From 8761d815c2bdff70ddea030ac13019b26c16bbe5 Mon Sep 17 00:00:00 2001 From: "mr.exodia" Date: Sat, 12 Oct 2013 01:05:46 +0200 Subject: [PATCH] - multiple calling conventions supported - moved stuff to the SDK directory --- Release/x32/TitanEngine.dll | Bin 628224 -> 628224 bytes Release/x32/TitanEngine.exp | Bin 57030 -> 57219 bytes Release/x32/TitanEngine.lib | Bin 96968 -> 98584 bytes Release/x32/TitanEngine_x86.a | Bin 311186 -> 311186 bytes Release/x64/TitanEngine.dll | Bin 723456 -> 723456 bytes Release/x64/TitanEngine.exp | Bin 56205 -> 56205 bytes Release/x64/TitanEngine.lib | Bin 94948 -> 94948 bytes Release/x64/TitanEngine_x64.a | Bin 311994 -> 311994 bytes SDK/C/TitanEngine.h | 938 +++++++++++ SDK/CPP/TitanEngine.h | 938 +++++++++++ SDK/CPP/TitanEngine.hpp | 2815 +++++++++++++++++++++++++++++++++ SDK/Delphi/TitanEngine.pas | 750 +++++++++ SDK/LUA/TitanEngine.lua | 1486 +++++++++++++++++ SDK/MASM/TitanEngine.INC | 832 ++++++++++ SDK/Python/TitanEngine.py | 678 ++++++++ TitanEngine/TitanEngine.cbp | 43 +- TitanEngine/TitanEngine.cpp | 926 +++++------ TitanEngine/TitanEngine.h | 933 ----------- TitanEngine/definitions.h | 812 +++++----- readme.txt | 6 +- 20 files changed, 9332 insertions(+), 1825 deletions(-) create mode 100644 SDK/C/TitanEngine.h create mode 100644 SDK/CPP/TitanEngine.h create mode 100644 SDK/CPP/TitanEngine.hpp create mode 100644 SDK/Delphi/TitanEngine.pas create mode 100644 SDK/LUA/TitanEngine.lua create mode 100644 SDK/MASM/TitanEngine.INC create mode 100644 SDK/Python/TitanEngine.py delete mode 100644 TitanEngine/TitanEngine.h diff --git a/Release/x32/TitanEngine.dll b/Release/x32/TitanEngine.dll index 9f6dd5c3dde6455022a5d640f13e2e0bd56ac45b..7ca93d74546320a2a88f5781aa4235a109afa626 100644 GIT binary patch delta 37062 zcmb@ucU%=m7dO5$vlmej7NrY_ilV4Umo66U=mo{zE22hCuoqCocEzBpId-v^XhbnA zc2w-B*h?%J+ZxnhVi)8+v-e{3dGfsPAHQGn`FhTrIn&OZsXN@{9d(m;)Xg9@V`p}c z6-@sX3bbZrQb`alh=Pz~rb($>lT4xY+JUvL&QHEXJP6DBK!QaQlI3S+;XxW@MK-ES z>97V_@r_3l`nG=7EpJNbU-jg>K7+FKzO#t!G7nKm$+O5LMa>h$1i=vJ9IJ}*Grz|4 zYTYa+|DMF|eVzZ-7+go5AK*p&<$VE*X+eS<9T-8^?UB<09qhL3VM5BpE<&QcA+9iX zUwlyoNtO4=2LkowiVt>cicfcQ#qQrIUfC^AX;Q98YRVQtjtxCf&njErJN5FoKtoia z-k7Demb!zGSj!My7-N)`W@g0%MH13WUL2fCuer&NA=~Ud-L&e*n^QqZ5Yp0$OUue) zR2%tLNM8~l2Zc@`;c{lEBi&F#J{RgvU%JY#LVX<0x*AhSXl$NJ{lru4b(KTH`q3+{ z^2)F&&evTu9Yb76TFa_LZ-_RJNn6SlW7SaEH@ps=?IQOG_o72wvgU=?BJ`-Uyfeas zE_2Sh9-$+2QFSdCUtKnfTui#i%OlLH9 z9a%Z+hfZ0-bHo^BrW>y7(<**tm-8*O$9d3cI{8)HExKNm^SgS` zNuvCw>v`fSAMY09c!qv4pUHkgBh7wtqwWLgu#Z`bx?iV6C&%}y#eT<9(t5q2^p6sG zR$mW#v?Ob1UpwmL^pTZ!L3t-gBzr#v^$(VrFsHSMGPV8~xyj<3<(^DN?pWX+>egT|MY=~ZTuCPx_kEVBvsvloBM zWLOtsFLxa_oV1m5hmE4w{*W8TXP}V_;_DGn{t#c6o_{6R9A1mmms<|^q|;x?m*PF> zh-X>LhZhq%=ug=&!b6OB$^f=;d`Idy)!r$;f@Q z$qP+XHS7MUd$elQ?@WjnwBZt;Y-J{?u2~nytR-~1Dv$X-oV3XL<@=v$wQYC*Lu=;a ztdZl+k!t6D`;Ul?59M|f<`GBv>V!fX^gFK@sg`wbVi0w>e&1viYX-@5>{{Wy{G^r#cj4>6$gaNqGBimd&(PgG4$%V73 z^DZi#l_JuSmt@z4XK6-3R>%1l7%j-xf?~ehasJ_~tv}8ubpIKij&zcLT(p7iKP~$& z)&h%j=%!P0Tlo-uax%+&i4&n`PiS%dk5-2N>Yd-Xt(XZqho88GVEy?dk<;skR@A2_ za^$ELt>};(Ic-HFv34#Kpsxc7AV=hl%ezwfh}>c2X8Q54F?2Yq!>RyX<=*?gIIi3< z+rtin+)&?6f9~>`b#t8;EYt;H{jBVe`;IR+u=(P81P2-$YY#I(b zH}`OOlJ#vVH?>K&AWL@L;zF$Duq}1yh(I~%NOk&MmYlrBgGO;;mvv-|j*xotiLISU zmn_F^3n@LZOWyW#EFHT`F8z5po!wZD-{DDm%JPnd^qiMmd*>kfWM|ggooSSGlkGA) z6DB8QCJ+btT4n?K+*78z(?}mVeRpU3ik`em<~RXW!|5l@SfkhV<>Wkji$cHi>glb< zCc&Ydq%Pfx?VLfo$}9J{aZfq4XDM@7vGLnR8CQ;38|8%T6k5C?>(6XELZ7aeE9At` zCF|v$IX4~lulu(o8`tq9M3OJ;`$*9A`(x>)wX(~BP4=E^ztuM`Gq^Y%m_?J<$o&rb z+4o%Yt%|W0E#++o7npBdZEC~aO{6YaEw|jZ|^{-y*$?bK%{? zp$=D9ew(?`N{3g<-bXy>8z;HP5qBI1(~mgQ*p>3y>vr;j>(;cs#%BF?1pCfHevo^K zgveP(8xTwR{!y7tc4UhmIm!!xnS#}~63_Dptt;x32fHL_2!=jE1n zPAV@}uYPBbol~7OmsjNl5-0ge-XQxeOUvtTS_e&ak3P|yck>Bb`_`!Om47cijakL2 zKJvj6OK3?oIrd~d5-U$R=}h9}WhYzH7k2W4lhtXlEPp;3OIOKRv8UV#9bYYL;%S-C z2i93t&Tb(jNdEO)4|>lkOUkcF=mEdvGK&E@`A8qfjea@v)~I4K;uGL!DC zAUC@jXV@cFA{QRTJ;&{S z^n#G(_S;^{htgdfN~JQrH;Ildm8abs;9yxw|GT?Blu&s_o)bMkMXq{(3`>~8pw4>Q z(P>I~m;E!R6ny1!d6WOG?!QdtF2^2!pmNV6wOP|rDkmRtqRl6N@j6G1%_=Iyty9Sd z`L73?c$fbE9ewg%Hh<{J_P?j{gQJde$A_I*C**7X<|yxb*pmMFPA+?xO`6ErkG`X) z-^z6#d(u^J<=Dr=33|!ne)Q5C+2u(ro%Ti^`=lC+f1|aEgk`ONvfP5t1>t|YYP3(8 zs}94;G?9GAH(|;PGvbO1NP<$O68TQlqAba0BU6pIQ+h5+*3qNFBB;$JmgS0noV)@u1%aC{ycT8%Uh8tSmV3I= z;|;*MG2z2a32#h>6VgiA;!Ua&npIyp;6tu4dZ!L74j@~IpAr&C+7TzUw$|Fwgy~WO#UpF<-WW9)_KqeEXj&0G7)|WxxFY2PQZv#Ar18Xy{_;qP98da5^!!y= zHyagxy$btglTg=*S4~+)-<ll9MHjg!`m>Z&A8zRLb>X$1=bg@%rWsre*I6DmLI#P=c+y@rx zNigw%R_jSCT9^Y1*ONfHH3v?vCynT&9C)*y_>flMv4OPYv&*OrWIUaxK72bv z_suwe)jzmLOUS+bz2@z4C9&$3a$#E3Ys}z%jGC*!t*yk%Zb*5IA?m&6^wA|Tsvcan zkzehdc57LE*`FGBKq5TbMwU7E&NTW6UrF#k;~t>ETid@VtG5$8)^6GhuYV>9#8To zx|_H<58GC5wxt`f#FS%VY+7o8w)g1(HTRI_I0p~jLkx7-tckVU4_16v>~ z3%%H|1s-ORO?0papAbE1kO!X&ouFVZ=|>OMi_VKtEnt8`Z0NfUFhL;=>6s0%Ng=)Ihz-DU zh!+V3-yED$pRR{FIXGfZu7|BTWCh#4j%o)6MczmHi8Vg1(pr2f>OCL)Uu;;Y-KN}K z1=fdgQp;ThUWZ8`y|@yjBjjg3>mE8n9#hf|HXI|-^aa3Q$8gF=`KaUM0Ht|L!1E+= zc6e>hgn3bSQl{N0OB|Sn*Fc82JF)6bbLe}LG^LBoVeLucO5EV^NwS)!?sJOR>geQ! zkeH7XWD{jeK50q#IC*iNd?M&`7l<1jv&kwD}NQK$_5pKPrX-@;#v!{h{m7uU#Bbfat6Ne_BB1-x${9h3rw8@Rx>f-N^la)T2ywNA+q zZ$kk@YljxbpE8 z*+xlQW#emdk;5^YI; zXa}EAPF$grHJv~=w^dGC(;kGhhg#KWFkdUH(cyGUYhzB8Y$)E-La+@TP4ikopK6%< z3me)DH)D-$X&3q|3Q}!pQ@S+@PTJBIbWjxNt*Ilp+hJZ-fLCD?=}#@;rX77wx3*AD z+S59fv>{WI{!F^S@>=vNO=<$8Yty5(4{Afk!YW(mgNq2xnmYB2Qdahlf2|CJ&hGT7 z{rV#W$Cf#2c*gI2B1(p+61|#s1Y+vYYINce7+Qz6#I4oOb?A9(nphhqH=!kTd@Tj9 zjPR6(Be_Zlol5Ers-Zb@LVxt%Wb9}))+jJtUZtfbzvJi1FlBcr4Iy-fE4&D!XGs9$ zgwrVcr?XNPPN|L-*#m1q@8iz-VGA@nJ!7lXiK2MXI=q^a+M3=VG~HV1+m;3rdQ(z< zYDdRd+CL%2qHW?QVpG%7GPD^D*R&q=cltsA(v#YdZeZ7wKC=I-jJMVz!6rU~>n`QG zv1)Iy?nQrh{P4Lva_?6e4JspwMQ=LFmj3+=ri`UcNo_bVmS)o_s`A74v?DclenPbE z6HK~B{8;g00=upe7gm7GMPz8^V~7|>U(h{|pwW2RgARQJbH~%sqyXNJr!5?JKQtCw zrq20@D^VV<%9x7cX&@O~z!nTQ&-_R=OC(>>VrHb$$vI;#l@bVcQQlKgioc2fs1HZ-GSME; zJc&*qey~3Yt9a|SVw;Q|j2*OX1`TGFZV_!)xZx&*&7}TBQpV1tGiZ&;*Nt@-)9{*j zUEU)c;T9*BG%}O;R)pI%mAY{EPNmIg$u(#+hc<$>sdNxcxCY{EI)%Qt3NvQYI`rgK z*gBgA&>yeD{n@kwX$B4F&;mN<3VfbJ>yWnKK9_E!8!yAzxj3TH7UA<~Pdv>P!1DRD z4K)6+e~7pa!#rD zBOONQ-LtSL9dDYCp4HluGVQf6z8hbGRa}7|#i-lPDksuuS3+aXaK&oiy_i-&;{+|H z9;6ENUrZGmclxWSVDOi5D~%Oxw1nQ$(Hps7zJk7@Kb(M1D`;cKdkPU!a}&qKi+rgU z(o)sWe0=|BFGj27-!7G}^Tcz2oud2LxIryQdj zYx_IX4y9gzafgz&o-WnVvwOgOEA3BuKSl9elQDm1{xN9>nmtBs3EO_9c+o$mw=z|hf^vd3tB|-59OoKDf^G;0YQ zIEfwGSqtKD>T`-_nvs5Bd4YB$67;!1m(d9e;N1nBZvvsoMLL-tFla$K*`U0>NPnTY z@7r*hZuZ$Q$Jn0U+E=f*WwEODTuqV|wM@USCI9Fr*bpI;80VECbCk(f=9Phpf*wt4EAan{gF2E5F!Tm>b=+#j6E3hy z*@&MK3~>ug1@E?k)i%)3c{#5L6M7VSz)XTaE7G#)qY@Y^lg*0IeD zEth8k`pUCNJR=zG@ybF8zl|$8Au#ecI)DJBIUVl(MjgQEF6~L*PlNGyX&Bu<4ffupwdvAnaO*A|VOMWjdE&VD zcubv}l53_{t3l6uxC^;F6;|D&@zvs|8g(rB;WaHPL$7v)o%g9HX#mad)9yBxr~GGp z?iBdtKCNGOX$9^VMbtO9FCKq!(Rnl3=;lTz&onuC>3!UlWKLEh3TbQV`E;U|ogsQw zOd9r4T2#7Tz4EOLE2>wIOoUy((*|_0sNDITdQi{dCQh(twc-%F{ctY)`)T`#FG89IN z+Bw)5@eCy?xvqL{FSXYi4E80LxRnPNN+U?U%uJE8!Go}&AN zL-AAU%J0xrT76(Gp1)qi-g#{rZc=&vc%@)0@$+Y{gQeO2pxGb|cUgRNBw(MtHsyYs z>qO!Wh3%>bqV%j6`ie1e3@lL5ev>{!+zVPGB!RCSRPYvL!m4M~)vfs_Onh3!8$`{3j|{karp4VfHF3#jxc!Va#|h5m5894CE`i~H zP?w~WC73AEJ2dLGRqFL`s=NbZtg@w)kHjkVAjYKOMNL8^TJ6h}HJ_(N%l^}vCEv6r zfyaN-n(iq1rZtt-R+b3LCqHBF1hvt?0P|Kx1Y>4zUsxqDgXFmUmo{O4|YJw zH$A9^Xgb(|F{3npbh7&VZ^|*07!6(C>`YAu4Si~a$Xz1mXS||M-uo{Ses6M3s;NLyK22PdROhYns>FU@FjVDaDEJG{FF3>f&1bm3HTMcU z`8T(UafbWWy>?(s`3#rId-6+}i~oj$f8!Z$%-@>Jwe6zi@wLk}M~SiX%3aP|(?RRE z9`-+7&H|dfruOvpU(oY4_2EavwAZvZ|1k3!50cl0fa4n);<~F3!J8;tS<;qv=U1}) z?%a@uheg~jr}crcZ)g$Ur@qDgX%}VnTUtoz=mC)Qf!a2_IY28r!4fyvQ495I8)Mjz zmZ)uimIm?sw3uH8D7hc#AxzrWl(g@EBsGTrEoooKEx}_<1Z0#_M~|$5L@-XvjzxT# zc(0EaBxKUw|A{p&pQ!K~MkyYt-IRdOlvvO$dI+k-n$f@GU`i!+(_wiht@L=)3!qf* zNPZ?u=>#JxvvAtKHEgfUTG5h@5N^S0(r2x})`HcgyG`MZt(5*2>_j;x3dZU&W{SR;OrbYda&V65_UPU z)8q}zb7mp1r#d_0_$flGTahiEO5^UN9Ajv~0=@buLYeQ(oG3jV2Af?OeoqYp6u7}( zu53Cj301zY!G_@*uMneMd0Jz_86nCGH>M*MCI@R#(5yCd0P9+;fEt37hqc%iLVpib z7PzzD7)|ws;q}-i(pRyn&m0Jef_k2803GBF22b{Z#y5u94On|(0hb%F;rxUd-jK~D zbW0;R)rj@N%j4Q!tS>EU2nW1a4Os8R>}i%32xvC7p;o-X_9nkPh{{j1(9es`PpB84 zY;A_~AzmW)G-{lR!bO^okNgHvcW~algL5g)S@^ZCF^eHA!P9uACl!<%-mEfyeW*|5 z)cYMtJ;mRb9TDk=+VCcjMbquIp=A>`lr)E*o3M3sQ7z~g#PCT06a}$j-ZOWD*m?MKM2C$yVzw zCp@W|o?D_VjK>hEiSZI5x)mG8n5Q+7haBqYgon)kR17jHHfo2?NE5AKa(niPPOyXt z9as^YUj-|^Il6j-D*v6bzcD48k7hmHPgrQiNpQf6vPbBZ>Rywe9tujhV1tFyz9aJ_ z^j&3`(1`^&6k%3=|???<$kM!!Z zib`q>%hoQo!@DpiLTsUX96L^8z_}}%%|E?#WxeQqmfelvH@Qopq)k z3B1N2%^=XR2kV3vfNOfN8T7mWHG5*JF#=5Q$$DUxH+!<)ET>F>CcRi3=AG7yO|d+O zBPwOubHQrXQRJX+Z)OJ#doyc@?9Bo!_wly8#v3sFM)>kGr1WNe81@Pj_GVGyC7xhx zA574+4<_i`$CLm!IQ(>@{#FWwgP9}j>chH#)R*n9ToreZDbotEFmuT7%RJ#jUlve> z7ozQ}@w;Udg!W_A8{=e!JLzHr4UMv}O10&o=wd4+#w;{WvP#wQa8&V(i56=~Rm|)S zr1oQV`&_{KBn06wh+Y<>w&r{0Jd3orxv>dB{2qjVn|>ct7WYUK;kR8?pMV!4Uqt-i zX^2*1P>5T2)YFCq|73hqui|dox<8AgTi!vJLFl?gmmql%cGN*wIf(sW{+#bM@$)%2 z4q!PJ>`N;@5IEnL)z_M-+44&>KR{SN=G3^sH|;e0k9Oi_>zj5yF}Cx_H|@l2>;I4K zd?#Es4#iYGhL-ocisvc3$kf5gp{#n17n(huoBI8Az`aK7( z4P|wc7NJ<{XMXQs&v$Cr&(U*Zu%F}7wU7L-@gsj>$}}4?uCgI|8LlSJa9u~wv!Ubg zxc%JF++to-{Id3O(L^!2`$zdk0S;z`sYQfhB$RzT(R*wq6A#W;3nY-Y#)J>^*XdDj$Tvq ztY$5OvD2BSv6IQ{#9*(g?@%meRH%$*E|xKX%Ob2$N*#xe)-Bkn-q(kSKx zp9e8>NFL8BLWl2>%OAxWn|Zz9o-W7D@&do_aPC|OY2UHGEH`{H%kuwamczLBM4$Lq zvmDpVLWduNpGUCz*75&gm+qQftQvi7m!JLs*O9Dx#Q!J5gh7?DEQlUgjdsZfc`U2r zkb#>K{Oo6yeHt%$#gkDFwW|yD78HzSj-nslbpES-+`eaF=66-&OdxN~Yd}=+{|;B9 z7m5p?OB=sKIB@CViiq(l}}Ka1~KRpYWS<>~)6(E}Kp$Q)?h!(d266V3h) z6OA{zPWvw=!U>==lqPDfGnJn$zIB~DX=$3&u#}T;T<6Xg*C~iqKRkv3+S6 zNl-YB>8#~STuoYF5+ujAuO86Y^#*F7N-d{6S5~_hur|HNz8>Thenf_ zBRK)BC$Zsj>%$FjF1RuY_v|&G@np7;tcAmqS+v8YLahM4I+mazEpV;G!*Kg2PL3<_h95S)*7;> zv55LxzH*WKceOX|E@H!7q`b|k`P%+>H|(0uYQfd%tfp&u6wb`* zfIG&*q6)1P{NQ0V>m1l6;npq#nk6x3=%2(~znBlFcl91DOky?2VfZBpm$^GooP_4H zg-Xe6G0VLzKt>Pj?(AgN-eq3Yqm*fn$`V`Ru95d+0zT>C56m9%b5;Qkgr&{L)f!k&t0?D)X?cg0>M7tPS|VuPiPX?xnKa3i^diQk`4D zrr9i1E?rU=*c{fIe!c<&<}f=OH;iqRj#Zl%b$TDCGoImLbPj81*@GW@cop$%qi%&0 zb69P%1fI>oN{q4q>$zCdRu&M%X$=eLhZNVy)VWyIOR!@uu9%16&Ro_;Y=vD0>(ZE0 zE$;EB_3^wE{=iY|7h89{uCvOHvf=mVGL+5#sughuvEOoG)jS+VuJC>y8!Ty!>D&CX zaYlKz9Y)S)-edx-p3g!&s$xlL+PKQm$8&T4TPcatVc0z8{>4=P6w&|&8d$QKR>XZ! z4Xk+;JU69056a=9Ms5(k09~{$bX$O(Rn;7(F2E)i!TJT*&5J5D9ss&Q-jA$Z)$j29!PiSv;P*>vL}hSGXI?Zy z1bsSI#9o96NNtLlwp!r_8U8T_uK@J%ZjhPIY;okBOlO0>SS5N1I{7LHS;SiF*R10c zxU*GuLF(m1Pkxj+h)0>s79qo!*X$Bfq zAC4}@>GlHLU(C8W{ZwAH|I{mm+{Jiv6ww97$m~58*F(Y*ye)VH^Omss)F}h@E@9t0 zwerv$iBBc`uQ2%?H12Eh5Bkl~wI)%o{~R<4CBKd~HslamH4lu-8-%GqTs#&~nJie2C_FII8;Z*N=5yI!B* z^krFqwqU=8dD@OBk8g?8Fg}#Ar-@g3CVcTJv zd|s4_H(q!Q!W(M-bj)`cbjVNfc!0}^b*Rp zFlXLim#u6%qt>@z_0Q}x7p&gF3_3dNvf{Z1`BH7~M? z$K@K|-Kei%RTdto9z#wRE+N<8W)^E$Wm%!7g~w5KT06yhFJ3x14nF$1O!Hf-R2kEz zrFPd|Pr0NhyR+F0Lg%*t{~T7o*65heWq5&e8n1-h^Nod7QxpCXTIEAh4jVx(Ls1T! zODE}J+&)&TY8~T5q)$sN#Er0CjXDRb4&v?K(S3MxFu57D+|S0+3e7;-&nDBA9l`Ga zo)v!V2>lMQTGpYFn$PIdmh!~0>Tj_40PA9Xy{S=bNWG)wc^%#zV9m(}2sy|a(%I1v ze-IPi5V&d}=ro?GHag2KYr$cOg9Vep{zYJJq+j`(T1{}v#RGSW;%jTs% zN4=uTs(ptorw%bfhZMn?!`OqzV8jvTjeP^Fk6>HYgo0Zx(>LhdmZ#ZUf^R*S@_+Gk zfs1ls9eigQ<7M>Ucp;q#YV8NGGMAOmr7A2x%KWKSBe-~!*;j4#jB7cZ)b-zGCJ`+7 zF}y#DefSt0j^PEe-*M=5jJewVeeQFa4tqn;$FKSeUsz>cz!E;gkH=VjJNE~r<#8Lo z#2tYP$5`*mu`P|2P?w*Cfa9!RWwnJ#(612I9>*(Te?8nj&brWuPvD)$oTSB`rfO?N z%=!a*=CKxJ7p%#{4RqJ{kdueg#&x)n$Gj>`=<~Tu9e7x=IKeC^*$a-RSp6D*SaXw0 z8>S}X%hT$HC}+GP!T)hi$Bo^nYRZ69%!<&4-^2H(*+5V8x>|9DV)Z3bGgVJuSI zoNv8?v;WG0aODc~@J>IB7UBNe@HM(v5dNd?a^Rh56E7SwMYZHny?N9U2gUO$%OzBw zt31EPth6`3r8gPA>E5qA{EeLwt+$6h|emELEqMQWY_ ztsddU{_3@``w^b8mleYwk65fzModW=J}Y|M=a_|%TFj&{1gELRO4rA%uo7NIHYsL5 z<7bbD#rVf4wEu6=<}bFLbX5NSi-(hcgYK`{cG_1^#5e4i1UMCn%q!SHRwCPWUR1?=<@57N0^lo7t- zdAp=Tm`BYBQTl-NJW}7LqSO!Z7ott1C?zAjnu*c^LJo4q4p2PUXh{ATF6xczO+9P&Hi_%+!&{34mAg1X>X-TXoZSE{eZb(NU5>f9Q zA_Da)V0t@5LCe9S)CFr)9|Nrsyru;RE~|?*9FDT`PZx%k?qW*r?Qs4|XF?6D?BwTh z-2AD9Nc?hBrn;L`t0lR|@v)&G9QVsTegozCh`VvhigscjVjk9=>!+DRS$lDx&yjAT zv=p%cu^SPKIFI-Z@eJ_}F#<6OF$WUZV7S zFQrwC7+8T84uaIdG>#>QCC0+cL4Y((S?RYH1+zJwOUYc_CsG)ybGFy3f`!JNKEnHw@KVO?)5 z7*#bBAk|DzfKgb1Q%LqAb|5w)Rw0%k79eKDYbLPas)jP2xr%s=FdvSeDa655M&ge& zm~7yj09HLkN4qh@wW{!#^kn2WBJzhDjW9C7XauC15x5f8!3{}0gf}7x5s7Gn&?5#V z7>!^oX(~!)A(kMvCMcf$#Fb{W-wfr{5V4Jvl$|I_VJ{f&3ot}lZiME(W{Bk3oW#VW_8FEuN z6?NzJEal@waX$V`MheWHB0ivh-cg266&IM(+;rvLEYX(Gp^LzBws?`x;P+>X6LnOP zp~nJo2A#N6xwAmbV`iUz!_JtYY)%&gY1QPq_}73v_|fezET(f;bu_$OECyB$`Xb+M zlzTv+EQVSZ)iLTP4nW;|kR*$q&RONM`Y7969&j$3;Giy3PRL?0C0ms2pTrN09D&Rg zVjL~l1Qk|_bFAWA@d#C1X1lczdkjAXtX?VBHm~f42TWHr4o@XX(5e!@_&aCE!nRHd(Va{FE-?e{lz`M0#PuH~=h|m8W zr`Ut|kGc-;6S=|0b?MqIK54HqIzv22>SZ_zLfJTT^_e|ZEFK??3F=`~ET0&S6n{EK z>AYTiPst(Zuu06vKLB*xEcPUSL*i!f5wV0GTf|y;JfFHnj3J@Qg)QPe{>O|ve-;Ph zdyA?&MEvmr<)Mc)d$>BM-nfQ=Cbj zD$6p(ZWOPwi}#2%@S&@eCAyQwNw$fr2&M2Rjw4L;{p5q9LX+l1pGr3=yXuLW7+E^M&tRp zpWpdjY6}QHBp$)<-X9K$K{liBVpN~wT@B+bQs0iN!aKGWL>(4=t@C*d-od$~d@dY+ zuB&Kl$8ZXJxZ*gS0lk9R~$l~!uPpiW4vWrpDQ-P z%~nCKcp~Z2E%cD_=IR-ZTBt`gDyjQ4YNPJfsDrwV(?E5-7IafrXw+R@tkHVve2q3# zXKK`2ovcxR^?Qvvs|gwnQU_`@Oznv@B`>lpX?&#GNt3lyTWhq9+Ek+*)Fv9$tBp0< zMfK2VceRE_d#m;u?XOyCbg)`Mqw#9lP2QxD>N|~&QUBCvqWV;$6V>|~ovPkIn#3!S zoy>>I87|JArHvYmoy*xQja|Umts0xo+0`1mgtLn^b{S{qXzVJ^PSw~9&W_dCjhr2- zv0FLYOJffvabBX>sf{%@pR?}BYIQE)Av-N1hqIM6_9kZqjm3Lq zL49+BH>!}ce`xF@&feEp71<>9s>VO(;xih1m9vL6wwSY78jIgK(E=KapM22*8e78I z#Tv_RnAJHN%U^A&Q#IC{vtyCf>de0^sDrc!e6Jv=-ESoE>fw_ML5(ALY*Le{^oc%*%!#I0iV5PaPJ)+tVy(7aQPRWE zN(|L45Y2D~(W@8j%7d_t^~q+ZjqlR|aN zOsdz75}Q!nDw8D7C~*kYWtb#;j1uQi-A0on!zghJ)onFN78)h)p}HL=$yB2xC{&kg zk|gvrio!y5c_vYJqa-p^ciJRrWt6lG)#aNc{zgfgP+fsZQcIJJ?+_YrRg-j8CFph% zXXHO&;z@CX?GgN8J40UR@kHlSLOwcw5&l8NSnxh2ZgSA^sFKi6iSef@@Tini=0#3= zbuYX)C4P^87Tf={sMsDC|2zFSXm|z}lcvz&j2KD(Tm%D7i`8J=8L=}Nth_lRwjiX1 z5`0d?9ZTeST={739dNrOy3&F>5Xoub9q4~a%m6oAU1s)WaU=C`yMr4(M1MpwA_IZL zLi^8sJ{}kric;@95nef&IYL2!&P@5^s<@)6S)mzjH|8qypNe~IE&rN>+jCEyRBIj= zLc3Bi!ScfjQL<>Dlh|@i@mMMD1F8zRZ_>}j?I1=NdBw|F_mb$2G#8{3P}5acU6<5C zkW!%;XZyDlq@geX*{ZcW3Q~Opem^Yx3+elgu+UX!r(2*Gq{XleRc!Y56{P(Lu2S4j zklrG|ySC28nhg}BiU=N4VUQqIfl^nUeIwi9f>a&B#mz?wQX9k_;NlAx1?egW^1SN)AO2}V-Zeowi{N^rZV1v32+j|?BS@nVoPU2GDdLeS{Q~}- z(PV-fPXy^Mg6sMJffYlb9<*@NSqEqTDM$wqJo4%*Y(0YWJaMv#^6(jvNEZ>D|GgrS zRB)+@jUG{jNMjLPOst4h0b#V#acd%-LGYNQss!C)6eb9nZ9}952rkaBCDLXD=XrVY zCd$K64n%5?;QS{?BJp2dsj0IIHg_hHC4$SXT!>_gC{MrStMqQQh*THB?2ZDc!sQnnoFdY2%Z?m)YRGN zF6R;HCe*L3t8Nx~fk>?`fM;!;lkSI0M4AM{xmdYEq(fIAfs2!G6KOVV<6`m-yWpKs z+uwppA@B^v7EP_F6ot@ANO#rQc=q+8(qIIyV8zB%vO;kF7}C=wz8LA-#?aASXP4Bn z4VBsC2(I%ghDz@coZl8p zrCkWlOP#4?hv0lz7b-RHLX)(>!8j@%L+}XCu2k|yaK2+7Ds@3{emv5tCf=+cl`Ifk z-UsO*6W^~tm4+a=Tt9$HT@jq0Hjqjw2+j{5M5WOP&OaWMM5Q8A;PzlD6(V@Vl_6BR zh2Z>!p;Wqx;QXm!R638~{Ni{jEkkggjG$5l1n22UDw!iVKYSDxhTwda(NwC2;QU9V z!WiU}Fpz-E7#=|WD$?5~e*6S%F@nq2Al+!0%RK zf)xKOS(A@M`n`$2g|yy%Q=sisDs@6=g(2N&;{Qha0RhRL=)Wa%Fe_MB7yW#gfl8y` zC}*cGr_xM#z}bbHsI&x#2eK|ZsZ<+kB5VCV6Eo((nh9A{GJ|Lj95q#rqeWmiYSgcK zk4g>*?#Q!GQE35!^HU0_Gy}o;yqi=y3p+7ol*gY`YJ}h!u75?Pt%&j&vY4NX@IM|` zl`+Wy!TA6)CWRt2z9RBav7WB_kVkcy^ap~Ak9sia6oT`Y>oMsjg7YUEFex9w`Ob}) z)C0l!hF(naMR5LcV3t930!5>S97j#fJtTuuJ`jn zCha~5eLZz{X6*}@6jK0`J#|iI-5xWk&tq7Dykpo)CN)R!e7^qA63%<-x>489aKTeo z3)(c$`4cag)MY!mxs|i~h zVg?Q1ZbRK5a|3RxxDpgJ(m9wX8BC$f`Z^nn`wK*=7*QT?WAXE1yyZfaOB^iEFA=}k z`OXr!&`9Sb{rJ;AvX#ig7~Ex4M=|GBO*RduA7 zuBBDi)y7mOSBcU^jM-IRXKN9@R+O3{cnV&58_Vk$x^0rYUk0?X&ddD##;-JV#hdWT z5_}q???rCrx1nPj>uQjCu!xgT*p0+|**;SWZUP<8oxm#|ar%fUg0DAPL~Zc#*43!{ z=$tV^(wS+s!QR$f!2;9%blVuW=r)Y^*7?$hx0UVQx{sC&e}fvfG}YBi$}JRxi~>RM z#z)wN$O|U~p#b4MoeH_hRPe?hkMXWVh5k-N=Ybd2YdqaGH*EHO3(dkuOHQG5q|Eddcf?i|`C9^?(Wb>r8ON-<2&cWI{Ur z_-rHx%8CmRmzYp^g$dpm7TTe100Mu{&MgROSP~No!cf5vfj@;;fXMVmgkypTCS)L= zj6a;4i*S3$g#L)a$4rp83=7W1aO5M5JBF1*B=5vZ7(7%jsw8m*Nyh6uU%*B$sHenLSbG-YchjA?@fRKSEH6_OFfHdJu4#cn`I2*HjD z1+~${j+ik%7#BXHg%AQh@y*0Pob*QY$5VO1&j{?ANS+qEAQDlCVFAN#zL<6r6OtnF zhZ~C%v9;r{HHgB|XqK61#$hNMi*dsdBaz1+r_4oo&q3=Tgz2b*D2PX^*kPr25Fz;^ z6~^EXzpRf@8kxA)yqz_Q`7d8st?Tx{(HxIw1NkS$H(_do%1!L}`i7KKw zD`AEL7KjgjBGa+9OHh6faU5HnhnXN>oQ3I*poR9L+mKa}w4Jnf{wG0t@MnDEJW*VmO)0FwPCBfSLD4L?YY} z#i%E69pp2381HGp}(}iZfS{D!>}G{ za&zpqW=x302THk!WOPD34%J*7S$e#-%EZ5*kgTbY)E^zMzdMd;MDk7?oBPl!_anvr z%=i^$*%;o11tRblPzC)S3}<1%2nqH3a~(wHQ4F8Jd4U745{uE75Sa_H5fy70Z+t2niPkHuh+TlAs6QeSt(Q9uTYMOuH3iKdj4~Vn>19dS0)qX8 zk#6|M?~zv6N`xEEppliaRVb5i*tj7web9tBYZc!{*+y*H2K4^bnBf|1;ddPINx1?2*q?Q*x_$iX!Iw;)hen$BsuqbbgDk=PMPZhL?7_VDT8Q{eNLPl=D6Z*||=zJb1>zR|wpebaq6 z`o8u3f!a75tDz!ia)10MwjH)-9ZS5lL6O+Gg94Qd&*GH6@S(ICIzLBZb#p9+2u z{65$v#64ti$cT{W&@Q1%LRW?+gdGig5>^ye8rG_5`=))GmhcMeaR4GQ^M2`V=Hubx z;}hi5(I?Jlq|XmN$v%60uJ}~)jl^mX^G)_$>-&dqO+Qb+CVp-FhWV}W+v2y^FX@Ee zBR@a?&Hg9+D+NRbL>b=ZczUoQcvu!1`fFAfT6wqk?&ICx$I*ANuZ!Obze|1( z{p|d!`#17`^eYrHGE)0%HWB1Cr+6>iqrhF1=+8{Rm4SonnSl<>7!;qBoABF02ajaU`2E@Df>>xj~bs!gjm^==y6 zRKV>FcVr*$p5BYRH+VnsF7ht*PV)K5XRl9fUw_}$zI}Wr`~K*gl;IoY*VWJ3Kgi!X zU=f<;bik7UG0-Kjci@CTIdFI2#lWY5Qj?lZhBukqWZ(a3>Ad50tlv2Poa5L#dvA_? z?|px7duDHvJt8YJqua{L9+53X_6U(x5+Pg2mQ_Xv$>#Td9>0Hj(o5&L@9+1zKG$bl z$~3V6+3q}Zvbg2lI&OD&l)J{=w{^seR>AUG|tRo_T)k1tSnYb zYqNFHdSVr}efx}k%YJ3&c3fwObJHp1c5=tM+uZP=`@qf0vv&99d276r-ZL+cFZ_1? z1pku%kDpxR5KToZ(L*c^&P9ujGp)c!J?XwwSpG`Rtu#ply`~kX znUmS|?3vysuaBQwG!PxcH)6HeCHNQjMk0gwD5VVJ@RuvwLPb*hs+-l5TtO+VgEmB) zqaD!h(2TA1UbNzDJrj-C+~{KrH)a{9jr&G%Qr-=rU%X1XCOwu6*_G?aC3x(xu{zfI+8OEQ z6spJ)eZ#Afh{s17xuV>Na+xQumD4GMlqE_NW0Rf3E#Ycz6}P23&0XsL?p|>3yOq3k z-dXQP^zD+EvwXzM#e>p;&rf5N@#|`CZMU_{-@qEn@X=Z7E)A1@S1u^`L*+mHrJmmC z49*R6t_vmT9CQzcMIWSKT%;%;-LxgzW&ri2mL4cgW2lDZq!)986TzQBgeegHJ;kXR zU;0aGB7Y`JdO>@xbHe%4DejhbeK%6!-9tp{;JL$ZuK(`WwZWNDO2|KG8yCsTM?b)0 zw=%+=>uz^f1=oVd(TC_A7s<+pA-Ph0siQtj?_x%Vzxx3jykFnF_2RflH1x`CZMWW9 zx$OdWF}sZ2z;1320mHnEuSPTC{zq8-V9|S_I^|t`H$NgLWzkVu_L6i{{L`_joG!cEpSTR+EUjiP{ z+T14&ilgF^xGNruS0YnTAV>_fzzLc%8+!zEgKwCRhl0z&?cn~qli3g#naEpbmWoN` zBu#Rpno=vNozz7dA&rv~PGg)MXK;Honz?#o19y3pm)%Zn+a9{%dx6kpIURRLw4Xa0E$E4_j~6X zcQr6IScDsS^LOtUIUW~@rlKpD`nTmbax&#TB~kfA*{@VnYpbn!?kB3Qb<&n=XS7^; zCw)B4xm@3`|D`|GlN;5HkBr{NWSaDM zGjF|j$}8i~^HYi}qJ$_bDvKJTu4pORicVs%m@R$~mqkL57LL%7D~nu(GsQ(B>7+7} zDt#_Zlzx)p<$Pd33ppGtzvX61D7I2hX{Y?5JW*1sxzsYMtTy7EJMz{exUEg<9zgeq z`cQqT#%u3s1++3+Gi|K4Lkl?SF8ZhX6n%;A7`2!iy@0AQ#w6oQW4^J(SYd22E*pOu zcZ>(d6XS&uF_W8V%o3(zwlX`Jy+U&+hqT08VXifQ0=3VY$*qi5b}PSCjC*TlO|zEL zR>!Qrt%p`}JBwY?HtlNm2X;66Q~L^aklM+_z*QXEsphnDx`82IIJ2Dj&L(HC^Q&{* zx#j%JStfT2xrST8t?ssCM1A5;biZ^L#K0>|?xpjJdgVObtK>Cf+z#_5c(c6u%z_`i zBOLR6Cc;}USFFK8f11D4|IXj%U-0kyZ~XMa5cNfKF-*)7E5&Ax{irxEt}%$;it_YM zlb~%dgaJ1{SQ`8g{1W^YTnhdQ{taFRk)*gtbFL&yC>54UN)@F#aGxI1r`*kAX_d55 zIxL-$E=vDN5jmxtMb0btl1IohXrn#y-*R##gQ6<6l@FDVls?L62FYw?m9j;-sU#_B z)$ClIr#4husD0F->L_)Fx|p%FNj;>VSFfti)C4W7R#a29N?Jp$ofh`iLT$44wYFCK zPCKfd*REud%8-a6^IrNC_t=1p?HaZ7uFSI6tkWvm15Zg@Gsv#tIv|D~^sTB5U==AF097#z`4~rFv3VsSm)uTv{VtXF@!YlFOOpqOt_1SS+uT!@cqe z`Ldj#6i_UsBBZFlGE~{5Y^UqbC^wYH%3CFiS{MR3R-FT3UI*L%MZKclQcGy%v?^LX zttp5wOL2KR^$GOF_xdqd)oVSgQQD|vv;Zf@a$esW zJB-7jagmw+#>j7$H2ZL1WIgl2lh3&JpgH&P&fEM{X|9 zL0A+~YA`~FD|0Emv(W8|NQ%zd=h`~$n)a`jpl8*K>YDE8ee^~8bv={S!CC=Ld2FS! zvoj;d+so`d_S#VFjuMB0@sa3;NLD?+uIj$tkfZCP525T<=?C-^`UCx$UVy1k&8Tk- zHbzruTR68{Mlv(KS&9kK05BP3jx<-BTg=~K^>J2OOSb~6GeTvOHQV~m+RcgGx6;^I zZDH52KeGD*!3)t@;Rz1wnVk&?_JEKM9M=SArn8!{e1yS#A99`uv#sT}jg{px_Xqcc zd&hn2X7kE;mAw`e=vZ%o_Z{Q-8c31RFXnrU;LiRh{%8Jpf0n<*U*mu8|Lp%B!;IXb zuox+(iG`vWMCX%WQ5ZdD#5kTwB)3#b@}yc)18JSKP1+@$1*KEVg=9mnEkBT-$`K`n zk})PfzgLbZ&y;vIjjF4C;Ebavz;7wQOImKDs8QCaX*4ui0mA#tBjy?Nq50BGX316$ zdmw})$xdM6lyT}KPTD)+Bq|wVv9Z%Gia@ z{8vq`<<&}~lB;WNwFzL(t`N|<2fItDXVYc9vEEVdk7!ZYO89QxHm>WdDZB7G$-lJ-jXm>_{% zh1qdI{zUmqnW22A{KlBSsk~6~sFoU5Q5UI~)#BPt?Y@>Beme#g_zg{W6~E#wh@}}d zD5eff^}$96&L1?cgYb`y)TU!rG;5e2Gr&ih>Y|9O_mwtEXWDPJazZ($%j@c+J9 zfI6;XwX(WU#S5t0XI6SUmtDv%Z&v~DhuXXC-|Tbf*?1?LQ_86TYiy4YU+?_v6mm_< zv4uOwUE%I@kGYk-hF%wMoVU>1;O&LVWbljl2F}5D|0n`Cj4Ip`9AAGiK`daTZV|`C z8F4|>3qB0`2D4!8j6n$<=B!-`GG1`3Z%wTR5dM-zLj=!cKPMdHv{5^&JvhW^>QZ$J z2l%`C7(HAZQ=*IZDWi3V_80oElDbY3hZg3%$QGvpo0LeVfB*)?{lV`uKo#)H-clrRQHlKQi0J?do=0`(t~69geWSw71#E?ThwJ=wu3~ zIHg$IY2vh_(`P#yoSo3|6VS+%Zb3R-cPqM0-2o8DIXGME+W!DhFXwB%>sRvI_#J8T5Le-}|GdfU+D8F zdAx@JOAN{ax=!#x&^73Z_*xcRi5~y(_{cbpKbh1-8YPXFrb>sTdU88?pgbOlwNW;e zN*r#ej8mpDl)qM1E4P)0N<__|7FQdqy&y5;)eGu%HMdrXvTUdI;B3PYu=qK6mOp5} zX-QgYJ)@pmFQ^yStLrVO)lMAuD3s0=eIBED8=$;TzW@ikt>4#QA;t?BiAH6{O+C7sT6h>?Sy$ z1MK1URC@uE`KW!$z77Cqck*DTRdMQKDRy;6IdhyP7-xsMlC#cb=b`h`NpMrU+1&yt zW*Hz3Frj9iZ01>$S)pRKVIJC*jbtOL?TSh@5@WX=w|b!B&QZ%1=?nNg={pXa7&3D#u z9`2;6++W@)>l}F$p;jutD1R!eup1w%O|@3EOj>yTX#H=!t=HbqA!g9Jk>l^ayo1(J zZvZWQV@&mydFT9lz9g!ML1M3n1SNuI!9eP0RHg7u}MqjRf8xbZ3spI+)1btW2bqxz$I z8&_1*8ffjcPq6fhW8g=dv!T(90Y2U6VxBWwGl+ZJedwYyP7wet?2g;@6I|u4``Xp% zgPmf(h$N9^QQez)BnP2XNV$j-O3$?O)Vk_GF6$fh4`y5{EgR;It+m!Z)&^(`wO!g} z?U|NOFGGpd)7xQR&cq?vr>8WE@DP14bkzcKM%nCal` z!Ww|aSq5tFgQY!3EM$f>v?gAdWAB2Jowx7WukAt_NUjz=cK-c1;e}M{Nk|UrH8f%w2y7X8j@60)poAPT$H$ z(8XtgqBulHIweai{i=xK>#p=B0~@9+#=VY$(Mh!5B}y|vO|53cd@$AF6k<9px0a|G zjG2av@Sa*f?K5qhwnE!N&U6l$a-TX$t7q2pgxCxv5zCq`^yV=CMf&F0kolFs>^j!k zKl&4db4nvKx~3G~uZ@6iNrX1Vn1{Kv%GgH3T{n`9=SB*%45m^=RKhTG3;=f8yoY{% zX%>e``PLw7rnUV48sLQWh|nrMTClJkDz**#uMZvQLaOsQWwy{>Zm))5?YI9X%X&?k zRSdaQ(`o6nVFV3^q|SzFZ6dfi#t{0;dG1tm3o>G+c}u-_(}a7gkSsEek2i8fB8wlC z+-egdw^=xz+tq{6n;YtDH7#Sfcu4bf(k5al-r=U-awxet4UhI|%;^1G|3yEnUm`e6 z`+q<5pmE0d*qlPQ$W~?RGwkN5_Mc_{2z5zIUKkJO8|N+eR(prMI6sRYA=DksgS_+o zOUXOrhm`8OD042#I{Z`5Zsb8Sz6%ew+CM-n|FvJ@RA)x_Xik1IyteLX44CZx9&tqc zK{-7Z$%AxE$vkw5LP=E#Y6T7OiF*d)gDJ#0D}zn=U58>8{onXqk+#YBlNOOkg7nU) zAFOOt_9b?L672G zsEU7F!3nEjBKLMCIlF10WNsfU*Gy1`&uGJy%(OG!Q?C%ATNz)4$5rsF`E~r>{v^O7 z3D(d@4Cf@&pclygRj>tzFVg$no2HR6O4+2mQYFBBtdx^!-&$@jcg4mV2s<7LVOt~b zLo-Vu!eWWCL0Q4%`V>h#j~RG`_swOt7G_C7lWlV7Ya`St# z7asKfLlT(&WCFzvh^ia^&*$cfbEE-(ioeAp@sv59zznOxEsqR#;A3)`!;?jB@KFZO zzaOTW3h(d7d(D+s%l}|iWLAnRrZNKJG7-@^54`w>jO;j+G>2MK{Qwv3yxKzhFx0x@ z09=83roc3dnnlrfzNr_)zc|34$bii3V~#R+m=P;EuFiW_KC5s{UbX`@=P@T6kPPq^8mbQU_@QuGm)TDB=4{ zDK+7H1Mc|~d8|AO<@1;PT27&)RmyS2EurK~dG~wDzXb7^>A7sU6g= zYEQMlIzgQRNX%!JZ&i1y``~bwNWuSB-{RV)(K2g-gs>lIu?DO0fcB4;QO~1G5Ryjv zNc!Xl{b&7G5Ho>l@r(vov!e*_*Bd{xZV+b{=Oim5*t?sk#f-^>PFx43nrTn#;<;Ayy8q**U>41(|vbXE&pp$4zt_a=6{m`&+2@qwZjDG;jF} z;l*n&wV&O8-(Sp|p75{x`9wJpkp8s=x<-ga;#U!#6d3~xlcX{jKA5axday9~mbc#@ zefz!1Vkt#N-o3N*i4-C^7h`UxihCKjpPu}v9-MJO7~}kLP=WkB&m#DQLGw@q`6PEHZO7R+lJB^dkkr~^K zk@9_}|DGU=9wU#Loo`G zj!}Jru8uLKJR0*wsniA?+3vn_T{kwwUa*wDo6Kzs8DX?+Gj)!Q-RBmyGPjuhmB!E-IOC(vWi4Ym?%|wVC@y^4f9(u26%&eT< zu#klQH%jQWpIH00C4hoc9Up75jrS3=?++5c=UyFu2HVG&mGT&*g4aH2MK_SiA0N6hZsC3TwcM`-?4 zNd6r?8uX;H(pj0TtYis!t%5j*iB=g)LS9?MSfg=SCz7Si^va^#KWE`#BNu!N>-3R$ zCf>kR(;#? zn*WIHD*+JJbH|}be{v7P!!xqIQrY_w7dE<5*HiRkS7kW7d?Gg5ToEo|hhn|hN~phI z{DymY4ejv{@b?z`E(;NVQNkP>c2*Uo*`5W*cXwMAF8+a>NV*U(BKv?Xo6y+%)x+vp z$n!16z!OZdlv+l-szSI`8sJhztE=@Usa{Q9|4_@ra4ezwq27eV`3dGsVP<1{W1X=Z z=6sxWo?9&RJfhPwnz_sZs7;4%tHJ3+v&i;jk$ubo=4a+uJcl`))za85%O)Uo7i{G^ z)sV!>FyIx)_iBXZAAxGSA@B{*AmX1q<&*&5R~aJ3ydz zp6dAv;WwPin8#{GboJ=~sqY=AcPbW(%6gVpA@u6QkGpt_y;ZDho@Gcq^NN5IyV)Bn zCp7V)SSnW0W+`Ybmto%rQnNoe8-3sn39%jI7E{JkhETN7*zB6|}er$b&Og3QauTlAGa;~kbrtBJL)OSvGp?SQ-o zBrM;s7~%kIEui{i;2K}5Ymu_oftH8r3v^lrP1ioudTG;fbmHN(74>F%H&(%;vB^z6 zVx%%MfFSja*2X7jv%N+-s;QmX*KA~ktuX>uTI-3Zf3jpU>5BGxwg!J>J0TM{S{^UP zhRzOhK6A!6zcF#sxtZOZu~os6M1FJJB?y4>p77o$@M|8$h~o*7HGH&`KIV0%av=w~ zl6%q{DU)1S*5qpJadd;XPbPFYFBcB6slLF4Pt<Ra% delta 37246 zcmcG$cYIA*_dkC3+UG_P$qDHqf@mqEOC?H(5|R+Tml45;8J$RoAg&M&mfm}r3BkcA zQARH@qmC8^a}gtE^p@Y+=iV6Rd7jVruOF{>);epi-PT^ao_%im)>`RXYprC}a^7`H z(3$@g>Y!SAR!*loFX?o9EHvp3r5YO#9<9*UULT-bWVKmd-dh$bvB!A<7FM;{t-L6o zS^$pTc}ew$F<9@Jcik5ltgfrv^6Qu9>pzd#ht!dD8ON-0*^?&8QnJpF=$c?$t6UGL z4;+YI2sZQ z6ZR%ODI*&L@{}#Xab`s}NtqDr>@aPI(Chq_-uF9{!3{p^9acUxaP~g2o$G9N$92#A zWn{1+x-ia^;&zf|jA^4AQQZ(*7;lm-+n(1rB#N>3%H+^Y7+Fmz8@9>uw7XXNBumig zl6BeH#UD#b;*C3%Q(-;XWu;E|Xm(3k8SV^C-IbrhJz!Q<PESYRAVj16y zSRJY=o)Nv^`>Ki|V!Z1pH%-To_#wMlMHXj>wT#c6FBB7uH8iYHG?%?lvZ6eoU1jCRs9H`7T_m01L64(n z&z?;*6eWL3O7hmrN$G?0o<{WqVZ_*`4Pm&GlHIf#v~^N)n>GVWC*@VsI_$PmwV4;& zp|oyR4RRcnZ<{5t^?6sDB{GP!&#Tw`4TFxAlsYkIU|dDzWlRHztC&}>vt+Jypkridqv`R3h>7+cVeJut}%P8I*stWDc4ucppw@~&Z)`lt; z%H724&_u87?^qk0^~!^e=h$f_uT#A9ApY5WX8Y-UH2W!4I`@S#@AD>gz5;BW(z#o8 zKACb!?e-F2#z$pD&)U%EW8Si!4&buy9WQNy(nhFbPUKwgj?m>@Ud=uYIM}{cdiJj( z%9h%{A#+F{EXn;>iJlpkQDnI%?xap<^m(sb9Pn4Yy)VdLk69(@(lv+53>j5Y5@%dv zmZmo}xmj)l;bz${l;_`cV5-u5;2`!$$sITpMm|xhCaokR=O@)+Yn4YywP5I9itV84 z?35BX$dkE=04V=BFKbXS1756*A6#3y{Rh`6jfYlJ_6}|a^Z!sv1}B02GiA__+N@Za zGo&lqpcD<+3s;|Nq8)h`hTevX5AJbYl1}R^N$EBgvhiTvp_CO2+#V^tzl&tQ=Pmzk z3sh=(`(IksALex*d4^RQeDhxc&F(8rmi_Z zSL-{y3l+EVS(Tn#{Z~TA?kL?y?p9JJOmNDf+%;o<6>;3{JSlaS1-qdr8F!%ERb|AK zuCU^YQZS{mXrZT5G9r z0n65Rahgiuq6tbfxuy-PDLWPG4OQ57#d||dDBnOCcBnE~?^IGY)MgKqVH+Ite%wGK z-$`ZH#`f$*UfE5v00!hLi?$?yZLack%OI%bt90J#$=)d$TW7)G`bwp3{b1@3d1JO^ z1ADDl)DDt{2SoQvS-#W*?RG?d=^md5RKQ(vVY$2AphDf#!KCDaRbG z3j@v>lQxysNEx=!gT}MK9UW;TGwg5|-mz`ReC`ys?(0gK<_eE>O4r>Pkh3=L&Ta<= z)7B`j)p!V8qqN#{&8h3^{}!d$Y7vFyDhKzzV`TY#2{3%6QsJj{j;B|At#6uGXgd07 z3b?OO+U*Z;e7F2-6;mnhD~tBew2YxJ(SAyHr&_R_=mp}e#5{n5F6v=djXA9^U> z$9x=XIEjo)TPIVrPMp!&iCU*JyQj=N7R>f3N00S$Y_XuU0_LgDT=>YJn}~M)+1~Mw z`CnCG{z*zI!FW;G`tv+kYNs?gUWfgq3_kA4UMka%w}5O%<>K+mkTXyD^LPS8%*$(X z!h?Z>U0%{jg~6nXc^^-0VC zZRS^XHaqvMOr`j;AN(YVW&?Xmt-Cp8mbM#vmN)B4J;w6$4qV*~U=PZm-#p;n$i#~!f{Fn<2ouI&-6kcuu z$IE`at;_h*Hv7lv3chf<{uKV7PSdG-R!Ee z{{FX+^jdLv;0Y10l_n1cF>;d!ym@S_t8cWTz;znP?76O40a{h;n)+~v$Xc*Zf4O{O-+YA(zHtzDQc z^k}ToLuCe0ht-Ca*r&gceEp=|7_b&nC8LK*ljHFU^RKjUQ;!~gRyB%RvRh?t3zs14cJR{dM);h zL1qAst-}J@1^l57n+IWeIBq9%!Jc)Q4Ayy=QkRVdWd~N<#hg{ilMDp&>ziWS!R6i* zqt%ZX=)*k0?MLkG!^W~T_?r)F5AA-y`t?`??(lmW5?5YM;jJvBXxY zZJM*)z-u~jbm_~gVXc;|GW=8#DSv0|-jWUEp%pnc?8ltc+b!7~4%yZ?JeI9ukJURE!f8eqgXv?`#|*_#d^sw^fJzw z${Zl^GH#m6!rh!Mn^TOvHtFpbNha=0FiyCHFpYV#0?e7p9N8W@4!! zth4INS!_xL;D^-lOIa(M5H50>1k2P!*)ZK#(Rx=NLyM|SRd#Z@z zfl+H&#cG>Xt!4$m%)hOG6CNZ#0LG{Sa>~#tNI*F2{Y_ zwWL0;8BJ@SwRn9KTj=^B_p^I^F^l+WOBXeJGow9h^e()=g(b5e)OK5027}Gpw6Z$3 z*j5_VyiPU6!pI-k45wXNzshvJSa~EES8T;QKd>sS5I_FFYE})aFO+1P-TBmFwLcfo zw1$k_ij9Ay#<$a`gPQ&$vtaBMPRpgibA=b)$z?Oa)(eMjXGxIoBVOIk++53SE;ZZy zwUlGV5h)=%vp`$*6rt@7)`Uji4m+3us%*l$J6Kb84QuAH3D9jLuE`_s_1cKP=CO4k z)e&Q%CtRy7hCvt1-^qGGkJ@4^On|brwF&G+Eo}mGI=QaY4(5fu>}N9Hfn78vR(`%o zD^g~@&6E+0_M4I+IzKKu_E@}eE5@tL4sb0FRGBvnT8r~l)*Z^P#lKZnkKMrPduTMB zwgyMf&Wu`X{2_h>ri+h=tnGN$N6W2Wdp> zy$szBvO*ZPbipCEMU1%H4zUNo9;0%E#X|N%ymy2~dy@A!%6~z6tD)6k)w_;VBawq7KG0(vbxYe3tfI;S?n~f{e=ZVjahi(7j`0aUw}Eq0!q=4 znftJ$%0?r_^<~*lh{kj=}JU%vD`=k1gcTbmRtl(w0h*kJwHIh7|n!F{=Z8 zQn1Ps769HUnDB(PWOvo2PiUD01HVOlO0(H9HS|wr#hHrDpR?6qm#jX1&Ncyiq|ST6 zE--K&pbmJ&EC6i#;m|j%uBhl6ngqi7;juT&o6QuDRaN;d`v$G9y zz|vm0@C|d@{egAUmUBHmG1`Hq58m|@G9-3W9j=ES0A0FZK^bs?iXGIVGH{(SRXtu7 zh6DQEIn{&A!52H4aC{%~xP&!`Jol7?r}&WDn0i2e{~^vTD@HK7tXaZU}VFIhe-8Fwr?oDo*ewR*;|Ej79%qLRW zndz^^#_^`QDjdQXRI7@&BH%Q;j2j~%8fI5fpG5-b!Qg~{H-S5}GXAwGnH>f>sP@r7 zho@!j)R8UVDg)n&YTK3&%wUYII<*y~SUXMyQ`UA#W2max*(9tFa1XK>KJNl{ z>@`|+h5L?k>41zDI>~lPD~0ZSp_^d*faF*AoEMb{Q;5KwUnInJpnm8ELuniK7zYoB zM(ikV84kOl@*}n1chD9r_djIX0tp9QW&u3sA;T4ySrwi_%pqbR?jhD22~Q#60ah6W zUBKc2ju{2RXjm|gf~L;#_f6TB7^l6X3FjD1*rH>5-B+89h7Pn1#6@F3oVuz9#y}^| z;?RBq_!Ehl0FziAo}K_cu;dE9oj@y~IGmJ9ZZhH)zE1^lK!Q~!!flp=A0~o}YwmQA zlNmM9u|Fg^=^Fhp{ys$HX_u6X{%J6p{fe8@sEA{4sQPqjU}~U6lOU9DzRqaT*O6UE z@5vCz+|@plVG>kzxoRr9luakUtB&0-BO9!Kp66pBiv@=;YbI0?-kk}JVd)jDG7Wri zb|&0)P!#?)S<}~K3UL}Hft9#YX-!C*G2qw26emw^f5pdG%vtC2B-=(3-G!D8Zer;XHqxY zthS#?U61cO%kbqo77v}ys!p?EAcNF1I4K8QT>6~R>XVWBLN}_Dm}iYN&)$zWwmhTm z%7Kmyo}UtmmC$`Ilp)*HnG3bqHjJAKD!e@TMbLHhP-vk{1+6jS1=`!<2j7*Zmgs#iZG=37@qjf$8EP;C9w+H(zfrjiXu3iE?85wdZRD<6R zea=CW-Xs`l)L9B1u;`FFU@4?Br^N@f(tn=7P0O??2k_l8$Y8}daXE-1Z*|#n>S2)n zlR9xF%ws%xFH=U|Y3s7r0c;kIsv7i?yhSJs%) zQc7|>@TdwIjfU1 z;D{E-p*Jj;kL6ELXJ|hkw;ZRI{Ts`jfF>-LmOYSb!AkJcIcUprG4?zx1jlUr<2;Qw zSFrX47{|Kd!}B!vxXe`VUw|KgR(HxTu->ofbW?r0YwxiV7bY0DnH>1y(?aF5xiRAjo)=nvn=kUZX`ms%0~Tn0PGffQu3+cNXi$jbDREWs3* zP!VTdhA6vYTT?u*f8u?_!pmUK{=iq4A=p00tWf74g=Mzb_zKv;G+XR+g$D0uIO_^* zg~>8TTm@&g0Xtp=H|H2xq&(9mV=cWNFeJ`2XB;nM_Em7I(SU-pQbG)|GtI@VMFKL+2U{y9TZ>)do9XqhVrz4UWAAvuO$~ zdmTE$vdP%zIwV2BWIS^nS~?piX{kKYk*_?8qMd-r9&;+FKEKg~&Q@Xf8;}CN>3IGI z^|LK_?gmuGp*LZ$vqze#ZKUk%{^Iz+kT^Z#2qYM-gpMYnSc^SrcJ#_P-I6ndK!Y6V#epLhcP`8{b{OY_bA@g}D?b)8(ZgFn4P3zE3; zYP~{e0iM&wYRMU5r^IJd`(#Jw#2LT;T1F*}Gxi#bEAD|8`0LfP_n3>5fJmZZ`#yMKz8^|7}Cb&;xLzHEBw53hv4AP<~Y3U0?O}?iYsBiRsfOIGNDFAHI-wr2#=A-flG&j=_JuA`dMd`rejI3LBGS{kH8rcKH+@!Z$A91Hsy^ENo0tj z>U>=A1YFn=to#J3R!w+E(vwCn;aJopMTXcSstaA0&<5JI*yRbtG^|WfHFw=4vi=*T=7oQ=?XD_DpRgqW*yhn16 zU}*dvQ^~2J$$MN{1THOWeU4q~k#?VBm--)QI+k%p=V2xvB~yx~CZm4#Y;yS`aAe2P z@hN!2*mtnUwhqenhrJ7^P!s8x$G8#&k6pM*z&g+^(V9e-?upHPiP7Hx0<6> zen_VtrH*#`t0JC7+h;U8?Le<*wED_9k+9cbF%s4Qm)Cf#n4IXyE0Yr)eWf{3s|~M2 zt|EG=6U`@yDSD|BWoSB7>BTe}(LO5szc^8^R|}qk1GIRB_#C{uzkT_Ck88{N{NL_% zo#Ov@_d4{_A@>?S$mCwZUnTgDd%3;D z{J&`DLc`eKViVpr?B87?WKLynxBAKL5p~-Q;s(V zr6Ue5$FDhs#%Z}FnXmI?`bLS}SdBRBR-Q+KE(RBu=gnbhJM^*Q)gY?{>aBP!h&Mks zYoW$j@!1TP#p2xx+zlp0tIV3W1#oMv#>@Pi#BQrq?Rk+nR>KO;{0T@+@SQXF5nD(X z9tMjWV}BPO3cVWR3KxD7=11W;S00M1EAvCnOB!i~dty%;(!`q?M>v_VAkH|YkxDu) z07;R!z>U+J(nt}>9q+mEiLf+6?OT-(WOf1JCc}!jrij(T)m!dd&&s%jX+h{$gF7Ls z&I`aRRQnloxN! zw&D>lK1ggXeZ2W}1}*BL>chLy>2RfbyeAlZa7#U273bFDj?i9v2x{!=qh)Wfzb4KN zqR(bq#bw2wO|FxaZfhZHr^N5PHH{O|G(CzAa@H&QCJjM1X)L8Ni(bXm=kbh}^I~{; z8%t16`110MZ>~#673bF zjSyZe8s=OmKPYH+7@r17?&uKC&s%0yrHNkL+h{YTHmizu5xlK)d9&>EPI-@$6P*EP zc;NU5UfJ=Xn^x*1ou#(5&oU_t2=2P9+br`bZ^Lmd}>oH>KvM*Q&*dR@`*UbvMrUGu0CcK(Aid;@jXs%$m`Kj z=k|ttxLa3OEoL^^(cDc=-q7|Xg$c&4b{N%&T;>UGY{VCXS7mG##aqF*l`$uZC-B8C z;s_`a0$kLH#=Jd)g>E>f3Ackz&gurDj19q@CfuHR;rb>#0tm~Uz)+R1Cbk;&K@G0^N}1*+oIiSXy-zE%YX0kL(Ga* zT9G4yos7w?`Fn7*!GUe4r+HfA&X&BLONIZ8*xM8l55)4W9s@{$Y?|yur(^fYA&ni( zf;uGlAOuY-sNrq7Cj+#?f$eyZlYt6DQD{=BFV2d@9Y{JWYGtMFY)57kXISyPvD0a> z8~v)oOvFX+&VUj7+MFr_>1fd$=p zv~-E0V9y@h0qghRwpxU!9_9$Nuo0UYKN>3itN#v%jpXtryFVx4$Oor$pdi!WvSZBo+n>I5|warYi0m7rLY%-~P z(N3?}Mvb=!Pn2ykt;KV6@uV?UD_BL!FiUJT8hKIWI81IQY!YOhFD`f$!QgD(l+-xL-e&cW2z}xLu`(X zYMc4Xh|bC41(cY74EU)RuMLLR*mDROtzJKFSLMRR58`z54O*r4(8XE4G1l__8NPR>5ZE^9|kXU4P(Hokfi$1&P8JznKuhnKP zi8YrL=O$BV{U;0?J3XFUGBHQHfAE6t9~6>HW~AD&k>w4s3u#7tL`x&;Kz1;aP7I0+ zO{}t_&pv96bg{(FJJ=K?*<>!$+Op_#FPKixrLG!#E#6q>1vVbYo$8qV-Q?NV;*&v~ zLYOiwRj2*5@i>kj$ivfSQ!13T-X=3sq#s)}X{^@EMvN_0rhUAzzgUh^Rj9WlTN)_0 zFH;p#169&Mnk1*ur!j)DSNvpjQ%icH42PwDrZ{AZvre zn~X;+EB4K!S0Ax&5+7q3`xh0D=4mu0@nE=p65R)Je;P&G58{2;Sll&;KP`VlYvoJS z$`^54GWXR+v0KSJ#CjVIM2SYzD7LT|R}Q0fl^(FsVD3oE<4%LQr|o8~NsG<(x0$jS zZBn?WHSL$pO*%c!n1ZJVb5~bkV$+hBtU)J8GlFlys|AZpY3-x!C2uL z)*Qkcz>6Z`^R3x5+&qNWrL(3>L%0XqgKvk>YV+bTtTvQ7#&bGt9m##La5%Tbl%c#n zpZrv(%sLjxy5g@xY0!U;KHu`c%K!Mew(I_n+LkZUYD;e#8V;t!9gbkM=|5e>|T$RE@V4%@d+jm%dIIrnEg_cS5BGP8}Nji6y zjz|Blotzj`^R;R-PrNgd*E7|6=Wre&ReMB3WqK!ncxS{*LuqQ9gQ?$fWBL7By{}O# z@4%GrxsTS$%f6>p&i$g5_xxe1_hbC@J=Oc@0dyKc^`8B&dZ(FMxx?prQ^(E086!$t zd4ky3eBH`7MJw+g@vl}cNHF?5#0Mj|AGq8X^>)PiBY7abJnBD^$5nLQuemrK$W9b9 zjnQhqsn%Aa*8Sn&eY`l8+hO7;zOKBaRZt98?@&M5JXqBq&4b#1IiEVyL5wz7{g?T) zfv6?TKBoDU4*RKR7lg;!*<@IlLMDwf&!w+Wr5qB@{A)0A`rXvw6OScO%{JAiHbS<0~N%I3PSt$_YZK* zI6j`=xue5X(cF*kBgQ_0$Fgqfn(^F=xi!44#mhKwk`~Uwy28!}#44H|o?_7i-a_-G zfK=YldhHj!WOdu*OHWOG$Z@Bs56#u=`p<|lS@R{kP9!chMdn#;jeZ-wC-Ul)xE;2g z$g5TR!dNso8>iniSt+{EMx~cBV))9QNDI;RxMw1F^%Ew~+$j<=WD7zg?dLIP{v{H8 zksKZ07)!8ZBCkq2k*aAl4feo3Y22BW#qnu;F5LZ1Y3uEXHPd;U8X3o2v!d^3q~0$X z(L$_hsNA%?(LOc1Z)#E}oRv;1{epBJNQIZM*CbxKoaS`J+F0y8iI(`K0mN8g;dHRW zd6RgQ1Bq!M7pu?_&SDW*lK4hw-k-#4nUc7#CE+redzYmEy6z%I_jZ$c2KT(CQ|uRX zq$64H3|_fRem0kVdS_$X4DMxpjv6i5omPF~meDAjmceVl5gXi^!E3@28~l|h8-Z^# zcr6x-?o)`=!WKlJ#2SZ9p=En>ygG$@0HybF3T=27phG6FZA-Ur=)bLjUP+cD=8NTW z>r9?sv2Yfbjf!Vw4jTWV$bM%paycpZQW07+C;f&XJ$N!LDP5*W`|v-QOTZ`$4S$u_{YoRMnPAU#|uQ+ z7<@^=EFN8_^ZIm&rOk96BekSfLYB>4Y6{;!8J8q-5tlB-mbt{WQlGFGszNxSXYn=7)JyiTHu(OWUfONxMC(32XjR;`Du&Z!dr52e>R^? zzTapTpXYW`_zbQ5#fxh?SJ?Nr=rVM5hVB&FOxc3ZXK@F5i%-3Fhxhy39I^ALS1c9IhB>?iE01?_xRdjDbd0EFv!CK#qrq(<6`S6- zyP!OWS78xYj|lwv0%Pa!hU^ENIfsYaS2|@{9+jRmXcRBZ;k7G2Tp>nTS8d)MA-uTN zljfQo&ecKNxs+l(tUs4`s{Cr@|Iq7U(u3vgF@G+91N~RwK821tn&EYY*M)H_P@2cT zb6HZNAH?i@nkBO z_Y-=f>>6*ZRP(8@hy_7a@^L$sUxO4??2?Lj?f2`m=ScT3xriqPKg~m1*zlsOYWS4nlvyv${zow<8?D#Unzp;zc&#{vxI14Rx{j}6*0W}qm1x;Mc?P;} zAf>k0ZUc7}6&|{QPvkKC8b003KMBFpE!?1o`xn)5+o^G3S0XOjL1&ihI^y0PyjsP+ zt%P+gpV%Z(7p2QW#&|5+K|??^TISKL5rlQ}xOas&cQh^9FdJ{RRQu%7iJ9}U{7)q| zy9+XZvB^{@Zgys8?aEi`WR>malNda1f>TspxB7*+PbGBvM7vDmlryHxDj84zBOG=H zFQ|Ml^T+T#d^%ijhd=M()hlM2#+|tA%tGxp?z+=h^b;Li+U});kKdwj-d;W&21a3- zeS93ekHw6AG%P)f#UJb6T7X+9H|JzqplFoxs3eY}Hhuvu)#ys4!bj4giRO&G@+ zKXGq(*ar9fM3Ltz+Xa$jm3e0q>7^C=8d4)Hjz{V^iW z&JT1Eb-wsZ8wr|+3v1FP(Ct1ZFHO?rFgkfG#3zUN2YC4hKFa5TFw7gP9_Ee}*BgbF z({X+8A1!1?8AoHxVQR!^Ogb!1zmMRS!`#iGJ+*>fZ2IGpmi|Te!g9}34n6VCVP4l^ z3fapXw)S&aRdhSTyO-b5)Km!L+n+J>2=7%src`j~4n8|V=h^exq32QF0hYhR^rPHG z{;RIJ*jg6%AK~VsyeYH6KabKHeD`a#JVxV2FxEcC>y^3M{ZonY$N{zcF>VDk7Y;hk z>sD=LD~v0znUGG`Vk;Y>UFjf){?p)1OT2Rx)$PZ*4TG7(@yH3@*E6Z6mYt#4*f#1@ z2`|nXY5Amz_zJ;f#Fn3f8)4g%)Bpz?VERekvO@7uF1j_1RK}BzD4(JOoT8K5v4ZaS zXZb8m?(?OngITrrDeh=Re@c^Z!HiS9euXb2cO3B0DQc%p4(iKO+`!<&K%9JrZ-+-o z7<85|rirQGEcu}eRys!~uqETL*ExO_nvcSU7s-lYRn1n^#Ze#H+69v?(spWY16+EZ zj+_QHz@N|aMzFCfT3q1n%z|zYak~871!FGoAo#I2rd{A2Stq=5fwHhe=K{*&?PwfO zz^}3>jJ(Jz%Ym+6=CHn_DTkSXxcVaH&@T|rT;!u*a3^f~3r%dt0xEDdTVg1U>K7mn(< zUwJ+Q-C;H2GPlugB*$LkbmQDb4Y5h}CQ6c56W$Pf8%y$SLPQfu{y?-V(FueG%_P}6T9PLb z?MieS;UM9UrjmS#aF|eu!bTI~NM1^t5g*lDlD84gH|B#$TjNl>W*#|i1t{UuqV5?!Z<*91}0bb^pwAvjY;r7I#sGY=^v|F=kS z!)SC>o89S4I|}n><`47ptzm)^XSVTPp-AS@SQRx9l8P*oMUY#WmLE}41 zt~GN=DZ8a^8j%r%A%y;f?t~76HiTvaaBgQQrjk%Kl!(+f5_S?!;?vI304wi-BH;CP z%JU}n>>{~1_V!|7O zj>MJ(nNVXO*6S+8*qJhlAW1Vq2SU<7bw*dopSt)U%?4HGC22Y53^LikPSCX^DH#Bo}=kGk)Am{Umi!Dd?Iz+@2KdbB)Kg; zH=ySh^!$?YI6-;jrjm7sOY*n$97WG{QYH2FNNEv+@F_TUw4}O>$t2svT4k|-{HRCb zVnfD&Yq}HBH`ivWt;R?*02WWdE90cQu;P}wcf2&y5>n=c~ zsnQrd44j9X4ALa1vq1HpDIMb$TW*r6($rV8rC_Kyu@-%%*hOs8=O3 zR}B6v-)xfC#Hn+oaO+1kP5LAHknT;qFjw+)-CioIOR}}453VJnos0`qdqpay9~@CF z7D#V7JFsA}lnCkTvD0E{noWB*+EEpk*l#Qp7w|YfT`bkGEbC4?NjGDAbXp?CxL&M6 zw_ALTr!`_Y(W~bZyY@!X&~-8HRwpcx`m*xvT`7V?PttmUkCsYatP0vMlRlRHO{7i- zB35`|ndFJl%Oyuv5qm6`T3Q)gbh;Bd2TI21g*%o@lPkGVA{~t{DdmpFLhbKmY_US> z>b8s?lFr_vj%<( zEFBk3lzzlUU9(Dh1MDYUx>h<%OV&Z_q^@+vp{V2K9 z+0=j^rOE7pYWz{^1Z)LH?U1Un1nj*-@?bt{<_@VHvp1B`i(=YocQiad-rS1rKaT8Y z{0^VwNwuq`(`q@(!q8j_*BhCIJi@`y+|p3treq;!#-vbPKVZO4=@JV-%Ux0m`v%AE zlA6=o{rp|hAi5vmxtnr{!*;uAsF{J2cS~W_E3GXlIdwGIF3G8(UN&BOOgs44!V+WF zFSIs)la+dtc1gE)Q^9}2lHF9cA=plQ?_3MVsZut5qG7p5a&ubwg3N#PNzIHmB_rJ@ zz0d!smq(OoZ%oC8dn9N2{;BgGX(8*0&-X|z*cLT(uXL2r9_Zsf$(8L!m!G6>ofGIv zOP7pwg;YCTa+~bT`@|&c;*1S()lbq*>mGknFzu^*1)S?fOMSzB=@1=qwLTz)*bTo$ zK|PLkG>o*$d^NIyXm1b11Cqb(c@aXdT&iSzDjapDBYjlx+W~1itAsNTk~@0io`ce2 zs}FZeN*P42ERAP0YGpjC zQQ7#DM(vDw8g(*m5j5DiR(o_eF4d@qah^u&7-wqK+c-s|zQzd}4K$9>sH<^^MnjDK zH5y^;PBi0KR7u*XC}X@PYi4Yz(HLW6jkYm{YBbL1r_m0^x*F|ltftZKMrV!oHri^m zzp<=FlZ;HGLyT{)iK?X-pKEl4@sUQy81HIyg7G@hG*O7%>7oan5#rrb1e>q1(*?Ur zV`mC>v&QBKc7?{y6YM;VT`1Trja@3(i5k07u-|L!TEQl1>_)-%(AfQHf=|%+e8INR z*kgi?&{(m@Gx}-lS;5vKRx5LXcyiJL_6W9u#$FRFXzWeFzP>6dRVdgZjlD0}yBcdG zHqCfNMV`BuHPpnqx zHsWcA7C=|dbjA%DD_$=dmuhTh!Oqdx?t-1FvAqR59;1#))mwHZNf&Ksn@QuD=#tG% z63cLXj#(0DlK6(}_n0NsHOZ*J@Sy#gq@z*BEytvqX^$^!$;sjRg=W=jCW&3ReyLe< z+$3=d*RM27cA6xv;rg{^$!e3tJzT%hEXgrRJi_%`&60^GNl3Up-z*u@)g+1t*B>*B z%#x^Z{YkSV#-!6MTz}Rq2{uV$!u17aiH9Z`)h0aXk|ybBtcaU_rV;r$p8i={V}F=_ zch7Jv{OAbR6S}kH{7>lfkneHwacP}X84>g${QZce6JeaSfctaOKdvFaA4 z6iD=a?k&s_H0KuP7Dy|1|01o0+6A<%DJICbXiG+jBT#S9{#}|uyNB75T<&KHpSxH% zV?lx5LVbKmT3pd0rwr+3sWbkNcGz35o=(e0Prdw0mJnjAk5aPrrX`YW<)xSN7HNt{ zKGLe7V(ty`Kr31bF!5?VSN)$%f1!y^zKqq}^p*9qo9g8G*jTVB&2;i8>_cqDfVMh0 zlt5p?lt4S3Y}pQHx#=DBOXGC%YTQIBcE@_^I%R2ctg3wF7s*^Jaf**ZTC#MnwZ&|35tqJ$d@n_NtyiybV@lYo}B?!G{ zkEvh;(!-|idfU+B&vf!xf(X3-oN7-Hyoj7`rsDa!#N;~!!T(j3$#1YqHLCRZ3QV3v z5Mo;!COZ;LR{GVJ$=3-YWOhYHZZVW1ge|aR@=}5j=h`!QH$m_sza%pi&xuY;_`cPd983^lH9VMH7b{fPJBD8MWb!S7 z5O1x=`GZy*Tq?r)jApCEWq`dnfJ70**= zFnK0H@R_TbY`|?4UB51u$y@MLb#g}6y-co-kBGH;lTV5S5gAje>FxCQjxpJYb!+G= zTg07ba>w)NSwrul&$!6sEF2`nCw^t}xnD6^h;x2p@&eo>#I~=g30|ADn^}R}3LlZ! zs+|qUi3BZ&95=n4=ePAh9zhTVbgmC_Rf6DuA$rZs>wH1B@Wr+sdWW@KuB00cbfS&W65*`A>U8*h?(~u2eLmw$d?jbZRV}UgItjyQ=u^Wg!ShUT^~B zr3Aqn3P7Gi5d5WUApeHjC}wnnXCOxsM1nh>gS>}OIzkqU?GXJFVbwX8>ktGVZNcT% z1dT6CJeIAauRP#IEiS(!2=T?*T)s*W{JlE#E}tOyD_&f_Nf3NLA1)6f2tJ}7mzxj- z|FS-p-xCCX$(PH&5d=RjfXnHaMOl@J3g>e3aE^m(=$-Wm&AHqePmx@|w*{9E;Ul5K z+i9j8WAd)f*`gBLS^X}V{YzGT;5F(dfg6ixz7RY>8W?HcwfL} zb`i&U>Rl|#JmhkPhq#z{=b}Hk{1-u_^X0#Tc+OMb3C@4Q^Pc+Z7~`c6q|ZK5z4YxM zr3{|;($|A@OZ?=ecX4hCah<{0l5&`Ca=a-s`I;5VynT^GAQ>;!~a0JdYqG8y6we*VkjI7+;^}i=xhPv5T|IV7zFJt3|M*3=L1%))z7U*wa zgDz?^p&aN^T$nC}K5Zxz_tYGiZsiG`E`@foaTKO&4mx+C|DNfhUXo4}=z7yP79=UI$gnfov!x=Du|#tMCnTH zNFCF93kWOka$OYtDsJ%|!WDYHNce^8axQUQAwA2j zxUP2)A(-oYLx@JCQ9uMK2N39|_zDU6frLm(s3F(o67Tyv*QF2&2=aYO>>-6yrYQpS zTuksiLWMg@h1y1irf;ANWYEckT)I16Y(=%s23_1NdM4_AkSrrWmsX?FQkbrQuF|{H z$1H_DWXc$>ODDLOp@?+FFh^W7viy=&;tq5?~sY;m#TcrQGz-u$Q&wt4waVf{p8*z9Hm+x zqeO_;?WA~z$U;O5$g~CY^IR+GSHsftiC;u<=9B(nqDx3lKdq%(N_07e6Tfl=S&$I7 zK8;F7Ov-u+piEK-g|jIlJ?97+h4~VdDe)9S9Kn~Mqr_#QLwv4yUP-ki6p*Y~fYK=3 zNb(;j4T3xAucV)LD3knjceu-Ry@}5u6y77=NXVeb^m`fw1Ya*o z%!3l4kHviHTe9AyUwDVYqRAnfQxi2Mr))-6qvzg4=@THGju1!JlnMwrP@Fr`4y>9wxCN(A;(McpgvubGT%mhlYW0BY9CQ*&)i)k+fC0uQig;=x@y*Y2R-Le z#sqiLPZ2tV{KNG8GmQ%b--YBCbIC6h@|oGxjD(d<$a2$ptD9q2MG@Lfk3h3AyycFz$qc6O<_-myljUI&Vl$hsoqkVPUO{8PYU0;WEs6JCNv7XJO+b)$k|k)gOW916^yQ62 z2~k_9X?_qrh<=AZhfqil1tct_Us+D~rIHh5szp>6YF9$YiS?s6 zB<~$dIwX%upaLY4FLb2mo|M5As?b%!uT-JyL{Per`mo%Zm#@>St^XIMrM}V=EC^-P)K`|PTBP-CIHX~#MuQt+qy3F&kd4ymwi0>l zTi&mMUw6MkKk&EmujTLMAK>5IzqNl4|Ec~f{df9X1e6b`63{%Lcfg2%;{j&^ZUtBb zx(5aawhCMycs%f7phZxdpqW9-g4P6W4EiDHaL|RI!XQrXtOf*+51t#mIrv`ii{O?G zIyD%a*5F2iav@DZI)rQq*&A{(q-p5)p_4y(PKCDN0|M0cpTf)ah zT#R@X@jjwLWXDF`8VzlvizBb0!dm${_v&-v-AtIMm>F1J97eko1t*AtysFhujPKJEUT0RA@rz ztk5N)8$spn0I)?@EzfuBlbl68u2*db;PL1@sZh)mm_aR7DfIY zS)pOyM!McKL6gOG9eum`4)sm(tLs0)-zQ*mz}&4tZ7(GSZrAPut8zpQuC#TO%9tLmK`=XY+=}zu-vfSVTZzwg`Ez&5Oyi- zx3Ds4;f~=o!kdQ2gtrY}Lalr#{ABp=;YHzHBa$OVMJ$L|60s`cPcmM`$jXtyk&Plp zM^1}WB7dX;?~5GXFumc-hFcqMZ>Tnu8dYdiy^&X=s75Ut>1ZjFOBHGCo9w&FH_!K# z?|a`0ezX17`yKNO@Need$$zN-4F47Wx&Da(Y2O4?3ycZ$4*LIUI_r2Vs;`Y7xEG|m z8%ZyoM{{2LOUt5{(!1!R^hNqE{i^;_FJMTH2jY7s?9yFs_$n0e9F&~)8EZM4Q-Ln3&(%1?1$M!h; zPuq5SJJX&0&Uxpp6Bg!K2e>QTt?mssg;&D+#OvYB@*aBcysUmPzrEktALOqK?naA^ zGcC(U3-LzC(hpLC+)C~#e=o0)x5-77$;vOvQ&p#tGg~dJ#qMr5(M#}K`91xO{xAMf zpI^8$66wc>El=R^H^}?tvdXYf*`wUx3T(BfI!;}to>Tv(6}xI7jkr`RKpS?@6ZMJu z68)zBM%Rr`jOE4~BfVL~G|c|yHW1^2dB-ebRksqYDOO{9lD)`2YhSb<+U1=eopa87 zuR;(x5s4J%3vUrmMVwSw`dDfv89a7dWx5^yWKVXA`xX2`(KozC_4AQSsw1_bTvkZi zq&)Iyd9B<|-)$9h45y+~&*|hWaMn4uo%_xk=TmpPd&hkdeY+o7^W&Bb=p1|w2Rx3+lbq$wL1#uc~o4tf6@>~#P4{;lW31o-I$^PrjDO0ddUn&n!ptPa*_AZxj`&f08kxAuV* zPpym~qp-Wi&|r!^%ieD9vu}so)Zg|SJI+bvbZJhDZJKdQiQjw27G4#JIC1|a* zp4v4di&@63ZZn9I!zRxP^~Q2Y(>d%)i4`~pmk^>^{&;rn-toJbOh2BDjn_%Ee& za%TBM*_4OMXXFM-6QwIpo=mNz_EtBjx73fc-r7u>bAxt9`$zjg&#E`jztV^3b7|7s z`fEMT$ZdRR^f%@h4;k%M%*N(KM*DvAmRZiKZ#B0TTYIhB)_v=ZRnRUTGBh;aC^|5j z*sbZ^-|ci%fa6T$?*DS4cb?BJ-wMh&HYY( zcfYqk)?ex$_8<9Kg52 z+(Pal{~;$+aw;Dwu2N2E!#nrlttW9`yOraB?j@mXs;24R>EG)s^|ksYeV_hFf3E+nztxi&sf-LpRwI{T80C%5MsFiD z#v5}&W392t*k=3&YTq%kn)%J5W@%I7-aa=MnCob(tLDFE5-Y1!$g->|Rs*Yx)!!Op zJ*E9Dm%5EhE5Mg)KF)R z^S!ew23}d+JZ`AEzFW!t)cu@sJHeghE^${f3r@P1IOaD@g!JA=u?G9bTi~tp_Ijth z``#NbouAjQ?6>qg_!Imk{$_s<$9~1X=Rai-rw;;pr(MuJ7{`QL8LSHq2WNxJ!NcI6 zAo3(hB%1ifi`1f!kcAbBI-(ieXOI}f-K-H?#4d4B+!7B&aw&t9T`DA%ltO8ew1`GJ zF8wQImGj9Jg=AJe5JRRNf-*lmC<>N^YenS64%6t#nipmGR0HWs$Omv9w#c zpxjfQC@It|YGGAXE2y8Ut<@gt5cL~1oU8t%Zd3QFSJZpz6E&5VRm-Cl*Ceg7_Az{L z5_h{s+suGHsr{in)l%wN^xS$eUDvDYZS-z>e}>a{`Z9gB{)>Kw5%o$hVl<{%M;qT5 zON;}?DXw*#InP{Wo-qG3({YUzt-i3tY<6DC{abr^X#WcSrFZgjOSPO1VBUAmM#ph$ zxy{@mT*h|r?uAZSH8`HlTP{xW|Duyx&k=jQ;dDh17hYtdTg8-I-p#~TqD zMLwXZh3F>|f%Xkzt9ZtYNG4^K3QDR}7FMxF+Af`t!t2r_DT`c2t}54o7LAa{%e&=+ z^!+XQg&e1(R|+XI6mq(<48pt}u76f}to)@Is;|~lTd3{9gaztqb+fu#J*d7?Q)-zw zzhauN)z`Xc!?am+#sTdryeh3;Sa`}r<;@1LnL*|xa|!h8ho8m4Z&~GO2uC4z)6-B&Ba6x@Qk=8Qb^UM4$?AYg(82(2%RV|r}XYXx9cD%`l#Qk z+tsIPyp}~Ptf^W>t-6+|t=67t16wkZhRuv<1(=LB zCL6yP`;6PL`iz`eC9{^<2buDnxzyZi9^<^;n7ORN)+g3y)>qarAoxc#)^$!QOko!R zf@=UFJvppd_G0@N=JF-`HbeOX$AsB7cDl#Pa=mldx$gY!q<4$Bu3OjbNP$jwSGju` z$4^0u{GR63U109401L(e@uEFkT1z8luSx4rIL~eXPiR$ z{Y?2iR1=$5 zIk%i7P>amqU{7z5H_}_ka9QtN^|A!{f?`31phi%ir;U_N8XF{=0H{O4kbI=(JUHSS z9xk1nL+%0>9whIOZv#bXfT9G&Q0gl!lrO1_qsj{v@L$$j)3(PqR=DZGJ zciFWfS~;z))=L|KU|ywd*N$p8wHF%n5O!!86^xol<>p2^ql?j#!8+Xd*4S?RYMf-i zKBrG2ykk!DL$ieG@TTo4wjt(tbFw*|`(MQLUvF+PcbdP_IcMpeTL95Jvk+uWM!JU4 zk9C(n@A$w~N{e1E!AM0xdVl9*Ktg-d=C-vCrEXo%~QW z*QpL!>)`aExxRs@?Q^a$TAnhvUpw)TwSsObx4hfN9q5j6=L2Ue+^fjB*KR7Wq-T0H zy)Q!a+*EHK2Y$x8=RNh}{1U$A*Z2FP>Gt{;{cDi2j6u1e7K*=h(2c^G8(e~jMQSIF zm>``5`>jpgv=$v8V1vXkbnra!gIFz2h}R;6R7zSWlY8)toI zt%em}wEnTuh0O3MH=AfLv`@l)GC75vx=uT1DpUH3^Ta9c+U}R`a7OYmH_po%8^VXZ z-@PP$PXANCwciom)5o9b|KP9T#I_+Vulo=DNKi1aps+QAA;I`ycCZKndyX0LB-(N< zlSWidE;$6Yga}Q>L?iK)m`qha7I~ziQW>edR88tB^_Rv;)1)oZL#Z0#v#H!o?n47E zm9NWpg)A*LkG!P8{Lhi;Qt$=43%8Z>}>X>j#p8+DXhHKN0wv- zRz2{3ymidFY~4lCW&*ryyEeS>OQiS?ECtD_LP2(PmN}c8BhFQ)uG`w}>&|e0ba%QZ z-1J^PPw^__9USzo#3XK53=-MLAK}mPS20xg`B(j0{(Zki@I^2zSPFO97Mu>Q1}{)V zNh1R}wydHwP*p+H5^Y6PHLVgqi({NzX(^B@0aoLsDKP)-(lP0@bdkb~le6NUd2(a9 zliVN5GFqO-DXx%@%U5JYX%Q;jls?KJj&OmpPT9xt-B#k%f>>!))xPQ&2J0d9A2qdR zW2gki|Xe|C?$=P{_#d4)XRtLS~~ed=}d zdeP+H;40ko-g>E!U|syd{uF zXw?o$8X3;<#4}|XUGc}%0J1!$S>t2N(LpL zqAP8c5DGI>xvxA^5>$zz?4b_gY$rkD!)5rDhtO=PignzfG@Q-S{gkUL)p~pGHzOc4wLkqxP)i)CpboL^~S*T2xGCa(b#Gn z0~sC~g-w-00y||z)Q2H!fh6wTYs$1=FJx5v-t@+j}B=Z&Pck3AdT+}XsomS6o zj-lAko?20g(Cr27fD{5tU6v0tL9OA2db%_G0c$3^oP( zgA>8cDCm+aVC2WZBb~@A3eyXwXi6va6NAMFpm(B}F6N3AVttIr?-xhJDK08X=OfYw zQa-5&Cao`3kv@?=!(r(p4GM8;$4XPB+0s%*>CceSKc$RvPUL3^cz$*HOL+b?`8(X( z_1x)h`GkCq5&Ka73;QGkWA;PERD75~Ev11nM45nh`m1tHxeH0ntmaaCsf*NK)MQ#( zC|MCM)`4HG0^$#7ne`s}1Wdm0C+O4>{ha<3m6pON0}WkdoH5dwUz%S5K2uE7YGOUI zlG^D3YRfKbhxT}Ti~SVCVvf_u?aATJ#gMq+HuBnew}6z4eggGqqp+9THB z;EDpa9wO(IxGDC*8LG+S$n7W(q0-N9g!+=(}!~`zQPiff0Nj zjG~T~1lxl@qYrS6WQdQnqPyr90-|fgb#WKBvmpgBMEX`bhh-8$mRFZs;?r(nX5Ydt zdx64B1Mka0PbVk}cV3U-6Dre`#i+bp%1PxVzGy|YmHMSR6iZ*nz>l_PYyERZ_(Hv} zao6a|C>~-Z(nq&!1xOpQ2=t{t_%sL7! zyJx+!(%KS*Sk0bpud{D}1Gyayb>H6U>5RZL`NcT|G?xUFo5g6?YzX>MHWq6A>Kpo$gYP-ylO=%mrPn z71syr{fxw@2~vPb-`^Z(Hn$d951p(K#(D1FZdNZ+ATH9DU-JM-l}*bHGeuQFb(6Y}tm!Ud zzJHfsJyWcCb$?VXlPPpfCw3!-jp9N=n*=uU)a z^Yj&1Ok4E*wB0j3Vx%;(87|gR9kjv(V;V4a(|C=BPHpP2shZ|!bFsPMKP7P8OloC< zQx&#C84+C#4bT!&(3foITMF$*YlHO*BUT`x)LI}kp!+DVR-oGs!l9EuU@1xA+sO#{#R#Y#6 zYkt0_0Y<0m&0+b5p!I_me?d+ksqtCi7r@xIT`mKdE2Q)1!)863M)0JalTfiEcR6RlU|;e{YfZFZNm< zKOiLN4-)S2Qw3EKP<6T6)=aRdoje^fx+{1_Qp#okZ&^x|MQonNtVra&_DfHsWMD-x zxwAYFd{`*2gMub!Xk~_|6aX1YDYcc)@zRbcSCwjNQ}u>=C**w_()V9!-)QrpnNN|P z)rraHV~$lZS{PsBhCManOdCx<0*suDreA0-Ggq6}%~xh_G|@n7vUL^;|FJy;j`)#N z8q;R4bH>RFF%R6@ZWnhDu6fcRTaY&>9F&GxCk9gh_DfK@dqMa(_$ykW6XPO_LBV{u zvL6W{Dsg|cMMKdgmTL@#a?b!Am%!?Fh<&iS>*6+??zzY%X;?JPrNL;$nb7c?u`|de z7bj#Lh(9)y?%xHE_(Lwp$nHxVJzN<}3Nl^!jpWLv10c*dBW0ww4ua{6uf4H`Rw?FRs^* zql}*Exll&ca89}yvyGj`=~!nZGjow0y2$f32=uT!$2yjTV!FA~T#HM$oxyt^$#e_b z{T;Dc8U}DttE8onY7IcU&jcG!GKS-^-wj-|CX`tR+>zd-!9S2{pSADW#hj8(G=Qsw zl<(}!a#mvL{!Z8`yN2tz6-iv1yKRZ{hqxm`cbq%fUF~jjFOz5`@$xdGYj};l9o}W8 zS8m_&YxvFnKk;LOC;G3>M6^WgN$NQhA{CLd#^s_bX-IHt*y0^(6ypKuLLpQBj;Bt!ig55`u|k2f$0fqBC_fj-qtH*YgR1HI>6XL zSWt5IKXkpk-di7ro087RVSH>f42^#HS(}aB{~`J`b2gkew^i4Ql8BAge(MxRE#N!V zp%VS=;k?-a4*7=t*bbdB>h{dUUVMTt(oXcI;!{c4qz~~$ z%EFOn!VgwU8>Iu%QR#ou72J`xaG#QLdASjh>H+yEdlNTeeBc8mozfjqGESL?GjdA# zS1C_X*Hh=?{asSu;W*XQI)}tZYl#<*X{m56N9#+m#h>aqjKW5JMC5E^1!r>}hcAPf zmx>+843Bcd>oCKdlw~K3r2A~j6vppvgbUIQc`||%`W}h01D*H}2~b9-AgQXthDB4S zwKI(^i&ah*w3zcX!nuWOJ|5v(}VRg@~{^2uoVY5mQwj1vt$P@?iG)JyUtJV z7xyLK_bbNs7`phw{V~jd)u8186i?J}Y6?~^4c5d?l^prR`^lFFR53x7x}u}_l1O5P zSSi+uo#J39E(0aHQ~}GWw$w=KCiRn+ORuD~5QjD>`HSp4M3l5ZXLX>nD^AHU;9~|M z>ShRdIue}%>PJL!CV@m%wYJ&_sWKfm_&8L&D5yGJTSs*BP)ki{Qv(t{O5dp8fj>4Q zRUKhWH^K|XD>Idq(JF!=DlkWG;>wlB2k8jUnP;zty&ksDaFhkv;d$p)!vRUn@ zBGnG1)+CYLq_1N7ccZjJ+848qE)z2RA-&)v3Ie8v?2~!5mPY}n%Td6O*k$?vqS+WR zG8fIeNx4IL72^z|_VO6`)CyR{74 zfA#qoZyRXCv+TI&<}7nJX7TUlOVhDxS)Fl*XIOiz(kahAVD&EWR??JvIlEE-+n|sFT166l0^{wi zpDhpsFkcZIPGs25M>4LUlr{#3m{!l;$L~+#A||JuRD2-PicDXhJ4DV zPYI0q8q`ufNq4Iu%qwF!Jww#R$ApI|8c>2srQ$LBHia2>z$p9GJLk3Xrx6}Y7|f%{ ze&Sq_-12EycA(Ky6>maZDBO<&Z8n6!27va4Cc2<%p{S7&vLP)v{SL_}b zZpG+$BBQnr3*Mi|r(o+rGPNrqn_2zQ{A;A=glctQgA3&!StvR|jb~5_()Wha7hL=n1s~15 zG8=h}x<-3evc{8~?#vE$(lOj2i)4IW}$ z>#BNR{ZloeFlCW^Ri}>`oHFQ6g^0 z^N!Uf;{VLh=4eTgq{VSSS@_aj_9RD<=kC<^>IW#w6Z&bAl1tP{Nkiarn8q+;jbWQz z%;6B&DfHVMjID#_V>2xtXbvlnRRAGc9F8Rz`9sj4qp|p(u^*Dd&d+EoZkJ>|B+1`pZy%!d6#LnjAaSD)_6lYVYi`&Z`&xYjN=muB!_(=56XY7;sZb*D=MJYYH zFT0$Z6tNH#y#$fB0j_T zGs9U3Qa%DJ-#I1({Y$qWyB9miQJ=e&y`Jo1rY3tV93%jTI!zq4!^1kkXF&^0*{(rv zmXb!`V9Y{nE+IzU9P9~>6H`R_{Nt#_Hu3$vrUoDX6iK8s@_9V8$8uWwshHAQ?TF$Y zppH@}sMDAfOV}~nr0&3&IEi<76a0ChzEulon$|>{O(1rd`FT!z7-B<|V8iEt{u|>n z6QueJqZgucBv!*5V*9m7v4fbGw~Rk%$iF$AWW@KGAln6FD=mgu!K}(z)x`sEX0|pv zaAE_IGc%}#B~ZSfuqJj8^_*d$@0xiJf|K4V#s=9oYn;8(neT@8+!20cetaw~ju%R7 zMW>(gjW!Ife?h;-f=y}`YzA{R)8I^ZFx_7p70lY~4)ijonlsH2_SeMQCowH<+xe*& zm3^4L#Fk^Iote01!ZqEG-3D$Gw<}@BK%jgf>zjK3^t;I5Na!W^vU|0m=0iv`7Jz4` zygL3D?7m#_Z~EzCI`_1C8q%^)q0oLUwXh2ld;psP|LS>-1oAT9sBC;{ z44}Eb#zV{qKl~O|xH%?W9uqG_R}D%syc<~ENc_j35|>bzDcKww#HP^y?BduOd!12u zC8fM7-e=wwG;8NRreH9E?&on zG4zo}6Wy(h?Zw=HdnG5t6Z-!|D0fsWb)9-v?S>`wmIO1so*x>e;T=`bYhpDw zVHBizL@>te;8O8ewEJ@6B%}dYBOVvwBO=Eb!d%uFdi;s_jzJF+ll@f|{PL9&%f~K$- E0LGy&-v9sr delta 56 zcmZqP&wOkzGnWq|6T^gG;X#E>6S?HrQWzK*-WX2QlVe?Kz`$^3VxTZPPz0o4<7Bp` J&3etDF#z^+5zGJp diff --git a/Release/x32/TitanEngine.lib b/Release/x32/TitanEngine.lib index bb30b1ed648f80c249036e78a47cdbce58fcc214..0302f3bcd6186b5c1b735bb2d63a30509d5088e1 100644 GIT binary patch literal 98584 zcmeHwdz@WWb^qFcfDsV^0|H8TzafN4f`~{S6EZMK#>pfEM8eI?N#>Htz2lubc_2bm zRKyn|+SXEQEv1%HYH3SbYb`&YsECS)h=_=aFMJ^?QpMkQoqhH``+ak`7ye>CpEc+1 zwbowW{XYBbv(Da!oL*~qIj78@GcW&r(F~%U zPa?W)9?>T!i9U5B(LD<#edB5(rh7gr=^L{U2Hka+q`MCyV*1({1>J-z=o?Q;`sN@J z)4dY~-H$8i?yDqy{ca+ryMHU`>thIyk$Bncf`ZxSH- z1@e&7R$M_p87}CPxPm@=yQI&-4$~Kx7IZ7Fw~|0m(j=~+`QruMk1NvqnO!7(b`9)+ zKGQDfVO$?3F#sD(XCEu+0;E5u599h_qCXs6&EpP9PQFdjoIVmD`UT2~ z>6aH2guMR}^ef~WBu-c->BJjJFr9Fxq!Uj^7JjCf2d z=jB9Sy^?bJ=Eu+uL0@_#C-ExemFcYgC9OGjKbM{^P*dy%B=xH2KFAiDkMlI}R12qZ>_CC&K=$_I4HL6TncMiM#w7T4dR zkFAsR)yI&J$4H!dTS16_>M+sI&X)8D>OQASab=pBlQ?ZF>W2yGVj4JG($WXf&L1Rt zY+TYG-$KOn8?-TyScUcvqF8e)C1GGeFfcw z>rJrzgrqyscbGnhKEd>r8zg-d>1BHC9!bAJ-kARHR!P4-ohYYUa0UJD$ehHOQ3VKE%Oz#Pr8KCEdO^%AW~!1rjHrJu$8Rw4|f%Cc(7#LP;+~88GdAtEByJ zC&Bb$w8flm!4J*H!BmUO^JNH86E zgQNqFMi_J;+9lJh$0Z$fJc*n>ge&MJ@0WB0>XYe6)C1Gu7fU*1f&|k`fX(#MeI?D> z4tq>UFVm3^NIGf_$^mp7^q7uDc`&_b_ku7Uyod>LnfAF}(!K|fVA^N4q%sB$3mPa0Na8F-g0le3_oRm!#bfKo~Rw z;he6-74+O|CB1Mp+6`zglwnTy;EFc=1o{<7>~@o+%YebO;BiT>Kwg+mKUUH!k=C3r z9=wtX>1I0f(t@7A6|`Whq=n-oazfr0g3j2ZpsR2NosM?J^om)M79o8(A$^NLi$`*z z?_r!_dgvXJez2N|=|PNJIeh?E(Dyb=dIV@ePv>~QGZNH8_$6okArL6b8jO>8ES6Uul3 zwCRF^?!pz+SSsn_J`y=yk1J>rX<^#9Z$bQ<=}AdLXvaArA48xOk4ajFI?4%cY8hzx zu9D6{T&6+DbJ_)0&~nrX(+bpQPRR2L(CZH^=v}yib~{bd>yS65OHqG0U56{EeW9e+ zK1zaV>S0M+KS_e=l4B*k?s&upZ9(3dww)?z>mc+%+isCGiT23!TGS0w`$0+5z+t-N zLy|V1Pl9R7h@{Q;BMh2;KvL^s5;^@GSI|^L(pu=}^l4l{wfzf1S=2xm%_|6by$Ez6 z?Bz6pD`;$SK_9~vl+BSeei`mVpwT-djqi>yD7#tG`ol>uZMa&}dXyd02DBHZb;xH< zNas3G?MX?m{{!j)bXiN1c!UJgu1Gu6PT!ZbGs=RA&?cC6LjFPYr%NO~`3EAVKcR1d z1i>EDbMBS2>vGsz4xQ~e34t^)?R=M{T_Dft3%G)wGbCxrY!W$Lk1MEuX+a;y6}0&7 zoapD*QBFU*1@i^a&vE}`dQ=hm^rN8f+$ib(n}~8c7FW=H;4^*e_=0Z66?7lsGyUkU zf`)JfJzUTa?!fo~`r)vohra?D=*M>#1pbd%1|HM5VUy{Bqa}R@wwWHdUedRL4-(t^ z3PKy%e#6?e1Ivb143Df`+`n?s@W9Z>is7{*^>(e%-`G%ZWVCke@>PR_z7kz-Xi1%s zrK^^ovv%=k8F4qogQyzQ4n427vQ~uT#EY_mtfHr z*l?IuP}_02%W5051rrmh(uU9NS1lnV@p;;CP=stR&$c*C%wbwVZO-Ld;j#mHY=;rH zm-i$zwE894Ao`P&zJS1EX}clG%B;O|yw=LxHsbSLjy4+*oE5R^^IeX%8W1ebCbD*@ z6aoT|r45H99CN@G#8ff1#> zdO^F%!`6!R>!-4|iWm_F*=4?>;zCg3j5NzcMub7Ohh>{&agpc6wRTPA#$p)(UA{KY z2yt;Pt4&U3V+<6q=PDR+%d|R7D;P?HS-YGM8zgAgS3wuz)?t=|#WDgq4K~jREorv= zVu;HPNts%QX$3uC&3akVWT98@)DF!WE2ZF0`7PpUh)ifgfqfR1nT zhO^p4eM4hN-%t#O{#j|UF zv>g-$nA(0=2CkgHEgH{8H?ExCq)Ip-@K~m8+X^HDje2`=wr+ZZvS={$Pi?{E=-*{- zEtV1Rz6>v}Pq8(aRdGy?gffH%L*CI0nZa0DTb~(0dAo9$a;}Ei*}_&< z+c?y$H`+SeVHr{_AE*pan`efs-0FDDmDV*&W!z)K+Jd2hGI>hT=gYhXm4l+PD1vdK zV%%GB<7{VJ+vdRUa_w+g4nDu+EE!tGCPT`G2ssbnyIeb5n)LZ4#{el>i-s~pizc#K ztAFcgmiH1lCsMT%mMxlYwX#M#7AGQI*{-$gqk~yvLwlV2!_-u^3B5!?Ma9t=0fEOV z3o0m*pwZM=0#CQJ9TXXnOHGGq1XVd$tYx+K==e~r-OgH#(um77!^(`!<0soPz6$YG z>C4}^J5HE-GQ`|ckAEXcqvNHb4(30UY7rRDCMRm6S*dL>ik~Wm4x$g`L%P!=4IVT` zveu@01C6TLaP&M0wEMT#(a*+od$U;FXQrpx%}q;djj@SxnZ)N~!ZeyKnrKdGLna6M z%XuJKw}HEKy)m6})0oy{a9o~eZLry#RApf>^v|*kE!N6*HaXB}H&xU!%)j`V-;~Jk z%6el1R$d_2GJ}J3F0Hl3w&0O8I8=v(!8m1#qheIVs>bwGHs%}U1-2=)eU-!=Qk6Fc z-%iBsoV6!l%b4^Mkxxm(4(HcXmn}|j+ zPf-O9NwKx%LwkD*;+;F$E09^TaA1&n6qw`iA4N6$1uPx7irl$D-zR!)r^v z+>ME>$ zMcJlpgp_O>R!wv?7S}ecBH;s#v21IwTuoshPGEdcF|0Nus|O;Uo&_Q~as$bd1e54# zsMy2V1dlFRvQtNtlnu-gnk_s7U?@iAxG8s~Di+T(R$@tEbUZK~I>KNa?;dGIf;1S* zFCHtJ*(X?lRZ=7`9I2F%=&M57H1Hfv+j$_TGFyM^Y76`~{X5Pi9d$mnK|=JnqWTT0>U3 zd_85=nlIFG(9zJjizS;#)Synvg4605K462jFjNfnFLa*~UGCEQ7~Trv{jITLY4cV! z?653%m#e0N*5ZxB)IsM#-sfu$hPZs#$tR=6sFP68qJDdwL#8_>E&2IEP7w?t$^{)$ zAsV-=tfWdpsPA-X9W6bpRa;jCkap{~p4Lf81K9}Ru$H#MzIiJfwaKaRre1!D2!m`t z-=;-Kb*x3rO_P|jjcjQuJbhP7>!hSUd;rEu#dxi;AyX^lYJ?~u9C1VtfVCo;h{{Cq z${ZbJqX!$*QOp)Q&lG`ZTM6o2jZ{QOMa9SH3(ySjQhBx5T4GG9C}D6&iwG5a;dFhX0JO$~xI88)$AOea zT&CMbQbh^*DMJ1ZCfgH7;(4G>M92s0>sqx|z1Bbz@?TfRq?#}1j){oAf{u#@A%Ab< zmp7^rM#T|<&SP92k(5=MP>6~;;pSdiIyOIT$v`->o;()QhjpSt0aYnKi&@PzYdqZs z1S5khWfd)|O-!t-l>=!&;IVXKLK4lhny|~Y!@j{hGT6||J2PfPu04nEYL?X;lK4C` z4VLM=MxoF5e=e+qC=eon&1pD`w0OYcnFXFa6>n9!5Uf~HwGIk8 z8J+dC#*$WsmrwW}$nw#SinXBlszrr)37#`nmY$NppDh1WNQF&J#f#~vn(M6BNy9Ii zNV3e@;-M&OVdY#|_tWERDBYG9JCFu9dJ;WUwypuz(J9~;j4I$I-4-gfmdW-L>_~&L z0?9O^u^8)K=nSTBfXR`+2eZxD#K|hzHg9QdYTV`&D+nH6YGH{CD|3M*i>O!%unK<; zzY~wf3@YfjMzq!S8dfTYv(cf6X)Fud*@Bgn>c}{T6nwBJmpX^18x8h#$(hzb*hx*< z;f5)Hn-i6oRPiyriAQpTD$Y<1&RjB}b6lj-5-EMOC-k^*1Y4$JDEGcdBu}j3hMCaq&uuO5Ktwh8z z(6|^qZ2`NO=AKxln`K%jCG}Gg!pTRLqIqFzsBZtb*RmrfJAF!w{>@qGNTOhOAc9gI zn9}af1C3?1dP54_f{v<{cI2;>Z8+5y-P$)2(s3;;fJ5G9{n95UE%^%?+hiaX(Nj=y zi)vlbn83uJt2!H#BCiXjG?g_B8!INWhV-;WJxRV>1~Dzeiu@TG4fV(*h0;BnXDU4D zQAjS=4(r>X$1WMG8WTZ#itlO$Y)VxKN?k4-KaG-WYX$7Fnq>_|k$+uKHvZCvDJ!{_ zbF;^m47q5vI2&zko7C%rK~aENcI=2Sz+O3-jn-?W<6-_Sft3oaA!8Sxcm|W`${ai_ zNVW|3+n7}HhihA8GWa#EQz5P_5W}u$D}rhh7Sk;|PZ+?+pZVlmDJBi_=k+C0*T0p; zk$9wyo#eLi3^a$swrbIE~LhOM>2q)H(in36xt;UFj~jmckTmcp_SS7$0BEZF+_hLa_E`X-Q6 zam~6fu;q6bC^V_4#YMb)P?9qo$x-zimzxsI-S8r9qhw9FdCiS`Dn)#qW5a+09#%=j zcM}jY0G+~ubk$~f!_7dJmn{nDyGUk)5+P6kP8Ne2ZVtIkEQ2Th)-2g3v`P^lm9Aq- zmIEGAh{knu>_;y14Vm)DA3JxvJ~}Sv$zyp6{Y0d6%k;#x0!d3M%l6K5mSWjeB`F~A zSQ;!Ok-U5vC|^6*d!z&e9?P+8Sb;=p^Sryrnw@4#z$*kR`iIOV0gF`x&dM5Dt3Fzr zn9#`#NqnA8Xi$X8mjkq}1C`W}#OG=2K@oT9!f-ZqZoNJ3RAF2$m%W$Z1?;l=)Kva` z2Kv=l))=jq{i=hK6w5E2iZ;DCi&;siNjuU)$J8X$I@r-g*;&ujSk;)s0&<2Ip^dTT z7FByG4JpGbJUi-ObHg&s`0(+BZ6v9PwZsfwW=%W|HW0IgodNP?9=Wip4Rz3pS&{xM z`eCJ`nyXNF1lcQ39h4$s+!>`AJ*w}3qN^hFlTMDU6SmMfG17{u=US2vUFo#gI$;YY zhI(IZw+U&*)N?Ii@Q?{Hm*qMr$yThIFb|)2G%`LEipygXrvv(?pG2deV z{lt7?+7V4pCx3r~N7XUQZ?mJCt$=|(FA13ejGek0=3DHkd_~p9@VO~I+gm%9jp92u ze!}rNvZfUuAJ_62P%0`$<(&J zwD&oJX8eL^D`@y9*i#*J`)7&zK1a0li$u4AXsMt{(D-~o_k(u%4AC0sv~hhHbnAei zV_|Fd1%f^dIvRUNegJgWokVl6PvVj<6MY;s`~=bJFJMn)(AejZM$mP?!(OYu$G+!} z6U_i!0$PvoW#mmvJaNrKkT7PRJaL7xRZbef>$FBkN2&}}Cp zZ*v4ajJ#a%OW=c+{EBGZ34(4sQP7>Zo{sAk#|wHCbbB4;u~N`X*t~OC&^-LU@~cE2 zLm58uCD5w`?SGb_Bi9JJ7W6Lsz5sfgA!|Xl*RP4TgB}I#H6my`=uyzmZznn&`$!It z3i=4rbI>V*-uN0pzXh#BojnGO+fEfU3_AN~$p0fmmx5-3wjw`!fzC#mKFDSM7|~n) zh%);P(fBGsA47h2L3vyU`@16@kBtku5c!x1+kNK>x(W0I^w*&5Ka4uO0p&jvc=y20 zFl^lVe?+JMmgpAHktqA6D6_jzp7+7_8IbLXxO*f0+d)^LTt2;8(A`G~TDUjL=!JrA z#r5|6QI0PbbPH$*zpp(GZ3yLg^}*OCbSBb*>vb2MD_1K(q^7kHq!y zS%Qu~2xSj?|4We1Banw91zmi&pov2eAH01Le>?PMfF6Ks4breLa26gdX!jQ(kD%?K z>-Q0Kz`kgExL$+nBZ%Js?k^98Jbl80*+5zZE(4}W051_4(k1qs1Xpb`lT?M)Uy0Z{x%_7(XjVuQC z_lVx{5c-S^S2K);+Ps13TZ4>)rL?F70EbPd|# z9^ehF7W9dRpgB$8fo4vkT~8p*pbIvkO@Nj{-ghy|7<47%`)lP2ezM!T37{fq!F9z<<(LXUR9Et0ZkD{(YH+~0g>VBeQK{wt4Wsw)S&rvD$S*NG>Z)&Eg92XX3r$TJe7IKJg~8tJqD<5YH2Ph+V{U#qMHf@qDqTc#e3dc!zkmc$c_F zyj@%+-XpFS2hmGtChbR;((C9F+D4a)?cy?V03ArnX$1|@tLV-22JuEQPIbDN-azlA zYw1n&e)==|b9xz_POqSs(;0Lc_0iAiI(i?SNGH)>(HrSqG$k5hlW2-bu~D?e1~DP( z;$kr^Hj6D{t9Y$wiE%Mk{DOW+KcI){C-fuwF+D)vrU&V}^c}jNzE2O)_vk+Q7Ck~g zqo30C^tbeP^hNqSeSz+v&(iJmIr=C18r@Cbq<^3r=u8kTLa(HSw1^haVmgzKrxWPyG(~M%EmnyYVo0nMBjQzJ zSd58Lu})0VtHrrujW|!dMqDT^5;d__Tp-RDZ=#F644@e=V;aj=*r z_7^V}2Z#g3VPcV3EKU=HVwqSjUM^lH`o$7)j#w(r76amyVu3haoGBKHSBSI38DgH8 zFHRMwh(3{t_2QRw7U2K{+UeQ8@@!vuwy*3!Upao~6Lx0Wnbu;d(cB;23bJ#A!@#Kms3JpKMCL^T9R==4UUGnQsIue}*>ElM-tae2-Nk z7<#!Iil>US^Sgd?+dVs++cGxPrf+*>*)hVio-MD64}~jOJp*%BI9$QIHaTe ztz+eqGL|~8gEjRlP9vb=6*3*M2p4$8(IFCCpCjS~ZC!-qtBt&ZbHZM0~cwgii>aJ)6a=pOr_V{|i-SS?l+8fMsvYegkS9FLvgjD3Xg|xXQ%`a;3*lT=>_o_6d6<~B8!6b*vqx+F9X(xj=9YGWi$`|b5jx%{|d8hELdVJ3)*PXY8 zQ*ILyxD&e@L*=5#&PYX8B2pd&?AU&KgWFi;k+_fK`-0<;Z-iw5qq9j38m zqN%Idu5B$a?CANRvf%6;S0=*|7&dss$|s9*TvnExnWbjuGf{ND(zKi~f@P-IU>aCF z(couLchgv9y^uS5SejD4i>G3jbr>;%euosup;Q?zd1e+$uC?{39jU;R_t>&bWL!%a zHNq2hB&qmdz%4Xyx2W zjMh@Aib_3z_-4!~Zl2Lto8B6wQtsf0hAth~f>IArP90D=p?I#)DPAc?F6Az;2B0M| zW638orHMPHQQT!Q@neb9DW2F=1V>=>JKk>5>a))Ni=}Z#VAxQb2u1pp{ZOcq1g^c~ zIA;-Ml26frYJ?bygYs-D{WC8g#n0!+TEsD|bDQKG!`b6rGJ(n3Jk!U|Jf?r50BiW% zJO%z)VxfbPf0NU@H@tzCNYOCQpRzyh-4$Y=LP_-+W8m(AH)tscFu+;p%AePFe(W&(o+#W_=>x2O7I=@Rn6&yu8kJ z)WCjlMrj13mTm5WhPt`cTZC=qR3$=w2)GdG#ZG978Q$eACCyFqr|{OdCUTH9zExoe z)-qT+CXbv&mr`m5t5Dm_Yg%QShjYB_9z{0z@HffO3q4jax00WX#CrOOBz)rUo-ymO z@~Hmd$GOwf%*=P8(NCg^lak5Wjm5OghBtaKjfXXCh_H?c#B;$w(oMEy z(iB*BoV{<9%`W!ei5@Li3i363jFCLs#cmDqXuf=xD<#2|)6e6mabh8Y)~c5sE+P~f z#;O;q+2>h-qhA2&lWf40%i-lFTg)=fc|kDr5-7+nQe(7#sOeB4jU0~!O|=e|mw^ft zvC1H-($K|>$XpYPNgONEhO>NyxE6<%@Bx83BTIf=%DrTpn25Fk|azaxKITTMBY@*^DANT1kB*tyEOlQjis;RJ>`55=b?CRwLFwebBBzEoN!QVW&Sxmnm|h=n}B_np=#cdJ}=r!D_~7qr6L) z-qB2M8m5D=>2D$y;&JwT&HQf7Y~BpA+&|9csK}<4it29DmczJAnM`@3;=NSXAp^Oh z%`(-Brw$}V>f~XiVC>wccJ7ex3R$<@ttKwZb5!i_!nZJ~DJQxrRyVtjC>!XU@~2$( z@Ypt@e4YvH%B13jwyHrns@<9b8|Ii9#loDsS&NPu+lQu9kiX>0vVl1z`S!*$Dwel3 zk|iisc}ru7jhrwkl5sI1Qbur(#THMV70H%Lr7{L$Zh733FuVtM@lkfwTLiu95tdL# zvldp&-JQRr;HmH2CF9F^uKcaGDnn>Tca3oO+%`_XrnN=@ooDU9vY{2jBWoA;uUs@d zFf_7acut!FuNoZmmDJ~Ma+$LjzJg3{Zt_buOE(`Z0(?$VebeMx_NLME zS(j5PIi56yqUlfLv2^6HZ;jN){nK})QArC5%X}7M*W1Q2Yzxh}hUblnp;=|pBVIT% zhMs?^1ZzeKB;6^TS)z(Qfp(ow7fnWJdS=QE51bO0Eg1qA-xBHEg?x7ulI_70;u;u+ zH&3ByPOChY5mUSE=&Wc?NXux=xnmFRIjwS&p3>LHvR3%}gm`69XqO?2rAN3T52cHc zow`ELNnXLVENVZY(xTxl6kvv8Yo2^TWi%l~Ny~Ty*W1PM@3PVI%8)|h z-?qf|lQQ*eiB1)pfXHl!IZJs{spLRQyXz{R=R{TFc_IVQaj7yQ+3r_m6vN|6VsqEZ zH;^puIs>{$e2F##QNDtK6V8p(xNL4&nkC;@nbPR_He6@r${s^Mrw->`kW48w+} zSIG_ddugG3PFG%Enr$tW8O31n&BS5(#q$Hx*3@&H_6F0E&OTvMweUy^cz>zH#Wi#? zO%<7M$#G2Rm2|vgR$I#LfQk#F&F})B1k!hrA|;lJ_8zlxjP?}pA#+uvJ?%*r7R%S& zahaO|Ksyd(PAT{b0TX)s>1qQu*RXuG%N11Kw~9hFMSe7?B-dP3QMg`c1wVB1mf>9H zdZZPx3=PYPDk(O7sSHIqA4mX6g&2+}jliHD*;gx{rn+s2vjaI+L0sQ8Bb^Z+HQij; zNJOU`^%CA}CRB%`8RZ&fqR6B|tjIiRq{wWyHY=mH$jM*Cv&}XTKQqoK2)1PVz)7KU z#gNNBSZPqUZ9(o27m86lNrWP5k2lYxmXz7maE45GM_(8eX&<-{pcaNPwb--lJgKO( zI4*N8q$BpM@>rff%$Rc?Wjpv3q=or&N$#&>SBQMZfxyq9A@Wkfvr}GSa{cCPxG)$FuNCC3r1qe=&Zwy&OV&Gy*ysS|T38k_l=fe9I%m+>djk%5GBWP!iALFH_wJxF}J7RC# z&|ZVKRmVlp9Ty$3XH~iKB*%r&l8j0=WVTOXkvw)1)SiVtuS|&YCe$fc45Q3TmLIR= zSl)*PWbR|=_#m1hq)`JK{)kG&_dhJPeVLJB-$PNEn7jm4XZK-zPQ|yyfdse;oe+GvoZFf1IYstW64BCpsqfXOD#({; zOw-S?RBw-t!#^I^CBmMzw4E~8ImwZ`}@qJ8!(@K;f?D7EYXHOzqRDOnIK25rL6l*Q2wv z?nQCf_z^OU(4S?zx6NS7b($6O___SC%CbXAAr&*1CY!S025F8N;u);1;f} zA@AN!8b)bEJbi5oDSuyE6N3;B6!N7G236&2>S;-VxiqVMOkqO)G#_h~P_97){D5tM zus3jL9lu}#p23cpn18UVCbOWtgu_zXSJ>9^Jca|};@zHZwMFe(-oth@=@M-E5QpRu zyE3xOn2X6Xln!3SHj;WLt$m9Nam>Tm6bJo`9R=eJQ}Uc(^EnT1+2G!+Jdd?O-~Tu& z(p}#5MV2uPCuCKC21`dC^Nz`o(G?#9w0$Usf1ZX?x!iDTmQKwhOIIyFXYJwzBMZoo zoj5izani}BoO<%yQ|8R+n={M$n_YzF&VE_(>!KNhVrLqDzTCI!V~Lb@NYSMjuP#QA2><@ySBL}W0uie0BoBTHe)ZD!HvifMNIn`X>o^|x_F|!5- zmYM-5j{byg>Lnz{;y+I0PNcGaCQhng z&bZ>_ndBHdD^4HlfKlqqEji3Toc|SnY>TjUZuz$pwwNWfvZv_jo@_WXoUC_jIdkUr z87*h0yyg54k|&c*!Im>t<|Y4Sw476vh+ED-s6cV$mcw?RmKL!ib^H>5N53GbTym$* zGfGbOIUJ*sEV)FVn_Co8-k7=1nSVx~>r;GgzBuB>`s;ZK??|a0f+QpxWz~|MdvZ~* zvo6A*z#Vo_@Q8MBp4Z)-olV`rk}CIsxu=BjIAb^?!@E_u+$n%~ zt_SHPp<_QUj#xrQ?J}JO#GO6F?(zCg4VURbz}uz3Q>%+kUfjHP%v+zj`8j#x?*1Gb z%gBQG;Jwxv-VXc3xy$I|jJVi{kcVyh-GE4+Gi$49qRq z>f>B0$Ip-A_9DlrF=0=MtUqJxKA&?Fz2*fDTKBzXUIguEw4=RpwD9M6ZUc709eZov z{P385AaGyExO&OE`w~sn-`*BhFIvmoNY0Kx&i0XL{Nb)aXp8J-l{0gLN zta*{U*0IRpi%Km2b%F=&B&B1knL9V!Y7PVP%o5r7^wNW@JkqA>bH5;FPg+spZnl2} zwfoUvu6hh{?%4bg`r;sJ4=^LGX%;XKkeJqou}+(DE4XtTO3arJ^zj0f>7<||Vru?+ zP>xuB%JU+rHxt`YB;WpOO zTyICXXuT-OM7^@oKA*2_wmSF zo1ce|b?~}JOWg^MQ)p^y1Sc!i=bx#%JKjNiy6f%)53l>uOx+Dmbnv=IOU>p_Vl?^H zSx;v3^CNd2UVfh~v3Q>e`01-n8NB^1x^6x5BBR>LNW;lx8sb}Lbe)3vk-o{VujcGP z3c9cJd69YP@kqfbZVK$GaPN_BxZ}u_D*wI`JHC@h*X2Ji^3;41azD3BL2Q$f?(q{X za9)Y8${lWx&i*Ieryz1S;-~8QehT=NcCodJ3+;qE*M8)k#c@DBHHGXq`pWmUXaBk#gskW2XgE;BPhKl(?Iy&NUE81K0h_Wf~%z*mR4W zS~WjCN4B=Wk?#3!{@ifq{6^MsPC$NN;iDE`$3?)ax4A@VpJAfAJMy^sbi&31q)1 zJ4xx7=hTRKmWhmeRk;P0gHn0qNX^ohO4Lr9Yq?3NK5i!FXak8f6nkxTjh~vMpB=)N zPf5m>U~UqeaL2lz7g--a5$*k)cnTr~P#HZ@{(~WOj4;MFW)9p_=yQoV^0E-VyF*&{ zDTu5i&PMq!Po;pzA8cadCcp`Itp8LCToJ;TpG-VMEpRBFf*!TNl;_W@3Up)BxvtAQ zHES65@%+KP@)(!O;YtHh?VsngAUDSyTU08CBR*aaa#;HP+CE1!(T7$sBEAfoaP#4Y zJLan|GSl53D617p4`#Kg+?*?Muu);RwUo-u8imq>+@#*Wo~Ll^Efl-XTk8Gx`C-gn zw8F@}gx^2C+CU9XQ!DrC)LQrj8cpsj=@n>YwA38@H4d6zluldi*wa$=ccDb{w!!Q{ z9wT>R_O@FaLG3|aBhOas|8Y@)YVY3JgPca@eC!iZ3u1Pk&(wSFbvb6a7pc=;+zfYa zKZ*Q}G8R9lI=h^9jTxEAvX9hQ7}GD*>isgZ?lTLhS%GSP%H4G?Blke|%wF%~_2T}K zDAx@(V)^;Go6YLw8hLlZ?={B@)ZCpf|1{8rbHW|l>%7Ejb=^es_rP_ap28DQq(=E2 z&BYEje_(BHuj_(4;g0!E-NQB(*m~n$$9VOerdBy73N(LDU>DX2cg$mI{j*(^}i_6Kg3o*4uBd)0Q6 z8WUO$p0i`L1693jQ|rA`N$j4KbYkpnJLo+q=fwCoZJ>pA&~^*j33u+Ni8i%aW0!k# zJNDg9)EO`Ggu-8TY*BdruHP898dRKhj-d$o(xnNJB#v^T=-;cbp1G-=Ay{z*$h0x1wO?r{{$e6}H4Ohg_ z)p-O?R-Z!2C(z$)pzDWuS?4`^>zw*F?=3dE#8o@scb)IlbIMyo$oYQ6F02#o*vnGB z1y{yU{RUq79+sNtzRkwvww<@G$iPw^J29GHmBjWlUbVdEN3eN6jknv_iK8$aRCl=R zSnKm6eQZ8b@s1r$g=aF?)_SN~zPUwN9F{d~><42x>*{l6JA3xRLtCxIat&07*|Ek0e9JA!) zvU;f}a{WP#EVrCGrw{gh zxPfuiSuSuYU!HBj{vuvcSFY*Qej9)9WAb@tUFS1(ul|USSssezK|4w5IF6*=KK_G+ ztdCpk9y8LK*^lPNFy_Oag?Z%+yTgqy;+y+BQ@{Qr}Ss*kkus$V( zM{xtyTOBzu)BoovvR~Addr)Nd!SAj~FgW65Z z@oq^V_n?#$?fG9#Wc#>8r!t?y9VmhOZx-%UyS@nr7LBc}Uy^lS(y6=9zgxKakjL)x zni#2W4Py49-=@~s{v(3geS1pHsQ%ML<-=Zh-!kW@O1H3`aL4;@>Z_Xn3gFwP+&O4& zbL)&AxdZca>c?DkK4`GVxlg^T{cjh)ob99wq4FIgHTU_rnF@Y^RGco_ZONxv`~QS7 z1D(uCMd$jC^laW~;1gj~^Qcb;uKFmNdNcjMKE8c2XxHfTBhPN9BKNm-Ku;Beld#UU zkhpvPKQ|rL39$}R_5Pkf{$vOlPc`A!q)tjY=Q*+R{V508I@Q(zs@~>O>l2@LkTJx` z19Q7aP0SZQ6G07h@ScukpY?Hj@yxYVMemGebEwwxN z*DW;r%yb8*dap{%lhwyxxDmiQm)RV^XW6-*!+}H8wVyTN>EwuU&IH zZuOZ#YP@2aEXe3*8{A`h{k(+|IotfLES~Lc=Y^{#Ny9G&uXGHN1DYE zr(PDTw$9Wn=*KbCKqstis_Q49&Y8{4|K!gIbL| zIkRWOBaG=E5A77?Q@AfhdI;}8@UtLhFG@G{%<}UbwZ5)ZYt?HFeswpP2e##B=DHbn z!X597DL=$tq>%mUt=y(kvyWd|*m${+%5-()#MAk&639KN>%>#yqe*PP$Sc=&VvYOP z3G5yqCrbP=3t9Rg=DYb0VZ3g4KX#?Y>EBq`Y8&A&aMjXIy*v9Y<1VXh%&-Ss@m2KH z@VWh7W-DVR#;@OnG5yM|+@Df&r^h8~dvtuL)^2Al|1*rrd5pB;Ss0^#@1g~|Y-PO2 z^Dys{@C4%x)u!6nP`}(^$g9HYrJ2az|9N!pvF!*6v$IYIYzb z+60#E(W|9%X|Xucll|9IvxA*1>_y|X#)eGotJ8fuP0hx3P9S$*-uj?y=bSbEzHAp8 zc_OPdrYF73R_*&KADidch&bQ8*2+eoilT+i(w*PT-W%S71ihVA2?S$?ZcjdmD zni=e7;ioqPubl75h|6z>cDHeJ*R`JZtH>zK?<1d^#O}rTm1=J@I-vU%Ub);OPqF+a z_<0ukS*_Z-ved&b5h|lcRw>w{Y>!Upfx@qfpIQZdzJ(urNmRLarM`&R)57D4uo_jo zA+0iQs#m`tiu?4ouDvW=^%7wj_UmbFTZnt;Mlah{Yd6)iUTC48Tc6B&-nJ7X`QDw- z{i3g2=czTZeI!0_jl>(__3m7{$VkfTQ~Q>fOIlf0tX_DPTs@zW5scU2UKGUi3%6>^ zN|o)*5|iJ#J|p?uFNoQLd`8A+UPaztVQ%Ip_HuQi`#DhR{qBoP)MBXU#W~HX`@jJu z;)RF5Ut%ByZr+u#QoZn{5^D;dRrL0Z z>%?eta1gWm+DomP%_=aPtu{aIsf9CdSgkz5Mebg_>VHTW)6Zz-8clh}9jZ{LTccS^ z@5(itO*NU*b&gZBg~QU=fyP|5yi;C@ho{kdQ0}Sk!jG`gx3>A%3RUXtnal02>(Wo1 zEqCOOq@V|NklOX+s2xc|4{9RygmAQ#2L8lIRfAXj)q7rKMVI%QIVOr5DD>*ci7zmZ zjUxL+UAf04a(tYP%hT2TSe#%}ub$(``Y4~_dc1|qsEi3ebXC=>0&ba=Q;_QKC+t89 zp5D?wkyF51K*&>6`8&E+R@)eU1ywokskz=sHgZo+4Nk3K&d%}j@5B;WtlF|uXRw@H zAcnG587DFqIsol>PKgs3B&s5%>g<#fX~iTTbm~8VRBt1R`FUS~_e`CCFxSWHMTsWn zck^t-UY>stdDG9U`STU(^i;dKN$yeC@@{OETTUXMrxu90H`!pbIXP0_l&zTV!Ta^p zlgY~p)cyt^7QUK&Sl~bBWwd&mjoi=po$P4}v(;+0u-Qu1gWX3`GnJPYcuQ-ou`PH- zk{H}7=QH&d?DQyZpvzQ7PQ7V-MS&b&l&IWt6JyXBE?OXaRq;~q_+DAyEzh>L7q8pE zLtniyjcwIy?P-6wt%{uT*FCd9er8U1Sm2-qinV&HNz~&)53dI^s|X(NsJ6(#!@P1? zZE`ZpCz;+5RJ9&cPw$IU$bn+6ik<44{SJ2bWt^JREh*5RxpM%{3L*NLtlV-_zUE7F zOgIl?&8eMr|JFTq#~jG9FxJ#Z7uTn1Q&ZWd-rO-0bAz*kn1O~`xl~iD+vk+1{MeUo z_wRMf>WGO|{6QNLZl(FWHsEAfxkpCEp;;J*mf5KMnCoS;GG4@kfOk|{?&I~Kf22-8 zU11{zH(Tyy4u^caUgR(_Uw@U2D9`Whz7`X25QjsEy~t&vrLHV7m)54ng9|{ttj7@_ zuNOH?)Z;1}QBGjHuE*3YeRYZWG<>g+@^v`3M3(tnoQ=YXtCdZ4KZ{L$zqBTR+uAnS zizm&%~D*wD^v(ADpv ziITn`g4&akjy%`%%KU4hxbynD&vELB@WKSLKVVg@;Zz@98%6FOH?_~!MG@Sm7qwQR z7Vma3WCe$gs%6}lSiM~*QM1W`M!V@Xq+TM8DkS!;=pHFDGVs@&V-l%38UBE}`gjoO zm%QGVG1kc7%7wMjjnk9C!(6N5C1xq>J-i;Y%1HZQzp4!ikKfCzXe_G10SH;`y8crA zZ#;|{7-Flo&(un0J%;KRaP=BZ%*rlSxYP9s-lV!W{RLd zWt%|VRG_j)vue6M>Z6G#?M4LE&ur!Pn|Nkw7O3(YLeA~FP)Duab`zt+WDv6l`Am#} zueC6H)LRlO3N0Vc&tUaZP2_M&BjWv7D+@N*sx2oqi*M(6;~3$`veqJ8+HjF(kKvJ= z*Y#MR^0%5!WA|WGO3g4go9OIlCUe}Augg<@PFpP8t=Z^wJ6qA1z-R3jXQS97S|+3W zC)Lz0##_xaU^TEj_z~|4dQ|hN`|UOdUqS{Od-dLxc!Ikmh#Rc(%DD3)xa{xqIulp! z&ow;VXz;Eac{l4#&QpEuQY!^{Q(Mr$4jFm#TZDJT-S_m!U6H@?d3`7JUi9_IIL_ae zU1s4=Eof|$<-TCFUEl0yy{C15xsBbwbu`NzSOyx)YV}5>vsF()!oP02oq}Z6E8klp zGX(y!>!9_ZEEB7D*D~5z kogdUUtsTQV#<48$LZ))%-GTTM~)34kX$!U%@lqBng#Wu{n@UBq<;2rW`HUx6o$) zJ|fA!i#Gd<@EaW1X!GSQB1J4($s(ICT9S+KL1mBHeDNBQq%2gyna4=cIG-5MsZ%yT z^(F$`si&LmXtxuc*=+Mm9U{poA2-v`g3?)TAg2`UxbBi4M4ydTaQjW9=#WS(X%y*Z z5n5=yEyc}pwBX}+ZA$$h(2uy|Xg7z^f<7=n(zj4Szkf@LYu$(>yIpYMZt(dDo88y& z8+<;&=E@61lFPX^SDz(PgrfzQVX@>&Jq7okM~Yqzi6woe+4R1Ke$Z=`O>ckv_9t@v z1{X%Ph(+M`SVZCAoT97uy%_+2S^)Jh9&f=zk z>uylExL!C(=r<%EU@o$mwSrjEyqis{*NG)f;Z{l3W}6n7#EOk*LCgAXaD$ehRUMnw z2&G~vTF`up#04QOZJPBZR+OU!ZD5h&akQXqMVoH%#EP|OLDzLQU7(00XOm5r_wXCs z2ltHwGhS+4O*6l3ZL@oJM<^XxAzQcVC70cVC50e+BJI#f4P# zCEFAnB9^poYg5>X7|?~6-DIEz=Svmb6ILrS(1ISN3fjJ!6rUZ$I&%<<+7ve~SeS|O zJAK0q>ie{$zRgeY2H+-jY#KwLq{9t2OVKVR`lFf6B~+2*;^Q`#AY1bLXq!vt@f-Yl z$j0^SaC{k#61?taAzF|Zsi1QR58&bJY(^koBz>V2pg%S!xS$B00{N#Dv>PiT;OyNB z`VD)71BPVE|kg z@t5RJSI`+GrQ~NAs(|G`Bcy@2S70*YUkfo+Y(@*BvTc$cC6-jX;s!}n4fv0?iG&9f z$oNPQhdh$h9BdPeBvcSu$$6WQ;lz^A{=kKgu)a1S-{JxYg?5r?)T|`zdz*+HVo7+u zO#)&sNklj#@zFLhvBZ*aC@6{8VG|ASNTQ^XAaOD3Uw$MZPLdQ1lqA7oNerx!#Kqgh zt|eCBMzQi{%WV=up$G_k)+PwbNRp8^ic@Go&2pQRZnzJq{sH2T53aGn4YaEPf}XGm z=uNEHgBH+Po0)BKKmiXzpaLFz5cnUnsonv?L6xO$pllUTxt>j>Cd878n-Twtn~8ll z+V~|BOMDyJRN91rz;A_3<#iAMd=LgjDO$i#PErBiB^9%5Ds;kcP|eq-D!is5`Ev==BO``liZnO^A}+p5w|;L zlMUr1ZLiz3n}B}M_EDP|xd<^BP|*zx7yt(D1}=OIYH2gzG%kRFaFwM0VmGm9LGf=k zgU1mo;MT!lcte}wdAJUSU;&a0`@m+%LHq{8vTcS!83n@N8j6o1l!;^z;wCAIx5ZIamySF;a|;$`A|QiWco6JBgDK9mFG%Tg3W^ zmZEX5mziBl@_VUW2NV#8nr0ajBvfzL!l27k8fZ74OI8islJ7MeoG!qIJy}(ROu^ zXt+91^sBi+q^Bf`3V(!%*H=ebNsTyMj7aGxUQWyrgOdtG(wtf%J2_39Ov(ab;?1^x zqWHZqv2kjwnDm^#82DVMD0?DYJQNcvmfQ>%Z>^~+R;>vYF}0dly_#~g7}PFJtZLg> zrdF8vB0o-inGz=UrNoGz6FZ8WqzG|QM2IcPLquM!U+4mR9N`*00YLL(_dro=o55BjQ~(#Ek|* zY(RToW}J00l!JxeYw_aD{3!87!#L3~CqvZEiM6KAgGt+R>WBw&GVM_pUyT+K>6zl4 z%m@+ps=x4mH3;8B#GQ39V(~+F&N*6Hi;Cs8s}Jj{W(&sUgs~? zG_GO|@#h+1$~<3;3bOKQa5d5G75|d8O@xoAkP|Piwi+(JYn5Emr*#(}QS?}#IMa5T zSl(`>5PesOAsrf7sgpQJ-1iaEynUANTT)$=ZjKjQJ2bN%nT!jQvR8_$?Wc%yn^Q!C z_CrPCOASQPOCcp`1$ivi&IuRgg%iY_!VocMZL%0TCqXPNtS4Ic8ZM5^2@w9htBBl} z0!ses749RB=j4|>lsnc(%>OV(G+P`dPWQ|d&wrR8dMu6*^YiwK7e5FWk3AhCa`Pia z$a}G(XLb!y@IXzmp?|$)KSqkJD-uNR^f+;JMW_h)v8pH?6e{LS4-~%7N1$yYGM@Jn zmj-2s#YItKK~a(@wQ|JmeubiMzbMhI-)s@HB36X02p3=Ve^qQ5&{>qfPp*|eb4I+VF|dg!8`ur_imI!EMDfZ1_5J;Uk)rLO8e;a!aMiw4G|J;$ zk1Mlr^Ty2*<$pt~KF@f%_>d@Z3(>%>MDuqLy*ZQVN*Pi10ivPh_6wec`|zN)A5Ri! zi_mVwwOcr?#DYbjOD>GpNM*PV%iQipTUD(onMH2P7zH5 zvr6$o23*IDM}J1NsXbF-2d2nIOp8FuHlpR=-H(aP?ssZ9@BitC}O4+vzWRyXL`LA zl*PQwSxlKNm^Om?u9i$2Kpk9+Y|XS3Y{B4`7}U2JQ#tT!!}K_)*p?~28`D~_t}BFe zVcL|#^d8!l_dyu?-a(ty8Q0MNF52popx8vFm&e1%X;9z+rthaSEu6}92ESdm@MSnU zUmu5?V{i%vR-cS`VNgX}TQr4fF@8r+U|J30A*?F;A}_+FJBeOSWjbG*>9u~iDF{YR zjQffxYcHP9>OfJnKE+J?>NE8R!5BLb{qxZ_No5z!8iAYjKu0dqX|QS+(W>qU1HPx? zdosQsDqw1hTT7hx8qcSoSA}T^8q(bBi^7s*oma8gRqr0 zMnCdtDQNZw68w^j=y6!$a|y|WZNTIr zD0M0y;X#t^&StuZcz=xKd#541n8B2cxIcxt??UMh;Hkn-i2Cku zcfwE&_(H*<4lZu z5DJ20{)m4E3|?9Vf z4e7Wk=+FSA2o53k-H>bpA!Nr$mX|slmwIRXF37;j)f<|sS&UkIL!EY$Taf6{OXgHi{9)7z9 z4?($_Sqa`HhA=LEXZ*ZUoy>ZAt1ir`Ne&9j0pa|a&e~mF< z;Rz@T=E41RjA#MyISx)@UjPg6{nTtIHwW=guK*8F9jZ%dlt@W*h`yu4w2?YdXX;25 zDVb{0Tl6pbnqHx`w2v~W2{on0^bLJW%jj8JN>$090;n1VQz(T|2>Fs9RiVmModPL{ zYS1(EC_lyj;>G+lFXAWpF@Bu?ho9ii+=N|CIg49xOK!x?xfwU+R@|C1`59iuf}drJ zm+}&Rj+b*hB~TS$NhN(kK|E2 znuqc*?#toao9c3HuEX`Y9;b04CvXba73h7hYPCck6S+tzm za|dqA<&@3s_yD!xRH{vH(*ytVnO4&pdXfG^Z_*pIgTA6i_d7RHV+?Bg=A@}0m z+=cJs?wrd#xF;9zd|E&==yCcVdV(HwVM%b&!}J(ENsrPaG>7KVOqxp%(JWd>vnh%r zc>-r}1XrRjsSkB0Jf)M*KUOiWzh5%{XvMhxe#!i!732E*CG(F~jO*{0%s*N&uD@S0 z|7gXy{(i~)e^ks0ex4;2Xh{2!BYTdT*=y8@>0>8Pq9LM3Z~$KRR1_iX!jcJ8iaJMEqZJ9UpJEw{VY?9}tD1sQDj)!5ZS%gQ*9*EHYSx0t)D zmG0KFf7zvH3(t`QcAJsqdu^G!oUSQ9*s68NsEeJx znt1#3DA8e0o&P)G#XVjV{PlzYY}Dd-Xt-#y*Ua(MaLL}gG`#I}Ej<}w{U?uYv&Zk# zw@^0j-)DE9+;>kWO3hvp!38@ zin0Uuw71ol#@_r=Cmq*+sbxA6qP{W`bXGj})jell{YuaFN~;kE^=L=vfrEDmZS%Dr zhJSM6sPx9y_Y@j)$c*+(kSCpPPa%ICGD5Wb#(ZPCv{~PLb5EI_zct;SGE2TS0<_GU z-5?hS zWt){KRvk&zSvPc$JL`Tw()FJ5rhc#GSs8I$PYFwhu%=R2UcUqpbEMY)omfp~ej^NO zMt&k_da`)&2R+6zssH;AI`ze`zu7iT{_);AocmGhAhM6T%|EKmcO+guY9#8_XZ$f! zI7?63GmjtZu8lXk3^}f6TE-#Y9rsYiuDJ#TTg0TgwB9gr*sCW#ZiTS{VAiKR9U&V9%Sdhy-96jteI0d zP%Ql>RI8+|fAJ?{J<>)k8;vpTK9O`b6t4k;MZ42lB^6vXLI$_1dj#GWRuCY+J^)i>t?Q+$Kwu7pRc4xFg@R6O> zYLrZ-9%@wnfI#b10PJ<`4%5PZ4Rj03z_6a~VSeJ{m6hdCeb2kJ&%?-QaeH7jvEvs# zNNTQp9&^@&M%U}}XPtU=@4i*enV{=YbI;v1>YOtwEfl)-S0RT4$*PHj z1%2gyku!F}1X1v{Ni#h$?ZRCXmA=nhXsQM3UEt3PW*5*K$;68$BRto^lNWW;c`d~S zmrS=#&uvbZmf7G}BNK_Il2dL@Ly(+b%#5%`P4G%itK95!myLQ_ z6R((=T8ZOVj1oE!{jTaj=pAp@RTC{euf=a>o;LBV-;C9IVT$`*uLaKf@Vx2s@>$q5 zGh3J8BiGD5v;}`&GZyGk6aO%y+@Yy16Cw_-oGcTfi&Z{=GjxnSx0ZtI+E8=g`^4$e zHZ=NE+hCTT|NLokTpOQuL#yv$=?ybe`!?*RxurhUJ$AFRR!%R8w{L2H>j+G~rF)z_ zIDX6Vh5Llq=eCihJ+}Y09%YrrxNEfionG!+DrHsb)rY_4BlV^h#)@-yJXRAsGvyNQ zQkUb!*uV5;XAk-0FTK=iFFn_awU@k>wS~{M=Y;2eWWANj@oKG-w|E2>Lq+UM{#G%2 zE&FD~qjH2*#@tAI4fEBmA?H6Pca4IV;;aEaX1duAthasGXz5NLE3E>X{BeiGdZ_{% zKf2SvimJ#un#yTPA?dWItb~djXMIr7u?Wk(b+e*`a0{fyB4i#mCYn~zE}@eW}Ps4hqSI%=DTv#8s_Ji zB_Ar}nrQvt=lIEeZnFASVSRGY=ML*g6*F0FJMyVOg`y5rUM^Lh`bwnrm!H={rneJy zr?RT7k0>UWtb%IJ?X~;&Rx`KKTaDGl-(;BOwUw>3diZmqb_Q=-exN4aY5WeCy!3s7lTaNs#QX%TNCQO26Y>yhKgr)Ifd)qO{^z_*(?zH zTxZ=5b{v9*MCE!41g*C&hj6$hLX4I|*U`BUFVmEg!$OTh(gjLPEr@y37V~?k6CZ6u zUYMDp>Q>nxA96RshT{z)tkYp^9@{*hM6LGWW~Oj2q}GSwrVN}_AT7cer&2(vC69&g zSdAh$#@ZR-RI*kpA<_}9`z)u=EXr1mDC16PvQl4~{GL?b6)t*z?Rf$--upAkcu%FW za^K`=6JwJMm!j{H3=?C_K(okO7h;@s2QgHd$QW*cCYRGfttGKuK~&e}QnS^4y+WLc zjymKjm5Srco%A|y{SaqVQVU$?c=rM~DBdh^%F*f;($Syb7R7a9EML4!*Bg<^z2XEX zJaR=+vt$N*idh8@M_Yd;IEw4SDo8Z`lZB;p-IeIX%)J|0?UGD*ydTSU$qF2{KEx_Z zy7$hqTMk&e9y<$O`s>Q`TIk+KY?A{qG&YMFs%ReqzE87E_8_QrB)K|xxqm78i3+}jBU>=6mp{#2urcjUfA z3@+7=vF@wwL{2~XS!-%LH+G+kte84x(=p4aiq4aDOmv*m6`OIeFh_6qSrXVV`cKY<8Yieub9;ccvv^IWp3Uo{x)2WZL$J>}vm&=~o4&>{R zN{sEGWxO@Jt&<_9rVq4rYT7G#3)(pW(dvEP&Zs9BOqEXZVWNsv)(%;4f3`VsNCnho zsX$fx@@enODzVzPH_NiKoo{RJ=;Rr@b{(9U>b>i&4vv~$`q%DgE|^VVO-FM#(-+st z^f|lt%1%ZD=fo1z*`%Y>xy0!-d0QdJd!VWNaO-l8{8z2V?pgQeoM~ol8Pdfg-R)OG z*4JH3oIT%6TV3vR+@n+beUCn`46fbv-WmK%SChexk+-`VgN%_=yLt7gY?G&^L}Xh~ zV3@}nFH^e%x*KDh&AP0+$te?)?ztu=UU`;c736Zfbs^U*TlyJExmdn1tYww;;1sLr zAd~C*jjr{159h&5Kdkk@-@A1o>y$ds(`1fQgkAGYy_tne-Bdp1)U)#PILbPa=d6Ne zIc=5iJyE_#SI&}e9P7hbmpdd|NAo?@wO^{MG18(2YD|(fwBR1nKP+&hdzMP$LX!)6 zd3dGJNgJ68@{ORX!LVLtm9z4Dx%c{qdO7*wDfs7JMzDStWcBN9`t;3q^>%KiH`*3` zO!)P%xBA>YEUB*^7DT8yeyip-s~UuPB>zdBX?OOdHq=Ri|je2;qnyx5F1#oK1E35z*g zmJBwxF)LQBAjJ?^2QcaOW^jMLT)8D^$B)*Tq;=&a>+9)7pH z{|+~kwY=IROqWye&yO(fzq{c3SDaGV6#O$O{hG}C_%u+; zi4fU6{jAla%!7jTxyn&_z#C*u9nBHevK&+WCa=ejcErl{#^iOeoD*gFj4^rbq*d{l z|A$>e?1|ULc-+kXGrN^{zlU8OZ{dewdD^%bXQPo`FRz@Hq}5onk~p2OI-OpJ?i%Av zI(n7$+;L7Mb#%{p^y#znpz%%?=tq>Y@gAD*vArb!a5mN&HXi?bMfQ@4@=pl*QB^0! z)(Ivl%$}D%(UGp>{mMi~y6%gbdqoaty}w*9DCPMIMEl%M2Fqeo!cThByTQFFY?#VoT`W}DP;YSuN| zLzw%e&7ZR!2kIP~I>$^_2cw72*hh_4xbYLXaniE-R?J*uzFO>*W^yxp5(9FVMO(FJ zdk;`&gbQ;W4fNB%n0Y3d)XOv_sVO8af~2E4sba)ux~QD}X6!>wf#dm2{S%gW%vp@^ z46&9}_IRh{u?Q})w#~;PICQ>KBiiN<=Q}p*+)sCz-1mA6TjMf2rP)0L7MMO=`g0dJ M<)lmO!U9hFU(e~Bq5uE@ diff --git a/Release/x32/TitanEngine_x86.a b/Release/x32/TitanEngine_x86.a index 3c2c556b73d51c9ca1973bf360ff94166ad2c224..f45591243ae711454fb1a964349b151b6a586c61 100644 GIT binary patch delta 14730 zcmZ{re{faB702h^`zEba5s}7}BBq*JM2dUwdwF?5q!|Y_MT@Beh%{oVh#5po1yiKr z#ENMKT0}sgh{z}+#ppy|%tpivwP>k7skIg~wW(E05h+$=7=J+Ty=QmN4&ROc=CJqd zcfWh~e0HD9j}2aaZ1A#SC6(DIswzBrW_x|v+}ZO+-+W%V`Y+5D!t{?-t83gwY| zBnnBWz6{9>L7 z1f`303%k@hWUE1A8821*sg^tI%m^ql#Y|YlF(C4ax`n01opK83m+GN0BwBCSEx5 z$V?LmDs$qyH=D$(KyIB?JY2_Pje58$kh~}!H;Yz`6QA^Ctr-Bswi7SyG>KP% z;^g)@XJq1(4tL#RMs#W3p|z|6xz+rQ535k^@}6zx--FPS%EXlCb(zRkfySz`mAs%U zTQ&~@%MES8bzbqAKUV6Qn=hEGrGb-G)XPs6!4+) z^(F1T{x6e9CF)CSx#I(~mX)Y)-IC;3n73DG?J7avuJ&XJhJRFHLO|YC?Os`N;D2N9 zZu|I569x*au-RIjO3;_4e&~NZb(A+fr8+<35Y#xWOY@GHx>N}oODecyzc2+i=MXtP zI=+6?RLUHPTx>dKDnt(DO-r_18FP=2N5V8Xz)H|)FvOULAMxb}xn*CaD z&8UmE2)z~(cS0h59(=Jgq{lGJAVgy1L%X?xIm0jpf(?umhoztBx_mB6? zR*pbtwHV!(@M1(LbXp8$;{?xC!w7|rn{D0pXG4^jvgy8@vk5_BmCd3nIGYfaCV_I3 zS)dSZ4&=^j*@Gd7Ox|d{ zp1l#G#$@I(jXaP5rD>oevv?rUpU~|$vCsmArm5FA@zezfZB95@GS@RloCEt}c$}{# z5-9VoX3sPS0tKd2K3rg>f-?t>!- z_R%NHTg@k(!fYg5*i>EnDvQbn_imgW$4ey*cV5 z2L+Pvn;$a1j~p17wth1Ah^KqM2sx1YRC(}GD+tt9wY+_cspS!(VBGz+DnCaB@N;rk zQYMFG{0UxHhgYh_DWJ@0Gb)!oWp-jzK$*$@HBTG+M+J~s9f$j*IS!)&2u9yyrk@{16@e9^SXl^>8Yj#>eAi8W?leqElOJ0K( zyk8QW;K^ODdK!fzzTH^tGc#RPaEo_#Z z?|3uyH1klrIsKLIa{75tpW|l#(~83dpq)PcectIvis_Ao9QtohUs*(XFg)qC_dl#x z9{o-W*|DD&5`i%-D>VnWtROIUePRxk$ia%#l9YaCT9U{Ci!Fz_Fe4|@jN3ow86zjs zRi#|;m1$U_O4N7zQPVy}m0<0-+QiP@>H8WsBVzroF_UW@5n6staow z;OkaDa&RKqRh;DOo-lHNA{Do{Pv()36qP)S2m89=joiSvNvG^UMXLP=PxDRfcK~C` zdF?}e&3O?5BdzDW(|zOM95^^Z72JQmPBihayJv$VUkeZFRru!P=BL^2!sbBR|-<;VFE+iW_&0rflxR6pB zdjqHB;6l2gD4FH!>z4?*knX@__iXEPP>~g3F1p$J90*Qko_GtJ*+GY-cj>LHw}TGT zqSEtoE-DT>6t{6*LM~L@(e#C^v;z$3m@l;WrlChLq{=h!F0MSth1^&4-tC(<3%QW0 zWoH{t%mIg#RNE3ODUe!H(DbEN5EKs1DtE7y71(?ApbO$RwxKogyNWzoC(61_#!I0C4rxQ)vBm6=5aBQtv8&zRX=V;OC+hW>KSQNfmMtq9%Z3g(T-Iq0 zgV2qI8}%m;2(8ytIph%uyZ5f|@pbPVA{w&G#{S;8EObC(@&-t+cXG%M zYeXV$Rd_(g1$(VtK71ae0(+>}6xgt;ze>IBAJ%tJ;dJJ$?^&~g>Y=t* z?FX!I63~vOEg( z{dDL+LaM#_Jo^vd5LFQ`1iBp#9bl-6`1#gAptFp-lecwEL@+eX%XSk31)7AJG@gY) zE~KRzaS1OKVj)$8!$0KBiEJ3pJATZ3=CVNl4k2`)A+6^8%Xu{s4P{?lV7dhd6;cOS zHaXC}Yv^D@3OaD56$AovW!f<<(9LV;phOyM-PJspgAxZ_6X@%L5GheLkmIhi#(-0h zmTSmNUM{3W)5#c#5E50V`PPkrz9$JC4~OEWK)>CG4n8D`pY*dpQ+$X|hV%$EU|yh~ z!b8MEbz$Ap9B38`kq^mWO}DYZ9C#RCGp*5HcYtBb!a)CyAao!h@mJTKy#HNDm_Bq& zU&O0~Z-umBa=+pY<9I5Je*na}Vlj@d)s~y7U>T;Hfckp^eG?EmI57U*k2ww;9N4fT zFby#hAXTY5R&$j?0F;!*xV4-H5+Hf@{dMeF2mK{Kag*H-vSJSUqxEThh}XyQKuC3S z^dnq11&B+g-2W(>((yh>SC$*L1p4wbbU+_{t?qI2HQ|6hx)K}MVfLCp^rJhXm!1mr z9g#rtQ=4|q)7C&xAyof1vfJ!Rf#^qT+qc!Mt#FVZ&27VT*4(hApf#Dk-K>c~{!=a~ z`GawZsP50v?JrnCP>a5a7_KR{Cgex{};|IM7#;0-pzy*Y?-+syZkz z`7xec^Cj;zd=*rjF!h*eyoCz`Q%J7xGrG+c4h*F2cp#I}Ev#^0AT=wizLwGLkw6Tj z<97CdjD{_d2Un|ed-O>eeQpcHK-Jdtoosy#l%^x1Yj8%l=K|?ZskHc;8BJ5d!GAQj zDP`8zpo&oS8};ps?!N`%pZePV)A?)2f96LNx~mWfftIs3o|Q4q?hgc8&(3HN6bOPU zt4ZfrS%J5$FP4w8z6h$z4d2h0z2tZzOm3xUPxgk^I8eH2^?Gu=dX8tpc(7OWHbEM+ za&8{O-|80$r(TfJNGK2q=?P?9O-4VG3M4{Bd%YL(R&gL9mCQvKWpooD97sqnpt;(N z(8q)W45?FkcS1%tYy!bh<+SKWR!*R{dX*hjXXOMIR}VbBS8z_qhw5Bzoy<8oUJfbo zQB$oT_>qBZx+VPU5GNuD^&>Y-0;wsb?X#?u`crzwP5dcUeL;70hE&MfvMCx3p-kQ-kB^*zQWZDzw zvq2CNRWG@1K}G|hKuV-SIe#G+N(UrTn^fDFDf4XWk#c-KvY!4t^IB;ZpezX zwdc3-)<#rRmw=^9I3))w(vrOS8(tD5M*7-s)i%$>FYqwnW70ACX6@ILYYAKv(osGcpiZm6lz;OtE=y95QysNDj%C zhRCY1$uM6wjo_FFVmdDM;+Ty$4(FH^Bf~eV~QPZameS*7pstLU0rF2 z+A|=M{JUVh#s_ z(#3{_ooXGjb)d0~mn!~L%bg88LaE3?#f)2IVoF68D;gG76nEXdo4-^lv54i{%zrHv zR}`Cq1XkXvUJ57+TnlOC=XBrl4`dC_W7?B*qL;uD@6 z%L9PecH$LVIq_OhoZLS9j7*%;k2XSSCOg!K8(uEuY63dRM$?mOwbri>d z#&W~51%G z*)(|&m^Sg)Uf#qts4r>v^?z|5HK;GG<<1XyEo)HUh9$|dFlV38+SP!*o$bjI4Ed;< zLqOhD?OtWE|9@leZvXg94g-Z%*etD14d_c#Km0#4b(A+Paa%t#A*gX$m*yPhx>N%i ztAab~3of`hhsf#C@%3X|DRUrlvH3Vxh#bnB9+z@u;IXH2pszfX@pwz-K-<(X^6V2l zc1#Y0CF{z4->|-e+9s;VP5nKVB?sctNhoKZ;+Z+4yh+<43j;mfw`6k;eUtV_9;ooR zN@N`Z?~Qk^eDGTymx(MWOeH{$AM9}r$b!&mCnYmyn3S@pbJ~%~uJ2eWf!b66<;-f2 zcTE=MrjZ7H&l(BjRwKP~jx`eKo%&tgKHOtBXF+bNw{p~Z*4I#Pa@xVrI3Pm3(`qW) zb4JPt^p0DzU+WDTfzWC-%0^m4fYP)Y+eewzh*0RXOO(w&@VHHkKQM9U>=i zAa`ABJQ#w=Qm*RN39@GTh;RREnLeZ zM8UZGYgK-Z3gGADuB1{9&iLcJ&JM3ai&H?E(`HmIdy02rR6v=@{`F6@{i6cNtd7I| zl8?iv07BEbx^5evs}Vw=(x~w{qY)CI(x`HW(Fj3Mjr7{{)<}J+z4!%dBs4dj(Dl2l zAP`+PuSwi^9y}aMz1{joffj=fLTZc#bv6@w@*R8IfzwG+mc! zKv{}uFY~8x3^-bKVJ-c9-RegUP9(dElYHG1Mh;M<;`a8*W+Wsj2B6TtyLw!w~5kexRy5L-ss)G^9;$uhnngJqYLR0{L z=QG>Eg=FLA>BhzmE~J!3-C$C3a3S4Ll+E<@^-F|YNOxeeYnJsnsK|;i7u{@q4g@DN zkH5v3*+GY-cg1Z+ZwDQwMWy@arl>gRP|P=V3As>pM^hIXr5#{M$9$p1=Y}4^kSb6A zyG-RlE;M~b&)q(^S;&P{Ew{Fri8kWCNz`noej zOjMP8*h5^kLKi0{x3_ZNMmBDUoG2SMv6n&z9MXooV+-$)5aBQtv9sOZ#WM$;6ZN|J z&rqqAWh;wp+0X%p%eL}i5W2B&qy7W}q4k<7XFu!5)RsP6hxk5d_uh@&zV5w4L__1U zQNL%Gg$_te-T>+KP7d5@jR@wZN_zN3uB4#@66wg=`X{sa4oED2nUC?%frrT>j2!y9 zF&W|^8FBxgtr)oSP!+WOP2&$29i~Q{_cvq2T09`*g1uHRA3hIKfj!*A1vaeht5R?O zhxHv)IGuUxd)BO=dZ_I+_5-7EEm)f5Dcffa1iq%_+_m2L2K) zJ47g?Gj#hYfd-8bnUJN_58EMvVIrcest9yD93mIW-byQ7bT!rT^3$z!!PQE;o--`% z(AFtn?KsnDhe$~CZu_p8w}S}jCUerzK;LAB4kA?T-noHhq!78Vn6^!2BLdB0A!4Cw z!QU2v=FbqhP*z2OzMl>qNJzCepEv%)H$+v$3xRHjLkAeDB7VL#5a=x9?&NJ<6A=u# zdD+1+P@qYe31f^f$c402LoYE)g;+=x;m8lo=0rA(=N&(0K66>1e}@n{(2!Ph-sNUB z5e;Q;L%`jFg9@nwtehC=-ZgZvAq5@0(h35BO=a3SCD6@l=%7RzY~9snFb5@;UlZu- zf)FWDHISpPv&Mi^kd|xU46|HFiQLJsLNh9QPvIfrp}Mf{o*QTu3y}}WV9oQ5!5nxPUo)-IUUz_D%fdkajv#a( zA@Nt|oo4^LkT8Adn7YWU622AEhROZPY#7H=Vf+IilPebE_*!i_PX)^`-2^n=6X=_O z(7}Q6?|%3=aB$$X6#+NINPtwO?pSTA6at{6G)AvAX&?cTXWw6EJnNvpp`QK zgZ^lJS|2j&<9HyXx;f$zQ#S>OOQt;Vs4=DEeUPp!H*5*?)*k9O(6Qw9nniq1^SLiAo;0HJNs#CAgBaptK{@_on^brLK0SlH-Xmxs{?l*%MmhK&}_gb37BqgT11+3DTgI^W2fv3PQz#vfNNr-FC8KZLM4za5 zsk3q^&)#&1`K%MRf^SvBae0U`1MzH-BT61c{NpwqTj{HE6i$ zqOfvBMqd;P2Q|{U+GMn66x?h`hYpS@gY$?TW;H6 z4Fu+%1kz6Pa)_T;fHvnL%i*|06ct+|6Esbo#>j`jIJC$vB; diff --git a/Release/x64/TitanEngine.dll b/Release/x64/TitanEngine.dll index 76ec624fc4b9e601216d80c098eec292596a0f53..78f6e234c52f3e1f8b00f68384f6c933d10668e6 100644 GIT binary patch delta 60 zcmZpeqSG)%XTk^Oh^C0f&#j*sTR$_ker9g{%+mUqb?axgjgvq!?aL>#0Wmuea{w{t K_T`hgBFg}6n;atm delta 60 zcmZpeqSG)%XTk^OEx*DWKev8nZ2ipC`kA@)GfV4d)~%n}HckS`v@f5`2E^<@%mKul L+m}z~iYx;Ft5Y4x diff --git a/Release/x64/TitanEngine.exp b/Release/x64/TitanEngine.exp index 7e7ba951352b2ad5ac43292ae73213c876ac59fa..a37d3fb74da5aaa5e0414ca0ebf04e831fbb6c5b 100644 GIT binary patch delta 25 fcmeC(&fL45nLVYAi6NpXVj_DYGmzStt#lgzaTf^t delta 25 fcmeC(&fL45nLVYAiDApH@QLh+%s^^mw$g0?fqDv| diff --git a/Release/x64/TitanEngine.lib b/Release/x64/TitanEngine.lib index fc94f007bb316723c26d5edbdeae75f66f536357..12f0cab70797260339b104634b2ecc722af7967c 100644 GIT binary patch delta 9531 zcmZ`i}NI;IMnTk_B7)YhYaW#&EW-Fs|kj`?Q zak(0EtmU{`X)IR{A_6okQxh{YGZRxYGE&BTWeju9xp)8e{et?d_P5`U-`?lag^OJ- zTHBSwr$6^(PkE7P{kasG2}-_WIt%G9GdJ zO@Bl8eaqK!(Syg1inaeK==ta~KAn{41LuU_TQPeVzukuzwdO=EEna&kjfCq?*rf2P z2}Fwh#U_!)y%~Y__6z$C6~;0h@FZB$k|14Fklsx0)nnL!x6K<~_Jp z@Sd%0<9n0HK*|@1J#=gXJ9X;RQ5@?|?`8$67(g;PARJzty<4jx@e_ z-WKjwpTSHn;nnpdEZ2rRdAV3W)!~(!QXSfYeN-UQcx)dus_dCm4N!5aH0=)-o1W_| z$Bwj+uev7Njq3d*#MMgv0M(*)*!BTg6IA-Z0~C^=ysZI=+pXyU@haB52Sy;~Q)^h3#{%u*f{0+huf>GKkQQH>X76k=#UkUS{~tl%5J+YM{=o43KlzE68UKk(elzA z+SX5rPh9=f?tEk_~R;O~frH)OZtlMUcQ!+MTU!-~2awuuUmBuw~z22mA> z&G-Cg`D6m>{EtH&;X>JQ40Yqrwq)CJ1Ods_pF>i`YGz`Hnu&C=?(;|ydSZ}cN|26{ z6Qn~BI5wZ4(g;G7d0)7V_tJWMit)3xV1OupH-rk%sM^RdCMm{jn=x7(`HE0PqA>=XhIU@%!miqlX#&Y*r&(x7jM#1pt4G*tc?lN7#-oU=gzy3`@c;7pZ_DTT$wqM&vl zWh)@lv3T(8XsVkdXRn3Ek?mMzBUlNM+ZqXx6|kEK`zwPFsR(mNgosV&kVrz^OXmn< z06R0jB@#Da?YGo`v@nv+lO;j@wf#K$3!BDs0oYGImR*1(fqLr&GAW3w@FH=M#WSFA z;`6_wVhGwc_1}?2CFrMfu2Zl?<$S8hPYe=ymnaDw-p)%Do`xKgw?rjWsPdLEG*YB~ zPa*)l^6xS0luF+w1feowl;{;&tdyKv7AiJ3QF|fA<|c{}Ib8SyW4dT6(WMv7g{=JLudDvR!7(>=QH z|6w3MCq(S1qV6GyQ@0^OU6Jz(x&jw{?Jw@OG%%QShx`_lr(Jg_PuOaPHSSkjDl`r| ze&s|sXLxigq`el0R5>lZ*CRGP?kj3rDFD8zJ^zC$(p~|Q=@sLIZyT*PT3sg1dUb6T zfo(BjcN@+KN6+RS7O950&FevNFb5yxoX!^YFGgP; z?QEg)v^8W#7bfcQG|}nn=0D1p)X0L7c}?lDCVJ%E z-7FeU%E-oUtcED?MZaZ6F2KjUH-C$Cq!6ai$ zh{^z#^!yaiQWX8{)>OnCs-a0IRR~CbgGL2xNt{31n#?QqFa_ z%|rqp`9vQSnfm8)9}a;^vml5QsX{ev7_a>JP}My!HAr3!vM{Z57R#()uc(ZWUSc0B zq3x@}#Mzg+$RC5bVN7xrkQ+t~2cj+6%wA%uQ(yhIDM8uEM7GBUXX#2C@hLy#x%BQ zMX^Qa>XECXyvE$*`f?N$8ex+I4QXG=mMAMiu8(G*MGKsXMvNHBxqZ2poE<2S^=0J< zD=P+J;c%31Gf^Fw{9!;2h_&d;09~H4Jl4YL3AJ}(p_V?Q$ilb|7*E83QO$-as>Yj( zx~L7qgJnTK?k+D^-tNb)I4=Yl7Y_@_#Kw5egnI=xsbc5-HOvbuuv%94$7-QFTsHT| z$ns)ZH~@@p_nWo*D-wd`)d6td6x8&ZF6d9ne8tpoIXA%ybd4P?ZdpH&JBA9FmVg3k zJ`6~U%t%npaXbOdK_{+E8pMO9feQ_F&6YVhh-IA9LdFkf)3m2v8tgLNWUJBGbVHUW zS|Kte5zs^kSC+`>LR+*ZqS|;Q$f6+_1a868LptEh8VXL+mpg{q-$P~9P>Wu^=7%0h z&JQt37M{Oe?Xw|?+sApE$(AIv51u`8-Y__V;v5>r8FFvvyR6P4{cmA%Q8EJv)7keQkdQ_1cs_oS$+Y5H&^Ti+38X7o|l%~DOb@D-1o@9PES za65Vgd*DXu9?I?dh$vY-g5B1rY?@U+WO^EgzV6Sv>~6(Kxa+n5{YUXir#}tI@==^k z+Iy{|I-XE}Wp&w_FxS(7jb0uNqf9Kkn~547k+?o``Q0jUy~ZGMJi&{`a0&GMo1pbU z6s*kW=LX3yQ!&E8f~-_-Zh%HjDl~yHc`O)#NIS-IytE9$$Dy-%2Fk`ESv)N_nbW(~ zm!$nps~=56t9ze(eP!i%D_A_ak6tct`?c}xHeFpY6F{RG7fkY6r2SOt0!t%h;zUlk zS3|`+3|lg+AUFEaU1p^-Y~f+DCLIqGeXQB9jJ9;#hj`hU66)`j3Cc`KX}sKh50_AN zo#_kxCLSc$WvI&{J_CJ^HNHB70Z$E?5z#}IXp8huxB9ppCx|Y(7h>ikv~fj$rW~qV zxmp@0drg8X((5gmq!NASv*Qq0{>}T0xX^l(;&=|T%U$Wyq9yj%5`N*gxrwLwV)+&Hk+3O z5|ur@1NBwYz15owZ*UG{u(~}>U+LR(vP{mgBIO4;coFjoin$-!k;;wtbBcgKZA`?~ zRg%m8g7Hi)q^VxHc_;*4qWkj@fkrQUwVAFrO4N(Nl~0iQNBDk!wQm5&0tVLK&NLQAXc992Uvvi8W)YWaMDZ&WB#|zL>J+) z?s*V2%3Aq@oHaMH%#o$D)O$H*7N1x2_IYv^uuW+((dmnKu3SFb3U&X%nf7Dh?DkE5 zb~aq`ekjb>YQp5oIs90n8}8T~$Y2*`J;b`{b4aa=rf()-#OS%e2(x099Co0;v>0vKj2yI#<-grv-R+S*Vf0!J$)H`5&kyum6 zZqRzUQ|L8CMwxEP^-9?r&v@j`BFo=(84yr3{R#bI2G+zruL!OqNhgbtBur^eF=*z< zk*^n9K_<>|%JQ>1&c@0_d83%)BzJQjV|Nt|=frc$-31#W#Kczr4*nV-CoF?!&RNxB ze=-`S48EXbD>e+27nfNy7FaiF%X!^k`|ezhiFZ#|xzclPL$Dk32!qO2aKzXuZ7VPW f3V-bTZ+S@v_D+|;9u{WSb85DCaJHB)iQ2Lq|pIIhNV&}?N?4$@h! zGcH$SjE-v|TQm0@-Q#};%Xr1j zHv$aZ|4o0(MGqb`BG&#VzxyLk`*l#F_n#F#-;CL_=&jzws5K{QY4PgYsU%!`+$M!r zjwe#=Et^zYndXpW?qo;uHnY{Ax7iBc8AFn}`)$$*kXUkJ6$}vDo+^@*^@)ywn0Mh? z{=2re4ew4Q11X;;cGIy9=+L1yxok1kUZvt+vh6=^yuT>0G zDtdP4D7GyQ7tg%ck0i*qGw-$aEvp8;UHQdUTv-EKx%<5`AlC92gTrb^{Z`|aTGIH! zIa|0(T{<(lgjdy(uv`=FE* zp>6qu_{5b@>@J8tl1Xe3-FyV1^#P7(czsqIK3NYwG_3b1HLR$;W}7GnNy3Exrw~<< z*nH1@nnxy}F5no{5iXP-!%#Q;WJ|UlLlBT$^%*2ptY#(#tC>g>Yd?z=p~nY0rUdCI zK2ACWfn(EgDvcmSnftlhcn^&zLzLEu9XfUpy)vT2jn4^ExH)o8pqhkL)h7r)%%~e= z8l?10R><^qVVIclMFROpVekHeEK91r32L|!yH~t+GD7^l%wOc5WcyUQ9Vbyb-3i9& zVM=PMcDj64s2Dd(3kHg^cS5KD4XTX{W0GRbvKgbr;V%hABpRdtDQMT#HKC*^p==dO zZBd*!bc#GuJ?9lYzw#KCWW{oyVreLf6QaX&gELezCKnVHiTs)Y zl&!!F$KruABdKnVoV^wr?rg&<8^B74+}c2htbpA_*iRXJP(_$CJVb0fi$oIYUOY<} z1K64V4UxD3Yrdfdq=k`mjw}i4uWjehU)VI>^T2-cvGhD73DjH8lSx5b1s8~mES?61 z6QB1j6+_Ursr!~JD#4yQ=Q;(8RnDh~yhM-4y+}#m@OE6J@HFI@yd^530+qM)A(3MA zcO(MPEBg+!PO0>7L=Y+?Mu}dbMM}xprJ-U|BefS|Y-*$!k;4VwQw~v&6W^0wUIP;^ zk;9yeic81^;bzql54WGns= zzSFQ=WG<@D%*#|CzDEv#2AE8}!pfX;qv8ss%fYW^dw2D3Ce%lHb~aO#8l4TwX^<@u zyPKm$)z#i2_Pt=5C*b|I|Fy|h_TuYg&rapx>mC!^NTu#MvFt{I2)qGoGRtE64LjKdH>Nvo(Oh1>L1ochY`RDH z{XY!kXNQRGmDD{Xaq=c4s4KE>p(}9F*W7ZqrGdeu+vK;PJng(qdBRpRtZ~2KQlW9! z{tG9(#YI z1hvM9U9C7H96g)5S)>}~Hmw7Vs=BF#N$O2unjt}{-KsGw-7Chmpni0`$;*~SIdMuM zi|?>d3wKZbTd8SyJXl(ORss!*o&X({oa1NxZdfnN1%6hH{MFAwU=BXW*&QwFUyQyy z($PZYX=}*zPE6F}X`<8D&3}|zYyKP|k9TVG8j(qzITUANz)xl#vZxSPgk@b!9c~XW%ZaW<|LCXIH2Z&I3F0-E zX&K2aJ)n`=*VI3#r-j=aO;O&nO;Z@=fL_dOpPe>r%d%b;aNF7X(i6bRcY{f_29xwr zA@Y>~xQPQ&wgj+g2V~`{K#QQl#)a}PZHODCVy=~I1Fb&d>(M=ALJ%vYO(08xkaDiW zO(qif$j5u5$kacVdUFU=n)x11qzcuvVZ8F=16B8+(H?olV_{n9ES8zUK2aGVy~I9J zLfck`i8C*Dl0O7iLc88n z@Zga8y>+GU@6KkCX zTn88zJvkgYxkj&rqj35bFdpku=9uz$?U*Q;6~Wb}JtMbASiETLy&!`kQCJkalxb|y zieih-)gxC$`HZ>A^`$5%G{Pna8q&U$%~4i_To=tiixxN?jTkYMbNX;EIXh4u?Ze6u zR%Q&s!r>_2Vxl@Q`NM$hA8XN<0lGY8S*(TA6KZeALM?qpkp*$>FdmNsqnZs$m-pg$Ph?l)=omnQ_vEB)cVDX8f+UCD{snVz7U<5&WkgHBwTG>`{P0~Z?Vsx5P1Aj>$Xg^VA>rfE;TILKwX(N?3e>6$D{ zv_fP`BA|&7t~8O;g|=u(M78lqkcERW2;73F2DihRIRu=hFSie|zlX}oAr`%S%@5s@ zoF8J6EIfaG+Gl+dw~zBSlg&wJA3S^H+@Wv;#W^^XGvwaTcUT=o+TX(D!ej;ztc&Vo z7IF?+IVuJ1gL6>sOu;-GATu=^s*>GV?oLrx)3jkow!S0G%;=-8i=~=w!OLDb&))~i z;dbP;*)*$u$aFUhecYdS+1>Ix;jYjA4;aBKo&Gc+%SLcE zY45d+Xn#Tjl+~rH!(2}THhO6!j54v{E+%SpMB;kOWp}B>^%#Z3@dPg%#U;@5Z-Ukb zQLr+fm*bINjK&B93o=J@a|1N0M?(`BlgEG&h_rnS$4ko~d@MSfXP|T}lEu?2vx3DFd+Fr@w_hE{ZqwBjGafXWals^?McP-TE~q3@CQjgl z`!rO%!>~Es^0?8D?lLQlVG9qF)oFN`=wr=(WwfT@KE%t;lu&=KOi*TuOXB6OySap_ z>r7whH}OEZHeFp7@#*M$tnpRp40vkDjEEkxL|dd^n$_FwI6-vbJrFY=p^Yp0GvyHF z%9WBh*<&JHkv?z9B*hT8rmx&E(Z?C1K>smmsQP`_nsE7cCM&>L&7Fi!p-)`$;3Tx8 zqz{L3e1>n6lw~+T`AP;i3DgEmhFWgG)sxYxu+=mfwx~DePeHqY?bwtyY#H~0jc2m* zUhwfW49%n zAW>P<+EHIQ%~!p-@CIcw2CLiC^p(CnC&}b&D^k9njTbSmpqTrh9jV-KAEyWi)XGF$ zUBx-H;Hhd zGqd1|??YjpRud*y%;v`u-Ec=|Lk7Dj^Fh{4pF?U~G<`DxBSy{vMwr!uAGZGH2l_j; z?Dh~Oc#t1|2<^z@h{FIUpHB~Hev1+HY+{|AN4`Xgw}Sj9w~{DU7xf0@(Bq)lIOE99_;t!Vl2!+;o{ z^YJfws9)NxK6fqhIUjk~zW4}steka^oe;|ou+XX&TWR&TqT&I-1{hIesZTbIz(} z`;*ZKW$<|=TfTmPys*@wvB0`XUB>GM+jqw@OuT!#%9Nh7>x12xM;KJPoFm3oX zyXTxepWVlctNOgSs!wfkx6(`ylm$BnEuVbJ{R{71G<^QG1NA?d$;tSya^2y3`sEK! zzSE6Ns?$w69xBRDow^}5Stvw_C?z}NB~Vq>?!8WaaaG2N{KQ5jVAQ_Q3yp@&D78iz zFcN2+(CEahE3HugMinndo@%SFutu`0QU35fn{3De{@k`Iba86#jfsm)c{$iL9Sm(= zsJX$~uR)N)Duooe(?i)lBhG~AauTB=`Q{}*^97wC$ zK8uW+*N(SFplv?Zf92y={~So0kN0tGo!!SAD4VZeXFoZIqSm*Bp}e(WvJC~4RlTl@ zcCh(ZH(Mi+wyvotKYTM=3e*kvFZ43I{=3!-$ooQ5Xp(zox-|ib^Krz*4L0H|C``dr zI{DMj%`mRApt0Vqcb~Vrl?9Qt(Y77T2vmNd=`SWLvLLbwvpf8*+nVRvV9urTNM%*d zg395?zibx*i3{I|HtJ;S9d;d%IP49f&F+_^wE>NFPg}6p^t4PFh)j-#zG5Afp~9jq z`tsxZuQ#iep~7uNkU_z_!DWgxJkfVUiD z0fWqny7{!XOgGPzfzCQ_`u)S^O&JJHUv>N)`&Ff&vks}g-G)>OLepkcePB1E6m%|3 z^+TEap1j(~TnaLWEwF!n{)Y>UjHRIRhS~*Ak?K|Bg!MJ^w(_X($%~kjuol|6jz5YbZkd2 zLAB#LP~Cewwh&5C?sz~_ZG9cvO){u=)RxrZ{*KMy3<@50imfI!GoUpUraDo~0?L5c z)ZNtP%XvVcc3e@aau5#)#MZ954d$*uZF1Fm1$PBv$LXzVu5xUCXHap{vg8`R9xA?K zxMLe(09vcK;i|^Ku^l%+vE#u_%`SE9O+n4|}kK3kNJp>BoHXKcrx0#eGfXbOzjDfI~lB1gP}NWEArv4# zQVI|IId=t;M@QrD5;X&4N7Z&kNX@G4ap!IuHEJHt>2F#uptcG%I%NM2LKl7?j^FB$ zjn4P&A|Q0kFKX&0#{f)F4mwkh%WbheEi0@9eKtv<70p%Ni(LZ zYv5L>GWGh(?Y6oDL`pqEP6#W!(Yf3xkpsD@PDXidrK5K2aQawNP@Y=in4PvbgB;2q zcc{~OTMR)CZu3}3)*NS8I{0RUzCAGTFH`(q2Z_4QYKy7>5nQlH0a8v5Y-(iuL zb=6xN&1~mJT@Ox4^*-tYR_{QaQZ=1$%)M0r#F=RH$wy41vaWJVy>l%evz-Ix)KRZL z#iK^K=`>vMAA7O{K%Fugpp;2S0M2mJzOZZ%0Bp+mwnrWK(lOUP0nnz52EKK65fE6> zR5kX0cB%?WyJmHCj~g*-*l;==*EXEeu8A#8! zl>jhPC+wUau9+JHz|1f^E_BURZ2*WFD->1i*IY9a2f&zN4)t-(z#jl!hF+p;7&W55 zYYze7%On%eUg8=k3`#(4y|Klv-PjUPT8RO!%^o028J=%18GQjPb@GfJ%-4WCroo`^ zP}j`10br%}^!`=M6JTYW>!Cc&*SH220)R_N$L&ht8jufwEkjrF06aG18ng;BnAh=s z6w26kWI$-`sx8M|q0-@vN8U)8fpn&mZ0tzaU}XSUDOHGik6R}obyQ*MhofC{EffG$ zYI$xS%j5y3OwzgE%`BaPDdTX${n&epYsfQv&FS)HAPeJN+dBXzrS2X5zULYu3jiir z?`WIAdItcduI9TYvT6pNOg^vIWd3>BJ>ucGbqY&d07|I_-szf`h5%49IS_7}?%Jaq zP%_EvVKZ4~14~M(q_eYGK!B1m8k~M@as((cS!%@`z7!-iEmbj}FO{0p;rrKxl;>(ACsu(EoD&yKqg|3T+YM>fYjqa@e0?D|3HwsA$2~& z8WIqsKF1HNaxEhOLF(_@wwisP0KI8MS+<791bUOv#K*W1Hj;QM6i@J&AhqLnJoRFo zYhEb=fJoA*u)(e-0U%?=UrDk}0y~D47N2M>n{5k~z>djex#TI=+?dL8Xe89wM?P&k zmjr^O8Y%q7=B+FTvGt|X!DnqU$#PIzTW$F*w*tB2G33%l_YEros2%Q`c`%g#kxAB$ z$=j@zK#`ITh(QH=KuDm-MDCLI8qnE zvOPB8Brqg7nzWBQ0>SAEN9^Zc2ztj!PaedCbRbpAjQ<Om`$n zJ)v#8NbOX_X5vgg+!httT@=iGgu)JD)qM1U*wrVT_RPI ztD4^273du+Ir?JHb|3^xQgTROOL`P78T+pZA#S^wke30 zbb#cxGCdJ5RsGX!=LGZ+YS@Ja)@B9ht$Y8H?X3611EtQrMF8 zZrEw{7Ab_OfBw+ynM){lB~4-zJkl%A|mLzQzJV$kbE!;n$f=DU=z$ ziH8c*9`ejvpg_uu$@ug!?{-HGIpSTI9CHFGQ<1;IQSJ{W!Ni}r@E3@g`ql9G-)-L% zIgp*YOWkpsq5@ti6Al~uPwon|Cs$|R&LP7(|kcp zclr&$?lYeG4S+z@q&EB9SF8wAUMy+CnB(|{Lj13b3=>H%KZFHqDanj$lis^JduK_ub&z5=80@8?t`S-7(rX@3{iWQy+5`H~IFM zL-f?G^xM9fQw8!T&3sMY@y*O95I^;SIBmRdW)la=C9nLLiCK2{&d1>!paJG}U$giEnQHL<*CJKW*A- z(j|pPsUfdi&H5fPsV(>0*RXO&ETxz_f5BoxD%D%lQp>gmu{2s!T~z0r2W^o;rF3uU zulLQpr9d{-xp#OY%RPis9o4c;JSs?b8W@IbVFN?TvnQSP|E*_deHxxV?VF$O3j|Yr zqrSRT-Xz sz^X3=P~%^K&)dZp#Qs9Rm>Sf|N)!QA)%?jf599*blv-Ks9{(!m|D~hyYXATM delta 15015 zcmZ{re{faB702iPkUNQ3-}%8wK%A_YVX zmKLfpSYQgppfpNNY4D|QgH16Y3bh(2h0$8HQ7JlAnN({A2gdf^dp5gg_%8gLGiT5J z?%8wBXZP{q>OL>7?o(6TEnSu=Nu_oTSU%~pA3ivH(a`zV_gDXdR5qZ$u0MQlVXke` z-EM4BWjE<~s3wBF-n6``$8`=8Zy1a7^T2S zoN*$f6Em+iMj;rLzZ`q2sk+J-1?L*&4&S@kge>6Ct*av!r{><=T#og7NpH3`#7f7>|+*`&DE_ppPWTe>zbob-r6|HgaXRSUN^)$ z*z~JgjS)y&+gOwvx`izT>PGt)d6`xB9peS$eW5Wj$v!j9n1IB&B;w+F6LAId`%Y#AD!<2!=TmvOG%9C6 z<>=#IHVc8o`ESGVjPvC!lE_) z^5X|?)T@=E!mUNI(U#XT#t0OqT%YiU$@NmuIXW{tv^u4rFdeDmN6e8b1%V|6y!99h z7-W`I&8NPlt9hyvbXIv&_z#mer64qY)$w=CSCxRyDx|u06H*BXO`B2qf!T}_&^bTF zk7O=5d99YY1Z0j%VBg&Q4;N?|OF-p~H4B^~*{j-#&ex2OFE!3UaBg|_Q)UUWlMYXI zFdaa3vYGffvq90RR26rcLsSBytNQ!VX;XjGpgOga<};?9q(OAG#gBevwm1!{Cs`+N zcN~*;X^=fRxU#43n3J0Z;b}Q}vYW%!1JP-{h70+6pf{CtIj@Ifgi3?r^6DG-~g zo7{3G4+zvwPL!+|zykuYm8)(8xhqhcT(w-qU4ht1dduo-9FyNERGhR-U&q%&#a9k> zOd$+GYnc>W*$_IW;)W=8GPucEC61ZgLX@0*^~`c#C^==y!5i4dgdjQ1lXB&a&egiA zgrGT{l_4Y8SqVXMI^)v6#W9CGM9q_=J35+eObD7MWmB#h>zKM3qU6a~E=zB7^jw|_ zEW*c=pKKq;q6$EGN|(lR7FB?{C$qPlF`j7^fbK~Zlf5Q5ri=wBdor}jcPFyC5}@pH z_mJBsGZ_Ml>~SlX6;oL@1Soqv+sYo(ScwWic6FB9rn8g@KzFKkkIrJQ1j`?cLkEit?_qVYKF*;vh}Knnq}+b&TJDkY97t$ZyGP4wv047Wd069=YJoK-|~@7 z&iBkBAauena>`~$158*3I#Z3yZZ$P7M2@7~@3qb3ewam(lYv$qdB)M>V~8Y4Gp4Mq z=T@jP)%uDZ=5&XMlxl<=AD!?9=SrCK>?J|cm%%c2B zg*u%xhat>@{HkNu=S>Fa@5uM|IHmdnGf-G! zU(f2)%AoWe`^@AMS`d@Arr-eEnhYo|t2f0N+V*E>vWW%7jtN^fyv{N-17cGeuQ|kx zQ0!zJmotvA6P^LF)m$r%nf?D}>XeNq9DQ#UT8NW0`s5>~Q7Oo+cCPtjwsXjw6!nHvJZhAiy5WNV zn9dSfs582xk~$#~IAzTjh7Cf5&E&R69{keL*F7Q9W<2n%H;aJ4lBTLL|1(onSOQsX z3QmXPnu1dTiLDFHOtU5^9eFF1M=x-v85_uJDo4#1x*AqO#7s)qIXzrGH-?CrvhiY9 zU)6>d#H2B=?Q5w&icDTL>N~X%`B4cpZz+q~0+1y3@a0Tw z1V|bOidVX3{6~VM($@J1D@aI?)W;95b`2vSLDKhaU&FpnfZi0-vb8)W(3^}VJjRW% zkR(%~c!I|Sshzyz$ro!~{YnucL?+ASH=5M~1ju;ad8I4c0t-75)--Q1B{V>GRFmbB zr(Atw8k9jHp~^MuIkWNl!f$oLUa4#=AZ5uBGIPc}2Tks`ZZaU-6q|D!v{~F5y3p-MC-}k!d z$N{pWO1fo-SkhVGkuKdv9^qCJ zfK%Qvr8hv1qy-1J^94b6r9gGTqVMUEH^4Vc*?57cZ^Z%&Nm5F=7kL^h0^~{Ri)}qTjTHex zrP`LdOFTWO2S}CVs=7CK1$rk+j=a<}6$rtSlpIv#={6i7RMKkh*ZFFYe_VOH<_LYmK4^+K`bl_T}IcUf7J~JxsuL#!4OX)R)BCxbIAKc zJw0ay7Pc%Go}ShNq)K(&JuB_$r^EoUk~($249iDkODY5HWu7LUz(SZwW^W(HJwZXC zX{KPfXC@IOOftIYW>1ei(Qm`f{e2T@R6d$%WC6^CRR@n{TV?^wnp-`6(;XmMMqeM@ zHtrqgjnM5E(USIcRXN+&6x45;3M^-nlfEq#tJ73SrtN^`L?O(Ek)qZ@Sq^%PTZ0is$X}uFW&3eMZ zmZW$6E~B@w5T^S1LzAa3p@fAn$yZOweL)#fBVgNZb9jXXF%uG7(_(g5AY;-O-u@E* zLXchEL-pL}>04t_hPp>LWKVPz3sDATTP4$s116aSQYHn|^EDO_LZ+I!55LZ2vQTF9 zCLXb9%^^>}1q!6hgp5xg^X_!ypd;SJU2RSvWlHjwKg#{VB-rIoU-%2eO!aDb{O_i2 ziY&-ZDO!8nq^Q7GO66+IKe;Q=o?M-MkGncg%WOPhTBfjoCJmMAJ~Tt6z*ov-9A5Nq zGY*Rk6c_#YKk-vfKmH2~X{y_@4o_cA3M5VH_r;&{;PFOK~S7J$jJg<&-}u|n55F4 zzFZ~9bXxDR%lUek=}Bp}zZl_={OZf7`F+fkCe8B^M3lOM>>Y<9c5Mi70_Q*M72T?gxdBe=IKhW!N5C zV3Q7DXPK{&R3L2XCEp#!mbCL`wC4Vsd~*bmI-`Od{{}hw0m;shzJAXYNS>K+#C(V3~-}d#)ClEhXL!3I!*E63${!~$QFXvH#`V>`D1&<2So}#L{ zi$#S1s-h~K$f805RaULv=T=bSqXmDdCjtw6((_$WCHpi)P)U>1{(F2gIU$3pfac8P z0YS2>S-grX02!|o-+vzu3lvvjRnO&Nok#MbYPKL^sEYm71uS+8hmsD}KVl0ahpOqf zXo;_HJ_J5?Qo0;o%F+cvR83i{mirnc1d=FqxKS%vEkzuqsjmA^e0}pLEKC~xv}v18 z7YmJ2L0+|n)jecVbKLJ-%Z@u@DaF+J3l z!Pobe0@+mM-r-Fw_Yh81RLeH=s36&CU>LNO4GflNPwMsmtz*63hNn;a`ltH>!BpL- zuc>EVkW496?%2Un1;JD)(7S;tfbX74fjv8!0!XHm=2g2`nj@JiSH(@-6|_@z++WSJ r(`NzH 1000 +#pragma once +#endif + +#include + +#pragma pack(push, 1) + +// Global.Constant.Structure.Declaration: +// Engine.External: +#define UE_ACCESS_READ 0 +#define UE_ACCESS_WRITE 1 +#define UE_ACCESS_ALL 2 + +#define UE_HIDE_BASIC 1 + +#define UE_PLUGIN_CALL_REASON_PREDEBUG 1 +#define UE_PLUGIN_CALL_REASON_EXCEPTION 2 +#define UE_PLUGIN_CALL_REASON_POSTDEBUG 3 + +#define TEE_HOOK_NRM_JUMP 1 +#define TEE_HOOK_NRM_CALL 3 +#define TEE_HOOK_IAT 5 + +#define UE_ENGINE_ALOW_MODULE_LOADING 1 +#define UE_ENGINE_AUTOFIX_FORWARDERS 2 +#define UE_ENGINE_PASS_ALL_EXCEPTIONS 3 +#define UE_ENGINE_NO_CONSOLE_WINDOW 4 +#define UE_ENGINE_BACKUP_FOR_CRITICAL_FUNCTIONS 5 +#define UE_ENGINE_CALL_PLUGIN_CALLBACK 6 +#define UE_ENGINE_RESET_CUSTOM_HANDLER 7 +#define UE_ENGINE_CALL_PLUGIN_DEBUG_CALLBACK 8 + +#define UE_OPTION_REMOVEALL 1 +#define UE_OPTION_DISABLEALL 2 +#define UE_OPTION_REMOVEALLDISABLED 3 +#define UE_OPTION_REMOVEALLENABLED 4 + +#define UE_STATIC_DECRYPTOR_XOR 1 +#define UE_STATIC_DECRYPTOR_SUB 2 +#define UE_STATIC_DECRYPTOR_ADD 3 + +#define UE_STATIC_DECRYPTOR_FOREWARD 1 +#define UE_STATIC_DECRYPTOR_BACKWARD 2 + +#define UE_STATIC_KEY_SIZE_1 1 +#define UE_STATIC_KEY_SIZE_2 2 +#define UE_STATIC_KEY_SIZE_4 4 +#define UE_STATIC_KEY_SIZE_8 8 + +#define UE_STATIC_APLIB 1 +#define UE_STATIC_APLIB_DEPACK 2 +#define UE_STATIC_LZMA 3 + +#define UE_STATIC_HASH_MD5 1 +#define UE_STATIC_HASH_SHA1 2 +#define UE_STATIC_HASH_CRC32 3 + +#define UE_RESOURCE_LANGUAGE_ANY -1 + +#define UE_PE_OFFSET 0 +#define UE_IMAGEBASE 1 +#define UE_OEP 2 +#define UE_SIZEOFIMAGE 3 +#define UE_SIZEOFHEADERS 4 +#define UE_SIZEOFOPTIONALHEADER 5 +#define UE_SECTIONALIGNMENT 6 +#define UE_IMPORTTABLEADDRESS 7 +#define UE_IMPORTTABLESIZE 8 +#define UE_RESOURCETABLEADDRESS 9 +#define UE_RESOURCETABLESIZE 10 +#define UE_EXPORTTABLEADDRESS 11 +#define UE_EXPORTTABLESIZE 12 +#define UE_TLSTABLEADDRESS 13 +#define UE_TLSTABLESIZE 14 +#define UE_RELOCATIONTABLEADDRESS 15 +#define UE_RELOCATIONTABLESIZE 16 +#define UE_TIMEDATESTAMP 17 +#define UE_SECTIONNUMBER 18 +#define UE_CHECKSUM 19 +#define UE_SUBSYSTEM 20 +#define UE_CHARACTERISTICS 21 +#define UE_NUMBEROFRVAANDSIZES 22 +#define UE_SECTIONNAME 23 +#define UE_SECTIONVIRTUALOFFSET 24 +#define UE_SECTIONVIRTUALSIZE 25 +#define UE_SECTIONRAWOFFSET 26 +#define UE_SECTIONRAWSIZE 27 +#define UE_SECTIONFLAGS 28 + +#define UE_CH_BREAKPOINT 1 +#define UE_CH_SINGLESTEP 2 +#define UE_CH_ACCESSVIOLATION 3 +#define UE_CH_ILLEGALINSTRUCTION 4 +#define UE_CH_NONCONTINUABLEEXCEPTION 5 +#define UE_CH_ARRAYBOUNDSEXCEPTION 6 +#define UE_CH_FLOATDENORMALOPERAND 7 +#define UE_CH_FLOATDEVIDEBYZERO 8 +#define UE_CH_INTEGERDEVIDEBYZERO 9 +#define UE_CH_INTEGEROVERFLOW 10 +#define UE_CH_PRIVILEGEDINSTRUCTION 11 +#define UE_CH_PAGEGUARD 12 +#define UE_CH_EVERYTHINGELSE 13 +#define UE_CH_CREATETHREAD 14 +#define UE_CH_EXITTHREAD 15 +#define UE_CH_CREATEPROCESS 16 +#define UE_CH_EXITPROCESS 17 +#define UE_CH_LOADDLL 18 +#define UE_CH_UNLOADDLL 19 +#define UE_CH_OUTPUTDEBUGSTRING 20 +#define UE_CH_AFTEREXCEPTIONPROCESSING 21 +#define UE_CH_ALLEVENTS 22 +#define UE_CH_SYSTEMBREAKPOINT 23 +#define UE_CH_UNHANDLEDEXCEPTION 24 +#define UE_CH_AFTERUNHANDLEDEXCEPTION 25 + +#define UE_OPTION_HANDLER_RETURN_HANDLECOUNT 1 +#define UE_OPTION_HANDLER_RETURN_ACCESS 2 +#define UE_OPTION_HANDLER_RETURN_FLAGS 3 +#define UE_OPTION_HANDLER_RETURN_TYPENAME 4 + +#define UE_BREAKPOINT_INT3 1 +#define UE_BREAKPOINT_LONG_INT3 2 +#define UE_BREAKPOINT_UD2 3 + +#define UE_BPXREMOVED 0 +#define UE_BPXACTIVE 1 +#define UE_BPXINACTIVE 2 + +#define UE_BREAKPOINT 0 +#define UE_SINGLESHOOT 1 +#define UE_HARDWARE 2 +#define UE_MEMORY 3 +#define UE_MEMORY_READ 4 +#define UE_MEMORY_WRITE 5 +#define UE_MEMORY_EXECUTE 6 +#define UE_BREAKPOINT_TYPE_INT3 0x10000000 +#define UE_BREAKPOINT_TYPE_LONG_INT3 0x20000000 +#define UE_BREAKPOINT_TYPE_UD2 0x30000000 + +#define UE_HARDWARE_EXECUTE 4 +#define UE_HARDWARE_WRITE 5 +#define UE_HARDWARE_READWRITE 6 + +#define UE_HARDWARE_SIZE_1 7 +#define UE_HARDWARE_SIZE_2 8 +#define UE_HARDWARE_SIZE_4 9 +#define UE_HARDWARE_SIZE_8 10 + +#define UE_ON_LIB_LOAD 1 +#define UE_ON_LIB_UNLOAD 2 +#define UE_ON_LIB_ALL 3 + +#define UE_APISTART 0 +#define UE_APIEND 1 + +#define UE_PLATFORM_x86 1 +#define UE_PLATFORM_x64 2 +#define UE_PLATFORM_ALL 3 + +#define UE_FUNCTION_STDCALL 1 +#define UE_FUNCTION_CCALL 2 +#define UE_FUNCTION_FASTCALL 3 +#define UE_FUNCTION_STDCALL_RET 4 +#define UE_FUNCTION_CCALL_RET 5 +#define UE_FUNCTION_FASTCALL_RET 6 +#define UE_FUNCTION_STDCALL_CALL 7 +#define UE_FUNCTION_CCALL_CALL 8 +#define UE_FUNCTION_FASTCALL_CALL 9 +#define UE_PARAMETER_BYTE 0 +#define UE_PARAMETER_WORD 1 +#define UE_PARAMETER_DWORD 2 +#define UE_PARAMETER_QWORD 3 +#define UE_PARAMETER_PTR_BYTE 4 +#define UE_PARAMETER_PTR_WORD 5 +#define UE_PARAMETER_PTR_DWORD 6 +#define UE_PARAMETER_PTR_QWORD 7 +#define UE_PARAMETER_STRING 8 +#define UE_PARAMETER_UNICODE 9 + +#define UE_CMP_NOCONDITION 0 +#define UE_CMP_EQUAL 1 +#define UE_CMP_NOTEQUAL 2 +#define UE_CMP_GREATER 3 +#define UE_CMP_GREATEROREQUAL 4 +#define UE_CMP_LOWER 5 +#define UE_CMP_LOWEROREQUAL 6 +#define UE_CMP_REG_EQUAL 7 +#define UE_CMP_REG_NOTEQUAL 8 +#define UE_CMP_REG_GREATER 9 +#define UE_CMP_REG_GREATEROREQUAL 10 +#define UE_CMP_REG_LOWER 11 +#define UE_CMP_REG_LOWEROREQUAL 12 +#define UE_CMP_ALWAYSFALSE 13 + +#define UE_EAX 1 +#define UE_EBX 2 +#define UE_ECX 3 +#define UE_EDX 4 +#define UE_EDI 5 +#define UE_ESI 6 +#define UE_EBP 7 +#define UE_ESP 8 +#define UE_EIP 9 +#define UE_EFLAGS 10 +#define UE_DR0 11 +#define UE_DR1 12 +#define UE_DR2 13 +#define UE_DR3 14 +#define UE_DR6 15 +#define UE_DR7 16 +#define UE_RAX 17 +#define UE_RBX 18 +#define UE_RCX 19 +#define UE_RDX 20 +#define UE_RDI 21 +#define UE_RSI 22 +#define UE_RBP 23 +#define UE_RSP 24 +#define UE_RIP 25 +#define UE_RFLAGS 26 +#define UE_R8 27 +#define UE_R9 28 +#define UE_R10 29 +#define UE_R11 30 +#define UE_R12 31 +#define UE_R13 32 +#define UE_R14 33 +#define UE_R15 34 +#define UE_CIP 35 +#define UE_CSP 36 +#ifdef _WIN64 +#define UE_CFLAGS UE_RFLAGS +#else +#define UE_CFLAGS UE_EFLAGS +#endif +#define UE_SEG_GS 37 +#define UE_SEG_FS 38 +#define UE_SEG_ES 39 +#define UE_SEG_DS 40 +#define UE_SEG_CS 41 +#define UE_SEG_SS 42 + +typedef struct +{ + DWORD PE32Offset; + DWORD ImageBase; + DWORD OriginalEntryPoint; + DWORD NtSizeOfImage; + DWORD NtSizeOfHeaders; + WORD SizeOfOptionalHeaders; + DWORD FileAlignment; + DWORD SectionAligment; + DWORD ImportTableAddress; + DWORD ImportTableSize; + DWORD ResourceTableAddress; + DWORD ResourceTableSize; + DWORD ExportTableAddress; + DWORD ExportTableSize; + DWORD TLSTableAddress; + DWORD TLSTableSize; + DWORD RelocationTableAddress; + DWORD RelocationTableSize; + DWORD TimeDateStamp; + WORD SectionNumber; + DWORD CheckSum; + WORD SubSystem; + WORD Characteristics; + DWORD NumberOfRvaAndSizes; +} PE32Struct, *PPE32Struct; + +typedef struct +{ + DWORD PE64Offset; + DWORD64 ImageBase; + DWORD OriginalEntryPoint; + DWORD NtSizeOfImage; + DWORD NtSizeOfHeaders; + WORD SizeOfOptionalHeaders; + DWORD FileAlignment; + DWORD SectionAligment; + DWORD ImportTableAddress; + DWORD ImportTableSize; + DWORD ResourceTableAddress; + DWORD ResourceTableSize; + DWORD ExportTableAddress; + DWORD ExportTableSize; + DWORD TLSTableAddress; + DWORD TLSTableSize; + DWORD RelocationTableAddress; + DWORD RelocationTableSize; + DWORD TimeDateStamp; + WORD SectionNumber; + DWORD CheckSum; + WORD SubSystem; + WORD Characteristics; + DWORD NumberOfRvaAndSizes; +} PE64Struct, *PPE64Struct; + +typedef struct +{ + bool NewDll; + int NumberOfImports; + ULONG_PTR ImageBase; + ULONG_PTR BaseImportThunk; + ULONG_PTR ImportThunk; + char* APIName; + char* DLLName; +} ImportEnumData, *PImportEnumData; + +typedef struct +{ + HANDLE hThread; + DWORD dwThreadId; + void* ThreadStartAddress; + void* ThreadLocalBase; +} THREAD_ITEM_DATA, *PTHREAD_ITEM_DATA; + +typedef struct +{ + HANDLE hFile; + void* BaseOfDll; + HANDLE hFileMapping; + void* hFileMappingView; + char szLibraryPath[MAX_PATH]; + char szLibraryName[MAX_PATH]; +} LIBRARY_ITEM_DATA, *PLIBRARY_ITEM_DATA; + +typedef struct +{ + HANDLE hFile; + void* BaseOfDll; + HANDLE hFileMapping; + void* hFileMappingView; + wchar_t szLibraryPath[MAX_PATH]; + wchar_t szLibraryName[MAX_PATH]; +} LIBRARY_ITEM_DATAW, *PLIBRARY_ITEM_DATAW; + +typedef struct +{ + HANDLE hProcess; + DWORD dwProcessId; + HANDLE hThread; + DWORD dwThreadId; + HANDLE hFile; + void* BaseOfImage; + void* ThreadStartAddress; + void* ThreadLocalBase; +} PROCESS_ITEM_DATA, *PPROCESS_ITEM_DATA; + +typedef struct +{ + ULONG ProcessId; + HANDLE hHandle; +} HandlerArray, *PHandlerArray; + +typedef struct +{ + char PluginName[64]; + DWORD PluginMajorVersion; + DWORD PluginMinorVersion; + HMODULE PluginBaseAddress; + void* TitanDebuggingCallBack; + void* TitanRegisterPlugin; + void* TitanReleasePlugin; + void* TitanResetPlugin; + bool PluginDisabled; +} PluginInformation, *PPluginInformation; + +#define TEE_MAXIMUM_HOOK_SIZE 14 +#define TEE_MAXIMUM_HOOK_RELOCS 7 +#if defined(_WIN64) +#define TEE_MAXIMUM_HOOK_INSERT_SIZE 14 +#else +#define TEE_MAXIMUM_HOOK_INSERT_SIZE 5 +#endif + +typedef struct HOOK_ENTRY +{ + bool IATHook; + BYTE HookType; + DWORD HookSize; + void* HookAddress; + void* RedirectionAddress; + BYTE HookBytes[TEE_MAXIMUM_HOOK_SIZE]; + BYTE OriginalBytes[TEE_MAXIMUM_HOOK_SIZE]; + void* IATHookModuleBase; + DWORD IATHookNameHash; + bool HookIsEnabled; + bool HookIsRemote; + void* PatchedEntry; + DWORD RelocationInfo[TEE_MAXIMUM_HOOK_RELOCS]; + int RelocationCount; +} HOOK_ENTRY, *PHOOK_ENTRY; + +#define UE_DEPTH_SURFACE 0 +#define UE_DEPTH_DEEP 1 + +#define UE_UNPACKER_CONDITION_SEARCH_FROM_EP 1 + +#define UE_UNPACKER_CONDITION_LOADLIBRARY 1 +#define UE_UNPACKER_CONDITION_GETPROCADDRESS 2 +#define UE_UNPACKER_CONDITION_ENTRYPOINTBREAK 3 +#define UE_UNPACKER_CONDITION_RELOCSNAPSHOT1 4 +#define UE_UNPACKER_CONDITION_RELOCSNAPSHOT2 5 + +#define UE_FIELD_OK 0 +#define UE_FIELD_BROKEN_NON_FIXABLE 1 +#define UE_FIELD_BROKEN_NON_CRITICAL 2 +#define UE_FIELD_BROKEN_FIXABLE_FOR_STATIC_USE 3 +#define UE_FIELD_BROKEN_BUT_CAN_BE_EMULATED 4 +#define UE_FILED_FIXABLE_NON_CRITICAL 5 +#define UE_FILED_FIXABLE_CRITICAL 6 +#define UE_FIELD_NOT_PRESET 7 +#define UE_FIELD_NOT_PRESET_WARNING 8 + +#define UE_RESULT_FILE_OK 10 +#define UE_RESULT_FILE_INVALID_BUT_FIXABLE 11 +#define UE_RESULT_FILE_INVALID_AND_NON_FIXABLE 12 +#define UE_RESULT_FILE_INVALID_FORMAT 13 + +typedef struct +{ + BYTE OveralEvaluation; + bool EvaluationTerminatedByException; + bool FileIs64Bit; + bool FileIsDLL; + bool FileIsConsole; + bool MissingDependencies; + bool MissingDeclaredAPIs; + BYTE SignatureMZ; + BYTE SignaturePE; + BYTE EntryPoint; + BYTE ImageBase; + BYTE SizeOfImage; + BYTE FileAlignment; + BYTE SectionAlignment; + BYTE ExportTable; + BYTE RelocationTable; + BYTE ImportTable; + BYTE ImportTableSection; + BYTE ImportTableData; + BYTE IATTable; + BYTE TLSTable; + BYTE LoadConfigTable; + BYTE BoundImportTable; + BYTE COMHeaderTable; + BYTE ResourceTable; + BYTE ResourceData; + BYTE SectionTable; +} FILE_STATUS_INFO, *PFILE_STATUS_INFO; + +typedef struct +{ + BYTE OveralEvaluation; + bool FixingTerminatedByException; + bool FileFixPerformed; + bool StrippedRelocation; + bool DontFixRelocations; + DWORD OriginalRelocationTableAddress; + DWORD OriginalRelocationTableSize; + bool StrippedExports; + bool DontFixExports; + DWORD OriginalExportTableAddress; + DWORD OriginalExportTableSize; + bool StrippedResources; + bool DontFixResources; + DWORD OriginalResourceTableAddress; + DWORD OriginalResourceTableSize; + bool StrippedTLS; + bool DontFixTLS; + DWORD OriginalTLSTableAddress; + DWORD OriginalTLSTableSize; + bool StrippedLoadConfig; + bool DontFixLoadConfig; + DWORD OriginalLoadConfigTableAddress; + DWORD OriginalLoadConfigTableSize; + bool StrippedBoundImports; + bool DontFixBoundImports; + DWORD OriginalBoundImportTableAddress; + DWORD OriginalBoundImportTableSize; + bool StrippedIAT; + bool DontFixIAT; + DWORD OriginalImportAddressTableAddress; + DWORD OriginalImportAddressTableSize; + bool StrippedCOM; + bool DontFixCOM; + DWORD OriginalCOMTableAddress; + DWORD OriginalCOMTableSize; +} FILE_FIX_INFO, *PFILE_FIX_INFO; + +#ifdef __cplusplus +extern "C" +{ +#endif + +// Global.Function.Declaration: +// TitanEngine.Dumper.functions: +__declspec(dllexport) bool TITCALL DumpProcess(HANDLE hProcess, LPVOID ImageBase, char* szDumpFileName, ULONG_PTR EntryPoint); +__declspec(dllexport) bool TITCALL DumpProcessW(HANDLE hProcess, LPVOID ImageBase, wchar_t* szDumpFileName, ULONG_PTR EntryPoint); +__declspec(dllexport) bool TITCALL DumpProcessEx(DWORD ProcessId, LPVOID ImageBase, char* szDumpFileName, ULONG_PTR EntryPoint); +__declspec(dllexport) bool TITCALL DumpProcessExW(DWORD ProcessId, LPVOID ImageBase, wchar_t* szDumpFileName, ULONG_PTR EntryPoint); +__declspec(dllexport) bool TITCALL DumpMemory(HANDLE hProcess, LPVOID MemoryStart, ULONG_PTR MemorySize, char* szDumpFileName); +__declspec(dllexport) bool TITCALL DumpMemoryW(HANDLE hProcess, LPVOID MemoryStart, ULONG_PTR MemorySize, wchar_t* szDumpFileName); +__declspec(dllexport) bool TITCALL DumpMemoryEx(DWORD ProcessId, LPVOID MemoryStart, ULONG_PTR MemorySize, char* szDumpFileName); +__declspec(dllexport) bool TITCALL DumpMemoryExW(DWORD ProcessId, LPVOID MemoryStart, ULONG_PTR MemorySize, wchar_t* szDumpFileName); +__declspec(dllexport) bool TITCALL DumpRegions(HANDLE hProcess, char* szDumpFolder, bool DumpAboveImageBaseOnly); +__declspec(dllexport) bool TITCALL DumpRegionsW(HANDLE hProcess, wchar_t* szDumpFolder, bool DumpAboveImageBaseOnly); +__declspec(dllexport) bool TITCALL DumpRegionsEx(DWORD ProcessId, char* szDumpFolder, bool DumpAboveImageBaseOnly); +__declspec(dllexport) bool TITCALL DumpRegionsExW(DWORD ProcessId, wchar_t* szDumpFolder, bool DumpAboveImageBaseOnly); +__declspec(dllexport) bool TITCALL DumpModule(HANDLE hProcess, LPVOID ModuleBase, char* szDumpFileName); +__declspec(dllexport) bool TITCALL DumpModuleW(HANDLE hProcess, LPVOID ModuleBase, wchar_t* szDumpFileName); +__declspec(dllexport) bool TITCALL DumpModuleEx(DWORD ProcessId, LPVOID ModuleBase, char* szDumpFileName); +__declspec(dllexport) bool TITCALL DumpModuleExW(DWORD ProcessId, LPVOID ModuleBase, wchar_t* szDumpFileName); +__declspec(dllexport) bool TITCALL PastePEHeader(HANDLE hProcess, LPVOID ImageBase, char* szDebuggedFileName); +__declspec(dllexport) bool TITCALL PastePEHeaderW(HANDLE hProcess, LPVOID ImageBase, wchar_t* szDebuggedFileName); +__declspec(dllexport) bool TITCALL ExtractSection(char* szFileName, char* szDumpFileName, DWORD SectionNumber); +__declspec(dllexport) bool TITCALL ExtractSectionW(wchar_t* szFileName, wchar_t* szDumpFileName, DWORD SectionNumber); +__declspec(dllexport) bool TITCALL ResortFileSections(char* szFileName); +__declspec(dllexport) bool TITCALL ResortFileSectionsW(wchar_t* szFileName); +__declspec(dllexport) bool TITCALL FindOverlay(char* szFileName, LPDWORD OverlayStart, LPDWORD OverlaySize); +__declspec(dllexport) bool TITCALL FindOverlayW(wchar_t* szFileName, LPDWORD OverlayStart, LPDWORD OverlaySize); +__declspec(dllexport) bool TITCALL ExtractOverlay(char* szFileName, char* szExtactedFileName); +__declspec(dllexport) bool TITCALL ExtractOverlayW(wchar_t* szFileName, wchar_t* szExtactedFileName); +__declspec(dllexport) bool TITCALL AddOverlay(char* szFileName, char* szOverlayFileName); +__declspec(dllexport) bool TITCALL AddOverlayW(wchar_t* szFileName, wchar_t* szOverlayFileName); +__declspec(dllexport) bool TITCALL CopyOverlay(char* szInFileName, char* szOutFileName); +__declspec(dllexport) bool TITCALL CopyOverlayW(wchar_t* szInFileName, wchar_t* szOutFileName); +__declspec(dllexport) bool TITCALL RemoveOverlay(char* szFileName); +__declspec(dllexport) bool TITCALL RemoveOverlayW(wchar_t* szFileName); +__declspec(dllexport) bool TITCALL MakeAllSectionsRWE(char* szFileName); +__declspec(dllexport) bool TITCALL MakeAllSectionsRWEW(wchar_t* szFileName); +__declspec(dllexport) long TITCALL AddNewSectionEx(char* szFileName, char* szSectionName, DWORD SectionSize, DWORD SectionAttributes, LPVOID SectionContent, DWORD ContentSize); +__declspec(dllexport) long TITCALL AddNewSectionExW(wchar_t* szFileName, char* szSectionName, DWORD SectionSize, DWORD SectionAttributes, LPVOID SectionContent, DWORD ContentSize); +__declspec(dllexport) long TITCALL AddNewSection(char* szFileName, char* szSectionName, DWORD SectionSize); +__declspec(dllexport) long TITCALL AddNewSectionW(wchar_t* szFileName, char* szSectionName, DWORD SectionSize); +__declspec(dllexport) bool TITCALL ResizeLastSection(char* szFileName, DWORD NumberOfExpandBytes, bool AlignResizeData); +__declspec(dllexport) bool TITCALL ResizeLastSectionW(wchar_t* szFileName, DWORD NumberOfExpandBytes, bool AlignResizeData); +__declspec(dllexport) void TITCALL SetSharedOverlay(char* szFileName); +__declspec(dllexport) void TITCALL SetSharedOverlayW(wchar_t* szFileName); +__declspec(dllexport) char* TITCALL GetSharedOverlay(); +__declspec(dllexport) wchar_t* TITCALL GetSharedOverlayW(); +__declspec(dllexport) bool TITCALL DeleteLastSection(char* szFileName); +__declspec(dllexport) bool TITCALL DeleteLastSectionW(wchar_t* szFileName); +__declspec(dllexport) bool TITCALL DeleteLastSectionEx(char* szFileName, DWORD NumberOfSections); +__declspec(dllexport) bool TITCALL DeleteLastSectionExW(wchar_t* szFileName, DWORD NumberOfSections); +__declspec(dllexport) long long TITCALL GetPE32DataFromMappedFile(ULONG_PTR FileMapVA, DWORD WhichSection, DWORD WhichData); +__declspec(dllexport) long long TITCALL GetPE32Data(char* szFileName, DWORD WhichSection, DWORD WhichData); +__declspec(dllexport) long long TITCALL GetPE32DataW(wchar_t* szFileName, DWORD WhichSection, DWORD WhichData); +__declspec(dllexport) bool TITCALL GetPE32DataFromMappedFileEx(ULONG_PTR FileMapVA, LPVOID DataStorage); +__declspec(dllexport) bool TITCALL GetPE32DataEx(char* szFileName, LPVOID DataStorage); +__declspec(dllexport) bool TITCALL GetPE32DataExW(wchar_t* szFileName, LPVOID DataStorage); +__declspec(dllexport) bool TITCALL SetPE32DataForMappedFile(ULONG_PTR FileMapVA, DWORD WhichSection, DWORD WhichData, ULONG_PTR NewDataValue); +__declspec(dllexport) bool TITCALL SetPE32Data(char* szFileName, DWORD WhichSection, DWORD WhichData, ULONG_PTR NewDataValue); +__declspec(dllexport) bool TITCALL SetPE32DataW(wchar_t* szFileName, DWORD WhichSection, DWORD WhichData, ULONG_PTR NewDataValue); +__declspec(dllexport) bool TITCALL SetPE32DataForMappedFileEx(ULONG_PTR FileMapVA, LPVOID DataStorage); +__declspec(dllexport) bool TITCALL SetPE32DataEx(char* szFileName, LPVOID DataStorage); +__declspec(dllexport) bool TITCALL SetPE32DataExW(wchar_t* szFileName, LPVOID DataStorage); +__declspec(dllexport) long TITCALL GetPE32SectionNumberFromVA(ULONG_PTR FileMapVA, ULONG_PTR AddressToConvert); +__declspec(dllexport) long long TITCALL ConvertVAtoFileOffset(ULONG_PTR FileMapVA, ULONG_PTR AddressToConvert, bool ReturnType); +__declspec(dllexport) long long TITCALL ConvertVAtoFileOffsetEx(ULONG_PTR FileMapVA, DWORD FileSize, ULONG_PTR ImageBase, ULONG_PTR AddressToConvert, bool AddressIsRVA, bool ReturnType); +__declspec(dllexport) long long TITCALL ConvertFileOffsetToVA(ULONG_PTR FileMapVA, ULONG_PTR AddressToConvert, bool ReturnType); +__declspec(dllexport) long long TITCALL ConvertFileOffsetToVAEx(ULONG_PTR FileMapVA, DWORD FileSize, ULONG_PTR ImageBase, ULONG_PTR AddressToConvert, bool ReturnType); +// TitanEngine.Realigner.functions: +__declspec(dllexport) bool TITCALL FixHeaderCheckSum(char* szFileName); +__declspec(dllexport) bool TITCALL FixHeaderCheckSumW(wchar_t* szFileName); +__declspec(dllexport) long TITCALL RealignPE(ULONG_PTR FileMapVA, DWORD FileSize, DWORD RealingMode); +__declspec(dllexport) long TITCALL RealignPEEx(char* szFileName, DWORD RealingFileSize, DWORD ForcedFileAlignment); +__declspec(dllexport) long TITCALL RealignPEExW(wchar_t* szFileName, DWORD RealingFileSize, DWORD ForcedFileAlignment); +__declspec(dllexport) bool TITCALL WipeSection(char* szFileName, int WipeSectionNumber, bool RemovePhysically); +__declspec(dllexport) bool TITCALL WipeSectionW(wchar_t* szFileName, int WipeSectionNumber, bool RemovePhysically); +__declspec(dllexport) bool TITCALL IsPE32FileValidEx(char* szFileName, DWORD CheckDepth, LPVOID FileStatusInfo); +__declspec(dllexport) bool TITCALL IsPE32FileValidExW(wchar_t* szFileName, DWORD CheckDepth, LPVOID FileStatusInfo); +__declspec(dllexport) bool TITCALL FixBrokenPE32FileEx(char* szFileName, LPVOID FileStatusInfo, LPVOID FileFixInfo); +__declspec(dllexport) bool TITCALL FixBrokenPE32FileExW(wchar_t* szFileName, LPVOID FileStatusInfo, LPVOID FileFixInfo); +__declspec(dllexport) bool TITCALL IsFileDLL(char* szFileName, ULONG_PTR FileMapVA); +__declspec(dllexport) bool TITCALL IsFileDLLW(wchar_t* szFileName, ULONG_PTR FileMapVA); +// TitanEngine.Hider.functions: +__declspec(dllexport) void* TITCALL GetPEBLocation(HANDLE hProcess); +__declspec(dllexport) bool TITCALL HideDebugger(HANDLE hProcess, DWORD PatchAPILevel); +__declspec(dllexport) bool TITCALL UnHideDebugger(HANDLE hProcess, DWORD PatchAPILevel); +// TitanEngine.Relocater.functions: +__declspec(dllexport) void TITCALL RelocaterCleanup(); +__declspec(dllexport) void TITCALL RelocaterInit(DWORD MemorySize, ULONG_PTR OldImageBase, ULONG_PTR NewImageBase); +__declspec(dllexport) void TITCALL RelocaterAddNewRelocation(HANDLE hProcess, ULONG_PTR RelocateAddress, DWORD RelocateState); +__declspec(dllexport) long TITCALL RelocaterEstimatedSize(); +__declspec(dllexport) bool TITCALL RelocaterExportRelocation(ULONG_PTR StorePlace, DWORD StorePlaceRVA, ULONG_PTR FileMapVA); +__declspec(dllexport) bool TITCALL RelocaterExportRelocationEx(char* szFileName, char* szSectionName); +__declspec(dllexport) bool TITCALL RelocaterExportRelocationExW(wchar_t* szFileName, char* szSectionName); +__declspec(dllexport) bool TITCALL RelocaterGrabRelocationTable(HANDLE hProcess, ULONG_PTR MemoryStart, DWORD MemorySize); +__declspec(dllexport) bool TITCALL RelocaterGrabRelocationTableEx(HANDLE hProcess, ULONG_PTR MemoryStart, ULONG_PTR MemorySize, DWORD NtSizeOfImage); +__declspec(dllexport) bool TITCALL RelocaterMakeSnapshot(HANDLE hProcess, char* szSaveFileName, LPVOID MemoryStart, ULONG_PTR MemorySize); +__declspec(dllexport) bool TITCALL RelocaterMakeSnapshotW(HANDLE hProcess, wchar_t* szSaveFileName, LPVOID MemoryStart, ULONG_PTR MemorySize); +__declspec(dllexport) bool TITCALL RelocaterCompareTwoSnapshots(HANDLE hProcess, ULONG_PTR LoadedImageBase, ULONG_PTR NtSizeOfImage, char* szDumpFile1, char* szDumpFile2, ULONG_PTR MemStart); +__declspec(dllexport) bool TITCALL RelocaterCompareTwoSnapshotsW(HANDLE hProcess, ULONG_PTR LoadedImageBase, ULONG_PTR NtSizeOfImage, wchar_t* szDumpFile1, wchar_t* szDumpFile2, ULONG_PTR MemStart); +__declspec(dllexport) bool TITCALL RelocaterChangeFileBase(char* szFileName, ULONG_PTR NewImageBase); +__declspec(dllexport) bool TITCALL RelocaterChangeFileBaseW(wchar_t* szFileName, ULONG_PTR NewImageBase); +__declspec(dllexport) bool TITCALL RelocaterRelocateMemoryBlock(ULONG_PTR FileMapVA, ULONG_PTR MemoryLocation, void* RelocateMemory, DWORD RelocateMemorySize, ULONG_PTR CurrentLoadedBase, ULONG_PTR RelocateBase); +__declspec(dllexport) bool TITCALL RelocaterWipeRelocationTable(char* szFileName); +__declspec(dllexport) bool TITCALL RelocaterWipeRelocationTableW(wchar_t* szFileName); +// TitanEngine.Resourcer.functions: +__declspec(dllexport) long long TITCALL ResourcerLoadFileForResourceUse(char* szFileName); +__declspec(dllexport) long long TITCALL ResourcerLoadFileForResourceUseW(wchar_t* szFileName); +__declspec(dllexport) bool TITCALL ResourcerFreeLoadedFile(LPVOID LoadedFileBase); +__declspec(dllexport) bool TITCALL ResourcerExtractResourceFromFileEx(ULONG_PTR FileMapVA, char* szResourceType, char* szResourceName, char* szExtractedFileName); +__declspec(dllexport) bool TITCALL ResourcerExtractResourceFromFile(char* szFileName, char* szResourceType, char* szResourceName, char* szExtractedFileName); +__declspec(dllexport) bool TITCALL ResourcerExtractResourceFromFileW(wchar_t* szFileName, char* szResourceType, char* szResourceName, char* szExtractedFileName); +__declspec(dllexport) bool TITCALL ResourcerFindResource(char* szFileName, char* szResourceType, DWORD ResourceType, char* szResourceName, DWORD ResourceName, DWORD ResourceLanguage, PULONG_PTR pResourceData, LPDWORD pResourceSize); +__declspec(dllexport) bool TITCALL ResourcerFindResourceW(wchar_t* szFileName, wchar_t* szResourceType, DWORD ResourceType, wchar_t* szResourceName, DWORD ResourceName, DWORD ResourceLanguage, PULONG_PTR pResourceData, LPDWORD pResourceSize); +__declspec(dllexport) bool TITCALL ResourcerFindResourceEx(ULONG_PTR FileMapVA, DWORD FileSize, wchar_t* szResourceType, DWORD ResourceType, wchar_t* szResourceName, DWORD ResourceName, DWORD ResourceLanguage, PULONG_PTR pResourceData, LPDWORD pResourceSize); +__declspec(dllexport) void TITCALL ResourcerEnumerateResource(char* szFileName, void* CallBack); +__declspec(dllexport) void TITCALL ResourcerEnumerateResourceW(wchar_t* szFileName, void* CallBack); +__declspec(dllexport) void TITCALL ResourcerEnumerateResourceEx(ULONG_PTR FileMapVA, DWORD FileSize, void* CallBack); +// TitanEngine.Threader.functions: +__declspec(dllexport) bool TITCALL ThreaderImportRunningThreadData(DWORD ProcessId); +__declspec(dllexport) void* TITCALL ThreaderGetThreadInfo(HANDLE hThread, DWORD ThreadId); +__declspec(dllexport) void TITCALL ThreaderEnumThreadInfo(void* EnumCallBack); +__declspec(dllexport) bool TITCALL ThreaderPauseThread(HANDLE hThread); +__declspec(dllexport) bool TITCALL ThreaderResumeThread(HANDLE hThread); +__declspec(dllexport) bool TITCALL ThreaderTerminateThread(HANDLE hThread, DWORD ThreadExitCode); +__declspec(dllexport) bool TITCALL ThreaderPauseAllThreads(bool LeaveMainRunning); +__declspec(dllexport) bool TITCALL ThreaderResumeAllThreads(bool LeaveMainPaused); +__declspec(dllexport) bool TITCALL ThreaderPauseProcess(); +__declspec(dllexport) bool TITCALL ThreaderResumeProcess(); +__declspec(dllexport) long long TITCALL ThreaderCreateRemoteThread(ULONG_PTR ThreadStartAddress, bool AutoCloseTheHandle, LPVOID ThreadPassParameter, LPDWORD ThreadId); +__declspec(dllexport) bool TITCALL ThreaderInjectAndExecuteCode(LPVOID InjectCode, DWORD StartDelta, DWORD InjectSize); +__declspec(dllexport) long long TITCALL ThreaderCreateRemoteThreadEx(HANDLE hProcess, ULONG_PTR ThreadStartAddress, bool AutoCloseTheHandle, LPVOID ThreadPassParameter, LPDWORD ThreadId); +__declspec(dllexport) bool TITCALL ThreaderInjectAndExecuteCodeEx(HANDLE hProcess, LPVOID InjectCode, DWORD StartDelta, DWORD InjectSize); +__declspec(dllexport) void TITCALL ThreaderSetCallBackForNextExitThreadEvent(LPVOID exitThreadCallBack); +__declspec(dllexport) bool TITCALL ThreaderIsThreadStillRunning(HANDLE hThread); +__declspec(dllexport) bool TITCALL ThreaderIsThreadActive(HANDLE hThread); +__declspec(dllexport) bool TITCALL ThreaderIsAnyThreadActive(); +__declspec(dllexport) bool TITCALL ThreaderExecuteOnlyInjectedThreads(); +__declspec(dllexport) long long TITCALL ThreaderGetOpenHandleForThread(DWORD ThreadId); +__declspec(dllexport) void* TITCALL ThreaderGetThreadData(); +__declspec(dllexport) bool TITCALL ThreaderIsExceptionInMainThread(); +// TitanEngine.Debugger.functions: +__declspec(dllexport) void* TITCALL StaticDisassembleEx(ULONG_PTR DisassmStart, LPVOID DisassmAddress); +__declspec(dllexport) void* TITCALL StaticDisassemble(LPVOID DisassmAddress); +__declspec(dllexport) void* TITCALL DisassembleEx(HANDLE hProcess, LPVOID DisassmAddress, bool ReturnInstructionType); +__declspec(dllexport) void* TITCALL Disassemble(LPVOID DisassmAddress); +__declspec(dllexport) long TITCALL StaticLengthDisassemble(LPVOID DisassmAddress); +__declspec(dllexport) long TITCALL LengthDisassembleEx(HANDLE hProcess, LPVOID DisassmAddress); +__declspec(dllexport) long TITCALL LengthDisassemble(LPVOID DisassmAddress); +__declspec(dllexport) void* TITCALL InitDebug(char* szFileName, char* szCommandLine, char* szCurrentFolder); +__declspec(dllexport) void* TITCALL InitDebugW(wchar_t* szFileName, wchar_t* szCommandLine, wchar_t* szCurrentFolder); +__declspec(dllexport) void* TITCALL InitDebugEx(char* szFileName, char* szCommandLine, char* szCurrentFolder, LPVOID EntryCallBack); +__declspec(dllexport) void* TITCALL InitDebugExW(wchar_t* szFileName, wchar_t* szCommandLine, wchar_t* szCurrentFolder, LPVOID EntryCallBack); +__declspec(dllexport) void* TITCALL InitDLLDebug(char* szFileName, bool ReserveModuleBase, char* szCommandLine, char* szCurrentFolder, LPVOID EntryCallBack); +__declspec(dllexport) void* TITCALL InitDLLDebugW(wchar_t* szFileName, bool ReserveModuleBase, wchar_t* szCommandLine, wchar_t* szCurrentFolder, LPVOID EntryCallBack); +__declspec(dllexport) bool TITCALL StopDebug(); +__declspec(dllexport) void TITCALL SetBPXOptions(long DefaultBreakPointType); +__declspec(dllexport) bool TITCALL IsBPXEnabled(ULONG_PTR bpxAddress); +__declspec(dllexport) bool TITCALL EnableBPX(ULONG_PTR bpxAddress); +__declspec(dllexport) bool TITCALL DisableBPX(ULONG_PTR bpxAddress); +__declspec(dllexport) bool TITCALL SetBPX(ULONG_PTR bpxAddress, DWORD bpxType, LPVOID bpxCallBack); +__declspec(dllexport) bool TITCALL SetBPXEx(ULONG_PTR bpxAddress, DWORD bpxType, DWORD NumberOfExecution, DWORD CmpRegister, DWORD CmpCondition, ULONG_PTR CmpValue, LPVOID bpxCallBack, LPVOID bpxCompareCallBack, LPVOID bpxRemoveCallBack); +__declspec(dllexport) bool TITCALL DeleteBPX(ULONG_PTR bpxAddress); +__declspec(dllexport) bool TITCALL SafeDeleteBPX(ULONG_PTR bpxAddress); +__declspec(dllexport) bool TITCALL SetAPIBreakPoint(char* szDLLName, char* szAPIName, DWORD bpxType, DWORD bpxPlace, LPVOID bpxCallBack); +__declspec(dllexport) bool TITCALL DeleteAPIBreakPoint(char* szDLLName, char* szAPIName, DWORD bpxPlace); +__declspec(dllexport) bool TITCALL SafeDeleteAPIBreakPoint(char* szDLLName, char* szAPIName, DWORD bpxPlace); +__declspec(dllexport) bool TITCALL SetMemoryBPX(ULONG_PTR MemoryStart, DWORD SizeOfMemory, LPVOID bpxCallBack); +__declspec(dllexport) bool TITCALL SetMemoryBPXEx(ULONG_PTR MemoryStart, DWORD SizeOfMemory, DWORD BreakPointType, bool RestoreOnHit, LPVOID bpxCallBack); +__declspec(dllexport) bool TITCALL RemoveMemoryBPX(ULONG_PTR MemoryStart, DWORD SizeOfMemory); +__declspec(dllexport) bool TITCALL GetContextFPUDataEx(HANDLE hActiveThread, void* FPUSaveArea); +__declspec(dllexport) long long TITCALL GetContextDataEx(HANDLE hActiveThread, DWORD IndexOfRegister); +__declspec(dllexport) long long TITCALL GetContextData(DWORD IndexOfRegister); +__declspec(dllexport) bool TITCALL SetContextFPUDataEx(HANDLE hActiveThread, void* FPUSaveArea); +__declspec(dllexport) bool TITCALL SetContextDataEx(HANDLE hActiveThread, DWORD IndexOfRegister, ULONG_PTR NewRegisterValue); +__declspec(dllexport) bool TITCALL SetContextData(DWORD IndexOfRegister, ULONG_PTR NewRegisterValue); +__declspec(dllexport) void TITCALL ClearExceptionNumber(); +__declspec(dllexport) long TITCALL CurrentExceptionNumber(); +__declspec(dllexport) bool TITCALL MatchPatternEx(HANDLE hProcess, void* MemoryToCheck, int SizeOfMemoryToCheck, void* PatternToMatch, int SizeOfPatternToMatch, PBYTE WildCard); +__declspec(dllexport) bool TITCALL MatchPattern(void* MemoryToCheck, int SizeOfMemoryToCheck, void* PatternToMatch, int SizeOfPatternToMatch, PBYTE WildCard); +__declspec(dllexport) long long TITCALL FindEx(HANDLE hProcess, LPVOID MemoryStart, DWORD MemorySize, LPVOID SearchPattern, DWORD PatternSize, LPBYTE WildCard); +extern "C" __declspec(dllexport) long long TITCALL Find(LPVOID MemoryStart, DWORD MemorySize, LPVOID SearchPattern, DWORD PatternSize, LPBYTE WildCard); +__declspec(dllexport) bool TITCALL FillEx(HANDLE hProcess, LPVOID MemoryStart, DWORD MemorySize, PBYTE FillByte); +__declspec(dllexport) bool TITCALL Fill(LPVOID MemoryStart, DWORD MemorySize, PBYTE FillByte); +__declspec(dllexport) bool TITCALL PatchEx(HANDLE hProcess, LPVOID MemoryStart, DWORD MemorySize, LPVOID ReplacePattern, DWORD ReplaceSize, bool AppendNOP, bool PrependNOP); +__declspec(dllexport) bool TITCALL Patch(LPVOID MemoryStart, DWORD MemorySize, LPVOID ReplacePattern, DWORD ReplaceSize, bool AppendNOP, bool PrependNOP); +__declspec(dllexport) bool TITCALL ReplaceEx(HANDLE hProcess, LPVOID MemoryStart, DWORD MemorySize, LPVOID SearchPattern, DWORD PatternSize, DWORD NumberOfRepetitions, LPVOID ReplacePattern, DWORD ReplaceSize, PBYTE WildCard); +__declspec(dllexport) bool TITCALL Replace(LPVOID MemoryStart, DWORD MemorySize, LPVOID SearchPattern, DWORD PatternSize, DWORD NumberOfRepetitions, LPVOID ReplacePattern, DWORD ReplaceSize, PBYTE WildCard); +__declspec(dllexport) void* TITCALL GetDebugData(); +__declspec(dllexport) void* TITCALL GetTerminationData(); +__declspec(dllexport) long TITCALL GetExitCode(); +__declspec(dllexport) long long TITCALL GetDebuggedDLLBaseAddress(); +__declspec(dllexport) unsigned long long TITCALL GetDebuggedFileBaseAddress(); +__declspec(dllexport) bool TITCALL GetRemoteString(HANDLE hProcess, LPVOID StringAddress, LPVOID StringStorage, int MaximumStringSize); +__declspec(dllexport) long long TITCALL GetFunctionParameter(HANDLE hProcess, DWORD FunctionType, DWORD ParameterNumber, DWORD ParameterType); +__declspec(dllexport) long long TITCALL GetJumpDestinationEx(HANDLE hProcess, ULONG_PTR InstructionAddress, bool JustJumps); +__declspec(dllexport) long long TITCALL GetJumpDestination(HANDLE hProcess, ULONG_PTR InstructionAddress); +__declspec(dllexport) bool TITCALL IsJumpGoingToExecuteEx(HANDLE hProcess, HANDLE hThread, ULONG_PTR InstructionAddress, ULONG_PTR RegFlags); +__declspec(dllexport) bool TITCALL IsJumpGoingToExecute(); +__declspec(dllexport) void TITCALL SetCustomHandler(DWORD ExceptionId, LPVOID CallBack); +__declspec(dllexport) void TITCALL ForceClose(); +__declspec(dllexport) void TITCALL StepInto(LPVOID traceCallBack); +__declspec(dllexport) void TITCALL StepOver(LPVOID traceCallBack); +__declspec(dllexport) void TITCALL SingleStep(DWORD StepCount, LPVOID StepCallBack); +__declspec(dllexport) bool TITCALL GetUnusedHardwareBreakPointRegister(LPDWORD RegisterIndex); +__declspec(dllexport) bool TITCALL SetHardwareBreakPointEx(HANDLE hActiveThread, ULONG_PTR bpxAddress, DWORD IndexOfRegister, DWORD bpxType, DWORD bpxSize, LPVOID bpxCallBack, LPDWORD IndexOfSelectedRegister); +__declspec(dllexport) bool TITCALL SetHardwareBreakPoint(ULONG_PTR bpxAddress, DWORD IndexOfRegister, DWORD bpxType, DWORD bpxSize, LPVOID bpxCallBack); +__declspec(dllexport) bool TITCALL DeleteHardwareBreakPoint(DWORD IndexOfRegister); +__declspec(dllexport) bool TITCALL RemoveAllBreakPoints(DWORD RemoveOption); +__declspec(dllexport) void* TITCALL GetProcessInformation(); +__declspec(dllexport) void* TITCALL GetStartupInformation(); +__declspec(dllexport) void TITCALL DebugLoop(); +__declspec(dllexport) void TITCALL SetDebugLoopTimeOut(DWORD TimeOut); +__declspec(dllexport) void TITCALL SetNextDbgContinueStatus(DWORD SetDbgCode); +__declspec(dllexport) bool TITCALL AttachDebugger(DWORD ProcessId, bool KillOnExit, LPVOID DebugInfo, LPVOID CallBack); +__declspec(dllexport) bool TITCALL DetachDebugger(DWORD ProcessId); +__declspec(dllexport) bool TITCALL DetachDebuggerEx(DWORD ProcessId); +__declspec(dllexport) void TITCALL DebugLoopEx(DWORD TimeOut); +__declspec(dllexport) void TITCALL AutoDebugEx(char* szFileName, bool ReserveModuleBase, char* szCommandLine, char* szCurrentFolder, DWORD TimeOut, LPVOID EntryCallBack); +__declspec(dllexport) void TITCALL AutoDebugExW(wchar_t* szFileName, bool ReserveModuleBase, wchar_t* szCommandLine, wchar_t* szCurrentFolder, DWORD TimeOut, LPVOID EntryCallBack); +__declspec(dllexport) bool TITCALL IsFileBeingDebugged(); +__declspec(dllexport) void TITCALL SetErrorModel(bool DisplayErrorMessages); +// TitanEngine.FindOEP.functions: +__declspec(dllexport) void TITCALL FindOEPInit(); +__declspec(dllexport) bool TITCALL FindOEPGenerically(char* szFileName, LPVOID TraceInitCallBack, LPVOID CallBack); +__declspec(dllexport) bool TITCALL FindOEPGenericallyW(wchar_t* szFileName, LPVOID TraceInitCallBack, LPVOID CallBack); +// TitanEngine.Importer.functions: +__declspec(dllexport) void TITCALL ImporterCleanup(); +__declspec(dllexport) void TITCALL ImporterSetImageBase(ULONG_PTR ImageBase); +__declspec(dllexport) void TITCALL ImporterSetUnknownDelta(ULONG_PTR DeltaAddress); +__declspec(dllexport) long long TITCALL ImporterGetCurrentDelta(); +__declspec(dllexport) void TITCALL ImporterInit(DWORD MemorySize, ULONG_PTR ImageBase); +__declspec(dllexport) void TITCALL ImporterAddNewDll(char* szDLLName, ULONG_PTR FirstThunk); +__declspec(dllexport) void TITCALL ImporterAddNewAPI(char* szAPIName, ULONG_PTR ThunkValue); +__declspec(dllexport) void TITCALL ImporterAddNewOrdinalAPI(ULONG_PTR OrdinalNumber, ULONG_PTR ThunkValue); +__declspec(dllexport) long TITCALL ImporterGetAddedDllCount(); +__declspec(dllexport) long TITCALL ImporterGetAddedAPICount(); +__declspec(dllexport) void* TITCALL ImporterGetLastAddedDLLName(); +__declspec(dllexport) void TITCALL ImporterMoveIAT(); +__declspec(dllexport) bool TITCALL ImporterExportIAT(ULONG_PTR StorePlace, ULONG_PTR FileMapVA); +__declspec(dllexport) long TITCALL ImporterEstimatedSize(); +__declspec(dllexport) bool TITCALL ImporterExportIATEx(char* szExportFileName, char* szSectionName); +__declspec(dllexport) bool TITCALL ImporterExportIATExW(wchar_t* szExportFileName, char* szSectionName); +__declspec(dllexport) long long TITCALL ImporterFindAPIWriteLocation(char* szAPIName); +__declspec(dllexport) long long TITCALL ImporterFindOrdinalAPIWriteLocation(ULONG_PTR OrdinalNumber); +__declspec(dllexport) long long TITCALL ImporterFindAPIByWriteLocation(ULONG_PTR APIWriteLocation); +__declspec(dllexport) long long TITCALL ImporterFindDLLByWriteLocation(ULONG_PTR APIWriteLocation); +__declspec(dllexport) void* TITCALL ImporterGetDLLName(ULONG_PTR APIAddress); +__declspec(dllexport) void* TITCALL ImporterGetAPIName(ULONG_PTR APIAddress); +__declspec(dllexport) long long TITCALL ImporterGetAPIOrdinalNumber(ULONG_PTR APIAddress); +__declspec(dllexport) void* TITCALL ImporterGetAPINameEx(ULONG_PTR APIAddress, ULONG_PTR DLLBasesList); +__declspec(dllexport) long long TITCALL ImporterGetRemoteAPIAddress(HANDLE hProcess, ULONG_PTR APIAddress); +__declspec(dllexport) long long TITCALL ImporterGetRemoteAPIAddressEx(char* szDLLName, char* szAPIName); +__declspec(dllexport) long long TITCALL ImporterGetLocalAPIAddress(HANDLE hProcess, ULONG_PTR APIAddress); +__declspec(dllexport) void* TITCALL ImporterGetDLLNameFromDebugee(HANDLE hProcess, ULONG_PTR APIAddress); +__declspec(dllexport) void* TITCALL ImporterGetAPINameFromDebugee(HANDLE hProcess, ULONG_PTR APIAddress); +__declspec(dllexport) long long TITCALL ImporterGetAPIOrdinalNumberFromDebugee(HANDLE hProcess, ULONG_PTR APIAddress); +__declspec(dllexport) long TITCALL ImporterGetDLLIndexEx(ULONG_PTR APIAddress, ULONG_PTR DLLBasesList); +__declspec(dllexport) long TITCALL ImporterGetDLLIndex(HANDLE hProcess, ULONG_PTR APIAddress, ULONG_PTR DLLBasesList); +__declspec(dllexport) long long TITCALL ImporterGetRemoteDLLBase(HANDLE hProcess, HMODULE LocalModuleBase); +__declspec(dllexport) long long TITCALL ImporterGetRemoteDLLBaseEx(HANDLE hProcess, char* szModuleName); +__declspec(dllexport) bool TITCALL ImporterRelocateWriteLocation(ULONG_PTR AddValue); +__declspec(dllexport) bool TITCALL ImporterIsForwardedAPI(HANDLE hProcess, ULONG_PTR APIAddress); +__declspec(dllexport) void* TITCALL ImporterGetForwardedAPIName(HANDLE hProcess, ULONG_PTR APIAddress); +__declspec(dllexport) void* TITCALL ImporterGetForwardedDLLName(HANDLE hProcess, ULONG_PTR APIAddress); +__declspec(dllexport) long TITCALL ImporterGetForwardedDLLIndex(HANDLE hProcess, ULONG_PTR APIAddress, ULONG_PTR DLLBasesList); +__declspec(dllexport) long long TITCALL ImporterGetForwardedAPIOrdinalNumber(HANDLE hProcess, ULONG_PTR APIAddress); +__declspec(dllexport) long long TITCALL ImporterGetNearestAPIAddress(HANDLE hProcess, ULONG_PTR APIAddress); +__declspec(dllexport) void* TITCALL ImporterGetNearestAPIName(HANDLE hProcess, ULONG_PTR APIAddress); +__declspec(dllexport) bool TITCALL ImporterCopyOriginalIAT(char* szOriginalFile, char* szDumpFile); +__declspec(dllexport) bool TITCALL ImporterCopyOriginalIATW(wchar_t* szOriginalFile, wchar_t* szDumpFile); +__declspec(dllexport) bool TITCALL ImporterLoadImportTable(char* szFileName); +__declspec(dllexport) bool TITCALL ImporterLoadImportTableW(wchar_t* szFileName); +__declspec(dllexport) bool TITCALL ImporterMoveOriginalIAT(char* szOriginalFile, char* szDumpFile, char* szSectionName); +__declspec(dllexport) bool TITCALL ImporterMoveOriginalIATW(wchar_t* szOriginalFile, wchar_t* szDumpFile, char* szSectionName); +__declspec(dllexport) void TITCALL ImporterAutoSearchIAT(HANDLE hProcess, char* szFileName, ULONG_PTR ImageBase, ULONG_PTR SearchStart, DWORD SearchSize, LPVOID pIATStart, LPVOID pIATSize); +__declspec(dllexport) void TITCALL ImporterAutoSearchIATW(HANDLE hProcess, wchar_t* szFileName, ULONG_PTR ImageBase, ULONG_PTR SearchStart, DWORD SearchSize, LPVOID pIATStart, LPVOID pIATSize); +__declspec(dllexport) void TITCALL ImporterAutoSearchIATEx(HANDLE hProcess, ULONG_PTR ImageBase, ULONG_PTR SearchStart, DWORD SearchSize, LPVOID pIATStart, LPVOID pIATSize); +__declspec(dllexport) void TITCALL ImporterEnumAddedData(LPVOID EnumCallBack); +__declspec(dllexport) long TITCALL ImporterAutoFixIATEx(HANDLE hProcess, char* szDumpedFile, char* szSectionName, bool DumpRunningProcess, bool RealignFile, ULONG_PTR EntryPointAddress, ULONG_PTR ImageBase, ULONG_PTR SearchStart, DWORD SearchSize, DWORD SearchStep, bool TryAutoFix, bool FixEliminations, LPVOID UnknownPointerFixCallback); +__declspec(dllexport) long TITCALL ImporterAutoFixIATExW(HANDLE hProcess, wchar_t* szDumpedFile, char* szSectionName, bool DumpRunningProcess, bool RealignFile, ULONG_PTR EntryPointAddress, ULONG_PTR ImageBase, ULONG_PTR SearchStart, DWORD SearchSize, DWORD SearchStep, bool TryAutoFix, bool FixEliminations, LPVOID UnknownPointerFixCallback); +__declspec(dllexport) long TITCALL ImporterAutoFixIAT(HANDLE hProcess, char* szDumpedFile, ULONG_PTR ImageBase, ULONG_PTR SearchStart, DWORD SearchSize, DWORD SearchStep); +__declspec(dllexport) long TITCALL ImporterAutoFixIATW(HANDLE hProcess, wchar_t* szDumpedFile, ULONG_PTR ImageBase, ULONG_PTR SearchStart, DWORD SearchSize, DWORD SearchStep); +// Global.Engine.Hook.functions: +__declspec(dllexport) bool TITCALL HooksSafeTransitionEx(LPVOID HookAddressArray, int NumberOfHooks, bool TransitionStart); +__declspec(dllexport) bool TITCALL HooksSafeTransition(LPVOID HookAddress, bool TransitionStart); +__declspec(dllexport) bool TITCALL HooksIsAddressRedirected(LPVOID HookAddress); +__declspec(dllexport) void* TITCALL HooksGetTrampolineAddress(LPVOID HookAddress); +__declspec(dllexport) void* TITCALL HooksGetHookEntryDetails(LPVOID HookAddress); +__declspec(dllexport) bool TITCALL HooksInsertNewRedirection(LPVOID HookAddress, LPVOID RedirectTo, int HookType); +__declspec(dllexport) bool TITCALL HooksInsertNewIATRedirectionEx(ULONG_PTR FileMapVA, ULONG_PTR LoadedModuleBase, char* szHookFunction, LPVOID RedirectTo); +__declspec(dllexport) bool TITCALL HooksInsertNewIATRedirection(char* szModuleName, char* szHookFunction, LPVOID RedirectTo); +__declspec(dllexport) bool TITCALL HooksRemoveRedirection(LPVOID HookAddress, bool RemoveAll); +__declspec(dllexport) bool TITCALL HooksRemoveRedirectionsForModule(HMODULE ModuleBase); +__declspec(dllexport) bool TITCALL HooksRemoveIATRedirection(char* szModuleName, char* szHookFunction, bool RemoveAll); +__declspec(dllexport) bool TITCALL HooksDisableRedirection(LPVOID HookAddress, bool DisableAll); +__declspec(dllexport) bool TITCALL HooksDisableRedirectionsForModule(HMODULE ModuleBase); +__declspec(dllexport) bool TITCALL HooksDisableIATRedirection(char* szModuleName, char* szHookFunction, bool DisableAll); +__declspec(dllexport) bool TITCALL HooksEnableRedirection(LPVOID HookAddress, bool EnableAll); +__declspec(dllexport) bool TITCALL HooksEnableRedirectionsForModule(HMODULE ModuleBase); +__declspec(dllexport) bool TITCALL HooksEnableIATRedirection(char* szModuleName, char* szHookFunction, bool EnableAll); +__declspec(dllexport) void TITCALL HooksScanModuleMemory(HMODULE ModuleBase, LPVOID CallBack); +__declspec(dllexport) void TITCALL HooksScanEntireProcessMemory(LPVOID CallBack); +__declspec(dllexport) void TITCALL HooksScanEntireProcessMemoryEx(); +// TitanEngine.Tracer.functions: +__declspec(dllexport) void TITCALL TracerInit(); +__declspec(dllexport) long long TITCALL TracerLevel1(HANDLE hProcess, ULONG_PTR AddressToTrace); +__declspec(dllexport) long long TITCALL HashTracerLevel1(HANDLE hProcess, ULONG_PTR AddressToTrace, DWORD InputNumberOfInstructions); +__declspec(dllexport) long TITCALL TracerDetectRedirection(HANDLE hProcess, ULONG_PTR AddressToTrace); +__declspec(dllexport) long long TITCALL TracerFixKnownRedirection(HANDLE hProcess, ULONG_PTR AddressToTrace, DWORD RedirectionId); +__declspec(dllexport) long long TITCALL TracerFixRedirectionViaModule(HMODULE hModuleHandle, HANDLE hProcess, ULONG_PTR AddressToTrace, DWORD IdParameter); +__declspec(dllexport) long TITCALL TracerFixRedirectionViaImpRecPlugin(HANDLE hProcess, char* szPluginName, ULONG_PTR AddressToTrace); +// TitanEngine.Exporter.functions: +__declspec(dllexport) void TITCALL ExporterCleanup(); +__declspec(dllexport) void TITCALL ExporterSetImageBase(ULONG_PTR ImageBase); +__declspec(dllexport) void TITCALL ExporterInit(DWORD MemorySize, ULONG_PTR ImageBase, DWORD ExportOrdinalBase, char* szExportModuleName); +__declspec(dllexport) bool TITCALL ExporterAddNewExport(char* szExportName, DWORD ExportRelativeAddress); +__declspec(dllexport) bool TITCALL ExporterAddNewOrdinalExport(DWORD OrdinalNumber, DWORD ExportRelativeAddress); +__declspec(dllexport) long TITCALL ExporterGetAddedExportCount(); +__declspec(dllexport) long TITCALL ExporterEstimatedSize(); +__declspec(dllexport) bool TITCALL ExporterBuildExportTable(ULONG_PTR StorePlace, ULONG_PTR FileMapVA); +__declspec(dllexport) bool TITCALL ExporterBuildExportTableEx(char* szExportFileName, char* szSectionName); +__declspec(dllexport) bool TITCALL ExporterBuildExportTableExW(wchar_t* szExportFileName, char* szSectionName); +__declspec(dllexport) bool TITCALL ExporterLoadExportTable(char* szFileName); +__declspec(dllexport) bool TITCALL ExporterLoadExportTableW(wchar_t* szFileName); +// TitanEngine.Librarian.functions: +__declspec(dllexport) bool TITCALL LibrarianSetBreakPoint(char* szLibraryName, DWORD bpxType, bool SingleShoot, LPVOID bpxCallBack); +__declspec(dllexport) bool TITCALL LibrarianRemoveBreakPoint(char* szLibraryName, DWORD bpxType); +__declspec(dllexport) void* TITCALL LibrarianGetLibraryInfo(char* szLibraryName); +__declspec(dllexport) void* TITCALL LibrarianGetLibraryInfoW(wchar_t* szLibraryName); +__declspec(dllexport) void* TITCALL LibrarianGetLibraryInfoEx(void* BaseOfDll); +__declspec(dllexport) void* TITCALL LibrarianGetLibraryInfoExW(void* BaseOfDll); +__declspec(dllexport) void TITCALL LibrarianEnumLibraryInfo(void* EnumCallBack); +__declspec(dllexport) void TITCALL LibrarianEnumLibraryInfoW(void* EnumCallBack); +// TitanEngine.Process.functions: +__declspec(dllexport) long TITCALL GetActiveProcessId(char* szImageName); +__declspec(dllexport) long TITCALL GetActiveProcessIdW(wchar_t* szImageName); +__declspec(dllexport) void TITCALL EnumProcessesWithLibrary(char* szLibraryName, void* EnumFunction); +// TitanEngine.TLSFixer.functions: +__declspec(dllexport) bool TITCALL TLSBreakOnCallBack(LPVOID ArrayOfCallBacks, DWORD NumberOfCallBacks, LPVOID bpxCallBack); +__declspec(dllexport) bool TITCALL TLSGrabCallBackData(char* szFileName, LPVOID ArrayOfCallBacks, LPDWORD NumberOfCallBacks); +__declspec(dllexport) bool TITCALL TLSGrabCallBackDataW(wchar_t* szFileName, LPVOID ArrayOfCallBacks, LPDWORD NumberOfCallBacks); +__declspec(dllexport) bool TITCALL TLSBreakOnCallBackEx(char* szFileName, LPVOID bpxCallBack); +__declspec(dllexport) bool TITCALL TLSBreakOnCallBackExW(wchar_t* szFileName, LPVOID bpxCallBack); +__declspec(dllexport) bool TITCALL TLSRemoveCallback(char* szFileName); +__declspec(dllexport) bool TITCALL TLSRemoveCallbackW(wchar_t* szFileName); +__declspec(dllexport) bool TITCALL TLSRemoveTable(char* szFileName); +__declspec(dllexport) bool TITCALL TLSRemoveTableW(wchar_t* szFileName); +__declspec(dllexport) bool TITCALL TLSBackupData(char* szFileName); +__declspec(dllexport) bool TITCALL TLSBackupDataW(wchar_t* szFileName); +__declspec(dllexport) bool TITCALL TLSRestoreData(); +__declspec(dllexport) bool TITCALL TLSBuildNewTable(ULONG_PTR FileMapVA, ULONG_PTR StorePlace, ULONG_PTR StorePlaceRVA, LPVOID ArrayOfCallBacks, DWORD NumberOfCallBacks); +__declspec(dllexport) bool TITCALL TLSBuildNewTableEx(char* szFileName, char* szSectionName, LPVOID ArrayOfCallBacks, DWORD NumberOfCallBacks); +__declspec(dllexport) bool TITCALL TLSBuildNewTableExW(wchar_t* szFileName, char* szSectionName, LPVOID ArrayOfCallBacks, DWORD NumberOfCallBacks); +// TitanEngine.TranslateName.functions: +__declspec(dllexport) void* TITCALL TranslateNativeName(char* szNativeName); +__declspec(dllexport) void* TITCALL TranslateNativeNameW(wchar_t* szNativeName); +// TitanEngine.Handler.functions: +__declspec(dllexport) long TITCALL HandlerGetActiveHandleCount(DWORD ProcessId); +__declspec(dllexport) bool TITCALL HandlerIsHandleOpen(DWORD ProcessId, HANDLE hHandle); +__declspec(dllexport) void* TITCALL HandlerGetHandleName(HANDLE hProcess, DWORD ProcessId, HANDLE hHandle, bool TranslateName); +__declspec(dllexport) void* TITCALL HandlerGetHandleNameW(HANDLE hProcess, DWORD ProcessId, HANDLE hHandle, bool TranslateName); +__declspec(dllexport) long TITCALL HandlerEnumerateOpenHandles(DWORD ProcessId, LPVOID HandleBuffer, DWORD MaxHandleCount); +__declspec(dllexport) long long TITCALL HandlerGetHandleDetails(HANDLE hProcess, DWORD ProcessId, HANDLE hHandle, DWORD InformationReturn); +__declspec(dllexport) bool TITCALL HandlerCloseRemoteHandle(HANDLE hProcess, HANDLE hHandle); +__declspec(dllexport) long TITCALL HandlerEnumerateLockHandles(char* szFileOrFolderName, bool NameIsFolder, bool NameIsTranslated, LPVOID HandleDataBuffer, DWORD MaxHandleCount); +__declspec(dllexport) long TITCALL HandlerEnumerateLockHandlesW(wchar_t* szFileOrFolderName, bool NameIsFolder, bool NameIsTranslated, LPVOID HandleDataBuffer, DWORD MaxHandleCount); +__declspec(dllexport) bool TITCALL HandlerCloseAllLockHandles(char* szFileOrFolderName, bool NameIsFolder, bool NameIsTranslated); +__declspec(dllexport) bool TITCALL HandlerCloseAllLockHandlesW(wchar_t* szFileOrFolderName, bool NameIsFolder, bool NameIsTranslated); +__declspec(dllexport) bool TITCALL HandlerIsFileLocked(char* szFileOrFolderName, bool NameIsFolder, bool NameIsTranslated); +__declspec(dllexport) bool TITCALL HandlerIsFileLockedW(wchar_t* szFileOrFolderName, bool NameIsFolder, bool NameIsTranslated); +// TitanEngine.Handler[Mutex].functions: +__declspec(dllexport) long TITCALL HandlerEnumerateOpenMutexes(HANDLE hProcess, DWORD ProcessId, LPVOID HandleBuffer, DWORD MaxHandleCount); +__declspec(dllexport) long long TITCALL HandlerGetOpenMutexHandle(HANDLE hProcess, DWORD ProcessId, char* szMutexString); +__declspec(dllexport) long long TITCALL HandlerGetOpenMutexHandleW(HANDLE hProcess, DWORD ProcessId, wchar_t* szMutexString); +__declspec(dllexport) long TITCALL HandlerGetProcessIdWhichCreatedMutex(char* szMutexString); +__declspec(dllexport) long TITCALL HandlerGetProcessIdWhichCreatedMutexW(wchar_t* szMutexString); +// TitanEngine.Injector.functions: +__declspec(dllexport) bool TITCALL RemoteLoadLibrary(HANDLE hProcess, char* szLibraryFile, bool WaitForThreadExit); +__declspec(dllexport) bool TITCALL RemoteLoadLibraryW(HANDLE hProcess, wchar_t* szLibraryFile, bool WaitForThreadExit); +__declspec(dllexport) bool TITCALL RemoteFreeLibrary(HANDLE hProcess, HMODULE hModule, char* szLibraryFile, bool WaitForThreadExit); +__declspec(dllexport) bool TITCALL RemoteFreeLibraryW(HANDLE hProcess, HMODULE hModule, wchar_t* szLibraryFile, bool WaitForThreadExit); +__declspec(dllexport) bool TITCALL RemoteExitProcess(HANDLE hProcess, DWORD ExitCode); +// TitanEngine.StaticUnpacker.functions: +__declspec(dllexport) bool TITCALL StaticFileLoad(char* szFileName, DWORD DesiredAccess, bool SimulateLoad, LPHANDLE FileHandle, LPDWORD LoadedSize, LPHANDLE FileMap, PULONG_PTR FileMapVA); +__declspec(dllexport) bool TITCALL StaticFileLoadW(wchar_t* szFileName, DWORD DesiredAccess, bool SimulateLoad, LPHANDLE FileHandle, LPDWORD LoadedSize, LPHANDLE FileMap, PULONG_PTR FileMapVA); +__declspec(dllexport) bool TITCALL StaticFileUnload(char* szFileName, bool CommitChanges, HANDLE FileHandle, DWORD LoadedSize, HANDLE FileMap, ULONG_PTR FileMapVA); +__declspec(dllexport) bool TITCALL StaticFileUnloadW(wchar_t* szFileName, bool CommitChanges, HANDLE FileHandle, DWORD LoadedSize, HANDLE FileMap, ULONG_PTR FileMapVA); +__declspec(dllexport) bool TITCALL StaticFileOpen(char* szFileName, DWORD DesiredAccess, LPHANDLE FileHandle, LPDWORD FileSizeLow, LPDWORD FileSizeHigh); +__declspec(dllexport) bool TITCALL StaticFileOpenW(wchar_t* szFileName, DWORD DesiredAccess, LPHANDLE FileHandle, LPDWORD FileSizeLow, LPDWORD FileSizeHigh); +__declspec(dllexport) bool TITCALL StaticFileGetContent(HANDLE FileHandle, DWORD FilePositionLow, LPDWORD FilePositionHigh, void* Buffer, DWORD Size); +__declspec(dllexport) void TITCALL StaticFileClose(HANDLE FileHandle); +__declspec(dllexport) void TITCALL StaticMemoryDecrypt(LPVOID MemoryStart, DWORD MemorySize, DWORD DecryptionType, DWORD DecryptionKeySize, ULONG_PTR DecryptionKey); +__declspec(dllexport) void TITCALL StaticMemoryDecryptEx(LPVOID MemoryStart, DWORD MemorySize, DWORD DecryptionKeySize, void* DecryptionCallBack); +__declspec(dllexport) void TITCALL StaticMemoryDecryptSpecial(LPVOID MemoryStart, DWORD MemorySize, DWORD DecryptionKeySize, DWORD SpecDecryptionType, void* DecryptionCallBack); +__declspec(dllexport) void TITCALL StaticSectionDecrypt(ULONG_PTR FileMapVA, DWORD SectionNumber, bool SimulateLoad, DWORD DecryptionType, DWORD DecryptionKeySize, ULONG_PTR DecryptionKey); +__declspec(dllexport) bool TITCALL StaticMemoryDecompress(void* Source, DWORD SourceSize, void* Destination, DWORD DestinationSize, int Algorithm); +__declspec(dllexport) bool TITCALL StaticRawMemoryCopy(HANDLE hFile, ULONG_PTR FileMapVA, ULONG_PTR VitualAddressToCopy, DWORD Size, bool AddressIsRVA, char* szDumpFileName); +__declspec(dllexport) bool TITCALL StaticRawMemoryCopyW(HANDLE hFile, ULONG_PTR FileMapVA, ULONG_PTR VitualAddressToCopy, DWORD Size, bool AddressIsRVA, wchar_t* szDumpFileName); +__declspec(dllexport) bool TITCALL StaticRawMemoryCopyEx(HANDLE hFile, DWORD RawAddressToCopy, DWORD Size, char* szDumpFileName); +__declspec(dllexport) bool TITCALL StaticRawMemoryCopyExW(HANDLE hFile, DWORD RawAddressToCopy, DWORD Size, wchar_t* szDumpFileName); +__declspec(dllexport) bool TITCALL StaticRawMemoryCopyEx64(HANDLE hFile, DWORD64 RawAddressToCopy, DWORD64 Size, char* szDumpFileName); +__declspec(dllexport) bool TITCALL StaticRawMemoryCopyEx64W(HANDLE hFile, DWORD64 RawAddressToCopy, DWORD64 Size, wchar_t* szDumpFileName); +__declspec(dllexport) bool TITCALL StaticHashMemory(void* MemoryToHash, DWORD SizeOfMemory, void* HashDigest, bool OutputString, int Algorithm); +__declspec(dllexport) bool TITCALL StaticHashFileW(wchar_t* szFileName, char* HashDigest, bool OutputString, int Algorithm); +__declspec(dllexport) bool TITCALL StaticHashFile(char* szFileName, char* HashDigest, bool OutputString, int Algorithm); +// TitanEngine.Engine.functions: +__declspec(dllexport) void TITCALL EngineUnpackerInitialize(char* szFileName, char* szUnpackedFileName, bool DoLogData, bool DoRealignFile, bool DoMoveOverlay, void* EntryCallBack); +__declspec(dllexport) void TITCALL EngineUnpackerInitializeW(wchar_t* szFileName, wchar_t* szUnpackedFileName, bool DoLogData, bool DoRealignFile, bool DoMoveOverlay, void* EntryCallBack); +__declspec(dllexport) bool TITCALL EngineUnpackerSetBreakCondition(void* SearchStart, DWORD SearchSize, void* SearchPattern, DWORD PatternSize, DWORD PatternDelta, ULONG_PTR BreakType, bool SingleBreak, DWORD Parameter1, DWORD Parameter2); +__declspec(dllexport) void TITCALL EngineUnpackerSetEntryPointAddress(ULONG_PTR UnpackedEntryPointAddress); +__declspec(dllexport) void TITCALL EngineUnpackerFinalizeUnpacking(); +// TitanEngine.Engine.functions: +__declspec(dllexport) void TITCALL SetEngineVariable(DWORD VariableId, bool VariableSet); +__declspec(dllexport) bool TITCALL EngineCreateMissingDependencies(char* szFileName, char* szOutputFolder, bool LogCreatedFiles); +__declspec(dllexport) bool TITCALL EngineCreateMissingDependenciesW(wchar_t* szFileName, wchar_t* szOutputFolder, bool LogCreatedFiles); +__declspec(dllexport) bool TITCALL EngineFakeMissingDependencies(HANDLE hProcess); +__declspec(dllexport) bool TITCALL EngineDeleteCreatedDependencies(); +__declspec(dllexport) bool TITCALL EngineCreateUnpackerWindow(char* WindowUnpackerTitle, char* WindowUnpackerLongTitle, char* WindowUnpackerName, char* WindowUnpackerAuthor, void* StartUnpackingCallBack); +__declspec(dllexport) void TITCALL EngineAddUnpackerWindowLogMessage(char* szLogMessage); +// Global.Engine.Extension.Functions: +__declspec(dllexport) bool TITCALL ExtensionManagerIsPluginLoaded(char* szPluginName); +__declspec(dllexport) bool TITCALL ExtensionManagerIsPluginEnabled(char* szPluginName); +__declspec(dllexport) bool TITCALL ExtensionManagerDisableAllPlugins(); +__declspec(dllexport) bool TITCALL ExtensionManagerDisablePlugin(char* szPluginName); +__declspec(dllexport) bool TITCALL ExtensionManagerEnableAllPlugins(); +__declspec(dllexport) bool TITCALL ExtensionManagerEnablePlugin(char* szPluginName); +__declspec(dllexport) bool TITCALL ExtensionManagerUnloadAllPlugins(); +__declspec(dllexport) bool TITCALL ExtensionManagerUnloadPlugin(char* szPluginName); +__declspec(dllexport) void* TITCALL ExtensionManagerGetPluginInfo(char* szPluginName); + +#ifdef __cplusplus +} +#endif + +#pragma pack(pop) + +#endif /*TITANENGINE*/ diff --git a/SDK/CPP/TitanEngine.h b/SDK/CPP/TitanEngine.h new file mode 100644 index 0000000..cb1b00f --- /dev/null +++ b/SDK/CPP/TitanEngine.h @@ -0,0 +1,938 @@ +#ifndef TITANENGINE +#define TITANENGINE + +#define TITCALL + +#if _MSC_VER > 1000 +#pragma once +#endif + +#include + +#pragma pack(push, 1) + +// Global.Constant.Structure.Declaration: +// Engine.External: +#define UE_ACCESS_READ 0 +#define UE_ACCESS_WRITE 1 +#define UE_ACCESS_ALL 2 + +#define UE_HIDE_BASIC 1 + +#define UE_PLUGIN_CALL_REASON_PREDEBUG 1 +#define UE_PLUGIN_CALL_REASON_EXCEPTION 2 +#define UE_PLUGIN_CALL_REASON_POSTDEBUG 3 + +#define TEE_HOOK_NRM_JUMP 1 +#define TEE_HOOK_NRM_CALL 3 +#define TEE_HOOK_IAT 5 + +#define UE_ENGINE_ALOW_MODULE_LOADING 1 +#define UE_ENGINE_AUTOFIX_FORWARDERS 2 +#define UE_ENGINE_PASS_ALL_EXCEPTIONS 3 +#define UE_ENGINE_NO_CONSOLE_WINDOW 4 +#define UE_ENGINE_BACKUP_FOR_CRITICAL_FUNCTIONS 5 +#define UE_ENGINE_CALL_PLUGIN_CALLBACK 6 +#define UE_ENGINE_RESET_CUSTOM_HANDLER 7 +#define UE_ENGINE_CALL_PLUGIN_DEBUG_CALLBACK 8 + +#define UE_OPTION_REMOVEALL 1 +#define UE_OPTION_DISABLEALL 2 +#define UE_OPTION_REMOVEALLDISABLED 3 +#define UE_OPTION_REMOVEALLENABLED 4 + +#define UE_STATIC_DECRYPTOR_XOR 1 +#define UE_STATIC_DECRYPTOR_SUB 2 +#define UE_STATIC_DECRYPTOR_ADD 3 + +#define UE_STATIC_DECRYPTOR_FOREWARD 1 +#define UE_STATIC_DECRYPTOR_BACKWARD 2 + +#define UE_STATIC_KEY_SIZE_1 1 +#define UE_STATIC_KEY_SIZE_2 2 +#define UE_STATIC_KEY_SIZE_4 4 +#define UE_STATIC_KEY_SIZE_8 8 + +#define UE_STATIC_APLIB 1 +#define UE_STATIC_APLIB_DEPACK 2 +#define UE_STATIC_LZMA 3 + +#define UE_STATIC_HASH_MD5 1 +#define UE_STATIC_HASH_SHA1 2 +#define UE_STATIC_HASH_CRC32 3 + +#define UE_RESOURCE_LANGUAGE_ANY -1 + +#define UE_PE_OFFSET 0 +#define UE_IMAGEBASE 1 +#define UE_OEP 2 +#define UE_SIZEOFIMAGE 3 +#define UE_SIZEOFHEADERS 4 +#define UE_SIZEOFOPTIONALHEADER 5 +#define UE_SECTIONALIGNMENT 6 +#define UE_IMPORTTABLEADDRESS 7 +#define UE_IMPORTTABLESIZE 8 +#define UE_RESOURCETABLEADDRESS 9 +#define UE_RESOURCETABLESIZE 10 +#define UE_EXPORTTABLEADDRESS 11 +#define UE_EXPORTTABLESIZE 12 +#define UE_TLSTABLEADDRESS 13 +#define UE_TLSTABLESIZE 14 +#define UE_RELOCATIONTABLEADDRESS 15 +#define UE_RELOCATIONTABLESIZE 16 +#define UE_TIMEDATESTAMP 17 +#define UE_SECTIONNUMBER 18 +#define UE_CHECKSUM 19 +#define UE_SUBSYSTEM 20 +#define UE_CHARACTERISTICS 21 +#define UE_NUMBEROFRVAANDSIZES 22 +#define UE_SECTIONNAME 23 +#define UE_SECTIONVIRTUALOFFSET 24 +#define UE_SECTIONVIRTUALSIZE 25 +#define UE_SECTIONRAWOFFSET 26 +#define UE_SECTIONRAWSIZE 27 +#define UE_SECTIONFLAGS 28 + +#define UE_CH_BREAKPOINT 1 +#define UE_CH_SINGLESTEP 2 +#define UE_CH_ACCESSVIOLATION 3 +#define UE_CH_ILLEGALINSTRUCTION 4 +#define UE_CH_NONCONTINUABLEEXCEPTION 5 +#define UE_CH_ARRAYBOUNDSEXCEPTION 6 +#define UE_CH_FLOATDENORMALOPERAND 7 +#define UE_CH_FLOATDEVIDEBYZERO 8 +#define UE_CH_INTEGERDEVIDEBYZERO 9 +#define UE_CH_INTEGEROVERFLOW 10 +#define UE_CH_PRIVILEGEDINSTRUCTION 11 +#define UE_CH_PAGEGUARD 12 +#define UE_CH_EVERYTHINGELSE 13 +#define UE_CH_CREATETHREAD 14 +#define UE_CH_EXITTHREAD 15 +#define UE_CH_CREATEPROCESS 16 +#define UE_CH_EXITPROCESS 17 +#define UE_CH_LOADDLL 18 +#define UE_CH_UNLOADDLL 19 +#define UE_CH_OUTPUTDEBUGSTRING 20 +#define UE_CH_AFTEREXCEPTIONPROCESSING 21 +#define UE_CH_ALLEVENTS 22 +#define UE_CH_SYSTEMBREAKPOINT 23 +#define UE_CH_UNHANDLEDEXCEPTION 24 +#define UE_CH_AFTERUNHANDLEDEXCEPTION 25 + +#define UE_OPTION_HANDLER_RETURN_HANDLECOUNT 1 +#define UE_OPTION_HANDLER_RETURN_ACCESS 2 +#define UE_OPTION_HANDLER_RETURN_FLAGS 3 +#define UE_OPTION_HANDLER_RETURN_TYPENAME 4 + +#define UE_BREAKPOINT_INT3 1 +#define UE_BREAKPOINT_LONG_INT3 2 +#define UE_BREAKPOINT_UD2 3 + +#define UE_BPXREMOVED 0 +#define UE_BPXACTIVE 1 +#define UE_BPXINACTIVE 2 + +#define UE_BREAKPOINT 0 +#define UE_SINGLESHOOT 1 +#define UE_HARDWARE 2 +#define UE_MEMORY 3 +#define UE_MEMORY_READ 4 +#define UE_MEMORY_WRITE 5 +#define UE_MEMORY_EXECUTE 6 +#define UE_BREAKPOINT_TYPE_INT3 0x10000000 +#define UE_BREAKPOINT_TYPE_LONG_INT3 0x20000000 +#define UE_BREAKPOINT_TYPE_UD2 0x30000000 + +#define UE_HARDWARE_EXECUTE 4 +#define UE_HARDWARE_WRITE 5 +#define UE_HARDWARE_READWRITE 6 + +#define UE_HARDWARE_SIZE_1 7 +#define UE_HARDWARE_SIZE_2 8 +#define UE_HARDWARE_SIZE_4 9 +#define UE_HARDWARE_SIZE_8 10 + +#define UE_ON_LIB_LOAD 1 +#define UE_ON_LIB_UNLOAD 2 +#define UE_ON_LIB_ALL 3 + +#define UE_APISTART 0 +#define UE_APIEND 1 + +#define UE_PLATFORM_x86 1 +#define UE_PLATFORM_x64 2 +#define UE_PLATFORM_ALL 3 + +#define UE_FUNCTION_STDCALL 1 +#define UE_FUNCTION_CCALL 2 +#define UE_FUNCTION_FASTCALL 3 +#define UE_FUNCTION_STDCALL_RET 4 +#define UE_FUNCTION_CCALL_RET 5 +#define UE_FUNCTION_FASTCALL_RET 6 +#define UE_FUNCTION_STDCALL_CALL 7 +#define UE_FUNCTION_CCALL_CALL 8 +#define UE_FUNCTION_FASTCALL_CALL 9 +#define UE_PARAMETER_BYTE 0 +#define UE_PARAMETER_WORD 1 +#define UE_PARAMETER_DWORD 2 +#define UE_PARAMETER_QWORD 3 +#define UE_PARAMETER_PTR_BYTE 4 +#define UE_PARAMETER_PTR_WORD 5 +#define UE_PARAMETER_PTR_DWORD 6 +#define UE_PARAMETER_PTR_QWORD 7 +#define UE_PARAMETER_STRING 8 +#define UE_PARAMETER_UNICODE 9 + +#define UE_CMP_NOCONDITION 0 +#define UE_CMP_EQUAL 1 +#define UE_CMP_NOTEQUAL 2 +#define UE_CMP_GREATER 3 +#define UE_CMP_GREATEROREQUAL 4 +#define UE_CMP_LOWER 5 +#define UE_CMP_LOWEROREQUAL 6 +#define UE_CMP_REG_EQUAL 7 +#define UE_CMP_REG_NOTEQUAL 8 +#define UE_CMP_REG_GREATER 9 +#define UE_CMP_REG_GREATEROREQUAL 10 +#define UE_CMP_REG_LOWER 11 +#define UE_CMP_REG_LOWEROREQUAL 12 +#define UE_CMP_ALWAYSFALSE 13 + +#define UE_EAX 1 +#define UE_EBX 2 +#define UE_ECX 3 +#define UE_EDX 4 +#define UE_EDI 5 +#define UE_ESI 6 +#define UE_EBP 7 +#define UE_ESP 8 +#define UE_EIP 9 +#define UE_EFLAGS 10 +#define UE_DR0 11 +#define UE_DR1 12 +#define UE_DR2 13 +#define UE_DR3 14 +#define UE_DR6 15 +#define UE_DR7 16 +#define UE_RAX 17 +#define UE_RBX 18 +#define UE_RCX 19 +#define UE_RDX 20 +#define UE_RDI 21 +#define UE_RSI 22 +#define UE_RBP 23 +#define UE_RSP 24 +#define UE_RIP 25 +#define UE_RFLAGS 26 +#define UE_R8 27 +#define UE_R9 28 +#define UE_R10 29 +#define UE_R11 30 +#define UE_R12 31 +#define UE_R13 32 +#define UE_R14 33 +#define UE_R15 34 +#define UE_CIP 35 +#define UE_CSP 36 +#ifdef _WIN64 +#define UE_CFLAGS UE_RFLAGS +#else +#define UE_CFLAGS UE_EFLAGS +#endif +#define UE_SEG_GS 37 +#define UE_SEG_FS 38 +#define UE_SEG_ES 39 +#define UE_SEG_DS 40 +#define UE_SEG_CS 41 +#define UE_SEG_SS 42 + +typedef struct +{ + DWORD PE32Offset; + DWORD ImageBase; + DWORD OriginalEntryPoint; + DWORD NtSizeOfImage; + DWORD NtSizeOfHeaders; + WORD SizeOfOptionalHeaders; + DWORD FileAlignment; + DWORD SectionAligment; + DWORD ImportTableAddress; + DWORD ImportTableSize; + DWORD ResourceTableAddress; + DWORD ResourceTableSize; + DWORD ExportTableAddress; + DWORD ExportTableSize; + DWORD TLSTableAddress; + DWORD TLSTableSize; + DWORD RelocationTableAddress; + DWORD RelocationTableSize; + DWORD TimeDateStamp; + WORD SectionNumber; + DWORD CheckSum; + WORD SubSystem; + WORD Characteristics; + DWORD NumberOfRvaAndSizes; +} PE32Struct, *PPE32Struct; + +typedef struct +{ + DWORD PE64Offset; + DWORD64 ImageBase; + DWORD OriginalEntryPoint; + DWORD NtSizeOfImage; + DWORD NtSizeOfHeaders; + WORD SizeOfOptionalHeaders; + DWORD FileAlignment; + DWORD SectionAligment; + DWORD ImportTableAddress; + DWORD ImportTableSize; + DWORD ResourceTableAddress; + DWORD ResourceTableSize; + DWORD ExportTableAddress; + DWORD ExportTableSize; + DWORD TLSTableAddress; + DWORD TLSTableSize; + DWORD RelocationTableAddress; + DWORD RelocationTableSize; + DWORD TimeDateStamp; + WORD SectionNumber; + DWORD CheckSum; + WORD SubSystem; + WORD Characteristics; + DWORD NumberOfRvaAndSizes; +} PE64Struct, *PPE64Struct; + +typedef struct +{ + bool NewDll; + int NumberOfImports; + ULONG_PTR ImageBase; + ULONG_PTR BaseImportThunk; + ULONG_PTR ImportThunk; + char* APIName; + char* DLLName; +} ImportEnumData, *PImportEnumData; + +typedef struct +{ + HANDLE hThread; + DWORD dwThreadId; + void* ThreadStartAddress; + void* ThreadLocalBase; +} THREAD_ITEM_DATA, *PTHREAD_ITEM_DATA; + +typedef struct +{ + HANDLE hFile; + void* BaseOfDll; + HANDLE hFileMapping; + void* hFileMappingView; + char szLibraryPath[MAX_PATH]; + char szLibraryName[MAX_PATH]; +} LIBRARY_ITEM_DATA, *PLIBRARY_ITEM_DATA; + +typedef struct +{ + HANDLE hFile; + void* BaseOfDll; + HANDLE hFileMapping; + void* hFileMappingView; + wchar_t szLibraryPath[MAX_PATH]; + wchar_t szLibraryName[MAX_PATH]; +} LIBRARY_ITEM_DATAW, *PLIBRARY_ITEM_DATAW; + +typedef struct +{ + HANDLE hProcess; + DWORD dwProcessId; + HANDLE hThread; + DWORD dwThreadId; + HANDLE hFile; + void* BaseOfImage; + void* ThreadStartAddress; + void* ThreadLocalBase; +} PROCESS_ITEM_DATA, *PPROCESS_ITEM_DATA; + +typedef struct +{ + ULONG ProcessId; + HANDLE hHandle; +} HandlerArray, *PHandlerArray; + +typedef struct +{ + char PluginName[64]; + DWORD PluginMajorVersion; + DWORD PluginMinorVersion; + HMODULE PluginBaseAddress; + void* TitanDebuggingCallBack; + void* TitanRegisterPlugin; + void* TitanReleasePlugin; + void* TitanResetPlugin; + bool PluginDisabled; +} PluginInformation, *PPluginInformation; + +#define TEE_MAXIMUM_HOOK_SIZE 14 +#define TEE_MAXIMUM_HOOK_RELOCS 7 +#if defined(_WIN64) +#define TEE_MAXIMUM_HOOK_INSERT_SIZE 14 +#else +#define TEE_MAXIMUM_HOOK_INSERT_SIZE 5 +#endif + +typedef struct HOOK_ENTRY +{ + bool IATHook; + BYTE HookType; + DWORD HookSize; + void* HookAddress; + void* RedirectionAddress; + BYTE HookBytes[TEE_MAXIMUM_HOOK_SIZE]; + BYTE OriginalBytes[TEE_MAXIMUM_HOOK_SIZE]; + void* IATHookModuleBase; + DWORD IATHookNameHash; + bool HookIsEnabled; + bool HookIsRemote; + void* PatchedEntry; + DWORD RelocationInfo[TEE_MAXIMUM_HOOK_RELOCS]; + int RelocationCount; +} HOOK_ENTRY, *PHOOK_ENTRY; + +#define UE_DEPTH_SURFACE 0 +#define UE_DEPTH_DEEP 1 + +#define UE_UNPACKER_CONDITION_SEARCH_FROM_EP 1 + +#define UE_UNPACKER_CONDITION_LOADLIBRARY 1 +#define UE_UNPACKER_CONDITION_GETPROCADDRESS 2 +#define UE_UNPACKER_CONDITION_ENTRYPOINTBREAK 3 +#define UE_UNPACKER_CONDITION_RELOCSNAPSHOT1 4 +#define UE_UNPACKER_CONDITION_RELOCSNAPSHOT2 5 + +#define UE_FIELD_OK 0 +#define UE_FIELD_BROKEN_NON_FIXABLE 1 +#define UE_FIELD_BROKEN_NON_CRITICAL 2 +#define UE_FIELD_BROKEN_FIXABLE_FOR_STATIC_USE 3 +#define UE_FIELD_BROKEN_BUT_CAN_BE_EMULATED 4 +#define UE_FILED_FIXABLE_NON_CRITICAL 5 +#define UE_FILED_FIXABLE_CRITICAL 6 +#define UE_FIELD_NOT_PRESET 7 +#define UE_FIELD_NOT_PRESET_WARNING 8 + +#define UE_RESULT_FILE_OK 10 +#define UE_RESULT_FILE_INVALID_BUT_FIXABLE 11 +#define UE_RESULT_FILE_INVALID_AND_NON_FIXABLE 12 +#define UE_RESULT_FILE_INVALID_FORMAT 13 + +typedef struct +{ + BYTE OveralEvaluation; + bool EvaluationTerminatedByException; + bool FileIs64Bit; + bool FileIsDLL; + bool FileIsConsole; + bool MissingDependencies; + bool MissingDeclaredAPIs; + BYTE SignatureMZ; + BYTE SignaturePE; + BYTE EntryPoint; + BYTE ImageBase; + BYTE SizeOfImage; + BYTE FileAlignment; + BYTE SectionAlignment; + BYTE ExportTable; + BYTE RelocationTable; + BYTE ImportTable; + BYTE ImportTableSection; + BYTE ImportTableData; + BYTE IATTable; + BYTE TLSTable; + BYTE LoadConfigTable; + BYTE BoundImportTable; + BYTE COMHeaderTable; + BYTE ResourceTable; + BYTE ResourceData; + BYTE SectionTable; +} FILE_STATUS_INFO, *PFILE_STATUS_INFO; + +typedef struct +{ + BYTE OveralEvaluation; + bool FixingTerminatedByException; + bool FileFixPerformed; + bool StrippedRelocation; + bool DontFixRelocations; + DWORD OriginalRelocationTableAddress; + DWORD OriginalRelocationTableSize; + bool StrippedExports; + bool DontFixExports; + DWORD OriginalExportTableAddress; + DWORD OriginalExportTableSize; + bool StrippedResources; + bool DontFixResources; + DWORD OriginalResourceTableAddress; + DWORD OriginalResourceTableSize; + bool StrippedTLS; + bool DontFixTLS; + DWORD OriginalTLSTableAddress; + DWORD OriginalTLSTableSize; + bool StrippedLoadConfig; + bool DontFixLoadConfig; + DWORD OriginalLoadConfigTableAddress; + DWORD OriginalLoadConfigTableSize; + bool StrippedBoundImports; + bool DontFixBoundImports; + DWORD OriginalBoundImportTableAddress; + DWORD OriginalBoundImportTableSize; + bool StrippedIAT; + bool DontFixIAT; + DWORD OriginalImportAddressTableAddress; + DWORD OriginalImportAddressTableSize; + bool StrippedCOM; + bool DontFixCOM; + DWORD OriginalCOMTableAddress; + DWORD OriginalCOMTableSize; +} FILE_FIX_INFO, *PFILE_FIX_INFO; + +#ifdef __cplusplus +extern "C" +{ +#endif + +// Global.Function.Declaration: +// TitanEngine.Dumper.functions: +__declspec(dllexport) bool TITCALL DumpProcess(HANDLE hProcess, LPVOID ImageBase, char* szDumpFileName, ULONG_PTR EntryPoint); +__declspec(dllexport) bool TITCALL DumpProcessW(HANDLE hProcess, LPVOID ImageBase, wchar_t* szDumpFileName, ULONG_PTR EntryPoint); +__declspec(dllexport) bool TITCALL DumpProcessEx(DWORD ProcessId, LPVOID ImageBase, char* szDumpFileName, ULONG_PTR EntryPoint); +__declspec(dllexport) bool TITCALL DumpProcessExW(DWORD ProcessId, LPVOID ImageBase, wchar_t* szDumpFileName, ULONG_PTR EntryPoint); +__declspec(dllexport) bool TITCALL DumpMemory(HANDLE hProcess, LPVOID MemoryStart, ULONG_PTR MemorySize, char* szDumpFileName); +__declspec(dllexport) bool TITCALL DumpMemoryW(HANDLE hProcess, LPVOID MemoryStart, ULONG_PTR MemorySize, wchar_t* szDumpFileName); +__declspec(dllexport) bool TITCALL DumpMemoryEx(DWORD ProcessId, LPVOID MemoryStart, ULONG_PTR MemorySize, char* szDumpFileName); +__declspec(dllexport) bool TITCALL DumpMemoryExW(DWORD ProcessId, LPVOID MemoryStart, ULONG_PTR MemorySize, wchar_t* szDumpFileName); +__declspec(dllexport) bool TITCALL DumpRegions(HANDLE hProcess, char* szDumpFolder, bool DumpAboveImageBaseOnly); +__declspec(dllexport) bool TITCALL DumpRegionsW(HANDLE hProcess, wchar_t* szDumpFolder, bool DumpAboveImageBaseOnly); +__declspec(dllexport) bool TITCALL DumpRegionsEx(DWORD ProcessId, char* szDumpFolder, bool DumpAboveImageBaseOnly); +__declspec(dllexport) bool TITCALL DumpRegionsExW(DWORD ProcessId, wchar_t* szDumpFolder, bool DumpAboveImageBaseOnly); +__declspec(dllexport) bool TITCALL DumpModule(HANDLE hProcess, LPVOID ModuleBase, char* szDumpFileName); +__declspec(dllexport) bool TITCALL DumpModuleW(HANDLE hProcess, LPVOID ModuleBase, wchar_t* szDumpFileName); +__declspec(dllexport) bool TITCALL DumpModuleEx(DWORD ProcessId, LPVOID ModuleBase, char* szDumpFileName); +__declspec(dllexport) bool TITCALL DumpModuleExW(DWORD ProcessId, LPVOID ModuleBase, wchar_t* szDumpFileName); +__declspec(dllexport) bool TITCALL PastePEHeader(HANDLE hProcess, LPVOID ImageBase, char* szDebuggedFileName); +__declspec(dllexport) bool TITCALL PastePEHeaderW(HANDLE hProcess, LPVOID ImageBase, wchar_t* szDebuggedFileName); +__declspec(dllexport) bool TITCALL ExtractSection(char* szFileName, char* szDumpFileName, DWORD SectionNumber); +__declspec(dllexport) bool TITCALL ExtractSectionW(wchar_t* szFileName, wchar_t* szDumpFileName, DWORD SectionNumber); +__declspec(dllexport) bool TITCALL ResortFileSections(char* szFileName); +__declspec(dllexport) bool TITCALL ResortFileSectionsW(wchar_t* szFileName); +__declspec(dllexport) bool TITCALL FindOverlay(char* szFileName, LPDWORD OverlayStart, LPDWORD OverlaySize); +__declspec(dllexport) bool TITCALL FindOverlayW(wchar_t* szFileName, LPDWORD OverlayStart, LPDWORD OverlaySize); +__declspec(dllexport) bool TITCALL ExtractOverlay(char* szFileName, char* szExtactedFileName); +__declspec(dllexport) bool TITCALL ExtractOverlayW(wchar_t* szFileName, wchar_t* szExtactedFileName); +__declspec(dllexport) bool TITCALL AddOverlay(char* szFileName, char* szOverlayFileName); +__declspec(dllexport) bool TITCALL AddOverlayW(wchar_t* szFileName, wchar_t* szOverlayFileName); +__declspec(dllexport) bool TITCALL CopyOverlay(char* szInFileName, char* szOutFileName); +__declspec(dllexport) bool TITCALL CopyOverlayW(wchar_t* szInFileName, wchar_t* szOutFileName); +__declspec(dllexport) bool TITCALL RemoveOverlay(char* szFileName); +__declspec(dllexport) bool TITCALL RemoveOverlayW(wchar_t* szFileName); +__declspec(dllexport) bool TITCALL MakeAllSectionsRWE(char* szFileName); +__declspec(dllexport) bool TITCALL MakeAllSectionsRWEW(wchar_t* szFileName); +__declspec(dllexport) long TITCALL AddNewSectionEx(char* szFileName, char* szSectionName, DWORD SectionSize, DWORD SectionAttributes, LPVOID SectionContent, DWORD ContentSize); +__declspec(dllexport) long TITCALL AddNewSectionExW(wchar_t* szFileName, char* szSectionName, DWORD SectionSize, DWORD SectionAttributes, LPVOID SectionContent, DWORD ContentSize); +__declspec(dllexport) long TITCALL AddNewSection(char* szFileName, char* szSectionName, DWORD SectionSize); +__declspec(dllexport) long TITCALL AddNewSectionW(wchar_t* szFileName, char* szSectionName, DWORD SectionSize); +__declspec(dllexport) bool TITCALL ResizeLastSection(char* szFileName, DWORD NumberOfExpandBytes, bool AlignResizeData); +__declspec(dllexport) bool TITCALL ResizeLastSectionW(wchar_t* szFileName, DWORD NumberOfExpandBytes, bool AlignResizeData); +__declspec(dllexport) void TITCALL SetSharedOverlay(char* szFileName); +__declspec(dllexport) void TITCALL SetSharedOverlayW(wchar_t* szFileName); +__declspec(dllexport) char* TITCALL GetSharedOverlay(); +__declspec(dllexport) wchar_t* TITCALL GetSharedOverlayW(); +__declspec(dllexport) bool TITCALL DeleteLastSection(char* szFileName); +__declspec(dllexport) bool TITCALL DeleteLastSectionW(wchar_t* szFileName); +__declspec(dllexport) bool TITCALL DeleteLastSectionEx(char* szFileName, DWORD NumberOfSections); +__declspec(dllexport) bool TITCALL DeleteLastSectionExW(wchar_t* szFileName, DWORD NumberOfSections); +__declspec(dllexport) long long TITCALL GetPE32DataFromMappedFile(ULONG_PTR FileMapVA, DWORD WhichSection, DWORD WhichData); +__declspec(dllexport) long long TITCALL GetPE32Data(char* szFileName, DWORD WhichSection, DWORD WhichData); +__declspec(dllexport) long long TITCALL GetPE32DataW(wchar_t* szFileName, DWORD WhichSection, DWORD WhichData); +__declspec(dllexport) bool TITCALL GetPE32DataFromMappedFileEx(ULONG_PTR FileMapVA, LPVOID DataStorage); +__declspec(dllexport) bool TITCALL GetPE32DataEx(char* szFileName, LPVOID DataStorage); +__declspec(dllexport) bool TITCALL GetPE32DataExW(wchar_t* szFileName, LPVOID DataStorage); +__declspec(dllexport) bool TITCALL SetPE32DataForMappedFile(ULONG_PTR FileMapVA, DWORD WhichSection, DWORD WhichData, ULONG_PTR NewDataValue); +__declspec(dllexport) bool TITCALL SetPE32Data(char* szFileName, DWORD WhichSection, DWORD WhichData, ULONG_PTR NewDataValue); +__declspec(dllexport) bool TITCALL SetPE32DataW(wchar_t* szFileName, DWORD WhichSection, DWORD WhichData, ULONG_PTR NewDataValue); +__declspec(dllexport) bool TITCALL SetPE32DataForMappedFileEx(ULONG_PTR FileMapVA, LPVOID DataStorage); +__declspec(dllexport) bool TITCALL SetPE32DataEx(char* szFileName, LPVOID DataStorage); +__declspec(dllexport) bool TITCALL SetPE32DataExW(wchar_t* szFileName, LPVOID DataStorage); +__declspec(dllexport) long TITCALL GetPE32SectionNumberFromVA(ULONG_PTR FileMapVA, ULONG_PTR AddressToConvert); +__declspec(dllexport) long long TITCALL ConvertVAtoFileOffset(ULONG_PTR FileMapVA, ULONG_PTR AddressToConvert, bool ReturnType); +__declspec(dllexport) long long TITCALL ConvertVAtoFileOffsetEx(ULONG_PTR FileMapVA, DWORD FileSize, ULONG_PTR ImageBase, ULONG_PTR AddressToConvert, bool AddressIsRVA, bool ReturnType); +__declspec(dllexport) long long TITCALL ConvertFileOffsetToVA(ULONG_PTR FileMapVA, ULONG_PTR AddressToConvert, bool ReturnType); +__declspec(dllexport) long long TITCALL ConvertFileOffsetToVAEx(ULONG_PTR FileMapVA, DWORD FileSize, ULONG_PTR ImageBase, ULONG_PTR AddressToConvert, bool ReturnType); +// TitanEngine.Realigner.functions: +__declspec(dllexport) bool TITCALL FixHeaderCheckSum(char* szFileName); +__declspec(dllexport) bool TITCALL FixHeaderCheckSumW(wchar_t* szFileName); +__declspec(dllexport) long TITCALL RealignPE(ULONG_PTR FileMapVA, DWORD FileSize, DWORD RealingMode); +__declspec(dllexport) long TITCALL RealignPEEx(char* szFileName, DWORD RealingFileSize, DWORD ForcedFileAlignment); +__declspec(dllexport) long TITCALL RealignPEExW(wchar_t* szFileName, DWORD RealingFileSize, DWORD ForcedFileAlignment); +__declspec(dllexport) bool TITCALL WipeSection(char* szFileName, int WipeSectionNumber, bool RemovePhysically); +__declspec(dllexport) bool TITCALL WipeSectionW(wchar_t* szFileName, int WipeSectionNumber, bool RemovePhysically); +__declspec(dllexport) bool TITCALL IsPE32FileValidEx(char* szFileName, DWORD CheckDepth, LPVOID FileStatusInfo); +__declspec(dllexport) bool TITCALL IsPE32FileValidExW(wchar_t* szFileName, DWORD CheckDepth, LPVOID FileStatusInfo); +__declspec(dllexport) bool TITCALL FixBrokenPE32FileEx(char* szFileName, LPVOID FileStatusInfo, LPVOID FileFixInfo); +__declspec(dllexport) bool TITCALL FixBrokenPE32FileExW(wchar_t* szFileName, LPVOID FileStatusInfo, LPVOID FileFixInfo); +__declspec(dllexport) bool TITCALL IsFileDLL(char* szFileName, ULONG_PTR FileMapVA); +__declspec(dllexport) bool TITCALL IsFileDLLW(wchar_t* szFileName, ULONG_PTR FileMapVA); +// TitanEngine.Hider.functions: +__declspec(dllexport) void* TITCALL GetPEBLocation(HANDLE hProcess); +__declspec(dllexport) bool TITCALL HideDebugger(HANDLE hProcess, DWORD PatchAPILevel); +__declspec(dllexport) bool TITCALL UnHideDebugger(HANDLE hProcess, DWORD PatchAPILevel); +// TitanEngine.Relocater.functions: +__declspec(dllexport) void TITCALL RelocaterCleanup(); +__declspec(dllexport) void TITCALL RelocaterInit(DWORD MemorySize, ULONG_PTR OldImageBase, ULONG_PTR NewImageBase); +__declspec(dllexport) void TITCALL RelocaterAddNewRelocation(HANDLE hProcess, ULONG_PTR RelocateAddress, DWORD RelocateState); +__declspec(dllexport) long TITCALL RelocaterEstimatedSize(); +__declspec(dllexport) bool TITCALL RelocaterExportRelocation(ULONG_PTR StorePlace, DWORD StorePlaceRVA, ULONG_PTR FileMapVA); +__declspec(dllexport) bool TITCALL RelocaterExportRelocationEx(char* szFileName, char* szSectionName); +__declspec(dllexport) bool TITCALL RelocaterExportRelocationExW(wchar_t* szFileName, char* szSectionName); +__declspec(dllexport) bool TITCALL RelocaterGrabRelocationTable(HANDLE hProcess, ULONG_PTR MemoryStart, DWORD MemorySize); +__declspec(dllexport) bool TITCALL RelocaterGrabRelocationTableEx(HANDLE hProcess, ULONG_PTR MemoryStart, ULONG_PTR MemorySize, DWORD NtSizeOfImage); +__declspec(dllexport) bool TITCALL RelocaterMakeSnapshot(HANDLE hProcess, char* szSaveFileName, LPVOID MemoryStart, ULONG_PTR MemorySize); +__declspec(dllexport) bool TITCALL RelocaterMakeSnapshotW(HANDLE hProcess, wchar_t* szSaveFileName, LPVOID MemoryStart, ULONG_PTR MemorySize); +__declspec(dllexport) bool TITCALL RelocaterCompareTwoSnapshots(HANDLE hProcess, ULONG_PTR LoadedImageBase, ULONG_PTR NtSizeOfImage, char* szDumpFile1, char* szDumpFile2, ULONG_PTR MemStart); +__declspec(dllexport) bool TITCALL RelocaterCompareTwoSnapshotsW(HANDLE hProcess, ULONG_PTR LoadedImageBase, ULONG_PTR NtSizeOfImage, wchar_t* szDumpFile1, wchar_t* szDumpFile2, ULONG_PTR MemStart); +__declspec(dllexport) bool TITCALL RelocaterChangeFileBase(char* szFileName, ULONG_PTR NewImageBase); +__declspec(dllexport) bool TITCALL RelocaterChangeFileBaseW(wchar_t* szFileName, ULONG_PTR NewImageBase); +__declspec(dllexport) bool TITCALL RelocaterRelocateMemoryBlock(ULONG_PTR FileMapVA, ULONG_PTR MemoryLocation, void* RelocateMemory, DWORD RelocateMemorySize, ULONG_PTR CurrentLoadedBase, ULONG_PTR RelocateBase); +__declspec(dllexport) bool TITCALL RelocaterWipeRelocationTable(char* szFileName); +__declspec(dllexport) bool TITCALL RelocaterWipeRelocationTableW(wchar_t* szFileName); +// TitanEngine.Resourcer.functions: +__declspec(dllexport) long long TITCALL ResourcerLoadFileForResourceUse(char* szFileName); +__declspec(dllexport) long long TITCALL ResourcerLoadFileForResourceUseW(wchar_t* szFileName); +__declspec(dllexport) bool TITCALL ResourcerFreeLoadedFile(LPVOID LoadedFileBase); +__declspec(dllexport) bool TITCALL ResourcerExtractResourceFromFileEx(ULONG_PTR FileMapVA, char* szResourceType, char* szResourceName, char* szExtractedFileName); +__declspec(dllexport) bool TITCALL ResourcerExtractResourceFromFile(char* szFileName, char* szResourceType, char* szResourceName, char* szExtractedFileName); +__declspec(dllexport) bool TITCALL ResourcerExtractResourceFromFileW(wchar_t* szFileName, char* szResourceType, char* szResourceName, char* szExtractedFileName); +__declspec(dllexport) bool TITCALL ResourcerFindResource(char* szFileName, char* szResourceType, DWORD ResourceType, char* szResourceName, DWORD ResourceName, DWORD ResourceLanguage, PULONG_PTR pResourceData, LPDWORD pResourceSize); +__declspec(dllexport) bool TITCALL ResourcerFindResourceW(wchar_t* szFileName, wchar_t* szResourceType, DWORD ResourceType, wchar_t* szResourceName, DWORD ResourceName, DWORD ResourceLanguage, PULONG_PTR pResourceData, LPDWORD pResourceSize); +__declspec(dllexport) bool TITCALL ResourcerFindResourceEx(ULONG_PTR FileMapVA, DWORD FileSize, wchar_t* szResourceType, DWORD ResourceType, wchar_t* szResourceName, DWORD ResourceName, DWORD ResourceLanguage, PULONG_PTR pResourceData, LPDWORD pResourceSize); +__declspec(dllexport) void TITCALL ResourcerEnumerateResource(char* szFileName, void* CallBack); +__declspec(dllexport) void TITCALL ResourcerEnumerateResourceW(wchar_t* szFileName, void* CallBack); +__declspec(dllexport) void TITCALL ResourcerEnumerateResourceEx(ULONG_PTR FileMapVA, DWORD FileSize, void* CallBack); +// TitanEngine.Threader.functions: +__declspec(dllexport) bool TITCALL ThreaderImportRunningThreadData(DWORD ProcessId); +__declspec(dllexport) void* TITCALL ThreaderGetThreadInfo(HANDLE hThread, DWORD ThreadId); +__declspec(dllexport) void TITCALL ThreaderEnumThreadInfo(void* EnumCallBack); +__declspec(dllexport) bool TITCALL ThreaderPauseThread(HANDLE hThread); +__declspec(dllexport) bool TITCALL ThreaderResumeThread(HANDLE hThread); +__declspec(dllexport) bool TITCALL ThreaderTerminateThread(HANDLE hThread, DWORD ThreadExitCode); +__declspec(dllexport) bool TITCALL ThreaderPauseAllThreads(bool LeaveMainRunning); +__declspec(dllexport) bool TITCALL ThreaderResumeAllThreads(bool LeaveMainPaused); +__declspec(dllexport) bool TITCALL ThreaderPauseProcess(); +__declspec(dllexport) bool TITCALL ThreaderResumeProcess(); +__declspec(dllexport) long long TITCALL ThreaderCreateRemoteThread(ULONG_PTR ThreadStartAddress, bool AutoCloseTheHandle, LPVOID ThreadPassParameter, LPDWORD ThreadId); +__declspec(dllexport) bool TITCALL ThreaderInjectAndExecuteCode(LPVOID InjectCode, DWORD StartDelta, DWORD InjectSize); +__declspec(dllexport) long long TITCALL ThreaderCreateRemoteThreadEx(HANDLE hProcess, ULONG_PTR ThreadStartAddress, bool AutoCloseTheHandle, LPVOID ThreadPassParameter, LPDWORD ThreadId); +__declspec(dllexport) bool TITCALL ThreaderInjectAndExecuteCodeEx(HANDLE hProcess, LPVOID InjectCode, DWORD StartDelta, DWORD InjectSize); +__declspec(dllexport) void TITCALL ThreaderSetCallBackForNextExitThreadEvent(LPVOID exitThreadCallBack); +__declspec(dllexport) bool TITCALL ThreaderIsThreadStillRunning(HANDLE hThread); +__declspec(dllexport) bool TITCALL ThreaderIsThreadActive(HANDLE hThread); +__declspec(dllexport) bool TITCALL ThreaderIsAnyThreadActive(); +__declspec(dllexport) bool TITCALL ThreaderExecuteOnlyInjectedThreads(); +__declspec(dllexport) long long TITCALL ThreaderGetOpenHandleForThread(DWORD ThreadId); +__declspec(dllexport) void* TITCALL ThreaderGetThreadData(); +__declspec(dllexport) bool TITCALL ThreaderIsExceptionInMainThread(); +// TitanEngine.Debugger.functions: +__declspec(dllexport) void* TITCALL StaticDisassembleEx(ULONG_PTR DisassmStart, LPVOID DisassmAddress); +__declspec(dllexport) void* TITCALL StaticDisassemble(LPVOID DisassmAddress); +__declspec(dllexport) void* TITCALL DisassembleEx(HANDLE hProcess, LPVOID DisassmAddress, bool ReturnInstructionType); +__declspec(dllexport) void* TITCALL Disassemble(LPVOID DisassmAddress); +__declspec(dllexport) long TITCALL StaticLengthDisassemble(LPVOID DisassmAddress); +__declspec(dllexport) long TITCALL LengthDisassembleEx(HANDLE hProcess, LPVOID DisassmAddress); +__declspec(dllexport) long TITCALL LengthDisassemble(LPVOID DisassmAddress); +__declspec(dllexport) void* TITCALL InitDebug(char* szFileName, char* szCommandLine, char* szCurrentFolder); +__declspec(dllexport) void* TITCALL InitDebugW(wchar_t* szFileName, wchar_t* szCommandLine, wchar_t* szCurrentFolder); +__declspec(dllexport) void* TITCALL InitDebugEx(char* szFileName, char* szCommandLine, char* szCurrentFolder, LPVOID EntryCallBack); +__declspec(dllexport) void* TITCALL InitDebugExW(wchar_t* szFileName, wchar_t* szCommandLine, wchar_t* szCurrentFolder, LPVOID EntryCallBack); +__declspec(dllexport) void* TITCALL InitDLLDebug(char* szFileName, bool ReserveModuleBase, char* szCommandLine, char* szCurrentFolder, LPVOID EntryCallBack); +__declspec(dllexport) void* TITCALL InitDLLDebugW(wchar_t* szFileName, bool ReserveModuleBase, wchar_t* szCommandLine, wchar_t* szCurrentFolder, LPVOID EntryCallBack); +__declspec(dllexport) bool TITCALL StopDebug(); +__declspec(dllexport) void TITCALL SetBPXOptions(long DefaultBreakPointType); +__declspec(dllexport) bool TITCALL IsBPXEnabled(ULONG_PTR bpxAddress); +__declspec(dllexport) bool TITCALL EnableBPX(ULONG_PTR bpxAddress); +__declspec(dllexport) bool TITCALL DisableBPX(ULONG_PTR bpxAddress); +__declspec(dllexport) bool TITCALL SetBPX(ULONG_PTR bpxAddress, DWORD bpxType, LPVOID bpxCallBack); +__declspec(dllexport) bool TITCALL SetBPXEx(ULONG_PTR bpxAddress, DWORD bpxType, DWORD NumberOfExecution, DWORD CmpRegister, DWORD CmpCondition, ULONG_PTR CmpValue, LPVOID bpxCallBack, LPVOID bpxCompareCallBack, LPVOID bpxRemoveCallBack); +__declspec(dllexport) bool TITCALL DeleteBPX(ULONG_PTR bpxAddress); +__declspec(dllexport) bool TITCALL SafeDeleteBPX(ULONG_PTR bpxAddress); +__declspec(dllexport) bool TITCALL SetAPIBreakPoint(char* szDLLName, char* szAPIName, DWORD bpxType, DWORD bpxPlace, LPVOID bpxCallBack); +__declspec(dllexport) bool TITCALL DeleteAPIBreakPoint(char* szDLLName, char* szAPIName, DWORD bpxPlace); +__declspec(dllexport) bool TITCALL SafeDeleteAPIBreakPoint(char* szDLLName, char* szAPIName, DWORD bpxPlace); +__declspec(dllexport) bool TITCALL SetMemoryBPX(ULONG_PTR MemoryStart, DWORD SizeOfMemory, LPVOID bpxCallBack); +__declspec(dllexport) bool TITCALL SetMemoryBPXEx(ULONG_PTR MemoryStart, DWORD SizeOfMemory, DWORD BreakPointType, bool RestoreOnHit, LPVOID bpxCallBack); +__declspec(dllexport) bool TITCALL RemoveMemoryBPX(ULONG_PTR MemoryStart, DWORD SizeOfMemory); +__declspec(dllexport) bool TITCALL GetContextFPUDataEx(HANDLE hActiveThread, void* FPUSaveArea); +__declspec(dllexport) long long TITCALL GetContextDataEx(HANDLE hActiveThread, DWORD IndexOfRegister); +__declspec(dllexport) long long TITCALL GetContextData(DWORD IndexOfRegister); +__declspec(dllexport) bool TITCALL SetContextFPUDataEx(HANDLE hActiveThread, void* FPUSaveArea); +__declspec(dllexport) bool TITCALL SetContextDataEx(HANDLE hActiveThread, DWORD IndexOfRegister, ULONG_PTR NewRegisterValue); +__declspec(dllexport) bool TITCALL SetContextData(DWORD IndexOfRegister, ULONG_PTR NewRegisterValue); +__declspec(dllexport) void TITCALL ClearExceptionNumber(); +__declspec(dllexport) long TITCALL CurrentExceptionNumber(); +__declspec(dllexport) bool TITCALL MatchPatternEx(HANDLE hProcess, void* MemoryToCheck, int SizeOfMemoryToCheck, void* PatternToMatch, int SizeOfPatternToMatch, PBYTE WildCard); +__declspec(dllexport) bool TITCALL MatchPattern(void* MemoryToCheck, int SizeOfMemoryToCheck, void* PatternToMatch, int SizeOfPatternToMatch, PBYTE WildCard); +__declspec(dllexport) long long TITCALL FindEx(HANDLE hProcess, LPVOID MemoryStart, DWORD MemorySize, LPVOID SearchPattern, DWORD PatternSize, LPBYTE WildCard); +extern "C" __declspec(dllexport) long long TITCALL Find(LPVOID MemoryStart, DWORD MemorySize, LPVOID SearchPattern, DWORD PatternSize, LPBYTE WildCard); +__declspec(dllexport) bool TITCALL FillEx(HANDLE hProcess, LPVOID MemoryStart, DWORD MemorySize, PBYTE FillByte); +__declspec(dllexport) bool TITCALL Fill(LPVOID MemoryStart, DWORD MemorySize, PBYTE FillByte); +__declspec(dllexport) bool TITCALL PatchEx(HANDLE hProcess, LPVOID MemoryStart, DWORD MemorySize, LPVOID ReplacePattern, DWORD ReplaceSize, bool AppendNOP, bool PrependNOP); +__declspec(dllexport) bool TITCALL Patch(LPVOID MemoryStart, DWORD MemorySize, LPVOID ReplacePattern, DWORD ReplaceSize, bool AppendNOP, bool PrependNOP); +__declspec(dllexport) bool TITCALL ReplaceEx(HANDLE hProcess, LPVOID MemoryStart, DWORD MemorySize, LPVOID SearchPattern, DWORD PatternSize, DWORD NumberOfRepetitions, LPVOID ReplacePattern, DWORD ReplaceSize, PBYTE WildCard); +__declspec(dllexport) bool TITCALL Replace(LPVOID MemoryStart, DWORD MemorySize, LPVOID SearchPattern, DWORD PatternSize, DWORD NumberOfRepetitions, LPVOID ReplacePattern, DWORD ReplaceSize, PBYTE WildCard); +__declspec(dllexport) void* TITCALL GetDebugData(); +__declspec(dllexport) void* TITCALL GetTerminationData(); +__declspec(dllexport) long TITCALL GetExitCode(); +__declspec(dllexport) long long TITCALL GetDebuggedDLLBaseAddress(); +__declspec(dllexport) unsigned long long TITCALL GetDebuggedFileBaseAddress(); +__declspec(dllexport) bool TITCALL GetRemoteString(HANDLE hProcess, LPVOID StringAddress, LPVOID StringStorage, int MaximumStringSize); +__declspec(dllexport) long long TITCALL GetFunctionParameter(HANDLE hProcess, DWORD FunctionType, DWORD ParameterNumber, DWORD ParameterType); +__declspec(dllexport) long long TITCALL GetJumpDestinationEx(HANDLE hProcess, ULONG_PTR InstructionAddress, bool JustJumps); +__declspec(dllexport) long long TITCALL GetJumpDestination(HANDLE hProcess, ULONG_PTR InstructionAddress); +__declspec(dllexport) bool TITCALL IsJumpGoingToExecuteEx(HANDLE hProcess, HANDLE hThread, ULONG_PTR InstructionAddress, ULONG_PTR RegFlags); +__declspec(dllexport) bool TITCALL IsJumpGoingToExecute(); +__declspec(dllexport) void TITCALL SetCustomHandler(DWORD ExceptionId, LPVOID CallBack); +__declspec(dllexport) void TITCALL ForceClose(); +__declspec(dllexport) void TITCALL StepInto(LPVOID traceCallBack); +__declspec(dllexport) void TITCALL StepOver(LPVOID traceCallBack); +__declspec(dllexport) void TITCALL SingleStep(DWORD StepCount, LPVOID StepCallBack); +__declspec(dllexport) bool TITCALL GetUnusedHardwareBreakPointRegister(LPDWORD RegisterIndex); +__declspec(dllexport) bool TITCALL SetHardwareBreakPointEx(HANDLE hActiveThread, ULONG_PTR bpxAddress, DWORD IndexOfRegister, DWORD bpxType, DWORD bpxSize, LPVOID bpxCallBack, LPDWORD IndexOfSelectedRegister); +__declspec(dllexport) bool TITCALL SetHardwareBreakPoint(ULONG_PTR bpxAddress, DWORD IndexOfRegister, DWORD bpxType, DWORD bpxSize, LPVOID bpxCallBack); +__declspec(dllexport) bool TITCALL DeleteHardwareBreakPoint(DWORD IndexOfRegister); +__declspec(dllexport) bool TITCALL RemoveAllBreakPoints(DWORD RemoveOption); +__declspec(dllexport) void* TITCALL GetProcessInformation(); +__declspec(dllexport) void* TITCALL GetStartupInformation(); +__declspec(dllexport) void TITCALL DebugLoop(); +__declspec(dllexport) void TITCALL SetDebugLoopTimeOut(DWORD TimeOut); +__declspec(dllexport) void TITCALL SetNextDbgContinueStatus(DWORD SetDbgCode); +__declspec(dllexport) bool TITCALL AttachDebugger(DWORD ProcessId, bool KillOnExit, LPVOID DebugInfo, LPVOID CallBack); +__declspec(dllexport) bool TITCALL DetachDebugger(DWORD ProcessId); +__declspec(dllexport) bool TITCALL DetachDebuggerEx(DWORD ProcessId); +__declspec(dllexport) void TITCALL DebugLoopEx(DWORD TimeOut); +__declspec(dllexport) void TITCALL AutoDebugEx(char* szFileName, bool ReserveModuleBase, char* szCommandLine, char* szCurrentFolder, DWORD TimeOut, LPVOID EntryCallBack); +__declspec(dllexport) void TITCALL AutoDebugExW(wchar_t* szFileName, bool ReserveModuleBase, wchar_t* szCommandLine, wchar_t* szCurrentFolder, DWORD TimeOut, LPVOID EntryCallBack); +__declspec(dllexport) bool TITCALL IsFileBeingDebugged(); +__declspec(dllexport) void TITCALL SetErrorModel(bool DisplayErrorMessages); +// TitanEngine.FindOEP.functions: +__declspec(dllexport) void TITCALL FindOEPInit(); +__declspec(dllexport) bool TITCALL FindOEPGenerically(char* szFileName, LPVOID TraceInitCallBack, LPVOID CallBack); +__declspec(dllexport) bool TITCALL FindOEPGenericallyW(wchar_t* szFileName, LPVOID TraceInitCallBack, LPVOID CallBack); +// TitanEngine.Importer.functions: +__declspec(dllexport) void TITCALL ImporterCleanup(); +__declspec(dllexport) void TITCALL ImporterSetImageBase(ULONG_PTR ImageBase); +__declspec(dllexport) void TITCALL ImporterSetUnknownDelta(ULONG_PTR DeltaAddress); +__declspec(dllexport) long long TITCALL ImporterGetCurrentDelta(); +__declspec(dllexport) void TITCALL ImporterInit(DWORD MemorySize, ULONG_PTR ImageBase); +__declspec(dllexport) void TITCALL ImporterAddNewDll(char* szDLLName, ULONG_PTR FirstThunk); +__declspec(dllexport) void TITCALL ImporterAddNewAPI(char* szAPIName, ULONG_PTR ThunkValue); +__declspec(dllexport) void TITCALL ImporterAddNewOrdinalAPI(ULONG_PTR OrdinalNumber, ULONG_PTR ThunkValue); +__declspec(dllexport) long TITCALL ImporterGetAddedDllCount(); +__declspec(dllexport) long TITCALL ImporterGetAddedAPICount(); +__declspec(dllexport) void* TITCALL ImporterGetLastAddedDLLName(); +__declspec(dllexport) void TITCALL ImporterMoveIAT(); +__declspec(dllexport) bool TITCALL ImporterExportIAT(ULONG_PTR StorePlace, ULONG_PTR FileMapVA); +__declspec(dllexport) long TITCALL ImporterEstimatedSize(); +__declspec(dllexport) bool TITCALL ImporterExportIATEx(char* szExportFileName, char* szSectionName); +__declspec(dllexport) bool TITCALL ImporterExportIATExW(wchar_t* szExportFileName, char* szSectionName); +__declspec(dllexport) long long TITCALL ImporterFindAPIWriteLocation(char* szAPIName); +__declspec(dllexport) long long TITCALL ImporterFindOrdinalAPIWriteLocation(ULONG_PTR OrdinalNumber); +__declspec(dllexport) long long TITCALL ImporterFindAPIByWriteLocation(ULONG_PTR APIWriteLocation); +__declspec(dllexport) long long TITCALL ImporterFindDLLByWriteLocation(ULONG_PTR APIWriteLocation); +__declspec(dllexport) void* TITCALL ImporterGetDLLName(ULONG_PTR APIAddress); +__declspec(dllexport) void* TITCALL ImporterGetAPIName(ULONG_PTR APIAddress); +__declspec(dllexport) long long TITCALL ImporterGetAPIOrdinalNumber(ULONG_PTR APIAddress); +__declspec(dllexport) void* TITCALL ImporterGetAPINameEx(ULONG_PTR APIAddress, ULONG_PTR DLLBasesList); +__declspec(dllexport) long long TITCALL ImporterGetRemoteAPIAddress(HANDLE hProcess, ULONG_PTR APIAddress); +__declspec(dllexport) long long TITCALL ImporterGetRemoteAPIAddressEx(char* szDLLName, char* szAPIName); +__declspec(dllexport) long long TITCALL ImporterGetLocalAPIAddress(HANDLE hProcess, ULONG_PTR APIAddress); +__declspec(dllexport) void* TITCALL ImporterGetDLLNameFromDebugee(HANDLE hProcess, ULONG_PTR APIAddress); +__declspec(dllexport) void* TITCALL ImporterGetAPINameFromDebugee(HANDLE hProcess, ULONG_PTR APIAddress); +__declspec(dllexport) long long TITCALL ImporterGetAPIOrdinalNumberFromDebugee(HANDLE hProcess, ULONG_PTR APIAddress); +__declspec(dllexport) long TITCALL ImporterGetDLLIndexEx(ULONG_PTR APIAddress, ULONG_PTR DLLBasesList); +__declspec(dllexport) long TITCALL ImporterGetDLLIndex(HANDLE hProcess, ULONG_PTR APIAddress, ULONG_PTR DLLBasesList); +__declspec(dllexport) long long TITCALL ImporterGetRemoteDLLBase(HANDLE hProcess, HMODULE LocalModuleBase); +__declspec(dllexport) long long TITCALL ImporterGetRemoteDLLBaseEx(HANDLE hProcess, char* szModuleName); +__declspec(dllexport) bool TITCALL ImporterRelocateWriteLocation(ULONG_PTR AddValue); +__declspec(dllexport) bool TITCALL ImporterIsForwardedAPI(HANDLE hProcess, ULONG_PTR APIAddress); +__declspec(dllexport) void* TITCALL ImporterGetForwardedAPIName(HANDLE hProcess, ULONG_PTR APIAddress); +__declspec(dllexport) void* TITCALL ImporterGetForwardedDLLName(HANDLE hProcess, ULONG_PTR APIAddress); +__declspec(dllexport) long TITCALL ImporterGetForwardedDLLIndex(HANDLE hProcess, ULONG_PTR APIAddress, ULONG_PTR DLLBasesList); +__declspec(dllexport) long long TITCALL ImporterGetForwardedAPIOrdinalNumber(HANDLE hProcess, ULONG_PTR APIAddress); +__declspec(dllexport) long long TITCALL ImporterGetNearestAPIAddress(HANDLE hProcess, ULONG_PTR APIAddress); +__declspec(dllexport) void* TITCALL ImporterGetNearestAPIName(HANDLE hProcess, ULONG_PTR APIAddress); +__declspec(dllexport) bool TITCALL ImporterCopyOriginalIAT(char* szOriginalFile, char* szDumpFile); +__declspec(dllexport) bool TITCALL ImporterCopyOriginalIATW(wchar_t* szOriginalFile, wchar_t* szDumpFile); +__declspec(dllexport) bool TITCALL ImporterLoadImportTable(char* szFileName); +__declspec(dllexport) bool TITCALL ImporterLoadImportTableW(wchar_t* szFileName); +__declspec(dllexport) bool TITCALL ImporterMoveOriginalIAT(char* szOriginalFile, char* szDumpFile, char* szSectionName); +__declspec(dllexport) bool TITCALL ImporterMoveOriginalIATW(wchar_t* szOriginalFile, wchar_t* szDumpFile, char* szSectionName); +__declspec(dllexport) void TITCALL ImporterAutoSearchIAT(HANDLE hProcess, char* szFileName, ULONG_PTR ImageBase, ULONG_PTR SearchStart, DWORD SearchSize, LPVOID pIATStart, LPVOID pIATSize); +__declspec(dllexport) void TITCALL ImporterAutoSearchIATW(HANDLE hProcess, wchar_t* szFileName, ULONG_PTR ImageBase, ULONG_PTR SearchStart, DWORD SearchSize, LPVOID pIATStart, LPVOID pIATSize); +__declspec(dllexport) void TITCALL ImporterAutoSearchIATEx(HANDLE hProcess, ULONG_PTR ImageBase, ULONG_PTR SearchStart, DWORD SearchSize, LPVOID pIATStart, LPVOID pIATSize); +__declspec(dllexport) void TITCALL ImporterEnumAddedData(LPVOID EnumCallBack); +__declspec(dllexport) long TITCALL ImporterAutoFixIATEx(HANDLE hProcess, char* szDumpedFile, char* szSectionName, bool DumpRunningProcess, bool RealignFile, ULONG_PTR EntryPointAddress, ULONG_PTR ImageBase, ULONG_PTR SearchStart, DWORD SearchSize, DWORD SearchStep, bool TryAutoFix, bool FixEliminations, LPVOID UnknownPointerFixCallback); +__declspec(dllexport) long TITCALL ImporterAutoFixIATExW(HANDLE hProcess, wchar_t* szDumpedFile, char* szSectionName, bool DumpRunningProcess, bool RealignFile, ULONG_PTR EntryPointAddress, ULONG_PTR ImageBase, ULONG_PTR SearchStart, DWORD SearchSize, DWORD SearchStep, bool TryAutoFix, bool FixEliminations, LPVOID UnknownPointerFixCallback); +__declspec(dllexport) long TITCALL ImporterAutoFixIAT(HANDLE hProcess, char* szDumpedFile, ULONG_PTR ImageBase, ULONG_PTR SearchStart, DWORD SearchSize, DWORD SearchStep); +__declspec(dllexport) long TITCALL ImporterAutoFixIATW(HANDLE hProcess, wchar_t* szDumpedFile, ULONG_PTR ImageBase, ULONG_PTR SearchStart, DWORD SearchSize, DWORD SearchStep); +// Global.Engine.Hook.functions: +__declspec(dllexport) bool TITCALL HooksSafeTransitionEx(LPVOID HookAddressArray, int NumberOfHooks, bool TransitionStart); +__declspec(dllexport) bool TITCALL HooksSafeTransition(LPVOID HookAddress, bool TransitionStart); +__declspec(dllexport) bool TITCALL HooksIsAddressRedirected(LPVOID HookAddress); +__declspec(dllexport) void* TITCALL HooksGetTrampolineAddress(LPVOID HookAddress); +__declspec(dllexport) void* TITCALL HooksGetHookEntryDetails(LPVOID HookAddress); +__declspec(dllexport) bool TITCALL HooksInsertNewRedirection(LPVOID HookAddress, LPVOID RedirectTo, int HookType); +__declspec(dllexport) bool TITCALL HooksInsertNewIATRedirectionEx(ULONG_PTR FileMapVA, ULONG_PTR LoadedModuleBase, char* szHookFunction, LPVOID RedirectTo); +__declspec(dllexport) bool TITCALL HooksInsertNewIATRedirection(char* szModuleName, char* szHookFunction, LPVOID RedirectTo); +__declspec(dllexport) bool TITCALL HooksRemoveRedirection(LPVOID HookAddress, bool RemoveAll); +__declspec(dllexport) bool TITCALL HooksRemoveRedirectionsForModule(HMODULE ModuleBase); +__declspec(dllexport) bool TITCALL HooksRemoveIATRedirection(char* szModuleName, char* szHookFunction, bool RemoveAll); +__declspec(dllexport) bool TITCALL HooksDisableRedirection(LPVOID HookAddress, bool DisableAll); +__declspec(dllexport) bool TITCALL HooksDisableRedirectionsForModule(HMODULE ModuleBase); +__declspec(dllexport) bool TITCALL HooksDisableIATRedirection(char* szModuleName, char* szHookFunction, bool DisableAll); +__declspec(dllexport) bool TITCALL HooksEnableRedirection(LPVOID HookAddress, bool EnableAll); +__declspec(dllexport) bool TITCALL HooksEnableRedirectionsForModule(HMODULE ModuleBase); +__declspec(dllexport) bool TITCALL HooksEnableIATRedirection(char* szModuleName, char* szHookFunction, bool EnableAll); +__declspec(dllexport) void TITCALL HooksScanModuleMemory(HMODULE ModuleBase, LPVOID CallBack); +__declspec(dllexport) void TITCALL HooksScanEntireProcessMemory(LPVOID CallBack); +__declspec(dllexport) void TITCALL HooksScanEntireProcessMemoryEx(); +// TitanEngine.Tracer.functions: +__declspec(dllexport) void TITCALL TracerInit(); +__declspec(dllexport) long long TITCALL TracerLevel1(HANDLE hProcess, ULONG_PTR AddressToTrace); +__declspec(dllexport) long long TITCALL HashTracerLevel1(HANDLE hProcess, ULONG_PTR AddressToTrace, DWORD InputNumberOfInstructions); +__declspec(dllexport) long TITCALL TracerDetectRedirection(HANDLE hProcess, ULONG_PTR AddressToTrace); +__declspec(dllexport) long long TITCALL TracerFixKnownRedirection(HANDLE hProcess, ULONG_PTR AddressToTrace, DWORD RedirectionId); +__declspec(dllexport) long long TITCALL TracerFixRedirectionViaModule(HMODULE hModuleHandle, HANDLE hProcess, ULONG_PTR AddressToTrace, DWORD IdParameter); +__declspec(dllexport) long TITCALL TracerFixRedirectionViaImpRecPlugin(HANDLE hProcess, char* szPluginName, ULONG_PTR AddressToTrace); +// TitanEngine.Exporter.functions: +__declspec(dllexport) void TITCALL ExporterCleanup(); +__declspec(dllexport) void TITCALL ExporterSetImageBase(ULONG_PTR ImageBase); +__declspec(dllexport) void TITCALL ExporterInit(DWORD MemorySize, ULONG_PTR ImageBase, DWORD ExportOrdinalBase, char* szExportModuleName); +__declspec(dllexport) bool TITCALL ExporterAddNewExport(char* szExportName, DWORD ExportRelativeAddress); +__declspec(dllexport) bool TITCALL ExporterAddNewOrdinalExport(DWORD OrdinalNumber, DWORD ExportRelativeAddress); +__declspec(dllexport) long TITCALL ExporterGetAddedExportCount(); +__declspec(dllexport) long TITCALL ExporterEstimatedSize(); +__declspec(dllexport) bool TITCALL ExporterBuildExportTable(ULONG_PTR StorePlace, ULONG_PTR FileMapVA); +__declspec(dllexport) bool TITCALL ExporterBuildExportTableEx(char* szExportFileName, char* szSectionName); +__declspec(dllexport) bool TITCALL ExporterBuildExportTableExW(wchar_t* szExportFileName, char* szSectionName); +__declspec(dllexport) bool TITCALL ExporterLoadExportTable(char* szFileName); +__declspec(dllexport) bool TITCALL ExporterLoadExportTableW(wchar_t* szFileName); +// TitanEngine.Librarian.functions: +__declspec(dllexport) bool TITCALL LibrarianSetBreakPoint(char* szLibraryName, DWORD bpxType, bool SingleShoot, LPVOID bpxCallBack); +__declspec(dllexport) bool TITCALL LibrarianRemoveBreakPoint(char* szLibraryName, DWORD bpxType); +__declspec(dllexport) void* TITCALL LibrarianGetLibraryInfo(char* szLibraryName); +__declspec(dllexport) void* TITCALL LibrarianGetLibraryInfoW(wchar_t* szLibraryName); +__declspec(dllexport) void* TITCALL LibrarianGetLibraryInfoEx(void* BaseOfDll); +__declspec(dllexport) void* TITCALL LibrarianGetLibraryInfoExW(void* BaseOfDll); +__declspec(dllexport) void TITCALL LibrarianEnumLibraryInfo(void* EnumCallBack); +__declspec(dllexport) void TITCALL LibrarianEnumLibraryInfoW(void* EnumCallBack); +// TitanEngine.Process.functions: +__declspec(dllexport) long TITCALL GetActiveProcessId(char* szImageName); +__declspec(dllexport) long TITCALL GetActiveProcessIdW(wchar_t* szImageName); +__declspec(dllexport) void TITCALL EnumProcessesWithLibrary(char* szLibraryName, void* EnumFunction); +// TitanEngine.TLSFixer.functions: +__declspec(dllexport) bool TITCALL TLSBreakOnCallBack(LPVOID ArrayOfCallBacks, DWORD NumberOfCallBacks, LPVOID bpxCallBack); +__declspec(dllexport) bool TITCALL TLSGrabCallBackData(char* szFileName, LPVOID ArrayOfCallBacks, LPDWORD NumberOfCallBacks); +__declspec(dllexport) bool TITCALL TLSGrabCallBackDataW(wchar_t* szFileName, LPVOID ArrayOfCallBacks, LPDWORD NumberOfCallBacks); +__declspec(dllexport) bool TITCALL TLSBreakOnCallBackEx(char* szFileName, LPVOID bpxCallBack); +__declspec(dllexport) bool TITCALL TLSBreakOnCallBackExW(wchar_t* szFileName, LPVOID bpxCallBack); +__declspec(dllexport) bool TITCALL TLSRemoveCallback(char* szFileName); +__declspec(dllexport) bool TITCALL TLSRemoveCallbackW(wchar_t* szFileName); +__declspec(dllexport) bool TITCALL TLSRemoveTable(char* szFileName); +__declspec(dllexport) bool TITCALL TLSRemoveTableW(wchar_t* szFileName); +__declspec(dllexport) bool TITCALL TLSBackupData(char* szFileName); +__declspec(dllexport) bool TITCALL TLSBackupDataW(wchar_t* szFileName); +__declspec(dllexport) bool TITCALL TLSRestoreData(); +__declspec(dllexport) bool TITCALL TLSBuildNewTable(ULONG_PTR FileMapVA, ULONG_PTR StorePlace, ULONG_PTR StorePlaceRVA, LPVOID ArrayOfCallBacks, DWORD NumberOfCallBacks); +__declspec(dllexport) bool TITCALL TLSBuildNewTableEx(char* szFileName, char* szSectionName, LPVOID ArrayOfCallBacks, DWORD NumberOfCallBacks); +__declspec(dllexport) bool TITCALL TLSBuildNewTableExW(wchar_t* szFileName, char* szSectionName, LPVOID ArrayOfCallBacks, DWORD NumberOfCallBacks); +// TitanEngine.TranslateName.functions: +__declspec(dllexport) void* TITCALL TranslateNativeName(char* szNativeName); +__declspec(dllexport) void* TITCALL TranslateNativeNameW(wchar_t* szNativeName); +// TitanEngine.Handler.functions: +__declspec(dllexport) long TITCALL HandlerGetActiveHandleCount(DWORD ProcessId); +__declspec(dllexport) bool TITCALL HandlerIsHandleOpen(DWORD ProcessId, HANDLE hHandle); +__declspec(dllexport) void* TITCALL HandlerGetHandleName(HANDLE hProcess, DWORD ProcessId, HANDLE hHandle, bool TranslateName); +__declspec(dllexport) void* TITCALL HandlerGetHandleNameW(HANDLE hProcess, DWORD ProcessId, HANDLE hHandle, bool TranslateName); +__declspec(dllexport) long TITCALL HandlerEnumerateOpenHandles(DWORD ProcessId, LPVOID HandleBuffer, DWORD MaxHandleCount); +__declspec(dllexport) long long TITCALL HandlerGetHandleDetails(HANDLE hProcess, DWORD ProcessId, HANDLE hHandle, DWORD InformationReturn); +__declspec(dllexport) bool TITCALL HandlerCloseRemoteHandle(HANDLE hProcess, HANDLE hHandle); +__declspec(dllexport) long TITCALL HandlerEnumerateLockHandles(char* szFileOrFolderName, bool NameIsFolder, bool NameIsTranslated, LPVOID HandleDataBuffer, DWORD MaxHandleCount); +__declspec(dllexport) long TITCALL HandlerEnumerateLockHandlesW(wchar_t* szFileOrFolderName, bool NameIsFolder, bool NameIsTranslated, LPVOID HandleDataBuffer, DWORD MaxHandleCount); +__declspec(dllexport) bool TITCALL HandlerCloseAllLockHandles(char* szFileOrFolderName, bool NameIsFolder, bool NameIsTranslated); +__declspec(dllexport) bool TITCALL HandlerCloseAllLockHandlesW(wchar_t* szFileOrFolderName, bool NameIsFolder, bool NameIsTranslated); +__declspec(dllexport) bool TITCALL HandlerIsFileLocked(char* szFileOrFolderName, bool NameIsFolder, bool NameIsTranslated); +__declspec(dllexport) bool TITCALL HandlerIsFileLockedW(wchar_t* szFileOrFolderName, bool NameIsFolder, bool NameIsTranslated); +// TitanEngine.Handler[Mutex].functions: +__declspec(dllexport) long TITCALL HandlerEnumerateOpenMutexes(HANDLE hProcess, DWORD ProcessId, LPVOID HandleBuffer, DWORD MaxHandleCount); +__declspec(dllexport) long long TITCALL HandlerGetOpenMutexHandle(HANDLE hProcess, DWORD ProcessId, char* szMutexString); +__declspec(dllexport) long long TITCALL HandlerGetOpenMutexHandleW(HANDLE hProcess, DWORD ProcessId, wchar_t* szMutexString); +__declspec(dllexport) long TITCALL HandlerGetProcessIdWhichCreatedMutex(char* szMutexString); +__declspec(dllexport) long TITCALL HandlerGetProcessIdWhichCreatedMutexW(wchar_t* szMutexString); +// TitanEngine.Injector.functions: +__declspec(dllexport) bool TITCALL RemoteLoadLibrary(HANDLE hProcess, char* szLibraryFile, bool WaitForThreadExit); +__declspec(dllexport) bool TITCALL RemoteLoadLibraryW(HANDLE hProcess, wchar_t* szLibraryFile, bool WaitForThreadExit); +__declspec(dllexport) bool TITCALL RemoteFreeLibrary(HANDLE hProcess, HMODULE hModule, char* szLibraryFile, bool WaitForThreadExit); +__declspec(dllexport) bool TITCALL RemoteFreeLibraryW(HANDLE hProcess, HMODULE hModule, wchar_t* szLibraryFile, bool WaitForThreadExit); +__declspec(dllexport) bool TITCALL RemoteExitProcess(HANDLE hProcess, DWORD ExitCode); +// TitanEngine.StaticUnpacker.functions: +__declspec(dllexport) bool TITCALL StaticFileLoad(char* szFileName, DWORD DesiredAccess, bool SimulateLoad, LPHANDLE FileHandle, LPDWORD LoadedSize, LPHANDLE FileMap, PULONG_PTR FileMapVA); +__declspec(dllexport) bool TITCALL StaticFileLoadW(wchar_t* szFileName, DWORD DesiredAccess, bool SimulateLoad, LPHANDLE FileHandle, LPDWORD LoadedSize, LPHANDLE FileMap, PULONG_PTR FileMapVA); +__declspec(dllexport) bool TITCALL StaticFileUnload(char* szFileName, bool CommitChanges, HANDLE FileHandle, DWORD LoadedSize, HANDLE FileMap, ULONG_PTR FileMapVA); +__declspec(dllexport) bool TITCALL StaticFileUnloadW(wchar_t* szFileName, bool CommitChanges, HANDLE FileHandle, DWORD LoadedSize, HANDLE FileMap, ULONG_PTR FileMapVA); +__declspec(dllexport) bool TITCALL StaticFileOpen(char* szFileName, DWORD DesiredAccess, LPHANDLE FileHandle, LPDWORD FileSizeLow, LPDWORD FileSizeHigh); +__declspec(dllexport) bool TITCALL StaticFileOpenW(wchar_t* szFileName, DWORD DesiredAccess, LPHANDLE FileHandle, LPDWORD FileSizeLow, LPDWORD FileSizeHigh); +__declspec(dllexport) bool TITCALL StaticFileGetContent(HANDLE FileHandle, DWORD FilePositionLow, LPDWORD FilePositionHigh, void* Buffer, DWORD Size); +__declspec(dllexport) void TITCALL StaticFileClose(HANDLE FileHandle); +__declspec(dllexport) void TITCALL StaticMemoryDecrypt(LPVOID MemoryStart, DWORD MemorySize, DWORD DecryptionType, DWORD DecryptionKeySize, ULONG_PTR DecryptionKey); +__declspec(dllexport) void TITCALL StaticMemoryDecryptEx(LPVOID MemoryStart, DWORD MemorySize, DWORD DecryptionKeySize, void* DecryptionCallBack); +__declspec(dllexport) void TITCALL StaticMemoryDecryptSpecial(LPVOID MemoryStart, DWORD MemorySize, DWORD DecryptionKeySize, DWORD SpecDecryptionType, void* DecryptionCallBack); +__declspec(dllexport) void TITCALL StaticSectionDecrypt(ULONG_PTR FileMapVA, DWORD SectionNumber, bool SimulateLoad, DWORD DecryptionType, DWORD DecryptionKeySize, ULONG_PTR DecryptionKey); +__declspec(dllexport) bool TITCALL StaticMemoryDecompress(void* Source, DWORD SourceSize, void* Destination, DWORD DestinationSize, int Algorithm); +__declspec(dllexport) bool TITCALL StaticRawMemoryCopy(HANDLE hFile, ULONG_PTR FileMapVA, ULONG_PTR VitualAddressToCopy, DWORD Size, bool AddressIsRVA, char* szDumpFileName); +__declspec(dllexport) bool TITCALL StaticRawMemoryCopyW(HANDLE hFile, ULONG_PTR FileMapVA, ULONG_PTR VitualAddressToCopy, DWORD Size, bool AddressIsRVA, wchar_t* szDumpFileName); +__declspec(dllexport) bool TITCALL StaticRawMemoryCopyEx(HANDLE hFile, DWORD RawAddressToCopy, DWORD Size, char* szDumpFileName); +__declspec(dllexport) bool TITCALL StaticRawMemoryCopyExW(HANDLE hFile, DWORD RawAddressToCopy, DWORD Size, wchar_t* szDumpFileName); +__declspec(dllexport) bool TITCALL StaticRawMemoryCopyEx64(HANDLE hFile, DWORD64 RawAddressToCopy, DWORD64 Size, char* szDumpFileName); +__declspec(dllexport) bool TITCALL StaticRawMemoryCopyEx64W(HANDLE hFile, DWORD64 RawAddressToCopy, DWORD64 Size, wchar_t* szDumpFileName); +__declspec(dllexport) bool TITCALL StaticHashMemory(void* MemoryToHash, DWORD SizeOfMemory, void* HashDigest, bool OutputString, int Algorithm); +__declspec(dllexport) bool TITCALL StaticHashFileW(wchar_t* szFileName, char* HashDigest, bool OutputString, int Algorithm); +__declspec(dllexport) bool TITCALL StaticHashFile(char* szFileName, char* HashDigest, bool OutputString, int Algorithm); +// TitanEngine.Engine.functions: +__declspec(dllexport) void TITCALL EngineUnpackerInitialize(char* szFileName, char* szUnpackedFileName, bool DoLogData, bool DoRealignFile, bool DoMoveOverlay, void* EntryCallBack); +__declspec(dllexport) void TITCALL EngineUnpackerInitializeW(wchar_t* szFileName, wchar_t* szUnpackedFileName, bool DoLogData, bool DoRealignFile, bool DoMoveOverlay, void* EntryCallBack); +__declspec(dllexport) bool TITCALL EngineUnpackerSetBreakCondition(void* SearchStart, DWORD SearchSize, void* SearchPattern, DWORD PatternSize, DWORD PatternDelta, ULONG_PTR BreakType, bool SingleBreak, DWORD Parameter1, DWORD Parameter2); +__declspec(dllexport) void TITCALL EngineUnpackerSetEntryPointAddress(ULONG_PTR UnpackedEntryPointAddress); +__declspec(dllexport) void TITCALL EngineUnpackerFinalizeUnpacking(); +// TitanEngine.Engine.functions: +__declspec(dllexport) void TITCALL SetEngineVariable(DWORD VariableId, bool VariableSet); +__declspec(dllexport) bool TITCALL EngineCreateMissingDependencies(char* szFileName, char* szOutputFolder, bool LogCreatedFiles); +__declspec(dllexport) bool TITCALL EngineCreateMissingDependenciesW(wchar_t* szFileName, wchar_t* szOutputFolder, bool LogCreatedFiles); +__declspec(dllexport) bool TITCALL EngineFakeMissingDependencies(HANDLE hProcess); +__declspec(dllexport) bool TITCALL EngineDeleteCreatedDependencies(); +__declspec(dllexport) bool TITCALL EngineCreateUnpackerWindow(char* WindowUnpackerTitle, char* WindowUnpackerLongTitle, char* WindowUnpackerName, char* WindowUnpackerAuthor, void* StartUnpackingCallBack); +__declspec(dllexport) void TITCALL EngineAddUnpackerWindowLogMessage(char* szLogMessage); +// Global.Engine.Extension.Functions: +__declspec(dllexport) bool TITCALL ExtensionManagerIsPluginLoaded(char* szPluginName); +__declspec(dllexport) bool TITCALL ExtensionManagerIsPluginEnabled(char* szPluginName); +__declspec(dllexport) bool TITCALL ExtensionManagerDisableAllPlugins(); +__declspec(dllexport) bool TITCALL ExtensionManagerDisablePlugin(char* szPluginName); +__declspec(dllexport) bool TITCALL ExtensionManagerEnableAllPlugins(); +__declspec(dllexport) bool TITCALL ExtensionManagerEnablePlugin(char* szPluginName); +__declspec(dllexport) bool TITCALL ExtensionManagerUnloadAllPlugins(); +__declspec(dllexport) bool TITCALL ExtensionManagerUnloadPlugin(char* szPluginName); +__declspec(dllexport) void* TITCALL ExtensionManagerGetPluginInfo(char* szPluginName); + +#ifdef __cplusplus +} +#endif + +#pragma pack(pop) + +#endif /*TITANENGINE*/ diff --git a/SDK/CPP/TitanEngine.hpp b/SDK/CPP/TitanEngine.hpp new file mode 100644 index 0000000..5f3e4d6 --- /dev/null +++ b/SDK/CPP/TitanEngine.hpp @@ -0,0 +1,2815 @@ +#ifndef TITANENGINE_CPP +#define TITANENGINE_CPP + +#if _MSC_VER > 1000 + #pragma once +#endif + +namespace TE +{ + +#include + +namespace UE +{ + #ifdef TITANENGINE + #undef TITANENGINE + #endif + + #include "TitanEngine.h" +} + +// ---- + +enum eHideLevel : DWORD +{ + UE_HIDE_PEBONLY = UE::UE_HIDE_PEBONLY, + UE_HIDE_BASIC = UE::UE_HIDE_BASIC +}; + +enum ePluginCallReason : int +{ + UE_PLUGIN_CALL_REASON_PREDEBUG = UE::UE_PLUGIN_CALL_REASON_PREDEBUG, + UE_PLUGIN_CALL_REASON_EXCEPTION = UE::UE_PLUGIN_CALL_REASON_EXCEPTION, + UE_PLUGIN_CALL_REASON_POSTDEBUG = UE::UE_PLUGIN_CALL_REASON_POSTDEBUG +}; + +enum eHookType : int +{ + TEE_HOOK_NRM_JUMP = UE::TEE_HOOK_NRM_JUMP, + TEE_HOOK_NRM_CALL = UE::TEE_HOOK_NRM_CALL, + TEE_HOOK_IAT = UE::TEE_HOOK_IAT +}; + +enum eEngineVariable : DWORD +{ + UE_ENGINE_ALOW_MODULE_LOADING = UE::UE_ENGINE_ALOW_MODULE_LOADING, + UE_ENGINE_AUTOFIX_FORWARDERS = UE::UE_ENGINE_AUTOFIX_FORWARDERS, + UE_ENGINE_PASS_ALL_EXCEPTIONS = UE::UE_ENGINE_PASS_ALL_EXCEPTIONS, + UE_ENGINE_NO_CONSOLE_WINDOW = UE::UE_ENGINE_NO_CONSOLE_WINDOW, + UE_ENGINE_BACKUP_FOR_CRITICAL_FUNCTIONS = UE::UE_ENGINE_BACKUP_FOR_CRITICAL_FUNCTIONS, + UE_ENGINE_CALL_PLUGIN_CALLBACK = UE::UE_ENGINE_CALL_PLUGIN_CALLBACK, + UE_ENGINE_RESET_CUSTOM_HANDLER = UE::UE_ENGINE_RESET_CUSTOM_HANDLER, + UE_ENGINE_CALL_PLUGIN_DEBUG_CALLBACK = UE::UE_ENGINE_CALL_PLUGIN_DEBUG_CALLBACK +}; + +enum eBPRemoveOption : DWORD +{ + UE_OPTION_REMOVEALL = UE::UE_OPTION_REMOVEALL, + UE_OPTION_DISABLEALL = UE::UE_OPTION_DISABLEALL, + UE_OPTION_REMOVEALLDISABLED = UE::UE_OPTION_REMOVEALLDISABLED, + UE_OPTION_REMOVEALLENABLED = UE::UE_OPTION_REMOVEALLENABLED +}; + +enum eAccess : DWORD +{ + UE_ACCESS_READ = UE::UE_ACCESS_READ, + UE_ACCESS_WRITE = UE::UE_ACCESS_WRITE, + UE_ACCESS_ALL = UE::UE_ACCESS_ALL +}; + +enum eDecryptionType : DWORD +{ + UE_STATIC_DECRYPTOR_XOR = UE::UE_STATIC_DECRYPTOR_XOR, + UE_STATIC_DECRYPTOR_SUB = UE::UE_STATIC_DECRYPTOR_SUB, + UE_STATIC_DECRYPTOR_ADD = UE::UE_STATIC_DECRYPTOR_ADD +}; + +enum eDecryptionDirection : DWORD +{ + UE_STATIC_DECRYPTOR_FOREWARD = UE::UE_STATIC_DECRYPTOR_FOREWARD, + UE_STATIC_DECRYPTOR_BACKWARD = UE::UE_STATIC_DECRYPTOR_BACKWARD +}; + +enum eDecryptionKeySize : DWORD +{ + UE_STATIC_KEY_SIZE_1 = UE::UE_STATIC_KEY_SIZE_1, + UE_STATIC_KEY_SIZE_2 = UE::UE_STATIC_KEY_SIZE_2, + UE_STATIC_KEY_SIZE_4 = UE::UE_STATIC_KEY_SIZE_4, + UE_STATIC_KEY_SIZE_8 = UE::UE_STATIC_KEY_SIZE_8 +}; + +enum eCompressionAlgorithm : int +{ + UE_STATIC_APLIB = UE::UE_STATIC_APLIB, + UE_STATIC_APLIB_DEPACK = UE::UE_STATIC_APLIB_DEPACK, + UE_STATIC_LZMA = UE::UE_STATIC_LZMA +}; + +enum eHashAlgorithm : int +{ + UE_STATIC_HASH_MD5 = UE::UE_STATIC_HASH_MD5, + UE_STATIC_HASH_SHA1 = UE::UE_STATIC_HASH_SHA1, + UE_STATIC_HASH_CRC32 = UE::UE_STATIC_HASH_CRC32 +}; + +const DWORD UE_RESOURCE_LANGUAGE_ANY = UE::UE_RESOURCE_LANGUAGE_ANY; + +enum ePE32Data : DWORD +{ + UE_PE_OFFSET = UE::UE_PE_OFFSET, + UE_IMAGEBASE = UE::UE_IMAGEBASE, + UE_OEP = UE::UE_OEP, + UE_SIZEOFIMAGE = UE::UE_SIZEOFIMAGE, + UE_SIZEOFHEADERS = UE::UE_SIZEOFHEADERS, + UE_SIZEOFOPTIONALHEADER = UE::UE_SIZEOFOPTIONALHEADER, + UE_SECTIONALIGNMENT = UE::UE_SECTIONALIGNMENT, + UE_IMPORTTABLEADDRESS = UE::UE_IMPORTTABLEADDRESS, + UE_IMPORTTABLESIZE = UE::UE_IMPORTTABLESIZE, + UE_RESOURCETABLEADDRESS = UE::UE_RESOURCETABLEADDRESS, + UE_RESOURCETABLESIZE = UE::UE_RESOURCETABLESIZE, + UE_EXPORTTABLEADDRESS = UE::UE_EXPORTTABLEADDRESS, + UE_EXPORTTABLESIZE = UE::UE_EXPORTTABLESIZE, + UE_TLSTABLEADDRESS = UE::UE_TLSTABLEADDRESS, + UE_TLSTABLESIZE = UE::UE_TLSTABLESIZE, + UE_RELOCATIONTABLEADDRESS = UE::UE_RELOCATIONTABLEADDRESS, + UE_RELOCATIONTABLESIZE = UE::UE_RELOCATIONTABLESIZE, + UE_TIMEDATESTAMP = UE::UE_TIMEDATESTAMP, + UE_SECTIONNUMBER = UE::UE_SECTIONNUMBER, + UE_CHECKSUM = UE::UE_CHECKSUM, + UE_SUBSYSTEM = UE::UE_SUBSYSTEM, + UE_CHARACTERISTICS = UE::UE_CHARACTERISTICS, + UE_NUMBEROFRVAANDSIZES = UE::UE_NUMBEROFRVAANDSIZES, + UE_SECTIONNAME = UE::UE_SECTIONNAME, + UE_SECTIONVIRTUALOFFSET = UE::UE_SECTIONVIRTUALOFFSET, + UE_SECTIONVIRTUALSIZE = UE::UE_SECTIONVIRTUALSIZE, + UE_SECTIONRAWOFFSET = UE::UE_SECTIONRAWOFFSET, + UE_SECTIONRAWSIZE = UE::UE_SECTIONRAWSIZE, + UE_SECTIONFLAGS = UE::UE_SECTIONFLAGS +}; + +const long UE_VANOTFOUND = UE::UE_VANOTFOUND; + +enum eCustomException : DWORD +{ + UE_CH_BREAKPOINT = UE::UE_CH_BREAKPOINT, + UE_CH_SINGLESTEP = UE::UE_CH_SINGLESTEP, + UE_CH_ACCESSVIOLATION = UE::UE_CH_ACCESSVIOLATION, + UE_CH_ILLEGALINSTRUCTION = UE::UE_CH_ILLEGALINSTRUCTION, + UE_CH_NONCONTINUABLEEXCEPTION = UE::UE_CH_NONCONTINUABLEEXCEPTION, + UE_CH_ARRAYBOUNDSEXCEPTION = UE::UE_CH_ARRAYBOUNDSEXCEPTION, + UE_CH_FLOATDENORMALOPERAND = UE::UE_CH_FLOATDENORMALOPERAND, + UE_CH_FLOATDEVIDEBYZERO = UE::UE_CH_FLOATDEVIDEBYZERO, + UE_CH_INTEGERDEVIDEBYZERO = UE::UE_CH_INTEGERDEVIDEBYZERO, + UE_CH_INTEGEROVERFLOW = UE::UE_CH_INTEGEROVERFLOW, + UE_CH_PRIVILEGEDINSTRUCTION = UE::UE_CH_PRIVILEGEDINSTRUCTION, + UE_CH_PAGEGUARD = UE::UE_CH_PAGEGUARD, + UE_CH_EVERYTHINGELSE = UE::UE_CH_EVERYTHINGELSE, + UE_CH_CREATETHREAD = UE::UE_CH_CREATETHREAD, + UE_CH_EXITTHREAD = UE::UE_CH_EXITTHREAD, + UE_CH_CREATEPROCESS = UE::UE_CH_CREATEPROCESS, + UE_CH_EXITPROCESS = UE::UE_CH_EXITPROCESS, + UE_CH_LOADDLL = UE::UE_CH_LOADDLL, + UE_CH_UNLOADDLL = UE::UE_CH_UNLOADDLL, + UE_CH_OUTPUTDEBUGSTRING = UE::UE_CH_OUTPUTDEBUGSTRING +}; + +enum eHandlerReturnType : DWORD +{ + UE_OPTION_HANDLER_RETURN_HANDLECOUNT = UE::UE_OPTION_HANDLER_RETURN_HANDLECOUNT, + UE_OPTION_HANDLER_RETURN_ACCESS = UE::UE_OPTION_HANDLER_RETURN_ACCESS, + UE_OPTION_HANDLER_RETURN_FLAGS = UE::UE_OPTION_HANDLER_RETURN_FLAGS, + UE_OPTION_HANDLER_RETURN_TYPENAME = UE::UE_OPTION_HANDLER_RETURN_TYPENAME +}; + +enum eBPState +{ + UE_BPXREMOVED = UE::UE_BPXREMOVED, + UE_BPXACTIVE = UE::UE_BPXACTIVE, + UE_BPXINACTIVE = UE::UE_BPXINACTIVE +}; + +enum eBPType +{ + UE_BREAKPOINT = UE::UE_BREAKPOINT, + UE_SINGLESHOOT = UE::UE_SINGLESHOOT, + //UE_HARDWARE = UE::UE_HARDWARE, +}; + +enum eMemoryBPType +{ + UE_MEMORY = UE::UE_MEMORY, + UE_MEMORY_READ = UE::UE_MEMORY_READ, + UE_MEMORY_WRITE = UE::UE_MEMORY_WRITE +}; + +enum eHWBPType : DWORD +{ + UE_HARDWARE_EXECUTE = UE::UE_HARDWARE_EXECUTE, + UE_HARDWARE_WRITE = UE::UE_HARDWARE_WRITE, + UE_HARDWARE_READWRITE = UE::UE_HARDWARE_READWRITE +}; + +enum eHWBPSize : DWORD +{ + UE_HARDWARE_SIZE_1 = UE::UE_HARDWARE_SIZE_1, + UE_HARDWARE_SIZE_2 = UE::UE_HARDWARE_SIZE_2, + UE_HARDWARE_SIZE_4 = UE::UE_HARDWARE_SIZE_4 +}; + +enum eLibraryEvent : DWORD +{ + UE_ON_LIB_LOAD = UE::UE_ON_LIB_LOAD, + UE_ON_LIB_UNLOAD = UE::UE_ON_LIB_UNLOAD, + UE_ON_LIB_ALL = UE::UE_ON_LIB_ALL +}; + +enum eBPPlace : DWORD +{ + UE_APISTART = UE::UE_APISTART, + UE_APIEND = UE::UE_APIEND +}; + +enum ePlatform : int +{ + UE_PLATFORM_x86 = UE::UE_PLATFORM_x86, + UE_PLATFORM_x64 = UE::UE_PLATFORM_x64, + UE_PLATFORM_ALL = UE::UE_PLATFORM_ALL +}; + +enum eFunctionType : DWORD +{ + UE_FUNCTION_STDCALL = UE::UE_FUNCTION_STDCALL, + UE_FUNCTION_CCALL = UE::UE_FUNCTION_CCALL, + UE_FUNCTION_FASTCALL = UE::UE_FUNCTION_FASTCALL, + UE_FUNCTION_STDCALL_RET = UE::UE_FUNCTION_STDCALL_RET, + UE_FUNCTION_CCALL_RET = UE::UE_FUNCTION_CCALL_RET, + UE_FUNCTION_FASTCALL_RET = UE::UE_FUNCTION_FASTCALL_RET, + UE_FUNCTION_STDCALL_CALL = UE::UE_FUNCTION_STDCALL_CALL, + UE_FUNCTION_CCALL_CALL = UE::UE_FUNCTION_CCALL_CALL, + UE_FUNCTION_FASTCALL_CALL = UE::UE_FUNCTION_FASTCALL_CALL +}; + +enum eParameterType : DWORD +{ + UE_PARAMETER_BYTE = UE::UE_PARAMETER_BYTE, + UE_PARAMETER_WORD = UE::UE_PARAMETER_WORD, + UE_PARAMETER_DWORD = UE::UE_PARAMETER_DWORD, + UE_PARAMETER_QWORD = UE::UE_PARAMETER_QWORD, + UE_PARAMETER_PTR_BYTE = UE::UE_PARAMETER_PTR_BYTE, + UE_PARAMETER_PTR_WORD = UE::UE_PARAMETER_PTR_WORD, + UE_PARAMETER_PTR_DWORD = UE::UE_PARAMETER_PTR_DWORD, + UE_PARAMETER_PTR_QWORD = UE::UE_PARAMETER_PTR_QWORD, + UE_PARAMETER_STRING = UE::UE_PARAMETER_STRING, + UE_PARAMETER_UNICODE = UE::UE_PARAMETER_UNICODE +}; + +enum eCompareCondition : DWORD +{ + UE_CMP_NOCONDITION = UE::UE_CMP_NOCONDITION, + UE_CMP_EQUAL = UE::UE_CMP_EQUAL, + UE_CMP_NOTEQUAL = UE::UE_CMP_NOTEQUAL, + UE_CMP_GREATER = UE::UE_CMP_GREATER, + UE_CMP_GREATEROREQUAL = UE::UE_CMP_GREATEROREQUAL, + UE_CMP_LOWER = UE::UE_CMP_LOWER, + UE_CMP_LOWEROREQUAL = UE::UE_CMP_LOWEROREQUAL, + UE_CMP_REG_EQUAL = UE::UE_CMP_REG_EQUAL, + UE_CMP_REG_NOTEQUAL = UE::UE_CMP_REG_NOTEQUAL, + UE_CMP_REG_GREATER = UE::UE_CMP_REG_GREATER, + UE_CMP_REG_GREATEROREQUAL = UE::UE_CMP_REG_GREATEROREQUAL, + UE_CMP_REG_LOWER = UE::UE_CMP_REG_LOWER, + UE_CMP_REG_LOWEROREQUAL = UE::UE_CMP_REG_LOWEROREQUAL, + UE_CMP_ALWAYSFALSE = UE::UE_CMP_ALWAYSFALSE +}; + +enum eContextData : DWORD +{ + UE_EAX = UE::UE_EAX, + UE_EBX = UE::UE_EBX, + UE_ECX = UE::UE_ECX, + UE_EDX = UE::UE_EDX, + UE_EDI = UE::UE_EDI, + UE_ESI = UE::UE_ESI, + UE_EBP = UE::UE_EBP, + UE_ESP = UE::UE_ESP, + UE_EIP = UE::UE_EIP, + UE_EFLAGS = UE::UE_EFLAGS, + UE_DR0 = UE::UE_DR0, + UE_DR1 = UE::UE_DR1, + UE_DR2 = UE::UE_DR2, + UE_DR3 = UE::UE_DR3, + UE_DR6 = UE::UE_DR6, + UE_DR7 = UE::UE_DR7, + UE_RAX = UE::UE_RAX, + UE_RBX = UE::UE_RBX, + UE_RCX = UE::UE_RCX, + UE_RDX = UE::UE_RDX, + UE_RDI = UE::UE_RDI, + UE_RSI = UE::UE_RSI, + UE_RBP = UE::UE_RBP, + UE_RSP = UE::UE_RSP, + UE_RIP = UE::UE_RIP, + UE_RFLAGS = UE::UE_RFLAGS, + UE_R8 = UE::UE_R8, + UE_R9 = UE::UE_R9, + UE_R10 = UE::UE_R10, + UE_R11 = UE::UE_R11, + UE_R12 = UE::UE_R12, + UE_R13 = UE::UE_R13, + UE_R14 = UE::UE_R14, + UE_R15 = UE::UE_R15, + UE_CIP = UE::UE_CIP, + UE_CSP = UE::UE_CSP +}; + +enum eCheckDepth : DWORD +{ + UE_DEPTH_SURFACE = UE::UE_DEPTH_SURFACE, + UE_DEPTH_DEEP = UE::UE_DEPTH_DEEP +}; + +enum eFieldState : BYTE +{ + UE_FIELD_OK = UE::UE_FIELD_OK, + UE_FIELD_BROKEN_NON_FIXABLE = UE::UE_FIELD_BROKEN_NON_FIXABLE, + UE_FIELD_BROKEN_NON_CRITICAL = UE::UE_FIELD_BROKEN_NON_CRITICAL, + UE_FIELD_BROKEN_FIXABLE_FOR_STATIC_USE = UE::UE_FIELD_BROKEN_FIXABLE_FOR_STATIC_USE, + UE_FIELD_BROKEN_BUT_CAN_BE_EMULATED = UE::UE_FIELD_BROKEN_BUT_CAN_BE_EMULATED, + UE_FILED_FIXABLE_NON_CRITICAL = UE::UE_FILED_FIXABLE_NON_CRITICAL, + UE_FILED_FIXABLE_CRITICAL = UE::UE_FILED_FIXABLE_CRITICAL, + UE_FIELD_NOT_PRESET = UE::UE_FIELD_NOT_PRESET, + UE_FIELD_NOT_PRESET_WARNING = UE::UE_FIELD_NOT_PRESET_WARNING +}; + +enum eFileState : BYTE +{ + UE_RESULT_FILE_OK = UE::UE_RESULT_FILE_OK, + UE_RESULT_FILE_INVALID_BUT_FIXABLE = UE::UE_RESULT_FILE_INVALID_BUT_FIXABLE, + UE_RESULT_FILE_INVALID_AND_NON_FIXABLE = UE::UE_RESULT_FILE_INVALID_AND_NON_FIXABLE, + UE_RESULT_FILE_INVALID_FORMAT = UE::UE_RESULT_FILE_INVALID_FORMAT +}; + +// ---- + +class DumperA; +class DumperW; + +class DumperX +{ + friend class DumperA; + friend class DumperW; + +protected: + + typedef UE::PEStruct PEStruct; + + static long long GetPE32DataFromMappedFile(ULONG_PTR FileMapVA, DWORD WhichSection, ePE32Data WhichData) + { + return UE::GetPE32DataFromMappedFile(FileMapVA, WhichSection, WhichData); + } + static bool GetPE32DataFromMappedFileEx(ULONG_PTR FileMapVA, PEStruct* DataStorage) + { + return UE::GetPE32DataFromMappedFileEx(FileMapVA, DataStorage); + } + static bool SetPE32DataForMappedFile(ULONG_PTR FileMapVA, DWORD WhichSection, ePE32Data WhichData, ULONG_PTR NewDataValue) + { + return UE::SetPE32DataForMappedFile(FileMapVA, WhichSection, WhichData, NewDataValue); + } + static bool SetPE32DataForMappedFileEx(ULONG_PTR FileMapVA, PEStruct* DataStorage) + { + return UE::SetPE32DataForMappedFileEx(FileMapVA, DataStorage); + } + static long GetPE32SectionNumberFromVA(ULONG_PTR FileMapVA, ULONG_PTR AddressToConvert) + { + return UE::GetPE32SectionNumberFromVA(FileMapVA, AddressToConvert); + } + static long long ConvertVAtoFileOffset(ULONG_PTR FileMapVA, ULONG_PTR AddressToConvert, bool ReturnType) + { + return UE::ConvertVAtoFileOffset(FileMapVA, AddressToConvert, ReturnType); + } + static long long ConvertVAtoFileOffsetEx(ULONG_PTR FileMapVA, DWORD FileSize, ULONG_PTR ImageBase, ULONG_PTR AddressToConvert, bool AddressIsRVA, bool ReturnType) + { + return UE::ConvertVAtoFileOffsetEx(FileMapVA, FileSize, ImageBase, AddressToConvert, AddressIsRVA, ReturnType); + } + static long long ConvertFileOffsetToVA(ULONG_PTR FileMapVA, ULONG_PTR AddressToConvert, bool ReturnType) + { + return UE::ConvertFileOffsetToVA(FileMapVA, AddressToConvert, ReturnType); + } + static long long ConvertFileOffsetToVAEx(ULONG_PTR FileMapVA, DWORD FileSize, ULONG_PTR ImageBase, ULONG_PTR AddressToConvert, bool ReturnType) + { + return UE::ConvertFileOffsetToVAEx(FileMapVA, FileSize, ImageBase, AddressToConvert, ReturnType); + } +}; + +class DumperA +{ +public: + + static bool DumpProcess(HANDLE hProcess, void* ImageBase, char* szDumpFileName, ULONG_PTR EntryPoint) + { + return UE::DumpProcess(hProcess, ImageBase, szDumpFileName, EntryPoint); + } + static bool DumpProcessEx(DWORD ProcessId, void* ImageBase, char* szDumpFileName, ULONG_PTR EntryPoint) + { + return UE::DumpProcessEx(ProcessId, ImageBase, szDumpFileName, EntryPoint); + } + static bool DumpMemory(HANDLE hProcess, void* MemoryStart, ULONG_PTR MemorySize, char* szDumpFileName) + { + return UE::DumpMemory(hProcess, MemoryStart, MemorySize, szDumpFileName); + } + static bool DumpMemoryEx(DWORD ProcessId, void* MemoryStart, ULONG_PTR MemorySize, char* szDumpFileName) + { + return UE::DumpMemoryEx(ProcessId, MemoryStart, MemorySize, szDumpFileName); + } + static bool DumpRegions(HANDLE hProcess, char* szDumpFolder, bool DumpAboveImageBaseOnly) + { + return UE::DumpRegions(hProcess, szDumpFolder, DumpAboveImageBaseOnly); + } + static bool DumpRegionsEx(DWORD ProcessId, char* szDumpFolder, bool DumpAboveImageBaseOnly) + { + return UE::DumpRegionsEx(ProcessId, szDumpFolder, DumpAboveImageBaseOnly); + } + static bool DumpModule(HANDLE hProcess, void* ModuleBase, char* szDumpFileName) + { + return UE::DumpModule(hProcess, ModuleBase, szDumpFileName); + } + static bool DumpModuleEx(DWORD ProcessId, void* ModuleBase, char* szDumpFileName) + { + return UE::DumpModuleEx(ProcessId, ModuleBase, szDumpFileName); + } + static bool PastePEHeader(HANDLE hProcess, void* ImageBase, char* szDebuggedFileName) + { + return UE::PastePEHeader(hProcess, ImageBase, szDebuggedFileName); + } + static bool ExtractSection(char* szFileName, char* szDumpFileName, DWORD SectionNumber) + { + return UE::ExtractSection(szFileName, szDumpFileName, SectionNumber); + } + static bool ResortFileSections(char* szFileName) + { + return UE::ResortFileSections(szFileName); + } + static bool FindOverlay(char* szFileName, DWORD* OverlayStart, DWORD* OverlaySize) + { + return UE::FindOverlay(szFileName, OverlayStart, OverlaySize); + } + static bool ExtractOverlay(char* szFileName, char* szExtractedFileName) + { + return UE::ExtractOverlay(szFileName, szExtractedFileName); + } + static bool AddOverlay(char* szFileName, char* szOverlayFileName) + { + return UE::AddOverlay(szFileName, szOverlayFileName); + } + static bool CopyOverlay(char* szInFileName, char* szOutFileName) + { + return UE::CopyOverlay(szInFileName, szOutFileName); + } + static bool RemoveOverlay(char* szFileName) + { + return UE::RemoveOverlay(szFileName); + } + static bool MakeAllSectionsRWE(char* szFileName) + { + return UE::MakeAllSectionsRWE(szFileName); + } + static long AddNewSectionEx(char* szFileName, char* szSectionName, DWORD SectionSize, DWORD SectionAttributes, void* SectionContent, DWORD ContentSize) + { + return UE::AddNewSectionEx(szFileName, szSectionName, SectionSize, SectionAttributes, SectionContent, ContentSize); + } + static long AddNewSection(char* szFileName, char* szSectionName, DWORD SectionSize) + { + return UE::AddNewSection(szFileName, szSectionName, SectionSize); + } + static bool ResizeLastSection(char* szFileName, DWORD NumberOfExpandBytes, bool AlignResizeData) + { + return UE::ResizeLastSection(szFileName, NumberOfExpandBytes, AlignResizeData); + } + static void SetSharedOverlay(char* szFileName) + { + return UE::SetSharedOverlay(szFileName); + } + static const char* GetSharedOverlay() + { + return UE::GetSharedOverlay(); + } + static bool DeleteLastSection(char* szFileName) + { + return UE::DeleteLastSection(szFileName); + } + static bool DeleteLastSectionEx(char* szFileName, DWORD NumberOfSections) + { + return UE::DeleteLastSectionEx(szFileName, NumberOfSections); + } + static long long GetPE32Data(char* szFileName, DWORD WhichSection, ePE32Data WhichData) + { + return UE::GetPE32Data(szFileName, WhichSection, WhichData); + } + static bool GetPE32DataEx(char* szFileName, DumperX::PEStruct* DataStorage) + { + return UE::GetPE32DataEx(szFileName, DataStorage); + } + static bool SetPE32Data(char* szFileName, DWORD WhichSection, ePE32Data WhichData, ULONG_PTR NewDataValue) + { + return UE::SetPE32Data(szFileName, WhichSection, WhichData, NewDataValue); + } + static bool SetPE32DataEx(char* szFileName, DumperX::PEStruct* DataStorage) + { + return UE::SetPE32DataEx(szFileName, DataStorage); + } +}; + +class DumperW +{ +public: + + static bool DumpProcess(HANDLE hProcess, void* ImageBase, wchar_t* szDumpFileName, ULONG_PTR EntryPoint) + { + return UE::DumpProcessW(hProcess, ImageBase, szDumpFileName, EntryPoint); + } + static bool DumpProcessEx(DWORD ProcessId, void* ImageBase, wchar_t* szDumpFileName, ULONG_PTR EntryPoint) + { + return UE::DumpProcessExW(ProcessId, ImageBase, szDumpFileName, EntryPoint); + } + static bool DumpMemory(HANDLE hProcess, void* MemoryStart, ULONG_PTR MemorySize, wchar_t* szDumpFileName) + { + return UE::DumpMemoryW(hProcess, MemoryStart, MemorySize, szDumpFileName); + } + static bool DumpMemoryEx(DWORD ProcessId, void* MemoryStart, ULONG_PTR MemorySize, wchar_t* szDumpFileName) + { + return UE::DumpMemoryExW(ProcessId, MemoryStart, MemorySize, szDumpFileName); + } + static bool DumpRegions(HANDLE hProcess, wchar_t* szDumpFolder, bool DumpAboveImageBaseOnly) + { + return UE::DumpRegionsW(hProcess, szDumpFolder, DumpAboveImageBaseOnly); + } + static bool DumpRegionsEx(DWORD ProcessId, wchar_t* szDumpFolder, bool DumpAboveImageBaseOnly) + { + return UE::DumpRegionsExW(ProcessId, szDumpFolder, DumpAboveImageBaseOnly); + } + static bool DumpModule(HANDLE hProcess, void* ModuleBase, wchar_t* szDumpFileName) + { + return UE::DumpModuleW(hProcess, ModuleBase, szDumpFileName); + } + static bool DumpModuleEx(DWORD ProcessId, void* ModuleBase, wchar_t* szDumpFileName) + { + return UE::DumpModuleExW(ProcessId, ModuleBase, szDumpFileName); + } + static bool PastePEHeader(HANDLE hProcess, void* ImageBase, wchar_t* szDebuggedFileName) + { + return UE::PastePEHeaderW(hProcess, ImageBase, szDebuggedFileName); + } + static bool ExtractSection(wchar_t* szFileName, wchar_t* szDumpFileName, DWORD SectionNumber) + { + return UE::ExtractSectionW(szFileName, szDumpFileName, SectionNumber); + } + static bool ResortFileSections(wchar_t* szFileName) + { + return UE::ResortFileSectionsW(szFileName); + } + static bool FindOverlay(wchar_t* szFileName, DWORD* OverlayStart, DWORD* OverlaySize) + { + return UE::FindOverlayW(szFileName, OverlayStart, OverlaySize); + } + static bool ExtractOverlay(wchar_t* szFileName, wchar_t* szExtractedFileName) + { + return UE::ExtractOverlayW(szFileName, szExtractedFileName); + } + static bool AddOverlay(wchar_t* szFileName, wchar_t* szOverlayFileName) + { + return UE::AddOverlayW(szFileName, szOverlayFileName); + } + static bool CopyOverlay(wchar_t* szInFileName, wchar_t* szOutFileName) + { + return UE::CopyOverlayW(szInFileName, szOutFileName); + } + static bool RemoveOverlay(wchar_t* szFileName) + { + return UE::RemoveOverlayW(szFileName); + } + static bool MakeAllSectionsRWE(wchar_t* szFileName) + { + return UE::MakeAllSectionsRWEW(szFileName); + } + static long AddNewSectionEx(wchar_t* szFileName, char* szSectionName, DWORD SectionSize, DWORD SectionAttributes, void* SectionContent, DWORD ContentSize) + { + return UE::AddNewSectionExW(szFileName, szSectionName, SectionSize, SectionAttributes, SectionContent, ContentSize); + } + static long AddNewSection(wchar_t* szFileName, char* szSectionName, DWORD SectionSize) + { + return UE::AddNewSectionW(szFileName, szSectionName, SectionSize); + } + static bool ResizeLastSection(wchar_t* szFileName, DWORD NumberOfExpandBytes, bool AlignResizeData) + { + return UE::ResizeLastSectionW(szFileName, NumberOfExpandBytes, AlignResizeData); + } + static void SetSharedOverlay(wchar_t* szFileName) + { + return UE::SetSharedOverlayW(szFileName); + } + static const wchar_t* GetSharedOverlay() + { + return UE::GetSharedOverlayW(); + } + static bool DeleteLastSection(wchar_t* szFileName) + { + return UE::DeleteLastSectionW(szFileName); + } + static bool DeleteLastSectionEx(wchar_t* szFileName, DWORD NumberOfSections) + { + return UE::DeleteLastSectionExW(szFileName, NumberOfSections); + } + static long long GetPE32Data(wchar_t* szFileName, DWORD WhichSection, ePE32Data WhichData) + { + return UE::GetPE32DataW(szFileName, WhichSection, WhichData); + } + static bool GetPE32DataEx(wchar_t* szFileName, DumperX::PEStruct* DataStorage) + { + return UE::GetPE32DataExW(szFileName, DataStorage); + } + static bool SetPE32Data(wchar_t* szFileName, DWORD WhichSection, ePE32Data WhichData, ULONG_PTR NewDataValue) + { + return UE::SetPE32DataW(szFileName, WhichSection, WhichData, NewDataValue); + } + static bool SetPE32DataEx(wchar_t* szFileName, DumperX::PEStruct* DataStorage) + { + return UE::SetPE32DataExW(szFileName, DataStorage); + } +}; + +class Dumper : DumperX, DumperA, DumperW +{ +public: + + using DumperX::PEStruct; + + using DumperA::DumpProcess; + using DumperW::DumpProcess; + using DumperA::DumpProcessEx; + using DumperW::DumpProcessEx; + using DumperA::DumpMemory; + using DumperW::DumpMemory; + using DumperA::DumpMemoryEx; + using DumperW::DumpMemoryEx; + using DumperA::DumpRegions; + using DumperW::DumpRegions; + using DumperA::DumpRegionsEx; + using DumperW::DumpRegionsEx; + using DumperA::DumpModule; + using DumperW::DumpModule; + using DumperA::DumpModuleEx; + using DumperW::DumpModuleEx; + using DumperA::PastePEHeader; + using DumperW::PastePEHeader; + using DumperA::ExtractSection; + using DumperW::ExtractSection; + using DumperA::ResortFileSections; + using DumperW::ResortFileSections; + using DumperA::FindOverlay; + using DumperW::FindOverlay; + using DumperA::ExtractOverlay; + using DumperW::ExtractOverlay; + using DumperA::AddOverlay; + using DumperW::AddOverlay; + using DumperA::CopyOverlay; + using DumperW::CopyOverlay; + using DumperA::RemoveOverlay; + using DumperW::RemoveOverlay; + using DumperA::MakeAllSectionsRWE; + using DumperW::MakeAllSectionsRWE; + using DumperA::AddNewSectionEx; + using DumperW::AddNewSectionEx; + using DumperA::AddNewSection; + using DumperW::AddNewSection; + using DumperA::ResizeLastSection; + using DumperW::ResizeLastSection; + using DumperA::SetSharedOverlay; + using DumperW::SetSharedOverlay; + #ifndef UNICODE + using DumperA::GetSharedOverlay; + #else + using DumperW::GetSharedOverlay; + #endif + using DumperA::DeleteLastSection; + using DumperW::DeleteLastSection; + using DumperA::DeleteLastSectionEx; + using DumperW::DeleteLastSectionEx; + using DumperX::GetPE32DataFromMappedFile; + using DumperA::GetPE32Data; + using DumperW::GetPE32Data; + using DumperX::GetPE32DataFromMappedFileEx; + using DumperA::GetPE32DataEx; + using DumperW::GetPE32DataEx; + using DumperX::SetPE32DataForMappedFile; + using DumperA::SetPE32Data; + using DumperW::SetPE32Data; + using DumperX::SetPE32DataForMappedFileEx; + using DumperA::SetPE32DataEx; + using DumperW::SetPE32DataEx; + using DumperX::GetPE32SectionNumberFromVA; + using DumperX::ConvertVAtoFileOffset; + using DumperX::ConvertVAtoFileOffsetEx; + using DumperX::ConvertFileOffsetToVA; + using DumperX::ConvertFileOffsetToVAEx; +}; + +class RealignerA; +class RealignerW; + +class RealignerX +{ + friend class RealignerA; + friend class RealignerW; + +protected: + + typedef UE::FILE_STATUS_INFO FILE_STATUS_INFO; + typedef UE::FILE_FIX_INFO FILE_FIX_INFO; + + static long RealignPE(ULONG_PTR FileMapVA, DWORD FileSize, DWORD RealingMode) + { + return UE::RealignPE(FileMapVA, FileSize, RealingMode); + } +}; + +class RealignerA +{ +public: + + static bool FixHeaderCheckSum(char* szFileName) + { + return UE::FixHeaderCheckSum(szFileName); + } + static long RealignPEEx(char* szFileName, DWORD RealingFileSize, DWORD ForcedFileAlignment) + { + return UE::RealignPEEx(szFileName, RealingFileSize, ForcedFileAlignment); + } + static bool WipeSection(char* szFileName, int WipeSectionNumber, bool RemovePhysically) + { + return UE::WipeSection(szFileName, WipeSectionNumber, RemovePhysically); + } + static bool IsPE32FileValidEx(char* szFileName, eCheckDepth CheckDepth, RealignerX::FILE_STATUS_INFO* FileStatusInfo) + { + return UE::IsPE32FileValidEx(szFileName, CheckDepth, FileStatusInfo); + } + static bool FixBrokenPE32FileEx(char* szFileName, RealignerX::FILE_STATUS_INFO* FileStatusInfo, RealignerX::FILE_FIX_INFO* FileFixInfo) + { + return UE::FixBrokenPE32FileEx(szFileName, FileStatusInfo, FileFixInfo); + } + static bool IsFileDLL(char* szFileName, ULONG_PTR FileMapVA) + { + return UE::IsFileDLL(szFileName, FileMapVA); + } +}; + +class RealignerW +{ +public: + + static bool FixHeaderCheckSum(wchar_t* szFileName) + { + return UE::FixHeaderCheckSumW(szFileName); + } + static long RealignPEEx(wchar_t* szFileName, DWORD RealingFileSize, DWORD ForcedFileAlignment) + { + return UE::RealignPEExW(szFileName, RealingFileSize, ForcedFileAlignment); + } + static bool WipeSection(wchar_t* szFileName, int WipeSectionNumber, bool RemovePhysically) + { + return UE::WipeSectionW(szFileName, WipeSectionNumber, RemovePhysically); + } + static bool IsPE32FileValidEx(wchar_t* szFileName, eCheckDepth CheckDepth, RealignerX::FILE_STATUS_INFO* FileStatusInfo) + { + return UE::IsPE32FileValidExW(szFileName, CheckDepth, FileStatusInfo); + } + static bool FixBrokenPE32FileEx(wchar_t* szFileName, RealignerX::FILE_STATUS_INFO* FileStatusInfo, RealignerX::FILE_FIX_INFO* FileFixInfo) + { + return UE::FixBrokenPE32FileExW(szFileName, FileStatusInfo, FileFixInfo); + } + static bool IsFileDLL(wchar_t* szFileName, ULONG_PTR FileMapVA) + { + return UE::IsFileDLLW(szFileName, FileMapVA); + } +}; + +class Realigner: RealignerX, RealignerA, RealignerW +{ +public: + + using RealignerX::FILE_STATUS_INFO; + using RealignerX::FILE_FIX_INFO; + + using RealignerA::FixHeaderCheckSum; + using RealignerW::FixHeaderCheckSum; + using RealignerX::RealignPE; + using RealignerA::RealignPEEx; + using RealignerW::RealignPEEx; + using RealignerA::WipeSection; + using RealignerW::WipeSection; + using RealignerA::IsPE32FileValidEx; + using RealignerW::IsPE32FileValidEx; + using RealignerA::FixBrokenPE32FileEx; + using RealignerW::FixBrokenPE32FileEx; + using RealignerA::IsFileDLL; + using RealignerW::IsFileDLL; +}; + +class Hider +{ +public: + + static void* GetPEBLocation(HANDLE hProcess) + { + return UE::GetPEBLocation(hProcess); + } + static bool HideDebugger(HANDLE hProcess, eHideLevel PatchAPILevel) + { + return UE::HideDebugger(hProcess, PatchAPILevel); + } + static bool UnHideDebugger(HANDLE hProcess, eHideLevel PatchAPILevel) + { + return UE::UnHideDebugger(hProcess, PatchAPILevel); + } +}; + +class RelocaterX +{ +protected: + + static void Cleanup() + { + UE::RelocaterCleanup(); + } + static void Init(DWORD MemorySize, ULONG_PTR OldImageBase, ULONG_PTR NewImageBase) + { + UE::RelocaterInit(MemorySize, OldImageBase, NewImageBase); + } + static void AddNewRelocation(HANDLE hProcess, ULONG_PTR RelocateAddress, DWORD RelocateState) + { + UE::RelocaterAddNewRelocation(hProcess, RelocateAddress, RelocateState); + } + static long EstimatedSize() + { + return UE::RelocaterEstimatedSize(); + } + static bool ExportRelocation(ULONG_PTR StorePlace, DWORD StorePlaceRVA, ULONG_PTR FileMapVA) + { + return UE::RelocaterExportRelocation(StorePlace, StorePlaceRVA, FileMapVA); + } + static bool GrabRelocationTable(HANDLE hProcess, ULONG_PTR MemoryStart, DWORD MemorySize) + { + return UE::RelocaterGrabRelocationTable(hProcess, MemoryStart, MemorySize); + } + static bool GrabRelocationTableEx(HANDLE hProcess, ULONG_PTR MemoryStart, ULONG_PTR MemorySize, DWORD NtSizeOfImage) + { + return UE::RelocaterGrabRelocationTableEx(hProcess, MemoryStart, MemorySize, NtSizeOfImage); + } + static bool RelocateMemoryBlock(ULONG_PTR FileMapVA, ULONG_PTR MemoryLocation, void* RelocateMemory, DWORD RelocateMemorySize, ULONG_PTR CurrentLoadedBase, ULONG_PTR RelocateBase) + { + return UE::RelocaterRelocateMemoryBlock(FileMapVA, MemoryLocation, RelocateMemory, RelocateMemorySize, CurrentLoadedBase, RelocateBase); + } +}; + +class RelocaterA +{ +public: + + static bool ExportRelocationEx(char* szFileName, char* szSectionName) + { + return UE::RelocaterExportRelocationEx(szFileName, szSectionName); + } + static bool MakeSnapshot(HANDLE hProcess, char* szSaveFileName, void* MemoryStart, ULONG_PTR MemorySize) + { + return UE::RelocaterMakeSnapshot(hProcess, szSaveFileName, MemoryStart, MemorySize); + } + static bool CompareTwoSnapshots(HANDLE hProcess, ULONG_PTR LoadedImageBase, ULONG_PTR NtSizeOfImage, char* szDumpFile1, char* szDumpFile2, ULONG_PTR MemStart) + { + return UE::RelocaterCompareTwoSnapshots(hProcess, LoadedImageBase, NtSizeOfImage, szDumpFile1, szDumpFile2, MemStart); + } + static bool ChangeFileBase(char* szFileName, ULONG_PTR NewImageBase) + { + return UE::RelocaterChangeFileBase(szFileName, NewImageBase); + } + static bool WipeRelocationTable(char* szFileName) + { + return UE::RelocaterWipeRelocationTable(szFileName); + } +}; + +class RelocaterW +{ +public: + + static bool ExportRelocationEx(wchar_t* szFileName, char* szSectionName) + { + return UE::RelocaterExportRelocationExW(szFileName, szSectionName); + } + static bool MakeSnapshot(HANDLE hProcess, wchar_t* szSaveFileName, void* MemoryStart, ULONG_PTR MemorySize) + { + return UE::RelocaterMakeSnapshotW(hProcess, szSaveFileName, MemoryStart, MemorySize); + } + static bool CompareTwoSnapshots(HANDLE hProcess, ULONG_PTR LoadedImageBase, ULONG_PTR NtSizeOfImage, wchar_t* szDumpFile1, wchar_t* szDumpFile2, ULONG_PTR MemStart) + { + return UE::RelocaterCompareTwoSnapshotsW(hProcess, LoadedImageBase, NtSizeOfImage, szDumpFile1, szDumpFile2, MemStart); + } + static bool ChangeFileBase(wchar_t* szFileName, ULONG_PTR NewImageBase) + { + return UE::RelocaterChangeFileBaseW(szFileName, NewImageBase); + } + static bool WipeRelocationTable(wchar_t* szFileName) + { + return UE::RelocaterWipeRelocationTableW(szFileName); + } +}; + +class Relocater : RelocaterX, RelocaterA, RelocaterW +{ +public: + + using RelocaterX::Cleanup; + using RelocaterX::Init; + using RelocaterX::AddNewRelocation; + using RelocaterX::EstimatedSize; + using RelocaterX::ExportRelocation; + using RelocaterA::ExportRelocationEx; + using RelocaterW::ExportRelocationEx; + using RelocaterX::GrabRelocationTable; + using RelocaterX::GrabRelocationTableEx; + using RelocaterA::MakeSnapshot; + using RelocaterW::MakeSnapshot; + using RelocaterA::CompareTwoSnapshots; + using RelocaterW::CompareTwoSnapshots; + using RelocaterA::ChangeFileBase; + using RelocaterW::ChangeFileBase; + using RelocaterX::RelocateMemoryBlock; + using RelocaterA::WipeRelocationTable; + using RelocaterW::WipeRelocationTable; +}; + +class ResourcerA; +class ResourcerW; + +class ResourcerX +{ + friend class ResourcerA; + friend class ResourcerW; + +protected: + + typedef void(__stdcall *fResourceEnumCallback)(const wchar_t* szResourceType, DWORD ResourceType, const wchar_t* szResourceName, DWORD ResourceName, DWORD ResourceLanguage, DWORD ResourceData, DWORD ResourceSize); + + static bool FreeLoadedFile(void* LoadedFileBase) + { + return UE::ResourcerFreeLoadedFile(LoadedFileBase); + } + static bool ExtractResourceFromFileEx(ULONG_PTR FileMapVA, char* szResourceType, char* szResourceName, char* szExtractedFileName) + { + return UE::ResourcerExtractResourceFromFileEx(FileMapVA, szResourceType, szResourceName, szExtractedFileName); + } + static bool FindResourceEx(ULONG_PTR FileMapVA, DWORD FileSize, wchar_t* szResourceType, DWORD ResourceType, wchar_t* szResourceName, DWORD ResourceName, DWORD ResourceLanguage, ULONG_PTR* pResourceData, DWORD* pResourceSize) + { + return UE::ResourcerFindResourceEx(FileMapVA, FileSize, szResourceType, ResourceType, szResourceName, ResourceName, ResourceLanguage, pResourceData, pResourceSize); + } + static void EnumerateResourceEx(ULONG_PTR FileMapVA, DWORD FileSize, fResourceEnumCallback CallBack) + { + UE::ResourcerEnumerateResourceEx(FileMapVA, FileSize, (void*)CallBack); + } +}; + +class ResourcerA +{ +public: + + static long long LoadFileForResourceUse(char* szFileName) + { + return UE::ResourcerLoadFileForResourceUse(szFileName); + } + static bool ExtractResourceFromFile(char* szFileName, char* szResourceType, char* szResourceName, char* szExtractedFileName) + { + return UE::ResourcerExtractResourceFromFile(szFileName, szResourceType, szResourceName, szExtractedFileName); + } + static bool FindResource(char* szFileName, char* szResourceType, DWORD ResourceType, char* szResourceName, DWORD ResourceName, DWORD ResourceLanguage, ULONG_PTR* pResourceData, DWORD* pResourceSize) + { + return UE::ResourcerFindResource(szFileName, szResourceType, ResourceType, szResourceName, ResourceName, ResourceLanguage, pResourceData, pResourceSize); + } + static void EnumerateResource(char* szFileName, ResourcerX::fResourceEnumCallback CallBack) + { + UE::ResourcerEnumerateResource(szFileName, (void*)CallBack); + } +}; + +class ResourcerW +{ +public: + + static long long LoadFileForResourceUse(wchar_t* szFileName) + { + return UE::ResourcerLoadFileForResourceUseW(szFileName); + } + static bool ExtractResourceFromFile(wchar_t* szFileName, char* szResourceType, char* szResourceName, char* szExtractedFileName) + { + return UE::ResourcerExtractResourceFromFileW(szFileName, szResourceType, szResourceName, szExtractedFileName); + } + static bool FindResource(wchar_t* szFileName, wchar_t* szResourceType, DWORD ResourceType, wchar_t* szResourceName, DWORD ResourceName, DWORD ResourceLanguage, ULONG_PTR* pResourceData, DWORD* pResourceSize) + { + return UE::ResourcerFindResourceW(szFileName, szResourceType, ResourceType, szResourceName, ResourceName, ResourceLanguage, pResourceData, pResourceSize); + } + static void EnumerateResource(wchar_t* szFileName, ResourcerX::fResourceEnumCallback CallBack) + { + UE::ResourcerEnumerateResourceW(szFileName, (void*)CallBack); + } +}; + +class Resourcer : ResourcerX, ResourcerA, ResourcerW +{ +public: + + using ResourcerX::fResourceEnumCallback; + + using ResourcerA::LoadFileForResourceUse; + using ResourcerW::LoadFileForResourceUse; + using ResourcerX::FreeLoadedFile; + using ResourcerX::ExtractResourceFromFileEx; + using ResourcerA::ExtractResourceFromFile; + using ResourcerW::ExtractResourceFromFile; + using ResourcerA::FindResource; + using ResourcerW::FindResource; + using ResourcerX::FindResourceEx; + using ResourcerA::EnumerateResource; + using ResourcerW::EnumerateResource; + using ResourcerX::EnumerateResourceEx; +}; + +class Threader +{ +public: + + typedef UE::THREAD_ITEM_DATA THREAD_ITEM_DATA; + + typedef void(__stdcall *fThreadEnumCallback)(const THREAD_ITEM_DATA* fThreadDetail); + typedef void(__stdcall *fThreadExitCallback)(const EXIT_THREAD_DEBUG_INFO* SpecialDBG); + + static bool ImportRunningThreadData(DWORD ProcessId) + { + return UE::ThreaderImportRunningThreadData(ProcessId); + } + static const THREAD_ITEM_DATA* GetThreadInfo(HANDLE hThread, DWORD ThreadId) + { + return (const THREAD_ITEM_DATA*)UE::ThreaderGetThreadInfo(hThread, ThreadId); + } + static void EnumThreadInfo(fThreadEnumCallback EnumCallBack) + { + UE::ThreaderEnumThreadInfo((void*)EnumCallBack); + } + static bool PauseThread(HANDLE hThread) + { + return UE::ThreaderPauseThread(hThread); + } + static bool ResumeThread(HANDLE hThread) + { + return UE::ThreaderResumeThread(hThread); + } + static bool TerminateThread(HANDLE hThread, DWORD ThreadExitCode) + { + return UE::ThreaderTerminateThread(hThread, ThreadExitCode); + } + static bool PauseAllThreads(bool LeaveMainRunning) + { + return UE::ThreaderPauseAllThreads(LeaveMainRunning); + } + static bool ResumeAllThreads(bool LeaveMainPaused) + { + return UE::ThreaderResumeAllThreads(LeaveMainPaused); + } + static bool PauseProcess() + { + return UE::ThreaderPauseProcess(); + } + static bool ResumeProcess() + { + return UE::ThreaderResumeProcess(); + } + static long long CreateRemoteThread(ULONG_PTR ThreadStartAddress, bool AutoCloseTheHandle, void* ThreadPassParameter, DWORD* ThreadId) + { + return UE::ThreaderCreateRemoteThread(ThreadStartAddress, AutoCloseTheHandle, ThreadPassParameter, ThreadId); + } + static bool InjectAndExecuteCode(void* InjectCode, DWORD StartDelta, DWORD InjectSize) + { + return UE::ThreaderInjectAndExecuteCode(InjectCode, StartDelta, InjectSize); + } + static long long CreateRemoteThreadEx(HANDLE hProcess, ULONG_PTR ThreadStartAddress, bool AutoCloseTheHandle, void* ThreadPassParameter, DWORD* ThreadId) + { + return UE::ThreaderCreateRemoteThreadEx(hProcess, ThreadStartAddress, AutoCloseTheHandle, ThreadPassParameter, ThreadId); + } + static bool InjectAndExecuteCodeEx(HANDLE hProcess, void* InjectCode, DWORD StartDelta, DWORD InjectSize) + { + return UE::ThreaderInjectAndExecuteCodeEx(hProcess, InjectCode, StartDelta, InjectSize); + } + static void SetCallBackForNextExitThreadEvent(fThreadExitCallback exitThreadCallBack) + { + UE::ThreaderSetCallBackForNextExitThreadEvent((void*)exitThreadCallBack); + } + static bool IsThreadStillRunning(HANDLE hThread) + { + return UE::ThreaderIsThreadStillRunning(hThread); + } + static bool IsThreadActive(HANDLE hThread) + { + return UE::ThreaderIsThreadActive(hThread); + } + static bool IsAnyThreadActive() + { + return UE::ThreaderIsAnyThreadActive(); + } + static bool ExecuteOnlyInjectedThreads() + { + return UE::ThreaderExecuteOnlyInjectedThreads(); + } + static long long GetOpenHandleForThread(DWORD ThreadId) + { + return UE::ThreaderGetOpenHandleForThread(ThreadId); + } + static const THREAD_ITEM_DATA* GetThreadData() + { + return (const THREAD_ITEM_DATA*)UE::ThreaderGetThreadData(); + } + static bool IsExceptionInMainThread() + { + return UE::ThreaderIsExceptionInMainThread(); + } +}; + +// -- + +class DebuggerA; +class DebuggerW; + +class DebuggerX +{ + friend class DebuggerA; + friend class DebuggerW; + +protected: + + typedef void(__stdcall *fBreakPointCallback)(); + typedef void(__stdcall *fCustomHandlerCallback)(void* ExceptionData); + + static const char* StaticDisassembleEx(ULONG_PTR DisassmStart, void* DisassmAddress) + { + return (const char*)UE::StaticDisassembleEx(DisassmStart, DisassmAddress); + } + static const char* StaticDisassemble(void* DisassmAddress) + { + return (const char*)UE::StaticDisassemble(DisassmAddress); + } + static const char* DisassembleEx(HANDLE hProcess, void* DisassmAddress, bool ReturnInstructionType) + { + return (const char*)UE::DisassembleEx(hProcess, DisassmAddress, ReturnInstructionType); + } + static const char* Disassemble(void* DisassmAddress) + { + return (const char*)UE::Disassemble(DisassmAddress); + } + static long StaticLengthDisassemble(void* DisassmAddress) + { + return UE::StaticLengthDisassemble(DisassmAddress); + } + static long LengthDisassembleEx(HANDLE hProcess, void* DisassmAddress) + { + return UE::LengthDisassembleEx(hProcess, DisassmAddress); + } + static long LengthDisassemble(void* DisassmAddress) + { + return UE::LengthDisassemble(DisassmAddress); + } + static bool StopDebug() + { + return UE::StopDebug(); + } + static void SetBPXOptions(long DefaultBreakPointType) + { + UE::SetBPXOptions(DefaultBreakPointType); + } + static bool IsBPXEnabled(ULONG_PTR bpxAddress) + { + return UE::IsBPXEnabled(bpxAddress); + } + static bool EnableBPX(ULONG_PTR bpxAddress) + { + return UE::EnableBPX(bpxAddress); + } + static bool DisableBPX(ULONG_PTR bpxAddress) + { + return UE::DisableBPX(bpxAddress); + } + static bool SetBPX(ULONG_PTR bpxAddress, eBPType bpxType, fBreakPointCallback bpxCallBack) + { + return UE::SetBPX(bpxAddress, bpxType, (void*)bpxCallBack); + } + static bool SetBPXEx(ULONG_PTR bpxAddress, eBPType bpxType, DWORD NumberOfExecution, eContextData CmpRegister, eCompareCondition CmpCondition, ULONG_PTR CmpValue, fBreakPointCallback bpxCallBack, fBreakPointCallback bpxCompareCallBack, fBreakPointCallback bpxRemoveCallBack) + { + return UE::SetBPXEx(bpxAddress, bpxType, NumberOfExecution, CmpRegister, CmpCondition, CmpValue, (void*)bpxCallBack, (void*)bpxCompareCallBack, (void*)bpxRemoveCallBack); + } + static bool DeleteBPX(ULONG_PTR bpxAddress) + { + return UE::DeleteBPX(bpxAddress); + } + static bool SafeDeleteBPX(ULONG_PTR bpxAddress) + { + return UE::SafeDeleteBPX(bpxAddress); + } + static bool SetAPIBreakPoint(char* szDLLName, char* szAPIName, eBPType bpxType, eBPPlace bpxPlace, fBreakPointCallback bpxCallBack) + { + return UE::SetAPIBreakPoint(szDLLName, szAPIName, bpxType, bpxPlace, (void*)bpxCallBack); + } + static bool DeleteAPIBreakPoint(char* szDLLName, char* szAPIName, eBPPlace bpxPlace) + { + return UE::DeleteAPIBreakPoint(szDLLName, szAPIName, bpxPlace); + } + static bool SafeDeleteAPIBreakPoint(char* szDLLName, char* szAPIName, eBPPlace bpxPlace) + { + return UE::SafeDeleteAPIBreakPoint(szDLLName, szAPIName, bpxPlace); + } + static bool SetMemoryBPX(ULONG_PTR MemoryStart, DWORD SizeOfMemory, fBreakPointCallback bpxCallBack) + { + return UE::SetMemoryBPX(MemoryStart, SizeOfMemory, (void*)bpxCallBack); + } + static bool SetMemoryBPXEx(ULONG_PTR MemoryStart, DWORD SizeOfMemory, eMemoryBPType BreakPointType, bool RestoreOnHit, fBreakPointCallback bpxCallBack) + { + return UE::SetMemoryBPXEx(MemoryStart, SizeOfMemory, BreakPointType, RestoreOnHit, (void*)bpxCallBack); + } + static bool RemoveMemoryBPX(ULONG_PTR MemoryStart, DWORD SizeOfMemory) + { + return UE::RemoveMemoryBPX(MemoryStart, SizeOfMemory); + } + static bool GetContextFPUDataEx(HANDLE hActiveThread, void* FPUSaveArea) + { + return UE::GetContextFPUDataEx(hActiveThread, FPUSaveArea); + } + static long long GetContextDataEx(HANDLE hActiveThread, eContextData IndexOfRegister) + { + return UE::GetContextDataEx(hActiveThread, IndexOfRegister); + } + static long long GetContextData(eContextData IndexOfRegister) + { + return UE::GetContextData(IndexOfRegister); + } + static bool SetContextFPUDataEx(HANDLE hActiveThread, void* FPUSaveArea) + { + return UE::SetContextFPUDataEx(hActiveThread, FPUSaveArea); + } + static bool SetContextDataEx(HANDLE hActiveThread, eContextData IndexOfRegister, ULONG_PTR NewRegisterValue) + { + return UE::SetContextDataEx(hActiveThread, IndexOfRegister, NewRegisterValue); + } + static bool SetContextData(eContextData IndexOfRegister, ULONG_PTR NewRegisterValue) + { + return UE::SetContextData(IndexOfRegister, NewRegisterValue); + } + static void ClearExceptionNumber() + { + UE::ClearExceptionNumber(); + } + static long CurrentExceptionNumber() + { + return UE::CurrentExceptionNumber(); + } + static bool MatchPatternEx(HANDLE hProcess, void* MemoryToCheck, int SizeOfMemoryToCheck, void* PatternToMatch, int SizeOfPatternToMatch, PBYTE WildCard) + { + return UE::MatchPatternEx(hProcess, MemoryToCheck, SizeOfMemoryToCheck, PatternToMatch, SizeOfPatternToMatch, WildCard); + } + static bool MatchPattern(void* MemoryToCheck, int SizeOfMemoryToCheck, void* PatternToMatch, int SizeOfPatternToMatch, PBYTE WildCard) + { + return UE::MatchPattern(MemoryToCheck, SizeOfMemoryToCheck, PatternToMatch, SizeOfPatternToMatch, WildCard); + } + static long long FindEx(HANDLE hProcess, void* MemoryStart, DWORD MemorySize, void* SearchPattern, DWORD PatternSize, BYTE* WildCard) + { + return UE::FindEx(hProcess, MemoryStart, MemorySize, SearchPattern, PatternSize, WildCard); + } + static long long Find(void* MemoryStart, DWORD MemorySize, void* SearchPattern, DWORD PatternSize, BYTE* WildCard) + { + return UE::Find(MemoryStart, MemorySize, SearchPattern, PatternSize, WildCard); + } + static bool FillEx(HANDLE hProcess, void* MemoryStart, DWORD MemorySize, BYTE* FillByte) + { + return UE::FillEx(hProcess, MemoryStart, MemorySize, FillByte); + } + static bool Fill(void* MemoryStart, DWORD MemorySize, BYTE* FillByte) + { + return UE::Fill(MemoryStart, MemorySize, FillByte); + } + static bool PatchEx(HANDLE hProcess, void* MemoryStart, DWORD MemorySize, void* ReplacePattern, DWORD ReplaceSize, bool AppendNOP, bool PrependNOP) + { + return UE::PatchEx(hProcess, MemoryStart, MemorySize, ReplacePattern, ReplaceSize, AppendNOP, PrependNOP); + } + static bool Patch(void* MemoryStart, DWORD MemorySize, void* ReplacePattern, DWORD ReplaceSize, bool AppendNOP, bool PrependNOP) + { + return UE::Patch(MemoryStart, MemorySize, ReplacePattern, ReplaceSize, AppendNOP, PrependNOP); + } + static bool ReplaceEx(HANDLE hProcess, void* MemoryStart, DWORD MemorySize, void* SearchPattern, DWORD PatternSize, DWORD NumberOfRepetitions, void* ReplacePattern, DWORD ReplaceSize, BYTE* WildCard) + { + return UE::ReplaceEx(hProcess, MemoryStart, MemorySize, SearchPattern, PatternSize, NumberOfRepetitions, ReplacePattern, ReplaceSize, WildCard); + } + static bool Replace(void* MemoryStart, DWORD MemorySize, void* SearchPattern, DWORD PatternSize, DWORD NumberOfRepetitions, void* ReplacePattern, DWORD ReplaceSize, BYTE* WildCard) + { + return UE::Replace(MemoryStart, MemorySize, SearchPattern, PatternSize, NumberOfRepetitions, ReplacePattern, ReplaceSize, WildCard); + } + static const DEBUG_EVENT* GetDebugData() + { + return (const DEBUG_EVENT*)UE::GetDebugData(); + } + static const DEBUG_EVENT* GetTerminationData() + { + return (const DEBUG_EVENT*)UE::GetTerminationData(); + } + static long GetExitCode() + { + return UE::GetExitCode(); + } + static long long GetDebuggedDLLBaseAddress() + { + return UE::GetDebuggedDLLBaseAddress(); + } + static long long GetDebuggedFileBaseAddress() + { + return UE::GetDebuggedFileBaseAddress(); + } + static bool GetRemoteString(HANDLE hProcess, void* StringAddress, void* StringStorage, int MaximumStringSize) + { + return UE::GetRemoteString(hProcess, StringAddress, StringStorage, MaximumStringSize); + } + static long long GetFunctionParameter(HANDLE hProcess, eFunctionType FunctionType, DWORD ParameterNumber, eParameterType ParameterType) + { + return UE::GetFunctionParameter(hProcess, FunctionType, ParameterNumber, ParameterType); + } + static long long GetJumpDestinationEx(HANDLE hProcess, ULONG_PTR InstructionAddress, bool JustJumps) + { + return UE::GetJumpDestinationEx(hProcess, InstructionAddress, JustJumps); + } + static long long GetJumpDestination(HANDLE hProcess, ULONG_PTR InstructionAddress) + { + return UE::GetJumpDestination(hProcess, InstructionAddress); + } + static bool IsJumpGoingToExecuteEx(HANDLE hProcess, HANDLE hThread, ULONG_PTR InstructionAddress, ULONG_PTR RegFlags) + { + return UE::IsJumpGoingToExecuteEx(hProcess, hThread, InstructionAddress, RegFlags); + } + static bool IsJumpGoingToExecute() + { + return UE::IsJumpGoingToExecute(); + } + static void SetCustomHandler(eCustomException ExceptionId, fCustomHandlerCallback CallBack) + { + UE::SetCustomHandler(ExceptionId, (void*)CallBack); + } + static void ForceClose() + { + UE::ForceClose(); + } + static void StepInto(fBreakPointCallback traceCallBack) + { + UE::StepInto((void*)traceCallBack); + } + static void StepOver(fBreakPointCallback traceCallBack) + { + UE::StepOver((void*)traceCallBack); + } + static void SingleStep(DWORD StepCount, fBreakPointCallback StepCallBack) + { + UE::SingleStep(StepCount, (void*)StepCallBack); + } + static bool GetUnusedHardwareBreakPointRegister(DWORD* RegisterIndex) + { + return UE::GetUnusedHardwareBreakPointRegister(RegisterIndex); + } + static bool SetHardwareBreakPointEx(HANDLE hActiveThread, ULONG_PTR bpxAddress, DWORD IndexOfRegister, eHWBPType bpxType, eHWBPSize bpxSize, fBreakPointCallback bpxCallBack, DWORD* IndexOfSelectedRegister) + { + return UE::SetHardwareBreakPointEx(hActiveThread, bpxAddress, IndexOfRegister, bpxType, bpxSize, (void*)bpxCallBack, IndexOfSelectedRegister); + } + static bool SetHardwareBreakPoint(ULONG_PTR bpxAddress, DWORD IndexOfRegister, eHWBPType bpxType, eHWBPSize bpxSize, fBreakPointCallback bpxCallBack) + { + return UE::SetHardwareBreakPoint(bpxAddress, IndexOfRegister, bpxType, bpxSize, (void*)bpxCallBack); + } + static bool DeleteHardwareBreakPoint(DWORD IndexOfRegister) + { + return UE::DeleteHardwareBreakPoint(IndexOfRegister); + } + static bool RemoveAllBreakPoints(eBPRemoveOption RemoveOption) + { + return UE::RemoveAllBreakPoints(RemoveOption); + } + static const PROCESS_INFORMATION* GetProcessInformation() + { + return (const PROCESS_INFORMATION*)UE::GetProcessInformation(); + } + static const STARTUPINFOW* GetStartupInformation() + { + return (const STARTUPINFOW*)UE::GetStartupInformation(); + } + static void DebugLoop() + { + UE::DebugLoop(); + } + static void SetDebugLoopTimeOut(DWORD TimeOut) + { + UE::SetDebugLoopTimeOut(TimeOut); + } + static void SetNextDbgContinueStatus(DWORD SetDbgCode) + { + UE::SetNextDbgContinueStatus(SetDbgCode); + } + static bool AttachDebugger(DWORD ProcessId, bool KillOnExit, PROCESS_INFORMATION* DebugInfo, fBreakPointCallback CallBack) + { + return UE::AttachDebugger(ProcessId, KillOnExit, DebugInfo, (void*)CallBack); + } + static bool DetachDebugger(DWORD ProcessId) + { + return UE::DetachDebugger(ProcessId); + } + static bool DetachDebuggerEx(DWORD ProcessId) + { + return UE::DetachDebuggerEx(ProcessId); + } + static void DebugLoopEx(DWORD TimeOut) + { + UE::DebugLoopEx(TimeOut); + } + static bool IsFileBeingDebugged() + { + return UE::IsFileBeingDebugged(); + } + static void SetErrorModel(bool DisplayErrorMessages) + { + return UE::SetErrorModel(DisplayErrorMessages); + } +}; + +class DebuggerA +{ +public: + + static const PROCESS_INFORMATION* InitDebug(char* szFileName, char* szCommandLine, char* szCurrentFolder) + { + return (const PROCESS_INFORMATION*)UE::InitDebug(szFileName, szCommandLine, szCurrentFolder); + } + static const PROCESS_INFORMATION* InitDebugEx(char* szFileName, char* szCommandLine, char* szCurrentFolder, DebuggerX::fBreakPointCallback EntryCallBack) + { + return (const PROCESS_INFORMATION*)UE::InitDebugEx(szFileName, szCommandLine, szCurrentFolder, (void*)EntryCallBack); + } + static const PROCESS_INFORMATION* InitDLLDebug(char* szFileName, bool ReserveModuleBase, char* szCommandLine, char* szCurrentFolder, DebuggerX::fBreakPointCallback EntryCallBack) + { + return (const PROCESS_INFORMATION*)UE::InitDLLDebug(szFileName, ReserveModuleBase, szCommandLine, szCurrentFolder, (void*)EntryCallBack); + } + static void AutoDebugEx(char* szFileName, bool ReserveModuleBase, char* szCommandLine, char* szCurrentFolder, DWORD TimeOut, DebuggerX::fBreakPointCallback EntryCallBack) + { + UE::AutoDebugEx(szFileName, ReserveModuleBase, szCommandLine, szCurrentFolder, TimeOut, (void*)EntryCallBack); + } +}; + +class DebuggerW +{ +public: + + static const PROCESS_INFORMATION* InitDebug(wchar_t* szFileName, wchar_t* szCommandLine, wchar_t* szCurrentFolder) + { + return (const PROCESS_INFORMATION*)UE::InitDebugW(szFileName, szCommandLine, szCurrentFolder); + } + static const PROCESS_INFORMATION* InitDebugEx(wchar_t* szFileName, wchar_t* szCommandLine, wchar_t* szCurrentFolder, DebuggerX::fBreakPointCallback EntryCallBack) + { + return (const PROCESS_INFORMATION*)UE::InitDebugExW(szFileName, szCommandLine, szCurrentFolder, (void*)EntryCallBack); + } + static const PROCESS_INFORMATION* InitDLLDebug(wchar_t* szFileName, bool ReserveModuleBase, wchar_t* szCommandLine, wchar_t* szCurrentFolder, DebuggerX::fBreakPointCallback EntryCallBack) + { + return (const PROCESS_INFORMATION*)UE::InitDLLDebugW(szFileName, ReserveModuleBase, szCommandLine, szCurrentFolder, (void*)EntryCallBack); + } + static void AutoDebugEx(wchar_t* szFileName, bool ReserveModuleBase, wchar_t* szCommandLine, wchar_t* szCurrentFolder, DWORD TimeOut, DebuggerX::fBreakPointCallback EntryCallBack) + { + UE::AutoDebugExW(szFileName, ReserveModuleBase, szCommandLine, szCurrentFolder, TimeOut, (void*)EntryCallBack); + } +}; + +class Debugger : DebuggerX, DebuggerA, DebuggerW +{ +public: + + using DebuggerX::fBreakPointCallback; + using DebuggerX::fCustomHandlerCallback; + + using DebuggerX::StaticDisassembleEx; + using DebuggerX::StaticDisassemble; + using DebuggerX::DisassembleEx; + using DebuggerX::Disassemble; + using DebuggerX::StaticLengthDisassemble; + using DebuggerX::LengthDisassembleEx; + using DebuggerX::LengthDisassemble; + using DebuggerA::InitDebug; + using DebuggerW::InitDebug; + using DebuggerA::InitDebugEx; + using DebuggerW::InitDebugEx; + using DebuggerA::InitDLLDebug; + using DebuggerW::InitDLLDebug; + using DebuggerX::StopDebug; + using DebuggerX::SetBPXOptions; + using DebuggerX::IsBPXEnabled; + using DebuggerX::EnableBPX; + using DebuggerX::DisableBPX; + using DebuggerX::SetBPX; + using DebuggerX::SetBPXEx; + using DebuggerX::DeleteBPX; + using DebuggerX::SafeDeleteBPX; + using DebuggerX::SetAPIBreakPoint; + using DebuggerX::DeleteAPIBreakPoint; + using DebuggerX::SafeDeleteAPIBreakPoint; + using DebuggerX::SetMemoryBPX; + using DebuggerX::SetMemoryBPXEx; + using DebuggerX::RemoveMemoryBPX; + using DebuggerX::GetContextFPUDataEx; + using DebuggerX::GetContextDataEx; + using DebuggerX::GetContextData; + using DebuggerX::SetContextFPUDataEx; + using DebuggerX::SetContextDataEx; + using DebuggerX::SetContextData; + using DebuggerX::ClearExceptionNumber; + using DebuggerX::CurrentExceptionNumber; + using DebuggerX::MatchPatternEx; + using DebuggerX::MatchPattern; + using DebuggerX::FindEx; + using DebuggerX::Find; + using DebuggerX::FillEx; + using DebuggerX::Fill; + using DebuggerX::PatchEx; + using DebuggerX::Patch; + using DebuggerX::ReplaceEx; + using DebuggerX::Replace; + using DebuggerX::GetDebugData; + using DebuggerX::GetTerminationData; + using DebuggerX::GetExitCode; + using DebuggerX::GetDebuggedDLLBaseAddress; + using DebuggerX::GetDebuggedFileBaseAddress; + using DebuggerX::GetRemoteString; + using DebuggerX::GetFunctionParameter; + using DebuggerX::GetJumpDestinationEx; + using DebuggerX::GetJumpDestination; + using DebuggerX::IsJumpGoingToExecuteEx; + using DebuggerX::IsJumpGoingToExecute; + using DebuggerX::SetCustomHandler; + using DebuggerX::ForceClose; + using DebuggerX::StepInto; + using DebuggerX::StepOver; + using DebuggerX::SingleStep; + using DebuggerX::GetUnusedHardwareBreakPointRegister; + using DebuggerX::SetHardwareBreakPointEx; + using DebuggerX::SetHardwareBreakPoint; + using DebuggerX::DeleteHardwareBreakPoint; + using DebuggerX::RemoveAllBreakPoints; + using DebuggerX::GetProcessInformation; + using DebuggerX::GetStartupInformation; + using DebuggerX::DebugLoop; + using DebuggerX::SetDebugLoopTimeOut; + using DebuggerX::SetNextDbgContinueStatus; + using DebuggerX::AttachDebugger; + using DebuggerX::DetachDebugger; + using DebuggerX::DetachDebuggerEx; + using DebuggerX::DebugLoopEx; + using DebuggerA::AutoDebugEx; + using DebuggerW::AutoDebugEx; + using DebuggerX::IsFileBeingDebugged; + using DebuggerX::SetErrorModel; +}; + +class FindOEPX +{ +protected: + + static void Init() + { + return UE::FindOEPInit(); + } +}; + +class FindOEPA +{ +public: + + static bool Generically(char* szFileName, Debugger::fBreakPointCallback TraceInitCallBack, Debugger::fBreakPointCallback CallBack) + { + return UE::FindOEPGenerically(szFileName, (void*)TraceInitCallBack, (void*)CallBack); + } +}; + +class FindOEPW +{ +public: + + static bool Generically(wchar_t* szFileName, Debugger::fBreakPointCallback TraceInitCallBack, Debugger::fBreakPointCallback CallBack) + { + return UE::FindOEPGenericallyW(szFileName, (void*)TraceInitCallBack, (void*)CallBack); + } +}; + +class FindOEP : FindOEPX, FindOEPA, FindOEPW +{ +public: + + using FindOEPX::Init; + using FindOEPA::Generically; + using FindOEPW::Generically; +}; + +class ImporterA; +class ImporterW; + +class ImporterX +{ + friend class ImporterA; + friend class ImporterW; + +protected: + + typedef UE::ImportEnumData ImportEnumData; + + typedef void(__stdcall *fImportEnumCallBack)(const ImportEnumData* ptrImportEnumData); + typedef void*(__stdcall *fImportFixCallback)(void* fIATPointer); + + static void Cleanup() + { + UE::ImporterCleanup(); + } + static void SetImageBase(ULONG_PTR ImageBase) + { + UE::ImporterSetImageBase(ImageBase); + } + static void SetUnknownDelta(ULONG_PTR DeltaAddress) + { + UE::ImporterSetUnknownDelta(DeltaAddress); + } + static long long GetCurrentDelta() + { + return UE::ImporterGetCurrentDelta(); + } + static void Init(DWORD MemorySize, ULONG_PTR ImageBase) + { + UE::ImporterInit(MemorySize, ImageBase); + } + static void AddNewDll(char* szDLLName, ULONG_PTR FirstThunk) + { + UE::ImporterAddNewDll(szDLLName, FirstThunk); + } + static void AddNewAPI(char* szAPIName, ULONG_PTR ThunkValue) + { + UE::ImporterAddNewAPI(szAPIName, ThunkValue); + } + static void AddNewOrdinalAPI(ULONG_PTR OrdinalNumber, ULONG_PTR ThunkValue) + { + UE::ImporterAddNewOrdinalAPI(OrdinalNumber, ThunkValue); + } + static long GetAddedDllCount() + { + return UE::ImporterGetAddedDllCount(); + } + static long GetAddedAPICount() + { + return UE::ImporterGetAddedAPICount(); + } + static const char* GetLastAddedDLLName() + { + return (const char*)UE::ImporterGetLastAddedDLLName(); + } + static void MoveIAT() + { + UE::ImporterMoveIAT(); + } + static bool ExportIAT(ULONG_PTR StorePlace, ULONG_PTR FileMapVA) + { + return UE::ImporterExportIAT(StorePlace, FileMapVA); + } + static long EstimatedSize() + { + return UE::ImporterEstimatedSize(); + } + static long long FindAPIWriteLocation(char* szAPIName) + { + return UE::ImporterFindAPIWriteLocation(szAPIName); + } + static long long FindOrdinalAPIWriteLocation(ULONG_PTR OrdinalNumber) + { + return UE::ImporterFindOrdinalAPIWriteLocation(OrdinalNumber); + } + static long long FindAPIByWriteLocation(ULONG_PTR APIWriteLocation) + { + return UE::ImporterFindAPIByWriteLocation(APIWriteLocation); + } + static long long FindDLLByWriteLocation(ULONG_PTR APIWriteLocation) + { + return UE::ImporterFindDLLByWriteLocation(APIWriteLocation); + } + static const char* GetDLLName(ULONG_PTR APIAddress) + { + return (const char*)UE::ImporterGetDLLName(APIAddress); + } + static const char* GetAPIName(ULONG_PTR APIAddress) + { + return (const char*)UE::ImporterGetAPIName(APIAddress); + } + static long long GetAPIOrdinalNumber(ULONG_PTR APIAddress) + { + return UE::ImporterGetAPIOrdinalNumber(APIAddress); + } + static const char* GetAPINameEx(ULONG_PTR APIAddress, HMODULE* DLLBasesList) + { + return (const char*)UE::ImporterGetAPINameEx(APIAddress, (ULONG_PTR)DLLBasesList); + } + static long long GetRemoteAPIAddress(HANDLE hProcess, ULONG_PTR APIAddress) + { + return UE::ImporterGetRemoteAPIAddress(hProcess, APIAddress); + } + static long long GetRemoteAPIAddressEx(char* szDLLName, char* szAPIName) + { + return UE::ImporterGetRemoteAPIAddressEx(szDLLName, szAPIName); + } + static long long GetLocalAPIAddress(HANDLE hProcess, ULONG_PTR APIAddress) + { + return UE::ImporterGetLocalAPIAddress(hProcess, APIAddress); + } + static const char* GetDLLNameFromDebugee(HANDLE hProcess, ULONG_PTR APIAddress) + { + return (const char*)UE::ImporterGetDLLNameFromDebugee(hProcess, APIAddress); + } + static const char* GetAPINameFromDebugee(HANDLE hProcess, ULONG_PTR APIAddress) + { + return (const char*)UE::ImporterGetAPINameFromDebugee(hProcess, APIAddress); + } + static long long GetAPIOrdinalNumberFromDebugee(HANDLE hProcess, ULONG_PTR APIAddress) + { + return UE::ImporterGetAPIOrdinalNumberFromDebugee(hProcess, APIAddress); + } + static long GetDLLIndexEx(ULONG_PTR APIAddress, HMODULE* DLLBasesList) + { + return UE::ImporterGetDLLIndexEx(APIAddress, (ULONG_PTR)DLLBasesList); + } + static long GetDLLIndex(HANDLE hProcess, ULONG_PTR APIAddress, HMODULE* DLLBasesList) + { + return UE::ImporterGetDLLIndex(hProcess, APIAddress, (ULONG_PTR)DLLBasesList); + } + static long long GetRemoteDLLBase(HANDLE hProcess, HMODULE LocalModuleBase) + { + return UE::ImporterGetRemoteDLLBase(hProcess, LocalModuleBase); + } + static bool RelocateWriteLocation(ULONG_PTR AddValue) + { + return UE::ImporterRelocateWriteLocation(AddValue); + } + static bool IsForwardedAPI(HANDLE hProcess, ULONG_PTR APIAddress) + { + return UE::ImporterIsForwardedAPI(hProcess, APIAddress); + } + static const char* GetForwardedAPIName(HANDLE hProcess, ULONG_PTR APIAddress) + { + return (const char*)UE::ImporterGetForwardedAPIName(hProcess, APIAddress); + } + static const char* GetForwardedDLLName(HANDLE hProcess, ULONG_PTR APIAddress) + { + return (const char*)UE::ImporterGetForwardedDLLName(hProcess, APIAddress); + } + static long GetForwardedDLLIndex(HANDLE hProcess, ULONG_PTR APIAddress, HMODULE* DLLBasesList) + { + return UE::ImporterGetForwardedDLLIndex(hProcess, APIAddress, (ULONG_PTR)DLLBasesList); + } + static long long GetForwardedAPIOrdinalNumber(HANDLE hProcess, ULONG_PTR APIAddress) + { + return UE::ImporterGetForwardedAPIOrdinalNumber(hProcess, APIAddress); + } + static long long GetNearestAPIAddress(HANDLE hProcess, ULONG_PTR APIAddress) + { + return UE::ImporterGetNearestAPIAddress(hProcess, APIAddress); + } + static const char* GetNearestAPIName(HANDLE hProcess, ULONG_PTR APIAddress) + { + return (const char*)UE::ImporterGetNearestAPIName(hProcess, APIAddress); + } + static void AutoSearchIATEx(HANDLE hProcess, ULONG_PTR ImageBase, ULONG_PTR SearchStart, DWORD SearchSize, ULONG_PTR* pIATStart, ULONG_PTR* pIATSize) + { + UE::ImporterAutoSearchIATEx(hProcess, ImageBase, SearchStart, SearchSize, pIATStart, pIATSize); + } + static void EnumAddedData(fImportEnumCallBack EnumCallBack) + { + UE::ImporterEnumAddedData((void*)EnumCallBack); + } +}; + +class ImporterA +{ +public: + + static bool ExportIATEx(char* szExportFileName, char* szSectionName) + { + return UE::ImporterExportIATEx(szExportFileName, szSectionName); + } + static bool CopyOriginalIAT(char* szOriginalFile, char* szDumpFile) + { + return UE::ImporterCopyOriginalIAT(szOriginalFile, szDumpFile); + } + static bool LoadImportTable(char* szFileName) + { + return UE::ImporterLoadImportTable(szFileName); + } + static bool MoveOriginalIAT(char* szOriginalFile, char* szDumpFile, char* szSectionName) + { + return UE::ImporterMoveOriginalIAT(szOriginalFile, szDumpFile, szSectionName); + } + static void AutoSearchIAT(HANDLE hProcess, char* szFileName, ULONG_PTR ImageBase, ULONG_PTR SearchStart, DWORD SearchSize, ULONG_PTR* pIATStart, ULONG_PTR* pIATSize) + { + UE::ImporterAutoSearchIAT(hProcess, szFileName, ImageBase, SearchStart, SearchSize, pIATStart, pIATSize); + } + static long AutoFixIATEx(HANDLE hProcess, char* szDumpedFile, char* szSectionName, bool DumpRunningProcess, bool RealignFile, ULONG_PTR EntryPointAddress, ULONG_PTR ImageBase, ULONG_PTR SearchStart, DWORD SearchSize, DWORD SearchStep, bool TryAutoFix, bool FixEliminations, ImporterX::fImportFixCallback UnknownPointerFixCallback) + { + return UE::ImporterAutoFixIATEx(hProcess, szDumpedFile, szSectionName, DumpRunningProcess, RealignFile, EntryPointAddress, ImageBase, SearchStart, SearchSize, SearchStep, TryAutoFix, FixEliminations, (void*)UnknownPointerFixCallback); + } + static long AutoFixIAT(HANDLE hProcess, char* szDumpedFile, ULONG_PTR ImageBase, ULONG_PTR SearchStart, DWORD SearchSize, DWORD SearchStep) + { + return UE::ImporterAutoFixIAT(hProcess, szDumpedFile, ImageBase, SearchStart, SearchSize, SearchStep); + } +}; + +class ImporterW +{ +public: + + static bool ExportIATEx(wchar_t* szExportFileName, char* szSectionName) + { + return UE::ImporterExportIATExW(szExportFileName, szSectionName); + } + static bool CopyOriginalIAT(wchar_t* szOriginalFile, wchar_t* szDumpFile) + { + return UE::ImporterCopyOriginalIATW(szOriginalFile, szDumpFile); + } + static bool LoadImportTable(wchar_t* szFileName) + { + return UE::ImporterLoadImportTableW(szFileName); + } + static bool MoveOriginalIAT(wchar_t* szOriginalFile, wchar_t* szDumpFile, char* szSectionName) + { + return UE::ImporterMoveOriginalIATW(szOriginalFile, szDumpFile, szSectionName); + } + static void AutoSearchIAT(HANDLE hProcess, wchar_t* szFileName, ULONG_PTR ImageBase, ULONG_PTR SearchStart, DWORD SearchSize, ULONG_PTR* pIATStart, ULONG_PTR* pIATSize) + { + UE::ImporterAutoSearchIATW(hProcess, szFileName, ImageBase, SearchStart, SearchSize, pIATStart, pIATSize); + } + static long AutoFixIATEx(HANDLE hProcess, wchar_t* szDumpedFile, char* szSectionName, bool DumpRunningProcess, bool RealignFile, ULONG_PTR EntryPointAddress, ULONG_PTR ImageBase, ULONG_PTR SearchStart, DWORD SearchSize, DWORD SearchStep, bool TryAutoFix, bool FixEliminations, ImporterX::fImportFixCallback UnknownPointerFixCallback) + { + return UE::ImporterAutoFixIATExW(hProcess, szDumpedFile, szSectionName, DumpRunningProcess, RealignFile, EntryPointAddress, ImageBase, SearchStart, SearchSize, SearchStep, TryAutoFix, FixEliminations, (void*)UnknownPointerFixCallback); + } + static long AutoFixIAT(HANDLE hProcess, wchar_t* szDumpedFile, ULONG_PTR ImageBase, ULONG_PTR SearchStart, DWORD SearchSize, DWORD SearchStep) + { + return UE::ImporterAutoFixIATW(hProcess, szDumpedFile, ImageBase, SearchStart, SearchSize, SearchStep); + } +}; + +class Importer : ImporterX, ImporterA, ImporterW +{ +public: + + using ImporterX::fImportEnumCallBack; + using ImporterX::fImportFixCallback; + + using ImporterX::Cleanup; + using ImporterX::SetImageBase; + using ImporterX::SetUnknownDelta; + using ImporterX::GetCurrentDelta; + using ImporterX::Init; + using ImporterX::AddNewDll; + using ImporterX::AddNewAPI; + using ImporterX::AddNewOrdinalAPI; + using ImporterX::GetAddedDllCount; + using ImporterX::GetAddedAPICount; + using ImporterX::GetLastAddedDLLName; + using ImporterX::MoveIAT; + using ImporterX::ExportIAT; + using ImporterX::EstimatedSize; + using ImporterA::ExportIATEx; + using ImporterW::ExportIATEx; + using ImporterX::FindAPIWriteLocation; + using ImporterX::FindOrdinalAPIWriteLocation; + using ImporterX::FindAPIByWriteLocation; + using ImporterX::FindDLLByWriteLocation; + using ImporterX::GetDLLName; + using ImporterX::GetAPIName; + using ImporterX::GetAPIOrdinalNumber; + using ImporterX::GetAPINameEx; + using ImporterX::GetRemoteAPIAddress; + using ImporterX::GetRemoteAPIAddressEx; + using ImporterX::GetLocalAPIAddress; + using ImporterX::GetDLLNameFromDebugee; + using ImporterX::GetAPINameFromDebugee; + using ImporterX::GetAPIOrdinalNumberFromDebugee; + using ImporterX::GetDLLIndexEx; + using ImporterX::GetDLLIndex; + using ImporterX::GetRemoteDLLBase; + using ImporterX::RelocateWriteLocation; + using ImporterX::IsForwardedAPI; + using ImporterX::GetForwardedAPIName; + using ImporterX::GetForwardedDLLName; + using ImporterX::GetForwardedDLLIndex; + using ImporterX::GetForwardedAPIOrdinalNumber; + using ImporterX::GetNearestAPIAddress; + using ImporterX::GetNearestAPIName; + using ImporterA::CopyOriginalIAT; + using ImporterW::CopyOriginalIAT; + using ImporterA::LoadImportTable; + using ImporterW::LoadImportTable; + using ImporterA::MoveOriginalIAT; + using ImporterW::MoveOriginalIAT; + using ImporterA::AutoSearchIAT; + using ImporterW::AutoSearchIAT; + using ImporterX::AutoSearchIATEx; + using ImporterX::EnumAddedData; + using ImporterA::AutoFixIATEx; + using ImporterW::AutoFixIATEx; + using ImporterA::AutoFixIAT; + using ImporterW::AutoFixIAT; +}; + +// --- + +class LibrarianX +{ +protected: + + typedef void(__stdcall *fLibraryBreakPointCallback)(const LOAD_DLL_DEBUG_INFO* SpecialDBG); + + static bool SetBreakPoint(char* szLibraryName, eLibraryEvent bpxType, bool SingleShoot, fLibraryBreakPointCallback bpxCallBack) + { + return UE::LibrarianSetBreakPoint(szLibraryName, bpxType, SingleShoot, (void*)bpxCallBack); + } + static bool RemoveBreakPoint(char* szLibraryName, eLibraryEvent bpxType) + { + return UE::LibrarianRemoveBreakPoint(szLibraryName, bpxType); + } +}; + +class LibrarianA +{ +public: + + typedef UE::LIBRARY_ITEM_DATA LIBRARY_ITEM_DATA; + + typedef void(__stdcall *fLibraryEnumCallback)(const LIBRARY_ITEM_DATA* fLibraryDetail); + + static const LIBRARY_ITEM_DATA* GetLibraryInfo(char* szLibraryName) + { + return (const LIBRARY_ITEM_DATA*)UE::LibrarianGetLibraryInfo(szLibraryName); + } + static const LIBRARY_ITEM_DATA* GetLibraryInfoEx(void* BaseOfDll) + { + return (const LIBRARY_ITEM_DATA*)UE::LibrarianGetLibraryInfoEx(BaseOfDll); + } + static void EnumLibraryInfo(fLibraryEnumCallback EnumCallBack) + { + UE::LibrarianEnumLibraryInfo((void*)EnumCallBack); + } +}; + +class LibrarianW +{ +public: + + typedef UE::LIBRARY_ITEM_DATAW LIBRARY_ITEM_DATA; + + typedef void(__stdcall *fLibraryEnumCallback)(const LIBRARY_ITEM_DATA* fLibraryDetail); + + static const LIBRARY_ITEM_DATA* GetLibraryInfo(wchar_t* szLibraryName) + { + return (const LIBRARY_ITEM_DATA*)UE::LibrarianGetLibraryInfoW(szLibraryName); + } + static const LIBRARY_ITEM_DATA* GetLibraryInfoEx(void* BaseOfDll) + { + return (const LIBRARY_ITEM_DATA*)UE::LibrarianGetLibraryInfoExW(BaseOfDll); + } + static void EnumLibraryInfo(fLibraryEnumCallback EnumCallBack) + { + UE::LibrarianEnumLibraryInfoW((void*)EnumCallBack); + } +}; + +class Librarian : LibrarianX, LibrarianA, LibrarianW +{ +public: + + #ifndef UNICODE + typedef LibrarianA::LIBRARY_ITEM_DATA LIBRARY_ITEM_DATA; + #else + typedef LibrarianW::LIBRARY_ITEM_DATA LIBRARY_ITEM_DATA; + #endif + + using LibrarianX::fLibraryBreakPointCallback; + #ifndef UNICODE + typedef LibrarianA::fLibraryEnumCallback fLibraryEnumCallback; + #else + typedef LibrarianW::fLibraryEnumCallback fLibraryEnumCallback; + #endif + + using LibrarianX::SetBreakPoint; + using LibrarianX::RemoveBreakPoint; + using LibrarianA::GetLibraryInfo; + using LibrarianW::GetLibraryInfo; + #ifndef UNICODE + using LibrarianA::GetLibraryInfoEx; + #else + using LibrarianW::GetLibraryInfoEx; + #endif + using LibrarianA::EnumLibraryInfo; + using LibrarianW::EnumLibraryInfo; +}; + +class Hooks +{ +public: + + typedef UE::HOOK_ENTRY HOOK_ENTRY; + + typedef bool(__stdcall *fHookEnumCallBack)(const HOOK_ENTRY* HookDetails, void* ptrOriginalInstructions, const LibrarianA::LIBRARY_ITEM_DATA* ModuleInformation, DWORD SizeOfImage); + + static bool SafeTransitionEx(void** HookAddressArray, int NumberOfHooks, bool TransitionStart) + { + return UE::HooksSafeTransitionEx(HookAddressArray, NumberOfHooks, TransitionStart); + } + static bool SafeTransition(void* HookAddress, bool TransitionStart) + { + return UE::HooksSafeTransition(HookAddress, TransitionStart); + } + static bool IsAddressRedirected(void* HookAddress) + { + return UE::HooksIsAddressRedirected(HookAddress); + } + static void* GetTrampolineAddress(void* HookAddress) + { + return UE::HooksGetTrampolineAddress(HookAddress); + } + static HOOK_ENTRY* GetHookEntryDetails(void* HookAddress) + { + return (HOOK_ENTRY*)UE::HooksGetHookEntryDetails(HookAddress); + } + static bool InsertNewRedirection(void* HookAddress, void* RedirectTo, eHookType HookType) + { + return UE::HooksInsertNewRedirection(HookAddress, RedirectTo, HookType); + } + static bool InsertNewIATRedirectionEx(ULONG_PTR FileMapVA, ULONG_PTR LoadedModuleBase, char* szHookFunction, void* RedirectTo) + { + return UE::HooksInsertNewIATRedirectionEx(FileMapVA, LoadedModuleBase, szHookFunction, RedirectTo); + } + static bool InsertNewIATRedirection(char* szModuleName, char* szHookFunction, void* RedirectTo) + { + return UE::HooksInsertNewIATRedirection(szModuleName, szHookFunction, RedirectTo); + } + static bool RemoveRedirection(void* HookAddress, bool RemoveAll) + { + return UE::HooksRemoveRedirection(HookAddress, RemoveAll); + } + static bool RemoveRedirectionsForModule(HMODULE ModuleBase) + { + return UE::HooksRemoveRedirectionsForModule(ModuleBase); + } + static bool RemoveIATRedirection(char* szModuleName, char* szHookFunction, bool RemoveAll) + { + return UE::HooksRemoveIATRedirection(szModuleName, szHookFunction, RemoveAll); + } + static bool DisableRedirection(void* HookAddress, bool DisableAll) + { + return UE::HooksDisableRedirection(HookAddress, DisableAll); + } + static bool DisableRedirectionsForModule(HMODULE ModuleBase) + { + return UE::HooksDisableRedirectionsForModule(ModuleBase); + } + static bool DisableIATRedirection(char* szModuleName, char* szHookFunction, bool DisableAll) + { + return UE::HooksDisableIATRedirection(szModuleName, szHookFunction, DisableAll); + } + static bool EnableRedirection(void* HookAddress, bool EnableAll) + { + return UE::HooksEnableRedirection(HookAddress, EnableAll); + } + static bool EnableRedirectionsForModule(HMODULE ModuleBase) + { + return UE::HooksEnableRedirectionsForModule(ModuleBase); + } + static bool EnableIATRedirection(char* szModuleName, char* szHookFunction, bool EnableAll) + { + return UE::HooksEnableIATRedirection(szModuleName, szHookFunction, EnableAll); + } + static void ScanModuleMemory(HMODULE ModuleBase, fHookEnumCallBack CallBack) + { + UE::HooksScanModuleMemory(ModuleBase, (void*)CallBack); + } + static void ScanEntireProcessMemory(fHookEnumCallBack CallBack) + { + UE::HooksScanEntireProcessMemory((void*)CallBack); + } + static void ScanEntireProcessMemoryEx() + { + UE::HooksScanEntireProcessMemoryEx(); + } +}; + +class Tracer +{ +public: + + static void Init() + { + UE::TracerInit(); + } + static long long Level1(HANDLE hProcess, ULONG_PTR AddressToTrace) + { + return UE::TracerLevel1(hProcess, AddressToTrace); + } + static long long HashTracerLevel1(HANDLE hProcess, ULONG_PTR AddressToTrace, DWORD InputNumberOfInstructions) + { + return UE::HashTracerLevel1(hProcess, AddressToTrace, InputNumberOfInstructions); + } + static long DetectRedirection(HANDLE hProcess, ULONG_PTR AddressToTrace) + { + return UE::TracerDetectRedirection(hProcess, AddressToTrace); + } + static long long FixKnownRedirection(HANDLE hProcess, ULONG_PTR AddressToTrace, DWORD RedirectionId) + { + return UE::TracerFixKnownRedirection(hProcess, AddressToTrace, RedirectionId); + } + static long long FixRedirectionViaModule(HMODULE hModuleHandle, HANDLE hProcess, ULONG_PTR AddressToTrace, DWORD IdParameter) + { + return UE::TracerFixRedirectionViaModule(hModuleHandle, hProcess, AddressToTrace, IdParameter); + } + static long long DetectRedirectionViaModule(HMODULE hModuleHandle, HANDLE hProcess, ULONG_PTR AddressToTrace, DWORD* ReturnedId) + { + return UE::TracerDetectRedirectionViaModule(hModuleHandle, hProcess, AddressToTrace, ReturnedId); + } + static long FixRedirectionViaImpRecPlugin(HANDLE hProcess, char* szPluginName, ULONG_PTR AddressToTrace) + { + return UE::TracerFixRedirectionViaImpRecPlugin(hProcess, szPluginName, AddressToTrace); + } +}; + +class ExporterX +{ +protected: + + static void Cleanup() + { + UE::ExporterCleanup(); + } + static void SetImageBase(ULONG_PTR ImageBase) + { + UE::ExporterSetImageBase(ImageBase); + } + static void Init(DWORD MemorySize, ULONG_PTR ImageBase, DWORD ExportOrdinalBase, char* szExportModuleName) + { + UE::ExporterInit(MemorySize, ImageBase, ExportOrdinalBase, szExportModuleName); + } + static bool AddNewExport(char* szExportName, DWORD ExportRelativeAddress) + { + return UE::ExporterAddNewExport(szExportName, ExportRelativeAddress); + } + static bool AddNewOrdinalExport(DWORD OrdinalNumber, DWORD ExportRelativeAddress) + { + return UE::ExporterAddNewOrdinalExport(OrdinalNumber, ExportRelativeAddress); + } + static long GetAddedExportCount() + { + return UE::ExporterGetAddedExportCount(); + } + static long EstimatedSize() + { + return UE::ExporterEstimatedSize(); + } + static bool BuildExportTable(ULONG_PTR StorePlace, ULONG_PTR FileMapVA) + { + return UE::ExporterBuildExportTable(StorePlace, FileMapVA); + } +}; + +class ExporterA +{ +public: + + static bool BuildExportTableEx(char* szExportFileName, char* szSectionName) + { + return UE::ExporterBuildExportTableEx(szExportFileName, szSectionName); + } + static bool LoadExportTable(char* szFileName) + { + return UE::ExporterLoadExportTable(szFileName); + } +}; + +class ExporterW +{ +public: + + static bool BuildExportTableEx(wchar_t* szExportFileName, char* szSectionName) + { + return UE::ExporterBuildExportTableExW(szExportFileName, szSectionName); + } + static bool LoadExportTable(wchar_t* szFileName) + { + return UE::ExporterLoadExportTableW(szFileName); + } +}; + +class Exporter : ExporterX, ExporterA, ExporterW +{ +public: + + using ExporterX::Cleanup; + using ExporterX::SetImageBase; + using ExporterX::Init; + using ExporterX::AddNewExport; + using ExporterX::AddNewOrdinalExport; + using ExporterX::GetAddedExportCount; + using ExporterX::EstimatedSize; + using ExporterX::BuildExportTable; + using ExporterA::BuildExportTableEx; + using ExporterW::BuildExportTableEx; + using ExporterA::LoadExportTable; + using ExporterW::LoadExportTable; +}; + +class ProcessX +{ +protected: + + typedef void(__stdcall *fProcessWithLibraryEnumCallback)(DWORD ProcessId, HMODULE ModuleBaseAddress); + + static void EnumProcessesWithLibrary(char* szLibraryName, fProcessWithLibraryEnumCallback EnumFunction) + { + UE::EnumProcessesWithLibrary(szLibraryName, (void*)EnumFunction); + } +}; + +class ProcessA +{ +public: + + static long GetActiveProcessId(char* szImageName) + { + return UE::GetActiveProcessId(szImageName); + } +}; + +class ProcessW +{ +public: + + static long GetActiveProcessId(wchar_t* szImageName) + { + return UE::GetActiveProcessIdW(szImageName); + } +}; + +class Process : ProcessX, ProcessA, ProcessW +{ +public: + + using ProcessX::fProcessWithLibraryEnumCallback; + + using ProcessA::GetActiveProcessId; + using ProcessW::GetActiveProcessId; + using ProcessX::EnumProcessesWithLibrary; +}; + +class TLSX +{ +protected: + + static bool BreakOnCallBack(ULONG_PTR* ArrayOfCallBacks, DWORD NumberOfCallBacks, Debugger::fBreakPointCallback bpxCallBack) + { + return UE::TLSBreakOnCallBack(ArrayOfCallBacks, NumberOfCallBacks, (void*)bpxCallBack); + } + static bool RestoreData() + { + return UE::TLSRestoreData(); + } + static bool BuildNewTable(ULONG_PTR FileMapVA, ULONG_PTR StorePlace, ULONG_PTR StorePlaceRVA, ULONG_PTR* ArrayOfCallBacks, DWORD NumberOfCallBacks) + { + return UE::TLSBuildNewTable(FileMapVA, StorePlace, StorePlaceRVA, ArrayOfCallBacks, NumberOfCallBacks); + } +}; + +class TLSA +{ +public: + + static bool GrabCallBackData(char* szFileName, ULONG_PTR* ArrayOfCallBacks, DWORD* NumberOfCallBacks) + { + return UE::TLSGrabCallBackData(szFileName, ArrayOfCallBacks, NumberOfCallBacks); + } + static bool BreakOnCallBackEx(char* szFileName, Debugger::fBreakPointCallback bpxCallBack) + { + return UE::TLSBreakOnCallBackEx(szFileName, (void*)bpxCallBack); + } + static bool RemoveCallback(char* szFileName) + { + return UE::TLSRemoveCallback(szFileName); + } + static bool RemoveTable(char* szFileName) + { + return UE::TLSRemoveTable(szFileName); + } + static bool BackupData(char* szFileName) + { + return UE::TLSBackupData(szFileName); + } + static bool BuildNewTableEx(char* szFileName, char* szSectionName, ULONG_PTR* ArrayOfCallBacks, DWORD NumberOfCallBacks) + { + return UE::TLSBuildNewTableEx(szFileName, szSectionName, ArrayOfCallBacks, NumberOfCallBacks); + } +}; + +class TLSW +{ +public: + + static bool GrabCallBackData(wchar_t* szFileName, ULONG_PTR* ArrayOfCallBacks, DWORD* NumberOfCallBacks) + { + return UE::TLSGrabCallBackDataW(szFileName, ArrayOfCallBacks, NumberOfCallBacks); + } + static bool BreakOnCallBackEx(wchar_t* szFileName, Debugger::fBreakPointCallback bpxCallBack) + { + return UE::TLSBreakOnCallBackExW(szFileName, (void*)bpxCallBack); + } + static bool RemoveCallback(wchar_t* szFileName) + { + return UE::TLSRemoveCallbackW(szFileName); + } + static bool RemoveTable(wchar_t* szFileName) + { + return UE::TLSRemoveTableW(szFileName); + } + static bool BackupData(wchar_t* szFileName) + { + return UE::TLSBackupDataW(szFileName); + } + static bool BuildNewTableEx(wchar_t* szFileName, char* szSectionName, ULONG_PTR* ArrayOfCallBacks, DWORD NumberOfCallBacks) + { + return UE::TLSBuildNewTableExW(szFileName, szSectionName, ArrayOfCallBacks, NumberOfCallBacks); + } +}; + +class TLS : TLSX, TLSA, TLSW +{ +public: + + using TLSX::BreakOnCallBack; + using TLSA::GrabCallBackData; + using TLSW::GrabCallBackData; + using TLSA::BreakOnCallBackEx; + using TLSW::BreakOnCallBackEx; + using TLSA::RemoveCallback; + using TLSW::RemoveCallback; + using TLSA::RemoveTable; + using TLSW::RemoveTable; + using TLSA::BackupData; + using TLSW::BackupData; + using TLSX::RestoreData; + using TLSX::BuildNewTable; + using TLSA::BuildNewTableEx; + using TLSW::BuildNewTableEx; +}; + +class TranslateA +{ +public: + + static const char* NativeName(char* szNativeName) + { + return (const char*)UE::TranslateNativeName(szNativeName); + } +}; + +class TranslateW +{ +public: + + static const wchar_t* NativeName(wchar_t* szNativeName) + { + return (const wchar_t*)UE::TranslateNativeNameW(szNativeName); + } +}; + +class Translate : TranslateA, TranslateW +{ +public: + + using TranslateA::NativeName; + using TranslateW::NativeName; +}; + +class HandlerA; +class HandlerW; + +class HandlerX +{ + friend class HandlerA; + friend class HandlerW; + +protected: + + typedef UE::HandlerArray HandlerArray; + + static long GetActiveHandleCount(DWORD ProcessId) + { + return UE::HandlerGetActiveHandleCount(ProcessId); + } + static bool IsHandleOpen(DWORD ProcessId, HANDLE hHandle) + { + return UE::HandlerIsHandleOpen(ProcessId, hHandle); + } + static long EnumerateOpenHandles(DWORD ProcessId, HandlerArray* HandleBuffer, DWORD MaxHandleCount) + { + return UE::HandlerEnumerateOpenHandles(ProcessId, HandleBuffer, MaxHandleCount); + } + static long long GetHandleDetails(HANDLE hProcess, DWORD ProcessId, HANDLE hHandle, eHandlerReturnType InformationReturn) + { + return UE::HandlerGetHandleDetails(hProcess, ProcessId, hHandle, InformationReturn); + } + static bool CloseRemoteHandle(HANDLE hProcess, HANDLE hHandle) + { + return UE::HandlerCloseRemoteHandle(hProcess, hHandle); + } + static long EnumerateOpenMutexes(HANDLE hProcess, DWORD ProcessId, HANDLE* HandleBuffer, DWORD MaxHandleCount) + { + return UE::HandlerEnumerateOpenMutexes(hProcess, ProcessId, HandleBuffer, MaxHandleCount); + } +}; + +class HandlerA +{ +public: + + static const char* GetHandleName(HANDLE hProcess, DWORD ProcessId, HANDLE hHandle, bool TranslateName) + { + return (const char*)UE::HandlerGetHandleName(hProcess, ProcessId, hHandle, TranslateName); + } + static long EnumerateLockHandles(char* szFileOrFolderName, bool NameIsFolder, bool NameIsTranslated, HandlerX::HandlerArray* HandleDataBuffer, DWORD MaxHandleCount) + { + return UE::HandlerEnumerateLockHandles(szFileOrFolderName, NameIsFolder, NameIsTranslated, HandleDataBuffer, MaxHandleCount); + } + static bool CloseAllLockHandles(char* szFileOrFolderName, bool NameIsFolder, bool NameIsTranslated) + { + return UE::HandlerCloseAllLockHandles(szFileOrFolderName, NameIsFolder, NameIsTranslated); + } + static bool IsFileLocked(char* szFileOrFolderName, bool NameIsFolder, bool NameIsTranslated) + { + return UE::HandlerIsFileLocked(szFileOrFolderName, NameIsFolder, NameIsTranslated); + } + static long long GetOpenMutexHandle(HANDLE hProcess, DWORD ProcessId, char* szMutexString) + { + return UE::HandlerGetOpenMutexHandle(hProcess, ProcessId, szMutexString); + } + static long GetProcessIdWhichCreatedMutex(char* szMutexString) + { + return UE::HandlerGetProcessIdWhichCreatedMutex(szMutexString); + } +}; + +class HandlerW +{ +public: + + static const wchar_t* GetHandleName(HANDLE hProcess, DWORD ProcessId, HANDLE hHandle, bool TranslateName) + { + return (const wchar_t*)UE::HandlerGetHandleNameW(hProcess, ProcessId, hHandle, TranslateName); + } + static long EnumerateLockHandles(wchar_t* szFileOrFolderName, bool NameIsFolder, bool NameIsTranslated, HandlerX::HandlerArray* HandleDataBuffer, DWORD MaxHandleCount) + { + return UE::HandlerEnumerateLockHandlesW(szFileOrFolderName, NameIsFolder, NameIsTranslated, HandleDataBuffer, MaxHandleCount); + } + static bool CloseAllLockHandles(wchar_t* szFileOrFolderName, bool NameIsFolder, bool NameIsTranslated) + { + return UE::HandlerCloseAllLockHandlesW(szFileOrFolderName, NameIsFolder, NameIsTranslated); + } + static bool IsFileLocked(wchar_t* szFileOrFolderName, bool NameIsFolder, bool NameIsTranslated) + { + return UE::HandlerIsFileLockedW(szFileOrFolderName, NameIsFolder, NameIsTranslated); + } + static long long GetOpenMutexHandle(HANDLE hProcess, DWORD ProcessId, wchar_t* szMutexString) + { + return UE::HandlerGetOpenMutexHandleW(hProcess, ProcessId, szMutexString); + } + static long GetProcessIdWhichCreatedMutex(wchar_t* szMutexString) + { + return UE::HandlerGetProcessIdWhichCreatedMutexW(szMutexString); + } +}; + +class Handler : HandlerX, HandlerA, HandlerW +{ +public: + + using HandlerX::HandlerArray; + + using HandlerX::GetActiveHandleCount; + using HandlerX::IsHandleOpen; + #ifndef UNICODE + using HandlerA::GetHandleName; + #else + using HandlerW::GetHandleName; + #endif + using HandlerX::EnumerateOpenHandles; + using HandlerX::GetHandleDetails; + using HandlerX::CloseRemoteHandle; + using HandlerA::EnumerateLockHandles; + using HandlerW::EnumerateLockHandles; + using HandlerA::CloseAllLockHandles; + using HandlerW::CloseAllLockHandles; + using HandlerA::IsFileLocked; + using HandlerW::IsFileLocked; + using HandlerX::EnumerateOpenMutexes; + using HandlerA::GetOpenMutexHandle; + using HandlerW::GetOpenMutexHandle; + using HandlerA::GetProcessIdWhichCreatedMutex; + using HandlerW::GetProcessIdWhichCreatedMutex; +}; + +class RemoteX +{ +protected: + + static bool ExitProcess(HANDLE hProcess, DWORD ExitCode) + { + return UE::RemoteExitProcess(hProcess, ExitCode); + } +}; + +class RemoteA +{ +public: + + static bool LoadLibrary(HANDLE hProcess, char* szLibraryFile, bool WaitForThreadExit) + { + return UE::RemoteLoadLibrary(hProcess, szLibraryFile, WaitForThreadExit); + } + static bool FreeLibrary(HANDLE hProcess, HMODULE hModule, char* szLibraryFile, bool WaitForThreadExit) + { + return UE::RemoteFreeLibrary(hProcess, hModule, szLibraryFile, WaitForThreadExit); + } +}; + +class RemoteW +{ +public: + + static bool LoadLibrary(HANDLE hProcess, wchar_t* szLibraryFile, bool WaitForThreadExit) + { + return UE::RemoteLoadLibraryW(hProcess, szLibraryFile, WaitForThreadExit); + } + static bool FreeLibrary(HANDLE hProcess, HMODULE hModule, wchar_t* szLibraryFile, bool WaitForThreadExit) + { + return UE::RemoteFreeLibraryW(hProcess, hModule, szLibraryFile, WaitForThreadExit); + } +}; + +class Remote : RemoteX, RemoteA, RemoteW +{ +public: + + using RemoteA::LoadLibrary; + using RemoteW::LoadLibrary; + using RemoteA::FreeLibrary; + using RemoteW::FreeLibrary; + using RemoteX::ExitProcess; +}; + +class StaticX +{ +protected: + + typedef bool(__stdcall *fStaticDecryptCallback)(void* sMemoryStart, int sKeySize); + + static bool FileGetContent(HANDLE FileHandle, DWORD FilePositionLow, LPDWORD FilePositionHigh, void* Buffer, DWORD Size) + { + return UE::StaticFileGetContent(FileHandle, FilePositionLow, FilePositionHigh, Buffer, Size); + } + static void FileClose(HANDLE FileHandle) + { + return UE::StaticFileClose(FileHandle); + } + static void MemoryDecrypt(void* MemoryStart, DWORD MemorySize, eDecryptionType DecryptionType, eDecryptionKeySize DecryptionKeySize, ULONG_PTR DecryptionKey) + { + UE::StaticMemoryDecrypt(MemoryStart, MemorySize, DecryptionType, DecryptionKeySize, DecryptionKey); + } + static void MemoryDecryptEx(void* MemoryStart, DWORD MemorySize, eDecryptionKeySize DecryptionKeySize, fStaticDecryptCallback DecryptionCallBack) + { + UE::StaticMemoryDecryptEx(MemoryStart, MemorySize, DecryptionKeySize, (void*)DecryptionCallBack); + } + static void MemoryDecryptSpecial(void* MemoryStart, DWORD MemorySize, eDecryptionKeySize DecryptionKeySize, eDecryptionDirection SpecDecryptionType, fStaticDecryptCallback DecryptionCallBack) + { + UE::StaticMemoryDecryptSpecial(MemoryStart, MemorySize, DecryptionKeySize, SpecDecryptionType, (void*)DecryptionCallBack); + } + static void SectionDecrypt(ULONG_PTR FileMapVA, DWORD SectionNumber, bool SimulateLoad, eDecryptionType DecryptionType, eDecryptionKeySize DecryptionKeySize, ULONG_PTR DecryptionKey) + { + UE::StaticSectionDecrypt(FileMapVA, SectionNumber, SimulateLoad, DecryptionType, DecryptionKeySize, DecryptionKey); + } + static bool MemoryDecompress(void* Source, DWORD SourceSize, void* Destination, DWORD DestinationSize, eCompressionAlgorithm Algorithm) + { + return UE::StaticMemoryDecompress(Source, SourceSize, Destination, DestinationSize, Algorithm); + } + static bool HashMemory(void* MemoryToHash, DWORD SizeOfMemory, void* HashDigest, bool OutputString, eHashAlgorithm Algorithm) + { + return UE::StaticHashMemory(MemoryToHash, SizeOfMemory, HashDigest, OutputString, Algorithm); + } +}; + +class StaticA +{ +public: + + static bool FileLoad(char* szFileName, eAccess DesiredAccess, bool SimulateLoad, HANDLE* FileHandle, DWORD* LoadedSize, HANDLE* FileMap, ULONG_PTR* FileMapVA) + { + return UE::StaticFileLoad(szFileName, DesiredAccess, SimulateLoad, FileHandle, LoadedSize, FileMap, FileMapVA); + } + static bool FileUnload(char* szFileName, bool CommitChanges, HANDLE FileHandle, DWORD LoadedSize, HANDLE FileMap, ULONG_PTR FileMapVA) + { + return UE::StaticFileUnload(szFileName, CommitChanges, FileHandle, LoadedSize, FileMap, FileMapVA); + } + static bool FileOpen(char* szFileName, DWORD DesiredAccess, LPHANDLE FileHandle, LPDWORD FileSizeLow, LPDWORD FileSizeHigh) + { + return UE::StaticFileOpen(szFileName, DesiredAccess, FileHandle, FileSizeLow, FileSizeHigh); + } + static bool RawMemoryCopy(HANDLE hFile, ULONG_PTR FileMapVA, ULONG_PTR VitualAddressToCopy, DWORD Size, bool AddressIsRVA, char* szDumpFileName) + { + return UE::StaticRawMemoryCopy(hFile, FileMapVA, VitualAddressToCopy, Size, AddressIsRVA, szDumpFileName); + } + static bool RawMemoryCopyEx(HANDLE hFile, DWORD RawAddressToCopy, DWORD Size, char* szDumpFileName) + { + return UE::StaticRawMemoryCopyEx(hFile, RawAddressToCopy, Size, szDumpFileName); + } + static bool RawMemoryCopyEx64(HANDLE hFile, DWORD64 RawAddressToCopy, DWORD64 Size, char* szDumpFileName) + { + return UE::StaticRawMemoryCopyEx64(hFile, RawAddressToCopy, Size, szDumpFileName); + } + static bool HashFile(char* szFileName, void* HashDigest, bool OutputString, eHashAlgorithm Algorithm) + { + return UE::StaticHashFile(szFileName, (char*)HashDigest, OutputString, Algorithm); + } +}; + +class StaticW +{ +public: + + static bool FileLoad(wchar_t* szFileName, eAccess DesiredAccess, bool SimulateLoad, HANDLE* FileHandle, DWORD* LoadedSize, HANDLE* FileMap, ULONG_PTR* FileMapVA) + { + return UE::StaticFileLoadW(szFileName, DesiredAccess, SimulateLoad, FileHandle, LoadedSize, FileMap, FileMapVA); + } + static bool FileUnload(wchar_t* szFileName, bool CommitChanges, HANDLE FileHandle, DWORD LoadedSize, HANDLE FileMap, ULONG_PTR FileMapVA) + { + return UE::StaticFileUnloadW(szFileName, CommitChanges, FileHandle, LoadedSize, FileMap, FileMapVA); + } + static bool FileOpen(wchar_t* szFileName, DWORD DesiredAccess, LPHANDLE FileHandle, LPDWORD FileSizeLow, LPDWORD FileSizeHigh) + { + return UE::StaticFileOpenW(szFileName, DesiredAccess, FileHandle, FileSizeLow, FileSizeHigh); + } + static bool RawMemoryCopy(HANDLE hFile, ULONG_PTR FileMapVA, ULONG_PTR VitualAddressToCopy, DWORD Size, bool AddressIsRVA, wchar_t* szDumpFileName) + { + return UE::StaticRawMemoryCopyW(hFile, FileMapVA, VitualAddressToCopy, Size, AddressIsRVA, szDumpFileName); + } + static bool RawMemoryCopyEx(HANDLE hFile, DWORD RawAddressToCopy, DWORD Size, wchar_t* szDumpFileName) + { + return UE::StaticRawMemoryCopyExW(hFile, RawAddressToCopy, Size, szDumpFileName); + } + static bool RawMemoryCopyEx64(HANDLE hFile, DWORD64 RawAddressToCopy, DWORD64 Size, wchar_t* szDumpFileName) + { + return UE::StaticRawMemoryCopyEx64W(hFile, RawAddressToCopy, Size, szDumpFileName); + } + static bool HashFile(wchar_t* szFileName, void* HashDigest, bool OutputString, eHashAlgorithm Algorithm) + { + return UE::StaticHashFileW(szFileName, (char*)HashDigest, OutputString, Algorithm); + } +}; + +class Static : StaticX, StaticA, StaticW +{ +public: + + using StaticX::fStaticDecryptCallback; + + using StaticA::FileLoad; + using StaticW::FileLoad; + using StaticA::FileUnload; + using StaticW::FileUnload; + using StaticA::FileOpen; + using StaticW::FileOpen; + using StaticX::FileGetContent; + using StaticX::FileClose; + using StaticX::MemoryDecrypt; + using StaticX::MemoryDecryptEx; + using StaticX::MemoryDecryptSpecial; + using StaticX::SectionDecrypt; + using StaticX::MemoryDecompress; + using StaticA::RawMemoryCopy; + using StaticW::RawMemoryCopy; + using StaticA::RawMemoryCopyEx; + using StaticW::RawMemoryCopyEx; + using StaticA::RawMemoryCopyEx64; + using StaticW::RawMemoryCopyEx64; + using StaticX::HashMemory; + using StaticA::HashFile; + using StaticW::HashFile; +}; + +class EngineX +{ +protected: + + static void SetEngineVariable(eEngineVariable VariableId, bool VariableSet) + { + UE::SetEngineVariable(VariableId, VariableSet); + } + static bool FakeMissingDependencies(HANDLE hProcess) + { + return UE::EngineFakeMissingDependencies(hProcess); + } + static bool DeleteCreatedDependencies() + { + return UE::EngineDeleteCreatedDependencies(); + } + static bool CreateUnpackerWindow(char* WindowUnpackerTitle, char* WindowUnpackerLongTitle, char* WindowUnpackerName, char* WindowUnpackerAuthor, void* StartUnpackingCallBack) + { + return UE::EngineCreateUnpackerWindow(WindowUnpackerTitle, WindowUnpackerLongTitle, WindowUnpackerName, WindowUnpackerAuthor, StartUnpackingCallBack); + } + static void AddUnpackerWindowLogMessage(char* szLogMessage) + { + return UE::EngineAddUnpackerWindowLogMessage(szLogMessage); + } +}; + +class EngineA +{ +public: + + static bool CreateMissingDependencies(char* szFileName, char* szOutputFolder, bool LogCreatedFiles) + { + return UE::EngineCreateMissingDependencies(szFileName, szOutputFolder, LogCreatedFiles); + } +}; + +class EngineW +{ +public: + + static bool CreateMissingDependencies(wchar_t* szFileName, wchar_t* szOutputFolder, bool LogCreatedFiles) + { + return UE::EngineCreateMissingDependenciesW(szFileName, szOutputFolder, LogCreatedFiles); + } +}; + +class Engine : EngineX, EngineA, EngineW +{ +public: + + using EngineX::SetEngineVariable; + using EngineA::CreateMissingDependencies; + using EngineW::CreateMissingDependencies; + using EngineX::FakeMissingDependencies; + using EngineX::DeleteCreatedDependencies; + using EngineX::CreateUnpackerWindow; + using EngineX::AddUnpackerWindowLogMessage; +}; + +class ExtensionManager +{ +public: + + typedef UE::PluginInformation PluginInformation; + + static bool IsPluginLoaded(char* szPluginName) + { + return UE::ExtensionManagerIsPluginLoaded(szPluginName); + } + static bool IsPluginEnabled(char* szPluginName) + { + return UE::ExtensionManagerIsPluginEnabled(szPluginName); + } + static bool DisableAllPlugins() + { + return UE::ExtensionManagerDisableAllPlugins(); + } + static bool DisablePlugin(char* szPluginName) + { + return UE::ExtensionManagerDisablePlugin(szPluginName); + } + static bool EnableAllPlugins() + { + return UE::ExtensionManagerEnableAllPlugins(); + } + static bool EnablePlugin(char* szPluginName) + { + return UE::ExtensionManagerEnablePlugin(szPluginName); + } + static bool UnloadAllPlugins() + { + return UE::ExtensionManagerUnloadAllPlugins(); + } + static bool UnloadPlugin(char* szPluginName) + { + return UE::ExtensionManagerUnloadPlugin(szPluginName); + } + static PluginInformation* GetPluginInfo(char* szPluginName) + { + return (PluginInformation*)UE::ExtensionManagerGetPluginInfo(szPluginName); + } +}; + +} /* namespace TE */ + +#endif /*TITANENGINE_CPP*/ diff --git a/SDK/Delphi/TitanEngine.pas b/SDK/Delphi/TitanEngine.pas new file mode 100644 index 0000000..0c2f10e --- /dev/null +++ b/SDK/Delphi/TitanEngine.pas @@ -0,0 +1,750 @@ +unit TitanEngine; + +interface + +{TitanEngine Delphi SDK - 2.0.3} +{http://www.reversinglabs.com/} +{Types} +type + PE32Structure = ^PE_32_STRUCT; + PE_32_STRUCT = packed record + PE32Offset : LongInt; + ImageBase : LongInt; + OriginalEntryPoint : LongInt; + NtSizeOfImage : LongInt; + NtSizeOfHeaders : LongInt; + SizeOfOptionalHeaders : SmallInt; + FileAlignment : LongInt; + SectionAligment : LongInt; + ImportTableAddress : LongInt; + ImportTableSize : LongInt; + ResourceTableAddress : LongInt; + ResourceTableSize : LongInt; + ExportTableAddress : LongInt; + ExportTableSize : LongInt; + TLSTableAddress : LongInt; + TLSTableSize : LongInt; + RelocationTableAddress : LongInt; + RelocationTableSize : LongInt; + TimeDateStamp : LongInt; + SectionNumber : SmallInt; + CheckSum : LongInt; + SubSystem : SmallInt; + Characteristics : SmallInt; + NumberOfRvaAndSizes : LongInt; + end; + + FileStatusInfo = ^FILE_STATUS_INFO; + FILE_STATUS_INFO = packed record + OveralEvaluation : BYTE; + EvaluationTerminatedByException : boolean; + FileIs64Bit : boolean; + FileIsDLL : boolean; + FileIsConsole : boolean; + MissingDependencies : boolean; + MissingDeclaredAPIs : boolean; + SignatureMZ : BYTE; + SignaturePE : BYTE; + EntryPoint : BYTE; + ImageBase : BYTE; + SizeOfImage : BYTE; + FileAlignment : BYTE; + SectionAlignment : BYTE; + ExportTable : BYTE; + RelocationTable : BYTE; + ImportTable : BYTE; + ImportTableSection : BYTE; + ImportTableData : BYTE; + IATTable : BYTE; + TLSTable : BYTE; + LoadConfigTable : BYTE; + BoundImportTable : BYTE; + COMHeaderTable : BYTE; + ResourceTable : BYTE; + ResourceData : BYTE; + SectionTable : BYTE; + end; + + FileFixInfo = ^FILE_FIX_INFO; + FILE_FIX_INFO = packed record + OveralEvaluation : BYTE; + FixingTerminatedByException : boolean; + FileFixPerformed : boolean; + StrippedRelocation : boolean; + DontFixRelocations : boolean; + OriginalRelocationTableAddress : LongInt; + OriginalRelocationTableSize : LongInt; + StrippedExports : boolean; + DontFixExports : boolean; + OriginalExportTableAddress : LongInt; + OriginalExportTableSize : LongInt; + StrippedResources : boolean; + DontFixResources : boolean; + OriginalResourceTableAddress : LongInt; + OriginalResourceTableSize : LongInt; + StrippedTLS : boolean; + DontFixTLS : boolean; + OriginalTLSTableAddress : LongInt; + OriginalTLSTableSize : LongInt; + StrippedLoadConfig : boolean; + DontFixLoadConfig : boolean; + OriginalLoadConfigTableAddress : LongInt; + OriginalLoadConfigTableSize : LongInt; + StrippedBoundImports : boolean; + DontFixBoundImports : boolean; + OriginalBoundImportTableAddress : LongInt; + OriginalBoundImportTableSize : LongInt; + StrippedIAT : boolean; + DontFixIAT : boolean; + OriginalImportAddressTableAddress : LongInt; + OriginalImportAddressTableSize : LongInt; + StrippedCOM : boolean; + DontFixCOM : boolean; + OriginalCOMTableAddress : LongInt; + OriginalCOMTableSize : LongInt; + end; + + ImportEnumData = ^IMPORT_ENUM_DATA; + IMPORT_ENUM_DATA = packed record + NewDll : boolean; + NumberOfImports : LongInt; + ImageBase : LongInt; + BaseImportThunk : LongInt; + ImportThunk : LongInt; + APIName : PAnsiChar; + DLLName : PAnsiChar; + end; + + ThreadItemData = ^THREAD_ITEM_DATA; + THREAD_ITEM_DATA = packed record + hThread : THandle; + dwThreadId : LongInt; + ThreadStartAddress : LongInt; + ThreadLocalBase : LongInt; + end; + + LibraryItemData = ^LIBRARY_ITEM_DATA; + LIBRARY_ITEM_DATA = packed record + hFile : THandle; + BaseOfDll : Pointer; + hFileMapping : THandle; + hFileMappingView : Pointer; + szLibraryPath:array[1..260] of AnsiChar; + szLibraryName:array[1..260] of AnsiChar; + end; + + ProcessItemData = ^PROCESS_ITEM_DATA; + PROCESS_ITEM_DATA = packed record + hProcess : THandle; + dwProcessId : LongInt; + hThread : THandle; + dwThreadId : LongInt; + hFile : THandle; + BaseOfImage : Pointer; + ThreadStartAddress : Pointer; + ThreadLocalBase : Pointer; + end; + + HandlerArray = ^HANDLER_ARRAY; + HANDLER_ARRAY = packed record + ProcessId : LongInt; + hHandle : THandle; + end; + + HookEntry = ^HOOK_ENTRY; + HOOK_ENTRY = packed record + IATHook : boolean; + HookType : BYTE; + HookSize : LongInt; + HookAddress : Pointer; + RedirectionAddress : Pointer; + HookBytes:array[1..14] of BYTE; + OriginalBytes:array[1..14] of BYTE; + IATHookModuleBase : Pointer; + IATHookNameHash : LongInt; + HookIsEnabled : boolean; + HookIsRemote : boolean; + PatchedEntry : Pointer; + RelocationInfo:array[1..7] of LongInt; + RelocationCount : LongInt; + end; + + PluginInformation = ^PLUGIN_INFORMATION; + PLUGIN_INFORMATION = packed record + PluginName:array[1..64] of AnsiChar; + PluginMajorVersion : LongInt; + PluginMinorVersion : LongInt; + PluginBaseAddress : LongInt; + TitanDebuggingCallBack : Pointer; + TitanRegisterPlugin : Pointer; + TitanReleasePlugin : Pointer; + TitanResetPlugin : Pointer; + PluginDisabled : boolean; + end; +const +{Registers} + UE_EAX = 1; + UE_EBX = 2; + UE_ECX = 3; + UE_EDX = 4; + UE_EDI = 5; + UE_ESI = 6; + UE_EBP = 7; + UE_ESP = 8; + UE_EIP = 9; + UE_EFLAGS = 10; + UE_DR0 = 11; + UE_DR1 = 12; + UE_DR2 = 13; + UE_DR3 = 14; + UE_DR6 = 15; + UE_DR7 = 16; + UE_CIP = 35; + UE_CSP = 36; + UE_SEG_GS = 37; + UE_SEG_FS = 38; + UE_SEG_ES = 39; + UE_SEG_DS = 40; + UE_SEG_CS = 41; + UE_SEG_SS = 42; +{Constants} + UE_PE_OFFSET = 0; + UE_IMAGEBASE = 1; + UE_OEP = 2; + UE_SIZEOFIMAGE = 3; + UE_SIZEOFHEADERS = 4; + UE_SIZEOFOPTIONALHEADER = 5; + UE_SECTIONALIGNMENT = 6; + UE_IMPORTTABLEADDRESS = 7; + UE_IMPORTTABLESIZE = 8; + UE_RESOURCETABLEADDRESS = 9; + UE_RESOURCETABLESIZE = 10; + UE_EXPORTTABLEADDRESS = 11; + UE_EXPORTTABLESIZE = 12; + UE_TLSTABLEADDRESS = 13; + UE_TLSTABLESIZE = 14; + UE_RELOCATIONTABLEADDRESS = 15; + UE_RELOCATIONTABLESIZE = 16; + UE_TIMEDATESTAMP = 17; + UE_SECTIONNUMBER = 18; + UE_CHECKSUM = 19; + UE_SUBSYSTEM = 20; + UE_CHARACTERISTICS = 21; + UE_NUMBEROFRVAANDSIZES = 22; + UE_SECTIONNAME = 23; + UE_SECTIONVIRTUALOFFSET = 24; + UE_SECTIONVIRTUALSIZE = 25; + UE_SECTIONRAWOFFSET = 26; + UE_SECTIONRAWSIZE = 27; + UE_SECTIONFLAGS = 28; + + UE_CH_BREAKPOINT = 1; + UE_CH_SINGLESTEP = 2; + UE_CH_ACCESSVIOLATION = 3; + UE_CH_ILLEGALINSTRUCTION = 4; + UE_CH_NONCONTINUABLEEXCEPTION = 5; + UE_CH_ARRAYBOUNDSEXCEPTION = 6; + UE_CH_FLOATDENORMALOPERAND = 7; + UE_CH_FLOATDEVIDEBYZERO = 8; + UE_CH_INTEGERDEVIDEBYZERO = 9; + UE_CH_INTEGEROVERFLOW = 10; + UE_CH_PRIVILEGEDINSTRUCTION = 11; + UE_CH_PAGEGUARD = 12; + UE_CH_EVERYTHINGELSE = 13; + UE_CH_CREATETHREAD = 14; + UE_CH_EXITTHREAD = 15; + UE_CH_CREATEPROCESS = 16; + UE_CH_EXITPROCESS = 17; + UE_CH_LOADDLL = 18; + UE_CH_UNLOADDLL = 19; + UE_CH_OUTPUTDEBUGSTRING = 20; + + UE_FUNCTION_STDCALL = 1; + UE_FUNCTION_CCALL = 2; + UE_FUNCTION_FASTCALL = 3; + UE_FUNCTION_STDCALL_RET = 4; + UE_FUNCTION_CCALL_RET = 5; + UE_FUNCTION_FASTCALL_RET = 6; + UE_FUNCTION_STDCALL_CALL = 7; + UE_FUNCTION_CCALL_CALL = 8; + UE_FUNCTION_FASTCALL_CALL = 9; + UE_PARAMETER_BYTE = 0; + UE_PARAMETER_WORD = 1; + UE_PARAMETER_DWORD = 2; + UE_PARAMETER_QWORD = 3; + UE_PARAMETER_PTR_BYTE = 4; + UE_PARAMETER_PTR_WORD = 5; + UE_PARAMETER_PTR_DWORD = 6; + UE_PARAMETER_PTR_QWORD = 7; + UE_PARAMETER_STRING = 8; + UE_PARAMETER_UNICODE = 9; + + UE_CMP_NOCONDITION = 0; + UE_CMP_EQUAL = 1; + UE_CMP_NOTEQUAL = 2; + UE_CMP_GREATER = 3; + UE_CMP_GREATEROREQUAL = 4; + UE_CMP_LOWER = 5; + UE_CMP_LOWEROREQUAL = 6; + UE_CMP_REG_EQUAL = 7; + UE_CMP_REG_NOTEQUAL = 8; + UE_CMP_REG_GREATER = 9; + UE_CMP_REG_GREATEROREQUAL = 10; + UE_CMP_REG_LOWER = 11; + UE_CMP_REG_LOWEROREQUAL = 12; + UE_CMP_ALWAYSFALSE = 13; + UE_OPTION_HANDLER_RETURN_HANDLECOUNT = 1; + UE_OPTION_HANDLER_RETURN_ACCESS = 2; + UE_OPTION_HANDLER_RETURN_FLAGS = 3; + UE_OPTION_HANDLER_RETURN_TYPENAME = 4; + + UE_BREAKPOINT_INT3 = 1; + UE_BREAKPOINT_LONG_INT3 = 2; + UE_BREAKPOINT_UD2 = 3; + + UE_BPXREMOVED = 0; + UE_BPXACTIVE = 1; + UE_BPXINACTIVE = 2; + + UE_BREAKPOINT = 0; + UE_SINGLESHOOT = 1; + UE_HARDWARE = 2; + UE_MEMORY = 3; + UE_MEMORY_READ = 4; + UE_MEMORY_WRITE = 5; + UE_BREAKPOINT_TYPE_INT3 = $10000000; + UE_BREAKPOINT_TYPE_LONG_INT3 = $20000000; + UE_BREAKPOINT_TYPE_UD2 = $30000000; + + UE_HARDWARE_EXECUTE = 4; + UE_HARDWARE_WRITE = 5; + UE_HARDWARE_READWRITE = 6; + + UE_HARDWARE_SIZE_1 = 7; + UE_HARDWARE_SIZE_2 = 8; + UE_HARDWARE_SIZE_4 = 9; + + UE_ON_LIB_LOAD = 1; + UE_ON_LIB_UNLOAD = 2; + UE_ON_LIB_ALL = 3; + + UE_APISTART = 0; + UE_APIEND = 1; + + UE_PLATFORM_x86 = 1; + UE_PLATFORM_x64 = 2; + UE_PLATFORM_ALL = 3; + + UE_ACCESS_READ = 0; + UE_ACCESS_WRITE = 1; + UE_ACCESS_ALL = 2; + + UE_HIDE_BASIC = 1; + + UE_ENGINE_ALOW_MODULE_LOADING = 1; + UE_ENGINE_AUTOFIX_FORWARDERS = 2; + UE_ENGINE_PASS_ALL_EXCEPTIONS = 3; + UE_ENGINE_NO_CONSOLE_WINDOW = 4; + UE_ENGINE_BACKUP_FOR_CRITICAL_FUNCTIONS = 5; + UE_ENGINE_CALL_PLUGIN_CALLBACK = 6; + UE_ENGINE_RESET_CUSTOM_HANDLER = 7; + UE_ENGINE_CALL_PLUGIN_DEBUG_CALLBACK = 8; + + UE_OPTION_REMOVEALL = 1; + UE_OPTION_DISABLEALL = 2; + UE_OPTION_REMOVEALLDISABLED = 3; + UE_OPTION_REMOVEALLENABLED = 4; + + UE_STATIC_DECRYPTOR_XOR = 1; + UE_STATIC_DECRYPTOR_SUB = 2; + UE_STATIC_DECRYPTOR_ADD = 3; + + UE_STATIC_DECRYPTOR_FOREWARD = 1; + UE_STATIC_DECRYPTOR_BACKWARD = 2; + + UE_STATIC_KEY_SIZE_1 = 1; + UE_STATIC_KEY_SIZE_2 = 2; + UE_STATIC_KEY_SIZE_4 = 4; + UE_STATIC_KEY_SIZE_8 = 8; + + UE_STATIC_APLIB = 1; + UE_STATIC_APLIB_DEPACK = 2; + UE_STATIC_LZMA = 3; + + UE_STATIC_HASH_MD5 = 1; + UE_STATIC_HASH_SHA1 = 2; + UE_STATIC_HASH_CRC32 = 3; + + UE_RESOURCE_LANGUAGE_ANY = -1; + + UE_DEPTH_SURFACE = 0; + UE_DEPTH_DEEP = 1; + + UE_UNPACKER_CONDITION_SEARCH_FROM_EP = 1; + + UE_UNPACKER_CONDITION_LOADLIBRARY = 1; + UE_UNPACKER_CONDITION_GETPROCADDRESS = 2; + UE_UNPACKER_CONDITION_ENTRYPOINTBREAK = 3; + UE_UNPACKER_CONDITION_RELOCSNAPSHOT1 = 4; + UE_UNPACKER_CONDITION_RELOCSNAPSHOT2 = 5; + + UE_FIELD_OK = 0; + UE_FIELD_BROKEN_NON_FIXABLE = 1; + UE_FIELD_BROKEN_NON_CRITICAL = 2; + UE_FIELD_BROKEN_FIXABLE_FOR_STATIC_USE = 3; + UE_FIELD_BROKEN_BUT_CAN_BE_EMULATED = 4; + UE_FILED_FIXABLE_NON_CRITICAL = 5; + UE_FILED_FIXABLE_CRITICAL = 6; + UE_FIELD_NOT_PRESET = 7; + UE_FIELD_NOT_PRESET_WARNING = 8; + + UE_RESULT_FILE_OK = 10; + UE_RESULT_FILE_INVALID_BUT_FIXABLE = 11; + UE_RESULT_FILE_INVALID_AND_NON_FIXABLE = 12; + UE_RESULT_FILE_INVALID_FORMAT = 13; + + UE_PLUGIN_CALL_REASON_PREDEBUG = 1; + UE_PLUGIN_CALL_REASON_EXCEPTION = 2; + UE_PLUGIN_CALL_REASON_POSTDEBUG = 3; + + TEE_HOOK_NRM_JUMP = 1; + TEE_HOOK_NRM_CALL = 3; + TEE_HOOK_IAT = 5; + +{TitanEngine.Dumper.functions} + function DumpProcess(hProcess:THandle; ImageBase:LongInt; szDumpFileName:PAnsiChar; EntryPoint:LongInt):boolean; stdcall; external 'TitanEngine.dll' name 'DumpProcess'; + function DumpProcessEx(ProcessId:LongInt; ImageBase:LongInt; szDumpFileName:PAnsiChar; EntryPoint:LongInt):boolean; stdcall; external 'TitanEngine.dll' name 'DumpProcessEx'; + function DumpMemory(hProcess:THandle; MemoryStart,MemorySize:LongInt; szDumpFileName:PAnsiChar):boolean; stdcall; external 'TitanEngine.dll' name 'DumpMemory'; + function DumpMemoryEx(ProcessId:LongInt; MemoryStart,MemorySize:LongInt; szDumpFileName:PAnsiChar):boolean; stdcall; external 'TitanEngine.dll' name 'DumpMemoryEx'; + function DumpRegions(hProcess:THandle; szDumpFolder:PAnsiChar; DumpAboveImageBaseOnly:boolean):boolean; stdcall; external 'TitanEngine.dll' name 'DumpRegions'; + function DumpRegionsEx(ProcessId:LongInt; szDumpFolder:PAnsiChar; DumpAboveImageBaseOnly:boolean):boolean; stdcall; external 'TitanEngine.dll' name 'DumpRegionsEx'; + function DumpModule(hProcess:THandle; ModuleBase:LongInt; szDumpFileName:PAnsiChar):boolean; stdcall; external 'TitanEngine.dll' name 'DumpModule'; + function DumpModuleEx(ProcessId:LongInt; ModuleBase:LongInt; szDumpFileName:PAnsiChar):boolean; stdcall; external 'TitanEngine.dll' name 'DumpModuleEx'; + function PastePEHeader(hProcess:THandle; ImageBase:LongInt; szDebuggedFileName:PAnsiChar):boolean; stdcall; external 'TitanEngine.dll' name 'PastePEHeader'; + function ExtractSection(szFileName,szDumpFileName:PAnsiChar; SectionNumber:LongInt):boolean; stdcall; external 'TitanEngine.dll' name 'ExtractSection'; + function ResortFileSections(szFileName:PAnsiChar):boolean; stdcall; external 'TitanEngine.dll' name 'ResortFileSections'; + function FindOverlay(szFileName:PAnsiChar; OverlayStart,OverlaySize:Pointer):boolean; stdcall; external 'TitanEngine.dll' name 'FindOverlay'; + function ExtractOverlay(szFileName,szExtactedFileName:PAnsiChar):boolean; stdcall; external 'TitanEngine.dll' name 'ExtractOverlay'; + function AddOverlay(szFileName,szOverlayFileName:PAnsiChar):boolean; stdcall; external 'TitanEngine.dll' name 'AddOverlay'; + function CopyOverlay(szInFileName,szOutFileName:PAnsiChar):boolean; stdcall; external 'TitanEngine.dll' name 'CopyOverlay'; + function RemoveOverlay(szFileName:PAnsiChar):boolean; stdcall; external 'TitanEngine.dll' name 'RemoveOverlay'; + function MakeAllSectionsRWE(szFileName:PAnsiChar):boolean; stdcall; external 'TitanEngine.dll' name 'MakeAllSectionsRWE'; + function AddNewSectionEx(szFileName,szSectionName:PAnsiChar; SectionSize,SectionAttributes:LongInt; SectionContent:Pointer; ContentSize:LongInt):LongInt; stdcall; external 'TitanEngine.dll' name 'AddNewSectionEx'; + function AddNewSection(szFileName,szSectionName:PAnsiChar; SectionSize:LongInt):LongInt; stdcall; external 'TitanEngine.dll' name 'AddNewSection'; + function ResizeLastSection(szFileName:PAnsiChar; NumberOfExpandBytes:LongInt; AlignResizeData:boolean):boolean; stdcall; external 'TitanEngine.dll' name 'ResizeLastSection'; + procedure SetSharedOverlay(szFileName:PAnsiChar); stdcall; external 'TitanEngine.dll' name 'SetSharedOverlay'; + function GetSharedOverlay():PAnsiChar; stdcall; external 'TitanEngine.dll' name 'GetSharedOverlay'; + function DeleteLastSection(szFileName:PAnsiChar):boolean; stdcall; external 'TitanEngine.dll' name 'DeleteLastSection'; + function DeleteLastSectionEx(szFileName:PAnsiChar; NumberOfSections:LongInt):boolean; stdcall; external 'TitanEngine.dll' name 'DeleteLastSectionEx'; + function GetPE32DataFromMappedFile(FileMapVA,WhichSection,WhichData:LongInt):LongInt; stdcall; external 'TitanEngine.dll' name 'GetPE32DataFromMappedFile'; + function GetPE32Data(szFileName:PAnsiChar; WhichSection,WhichData:LongInt):LongInt; stdcall; external 'TitanEngine.dll' name 'GetPE32Data'; + function GetPE32DataFromMappedFileEx(FileMapVA:LongInt; DataStorage:Pointer):boolean; stdcall; external 'TitanEngine.dll' name 'GetPE32DataFromMappedFileEx'; + function GetPE32DataEx(szFileName:PAnsiChar; DataStorage:Pointer):boolean; stdcall; external 'TitanEngine.dll' name 'GetPE32DataEx'; + function SetPE32DataForMappedFile(FileMapVA,WhichSection,WhichData,NewDataValue:LongInt):boolean; stdcall; external 'TitanEngine.dll' name 'SetPE32DataForMappedFile'; + function SetPE32Data(szFileName:PAnsiChar; WhichSection,WhichData,NewDataValue:LongInt):boolean; stdcall; external 'TitanEngine.dll' name 'SetPE32Data'; + function SetPE32DataForMappedFileEx(szFileName:PAnsiChar; DataStorage:Pointer):boolean; stdcall; external 'TitanEngine.dll' name 'SetPE32DataForMappedFileEx'; + function SetPE32DataEx(szFileName:PAnsiChar; DataStorage:Pointer):boolean; stdcall; external 'TitanEngine.dll' name 'SetPE32DataEx'; + function GetPE32SectionNumberFromVA(FileMapVA,AddressToConvert:LongInt):LongInt; stdcall; external 'TitanEngine.dll' name 'GetPE32SectionNumberFromVA'; + function ConvertVAtoFileOffset(FileMapVA,AddressToConvert:LongInt; ReturnType:boolean):LongInt; stdcall; external 'TitanEngine.dll' name 'ConvertVAtoFileOffset'; + function ConvertVAtoFileOffsetEx(FileMapVA,FileSize,ImageBase,AddressToConvert:LongInt; AddressIsRVA,ReturnType:boolean):LongInt; stdcall; external 'TitanEngine.dll' name 'ConvertVAtoFileOffsetEx'; + function ConvertFileOffsetToVA(FileMapVA,AddressToConvert:LongInt; ReturnType:boolean):LongInt; stdcall; external 'TitanEngine.dll' name 'ConvertFileOffsetToVA'; + function ConvertFileOffsetToVAEx(FileMapVA,FileSize,ImageBase,AddressToConvert:LongInt; ReturnType:boolean):LongInt; stdcall; external 'TitanEngine.dll' name 'ConvertFileOffsetToVAEx'; +{TitanEngine.Realigner.functions} + function FixHeaderCheckSum(szFileName:PAnsiChar):boolean; stdcall; external 'TitanEngine.dll' name 'FixHeaderCheckSum'; + function RealignPE(FileMapVA,FileSize,RealingMode:LongInt):LongInt; stdcall; external 'TitanEngine.dll' name 'RealignPE'; + function RealignPEEx(szFileName:PAnsiChar; RealingFileSize,ForcedFileAlignment:LongInt):LongInt; stdcall; external 'TitanEngine.dll' name 'RealignPEEx'; + function WipeSection(szFileName:PAnsiChar; WipeSectionNumber:LongInt; RemovePhysically:boolean):boolean; stdcall; external 'TitanEngine.dll' name 'WipeSection'; + function IsPE32FileValidEx(szFileName:PAnsiChar; CheckDepth:LongInt; FileStatusInfo:Pointer):boolean; stdcall; external 'TitanEngine.dll' name 'IsPE32FileValidEx'; + function FixBrokenPE32FileEx(szFileName:PAnsiChar; FileStatusInfo,FileFixInfo:Pointer):boolean; stdcall; external 'TitanEngine.dll' name 'FixBrokenPE32FileEx'; + function IsFileDLL(szFileName:PAnsiChar; FileMapVA:LongInt):boolean; stdcall; external 'TitanEngine.dll' name 'IsFileDLL'; +{TitanEngine.Hider.functions} + function GetPEBLocation(hProcess:THandle):LongInt; stdcall; external 'TitanEngine.dll' name 'GetPEBLocation'; + function HideDebugger(hProcess:THandle; PatchAPILevel:LongInt):boolean; stdcall; external 'TitanEngine.dll' name 'HideDebugger'; + function UnHideDebugger(hProcess:THandle; PatchAPILevel:LongInt):boolean; stdcall; external 'TitanEngine.dll' name 'UnHideDebugger'; +{TitanEngine.Relocater.functions} + procedure RelocaterCleanup(); stdcall; external 'TitanEngine.dll' name 'RelocaterCleanup'; + procedure RelocaterInit(MemorySize,OldImageBase,NewImageBase:LongInt); stdcall; external 'TitanEngine.dll' name 'RelocaterInit'; + procedure RelocaterAddNewRelocation(hProcess:THandle; RelocateAddress,RelocateState:LongInt); stdcall; external 'TitanEngine.dll' name 'RelocaterAddNewRelocation'; + function RelocaterEstimatedSize():LongInt; stdcall; external 'TitanEngine.dll' name 'RelocaterEstimatedSize'; + function RelocaterExportRelocation(StorePlace,StorePlaceRVA,FileMapVA:LongInt):boolean; stdcall; external 'TitanEngine.dll' name 'RelocaterExportRelocation'; + function RelocaterExportRelocationEx(szFileName,szSectionName:PAnsiChar; StorePlace,StorePlaceRVA:LongInt):boolean; stdcall; external 'TitanEngine.dll' name 'RelocaterExportRelocationEx'; + function RelocaterGrabRelocationTable(hProcess:THandle; MemoryStart,MemorySize:LongInt):boolean; stdcall; external 'TitanEngine.dll' name 'RelocaterGrabRelocationTable'; + function RelocaterGrabRelocationTableEx(hProcess:THandle; MemoryStart,MemorySize,NtSizeOfImage:LongInt):boolean; stdcall; external 'TitanEngine.dll' name 'RelocaterGrabRelocationTableEx'; + function RelocaterMakeSnapshot(hProcess:THandle; szSaveFileName:PAnsiChar; MemoryStart,MemorySize:LongInt):boolean; stdcall; external 'TitanEngine.dll' name 'RelocaterMakeSnapshot'; + function RelocaterCompareTwoSnapshots(hProcess:THandle; LoadedImageBase,NtSizeOfImage:LongInt; szDumpFile1,szDumpFile2:PAnsiChar; MemStart:LongInt):boolean; stdcall; external 'TitanEngine.dll' name 'RelocaterCompareTwoSnapshots'; + function RelocaterChangeFileBase(szFileName:PAnsiChar; NewImageBase:LongInt):boolean; stdcall; external 'TitanEngine.dll' name 'RelocaterChangeFileBase'; + function RelocaterRelocateMemoryBlock(FileMapVA,MemoryLocation:LongInt; RelocateMemory:Pointer; RelocateMemorySize,CurrentLoadedBase,RelocateBase:LongInt):boolean; stdcall; external 'TitanEngine.dll' name 'RelocaterRelocateMemoryBlock'; + function RelocaterWipeRelocationTable(szFileName:PAnsiChar):boolean; stdcall; external 'TitanEngine.dll' name 'RelocaterWipeRelocationTable'; +{TitanEngine.Resourcer.functions} + function ResourcerLoadFileForResourceUse(szFileName:PAnsiChar):LongInt; stdcall; external 'TitanEngine.dll' name 'ResourcerLoadFileForResourceUse'; + function ResourcerFreeLoadedFile(LoadedFileBase:LongInt):boolean; stdcall; external 'TitanEngine.dll' name 'ResourcerFreeLoadedFile'; + function ResourcerExtractResourceFromFileEx(FileMapVA:LongInt; szResourceType,szResourceName,szExtractedFileName:PAnsiChar):boolean; stdcall; external 'TitanEngine.dll' name 'ResourcerExtractResourceFromFileEx'; + function ResourcerExtractResourceFromFile(szFileName,szResourceType,szResourceName,szExtractedFileName:PAnsiChar):boolean; stdcall; external 'TitanEngine.dll' name 'ResourcerExtractResourceFromFile'; + function ResourcerFindResource(szFileName,szResourceType:PAnsiChar; ResourceType:LongInt; szResourceName:PAnsiChar; ResourceName,ResourceLanguage:LongInt; pResourceData,pResourceSize:Pointer):boolean; stdcall; external 'TitanEngine.dll' name 'ResourcerFindResource'; + function ResourcerFindResourceEx(FileMapVA,FileSize:LongInt; szResourceType:PAnsiChar; ResourceType:LongInt; szResourceName:PAnsiChar; ResourceName,ResourceLanguage:LongInt; pResourceData,pResourceSize:Pointer):boolean; stdcall; external 'TitanEngine.dll' name 'ResourcerFindResourceEx'; + procedure ResourcerEnumerateResource(szFileName:PAnsiChar; CallBack:LongInt); stdcall; external 'TitanEngine.dll' name 'ResourcerEnumerateResource'; + procedure ResourcerEnumerateResourceEx(FileMapVA,FileSize:LongInt; CallBack:LongInt); stdcall; external 'TitanEngine.dll' name 'ResourcerEnumerateResourceEx'; +{TitanEngine.FindOEP.functions} + procedure FindOEPInit(); stdcall; external 'TitanEngine.dll' name 'FindOEPInit'; + procedure FindOEPGenerically(szFileName:PAnsiChar; TraceInitCallBack,CallBack:Pointer); stdcall; external 'TitanEngine.dll' name 'FindOEPGenerically'; +{TitanEngine.Threader.functions} + function ThreaderImportRunningThreadData(ProcessId:LongInt):boolean; stdcall; external 'TitanEngine.dll' name 'ThreaderImportRunningThreadData'; + function ThreaderGetThreadInfo(hThread:THandle; ThreadId:LongInt):LongInt; stdcall; external 'TitanEngine.dll' name 'ThreaderGetThreadInfo'; + procedure ThreaderEnumThreadInfo(EnumCallBack:Pointer); stdcall; external 'TitanEngine.dll' name 'ThreaderGetThreadInfo'; + function ThreaderPauseThread(hThread:THandle):boolean; stdcall; external 'TitanEngine.dll' name 'ThreaderPauseThread'; + function ThreaderResumeThread(hThread:THandle):boolean; stdcall; external 'TitanEngine.dll' name 'ThreaderResumeThread'; + function ThreaderTerminateThread(hThread:THandle; ThreadExitCode:LongInt):boolean; stdcall; external 'TitanEngine.dll' name 'ThreaderTerminateThread'; + function ThreaderPauseAllThreads(LeaveMainRunning:boolean):boolean; stdcall; external 'TitanEngine.dll' name 'ThreaderPauseAllThreads'; + function ThreaderResumeAllThreads(LeaveMainPaused:boolean):boolean; stdcall; external 'TitanEngine.dll' name 'ThreaderResumeAllThreads'; + function ThreaderPauseProcess():boolean; stdcall; external 'TitanEngine.dll' name 'ThreaderPauseProcess'; + function ThreaderResumeProcess():boolean; stdcall; external 'TitanEngine.dll' name 'ThreaderResumeProcess'; + function ThreaderCreateRemoteThread(ThreadStartAddress:LongInt; AutoCloseTheHandle:boolean; ThreadPassParameter,ThreadId:Pointer):LongInt; stdcall; external 'TitanEngine.dll' name 'ThreaderCreateRemoteThread'; + function ThreaderInjectAndExecuteCode(InjectCode:Pointer; StartDelta,InjectSize:LongInt):boolean; stdcall; external 'TitanEngine.dll' name 'ThreaderInjectAndExecuteCode'; + function ThreaderCreateRemoteThreadEx(hProcess:THandle; ThreadStartAddress:LongInt; AutoCloseTheHandle:boolean; ThreadPassParameter,ThreadId:Pointer):LongInt; stdcall; external 'TitanEngine.dll' name 'ThreaderCreateRemoteThreadEx'; + function ThreaderInjectAndExecuteCodeEx(hProcess:THandle; InjectCode:Pointer; StartDelta,InjectSize:LongInt):boolean; stdcall; external 'TitanEngine.dll' name 'ThreaderInjectAndExecuteCodeEx'; + procedure ThreaderSetCallBackForNextExitThreadEvent(exitThreadCallBack:Pointer); stdcall; external 'TitanEngine.dll' name 'ThreaderSetCallBackForNextExitThreadEvent'; + function ThreaderIsThreadStillRunning(hThread:THandle):boolean; stdcall; external 'TitanEngine.dll' name 'ThreaderIsThreadStillRunning'; + function ThreaderIsThreadActive(hThread:THandle):boolean; stdcall; external 'TitanEngine.dll' name 'ThreaderIsThreadActive'; + function ThreaderIsAnyThreadActive():boolean; stdcall; external 'TitanEngine.dll' name 'ThreaderIsAnyThreadActive'; + function ThreaderExecuteOnlyInjectedThreads():boolean; stdcall; external 'TitanEngine.dll' name 'ThreaderExecuteOnlyInjectedThreads'; + function ThreaderGetOpenHandleForThread(ThreadId:LongInt):THandle; stdcall; external 'TitanEngine.dll' name 'ThreaderGetOpenHandleForThread'; + function ThreaderGetThreadData():Pointer; stdcall; external 'TitanEngine.dll' name 'ThreaderGetThreadData'; + function ThreaderIsExceptionInMainThread():boolean; stdcall; external 'TitanEngine.dll' name 'ThreaderIsExceptionInMainThread'; +{TitanEngine.Debugger.functions} + function StaticDisassembleEx(DisassmStart:LongInt; DisassmAddress:Pointer):PAnsiChar; stdcall; external 'TitanEngine.dll' name 'StaticDisassembleEx'; + function StaticDisassemble(DisassmAddress:Pointer):PAnsiChar; stdcall; external 'TitanEngine.dll' name 'StaticDisassemble'; + function DisassembleEx(hProcess:THandle; DisassmAddress:Pointer):PAnsiChar; stdcall; external 'TitanEngine.dll' name 'DisassembleEx'; + function Disassemble(DisassmAddress:Pointer):PAnsiChar; stdcall; external 'TitanEngine.dll' name 'Disassemble'; + function StaticLengthDisassemble(DisassmAddress:Pointer):LongInt; stdcall; external 'TitanEngine.dll' name 'StaticLengthDisassemble'; + function LengthDisassembleEx(hProcess:THandle; DisassmAddress:Pointer):LongInt; stdcall; external 'TitanEngine.dll' name 'LengthDisassembleEx'; + function LengthDisassemble(DisassmAddress:Pointer):LongInt; stdcall; external 'TitanEngine.dll' name 'LengthDisassemble'; + function InitDebug(szFileName,szCommandLine,szCurrentFolder:PAnsiChar): Pointer; stdcall; external 'TitanEngine.dll' name 'InitDebug'; + function InitDebugEx(szFileName,szCommandLine,szCurrentFolder:PAnsiChar; EntryCallBack:Pointer): Pointer; stdcall; external 'TitanEngine.dll' name 'InitDebugEx'; + function InitDLLDebug(szFileName:PAnsiChar; ReserveModuleBase:boolean; szCommandLine,szCurrentFolder:PAnsiChar; EntryCallBack:Pointer): Pointer; stdcall; external 'TitanEngine.dll' name 'InitDLLDebug'; + function StopDebug(): Boolean; stdcall; external 'TitanEngine.dll' name 'StopDebug'; + procedure SetBPXOptions(DefaultBreakPointType:LongInt); stdcall; external 'TitanEngine.dll' name 'SetBPXOptions'; + function IsBPXEnabled(bpxAddress:LongInt): boolean; stdcall; external 'TitanEngine.dll' name 'IsBPXEnabled'; + function EnableBPX(bpxAddress:LongInt): boolean; stdcall; external 'TitanEngine.dll' name 'EnableBPX'; + function DisableBPX(bpxAddress:LongInt): boolean; stdcall; external 'TitanEngine.dll' name 'DisableBPX'; + function SetBPX(bpxAddress,bpxType:LongInt; bpxCallBack:Pointer): boolean; stdcall; external 'TitanEngine.dll' name 'SetBPX'; + function SetBPXEx(bpxAddress,bpxType,NumberOfExecution,CmpRegister,CmpCondition,CmpValue:LongInt; bpxCallBack,bpxCompareCallBack,bpxRemoveCallBack:Pointer): boolean; stdcall; external 'TitanEngine.dll' name 'SetBPXEx'; + function DeleteBPX(bpxAddress:LongInt): boolean; stdcall; external 'TitanEngine.dll' name 'DeleteBPX'; + function SafeDeleteBPX(bpxAddress:LongInt): boolean; stdcall; external 'TitanEngine.dll' name 'SafeDeleteBPX'; + function SetAPIBreakPoint(szDLLName,szAPIName:PAnsiChar; bpxType,bpxPlace:LongInt; bpxCallBack:Pointer):boolean; stdcall; external 'TitanEngine.dll' name 'SetAPIBreakPoint'; + function DeleteAPIBreakPoint(szDLLName,szAPIName:PAnsiChar; bpxPlace:LongInt):boolean; stdcall; external 'TitanEngine.dll' name 'DeleteAPIBreakPoint'; + function SafeDeleteAPIBreakPoint(szDLLName,szAPIName:PAnsiChar; bpxPlace:LongInt):boolean; stdcall; external 'TitanEngine.dll' name 'SafeDeleteAPIBreakPoint'; + function SetMemoryBPX(MemoryStart,SizeOfMemory:LongInt; bpxCallBack:Pointer):boolean; stdcall; external 'TitanEngine.dll' name 'SetMemoryBPX'; + function SetMemoryBPXEx(MemoryStart,SizeOfMemory,BreakPointType:LongInt; RestoreOnHit:boolean; bpxCallBack:Pointer):boolean; stdcall; external 'TitanEngine.dll' name 'SetMemoryBPXEx'; + function RemoveMemoryBPX(MemoryStart,SizeOfMemory:LongInt):boolean; stdcall; external 'TitanEngine.dll' name 'RemoveMemoryBPX'; + function GetContextFPUDataEx(hActiveThread:THandle; FPUSaveArea:Pointer): boolean; stdcall; external 'TitanEngine.dll' name 'GetContextFPUDataEx'; + function GetContextDataEx(hActiveThread:THandle; IndexOfRegister:LongInt): LongInt; stdcall; external 'TitanEngine.dll' name 'GetContextDataEx'; + function GetContextData(IndexOfRegister:LongInt): LongInt; stdcall; external 'TitanEngine.dll' name 'GetContextData'; + function SetContextFPUDataEx(hActiveThread:THandle; FPUSaveArea:Pointer): boolean; stdcall; external 'TitanEngine.dll' name 'SetContextFPUDataEx'; + function SetContextDataEx(hActiveThread:THandle; IndexOfRegister,NewRegisterValue:LongInt):boolean; stdcall; external 'TitanEngine.dll' name 'SetContextDataEx'; + function SetContextData(IndexOfRegister,NewRegisterValue:LongInt):boolean; stdcall; external 'TitanEngine.dll' name 'SetContextData'; + procedure ClearExceptionNumber(); stdcall; external 'TitanEngine.dll' name 'ClearExceptionNumber'; + function CurrentExceptionNumber(): LongInt; stdcall; external 'TitanEngine.dll' name 'CurrentExceptionNumber'; + function MatchPatternEx(hProcess:THandle; MemoryToCheck,SizeOfMemoryToCheck:LongInt; PatternToMatch:Pointer; SizeOfPatternToMatch:LongInt; WildCard:Pointer): boolean; stdcall; external 'TitanEngine.dll' name 'MatchPatternEx'; + function MatchPattern(MemoryToCheck,SizeOfMemoryToCheck:LongInt; PatternToMatch:Pointer; SizeOfPatternToMatch:LongInt; WildCard:Pointer): boolean; stdcall; external 'TitanEngine.dll' name 'MatchPattern'; + function FindEx(hProcess:THandle; MemoryStart,MemorySize:LongInt; SearchPattern:Pointer; PatternSize:LongInt; WildCard:Pointer): LongInt; stdcall; external 'TitanEngine.dll' name 'FindEx'; + function Find(MemoryStart,MemorySize:LongInt; SearchPattern:Pointer; PatternSize:LongInt; WildCard:Pointer): LongInt; stdcall; external 'TitanEngine.dll' name 'Find'; + function FillEx(hProcess:THandle; MemoryStart,MemorySize:LongInt; FillByte:Pointer): boolean; stdcall; external 'TitanEngine.dll' name 'FillEx'; + function Fill(MemoryStart,MemorySize:LongInt; FillByte:Pointer): boolean; stdcall; external 'TitanEngine.dll' name 'Fill'; + function PatchEx(hProcess:THandle; MemoryStart,MemorySize:LongInt; ReplacePattern:Pointer; ReplaceSize:LongInt; AppendNOP,PrependNOP:boolean): boolean; stdcall; external 'TitanEngine.dll' name 'PatchEx'; + function Patch(MemoryStart,MemorySize:LongInt; ReplacePattern:Pointer; ReplaceSize:LongInt; AppendNOP,PrependNOP:boolean): boolean; stdcall; external 'TitanEngine.dll' name 'Patch'; + function ReplaceEx(hProcess:THandle; MemoryStart,MemorySize:LongInt; SearchPattern:Pointer; PatternSize,NumberOfRepetitions:LongInt; ReplacePattern:Pointer; ReplaceSize:LongInt; WildCard:Pointer): boolean; stdcall; external 'TitanEngine.dll' name 'ReplaceEx'; + function Replace(MemoryStart,MemorySize:LongInt; SearchPattern:Pointer; PatternSize,NumberOfRepetitions:LongInt; ReplacePattern:Pointer; ReplaceSize:LongInt; WildCard:Pointer): boolean; stdcall; external 'TitanEngine.dll' name 'Replace'; + function GetDebugData(): Pointer; stdcall; external 'TitanEngine.dll' name 'GetDebugData'; + function GetTerminationData(): Pointer; stdcall; external 'TitanEngine.dll' name 'GetTerminationData'; + function GetExitCode():LongInt; stdcall; external 'TitanEngine.dll' name 'GetExitCode'; + function GetDebuggedDLLBaseAddress(): LongInt; stdcall; external 'TitanEngine.dll' name 'GetDebuggedDLLBaseAddress'; + function GetDebuggedFileBaseAddress(): LongInt; stdcall; external 'TitanEngine.dll' name 'GetDebuggedFileBaseAddress'; + function GetRemoteString(hProcess:THandle; StringAddress:LongInt; StringStorage:Pointer; MaximumStringSize:LongInt): LongInt; stdcall; external 'TitanEngine.dll' name 'GetRemoteString'; + function GetFunctionParameter(hProcess:THandle; FunctionType,ParameterNumber,ParameterType:LongInt): LongInt; stdcall; external 'TitanEngine.dll' name 'GetFunctionParameter'; + function GetJumpDestinationEx(hProcess:THandle; InstructionAddress:LongInt; JustJumps:boolean): LongInt; stdcall; external 'TitanEngine.dll' name 'GetJumpDestinationEx'; + function GetJumpDestination(hProcess:THandle; InstructionAddress:LongInt; JustJumps:boolean): LongInt; stdcall; external 'TitanEngine.dll' name 'GetJumpDestination'; + function IsJumpGoingToExecuteEx(hProcess,hThread:THandle; InstructionAddress,RegFlags:LongInt): boolean; stdcall; external 'TitanEngine.dll' name 'IsJumpGoingToExecuteEx'; + function IsJumpGoingToExecute(): boolean; stdcall; external 'TitanEngine.dll' name 'IsJumpGoingToExecute'; + procedure SetCustomHandler(WhichException:LongInt; CallBack:Pointer); stdcall; external 'TitanEngine.dll' name 'SetCustomHandler'; + procedure ForceClose(); stdcall; external 'TitanEngine.dll' name 'ForceClose'; + procedure StepInto(traceCallBack:Pointer); stdcall; external 'TitanEngine.dll' name 'StepInto'; + procedure StepOver(traceCallBack:Pointer); stdcall; external 'TitanEngine.dll' name 'StepOver'; + procedure SingleStep(StepCount:LongInt; StepCallBack:Pointer); stdcall; external 'TitanEngine.dll' name 'SingleStep'; + function GetUnusedHardwareBreakPointRegister(RegisterIndex:Pointer):boolean; stdcall; external 'TitanEngine.dll' name 'GetUnusedHardwareBreakPointRegister'; + function SetHardwareBreakPointEx(hActiveThread:THandle; bpxAddress,IndexOfRegister,bpxType,bpxSize:LongInt; bpxCallBack,IndexOfSelectedRegister:Pointer):boolean; stdcall; external 'TitanEngine.dll' name 'SetHardwareBreakPointEx'; + function SetHardwareBreakPoint(bpxAddress,IndexOfRegister,bpxType,bpxSize:LongInt; bpxCallBack:Pointer):boolean; stdcall; external 'TitanEngine.dll' name 'SetHardwareBreakPoint'; + function DeleteHardwareBreakPoint(IndexOfRegister:LongInt):boolean; stdcall; external 'TitanEngine.dll' name 'DeleteHardwareBreakPoint'; + function RemoveAllBreakPoints(RemoveOption:LongInt):boolean; stdcall; external 'TitanEngine.dll' name 'RemoveAllBreakPoints'; + function GetProcessInformation(): Pointer; stdcall; external 'TitanEngine.dll' name 'GetProcessInformation'; + function GetStartupInformation(): Pointer; stdcall; external 'TitanEngine.dll' name 'GetStartupInformation'; + procedure DebugLoop(); stdcall; external 'TitanEngine.dll' name 'DebugLoop'; + procedure SetDebugLoopTimeOut(TimeOut:LongInt); stdcall; external 'TitanEngine.dll' name 'SetDebugLoopTimeOut'; + procedure SetNextDbgContinueStatus(SetDbgCode:LongInt); stdcall; external 'TitanEngine.dll' name 'SetNextDbgContinueStatus'; + function AttachDebugger(ProcessId:LongInt; KillOnExit:Boolean; DebugInfo,CallBack:Pointer): Pointer; stdcall; external 'TitanEngine.dll' name 'AttachDebugger'; + function DetachDebugger(ProcessId:LongInt): Pointer; stdcall; external 'TitanEngine.dll' name 'DetachDebugger'; + function DetachDebuggerEx(ProcessId:LongInt): Pointer; stdcall; external 'TitanEngine.dll' name 'DetachDebuggerEx'; + function DebugLoopEx(TimeOut:LongInt): LongInt; stdcall; external 'TitanEngine.dll' name 'DebugLoopEx'; + procedure AutoDebugEx(szFileName:PAnsiChar; ReserveModuleBase:boolean; szCommandLine,szCurrentFolder:PAnsiChar; TimeOut:LongInt; EntryCallBack:Pointer); stdcall; external 'TitanEngine.dll' name 'AutoDebugEx'; + function IsFileBeingDebugged(): boolean; stdcall; external 'TitanEngine.dll' name 'IsFileBeingDebugged'; + procedure SetErrorModel(DisplayErrorMessages:boolean); stdcall; external 'TitanEngine.dll' name 'SetErrorModel'; +{TitanEngine.Importer.functions} + procedure ImporterCleanup(); stdcall; external 'TitanEngine.dll' name 'ImporterCleanup'; + procedure ImporterSetImageBase(ImageBase:LongInt); stdcall; external 'TitanEngine.dll' name 'ImporterSetImageBase'; + procedure ImporterSetUnknownDelta(DeltaAddress:LongInt); stdcall; external 'TitanEngine.dll' name 'ImporterSetUnknownDelta'; + function ImporterGetCurrentDelta():LongInt; stdcall; external 'TitanEngine.dll' name 'ImporterGetCurrentDelta'; + procedure ImporterInit(MemorySize,ImageBase:LongInt); stdcall; external 'TitanEngine.dll' name 'ImporterInit'; + procedure ImporterAddNewDll(DLLName:PAnsiChar; FirstThunk:LongInt); stdcall; external 'TitanEngine.dll' name 'ImporterAddNewDll'; + procedure ImporterAddNewAPI(APIName:PAnsiChar; FirstThunk:LongInt); stdcall; external 'TitanEngine.dll' name 'ImporterAddNewAPI'; + procedure ImporterAddNewOrdinalAPI(dwAPIName,FirstThunk:LongInt); stdcall; external 'TitanEngine.dll' name 'ImporterAddNewAPI'; + function ImporterGetAddedDllCount(): LongInt; stdcall; external 'TitanEngine.dll' name 'ImporterGetAddedDllCount'; + function ImporterGetAddedAPICount(): LongInt; stdcall; external 'TitanEngine.dll' name 'ImporterGetAddedAPICount'; + function ImporterGetLastAddedDLLName(): PAnsiChar; stdcall; external 'TitanEngine.dll' name 'ImporterGetLastAddedDLLName'; + procedure ImporterMoveIAT(); stdcall; external 'TitanEngine.dll' name 'ImporterMoveIAT'; + function ImporterExportIAT(StorePlace,FileMap:LongInt):boolean; stdcall; external 'TitanEngine.dll' name 'ImporterExportIAT'; + function ImporterEstimatedSize(): LongInt; stdcall; external 'TitanEngine.dll' name 'ImporterEstimatedSize'; + function ImporterExportIATEx(szExportFileName,szSectionName:PAnsiChar):boolean; stdcall; external 'TitanEngine.dll' name 'ImporterExportIATEx'; + function ImporterFindAPIWriteLocation(szAPIName:PAnsiChar): LongInt; stdcall; external 'TitanEngine.dll' name 'ImporterFindAPIWriteLocation'; + function ImporterFindOrdinalAPIWriteLocation(OrdinalNumber:LongInt): LongInt; stdcall; external 'TitanEngine.dll' name 'ImporterFindOrdinalAPIWriteLocation'; + function ImporterFindAPIByWriteLocation(APIWriteLocation:PAnsiChar): LongInt; stdcall; external 'TitanEngine.dll' name 'ImporterFindAPIByWriteLocation'; + function ImporterFindDLLByWriteLocation(APIWriteLocation:PAnsiChar): LongInt; stdcall; external 'TitanEngine.dll' name 'ImporterFindDLLByWriteLocation'; + function ImporterGetDLLName(APIAddress:LongInt): PAnsiChar; stdcall; external 'TitanEngine.dll' name 'ImporterGetDLLName'; + function ImporterGetAPIName(APIAddress:LongInt): PAnsiChar; stdcall; external 'TitanEngine.dll' name 'ImporterGetAPIName'; + function ImporterGetAPIOrdinalNumber(APIAddress:LongInt): LongInt; stdcall; external 'TitanEngine.dll' name 'ImporterGetAPIOrdinalNumber'; + function ImporterGetAPINameEx(APIAddress:LongInt; pDLLBases:Pointer): PAnsiChar; stdcall; external 'TitanEngine.dll' name 'ImporterGetAPINameEx'; + function ImporterGetRemoteAPIAddress(hProcess:THandle; APIAddress:LongInt): LongInt; stdcall; external 'TitanEngine.dll' name 'ImporterGetRemoteAPIAddress'; + function ImporterGetRemoteAPIAddressEx(szDLLName,szAPIName:PAnsiChar): LongInt; stdcall; external 'TitanEngine.dll' name 'ImporterGetRemoteAPIAddressEx'; + function ImporterGetLocalAPIAddress(hProcess:THandle; APIAddress:LongInt): LongInt; stdcall; external 'TitanEngine.dll' name 'ImporterGetLocalAPIAddress'; + function ImporterGetDLLNameFromDebugee(hProcess:THandle; APIAddress:LongInt): PAnsiChar; stdcall; external 'TitanEngine.dll' name 'ImporterGetDLLNameFromDebugee'; + function ImporterGetAPINameFromDebugee(hProcess:THandle; APIAddress:LongInt): PAnsiChar; stdcall; external 'TitanEngine.dll' name 'ImporterGetAPINameFromDebugee'; + function ImporterGetAPIOrdinalNumberFromDebugee(hProcess:THandle; APIAddress:LongInt): LongInt; stdcall; external 'TitanEngine.dll' name 'ImporterGetAPIOrdinalNumberFromDebugee'; + function ImporterGetDLLIndexEx(APIAddress:LongInt; pDLLBases:Pointer): LongInt; stdcall; external 'TitanEngine.dll' name 'ImporterGetDLLIndexEx'; + function ImporterGetDLLIndex(hProcess:THandle; APIAddress:LongInt; pDLLBases:Pointer): LongInt; stdcall; external 'TitanEngine.dll' name 'ImporterGetDLLIndex'; + function ImporterGetRemoteDLLBase(hProcess:THandle; LocalModuleBase:LongInt): LongInt; stdcall; external 'TitanEngine.dll' name 'ImporterGetRemoteDLLBase'; + function ImporterRelocateWriteLocation(AddValue:LongInt): boolean; stdcall; external 'TitanEngine.dll' name 'ImporterRelocateWriteLocation'; + function ImporterIsForwardedAPI(hProcess:THandle; APIAddress:LongInt): boolean; stdcall; external 'TitanEngine.dll' name 'ImporterIsForwardedAPI'; + function ImporterGetForwardedAPIName(hProcess:THandle; APIAddress:LongInt): PAnsiChar; stdcall; external 'TitanEngine.dll' name 'ImporterGetForwardedAPIName'; + function ImporterGetForwardedDLLName(hProcess:THandle; APIAddress:LongInt): PAnsiChar; stdcall; external 'TitanEngine.dll' name 'ImporterGetForwardedDLLName'; + function ImporterGetForwardedDLLIndex(hProcess:THandle; APIAddress:LongInt; pDLLBases:Pointer): LongInt; stdcall; external 'TitanEngine.dll' name 'ImporterGetForwardedDLLIndex'; + function ImporterGetForwardedAPIOrdinalNumber(hProcess:THandle; APIAddress:LongInt): LongInt; stdcall; external 'TitanEngine.dll' name 'ImporterGetForwardedAPIOrdinalNumber'; + function ImporterGetNearestAPIAddress(hProcess:THandle; APIAddress:LongInt): LongInt; stdcall; external 'TitanEngine.dll' name 'ImporterGetNearestAPIAddress'; + function ImporterGetNearestAPIName(hProcess:THandle; APIAddress:LongInt): PAnsiChar; stdcall; external 'TitanEngine.dll' name 'ImporterGetNearestAPIName'; + function ImporterCopyOriginalIAT(szOriginalFile,szDumpFile:PAnsiChar): boolean; stdcall; external 'TitanEngine.dll' name 'ImporterCopyOriginalIAT'; + function ImporterLoadImportTable(szFileName:PAnsiChar): boolean; stdcall; external 'TitanEngine.dll' name 'ImporterLoadImportTable'; + function ImporterMoveOriginalIAT(szOriginalFile,szDumpFile,szSectionName:PAnsiChar): boolean; stdcall; external 'TitanEngine.dll' name 'ImporterMoveOriginalIAT'; + procedure ImporterAutoSearchIAT(pFileName:PAnsiChar;ImageBase,SearchStart,SearchSize:LongInt;pIATStart,pIATSize:Pointer); stdcall; external 'TitanEngine.dll' name 'ImporterAutoSearchIAT'; + procedure ImporterAutoSearchIATEx(hProcess:LongInt;ImageBase,SearchStart,SearchSize:LongInt;pIATStart,pIATSize:Pointer); stdcall; external 'TitanEngine.dll' name 'ImporterAutoSearchIATEx'; + procedure ImporterEnumAddedData(EnumCallBack:Pointer); stdcall; external 'TitanEngine.dll' name 'ImporterEnumAddedData'; + function ImporterAutoFixIAT(hProcess:LongInt;pFileName:PAnsiChar;ImageBase,SearchStart,SearchSize,SearchStep:LongInt):LongInt; stdcall; external 'TitanEngine.dll' name 'ImporterAutoFixIAT'; + function ImporterAutoFixIATEx(hProcess:LongInt;pFileName,szSectionName:PAnsiChar;DumpRunningProcess,RealignFile:boolean;EntryPointAddress,ImageBase,SearchStart,SearchSize,SearchStep:LongInt;TryAutoFix,FixEliminations:boolean;UnknownPointerFixCallback:LongInt):LongInt; stdcall; external 'TitanEngine.dll' name 'ImporterAutoFixIATEx'; +{TitanEngine.Hooks.functions} + function HooksSafeTransitionEx(HookAddressArray:Pointer; NumberOfHooks:LongInt; TransitionStart:boolean):boolean; stdcall; external 'TitanEngine.dll' name 'HooksSafeTransitionEx'; + function HooksSafeTransition(HookAddressArray:Pointer; TransitionStart:boolean):boolean; stdcall; external 'TitanEngine.dll' name 'HooksSafeTransition'; + function HooksIsAddressRedirected(HookAddressArray:Pointer):boolean; stdcall; external 'TitanEngine.dll' name 'HooksIsAddressRedirected'; + function HooksGetTrampolineAddress(HookAddressArray:Pointer):Pointer; stdcall; external 'TitanEngine.dll' name 'HooksGetTrampolineAddress'; + function HooksGetHookEntryDetails(HookAddressArray:Pointer):Pointer; stdcall; external 'TitanEngine.dll' name 'HooksGetHookEntryDetails'; + function HooksInsertNewRedirection(HookAddressArray,RedirectTo:Pointer; HookType:LongInt):boolean; stdcall; external 'TitanEngine.dll' name 'HooksInsertNewRedirection'; + function HooksInsertNewIATRedirectionEx(FileMapVA,LoadedModuleBase:LongInt; szHookFunction:PAnsiChar; RedirectTo:Pointer):boolean; stdcall; external 'TitanEngine.dll' name 'HooksInsertNewIATRedirectionEx'; + function HooksInsertNewIATRedirection(szModuleName,szHookFunction:PAnsiChar; RedirectTo:Pointer):boolean; stdcall; external 'TitanEngine.dll' name 'HooksInsertNewIATRedirection'; + function HooksRemoveRedirection(HookAddressArray:Pointer; RemoveAll:boolean):boolean; stdcall; external 'TitanEngine.dll' name 'HooksRemoveRedirection'; + function HooksRemoveRedirectionsForModule(ModuleBase:LongInt):boolean; stdcall; external 'TitanEngine.dll' name 'HooksRemoveRedirectionsForModule'; + function HooksDisableRedirection(HookAddressArray:Pointer; DisableAll:boolean):boolean; stdcall; external 'TitanEngine.dll' name 'HooksDisableRedirection'; + function HooksDisableRedirectionsForModule(ModuleBase:LongInt):boolean; stdcall; external 'TitanEngine.dll' name 'HooksDisableRedirectionsForModule'; + function HooksEnableRedirection(HookAddressArray:Pointer; EnableAll:boolean):boolean; stdcall; external 'TitanEngine.dll' name 'HooksEnableRedirection'; + function HooksEnableRedirectionsForModule(ModuleBase:LongInt):boolean; stdcall; external 'TitanEngine.dll' name 'HooksEnableRedirectionsForModule'; + function HooksRemoveIATRedirection(szModuleName,szHookFunction:PAnsiChar; RemoveAll:boolean):boolean; stdcall; external 'TitanEngine.dll' name 'HooksRemoveIATRedirection'; + function HooksDisableIATRedirection(szModuleName,szHookFunction:PAnsiChar; DisableAll:boolean):boolean; stdcall; external 'TitanEngine.dll' name 'HooksDisableIATRedirection'; + function HooksEnableIATRedirection(szModuleName,szHookFunction:PAnsiChar; EnableAll:boolean):boolean; stdcall; external 'TitanEngine.dll' name 'HooksEnableIATRedirection'; + procedure HooksScanModuleMemory(ModuleBase:LongInt; CallBack:Pointer); stdcall; external 'TitanEngine.dll' name 'HooksScanModuleMemory'; + procedure HooksScanEntireProcessMemory(CallBack:Pointer); stdcall; external 'TitanEngine.dll' name 'HooksScanEntireProcessMemory'; + procedure HooksScanEntireProcessMemoryEx(); stdcall; external 'TitanEngine.dll' name 'HooksScanEntireProcessMemoryEx'; +{TitanEngine.Tracer.functions} + procedure TracerInit(); stdcall; external 'TitanEngine.dll' name 'TracerInit'; + function TracerLevel1(hProcess,APIAddress:LongInt):LongInt; stdcall; external 'TitanEngine.dll' name 'TracerLevel1'; + function HashTracerLevel1(hProcess,APIAddress,NumberOfInstructions:LongInt):LongInt; stdcall; external 'TitanEngine.dll' name 'HashTracerLevel1'; + function TracerDetectRedirection(hProcess,APIAddress:LongInt):LongInt; stdcall; external 'TitanEngine.dll' name 'TracerDetectRedirection'; + function TracerFixKnownRedirection(hProcess,APIAddress,RedirectionId:LongInt):LongInt; stdcall; external 'TitanEngine.dll' name 'TracerFixKnownRedirection'; + function TracerFixRedirectionViaImpRecPlugin(hProcess:LongInt;szPluginName:PAnsiChar;APIAddress:LongInt):LongInt; stdcall; external 'TitanEngine.dll' name 'TracerFixRedirectionViaImpRecPlugin'; +{TitanEngine.Exporter.functions} + procedure ExporterCleanup(); stdcall; external 'TitanEngine.dll' name 'ExporterCleanup'; + procedure ExporterSetImageBase(ImageBase:LongInt); stdcall; external 'TitanEngine.dll' name 'ExporterSetImageBase'; + procedure ExporterInit(MemorySize,ImageBase,ExportOrdinalBase:LongInt; szExportModuleName:PAnsiChar); stdcall; external 'TitanEngine.dll' name 'ExporterInit'; + function ExporterAddNewExport(szExportName:PAnsiChar; ExportRelativeAddress:LongInt):boolean; stdcall; external 'TitanEngine.dll' name 'ExporterAddNewExport'; + function ExporterAddNewOrdinalExport(OrdinalNumber,ExportRelativeAddress:LongInt):boolean; stdcall; external 'TitanEngine.dll' name 'ExporterAddNewOrdinalExport'; + function ExporterGetAddedExportCount():LongInt; stdcall; external 'TitanEngine.dll' name 'ExporterGetAddedExportCount'; + function ExporterEstimatedSize():LongInt; stdcall; external 'TitanEngine.dll' name 'ExporterEstimatedSize'; + function ExporterBuildExportTable(StorePlace,FileMapVA:LongInt):boolean; stdcall; external 'TitanEngine.dll' name 'ExporterBuildExportTable'; + function ExporterBuildExportTableEx(szExportFileName,szSectionName:PAnsiChar):boolean; stdcall; external 'TitanEngine.dll' name 'ExporterBuildExportTableEx'; + function ExporterLoadExportTable(szFileName:PAnsiChar):boolean; stdcall; external 'TitanEngine.dll' name 'ExporterLoadExportTable'; +{TitanEngine.Librarian.functions} + function LibrarianSetBreakPoint(szLibraryName:PAnsiChar; bpxType:LongInt; SingleShoot:boolean; bpxCallBack:Pointer):boolean; stdcall; external 'TitanEngine.dll' name 'LibrarianSetBreakPoint'; + function LibrarianRemoveBreakPoint(szLibraryName:PAnsiChar; bpxType:LongInt):boolean; stdcall; external 'TitanEngine.dll' name 'LibrarianRemoveBreakPoint'; + function LibrarianGetLibraryInfo(szLibraryName:PAnsiChar):Pointer; stdcall; external 'TitanEngine.dll' name 'LibrarianGetLibraryInfo'; + function LibrarianGetLibraryInfoEx(BaseOfDll:Pointer):Pointer; stdcall; external 'TitanEngine.dll' name 'LibrarianGetLibraryInfoEx'; + procedure LibrarianEnumLibraryInfo(BaseOfDll:Pointer); stdcall; external 'TitanEngine.dll' name 'LibrarianEnumLibraryInfo'; +{TitanEngine.Process.functions} + function GetActiveProcessId(szImageName:PAnsiChar):LongInt; stdcall; external 'TitanEngine.dll' name 'GetActiveProcessId'; + function EnumProcessesWithLibrary(szLibraryName:PAnsiChar; EnumFunction:Pointer):LongInt; stdcall; external 'TitanEngine.dll' name 'EnumProcessesWithLibrary'; +{TitanEngine.TLSFixer.functions} + function TLSBreakOnCallBack(ArrayOfCallBacks:Pointer; NumberOfCallBacks:LongInt; bpxCallBack:Pointer):boolean; stdcall; external 'TitanEngine.dll' name 'TLSBreakOnCallBack'; + function TLSGrabCallBackData(szFileName:PAnsiChar; ArrayOfCallBacks,NumberOfCallBacks:Pointer):boolean; stdcall; external 'TitanEngine.dll' name 'TLSGrabCallBackData'; + function TLSBreakOnCallBackEx(szFileName:PAnsiChar; bpxCallBack:Pointer):boolean; stdcall; external 'TitanEngine.dll' name 'TLSBreakOnCallBackEx'; + function TLSRemoveCallback(szFileName:PAnsiChar):boolean; stdcall; external 'TitanEngine.dll' name 'TLSRemoveCallback'; + function TLSRemoveTable(szFileName:PAnsiChar):boolean; stdcall; external 'TitanEngine.dll' name 'TLSRemoveTable'; + function TLSBackupData(szFileName:PAnsiChar):boolean; stdcall; external 'TitanEngine.dll' name 'TLSBackupData'; + function TLSRestoreData():boolean; stdcall; external 'TitanEngine.dll' name 'TLSRestoreData'; + function TLSBuildNewTable(FileMapVA,StorePlace,StorePlaceRVA:LongInt; ArrayOfCallBacks:Pointer; NumberOfCallBacks:LongInt):boolean; stdcall; external 'TitanEngine.dll' name 'TLSBuildNewTable'; + function TLSBuildNewTableEx(szFileName,szSectionName:PAnsiChar; ArrayOfCallBacks:Pointer; NumberOfCallBacks:LongInt):boolean; stdcall; external 'TitanEngine.dll' name 'TLSBuildNewTableEx'; +{TitanEngine.TranslateName.functions} + function TranslateNativeName(szNativeName:PAnsiChar):PAnsiChar; stdcall; external 'TitanEngine.dll' name 'TranslateNativeName'; +{TitanEngine.Handler.functions} + function HandlerGetActiveHandleCount(ProcessId:LongInt):LongInt; stdcall; external 'TitanEngine.dll' name 'HandlerGetActiveHandleCount'; + function HandlerIsHandleOpen(ProcessId:LongInt; hHandle:THandle):boolean; stdcall; external 'TitanEngine.dll' name 'HandlerIsHandleOpen'; + function HandlerGetHandleName(hProcess:THandle; ProcessId:LongInt; hHandle:THandle; TranslateName:boolean):PAnsiChar; stdcall; external 'TitanEngine.dll' name 'HandlerGetHandleName'; + function HandlerEnumerateOpenHandles(ProcessId:LongInt; HandleBuffer:Pointer; MaxHandleCount:LongInt):LongInt; stdcall; external 'TitanEngine.dll' name 'HandlerEnumerateOpenHandles'; + function HandlerGetHandleDetails(hProcess:THandle; ProcessId:LongInt; hHandle:THandle; InformationReturn:LongInt):LongInt; stdcall; external 'TitanEngine.dll' name 'HandlerGetHandleDetails'; + function HandlerCloseRemoteHandle(ProcessId:LongInt; hHandle:THandle):boolean; stdcall; external 'TitanEngine.dll' name 'HandlerCloseRemoteHandle'; + function HandlerEnumerateLockHandles(szFileOrFolderName:PAnsiChar; NameIsFolder,NameIsTranslated:boolean; HandleDataBuffer:Pointer; MaxHandleCount:LongInt):LongInt; stdcall; external 'TitanEngine.dll' name 'HandlerEnumerateLockHandles'; + function HandlerCloseAllLockHandles(szFileOrFolderName:PAnsiChar; NameIsFolder,NameIsTranslated:boolean):boolean; stdcall; external 'TitanEngine.dll' name 'HandlerCloseAllLockHandles'; + function HandlerIsFileLocked(szFileOrFolderName:PAnsiChar; NameIsFolder,NameIsTranslated:boolean):boolean; stdcall; external 'TitanEngine.dll' name 'HandlerIsFileLocked'; + function HandlerEnumerateOpenMutexes(hProcess:THandle; ProcessId:LongInt; HandleBuffer:Pointer; MaxHandleCount:LongInt):LongInt; stdcall; external 'TitanEngine.dll' name 'HandlerEnumerateOpenMutexes'; + function HandlerGetOpenMutexHandle(hProcess:THandle; ProcessId:LongInt; szMutexString:PAnsiChar):LongInt; stdcall; external 'TitanEngine.dll' name 'HandlerGetOpenMutexHandle'; + function HandlerGetProcessIdWhichCreatedMutex(szMutexString:PAnsiChar):LongInt; stdcall; external 'TitanEngine.dll' name 'HandlerGetProcessIdWhichCreatedMutex'; +{TitanEngine.Injector.functions} + function RemoteLoadLibrary(hProcess:THandle; szLibraryFile:PAnsiChar; WaitForThreadExit:boolean):boolean; stdcall; external 'TitanEngine.dll' name 'RemoteLoadLibrary'; + function RemoteFreeLibrary(hProcess:THandle; hModule:LongInt; szLibraryFile:PAnsiChar; WaitForThreadExit:boolean):boolean; stdcall; external 'TitanEngine.dll' name 'RemoteFreeLibrary'; + function RemoteExitProcess(hProcess:THandle; ExitCode:LongInt):boolean; stdcall; external 'TitanEngine.dll' name 'RemoteExitProcess'; +{TitanEngine.StaticUnpacker.functions} + function StaticFileLoad(szFileName:PAnsiChar; DesiredAccess:LongInt; SimulateLoad:boolean; FileHandle,LoadedSize,FileMap,FileMapVA:Pointer):boolean; stdcall; external 'TitanEngine.dll' name 'StaticFileLoad'; + function StaticFileUnload(szFileName:PAnsiChar; CommitChanges:boolean; FileHandle,LoadedSize,FileMap,FileMapVA:LongInt):boolean; stdcall; external 'TitanEngine.dll' name 'StaticFileUnload'; + function StaticFileOpen(szFileName:PAnsiChar; DesiredAccess:LongInt; FileHandle,FileSizeLow,FileSizeHigh:Pointer):boolean; stdcall; external 'TitanEngine.dll' name 'StaticFileOpen'; + function StaticFileGetContent(FileHandle:THandle; FilePositionLow:LongInt; FilePositionHigh,Buffer:Pointer; Size:LongInt):boolean; stdcall; external 'TitanEngine.dll' name 'StaticFileGetContent'; + procedure StaticFileClose(FileHandle:THandle); stdcall; external 'TitanEngine.dll' name 'StaticFileClose'; + procedure StaticMemoryDecrypt(MemoryStart,MemorySize,DecryptionType,DecryptionKeySize,DecryptionKey:LongInt); stdcall; external 'TitanEngine.dll' name 'StaticMemoryDecrypt'; + procedure StaticMemoryDecryptEx(MemoryStart,MemorySize,DecryptionKeySize:LongInt; DecryptionCallBack:Pointer); stdcall; external 'TitanEngine.dll' name 'StaticMemoryDecryptEx'; + procedure StaticMemoryDecryptSpecial(MemoryStart,MemorySize,DecryptionKeySize,SpecDecryptionType:LongInt; DecryptionCallBack:Pointer); stdcall; external 'TitanEngine.dll' name 'StaticMemoryDecryptSpecial'; + procedure StaticSectionDecrypt(FileMapVA,SectionNumber:LongInt; SimulateLoad:boolean; DecryptionType,DecryptionKeySize,DecryptionKey:LongInt); stdcall; external 'TitanEngine.dll' name 'StaticSectionDecrypt'; + function StaticMemoryDecompress(Source,SourceSize,Destination,DestinationSize,Algorithm:LongInt):boolean; stdcall; external 'TitanEngine.dll' name 'StaticMemoryDecompress'; + function StaticRawMemoryCopy(hFile:THandle; FileMapVA,VitualAddressToCopy,Size:LongInt; AddressIsRVA:boolean; szDumpFileName:PAnsiChar):boolean; stdcall; external 'TitanEngine.dll' name 'StaticRawMemoryCopy'; + function StaticHashMemory(MemoryToHash:Pointer; SizeOfMemory:LongInt; HashDigest:Pointer; OutputString:boolean; Algorithm:LongInt):boolean; stdcall; external 'TitanEngine.dll' name 'StaticHashMemory'; + function StaticHashFile(szFileName,HashDigest:PAnsiChar; OutputString:boolean; Algorithm:LongInt):boolean; stdcall; external 'TitanEngine.dll' name 'StaticHashFile'; +{TitanEngine.Engine.functions} + procedure SetEngineVariable(VariableId:LongInt; VariableSet:boolean); stdcall; external 'TitanEngine.dll' name 'SetEngineVariable'; + function EngineCreateMissingDependencies(szFileName,szOutputFolder:PAnsiChar; LogCreatedFiles:boolean):boolean; stdcall; external 'TitanEngine.dll' name 'EngineCreateMissingDependencies'; + function EngineFakeMissingDependencies(hProcess:THandle):boolean; stdcall; external 'TitanEngine.dll' name 'EngineCreateMissingDependencies'; + function EngineDeleteCreatedDependencies():boolean; stdcall; external 'TitanEngine.dll' name 'EngineDeleteCreatedDependencies'; + function EngineCreateUnpackerWindow(WindowUnpackerTitle,WindowUnpackerLongTitleWindowUnpackerName,WindowUnpackerAuthor:PChar; StartUnpackingCallBack:Pointer):boolean; stdcall; external 'TitanEngine.dll' name 'EngineCreateUnpackerWindow'; + procedure EngineAddUnpackerWindowLogMessage(szLogMessage:PChar); stdcall; external 'TitanEngine.dll' name 'EngineAddUnpackerWindowLogMessage'; +{TitanEngine.Extension.functions} + function ExtensionManagerIsPluginLoaded(szPluginName:PAnsiChar):boolean; stdcall; external 'TitanEngine.dll' name 'ExtensionManagerIsPluginLoaded'; + function ExtensionManagerIsPluginEnabled(szPluginName:PAnsiChar):boolean; stdcall; external 'TitanEngine.dll' name 'ExtensionManagerIsPluginEnabled'; + function ExtensionManagerDisableAllPlugins():boolean; stdcall; external 'TitanEngine.dll' name 'ExtensionManagerDisableAllPlugins'; + function ExtensionManagerDisablePlugin(szPluginName:PAnsiChar):boolean; stdcall; external 'TitanEngine.dll' name 'ExtensionManagerDisablePlugin'; + function ExtensionManagerEnableAllPlugins():boolean; stdcall; external 'TitanEngine.dll' name 'ExtensionManagerEnableAllPlugins'; + function ExtensionManagerEnablePlugin(szPluginName:PAnsiChar):boolean; stdcall; external 'TitanEngine.dll' name 'ExtensionManagerEnablePlugin'; + function ExtensionManagerUnloadAllPlugins():boolean; stdcall; external 'TitanEngine.dll' name 'ExtensionManagerUnloadAllPlugins'; + function ExtensionManagerUnloadPlugin(szPluginName:PAnsiChar):boolean; stdcall; external 'TitanEngine.dll' name 'ExtensionManagerUnloadPlugin'; + function ExtensionManagerGetPluginInfo(szPluginName:PAnsiChar):Pointer; stdcall; external 'TitanEngine.dll' name 'ExtensionManagerGetPluginInfo'; + +implementation + +end. diff --git a/SDK/LUA/TitanEngine.lua b/SDK/LUA/TitanEngine.lua new file mode 100644 index 0000000..9873d14 --- /dev/null +++ b/SDK/LUA/TitanEngine.lua @@ -0,0 +1,1486 @@ +require 'alien' +local TitanEngine = alien.load 'TitanEngine.dll' +local SystemKernel = alien.load 'kernel32.dll' + +-- +-- +-- TitanEngine 2.0.3 LUA SDK / www.reversinglabs.com +-- +-- + +-- Windows.Constants: + +MAX_PATH = 260 + +-- Global.Constant.Structure.Declaration: +-- Engine.External: +UE_ACCESS_READ = 0 +UE_ACCESS_WRITE = 1 +UE_ACCESS_ALL = 2 + +UE_HIDE_BASIC = 1 + +UE_PLUGIN_CALL_REASON_PREDEBUG = 1 +UE_PLUGIN_CALL_REASON_EXCEPTION = 2 +UE_PLUGIN_CALL_REASON_POSTDEBUG = 3 + +TEE_HOOK_NRM_JUMP = 1 +TEE_HOOK_NRM_CALL = 3 +TEE_HOOK_IAT = 5 + +UE_ENGINE_ALOW_MODULE_LOADING = 1 +UE_ENGINE_AUTOFIX_FORWARDERS = 2 +UE_ENGINE_PASS_ALL_EXCEPTIONS = 3 +UE_ENGINE_NO_CONSOLE_WINDOW = 4 +UE_ENGINE_BACKUP_FOR_CRITICAL_FUNCTIONS = 5 +UE_ENGINE_CALL_PLUGIN_CALLBACK = 6 +UE_ENGINE_RESET_CUSTOM_HANDLER = 7 +UE_ENGINE_CALL_PLUGIN_DEBUG_CALLBACK = 8 + +UE_OPTION_REMOVEALL = 1 +UE_OPTION_DISABLEALL = 2 +UE_OPTION_REMOVEALLDISABLED = 3 +UE_OPTION_REMOVEALLENABLED = 4 + +UE_STATIC_DECRYPTOR_XOR = 1 +UE_STATIC_DECRYPTOR_SUB = 2 +UE_STATIC_DECRYPTOR_ADD = 3 + +UE_STATIC_DECRYPTOR_FOREWARD = 1 +UE_STATIC_DECRYPTOR_BACKWARD = 2 + +UE_STATIC_KEY_SIZE_1 = 1 +UE_STATIC_KEY_SIZE_2 = 2 +UE_STATIC_KEY_SIZE_4 = 4 +UE_STATIC_KEY_SIZE_8 = 8 + +UE_STATIC_APLIB = 1 +UE_STATIC_APLIB_DEPACK = 2 +UE_STATIC_LZMA = 3 + +UE_STATIC_HASH_MD5 = 1 +UE_STATIC_HASH_SHA1 = 2 +UE_STATIC_HASH_CRC32 = 3 + +UE_RESOURCE_LANGUAGE_ANY = -1 + +UE_PE_OFFSET = 0 +UE_IMAGEBASE = 1 +UE_OEP = 2 +UE_SIZEOFIMAGE = 3 +UE_SIZEOFHEADERS = 4 +UE_SIZEOFOPTIONALHEADER = 5 +UE_SECTIONALIGNMENT = 6 +UE_IMPORTTABLEADDRESS = 7 +UE_IMPORTTABLESIZE = 8 +UE_RESOURCETABLEADDRESS = 9 +UE_RESOURCETABLESIZE = 10 +UE_EXPORTTABLEADDRESS = 11 +UE_EXPORTTABLESIZE = 12 +UE_TLSTABLEADDRESS = 13 +UE_TLSTABLESIZE = 14 +UE_RELOCATIONTABLEADDRESS = 15 +UE_RELOCATIONTABLESIZE = 16 +UE_TIMEDATESTAMP = 17 +UE_SECTIONNUMBER = 18 +UE_CHECKSUM = 19 +UE_SUBSYSTEM = 20 +UE_CHARACTERISTICS = 21 +UE_NUMBEROFRVAANDSIZES = 22 +UE_SECTIONNAME = 23 +UE_SECTIONVIRTUALOFFSET = 24 +UE_SECTIONVIRTUALSIZE = 25 +UE_SECTIONRAWOFFSET = 26 +UE_SECTIONRAWSIZE = 27 +UE_SECTIONFLAGS = 28 + +UE_CH_BREAKPOINT = 1 +UE_CH_SINGLESTEP = 2 +UE_CH_ACCESSVIOLATION = 3 +UE_CH_ILLEGALINSTRUCTION = 4 +UE_CH_NONCONTINUABLEEXCEPTION = 5 +UE_CH_ARRAYBOUNDSEXCEPTION = 6 +UE_CH_FLOATDENORMALOPERAND = 7 +UE_CH_FLOATDEVIDEBYZERO = 8 +UE_CH_INTEGERDEVIDEBYZERO = 9 +UE_CH_INTEGEROVERFLOW = 10 +UE_CH_PRIVILEGEDINSTRUCTION = 11 +UE_CH_PAGEGUARD = 12 +UE_CH_EVERYTHINGELSE = 13 +UE_CH_CREATETHREAD = 14 +UE_CH_EXITTHREAD = 15 +UE_CH_CREATEPROCESS = 16 +UE_CH_EXITPROCESS = 17 +UE_CH_LOADDLL = 18 +UE_CH_UNLOADDLL = 19 +UE_CH_OUTPUTDEBUGSTRING = 20 +UE_CH_AFTEREXCEPTIONPROCESSING = 21 +UE_CH_ALLEVENTS = 22 + +UE_OPTION_HANDLER_RETURN_HANDLECOUNT = 1 +UE_OPTION_HANDLER_RETURN_ACCESS = 2 +UE_OPTION_HANDLER_RETURN_FLAGS = 3 +UE_OPTION_HANDLER_RETURN_TYPENAME = 4 + +UE_BREAKPOINT_INT3 = 1 +UE_BREAKPOINT_LONG_INT3 = 2 +UE_BREAKPOINT_UD2 = 3 + +UE_BPXREMOVED = 0 +UE_BPXACTIVE = 1 +UE_BPXINACTIVE = 2 + +UE_BREAKPOINT = 0 +UE_SINGLESHOOT = 1 +UE_HARDWARE = 2 +UE_MEMORY = 3 +UE_MEMORY_READ = 4 +UE_MEMORY_WRITE = 5 +UE_BREAKPOINT_TYPE_INT3 = 0x10000000 +UE_BREAKPOINT_TYPE_LONG_INT3 = 0x20000000 +UE_BREAKPOINT_TYPE_UD2 = 0x30000000 + +UE_HARDWARE_EXECUTE = 4 +UE_HARDWARE_WRITE = 5 +UE_HARDWARE_READWRITE = 6 + +UE_HARDWARE_SIZE_1 = 7 +UE_HARDWARE_SIZE_2 = 8 +UE_HARDWARE_SIZE_4 = 9 + +UE_ON_LIB_LOAD = 1 +UE_ON_LIB_UNLOAD = 2 +UE_ON_LIB_ALL = 3 + +UE_APISTART = 0 +UE_APIEND = 1 + +UE_PLATFORM_x86 = 1 +UE_PLATFORM_x64 = 2 +UE_PLATFORM_ALL = 3 + +UE_FUNCTION_STDCALL = 1 +UE_FUNCTION_CCALL = 2 +UE_FUNCTION_FASTCALL = 3 +UE_FUNCTION_STDCALL_RET = 4 +UE_FUNCTION_CCALL_RET = 5 +UE_FUNCTION_FASTCALL_RET = 6 +UE_FUNCTION_STDCALL_CALL = 7 +UE_FUNCTION_CCALL_CALL = 8 +UE_FUNCTION_FASTCALL_CALL = 9 +UE_PARAMETER_BYTE = 0 +UE_PARAMETER_WORD = 1 +UE_PARAMETER_DWORD = 2 +UE_PARAMETER_QWORD = 3 +UE_PARAMETER_PTR_BYTE = 4 +UE_PARAMETER_PTR_WORD = 5 +UE_PARAMETER_PTR_DWORD = 6 +UE_PARAMETER_PTR_QWORD = 7 +UE_PARAMETER_STRING = 8 +UE_PARAMETER_UNICODE = 9 + +UE_CMP_NOCONDITION = 0 +UE_CMP_EQUAL = 1 +UE_CMP_NOTEQUAL = 2 +UE_CMP_GREATER = 3 +UE_CMP_GREATEROREQUAL = 4 +UE_CMP_LOWER = 5 +UE_CMP_LOWEROREQUAL = 6 +UE_CMP_REG_EQUAL = 7 +UE_CMP_REG_NOTEQUAL = 8 +UE_CMP_REG_GREATER = 9 +UE_CMP_REG_GREATEROREQUAL = 10 +UE_CMP_REG_LOWER = 11 +UE_CMP_REG_LOWEROREQUAL = 12 +UE_CMP_ALWAYSFALSE = 13 + +UE_EAX = 1 +UE_EBX = 2 +UE_ECX = 3 +UE_EDX = 4 +UE_EDI = 5 +UE_ESI = 6 +UE_EBP = 7 +UE_ESP = 8 +UE_EIP = 9 +UE_EFLAGS = 10 +UE_DR0 = 11 +UE_DR1 = 12 +UE_DR2 = 13 +UE_DR3 = 14 +UE_DR6 = 15 +UE_DR7 = 16 +UE_RAX = 17 +UE_RBX = 18 +UE_RCX = 19 +UE_RDX = 20 +UE_RDI = 21 +UE_RSI = 22 +UE_RBP = 23 +UE_RSP = 24 +UE_RIP = 25 +UE_RFLAGS = 26 +UE_R8 = 27 +UE_R9 = 28 +UE_R10 = 29 +UE_R11 = 30 +UE_R12 = 31 +UE_R13 = 32 +UE_R14 = 33 +UE_R15 = 34 +UE_CIP = 35 +UE_CSP = 36 +UE_SEG_GS = 37 +UE_SEG_FS = 38 +UE_SEG_ES = 39 +UE_SEG_DS = 40 +UE_SEG_CS = 41 +UE_SEG_SS = 42 + +PE32Struct = alien.defstruct{ + { "PE32Offset", "long" }, + { "ImageBase", "long" }, + { "OriginalEntryPoint", "long" }, + { "NtSizeOfImage", "long" }, + { "NtSizeOfHeaders", "long" }, + { "SizeOfOptionalHeaders", "short" }, + { "FileAlignment", "long" }, + { "SectionAligment", "long" }, + { "ImportTableAddress", "long" }, + { "ImportTableSize", "long" }, + { "ResourceTableAddress", "long" }, + { "ResourceTableSize", "long" }, + { "ExportTableAddress", "long" }, + { "ExportTableSize", "long" }, + { "TLSTableAddress", "long" }, + { "TLSTableSize", "long" }, + { "RelocationTableAddress", "long" }, + { "RelocationTableSize", "long" }, + { "TimeDateStamp", "long" }, + { "SectionNumber", "short" }, + { "CheckSum", "long" }, + { "SubSystem", "short" }, + { "Characteristics", "short" }, + { "NumberOfRvaAndSizes", "long" } +} + +ImportEnumData = alien.defstruct{ + { "NewDll", "byte"}, + { "NumberOfImports", "long"}, + { "ImageBase", "long"}, + { "BaseImportThunk", "long"}, + { "ImportThunk", "long"}, + { "APIName", "string"}, + { "DLLName", "string"} +} + +THREAD_ITEM_DATA = alien.defstruct{ + { "hThread", "long" }, + { "dwThreadId", "long" }, + { "ThreadStartAddress", "long" }, + { "ThreadLocalBase", "long" } +} + +LIBRARY_ITEM_DATA = alien.defstruct{ + { "hFile", "long" }, + { "BaseOfDll", "long" }, + { "hFileMapping", "long" }, + { "hFileMappingView", "long" }, + { "additionalFields", "char" } +} +LIBRARY_ITEM_DATA.size = LIBRARY_ITEM_DATA.size + 2 * MAX_PATH - 1 + +-- Auxiliary LUA functions +function LibraryItemData_GetLibraryPath(lid) + local out = {} + local offset = lid.offsets.additionalFields + local buf = lf() + for i = offset, offset+MAX_PATH-1 do + local c = buf:get(i, "char") + if c ~= 0 then + out[#out+1] = string.char(c) + else + break + end + end + return table.concat(out) +end + +function LibraryItemData_GetLibraryName(lid) + local out = {} + local offset = lid.offsets.additionalFields + MAX_PATH + local buf = lf() + for i = offset, offset+MAX_PATH-1 do + local c = buf:get(i, "char") + if c ~= 0 then + out[#out+1] = string.char(c) + else + break + end + end + return table.concat(out) +end +-- Auxiliary LUA functions + +PROCESS_ITEM_DATA = alien.defstruct{ + { "hProcess", "long" }, + { "dwProcessId", "long" }, + { "hThread", "long" }, + { "dwThreadId", "long" }, + { "hFile", "long" }, + { "BaseOfImage", "long" }, + { "ThreadStartAddress", "long" }, + { "ThreadLocalBase", "long" } +} + +HandlerArray = alien.defstruct{ + { "ProcessId", "long" }, + { "hHandle", "long" } +} + +PluginInformation = alien.defstruct{ + { "PluginName", "byte" }, + { "PluginMajorVersion", "long" }, + { "PluginMinorVersion", "long" }, + { "PluginBaseAddress", "long" }, + { "TitanDebuggingCallBack", "long" }, + { "TitanRegisterPlugin", "long" }, + { "TitanReleasePlugin", "long" }, + { "TitanResetPlugin", "long" }, + { "PluginDisabled", "byte" } +} + +TEE_MAXIMUM_HOOK_SIZE = 14 +TEE_MAXIMUM_HOOK_RELOCS = 7 + +UE_DEPTH_SURFACE = 0 +UE_DEPTH_DEEP = 1 + +UE_UNPACKER_CONDITION_SEARCH_FROM_EP = 1 + +UE_UNPACKER_CONDITION_LOADLIBRARY = 1 +UE_UNPACKER_CONDITION_GETPROCADDRESS = 2 +UE_UNPACKER_CONDITION_ENTRYPOINTBREAK = 3 +UE_UNPACKER_CONDITION_RELOCSNAPSHOT1 = 4 +UE_UNPACKER_CONDITION_RELOCSNAPSHOT2 = 5 + +UE_FIELD_OK = 0 +UE_FIELD_BROKEN_NON_FIXABLE = 1 +UE_FIELD_BROKEN_NON_CRITICAL = 2 +UE_FIELD_BROKEN_FIXABLE_FOR_STATIC_USE = 3 +UE_FIELD_BROKEN_BUT_CAN_BE_EMULATED = 4 +UE_FILED_FIXABLE_NON_CRITICAL = 5 +UE_FILED_FIXABLE_CRITICAL = 6 +UE_FIELD_NOT_PRESET = 7 +UE_FIELD_NOT_PRESET_WARNING = 8 + +UE_RESULT_FILE_OK = 10 +UE_RESULT_FILE_INVALID_BUT_FIXABLE = 11 +UE_RESULT_FILE_INVALID_AND_NON_FIXABLE = 12 +UE_RESULT_FILE_INVALID_FORMAT = 13 + +FILE_STATUS_INFO = alien.defstruct{ + { "OveralEvaluation", "byte" }, + { "EvaluationTerminatedByException", "byte" }, + { "FileIs64Bit", "byte" }, + { "FileIsDLL", "byte" }, + { "FileIsConsole", "byte" }, + { "MissingDependencies", "byte" }, + { "MissingDeclaredAPIs", "byte" }, + { "SignatureMZ", "byte" }, + { "SignaturePE", "byte" }, + { "EntryPoint", "byte" }, + { "ImageBase", "byte" }, + { "SizeOfImage", "byte" }, + { "FileAlignment", "byte" }, + { "SectionAlignment", "byte" }, + { "ExportTable", "byte" }, + { "RelocationTable", "byte" }, + { "ImportTable", "byte" }, + { "ImportTableSection", "byte" }, + { "ImportTableData", "byte" }, + { "IATTable", "byte" }, + { "TLSTable", "byte" }, + { "LoadConfigTable", "byte" }, + { "BoundImportTable", "byte" }, + { "COMHeaderTable", "byte" }, + { "ResourceTable", "byte" }, + { "ResourceData", "byte" }, + { "SectionTable", "byte" } +} + +FILE_FIX_INFO = alien.defstruct{ + { "OveralEvaluation", "byte" }, + { "FixingTerminatedByException", "byte" }, + { "FileFixPerformed", "byte" }, + { "StrippedRelocation", "byte" }, + { "DontFixRelocations", "byte" }, + { "OriginalRelocationTableAddress", "long" }, + { "OriginalRelocationTableSize", "long" }, + { "StrippedExports", "byte" }, + { "DontFixExports", "byte" }, + { "OriginalExportTableAddress", "long" }, + { "OriginalExportTableSize", "long" }, + { "StrippedResources", "byte" }, + { "DontFixResources", "byte" }, + { "OriginalResourceTableAddress", "long" }, + { "OriginalResourceTableSize", "long" }, + { "StrippedTLS", "byte" }, + { "DontFixTLS", "byte" }, + { "OriginalTLSTableAddress", "long" }, + { "OriginalTLSTableSize", "long" }, + { "StrippedLoadConfig", "byte" }, + { "DontFixLoadConfig", "byte" }, + { "OriginalLoadConfigTableAddress", "long" }, + { "OriginalLoadConfigTableSize", "long" }, + { "StrippedBoundImports", "byte" }, + { "DontFixBoundImports", "byte" }, + { "OriginalBoundImportTableAddress", "long" }, + { "OriginalBoundImportTableSize", "long" }, + { "StrippedIAT", "byte" }, + { "DontFixIAT", "byte" }, + { "OriginalImportAddressTableAddress", "long" }, + { "OriginalImportAddressTableSize", "long" }, + { "StrippedCOM", "byte" }, + { "DontFixCOM", "byte" }, + { "OriginalCOMTableAddress", "long" }, + { "OriginalCOMTableSize", "long" } +} + +-- Global.UtilFunction.Declaration: + SystemKernel.CopyFileA:types {"string","string","long",abi="stdcall",ret="byte"} + TE_CopyFileA = SystemKernel.CopyFileA + SystemKernel.DeleteFileA:types {"string",abi="stdcall",ret="byte"} + TE_DeleteFileA = SystemKernel.DeleteFileA + SystemKernel.RtlMoveMemory:types {"pointer","pointer","long",abi="stdcall"} + TE_RtlMoveMemory = SystemKernel.RtlMoveMemory + SystemKernel.RtlZeroMemory:types {"pointer","long",abi="stdcall"} + TE_RtlZeroMemory = SystemKernel.RtlZeroMemory + SystemKernel.FreeLibrary:types {"long",abi="stdcall",ret="byte"} + TE_FreeLibrary = SystemKernel.FreeLibrary + +-- Global.UtilStructure.Declaration: +PROCESS_INFORMATION = alien.defstruct{ + { "hProcess", "long" }, + { "hThread", "long" }, + { "dwProcessId", "long" }, + { "dwThreadId", "long" } +} + +-- Global.UtilVariable.Declaration: + TE_TRUE = 1 + TE_FALSE = 0 + +-- Global.Function.Declaration: +-- +-- TitanEngine.Dumper.functions: +-- +-- __declspec(dllexport) bool __stdcall DumpProcess(HANDLE hProcess, LPVOID ImageBase, char* szDumpFileName, ULONG_PTR EntryPoint); + TitanEngine.DumpProcess:types {"long","long","string","long",abi="stdcall",ret="byte"} + TE_DumpProcess = TitanEngine.DumpProcess +-- __declspec(dllexport) bool __stdcall DumpProcessEx(DWORD ProcessId, LPVOID ImageBase, char* szDumpFileName, ULONG_PTR EntryPoint); + TitanEngine.DumpProcessEx:types {"long","long","string","long",abi="stdcall",ret="byte"} + TE_DumpProcessEx = TitanEngine.DumpProcessEx +-- __declspec(dllexport) bool __stdcall DumpMemory(HANDLE hProcess, LPVOID MemoryStart, ULONG_PTR MemorySize, char* szDumpFileName); + TitanEngine.DumpMemory:types {"long","long","long","string",abi="stdcall",ret="byte"} + TE_DumpMemory = TitanEngine.DumpMemory +-- __declspec(dllexport) bool __stdcall DumpMemoryEx(DWORD ProcessId, LPVOID MemoryStart, ULONG_PTR MemorySize, char* szDumpFileName); + TitanEngine.DumpMemoryEx:types {"long","long","long","string",abi="stdcall",ret="byte"} + TE_DumpMemoryEx = TitanEngine.DumpMemoryEx +-- __declspec(dllexport) bool __stdcall DumpRegions(HANDLE hProcess, char* szDumpFolder, bool DumpAboveImageBaseOnly); + TitanEngine.DumpRegions:types {"long","string","long",abi="stdcall",ret="byte"} + TE_DumpRegions = TitanEngine.DumpRegions +-- __declspec(dllexport) bool __stdcall DumpRegionsEx(DWORD ProcessId, char* szDumpFolder, bool DumpAboveImageBaseOnly); + TitanEngine.DumpRegionsEx:types {"long","string","long",abi="stdcall",ret="byte"} + TE_DumpRegionsEx = TitanEngine.DumpRegionsEx +-- __declspec(dllexport) bool __stdcall DumpModule(HANDLE hProcess, LPVOID ModuleBase, char* szDumpFileName); + TitanEngine.DumpModule:types {"long","long","string",abi="stdcall",ret="byte"} + TE_DumpModule = TitanEngine.DumpModule +-- __declspec(dllexport) bool __stdcall DumpModuleEx(DWORD ProcessId, LPVOID ModuleBase, char* szDumpFileName); + TitanEngine.DumpModuleEx:types {"long","long","string",abi="stdcall",ret="byte"} + TE_DumpModuleEx = TitanEngine.DumpModuleEx +-- __declspec(dllexport) bool __stdcall PastePEHeader(HANDLE hProcess, LPVOID ImageBase, char* szDebuggedFileName); + TitanEngine.PastePEHeader:types {"long","long","string",abi="stdcall",ret="byte"} + TE_PastePEHeader = TitanEngine.PastePEHeader +-- __declspec(dllexport) bool __stdcall ExtractSection(char* szFileName, char* szDumpFileName, DWORD SectionNumber); + TitanEngine.ExtractSection:types {"string","string","long",abi="stdcall",ret="byte"} + TE_ExtractSection = TitanEngine.ExtractSection +-- __declspec(dllexport) bool __stdcall ResortFileSections(char* szFileName); + TitanEngine.ResortFileSections:types {"string",abi="stdcall",ret="byte"} + TE_ResortFileSections = TitanEngine.ResortFileSections +-- __declspec(dllexport) bool __stdcall FindOverlay(char* szFileName, LPDWORD OverlayStart, LPDWORD OverlaySize); + TitanEngine.FindOverlay:types {"string","pointer","pointer",abi="stdcall",ret="byte"} + TE_FindOverlay = TitanEngine.FindOverlay +-- __declspec(dllexport) bool __stdcall ExtractOverlay(char* szFileName, char* szExtactedFileName); + TitanEngine.ExtractOverlay:types {"string","string",abi="stdcall",ret="byte"} + TE_ExtractOverlay = TitanEngine.ExtractOverlay +-- __declspec(dllexport) bool __stdcall AddOverlay(char* szFileName, char* szOverlayFileName); + TitanEngine.AddOverlay:types {"string","string",abi="stdcall",ret="byte"} + TE_AddOverlay = TitanEngine.AddOverlay +-- __declspec(dllexport) bool __stdcall CopyOverlay(char* szInFileName, char* szOutFileName); + TitanEngine.CopyOverlay:types {"string","string",abi="stdcall",ret="byte"} + TE_CopyOverlay = TitanEngine.CopyOverlay +-- __declspec(dllexport) bool __stdcall RemoveOverlay(char* szFileName); + TitanEngine.RemoveOverlay:types {"string",abi="stdcall",ret="byte"} + TE_RemoveOverlay = TitanEngine.RemoveOverlay +-- __declspec(dllexport) bool __stdcall MakeAllSectionsRWE(char* szFileName); + TitanEngine.MakeAllSectionsRWE:types {"string",abi="stdcall",ret="byte"} + TE_MakeAllSectionsRWE = TitanEngine.MakeAllSectionsRWE +-- __declspec(dllexport) long __stdcall AddNewSectionEx(char* szFileName, char* szSectionName, DWORD SectionSize, DWORD SectionAttributes, LPVOID SectionContent, DWORD ContentSize); + TitanEngine.AddNewSectionEx:types {"string","string","long","long","pointer","long",abi="stdcall",ret="long"} + TE_AddNewSectionEx = TitanEngine.AddNewSectionEx +-- __declspec(dllexport) long __stdcall AddNewSection(char* szFileName, char* szSectionName, DWORD SectionSize); + TitanEngine.AddNewSection:types {"string","string","long",abi="stdcall",ret="long"} + TE_AddNewSection = TitanEngine.AddNewSection +-- __declspec(dllexport) bool __stdcall ResizeLastSection(char* szFileName, DWORD NumberOfExpandBytes, bool AlignResizeData); + TitanEngine.ResizeLastSection:types {"string","long","long",abi="stdcall",ret="byte"} + TE_ResizeLastSection = TitanEngine.ResizeLastSection +-- __declspec(dllexport) void __stdcall SetSharedOverlay(char* szFileName); + TitanEngine.SetSharedOverlay:types {"string",abi="stdcall"} + TE_SetSharedOverlay = TitanEngine.SetSharedOverlay +-- __declspec(dllexport) char* __stdcall GetSharedOverlay(); + TitanEngine.GetSharedOverlay:types {abi="stdcall",ret="string"} + TE_GetSharedOverlay = TitanEngine.GetSharedOverlay +-- __declspec(dllexport) bool __stdcall DeleteLastSection(char* szFileName); + TitanEngine.DeleteLastSection:types {"string",abi="stdcall",ret="byte"} + TE_DeleteLastSection = TitanEngine.DeleteLastSection +-- __declspec(dllexport) bool __stdcall DeleteLastSectionEx(char* szFileName, DWORD NumberOfSections); + TitanEngine.DeleteLastSectionEx:types {"string","long",abi="stdcall",ret="byte"} + TE_DeleteLastSectionEx = TitanEngine.DeleteLastSectionEx +-- __declspec(dllexport) long long __stdcall GetPE32DataFromMappedFile(ULONG_PTR FileMapVA, DWORD WhichSection, DWORD WhichData); + TitanEngine.GetPE32DataFromMappedFile:types {"long","long","long",abi="stdcall",ret="long"} + TE_GetPE32DataFromMappedFile = TitanEngine.GetPE32DataFromMappedFile +-- __declspec(dllexport) long long __stdcall GetPE32Data(char* szFileName, DWORD WhichSection, DWORD WhichData); + TitanEngine.GetPE32Data:types {"string","long","long",abi="stdcall",ret="long"} + TE_GetPE32Data = TitanEngine.GetPE32Data +-- __declspec(dllexport) bool __stdcall GetPE32DataFromMappedFileEx(ULONG_PTR FileMapVA, LPVOID DataStorage); + TitanEngine.GetPE32DataFromMappedFileEx:types {"long","pointer",abi="stdcall",ret="byte"} + TE_GetPE32DataFromMappedFileEx = TitanEngine.GetPE32DataFromMappedFileEx +-- __declspec(dllexport) bool __stdcall GetPE32DataEx(char* szFileName, LPVOID DataStorage); + TitanEngine.GetPE32DataEx:types {"string","pointer",abi="stdcall",ret="byte"} + TE_GetPE32DataEx = TitanEngine.GetPE32DataEx +-- __declspec(dllexport) bool __stdcall SetPE32DataForMappedFile(ULONG_PTR FileMapVA, DWORD WhichSection, DWORD WhichData, ULONG_PTR NewDataValue); + TitanEngine.SetPE32DataForMappedFile:types {"long","long","long","long",abi="stdcall",ret="byte"} + TE_SetPE32DataForMappedFile = TitanEngine.SetPE32DataForMappedFile +-- __declspec(dllexport) bool __stdcall SetPE32Data(char* szFileName, DWORD WhichSection, DWORD WhichData, ULONG_PTR NewDataValue); + TitanEngine.SetPE32Data:types {"string","long","long","long",abi="stdcall",ret="byte"} + TE_SetPE32Data = TitanEngine.SetPE32Data +-- __declspec(dllexport) bool __stdcall SetPE32DataForMappedFileEx(ULONG_PTR FileMapVA, LPVOID DataStorage); + TitanEngine.SetPE32DataForMappedFileEx:types {"long","pointer",abi="stdcall",ret="byte"} + TE_SetPE32DataForMappedFileEx = TitanEngine.SetPE32DataForMappedFileEx +-- __declspec(dllexport) bool __stdcall SetPE32DataEx(char* szFileName, LPVOID DataStorage); + TitanEngine.SetPE32DataEx:types {"string","pointer",abi="stdcall",ret="byte"} + TE_SetPE32DataEx = TitanEngine.SetPE32DataEx +-- __declspec(dllexport) long __stdcall GetPE32SectionNumberFromVA(ULONG_PTR FileMapVA, ULONG_PTR AddressToConvert); + TitanEngine.GetPE32SectionNumberFromVA:types {"long","long",abi="stdcall",ret="long"} + TE_GetPE32SectionNumberFromVA = TitanEngine.GetPE32SectionNumberFromVA +-- __declspec(dllexport) long long __stdcall ConvertVAtoFileOffset(ULONG_PTR FileMapVA, ULONG_PTR AddressToConvert, bool ReturnType); + TitanEngine.ConvertVAtoFileOffset:types {"long","long","long",abi="stdcall",ret="long"} + TE_ConvertVAtoFileOffset = TitanEngine.ConvertVAtoFileOffset +-- __declspec(dllexport) long long __stdcall ConvertVAtoFileOffsetEx(ULONG_PTR FileMapVA, DWORD FileSize, ULONG_PTR ImageBase, ULONG_PTR AddressToConvert, bool AddressIsRVA, bool ReturnType); + TitanEngine.ConvertVAtoFileOffsetEx:types {"long","long","long","long","long","long",abi="stdcall",ret="long"} + TE_ConvertVAtoFileOffsetEx = TitanEngine.ConvertVAtoFileOffsetEx +-- __declspec(dllexport) long long __stdcall ConvertFileOffsetToVA(ULONG_PTR FileMapVA, ULONG_PTR AddressToConvert, bool ReturnType); + TitanEngine.ConvertFileOffsetToVA:types {"long","long","long",abi="stdcall",ret="long"} + TE_ConvertFileOffsetToVA = TitanEngine.ConvertFileOffsetToVA +-- __declspec(dllexport) long long __stdcall ConvertFileOffsetToVAEx(ULONG_PTR FileMapVA, DWORD FileSize, ULONG_PTR ImageBase, ULONG_PTR AddressToConvert, bool ReturnType); + TitanEngine.ConvertFileOffsetToVAEx:types {"long","long","long","long","long",abi="stdcall",ret="long"} + TE_ConvertFileOffsetToVAEx = TitanEngine.ConvertFileOffsetToVAEx +-- +-- TitanEngine.Realigner.functions: +-- +-- __declspec(dllexport) bool __stdcall FixHeaderCheckSum(char* szFileName); + TitanEngine.FixHeaderCheckSum:types {"string",abi="stdcall",ret="byte"} + TE_FixHeaderCheckSum = TitanEngine.FixHeaderCheckSum +-- __declspec(dllexport) long __stdcall RealignPE(ULONG_PTR FileMapVA, DWORD FileSize, DWORD RealingMode); + TitanEngine.RealignPE:types {"long","long","long",abi="stdcall",ret="long"} + TE_RealignPE = TitanEngine.RealignPE +-- __declspec(dllexport) long __stdcall RealignPEEx(char* szFileName, DWORD RealingFileSize, DWORD ForcedFileAlignment); + TitanEngine.RealignPEEx:types {"string","long","long",abi="stdcall",ret="long"} + TE_RealignPEEx = TitanEngine.RealignPEEx +-- __declspec(dllexport) bool __stdcall WipeSection(char* szFileName, int WipeSectionNumber, bool RemovePhysically); + TitanEngine.WipeSection:types {"string","long","long",abi="stdcall",ret="byte"} + TE_WipeSection = TitanEngine.WipeSection +-- __declspec(dllexport) bool __stdcall IsPE32FileValidEx(char* szFileName, DWORD CheckDepth, LPVOID FileStatusInfo); + TitanEngine.IsPE32FileValidEx:types {"string","long","pointer",abi="stdcall",ret="byte"} + TE_IsPE32FileValidEx = TitanEngine.IsPE32FileValidEx +-- __declspec(dllexport) bool __stdcall FixBrokenPE32FileEx(char* szFileName, LPVOID FileStatusInfo, LPVOID FileFixInfo); + TitanEngine.FixBrokenPE32FileEx:types {"string","pointer","pointer",abi="stdcall",ret="byte"} + TE_FixBrokenPE32FileEx = TitanEngine.FixBrokenPE32FileEx +-- __declspec(dllexport) bool __stdcall IsFileDLL(char* szFileName, ULONG_PTR FileMapVA); + TitanEngine.IsFileDLL:types {"string","long",abi="stdcall",ret="byte"} + TE_IsFileDLL = TitanEngine.IsFileDLL +-- +-- TitanEngine.Hider.functions: +-- +-- __declspec(dllexport) void* __stdcall GetPEBLocation(HANDLE hProcess); + TitanEngine.GetPEBLocation:types {"long",abi="stdcall",ret="pointer"} + TE_GetPEBLocation = TitanEngine.GetPEBLocation +-- __declspec(dllexport) bool __stdcall HideDebugger(HANDLE hProcess, DWORD PatchAPILevel); + TitanEngine.HideDebugger:types {"long","long",abi="stdcall",ret="byte"} + TE_HideDebugger = TitanEngine.HideDebugger +-- __declspec(dllexport) bool __stdcall UnHideDebugger(HANDLE hProcess, DWORD PatchAPILevel); + TitanEngine.UnHideDebugger:types {"long","long",abi="stdcall",ret="byte"} + TE_UnHideDebugger = TitanEngine.UnHideDebugger +-- +-- TitanEngine.Relocater.functions: +-- +-- __declspec(dllexport) void __stdcall RelocaterCleanup(); + TitanEngine.RelocaterCleanup:types {abi="stdcall"} + TE_RelocaterCleanup = TitanEngine.RelocaterCleanup +-- __declspec(dllexport) void __stdcall RelocaterInit(DWORD MemorySize, ULONG_PTR OldImageBase, ULONG_PTR NewImageBase); + TitanEngine.RelocaterInit:types {"long","long","long",abi="stdcall"} + TE_RelocaterInit = TitanEngine.RelocaterInit +-- __declspec(dllexport) void __stdcall RelocaterAddNewRelocation(HANDLE hProcess, ULONG_PTR RelocateAddress, DWORD RelocateState); + TitanEngine.RelocaterAddNewRelocation:types {"long","long","long",abi="stdcall"} + TE_RelocaterAddNewRelocation = TitanEngine.RelocaterAddNewRelocation +-- __declspec(dllexport) long __stdcall RelocaterEstimatedSize(); + TitanEngine.RelocaterEstimatedSize:types {abi="stdcall",ret="long"} + TE_RelocaterEstimatedSize = TitanEngine.RelocaterEstimatedSize +-- __declspec(dllexport) bool __stdcall RelocaterExportRelocation(ULONG_PTR StorePlace, DWORD StorePlaceRVA, ULONG_PTR FileMapVA); + TitanEngine.RelocaterExportRelocation:types {"long","long","long",abi="stdcall",ret="byte"} + TE_RelocaterExportRelocation = TitanEngine.RelocaterExportRelocation +-- __declspec(dllexport) bool __stdcall RelocaterExportRelocationEx(char* szFileName, char* szSectionName); + TitanEngine.RelocaterExportRelocationEx:types {"string","string",abi="stdcall",ret="byte"} + TE_RelocaterExportRelocationEx = TitanEngine.RelocaterExportRelocationEx +-- __declspec(dllexport) bool __stdcall RelocaterGrabRelocationTable(HANDLE hProcess, ULONG_PTR MemoryStart, DWORD MemorySize); + TitanEngine.RelocaterGrabRelocationTable:types {"long","long","long",abi="stdcall",ret="byte"} + TE_RelocaterGrabRelocationTable = TitanEngine.RelocaterGrabRelocationTable +-- __declspec(dllexport) bool __stdcall RelocaterGrabRelocationTableEx(HANDLE hProcess, ULONG_PTR MemoryStart, ULONG_PTR MemorySize, DWORD NtSizeOfImage); + TitanEngine.RelocaterGrabRelocationTableEx:types {"long","long","long","long",abi="stdcall",ret="byte"} + TE_RelocaterGrabRelocationTableEx = TitanEngine.RelocaterGrabRelocationTableEx +-- __declspec(dllexport) bool __stdcall RelocaterMakeSnapshot(HANDLE hProcess, char* szSaveFileName, LPVOID MemoryStart, ULONG_PTR MemorySize); + TitanEngine.RelocaterMakeSnapshot:types {"long","string","long","long",abi="stdcall",ret="byte"} + TE_RelocaterMakeSnapshot = TitanEngine.RelocaterMakeSnapshot +-- __declspec(dllexport) bool __stdcall RelocaterCompareTwoSnapshots(HANDLE hProcess, ULONG_PTR LoadedImageBase, ULONG_PTR NtSizeOfImage, char* szDumpFile1, char* szDumpFile2, ULONG_PTR MemStart); + TitanEngine.RelocaterCompareTwoSnapshots:types {"long","long","long","string","string","long",abi="stdcall",ret="byte"} + TE_RelocaterCompareTwoSnapshots = TitanEngine.RelocaterCompareTwoSnapshots +-- __declspec(dllexport) bool __stdcall RelocaterChangeFileBase(char* szFileName, ULONG_PTR NewImageBase); + TitanEngine.RelocaterChangeFileBase:types {"string","long",abi="stdcall",ret="byte"} + TE_RelocaterChangeFileBase = TitanEngine.RelocaterChangeFileBase +-- __declspec(dllexport) bool __stdcall RelocaterRelocateMemoryBlock(ULONG_PTR FileMapVA, ULONG_PTR MemoryLocation, void* RelocateMemory, DWORD RelocateMemorySize, ULONG_PTR CurrentLoadedBase, ULONG_PTR RelocateBase); + TitanEngine.RelocaterRelocateMemoryBlock:types {"long","long","long","long","long","long",abi="stdcall",ret="byte"} + TE_RelocaterRelocateMemoryBlock = TitanEngine.RelocaterRelocateMemoryBlock +-- __declspec(dllexport) bool __stdcall RelocaterWipeRelocationTable(char* szFileName); + TitanEngine.RelocaterWipeRelocationTable:types {"string",abi="stdcall",ret="byte"} + TE_RelocaterWipeRelocationTable = TitanEngine.RelocaterWipeRelocationTable +-- +-- TitanEngine.Resourcer.functions: +-- +-- __declspec(dllexport) long long __stdcall ResourcerLoadFileForResourceUse(char* szFileName); + TitanEngine.ResourcerLoadFileForResourceUse:types {"string",abi="stdcall",ret="long"} + TE_ResourcerLoadFileForResourceUse = TitanEngine.ResourcerLoadFileForResourceUse +-- __declspec(dllexport) bool __stdcall ResourcerFreeLoadedFile(LPVOID LoadedFileBase); + TitanEngine.ResourcerFreeLoadedFile:types {"long",abi="stdcall",ret="byte"} + TE_ResourcerFreeLoadedFile = TitanEngine.ResourcerFreeLoadedFile +-- __declspec(dllexport) bool __stdcall ResourcerExtractResourceFromFileEx(ULONG_PTR FileMapVA, char* szResourceType, char* szResourceName, char* szExtractedFileName); + TitanEngine.ResourcerExtractResourceFromFileEx:types {"long","string","string","string",abi="stdcall",ret="byte"} + TE_ResourcerExtractResourceFromFileEx = TitanEngine.ResourcerExtractResourceFromFileEx +-- __declspec(dllexport) bool __stdcall ResourcerExtractResourceFromFile(char* szFileName, char* szResourceType, char* szResourceName, char* szExtractedFileName); + TitanEngine.ResourcerExtractResourceFromFile:types {"string","string","string","string",abi="stdcall",ret="byte"} + TE_ResourcerExtractResourceFromFile = TitanEngine.ResourcerExtractResourceFromFile +-- __declspec(dllexport) bool __stdcall ResourcerFindResource(char* szFileName, char* szResourceType, DWORD ResourceType, char* szResourceName, DWORD ResourceName, DWORD ResourceLanguage, PULONG_PTR pResourceData, LPDWORD pResourceSize); + TitanEngine.ResourcerFindResource:types {"string","string","long","string","long","long","pointer","pointer",abi="stdcall",ret="byte"} + TE_ResourcerFindResource = TitanEngine.ResourcerFindResource +-- __declspec(dllexport) void __stdcall ResourcerEnumerateResource(char* szFileName, void* CallBack); + TitanEngine.ResourcerEnumerateResource:types {"string","callback",abi="stdcall"} + TE_ResourcerEnumerateResource = TitanEngine.ResourcerEnumerateResource +-- __declspec(dllexport) void __stdcall ResourcerEnumerateResourceEx(ULONG_PTR FileMapVA, DWORD FileSize, void* CallBack); + TitanEngine.ResourcerEnumerateResourceEx:types {"long","long","callback",abi="stdcall"} + TE_ResourcerEnumerateResourceEx = TitanEngine.ResourcerEnumerateResourceEx +-- CallBacks: +-- typedef bool(__stdcall *fResourceEnumerator)(wchar_t* szResourceType, DWORD ResourceType, wchar_t* szResourceName, DWORD ResourceName, DWORD ResourceLanguage, DWORD ResourceData, DWORD ResourceSize); +-- TE_ResourcerEnumerateResource_CB = alien.callback(YourFunctionHere, "pointer", "long", "pointer", "long", "long", "long", "long") +-- TE_ResourcerEnumerateResourceEx_CB = alien.callback(YourFunctionHere, "pointer", "long", "pointer", "long", "long", "long", "long") +-- +-- TitanEngine.Threader.functions: +-- +-- __declspec(dllexport) bool __stdcall ThreaderImportRunningThreadData(DWORD ProcessId); + TitanEngine.ThreaderImportRunningThreadData:types {"long",abi="stdcall",ret="byte"} + TE_ThreaderImportRunningThreadData = TitanEngine.ThreaderImportRunningThreadData +-- __declspec(dllexport) void* __stdcall ThreaderGetThreadInfo(HANDLE hThread, DWORD ThreadId); + TitanEngine.ThreaderGetThreadInfo:types {"long","long",abi="stdcall",ret="pointer"} + TE_ThreaderGetThreadInfo = TitanEngine.ThreaderGetThreadInfo +-- __declspec(dllexport) void __stdcall ThreaderEnumThreadInfo(void* EnumCallBack); + TitanEngine.ThreaderEnumThreadInfo:types {"callback",abi="stdcall"} + TE_ThreaderEnumThreadInfo = TitanEngine.ThreaderEnumThreadInfo +-- __declspec(dllexport) bool __stdcall ThreaderPauseThread(HANDLE hThread); + TitanEngine.ThreaderPauseThread:types {"long",abi="stdcall",ret="byte"} + TE_ThreaderPauseThread = TitanEngine.ThreaderPauseThread +-- __declspec(dllexport) bool __stdcall ThreaderResumeThread(HANDLE hThread); + TitanEngine.ThreaderResumeThread:types {"long",abi="stdcall",ret="byte"} + TE_ThreaderResumeThread = TitanEngine.ThreaderResumeThread +-- __declspec(dllexport) bool __stdcall ThreaderTerminateThread(HANDLE hThread, DWORD ThreadExitCode); + TitanEngine.ThreaderTerminateThread:types {"long","long",abi="stdcall",ret="byte"} + TE_ThreaderTerminateThread = TitanEngine.ThreaderTerminateThread +-- __declspec(dllexport) bool __stdcall ThreaderPauseAllThreads(bool LeaveMainRunning); + TitanEngine.ThreaderPauseAllThreads:types {"long",abi="stdcall",ret="byte"} + TE_ThreaderPauseAllThreads = TitanEngine.ThreaderPauseAllThreads +-- __declspec(dllexport) bool __stdcall ThreaderResumeAllThreads(bool LeaveMainPaused); + TitanEngine.ThreaderResumeAllThreads:types {"long",abi="stdcall",ret="byte"} + TE_ThreaderResumeAllThreads = TitanEngine.ThreaderResumeAllThreads +-- __declspec(dllexport) bool __stdcall ThreaderPauseProcess(); + TitanEngine.ThreaderPauseProcess:types {abi="stdcall",ret="byte"} + TE_ThreaderPauseProcess = TitanEngine.ThreaderPauseProcess +-- __declspec(dllexport) bool __stdcall ThreaderResumeProcess(); + TitanEngine.ThreaderResumeProcess:types {abi="stdcall",ret="byte"} + TE_ThreaderResumeProcess = TitanEngine.ThreaderResumeProcess +-- __declspec(dllexport) long long __stdcall ThreaderCreateRemoteThread(ULONG_PTR ThreadStartAddress, bool AutoCloseTheHandle, LPVOID ThreadPassParameter, LPDWORD ThreadId); + TitanEngine.ThreaderCreateRemoteThread:types {"long","long","long","pointer",abi="stdcall",ret="long"} + TE_ThreaderCreateRemoteThread = TitanEngine.ThreaderCreateRemoteThread +-- __declspec(dllexport) bool __stdcall ThreaderInjectAndExecuteCode(LPVOID InjectCode, DWORD StartDelta, DWORD InjectSize); + TitanEngine.ThreaderInjectAndExecuteCode:types {"pointer","long","long",abi="stdcall",ret="byte"} + TE_ThreaderInjectAndExecuteCode = TitanEngine.ThreaderInjectAndExecuteCode +-- __declspec(dllexport) long long __stdcall ThreaderCreateRemoteThreadEx(HANDLE hProcess, ULONG_PTR ThreadStartAddress, bool AutoCloseTheHandle, LPVOID ThreadPassParameter, LPDWORD ThreadId); + TitanEngine.ThreaderCreateRemoteThreadEx:types {"long","long","long","long","pointer",abi="stdcall",ret="long"} + TE_ThreaderCreateRemoteThreadEx = TitanEngine.ThreaderCreateRemoteThreadEx +-- __declspec(dllexport) bool __stdcall ThreaderInjectAndExecuteCodeEx(HANDLE hProcess, LPVOID InjectCode, DWORD StartDelta, DWORD InjectSize); + TitanEngine.ThreaderInjectAndExecuteCodeEx:types {"long","long","long","long",abi="stdcall",ret="byte"} + TE_ThreaderInjectAndExecuteCodeEx = TitanEngine.ThreaderInjectAndExecuteCodeEx +-- __declspec(dllexport) void __stdcall ThreaderSetCallBackForNextExitThreadEvent(LPVOID exitThreadCallBack); + TitanEngine.ThreaderSetCallBackForNextExitThreadEvent:types {"callback",abi="stdcall"} + TE_ThreaderSetCallBackForNextExitThreadEvent = TitanEngine.ThreaderSetCallBackForNextExitThreadEvent +-- __declspec(dllexport) bool __stdcall ThreaderIsThreadStillRunning(HANDLE hThread); + TitanEngine.ThreaderIsThreadStillRunning:types {"long",abi="stdcall",ret="byte"} + TE_ThreaderIsThreadStillRunning = TitanEngine.ThreaderIsThreadStillRunning +-- __declspec(dllexport) bool __stdcall ThreaderIsThreadActive(HANDLE hThread); + TitanEngine.ThreaderIsThreadActive:types {"long",abi="stdcall",ret="byte"} + TE_ThreaderIsThreadActive = TitanEngine.ThreaderIsThreadActive +-- __declspec(dllexport) bool __stdcall ThreaderIsAnyThreadActive(); + TitanEngine.ThreaderIsAnyThreadActive:types {abi="stdcall",ret="byte"} + TE_ThreaderIsAnyThreadActive = TitanEngine.ThreaderIsAnyThreadActive +-- __declspec(dllexport) bool __stdcall ThreaderExecuteOnlyInjectedThreads(); + TitanEngine.ThreaderExecuteOnlyInjectedThreads:types {abi="stdcall",ret="byte"} + TE_ThreaderExecuteOnlyInjectedThreads = TitanEngine.ThreaderExecuteOnlyInjectedThreads +-- __declspec(dllexport) long long __stdcall ThreaderGetOpenHandleForThread(DWORD ThreadId); + TitanEngine.ThreaderGetOpenHandleForThread:types {"long",abi="stdcall",ret="long"} + TE_ThreaderGetOpenHandleForThread = TitanEngine.ThreaderGetOpenHandleForThread +-- __declspec(dllexport) void* __stdcall ThreaderGetThreadData(); + TitanEngine.ThreaderGetThreadData:types {abi="stdcall",ret="pointer"} + TE_ThreaderGetThreadData = TitanEngine.ThreaderGetThreadData +-- __declspec(dllexport) bool __stdcall ThreaderIsExceptionInMainThread(); + TitanEngine.ThreaderIsExceptionInMainThread:types {abi="stdcall",ret="byte"} + TE_ThreaderIsExceptionInMainThread = TitanEngine.ThreaderIsExceptionInMainThread +-- CallBacks: +-- typedef void(__stdcall *fEnumCallBack)(LPVOID fThreadDetail); +-- TE_ThreaderEnumThreadInfo_CB = alien.callback(YourFunctionHere, "pointer", abi = "stdcall") +-- typedef void(__stdcall *fCustomHandler)(void* SpecialDBG); +-- TE_ThreaderSetCallBackForNextExitThreadEvent_CB = alien.callback(YourFunctionHere, "pointer", abi = "stdcall") +-- +-- TitanEngine.Debugger.functions: +-- +-- __declspec(dllexport) void* __stdcall StaticDisassembleEx(ULONG_PTR DisassmStart, LPVOID DisassmAddress); + TitanEngine.StaticDisassembleEx:types {"long","long",abi="stdcall",ret="string"} + TE_StaticDisassembleEx = TitanEngine.StaticDisassembleEx +-- __declspec(dllexport) void* __stdcall StaticDisassemble(LPVOID DisassmAddress); + TitanEngine.StaticDisassemble:types {"long",abi="stdcall",ret="string"} + TE_StaticDisassemble = TitanEngine.StaticDisassemble +-- __declspec(dllexport) void* __stdcall DisassembleEx(HANDLE hProcess, LPVOID DisassmAddress); + TitanEngine.DisassembleEx:types {"long","long",abi="stdcall",ret="string"} + TE_DisassembleEx = TitanEngine.DisassembleEx +-- __declspec(dllexport) void* __stdcall Disassemble(LPVOID DisassmAddress); + TitanEngine.Disassemble:types {"long",abi="stdcall",ret="string"} + TE_Disassemble = TitanEngine.Disassemble +-- __declspec(dllexport) long __stdcall StaticLengthDisassemble(LPVOID DisassmAddress); + TitanEngine.StaticLengthDisassemble:types {"long",abi="stdcall",ret="long"} + TE_StaticLengthDisassemble = TitanEngine.StaticLengthDisassemble +-- __declspec(dllexport) long __stdcall LengthDisassembleEx(HANDLE hProcess, LPVOID DisassmAddress); + TitanEngine.LengthDisassembleEx:types {"long","long",abi="stdcall",ret="long"} + TE_LengthDisassembleEx = TitanEngine.LengthDisassembleEx +-- __declspec(dllexport) long __stdcall LengthDisassemble(LPVOID DisassmAddress); + TitanEngine.LengthDisassemble:types {"long",abi="stdcall",ret="long"} + TE_LengthDisassemble = TitanEngine.LengthDisassemble +-- __declspec(dllexport) void* __stdcall InitDebug(char* szFileName, char* szCommandLine, char* szCurrentFolder); + TitanEngine.InitDebug:types {"string","string","string",abi="stdcall",ret="pointer"} + TE_InitDebug = TitanEngine.InitDebug +-- __declspec(dllexport) void* __stdcall InitDebugEx(char* szFileName, char* szCommandLine, char* szCurrentFolder, LPVOID EntryCallBack); + TitanEngine.InitDebugEx:types {"string","string","string","callback",abi="stdcall",ret="pointer"} + TE_InitDebugEx = TitanEngine.InitDebugEx +-- __declspec(dllexport) void* __stdcall InitDLLDebug(char* szFileName, bool ReserveModuleBase, char* szCommandLine, char* szCurrentFolder, LPVOID EntryCallBack); + TitanEngine.InitDLLDebug:types {"string","long","string","string","callback",abi="stdcall",ret="pointer"} + TE_InitDLLDebug = TitanEngine.InitDLLDebug +-- __declspec(dllexport) bool __stdcall StopDebug(); + TitanEngine.StopDebug:types {abi="stdcall",ret="byte"} + TE_StopDebug = TitanEngine.StopDebug +-- __declspec(dllexport) void __stdcall SetBPXOptions(long DefaultBreakPointType); + TitanEngine.SetBPXOptions:types {"long",abi="stdcall"} + TE_SetBPXOptions = TitanEngine.SetBPXOptions +-- __declspec(dllexport) bool __stdcall IsBPXEnabled(ULONG_PTR bpxAddress); + TitanEngine.IsBPXEnabled:types {"long",abi="stdcall",ret="byte"} + TE_IsBPXEnabled = TitanEngine.IsBPXEnabled +-- __declspec(dllexport) bool __stdcall EnableBPX(ULONG_PTR bpxAddress); + TitanEngine.EnableBPX:types {"long",abi="stdcall",ret="byte"} + TE_EnableBPX = TitanEngine.EnableBPX +-- __declspec(dllexport) bool __stdcall DisableBPX(ULONG_PTR bpxAddress); + TitanEngine.DisableBPX:types {"long",abi="stdcall",ret="byte"} + TE_DisableBPX = TitanEngine.DisableBPX +-- __declspec(dllexport) bool __stdcall SetBPX(ULONG_PTR bpxAddress, DWORD bpxType, LPVOID bpxCallBack); + TitanEngine.SetBPX:types {"long","long","callback",abi="stdcall",ret="byte"} + TE_SetBPX = TitanEngine.SetBPX +-- __declspec(dllexport) bool __stdcall SetBPXEx(ULONG_PTR bpxAddress, DWORD bpxType, DWORD NumberOfExecution, DWORD CmpRegister, DWORD CmpCondition, ULONG_PTR CmpValue, LPVOID bpxCallBack, LPVOID bpxCompareCallBack, LPVOID bpxRemoveCallBack); + TitanEngine.SetBPXEx:types {"long","long","long","long","long","long","callback","callback","callback",abi="stdcall",ret="byte"} + TE_SetBPXEx = TitanEngine.SetBPXEx +-- __declspec(dllexport) bool __stdcall DeleteBPX(ULONG_PTR bpxAddress); + TitanEngine.DeleteBPX:types {"long",abi="stdcall",ret="byte"} + TE_DeleteBPX = TitanEngine.DeleteBPX +-- __declspec(dllexport) bool __stdcall SafeDeleteBPX(ULONG_PTR bpxAddress); + TitanEngine.SafeDeleteBPX:types {"long",abi="stdcall",ret="byte"} + TE_SafeDeleteBPX = TitanEngine.SafeDeleteBPX +-- __declspec(dllexport) bool __stdcall SetAPIBreakPoint(char* szDLLName, char* szAPIName, DWORD bpxType, DWORD bpxPlace, LPVOID bpxCallBack); + TitanEngine.SetAPIBreakPoint:types {"string","string","long","long","callback",abi="stdcall",ret="byte"} + TE_SetAPIBreakPoint = TitanEngine.SetAPIBreakPoint +-- __declspec(dllexport) bool __stdcall DeleteAPIBreakPoint(char* szDLLName, char* szAPIName, DWORD bpxPlace); + TitanEngine.DeleteAPIBreakPoint:types {"string","string","long",abi="stdcall",ret="byte"} + TE_DeleteAPIBreakPoint = TitanEngine.DeleteAPIBreakPoint +-- __declspec(dllexport) bool __stdcall SafeDeleteAPIBreakPoint(char* szDLLName, char* szAPIName, DWORD bpxPlace); + TitanEngine.SafeDeleteAPIBreakPoint:types {"string","string","long",abi="stdcall",ret="byte"} + TE_SafeDeleteAPIBreakPoint = TitanEngine.SafeDeleteAPIBreakPoint +-- __declspec(dllexport) bool __stdcall SetMemoryBPX(ULONG_PTR MemoryStart, DWORD SizeOfMemory, LPVOID bpxCallBack); + TitanEngine.SetMemoryBPX:types {"long","long","callback",abi="stdcall",ret="byte"} + TE_SetMemoryBPX = TitanEngine.SetMemoryBPX +-- __declspec(dllexport) bool __stdcall SetMemoryBPXEx(ULONG_PTR MemoryStart, DWORD SizeOfMemory, DWORD BreakPointType, bool RestoreOnHit, LPVOID bpxCallBack); + TitanEngine.SetMemoryBPXEx:types {"long","long","long","long","callback",abi="stdcall",ret="byte"} + TE_SetMemoryBPXEx = TitanEngine.SetMemoryBPXEx +-- __declspec(dllexport) bool __stdcall RemoveMemoryBPX(ULONG_PTR MemoryStart, DWORD SizeOfMemory); + TitanEngine.RemoveMemoryBPX:types {"long","long",abi="stdcall",ret="byte"} + TE_RemoveMemoryBPX = TitanEngine.RemoveMemoryBPX +-- __declspec(dllexport) bool __stdcall GetContextFPUDataEx(HANDLE hActiveThread, void* FPUSaveArea); + TitanEngine.GetContextFPUDataEx:types {"long","pointer",abi="stdcall",ret="byte"} + TE_GetContextFPUDataEx = TitanEngine.GetContextFPUDataEx +-- __declspec(dllexport) long long __stdcall GetContextDataEx(HANDLE hActiveThread, DWORD IndexOfRegister); + TitanEngine.GetContextDataEx:types {"long","long",abi="stdcall",ret="long"} + TE_GetContextDataEx = TitanEngine.GetContextDataEx +-- __declspec(dllexport) long long __stdcall GetContextData(DWORD IndexOfRegister); + TitanEngine.GetContextData:types {"long",abi="stdcall",ret="long"} + TE_GetContextData = TitanEngine.GetContextData +-- __declspec(dllexport) bool __stdcall SetContextFPUDataEx(HANDLE hActiveThread, void* FPUSaveArea); + TitanEngine.SetContextFPUDataEx:types {"long","pointer",abi="stdcall",ret="byte"} + TE_SetContextFPUDataEx = TitanEngine.SetContextFPUDataEx +-- __declspec(dllexport) bool __stdcall SetContextDataEx(HANDLE hActiveThread, DWORD IndexOfRegister, ULONG_PTR NewRegisterValue); + TitanEngine.SetContextDataEx:types {"long","long","long",abi="stdcall",ret="byte"} + TE_SetContextDataEx = TitanEngine.SetContextDataEx +-- __declspec(dllexport) bool __stdcall SetContextData(DWORD IndexOfRegister, ULONG_PTR NewRegisterValue); + TitanEngine.SetContextData:types {"long","long",abi="stdcall",ret="byte"} + TE_SetContextData = TitanEngine.SetContextData +-- __declspec(dllexport) void __stdcall ClearExceptionNumber(); + TitanEngine.ClearExceptionNumber:types {abi="stdcall"} + TE_ClearExceptionNumber = TitanEngine.ClearExceptionNumber +-- __declspec(dllexport) long __stdcall CurrentExceptionNumber(); + TitanEngine.CurrentExceptionNumber:types {abi="stdcall",ret="long"} + TE_CurrentExceptionNumber = TitanEngine.CurrentExceptionNumber +-- __declspec(dllexport) bool __stdcall MatchPatternEx(HANDLE hProcess, void* MemoryToCheck, int SizeOfMemoryToCheck, void* PatternToMatch, int SizeOfPatternToMatch, PBYTE WildCard); + TitanEngine.MatchPatternEx:types {"long","long","long","pointer","long","pointer",abi="stdcall",ret="byte"} + TE_MatchPatternEx = TitanEngine.MatchPatternEx +-- __declspec(dllexport) bool __stdcall MatchPattern(void* MemoryToCheck, int SizeOfMemoryToCheck, void* PatternToMatch, int SizeOfPatternToMatch, PBYTE WildCard); + TitanEngine.MatchPattern:types {"long","long","pointer","long","pointer",abi="stdcall",ret="byte"} + TE_MatchPattern = TitanEngine.MatchPattern +-- __declspec(dllexport) long long __stdcall FindEx(HANDLE hProcess, LPVOID MemoryStart, DWORD MemorySize, LPVOID SearchPattern, DWORD PatternSize, LPBYTE WildCard); + TitanEngine.FindEx:types {"long","long","long","pointer","long","pointer",abi="stdcall",ret="long"} + TE_FindEx = TitanEngine.FindEx +-- __declspec(dllexport) long long __stdcall Find(LPVOID MemoryStart, DWORD MemorySize, LPVOID SearchPattern, DWORD PatternSize, LPBYTE WildCard); + TitanEngine.Find:types {"long","long","pointer","long","pointer",abi="stdcall",ret="long"} + TE_Find = TitanEngine.Find +-- __declspec(dllexport) bool __stdcall FillEx(HANDLE hProcess, LPVOID MemoryStart, DWORD MemorySize, PBYTE FillByte); + TitanEngine.FillEx:types {"long","long","long","pointer",abi="stdcall",ret="byte"} + TE_FillEx = TitanEngine.FillEx +-- __declspec(dllexport) bool __stdcall Fill(LPVOID MemoryStart, DWORD MemorySize, PBYTE FillByte); + TitanEngine.Fill:types {"long","long","pointer",abi="stdcall",ret="byte"} + TE_Fill = TitanEngine.Fill +-- __declspec(dllexport) bool __stdcall PatchEx(HANDLE hProcess, LPVOID MemoryStart, DWORD MemorySize, LPVOID ReplacePattern, DWORD ReplaceSize, bool AppendNOP, bool PrependNOP); + TitanEngine.PatchEx:types {"long","long","long","pointer","long","long","long",abi="stdcall",ret="byte"} + TE_PatchEx = TitanEngine.PatchEx +-- __declspec(dllexport) bool __stdcall Patch(LPVOID MemoryStart, DWORD MemorySize, LPVOID ReplacePattern, DWORD ReplaceSize, bool AppendNOP, bool PrependNOP); + TitanEngine.Patch:types {"long","long","pointer","long","long","long",abi="stdcall",ret="byte"} + TE_Patch = TitanEngine.Patch +-- __declspec(dllexport) bool __stdcall ReplaceEx(HANDLE hProcess, LPVOID MemoryStart, DWORD MemorySize, LPVOID SearchPattern, DWORD PatternSize, DWORD NumberOfRepetitions, LPVOID ReplacePattern, DWORD ReplaceSize, PBYTE WildCard); + TitanEngine.ReplaceEx:types {"long","long","long","pointer","long","long","pointer","long","pointer",abi="stdcall",ret="byte"} + TE_ReplaceEx = TitanEngine.ReplaceEx +-- __declspec(dllexport) bool __stdcall Replace(LPVOID MemoryStart, DWORD MemorySize, LPVOID SearchPattern, DWORD PatternSize, DWORD NumberOfRepetitions, LPVOID ReplacePattern, DWORD ReplaceSize, PBYTE WildCard); + TitanEngine.Replace:types {"long","long","pointer","long","long","pointer","long","pointer",abi="stdcall",ret="byte"} + TE_Replace = TitanEngine.Replace +-- __declspec(dllexport) void* __stdcall GetDebugData(); + TitanEngine.GetDebugData:types {abi="stdcall",ret="pointer"} + TE_GetDebugData = TitanEngine.GetDebugData +-- __declspec(dllexport) void* __stdcall GetTerminationData(); + TitanEngine.GetTerminationData:types {abi="stdcall",ret="pointer"} + TE_GetTerminationData = TitanEngine.GetTerminationData +-- __declspec(dllexport) long __stdcall GetExitCode(); + TitanEngine.GetExitCode:types {abi="stdcall",ret="long"} + TE_GetExitCode = TitanEngine.GetExitCode +-- __declspec(dllexport) long long __stdcall GetDebuggedDLLBaseAddress(); + TitanEngine.GetDebuggedDLLBaseAddress:types {abi="stdcall",ret="long"} + TE_GetDebuggedDLLBaseAddress = TitanEngine.GetDebuggedDLLBaseAddress +-- __declspec(dllexport) long long __stdcall GetDebuggedFileBaseAddress(); + TitanEngine.GetDebuggedFileBaseAddress:types {abi="stdcall",ret="long"} + TE_GetDebuggedFileBaseAddress = TitanEngine.GetDebuggedFileBaseAddress +-- __declspec(dllexport) bool __stdcall GetRemoteString(HANDLE hProcess, LPVOID StringAddress, LPVOID StringStorage, int MaximumStringSize); + TitanEngine.GetRemoteString:types {"long","long","pointer","long",abi="stdcall",ret="byte"} + TE_GetRemoteString = TitanEngine.GetRemoteString +-- __declspec(dllexport) long long __stdcall GetFunctionParameter(HANDLE hProcess, DWORD FunctionType, DWORD ParameterNumber, DWORD ParameterType); + TitanEngine.GetFunctionParameter:types {"long","long","long","long",abi="stdcall",ret="long"} + TE_GetFunctionParameter = TitanEngine.GetFunctionParameter +-- __declspec(dllexport) long long __stdcall GetJumpDestinationEx(HANDLE hProcess, ULONG_PTR InstructionAddress, bool JustJumps); + TitanEngine.GetJumpDestinationEx:types {"long","long","long",abi="stdcall",ret="long"} + TE_GetJumpDestinationEx = TitanEngine.GetJumpDestinationEx +-- __declspec(dllexport) long long __stdcall GetJumpDestination(HANDLE hProcess, ULONG_PTR InstructionAddress); + TitanEngine.GetJumpDestination:types {"long","long",abi="stdcall",ret="long"} + TE_GetJumpDestination = TitanEngine.GetJumpDestination +-- __declspec(dllexport) bool __stdcall IsJumpGoingToExecuteEx(HANDLE hProcess, HANDLE hThread, ULONG_PTR InstructionAddress, ULONG_PTR RegFlags); + TitanEngine.IsJumpGoingToExecuteEx:types {"long","long","long","long",abi="stdcall",ret="byte"} + TE_IsJumpGoingToExecuteEx = TitanEngine.IsJumpGoingToExecuteEx +-- __declspec(dllexport) bool __stdcall IsJumpGoingToExecute(); + TitanEngine.IsJumpGoingToExecute:types {abi="stdcall",ret="byte"} + TE_IsJumpGoingToExecute = TitanEngine.IsJumpGoingToExecute +-- __declspec(dllexport) void __stdcall SetCustomHandler(DWORD ExceptionId, LPVOID CallBack); + TitanEngine.SetCustomHandler:types {"long","callback",abi="stdcall"} + TE_SetCustomHandler = TitanEngine.SetCustomHandler +-- __declspec(dllexport) void __stdcall ForceClose(); + TitanEngine.ForceClose:types {abi="stdcall"} + TE_ForceClose = TitanEngine.ForceClose +-- __declspec(dllexport) void __stdcall StepInto(LPVOID traceCallBack); + TitanEngine.StepInto:types {"callback",abi="stdcall"} + TE_StepInto = TitanEngine.StepInto +-- __declspec(dllexport) void __stdcall StepOver(LPVOID traceCallBack); + TitanEngine.StepOver:types {"callback",abi="stdcall"} + TE_StepOver = TitanEngine.StepOver +-- __declspec(dllexport) void __stdcall SingleStep(DWORD StepCount, LPVOID StepCallBack); + TitanEngine.SingleStep:types {"long","callback",abi="stdcall"} + TE_SingleStep = TitanEngine.SingleStep +-- __declspec(dllexport) bool __stdcall GetUnusedHardwareBreakPointRegister(LPDWORD RegisterIndex); + TitanEngine.GetUnusedHardwareBreakPointRegister:types {"long",abi="stdcall",ret="byte"} + TE_GetUnusedHardwareBreakPointRegister = TitanEngine.GetUnusedHardwareBreakPointRegister +-- __declspec(dllexport) bool __stdcall SetHardwareBreakPointEx(HANDLE hActiveThread, ULONG_PTR bpxAddress, DWORD IndexOfRegister, DWORD bpxType, DWORD bpxSize, LPVOID bpxCallBack, LPDWORD IndexOfSelectedRegister); + TitanEngine.SetHardwareBreakPointEx:types {"long","long","long","long","long","callback","pointer",abi="stdcall",ret="byte"} + TE_SetHardwareBreakPointEx = TitanEngine.SetHardwareBreakPointEx +-- __declspec(dllexport) bool __stdcall SetHardwareBreakPoint(ULONG_PTR bpxAddress, DWORD IndexOfRegister, DWORD bpxType, DWORD bpxSize, LPVOID bpxCallBack); + TitanEngine.SetHardwareBreakPoint:types {"long","long","long","long","callback",abi="stdcall",ret="byte"} + TE_SetHardwareBreakPoint = TitanEngine.SetHardwareBreakPoint +-- __declspec(dllexport) bool __stdcall DeleteHardwareBreakPoint(DWORD IndexOfRegister); + TitanEngine.DeleteHardwareBreakPoint:types {"long",abi="stdcall",ret="byte"} + TE_DeleteHardwareBreakPoint = TitanEngine.DeleteHardwareBreakPoint +-- __declspec(dllexport) bool __stdcall RemoveAllBreakPoints(DWORD RemoveOption); + TitanEngine.RemoveAllBreakPoints:types {"long",abi="stdcall",ret="byte"} + TE_RemoveAllBreakPoints = TitanEngine.RemoveAllBreakPoints +-- __declspec(dllexport) void* __stdcall GetProcessInformation(); + TitanEngine.GetProcessInformation:types {abi="stdcall",ret="pointer"} + TE_GetProcessInformation = TitanEngine.GetProcessInformation +-- __declspec(dllexport) void* __stdcall GetStartupInformation(); + TitanEngine.GetStartupInformation:types {abi="stdcall",ret="pointer"} + TE_GetStartupInformation = TitanEngine.GetStartupInformation +-- __declspec(dllexport) void __stdcall DebugLoop(); + TitanEngine.DebugLoop:types {abi="stdcall"} + TE_DebugLoop = TitanEngine.DebugLoop +-- __declspec(dllexport) void __stdcall SetDebugLoopTimeOut(DWORD TimeOut); + TitanEngine.SetDebugLoopTimeOut:types {"long",abi="stdcall"} + TE_SetDebugLoopTimeOut = TitanEngine.SetDebugLoopTimeOut +-- __declspec(dllexport) void __stdcall SetNextDbgContinueStatus(DWORD SetDbgCode); + TitanEngine.SetNextDbgContinueStatus:types {"long",abi="stdcall"} + TE_SetNextDbgContinueStatus = TitanEngine.SetNextDbgContinueStatus +-- __declspec(dllexport) bool __stdcall AttachDebugger(DWORD ProcessId, bool KillOnExit, LPVOID DebugInfo, LPVOID CallBack); + TitanEngine.AttachDebugger:types {"long","long","pointer","callback",abi="stdcall",ret="byte"} + TE_AttachDebugger = TitanEngine.AttachDebugger +-- __declspec(dllexport) bool __stdcall DetachDebugger(DWORD ProcessId); + TitanEngine.DetachDebugger:types {"long",abi="stdcall",ret="byte"} + TE_DetachDebugger = TitanEngine.DetachDebugger +-- __declspec(dllexport) bool __stdcall DetachDebuggerEx(DWORD ProcessId); + TitanEngine.DetachDebuggerEx:types {"long",abi="stdcall",ret="byte"} + TE_DetachDebuggerEx = TitanEngine.DetachDebuggerEx +-- __declspec(dllexport) void __stdcall DebugLoopEx(DWORD TimeOut); + TitanEngine.DebugLoopEx:types {"long",abi="stdcall"} + TE_DebugLoopEx = TitanEngine.DebugLoopEx +-- __declspec(dllexport) void __stdcall DebugLoop(); + TitanEngine.DebugLoop:types {abi="stdcall"} + TE_DebugLoop = TitanEngine.DebugLoop +-- __declspec(dllexport) void __stdcall AutoDebugEx(char* szFileName, bool ReserveModuleBase, char* szCommandLine, char* szCurrentFolder, DWORD TimeOut, LPVOID EntryCallBack); + TitanEngine.AutoDebugEx:types {"string","long","string","string","long","callback",abi="stdcall"} + TE_AutoDebugEx = TitanEngine.AutoDebugEx +-- __declspec(dllexport) bool __stdcall IsFileBeingDebugged(); + TitanEngine.IsFileBeingDebugged:types {abi="stdcall",ret="byte"} + TE_IsFileBeingDebugged = TitanEngine.IsFileBeingDebugged +-- __declspec(dllexport) void __stdcall SetErrorModel(bool DisplayErrorMessages); + TitanEngine.SetErrorModel:types {"byte",abi="stdcall"} + TE_SetErrorModel = TitanEngine.SetErrorModel +-- +-- TitanEngine.FindOEP.functions: +-- +-- __declspec(dllexport) void __stdcall FindOEPInit(); + TitanEngine.FindOEPInit:types {abi="stdcall"} + TE_FindOEPInit = TitanEngine.FindOEPInit +-- __declspec(dllexport) bool __stdcall FindOEPGenerically(char* szFileName, LPVOID TraceInitCallBack, LPVOID CallBack); + TitanEngine.FindOEPGenerically:types {"string","callback","callback",abi="stdcall",ret="byte"} + TE_FindOEPGenerically = TitanEngine.FindOEPGenerically +-- +-- TitanEngine.Importer.functions: +-- +-- __declspec(dllexport) void __stdcall ImporterCleanup(); + TitanEngine.ImporterCleanup:types {abi="stdcall"} + TE_ImporterCleanup = TitanEngine.ImporterCleanup +-- __declspec(dllexport) void __stdcall ImporterSetImageBase(ULONG_PTR ImageBase); + TitanEngine.ImporterSetImageBase:types {"long",abi="stdcall"} + TE_ImporterSetImageBase = TitanEngine.ImporterSetImageBase +-- __declspec(dllexport) void __stdcall ImporterSetUnknownDelta(ULONG_PTR DeltaAddress); + TitanEngine.ImporterSetUnknownDelta:types {"long",abi="stdcall"} + TE_ImporterSetUnknownDelta = TitanEngine.ImporterSetUnknownDelta +-- __declspec(dllexport) long long __stdcall ImporterGetCurrentDelta(); + TitanEngine.ImporterGetCurrentDelta:types {abi="stdcall",ret="long"} + TE_ImporterGetCurrentDelta = TitanEngine.ImporterGetCurrentDelta +-- __declspec(dllexport) void __stdcall ImporterInit(DWORD MemorySize, ULONG_PTR ImageBase); + TitanEngine.ImporterInit:types {"long","long",abi="stdcall"} + TE_ImporterInit = TitanEngine.ImporterInit +-- __declspec(dllexport) void __stdcall ImporterAddNewDll(char* szDLLName, ULONG_PTR FirstThunk); + TitanEngine.ImporterAddNewDll:types {"string","long",abi="stdcall"} + TE_ImporterAddNewDll = TitanEngine.ImporterAddNewDll +-- __declspec(dllexport) void __stdcall ImporterAddNewAPI(char* szAPIName, ULONG_PTR ThunkValue); + TitanEngine.ImporterAddNewAPI:types {"string","long",abi="stdcall"} + TE_ImporterAddNewAPI = TitanEngine.ImporterAddNewAPI +-- __declspec(dllexport) void __stdcall ImporterAddNewOrdinalAPI(ULONG_PTR OrdinalNumber, ULONG_PTR ThunkValue); + TitanEngine.ImporterAddNewOrdinalAPI:types {"long","long",abi="stdcall"} + TE_ImporterAddNewOrdinalAPI = TitanEngine.ImporterAddNewOrdinalAPI +-- __declspec(dllexport) long __stdcall ImporterGetAddedDllCount(); + TitanEngine.ImporterGetAddedDllCount:types {abi="stdcall",ret="long"} + TE_ImporterGetAddedDllCount = TitanEngine.ImporterGetAddedDllCount +-- __declspec(dllexport) long __stdcall ImporterGetAddedAPICount(); + TitanEngine.ImporterGetAddedAPICount:types {abi="stdcall",ret="long"} + TE_ImporterGetAddedAPICount = TitanEngine.ImporterGetAddedAPICount +-- __declspec(dllexport) void* __stdcall ImporterGetLastAddedDLLName(); + TitanEngine.ImporterGetLastAddedDLLName:types {abi="stdcall",ret="string"} + TE_ImporterGetLastAddedDLLName = TitanEngine.ImporterGetLastAddedDLLName +-- __declspec(dllexport) void __stdcall ImporterMoveIAT(); + TitanEngine.ImporterMoveIAT:types {abi="stdcall"} + TE_ImporterMoveIAT = TitanEngine.ImporterMoveIAT +-- __declspec(dllexport) bool __stdcall ImporterExportIAT(ULONG_PTR StorePlace, ULONG_PTR FileMapVA); + TitanEngine.ImporterExportIAT:types {"long","long",abi="stdcall"} + TE_ImporterExportIAT = TitanEngine.ImporterExportIAT +-- __declspec(dllexport) long __stdcall ImporterEstimatedSize(); + TitanEngine.ImporterEstimatedSize:types {abi="stdcall",ret="long"} + TE_ImporterEstimatedSize = TitanEngine.ImporterEstimatedSize +-- __declspec(dllexport) bool __stdcall ImporterExportIATEx(char* szExportFileName, char* szSectionName); + TitanEngine.ImporterExportIATEx:types {"string","string",abi="stdcall",ret="byte"} + TE_ImporterExportIATEx = TitanEngine.ImporterExportIATEx +-- __declspec(dllexport) long long __stdcall ImporterFindAPIWriteLocation(char* szAPIName); + TitanEngine.ImporterFindAPIWriteLocation:types {"string",abi="stdcall",ret="long"} + TE_ImporterFindAPIWriteLocation = TitanEngine.ImporterFindAPIWriteLocation +-- __declspec(dllexport) long long __stdcall ImporterFindOrdinalAPIWriteLocation(ULONG_PTR OrdinalNumber); + TitanEngine.ImporterFindOrdinalAPIWriteLocation:types {"long",abi="stdcall",ret="long"} + TE_ImporterFindOrdinalAPIWriteLocation = TitanEngine.ImporterFindOrdinalAPIWriteLocation +-- __declspec(dllexport) long long __stdcall ImporterFindAPIByWriteLocation(char* szAPIName); + TitanEngine.ImporterFindAPIByWriteLocation:types {"string",abi="stdcall",ret="long"} + TE_ImporterFindAPIByWriteLocation = TitanEngine.ImporterFindAPIByWriteLocation +-- __declspec(dllexport) long long __stdcall ImporterFindDLLByWriteLocation(ULONG_PTR APIWriteLocation); + TitanEngine.ImporterFindDLLByWriteLocation:types {"long",abi="stdcall",ret="long"} + TE_ImporterFindDLLByWriteLocation = TitanEngine.ImporterFindDLLByWriteLocation +-- __declspec(dllexport) void* __stdcall ImporterGetDLLName(ULONG_PTR APIAddress); + TitanEngine.ImporterGetDLLName:types {"long",abi="stdcall",ret="string"} + TE_ImporterGetDLLName = TitanEngine.ImporterGetDLLName +-- __declspec(dllexport) void* __stdcall ImporterGetAPIName(ULONG_PTR APIAddress); + TitanEngine.ImporterGetAPIName:types {"long",abi="stdcall",ret="string"} + TE_ImporterGetAPIName = TitanEngine.ImporterGetAPIName +-- __declspec(dllexport) long long __stdcall ImporterGetAPIOrdinalNumber(ULONG_PTR APIAddress); + TitanEngine.ImporterGetAPIOrdinalNumber:types {"long",abi="stdcall",ret="long"} + TE_ImporterGetAPIOrdinalNumber = TitanEngine.ImporterGetAPIOrdinalNumber +-- __declspec(dllexport) void* __stdcall ImporterGetAPINameEx(ULONG_PTR APIAddress, ULONG_PTR DLLBasesList); + TitanEngine.ImporterGetAPINameEx:types {"long","pointer",abi="stdcall",ret="string"} + TE_ImporterGetAPINameEx = TitanEngine.ImporterGetAPINameEx +-- __declspec(dllexport) long long __stdcall ImporterGetRemoteAPIAddress(HANDLE hProcess, ULONG_PTR APIAddress); + TitanEngine.ImporterGetRemoteAPIAddress:types {"long","long",abi="stdcall",ret="long"} + TE_ImporterGetRemoteAPIAddress = TitanEngine.ImporterGetRemoteAPIAddress +-- __declspec(dllexport) long long __stdcall ImporterGetRemoteAPIAddressEx(char* szDLLName, char* szAPIName); + TitanEngine.ImporterGetRemoteAPIAddressEx:types {"string","string",abi="stdcall",ret="long"} + TE_ImporterGetRemoteAPIAddressEx = TitanEngine.ImporterGetRemoteAPIAddressEx +-- __declspec(dllexport) long long __stdcall ImporterGetLocalAPIAddress(HANDLE hProcess, ULONG_PTR APIAddress); + TitanEngine.ImporterGetLocalAPIAddress:types {"long","long",abi="stdcall",ret="long"} + TE_ImporterGetLocalAPIAddress = TitanEngine.ImporterGetLocalAPIAddress +-- __declspec(dllexport) void* __stdcall ImporterGetDLLNameFromDebugee(HANDLE hProcess, ULONG_PTR APIAddress); + TitanEngine.ImporterGetDLLNameFromDebugee:types {"long","long",abi="stdcall",ret="string"} + TE_ImporterGetDLLNameFromDebugee = TitanEngine.ImporterGetDLLNameFromDebugee +-- __declspec(dllexport) void* __stdcall ImporterGetAPINameFromDebugee(HANDLE hProcess, ULONG_PTR APIAddress); + TitanEngine.ImporterGetAPINameFromDebugee:types {"long","long",abi="stdcall",ret="string"} + TE_ImporterGetAPINameFromDebugee = TitanEngine.ImporterGetAPINameFromDebugee +-- __declspec(dllexport) long long __stdcall ImporterGetAPIOrdinalNumberFromDebugee(HANDLE hProcess, ULONG_PTR APIAddress); + TitanEngine.ImporterGetAPIOrdinalNumberFromDebugee:types {"long","long",abi="stdcall",ret="long"} + TE_ImporterGetAPIOrdinalNumberFromDebugee = TitanEngine.ImporterGetAPIOrdinalNumberFromDebugee +-- __declspec(dllexport) long __stdcall ImporterGetDLLIndexEx(ULONG_PTR APIAddress, ULONG_PTR DLLBasesList); + TitanEngine.ImporterGetDLLIndexEx:types {"long","pointer",abi="stdcall",ret="long"} + TE_ImporterGetDLLIndexEx = TitanEngine.ImporterGetDLLIndexEx +-- __declspec(dllexport) long __stdcall ImporterGetDLLIndex(HANDLE hProcess, ULONG_PTR APIAddress, ULONG_PTR DLLBasesList); + TitanEngine.ImporterGetDLLIndex:types {"long","long","pointer",abi="stdcall",ret="long"} + TE_ImporterGetDLLIndex = TitanEngine.ImporterGetDLLIndex +-- __declspec(dllexport) long long __stdcall ImporterGetRemoteDLLBase(HANDLE hProcess, HMODULE LocalModuleBase); + TitanEngine.ImporterGetRemoteDLLBase:types {"long","long",abi="stdcall",ret="long"} + TE_ImporterGetRemoteDLLBase = TitanEngine.ImporterGetRemoteDLLBase +-- __declspec(dllexport) bool __stdcall ImporterRelocateWriteLocation(ULONG_PTR AddValue); + TitanEngine.ImporterRelocateWriteLocation:types {"long",abi="stdcall",ret="byte"} + TE_ImporterRelocateWriteLocation = TitanEngine.ImporterRelocateWriteLocation +-- __declspec(dllexport) bool __stdcall ImporterIsForwardedAPI(HANDLE hProcess, ULONG_PTR APIAddress); + TitanEngine.ImporterIsForwardedAPI:types {"long","long",abi="stdcall",ret="byte"} + TE_ImporterIsForwardedAPI = TitanEngine.ImporterIsForwardedAPI +-- __declspec(dllexport) void* __stdcall ImporterGetForwardedAPIName(HANDLE hProcess, ULONG_PTR APIAddress); + TitanEngine.ImporterGetForwardedAPIName:types {"long","long",abi="stdcall",ret="string"} + TE_ImporterGetForwardedAPIName = TitanEngine.ImporterGetForwardedAPIName +-- __declspec(dllexport) void* __stdcall ImporterGetForwardedDLLName(HANDLE hProcess, ULONG_PTR APIAddress); + TitanEngine.ImporterGetForwardedDLLName:types {"long","long",abi="stdcall",ret="string"} + TE_ImporterGetForwardedDLLName = TitanEngine.ImporterGetForwardedDLLName +-- __declspec(dllexport) long __stdcall ImporterGetForwardedDLLIndex(HANDLE hProcess, ULONG_PTR APIAddress, ULONG_PTR DLLBasesList); + TitanEngine.ImporterGetForwardedDLLIndex:types {"long","long","pointer",abi="stdcall",ret="long"} + TE_ImporterGetForwardedDLLIndex = TitanEngine.ImporterGetForwardedDLLIndex +-- __declspec(dllexport) long long __stdcall ImporterGetForwardedAPIOrdinalNumber(HANDLE hProcess, ULONG_PTR APIAddress); + TitanEngine.ImporterGetForwardedAPIOrdinalNumber:types {"long","long",abi="stdcall",ret="long"} + TE_ImporterGetForwardedAPIOrdinalNumber = TitanEngine.ImporterGetForwardedAPIOrdinalNumber +-- __declspec(dllexport) long long __stdcall ImporterGetNearestAPIAddress(HANDLE hProcess, ULONG_PTR APIAddress); + TitanEngine.ImporterGetNearestAPIAddress:types {"long","long",abi="stdcall",ret="long"} + TE_ImporterGetNearestAPIAddress = TitanEngine.ImporterGetNearestAPIAddress +-- __declspec(dllexport) void* __stdcall ImporterGetNearestAPIName(HANDLE hProcess, ULONG_PTR APIAddress); + TitanEngine.ImporterGetNearestAPIName:types {"long","long",abi="stdcall",ret="string"} + TE_ImporterGetNearestAPIName = TitanEngine.ImporterGetNearestAPIName +-- __declspec(dllexport) bool __stdcall ImporterCopyOriginalIAT(char* szOriginalFile, char* szDumpFile); + TitanEngine.ImporterCopyOriginalIAT:types {"string","string",abi="stdcall",ret="byte"} + TE_ImporterCopyOriginalIAT = TitanEngine.ImporterCopyOriginalIAT +-- __declspec(dllexport) bool __stdcall ImporterLoadImportTable(char* szFileName); + TitanEngine.ImporterLoadImportTable:types {"string",abi="stdcall",ret="byte"} + TE_ImporterLoadImportTable = TitanEngine.ImporterLoadImportTable +-- __declspec(dllexport) bool __stdcall ImporterMoveOriginalIAT(char* szOriginalFile, char* szDumpFile, char* szSectionName); + TitanEngine.ImporterMoveOriginalIAT:types {"string","string","string",abi="stdcall",ret="byte"} + TE_ImporterMoveOriginalIAT = TitanEngine.ImporterMoveOriginalIAT +-- __declspec(dllexport) void __stdcall ImporterAutoSearchIAT(HANDLE hProcess, char* szFileName, ULONG_PTR ImageBase, ULONG_PTR SearchStart, DWORD SearchSize, LPVOID pIATStart, LPVOID pIATSize); + TitanEngine.ImporterAutoSearchIAT:types {"long","string","long","long","long","pointer","pointer",abi="stdcall"} + TE_ImporterAutoSearchIAT = TitanEngine.ImporterAutoSearchIAT +-- __declspec(dllexport) void __stdcall ImporterAutoSearchIATEx(HANDLE hProcess, ULONG_PTR ImageBase, ULONG_PTR SearchStart, DWORD SearchSize, LPVOID pIATStart, LPVOID pIATSize); + TitanEngine.ImporterAutoSearchIATEx:types {"long","long","long","long","pointer","pointer",abi="stdcall"} + TE_ImporterAutoSearchIATEx = TitanEngine.ImporterAutoSearchIATEx +-- __declspec(dllexport) void __stdcall ImporterEnumAddedData(LPVOID EnumCallBack); + TitanEngine.ImporterEnumAddedData:types {"callback",abi="stdcall"} + TE_ImporterEnumAddedData = TitanEngine.ImporterEnumAddedData +-- __declspec(dllexport) long __stdcall ImporterAutoFixIATEx(HANDLE hProcess, char* szDumpedFile, char* szSectionName, bool DumpRunningProcess, bool RealignFile, ULONG_PTR EntryPointAddress, ULONG_PTR ImageBase, ULONG_PTR SearchStart, DWORD SearchSize, DWORD SearchStep, bool TryAutoFix, bool FixEliminations, LPVOID UnknownPointerFixCallback); + TitanEngine.ImporterAutoSearchIATEx:types {"long","string","string","long","long","long","long","long","long","long","long","long","callback",abi="stdcall",ret="long"} + TE_ImporterAutoSearchIATEx = TitanEngine.ImporterAutoSearchIATEx +-- __declspec(dllexport) long __stdcall ImporterAutoFixIAT(HANDLE hProcess, char* szDumpedFile, ULONG_PTR ImageBase, ULONG_PTR SearchStart, DWORD SearchSize, DWORD SearchStep); + TitanEngine.ImporterAutoFixIAT:types {"long","string","long","long","long","long",abi="stdcall",ret="long"} + TE_ImporterAutoFixIAT = TitanEngine.ImporterAutoFixIAT +-- +-- Global.Engine.Hook.functions: +-- +-- __declspec(dllexport) bool __stdcall HooksSafeTransitionEx(LPVOID HookAddressArray, int NumberOfHooks, bool TransitionStart); + TitanEngine.HooksSafeTransitionEx:types {"pointer","long","long",abi="stdcall",ret="byte"} + TE_HooksSafeTransitionEx = TitanEngine.HooksSafeTransitionEx +-- __declspec(dllexport) bool __stdcall HooksSafeTransition(LPVOID HookAddress, bool TransitionStart); + TitanEngine.HooksSafeTransition:types {"long","long",abi="stdcall",ret="byte"} + TE_HooksSafeTransition = TitanEngine.HooksSafeTransition +-- __declspec(dllexport) bool __stdcall HooksIsAddressRedirected(LPVOID HookAddress); + TitanEngine.HooksIsAddressRedirected:types {"long",abi="stdcall",ret="byte"} + TE_HooksIsAddressRedirected = TitanEngine.HooksIsAddressRedirected +-- __declspec(dllexport) void* __stdcall HooksGetTrampolineAddress(LPVOID HookAddress); + TitanEngine.HooksGetTrampolineAddress:types {"long",abi="stdcall",ret="pointer"} + TE_HooksGetTrampolineAddress = TitanEngine.HooksGetTrampolineAddress +-- __declspec(dllexport) void* __stdcall HooksGetHookEntryDetails(LPVOID HookAddress); + TitanEngine.HooksGetHookEntryDetails:types {"long",abi="stdcall",ret="pointer"} + TE_HooksGetHookEntryDetails = TitanEngine.HooksGetHookEntryDetails +-- __declspec(dllexport) bool __stdcall HooksInsertNewRedirection(LPVOID HookAddress, LPVOID RedirectTo, int HookType); + TitanEngine.HooksInsertNewRedirection:types {"long","long","long",abi="stdcall",ret="byte"} + TE_HooksInsertNewRedirection = TitanEngine.HooksInsertNewRedirection +-- __declspec(dllexport) bool __stdcall HooksInsertNewIATRedirectionEx(ULONG_PTR FileMapVA, ULONG_PTR LoadedModuleBase, char* szHookFunction, LPVOID RedirectTo); + TitanEngine.HooksInsertNewIATRedirectionEx:types {"long","long","string","long",abi="stdcall",ret="byte"} + TE_HooksInsertNewIATRedirectionEx = TitanEngine.HooksInsertNewIATRedirectionEx +-- __declspec(dllexport) bool __stdcall HooksInsertNewIATRedirection(char* szModuleName, char* szHookFunction, LPVOID RedirectTo); + TitanEngine.HooksInsertNewIATRedirection:types {"string","string","long",abi="stdcall",ret="byte"} + TE_HooksInsertNewIATRedirection = TitanEngine.HooksInsertNewIATRedirection +-- __declspec(dllexport) bool __stdcall HooksRemoveRedirection(LPVOID HookAddress, bool RemoveAll); + TitanEngine.HooksRemoveRedirection:types {"long","long",abi="stdcall",ret="byte"} + TE_HooksRemoveRedirection = TitanEngine.HooksRemoveRedirection +-- __declspec(dllexport) bool __stdcall HooksRemoveRedirectionsForModule(HMODULE ModuleBase); + TitanEngine.HooksRemoveRedirectionsForModule:types {"long",abi="stdcall",ret="byte"} + TE_HooksRemoveRedirectionsForModule = TitanEngine.HooksRemoveRedirectionsForModule +-- __declspec(dllexport) bool __stdcall HooksRemoveIATRedirection(char* szModuleName, char* szHookFunction, bool RemoveAll); + TitanEngine.HooksRemoveIATRedirection:types {"string","string","long",abi="stdcall",ret="byte"} + TE_HooksRemoveIATRedirection = TitanEngine.HooksRemoveIATRedirection +-- __declspec(dllexport) bool __stdcall HooksDisableRedirection(LPVOID HookAddress, bool DisableAll); + TitanEngine.HooksDisableRedirection:types {"long","long",abi="stdcall",ret="byte"} + TE_HooksDisableRedirection = TitanEngine.HooksDisableRedirection +-- __declspec(dllexport) bool __stdcall HooksDisableRedirectionsForModule(HMODULE ModuleBase); + TitanEngine.HooksDisableRedirectionsForModule:types {"long",abi="stdcall",ret="byte"} + TE_HooksDisableRedirectionsForModule = TitanEngine.HooksDisableRedirectionsForModule +-- __declspec(dllexport) bool __stdcall HooksDisableIATRedirection(char* szModuleName, char* szHookFunction, bool DisableAll); + TitanEngine.HooksDisableIATRedirection:types {"string","string","long",abi="stdcall",ret="byte"} + TE_HooksDisableIATRedirection = TitanEngine.HooksDisableIATRedirection +-- __declspec(dllexport) bool __stdcall HooksEnableRedirection(LPVOID HookAddress, bool EnableAll); + TitanEngine.HooksEnableRedirection:types {"long","long",abi="stdcall",ret="byte"} + TE_HooksEnableRedirection = TitanEngine.HooksEnableRedirection +-- __declspec(dllexport) bool __stdcall HooksEnableRedirectionsForModule(HMODULE ModuleBase); + TitanEngine.HooksEnableRedirectionsForModule:types {"long",abi="stdcall",ret="byte"} + TE_HooksEnableRedirectionsForModule = TitanEngine.HooksEnableRedirectionsForModule +-- __declspec(dllexport) bool __stdcall HooksEnableIATRedirection(char* szModuleName, char* szHookFunction, bool EnableAll); + TitanEngine.HooksEnableIATRedirection:types {"string","string","long",abi="stdcall",ret="byte"} + TE_HooksEnableIATRedirection = TitanEngine.HooksEnableIATRedirection +-- __declspec(dllexport) void __stdcall HooksScanModuleMemory(HMODULE ModuleBase, LPVOID CallBack); + TitanEngine.HooksScanModuleMemory:types {"long","callback",abi="stdcall"} + TE_HooksScanModuleMemory = TitanEngine.HooksScanModuleMemory +-- __declspec(dllexport) void __stdcall HooksScanEntireProcessMemory(LPVOID CallBack); + TitanEngine.HooksScanModuleMemory:types {"callback",abi="stdcall"} + TE_HooksScanModuleMemory = TitanEngine.HooksScanModuleMemory +-- __declspec(dllexport) void __stdcall HooksScanEntireProcessMemoryEx(); + TitanEngine.HooksScanEntireProcessMemoryEx:types {abi="stdcall"} + TE_HooksScanEntireProcessMemoryEx = TitanEngine.HooksScanEntireProcessMemoryEx +-- +-- TitanEngine.Tracer.functions: +-- +-- __declspec(dllexport) void __stdcall TracerInit(); + TitanEngine.TracerInit:types {abi="stdcall"} + TE_TracerInit = TitanEngine.TracerInit +-- __declspec(dllexport) long long __stdcall TracerLevel1(HANDLE hProcess, ULONG_PTR AddressToTrace); + TitanEngine.TracerLevel1:types {"long","long",abi="stdcall",ret="long"} + TE_TracerLevel1 = TitanEngine.TracerLevel1 +-- __declspec(dllexport) long long __stdcall HashTracerLevel1(HANDLE hProcess, ULONG_PTR AddressToTrace, DWORD InputNumberOfInstructions); + TitanEngine.HashTracerLevel1:types {"long","long","long",abi="stdcall",ret="long"} + TE_HashTracerLevel1 = TitanEngine.HashTracerLevel1 +-- __declspec(dllexport) long __stdcall TracerDetectRedirection(HANDLE hProcess, ULONG_PTR AddressToTrace); + TitanEngine.TracerDetectRedirection:types {"long","long",abi="stdcall",ret="long"} + TE_TracerDetectRedirection = TitanEngine.TracerDetectRedirection +-- __declspec(dllexport) long long __stdcall TracerFixKnownRedirection(HANDLE hProcess, ULONG_PTR AddressToTrace, DWORD RedirectionId); + TitanEngine.TracerFixKnownRedirection:types {"long","long","long",abi="stdcall",ret="long"} + TE_TracerFixKnownRedirection = TitanEngine.TracerFixKnownRedirection +-- __declspec(dllexport) long __stdcall TracerFixRedirectionViaImpRecPlugin(HANDLE hProcess, char* szPluginName, ULONG_PTR AddressToTrace); + TitanEngine.TracerFixRedirectionViaImpRecPlugin:types {"long","string","long",abi="stdcall",ret="long"} + TE_TracerFixRedirectionViaImpRecPlugin = TitanEngine.TracerFixRedirectionViaImpRecPlugin +-- +-- TitanEngine.Exporter.functions: +-- +-- __declspec(dllexport) void __stdcall ExporterCleanup(); + TitanEngine.ExporterCleanup:types {abi="stdcall"} + TE_ExporterCleanup = TitanEngine.ExporterCleanup +-- __declspec(dllexport) void __stdcall ExporterSetImageBase(ULONG_PTR ImageBase); + TitanEngine.ExporterSetImageBase:types {"long",abi="stdcall"} + TE_ExporterSetImageBase = TitanEngine.ExporterSetImageBase +-- __declspec(dllexport) void __stdcall ExporterInit(DWORD MemorySize, ULONG_PTR ImageBase, DWORD ExportOrdinalBase, char* szExportModuleName); + TitanEngine.ExporterInit:types {"long","long","long","string",abi="stdcall"} + TE_ExporterInit = TitanEngine.ExporterInit +-- __declspec(dllexport) bool __stdcall ExporterAddNewExport(char* szExportName, DWORD ExportRelativeAddress); + TitanEngine.ExporterAddNewExport:types {"string","long",abi="stdcall",ret="byte"} + TE_ExporterAddNewExport = TitanEngine.ExporterAddNewExport +-- __declspec(dllexport) bool __stdcall ExporterAddNewOrdinalExport(DWORD OrdinalNumber, DWORD ExportRelativeAddress); + TitanEngine.ExporterAddNewOrdinalExport:types {"long","long",abi="stdcall",ret="byte"} + TE_ExporterAddNewOrdinalExport = TitanEngine.ExporterAddNewOrdinalExport +-- __declspec(dllexport) long __stdcall ExporterGetAddedExportCount(); + TitanEngine.ExporterGetAddedExportCount:types {abi="stdcall",ret="long"} + TE_ExporterGetAddedExportCount = TitanEngine.ExporterGetAddedExportCount +-- __declspec(dllexport) long __stdcall ExporterEstimatedSize(); + TitanEngine.ExporterEstimatedSize:types {abi="stdcall",ret="long"} + TE_ExporterEstimatedSize = TitanEngine.ExporterEstimatedSize +-- __declspec(dllexport) bool __stdcall ExporterBuildExportTable(ULONG_PTR StorePlace, ULONG_PTR FileMapVA); + TitanEngine.ExporterBuildExportTable:types {"long","long",abi="stdcall",ret="byte"} + TE_ExporterBuildExportTable = TitanEngine.ExporterBuildExportTable +-- __declspec(dllexport) bool __stdcall ExporterBuildExportTableEx(char* szExportFileName, char* szSectionName); + TitanEngine.ExporterBuildExportTableEx:types {"string","string",abi="stdcall",ret="byte"} + TE_ExporterBuildExportTableEx = TitanEngine.ExporterBuildExportTableEx +-- __declspec(dllexport) bool __stdcall ExporterLoadExportTable(char* szFileName); + TitanEngine.ExporterLoadExportTable:types {"string",abi="stdcall",ret="byte"} + TE_ExporterLoadExportTable = TitanEngine.ExporterLoadExportTable +-- +-- TitanEngine.Librarian.functions: +-- +-- __declspec(dllexport) bool __stdcall LibrarianSetBreakPoint(char* szLibraryName, DWORD bpxType, bool SingleShoot, LPVOID bpxCallBack); + TitanEngine.LibrarianSetBreakPoint:types {"string","long","long","callback",abi="stdcall",ret="byte"} + TE_LibrarianSetBreakPoint = TitanEngine.LibrarianSetBreakPoint +-- __declspec(dllexport) bool __stdcall LibrarianRemoveBreakPoint(char* szLibraryName, DWORD bpxType); + TitanEngine.LibrarianRemoveBreakPoint:types {"string","long",abi="stdcall",ret="byte"} + TE_LibrarianRemoveBreakPoint = TitanEngine.LibrarianRemoveBreakPoint +-- __declspec(dllexport) void* __stdcall LibrarianGetLibraryInfo(char* szLibraryName); + TitanEngine.LibrarianGetLibraryInfo:types {"string",abi="stdcall",ret="pointer"} + TE_LibrarianGetLibraryInfo = TitanEngine.LibrarianGetLibraryInfo +-- __declspec(dllexport) void* __stdcall LibrarianGetLibraryInfoEx(void* BaseOfDll); + TitanEngine.LibrarianGetLibraryInfoEx:types {"long",abi="stdcall",ret="pointer"} + TE_LibrarianGetLibraryInfoEx = TitanEngine.LibrarianGetLibraryInfoEx +-- __declspec(dllexport) void __stdcall LibrarianEnumLibraryInfo(void* EnumCallBack); + TitanEngine.LibrarianEnumLibraryInfo:types {"callback",abi="stdcall"} + TE_LibrarianEnumLibraryInfo = TitanEngine.LibrarianEnumLibraryInfo +-- +-- TitanEngine.Process.functions: +-- +-- __declspec(dllexport) long __stdcall GetActiveProcessId(char* szImageName); + TitanEngine.GetActiveProcessId:types {"string",abi="stdcall",ret="long"} + TE_GetActiveProcessId = TitanEngine.GetActiveProcessId +-- __declspec(dllexport) void __stdcall EnumProcessesWithLibrary(char* szLibraryName, void* EnumFunction); + TitanEngine.EnumProcessesWithLibrary:types {"string","callback",abi="stdcall"} + TE_EnumProcessesWithLibrary = TitanEngine.EnumProcessesWithLibrary +-- +-- TitanEngine.TLSFixer.functions: +-- +-- __declspec(dllexport) bool __stdcall TLSBreakOnCallBack(LPVOID ArrayOfCallBacks, DWORD NumberOfCallBacks, LPVOID bpxCallBack); + TitanEngine.TLSBreakOnCallBack:types {"pointer","long","callback",abi="stdcall",ret="byte"} + TE_TLSBreakOnCallBack = TitanEngine.TLSBreakOnCallBack +-- __declspec(dllexport) bool __stdcall TLSGrabCallBackData(char* szFileName, LPVOID ArrayOfCallBacks, LPDWORD NumberOfCallBacks); + TitanEngine.TLSGrabCallBackData:types {"string","pointer","pointer",abi="stdcall",ret="byte"} + TE_TLSGrabCallBackData = TitanEngine.TLSGrabCallBackData +-- __declspec(dllexport) bool __stdcall TLSBreakOnCallBackEx(char* szFileName, LPVOID bpxCallBack); + TitanEngine.TLSBreakOnCallBackEx:types {"string","callback",abi="stdcall",ret="byte"} + TE_TLSBreakOnCallBackEx = TitanEngine.TLSBreakOnCallBackEx +-- __declspec(dllexport) bool __stdcall TLSRemoveCallback(char* szFileName); + TitanEngine.TLSRemoveCallback:types {"string",abi="stdcall",ret="byte"} + TE_TLSRemoveCallback = TitanEngine.TLSRemoveCallback +-- __declspec(dllexport) bool __stdcall TLSRemoveTable(char* szFileName); + TitanEngine.TLSRemoveTable:types {"string",abi="stdcall",ret="byte"} + TE_TLSRemoveTable = TitanEngine.TLSRemoveTable +-- __declspec(dllexport) bool __stdcall TLSBackupData(char* szFileName); + TitanEngine.TLSBackupData:types {"string",abi="stdcall",ret="byte"} + TE_TLSBackupData = TitanEngine.TLSBackupData +-- __declspec(dllexport) bool __stdcall TLSRestoreData(); + TitanEngine.TLSRestoreData:types {abi="stdcall",ret="byte"} + TE_TLSRestoreData = TitanEngine.TLSRestoreData +-- __declspec(dllexport) bool __stdcall TLSBuildNewTable(ULONG_PTR FileMapVA, ULONG_PTR StorePlace, ULONG_PTR StorePlaceRVA, LPVOID ArrayOfCallBacks, DWORD NumberOfCallBacks); + TitanEngine.TLSBuildNewTable:types {"long","long","long","pointer","long",abi="stdcall",ret="byte"} + TE_TLSBuildNewTable = TitanEngine.TLSBuildNewTable +-- __declspec(dllexport) bool __stdcall TLSBuildNewTableEx(char* szFileName, char* szSectionName, LPVOID ArrayOfCallBacks, DWORD NumberOfCallBacks); + TitanEngine.TLSBuildNewTableEx:types {"string","string","pointer","long",abi="stdcall",ret="byte"} + TE_TLSBuildNewTableEx = TitanEngine.TLSBuildNewTableEx +-- +-- TitanEngine.Handler.functions: +-- +-- __declspec(dllexport) long __stdcall HandlerGetActiveHandleCount(DWORD ProcessId); + TitanEngine.HandlerGetActiveHandleCount:types {"long",abi="stdcall",ret="long"} + TE_HandlerGetActiveHandleCount = TitanEngine.HandlerGetActiveHandleCount +-- __declspec(dllexport) bool __stdcall HandlerIsHandleOpen(DWORD ProcessId, HANDLE hHandle); + TitanEngine.HandlerIsHandleOpen:types {"long","long",abi="stdcall",ret="byte"} + TE_HandlerIsHandleOpen = TitanEngine.HandlerIsHandleOpen +-- __declspec(dllexport) void* __stdcall HandlerGetHandleName(HANDLE hProcess, DWORD ProcessId, HANDLE hHandle, bool TranslateName); + TitanEngine.HandlerGetHandleName:types {"long","long","long","long",abi="stdcall",ret="string"} + TE_HandlerGetHandleName = TitanEngine.HandlerGetHandleName +-- __declspec(dllexport) long __stdcall HandlerEnumerateOpenHandles(DWORD ProcessId, LPVOID HandleBuffer, DWORD MaxHandleCount); + TitanEngine.HandlerEnumerateOpenHandles:types {"long","pointer","long",abi="stdcall",ret="long"} + TE_HandlerEnumerateOpenHandles = TitanEngine.HandlerEnumerateOpenHandles +-- __declspec(dllexport) long long __stdcall HandlerGetHandleDetails(HANDLE hProcess, DWORD ProcessId, HANDLE hHandle, DWORD InformationReturn); + TitanEngine.HandlerGetHandleDetails:types {"long","long","long","long",abi="stdcall",ret="long"} + TE_HandlerGetHandleDetails = TitanEngine.HandlerGetHandleDetails +-- __declspec(dllexport) bool __stdcall HandlerCloseRemoteHandle(HANDLE hProcess, HANDLE hHandle); + TitanEngine.HandlerCloseRemoteHandle:types {"long","long",abi="stdcall",ret="byte"} + TE_HandlerCloseRemoteHandle = TitanEngine.HandlerCloseRemoteHandle +-- __declspec(dllexport) long __stdcall HandlerEnumerateLockHandles(char* szFileOrFolderName, bool NameIsFolder, bool NameIsTranslated, LPVOID HandleDataBuffer, DWORD MaxHandleCount); + TitanEngine.HandlerEnumerateLockHandles:types {"string","long","long","pointer","long",abi="stdcall",ret="long"} + TE_HandlerEnumerateLockHandles = TitanEngine.HandlerEnumerateLockHandles +-- __declspec(dllexport) bool __stdcall HandlerCloseAllLockHandles(char* szFileOrFolderName, bool NameIsFolder, bool NameIsTranslated); + TitanEngine.HandlerCloseAllLockHandles:types {"string","long","long",abi="stdcall",ret="byte"} + TE_HandlerCloseAllLockHandles = TitanEngine.HandlerCloseAllLockHandles +-- __declspec(dllexport) bool __stdcall HandlerIsFileLocked(char* szFileOrFolderName, bool NameIsFolder, bool NameIsTranslated); + TitanEngine.HandlerIsFileLocked:types {"string","long","long",abi="stdcall",ret="byte"} + TE_HandlerIsFileLocked = TitanEngine.HandlerIsFileLocked +-- __declspec(dllexport) long __stdcall HandlerEnumerateOpenMutexes(HANDLE hProcess, DWORD ProcessId, LPVOID HandleBuffer, DWORD MaxHandleCount); + TitanEngine.HandlerEnumerateOpenMutexes:types {"long","long","pointer","long",abi="stdcall",ret="long"} + TE_HandlerEnumerateOpenMutexes = TitanEngine.HandlerEnumerateOpenMutexes +-- __declspec(dllexport) long long __stdcall HandlerGetOpenMutexHandle(HANDLE hProcess, DWORD ProcessId, char* szMutexString); + TitanEngine.HandlerGetOpenMutexHandle:types {"long","long","string",abi="stdcall",ret="long"} + TE_HandlerGetOpenMutexHandle = TitanEngine.HandlerGetOpenMutexHandle +-- ___declspec(dllexport) long __stdcall HandlerGetProcessIdWhichCreatedMutex(char* szMutexString); + TitanEngine.HandlerGetProcessIdWhichCreatedMutex:types {"string",abi="stdcall",ret="long"} + TE_HandlerGetProcessIdWhichCreatedMutex = TitanEngine.HandlerGetProcessIdWhichCreatedMutex +-- +-- TitanEngine.TranslateName.functions: +-- +-- __declspec(dllexport) void* __stdcall TranslateNativeName(char* szNativeName); + TitanEngine.TranslateNativeName:types {"string",abi="stdcall",ret="string"} + TE_TranslateNativeName = TitanEngine.TranslateNativeName +-- +-- TitanEngine.Injector.functions: +-- +-- __declspec(dllexport) bool __stdcall RemoteLoadLibrary(HANDLE hProcess, char* szLibraryFile, bool WaitForThreadExit); + TitanEngine.RemoteLoadLibrary:types {"long","string","long",abi="stdcall",ret="byte"} + TE_RemoteLoadLibrary = TitanEngine.RemoteLoadLibrary +-- __declspec(dllexport) bool __stdcall RemoteFreeLibrary(HANDLE hProcess, HMODULE hModule, char* szLibraryFile, bool WaitForThreadExit); + TitanEngine.RemoteFreeLibrary:types {"long","long","string","long",abi="stdcall",ret="byte"} + TE_RemoteFreeLibrary = TitanEngine.RemoteFreeLibrary +-- __declspec(dllexport) bool __stdcall RemoteExitProcess(HANDLE hProcess, DWORD ExitCode); + TitanEngine.RemoteExitProcess:types {"long","long",abi="stdcall",ret="byte"} + TE_RemoteExitProcess = TitanEngine.RemoteExitProcess +-- +-- TitanEngine.StaticUnpacker.functions: +-- +-- __declspec(dllexport) bool __stdcall StaticFileLoad(char* szFileName, DWORD DesiredAccess, bool SimulateLoad, LPHANDLE FileHandle, LPDWORD LoadedSize, LPHANDLE FileMap, PULONG_PTR FileMapVA); + TitanEngine.StaticFileLoad:types {"string","long","long","pointer","pointer","pointer","pointer",abi="stdcall",ret="byte"} + TE_StaticFileLoad = TitanEngine.StaticFileLoad +-- __declspec(dllexport) bool __stdcall StaticFileUnload(char* szFileName, bool CommitChanges, HANDLE FileHandle, DWORD LoadedSize, HANDLE FileMap, ULONG_PTR FileMapVA); + TitanEngine.StaticFileUnload:types {"string","long","long","long","long","long",abi="stdcall",ret="byte"} + TE_StaticFileUnload = TitanEngine.StaticFileUnload +-- __declspec(dllexport) bool __stdcall StaticFileOpen(char* szFileName, DWORD DesiredAccess, LPHANDLE FileHandle, LPDWORD FileSizeLow, LPDWORD FileSizeHigh); + TitanEngine.StaticFileOpen:types {"string","long","pointer","pointer","pointer",abi="stdcall",ret="byte"} + TE_StaticFileOpen = TitanEngine.StaticFileOpen +-- __declspec(dllexport) bool __stdcall StaticFileGetContent(HANDLE FileHandle, DWORD FilePositionLow, LPDWORD FilePositionHigh, void* Buffer, DWORD Size); + TitanEngine.StaticFileGetContent:types {"long","long","pointer","pointer","long",abi="stdcall",ret="byte"} + TE_StaticFileGetContent = TitanEngine.StaticFileGetContent +-- __declspec(dllexport) void __stdcall StaticFileClose(HANDLE FileHandle); + TitanEngine.StaticFileClose:types {"long",abi="stdcall"} + TE_StaticFileClose = TitanEngine.StaticFileClose +-- __declspec(dllexport) void __stdcall StaticMemoryDecrypt(LPVOID MemoryStart, DWORD MemorySize, DWORD DecryptionType, DWORD DecryptionKeySize, ULONG_PTR DecryptionKey); + TitanEngine.StaticMemoryDecrypt:types {"long","long","long","long","long",abi="stdcall"} + TE_StaticMemoryDecrypt = TitanEngine.StaticMemoryDecrypt +-- __declspec(dllexport) void __stdcall StaticMemoryDecryptEx(LPVOID MemoryStart, DWORD MemorySize, DWORD DecryptionKeySize, void* DecryptionCallBack); + TitanEngine.StaticMemoryDecryptEx:types {"long","long","long","long","callback",abi="stdcall"} + TE_StaticMemoryDecryptEx = TitanEngine.StaticMemoryDecryptEx +-- __declspec(dllexport) void __stdcall StaticMemoryDecryptSpecial(LPVOID MemoryStart, DWORD MemorySize, DWORD DecryptionKeySize, DWORD SpecDecryptionType, void* DecryptionCallBack); + TitanEngine.StaticMemoryDecryptSpecial:types {"long","long","long","long","callback",abi="stdcall"} + TE_StaticMemoryDecryptSpecial = TitanEngine.StaticMemoryDecryptSpecial +-- __declspec(dllexport) void __stdcall StaticSectionDecrypt(ULONG_PTR FileMapVA, DWORD SectionNumber, bool SimulateLoad, DWORD DecryptionType, DWORD DecryptionKeySize, ULONG_PTR DecryptionKey); + TitanEngine.StaticSectionDecrypt:types {"long","long","long","long","long","long",abi="stdcall"} + TE_StaticSectionDecrypt = TitanEngine.StaticSectionDecrypt +-- __declspec(dllexport) bool __stdcall StaticMemoryDecompress(void* Source, DWORD SourceSize, void* Destination, DWORD DestinationSize, int Algorithm); + TitanEngine.StaticMemoryDecompress:types {"pointer","long","pointer","long","long",abi="stdcall",ret="byte"} + TE_StaticMemoryDecompress = TitanEngine.StaticMemoryDecompress +-- __declspec(dllexport) bool __stdcall StaticRawMemoryCopy(HANDLE hFile, ULONG_PTR FileMapVA, ULONG_PTR VitualAddressToCopy, DWORD Size, bool AddressIsRVA, char* szDumpFileName); + TitanEngine.StaticRawMemoryCopy:types {"long","long","long","long","long","string",abi="stdcall",ret="byte"} + TE_StaticRawMemoryCopy = TitanEngine.StaticRawMemoryCopy +-- __declspec(dllexport) bool __stdcall StaticRawMemoryCopyEx(HANDLE hFile, ULONG_PTR RawAddressToCopy, DWORD Size, char* szDumpFileName); + TitanEngine.StaticRawMemoryCopyEx:types {"long","long","long","string",abi="stdcall",ret="byte"} + TE_StaticRawMemoryCopyEx = TitanEngine.StaticRawMemoryCopyEx +-- __declspec(dllexport) bool __stdcall StaticHashMemory(void* MemoryToHash, DWORD SizeOfMemory, void* HashDigest, bool OutputString, int Algorithm); + TitanEngine.StaticHashMemory:types {"long","long","pointer","long","long",abi="stdcall",ret="byte"} + TE_StaticHashMemory = TitanEngine.StaticHashMemory +-- __declspec(dllexport) bool __stdcall StaticHashFile(char* szFileName, char* HashDigest, bool OutputString, int Algorithm); + TitanEngine.StaticHashFile:types {"string","string","long","long",abi="stdcall",ret="byte"} + TE_StaticHashFile = TitanEngine.StaticHashFile +-- CallBacks: +-- typedef bool(__stdcall *fStaticCallBack)(void* sMemoryStart, int sKeySize); +-- TE_StaticMemoryDecryptEx_CB = alien.callback(YourFunctionHere, "pointer", "int", abi = "stdcall", ret = "byte") +-- TE_StaticMemoryDecryptSpecial_CB = alien.callback(YourFunctionHere, "pointer", "int", abi = "stdcall", ret = "byte") +-- +-- TitanEngine.Engine.functions: +-- +-- __declspec(dllexport) void __stdcall SetEngineVariable(DWORD VariableId, bool VariableSet); + TitanEngine.SetEngineVariable:types {"long","long",abi="stdcall"} + TE_SetEngineVariable = TitanEngine.SetEngineVariable +-- __declspec(dllexport) bool __stdcall EngineCreateMissingDependencies(char* szFileName, char* szOutputFolder, bool LogCreatedFiles); + TitanEngine.EngineCreateMissingDependencies:types {"string","string","long",abi="stdcall",ret="byte"} + TE_EngineCreateMissingDependencies = TitanEngine.EngineCreateMissingDependencies +-- __declspec(dllexport) bool __stdcall EngineFakeMissingDependencies(HANDLE hProcess); + TitanEngine.EngineFakeMissingDependencies:types {"long",abi="stdcall",ret="byte"} + TE_EngineFakeMissingDependencies = TitanEngine.EngineFakeMissingDependencies +-- __declspec(dllexport) bool __stdcall EngineDeleteCreatedDependencies(); + TitanEngine.EngineDeleteCreatedDependencies:types {abi="stdcall",ret="byte"} + TE_EngineDeleteCreatedDependencies = TitanEngine.EngineDeleteCreatedDependencies +-- __declspec(dllexport) bool __stdcall EngineCreateUnpackerWindow(char* WindowUnpackerTitle, char* WindowUnpackerLongTitle, char* WindowUnpackerName, char* WindowUnpackerAuthor, void* StartUnpackingCallBack); + TitanEngine.EngineCreateUnpackerWindow:types {"string","string","string","string","callback",abi="stdcall",ret="byte"} + TE_EngineCreateUnpackerWindow = TitanEngine.EngineCreateUnpackerWindow +-- __declspec(dllexport) bool __stdcall EngineAddUnpackerWindowLogMessage(char* szLogMessage); + TitanEngine.EngineAddUnpackerWindowLogMessage:types {"string",abi="stdcall",ret="byte"} + TE_EngineAddUnpackerWindowLogMessage = TitanEngine.EngineAddUnpackerWindowLogMessage +-- +-- TitanEngine.Engine.functions: +-- +-- __declspec(dllexport) bool __stdcall ExtensionManagerIsPluginLoaded(char* szPluginName); + TitanEngine.ExtensionManagerIsPluginLoaded:types {"string",abi="stdcall",ret="byte"} + TE_ExtensionManagerIsPluginLoaded = TitanEngine.ExtensionManagerIsPluginLoaded +-- __declspec(dllexport) bool __stdcall ExtensionManagerIsPluginEnabled(char* szPluginName); + TitanEngine.ExtensionManagerIsPluginEnabled:types {"string",abi="stdcall",ret="byte"} + TE_ExtensionManagerIsPluginEnabled = TitanEngine.ExtensionManagerIsPluginEnabled +-- __declspec(dllexport) bool __stdcall ExtensionManagerDisableAllPlugins(); + TitanEngine.ExtensionManagerDisableAllPlugins:types {abi="stdcall",ret="byte"} + TE_ExtensionManagerDisableAllPlugins = TitanEngine.ExtensionManagerDisableAllPlugins +-- __declspec(dllexport) bool __stdcall ExtensionManagerDisablePlugin(char* szPluginName); + TitanEngine.ExtensionManagerDisablePlugin:types {"string",abi="stdcall",ret="byte"} + TE_ExtensionManagerDisablePlugin = TitanEngine.ExtensionManagerDisablePlugin +-- __declspec(dllexport) bool __stdcall ExtensionManagerEnableAllPlugins(); + TitanEngine.ExtensionManagerEnableAllPlugins:types {abi="stdcall",ret="byte"} + TE_ExtensionManagerEnableAllPlugins = TitanEngine.ExtensionManagerEnableAllPlugins +-- __declspec(dllexport) bool __stdcall ExtensionManagerEnablePlugin(char* szPluginName); + TitanEngine.ExtensionManagerEnablePlugin:types {"string",abi="stdcall",ret="byte"} + TE_ExtensionManagerEnablePlugin = TitanEngine.ExtensionManagerEnablePlugin +-- __declspec(dllexport) bool __stdcall ExtensionManagerUnloadAllPlugins(); + TitanEngine.ExtensionManagerUnloadAllPlugins:types {abi="stdcall",ret="byte"} + TE_ExtensionManagerUnloadAllPlugins = TitanEngine.ExtensionManagerUnloadAllPlugins +-- __declspec(dllexport) bool __stdcall ExtensionManagerUnloadPlugin(char* szPluginName); + TitanEngine.ExtensionManagerUnloadPlugin:types {"string",abi="stdcall",ret="byte"} + TE_ExtensionManagerUnloadPlugin = TitanEngine.ExtensionManagerUnloadPlugin diff --git a/SDK/MASM/TitanEngine.INC b/SDK/MASM/TitanEngine.INC new file mode 100644 index 0000000..2c5f07b --- /dev/null +++ b/SDK/MASM/TitanEngine.INC @@ -0,0 +1,832 @@ +;--- include file created by h2incx v0.99.20 (copyright 2005-2009 japheth) +;--- source file: C:\Users\Administrator\Desktop\h2incx\SDK.h, last modified: 3/8/2010 17:0 +;--- cmdline used for creation: -a -b -d3 -y sdk.h + +include windows.inc +includelib TitanEngine_x86.lib + +UE_ACCESS_READ EQU 0 +UE_ACCESS_WRITE EQU 1 +UE_ACCESS_ALL EQU 2 +UE_HIDE_BASIC EQU 1 +UE_PLUGIN_CALL_REASON_PREDEBUG EQU 1 +UE_PLUGIN_CALL_REASON_EXCEPTION EQU 2 +UE_PLUGIN_CALL_REASON_POSTDEBUG EQU 3 +TEE_HOOK_NRM_JUMP EQU 1 +TEE_HOOK_NRM_CALL EQU 3 +TEE_HOOK_IAT EQU 5 +UE_ENGINE_ALOW_MODULE_LOADING EQU 1 +UE_ENGINE_AUTOFIX_FORWARDERS EQU 2 +UE_ENGINE_PASS_ALL_EXCEPTIONS EQU 3 +UE_ENGINE_NO_CONSOLE_WINDOW EQU 4 +UE_ENGINE_BACKUP_FOR_CRITICAL_FUNCTIONS EQU 5 +UE_ENGINE_CALL_PLUGIN_CALLBACK EQU 6 +UE_ENGINE_RESET_CUSTOM_HANDLER EQU 7 +UE_ENGINE_CALL_PLUGIN_DEBUG_CALLBACK EQU 8 +UE_OPTION_REMOVEALL EQU 1 +UE_OPTION_DISABLEALL EQU 2 +UE_OPTION_REMOVEALLDISABLED EQU 3 +UE_OPTION_REMOVEALLENABLED EQU 4 +UE_STATIC_DECRYPTOR_XOR EQU 1 +UE_STATIC_DECRYPTOR_SUB EQU 2 +UE_STATIC_DECRYPTOR_ADD EQU 3 +UE_STATIC_DECRYPTOR_FOREWARD EQU 1 +UE_STATIC_DECRYPTOR_BACKWARD EQU 2 +UE_STATIC_KEY_SIZE_1 EQU 1 +UE_STATIC_KEY_SIZE_2 EQU 2 +UE_STATIC_KEY_SIZE_4 EQU 4 +UE_STATIC_KEY_SIZE_8 EQU 8 +UE_STATIC_APLIB EQU 1 +UE_STATIC_APLIB_DEPACK EQU 2 +UE_STATIC_LZMA EQU 3 +UE_STATIC_HASH_MD5 EQU 1 +UE_STATIC_HASH_SHA1 EQU 2 +UE_STATIC_HASH_CRC32 EQU 3 +UE_RESOURCE_LANGUAGE_ANY EQU - 1 +UE_PE_OFFSET EQU 0 +UE_IMAGEBASE EQU 1 +UE_OEP EQU 2 +UE_SIZEOFIMAGE EQU 3 +UE_SIZEOFHEADERS EQU 4 +UE_SIZEOFOPTIONALHEADER EQU 5 +UE_SECTIONALIGNMENT EQU 6 +UE_IMPORTTABLEADDRESS EQU 7 +UE_IMPORTTABLESIZE EQU 8 +UE_RESOURCETABLEADDRESS EQU 9 +UE_RESOURCETABLESIZE EQU 10 +UE_EXPORTTABLEADDRESS EQU 11 +UE_EXPORTTABLESIZE EQU 12 +UE_TLSTABLEADDRESS EQU 13 +UE_TLSTABLESIZE EQU 14 +UE_RELOCATIONTABLEADDRESS EQU 15 +UE_RELOCATIONTABLESIZE EQU 16 +UE_TIMEDATESTAMP EQU 17 +UE_SECTIONNUMBER EQU 18 +UE_CHECKSUM EQU 19 +UE_SUBSYSTEM EQU 20 +UE_CHARACTERISTICS EQU 21 +UE_NUMBEROFRVAANDSIZES EQU 22 +UE_SECTIONNAME EQU 23 +UE_SECTIONVIRTUALOFFSET EQU 24 +UE_SECTIONVIRTUALSIZE EQU 25 +UE_SECTIONRAWOFFSET EQU 26 +UE_SECTIONRAWSIZE EQU 27 +UE_SECTIONFLAGS EQU 28 +UE_CH_BREAKPOINT EQU 1 +UE_CH_SINGLESTEP EQU 2 +UE_CH_ACCESSVIOLATION EQU 3 +UE_CH_ILLEGALINSTRUCTION EQU 4 +UE_CH_NONCONTINUABLEEXCEPTION EQU 5 +UE_CH_ARRAYBOUNDSEXCEPTION EQU 6 +UE_CH_FLOATDENORMALOPERAND EQU 7 +UE_CH_FLOATDEVIDEBYZERO EQU 8 +UE_CH_INTEGERDEVIDEBYZERO EQU 9 +UE_CH_INTEGEROVERFLOW EQU 10 +UE_CH_PRIVILEGEDINSTRUCTION EQU 11 +UE_CH_PAGEGUARD EQU 12 +UE_CH_EVERYTHINGELSE EQU 13 +UE_CH_CREATETHREAD EQU 14 +UE_CH_EXITTHREAD EQU 15 +UE_CH_CREATEPROCESS EQU 16 +UE_CH_EXITPROCESS EQU 17 +UE_CH_LOADDLL EQU 18 +UE_CH_UNLOADDLL EQU 19 +UE_CH_OUTPUTDEBUGSTRING EQU 20 +UE_CH_AFTEREXCEPTIONPROCESSING EQU 21 +UE_CH_ALLEVENTS EQU 22 +UE_OPTION_HANDLER_RETURN_HANDLECOUNT EQU 1 +UE_OPTION_HANDLER_RETURN_ACCESS EQU 2 +UE_OPTION_HANDLER_RETURN_FLAGS EQU 3 +UE_OPTION_HANDLER_RETURN_TYPENAME EQU 4 +UE_BREAKPOINT_INT3 EQU 1 +UE_BREAKPOINT_LONG_INT3 EQU 2 +UE_BREAKPOINT_UD2 EQU 3 +UE_BPXREMOVED EQU 0 +UE_BPXACTIVE EQU 1 +UE_BPXINACTIVE EQU 2 +UE_BREAKPOINT EQU 0 +UE_SINGLESHOOT EQU 1 +UE_HARDWARE EQU 2 +UE_MEMORY EQU 3 +UE_MEMORY_READ EQU 4 +UE_MEMORY_WRITE EQU 5 +UE_BREAKPOINT_TYPE_INT3 EQU 10000000h +UE_BREAKPOINT_TYPE_LONG_INT3 EQU 20000000h +UE_BREAKPOINT_TYPE_UD2 EQU 30000000h +UE_HARDWARE_EXECUTE EQU 4 +UE_HARDWARE_WRITE EQU 5 +UE_HARDWARE_READWRITE EQU 6 +UE_HARDWARE_SIZE_1 EQU 7 +UE_HARDWARE_SIZE_2 EQU 8 +UE_HARDWARE_SIZE_4 EQU 9 +UE_ON_LIB_LOAD EQU 1 +UE_ON_LIB_UNLOAD EQU 2 +UE_ON_LIB_ALL EQU 3 +UE_APISTART EQU 0 +UE_APIEND EQU 1 +UE_PLATFORM_x86 EQU 1 +UE_PLATFORM_x64 EQU 2 +UE_PLATFORM_ALL EQU 3 +UE_FUNCTION_STDCALL EQU 1 +UE_FUNCTION_CCALL EQU 2 +UE_FUNCTION_FASTCALL EQU 3 +UE_FUNCTION_STDCALL_RET EQU 4 +UE_FUNCTION_CCALL_RET EQU 5 +UE_FUNCTION_FASTCALL_RET EQU 6 +UE_FUNCTION_STDCALL_CALL EQU 7 +UE_FUNCTION_CCALL_CALL EQU 8 +UE_FUNCTION_FASTCALL_CALL EQU 9 +UE_PARAMETER_BYTE EQU 0 +UE_PARAMETER_WORD EQU 1 +UE_PARAMETER_DWORD EQU 2 +UE_PARAMETER_QWORD EQU 3 +UE_PARAMETER_PTR_BYTE EQU 4 +UE_PARAMETER_PTR_WORD EQU 5 +UE_PARAMETER_PTR_DWORD EQU 6 +UE_PARAMETER_PTR_QWORD EQU 7 +UE_PARAMETER_STRING EQU 8 +UE_PARAMETER_UNICODE EQU 9 +UE_CMP_NOCONDITION EQU 0 +UE_CMP_EQUAL EQU 1 +UE_CMP_NOTEQUAL EQU 2 +UE_CMP_GREATER EQU 3 +UE_CMP_GREATEROREQUAL EQU 4 +UE_CMP_LOWER EQU 5 +UE_CMP_LOWEROREQUAL EQU 6 +UE_CMP_REG_EQUAL EQU 7 +UE_CMP_REG_NOTEQUAL EQU 8 +UE_CMP_REG_GREATER EQU 9 +UE_CMP_REG_GREATEROREQUAL EQU 10 +UE_CMP_REG_LOWER EQU 11 +UE_CMP_REG_LOWEROREQUAL EQU 12 +UE_CMP_ALWAYSFALSE EQU 13 +UE_EAX EQU 1 +UE_EBX EQU 2 +UE_ECX EQU 3 +UE_EDX EQU 4 +UE_EDI EQU 5 +UE_ESI EQU 6 +UE_EBP EQU 7 +UE_ESP EQU 8 +UE_EIP EQU 9 +UE_EFLAGS EQU 10 +UE_DR0 EQU 11 +UE_DR1 EQU 12 +UE_DR2 EQU 13 +UE_DR3 EQU 14 +UE_DR6 EQU 15 +UE_DR7 EQU 16 +UE_RAX EQU 17 +UE_RBX EQU 18 +UE_RCX EQU 19 +UE_RDX EQU 20 +UE_RDI EQU 21 +UE_RSI EQU 22 +UE_RBP EQU 23 +UE_RSP EQU 24 +UE_RIP EQU 25 +UE_RFLAGS EQU 26 +UE_R8 EQU 27 +UE_R9 EQU 28 +UE_R10 EQU 29 +UE_R11 EQU 30 +UE_R12 EQU 31 +UE_R13 EQU 32 +UE_R14 EQU 33 +UE_R15 EQU 34 +UE_CIP EQU 35 +UE_CSP EQU 36 +UE_SEG_GS EQU 37 +UE_SEG_FS EQU 38 +UE_SEG_ES EQU 39 +UE_SEG_DS EQU 40 +UE_SEG_CS EQU 41 +UE_SEG_SS EQU 42 +ifndef @align +@align equ <> +endif +PE32Struct struct @align +PE32Offset DWORD ? +ImageBase DWORD ? +OriginalEntryPoint DWORD ? +NtSizeOfImage DWORD ? +NtSizeOfHeaders DWORD ? +SizeOfOptionalHeaders WORD ? +FileAlignment DWORD ? +SectionAligment DWORD ? +ImportTableAddress DWORD ? +ImportTableSize DWORD ? +ResourceTableAddress DWORD ? +ResourceTableSize DWORD ? +ExportTableAddress DWORD ? +ExportTableSize DWORD ? +TLSTableAddress DWORD ? +TLSTableSize DWORD ? +RelocationTableAddress DWORD ? +RelocationTableSize DWORD ? +TimeDateStamp DWORD ? +SectionNumber WORD ? +CheckSum DWORD ? +SubSystem WORD ? +Characteristics WORD ? +NumberOfRvaAndSizes DWORD ? +PE32Struct ends + +PPE32Struct typedef ptr PE32Struct + +ImportEnumData struct @align +NewDll bool ? +NumberOfImports DWORD ? +ImageBase DWORD ? +BaseImportThunk DWORD ? +ImportThunk DWORD ? +APIName DWORD ? +DLLName DWORD ? +ImportEnumData ends + +PImportEnumData typedef ptr ImportEnumData + +THREAD_ITEM_DATA struct @align +hThread HANDLE ? +dwThreadId DWORD ? +ThreadStartAddress DWORD ? +ThreadLocalBase DWORD ? +THREAD_ITEM_DATA ends + +PTHREAD_ITEM_DATA typedef ptr THREAD_ITEM_DATA + +LIBRARY_ITEM_DATA struct @align +hFile HANDLE ? +BaseOfDll DWORD ? +hFileMapping HANDLE ? +hFileMappingView DWORD ? +szLibraryPath SBYTE MAX_PATH dup (?) +szLibraryName SBYTE MAX_PATH dup (?) +LIBRARY_ITEM_DATA ends + +PLIBRARY_ITEM_DATA typedef ptr LIBRARY_ITEM_DATA + +LIBRARY_ITEM_DATAW struct @align +hFile HANDLE ? +BaseOfDll DWORD ? +hFileMapping HANDLE ? +hFileMappingView DWORD ? +szLibraryPath WORD MAX_PATH dup (?) +szLibraryName WORD MAX_PATH dup (?) +LIBRARY_ITEM_DATAW ends + +PLIBRARY_ITEM_DATAW typedef ptr LIBRARY_ITEM_DATAW + +PROCESS_ITEM_DATA struct @align +hProcess HANDLE ? +dwProcessId DWORD ? +hThread HANDLE ? +dwThreadId DWORD ? +hFile HANDLE ? +BaseOfImage DWORD ? +ThreadStartAddress DWORD ? +ThreadLocalBase DWORD ? +PROCESS_ITEM_DATA ends + +PPROCESS_ITEM_DATA typedef ptr PROCESS_ITEM_DATA + +HandlerArray struct @align +ProcessId DWORD ? +hHandle HANDLE ? +HandlerArray ends + +PHandlerArray typedef ptr HandlerArray + +PluginInformation struct @align +PluginName SBYTE 64 dup (?) +PluginMajorVersion DWORD ? +PluginMinorVersion DWORD ? +PluginBaseAddress HMODULE ? +TitanDebuggingCallBack DWORD ? +TitanRegisterPlugin DWORD ? +TitanReleasePlugin DWORD ? +TitanResetPlugin DWORD ? +PluginDisabled bool ? +PluginInformation ends + +PPluginInformation typedef ptr PluginInformation + +TEE_MAXIMUM_HOOK_SIZE EQU 14 +TEE_MAXIMUM_HOOK_RELOCS EQU 7 +TEE_MAXIMUM_HOOK_INSERT_SIZE EQU 5 + +HOOK_ENTRY struct @align +IATHook bool ? +HookType BYTE ? +HookSize DWORD ? +HookAddress DWORD ? +RedirectionAddress DWORD ? +HookBytes BYTE TEE_MAXIMUM_HOOK_SIZE dup (?) +OriginalBytes BYTE TEE_MAXIMUM_HOOK_SIZE dup (?) +IATHookModuleBase DWORD ? +IATHookNameHash DWORD ? +HookIsEnabled bool ? +HookIsRemote bool ? +PatchedEntry DWORD ? +RelocationInfo DWORD TEE_MAXIMUM_HOOK_RELOCS dup (?) +RelocationCount DWORD ? +HOOK_ENTRY ends + +PHOOK_ENTRY typedef ptr HOOK_ENTRY + +UE_DEPTH_SURFACE EQU 0 +UE_DEPTH_DEEP EQU 1 +UE_UNPACKER_CONDITION_SEARCH_FROM_EP EQU 1 +UE_UNPACKER_CONDITION_LOADLIBRARY EQU 1 +UE_UNPACKER_CONDITION_GETPROCADDRESS EQU 2 +UE_UNPACKER_CONDITION_ENTRYPOINTBREAK EQU 3 +UE_UNPACKER_CONDITION_RELOCSNAPSHOT1 EQU 4 +UE_UNPACKER_CONDITION_RELOCSNAPSHOT2 EQU 5 +UE_FIELD_OK EQU 0 +UE_FIELD_BROKEN_NON_FIXABLE EQU 1 +UE_FIELD_BROKEN_NON_CRITICAL EQU 2 +UE_FIELD_BROKEN_FIXABLE_FOR_STATIC_USE EQU 3 +UE_FIELD_BROKEN_BUT_CAN_BE_EMULATED EQU 4 +UE_FILED_FIXABLE_NON_CRITICAL EQU 5 +UE_FILED_FIXABLE_CRITICAL EQU 6 +UE_FIELD_NOT_PRESET EQU 7 +UE_FIELD_NOT_PRESET_WARNING EQU 8 +UE_RESULT_FILE_OK EQU 10 +UE_RESULT_FILE_INVALID_BUT_FIXABLE EQU 11 +UE_RESULT_FILE_INVALID_AND_NON_FIXABLE EQU 12 +UE_RESULT_FILE_INVALID_FORMAT EQU 13 +FILE_STATUS_INFO struct @align +OveralEvaluation BYTE ? +EvaluationTerminatedByException bool ? +FileIs64Bit bool ? +FileIsDLL bool ? +FileIsConsole bool ? +MissingDependencies bool ? +MissingDeclaredAPIs bool ? +SignatureMZ BYTE ? +SignaturePE BYTE ? +EntryPoint BYTE ? +ImageBase BYTE ? +SizeOfImage BYTE ? +FileAlignment BYTE ? +SectionAlignment BYTE ? +ExportTable BYTE ? +RelocationTable BYTE ? +ImportTable BYTE ? +ImportTableSection BYTE ? +ImportTableData BYTE ? +IATTable BYTE ? +TLSTable BYTE ? +LoadConfigTable BYTE ? +BoundImportTable BYTE ? +COMHeaderTable BYTE ? +ResourceTable BYTE ? +ResourceData BYTE ? +SectionTable BYTE ? +FILE_STATUS_INFO ends + +PFILE_STATUS_INFO typedef ptr FILE_STATUS_INFO + +FILE_FIX_INFO struct @align +OveralEvaluation BYTE ? +FixingTerminatedByException bool ? +FileFixPerformed bool ? +StrippedRelocation bool ? +DontFixRelocations bool ? +OriginalRelocationTableAddress DWORD ? +OriginalRelocationTableSize DWORD ? +StrippedExports bool ? +DontFixExports bool ? +OriginalExportTableAddress DWORD ? +OriginalExportTableSize DWORD ? +StrippedResources bool ? +DontFixResources bool ? +OriginalResourceTableAddress DWORD ? +OriginalResourceTableSize DWORD ? +StrippedTLS bool ? +DontFixTLS bool ? +OriginalTLSTableAddress DWORD ? +OriginalTLSTableSize DWORD ? +StrippedLoadConfig bool ? +DontFixLoadConfig bool ? +OriginalLoadConfigTableAddress DWORD ? +OriginalLoadConfigTableSize DWORD ? +StrippedBoundImports bool ? +DontFixBoundImports bool ? +OriginalBoundImportTableAddress DWORD ? +OriginalBoundImportTableSize DWORD ? +StrippedIAT bool ? +DontFixIAT bool ? +OriginalImportAddressTableAddress DWORD ? +OriginalImportAddressTableSize DWORD ? +StrippedCOM bool ? +DontFixCOM bool ? +OriginalCOMTableAddress DWORD ? +OriginalCOMTableSize DWORD ? +FILE_FIX_INFO ends + +PFILE_FIX_INFO typedef ptr FILE_FIX_INFO + +DumpProcess proto stdcall :HANDLE, :LPVOID, :ptr SBYTE, :DWORD +DumpProcessW proto stdcall :HANDLE, :LPVOID, :ptr WORD, :DWORD +DumpProcessEx proto stdcall :DWORD, :LPVOID, :ptr SBYTE, :DWORD +DumpProcessExW proto stdcall :DWORD, :LPVOID, :ptr WORD, :DWORD +DumpMemory proto stdcall :HANDLE, :LPVOID, :DWORD, :ptr SBYTE +DumpMemoryW proto stdcall :HANDLE, :LPVOID, :DWORD, :ptr WORD +DumpMemoryEx proto stdcall :DWORD, :LPVOID, :DWORD, :ptr SBYTE +DumpMemoryExW proto stdcall :DWORD, :LPVOID, :DWORD, :ptr WORD +DumpRegions proto stdcall :HANDLE, :ptr SBYTE, :bool +DumpRegionsW proto stdcall :HANDLE, :ptr WORD, :bool +DumpRegionsEx proto stdcall :DWORD, :ptr SBYTE, :bool +DumpRegionsExW proto stdcall :DWORD, :ptr WORD, :bool +DumpModule proto stdcall :HANDLE, :LPVOID, :ptr SBYTE +DumpModuleW proto stdcall :HANDLE, :LPVOID, :ptr WORD +DumpModuleEx proto stdcall :DWORD, :LPVOID, :ptr SBYTE +DumpModuleExW proto stdcall :DWORD, :LPVOID, :ptr WORD +PastePEHeader proto stdcall :HANDLE, :LPVOID, :ptr SBYTE +PastePEHeaderW proto stdcall :HANDLE, :LPVOID, :ptr WORD +ExtractSection proto stdcall :ptr SBYTE, :ptr SBYTE, :DWORD +ExtractSectionW proto stdcall :ptr WORD, :ptr WORD, :DWORD +ResortFileSections proto stdcall :ptr SBYTE +ResortFileSectionsW proto stdcall :ptr WORD +FindOverlay proto stdcall :ptr SBYTE, :LPDWORD, :LPDWORD +FindOverlayW proto stdcall :ptr WORD, :LPDWORD, :LPDWORD +ExtractOverlay proto stdcall :ptr SBYTE, :ptr SBYTE +ExtractOverlayW proto stdcall :ptr WORD, :ptr WORD +AddOverlay proto stdcall :ptr SBYTE, :ptr SBYTE +AddOverlayW proto stdcall :ptr WORD, :ptr WORD +CopyOverlay proto stdcall :ptr SBYTE, :ptr SBYTE +CopyOverlayW proto stdcall :ptr WORD, :ptr WORD +RemoveOverlay proto stdcall :ptr SBYTE +RemoveOverlayW proto stdcall :ptr WORD +MakeAllSectionsRWE proto stdcall :ptr SBYTE +MakeAllSectionsRWEW proto stdcall :ptr WORD +AddNewSectionEx proto stdcall :ptr SBYTE, :ptr SBYTE, :DWORD, :DWORD, :LPVOID, :DWORD +AddNewSectionExW proto stdcall :ptr WORD, :ptr SBYTE, :DWORD, :DWORD, :LPVOID, :DWORD +AddNewSection proto stdcall :ptr SBYTE, :ptr SBYTE, :DWORD +AddNewSectionW proto stdcall :ptr WORD, :ptr SBYTE, :DWORD +ResizeLastSection proto stdcall :ptr SBYTE, :DWORD, :bool +ResizeLastSectionW proto stdcall :ptr WORD, :DWORD, :bool +SetSharedOverlay proto stdcall :ptr SBYTE +SetSharedOverlayW proto stdcall :ptr WORD +GetSharedOverlay proto stdcall +GetSharedOverlayW proto stdcall +DeleteLastSection proto stdcall :ptr SBYTE +DeleteLastSectionW proto stdcall :ptr WORD +DeleteLastSectionEx proto stdcall :ptr SBYTE, :DWORD +DeleteLastSectionExW proto stdcall :ptr WORD, :DWORD +GetPE32DataFromMappedFile proto stdcall :DWORD, :DWORD, :DWORD +GetPE32Data proto stdcall :ptr SBYTE, :DWORD, :DWORD +GetPE32DataW proto stdcall :ptr WORD, :DWORD, :DWORD +GetPE32DataFromMappedFileEx proto stdcall :DWORD, :LPVOID +GetPE32DataEx proto stdcall :ptr SBYTE, :LPVOID +GetPE32DataExW proto stdcall :ptr WORD, :LPVOID +SetPE32DataForMappedFile proto stdcall :DWORD, :DWORD, :DWORD, :DWORD +SetPE32Data proto stdcall :ptr SBYTE, :DWORD, :DWORD, :DWORD +SetPE32DataW proto stdcall :ptr WORD, :DWORD, :DWORD, :DWORD +SetPE32DataForMappedFileEx proto stdcall :DWORD, :LPVOID +SetPE32DataEx proto stdcall :ptr SBYTE, :LPVOID +GetPE32SectionNumberFromVA proto stdcall :DWORD, :DWORD +ConvertVAtoFileOffset proto stdcall :DWORD, :DWORD, :bool +ConvertVAtoFileOffsetEx proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :bool, :bool +ConvertFileOffsetToVA proto stdcall :DWORD, :DWORD, :bool +ConvertFileOffsetToVAEx proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :bool +FixHeaderCheckSum proto stdcall :ptr SBYTE +FixHeaderCheckSumW proto stdcall :ptr WORD +RealignPE proto stdcall :DWORD, :DWORD, :DWORD +RealignPEEx proto stdcall :ptr SBYTE, :DWORD, :DWORD +RealignPEExW proto stdcall :ptr WORD, :DWORD, :DWORD +WipeSection proto stdcall :ptr SBYTE, :DWORD, :bool +WipeSectionW proto stdcall :ptr WORD, :DWORD, :bool +IsPE32FileValidEx proto stdcall :ptr SBYTE, :DWORD, :LPVOID +IsPE32FileValidExW proto stdcall :ptr WORD, :DWORD, :LPVOID +FixBrokenPE32FileEx proto stdcall :ptr SBYTE, :LPVOID, :LPVOID +FixBrokenPE32FileExW proto stdcall :ptr WORD, :LPVOID, :LPVOID +IsFileDLL proto stdcall :ptr SBYTE, :DWORD +IsFileDLLW proto stdcall :ptr WORD, :DWORD +GetPEBLocation proto stdcall :HANDLE +HideDebugger proto stdcall :HANDLE, :DWORD +UnHideDebugger proto stdcall :HANDLE, :DWORD +RelocaterCleanup proto stdcall +RelocaterInit proto stdcall :DWORD, :DWORD, :DWORD +RelocaterAddNewRelocation proto stdcall :HANDLE, :DWORD, :DWORD +RelocaterEstimatedSize proto stdcall +RelocaterExportRelocation proto stdcall :DWORD, :DWORD, :DWORD +RelocaterExportRelocationEx proto stdcall :ptr SBYTE, :ptr SBYTE +RelocaterExportRelocationExW proto stdcall :ptr WORD, :ptr SBYTE +RelocaterGrabRelocationTable proto stdcall :HANDLE, :DWORD, :DWORD +RelocaterGrabRelocationTableEx proto stdcall :HANDLE, :DWORD, :DWORD, :DWORD +RelocaterMakeSnapshot proto stdcall :HANDLE, :ptr SBYTE, :LPVOID, :DWORD +RelocaterMakeSnapshotW proto stdcall :HANDLE, :ptr WORD, :LPVOID, :DWORD +RelocaterCompareTwoSnapshots proto stdcall :HANDLE, :DWORD, :DWORD, :ptr SBYTE, :ptr SBYTE, :DWORD +RelocaterCompareTwoSnapshotsW proto stdcall :HANDLE, :DWORD, :DWORD, :ptr WORD, :ptr WORD, :DWORD +RelocaterChangeFileBase proto stdcall :ptr SBYTE, :DWORD +RelocaterChangeFileBaseW proto stdcall :ptr WORD, :DWORD +RelocaterRelocateMemoryBlock proto stdcall :DWORD, :DWORD, :ptr , :DWORD, :DWORD, :DWORD +RelocaterWipeRelocationTable proto stdcall :ptr SBYTE +RelocaterWipeRelocationTableW proto stdcall :ptr WORD +ResourcerLoadFileForResourceUse proto stdcall :ptr SBYTE +ResourcerLoadFileForResourceUseW proto stdcall :ptr WORD +ResourcerFreeLoadedFile proto stdcall :LPVOID +ResourcerExtractResourceFromFileEx proto stdcall :DWORD, :ptr SBYTE, :ptr SBYTE, :ptr SBYTE +ResourcerExtractResourceFromFile proto stdcall :ptr SBYTE, :ptr SBYTE, :ptr SBYTE, :ptr SBYTE +ResourcerExtractResourceFromFileW proto stdcall :ptr WORD, :ptr SBYTE, :ptr SBYTE, :ptr SBYTE +ResourcerFindResource proto stdcall :ptr SBYTE, :ptr SBYTE, :DWORD, :ptr SBYTE, :DWORD, :DWORD, :ptr DWORD, :LPDWORD +ResourcerFindResourceW proto stdcall :ptr WORD, :ptr WORD, :DWORD, :ptr WORD, :DWORD, :DWORD, :ptr DWORD, :LPDWORD +ResourcerFindResourceEx proto stdcall :DWORD, :DWORD, :ptr WORD, :DWORD, :ptr WORD, :DWORD, :DWORD, :ptr DWORD, :LPDWORD +ResourcerEnumerateResource proto stdcall :ptr SBYTE, :ptr +ResourcerEnumerateResourceW proto stdcall :ptr WORD, :ptr +ResourcerEnumerateResourceEx proto stdcall :DWORD, :DWORD, :ptr +ThreaderImportRunningThreadData proto stdcall :DWORD +ThreaderGetThreadInfo proto stdcall :HANDLE, :DWORD +ThreaderEnumThreadInfo proto stdcall :ptr +ThreaderPauseThread proto stdcall :HANDLE +ThreaderResumeThread proto stdcall :HANDLE +ThreaderTerminateThread proto stdcall :HANDLE, :DWORD +ThreaderPauseAllThreads proto stdcall :bool +ThreaderResumeAllThreads proto stdcall :bool +ThreaderPauseProcess proto stdcall +ThreaderResumeProcess proto stdcall +ThreaderCreateRemoteThread proto stdcall :DWORD, :bool, :LPVOID, :LPDWORD +ThreaderInjectAndExecuteCode proto stdcall :LPVOID, :DWORD, :DWORD +ThreaderCreateRemoteThreadEx proto stdcall :HANDLE, :DWORD, :bool, :LPVOID, :LPDWORD +ThreaderInjectAndExecuteCodeEx proto stdcall :HANDLE, :LPVOID, :DWORD, :DWORD +ThreaderSetCallBackForNextExitThreadEvent proto stdcall :LPVOID +ThreaderIsThreadStillRunning proto stdcall :HANDLE +ThreaderIsThreadActive proto stdcall :HANDLE +ThreaderIsAnyThreadActive proto stdcall +ThreaderExecuteOnlyInjectedThreads proto stdcall +ThreaderGetOpenHandleForThread proto stdcall :DWORD +ThreaderGetThreadData proto stdcall +ThreaderIsExceptionInMainThread proto stdcall +StaticDisassembleEx proto stdcall :DWORD, :LPVOID +StaticDisassemble proto stdcall :LPVOID +DisassembleEx proto stdcall :HANDLE, :LPVOID +Disassemble proto stdcall :LPVOID +StaticLengthDisassemble proto stdcall :LPVOID +LengthDisassembleEx proto stdcall :HANDLE, :LPVOID +LengthDisassemble proto stdcall :LPVOID +InitDebug proto stdcall :ptr SBYTE, :ptr SBYTE, :ptr SBYTE +InitDebugW proto stdcall :ptr WORD, :ptr WORD, :ptr WORD +InitDebugEx proto stdcall :ptr SBYTE, :ptr SBYTE, :ptr SBYTE, :LPVOID +InitDebugExW proto stdcall :ptr WORD, :ptr WORD, :ptr WORD, :LPVOID +InitDLLDebug proto stdcall :ptr SBYTE, :bool, :ptr SBYTE, :ptr SBYTE, :LPVOID +InitDLLDebugW proto stdcall :ptr WORD, :bool, :ptr WORD, :ptr WORD, :LPVOID +StopDebug proto stdcall +SetBPXOptions proto stdcall :SDWORD +IsBPXEnabled proto stdcall :DWORD +EnableBPX proto stdcall :DWORD +DisableBPX proto stdcall :DWORD +SetBPX proto stdcall :DWORD, :DWORD, :LPVOID +SetBPXEx proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :LPVOID, :LPVOID, :LPVOID +DeleteBPX proto stdcall :DWORD +SafeDeleteBPX proto stdcall :DWORD +SetAPIBreakPoint proto stdcall :ptr SBYTE, :ptr SBYTE, :DWORD, :DWORD, :LPVOID +DeleteAPIBreakPoint proto stdcall :ptr SBYTE, :ptr SBYTE, :DWORD +SafeDeleteAPIBreakPoint proto stdcall :ptr SBYTE, :ptr SBYTE, :DWORD +SetMemoryBPX proto stdcall :DWORD, :DWORD, :LPVOID +SetMemoryBPXEx proto stdcall :DWORD, :DWORD, :DWORD, :bool, :LPVOID +RemoveMemoryBPX proto stdcall :DWORD, :DWORD +GetContextFPUDataEx proto stdcall :HANDLE, :ptr +GetContextDataEx proto stdcall :HANDLE, :DWORD +GetContextData proto stdcall :DWORD +SetContextFPUDataEx proto stdcall :HANDLE, :ptr +SetContextDataEx proto stdcall :HANDLE, :DWORD, :DWORD +SetContextData proto stdcall :DWORD, :DWORD +ClearExceptionNumber proto stdcall +CurrentExceptionNumber proto stdcall +MatchPatternEx proto stdcall :HANDLE, :ptr , :DWORD, :ptr , :DWORD, :PBYTE +MatchPattern proto stdcall :ptr , :DWORD, :ptr , :DWORD, :PBYTE +FindEx proto stdcall :HANDLE, :LPVOID, :DWORD, :LPVOID, :DWORD, :LPBYTE +Find proto stdcall :LPVOID, :DWORD, :LPVOID, :DWORD, :LPBYTE +FillEx proto stdcall :HANDLE, :LPVOID, :DWORD, :PBYTE +Fill proto stdcall :LPVOID, :DWORD, :PBYTE +PatchEx proto stdcall :HANDLE, :LPVOID, :DWORD, :LPVOID, :DWORD, :bool, :bool +Patch proto stdcall :LPVOID, :DWORD, :LPVOID, :DWORD, :bool, :bool +ReplaceEx proto stdcall :HANDLE, :LPVOID, :DWORD, :LPVOID, :DWORD, :DWORD, :LPVOID, :DWORD, :PBYTE +Replace proto stdcall :LPVOID, :DWORD, :LPVOID, :DWORD, :DWORD, :LPVOID, :DWORD, :PBYTE +GetDebugData proto stdcall +GetTerminationData proto stdcall +GetExitCode proto stdcall +GetDebuggedDLLBaseAddress proto stdcall +GetDebuggedFileBaseAddress proto stdcall +GetRemoteString proto stdcall :HANDLE, :LPVOID, :LPVOID, :DWORD +GetFunctionParameter proto stdcall :HANDLE, :DWORD, :DWORD, :DWORD +GetJumpDestinationEx proto stdcall :HANDLE, :DWORD, :bool +GetJumpDestination proto stdcall :HANDLE, :DWORD +IsJumpGoingToExecuteEx proto stdcall :HANDLE, :HANDLE, :DWORD, :DWORD +IsJumpGoingToExecute proto stdcall +SetCustomHandler proto stdcall :DWORD, :LPVOID +ForceClose proto stdcall +StepInto proto stdcall :LPVOID +StepOver proto stdcall :LPVOID +SingleStep proto stdcall :DWORD, :LPVOID +GetUnusedHardwareBreakPointRegister proto stdcall :LPDWORD +SetHardwareBreakPointEx proto stdcall :HANDLE, :DWORD, :DWORD, :DWORD, :DWORD, :LPVOID, :LPDWORD +SetHardwareBreakPoint proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :LPVOID +DeleteHardwareBreakPoint proto stdcall :DWORD +RemoveAllBreakPoints proto stdcall :DWORD +GetProcessInformation proto stdcall +GetStartupInformation proto stdcall +DebugLoop proto stdcall +SetDebugLoopTimeOut proto stdcall :DWORD +SetNextDbgContinueStatus proto stdcall :DWORD +AttachDebugger proto stdcall :DWORD, :bool, :LPVOID, :LPVOID +DetachDebugger proto stdcall :DWORD +DetachDebuggerEx proto stdcall :DWORD +DebugLoopEx proto stdcall :DWORD +AutoDebugEx proto stdcall :ptr SBYTE, :bool, :ptr SBYTE, :ptr SBYTE, :DWORD, :LPVOID +AutoDebugExW proto stdcall :ptr WORD, :bool, :ptr WORD, :ptr WORD, :DWORD, :LPVOID +IsFileBeingDebugged proto stdcall +SetErrorModel proto stdcall :bool +FindOEPInit proto stdcall +FindOEPGenerically proto stdcall :ptr SBYTE, :LPVOID, :LPVOID +FindOEPGenericallyW proto stdcall :ptr WORD, :LPVOID, :LPVOID +ImporterCleanup proto stdcall +ImporterSetImageBase proto stdcall :DWORD +ImporterSetUnknownDelta proto stdcall :DWORD +ImporterGetCurrentDelta proto stdcall +ImporterInit proto stdcall :DWORD, :DWORD +ImporterAddNewDll proto stdcall :ptr SBYTE, :DWORD +ImporterAddNewAPI proto stdcall :ptr SBYTE, :DWORD +ImporterAddNewOrdinalAPI proto stdcall :DWORD, :DWORD +ImporterGetAddedDllCount proto stdcall +ImporterGetAddedAPICount proto stdcall +ImporterGetLastAddedDLLName proto stdcall +ImporterMoveIAT proto stdcall +ImporterExportIAT proto stdcall :DWORD, :DWORD +ImporterEstimatedSize proto stdcall +ImporterExportIATEx proto stdcall :ptr SBYTE, :ptr SBYTE +ImporterExportIATExW proto stdcall :ptr WORD, :ptr SBYTE +ImporterFindAPIWriteLocation proto stdcall :ptr SBYTE +ImporterFindOrdinalAPIWriteLocation proto stdcall :DWORD +ImporterFindAPIByWriteLocation proto stdcall :DWORD +ImporterFindDLLByWriteLocation proto stdcall :DWORD +ImporterGetDLLName proto stdcall :DWORD +ImporterGetAPIName proto stdcall :DWORD +ImporterGetAPIOrdinalNumber proto stdcall :DWORD +ImporterGetAPINameEx proto stdcall :DWORD, :DWORD +ImporterGetRemoteAPIAddress proto stdcall :HANDLE, :DWORD +ImporterGetRemoteAPIAddressEx proto stdcall :ptr SBYTE, :ptr SBYTE +ImporterGetLocalAPIAddress proto stdcall :HANDLE, :DWORD +ImporterGetDLLNameFromDebugee proto stdcall :HANDLE, :DWORD +ImporterGetAPINameFromDebugee proto stdcall :HANDLE, :DWORD +ImporterGetAPIOrdinalNumberFromDebugee proto stdcall :HANDLE, :DWORD +ImporterGetDLLIndexEx proto stdcall :DWORD, :DWORD +ImporterGetDLLIndex proto stdcall :HANDLE, :DWORD, :DWORD +ImporterGetRemoteDLLBase proto stdcall :HANDLE, :HMODULE +ImporterRelocateWriteLocation proto stdcall :DWORD +ImporterIsForwardedAPI proto stdcall :HANDLE, :DWORD +ImporterGetForwardedAPIName proto stdcall :HANDLE, :DWORD +ImporterGetForwardedDLLName proto stdcall :HANDLE, :DWORD +ImporterGetForwardedDLLIndex proto stdcall :HANDLE, :DWORD, :DWORD +ImporterGetForwardedAPIOrdinalNumber proto stdcall :HANDLE, :DWORD +ImporterGetNearestAPIAddress proto stdcall :HANDLE, :DWORD +ImporterGetNearestAPIName proto stdcall :HANDLE, :DWORD +ImporterCopyOriginalIAT proto stdcall :ptr SBYTE, :ptr SBYTE +ImporterCopyOriginalIATW proto stdcall :ptr WORD, :ptr WORD +ImporterLoadImportTable proto stdcall :ptr SBYTE +ImporterLoadImportTableW proto stdcall :ptr WORD +ImporterMoveOriginalIAT proto stdcall :ptr SBYTE, :ptr SBYTE, :ptr SBYTE +ImporterMoveOriginalIATW proto stdcall :ptr WORD, :ptr WORD, :ptr SBYTE +ImporterAutoSearchIAT proto stdcall :HANDLE, :ptr SBYTE, :DWORD, :DWORD, :DWORD, :LPVOID, :LPVOID +ImporterAutoSearchIATW proto stdcall :HANDLE, :ptr WORD, :DWORD, :DWORD, :DWORD, :LPVOID, :LPVOID +ImporterAutoSearchIATEx proto stdcall :HANDLE, :DWORD, :DWORD, :DWORD, :LPVOID, :LPVOID +ImporterEnumAddedData proto stdcall :LPVOID +ImporterAutoFixIATEx proto stdcall :HANDLE, :ptr SBYTE, :ptr SBYTE, :bool, :bool, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :bool, :bool, :LPVOID +ImporterAutoFixIATExW proto stdcall :HANDLE, :ptr WORD, :ptr SBYTE, :bool, :bool, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :bool, :bool, :LPVOID +ImporterAutoFixIAT proto stdcall :HANDLE, :ptr SBYTE, :DWORD, :DWORD, :DWORD, :DWORD +ImporterAutoFixIATW proto stdcall :HANDLE, :ptr WORD, :DWORD, :DWORD, :DWORD, :DWORD +HooksSafeTransitionEx proto stdcall :LPVOID, :DWORD, :bool +HooksSafeTransition proto stdcall :LPVOID, :bool +HooksIsAddressRedirected proto stdcall :LPVOID +HooksGetTrampolineAddress proto stdcall :LPVOID +HooksGetHookEntryDetails proto stdcall :LPVOID +HooksInsertNewRedirection proto stdcall :LPVOID, :LPVOID, :DWORD +HooksInsertNewIATRedirectionEx proto stdcall :DWORD, :DWORD, :ptr SBYTE, :LPVOID +HooksInsertNewIATRedirection proto stdcall :ptr SBYTE, :ptr SBYTE, :LPVOID +HooksRemoveRedirection proto stdcall :LPVOID, :bool +HooksRemoveRedirectionsForModule proto stdcall :HMODULE +HooksRemoveIATRedirection proto stdcall :ptr SBYTE, :ptr SBYTE, :bool +HooksDisableRedirection proto stdcall :LPVOID, :bool +HooksDisableRedirectionsForModule proto stdcall :HMODULE +HooksDisableIATRedirection proto stdcall :ptr SBYTE, :ptr SBYTE, :bool +HooksEnableRedirection proto stdcall :LPVOID, :bool +HooksEnableRedirectionsForModule proto stdcall :HMODULE +HooksEnableIATRedirection proto stdcall :ptr SBYTE, :ptr SBYTE, :bool +HooksScanModuleMemory proto stdcall :HMODULE, :LPVOID +HooksScanEntireProcessMemory proto stdcall :LPVOID +HooksScanEntireProcessMemoryEx proto stdcall +TracerInit proto stdcall +TracerLevel1 proto stdcall :HANDLE, :DWORD +HashTracerLevel1 proto stdcall :HANDLE, :DWORD, :DWORD +TracerDetectRedirection proto stdcall :HANDLE, :DWORD +TracerFixKnownRedirection proto stdcall :HANDLE, :DWORD, :DWORD +TracerFixRedirectionViaImpRecPlugin proto stdcall :HANDLE, :ptr SBYTE, :DWORD +ExporterCleanup proto stdcall +ExporterSetImageBase proto stdcall :DWORD +ExporterInit proto stdcall :DWORD, :DWORD, :DWORD, :ptr SBYTE +ExporterAddNewExport proto stdcall :ptr SBYTE, :DWORD +ExporterAddNewOrdinalExport proto stdcall :DWORD, :DWORD +ExporterGetAddedExportCount proto stdcall +ExporterEstimatedSize proto stdcall +ExporterBuildExportTable proto stdcall :DWORD, :DWORD +ExporterBuildExportTableEx proto stdcall :ptr SBYTE, :ptr SBYTE +ExporterBuildExportTableExW proto stdcall :ptr WORD, :ptr SBYTE +ExporterLoadExportTable proto stdcall :ptr SBYTE +ExporterLoadExportTableW proto stdcall :ptr WORD +LibrarianSetBreakPoint proto stdcall :ptr SBYTE, :DWORD, :bool, :LPVOID +LibrarianRemoveBreakPoint proto stdcall :ptr SBYTE, :DWORD +LibrarianGetLibraryInfo proto stdcall :ptr SBYTE +LibrarianGetLibraryInfoW proto stdcall :ptr WORD +LibrarianGetLibraryInfoEx proto stdcall :ptr +LibrarianGetLibraryInfoExW proto stdcall :ptr +LibrarianEnumLibraryInfo proto stdcall :ptr +LibrarianEnumLibraryInfoW proto stdcall :ptr +GetActiveProcessId proto stdcall :ptr SBYTE +GetActiveProcessIdW proto stdcall :ptr WORD +EnumProcessesWithLibrary proto stdcall :ptr SBYTE, :ptr +TLSBreakOnCallBack proto stdcall :LPVOID, :DWORD, :LPVOID +TLSGrabCallBackData proto stdcall :ptr SBYTE, :LPVOID, :LPDWORD +TLSGrabCallBackDataW proto stdcall :ptr WORD, :LPVOID, :LPDWORD +TLSBreakOnCallBackEx proto stdcall :ptr SBYTE, :LPVOID +TLSBreakOnCallBackExW proto stdcall :ptr WORD, :LPVOID +TLSRemoveCallback proto stdcall :ptr SBYTE +TLSRemoveCallbackW proto stdcall :ptr WORD +TLSRemoveTable proto stdcall :ptr SBYTE +TLSRemoveTableW proto stdcall :ptr WORD +TLSBackupData proto stdcall :ptr SBYTE +TLSBackupDataW proto stdcall :ptr WORD +TLSRestoreData proto stdcall +TLSBuildNewTable proto stdcall :DWORD, :DWORD, :DWORD, :LPVOID, :DWORD +TLSBuildNewTableEx proto stdcall :ptr SBYTE, :ptr SBYTE, :LPVOID, :DWORD +TLSBuildNewTableExW proto stdcall :ptr WORD, :ptr SBYTE, :LPVOID, :DWORD +TranslateNativeName proto stdcall :ptr SBYTE +TranslateNativeNameW proto stdcall :ptr WORD +HandlerGetActiveHandleCount proto stdcall :DWORD +HandlerIsHandleOpen proto stdcall :DWORD, :HANDLE +HandlerGetHandleName proto stdcall :HANDLE, :DWORD, :HANDLE, :bool +HandlerGetHandleNameW proto stdcall :HANDLE, :DWORD, :HANDLE, :bool +HandlerEnumerateOpenHandles proto stdcall :DWORD, :LPVOID, :DWORD +HandlerGetHandleDetails proto stdcall :HANDLE, :DWORD, :HANDLE, :DWORD +HandlerCloseRemoteHandle proto stdcall :HANDLE, :HANDLE +HandlerEnumerateLockHandles proto stdcall :ptr SBYTE, :bool, :bool, :LPVOID, :DWORD +HandlerEnumerateLockHandlesW proto stdcall :ptr WORD, :bool, :bool, :LPVOID, :DWORD +HandlerCloseAllLockHandles proto stdcall :ptr SBYTE, :bool, :bool +HandlerCloseAllLockHandlesW proto stdcall :ptr WORD, :bool, :bool +HandlerIsFileLocked proto stdcall :ptr SBYTE, :bool, :bool +HandlerIsFileLockedW proto stdcall :ptr WORD, :bool, :bool +HandlerEnumerateOpenMutexes proto stdcall :HANDLE, :DWORD, :LPVOID, :DWORD +HandlerGetOpenMutexHandle proto stdcall :HANDLE, :DWORD, :ptr SBYTE +HandlerGetOpenMutexHandleW proto stdcall :HANDLE, :DWORD, :ptr WORD +HandlerGetProcessIdWhichCreatedMutex proto stdcall :ptr SBYTE +HandlerGetProcessIdWhichCreatedMutexW proto stdcall :ptr WORD +RemoteLoadLibrary proto stdcall :HANDLE, :ptr SBYTE, :bool +RemoteLoadLibraryW proto stdcall :HANDLE, :ptr WORD, :bool +RemoteFreeLibrary proto stdcall :HANDLE, :HMODULE, :ptr SBYTE, :bool +RemoteFreeLibraryW proto stdcall :HANDLE, :HMODULE, :ptr WORD, :bool +RemoteExitProcess proto stdcall :HANDLE, :DWORD +StaticFileLoad proto stdcall :ptr SBYTE, :DWORD, :bool, :LPHANDLE, :LPDWORD, :LPHANDLE, :ptr DWORD +StaticFileLoadW proto stdcall :ptr WORD, :DWORD, :bool, :LPHANDLE, :LPDWORD, :LPHANDLE, :ptr DWORD +StaticFileUnload proto stdcall :ptr SBYTE, :bool, :HANDLE, :DWORD, :HANDLE, :DWORD +StaticFileUnloadW proto stdcall :ptr WORD, :bool, :HANDLE, :DWORD, :HANDLE, :DWORD +StaticFileOpen proto stdcall :ptr SBYTE, :DWORD, :LPHANDLE, :LPDWORD, :LPDWORD +StaticFileOpenW proto stdcall :ptr WORD, :DWORD, :LPHANDLE, :LPDWORD, :LPDWORD +StaticFileGetContent proto stdcall :HANDLE, :DWORD, :LPDWORD, :ptr , :DWORD +StaticFileClose proto stdcall :HANDLE +StaticMemoryDecrypt proto stdcall :LPVOID, :DWORD, :DWORD, :DWORD, :DWORD +StaticMemoryDecryptEx proto stdcall :LPVOID, :DWORD, :DWORD, :ptr +StaticMemoryDecryptSpecial proto stdcall :LPVOID, :DWORD, :DWORD, :DWORD, :ptr +StaticSectionDecrypt proto stdcall :DWORD, :DWORD, :bool, :DWORD, :DWORD, :DWORD +StaticMemoryDecompress proto stdcall :ptr , :DWORD, :ptr , :DWORD, :DWORD +StaticRawMemoryCopy proto stdcall :HANDLE, :DWORD, :DWORD, :DWORD, :bool, :ptr SBYTE +StaticRawMemoryCopyW proto stdcall :HANDLE, :DWORD, :DWORD, :DWORD, :bool, :ptr WORD +StaticRawMemoryCopyEx proto stdcall :HANDLE, :DWORD, :DWORD, :ptr SBYTE +StaticRawMemoryCopyExW proto stdcall :HANDLE, :DWORD, :DWORD, :ptr WORD +StaticHashMemory proto stdcall :ptr , :DWORD, :ptr , :bool, :DWORD +StaticHashFileW proto stdcall :ptr WORD, :ptr SBYTE, :bool, :DWORD +StaticHashFile proto stdcall :ptr SBYTE, :ptr SBYTE, :bool, :DWORD +EngineUnpackerInitialize proto stdcall :ptr SBYTE, :ptr SBYTE, :bool, :bool, :bool, :ptr +EngineUnpackerInitializeW proto stdcall :ptr WORD, :ptr WORD, :bool, :bool, :bool, :ptr +EngineUnpackerSetBreakCondition proto stdcall :ptr , :DWORD, :ptr , :DWORD, :DWORD, :DWORD, :bool, :DWORD, :DWORD +EngineUnpackerSetEntryPointAddress proto stdcall :DWORD +EngineUnpackerFinalizeUnpacking proto stdcall +SetEngineVariable proto stdcall :DWORD, :bool +EngineCreateMissingDependencies proto stdcall :ptr SBYTE, :ptr SBYTE, :bool +EngineCreateMissingDependenciesW proto stdcall :ptr WORD, :ptr WORD, :bool +EngineFakeMissingDependencies proto stdcall :HANDLE +EngineDeleteCreatedDependencies proto stdcall +EngineCreateUnpackerWindow proto stdcall :ptr SBYTE, :ptr SBYTE, :ptr SBYTE, :ptr SBYTE, :ptr +EngineAddUnpackerWindowLogMessage proto stdcall :ptr SBYTE +ExtensionManagerIsPluginLoaded proto stdcall :ptr SBYTE +ExtensionManagerIsPluginEnabled proto stdcall :ptr SBYTE +ExtensionManagerDisableAllPlugins proto stdcall +ExtensionManagerDisablePlugin proto stdcall :ptr SBYTE +ExtensionManagerEnableAllPlugins proto stdcall +ExtensionManagerEnablePlugin proto stdcall :ptr SBYTE +ExtensionManagerUnloadAllPlugins proto stdcall +ExtensionManagerUnloadPlugin proto stdcall :ptr SBYTE +ExtensionManagerGetPluginInfo proto stdcall :ptr SBYTE + +;--- errors: 0 +;--- end of file --- \ No newline at end of file diff --git a/SDK/Python/TitanEngine.py b/SDK/Python/TitanEngine.py new file mode 100644 index 0000000..6d2a242 --- /dev/null +++ b/SDK/Python/TitanEngine.py @@ -0,0 +1,678 @@ + +from ctypes import * + +TE = windll.LoadLibrary("TitanEngine.dll") + +# check widechar, x64 + +UE_ACCESS_READ = 0 +UE_ACCESS_WRITE = 1 +UE_ACCESS_ALL = 2 + +UE_HIDE_BASIC = 1 + +UE_PLUGIN_CALL_REASON_PREDEBUG = 1 +UE_PLUGIN_CALL_REASON_EXCEPTION = 2 +UE_PLUGIN_CALL_REASON_POSTDEBUG = 3 + +TEE_HOOK_NRM_JUMP = 1 +TEE_HOOK_NRM_CALL = 3 +TEE_HOOK_IAT = 5 + +UE_ENGINE_ALOW_MODULE_LOADING = 1 +UE_ENGINE_AUTOFIX_FORWARDERS = 2 +UE_ENGINE_PASS_ALL_EXCEPTIONS = 3 +UE_ENGINE_NO_CONSOLE_WINDOW = 4 +UE_ENGINE_BACKUP_FOR_CRITICAL_FUNCTIONS = 5 +UE_ENGINE_CALL_PLUGIN_CALLBACK = 6 +UE_ENGINE_RESET_CUSTOM_HANDLER = 7 +UE_ENGINE_CALL_PLUGIN_DEBUG_CALLBACK = 8 + +UE_OPTION_REMOVEALL = 1 +UE_OPTION_DISABLEALL = 2 +UE_OPTION_REMOVEALLDISABLED = 3 +UE_OPTION_REMOVEALLENABLED = 4 + +UE_STATIC_DECRYPTOR_XOR = 1 +UE_STATIC_DECRYPTOR_SUB = 2 +UE_STATIC_DECRYPTOR_ADD = 3 + +UE_STATIC_DECRYPTOR_FOREWARD = 1 +UE_STATIC_DECRYPTOR_BACKWARD = 2 + +UE_STATIC_KEY_SIZE_1 = 1 +UE_STATIC_KEY_SIZE_2 = 2 +UE_STATIC_KEY_SIZE_4 = 4 +UE_STATIC_KEY_SIZE_8 = 8 + +UE_STATIC_APLIB = 1 +UE_STATIC_APLIB_DEPACK = 2 +UE_STATIC_LZMA = 3 + +UE_STATIC_HASH_MD5 = 1 +UE_STATIC_HASH_SHA1 = 2 +UE_STATIC_HASH_CRC32 = 3 + +UE_RESOURCE_LANGUAGE_ANY = -1 + +UE_PE_OFFSET = 0 +UE_IMAGEBASE = 1 +UE_OEP = 2 +UE_SIZEOFIMAGE = 3 +UE_SIZEOFHEADERS = 4 +UE_SIZEOFOPTIONALHEADER = 5 +UE_SECTIONALIGNMENT = 6 +UE_IMPORTTABLEADDRESS = 7 +UE_IMPORTTABLESIZE = 8 +UE_RESOURCETABLEADDRESS = 9 +UE_RESOURCETABLESIZE = 10 +UE_EXPORTTABLEADDRESS = 11 +UE_EXPORTTABLESIZE = 12 +UE_TLSTABLEADDRESS = 13 +UE_TLSTABLESIZE = 14 +UE_RELOCATIONTABLEADDRESS = 15 +UE_RELOCATIONTABLESIZE = 16 +UE_TIMEDATESTAMP = 17 +UE_SECTIONNUMBER = 18 +UE_CHECKSUM = 19 +UE_SUBSYSTEM = 20 +UE_CHARACTERISTICS = 21 +UE_NUMBEROFRVAANDSIZES = 22 +UE_SECTIONNAME = 23 +UE_SECTIONVIRTUALOFFSET = 24 +UE_SECTIONVIRTUALSIZE = 25 +UE_SECTIONRAWOFFSET = 26 +UE_SECTIONRAWSIZE = 27 +UE_SECTIONFLAGS = 28 + +UE_CH_BREAKPOINT = 1 +UE_CH_SINGLESTEP = 2 +UE_CH_ACCESSVIOLATION = 3 +UE_CH_ILLEGALINSTRUCTION = 4 +UE_CH_NONCONTINUABLEEXCEPTION = 5 +UE_CH_ARRAYBOUNDSEXCEPTION = 6 +UE_CH_FLOATDENORMALOPERAND = 7 +UE_CH_FLOATDEVIDEBYZERO = 8 +UE_CH_INTEGERDEVIDEBYZERO = 9 +UE_CH_INTEGEROVERFLOW = 10 +UE_CH_PRIVILEGEDINSTRUCTION = 11 +UE_CH_PAGEGUARD = 12 +UE_CH_EVERYTHINGELSE = 13 +UE_CH_CREATETHREAD = 14 +UE_CH_EXITTHREAD = 15 +UE_CH_CREATEPROCESS = 16 +UE_CH_EXITPROCESS = 17 +UE_CH_LOADDLL = 18 +UE_CH_UNLOADDLL = 19 +UE_CH_OUTPUTDEBUGSTRING = 20 + +UE_OPTION_HANDLER_RETURN_HANDLECOUNT = 1 +UE_OPTION_HANDLER_RETURN_ACCESS = 2 +UE_OPTION_HANDLER_RETURN_FLAGS = 3 +UE_OPTION_HANDLER_RETURN_TYPENAME = 4 + +UE_BREAKPOINT_INT3 = 1 +UE_BREAKPOINT_LONG_INT3 = 2 +UE_BREAKPOINT_UD2 = 3 + +UE_BPXREMOVED = 0 +UE_BPXACTIVE = 1 +UE_BPXINACTIVE = 2 + +UE_BREAKPOINT = 0 +UE_SINGLESHOOT = 1 +UE_HARDWARE = 2 +UE_MEMORY = 3 +UE_MEMORY_READ = 4 +UE_MEMORY_WRITE = 5 +UE_BREAKPOINT_TYPE_INT3 = 0x10000000 +UE_BREAKPOINT_TYPE_LONG_INT3 = 0x20000000 +UE_BREAKPOINT_TYPE_UD2 = 0x30000000 + +UE_HARDWARE_EXECUTE = 4 +UE_HARDWARE_WRITE = 5 +UE_HARDWARE_READWRITE = 6 + +UE_HARDWARE_SIZE_1 = 7 +UE_HARDWARE_SIZE_2 = 8 +UE_HARDWARE_SIZE_4 = 9 + +UE_ON_LIB_LOAD = 1 +UE_ON_LIB_UNLOAD = 2 +UE_ON_LIB_ALL = 3 + +UE_APISTART = 0 +UE_APIEND = 1 + +UE_PLATFORM_x86 = 1 +UE_PLATFORM_x64 = 2 +UE_PLATFORM_ALL = 3 + +UE_FUNCTION_STDCALL = 1 +UE_FUNCTION_CCALL = 2 +UE_FUNCTION_FASTCALL = 3 +UE_FUNCTION_STDCALL_RET = 4 +UE_FUNCTION_CCALL_RET = 5 +UE_FUNCTION_FASTCALL_RET = 6 +UE_FUNCTION_STDCALL_CALL = 7 +UE_FUNCTION_CCALL_CALL = 8 +UE_FUNCTION_FASTCALL_CALL = 9 +UE_PARAMETER_BYTE = 0 +UE_PARAMETER_WORD = 1 +UE_PARAMETER_DWORD = 2 +UE_PARAMETER_QWORD = 3 +UE_PARAMETER_PTR_BYTE = 4 +UE_PARAMETER_PTR_WORD = 5 +UE_PARAMETER_PTR_DWORD = 6 +UE_PARAMETER_PTR_QWORD = 7 +UE_PARAMETER_STRING = 8 +UE_PARAMETER_UNICODE = 9 + +UE_CMP_NOCONDITION = 0 +UE_CMP_EQUAL = 1 +UE_CMP_NOTEQUAL = 2 +UE_CMP_GREATER = 3 +UE_CMP_GREATEROREQUAL = 4 +UE_CMP_LOWER = 5 +UE_CMP_LOWEROREQUAL = 6 +UE_CMP_REG_EQUAL = 7 +UE_CMP_REG_NOTEQUAL = 8 +UE_CMP_REG_GREATER = 9 +UE_CMP_REG_GREATEROREQUAL = 10 +UE_CMP_REG_LOWER = 11 +UE_CMP_REG_LOWEROREQUAL = 12 +UE_CMP_ALWAYSFALSE = 13 + +UE_EAX = 1 +UE_EBX = 2 +UE_ECX = 3 +UE_EDX = 4 +UE_EDI = 5 +UE_ESI = 6 +UE_EBP = 7 +UE_ESP = 8 +UE_EIP = 9 +UE_EFLAGS = 10 +UE_DR0 = 11 +UE_DR1 = 12 +UE_DR2 = 13 +UE_DR3 = 14 +UE_DR6 = 15 +UE_DR7 = 16 +UE_RAX = 17 +UE_RBX = 18 +UE_RCX = 19 +UE_RDX = 20 +UE_RDI = 21 +UE_RSI = 22 +UE_RBP = 23 +UE_RSP = 24 +UE_RIP = 25 +UE_RFLAGS = 26 +UE_R8 = 27 +UE_R9 = 28 +UE_R10 = 29 +UE_R11 = 30 +UE_R12 = 31 +UE_R13 = 32 +UE_R14 = 33 +UE_R15 = 34 +UE_CIP = 35 +UE_CSP = 36 + +class PE32Struct(Structure): + _pack_ = 1 + _fields_ = [ ("PE32Offset", c_ulong), + ("ImageBase", c_ulong), + ("OriginalEntryPoint", c_ulong), + ("NtSizeOfImage", c_ulong), + ("NtSizeOfHeaders", c_ulong), + ("SizeOfOptionalHeaders", c_ushort), + ("FileAlignment", c_ulong), + ("SectionAligment", c_ulong), + ("ImportTableAddress", c_ulong), + ("ImportTableSize", c_ulong), + ("ResourceTableAddress", c_ulong), + ("ResourceTableSize", c_ulong), + ("ExportTableAddress", c_ulong), + ("ExportTableSize", c_ulong), + ("TLSTableAddress", c_ulong), + ("TLSTableSize", c_ulong), + ("RelocationTableAddress", c_ulong), + ("RelocationTableSize", c_ulong), + ("TimeDateStamp", c_ulong), + ("SectionNumber", c_ushort), + ("CheckSum", c_ulong), + ("SubSystem", c_ushort), + ("Characteristics", c_ushort), + ("NumberOfRvaAndSizes", c_ulong) ] + +class PE64Struct(Structure): + _pack_ = 1 + _fields_ = [ ("PE64Offset", c_ulong), + ("ImageBase", c_ulonglong), + ("OriginalEntryPoint", c_ulong), + ("NtSizeOfImage", c_ulong), + ("NtSizeOfHeaders", c_ulong), + ("SizeOfOptionalHeaders", c_ushort), + ("FileAlignment", c_ulong), + ("SectionAligment", c_ulong), + ("ImportTableAddress", c_ulong), + ("ImportTableSize", c_ulong), + ("ResourceTableAddress", c_ulong), + ("ResourceTableSize", c_ulong), + ("ExportTableAddress", c_ulong), + ("ExportTableSize", c_ulong), + ("TLSTableAddress", c_ulong), + ("TLSTableSize", c_ulong), + ("RelocationTableAddress", c_ulong), + ("RelocationTableSize", c_ulong), + ("TimeDateStamp", c_ulong), + ("SectionNumber", c_ushort), + ("CheckSum", c_ulong), + ("SubSystem", c_ushort), + ("Characteristics", c_ushort), + ("NumberOfRvaAndSizes", c_ulong) ] + +class ImportEnumData(Structure): + _pack_ = 1 + _fields_ = [ ("NewDll", c_bool), + ("NumberOfImports", c_int), + ("ImageBase", c_ulong), + ("BaseImportThunk", c_ulong), + ("ImportThunk", c_ulong), + ("APIName", c_char_p), + ("DLLName", c_char_p) ] + +class THREAD_ITEM_DATA(Structure): + _pack_ = 1 + _fields_ = [ ("hThread", c_void_p), + ("dwThreadId", c_ulong), + ("ThreadStartAddress", c_void_p), + ("ThreadLocalBase", c_void_p) ] + +MAX_PATH = 260 + +class LIBRARY_ITEM_DATA(Structure): + _pack_ = 1 + _fields_ = [ ("hFile", c_void_p), + ("BaseOfDll", c_void_p), + ("hFileMapping", c_void_p), + ("hFileMappingView", c_void_p), + ("szLibraryPath", c_char * MAX_PATH), + ("szLibraryName", c_char * MAX_PATH) ] + +class LIBRARY_ITEM_DATAW(Structure): + _pack_ = 1 + _fields_ = [ ("hFile", c_void_p), + ("BaseOfDll", c_void_p), + ("hFileMapping", c_void_p), + ("hFileMappingView", c_void_p), + ("szLibraryPath", c_wchar * MAX_PATH), + ("szLibraryName", c_wchar * MAX_PATH) ] + +class PROCESS_ITEM_DATA(Structure): + _pack_ = 1 + _fields_ = [ ("hProcess", c_void_p), + ("dwProcessId", c_ulong), + ("hThread", c_void_p), + ("dwThreadId", c_ulong), + ("hFile", c_void_p), + ("BaseOfImage", c_void_p), + ("ThreadStartAddress", c_void_p), + ("ThreadLocalBase", c_void_p) ] + +class HandlerArray(Structure): + _pack_ = 1 + _fields_ = [ ("ProcessId", c_ulong), + ("hHandle", c_void_p) ] + +class PluginInformation(Structure): + _pack_ = 1 + _fields_ = [ ("PluginName", c_char * 64), + ("PluginMajorVersion", c_ulong), + ("PluginMinorVersion", c_ulong), + ("PluginBaseAddress", c_void_p), + ("TitanDebuggingCallBack", c_void_p), + ("TitanRegisterPlugin", c_void_p), + ("TitanReleasePlugin", c_void_p), + ("TitanResetPlugin", c_void_p), + ("PluginDisabled", c_bool) ] + +TEE_MAXIMUM_HOOK_SIZE = 14 +TEE_MAXIMUM_HOOK_RELOCS = 7 + +TEE_MAXIMUM_HOOK_INSERT_SIZE = 5 +TEE_MAXIMUM_HOOK_INSERT_SIZE64 = 14 + +class HOOK_ENTRY(Structure): + _pack_ = 1 + _fields_ = [ ("IATHook", c_bool), + ("HookType", c_ubyte), + ("HookSize", c_ulong), + ("HookAddress", c_void_p), + ("RedirectionAddress", c_void_p), + ("HookBytes", c_ubyte * TEE_MAXIMUM_HOOK_SIZE), + ("OriginalBytes", c_ubyte * TEE_MAXIMUM_HOOK_SIZE), + ("IATHookModuleBase", c_void_p), + ("IATHookNameHash", c_ulong), + ("HookIsEnabled", c_bool), + ("HookIsRemote", c_bool), + ("PatchedEntry", c_void_p), + ("RelocationInfo", c_ulong * TEE_MAXIMUM_HOOK_RELOCS), + ("RelocationCount", c_int) ] + +UE_DEPTH_SURFACE = 0 +UE_DEPTH_DEEP = 1 + +UE_UNPACKER_CONDITION_SEARCH_FROM_EP = 1 + +UE_UNPACKER_CONDITION_LOADLIBRARY = 1 +UE_UNPACKER_CONDITION_GETPROCADDRESS = 2 +UE_UNPACKER_CONDITION_ENTRYPOINTBREAK = 3 +UE_UNPACKER_CONDITION_RELOCSNAPSHOT1 = 4 +UE_UNPACKER_CONDITION_RELOCSNAPSHOT2 = 5 + +UE_FIELD_OK = 0 +UE_FIELD_BROKEN_NON_FIXABLE = 1 +UE_FIELD_BROKEN_NON_CRITICAL = 2 +UE_FIELD_BROKEN_FIXABLE_FOR_STATIC_USE = 3 +UE_FIELD_BROKEN_BUT_CAN_BE_EMULATED = 4 +UE_FILED_FIXABLE_NON_CRITICAL = 5 +UE_FILED_FIXABLE_CRITICAL = 6 +UE_FIELD_NOT_PRESET = 7 +UE_FIELD_NOT_PRESET_WARNING = 8 + +UE_RESULT_FILE_OK = 10 +UE_RESULT_FILE_INVALID_BUT_FIXABLE = 11 +UE_RESULT_FILE_INVALID_AND_NON_FIXABLE = 12 +UE_RESULT_FILE_INVALID_FORMAT = 13 + +class FILE_STATUS_INFO(Structure): + _pack_ = 1 + _fields_ = [ ("OveralEvaluation", c_ubyte), + ("EvaluationTerminatedByException", c_bool), + ("FileIs64Bit", c_bool), + ("FileIsDLL", c_bool), + ("FileIsConsole", c_bool), + ("MissingDependencies", c_bool), + ("MissingDeclaredAPIs", c_bool), + ("SignatureMZ", c_ubyte), + ("SignaturePE", c_ubyte), + ("EntryPoint", c_ubyte), + ("ImageBase", c_ubyte), + ("SizeOfImage", c_ubyte), + ("FileAlignment", c_ubyte), + ("SectionAlignment", c_ubyte), + ("ExportTable", c_ubyte), + ("RelocationTable", c_ubyte), + ("ImportTable", c_ubyte), + ("ImportTableSection", c_ubyte), + ("ImportTableData", c_ubyte), + ("IATTable", c_ubyte), + ("TLSTable", c_ubyte), + ("LoadConfigTable", c_ubyte), + ("BoundImportTable", c_ubyte), + ("COMHeaderTable", c_ubyte), + ("ResourceTable", c_ubyte), + ("ResourceData", c_ubyte), + ("SectionTable", c_ubyte) ] + +class FILE_FIX_INFO(Structure): + _pack_ = 1 + _fields_ = [ ("OveralEvaluation", c_ubyte), + ("FixingTerminatedByException", c_bool), + ("FileFixPerformed", c_bool), + ("StrippedRelocation", c_bool), + ("DontFixRelocations", c_bool), + ("OriginalRelocationTableAddress", c_ulong), + ("OriginalRelocationTableSize", c_ulong), + ("StrippedExports", c_bool), + ("DontFixExports", c_bool), + ("OriginalExportTableAddress", c_ulong), + ("OriginalExportTableSize", c_ulong), + ("StrippedResources", c_bool), + ("DontFixResources", c_bool), + ("OriginalResourceTableAddress", c_ulong), + ("OriginalResourceTableSize", c_ulong), + ("StrippedTLS", c_bool), + ("DontFixTLS", c_bool), + ("OriginalTLSTableAddress", c_ulong), + ("OriginalTLSTableSize", c_ulong), + ("StrippedLoadConfig", c_bool), + ("DontFixLoadConfig", c_bool), + ("OriginalLoadConfigTableAddress", c_ulong), + ("OriginalLoadConfigTableSize", c_ulong), + ("StrippedBoundImports", c_bool), + ("DontFixBoundImports", c_bool), + ("OriginalBoundImportTableAddress", c_ulong), + ("OriginalBoundImportTableSize", c_ulong), + ("StrippedIAT", c_bool), + ("DontFixIAT", c_bool), + ("OriginalImportAddressTableAddress", c_ulong), + ("OriginalImportAddressTableSize", c_ulong), + ("StrippedCOM", c_bool), + ("DontFixCOM", c_bool), + ("OriginalCOMTableAddress", c_ulong), + ("OriginalCOMTableSize", c_ulong) ] + +class PROCESS_INFORMATION(Structure): + _pack_ = 1 + _fields_ = [ ("hProcess", c_void_p), + ("hThread", c_void_p), + ("dwProcessId", c_ulong), + ("dwThreadId", c_ulong) ] + +EXCEPTION_MAXIMUM_PARAMETERS = 15 + +class EXCEPTION_RECORD(Structure): + _pack_ = 1 + pass + +EXCEPTION_RECORD._fields_ = [ ("ExceptionCode", c_ulong), + ("ExceptionFlags", c_ulong), + ("ExceptionRecord", POINTER(EXCEPTION_RECORD)), + ("ExceptionAddress", c_void_p), + ("NumberParameters", c_ulong), + ("ExceptionInformation", c_ulong * EXCEPTION_MAXIMUM_PARAMETERS) ] + +class EXCEPTION_DEBUG_INFO(Structure): + _pack_ = 1 + _fields_ = [ ("ExceptionRecord", EXCEPTION_RECORD), + ("dwFirstChance", c_ulong) ] + +class CREATE_THREAD_DEBUG_INFO(Structure): + _pack_ = 1 + _fields_ = [ ("hThread", c_void_p), + ("lpThreadLocalBase", c_void_p), + ("lpStartAddress", c_void_p) ] + +class CREATE_PROCESS_DEBUG_INFO(Structure): + _pack_ = 1 + _fields_ = [ ("hFile", c_void_p), + ("hProcess", c_void_p), + ("hThread", c_void_p), + ("dwDebugInfoFileOffset", c_ulong), + ("nDebugInfoSize", c_ulong), + ("lpThreadLocalBase", c_void_p), + ("lpStartAddress", c_void_p), + ("lpImageName", c_void_p), + ("fUnicode", c_ushort) ] + +class EXIT_THREAD_DEBUG_INFO(Structure): + _pack_ = 1 + _fields_ = [ ("dwExitCode", c_ulong) ] + +class EXIT_PROCESS_DEBUG_INFO(Structure): + _pack_ = 1 + _fields_ = [ ("dwExitCode", c_ulong) ] + +class LOAD_DLL_DEBUG_INFO(Structure): + _pack_ = 1 + _fields_ = [ ("hFile", c_void_p), + ("lpBaseOfDll", c_void_p), + ("dwDebugInfoFileOffset", c_ulong), + ("nDebugInfoSize", c_ulong), + ("lpImageName", c_void_p), + ("fUnicode", c_ushort) ] + +class UNLOAD_DLL_DEBUG_INFO(Structure): + _pack_ = 1 + _fields_ = [ ("lpBaseOfDll", c_void_p) ] + +class OUTPUT_DEBUG_STRING_INFO(Structure): + _pack_ = 1 + _fields_ = [ ("lpDebugStringData", c_char_p), + ("fUnicode", c_ushort), + ("nDebugStringLength", c_ushort) ] + +class RIP_INFO(Structure): + _pack_ = 1 + _fields_ = [ ("dwError", c_ulong), + ("dwType", c_ulong) ] + +class _U(Union): + _pack_ = 1 + _fields_ = [ ("Exception", EXCEPTION_DEBUG_INFO), + ("CreateThread", CREATE_THREAD_DEBUG_INFO), + ("CreateProcessInfo", CREATE_PROCESS_DEBUG_INFO), + ("ExitThread", EXIT_THREAD_DEBUG_INFO), + ("ExitProcess", EXIT_PROCESS_DEBUG_INFO), + ("LoadDll", LOAD_DLL_DEBUG_INFO), + ("UnloadDll", UNLOAD_DLL_DEBUG_INFO), + ("DebugString", OUTPUT_DEBUG_STRING_INFO), + ("RipInfo", RIP_INFO) ] + +class DEBUG_EVENT(Structure): + _pack_ = 1 + _anonymous_ = ("u",) + _fields_ = [ ("dwDebugEventCode", c_ulong), + ("dwProcessId", c_ulong), + ("dwThreadId", c_ulong), + ("u", _U) ] + +class STARTUPINFOW(Structure): + _pack_ = 1 + _fields_ = [ ("cb", c_ulong), + ("lpReserved", c_wchar_p), + ("lpDesktop", c_wchar_p), + ("lpTitle", c_wchar_p), + ("dwX", c_ulong), + ("dwY", c_ulong), + ("dwXSize", c_ulong), + ("dwYSize", c_ulong), + ("dwXCountChars", c_ulong), + ("dwYCountChars", c_ulong), + ("dwFillAttribute", c_ulong), + ("dwFlags", c_ulong), + ("wShowWindow", c_ushort), + ("cbReserved2", c_ushort), + ("lpReserved2", POINTER(c_ubyte)), + ("hStdInput", c_void_p), + ("hStdOutput", c_void_p), + ("hStdError", c_void_p) ] + +fImportEnum = WINFUNCTYPE(None, POINTER(ImportEnumData)) +fImportFix = WINFUNCTYPE(None, c_void_p) +fResourceEnum = WINFUNCTYPE(None, c_wchar_p, c_ulong, c_wchar_p, c_ulong, c_ulong, c_ulong, c_ulong) +fThreadEnum = WINFUNCTYPE(None, POINTER(THREAD_ITEM_DATA)) +fThreadExit = WINFUNCTYPE(None, POINTER(EXIT_THREAD_DEBUG_INFO)) +fBreakPoint = WINFUNCTYPE(None) +fCustomHandler = WINFUNCTYPE(None, c_void_p) +fLibraryBreakPoint = WINFUNCTYPE(None, POINTER(LOAD_DLL_DEBUG_INFO)) +fLibraryEnum = WINFUNCTYPE(None, POINTER(LIBRARY_ITEM_DATA)) +fLibraryEnumW = WINFUNCTYPE(None, POINTER(LIBRARY_ITEM_DATAW)) +fHookEnum = WINFUNCTYPE(c_bool, POINTER(HOOK_ENTRY), c_void_p, POINTER(LIBRARY_ITEM_DATA), c_ulong) +fProcessWithLibraryEnum = WINFUNCTYPE(None, c_ulong, c_void_p) +fStaticDecrypt = WINFUNCTYPE(c_bool, c_void_p, c_ulong) +fInitializeDbg = WINFUNCTYPE(None, c_char_p, c_ubyte, c_ubyte) + +TE.GetPE32DataFromMappedFile.restype = c_ulonglong +TE.GetPE32Data.restype = c_ulonglong +TE.GetPE32DataW.restype = c_ulonglong +TE.ConvertVAtoFileOffset.restype = c_ulonglong +TE.ConvertVAtoFileOffsetEx.restype = c_ulonglong +TE.ConvertFileOffsetToVA.restype = c_ulonglong +TE.ConvertFileOffsetToVAEx.restype = c_ulonglong +TE.ResourcerLoadFileForResourceUse.restype = c_ulonglong +TE.ResourcerLoadFileForResourceUseW.restype = c_ulonglong +TE.ThreaderCreateRemoteThread.restype = c_ulonglong +TE.ThreaderCreateRemoteThreadEx.restype = c_ulonglong +TE.ThreaderGetOpenHandleForThread.restype = c_ulonglong +TE.GetContextDataEx.restype = c_ulonglong +TE.GetContextData.restype = c_ulonglong +TE.FindEx.restype = c_ulonglong +TE.Find.restype = c_ulonglong +TE.GetDebuggedDLLBaseAddress.restype = c_ulonglong +TE.GetDebuggedFileBaseAddress.restype = c_ulonglong +TE.GetFunctionParameter.restype = c_ulonglong +TE.GetJumpDestinationEx.restype = c_ulonglong +TE.GetJumpDestination.restype = c_ulonglong +TE.ImporterGetCurrentDelta.restype = c_ulonglong +TE.ImporterFindAPIWriteLocation.restype = c_ulonglong +TE.ImporterFindOrdinalAPIWriteLocation.restype = c_ulonglong +TE.ImporterFindAPIByWriteLocation.restype = c_ulonglong +TE.ImporterFindDLLByWriteLocation.restype = c_ulonglong +TE.ImporterGetAPIOrdinalNumber.restype = c_ulonglong +TE.ImporterGetRemoteAPIAddress.restype = c_ulonglong +TE.ImporterGetRemoteAPIAddressEx.restype = c_ulonglong +TE.ImporterGetLocalAPIAddress.restype = c_ulonglong +TE.ImporterGetAPIOrdinalNumberFromDebugee.restype = c_ulonglong +TE.ImporterGetRemoteDLLBase.restype = c_ulonglong +TE.ImporterGetForwardedAPIOrdinalNumber.restype = c_ulonglong +TE.ImporterGetNearestAPIAddress.restype = c_ulonglong +TE.TracerLevel1.restype = c_ulonglong +TE.HashTracerLevel1.restype = c_ulonglong +TE.TracerFixKnownRedirection.restype = c_ulonglong +TE.HandlerGetHandleDetails.restype = c_ulonglong +TE.HandlerGetOpenMutexHandle.restype = c_ulonglong +TE.HandlerGetOpenMutexHandleW.restype = c_ulonglong + +TE.GetSharedOverlay.restype = c_char_p +TE.StaticDisassembleEx.restype = c_char_p +TE.StaticDisassemble.restype = c_char_p +TE.DisassembleEx.restype = c_char_p +TE.Disassemble.restype = c_char_p +TE.ImporterGetLastAddedDLLName.restype = c_char_p +TE.ImporterGetDLLName.restype = c_char_p +TE.ImporterGetAPIName.restype = c_char_p +TE.ImporterGetAPINameEx.restype = c_char_p +TE.ImporterGetDLLNameFromDebugee.restype = c_char_p +TE.ImporterGetAPINameFromDebugee.restype = c_char_p +TE.ImporterGetForwardedAPIName.restype = c_char_p +TE.ImporterGetForwardedDLLName.restype = c_char_p +TE.ImporterGetNearestAPIName.restype = c_char_p +TE.TranslateNativeName.restype = c_char_p +TE.HandlerGetHandleName.restype = c_char_p + +TE.GetSharedOverlayW.restype = c_wchar_p +TE.TranslateNativeNameW.restype = c_wchar_p +TE.HandlerGetHandleNameW.restype = c_wchar_p + +TE.GetPEBLocation.restype = c_void_p + +TE.ThreaderGetThreadInfo.restype = POINTER(THREAD_ITEM_DATA) +TE.ThreaderGetThreadData.restype = POINTER(THREAD_ITEM_DATA) + +TE.InitDebug.restype = POINTER(PROCESS_INFORMATION) +TE.InitDebugW.restype = POINTER(PROCESS_INFORMATION) +TE.InitDebugEx.restype = POINTER(PROCESS_INFORMATION) +TE.InitDebugExW.restype = POINTER(PROCESS_INFORMATION) +TE.InitDLLDebug.restype = POINTER(PROCESS_INFORMATION) +TE.InitDLLDebugW.restype = POINTER(PROCESS_INFORMATION) + +TE.GetDebugData.restype = POINTER(DEBUG_EVENT) +TE.GetTerminationData.restype = POINTER(DEBUG_EVENT) + +TE.GetProcessInformation.restype = POINTER(PROCESS_INFORMATION) +TE.GetStartupInformation.restype = POINTER(STARTUPINFOW) + +TE.LibrarianGetLibraryInfo.restype = POINTER(LIBRARY_ITEM_DATA) +TE.LibrarianGetLibraryInfoEx.restype = POINTER(LIBRARY_ITEM_DATA) + +TE.LibrarianGetLibraryInfoW.restype = POINTER(LIBRARY_ITEM_DATAW) +TE.LibrarianGetLibraryInfoExW.restype = POINTER(LIBRARY_ITEM_DATAW) + +TE.HooksGetHookEntryDetails.restype = POINTER(HOOK_ENTRY) + +TE.ExtensionManagerGetPluginInfo.restype = POINTER(PluginInformation) \ No newline at end of file diff --git a/TitanEngine/TitanEngine.cbp b/TitanEngine/TitanEngine.cbp index 0730314..2c5bbb0 100644 --- a/TitanEngine/TitanEngine.cbp +++ b/TitanEngine/TitanEngine.cbp @@ -6,26 +6,6 @@