48)0W0iqYsN@GuBYD^9bt@TE2))Q*BnYi_H#1gC;AKx)av$ccGT4S~oKrviz!nLNHysS2HbZwB9utJZtokc1J5otUWJ^rNk zm99wb^(+lHauE~0f(T19vuMnz$j8KqaEa)L7Hmb^mLESk!pdm~nOtc~B_JY=hq7a3 zAqU}YJ zv&?^k^||i-q6Io}As?Ksvb56g95YsS;%ZD_dnvc!GvKru>h=|z(k zW_9#Ern#kMrN)$*c@Fu8gU(fSc*3~V-(?hxsK=enknv7QOTL({QMWNfIc;MrB*T`~ zB&(7Un&)v|$4Jj?*0!n}#N8Quq=B7XCX{N!~~RND{{LFm#6Q%&LUuI1}21i$7Ibml?G^?V8(Jn0^)a+$b^-%@r^ap8qN>cU% zIgPZ;)Qzl)7Sg+p{2h&UAWnn}K)ryF_tm#HYt4GCfhrU(cc!FOp6kQK0W^_x0WHdZ0C!pD8jS>d|N7|usk*4*(Ny6q*$9<+n&RP7To?@rH9xJ_P9x0J1f*Tg)QJ^MyhCa0VSGXj zt=kMjN8;cI&!U%gI*ma(MoLSz`X-3FE7WRDn;k~jlSV^DqG<;ctqMW<3JF)WWnLW)maREJ?8xVCCVg#`vyAGGtW2gtdZgtk*E* zI#3Mtk4|CQ+f5d%7)_MLB0XFx6;~myKXLU1&QsZHFqR{A~|$Qc}&Q84Q6C z3*-rPnEo2v$mESlv5KW5()y@RXmRlXu1tp*R4#{!K!I3?6Yy}$miOibH7V8t8H;ql zP_9D?MDOF|xJ+}Utwaz{sKYErRiXZhoX8~4&-j=|I&|5X^Ez7E+qeKNZ7Dgo3Lh}r z!85OulZLT~;fS6^RWA%G^}qp7X>tK2cToI^x?q~=&do``Q0%8Fdtuw^CJagh$#k|C$ARun_c-4kY(Fe-{L z%SM_IM%e2oilKU~bRiTa>cqlm$k6I@)o2ubnTLmI$)@GRo03ZYKy8(yh zA>4v?0_Zy7F#Ws>gb@t!<|oHJDQT2nEe*s;7y@5=Vibkx$iB3t5RwPH4Z(43k zFb=~)-VVu{^wTPg2P!JONwHU2|KUv|^`Q|t<{cI> z3?q@#E#s5cibO4|EbBXsS=8jKj#5MrunbsCB6(smNX(#{{azx1faO`XtUw~QX$-BB z=Em6((A)mHo_>4X**X@1f%(S*-gM)5gKPk|iTw}6)R3IUHPL9Jm9irJcFapr zTQy%nc|N(bRc(|KVmyJR8T0hm14Um&rY9dAS0`?vePpB+ThF&7U+(g8adqMrYz#S$ zZ?ETTpp%jjv1jGlD9Ku>8vu3Fcm=aQK1$0|60iA&rlH`56^njwxD-1gpq1HgW_zL; z=!n%Kyb=#P{;6%%Tm?K(L{7*ApyxHsP^?_)bVbzYVX<+u+BQIk@|Z|-sN*paWaSin z)n)cSC|?cZG8jmPh|6GS`sBsfa6o^}YZ_)u0^XW6n`5djTYTAUeT_*UI@7IrzIl^7 zwA&*+4qf)-(C*RE+Lk6ZPJxpIz1v|sswh*om{5eO7G*m6!}wTLJ%>yCE;FTH+PCyg z15nW0@IaEjk@VUYd|S3>T22heqFexIXECD{SX5pyGKlvXofXNPT41xCv8dd!g5_cP zNhJJEDQx6J{?S$D*PD+;Vk3#ag~S_dGBc9Lu(m-W7Fa|nst%PNwG(hQFfV*er;G)IHPQFd`+2fTT^o! zO_QzYa>`tj2{65o5=@pKMg^S8XND}Ef08^uf@{l`q?uG z|7*r3-pSb`pszj0*rMM82mDJx`(Y>XouI3}jU9wR_nyPqvUhN{xtFthKr8QK?B;JW z_C;Ke!S%{>IeQlLOoOx0an9~|1!qUh5@uzA}9h$DW_ zJ`0CZfbQHE;rHVJ=WO=Nzyn=`->XJByBcvs;lSY|2cBUa-A6XN}Wg;|#=Y31>HezK#1;xWD#ooIMA6 z_9D)nDmdE*wy(zZ>kr{X2jt_N?=g1jFfh*s-UYzh!P)u9lh1wVb2b<0-1Z&D4&8~gBToDGaMm}$+1;R9{~h@bx??r+7qsth82b!P z$~YBtAIfJn()2LO>rmwFoyh+iVf)Dg5YLxzb{A|vLf#w<+q2)y+2@W#KH_@&@rdIIzy{65?_bVC*@3Qn3ujl% zLAr3=2iNmX;_Ti9$b%Ds5864GvoD{_*=eVs92P?c`2gg2f7#X*6TTY0`&ADxE{*c zHt05SU4Z;p^d{6r&?7HLo+1Bc9>CefpsS#JDeCIi2hm3QQHE<_|LxEj;Ow74YuBS~ zfmTC)>IS40^dR)kh0gRkv{}$`8xeodQJWzDIm#TT^&I#MoCfq?DAy+$TL9i&;N6ek z{Xa$f2hDy8Z58y;D%1tg^h(s@Ghq+c2CkR&ATFR=N5Fe8(sCKv1!(pAP`@uhxn7F) z0on($i$EjqLEeMzf_&A*xPs!2Q>2 zC=1ZveiZ4r4s{9na{9F>2halW4*3B1@8|3@S0LX$gtERGW$|IO>#I;FaKA680p1Ch zBQHR=K>v^{kx$S$=!57Rpm!6lH-q#KfZx~s3co?u;C}Q!ancm%ktgsx06h+SFXrDP9QCU}c|`s$*a!VbUCJJx#o3a5 zOTA+*Dt||U{*Lv#9Qa)hbSVe!K|k}mzu)D+i;)BO-GXt)r|`_a5zlbYKA%9{y9r}) zT(7|OijU)24SMEgj0--AXEv?}g6{Yjo~a0X&kYz$;CBlTv`AhjL`K$QL_;viF{04qK|2V&ve}v!2KgJJbZ(s+p*Ro64 z#q2%oB6b;nAAc`DguR~iv$wMWww_(dzQix*@8>(%C>vv!vm4pR*%j;`_$S!S?33&t z`CHlP>Q}#3Ve)duJ6~2?di%;+-pX3d`i(kOU z`6wUb(|k9-kiVO^_!Qs4PvJjjkFiJDkJyjdf3U~d_t}H&-`T_LA@)7?L-qsq2>TBE zF8fdR1p5iQo&7QU6ZU`D|7Krj_pq-a*qLk<`xLu{t!3+2i%qfD@k97)_-pyW z{2+cHe>Fdny_vn6UC2&hr?LatYuJ0)rR*%$$JVg_W_$4&9D^aw`P1xI>>2iJ_AL7i z`vrTB{T6SEFX8*}OZmn85`GbX4I z<9&QBU&EL49=?RH;4Ar3eimQGe~-;I!%WxkcjGh@QW-Ohte8!R)%VzY>ST$qijI}e)oN?BS(`LMF z#=04MsyBmm{!t57v+QGAoLgGV@fcV-a5(aw_JkGZ^+2Y6lfc^#m3BumJ3m@CP)%$U zEsyP>brpGJhdfFH%T08ehs&n8DuI8@N0cq~t;2c5Zagv_6rsc})FS?JpI!5lOqmU6 z?C&@wQ|yc`f5vu|l@jM{nt)XzSbD;vGEha_$!*Qvht|CpwyYiIY37jR#AWTvZ?gauw5;riadJ3_n=TR@jXM-^Q4V}hzuPjC%sbKNa*EgS=drz z*maPR=96AHQmm~;R)k#zdzC#UF)`Lwv3%<YkLfiVE6|9V_l>?5N-r~gN6s_yxB4D8 zA+TbBJhXNx@LeaAAB^p)kx<`xW_e>8X-S zVBpI_C*PR|6zo~|B4Y)^oC~HD)IAjNn1RPX{imverh{11e|-nvLB}_cWG+t_v78Kr zhJIpNH$pFRgbY5o^Usx$s_rQ+6fN&~7*ew~oTsX3xqZ;B_!LKVrM*a5$b$_qEf){} zo-(4;uug^mQ#>Q(XMg%`J2nFL_9?eS^iX%UA&0EodLK6t?-9Wb_7?|t4|fWOrt2I6 zMtJ~~b)!dy=$g?AJn5?Q=x7In{Oqf{)&ug`bv3pP7M-WGzBT9Z% zX2)=_r6a7~pB)VEusWY3qk@kZg3Z98X>I)^Fs*wP3;h8j`~*#*x8Ix}rUMTj<;k4$ z_>RaBeLJ8`z2q1PJ#WNk(vB;=3KkQVMvas_fn*4{0r)|U8#%eZDj||6o0_~=o*1Q2 z{_?*!Kqx7YUsL$%#4RHSWrHj=ZFEoM1k-gV=6zmbrnO3Awqw6Rx0$x8G))mBRsR!d zchfMjnVNdKMYnfTGV8-+7^R&cL%|+yDL59KJ^w{7$-JKo;0C4eWe zg2=ZACymshiNUJut#xd?k*#5ikua)Ci6#fEVA*lDm=-(@bO0WB7i#ND?z#2ZQW`e+ z``+8~vJ?|W(DD!i*_rBqCC^Sm$#r%jcLOOr`Lr(cM22;QNh9>4fGDZwfo+~7<$(#7 z1i8>lo0>a-n(3th>>#y@mx@v-w#pDmQ*xJyL8jSFJOH$XPOdm9Fj@cz(`QQq02&%O z8|hoQRqpAGdM@3zqtd{r96O+FV&QzDm+exFgvdSNEkH+-3+41Ac!F9PTxJ`+BuV4y z{ZS)%0;{mR{g_Kzo`8bTk&vka6NONo7ioTq^iUw;%LM2jt6B_L6A1-sZ1HwC5XYmO=EUvn40C zb!bj%N6vf3nqczbsc!KeWu?a#$)u0UeRD&hjTYH&)iNBBI=1Dkm5HLgm8xaMX4}|0 zoGkrih%a^;)y()VqB*HBO&i8IUvbKg)%psQAV|w%nUK^ysy3(9ES6H+Szwl_oXy9( zoNPZT8FVSd;rJ)f2P_eE5*vI{|E8t{1ia5viei^H^KJ@r zV&6A{RXe~1GFiGQsbe;^)mdpgu3;OYp`F&ZqGhw47})~Hj<;`|w%Nhnb<_`;fpJ;d z*!IE*#PR?-NE*C0^|82Ohe&%eje1b36Y^>f2F9&3b>`kvs!NVFbw*70KuK`Sf|EH) z4oo@4UhYy!EbFi{+(u^1z>O_MMcFEjR<(zkxl_`_sg=;wlVu{I`bLE+Z&AvYE=D`{ zJX%WPS&=rp2`+?nIHZIx<@C{&a=Q+iBQQ%~0ZYJ`&3nYG6O0%Jp2ebsX>Xg7OZ|y| zPuM1yocD0=9R)d$Z3mGYqoj8o(JK1hQIG|tRf6G*7DzShQ)9NBkufuTxy4R|S>}$T z>urSN>=2_t9cF3AW7E{4#0>-{rJf|tH(b@Fnq7J5TR?gKsrf2U{J<1FL7PLsX%|kj zW2oGe)7-*%xJhS>N9hbT#So6z^c`WjKdaBtfo&}v)ZYeG!1zoVP5Gdr9mlpJ0YcGb z*=p+50#T7V;$ACQJEQ7dvgGn4>6UxCrDY;TY8NzmOi4{S64s$Q*_%t-Kr4-zmM=_^ zO$v3m*v@UpFcssN)J_qm-Tb}FOwiP}Y^8$yCFhMT%t^_2_hHkaf}H{#fttfDjb-*V z#OOzc#n3|=!2=hQ=YbW;mP(~Ey54r1+G)Fb-N0-DsE;Mplg{?ChL)jI2v#Y~=euPb z{V#Vh_lmtcG1czxu_*;uLkl<2G$LyAirLgBLc|RZs_X^mDK0nXPCj0TJhBPG%-X2 z&pq2!*YyU{pOVWrFBNZU5c0E1k4MN%q$_d-|C?hP>slxhxNKRN+Xot0Yl5_~eDx;q8Pm&?bNKxmoVU$48QLhd@ism7P zvo<3(WVGd$Z&Ha%mMnpf?}$w5WZW#7C2@V5G``KXFf2bOrD+fK0+tohI5e507*0$} zJcX4#qgck8Sjr>HQc|8!4npZ2=+tmEVSXt z1v0A&$zBOPfOZ!O{i`IfRE&FBIU0BuYqj5VNDfCLE?HJo(|%VrpsbWp?<-p^>4Rk} z=}f?z?w)MnK@XKZ+x5gtmBzud*!RtfMF(mT4=t_PW-lq_CnY<1IUS|zjl9!qa%vGE zuHyS=`6hgMS=}{As8ME$@5`lL@2Tt6~f&y`p}mYCI+Xkr_Hm7I?N9S>WH6k~m3recenDJsGD< z9jVnUCwR%Ub6s=k?ZKYA3(UI;QOmwv)tclwJB8nfU63rpmTz2)TkarCNs9Q%nLu*V zLVL>@wljffAv=6K(y=#FW6koKvus&hC%*d4*m%?#JMI1IjB4OrCnd_aE8<6|BbL@M z$+cBv{z;B!!Yn~JUUyDBVk$n2(V^*6354m1xEbT}Mt*pX3hF_`8_!pf=8aEYTrB+t z(lS2*fHv`pW>lyUF`;X5%wx}wOIp`AEEm+NfXe5qj3c&tqz+Ar!eCNK&S-0R-=9zM zW5j9;J))#fB?Iq{pxGO3WtvOt>1GS@-SNvJFG(wFcNbPc4B*tIf( zEVdAUq3WA=DdBETHin3``nHnOp;B$xL$$g;A05CX4|ZVI0$l z1IwP

Nw02f@u`lpl~feDT_455#mzqwi}*Sb8hEMIztEl+R*P6hx5*&9nsUdmy?N zl$Pg!80wI7SbIxly~!FxUxJv~k0PB3r6erSQbuDcF|ws?2;I0!CC_cItx6k%uGeE| z&Gmf@eG(MN^A#i9Ax0e6&NQppGE7lvYe+JMkqVVym>vbfXK%RDRex2}nHD zUGK>tQzJf<8Jz@-92=sVqBS?IgH5cO>Z?QxQ7R$H(zh~*h$C-r!J4<#F~L~J@wRj! zX!=2FI`cU?uqO_xf#+uFH#bjQ26uchRg5g2t0?_4EiLJgX~48srk!}rb1YfznRZ}{ zU8+02n+jWu8a)qATZCdXb}esCtrB`~mfE4rD(uj|Q=6psR2s^PeMPPGM?52BkU&tv z81G4XNGX3Zdt>XA+~k>2K);a-?}{T4@DmMpU=Lfm0hEm7bcu?`c*X+Be@J`{82VsO@z^fas{oBu|c>GRgB5>}*px z5UPZ+i1?(IC8F#^bRuZ>th`Bv?W`KuwS{5Kv<+E1l|QSO(UC*z1C)r41r~U?Y6Q=z zwKVGqJX`c&QhkgY#1c3`LjTt?20IItc=C9(+1^C6>{a|Vd*u#WhBV%>+Em~pn-EwL z_I+bZ>%PPZl=7W5fbtAwGw-CmBJ$xXK8{^}?9b>xPa}V8s?j;%kc| zmOWovFC|oK=sAj^lE&ZjL!}KG_21^z&vverXrzR0#^$7R@!k|Xjh zd%|+DChen~gtgv3BB8zfRjXjeYgt>>zRTskILO4h6@JY6-gq-h26-48CuW@u4%0+~ zxYX;eYiPGlTi=zGxfX`9QcXhJm)SOG^IdbU#Ezfu?rhofMRqVbOey`LP1d-AFo-h+ zfW%0B?ICTMvHYYJS9uV}yrtV|She{NgVeuu=e9UREDZ@1A3J-m}5(~-j zVwu3|n3-C6@Qn;!@?Dox#ZMi$GYlV9RfNX9LItrzK6-(vFEt%14l#0~Py{CSpnC#YO5_*bWN>DYRhbkhIJz1sj#Ysa$EqLE^T~j#H2vzL*+E57 zg0k471sZ61WoXGW)xy%sRS2V|szP}$UsYrUQCz?HeKrcdWI08y*luAfrd!M*v&`tS zXfF|ct9;FrpM(sq+OYPlEi0A|E@hT%&hY5yiSrhoG=J{AxpU_)p6&e2Rd);Lo}zx8 zzh57p!H)lQ|2uG~33f;qe|*j`Ej1juUhfp&gCAGx8+Bd6W-XgjAFj1(N6y!x1Mvd~ zTw!l<`G-y0v5WcKyOrJ|#l{ZojLiU^)+7EBHv8_qa6Je+wA0@KUZRd>ub%Z%@X03q z?FSm)`KmSbq2~DH__o&UV+M|$-PgPJEFty&?T>p3NCt3dlK4fDc!~JsA+aU&{UqW% zzVjCLTO2$kAt@C7Q6#aAwo3XEoEb%&5zP^aq!2SSX94MeQR*x#ImADb{;5B*#jyE% z`L`FgOlRn_p67Q$*^0BDm-MzZXa2$kR?XQ<)SSOZ^klSIwB`(#X%WAynsbsCQO)@i zeWR{abI9%sQX}@HjNbt8B?+Ib3fx8NZj0mQu`h?@dPFA8mY zqJ{J0X`Btj83AJFcneOB;~fgTy%nBbH}TTqr?qX`7U;*bmz&ffy~M=|6IQ);W^!^L zf#!al`9h}dr2^0T?$ZaWo;p3~@$&L8yp^t@Bp1D1mki>d`EL7XMDV({{7KydSyG<<|rEm4s_n{5sFkT=~7q z!RkhBS(r%Kn~}0tOEmhV+g*b7v$Jwvo6FAwOH^9R?HFrO;;D5UQuvw@E3%yGLwon_ z`}l?Nk-(dPd{BvOefQpZYIEiJ+9+mMYEkBCc5ni<^WI>geo^wC*z}tGx+rQFFcYqERqVOB-Vjb9HHh~+K|o^3z1ZCgmLuX}^W(pz=;V3m8F z+}qV*9$F+LE92#I@{Iz|Y#rg}oPXaoCv(r?*)CQjX$Exe|-E_kmZw-U}z# zc&OvrvnVkpI{|T+SH>Z_r;!it-M4L(ixNHRJYdhau;HH--z~`ltloAOC;A0i+&gIx zV$gYg%jN$9KL&0!@So5AeMkAfu*6Pp9@TOFFG{?zpNRZlRK_5+FIDIGnHspb#Mk)_ zw{vgHtIlJPcoNbZ{mEertlhMHXz#v#=_l4pjtBB7Ipna?SAPEITK=gaHr&0uEx^3Q zK9824$ah*gd}}lY;qGF7B)t3fC6I^%mHlZl4vBrsJfzAkKR09lHh~=55v^0yMTt42 zw;;Wzhp5V-MSgMRC$V~o=jP7Nu+jZZ*aB!TAKI65<{7&rha4HMRmRTb`O-Xg7uxy4 zL?1(Ivde6A{bit+yy~T#TNPSvBf6goc8r^=+be8bc$;EC=kCSVF?w!{++(8)XHXx` zyKi5g6XRA|0b6OK(N`a``ATnd52$+S=GyR?8RW1kdr@hd=3I}t%0|Yss@(O^L-Bi( zwy3!`gkFi-Za+mo3e}(0nK9bxOdQnqiXG$U#^`6o@Z}qtwF{&l1@FFXDJ)9N&Cfx7 z?@PxZkpY#_Gx@(JhK?S_+PTt$dme2rGe%w;!}mAE>^ugEIn24p|8=<-Q2&Gd!2Ae! z_if8RR|ETF`0|Ui7pVrmJspEC)xezB(SSm?_8ILszjLF8^&wu^xmWJvaw#0N5cQU+ zUJde7+_pyLQn(?+>p}__B;GX+LL1shi1_ew)K7p9yqvgin=Xq#hR(kMlTUxICwn(&K=i{K#R8M2#Nlc!8=O<9Rkk-UIEcu?) z6sotAvzMLKM?JYVxiyN}c{+1z>_Y;x+lvt~wHQWmns&HKt+im)A-hJD;vnVlhMYH2OY_xDkbq}g~N^@&M zqaHTxmtk+#?t^>xZPT55W{xRrvkkmwyn0G=vnmaR7VaD4!+Q5^)0jgYH>m#J^&X1f zZrh_KW)aB4Z$hE^yW)3@nR#BnD~{QX{vpwJXx6u>P@SFp{bW||b91$JQX%U7cl?5T z9}+{xk?gFTy4>68RDc&g!o2KlTT^p=-%byY_MNr1JMy5a=WT8teODH{D>D4pkRrZg`L@w(AcG9#1sX~d#A2Je@aKFr0>R`0%T zf3P^wO6U{s%N1tZV`4ne>Q9^8TmJi1Ec_E_d{FPcZOU__`zr`jom&z++s4E4>sov4 zM7t#qj1T0oyU>DjtG8GB=(3BHdEuwizwapBAGDCoUa8nweuu=K^uemvvfTRNRc+A2 zZ1?IwM`{01487b&ts802)VQlt=xe50#WapS@{;;Iaz2CpVGErmyTs&^EOWVoQRnE1 z_XP5jxW+}7xcac2j*)Y3xF3lji<1w0Sns}VP0RV-T$@4-D|qFRLGFF!qb@GhZBe@t z9ZPlW#M7F_@YiLr!-QAO@5Kph+KuOW7h7*|7ddsyL-iY7+frYgXk&{JiyQVd7GY*o zE{WWV$j7XB*yn-yiLKtlm)Qk@s-rKFB96$Z@c8p_ZfqoIG)f?sej)-<%t=2@@4zO zcIc5QPA@y!<0sy`X|y7!+slKtC7tVEZcpQOv46>pQvSrmfKJLlGjB}RX>!Rg+Un1<+*`AMt61fFmBYQu!PR@kudiQNbRoT&=g{9fxaK@*uj)RJ=WV91`f?Pr8!b0C z%k~cm)XwX0ZcKHzjf#B%V&`l7neE-Tee&kkjs8aj-#tOVL-VU!d-TLJnBG*s;-k}{ z#@?CWo#N+Ki2u>YFULFiOsL+r6Qg?a+WRLv7PN$<4l?gF<+Hlks-}#d~SHu1}jvsL@J}_R)_D+pyxYQui3S2+qp5!zouf5Y~+>EGbM0e20hy7DwjZRJ@K0!IvkE_ zqbPg4mNbjW(DkKq$`j8sTIIOk!(NNCv~b>8H_&Y>gN3snt$KEZ_W4&JZR(6J{WQy{6*M@=ldDtFtaO{bSBLY*~n|gcNXiKb!?zn z8^w~IpSjh?i@BEd?-}II)13RV{9%FIsJGCJ#n+EPLaXL*Za>){_-J9`D)*SV9akSQ zcyu;jkhJPpi8*iDf8d7>R-{v^jFv06M?JJKBdeBM?(6X%IcS|@<@PUmOk=IBwdy;I zc%`hKmx-qf`JVkp1hETgO!VsXz47A$aT2=#OP{39_ZrE)q5N2)iBEltdSkoDQhayZ zh4zpbtP(OT5QP|B(-{bOuS#vyy#D(m|ZB<#3+x}`hP~4 zeMMt?Yh(q^^yuC>8;KS|dr15|irJ0a&5bpl5~%g9&04cwYtT|wpSamAjvK{|2u=+m9kDe+33CL=`41bS7{k4OwH=d3ISIzC5C(W~jyQa3I zz^;Mnd+*7CO+7(kD`RH*uiwNm!@{lHo^m7K=Ok)tXr#Z^Y8B1U<*#xY6Sa6Y%Ja8A zTBON#6OVB!M||Gh+&xg#hRM0H^D<1d6>+j{i6>S*qkz@RFY%U5yF=|oi2b$6R?*)h zcijpSSRF4@f-?fVu!2@C!3BvNeJ#?rx5PvJ>^xly5+jz^0p}$KCsHLV=V0zFdLKeU zZ5*v{Z}f*UcbMKJX+KmQxidAtG4~ziqtDy#PP8S ztc(oq8eiY2O-zoAx4N({lXxDJm&MF>=wWtOZo9d6)B_y+{08}zb3M`H(sw7bTwLL- z*41{E=!Iz=_LW)eZuDQd`u3_e=wX3Z&iBN7I;{h~+Ce|FS=(CXdVHavGJ0YjhJ45l zY=<7n{Hpl5x$M_C_}$rYHs@1vkb_4rekLg7>gi1MU^LVChA3v3xm9acE^iMjF=<`(MM>uyqnKStXQF?mdGgsBb0^J7 zl=Cm0kAZTlM~9cFs;lV6x#_v*z!4?lx~}a7o_U{rQ-IfbIp*FokCb>5qqU)MDxz|0 z%)Mv6*+PmuyenhnTH#R=YZ4z)bob2pOmA~^6tnZv%gqZOqcF#tEqdM4Q-eXbTDgZy zJiTaLdLh}lj4(HTpB8hW16DXta^$QbCYzY@B#;!Pze(*dAg`K zMBE@N#~|0%7Vbd|UfA4UL@}U60`uKvIkM}#rsu|4i(TZdoS>bXJv>?9iLbIUNvvA4 zb16JUBX;rJjNBPSrz*TyR(3O8Z!K}wP0%JC;VVGpR+8I)`ZR_2Vx5xlwh%AU`Bu)+ z%n0jr7qOeCWMt;k&(Nq-ldbVFxieh&>0CF{xkMofkF~z>@rl9uSg~%Z3v2kfcY~!0 zwWk5^U${KMPiAXm2vfbzCZ1}vD!NQ#Hk;#3Y;jU_Vb71;cc9A^-V1O#M&b!d`=+l@ zsH^a)5+|8|i^(1j44Ye|IZiR8BLQYRcRBkVsxq&l%v`F%*;^o%%Rw=x- z#dK@M*6q~c)*DmUn7-DU3Oo6#$hlKFdKL1Eb1KJb4=s|d)oV?r9M1~yx-hCs;L+}B zeI6dhw3$OWs+ME!t$j@nIg-s)v2$&6t%u!t9_PlB>lE6HcalPX3^7b(<(ixOQsC_Z z6K>I%YibppueRr&(*ptveNBDnMf2HRAH|GR)XKSDfl0NrkRxN_t+&$5a_uI@{*wzGUH=bg- zvEEPucl|^$RIi0Eyp`KeX2xW=#2%>al7&p$hOolz66-cl)SD>dI_iE=^+w3Emr>rzz0~(HF4|i8MaZt#6tWJpj!o zjuX~k-}+^>p&e5bUD~HIGai}<@VZd{6E%@Mx89}knni8Ly2kPvT#S&^j>|9C(wlM2 zNM~NPCFE9?CsU|l23PLMbMqA~jXPBzrLC{K@(@!T*!^Bpuzloll{5p3lRQVkyrFLtqp;oWEncm^TC}tPZndt%F z?O=APwPfZlE(-C&1Xj=0ObXv)5V8K(ETR>*YR$>LFI+6}M$p3#7tQ6kwBUqIKFNcE z*KuE;^XR%HkKKh{DL0nA)J7*)HksnCe4)QMQNjz*R^RL3P8UNsNO4_b6k7vaPz<$- zVHu6iS9WsyIbLSR0rQUKagtb-=u*k&p11Gw@H1Ioxpgf{yepD-(d9O-+-+-Ms?new zMnrXwHn-|ANc5WYJFWY+Q4ofq8cp6nsnzaF7b4t?|H6hhu)1gm*`LFE3ywb z_>)T;yJf!1gFS8J!cnHTv8GmUBr1LN7-YQpKIq0EoAki zsMvZ$zggh9Ne&wHC6|mv&(0#UkXJbea&!6D*>M?Ehrg!=Zq<lU=<&GiDg-l{b) zc+lt8Hnxp7$7<07!m5@)Zp3J<6{tFDV#G${)7vc60@FNdlWly{)Ol)i zqq9G@arL2M*yXxA=ZfV{j=0@I-iEK_WQwV`?e_UkxjCjkiN+#-^i$P#oXdsJdib&- zzYw{wI59K77`5+Dy;!J|J7kgMGoyMd$UKui=fq=r1sZ)&{j27F?#cUSE}rys?hb0E zt$*G^-Cn4kG=2b5_1sOAGOfS-c?`E3vm2ST-r-`(>fNohW_t0zuyE^R6Zq(TQtVh9 wRHy1WoI$ + +//XEDParse defines +#ifdef XEDPARSE_BUILD +#define XEDPARSE_EXPORT __declspec(dllexport) +#else +#define XEDPARSE_EXPORT __declspec(dllimport) +#endif //XEDPARSE_BUILD + +#define XEDPARSE_CALL //calling convention + +#define XEDPARSE_MAXBUFSIZE 256 +#define XEDPARSE_MAXASMSIZE 16 + +//typedefs +typedef bool (XEDPARSE_CALL* CBXEDPARSE_UNKNOWN)(const char* text, ULONGLONG* value); + +//XEDParse enums +enum XEDPARSE_STATUS +{ + XEDPARSE_ERROR = 0, + XEDPARSE_OK = 1 +}; + +//XEDParse structs +#pragma pack(push,8) +struct XEDPARSE +{ + bool x64; // use 64-bit instructions + ULONGLONG cip; //instruction pointer (for relative addressing) + unsigned int dest_size; //destination size (returned by XEDParse) + CBXEDPARSE_UNKNOWN cbUnknown; //unknown operand callback + unsigned char dest[XEDPARSE_MAXASMSIZE]; //destination buffer + char instr[XEDPARSE_MAXBUFSIZE]; //instruction text + char error[XEDPARSE_MAXBUFSIZE]; //error text (in case of an error) +}; +#pragma pack(pop) + +#ifdef __cplusplus +extern "C" +{ +#endif + +XEDPARSE_EXPORT XEDPARSE_STATUS XEDPARSE_CALL XEDParseAssemble(XEDPARSE* XEDParse); + +#ifdef __cplusplus +} +#endif + +#endif // _XEDPARSE_H diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/XEDParse/XEDParse_x64.a b/BranchTrace-x64plugin-wtl/pluginsdk/XEDParse/XEDParse_x64.a new file mode 100644 index 0000000000000000000000000000000000000000..c08940befee42657e126a80d2d1c2c16da647a06 GIT binary patch literal 2912 zcmd5;O>fgc5S_#=l&A<)6$Ij9q#`bralYI{LMWAr#04pb9ylNzmn2QpBvf&bD#W1& z#JNAIXVl+BnK$dT*NIKiOJSt!j%S}UvomjJ{rq(>{XBS6dS$1jTy0kBUZt_;*|sZ7 z=4jjHYAt%9QzD`}{QE^@9kTjZ{Wh+MHm-dC!`p*)Fb#YDnOE}ze>e%oJ@N;=pgXrj z8o3{az46hAQT}jz8lz(K!D#e87*3*P{nQQn$1~?kypg;elwH^JcvtmCGu}b>CpJK| zQy_XE+B!M2-q}p_{K2Mn$LR*MARi(tEoxsnM`5@GM(4l{@rOG#jon~njpH((4eB7SKJ!EA&1E<&ZtgGR4MLB zMy{+pjFG1`!5{-^iE=49TIVIJkc*N0fCX0Je)>Q>14+=5V_NCJt`EM6bql z6zP;S6FtrxD#f+`*G#NP7(8qv8jkBpR8>?ai-{U<&IT@Kwz;l#;IuwJZ?eH6j5wo~ z?4!k)Z`n9c$A!wii!j>8JHEVr zfv1a$#Fl7<#rsfd3!kdq_gGVWQQW}05lf7_3vT&@7`K#kT{3ehJ(ePFNw(mD-%>p` z>7Uvn8Avfw_KM1@h*X3`@U9s7h&2dKnzHQ5vl@!D&x*ct;;TOA3m}ur(szZm?rN;9 zH_a~q#oF&2@G{mOVpA-bZj-g248MP4?I0Vsz}jgxE@mzAa8uS2>F+UB<^P|pNxUXo XHGdPfZlUCn6zL^vik$lWY)<|G%@$fn literal 0 HcmV?d00001 diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/XEDParse/XEDParse_x64.lib b/BranchTrace-x64plugin-wtl/pluginsdk/XEDParse/XEDParse_x64.lib new file mode 100644 index 0000000000000000000000000000000000000000..ed97902a45bd04c9be75fd81ccc7b51c3eb87ea5 GIT binary patch literal 1916 zcmcIl&2G~`5dPx)08tf1w45SPDpdk5p-JO5MF=@1m5A!3QQ}J6j2ovkl0&MboVoSH zBhV|#GjQq?AjE+q2M&FWGPB-w9Fo!$wJUkYGdtd$Z|0lz@(X9sK75&cmYp2=watRQ zUf9U%llE1q<~NG+?QIgk9UyWJ#Fl`#NovY}5+finvh8ZEvD>ul%698jv)ZtBoA#US zO2ZipJFxBgo@q{d;G=T!9jw=T^&PuXw#rZo<>9c?+xK{nZtp1AGB8&>ujX{$%Vniq z8)<2bG)_>@BfwG&FiA-f?omR(M;tLkpa~g;I&DU*|C0$ z%~DWZ_autU542K*`!3<8AKl<)Yy+z1KBf;$V5|VgKMb z`=t3aYgX$!a(zN9kj9blLmU=wX_~p((SU7y3`NoI_l_vs%;{%bT!g9P^CSoF4m_6{3k?>{x7A9Rs;y32mi34Wbt=j|U|rmIwO zmvWbdhXF%%Sy9>9@266vWWSrw?>xDEL=oKJ4W=lW<^L0Rs(Zq>*aLwxHg!LX?!I;f Xb@e;^>lDTkp_@c8BKRdKgE;OF_VH^g literal 0 HcmV?d00001 diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/XEDParse/XEDParse_x86.a b/BranchTrace-x64plugin-wtl/pluginsdk/XEDParse/XEDParse_x86.a new file mode 100644 index 0000000000000000000000000000000000000000..286630e1c8c23c34a63a125a4dcc35cdf5a71da3 GIT binary patch literal 2940 zcmdT`&2G~`5FW=Z2~qhuR0siwMJgABj2#jul`0gZa4S*|91sT_mn7KA4=7Hh960a@ zeWX4>pMgiA%*=Y7b-ZrEp_N$0v+LO}`}57`*?oQ#&c8-)>#s$=cyA6HEx*xe9}3}e zmu`jdTFvwi{W<{L!RI%C-N)vEd}@~fwaXy*^uBiz&XZxV?D#<##ItZZgdm89;b5%~ zy}ilgLm1DxUITyl9#4M+1+Ngg?osNJp)elD`uU+WI{e?6eI1j{J8@7W{twJa-@EpD;nBf8=qi0 zPn9x^#*tly(fFY~+ZNe;NjYS0cCqUk4D&+Kx2=2mLDDxhI$!iTw9~9^} z+XV&s$Q(t8Vy?5wE`zy21vb=l`@9-}$7xh4GA0Eoyk2X#OwoG3Y7HwYTThcGHEA>nK5~r)8=K#6pf}$C$v`IC6 zQvgrcN>c$38)fNNedoDc%^FTzES?ndrY!0=GY!( z-`mvb7j53_bQ+m)1)a{#xJ;)MuWfY-pmIlcE8`gduUdU1MX71kNj+3mpoccQzGho4 JyNH_e?O%D4V+{ZR literal 0 HcmV?d00001 diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/XEDParse/XEDParse_x86.lib b/BranchTrace-x64plugin-wtl/pluginsdk/XEDParse/XEDParse_x86.lib new file mode 100644 index 0000000000000000000000000000000000000000..53e0a789f41b38171eda776330ccb4b6cd6aa193 GIT binary patch literal 1934 zcmcIl&2Ab&4E}ccNs6KfHN8|(QzAtwy--*d0##KlDUph@5ClZ(Z6QD#q$NaIeX*`C>c*XTD--iO{qrbi-~HBxC~ zH<_N6#|4|nm||5A0ayXF8^9k00(D}yMqh9U1c#1OD3%W^H7CDc{ZJ{CYlju*(|*3( z=nvX(oYIkP-`Bu}R2eDMJ|2}0oP4g9!}#aiV9@R!yL?Eed*;lL=Uunh=$u*!L+U7! zrDM)cVh&KyHyRN219f7y2!UbH0|Ei~p+Wbk4~}AShKKhfA1lqrM#QV0JO_b`xhTqw zSj%-8iGO9>%x12N)*Ql-&0;_}s4K3DcAAkL_QysCu9xc8}Mo#IJ;2T8OdE3$iEmn6(hO(ur>13A0#JgL;LHFl7aNAP=t7&C937 zPP5+|^gf?QqLtSXyHGmtcJEAU#Pg4Q0M)g(3e(JaUx8|dylD2iXXNhY<#*iPN`w3l z5B5)ojM@S`k58n;i;pe&q{L($5@4*8nn+l_&65~>I`CF-Omx&}e(au8BVMFhj8sCY z7Tv3spPqN@EykYAh*=4`U z!YI$PaeJW4QW7ezM(#3oC|zbsIqO|ZM$pH_cM(kK`FP;|Ulvm{B}y^EZxwf_t?}*k foUCZn+v*Lio{gomH!k`+mR@>DuFiP5rtSR&dU9>g literal 0 HcmV?d00001 diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/_dbgfunctions.h b/BranchTrace-x64plugin-wtl/pluginsdk/_dbgfunctions.h new file mode 100644 index 0000000..732ef94 --- /dev/null +++ b/BranchTrace-x64plugin-wtl/pluginsdk/_dbgfunctions.h @@ -0,0 +1,297 @@ +#ifndef _DBGFUNCTIONS_H +#define _DBGFUNCTIONS_H + +#ifndef __cplusplus +#include +#endif + +typedef struct +{ + char mod[MAX_MODULE_SIZE]; + duint addr; + unsigned char oldbyte; + unsigned char newbyte; +} DBGPATCHINFO; + +typedef struct +{ + duint addr; + duint from; + duint to; + char comment[MAX_COMMENT_SIZE]; +} DBGCALLSTACKENTRY; + +typedef struct +{ + int total; + DBGCALLSTACKENTRY* entries; +} DBGCALLSTACK; + +typedef struct +{ + duint addr; + duint handler; +} DBGSEHRECORD; + +typedef struct +{ + duint total; + DBGSEHRECORD* records; +} DBGSEHCHAIN; + +typedef struct +{ + DWORD dwProcessId; + char szExeFile[MAX_PATH]; + char szExeMainWindowTitle[MAX_PATH]; + char szExeArgs[MAX_COMMAND_LINE_SIZE]; +} DBGPROCESSINFO; + +typedef struct +{ + DWORD rva; + BYTE type; + WORD size; +} DBGRELOCATIONINFO; + +typedef enum +{ + InstructionBody = 0, + InstructionHeading = 1, + InstructionTailing = 2, + InstructionOverlapped = 3, // The byte was executed with differing instruction base addresses + DataByte, // This and the following is not implemented yet. + DataWord, + DataDWord, + DataQWord, + DataFloat, + DataDouble, + DataLongDouble, + DataXMM, + DataYMM, + DataMMX, + DataMixed, //the byte is accessed in multiple ways + InstructionDataMixed //the byte is both executed and written +} TRACERECORDBYTETYPE; + +typedef enum +{ + TraceRecordNone, + TraceRecordBitExec, + TraceRecordByteWithExecTypeAndCounter, + TraceRecordWordWithExecTypeAndCounter +} TRACERECORDTYPE; + +typedef struct +{ + duint Handle; + unsigned char TypeNumber; + unsigned int GrantedAccess; +} HANDLEINFO; + +// The longest ip address is 1234:6789:1234:6789:1234:6789:123.567.901.345 (46 bytes) +#define TCP_ADDR_SIZE 50 + +typedef struct +{ + char RemoteAddress[TCP_ADDR_SIZE]; + unsigned short RemotePort; + char LocalAddress[TCP_ADDR_SIZE]; + unsigned short LocalPort; + char StateText[TCP_ADDR_SIZE]; + unsigned int State; +} TCPCONNECTIONINFO; + +typedef struct +{ + duint handle; + duint parent; + DWORD threadId; + DWORD style; + DWORD styleEx; + duint wndProc; + bool enabled; + RECT position; + char windowTitle[MAX_COMMENT_SIZE]; + char windowClass[MAX_COMMENT_SIZE]; +} WINDOW_INFO; + +typedef struct +{ + duint addr; + duint size; + duint flags; +} HEAPINFO; + +typedef struct +{ + const char* name; + duint value; +} CONSTANTINFO; + +typedef enum +{ + MODSYMUNLOADED = 0, + MODSYMLOADING, + MODSYMLOADED +} MODULESYMBOLSTATUS; + +typedef bool (*ASSEMBLEATEX)(duint addr, const char* instruction, char* error, bool fillnop); +typedef bool (*SECTIONFROMADDR)(duint addr, char* section); +typedef bool (*MODNAMEFROMADDR)(duint addr, char* modname, bool extension); +typedef duint(*MODBASEFROMADDR)(duint addr); +typedef duint(*MODBASEFROMNAME)(const char* modname); +typedef duint(*MODSIZEFROMADDR)(duint addr); +typedef bool (*ASSEMBLE)(duint addr, unsigned char* dest, int* size, const char* instruction, char* error); +typedef bool (*PATCHGET)(duint addr); +typedef bool (*PATCHINRANGE)(duint start, duint end); +typedef bool (*MEMPATCH)(duint va, const unsigned char* src, duint size); +typedef void (*PATCHRESTORERANGE)(duint start, duint end); +typedef bool (*PATCHENUM)(DBGPATCHINFO* patchlist, size_t* cbsize); +typedef bool (*PATCHRESTORE)(duint addr); +typedef int (*PATCHFILE)(DBGPATCHINFO* patchlist, int count, const char* szFileName, char* error); +typedef int (*MODPATHFROMADDR)(duint addr, char* path, int size); +typedef int (*MODPATHFROMNAME)(const char* modname, char* path, int size); +typedef bool (*DISASMFAST)(const unsigned char* data, duint addr, BASIC_INSTRUCTION_INFO* basicinfo); +typedef void (*MEMUPDATEMAP)(); +typedef void (*GETCALLSTACK)(DBGCALLSTACK* callstack); +typedef void (*GETSEHCHAIN)(DBGSEHCHAIN* sehchain); +typedef void (*SYMBOLDOWNLOADALLSYMBOLS)(const char* szSymbolStore); +typedef bool (*GETJIT)(char* jit, bool x64); +typedef bool (*GETJITAUTO)(bool* jitauto); +typedef bool (*GETDEFJIT)(char* defjit); +typedef bool (*GETPROCESSLIST)(DBGPROCESSINFO** entries, int* count); +typedef bool (*GETPAGERIGHTS)(duint addr, char* rights); +typedef bool (*SETPAGERIGHTS)(duint addr, const char* rights); +typedef bool (*PAGERIGHTSTOSTRING)(DWORD protect, char* rights); +typedef bool (*ISPROCESSELEVATED)(); +typedef bool (*GETCMDLINE)(char* cmdline, size_t* cbsize); +typedef bool (*SETCMDLINE)(const char* cmdline); +typedef duint(*FILEOFFSETTOVA)(const char* modname, duint offset); +typedef duint(*VATOFILEOFFSET)(duint va); +typedef duint(*GETADDRFROMLINE)(const char* szSourceFile, int line, duint* displacement); +typedef bool (*GETSOURCEFROMADDR)(duint addr, char* szSourceFile, int* line); +typedef bool (*VALFROMSTRING)(const char* string, duint* value); +typedef bool (*PATCHGETEX)(duint addr, DBGPATCHINFO* info); +typedef bool (*GETBRIDGEBP)(BPXTYPE type, duint addr, BRIDGEBP* bp); +typedef bool (*STRINGFORMATINLINE)(const char* format, size_t resultSize, char* result); +typedef void (*GETMNEMONICBRIEF)(const char* mnem, size_t resultSize, char* result); +typedef unsigned int (*GETTRACERECORDHITCOUNT)(duint address); +typedef TRACERECORDBYTETYPE(*GETTRACERECORDBYTETYPE)(duint address); +typedef bool (*SETTRACERECORDTYPE)(duint pageAddress, TRACERECORDTYPE type); +typedef TRACERECORDTYPE(*GETTRACERECORDTYPE)(duint pageAddress); +typedef bool (*ENUMHANDLES)(ListOf(HANDLEINFO) handles); +typedef bool (*GETHANDLENAME)(duint handle, char* name, size_t nameSize, char* typeName, size_t typeNameSize); +typedef bool (*ENUMTCPCONNECTIONS)(ListOf(TCPCONNECTIONINFO) connections); +typedef duint(*GETDBGEVENTS)(); +typedef MODULEPARTY(*MODGETPARTY)(duint base); +typedef void (*MODSETPARTY)(duint base, MODULEPARTY party); +typedef bool(*WATCHISWATCHDOGTRIGGERED)(unsigned int id); +typedef bool(*MEMISCODEPAGE)(duint addr, bool refresh); +typedef bool(*ANIMATECOMMAND)(const char* command); +typedef void(*DBGSETDEBUGGEEINITSCRIPT)(const char* fileName); +typedef const char* (*DBGGETDEBUGGEEINITSCRIPT)(); +typedef bool(*HANDLESENUMWINDOWS)(ListOf(WINDOW_INFO) windows); +typedef bool(*HANDLESENUMHEAPS)(ListOf(HEAPINFO) heaps); +typedef bool(*THREADGETNAME)(DWORD tid, char* name); +typedef bool(*ISDEPENABLED)(); +typedef void(*GETCALLSTACKEX)(DBGCALLSTACK* callstack, bool cache); +typedef bool(*GETUSERCOMMENT)(duint addr, char* comment); +typedef void(*ENUMCONSTANTS)(ListOf(CONSTANTINFO) constants); +typedef duint(*MEMBPSIZE)(duint addr); +typedef bool(*MODRELOCATIONSFROMADDR)(duint addr, ListOf(DBGRELOCATIONINFO) relocations); +typedef bool(*MODRELOCATIONATADDR)(duint addr, DBGRELOCATIONINFO* relocation); +typedef bool(*MODRELOCATIONSINRANGE)(duint addr, duint size, ListOf(DBGRELOCATIONINFO) relocations); +typedef duint(*DBGETHASH)(); +typedef int(*SYMAUTOCOMPLETE)(const char* Search, char** Buffer, int MaxSymbols); +typedef void(*REFRESHMODULELIST)(); +typedef duint(*GETADDRFROMLINEEX)(duint mod, const char* szSourceFile, int line); +typedef MODULESYMBOLSTATUS(*MODSYMBOLSTATUS)(duint mod); + +//The list of all the DbgFunctions() return value. +//WARNING: This list is append only. Do not insert things in the middle or plugins would break. +typedef struct DBGFUNCTIONS_ +{ + ASSEMBLEATEX AssembleAtEx; + SECTIONFROMADDR SectionFromAddr; + MODNAMEFROMADDR ModNameFromAddr; + MODBASEFROMADDR ModBaseFromAddr; + MODBASEFROMNAME ModBaseFromName; + MODSIZEFROMADDR ModSizeFromAddr; + ASSEMBLE Assemble; + PATCHGET PatchGet; + PATCHINRANGE PatchInRange; + MEMPATCH MemPatch; + PATCHRESTORERANGE PatchRestoreRange; + PATCHENUM PatchEnum; + PATCHRESTORE PatchRestore; + PATCHFILE PatchFile; + MODPATHFROMADDR ModPathFromAddr; + MODPATHFROMNAME ModPathFromName; + DISASMFAST DisasmFast; + MEMUPDATEMAP MemUpdateMap; + GETCALLSTACK GetCallStack; + GETSEHCHAIN GetSEHChain; + SYMBOLDOWNLOADALLSYMBOLS SymbolDownloadAllSymbols; + GETJITAUTO GetJitAuto; + GETJIT GetJit; + GETDEFJIT GetDefJit; + GETPROCESSLIST GetProcessList; + GETPAGERIGHTS GetPageRights; + SETPAGERIGHTS SetPageRights; + PAGERIGHTSTOSTRING PageRightsToString; + ISPROCESSELEVATED IsProcessElevated; + GETCMDLINE GetCmdline; + SETCMDLINE SetCmdline; + FILEOFFSETTOVA FileOffsetToVa; + VATOFILEOFFSET VaToFileOffset; + GETADDRFROMLINE GetAddrFromLine; + GETSOURCEFROMADDR GetSourceFromAddr; + VALFROMSTRING ValFromString; + PATCHGETEX PatchGetEx; + GETBRIDGEBP GetBridgeBp; + STRINGFORMATINLINE StringFormatInline; + GETMNEMONICBRIEF GetMnemonicBrief; + GETTRACERECORDHITCOUNT GetTraceRecordHitCount; + GETTRACERECORDBYTETYPE GetTraceRecordByteType; + SETTRACERECORDTYPE SetTraceRecordType; + GETTRACERECORDTYPE GetTraceRecordType; + ENUMHANDLES EnumHandles; + GETHANDLENAME GetHandleName; + ENUMTCPCONNECTIONS EnumTcpConnections; + GETDBGEVENTS GetDbgEvents; + MODGETPARTY ModGetParty; + MODSETPARTY ModSetParty; + WATCHISWATCHDOGTRIGGERED WatchIsWatchdogTriggered; + MEMISCODEPAGE MemIsCodePage; + ANIMATECOMMAND AnimateCommand; + DBGSETDEBUGGEEINITSCRIPT DbgSetDebuggeeInitScript; + DBGGETDEBUGGEEINITSCRIPT DbgGetDebuggeeInitScript; + HANDLESENUMWINDOWS EnumWindows; + HANDLESENUMHEAPS EnumHeaps; + THREADGETNAME ThreadGetName; + ISDEPENABLED IsDepEnabled; + GETCALLSTACKEX GetCallStackEx; + GETUSERCOMMENT GetUserComment; + ENUMCONSTANTS EnumConstants; + ENUMCONSTANTS EnumErrorCodes; + ENUMCONSTANTS EnumExceptions; + MEMBPSIZE MemBpSize; + MODRELOCATIONSFROMADDR ModRelocationsFromAddr; + MODRELOCATIONATADDR ModRelocationAtAddr; + MODRELOCATIONSINRANGE ModRelocationsInRange; + DBGETHASH DbGetHash; + SYMAUTOCOMPLETE SymAutoComplete; + REFRESHMODULELIST RefreshModuleList; + GETADDRFROMLINEEX GetAddrFromLineEx; + MODSYMBOLSTATUS ModSymbolStatus; +} DBGFUNCTIONS; + +#ifdef BUILD_DBG + +const DBGFUNCTIONS* dbgfunctionsget(); +void dbgfunctionsinit(); + +#endif //BUILD_DBG + +#endif //_DBGFUNCTIONS_H diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/_plugin_types.h b/BranchTrace-x64plugin-wtl/pluginsdk/_plugin_types.h new file mode 100644 index 0000000..12277f7 --- /dev/null +++ b/BranchTrace-x64plugin-wtl/pluginsdk/_plugin_types.h @@ -0,0 +1,34 @@ +#ifndef _PLUGIN_DATA_H +#define _PLUGIN_DATA_H + +#ifdef BUILD_DBG + +#include "_global.h" +#include "jansson/jansson.h" +#pragma warning(push) +#pragma warning(disable:4091) +#include +#pragma warning(pop) + +#else + +#ifdef __GNUC__ +#include "dbghelp/dbghelp.h" +#else +#pragma warning(push) +#pragma warning(disable:4091) +#include +#pragma warning(pop) +#endif // __GNUC__ + +#ifndef deflen +#define deflen 1024 +#endif // deflen + +#include "bridgemain.h" +#include "_dbgfunctions.h" +#include "jansson/jansson.h" + +#endif // BUILD_DBG + +#endif // _PLUGIN_DATA_H diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/_plugins.h b/BranchTrace-x64plugin-wtl/pluginsdk/_plugins.h new file mode 100644 index 0000000..7b1d646 --- /dev/null +++ b/BranchTrace-x64plugin-wtl/pluginsdk/_plugins.h @@ -0,0 +1,332 @@ +#ifndef _PLUGINS_H +#define _PLUGINS_H + +#ifndef __cplusplus +#include +#endif + +#ifndef PLUG_IMPEXP +#ifdef BUILD_DBG +#define PLUG_IMPEXP __declspec(dllexport) +#else +#define PLUG_IMPEXP __declspec(dllimport) +#endif //BUILD_DBG +#endif //PLUG_IMPEXP + +#include "_plugin_types.h" + +//default structure alignments forced +#ifdef _WIN64 +#pragma pack(push, 16) +#else //x86 +#pragma pack(push, 8) +#endif //_WIN64 + +//defines +#define PLUG_SDKVERSION 1 + +#define PLUG_DB_LOADSAVE_DATA 1 +#define PLUG_DB_LOADSAVE_ALL 2 + +//structures +typedef struct +{ + //provided by the debugger + int pluginHandle; + //provided by the pluginit function + int sdkVersion; + int pluginVersion; + char pluginName[256]; +} PLUG_INITSTRUCT; + +typedef struct +{ + //provided by the debugger + HWND hwndDlg; //gui window handle + int hMenu; //plugin menu handle + int hMenuDisasm; //plugin disasm menu handle + int hMenuDump; //plugin dump menu handle + int hMenuStack; //plugin stack menu handle + int hMenuGraph; //plugin graph menu handle + int hMenuMemmap; //plugin memory map menu handle + int hMenuSymmod; //plugin symbol module menu handle +} PLUG_SETUPSTRUCT; + +typedef struct +{ + void* data; //user data +} PLUG_SCRIPTSTRUCT; + +//callback structures +typedef struct +{ + const char* szFileName; +} PLUG_CB_INITDEBUG; + +typedef struct +{ + void* reserved; +} PLUG_CB_STOPDEBUG; + +typedef struct +{ + CREATE_PROCESS_DEBUG_INFO* CreateProcessInfo; + IMAGEHLP_MODULE64* modInfo; + const char* DebugFileName; + PROCESS_INFORMATION* fdProcessInfo; +} PLUG_CB_CREATEPROCESS; + +typedef struct +{ + EXIT_PROCESS_DEBUG_INFO* ExitProcess; +} PLUG_CB_EXITPROCESS; + +typedef struct +{ + CREATE_THREAD_DEBUG_INFO* CreateThread; + DWORD dwThreadId; +} PLUG_CB_CREATETHREAD; + +typedef struct +{ + EXIT_THREAD_DEBUG_INFO* ExitThread; + DWORD dwThreadId; +} PLUG_CB_EXITTHREAD; + +typedef struct +{ + void* reserved; +} PLUG_CB_SYSTEMBREAKPOINT; + +typedef struct +{ + LOAD_DLL_DEBUG_INFO* LoadDll; + IMAGEHLP_MODULE64* modInfo; + const char* modname; +} PLUG_CB_LOADDLL; + +typedef struct +{ + UNLOAD_DLL_DEBUG_INFO* UnloadDll; +} PLUG_CB_UNLOADDLL; + +typedef struct +{ + OUTPUT_DEBUG_STRING_INFO* DebugString; +} PLUG_CB_OUTPUTDEBUGSTRING; + +typedef struct +{ + EXCEPTION_DEBUG_INFO* Exception; +} PLUG_CB_EXCEPTION; + +typedef struct +{ + BRIDGEBP* breakpoint; +} PLUG_CB_BREAKPOINT; + +typedef struct +{ + void* reserved; +} PLUG_CB_PAUSEDEBUG; + +typedef struct +{ + void* reserved; +} PLUG_CB_RESUMEDEBUG; + +typedef struct +{ + void* reserved; +} PLUG_CB_STEPPED; + +typedef struct +{ + DWORD dwProcessId; +} PLUG_CB_ATTACH; + +typedef struct +{ + PROCESS_INFORMATION* fdProcessInfo; +} PLUG_CB_DETACH; + +typedef struct +{ + DEBUG_EVENT* DebugEvent; +} PLUG_CB_DEBUGEVENT; + +typedef struct +{ + int hEntry; +} PLUG_CB_MENUENTRY; + +typedef struct +{ + MSG* message; + long* result; + bool retval; +} PLUG_CB_WINEVENT; + +typedef struct +{ + MSG* message; + bool retval; +} PLUG_CB_WINEVENTGLOBAL; + +typedef struct +{ + json_t* root; + int loadSaveType; +} PLUG_CB_LOADSAVEDB; + +typedef struct +{ + const char* symbol; + bool retval; +} PLUG_CB_FILTERSYMBOL; + +typedef struct +{ + duint cip; + bool stop; +} PLUG_CB_TRACEEXECUTE; + +typedef struct +{ + int hWindow; + duint VA; +} PLUG_CB_SELCHANGED; + +typedef struct +{ + BridgeCFGraphList graph; +} PLUG_CB_ANALYZE; + +typedef struct +{ + duint addr; + BRIDGE_ADDRINFO* addrinfo; + bool retval; +} PLUG_CB_ADDRINFO; + +typedef struct +{ + const char* string; + duint value; + int* value_size; + bool* isvar; + bool* hexonly; + bool retval; +} PLUG_CB_VALFROMSTRING; + +typedef struct +{ + const char* string; + duint value; + bool retval; +} PLUG_CB_VALTOSTRING; + +typedef struct +{ + GUIMENUTYPE hMenu; +} PLUG_CB_MENUPREPARE; + +//enums +typedef enum +{ + CB_INITDEBUG, //PLUG_CB_INITDEBUG + CB_STOPDEBUG, //PLUG_CB_STOPDEBUG + CB_CREATEPROCESS, //PLUG_CB_CREATEPROCESS + CB_EXITPROCESS, //PLUG_CB_EXITPROCESS + CB_CREATETHREAD, //PLUG_CB_CREATETHREAD + CB_EXITTHREAD, //PLUG_CB_EXITTHREAD + CB_SYSTEMBREAKPOINT, //PLUG_CB_SYSTEMBREAKPOINT + CB_LOADDLL, //PLUG_CB_LOADDLL + CB_UNLOADDLL, //PLUG_CB_UNLOADDLL + CB_OUTPUTDEBUGSTRING, //PLUG_CB_OUTPUTDEBUGSTRING + CB_EXCEPTION, //PLUG_CB_EXCEPTION + CB_BREAKPOINT, //PLUG_CB_BREAKPOINT + CB_PAUSEDEBUG, //PLUG_CB_PAUSEDEBUG + CB_RESUMEDEBUG, //PLUG_CB_RESUMEDEBUG + CB_STEPPED, //PLUG_CB_STEPPED + CB_ATTACH, //PLUG_CB_ATTACHED (before attaching, after CB_INITDEBUG) + CB_DETACH, //PLUG_CB_DETACH (before detaching, before CB_STOPDEBUG) + CB_DEBUGEVENT, //PLUG_CB_DEBUGEVENT (called on any debug event) + CB_MENUENTRY, //PLUG_CB_MENUENTRY + CB_WINEVENT, //PLUG_CB_WINEVENT + CB_WINEVENTGLOBAL, //PLUG_CB_WINEVENTGLOBAL + CB_LOADDB, //PLUG_CB_LOADSAVEDB + CB_SAVEDB, //PLUG_CB_LOADSAVEDB + CB_FILTERSYMBOL, //PLUG_CB_FILTERSYMBOL + CB_TRACEEXECUTE, //PLUG_CB_TRACEEXECUTE + CB_SELCHANGED, //PLUG_CB_SELCHANGED + CB_ANALYZE, //PLUG_CB_ANALYZE + CB_ADDRINFO, //PLUG_CB_ADDRINFO + CB_VALFROMSTRING, //PLUG_CB_VALFROMSTRING + CB_VALTOSTRING, //PLUG_CB_VALTOSTRING + CB_MENUPREPARE, //PLUG_CB_MENUPREPARE + CB_LAST +} CBTYPE; + +typedef enum +{ + FORMAT_ERROR, //generic failure (no message) + FORMAT_SUCCESS, //success + FORMAT_ERROR_MESSAGE, //formatting failed but an error was put in the buffer (there are always at least 511 characters available). + FORMAT_BUFFER_TOO_SMALL //buffer too small (x64dbg will retry until the buffer is big enough) +} FORMATRESULT; + +//typedefs +typedef void (*CBPLUGIN)(CBTYPE cbType, void* callbackInfo); +typedef bool (*CBPLUGINCOMMAND)(int argc, char** argv); +typedef void (*CBPLUGINSCRIPT)(); +typedef duint(*CBPLUGINEXPRFUNCTION)(int argc, duint* argv, void* userdata); +typedef FORMATRESULT(*CBPLUGINFORMATFUNCTION)(char* dest, size_t destCount, int argc, char* argv[], duint value, void* userdata); +typedef bool (*CBPLUGINPREDICATE)(void* userdata); + +//exports +#ifdef __cplusplus +extern "C" +{ +#endif + +PLUG_IMPEXP void _plugin_registercallback(int pluginHandle, CBTYPE cbType, CBPLUGIN cbPlugin); +PLUG_IMPEXP bool _plugin_unregistercallback(int pluginHandle, CBTYPE cbType); +PLUG_IMPEXP bool _plugin_registercommand(int pluginHandle, const char* command, CBPLUGINCOMMAND cbCommand, bool debugonly); +PLUG_IMPEXP bool _plugin_unregistercommand(int pluginHandle, const char* command); +PLUG_IMPEXP void _plugin_logprintf(const char* format, ...); +PLUG_IMPEXP void _plugin_logputs(const char* text); +PLUG_IMPEXP void _plugin_logprint(const char* text); +PLUG_IMPEXP void _plugin_debugpause(); +PLUG_IMPEXP void _plugin_debugskipexceptions(bool skip); +PLUG_IMPEXP int _plugin_menuadd(int hMenu, const char* title); +PLUG_IMPEXP bool _plugin_menuaddentry(int hMenu, int hEntry, const char* title); +PLUG_IMPEXP bool _plugin_menuaddseparator(int hMenu); +PLUG_IMPEXP bool _plugin_menuclear(int hMenu); +PLUG_IMPEXP void _plugin_menuseticon(int hMenu, const ICONDATA* icon); +PLUG_IMPEXP void _plugin_menuentryseticon(int pluginHandle, int hEntry, const ICONDATA* icon); +PLUG_IMPEXP void _plugin_menuentrysetchecked(int pluginHandle, int hEntry, bool checked); +PLUG_IMPEXP void _plugin_menusetvisible(int pluginHandle, int hMenu, bool visible); +PLUG_IMPEXP void _plugin_menuentrysetvisible(int pluginHandle, int hEntry, bool visible); +PLUG_IMPEXP void _plugin_menusetname(int pluginHandle, int hMenu, const char* name); +PLUG_IMPEXP void _plugin_menuentrysetname(int pluginHandle, int hEntry, const char* name); +PLUG_IMPEXP void _plugin_menuentrysethotkey(int pluginHandle, int hEntry, const char* hotkey); +PLUG_IMPEXP bool _plugin_menuremove(int hMenu); +PLUG_IMPEXP bool _plugin_menuentryremove(int pluginHandle, int hEntry); +PLUG_IMPEXP void _plugin_startscript(CBPLUGINSCRIPT cbScript); +PLUG_IMPEXP bool _plugin_waituntilpaused(); +PLUG_IMPEXP bool _plugin_registerexprfunction(int pluginHandle, const char* name, int argc, CBPLUGINEXPRFUNCTION cbFunction, void* userdata); +PLUG_IMPEXP bool _plugin_unregisterexprfunction(int pluginHandle, const char* name); +PLUG_IMPEXP bool _plugin_unload(const char* pluginName); +PLUG_IMPEXP bool _plugin_load(const char* pluginName); +PLUG_IMPEXP duint _plugin_hash(const void* data, duint size); +PLUG_IMPEXP bool _plugin_registerformatfunction(int pluginHandle, const char* type, CBPLUGINFORMATFUNCTION cbFunction, void* userdata); +PLUG_IMPEXP bool _plugin_unregisterformatfunction(int pluginHandle, const char* type); + +#ifdef __cplusplus +} +#endif + +#pragma pack(pop) + +#endif // _PLUGINS_H diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi.h b/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi.h new file mode 100644 index 0000000..f6460d9 --- /dev/null +++ b/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi.h @@ -0,0 +1,8 @@ +#ifndef _SCRIPT_API_H +#define _SCRIPT_API_H + +#include "_plugins.h" + +#define SCRIPT_EXPORT PLUG_IMPEXP + +#endif //_SCRIPT_API_H \ No newline at end of file diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_argument.h b/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_argument.h new file mode 100644 index 0000000..52f319f --- /dev/null +++ b/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_argument.h @@ -0,0 +1,31 @@ +#ifndef _SCRIPTAPI_ARGUMENT_H +#define _SCRIPTAPI_ARGUMENT_H + +#include "_scriptapi.h" + +namespace Script +{ + namespace Argument + { + struct ArgumentInfo + { + char mod[MAX_MODULE_SIZE]; + duint rvaStart; + duint rvaEnd; + bool manual; + duint instructioncount; + }; + + SCRIPT_EXPORT bool Add(duint start, duint end, bool manual, duint instructionCount = 0); + SCRIPT_EXPORT bool Add(const ArgumentInfo* info); + SCRIPT_EXPORT bool Get(duint addr, duint* start = nullptr, duint* end = nullptr, duint* instructionCount = nullptr); + SCRIPT_EXPORT bool GetInfo(duint addr, ArgumentInfo* info); + SCRIPT_EXPORT bool Overlaps(duint start, duint end); + SCRIPT_EXPORT bool Delete(duint address); + SCRIPT_EXPORT void DeleteRange(duint start, duint end, bool deleteManual = false); + SCRIPT_EXPORT void Clear(); + SCRIPT_EXPORT bool GetList(ListOf(ArgumentInfo) list); //caller has the responsibility to free the list + }; //Argument +}; //Script + +#endif //_SCRIPTAPI_ARGUMENT_H \ No newline at end of file diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_assembler.h b/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_assembler.h new file mode 100644 index 0000000..33e8743 --- /dev/null +++ b/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_assembler.h @@ -0,0 +1,17 @@ +#ifndef _SCRIPTAPI_ASSEMBLER_H +#define _SCRIPTAPI_ASSEMBLER_H + +#include "_scriptapi.h" + +namespace Script +{ + namespace Assembler + { + SCRIPT_EXPORT bool Assemble(duint addr, unsigned char* dest, int* size, const char* instruction); //dest[16] + SCRIPT_EXPORT bool AssembleEx(duint addr, unsigned char* dest, int* size, const char* instruction, char* error); //dest[16], error[MAX_ERROR_SIZE] + SCRIPT_EXPORT bool AssembleMem(duint addr, const char* instruction); + SCRIPT_EXPORT bool AssembleMemEx(duint addr, const char* instruction, int* size, char* error, bool fillnop); //error[MAX_ERROR_SIZE] + }; //Assembler +}; //Script + +#endif //_SCRIPTAPI_ASSEMBLER_H \ No newline at end of file diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_bookmark.h b/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_bookmark.h new file mode 100644 index 0000000..5f32388 --- /dev/null +++ b/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_bookmark.h @@ -0,0 +1,28 @@ +#ifndef _SCRIPTAPI_BOOKMARK_H +#define _SCRIPTAPI_BOOKMARK_H + +#include "_scriptapi.h" + +namespace Script +{ + namespace Bookmark + { + struct BookmarkInfo + { + char mod[MAX_MODULE_SIZE]; + duint rva; + bool manual; + }; + + SCRIPT_EXPORT bool Set(duint addr, bool manual = false); + SCRIPT_EXPORT bool Set(const BookmarkInfo* info); + SCRIPT_EXPORT bool Get(duint addr); + SCRIPT_EXPORT bool GetInfo(duint addr, BookmarkInfo* info); + SCRIPT_EXPORT bool Delete(duint addr); + SCRIPT_EXPORT void DeleteRange(duint start, duint end); + SCRIPT_EXPORT void Clear(); + SCRIPT_EXPORT bool GetList(ListOf(BookmarkInfo) list); //caller has the responsibility to free the list + }; //Bookmark +}; //Script + +#endif //_SCRIPTAPI_BOOKMARK_H \ No newline at end of file diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_comment.h b/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_comment.h new file mode 100644 index 0000000..06ac5df --- /dev/null +++ b/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_comment.h @@ -0,0 +1,29 @@ +#ifndef _SCRIPTAPI_COMMENT_H +#define _SCRIPTAPI_COMMENT_H + +#include "_scriptapi.h" + +namespace Script +{ + namespace Comment + { + struct CommentInfo + { + char mod[MAX_MODULE_SIZE]; + duint rva; + char text[MAX_LABEL_SIZE]; + bool manual; + }; + + SCRIPT_EXPORT bool Set(duint addr, const char* text, bool manual = false); + SCRIPT_EXPORT bool Set(const CommentInfo* info); + SCRIPT_EXPORT bool Get(duint addr, char* text); //text[MAX_COMMENT_SIZE] + SCRIPT_EXPORT bool GetInfo(duint addr, CommentInfo* info); + SCRIPT_EXPORT bool Delete(duint addr); + SCRIPT_EXPORT void DeleteRange(duint start, duint end); + SCRIPT_EXPORT void Clear(); + SCRIPT_EXPORT bool GetList(ListOf(CommentInfo) list); //caller has the responsibility to free the list + }; //Comment +}; //Script + +#endif //_SCRIPTAPI_COMMENT_H \ No newline at end of file diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_debug.h b/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_debug.h new file mode 100644 index 0000000..1be789d --- /dev/null +++ b/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_debug.h @@ -0,0 +1,32 @@ +#ifndef _SCRIPTAPI_DEBUG_H +#define _SCRIPTAPI_DEBUG_H + +#include "_scriptapi.h" + +namespace Script +{ + namespace Debug + { + enum HardwareType + { + HardwareAccess, + HardwareWrite, + HardwareExecute + }; + + SCRIPT_EXPORT void Wait(); + SCRIPT_EXPORT void Run(); + SCRIPT_EXPORT void Pause(); + SCRIPT_EXPORT void Stop(); + SCRIPT_EXPORT void StepIn(); + SCRIPT_EXPORT void StepOver(); + SCRIPT_EXPORT void StepOut(); + SCRIPT_EXPORT bool SetBreakpoint(duint address); + SCRIPT_EXPORT bool DeleteBreakpoint(duint address); + SCRIPT_EXPORT bool DisableBreakpoint(duint address); + SCRIPT_EXPORT bool SetHardwareBreakpoint(duint address, HardwareType type = HardwareExecute); + SCRIPT_EXPORT bool DeleteHardwareBreakpoint(duint address); + }; //Debug +}; //Script + +#endif //_SCRIPTAPI_DEBUG_H \ No newline at end of file diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_flag.h b/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_flag.h new file mode 100644 index 0000000..58a2dd2 --- /dev/null +++ b/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_flag.h @@ -0,0 +1,47 @@ +#ifndef _SCRIPTAPI_FLAG_H +#define _SCRIPTAPI_FLAG_H + +#include "_scriptapi.h" + +namespace Script +{ + namespace Flag + { + enum FlagEnum + { + ZF, + OF, + CF, + PF, + SF, + TF, + AF, + DF, + IF + }; + + SCRIPT_EXPORT bool Get(FlagEnum flag); + SCRIPT_EXPORT bool Set(FlagEnum flag, bool value); + + SCRIPT_EXPORT bool GetZF(); + SCRIPT_EXPORT bool SetZF(bool value); + SCRIPT_EXPORT bool GetOF(); + SCRIPT_EXPORT bool SetOF(bool value); + SCRIPT_EXPORT bool GetCF(); + SCRIPT_EXPORT bool SetCF(bool value); + SCRIPT_EXPORT bool GetPF(); + SCRIPT_EXPORT bool SetPF(bool value); + SCRIPT_EXPORT bool GetSF(); + SCRIPT_EXPORT bool SetSF(bool value); + SCRIPT_EXPORT bool GetTF(); + SCRIPT_EXPORT bool SetTF(bool value); + SCRIPT_EXPORT bool GetAF(); + SCRIPT_EXPORT bool SetAF(bool value); + SCRIPT_EXPORT bool GetDF(); + SCRIPT_EXPORT bool SetDF(bool value); + SCRIPT_EXPORT bool GetIF(); + SCRIPT_EXPORT bool SetIF(bool value); + }; +}; + +#endif //_SCRIPTAPI_FLAG_H \ No newline at end of file diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_function.h b/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_function.h new file mode 100644 index 0000000..31fdb7f --- /dev/null +++ b/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_function.h @@ -0,0 +1,32 @@ +#ifndef _SCRIPTAPI_FUNCTION_H +#define _SCRIPTAPI_FUNCTION_H + +#include "_scriptapi.h" + +namespace Script +{ + namespace Function + { + struct FunctionInfo + { + char mod[MAX_MODULE_SIZE]; + duint rvaStart; + duint rvaEnd; + bool manual; + duint instructioncount; + }; + + SCRIPT_EXPORT bool Add(duint start, duint end, bool manual, duint instructionCount = 0); + SCRIPT_EXPORT bool Add(const FunctionInfo* info); + SCRIPT_EXPORT bool Get(duint addr, duint* start = nullptr, duint* end = nullptr, duint* instructionCount = nullptr); + SCRIPT_EXPORT bool GetInfo(duint addr, FunctionInfo* info); + SCRIPT_EXPORT bool Overlaps(duint start, duint end); + SCRIPT_EXPORT bool Delete(duint address); + SCRIPT_EXPORT void DeleteRange(duint start, duint end, bool deleteManual); + SCRIPT_EXPORT void DeleteRange(duint start, duint end); + SCRIPT_EXPORT void Clear(); + SCRIPT_EXPORT bool GetList(ListOf(FunctionInfo) list); //caller has the responsibility to free the list + }; //Function +}; //Script + +#endif //_SCRIPTAPI_FUNCTION_H diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_gui.h b/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_gui.h new file mode 100644 index 0000000..bc19b16 --- /dev/null +++ b/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_gui.h @@ -0,0 +1,78 @@ +#ifndef _SCRIPTAPI_GUI_H +#define _SCRIPTAPI_GUI_H + +#include "_scriptapi.h" + +namespace Script +{ + namespace Gui + { + namespace Disassembly + { + SCRIPT_EXPORT bool SelectionGet(duint* start, duint* end); + SCRIPT_EXPORT bool SelectionSet(duint start, duint end); + SCRIPT_EXPORT duint SelectionGetStart(); + SCRIPT_EXPORT duint SelectionGetEnd(); + }; //Disassembly + + namespace Dump + { + SCRIPT_EXPORT bool SelectionGet(duint* start, duint* end); + SCRIPT_EXPORT bool SelectionSet(duint start, duint end); + SCRIPT_EXPORT duint SelectionGetStart(); + SCRIPT_EXPORT duint SelectionGetEnd(); + }; //Dump + + namespace Stack + { + SCRIPT_EXPORT bool SelectionGet(duint* start, duint* end); + SCRIPT_EXPORT bool SelectionSet(duint start, duint end); + SCRIPT_EXPORT duint SelectionGetStart(); + SCRIPT_EXPORT duint SelectionGetEnd(); + }; //Stack + + namespace Graph + { + SCRIPT_EXPORT duint SelectionGetStart(); + }; //Graph + + namespace MemMap + { + SCRIPT_EXPORT duint SelectionGetStart(); + }; //MemoryMap + + namespace SymMod + { + SCRIPT_EXPORT duint SelectionGetStart(); + }; //SymMod + }; //Gui + + namespace Gui + { + enum Window + { + DisassemblyWindow, + DumpWindow, + StackWindow, + GraphWindow, + MemMapWindow, + SymModWindow + }; + + SCRIPT_EXPORT bool SelectionGet(Window window, duint* start, duint* end); + SCRIPT_EXPORT bool SelectionSet(Window window, duint start, duint end); + SCRIPT_EXPORT duint SelectionGetStart(Window window); + SCRIPT_EXPORT duint SelectionGetEnd(Window window); + SCRIPT_EXPORT void Message(const char* message); + SCRIPT_EXPORT bool MessageYesNo(const char* message); + SCRIPT_EXPORT bool InputLine(const char* title, char* text); //text[GUI_MAX_LINE_SIZE] + SCRIPT_EXPORT bool InputValue(const char* title, duint* value); + SCRIPT_EXPORT void Refresh(); + SCRIPT_EXPORT void AddQWidgetTab(void* qWidget); + SCRIPT_EXPORT void ShowQWidgetTab(void* qWidget); + SCRIPT_EXPORT void CloseQWidgetTab(void* qWidget); + + }; //Gui +}; //Script + +#endif //_SCRIPTAPI_GUI_H \ No newline at end of file diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_label.h b/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_label.h new file mode 100644 index 0000000..7ee503b --- /dev/null +++ b/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_label.h @@ -0,0 +1,30 @@ +#ifndef _SCRIPTAPI_LABEL_H +#define _SCRIPTAPI_LABEL_H + +#include "_scriptapi.h" + +namespace Script +{ + namespace Label + { + struct LabelInfo + { + char mod[MAX_MODULE_SIZE]; + duint rva; + char text[MAX_LABEL_SIZE]; + bool manual; + }; + + SCRIPT_EXPORT bool Set(duint addr, const char* text, bool manual = false); + SCRIPT_EXPORT bool Set(const LabelInfo* info); + SCRIPT_EXPORT bool FromString(const char* label, duint* addr); + SCRIPT_EXPORT bool Get(duint addr, char* text); //text[MAX_LABEL_SIZE] + SCRIPT_EXPORT bool GetInfo(duint addr, LabelInfo* info); + SCRIPT_EXPORT bool Delete(duint addr); + SCRIPT_EXPORT void DeleteRange(duint start, duint end); + SCRIPT_EXPORT void Clear(); + SCRIPT_EXPORT bool GetList(ListOf(LabelInfo) list); //caller has the responsibility to free the list + }; //Label +}; //Script + +#endif //_SCRIPTAPI_LABEL_H \ No newline at end of file diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_memory.h b/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_memory.h new file mode 100644 index 0000000..f52e0e4 --- /dev/null +++ b/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_memory.h @@ -0,0 +1,32 @@ +#ifndef _SCRIPTAPI_MEMORY_H +#define _SCRIPTAPI_MEMORY_H + +#include "_scriptapi.h" + +namespace Script +{ + namespace Memory + { + SCRIPT_EXPORT bool Read(duint addr, void* data, duint size, duint* sizeRead); + SCRIPT_EXPORT bool Write(duint addr, const void* data, duint size, duint* sizeWritten); + SCRIPT_EXPORT bool IsValidPtr(duint addr); + SCRIPT_EXPORT duint RemoteAlloc(duint addr, duint size); + SCRIPT_EXPORT bool RemoteFree(duint addr); + SCRIPT_EXPORT unsigned int GetProtect(duint addr, bool reserved = false, bool cache = true); + SCRIPT_EXPORT duint GetBase(duint addr, bool reserved = false, bool cache = true); + SCRIPT_EXPORT duint GetSize(duint addr, bool reserved = false, bool cache = true); + + SCRIPT_EXPORT unsigned char ReadByte(duint addr); + SCRIPT_EXPORT bool WriteByte(duint addr, unsigned char data); + SCRIPT_EXPORT unsigned short ReadWord(duint addr); + SCRIPT_EXPORT bool WriteWord(duint addr, unsigned short data); + SCRIPT_EXPORT unsigned int ReadDword(duint addr); + SCRIPT_EXPORT bool WriteDword(duint addr, unsigned int data); + SCRIPT_EXPORT unsigned long long ReadQword(duint addr); + SCRIPT_EXPORT bool WriteQword(duint addr, unsigned long long data); + SCRIPT_EXPORT duint ReadPtr(duint addr); + SCRIPT_EXPORT bool WritePtr(duint addr, duint data); + }; //Memory +}; //Script + +#endif //_SCRIPTAPI_MEMORY_H \ No newline at end of file diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_misc.h b/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_misc.h new file mode 100644 index 0000000..aca9063 --- /dev/null +++ b/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_misc.h @@ -0,0 +1,65 @@ +#ifndef _SCRIPTAPI_MISC_H +#define _SCRIPTAPI_MISC_H + +#include "_scriptapi.h" + +namespace Script +{ + namespace Misc + { + ///

+ /// Evaluates an expression and returns the result. Analagous to using the Command field in x64dbg. + /// + /// Expressions can consist of memory locations, registers, flags, API names, labels, symbols, variables etc. + /// + /// Example: bool success = ParseExpression("[esp+8]", &val) + /// + /// The expression to evaluate. + /// The result of the expression. + /// True on success, False on failure. + SCRIPT_EXPORT bool ParseExpression(const char* expression, duint* value); + + /// + /// Returns the address of a function in the debuggee's memory space. + /// + /// Example: duint addr = RemoteGetProcAddress("kernel32.dll", "GetProcAddress") + /// + /// The name of the module. + /// The name of the function. + /// The address of the function in the debuggee. + SCRIPT_EXPORT duint RemoteGetProcAddress(const char* module, const char* api); + + /// + /// Returns the address for a label created in the disassembly window. + /// + /// Example: duint addr = ResolveLabel("sneaky_crypto") + /// + /// The name of the label to resolve. + /// The memory address for the label. + SCRIPT_EXPORT duint ResolveLabel(const char* label); + + /// + /// Allocates the requested number of bytes from x64dbg's default process heap. + /// + /// Note: this allocation is in the debugger, not the debuggee. + /// + /// Memory allocated using this function should be Free'd after use. + /// + /// Example: void* addr = Alloc(0x100000) + /// + /// Number of bytes to allocate. + /// A pointer to the newly allocated memory. + SCRIPT_EXPORT void* Alloc(duint size); + + /// + /// Frees memory previously allocated by Alloc. + /// + /// Example: Free(addr) + /// + /// Pointer returned by Alloc. + /// Nothing. + SCRIPT_EXPORT void Free(void* ptr); + }; //Misc +}; //Script + +#endif //_SCRIPTAPI_MISC_H \ No newline at end of file diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_module.h b/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_module.h new file mode 100644 index 0000000..cb7d751 --- /dev/null +++ b/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_module.h @@ -0,0 +1,78 @@ +#ifndef _SCRIPTAPI_MODULE_H +#define _SCRIPTAPI_MODULE_H + +#include "_scriptapi.h" + +namespace Script +{ + namespace Module + { + struct ModuleInfo + { + duint base; + duint size; + duint entry; + int sectionCount; + char name[MAX_MODULE_SIZE]; + char path[MAX_PATH]; + }; + + struct ModuleSectionInfo + { + duint addr; + duint size; + char name[MAX_SECTION_SIZE * 5]; + }; + + struct ModuleExport + { + duint ordinal; + duint rva; + duint va; + bool forwarded; + char forwardName[MAX_STRING_SIZE]; + char name[MAX_STRING_SIZE]; + char undecoratedName[MAX_STRING_SIZE]; + }; + + struct ModuleImport + { + duint iatRva; + duint iatVa; + duint ordinal; //equal to -1 if imported by name + char name[MAX_STRING_SIZE]; + char undecoratedName[MAX_STRING_SIZE]; + }; + + SCRIPT_EXPORT bool InfoFromAddr(duint addr, ModuleInfo* info); + SCRIPT_EXPORT bool InfoFromName(const char* name, ModuleInfo* info); + SCRIPT_EXPORT duint BaseFromAddr(duint addr); + SCRIPT_EXPORT duint BaseFromName(const char* name); + SCRIPT_EXPORT duint SizeFromAddr(duint addr); + SCRIPT_EXPORT duint SizeFromName(const char* name); + SCRIPT_EXPORT bool NameFromAddr(duint addr, char* name); //name[MAX_MODULE_SIZE] + SCRIPT_EXPORT bool PathFromAddr(duint addr, char* path); //path[MAX_PATH] + SCRIPT_EXPORT bool PathFromName(const char* name, char* path); //path[MAX_PATH] + SCRIPT_EXPORT duint EntryFromAddr(duint addr); + SCRIPT_EXPORT duint EntryFromName(const char* name); + SCRIPT_EXPORT int SectionCountFromAddr(duint addr); + SCRIPT_EXPORT int SectionCountFromName(const char* name); + SCRIPT_EXPORT bool SectionFromAddr(duint addr, int number, ModuleSectionInfo* section); + SCRIPT_EXPORT bool SectionFromName(const char* name, int number, ModuleSectionInfo* section); + SCRIPT_EXPORT bool SectionListFromAddr(duint addr, ListOf(ModuleSectionInfo) list); + SCRIPT_EXPORT bool SectionListFromName(const char* name, ListOf(ModuleSectionInfo) list); + SCRIPT_EXPORT bool GetMainModuleInfo(ModuleInfo* info); + SCRIPT_EXPORT duint GetMainModuleBase(); + SCRIPT_EXPORT duint GetMainModuleSize(); + SCRIPT_EXPORT duint GetMainModuleEntry(); + SCRIPT_EXPORT int GetMainModuleSectionCount(); + SCRIPT_EXPORT bool GetMainModuleName(char* name); //name[MAX_MODULE_SIZE] + SCRIPT_EXPORT bool GetMainModulePath(char* path); //path[MAX_PATH] + SCRIPT_EXPORT bool GetMainModuleSectionList(ListOf(ModuleSectionInfo) list); //caller has the responsibility to free the list + SCRIPT_EXPORT bool GetList(ListOf(ModuleInfo) list); //caller has the responsibility to free the list + SCRIPT_EXPORT bool GetExports(const ModuleInfo* mod, ListOf(ModuleExport) list); //caller has the responsibility to free the list + SCRIPT_EXPORT bool GetImports(const ModuleInfo* mod, ListOf(ModuleImport) list); //caller has the responsibility to free the list + }; //Module +}; //Script + +#endif //_SCRIPTAPI_MODULE_H diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_pattern.h b/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_pattern.h new file mode 100644 index 0000000..ccf52ee --- /dev/null +++ b/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_pattern.h @@ -0,0 +1,19 @@ +#ifndef _SCRIPTAPI_PATTERN_H +#define _SCRIPTAPI_PATTERN_H + +#include "_scriptapi.h" + +namespace Script +{ + namespace Pattern + { + SCRIPT_EXPORT duint Find(unsigned char* data, duint datasize, const char* pattern); + SCRIPT_EXPORT duint FindMem(duint start, duint size, const char* pattern); + SCRIPT_EXPORT void Write(unsigned char* data, duint datasize, const char* pattern); + SCRIPT_EXPORT void WriteMem(duint start, duint size, const char* pattern); + SCRIPT_EXPORT bool SearchAndReplace(unsigned char* data, duint datasize, const char* searchpattern, const char* replacepattern); + SCRIPT_EXPORT bool SearchAndReplaceMem(duint start, duint size, const char* searchpattern, const char* replacepattern); + }; +}; + +#endif //_SCRIPTAPI_FIND_H \ No newline at end of file diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_register.h b/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_register.h new file mode 100644 index 0000000..b5c8d74 --- /dev/null +++ b/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_register.h @@ -0,0 +1,289 @@ +#ifndef _SCRIPTAPI_REGISTER_H +#define _SCRIPTAPI_REGISTER_H + +#include "_scriptapi.h" + +namespace Script +{ + namespace Register + { + enum RegisterEnum + { + DR0, + DR1, + DR2, + DR3, + DR6, + DR7, + + EAX, + AX, + AH, + AL, + EBX, + BX, + BH, + BL, + ECX, + CX, + CH, + CL, + EDX, + DX, + DH, + DL, + EDI, + DI, + ESI, + SI, + EBP, + BP, + ESP, + SP, + EIP, + +#ifdef _WIN64 + RAX, + RBX, + RCX, + RDX, + RSI, + SIL, + RDI, + DIL, + RBP, + BPL, + RSP, + SPL, + RIP, + R8, + R8D, + R8W, + R8B, + R9, + R9D, + R9W, + R9B, + R10, + R10D, + R10W, + R10B, + R11, + R11D, + R11W, + R11B, + R12, + R12D, + R12W, + R12B, + R13, + R13D, + R13W, + R13B, + R14, + R14D, + R14W, + R14B, + R15, + R15D, + R15W, + R15B, +#endif //_WIN64 + + CIP, + CSP, + CAX, + CBX, + CCX, + CDX, + CDI, + CSI, + CBP, + CFLAGS + }; //RegisterEnum + + SCRIPT_EXPORT duint Get(RegisterEnum reg); + SCRIPT_EXPORT bool Set(RegisterEnum reg, duint value); + SCRIPT_EXPORT int Size(); //gets architecture register size in bytes + + SCRIPT_EXPORT duint GetDR0(); + SCRIPT_EXPORT bool SetDR0(duint value); + SCRIPT_EXPORT duint GetDR1(); + SCRIPT_EXPORT bool SetDR1(duint value); + SCRIPT_EXPORT duint GetDR2(); + SCRIPT_EXPORT bool SetDR2(duint value); + SCRIPT_EXPORT duint GetDR3(); + SCRIPT_EXPORT bool SetDR3(duint value); + SCRIPT_EXPORT duint GetDR6(); + SCRIPT_EXPORT bool SetDR6(duint value); + SCRIPT_EXPORT duint GetDR7(); + SCRIPT_EXPORT bool SetDR7(duint value); + + SCRIPT_EXPORT unsigned int GetEAX(); + SCRIPT_EXPORT bool SetEAX(unsigned int value); + SCRIPT_EXPORT unsigned short GetAX(); + SCRIPT_EXPORT bool SetAX(unsigned short value); + SCRIPT_EXPORT unsigned char GetAH(); + SCRIPT_EXPORT bool SetAH(unsigned char value); + SCRIPT_EXPORT unsigned char GetAL(); + SCRIPT_EXPORT bool SetAL(unsigned char value); + SCRIPT_EXPORT unsigned int GetEBX(); + SCRIPT_EXPORT bool SetEBX(unsigned int value); + SCRIPT_EXPORT unsigned short GetBX(); + SCRIPT_EXPORT bool SetBX(unsigned short value); + SCRIPT_EXPORT unsigned char GetBH(); + SCRIPT_EXPORT bool SetBH(unsigned char value); + SCRIPT_EXPORT unsigned char GetBL(); + SCRIPT_EXPORT bool SetBL(unsigned char value); + SCRIPT_EXPORT unsigned int GetECX(); + SCRIPT_EXPORT bool SetECX(unsigned int value); + SCRIPT_EXPORT unsigned short GetCX(); + SCRIPT_EXPORT bool SetCX(unsigned short value); + SCRIPT_EXPORT unsigned char GetCH(); + SCRIPT_EXPORT bool SetCH(unsigned char value); + SCRIPT_EXPORT unsigned char GetCL(); + SCRIPT_EXPORT bool SetCL(unsigned char value); + SCRIPT_EXPORT unsigned int GetEDX(); + SCRIPT_EXPORT bool SetEDX(unsigned int value); + SCRIPT_EXPORT unsigned short GetDX(); + SCRIPT_EXPORT bool SetDX(unsigned short value); + SCRIPT_EXPORT unsigned char GetDH(); + SCRIPT_EXPORT bool SetDH(unsigned char value); + SCRIPT_EXPORT unsigned char GetDL(); + SCRIPT_EXPORT bool SetDL(unsigned char value); + SCRIPT_EXPORT unsigned int GetEDI(); + SCRIPT_EXPORT bool SetEDI(unsigned int value); + SCRIPT_EXPORT unsigned short GetDI(); + SCRIPT_EXPORT bool SetDI(unsigned short value); + SCRIPT_EXPORT unsigned int GetESI(); + SCRIPT_EXPORT bool SetESI(unsigned int value); + SCRIPT_EXPORT unsigned short GetSI(); + SCRIPT_EXPORT bool SetSI(unsigned short value); + SCRIPT_EXPORT unsigned int GetEBP(); + SCRIPT_EXPORT bool SetEBP(unsigned int value); + SCRIPT_EXPORT unsigned short GetBP(); + SCRIPT_EXPORT bool SetBP(unsigned short value); + SCRIPT_EXPORT unsigned int GetESP(); + SCRIPT_EXPORT bool SetESP(unsigned int value); + SCRIPT_EXPORT unsigned short GetSP(); + SCRIPT_EXPORT bool SetSP(unsigned short value); + SCRIPT_EXPORT unsigned int GetEIP(); + SCRIPT_EXPORT bool SetEIP(unsigned int value); + +#ifdef _WIN64 + SCRIPT_EXPORT unsigned long long GetRAX(); + SCRIPT_EXPORT bool SetRAX(unsigned long long value); + SCRIPT_EXPORT unsigned long long GetRBX(); + SCRIPT_EXPORT bool SetRBX(unsigned long long value); + SCRIPT_EXPORT unsigned long long GetRCX(); + SCRIPT_EXPORT bool SetRCX(unsigned long long value); + SCRIPT_EXPORT unsigned long long GetRDX(); + SCRIPT_EXPORT bool SetRDX(unsigned long long value); + SCRIPT_EXPORT unsigned long long GetRSI(); + SCRIPT_EXPORT bool SetRSI(unsigned long long value); + SCRIPT_EXPORT unsigned char GetSIL(); + SCRIPT_EXPORT bool SetSIL(unsigned char value); + SCRIPT_EXPORT unsigned long long GetRDI(); + SCRIPT_EXPORT bool SetRDI(unsigned long long value); + SCRIPT_EXPORT unsigned char GetDIL(); + SCRIPT_EXPORT bool SetDIL(unsigned char value); + SCRIPT_EXPORT unsigned long long GetRBP(); + SCRIPT_EXPORT bool SetRBP(unsigned long long value); + SCRIPT_EXPORT unsigned char GetBPL(); + SCRIPT_EXPORT bool SetBPL(unsigned char value); + SCRIPT_EXPORT unsigned long long GetRSP(); + SCRIPT_EXPORT bool SetRSP(unsigned long long value); + SCRIPT_EXPORT unsigned char GetSPL(); + SCRIPT_EXPORT bool SetSPL(unsigned char value); + SCRIPT_EXPORT unsigned long long GetRIP(); + SCRIPT_EXPORT bool SetRIP(unsigned long long value); + SCRIPT_EXPORT unsigned long long GetR8(); + SCRIPT_EXPORT bool SetR8(unsigned long long value); + SCRIPT_EXPORT unsigned int GetR8D(); + SCRIPT_EXPORT bool SetR8D(unsigned int value); + SCRIPT_EXPORT unsigned short GetR8W(); + SCRIPT_EXPORT bool SetR8W(unsigned short value); + SCRIPT_EXPORT unsigned char GetR8B(); + SCRIPT_EXPORT bool SetR8B(unsigned char value); + SCRIPT_EXPORT unsigned long long GetR9(); + SCRIPT_EXPORT bool SetR9(unsigned long long value); + SCRIPT_EXPORT unsigned int GetR9D(); + SCRIPT_EXPORT bool SetR9D(unsigned int value); + SCRIPT_EXPORT unsigned short GetR9W(); + SCRIPT_EXPORT bool SetR9W(unsigned short value); + SCRIPT_EXPORT unsigned char GetR9B(); + SCRIPT_EXPORT bool SetR9B(unsigned char value); + SCRIPT_EXPORT unsigned long long GetR10(); + SCRIPT_EXPORT bool SetR10(unsigned long long value); + SCRIPT_EXPORT unsigned int GetR10D(); + SCRIPT_EXPORT bool SetR10D(unsigned int value); + SCRIPT_EXPORT unsigned short GetR10W(); + SCRIPT_EXPORT bool SetR10W(unsigned short value); + SCRIPT_EXPORT unsigned char GetR10B(); + SCRIPT_EXPORT bool SetR10B(unsigned char value); + SCRIPT_EXPORT unsigned long long GetR11(); + SCRIPT_EXPORT bool SetR11(unsigned long long value); + SCRIPT_EXPORT unsigned int GetR11D(); + SCRIPT_EXPORT bool SetR11D(unsigned int value); + SCRIPT_EXPORT unsigned short GetR11W(); + SCRIPT_EXPORT bool SetR11W(unsigned short value); + SCRIPT_EXPORT unsigned char GetR11B(); + SCRIPT_EXPORT bool SetR11B(unsigned char value); + SCRIPT_EXPORT unsigned long long GetR12(); + SCRIPT_EXPORT bool SetR12(unsigned long long value); + SCRIPT_EXPORT unsigned int GetR12D(); + SCRIPT_EXPORT bool SetR12D(unsigned int value); + SCRIPT_EXPORT unsigned short GetR12W(); + SCRIPT_EXPORT bool SetR12W(unsigned short value); + SCRIPT_EXPORT unsigned char GetR12B(); + SCRIPT_EXPORT bool SetR12B(unsigned char value); + SCRIPT_EXPORT unsigned long long GetR13(); + SCRIPT_EXPORT bool SetR13(unsigned long long value); + SCRIPT_EXPORT unsigned int GetR13D(); + SCRIPT_EXPORT bool SetR13D(unsigned int value); + SCRIPT_EXPORT unsigned short GetR13W(); + SCRIPT_EXPORT bool SetR13W(unsigned short value); + SCRIPT_EXPORT unsigned char GetR13B(); + SCRIPT_EXPORT bool SetR13B(unsigned char value); + SCRIPT_EXPORT unsigned long long GetR14(); + SCRIPT_EXPORT bool SetR14(unsigned long long value); + SCRIPT_EXPORT unsigned int GetR14D(); + SCRIPT_EXPORT bool SetR14D(unsigned int value); + SCRIPT_EXPORT unsigned short GetR14W(); + SCRIPT_EXPORT bool SetR14W(unsigned short value); + SCRIPT_EXPORT unsigned char GetR14B(); + SCRIPT_EXPORT bool SetR14B(unsigned char value); + SCRIPT_EXPORT unsigned long long GetR15(); + SCRIPT_EXPORT bool SetR15(unsigned long long value); + SCRIPT_EXPORT unsigned int GetR15D(); + SCRIPT_EXPORT bool SetR15D(unsigned int value); + SCRIPT_EXPORT unsigned short GetR15W(); + SCRIPT_EXPORT bool SetR15W(unsigned short value); + SCRIPT_EXPORT unsigned char GetR15B(); + SCRIPT_EXPORT bool SetR15B(unsigned char value); +#endif //_WIN64 + + SCRIPT_EXPORT duint GetCAX(); + SCRIPT_EXPORT bool SetCAX(duint value); + SCRIPT_EXPORT duint GetCBX(); + SCRIPT_EXPORT bool SetCBX(duint value); + SCRIPT_EXPORT duint GetCCX(); + SCRIPT_EXPORT bool SetCCX(duint value); + SCRIPT_EXPORT duint GetCDX(); + SCRIPT_EXPORT bool SetCDX(duint value); + SCRIPT_EXPORT duint GetCDI(); + SCRIPT_EXPORT bool SetCDI(duint value); + SCRIPT_EXPORT duint GetCSI(); + SCRIPT_EXPORT bool SetCSI(duint value); + SCRIPT_EXPORT duint GetCBP(); + SCRIPT_EXPORT bool SetCBP(duint value); + SCRIPT_EXPORT duint GetCSP(); + SCRIPT_EXPORT bool SetCSP(duint value); + SCRIPT_EXPORT duint GetCIP(); + SCRIPT_EXPORT bool SetCIP(duint value); + SCRIPT_EXPORT duint GetCFLAGS(); + SCRIPT_EXPORT bool SetCFLAGS(duint value); + }; //Register +}; //Script + +#endif //_SCRIPTAPI_REGISTER_H \ No newline at end of file diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_stack.h b/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_stack.h new file mode 100644 index 0000000..55522b7 --- /dev/null +++ b/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_stack.h @@ -0,0 +1,16 @@ +#ifndef _SCRIPTAPI_STACK_H +#define _SCRIPTAPI_STACK_H + +#include "_scriptapi.h" + +namespace Script +{ + namespace Stack + { + SCRIPT_EXPORT duint Pop(); + SCRIPT_EXPORT duint Push(duint value); //returns the previous top, equal to Peek(1) + SCRIPT_EXPORT duint Peek(int offset = 0); //offset is in multiples of Register::Size(), for easy x32/x64 portability + }; //Stack +}; //Script + +#endif //_SCRIPTAPI_STACK_H \ No newline at end of file diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_symbol.h b/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_symbol.h new file mode 100644 index 0000000..9d51d42 --- /dev/null +++ b/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_symbol.h @@ -0,0 +1,30 @@ +#ifndef _SCRIPTAPI_SYMBOL_H +#define _SCRIPTAPI_SYMBOL_H + +#include "_scriptapi.h" + +namespace Script +{ + namespace Symbol + { + enum SymbolType + { + Function, //user-defined function + Import, //IAT entry + Export //export + }; + + struct SymbolInfo + { + char mod[MAX_MODULE_SIZE]; + duint rva; + char name[MAX_LABEL_SIZE]; + bool manual; + SymbolType type; + }; + + SCRIPT_EXPORT bool GetList(ListOf(SymbolInfo) list); //caller has the responsibility to free the list + }; //Symbol +}; //Script + +#endif //_SCRIPTAPI_SYMBOL_H \ No newline at end of file diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/bridgegraph.h b/BranchTrace-x64plugin-wtl/pluginsdk/bridgegraph.h new file mode 100644 index 0000000..7638aaf --- /dev/null +++ b/BranchTrace-x64plugin-wtl/pluginsdk/bridgegraph.h @@ -0,0 +1,186 @@ +#ifndef _GRAPH_H +#define _GRAPH_H + +typedef struct +{ + duint addr; //virtual address of the instruction + unsigned char data[15]; //instruction bytes +} BridgeCFInstruction; + +typedef struct +{ + duint parentGraph; //function of which this node is a part + duint start; //start of the block + duint end; //end of the block (inclusive) + duint brtrue; //destination if condition is true + duint brfalse; //destination if condition is false + duint icount; //number of instructions in node + bool terminal; //node is a RET + bool split; //node is a split (brtrue points to the next node) + bool indirectcall; //node contains indirect calls (call reg, call [reg+X]) + void* userdata; //user data + ListInfo exits; //exits (including brtrue and brfalse, duint) + ListInfo instrs; //block instructions +} BridgeCFNodeList; + +typedef struct +{ + duint entryPoint; //graph entry point + void* userdata; //user data + ListInfo nodes; //graph nodes (BridgeCFNodeList) +} BridgeCFGraphList; + +#ifdef __cplusplus +#if _MSC_VER >= 1700 && !defined(NO_CPP11) + +#include +#include +#include +#include + +struct BridgeCFNode +{ + duint parentGraph = 0; //function of which this node is a part + duint start = 0; //va of the first instruction in the block + duint end = 0; //va of the last instruction in the block (inclusive) + duint brtrue = 0; //destination if condition is true + duint brfalse = 0; //destination if condition is false + duint icount = 0; //number of instructions in node + bool terminal = false; //node is a RET + bool split = false; //node is a split (brtrue points to the next node) + bool indirectcall = false; //node contains indirect calls (call reg, call [reg+X]) + void* userdata = nullptr; //user data + std::vector exits; //exits (including brtrue and brfalse) + std::vector instrs; //block instructions + + static void Free(const BridgeCFNodeList* nodeList) + { + if(!BridgeList::Free(&nodeList->exits)) + __debugbreak(); + if(!BridgeList::Free(&nodeList->instrs)) + __debugbreak(); + } + + BridgeCFNode() = default; + + BridgeCFNode(const BridgeCFNodeList* nodeList, bool freedata) + { + if(!nodeList) + __debugbreak(); + parentGraph = nodeList->parentGraph; + start = nodeList->start; + end = nodeList->end; + brtrue = nodeList->brtrue; + brfalse = nodeList->brfalse; + icount = nodeList->icount; + terminal = nodeList->terminal; + indirectcall = nodeList->indirectcall; + split = nodeList->split; + userdata = nodeList->userdata; + if(!BridgeList::ToVector(&nodeList->exits, exits, freedata)) + __debugbreak(); + if(!BridgeList::ToVector(&nodeList->instrs, instrs, freedata)) + __debugbreak(); + } + + BridgeCFNode(duint parentGraph, duint start, duint end) + : parentGraph(parentGraph), + start(start), + end(end) + { + } + + BridgeCFNodeList ToNodeList() const + { + BridgeCFNodeList out; + out.parentGraph = parentGraph; + out.start = start; + out.end = end; + out.brtrue = brtrue; + out.brfalse = brfalse; + out.icount = icount; + out.terminal = terminal; + out.indirectcall = indirectcall; + out.split = split; + out.userdata = userdata; + BridgeList::CopyData(&out.exits, exits); + BridgeList::CopyData(&out.instrs, instrs); + return std::move(out); + } +}; + +struct BridgeCFGraph +{ + duint entryPoint; //graph entry point + void* userdata; //user data + std::unordered_map nodes; //CFNode.start -> CFNode + std::unordered_map> parents; //CFNode.start -> parents + + static void Free(const BridgeCFGraphList* graphList) + { + if(!graphList || graphList->nodes.size != graphList->nodes.count * sizeof(BridgeCFNodeList)) + __debugbreak(); + auto data = (BridgeCFNodeList*)graphList->nodes.data; + for(int i = 0; i < graphList->nodes.count; i++) + BridgeCFNode::Free(&data[i]); + BridgeFree(data); + } + + explicit BridgeCFGraph(const BridgeCFGraphList* graphList, bool freedata) + { + if(!graphList || graphList->nodes.size != graphList->nodes.count * sizeof(BridgeCFNodeList)) + __debugbreak(); + entryPoint = graphList->entryPoint; + userdata = graphList->userdata; + auto data = (BridgeCFNodeList*)graphList->nodes.data; + for(int i = 0; i < graphList->nodes.count; i++) + AddNode(BridgeCFNode(&data[i], freedata)); + if(freedata && data) + BridgeFree(data); + } + + explicit BridgeCFGraph(duint entryPoint) + : entryPoint(entryPoint), + userdata(nullptr) + { + } + + void AddNode(const BridgeCFNode & node) + { + nodes[node.start] = node; + AddParent(node.start, node.brtrue); + AddParent(node.start, node.brfalse); + } + + void AddParent(duint child, duint parent) + { + if(!child || !parent) + return; + auto found = parents.find(child); + if(found == parents.end()) + { + parents[child] = std::unordered_set(); + parents[child].insert(parent); + } + else + found->second.insert(parent); + } + + BridgeCFGraphList ToGraphList() const + { + BridgeCFGraphList out; + out.entryPoint = entryPoint; + out.userdata = userdata; + std::vector nodeList; + nodeList.reserve(nodes.size()); + for(const auto & nodeIt : nodes) + nodeList.push_back(nodeIt.second.ToNodeList()); + BridgeList::CopyData(&out.nodes, nodeList); + return std::move(out); + } +}; + +#endif //_MSC_VER +#endif //__cplusplus + +#endif //_GRAPH_H \ No newline at end of file diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/bridgelist.h b/BranchTrace-x64plugin-wtl/pluginsdk/bridgelist.h new file mode 100644 index 0000000..d71d203 --- /dev/null +++ b/BranchTrace-x64plugin-wtl/pluginsdk/bridgelist.h @@ -0,0 +1,149 @@ +#ifndef _LIST_H +#define _LIST_H + +typedef struct +{ + int count; //Number of element in the list. + size_t size; //Size of list in bytes (used for type checking). + void* data; //Pointer to the list contents. Must be deleted by the caller using BridgeFree (or BridgeList::Free). +} ListInfo; + +#define ListOf(Type) ListInfo* + +#ifdef __cplusplus + +#include + +/** +\brief A list object. This object is NOT thread safe. +\tparam Type BridgeList contents type. +*/ +template +class BridgeList +{ +public: + /** + \brief BridgeList constructor. + \param _freeData (Optional) the free function. + */ + explicit BridgeList() + { + memset(&_listInfo, 0, sizeof(_listInfo)); + } + + /** + \brief BridgeList destructor. + */ + ~BridgeList() + { + Cleanup(); + } + + /** + \brief Gets the list data. + \return Returns ListInfo->data. Can be null if the list was never initialized. Will be destroyed once this object goes out of scope! + */ + Type* Data() const + { + return reinterpret_cast(_listInfo.data); + } + + /** + \brief Gets the number of elements in the list. This will crash the program if the data is not consistent with the specified template argument. + \return The number of elements in the list. + */ + int Count() const + { + if(_listInfo.size != _listInfo.count * sizeof(Type)) //make sure the user is using the correct type. + __debugbreak(); + return _listInfo.count; + } + + /** + \brief Cleans up the list, freeing the list data when it is not null. + */ + void Cleanup() + { + if(_listInfo.data) + { + BridgeFree(_listInfo.data); + _listInfo.data = nullptr; + } + } + + /** + \brief Reference operator (cleans up the previous list) + \return Pointer to the ListInfo. + */ + ListInfo* operator&() + { + Cleanup(); + return &_listInfo; + } + + /** + \brief Array indexer operator. This will crash if you try to access out-of-bounds. + \param index Zero-based index of the item you want to get. + \return Reference to a value at that index. + */ + Type & operator[](size_t index) const + { + if(index >= size_t(Count())) //make sure the out-of-bounds access is caught as soon as possible. + __debugbreak(); + return Data()[index]; + } + + /** + \brief Copies data to a ListInfo structure.. + \param [out] listInfo If non-null, information describing the list. + \param listData Data to copy in the ListInfo structure. + \return true if it succeeds, false if it fails. + */ + static bool CopyData(ListInfo* listInfo, const std::vector & listData) + { + if(!listInfo) + return false; + listInfo->count = int(listData.size()); + listInfo->size = listInfo->count * sizeof(Type); + if(listInfo->count) + { + listInfo->data = BridgeAlloc(listInfo->size); + Type* curItem = reinterpret_cast(listInfo->data); + for(const auto & item : listData) + { + *curItem = item; + ++curItem; + } + } + else + listInfo->data = nullptr; + return true; + } + + static bool Free(const ListInfo* listInfo) + { + if(!listInfo || listInfo->size != listInfo->count * sizeof(Type) || (listInfo->count && !listInfo->data)) + return false; + BridgeFree(listInfo->data); + return true; + } + + static bool ToVector(const ListInfo* listInfo, std::vector & listData, bool freedata = true) + { + if(!listInfo || listInfo->size != listInfo->count * sizeof(Type) || (listInfo->count && !listInfo->data)) + return false; + listData.resize(listInfo->count); + for(int i = 0; i < listInfo->count; i++) + listData[i] = ((Type*)listInfo->data)[i]; + if(freedata && listInfo->data) + BridgeFree(listInfo->data); + return true; + } + +private: + ListInfo _listInfo; +}; + +#endif //__cplusplus + +#endif //_LIST_H \ No newline at end of file diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/bridgemain.h b/BranchTrace-x64plugin-wtl/pluginsdk/bridgemain.h new file mode 100644 index 0000000..5be72e7 --- /dev/null +++ b/BranchTrace-x64plugin-wtl/pluginsdk/bridgemain.h @@ -0,0 +1,1388 @@ +#ifndef _BRIDGEMAIN_H_ +#define _BRIDGEMAIN_H_ + +#include + +#ifndef __cplusplus +#include +#define DEFAULT_PARAM(name, value) name +#else +#define DEFAULT_PARAM(name, value) name = value +#endif + +//default structure alignments forced +#ifdef _WIN64 +#pragma pack(push, 16) +#else //x86 +#pragma pack(push, 8) +#endif //_WIN64 + +#ifdef _WIN64 +typedef unsigned long long duint; +typedef signed long long dsint; +#else +typedef unsigned long duint; +typedef signed long dsint; +#endif //_WIN64 + +#ifndef BRIDGE_IMPEXP +#ifdef BUILD_BRIDGE +#define BRIDGE_IMPEXP __declspec(dllexport) +#else +#define BRIDGE_IMPEXP __declspec(dllimport) +#endif //BUILD_BRIDGE +#endif //BRIDGE_IMPEXP + +#ifdef __cplusplus +extern "C" +{ +#endif + +//Bridge defines +#define MAX_SETTING_SIZE 65536 +#define DBG_VERSION 25 + +//Bridge functions + +/// +/// Initialize the bridge. +/// +/// On error it returns a non-null error message. +BRIDGE_IMPEXP const wchar_t* BridgeInit(); + +/// +/// Start the bridge. +/// +/// On error it returns a non-null error message. +BRIDGE_IMPEXP const wchar_t* BridgeStart(); + +/// +/// Allocate buffer. Use BridgeFree to free the buffer. +/// +/// Size in bytes of the buffer to allocate. +/// A pointer to the allocated buffer. This function will trigger a crash dump if unsuccessful. +BRIDGE_IMPEXP void* BridgeAlloc(size_t size); + +/// +/// Free buffer allocated by BridgeAlloc. +/// +/// Buffer to free. +BRIDGE_IMPEXP void BridgeFree(void* ptr); + +/// +/// Get a string setting from the in-memory setting store. +/// +/// Section the setting is in. Cannot be null. +/// Setting key (name). Cannot be null. +/// Output buffer for the value. Should be of MAX_SETTING_SIZE. Cannot be null. +/// True if the setting was found and copied in the value parameter. +BRIDGE_IMPEXP bool BridgeSettingGet(const char* section, const char* key, char* value); + +/// +/// Get an integer setting from the in-memory setting store. +/// +/// Section the setting is in. Cannot be null. +/// Setting key (name). Cannot be null. +/// Output value. +/// True if the setting was found and successfully converted to an integer. +BRIDGE_IMPEXP bool BridgeSettingGetUint(const char* section, const char* key, duint* value); + +/// +/// Set a string setting in the in-memory setting store. +/// +/// Section the setting is in. Cannot be null. +/// Setting key (name). Set to null to clear the whole section. +/// New setting value. Set to null to remove the key from the section. +/// True if the operation was successful. +BRIDGE_IMPEXP bool BridgeSettingSet(const char* section, const char* key, const char* value); + +/// +/// Set an integer setting in the in-memory setting store. +/// +/// Section the setting is in. Cannot be null. +/// Setting key (name). Set to null to clear the whole section. +/// New setting value. +/// True if the operation was successful. +BRIDGE_IMPEXP bool BridgeSettingSetUint(const char* section, const char* key, duint value); + +/// +/// Flush the in-memory setting store to disk. +/// +/// +BRIDGE_IMPEXP bool BridgeSettingFlush(); + +/// +/// Read the in-memory setting store from disk. +/// +/// Line where the error occurred. Set to null to ignore this. +/// True if the setting were read and parsed correctly. +BRIDGE_IMPEXP bool BridgeSettingRead(int* errorLine); + +/// +/// Get the debugger version. +/// +/// 25 +BRIDGE_IMPEXP int BridgeGetDbgVersion(); + +/// +/// Checks if the current process is elevated. +/// +/// true if the process is elevated, false otherwise. +BRIDGE_IMPEXP bool BridgeIsProcessElevated(); + +#ifdef __cplusplus +} +#endif + +//list structure (and C++ wrapper) +#include "bridgelist.h" + +#include "bridgegraph.h" + +#ifdef __cplusplus +extern "C" +{ +#endif + +//Debugger defines +#define MAX_LABEL_SIZE 256 +#define MAX_COMMENT_SIZE 512 +#define MAX_MODULE_SIZE 256 +#define MAX_IMPORT_SIZE 65536 +#define MAX_BREAKPOINT_SIZE 256 +#define MAX_CONDITIONAL_EXPR_SIZE 256 +#define MAX_CONDITIONAL_TEXT_SIZE 256 +#define MAX_SCRIPT_LINE_SIZE 2048 +#define MAX_THREAD_NAME_SIZE 256 +#define MAX_WATCH_NAME_SIZE 256 +#define MAX_STRING_SIZE 512 +#define MAX_ERROR_SIZE 512 +#define RIGHTS_STRING_SIZE (sizeof("ERWCG") + 1) +#define MAX_SECTION_SIZE 10 +#define MAX_COMMAND_LINE_SIZE 256 +#define MAX_MNEMONIC_SIZE 64 +#define PAGE_SIZE 0x1000 + +//Debugger enums +typedef enum +{ + initialized, + paused, + running, + stopped +} DBGSTATE; + +typedef enum +{ + SEG_DEFAULT, + SEG_ES, + SEG_DS, + SEG_FS, + SEG_GS, + SEG_CS, + SEG_SS +} SEGMENTREG; + +typedef enum +{ + flagmodule = 0x1, + flaglabel = 0x2, + flagcomment = 0x4, + flagbookmark = 0x8, + flagfunction = 0x10, + flagloop = 0x20, + flagargs = 0x40, + flagNoFuncOffset = 0x80 +} ADDRINFOFLAGS; + +typedef enum +{ + bp_none = 0, + bp_normal = 1, + bp_hardware = 2, + bp_memory = 4, + bp_dll = 8, + bp_exception = 16 +} BPXTYPE; + +typedef enum +{ + FUNC_NONE, + FUNC_BEGIN, + FUNC_MIDDLE, + FUNC_END, + FUNC_SINGLE +} FUNCTYPE; + +typedef enum +{ + LOOP_NONE, + LOOP_BEGIN, + LOOP_MIDDLE, + LOOP_ENTRY, + LOOP_END, + LOOP_SINGLE +} LOOPTYPE; + +//order by most important type last +typedef enum +{ + XREF_NONE, + XREF_DATA, + XREF_JMP, + XREF_CALL +} XREFTYPE; + +typedef enum +{ + ARG_NONE, + ARG_BEGIN, + ARG_MIDDLE, + ARG_END, + ARG_SINGLE +} ARGTYPE; + +typedef enum +{ + DBG_SCRIPT_LOAD, // param1=const char* filename, param2=unused + DBG_SCRIPT_UNLOAD, // param1=unused, param2=unused + DBG_SCRIPT_RUN, // param1=int destline, param2=unused + DBG_SCRIPT_STEP, // param1=unused, param2=unused + DBG_SCRIPT_BPTOGGLE, // param1=int line, param2=unused + DBG_SCRIPT_BPGET, // param1=int line, param2=unused + DBG_SCRIPT_CMDEXEC, // param1=const char* command, param2=unused + DBG_SCRIPT_ABORT, // param1=unused, param2=unused + DBG_SCRIPT_GETLINETYPE, // param1=int line, param2=unused + DBG_SCRIPT_SETIP, // param1=int line, param2=unused + DBG_SCRIPT_GETBRANCHINFO, // param1=int line, param2=SCRIPTBRANCH* info + DBG_SYMBOL_ENUM, // param1=SYMBOLCBINFO* cbInfo, param2=unused + DBG_ASSEMBLE_AT, // param1=duint addr, param2=const char* instruction + DBG_MODBASE_FROM_NAME, // param1=const char* modname, param2=unused + DBG_DISASM_AT, // param1=duint addr, param2=DISASM_INSTR* instr + DBG_STACK_COMMENT_GET, // param1=duint addr, param2=STACK_COMMENT* comment + DBG_GET_THREAD_LIST, // param1=THREADALLINFO* list, param2=unused + DBG_SETTINGS_UPDATED, // param1=unused, param2=unused + DBG_DISASM_FAST_AT, // param1=duint addr, param2=BASIC_INSTRUCTION_INFO* basicinfo + DBG_MENU_ENTRY_CLICKED, // param1=int hEntry, param2=unused + DBG_FUNCTION_GET, // param1=FUNCTION_LOOP_INFO* info, param2=unused + DBG_FUNCTION_OVERLAPS, // param1=FUNCTION_LOOP_INFO* info, param2=unused + DBG_FUNCTION_ADD, // param1=FUNCTION_LOOP_INFO* info, param2=unused + DBG_FUNCTION_DEL, // param1=FUNCTION_LOOP_INFO* info, param2=unused + DBG_LOOP_GET, // param1=FUNCTION_LOOP_INFO* info, param2=unused + DBG_LOOP_OVERLAPS, // param1=FUNCTION_LOOP_INFO* info, param2=unused + DBG_LOOP_ADD, // param1=FUNCTION_LOOP_INFO* info, param2=unused + DBG_LOOP_DEL, // param1=FUNCTION_LOOP_INFO* info, param2=unused + DBG_IS_RUN_LOCKED, // param1=unused, param2=unused + DBG_IS_BP_DISABLED, // param1=duint addr, param2=unused + DBG_SET_AUTO_COMMENT_AT, // param1=duint addr, param2=const char* text + DBG_DELETE_AUTO_COMMENT_RANGE, // param1=duint start, param2=duint end + DBG_SET_AUTO_LABEL_AT, // param1=duint addr, param2=const char* text + DBG_DELETE_AUTO_LABEL_RANGE, // param1=duint start, param2=duint end + DBG_SET_AUTO_BOOKMARK_AT, // param1=duint addr, param2=const char* text + DBG_DELETE_AUTO_BOOKMARK_RANGE, // param1=duint start, param2=duint end + DBG_SET_AUTO_FUNCTION_AT, // param1=duint addr, param2=const char* text + DBG_DELETE_AUTO_FUNCTION_RANGE, // param1=duint start, param2=duint end + DBG_GET_STRING_AT, // param1=duint addr, param2=unused + DBG_GET_FUNCTIONS, // param1=unused, param2=unused + DBG_WIN_EVENT, // param1=MSG* message, param2=long* result + DBG_WIN_EVENT_GLOBAL, // param1=MSG* message, param2=unused + DBG_INITIALIZE_LOCKS, // param1=unused, param2=unused + DBG_DEINITIALIZE_LOCKS, // param1=unused, param2=unused + DBG_GET_TIME_WASTED_COUNTER, // param1=unused, param2=unused + DBG_SYMBOL_ENUM_FROMCACHE, // param1=SYMBOLCBINFO* cbInfo, param2=unused + DBG_DELETE_COMMENT_RANGE, // param1=duint start, param2=duint end + DBG_DELETE_LABEL_RANGE, // param1=duint start, param2=duint end + DBG_DELETE_BOOKMARK_RANGE, // param1=duint start, param2=duint end + DBG_GET_XREF_COUNT_AT, // param1=duint addr, param2=unused + DBG_GET_XREF_TYPE_AT, // param1=duint addr, param2=unused + DBG_XREF_ADD, // param1=duint addr, param2=duint from + DBG_XREF_DEL_ALL, // param1=duint addr, param2=unused + DBG_XREF_GET, // param1=duint addr, param2=XREF_INFO* info + DBG_GET_ENCODE_TYPE_BUFFER, // param1=duint addr, param2=unused + DBG_ENCODE_TYPE_GET, // param1=duint addr, param2=duint size + DBG_DELETE_ENCODE_TYPE_RANGE, // param1=duint start, param2=duint end + DBG_ENCODE_SIZE_GET, // param1=duint addr, param2=duint codesize + DBG_DELETE_ENCODE_TYPE_SEG, // param1=duint addr, param2=unused + DBG_RELEASE_ENCODE_TYPE_BUFFER, // param1=void* buffer, param2=unused + DBG_ARGUMENT_GET, // param1=FUNCTION* info, param2=unused + DBG_ARGUMENT_OVERLAPS, // param1=FUNCTION* info, param2=unused + DBG_ARGUMENT_ADD, // param1=FUNCTION* info, param2=unused + DBG_ARGUMENT_DEL, // param1=FUNCTION* info, param2=unused + DBG_GET_WATCH_LIST, // param1=ListOf(WATCHINFO), param2=unused + DBG_SELCHANGED, // param1=hWindow, param2=VA + DBG_GET_PROCESS_HANDLE, // param1=unused, param2=unused + DBG_GET_THREAD_HANDLE, // param1=unused, param2=unused + DBG_GET_PROCESS_ID, // param1=unused, param2=unused + DBG_GET_THREAD_ID, // param1=unused, param2=unused + DBG_GET_PEB_ADDRESS, // param1=DWORD ProcessId, param2=unused + DBG_GET_TEB_ADDRESS, // param1=DWORD ThreadId, param2=unused + DBG_ANALYZE_FUNCTION, // param1=BridgeCFGraphList* graph, param2=duint entry + DBG_MENU_PREPARE, // param1=int hMenu, param2=unused + DBG_GET_SYMBOL_INFO, // param1=void* symbol, param2=SYMBOLINFO* info + DBG_GET_DEBUG_ENGINE, // param1=unused, param2-unused +} DBGMSG; + +typedef enum +{ + linecommand, + linebranch, + linelabel, + linecomment, + lineempty, +} SCRIPTLINETYPE; + +typedef enum +{ + scriptnobranch, + scriptjmp, + scriptjnejnz, + scriptjejz, + scriptjbjl, + scriptjajg, + scriptjbejle, + scriptjaejge, + scriptcall +} SCRIPTBRANCHTYPE; + +typedef enum +{ + instr_normal, + instr_branch, + instr_stack +} DISASM_INSTRTYPE; + +typedef enum +{ + arg_normal, + arg_memory +} DISASM_ARGTYPE; + +typedef enum +{ + str_none, + str_ascii, + str_unicode +} STRING_TYPE; + +typedef enum +{ + _PriorityIdle = -15, + _PriorityAboveNormal = 1, + _PriorityBelowNormal = -1, + _PriorityHighest = 2, + _PriorityLowest = -2, + _PriorityNormal = 0, + _PriorityTimeCritical = 15, + _PriorityUnknown = 0x7FFFFFFF +} THREADPRIORITY; + +typedef enum +{ + _Executive = 0, + _FreePage = 1, + _PageIn = 2, + _PoolAllocation = 3, + _DelayExecution = 4, + _Suspended = 5, + _UserRequest = 6, + _WrExecutive = 7, + _WrFreePage = 8, + _WrPageIn = 9, + _WrPoolAllocation = 10, + _WrDelayExecution = 11, + _WrSuspended = 12, + _WrUserRequest = 13, + _WrEventPair = 14, + _WrQueue = 15, + _WrLpcReceive = 16, + _WrLpcReply = 17, + _WrVirtualMemory = 18, + _WrPageOut = 19, + _WrRendezvous = 20, + _Spare2 = 21, + _Spare3 = 22, + _Spare4 = 23, + _Spare5 = 24, + _WrCalloutStack = 25, + _WrKernel = 26, + _WrResource = 27, + _WrPushLock = 28, + _WrMutex = 29, + _WrQuantumEnd = 30, + _WrDispatchInt = 31, + _WrPreempted = 32, + _WrYieldExecution = 33, + _WrFastMutex = 34, + _WrGuardedMutex = 35, + _WrRundown = 36, +} THREADWAITREASON; + +typedef enum +{ + size_byte = 1, + size_word = 2, + size_dword = 4, + size_qword = 8, + size_xmmword = 16, + size_ymmword = 32 +} MEMORY_SIZE; + +typedef enum +{ + enc_unknown, //must be 0 + enc_byte, //1 byte + enc_word, //2 bytes + enc_dword, //4 bytes + enc_fword, //6 bytes + enc_qword, //8 bytes + enc_tbyte, //10 bytes + enc_oword, //16 bytes + enc_mmword, //8 bytes + enc_xmmword, //16 bytes + enc_ymmword, //32 bytes + enc_zmmword, //64 bytes avx512 not supported + enc_real4, //4 byte float + enc_real8, //8 byte double + enc_real10, //10 byte decimal + enc_ascii, //ascii sequence + enc_unicode, //unicode sequence + enc_code, //start of code + enc_junk, //junk code + enc_middle //middle of data +} ENCODETYPE; + +typedef enum +{ + TYPE_UINT, // unsigned integer + TYPE_INT, // signed integer + TYPE_FLOAT,// single precision floating point value + TYPE_ASCII, // ascii string + TYPE_UNICODE, // unicode string + TYPE_INVALID // invalid watch expression or data type +} WATCHVARTYPE; + +typedef enum +{ + MODE_DISABLED, // watchdog is disabled + MODE_ISTRUE, // alert if expression is not 0 + MODE_ISFALSE, // alert if expression is 0 + MODE_CHANGED, // alert if expression is changed + MODE_UNCHANGED // alert if expression is not changed +} WATCHDOGMODE; + +typedef enum +{ + hw_access, + hw_write, + hw_execute +} BPHWTYPE; + +typedef enum +{ + mem_access, + mem_read, + mem_write, + mem_execute +} BPMEMTYPE; + +typedef enum +{ + dll_load = 1, + dll_unload, + dll_all +} BPDLLTYPE; + +typedef enum +{ + ex_firstchance = 1, + ex_secondchance, + ex_all +} BPEXTYPE; + +typedef enum +{ + hw_byte, + hw_word, + hw_dword, + hw_qword +} BPHWSIZE; + +typedef enum +{ + sym_import, + sym_export, + sym_symbol +} SYMBOLTYPE; + +typedef enum +{ + mod_user, + mod_system +} MODULEPARTY; + +typedef enum +{ + DebugEngineTitanEngine, + DebugEngineGleeBug, + DebugEngineStaticEngine, +} DEBUG_ENGINE; + +//Debugger typedefs +typedef MEMORY_SIZE VALUE_SIZE; + +typedef struct DBGFUNCTIONS_ DBGFUNCTIONS; + +typedef bool (*CBSYMBOLENUM)(const struct SYMBOLPTR_* symbol, void* user); + +//Debugger structs +typedef struct +{ + MEMORY_BASIC_INFORMATION mbi; + char info[MAX_MODULE_SIZE]; +} MEMPAGE; + +typedef struct +{ + int count; + MEMPAGE* page; +} MEMMAP; + +typedef struct +{ + BPXTYPE type; + duint addr; + bool enabled; + bool singleshoot; + bool active; + char name[MAX_BREAKPOINT_SIZE]; + char mod[MAX_MODULE_SIZE]; + unsigned short slot; + // extended part + unsigned char typeEx; //BPHWTYPE/BPMEMTYPE/BPDLLTYPE/BPEXTYPE + unsigned char hwSize; //BPHWSIZE + unsigned int hitCount; + bool fastResume; + bool silent; + char breakCondition[MAX_CONDITIONAL_EXPR_SIZE]; + char logText[MAX_CONDITIONAL_TEXT_SIZE]; + char logCondition[MAX_CONDITIONAL_EXPR_SIZE]; + char commandText[MAX_CONDITIONAL_TEXT_SIZE]; + char commandCondition[MAX_CONDITIONAL_EXPR_SIZE]; +} BRIDGEBP; + +typedef struct +{ + int count; + BRIDGEBP* bp; +} BPMAP; + +typedef struct +{ + char WatchName[MAX_WATCH_NAME_SIZE]; + char Expression[MAX_CONDITIONAL_EXPR_SIZE]; + unsigned int window; + unsigned int id; + WATCHVARTYPE varType; + WATCHDOGMODE watchdogMode; + duint value; + bool watchdogTriggered; +} WATCHINFO; + +typedef struct +{ + duint start; //OUT + duint end; //OUT + duint instrcount; //OUT +} FUNCTION; + +typedef struct +{ + int depth; //IN + duint start; //OUT + duint end; //OUT + duint instrcount; //OUT +} LOOP; + +typedef struct +{ + int flags; //ADDRINFOFLAGS (IN) + char module[MAX_MODULE_SIZE]; //module the address is in + char label[MAX_LABEL_SIZE]; + char comment[MAX_COMMENT_SIZE]; + bool isbookmark; + FUNCTION function; + LOOP loop; + FUNCTION args; +} BRIDGE_ADDRINFO; + +typedef struct SYMBOLINFO_ +{ + duint addr; + char* decoratedSymbol; + char* undecoratedSymbol; + SYMBOLTYPE type; + bool freeDecorated; + bool freeUndecorated; + DWORD ordinal; +} SYMBOLINFO; + +typedef struct +{ + duint base; + char name[MAX_MODULE_SIZE]; +} SYMBOLMODULEINFO; + +typedef struct +{ + duint base; + CBSYMBOLENUM cbSymbolEnum; + void* user; +} SYMBOLCBINFO; + +typedef struct +{ + bool c; + bool p; + bool a; + bool z; + bool s; + bool t; + bool i; + bool d; + bool o; +} FLAGS; + +typedef struct +{ + bool FZ; + bool PM; + bool UM; + bool OM; + bool ZM; + bool IM; + bool DM; + bool DAZ; + bool PE; + bool UE; + bool OE; + bool ZE; + bool DE; + bool IE; + + unsigned short RC; +} MXCSRFIELDS; + +typedef struct +{ + bool B; + bool C3; + bool C2; + bool C1; + bool C0; + bool ES; + bool SF; + bool P; + bool U; + bool O; + bool Z; + bool D; + bool I; + + unsigned short TOP; + +} X87STATUSWORDFIELDS; + +typedef struct +{ + bool IC; + bool IEM; + bool PM; + bool UM; + bool OM; + bool ZM; + bool DM; + bool IM; + + unsigned short RC; + unsigned short PC; + +} X87CONTROLWORDFIELDS; + +typedef struct DECLSPEC_ALIGN(16) _XMMREGISTER +{ + ULONGLONG Low; + LONGLONG High; +} XMMREGISTER; + +typedef struct +{ + XMMREGISTER Low; //XMM/SSE part + XMMREGISTER High; //AVX part +} YMMREGISTER; + +typedef struct +{ + BYTE data[10]; + int st_value; + int tag; +} X87FPUREGISTER; + +typedef struct +{ + WORD ControlWord; + WORD StatusWord; + WORD TagWord; + DWORD ErrorOffset; + DWORD ErrorSelector; + DWORD DataOffset; + DWORD DataSelector; + DWORD Cr0NpxState; +} X87FPU; + +typedef struct +{ + ULONG_PTR cax; + ULONG_PTR ccx; + ULONG_PTR cdx; + ULONG_PTR cbx; + ULONG_PTR csp; + ULONG_PTR cbp; + ULONG_PTR csi; + ULONG_PTR cdi; +#ifdef _WIN64 + ULONG_PTR r8; + ULONG_PTR r9; + ULONG_PTR r10; + ULONG_PTR r11; + ULONG_PTR r12; + ULONG_PTR r13; + ULONG_PTR r14; + ULONG_PTR r15; +#endif //_WIN64 + ULONG_PTR cip; + ULONG_PTR eflags; + unsigned short gs; + unsigned short fs; + unsigned short es; + unsigned short ds; + unsigned short cs; + unsigned short ss; + ULONG_PTR dr0; + ULONG_PTR dr1; + ULONG_PTR dr2; + ULONG_PTR dr3; + ULONG_PTR dr6; + ULONG_PTR dr7; + BYTE RegisterArea[80]; + X87FPU x87fpu; + DWORD MxCsr; +#ifdef _WIN64 + XMMREGISTER XmmRegisters[16]; + YMMREGISTER YmmRegisters[16]; +#else // x86 + XMMREGISTER XmmRegisters[8]; + YMMREGISTER YmmRegisters[8]; +#endif +} REGISTERCONTEXT; + +typedef struct +{ + DWORD code; + char name[128]; +} LASTERROR; + +typedef struct +{ + DWORD code; + char name[128]; +} LASTSTATUS; + +typedef struct +{ + REGISTERCONTEXT regcontext; + FLAGS flags; + X87FPUREGISTER x87FPURegisters[8]; + unsigned long long mmx[8]; + MXCSRFIELDS MxCsrFields; + X87STATUSWORDFIELDS x87StatusWordFields; + X87CONTROLWORDFIELDS x87ControlWordFields; + LASTERROR lastError; + LASTSTATUS lastStatus; +} REGDUMP; + +typedef struct +{ + DISASM_ARGTYPE type; //normal/memory + SEGMENTREG segment; + char mnemonic[64]; + duint constant; //constant in the instruction (imm/disp) + duint value; //equal to constant or equal to the register value + duint memvalue; //memsize:[value] +} DISASM_ARG; + +typedef struct +{ + char instruction[64]; + DISASM_INSTRTYPE type; + int argcount; + int instr_size; + DISASM_ARG arg[3]; +} DISASM_INSTR; + +typedef struct +{ + char color[8]; //hex color-code + char comment[MAX_COMMENT_SIZE]; +} STACK_COMMENT; + +typedef struct +{ + int ThreadNumber; + HANDLE Handle; + DWORD ThreadId; + duint ThreadStartAddress; + duint ThreadLocalBase; + char threadName[MAX_THREAD_NAME_SIZE]; +} THREADINFO; + +typedef struct +{ + THREADINFO BasicInfo; + duint ThreadCip; + DWORD SuspendCount; + THREADPRIORITY Priority; + THREADWAITREASON WaitReason; + DWORD LastError; + FILETIME UserTime; + FILETIME KernelTime; + FILETIME CreationTime; + ULONG64 Cycles; // Windows Vista or greater +} THREADALLINFO; + +typedef struct +{ + int count; + THREADALLINFO* list; + int CurrentThread; +} THREADLIST; + +typedef struct +{ + duint value; //displacement / addrvalue (rip-relative) + MEMORY_SIZE size; //byte/word/dword/qword + char mnemonic[MAX_MNEMONIC_SIZE]; +} MEMORY_INFO; + +typedef struct +{ + duint value; + VALUE_SIZE size; +} VALUE_INFO; + +//definitions for BASIC_INSTRUCTION_INFO.type +#define TYPE_VALUE 1 +#define TYPE_MEMORY 2 +#define TYPE_ADDR 4 + +typedef struct +{ + DWORD type; //value|memory|addr + VALUE_INFO value; //immediat + MEMORY_INFO memory; + duint addr; //addrvalue (jumps + calls) + bool branch; //jumps/calls + bool call; //instruction is a call + int size; + char instruction[MAX_MNEMONIC_SIZE * 4]; +} BASIC_INSTRUCTION_INFO; + +typedef struct +{ + SCRIPTBRANCHTYPE type; + int dest; + char branchlabel[256]; +} SCRIPTBRANCH; + +typedef struct +{ + duint addr; + duint start; + duint end; + bool manual; + int depth; +} FUNCTION_LOOP_INFO; + +typedef struct +{ + duint addr; + XREFTYPE type; +} XREF_RECORD; + +typedef struct +{ + duint refcount; + XREF_RECORD* references; +} XREF_INFO; + +typedef struct SYMBOLPTR_ +{ + duint modbase; + const void* symbol; +} SYMBOLPTR; + +//Debugger functions +BRIDGE_IMPEXP const char* DbgInit(); +BRIDGE_IMPEXP void DbgExit(); +BRIDGE_IMPEXP bool DbgMemRead(duint va, void* dest, duint size); +BRIDGE_IMPEXP bool DbgMemWrite(duint va, const void* src, duint size); +BRIDGE_IMPEXP duint DbgMemGetPageSize(duint base); +BRIDGE_IMPEXP duint DbgMemFindBaseAddr(duint addr, duint* size); + +/// +/// Asynchronously execute a debugger command by adding it to the command queue. +/// Note: the command may not have completed before this call returns. Use this +/// function if you don't care when the command gets executed. +/// +/// Example: DbgCmdExec("ClearLog") +/// +/// The command to execute. +/// True if the command was successfully submitted to the command queue. False if the submission failed. +BRIDGE_IMPEXP bool DbgCmdExec(const char* cmd); + +/// +/// Performs synchronous execution of a debugger command. This function call only +/// returns after the command has completed. +/// +/// Example: DbgCmdExecDirect("loadlib advapi32.dll") +/// +/// The command to execute. +/// True if the command executed successfully, False if there was a problem. +BRIDGE_IMPEXP bool DbgCmdExecDirect(const char* cmd); +BRIDGE_IMPEXP bool DbgMemMap(MEMMAP* memmap); +BRIDGE_IMPEXP bool DbgIsValidExpression(const char* expression); +BRIDGE_IMPEXP bool DbgIsDebugging(); +BRIDGE_IMPEXP bool DbgIsJumpGoingToExecute(duint addr); +BRIDGE_IMPEXP bool DbgGetLabelAt(duint addr, SEGMENTREG segment, char* text); +BRIDGE_IMPEXP bool DbgSetLabelAt(duint addr, const char* text); +BRIDGE_IMPEXP void DbgClearLabelRange(duint start, duint end); +BRIDGE_IMPEXP bool DbgGetCommentAt(duint addr, char* text); +BRIDGE_IMPEXP bool DbgSetCommentAt(duint addr, const char* text); +BRIDGE_IMPEXP void DbgClearCommentRange(duint start, duint end); +BRIDGE_IMPEXP bool DbgGetBookmarkAt(duint addr); +BRIDGE_IMPEXP bool DbgSetBookmarkAt(duint addr, bool isbookmark); +BRIDGE_IMPEXP void DbgClearBookmarkRange(duint start, duint end); +BRIDGE_IMPEXP bool DbgGetModuleAt(duint addr, char* text); +BRIDGE_IMPEXP BPXTYPE DbgGetBpxTypeAt(duint addr); +BRIDGE_IMPEXP duint DbgValFromString(const char* string); +BRIDGE_IMPEXP bool DbgGetRegDumpEx(REGDUMP* regdump, size_t size); +BRIDGE_IMPEXP bool DbgValToString(const char* string, duint value); +BRIDGE_IMPEXP bool DbgMemIsValidReadPtr(duint addr); +BRIDGE_IMPEXP int DbgGetBpList(BPXTYPE type, BPMAP* list); +BRIDGE_IMPEXP FUNCTYPE DbgGetFunctionTypeAt(duint addr); +BRIDGE_IMPEXP LOOPTYPE DbgGetLoopTypeAt(duint addr, int depth); +BRIDGE_IMPEXP duint DbgGetBranchDestination(duint addr); +BRIDGE_IMPEXP void DbgScriptLoad(const char* filename); +BRIDGE_IMPEXP void DbgScriptUnload(); +BRIDGE_IMPEXP void DbgScriptRun(int destline); +BRIDGE_IMPEXP void DbgScriptStep(); +BRIDGE_IMPEXP bool DbgScriptBpToggle(int line); +BRIDGE_IMPEXP bool DbgScriptBpGet(int line); +BRIDGE_IMPEXP bool DbgScriptCmdExec(const char* command); +BRIDGE_IMPEXP void DbgScriptAbort(); +BRIDGE_IMPEXP SCRIPTLINETYPE DbgScriptGetLineType(int line); +BRIDGE_IMPEXP void DbgScriptSetIp(int line); +BRIDGE_IMPEXP bool DbgScriptGetBranchInfo(int line, SCRIPTBRANCH* info); +BRIDGE_IMPEXP void DbgSymbolEnum(duint base, CBSYMBOLENUM cbSymbolEnum, void* user); +BRIDGE_IMPEXP void DbgSymbolEnumFromCache(duint base, CBSYMBOLENUM cbSymbolEnum, void* user); +BRIDGE_IMPEXP bool DbgAssembleAt(duint addr, const char* instruction); +BRIDGE_IMPEXP duint DbgModBaseFromName(const char* name); +BRIDGE_IMPEXP void DbgDisasmAt(duint addr, DISASM_INSTR* instr); +BRIDGE_IMPEXP bool DbgStackCommentGet(duint addr, STACK_COMMENT* comment); +BRIDGE_IMPEXP void DbgGetThreadList(THREADLIST* list); +BRIDGE_IMPEXP void DbgSettingsUpdated(); +BRIDGE_IMPEXP void DbgDisasmFastAt(duint addr, BASIC_INSTRUCTION_INFO* basicinfo); +BRIDGE_IMPEXP void DbgMenuEntryClicked(int hEntry); +BRIDGE_IMPEXP bool DbgFunctionGet(duint addr, duint* start, duint* end); +BRIDGE_IMPEXP bool DbgFunctionOverlaps(duint start, duint end); +BRIDGE_IMPEXP bool DbgFunctionAdd(duint start, duint end); +BRIDGE_IMPEXP bool DbgFunctionDel(duint addr); +BRIDGE_IMPEXP bool DbgArgumentGet(duint addr, duint* start, duint* end); +BRIDGE_IMPEXP bool DbgArgumentOverlaps(duint start, duint end); +BRIDGE_IMPEXP bool DbgArgumentAdd(duint start, duint end); +BRIDGE_IMPEXP bool DbgArgumentDel(duint addr); +BRIDGE_IMPEXP bool DbgLoopGet(int depth, duint addr, duint* start, duint* end); +BRIDGE_IMPEXP bool DbgLoopOverlaps(int depth, duint start, duint end); +BRIDGE_IMPEXP bool DbgLoopAdd(duint start, duint end); +BRIDGE_IMPEXP bool DbgLoopDel(int depth, duint addr); +BRIDGE_IMPEXP bool DbgXrefAdd(duint addr, duint from); +BRIDGE_IMPEXP bool DbgXrefDelAll(duint addr); +BRIDGE_IMPEXP bool DbgXrefGet(duint addr, XREF_INFO* info); +BRIDGE_IMPEXP size_t DbgGetXrefCountAt(duint addr); +BRIDGE_IMPEXP XREFTYPE DbgGetXrefTypeAt(duint addr); +BRIDGE_IMPEXP bool DbgIsRunLocked(); +BRIDGE_IMPEXP bool DbgIsBpDisabled(duint addr); +BRIDGE_IMPEXP bool DbgSetAutoCommentAt(duint addr, const char* text); +BRIDGE_IMPEXP void DbgClearAutoCommentRange(duint start, duint end); +BRIDGE_IMPEXP bool DbgSetAutoLabelAt(duint addr, const char* text); +BRIDGE_IMPEXP void DbgClearAutoLabelRange(duint start, duint end); +BRIDGE_IMPEXP bool DbgSetAutoBookmarkAt(duint addr); +BRIDGE_IMPEXP void DbgClearAutoBookmarkRange(duint start, duint end); +BRIDGE_IMPEXP bool DbgSetAutoFunctionAt(duint start, duint end); +BRIDGE_IMPEXP void DbgClearAutoFunctionRange(duint start, duint end); +BRIDGE_IMPEXP bool DbgGetStringAt(duint addr, char* text); +BRIDGE_IMPEXP const DBGFUNCTIONS* DbgFunctions(); +BRIDGE_IMPEXP bool DbgWinEvent(MSG* message, long* result); +BRIDGE_IMPEXP bool DbgWinEventGlobal(MSG* message); +BRIDGE_IMPEXP bool DbgIsRunning(); +BRIDGE_IMPEXP duint DbgGetTimeWastedCounter(); +BRIDGE_IMPEXP ARGTYPE DbgGetArgTypeAt(duint addr); +BRIDGE_IMPEXP void* DbgGetEncodeTypeBuffer(duint addr, duint* size); +BRIDGE_IMPEXP void DbgReleaseEncodeTypeBuffer(void* buffer); +BRIDGE_IMPEXP ENCODETYPE DbgGetEncodeTypeAt(duint addr, duint size); +BRIDGE_IMPEXP duint DbgGetEncodeSizeAt(duint addr, duint codesize); +BRIDGE_IMPEXP bool DbgSetEncodeType(duint addr, duint size, ENCODETYPE type); +BRIDGE_IMPEXP void DbgDelEncodeTypeRange(duint start, duint end); +BRIDGE_IMPEXP void DbgDelEncodeTypeSegment(duint start); +BRIDGE_IMPEXP bool DbgGetWatchList(ListOf(WATCHINFO) list); +BRIDGE_IMPEXP void DbgSelChanged(int hWindow, duint VA); +BRIDGE_IMPEXP HANDLE DbgGetProcessHandle(); +BRIDGE_IMPEXP HANDLE DbgGetThreadHandle(); +BRIDGE_IMPEXP DWORD DbgGetProcessId(); +BRIDGE_IMPEXP DWORD DbgGetThreadId(); +BRIDGE_IMPEXP duint DbgGetPebAddress(DWORD ProcessId); +BRIDGE_IMPEXP duint DbgGetTebAddress(DWORD ThreadId); +BRIDGE_IMPEXP bool DbgAnalyzeFunction(duint entry, BridgeCFGraphList* graph); +BRIDGE_IMPEXP duint DbgEval(const char* expression, bool* DEFAULT_PARAM(success, nullptr)); +BRIDGE_IMPEXP void DbgGetSymbolInfo(const SYMBOLPTR* symbolptr, SYMBOLINFO* info); +BRIDGE_IMPEXP DEBUG_ENGINE DbgGetDebugEngine(); + +//Gui defines +typedef enum +{ + GUI_PLUGIN_MENU, + GUI_DISASM_MENU, + GUI_DUMP_MENU, + GUI_STACK_MENU, + GUI_GRAPH_MENU, + GUI_MEMMAP_MENU, + GUI_SYMMOD_MENU, +} GUIMENUTYPE; + +BRIDGE_IMPEXP void DbgMenuPrepare(GUIMENUTYPE hMenu); + +typedef enum +{ + GUI_DISASSEMBLY, + GUI_DUMP, + GUI_STACK, + GUI_GRAPH, + GUI_MEMMAP, + GUI_SYMMOD, +} GUISELECTIONTYPE; + +#define GUI_MAX_LINE_SIZE 65536 +#define GUI_MAX_DISASSEMBLY_SIZE 2048 + +//Gui enums +typedef enum +{ + GUI_DISASSEMBLE_AT, // param1=(duint)va, param2=(duint)cip + GUI_SET_DEBUG_STATE, // param1=(DBGSTATE)state, param2=unused + GUI_ADD_MSG_TO_LOG, // param1=(const char*)msg, param2=unused + GUI_CLEAR_LOG, // param1=unused, param2=unused + GUI_UPDATE_REGISTER_VIEW, // param1=unused, param2=unused + GUI_UPDATE_DISASSEMBLY_VIEW, // param1=unused, param2=unused + GUI_UPDATE_BREAKPOINTS_VIEW, // param1=unused, param2=unused + GUI_UPDATE_WINDOW_TITLE, // param1=(const char*)file, param2=unused + GUI_GET_WINDOW_HANDLE, // param1=unused, param2=unused + GUI_DUMP_AT, // param1=(duint)va param2=unused + GUI_SCRIPT_ADD, // param1=int count, param2=const char** lines + GUI_SCRIPT_CLEAR, // param1=unused, param2=unused + GUI_SCRIPT_SETIP, // param1=int line, param2=unused + GUI_SCRIPT_ERROR, // param1=int line, param2=const char* message + GUI_SCRIPT_SETTITLE, // param1=const char* title, param2=unused + GUI_SCRIPT_SETINFOLINE, // param1=int line, param2=const char* info + GUI_SCRIPT_MESSAGE, // param1=const char* message, param2=unused + GUI_SCRIPT_MSGYN, // param1=const char* message, param2=unused + GUI_SYMBOL_LOG_ADD, // param1(const char*)msg, param2=unused + GUI_SYMBOL_LOG_CLEAR, // param1=unused, param2=unused + GUI_SYMBOL_SET_PROGRESS, // param1=int percent param2=unused + GUI_SYMBOL_UPDATE_MODULE_LIST, // param1=int count, param2=SYMBOLMODULEINFO* modules + GUI_REF_ADDCOLUMN, // param1=int width, param2=(const char*)title + GUI_REF_SETROWCOUNT, // param1=int rows, param2=unused + GUI_REF_GETROWCOUNT, // param1=unused, param2=unused + GUI_REF_DELETEALLCOLUMNS, // param1=unused, param2=unused + GUI_REF_SETCELLCONTENT, // param1=(CELLINFO*)info, param2=unused + GUI_REF_GETCELLCONTENT, // param1=int row, param2=int col + GUI_REF_RELOADDATA, // param1=unused, param2=unused + GUI_REF_SETSINGLESELECTION, // param1=int index, param2=bool scroll + GUI_REF_SETPROGRESS, // param1=int progress, param2=unused + GUI_REF_SETCURRENTTASKPROGRESS, // param1=int progress, param2=const char* taskTitle + GUI_REF_SETSEARCHSTARTCOL, // param1=int col param2=unused + GUI_STACK_DUMP_AT, // param1=duint addr, param2=duint csp + GUI_UPDATE_DUMP_VIEW, // param1=unused, param2=unused + GUI_UPDATE_THREAD_VIEW, // param1=unused, param2=unused + GUI_ADD_RECENT_FILE, // param1=(const char*)file, param2=unused + GUI_SET_LAST_EXCEPTION, // param1=unsigned int code, param2=unused + GUI_GET_DISASSEMBLY, // param1=duint addr, param2=char* text + GUI_MENU_ADD, // param1=int hMenu, param2=const char* title + GUI_MENU_ADD_ENTRY, // param1=int hMenu, param2=const char* title + GUI_MENU_ADD_SEPARATOR, // param1=int hMenu, param2=unused + GUI_MENU_CLEAR, // param1=int hMenu, param2=unused + GUI_SELECTION_GET, // param1=GUISELECTIONTYPE, param2=SELECTIONDATA* selection + GUI_SELECTION_SET, // param1=GUISELECTIONTYPE, param2=const SELECTIONDATA* selection + GUI_GETLINE_WINDOW, // param1=const char* title, param2=char* text + GUI_AUTOCOMPLETE_ADDCMD, // param1=const char* cmd, param2=ununsed + GUI_AUTOCOMPLETE_DELCMD, // param1=const char* cmd, param2=ununsed + GUI_AUTOCOMPLETE_CLEARALL, // param1=unused, param2=unused + GUI_SCRIPT_ENABLEHIGHLIGHTING, // param1=bool enable, param2=unused + GUI_ADD_MSG_TO_STATUSBAR, // param1=const char* msg, param2=unused + GUI_UPDATE_SIDEBAR, // param1=unused, param2=unused + GUI_REPAINT_TABLE_VIEW, // param1=unused, param2=unused + GUI_UPDATE_PATCHES, // param1=unused, param2=unused + GUI_UPDATE_CALLSTACK, // param1=unused, param2=unused + GUI_UPDATE_SEHCHAIN, // param1=unused, param2=unused + GUI_SYMBOL_REFRESH_CURRENT, // param1=unused, param2=unused + GUI_UPDATE_MEMORY_VIEW, // param1=unused, param2=unused + GUI_REF_INITIALIZE, // param1=const char* name, param2=unused + GUI_LOAD_SOURCE_FILE, // param1=const char* path, param2=duint addr + GUI_MENU_SET_ICON, // param1=int hMenu, param2=ICONINFO* + GUI_MENU_SET_ENTRY_ICON, // param1=int hEntry, param2=ICONINFO* + GUI_SHOW_CPU, // param1=unused, param2=unused + GUI_ADD_QWIDGET_TAB, // param1=QWidget*, param2=unused + GUI_SHOW_QWIDGET_TAB, // param1=QWidget*, param2=unused + GUI_CLOSE_QWIDGET_TAB, // param1=QWidget*, param2=unused + GUI_EXECUTE_ON_GUI_THREAD, // param1=GUICALLBACKEX cb, param2=void* userdata + GUI_UPDATE_TIME_WASTED_COUNTER, // param1=unused, param2=unused + GUI_SET_GLOBAL_NOTES, // param1=const char* text, param2=unused + GUI_GET_GLOBAL_NOTES, // param1=char** text, param2=unused + GUI_SET_DEBUGGEE_NOTES, // param1=const char* text, param2=unused + GUI_GET_DEBUGGEE_NOTES, // param1=char** text, param2=unused + GUI_DUMP_AT_N, // param1=int index, param2=duint va + GUI_DISPLAY_WARNING, // param1=const char *text, param2=unused + GUI_REGISTER_SCRIPT_LANG, // param1=SCRIPTTYPEINFO* info, param2=unused + GUI_UNREGISTER_SCRIPT_LANG, // param1=int id, param2=unused + GUI_UPDATE_ARGUMENT_VIEW, // param1=unused, param2=unused + GUI_FOCUS_VIEW, // param1=int hWindow, param2=unused + GUI_UPDATE_WATCH_VIEW, // param1=unused, param2=unused + GUI_LOAD_GRAPH, // param1=BridgeCFGraphList* param2=unused + GUI_GRAPH_AT, // param1=duint addr param2=unused + GUI_UPDATE_GRAPH_VIEW, // param1=unused, param2=unused + GUI_SET_LOG_ENABLED, // param1=bool isEnabled param2=unused + GUI_ADD_FAVOURITE_TOOL, // param1=const char* name param2=const char* description + GUI_ADD_FAVOURITE_COMMAND, // param1=const char* command param2=const char* shortcut + GUI_SET_FAVOURITE_TOOL_SHORTCUT,// param1=const char* name param2=const char* shortcut + GUI_FOLD_DISASSEMBLY, // param1=duint startAddress param2=duint length + GUI_SELECT_IN_MEMORY_MAP, // param1=duint addr, param2=unused + GUI_GET_ACTIVE_VIEW, // param1=ACTIVEVIEW*, param2=unused + GUI_MENU_SET_ENTRY_CHECKED, // param1=int hEntry, param2=bool checked + GUI_ADD_INFO_LINE, // param1=const char* infoline, param2=unused + GUI_PROCESS_EVENTS, // param1=unused, param2=unused + GUI_TYPE_ADDNODE, // param1=void* parent, param2=TYPEDESCRIPTOR* type + GUI_TYPE_CLEAR, // param1=unused, param2=unused + GUI_UPDATE_TYPE_WIDGET, // param1=unused, param2=unused + GUI_CLOSE_APPLICATION, // param1=unused, param2=unused + GUI_MENU_SET_VISIBLE, // param1=int hMenu, param2=bool visible + GUI_MENU_SET_ENTRY_VISIBLE, // param1=int hEntry, param2=bool visible + GUI_MENU_SET_NAME, // param1=int hMenu, param2=const char* name + GUI_MENU_SET_ENTRY_NAME, // param1=int hEntry, param2=const char* name + GUI_FLUSH_LOG, // param1=unused, param2=unused + GUI_MENU_SET_ENTRY_HOTKEY, // param1=int hEntry, param2=const char* hack + GUI_REF_SEARCH_GETROWCOUNT, // param1=unused, param2=unused + GUI_REF_SEARCH_GETCELLCONTENT, // param1=int row, param2=int col + GUI_MENU_REMOVE, // param1=int hEntryMenu, param2=unused + GUI_REF_ADDCOMMAND, // param1=const char* title, param2=const char* command + GUI_OPEN_TRACE_FILE, // param1=const char* file name,param2=unused + GUI_UPDATE_TRACE_BROWSER, // param1=unused, param2=unused + GUI_INVALIDATE_SYMBOL_SOURCE, // param1=duint base, param2=unused + GUI_GET_CURRENT_GRAPH, // param1=BridgeCFGraphList*, param2=unused + GUI_SHOW_REF, // param1=unused, param2=unused +} GUIMSG; + +//GUI Typedefs +struct _TYPEDESCRIPTOR; + +typedef void (*GUICALLBACK)(); +typedef void (*GUICALLBACKEX)(void*); +typedef bool (*GUISCRIPTEXECUTE)(const char* text); +typedef void (*GUISCRIPTCOMPLETER)(const char* text, char** entries, int* entryCount); +typedef bool (*TYPETOSTRING)(const struct _TYPEDESCRIPTOR* type, char* dest, size_t* destCount); //don't change destCount for final failure + +//GUI structures +typedef struct +{ + int row; + int col; + const char* str; +} CELLINFO; + +typedef struct +{ + duint start; + duint end; +} SELECTIONDATA; + +typedef struct +{ + const void* data; + duint size; +} ICONDATA; + +typedef struct +{ + char name[64]; + int id; + GUISCRIPTEXECUTE execute; + GUISCRIPTCOMPLETER completeCommand; +} SCRIPTTYPEINFO; + +typedef struct +{ + void* titleHwnd; + void* classHwnd; + char title[MAX_STRING_SIZE]; + char className[MAX_STRING_SIZE]; +} ACTIVEVIEW; + +typedef struct _TYPEDESCRIPTOR +{ + bool expanded; //is the type node expanded? + bool reverse; //big endian? + const char* name; //type name (int b) + duint addr; //virtual address + duint offset; //offset to addr for the actual location + int id; //type id + int size; //sizeof(type) + TYPETOSTRING callback; //convert to string + void* userdata; //user data +} TYPEDESCRIPTOR; + +//GUI functions +//code page is utf8 +BRIDGE_IMPEXP const char* GuiTranslateText(const char* Source); +BRIDGE_IMPEXP void GuiDisasmAt(duint addr, duint cip); +BRIDGE_IMPEXP void GuiSetDebugState(DBGSTATE state); +BRIDGE_IMPEXP void GuiSetDebugStateFast(DBGSTATE state); +BRIDGE_IMPEXP void GuiAddLogMessage(const char* msg); +BRIDGE_IMPEXP void GuiLogClear(); +BRIDGE_IMPEXP void GuiUpdateAllViews(); +BRIDGE_IMPEXP void GuiUpdateRegisterView(); +BRIDGE_IMPEXP void GuiUpdateDisassemblyView(); +BRIDGE_IMPEXP void GuiUpdateBreakpointsView(); +BRIDGE_IMPEXP void GuiUpdateWindowTitle(const char* filename); +BRIDGE_IMPEXP HWND GuiGetWindowHandle(); +BRIDGE_IMPEXP void GuiDumpAt(duint va); +BRIDGE_IMPEXP void GuiScriptAdd(int count, const char** lines); +BRIDGE_IMPEXP void GuiScriptClear(); +BRIDGE_IMPEXP void GuiScriptSetIp(int line); +BRIDGE_IMPEXP void GuiScriptError(int line, const char* message); +BRIDGE_IMPEXP void GuiScriptSetTitle(const char* title); +BRIDGE_IMPEXP void GuiScriptSetInfoLine(int line, const char* info); +BRIDGE_IMPEXP void GuiScriptMessage(const char* message); +BRIDGE_IMPEXP int GuiScriptMsgyn(const char* message); +BRIDGE_IMPEXP void GuiScriptEnableHighlighting(bool enable); +BRIDGE_IMPEXP void GuiSymbolLogAdd(const char* message); +BRIDGE_IMPEXP void GuiSymbolLogClear(); +BRIDGE_IMPEXP void GuiSymbolSetProgress(int percent); +BRIDGE_IMPEXP void GuiSymbolUpdateModuleList(int count, SYMBOLMODULEINFO* modules); +BRIDGE_IMPEXP void GuiSymbolRefreshCurrent(); +BRIDGE_IMPEXP void GuiReferenceAddColumn(int width, const char* title); +BRIDGE_IMPEXP void GuiReferenceSetRowCount(int count); +BRIDGE_IMPEXP int GuiReferenceGetRowCount(); +BRIDGE_IMPEXP int GuiReferenceSearchGetRowCount(); +BRIDGE_IMPEXP void GuiReferenceDeleteAllColumns(); +BRIDGE_IMPEXP void GuiReferenceInitialize(const char* name); +BRIDGE_IMPEXP void GuiReferenceSetCellContent(int row, int col, const char* str); +BRIDGE_IMPEXP char* GuiReferenceGetCellContent(int row, int col); +BRIDGE_IMPEXP char* GuiReferenceSearchGetCellContent(int row, int col); +BRIDGE_IMPEXP void GuiReferenceReloadData(); +BRIDGE_IMPEXP void GuiReferenceSetSingleSelection(int index, bool scroll); +BRIDGE_IMPEXP void GuiReferenceSetProgress(int progress); +BRIDGE_IMPEXP void GuiReferenceSetCurrentTaskProgress(int progress, const char* taskTitle); +BRIDGE_IMPEXP void GuiReferenceSetSearchStartCol(int col); +BRIDGE_IMPEXP void GuiStackDumpAt(duint addr, duint csp); +BRIDGE_IMPEXP void GuiUpdateDumpView(); +BRIDGE_IMPEXP void GuiUpdateWatchView(); +BRIDGE_IMPEXP void GuiUpdateThreadView(); +BRIDGE_IMPEXP void GuiUpdateMemoryView(); +BRIDGE_IMPEXP void GuiAddRecentFile(const char* file); +BRIDGE_IMPEXP void GuiSetLastException(unsigned int exception); +BRIDGE_IMPEXP bool GuiGetDisassembly(duint addr, char* text); +BRIDGE_IMPEXP int GuiMenuAdd(int hMenu, const char* title); +BRIDGE_IMPEXP int GuiMenuAddEntry(int hMenu, const char* title); +BRIDGE_IMPEXP void GuiMenuAddSeparator(int hMenu); +BRIDGE_IMPEXP void GuiMenuClear(int hMenu); +BRIDGE_IMPEXP void GuiMenuRemove(int hEntryMenu); +BRIDGE_IMPEXP bool GuiSelectionGet(GUISELECTIONTYPE hWindow, SELECTIONDATA* selection); +BRIDGE_IMPEXP bool GuiSelectionSet(GUISELECTIONTYPE hWindow, const SELECTIONDATA* selection); +BRIDGE_IMPEXP bool GuiGetLineWindow(const char* title, char* text); +BRIDGE_IMPEXP void GuiAutoCompleteAddCmd(const char* cmd); +BRIDGE_IMPEXP void GuiAutoCompleteDelCmd(const char* cmd); +BRIDGE_IMPEXP void GuiAutoCompleteClearAll(); +BRIDGE_IMPEXP void GuiAddStatusBarMessage(const char* msg); +BRIDGE_IMPEXP void GuiUpdateSideBar(); +BRIDGE_IMPEXP void GuiRepaintTableView(); +BRIDGE_IMPEXP void GuiUpdatePatches(); +BRIDGE_IMPEXP void GuiUpdateCallStack(); +BRIDGE_IMPEXP void GuiUpdateSEHChain(); +BRIDGE_IMPEXP void GuiLoadSourceFileEx(const char* path, duint addr); +BRIDGE_IMPEXP void GuiMenuSetIcon(int hMenu, const ICONDATA* icon); +BRIDGE_IMPEXP void GuiMenuSetEntryIcon(int hEntry, const ICONDATA* icon); +BRIDGE_IMPEXP void GuiMenuSetEntryChecked(int hEntry, bool checked); +BRIDGE_IMPEXP void GuiMenuSetVisible(int hMenu, bool visible); +BRIDGE_IMPEXP void GuiMenuSetEntryVisible(int hEntry, bool visible); +BRIDGE_IMPEXP void GuiMenuSetName(int hMenu, const char* name); +BRIDGE_IMPEXP void GuiMenuSetEntryName(int hEntry, const char* name); +BRIDGE_IMPEXP void GuiMenuSetEntryHotkey(int hEntry, const char* hack); +BRIDGE_IMPEXP void GuiShowCpu(); +BRIDGE_IMPEXP void GuiAddQWidgetTab(void* qWidget); +BRIDGE_IMPEXP void GuiShowQWidgetTab(void* qWidget); +BRIDGE_IMPEXP void GuiCloseQWidgetTab(void* qWidget); +BRIDGE_IMPEXP void GuiExecuteOnGuiThread(GUICALLBACK cbGuiThread); +BRIDGE_IMPEXP void GuiUpdateTimeWastedCounter(); +BRIDGE_IMPEXP void GuiSetGlobalNotes(const char* text); +BRIDGE_IMPEXP void GuiGetGlobalNotes(char** text); +BRIDGE_IMPEXP void GuiSetDebuggeeNotes(const char* text); +BRIDGE_IMPEXP void GuiGetDebuggeeNotes(char** text); +BRIDGE_IMPEXP void GuiDumpAtN(duint va, int index); +BRIDGE_IMPEXP void GuiDisplayWarning(const char* title, const char* text); +BRIDGE_IMPEXP void GuiRegisterScriptLanguage(SCRIPTTYPEINFO* info); +BRIDGE_IMPEXP void GuiUnregisterScriptLanguage(int id); +BRIDGE_IMPEXP void GuiUpdateArgumentWidget(); +BRIDGE_IMPEXP void GuiFocusView(int hWindow); +BRIDGE_IMPEXP bool GuiIsUpdateDisabled(); +BRIDGE_IMPEXP void GuiUpdateEnable(bool updateNow); +BRIDGE_IMPEXP void GuiUpdateDisable(); +BRIDGE_IMPEXP bool GuiLoadGraph(BridgeCFGraphList* graph, duint addr); +BRIDGE_IMPEXP duint GuiGraphAt(duint addr); +BRIDGE_IMPEXP void GuiUpdateGraphView(); +BRIDGE_IMPEXP void GuiDisableLog(); +BRIDGE_IMPEXP void GuiEnableLog(); +BRIDGE_IMPEXP void GuiAddFavouriteTool(const char* name, const char* description); +BRIDGE_IMPEXP void GuiAddFavouriteCommand(const char* name, const char* shortcut); +BRIDGE_IMPEXP void GuiSetFavouriteToolShortcut(const char* name, const char* shortcut); +BRIDGE_IMPEXP void GuiFoldDisassembly(duint startAddress, duint length); +BRIDGE_IMPEXP void GuiSelectInMemoryMap(duint addr); +BRIDGE_IMPEXP void GuiGetActiveView(ACTIVEVIEW* activeView); +BRIDGE_IMPEXP void GuiAddInfoLine(const char* infoLine); +BRIDGE_IMPEXP void GuiProcessEvents(); +BRIDGE_IMPEXP void* GuiTypeAddNode(void* parent, const TYPEDESCRIPTOR* type); +BRIDGE_IMPEXP bool GuiTypeClear(); +BRIDGE_IMPEXP void GuiUpdateTypeWidget(); +BRIDGE_IMPEXP void GuiCloseApplication(); +BRIDGE_IMPEXP void GuiFlushLog(); +BRIDGE_IMPEXP void GuiReferenceAddCommand(const char* title, const char* command); +BRIDGE_IMPEXP void GuiUpdateTraceBrowser(); +BRIDGE_IMPEXP void GuiOpenTraceFile(const char* fileName); +BRIDGE_IMPEXP void GuiInvalidateSymbolSource(duint base); +BRIDGE_IMPEXP void GuiExecuteOnGuiThreadEx(GUICALLBACKEX cbGuiThread, void* userdata); +BRIDGE_IMPEXP void GuiGetCurrentGraph(BridgeCFGraphList* graphList); +BRIDGE_IMPEXP void GuiShowReferences(); + +#ifdef __cplusplus +} +#endif + +#pragma pack(pop) + +#endif // _BRIDGEMAIN_H_ diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/dbghelp/dbghelp.h b/BranchTrace-x64plugin-wtl/pluginsdk/dbghelp/dbghelp.h new file mode 100644 index 0000000..53c634a --- /dev/null +++ b/BranchTrace-x64plugin-wtl/pluginsdk/dbghelp/dbghelp.h @@ -0,0 +1,4677 @@ +#ifndef _DBGHELP_ +#define _DBGHELP_ + + +// As a general principal always call the 64 bit version +// of every API, if a choice exists. The 64 bit version +// works great on 32 bit platforms, and is forward +// compatible to 64 bit platforms. + +#ifdef _WIN64 +#ifndef _IMAGEHLP64 +#define _IMAGEHLP64 +#endif +#endif + +#pragma pack(push,8) + +// For those without specstrings.h +// Since there are different versions of this header, I need to +// individually test each item and define it if it is not around. + +#ifndef __in +#define __in +#endif +#ifndef __out +#define __out +#endif +#ifndef __inout +#define __inout +#endif +#ifndef __in_opt +#define __in_opt +#endif +#ifndef __out_opt +#define __out_opt +#endif +#ifndef __inout_opt +#define __inout_opt +#endif +#ifndef __in_ecount +#define __in_ecount(x) +#endif +#ifndef __out_ecount +#define __out_ecount(x) +#endif +#ifndef __inout_ecount +#define __inout_ecount(x) +#endif +#ifndef __in_bcount +#define __in_bcount(x) +#endif +#ifndef __out_bcount +#define __out_bcount(x) +#endif +#ifndef __inout_bcount +#define __inout_bcount(x) +#endif +#ifndef __out_xcount +#define __out_xcount(x) +#endif +#ifndef __deref_opt_out +#define __deref_opt_out +#endif +#ifndef __deref_out +#define __deref_out +#endif +#ifndef __out_ecount_opt +#define __out_ecount_opt(x) +#endif +#ifndef __in_bcount_opt +#define __in_bcount_opt(x) +#endif +#ifndef __out_bcount_opt +#define __out_bcount_opt(x) +#endif +#ifndef __deref_out_opt +#define __deref_out_opt +#endif + + +#ifdef __cplusplus +extern "C" { +#endif + +#ifdef _IMAGEHLP_SOURCE_ +#define IMAGEAPI __stdcall +#define DBHLP_DEPRECIATED +#else +#define IMAGEAPI DECLSPEC_IMPORT __stdcall +#if (_MSC_VER >= 1300) && !defined(MIDL_PASS) +#define DBHLP_DEPRECIATED __declspec(deprecated) +#else +#define DBHLP_DEPRECIATED +#endif +#endif + +#define DBHLPAPI IMAGEAPI + +#define IMAGE_SEPARATION (64*1024) + +// Observant readers may notice that 2 new fields, +// 'fReadOnly' and 'Version' have been added to +// the LOADED_IMAGE structure after 'fDOSImage'. +// This does not change the size of the structure +// from previous headers. That is because while +// 'fDOSImage' is a byte, it is padded by the +// compiler to 4 bytes. So the 2 new fields are +// slipped into the extra space. + +typedef struct _LOADED_IMAGE +{ + PSTR ModuleName; + HANDLE hFile; + PUCHAR MappedAddress; +#ifdef _IMAGEHLP64 + PIMAGE_NT_HEADERS64 FileHeader; +#else + PIMAGE_NT_HEADERS32 FileHeader; +#endif + PIMAGE_SECTION_HEADER LastRvaSection; + ULONG NumberOfSections; + PIMAGE_SECTION_HEADER Sections; + ULONG Characteristics; + BOOLEAN fSystemImage; + BOOLEAN fDOSImage; + BOOLEAN fReadOnly; + UCHAR Version; + LIST_ENTRY Links; + ULONG SizeOfImage; +} LOADED_IMAGE, *PLOADED_IMAGE; + +#define MAX_SYM_NAME 2000 + + +// Error codes set by dbghelp functions. Call GetLastError +// to see them. +// Dbghelp also sets error codes found in winerror.h + +#define ERROR_IMAGE_NOT_STRIPPED 0x8800 // the image is not stripped. No dbg file available. +#define ERROR_NO_DBG_POINTER 0x8801 // image is stripped but there is no pointer to a dbg file +#define ERROR_NO_PDB_POINTER 0x8802 // image does not point to a pdb file + +typedef BOOL +(CALLBACK* PFIND_DEBUG_FILE_CALLBACK)( + __in HANDLE FileHandle, + __in PCSTR FileName, + __in PVOID CallerData +); + +HANDLE +IMAGEAPI +SymFindDebugInfoFile( + __in HANDLE hProcess, + __in PCSTR FileName, + __out_ecount(MAX_PATH + 1) PSTR DebugFilePath, + __in_opt PFIND_DEBUG_FILE_CALLBACK Callback, + __in_opt PVOID CallerData +); + +typedef BOOL +(CALLBACK* PFIND_DEBUG_FILE_CALLBACKW)( + __in HANDLE FileHandle, + __in PCWSTR FileName, + __in PVOID CallerData +); + +HANDLE +IMAGEAPI +SymFindDebugInfoFileW( + __in HANDLE hProcess, + __in PCWSTR FileName, + __out_ecount(MAX_PATH + 1) PWSTR DebugFilePath, + __in_opt PFIND_DEBUG_FILE_CALLBACKW Callback, + __in_opt PVOID CallerData +); + +HANDLE +IMAGEAPI +FindDebugInfoFile( + __in PCSTR FileName, + __in PCSTR SymbolPath, + __out_ecount(MAX_PATH + 1) PSTR DebugFilePath +); + +HANDLE +IMAGEAPI +FindDebugInfoFileEx( + __in PCSTR FileName, + __in PCSTR SymbolPath, + __out_ecount(MAX_PATH + 1) PSTR DebugFilePath, + __in_opt PFIND_DEBUG_FILE_CALLBACK Callback, + __in_opt PVOID CallerData +); + +HANDLE +IMAGEAPI +FindDebugInfoFileExW( + __in PCWSTR FileName, + __in PCWSTR SymbolPath, + __out_ecount(MAX_PATH + 1) PWSTR DebugFilePath, + __in_opt PFIND_DEBUG_FILE_CALLBACKW Callback, + __in_opt PVOID CallerData +); + +typedef BOOL +(CALLBACK* PFINDFILEINPATHCALLBACK)( + __in PCSTR filename, + __in PVOID context +); + +BOOL +IMAGEAPI +SymFindFileInPath( + __in HANDLE hprocess, + __in_opt PCSTR SearchPath, + __in PCSTR FileName, + __in_opt PVOID id, + __in DWORD two, + __in DWORD three, + __in DWORD flags, + __out_ecount(MAX_PATH + 1) PSTR FoundFile, + __in_opt PFINDFILEINPATHCALLBACK callback, + __in_opt PVOID context +); + +typedef BOOL +(CALLBACK* PFINDFILEINPATHCALLBACKW)( + __in PCWSTR filename, + __in PVOID context +); + +BOOL +IMAGEAPI +SymFindFileInPathW( + __in HANDLE hprocess, + __in_opt PCWSTR SearchPath, + __in PCWSTR FileName, + __in_opt PVOID id, + __in DWORD two, + __in DWORD three, + __in DWORD flags, + __out_ecount(MAX_PATH + 1) PWSTR FoundFile, + __in_opt PFINDFILEINPATHCALLBACKW callback, + __in_opt PVOID context +); + +typedef BOOL +(CALLBACK* PFIND_EXE_FILE_CALLBACK)( + __in HANDLE FileHandle, + __in PCSTR FileName, + __in_opt PVOID CallerData +); + +HANDLE +IMAGEAPI +SymFindExecutableImage( + __in HANDLE hProcess, + __in PCSTR FileName, + __out_ecount(MAX_PATH + 1) PSTR ImageFilePath, + __in PFIND_EXE_FILE_CALLBACK Callback, + __in PVOID CallerData +); + +typedef BOOL +(CALLBACK* PFIND_EXE_FILE_CALLBACKW)( + __in HANDLE FileHandle, + __in PCWSTR FileName, + __in_opt PVOID CallerData +); + +HANDLE +IMAGEAPI +SymFindExecutableImageW( + __in HANDLE hProcess, + __in PCWSTR FileName, + __out_ecount(MAX_PATH + 1) PWSTR ImageFilePath, + __in PFIND_EXE_FILE_CALLBACKW Callback, + __in PVOID CallerData +); + +HANDLE +IMAGEAPI +FindExecutableImage( + __in PCSTR FileName, + __in PCSTR SymbolPath, + __out_ecount(MAX_PATH + 1) PSTR ImageFilePath +); + +HANDLE +IMAGEAPI +FindExecutableImageEx( + __in PCSTR FileName, + __in PCSTR SymbolPath, + __out_ecount(MAX_PATH + 1) PSTR ImageFilePath, + __in_opt PFIND_EXE_FILE_CALLBACK Callback, + __in_opt PVOID CallerData +); + +HANDLE +IMAGEAPI +FindExecutableImageExW( + __in PCWSTR FileName, + __in PCWSTR SymbolPath, + __out_ecount(MAX_PATH + 1) PWSTR ImageFilePath, + __in_opt PFIND_EXE_FILE_CALLBACKW Callback, + __in PVOID CallerData +); + +PIMAGE_NT_HEADERS +IMAGEAPI +ImageNtHeader( + __in PVOID Base +); + +PVOID +IMAGEAPI +ImageDirectoryEntryToDataEx( + __in PVOID Base, + __in BOOLEAN MappedAsImage, + __in USHORT DirectoryEntry, + __out PULONG Size, + __out_opt PIMAGE_SECTION_HEADER* FoundHeader +); + +PVOID +IMAGEAPI +ImageDirectoryEntryToData( + __in PVOID Base, + __in BOOLEAN MappedAsImage, + __in USHORT DirectoryEntry, + __out PULONG Size +); + +PIMAGE_SECTION_HEADER +IMAGEAPI +ImageRvaToSection( + __in PIMAGE_NT_HEADERS NtHeaders, + __in PVOID Base, + __in ULONG Rva +); + +PVOID +IMAGEAPI +ImageRvaToVa( + __in PIMAGE_NT_HEADERS NtHeaders, + __in PVOID Base, + __in ULONG Rva, + __in_opt OUT PIMAGE_SECTION_HEADER* LastRvaSection +); + +#ifndef _WIN64 +// This api won't be ported to Win64 - Fix your code. + +typedef struct _IMAGE_DEBUG_INFORMATION +{ + LIST_ENTRY List; + DWORD ReservedSize; + PVOID ReservedMappedBase; + USHORT ReservedMachine; + USHORT ReservedCharacteristics; + DWORD ReservedCheckSum; + DWORD ImageBase; + DWORD SizeOfImage; + + DWORD ReservedNumberOfSections; + PIMAGE_SECTION_HEADER ReservedSections; + + DWORD ReservedExportedNamesSize; + PSTR ReservedExportedNames; + + DWORD ReservedNumberOfFunctionTableEntries; + PIMAGE_FUNCTION_ENTRY ReservedFunctionTableEntries; + DWORD ReservedLowestFunctionStartingAddress; + DWORD ReservedHighestFunctionEndingAddress; + + DWORD ReservedNumberOfFpoTableEntries; + PFPO_DATA ReservedFpoTableEntries; + + DWORD SizeOfCoffSymbols; + PIMAGE_COFF_SYMBOLS_HEADER CoffSymbols; + + DWORD ReservedSizeOfCodeViewSymbols; + PVOID ReservedCodeViewSymbols; + + PSTR ImageFilePath; + PSTR ImageFileName; + PSTR ReservedDebugFilePath; + + DWORD ReservedTimeDateStamp; + + BOOL ReservedRomImage; + PIMAGE_DEBUG_DIRECTORY ReservedDebugDirectory; + DWORD ReservedNumberOfDebugDirectories; + + DWORD ReservedOriginalFunctionTableBaseAddress; + + DWORD Reserved[ 2 ]; + +} IMAGE_DEBUG_INFORMATION, *PIMAGE_DEBUG_INFORMATION; + + +PIMAGE_DEBUG_INFORMATION +IMAGEAPI +MapDebugInformation( + __in_opt HANDLE FileHandle, + __in PCSTR FileName, + __in_opt PCSTR SymbolPath, + __in ULONG ImageBase +); + +BOOL +IMAGEAPI +UnmapDebugInformation( + __out_xcount(unknown) PIMAGE_DEBUG_INFORMATION DebugInfo +); + +#endif + +BOOL +IMAGEAPI +SearchTreeForFile( + __in PCSTR RootPath, + __in PCSTR InputPathName, + __out_ecount(MAX_PATH + 1) PSTR OutputPathBuffer +); + +BOOL +IMAGEAPI +SearchTreeForFileW( + __in PCWSTR RootPath, + __in PCWSTR InputPathName, + __out_ecount(MAX_PATH + 1) PWSTR OutputPathBuffer +); + +typedef BOOL +(CALLBACK* PENUMDIRTREE_CALLBACK)( + __in PCSTR FilePath, + __in_opt PVOID CallerData +); + +BOOL +IMAGEAPI +EnumDirTree( + __in_opt HANDLE hProcess, + __in PCSTR RootPath, + __in PCSTR InputPathName, + __out_ecount_opt(MAX_PATH + 1) PSTR OutputPathBuffer, + __in_opt PENUMDIRTREE_CALLBACK cb, + __in_opt PVOID data +); + +typedef BOOL +(CALLBACK* PENUMDIRTREE_CALLBACKW)( + __in PCWSTR FilePath, + __in_opt PVOID CallerData +); + +BOOL +IMAGEAPI +EnumDirTreeW( + __in_opt HANDLE hProcess, + __in PCWSTR RootPath, + __in PCWSTR InputPathName, + __out_ecount_opt(MAX_PATH + 1) PWSTR OutputPathBuffer, + __in_opt PENUMDIRTREE_CALLBACKW cb, + __in_opt PVOID data +); + +BOOL +IMAGEAPI +MakeSureDirectoryPathExists( + __in PCSTR DirPath +); + +// +// UnDecorateSymbolName Flags +// + +#define UNDNAME_COMPLETE (0x0000) // Enable full undecoration +#define UNDNAME_NO_LEADING_UNDERSCORES (0x0001) // Remove leading underscores from MS extended keywords +#define UNDNAME_NO_MS_KEYWORDS (0x0002) // Disable expansion of MS extended keywords +#define UNDNAME_NO_FUNCTION_RETURNS (0x0004) // Disable expansion of return type for primary declaration +#define UNDNAME_NO_ALLOCATION_MODEL (0x0008) // Disable expansion of the declaration model +#define UNDNAME_NO_ALLOCATION_LANGUAGE (0x0010) // Disable expansion of the declaration language specifier +#define UNDNAME_NO_MS_THISTYPE (0x0020) // NYI Disable expansion of MS keywords on the 'this' type for primary declaration +#define UNDNAME_NO_CV_THISTYPE (0x0040) // NYI Disable expansion of CV modifiers on the 'this' type for primary declaration +#define UNDNAME_NO_THISTYPE (0x0060) // Disable all modifiers on the 'this' type +#define UNDNAME_NO_ACCESS_SPECIFIERS (0x0080) // Disable expansion of access specifiers for members +#define UNDNAME_NO_THROW_SIGNATURES (0x0100) // Disable expansion of 'throw-signatures' for functions and pointers to functions +#define UNDNAME_NO_MEMBER_TYPE (0x0200) // Disable expansion of 'static' or 'virtual'ness of members +#define UNDNAME_NO_RETURN_UDT_MODEL (0x0400) // Disable expansion of MS model for UDT returns +#define UNDNAME_32_BIT_DECODE (0x0800) // Undecorate 32-bit decorated names +#define UNDNAME_NAME_ONLY (0x1000) // Crack only the name for primary declaration; +// return just [scope::]name. Does expand template params +#define UNDNAME_NO_ARGUMENTS (0x2000) // Don't undecorate arguments to function +#define UNDNAME_NO_SPECIAL_SYMS (0x4000) // Don't undecorate special names (v-table, vcall, vector xxx, metatype, etc) + +DWORD +IMAGEAPI +WINAPI +UnDecorateSymbolName( + __in PCSTR name, + __out_ecount(maxStringLength) PSTR outputString, + __in DWORD maxStringLength, + __in DWORD flags +); + +DWORD +IMAGEAPI +WINAPI +UnDecorateSymbolNameW( + __in PCWSTR name, + __out_ecount(maxStringLength) PWSTR outputString, + __in DWORD maxStringLength, + __in DWORD flags +); + +// +// these values are used for synthesized file types +// that can be passed in as image headers instead of +// the standard ones from ntimage.h +// + +#define DBHHEADER_DEBUGDIRS 0x1 +#define DBHHEADER_CVMISC 0x2 +#define DBHHEADER_PDBGUID 0x3 +typedef struct _MODLOAD_DATA +{ + DWORD ssize; // size of this struct + DWORD ssig; // signature identifying the passed data + PVOID data; // pointer to passed data + DWORD size; // size of passed data + DWORD flags; // options +} MODLOAD_DATA, *PMODLOAD_DATA; + +typedef struct _MODLOAD_CVMISC +{ + DWORD oCV; // ofset to the codeview record + size_t cCV; // size of the codeview record + DWORD oMisc; // offset to the misc record + size_t cMisc; // size of the misc record + DWORD dtImage; // datetime stamp of the image + DWORD cImage; // size of the image +} MODLOAD_CVMISC, *PMODLOAD_CVMISC; + +typedef struct _MODLOAD_PDBGUID_PDBAGE +{ + GUID PdbGuid; // Pdb Guid + DWORD PdbAge; // Pdb Age +} MODLOAD_PDBGUID_PDBAGE, *PMODLOAD_PDBGUID_PDBAGE; + +// +// StackWalking API +// + +typedef enum +{ + AddrMode1616, + AddrMode1632, + AddrModeReal, + AddrModeFlat +} ADDRESS_MODE; + +typedef struct _tagADDRESS64 +{ + DWORD64 Offset; + WORD Segment; + ADDRESS_MODE Mode; +} ADDRESS64, *LPADDRESS64; + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define ADDRESS ADDRESS64 +#define LPADDRESS LPADDRESS64 +#else +typedef struct _tagADDRESS +{ + DWORD Offset; + WORD Segment; + ADDRESS_MODE Mode; +} ADDRESS, *LPADDRESS; + +__inline +void +Address32To64( + __in LPADDRESS a32, + __out LPADDRESS64 a64 +) +{ + a64->Offset = (ULONG64)(LONG64)(LONG)a32->Offset; + a64->Segment = a32->Segment; + a64->Mode = a32->Mode; +} + +__inline +void +Address64To32( + __in LPADDRESS64 a64, + __out LPADDRESS a32 +) +{ + a32->Offset = (ULONG)a64->Offset; + a32->Segment = a64->Segment; + a32->Mode = a64->Mode; +} +#endif + +// +// This structure is included in the STACKFRAME structure, +// and is used to trace through usermode callbacks in a thread's +// kernel stack. The values must be copied by the kernel debugger +// from the DBGKD_GET_VERSION and WAIT_STATE_CHANGE packets. +// + +// +// New KDHELP structure for 64 bit system support. +// This structure is preferred in new code. +// +typedef struct _KDHELP64 +{ + + // + // address of kernel thread object, as provided in the + // WAIT_STATE_CHANGE packet. + // + DWORD64 Thread; + + // + // offset in thread object to pointer to the current callback frame + // in kernel stack. + // + DWORD ThCallbackStack; + + // + // offset in thread object to pointer to the current callback backing + // store frame in kernel stack. + // + DWORD ThCallbackBStore; + + // + // offsets to values in frame: + // + // address of next callback frame + DWORD NextCallback; + + // address of saved frame pointer (if applicable) + DWORD FramePointer; + + + // + // Address of the kernel function that calls out to user mode + // + DWORD64 KiCallUserMode; + + // + // Address of the user mode dispatcher function + // + DWORD64 KeUserCallbackDispatcher; + + // + // Lowest kernel mode address + // + DWORD64 SystemRangeStart; + + // + // Address of the user mode exception dispatcher function. + // Added in API version 10. + // + DWORD64 KiUserExceptionDispatcher; + + // + // Stack bounds, added in API version 11. + // + DWORD64 StackBase; + DWORD64 StackLimit; + + DWORD64 Reserved[5]; + +} KDHELP64, *PKDHELP64; + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define KDHELP KDHELP64 +#define PKDHELP PKDHELP64 +#else +typedef struct _KDHELP +{ + + // + // address of kernel thread object, as provided in the + // WAIT_STATE_CHANGE packet. + // + DWORD Thread; + + // + // offset in thread object to pointer to the current callback frame + // in kernel stack. + // + DWORD ThCallbackStack; + + // + // offsets to values in frame: + // + // address of next callback frame + DWORD NextCallback; + + // address of saved frame pointer (if applicable) + DWORD FramePointer; + + // + // Address of the kernel function that calls out to user mode + // + DWORD KiCallUserMode; + + // + // Address of the user mode dispatcher function + // + DWORD KeUserCallbackDispatcher; + + // + // Lowest kernel mode address + // + DWORD SystemRangeStart; + + // + // offset in thread object to pointer to the current callback backing + // store frame in kernel stack. + // + DWORD ThCallbackBStore; + + // + // Address of the user mode exception dispatcher function. + // Added in API version 10. + // + DWORD KiUserExceptionDispatcher; + + // + // Stack bounds, added in API version 11. + // + DWORD StackBase; + DWORD StackLimit; + + DWORD Reserved[5]; + +} KDHELP, *PKDHELP; + +__inline +void +KdHelp32To64( + __in PKDHELP p32, + __out PKDHELP64 p64 +) +{ + p64->Thread = p32->Thread; + p64->ThCallbackStack = p32->ThCallbackStack; + p64->NextCallback = p32->NextCallback; + p64->FramePointer = p32->FramePointer; + p64->KiCallUserMode = p32->KiCallUserMode; + p64->KeUserCallbackDispatcher = p32->KeUserCallbackDispatcher; + p64->SystemRangeStart = p32->SystemRangeStart; + p64->KiUserExceptionDispatcher = p32->KiUserExceptionDispatcher; + p64->StackBase = p32->StackBase; + p64->StackLimit = p32->StackLimit; +} +#endif + +typedef struct _tagSTACKFRAME64 +{ + ADDRESS64 AddrPC; // program counter + ADDRESS64 AddrReturn; // return address + ADDRESS64 AddrFrame; // frame pointer + ADDRESS64 AddrStack; // stack pointer + ADDRESS64 AddrBStore; // backing store pointer + PVOID FuncTableEntry; // pointer to pdata/fpo or NULL + DWORD64 Params[4]; // possible arguments to the function + BOOL Far; // WOW far call + BOOL Virtual; // is this a virtual frame? + DWORD64 Reserved[3]; + KDHELP64 KdHelp; +} STACKFRAME64, *LPSTACKFRAME64; + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define STACKFRAME STACKFRAME64 +#define LPSTACKFRAME LPSTACKFRAME64 +#else +typedef struct _tagSTACKFRAME +{ + ADDRESS AddrPC; // program counter + ADDRESS AddrReturn; // return address + ADDRESS AddrFrame; // frame pointer + ADDRESS AddrStack; // stack pointer + PVOID FuncTableEntry; // pointer to pdata/fpo or NULL + DWORD Params[4]; // possible arguments to the function + BOOL Far; // WOW far call + BOOL Virtual; // is this a virtual frame? + DWORD Reserved[3]; + KDHELP KdHelp; + ADDRESS AddrBStore; // backing store pointer +} STACKFRAME, *LPSTACKFRAME; +#endif + + +typedef +BOOL +(__stdcall* PREAD_PROCESS_MEMORY_ROUTINE64)( + __in HANDLE hProcess, + __in DWORD64 qwBaseAddress, + __out_bcount(nSize) PVOID lpBuffer, + __in DWORD nSize, + __out LPDWORD lpNumberOfBytesRead +); + +typedef +PVOID +(__stdcall* PFUNCTION_TABLE_ACCESS_ROUTINE64)( + __in HANDLE ahProcess, + __in DWORD64 AddrBase +); + +typedef +DWORD64 +(__stdcall* PGET_MODULE_BASE_ROUTINE64)( + __in HANDLE hProcess, + __in DWORD64 Address +); + +typedef +DWORD64 +(__stdcall* PTRANSLATE_ADDRESS_ROUTINE64)( + __in HANDLE hProcess, + __in HANDLE hThread, + __in LPADDRESS64 lpaddr +); + +BOOL +IMAGEAPI +StackWalk64( + __in DWORD MachineType, + __in HANDLE hProcess, + __in HANDLE hThread, + __inout LPSTACKFRAME64 StackFrame, + __inout PVOID ContextRecord, + __in_opt PREAD_PROCESS_MEMORY_ROUTINE64 ReadMemoryRoutine, + __in_opt PFUNCTION_TABLE_ACCESS_ROUTINE64 FunctionTableAccessRoutine, + __in_opt PGET_MODULE_BASE_ROUTINE64 GetModuleBaseRoutine, + __in_opt PTRANSLATE_ADDRESS_ROUTINE64 TranslateAddress +); + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) + +#define PREAD_PROCESS_MEMORY_ROUTINE PREAD_PROCESS_MEMORY_ROUTINE64 +#define PFUNCTION_TABLE_ACCESS_ROUTINE PFUNCTION_TABLE_ACCESS_ROUTINE64 +#define PGET_MODULE_BASE_ROUTINE PGET_MODULE_BASE_ROUTINE64 +#define PTRANSLATE_ADDRESS_ROUTINE PTRANSLATE_ADDRESS_ROUTINE64 + +#define StackWalk StackWalk64 + +#else + +typedef +BOOL +(__stdcall* PREAD_PROCESS_MEMORY_ROUTINE)( + __in HANDLE hProcess, + __in DWORD lpBaseAddress, + __out_bcount(nSize) PVOID lpBuffer, + __in DWORD nSize, + __out PDWORD lpNumberOfBytesRead +); + +typedef +PVOID +(__stdcall* PFUNCTION_TABLE_ACCESS_ROUTINE)( + __in HANDLE hProcess, + __in DWORD AddrBase +); + +typedef +DWORD +(__stdcall* PGET_MODULE_BASE_ROUTINE)( + __in HANDLE hProcess, + __in DWORD Address +); + +typedef +DWORD +(__stdcall* PTRANSLATE_ADDRESS_ROUTINE)( + __in HANDLE hProcess, + __in HANDLE hThread, + __out LPADDRESS lpaddr +); + +BOOL +IMAGEAPI +StackWalk( + DWORD MachineType, + __in HANDLE hProcess, + __in HANDLE hThread, + __inout LPSTACKFRAME StackFrame, + __inout PVOID ContextRecord, + __in_opt PREAD_PROCESS_MEMORY_ROUTINE ReadMemoryRoutine, + __in_opt PFUNCTION_TABLE_ACCESS_ROUTINE FunctionTableAccessRoutine, + __in_opt PGET_MODULE_BASE_ROUTINE GetModuleBaseRoutine, + __in_opt PTRANSLATE_ADDRESS_ROUTINE TranslateAddress +); + +#endif + + +#define API_VERSION_NUMBER 11 + +typedef struct API_VERSION +{ + USHORT MajorVersion; + USHORT MinorVersion; + USHORT Revision; + USHORT Reserved; +} API_VERSION, *LPAPI_VERSION; + +LPAPI_VERSION +IMAGEAPI +ImagehlpApiVersion( + VOID +); + +LPAPI_VERSION +IMAGEAPI +ImagehlpApiVersionEx( + __in LPAPI_VERSION AppVersion +); + +DWORD +IMAGEAPI +GetTimestampForLoadedLibrary( + __in HMODULE Module +); + +// +// typedefs for function pointers +// +typedef BOOL +(CALLBACK* PSYM_ENUMMODULES_CALLBACK64)( + __in PCSTR ModuleName, + __in DWORD64 BaseOfDll, + __in_opt PVOID UserContext +); + +typedef BOOL +(CALLBACK* PSYM_ENUMMODULES_CALLBACKW64)( + __in PCWSTR ModuleName, + __in DWORD64 BaseOfDll, + __in_opt PVOID UserContext +); + +typedef BOOL +(CALLBACK* PENUMLOADED_MODULES_CALLBACK64)( + __in PCSTR ModuleName, + __in DWORD64 ModuleBase, + __in ULONG ModuleSize, + __in_opt PVOID UserContext +); + +typedef BOOL +(CALLBACK* PENUMLOADED_MODULES_CALLBACKW64)( + __in PCWSTR ModuleName, + __in DWORD64 ModuleBase, + __in ULONG ModuleSize, + __in_opt PVOID UserContext +); + +typedef BOOL +(CALLBACK* PSYM_ENUMSYMBOLS_CALLBACK64)( + __in PCSTR SymbolName, + __in DWORD64 SymbolAddress, + __in ULONG SymbolSize, + __in_opt PVOID UserContext +); + +typedef BOOL +(CALLBACK* PSYM_ENUMSYMBOLS_CALLBACK64W)( + __in PCWSTR SymbolName, + __in DWORD64 SymbolAddress, + __in ULONG SymbolSize, + __in_opt PVOID UserContext +); + +typedef BOOL +(CALLBACK* PSYMBOL_REGISTERED_CALLBACK64)( + __in HANDLE hProcess, + __in ULONG ActionCode, + __in_opt ULONG64 CallbackData, + __in_opt ULONG64 UserContext +); + +typedef +PVOID +(CALLBACK* PSYMBOL_FUNCENTRY_CALLBACK)( + __in HANDLE hProcess, + __in DWORD AddrBase, + __in_opt PVOID UserContext +); + +typedef +PVOID +(CALLBACK* PSYMBOL_FUNCENTRY_CALLBACK64)( + __in HANDLE hProcess, + __in ULONG64 AddrBase, + __in ULONG64 UserContext +); + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) + +#define PSYM_ENUMMODULES_CALLBACK PSYM_ENUMMODULES_CALLBACK64 +#define PSYM_ENUMSYMBOLS_CALLBACK PSYM_ENUMSYMBOLS_CALLBACK64 +#define PSYM_ENUMSYMBOLS_CALLBACKW PSYM_ENUMSYMBOLS_CALLBACK64W +#define PENUMLOADED_MODULES_CALLBACK PENUMLOADED_MODULES_CALLBACK64 +#define PSYMBOL_REGISTERED_CALLBACK PSYMBOL_REGISTERED_CALLBACK64 +#define PSYMBOL_FUNCENTRY_CALLBACK PSYMBOL_FUNCENTRY_CALLBACK64 + +#else + +typedef BOOL +(CALLBACK* PSYM_ENUMMODULES_CALLBACK)( + __in PCSTR ModuleName, + __in ULONG BaseOfDll, + __in_opt PVOID UserContext +); + +typedef BOOL +(CALLBACK* PSYM_ENUMSYMBOLS_CALLBACK)( + __in PCSTR SymbolName, + __in ULONG SymbolAddress, + __in ULONG SymbolSize, + __in_opt PVOID UserContext +); + +typedef BOOL +(CALLBACK* PSYM_ENUMSYMBOLS_CALLBACKW)( + __in PCWSTR SymbolName, + __in ULONG SymbolAddress, + __in ULONG SymbolSize, + __in_opt PVOID UserContext +); + +typedef BOOL +(CALLBACK* PENUMLOADED_MODULES_CALLBACK)( + __in PCSTR ModuleName, + __in ULONG ModuleBase, + __in ULONG ModuleSize, + __in_opt PVOID UserContext +); + +typedef BOOL +(CALLBACK* PSYMBOL_REGISTERED_CALLBACK)( + __in HANDLE hProcess, + __in ULONG ActionCode, + __in_opt PVOID CallbackData, + __in_opt PVOID UserContext +); + +#endif + + +// values found in SYMBOL_INFO.Tag +// +// This was taken from cvconst.h and should +// not override any values found there. +// +// #define _NO_CVCONST_H_ if you don't +// have access to that file... + +#ifdef _NO_CVCONST_H + +// DIA enums + +enum SymTagEnum +{ + SymTagNull, + SymTagExe, + SymTagCompiland, + SymTagCompilandDetails, + SymTagCompilandEnv, + SymTagFunction, + SymTagBlock, + SymTagData, + SymTagAnnotation, + SymTagLabel, + SymTagPublicSymbol, + SymTagUDT, + SymTagEnum, + SymTagFunctionType, + SymTagPointerType, + SymTagArrayType, + SymTagBaseType, + SymTagTypedef, + SymTagBaseClass, + SymTagFriend, + SymTagFunctionArgType, + SymTagFuncDebugStart, + SymTagFuncDebugEnd, + SymTagUsingNamespace, + SymTagVTableShape, + SymTagVTable, + SymTagCustom, + SymTagThunk, + SymTagCustomType, + SymTagManagedType, + SymTagDimension, + SymTagMax +}; + +#endif + +// +// flags found in SYMBOL_INFO.Flags +// + +#define SYMFLAG_VALUEPRESENT 0x00000001 +#define SYMFLAG_REGISTER 0x00000008 +#define SYMFLAG_REGREL 0x00000010 +#define SYMFLAG_FRAMEREL 0x00000020 +#define SYMFLAG_PARAMETER 0x00000040 +#define SYMFLAG_LOCAL 0x00000080 +#define SYMFLAG_CONSTANT 0x00000100 +#define SYMFLAG_EXPORT 0x00000200 +#define SYMFLAG_FORWARDER 0x00000400 +#define SYMFLAG_FUNCTION 0x00000800 +#define SYMFLAG_VIRTUAL 0x00001000 +#define SYMFLAG_THUNK 0x00002000 +#define SYMFLAG_TLSREL 0x00004000 +#define SYMFLAG_SLOT 0x00008000 +#define SYMFLAG_ILREL 0x00010000 +#define SYMFLAG_METADATA 0x00020000 +#define SYMFLAG_CLR_TOKEN 0x00040000 + +// this resets SymNext/Prev to the beginning +// of the module passed in the address field + +#define SYMFLAG_RESET 0x80000000 + +// +// symbol type enumeration +// +typedef enum +{ + SymNone = 0, + SymCoff, + SymCv, + SymPdb, + SymExport, + SymDeferred, + SymSym, // .sym file + SymDia, + SymVirtual, + NumSymTypes +} SYM_TYPE; + +// +// symbol data structure +// + +typedef struct _IMAGEHLP_SYMBOL64 +{ + DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_SYMBOL64) + DWORD64 Address; // virtual address including dll base address + DWORD Size; // estimated size of symbol, can be zero + DWORD Flags; // info about the symbols, see the SYMF defines + DWORD MaxNameLength; // maximum size of symbol name in 'Name' + CHAR Name[1]; // symbol name (null terminated string) +} IMAGEHLP_SYMBOL64, *PIMAGEHLP_SYMBOL64; + +typedef struct _IMAGEHLP_SYMBOL64_PACKAGE +{ + IMAGEHLP_SYMBOL64 sym; + CHAR name[MAX_SYM_NAME + 1]; +} IMAGEHLP_SYMBOL64_PACKAGE, *PIMAGEHLP_SYMBOL64_PACKAGE; + +typedef struct _IMAGEHLP_SYMBOLW64 +{ + DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_SYMBOLW64) + DWORD64 Address; // virtual address including dll base address + DWORD Size; // estimated size of symbol, can be zero + DWORD Flags; // info about the symbols, see the SYMF defines + DWORD MaxNameLength; // maximum size of symbol name in 'Name' + WCHAR Name[1]; // symbol name (null terminated string) +} IMAGEHLP_SYMBOLW64, *PIMAGEHLP_SYMBOLW64; + +typedef struct _IMAGEHLP_SYMBOLW64_PACKAGE +{ + IMAGEHLP_SYMBOLW64 sym; + WCHAR name[MAX_SYM_NAME + 1]; +} IMAGEHLP_SYMBOLW64_PACKAGE, *PIMAGEHLP_SYMBOLW64_PACKAGE; + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) + +#define IMAGEHLP_SYMBOL IMAGEHLP_SYMBOL64 +#define PIMAGEHLP_SYMBOL PIMAGEHLP_SYMBOL64 +#define IMAGEHLP_SYMBOL_PACKAGE IMAGEHLP_SYMBOL64_PACKAGE +#define PIMAGEHLP_SYMBOL_PACKAGE PIMAGEHLP_SYMBOL64_PACKAGE +#define IMAGEHLP_SYMBOLW IMAGEHLP_SYMBOLW64 +#define PIMAGEHLP_SYMBOLW PIMAGEHLP_SYMBOLW64 +#define IMAGEHLP_SYMBOLW_PACKAGE IMAGEHLP_SYMBOLW64_PACKAGE +#define PIMAGEHLP_SYMBOLW_PACKAGE PIMAGEHLP_SYMBOLW64_PACKAGE + +#else + +typedef struct _IMAGEHLP_SYMBOL +{ + DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_SYMBOL) + DWORD Address; // virtual address including dll base address + DWORD Size; // estimated size of symbol, can be zero + DWORD Flags; // info about the symbols, see the SYMF defines + DWORD MaxNameLength; // maximum size of symbol name in 'Name' + CHAR Name[1]; // symbol name (null terminated string) +} IMAGEHLP_SYMBOL, *PIMAGEHLP_SYMBOL; + +typedef struct _IMAGEHLP_SYMBOL_PACKAGE +{ + IMAGEHLP_SYMBOL sym; + CHAR name[MAX_SYM_NAME + 1]; +} IMAGEHLP_SYMBOL_PACKAGE, *PIMAGEHLP_SYMBOL_PACKAGE; + +typedef struct _IMAGEHLP_SYMBOLW +{ + DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_SYMBOLW) + DWORD Address; // virtual address including dll base address + DWORD Size; // estimated size of symbol, can be zero + DWORD Flags; // info about the symbols, see the SYMF defines + DWORD MaxNameLength; // maximum size of symbol name in 'Name' + WCHAR Name[1]; // symbol name (null terminated string) +} IMAGEHLP_SYMBOLW, *PIMAGEHLP_SYMBOLW; + +typedef struct _IMAGEHLP_SYMBOLW_PACKAGE +{ + IMAGEHLP_SYMBOLW sym; + WCHAR name[MAX_SYM_NAME + 1]; +} IMAGEHLP_SYMBOLW_PACKAGE, *PIMAGEHLP_SYMBOLW_PACKAGE; + +#endif + +// +// module data structure +// + +typedef struct _IMAGEHLP_MODULE64 +{ + DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_MODULE64) + DWORD64 BaseOfImage; // base load address of module + DWORD ImageSize; // virtual size of the loaded module + DWORD TimeDateStamp; // date/time stamp from pe header + DWORD CheckSum; // checksum from the pe header + DWORD NumSyms; // number of symbols in the symbol table + SYM_TYPE SymType; // type of symbols loaded + CHAR ModuleName[32]; // module name + CHAR ImageName[256]; // image name + CHAR LoadedImageName[256]; // symbol file name + // new elements: 07-Jun-2002 + CHAR LoadedPdbName[256]; // pdb file name + DWORD CVSig; // Signature of the CV record in the debug directories + CHAR CVData[MAX_PATH * 3]; // Contents of the CV record + DWORD PdbSig; // Signature of PDB + GUID PdbSig70; // Signature of PDB (VC 7 and up) + DWORD PdbAge; // DBI age of pdb + BOOL PdbUnmatched; // loaded an unmatched pdb + BOOL DbgUnmatched; // loaded an unmatched dbg + BOOL LineNumbers; // we have line number information + BOOL GlobalSymbols; // we have internal symbol information + BOOL TypeInfo; // we have type information + // new elements: 17-Dec-2003 + BOOL SourceIndexed; // pdb supports source server + BOOL Publics; // contains public symbols +} IMAGEHLP_MODULE64, *PIMAGEHLP_MODULE64; + +typedef struct _IMAGEHLP_MODULEW64 +{ + DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_MODULE64) + DWORD64 BaseOfImage; // base load address of module + DWORD ImageSize; // virtual size of the loaded module + DWORD TimeDateStamp; // date/time stamp from pe header + DWORD CheckSum; // checksum from the pe header + DWORD NumSyms; // number of symbols in the symbol table + SYM_TYPE SymType; // type of symbols loaded + WCHAR ModuleName[32]; // module name + WCHAR ImageName[256]; // image name + // new elements: 07-Jun-2002 + WCHAR LoadedImageName[256]; // symbol file name + WCHAR LoadedPdbName[256]; // pdb file name + DWORD CVSig; // Signature of the CV record in the debug directories + WCHAR CVData[MAX_PATH * 3]; // Contents of the CV record + DWORD PdbSig; // Signature of PDB + GUID PdbSig70; // Signature of PDB (VC 7 and up) + DWORD PdbAge; // DBI age of pdb + BOOL PdbUnmatched; // loaded an unmatched pdb + BOOL DbgUnmatched; // loaded an unmatched dbg + BOOL LineNumbers; // we have line number information + BOOL GlobalSymbols; // we have internal symbol information + BOOL TypeInfo; // we have type information + // new elements: 17-Dec-2003 + BOOL SourceIndexed; // pdb supports source server + BOOL Publics; // contains public symbols +} IMAGEHLP_MODULEW64, *PIMAGEHLP_MODULEW64; + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define IMAGEHLP_MODULE IMAGEHLP_MODULE64 +#define PIMAGEHLP_MODULE PIMAGEHLP_MODULE64 +#define IMAGEHLP_MODULEW IMAGEHLP_MODULEW64 +#define PIMAGEHLP_MODULEW PIMAGEHLP_MODULEW64 +#else +typedef struct _IMAGEHLP_MODULE +{ + DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_MODULE) + DWORD BaseOfImage; // base load address of module + DWORD ImageSize; // virtual size of the loaded module + DWORD TimeDateStamp; // date/time stamp from pe header + DWORD CheckSum; // checksum from the pe header + DWORD NumSyms; // number of symbols in the symbol table + SYM_TYPE SymType; // type of symbols loaded + CHAR ModuleName[32]; // module name + CHAR ImageName[256]; // image name + CHAR LoadedImageName[256]; // symbol file name +} IMAGEHLP_MODULE, *PIMAGEHLP_MODULE; + +typedef struct _IMAGEHLP_MODULEW +{ + DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_MODULE) + DWORD BaseOfImage; // base load address of module + DWORD ImageSize; // virtual size of the loaded module + DWORD TimeDateStamp; // date/time stamp from pe header + DWORD CheckSum; // checksum from the pe header + DWORD NumSyms; // number of symbols in the symbol table + SYM_TYPE SymType; // type of symbols loaded + WCHAR ModuleName[32]; // module name + WCHAR ImageName[256]; // image name + WCHAR LoadedImageName[256]; // symbol file name +} IMAGEHLP_MODULEW, *PIMAGEHLP_MODULEW; +#endif + +// +// source file line data structure +// + +typedef struct _IMAGEHLP_LINE64 +{ + DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_LINE64) + PVOID Key; // internal + DWORD LineNumber; // line number in file + PCHAR FileName; // full filename + DWORD64 Address; // first instruction of line +} IMAGEHLP_LINE64, *PIMAGEHLP_LINE64; + +typedef struct _IMAGEHLP_LINEW64 +{ + DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_LINE64) + PVOID Key; // internal + DWORD LineNumber; // line number in file + PWSTR FileName; // full filename + DWORD64 Address; // first instruction of line +} IMAGEHLP_LINEW64, *PIMAGEHLP_LINEW64; + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define IMAGEHLP_LINE IMAGEHLP_LINE64 +#define PIMAGEHLP_LINE PIMAGEHLP_LINE64 +#else +typedef struct _IMAGEHLP_LINE +{ + DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_LINE) + PVOID Key; // internal + DWORD LineNumber; // line number in file + PCHAR FileName; // full filename + DWORD Address; // first instruction of line +} IMAGEHLP_LINE, *PIMAGEHLP_LINE; + +typedef struct _IMAGEHLP_LINEW +{ + DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_LINE64) + PVOID Key; // internal + DWORD LineNumber; // line number in file + PCHAR FileName; // full filename + DWORD64 Address; // first instruction of line +} IMAGEHLP_LINEW, *PIMAGEHLP_LINEW; +#endif + +// +// source file structure +// + +typedef struct _SOURCEFILE +{ + DWORD64 ModBase; // base address of loaded module + PCHAR FileName; // full filename of source +} SOURCEFILE, *PSOURCEFILE; + +typedef struct _SOURCEFILEW +{ + DWORD64 ModBase; // base address of loaded module + PWSTR FileName; // full filename of source +} SOURCEFILEW, *PSOURCEFILEW; + +// +// data structures used for registered symbol callbacks +// + +#define CBA_DEFERRED_SYMBOL_LOAD_START 0x00000001 +#define CBA_DEFERRED_SYMBOL_LOAD_COMPLETE 0x00000002 +#define CBA_DEFERRED_SYMBOL_LOAD_FAILURE 0x00000003 +#define CBA_SYMBOLS_UNLOADED 0x00000004 +#define CBA_DUPLICATE_SYMBOL 0x00000005 +#define CBA_READ_MEMORY 0x00000006 +#define CBA_DEFERRED_SYMBOL_LOAD_CANCEL 0x00000007 +#define CBA_SET_OPTIONS 0x00000008 +#define CBA_EVENT 0x00000010 +#define CBA_DEFERRED_SYMBOL_LOAD_PARTIAL 0x00000020 +#define CBA_DEBUG_INFO 0x10000000 +#define CBA_SRCSRV_INFO 0x20000000 +#define CBA_SRCSRV_EVENT 0x40000000 + +typedef struct _IMAGEHLP_CBA_READ_MEMORY +{ + DWORD64 addr; // address to read from + PVOID buf; // buffer to read to + DWORD bytes; // amount of bytes to read + DWORD* bytesread; // pointer to store amount of bytes read +} IMAGEHLP_CBA_READ_MEMORY, *PIMAGEHLP_CBA_READ_MEMORY; + +enum +{ + sevInfo = 0, + sevProblem, + sevAttn, + sevFatal, + sevMax // unused +}; + +#define EVENT_SRCSPEW_START 100 +#define EVENT_SRCSPEW 100 +#define EVENT_SRCSPEW_END 199 + +typedef struct _IMAGEHLP_CBA_EVENT +{ + DWORD severity; // values from sevInfo to sevFatal + DWORD code; // numerical code IDs the error + PCHAR desc; // may contain a text description of the error + PVOID object; // value dependant upon the error code +} IMAGEHLP_CBA_EVENT, *PIMAGEHLP_CBA_EVENT; + +typedef struct _IMAGEHLP_CBA_EVENTW +{ + DWORD severity; // values from sevInfo to sevFatal + DWORD code; // numerical code IDs the error + PCWSTR desc; // may contain a text description of the error + PVOID object; // value dependant upon the error code +} IMAGEHLP_CBA_EVENTW, *PIMAGEHLP_CBA_EVENTW; + +typedef struct _IMAGEHLP_DEFERRED_SYMBOL_LOAD64 +{ + DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_DEFERRED_SYMBOL_LOAD64) + DWORD64 BaseOfImage; // base load address of module + DWORD CheckSum; // checksum from the pe header + DWORD TimeDateStamp; // date/time stamp from pe header + CHAR FileName[MAX_PATH]; // symbols file or image name + BOOLEAN Reparse; // load failure reparse + HANDLE hFile; // file handle, if passed + DWORD Flags; // +} IMAGEHLP_DEFERRED_SYMBOL_LOAD64, *PIMAGEHLP_DEFERRED_SYMBOL_LOAD64; + +typedef struct _IMAGEHLP_DEFERRED_SYMBOL_LOADW64 +{ + DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_DEFERRED_SYMBOL_LOADW64) + DWORD64 BaseOfImage; // base load address of module + DWORD CheckSum; // checksum from the pe header + DWORD TimeDateStamp; // date/time stamp from pe header + WCHAR FileName[MAX_PATH + 1]; // symbols file or image name + BOOLEAN Reparse; // load failure reparse + HANDLE hFile; // file handle, if passed + DWORD Flags; // +} IMAGEHLP_DEFERRED_SYMBOL_LOADW64, *PIMAGEHLP_DEFERRED_SYMBOL_LOADW64; + +#define DSLFLAG_MISMATCHED_PDB 0x1 +#define DSLFLAG_MISMATCHED_DBG 0x2 + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define IMAGEHLP_DEFERRED_SYMBOL_LOAD IMAGEHLP_DEFERRED_SYMBOL_LOAD64 +#define PIMAGEHLP_DEFERRED_SYMBOL_LOAD PIMAGEHLP_DEFERRED_SYMBOL_LOAD64 +#else +typedef struct _IMAGEHLP_DEFERRED_SYMBOL_LOAD +{ + DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_DEFERRED_SYMBOL_LOAD) + DWORD BaseOfImage; // base load address of module + DWORD CheckSum; // checksum from the pe header + DWORD TimeDateStamp; // date/time stamp from pe header + CHAR FileName[MAX_PATH]; // symbols file or image name + BOOLEAN Reparse; // load failure reparse + HANDLE hFile; // file handle, if passed +} IMAGEHLP_DEFERRED_SYMBOL_LOAD, *PIMAGEHLP_DEFERRED_SYMBOL_LOAD; +#endif + +typedef struct _IMAGEHLP_DUPLICATE_SYMBOL64 +{ + DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_DUPLICATE_SYMBOL64) + DWORD NumberOfDups; // number of duplicates in the Symbol array + PIMAGEHLP_SYMBOL64 Symbol; // array of duplicate symbols + DWORD SelectedSymbol; // symbol selected (-1 to start) +} IMAGEHLP_DUPLICATE_SYMBOL64, *PIMAGEHLP_DUPLICATE_SYMBOL64; + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define IMAGEHLP_DUPLICATE_SYMBOL IMAGEHLP_DUPLICATE_SYMBOL64 +#define PIMAGEHLP_DUPLICATE_SYMBOL PIMAGEHLP_DUPLICATE_SYMBOL64 +#else +typedef struct _IMAGEHLP_DUPLICATE_SYMBOL +{ + DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_DUPLICATE_SYMBOL) + DWORD NumberOfDups; // number of duplicates in the Symbol array + PIMAGEHLP_SYMBOL Symbol; // array of duplicate symbols + DWORD SelectedSymbol; // symbol selected (-1 to start) +} IMAGEHLP_DUPLICATE_SYMBOL, *PIMAGEHLP_DUPLICATE_SYMBOL; +#endif + +// If dbghelp ever needs to display graphical UI, it will use this as the parent window. + +BOOL +IMAGEAPI +SymSetParentWindow( + __in HWND hwnd +); + +PCHAR +IMAGEAPI +SymSetHomeDirectory( + __in_opt HANDLE hProcess, + __in_opt PCSTR dir +); + +PWSTR +IMAGEAPI +SymSetHomeDirectoryW( + __in_opt HANDLE hProcess, + __in_opt PCWSTR dir +); + +PCHAR +IMAGEAPI +SymGetHomeDirectory( + __in DWORD type, + __out_ecount(size) PSTR dir, + __in size_t size +); + +PWSTR +IMAGEAPI +SymGetHomeDirectoryW( + __in DWORD type, + __out_ecount(size) PWSTR dir, + __in size_t size +); + +enum +{ + hdBase = 0, // root directory for dbghelp + hdSym, // where symbols are stored + hdSrc, // where source is stored + hdMax // end marker +}; + +typedef struct _OMAP +{ + ULONG rva; + ULONG rvaTo; +} OMAP, *POMAP; + +BOOL +IMAGEAPI +SymGetOmaps( + __in HANDLE hProcess, + __in DWORD64 BaseOfDll, + __out POMAP* OmapTo, + __out PDWORD64 cOmapTo, + __out POMAP* OmapFrom, + __out PDWORD64 cOmapFrom +); + +// +// options that are set/returned by SymSetOptions() & SymGetOptions() +// these are used as a mask +// +#define SYMOPT_CASE_INSENSITIVE 0x00000001 +#define SYMOPT_UNDNAME 0x00000002 +#define SYMOPT_DEFERRED_LOADS 0x00000004 +#define SYMOPT_NO_CPP 0x00000008 +#define SYMOPT_LOAD_LINES 0x00000010 +#define SYMOPT_OMAP_FIND_NEAREST 0x00000020 +#define SYMOPT_LOAD_ANYTHING 0x00000040 +#define SYMOPT_IGNORE_CVREC 0x00000080 +#define SYMOPT_NO_UNQUALIFIED_LOADS 0x00000100 +#define SYMOPT_FAIL_CRITICAL_ERRORS 0x00000200 +#define SYMOPT_EXACT_SYMBOLS 0x00000400 +#define SYMOPT_ALLOW_ABSOLUTE_SYMBOLS 0x00000800 +#define SYMOPT_IGNORE_NT_SYMPATH 0x00001000 +#define SYMOPT_INCLUDE_32BIT_MODULES 0x00002000 +#define SYMOPT_PUBLICS_ONLY 0x00004000 +#define SYMOPT_NO_PUBLICS 0x00008000 +#define SYMOPT_AUTO_PUBLICS 0x00010000 +#define SYMOPT_NO_IMAGE_SEARCH 0x00020000 +#define SYMOPT_SECURE 0x00040000 +#define SYMOPT_NO_PROMPTS 0x00080000 +#define SYMOPT_OVERWRITE 0x00100000 +#define SYMOPT_IGNORE_IMAGEDIR 0x00200000 +#define SYMOPT_FLAT_DIRECTORY 0x00400000 +#define SYMOPT_FAVOR_COMPRESSED 0x00800000 +#define SYMOPT_ALLOW_ZERO_ADDRESS 0x01000000 +#define SYMOPT_DISABLE_SYMSRV_AUTODETECT 0x02000000 + +#define SYMOPT_DEBUG 0x80000000 + +DWORD +IMAGEAPI +SymSetOptions( + __in DWORD SymOptions +); + +DWORD +IMAGEAPI +SymGetOptions( + VOID +); + +BOOL +IMAGEAPI +SymCleanup( + __in HANDLE hProcess +); + +BOOL +IMAGEAPI +SymMatchString( + __in PCSTR string, + __in PCSTR expression, + __in BOOL fCase +); + +BOOL +IMAGEAPI +SymMatchStringA( + __in PCSTR string, + __in PCSTR expression, + __in BOOL fCase +); + +BOOL +IMAGEAPI +SymMatchStringW( + __in PCWSTR string, + __in PCWSTR expression, + __in BOOL fCase +); + +typedef BOOL +(CALLBACK* PSYM_ENUMSOURCEFILES_CALLBACK)( + __in PSOURCEFILE pSourceFile, + __in_opt PVOID UserContext +); + +// for backwards compatibility - don't use this +#define PSYM_ENUMSOURCFILES_CALLBACK PSYM_ENUMSOURCEFILES_CALLBACK + +BOOL +IMAGEAPI +SymEnumSourceFiles( + __in HANDLE hProcess, + __in ULONG64 ModBase, + __in_opt PCSTR Mask, + __in PSYM_ENUMSOURCEFILES_CALLBACK cbSrcFiles, + __in_opt PVOID UserContext +); + +typedef BOOL +(CALLBACK* PSYM_ENUMSOURCEFILES_CALLBACKW)( + __in PSOURCEFILEW pSourceFile, + __in_opt PVOID UserContext +); + +BOOL +IMAGEAPI +SymEnumSourceFilesW( + __in HANDLE hProcess, + __in ULONG64 ModBase, + __in_opt PCWSTR Mask, + __in PSYM_ENUMSOURCEFILES_CALLBACKW cbSrcFiles, + __in_opt PVOID UserContext +); + +BOOL +IMAGEAPI +SymEnumerateModules64( + __in HANDLE hProcess, + __in PSYM_ENUMMODULES_CALLBACK64 EnumModulesCallback, + __in_opt PVOID UserContext +); + +BOOL +IMAGEAPI +SymEnumerateModulesW64( + __in HANDLE hProcess, + __in PSYM_ENUMMODULES_CALLBACKW64 EnumModulesCallback, + __in_opt PVOID UserContext +); + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define SymEnumerateModules SymEnumerateModules64 +#else +BOOL +IMAGEAPI +SymEnumerateModules( + __in HANDLE hProcess, + __in PSYM_ENUMMODULES_CALLBACK EnumModulesCallback, + __in_opt PVOID UserContext +); +#endif + +BOOL +IMAGEAPI +EnumerateLoadedModulesEx( + __in HANDLE hProcess, + __in PENUMLOADED_MODULES_CALLBACK64 EnumLoadedModulesCallback, + __in_opt PVOID UserContext +); + +BOOL +IMAGEAPI +EnumerateLoadedModulesExW( + __in HANDLE hProcess, + __in PENUMLOADED_MODULES_CALLBACKW64 EnumLoadedModulesCallback, + __in_opt PVOID UserContext +); + +BOOL +IMAGEAPI +EnumerateLoadedModules64( + __in HANDLE hProcess, + __in PENUMLOADED_MODULES_CALLBACK64 EnumLoadedModulesCallback, + __in_opt PVOID UserContext +); + +BOOL +IMAGEAPI +EnumerateLoadedModulesW64( + __in HANDLE hProcess, + __in PENUMLOADED_MODULES_CALLBACKW64 EnumLoadedModulesCallback, + __in_opt PVOID UserContext +); + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define EnumerateLoadedModules EnumerateLoadedModules64 +#else +BOOL +IMAGEAPI +EnumerateLoadedModules( + __in HANDLE hProcess, + __in PENUMLOADED_MODULES_CALLBACK EnumLoadedModulesCallback, + __in_opt PVOID UserContext +); +#endif + +PVOID +IMAGEAPI +SymFunctionTableAccess64( + __in HANDLE hProcess, + __in DWORD64 AddrBase +); + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define SymFunctionTableAccess SymFunctionTableAccess64 +#else +PVOID +IMAGEAPI +SymFunctionTableAccess( + __in HANDLE hProcess, + __in DWORD AddrBase +); +#endif + +BOOL +IMAGEAPI +SymGetUnwindInfo( + __in HANDLE hProcess, + __in DWORD64 Address, + __out_bcount_opt(*Size) PVOID Buffer, + __inout PULONG Size +); + +BOOL +IMAGEAPI +SymGetModuleInfo64( + __in HANDLE hProcess, + __in DWORD64 qwAddr, + __out PIMAGEHLP_MODULE64 ModuleInfo +); + +BOOL +IMAGEAPI +SymGetModuleInfoW64( + __in HANDLE hProcess, + __in DWORD64 qwAddr, + __out PIMAGEHLP_MODULEW64 ModuleInfo +); + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define SymGetModuleInfo SymGetModuleInfo64 +#define SymGetModuleInfoW SymGetModuleInfoW64 +#else +BOOL +IMAGEAPI +SymGetModuleInfo( + __in HANDLE hProcess, + __in DWORD dwAddr, + __out PIMAGEHLP_MODULE ModuleInfo +); + +BOOL +IMAGEAPI +SymGetModuleInfoW( + __in HANDLE hProcess, + __in DWORD dwAddr, + __out PIMAGEHLP_MODULEW ModuleInfo +); +#endif + +DWORD64 +IMAGEAPI +SymGetModuleBase64( + __in HANDLE hProcess, + __in DWORD64 qwAddr +); + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define SymGetModuleBase SymGetModuleBase64 +#else +DWORD +IMAGEAPI +SymGetModuleBase( + __in HANDLE hProcess, + __in DWORD dwAddr +); +#endif + +typedef struct _SRCCODEINFO +{ + DWORD SizeOfStruct; // set to sizeof(SRCCODEINFO) + PVOID Key; // not used + DWORD64 ModBase; // base address of module this applies to + CHAR Obj[MAX_PATH + 1]; // the object file within the module + CHAR FileName[MAX_PATH + 1]; // full filename + DWORD LineNumber; // line number in file + DWORD64 Address; // first instruction of line +} SRCCODEINFO, *PSRCCODEINFO; + +typedef struct _SRCCODEINFOW +{ + DWORD SizeOfStruct; // set to sizeof(SRCCODEINFO) + PVOID Key; // not used + DWORD64 ModBase; // base address of module this applies to + WCHAR Obj[MAX_PATH + 1]; // the object file within the module + WCHAR FileName[MAX_PATH + 1]; // full filename + DWORD LineNumber; // line number in file + DWORD64 Address; // first instruction of line +} SRCCODEINFOW, *PSRCCODEINFOW; + +typedef BOOL +(CALLBACK* PSYM_ENUMLINES_CALLBACK)( + __in PSRCCODEINFO LineInfo, + __in_opt PVOID UserContext +); + +BOOL +IMAGEAPI +SymEnumLines( + __in HANDLE hProcess, + __in ULONG64 Base, + __in_opt PCSTR Obj, + __in_opt PCSTR File, + __in PSYM_ENUMLINES_CALLBACK EnumLinesCallback, + __in_opt PVOID UserContext +); + +typedef BOOL +(CALLBACK* PSYM_ENUMLINES_CALLBACKW)( + __in PSRCCODEINFOW LineInfo, + __in_opt PVOID UserContext +); + +BOOL +IMAGEAPI +SymEnumLinesW( + __in HANDLE hProcess, + __in ULONG64 Base, + __in_opt PCWSTR Obj, + __in_opt PCWSTR File, + __in PSYM_ENUMLINES_CALLBACKW EnumLinesCallback, + __in_opt PVOID UserContext +); + +BOOL +IMAGEAPI +SymGetLineFromAddr64( + __in HANDLE hProcess, + __in DWORD64 qwAddr, + __out PDWORD pdwDisplacement, + __out PIMAGEHLP_LINE64 Line64 +); + +BOOL +IMAGEAPI +SymGetLineFromAddrW64( + __in HANDLE hProcess, + __in DWORD64 dwAddr, + __out PDWORD pdwDisplacement, + __out PIMAGEHLP_LINEW64 Line +); + +BOOL +IMAGEAPI +SymEnumSourceLines( + __in HANDLE hProcess, + __in ULONG64 Base, + __in_opt PCSTR Obj, + __in_opt PCSTR File, + __in_opt DWORD Line, + __in DWORD Flags, + __in PSYM_ENUMLINES_CALLBACK EnumLinesCallback, + __in_opt PVOID UserContext +); + +BOOL +IMAGEAPI +SymEnumSourceLinesW( + __in HANDLE hProcess, + __in ULONG64 Base, + __in_opt PCWSTR Obj, + __in_opt PCWSTR File, + __in_opt DWORD Line, + __in DWORD Flags, + __in PSYM_ENUMLINES_CALLBACKW EnumLinesCallback, + __in_opt PVOID UserContext +); + +// flags for SymEnumSourceLines + +#define ESLFLAG_FULLPATH 0x1 +#define ESLFLAG_NEAREST 0x2 +#define ESLFLAG_PREV 0x4 +#define ESLFLAG_NEXT 0x8 + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define SymGetLineFromAddr SymGetLineFromAddr64 +#define SymGetLineFromAddrW SymGetLineFromAddrW64 +#else +BOOL +IMAGEAPI +SymGetLineFromAddr( + __in HANDLE hProcess, + __in DWORD dwAddr, + __out PDWORD pdwDisplacement, + __out PIMAGEHLP_LINE Line +); + +BOOL +IMAGEAPI +SymGetLineFromAddrW( + __in HANDLE hProcess, + __in DWORD dwAddr, + __out PDWORD pdwDisplacement, + __out PIMAGEHLP_LINEW Line +); +#endif + +BOOL +IMAGEAPI +SymGetLineFromName64( + __in HANDLE hProcess, + __in_opt PCSTR ModuleName, + __in_opt PCSTR FileName, + __in DWORD dwLineNumber, + __out PLONG plDisplacement, + __inout PIMAGEHLP_LINE64 Line +); + +BOOL +IMAGEAPI +SymGetLineFromNameW64( + __in HANDLE hProcess, + __in_opt PCWSTR ModuleName, + __in_opt PCWSTR FileName, + __in DWORD dwLineNumber, + __out PLONG plDisplacement, + __inout PIMAGEHLP_LINEW64 Line +); + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define SymGetLineFromName SymGetLineFromName64 +#else +BOOL +IMAGEAPI +SymGetLineFromName( + __in HANDLE hProcess, + __in_opt PCSTR ModuleName, + __in_opt PCSTR FileName, + __in DWORD dwLineNumber, + __out PLONG plDisplacement, + __inout PIMAGEHLP_LINE Line +); +#endif + +BOOL +IMAGEAPI +SymGetLineNext64( + __in HANDLE hProcess, + __inout PIMAGEHLP_LINE64 Line +); + +BOOL +IMAGEAPI +SymGetLineNextW64( + __in HANDLE hProcess, + __inout PIMAGEHLP_LINEW64 Line +); + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define SymGetLineNext SymGetLineNext64 +#else +BOOL +IMAGEAPI +SymGetLineNext( + __in HANDLE hProcess, + __inout PIMAGEHLP_LINE Line +); + +BOOL +IMAGEAPI +SymGetLineNextW( + __in HANDLE hProcess, + __inout PIMAGEHLP_LINEW Line +); +#endif + +BOOL +IMAGEAPI +SymGetLinePrev64( + __in HANDLE hProcess, + __inout PIMAGEHLP_LINE64 Line +); + +BOOL +IMAGEAPI +SymGetLinePrevW64( + __in HANDLE hProcess, + __inout PIMAGEHLP_LINEW64 Line +); + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define SymGetLinePrev SymGetLinePrev64 +#else +BOOL +IMAGEAPI +SymGetLinePrev( + __in HANDLE hProcess, + __inout PIMAGEHLP_LINE Line +); + +BOOL +IMAGEAPI +SymGetLinePrevW( + __in HANDLE hProcess, + __inout PIMAGEHLP_LINEW Line +); +#endif + +ULONG +IMAGEAPI +SymGetFileLineOffsets64( + __in HANDLE hProcess, + __in_opt PCSTR ModuleName, + __in PCSTR FileName, + __out_ecount(BufferLines) PDWORD64 Buffer, + __in ULONG BufferLines +); + +BOOL +IMAGEAPI +SymMatchFileName( + __in PCSTR FileName, + __in PCSTR Match, + __deref_opt_out PSTR* FileNameStop, + __deref_opt_out PSTR* MatchStop +); + +BOOL +IMAGEAPI +SymMatchFileNameW( + __in PCWSTR FileName, + __in PCWSTR Match, + __deref_opt_out PWSTR* FileNameStop, + __deref_opt_out PWSTR* MatchStop +); + +BOOL +IMAGEAPI +SymGetSourceFile( + __in HANDLE hProcess, + __in ULONG64 Base, + __in_opt PCSTR Params, + __in PCSTR FileSpec, + __out_ecount(Size) PSTR FilePath, + __in DWORD Size +); + +BOOL +IMAGEAPI +SymGetSourceFileW( + __in HANDLE hProcess, + __in ULONG64 Base, + __in_opt PCWSTR Params, + __in PCWSTR FileSpec, + __out_ecount(Size) PWSTR FilePath, + __in DWORD Size +); + +BOOL +IMAGEAPI +SymGetSourceFileToken( + __in HANDLE hProcess, + __in ULONG64 Base, + __in PCSTR FileSpec, + __deref_out PVOID* Token, + __out DWORD* Size +); + +BOOL +IMAGEAPI +SymGetSourceFileTokenW( + __in HANDLE hProcess, + __in ULONG64 Base, + __in PCWSTR FileSpec, + __deref_out PVOID* Token, + __out DWORD* Size +); + +BOOL +IMAGEAPI +SymGetSourceFileFromToken( + __in HANDLE hProcess, + __in PVOID Token, + __in_opt PCSTR Params, + __out_ecount(Size) PSTR FilePath, + __in DWORD Size +); + +BOOL +IMAGEAPI +SymGetSourceFileFromTokenW( + __in HANDLE hProcess, + __in PVOID Token, + __in_opt PCWSTR Params, + __out_ecount(Size) PWSTR FilePath, + __in DWORD Size +); + +BOOL +IMAGEAPI +SymGetSourceVarFromToken( + __in HANDLE hProcess, + __in PVOID Token, + __in_opt PCSTR Params, + __in PCSTR VarName, + __out_ecount(Size) PSTR Value, + __in DWORD Size +); + +BOOL +IMAGEAPI +SymGetSourceVarFromTokenW( + __in HANDLE hProcess, + __in PVOID Token, + __in_opt PCWSTR Params, + __in PCWSTR VarName, + __out_ecount(Size) PWSTR Value, + __in DWORD Size +); + +typedef BOOL (CALLBACK* PENUMSOURCEFILETOKENSCALLBACK)(__in PVOID token, __in size_t size); + +BOOL +IMAGEAPI +SymEnumSourceFileTokens( + __in HANDLE hProcess, + __in ULONG64 Base, + __in PENUMSOURCEFILETOKENSCALLBACK Callback +); + +BOOL +IMAGEAPI +SymInitialize( + __in HANDLE hProcess, + __in_opt PCSTR UserSearchPath, + __in BOOL fInvadeProcess +); + +BOOL +IMAGEAPI +SymInitializeW( + __in HANDLE hProcess, + __in_opt PCWSTR UserSearchPath, + __in BOOL fInvadeProcess +); + +BOOL +IMAGEAPI +SymGetSearchPath( + __in HANDLE hProcess, + __out_ecount(SearchPathLength) PSTR SearchPath, + __in DWORD SearchPathLength +); + +BOOL +IMAGEAPI +SymGetSearchPathW( + __in HANDLE hProcess, + __out_ecount(SearchPathLength) PWSTR SearchPath, + __in DWORD SearchPathLength +); + +BOOL +IMAGEAPI +SymSetSearchPath( + __in HANDLE hProcess, + __in_opt PCSTR SearchPath +); + +BOOL +IMAGEAPI +SymSetSearchPathW( + __in HANDLE hProcess, + __in_opt PCWSTR SearchPath +); + +#define SLMFLAG_VIRTUAL 0x1 +#define SLMFLAG_ALT_INDEX 0x2 +#define SLMFLAG_NO_SYMBOLS 0x4 + +DWORD64 +IMAGEAPI +SymLoadModuleEx( + __in HANDLE hProcess, + __in_opt HANDLE hFile, + __in_opt PCSTR ImageName, + __in_opt PCSTR ModuleName, + __in DWORD64 BaseOfDll, + __in DWORD DllSize, + __in_opt PMODLOAD_DATA Data, + __in_opt DWORD Flags +); + +DWORD64 +IMAGEAPI +SymLoadModuleExW( + __in HANDLE hProcess, + __in_opt HANDLE hFile, + __in_opt PCWSTR ImageName, + __in_opt PCWSTR ModuleName, + __in DWORD64 BaseOfDll, + __in DWORD DllSize, + __in_opt PMODLOAD_DATA Data, + __in_opt DWORD Flags +); + +BOOL +IMAGEAPI +SymUnloadModule64( + __in HANDLE hProcess, + __in DWORD64 BaseOfDll +); + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define SymUnloadModule SymUnloadModule64 +#else +BOOL +IMAGEAPI +SymUnloadModule( + __in HANDLE hProcess, + __in DWORD BaseOfDll +); +#endif + +BOOL +IMAGEAPI +SymUnDName64( + __in PIMAGEHLP_SYMBOL64 sym, // Symbol to undecorate + __out_ecount(UnDecNameLength) PSTR UnDecName, // Buffer to store undecorated name in + __in DWORD UnDecNameLength // Size of the buffer +); + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define SymUnDName SymUnDName64 +#else +BOOL +IMAGEAPI +SymUnDName( + __in PIMAGEHLP_SYMBOL sym, // Symbol to undecorate + __out_ecount(UnDecNameLength) PSTR UnDecName, // Buffer to store undecorated name in + __in DWORD UnDecNameLength // Size of the buffer +); +#endif + +BOOL +IMAGEAPI +SymRegisterCallback64( + __in HANDLE hProcess, + __in PSYMBOL_REGISTERED_CALLBACK64 CallbackFunction, + __in ULONG64 UserContext +); + +BOOL +IMAGEAPI +SymRegisterCallbackW64( + __in HANDLE hProcess, + __in PSYMBOL_REGISTERED_CALLBACK64 CallbackFunction, + __in ULONG64 UserContext +); + +BOOL +IMAGEAPI +SymRegisterFunctionEntryCallback64( + __in HANDLE hProcess, + __in PSYMBOL_FUNCENTRY_CALLBACK64 CallbackFunction, + __in ULONG64 UserContext +); + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define SymRegisterCallback SymRegisterCallback64 +#define SymRegisterFunctionEntryCallback SymRegisterFunctionEntryCallback64 +#else +BOOL +IMAGEAPI +SymRegisterCallback( + __in HANDLE hProcess, + __in PSYMBOL_REGISTERED_CALLBACK CallbackFunction, + __in_opt PVOID UserContext +); + +BOOL +IMAGEAPI +SymRegisterFunctionEntryCallback( + __in HANDLE hProcess, + __in PSYMBOL_FUNCENTRY_CALLBACK CallbackFunction, + __in_opt PVOID UserContext +); +#endif + + +typedef struct _IMAGEHLP_SYMBOL_SRC +{ + DWORD sizeofstruct; + DWORD type; + char file[MAX_PATH]; +} IMAGEHLP_SYMBOL_SRC, *PIMAGEHLP_SYMBOL_SRC; + +typedef struct _MODULE_TYPE_INFO // AKA TYPTYP +{ + USHORT dataLength; + USHORT leaf; + BYTE data[1]; +} MODULE_TYPE_INFO, *PMODULE_TYPE_INFO; + +typedef struct _SYMBOL_INFO +{ + ULONG SizeOfStruct; + ULONG TypeIndex; // Type Index of symbol + ULONG64 Reserved[2]; + ULONG Index; + ULONG Size; + ULONG64 ModBase; // Base Address of module comtaining this symbol + ULONG Flags; + ULONG64 Value; // Value of symbol, ValuePresent should be 1 + ULONG64 Address; // Address of symbol including base address of module + ULONG Register; // register holding value or pointer to value + ULONG Scope; // scope of the symbol + ULONG Tag; // pdb classification + ULONG NameLen; // Actual length of name + ULONG MaxNameLen; + CHAR Name[1]; // Name of symbol +} SYMBOL_INFO, *PSYMBOL_INFO; + +typedef struct _SYMBOL_INFO_PACKAGE +{ + SYMBOL_INFO si; + CHAR name[MAX_SYM_NAME + 1]; +} SYMBOL_INFO_PACKAGE, *PSYMBOL_INFO_PACKAGE; + +typedef struct _SYMBOL_INFOW +{ + ULONG SizeOfStruct; + ULONG TypeIndex; // Type Index of symbol + ULONG64 Reserved[2]; + ULONG Index; + ULONG Size; + ULONG64 ModBase; // Base Address of module comtaining this symbol + ULONG Flags; + ULONG64 Value; // Value of symbol, ValuePresent should be 1 + ULONG64 Address; // Address of symbol including base address of module + ULONG Register; // register holding value or pointer to value + ULONG Scope; // scope of the symbol + ULONG Tag; // pdb classification + ULONG NameLen; // Actual length of name + ULONG MaxNameLen; + WCHAR Name[1]; // Name of symbol +} SYMBOL_INFOW, *PSYMBOL_INFOW; + +typedef struct _SYMBOL_INFO_PACKAGEW +{ + SYMBOL_INFOW si; + WCHAR name[MAX_SYM_NAME + 1]; +} SYMBOL_INFO_PACKAGEW, *PSYMBOL_INFO_PACKAGEW; + +typedef struct _IMAGEHLP_STACK_FRAME +{ + ULONG64 InstructionOffset; + ULONG64 ReturnOffset; + ULONG64 FrameOffset; + ULONG64 StackOffset; + ULONG64 BackingStoreOffset; + ULONG64 FuncTableEntry; + ULONG64 Params[4]; + ULONG64 Reserved[5]; + BOOL Virtual; + ULONG Reserved2; +} IMAGEHLP_STACK_FRAME, *PIMAGEHLP_STACK_FRAME; + +typedef VOID IMAGEHLP_CONTEXT, *PIMAGEHLP_CONTEXT; + + +BOOL +IMAGEAPI +SymSetContext( + __in HANDLE hProcess, + __in PIMAGEHLP_STACK_FRAME StackFrame, + __in_opt PIMAGEHLP_CONTEXT Context +); + +BOOL +IMAGEAPI +SymSetScopeFromAddr( + __in HANDLE hProcess, + __in ULONG64 Address +); + +BOOL +IMAGEAPI +SymSetScopeFromIndex( + __in HANDLE hProcess, + __in ULONG64 BaseOfDll, + __in DWORD Index +); + +typedef BOOL +(CALLBACK* PSYM_ENUMPROCESSES_CALLBACK)( + __in HANDLE hProcess, + __in PVOID UserContext +); + +BOOL +IMAGEAPI +SymEnumProcesses( + __in PSYM_ENUMPROCESSES_CALLBACK EnumProcessesCallback, + __in PVOID UserContext +); + +BOOL +IMAGEAPI +SymFromAddr( + __in HANDLE hProcess, + __in DWORD64 Address, + __out_opt PDWORD64 Displacement, + __inout PSYMBOL_INFO Symbol +); + +BOOL +IMAGEAPI +SymFromAddrW( + __in HANDLE hProcess, + __in DWORD64 Address, + __out_opt PDWORD64 Displacement, + __inout PSYMBOL_INFOW Symbol +); + +BOOL +IMAGEAPI +SymFromToken( + __in HANDLE hProcess, + __in DWORD64 Base, + __in DWORD Token, + __inout PSYMBOL_INFO Symbol +); + +BOOL +IMAGEAPI +SymFromTokenW( + __in HANDLE hProcess, + __in DWORD64 Base, + __in DWORD Token, + __inout PSYMBOL_INFOW Symbol +); + +BOOL +IMAGEAPI +SymNext( + __in HANDLE hProcess, + __inout PSYMBOL_INFO si +); + +BOOL +IMAGEAPI +SymNextW( + __in HANDLE hProcess, + __inout PSYMBOL_INFOW siw +); + +BOOL +IMAGEAPI +SymPrev( + __in HANDLE hProcess, + __inout PSYMBOL_INFO si +); + +BOOL +IMAGEAPI +SymPrevW( + __in HANDLE hProcess, + __inout PSYMBOL_INFOW siw +); + +// While SymFromName will provide a symbol from a name, +// SymEnumSymbols can provide the same matching information +// for ALL symbols with a matching name, even regular +// expressions. That way you can search across modules +// and differentiate between identically named symbols. + +BOOL +IMAGEAPI +SymFromName( + __in HANDLE hProcess, + __in PCSTR Name, + __inout PSYMBOL_INFO Symbol +); + +BOOL +IMAGEAPI +SymFromNameW( + __in HANDLE hProcess, + __in PCWSTR Name, + __inout PSYMBOL_INFOW Symbol +); + +typedef BOOL +(CALLBACK* PSYM_ENUMERATESYMBOLS_CALLBACK)( + __in PSYMBOL_INFO pSymInfo, + __in ULONG SymbolSize, + __in_opt PVOID UserContext +); + +BOOL +IMAGEAPI +SymEnumSymbols( + __in HANDLE hProcess, + __in ULONG64 BaseOfDll, + __in_opt PCSTR Mask, + __in PSYM_ENUMERATESYMBOLS_CALLBACK EnumSymbolsCallback, + __in_opt PVOID UserContext +); + +typedef BOOL +(CALLBACK* PSYM_ENUMERATESYMBOLS_CALLBACKW)( + __in PSYMBOL_INFOW pSymInfo, + __in ULONG SymbolSize, + __in_opt PVOID UserContext +); + +BOOL +IMAGEAPI +SymEnumSymbolsW( + __in HANDLE hProcess, + __in ULONG64 BaseOfDll, + __in_opt PCWSTR Mask, + __in PSYM_ENUMERATESYMBOLS_CALLBACKW EnumSymbolsCallback, + __in_opt PVOID UserContext +); + +BOOL +IMAGEAPI +SymEnumSymbolsForAddr( + __in HANDLE hProcess, + __in DWORD64 Address, + __in PSYM_ENUMERATESYMBOLS_CALLBACK EnumSymbolsCallback, + __in_opt PVOID UserContext +); + +BOOL +IMAGEAPI +SymEnumSymbolsForAddrW( + __in HANDLE hProcess, + __in DWORD64 Address, + __in PSYM_ENUMERATESYMBOLS_CALLBACKW EnumSymbolsCallback, + __in_opt PVOID UserContext +); + +#define SYMSEARCH_MASKOBJS 0x01 // used internally to implement other APIs +#define SYMSEARCH_RECURSE 0X02 // recurse scopes +#define SYMSEARCH_GLOBALSONLY 0X04 // search only for global symbols +#define SYMSEARCH_ALLITEMS 0X08 // search for everything in the pdb, not just normal scoped symbols + +BOOL +IMAGEAPI +SymSearch( + __in HANDLE hProcess, + __in ULONG64 BaseOfDll, + __in_opt DWORD Index, + __in_opt DWORD SymTag, + __in_opt PCSTR Mask, + __in_opt DWORD64 Address, + __in PSYM_ENUMERATESYMBOLS_CALLBACK EnumSymbolsCallback, + __in_opt PVOID UserContext, + __in DWORD Options +); + +BOOL +IMAGEAPI +SymSearchW( + __in HANDLE hProcess, + __in ULONG64 BaseOfDll, + __in_opt DWORD Index, + __in_opt DWORD SymTag, + __in_opt PCWSTR Mask, + __in_opt DWORD64 Address, + __in PSYM_ENUMERATESYMBOLS_CALLBACKW EnumSymbolsCallback, + __in_opt PVOID UserContext, + __in DWORD Options +); + +BOOL +IMAGEAPI +SymGetScope( + __in HANDLE hProcess, + __in ULONG64 BaseOfDll, + __in DWORD Index, + __inout PSYMBOL_INFO Symbol +); + +BOOL +IMAGEAPI +SymGetScopeW( + __in HANDLE hProcess, + __in ULONG64 BaseOfDll, + __in DWORD Index, + __inout PSYMBOL_INFOW Symbol +); + +BOOL +IMAGEAPI +SymFromIndex( + __in HANDLE hProcess, + __in ULONG64 BaseOfDll, + __in DWORD Index, + __inout PSYMBOL_INFO Symbol +); + +BOOL +IMAGEAPI +SymFromIndexW( + __in HANDLE hProcess, + __in ULONG64 BaseOfDll, + __in DWORD Index, + __inout PSYMBOL_INFOW Symbol +); + +typedef enum _IMAGEHLP_SYMBOL_TYPE_INFO +{ + TI_GET_SYMTAG, + TI_GET_SYMNAME, + TI_GET_LENGTH, + TI_GET_TYPE, + TI_GET_TYPEID, + TI_GET_BASETYPE, + TI_GET_ARRAYINDEXTYPEID, + TI_FINDCHILDREN, + TI_GET_DATAKIND, + TI_GET_ADDRESSOFFSET, + TI_GET_OFFSET, + TI_GET_VALUE, + TI_GET_COUNT, + TI_GET_CHILDRENCOUNT, + TI_GET_BITPOSITION, + TI_GET_VIRTUALBASECLASS, + TI_GET_VIRTUALTABLESHAPEID, + TI_GET_VIRTUALBASEPOINTEROFFSET, + TI_GET_CLASSPARENTID, + TI_GET_NESTED, + TI_GET_SYMINDEX, + TI_GET_LEXICALPARENT, + TI_GET_ADDRESS, + TI_GET_THISADJUST, + TI_GET_UDTKIND, + TI_IS_EQUIV_TO, + TI_GET_CALLING_CONVENTION, + TI_IS_CLOSE_EQUIV_TO, + TI_GTIEX_REQS_VALID, + TI_GET_VIRTUALBASEOFFSET, + TI_GET_VIRTUALBASEDISPINDEX, + TI_GET_IS_REFERENCE, + TI_GET_INDIRECTVIRTUALBASECLASS, + IMAGEHLP_SYMBOL_TYPE_INFO_MAX, +} IMAGEHLP_SYMBOL_TYPE_INFO; + +typedef struct _TI_FINDCHILDREN_PARAMS +{ + ULONG Count; + ULONG Start; + ULONG ChildId[1]; +} TI_FINDCHILDREN_PARAMS; + +BOOL +IMAGEAPI +SymGetTypeInfo( + __in HANDLE hProcess, + __in DWORD64 ModBase, + __in ULONG TypeId, + __in IMAGEHLP_SYMBOL_TYPE_INFO GetType, + __out PVOID pInfo +); + +#define IMAGEHLP_GET_TYPE_INFO_UNCACHED 0x00000001 +#define IMAGEHLP_GET_TYPE_INFO_CHILDREN 0x00000002 + +typedef struct _IMAGEHLP_GET_TYPE_INFO_PARAMS +{ + IN ULONG SizeOfStruct; + IN ULONG Flags; + IN ULONG NumIds; + IN PULONG TypeIds; + IN ULONG64 TagFilter; + IN ULONG NumReqs; + IN IMAGEHLP_SYMBOL_TYPE_INFO* ReqKinds; + IN PULONG_PTR ReqOffsets; + IN PULONG ReqSizes; + IN ULONG_PTR ReqStride; + IN ULONG_PTR BufferSize; + OUT PVOID Buffer; + OUT ULONG EntriesMatched; + OUT ULONG EntriesFilled; + OUT ULONG64 TagsFound; + OUT ULONG64 AllReqsValid; + IN ULONG NumReqsValid; + OUT PULONG64 ReqsValid OPTIONAL; +} IMAGEHLP_GET_TYPE_INFO_PARAMS, *PIMAGEHLP_GET_TYPE_INFO_PARAMS; + +BOOL +IMAGEAPI +SymGetTypeInfoEx( + __in HANDLE hProcess, + __in DWORD64 ModBase, + __inout PIMAGEHLP_GET_TYPE_INFO_PARAMS Params +); + +BOOL +IMAGEAPI +SymEnumTypes( + __in HANDLE hProcess, + __in ULONG64 BaseOfDll, + __in PSYM_ENUMERATESYMBOLS_CALLBACK EnumSymbolsCallback, + __in_opt PVOID UserContext +); + +BOOL +IMAGEAPI +SymEnumTypesW( + __in HANDLE hProcess, + __in ULONG64 BaseOfDll, + __in PSYM_ENUMERATESYMBOLS_CALLBACKW EnumSymbolsCallback, + __in_opt PVOID UserContext +); + +BOOL +IMAGEAPI +SymEnumTypesByName( + __in HANDLE hProcess, + __in ULONG64 BaseOfDll, + __in_opt PCSTR mask, + __in PSYM_ENUMERATESYMBOLS_CALLBACK EnumSymbolsCallback, + __in_opt PVOID UserContext +); + +BOOL +IMAGEAPI +SymEnumTypesByNameW( + __in HANDLE hProcess, + __in ULONG64 BaseOfDll, + __in_opt PCWSTR mask, + __in PSYM_ENUMERATESYMBOLS_CALLBACKW EnumSymbolsCallback, + __in_opt PVOID UserContext +); + +BOOL +IMAGEAPI +SymGetTypeFromName( + __in HANDLE hProcess, + __in ULONG64 BaseOfDll, + __in PCSTR Name, + __inout PSYMBOL_INFO Symbol +); + +BOOL +IMAGEAPI +SymGetTypeFromNameW( + __in HANDLE hProcess, + __in ULONG64 BaseOfDll, + __in PCWSTR Name, + __inout PSYMBOL_INFOW Symbol +); + +BOOL +IMAGEAPI +SymAddSymbol( + __in HANDLE hProcess, + __in ULONG64 BaseOfDll, + __in PCSTR Name, + __in DWORD64 Address, + __in DWORD Size, + __in DWORD Flags +); + +BOOL +IMAGEAPI +SymAddSymbolW( + __in HANDLE hProcess, + __in ULONG64 BaseOfDll, + __in PCWSTR Name, + __in DWORD64 Address, + __in DWORD Size, + __in DWORD Flags +); + +BOOL +IMAGEAPI +SymDeleteSymbol( + __in HANDLE hProcess, + __in ULONG64 BaseOfDll, + __in_opt PCSTR Name, + __in DWORD64 Address, + __in DWORD Flags +); + +BOOL +IMAGEAPI +SymDeleteSymbolW( + __in HANDLE hProcess, + __in ULONG64 BaseOfDll, + __in_opt PCWSTR Name, + __in DWORD64 Address, + __in DWORD Flags +); + +BOOL +IMAGEAPI +SymRefreshModuleList( + __in HANDLE hProcess +); + +BOOL +IMAGEAPI +SymAddSourceStream( + __in HANDLE hProcess, + __in ULONG64 Base, + __in_opt PCSTR StreamFile, + __in_bcount_opt(Size) PBYTE Buffer, + __in size_t Size +); + +typedef BOOL (WINAPI* SYMADDSOURCESTREAM)(HANDLE, ULONG64, PCSTR, PBYTE, size_t); + +BOOL +IMAGEAPI +SymAddSourceStreamA( + __in HANDLE hProcess, + __in ULONG64 Base, + __in_opt PCSTR StreamFile, + __in_bcount_opt(Size) PBYTE Buffer, + __in size_t Size +); + +typedef BOOL (WINAPI* SYMADDSOURCESTREAMA)(HANDLE, ULONG64, PCSTR, PBYTE, size_t); + +BOOL +IMAGEAPI +SymAddSourceStreamW( + __in HANDLE hProcess, + __in ULONG64 Base, + __in_opt PCWSTR FileSpec, + __in_bcount_opt(Size) PBYTE Buffer, + __in size_t Size +); + +BOOL +IMAGEAPI +SymSrvIsStoreW( + __in_opt HANDLE hProcess, + __in PCWSTR path +); + +BOOL +IMAGEAPI +SymSrvIsStore( + __in_opt HANDLE hProcess, + __in PCSTR path +); + +PCSTR +IMAGEAPI +SymSrvDeltaName( + __in HANDLE hProcess, + __in_opt PCSTR SymPath, + __in PCSTR Type, + __in PCSTR File1, + __in PCSTR File2 +); + +PCWSTR +IMAGEAPI +SymSrvDeltaNameW( + __in HANDLE hProcess, + __in_opt PCWSTR SymPath, + __in PCWSTR Type, + __in PCWSTR File1, + __in PCWSTR File2 +); + +PCSTR +IMAGEAPI +SymSrvGetSupplement( + __in HANDLE hProcess, + __in_opt PCSTR SymPath, + __in PCSTR Node, + __in PCSTR File +); + +PCWSTR +IMAGEAPI +SymSrvGetSupplementW( + __in HANDLE hProcess, + __in_opt PCWSTR SymPath, + __in PCWSTR Node, + __in PCWSTR File +); + +BOOL +IMAGEAPI +SymSrvGetFileIndexes( + __in PCSTR File, + __out GUID* Id, + __out PDWORD Val1, + __out_opt PDWORD Val2, + __in DWORD Flags +); + +BOOL +IMAGEAPI +SymSrvGetFileIndexesW( + __in PCWSTR File, + __out GUID* Id, + __out PDWORD Val1, + __out_opt PDWORD Val2, + __in DWORD Flags +); + +BOOL +IMAGEAPI +SymSrvGetFileIndexStringW( + __in HANDLE hProcess, + __in_opt PCWSTR SrvPath, + __in PCWSTR File, + __out_ecount(Size) PWSTR Index, + __in size_t Size, + __in DWORD Flags +); + +BOOL +IMAGEAPI +SymSrvGetFileIndexString( + __in HANDLE hProcess, + __in_opt PCSTR SrvPath, + __in PCSTR File, + __out_ecount(Size) PSTR Index, + __in size_t Size, + __in DWORD Flags +); + +typedef struct +{ + DWORD sizeofstruct; + char file[MAX_PATH + 1]; + BOOL stripped; + DWORD timestamp; + DWORD size; + char dbgfile[MAX_PATH + 1]; + char pdbfile[MAX_PATH + 1]; + GUID guid; + DWORD sig; + DWORD age; +} SYMSRV_INDEX_INFO, *PSYMSRV_INDEX_INFO; + +typedef struct +{ + DWORD sizeofstruct; + WCHAR file[MAX_PATH + 1]; + BOOL stripped; + DWORD timestamp; + DWORD size; + WCHAR dbgfile[MAX_PATH + 1]; + WCHAR pdbfile[MAX_PATH + 1]; + GUID guid; + DWORD sig; + DWORD age; +} SYMSRV_INDEX_INFOW, *PSYMSRV_INDEX_INFOW; + +BOOL +IMAGEAPI +SymSrvGetFileIndexInfo( + __in PCSTR File, + __out PSYMSRV_INDEX_INFO Info, + __in DWORD Flags +); + +BOOL +IMAGEAPI +SymSrvGetFileIndexInfoW( + __in PCWSTR File, + __out PSYMSRV_INDEX_INFOW Info, + __in DWORD Flags +); + +PCSTR +IMAGEAPI +SymSrvStoreSupplement( + __in HANDLE hProcess, + __in_opt PCSTR SrvPath, + __in PCSTR Node, + __in PCSTR File, + __in DWORD Flags +); + +PCWSTR +IMAGEAPI +SymSrvStoreSupplementW( + __in HANDLE hProcess, + __in_opt PCWSTR SymPath, + __in PCWSTR Node, + __in PCWSTR File, + __in DWORD Flags +); + +PCSTR +IMAGEAPI +SymSrvStoreFile( + __in HANDLE hProcess, + __in_opt PCSTR SrvPath, + __in PCSTR File, + __in DWORD Flags +); + +PCWSTR +IMAGEAPI +SymSrvStoreFileW( + __in HANDLE hProcess, + __in_opt PCWSTR SrvPath, + __in PCWSTR File, + __in DWORD Flags +); + +// used by SymGetSymbolFile's "Type" parameter + +enum +{ + sfImage = 0, + sfDbg, + sfPdb, + sfMpd, + sfMax +}; + +BOOL +IMAGEAPI +SymGetSymbolFile( + __in_opt HANDLE hProcess, + __in_opt PCSTR SymPath, + __in PCSTR ImageFile, + __in DWORD Type, + __out_ecount(cSymbolFile) PSTR SymbolFile, + __in size_t cSymbolFile, + __out_ecount(cDbgFile) PSTR DbgFile, + __in size_t cDbgFile +); + +BOOL +IMAGEAPI +SymGetSymbolFileW( + __in_opt HANDLE hProcess, + __in_opt PCWSTR SymPath, + __in PCWSTR ImageFile, + __in DWORD Type, + __out_ecount(cSymbolFile) PWSTR SymbolFile, + __in size_t cSymbolFile, + __out_ecount(cDbgFile) PWSTR DbgFile, + __in size_t cDbgFile +); + +// +// Full user-mode dump creation. +// + +typedef BOOL (WINAPI* PDBGHELP_CREATE_USER_DUMP_CALLBACK)( + __in DWORD DataType, + __in PVOID* Data, + __out LPDWORD DataLength, + __in_opt PVOID UserData +); + +BOOL +WINAPI +DbgHelpCreateUserDump( + __in_opt LPCSTR FileName, + __in PDBGHELP_CREATE_USER_DUMP_CALLBACK Callback, + __in_opt PVOID UserData +); + +BOOL +WINAPI +DbgHelpCreateUserDumpW( + __in_opt LPCWSTR FileName, + __in PDBGHELP_CREATE_USER_DUMP_CALLBACK Callback, + __in_opt PVOID UserData +); + +// ----------------------------------------------------------------- +// The following 4 legacy APIs are fully supported, but newer +// ones are recommended. SymFromName and SymFromAddr provide +// much more detailed info on the returned symbol. + +BOOL +IMAGEAPI +SymGetSymFromAddr64( + __in HANDLE hProcess, + __in DWORD64 qwAddr, + __out_opt PDWORD64 pdwDisplacement, + __inout PIMAGEHLP_SYMBOL64 Symbol +); + + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define SymGetSymFromAddr SymGetSymFromAddr64 +#else +BOOL +IMAGEAPI +SymGetSymFromAddr( + __in HANDLE hProcess, + __in DWORD dwAddr, + __out_opt PDWORD pdwDisplacement, + __inout PIMAGEHLP_SYMBOL Symbol +); +#endif + +// While following two APIs will provide a symbol from a name, +// SymEnumSymbols can provide the same matching information +// for ALL symbols with a matching name, even regular +// expressions. That way you can search across modules +// and differentiate between identically named symbols. + +BOOL +IMAGEAPI +SymGetSymFromName64( + __in HANDLE hProcess, + __in PCSTR Name, + __inout PIMAGEHLP_SYMBOL64 Symbol +); + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define SymGetSymFromName SymGetSymFromName64 +#else +BOOL +IMAGEAPI +SymGetSymFromName( + __in HANDLE hProcess, + __in PCSTR Name, + __inout PIMAGEHLP_SYMBOL Symbol +); +#endif + + +// Symbol server exports + +typedef BOOL (WINAPI* PSYMBOLSERVERPROC)(PCSTR, PCSTR, PVOID, DWORD, DWORD, PSTR); +typedef BOOL (WINAPI* PSYMBOLSERVERPROCA)(PCSTR, PCSTR, PVOID, DWORD, DWORD, PSTR); +typedef BOOL (WINAPI* PSYMBOLSERVERPROCW)(PCWSTR, PCWSTR, PVOID, DWORD, DWORD, PWSTR); +typedef BOOL (WINAPI* PSYMBOLSERVERBYINDEXPROC)(PCSTR, PCSTR, PCSTR, PSTR); +typedef BOOL (WINAPI* PSYMBOLSERVERBYINDEXPROCA)(PCSTR, PCSTR, PCSTR, PSTR); +typedef BOOL (WINAPI* PSYMBOLSERVERBYINDEXPROCW)(PCWSTR, PCWSTR, PCWSTR, PWSTR); +typedef BOOL (WINAPI* PSYMBOLSERVEROPENPROC)(VOID); +typedef BOOL (WINAPI* PSYMBOLSERVERCLOSEPROC)(VOID); +typedef BOOL (WINAPI* PSYMBOLSERVERSETOPTIONSPROC)(UINT_PTR, ULONG64); +typedef BOOL (WINAPI* PSYMBOLSERVERSETOPTIONSWPROC)(UINT_PTR, ULONG64); +typedef BOOL (CALLBACK WINAPI* PSYMBOLSERVERCALLBACKPROC)(UINT_PTR action, ULONG64 data, ULONG64 context); +typedef UINT_PTR(WINAPI* PSYMBOLSERVERGETOPTIONSPROC)(); +typedef BOOL (WINAPI* PSYMBOLSERVERPINGPROC)(PCSTR); +typedef BOOL (WINAPI* PSYMBOLSERVERPINGPROCA)(PCSTR); +typedef BOOL (WINAPI* PSYMBOLSERVERPINGPROCW)(PCWSTR); +typedef BOOL (WINAPI* PSYMBOLSERVERGETVERSION)(LPAPI_VERSION); +typedef BOOL (WINAPI* PSYMBOLSERVERDELTANAME)(PCSTR, PVOID, DWORD, DWORD, PVOID, DWORD, DWORD, PSTR, size_t); +typedef BOOL (WINAPI* PSYMBOLSERVERDELTANAMEW)(PCWSTR, PVOID, DWORD, DWORD, PVOID, DWORD, DWORD, PWSTR, size_t); +typedef BOOL (WINAPI* PSYMBOLSERVERGETSUPPLEMENT)(PCSTR, PCSTR, PCSTR, PSTR, size_t); +typedef BOOL (WINAPI* PSYMBOLSERVERGETSUPPLEMENTW)(PCWSTR, PCWSTR, PCWSTR, PWSTR, size_t); +typedef BOOL (WINAPI* PSYMBOLSERVERSTORESUPPLEMENT)(PCSTR, PCSTR, PCSTR, PSTR, size_t, DWORD); +typedef BOOL (WINAPI* PSYMBOLSERVERSTORESUPPLEMENTW)(PCWSTR, PCWSTR, PCWSTR, PWSTR, size_t, DWORD); +typedef BOOL (WINAPI* PSYMBOLSERVERGETINDEXSTRING)(PVOID, DWORD, DWORD, PSTR, size_t); +typedef BOOL (WINAPI* PSYMBOLSERVERGETINDEXSTRINGW)(PVOID, DWORD, DWORD, PWSTR, size_t); +typedef BOOL (WINAPI* PSYMBOLSERVERSTOREFILE)(PCSTR, PCSTR, PVOID, DWORD, DWORD, PSTR, size_t, DWORD); +typedef BOOL (WINAPI* PSYMBOLSERVERSTOREFILEW)(PCWSTR, PCWSTR, PVOID, DWORD, DWORD, PWSTR, size_t, DWORD); +typedef BOOL (WINAPI* PSYMBOLSERVERISSTORE)(PCSTR); +typedef BOOL (WINAPI* PSYMBOLSERVERISSTOREW)(PCWSTR); +typedef DWORD (WINAPI* PSYMBOLSERVERVERSION)(); +typedef BOOL (CALLBACK WINAPI* PSYMBOLSERVERMESSAGEPROC)(UINT_PTR action, ULONG64 data, ULONG64 context); + +#define SYMSRV_VERSION 2 + +#define SSRVOPT_CALLBACK 0x00000001 +#define SSRVOPT_DWORD 0x00000002 +#define SSRVOPT_DWORDPTR 0x00000004 +#define SSRVOPT_GUIDPTR 0x00000008 +#define SSRVOPT_OLDGUIDPTR 0x00000010 +#define SSRVOPT_UNATTENDED 0x00000020 +#define SSRVOPT_NOCOPY 0x00000040 +#define SSRVOPT_GETPATH 0x00000040 +#define SSRVOPT_PARENTWIN 0x00000080 +#define SSRVOPT_PARAMTYPE 0x00000100 +#define SSRVOPT_SECURE 0x00000200 +#define SSRVOPT_TRACE 0x00000400 +#define SSRVOPT_SETCONTEXT 0x00000800 +#define SSRVOPT_PROXY 0x00001000 +#define SSRVOPT_DOWNSTREAM_STORE 0x00002000 +#define SSRVOPT_OVERWRITE 0x00004000 +#define SSRVOPT_RESETTOU 0x00008000 +#define SSRVOPT_CALLBACKW 0x00010000 +#define SSRVOPT_FLAT_DEFAULT_STORE 0x00020000 +#define SSRVOPT_PROXYW 0x00040000 +#define SSRVOPT_MESSAGE 0x00080000 +#define SSRVOPT_SERVICE 0x00100000 // deprecated +#define SSRVOPT_FAVOR_COMPRESSED 0x00200000 +#define SSRVOPT_STRING 0x00400000 +#define SSRVOPT_WINHTTP 0x00800000 +#define SSRVOPT_WININET 0x01000000 + +#define SSRVOPT_MAX 0x0100000 + +#define SSRVOPT_RESET ((ULONG_PTR)-1) + + +#define NUM_SSRVOPTS 30 + +#define SSRVACTION_TRACE 1 +#define SSRVACTION_QUERYCANCEL 2 +#define SSRVACTION_EVENT 3 +#define SSRVACTION_EVENTW 4 +#define SSRVACTION_SIZE 5 + +#define SYMSTOREOPT_COMPRESS 0x01 +#define SYMSTOREOPT_OVERWRITE 0x02 +#define SYMSTOREOPT_RETURNINDEX 0x04 +#define SYMSTOREOPT_POINTER 0x08 +#define SYMSTOREOPT_ALT_INDEX 0x10 +#define SYMSTOREOPT_UNICODE 0x20 +#define SYMSTOREOPT_PASS_IF_EXISTS 0x40 + +#ifdef DBGHELP_TRANSLATE_TCHAR +#define SymInitialize SymInitializeW +#define SymAddSymbol SymAddSymbolW +#define SymDeleteSymbol SymDeleteSymbolW +#define SearchTreeForFile SearchTreeForFileW +#define UnDecorateSymbolName UnDecorateSymbolNameW +#define SymGetLineFromName64 SymGetLineFromNameW64 +#define SymGetLineFromAddr64 SymGetLineFromAddrW64 +#define SymGetLineNext64 SymGetLineNextW64 +#define SymGetLinePrev64 SymGetLinePrevW64 +#define SymFromName SymFromNameW +#define SymFindExecutableImage SymFindExecutableImageW +#define FindExecutableImageEx FindExecutableImageExW +#define SymSearch SymSearchW +#define SymEnumLines SymEnumLinesW +#define SymEnumSourceLines SymEnumSourceLinesW +#define SymGetTypeFromName SymGetTypeFromNameW +#define SymEnumSymbolsForAddr SymEnumSymbolsForAddrW +#define SymFromAddr SymFromAddrW +#define SymMatchString SymMatchStringW +#define SymEnumSourceFiles SymEnumSourceFilesW +#define SymEnumSymbols SymEnumSymbolsW +#define SymLoadModuleEx SymLoadModuleExW +#define SymSetSearchPath SymSetSearchPathW +#define SymGetSearchPath SymGetSearchPathW +#define EnumDirTree EnumDirTreeW +#define SymFromToken SymFromTokenW +#define SymFromIndex SymFromIndexW +#define SymGetScope SymGetScopeW +#define SymNext SymNextW +#define SymPrev SymPrevW +#define SymEnumTypes SymEnumTypesW +#define SymEnumTypesByName SymEnumTypesByNameW +#define SymRegisterCallback64 SymRegisterCallbackW64 +#define SymFindDebugInfoFile SymFindDebugInfoFileW +#define FindDebugInfoFileEx FindDebugInfoFileExW +#define SymFindFileInPath SymFindFileInPathW +#define SymEnumerateModules64 SymEnumerateModulesW64 +#define SymSetHomeDirectory SymSetHomeDirectoryW +#define SymGetHomeDirectory SymGetHomeDirectoryW +#define SymGetSourceFile SymGetSourceFileW +#define SymGetSourceFileToken SymGetSourceFileTokenW +#define SymGetSourceFileFromToken SymGetSourceFileFromTokenW +#define SymGetSourceVarFromToken SymGetSourceVarFromTokenW +#define SymGetSourceFileToken SymGetSourceFileTokenW +#define SymGetFileLineOffsets64 SymGetFileLineOffsetsW64 +#define SymFindFileInPath SymFindFileInPathW +#define SymMatchFileName SymMatchFileNameW +#define SymGetSourceFileFromToken SymGetSourceFileFromTokenW +#define SymGetSourceVarFromToken SymGetSourceVarFromTokenW +#define SymGetModuleInfo64 SymGetModuleInfoW64 +#define SymSrvIsStore SymSrvIsStoreW +#define SymSrvDeltaName SymSrvDeltaNameW +#define SymSrvGetSupplement SymSrvGetSupplementW +#define SymSrvStoreSupplement SymSrvStoreSupplementW +#define SymSrvGetFileIndexes SymSrvGetFileIndexes +#define SymSrvGetFileIndexString SymSrvGetFileIndexStringW +#define SymSrvStoreFile SymSrvStoreFileW +#define SymGetSymbolFile SymGetSymbolFileW +#define EnumerateLoadedModules64 EnumerateLoadedModulesW64 +#define EnumerateLoadedModulesEx EnumerateLoadedModulesExW +#define SymSrvGetFileIndexInfo SymSrvGetFileIndexInfoW + +#define IMAGEHLP_LINE64 IMAGEHLP_LINEW64 +#define PIMAGEHLP_LINE64 PIMAGEHLP_LINEW64 +#define SYMBOL_INFO SYMBOL_INFOW +#define PSYMBOL_INFO PSYMBOL_INFOW +#define SYMBOL_INFO_PACKAGE SYMBOL_INFO_PACKAGEW +#define PSYMBOL_INFO_PACKAGE PSYMBOL_INFO_PACKAGEW +#define FIND_EXE_FILE_CALLBACK FIND_EXE_FILE_CALLBACKW +#define PFIND_EXE_FILE_CALLBACK PFIND_EXE_FILE_CALLBACKW +#define SYM_ENUMERATESYMBOLS_CALLBACK SYM_ENUMERATESYMBOLS_CALLBACKW +#define PSYM_ENUMERATESYMBOLS_CALLBACK PSYM_ENUMERATESYMBOLS_CALLBACKW +#define SRCCODEINFO SRCCODEINFOW +#define PSRCCODEINFO PSRCCODEINFOW +#define SOURCEFILE SOURCEFILEW +#define PSOURCEFILE PSOURCEFILEW +#define SYM_ENUMSOURECFILES_CALLBACK SYM_ENUMSOURCEFILES_CALLBACKW +#define PSYM_ENUMSOURCEFILES_CALLBACK PSYM_ENUMSOURECFILES_CALLBACKW +#define IMAGEHLP_CBA_EVENT IMAGEHLP_CBA_EVENTW +#define PIMAGEHLP_CBA_EVENT PIMAGEHLP_CBA_EVENTW +#define PENUMDIRTREE_CALLBACK PENUMDIRTREE_CALLBACKW +#define IMAGEHLP_DEFERRED_SYMBOL_LOAD64 IMAGEHLP_DEFERRED_SYMBOL_LOADW64 +#define PIMAGEHLP_DEFERRED_SYMBOL_LOAD64 PIMAGEHLP_DEFERRED_SYMBOL_LOADW64 +#define PFIND_DEBUG_FILE_CALLBACK PFIND_DEBUG_FILE_CALLBACKW +#define PFINDFILEINPATHCALLBACK PFINDFILEINPATHCALLBACKW +#define IMAGEHLP_MODULE64 IMAGEHLP_MODULEW64 +#define PIMAGEHLP_MODULE64 PIMAGEHLP_MODULEW64 +#define SYMSRV_INDEX_INFO SYMSRV_INDEX_INFOW +#define PSYMSRV_INDEX_INFO PSYMSRV_INDEX_INFOW + +#define PSYMBOLSERVERPROC PSYMBOLSERVERPROCW +#define PSYMBOLSERVERPINGPROC PSYMBOLSERVERPINGPROCW +#endif + +// ----------------------------------------------------------------- +// The following APIs exist only for backwards compatibility +// with a pre-release version documented in an MSDN release. + +// You should use SymFindFileInPath if you want to maintain +// future compatibility. + +DBHLP_DEPRECIATED +BOOL +IMAGEAPI +FindFileInPath( + __in HANDLE hprocess, + __in PCSTR SearchPath, + __in PCSTR FileName, + __in PVOID id, + __in DWORD two, + __in DWORD three, + __in DWORD flags, + __out_ecount(MAX_PATH + 1) PSTR FilePath +); + +// You should use SymFindFileInPath if you want to maintain +// future compatibility. + +DBHLP_DEPRECIATED +BOOL +IMAGEAPI +FindFileInSearchPath( + __in HANDLE hprocess, + __in PCSTR SearchPath, + __in PCSTR FileName, + __in DWORD one, + __in DWORD two, + __in DWORD three, + __out_ecount(MAX_PATH + 1) PSTR FilePath +); + +DBHLP_DEPRECIATED +BOOL +IMAGEAPI +SymEnumSym( + __in HANDLE hProcess, + __in ULONG64 BaseOfDll, + __in PSYM_ENUMERATESYMBOLS_CALLBACK EnumSymbolsCallback, + __in_opt PVOID UserContext +); + +DBHLP_DEPRECIATED +BOOL +IMAGEAPI +SymEnumerateSymbols64( + __in HANDLE hProcess, + __in ULONG64 BaseOfDll, + __in PSYM_ENUMSYMBOLS_CALLBACK64 EnumSymbolsCallback, + __in_opt PVOID UserContext +); + +DBHLP_DEPRECIATED +BOOL +IMAGEAPI +SymEnumerateSymbolsW64( + __in HANDLE hProcess, + __in ULONG64 BaseOfDll, + __in PSYM_ENUMSYMBOLS_CALLBACK64W EnumSymbolsCallback, + __in_opt PVOID UserContext +); + + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define SymEnumerateSymbols SymEnumerateSymbols64 +#define SymEnumerateSymbolsW SymEnumerateSymbolsW64 +#else +DBHLP_DEPRECIATED +BOOL +IMAGEAPI +SymEnumerateSymbols( + __in HANDLE hProcess, + __in ULONG BaseOfDll, + __in PSYM_ENUMSYMBOLS_CALLBACK EnumSymbolsCallback, + __in_opt PVOID UserContext +); + +DBHLP_DEPRECIATED +BOOL +IMAGEAPI +SymEnumerateSymbolsW( + __in HANDLE hProcess, + __in ULONG BaseOfDll, + __in PSYM_ENUMSYMBOLS_CALLBACKW EnumSymbolsCallback, + __in_opt PVOID UserContext +); +#endif + +// use SymLoadModuleEx + +DWORD64 +IMAGEAPI +SymLoadModule64( + __in HANDLE hProcess, + __in_opt HANDLE hFile, + __in_opt PCSTR ImageName, + __in_opt PCSTR ModuleName, + __in DWORD64 BaseOfDll, + __in DWORD SizeOfDll +); + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define SymLoadModule SymLoadModule64 +#else +DWORD +IMAGEAPI +SymLoadModule( + __in HANDLE hProcess, + __in_opt HANDLE hFile, + __in_opt PCSTR ImageName, + __in_opt PCSTR ModuleName, + __in DWORD BaseOfDll, + __in DWORD SizeOfDll +); +#endif + +BOOL +IMAGEAPI +SymGetSymNext64( + __in HANDLE hProcess, + __inout PIMAGEHLP_SYMBOL64 Symbol +); + +BOOL +IMAGEAPI +SymGetSymNextW64( + __in HANDLE hProcess, + __inout PIMAGEHLP_SYMBOLW64 Symbol +); + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define SymGetSymNext SymGetSymNext64 +#define SymGetSymNextW SymGetSymNextW64 +#else +BOOL +IMAGEAPI +SymGetSymNext( + __in HANDLE hProcess, + __inout PIMAGEHLP_SYMBOL Symbol +); + +BOOL +IMAGEAPI +SymGetSymNextW( + __in HANDLE hProcess, + __inout PIMAGEHLP_SYMBOLW Symbol +); +#endif + +BOOL +IMAGEAPI +SymGetSymPrev64( + __in HANDLE hProcess, + __inout PIMAGEHLP_SYMBOL64 Symbol +); + +BOOL +IMAGEAPI +SymGetSymPrevW64( + __in HANDLE hProcess, + __inout PIMAGEHLP_SYMBOLW64 Symbol +); + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define SymGetSymPrev SymGetSymPrev64 +#define SymGetSymPrevW SymGetSymPrevW64 +#else +BOOL +IMAGEAPI +SymGetSymPrev( + __in HANDLE hProcess, + __inout PIMAGEHLP_SYMBOL Symbol +); + +BOOL +IMAGEAPI +SymGetSymPrevW( + __in HANDLE hProcess, + __inout PIMAGEHLP_SYMBOLW Symbol +); +#endif + + +// These values should not be used. +// They have been replaced by SYMFLAG_ values. + +#define SYMF_OMAP_GENERATED 0x00000001 +#define SYMF_OMAP_MODIFIED 0x00000002 +#define SYMF_REGISTER 0x00000008 +#define SYMF_REGREL 0x00000010 +#define SYMF_FRAMEREL 0x00000020 +#define SYMF_PARAMETER 0x00000040 +#define SYMF_LOCAL 0x00000080 +#define SYMF_CONSTANT 0x00000100 +#define SYMF_EXPORT 0x00000200 +#define SYMF_FORWARDER 0x00000400 +#define SYMF_FUNCTION 0x00000800 +#define SYMF_VIRTUAL 0x00001000 +#define SYMF_THUNK 0x00002000 +#define SYMF_TLSREL 0x00004000 + +// These values should also not be used. +// They have been replaced by SYMFLAG_ values. + +#define IMAGEHLP_SYMBOL_INFO_VALUEPRESENT 1 +#define IMAGEHLP_SYMBOL_INFO_REGISTER SYMF_REGISTER // 0x0008 +#define IMAGEHLP_SYMBOL_INFO_REGRELATIVE SYMF_REGREL // 0x0010 +#define IMAGEHLP_SYMBOL_INFO_FRAMERELATIVE SYMF_FRAMEREL // 0x0020 +#define IMAGEHLP_SYMBOL_INFO_PARAMETER SYMF_PARAMETER // 0x0040 +#define IMAGEHLP_SYMBOL_INFO_LOCAL SYMF_LOCAL // 0x0080 +#define IMAGEHLP_SYMBOL_INFO_CONSTANT SYMF_CONSTANT // 0x0100 +#define IMAGEHLP_SYMBOL_FUNCTION SYMF_FUNCTION // 0x0800 +#define IMAGEHLP_SYMBOL_VIRTUAL SYMF_VIRTUAL // 0x1000 +#define IMAGEHLP_SYMBOL_THUNK SYMF_THUNK // 0x2000 +#define IMAGEHLP_SYMBOL_INFO_TLSRELATIVE SYMF_TLSREL // 0x4000 + +#pragma pack(pop) + + +#pragma pack(push,4) + +#define MINIDUMP_SIGNATURE ('PMDM') +#define MINIDUMP_VERSION (42899) +typedef DWORD RVA; +typedef ULONG64 RVA64; + +typedef struct _MINIDUMP_LOCATION_DESCRIPTOR +{ + ULONG32 DataSize; + RVA Rva; +} MINIDUMP_LOCATION_DESCRIPTOR; + +typedef struct _MINIDUMP_LOCATION_DESCRIPTOR64 +{ + ULONG64 DataSize; + RVA64 Rva; +} MINIDUMP_LOCATION_DESCRIPTOR64; + + +typedef struct _MINIDUMP_MEMORY_DESCRIPTOR +{ + ULONG64 StartOfMemoryRange; + MINIDUMP_LOCATION_DESCRIPTOR Memory; +} MINIDUMP_MEMORY_DESCRIPTOR, *PMINIDUMP_MEMORY_DESCRIPTOR; + +// DESCRIPTOR64 is used for full-memory minidumps where +// all of the raw memory is laid out sequentially at the +// end of the dump. There is no need for individual RVAs +// as the RVA is the base RVA plus the sum of the preceeding +// data blocks. +typedef struct _MINIDUMP_MEMORY_DESCRIPTOR64 +{ + ULONG64 StartOfMemoryRange; + ULONG64 DataSize; +} MINIDUMP_MEMORY_DESCRIPTOR64, *PMINIDUMP_MEMORY_DESCRIPTOR64; + + +typedef struct _MINIDUMP_HEADER +{ + ULONG32 Signature; + ULONG32 Version; + ULONG32 NumberOfStreams; + RVA StreamDirectoryRva; + ULONG32 CheckSum; + union + { + ULONG32 Reserved; + ULONG32 TimeDateStamp; + }; + ULONG64 Flags; +} MINIDUMP_HEADER, *PMINIDUMP_HEADER; + +// +// The MINIDUMP_HEADER field StreamDirectoryRva points to +// an array of MINIDUMP_DIRECTORY structures. +// + +typedef struct _MINIDUMP_DIRECTORY +{ + ULONG32 StreamType; + MINIDUMP_LOCATION_DESCRIPTOR Location; +} MINIDUMP_DIRECTORY, *PMINIDUMP_DIRECTORY; + + +typedef struct _MINIDUMP_STRING +{ + ULONG32 Length; // Length in bytes of the string + WCHAR Buffer [0]; // Variable size buffer +} MINIDUMP_STRING, *PMINIDUMP_STRING; + + + +// +// The MINIDUMP_DIRECTORY field StreamType may be one of the following types. +// Types will be added in the future, so if a program reading the minidump +// header encounters a stream type it does not understand it should ignore +// the data altogether. Any tag above LastReservedStream will not be used by +// the system and is reserved for program-specific information. +// + +typedef enum _MINIDUMP_STREAM_TYPE +{ + + UnusedStream = 0, + ReservedStream0 = 1, + ReservedStream1 = 2, + ThreadListStream = 3, + ModuleListStream = 4, + MemoryListStream = 5, + ExceptionStream = 6, + SystemInfoStream = 7, + ThreadExListStream = 8, + Memory64ListStream = 9, + CommentStreamA = 10, + CommentStreamW = 11, + HandleDataStream = 12, + FunctionTableStream = 13, + UnloadedModuleListStream = 14, + MiscInfoStream = 15, + MemoryInfoListStream = 16, + ThreadInfoListStream = 17, + HandleOperationListStream = 18, + TokenStream = 19, + + ceStreamNull = 0x8000, + ceStreamSystemInfo = 0x8001, + ceStreamException = 0x8002, + ceStreamModuleList = 0x8003, + ceStreamProcessList = 0x8004, + ceStreamThreadList = 0x8005, + ceStreamThreadContextList = 0x8006, + ceStreamThreadCallStackList = 0x8007, + ceStreamMemoryVirtualList = 0x8008, + ceStreamMemoryPhysicalList = 0x8009, + ceStreamBucketParameters = 0x800A, + ceStreamProcessModuleMap = 0x800B, + ceStreamDiagnosisList = 0x800C, + + LastReservedStream = 0xffff + +} MINIDUMP_STREAM_TYPE; + + +// +// The minidump system information contains processor and +// Operating System specific information. +// + +// +// CPU information is obtained from one of two places. +// +// 1) On x86 computers, CPU_INFORMATION is obtained from the CPUID +// instruction. You must use the X86 portion of the union for X86 +// computers. +// +// 2) On non-x86 architectures, CPU_INFORMATION is obtained by calling +// IsProcessorFeatureSupported(). +// + +typedef union _CPU_INFORMATION +{ + + // + // X86 platforms use CPUID function to obtain processor information. + // + + struct + { + + // + // CPUID Subfunction 0, register EAX (VendorId [0]), + // EBX (VendorId [1]) and ECX (VendorId [2]). + // + + ULONG32 VendorId [ 3 ]; + + // + // CPUID Subfunction 1, register EAX + // + + ULONG32 VersionInformation; + + // + // CPUID Subfunction 1, register EDX + // + + ULONG32 FeatureInformation; + + + // + // CPUID, Subfunction 80000001, register EBX. This will only + // be obtained if the vendor id is "AuthenticAMD". + // + + ULONG32 AMDExtendedCpuFeatures; + + } X86CpuInfo; + + // + // Non-x86 platforms use processor feature flags. + // + + struct + { + + ULONG64 ProcessorFeatures [ 2 ]; + + } OtherCpuInfo; + +} CPU_INFORMATION, *PCPU_INFORMATION; + +typedef struct _MINIDUMP_SYSTEM_INFO +{ + + // + // ProcessorArchitecture, ProcessorLevel and ProcessorRevision are all + // taken from the SYSTEM_INFO structure obtained by GetSystemInfo( ). + // + + USHORT ProcessorArchitecture; + USHORT ProcessorLevel; + USHORT ProcessorRevision; + + union + { + USHORT Reserved0; + struct + { + UCHAR NumberOfProcessors; + UCHAR ProductType; + }; + }; + + // + // MajorVersion, MinorVersion, BuildNumber, PlatformId and + // CSDVersion are all taken from the OSVERSIONINFO structure + // returned by GetVersionEx( ). + // + + ULONG32 MajorVersion; + ULONG32 MinorVersion; + ULONG32 BuildNumber; + ULONG32 PlatformId; + + // + // RVA to a CSDVersion string in the string table. + // + + RVA CSDVersionRva; + + union + { + ULONG32 Reserved1; + struct + { + USHORT SuiteMask; + USHORT Reserved2; + }; + }; + + CPU_INFORMATION Cpu; + +} MINIDUMP_SYSTEM_INFO, *PMINIDUMP_SYSTEM_INFO; + + +// +// The minidump thread contains standard thread +// information plus an RVA to the memory for this +// thread and an RVA to the CONTEXT structure for +// this thread. +// + + +// +// ThreadId must be 4 bytes on all architectures. +// + +C_ASSERT(sizeof(((PPROCESS_INFORMATION)0)->dwThreadId) == 4); + +typedef struct _MINIDUMP_THREAD +{ + ULONG32 ThreadId; + ULONG32 SuspendCount; + ULONG32 PriorityClass; + ULONG32 Priority; + ULONG64 Teb; + MINIDUMP_MEMORY_DESCRIPTOR Stack; + MINIDUMP_LOCATION_DESCRIPTOR ThreadContext; +} MINIDUMP_THREAD, *PMINIDUMP_THREAD; + +// +// The thread list is a container of threads. +// + +typedef struct _MINIDUMP_THREAD_LIST +{ + ULONG32 NumberOfThreads; + MINIDUMP_THREAD Threads [0]; +} MINIDUMP_THREAD_LIST, *PMINIDUMP_THREAD_LIST; + + +typedef struct _MINIDUMP_THREAD_EX +{ + ULONG32 ThreadId; + ULONG32 SuspendCount; + ULONG32 PriorityClass; + ULONG32 Priority; + ULONG64 Teb; + MINIDUMP_MEMORY_DESCRIPTOR Stack; + MINIDUMP_LOCATION_DESCRIPTOR ThreadContext; + MINIDUMP_MEMORY_DESCRIPTOR BackingStore; +} MINIDUMP_THREAD_EX, *PMINIDUMP_THREAD_EX; + +// +// The thread list is a container of threads. +// + +typedef struct _MINIDUMP_THREAD_EX_LIST +{ + ULONG32 NumberOfThreads; + MINIDUMP_THREAD_EX Threads [0]; +} MINIDUMP_THREAD_EX_LIST, *PMINIDUMP_THREAD_EX_LIST; + + +// +// The MINIDUMP_EXCEPTION is the same as EXCEPTION on Win64. +// + +typedef struct _MINIDUMP_EXCEPTION +{ + ULONG32 ExceptionCode; + ULONG32 ExceptionFlags; + ULONG64 ExceptionRecord; + ULONG64 ExceptionAddress; + ULONG32 NumberParameters; + ULONG32 __unusedAlignment; + ULONG64 ExceptionInformation [ EXCEPTION_MAXIMUM_PARAMETERS ]; +} MINIDUMP_EXCEPTION, *PMINIDUMP_EXCEPTION; + + +// +// The exception information stream contains the id of the thread that caused +// the exception (ThreadId), the exception record for the exception +// (ExceptionRecord) and an RVA to the thread context where the exception +// occured. +// + +typedef struct MINIDUMP_EXCEPTION_STREAM +{ + ULONG32 ThreadId; + ULONG32 __alignment; + MINIDUMP_EXCEPTION ExceptionRecord; + MINIDUMP_LOCATION_DESCRIPTOR ThreadContext; +} MINIDUMP_EXCEPTION_STREAM, *PMINIDUMP_EXCEPTION_STREAM; + + +// +// The MINIDUMP_MODULE contains information about a +// a specific module. It includes the CheckSum and +// the TimeDateStamp for the module so the module +// can be reloaded during the analysis phase. +// + +typedef struct _MINIDUMP_MODULE +{ + ULONG64 BaseOfImage; + ULONG32 SizeOfImage; + ULONG32 CheckSum; + ULONG32 TimeDateStamp; + RVA ModuleNameRva; + VS_FIXEDFILEINFO VersionInfo; + MINIDUMP_LOCATION_DESCRIPTOR CvRecord; + MINIDUMP_LOCATION_DESCRIPTOR MiscRecord; + ULONG64 Reserved0; // Reserved for future use. + ULONG64 Reserved1; // Reserved for future use. +} MINIDUMP_MODULE, *PMINIDUMP_MODULE; + + +// +// The minidump module list is a container for modules. +// + +typedef struct _MINIDUMP_MODULE_LIST +{ + ULONG32 NumberOfModules; + MINIDUMP_MODULE Modules [ 0 ]; +} MINIDUMP_MODULE_LIST, *PMINIDUMP_MODULE_LIST; + + +// +// Memory Ranges +// + +typedef struct _MINIDUMP_MEMORY_LIST +{ + ULONG32 NumberOfMemoryRanges; + MINIDUMP_MEMORY_DESCRIPTOR MemoryRanges [0]; +} MINIDUMP_MEMORY_LIST, *PMINIDUMP_MEMORY_LIST; + +typedef struct _MINIDUMP_MEMORY64_LIST +{ + ULONG64 NumberOfMemoryRanges; + RVA64 BaseRva; + MINIDUMP_MEMORY_DESCRIPTOR64 MemoryRanges [0]; +} MINIDUMP_MEMORY64_LIST, *PMINIDUMP_MEMORY64_LIST; + + +// +// Support for user supplied exception information. +// + +typedef struct _MINIDUMP_EXCEPTION_INFORMATION +{ + DWORD ThreadId; + PEXCEPTION_POINTERS ExceptionPointers; + BOOL ClientPointers; +} MINIDUMP_EXCEPTION_INFORMATION, *PMINIDUMP_EXCEPTION_INFORMATION; + +typedef struct _MINIDUMP_EXCEPTION_INFORMATION64 +{ + DWORD ThreadId; + ULONG64 ExceptionRecord; + ULONG64 ContextRecord; + BOOL ClientPointers; +} MINIDUMP_EXCEPTION_INFORMATION64, *PMINIDUMP_EXCEPTION_INFORMATION64; + + +// +// Support for capturing system handle state at the time of the dump. +// + +// Per-handle object information varies according to +// the OS, the OS version, the processor type and +// so on. The minidump gives a minidump identifier +// to each possible data format for identification +// purposes but does not control nor describe the actual data. +typedef enum _MINIDUMP_HANDLE_OBJECT_INFORMATION_TYPE +{ + MiniHandleObjectInformationNone, + MiniThreadInformation1, + MiniMutantInformation1, + MiniMutantInformation2, + MiniProcessInformation1, + MiniProcessInformation2, + MiniHandleObjectInformationTypeMax +} MINIDUMP_HANDLE_OBJECT_INFORMATION_TYPE; + +typedef struct _MINIDUMP_HANDLE_OBJECT_INFORMATION +{ + RVA NextInfoRva; + ULONG32 InfoType; + ULONG32 SizeOfInfo; + // Raw information follows. +} MINIDUMP_HANDLE_OBJECT_INFORMATION; + +typedef struct _MINIDUMP_HANDLE_DESCRIPTOR +{ + ULONG64 Handle; + RVA TypeNameRva; + RVA ObjectNameRva; + ULONG32 Attributes; + ULONG32 GrantedAccess; + ULONG32 HandleCount; + ULONG32 PointerCount; +} MINIDUMP_HANDLE_DESCRIPTOR, *PMINIDUMP_HANDLE_DESCRIPTOR; + +typedef struct _MINIDUMP_HANDLE_DESCRIPTOR_2 +{ + ULONG64 Handle; + RVA TypeNameRva; + RVA ObjectNameRva; + ULONG32 Attributes; + ULONG32 GrantedAccess; + ULONG32 HandleCount; + ULONG32 PointerCount; + RVA ObjectInfoRva; + ULONG32 Reserved0; +} MINIDUMP_HANDLE_DESCRIPTOR_2, *PMINIDUMP_HANDLE_DESCRIPTOR_2; + +// The latest MINIDUMP_HANDLE_DESCRIPTOR definition. +typedef MINIDUMP_HANDLE_DESCRIPTOR_2 MINIDUMP_HANDLE_DESCRIPTOR_N; +typedef MINIDUMP_HANDLE_DESCRIPTOR_N* PMINIDUMP_HANDLE_DESCRIPTOR_N; + +typedef struct _MINIDUMP_HANDLE_DATA_STREAM +{ + ULONG32 SizeOfHeader; + ULONG32 SizeOfDescriptor; + ULONG32 NumberOfDescriptors; + ULONG32 Reserved; +} MINIDUMP_HANDLE_DATA_STREAM, *PMINIDUMP_HANDLE_DATA_STREAM; + +// Some operating systems can track the last operations +// performed on a handle. For example, Application Verifier +// can enable this for some versions of Windows. The +// handle operation list collects handle operations +// known for the dump target. +// Each entry is an AVRF_HANDLE_OPERATION. +typedef struct _MINIDUMP_HANDLE_OPERATION_LIST +{ + ULONG32 SizeOfHeader; + ULONG32 SizeOfEntry; + ULONG32 NumberOfEntries; + ULONG32 Reserved; +} MINIDUMP_HANDLE_OPERATION_LIST, *PMINIDUMP_HANDLE_OPERATION_LIST; + + +// +// Support for capturing dynamic function table state at the time of the dump. +// + +typedef struct _MINIDUMP_FUNCTION_TABLE_DESCRIPTOR +{ + ULONG64 MinimumAddress; + ULONG64 MaximumAddress; + ULONG64 BaseAddress; + ULONG32 EntryCount; + ULONG32 SizeOfAlignPad; +} MINIDUMP_FUNCTION_TABLE_DESCRIPTOR, *PMINIDUMP_FUNCTION_TABLE_DESCRIPTOR; + +typedef struct _MINIDUMP_FUNCTION_TABLE_STREAM +{ + ULONG32 SizeOfHeader; + ULONG32 SizeOfDescriptor; + ULONG32 SizeOfNativeDescriptor; + ULONG32 SizeOfFunctionEntry; + ULONG32 NumberOfDescriptors; + ULONG32 SizeOfAlignPad; +} MINIDUMP_FUNCTION_TABLE_STREAM, *PMINIDUMP_FUNCTION_TABLE_STREAM; + + +// +// The MINIDUMP_UNLOADED_MODULE contains information about a +// a specific module that was previously loaded but no +// longer is. This can help with diagnosing problems where +// callers attempt to call code that is no longer loaded. +// + +typedef struct _MINIDUMP_UNLOADED_MODULE +{ + ULONG64 BaseOfImage; + ULONG32 SizeOfImage; + ULONG32 CheckSum; + ULONG32 TimeDateStamp; + RVA ModuleNameRva; +} MINIDUMP_UNLOADED_MODULE, *PMINIDUMP_UNLOADED_MODULE; + + +// +// The minidump unloaded module list is a container for unloaded modules. +// + +typedef struct _MINIDUMP_UNLOADED_MODULE_LIST +{ + ULONG32 SizeOfHeader; + ULONG32 SizeOfEntry; + ULONG32 NumberOfEntries; +} MINIDUMP_UNLOADED_MODULE_LIST, *PMINIDUMP_UNLOADED_MODULE_LIST; + + +// +// The miscellaneous information stream contains a variety +// of small pieces of information. A member is valid if +// it's within the available size and its corresponding +// bit is set. +// + +#define MINIDUMP_MISC1_PROCESS_ID 0x00000001 +#define MINIDUMP_MISC1_PROCESS_TIMES 0x00000002 +#define MINIDUMP_MISC1_PROCESSOR_POWER_INFO 0x00000004 +#define MINIDUMP_MISC3_PROCESS_INTEGRITY 0x00000010 +#define MINIDUMP_MISC3_PROCESS_EXECUTE_FLAGS 0x00000020 +#define MINIDUMP_MISC3_TIMEZONE 0x00000040 +#define MINIDUMP_MISC3_PROTECTED_PROCESS 0x00000080 + +typedef struct _MINIDUMP_MISC_INFO +{ + ULONG32 SizeOfInfo; + ULONG32 Flags1; + ULONG32 ProcessId; + ULONG32 ProcessCreateTime; + ULONG32 ProcessUserTime; + ULONG32 ProcessKernelTime; +} MINIDUMP_MISC_INFO, *PMINIDUMP_MISC_INFO; + +typedef struct _MINIDUMP_MISC_INFO_2 +{ + ULONG32 SizeOfInfo; + ULONG32 Flags1; + ULONG32 ProcessId; + ULONG32 ProcessCreateTime; + ULONG32 ProcessUserTime; + ULONG32 ProcessKernelTime; + ULONG32 ProcessorMaxMhz; + ULONG32 ProcessorCurrentMhz; + ULONG32 ProcessorMhzLimit; + ULONG32 ProcessorMaxIdleState; + ULONG32 ProcessorCurrentIdleState; +} MINIDUMP_MISC_INFO_2, *PMINIDUMP_MISC_INFO_2; + +typedef struct _MINIDUMP_MISC_INFO_3 +{ + ULONG32 SizeOfInfo; + ULONG32 Flags1; + ULONG32 ProcessId; + ULONG32 ProcessCreateTime; + ULONG32 ProcessUserTime; + ULONG32 ProcessKernelTime; + ULONG32 ProcessorMaxMhz; + ULONG32 ProcessorCurrentMhz; + ULONG32 ProcessorMhzLimit; + ULONG32 ProcessorMaxIdleState; + ULONG32 ProcessorCurrentIdleState; + ULONG32 ProcessIntegrityLevel; + ULONG32 ProcessExecuteFlags; + ULONG32 ProtectedProcess; + ULONG32 TimeZoneId; + TIME_ZONE_INFORMATION TimeZone; +} MINIDUMP_MISC_INFO_3, *PMINIDUMP_MISC_INFO_3; + +// The latest MINIDUMP_MISC_INFO definition. +typedef MINIDUMP_MISC_INFO_3 MINIDUMP_MISC_INFO_N; +typedef MINIDUMP_MISC_INFO_N* PMINIDUMP_MISC_INFO_N; + + +// +// The memory information stream contains memory region +// description information. This stream corresponds to +// what VirtualQuery would return for the process the +// dump was created for. +// + +typedef struct _MINIDUMP_MEMORY_INFO +{ + ULONG64 BaseAddress; + ULONG64 AllocationBase; + ULONG32 AllocationProtect; + ULONG32 __alignment1; + ULONG64 RegionSize; + ULONG32 State; + ULONG32 Protect; + ULONG32 Type; + ULONG32 __alignment2; +} MINIDUMP_MEMORY_INFO, *PMINIDUMP_MEMORY_INFO; + +typedef struct _MINIDUMP_MEMORY_INFO_LIST +{ + ULONG SizeOfHeader; + ULONG SizeOfEntry; + ULONG64 NumberOfEntries; +} MINIDUMP_MEMORY_INFO_LIST, *PMINIDUMP_MEMORY_INFO_LIST; + + +// +// The memory information stream contains memory region +// description information. This stream corresponds to +// what VirtualQuery would return for the process the +// dump was created for. +// + +// Thread dump writer status flags. +#define MINIDUMP_THREAD_INFO_ERROR_THREAD 0x00000001 +#define MINIDUMP_THREAD_INFO_WRITING_THREAD 0x00000002 +#define MINIDUMP_THREAD_INFO_EXITED_THREAD 0x00000004 +#define MINIDUMP_THREAD_INFO_INVALID_INFO 0x00000008 +#define MINIDUMP_THREAD_INFO_INVALID_CONTEXT 0x00000010 +#define MINIDUMP_THREAD_INFO_INVALID_TEB 0x00000020 + +typedef struct _MINIDUMP_THREAD_INFO +{ + ULONG32 ThreadId; + ULONG32 DumpFlags; + ULONG32 DumpError; + ULONG32 ExitStatus; + ULONG64 CreateTime; + ULONG64 ExitTime; + ULONG64 KernelTime; + ULONG64 UserTime; + ULONG64 StartAddress; + ULONG64 Affinity; +} MINIDUMP_THREAD_INFO, *PMINIDUMP_THREAD_INFO; + +typedef struct _MINIDUMP_THREAD_INFO_LIST +{ + ULONG SizeOfHeader; + ULONG SizeOfEntry; + ULONG NumberOfEntries; +} MINIDUMP_THREAD_INFO_LIST, *PMINIDUMP_THREAD_INFO_LIST; + +// +// Support for token information. +// +typedef struct _MINIDUMP_TOKEN_INFO_HEADER +{ + ULONG TokenSize; // The size of the token structure. + ULONG TokenId; // The PID in NtOpenProcessToken() call or TID in NtOpenThreadToken() call. + ULONG64 TokenHandle; // The handle value returned. +} MINIDUMP_TOKEN_INFO_HEADER, *PMINIDUMP_TOKEN_INFO_HEADER; + +typedef struct _MINIDUMP_TOKEN_INFO_LIST +{ + ULONG TokenListSize; + ULONG TokenListEntries; + ULONG ListHeaderSize; + ULONG ElementHeaderSize; +} MINIDUMP_TOKEN_INFO_LIST, *PMINIDUMP_TOKEN_INFO_LIST; + +// +// Support for arbitrary user-defined information. +// + +typedef struct _MINIDUMP_USER_RECORD +{ + ULONG32 Type; + MINIDUMP_LOCATION_DESCRIPTOR Memory; +} MINIDUMP_USER_RECORD, *PMINIDUMP_USER_RECORD; + + +typedef struct _MINIDUMP_USER_STREAM +{ + ULONG32 Type; + ULONG BufferSize; + PVOID Buffer; + +} MINIDUMP_USER_STREAM, *PMINIDUMP_USER_STREAM; + + +typedef struct _MINIDUMP_USER_STREAM_INFORMATION +{ + ULONG UserStreamCount; + PMINIDUMP_USER_STREAM UserStreamArray; +} MINIDUMP_USER_STREAM_INFORMATION, *PMINIDUMP_USER_STREAM_INFORMATION; + +// +// Callback support. +// + +typedef enum _MINIDUMP_CALLBACK_TYPE +{ + ModuleCallback, + ThreadCallback, + ThreadExCallback, + IncludeThreadCallback, + IncludeModuleCallback, + MemoryCallback, + CancelCallback, + WriteKernelMinidumpCallback, + KernelMinidumpStatusCallback, + RemoveMemoryCallback, + IncludeVmRegionCallback, + IoStartCallback, + IoWriteAllCallback, + IoFinishCallback, + ReadMemoryFailureCallback, + SecondaryFlagsCallback, +} MINIDUMP_CALLBACK_TYPE; + + +typedef struct _MINIDUMP_THREAD_CALLBACK +{ + ULONG ThreadId; + HANDLE ThreadHandle; + CONTEXT Context; + ULONG SizeOfContext; + ULONG64 StackBase; + ULONG64 StackEnd; +} MINIDUMP_THREAD_CALLBACK, *PMINIDUMP_THREAD_CALLBACK; + + +typedef struct _MINIDUMP_THREAD_EX_CALLBACK +{ + ULONG ThreadId; + HANDLE ThreadHandle; + CONTEXT Context; + ULONG SizeOfContext; + ULONG64 StackBase; + ULONG64 StackEnd; + ULONG64 BackingStoreBase; + ULONG64 BackingStoreEnd; +} MINIDUMP_THREAD_EX_CALLBACK, *PMINIDUMP_THREAD_EX_CALLBACK; + + +typedef struct _MINIDUMP_INCLUDE_THREAD_CALLBACK +{ + ULONG ThreadId; +} MINIDUMP_INCLUDE_THREAD_CALLBACK, *PMINIDUMP_INCLUDE_THREAD_CALLBACK; + + +typedef enum _THREAD_WRITE_FLAGS +{ + ThreadWriteThread = 0x0001, + ThreadWriteStack = 0x0002, + ThreadWriteContext = 0x0004, + ThreadWriteBackingStore = 0x0008, + ThreadWriteInstructionWindow = 0x0010, + ThreadWriteThreadData = 0x0020, + ThreadWriteThreadInfo = 0x0040, +} THREAD_WRITE_FLAGS; + +typedef struct _MINIDUMP_MODULE_CALLBACK +{ + PWCHAR FullPath; + ULONG64 BaseOfImage; + ULONG SizeOfImage; + ULONG CheckSum; + ULONG TimeDateStamp; + VS_FIXEDFILEINFO VersionInfo; + PVOID CvRecord; + ULONG SizeOfCvRecord; + PVOID MiscRecord; + ULONG SizeOfMiscRecord; +} MINIDUMP_MODULE_CALLBACK, *PMINIDUMP_MODULE_CALLBACK; + + +typedef struct _MINIDUMP_INCLUDE_MODULE_CALLBACK +{ + ULONG64 BaseOfImage; +} MINIDUMP_INCLUDE_MODULE_CALLBACK, *PMINIDUMP_INCLUDE_MODULE_CALLBACK; + + +typedef enum _MODULE_WRITE_FLAGS +{ + ModuleWriteModule = 0x0001, + ModuleWriteDataSeg = 0x0002, + ModuleWriteMiscRecord = 0x0004, + ModuleWriteCvRecord = 0x0008, + ModuleReferencedByMemory = 0x0010, + ModuleWriteTlsData = 0x0020, + ModuleWriteCodeSegs = 0x0040, +} MODULE_WRITE_FLAGS; + + +typedef struct _MINIDUMP_IO_CALLBACK +{ + HANDLE Handle; + ULONG64 Offset; + PVOID Buffer; + ULONG BufferBytes; +} MINIDUMP_IO_CALLBACK, *PMINIDUMP_IO_CALLBACK; + + +typedef struct _MINIDUMP_READ_MEMORY_FAILURE_CALLBACK +{ + ULONG64 Offset; + ULONG Bytes; + HRESULT FailureStatus; +} MINIDUMP_READ_MEMORY_FAILURE_CALLBACK, +*PMINIDUMP_READ_MEMORY_FAILURE_CALLBACK; + + +typedef struct _MINIDUMP_CALLBACK_INPUT +{ + ULONG ProcessId; + HANDLE ProcessHandle; + ULONG CallbackType; + union + { + HRESULT Status; + MINIDUMP_THREAD_CALLBACK Thread; + MINIDUMP_THREAD_EX_CALLBACK ThreadEx; + MINIDUMP_MODULE_CALLBACK Module; + MINIDUMP_INCLUDE_THREAD_CALLBACK IncludeThread; + MINIDUMP_INCLUDE_MODULE_CALLBACK IncludeModule; + MINIDUMP_IO_CALLBACK Io; + MINIDUMP_READ_MEMORY_FAILURE_CALLBACK ReadMemoryFailure; + ULONG SecondaryFlags; + }; +} MINIDUMP_CALLBACK_INPUT, *PMINIDUMP_CALLBACK_INPUT; + +typedef struct _MINIDUMP_CALLBACK_OUTPUT +{ + union + { + ULONG ModuleWriteFlags; + ULONG ThreadWriteFlags; + ULONG SecondaryFlags; + struct + { + ULONG64 MemoryBase; + ULONG MemorySize; + }; + struct + { + BOOL CheckCancel; + BOOL Cancel; + }; + HANDLE Handle; + struct + { + MINIDUMP_MEMORY_INFO VmRegion; + BOOL Continue; + }; + HRESULT Status; + }; +} MINIDUMP_CALLBACK_OUTPUT, *PMINIDUMP_CALLBACK_OUTPUT; + + +// +// A normal minidump contains just the information +// necessary to capture stack traces for all of the +// existing threads in a process. +// +// A minidump with data segments includes all of the data +// sections from loaded modules in order to capture +// global variable contents. This can make the dump much +// larger if many modules have global data. +// +// A minidump with full memory includes all of the accessible +// memory in the process and can be very large. A minidump +// with full memory always has the raw memory data at the end +// of the dump so that the initial structures in the dump can +// be mapped directly without having to include the raw +// memory information. +// +// Stack and backing store memory can be filtered to remove +// data unnecessary for stack walking. This can improve +// compression of stacks and also deletes data that may +// be private and should not be stored in a dump. +// Memory can also be scanned to see what modules are +// referenced by stack and backing store memory to allow +// omission of other modules to reduce dump size. +// In either of these modes the ModuleReferencedByMemory flag +// is set for all modules referenced before the base +// module callbacks occur. +// +// On some operating systems a list of modules that were +// recently unloaded is kept in addition to the currently +// loaded module list. This information can be saved in +// the dump if desired. +// +// Stack and backing store memory can be scanned for referenced +// pages in order to pick up data referenced by locals or other +// stack memory. This can increase the size of a dump significantly. +// +// Module paths may contain undesired information such as user names +// or other important directory names so they can be stripped. This +// option reduces the ability to locate the proper image later +// and should only be used in certain situations. +// +// Complete operating system per-process and per-thread information can +// be gathered and stored in the dump. +// +// The virtual address space can be scanned for various types +// of memory to be included in the dump. +// +// Code which is concerned with potentially private information +// getting into the minidump can set a flag that automatically +// modifies all existing and future flags to avoid placing +// unnecessary data in the dump. Basic data, such as stack +// information, will still be included but optional data, such +// as indirect memory, will not. +// +// When doing a full memory dump it's possible to store all +// of the enumerated memory region descriptive information +// in a memory information stream. +// +// Additional thread information beyond the basic thread +// structure can be collected if desired. +// +// A minidump with code segments includes all of the code +// and code-related sections from loaded modules in order +// to capture executable content. +// +// MiniDumpWithoutAuxiliaryState turns off any secondary, +// auxiliary-supported memory gathering. +// +// MiniDumpWithFullAuxiliaryState asks any present auxiliary +// data providers to include all of their state in the dump. +// The exact set of what is provided depends on the auxiliary. +// This can be quite large. +// + +typedef enum _MINIDUMP_TYPE +{ + MiniDumpNormal = 0x00000000, + MiniDumpWithDataSegs = 0x00000001, + MiniDumpWithFullMemory = 0x00000002, + MiniDumpWithHandleData = 0x00000004, + MiniDumpFilterMemory = 0x00000008, + MiniDumpScanMemory = 0x00000010, + MiniDumpWithUnloadedModules = 0x00000020, + MiniDumpWithIndirectlyReferencedMemory = 0x00000040, + MiniDumpFilterModulePaths = 0x00000080, + MiniDumpWithProcessThreadData = 0x00000100, + MiniDumpWithPrivateReadWriteMemory = 0x00000200, + MiniDumpWithoutOptionalData = 0x00000400, + MiniDumpWithFullMemoryInfo = 0x00000800, + MiniDumpWithThreadInfo = 0x00001000, + MiniDumpWithCodeSegs = 0x00002000, + MiniDumpWithoutAuxiliaryState = 0x00004000, + MiniDumpWithFullAuxiliaryState = 0x00008000, + MiniDumpWithPrivateWriteCopyMemory = 0x00010000, + MiniDumpIgnoreInaccessibleMemory = 0x00020000, + MiniDumpWithTokenInformation = 0x00040000, + MiniDumpValidTypeFlags = 0x0007ffff, +} MINIDUMP_TYPE; + +// +// In addition to the primary flags provided to +// MiniDumpWriteDump there are additional, less +// frequently used options queried via the secondary +// flags callback. +// +// MiniSecondaryWithoutPowerInfo suppresses the minidump +// query that retrieves processor power information for +// MINIDUMP_MISC_INFO. +// + +typedef enum _MINIDUMP_SECONDARY_FLAGS +{ + MiniSecondaryWithoutPowerInfo = 0x00000001, + + MiniSecondaryValidFlags = 0x00000001, +} MINIDUMP_SECONDARY_FLAGS; + + +// +// The minidump callback should modify the FieldsToWrite parameter to reflect +// what portions of the specified thread or module should be written to the +// file. +// + +typedef +BOOL +(WINAPI* MINIDUMP_CALLBACK_ROUTINE)( + __inout PVOID CallbackParam, + __in PMINIDUMP_CALLBACK_INPUT CallbackInput, + __inout PMINIDUMP_CALLBACK_OUTPUT CallbackOutput +); + +typedef struct _MINIDUMP_CALLBACK_INFORMATION +{ + MINIDUMP_CALLBACK_ROUTINE CallbackRoutine; + PVOID CallbackParam; +} MINIDUMP_CALLBACK_INFORMATION, *PMINIDUMP_CALLBACK_INFORMATION; + + + +//++ +// +// PVOID +// RVA_TO_ADDR( +// PVOID Mapping, +// ULONG Rva +// ) +// +// Routine Description: +// +// Map an RVA that is contained within a mapped file to it's associated +// flat address. +// +// Arguments: +// +// Mapping - Base address of mapped file containing the RVA. +// +// Rva - An Rva to fixup. +// +// Return Values: +// +// A pointer to the desired data. +// +//-- + +#define RVA_TO_ADDR(Mapping,Rva) ((PVOID)(((ULONG_PTR) (Mapping)) + (Rva))) + +BOOL +WINAPI +MiniDumpWriteDump( + __in HANDLE hProcess, + __in DWORD ProcessId, + __in HANDLE hFile, + __in MINIDUMP_TYPE DumpType, + __in_opt PMINIDUMP_EXCEPTION_INFORMATION ExceptionParam, + __in_opt PMINIDUMP_USER_STREAM_INFORMATION UserStreamParam, + __in_opt PMINIDUMP_CALLBACK_INFORMATION CallbackParam +); + +BOOL +WINAPI +MiniDumpReadDumpStream( + __in PVOID BaseOfDump, + __in ULONG StreamNumber, + __deref_out_opt PMINIDUMP_DIRECTORY* Dir, + __deref_out_opt PVOID* StreamPointer, + __out_opt ULONG* StreamSize +); + +#pragma pack(pop) + +#ifdef __cplusplus +} +#endif + + +#endif // _DBGHELP_ + diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/dbghelp/dbghelp_x64.a b/BranchTrace-x64plugin-wtl/pluginsdk/dbghelp/dbghelp_x64.a new file mode 100644 index 0000000000000000000000000000000000000000..feaab5eeaba2f17ca8d78ee762f076f5dfb4df62 GIT binary patch literal 162912 zcmeI550E8CdDwg334t!MKyV0z1+3%)$%=g1+uPl{Q-rubyQf>_?sVL(?#=@1?(N&z z+oyZ`-tykt)2>XELs1mr$U@i(U}77h*jQ08CJMHRZDIx6L@}6PunCD%E?4ZLs5nKH z%Py)+D4g%>uY0p=t$=J2Q5c3)nQMmoHjA3}|y%Y{WJ{TrHPT|hm7{f6Ac?w5PF^1vTwdm_fhEm1!EX4evHCun=uUU zx`Dz&f5aGucRxbmksXX-c=Q_--UIt#cpUb@@Lq_+@V;+TcnZ!D!v}tf!iV5oG5p+B z6h8bsV;G*kNZ}WuycnLTQF!(g0{f$n~*PtPd`WD z`QwaX_#M~}!)J#nyzq6#FnsP=3SU@Y48tGZMB&SjH-@h~Na4R<$ry$|`3QwS9c2u| zpF!PW`1AKu_}U@HFnk@#kKr#rLE#&4ZW#XR8VY~?0%I7y*`@HeP~RB-@8>Ce2g(Xz zXlRVWmcL*_7%qRB!WH+iAq-b;qj1#=YzV{E4^r5+oeg2Q<|`Dgg}g9acL#+x{0$qz zaQ$->wlAJf3b(?(7)B3J7{7)MVb~4lgyFUiQh3WTHiTgx?2F;R zvlOO|vmp$3ev86gA7MinjzSqQ9KVjji7&As4EH=i;S3xP!@b|3@MCbk7|y}DVramA z7_!e(Sa_HXVYmS0z_9o=3QNzhAq+j(2g60E8w@Mortsr%Obib_Md95uYzV_6ub}Yg z7ugVo_rQ5!c>D~7_d*^R-uHhfJoSDygy92F&lr9Nj*sDIAE)qPs2dDVUq#^;pnfs@ z(m4vxzKjiF_}IrO{L1}o2*Y#36h8UCK^;N(b*KXjztN}g=`l8h;kThY7(Vk`6n^g^ zHiY4Y+bMkRGB$+a4?aubi;u7&3}4aE>ITENAr8ZL;Cvy}hUO_;b``5( zxcoB|uIRHGhASs1T=hR#4a3#XP}p{Y)i7N1Eeh9uiq$Y&cag#yM_CQS^6y_lgL-QsI z7ygFTFtnei@Xp6r4MTr~!o{z!8iv)M$8h%S-0b; zNqgPKe6yAHWVHO-S?WWcbIXfM^|`sOh%E@!Un`z<7VGkm{AX*i*`AkW6Mx`K?1;ab z{Z4CcwX@ulsWd^e-D)Jp|hCHHRTD)fAdRyDdIop7Q}(zhiDBcptfO+g$t@$ z#h=+$r*T1~qu-~S?aA5mQ!D+f-D`H*ldaZtyV(~>N+R!RPiBoyx8BcAt}f1YTF0RI zPm5jLaW1K62L}1x({6R@b4NRK%dKo;OeD7D1&KQyh)hEjS6=yl{z;zBw*PfR9qo9^+mHuK7bl#}>t ze!4`<&=8Asjm}bbsM}eb=IZWXr`^w1q;~Npu_A#F^H?ftj4GtxuT;D%hGfU< zUA&Z=?YYhaM&3pQrM-Kp59(3gR7@HDI}Cbzvf0fVpea_(3M@o9(i?|2l8chLs!qyy ze%N%zQAv=;=|{jQ%=bigzS-+%-9yXm1{QCs-S4g*thZXTa0AvgjDe=6NTpm+O3i;(?NOvT+0;X29a+~5pI+dNC49`#f*BLRSMk-fMm=79B z&3dc(pnj*;g+>~ci%NpIzzy!6_5+}QOnq;PDc#KK65J%`J5!n#gmjwNOs5X1r4q-) zolq$k+DIf+F)BwXvvSQNC@p+~J&4VxH5KHm%Zn+EJXJz*t{_12_12>Ngf!2MUmrQ) zDvinquL(OJARpu2bS`A=Ld!Vf#WAcHvj}#yzMq2uz5~gNDN9cblZ!~_K8{n$cQI-JrQRwi zBq$y&-?!w5D!#a9$qw@DTs9ZBq$U?R<`OeUB^K$>Fe)@MiL`h#3yc=$W7#=yE>cGO z-wpj>%?`qNE>W=uu$OtD-qY@TB9)4v)O1Hhy=L6zA+;G}r8drAODjsDB!!E~h$!Y- zlBtm=7R#BZh|u%2s(_Bp#gy&{i~*qHDwbZCn<)#&mI*;@rZdVSQ)y{XrMZqO22P-;}Hc#3z= z&-b!^uh5WoEbJxwBQy2cR<^&<$a=hv6YVfnGDi?<(5rl-*Ik~_&93Z@ih zKq9d}{xNsw5)o@4qBQ_!Q;2izVPt(d9L;zVi8JCn z*w{G9_C}ky7w{-#pSP;D);W&jjaTG&p9>a`+^i%ES#Y~N-_6(KaigfLxj$!SAr6>yZ>(CMB z*rWUaM*eh@D=C8(sUJazo#&+D9D6v)(_JsIY9umg^?E-3XD zG*Drb%Mpirw6c18S^Cg40sKU=r`wIz@|-)zl6cw^KH)ObiUg^pOi!T-lPAEE;2+*F zFiw`$7Yq3qF?MQgysVJVen;Ns8E9Fvlj!6;U2k1bmz5^TW0i)Ku^`D~W%e?TQ7>|) zn`NLqkh{Eayw_+%SZQT$#iZ>LqXbmC%trgN&Ur;;KS ze-gX^aA+%$l=GCw`iG%fGU?VeW&B_6PT&LcGo8tLzit+%Bt_}o`Wd*5+?bf@iVrOp>Wx%Ns46&axN(r%lP{R({N} zM|pal+OXryGqR#E_kvK%y%=MqE=$X%q~~4%FVebV@Fv6!O=?%o8Y9cSJl-9n3SAyw z79&s7c}hUJd%s)(mPWfHyhr25g3AH*q12F=O)k>@Xc>uU1`{X_!)%y?aQEnE_w=$Z zSB@fKNu*Qk+l9@&v)AtL=;V`8%VweO92uFIfa#~>d&b1H)pJ|t9=)95Hax`G%lWUD zupQhL%m0*q4720scFcj+DNR8U``Gd4cg*&BYb0ZrFkKTf+&(7Lz6^d`2Ir-3``Cy~ zH!kIv?#l9XyJb3gY0_21{>lq8@quyab}Q43(zgb%O+K8N%AJH#`Pzn5M>F z2cPaaUdZ5ri@{NICbVR5V$5c60_yD*crbR^_nJYNflC`qyXFkOR#-1ySc z7&MAvbb~RVL89Ok&)4z69n;^I&|-DO^3de zAM{;NeOvi2n_s*FZ-Mw3!4ZB9vyng@3OY~I4g3&}k4s87<~k2+XABN@pLSfP(iu8* z52RUer_1@pa_oaNU3a<(d0JQxheaAGgAzagcW=UfPd=$+>epB0tWXePi{i1Um9Kzb zL*Q-nr#cK(V0Qrz!RXS5jc*zY8c^R?Aw`k|f7#5Z|q;qBr zuP>5Z4Zq}8V^{@bRmoYfjtR0`QKNDq#}koQcLY;@_umjA{~PPkoMbqD97L+~twyBS z-!)}h5jhr0Bt88!JdAcG>Btpm#23|RNa#KcRDnsQGAo6($f{jok>p1dVck7m`Xlj)pNgvCGzukHBfIr5)cvjmS%| zk=k)yJFZVVF1gcL+VMemx}3>ZLcI^lsV?x`=STL0F*?3?r=?RTN(qF6FDuZc1u%SI#R`m3IM^v=D(z8ZMI zf^TV#rRJZ^{fSlV#m_QY0XGgB>0CLC{JJcok)EufbTzgee$c&~_V?VcckT`J)l7`r zEItl5ueE&J`h41r^lg{S&$XV3K${o0!hP8CZ9nWzm$QgZPYvp;`8`&$)H3812cKAT z(muorB0hf*#jq(Gat{gkXN?_!?~;-ewq=nHr7FfOckT`J@Jx)^b2J`GGmO_WZi?Z&ia=UpcfqH-)P!(J zoR8p8&yewSB|UkO2v$A!Dg^(Ivn}J+!q+0cuqlFbWdPC|I}D#LN`>j*j`Hyv>NVP> zKOIc`rdgee-)+z?gKFT<;Hoo)cPGSbL0kiMfSY1>2MPFRjU9k*yTqh<9daMFf!?I_ zLLWJL+cYt1kMLiD z=3C3sJ)>EO8)@lo^lW78GY?Aa^F*wCflSo2$`LF@D~=n;t;Vp=#<`TG)zoV)@^KpI ziApn_sLsnYYn7Q!zpb?#<{q%#ziMnBd}{O>E99zMk`Q|=+&!Vbv$Prn zR(#RNmJg^`89VsRVhck4F|tP%l|}@_yZk{S85E{wmhUi4A%3 zp0sRUV%@$~LLaZ8KCw~TDoA5p$||Tb*7YAuUZd8oa{izi>%tlSa;vf1;HSZ=ppHd=<Mcw5!@3jvt4@OB*1rSU4;rOK1#Cq5 z_zm`?+0T8YdF0A|xDMzZ)PDG+gI{>(RM}rk6#mPb-J|+tRaY zyeZ0hc~waMcO~tK2a1{G@Yyxehs;hO*V9K4L>Xa_MdYl-{kf4cLK%Ui2Mv-|Tu(fohatQdTK^*Vq~O#8CzS)m?f+ z0hc84ah-f}yuR1s`n$2F$iKB)7W~R_>*G+LoWV1ex`bmM<>NQhCzs~*xH!-Ca+Ntf z&ldUJPcPewSs#ba>CyP*rFP;=F&=s+LVa*!_H*u!fy!FTsyL_JjW^P&*yt6Vs?hsy z1ii=W-K^b*<+$cL58x#dGrh0j*SPMp7!eXG8QK(!6!v1_cWv z*SuBctv@4L@$RL5v(xTH&1~qr^{g*TtK*u>e58i@)Y7~&FR6HM9JKHDOM=wH@J@xv zW;bi}JKfdOackLd8@Etu9o%A+kKa&VTC#Dy{8q6NKI-BZjuNw#5N_idkQ!aILX3~z zP_J6D6TI|Ru@in#&?|?^Vx~6SPLQS5)om{Gks9hvOYg1ol3Haor(Yma>)i&p(IVHc zfvY)@DXD}y1eP`*tbzVlRytnROD@LQf|Ks(EoANoxS?DOG_tx=I0>rV1 zr*|IiM5vc+kL@Mp|_fz7@)Gl^)#aD_=p>@{&E_PM41f;FH^f_OzZx zI!|Qho4tP4J+$0z;LyNSyWd?sSZ}pv>x~N&{5)c|0dC~AtCNc}%H>vLbMP~u7IMR2 zt?Ke>;!w|-<1J)QLHn;YcH7bz*~qcmi`sF0tY31cvsnKLceB8+i9f-<02DIl5c^@M=$3z8-#+P)j5c!XTS=jI`KxrEzXbX2hy#}VHR<4?FDH;D2rFFjf#q)#&BdVr<2O-GH18ScUg`H`r6Vv)Ukf85#^joyfz25XFnvF zgni@CqJl}R2(D$whP9cLK4MH)V>pU#FzL5Z13ha=OJePo6In$|{tOa%EL-Wvq$S1q z`ib;tN!s79B?J9wNlW^ftfD19D4B$;qtTMc6t4<2c`9g0zP}5}{JtIP^-60bhy|&K*s)M=ReFQTx)b{^3dG_8;<)?c znc6y5+MlZ5eiJ4XTaDrRjOJa%39O&jP~TKqg@)IAnTAE}GH74^sl4@YaadaHD`sAC zgcvu)>kbm|&-|_ET$id6n^u7)_i5QspHy0fhS&XiQv1^uwQ+0Nz*T4rY72T+LhIMG zp?;{u?7B1iQ^@R*PJND?s8cJ^j8$P(*p@*cvu25NMOzU2^lYH_X(IK%yv$bVf4#5B zEF2+b>macIrNgPztSR*o8|a%##ByMZPdmJ*F|H>~V)=B}O+~CeM^F*F#_YhcK;P9w zddAkPW2-!4`(BgSsP(J#pQ_#$`cUPTze7@S>C&!#3pUWBHIc@)c(s@Hx~ffANh?>^Gu>rHhxo$0pJn52EU$L0!t6g6%+9PX!3$02J5wuh zTLa90n7(ySfp?g+O@zERV@k%QsuRFbuIq1cM#H?{&!)r;O zUoavhRI*9<`^KdrOa08 zll@c0EI#+SSvyS8-aM2}9r>#zcLY!YT2FIM$j;oErTBEi4>ULVXF@6B}kfXIFtI_47wN?BIkC?

_TSbWrx>ZVjx;4}j zmVCBeVyo!ZhfQKPk8VXSi@KF$9#Tg`{a< zR*&(~8|n#5&wY96tuj(@$)-1IU5i&RZffSC^SLjwVV*L1;7wR&D_ ztwmTx=l)}pT6{m|=F_>N)DE31V|?_6`oogWby1%8#;WMthirN`m(Hd4*`94KE}aGY zLFrDvv+iNG}v>N<|trmkb<^H zcdOVFKW?<>rkbO`A*B-Anpntv8aUK@mflOlRY)1NRo+YUphc}PCg4ah&kPHEFAZ9~ zIlZFfZiHo|kK<6^+L&!gJO+)rmR)>KvnMywF1}wouFo#+yVF^A@mgaMIPN*9UA*e% zIBJFi-%DdN>@Xov3v-11_Cu(zZNj!6o(v#(K_g@%2`*U+-s;)m`uMofS8f+r1V8Fd zm-p7&MG;D>GxBduEL-5Oa>;L*xEL%nio zw1PKBf&HB6D*d|$%3C#Ro(CPRFnBJ}&NC z^LcX{xddK6v!On^c;3~{6OJ*~C{rB;DeiutMbHG}Py|)Ak@IPL&mV6|}>k;|yKB zl*oSG^XG4LRsTjE~+>-&lIO z$E#zj(AyUD(#slfeY?|}Xr{SYYMtIfjECNlP%l^-gZ0u|Wi)HirZ;LUA$$y0QoB_yM)=qb_IlaYZt~QsF|H~a_kzW4 z-2Jj}Pp#s%gjzqdp+2vqZ`WPl-fu9A-LuW7Z$+tXeJdk;`Zm<}l~y13vRg&pHZ68H zm%inLDQ;^0`Zm-LmU?CD&g_C<_DHjx;j&pcq7d`gZFsLtFR>1-A@^z8P`_BxwChgo z`2w|QBg9N?xMeHp#BP`N(7G=6F&pY3OYeE`GFxTcyZHjMcz~Fh4S&yrgwsi^-!cgG zl_kr-%WD;DHq&^;Mc+1;WgtsjRI<6;r)5KZWXUpEcWUPf)NU@z0O@pC22xzk?8x3w z&seeyyv$ay3>pPy@c^60GC(*j%YcMFUW0vN=_zyMsccqam8Z;SHD2*~J^ltLP&+X* z8~&6zTC;koixz?r=OZ}OGd5;FWuE4NDbH9Hg6j@~W49Ep#mgKvH47XDMe?o24#RJn z1+Ek9uofi180F(PdC7R~7Bp*K>GEw4YpwH9WmdvDM@!<##H@kCXC>(TT9$*P*UxUK zmu$j*@+PhDp>*#sFgNHN+_MFCr`s*KqaN(E`#8uDH^bNCMF^YH!T9byxz*Si_-X3k zLg`(`L@|j^Cx?2{CTy!Xajm$nvU1IRzLte{k6AYl3xpNd2ZRK_YU~tzdboBfX#;D& zwhr~Qr4_|^s}wAf2`+?>Dwgt(71|Y-MUH(Wc<{cSEVWBL=W#y09O`#VeZ6%j_#F;{ zH(y^5DJ|*i$tWMcp?BF9sJ@!Vzws+@9QC?PBVfceC&pLxE z49-k_ww3K~G_oE?Ic7UJ@C_;MlIJLwMEh6{_1&d+O?X+ZqLojTu#5+andQKDO*mjx zriC-o$8o41FRe}H<+#e)WcP56zdzo)7PvMU`j+JzP~^iGy39vvsAn#%NxJT&&KRV| ztz`q(B+aSRbgP8d>ucK+>T64!t~;kEC8vBs<)-13N~^3{Iiu9iX{bjnt@Y^Tw8~nK zCv;9B_n58Lz_oMLtTO$+kL3C(4fdPa^KsG~Up4ww#rNB<}Y<1kPMQS_`E% z)N3)$XSXKrnM;2TJj=HV!N;8h$E|Mzy=NA|rX6bl?A5@#L%nBdguumlK6k9j2*KTo z-??lhZp}Nu2*Grlm$smBN#@bCyF)!?spqxsq#iR!ja$PGFhamdEoxQ()vr-Q{a}gH zb?5Y`

K;MLv&a08Xj2hC&r0pFR!saitLgFQ-*T2#)BSLhhSngn;HE>LUas@lhJ; z!Adi0y_8m&-SrPSrOoynP6U~5(`z9kr!{b9?V&=cm2NFY_}C5gX{FVfyzFj+*g>D7 zyvt@cYAuV`FK%j1*A5c!&l)=b-#7=zz*93_3vwT|p&qU@BazpA**vZ)b6=)q8&0ic zjpaU0NQhx0Y7AS$BR9y7+}>C1dW* z1zN&INcDw6TyZ{vL%nY4X>~8bRs0zTTm-{WVkS87Y4swdV6Eh~9jr(Cv~Z|rF4+-Yj;q+g`&=AvGCM+G>a-)YI3K~GUbo;B9HOW8|s-$v(CNrR+)8vhopCAbt&t`?a2t7b&l4rD6L^KNSTk+ zVBeele)jZ)ntDR5ik^LoLF$23@!0QX>927*WvOj$^B5n!!G5=qVcO1ZoqP19T<0Wu zUmU%+JLtuVjd`>oaQ0-bZ;4UUNYJqMjx~&j`rOiU6zgsy`~!pCxS0)njv{B)L93tB zP@mc^TgN^ElLxo**1L@D!1sIb-}Hg+$GHXK-$4@$`5VfH*~qyabM<~*OXvEzkBvOP zW470G#p$w3n68N#Zr?5Cm%)!QIOe=|T&B{E%XD~tdmzn{JDoK<=RtS6+&7H2+@Q03 zZy&bX;rzBiMAf7aL?@GZRId5I0nKuJAT!FZ?_Esf&xdM9x6DtoI8w~y2F{B_Eh`w!OYQ<#Mfx}n_NArOLlERLj;oB~?s0P*HNyjV zgH47_lc5;rBRJHbmYxvuYGS-^4r)8>E)YBw`3ej;!h)N!9h^@HX&M+y>{7m5?xQx; zdzRkc&Re8R?^dC9!lE{AyW!QmhIDFg5fc2Wv3>9f3e}*t1X_PDE!1C@-rtTDUur8< z>7|VqS`hP(+17m(763M-X>TF{|E#gw;oD@^NvxmOP!HKo+qS&~3TLfRg)^j-HhffJ zRy(e5RH5ZgXN@Xcbf?SvXjN8c7}Hu0n>1!tU(T7-SsfM<{HigmP{pdnsh`p08{>6J z2)$! z(`nu59dXc$2ia7bmow_pyduKKZm{nxy{`|sD%i%k=B?s8yVYiwzikHH+%fYTxH=9W z1LFn)Vk$~rqJd?skK|DASsKMfkV{FfGK#xHl6<_|!T0oKfN;zN4={?WN^GF3iG9q5 z`peS1aWAt~=8gY|WENkQx_Rb}i_#jfN|}$;P#;;Ey}0hA-eQm%w`Lt+_9Ca!v}%RO z$7!fvELj0wPODe}e;+xW%vzaT)&>S}H-QykmN-|e1+kCWP~TXZaqDHaiZA!(BC~LW zn3=`v7B}U~brA)a z$fBk;aHgW8)VaEK#rX&h^_Hdi2wb0(jeAv@k8l$wxRur0%S)Jf%=$KPKEgp!T7|0= zco^Lk>J=N`V?FKoI5gN=b7tnKQ8#?fOj|pyZ_dn$JDoKj;bC{Wd~6oSBM0@0-H43h zlMK`CMr(QQ`$p5gfnUwKeSpv4$gRdsz|ZoM=lGV?%vm4Jpw2?jQ)pROZFEztkpP6s((2UaG9Rg-KCv{`weF<8$sjdu+aPePD<@TT#59qQ(@>9B znlaAp(Yx;S{*Z&-{cx0+dt!mJ zZ4317H<@ajXP_I~`l-GCJctI6PhgG}5 znyztc)`2KhE7(d(QR1@$LOo$S?bVXr1x>cr80`!->xPff-lrYcH%7bQPG^nLcHQan zQLQV1vO&ja->4{!`reOMC~iuR%28UB*4QX~=6Y1#@+F^sIzzo&$x6klE}auwWrW}j z>||E&HWp^OSq97h;2dWhAc&gOAS=}_wYc#+B0QRPG}QZ*){;T2O4-F3A%kkx*W2ty z%`INPxG4?0g9Q9jyluLOr_{8z+(&Jwmn%`r>z>R4+sjpj+UwZSX1h7Lyts6_+w5of z}$JHs2ec5O-T$y&P>dz82pw5rt`d(@pS?~P&qV^Evnb?j*U zLUwYwn@u*mS)!lvwp10>*|HFgTVeWe#bd+NtG#xNS} zDYKu^eJp_La~cgBN%j5OaeZS9eRn#G>b2ITsWRL4S~k5{Kc6kMmi8|-Pi5U+v(v_b z+n6A7;1^FOW`09PA#6xRcg_{zV>i@S zmga)F7|$(=Dzg?}L+qZoSfA;fs>jW2$XqavrYx;Q^dZR1pKqcZi8=5Y+hQ8RweV18tO?)BMZFF%Sf#EzlY3!L1N(rX--rSMR_Gt|eHo-p%LUF8Y0SCvy8wJw%(7nCl(LokkC z^n_U{(RwG%#j|&|!_H9O+l2kRWE%ZdPo)n-I}JMe`$~3a)}LuEX1#uWaS7%-9O-~n zF?Xan+pTw3x+oQ_(@73&3 zvpt8Ccc$Akp9h^9aq}E9{_89?aqN!r@f+%uOYbV-8l{ZiD(l<4LgSanjho$&caVIS!20hp9QUp-Zy-K7i=;6EJ9{OAh(W^D}G&( zK8}O^ZuV@5FmVa;vdJ@Y6wQIlun#h)|zg>bLPGD6@O3=-(@OJ5FY^%jc)t^BwHKaVsKb z8zQvdW|dl55O$PL`-XbwlJ@oTTSfc+Jr}=ll$iMq)xHHtHSKG~_~;Gw*rgc}UV5v{ zh}de=8#TEhGa}G#F!(Iv)@w72gnHzX&h=7TMdx0@rdIk{8>jfH$-bLF=ekNwCWAA^ zqjN_>J#fjN?4`GgKlx=0U#OII>-~&;Z$~?G%lIxoSivA>t0BanTwZd)acRx?p1T+c z^}8jS*PZ5L*;tX{3`*U6#2y7Z(R;#JCVl_%x4aE@WZEG{+$ zb0uPCH{?k#jZ;mr3QYalG}QN& ztO75kRjh&`HaUC#aMoHn2&?+{vwM13moF-X2a1{45UZf122m8)yOrk7{37JHKNr;(1ltq$nX1>V`nVE0+=9`ej z0O1v$hF5sM-ywvDJOc#Cy6&zk>ar}dt_!TX>}pXKWl@&3wY635@ATvL>Arp2@8%}f z{;?D%-@WIY?q8qNr=Pd)olhKDYxWKtHQ@`B{r?U-e8!B!Iy(=Y@g<*ssJT7tu#V|p zRM*QV5WVerq7x4!I%z)9H_s+|62DA6KiBls1|p`5TAH4E1NWe(kJYqeA`#Q}*EBtI z6cN+2Kh?Bj6mq7QG(EWk`GcOhUDI=0h!i2sbD*cUYI+J~V%ok+)3bXbKc*o~+ZhwI z?7N!!rV=r&+-9f?zo3&}(X?zK^gx?7YPx10BBtvWX*%t3BBs^XYFhP6BBnK~4gDIw zpz}6sx?ma+(?#GhUA0`(?I;h^*z1~B?TvgucWu{nH+;!--?N(TpFqTP?J1g8PXRvY znsu74gC0|JlcupfkuMYKgJ}!$V!Cy+rbiDVQgj)9K@UEx>7fIN6kUQ}(054FBV9yH zx2@OIf{&P1A#bKpl#OZI&otdJm56EGo0`_ZHm38xuj#y_;2+SswVJm42IT|Ya>E3;bnC{u3>Fh&@6y1zp&^Z$gor_=4Bado&>}4XR$B)tU=>Nda zpvML@4IwSl@B~dms1K&$*9^g@!=RC4HT5ncQuHi-LG|Bj>hB?9>Vw@(b(Du`#Y{s_ z;TJS;sG-gH1r5R%iq_+o2|i#t?enI3pq(>C~nskXPKo>S1DfNEzL`W=2jr+!b z+lZLfqP`UEz%OVW@?$z3_9#O7(?RC~m+AcFnl427m@YX&)5i6PFVLkgXu5oV#24ra z_?YR+nVL2o0Q*5VK&I&T_yygFbWAtht?A}BiI{Hrv8G#r!*u%znl|4~#I$8EO;1cA zQuN>W1>L#Y(ChdG-L**58FvyX>cB7P+E+B4+YkFdcTUiB&0FXnK-WWu>0#Kd=tca3 zzSA=F27W;|Pcj4_+zeX2Nz+8HCNMxC_mH1KhU&sBK!!t6go_o zp&c__{yR-q0GsK`hcsQk1?29VFS}mM{2t5H;6CL=4qPlg&x!6+ciD05&i-- z57D$?9ojq7o0`6jx>9sCenAhMr0HAGS9CpoL9K0?#-YP>5B$wEx>i&FOK5MP(YG`; z4o3R`jXbL9!r#IVzg@O$-hxHPEnc#$Yfks<#q$;|Id1W?zMd5W^`TK(wrt_?^XKOk z=uD%baDqhL-qNCBlY9@`^W07vFRNqpR}}ZfbhRAV*hBXN$MYc zKelF=nDpJy@E|c|cO(4`X7G>EZ}#@15MwlEFS2~bnyWY~{?WWuy)*hp8)SYouV<*y zyOQ+3n$sArjgtDuUJ)>GI?zPrHW4PWo*d+U_xxE7` z*+}!Fd4sLSP~V!y_*jF)rIs~DTPQ)__%KT5E<;(ZudgZO>el2vGK5-UBL=gpIV0o4 zU4zXf&3fJVM{?#4j`Vfad&XDHgRi-o=d508)S{vVgCm1oDBsfNV5`m-Mmf*7oW=E8 zA1ijZn)RBk@B(31&x&KvK4wF+RX={L-V_LNS(IxnC=hn5m_82mKW0iVIr_T0F^&pn zhj=Q29qL)oJRcl(`J!f{w>~z87}k}QV;hFU2sEX@=yIbBv^2}hE25?ID$*6UaLI-8 zQbNvin~mXlBYpMN&JxEm@+FOxb=%!|EZm?+IR@$sW=uSUG<@Qs~)O&TnHD|SKBVv-r;vqvu=AH zdxzidLK|}ut-Yw$tdF$NmG?DHbESl`Cx9+|oURYdS#|^;yQA80ol5RJ-%~iijZ3n&n&;9%QgJYr#UvXX}dOp>S@a$)3nGRgHUs<43ycy^SUYB8|+IVAbO?=*fP^D(Bc> zs1~UV8WUN^4r!!xDfky$8kK{N|;5i{&!RIp8xee+ee#~=QOo%k$ z_$tbh7eOBd^kySMKQDs*;`)lgu~xk~yEZh`gQbF3rkGHr>2KD@2DBCPk=)t3xE_k2 zpPPF-{k$lqFO0|~&~vza^YAf(=Aq_&`7{AekSIDDh$P`~VD;6=DMpEG>VO2H4A$ql zK1PtlL-D8hHYdduIeTM;1JvxrwUHI|1vRs5F1os9*1!KiJc(Ws8}liW-fw z<Go>t+7fP}cr!^{ysEaOVd76}d3>jNf>&&% z1eTHy42|YCpCW=h%Qwf%2BHPEmG$oNrdvUB=*(G-e$_UYl!guzG1)UV=K1IWW)IbC zBja|PLojgZ!cv58o(~S9;kZ%RoPD0Y69Jrcct|MN&~p=GTWXI7jRmzhO-+ZEpJULcv?dZ-FC|5GJ~Ek3AE?=y8}{Pi?n{uCs4FJlVdiA@xdKCHWxR# zQBgK)(5==?EV7APp*SvZgMYC+F3BRiP+TOigIlq@o3}8R)`nJQW=Re_n~WEK{PYR%TN0G9}1Uv!wj!HGX^I zk|`}CfNs8>WE>;)vtX&>uylMxjrU7v6Or$+Z&cyA3x&pp{a&O>^TmOtZ*KdOkYRr zH3}uQ&nWI~FYTvQYmcn!5ITZ~6xp5bTw;1w0&P@suz@QQ#DqxW&s~ImD6r+XGYX-q ztabdbB;35h4F#_>LP4gL+rk1ZOX|y!QZFO*dI3)*WM7^a#q^GN_A6c7kJvdLm~}aVc>?sf`qF!*%n-#Ey9d!fei9;q9!#j>d9l z#_Htf7M`{)yamQxhHWJgo-iv^SG8k12{CrM;>3i&fPdt;>GVT^ugg77R96X{E_eSq zJ;ii7+|B276jSTC;n33(Y^j&)_uZgpMm)z54u!druXDt|c5L*ZCEwG`xy5J-uYi+t zisfZ_Ak_LJi;*$pmb%3ex+F!y#<(=j<$2L3-{I z@WV?0=faR3>WRX6>6JhD*~h$*-l6e6%%-?NOPaM_(d-N4z?j__9>sIqXsU<|DZVyd zZ?1{z=OpmL?16gkN=BX zM;lEu5OI#(#Inr_b2C#tir=SGXjaN@FFRSW1F7n-=}xzHPYh7c*{Qn(T?&? zoP(ZW&q4o+hz>lFXg*Glo&8PxK1uX*oC@6V6i$s@MDzxJkA0eG;trzMwi6xo4AD=Y z#Yr*TzXaL={oBFY@*HHKth`=sKKwI}IoPa60gpt8fx{4biVbo6jSfhEs9BMp>3$g?w(4hmcA2ewYc7omjop=h-4?#CJP?m9`{{rUkH^JX1_kQrjjdu_&fp6E| z4}H+BDDTS;pd9ea-Zl6eadHNJe+T;BsknwsFRe!%p9QbU}Cy%Kc-{QYl0IY2Mmh?C4W!T&cC{TRMJ0`+$S>i_o5 zM0>&iQ=TCDZ_w&H5fh+Acj1KS8AKhRR}c&Rz?%U6TZo5_>w*0+(TkuK>iZ4QB;>mu zvT|_QLaOph(*-E|?+=Fq2T5q*+6XbK%m2hpeLYPyDArPt_MT0ryYI=Y@7qetnl=}J18zDJwrZ|ExO zr9P@tKb=EQ&2dSC7nl0=@ZmRPtxJ^I2}mS=_&d#-9`UE zchd`W5B(!;rsrq}-Al*O7P^oAoHo#GdXcu$A#@C#PutMEAErm>3v?14O5dbkP!IhR z-A^@oi5{RMXdzudhtV>+n5NN%bP>Hmm(U4x6n&Xy(kyz0o~5U0I~`3c=t%ktI)zr! z01eVl=s|j!9-?p4S7=Xq8}0G`we)|!mL}2%XfN8E-bMS;hiE@~H~ksCk3LBI(|hRs zG>InAKJ;E{PwVXzJ&qaY>IJJkw#qZK?C?Ui0_2H@Tgk@R*!PJGFjFiN6fKr{>u`=e zfGwVC@rH?agqCs~phb8~6*G9c7~`4bfhM2S^*3w8t$1h@PVsPG{P0peiHkm&ER>*h zN|tzrsN{(UgGyfJAz#7yVas->lkIcu$a8fo(x;8HC*bM{y_I>-#?A9}E7Om~i>9qb zliRS7o?2bmeAG>9orFa8sVQIP zmqg&ob9tPxyjOX1>*Ng@brdzb$wcljH4?Kp*Z|FvIev_l<)_s=K*4fq`A1O}KU;x@ z44If0slmf1s0(hWoZYKOP3$Q)R^7PgP65kLlihi{btWUpq=dh!oS4n99t&8yJOR@^ZnLTV4JHj2m4&d@lLCQRIauXoj~i^e@@-D; z7u0S!8Z5r`QZU1%DA+}nZjaTt*fFx49n0D-IGL7yZ$;-S&Pt%D`Yj19aYrs$ z;7&^zX~wWfuA4OFa}2KYELu6Y?A&oC$>$PJ;NslN$4@RF?|6lgf-H${d?F@cp^eha zXND(2NN}W<2o-2}k%D^>7UoW-MK7+N)j-77scxMawx|WqYq_v0W{s`cGhCgIz18D5 zG8XS2Ktmh{^6nHU&yaNpao+Aum)hOyyyd-0?mgb)96W|oagV#iIPNEcPmF4PT+%dM}JO+0xs=c<&z z?@hI`&$G!yb4DiNdp|t!78ygAM80;yCWw2hfI!rP zDaJ*6xFC26%IuiB3zr~)c={Pg^eiyP6uFDT!n(xV1hW@VtfGA;OqKI;=aH4N_XNnEQUIttdceu$Jt7Lpa<803nM;e`2i}R7j`d-~`06|%vyV`C zYG_yLT3v9YlA1qqFXLA2PCqY%LsDXNT4`|_ntK70KC-6QlH5$xq{#8JvP2}d7_kYg zg9+xaUWPfD%u=^PasHHXG*h&54Wx%9u7ThYQ1O0%PFT41Hx4P3XLcx!Y==PP>YXVL z`TogbZ-YQ0dx8uybp%)g+3f;e+sUqk9)gFVdWp)~T zrrvKbJayE+_)%Kw@th8eHjY2rFvF1X$Dcc*HwyzR+k-H5mEC7eFXLpDhHT(iJ;lU$ z;NBR|3&b(3AW2qm@#3H@gJAh;$tS*cKSO&TWr^%+WHPyz;b0|KAah^I>!09AjA8|9 zZqFlw;?!%exxRd{xqHkHj~?vh$gWosno(W-le4 zFyN|96F(QlGW#fAk%SHvUA`-Nl$@2Eyc>I4WY%^NqV3zL_spOeDt*S zy3J$hg>RlE^UCkp2%qPLUTww1!G2E$ZYJs6lHIP4lzRI-t_(=$NkrKp;_R&dy);rF z%N(R}GcVM+koij$SxlR;rx7odUq>Q$78Ddp)nY`ZR;yt-%$`7u9WzWVa6@HgM)1@k zIN z_56O+ACnj58#G>okHa*3S6=xu8oTnMNPX=nX_^4mwk9CkVeO$mj2KU-%niE=({U9m`g{xEc$;J*a(P zthaWHnto@ka%xbemh83&hD`dt-iQ z(!`^u4))=*2UDh5(Z0C&5$G3&@pk;qq(gTYz3GOHb7(|=09ife&!ova_Q3BXoLA%j z-Yty!G`)Y~JHdNFNg%`TtACiZV6eB@7;E&mCLg@`Gn41fTliHY_kI|R3&Mm0(&}m= z{(XnK5-2pY7pGlN)>r@VJpBRXb19&TBackhG)P z{EzvM^CBEhb^q;wqptXrb^be}6+T2dL73ZCq)h9yUlZp@*+WIjlPH!hF3wR$BBjsS zpsqxu9BxG%DLB6D{l}5Q`R?)vXs2F32H?UEyO#Fa7pLdi*Q)?Xc`ebtI<1?yeRBJf z|IMVCwtaP2KI{F&-k4w3+vVPE*R#8<=j!Y*j-AZkwC6_Jw}E@F1C^C~#?PaYs6Tn# zRtxCtj3a&$h;Ku8(iQva=~4+prCVJ`ftC9Ma}QvOM|2*Lu(K`OItpz25OCh^<5aXL z<;6V>lG+>PwU>LsC=4p^#m*V=n)?*2dq*KAW>>onb+1BHEI+HE>KB|~u-`5Yg01gN zp!(G+iqKa4bS6;uE=1)eqCk?@?V(PK*Xv~1`YuL|JQA*iXNSPRw+8@k0`PJh?b0H7 zUD>*K$Iyb%5tg=xXQzUJb)SHBe-_8{gQj%v)|sfk_ZYpOH@7iJmnPGw<`T#Quc{%<_mG1wGA2VcjGk z@@B7mhAqLwbzAW={jhld@)=;gUt<*?xe#FGtxWZ&`vSS}q=r|Wq6qETThPB940}J2 zLao?JI_xAl=y^U2-2E(WcIre}C9Q4C!fX)}AaM`=L5t*_WvPOenpN%Zq2Yv#1S;Q? z7DVdDVb_N&l6StQB3`21e>jR4gh*)%rzc|bBS1_Y6OyhK*X>12q6hyd;|}V-q!1iF z5->Z_`U`C3DE*kgbZ43*oVae!!tAex`7_2(1ML8yB~D5SsPa~(#;K1BTyp@c8dgCq z^7>}7z*6VBb{o1P0n!xI)D%W4 zI5H=2WY<<1^HT~leh{w`W}=NB1WY|&lE?chp(VzLPsh+I&OuYX^}!0S_$*=-J5#g6 z&uH9THaqMnSiS6rNc}8h+3)|zc$C*|#b#;;=yMXK;#xX|bBM$V269nbZQ0YAh{Vq` zPX6SmfG9u8q}G^Iqj???h$%u+CMDhHlCX8(hFEz(J)ZwYa8`7Bao=nZs z4-1g0*_2xSOv{jBCw+zYq_ORJvS3d8LDbyg8r7a3mN2DfvZ-H>5 zteHDCqCD0tJtwc*!z!3f@?(|hc`QFrO8YVu{WCP0JDDxqwrivRivf~vlz^@5!7n)^ zcZ^&Bl((xhG2c4Ep#=x%#$;T`>$WURjRAii!}Q@wM@ec7I5LV?tp-!}{Y8k!r($=b zeMd#{s@d0(=qbM}@NjOSQf#JHh%-GLb-unDR-)gUmBR`qLFFSdG5bF{f>y1*QX|gn z9Gd;Gg>J%H?p)(Q*-}0IZPj{tbM6*XRgCi@1Im_1F61*zrcn0 zGLLWy$-Dw1jM<6tATfVECW=?llLg}s@BPjT@TwuDMuB4;l6=?4t2*J<_S!(=Y13EZ zcoo-hsb}l+o<<$iNCSo<$QSVBxE{x+<^=iRr$InHNizE7hTHdFL-g8j_ zVqj!>%!HL+)0pYU+vO1x?PGBPqVL$!v6Jv?w?j-laxQOWLI1}4nM(>WE83ZuT^#Q) z3myWO_G)5B=Y$xVZ(M1Qrgo~98a(@^p|C~vGuYt zN#%W45RE+Ao){qcMhV!qyw{oNPySLO4T*O+1;|d!ToV1sNd<`2Y)nPsHyxsSnNgZ1 zuG{iuDiTljaeRZy$44R(mpLT;f}Jp zojB|%#H>1o&nW1L`LK0w0yTK?SU7kmEHCI`c)aV=WiYQB@y3UHpIL&6>-K6mv1X}f znEtz80z+1Hdw7Yytv` z!xOUm+KJJ=V8+4c4p&9cs`@h30!|C?)E5RS#Yt+^T^&KIYF+Ad>Y50iKO6{C+Zz8; zJ9leiXn}cU@lva$bs3)iE{Vun254J$rB)WFI~?=1lS)VhD^7kp>x>LZe?z4bPGVJd zrjO%?#4a6S);lEk!53*(X|zb{)h8Clx1iT#3$V`vpezEnSVNr;zQ zcI`^*z8yoWXkBW&-6-*L3!t)=rJnF#8Y1mRt1gpRx#h^NwCeH@sj5{4;{%`0yFy~w zFMtVSc47=nwCXD(XchaA#9Cxih9MNhrI_sJo zR@Ku`DYR=dH1Q?4N>Q2WuddT*;sbLMN?f-$<184#`AyvGLnJ>qN=IYLsv9(x` z_@%8XnA!3hxHpDKRr{+1)=eQ+5Qe4gO7x94=dr5RR|4%8jplt%(5tf2(UF>g+!{gi zjVtZRMBLvd(98$pME2#!nADu$_8eBVcRNy8cjT}t`mkW^!y^7DHo!#$aM!$Sot?!>+ z&>MdN=nu4k9yq+T^{MwHAJq8zWmnJ4vXPW}C*dK9Qn3$6&9lB^ak6jE3M-^_?X``> z`r_dX=}&X2;gLArZuI4&8KV9CZY5t9j1T;r>ah&T`>3ykD;@Kxe)RDSFZ=9o?!bls zZ!cC7=QWu+hT~j?3`a}wfLk%{u4Z-cq)SCH;J>T}FhLwHPUD_hA+p4ovPx}2lRz=HFCnf*h zN842~ndrNJP=r{~%G7-Rd5vj5qAx?TeDoLC#_wMI(8H;`4oXDik1W!V`&+-#EOFgd zM5gxpew@b&Oe>9+=(GL-XtBRRARF0EjO>YV;DrK2KOjrnSP&;XfB8os7W^#*0aM<} z!wVv25-?u`rvCE;5<*_WdE2>%2G|4$$ApA{%?MQZ==C198`+g}Az+Kz(S zc`xkv31bX+*_ZAm4lme4c^~qB8TqR}2q6l+YrXW(K(K#pLV}3vwrV@I6Z2DGxW8l} za+Z#352c_t;P2@C3!}Kd{~=+@*Ga+bp8ur7&w#^!f$dDjwT*w(`SYLm5ZRWm z^;BHF0u1%HLn z<>#C~XO!UY%SbSB-Bzr1BrN)c#X_bPqb<>5e#t1o2V2Tok!msjuJh+Vu_LnGi58O> Ov0ev;`3pH7#{U90x8HvN literal 0 HcmV?d00001 diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/dbghelp/dbghelp_x86.a b/BranchTrace-x64plugin-wtl/pluginsdk/dbghelp/dbghelp_x86.a new file mode 100644 index 0000000000000000000000000000000000000000..b3159337d875a57902aa464e20a6af8b6c08e2a3 GIT binary patch literal 166524 zcmeI54U{EEb(m|Ogaon-#>f)CVk8#vW4z4&&Vqp1-I>)6>`JTM*^%0( zd&7HgRaJK-ep35Ucv9723V z?yc(X`t9mln_+y4sXpiSo2gsx&7(+RIoshde!Whau$A!G|n~b5Hy;sQ64;Vwq z-YR767RFFs^*tf$A7%_?G-D{6|6Rz|yBR}y%@HBL_`euKx%5dPue-z;${VJH zJOtaJ{OWHCdGjn|C~vt+$gh2YF_gEzQOG->Y$)%1s*vA;ZBc&bqe9*T`$l;$>>uU# zK!@^ycM1960%Is2-YeuIP%e~@eMrbB+Ki!m>Utrc{u9PfKKnKypPyk2aJe0pY zBIJMkHDf5>`+XsQwaOUE_u)FA{NQUs{x6&h$|GZ3hS+x)mn(jQ4WV2$E9B8XWJ4%F z^&ugTU1CEhkH1;S6TZ!cP_Bn4( zyeT$>viJK!M!&#@P$u3cWZzLXgz|#xh1~k5YzXBga9$_}FA150eW2X-T_G=h4;w-` z2Iqxx2kal^#5;wYf^wqVb)}HIKgotrUipBKvtw)sW$AlDGT0Z&8e9XE^G_7A{zW!~ zvH{zn^kEy6%|92i^>#Ld@|wGaJP6yNT!J#7yzV1H-tZo>9?ly|`WLwP6c2j#cV3VHW6YzXB&kcRT!R|t9kFdIVo0GuDn2j48@ z!_#aClPv3hO(gi1zc;C@4&r7`ELy&e+kD%`R>C){wJIp z%3nPq4&U=^3*R0dHMy`K)HEX$ewSr2FkPECFHsHvIfd8TqWfBzsnjZ zW48;Lyp}ak_I*ys3m#w%louTqG6UP89Q;p0=HAH~C`T5Ayz~*)KsokNA;-_M2Fl54 zA*UbB8Yp*tTgW}{W(|~kVSAM3jY5|HoHbBZL5I>>5z^kn8Ymq&KFX`#E@ZIE8YuTo z3Az7D)(RyVpcV-uint#2%<3H^)f{oVydrzF6ix`O}LA2gTG!@*URn#A>stKHsm zwwNt#nAr?Xzqh>FYG-{lo0`EbRc3CnBe^_!_AEVaAK=at>b|If5KvrFgZwgy?J-|BW|+wJ*IYcMl9Rvf{T z;Zz4M^lY}Yd2SxAYj3?dfIZBV1Xij~b!M~WZm&7WPF`GJ>b7qOtk2AhP8El&*1I${ z8*()q=TxWNZLS>au57k5dHoy;BWY?vxfpI8Po2e5m|10_%wzA6=gN~I-^t#ElY?$A zJGr^B(azSh&fv_<*hq14JQ#oo9SHq!hXOL}yO)U*vZ8j?d zFz4I8P#fDFz}KmM$KZ^Mvn#b?tK-ccnwnN;rF)+=;%=Qty<-Cne&5WjB#V4U;Qcq- z>SfDd)h=2W+}1j_GB3NfQDG6XL3yb)O7(QUcf9>)W+t?Ui8CP*%RH_uJPmT3$j-I; zgRFOWv$KpBVy-jjT|Crmx0k?q(l2{`*1G-S>p|tmyT?4Uvd`kQ&Q$Hk%;4D8U8G{e z;@K@utVpjrpn9&Wy{x|`UeQP4(rRFx$Q)WY%R4u--bL}CE%chp+02Ccs&r~$tK+@w zf=*(Yl4~{MP?=M9J3PwzmSqZTiGOQb773s`)*LLa6*gLXDlLtk`+$DsmE1z3=dR3L z+#$X_zK~46tJsgOGgEaAwViPl2sB{*P)vOof)WDr<4I;U#{mb01h$e1GaMCtC%3hQx)78{lTF zcIOP6Z>#kD`sGk^7uO?C!dH{y)#}vBBNSU%Wx&(blwuoLgKv*40RrmfgyWbxa|_P~ zTvg^T9!yc^wUV_2xYH^E;xupvLQ&=|9$90bMY5L9xlhb#?6bT+8d%~KG+nv(A{BPz z*(TR&TZ#9&`q0Valsan**pudH>D%Pme5>vzRQyjjdw7lu-Sb(;@Jn&qiab?&u-LVC zpinH7f-UX2E{`mA>Jc&3d%{Kr=e8B6T5jq*PxVr%FDUJVjZEgzOSOHc_|?WU(DRsk z(2byWY_7`lE8elio}n|huwgAXP%I+%L5(UDo(;ODB01kLCfKDdQ$?=a;Z$nKu&**P z&jU>r&;Vr^fIG@mnd>07l^ksLp)zkgLzr9Fimiml;;0|NX_z`|3w(l&<0#wYT5~Jw zD$7ljt1J_}2XP#O7vH#6VsC{;JtIuRoft-5ZjdX*HbG`WNW4fNR zddET|bEBn3m)LP0ib~I4m03Rz`3_KDBUnJGk^9A`mcNnVT(lZK5QN*9dV5RnW{O2p z_f~VTT&*8VtJ2yp_G0&rY@YpCuY2cilsA8&$JZI&Kl9Dy((A`BUxeoE!Ao5#?QLof zmaD~fS|!!+DdEOC)Q;_}$4c8wdD_wXW4Z5GUF~OszT-sQIpCN@4R)cq)XokpFK7L} zMtOzay(Ju2vjmQf^DMZ%;z6jdMI&9!so(4}BTvrrT%|v;=7zBIS*dU>(gq3 zVwqpn+FR*%!Puy<3T3j+l%AaL8-AeTjc0G3ji%9aAMW;~F(@B0+<(52mchBLeQNrq z#S^CN6q|=MpWLC-j|FWa)f*Ib7-cV&7eT$Ua0utgYiG=>Song4E2}kW@uQjA;;d!5 zccY?hOYRFzkMkauRlQuR9f@z{D6`y1D|ea9E5&`=3doAKk|RIj@m?1_1&Hgb?lYD^ z)8x7HD`(w2C0)&F-({Y$xWf?C$%^o?fsn0&{i=!jt}PAZKGcP-2t9bkwc&OZY6_LS(UY3Eu6R&^e*6_9rOKEMRzG=)&xb9f1)0&0;E@yhJL56=QOuBVN>Ivxk zgByrDrC2RbhGULi8q&q6(jIG`hb{;`8M#A$Z*B|XGD^g+CKGqu*4i5fHd?2%9(FLn zn^-i|RB7$>>MhtJ&wb)TbD?{>sTeRTStgu>NF?@DkvG<@4CG0?y*;$6# ztv%an)dTnGMQJIGG;vmSpfC?)Y^aH{Gy zMLk=2_4(Do-flSnqiW>E=*Y;_6b!kT+$Y9e3=f~Z=IGE>43{SkG4?qA*Q18^Vh0!g zclBzRjhx-P0#>m)3)jrBki281u}he*g*)6cQRKZ6{M83%)9rHc9 zI^Vt`-?i|^wT^s+ens@p-Mi9mv%Ra}vFD0Me#F?hp;dT;7CFVQdYy2$R~Y-oToAk&$&=t`_%lCxCjR&E!!nJrKV@R11E%4<#AD#SXY4T`;@aZ>>R%SOwvA=# z8;4s|mb1jK4j$!-B1KxuB88V&BaoL3&p{B2+v9?T6a+p&Zv|GhgA(XW7hEcfQhQqP3aH^B{3zaofyqBAJjO4k{Pn zWDzV}uzr#Hzub1%Kot-}3F9Z**xPCutl`jlf`ZzM%IhI85*EJtc?e zby7L}4~&l+gi2E^EFxV6d6LD)V=^p~#XTZ{uN!PX{4N$nRc$1;HACq|lGjR35a}Er zwdi~RPPEQSF65R2e|FMJ-m4tfXC>F%`7A5hbLT7RL>ob+^G^hwa_lN>8;8Y&6LnDf zL`;T7Qd(A3A+^D7gSDVk7TJW=)OeX4Co-EXD&7|UZd0CtlGzZ8`VCf$t&W>jnnhK| zjEnkEQF?+!9V5~?X20)~MV0US5R3Z9tgDUeN9tp?s5f8%V38JeL?rNagU!M3qF!Xh zpt=-Zdpb%acGRvZZNYo7&IdTIygPT&2e?}~u44bJ)}n0v+66 z%$AbW7B7mbSV=X(_Z}Z1Mu}33CvsFxW=M!pS07Md_<7WMzwIzP-~x zmMxwm)R<86C(Apb_@|fUPyRb5Ckw-!#=#?=som;Xyq~@Pq%5vtDa}N$wIs%erbg|S z&(tn2{mGD4q_416F^65$gckNu5_$`woG%UbLih{%aA2qYvK5}sm1v}S`6S1U>{@x^ zQ}P+&XMUNji5V2({>5xTMUOSLMt*YvCodUxHCfDys+dnL#mgo!YLx2Y; zRL5Z-7sY(G{4w-#Sj2@y$?$ESw+R)K<2uY?Ng*}jlX_>C_rX=)33*e0iRC@wVUKZ; zh()*SI;0k%yr^>YtD4{dQ`W?(k)1^5wvqX7n3xV5clZ-erZV%lh?A=cUNWiCoc(r` zJiWQ)n>)mV{37GCu}4iM##nKYHE;N+PPsJLIQ+dRC!H5iD*t`abZ5ysbp zb5R!uS9|2{WE{Mrhp!a}$L9(c@l)1TtT_1n?tEpf21jI3BaDB@+|&N!dBkizpN<89 zMRGdB{}-zUI|Y9%x{I!itMp~?l1z*Q=_B4mz338wU}T$hUQkZf za!ZV4O{G3lcxzadr48wW|E~nM{G)id&zP+&sm~PWQhq5=G>(~xUP`Hvt}(mMR2nHF zttjhfP*!^aF3X<45q68O5o4#2Oltm>C4O->72>m`*M`ATiM{MuL9 z(~!2@Pa~<0Z;IjpVz#ZMwp@47m3bI_8N4JDBV|*mCCp25NK4osxJizhVp2<(6Vf_} zh2F>TG&Qm|Zb#NqtxWn2A+@qksSNY^rQ^23#Y}qAcPPU-{QWWy>-=-g{PWNGl-lYS zuZnk*qViHpjiRNwQM{Hnr1k5QCbj(Dik?&0OEI?D_egW2C{`EIRGMv_8ZWcdxY?K; zH%pdQTG|k1|7Ff>@qKxuG-iMIdMp4e($ek~34GmPhu}B2v_+A%23s(*TDq54YK$zk zDDbOaRZk0PQTT+;Yt*b#TNEUd6{zxLFR9d6Sc>L)Ne!uo{fnGb_>#oQ&5ezAww`qc zXX3W5q-d^q@9V|3+ya-{OE5JyHeuJoQlA>>8{qqq+IstO7s0T7%>Kbs`SY#%2QSD| z@TbA}BWw1^ois{9dJ*^*rFs$n+(9sW zm#@`17q=z8nLp#ICviAW!Jh`Z2iDS)C@Id1uFPCe`pfP-UW-hPuT9!5W{Ky^JfnSq*J{>%=~4lrC9XFS8+*_Jf>R2+?KD-troLlRfTM z39_Ztimb<#ZI##3QX_N8(rz2Izi&|+w}(r%v?`j_(AM^c*hh`VP1)_h4?$I>Znm7W zqB_IyXD8PA7@dYH6x&B~srC{~jnSo^J}%Nr+Z@u<=O3E{A6QxG zamy8N?{#udABA8nw$Wtf)Oz`)#^lCr-{KOOtvcW0uKazAKRfAL?DYI)A^g5S=l6KC zhn*~2ot5r=_;AGB>WeMkxJaL(e6%4|&g5`18>q#Wlb2!a!lCoAJ4KDar5^44-iSxB z^fJmD6w;&p_i}dc*ci0Boqp8Jl6$mggS@yVu4=NERBC)Jc?n)pL;6#`FDLZ~d}m~~ z)ytL#-QLB>BNG8$f?jO1^}(U_@=J}XP1v)MBriesbqMhi-s|F*zf0rwa-YJVZq-Ye z&QtKG!H&T?Z+XxN_2OIGel|sou8rBFF}C2PS?A*(7cW+ZKRfB;?(|oeL;Qr_&FL)~ z%wqO!@u|f{`nDCLG_yfoT&q^5rF$(cHL8|oC*$`-JbJcI8!|iDKN75BNDVt$MeWm4 zXD1U8#4|G!6UFCucm<4K1Ci*Zlo~}#Uv%_R8uCTQ_ee^kCKUT<;3BOlegmpl@-I4; zFuDLG@JWrBP22wJo4};hz42Fs+1c?oen&a3Z&rTvT5u6RrFFC-X0LVUD_aKkz&>X3 zJbZ_I<&K#BL*(;BcCOVQWWB?ion>qwnClFB7Y{Yt?WN}O`M53XbMgxyxm}Q#1fEFz zHZ}UL-bj#EdfGeUV;FEV>+r$*XRA9a48jHjZc zJ*1EN@2IpFX8cV2gj4&d7tkt2cT;U;@RCf8xuw=%FUeRhr`qjzxk!fXV{VtAwg#IN zyPc2%VWIW$J4ubZrP(38{Dwp`e%r-w>CmmHC^V;YyhHLR=qrG7j3 zcs%?te@ODxKR|x(+{}6xMQ7lJUUNAE-EQz9%wo?>j3^DqZmpMJYD{j#o(lr|gV*tU zRH^gtWZT7Q<+#4Ki?i;0mi?{hBVX3$LRygDiTob#Wfvmv1%Yu$Tx9#i%_4!X8*Cr^ zqF=y^s)deaikD4l3@&}konLW*a@qb?vWd?qwSM;Z3pQb!nC18v-YQCdj zliQYf`-M@hCX#5OS#LF|ak4b#*Gp!|>B@AIX}aMzYd3todE2va;8KmRi&QdnK_r zgRGb?EM{V*@<)|FbiwvE}pi_Fek@e~D9V)MdrAEI}>z3EThEV&aoZ5wp8}Px@)$ZKZ zuAx>IS#OgCYE6}o+HqbMfGGAH1*~JOW`G!8v9D4XT8LR zjGld?LM%>(pMT^jYHF#YXLC5qVp~oEnp;Eb<(C=-OLHl18^6Ee;5T-wOPx#6;Ma?9 z{a2sH$ z%xiT+YG=P}aT~Xv8_=d8x%FTxR9f(n zQs?EC922v9d|iTfbW-OS%i>e!pZc?$kC*gdeu84!?CyXaQOn#w$0o~hBYNqctA#ItN03*q?}D|wDP zYIajjuN+G@o2TGUgS{Nql{^!07FoPBQ=@3fE9Q4b7-@Sx&k(Qp0gdL})n|cQWnN@` zj9F>16`hw`YD_JC@y5$7)@Z0+#cM2XbC&}45p%7M`o$ZKQBm{?8;lUE8N4J@V{Pe+ zAzqSk9sw%J_q$1snquk~Lu`ucASQSb)F|AP9n*LSUa56$6layX(N5O!DrT6+iK_X6 zJr}0o+;G-?T*Oc59awd|2i^I~Iv(CbD#I5ohLuVl>?dZ6{0zL9ut>l7h)Ce;274v^ zYJM>qTv>d($)a>S%uHU(OpVl~mJ5Dg4Ejr|Luz_k)l^4Kba2asMl=QJ`u^#o)CgYc z=j-J;q^@_L#dF-2Ii#O&X>>hRJ)!bh;n5VgbJ1w|7InQRL#Vw_P@CaL?~gYJYjL+5 zhs5n*Blg9zwX?w7A_p*0yBRgRM|`sij8i(x?hAwIMx!2L-ju z-3^?(Ddw76$fyclT-&u(lD(u-<8Y&PTzLzsDs^oR$CbMJPPRGRtsK`ES6*@Fv;2aN zJ6~yE9}65)+Z_5Tsjywlq~d!87um+}T#>-n4fYcFE!r3mNjIp3S{F6KHfqO<6Q?p> z9AZ&>Ij47Q3|iezKWa{&kW(o+eYVEwizKH-aTgbh&p$(BuT1n>Q))adSyO)Xg;6bA zdN0eGzPg}vy}8kcz3vigdIuKQY7$UVy_}MxWvMqLf?CDt^`N7^^*0nw54O9@=MOgf zS>(J1^g>56%VJv-iaE4ieyNeN)ZYg2t>ibPRiK;mD?ampbK&ip)-0vSRvvA-?W; zjb2evi@9Ba`gJI1=n~{&knkG47)&bxI6;Embh26(wjkxi3ps=U-vBV=QCge>_9(oYDPA8*Z| z79WS0sYMST7a1jUf0YmXgaXYfWO=%mS8A**eU*>jld2d*h?PBO@QNNn%)AEpwFR%> z02mWG8X7ON)VNvl47QEgRfSoc9B!9+26>TP(5fmgwbW=?@(jGxhIj^4LOzf}nTd2JRQ=@Z<;B6!Lo}Az#-Sup?)ytL#-QLB> zYkL9h7J9L*-jXi0mtbnVE{$sQ5**?|-0dPbat|V4G_i)LAK=>YK_k=D*xjVva-6&M!{TiEqq1R#*GkppR}u)L!r~f5O!^w}W{K{xlf8WQvvvtLT<1QIW%E zi>IkEyh(esP-6M=SiTEcKD^mk#%XdEnoI5M!18j|$H_>dW|`V5;V8P+_oqtl<(L}H zOWy}V%qnMi2$?ndOa;fW*X?fNS4g$V?(YLRIE4zFHkQbf#Y;0avNvYWx07ZslU6xo z_OjEQ=AVo&wo!Xun)C7(6PTIlURJ5Gx-@sG*Ybw2dP-w8Zm)qlcWKF_?)DnVUQ(&i zw?yi;k-AWj$~#-`9#VO64PT(>a!P1npvKtJypUc}LuT1MsgeqNjXAc4J^68w{TwB_KQ{!o=wZKLC6i(gh&INxBK5&K3 z%PlqPm3k|Bxee*9_|k&gxvgw@bAVmE=GU9&@H3N9^E=G1kQ!HT_f|xH&7vD#LuC#x z%hb5oq}?wj^;VSeh7gwLD_BMpV)lBUZm~R*r{GV6oq{!v33jkti!#9%PLVTywRbY= zaHJr4He1>}hhL;Zr#SAmTXN(K?5$pG8)BEuj!Pz2+c;zn8l0{w^6yX%$-^&0eAQ+2AQ^JS};|UV=kB z;yEY5d??zk@Q5u;i(%_U_wmXMUXrQtwlpf(OL9o-@T`ku*n7n^uAfn}&?Rre%W#M{aZqDee0i*o6O=`6 zhpFvrCC9SpdUy273|^9{(YoYKcu5ZNCJwkrj-29PZz8AIk8u6SiYaQ;E_oAPenY&8 z85h61&6~*iH3zbrM!3*>Z7?-jm-?l984l@}{*r>>g^L>*G^@qz3FEs57deW}{dGZP zQxsQk5H{1jtdiq#c4Rq?WRsEQ5P#vt8mk8{=0k*|W;VoM;LPU5)&~KV>akwc2h+M3fzHZ1kqG^NSxyWa1z&8;t(t{{33#2yK z%V2GI5K!cqv1#RlgNk=i>b$m>8c`d!TgV=OS8Cn&G8e>am)C7}@_U*0D#!JGFLTYE z&$7KecfRrlg>bvi;x=yY;YkQBERx&u@XHan9 zMAWo~#LG@9#hw|TGJRP~>-7s#yllt$9e41HClRx?4T+a2{Ce>fN-w?Ccv!CydeYn_Dk(eOlV(XduCFIe z+np~sb`~2153RW zF0Yrub2!88tl8PzKw}=W&BgZ(F0$S07LmZ$4faC##a;@BL~&;(lxVM-=4F%`C7ZPS zex=!>C8HRlr$))1jf~<*hxyKOdvoO{#@61P(NoHA+_((d)FoM*VTFi+|3m`?%t%!@lSKBm}RGu_K7HAa@&y|#_j zTQpYV_7AA-UL}(isETASsniHq>PzD#HKZ@iGYe9AMDygJmo?XSOHW25RxP&P8Nsdf z@=J||C4RS!-#rd~55V4Iu8~oD;u?e=@ba5$z5G%mWT`LMw(jh9_V#$tj%OEhd+qOdN=&2&1al38YK8+n~by~BV>lO^XD2s% z*=(zqEf2cAi^rRTwYjZUe-Qh)-DmKtskYl5$y4yB!CndLMNjc%hsL^0UaHBlGkZ?P zOK_*_s7^h}@owt#fINxKuQ$(SYwe8#8?Dn>uMb8U!w@n179^|eDz?P9QtRcH8a;E= z>k_}Rhi-^h@k9r|NO{csl18B0gcf}pof|F3aKZ-@5NeM%+{6E;w!Pti>$Qx zR_MIkQsZpN!fu;|{W-zy?SmuGaF+F=W|nSYi{cuttd{I0l^Ro`ff1cHrg_q_j_|ssEuwLXA)m?n0v9~stkLyut%q@+c zGc^{M?6jBXVbD@rfPa?V zmJJqK>sf!$T;G7cJ4d_VS*#pwE%lnci*eWCNOsy+eCcr1=JIk)j?CGSjnsxF{g05@ zL>|u$w>m4>5pBLB`lexEBW|9bX4&Xl^A!APusdPB=qk3-MWR~mC72qUOW)|>ccjYG z2${p_XB2`3yK&Qd1HUq=hcS|;;7|UI9*HLwSs5|xQh14_#@$lC9)1_9hz;r2^EgiI z+*Y={IcP3{<;5r*e#npCUlHlPiXZJUu)doAh5xI6?Hy!W1FjKm(pRv(D^O?5Q?QK= zQkMD{oaW0Fu!fWtX4oP*R0!ojc->8R9t`K89_CQ=O!0j}aVqy~2_=eO)!iB&o7OT^4C zxdvwz+c3dywU=OOv@TiTZL`2X9=zMl}gc_q8PqjA$x5{$}@q8b{=C%g#;VJ0VBRc>`Zg)xZ_PdI`xY%0X zSX^|gyyQ}&aVfg&wYVYC<=;fy*KkKq_+JY&QtIw zpPRR`=!yld$>Zgj8ih+d^LtZei9>k4x`Jn{$n8>|q3E?dmwCKAQ)6@rN1 zHd=lfzzutm#cP+Tk-Id?!%K6>IJzr1&CrJyr&EL86EPD^8s&j_7R6O&`?Zt3q*7ya zX?{vCsUh=ILa!}(>tL@jlZq|lxJV!PxgvqD^Lc)i;<`btpO1Qk8i`9i)A*G)JmPZH zMu?|7#AcVy9m(1ohu}LFgX~m4>+xyR@BlG0OY(HxMOVB7Uk0zmrN-n^&onQ|A-y7) Uo8+h|CiP5nLRtrLb#3kc0X0Y$ZvX%Q literal 0 HcmV?d00001 diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/dbghelp/dbghelp_x86.lib b/BranchTrace-x64plugin-wtl/pluginsdk/dbghelp/dbghelp_x86.lib new file mode 100644 index 0000000000000000000000000000000000000000..40b3d7ea71d4a4ed913c1a8d33f78ec06cfedafe GIT binary patch literal 54294 zcmeHwd5~Sjb^Zao5bO{IV~lqh%NS#fK^jSh5Hf%yBP@h02`O<1(rD&MGcYr6crzm; z!0ej=1I8dWvG1!v?5hQ4-@!Ip)FzT13#vj4Z|w3##aoVwSHXE+3qE_E$yGy@yZG8^6}{Ds&Y==T*?_S8Dp{ z93n+`;uG}JLQSt7M#S{S8be#-6Z8t?OfNmC>D4L75A@oTnqJ=>`GQ_~Skv$lBBs`F zG#$G$5z{fiVjAi<^fo?0H!Rn5)9;CxZk?~`jB|;Y&RnhO^bJHz-#gsU8~6lW^go&| zxtfUS@az z$e(HKAWc`Hu9&U{4%4-;m+6TuHQjVN+6y!cKVZ6aTTSaw|4cXDsOf=qs9(^7D>a?J z9TC%GZ)&>y9kdtd;j1-0v_BEk1uG2w0-vBC&NuW7K0!~TY)sF-qUpI=L`=`Tr|H?l zzy}?-y`huw2|D%?P2Yu#={VTN^xc;Ii>`BxIXdLy)G`if-&+rLay`v%2 z=W5W=+Zs9xpG?2kwB`sRMX+TJXf5hl(c}08ov^E>Q-6o{23?4{X1W38V!CO2O&d^V zrhETO)1&XBJwZQ4dPP^_6ZAOpXWDpyrWe-0UqH=0G##}A#uL!UPKMUw6LjK#YdUWi zBBt}t()5EdBBrzE7}|hO&^aH{^!+{}MQ`8}bkP(|7o)A1EPhe~ z&^4%6rfb1xy6!?v*B?W~blbg}ZbzFl-EpF(I}ayfx@)qgySGNaV}h+r_w23dq5I)i zphtGp^xUKH7tr(TG~M?$5!3zi4Ly!e(76vAg5BqWZh2GFg(xG_eS?~Aei!2d=r-Un zJyj8Oo&x;@X%%h6C+J7}7`hXmpysWbjzK!6llnECcO}{Z^aC>V9zH>r9j|FUe1qw# zoi$y3BI*-#&1;&jn}T`-U5`3Z^jmy_Zr?@I9owQFnSQ6~&R0;MpnFgrriXXa^vHVD z8|e96HNAlRm|pDDbQ0Q}Y290zE?$6k2VH?WXS#B#rj6UfA3{p zhi45A&K({Y>)vxJG8-5gSyoc8srDNgSkh>5`tCidbVZ>lPWLycDmz~;T08X3#@L*J z!N$CS;l?2=SB^HuMrU+&PqmqDTBEPOdukVQ)gRh~l_O&<#kCijKe~2Ev8zwb9UK}^ z-0IVEhgUW$L3L^JY4xr|p+|LQ@{7e8ZLO}Ls!J_f-8*yTh|X7BYT1gxX779$uB~_Y-O|6+gR3Ep|coewScF!`)xK`;V+D zPF!l)z*uvzZ*6mYR9hB&)jG|QF_g4#e8^bhe+_kd`ucQ1Tr$ftn8Sncn#%YA@7wI* z@u67*t;MZILsgAV5pw4Y4EN1ytQcQ47wyY#ID5@f;e1)~!2`nsvtY;4*1%YUFS@6~ zn>9vSR&f_LdiprQqOn$^2hM06y`V5_#i|3**$+U9vBsgJjg~@m9X2mdN|uVgUQp0I z?-2MM+}v6ha`pE`&2cywS74+Xh(di-caXPBpk+wG&9}`yWqR&bFNMf{ICc2O6 zrpX8mn}?vlRL>_E;3a{j+E?zLDJFgJ=1Q-9Z+SiH9}l=Dd!Wm z#2&Vblqq4HWT~b%@ zpn>{1bogkrG*1#yM+iimV{7%?(M9NE4bSI%wx_o=qp0{=6D~j2Grwmj=!wYGmjv1{ zQ+8abu0>iOCbI9S@kUwcCYORjS|q2Jl7^Kn8Xp-MYz(10`F@SUvTOQMq~hi3K+oX7 zF^vE!6hPOGH5gZugN^1xQ;sR98aWEYBJCi&xR}#yam{%pQ63cu4;`M>=xw$zg#!(v zA2%kF*`A!2Ltl=g!2}YEpsz*^1v9EW-S+lKQfb>MJeeYtA{CDY#t2!pKHKP_9a@1e zvYumCrO;(YtvXSv=$-=7>IPYw>c*N09XQkCwIdBzKCf#erKVJBt`D5TE)6ta=g*4P zuEc#zO3sVS*=riT<6}K5&;^HjRwY)U83i9zH3p-~u?%)qs8a4y@;tc|sieo7L_*~B zdG5^U3la1&6Y6GJ&@bF@xB8CBW`Q1h z7vb&*QLRyN8?y& zWxie_@@Os=Qwf1%xiMQ9krlHb=mLQ?DQO~AWKodL$T6BN9vEsM95yt91qCmp8h!Hy zRdu)AXQ(9`qwzt)@hsRoL7dL11jP;1MU0Ek9_3YS`mXgmOI}ib;M#~jHVk^eN z)jf-w#@9t1r)7@2Br-~6WY|ite{duf98Sw(E=;yHpOYTkb7W)Dc+15y*d=GL!OSu0 z5^q9Dd!|^Vi&{v_FjgHf*ytG^A8{Z)58s?`t8UUIZ@v;Tq=0)JGNOkZsqC}0p6E^C ztQ?4-?{0>qWf32m2ltHi_H*Cn^`UUuqzFu`EDmT6k8!-kD@MTAnrbmrEr}!jSQ?~K zYc9V`ysYFE7H8_jI$c$h)`cRr$zR=~sV0)kUe4N+r0&T?X|iIwF4JR*S-yFzx1vf~ z=r8}uI%z3-mus@3N=}G**xu}wbr$hchNV4&N5X6o@eH_V51UP@n(}ff!8PuvqbEl; zXJ4L3$yMtn!GeMj;Um_sm`;Za<=>8Rks!AMU)S8$CbQ-wQf^Z6EiEwQ*ufZ%E%o+a ztNOTigJ`vd5NT|m^|JQ3MoSMH)+<6Te;*%KtE$C(hr3@d$ML%6JnQ+Z`6=Rju0k^lQ?a@aZ77EiPqMBzJJdsm&kRej8L*UHpgk? zofV3tGZexwO>{fvC90%475-PP3@ESlkt&vYsZ2eFMwwJXYE!wYv~eB{;{;aMRb-&+ z1X@?dc_I@cp-ZD9yn&Cfz7_boJe~$^QE3|y^j(0C>r;ADB!PB#Cml9-MlMoTy-h7e zs~hrMHYH``i5X5bnyq!8t@H-%Ga!bNqrsuWkqjx+ssqmi28LJp>Y>2b-7l-GCBC+t ztx^*3?C=-d;0AoDsRv5vOGmN#Qi@dU%rXdUFhHKNu6Dj?!Lpom4Ge(*%YOQ2=!k}7=2<4nUmp~a&?+c^sg2(s9X z5v`#fzCjT~T~2D(e5n2L5B#FX))4O!=hNR zcx{I6CcQB{UAFNLbBuuvw2mDvKS)YNs>%bsSw5XbUKRP7soYN~nM%ja;GSE^shtIf4r9AeG;Y}0 zE-SX<28Vy#v{T(H8ZJu0zA#s9^r}J--guoBr_u%Ebd*qz(N%x;fy3cCuLXS3iM?Fn zK|Gm_Rzp61@M92<8>@QohQqQN^5KCGA3Ttva=k@qEDH5eH*yv0CD1aY;2X8M!@Yy! zeONqmK^M1rdS!ULtOMx*&7l$OvXQBUZ)D|2`R(yWYi%}NQi>Wopuf?3ByX>qi{MtP zH9j)7s2})!BHUM2(qjg9^x3Uev*jL7Bm~?-da%&CwvQwP3mYTNmRTuq?u*8UhB!p+ zMz@lNel9V0cr~_6m^Fa^kgcGAB36Tkm3jHv&G9k4XU=umwi8U?L{XPMY_xov z|G>WS`}>LBIf7`1L87-_#D4yxh$g>G^!{ZyD}vAWK)=S`?elT==zY+YuM^GrDfWSb z7GiJtVXxuL0_0nR7V^Gq@TNfTN$_`v?!(|M87BHoi)iO#k?t6rVHzTO8?^ieqTk;{ zG#`7(&piWYB+kV7h0}=+{~pd4f&S+r>{q`8XPqu5+WSVL9q+}y_ET`S=rrX00OX(* zj{y^V@t5C%@5ti_>;vD3{PsN=d4YC@{^zil|2KCNO?n3V!9inB5WNdp@+8hBfp&fx z`_(tVhEs{UfxrF)qTjv%`+@g9_LTny<(i6eoR9Jxhwo=1Ki=Oz8F<}S5FIpza$SWq zR|EH2qAij4>9Ffb*uCwgDE~Tr-en!iyYfMz?an896Xkvfc3u52(f$v?jthu>0h<3q zoKXQ?hBCeKEYYmz&;}^;VYuG@IGiT}U4nW%?7P6j^-K8t0P1!%=t-1g>Nx6Rl;~%m z9kFlzLeREH<2(lF_n;%z00(r?TATp^?Fw6e2fO#Z5P6|Jwnw=S+d%YRY&-1S^~Y#) z&_Sr<3pS#yQ7?Nm;VmD^zZ?byeE2mIhp)bU+t7qs0P(BAjJ zUr|>(K7w;CsF!um!;kJmo!t*xKo6e_Y|xwV1wO+x2-&;vhrN;K-cNxCn)4I*2WX!k z!52Zd!j`?+Cr^T%uz?R#yazfS{{Irnxii}JM3nP2lyeHoxHZc7ThJ~jc z=|r3p8ONC!d~P@%g&}l;KTHJ`V{>&ol8&9`6%Rh^g(LTD1Dk%)6uk$#%P@W zmDbQ&I);v=EGxA`U(95&7^P8 zUi3AZMZcnx>DRP7&89EW0{S9#(G)s}cBU`WI=YztncksG=wO;lm(pc)AKgnoq^Ia` zx{#ixi|85Zr9NuVN;-uepv!3Rz<=n%Sl=FZ~sD(|+_AJx-6%qqIM* zqJ8Ku=?FTK`e}fEL~qhv^!N0A`X>E?K0sU0mjBmM|0`N*5`COLL|fCJ(Dw96+JQbo zAEiI1PtcC^r}Qz}j<%s~>CdP=t*vNT@&JHZStKR;){Iwt@^FRtuGh`Xh$9asFqjr9 z%(MtAR9@=jgsx06WcA2wc6Hpze>TlAG<&{Q!qGTVPDu|9ai%lV2^?JBCi^Qj(nQ{)(SGf>5Hdv*#7 z?$SbDw|%%}A>x|oN%>YKahGB5!O>0md9D5Kf8!QHP2kP|wHEE{kJ)!FBFSh4p?-S~ zgR^up{Y*GYVm4lTd|eLJ9_FrHJxow+)DO3ly_;8Kk^7o?#>_q0*$H(W1n^8V+{EK% zUxGy17nFTEEAY^TO)>asn0`7f8UB-IPOJ2SCnuKgp~(HPWZwg@U{AG#w=Yf_4vtJ>_3m=5I-Uve-J4(;bF&HhSEZftaiPh-Ut}{Ip0z>Ujt30^+Zu<>0+%7X`gkwrDH)~YG zHmA2wl-aMm4wII8;5M;IXxr3fTRj3!h>(?SNu5AG&lSEC3z5`i=msHFxfx`*@QyDU z!f=h-iaOKUa!k>AgszDUe9r_U^g+XNE(8W<1|ADUA9GCEv3LTjMl)fJWXm>SetAy` zU|>mnx-i(+2{p&De&ZfCaoy_Xa=fY)90zLxvy_lLyT0)D4OFe-F@damnBt0U9Vnk* z<@abnPqYtTR!36Avo*e~*y$)fKUGVg7YU!Ixqco>s&OIYi=m+sRdbQ|5H8L+saC=0 zZm&+Rp%U~rduELvONhO;O2MCKjJHBDn16JugI^6#y6b_FIG+rz-Bin~ZC5zQSF?ZB z&N6{N8yQDn1vkps!Z=>lkk}&8#t~MwT%8BiOC0PFu}_`TBHI^&WNq)^h_iJo*&xpb zuiW+MuO;HZO;sJiVOHB=kU*Rk)}V$VYRI00vGs3`?r?R;ylS530bXJ+m)i4Hxqy7e z%dV{_UCCt^L@v?kR#n!NKo>asG`RGJnhCrL$DGYi#YoMg03 zB#vTkp)5YD<3-xs)9G9kPG`7@SX`wP@A}|@&qxRK+j2Jf?i)WkrxRD*r8c*N#gUL84%*$H(ois+>X?#7C5ebEucO!E8-9ducR2V`Q5e#V)z zFE-v7YU==FTvNK4u>mPjEk-6Ikg05q92wX-2PwH3Oa_oRuh$Y4Ym5^pwunr6a6*{N zF;NB?k@Tj1Q${Hl6JJ8=&(>1G*oo|;Dp1)Qxmt^PCP^u0Urer7Y&Lx~>-(uAaZoob z4`%K-gFqpXg_zsDp^3A1vT)lx0w(GX$FsKz&xI&Z*0(*8wqhsM2QdItH*KEtF^G4s zgyhmWZT!Hk-Ozd!*Bkvc+Xa4H%T)28uxQz+sY{wtNyJV|3HVmP%CU~(X5c}_kE2Qr z@2=JF1W4~mgBpOCv#y#hbm2hkcYr_``M;2RE#}WjIjvxd5^5suDl4I~L&dQ?p9s>b zf=Zt;au@Cjv#p{kDL&^GG#Hn}#l^xzRV*gOPh{r8vHvQmgs~sFh^|ag1y1DDf`Yr~u2fdspwqFki-Cj{;6!nO+}!U^o1CK!-?HZ? zhJdtAqG&cF7YFt%^5wx`<)J_p_)#4E^~XA!Tn3L55H1>==-*~^RKt1bCt~DGIG>P4 zZUkAnI~hUfu3)Eoj1eUCWmMU#avN}thY((ZRC9qpTcR$dFm7p<+Gw-Hs{~lwhxHdk zo^2`@ZT2h9@dIym5oK;c=_XF%`-bDAT;AeTN_2GEmdguA`__0OlunK)A~@~aBLw*~ zhk>clSj!9*#k0kXMo?z>D#^&U%^(@y7E=E`OyK}p1+J@Op}x(bl!tV$wkm~WK)aT* z53Gm6{M*~CeSF(1;^C6-Efu^zheV#xuWm@IfnH9mV25#Xi55r8lTy8S^y&~9+r<9b zB2sg6hwL_-ft3Wdgt2s2C?N?3h#;74oDyN2r*uQJ!10q+Ij zhUdSwTr;!pf!E^T4eZS}Ut_Klk0xFg&%wCl>)1zG0;|RJIBMQtZ*p5ZG-}>6uNmTv z@~%2XMT#mkm1p0OFDuNis^DerRrTOgy$~0prmd2oGThf5eyGTIHeLlN0|V1Nqbqaq zSsCg~%>KrKv2ypm!9jJ*Xj8vd)V0?%^SedMx0$!aR&?#+k1zZP&Ms_C>TiqP`}iI4 zQx@s3gnjim>rj0$pWQTR|J?`r@ZPT}Q!CN-xOf@#E5q0dpWU>_Mx!^wu(5-i=ntSu zkNMp+dE=J&+zvav`R^mbs4vsUCVdz@&X4~-0{Z12wmW#Bx78eNt{j`Z%fhcro;P>? zx0E#a$6%b0Gr$oXbu|h9Kd7z*3U&8lFD1(Q%RjtGe?a*(9H-zvF5H$>ncR)jDa`4w zILbIqu~o(CVjVD?&UD9N{$&1V{x~nf;STq=B@T-aq6-sv0+@A_ZG^dPdCJu3)h}GJ zr);S_1qXXnW#A*}DSgfcbtODyS|wsnxuN=EKG{?LC?3#GyM7jh$o{xU?OL1pji`V9 z900nJ)3sLUU(>6KVprt;CI3YK>Zikd~Vj-ZMR0Vj##%wr&kp^nSWo6JLkMD zc+}ciS@+SxxekFu;<_#GpT3uA#sKxpK-~hPSo$=HS}O`Ds@?0lGS+?uxLY!A@MvCw ziR-p(?8?~49b&5hOD$goKz++*?3u37uK?|X6`G3F^R2IahlgIzb%b1M%Mav{c^%mi zZpq>g<#9Pe(JAuObY1U?y8dtpIdWi80d4uzi~{o3d1Q6_?HgSedHVFU&0mDgf1;3+ z8$Se0eV?9ge-qLln|1=`HjEiP9txXQz_(Su(`TfuoB~8X9~UFSo$y3Q;K=LtFlVMQ zzXZ&WW-!&=oCK{s5|%9e(+V|sa@KL}W=3D0Yqrf`Zif2JjKe(F{8<)tGt_WqME*Q* zCsnxa=^{T6>a0Zze)Q))o{Rc$9JMplf|c7bD#z#L))Bw6)b`sMnK5BE)au6!UTJHU zG*(=<)l*BO@Aiyc+^{9kWR5@JwuiL_$QH4Q*_5D}T zOFzw+<;{S?#0k`JVGjR{#!l`rl%V3eEqhCA;Lj?|?9N32H33^Q;{vacJ|}U#4UrO3 zT(@OusbxRUh~;gT0&W7$WT{-79`UqM1FRBLCX`r8EZZ zB(bWUrV_0F7+aXLzv!b?8(2HTE414biD&o4N;q-dR=bt@;+GU!cDJp7s_&gMGFI*a z@7!7AW;gLlU~%1^y@fI0%Z#g6d%@OVfl}LBOZS4iBoU(<-`YM~8h5^;F-!ZHrMb1S zrx*Imt_Is%4#C2QV)0LSmKLxM-s)xlJC`9h^x;>=K-51uakrm*KO5j=?-t2L(7~K5NOhs+Cnb%!!CpD zP9JoFREqdduaJ`OKIsTG6ScAQ~Q!;=yn;brbXz5u+L2|RR*4kIC@e(?>1=pE~j z=GC4f?Bm14T6nJzEiz6(x8; z-4auuL=xFgV5Tap68H15ssm1);T1->{bM{11a>&Wm11)Tq!2qFcQR{6eqt~yMihs< zWYvo6w!Efv2RS>73S<36YyFX+Fv`w}aXTIbN;B3s1s-qiR`1>t6*+d46VE`W7QNzJtusLgZeg>7d*a{qZ-JUNMYWUk3Os?U;)cQ4?nWgy& z_<|g6XzXT1U1(6_4F(Tai9*XR7O3F^|4ywft>X{P<92RuAtt&+;EKoZ zf5eE>(j=lfPAt1?Z4WNR3IDpn#L>R$l(Ga9*KLgrrM1G}1Xxk?)we9;ue^8eI|9uf zsTSr;U}aK>G5u|b78xg?+p5Xwh0*RX4{Z?lUDY9_j-!)>ap&)HsIb)!iq^HY3@X!YH^ZgV}knEsebc4wY-ye;b4_Zvyj6#;bYnY=0WH^VMy^gO5mK zCYJKT?6z99v^(#}7}YTD%ZdIE8jk80n!Agfkfx8=#D8FwVc>u}_sUWnzkVl=K#f2yh9 ziiKF?n2%`RNg?X6{v1Veo3#yB zr!YIM)q;&{Lp(nH&o=rYsroh+T5?SaGhCR|M=ZoPk4+)6_XK9v_SZtZ;+Q06Xl7l+ z(w*6N9in}ok;uPx-!I)O9WSs(_{X6~@jg)rR=fR5mYv|x?8}!Vn7D3hoGDp$Vt^Ih zmesbbG)tT$(Cj-sLMN$@Sn$h}Q;5+Ly>5+`Y&=CE+E+?-{8Y2F=jYTEqW88eVV`u{ zw!Ejbr}4BR@@DX*!Yc0c6t;b}S0@&io~)jcMUBExo7IocOyL63UtkHV+iTm*ZU8=y z`@IlRzPhaA^?Avk&nh8D)m+!+QXJtNfgHYyP2kk-L!~_lXD2Z`o~sM%gL5N9bE6j= zITjYTwXa7b!=T>&HO_TO}su(ILHLz5QTNZg(<`+;3DAL>k)-}k&7Ine4SzEPNe_a|g zny72rS?Grs`83n`yTC(6fm&AD3RTkX()b1Ol72l-}(SMC(XEqjM5tkW6_ZG@O z=16*ZgcdEJ>(^%?vU7#ObFaU|y=#Xnol>N1eS{Y-Z$v}3*Y69~T^XUlJv%(LQu5BL z5_r*;)%xvM=z&)oMDInUo%g`P=zUEJ5l-rdb!xX_VN|i;cDrjk}xNgg%OD9O~_K?(1EsE^xk4B}H)CP+s-&-x=#C2Pi zmCgX&xRt=A1xZ&GZ(2N9GeH>icTx4&@~ut>byD^c?b4i#3QhOzVwq@g_H6YI|*% zx!>jIkgp^VgTPbmwkz%9eU0%_KVA|Jsr69{v&ZW>)Tmq5uG_*${)R>!>WSZ#=x^k$ zZ)>4f{*+PkzwaUpoIpRxjIukxlYYjy_IFMsjJR&gUrUk8pEHX44Hc2~1gy!7;T-XO zlW|P$o%V-mnb!IkaQZfHotFg?TImfR5fl + * + * Jansson is free software; you can redistribute it and/or modify + * it under the terms of the MIT license. See LICENSE for details. + */ + +#ifndef JANSSON_H +#define JANSSON_H + +#include +#include /* for size_t */ +#include + +#include "jansson_config.h" + +#ifdef __cplusplus +extern "C" { +#endif + +/* version */ + +#define JANSSON_MAJOR_VERSION 2 +#define JANSSON_MINOR_VERSION 9 +#define JANSSON_MICRO_VERSION 0 + +/* Micro version is omitted if it's 0 */ +#define JANSSON_VERSION "2.9" + +/* Version as a 3-byte hex number, e.g. 0x010201 == 1.2.1. Use this + for numeric comparisons, e.g. #if JANSSON_VERSION_HEX >= ... */ +#define JANSSON_VERSION_HEX ((JANSSON_MAJOR_VERSION << 16) | \ + (JANSSON_MINOR_VERSION << 8) | \ + (JANSSON_MICRO_VERSION << 0)) + + +/* types */ + +typedef enum +{ + JSON_OBJECT, + JSON_ARRAY, + JSON_STRING, + JSON_INTEGER, + JSON_REAL, + JSON_TRUE, + JSON_FALSE, + JSON_NULL +} json_type; + +typedef struct json_t +{ + json_type type; + size_t refcount; +} json_t; + +#ifndef JANSSON_USING_CMAKE /* disabled if using cmake */ +#if JSON_INTEGER_IS_LONG_LONG +#ifdef _WIN32 +#define JSON_INTEGER_FORMAT "I64d" +#else +#define JSON_INTEGER_FORMAT "lld" +#endif +typedef long long json_int_t; +#else +#define JSON_INTEGER_FORMAT "ld" +typedef long json_int_t; +#endif /* JSON_INTEGER_IS_LONG_LONG */ +#endif + +#define json_typeof(json) ((json)->type) +#define json_is_object(json) ((json) && json_typeof(json) == JSON_OBJECT) +#define json_is_array(json) ((json) && json_typeof(json) == JSON_ARRAY) +#define json_is_string(json) ((json) && json_typeof(json) == JSON_STRING) +#define json_is_integer(json) ((json) && json_typeof(json) == JSON_INTEGER) +#define json_is_real(json) ((json) && json_typeof(json) == JSON_REAL) +#define json_is_number(json) (json_is_integer(json) || json_is_real(json)) +#define json_is_true(json) ((json) && json_typeof(json) == JSON_TRUE) +#define json_is_false(json) ((json) && json_typeof(json) == JSON_FALSE) +#define json_boolean_value json_is_true +#define json_is_boolean(json) (json_is_true(json) || json_is_false(json)) +#define json_is_null(json) ((json) && json_typeof(json) == JSON_NULL) + +/* construction, destruction, reference counting */ + +__declspec(dllimport) json_t* json_object(void); +__declspec(dllimport) json_t* json_array(void); +__declspec(dllimport) json_t* json_string(const char* value); +__declspec(dllimport) json_t* json_stringn(const char* value, size_t len); +__declspec(dllimport) json_t* json_string_nocheck(const char* value); +__declspec(dllimport) json_t* json_stringn_nocheck(const char* value, size_t len); +__declspec(dllimport) json_t* json_integer(json_int_t value); +__declspec(dllimport) json_t* json_real(double value); +__declspec(dllimport) json_t* json_true(void); +__declspec(dllimport) json_t* json_false(void); +#define json_boolean(val) ((val) ? json_true() : json_false()) +__declspec(dllimport) json_t* json_null(void); + +static JSON_INLINE +json_t* json_incref(json_t* json) +{ + if(json && json->refcount != (size_t) - 1) + ++json->refcount; + return json; +} + +/* do not call json_delete directly */ +__declspec(dllimport) void json_delete(json_t* json); + +static JSON_INLINE +void json_decref(json_t* json) +{ + if(json && json->refcount != (size_t) - 1 && --json->refcount == 0) + json_delete(json); +} + +#if defined(__GNUC__) || defined(__clang__) +static JSON_INLINE +void json_decrefp(json_t** json) +{ + if(json) + { + json_decref(*json); + *json = NULL; + } +} + +#define json_auto_t json_t __attribute__((cleanup(json_decrefp))) +#endif + + +/* error reporting */ + +#define JSON_ERROR_TEXT_LENGTH 160 +#define JSON_ERROR_SOURCE_LENGTH 80 + +typedef struct +{ + int line; + int column; + int position; + char source[JSON_ERROR_SOURCE_LENGTH]; + char text[JSON_ERROR_TEXT_LENGTH]; +} json_error_t; + + +/* getters, setters, manipulation */ + +__declspec(dllimport) void json_object_seed(size_t seed); +__declspec(dllimport) size_t json_object_size(const json_t* object); +__declspec(dllimport) json_t* json_object_get(const json_t* object, const char* key); +__declspec(dllimport) int json_object_set_new(json_t* object, const char* key, json_t* value); +__declspec(dllimport) int json_object_set_new_nocheck(json_t* object, const char* key, json_t* value); +__declspec(dllimport) int json_object_del(json_t* object, const char* key); +__declspec(dllimport) int json_object_clear(json_t* object); +__declspec(dllimport) int json_object_update(json_t* object, json_t* other); +__declspec(dllimport) int json_object_update_existing(json_t* object, json_t* other); +__declspec(dllimport) int json_object_update_missing(json_t* object, json_t* other); +__declspec(dllimport) void* json_object_iter(json_t* object); +__declspec(dllimport) void* json_object_iter_at(json_t* object, const char* key); +__declspec(dllimport) void* json_object_key_to_iter(const char* key); +__declspec(dllimport) void* json_object_iter_next(json_t* object, void* iter); +__declspec(dllimport) const char* json_object_iter_key(void* iter); +__declspec(dllimport) json_t* json_object_iter_value(void* iter); +__declspec(dllimport) int json_object_iter_set_new(json_t* object, void* iter, json_t* value); + +#define json_object_foreach(object, key, value) \ + for(key = json_object_iter_key(json_object_iter(object)); \ + key && (value = json_object_iter_value(json_object_key_to_iter(key))); \ + key = json_object_iter_key(json_object_iter_next(object, json_object_key_to_iter(key)))) + +#define json_object_foreach_safe(object, n, key, value) \ + for(key = json_object_iter_key(json_object_iter(object)), \ + n = json_object_iter_next(object, json_object_key_to_iter(key)); \ + key && (value = json_object_iter_value(json_object_key_to_iter(key))); \ + key = json_object_iter_key(n), \ + n = json_object_iter_next(object, json_object_key_to_iter(key))) + +#define json_array_foreach(array, index, value) \ + for(index = 0; \ + index < json_array_size(array) && (value = json_array_get(array, index)); \ + index++) + +static JSON_INLINE +int json_object_set(json_t* object, const char* key, json_t* value) +{ + return json_object_set_new(object, key, json_incref(value)); +} + +static JSON_INLINE +int json_object_set_nocheck(json_t* object, const char* key, json_t* value) +{ + return json_object_set_new_nocheck(object, key, json_incref(value)); +} + +static JSON_INLINE +int json_object_iter_set(json_t* object, void* iter, json_t* value) +{ + return json_object_iter_set_new(object, iter, json_incref(value)); +} + +__declspec(dllimport) size_t json_array_size(const json_t* array); +__declspec(dllimport) json_t* json_array_get(const json_t* array, size_t index); +__declspec(dllimport) int json_array_set_new(json_t* array, size_t index, json_t* value); +__declspec(dllimport) int json_array_append_new(json_t* array, json_t* value); +__declspec(dllimport) int json_array_insert_new(json_t* array, size_t index, json_t* value); +__declspec(dllimport) int json_array_remove(json_t* array, size_t index); +__declspec(dllimport) int json_array_clear(json_t* array); +__declspec(dllimport) int json_array_extend(json_t* array, json_t* other); + +static JSON_INLINE +int json_array_set(json_t* array, size_t ind, json_t* value) +{ + return json_array_set_new(array, ind, json_incref(value)); +} + +static JSON_INLINE +int json_array_append(json_t* array, json_t* value) +{ + return json_array_append_new(array, json_incref(value)); +} + +static JSON_INLINE +int json_array_insert(json_t* array, size_t ind, json_t* value) +{ + return json_array_insert_new(array, ind, json_incref(value)); +} + +__declspec(dllimport) const char* json_string_value(const json_t* string); +__declspec(dllimport) size_t json_string_length(const json_t* string); +__declspec(dllimport) json_int_t json_integer_value(const json_t* integer); +__declspec(dllimport) double json_real_value(const json_t* real); +__declspec(dllimport) double json_number_value(const json_t* json); + +__declspec(dllimport) int json_string_set(json_t* string, const char* value); +__declspec(dllimport) int json_string_setn(json_t* string, const char* value, size_t len); +__declspec(dllimport) int json_string_set_nocheck(json_t* string, const char* value); +__declspec(dllimport) int json_string_setn_nocheck(json_t* string, const char* value, size_t len); +__declspec(dllimport) int json_integer_set(json_t* integer, json_int_t value); +__declspec(dllimport) int json_real_set(json_t* real, double value); + +/* pack, unpack */ + +__declspec(dllimport) json_t* json_pack(const char* fmt, ...); +__declspec(dllimport) json_t* json_pack_ex(json_error_t* error, size_t flags, const char* fmt, ...); +__declspec(dllimport) json_t* json_vpack_ex(json_error_t* error, size_t flags, const char* fmt, va_list ap); + +#define JSON_VALIDATE_ONLY 0x1 +#define JSON_STRICT 0x2 + +__declspec(dllimport) int json_unpack(json_t* root, const char* fmt, ...); +__declspec(dllimport) int json_unpack_ex(json_t* root, json_error_t* error, size_t flags, const char* fmt, ...); +__declspec(dllimport) int json_vunpack_ex(json_t* root, json_error_t* error, size_t flags, const char* fmt, va_list ap); + + +/* equality */ + +__declspec(dllimport) int json_equal(json_t* value1, json_t* value2); + + +/* copying */ + +__declspec(dllimport) json_t* json_copy(json_t* value); +__declspec(dllimport) json_t* json_deep_copy(const json_t* value); + + +/* decoding */ + +#define JSON_REJECT_DUPLICATES 0x1 +#define JSON_DISABLE_EOF_CHECK 0x2 +#define JSON_DECODE_ANY 0x4 +#define JSON_DECODE_INT_AS_REAL 0x8 +#define JSON_ALLOW_NUL 0x10 + +typedef size_t (*json_load_callback_t)(void* buffer, size_t buflen, void* data); + +__declspec(dllimport) json_t* json_loads(const char* input, size_t flags, json_error_t* error); +__declspec(dllimport) json_t* json_loadb(const char* buffer, size_t buflen, size_t flags, json_error_t* error); +__declspec(dllimport) json_t* json_loadf(FILE* input, size_t flags, json_error_t* error); +__declspec(dllimport) json_t* json_load_file(const char* path, size_t flags, json_error_t* error); +__declspec(dllimport) json_t* json_load_callback(json_load_callback_t callback, void* data, size_t flags, json_error_t* error); + + +/* encoding */ + +#define JSON_MAX_INDENT 0x1F +#define JSON_INDENT(n) ((n) & JSON_MAX_INDENT) +#define JSON_COMPACT 0x20 +#define JSON_ENSURE_ASCII 0x40 +#define JSON_SORT_KEYS 0x80 +#define JSON_PRESERVE_ORDER 0x100 +#define JSON_ENCODE_ANY 0x200 +#define JSON_ESCAPE_SLASH 0x400 +#define JSON_REAL_PRECISION(n) (((n) & 0x1F) << 11) + +typedef int (*json_dump_callback_t)(const char* buffer, size_t size, void* data); + +__declspec(dllimport) char* json_dumps(const json_t* json, size_t flags); +__declspec(dllimport) int json_dumpf(const json_t* json, FILE* output, size_t flags); +__declspec(dllimport) int json_dump_file(const json_t* json, const char* path, size_t flags); +__declspec(dllimport) int json_dump_callback(const json_t* json, json_dump_callback_t callback, void* data, size_t flags); + +/* custom memory allocation */ + +typedef void* (*json_malloc_t)(size_t); +typedef void (*json_free_t)(void*); + +__declspec(dllimport) void json_set_alloc_funcs(json_malloc_t malloc_fn, json_free_t free_fn); +__declspec(dllimport) void json_get_alloc_funcs(json_malloc_t* malloc_fn, json_free_t* free_fn); + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/jansson/jansson_config.h b/BranchTrace-x64plugin-wtl/pluginsdk/jansson/jansson_config.h new file mode 100644 index 0000000..0d8cd11 --- /dev/null +++ b/BranchTrace-x64plugin-wtl/pluginsdk/jansson/jansson_config.h @@ -0,0 +1,68 @@ +/* + * Copyright (c) 2010-2016 Petri Lehtinen + * + * Jansson is free software; you can redistribute it and/or modify + * it under the terms of the MIT license. See LICENSE for details. + * + * + * This file specifies a part of the site-specific configuration for + * Jansson, namely those things that affect the public API in + * jansson.h. + * + * The CMake system will generate the jansson_config.h file and + * copy it to the build and install directories. + */ + +#ifndef JANSSON_CONFIG_H +#define JANSSON_CONFIG_H + +/* Define this so that we can disable scattered automake configuration in source files */ +#ifndef JANSSON_USING_CMAKE +#define JANSSON_USING_CMAKE +#endif + +/* Note: when using cmake, JSON_INTEGER_IS_LONG_LONG is not defined nor used, + * as we will also check for __int64 etc types. + * (the definition was used in the automake system) */ + +/* Bring in the cmake-detected defines */ +#define HAVE_STDINT_H 1 +/* #undef HAVE_INTTYPES_H */ +/* #undef HAVE_SYS_TYPES_H */ + +/* Include our standard type header for the integer typedef */ + +#if defined(HAVE_STDINT_H) +# include +#elif defined(HAVE_INTTYPES_H) +# include +#elif defined(HAVE_SYS_TYPES_H) +# include +#endif + + +/* If your compiler supports the inline keyword in C, JSON_INLINE is + defined to `inline', otherwise empty. In C++, the inline is always + supported. */ +#ifdef __cplusplus +#define JSON_INLINE inline +#else +#define JSON_INLINE __inline +#endif + + +#define json_int_t long long +#define json_strtoint strtoll +#define JSON_INTEGER_FORMAT "I64d" + + +/* If locale.h and localeconv() are available, define to 1, otherwise to 0. */ +#define JSON_HAVE_LOCALECONV 1 + + +/* Maximum recursion depth for parsing JSON input. + This limits the depth of e.g. array-within-array constructions. */ +#define JSON_PARSER_MAX_DEPTH 2048 + + +#endif diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/jansson/jansson_x64.a b/BranchTrace-x64plugin-wtl/pluginsdk/jansson/jansson_x64.a new file mode 100644 index 0000000000000000000000000000000000000000..a2b6376fec0650a37dbdfed84df0030f65ac53da GIT binary patch literal 50726 zcmeI5Z-`w-6~HHN(|R)5?O94_ zp4ugZxFp2xzY1~lq7ZxbQ{4NW5E$?5Q``^f7!Ul0;(cEb0^`9w6c7DU2#gP{Qas!e z0^^atP<-S^LSSq^PjUVxAut~O1I5Q+Ka5WtqWI*WguwXJd5WKe^I-fmoCD*tCnF@f6|NEES*Qz){R0#S ze-r}a=v9j69u@-Q`9D+q%4owa^zx7i-Ow3TIuXaol!QfIJ=!)+|RuVDQ{f~9N%9! z6wh-DM=w9Pb!=~?l^(N~^-qsiOAf0t*!f){bzZpKZm+ko)LGf=FO4j*LY6$*Fzfc* zwqU773TlEMPRd|fE>X;-91SXiODD-a@eAKmewR5Li)XT>ac6U|+#P3~^|jFmK;)w3 z0ww!q=hsH#%AIowcW>_*seI}pMr*HHKOmmWk12V|zMQu|s}{Wr62~M;_Aa?3bzJ+J zvTV6j6q5N-&t|W5#v7fraW*Uw=ec|@6nD{4gwzFS9J8u!lPbKr5 zJ>b$y3M9{hS&n?ydwj?#N_&oM$(^=;GwO;ll^<<6>y;b~Q@PYqFYA`I52Z6n_gHkC z{^t5(S(91m@;Lp?o^?g?yUgirbeAoyLJ4`^3O_mKt|K$`77Pt$hv+?ko#sYZ+5Nf zqy(9_ytzKG>XQ=kJgYu2Pt_-GI(23e^ZiTfOv>4H2C!vgs{ks6j+AAC&eF!f`ZX=* ziBhJREx*g0?r_+BrBhUpER{=<^5gZa1XTu;9cJqr=d5ccQI*al*ZQMuD7C74V3x=B zDEx5g!1?c%zJfZ+`j&#V(%I3RpDqcqUoItd2Lm`FYJc}SS)MtvBPNz#?w%P>Z{#;P zzB`+lR%>Blq1l{2rfzKD&Sv@IwE{zP2i)7pt!u>e7`1M7Xo{1krlFJWR*Q)f;^e#2 zi=)vNV&VeIt>FO=&1qS<6%ae&x_CGtT3T*ir=#3%zuZwR2e%PoZ;71F*Z-9rKfMeZ zaat-V%K6XxLY&^Q(mk7LN&3(03lBe4I0s7cx@!1jSUpYoWLO>TlrmU)JE(e;^>Ynm zP3`c?$htuSrgmWMxB<_B0c9HE4)}EMbCAE)3HV!>1qfv@{4GG8-GV0)J3nat+VV2s zV=rC}T-QF;p4cX3{AqdqpULGs^L)LHa(cV?A6sNf;3xhvr)2%yD7QkWT$T5rAPzyc zuvi(dZuZYoisZtoX)NSbAXnBdk&E?E&-UL0z^npA@$;Snw z4|6?-wK4}MTVdxFM$Xck$3SLKE|+tQ$!5doL1~@CZ+Wgs_pb>2DWglq~fm?gCP~Q zrVb5(6-A`#(sEAoG#{mNft0rA97>Z;J(N>gN2i{kb~A&)(2_BedYgjMkovI3RF>=* zd`ePHi5aRa(Z}j+AgePjt4X68R>4&@u||E8x14Ovcr_~Bzi^Fu5K5#&L!jx)IOR9; z$}dy2S@S->9Y|=)wNPJ!esHTk|9RF|Ud=xLOYFQ=eg0~>oYUtI%jI%yiuY2J_W8%D z&7^lMW-W@pP7Fqi-b)GcvmwAK%Sy@=DESF}x^pIw%sD>hMAqmfXsxZtJjGh{YLa<| zowth2ak-pB=IiBhIho*6o|w!hsJ)6V*{J*ayA+d#(!44mry-u!lom_PfOWEb?6v~g zopH5l>i12*U*}Hhaf{u!?bBNwW)G-3>t1MsNqhc}^Hx)C@0cxsI}k?*Mz><0uR}u|hfT(*>*yy~b-It(V}ZoZx1Brx zZ$dA*l|``3deW3_A zQbX?J8e90^5TAihPOepQ$1L89;27nP%qZJdncCkuHkh*w8f-)_gJy@^0|I-bBlct2BUY;f2Bi1JPVrz zZu63ts$G-ovmQddTgewIn}Ljod`?VmJ=F0V94)pboFQg=7keHIhTg-JAU~NeR@t?M z34uJ-M{B5;Yu2?9(&(4bxp-$Xsm@)nXw|ds<0ckI0Wlb2(PyATLp%kWT;J+aySg^d z@sS(q^Rnh@rE%NhxI!Ir=dCtW4|+h$#;j}aRFE2STN+zgvJ>#h$=&L?7q68Y>IqA} zT3P=-`=E}mc8<58Y}IYxt0gPIy%}@n7iwSaeDa8uk>`wm{XaZnvx?BdV{cJw)^Lwl zq144iGy89|){C~RpY7@KcIn1~%g5bL^R$_)MPxa6`7wQ{JGhr)ft>eF) zVYK3XbIi6Yj+J0AwyS3*Z2tUnkyANx;G;CuAC~5B$yV@LtaavYwG5?E6B;~s3kl`6 zDt-5n8S3Fm^Is~-tfN04Au{ze`l#s)p8ujt%hYF{TmgE+4o1O3ZAP|kh+#d5j) zUI}L*PdfJhF(Ol~tx;Gl296iAHF_UbDgR@O-4KMf3HE;^w)j=ruf}7fXkRcn&s8c+N}j1=>jXh)zB(S-e}nTGFO?F)?fAU>}#Ic)3AQ$nbF+>f=f?56k$@EejlhoYb;7Y;h|WFp8Sl;F*UC z&Ek?xR)x#94dLOV>x`p=9N~=%4gZdt#6yMwzwr+Z8^XwthI`wYdJU)KB7bY zU};`gCDC;(hlk6EhO@+MIRww^((0B-E-@Vx!QR;iv!On*WII%nTgP^Is6Z|(xf(UK z6Wb0IYtQ=TbIpc&$I?>^mAuw@YT-ePSH9+N+}s8~wV<>uFS%m2FO5YNCSA2(wqcOmAPK88a*ZRxpP*$9PE zwS3e8wa=uZ4u{;9)P`Qv7DVuKyGj#FOm)dU6zADKjzj%&bFLrb5;W>oez{Z3pLI3; zaxtt(^I?}`xk`V`_iorHVKDxS{HG474e=@XboB6+?=A4!!=YZdw4M?+O40kAH%*=O zln%P>h_8%@S_22q9_JbuOYPCVGRvoVgZ*u;6`VA$v4ZQ2n%(cR3-2$9o83uA&7}2E z`92q~)=eI_GHvS2<=JWl@H(SrO^4jLshxDx45{^KTmL9;sK+fmr&GptZY9)NCE-4c zSA0KA+`Qs%7K5>GJ*y-r3!(6u9G>d43qrkViB{PXzLAAGwBBpcitiWOUbJF~T~k)3 zdT4EjdeG8}i zV4Z4}nAre!x=*Kudc)FlXO+a(dG2h#CKlem7&EEC&z+UNd)GHs)eiM<&A9%p3!qrG z@^5XI_kY#t?e8Ko@dd>4jixcvNpE}Qy?s;ulIf!%TCgGgT2xx5KvjZIbB21b5}&fF zeSLi$KKGdxTfu{G8$PXfW+R`F;NvsYOO^P%;(Xp|_*~ppd@k~vCFBzle0&D`qTIL9 zrFG|x7q!l4=^cj8j(+iX%sMpq&54L4mAKH)t3)5Gp?;{eifpAWt>f{(ow2&q?e!LM z@d^kr^BVkwt>iT?b&*+<;o~;cBbB(l;@s{fZrA$b>~uC%FB94>+}fpP+!iuC+|Gph zrqa`0mE6`DN4?GF7N#M`t!snlsc1B@#3jVaWFN1=o~iVPMFiG27Eot}xjh!IakCn{ z!kl8Ygj4VR)=a2xDvbwJ>eM>pRksqOE8X5G!-L0cy9SS^QfZkcRS7;F8tREkd|q)r zZy`Rjmp5Tq)$PJ3m6q|T5`26ne^eQFb21S=^!q-~QRnXM%?G&QEHU3R1&{YjH1kpy`u>i|@NpaJr%E%VE4i&> zqkc$noAt6W-sH#3Yw!$dc)$cp%RyBsK0-r1QppOaB(#nduuBt~4LVC319;*;Zc2l_ z{>zyzu?1?L=wY=L>V-;kqbpghGdKDMVpU=qvnIu!1cQ0j1XsV+p&_PWQ_en>C1rTh zcORLd{-*S#sjTWNc`tQ6wO4mI?7q^Wg|nmX>(NJy!4T?sE}E5?amrJDw1#?~(%qD7 z2_LO>?xwD@XjRMY!dYV0slj(sicNQs;X;Ow+fa{GdYZ42+d8vQuI1bgv-OR0S=7wp zZx@5nve@(M&=ALAQ`!N9rYfeEVds;@Y)4NfdAeiJpZ!E>rfkvhx$Sjj$K zLw#AvmaXKqjxD=`^V%H@K*Qo2r=n(dLR*%V+R?N;&qr^lpDWE~t)#b(Czjtyk6K2EmbOa#Hxe>pZ^8Pq-=Bm literal 0 HcmV?d00001 diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/jansson/jansson_x64.lib b/BranchTrace-x64plugin-wtl/pluginsdk/jansson/jansson_x64.lib new file mode 100644 index 0000000000000000000000000000000000000000..aa6194b0064c275b5a1470e7b5250cdedee20464 GIT binary patch literal 15226 zcmd5?OK)677Cvzj7#tHq67qhuAF-Xp@w3~HB!CkFN<;{j6Eqv7OWVGV9Xj2f?zV@C zkY*PNG(xNpi&>1Kz=D4;42rVMf|0UdmV+`ZSn&f`AegUS_nxY{_l|GcmZqiC_tvRX z_0{9lsdK7s=lODde(9C=p@RJzDGrYfk4%gdCv5((PL7REOsd!S+KK2RqC>qzM`nnQ z-X-e(S<#8}M1p$0)3k&qXsE8}B;Ez}f3D~xsuI*cps4Q~B0?HC*Q;!v$f~=t7M~Y7WNF?bFo`O0Q4a^crdWa|J4Dcik;|Uu4SkqoS1^ue% z1nL%a?1`f8Ptk8s7wQvKK-(ns;|VJLq-YZ3Bk2=71r-#PK14of;ww$(@dWiY74==k zcz}ApS2VUrB&ay9XzW|0L8p)wG<8c+ZwKT-Cm$;sp22v4hR|+7-93sre;^Wc{Ia6X zHlzgsU(oTd6_qdsg2o?ddKXX72rwmmi6?0En4+!+7>@@*aOJI;w`XqzmtMdA+U%8? z8*k4Bx60K%>W}>n-3OOtMj_GE|bZxtzhhf@B`KK zD8(c!0h4g@RcVpQ`@ObWHS%(DS(=r1gyN(pqfnFp$5GRza`ihaYbJB~j@ALr@a1lX zOC9B~deH@eFmqQDJW-X8-BlSs7Bh%JMLkVbhok_0Dpoc+iNHiKRWMNR^b3qe+U1$qB34>{uLDTccTDuHFo) zwfUvc7)podNmrA^W2P^!WX-i{ndH!s^ZD60a}NEMFG09XCo&s;=D1 zNG@j~2zlP>XP*FSYdT|`=lu}Ga{$k8`iSloiSC~z`el^pGtka+hzF2jk0>ArHV9$1;z5-$?&`%|_2eHv7paSSaq`#U#`#{ZJ zqN`}f_joRj!IwvSz7{X-|w<>N$ccs4;_<9#pce1sU_ zUC{Ul(U+iO=+6VR<0Eu=3$;-fou^l+mrl^j^a`D$9(se$Qa5d*XXzQ*PMtJPgEUM- z^gMM?JMEz7Xo8CL5*?%iw4V;qVLD1j=r|pt0{xDrXp;8PYjlZTrx$4#jnEj4(oUMD z)6_>7=>nah0Xl`@?xzy%r9Jcl?fyS$#a67ur-+G|^2#;O*RwJLS=Pui5UPlFAl$lL zzf}pZ!*+QU!8k~x>1PNhh;ijIWa&h^t-UKQW<`N+h78>trWfE@(V*w-dAnSOJK$JC zv(bC5Y-;?K8o(t)gsfYlnAHn+|4rNHmHp+@pe?eeE}EYlsW`r=mX)qHYb9f61RNQW zLRQp~pl2M;c?O(c@v!YMVz+8E=bZC$GMg_&)6BIJQY#J5^9QL4%S}RQT7iS z63-@*&P>=zhYV_zxsP81X6PB$a|-?F(1|ITL1*>&Zm3pk<(H|wAdX>UPbxOqvNkIe zw#>B37A*U0jUB`3vnLjYv&h4kU|El`vO-fV28(lSgDa(CQyV4O2^>3c(=Fk_jT=U( zMQpjPY%=r`7p7A}>2x#~I_;fI$YYSC(;8tSc}-F<`Jl#{IR?aoK+Wc+kk_7Yu*sqt zU0CBp%gd@DI_}WIsi8sa<@55|1R5t^W=Yc)y+tRG(ws?l6#vF4rVpaI+;~YLwcgdp zYLk(07-38mDJcn!R*^8BXC%QU_`!urMTSTJ>vpI(HKy;0-fLgDyOsX&`@db^v4!BRtKZ;4IJbJU=ekb9M<@D= zN$BS^?YcO)jL5Ovg9t+XaOFV%1pP;+x8gZX!wZ#@K(>P0@h$%qvaA{|11XIsYVe0Bq z7)8ph_obqqKnJG_I9p&uq-j?E6?gF%WbU3#B_j&OY_k!y$HKt!_s=YAr++w@g4whB zXM9rzm%DG#R|@v59R}Jq8%_FJ3@U%mGG=bOjm4d62AQ{ak%>$g%V%sv7T(8hLy z!XhLFm4Eb7wDACXv?In+H<1h|@5q%hw4x)zu|qosm%m>bWB9y6?3)gFY7?>0EmK|o7L8GGa&2T6r`t)OMC zsl6_m4g)s}?Ib9OO8y+KP-F z@sPn$2VQL0*buHO%FFU#4#z0`Fs%i&V#c0$#Gt7IC`%bOvR6lKoWOUf^P*+>Nyi*C zdBE7p2xjsW5TqLiZV1?(lA325>gIR==wccm12(Fwe+ zBs_Vd%K-EDFh%=CWGQahWn`(3U)gangUsE>6kiP=BH(sE0dYg(hEj@G&<)fRNvIpK zgPLO(Csx6y9r&Wb?x}T%-ooe>GuB6+gQ*Va8CZVp$ygu#9-2P=XMlNiXFTPc03XKS ziw%23wc5nz=`G-9jp`{E*9|-Kk7`ErblO2PS0b!)x$&|_bs!Os-M28{yt7$K(N%m} zgs*Vy*>vx67;NtTX2tb`23K7aF_^r)E2dZ+5r+(M6nP27fHt&0!v;y+a50$N{YkNA z_<#*xQR&%=Z_ipm%J3&fEhOJa=j~P2jyq&)aCNj%J1*|FVO$F(a9^r@dkj z)qOux6Q(ljTXPw<>s5ndz9nb{Cq)~@4b8NT)B5h2vbM#(cEMo9A3?OztBif^VuTcb JV8LdG{tGgl7w`Z8 literal 0 HcmV?d00001 diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/jansson/jansson_x64dbg.h b/BranchTrace-x64plugin-wtl/pluginsdk/jansson/jansson_x64dbg.h new file mode 100644 index 0000000..2415bb4 --- /dev/null +++ b/BranchTrace-x64plugin-wtl/pluginsdk/jansson/jansson_x64dbg.h @@ -0,0 +1,25 @@ +#pragma once + +#include "jansson.h" + +typedef json_t* JSON; + +static JSON_INLINE +json_t* json_hex(unsigned json_int_t value) +{ + char hexvalue[20]; + sprintf_s(hexvalue, "0x%llX", value); + return json_string(hexvalue); +} + +static JSON_INLINE +unsigned json_int_t json_hex_value(const json_t* hex) +{ + unsigned json_int_t ret = 0; + const char* hexvalue; + hexvalue = json_string_value(hex); + if(!hexvalue) + return 0; + sscanf_s(hexvalue, "0x%llX", &ret); + return ret; +} diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/jansson/jansson_x86.a b/BranchTrace-x64plugin-wtl/pluginsdk/jansson/jansson_x86.a new file mode 100644 index 0000000000000000000000000000000000000000..daf6b8d8b2120662239803d25f188159e5ad9e2d GIT binary patch literal 50588 zcmeI5>x*PZ6~JqHH`&da_ha);ChKkz*JRSu^Vml=n@LQJ#sq^J2_f3kGjnIAcYAs| z-976hhOnSQFenQmh!2o}5(0_@1QCQ_{3L$%llZ|;`5^uUVmzl#-CL(_Ro$r@HXDkm z3w68u)VXzU)&2FU$EjQQo>QIS^7`om4^5ie^lWpcIentlJT^Jmlu>*?IXN>kKTk(2 z9uPvjA;eW@gt+EkLR|lI3O9XT2n;uWK;gCvLSVRaio)H05dy=Z*C-shLkJA_{guMe z9}0ot!IKmo`mYceTEC_+_mU78j$cdRzIc=~k; z&ps^#hUadf@Rh#_f#LaW3NJt&FuVxo#_)}|DJ(*MF)SaYko`vp4C@e&;p`%X{y`xy z4E{`E)Dr^3Ignx4hBCnL?IjAY!!=_#5BbFKoyRGB@1H_oc;i(HZypi?!w>#W;llTY z!0@Aa3O@!phMx>6{OoEWF#O^j3crLrVR#F!8N;vMqVV>D5E$P1fWmK}oG|?EehTmY zLkJANhjU^0!xI$#_-`RF{OP9@-h;F;ybpN1FWT)ho&IRF*>88+-F{~y1Ic>USD(7S30j5!BT6FvT@Zll;X=rI<7??VO|fMqavGl zfQ~Mm!E*vLeSZB_Qf z#jT8Tp7Po3mG*eE-5qB`*8xT}KMoIYK&3LnW38i#E4B+k9#_O$NA|OAlTLm*inNY_ z9Jn$j&m`llBRc+bU{qP(m%6FBR{CG5E0e~8S z8%xgHXhz7i`ddBo%19vNdYhdU(-J935xZ(!1jd4-h+VQ`K~luFSGzs)e}=~^sn%Ks ztGHA)Fj7;;NbPQaoUJ*tU5YWZflA{lb6qLtnl3Gso7GNlWadOk&E`Dzt>%ukRF`b=z%vt$9-hs0_rjOGa9w

5<-CE=Rrne!XM4-j(p>N{3z^ulf;FD_}pT zq$#7A|9vRL+Qe$-Y?f=%Cod;Vc26m7)Z%5-@aeGf+2hk;WrO+MGl6?^Q{^Yi z(2-?=cYe)>zHbIDPLcVwU3<3DnrET607w-74VWgi&SVUu@Qtd7^W z`e#WZxe%WKxw3SLTr6KKQ@!zjK3%iLvQ*Bg#83P;!8nlI)2<=zgD-aPUylT+0fGZa z?x>08knr8fV$Qdw8M*u9>0SeJ56Evex%)x>0K|VySp@u;{P-+pVd1b`X5nPtWakyy zvKkiiIOwdq^$Kz^y;GnwbnDGSwA`+T{esd_BKVkm@53Yb>%s*sgAp?!Ycn<)L-!KT zh4)^FDV!y@FJ%YeGqVOp%%ojo{slmC_p&kD5{#bS<`qI04@krFnJ@MzzpO=xivVCoDpf zEj?TiTE~_y5TSb98SY}tlw!*OH%;kL63Bf+JPe;ism?OTluNyw&IEGWv^h_dgt^QVbU>3oZsOd7x8WKKdU>~qO#}Kv#31h)+?xli2%V=K0;KMeZ5iJ&f64> zx_&Q;24WiGse;gQws|dY$9e1eW+1oIwlz(4y{_x)^qNi?+{RtkV_O_I&Fj4+ko$(f zAqBFiibp$nb(W9w)A-$Yp=R8v74QsueJB>shUUSKWF=Rd)y6 zkx*Js8nl87ThGRVdmHa~)Ln4xxM^xnlR)kp;>+-9P-|q}ZVi+sqIp}gbH@T1ZrS6g z$>M%Ai+jRiIPO-#K}D)&cgkS*Q5U<8mVufI>1Q?6J2h*!4wAjqtYWVt)ZQL1vs%mq zjGNgzEoM&{%s%U2w#d5M+_GqIiy_o&mHeynZcxLam0j+F_9lw)ow9A|1-p1QbWC0Gj_Wmjc{pOi*;kDt(`YW&1dPyP3x`lf6UvpMfX7d51)j+ z(XP$2?Xa;r%1dpiFKfmg-%8YeG-~GzYSj}V^4`YV8^dvF+_a5tkwESn;&bq6P@6vp z!=@f9Gh4)XnGN=ECI2fHzpqVD$NxIZnT0fCZV!a}Ux`RZ#|uPWI+Ldhp(|5YRAM;) z=@cM&F+E)~iq6tAaZyuR!_!sDw$Tu<;=J63db(0i%fS?uzTlRQn+?F-Gr^T|& zaW%v~QfEVbUTG$4C8>3MveS%I>>kHl|A)_H)lWpTW-1eU2@UmgHSJzinuDc#RdwcI zH8r78(-}So3qds6rb^(YGSqXG=CWKgyZI1NnNNO?n#}OIEO~Z$)vje;K101#$!b>e zS;uNlX+EQ7Gu&z-hlbTu0xy-J9;i9nhx!Keb9b7vvPi=-vcG&O=d5_B12KPAn^Z+o3^^X*@KEoYh5K%?qxO9la*Qv@_v-;aKUPw*1~5@ zR%tn_VxHVCYc0S)v$;+p8->jgwp6?{hx)hD{H#iv>$Dc`chL-~$J~DlpPywS>S``1 zz#+;iQI`Vb`KBI}7?xme1f!sI5 zm*CSF8)I2_0Bpp1`3?1;rRQtqUGVkT>O5b2*ycBH)nBYqxk=uZB&v{DS-KyyXSPumR3CH78#WB1tH!V5>@=C=08m~1iZ@Cp{cwN0Khmld_<Il@_T6vv9~P{>Lp90 zUNlngGDyYOf9*0-t6qfWt^ZrWo-un~Zd!*+w_5Ae|92Xs((9;V9wP`}`A`{8`^{XX z2%lYTh5E+Qn(>u(wa%IacW_!Gx2fT477&n*MruX-v=!?2N~_3L(pkrr-cEEHuixAq zw$#WnAF?V%cx`E@mn%IdR!M7}=frNyX@xf%#!PAWb7G#C;QHI6p?<5T{cKHIDPFfn z>(ubK5|#7@;>c@wT#W%Y?XNmS0=aL98TcfB6=jzj&RpWPn4zAj#HK85-&koKHgC~v zu41AwTg`fGnlGnDHc{ebGt~Q(*t}?L-mKYN+FfiqUqA0>Gt|d4ZLc(##+Y=SUT56? zpk|ZaV;{Ng#6BTzx?Vp@0=egJBt%O|SuWS@xzuYzL;Xu>6<1m6zWTk62mdC<>2jyn zTf%iEV2in)4`0PqvRY)@;+4gCnGN+cC1x)gvo{j6-TpXR%ZBQ8J-dckGuxcma*U7J z>0qCeJyR;R2XuR&&N%4}CbKYsIBpvoKIbH-60_{0mE>MlLp@GuwYN(9T4$Ba>kU@p z<}`e@H^r%o(TaZmbg0iM_4_ONtTQHc9r3x^>5Vc>H0HKy_?Q%Bms`+W;Q+3$9me|Z*-hx$4cMY4AUCw4M@v@oxOo&IBxmhWMUH*Q7K0#U5E9R2cVe=Yd zb7gB|Fv9cf4!cR&FPq8FBrz=6!;h8Ct2LXu$j^i%ntrBS;$<_`&y>dUT?`j? zv(8xlRhrFRHkOYx=A-sq_)4C8F7T^otqLrN18Oy(taas&rM_$i|kL61$i)@$c z`!t$o?%*Wg&4WHc%kBVS+4M=m5m(Ea6Q>ytZ>8w-p zAIRy<2JPj|0X&f(H=*dUz-?zQ{z{f-*@RR}eVjH!y-R6cv%D9jURKdUtuwFr3gT2E z8nXorpVut2%F$E;FO{Kwr1V5+C6#ro=YFEHGaPnaY14w$QP=O`&n~kpb4CrZm();? zQtCNXl3J(dw9g=w7GuW5W45K?Jtu{w%C-a8BF4*XsHZ7Cc~{9Sw$B#Sh`&^nJNMg# zF6Yb+vyIJjS=79SKgCSEsw~^M77<=rLw!$aZN5rc>#T5g8K z#IkJL)Ebdqazi~+X$+u}+&Zn;y_{THfG28d!^Z%K+VTQCTWjkwESn;!*e{ z??qxO9N0r*HvgCcEt99D06P(q~U;vgCU+5GyuXWq5EZeq)H6p#_hWfA4 fOzBE;>v&fMBNr2mc|0q8rnI!AhI2KSl-c}0=To-= literal 0 HcmV?d00001 diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/jansson/jansson_x86.lib b/BranchTrace-x64plugin-wtl/pluginsdk/jansson/jansson_x86.lib new file mode 100644 index 0000000000000000000000000000000000000000..c9bfb569e28e171e623daf09bf3777c66306625f GIT binary patch literal 15550 zcmd5?O>7iL7JfDmh#`a+68>TQhm8T_pBWniA%+kHiQ`y6E>T2hY`0;^Fyr-%y)1|9 zEz(MRLQzhuh|A^><&aaPaMfJ<@sCZI!@;7-$;IVYV>=+J$l zKJWw`nNigD3(|t_DH{HiNYEhCf{uQnXs{D$(9v^>1|Aa$D*T}6%o8F(`2j^^4~Ybw zomF(^F7gF!S9I)KB0(ch6`g1&5_J3%O}z*~Czdq*h!8aNohH;f1UmVprg4Oz;hdr) zU!#AZ!)TMB-Uo_$ZV(CT`b^UhLeK=t2|AruH2FP|r1ubl#=lZ@3Ux_ZMF{HuSkVCL z6x9DzQ66J0sIaIg{~OYvV{a-t{W)+z{f86{{*3Vjji63R8xewf(H=qFzbeX26A9|Z z97_5KAt?7y(fB2_6Lg9cO`r{eM$tA&j}d~#E-UJJgzyabWlloG4O@`^LovW(`ZloD&U68<>>E6VXpq8UNG8mK{%YfVqCmBGq|e_AP; zY146*TU=f)n%?R-%fUBDXLxe)GE-viDpOocSXePC%Vx0}YxU() zNL;W~$+G~3gkiXH zF_e^YaVjf!=Aa#T^KBNZuf7~@U=?L~i^X!yYyur;xs{c&*L)akIC9|Vhn$@Z|sil1!o+n*gTEebm>Pi*hY_CkIQVW;4ic@7c+bgpi z-l?vd!B+By<;n76Mv3~TjM^{ORZ9P;MvTAzB~!90F*=hUjy&SVWJ1UL^pbfKI?)f1pV8h`v|}SEkGg;DCYpvv)q(IM z&_l#8p-$nN+y~Z;QS=RT8U1;LcEC}kHfpDCI!mw75$dB?=^UM*Ub;l5sfRYwW_pe` zQ5TKV5Dn8wdV#i42W_S2X@c_fGVP^3w43(PemY18=rA3k9BrXV0KP)6(?xoNUZNc| zLSr;a+i8l9Q9oUv^K^oa(;ywC0V>cg+DR``=l@A7HelDR!87AqO{xHE^C_i}siS<2 zp$Zu*gl!L%k!-Xyq|>~*pe&R|^>d_2#n@_ZGDfm$Pq5J(zm!)YJXYmLI$Ya}6E)cW zsc%R6=VF#c;c7`^Dfsqsx*wSCOD1}#tcRkc-5>AZPPG%1?zUE$R_Fdo(itgElDm+! zv@+~jYZ*Vw(aCa8GQFLoMaVJzInlXk4u{TG7Y}|%GVpX(d=e*=b~lDbGY70+Vh!gd ztHg8lBR`)BC0nuXB2TeoMW?O%3|6tRUOZNY(-65tej&F-u@RFvg^MMJu?kztPn3yqV8B4Ew zZRe?ThB?*DE@N6>mN)udCDLvnox4JFU#IoDEX!{RxW5x=aVcf=v|LCQhdWu0&X#ga zTSsYrt7zJ!b+eSQJS)$YQybs5jrlxj#UQn>tWGoHY0?b;Dn;JiB;GVhEz4_@qA8b5 z_OvoI%O%x(OPg|pqzhc`RO#{>EZ&e-9q|o~7B~8mOL>|yAv5wDWS-KFQ8d0|RT@!d z#IAXq7@Oym$Llin0_<+pkumi1N~?A!L_Yz1fN0v z+J+Xwxs{u}*Hn_=DG>eLBy>1MJ1z{B;Kmkv;mfGsE(HGq{iM?y5KhtXLoFwKAo<&d z|KCAIPB5qNlGBc`6JCw@ZDpP6r=2@CgD2_}KRf|Zb+z;D()@C@R$Z*;2Cg2>O<$RL zOXfO%0!$PX6~IZ8u^sr|Bx4MPrsk`6meAJf>Obgrv`@i_65=Ns*G{I(Q}F8q=a%8f z&WREm3@0ySz=&lEF-P!o;!poXU3hTQDG{{ORs65X4N6@o9jv{6De_}EXb_*kF6AVyy_=b%0Ep)hhn9y%L-^@UU4shu}*pLYkJfsPI>$5zW`8^ zoIGk7`wMpt>L-?>*kAm|_80CY)KAF$+az@OOh>oT5lvl)&5me3uLm?I-uA`joNg0Z zYme;R7Ok_D0mtel7H??17YfNZJ-}&$epF|JGRc^6$Y7}HJr->-r*F6>!-}ynl|{qh zSiG?wjwJUG7h_OeHk!6-8AS8F%bTs>^zH!gHad917UN(n-dNu&#msRA(|rF5 z8RPk!gQ;!(*6{S5YR(zY9L96AgD34AyeM)&7H?=w^U>Ef_RbRubBl{7>`DgE{AlKl zVdC^|H_)Ds(4+^{8cxQl?1*q;_lkqDcw-}&vMTqYPg@z5d|PFeH$QrXjJ2^XMzZ`u z4#?t-^(4s z9OdJ;gfpIeuI$4q?~HKF{Xr{8S?A?W7fHUrwS<gD2uI$J@ukqbC7NN&>}NRa@~tJj ze8$OmAi`5uRD2Pv;bhF{*+B;>@Qv)IM>5N5I^^PsJIU6@F~deX?4r3wcGG>!(!b)} zS@}r%Vo~0v^3Jh%LwmW9vi7@hu5=}#iB~ZOvWB&iVrg^(u{#k_Tmy4R7H_PNDf>Wp zojr+&@`{^GS-i2HrdSERK)x{+*+CE4bx9d?V;Ci7UysU9Oo{SfN{KbKrpV5>Ri_f3% zrI0hD`fYyvKL1dJE8mt_)y=P)e2VT79?D4zM?73{C>C$IN5c`4d=z6< zuc1dNnhhV?;cG85W6_ISYgidJ#;A?utL&!NVj<%U9*fX~TH$Ynyn`&>*qo)D!Qz%C zA0x_#K5KC_-?t2nQgD#WhaIdp9K4~PWm!<;E}r>ZgabC+!z}A}!bQX+@-8*M3koT_ zK%DQV642KF6q-yxtyrC8!`s*#W>{;dlh6`7*)(d(886-n&bX-0VAp49=(7%9i{qK0 zUtV>Qp2=8dopR?QMEQ{bo2KS>LzYkdT7;v&KxhpqWlf5gohb*Y (unsigned int)LZ4_MAX_INPUT_SIZE ? 0 : (isize) + ((isize)/255) + 16) + +/* +LZ4_compressBound() : + Provides the maximum size that LZ4 may output in a "worst case" scenario (input data not compressible) + primarily useful for memory allocation of output buffer. + inline function is recommended for the general case, + macro is also provided when result needs to be evaluated at compilation (such as stack memory allocation). + + isize : is the input size. Max supported value is LZ4_MAX_INPUT_SIZE + return : maximum output size in a "worst case" scenario + or 0, if input size is too large ( > LZ4_MAX_INPUT_SIZE) +*/ +__declspec(dllimport) int LZ4_compressBound(int isize); + + +/* +LZ4_compress_limitedOutput() : + Compress 'inputSize' bytes from 'source' into an output buffer 'dest' of maximum size 'maxOutputSize'. + If it cannot achieve it, compression will stop, and result of the function will be zero. + This function never writes outside of provided output buffer. + + inputSize : Max supported value is LZ4_MAX_INPUT_VALUE + maxOutputSize : is the size of the destination buffer (which must be already allocated) + return : the number of bytes written in buffer 'dest' + or 0 if the compression fails +*/ +__declspec(dllimport) int LZ4_compress_limitedOutput(const char* source, char* dest, int inputSize, int maxOutputSize); + + +/* +LZ4_decompress_fast() : + originalSize : is the original and therefore uncompressed size + return : the number of bytes read from the source buffer (in other words, the compressed size) + If the source stream is malformed, the function will stop decoding and return a negative result. + note : This function is a bit faster than LZ4_decompress_safe() + This function never writes outside of output buffers, but may read beyond input buffer in case of malicious data packet. + Use this function preferably into a trusted environment (data to decode comes from a trusted source). + Destination buffer must be already allocated. Its size must be a minimum of 'outputSize' bytes. +*/ +__declspec(dllimport) int LZ4_decompress_fast(const char* source, char* dest, int originalSize); + + +/* +LZ4_decompress_safe_partial() : + This function decompress a compressed block of size 'inputSize' at position 'source' + into output buffer 'dest' of size 'maxOutputSize'. + The function tries to stop decompressing operation as soon as 'targetOutputSize' has been reached, + reducing decompression time. + return : the number of bytes decoded in the destination buffer (necessarily <= maxOutputSize) + Note : this number can be < 'targetOutputSize' should the compressed block to decode be smaller. + Always control how many bytes were decoded. + If the source stream is detected malformed, the function will stop decoding and return a negative result. + This function never writes outside of output buffer, and never reads outside of input buffer. It is therefore protected against malicious data packets +*/ +__declspec(dllimport) int LZ4_decompress_safe_partial(const char* source, char* dest, int inputSize, int targetOutputSize, int maxOutputSize); + + +/* +These functions are provided should you prefer to allocate memory for compression tables with your own allocation methods. +To know how much memory must be allocated for the compression tables, use : +int LZ4_sizeofState(); + +Note that tables must be aligned on 4-bytes boundaries, otherwise compression will fail (return code 0). + +The allocated memory can be provided to the compressions functions using 'void* state' parameter. +LZ4_compress_withState() and LZ4_compress_limitedOutput_withState() are equivalent to previously described functions. +They just use the externally allocated memory area instead of allocating their own (on stack, or on heap). +*/ +__declspec(dllimport) int LZ4_sizeofState(void); +__declspec(dllimport) int LZ4_compress_withState(void* state, const char* source, char* dest, int inputSize); +__declspec(dllimport) int LZ4_compress_limitedOutput_withState(void* state, const char* source, char* dest, int inputSize, int maxOutputSize); + + +/************************************** + Streaming Functions +**************************************/ +__declspec(dllimport) void* LZ4_create(const char* inputBuffer); +__declspec(dllimport) int LZ4_compress_continue(void* LZ4_Data, const char* source, char* dest, int inputSize); +__declspec(dllimport) int LZ4_compress_limitedOutput_continue(void* LZ4_Data, const char* source, char* dest, int inputSize, int maxOutputSize); +__declspec(dllimport) char* LZ4_slideInputBuffer(void* LZ4_Data); +__declspec(dllimport) int LZ4_free(void* LZ4_Data); + +/* +These functions allow the compression of dependent blocks, where each block benefits from prior 64 KB within preceding blocks. +In order to achieve this, it is necessary to start creating the LZ4 Data Structure, thanks to the function : + +void* LZ4_create (const char* inputBuffer); +The result of the function is the (void*) pointer on the LZ4 Data Structure. +This pointer will be needed in all other functions. +If the pointer returned is NULL, then the allocation has failed, and compression must be aborted. +The only parameter 'const char* inputBuffer' must, obviously, point at the beginning of input buffer. +The input buffer must be already allocated, and size at least 192KB. +'inputBuffer' will also be the 'const char* source' of the first block. + +All blocks are expected to lay next to each other within the input buffer, starting from 'inputBuffer'. +To compress each block, use either LZ4_compress_continue() or LZ4_compress_limitedOutput_continue(). +Their behavior are identical to LZ4_compress() or LZ4_compress_limitedOutput(), +but require the LZ4 Data Structure as their first argument, and check that each block starts right after the previous one. +If next block does not begin immediately after the previous one, the compression will fail (return 0). + +When it's no longer possible to lay the next block after the previous one (not enough space left into input buffer), a call to : +char* LZ4_slideInputBuffer(void* LZ4_Data); +must be performed. It will typically copy the latest 64KB of input at the beginning of input buffer. +Note that, for this function to work properly, minimum size of an input buffer must be 192KB. +==> The memory position where the next input data block must start is provided as the result of the function. + +Compression can then resume, using LZ4_compress_continue() or LZ4_compress_limitedOutput_continue(), as usual. + +When compression is completed, a call to LZ4_free() will release the memory used by the LZ4 Data Structure. +*/ + + +__declspec(dllimport) int LZ4_sizeofStreamState(void); +__declspec(dllimport) int LZ4_resetStreamState(void* state, const char* inputBuffer); + +/* +These functions achieve the same result as : +void* LZ4_create (const char* inputBuffer); + +They are provided here to allow the user program to allocate memory using its own routines. + +To know how much space must be allocated, use LZ4_sizeofStreamState(); +Note also that space must be 4-bytes aligned. + +Once space is allocated, you must initialize it using : LZ4_resetStreamState(void* state, const char* inputBuffer); +void* state is a pointer to the space allocated. +It must be aligned on 4-bytes boundaries, and be large enough. +The parameter 'const char* inputBuffer' must, obviously, point at the beginning of input buffer. +The input buffer must be already allocated, and size at least 192KB. +'inputBuffer' will also be the 'const char* source' of the first block. + +The same space can be re-used multiple times, just by initializing it each time with LZ4_resetStreamState(). +return value of LZ4_resetStreamState() must be 0 is OK. +Any other value means there was an error (typically, pointer is not aligned on 4-bytes boundaries). +*/ + + +__declspec(dllimport) int LZ4_decompress_safe_withPrefix64k(const char* source, char* dest, int inputSize, int maxOutputSize); +__declspec(dllimport) int LZ4_decompress_fast_withPrefix64k(const char* source, char* dest, int outputSize); + +/* +*_withPrefix64k() : + These decoding functions work the same as their "normal name" versions, + but can use up to 64KB of data in front of 'char* dest'. + These functions are necessary to decode inter-dependant blocks. +*/ + + +/************************************** + Obsolete Functions +**************************************/ +/* +These functions are deprecated and should no longer be used. +They are provided here for compatibility with existing user programs. +*/ +__declspec(dllimport) int LZ4_uncompress(const char* source, char* dest, int outputSize); +__declspec(dllimport) int LZ4_uncompress_unknownOutputSize(const char* source, char* dest, int isize, int maxOutputSize); + + +#if defined (__cplusplus) +} +#endif + +#endif //_LZ4_H \ No newline at end of file diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/lz4/lz4_x64.a b/BranchTrace-x64plugin-wtl/pluginsdk/lz4/lz4_x64.a new file mode 100644 index 0000000000000000000000000000000000000000..6d38e9bb571d95564bcc8072c106e60b30f79d53 GIT binary patch literal 33634 zcmeI5-ES4g6~GT`Ac+h4AOr}3V{qBKG=7w*0F1%JuD zZY)|wR#YJrRS}B%P(}SK`q1Yn5B&qGKK8kPLLaIs={Yky-)HyET`87U-jQZ^J#%(u zcjmX}o|!YdKJ!j{(@&y3JSKgNK_q`KN z_46`L?+2hb^A8zkp8!z&@w|*b`40fa`G3lI^)mp9*DlJq@OJ=;KYJ|W2de-Se{oaB zn>7H6xA1(5zy4IlJMREcTzpo>_WuAVcK$8nZ}9#pKG>FVadG)kbFsbHUu~~+VR5P3?#L8)|HJ0u*6RJWmGzD8<|ZCK zTwVKk_2*lI^{v5;{v#A#?60gZ4i$3+*t0}ko6G%9_ou5^`jxF-ue-5u)skg0sa!uf z=L}f~UiVt>#$cn{Ub!)754vt8Os=TKPq(WH^6WFRYLMxkBvUHNiR;E5=nk?jo5`e- z{bZ~7AdBRC8(p_K(gc-foliO9x;kCW$7Z|NUHrH|Sh~K^?e(`?&4<#buUPIwfX{2c@?+2Qh8Z3+4QJQ6i&W$|33d2(<^a zPBQscAu?BT{Gtv zrzNvXAqh3VOL4Xz1>z+^q5yZN!jg`WXV`+99dg%D z)!|S=aCai@OX?4fJ0)-LEji7xov)5bP96LELzplIw52CJk_I7g-kCY+YuC2B?MN@}TnsZC9=pL}`E0mnjE5lMS`k`z1Q5K~^q1ADX=^14~C z*PBxk+F^RK<><+0L?wU1=AxlH$16RJmoR@h<%V`Os7LBa)N7Uwpc=TaWAvZaYt$M| ztn9Z|y zksz-~ULgS0E_oEUj(^c}CR5(WBNY<3jfeDmp4$S(7Rnd1<~2wc3%2W#Y&Yc0RINrf zfMoj*cpJmmzLWMh?RJyxo>gxi+v~hs!1g0vPP0wFcB8U=!RuM-bz-2bEWb=QfWfeQ zK_-Z80@SE3%a(O&$aOTb;&gg0lGA27VQO*uN9?;{oOZ1K-Aztct$On~-R9*2PCw=4 zG^Z!A4@Twm2cp;fSwJ)BK*mJ{gtY^K37co84DaQVqMhDKRI3 zdE9dBS{m0Um)EEF>XpM|5Q)1I}PR}-D zX|=rx)l5PE{?>>)Ik801p zA-GK!GvfJWwhrXF6WcndiRWBy61ap1WF2I!<+MG%+P@I#2b-Cj3g%~jAHn8Li;>-A z^CPQXi@CtZyTr={Y;N#!noU}TFe;m`>)t90mx?YTjv9oXCgp#&xl|r8%1z)6+?pSI zv3%G@aa^(3i1l?{4t-tKdIK}=pTPDWmBrJ7MSmT(yP~_yy7N4th{24kK9C7wo4|*- zC%W@nz)(Cyj`)TGP_n zrBUfV#rCawhoCIlms&4eNmHX_42JA0GC^z;AkI0m)!k<^ttB{`WBp_5MJ{Vy!jlM^ z_ljTl81~MnG{466CzexY{Y+z03Wj36%oI}-co(+}#g<*+X=HW=tP$-K3q1=JwZ_6I zGJ|l^??3q(O{uAkok6hJly}W4-875Swy_?uO52hW@ofxkI~38juX5aC9eYgMig!FR zvE{XGtY@qm&*f5EWIT5wpf-HVw9Et-7|${9+44MxEoDzv=-G-`Z(603bLlRklaF(B z??IiM|6VvtZLAM%DqO9w6ESYvE4~PN7jM*Y+c80{el5S$7Q{>9nYPDk^ed%80(Cs3 z@tVF{qiRhOXX#eHGSP^`X34$_U)d{GkI_Yx**=K%m8GA-@ag33*+^emt6D$9F|0>n zMb^(8m29f7j_403l%3PqcX8CmKFsGTtf?<9lhLhHvHrE$(7*QQh~Iwuox z+IXla$9b%$Z8o%VE6&XrPOiKFIO%X%u> zFBfX;$}eYFE;5()qT8FPSFYR)A5V!j4AXps3JKtcQn|Zk6mqstZYtI%SG}bs8s4+I zwKaVdb4Rr@UI=@y)H;`*TMC9({w*~<(DS@;UOHzj#QNf@w}C}ZWYJn=<-_wXt=g(9 zvz0(|I1~)A`hmt&^ER+1Q{OeCWKAANZmgfJvU5d`WRY9M&OPjq>wRce^mBQ?+BB-2 z>)m~bu`j@}9P53X3&(7K!Hyla2H5`E%x=!WWqiFRn1Lf(or1?`um<=GUQVkRdedc8 zo8gepvNJ3(^Q!btW|=kfTcU++&3q?KpH7c`=ZF`@tJ_;>`_pet!XvyY-|nkW~-3E13YwX4evk3 zI0I>(^X!)6RxHqMZ?K}?P*3BeQLXBOL;70(_+r^*rv8U1;D-9!X$tKU=-@V= zdfgH+$Qxl!%g6c^TOse&DAMp=!#*38_XGL8Tx!P8VtY_9jMMjqRY-u=Fy%7N4kJD7 z&yOQxeUHu1ZmGVdZHT6^)2Kx65BgLqpHkC&ItACzOlvw+NMHdEeVX;1^E%pOb6Ppp z3)u*@a`jDO!*G$WypH)jiG5pUYlBw2P%!MOIc!QbUwO4gkG$^XwQa1AvHH(O)ZD%= zQqS5IAr)6g(mQYIqV@8B-Bo?Z&5)|rK2yt?|7>L4F{fL3PGkLo)%rPV>`YFJte@NG za4P?MYMC|aG0{S{Mpg3|lwrQ|t~kyAKeFsBM67SGdT(0vMV2q5$a~YSC0Fj>{^<9n N)87#0hu_hr{|91>0UQ7T literal 0 HcmV?d00001 diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/lz4/lz4_x64.lib b/BranchTrace-x64plugin-wtl/pluginsdk/lz4/lz4_x64.lib new file mode 100644 index 0000000000000000000000000000000000000000..8734cb0c5add7fa3c2ef18ed8b40a78834d8df46 GIT binary patch literal 11406 zcmcIqJ#17*5FY-61HlH&kN-IT+x!?f?#>{Q=)eR)Fh8=5kWz45xVvz|*vLMMh=NEI zL_*YvA{3DjqCgZ#ktir=gAhu}NTi{rpe6;G*?qfjXW#C#-`P27{BCz==9}3!yE{AQ z&cnr-%U8Z>*qh>?{h9syGP!JSct7vo7c|qkgK7EoQUd^70BF7iu=N4Jw$}hHw*zX! zCsOANNrN2#MBROox}E?K4Stj~kOv^@zAvf&CIHdSw~|sd0HUtllKN5rMExMC?;f_1 zdfo(d37<&2o=V!i8GtDDUQ+LI0HV%ONxjdpjkNQkq=9E>4^sChN&W8-2Wi(~Nv#tA zL@ggAwG9Cfb=;LScnAGLYJV&VO$DO%9!WcJ&WJi%B(=UoeMmcyhp6olQK4}1^trQR z6NO{nj*pC;JU4N6tT1^q1BJqw^P{8DLHHR*<=DiD^Jh*Kjvbje0;At&3YVv^U7sn> z&K{kfn<}Av_1g79wBPJ;FfmPq$?COgtz0@gSGzt}b8uS>qbDe_#B$t_#`V<*4&huErZeMB#mJczh0f1zA+`&-#D%;r<8+@^eCi4r8;Q} z@_yR~&TINlBN4q942ziJ3xd~@H@PE2q&u?iPK+1;u2GV*7atRH3<@vAQe>QRbz&Ed z(}HB9L5Hx?T8NBqHaaNqf^~XgByD)4ri^+ymy^ljN%Q^9DPr?*lm#fTScL!K9?xB8 z{TwMB?!HXMm;uJYrP)xpJVRl|z-6r&V4N;har|5}pPG3U$FN&^WA@?`BjHZZrPASm z+byk?%UNb=E|(G?FV|?#V5~|nbMmb9kj`57V19M08Q{TIfY;jqZetGChV-HnbFo3p zBf9~fbOC(C@A(0M``EsTiRRm#0JRk6kvNv>LnYXE51(%^r@MsobQi$p-2m^A=Xfu` zDC&ET&x1tctjF!B6J>kwc?*-k7VLkCe3TGA zLOx8jVHK=|F6e|^&<%TF0Qz7j^uTTyL}NC&J|^@+&|6G!sRs>qDTq{Rbq2g)wkf#6rX#CNd{>PgA&wlycV9&Vqw?PL zDGW=e5RYNEV$PFDAzQ3&19a?r{EElpwmI$REJ@VOYyCV7aaggp5A#0Y*@&W(xo|%% zPW=WP(-(SZ4$2M6FhO*%7iexVv{{AB)`&m|_YF5+?Cr~(Ekk+ywOemxPC&TmgPRGXRtjS@WZm2Xl zsngi`s;-&g;h_F{siAad1^n{4X=24Pz&uZWhDzlh=6>uM51Q~bez~U_!7~qyM~AAV zVy)PdRzp}4g+Gw~2|8BbGY|V-1$?=nTj2a_@KJvrQm>Zd^DE3Z>9ZzqsvkBruEF-7 zq8BjN#M0vFNh2ej$r+KcTtvq2XpS@!Zy1iqC>h4nS0geGs3D4s-&7-bQe=?cC4J)yd6#rE z@)o@l&)D!mW5(oK`Wpe_W-Mkc=}4fpNNdUbwc8oH){Tpr<$rUZe32%TZ+BsGt)2b07#1 z3keGb7$qDDPX`5)+@p*e2a6K8?b$eK4V2WMtjC{D#90}|2~)PZJX5Wh_af@*`B0a@>tXdHsfAC+?V5SPRN^qEKlJX z9-a3k!3-*EDGM`&m}?`L(P>WXqvtJSsSR@t+ec4mC0?sJ&&=YFzF1X@M_s(nxkK)q zVn3pg}VANbDnbzi{n^_w%!}VT>M+idE%6+{+r^lbc_nk$!* zuD_h;#KIqH@HZ6smMko*LQ^ktCdSL{4rHqN)Q#nd4Z2LVxUm+o&%}Aw8buR@sd_!j zdd_0Xa@yQjy3|!KW?am)doXE%hgH3Lkq>xIizf88BS04AI0cY+?ZxdPI}C(Ht?!s< zOa&NrWl)EHVvpkX;Z6_QqP+8*cyyEN3h;~~rgkiNWecwZdLp0hz}-RelZZ>g*EH? Z{mOZ=9sFko{Eq~Aj)pjn+PL1a{sX>6R8{~0 literal 0 HcmV?d00001 diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/lz4/lz4_x86.a b/BranchTrace-x64plugin-wtl/pluginsdk/lz4/lz4_x86.a new file mode 100644 index 0000000000000000000000000000000000000000..b712e2897022de41f9df3b8f11abcc3790e60c2e GIT binary patch literal 33554 zcmeI5TW=h<6@ZUMzD2bY$F&{DiIcT0JI1^_n!#{LO# z;0D0KJu)8p2LQz*AIW&^0szJ1|CaH@Cjb;{JsD3Q1fY24QyI@~08o7Otc>6I69C2f z+cHj_1EAQ#`Y6u)QO0lG0-$&SuZ!YEye^8D{~+TV4FHN){wm{J9|KT)`>u@dUIn0d zo;^LoW{NQ&06z^gk6jzSQxV{g7;>Leu+(LPZ z53qkI{tWMh;xGOtsy2C{f8vpUs<1vkh5#z&y($KF83F^Z?0ksm$rJn?#7kNrZiVd zb-Vd_=cMi6^{@4=4>r1;mFt7fpzAcm6^oYK0;?&%&^#yDN?PE^ay6r*ynY;!?jU&i zTq)J==9^9UWpqYwqw91{mXnp5bx@hSzQwNMX0y}l&VAS)EM42^_WBRn&3oo4LjdCrx~x`%BAm!0TJ zIA>dT8c|n{d~VJ9^8I_mOSG%i!g+Oa-Rf3lj~$lks@dz%#dgb$;a%g1xaZq({mtF_wA)EJ&0yE?K5&0B!OBLGi{PrFAZ2Hgh(@j0B- zpgupb*co)fBBJCX)IXbee{*w)7;KYVpDG-0X0p5R!!EooGl=@6Tr0~bxqV@|=}Zod zQ`pbQW#wpzPAo1j!-P)h*RQu1i_5mh%uzH=HZUfDorx+ra z#0(0>F^JKH-e3vmOfp9>0bc^OqIV^=)W6iHI+)*hdCeZjLO3Imj`U3ecv_?~N#I5N zV9y<`Y2_FZyIHT-o0AgTVH&dCo;HZxE1LN&Qi0QL3_h{+J$enx7gKWRQ2YOBNTt!J zKbqLss?jcJO=@Y#8I*az%PC^1zVj&a5ii%qViCqMy_m|RS$L>@_W2q5>(L{f2kB3{cV2o`1N%xn7=kcqe9A*=rw9(G|SQ2GRqM?VUZ~AnXW;S zOXpLdo0lY>6@LTJH%#W>0*(p^`~*KoEKz7hp917&NQjlo=vT;0JgVtTMN5EE=<=#tO7%cP5tINl(9S<9H5Z_m(l{JIU_* zM!R|JF7t98yZ3oH#qKd2msobsvh0?dTl(%&(A=u7!Q2Gsi^+0pYFd}tkiMOcWVY!u zTj|?zH84f=?HS3e>xK~ux6JzX1VM{Ib9-K9h%|vW@hG`vZrxP4Y%!~G+mZB6O;s8f zdtWMEwT7nXEuwM9d3sB2DLj{Qs>z*6bLf!3_c7(kwN$RlZAj;~BB^coI=7mKX`M@R zkytz7v_-9SEtXl=K0{z)(8ShdhDa0mHXbcvJ#Xq}N^4fY>epr@sgwRnSVgKPwaALW zDVJ0n$ug6AB;`_*`dXSphXiIZbxGy4Dsmdqr&E!XR%-^L=R;ON5gYcTpwxXD=PR^k zz}&iF!m_2ThHb>M>)Qg=nt|4^MJ(7F%Wk=~Z1kFeOQxx6nKG8ySpQhvpLLOMY1lf~ zHDi5fC)c@d8|~(;bD91-L(W_03i#X9tm{eC#nZWO zB$EVQ#}C3H$R6UTJUr=0@TYu7bk%G2TUyvChP2g2LDke>xDIX>_pGa5!fJUq@tL^);s^np-3*gtN zeTG>8rY74-O&idRo~ET=3kvd})>A!A`%7Ln6gx7x1Yna7GX(_^?zAUC(7pywsCZak^EKh*&f9aiY56uj$|>;<+W*_#p|b_ z^|De1n47?NG35w0O$kR62Ufcp(LS$g#ehacs$iv~mF_LFVsP9gR_>C)aV;;g(JKZ9 zmg(joJs)GrSS=gv@$xO64Q zTC9((?mvZ4`5UzLKbbF3^*c6r7bSPp5v&%PDs8HCoZX_g}Z!4ZP^1+#J6mdeyW8Zl*bONMHd|X$NFq z;ZQf2_Q7yjmho5*+O%)eR*Y+#mMpngoAyv1+Yr>28h@Z|OoB$}Z6;h)cz@W*#Br`;sz&m)%A)B>CEd3r> z37(Agw>5lCy^X)nm4{dkQ<3$ugEq&hx2@d#lE0CH=2yJ*MrPtS^E>#-=GXJKDGNF) zVfAjbug%xH)t()#cMs!u#99_l`Mj1|*GBIyvxsC>Z0devNsaZfRl9eEmT=~SYMxi* zNroqFQk4x?X3HRY_pYK<-8N_C8ig#ivHr8luFa*kh+TWYqSkpEEVfc+dTXMWOuJx+ zUF+OFgRm#TavbYboAvF4-$&TB=G$O)a+U4ARFm%NnYYSDwmAhyt9q+!zv1PS_NCpd zv3A0Kmt$)JqL)o+A7z=Do)A52GJPk_p+f@nx=G8{MPkEU!4sY*&+;DYshjb6e}oJS zo5xkF$~3n2TOGfa&%64iEi>!1Gl+to*WHpCB2A!+$9&dRH^hK$2(y&O`u$q|9=K}N zP0#*nIBKz4eJq#qa%=Kaf?|{IH_{wBByb(mT)MeQp{wl!D{u8!KVbE4GBGBOC8I2q zB0lUVT$Yu-DL2Q_?W^*}*e&-3DMnIy1+ z9~}F_`F}0etU17VxbOI9R}rs?rzdV=t>`^Nh*v+iSZA4u&)$BfiN7sj z7ij_?;Bg4?sw<*!H>6qZ9_ue``K(tnM$LK+$1Rri-TADSn(xzsV^gDFNpt9szz;Fa z=bN80I%+>OXN>hJHho*AdY`qXnV$KLrFoY}vr;*wCYfd)6tt$kATvaoz*~6qNLIHV z(9K3UtBqs5i`5%f#VCZ|4k1R1JO?*o zF)IHxX_+-?;pgCn{hL;He{((7XIJfS&Ly?T{${X9E%)zz{Ql;2uM($69WDAl(0DLT literal 0 HcmV?d00001 diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/lz4/lz4_x86.lib b/BranchTrace-x64plugin-wtl/pluginsdk/lz4/lz4_x86.lib new file mode 100644 index 0000000000000000000000000000000000000000..aa960265e2a15e38ba4cc777421d7d49a3e5140d GIT binary patch literal 11606 zcmcIqOK%)S5H81ofCGsay`^_?h^2cCK8GzTO%jqMJkqr-%;C6CG|74NXLJ#CVwy=GgB$Ty7T#LAQn~oX${SQ!d^@PzUb}a{U0Yv2 zzqZj@g@VSt`xO_%ly!+oZIx!@UZYc6y|&T0ztM5Y+Y+pQz41|Pt-jo;c53DnF>KmV z`JmCclM+`RnOreT*k($lotIXcvZlT5TJ>Ja3}v;!h)S%gfztqk>a(0MbYXsS{p*K4r{^`b7WK#p~O9{ z!6(Z4R%=>py;>I*q*xC5@DW{a*XoTA%fb7m%hqgL(535swcTk{n^{`4h&8`nUGLZs zNhAzgT!Ic=9vgUewDUGvDsHBzIm%j-dwhMrwe~?P+M&zXdG2{GIo71mD)mNFOtl!c zFP5|!iIA1jebcl{CEec{@m^lIFl+jz0vHZUIk%Y1>zF1}qI*(GNFr@Ug)I|CB6&YpL68iI zHk+hvIm?KJ6p`~KFWJP&bSWWcTcMDmE@hb$q;46b?y9roEzMc^d*Oodf{^oO4UXHn zM6sM{*_Md8)OdxZPCJy@O1;wgE8#g^37>dX~oM85*Ho zG)V(AOwUn)4$=$MM?3x(z5Oyz$-B6=m5W1)IP#&nmgQ7yrKB|VxIA?=%W29+%wQUO zPR^2c*g7S5lS*WgvEaNmdX&etgQ+DPieJ+z!Ae7=8(?v~G23zxau;ME|LneD;;U{MUv%awFmMALrs9KY%I0}y> zY?Luz%OHU2Tx3e>VJ&Y}IFSXu$|k8{Be~?>RjZ~C!`UZg#|hX~<9LtD?33%2<*UMs zCF`6f7q~~a6w0Sk?r66SdT02&>jEk5b2}kraw+WYLN|#_xa=d2IB)n;RywRX+_gmY z!*Inhaa3^QRA!hFj>yMpW}+~yCE^wY5%{e6VmG5qwMUah^m@m_H`x+QuIUp`Ye@pYaC&!29r zRy)<=tYV>+OTU2riU;~}ou@ND#d7GnMjyuc7o_BPbe;-7?ZEXp)Uf>76+1Oe`v-U7 zo^|nO05tT~zN?Mf?X~r_dZ#dR<5*$w($bZXYyH`cd!EP&P=1Hs2J!ca@LP;P^PDJP z=m@QV1Xm{+k<+}?Kzri zVSmf&#-u}?-%ro8Mhg%1M#@il1kjr)@2)L-qWdCHpXr9W4PNUPmz4>*oZHbUOl4phB$1D6AmjGDD}MtrEe)syaD&)DZY?~Z-&cvNABEjtAfUpL=%@~jumC}SqV7WR79 znk*;`yLG6yKwgisa`LzjZ42H7p7$T0^ClFY(c{#P<<4SRRm)KalHpWttWrirR The memory position where the next input data block must start is provided as the result of the function. + +Compression can then resume, using LZ4_compressHC_continue() or LZ4_compressHC_limitedOutput_continue(), as usual. + +When compression is completed, a call to LZ4_freeHC() will release the memory used by the LZ4HC Data Structure. +*/ + +__declspec(dllimport) int LZ4_sizeofStreamStateHC(void); +__declspec(dllimport) int LZ4_resetStreamStateHC(void* state, const char* inputBuffer); + +/* +These functions achieve the same result as : +void* LZ4_createHC (const char* inputBuffer); + +They are provided here to allow the user program to allocate memory using its own routines. + +To know how much space must be allocated, use LZ4_sizeofStreamStateHC(); +Note also that space must be aligned for pointers (32 or 64 bits). + +Once space is allocated, you must initialize it using : LZ4_resetStreamStateHC(void* state, const char* inputBuffer); +void* state is a pointer to the space allocated. +It must be aligned for pointers (32 or 64 bits), and be large enough. +The parameter 'const char* inputBuffer' must, obviously, point at the beginning of input buffer. +The input buffer must be already allocated, and size at least 192KB. +'inputBuffer' will also be the 'const char* source' of the first block. + +The same space can be re-used multiple times, just by initializing it each time with LZ4_resetStreamState(). +return value of LZ4_resetStreamStateHC() must be 0 is OK. +Any other value means there was an error (typically, state is not aligned for pointers (32 or 64 bits)). +*/ + + +#if defined (__cplusplus) +} +#endif + +#endif //_LZ4HC_H diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/x32bridge.lib b/BranchTrace-x64plugin-wtl/pluginsdk/x32bridge.lib new file mode 100644 index 0000000000000000000000000000000000000000..ddf73f81b565defdb5210cb93c94663361eae58a GIT binary patch literal 53804 zcmeHQX_Q>Wb-paNiGpo{3EnW4F~%5US%{I02_f1>Xs{$?&9HfT%R)n4`PyH)QC2b3E9g9ncL`gr+opD7c&y7t+3ze$rMf1(NQGil1c`(=NBcO21H zza;9PMO0o%wD>Nf%6v`LH;EJte%Me0zo4b-H7(nTD5Kxw7gSxUY3U@$LCe-^8hius zK$Q)ePCb`M(Q@c0IvaV&Xav8YGohE!Z2W?ndl)(ozo4_O*0dIUMW-z`^fUZ|j=M?I zrP~oHYTT!3_3wxjU9zX9##Hb@tGYB@{2-B{qc>?K_IUXy{>0wY|Uxol!IN8h$}*5ns_6+iJSv_e6@mKVaxp z{DMxoP1C8nqJMx+pQGv2_YnqN^c_vZi-;6mJWJEjD378Gf32yGGAgAycGpOmD zKD00B>7z7VyCadJ$JS|j{9{Clu0$L~w@uLW>~2JgUffyJbBl=-ZQ5SbD-RMWx*2IH zy7o7kegv$H9>Xu_k)@g*zJ*B9BPffaAET`@`V@W@p>7pD417gT?PTZ_{DOW`GxRoo zK~EvRqI>t(^x$ua6y3jzrUy{Zita;OD!LzKQ}nD0CG)hPqI66Y{F)sv|XBJ)20;RWEB=2OLE&{+Ff=ZxJba0r^$5=@d;b zo((zZ)(x8OMtdr{^A1gSJOO;r-N=igyDrgmH|j#sUAt+zb3f>Vo;*U+I+RDzlZdP6 z8q|ZL^_YVcz4W%GCmN^^&`sbedi*3!Hy(`o0bPgkDY|xzrVWcx4$w0wgQ90I(sccq zM2c=1)b#v(B1N0fCluZChNhcQZbi>Orsl6{!j=0@TGXfvEGg5% zh4T)bGbgV?$2%RZ(Kq|hdEZ(%b6VdtS~xw6+f%EIAbw?Nc%k5EY41p>5r_>-%coVV z^?n)Mu(W(uqpWhrQr8@ldU<4|Qd@FRIfP*RQ1j4Atx#LbM2y~ov@?FFS(rAoBWcg7 zjy4Bn>7b}eWF#W}1?AE}R9OqOE~;YYq9uow8_i0+Cba{R*6(S~Z`AwC&1QGCyu370 z4iF+@B+r}N1@TAsO5YV+5P!@q5An=%j{f`bMrFh`vta1}vOd4Gq}*Fs9cT%G)}2+U z4NNaJ%hLu18nyyr67XgW4Ro(8yY9z1{_mNUM!Dbhm^>dGly7cnSb}8?$a>~n03VKk%o zQl@h-yv%vWpjB|JN@}k)YggPH{>jR_Ja+nLxHMt#L*|%yqr#9WQ zp@+UTt5F~79cjqk67Y433(8AoqR(`%WZeoa&)7P}zIrS@&xICxyy@6#V9y^3Mp`J- z_|u2yRGLAzvplUaYqZusf-w>+cqr2`=G5!MF>TH_=#5gXe{g2GiTSmpKx8dU&x;YS zx4%&t9+^}3GjG6j!9#1+n3iQby#=EjSf`)yoJQ|Rna?F!MKhhw^x?kxk|k9>8)`i- zV7h2zR#>Z;ah+CvF4TIC?=+_^s{1896FL~wYAsR` z=aq(dsyPX?XI7e}=8%{eJWJ(sq}0F6%xqcf`MD{SKpPr;gAEMN{HWu6m9E}&G!Gpf z;9G#01U#LkS*50&%Ox9nbIY~S?%GIW)r@MTf0^G|L`7iQ0WM1>xJ>Ji<>f}TG~8sZ zYE`|6>0>((QO&qaYi79`(aN~cn$}n{s@5=>L&0TQJ{zu?tg06=eVIe6YIA7AGKYeT zwA8dGbLTil>Y-h(l!|8?J((M&VsoPYmbq{o#66->UM%A}j*%iRw)m`?m4am&9a#pY zkZ~ZzuL{nnkLLFhLf~~{>w{9Yd}#JGF$d472i;U~Gp*^vs+(ib^Ul=M(idaXAkzAJ z2M|-25|Mfj&x21{v3aVYnoiMc%`Y#)3ZWi{Sw*Sj7~iDFIIbT-vybtiIjvTzu3BBT z1C^zklR&$Bxfp{wsPXh>G1yrGkMp%=_AuUE!$UgX)In7UpsRL4^Bd*iQiCfB?m?rK zzDB9mtYY)kS6=D5Po58s-w^5w5iA7ItFtU%ujmZ|d49-I+c{fraT&O1wK;W^sM&-u zhG_?UXhJPp)R>ZIL9Tb2*ajR{DX(zdAR=%qJf-5{vD{D*SgJZ9DRgnNy2>``tD@0z zau;(t_RY(NVO$w$Mq}pWE+(e*f%=NR%7`C^aT&PiE?QlV!ST3!N7Fkbe>jxh~w@Xw==p6LMV`X@!-cLA`+Ms#^yQMs z>+lqm0lfmVus3HHNjV>tF{7+dYa_C09BQb+W24L;5IfZ1v0c4=KpJs9o)Wf!FqF+K zjg(>y&ZRsSO4f_fSS@4g19Lnx-+ho)Add_sUVUC1#4`h;uhd-Tbz)s-B&r#trmHD? z6NXL{s|Z!#tgm_{q>)*GatndrLQ9W-r50Vhyuj&Zd(NmblQ?a?p^K_>k<*8@xZa2_ z!CVA=Od$)({pj7ZDq{T%_|QcC%)y?edu4xlIOq;}5%kfy*>cZnJQP4z?at&h?l@lB ztxQ`i9iw8{Uawc}{YoQZsWiGwWc0&DK`Hw6K!p~dE|>G=ku#Bs8y_ea%bjF%J=9iA zFJnUw$*A>M?^Bp!z=x(WPz-02BbI_8_q0$T4A_`5i{n^f5GSh}W=$#-E5X132Fl22 zb9$-a_6KeRN2Q3R$5L-)pp0m&`~e@D3((NmF!re(L@+k;BA4=f^$=L*Ylu$S@tx+3 zQni|m^jt2O#A)|-&&G3Og|EdX%T54Y^=6~DKHBIns{!ZV3`Ip?s?LU<(bMl=pM+c= z&W1udV^&H7GE|eco6W0_hyfG|po`fmt{Vz;y82an zxg1G35b3l7rmHBV9*Cf?m+yJ3dK^bdE6w3*Y1QGS1~&pm1Yp_6Uj5872Uem{`Cwk8 zfVhX&8s>?*Fm|zuil4nJvhN>s?_))ZixF>Dy?-=(re-{7^qBWhYPsf?_Nd6^L_e10 za$wm`&!n1DbbM&4S@EDoY1sMZNFG9&R6LA3jzh{g!9t*`g-M`okn!lqGR2wD(Z!G| zj0X*j^;xCmn9AWv(^nUJ%DgDhS1&4HIAriVijyK1hL%9Vw9y!W>j{fmtb+Kn>eT^N zH2vz7PkcE^hNkxVJvF^aWG*&w8Mqj5)9`e#JY0YSJ~UB6Z%=RoR&b$(t$yYlrL6mW zjSl$G%L)5iER*X-slPnEQD4#YuM7%=U>`DEuEFl9w;rs{0zNc*YB1SW z)VpbIWzjnp7Ntl5aq~-$*yY5(|KZyGZL*@Lvaij}wWGScyC%4Rv;51LAE& zel~*l$gwCZ$}k7NuOEYapq`ZT|8md)z&RFa4IB>^{GVUL@2~LtAE=jY@p~}xx(VgE z2K4u{gwU^MZUO@TQp*@~JecXsTM}D`x z9X!yxpuRi6e-!yZnXbJFZFm*>-qrAr#_v0b_g^U2TN{w>3&RHXxHIxVL^ zqFHnh&7^MnE|qCF`YP=~6X^4_k}5Pvi)nA#g}z2#q9)bpX!>{BlNQnnbj)FD&{P_r zA?l?*+JO$E&(LS-Q0k{o(>ywa=FnXFW7>)KqEFF|^a+|ltLRT@2~D9c+LtENH|ZPn zb=rsaqe(Q8YV;R$IQ=F4Ien4F(^C2zO`|`f{pnBW%k&j0(IT2p-=+ohCjEl`p4QM$ z=qCCh-Anh=ee^CpLw`%h(93ihy+m)&v-BSQ6a9?dqPOYa=ta7Po~L{0RQenGSNbb@ zjebiH)A4jG-A1?59dsu>N*n1BdXgTeAJY@`82t;qLl@Jp>2mr3T}oHbI=YfBqwmu- zbTwT<*V0w=3Oz`t(^~o-ok{1=xpX$2L1)n~=`OmPj-})11^PRBj&7!>=xO>5T}S89 z`E(IoKo`<#`Um@}gq}NYr8(EpQ@- z6|@JxNDlfzRB%L8efk5Lj=hMt50BVsW)1{43|pTFXE{`9823Bjs}?w1YJ(s=pYpy% zPGtPDjDrUfb`tAB5D{^wDI28#Bc6VkfIWMl64QU%lLp|R3UZz(A)9-XWY1KY=cv-k z+(@m1CK%4eK_Acn#}?F9y$#!{w_#iLHY}>%GO^!9l2AnhWe+^)6`ElyNIfYVj`0Dv zA?M?681RD#oV2yT)TvJ>v#VGK46UPUjCuYbOTHF;RL`^CO*+0Uk1PXsp+kbo*HJ2j zj{A8x7W1@d-|}lT!}M-3?x8@-O;A0pXoh!HGvVxov36F`oWLyxxz(0939NY@SBLd` zVv|nZy-W+FYZB7`0FO(=(r1O#AEB3IYbRQ=n9MoThP8Dp3*oSXJYWNE)M3@|k?*Wd zm5%7purtWhLx=z#^!@20&59gwfTBI~gFp3bsg=#?rYsP;L>s2_5K`gLXB@ng@0_;Z z8Lxck>hN^!2h76u#DHVvUHehe(0x8T00F*t=6CVcLuyu$8ZkJ<5cur}2N?Ld2+Hq?}xZ(0~3sye8Tv~o!(4|su7|ls3Rp!u1UhyJs_u53!ogFw( zD%mJiL3w&0e?kWwamL0vhh~|v0p=;H#-5$O)!&%Avo~P?Rl%&6!(spxXR=d8&J2A4 zUmFZH(_6)K7`7t!woG&QI|0q%?`$KPCv>x{?K2JaLN4ptNWlD^y%FQW!k6bJj(t&Xf*8J867KzCz-KSp`0GIZ`ZCbf zZ}|eId#&jCVdO9#kCL}~=55T*!ic)Do>oAUY(K&sA7dwQSmLo%2jgxk3cTu2ZEOB8Ay61I%VUA>B4-n*3su`*GH#;oQp|bYbh=)(p<|pZYoyh zbtT@!I4*p#(1mnN>zswe3`2M$XK@%udmS_G68FwkGu_IiRw)0nNejcN4WNNbkkYen z&duM!5)s30E zIgh!-^4>9cTw?y=PSLx;c$W3$aUA^w6l5;qmf$0Z7hRq$U(Mrw<7oc7d-@#nN`f?5^UQHqELz-y(Pif$wU&3oVARL*#joN-*XL~!G;4*6*=X0B!;1A-6(LgMV-aePt=chSz?}{u_JQ}muakjAAg@Rmb@#O)i z(vs(53ws{p#x9~^VrJWuT<-stq2}y-PTyJk1V;{Mr6Y&3wEwxNIV&KSAO&v=C0`3o!gz$`(baN7GiDwb=C@q5aaA&zUWG>W;~5nJ!9T(d2w@*K}NK z&}7M5mbGy@U1#YO91QQw-YJ-DgkxKdW!^nOs%k8Da?HC-`bT69pp)a)P|oL%m7LEl zqnw|&k9ujuN*WdF&7!|bL*c|wf;thi6bnD^B&H)8>SggE}l|8k-$#u5)Z7!j_>T1mt1~L}dzkRaS3NAR&1wXWi`xx9V?zz?&&P*z*f-O7OS296pDG!oENxZ#0kQu9R zc84Z^90q7$J9iO<1zm8%+!b5XT{Ml4ou{%FJ5vwPjldWctz|ukm$R=2a%N=@BxWPV zx|jyc_F}0^PMqC6NYGl}12(h42NFEE79Hbu_V^%*w8{rUZ<`MV)Xcunhn+u&y^ zO?=GgO)+fvkmH*jz_WUaKb6Kmwl#itf?v7%_fb)(FViP>_z1WvMfGoc(EaOnoLlK{ z)SLCiBjfj6@Rjj%dggsAlLr4OWff5+0O$McuO0CJhqAu}4o&T^4-F%~_pkc}{r7)c zKov**QyJWvY_X@p^ImZVEhj6WLfXc1x|9wWUT3oBDE@BhKl4weMQ}s+|F(v!J7GL- z*87`8hZ!dd-9nFM^P+ zwm?s4rFB0C=)%kD+pf3$c)jV7_HzK}rjFNJVx&zrRg`sNHPZM$HqyE*Uv=D{+JN~T ze+V1&XQ{q^k0oGQS zF}V}Hgc6|^#@OV^ailK-X={&!JtIty)9%D^ zxvvEXp!Q2RxhsyVCf*NuTt+clLamh44*8&WjtAn0bBO8@Kp@CaD|iJxba&u= zB!-v0(e4m)-*~Nl0hrt6FtgY060q%Y=oX+zt^Pp{Q9VIPKoRP&R>#Hg#-LVH^V%OW z%*_8l6liS6g*x4*js%2`4H8m>TB%X{@wT7^cSWE1s6}KB6C!=tnjNBjEI?DQ@wOb= z#{;x681adfVut|Dc@fA0wmts33g&OMUHT)7={-_9M4MtCP=dbl6`<{C(6T3M?#Qn_ zJ~~A%=%srC`4b_sd2tp47TIW_zotsOQ;2Kd{KbIVZrREDxIQLyxtrPpCH~_OnR)1l z63X$@LU|__?BTuy)SWr1eQ7y1WlgM=pX8`x*s`e|$fr2wnAL4+&-!VLXuPUAY{kT0 z=Q9$?oIUIiFVSm0Yw$3e`#0BP(`yRmKDBqoh-B7!mFBlvW-0o3YbR z%+X)=cy^tIH<1Jsp%(h4x&9}&pHOwVC&SZTs3LWV+yYi=*7^#^vfix{uI(9la$+Ue zi{Ujwx7ki{6Mg2Z9@p$za!uHNISXcI^?bj#$K#H^ot7|Rr}>&k6duG9QiNLRI|;-I zA)@hE6&UUJ)`D3^?XF~3d8VZyh* zL%dY~{D#M~PWv6ArBl821Kfmem+%W?QCqk`^hD86|pP^-L8JTmoK#+y) z5bsYs9y=D%AzosgIDp~t;}#tvCfe^$L&V%*5ZE2o=Yb(w<_{wf+Hb$a9_r5+Ue4b_ z!j9=2Gu7kz^DLd>CH7F$JRUzN($e50$%!3rkHZQNdv%7Hvbi2?Fzq3-Er;|ihSa&;Csn373~3B(K8gL`T!u7O z_MVhYexAV#Pw92mYLg4*O7%p2h(|CWu>DyxF$(5;#Nb$=1QnqcMqXFJv%{xR z%5Qs2bzD&--Tv&A>YEEZQpEK@0Jl=6f_Dze+o;zg>GPE$@%BrV@&W2|Si!-~PB9bf zz@ZG&-XJI8M5u+@OpUz5ELw2VRA9)C(*oj@f?d&GXurb^V$liK&X7~@1dcGs<_tu3 zGIqH006Kjq#bT522&IJEHiyaW}Y z7TPbh`j#c;*u7~qMr7gI?lGz7-4TOmZ!wWjBGf`JNsWY2h6MYPx*bI%-+oP|%C(%K zje(6RG3Hh%B%H8~UFRYTC_*jNW@=BdGJ=|26C*&{uhZ0X=PHls4!KJ>5o)D`iCJZ} zM`QQe2n5-II>bB1x%+)OL@ls#DSzxW7M0!oqb~cv z_m?GT+p}8ApX&Gss`mNseAY>MpPvxH#auTQr7f_IsuO-E8r0ksN}bklVkdPH#~icq zl3G7bHi+h`0d?n7hviGH`lm3orn*e3L#&hy|5T5~Z>j1KF=bCb%_8cL3UrE8@Eoen zxt=bN<^|O#fLoZqQ}&;=2Fc&oB~q8jEnua_`56`~_hAJIvl;7e;*IW^g{YnT{iMdi zSq9hLTqY~F?U_5(if3CacO{wx6QNdGF)@do$fc|38epTKB)Y^0vpF1Co~w!qGiQfDGBF-Qfs5K7?odun2ITxyZS>kT`^ zOwFj58BBj~q68D6R(egsesMX&V&Byf5Sy_kCTjGGDB_k~55Mm)%~ydsEMIC={J>z@ zt0^Uv2({973168jC6d1KQUHu?%dL}m{w~c9F;ipVDu$_VSCe2O)Ixoxo>#7BSmyFi zk^E-VX5#7o8it1Vk>XZS2`fS^lrgmrzBYntZYvcqn^D%pn7=N9n%!Hv1u@r0Ftb}x zJH<@2>Gcszd*`Zz6`@wzG+|x8L83+~b}Z3ulxUGEZ5u7IKHVhI;+5I{il5lG-E0u$ z&A6gWZSSH|_u1TH@Z^oV9pWYId$$@qcO9=X?$xWKL!tXc`?Z=F8Mj4I^%cRLm32zN zo_KHAGHwr1VcL^d4|j-N(2tb2*&QJ^9wGTfz?~tdY^irfklnq&5_U}6_^uF_-N7tj zMW~h8FVVB^4pG_N&H|_HQ9Gpobs}2#o)FdD1wD3cJf&bo{TlG^EyN$ImQHz6-j_!o z!@m8Eg0)UvJ$io(IdXY+XDy!^T|bQEz}+q^VcQ>F30vX=5!^9r>qJj`FoGLgBi>=D zrxaMDC!oC_ilO5ePPObV(3ay`hFX|gQg(+84n2DBd57gry)FKcLk=!f?+`Qfto5+L zG+xSE^xl#m3#_qtvYS${i~K5j(IWyaa>9=3Hg4sabaQTElQ(nBa#dT#}l_)aQVF{niVTR7U zqP(r374%efI%s2vrav_xAU5OKJW;1lS;X8o3?!%swNlE2Ydf|9(yd`ASG(}1&=5{#L;0XQ`YMjEvEUxhlCQLR{CsW zrhADY6}qFe-Fs3k_%cIu){pRlul5lWtK%yck$vk#)M5K0GBL}&YSHY+Qu0^NwO_hK z3;s03i*4iDM@&2e{Y)SRUwx4k+dgh$e*G(fi^Zehflp+ih4GPk_V{aonfpwQfZB}J zGO>F7+#t*E-$+0aYN4d59r9}ykA0b5q~G=^Nj>HK4MU4{Sb^L^$x`dp>jtavJ3s<# zGg>h*I{(&U597NnW%q%hP7xEM^9_k8zg*NI?v#RAR^8P63xOMc5=jD!Pz$Y_I>G#= z!1bS65*Tgw-PF_F-w8zf38&8RQZ@Tl4o_eDy-IzoN|sE9TB+GY-~FY;wV#}l1#N$Z zPpqA93q-b|>kQT)BY^B>8QkRsGdohEjZ?+8Tp@ht(e8FNr#CHV(|X}{_v z0Y#{lGA7<_{Yv18uZ0Pi%_wD}xBjC*b)O;Y6fse+?@C1TeKQFtLao$mqVN2Zz+>M{ z6Cmx^YU&-suO;ROTo5KQ(n@I)z387MGXKz*3#BmYOPvIt+kY5MMOkIM2e`0h>G|^M8$sB?APqsYi94wzQ_LY z``yoH-E+>KHS4=(&6?S>XRnz#<>E?vbmt}0FPNSDo4F| zPn!-Tk7?s#pRTwY>7Y$d`ZQE0Ptjxe1YL$SrnU2YT7M7lKx-k7X^4E<3=F2rPYUR* z_yld}^J!BX@bv`^Q3lsu-ZA&cp%7kzr&yU1gD?ZZC3?mYYkz4lt4u5N)Jbj>=S zu6i@_frg*=Y2-uXF4_J8 zdhs1ZAn#!41)_&v@afSO5z|A*`t;N7L`)An>(gi2L`)A-KsVtN_Bx z#%5xoN3QefvAsl0Uwpx*&%GJ;1pVx1ioE0DOH8N2$C*xg+NW9fk;inx0-sJhhdic} zQFf*ifx|Rw(5KT;R;E*K@#&-y$N`=FqEDwx$92%D$NF@_osbJU4fbc6eWOn&J_@;@ z>1d~l9>gc;KwM)wXq!(*oJk&tKK*?~-tw8mL=VGHK;BtH0ihnxx*u%;zQptu)GyOZ zkNEV+)36ihG1!CYb1(b!^P7l3-i(KRI`W<5F&%|^2GIlXai;$PzaqjX(~XL}RZo(l z)oA}rN2C8x^d5YIW?tmes_ozd9mHh=9q}%oj+_NN(7wnEqNgubGFZW9E@hcj6Ot?DBxXe=O*@H~4h?O!y&) zPFF;~m_Bp#3rmvumLEfB= zJ}rM6{N-&#-@Qzcw+J{O`tCi7yv5fM6Fq;4B5yJBg6MhlQy_22h$8yl0%G!(pe!Kz z-uo4KOJNrfeII&*ybFN~qOU!s$UA2PG0|5c6Xcx@{Xz7#?TWm!AHwg4h<@;PMczf1 z5fgp=ZbjaCm!Lm`Zcm}DgS>NK7Z5%5fFkeQRm4O;JXDc)(Y?rjFVVNZt;kz=6EV@V zZ&l>YKc1NATc|gXx8QI^^ds~^An(;5Q$*iC6XiJ*WqU*sedlrXSMayK8x+xV4-%8N zsI7>8_!i*9UtWzm0?~6QBgpG}K@t7v1<1$ui$CJiekcpmz#K*N1Ly?uE_^@{eSI~` zzZzw`TM@m0{uAWAW`R%pfsbk6y^82ZZ-9LG*u@tqqNnddJGzU!^YI%*-?&4OHy8Oq z^voPZ-rPIz8)@I1rO3PBc4DGu-lNF7;2iuu2ex`qk+Qm&MkMe-%+igYO z!s)R0bnx!0$eVvF?0qY24}S%D^WN#xtA@x^bPqm3hd!o=UWOmM{PyADHS32i-?({r zaOI{I8`lhNzI@~G-h~UsM#gD)c*B+J)}_vn46jY{1VpGaZuiR#3TT4QXa(y3O)#@Y$~ zbXt(34PKKoxE65iY1g_{lO?|WO5vp#ZIMsMDZrC`<&NJPPE3G;OsWJA|{Q})jA>r=Vi0j8atZf z)ucxxuj`y03#WgbIjar!(eCxFs>y4nF!x9c*vwo>YLL9noZxF$$H!3Cgh3LQnGe?N zHf1Yo*8_S5UC`wA?tvAP8@c8bI7)`&F;+^br zodwdF)4!17W0^_D;7Wp1HR)DmvcokS2u)l|b9Z*tTGhRy)fT&vri;p!N=)RRs5U0i zkYlL$g2Y#Cblcabn8T}5j!v~zX;->U?*D?)1Q2>kD(7guS~0SOmr}gwLU7CD_ND>E z7gPL7-8fy#WTaSgj_$0E?y4GA3p2-wsr&%lUF+0F>RR2hH4@iTxkABW)^uVjKcqJ* z6KTlcVv0W$na*USSaa@dc6U_`KMC_jX{p@p>IC}0WHmjlx$XFl#s~R=~mj^ z&S<;V(i&p&VuF89rPiHnbZd3h9<};TCnWNPy;gN^s~z^>ak(t12?=rkCCjj;8&c{` zHPQ*pGua4!C%BS4635O;XJ@Q`@GBuBER%nWv6nfOo{$okD#aI-z=G7jY;0^`S$ljE z?WsGkN!9Vdz*WnJH>_O?8n_zzGgdaAonvVEl_3J(OfiHW$RStG)qiQVYteUT+1h#Y zV!_#rEK4aAYL_hk&@zYGuOw^#<-t(JQUJ}`IXL?VtMzKPYLOM&A&V`Lv$4_`7lmzO zM=-@@a`&&`JCUT^wr!D5IeEBt)?x4@$r#>%%Hc#+eVR8F%G1BB)2UA2t}+mQX`3Ff za%kD=q2+^d@k7o$St9u>_hzyWEfYX;=ZlcmS0}7cQZX|5b;%BOmJhO_mJRBj5}FDa zd2{w}LhD}MZ0?$`VGaB|uSmaDWODZpVs0G6p-jf$ksvQSmwt7nJ+`OP z&XB#eFXY>dY0Kn;LOCIU#X|A9i>SufxpS$0cU8Tjx5nWOTl@IZ%EshGvP9hdW;3h1 zMFyLB`^m%3x?a61tw7wf*%??TDX*c2m4&e{&%(AaFt(IrU|U%jdqozug@Li9Bm>*Z z!q`Ju*cJxHmXZu?D+^<9%EGoVFt(IrU|U%jdvg}Hg@Li9Bm>*Z!r05Quq_OXEhQP) zRu;w{%)+)XFt(IrU|U%jdrcO$g@Li9Bm>*ZqUM5D1utl{k%>5~=-m{YS#qTq;8*`24kY-|p-xyp)Wjc1i)K%*+&HM1GmfvsPD3E=%AViF=NjErG*6S{NleQ~!EDgvXG*E%Bnp$rDPr zs@mDmG{oSZt-mP=`ot~oe;XP!P|uBiAR)TD>OtZOXSNGK9>mGae;#uS29oH*}-J7z8R1igQtd6Vmw~;9~mTu z=y}0R%zRkL&VbqZcBi@$;WOwV@w_mwzSbE{xU%UZ`7@v&nP_&as5TCJL~~~h6M$Qa z_5@NS3*>j2_1#s!l!oFgH?HR#oc+t{_2#Il9(pXTeYjZA(yCQ6d$PxKaP+Uj&|qMw z(naWJL$f~`%*td@vKf^ueorrmTbmY^!P&o+BeVrsD4U^L4o+X142dR{s5B)mgB3j| zF9luJ7~5EF)hnZtqTEcBril?(v1}Yz-#rPtKTg+IRj~a8#9F^ z-k15pT#Ve~qR;AL4kca6HHdD~daOLGEN?j$PNao#s8mvzn~x=Js@;%FlABNY+4Aer zv{N;{QtR^A#~fU~f5{9m`pVcJly^B9l}1~eZNd95H8gT?`5MU#(CAV_BPXNMXmF3H z(i%f07n`q>g#${hF_dz1Dy^=NwHi*gn#!1y&)3Vwf>lvk8CCsduqw^OuEA8x&gAPP zro&RELM}c$7wu^Bkd}uY19--tMBrW`U=>kM{^j%t`xWJl5I0mN(5}*mxHsg$ESS5W zy9|3db(`hjjHJn0ByZ87JST5IcSQO0%fT5*b7F=QS^=_?x1Uq(`oZfGPvkkdF|zLN z%r7-3cO+FVk(!D~XdBASu!{XHI^qsCmku0=w!wyOuf}u(Zpf_yQ-_T zUZOyblyq5_WO%PB-h?!Xp>vzxdM_46SY5Wu52UK_04e59L2=m%*Bc*XgX$o^Qj@k?cT%c9 z?#wII&YhI1dWiHr)uyb2Jt1iLQO2sa$`_vY5papuoi13 zrb3G{Qdo&DUi?9$lN zS{DbKugk(bx>%WfUBu+HE)F(dm&JK>u`>C(h{B4=az- zLrfjspiQx{9u6+0$GRMPSb3BlVrohc2bc1Z<#~L>&ZK-qPEPrVi;Z=W(~~}8=V49c zRMSUXTuKkI?vg&T+{&Z$5L3;%k!AQ?N)NH_3_YwoN)ItLrH6w{`N)bqK4NE5J|ZWl ze8k1Zy2$BCAF=bWCUUCjBQ7qbhgieOx>;f6QF@4}X5Gj#Vjo!{)}5h;l}G6zrl$08 za48=d%;O_=Cgme?a>_?sY^;l%p7aqr4{IW)nm*#bn5z`GHvGORJh^Z+bad0V{ zY!Vp^o7kC@P2}X1O|7dw;EMNUrX;$rjdBK9waE^;r$Ouk)287W<4DL$LhMecwMUF=Ls z7dbhli;GR^vTEJ3OE*ckXhR(*pVG+6ky0vyvwsL1RQSte;>Z$B9b0n$&?ExvQyH~c zVmm|sP_>G^j@0TV4Rm!p!)#|@JE}J;Si>^XOa`sn-*e>6@e0o4SQwtiagj%~;1fjK zK1p;lcI}=s>d`Hrt1kns_vprT9?bwf3mUq@quVxmbl@hB7UT17{C*PO>q8zr2D%%0 z=B@SU9^|_XpM+~en>{+|a*y5$>f7K^8~nH9bLO=k-M`(VoA5bU@#vW?9&Op`(GB?g z81l@$67ukS?lzC!4LbTNk3M=0_^$ToMSOqP>pXh+wH}>^&uj77!u54Xe>2jaANJ@& zBObj3*>^$qcHqo}+}k0ui?qc^d*V|>*W8a2DX>%eJFs*1!v}lx!ox(ZM~RNbZs*&7 ziruguAZmYxh>xDQ3G~s^Jz9E(N4viaJN*P{pT~~k;J*d@&w~FRq%A)a_(;DK>CYj3 z_ZNv~e2%D#o!_5b>Ct zyo(R;=pD;oyL~+R_$40Q`c0x!=fM{Ey|f=?+1H~F;Pc-7J(>-^)>m=Dz#NZue1~XS zA8h<%qSeUv49dIX)6ffYSG`2Ed4@;VJwmkiG3;CpJ>LvH`80;xkB7}q_2}u7Ji2d| zM+;8y=$zAlf3ioLPegs;+S1eEC#QHc0-hIfeLB7$i#&IN_YUyhINPH~!MkO;M-PG? zJ~rzcumS9I7pGt9 z(fbbf=a#@0&qp18i|FtL9!>iZ(Z^nmx&zK5zu{(;P(r-{sQ)P-*3MF^^4!<;PXZ3bu;wp1K&r$--h1Pq4&PHek=5z0sY^J_A&G-*bwv>+S}V< z>(@_1`Kh0Nh2B7aM(?LfX*I2(%jm!9leChqpsVON=&$L|X$4(QTj|&6uV|EZ&>#)b zHhL5NI^9lV^ci#pchEo3-_v_&fY#HMG)})te@S1ZN%|4}n0`P%r(e(s-cNBP#A)6I z-WlFm-nrh{-UKc3_VX5c2YBau^Syn%J#>h7g!d}%>+}u!CVh*(L*J!?z30|UR`e(Y6-ba5&*U$&)pXjsn5Pgmwrq9zO^qchC^mh6^dJFw7{V~0bev5vG z{(x?!Tj=-c59ua)EBz7OOlxT!ZKBPzlip2#L0_ZY^a8y|KO~sno8|qCM(A{Jo_D4< z$2-qE$7|4HZ-1}PJJ6f!E%5gB_R^u=k={)2X?lj9rEk-7^gPY*zE8({FVQsbaBsSI zs&}+^l2@f0s7@_v)3M%cuS?g_ZS)k~N1vi$s?c`2mR?IArVr4+(SOiC(tpu^(!bOG zXpPh82s)CEri17}nobAMQFH>GNXOCfbPOFvhtt9IDms*A&>=L7X40|$-&_74_LgFv zat57AucnL8=buWa(OEQy&ZcvykIttBbRNy83uqyoOY>+hokX)~30+K!=t4S~PNAjr z8d^;I(tb1*GWH?+{=VT(!FCQTWeoS&)uP|*d%Gkg%6nvpyT9aFuj*VG7HxNG-9>d- zyd`YJyfW|pu2Bvw(y$_^m2NtxLwsW2)hO0mj*wR&zY&idkQRjT2J0KcI@6+Sc-e4} zD(sr6rKYzp)Dnd%)l$uMjzLn6wZ7phQ9<$GAvovWrdc~oS~mB=Gh3*FS%?IF=Js=e zl-0R*&5Kd9w`JBh$doG3cM_dTsK_*vRH1pf)TUB7R_Es4o-mG8cQu5ZG3ryZK-0CH zH0Ppje%6=w!sca!^LW{rVi9UJ@I4lgu1zHRfu$;U#?FBuh)~~3j;4pu05lvSqDT%> zWUZwA)wmzxB=OxQzm-&};=9BsReag3-Y!7099I$MUG9`D&k077-MG$`gsBs@_uxxP}ZrrNVc=8SIF~?QD$d-t&k^_qs;QWYLqON zIjn7IgTBB$Zi^-Ob#5xOP30w^|9^5DfiN?ud+-96ChEm4KVsvAiECw7#$xdTh z0txwL9XruV+4bXOQFxRryMB}`S4f=f7B2f|lw0<|I9YrF5G9w0e`mW%8#x9hEgO!m z#{2Sk3^UYWg8o#%`tT-*@{J6c!UQRk<^CpYRj$fic(cV&Iq~k6+UkTc)NFfLPHiO3 z>p7B3Eh6r)fcdzkB3ng^H*PC;x|CMd9BVtG^5uA2!MyS6nY?S2axW87t|P1LUp0Iy zRz-ep3K!=j)qVxba@1PL^g5PsQA4c9D_Dc0WmbC*NNc*d0MgdUL2n@KE*vIh?XbY2 zr5%EU{Bj2v-tOc(aFpuYLxF*%?STVeX_snFVi(9-!kBiJFqhR&%(E-)Q0{$=q9xVxvtRtQ!;O=x*I7}#;0_XPM;Kn$97j;*M`oVl-*^)w8G7xa2(Awc9_1)t)Toi|w19&$T7 zG1sbaU4V>~xv)GG!J{Cj9;tzac7w}orp7o*-(S|T@h{)B)qcrPQr}=Xy?3pJGr6~= zxFu*(v>)YRW|Oo~+u~YxdR7lhy3&e0t+&XRgwNc-Q_?vl7fhKuIVVgJWXPei&sku9 z*#hPBWn(g4-jG(%7&%hA5L>K~V_#W>YdZbY?{A}uR_tk$;r_spMzOZcm$X9CHwAX7 zT(Ml+A!h#6EyKx=EaGu%(9<>#862c#<-mKS;Aux6pR>G-dCOSQ^dk+w^Khk0`*1R( zFokJb1&%$qK9Dc+W zvdnA34Snyn&1~un7Cj;f@)VCIL7wE%8L}XRInJn_S6F8`H3V^ohoEOVhcg9U;YWpgdAv^AE9!B$lTVx@#HZ!f;2T6xw14<5+zD=B~hX@5fUd_LhZvAU~8UXx-{7l374ijg2Wu#b31qD zh&FSRpS^=&N3KoWGLQ4Kp0vlu@Y&A#v!6g{KS|Nw!BBoGkM>**m@ubc?D(r~tLyW~ zkM3yqyz<{?u{^zlNBMNFjdT^0b34UcJ3uNX`B@+8u)hrt*6Td6h+`0NRQQ_pLzi#d zJUqB^(~6C2hBjZmad_{-1!E)QNZN4ax^?MvBp`XXf;}B;m~R`e@(J_$l}>bJq=nQj z&IPQ5Jm4Fh7#pj#@dRDnTOAFu`j?Xzs(WkQPHntVsmDyUMlF<7ZHzX@sw_Ol+Yy{! z)eKJU4l+Uso^`Q_PbqajP4w(cDl8O!P>5lk6|<)@YXtG ze2(XMt-;n}6Vy7_A$c4}MvixzT%5^nHAtGMPVB%I(<69S%%+R4);ha+LthNH##&wN z`a~tfK~_$Uv+Us=p@W~DYGZ7|KV2cX0&zPqOV&}F&d1lf&FD(Lt2`TdK1_D1#V2B$n-l-woKdHj1I&*u@IE;%SH!IORsmSPEAKzpy2;xV5O6AU>* z&;p%;I5T^uKmH^H-&@#)O8M2nZ@VO;- z(48<(_?jSAFr4*V2$@%nqXfyOt&?Jlow^&vtvLo+feI08p4ONh=oUz2Msy*<83Nek zJ+bA#%aLcDl5*skCxb_P#51t+ z=;I8ni}kilMDaYY#w5oYnM|Tu29x}pZ7|8t+9p#TIAMY+Su*P+m4PNsR3)pMPqdT*A;pRpcN=M=oV~xqz0s ziY;&7Rz3!lCgT%5k~AToWXK9(jKQS&`-CjHyH4Kx<8MXfPLfsf&B zEYTV36B-ex*q`d0`2!^bmBTPdc{ag(Dh;`vRjn1#9y%GqXKsFzu_I5`#ycFWD8Ias z&fk;Y&X^~tSzgeXXNZZfU-Zgi-JGG8fsvR`ehHI2NzE2^8HvdZzD#hs&eTgVV)T+D z5Hre>8IBopPBsPx`JIT?F0|>`qM@0AR5P1Al?BJ=xh(B4KmFckZ{x1RisVKk9zbLV zfMTwY&8Uznrj*6Vs2CS4AIvX^Z_rMiEJL(c9>f_HM32n021G^ynqoF7WG)E0l=xkt zbI6uBcU03(4xzK-WQTYP$~gi(E!@e{nBkt5Oj232$Mz^95iK9AnW3KoN{}sGHBJ~? z7^oGXaOr)$&?(3vp;n;67PE$jnh*#=$qo_~Go_8o-CF!O6jdWbBrPQbj7ktvsZ9*q zT)h6WgcXn0eh|@_!6$~3YI!nd{>=iUA6%o*QcY-@O9(L4_=T4MwlLE; zm-HIIP*;8t;D_O9g2egB6qh*5W$wf)zYZ{E$u9&_T;fDm3NfEvh=+=qhr;l|I7H9>T$dOt<_X&kff0kd#{KNhQM#58UQLKKkT>GN?2viS z)}{!yR%+>cx}MIVkMitL6xtg=sYqBM=0ywe)j8#fB=lI?0bfd_WiAPvTDwx5@f=KNaulQ_}Pr_O8^86EI#vYyw1?Kp+WGL^r3gt~-?-0sbE5d{-Nf)gB3U~uxP5FVUhh=YXV%gIn-{kj-1 z95YO$!iE!Rso>#6svkm}xP*Z-2NEZ)?Fqt(eDHo(oZ-B8$BQ$Y;Yvk`2<1hSr6d z&1!qJQm>C-Wv{7ll-`_}s5DX*3zMsRTkWuiu!->33fQLI%Uyy!xYtfLy0yA$oRO(`%67B{Bcna>!Up9pwa#P%^~kFtg3Edv z4qLZ=E!D1r#Gpk-?Nhbo=vUN=jVs)KwM%}>4KBoOHhDq$b(}9?)7z=WAGT2KlFA=> zwwVAIja#LV7_~f9=%f)mLI%Hn?o_ zGV(9a9jn(bn9YCl7tibKo4;`BlEvz0^lx79t?$C{+xF?}ynX0HwZ9m~;R)EST>W`- z)m`=UP5w{94)lcG*pq()I9p+EZLHF*oW3ATITBxR_yau|T-XPn12pgB0pH@_GIl=4 z=?b7H!wdKvpxGavhR?&WYdZf;j|+7c9WnC&Tw-zj$Jsx8+u`eLqwQv=xuZLK&c?H6 zuUoTWtx7fiF*9dm0fhap`P)qV-%ovuL7>5CbD{-RKYZK&&@XU~f)B?z_>Xm)Mq!Bu zh?KTF!z-$6oMWHxN+0v!0`{m6axIFl@b#1VU+~A$343(Mf75Ut0HJ>=zJzY7yktS& zg@M1YmrPS$awl~1btTbD#^M5~ZJm?j*~zf=<))_GP<}dF)h@^5)p(4 zb4);%L3deVA1AuJ*s_c+ifpmrZKqY7y0y9I$yT`YoNygx*m>orO73%nli=P z=t5Z=?m7?Dwc#1FaFJ|Vs~9v6f6lCo7E3K!^h1k-3@sdHNi4T5qmQeNOlN&^EaEMN zZ|OPb!yX6g_;Ntf6x7IKitD1~ZvAJXmS@JuW|)NmTe!Rq?>@{&&9OKbQu@3p(HYW#RQ)-XnVqG$K zGALt@#g6{xcvAqocrxN-g`RUSix^lN{p8bO zvBM8%vkoiywOU3{LkavPmJt_Eik_0d&pXhKmC0!VhYy^}8f0(f5knTYzvEf_v=Cj6 zRfzTn(clZW!bO&T;4IkxbcNrpBBmqxD2^zNZDsEQj(R`C$8An*Qtz_{%!a2{TVN$X zQia$GjtPowe^OPTtEOv|l=Y+`VI}U*TwXa&C z3wxWZwVxegXT*v3uGY_qG;nS^qZuInn$zbTwSI1ho_6=Cu)L+8xe)$#UWmLgcz>@= z?#Mgj#N{r2&viX7ee?PCqfTYhecD#lgwE+jEp@$$N!?Jo$C#n|IsBF_tv z#n@L~G~KH*&kvC0^$Wc$^MVlhmu~HaA+i|s+e>Trg~+|BXUE&6MIo|to2XJ=W*I-9 zgFcPVYUVq*WAiBuI{uooH*p{@36bqPTE%c$D=Uw@G(r|Do0kIi2>HSgSq{waA@W5b zvK;H*L*!RS$i1+(>n?e5h%78BDp|*l_WYU%b=|T{H%XE3hOrBe4qbQ3OG5PC+@l@s zxj#gf*MAs=jvH9c_UsrD4ur_PxnDWTyeveP7qgTtvjcf~ge=}F%OX3hy&^;wn{(NF zw5vT22FTKax03DIQQnmyYHwPU19?@5EUpDAYiU<6a%qVCOK(xDL*$L~a&(=Adl5&A zS`#5#PbrS!v;jiS{>y=US%fUEaxB}H9ms1VWO3nS50TeJ$l_Ye9wM)gkj3SlWsx22 zc|(ZYlb&<2qnAULu7f}*~2n#36bT|Uk{PDM#$pmuO#w?mZuvIeBTx#m)Oo#>uL%=`?$u3 zR|UFB>$uDHa4w5n9imROnpjMg-k_3S!(5r%#n9Zhs*FXJTB1b;P+PAJbt}4`t)@`? zHQz|brO!3GKJr@|m?lh6dy~#zz&okNN@!nm>SMVtUIP2PPS?lsE=SmTw~RK9+PYTP zMu;U)ua>0kd`sxF#PVMIB3Nfw*GGKYlG-DYzLitiqLw%`spy)7 zj;g%};w|Bl+Zk&nDcsw+BC$twO(frSC=%FOoc%VnTt+IVX>ry&c z`gx8L+L_Wph3lm6)g_<)mRh1jRzinbN{1qQZLCcNb9Ax z3vZ51)~njR&}dAB`+C<{zZvKtZOD|YlA9gP65LtY5X}%>12rP+}Yv)&=rrtGM|)${#Igr9K$gJyvEYrdY(72Ey>g`atZyl=6pecoI>0x;N z@b84!mfc9z$u=5z{54;{;(81+=d@b+OE*@P0YBO1jAFB{8yQW%v*(O_{>A z;d(dm$G$e|w5SzL?B8i0-KnFkO6g(g8+b+6J0v~i5nga$RvAq$wD{*bX!0kTCU#?> zYFwvhY0AZ4^ZCw&mXXm0==M%SH`ze&V)xlzu}Yd><sz=_?d_B#R?Sn z4$E^Z&&k|w(WM9eVR?e(h?BpTwXmHRSi%;rdifiR7LzsoW$f0zt+mEjbI(BOh&tEE z?r&vXFw&GyHq=Z~xMz3urtg#W=s}BdS>x|4T3kPYz#wBz-DtSQt>Ng^-=EN9Q=X$8 zwTg+q=IcXTz53s$HAy#FegY}`^x?3^9Vs1>UAk}zWo&}ty_lm{|A&+&l7ptr5v!B0 zMqGQDe8AViauVj+(tAg__Eh^vCpN;S!w5?`6u593aqVsV!B7_|mXaTc%UiGP- zbQmH~YKrXO+EMF6p(Yvo%b4bvN}v32s6#r6b82eBF|zoG9UJwa6q>49aKxegbEt)| z*Np8T*0=^210HEyVsmu=&SAY%%7mw>JOx5W83PZ5a#k9-1Eyv9nGi z)*LSWnsfAFd4l41fd3KTTlSy9&?h+%oJ#DwLu`3%YEQBMGs3o1dJoHePlzqAPwi>B z|0~3nSE%+B``!qcodLq8E>3wzO&zK2@ImHhVezaw1RZZs*A7avtS?xUX!@q2X- zcl0gyh1l}S;8ej2_brZce=5Z8)xFG7?)yV*d0le(ayzg;9bsE;q-Faxhs_@du`SJ; z&y0=hcxuPUp9!#~y=h9fZ%3IQ3~_taz8u(}4Y9=t{oan59tyGl58Bt~LTq`Dnx3|= zha+rpmzthpe?Gz%_o?YA_9GFtxKm9}vA+;ui+k1d6#LN#TimUtJhr2Ke=)@FRe$QZ zk31G&TXw7&-oWRSYn^%gwfr;5mqKjYb3qTWACIstM(-i^|Ag4K=Yk$$KM`Wvo(p=2 z{pASzmv8eYLu}g^wTI>YN{DS6C-xBgs}Z(koLCb3LQCIr8J>y07GUQ)#${_?$hZ0W zR<-=w)5VUb#HRwyq#bNZk0KqoUk`Al)wI3DeLBFE*3_*;;7V&tOXE6bRllupcQ*GFI3Bd{2*y$F?bp9=9B|3+50gX3!t-6OvtXWA8g#3zHI1xg zT7_|4caHCcxR+0Mvw#cNxFxQfSLuI0!rfhMX8{*3@gj?_odM(@_{dl!Hdq~*9M?jf zj6)Zv6!nLUy0ucvG;(27*E;AQDb#kYiz9}r6V3MZT50hJIJA5ljy@?nvu3e1&mzAN z<6~QvZnfRe6u>D*YV|_NR^?hl^Wz9#UZw^ctW3fe_Hjq)UyRT#3)KK`3|FVL_J0!L z%L_Jez*?$PD_nlZinW&_d~vZHN^iK{l$QRd5xQ-`+=jKoh6064Z&{ha=iB`(!k3rK zq4>tosVI7%WyE+4(0>l};lX;HchADJhd$*|*vfsDc#{)>^D@q`9v&VW86U2UjkRmo zFLJ!v?HSrHQfQqXqLCMtZKQ=#b@3QiDOa{dmZ!^8VM#ASgEdDd#>Q&x>S(vRw>qku zv#^g?Mw_#MIL$yTi?zsdzdspR`{-EJy|r$qHr}Yz^`aH`OH1E#9Pswl@oJ4)$$E2? zY`+Mp+8Aw)RoP9-dZo)x_K)y(1jnc~F@&mDS{>b(Mg7DzHa#FhL@VH>pw&)?L)qFB zm2R!s&|!<$q2>O00_yNU9e1QvuXRe+qNOeHD*l5KSnWzwTn8&$cdj+tGc>g8P^$4J(7H|TVkWy) z9kys07g_Flr@)?vM5q(hi5*zBFoMIe_{O9I7B8ozpE(VPhw6y6&hARRHinR>u~xSn zW}oFwaV#)jrDIN1%6W{XY}|*=)N!~_rL5Rz87mzRq{DQiJ^Z|)LlyN9*Ldad2&q$T zj7^{?tBfbWihGCS-f%>O2FKXZZccR6iK}|y3gfv-cchNjZB7B2>z;m;LTlA0(UT0T zE~Qn$HZ!G4=bEcHI)&HSRclrEj#gWIA1ZbK>vOb&V|3h|mCnvmC3GPjt0UE$Wm}x% zZg5-@X}pE8d&#@2WnS?lwD033v>mz`3%7B{UG)SLZL(X=Hyl{AbgYSLV-k0pGUamJ z-A)v+s(gI74p_K9am|&TBp`OGtxCJnZI-*gEpm9v$tLP(y;@1Y74;U^4j;2kG-c8@ zrptCGy0W5}uAb}^5fe`hqdTjkyQ<|p$kOWh#PL&YxI3HOUDe+C(P=i^+Gxq=2bcGr zZbNNghrm*8##Ogx*id)ZI<=8{0=TG8x$eeinz(5fF5Wj-)*#M?FP&xL!F|o@EL=VZ z-W&nXtjNN6mb*TW?9UePgeojo_MS6(Mr8OQW@P<%41zU;JG4d zb7G>>DAg0W_9#71!mRFXwZln`Ql)jRTRmSw_9ru@1bdOghv(|p9o_|@Gup1T5(BTI zKHO*VC!RsMK*yVGlpayKW{Kt{v8L90Eh8|VxtVXlodW;0%rx*izXdYt)OoO_XX2dz z7s}XE>BE+1b>3sMPe?x3{Xk_qN~D8~u~> z>73G=uBz@|@7=e$Zr?8)RH^q49K6lfC+mOvO`p=yvETmFzBxtnU2wmt(8xr`ZA0{t zUlJ|8fT;2$(URX0Rj)BLxH}P3U$-U5`#?+IGt_@H5!1lImhQzbXz5Br{ck`Hs_toM z=_K$$XWVG0ejE|gdD~e+yz@ZkY_hZvzo6Q&mR`m$=-l;&&YD8Rw7PETZTx~(L5Jz` z|1>o6J`vN3T@78n3;3WBU@?s!W9YIwiI_&VGIZi?L`=&MFm%=4L`)~6OiWj;HFWM& z%XATVOqYDz&_&N647wQUFkN_oCFJu$rVkBWa4!+l8kCLc z;(ZLQIUZrqmGdk;j9<{QCk&mBdSp6bcSBdaNyKy-;xJv&XXu1Akb};9$53M(5!2ZA zhUzb(oj{EaL&v{G#Iy{!OoRVz==dS;pq9e@?`70m{#`5@lps@u8v1&qIF#jiR4qbT@uM zr=#yOT{33qB;YcgdV!&neupsV)c-Pc(hdlNPTj@O;2P8`=mg*}opPt46^PGtevhF| zC^ORy?;Cn@I#EXJ@e8^Z?ZI>h%ER(BVxMqL__zWE}8D0XXqZ(6VqL98oKkh&;xCJ*U+{2WqP{X&>59{t(Jg0Nf?C!3GJ%@EKUOByENqw-dzerl&%DDIe0%YnnLRUURu;8uWN-}82Zu)&3x@e~(O9Lfg@$9KGlzz1y(+5V z80p-4m9rJn%@{V_>e$%eNdF<#DDl9K^$s5#DbvkFN`Fyty3CIC%F=~yKHa%P;$(tkv?-WaTnC|xZv+Fgx>^;&PW(dZniF0YJLb?SL3 zk`_(tLip`m=^NaI@Ox-=SY%l+%%4Zr2gh7>+}F9X>bjR;gg@sD)~mg)SLE1WpiGBWMimT)A?a!yQ5hNp!e|{e z8mhlglriU2myGxKqpd@7U5&uZbiOq{JbFkCIz2Vc`?##Ju10|ru~0?xD@&?FGetoJ z4;tuWISs*s#_XYLrJm_@S4OhQfJa?{z~IfU4G&jG#v;VPHJBl6264=F$y>c5WF<1# zvud?v!jqp9w=5lmp&#KW_X_n_g3;kzq zy*9jPtgiZmW}DQytNnA(Gdfp>u7eg1T$5T)tspJWgbsSM?Y2Bn7mn%i6NwD+tkL;{ z4c)OU%gE=BkMxeA_ZJj45*hvZwc2Qbu3%f-dS#?{U{1Ax$+5x!s^qhBQp8%+TOS-9 zn_u&@rsnz3;Uhx@I+p9Ty2k~iNt#(+zG$o}<^`jW@w~>Y(Vkj=|B#r^jF#sMO|)hx zpi^U}*U8OhM$56i-pnO6zu-npALQ9#aHPuZ5Ti=r#hL_ZaI!DHbg=*j_4IU)3E4>3UuU<6>5oczjQ5{~Qho;~`1EZAJ4vw{;GAvSz z1<;){*r+syqC{%Mku&b^b(XO*iDBjWwGU14V7;eGXpaGaA5q1V;GF&u#FyJ9|x3`c}j4hrJNess>D~6T_BsVk*kc3DgId&P6 zmLn$mjM;ri49SF!i&QXaG`Qa#IXKd}9HTt+SKy5<^<}H;tnsBwqoi{}#ObbL``xJK zM1IOBQ;6}Rx(^9LAa(gMt5DYppo@+eqK5|2Z0KP|33^d)DUii67FGLsUJn2&j+2_a zA6Xge9mp-Aft%%eX!ZacpxWej&wJ0Nu{za%^QG zgJiaBdUppT!8Ur?6K&@R9(2X_3W|~sP2QO-tXD@Xb)hDihl~&Q)GH&6A#8^L)?2LmwWIVWQJU}wEvbBjg9^g*N(72m*lzSQIq#ZP0QF}<=EdHq~(GrEo)^cwxE-1BS1 z^uf*%-fGPo>>n5cu@N%PLV*Uy&K|zdhjo=puGESv-su^>*F@c5_U#ulUZKb{O^-KL z7qKRk%e|z#x)dk_v&ZZ8u=12i!H0eon!RjsoLw6l9~Ko`Ad@jrsP5W|Y=;r**2j@j z84JTA5lc#CtVQU`y#rF}XG4J)>&O(a^j62Jn2Jm(#bo3Y$f?NqY%CsxQPi7oON5e* zI+$H$#E~)87#=ZFka1DgblgZm#`U$8PN7gurh}asj7f7UW0isi7D5>ZMOuW>HdMvV z1m@>p-1Mxn2^}-KS*d90@qDkDZ32r_gTU*WomP>uka%s_Ol$SRg;PkNjme?A+KWCscTlc- znhiZv$$acBI#>2qM|IQZB+y0=7VC4U;fN1S-a4rX*)f8wlMO*34Xa?dL2D83$tq)V zk+YgXVzr~Goz?uT&Vg>!-Ey(82_91Ly&r`Mxl&xIh3YBLVlK3h1h1iHHxbk{8+!Ix ze>9uuFr5#(oqDk>;$rqIjbUX`jI26>6{bwe{JuVnfwA$%tV-Q2=YCuk2@%JPl0}1k zRYVG<)@*4iY_xqg0r@D|IwyI(cFsVAW*PC4#8p;N5j2{GEcTwj&Je>`S z_0wk6@uA7~`$e_!dT*5nl0We%l7PoO3SFS9*B=l>%n;1_d7)yEMB1|ls={JbA`I*! z1{;H@;ZPAaca9%4GepPst!&kmFvJn|>WCSFS=2(sAc?f+)y9@pqgeqpn(12^Vk{cK zHfD4@6wNUpL+AX?k?cai9V}>QwoRi*k&_a9XwDw0HL8N;YbX{#*B+A|HiEy+{2j7T zAcL0ab7cmggaSmU8DnNzP#cqjBjQ67Q%|90#5ZZ0Q{ZYfpQ@IabT!Xc4pP<d|MV|a{=p(k-u5kUZ53yFuckQu>)hRM592rS4keCJk{VkLZ3FN+xu$$@a(TL8;(r~t{dI?6j}=z75~P+*rZY!JaWW`R*o!3KWe!TJyLb+y{>cNScTMbTq)3Q3Hn;Uk zZ*^9^wxZz;<;5~^4;!tHz$R$62BDTT8+u(MFk%k!8LF{WnEgbEP$Ean{E8uWAca!I zLdURAOW7a{K(PS2yxRE+5gj7p8(S(SR-UkJf|`f4^j;~zM*Pk2-T#L3-Tx1QNAhBL z`BsR22XDe_szkdF5_QAd^GVQqONox|Cpvfl9*Llp2)}{wp3s|wzi&K)=s0+lZg(DJ zpiSoxEd(7~gGVK3{kcR_&Vu*%YNEG6FRvo{&&!G4A0gUx1<@|}dnNupW*i=)ml17+ zzi)&0O@IqaS->FFFb?EdUeh1|1A@8|}=;N2b;}*YbFGe{oM4F%vLHAw& zJa}vF1OD;&op&WXc0o@pLmtmZ8BZX3^9smL!y5_sU4!sD$p5+q(e~^miZXTJ@3)Re zT*Ucr)X5P3UU@e3K)0bx+wtF56V3lFyp%y3;XS%9>f?wrQ4W-~=Tg+q5Yd4s*Tuug z5AwPv!Y_iq6T%0b09wFKTdh5X79)C|o zTF1PEc6uH4`YPhSOmx&*;BG|TZpGi?T@+ue!2`2+MR(DBIg!Pfx;UbPS6 z_hrPZBaPK4!)_?wB$RIw!Y8B58}CM&--S0T5P$7GC>z52;P*}Nehc2azS`eGU8%k&j)TBH9_h``(1MMm=o+tF6^DcY8{raz!h(l+#m^f4NzZ_&4D9(B<{ zbPOFu$I{WX2YrEdqn+qaXc-OB!8D7O(;v}XI)vs>Cmlys+MT{id(yu2d0I(>G(byf zAKI0^Mqi=^)#wEJzqA)ErWG_sqg1CE)JMa#h47EBXuiB2A{_>2oxb z{+te^Kcz3zSExcuXd!)vy6NZiGx`;sN-xs)XahY&kI=*PF1<|uNGH*c=^XkI{S&=H zAJD(jPv~uWhyD+}L3h&Y^dOy0|3Lpve@A~$|3OdEX>=FeP502fbRRuU&(lVFj-I8b zXcIj{@6)g8DteEurR(Xtw3cq98|WIkj&7lw>1tX>H_>0yV{|T^N0-nAbP-)lYv_Es zkbX(`(*txeokBmPU(jpxeR_djqTkZ3bSYg%SJLHl1)WI$OuwPOq0{Ma=}dZpeoCw9 zHhPoZqC4nuI)i>dkJ5U2mHv(Xg>I*_=p!`g|F`h}>K6W}^*@JA37+%DuUojqW5a=6 zf^!JBZr|*lU*-XB_}FNdIH4m!?ePvq-mN|J`&LOIMI8?e883S+09h?Kfp*V(*h=z& zxeLO;CWD+YA(akQ+U3uf;NY~AbB^&6>r7<47m%nIxD)fdM0oqS2*v3arX9t$j_RC{ z`P2HPgMm`V?iDdtI7ws=MC`K2I+^>Tbr3|@9pz`v`v|+T*=lw{Tg@(LtJwu*H9KDB zx&yt~4aU`n$qp2h$fL1*DMZ8afF_uol-e|M9#Dp_{ArMM(&Gg*?-mw6)z&p}%ky)-kR*?M^PyOnh5vYI#W&gs7;pF|_p=RIqz+c%MXEe>LEZN_Y zd#&X;#}*Do9>-uMyt#~(%=mCa(*$Q_4yGb#{mMNj=LC+zMgG>AZ#>xE@7qV_hefV7 zgQb1kwTriQZx;^p%E1Z~J)g4Z(Qlb*Fk7A*fo7yyrWk?X8y|qI1VZQ^4zN#V956?oF^hD;rfRxe5LHe z1qMX4jxY!!G8oF@V^}%!JJhm58Sg7b1xFqW7>+o)Gz{ex#Vj@%V}Rh#a@$qTt_|&A zZ?=JOw8n{PLy@T$^rEbNSM#kYDBphENk@x?R zeBoas*`;14*4L*D#{0Guf}yd>Bf8G7yhvo85F3?fytyKN8Cu>^#8)IziydaNM2#n8 zbh4C5qVsO>?8<67vkCZaZh~emQT}i~p7HwgK{3smxQAx`c3zGQ%emR;FmsfLjt?3q zLFQzRK=OdXGvOVCu98J_-a<&ogr#3=7C|sF2UfxCcc+Vn=T{kCPW;J>kwp^};IzjI zYuWQ)`=_4OBU3i(@PZpAaOFYB;u4=gbO7n8=QWWd*}F`1bDSU?0->%Qh?#*C5RBpM zl*I;pFKFT<(s}73s)2J4r{Pq^@JpRz3%nxiBFIf@B8w#>JLn4n=MUvMrq70`>JZS@ zNN`~C(Q;lKcmN4r#a_+(YXpwGwf(~49_j|~Qv0s#;4Vs>UUDG+6kBL#e(9E#cb zl*HW(C}wPmF{!Y?zI?|!fgF?V1vzFYj)?A`$%1;p`QMJLxSCSU z>zJx}9aA;0W9FOJN!%$X`T}AGGm$R^xUSZ*$yMy4*Ut;ztgpxBBbiKiUX)yEN|Joj z7NzeO*!&QjEodaSduFZSusCu8!^2DP?@%T zRB7N6%z{fggftktG*h@>Wq`5a%WFIHmtv?<${K2fDubAh7n{YT0MWg1O!6ZWnG^-D z8sy)Z%cMf?{+GyfCUlG542#TYUc1bg<`v9tyYN~BV_1tc{q+nH-x=8=HqTwz+>@DS z^FnWMi$s~(E#k59En;Cg_pcJuAu{NN7~YU4Que%H-18B%iBGb3MD&d zFbu-H*|1P%HgLY+oHr2@mBJ=OA2Vl2)RLmi+vh3es}}8(01A#YF#2TeQ)(0z9<;&a z=yeJVj|rJyQjrU9g!KBs6e(CGu8!y}!Yt|a!B)meDbOZLB`I>IL{ickAoYdOQnHol zG6<{z(=$rUm_c6Zq#I0{URj$lL+8COl)U&-g5A$03J<4dR^ARyQXoG4# zZSMQRtXinxEs%MsFtO%^!qA!*dTVML-m4`t!RutQ46I<@UR4IzqD%!tS)nwYi^wEf zm_lrr6-tHXSs{;%v|eI&Y~I>{dD5_=;boWwX4@#G!dJGP2{+O;hTMpW`p&PYb}J_K zXFi|McUCICMvwV918;zEW?gjMFm?IY;EI4AnwaZ+_md(;oY}yXb3L-zwZYAX;b#g?%$t0`M7QR&iN=^J#fq7Pr(CtYcl`# z?c@7M_gG|u@VJG?u?yJW8MOVZefdR-${tglXh;0YUK~tWwdebc%UdFih zA9zlW`7>zpGn4SUBRr4!-zQa}zD%Fq{uAK-IFrF=8NZL*xWl1?z4cn7wsdUrUfo}r zJilwfx2;_Lurg-5+Bb7&*{5OMUxRKW3_^kI+7qGvqw*~6AnY#TvvM_=3SjTkR zDKU>xHeCD8;kj&=tfX66FJp6%dwmng{tpZZ+E^-a4LQRx!+Wy6; zUjXXIJSz5m;TTpyY(_cV@*4F^?*1Q-5qWRlE?!CR{37r^QGk~n_qL1a7KEsblYzN) zjG3KCYd{rhrWF%)`Uf!{KN%^2&1l0!oo-WrHxYH3n$P|)U}k6Yx_BzoOl>B{#I``f z_Hd__^v^E? z_tO!sJ*p~#ZF#*Y)V&saq3bJT7dCRXBI6q0pjY8NljXFhB2 zFo%bO;tA<9B{LrHRCg`Fblz9Gs4CRNm`ttzpR=ght9v+US83}|6G+qC#~7nob~lu7 zH;H7u#o9ybDA_CS1hmf^w9E@_%b`rRDD2(VCQ8XV!TXpm7!)^6vrSrqwY)l{c1^o$ zv@N`k`JzVK!uyy#G}=V%V@lS%&!X+Vq!AnKwp?n2?P;)3hr#1fcN7(BW;`e6#yan<8)Z>Yl2HM3- ztVah0Joz?4n~16Q`?Cl!Hw-4U{SJ=MGDns+OE)dCXZrJim%CL&!>UjdqdheOXL!`` z!iP#Q^0F9} ze#>o^8g-ox&A2`DCr&h2>!U6)3g$Yrf>(evtO_+zqp30;;!wk@MJoBt*dLYba`_2* zo&Fn=!&m zo)LCN8NcH(`ISBmq(V)UEj7}*Jx+n+K+E%T%BsG|Bbj#)RVj1{nS3eTD+m# zE^5g-%U)Q26`}f9f7`@NSv-!FnAtnU8cc2 zm!R84E7`fTe@jK7@!QoJOof`L#ne;l5{YHs+E(dn>?Y7s{iD~Sg}1@m!%FQ|`W#k# z0i=d(eMKtSt+2OjRbfup*-2uQFI9-n>Yh8UX}y#s&*qa+%6^5p<*n`m9&h4K6H{Yi z(Bn;53no^h<2_pNC((m$Gv>0y?6S<`O;F1vESp0fOWl;v?g&gE4qL?N3WhcjQ*+vg zMa)do*_EvtOof`5KT|u2T8tI$j8HJG_n6eV(5OMxmr=Bdms)L4@Ob`~i+0gU{JHq8 zjk-Z|mt{mlPXRa6dWm_np^@yh9120BH-VRWrX4eQ?z#^R)bfgu8Uy123DzUNM?{0E zP@AP%9*(Z5%& zlHZK-CDywWJ({=zW((q-v^=Kq%Wr$WN%@GMo=3$THvuJ0%mHT@%-nTDsy1~^H&eHX zebZ`zIC0}7wPu`Y5bZ1fd_PiqrAygd&k9%#zMrx^q?9e|Y>y=Gb7~K-qok*>ef%7Y zXRf1f6Q|@klTU5Vl{gEc3T%BZQ8J(LncjH@DO_x&3)M1KYHXixv2vI4M+H<_XlA69 zJb$q-{{>~3?R)H$%-6ijz0jcg8@^PDbZMI?U&=1G#v=Le-fF1U+b=O|UF5Lzm1ONA zCU!3u8$|3p#a(CZ;w4IWiN{lysI`k&GNZ5!>r#)XZ)ekxD%3=eNzIv;1w?V{n?h*0 zho}CvK_Ja1%NzuJm~7`nxs}Q%{;#SwwrUUYkg%_Ylwwmf2XduW@8iPpS5kLa!@)u65S*M!Y(y+SRh z)ConqL!lK^Xv=7+{n_^vT5)Bns%@s1CiZ9FH+cH~SOu^dBQb$@r@_+~)3%G382NV@ zJb!U58|rF9oq&Qd1QZ+u7*{iHe2}q2vuBGtYBJi;nWG}0}-mY1-VVs=_S4S z>uB2tBUFEH@&vZ<^pbUSAK*V!hCe~=obq{mIEOuv{d#)I8n+)x{YU|F!9~+;wtH%1 zZOG@q-_)yNRj8Sfm9P*#nn#_ec24xM$MUGrjoYe>E$`Z}NZ&w8l2mc55_M!slYl*xk0}`b<6BJRhN%oB4H>s!%g)Ny*I0Uf?fSyxfid z3Z(VRYNm{dp8C%c(S83)0c=K(Nt{vrM&hXtYiUpwYNm{dUivQ*(|@o_A++9a5_S5n z!m}R&({K~oYyMT@i7$+4NEK?LMpI`6?5Wli*-e^bcyN^jMD5>1t__4Z7R m%J&s!_|#gPh>4l!-z8%BgqsFzyXG`TqdBQe!*- literal 0 HcmV?d00001 diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/x64dbg.lib b/BranchTrace-x64plugin-wtl/pluginsdk/x64dbg.lib new file mode 100644 index 0000000000000000000000000000000000000000..f8448fdd4d4beb2f998c3d6a2a10c8458c7be317 GIT binary patch literal 117568 zcmeHw3z%F*m46i?#E1|c@_vN(J7ki{B;hrWOddm$Ntgr@Ff!?xzM1Kyr@QU$$pewM zQ4tXl5fKp;5fu>;5m6Bp6r0FAWs2zl*a+rmxtjO7MOG@TnEhNh89#k^@Tp@h{{pldDzgWrE8-zre zd_~FOWg$`K^(dLKLP(SYf28CMn}tMKFkQ*En}zgcFZcyH{O3yMfj-KNrP;S0Y$+QJRqU?RYk|TZ&d_lTKl)QOR zNR<7TD0$<0AyE$cv66iu-zW=@RNDHM3WrgyVSxV~ta37?xR!R9qNEf8}DJsH*#UV#*$x~~4l61-a$HE1uHP!z|4FbD$QvR5DEt0c z$-?`!Puqa5-JC5LW?Ymf&vD)~I*5oK&vAdkZ@NTE;3 z=KvGsQoune-mk<1eUu)^6Uwm5o`+wM zgCT8{Lm*9*@xegAuHzu3je)!ZzaX3MQnIBJ{1D_^C|i_sdX#h@49^?LIZrA%?_ zkSIq1FO;#S|bEYYIFW{hD1Z9tMFXS2JtTU9{2)`&Z zmneA~#6y{Lt&;cN4DmrOK3~bF?h+EE<0d6H-46UgRzu!VKK6u?3u{86eEe%lF8mc- zgM0#Pj4}i^K)I(&$(rYcMEN8*0L?^2rC4Tny=;+;_N=H5&mRthi4|l#jfiWaXVgqTKZp zC4&bGiSp64N>&0-l)Hcv${^Sb<)c4TvI=;h-2If2Rj2AC*|Ur=(}%Ww^{WP_3qUM?ic;-Zq zT=1xp4?{jsmOrTE&Yua1vf>OS9~pu21zFyyIx+%gH2Jce_qK+P_8J~ z0T+}LZ&7kBml}n}XsOg_)=QN!k-Q2uCM%`U zYSD{ylGpv^^2$P~5~P>B8U|)4rAnzOk{3RDcx!Z`=xz5#BbDgd)GC(h-e}X*)$b-^ zc-u?OMro{4C`U=_w_@E1Z(>uaQXDBXyh5>9SK8Lignk_~BRzGI2;WvOHN8k7xJqbD z6lzhp|92v^)Yw`mmx`Ejtr;^iZ^v;!eN(+U5fqbeTH{u%TWS=&k;ySA81Nh{q{Izf zZ}a3tZLA7<%_^FGGR#w{L50LI(Tt_ars|j%lzifbt=BO1{2Q^JS3w_a?x=Z@rg1CQ z9jO5-sulw5#En=FwCdhi5pt-EpkK#YV8mwCuxflG)`Qq1wK6{u zRH_u3r7Ao*SO6H?4vAxKnyieXc6F;)FBfVJ70bRG$7pz!;)K^|6vhHKOx%d|0C{!2 zItrQtP+s+kBq=IL#jTYm!GDIqf{h&NebV^TqhxKYgN#6+P2 zkD&<}-cQ8Rk`2Ryctl7dX1O|618;6_ijcHBmgZy=N+(De_55o~3)4%esT&DB{~@gv zCL2(KL4x`%Teq>LRP(lvdNp*Fn1vt73`@kG@G6t=ghnvYHKpZMn)Mx~YH*X%Z+Nvr zz0j;eEf(Y=NL~xD;*FNQLNY>d$I^rf0bWq>9BGM1_bhFnXB4bONd~a-M#sI;End=6 zVbmzhiVc8UOO4VES3GI zEiPT_ej-*_4|&^b^{^_A@Yz4nF1GVq*1P7OC&JLWJO&jbP^gw_;{f)9;Kiz z67j>VsMiCVQ!_Y`Mw}T_En?2VboUmEJ-zj@NqAzKJ!||T?diFscX)7k`Rw7r**%vA zjn5Q{yvpjueHVow_#*7-nA4LYWhPqpQm@HzUcIu4Q~QoCOzRFb=w;j1J*Kd&;Hm7p?2D65zgZ6 zsiFWPftD?Dgt^k2aDY;b0Cw%grprY0Yp*algKumM@L4WXpcK_tOgi`^gh4jru)Yd43=&M_uzq1; z#nglPh1W~eFN7M_FJ^M8cHxzSx`k3O>lQ{Qs#}Qg)^$s|NWPCPf)6D7Ws8-G>8>p_ z+0@YUg1C0+qrXxK(~*2{rPPO)Co3d$Sf^g(v#b`+IrP{pQA2;F3=_iEz_ZX_d%R?cmmqnkr8BI%u-@^kX-cRyk;IX*RrjXtLsp$OU(=#xHSK zOkSaTO|x2aMPcwq^daKmeb%u&-p#wAd5t1{N zz;0ps>9grK+S5n#>*FQmg8p0%53cLPTZ=1`6Uj_rrQBNCe~+|KGha<<)RF6@OKbvh zEypV$Cn~PNgH=K7RjsfY1;nO;3~W{fu@|+%W)u*c3No-+6~tcM3Y$?tY%0jWW>pY- zO)G3h0kNqd1DjPr?6s}183n|qf(&d{1+jZuVKWMdO$8a)tO{cHx58!=5St1zuvrzv z9%zNlC?GZ!WMH!@eqYm)VBAJ)qtN|UZbd#VY!ioZ?UpolorR$Z3QRP#7ahTGOxyid zWa7H6Ujo>l#%ntGWASB=9QRu>pxU=v)Nkcb4cqCAO5A=4zAJgXL`$7ebM;%f)YGJE z(o~-dOse=*q58Qfh4}U8)WNd%`@)DcT7L$liv&+;8Ri7Qco(`ZHsMs?*p8m1lO@CD zq2E<2`Roy6ET|fsSTs<&STPFZXblcyxS*EDWua#%RlEe!;!5#V;G~F^Kk^y8ExYm@3ubF(oLsiOf|O~&A?ej;Vif@gJUy-*uB&Fj82m z&qpEBU$bLkWwn@zJ|88KzL_R`5w3$dSJiF!JqR6j(6)%*P`bybix^{}Z<=+#jzt5d zixs0periB1*P-YP1%8rzJ(=+mNa(ZKaZ<$UUa4jX8L6*_=Akx{<5mjOxWsD=R*i)4 zEl;H6RP7$9z?_*CrHV%;mh96_rK?iBxKN&Clhk{m{4`r@cMo}+>R!Wq*0nB3UIE+l z7p^N6$KbQBFk<8rtlzsncAYe;-D}3H+tMbON*7vx)rOZg$#lx#)6Je0g%PiuXqe&W zf<3a})MHY@uNps|{Ut<0QxUqCz%DrtGIwt>-%3a=9;Ak`> z`l4b|;w%8k`esQRE&S@C^yAD2pFE6G;=9Du;m0Ky&ESi~3XPk<>T`rrh`vS4z}6ok zDPq9bK)vBDhIv3xpTf6D&&pC`G~wig-(-pdwarAe=|LglluW1-5Xpk^pCs)YCtD=I zXjIEvJ(XcI3x3*h!Kc#g?k$(Aqb5zP-}DOCtpv}b=b1?ub)-wBdkHi%dR7;jFiW+f zmkACJE>@LKoUL@qewsMnfJzpcz*ySJG+Qfoufr+hM2eVKi)T7zl_rgik6)6fpJq#C zsC#jVb#J9O;c7UeTVKU zFiM3^3-*F`YMh^x+Cj-O$@W>vs=_=$4pab1~p9ZFj^*9p7^p; z6-x`x>1S@7o!yyrrAQf8>_3dJX7gLDYifkd*lNA z7TVny?%)aj2>zor%~I<_3%@y@CFRumQOZo-{4SIv>oDyUF}fGyY8?mhgo~w9j?-ia z7)}&+}ttn_I<#;j=*!5t~Y;OXOQ1R%m%EJ)t2%z}U% z3F%yD)~bIlBb!&9RLBR%1l`#}^HB5T1Dm{x1WasKCQ_njN&;JlxKLVqb&)Tc&@F6# zc=ZV+u~j?PddX>H2ni&IdNN(rqD`HyLp_JDL!*k@!_=;A3EITE7swGJmrR>$W-h7J#E{d~y7q2=>fk%9-Si9g!P_u04G-4m=C(F*@!Rq)t$WV)iLreL{0QJ%{+9Um}lJXHU*!B^JnqM|#xZxwL zj&Bn()bbIBmT!|aq=I1+Udgu!9cnl^E1`8MfWox)FeCEq4= zuw@gM8gik-lQ!XXkO>`X+Qg-${3MM{*04&-Psm`)CUh!F&G!>BnWRnVG*HL)6EX$U zCUhD~%eTn@nT+x5@JhZ-=wQnxE;Zyb#C)D4`!ZZw$c76yzx~{LJ|Cu$Yw&Ss`Fxmg zi;q*!=fgCp3_cDmpAQpm@p0<;e3+NF!N;NH^I^g*K2ANK4^t@`d>mRnA12)5J~(WzLrVbW20$frMzZ5&F-h6y%p z<5cr)!@M{Qzj0{!wqe38+c@=*Pv7bke&bL=HcYT-8>gCY8|DRK*v6sd+lC3ZY~$2J zK5Nq0#-W64m|)X3PBq^)%nQx1jYG?~4HItJ#;ND?SwJ=U%txG8^4ZYA78#eC;?hr% zNwzD77O+Z+3mI&-E0|Q`w${*sbrhFmW6PnWxR7a>%`GOCxV<&BppW8`d?z@R6c;iL z(|?&%l$u{g3n?n5zwk;v7dqJT7nhpiLYB4RFAG^E#f1#E{Dn?M^OuEWSsVVsD=98y z8kWD%sc8PPkSuG%Uw9?Og-pZp7djQqUpi)|aTte|&xQ%NT*j&A`%K4dvcL_eacBj6 z$W$!1Vban3reii)=!WAsv;sb4DwgXo>1e*wF`F!S!+9K90Ut6I%YB%1bpN48YmN6M z>^e(~xW#QyCfxQPIvu5_{HKE~dDDM*EoC1%-1Z-rUciSedDDM7Sgn8$8E*RzosRB5 z9c0Oy{=;hpe8^O6|Dn^-{f8c1H~oj#Qhexe+kaeos=Vf;@*iF+;6tWj`wyLtUjNJ? zOWyP!UMt{3regaKosRB5bI6i6{fE~I_>igC{zIpu`wu-E!t@_rOYxz@ZU1rUDgT*E zmb_X2@LB;MG8Nl@=yY`dnM;0a%5aCV2kr=AYIES|;h&_J8|>ses4 zw2^9Z`yo=ltaT*}>)9ISc1?`G0SmeybGX*HVgu_LSm+ z*GjSZX(^rsdGQNU{Pu8&%kvZ(wz?S1l+qE?#1*xdy^|q_`cfpIr<2xfg7|PKw*^lcI7I*zj`D zIYo+}ydC1rmEt}~bHOwy1IYK!A>ENK$m^TI?)yuz{*6%9z;naCP&NytcxHioj!V9JqpPEJ0a<+_hPXPO#wx=YpS{BgMf`ZcoDROXtC}0{6z@_lonSn0+?* z_8ch3PVf=P`|V(hX@Il(bcpv(urK^R4!_IJ0DkX+G~o9!`0Y6pY;l7WUxVLA;P;_f z;H&S3vOXGY`Bq5lC@JoQ^1lqO4~6S{&jLH%2+sxBKwJsW&oO{`1*8wZH^T4C+2Akl zfigV>d;t7q#z~OxYr&UKhP1AO=d=TS?k2zloKC9o_)BI&*xRJI7Q%0a@bfPQTYXB3n;`w$A^q*E!Tuiu z|GE(J_Hig@_&xg*z+ni={T?XSHBcs>1WZWxIEXh6_aBAu4Zvd=@c1pnKOf>f0XWwK z&ib`r7tntca1Or@$_L^<4C&mr0?OedV55~_v%8>t2Elhf3TeXi2DrW%u73#E*RKM< zy&K9De*1yfbogBX*VB5zMz?@1``}r9Ka?f>-T=SX!~L7!{_o*>+O1IDi=^1|1K>aX zkZ1U9!u3wL{|mSlw*iO6Q2y|{VF}bp9|T{5>nq{0AeO z^of9bE%4e1bsfla!+;Gwed23`=oaUTE5uvHN5uVNsaPfk#0BCh@qMvaTqrIP*NIPw zkBUWNl~^aP7M~QOVw30>tHpY8t++3Gt$s z6#psyOZF?_JYCM0 zZxM&cGvzUIq5P_7h?4lO_@1~!d{{gpZWkXC&xk&8mH4#yQ}F}wX7PUcK6#6LSbR-9 zA)XZ95|4{J#h1mS;xpp2VuN@{d{O+l_>uSv@vQhu@ni9J@h)+zc#n9exKVsi+$`Q9 z-YwoIZWFhN_loz6o#F=Z0dbR9A(o4^VvQIV9}{md-DbJQov02qWSkP_X+easDlCxg3NNha765_Q`TuAaUM=7HVz+8w91< zBRSkimtc;20YL{ss6ntdH0&H03Pdgp4KpXn;MT{21!R|{JJ2l7U5e9p^>YjfTLc>h zCpHzf4MJ%VR>`2|pZJqNHEkFrmi7p_cndA}vypo1tSQ~M*16?w`u(x7*NZ*}+24jO zI8DgcB1${-OH9NrWekO$Gu+|EPoTwVZ;={(9uuUbvoVX;1S2O=**lm7pw!7&SYtuP z=ymuw3g(Bhlhysu^;G{Xj_6@1y?Q%LxzCw0-F+UV%+C||f!(xPY`2OjEOHFS`QbD_ zHH{79Gs9Vaw>^e4!%I;(v&13}C$kvi(+7_E)cFqXD0OmCZCG%Nn6CRMwzFUtF#|PG zY-XS$3MVrjItFzLTi}iK8sIQfw7sKb`SmPlQhxccAL`h|M}^Z<8N(d+57ATA;&6H@ zQXEci%Myprr=H@-m-?L+XSP4VSq7N7#q@&`2a}0M!SrJi1=FP#2fGue{WywEJ8B$E z4!lLdxpwwK%Tb5=1xC%k$(FyhAJZ7b!Jsfm+XB$%ga_djd^)m$5LPfe}F5@ueJvlaVSHi9_BNpI+b-aS7HmfC~-2+ytfA5Gibx0mb=(v+C$7Ljque0;pFV6@U05r^eo31pPp40<;1(5h~@e3FIXOCV~7iFDZ&lO?Q%iyAn(<{@We7E@g8KPTtQIm0~#pllu-L8w{ z(+xW};dIk34yW68S~%Ibi^8b`wu6e5PB}Czvywk7HTv5pitPUCRl6BmXPiI} zr#hAdor*f0J0MOS5|2Uner>%|w*4*+#xF`9?uX@c5@Xw++-&9KqH-G+CibeHWdu1@k)7pVVL} z)3s7~>_VvSex99Y7U)UPU?~nh2ou2%MK>4wn@{`bz^E<`ROGBDngdlm3UQh=es~3y zTSC`3RhB-KH<`Se18YX4)AvuS=FepJ+fzCpU!R~)DjF18o}fz-w^9bJ)+eqfEE2>> zLtCk4Iq*44CROS%pvxQ)O|XV2_95YnP0}3n469&Vr^v%=4o|6yiTL`2CoQG<#Z% zY{l4AXOw*&uAio@YNAp@T-+x8m?SmG6;Y#yxq{_a7?~Wk(8B324u5lP1g8hP;`sD% zmljTcam4AG}f^B6nGCe@TF-m-+sCVLnTIGzW=l|m@hzG zqa_M42p0K+W7UX;K@Nn)Hs^-Iv=myn6*nBFr9gia>Se|l0{4AK*Q5r;B0JE-VsRF^ za)=VAhsLx7T3En+I)%@Fh#nw|ZNv?c=^AuTnyx_)lj$1tK$)h|q9mBXvS5)c6csaE zrYkTIc-jCOYccm|MG9Pr#tN+rL-3g-Qg7fK+L&}*w>pDZlwL5BFPsf~| zzzWphS>*Cmk9ibG^_fS3Tz`1%0bGxG{5)`d;<0tOUh!bjiIuE*sT<1aek?TC@UUHpBtEZdmDc5<>edRh2y0={CLHC#I_Mm&rbslt| zxz2;`HP?C2{pLCky60TyLHC{OJm}tYjmHAA|6HR%Z4$9+rk6b~QSS8W6lX^rBNj*E4 zq#BV^QqRmSrPO+1MItNVw^hbytruA&P?S1hwO~O5p=_Iu*Cp(iS=oPi6Ff|t8wsaf zh!Lb5t+QapXVt6SR8IGRrdyg3q>ak-`wqI9qZeMNT=zV)a$S$LYh1TtowKG{FIC2R zOpB>8Fi_X)Vi>68o;F_-CWS?{3hENRlk|R6vV8`1k`*%Qwdm?jA`{LPq#7*c2#kaY z+gYdJsXp&khu>2D-f_JP*mU1FPCAMC(f!|s4%sn;(^KMf=zj2II&@#Sp+kNl7+7>O z-AE`6=@v^u;_Pw#<2YWWX)#}OrWQ%fpJk+_#eCHnX)(QerdBFMqTf83J@*n4jXT+Y zo-7}(58Yr+_97c8G2ewoO3cTfp+y=h>3&qddcsb0-+GcXU2X;t-N$Yul)^$>Uwbm| z{Y-zmsYUnwnObzuoT)|ky_;He|GS};qU4xJ1^50Zz_>+h7$b<8%ne%m`Z8j z=pGs)CHi48mB?DyP|CH`CAK%!XP+pLe9K-mAY8=~e&gDod5+Itc$fO$#7v6=S`*Z; zy@AZOM2Hc3BP!qCaC}pTq?rbYwJ0XW%&;`Zh(sC)&68O2Vnm`0(<%;WkyepxOSFo? ztUz()Ce8Ah*Z}cz562=JO5L@ThSK-_m&uMbiI+-%`QQkb)lgAdEUuxV=#%^CB{q&& zzTYx=WQr`dznVr(F1LvxsUgHfT}2HeCKXyPz=_egVaMc)j~jYSHWRqv$7G$(4M8T` zCEPHi$%`I}G2Q@}h?< zOQUj}r%u$1@ zu>!Vk977zc$Io7J6yS%k`6dptWGRYYn}qe`70*~m6!mgygFpTvr;7{aNmg0!5*=uO zYN^N$FUH-H!CEDQ0rbfFqoM)PGz*#nRkTG*i)#5wv$!cpI#MMY@zB#8=W2DK-tZQ0 zufbZGMyXmcJDei}>oyA)F)`igR_|}9-=g%jyz)z*f*d*)K!qBuHWP2XWjL-eO0gs= z07PwiR9r2L($t*GqclC*D-**Ni0WP{rKLv?eyasjks7ybDpE+Xcq*a0#2?78>L_rN z*bUW^Ecl>KwU8=GKE-mXP?uR$6$HPErBzH!W_$;7>rZIVMp*POF}@;Lrklx(LO)T) zP^mSGILZ*0mRYYEo zNG)&y$V4rxFM~2(Aj653E`G#>k7!Wzk{1_NiX~b^o?HvH7g=BiA?sE9^h@d+XG+_6UZF7AyhN)ad?HY9UyQNNQ4@J_`aZ z(_*CDRHr&!?WJKF6FUOUgBmjDmWjp5Q-kIPWqR0L%_7wjBFEh1l~_9ZEtiD{#tp4o+)}x)d#RenjqWzEEyolX&Tx%WqXyXx zyV1k!rZKqkG~no=b}O+|7UPE7P5W~L?zSG?uWjqm{mix=J?w7l(F5<6UaAsh2H(|k zin!pJ;dfh&0mY?cT58;5Z>VuzVydMBW%>sFg>o7IZ=c0 z#$!i~ff*{)D43zbjcu8}#f@&6PbN3MWm=OP;WA&z+!&Y5j~?Z+`O)KCHa~i#%jTD^ zPT)qnY<~23m(7nJ@v`})tBbf%FPk4d?q&0%N4{)+^w^hOzVzsq&5s`cviZ>?U^YK` z49w<7kAm6!=y5QcA3YLg@moNSg<16I(J+f0JsxI}qesLnZuFR##f=^nv$)aYViq@g zWX$5mjE!03Qnr7&@i8ks?nP*{lesZ6E4`HMU-z=X_{B5Cy$nr$+}qI5qejb&R}hDo zY#A~mW~P^Lw2Z{keRff!VFr0>JS?G-X31e_e%xu6_?*TaZ8a4~S7@TsKjk9CFlBxz zqNc$uNYquhWr>jvvp6vbXO}33;q_7zmOM}+1<-X9??IPPC)N%^k7&GHQCFsiXYl(8 z7cJ_V%m@vtYK=mFMIqhck1JM^Lxa9DJ)#4tYQ1D>7BlKx=}{e|8b2EG!bV)AI1CFJ zhYQ6btQ^@?9rKz&))TiI$=f3}&}+h85QT&`Bs4lvESBo9Wt_L&8`V=%VZ>c;d#Twd zja3R|L%mcfB~te)qt&8^s0N!&!AT!g@W^tZ*3i=do;ZjE}VO-Nt7^#(E zn$_g(T6q$(Iqc`RhC5S+`g%ZPOR45xaeI@M!Wc{qFrg;A$|P9U&<*Z-m1cbh9n|n@g?gb`jjSG^W6V)pib+KC zldD6ewbe8U#_~hKdq>B;(JdauDAX9QHn(^buTY^h8vC)vD-5o{d;*Rh5ZGF3lwcVy zp}}&8SPUkFFmNmqJU#HpdG*mkxjX{<(iude;OfLgp<>!84E125Lip@638+V&QEK2I zQe(7Us+s;ZSs{FJvJwI_tThFacO33u9xFMyZ-WK?la*$v>_2^>g>cw%v;>yLRe*s> zN{z`16dcxM>aJDY>o=gpgkSR~s(92;6}Vox$9Gk=9$f1cdT>is<#=IK;&>}8ow)kO zyG+F$1cg<0cxhMGK?oF?s;2QeQ9-L4RMm_jR;3)=G^^v_wqFqkf2%4uxCkm=yh>EN zc*Cf0gIjS`8$8x}C9B^utJfe*Rjk2pJL{0cOrXJ^OUuFm=XW%S?d;IGbw;a?l47k9o! z{Mq=&hNr_(+|z{mH_LylPFNFM!nxA|PD)Px>k%{hW|fMCX5oZ6VaP%7$1@-=1UKOL zYlu7hi9oL_xD98q3Oq$Q(!={bV&)Tj!0-NWjw}9~9%t%gao~)-;nolR0O3df(p?9v zEREKyjq0Z6%u|L=ow;IQaCs1(_(3e>fg<4SR{U!Q{Qp}2uNVXvj8-RVK=n&^{jK=p zAN3fZDv;YABFu4*5I)=S@Q$B1g%jv>q7FoY^P_`1^Wr;r{}}u)_=l+rIA1pYw+Ea8 zF5oqleS4Lu@{&273j=>aFWJNQl1G7);wl8?CB--c{$HAx%ngIkOYR9Tf?xEKc9eda zGCc}7uzS^LZkX=bnzNu&vzmIgo&yAz)f~^(ywFhiY~r(}|LYMw;j`5l-bcM>!;9b- z^`_doX)Jpr;7^q|E(oivnH#4I|M@KL#Cq#oKaYE6KOI?n^y5F%m2p>BSfwVp%mOYF z>KJ}&Bj~mry5s;8zt+ch?)#Jj+2sR!`N$bJlgh(|c^dk_3VZ8Zocl#tJ5=RhG=Cml zF7tuWG@TLlNQPTr*}HA|%M~;lncoEqqV`v^o>&AtUT5%d8pqg7D-Wlx@TG3lqaDC$ zI&w<2MOPjM^E>F$!3M(Xbq0gbPh&5=tUrbY&<9W>c;UviMj2PLR<(V_T z^BFtiXVU%(HO^T==aH)_~~tJ~n&?e1ue9IT<6?ruY8&G&o;89z!6iIH1x;uiyF z_IX!}=+Kx$%Bg9|*Go(*ogcXDaahcy^)7`maAteBYN5kT4#cAvY$TY2fvcr)gvr2u z9Bl%bp9q%?jx-q%52Z~ZHb;I>I4UIre=0=`oY@n)m{#an@N^z+axg0g+XUH5VJ_X? z!>)~EeEhV#RBA@Z&cg9lo{20L<6vjYc_kW!_|N>laBPA>`i5_24h}0EhaA%F(iy{M z_D0t;d3?wKzsv0DD*D!+IT&;?Ho$i92|feIexf;W=R2N*6BTaCO-eNqnV$n!t$Y%) zSPJW^_?^juO+|AtU|I{P9grl*9+_L~TSVWt$Wy3dnum*<}vqPJMl zmZT7~Nmm28%Ko&70o8Np8(=ERo_PjNhq6CCWMIC7rpo@z*WlTJeMX2q6imL*zCwrT z&2MAlYhIDA99-X}X9i5D#evBVfS5o!R9BzJtPqu4)P-BJ#Ay1^Tz=%ULS%9|Q#+Ao zhsfkY8r)*0U3u;Zko$JIwdaJ$yWHAyLu7I-Wo~Ob-YK0Ca+*xXWuD)+=Y`1a@i0fb zzAHp-v8!~P+gI^aJL>ZJ0Y10H7IzeA7xsb>n_0HdPV9vdHd*BUHd^h<_t_yfv%I36 z`93GaW)?5D6Z_lzvF zS&I#X$Z3GH`?celx*$XznoXHI|1;&lULIl7=NY%NE?E&_)62!%iM=wyrk8@Z6MHbi zrnkCiC-$lco8CSnH@2fzSsh}xrT%u+Di;RG%r+mmjc{C*Xn&?`nK|mSp%9t=_GlyW znh2RRcN>w{hRF1HM;nnZ3X$orjy57+93k&&Yp)BD={9g1^SnMprrV)yM7|_KCR?F7 zkry)kC@bMh>(UT8*8wwHWs|uj;cBP8DPTwKl#{QHbJ=7=h&oZL!Wuzhh92w#+Gp%= z4dW-tgIDs{WC8PSj5AK(9J0%P!j48M{xjV>!Nuq@oe?vxh2{x^re0B1m! z0v_@CPLA`n@^E0j`*EJtW{ZPA-HCX2=lvp#mX;dtoh86xi^al!*D*d~9R-%hHV!{2 zTdbJ*SK;|$ZQ?Ou@xbFCh$5N_9?U9`bD)$e77u+heVY$%&7_$mb6v8K@!J95Qsub# zFGI$0FwA$Xp5%0y%*6n5^h2}i!SN7%c*uY5<0z01q{@)&!Um-ky^>|I{oS47ymethC>G4?Jm z?<-^MU0&W-#n`*NyswV1cm0^qH8J)sFYjw(>|I{o*TvYoyu7cEu<7lV+xh-}dyKuy z%X?>xz01q{9WnMUFYk9o*!1?*?JVzi#n`*Nyl;rHcX@fgJH~ELc{BYixOU{m5PJdD zQZ%Pk#9s;NzQbJO&F_hj(-ihpBHt7trzz^GM1F6CoTi|s68Yv3nciC6c&w)q`F#=c zt}f?WBII3N&hL+q+fvSs@2^`!WM-RsqoAksyYmAfHa(BStW2g9`?d(1oLkUV><@<6 z^jwa%V&5KO)3Z6+iv6Jod)M3iju4xk(b3j?e>lXZ=XA6c`_2fPoYj#V+tqXWkpP=I znjvQ&rej9jT_Nf&pJ)5g2szDk*UaxsN1pEvk;y{N-GAq34}L5{ZcCn-(P`XO;o~8) zKO$hA(f}t^3=iVbwXvPE_f)&Q`x5~^b#_NS?{=Zy6QEMZf#gGV?W6WdM8(k_$JPyM z{kAb9DX0AxFe7M-q5SXFIq`#u{;qCQ%gQx^@+rj%4gpwEs(99^vUmmu%n``F%AKhT zaCf)+A_f;1%9AVw|M;9d&xUKqlTZ5`8bF{_WX~AM=^L(Z#m^xAN_E17Q3mUSV^FlL z$A6~$N@eB|;f|P})sQdo8iQ2>UY$vv%z9RQ*B%%5BR)P2EuYl9KIqyP^mE8!Rd5;# zJ)KIOF%xH9tEcmq!UG9>a>7t<{Q1ng31?1y9`RQf>J4u(91#J22Zm-G%VUzV&2GJoUFW4!Q0zb$r(yV+}dW^Ng-)P5|)zHnQ$P8ENCbVts= z8luw&pDi`b9vdNDnY-$k4(E+VpzW-rLmI7ak!O=k--Q zXH3n8-+qtB43_x&h*<>SYa}PWYd-QfVtm-i3(t4!g@e=JJ#W3_VNa{Re!~>8RnmEY zt1O;SOd8elR!>bwHk%nfgPgXQ$2@%}Kv{g#XE0fr>Nn~Frq{X~Fu#SEYrH~zbiB7x z9P(=A!l*}WW{0ylgToi+H`dnf_6XdHW_@v$CI5d`9uyyG2zvri*X= zEi)gKtlsH*PQF9&pxb}T@_&~tWWLJ=!DGIwG2xAYYhZv#Z_r;5Ov#;^wL%@U!z~e$ z`_$tJG~YAW(I!&gj_u;-np6Ii#t$d{x-IBh1d-Ld7BYR0%fM>iCs?^GHdWW_e6 z{>rq(aZTWlX*SRfU0JXye8WjHKf{jF`74@7Tb>+O9sd)C$BqeDKxDoE^V-8vr~P$; z$C?)H0jn{Pxi)dt@jtb>5RWc?qa-WV%>Lo9$KO~Sj0!%{5`YbnlT@cf2A$puH%lf{wQGnlV5+#&k!LTq}qdEeCT zmf#w}e8I&;osMN1BC|)hp3}b%@muUwZj#7c8jg4Uiy;SUoqOL@?#$ro*Zv2d#T1o; z>&g6Ch)(TU4)s)cdvRrQ0>4}G_NKT-R{k;ILhV|f*AHClB7Yv@l6xi&4=zqt2$`P) z7xq7e*yQx0_G14c#HOb!4lZqDzW+JErgtxIZ@zySV($i<|4WEX&SV?TZ*!);!;{N? z6=A2#c-Fes<>&tzVzi_s#u;kAi*VU}%`LM}Wli^AA%44B6OMZ3_aQd33c$+vl(uF5J48?S zddZIM$oU^aY-SC@6y)52{yz~q^IFee$1&gdxUa{{Av*Jz=WfS2p7Q?T8=zB)!^qwN^MSpFCPVaEhUi7^pbb8!ouaB@9qqh-zpAeh-R%s*l8$xXEOQnt2`$pKi z-sby-*j$UbjrpDtVsmZQHe&A|VKXh(oY)JQ*79;_uO1L!r#wb|U1zAcc1O*_PUvLS zlf9kcXwM!PaHDoZ&)uGN;2spN8pdT8elN)hZFW2lI?m#~*MkhDpn1b&Y2m0X=`tE2+9}%PPhH^hLM&AwP zepHOU8_NCY2z_^a!yFT%?}l=p8Kdupaz8dk-wow{T!g+mz8;T{(RV|+pAe((hH^hK zM&AwPeo}-^?~~Zx_xs5)`fe!qQ)2YpQ0}M3=)0lZPm9p${Sw<-?x)A-yP@3Ah|zaL zxt|%Mx2xP8eKxZ~^abfU%BHfv=&T4kU7=4U_Us5dU6D^Ec1MJruE3`fdrpW=@1JNr z=2MA1H^Sca<=q)!@A~qd7h$)lydB?dT_HBJkD^uJQ~J$1KSbwxg!7NDI`Y0CLTCCX z+lsz0MCW>i+lqd6h|cv3w-x=I2z_^0{@f6q>losx!&QnqMsk3GyTK)(H*^^ z-2pnavtsUENyms=Pl&r4M)rFn>~zEHnct|6eD{UeOkwAqLE>mRE{d?*ly8Th^#|D0 z9*4R8%z?W&z@>IM%#G`q3A@C{9j|V?a9yc5<~7$AMvQf0uzei7;dAb6;>h_@p8;-Z z8LlkQmPi|ifMxb@N6wdpxQ?a$);2ns+c2*En+9|S%rgEd*~^5n0`AmxfzP4o)dpH_ zXOcPZu9Y3jL)=x9_T1~dJNYo{S5Jlfu8449uRd$iw*j0v$F9A}Rw`uJoXnhR-cHm( zL|s=XwKQ_(yt>wMt@2Upr6!zQM{QIDJD-qSlVyFr=QH)n94P74F$XyCu<6w+TD^jm zTCht_vTDo9z_p_8!iWLAIT|i8$i0%tG4FXO!e=%}LjpNR^<5>fCc>vT23jBN3zV}2 znDybfPukju0li5ZXY@7Oc!;s~GKs11uhZ#!--^KLm1tiKNM z`^#lKpf=aOXq}9Y9|;)i0b{s0GB#X*?Z`^7Uo*5}bg-rC>Bd~*vH4)?v3h(%=~`nWIXc-K-`c-%#AgVc@G>7 zSZ~&_yzQlCqcm12l=ZA-_7UdWPW2& z`+ns?a}2}w4+ESn8qPNSJkfzN`-ZEnP!5qAUZpsp_T|^XGW&(&T`&=1flF+vS0@@xXbI(d z)?7KOXlTu9ek|9!yNXz~@+8z9!+s@FE5J_Xx$MZaSFtaoW}-E=lxp7gQLl#YoQ4jY z-B%pm{}v5*ywDiefwKBZrvs<1;gqX6pE5_y-$>w$)xaBby+=ElGCK;&tVv*P(hZos zq#W(mNds-NnbRvASX(u$39m8K@pX7xnZ4$9kYyoOgR)C(CdrHBo(K$7FJd_19Y|O!z7o9rs4J zcsad?dEQR~+$$K|@oIC6*ESz|8-rRJ&G&ua^4lvJ%nBSolj~V=lB0H3k~Etyz%SbLYUj*2XgnF*_df?!~tIbv7PRfSE1I ze9Pi4_19~N@T~{mvR-|(P%e)YMz`ehRY$G&b_%mPF;S@Gt9@J}NjnKl56&P8yDIYJ z)pg?5I|y9WK`|A`^BlhWP7S$%TjMtT<8}0mX7=4q#*?sDFQ(bem7Ljq|^ zy_RWd;i*CIrctNDZ<*c$|6Fkrb;>-Ksf%#eulJD1Q|P;n8sa7mdm9W(!buIKvj0_= quZD1a^}iP|aXb3a5>$fbr*ZZth4Ccp*S^_DnykR93%m0ytp5k272`nw literal 0 HcmV?d00001 diff --git a/BranchTrace-x64plugin-wtl/pulgin.cpp b/BranchTrace-x64plugin-wtl/pulgin.cpp new file mode 100644 index 0000000..329d829 --- /dev/null +++ b/BranchTrace-x64plugin-wtl/pulgin.cpp @@ -0,0 +1,123 @@ +#include "plugin.h" +#include "dllmain.h" +#include "stdafx.h" +#include "plugin_global.h" +HWND hwndX64Dbg; +int hMenu; +int hMenuDump; +int pluginHandle; + +/*²å¼þ³õʼ»¯Ê±±»µ÷ÓÃ*/ +DLL_EXPORT bool pluginit(PLUG_INITSTRUCT* initStruct) +{ + pluginHandle = initStruct->pluginHandle; + initStruct->sdkVersion = PLUG_SDKVERSION; + initStruct->pluginVersion = PLUGIN_VERSION; + strcpy_s(initStruct->pluginName, PLUGIN_NAME); + _plugin_registercommand(pluginHandle, PLUGIN_NAME, NULL, false); + return true; +} + + +/* ²å¼þ³õʼ»¯³É¹¦ºó¸Ãº¯Êý»á±»µ÷Óà */ +DLL_EXPORT void plugsetup(PLUG_SETUPSTRUCT* setupStruct) +{ + hwndX64Dbg = setupStruct->hwndDlg; + hMenu = setupStruct->hMenu; + hMenuDump = setupStruct->hMenuDump; + bool result = true; + + // ×¢²áʼþ»Øµ÷ + _plugin_registercallback(pluginHandle, CB_BREAKPOINT, OnBreakPoint); + _plugin_registercallback(pluginHandle, CB_INITDEBUG, OnInitDebug); + _plugin_registercallback(pluginHandle, CB_STOPDEBUG, OnStopDebug); + + + // ×¢²á²Ëµ¥À¸ + _plugin_menuaddentry(hMenu, AS_MENU_THREAD_TRACE, "Branch Trace"); + _plugin_menuaddentry(hMenu, AS_MENU_TEST, "TEST"); + + // ÉèÖÃͼ±ê + ICONDATA icon; + HRSRC hResPng; + HGLOBAL hResLoad; + + + // ÉèÖÃÒ»¼¶Ö÷²Ëµ¥Í¼±ê + hResPng = FindResource(g_hModule, MAKEINTRESOURCE(IDB_PNG_TRACE), TEXT("PNG")); + hResLoad = LoadResource(g_hModule, hResPng); + icon.data = LockResource(hResLoad); + icon.size = SizeofResource(g_hModule, hResPng); + _plugin_menuseticon(hMenu, (const ICONDATA*)&icon); + + // ÉèÖöþ¼¶²Ëµ¥Í¼±ê + hResPng = FindResource(g_hModule, MAKEINTRESOURCE(IDB_PNG_THREAD), TEXT("PNG")); + hResLoad = LoadResource(g_hModule, hResPng); + icon.data = LockResource(hResLoad); + icon.size = SizeofResource(g_hModule, hResPng); + _plugin_menuentryseticon(pluginHandle, AS_MENU_THREAD_TRACE, &icon); +} + +/* ²å¼þ±»Ð¶Ôغó¸Ãº¯Êý»á±»µ÷Óà */ +DLL_EXPORT bool plugstop() +{ + _plugin_menuentryremove(pluginHandle, AS_MENU_THREAD_TRACE); + + PluginGlobal* instance = PluginGlobal::GetInstance(); + instance->CloseAll(); + + return true; +} + +/* ²Ëµ¥±»µã»÷ºó¸Ãº¯Êý»á±»µ÷Óà */ +DLL_EXPORT void CBMENUENTRY(CBTYPE cbType, PLUG_CB_MENUENTRY* info) +{ + unsigned char buf[0x10] = { 0 }; + switch (info->hEntry) + { + case AS_MENU_THREAD_TRACE: + { + if (DbgIsDebugging()) { + PluginGlobal* instance = PluginGlobal::GetInstance(); + instance->ShowDlgThreadTrace(); + } + else + { + MessageBox(hwndX64Dbg, TEXT("Not Debugging..."), TEXT("Error"), MB_OK); + + } + break; + } + + case AS_MENU_TEST: + { + PluginGlobal* instance = PluginGlobal::GetInstance(); + if (instance->threadTraceDialog) { + instance->threadTraceDialog->OnBreakDebugPoint(); + } + break; + } + default: + break; + } +} + + +void OnBreakPoint(CBTYPE cbType, void* callbackInfo) { + //BRIDGEBP* breakpointInfo = ((PLUG_CB_BREAKPOINT*)callbackInfo)->breakpoint; + PluginGlobal* instance = PluginGlobal::GetInstance(); + if (instance->threadTraceDialog) { + instance->threadTraceDialog->OnBreakDebugPoint(); + } + +} + +void OnInitDebug(CBTYPE cbType, void* callbackInfo) { + + +} + +void OnStopDebug(CBTYPE cbType, void* callbackInfo) { + + PluginGlobal::GetInstance()->disassembler->Reset(); +} diff --git a/BranchTrace-x64plugin-wtl/res/Thread.png b/BranchTrace-x64plugin-wtl/res/Thread.png new file mode 100644 index 0000000000000000000000000000000000000000..6dddc0bb39300fd1e0f86d5323c4fa331eccf132 GIT binary patch literal 4484 zcmXw52UHVl)7~T`NF;(l=xS7YCxctugYeI3$G1?F8*EaI+Q*Z#R?0BRj;?Nqsan^CR zP>r#g5S>&Qzq4CmNk_Ce7yQ1$MbaR07AVYoAGkwoC8is%-W5Yd0P_akjh#7F;0Q=g z)?}**wi+h=axyIOh9}gA)XIMvswuZ+Nzb)5evzH2M>HosDd2w?{N*BH1+rlHBn}x} z(t;-@cC5*hn=caXHC7NKp0TbdSmvq|jX@D}Z~INK=OI~1adOqp-0+1_s{Kzl(@5|o zQKo3D{|B%JGECP;Ro)4>WZDm1Q@MSv#-S2CaV?{?|E45%WWJP8!mZXGa{V^(G;#H& zK!FzzC;P;nhGSF;tYLjZ+z(S`NVRW=X+HYM5oSg`Ges@tQaW90Y{~5{D*{FFf9qCW zdDm?nHg$`8YJ%3MA%T@&(;zzId#Zfk+&eowx0i3KV#;O2K`*wZz@0#pYw1&jpau~K zkpZOnoy&Ng$uO7Jjw1<^HNn<MKuO#J4M6hb` z9cbrlYkfxbXa>P6tcX>Nt@P1O))+qVwGPo3=XffiS%}{`#isyp8O5wlej&JWMXBkS zL7ARDs+jnpb`>R1QN`&8_@Vp`$mR?E&ghM+^dNdu%iagoocd;4z0GjPmY;W)S4JmJFJwOvPP}Ae}MshT39jLKR+7bpfz39sNuTq}l z@uxP{p0CFF++iVfEiyyET5K`W-_aYvbcp_8R1p`p!-3;GrWzb>ajfF#j^*Qt1NsSV z_OP{5BVs=8*Tif&AG^!~hARxY(e{d1{&+zV;x46vjsd4$-(6RvoIGoJ>Q? zy)`02+D>hri3W4AKaIip&M;jo|5Pgl%9HIYPhpK#l*qR;!zhYWpIa&7s%SP?)(czD zgM4fA{~9ls35Y>ZxFT`axanJ#0Ys zOOMr9MAvsBO}>_l51Gvvo1Pm&{EeZ+?gMB@+^ImJmTYk3@OsP+l0^AaH;EJ=9pG&A zmkyhlH(uI4+dvA@UcMZojuR@io-HkHR(niK9mBt6Z2RL(Rx-9%2|4n$8utQA=hDb-B3@W@){gnd4epu6iw1w6}m$)~0gqQm@LJ*eCJ)|~f1 z5201S_6ystiO-q<>5H4o%T2{@qKA*g5GHoY=fX^kzVVZ?+%8|RF$0$yrZ$Gh@rNE;O}p78#c{!e(qDGdHMauw}9$S-NgpHjA>laK}63uEj}mpDAwXb>0bne z#G#B5CN|u0>Lk;wAB*@k!)mrg^l>k{^;rl?BKS?$O$SJ18`<~w+f~ZG1LcX0=s>O2 z2_4KN21~*AVmeFJh_xnmCAa%DeSndzd1+El#|4gL`}ua$mN@<|pD8n{HRRL$TB#g> zzrntk{+rJz4X5E{SgkJde#C0zkOSyiUb1V9L@E&NJj`kM2wTH2XGWUKze%!DMA~U_ zY0K&|m}dE&v8|id`ItHWZ1T+ih%+Vy`l)dLW@X_VbQr(AO-2Q%=Nw z#fQgS-25c*+dCPV$U*hj;TrkdH-fcrSMZI8)8oT@qz}lQFhlq?u*vJ0{LRfYziF2u zev->@{dWKwB=C!na+*h&f9EBQ_;T zAb*2!I(%hZ(!wA-{p*c0E7`3jmWzzqHT486JBa=Y*$L)eHJ!eHbyQ%L0WZ!ha{Y5O zLeL4u^9=30(4D={M{)(1^)Cwob+WlrjSZE&5f|vi!Tqdz5fE9;roHMu5PM<6`l}$a zJ0v163kFFtn+`bWhq8;0rw!m9m)bUmSEQ18NkZk^vmQnS+nV~($vXAXIH0}kSnSzS z-e0kCRm^^w=fy1Iuc@$y8S6ixfugn-%RHz55)w|EFmRA@GYEI^q_xL?xv=XvYeXBB z`Kzqb%=Vvuu7?Vk+MkB&d4oqlB|eY+u%H~A5}p;1dpE^%z2_OPGAigIoGR4^d^=9hPbmo zCWlj9{4l5|!a>ZO;)5Z`A-U*;%rUv{Tqi87d%lBHqHIm#ZH;v}$C^8=*%$~%(U-<4#!oj5hyLa3f`2&2CFDy>K`(c1vi+iJV*7#L zzJ5wds*NBPyPI1+xJxK+-->@KF#MzkGTSEWdQ4=g&D)~47s*94d0c-vh`7&uwM$B* zi6WP-aQhJ9*F?=O9z*|SE~?k-m4bN(IrQhkLwXtl35~`sTAY->DPP{>hq&`_gVJw% zEZhHrg%_?2p0q)F9>yrU(0Q2lVDBcK50QEXY-B_GG}nC62|L-NLB9f{b$z#}tGqS2 zGD|0;I_UIA-vQ+|a?M0BYg~@Ud&U7%(;-S9(7evzalN;rB*(@eJUO%m64Ysmvp;?9 zO{ruaFiex7Ipl+S*GM49yTSkdD z6nS?|=^yd&ivRBh-bjQ&g0Czz9q{{N_a)}`mC?Bsny)^l<-i5M(83_YI1FvTnwSaj zDDb{dE_yvi+dWa~?8F+bIfXHZOMM^@DWCe@5qNfz2~Gi9V|zagpX1#dB91s}8hTW- zqbWyD!CHJ@XUFaSIUbQbf`20;@a~N^M`j?8IKx@rzL>hI|9DA0r`E>qP7p-?vPl)#{@UMi|b&!{_ z1F8z|a}lwV?|E;ZSk%ok$)*XIMQP%0dTY%>u!zio@% zYgilI>w`6SbM|56#5+BO0-U5}AY6?yl^36LroL_tP)-Gm{N#m;&JX@NR=A29B4=4> zzl6bC6_fCxawO5mYVGzuH#Wy|Q}@d30uh+vAt<(N4$lagn^K z9!S$yFQg=QFsA{cnkMp_b@d37Td7j7_TSQ&SlXB}fq*Kcm>|+>_zjk4pJ1jb3a6ave!S&+y3AbS3BOt)C{!gf~_;PE5=5H!!7ZqI<4d0X27N% zUH1bb_;H*$b_%!c?KR9HK)SG>c7J#;Yl{A9KC_eKk_c+DuyEIf2hDB{!pF}FyG7ym zW1-O@0W(ztEmTivxY&jPeNSyko5BwvnFGS>0UyBPNR#|_#XP}W>iQePDOS)oC#V_P z&mYMgba#npd2j*VH9-gvtFt0vxRgLjPS1%79lYS^au4*u(>NrrKC#&ncUG-7(JT_! z9J~Mht5{?>JK98iV>m6@`&}FtJlbr;Ju~J~z24dtQD~4&DVg>z#RSVG`lw%wo8h_9 z3_s)^50Esy2~y@#@|V16s8*J_iq)WJb&ZJMbQ`XTKqkx!UkH#BSsjRI)J<(Pa&SByFvXS9c?K Z72n8*&BrXu_5qAbSIbC~deiZr{{!56PsjiO literal 0 HcmV?d00001 diff --git a/BranchTrace-x64plugin-wtl/res/trace.png b/BranchTrace-x64plugin-wtl/res/trace.png new file mode 100644 index 0000000000000000000000000000000000000000..12e87e82fb8d6aad7a2e67aaf17cb74189bfba77 GIT binary patch literal 6814 zcmV;P8e!#$P)QO^hF#h2gz_rCAUoHO^%+&kxa-sk^^|IC@0GxvM%Ea!aB zHPoeBpj%+21+LL;(=E^~u-XD0AZbs>O(fl3((NSeEa?X%?G*mx@7I=e$u_@FNcu-f z=cP5*OOI`V4v^I|02ua>^fLhv0E7Q$5x@gb_?;=~gOWaDQP}I2wLk~RckO#~N&8Cr z=>Up5lr{ZT+CL}h{gOTsKy%hW?e=COEHHO~{D`CnF8!__=OkCAlu#%7d#3LxS4`NsO* zba&?fkQ+&QLIB3Cnw~A`KP8$n1YkVwCbbsmq`4ve|le9+@vk~9PZ%KNgq!&o~ zT70!$GSvc81<3s+9VzMFsRn7R{J8-nf8JQXo9XV<0CHnVe<10QW@f;rqwkjV97!Mc zQP;IBEHEX2+%vpQ?>N)xy*MleQ(Aw0%E1%MnU z=}-@2Oi0J+VGs6C6B^SfLunl#e=X^Lqgbx~M!zWOa7pi|zpM53uw{V!gQPpvYuajh z_RHbkq?!)3)R9&J!rSp?BN+NJNnZ-Ti?;bYUBbVMAD+L9zc2p8C4LM!Leh)IXt?z@ zTLj3rC4KLJhUZK5PDw21&M>xn3rPot-vLHlsnwqwj)GI`&ANPR0J%WYE`?_dr@&Js zvC%!PV7$f+CEX`nW&)NUD?BdLFUvhb{E1iJC#|OyfV@G{!wSs=`x$`oCz8HdsEri0j}E6#cTK63Q1&|^Qj!3z zE*mV+0zgWEgPUi7!H*kB`|B$jdfzP$8z z@6$0NCI8fMOnjM2of0~Bb9hy?0c2N6fA4r1_{6Yw_pt13!pYBrCEYDiA*V)f3Agdk z`gq7sO7is9eY~W<@aWi-bkqirmq>b&lYu$LgkQ=cI70#mmLPYrC|at^y$fzD?{heW z;EUz;b^13+`$;Qf{Ewp`)vfqMvk-;=8(q8?up`uWC)va5=~ z0O`eW!m^DqcL^4#2_T%y^R~7M5p_?^RKgN(0gNF%Zy|>RD123N=~zrWSzweDHy?T7=-BT#)^C00*1xv4nW?r%U=qMhAXN((h)}+ggRa67$hTQY`@C z81`Pq8Nt~Q@7Nr-k(UOy4r3Qws^eb&xXcYW%!{x`T7|jD{hC?ZuBv_w0AWIzSd093 z@P;yE+oK{h{27tijWc6IdU+ec0ElT{w zzes|!w^m_4lzQJmKvpWSwi`bnn|&&Vu>tZZNxZEr!b8qv!dn|FIu7T1wq ziZ#ZHa=8EFBspst8z6uKkXR)3NS94Gx7;lWZ1f*W=rCEatQV3OO5$=f=fEJLt92J0 z6Cgh<>0c%BXRZ+R!`I{T1O>F&BANBACBelTD}N>lPXdd~o)KkCfOssg@Ug``)Xw8e=4MOyG~^J?TT5B%?-`gQ*}&$SeIAtmGrX-raVT{Q3>U1ESehR z*4^t4>5^;Ht5j+FPrfbR0J8Qb2u>eBQ z4=&cZg6~lZt756R_T2tk>Tw~ucS6oWj)`%P&lLjKYP%=O9ZPb(u>fKX`uXEP&Kxsf z;;v)AG%@-p1K|VrH(X5e<5Y~_|1HIb5ETi<&i;~ii&Y$14tJE;m>H{|7Gvd0KTEdw zu>b;Df+b%d{#LQ1%!~bJlguy%KyW2LC#jcLFU%iwZ4-pW>it`vfc zO~PrG1>A5VkHMzDXRqkk-`SQ6&A&~F;wt0h6XV-ei+ z`8vc1Cx1jA<_a!4Lvt4A_SLQ47yu#WIhXJ1Zxc4$1Rq(m-5%r=$hF;sak9k;*pC}# zGi8}Y7F>eDas?VDvgyuBh6V_355zj;3L9jCiDKkylDLq}6%x+iNn29zmgOs8k-a2+ zG(rJO(-R`ftt#?NN!-lON`?l=?IeA|VBy$XU6yc`h&cS7I2ulIq0b!_Z)GAObA>Mh zcG)CWn?M8mh)s=5?caw62uF<;DjvQbF~_Ww`%A-Q4ar%{GSHISoJ&{SPc{ilI;eee z1->%e=w~HE0|fVJ3pp8Yb@m~f#L5bf6C@XmLx}akg))fS@)+T!KUZ*A#Bp&}GBiM* zCF%DK7T!Jbxbh@PB%;Zcq3y!MhkJUCq#RuE1<7@LIj_+;njD*6RcGi2feXUeW6A9X z7TaHPgp<0rcMlZju5kc%bbdaI+ia8sTN`bqF!S- zs{Oh#z|CNu@v06D5Kgc-$;y>$MiMl@o}L@z!`+AFf-z@omKO(^vtl>+kX&%Fm?I^8 z(sKGSXq}+}a;&7M8AgcHAQQDoEN^6VR{jH+R7yz-77Q}{rT2F_TCy1j_TrIrB103`v#p~GO z$@?8i1iSI)tYi#;kgkAey<9m=(s7ZMJ(BY*nj#j0mpz^ zyyQyC(l)n^D(j5_kbNb+-(ZcD&9n6gb!#^*VW$t2^hZwMpkLf65!e+Y1dqjrDsQJR zg&ZQLKh2aG10XQ`;el$Q<>%7tqDU*l2W; z`(R+S5QWcjgU;NJ0T9}?(t*OO6&smoy?a@OfdxM=UqisU;O1qI1oI>QQ5+M;Iub@; z?W!W&M{q9@BV??N@jh6mYadBx#56XwGGhV6dL~bjO5V(|0z-M}JB`@BSj#~bl)@`! zwKYCz97TWA+VK|aj|C7I0pDdb7;J%Gh}2=-q((L~NHGZU@cxYzYs$GH-ELyXG+4Q@ z0Kx#R6PKDI`DKypAA=b`qoI_v52*J@95kfkW`;@1Rv8l@FOl>l!|w<#x#h zZ;9cU_3{csjtLNtWfuHbseH3+I0@fvNg$n0WuzoMw)Ny`*2}9J0AgKc5s!W6gw6T_ z6dr5yp#a7*l>JkxSi_rVzr3meARfysA_pO)OBF5~A$=a211qJUkC6lkUaDBV6=-kv z%c~jyLLV&g*wlw@gRe+TOvKg)?b?z~ltct#O~Ss4l28*@Npyg@+2&ui;fLeTo z@JZq;LiXHT!F_|f6~cAL5Wau_6}EPZye;HYwCG52WwEqVecc)Wf|2kRCH&MPvE&8o z+W5Wz5`aP|>k#to01Pexttrmn_f5HF-)?-k(Q|4BJLT-97J%THO3Z;pc+mDXtlO8{ zhByw85POoFE-q#)CrbhtF&Uy_^braGHIhZ1ZKP(hv|U}@S^$D!-XiHCMhih0$Aj%9 z00k$<#m^(tD;&eP;Iq!hiPB3vLX2URmtcXK0793nt`X=U<~=vX zLh6G-@E0i=01JO&PXMv_4UyxJK0~M%8y~W2jF*QcYN?k?s%@(%UmHNIxdj(Sjm>3P z#UvOz!G$M5Th>Db7%!~{CB~uDSG_iXU?FR?Av!pTVL4Q4IaAY2dbsg(V#NUmOz~Zo zEKnmrxIuoC!z>Mv=iH&2CKW_gzQd&9%F5ioSXlQRx=^Qz8Ucc(pr|1V&??+2!+kqN z!A*vx6-VS2VV}g;g8;TJTP#p3Ksd|yAdXH++t%8{ftx=m)vS{1>}hSciTbqy1modE zc(8*NpCRe_4ti=*!B>N?2VW73z{JAWBR00*(pHmoYX%4tccz0?@%ClI4wuwa#7acH zu)}kmzCu&6>ki|n86b2PFW*>l=5>=arPzkUGXto$+6MD7vjI>;)C4gKvd_`h&@@=vOZtIqWqMP)4{5zSg=pzrchw$a} z*w1ILkE7Rur}d5XOsZgjYJ^noo1sC&Xru z+VmXYrAt1;Ie0g3vPIIrw+N7Hg@iEsC5?1-;Tms~y*!#1qlV1ElB3Yc)a|Kh5g=F@ zaKO|KSUe;(m4Zi`t8_p+MD7$XvIzXpIF#s;VS!cw!cbXevE1?!?paRpQkJQQ=s^6e zER5{SO_Pn_iuPL zI#oSW0SNO0c|l5Q=uLAv#1iGfk|3M*5*~i2d-&nGyh$L;22e1`K>d3DrV4ZW_bCD7 zR)O|^H^)i5M?v>^$mVi#nyech`xr}J5I{oOHuRk3Xvbz%O$i`Og7*a*I-xSfP2O9e zN%a&`t{vj2kjz%Nx@9OP8A@`vG=7LI;|jqD8Vy> z)q;58sm>>1tFT5MlZO}BI~B%uzWONx>oTQ5@KxLqI^kkJY-McDSW92rrIPWE=f1Fx%hV|QTLB6+)BAQ0))9CIO+z@ zlLSa0f#4zamXvwgGvr>6aaQ#1C;P3JdMh1MUy9+!>}QF#y?vod^bwu7q+F7r99Q>+ zyZf$^ZWPj1TXTx6>k3{1xYu8p(cdbo%o!j|NbMlGnWPJxpB!%TxnSf+cmS!aJ%z)G zr+X?KQ`g)9QZqQHRqsG7UE`9UxauVQpU$mPRm=3?=Nx z*gN6VL#Aj~2nD|BDs{HPr0@*>M)e0?A>LU^l5jNHSz)z8@l{zqqYBK(;sW&>(@R zn#49W311PM5p!h{IqEw=R!{%`ICB54d&rKGbZqWZSg;=Sr)L}Vv%K<*oHTSLziJ1_ zdfSmMfD5)#QoFmjHO_>Td6$(k-Vk~_KsH;M^ZZ+EE|y#ZR}jL2YZijChRB);www;BI!#G zdWKLzoQZ{=wE2^)4v@6RjDRKF+H>U6;COg>PUVs6bbyRx_?DZ^VPgNBq}>}FbYEgM zIB7L>nLCSTMs{RVBw(bPQHu3V`Y2|fMx*fHLixE)@N0T}!^7>zybVuY4P7V2+371f zLJ9&B*|aMCqHrd>Sfw9O64jh2>6S|kJx2Bv`CffbizS4PxgIud)26m2e=ze9aVP z3Dt??GN!8)fB*=1U-t`yXM1FfwO1)`flfVI-o{t8z+3O&Kx(#*)qKD%^`_QXpp#b* z^my=fAQY7!oU&cous~0LP0;h!Fsdu&2ZJ*u_1(2HrnoS(#y0l?|lL9aZot>==1rU~1EU&uMZGjI< zIztj{CTG>%)nR%!1VH+U)i86J(+ZpI(=Y@%unQTXfak0y|isBtS?ce}vKIpO$pAq&FJ% z^y=LLSr#Y>kdH{(E2~#mR{FZ61H-YSK~1mPEs$@4k^s5D7~gS_ByMrLbPJ4Tfsz2R zgqo!IFKGKELN_aw9GY5bH7Tr0HZP_asepKqUcU zy(q-wq&7QeqPFkDYQO>|0Rn3Yu^?9IAhBAo*Uz>%B)ER zoNe3HZLvUUfROo#;Q!qVTK*E_t$o3+b=4JHfLMG8D$bVlU#t3A8X&a$2uZK0*igM| z^R@s)6)fG4-Oda{0EBj5BB)wl6ioPXIIG30HMvE{$TEp zVBO>A+TfmJ0))0Z9ckSU$((!l6-hT98z8j*oRFWer(m1&<5=I=s{sh6=}A26dqC#i zqbinITPLBXfu8$gS#<&Mb9mKAZ_FekznW~_d?-p2NflDPFBZ;8A9i#<- zZ0+=JlJ=KG#3JtW{2-cJ{CWNUICKkaumHs9Bwiwa4JkD~wyOO90}Rd<1-y>uNdN!< M07*qoM6N<$f*iEoH2?qr literal 0 HcmV?d00001 diff --git a/BranchTrace-x64plugin-wtl/resource.h b/BranchTrace-x64plugin-wtl/resource.h new file mode 100644 index 0000000..168fd72 --- /dev/null +++ b/BranchTrace-x64plugin-wtl/resource.h @@ -0,0 +1,41 @@ +//{{NO_DEPENDENCIES}} +// Microsoft Visual C++ generated include file. +// Used by BranchTrace-x64plugin-wtl.rc +// +#define IDB_PNG_THREAD 101 +#define IDB_PNG_TRACE 102 +#define IDD_DIALOG_THREAD_TRACE1 105 +#define IDD_DIALOG_THREAD_TRACE 105 +#define IDC_COMBO1 1002 +#define IDC_COMBO_THREAD 1002 +#define IDC_BUTTON1 1003 +#define IDC_BUTTON_STARTTRACE 1003 +#define IDC_BUTTON2 1004 +#define IDC_BUTTON_RESET 1004 +#define IDC_BUTTON3 1005 +#define IDC_BUTTON_PREV 1005 +#define IDC_BUTTON4 1006 +#define IDC_BUTTON_NEXTINTO 1006 +#define IDC_BUTTON5 1007 +#define IDC_BUTTON_PREVINTO 1007 +#define IDC_SLIDER1 1008 +#define IDC_BUTTON_NEXT 1008 +#define IDC_LIST1 1013 +#define IDC_COMBO_MODULE 1014 +#define IDC_BUTTON_PROCSTART 1017 +#define IDC_BUTTON_PROCEND 1018 +#define IDC_BUTTON_TOEND 1019 +#define IDC_BUTTON_PREV_SNIPPET 1030 +#define IDC_BUTTON_PREVSNIPPET 1030 +#define IDC_BUTTON_NEXTSNIPPET 1031 + +// Next default values for new objects +// +#ifdef APSTUDIO_INVOKED +#ifndef APSTUDIO_READONLY_SYMBOLS +#define _APS_NEXT_RESOURCE_VALUE 111 +#define _APS_NEXT_COMMAND_VALUE 40001 +#define _APS_NEXT_CONTROL_VALUE 1014 +#define _APS_NEXT_SYMED_VALUE 101 +#endif +#endif diff --git a/BranchTrace-x64plugin-wtl/stdafx.h b/BranchTrace-x64plugin-wtl/stdafx.h new file mode 100644 index 0000000..7e203eb --- /dev/null +++ b/BranchTrace-x64plugin-wtl/stdafx.h @@ -0,0 +1,45 @@ +#pragma once + +#define _ATL_USE_CSTRING + +#include +#include +extern CAppModule _Module; +#include +#include +#include +#include +#include + + +#include "resource.h" + + +class CEditImpl : public CWindowImpl +{ + BEGIN_MSG_MAP(CEditImpl) + END_MSG_MAP() +}; + +class CComboBoxImpl : public CWindowImpl +{ + BEGIN_MSG_MAP(CComboBoxImpl) + END_MSG_MAP() +}; + +class CListViewImpl : public CWindowImpl +{ + BEGIN_MSG_MAP(CListViewImpl) + END_MSG_MAP() +}; + +class CButtonImpl :public CWindowImpl +{ + BEGIN_MSG_MAP(CButtonImpl) + END_MSG_MAP() +}; + +class CTrackBarCtrlImpl : public CWindowImpl< CTrackBarCtrlImpl, CTrackBarCtrl> { + BEGIN_MSG_MAP(CTrackBarCtrlImpl) + END_MSG_MAP() +}; diff --git a/BranchTrace-x64plugin/BranchTrace-x64plugin.aps b/BranchTrace-x64plugin/BranchTrace-x64plugin.aps new file mode 100644 index 0000000000000000000000000000000000000000..41cba768d8e41ffbd3f2c7b03de3fa2fcf36d153 GIT binary patch literal 33724 zcmbTf30%zI_dkB8m53~bgo&b*G}E+6%wAK|OlDdYlQt5S77|f*LJ3*2%i3nEgov^e zB85`cgshRh-+8@Wlh-tQe?O1^KaZjA^LfubcR%;sbAu2VowQ& zCj~8(IAS61|AIXvERO5{Ex}zPcIQbvd=TUbzZWK3jeEY&M4 zCT_|MD#y%>8WJ298xl-y@BA1=x$@qK4gwk27s!#uPKgMf5*4ylo zERXof&D*FP!n(~8%b3}3PT;K{6|8QsR|kL*>Pv?oOH&|*(< zNN``RlPTf)U8fftr4)PY*|51Ab$?jz^z;e0G+$oaRNvNm_Wg}*R;?Aa4vljkH?}Qr zyRl`9RqMR>=8f}jS>M~|x63bJpL*V%nRiFs9(ClQ${=c(__CW(-Q>zy{Z1d(n;CPT+59zhsJZ2wq+cttG%bGT z4VZGglK1WKFVAm@$6|vfwIy`Bp-b(#G1eVj`Z98X^B;btpYe8+rpi@6?H}ab>`JX4 z-4q~5T^HMWDRe`k7WGN%_e(z>$IfX)X#)ibY;-Ai>yA-P!KPJvEm`txyk*Z($Z9K@d>G2_ru$*7T6r+WYea>Yz zy}O5^g9HnyO=+Q_r3d!D&uB3a4EZ{ty1?Ar(m1Ks>WtfaySq&#cIG2ecQ$=X={|2H z`d)Bk_~ojgcb}f34Q<;`8;-p+UOmZRM3Z~ZAffZ+rYSwYiu>r_HQ|H}qAncOv|z7K z-XH!slcp%a`-A7QzkEFslJskFmP1we!|4fMuRnR5wY5jVy>(uc3y(gA4(tDeE|6)R zODX*BFzLd%lp#CLrJNi6r`&i!cYAha%B5*1zu5SxT`4k7e4n(e(e;Z+VBT0^Svaqo zKyz6=g+J*~)y{!y7fIjTJT*TY6*DU>mQL+{pj2vn^p0b0z?nk&1vq$UB*fCcO6-8nD=7z`q))j`P_%MvTF*AX8pW1E3Rqubw~EEmEQFuau4Vx zoncj$Y28%&IUwodi1f3*2iNp1NbPYzJjdB;eU=BS=_9Mi0@r*)YNa=&o*a4e%yWg0dWN?OM>qI95eB|W1m&pbBnXe3}%-7 z={9H3!4;=w9A&OShPPKb+mD{RG3#=IX}5$A`oq62iF$l7we4)4QO2xaXV0|Ed4HES z)VS^5EaChuF57#LnH>}FSwIQ)7A$-pKj2&Wk=dY|=+MKR>2fI?YUH@EIsMRY@eADAX??}pOL&r$N<*Fw0J)@sLNuRt^ zIxBO`VAm~h~{~`I<#3c>8{L_BVMw*$;N0-EZI^g<)&(~bwTKPWo-lK_2 zOL~94!;_3cPx^nId}+Y>2RiR-42srm(kSW?)X)F$v&n5IZ)n@yNIBv(acS|D-&=hj z6H_F263Gb6#}3$ZN{@4GHxurq{?Lg#*V^GZRNHJ4*RvA~=(4et}aF ze8F#^*>e3cM%UwS{6r_qeYQtIyPxPF8BP{*4$$&5cv&C_WqtA6%LP5s1!p8lS&7&}`xG zu40vx8#{W12$SN?^FJKDP(9KsDyDJUIo|hpyL~^W2RAMpnH76l6#Tt;mG9b{+Bfe@ z6I;xv9Ozs$SV2ezn3O{M4?ah<&@K#r@(%?sf}U=CCW+ zYgf)ny``&CJ^l2EYlB>)OOB#I?H}KtF)IwL0-ojtonz2`n5aHcZMF3metPDyy1s4H z#pOD>T`yMrNuQnKY2e#q&W4)J1G0DO1-)<`?^^inC{poVWGtip@j9AyPpgl#J+Lpluq=9~wrpM7irbnWRo~e<@HR~HR1?2BWIkd24NDDXl=1ix zhcICo?EEVwd;4tbvod8aQ*?l{UAC!ZEa!J< z_F78X2-ge7j^2_BoLR%#iffl;yzW(e+1u`M-6R8$|uSw4&;zLF&93+Wvgc zjRRDvXYR~B-stkSPP4YCR>N;)o^M6%*rMZRuYd10dVI|*Ij`@c6t@du8S1rBLsQT1 zKNseIu`RKCQUm|yC2Q{pou)qlj;4DTnrHj;etGhCq<($2F{?PJS8dDpG38xGEaVP( zsbw*S6QkGowJP^{^pLFw`n!3s28~ z(S>Mr{o%)&DqNOnbcyI$KIXaBz~DtI1D}VdpG>=<+qxJzg4!FmAk&p*qr?jVPip)oWkhAHu=};cPG2-@_pL#Cks(73W0sCqo&CVb zE0d}EbA{U)VRQX*jV?}W^hORoJD7GkXTwj|vS972zSrru(;sbf^{y4$bafqbFfm&F zEWP&CRAY{+T5DK0`vH-0Ukx+MuW6Qf{YRTJd5%vss zaNX-d_404)3@;`)^>Rq%6j)_7uPW3H_sJLeWc1!C_8DKcU(|ihTAkwyu5VklY)r=J zE{F62RrgE|vOE0y6s`1Tz>bfHduZ#3j@VtjwlSRFn^C%B$H3=hb<1BYqD`HV(NA;B z@j%;eY5q}1HxDzOUm5*_Hf{TEN_0-vfdTv#cd2~}1m=;!vCm#zar@;SXn)b=>JHuq z>AP_%E*{^?F-4awS$C-WitBx%BL!o1GS$SsV?$$>4h!7Yb-B(P$1X;*XrfeuiBa+E z%nl5U{1x+PP{HHdDA}dYrL+EX+0S#Wau#KjZ%8VOPEDted*hZc*;A`Kq zEgTrk4=<+d-E8JhXMa8?$QdVlHJ(`+mZ=~8ZBF)Ry;c`mkJPj)tl^u?^3!6cMZEBO zqphuDQ!!&#jC#~X$;OGbubYN6AS2_8WtsgloFj^DSH`tDUCDJytKPrB>&ttN>hlpp zN5pJg7tniUiD41nqEhp$mtOVexb-)aRsT%Rh}Su@_I>~FTwh;f$3A=bv*-Q_gzEO{ zbGF#^zt!S~(|nCt`ZSgN{1*!}2h;QYSI~av?zzz)9ZlCO zU$$VPczMQ%6?-T6k2+JXYS3bQ@lDOst3L+`)J}hF%n9zEl$Mt?t;FA6SUGFmM#uEe z=39sAE!x~Ar9tiLEYqxLFT>F;=0*Ki8(E%t?sBctrfAK`H)|+qiN+=M0c$qgJpQFi zT)6G1DF=FPXmJuX?2^@*_Nvhxrj~kf*~rKPqn8>C-9P^323R~Se?3W_zWYUE<(oau zW@TMoHO*gPH7tDLtJxMQuT)C|7Qfjto6>Ji<^78mKLY|z=q$Yzy||)wEk);HL1prV zY~6udrj^X|U7D;uezc5JdaB`NNUGZBVSgqV^tn8yH$R~H@X%VPsL{QK1?Q~!IL_xl z_z=O=a)wO-J&01CFkGDO^7zJ470%oyhcz{4eXg@~H(W3aEwCOJX24r`_u)sqH>v76 z{VDY!jQ%r{Wh?GYsmtQqSUJ(K8Z>)sAo zJYf9Z-5XByJlN`Nz{q+Qx=e7*Yd|0B=yfedWgm9+bgBDxOmC{&<2}#qx;?eO8RngL z1R+Ov9xY=<+)X7~yRw`7_I7GD*IT|WM{NM&xUa9rAp*;mygS3cSN<&zd? zZC9Pt5WQdChvpxjVb`^OrhvL#6q04+Sor06*!}C-`Y3QxXs^`7#w9m@sPr8i{&_dL zMBngRdf2BdbLzP>hbh#-*Ug7&8fLlbS`0Ky9K2Q4Y~Rk*b!uHFANDEHofi2O6Tu#0 z{;}rX@|lbCorS{k`W%2oQ zU56N_L=Bj|fpxx{rgNOmqmr8bpFMwEdDd%v-1JEcFEwbS6x`bNVmj(_sH7%o;{2r_ z1W(P_Uu*r(CoVp%dm-+!&e7|9N(|J2)W`!O*F=a==9ImO;%y1n$S zFyZ9Kn81q^P2tB$8RqW8m?v2a)|Z)UuWPK`ojF{W>v^^;>&dliwdZ_%S_hqSKd?%l zvS{C~gN9nSN7jxkOLX9!cU!hk*Xg<5l%3_(i&3G4pSimk)9!jJb*)J7=>Eg9N`E zUHZ(~zu5ER*O0Ovo9=m(yKqa6l*Md6%a$H})8pB}0n}K%(e*yjFXPrT_SGyavr;`+ z_)t@G!Yhxdg2p~6uO3nsWos7QDq1<{_SWdJK3-zqA}Ca$`nZYTru(Yz zG&$zK@7Q9WM_&#uJYn>;yO-fo3hn#gpAO-&!};}E%w2g?4)M+`^Zcgoc>i#4!;c-m zF1&rSAgJMw?IV9PbiVYAE9#OK zzI2J@PvbSQaZmIk*O!dl+Hdc&8|Tya-oART`A}Fds?UI^(tAC8#u`~~T;!CQ9m{m! zzUw>sSeIY7?KZqhpOOscTzB8lqqU!Uzw;G+lw=%Q{)+i4$9(nM>u&2eZi?+`c{cXy z5$1I?<>X}1yjK?veT?9LDqd}Ra-wda_q!m^V;+x>ALUTGa=R*-gLb_SkQi;7eag z-k_%k({6a3JjI+(^V_1&-0VEMF!jaqr-kViv*x>4WGorBXOqE@r|-V6O6WF+gO*;u z{@`j~$_1l|eS9KXsqx865>>X$E?F}FW+2p*{ z;;KdQPYzX#n38>jKY0D}el-rdmu8>+VXFFknc;%+pHD~kGs=1Kpk-cHmiYF7qb;A$ z2G`!Z{J`kjHac_jbBCqD)@pupT}C>OO;?@S+@_lGRUHh3v-e)9H``zKezkQBv;VM2 zhsY7!6+I({6whkyo-lDN@+(O#89gv)$cfsq?~eX(8f~kY6!3hQ%HrY!=j~TMoT}>V zZ2lwo7T?y_S}@=)+>c)mn7ndE(f&L&lEi9XR9hp80~PvBBa7)A@(G?0;xvY$32MDE>Cb zWI}7|s9Kj|dzB@{hIX$tD%PtxQGB%-xh=Hb^R4_2lx~ zsVfUh5_h|_^xA$h%Rha$fp_cD(?9dlBl=c)`Ngctd80L1MfcwQ`S3!Z<*fR`0eEyhbMPm7zW=kj*0kON%>S~nxk$M6s^%mym&;* zmo?(AKUM0|Cfxj1<-p7vrx~<($-atkrv>I$2C1C4?v<){eqURPp1SqDX7pf|-X)c* zQ_=%$53!u-!69dd4Bdb3WbPPdq3y@p)Z~L(%WbT?%6e_<6%*3i{66wKOE%2iw2}T; zC&7Vfn%FAV(u;7$~o%~9`tQOD>KK84QpL%rti6m5pCyo z-(qaTx6LoKY`?s}k?YSX>5=x$H_7N{(zmB(uJ496x%Nm{=FZx-a_No}-`D5#NIP+P zb&_%I!U!nlGQx7EjimG~(ieCbKbYEtTF6PK^A$Cu;Z^ zpM68zdsl5UY07Zbb`({bx!U^sv<+nEI7e93RT))B_sMaJ>NCQ>+*4=M@0XV@cPTYI zbKLo})0ysPhkTwmI63UT@rAVf<({WbpRQU|vLH_HgNjqn&4(kV&s%P;_sX!yET?*t zPsU|9)oed8rOaS<(uuaT18aBP{bS^li52ZIlXXg)%;S6FZ=KN>{{>LvnBpR z9JTMpA={2kdU%8>Ug#db18JG8>F?73Zk@=oQb zJLkH+YrT5Czf8w&nrz(M>!O&XA=+8GjczgV4r`}RONz>8MNQcB)%=5&V0mHnOuy9S zYF)NTqFm#`uB#ka(r{=_LDkHik9(-6WvXp;Gk9_8#FXUqDwbWgZ_n+nu9M+uo`34z z%;cV~V>rEM44+z6S2ZQUR*m^%WtC;jmb+S+&3BDTyn8p;jd!}b;mrn(F2W&=dNvIg z)9ofT9eb!E%V<#-Jf}4leLKB$&K$k37TRgUjMv#d@)OByi46hWr;!m$*w#57=8T7WckHb)u}l6>@s3H8!cRN z=jG0f*b`Z{`d?aJ*QxmGnRHD{b$)1;?d|RL<5ZSv+0nf$xBQ2r(jt@7QE_Si`dMj4 z5wlLmc3T|^2}hsnk1v*)ul*`)S+>dCU5jeFF?RR)$~l`_3^~6i7xgG>P3mKqXUrdb5mo|Nxyfh!eE*lW2PNoydgA(V=NiMJhgo#hc|&`j z)f7Cu)yOTDX-o+$F)4qZW#ce)PvQHr>7^>h6qWFB@`1(+n=epzBvGWBJj+skF=)ZYg<|Y}gT`vZT;qP*`2htJ~(a>I!TJ52T)G+m^QT z$bo>&&(D17YqBX__BRQ}zM02-`FQWh3?IJ{yALGq_!;DT>zh-3RzCgW;PkcWE#(O_ zs^-x--Bu^u7#I}Ue*zL{x~wip7$Am}37f~H_1NH%^5v6Ww}t@=&gE)dI;klbRGydq zb<&UKEr)k)davgblIZglJ9IQ8CD45Fs+^Ep=`#$6zPTdG zFxMV_u}1q+`uDXzt8dkpw9a{7+*muWqNLvHb7s*?$LpWx-}-)Lj>D}Oi{&Z0M^x5m z`Byyjp_tvyNuqpweMDuHR(JL1@eTJ&t8$L%uGm#NB>BCH6YrIoOFs@OW~@?wSFUx> z%rbZ;|1RU+if2i~_WC|qn^W3m7NrtZe(%B(m1vD4ZTBwC`{ir)p;titAxDsA)R1;) zP3yPgUJcr%K?lBC_D$m?_c>tm_}Q(A$z{o##LZJosPj;xaORoII}23isqWnNu*{uV zs9~|?VSMWNaP^3^GW~AqT&vGs4ZD2B>$YdQBukSQAJCs4S8JH`R`r$J;uPH#xuuE8 zsh8d{vd$SMO*?ZudEV0QZ*9DGv697@_IbV%js*^?WEXCZzg@XI#vJa zRr|MlulmM6;_E$nP<@j#lF4|-Ne)W9UJ#+B*V@|8;|<$^c5JjMW!>jTDwomnko+au z2ApJX)zQd8Kj=vRpe&8xvP-{5y1z3ho7OsEn~E%_)b2Rr`ehaFDgUl^rye%EvYoUq zcZ21;IET22>X+-wPHir%+MF~a{&07bp7{$}x7|-n-Qk=p_73Q>_MDM^(1wTuD7cE& z{IE7Dr0;S^XNkJnk_E>fyl}Lp4m@7aCkjPTqkd*dUsVK|eXwqbZ73=Ie$-*-sdN6w zw~DpJTrFim_4bL>R9SXuq#0H1;_}9v32T#Pyvp@1U&Q_R{`8Ae-cu`5g4Rcl*KDzI zxz$f)?`H1;&P$W2Ot0Ukh8{7CI`H~dUGkvicJB(qb-(rcQ1!Z1y&PcP`B-i2 zvGXTKQTEYq9^24;h3&}wlO#0T;e~_V9`1YmobZiH{QG^XPs?XLiK)L&|2lilpws)y z*1x`XGim4kSwZpn8o?)*#k@7Np*pEtw(b(=+VHb@)ih@G_AOz}tF*5?ORi>|%u1YH zzxjUM%RAbb4!M(#Qtp@r90RfPdB&B@^*i_xurR2C*$M?^M<+4PE{wK=$%JhD|kO{ z=b`W(D+T9HoIh!+n(8t$ep;I`f*iLWtf`N17M{wZo=Tr#G3Mc@N840!;9EDx6PFEX zO+OC$75!w%?tHO!ye?4zQMaZxb$_tq&!r5%L*Zy)#pRpV%}psfm$Mp=M=w*eGtEzW zc`Wa(%6zLKw%1j-_s0xRd|1_I*zid`pPpKEZ{uRWaYmxobGv${3DiF|-03@Q-oQgM zO_uWpng%*)8132o?yzTacA*+SQTJrf+8+bb45o&hwMpz+lY71-H(A#B@)YIjO#aK6 zx2`9Z4fL<=`OQ7z-N3Zk(BQ{k$9A{NJ0?48Z-_=+9x=ar%?Mj{ z7madSQ<%5(#^x4J*M;3pZp@DPKH>-`;z<#7-{uxZTKVI5XQ%IrI2xPn>D@zJBzh+C z$=5Iv78Mt{bX`%|W}@vr$$n70yXdKY+P2VPL;NHv$J{oaNl4M3)8$UZlN&6ccuf4I(O6!{~Uq#iXGOX8Bt#oODV-&rZA(otUUA9S$oCfz^2t{ z*KJQG&S|JMFfvt#CQLm&G4OI$weP~=QRg&@T86uNZ@KE)HOX#x;-`>LGSy|}S&?7& zG-v;iWiR#{aqFZH-W{50&`WWXO`KmBYQHPdu?wAE?TVnb(){%6mxlCSKe_SZgwhoK z+Pm409g4EL>GL-BMze%JOk8*0rE&r*-)Ni^=uV&4yzGvQGIrnkkd-4hq7^}vecTo> zivZ4CCS~kS_p{ZV#Ov!s7eG&UeYUwpka2mT=9*sXA3sli>^{==ew_ZuGbJJKy`nu` zC`QFPg99Y$JGvS?3QVrBo!{11Pe0Anqjhtp?rqkN1kV1J@o_wF%fvIk>S`(nq#f05 zjd#-;tKz=n@%~SrGNS5&59_A|SDt!?)ME#JN!k`s(A~Mz{FH#MzTros!LA6iGa7?_ zdtFa5$_$@laFF>ZdFSisdw#j;lv%=r2CcU>=AOcYO;5)6c)PtU*Q*KIuH<_38`+32 zvs>fznkUpvx2_u44B2xs4~P8ueJ{y5F0tR8)^&pV=>yV2RE|`P zkcOPNitgX%snWS6-wSV2bPk<tFrOpt|FUtCi=VSQ@109B!>SQex=vz$ zj_@8zof&z2(Q%r7+T77C?(bdHvPOOK7~#>Bb@=hVzE~g3o33enWz_JJY^zN+9>27s zO7gbn+&9B|ZuyNFTWzG5vgUkzHNPQ4TUUJrv&j>0{*wKSuotF5m8b2#PGYFJ9S8mR{>G);oqocE^>d0;V=qtep4@Hh?tF7N zhEh@{eA_y2KC~HBmR__cq;=ldcH;p-^RmtOR z`+u9za5iy`Z97fnL#l>qoaL*MpZbx^A0uD>us7RvoV)dG#!fAR+Uj`KN^e^AE#Kr! z)X%2>!S#oC+^_zI&(it_@4U}#fQ2|eLUn%j`I~!_`n9f43XJ}I|N9HK)rnJ2&->lG z==61m?JKf>2gdORJgKjlw5aW#`ERYKS=xzH&-ne8P{LB&>LYKiEH1d#KP{qLXjp-Z zde*4BPc2Gqe~Pj|=^Fa$Oo_f z--}Fj)Apx5YUrDVPtjSs&1u6+nv-r-tEP5acSMc(Ym9Ah=-m@n?T7z%EKSyq2+urS zc)HaBZ}`V|x8|_&Xia`9<0*Mn4aJ4KepztwfS!Sv^R~h zv0?SQ>_PfzE2lmv(=fX-Nn(31BD5hXa zh9qrppEAB`Zw{}OmZ37KAzt-EjgQ8FG#{5!JMU?|RX-DWbK|q24VO5R-&8c|U56cY zQ?LcC$wlKp{HHR9li8!1A3hwMyJ5ci$KjWzU2kX`b8X7$pPorh6tQ~5o%28nvAOhM~b^%xv$$lRb%$+gC`45oy!fXn_Si1d33R!bnXmhAtlx+sweZR?hkI8 zdWc!mnDrW2*^=vrZ8fN4db{;}JkL9-#q--(rk`Nk?V>3=e`sW-PP~3-V4t)%D8VuN z(Y`f1dz>nMiR?EbQ53`Y@Zj5D+H9<;ce1v5Iwhh9TDM14zK%St+rMzl!PTPF-u-v3 zsF@n>tr2X#@4EifI&IcV0!UjBER?_I5mT=K+X;Dw~sBa1ZO94ZYCm{AkPOsLqL zJ;J+TYN-?2w=vP_)1CX>1DN}FP*O*$S7<)=PM#GZO79PbLeQVWSGnugj&RrD{Vh7x^uoS~f45$0Ydg%C;6mX>y3Eeqb$jP&Rfmk> zU%NN|rtLa0=9J^L*Y`~_?%S*GX>HU*^U!HZLeabQd=-}uBYax=*c~^qS2-4`zO2EW zKX%ixzPEETs1ruI|6XNLjP{J`qQWlr+_>^W$Y8BkrTR-RpY3yU7kATs4X)(ebea3mDXG&3Yfv$;xu21Fkl|gSbvque^da21`=I9`mXyb-y4b*_;CnAbl zRr;E!Y&eQ0=&Y_hVxm!cQ7dQUuJ|6!x2w)(zjc|;Y&q-|V34uB(Z*ziddt#DX(koJ zveSE~EmyhxWA@1G?-h0ZFV5}K_hMr31PSF+Ftd2Vq#Wi7l?1QE3C?9TGbQMgOM~F3 zcHF`gDf5wc%gh;-y$7ZZ`H?Zb^82<&4d)v(FZUigoci$4p>M(c%ygub#5MKCq01A0 ztWsYwJNj|KtRnw%%_My z@U-h?%iBRd$!=P&w&^&kVoDBGP0jBy+k1cSer9Qs*! z{Obz3!XzTryHY0MDIRDVibf%53JL}(9`OAX6a+sb)CHwc5XB8iAzccr5Hth+P$6=D z2AWEU!~a&L7`p4CerOIFjIb!@wzj1TDE2MI{Q%NObkqZ39;CLmB!zOYGD!_E_GI{Q z@edEm6+ry72#?$6BQc~pLF~Q&kKPyJsTha&QjD#pKvH{qU@g%fe&)jmi}}}t5B7z{ zWvgIB_)=FR(>39HFCrNs9pW2$`_J-!u{LDFhXqo7kPP$@!1qGX&pyId=a0o>#QCBFP_?o7QMfZC_{bcYr4@vOW5JPLo6xsu!61De# zppAhG-Gyf*{vA(|*jo!Rw1*gtf!d8#;!%N3FvsEC ziD&@GYA>4$5@KNVVLC;DZedVHL?<%a`BWIQo#h~8Tfzt?WqScL8l;mlX~+WVLwsns z-ul4D>K}`9F->PE)QpYKjR??h8q~3Uo{U2A$OhUb3b=95j#z72fL_>K0Us)qK!NcP z0thAzYqcn7FRX@BK~5}QF4wTw3`LsR2X5zY$PScKq@wqV{q+f!{5Q62}1rb z_bAXG1QXK_)11m%g zhIoo0YJVPLF%61E0xnwyk2q+EW@%}O)c+>Pus1P0A{8EU2)G;>N9@KH%RHPVJQkM# zU>TCpZ#uc!HVkbG9EQ5~V2?llEDik znTY4(LB6c@`y>I>b7P6PG6J`v+uG7l?~VkKheRxt6KIw+OVmdZm-@Q# z+Oy-W(HEiiMr(h}1WiUUM03I-@TX0%CQ-bkGB2J)DiDj{krZEyutF(VRiqv)4*>_6 zjG~#MQCKc4ugs0lk?{pWo`~hf!!n|wG`i(bY&FzI5}gv7&tbr1I89ZSGWOahlArgfGm+OAbcEQ$`Q6$!i5J>az&u2 zKoNFFjL^gqR1w0OKr=puxLv;+887fVn^2%AC&lu*VJv=PE=ARrI1Sm+^e zmx7j-po$QNIRWs6zHCf)OV9$_O50P#EDxERC*;8~24F57OR?hOh#erVa>QA{IG(5GE=tub96a!$*^1 zjY!oL2aYM4B+q~iF-8907Le21n_#k>PmDXo9C!**4TT|X3g!o)u6!^mW+9R~;=rm!U^LhwJ7yDkV)GEP(P8iG2uV2-tWg28 zg1xmPCicPx3qTAsT?vx#urUdcH40aPTv;L(f!V;mfk~9|+*uM#f7sO{5Cwa)=pk@} zsSX%lAd%vA;y|4?DS=#p6y}DnjOFYNi!9FzhA1W(qi$BBvOGP+GJHNsg~Y5<gDW#Ec|ub?vnZBt?pB4K+F;tMyn z1VG)a(RL-Cmq03D3*g16FVSuU&j#&K;;}d!o{)#PG(1xE5b%8!%eO^4mH0#_;15xW z^#V$_L%TX zqF@~$-*pKJ7wuD~KpS|-I6|?MCvz9Odt#dx)QpGrcS=;!ijNL-N|X0L$3x%+9f6C4 z&HSJe*MlvSI*Yw!TzI<66?+qdgGNJ#lz49NB$r^qq9zk~@Z9jp%c0THVI?YzOrcop zDr2)GGHkZWq3r)f<;oRcpd2MCt^nRTO5H-UM!EmZRp=a=4a)0;h^a}oI?Wd4 z{|8CJa}#?JW1a>N)|6Nh0h=urVZ!h!r`Y8*dvx?a*?8-_@_glcH;+SOp<|u0-B}`@ zP*GJjI{tqU71iaS6aNSEUxm4-K#4D8$yYrZ9~BaqfD5LWyE{yA4m)2@yATR0m@S}+HM&W1u!01bT>^j&x`l56nE44dwKtXuh8?ORQ{jy}K1#tj zM)%2NeEt%2I;tkqr7U95&_M5+j>$3>K8a|sUp*iZcW5x!f;@<6LjzqODu5CJm^})p z4SJ-65<1wTTBUS2SHLcaFN!o+HtUpOcL~o+&|YJE^q9mw-QjgQ-nukP7OE!!tZs1R zafcmGUK2KIP=F!ENan^8;EN;8l7pU*7__a7FOhc|&610rl9-#sliX)%uxdS5#)Lc? zUQNJW{EN{EjD}wRi&+sE9X0-oF$l~Gz4{lkCNKtS`WLeyFl+SsU(A-kY|xv3F*^dY zMQ{Jbz!L)_4;Gr{e=(>v4%(x4oq+O|VWIb(fbyncqYs^c^0wiikDY+>#^It*oq+Pz z;i1o+fb!Im*aQGue6P<>>D_}4N@iw8; z(GP`WPhz;!tmL+9T;V7KbyGyaHYRK`nw2%`jw9I8%VLAYfY*s(iTeIc=K09U3>wnKQ?V@r zJ6rI42sRz*k?B~c;%7x3jbVlQk$|UEzH!hP4AdV_2UFMsbC+NO2~pN)z~3B1iVYfw zr*L_E7Mzk5xVFduM{th|wkhKotS!+HJQ-U?Wn?l9QSoHHSOT`Bj1NWQd>czN3P=|!~bIVXu(DwzQWRB(;3kbgW9w=IUNp6CQ7I?*3U8lu&{FJunU=X zWXOMOi-0FDfPqH-C4gWyxfIi3;W6uo{k5FvFj+@a@Us#Oars_C7`0frR!}GUKQNs0 zu-%Rz(2&)?1o;8d3M$6<2gOPu@>(J5PEgn?37COw{(&co#cl$;O{`#xwe1v_4@@gC z3+(WEV;iIlbG3k>hlvL7400e5%$?;a#VlU}q@l4SDB=B0XCOy19W%carlTEbGmb>1 zZm{CD_nsYe0F%Uo@Vjz&Bt}Cl1x!E~Y<6Iwv&m#G&ja>jyr=EJAm@+>3^5*Ia@f%r zh)V)&%%y|(ksa9DyuS^Fw*@qzzzt68(C7Hiq`G`1BFm=(Q7+X9F9+-r@THLh%^sT7 zRS{|5D(qqS3l#xu5@Ky_4+F$a5ojM9_AuZ@7|_w#=+&;B6wWA^=L!=74mBiG1lkRL zJ`@|!0l=#LHy0gE=>TF?{R>*5Kt&K!m{^;M5*a8+5ysS3gsoAqBK+6Lcxs#lLVQ2u!#*5FLR_BI6+59zrD6%bx$?Oz z6i(up9gLaDP!G&6iXun|vkOUxh9XG_Ml&GrtEh-kB5Vv}BdlFt8x%{zm>&k03Mb#V_GEYL7iaM#5^!U&ykOF> z*z&xv(#5xv!0|2yd)(9AT`ci{0(d?gp1a&-z_$b=WiHA5`+KjHNOY7ylHA~wDFHu7 zM>$q#9!c?p%|e;LK=Vlg{30@NFmh%1uhQx$$QmV*Ja_CcAr@h(p!( z)@W(x3_^enTBZamj4*~RTCRkG=kae3G3?L^CD=p!ca$*f(Ml49vm|DiVV(%g0fHB9 zXNlI341BM~_Dlk!p|vE&!aOl>jKVH70?xg4d z)6s4c#!nZR93I!h*PU2x>=|e;$?z1piogR$qSh#jL?s^l4#I8FJ`%*OS%uo!+oJs> z+P)lcJS7sIh(oNO_IBvtzZC48k9k?~2DG*m!5F)J55fUZK;lOn) z%)Gxs80e@14I4LL)5&miijZTCjwulS>I?QAnCbW;NAPUW@y>WcmZym0+#-MAkgEN3MbWRzBjI#EFDlq7%RGEQgSEN{>^U4&d2kdiBGP#upVi@Rx zGDpI~euF1*vrcGZjmnfsY+u|#01|9axiaYax01H#qB5vBuP~?1C1rx*+@yiS__8v= z$rE=`LfI^IMHy_LvNReST~!9}Y2Yon{|}5^?y)>zT6eI`Xy84mR^Z|R4Kl)1z-57j z@Q}pitqzM89LPn4JC;wgqoGG62h2N|P%s#!_)<-?qoZ09mCrZagrI?uP}dF-rYNj& ziiI=K<8~bOx4#P+aoa}dXN~GRqY!HtL9sy%Bt^dH{&fn2`nKo^iIb%$QtZ&v&M2@v z!NG($4bbfD(X-A-_yt8rCJR09j7j=JKr1$SL2{gU;9pTR)rp#M&`Xj7ZuQPMT+~Q% z#OPm7>F+riBW|AT= z2xmya(@s$6=$!%u+uB6!t3S&UeNe){Q0GbTa1B0ZQvRQQWNr`|B z#=k29%L;u~!m(`?Y*b%-rzeCkP>T{tz9MjWA^{#A0;*V}FG{5L25Gm=X)GJ`Rf$7f zdC7>i6gL8CEL+s7#DZ%Oa*1Nup>Ik!RwpTshk1KJ6MOVs33rBmmkDrdoW^3IA4;$k zaKhsVx!LHa5)Ava>tC3IeksA&0{VCTgcb6)63!Fz3B7pe4+*g(uq^%UXEsD{s{Gx7 zaZItF*)&8^g0b~eED{pS4V#WslyDebV*cNjXImjvB?7*(k`fq5O^E=F+U~jK)7aKX z{a>5|P9FSJLSx$?jel_|+-SRDks2Vt7HPH< z#MzQOxpz+Pg5}d;mG42K@&GCr@3_|xU>fR4!XTRi*Odw|9qEuT<_A;2tWd9Z%v~m( zAZ%al@g*3m0v(q8ejO=<6AW8}z>@dI23dQ9(qRYa-;vC7bBE{(j#%jF2BC0-ZwG{0 zp#dFvd;w1g!x?WnnVSIIbFhOE3NVmRe|8x{a-YO@znNLFe(1QAd`1;B;j1k#R>BR257-7K|GCLQRLQWOzpov@e8VV3uGf z>e<7ULPt8@JYIC@wh5kaX-ssSJ=`sHq(RB;CgLD^J69?rsw79a$hsYIhv5Q-v&ab?{%|sb?gMAx#P&ERJ{`6X zhmKq>1i-Oj`NkE3?PF|5Sne0YYAKJ603meb*pUUj1xqZ<5W?9=hh2o-kpX)IRtg>= zj4hFD2I6#N5bK?%sDnS24%-R0ohOw!dw7sBDSSGYh6G9=wl>Ipi*zm>xhTQd{*MiO z9)5uW60DG`5(NxW=Z=$u%RoXU5=>h*gmV*KI6BuFxhWAk4hyag5-Abn2Z6um5<1rw ziIq5*5P=&k$>6tZpDJ8CF>YD#OAOfXP4;{}+=^Fs+f_|6*DZOdI6?znBbyX^STP zFD4es0D9V?$^VOq#Weua9?AZjDW91<77A!5!Nx;$1{T1NLdj&p0}QDU5KE@AvAq!v zNHi=MmQ2Q-P?$#xcd}vE!r{swPQg4);LpQuhG+akfVn6~t4OJyCu)2TTTvX-|ZEdVv(PKp@!~#gc`3 zu-Mp^h`l}_P)iioj&iZ9am+Ew6*?g+OIs*<1&QJHY)9y5r6PjgH(=g9{Kgi`YK2yj z1mfadeqhE>23kX+M2FxPtQcmE)+%7~TXzhwL8&BwJ9^s#LNL@8rI9FhLx6je@oLzi zbtHt@*F3_99KGKd-w|K$rN6#_OgNEA0BiPt7L z$Us}#LF^?99wdRsNLX3g+uEY-B zh=V_=aTVbT!mY_ZCBT~yW`p)C0Ss>zUSn`~93Ua=j`%MEPIW~DZtAd55Sa*90$lDn zouZhA;B3$B6a;Nxov=iCouMEXKpM*L40QIwQ93%(8A`~tLPt9Tu~q}Y40Nnh6bG%* z@lHWPunjuV8H$GvVWMqOL1#E@7aq8DJ5;EQi{XC;`kUV#6?cZW=Lb*osm^esO~BQB zS{ZeNO$sX+oXlt1F*Y2TV4P!Nip13v)=>;}j>J1`uJ+b=Puidh?F0xdCZZ~3c&s}P zgL}9g7C;<5L`ZUpBA|3SOwcPGQ6fkZgBa*)I|T2eV0vORAKOGM(XEaEwx~-ngobW+ zM5G?R*xesMbaY1vf{+Cqu|kz3A_eEUD-R2VfjkU!mqg&S!IQvRhQBkjM)ycW%EAm1 zFgLI~HmHh3z<>kGnGKO|t_W@eEK!Xz=IxBRd;z1O2g(?B5&?vc9x5YF5+2xDfLWnO z$`~7e3Wo*R)+$53Jh(UU#`0OCI%N>nI54SL7;1waE2A7=xc&mj7S$_5P7+ur0J1|3 z$`HIouoC~J_qLwg#pLT|}*A#~Ev(9jNZDABYSBCMzu^k3e9Kt|eC=;;K z$y&oT$;-|d@|r^|P@@t|j7RKtbH<2Kg1Ghln(t(EFDgXkG z2X-|E>2%agrpq@-NVY=n$YdgB6jB-JeS0bvg(h~#Vhu1q33&Fc=yYpa^raIV_xWJ3 z9s1e{>@HUZW7wnCb_Teb+6$21-Gbr5=Rrk&lN4gaW3e>YLoFOgPHEL5P!J8t?&T=9SVmug?5CV!lPQoJbiE@C_ezf7i(4;8i*yTPEg$6~~A(hT> zQh+^DRVLt34DvuW5Wzxf$_#->iNi+f${d107Q{gs%9M67B#DbOl}YlF@OPL*+wxEs zWm3B&;%ys2WAm!Mh z-XsfdWIW-{oKV9a^&t_q7>_7}c4VQxWU>Gpa>Qi=4=yToNdV(3f*hnrg2Zk@>cB<) zND#Y}gBN$$E(KS-?Y>(cjfeXG7l~L5u$c()ZUg>{)jsDj9$bj(lRP;B=DPgeiU-G$ zfgN!;s=!ejkLSRf2W~X@62j7W;S1xW!MWZWs* zQ3e+c|A$5F2klRg_z-7|Mvx?8%HuYV40|&HI1QO}j^q9b9vq)cNgS+6HXg2z=Y{Y% zb0rMh0Kj4;VyF2$2$LJt&VbklV%y-bAjpn*GsNeChu*SN1{P?6mtx02w0{`b0Tv7P zB^cI-{tpB5iId(-9(d!eNDlb<2;V**{6ARi8{C%QSBgBi6SPs}Vg4FEW)oqJ1vi4W z9YApG@QH{M0;eN8MVt#y4Y4>7w(mrq1iv8T!JVMJA_WXdF`t;Nh68!A%LBKtvmyzr40tf{*2R?pudqOofL$)*ZHEUUlkE$>VHaf{ z2qL=~oWib(1o{0j$oqfAoy%_1Koo`t+C`rM390O0K_M+vg&lTWsMH(uE_qY6Bt#Ti zl2%Y5AvWxI09HH+F92e}JFqExmPqCMXY9;L>qMeikjhay{ypb-ZcfgOKWp(-Xo11v zw41LG^3#23cClE=k}=`9P$80Mes;!BHfPCQ0yP zZObiNH8WD2YIn`?1I?3^D}b^jagPUx!zrikiPbD-S-o`ftnIp6vC?4M*DVDZMyw=r zt5(BOivj-4y0rmf?;q2)>sC|x)>FZ0&23mwQNii_+;YPG6m?TC>7?7NklIUpI_0*k zq==oy2A2}JwgQdn3UaFnFw;mVEx1n9+R9eAmo0syFE72$6SB6l;%+d-@L9&suN9BO zV0M*&^@y-2+&Xs6bsr2ZN{T0}Y#+25+b>#s$AD@sD=q8^a`&^#0~>`w)yuy5>Pa_Z zX_f4o)8aKcmcew&`*4E#rC0Hhau+y7`w)ZLFoT}LDSC$8XesrU0t={#M$D-3F5yR{ zqw8>&W*{%!z@r6-528lxyAE5!9kPF&v<~@;btHb-A)j|i+vmR;EV2n04mqlncQJwX zu+Siv9E})AqB)5!rM(So1&@dGbHnGoix02yZ5(_`3(FmBFsF!Dxu;KA+edhnqn1zq z(*x0@+Wd9cc8092e=mg&twV$-5v|J7*oLFkqGr@GL@qlnys}T+9vus1mQ%`VL!qS| zP?k+vTU7oUiAqbOo4`iUKBqJE_LFbt`iVL-Q_J&ftdbBjHC)~gecpFN z*svd>YB&>19&N?C=ZMcb8Hu#38c0E%AAuC$PkxG6D`GRn9|IUrdld{R=vn+IEP|Gk zYq@EPlT+|0T57)EP5ZYQ*>I$PwLUGgo>84e+oF!zOR zm1eTZ`yBM86mruVM~amgxrC7?*&zMTz+<8>$o#8`=}&C^?QkLDWf_j2uh4@?j{Q`0 z$zF|~QF3zCYR*5SM10JTw;~VH=VADm;!VD1X`IgZqP$6+@i?9SqC7~kAX$+>c~`R_ l#i;uM4l>qd$*7CGNL|anzqOk3S{^kT$9})FnsOYAn!hKV9>4$q literal 0 HcmV?d00001 diff --git a/BranchTrace-x64plugin/BranchTrace-x64plugin.cpp b/BranchTrace-x64plugin/BranchTrace-x64plugin.cpp new file mode 100644 index 0000000..53738bd --- /dev/null +++ b/BranchTrace-x64plugin/BranchTrace-x64plugin.cpp @@ -0,0 +1,68 @@ +// BranchTrace-x64plugin.cpp : Defines the initialization routines for the DLL. +// + +#include "pch.h" +#include "framework.h" +#include "BranchTrace-x64plugin.h" +#include "plugin.h" +#include "ThreadTraceDialog.h" + +#ifdef _DEBUG +#define new DEBUG_NEW +#endif + +// +//TODO: If this DLL is dynamically linked against the MFC DLLs, +// any functions exported from this DLL which call into +// MFC must have the AFX_MANAGE_STATE macro added at the +// very beginning of the function. +// +// For example: +// +// extern "C" BOOL PASCAL EXPORT ExportedFunction() +// { +// AFX_MANAGE_STATE(AfxGetStaticModuleState()); +// // normal function body here +// } +// +// It is very important that this macro appear in each +// function, prior to any calls into MFC. This means that +// it must appear as the first statement within the +// function, even before any object variable declarations +// as their constructors may generate calls into the MFC +// DLL. +// +// Please see MFC Technical Notes 33 and 58 for additional +// details. +// + +// CBranchTracex64pluginApp + +BEGIN_MESSAGE_MAP(CBranchTracex64pluginApp, CWinApp) +END_MESSAGE_MAP() + + +// CBranchTracex64pluginApp construction + +CBranchTracex64pluginApp::CBranchTracex64pluginApp() +{ + // TODO: add construction code here, + // Place all significant initialization in InitInstance +} + + +// The one and only CBranchTracex64pluginApp object + +CBranchTracex64pluginApp theApp; + + +// CBranchTracex64pluginApp initialization + +HMODULE g_hModule; +BOOL CBranchTracex64pluginApp::InitInstance() +{ + CWinApp::InitInstance(); + g_hModule =this->m_hInstance; + + return TRUE; +} diff --git a/BranchTrace-x64plugin/BranchTrace-x64plugin.h b/BranchTrace-x64plugin/BranchTrace-x64plugin.h new file mode 100644 index 0000000..77df12d --- /dev/null +++ b/BranchTrace-x64plugin/BranchTrace-x64plugin.h @@ -0,0 +1,27 @@ +// BranchTrace-x64plugin.h : main header file for the BranchTrace-x64plugin DLL +// + +#pragma once + +#ifndef __AFXWIN_H__ + #error "include 'pch.h' before including this file for PCH" +#endif + +#include "resource.h" // main symbols + + +// CBranchTracex64pluginApp +// See BranchTrace-x64plugin.cpp for the implementation of this class +// + +class CBranchTracex64pluginApp : public CWinApp +{ +public: + CBranchTracex64pluginApp(); + +// Overrides +public: + virtual BOOL InitInstance(); + + DECLARE_MESSAGE_MAP() +}; diff --git a/BranchTrace-x64plugin/BranchTrace-x64plugin.rc b/BranchTrace-x64plugin/BranchTrace-x64plugin.rc new file mode 100644 index 0000000000000000000000000000000000000000..6f666681b0463da2d38f87e0427ce9b5e26de55c GIT binary patch literal 9968 zcmd^FZBH9V5Z=#~`X8?53sEW9kT#^MD&ZHvD#i$(Nsy2%gfX#14YEy?O8M<=pJ&Fy z-ud>dvqLIJm37|p?(FRB%rmpIyZ-0z9k=5m*K$L5l&J?-72H+t59NX4`%5zQZUxQf{Djgw}gd_l35U z>A&qhxROw_=Z4S?q#t=7xHH#rvFp0JYr3}UxpUV*Z5{8Y?!;Z9ri1U6tD@!v?>0VV zSig@+XJzD$pqF_a51^$7_b28*g?6Zi7_)wl?aB@EXI`X1NWSLmyTfQY?>2$gLm*%Mz5|qYgIc;d*uXAB(n0*jw2W zNgs~jvF81!@O*lidRQ!WK1U5BYBDNx7HD-bZ)OjSDlf+|2CoCe9ImS`D=Q;v8@eFh zSaP7^QZGW(*N?#T*e)V)o)i{geN=uc@wbxOBkXmW6J4QK6<&4?f4aeX70Wxb)}N4z z{Ni5AYW0MyhQ6?k)*D2T5%3jIXe<* z7&jPin5o}L4*4kZGonn9QRV49nZf1J)aPpHtK465v?RT9;0TP|)J6>>CuvLQ=TX2Mj1iYnRx#;kurD(%A(m36 z4tm`}+dOfoW z3ukK9p>yB-1wEntd!U21{c-pJgI%F1)m)p3A+7r59D_ED4;<4-?S+_o|j?E`(u zd3ogdxBp*8Vf&n<^?ShG0pd5$JYvzAp`ZF&4p}_+({q%?BZN^_meIX^)Svt=)o?}m zUh-sUy<-ryz-PUsRGTy;N94)e1gk}a)3GjU{4Paz4?N?ati?$kvBrHO^_$%jT1`*Z zts{xgTrU~%=1=O#$y4;eRqqJC4a=F7yrJQl`vf-Qe$?t&@?nTG;yIG#{E$2cm(OVhIDW$!d&zDm@z z-LLrd+Z=6#9!mXtjy&NJO)GVble~je4+)QKee|{<+iNum(!OaUSFj^4&z{OsGozgu zi^rmw`;0c1In(L`IrmGAeu9zjV3B*V(<7`&9NuBwn1WB%o}1X~@pfmCUANKB97K0} zp5FwudRE8T^7NVK2w_x)QP7@AM^B;5W?{pWN&Iznb_OXPAo~+^G0oU3js7(4s_0L1 zSsj5st26y(YtoVF0(u@l>v@%!l#U#_mmR@}@47m&t|JJL{tc?9p{~(Y-YDf%HEB)_Zo8j + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + 16.0 + {DB6AC0A0-15F8-46A2-B4F5-27F4181EE447} + MFCDLLProj + BranchTracex64plugin + 10.0 + BranchTrace-x64plugin-mfc + + + + DynamicLibrary + true + v142 + MultiByte + Dynamic + + + DynamicLibrary + false + v142 + true + MultiByte + Dynamic + + + DynamicLibrary + true + v142 + MultiByte + Dynamic + + + DynamicLibrary + false + v142 + true + MultiByte + Dynamic + + + + + + + + + + + + + + + + + + + + + false + .dp$(PlatformArchitecture) + ..\..\..\x64dbg_plugins\x64dbg\x$(PlatformArchitecture)\plugins + + + true + ..\..\..\x64dbg_plugins\x64dbg\x$(PlatformArchitecture)\plugins + .dp$(PlatformArchitecture) + + + true + ..\..\..\x64dbg_plugins\x64dbg\x$(PlatformArchitecture)\plugins + .dp$(PlatformArchitecture) + + + false + ..\..\..\x64dbg_plugins\x64dbg\x$(PlatformArchitecture)\plugins + .dp$(PlatformArchitecture) + + + + NotUsing + Level3 + true + true + true + _WINDOWS;NDEBUG;_USRDLL;%(PreprocessorDefinitions) + pch.h + + + Windows + true + true + + + + + false + NDEBUG;%(PreprocessorDefinitions) + + + 0x0409 + NDEBUG;%(PreprocessorDefinitions) + $(IntDir);%(AdditionalIncludeDirectories) + + + + + NotUsing + Level3 + true + WIN32;_WINDOWS;_DEBUG;_USRDLL;%(PreprocessorDefinitions) + pch.h + MultiThreadedDebugDLL + Default + EditAndContinue + + + Windows + + + false + + + false + _DEBUG;%(PreprocessorDefinitions) + + + 0x0409 + _DEBUG;%(PreprocessorDefinitions) + $(IntDir);%(AdditionalIncludeDirectories) + + + + + NotUsing + Level3 + true + _WINDOWS;_DEBUG;_USRDLL;%(PreprocessorDefinitions) + pch.h + MultiThreadedDebugDLL + Default + EditAndContinue + + + Windows + + + false + + + false + _DEBUG;%(PreprocessorDefinitions) + + + 0x0409 + _DEBUG;%(PreprocessorDefinitions) + $(IntDir);%(AdditionalIncludeDirectories) + + + + + NotUsing + Level3 + true + true + true + WIN32;_WINDOWS;NDEBUG;_USRDLL;%(PreprocessorDefinitions) + pch.h + + + Windows + true + true + + + + + false + NDEBUG;%(PreprocessorDefinitions) + + + 0x0409 + NDEBUG;%(PreprocessorDefinitions) + $(IntDir);%(AdditionalIncludeDirectories) + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/BranchTrace-x64plugin/BranchTrace-x64plugin.vcxproj.filters b/BranchTrace-x64plugin/BranchTrace-x64plugin.vcxproj.filters new file mode 100644 index 0000000..a5fc392 --- /dev/null +++ b/BranchTrace-x64plugin/BranchTrace-x64plugin.vcxproj.filters @@ -0,0 +1,161 @@ + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;c++;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + {5c791c3b-b861-42ea-b0ec-3ab5ca302fe4} + + + {c829ae2a-30e2-4106-be41-66a306087b66} + + + + + Resource Files + + + + + Resource Files + + + mfc + + + mfc + + + mfc + + + mfc + + + Source Files + + + Source Files\pluginsdk + + + Source Files\pluginsdk + + + Source Files\pluginsdk + + + Source Files\pluginsdk + + + Source Files\pluginsdk + + + Source Files\pluginsdk + + + Source Files\pluginsdk + + + Source Files\pluginsdk + + + Source Files\pluginsdk + + + Source Files\pluginsdk + + + Source Files\pluginsdk + + + Source Files\pluginsdk + + + Source Files\pluginsdk + + + Source Files\pluginsdk + + + Source Files\pluginsdk + + + Source Files\pluginsdk + + + Source Files\pluginsdk + + + Source Files\pluginsdk + + + Source Files\pluginsdk + + + Source Files\pluginsdk + + + Source Files\pluginsdk + + + Source Files\pluginsdk + + + Source Files\pluginsdk + + + Source Files + + + Source Files + + + + + Resource Files + + + + + mfc + + + Source Files + + + Source Files + + + + + Source Files\pluginsdk + + + Source Files\pluginsdk + + + Source Files\pluginsdk + + + Source Files\pluginsdk + + + + + Resource Files + + + Resource Files + + + \ No newline at end of file diff --git a/BranchTrace-x64plugin/BranchTrace-x64plugin.vcxproj.user b/BranchTrace-x64plugin/BranchTrace-x64plugin.vcxproj.user new file mode 100644 index 0000000..a184711 --- /dev/null +++ b/BranchTrace-x64plugin/BranchTrace-x64plugin.vcxproj.user @@ -0,0 +1,22 @@ + + + + E:\Projects\x64dbg_plugins\x64dbg\x$(PlatformArchitecture)\x$(PlatformArchitecture)dbg.exe + WindowsLocalDebugger + + + E:\Projects\x64dbg_plugins\x64dbg\x$(PlatformArchitecture)\x$(PlatformArchitecture)dbg.exe + WindowsLocalDebugger + + + E:\Projects\x64dbg_plugins\x64dbg\x$(PlatformArchitecture)\x$(PlatformArchitecture)dbg.exe + WindowsLocalDebugger + + + E:\Projects\x64dbg_plugins\x64dbg\x$(PlatformArchitecture)\x$(PlatformArchitecture)dbg.exe + WindowsLocalDebugger + + + BranchTrace-x64plugin.rc + + \ No newline at end of file diff --git a/BranchTrace-x64plugin/ThreadTraceDialog.cpp b/BranchTrace-x64plugin/ThreadTraceDialog.cpp new file mode 100644 index 0000000..e0f507a --- /dev/null +++ b/BranchTrace-x64plugin/ThreadTraceDialog.cpp @@ -0,0 +1,66 @@ +// ThreadTraceDialog.cpp : implementation file +// + +#include "pch.h" +#include "BranchTrace-x64plugin.h" +#include "ThreadTraceDialog.h" +#include "afxdialogex.h" +#include "pluginsdk/bridgemain.h" +#include "pluginsdk/_plugins.h" + + +// ThreadTraceDialog dialog + +IMPLEMENT_DYNAMIC(CThreadTraceDialog, CDialog) + +CThreadTraceDialog::CThreadTraceDialog(CWnd* pParent /*=nullptr*/) + : CDialog(IDD_DIALOG_THREAD_TRACE, pParent) +{ + +} + +CThreadTraceDialog::~CThreadTraceDialog() +{ +} + +void CThreadTraceDialog::DoDataExchange(CDataExchange* pDX) +{ + CDialog::DoDataExchange(pDX); + DDX_Control(pDX, IDC_COMBO_THREAD, threadCombo); +} + + +BEGIN_MESSAGE_MAP(CThreadTraceDialog, CDialog) + ON_CBN_DROPDOWN(IDC_COMBO_THREAD, &CThreadTraceDialog::OnCbnDropdownComboThread) +END_MESSAGE_MAP() + + +// ThreadTraceDialog message handlers + + +void CThreadTraceDialog::OnCbnDropdownComboThread() +{ + // TODO: Add your control notification handler code here + THREADLIST threadList; + DbgGetThreadList(&threadList); + + threadCombo.ResetContent(); + + for (size_t i = 0; i < threadList.count; i++) + { + THREADALLINFO* thread = &threadList.list[i]; + + bool isMainThread = thread->BasicInfo.ThreadNumber == 0; + bool isCurrentThead = i == threadList.CurrentThread; + + CString str; + str.Format("[%d] thread-%x %s %s", i, thread->BasicInfo.ThreadId, isMainThread ? "[main]" : "", isCurrentThead ? "[current]" : ""); + threadCombo.InsertString(i, str); + threadCombo.SetItemData(i, thread->BasicInfo.ThreadId); + + if (isMainThread) { + threadCombo.SetCurSel(i); + } + + } +} diff --git a/BranchTrace-x64plugin/ThreadTraceDialog.h b/BranchTrace-x64plugin/ThreadTraceDialog.h new file mode 100644 index 0000000..771c962 --- /dev/null +++ b/BranchTrace-x64plugin/ThreadTraceDialog.h @@ -0,0 +1,26 @@ +#pragma once + + +// ThreadTraceDialog dialog + +class CThreadTraceDialog : public CDialog +{ + DECLARE_DYNAMIC(CThreadTraceDialog) + +public: + CThreadTraceDialog(CWnd* pParent = nullptr); // standard constructor + virtual ~CThreadTraceDialog(); + +// Dialog Data +#ifdef AFX_DESIGN_TIME + enum { IDD = IDD_DIALOG_THREAD_TRACE }; +#endif + +protected: + virtual void DoDataExchange(CDataExchange* pDX); // DDX/DDV support + + DECLARE_MESSAGE_MAP() +public: + CComboBox threadCombo; + afx_msg void OnCbnDropdownComboThread(); +}; diff --git a/BranchTrace-x64plugin/framework.h b/BranchTrace-x64plugin/framework.h new file mode 100644 index 0000000..5175c5a --- /dev/null +++ b/BranchTrace-x64plugin/framework.h @@ -0,0 +1,35 @@ +#pragma once + +#ifndef VC_EXTRALEAN +#define VC_EXTRALEAN // Exclude rarely-used stuff from Windows headers +#endif + +#include "targetver.h" + +#define _ATL_CSTRING_EXPLICIT_CONSTRUCTORS // some CString constructors will be explicit + +#include // MFC core and standard components +#include // MFC extensions + +#ifndef _AFX_NO_OLE_SUPPORT +#include // MFC OLE classes +#include // MFC OLE dialog classes +#include // MFC Automation classes +#endif // _AFX_NO_OLE_SUPPORT + +#ifndef _AFX_NO_DB_SUPPORT +#include // MFC ODBC database classes +#endif // _AFX_NO_DB_SUPPORT + +#ifndef _AFX_NO_DAO_SUPPORT +#include // MFC DAO database classes +#endif // _AFX_NO_DAO_SUPPORT + +#ifndef _AFX_NO_OLE_SUPPORT +#include // MFC support for Internet Explorer 4 Common Controls +#endif +#ifndef _AFX_NO_AFXCMN_SUPPORT +#include // MFC support for Windows Common Controls +#endif // _AFX_NO_AFXCMN_SUPPORT + + diff --git a/BranchTrace-x64plugin/pch.h b/BranchTrace-x64plugin/pch.h new file mode 100644 index 0000000..885d5d6 --- /dev/null +++ b/BranchTrace-x64plugin/pch.h @@ -0,0 +1,13 @@ +// pch.h: This is a precompiled header file. +// Files listed below are compiled only once, improving build performance for future builds. +// This also affects IntelliSense performance, including code completion and many code browsing features. +// However, files listed here are ALL re-compiled if any one of them is updated between builds. +// Do not add files here that you will be updating frequently as this negates the performance advantage. + +#ifndef PCH_H +#define PCH_H + +// add headers that you want to pre-compile here +#include "framework.h" + +#endif //PCH_H diff --git a/BranchTrace-x64plugin/plugin.cpp b/BranchTrace-x64plugin/plugin.cpp new file mode 100644 index 0000000..a981e5a --- /dev/null +++ b/BranchTrace-x64plugin/plugin.cpp @@ -0,0 +1,96 @@ +#include "pch.h" +#include "plugin.h" +#include "Resource.h" +#include "plugin_global.h" + +//#include "resource.h" +//#include "plugin_global.h" + +int hMenu; +int hMenuDump; +int pluginHandle; +HWND g_hwndX64Dbg; + +//HANDLE hBatchCommandThread; +//BatchCommandDlg* dlg; + +void MenuOffsetSearch(); +void ShowDialogThreadTrace(); + + +///*²å¼þ³õʼ»¯Ê±±»µ÷ÓÃ*/ +DLL_EXPORT bool pluginit(PLUG_INITSTRUCT* initStruct) +{ + pluginHandle = initStruct->pluginHandle; + initStruct->sdkVersion = PLUG_SDKVERSION; + initStruct->pluginVersion = PLUGIN_VERSION; + strcpy_s(initStruct->pluginName, PLUGIN_NAME); + _plugin_registercommand(pluginHandle, PLUGIN_NAME, NULL, false); + + //_plugin_registercallback(pluginHandle, CB_INITDEBUG, OnInitDebug); + //_plugin_registercallback(pluginHandle, CB_BREAKPOINT, OnBreakPoint); + + return true; +} + +/* ²å¼þ³õʼ»¯³É¹¦ºó¸Ãº¯Êý»á±»µ÷Óà */ +DLL_EXPORT void plugsetup(PLUG_SETUPSTRUCT* setupStruct) +{ + g_hwndX64Dbg = setupStruct->hwndDlg; + hMenu = setupStruct->hMenu; + hMenuDump = setupStruct->hMenuDump; + bool result = true; + + + // ×¢²á²Ëµ¥À¸ + _plugin_menuaddentry(hMenu, MENU_THREAD_TRACE, "Thread Trace"); + //_plugin_menuaddentry(hMenu, MENU_POINTER_SCANNER, "Pointer Scanner"); + + // ÉèÖÃͼ±ê + ICONDATA icon; + HRSRC hResPng; + HGLOBAL hResLoad; + + // ÉèÖÃÒ»¼¶Ö÷²Ëµ¥Í¼±ê + hResPng = FindResource(g_hModule, MAKEINTRESOURCE(IDB_PNG_TRACE), TEXT("PNG")); + hResLoad = LoadResource(g_hModule, hResPng); + icon.data = LockResource(hResLoad); + icon.size = SizeofResource(g_hModule, hResPng); + _plugin_menuseticon(hMenu, (const ICONDATA*)&icon); + + // ÉèÖöþ¼¶²Ëµ¥Í¼±ê + hResPng = FindResource(g_hModule, MAKEINTRESOURCE(IDB_PNG_THREAD), TEXT("PNG")); + hResLoad = LoadResource(g_hModule, hResPng); + icon.data = LockResource(hResLoad); + icon.size = SizeofResource(g_hModule, hResPng); + _plugin_menuentryseticon(pluginHandle, MENU_THREAD_TRACE, &icon); + +} + +/* ²å¼þ±»Ð¶Ôغó¸Ãº¯Êý»á±»µ÷Óà */ +DLL_EXPORT bool plugstop() +{ + _plugin_menuentryremove(pluginHandle, MENU_THREAD_TRACE); + return true; +} + + +/* ²Ëµ¥±»µã»÷ºó¸Ãº¯Êý»á±»µ÷Óà */ +DLL_EXPORT void CBMENUENTRY(CBTYPE cbType, PLUG_CB_MENUENTRY* info) +{ + switch (info->hEntry) + { + case MENU_THREAD_TRACE: + { + ShowDialogThreadTrace(); + break; + } + default: + break; + } +} + +void ShowDialogThreadTrace() +{ + PluginGlobal::GetInstance()->ShowDlgThreadTrace(); +} diff --git a/BranchTrace-x64plugin/plugin.h b/BranchTrace-x64plugin/plugin.h new file mode 100644 index 0000000..ef7eba0 --- /dev/null +++ b/BranchTrace-x64plugin/plugin.h @@ -0,0 +1,38 @@ +#pragma once + +#include +#include "pluginsdk/_plugins.h" +#include "pluginsdk/bridgemain.h" + + +#define PLUGIN_NAME "Branch Trace" +#define PLUGIN_VERSION 1 + +#ifndef DLL_EXPORT +#define DLL_EXPORT __declspec(dllexport) +#endif //DLL_EXPORT + + +enum PLUGIN_MENUS +{ + MENU_THREAD_TRACE +}; + +EXTERN_C_START + +/* ²å¼þ³õʼ»¯³É¹¦ºó¸Ãº¯Êý»á±»µ÷Óà */ +DLL_EXPORT void plugsetup(PLUG_SETUPSTRUCT* setupStruct); +/* ²å¼þ±»Ð¶Ôغó¸Ãº¯Êý»á±»µ÷Óà */ +DLL_EXPORT bool plugstop(); +/* ²Ëµ¥±»µã»÷ºó¸Ãº¯Êý»á±»µ÷Óà */ +DLL_EXPORT void CBMENUENTRY(CBTYPE cbType, PLUG_CB_MENUENTRY* info); +/*²å¼þ³õʼ»¯Ê±±»µ÷ÓÃ*/ +DLL_EXPORT bool pluginit(PLUG_INITSTRUCT* setupStruct); + +EXTERN_C_END + +extern HMODULE g_hModule; +extern HWND g_hwndX64Dbg; + + + diff --git a/BranchTrace-x64plugin/plugin_global.h b/BranchTrace-x64plugin/plugin_global.h new file mode 100644 index 0000000..d328dc7 --- /dev/null +++ b/BranchTrace-x64plugin/plugin_global.h @@ -0,0 +1,45 @@ +#pragma once +#include "pch.h" +#include "ThreadTraceDialog.h" + +class PluginGlobal { + +public: + CThreadTraceDialog* threadTraceDialog; + +private: + PluginGlobal() :threadTraceDialog(NULL) { + AFX_MANAGE_STATE(AfxGetStaticModuleState()); + threadTraceDialog = new CThreadTraceDialog(); + }; + +public: + ~PluginGlobal() { + CloseAll(); + } + +public: + static PluginGlobal* GetInstance() { + static PluginGlobal pluginGlobal; + return &pluginGlobal; + } + + void ShowDlgThreadTrace() { + auto showdlg = [](LPVOID data) -> DWORD { + AFX_MANAGE_STATE(AfxGetStaticModuleState()); + PluginGlobal* pluginglobal = (PluginGlobal*)data; + pluginglobal->threadTraceDialog->DoModal(); + return 0; + }; + + AFX_MANAGE_STATE(AfxGetStaticModuleState()); + HANDLE thread = CreateThread(NULL, 0, showdlg, this, 0, NULL); + if (thread != NULL) { + CloseHandle(thread); + } + }; + + void CloseAll() { + SendMessage(threadTraceDialog->m_hWnd, WM_CLOSE, 0, 0); + } +}; diff --git a/BranchTrace-x64plugin/res/BranchTrace-x64plugin.rc2 b/BranchTrace-x64plugin/res/BranchTrace-x64plugin.rc2 new file mode 100644 index 0000000000000000000000000000000000000000..0341d2a382b3c3c733c42feb16500d61acf16f50 GIT binary patch literal 826 zcmdUtPfr3d5XFCI6Td?fj|Mg|hP(d`geXSPt67!;o4{fgO!UhG?{!5JN@j-`6-k9^wlv0Q`Puy@JPD`T}YQ<97T3q{q zd*KT0mnk!0t=NlVE1`0o6vRK51;)ZOoJyW?QL!?4UVVC@-JH*Ft=8;uru;M%6l)k!Ct6o6##)tHQxLz@4N+dR|E(ow^pzh;$Kmzu@2pZy uR_V7sMCrapxctugYeI3$G1?F8*EaI+Q*Z#R?0BRj;?Nqsan^CR zP>r#g5S>&Qzq4CmNk_Ce7yQ1$MbaR07AVYoAGkwoC8is%-W5Yd0P_akjh#7F;0Q=g z)?}**wi+h=axyIOh9}gA)XIMvswuZ+Nzb)5evzH2M>HosDd2w?{N*BH1+rlHBn}x} z(t;-@cC5*hn=caXHC7NKp0TbdSmvq|jX@D}Z~INK=OI~1adOqp-0+1_s{Kzl(@5|o zQKo3D{|B%JGECP;Ro)4>WZDm1Q@MSv#-S2CaV?{?|E45%WWJP8!mZXGa{V^(G;#H& zK!FzzC;P;nhGSF;tYLjZ+z(S`NVRW=X+HYM5oSg`Ges@tQaW90Y{~5{D*{FFf9qCW zdDm?nHg$`8YJ%3MA%T@&(;zzId#Zfk+&eowx0i3KV#;O2K`*wZz@0#pYw1&jpau~K zkpZOnoy&Ng$uO7Jjw1<^HNn<MKuO#J4M6hb` z9cbrlYkfxbXa>P6tcX>Nt@P1O))+qVwGPo3=XffiS%}{`#isyp8O5wlej&JWMXBkS zL7ARDs+jnpb`>R1QN`&8_@Vp`$mR?E&ghM+^dNdu%iagoocd;4z0GjPmY;W)S4JmJFJwOvPP}Ae}MshT39jLKR+7bpfz39sNuTq}l z@uxP{p0CFF++iVfEiyyET5K`W-_aYvbcp_8R1p`p!-3;GrWzb>ajfF#j^*Qt1NsSV z_OP{5BVs=8*Tif&AG^!~hARxY(e{d1{&+zV;x46vjsd4$-(6RvoIGoJ>Q? zy)`02+D>hri3W4AKaIip&M;jo|5Pgl%9HIYPhpK#l*qR;!zhYWpIa&7s%SP?)(czD zgM4fA{~9ls35Y>ZxFT`axanJ#0Ys zOOMr9MAvsBO}>_l51Gvvo1Pm&{EeZ+?gMB@+^ImJmTYk3@OsP+l0^AaH;EJ=9pG&A zmkyhlH(uI4+dvA@UcMZojuR@io-HkHR(niK9mBt6Z2RL(Rx-9%2|4n$8utQA=hDb-B3@W@){gnd4epu6iw1w6}m$)~0gqQm@LJ*eCJ)|~f1 z5201S_6ystiO-q<>5H4o%T2{@qKA*g5GHoY=fX^kzVVZ?+%8|RF$0$yrZ$Gh@rNE;O}p78#c{!e(qDGdHMauw}9$S-NgpHjA>laK}63uEj}mpDAwXb>0bne z#G#B5CN|u0>Lk;wAB*@k!)mrg^l>k{^;rl?BKS?$O$SJ18`<~w+f~ZG1LcX0=s>O2 z2_4KN21~*AVmeFJh_xnmCAa%DeSndzd1+El#|4gL`}ua$mN@<|pD8n{HRRL$TB#g> zzrntk{+rJz4X5E{SgkJde#C0zkOSyiUb1V9L@E&NJj`kM2wTH2XGWUKze%!DMA~U_ zY0K&|m}dE&v8|id`ItHWZ1T+ih%+Vy`l)dLW@X_VbQr(AO-2Q%=Nw z#fQgS-25c*+dCPV$U*hj;TrkdH-fcrSMZI8)8oT@qz}lQFhlq?u*vJ0{LRfYziF2u zev->@{dWKwB=C!na+*h&f9EBQ_;T zAb*2!I(%hZ(!wA-{p*c0E7`3jmWzzqHT486JBa=Y*$L)eHJ!eHbyQ%L0WZ!ha{Y5O zLeL4u^9=30(4D={M{)(1^)Cwob+WlrjSZE&5f|vi!Tqdz5fE9;roHMu5PM<6`l}$a zJ0v163kFFtn+`bWhq8;0rw!m9m)bUmSEQ18NkZk^vmQnS+nV~($vXAXIH0}kSnSzS z-e0kCRm^^w=fy1Iuc@$y8S6ixfugn-%RHz55)w|EFmRA@GYEI^q_xL?xv=XvYeXBB z`Kzqb%=Vvuu7?Vk+MkB&d4oqlB|eY+u%H~A5}p;1dpE^%z2_OPGAigIoGR4^d^=9hPbmo zCWlj9{4l5|!a>ZO;)5Z`A-U*;%rUv{Tqi87d%lBHqHIm#ZH;v}$C^8=*%$~%(U-<4#!oj5hyLa3f`2&2CFDy>K`(c1vi+iJV*7#L zzJ5wds*NBPyPI1+xJxK+-->@KF#MzkGTSEWdQ4=g&D)~47s*94d0c-vh`7&uwM$B* zi6WP-aQhJ9*F?=O9z*|SE~?k-m4bN(IrQhkLwXtl35~`sTAY->DPP{>hq&`_gVJw% zEZhHrg%_?2p0q)F9>yrU(0Q2lVDBcK50QEXY-B_GG}nC62|L-NLB9f{b$z#}tGqS2 zGD|0;I_UIA-vQ+|a?M0BYg~@Ud&U7%(;-S9(7evzalN;rB*(@eJUO%m64Ysmvp;?9 zO{ruaFiex7Ipl+S*GM49yTSkdD z6nS?|=^yd&ivRBh-bjQ&g0Czz9q{{N_a)}`mC?Bsny)^l<-i5M(83_YI1FvTnwSaj zDDb{dE_yvi+dWa~?8F+bIfXHZOMM^@DWCe@5qNfz2~Gi9V|zagpX1#dB91s}8hTW- zqbWyD!CHJ@XUFaSIUbQbf`20;@a~N^M`j?8IKx@rzL>hI|9DA0r`E>qP7p-?vPl)#{@UMi|b&!{_ z1F8z|a}lwV?|E;ZSk%ok$)*XIMQP%0dTY%>u!zio@% zYgilI>w`6SbM|56#5+BO0-U5}AY6?yl^36LroL_tP)-Gm{N#m;&JX@NR=A29B4=4> zzl6bC6_fCxawO5mYVGzuH#Wy|Q}@d30uh+vAt<(N4$lagn^K z9!S$yFQg=QFsA{cnkMp_b@d37Td7j7_TSQ&SlXB}fq*Kcm>|+>_zjk4pJ1jb3a6ave!S&+y3AbS3BOt)C{!gf~_;PE5=5H!!7ZqI<4d0X27N% zUH1bb_;H*$b_%!c?KR9HK)SG>c7J#;Yl{A9KC_eKk_c+DuyEIf2hDB{!pF}FyG7ym zW1-O@0W(ztEmTivxY&jPeNSyko5BwvnFGS>0UyBPNR#|_#XP}W>iQePDOS)oC#V_P z&mYMgba#npd2j*VH9-gvtFt0vxRgLjPS1%79lYS^au4*u(>NrrKC#&ncUG-7(JT_! z9J~Mht5{?>JK98iV>m6@`&}FtJlbr;Ju~J~z24dtQD~4&DVg>z#RSVG`lw%wo8h_9 z3_s)^50Esy2~y@#@|V16s8*J_iq)WJb&ZJMbQ`XTKqkx!UkH#BSsjRI)J<(Pa&SByFvXS9c?K Z72n8*&BrXu_5qAbSIbC~deiZr{{!56PsjiO literal 0 HcmV?d00001 diff --git a/BranchTrace-x64plugin/res/trace.png b/BranchTrace-x64plugin/res/trace.png new file mode 100644 index 0000000000000000000000000000000000000000..12e87e82fb8d6aad7a2e67aaf17cb74189bfba77 GIT binary patch literal 6814 zcmV;P8e!#$P)QO^hF#h2gz_rCAUoHO^%+&kxa-sk^^|IC@0GxvM%Ea!aB zHPoeBpj%+21+LL;(=E^~u-XD0AZbs>O(fl3((NSeEa?X%?G*mx@7I=e$u_@FNcu-f z=cP5*OOI`V4v^I|02ua>^fLhv0E7Q$5x@gb_?;=~gOWaDQP}I2wLk~RckO#~N&8Cr z=>Up5lr{ZT+CL}h{gOTsKy%hW?e=COEHHO~{D`CnF8!__=OkCAlu#%7d#3LxS4`NsO* zba&?fkQ+&QLIB3Cnw~A`KP8$n1YkVwCbbsmq`4ve|le9+@vk~9PZ%KNgq!&o~ zT70!$GSvc81<3s+9VzMFsRn7R{J8-nf8JQXo9XV<0CHnVe<10QW@f;rqwkjV97!Mc zQP;IBEHEX2+%vpQ?>N)xy*MleQ(Aw0%E1%MnU z=}-@2Oi0J+VGs6C6B^SfLunl#e=X^Lqgbx~M!zWOa7pi|zpM53uw{V!gQPpvYuajh z_RHbkq?!)3)R9&J!rSp?BN+NJNnZ-Ti?;bYUBbVMAD+L9zc2p8C4LM!Leh)IXt?z@ zTLj3rC4KLJhUZK5PDw21&M>xn3rPot-vLHlsnwqwj)GI`&ANPR0J%WYE`?_dr@&Js zvC%!PV7$f+CEX`nW&)NUD?BdLFUvhb{E1iJC#|OyfV@G{!wSs=`x$`oCz8HdsEri0j}E6#cTK63Q1&|^Qj!3z zE*mV+0zgWEgPUi7!H*kB`|B$jdfzP$8z z@6$0NCI8fMOnjM2of0~Bb9hy?0c2N6fA4r1_{6Yw_pt13!pYBrCEYDiA*V)f3Agdk z`gq7sO7is9eY~W<@aWi-bkqirmq>b&lYu$LgkQ=cI70#mmLPYrC|at^y$fzD?{heW z;EUz;b^13+`$;Qf{Ewp`)vfqMvk-;=8(q8?up`uWC)va5=~ z0O`eW!m^DqcL^4#2_T%y^R~7M5p_?^RKgN(0gNF%Zy|>RD123N=~zrWSzweDHy?T7=-BT#)^C00*1xv4nW?r%U=qMhAXN((h)}+ggRa67$hTQY`@C z81`Pq8Nt~Q@7Nr-k(UOy4r3Qws^eb&xXcYW%!{x`T7|jD{hC?ZuBv_w0AWIzSd093 z@P;yE+oK{h{27tijWc6IdU+ec0ElT{w zzes|!w^m_4lzQJmKvpWSwi`bnn|&&Vu>tZZNxZEr!b8qv!dn|FIu7T1wq ziZ#ZHa=8EFBspst8z6uKkXR)3NS94Gx7;lWZ1f*W=rCEatQV3OO5$=f=fEJLt92J0 z6Cgh<>0c%BXRZ+R!`I{T1O>F&BANBACBelTD}N>lPXdd~o)KkCfOssg@Ug``)Xw8e=4MOyG~^J?TT5B%?-`gQ*}&$SeIAtmGrX-raVT{Q3>U1ESehR z*4^t4>5^;Ht5j+FPrfbR0J8Qb2u>eBQ z4=&cZg6~lZt756R_T2tk>Tw~ucS6oWj)`%P&lLjKYP%=O9ZPb(u>fKX`uXEP&Kxsf z;;v)AG%@-p1K|VrH(X5e<5Y~_|1HIb5ETi<&i;~ii&Y$14tJE;m>H{|7Gvd0KTEdw zu>b;Df+b%d{#LQ1%!~bJlguy%KyW2LC#jcLFU%iwZ4-pW>it`vfc zO~PrG1>A5VkHMzDXRqkk-`SQ6&A&~F;wt0h6XV-ei+ z`8vc1Cx1jA<_a!4Lvt4A_SLQ47yu#WIhXJ1Zxc4$1Rq(m-5%r=$hF;sak9k;*pC}# zGi8}Y7F>eDas?VDvgyuBh6V_355zj;3L9jCiDKkylDLq}6%x+iNn29zmgOs8k-a2+ zG(rJO(-R`ftt#?NN!-lON`?l=?IeA|VBy$XU6yc`h&cS7I2ulIq0b!_Z)GAObA>Mh zcG)CWn?M8mh)s=5?caw62uF<;DjvQbF~_Ww`%A-Q4ar%{GSHISoJ&{SPc{ilI;eee z1->%e=w~HE0|fVJ3pp8Yb@m~f#L5bf6C@XmLx}akg))fS@)+T!KUZ*A#Bp&}GBiM* zCF%DK7T!Jbxbh@PB%;Zcq3y!MhkJUCq#RuE1<7@LIj_+;njD*6RcGi2feXUeW6A9X z7TaHPgp<0rcMlZju5kc%bbdaI+ia8sTN`bqF!S- zs{Oh#z|CNu@v06D5Kgc-$;y>$MiMl@o}L@z!`+AFf-z@omKO(^vtl>+kX&%Fm?I^8 z(sKGSXq}+}a;&7M8AgcHAQQDoEN^6VR{jH+R7yz-77Q}{rT2F_TCy1j_TrIrB103`v#p~GO z$@?8i1iSI)tYi#;kgkAey<9m=(s7ZMJ(BY*nj#j0mpz^ zyyQyC(l)n^D(j5_kbNb+-(ZcD&9n6gb!#^*VW$t2^hZwMpkLf65!e+Y1dqjrDsQJR zg&ZQLKh2aG10XQ`;el$Q<>%7tqDU*l2W; z`(R+S5QWcjgU;NJ0T9}?(t*OO6&smoy?a@OfdxM=UqisU;O1qI1oI>QQ5+M;Iub@; z?W!W&M{q9@BV??N@jh6mYadBx#56XwGGhV6dL~bjO5V(|0z-M}JB`@BSj#~bl)@`! zwKYCz97TWA+VK|aj|C7I0pDdb7;J%Gh}2=-q((L~NHGZU@cxYzYs$GH-ELyXG+4Q@ z0Kx#R6PKDI`DKypAA=b`qoI_v52*J@95kfkW`;@1Rv8l@FOl>l!|w<#x#h zZ;9cU_3{csjtLNtWfuHbseH3+I0@fvNg$n0WuzoMw)Ny`*2}9J0AgKc5s!W6gw6T_ z6dr5yp#a7*l>JkxSi_rVzr3meARfysA_pO)OBF5~A$=a211qJUkC6lkUaDBV6=-kv z%c~jyLLV&g*wlw@gRe+TOvKg)?b?z~ltct#O~Ss4l28*@Npyg@+2&ui;fLeTo z@JZq;LiXHT!F_|f6~cAL5Wau_6}EPZye;HYwCG52WwEqVecc)Wf|2kRCH&MPvE&8o z+W5Wz5`aP|>k#to01Pexttrmn_f5HF-)?-k(Q|4BJLT-97J%THO3Z;pc+mDXtlO8{ zhByw85POoFE-q#)CrbhtF&Uy_^braGHIhZ1ZKP(hv|U}@S^$D!-XiHCMhih0$Aj%9 z00k$<#m^(tD;&eP;Iq!hiPB3vLX2URmtcXK0793nt`X=U<~=vX zLh6G-@E0i=01JO&PXMv_4UyxJK0~M%8y~W2jF*QcYN?k?s%@(%UmHNIxdj(Sjm>3P z#UvOz!G$M5Th>Db7%!~{CB~uDSG_iXU?FR?Av!pTVL4Q4IaAY2dbsg(V#NUmOz~Zo zEKnmrxIuoC!z>Mv=iH&2CKW_gzQd&9%F5ioSXlQRx=^Qz8Ucc(pr|1V&??+2!+kqN z!A*vx6-VS2VV}g;g8;TJTP#p3Ksd|yAdXH++t%8{ftx=m)vS{1>}hSciTbqy1modE zc(8*NpCRe_4ti=*!B>N?2VW73z{JAWBR00*(pHmoYX%4tccz0?@%ClI4wuwa#7acH zu)}kmzCu&6>ki|n86b2PFW*>l=5>=arPzkUGXto$+6MD7vjI>;)C4gKvd_`h&@@=vOZtIqWqMP)4{5zSg=pzrchw$a} z*w1ILkE7Rur}d5XOsZgjYJ^noo1sC&Xru z+VmXYrAt1;Ie0g3vPIIrw+N7Hg@iEsC5?1-;Tms~y*!#1qlV1ElB3Yc)a|Kh5g=F@ zaKO|KSUe;(m4Zi`t8_p+MD7$XvIzXpIF#s;VS!cw!cbXevE1?!?paRpQkJQQ=s^6e zER5{SO_Pn_iuPL zI#oSW0SNO0c|l5Q=uLAv#1iGfk|3M*5*~i2d-&nGyh$L;22e1`K>d3DrV4ZW_bCD7 zR)O|^H^)i5M?v>^$mVi#nyech`xr}J5I{oOHuRk3Xvbz%O$i`Og7*a*I-xSfP2O9e zN%a&`t{vj2kjz%Nx@9OP8A@`vG=7LI;|jqD8Vy> z)q;58sm>>1tFT5MlZO}BI~B%uzWONx>oTQ5@KxLqI^kkJY-McDSW92rrIPWE=f1Fx%hV|QTLB6+)BAQ0))9CIO+z@ zlLSa0f#4zamXvwgGvr>6aaQ#1C;P3JdMh1MUy9+!>}QF#y?vod^bwu7q+F7r99Q>+ zyZf$^ZWPj1TXTx6>k3{1xYu8p(cdbo%o!j|NbMlGnWPJxpB!%TxnSf+cmS!aJ%z)G zr+X?KQ`g)9QZqQHRqsG7UE`9UxauVQpU$mPRm=3?=Nx z*gN6VL#Aj~2nD|BDs{HPr0@*>M)e0?A>LU^l5jNHSz)z8@l{zqqYBK(;sW&>(@R zn#49W311PM5p!h{IqEw=R!{%`ICB54d&rKGbZqWZSg;=Sr)L}Vv%K<*oHTSLziJ1_ zdfSmMfD5)#QoFmjHO_>Td6$(k-Vk~_KsH;M^ZZ+EE|y#ZR}jL2YZijChRB);www;BI!#G zdWKLzoQZ{=wE2^)4v@6RjDRKF+H>U6;COg>PUVs6bbyRx_?DZ^VPgNBq}>}FbYEgM zIB7L>nLCSTMs{RVBw(bPQHu3V`Y2|fMx*fHLixE)@N0T}!^7>zybVuY4P7V2+371f zLJ9&B*|aMCqHrd>Sfw9O64jh2>6S|kJx2Bv`CffbizS4PxgIud)26m2e=ze9aVP z3Dt??GN!8)fB*=1U-t`yXM1FfwO1)`flfVI-o{t8z+3O&Kx(#*)qKD%^`_QXpp#b* z^my=fAQY7!oU&cous~0LP0;h!Fsdu&2ZJ*u_1(2HrnoS(#y0l?|lL9aZot>==1rU~1EU&uMZGjI< zIztj{CTG>%)nR%!1VH+U)i86J(+ZpI(=Y@%unQTXfak0y|isBtS?ce}vKIpO$pAq&FJ% z^y=LLSr#Y>kdH{(E2~#mR{FZ61H-YSK~1mPEs$@4k^s5D7~gS_ByMrLbPJ4Tfsz2R zgqo!IFKGKELN_aw9GY5bH7Tr0HZP_asepKqUcU zy(q-wq&7QeqPFkDYQO>|0Rn3Yu^?9IAhBAo*Uz>%B)ER zoNe3HZLvUUfROo#;Q!qVTK*E_t$o3+b=4JHfLMG8D$bVlU#t3A8X&a$2uZK0*igM| z^R@s)6)fG4-Oda{0EBj5BB)wl6ioPXIIG30HMvE{$TEp zVBO>A+TfmJ0))0Z9ckSU$((!l6-hT98z8j*oRFWer(m1&<5=I=s{sh6=}A26dqC#i zqbinITPLBXfu8$gS#<&Mb9mKAZ_FekznW~_d?-p2NflDPFBZ;8A9i#<- zZ0+=JlJ=KG#3JtW{2-cJ{CWNUICKkaumHs9Bwiwa4JkD~wyOO90}Rd<1-y>uNdN!< M07*qoM6N<$f*iEoH2?qr literal 0 HcmV?d00001 diff --git a/BranchTrace-x64plugin/resource.h b/BranchTrace-x64plugin/resource.h new file mode 100644 index 0000000..6fb8a93 --- /dev/null +++ b/BranchTrace-x64plugin/resource.h @@ -0,0 +1,22 @@ +//{{NO_DEPENDENCIES}} +// Microsoft Visual C++ generated include file. +// Used by BranchTrace-x64plugin.rc +// +#define IDB_PNG1 1000 +#define IDB_PNG_TRACE 1000 +#define IDC_COMBO_THREAD 1000 +#define IDB_PNG_THREAD 1001 +#define IDC_BUTTON1 1001 +#define IDD_DIALOG_THREAD_TRACE 1002 +#define IDC_BUTTON3 1003 + +// Next default values for new objects +// +#ifdef APSTUDIO_INVOKED +#ifndef APSTUDIO_READONLY_SYMBOLS +#define _APS_NEXT_RESOURCE_VALUE 1004 +#define _APS_NEXT_COMMAND_VALUE 32771 +#define _APS_NEXT_CONTROL_VALUE 1010 +#define _APS_NEXT_SYMED_VALUE 1000 +#endif +#endif diff --git a/BranchTrace-x64plugin/targetver.h b/BranchTrace-x64plugin/targetver.h new file mode 100644 index 0000000..87c0086 --- /dev/null +++ b/BranchTrace-x64plugin/targetver.h @@ -0,0 +1,8 @@ +#pragma once + +// Including SDKDDKVer.h defines the highest available Windows platform. + +// If you wish to build your application for a previous Windows platform, include WinSDKVer.h and +// set the _WIN32_WINNT macro to the platform you wish to support before including SDKDDKVer.h. + +#include