hotfix x64 calling convention and more prototypes

this fix a problem with BeaEngine and use the arg.mne as a workaround to detect register modifications. An email was sent to the original author of BeaEngine. Many undocumented function prototypes were added to the library list.

.gitattributes

@@ -0,0 +1,63 @@
+###############################################################################
+# Set default behavior to automatically normalize line endings.
+###############################################################################
+* text=auto
+
+###############################################################################
+# Set default behavior for command prompt diff.
+#
+# This is need for earlier builds of msysgit that does not have it on by
+# default for csharp files.
+# Note: This is only used by command line
+###############################################################################
+#*.cs     diff=csharp
+
+###############################################################################
+# Set the merge driver for project and solution files
+#
+# Merging from the command prompt will add diff markers to the files if there
+# are conflicts (Merging from VS is not affected by the settings below, in VS
+# the diff markers are never inserted). Diff markers may cause the following 
+# file extensions to fail to load in VS. An alternative would be to treat
+# these files as binary and thus will always conflict and require user
+# intervention with every merge. To do so, just uncomment the entries below
+###############################################################################
+#*.sln       merge=binary
+#*.csproj    merge=binary
+#*.vbproj    merge=binary
+#*.vcxproj   merge=binary
+#*.vcproj    merge=binary
+#*.dbproj    merge=binary
+#*.fsproj    merge=binary
+#*.lsproj    merge=binary
+#*.wixproj   merge=binary
+#*.modelproj merge=binary
+#*.sqlproj   merge=binary
+#*.wwaproj   merge=binary
+
+###############################################################################
+# behavior for image files
+#
+# image files are treated as binary by default.
+###############################################################################
+#*.jpg   binary
+#*.png   binary
+#*.gif   binary
+
+###############################################################################
+# diff behavior for common document formats
+# 
+# Convert binary document formats to text before diffing them. This feature
+# is only available from the command line. Turn it on by uncommenting the 
+# entries below.
+###############################################################################
+#*.doc   diff=astextplain
+#*.DOC   diff=astextplain
+#*.docx  diff=astextplain
+#*.DOCX  diff=astextplain
+#*.dot   diff=astextplain
+#*.DOT   diff=astextplain
+#*.pdf   diff=astextplain
+#*.PDF   diff=astextplain
+#*.rtf   diff=astextplain
+#*.RTF   diff=astextplain

README.md

@@ -1,15 +1,46 @@
 x64dbg-StaticAnalysis
 =====================
+This is a plugin for the project x64_dbg. It detect win32api calls and add useful comments at found parameters for easier analysis. It supports **x86 and x64**.
+The plugin delivers a comprehensive list (3304 descriptions of functions) of function prototypes. *These were crafted by hand and RegEx, so please respect the credits and license.
 
-- plugin for x64_dbg
-- see [release page](https://github.com/x64dbg/x64dbg-StaticAnalysis/releases) for a working plugin
+### x86 and x64
+It fully supports the x64 calling convention:
+![default x86 calling](https://raw.githubusercontent.com/x64dbg/x64dbg-StaticAnalysis/master/x64.PNG)
 
-##Roadmap
-see [dev branch](https://github.com/x64dbg/x64dbg-StaticAnalysis/tree/enhance)
+It even detects different argument order. Notice that the prototype is
 
-- x64 calling convention (x64 version)
-- Stackemulator (for MingGM-argument-passing)
-- function-finder
+   int GetModuleFileNameW(DWORD nBufferSize,LPTSTR lpBuffer,HMODULE hModule)
+
+but the plugin recognize the order of the arguments
+![default x86 calling](https://raw.githubusercontent.com/x64dbg/x64dbg-StaticAnalysis/master/x64_2.PNG)
+Hence it knows, that in this case the argument order changed.
+
+
+### advanced parameter detection (MinGW)
+
+![default x86 calling](https://raw.githubusercontent.com/x64dbg/x64dbg-StaticAnalysis/master/analysis2.PNG)
+Due some stack emulation it is possible to analyse MingGW parameter passing to the stack
+![MingGW parameters](https://raw.githubusercontent.com/x64dbg/x64dbg-StaticAnalysis/master/analysis.PNG)
+
+## Download
+See [release page](https://github.com/x64dbg/x64dbg-StaticAnalysis/release) for lastest compiled plugin. The source of the latest release is in the branch "stable".
+
+This master branch may contains experimental code and the latest commits.
+
+Make sure that you installed the "Microsoft Visual C++ 2013 Redistributatble Package".
+(http://www.microsoft.com/en-us/download/details.aspx?id=40784)
+
+
+## implemented Features
+- auto comments on parameters for api-function
+- real stack emulator for MinGW-arguments detection
+- real register emulator for x64 calling convention
+- supports x86 and x64 targets
+
+## Roadmap
+
+
+- function-finder (function body, xrefs, function returns)
 - case-switch detection
 - "MB_OK"-like symbols
 - loop-detection

src/AnalysisRunner.cpp

@@ -3,18 +3,18 @@
  * license:  GLPv3
  */
 #include "AnalysisRunner.h"
+#include "StackEmulator.h"
+#include "RegisterEmulator.h"
 
 
-AnalysisRunner::AnalysisRunner(duint BaseAddress,duint Size)
+
+AnalysisRunner::AnalysisRunner(duint BaseAddress, duint Size)
 {
+	// store all given information
 	mBaseAddress = BaseAddress;
 	mSize = Size;
 
-#ifdef _WIN64
-	throw std::exception("The method or operation is not implemented.");
-#else
 	_Calls = new S_IntermodularCalls(this);
-#endif // _WIN64
 
 	initialise();
 	clear();
@@ -26,25 +26,41 @@ AnalysisRunner::~AnalysisRunner(void)
 }
 
 void AnalysisRunner::start(){
-	if(!mDb->ok())
+	// do we have information about the function prototypes?
+	if(!mApiDb->ok())
 		return;
 	_plugin_logputs("[StaticAnalysis] analysis started ...");
+	// remove all temp information
 	clear();
 	run();
+	// see every instructions once
+	publishInstructions();
+	// do some magic
 	think();
 	_plugin_logputs("[StaticAnalysis] analysis finished ...");
 }
 
-const duint AnalysisRunner::baseAddress() const{
-	return mBaseAddress;
+void AnalysisRunner::publishInstructions(){
+	StackEmulator Stack;
+	RegisterEmulator Register;
+	// show every sub-plugin the current instruction
+	for (auto currentInstruction : mInstructionsBuffer)
+	{
+		see(&currentInstruction.second,&Stack,&Register);
+		Stack.emulate(&currentInstruction.second.BeaStruct);
+		Register.emulate(&currentInstruction.second.BeaStruct);
+	}
 }
 
 void AnalysisRunner::run()
 {
-	unsigned char* data = new unsigned char[mSize];
-	if(!DbgMemRead(mBaseAddress, data, mSize))
+	// this function will be run once
+
+	// copy the code section
+	mCodeMemory = new unsigned char[mSize];
+	if(!DbgMemRead(mBaseAddress, mCodeMemory, mSize))
 	{
-		//ERROR
+		//ERROR: copying did not work
 		_plugin_logputs("[StaticAnalysis] could not read memory ...");
 		return;
 	}
@@ -56,57 +72,98 @@ void AnalysisRunner::run()
 	duint size = mSize;
 
 	memset(&disasm, 0, sizeof(disasm));
+
 #ifdef _WIN64
-	disasm.Archi=64;
+	disasm.Archi = 64;
 #endif // _WIN64
-	disasm.EIP=(UIntPtr)data;
-	disasm.VirtualAddr=(UInt64)baseaddr;
+
+	currentEIP = (UIntPtr)mCodeMemory;
+	disasm.EIP=currentEIP;
+	currentVirtualAddr = (UInt64)baseaddr;
+	disasm.VirtualAddr=currentVirtualAddr;
 	duint i=0;
-	while(i<size)
+
+	for (duint i = 0; i < size;)
 	{
-		int len=Disasm(&disasm);
-		if(len!=UNKNOWN_OPCODE)
+		// disassemble instruction
+		int len = Disasm(&disasm);
+		// everything ok?
+		if (len != UNKNOWN_OPCODE)
 		{
-			see(&disasm);
+			Instruction_t instr(&disasm, len);
+			mInstructionsBuffer.insert(std::pair<UInt64, Instruction_t>(disasm.VirtualAddr, instr));
 		}
 		else{
+			// something went wrong --> notify every subplugin
 			unknownOpCode(&disasm);
-			len=1;
+			len = 1;
 		}
-		disasm.EIP+=len;
-		disasm.VirtualAddr+=len;
-		i+=len;
+		// we do not know if the struct DISASM gets destroyed on unkown opcodes --> use variables
+		currentEIP += len;
+		currentVirtualAddr += len;
+
+		disasm.EIP = currentEIP;
+		disasm.VirtualAddr = currentVirtualAddr;
+		// move memory pointer
+		i += len;
 	}
+
+
+	delete mCodeMemory;
 }
 void AnalysisRunner::clear(  )
 {
+	mInstructionsBuffer.clear();
+	// forward to all sub-plugin
 	_Calls->clear();
 }
 void AnalysisRunner::think(  )
 {
+	// forward to all sub-plugin
 	_Calls->think();
 }
-void AnalysisRunner::see( const DISASM *disasm )
+void AnalysisRunner::see(const Instruction_t *disasm, const StackEmulator *stack, const RegisterEmulator* regState)
 {
-	_Calls->see(disasm);
+	// forward to all sub-plugin
+	_Calls->see(disasm, stack, regState);
 }
 
 void AnalysisRunner::unknownOpCode( const DISASM *disasm )
 {
+	// forward to all sub-plugin
 	_Calls->unknownOpCode(disasm);
 }
 
-ApiDB* AnalysisRunner::db()
-{
-	return mDb;
-}
-
 void AnalysisRunner::initialise()
 {
-	_Calls->initialise(mBaseAddress,mSize);
+	// forward to all sub-plugin
+	_Calls->initialise(mBaseAddress, mSize);
 }
 
-void AnalysisRunner::setDB( ApiDB *api )
+
+
+ApiDB* AnalysisRunner::FunctionInformation() const
 {
-	mDb = api;
+	return mApiDb;
 }
+
+
+void AnalysisRunner::setFunctionInformation( ApiDB *api )
+{
+	mApiDb = api;
+}
+
+// return instruction of address - if possible
+int AnalysisRunner::instruction(UInt64 va, Instruction_t* instr) const{
+	if (std::contains(mInstructionsBuffer, va)){
+		*instr = mInstructionsBuffer.at(va);
+		return instr->Length;
+	}
+	else{
+		return UNKNOWN_OPCODE;
+	}
+}
+
+
+
+

src/AnalysisRunner.h

@@ -4,48 +4,53 @@
  */
 #pragma once
 #include "pluginsdk/bridgemain.h"
-/* plugin:   (StaticAnalysis) for x64dbg <http://www.x64dbg.com>
- * author:   [email protected] <http://blog.traceflow.com>
- * license:  GLPv3
- */
 #include "pluginmain.h"
 #include "pluginsdk/BeaEngine.h"
 
-#ifdef _WIN64
-throw std::exception("The method or operation is not implemented.");
-#else
-#include "S_IntermodularCallsX86.h"
-#endif // _WIN64
-
+#include "S_IntermodularCalls.h"
 
 #include "ApiDB.h"
 
 class AnalysisRunner
 {
+	std::map<UInt64,Instruction_t> mInstructionsBuffer;
 	duint mBaseAddress;
 	duint mSize;
 
 	S_IntermodularCalls *_Calls;
-	ApiDB *mDb;
+	ApiDB *mApiDb;
 
 
+	unsigned char* mCodeMemory;
+	UIntPtr currentEIP;
+	UInt64 currentVirtualAddr;
+
+protected:
+	// forwarding
+	void see(const Instruction_t *disasm, const  StackEmulator *stack, const RegisterEmulator* regState);
+	void clear();
+	void think();
+	void initialise();
+	void unknownOpCode(const DISASM *disasm);
+
+private:
+	void run();
+	void publishInstructions();
+
 public:
 
-	ApiDB* db();
-
-	void setDB(ApiDB *api);
-
+	ApiDB* FunctionInformation() const;
+	void setFunctionInformation(ApiDB *api);
 
 	AnalysisRunner(duint BaseAddress,duint Size);
 	~AnalysisRunner(void);
-
-	void run();
-	void see(const DISASM *disasm);
-	void unknownOpCode( const DISASM *disasm );
+	
 	void start();
-	void clear( );
-	void think( );
-	void initialise();
-	const duint baseAddress() const;
+	
+
+
+	int instruction(UInt64 va, Instruction_t* instr) const;
+
+	
 };
 

src/ApiDB.cpp

@@ -46,14 +46,14 @@ ApiDB::ApiDB(void)
 			std::vector<std::string> tokens = split(rawLine,";");
 			
 			if(tokens.size() >3){
-				APIFunction f;
+				FunctionInfo_t f;
 				f.DLLName = tokens.at(0);
 				f.ReturnType = tokens.at(1);
 				f.Name = tokens.at(2);
 
 				for (int j = 3;j<tokens.size()-1;j+=2)
 				{
-					APIArgument a;
+					ArgumentInfo_t a;
 					a.Type = tokens.at(j);
 					a.Name = tokens.at(j+1);
 					f.Arguments.push_back(a);
@@ -84,15 +84,15 @@ ApiDB::~ApiDB(void)
 {
 }
 
-APIFunction ApiDB::find( std::string name )
+FunctionInfo_t ApiDB::find( std::string name )
 {
 	if(name[0]=='&')
 		name.erase (0,1); 
-	APIFunction f;
+	FunctionInfo_t f;
 	f.invalid = true;
 	
 	//_plugin_logprintf("[StaticAnalysis:IntermodularCalls] search data %s \n",name.c_str() );
-	std::list<APIFunction>::iterator it = mInfo.begin();
+	std::list<FunctionInfo_t>::iterator it = mInfo.begin();
 
 	while(it!=mInfo.end()){
 		if(it->Name == name){

src/ApiDB.h

@@ -15,9 +15,9 @@ public:
 
 	const bool ok() const;
 
-	APIFunction find(std::string name);
+	FunctionInfo_t find(std::string name);
 
-	std::list<APIFunction> mInfo;
+	std::list<FunctionInfo_t> mInfo;
 
 	
 };

src/ICommand.cpp

@@ -1,5 +1,5 @@
 #include "ICommand.h"
-
+#include "AnalysisRunner.h"
 
 ICommand::ICommand(AnalysisRunner *parent) : mParent(parent)
 {
@@ -15,3 +15,4 @@ void ICommand::initialise( const duint Base,const duint Size )
 	mBase = Base;
 	mSize = Size;
 }
+

src/ICommand.h

@@ -7,7 +7,12 @@
 #include "pluginmain.h"
 #include "pluginsdk/BeaEngine.h"
 
+#include "meta.h"
+
 class AnalysisRunner;
+class StackEmulator;
+class RegisterEmulator;
+
 class ICommand
 {
 public:
@@ -26,8 +31,8 @@ public:
 	void initialise(const duint Base,const duint Size);
 	// clear all extracted informations
 	virtual void clear() = 0;
-	// each derived class will see each instruction only once (in a analysis step)
-	virtual void see(const DISASM* disasm) = 0;
+	// each sub-plugin will get a simulated flow (it gets an instruction and the state of the stack)
+	virtual void see(const Instruction_t* disasm, const StackEmulator *stack, const RegisterEmulator* regState) = 0;
 	// this methods process all gathered informations
 	virtual bool think() = 0;
 

src/RegisterEmulator.cpp

@@ -0,0 +1,71 @@
+#include "RegisterEmulator.h"
+
+#define _SAME(a,b)  ((strcmp(a ,b) == 0) )
+
+RegisterEmulator::RegisterEmulator()
+{
+}
+
+
+RegisterEmulator::~RegisterEmulator()
+{
+}
+
+void RegisterEmulator::emulate(const DISASM* BeaStruct)
+{
+	if ((BeaStruct->Argument1.AccessMode == WRITE) && ((BeaStruct->Argument1.ArgType & GENERAL_REG))){
+		// Unfortunately there is a bug in BeaEngine, so we cannot use 
+		// "if (BeaStruct->Argument1.ArgType & REG?)"
+		if (_SAME(BeaStruct->Argument1.ArgMnemonic, "cl") ||
+			_SAME(BeaStruct->Argument1.ArgMnemonic, "ch") ||
+			_SAME(BeaStruct->Argument1.ArgMnemonic, "cx") ||
+			_SAME(BeaStruct->Argument1.ArgMnemonic, "ecx") ||
+			_SAME(BeaStruct->Argument1.ArgMnemonic, "rcx")
+			){
+			mRCX = BeaStruct->VirtualAddr;
+		}
+		else if (_SAME(BeaStruct->Argument1.ArgMnemonic, "dl") ||
+			_SAME(BeaStruct->Argument1.ArgMnemonic, "dh") ||
+			_SAME(BeaStruct->Argument1.ArgMnemonic, "dx") ||
+			_SAME(BeaStruct->Argument1.ArgMnemonic, "edx") ||
+			_SAME(BeaStruct->Argument1.ArgMnemonic, "rdx")
+			){
+			mRDX = BeaStruct->VirtualAddr;
+		}
+		else if (_SAME(BeaStruct->Argument1.ArgMnemonic, "r8") ||
+			_SAME(BeaStruct->Argument1.ArgMnemonic, "r8d") ||
+			_SAME(BeaStruct->Argument1.ArgMnemonic, "r8w") ||
+			_SAME(BeaStruct->Argument1.ArgMnemonic, "r8b")
+			){
+			mR8 = BeaStruct->VirtualAddr;
+		}
+		else if (_SAME(BeaStruct->Argument1.ArgMnemonic, "r9") ||
+			_SAME(BeaStruct->Argument1.ArgMnemonic, "r9d") ||
+			_SAME(BeaStruct->Argument1.ArgMnemonic, "r9w") ||
+			_SAME(BeaStruct->Argument1.ArgMnemonic, "r9b")
+			){
+			mR9 = BeaStruct->VirtualAddr;
+		}
+
+	}
+}
+
+const duint RegisterEmulator::rcx() const
+{
+	return mRCX;
+}
+
+const duint RegisterEmulator::rdx() const
+{
+	return mRDX;
+}
+
+const duint RegisterEmulator::r8() const
+{
+	return mR8;
+}
+
+const duint RegisterEmulator::r9() const
+{
+	return mR9;
+}

src/RegisterEmulator.h

@@ -0,0 +1,20 @@
+#pragma once
+#include "meta.h"
+class RegisterEmulator
+{
+	duint mRCX;
+	duint mRDX;
+	duint mR8;
+	duint mR9;
+public:
+	RegisterEmulator();
+	~RegisterEmulator();
+
+	void emulate(const DISASM* BeaStruct);
+
+	const duint rcx() const;
+	const duint rdx() const;
+	const duint r8() const;
+	const duint r9() const;
+};
+

src/S_IntermodularCalls.h

@@ -0,0 +1,29 @@
+/* plugin:   (StaticAnalysis) for x64dbg <http://www.x64dbg.com>
+ * author:   [email protected] <http://blog.traceflow.com>
+ * license:  GLPv3
+ */
+#pragma once
+#include "ICommand.h"
+#include <list>
+#include <set>
+#include <map>
+
+#include "meta.h"
+#include "StackEmulator.h"
+#include "RegisterEmulator.h"
+
+class S_IntermodularCalls : public ICommand
+{
+	unsigned int numberOfCalls;
+	unsigned int numberOfApiCalls;
+
+public:
+
+	S_IntermodularCalls(AnalysisRunner *parent);
+
+	void clear();
+	void see(const Instruction_t* disasm, const StackEmulator* stack, const RegisterEmulator* regState);
+	bool think();
+	void unknownOpCode(const DISASM* disasm);
+};
+

src/S_IntermodularCallsX64.cpp

@@ -0,0 +1,152 @@
+/* plugin:   (StaticAnalysis) for x64dbg <http://www.x64dbg.com>
+* author:   [email protected] <http://blog.traceflow.com>
+* license:  GLPv3
+*/
+#ifdef _WIN64
+
+
+#include "S_IntermodularCalls.h"
+#include "AnalysisRunner.h"
+
+
+
+#define _isCall(disasm)  ((disasm.Instruction.BranchType==CallType) && (disasm.Instruction.BranchType!=RetType) && !(disasm.Argument1.ArgType &REGISTER_TYPE))
+
+
+S_IntermodularCalls::S_IntermodularCalls(AnalysisRunner *parent) : ICommand(parent){
+
+}
+
+void S_IntermodularCalls::clear()
+{
+	numberOfApiCalls = 0;
+	numberOfCalls = 0;
+}
+
+void S_IntermodularCalls::see(const  Instruction_t* currentInstruction, const StackEmulator* stackState, const RegisterEmulator* regState)
+{
+
+	if ((_isCall(currentInstruction->BeaStruct))){
+		// current instructions contains a call
+		// extract from "call 0x123" --> instruction at 0x123
+
+
+		// the opcode 0xFF "jmp" tells us that the current call is a call to a dll-function
+
+		numberOfCalls++;
+		// does the TitanEngine provides us a label?
+		char labelText[MAX_LABEL_SIZE];
+		bool hasLabel = DbgGetLabelAt(currentInstruction->BeaStruct.Instruction.AddrValue, SEG_DEFAULT, labelText);
+		if (hasLabel){
+
+			// we have a label from TitanEngine --> look up function header in database
+			FunctionInfo_t f = mParent->FunctionInformation()->find(labelText);
+			if (!f.invalid){
+				numberOfApiCalls++;
+				// yeah we know everything about the dll-call!
+				std::string functionComment;
+				functionComment = f.ReturnType + " " + f.Name + "(...)";
+				DbgSetCommentAt(currentInstruction->BeaStruct.VirtualAddr, functionComment.c_str());
+
+				if (f.Arguments.size() > 0){
+					std::string ArgComment = f.arg(0).Type + " " + f.arg(0).Name;
+					DbgSetCommentAt(regState->rcx(), ArgComment.c_str());
+				}
+				if (f.Arguments.size() > 1){
+					std::string ArgComment = f.arg(1).Type + " " + f.arg(1).Name;
+					DbgSetCommentAt(regState->rdx(), ArgComment.c_str());
+				}
+				if (f.Arguments.size() > 2){
+					std::string ArgComment = f.arg(2).Type + " " + f.arg(2).Name;
+					DbgSetCommentAt(regState->r8(), ArgComment.c_str());
+				}
+				if (f.Arguments.size() > 3){
+					std::string ArgComment = f.arg(3).Type + " " + f.arg(3).Name;
+					DbgSetCommentAt(regState->r9(), ArgComment.c_str());
+				}
+				if (f.Arguments.size() > 4){
+					// set comments for the arguments
+					for (auto i = 4; i < f.Arguments.size(); i++)
+					{
+						std::string ArgComment = f.arg(i).Type + " " + f.arg(i).Name;
+						duint commentAddr = stackState->lastAccessAtOffset(f.Arguments.size() - i - 1);
+						if (commentAddr != STACK_ERROR){
+							DbgSetCommentAt(commentAddr, ArgComment.c_str());
+						}
+						else{
+							// we have more arguments in the function descriptions than parameters on the stack
+							break;
+						}
+					}
+				}
+
+			}
+
+
+		}
+	}
+}
+
+bool S_IntermodularCalls::think()
+{
+	StackEmulator stack;
+
+	_plugin_logprintf("[StaticAnalysis:IntermodularCalls] found %i calls\n", numberOfCalls);
+	_plugin_logprintf("[StaticAnalysis:IntermodularCalls] of which are %i intermodular calls\n", numberOfApiCalls);
+
+	return true;
+}
+
+void S_IntermodularCalls::unknownOpCode(const  DISASM* disasm)
+{
+	// current instruction wasn't correctly disassembled, so assuming worst-case
+
+}
+
+
+
+#endif // _WIN64
+
+
+/* new calling convention in x64
+
+1. arg -> RCX (floating point: XMM0)
+2. arg -> RDX (floating point: XMM1)
+3. arg -> R8  (floating point: XMM2)
+4. arg -> R9  (floating point: XMM3)
+
+additional arguments are pushed onto the stack (right to left)
+
+
+
+if (f.Arguments.size() > 0){
+std::string ArgComment = f.arg(0).Type + " " + f.arg(0).Name;
+DbgSetAutoCommentAt(regState->rcx(), ArgComment.c_str());
+}
+if (f.Arguments.size() > 1){
+std::string ArgComment = f.arg(1).Type + " " + f.arg(1).Name;
+DbgSetAutoCommentAt(regState->rdx(), ArgComment.c_str());
+}
+if (f.Arguments.size() > 2){
+std::string ArgComment = f.arg(2).Type + " " + f.arg(2).Name;
+DbgSetAutoCommentAt(regState->r8(), ArgComment.c_str());
+}
+if (f.Arguments.size() > 3){
+std::string ArgComment = f.arg(3).Type + " " + f.arg(3).Name;
+DbgSetAutoCommentAt(regState->r9(), ArgComment.c_str());
+}
+if (f.Arguments.size() > 4){
+// set comments for the arguments
+for (auto i = 4; i < f.Arguments.size(); i++)
+{
+std::string ArgComment = f.arg(i).Type + " " + f.arg(i).Name;
+duint commentAddr = stackState->lastAccessAtOffset(i - 4);
+if (commentAddr != STACK_ERROR){
+DbgSetAutoCommentAt(commentAddr, ArgComment.c_str());
+}
+else{
+// we have more arguments in the function descriptions than parameters on the stack
+break;
+}
+}
+}*/

src/S_IntermodularCallsX86.cpp

@@ -2,12 +2,13 @@
  * author:   [email protected] <http://blog.traceflow.com>
  * license:  GLPv3
  */
-#include "S_IntermodularCallsX86.h"
-#include "AnalysisRunner.h"
-#include "meta.h"
+#ifndef _WIN64
 
-#define _isPush(disasm)  ((strcmp(disasm->Instruction.Mnemonic ,"push ") == 0) )
-#define _isCall(disasm)  ((disasm->Instruction.Opcode == 0xE8) && (disasm->Instruction.BranchType) && (disasm->Instruction.BranchType!=RetType) && !(disasm->Argument1.ArgType &REGISTER_TYPE))
+
+#include "S_IntermodularCalls.h"
+#include "AnalysisRunner.h"
+
+#define _isCall(disasm)  ((disasm.Instruction.Opcode == 0xE8) && (disasm.Instruction.BranchType) && (disasm.Instruction.BranchType!=RetType) && !(disasm.Argument1.ArgType &REGISTER_TYPE))
 
 
 S_IntermodularCalls::S_IntermodularCalls(AnalysisRunner *parent) : ICommand(parent){
@@ -16,50 +17,59 @@ S_IntermodularCalls::S_IntermodularCalls(AnalysisRunner *parent) : ICommand(pare
 
 void S_IntermodularCalls::clear()
 {
-	mCurrent.clear();
-	mApiJumps.clear();
-	mCalls.clear();
-	mComments.clear();
+	numberOfApiCalls = 0;
+	numberOfCalls = 0;
 }
 
-void S_IntermodularCalls::see(const  DISASM* disasm )
+void S_IntermodularCalls::see(const  Instruction_t* currentInstruction, const StackEmulator* stackState, const RegisterEmulator* regState)
 {
-	if(_isPush(disasm))
-	{
-		// there is "push ..." --> remember
-		mCurrent.arguments.push_back(disasm->VirtualAddr );
-	}else {
-		if(disasm->Instruction.Opcode == 0xFF)
-		{
-			// no part of api-call
-			mCurrent.clear();
-			//_plugin_logprintf("[StaticAnalysis:IntermodularCalls] found 0xFF : %x and mne (%s)\n", disasm->Instruction.Opcode,disasm->Instruction.Mnemonic);
-			char labelText[MAX_LABEL_SIZE];
-			bool hasLabel = DbgGetLabelAt(disasm->Argument1.Memory.Displacement, SEG_DEFAULT, labelText);
 
-			if(hasLabel){
-				// api calls have 0xFF-jumps as target addresses, we need to remember them
-				_JumpFF j;
-				j.RVA = disasm->VirtualAddr;
-				j.RelativeAddressValue = disasm->Argument1.Memory.Displacement;
-				strcpy(j.label,labelText);
-				mApiJumps.insert(j);
+	if ((currentInstruction->BeaStruct.Instruction.Opcode != 0xFF) && (_isCall(currentInstruction->BeaStruct))){
+		// current instructions contains a call
+		// extract from "call 0x123" --> instruction at 0x123
+		Instruction_t callTarget;
+		int len = mParent->instruction(currentInstruction->BeaStruct.Instruction.AddrValue, &callTarget);
+		if (len != UNKNOWN_OPCODE){
+			// call target was correctly disassembled before
+			if (callTarget.BeaStruct.Instruction.Opcode == 0xFF)
+			{
+				
+				// the opcode 0xFF "jmp" tells us that the current call is a call to a dll-function
+				numberOfApiCalls++;
+				numberOfCalls++;
+				// does the TitanEngine provides us a label?
+				char labelText[MAX_LABEL_SIZE];
+				bool hasLabel = DbgGetLabelAt(callTarget.BeaStruct.Argument1.Memory.Displacement, SEG_DEFAULT, labelText);
+				if (hasLabel){
+
+					// we have a label from TitanEngine --> look up function header in database
+					FunctionInfo_t f = mParent->FunctionInformation()->find(labelText);
+					if (!f.invalid){
+						// yeah we know everything about the dll-call!
+						std::string functionComment;
+						functionComment = f.ReturnType + " " + f.Name + "(...)";
+						DbgSetAutoCommentAt(currentInstruction->BeaStruct.VirtualAddr, functionComment.c_str());
+
+
+						// set comments for the arguments
+						for (auto i = 0; i < f.Arguments.size(); i++)
+						{
+							std::string ArgComment = f.arg(i).Type + " " + f.arg(i).Name;
+							duint commentAddr = stackState->lastAccessAtOffset(f.Arguments.size()-i-1);
+							if (commentAddr != STACK_ERROR){
+								DbgSetAutoCommentAt(commentAddr, ArgComment.c_str());
+							}
+							else{
+								// we have more arguments in the function descriptions than parameters on the stack
+								break;
+							}
+						}
+
+					}
+				}
 			}
-		}else {
-			if(_isCall(disasm))
-			{
-				// set missing informations
-				mCurrent.RVA = disasm->VirtualAddr ;
-				mCurrent.RelativeAddressValue = disasm->Instruction.AddrValue ;
-				// copy structure
-				_Call t = mCurrent;
-				mCalls.push_back(t);
-				mCurrent.clear();
-
-			}else
-			{
-				// something else, in particular no call
-				mCurrent.clear();
+			else{
+				numberOfCalls++;
 			}
 		}
 	}
@@ -67,57 +77,20 @@ void S_IntermodularCalls::see(const  DISASM* disasm )
 
 bool S_IntermodularCalls::think()
 {
-	_plugin_logprintf("[StaticAnalysis:IntermodularCalls] found %i calls\n", mCalls.size());
-
-	unsigned int numberOfApiCalls = 0;
-	std::list<_Call>::iterator c = mCalls.begin();
-
-	// iterate all calls
-	for (std::list<_Call>::iterator c = mCalls.begin();c != mCalls.end();c++)
-	{
-		bool is_api = false;
-		_JumpFF findJump; 
-		findJump.RVA = c->RelativeAddressValue;
-		std::set<_JumpFF>::iterator j = mApiJumps.find(findJump);
-		if(j != mApiJumps.end()){
-			// having a label we can look in our database to get the arguments list
-			APIFunction f; 
-			f = mParent->db()->find(j->label);
-			if(!f.invalid){
-				// yeah we know everything about the api-call!
-				std::string functionComment;
-				functionComment = f.ReturnType + " " + f.Name + "(...)";
-				DbgSetAutoCommentAt(c->RVA ,functionComment.c_str());
-				//_plugin_logprintf("[StaticAnalysis:IntermodularCalls] found %s at %X\n",functionComment , c->RVA);
-				int pos=0;
-				// set comments for the arguments
-				if( (f.Arguments.size() > 0)  && (c->arguments.size() > 0) ){
-					for(std::list<duint>::reverse_iterator a= c->arguments.rbegin();a!=c->arguments.rend();a++)
-					{
-						// more push" instructions than arguments
-						if(pos >=f.Arguments.size())
-							break;
-
-						std::string ArgComment = f.arg(pos).Type + " "+ f.arg(pos).Name;
-						DbgSetAutoCommentAt((*a) ,ArgComment.c_str());
-						pos++;
-					}
-				}
-			}
-			is_api = true;
-			numberOfApiCalls++;
-		}
-	}
+	StackEmulator stack;
 
+	_plugin_logprintf("[StaticAnalysis:IntermodularCalls] found %i calls\n", numberOfCalls);
 	_plugin_logprintf("[StaticAnalysis:IntermodularCalls] of which are %i intermodular calls\n", numberOfApiCalls);
 
-
 	return true;
 }
 
-void S_IntermodularCalls::unknownOpCode(const  DISASM* disasm )
+void S_IntermodularCalls::unknownOpCode(const  DISASM* disasm)
 {
 	// current instruction wasn't correctly disassembled, so assuming worst-case
-	mCurrent.clear();
+
 }
 
+
+
+#endif // _WIN64

src/S_IntermodularCallsX86.h

@@ -1,65 +0,0 @@
-/* plugin:   (StaticAnalysis) for x64dbg <http://www.x64dbg.com>
- * author:   [email protected] <http://blog.traceflow.com>
- * license:  GLPv3
- */
-#pragma once
-#include "ICommand.h"
-#include <list>
-#include <set>
-#include <map>
-
-struct _Call{
-	std::list<duint> arguments;             // address of arguments
-	duint RVA;                              // relative VA of call
-	duint RelativeAddressValue;             // call "xxxx"
-	bool isApiCall;
-
-
-	void clear(){
-		arguments.clear();
-		RVA = 0;
-		RelativeAddressValue = 0;
-		isApiCall = false;
-	}
-	_Call(){
-		isApiCall=false;
-	}	
-
-
-};
-
-
-
-class S_IntermodularCalls : public ICommand
-{
-
-	struct _JumpFF{
-		duint RVA;
-		duint RelativeAddressValue;
-		char label[MAX_LABEL_SIZE];
-
-		bool operator==(const _JumpFF& rhs) const
-		{
-			return (RVA == rhs.RVA);
-		}
-		bool operator<(const _JumpFF& rhs) const
-		{
-			return (RVA < rhs.RVA);
-		}
-	};
-
-	_Call mCurrent;
-	std::set<_JumpFF> mApiJumps;
-	std::list<_Call> mCalls;
-	std::map<duint,std::string> mComments;
-
-public:
-
-	S_IntermodularCalls(AnalysisRunner *parent);
-
-	void clear();
-	void see(const DISASM* disasm);
-	bool think();
-	void unknownOpCode(const DISASM* disasm);
-};
-

src/StackEmulator.cpp

@@ -0,0 +1,142 @@
+/* plugin:   (StaticAnalysis) for x64dbg <http://www.x64dbg.com>
+ * author:   [email protected] <http://blog.traceflow.com>
+ * license:  GLPv3
+ */
+#include "StackEmulator.h"
+
+#define _isPush(disasm)  ((strcmp((disasm)->Instruction.Mnemonic ,"push ") == 0) )
+#define _isPop(disasm)  ((strcmp((disasm)->Instruction.Mnemonic ,"pop ") == 0) )
+#define _isSub(disasm)  ((strcmp((disasm)->Instruction.Mnemonic ,"sub ") == 0) )
+#define _isAdd(disasm)  ((strcmp((disasm)->Instruction.Mnemonic ,"add ") == 0) )
+
+
+
+
+StackEmulator::StackEmulator( void) : mStackpointer(0)
+{
+	for (unsigned int i=0;i<MAX_STACKSIZE;i++)
+		mStack[i]=STACK_ERROR;
+}
+
+
+StackEmulator::~StackEmulator(void)
+{
+}
+
+/*
+ 0x01234: mov [esp+C], eax
+ --> modifyFrom(0xC,0x01234)
+*/
+void StackEmulator::modifyFrom(int relative_offset, duint addr){
+	const unsigned int internal_pointer = pointerByOffset(-1*relative_offset);
+	mStack[internal_pointer] = addr;
+}
+/*
+ 0x01234: pop eax
+ --> popFrom(0x01234), because it is:
+
+ mov eax, [esp]
+ add esp, -1    ; one to the past
+
+*/
+void StackEmulator::popFrom( duint addr )
+{
+	moveStackpointerBack(+1);
+}
+/*
+ 0x01234: push eax
+ --> pushFrom(0x01234), because it is:
+
+ add esp, +1
+ mov [esp], eax  ; one to the future
+*/
+void StackEmulator::pushFrom( duint addr )
+{
+	moveStackpointerBack(-1);
+	mStack[mStackpointer] = addr;
+}
+/*
+ 0x01234: add esp, 0xA
+ --> moveStackpointer(0xA)
+
+ offset = offset to the past
+*/
+void StackEmulator::moveStackpointerBack( int offset )
+{
+	mStackpointer = pointerByOffset(-offset);
+}
+
+unsigned int StackEmulator::pointerByOffset(int offset) const{
+	return (mStackpointer + ((offset+MAX_STACKSIZE) %MAX_STACKSIZE) + MAX_STACKSIZE) %MAX_STACKSIZE;
+}
+
+/* returns addr from last access
+   
+   0x155: mov [esp+8], eax
+
+   lastAccessAt(0x8)  would be 0x155
+
+*/
+duint StackEmulator::lastAccessAtOffset(int offset) const{
+	int p = pointerByOffset(-offset);
+	return mStack[p];
+}
+
+
+
+void StackEmulator::emulate(const DISASM* BeaStruct)
+{
+	/* track all events:
+	- sub/add esp
+	- mov [esp+x], ???
+	- push/pop
+	*/
+	// 
+
+	const duint addr = BeaStruct->VirtualAddr;                    // --> 00401301
+
+	if (_isPush(BeaStruct)){
+		// "0x123  push eax" --> remember 0x123
+		pushFrom(addr);
+	}
+	else if (_isPop(BeaStruct))
+	{
+		// "0x125  pop ebp" --> remember 0x125
+		popFrom(addr);
+	}
+	else if (_isSub(BeaStruct)){
+
+		if ((strcmp(BeaStruct->Argument1.ArgMnemonic, "esp ") == 0)){
+			// "sub esp, ???"
+			moveStackpointerBack(BeaStruct->Instruction.Immediat / REGISTER_SIZE);
+		}
+
+	}
+	else if (_isAdd(BeaStruct)){
+
+		if ((strcmp(BeaStruct->Argument1.ArgMnemonic, "esp ") == 0)){
+			// "add esp, ???"
+			moveStackpointerBack(BeaStruct->Instruction.Immediat / -REGISTER_SIZE);
+		}
+
+	}
+	else{
+		// "00401301: mov dword ptr ss:[esp+04h], 0040400Eh"
+		if ((BeaStruct->Argument1.AccessMode == WRITE)
+			&& (BeaStruct->Argument1.ArgType & MEMORY_TYPE)
+			&& (BeaStruct->Argument1.Memory.BaseRegister & REG4)
+			&& (BeaStruct->Argument1.SegmentReg & SSReg)
+			)  {
+			int offset = BeaStruct->Argument1.Memory.Displacement;  // --> 04h
+			duint addr = BeaStruct->VirtualAddr;                    // --> 00401301
+
+			modifyFrom(offset / REGISTER_SIZE, addr);
+
+
+
+		}
+	}
+
+
+
+}

src/StackEmulator.h

@@ -0,0 +1,41 @@
+/* plugin:   (StaticAnalysis) for x64dbg <http://www.x64dbg.com>
+ * author:   [email protected] <http://blog.traceflow.com>
+ * license:  GLPv3
+ */
+#pragma once
+#include "meta.h"
+
+/* since some compilers don't use "push" to change the stack for arguments (see MingGW)
+   we have to track all modifications to the stack for better analysis
+   therefore we emulate the stack by only storing the virtual address from the last write-access
+
+   -> advantage: we can track all modifications of the register for better placing of comments
+*/
+
+const unsigned int MAX_STACKSIZE = 50;
+
+#define STACK_ERROR -1
+
+class StackEmulator
+{
+	
+
+	duint mStack[MAX_STACKSIZE];
+	unsigned int mStackpointer;
+
+public:
+	StackEmulator(void);
+	~StackEmulator(void);
+
+	
+	void pushFrom(duint addr);
+	void popFrom(duint addr);
+	void modifyFrom(int relative_offset, duint addr);
+
+	void moveStackpointerBack(int offset);
+	unsigned int pointerByOffset(int offset) const;
+	duint lastAccessAtOffset(int offset) const;
+
+	void emulate(const DISASM* disasm);
+};
+

src/TitanEngine.h

@@ -0,0 +1,958 @@
+#ifndef TITANENGINE
+#define TITANENGINE
+
+#define TITCALL
+
+#if _MSC_VER > 1000
+#pragma once
+#endif
+
+#include <windows.h>
+
+#pragma pack(push, 1)
+
+// Global.Constant.Structure.Declaration:
+// Engine.External:
+const BYTE UE_STRUCT_PE32STRUCT = 1;
+const BYTE UE_STRUCT_PE64STRUCT = 2;
+const BYTE UE_STRUCT_PESTRUCT = 3;
+const BYTE UE_STRUCT_IMPORTENUMDATA = 4;
+const BYTE UE_STRUCT_THREAD_ITEM_DATA = 5;
+const BYTE UE_STRUCT_LIBRARY_ITEM_DATA = 6;
+const BYTE UE_STRUCT_LIBRARY_ITEM_DATAW = 7;
+const BYTE UE_STRUCT_PROCESS_ITEM_DATA = 8;
+const BYTE UE_STRUCT_HANDLERARRAY = 9;
+const BYTE UE_STRUCT_PLUGININFORMATION = 10;
+const BYTE UE_STRUCT_HOOK_ENTRY = 11;
+const BYTE UE_STRUCT_FILE_STATUS_INFO = 12;
+const BYTE UE_STRUCT_FILE_FIX_INFO = 13;
+
+const BYTE UE_ACCESS_READ = 0;
+const BYTE UE_ACCESS_WRITE = 1;
+const BYTE UE_ACCESS_ALL = 2;
+
+const BYTE UE_HIDE_PEBONLY = 0;
+const BYTE UE_HIDE_BASIC = 1;
+
+const BYTE UE_PLUGIN_CALL_REASON_PREDEBUG = 1;
+const BYTE UE_PLUGIN_CALL_REASON_EXCEPTION = 2;
+const BYTE UE_PLUGIN_CALL_REASON_POSTDEBUG = 3;
+const BYTE UE_PLUGIN_CALL_REASON_UNHANDLEDEXCEPTION = 4;
+
+const BYTE TEE_HOOK_NRM_JUMP = 1;
+const BYTE TEE_HOOK_NRM_CALL = 3;
+const BYTE TEE_HOOK_IAT = 5;
+
+const BYTE UE_ENGINE_ALOW_MODULE_LOADING = 1;
+const BYTE UE_ENGINE_AUTOFIX_FORWARDERS = 2;
+const BYTE UE_ENGINE_PASS_ALL_EXCEPTIONS = 3;
+const BYTE UE_ENGINE_NO_CONSOLE_WINDOW = 4;
+const BYTE UE_ENGINE_BACKUP_FOR_CRITICAL_FUNCTIONS = 5;
+const BYTE UE_ENGINE_CALL_PLUGIN_CALLBACK = 6;
+const BYTE UE_ENGINE_RESET_CUSTOM_HANDLER = 7;
+const BYTE UE_ENGINE_CALL_PLUGIN_DEBUG_CALLBACK = 8;
+const BYTE UE_ENGINE_SET_DEBUG_PRIVILEGE = 9;
+
+const BYTE UE_OPTION_REMOVEALL = 1;
+const BYTE UE_OPTION_DISABLEALL = 2;
+const BYTE UE_OPTION_REMOVEALLDISABLED = 3;
+const BYTE UE_OPTION_REMOVEALLENABLED = 4;
+
+const BYTE UE_STATIC_DECRYPTOR_XOR = 1;
+const BYTE UE_STATIC_DECRYPTOR_SUB = 2;
+const BYTE UE_STATIC_DECRYPTOR_ADD = 3;
+
+const BYTE UE_STATIC_DECRYPTOR_FOREWARD = 1;
+const BYTE UE_STATIC_DECRYPTOR_BACKWARD = 2;
+
+const BYTE UE_STATIC_KEY_SIZE_1 = 1;
+const BYTE UE_STATIC_KEY_SIZE_2 = 2;
+const BYTE UE_STATIC_KEY_SIZE_4 = 4;
+const BYTE UE_STATIC_KEY_SIZE_8 = 8;
+
+const BYTE UE_STATIC_APLIB = 1;
+const BYTE UE_STATIC_APLIB_DEPACK = 2;
+const BYTE UE_STATIC_LZMA = 3;
+
+const BYTE UE_STATIC_HASH_MD5 = 1;
+const BYTE UE_STATIC_HASH_SHA1 = 2;
+const BYTE UE_STATIC_HASH_CRC32 = 3;
+
+const DWORD UE_RESOURCE_LANGUAGE_ANY = -1;
+
+const BYTE UE_PE_OFFSET = 0;
+const BYTE UE_IMAGEBASE = 1;
+const BYTE UE_OEP = 2;
+const BYTE UE_SIZEOFIMAGE = 3;
+const BYTE UE_SIZEOFHEADERS = 4;
+const BYTE UE_SIZEOFOPTIONALHEADER = 5;
+const BYTE UE_SECTIONALIGNMENT = 6;
+const BYTE UE_IMPORTTABLEADDRESS = 7;
+const BYTE UE_IMPORTTABLESIZE = 8;
+const BYTE UE_RESOURCETABLEADDRESS = 9;
+const BYTE UE_RESOURCETABLESIZE = 10;
+const BYTE UE_EXPORTTABLEADDRESS = 11;
+const BYTE UE_EXPORTTABLESIZE = 12;
+const BYTE UE_TLSTABLEADDRESS = 13;
+const BYTE UE_TLSTABLESIZE = 14;
+const BYTE UE_RELOCATIONTABLEADDRESS = 15;
+const BYTE UE_RELOCATIONTABLESIZE = 16;
+const BYTE UE_TIMEDATESTAMP = 17;
+const BYTE UE_SECTIONNUMBER = 18;
+const BYTE UE_CHECKSUM = 19;
+const BYTE UE_SUBSYSTEM = 20;
+const BYTE UE_CHARACTERISTICS = 21;
+const BYTE UE_NUMBEROFRVAANDSIZES = 22;
+const BYTE UE_BASEOFCODE = 23;
+const BYTE UE_BASEOFDATA = 24;
+//leaving some enum space here for future additions
+const BYTE UE_SECTIONNAME = 40;
+const BYTE UE_SECTIONVIRTUALOFFSET = 41;
+const BYTE UE_SECTIONVIRTUALSIZE = 42;
+const BYTE UE_SECTIONRAWOFFSET = 43;
+const BYTE UE_SECTIONRAWSIZE = 44;
+const BYTE UE_SECTIONFLAGS = 45;
+
+const long UE_VANOTFOUND = -2;
+
+const BYTE UE_CH_BREAKPOINT = 1;
+const BYTE UE_CH_SINGLESTEP = 2;
+const BYTE UE_CH_ACCESSVIOLATION = 3;
+const BYTE UE_CH_ILLEGALINSTRUCTION = 4;
+const BYTE UE_CH_NONCONTINUABLEEXCEPTION = 5;
+const BYTE UE_CH_ARRAYBOUNDSEXCEPTION = 6;
+const BYTE UE_CH_FLOATDENORMALOPERAND = 7;
+const BYTE UE_CH_FLOATDEVIDEBYZERO = 8;
+const BYTE UE_CH_INTEGERDEVIDEBYZERO = 9;
+const BYTE UE_CH_INTEGEROVERFLOW = 10;
+const BYTE UE_CH_PRIVILEGEDINSTRUCTION = 11;
+const BYTE UE_CH_PAGEGUARD = 12;
+const BYTE UE_CH_EVERYTHINGELSE = 13;
+const BYTE UE_CH_CREATETHREAD = 14;
+const BYTE UE_CH_EXITTHREAD = 15;
+const BYTE UE_CH_CREATEPROCESS = 16;
+const BYTE UE_CH_EXITPROCESS = 17;
+const BYTE UE_CH_LOADDLL = 18;
+const BYTE UE_CH_UNLOADDLL = 19;
+const BYTE UE_CH_OUTPUTDEBUGSTRING = 20;
+const BYTE UE_CH_AFTEREXCEPTIONPROCESSING = 21;
+const BYTE UE_CH_SYSTEMBREAKPOINT = 23;
+const BYTE UE_CH_UNHANDLEDEXCEPTION = 24;
+const BYTE UE_CH_RIPEVENT = 25;
+const BYTE UE_CH_DEBUGEVENT = 26;
+
+const BYTE UE_OPTION_HANDLER_RETURN_HANDLECOUNT = 1;
+const BYTE UE_OPTION_HANDLER_RETURN_ACCESS = 2;
+const BYTE UE_OPTION_HANDLER_RETURN_FLAGS = 3;
+const BYTE UE_OPTION_HANDLER_RETURN_TYPENAME = 4;
+
+const BYTE UE_BREAKPOINT_INT3 = 1;
+const BYTE UE_BREAKPOINT_LONG_INT3 = 2;
+const BYTE UE_BREAKPOINT_UD2 = 3;
+
+const BYTE UE_BPXREMOVED = 0;
+const BYTE UE_BPXACTIVE = 1;
+const BYTE UE_BPXINACTIVE = 2;
+
+const BYTE UE_BREAKPOINT = 0;
+const BYTE UE_SINGLESHOOT = 1;
+const BYTE UE_HARDWARE = 2;
+const BYTE UE_MEMORY = 3;
+const BYTE UE_MEMORY_READ = 4;
+const BYTE UE_MEMORY_WRITE = 5;
+const BYTE UE_MEMORY_EXECUTE = 6;
+const DWORD UE_BREAKPOINT_TYPE_INT3 = 0x10000000;
+const DWORD UE_BREAKPOINT_TYPE_LONG_INT3 = 0x20000000;
+const DWORD UE_BREAKPOINT_TYPE_UD2 = 0x30000000;
+
+const BYTE UE_HARDWARE_EXECUTE = 4;
+const BYTE UE_HARDWARE_WRITE = 5;
+const BYTE UE_HARDWARE_READWRITE = 6;
+
+const BYTE UE_HARDWARE_SIZE_1 = 7;
+const BYTE UE_HARDWARE_SIZE_2 = 8;
+const BYTE UE_HARDWARE_SIZE_4 = 9;
+const BYTE UE_HARDWARE_SIZE_8 = 10;
+
+const BYTE UE_ON_LIB_LOAD = 1;
+const BYTE UE_ON_LIB_UNLOAD = 2;
+const BYTE UE_ON_LIB_ALL = 3;
+
+const BYTE UE_APISTART = 0;
+const BYTE UE_APIEND = 1;
+
+const BYTE UE_PLATFORM_x86 = 1;
+const BYTE UE_PLATFORM_x64 = 2;
+const BYTE UE_PLATFORM_ALL = 3;
+
+const BYTE UE_FUNCTION_STDCALL = 1;
+const BYTE UE_FUNCTION_CCALL = 2;
+const BYTE UE_FUNCTION_FASTCALL = 3;
+const BYTE UE_FUNCTION_STDCALL_RET = 4;
+const BYTE UE_FUNCTION_CCALL_RET = 5;
+const BYTE UE_FUNCTION_FASTCALL_RET = 6;
+const BYTE UE_FUNCTION_STDCALL_CALL = 7;
+const BYTE UE_FUNCTION_CCALL_CALL = 8;
+const BYTE UE_FUNCTION_FASTCALL_CALL = 9;
+const BYTE UE_PARAMETER_BYTE = 0;
+const BYTE UE_PARAMETER_WORD = 1;
+const BYTE UE_PARAMETER_DWORD = 2;
+const BYTE UE_PARAMETER_QWORD = 3;
+const BYTE UE_PARAMETER_PTR_BYTE = 4;
+const BYTE UE_PARAMETER_PTR_WORD = 5;
+const BYTE UE_PARAMETER_PTR_DWORD = 6;
+const BYTE UE_PARAMETER_PTR_QWORD = 7;
+const BYTE UE_PARAMETER_STRING = 8;
+const BYTE UE_PARAMETER_UNICODE = 9;
+
+const BYTE UE_EAX = 1;
+const BYTE UE_EBX = 2;
+const BYTE UE_ECX = 3;
+const BYTE UE_EDX = 4;
+const BYTE UE_EDI = 5;
+const BYTE UE_ESI = 6;
+const BYTE UE_EBP = 7;
+const BYTE UE_ESP = 8;
+const BYTE UE_EIP = 9;
+const BYTE UE_EFLAGS = 10;
+const BYTE UE_DR0 = 11;
+const BYTE UE_DR1 = 12;
+const BYTE UE_DR2 = 13;
+const BYTE UE_DR3 = 14;
+const BYTE UE_DR6 = 15;
+const BYTE UE_DR7 = 16;
+const BYTE UE_RAX = 17;
+const BYTE UE_RBX = 18;
+const BYTE UE_RCX = 19;
+const BYTE UE_RDX = 20;
+const BYTE UE_RDI = 21;
+const BYTE UE_RSI = 22;
+const BYTE UE_RBP = 23;
+const BYTE UE_RSP = 24;
+const BYTE UE_RIP = 25;
+const BYTE UE_RFLAGS = 26;
+const BYTE UE_R8 = 27;
+const BYTE UE_R9 = 28;
+const BYTE UE_R10 = 29;
+const BYTE UE_R11 = 30;
+const BYTE UE_R12 = 31;
+const BYTE UE_R13 = 32;
+const BYTE UE_R14 = 33;
+const BYTE UE_R15 = 34;
+const BYTE UE_CIP = 35;
+const BYTE UE_CSP = 36;
+#ifdef _WIN64
+const BYTE UE_CFLAGS = UE_RFLAGS;
+#else
+const BYTE UE_CFLAGS = UE_EFLAGS;
+#endif
+const BYTE UE_SEG_GS = 37;
+const BYTE UE_SEG_FS = 38;
+const BYTE UE_SEG_ES = 39;
+const BYTE UE_SEG_DS = 40;
+const BYTE UE_SEG_CS = 41;
+const BYTE UE_SEG_SS = 42;
+
+typedef struct
+{
+	DWORD PE32Offset;
+	DWORD ImageBase;
+	DWORD OriginalEntryPoint;
+	DWORD BaseOfCode;
+	DWORD BaseOfData;
+	DWORD NtSizeOfImage;
+	DWORD NtSizeOfHeaders;
+	WORD SizeOfOptionalHeaders;
+	DWORD FileAlignment;
+	DWORD SectionAligment;
+	DWORD ImportTableAddress;
+	DWORD ImportTableSize;
+	DWORD ResourceTableAddress;
+	DWORD ResourceTableSize;
+	DWORD ExportTableAddress;
+	DWORD ExportTableSize;
+	DWORD TLSTableAddress;
+	DWORD TLSTableSize;
+	DWORD RelocationTableAddress;
+	DWORD RelocationTableSize;
+	DWORD TimeDateStamp;
+	WORD SectionNumber;
+	DWORD CheckSum;
+	WORD SubSystem;
+	WORD Characteristics;
+	DWORD NumberOfRvaAndSizes;
+} PE32Struct, *PPE32Struct;
+
+typedef struct
+{
+	DWORD PE64Offset;
+	DWORD64 ImageBase;
+	DWORD OriginalEntryPoint;
+	DWORD BaseOfCode;
+	DWORD BaseOfData;
+	DWORD NtSizeOfImage;
+	DWORD NtSizeOfHeaders;
+	WORD SizeOfOptionalHeaders;
+	DWORD FileAlignment;
+	DWORD SectionAligment;
+	DWORD ImportTableAddress;
+	DWORD ImportTableSize;
+	DWORD ResourceTableAddress;
+	DWORD ResourceTableSize;
+	DWORD ExportTableAddress;
+	DWORD ExportTableSize;
+	DWORD TLSTableAddress;
+	DWORD TLSTableSize;
+	DWORD RelocationTableAddress;
+	DWORD RelocationTableSize;
+	DWORD TimeDateStamp;
+	WORD SectionNumber;
+	DWORD CheckSum;
+	WORD SubSystem;
+	WORD Characteristics;
+	DWORD NumberOfRvaAndSizes;
+} PE64Struct, *PPE64Struct;
+
+#if defined(_WIN64)
+typedef PE64Struct PEStruct;
+#else
+typedef PE32Struct PEStruct;
+#endif
+
+typedef struct
+{
+	bool NewDll;
+	int NumberOfImports;
+	ULONG_PTR ImageBase;
+	ULONG_PTR BaseImportThunk;
+	ULONG_PTR ImportThunk;
+	char* APIName;
+	char* DLLName;
+} ImportEnumData, *PImportEnumData;
+
+typedef struct
+{
+	HANDLE hThread;
+	DWORD dwThreadId;
+	void* ThreadStartAddress;
+	void* ThreadLocalBase;
+	void* TebAddress;
+	ULONG WaitTime;
+	LONG Priority;
+	LONG BasePriority;
+	ULONG ContextSwitches;
+	ULONG ThreadState;
+	ULONG WaitReason;
+} THREAD_ITEM_DATA, *PTHREAD_ITEM_DATA;
+
+typedef struct
+{
+	HANDLE hFile;
+	void* BaseOfDll;
+	HANDLE hFileMapping;
+	void* hFileMappingView;
+	char szLibraryPath[MAX_PATH];
+	char szLibraryName[MAX_PATH];
+} LIBRARY_ITEM_DATA, *PLIBRARY_ITEM_DATA;
+
+typedef struct
+{
+	HANDLE hFile;
+	void* BaseOfDll;
+	HANDLE hFileMapping;
+	void* hFileMappingView;
+	wchar_t szLibraryPath[MAX_PATH];
+	wchar_t szLibraryName[MAX_PATH];
+} LIBRARY_ITEM_DATAW, *PLIBRARY_ITEM_DATAW;
+
+typedef struct
+{
+	HANDLE hProcess;
+	DWORD dwProcessId;
+	HANDLE hThread;
+	DWORD dwThreadId;
+	HANDLE hFile;
+	void* BaseOfImage;
+	void* ThreadStartAddress;
+	void* ThreadLocalBase;
+} PROCESS_ITEM_DATA, *PPROCESS_ITEM_DATA;
+
+typedef struct
+{
+	ULONG ProcessId;
+	HANDLE hHandle;
+} HandlerArray, *PHandlerArray;
+
+typedef struct
+{
+	char PluginName[64];
+	DWORD PluginMajorVersion;
+	DWORD PluginMinorVersion;
+	HMODULE PluginBaseAddress;
+	void* TitanDebuggingCallBack;
+	void* TitanRegisterPlugin;
+	void* TitanReleasePlugin;
+	void* TitanResetPlugin;
+	bool PluginDisabled;
+} PluginInformation, *PPluginInformation;
+
+const size_t TEE_MAXIMUM_HOOK_SIZE = 14;
+const size_t TEE_MAXIMUM_HOOK_RELOCS = 7;
+#if defined(_WIN64)
+const size_t TEE_MAXIMUM_HOOK_INSERT_SIZE = 14;
+#else
+const size_t TEE_MAXIMUM_HOOK_INSERT_SIZE = 5;
+#endif
+
+typedef struct HOOK_ENTRY
+{
+	bool IATHook;
+	BYTE HookType;
+	DWORD HookSize;
+	void* HookAddress;
+	void* RedirectionAddress;
+	BYTE HookBytes[TEE_MAXIMUM_HOOK_SIZE];
+	BYTE OriginalBytes[TEE_MAXIMUM_HOOK_SIZE];
+	void* IATHookModuleBase;
+	DWORD IATHookNameHash;
+	bool HookIsEnabled;
+	bool HookIsRemote;
+	void* PatchedEntry;
+	DWORD RelocationInfo[TEE_MAXIMUM_HOOK_RELOCS];
+	int RelocationCount;
+} HOOK_ENTRY, *PHOOK_ENTRY;
+
+const BYTE UE_DEPTH_SURFACE = 0;
+const BYTE UE_DEPTH_DEEP = 1;
+
+const BYTE UE_UNPACKER_CONDITION_SEARCH_FROM_EP = 1;
+
+const BYTE UE_UNPACKER_CONDITION_LOADLIBRARY = 1;
+const BYTE UE_UNPACKER_CONDITION_GETPROCADDRESS = 2;
+const BYTE UE_UNPACKER_CONDITION_ENTRYPOINTBREAK = 3;
+const BYTE UE_UNPACKER_CONDITION_RELOCSNAPSHOT1 = 4;
+const BYTE UE_UNPACKER_CONDITION_RELOCSNAPSHOT2 = 5;
+
+const BYTE UE_FIELD_OK = 0;
+const BYTE UE_FIELD_BROKEN_NON_FIXABLE = 1;
+const BYTE UE_FIELD_BROKEN_NON_CRITICAL = 2;
+const BYTE UE_FIELD_BROKEN_FIXABLE_FOR_STATIC_USE = 3;
+const BYTE UE_FIELD_BROKEN_BUT_CAN_BE_EMULATED = 4;
+const BYTE UE_FIELD_FIXABLE_NON_CRITICAL = 5;
+const BYTE UE_FIELD_FIXABLE_CRITICAL = 6;
+const BYTE UE_FIELD_NOT_PRESET = 7;
+const BYTE UE_FIELD_NOT_PRESET_WARNING = 8;
+
+const BYTE UE_RESULT_FILE_OK = 10;
+const BYTE UE_RESULT_FILE_INVALID_BUT_FIXABLE = 11;
+const BYTE UE_RESULT_FILE_INVALID_AND_NON_FIXABLE = 12;
+const BYTE UE_RESULT_FILE_INVALID_FORMAT = 13;
+
+typedef struct
+{
+	BYTE OveralEvaluation;
+	bool EvaluationTerminatedByException;
+	bool FileIs64Bit;
+	bool FileIsDLL;
+	bool FileIsConsole;
+	bool MissingDependencies;
+	bool MissingDeclaredAPIs;
+	BYTE SignatureMZ;
+	BYTE SignaturePE;
+	BYTE EntryPoint;
+	BYTE ImageBase;
+	BYTE SizeOfImage;
+	BYTE FileAlignment;
+	BYTE SectionAlignment;
+	BYTE ExportTable;
+	BYTE RelocationTable;
+	BYTE ImportTable;
+	BYTE ImportTableSection;
+	BYTE ImportTableData;
+	BYTE IATTable;
+	BYTE TLSTable;
+	BYTE LoadConfigTable;
+	BYTE BoundImportTable;
+	BYTE COMHeaderTable;
+	BYTE ResourceTable;
+	BYTE ResourceData;
+	BYTE SectionTable;
+} FILE_STATUS_INFO, *PFILE_STATUS_INFO;
+
+typedef struct
+{
+	BYTE OveralEvaluation;
+	bool FixingTerminatedByException;
+	bool FileFixPerformed;
+	bool StrippedRelocation;
+	bool DontFixRelocations;
+	DWORD OriginalRelocationTableAddress;
+	DWORD OriginalRelocationTableSize;
+	bool StrippedExports;
+	bool DontFixExports;
+	DWORD OriginalExportTableAddress;
+	DWORD OriginalExportTableSize;
+	bool StrippedResources;
+	bool DontFixResources;
+	DWORD OriginalResourceTableAddress;
+	DWORD OriginalResourceTableSize;
+	bool StrippedTLS;
+	bool DontFixTLS;
+	DWORD OriginalTLSTableAddress;
+	DWORD OriginalTLSTableSize;
+	bool StrippedLoadConfig;
+	bool DontFixLoadConfig;
+	DWORD OriginalLoadConfigTableAddress;
+	DWORD OriginalLoadConfigTableSize;
+	bool StrippedBoundImports;
+	bool DontFixBoundImports;
+	DWORD OriginalBoundImportTableAddress;
+	DWORD OriginalBoundImportTableSize;
+	bool StrippedIAT;
+	bool DontFixIAT;
+	DWORD OriginalImportAddressTableAddress;
+	DWORD OriginalImportAddressTableSize;
+	bool StrippedCOM;
+	bool DontFixCOM;
+	DWORD OriginalCOMTableAddress;
+	DWORD OriginalCOMTableSize;
+} FILE_FIX_INFO, *PFILE_FIX_INFO;
+
+#ifdef __cplusplus
+extern "C" {
+#endif /*__cplusplus*/
+
+	// Global.Function.Declaration:
+	// TitanEngine.Dumper.functions:
+	__declspec(dllimport) bool TITCALL DumpProcess(HANDLE hProcess, LPVOID ImageBase, char* szDumpFileName, ULONG_PTR EntryPoint);
+	__declspec(dllimport) bool TITCALL DumpProcessW(HANDLE hProcess, LPVOID ImageBase, wchar_t* szDumpFileName, ULONG_PTR EntryPoint);
+	__declspec(dllimport) bool TITCALL DumpProcessEx(DWORD ProcessId, LPVOID ImageBase, char* szDumpFileName, ULONG_PTR EntryPoint);
+	__declspec(dllimport) bool TITCALL DumpProcessExW(DWORD ProcessId, LPVOID ImageBase, wchar_t* szDumpFileName, ULONG_PTR EntryPoint);
+	__declspec(dllimport) bool TITCALL DumpMemory(HANDLE hProcess, LPVOID MemoryStart, ULONG_PTR MemorySize, char* szDumpFileName);
+	__declspec(dllimport) bool TITCALL DumpMemoryW(HANDLE hProcess, LPVOID MemoryStart, ULONG_PTR MemorySize, wchar_t* szDumpFileName);
+	__declspec(dllimport) bool TITCALL DumpMemoryEx(DWORD ProcessId, LPVOID MemoryStart, ULONG_PTR MemorySize, char* szDumpFileName);
+	__declspec(dllimport) bool TITCALL DumpMemoryExW(DWORD ProcessId, LPVOID MemoryStart, ULONG_PTR MemorySize, wchar_t* szDumpFileName);
+	__declspec(dllimport) bool TITCALL DumpRegions(HANDLE hProcess, char* szDumpFolder, bool DumpAboveImageBaseOnly);
+	__declspec(dllimport) bool TITCALL DumpRegionsW(HANDLE hProcess, wchar_t* szDumpFolder, bool DumpAboveImageBaseOnly);
+	__declspec(dllimport) bool TITCALL DumpRegionsEx(DWORD ProcessId, char* szDumpFolder, bool DumpAboveImageBaseOnly);
+	__declspec(dllimport) bool TITCALL DumpRegionsExW(DWORD ProcessId, wchar_t* szDumpFolder, bool DumpAboveImageBaseOnly);
+	__declspec(dllimport) bool TITCALL DumpModule(HANDLE hProcess, LPVOID ModuleBase, char* szDumpFileName);
+	__declspec(dllimport) bool TITCALL DumpModuleW(HANDLE hProcess, LPVOID ModuleBase, wchar_t* szDumpFileName);
+	__declspec(dllimport) bool TITCALL DumpModuleEx(DWORD ProcessId, LPVOID ModuleBase, char* szDumpFileName);
+	__declspec(dllimport) bool TITCALL DumpModuleExW(DWORD ProcessId, LPVOID ModuleBase, wchar_t* szDumpFileName);
+	__declspec(dllimport) bool TITCALL PastePEHeader(HANDLE hProcess, LPVOID ImageBase, char* szDebuggedFileName);
+	__declspec(dllimport) bool TITCALL PastePEHeaderW(HANDLE hProcess, LPVOID ImageBase, wchar_t* szDebuggedFileName);
+	__declspec(dllimport) bool TITCALL ExtractSection(char* szFileName, char* szDumpFileName, DWORD SectionNumber);
+	__declspec(dllimport) bool TITCALL ExtractSectionW(wchar_t* szFileName, wchar_t* szDumpFileName, DWORD SectionNumber);
+	__declspec(dllimport) bool TITCALL ResortFileSections(char* szFileName);
+	__declspec(dllimport) bool TITCALL ResortFileSectionsW(wchar_t* szFileName);
+	__declspec(dllimport) bool TITCALL FindOverlay(char* szFileName, LPDWORD OverlayStart, LPDWORD OverlaySize);
+	__declspec(dllimport) bool TITCALL FindOverlayW(wchar_t* szFileName, LPDWORD OverlayStart, LPDWORD OverlaySize);
+	__declspec(dllimport) bool TITCALL ExtractOverlay(char* szFileName, char* szExtractedFileName);
+	__declspec(dllimport) bool TITCALL ExtractOverlayW(wchar_t* szFileName, wchar_t* szExtractedFileName);
+	__declspec(dllimport) bool TITCALL AddOverlay(char* szFileName, char* szOverlayFileName);
+	__declspec(dllimport) bool TITCALL AddOverlayW(wchar_t* szFileName, wchar_t* szOverlayFileName);
+	__declspec(dllimport) bool TITCALL CopyOverlay(char* szInFileName, char* szOutFileName);
+	__declspec(dllimport) bool TITCALL CopyOverlayW(wchar_t* szInFileName, wchar_t* szOutFileName);
+	__declspec(dllimport) bool TITCALL RemoveOverlay(char* szFileName);
+	__declspec(dllimport) bool TITCALL RemoveOverlayW(wchar_t* szFileName);
+	__declspec(dllimport) bool TITCALL MakeAllSectionsRWE(char* szFileName);
+	__declspec(dllimport) bool TITCALL MakeAllSectionsRWEW(wchar_t* szFileName);
+	__declspec(dllimport) long TITCALL AddNewSectionEx(char* szFileName, char* szSectionName, DWORD SectionSize, DWORD SectionAttributes, LPVOID SectionContent, DWORD ContentSize);
+	__declspec(dllimport) long TITCALL AddNewSectionExW(wchar_t* szFileName, char* szSectionName, DWORD SectionSize, DWORD SectionAttributes, LPVOID SectionContent, DWORD ContentSize);
+	__declspec(dllimport) long TITCALL AddNewSection(char* szFileName, char* szSectionName, DWORD SectionSize);
+	__declspec(dllimport) long TITCALL AddNewSectionW(wchar_t* szFileName, char* szSectionName, DWORD SectionSize);
+	__declspec(dllimport) bool TITCALL ResizeLastSection(char* szFileName, DWORD NumberOfExpandBytes, bool AlignResizeData);
+	__declspec(dllimport) bool TITCALL ResizeLastSectionW(wchar_t* szFileName, DWORD NumberOfExpandBytes, bool AlignResizeData);
+	__declspec(dllimport) void TITCALL SetSharedOverlay(char* szFileName);
+	__declspec(dllimport) void TITCALL SetSharedOverlayW(wchar_t* szFileName);
+	__declspec(dllimport) char* TITCALL GetSharedOverlay();
+	__declspec(dllimport) wchar_t* TITCALL GetSharedOverlayW();
+	__declspec(dllimport) bool TITCALL DeleteLastSection(char* szFileName);
+	__declspec(dllimport) bool TITCALL DeleteLastSectionW(wchar_t* szFileName);
+	__declspec(dllimport) bool TITCALL DeleteLastSectionEx(char* szFileName, DWORD NumberOfSections);
+	__declspec(dllimport) bool TITCALL DeleteLastSectionExW(wchar_t* szFileName, DWORD NumberOfSections);
+	__declspec(dllimport) ULONG_PTR TITCALL GetPE32DataFromMappedFile(ULONG_PTR FileMapVA, DWORD WhichSection, DWORD WhichData);
+	__declspec(dllimport) ULONG_PTR TITCALL GetPE32Data(char* szFileName, DWORD WhichSection, DWORD WhichData);
+	__declspec(dllimport) ULONG_PTR TITCALL GetPE32DataW(wchar_t* szFileName, DWORD WhichSection, DWORD WhichData);
+	__declspec(dllimport) bool TITCALL GetPE32DataFromMappedFileEx(ULONG_PTR FileMapVA, LPVOID DataStorage);
+	__declspec(dllimport) bool TITCALL GetPE32DataEx(char* szFileName, LPVOID DataStorage);
+	__declspec(dllimport) bool TITCALL GetPE32DataExW(wchar_t* szFileName, LPVOID DataStorage);
+	__declspec(dllimport) bool TITCALL SetPE32DataForMappedFile(ULONG_PTR FileMapVA, DWORD WhichSection, DWORD WhichData, ULONG_PTR NewDataValue);
+	__declspec(dllimport) bool TITCALL SetPE32Data(char* szFileName, DWORD WhichSection, DWORD WhichData, ULONG_PTR NewDataValue);
+	__declspec(dllimport) bool TITCALL SetPE32DataW(wchar_t* szFileName, DWORD WhichSection, DWORD WhichData, ULONG_PTR NewDataValue);
+	__declspec(dllimport) bool TITCALL SetPE32DataForMappedFileEx(ULONG_PTR FileMapVA, LPVOID DataStorage);
+	__declspec(dllimport) bool TITCALL SetPE32DataEx(char* szFileName, LPVOID DataStorage);
+	__declspec(dllimport) bool TITCALL SetPE32DataExW(wchar_t* szFileName, LPVOID DataStorage);
+	__declspec(dllimport) long TITCALL GetPE32SectionNumberFromVA(ULONG_PTR FileMapVA, ULONG_PTR AddressToConvert);
+	__declspec(dllimport) ULONG_PTR TITCALL ConvertVAtoFileOffset(ULONG_PTR FileMapVA, ULONG_PTR AddressToConvert, bool ReturnType);
+	__declspec(dllimport) ULONG_PTR TITCALL ConvertVAtoFileOffsetEx(ULONG_PTR FileMapVA, DWORD FileSize, ULONG_PTR ImageBase, ULONG_PTR AddressToConvert, bool AddressIsRVA, bool ReturnType);
+	__declspec(dllimport) ULONG_PTR TITCALL ConvertFileOffsetToVA(ULONG_PTR FileMapVA, ULONG_PTR AddressToConvert, bool ReturnType);
+	__declspec(dllimport) ULONG_PTR TITCALL ConvertFileOffsetToVAEx(ULONG_PTR FileMapVA, DWORD FileSize, ULONG_PTR ImageBase, ULONG_PTR AddressToConvert, bool ReturnType);
+	__declspec(dllimport) bool TITCALL MemoryReadSafe(HANDLE hProcess, LPVOID lpBaseAddress, LPVOID lpBuffer, SIZE_T nSize, SIZE_T * lpNumberOfBytesRead);
+	__declspec(dllimport) bool TITCALL MemoryWriteSafe(HANDLE hProcess, LPVOID lpBaseAddress, LPCVOID lpBuffer, SIZE_T nSize, SIZE_T * lpNumberOfBytesWritten);
+	// TitanEngine.Realigner.functions:
+	__declspec(dllimport) bool TITCALL FixHeaderCheckSum(char* szFileName);
+	__declspec(dllimport) bool TITCALL FixHeaderCheckSumW(wchar_t* szFileName);
+	__declspec(dllimport) long TITCALL RealignPE(ULONG_PTR FileMapVA, DWORD FileSize, DWORD RealingMode);
+	__declspec(dllimport) long TITCALL RealignPEEx(char* szFileName, DWORD RealingFileSize, DWORD ForcedFileAlignment);
+	__declspec(dllimport) long TITCALL RealignPEExW(wchar_t* szFileName, DWORD RealingFileSize, DWORD ForcedFileAlignment);
+	__declspec(dllimport) bool TITCALL WipeSection(char* szFileName, int WipeSectionNumber, bool RemovePhysically);
+	__declspec(dllimport) bool TITCALL WipeSectionW(wchar_t* szFileName, int WipeSectionNumber, bool RemovePhysically);
+	__declspec(dllimport) bool TITCALL IsPE32FileValidEx(char* szFileName, DWORD CheckDepth, LPVOID FileStatusInfo);
+	__declspec(dllimport) bool TITCALL IsPE32FileValidExW(wchar_t* szFileName, DWORD CheckDepth, LPVOID FileStatusInfo);
+	__declspec(dllimport) bool TITCALL FixBrokenPE32FileEx(char* szFileName, LPVOID FileStatusInfo, LPVOID FileFixInfo);
+	__declspec(dllimport) bool TITCALL FixBrokenPE32FileExW(wchar_t* szFileName, LPVOID FileStatusInfo, LPVOID FileFixInfo);
+	__declspec(dllimport) bool TITCALL IsFileDLL(char* szFileName, ULONG_PTR FileMapVA);
+	__declspec(dllimport) bool TITCALL IsFileDLLW(wchar_t* szFileName, ULONG_PTR FileMapVA);
+	// TitanEngine.Hider.functions:
+	__declspec(dllimport) void* TITCALL GetPEBLocation(HANDLE hProcess);
+	__declspec(dllimport) void* TITCALL GetPEBLocation64(HANDLE hProcess);
+	__declspec(dllimport) void* TITCALL GetTEBLocation(HANDLE hThread);
+	__declspec(dllimport) void* TITCALL GetTEBLocation64(HANDLE hThread);
+	__declspec(dllimport) bool TITCALL HideDebugger(HANDLE hProcess, DWORD PatchAPILevel);
+	__declspec(dllimport) bool TITCALL UnHideDebugger(HANDLE hProcess, DWORD PatchAPILevel);
+	// TitanEngine.Relocater.functions:
+	__declspec(dllimport) void TITCALL RelocaterCleanup();
+	__declspec(dllimport) void TITCALL RelocaterInit(DWORD MemorySize, ULONG_PTR OldImageBase, ULONG_PTR NewImageBase);
+	__declspec(dllimport) void TITCALL RelocaterAddNewRelocation(HANDLE hProcess, ULONG_PTR RelocateAddress, DWORD RelocateState);
+	__declspec(dllimport) long TITCALL RelocaterEstimatedSize();
+	__declspec(dllimport) bool TITCALL RelocaterExportRelocation(ULONG_PTR StorePlace, DWORD StorePlaceRVA, ULONG_PTR FileMapVA);
+	__declspec(dllimport) bool TITCALL RelocaterExportRelocationEx(char* szFileName, char* szSectionName);
+	__declspec(dllimport) bool TITCALL RelocaterExportRelocationExW(wchar_t* szFileName, char* szSectionName);
+	__declspec(dllimport) bool TITCALL RelocaterGrabRelocationTable(HANDLE hProcess, ULONG_PTR MemoryStart, DWORD MemorySize);
+	__declspec(dllimport) bool TITCALL RelocaterGrabRelocationTableEx(HANDLE hProcess, ULONG_PTR MemoryStart, ULONG_PTR MemorySize, DWORD NtSizeOfImage);
+	__declspec(dllimport) bool TITCALL RelocaterMakeSnapshot(HANDLE hProcess, char* szSaveFileName, LPVOID MemoryStart, ULONG_PTR MemorySize);
+	__declspec(dllimport) bool TITCALL RelocaterMakeSnapshotW(HANDLE hProcess, wchar_t* szSaveFileName, LPVOID MemoryStart, ULONG_PTR MemorySize);
+	__declspec(dllimport) bool TITCALL RelocaterCompareTwoSnapshots(HANDLE hProcess, ULONG_PTR LoadedImageBase, ULONG_PTR NtSizeOfImage, char* szDumpFile1, char* szDumpFile2, ULONG_PTR MemStart);
+	__declspec(dllimport) bool TITCALL RelocaterCompareTwoSnapshotsW(HANDLE hProcess, ULONG_PTR LoadedImageBase, ULONG_PTR NtSizeOfImage, wchar_t* szDumpFile1, wchar_t* szDumpFile2, ULONG_PTR MemStart);
+	__declspec(dllimport) bool TITCALL RelocaterChangeFileBase(char* szFileName, ULONG_PTR NewImageBase);
+	__declspec(dllimport) bool TITCALL RelocaterChangeFileBaseW(wchar_t* szFileName, ULONG_PTR NewImageBase);
+	__declspec(dllimport) bool TITCALL RelocaterRelocateMemoryBlock(ULONG_PTR FileMapVA, ULONG_PTR MemoryLocation, void* RelocateMemory, DWORD RelocateMemorySize, ULONG_PTR CurrentLoadedBase, ULONG_PTR RelocateBase);
+	__declspec(dllimport) bool TITCALL RelocaterWipeRelocationTable(char* szFileName);
+	__declspec(dllimport) bool TITCALL RelocaterWipeRelocationTableW(wchar_t* szFileName);
+	// TitanEngine.Resourcer.functions:
+	__declspec(dllimport) ULONG_PTR TITCALL ResourcerLoadFileForResourceUse(char* szFileName);
+	__declspec(dllimport) ULONG_PTR TITCALL ResourcerLoadFileForResourceUseW(wchar_t* szFileName);
+	__declspec(dllimport) bool TITCALL ResourcerFreeLoadedFile(LPVOID LoadedFileBase);
+	__declspec(dllimport) bool TITCALL ResourcerExtractResourceFromFileEx(ULONG_PTR FileMapVA, char* szResourceType, char* szResourceName, char* szExtractedFileName);
+	__declspec(dllimport) bool TITCALL ResourcerExtractResourceFromFile(char* szFileName, char* szResourceType, char* szResourceName, char* szExtractedFileName);
+	__declspec(dllimport) bool TITCALL ResourcerExtractResourceFromFileW(wchar_t* szFileName, char* szResourceType, char* szResourceName, char* szExtractedFileName);
+	__declspec(dllimport) bool TITCALL ResourcerFindResource(char* szFileName, char* szResourceType, DWORD ResourceType, char* szResourceName, DWORD ResourceName, DWORD ResourceLanguage, PULONG_PTR pResourceData, LPDWORD pResourceSize);
+	__declspec(dllimport) bool TITCALL ResourcerFindResourceW(wchar_t* szFileName, wchar_t* szResourceType, DWORD ResourceType, wchar_t* szResourceName, DWORD ResourceName, DWORD ResourceLanguage, PULONG_PTR pResourceData, LPDWORD pResourceSize);
+	__declspec(dllimport) bool TITCALL ResourcerFindResourceEx(ULONG_PTR FileMapVA, DWORD FileSize, wchar_t* szResourceType, DWORD ResourceType, wchar_t* szResourceName, DWORD ResourceName, DWORD ResourceLanguage, PULONG_PTR pResourceData, LPDWORD pResourceSize);
+	__declspec(dllimport) void TITCALL ResourcerEnumerateResource(char* szFileName, void* CallBack);
+	__declspec(dllimport) void TITCALL ResourcerEnumerateResourceW(wchar_t* szFileName, void* CallBack);
+	__declspec(dllimport) void TITCALL ResourcerEnumerateResourceEx(ULONG_PTR FileMapVA, DWORD FileSize, void* CallBack);
+	// TitanEngine.Threader.functions:
+	__declspec(dllimport) bool TITCALL ThreaderImportRunningThreadData(DWORD ProcessId);
+	__declspec(dllimport) void* TITCALL ThreaderGetThreadInfo(HANDLE hThread, DWORD ThreadId);
+	__declspec(dllimport) void TITCALL ThreaderEnumThreadInfo(void* EnumCallBack);
+	__declspec(dllimport) bool TITCALL ThreaderPauseThread(HANDLE hThread);
+	__declspec(dllimport) bool TITCALL ThreaderResumeThread(HANDLE hThread);
+	__declspec(dllimport) bool TITCALL ThreaderTerminateThread(HANDLE hThread, DWORD ThreadExitCode);
+	__declspec(dllimport) bool TITCALL ThreaderPauseAllThreads(bool LeaveMainRunning);
+	__declspec(dllimport) bool TITCALL ThreaderResumeAllThreads(bool LeaveMainPaused);
+	__declspec(dllimport) bool TITCALL ThreaderPauseProcess();
+	__declspec(dllimport) bool TITCALL ThreaderResumeProcess();
+	__declspec(dllimport) ULONG_PTR TITCALL ThreaderCreateRemoteThread(ULONG_PTR ThreadStartAddress, bool AutoCloseTheHandle, LPVOID ThreadPassParameter, LPDWORD ThreadId);
+	__declspec(dllimport) bool TITCALL ThreaderInjectAndExecuteCode(LPVOID InjectCode, DWORD StartDelta, DWORD InjectSize);
+	__declspec(dllimport) ULONG_PTR TITCALL ThreaderCreateRemoteThreadEx(HANDLE hProcess, ULONG_PTR ThreadStartAddress, bool AutoCloseTheHandle, LPVOID ThreadPassParameter, LPDWORD ThreadId);
+	__declspec(dllimport) bool TITCALL ThreaderInjectAndExecuteCodeEx(HANDLE hProcess, LPVOID InjectCode, DWORD StartDelta, DWORD InjectSize);
+	__declspec(dllimport) void TITCALL ThreaderSetCallBackForNextExitThreadEvent(LPVOID exitThreadCallBack);
+	__declspec(dllimport) bool TITCALL ThreaderIsThreadStillRunning(HANDLE hThread);
+	__declspec(dllimport) bool TITCALL ThreaderIsThreadActive(HANDLE hThread);
+	__declspec(dllimport) bool TITCALL ThreaderIsAnyThreadActive();
+	__declspec(dllimport) bool TITCALL ThreaderExecuteOnlyInjectedThreads();
+	__declspec(dllimport) ULONG_PTR TITCALL ThreaderGetOpenHandleForThread(DWORD ThreadId);
+	__declspec(dllimport) bool TITCALL ThreaderIsExceptionInMainThread();
+	// TitanEngine.Debugger.functions:
+	__declspec(dllimport) void* TITCALL StaticDisassembleEx(ULONG_PTR DisassmStart, LPVOID DisassmAddress);
+	__declspec(dllimport) void* TITCALL StaticDisassemble(LPVOID DisassmAddress);
+	__declspec(dllimport) void* TITCALL DisassembleEx(HANDLE hProcess, LPVOID DisassmAddress, bool ReturnInstructionType);
+	__declspec(dllimport) void* TITCALL Disassemble(LPVOID DisassmAddress);
+	__declspec(dllimport) long TITCALL StaticLengthDisassemble(LPVOID DisassmAddress);
+	__declspec(dllimport) long TITCALL LengthDisassembleEx(HANDLE hProcess, LPVOID DisassmAddress);
+	__declspec(dllimport) long TITCALL LengthDisassemble(LPVOID DisassmAddress);
+	__declspec(dllimport) void* TITCALL InitDebug(char* szFileName, char* szCommandLine, char* szCurrentFolder);
+	__declspec(dllimport) void* TITCALL InitDebugW(wchar_t* szFileName, wchar_t* szCommandLine, wchar_t* szCurrentFolder);
+	__declspec(dllimport) void* TITCALL InitDebugEx(char* szFileName, char* szCommandLine, char* szCurrentFolder, LPVOID EntryCallBack);
+	__declspec(dllimport) void* TITCALL InitDebugExW(wchar_t* szFileName, wchar_t* szCommandLine, wchar_t* szCurrentFolder, LPVOID EntryCallBack);
+	__declspec(dllimport) void* TITCALL InitDLLDebug(char* szFileName, bool ReserveModuleBase, char* szCommandLine, char* szCurrentFolder, LPVOID EntryCallBack);
+	__declspec(dllimport) void* TITCALL InitDLLDebugW(wchar_t* szFileName, bool ReserveModuleBase, wchar_t* szCommandLine, wchar_t* szCurrentFolder, LPVOID EntryCallBack);
+	__declspec(dllimport) bool TITCALL StopDebug();
+	__declspec(dllimport) void TITCALL SetBPXOptions(long DefaultBreakPointType);
+	__declspec(dllimport) bool TITCALL IsBPXEnabled(ULONG_PTR bpxAddress);
+	__declspec(dllimport) bool TITCALL EnableBPX(ULONG_PTR bpxAddress);
+	__declspec(dllimport) bool TITCALL DisableBPX(ULONG_PTR bpxAddress);
+	__declspec(dllimport) bool TITCALL SetBPX(ULONG_PTR bpxAddress, DWORD bpxType, LPVOID bpxCallBack);
+	__declspec(dllimport) bool TITCALL DeleteBPX(ULONG_PTR bpxAddress);
+	__declspec(dllimport) bool TITCALL SafeDeleteBPX(ULONG_PTR bpxAddress);
+	__declspec(dllimport) bool TITCALL SetAPIBreakPoint(const char* szDLLName, const char* szAPIName, DWORD bpxType, DWORD bpxPlace, LPVOID bpxCallBack);
+	__declspec(dllimport) bool TITCALL DeleteAPIBreakPoint(const char* szDLLName, const char* szAPIName, DWORD bpxPlace);
+	__declspec(dllimport) bool TITCALL SafeDeleteAPIBreakPoint(const char* szDLLName, const char* szAPIName, DWORD bpxPlace);
+	__declspec(dllimport) bool TITCALL SetMemoryBPX(ULONG_PTR MemoryStart, SIZE_T SizeOfMemory, LPVOID bpxCallBack);
+	__declspec(dllimport) bool TITCALL SetMemoryBPXEx(ULONG_PTR MemoryStart, SIZE_T SizeOfMemory, DWORD BreakPointType, bool RestoreOnHit, LPVOID bpxCallBack);
+	__declspec(dllimport) bool TITCALL RemoveMemoryBPX(ULONG_PTR MemoryStart, SIZE_T SizeOfMemory);
+	__declspec(dllimport) bool TITCALL GetContextFPUDataEx(HANDLE hActiveThread, void* FPUSaveArea);
+	__declspec(dllimport) ULONG_PTR TITCALL GetContextDataEx(HANDLE hActiveThread, DWORD IndexOfRegister);
+	__declspec(dllimport) ULONG_PTR TITCALL GetContextData(DWORD IndexOfRegister);
+	__declspec(dllimport) bool TITCALL SetContextFPUDataEx(HANDLE hActiveThread, void* FPUSaveArea);
+	__declspec(dllimport) bool TITCALL SetContextDataEx(HANDLE hActiveThread, DWORD IndexOfRegister, ULONG_PTR NewRegisterValue);
+	__declspec(dllimport) bool TITCALL SetContextData(DWORD IndexOfRegister, ULONG_PTR NewRegisterValue);
+	__declspec(dllimport) void TITCALL ClearExceptionNumber();
+	__declspec(dllimport) long TITCALL CurrentExceptionNumber();
+	__declspec(dllimport) bool TITCALL MatchPatternEx(HANDLE hProcess, void* MemoryToCheck, int SizeOfMemoryToCheck, void* PatternToMatch, int SizeOfPatternToMatch, PBYTE WildCard);
+	__declspec(dllimport) bool TITCALL MatchPattern(void* MemoryToCheck, int SizeOfMemoryToCheck, void* PatternToMatch, int SizeOfPatternToMatch, PBYTE WildCard);
+	__declspec(dllimport) ULONG_PTR TITCALL FindEx(HANDLE hProcess, LPVOID MemoryStart, DWORD MemorySize, LPVOID SearchPattern, DWORD PatternSize, LPBYTE WildCard);
+	__declspec(dllimport) ULONG_PTR TITCALL Find(LPVOID MemoryStart, DWORD MemorySize, LPVOID SearchPattern, DWORD PatternSize, LPBYTE WildCard);
+	__declspec(dllimport) bool TITCALL FillEx(HANDLE hProcess, LPVOID MemoryStart, DWORD MemorySize, PBYTE FillByte);
+	__declspec(dllimport) bool TITCALL Fill(LPVOID MemoryStart, DWORD MemorySize, PBYTE FillByte);
+	__declspec(dllimport) bool TITCALL PatchEx(HANDLE hProcess, LPVOID MemoryStart, DWORD MemorySize, LPVOID ReplacePattern, DWORD ReplaceSize, bool AppendNOP, bool PrependNOP);
+	__declspec(dllimport) bool TITCALL Patch(LPVOID MemoryStart, DWORD MemorySize, LPVOID ReplacePattern, DWORD ReplaceSize, bool AppendNOP, bool PrependNOP);
+	__declspec(dllimport) bool TITCALL ReplaceEx(HANDLE hProcess, LPVOID MemoryStart, DWORD MemorySize, LPVOID SearchPattern, DWORD PatternSize, DWORD NumberOfRepetitions, LPVOID ReplacePattern, DWORD ReplaceSize, PBYTE WildCard);
+	__declspec(dllimport) bool TITCALL Replace(LPVOID MemoryStart, DWORD MemorySize, LPVOID SearchPattern, DWORD PatternSize, DWORD NumberOfRepetitions, LPVOID ReplacePattern, DWORD ReplaceSize, PBYTE WildCard);
+	__declspec(dllimport) void* TITCALL GetDebugData();
+	__declspec(dllimport) void* TITCALL GetTerminationData();
+	__declspec(dllimport) long TITCALL GetExitCode();
+	__declspec(dllimport) ULONG_PTR TITCALL GetDebuggedDLLBaseAddress();
+	__declspec(dllimport) ULONG_PTR TITCALL GetDebuggedFileBaseAddress();
+	__declspec(dllimport) bool TITCALL GetRemoteString(HANDLE hProcess, LPVOID StringAddress, LPVOID StringStorage, int MaximumStringSize);
+	__declspec(dllimport) ULONG_PTR TITCALL GetFunctionParameter(HANDLE hProcess, DWORD FunctionType, DWORD ParameterNumber, DWORD ParameterType);
+	__declspec(dllimport) ULONG_PTR TITCALL GetJumpDestinationEx(HANDLE hProcess, ULONG_PTR InstructionAddress, bool JustJumps);
+	__declspec(dllimport) ULONG_PTR TITCALL GetJumpDestination(HANDLE hProcess, ULONG_PTR InstructionAddress);
+	__declspec(dllimport) bool TITCALL IsJumpGoingToExecuteEx(HANDLE hProcess, HANDLE hThread, ULONG_PTR InstructionAddress, ULONG_PTR RegFlags);
+	__declspec(dllimport) bool TITCALL IsJumpGoingToExecute();
+	__declspec(dllimport) void TITCALL SetCustomHandler(DWORD ExceptionId, LPVOID CallBack);
+	__declspec(dllimport) void TITCALL ForceClose();
+	__declspec(dllimport) void TITCALL StepInto(LPVOID traceCallBack);
+	__declspec(dllimport) void TITCALL StepOver(LPVOID traceCallBack);
+	__declspec(dllimport) void TITCALL StepOut(LPVOID StepOut, bool StepFinal);
+	__declspec(dllimport) void TITCALL SingleStep(DWORD StepCount, LPVOID StepCallBack);
+	__declspec(dllimport) bool TITCALL GetUnusedHardwareBreakPointRegister(LPDWORD RegisterIndex);
+	__declspec(dllimport) bool TITCALL SetHardwareBreakPointEx(HANDLE hActiveThread, ULONG_PTR bpxAddress, DWORD IndexOfRegister, DWORD bpxType, DWORD bpxSize, LPVOID bpxCallBack, LPDWORD IndexOfSelectedRegister);
+	__declspec(dllimport) bool TITCALL SetHardwareBreakPoint(ULONG_PTR bpxAddress, DWORD IndexOfRegister, DWORD bpxType, DWORD bpxSize, LPVOID bpxCallBack);
+	__declspec(dllimport) bool TITCALL DeleteHardwareBreakPoint(DWORD IndexOfRegister);
+	__declspec(dllimport) bool TITCALL RemoveAllBreakPoints(DWORD RemoveOption);
+	__declspec(dllexport) PROCESS_INFORMATION* TITCALL GetProcessInformation();
+	__declspec(dllexport) STARTUPINFOW* TITCALL GetStartupInformation();
+	__declspec(dllimport) void TITCALL DebugLoop();
+	__declspec(dllimport) void TITCALL SetDebugLoopTimeOut(DWORD TimeOut);
+	__declspec(dllimport) void TITCALL SetNextDbgContinueStatus(DWORD SetDbgCode);
+	__declspec(dllimport) bool TITCALL AttachDebugger(DWORD ProcessId, bool KillOnExit, LPVOID DebugInfo, LPVOID CallBack);
+	__declspec(dllimport) bool TITCALL DetachDebugger(DWORD ProcessId);
+	__declspec(dllimport) bool TITCALL DetachDebuggerEx(DWORD ProcessId);
+	__declspec(dllimport) void TITCALL DebugLoopEx(DWORD TimeOut);
+	__declspec(dllimport) void TITCALL AutoDebugEx(char* szFileName, bool ReserveModuleBase, char* szCommandLine, char* szCurrentFolder, DWORD TimeOut, LPVOID EntryCallBack);
+	__declspec(dllimport) void TITCALL AutoDebugExW(wchar_t* szFileName, bool ReserveModuleBase, wchar_t* szCommandLine, wchar_t* szCurrentFolder, DWORD TimeOut, LPVOID EntryCallBack);
+	__declspec(dllimport) bool TITCALL IsFileBeingDebugged();
+	__declspec(dllimport) void TITCALL SetErrorModel(bool DisplayErrorMessages);
+	// TitanEngine.FindOEP.functions:
+	__declspec(dllimport) void TITCALL FindOEPInit();
+	__declspec(dllimport) bool TITCALL FindOEPGenerically(char* szFileName, LPVOID TraceInitCallBack, LPVOID CallBack);
+	__declspec(dllimport) bool TITCALL FindOEPGenericallyW(wchar_t* szFileName, LPVOID TraceInitCallBack, LPVOID CallBack);
+	// TitanEngine.Importer.functions:
+	__declspec(dllimport) void TITCALL ImporterAddNewDll(char* szDLLName, ULONG_PTR FirstThunk);
+	__declspec(dllimport) void TITCALL ImporterAddNewAPI(char* szAPIName, ULONG_PTR ThunkValue);
+	__declspec(dllimport) void TITCALL ImporterAddNewOrdinalAPI(ULONG_PTR OrdinalNumber, ULONG_PTR ThunkValue);
+	__declspec(dllimport) long TITCALL ImporterGetAddedDllCount();
+	__declspec(dllimport) long TITCALL ImporterGetAddedAPICount();
+	__declspec(dllimport) bool TITCALL ImporterExportIAT(ULONG_PTR StorePlace, ULONG_PTR FileMapVA, HANDLE hFileMap);
+	__declspec(dllimport) long TITCALL ImporterEstimatedSize();
+	__declspec(dllimport) bool TITCALL ImporterExportIATEx(char* szDumpFileName, char* szExportFileName, char* szSectionName);
+	__declspec(dllimport) bool TITCALL ImporterExportIATExW(wchar_t* szDumpFileName, wchar_t* szExportFileName, wchar_t* szSectionName = L".RL!TEv2");
+	__declspec(dllimport) ULONG_PTR TITCALL ImporterFindAPIWriteLocation(char* szAPIName);
+	__declspec(dllimport) ULONG_PTR TITCALL ImporterFindOrdinalAPIWriteLocation(ULONG_PTR OrdinalNumber);
+	__declspec(dllimport) ULONG_PTR TITCALL ImporterFindAPIByWriteLocation(ULONG_PTR APIWriteLocation);
+	__declspec(dllimport) ULONG_PTR TITCALL ImporterFindDLLByWriteLocation(ULONG_PTR APIWriteLocation);
+	__declspec(dllimport) void* TITCALL ImporterGetDLLName(ULONG_PTR APIAddress);
+	__declspec(dllimport) void* TITCALL ImporterGetDLLNameW(ULONG_PTR APIAddress);
+	__declspec(dllimport) void* TITCALL ImporterGetAPIName(ULONG_PTR APIAddress);
+	__declspec(dllimport) ULONG_PTR TITCALL ImporterGetAPIOrdinalNumber(ULONG_PTR APIAddress);
+	__declspec(dllimport) void* TITCALL ImporterGetAPINameEx(ULONG_PTR APIAddress, ULONG_PTR DLLBasesList);
+	__declspec(dllimport) ULONG_PTR TITCALL ImporterGetRemoteAPIAddress(HANDLE hProcess, ULONG_PTR APIAddress);
+	__declspec(dllimport) ULONG_PTR TITCALL ImporterGetRemoteAPIAddressEx(char* szDLLName, char* szAPIName);
+	__declspec(dllimport) ULONG_PTR TITCALL ImporterGetLocalAPIAddress(HANDLE hProcess, ULONG_PTR APIAddress);
+	__declspec(dllimport) void* TITCALL ImporterGetDLLNameFromDebugee(HANDLE hProcess, ULONG_PTR APIAddress);
+	__declspec(dllimport) void* TITCALL ImporterGetDLLNameFromDebugeeW(HANDLE hProcess, ULONG_PTR APIAddress);
+	__declspec(dllimport) void* TITCALL ImporterGetAPINameFromDebugee(HANDLE hProcess, ULONG_PTR APIAddress);
+	__declspec(dllimport) ULONG_PTR TITCALL ImporterGetAPIOrdinalNumberFromDebugee(HANDLE hProcess, ULONG_PTR APIAddress);
+	__declspec(dllimport) long TITCALL ImporterGetDLLIndexEx(ULONG_PTR APIAddress, ULONG_PTR DLLBasesList);
+	__declspec(dllimport) long TITCALL ImporterGetDLLIndex(HANDLE hProcess, ULONG_PTR APIAddress, ULONG_PTR DLLBasesList);
+	__declspec(dllimport) ULONG_PTR TITCALL ImporterGetRemoteDLLBase(HANDLE hProcess, HMODULE LocalModuleBase);
+	__declspec(dllimport) ULONG_PTR TITCALL ImporterGetRemoteDLLBaseEx(HANDLE hProcess, char* szModuleName);
+	__declspec(dllimport) void* TITCALL ImporterGetRemoteDLLBaseExW(HANDLE hProcess, wchar_t* szModuleName);
+	__declspec(dllimport) bool TITCALL ImporterIsForwardedAPI(HANDLE hProcess, ULONG_PTR APIAddress);
+	__declspec(dllimport) void* TITCALL ImporterGetForwardedAPIName(HANDLE hProcess, ULONG_PTR APIAddress);
+	__declspec(dllimport) void* TITCALL ImporterGetForwardedDLLName(HANDLE hProcess, ULONG_PTR APIAddress);
+	__declspec(dllimport) long TITCALL ImporterGetForwardedDLLIndex(HANDLE hProcess, ULONG_PTR APIAddress, ULONG_PTR DLLBasesList);
+	__declspec(dllimport) ULONG_PTR TITCALL ImporterGetForwardedAPIOrdinalNumber(HANDLE hProcess, ULONG_PTR APIAddress);
+	__declspec(dllimport) ULONG_PTR TITCALL ImporterGetNearestAPIAddress(HANDLE hProcess, ULONG_PTR APIAddress);
+	__declspec(dllimport) void* TITCALL ImporterGetNearestAPIName(HANDLE hProcess, ULONG_PTR APIAddress);
+	__declspec(dllimport) bool TITCALL ImporterCopyOriginalIAT(char* szOriginalFile, char* szDumpFile);
+	__declspec(dllimport) bool TITCALL ImporterCopyOriginalIATW(wchar_t* szOriginalFile, wchar_t* szDumpFile);
+	__declspec(dllimport) bool TITCALL ImporterLoadImportTable(char* szFileName);
+	__declspec(dllimport) bool TITCALL ImporterLoadImportTableW(wchar_t* szFileName);
+	__declspec(dllimport) bool TITCALL ImporterMoveOriginalIAT(char* szOriginalFile, char* szDumpFile, char* szSectionName);
+	__declspec(dllimport) bool TITCALL ImporterMoveOriginalIATW(wchar_t* szOriginalFile, wchar_t* szDumpFile, char* szSectionName);
+	__declspec(dllimport) void TITCALL ImporterAutoSearchIAT(DWORD ProcessId, char* szFileName, ULONG_PTR SearchStart, LPVOID pIATStart, LPVOID pIATSize);
+	__declspec(dllimport) void TITCALL ImporterAutoSearchIATW(DWORD ProcessIds, wchar_t* szFileName, ULONG_PTR SearchStart, LPVOID pIATStart, LPVOID pIATSize);
+	__declspec(dllimport) void TITCALL ImporterAutoSearchIATEx(DWORD ProcessId, ULONG_PTR ImageBase, ULONG_PTR SearchStart, LPVOID pIATStart, LPVOID pIATSize);
+	__declspec(dllimport) void TITCALL ImporterEnumAddedData(LPVOID EnumCallBack);
+	__declspec(dllimport) long TITCALL ImporterAutoFixIATEx(DWORD ProcessId, char* szDumpedFile, char* szSectionName, bool DumpRunningProcess, bool RealignFile, ULONG_PTR EntryPointAddress, ULONG_PTR ImageBase, ULONG_PTR SearchStart, bool TryAutoFix, bool FixEliminations, LPVOID UnknownPointerFixCallback);
+	__declspec(dllimport) long TITCALL ImporterAutoFixIATExW(DWORD ProcessId, wchar_t* szDumpedFile, char* szSectionName, bool DumpRunningProcess, bool RealignFile, ULONG_PTR EntryPointAddress, ULONG_PTR ImageBase, ULONG_PTR SearchStart, bool TryAutoFix, bool FixEliminations, LPVOID UnknownPointerFixCallback);
+	__declspec(dllimport) long TITCALL ImporterAutoFixIAT(DWORD ProcessId, char* szDumpedFile, ULONG_PTR SearchStart);
+	__declspec(dllimport) long TITCALL ImporterAutoFixIATW(DWORD ProcessId, wchar_t* szDumpedFile, ULONG_PTR SearchStart);
+	__declspec(dllimport) bool TITCALL ImporterDeleteAPI(DWORD_PTR apiAddr);
+	// Global.Engine.Hook.functions:
+	__declspec(dllimport) bool TITCALL HooksSafeTransitionEx(LPVOID HookAddressArray, int NumberOfHooks, bool TransitionStart);
+	__declspec(dllimport) bool TITCALL HooksSafeTransition(LPVOID HookAddress, bool TransitionStart);
+	__declspec(dllimport) bool TITCALL HooksIsAddressRedirected(LPVOID HookAddress);
+	__declspec(dllimport) void* TITCALL HooksGetTrampolineAddress(LPVOID HookAddress);
+	__declspec(dllimport) void* TITCALL HooksGetHookEntryDetails(LPVOID HookAddress);
+	__declspec(dllimport) bool TITCALL HooksInsertNewRedirection(LPVOID HookAddress, LPVOID RedirectTo, int HookType);
+	__declspec(dllimport) bool TITCALL HooksInsertNewIATRedirectionEx(ULONG_PTR FileMapVA, ULONG_PTR LoadedModuleBase, char* szHookFunction, LPVOID RedirectTo);
+	__declspec(dllimport) bool TITCALL HooksInsertNewIATRedirection(char* szModuleName, char* szHookFunction, LPVOID RedirectTo);
+	__declspec(dllimport) bool TITCALL HooksRemoveRedirection(LPVOID HookAddress, bool RemoveAll);
+	__declspec(dllimport) bool TITCALL HooksRemoveRedirectionsForModule(HMODULE ModuleBase);
+	__declspec(dllimport) bool TITCALL HooksRemoveIATRedirection(char* szModuleName, char* szHookFunction, bool RemoveAll);
+	__declspec(dllimport) bool TITCALL HooksDisableRedirection(LPVOID HookAddress, bool DisableAll);
+	__declspec(dllimport) bool TITCALL HooksDisableRedirectionsForModule(HMODULE ModuleBase);
+	__declspec(dllimport) bool TITCALL HooksDisableIATRedirection(char* szModuleName, char* szHookFunction, bool DisableAll);
+	__declspec(dllimport) bool TITCALL HooksEnableRedirection(LPVOID HookAddress, bool EnableAll);
+	__declspec(dllimport) bool TITCALL HooksEnableRedirectionsForModule(HMODULE ModuleBase);
+	__declspec(dllimport) bool TITCALL HooksEnableIATRedirection(char* szModuleName, char* szHookFunction, bool EnableAll);
+	__declspec(dllimport) void TITCALL HooksScanModuleMemory(HMODULE ModuleBase, LPVOID CallBack);
+	__declspec(dllimport) void TITCALL HooksScanEntireProcessMemory(LPVOID CallBack);
+	__declspec(dllimport) void TITCALL HooksScanEntireProcessMemoryEx();
+	// TitanEngine.Tracer.functions:
+	__declspec(dllimport) void TITCALL TracerInit();
+	__declspec(dllimport) ULONG_PTR TITCALL TracerLevel1(HANDLE hProcess, ULONG_PTR AddressToTrace);
+	__declspec(dllimport) ULONG_PTR TITCALL HashTracerLevel1(HANDLE hProcess, ULONG_PTR AddressToTrace, DWORD InputNumberOfInstructions);
+	__declspec(dllimport) long TITCALL TracerDetectRedirection(HANDLE hProcess, ULONG_PTR AddressToTrace);
+	__declspec(dllimport) ULONG_PTR TITCALL TracerFixKnownRedirection(HANDLE hProcess, ULONG_PTR AddressToTrace, DWORD RedirectionId);
+	__declspec(dllimport) ULONG_PTR TITCALL TracerFixRedirectionViaModule(HMODULE hModuleHandle, HANDLE hProcess, ULONG_PTR AddressToTrace, DWORD IdParameter);
+	__declspec(dllimport) ULONG_PTR TITCALL TracerDetectRedirectionViaModule(HMODULE hModuleHandle, HANDLE hProcess, ULONG_PTR AddressToTrace, PDWORD ReturnedId);
+	__declspec(dllimport) long TITCALL TracerFixRedirectionViaImpRecPlugin(HANDLE hProcess, char* szPluginName, ULONG_PTR AddressToTrace);
+	// TitanEngine.Exporter.functions:
+	__declspec(dllimport) void TITCALL ExporterCleanup();
+	__declspec(dllimport) void TITCALL ExporterSetImageBase(ULONG_PTR ImageBase);
+	__declspec(dllimport) void TITCALL ExporterInit(DWORD MemorySize, ULONG_PTR ImageBase, DWORD ExportOrdinalBase, char* szExportModuleName);
+	__declspec(dllimport) bool TITCALL ExporterAddNewExport(char* szExportName, DWORD ExportRelativeAddress);
+	__declspec(dllimport) bool TITCALL ExporterAddNewOrdinalExport(DWORD OrdinalNumber, DWORD ExportRelativeAddress);
+	__declspec(dllimport) long TITCALL ExporterGetAddedExportCount();
+	__declspec(dllimport) long TITCALL ExporterEstimatedSize();
+	__declspec(dllimport) bool TITCALL ExporterBuildExportTable(ULONG_PTR StorePlace, ULONG_PTR FileMapVA);
+	__declspec(dllimport) bool TITCALL ExporterBuildExportTableEx(char* szExportFileName, char* szSectionName);
+	__declspec(dllimport) bool TITCALL ExporterBuildExportTableExW(wchar_t* szExportFileName, char* szSectionName);
+	__declspec(dllimport) bool TITCALL ExporterLoadExportTable(char* szFileName);
+	__declspec(dllimport) bool TITCALL ExporterLoadExportTableW(wchar_t* szFileName);
+	// TitanEngine.Librarian.functions:
+	__declspec(dllimport) bool TITCALL LibrarianSetBreakPoint(char* szLibraryName, DWORD bpxType, bool SingleShoot, LPVOID bpxCallBack);
+	__declspec(dllimport) bool TITCALL LibrarianRemoveBreakPoint(char* szLibraryName, DWORD bpxType);
+	__declspec(dllimport) void* TITCALL LibrarianGetLibraryInfo(char* szLibraryName);
+	__declspec(dllimport) void* TITCALL LibrarianGetLibraryInfoW(wchar_t* szLibraryName);
+	__declspec(dllimport) void* TITCALL LibrarianGetLibraryInfoEx(void* BaseOfDll);
+	__declspec(dllimport) void* TITCALL LibrarianGetLibraryInfoExW(void* BaseOfDll);
+	__declspec(dllimport) void TITCALL LibrarianEnumLibraryInfo(void* EnumCallBack);
+	__declspec(dllimport) void TITCALL LibrarianEnumLibraryInfoW(void* EnumCallBack);
+	// TitanEngine.Process.functions:
+	__declspec(dllimport) long TITCALL GetActiveProcessId(char* szImageName);
+	__declspec(dllimport) long TITCALL GetActiveProcessIdW(wchar_t* szImageName);
+	__declspec(dllimport) void TITCALL EnumProcessesWithLibrary(char* szLibraryName, void* EnumFunction);
+	__declspec(dllimport) HANDLE TITCALL TitanOpenProcess(DWORD dwDesiredAccess, bool bInheritHandle, DWORD dwProcessId);
+	// TitanEngine.TLSFixer.functions:
+	__declspec(dllimport) bool TITCALL TLSBreakOnCallBack(LPVOID ArrayOfCallBacks, DWORD NumberOfCallBacks, LPVOID bpxCallBack);
+	__declspec(dllimport) bool TITCALL TLSGrabCallBackData(char* szFileName, LPVOID ArrayOfCallBacks, LPDWORD NumberOfCallBacks);
+	__declspec(dllimport) bool TITCALL TLSGrabCallBackDataW(wchar_t* szFileName, LPVOID ArrayOfCallBacks, LPDWORD NumberOfCallBacks);
+	__declspec(dllimport) bool TITCALL TLSBreakOnCallBackEx(char* szFileName, LPVOID bpxCallBack);
+	__declspec(dllimport) bool TITCALL TLSBreakOnCallBackExW(wchar_t* szFileName, LPVOID bpxCallBack);
+	__declspec(dllimport) bool TITCALL TLSRemoveCallback(char* szFileName);
+	__declspec(dllimport) bool TITCALL TLSRemoveCallbackW(wchar_t* szFileName);
+	__declspec(dllimport) bool TITCALL TLSRemoveTable(char* szFileName);
+	__declspec(dllimport) bool TITCALL TLSRemoveTableW(wchar_t* szFileName);
+	__declspec(dllimport) bool TITCALL TLSBackupData(char* szFileName);
+	__declspec(dllimport) bool TITCALL TLSBackupDataW(wchar_t* szFileName);
+	__declspec(dllimport) bool TITCALL TLSRestoreData();
+	__declspec(dllimport) bool TITCALL TLSBuildNewTable(ULONG_PTR FileMapVA, ULONG_PTR StorePlace, ULONG_PTR StorePlaceRVA, LPVOID ArrayOfCallBacks, DWORD NumberOfCallBacks);
+	__declspec(dllimport) bool TITCALL TLSBuildNewTableEx(char* szFileName, char* szSectionName, LPVOID ArrayOfCallBacks, DWORD NumberOfCallBacks);
+	__declspec(dllimport) bool TITCALL TLSBuildNewTableExW(wchar_t* szFileName, char* szSectionName, LPVOID ArrayOfCallBacks, DWORD NumberOfCallBacks);
+	// TitanEngine.TranslateName.functions:
+	__declspec(dllimport) void* TITCALL TranslateNativeName(char* szNativeName);
+	__declspec(dllimport) void* TITCALL TranslateNativeNameW(wchar_t* szNativeName);
+	// TitanEngine.Handler.functions:
+	__declspec(dllimport) long TITCALL HandlerGetActiveHandleCount(DWORD ProcessId);
+	__declspec(dllimport) bool TITCALL HandlerIsHandleOpen(DWORD ProcessId, HANDLE hHandle);
+	__declspec(dllimport) void* TITCALL HandlerGetHandleName(HANDLE hProcess, DWORD ProcessId, HANDLE hHandle, bool TranslateName);
+	__declspec(dllimport) void* TITCALL HandlerGetHandleNameW(HANDLE hProcess, DWORD ProcessId, HANDLE hHandle, bool TranslateName);
+	__declspec(dllimport) long TITCALL HandlerEnumerateOpenHandles(DWORD ProcessId, LPVOID HandleBuffer, DWORD MaxHandleCount);
+	__declspec(dllimport) ULONG_PTR TITCALL HandlerGetHandleDetails(HANDLE hProcess, DWORD ProcessId, HANDLE hHandle, DWORD InformationReturn);
+	__declspec(dllimport) bool TITCALL HandlerCloseRemoteHandle(HANDLE hProcess, HANDLE hHandle);
+	__declspec(dllimport) long TITCALL HandlerEnumerateLockHandles(char* szFileOrFolderName, bool NameIsFolder, bool NameIsTranslated, LPVOID HandleDataBuffer, DWORD MaxHandleCount);
+	__declspec(dllimport) long TITCALL HandlerEnumerateLockHandlesW(wchar_t* szFileOrFolderName, bool NameIsFolder, bool NameIsTranslated, LPVOID HandleDataBuffer, DWORD MaxHandleCount);
+	__declspec(dllimport) bool TITCALL HandlerCloseAllLockHandles(char* szFileOrFolderName, bool NameIsFolder, bool NameIsTranslated);
+	__declspec(dllimport) bool TITCALL HandlerCloseAllLockHandlesW(wchar_t* szFileOrFolderName, bool NameIsFolder, bool NameIsTranslated);
+	__declspec(dllimport) bool TITCALL HandlerIsFileLocked(char* szFileOrFolderName, bool NameIsFolder, bool NameIsTranslated);
+	__declspec(dllimport) bool TITCALL HandlerIsFileLockedW(wchar_t* szFileOrFolderName, bool NameIsFolder, bool NameIsTranslated);
+	// TitanEngine.Handler[Mutex].functions:
+	__declspec(dllimport) long TITCALL HandlerEnumerateOpenMutexes(HANDLE hProcess, DWORD ProcessId, LPVOID HandleBuffer, DWORD MaxHandleCount);
+	__declspec(dllimport) ULONG_PTR TITCALL HandlerGetOpenMutexHandle(HANDLE hProcess, DWORD ProcessId, char* szMutexString);
+	__declspec(dllimport) ULONG_PTR TITCALL HandlerGetOpenMutexHandleW(HANDLE hProcess, DWORD ProcessId, wchar_t* szMutexString);
+	__declspec(dllimport) long TITCALL HandlerGetProcessIdWhichCreatedMutex(char* szMutexString);
+	__declspec(dllimport) long TITCALL HandlerGetProcessIdWhichCreatedMutexW(wchar_t* szMutexString);
+	// TitanEngine.Injector.functions:
+	__declspec(dllimport) bool TITCALL RemoteLoadLibrary(HANDLE hProcess, char* szLibraryFile, bool WaitForThreadExit);
+	__declspec(dllimport) bool TITCALL RemoteLoadLibraryW(HANDLE hProcess, wchar_t* szLibraryFile, bool WaitForThreadExit);
+	__declspec(dllimport) bool TITCALL RemoteFreeLibrary(HANDLE hProcess, HMODULE hModule, char* szLibraryFile, bool WaitForThreadExit);
+	__declspec(dllimport) bool TITCALL RemoteFreeLibraryW(HANDLE hProcess, HMODULE hModule, wchar_t* szLibraryFile, bool WaitForThreadExit);
+	__declspec(dllimport) bool TITCALL RemoteExitProcess(HANDLE hProcess, DWORD ExitCode);
+	// TitanEngine.StaticUnpacker.functions:
+	__declspec(dllimport) bool TITCALL StaticFileLoad(char* szFileName, DWORD DesiredAccess, bool SimulateLoad, LPHANDLE FileHandle, LPDWORD LoadedSize, LPHANDLE FileMap, PULONG_PTR FileMapVA);
+	__declspec(dllimport) bool TITCALL StaticFileLoadW(wchar_t* szFileName, DWORD DesiredAccess, bool SimulateLoad, LPHANDLE FileHandle, LPDWORD LoadedSize, LPHANDLE FileMap, PULONG_PTR FileMapVA);
+	__declspec(dllimport) bool TITCALL StaticFileUnload(char* szFileName, bool CommitChanges, HANDLE FileHandle, DWORD LoadedSize, HANDLE FileMap, ULONG_PTR FileMapVA);
+	__declspec(dllimport) bool TITCALL StaticFileUnloadW(wchar_t* szFileName, bool CommitChanges, HANDLE FileHandle, DWORD LoadedSize, HANDLE FileMap, ULONG_PTR FileMapVA);
+	__declspec(dllimport) bool TITCALL StaticFileOpen(char* szFileName, DWORD DesiredAccess, LPHANDLE FileHandle, LPDWORD FileSizeLow, LPDWORD FileSizeHigh);
+	__declspec(dllimport) bool TITCALL StaticFileOpenW(wchar_t* szFileName, DWORD DesiredAccess, LPHANDLE FileHandle, LPDWORD FileSizeLow, LPDWORD FileSizeHigh);
+	__declspec(dllimport) bool TITCALL StaticFileGetContent(HANDLE FileHandle, DWORD FilePositionLow, LPDWORD FilePositionHigh, void* Buffer, DWORD Size);
+	__declspec(dllimport) void TITCALL StaticFileClose(HANDLE FileHandle);
+	__declspec(dllimport) void TITCALL StaticMemoryDecrypt(LPVOID MemoryStart, DWORD MemorySize, DWORD DecryptionType, DWORD DecryptionKeySize, ULONG_PTR DecryptionKey);
+	__declspec(dllimport) void TITCALL StaticMemoryDecryptEx(LPVOID MemoryStart, DWORD MemorySize, DWORD DecryptionKeySize, void* DecryptionCallBack);
+	__declspec(dllimport) void TITCALL StaticMemoryDecryptSpecial(LPVOID MemoryStart, DWORD MemorySize, DWORD DecryptionKeySize, DWORD SpecDecryptionType, void* DecryptionCallBack);
+	__declspec(dllimport) void TITCALL StaticSectionDecrypt(ULONG_PTR FileMapVA, DWORD SectionNumber, bool SimulateLoad, DWORD DecryptionType, DWORD DecryptionKeySize, ULONG_PTR DecryptionKey);
+	__declspec(dllimport) bool TITCALL StaticMemoryDecompress(void* Source, DWORD SourceSize, void* Destination, DWORD DestinationSize, int Algorithm);
+	__declspec(dllimport) bool TITCALL StaticRawMemoryCopy(HANDLE hFile, ULONG_PTR FileMapVA, ULONG_PTR VitualAddressToCopy, DWORD Size, bool AddressIsRVA, char* szDumpFileName);
+	__declspec(dllimport) bool TITCALL StaticRawMemoryCopyW(HANDLE hFile, ULONG_PTR FileMapVA, ULONG_PTR VitualAddressToCopy, DWORD Size, bool AddressIsRVA, wchar_t* szDumpFileName);
+	__declspec(dllimport) bool TITCALL StaticRawMemoryCopyEx(HANDLE hFile, DWORD RawAddressToCopy, DWORD Size, char* szDumpFileName);
+	__declspec(dllimport) bool TITCALL StaticRawMemoryCopyExW(HANDLE hFile, DWORD RawAddressToCopy, DWORD Size, wchar_t* szDumpFileName);
+	__declspec(dllimport) bool TITCALL StaticRawMemoryCopyEx64(HANDLE hFile, DWORD64 RawAddressToCopy, DWORD64 Size, char* szDumpFileName);
+	__declspec(dllimport) bool TITCALL StaticRawMemoryCopyEx64W(HANDLE hFile, DWORD64 RawAddressToCopy, DWORD64 Size, wchar_t* szDumpFileName);
+	__declspec(dllimport) bool TITCALL StaticHashMemory(void* MemoryToHash, DWORD SizeOfMemory, void* HashDigest, bool OutputString, int Algorithm);
+	__declspec(dllimport) bool TITCALL StaticHashFile(char* szFileName, char* HashDigest, bool OutputString, int Algorithm);
+	__declspec(dllimport) bool TITCALL StaticHashFileW(wchar_t* szFileName, char* HashDigest, bool OutputString, int Algorithm);
+	// TitanEngine.Engine.functions:
+	__declspec(dllimport) void TITCALL SetEngineVariable(DWORD VariableId, bool VariableSet);
+	__declspec(dllimport) bool TITCALL EngineCreateMissingDependencies(char* szFileName, char* szOutputFolder, bool LogCreatedFiles);
+	__declspec(dllimport) bool TITCALL EngineCreateMissingDependenciesW(wchar_t* szFileName, wchar_t* szOutputFolder, bool LogCreatedFiles);
+	__declspec(dllimport) bool TITCALL EngineFakeMissingDependencies(HANDLE hProcess);
+	__declspec(dllimport) bool TITCALL EngineDeleteCreatedDependencies();
+	__declspec(dllimport) bool TITCALL EngineCreateUnpackerWindow(char* WindowUnpackerTitle, char* WindowUnpackerLongTitle, char* WindowUnpackerName, char* WindowUnpackerAuthor, void* StartUnpackingCallBack);
+	__declspec(dllimport) void TITCALL EngineAddUnpackerWindowLogMessage(char* szLogMessage);
+	__declspec(dllimport) bool TITCALL EngineCheckStructAlignment(DWORD StructureType, ULONG_PTR StructureSize);
+	// Global.Engine.Extension.Functions:
+	__declspec(dllimport) bool TITCALL ExtensionManagerIsPluginLoaded(char* szPluginName);
+	__declspec(dllimport) bool TITCALL ExtensionManagerIsPluginEnabled(char* szPluginName);
+	__declspec(dllimport) bool TITCALL ExtensionManagerDisableAllPlugins();
+	__declspec(dllimport) bool TITCALL ExtensionManagerDisablePlugin(char* szPluginName);
+	__declspec(dllimport) bool TITCALL ExtensionManagerEnableAllPlugins();
+	__declspec(dllimport) bool TITCALL ExtensionManagerEnablePlugin(char* szPluginName);
+	__declspec(dllimport) bool TITCALL ExtensionManagerUnloadAllPlugins();
+	__declspec(dllimport) bool TITCALL ExtensionManagerUnloadPlugin(char* szPluginName);
+	__declspec(dllimport) void* TITCALL ExtensionManagerGetPluginInfo(char* szPluginName);
+
+#ifdef __cplusplus
+}
+#endif /*__cplusplus*/
+
+#pragma pack(pop)
+
+#endif /*TITANENGINE*/

src/internal.cpp

@@ -1,5 +1,5 @@
 #include "internal.h"
-#include "pluginsdk\TitanEngine\TitanEngine.h"
+#include "pluginsdk\TitanEngine\TitanEngine.hpp"
 #include <windows.h>
 #include <stdio.h>
 #include <psapi.h>
@@ -33,7 +33,7 @@ duint memfindbaseaddr(HANDLE hProcess, duint addr, duint* size)
 }
 
 static bool cbRunAnalysis(){
-	duint entry = GetContextData(UE_CIP);
+	duint entry = TE::UE::GetContextData(TE::UE::UE_CIP);
 	char mod[MAX_MODULE_SIZE]="";
 	if(!DbgGetModuleAt(entry, mod))
 	{
@@ -48,15 +48,13 @@ static bool cbRunAnalysis(){
 	}
 	duint size = DbgMemGetPageSize(base);
 	duint BaseAddr = base + size;
-	
 	duint memSize=0;
-	HANDLE hProcess=((PROCESS_INFORMATION*)GetProcessInformation())->hProcess;
+	HANDLE hProcess = ((PROCESS_INFORMATION*)TE::UE::GetProcessInformation())->hProcess;
 	memfindbaseaddr(hProcess,entry,&memSize);
 
-	
 
 	AnalysisRunner AR(BaseAddr,memSize);
-	AR.setDB(db);
+	AR.setFunctionInformation(db);
 	AR.start();
 	return true;
 }

src/meta.h

@@ -3,37 +3,53 @@
  * license:  GLPv3
  */
 #pragma once
-
+#include "pluginsdk/BeaEngine.h"
 #include "pluginsdk/bridgemain.h"
 #include <vector>
 #include <string>
+#include <map>
 
-struct APIArgument
+
+struct Instruction_t{
+	DISASM BeaStruct;
+	unsigned int Length;
+
+	Instruction_t(DISASM *dis, unsigned int len){
+		BeaStruct = *dis;
+		Length = len;
+	}
+
+	Instruction_t(){
+		Length = UNKNOWN_OPCODE;
+	}
+};
+
+struct ArgumentInfo_t
 {
 	std::string Type;
 	std::string Name;
 
-	APIArgument(std::string t,std::string n){
+	ArgumentInfo_t(std::string t,std::string n){
 		Type=t;
 		Name = n;
 	}
 
-	APIArgument(){}
+	ArgumentInfo_t(){}
 };
 
-struct APIFunction
+struct FunctionInfo_t
 {
 	std::string DLLName;
 	std::string ReturnType;
 	std::string Name;
-	std::vector<APIArgument> Arguments;
+	std::vector<ArgumentInfo_t> Arguments;
 	bool invalid;
 
-	APIFunction(){
+	FunctionInfo_t(){
 		invalid=false;
 	}
 
-	APIFunction(std::string dll,std::string ret,std::string name, std::vector<APIArgument> args){
+	FunctionInfo_t(std::string dll,std::string ret,std::string name, std::vector<ArgumentInfo_t> args){
 		DLLName=dll;
 		ReturnType=ret;
 		Name=name;
@@ -41,8 +57,33 @@ struct APIFunction
 		invalid = false;
 	}
 
-	APIArgument arg(int i){
+	bool operator==(const FunctionInfo_t& rhs) const
+	{
+		return (bool)(stricmp(Name.c_str(), rhs.Name.c_str()) < 0);
+	}
+	bool operator<(const FunctionInfo_t& rhs) const
+	{
+		return (bool)stricmp(Name.c_str(), rhs.Name.c_str());
+	}
+
+	ArgumentInfo_t arg(int i){
 		return Arguments.at(i);
 	}
 
-};
+};
+
+namespace std{
+
+	template<typename T, typename D>
+	bool contains(map<T,D> s, T key)
+	{
+		std::map<T,D>::iterator it = s.find(key);
+		return (it != s.end());
+	}
+}
+
+#ifdef _WIN64
+#define REGISTER_SIZE 8
+#else
+#define REGISTER_SIZE 4
+#endif

src/pluginsdk/BeaEngine.h

@@ -0,0 +1,392 @@
+#ifndef _BEA_ENGINE_
+#define _BEA_ENGINE_
+#if  defined(__cplusplus) && defined(__BORLANDC__)
+namespace BeaEngine
+{
+#endif
+
+#include "macros.h"
+#include "export.h"
+#include "basic_types.h"
+
+#if !defined(BEA_ENGINE_STATIC)
+#if defined(BUILD_BEA_ENGINE_DLL)
+#define BEA_API bea__api_export__
+#else
+#define BEA_API bea__api_import__
+#endif
+#else
+#define BEA_API
+#endif
+
+
+#define INSTRUCT_LENGTH 64
+
+#pragma pack(1)
+typedef struct
+{
+    UInt8 W_;
+    UInt8 R_;
+    UInt8 X_;
+    UInt8 B_;
+    UInt8 state;
+} REX_Struct  ;
+#pragma pack()
+
+#pragma pack(1)
+typedef struct
+{
+    int Number;
+    int NbUndefined;
+    UInt8 LockPrefix;
+    UInt8 OperandSize;
+    UInt8 AddressSize;
+    UInt8 RepnePrefix;
+    UInt8 RepPrefix;
+    UInt8 FSPrefix;
+    UInt8 SSPrefix;
+    UInt8 GSPrefix;
+    UInt8 ESPrefix;
+    UInt8 CSPrefix;
+    UInt8 DSPrefix;
+    UInt8 BranchTaken;
+    UInt8 BranchNotTaken;
+    REX_Struct REX;
+    char alignment[2];
+} PREFIXINFO  ;
+#pragma pack()
+
+#pragma pack(1)
+typedef struct
+{
+    UInt8 OF_;
+    UInt8 SF_;
+    UInt8 ZF_;
+    UInt8 AF_;
+    UInt8 PF_;
+    UInt8 CF_;
+    UInt8 TF_;
+    UInt8 IF_;
+    UInt8 DF_;
+    UInt8 NT_;
+    UInt8 RF_;
+    UInt8 alignment;
+} EFLStruct  ;
+#pragma pack()
+
+#pragma pack(4)
+typedef struct
+{
+    Int32 BaseRegister;
+    Int32 IndexRegister;
+    Int32 Scale;
+    Int64 Displacement;
+} MEMORYTYPE ;
+#pragma pack()
+
+
+#pragma pack(1)
+typedef struct
+{
+    Int32 Category; //INSTRUCTION_TYPE
+    Int32 Opcode;
+    char Mnemonic[16];
+    Int32 BranchType; //BRANCH_TYPE
+    EFLStruct Flags;
+    UInt64 AddrValue;
+    Int64 Immediat;
+    UInt32 ImplicitModifiedRegs;
+} INSTRTYPE;
+#pragma pack()
+
+#pragma pack(1)
+typedef struct
+{
+    char ArgMnemonic[64];
+    Int32 ArgType; //ARGUMENTS_TYPE
+    Int32 ArgSize;
+    Int32 ArgPosition;
+    UInt32 AccessMode;
+    MEMORYTYPE Memory;
+    UInt32 SegmentReg;
+} ARGTYPE;
+#pragma pack()
+
+/* reserved structure used for thread-safety */
+/* unusable by customer */
+#pragma pack(1)
+typedef struct
+{
+    UIntPtr EIP_;
+    UInt64 EIP_VA;
+    UIntPtr EIP_REAL;
+    Int32 OriginalOperandSize;
+    Int32 OperandSize;
+    Int32 MemDecoration;
+    Int32 AddressSize;
+    Int32 MOD_;
+    Int32 RM_;
+    Int32 INDEX_;
+    Int32 SCALE_;
+    Int32 BASE_;
+    Int32 MMX_;
+    Int32 SSE_;
+    Int32 CR_;
+    Int32 DR_;
+    Int32 SEG_;
+    Int32 REGOPCODE;
+    UInt32 DECALAGE_EIP;
+    Int32 FORMATNUMBER;
+    Int32 SYNTAX_;
+    UInt64 EndOfBlock;
+    Int32 RelativeAddress;
+    UInt32 Architecture;
+    Int32 ImmediatSize;
+    Int32 NB_PREFIX;
+    Int32 PrefRepe;
+    Int32 PrefRepne;
+    UInt32 SEGMENTREGS;
+    UInt32 SEGMENTFS;
+    Int32 third_arg;
+    Int32 TAB_;
+    Int32 ERROR_OPCODE;
+    REX_Struct REX;
+    Int32 OutOfBlock;
+} InternalDatas;
+#pragma pack()
+
+/* ************** main structure ************ */
+#pragma pack(1)
+typedef struct _Disasm
+{
+    UIntPtr EIP;
+    UInt64 VirtualAddr;
+    UInt32 SecurityBlock;
+    char CompleteInstr[INSTRUCT_LENGTH];
+    UInt32 Archi;
+    UInt64 Options;
+    INSTRTYPE Instruction;
+    ARGTYPE Argument1;
+    ARGTYPE Argument2;
+    ARGTYPE Argument3;
+    PREFIXINFO Prefix;
+    InternalDatas Reserved_;
+} DISASM, *PDISASM, *LPDISASM;
+#pragma pack()
+
+#define ESReg 1
+#define DSReg 2
+#define FSReg 3
+#define GSReg 4
+#define CSReg 5
+#define SSReg 6
+
+#define InvalidPrefix 4
+#define SuperfluousPrefix 2
+#define NotUsedPrefix 0
+#define MandatoryPrefix 8
+#define InUsePrefix 1
+
+#define LowPosition 0
+#define HighPosition 1
+
+enum INSTRUCTION_TYPE
+{
+    GENERAL_PURPOSE_INSTRUCTION   =    0x10000,
+    FPU_INSTRUCTION               =    0x20000,
+    MMX_INSTRUCTION               =    0x40000,
+    SSE_INSTRUCTION               =    0x80000,
+    SSE2_INSTRUCTION              =   0x100000,
+    SSE3_INSTRUCTION              =   0x200000,
+    SSSE3_INSTRUCTION             =   0x400000,
+    SSE41_INSTRUCTION             =   0x800000,
+    SSE42_INSTRUCTION             =  0x1000000,
+    SYSTEM_INSTRUCTION            =  0x2000000,
+    VM_INSTRUCTION                =  0x4000000,
+    UNDOCUMENTED_INSTRUCTION      =  0x8000000,
+    AMD_INSTRUCTION               = 0x10000000,
+    ILLEGAL_INSTRUCTION           = 0x20000000,
+    AES_INSTRUCTION               = 0x40000000,
+    CLMUL_INSTRUCTION             = (int)0x80000000,
+
+
+    DATA_TRANSFER = 0x1,
+    ARITHMETIC_INSTRUCTION,
+    LOGICAL_INSTRUCTION,
+    SHIFT_ROTATE,
+    BIT_UInt8,
+    CONTROL_TRANSFER,
+    STRING_INSTRUCTION,
+    InOutINSTRUCTION,
+    ENTER_LEAVE_INSTRUCTION,
+    FLAG_CONTROL_INSTRUCTION,
+    SEGMENT_REGISTER,
+    MISCELLANEOUS_INSTRUCTION,
+    COMPARISON_INSTRUCTION,
+    LOGARITHMIC_INSTRUCTION,
+    TRIGONOMETRIC_INSTRUCTION,
+    UNSUPPORTED_INSTRUCTION,
+    LOAD_CONSTANTS,
+    FPUCONTROL,
+    STATE_MANAGEMENT,
+    CONVERSION_INSTRUCTION,
+    SHUFFLE_UNPACK,
+    PACKED_SINGLE_PRECISION,
+    SIMD128bits,
+    SIMD64bits,
+    CACHEABILITY_CONTROL,
+    FP_INTEGER_CONVERSION,
+    SPECIALIZED_128bits,
+    SIMD_FP_PACKED,
+    SIMD_FP_HORIZONTAL ,
+    AGENT_SYNCHRONISATION,
+    PACKED_ALIGN_RIGHT  ,
+    PACKED_SIGN,
+    PACKED_BLENDING_INSTRUCTION,
+    PACKED_TEST,
+    PACKED_MINMAX,
+    HORIZONTAL_SEARCH,
+    PACKED_EQUALITY,
+    STREAMING_LOAD,
+    INSERTION_EXTRACTION,
+    DOT_PRODUCT,
+    SAD_INSTRUCTION,
+    ACCELERATOR_INSTRUCTION,    /* crc32, popcnt (sse4.2) */
+    ROUND_INSTRUCTION
+};
+
+enum EFLAGS_STATES
+{
+    TE_ = 1,
+    MO_ = 2,
+    RE_ = 4,
+    SE_ = 8,
+    UN_ = 0x10,
+    PR_ = 0x20
+};
+
+enum BRANCH_TYPE
+{
+    //JO vs JNO
+    JO = 1,
+    JNO = -1,
+    //JC=JB=JNAE vs JNC=JNB=JAE
+    JC = 2,
+    JB = 2,
+    JNAE = 2,
+    JNC = -2,
+    JNB = -2,
+    JAE = -2,
+    //JE=JZ vs JNE=JNZ
+    JE = 3,
+    JZ = 3,
+    JNE = -3,
+    JNZ = -3,
+    //JA=JNBE vs JNA=JBE
+    JA = 4,
+    JNBE = 4,
+    JNA = -4,
+    JBE = -4,
+    //JS vs JNS
+    JS = 5,
+    JNS = -5,
+    //JP=JPE vs JNP=JPO
+    JP = 6,
+    JPE = 6,
+    JNP = -6,
+    JPO = -6,
+    //JL=JNGE vs JNL=JGE
+    JL = 7,
+    JNGE = 7,
+    JNL = -7,
+    JGE = -7,
+    //JG=JNLE vs JNG=JLE
+    JG = 8,
+    JNLE = 8,
+    JNG = -8,
+    JLE = -8,
+    //others
+    JECXZ = 9,
+    JmpType = 10,
+    CallType = 11,
+    RetType = 12,
+};
+
+enum ARGUMENTS_TYPE
+{
+    NO_ARGUMENT = 0x10000000,
+    REGISTER_TYPE = 0x20000000,
+    MEMORY_TYPE = 0x40000000,
+    CONSTANT_TYPE = (int)0x80000000,
+
+    MMX_REG = 0x10000,
+    GENERAL_REG = 0x20000,
+    FPU_REG = 0x40000,
+    SSE_REG = 0x80000,
+    CR_REG = 0x100000,
+    DR_REG = 0x200000,
+    SPECIAL_REG = 0x400000,
+    MEMORY_MANAGEMENT_REG = 0x800000,
+    SEGMENT_REG = 0x1000000,
+
+    RELATIVE_ = 0x4000000,
+    ABSOLUTE_ = 0x8000000,
+
+    READ = 0x1,
+    WRITE = 0x2,
+
+    REG0 = 0x1,
+    REG1 = 0x2,
+    REG2 = 0x4,
+    REG3 = 0x8,
+    REG4 = 0x10,
+    REG5 = 0x20,
+    REG6 = 0x40,
+    REG7 = 0x80,
+    REG8 = 0x100,
+    REG9 = 0x200,
+    REG10 = 0x400,
+    REG11 = 0x800,
+    REG12 = 0x1000,
+    REG13 = 0x2000,
+    REG14 = 0x4000,
+    REG15 = 0x8000
+};
+
+enum SPECIAL_INFO
+{
+    UNKNOWN_OPCODE = -1,
+    OUT_OF_BLOCK = 0,
+
+    /* === mask = 0xff */
+    NoTabulation      = 0x00000000,
+    Tabulation        = 0x00000001,
+
+    /* === mask = 0xff00 */
+    MasmSyntax        = 0x00000000,
+    GoAsmSyntax       = 0x00000100,
+    NasmSyntax        = 0x00000200,
+    ATSyntax          = 0x00000400,
+
+    /* === mask = 0xff0000 */
+    PrefixedNumeral   = 0x00010000,
+    SuffixedNumeral   = 0x00020000,
+    NoformatNumeral   = 0x00030000,
+    CleanNumeral      = 0x00000000,
+
+    /* === mask = 0xff000000 */
+    ShowSegmentRegs   = 0x01000000
+};
+
+#ifdef __cplusplus
+extern "C"
+#endif
+
+BEA_API int __bea_callspec__ Disasm (LPDISASM pDisAsm);
+BEA_API const__ char* __bea_callspec__ BeaEngineVersion (void);
+BEA_API const__ char* __bea_callspec__ BeaEngineRevision (void);
+#if  defined(__cplusplus) && defined(__BORLANDC__)
+};
+using namespace BeaEngine;
+#endif
+#endif

src/pluginsdk/TitanEngine - Kopie/TitanEngine.hpp

@@ -0,0 +1,967 @@
+#ifndef TITANENGINE
+#define TITANENGINE
+
+#define TITCALL
+
+#if _MSC_VER > 1000
+#pragma once
+#endif
+
+#define WINVER 0x0500
+#define _WIN32_WINNT 0x0500
+
+#include <windows.h>
+
+#pragma pack(push, 1)
+
+// Global.Constant.Structure.Declaration:
+// Engine.External:
+#define UE_STRUCT_PE32STRUCT 1
+#define UE_STRUCT_PE64STRUCT 2
+#define UE_STRUCT_PESTRUCT 3
+#define UE_STRUCT_IMPORTENUMDATA 4
+#define UE_STRUCT_THREAD_ITEM_DATA 5
+#define UE_STRUCT_LIBRARY_ITEM_DATA 6
+#define UE_STRUCT_LIBRARY_ITEM_DATAW 7
+#define UE_STRUCT_PROCESS_ITEM_DATA 8
+#define UE_STRUCT_HANDLERARRAY 9
+#define UE_STRUCT_PLUGININFORMATION 10
+#define UE_STRUCT_HOOK_ENTRY 11
+#define UE_STRUCT_FILE_STATUS_INFO 12
+#define UE_STRUCT_FILE_FIX_INFO 13
+
+#define UE_ACCESS_READ 0
+#define UE_ACCESS_WRITE 1
+#define UE_ACCESS_ALL 2
+
+#define UE_HIDE_PEBONLY 0
+#define UE_HIDE_BASIC 1
+
+#define UE_PLUGIN_CALL_REASON_PREDEBUG 1
+#define UE_PLUGIN_CALL_REASON_EXCEPTION 2
+#define UE_PLUGIN_CALL_REASON_POSTDEBUG 3
+#define UE_PLUGIN_CALL_REASON_UNHANDLEDEXCEPTION 4
+
+#define TEE_HOOK_NRM_JUMP 1
+#define TEE_HOOK_NRM_CALL 3
+#define TEE_HOOK_IAT 5
+
+#define UE_ENGINE_ALOW_MODULE_LOADING 1
+#define UE_ENGINE_AUTOFIX_FORWARDERS 2
+#define UE_ENGINE_PASS_ALL_EXCEPTIONS 3
+#define UE_ENGINE_NO_CONSOLE_WINDOW 4
+#define UE_ENGINE_BACKUP_FOR_CRITICAL_FUNCTIONS 5
+#define UE_ENGINE_CALL_PLUGIN_CALLBACK 6
+#define UE_ENGINE_RESET_CUSTOM_HANDLER 7
+#define UE_ENGINE_CALL_PLUGIN_DEBUG_CALLBACK 8
+#define UE_ENGINE_SET_DEBUG_PRIVILEGE 9
+
+#define UE_OPTION_REMOVEALL 1
+#define UE_OPTION_DISABLEALL 2
+#define UE_OPTION_REMOVEALLDISABLED 3
+#define UE_OPTION_REMOVEALLENABLED 4
+
+#define UE_STATIC_DECRYPTOR_XOR 1
+#define UE_STATIC_DECRYPTOR_SUB 2
+#define UE_STATIC_DECRYPTOR_ADD 3
+
+#define UE_STATIC_DECRYPTOR_FOREWARD 1
+#define UE_STATIC_DECRYPTOR_BACKWARD 2
+
+#define UE_STATIC_KEY_SIZE_1 1
+#define UE_STATIC_KEY_SIZE_2 2
+#define UE_STATIC_KEY_SIZE_4 4
+#define UE_STATIC_KEY_SIZE_8 8
+
+#define UE_STATIC_APLIB 1
+#define UE_STATIC_APLIB_DEPACK 2
+#define UE_STATIC_LZMA 3
+
+#define UE_STATIC_HASH_MD5 1
+#define UE_STATIC_HASH_SHA1 2
+#define UE_STATIC_HASH_CRC32 3
+
+#define UE_RESOURCE_LANGUAGE_ANY -1
+
+#define UE_PE_OFFSET 0
+#define UE_IMAGEBASE 1
+#define UE_OEP 2
+#define UE_SIZEOFIMAGE 3
+#define UE_SIZEOFHEADERS 4
+#define UE_SIZEOFOPTIONALHEADER 5
+#define UE_SECTIONALIGNMENT 6
+#define UE_IMPORTTABLEADDRESS 7
+#define UE_IMPORTTABLESIZE 8
+#define UE_RESOURCETABLEADDRESS 9
+#define UE_RESOURCETABLESIZE 10
+#define UE_EXPORTTABLEADDRESS 11
+#define UE_EXPORTTABLESIZE 12
+#define UE_TLSTABLEADDRESS 13
+#define UE_TLSTABLESIZE 14
+#define UE_RELOCATIONTABLEADDRESS 15
+#define UE_RELOCATIONTABLESIZE 16
+#define UE_TIMEDATESTAMP 17
+#define UE_SECTIONNUMBER 18
+#define UE_CHECKSUM 19
+#define UE_SUBSYSTEM 20
+#define UE_CHARACTERISTICS 21
+#define UE_NUMBEROFRVAANDSIZES 22
+#define UE_BASEOFCODE 23
+#define UE_BASEOFDATA 24
+//leaving some enum space here for future additions
+#define UE_SECTIONNAME 40
+#define UE_SECTIONVIRTUALOFFSET 41
+#define UE_SECTIONVIRTUALSIZE 42
+#define UE_SECTIONRAWOFFSET 43
+#define UE_SECTIONRAWSIZE 44
+#define UE_SECTIONFLAGS 45
+
+#define UE_VANOTFOUND = -2;
+
+#define UE_CH_BREAKPOINT 1
+#define UE_CH_SINGLESTEP 2
+#define UE_CH_ACCESSVIOLATION 3
+#define UE_CH_ILLEGALINSTRUCTION 4
+#define UE_CH_NONCONTINUABLEEXCEPTION 5
+#define UE_CH_ARRAYBOUNDSEXCEPTION 6
+#define UE_CH_FLOATDENORMALOPERAND 7
+#define UE_CH_FLOATDEVIDEBYZERO 8
+#define UE_CH_INTEGERDEVIDEBYZERO 9
+#define UE_CH_INTEGEROVERFLOW 10
+#define UE_CH_PRIVILEGEDINSTRUCTION 11
+#define UE_CH_PAGEGUARD 12
+#define UE_CH_EVERYTHINGELSE 13
+#define UE_CH_CREATETHREAD 14
+#define UE_CH_EXITTHREAD 15
+#define UE_CH_CREATEPROCESS 16
+#define UE_CH_EXITPROCESS 17
+#define UE_CH_LOADDLL 18
+#define UE_CH_UNLOADDLL 19
+#define UE_CH_OUTPUTDEBUGSTRING 20
+#define UE_CH_AFTEREXCEPTIONPROCESSING 21
+#define UE_CH_SYSTEMBREAKPOINT 23
+#define UE_CH_UNHANDLEDEXCEPTION 24
+#define UE_CH_RIPEVENT 25
+#define UE_CH_DEBUGEVENT 26
+
+#define UE_OPTION_HANDLER_RETURN_HANDLECOUNT 1
+#define UE_OPTION_HANDLER_RETURN_ACCESS 2
+#define UE_OPTION_HANDLER_RETURN_FLAGS 3
+#define UE_OPTION_HANDLER_RETURN_TYPENAME 4
+
+#define UE_BREAKPOINT_INT3 1
+#define UE_BREAKPOINT_LONG_INT3 2
+#define UE_BREAKPOINT_UD2 3
+
+#define UE_BPXREMOVED 0
+#define UE_BPXACTIVE 1
+#define UE_BPXINACTIVE 2
+
+#define UE_BREAKPOINT 0
+#define UE_SINGLESHOOT 1
+#define UE_HARDWARE 2
+#define UE_MEMORY 3
+#define UE_MEMORY_READ 4
+#define UE_MEMORY_WRITE 5
+#define UE_MEMORY_EXECUTE 6
+#define UE_BREAKPOINT_TYPE_INT3 0x10000000
+#define UE_BREAKPOINT_TYPE_LONG_INT3 0x20000000
+#define UE_BREAKPOINT_TYPE_UD2 0x30000000
+
+#define UE_HARDWARE_EXECUTE 4
+#define UE_HARDWARE_WRITE 5
+#define UE_HARDWARE_READWRITE 6
+
+#define UE_HARDWARE_SIZE_1 7
+#define UE_HARDWARE_SIZE_2 8
+#define UE_HARDWARE_SIZE_4 9
+#define UE_HARDWARE_SIZE_8 10
+
+#define UE_ON_LIB_LOAD 1
+#define UE_ON_LIB_UNLOAD 2
+#define UE_ON_LIB_ALL 3
+
+#define UE_APISTART 0
+#define UE_APIEND 1
+
+#define UE_PLATFORM_x86 1
+#define UE_PLATFORM_x64 2
+#define UE_PLATFORM_ALL 3
+
+#define UE_FUNCTION_STDCALL 1
+#define UE_FUNCTION_CCALL 2
+#define UE_FUNCTION_FASTCALL 3
+#define UE_FUNCTION_STDCALL_RET 4
+#define UE_FUNCTION_CCALL_RET 5
+#define UE_FUNCTION_FASTCALL_RET 6
+#define UE_FUNCTION_STDCALL_CALL 7
+#define UE_FUNCTION_CCALL_CALL 8
+#define UE_FUNCTION_FASTCALL_CALL 9
+#define UE_PARAMETER_BYTE 0
+#define UE_PARAMETER_WORD 1
+#define UE_PARAMETER_DWORD 2
+#define UE_PARAMETER_QWORD 3
+#define UE_PARAMETER_PTR_BYTE 4
+#define UE_PARAMETER_PTR_WORD 5
+#define UE_PARAMETER_PTR_DWORD 6
+#define UE_PARAMETER_PTR_QWORD 7
+#define UE_PARAMETER_STRING 8
+#define UE_PARAMETER_UNICODE 9
+
+#define UE_EAX 1
+#define UE_EBX 2
+#define UE_ECX 3
+#define UE_EDX 4
+#define UE_EDI 5
+#define UE_ESI 6
+#define UE_EBP 7
+#define UE_ESP 8
+#define UE_EIP 9
+#define UE_EFLAGS 10
+#define UE_DR0 11
+#define UE_DR1 12
+#define UE_DR2 13
+#define UE_DR3 14
+#define UE_DR6 15
+#define UE_DR7 16
+#define UE_RAX 17
+#define UE_RBX 18
+#define UE_RCX 19
+#define UE_RDX 20
+#define UE_RDI 21
+#define UE_RSI 22
+#define UE_RBP 23
+#define UE_RSP 24
+#define UE_RIP 25
+#define UE_RFLAGS 26
+#define UE_R8 27
+#define UE_R9 28
+#define UE_R10 29
+#define UE_R11 30
+#define UE_R12 31
+#define UE_R13 32
+#define UE_R14 33
+#define UE_R15 34
+#define UE_CIP 35
+#define UE_CSP 36
+#ifdef _WIN64
+#define UE_CFLAGS UE_RFLAGS
+#else
+#define UE_CFLAGS UE_EFLAGS
+#endif
+#define UE_SEG_GS 37
+#define UE_SEG_FS 38
+#define UE_SEG_ES 39
+#define UE_SEG_DS 40
+#define UE_SEG_CS 41
+#define UE_SEG_SS 42
+
+typedef struct
+{
+    DWORD PE32Offset;
+    DWORD ImageBase;
+    DWORD OriginalEntryPoint;
+    DWORD BaseOfCode;
+    DWORD BaseOfData;
+    DWORD NtSizeOfImage;
+    DWORD NtSizeOfHeaders;
+    WORD SizeOfOptionalHeaders;
+    DWORD FileAlignment;
+    DWORD SectionAligment;
+    DWORD ImportTableAddress;
+    DWORD ImportTableSize;
+    DWORD ResourceTableAddress;
+    DWORD ResourceTableSize;
+    DWORD ExportTableAddress;
+    DWORD ExportTableSize;
+    DWORD TLSTableAddress;
+    DWORD TLSTableSize;
+    DWORD RelocationTableAddress;
+    DWORD RelocationTableSize;
+    DWORD TimeDateStamp;
+    WORD SectionNumber;
+    DWORD CheckSum;
+    WORD SubSystem;
+    WORD Characteristics;
+    DWORD NumberOfRvaAndSizes;
+} PE32Struct, *PPE32Struct;
+
+typedef struct
+{
+    DWORD PE64Offset;
+    DWORD64 ImageBase;
+    DWORD OriginalEntryPoint;
+    DWORD BaseOfCode;
+    DWORD BaseOfData;
+    DWORD NtSizeOfImage;
+    DWORD NtSizeOfHeaders;
+    WORD SizeOfOptionalHeaders;
+    DWORD FileAlignment;
+    DWORD SectionAligment;
+    DWORD ImportTableAddress;
+    DWORD ImportTableSize;
+    DWORD ResourceTableAddress;
+    DWORD ResourceTableSize;
+    DWORD ExportTableAddress;
+    DWORD ExportTableSize;
+    DWORD TLSTableAddress;
+    DWORD TLSTableSize;
+    DWORD RelocationTableAddress;
+    DWORD RelocationTableSize;
+    DWORD TimeDateStamp;
+    WORD SectionNumber;
+    DWORD CheckSum;
+    WORD SubSystem;
+    WORD Characteristics;
+    DWORD NumberOfRvaAndSizes;
+} PE64Struct, *PPE64Struct;
+
+#if defined(_WIN64)
+typedef PE64Struct PEStruct;
+#else
+typedef PE32Struct PEStruct;
+#endif
+
+typedef struct
+{
+    bool NewDll;
+    int NumberOfImports;
+    ULONG_PTR ImageBase;
+    ULONG_PTR BaseImportThunk;
+    ULONG_PTR ImportThunk;
+    char* APIName;
+    char* DLLName;
+} ImportEnumData, *PImportEnumData;
+
+typedef struct
+{
+    HANDLE hThread;
+    DWORD dwThreadId;
+    void* ThreadStartAddress;
+    void* ThreadLocalBase;
+    void* TebAddress;
+    ULONG WaitTime;
+    LONG Priority;
+    LONG BasePriority;
+    ULONG ContextSwitches;
+    ULONG ThreadState;
+    ULONG WaitReason;
+} THREAD_ITEM_DATA, *PTHREAD_ITEM_DATA;
+
+typedef struct
+{
+    HANDLE hFile;
+    void* BaseOfDll;
+    HANDLE hFileMapping;
+    void* hFileMappingView;
+    char szLibraryPath[MAX_PATH];
+    char szLibraryName[MAX_PATH];
+} LIBRARY_ITEM_DATA, *PLIBRARY_ITEM_DATA;
+
+typedef struct
+{
+    HANDLE hFile;
+    void* BaseOfDll;
+    HANDLE hFileMapping;
+    void* hFileMappingView;
+    wchar_t szLibraryPath[MAX_PATH];
+    wchar_t szLibraryName[MAX_PATH];
+} LIBRARY_ITEM_DATAW, *PLIBRARY_ITEM_DATAW;
+
+typedef struct
+{
+    HANDLE hProcess;
+    DWORD dwProcessId;
+    HANDLE hThread;
+    DWORD dwThreadId;
+    HANDLE hFile;
+    void* BaseOfImage;
+    void* ThreadStartAddress;
+    void* ThreadLocalBase;
+} PROCESS_ITEM_DATA, *PPROCESS_ITEM_DATA;
+
+typedef struct
+{
+    ULONG ProcessId;
+    HANDLE hHandle;
+} HandlerArray, *PHandlerArray;
+
+typedef struct
+{
+    char PluginName[64];
+    DWORD PluginMajorVersion;
+    DWORD PluginMinorVersion;
+    HMODULE PluginBaseAddress;
+    void* TitanDebuggingCallBack;
+    void* TitanRegisterPlugin;
+    void* TitanReleasePlugin;
+    void* TitanResetPlugin;
+    bool PluginDisabled;
+} PluginInformation, *PPluginInformation;
+
+#define TEE_MAXIMUM_HOOK_SIZE 14
+#define TEE_MAXIMUM_HOOK_RELOCS 7
+#if defined(_WIN64)
+#define TEE_MAXIMUM_HOOK_INSERT_SIZE 14
+#else
+#define TEE_MAXIMUM_HOOK_INSERT_SIZE 5
+#endif
+
+typedef struct HOOK_ENTRY
+{
+    bool IATHook;
+    BYTE HookType;
+    DWORD HookSize;
+    void* HookAddress;
+    void* RedirectionAddress;
+    BYTE HookBytes[TEE_MAXIMUM_HOOK_SIZE];
+    BYTE OriginalBytes[TEE_MAXIMUM_HOOK_SIZE];
+    void* IATHookModuleBase;
+    DWORD IATHookNameHash;
+    bool HookIsEnabled;
+    bool HookIsRemote;
+    void* PatchedEntry;
+    DWORD RelocationInfo[TEE_MAXIMUM_HOOK_RELOCS];
+    int RelocationCount;
+} HOOK_ENTRY, *PHOOK_ENTRY;
+
+#define UE_DEPTH_SURFACE 0
+#define UE_DEPTH_DEEP 1
+
+#define UE_UNPACKER_CONDITION_SEARCH_FROM_EP 1
+
+#define UE_UNPACKER_CONDITION_LOADLIBRARY 1
+#define UE_UNPACKER_CONDITION_GETPROCADDRESS 2
+#define UE_UNPACKER_CONDITION_ENTRYPOINTBREAK 3
+#define UE_UNPACKER_CONDITION_RELOCSNAPSHOT1 4
+#define UE_UNPACKER_CONDITION_RELOCSNAPSHOT2 5
+
+#define UE_FIELD_OK 0
+#define UE_FIELD_BROKEN_NON_FIXABLE 1
+#define UE_FIELD_BROKEN_NON_CRITICAL 2
+#define UE_FIELD_BROKEN_FIXABLE_FOR_STATIC_USE 3
+#define UE_FIELD_BROKEN_BUT_CAN_BE_EMULATED 4
+#define UE_FIELD_FIXABLE_NON_CRITICAL 5
+#define UE_FIELD_FIXABLE_CRITICAL 6
+#define UE_FIELD_NOT_PRESET 7
+#define UE_FIELD_NOT_PRESET_WARNING 8
+
+#define UE_RESULT_FILE_OK 10
+#define UE_RESULT_FILE_INVALID_BUT_FIXABLE 11
+#define UE_RESULT_FILE_INVALID_AND_NON_FIXABLE 12
+#define UE_RESULT_FILE_INVALID_FORMAT 13
+
+typedef struct
+{
+    BYTE OveralEvaluation;
+    bool EvaluationTerminatedByException;
+    bool FileIs64Bit;
+    bool FileIsDLL;
+    bool FileIsConsole;
+    bool MissingDependencies;
+    bool MissingDeclaredAPIs;
+    BYTE SignatureMZ;
+    BYTE SignaturePE;
+    BYTE EntryPoint;
+    BYTE ImageBase;
+    BYTE SizeOfImage;
+    BYTE FileAlignment;
+    BYTE SectionAlignment;
+    BYTE ExportTable;
+    BYTE RelocationTable;
+    BYTE ImportTable;
+    BYTE ImportTableSection;
+    BYTE ImportTableData;
+    BYTE IATTable;
+    BYTE TLSTable;
+    BYTE LoadConfigTable;
+    BYTE BoundImportTable;
+    BYTE COMHeaderTable;
+    BYTE ResourceTable;
+    BYTE ResourceData;
+    BYTE SectionTable;
+} FILE_STATUS_INFO, *PFILE_STATUS_INFO;
+
+typedef struct
+{
+    BYTE OveralEvaluation;
+    bool FixingTerminatedByException;
+    bool FileFixPerformed;
+    bool StrippedRelocation;
+    bool DontFixRelocations;
+    DWORD OriginalRelocationTableAddress;
+    DWORD OriginalRelocationTableSize;
+    bool StrippedExports;
+    bool DontFixExports;
+    DWORD OriginalExportTableAddress;
+    DWORD OriginalExportTableSize;
+    bool StrippedResources;
+    bool DontFixResources;
+    DWORD OriginalResourceTableAddress;
+    DWORD OriginalResourceTableSize;
+    bool StrippedTLS;
+    bool DontFixTLS;
+    DWORD OriginalTLSTableAddress;
+    DWORD OriginalTLSTableSize;
+    bool StrippedLoadConfig;
+    bool DontFixLoadConfig;
+    DWORD OriginalLoadConfigTableAddress;
+    DWORD OriginalLoadConfigTableSize;
+    bool StrippedBoundImports;
+    bool DontFixBoundImports;
+    DWORD OriginalBoundImportTableAddress;
+    DWORD OriginalBoundImportTableSize;
+    bool StrippedIAT;
+    bool DontFixIAT;
+    DWORD OriginalImportAddressTableAddress;
+    DWORD OriginalImportAddressTableSize;
+    bool StrippedCOM;
+    bool DontFixCOM;
+    DWORD OriginalCOMTableAddress;
+    DWORD OriginalCOMTableSize;
+} FILE_FIX_INFO, *PFILE_FIX_INFO;
+
+#ifdef __cplusplus
+extern "C"
+{
+#endif
+
+// Global.Function.Declaration:
+// TitanEngine.Dumper.functions:
+__declspec(dllexport) bool TITCALL DumpProcess(HANDLE hProcess, LPVOID ImageBase, char* szDumpFileName, ULONG_PTR EntryPoint);
+__declspec(dllexport) bool TITCALL DumpProcessW(HANDLE hProcess, LPVOID ImageBase, wchar_t* szDumpFileName, ULONG_PTR EntryPoint);
+__declspec(dllexport) bool TITCALL DumpProcessEx(DWORD ProcessId, LPVOID ImageBase, char* szDumpFileName, ULONG_PTR EntryPoint);
+__declspec(dllexport) bool TITCALL DumpProcessExW(DWORD ProcessId, LPVOID ImageBase, wchar_t* szDumpFileName, ULONG_PTR EntryPoint);
+__declspec(dllexport) bool TITCALL DumpMemory(HANDLE hProcess, LPVOID MemoryStart, ULONG_PTR MemorySize, char* szDumpFileName);
+__declspec(dllexport) bool TITCALL DumpMemoryW(HANDLE hProcess, LPVOID MemoryStart, ULONG_PTR MemorySize, wchar_t* szDumpFileName);
+__declspec(dllexport) bool TITCALL DumpMemoryEx(DWORD ProcessId, LPVOID MemoryStart, ULONG_PTR MemorySize, char* szDumpFileName);
+__declspec(dllexport) bool TITCALL DumpMemoryExW(DWORD ProcessId, LPVOID MemoryStart, ULONG_PTR MemorySize, wchar_t* szDumpFileName);
+__declspec(dllexport) bool TITCALL DumpRegions(HANDLE hProcess, char* szDumpFolder, bool DumpAboveImageBaseOnly);
+__declspec(dllexport) bool TITCALL DumpRegionsW(HANDLE hProcess, wchar_t* szDumpFolder, bool DumpAboveImageBaseOnly);
+__declspec(dllexport) bool TITCALL DumpRegionsEx(DWORD ProcessId, char* szDumpFolder, bool DumpAboveImageBaseOnly);
+__declspec(dllexport) bool TITCALL DumpRegionsExW(DWORD ProcessId, wchar_t* szDumpFolder, bool DumpAboveImageBaseOnly);
+__declspec(dllexport) bool TITCALL DumpModule(HANDLE hProcess, LPVOID ModuleBase, char* szDumpFileName);
+__declspec(dllexport) bool TITCALL DumpModuleW(HANDLE hProcess, LPVOID ModuleBase, wchar_t* szDumpFileName);
+__declspec(dllexport) bool TITCALL DumpModuleEx(DWORD ProcessId, LPVOID ModuleBase, char* szDumpFileName);
+__declspec(dllexport) bool TITCALL DumpModuleExW(DWORD ProcessId, LPVOID ModuleBase, wchar_t* szDumpFileName);
+__declspec(dllexport) bool TITCALL PastePEHeader(HANDLE hProcess, LPVOID ImageBase, char* szDebuggedFileName);
+__declspec(dllexport) bool TITCALL PastePEHeaderW(HANDLE hProcess, LPVOID ImageBase, wchar_t* szDebuggedFileName);
+__declspec(dllexport) bool TITCALL ExtractSection(char* szFileName, char* szDumpFileName, DWORD SectionNumber);
+__declspec(dllexport) bool TITCALL ExtractSectionW(wchar_t* szFileName, wchar_t* szDumpFileName, DWORD SectionNumber);
+__declspec(dllexport) bool TITCALL ResortFileSections(char* szFileName);
+__declspec(dllexport) bool TITCALL ResortFileSectionsW(wchar_t* szFileName);
+__declspec(dllexport) bool TITCALL FindOverlay(char* szFileName, LPDWORD OverlayStart, LPDWORD OverlaySize);
+__declspec(dllexport) bool TITCALL FindOverlayW(wchar_t* szFileName, LPDWORD OverlayStart, LPDWORD OverlaySize);
+__declspec(dllexport) bool TITCALL ExtractOverlay(char* szFileName, char* szExtactedFileName);
+__declspec(dllexport) bool TITCALL ExtractOverlayW(wchar_t* szFileName, wchar_t* szExtactedFileName);
+__declspec(dllexport) bool TITCALL AddOverlay(char* szFileName, char* szOverlayFileName);
+__declspec(dllexport) bool TITCALL AddOverlayW(wchar_t* szFileName, wchar_t* szOverlayFileName);
+__declspec(dllexport) bool TITCALL CopyOverlay(char* szInFileName, char* szOutFileName);
+__declspec(dllexport) bool TITCALL CopyOverlayW(wchar_t* szInFileName, wchar_t* szOutFileName);
+__declspec(dllexport) bool TITCALL RemoveOverlay(char* szFileName);
+__declspec(dllexport) bool TITCALL RemoveOverlayW(wchar_t* szFileName);
+__declspec(dllexport) bool TITCALL MakeAllSectionsRWE(char* szFileName);
+__declspec(dllexport) bool TITCALL MakeAllSectionsRWEW(wchar_t* szFileName);
+__declspec(dllexport) long TITCALL AddNewSectionEx(char* szFileName, char* szSectionName, DWORD SectionSize, DWORD SectionAttributes, LPVOID SectionContent, DWORD ContentSize);
+__declspec(dllexport) long TITCALL AddNewSectionExW(wchar_t* szFileName, char* szSectionName, DWORD SectionSize, DWORD SectionAttributes, LPVOID SectionContent, DWORD ContentSize);
+__declspec(dllexport) long TITCALL AddNewSection(char* szFileName, char* szSectionName, DWORD SectionSize);
+__declspec(dllexport) long TITCALL AddNewSectionW(wchar_t* szFileName, char* szSectionName, DWORD SectionSize);
+__declspec(dllexport) bool TITCALL ResizeLastSection(char* szFileName, DWORD NumberOfExpandBytes, bool AlignResizeData);
+__declspec(dllexport) bool TITCALL ResizeLastSectionW(wchar_t* szFileName, DWORD NumberOfExpandBytes, bool AlignResizeData);
+__declspec(dllexport) void TITCALL SetSharedOverlay(char* szFileName);
+__declspec(dllexport) void TITCALL SetSharedOverlayW(wchar_t* szFileName);
+__declspec(dllexport) char* TITCALL GetSharedOverlay();
+__declspec(dllexport) wchar_t* TITCALL GetSharedOverlayW();
+__declspec(dllexport) bool TITCALL DeleteLastSection(char* szFileName);
+__declspec(dllexport) bool TITCALL DeleteLastSectionW(wchar_t* szFileName);
+__declspec(dllexport) bool TITCALL DeleteLastSectionEx(char* szFileName, DWORD NumberOfSections);
+__declspec(dllexport) bool TITCALL DeleteLastSectionExW(wchar_t* szFileName, DWORD NumberOfSections);
+__declspec(dllexport) ULONG_PTR TITCALL GetPE32DataFromMappedFile(ULONG_PTR FileMapVA, DWORD WhichSection, DWORD WhichData);
+__declspec(dllexport) ULONG_PTR TITCALL GetPE32Data(char* szFileName, DWORD WhichSection, DWORD WhichData);
+__declspec(dllexport) ULONG_PTR TITCALL GetPE32DataW(wchar_t* szFileName, DWORD WhichSection, DWORD WhichData);
+__declspec(dllexport) bool TITCALL GetPE32DataFromMappedFileEx(ULONG_PTR FileMapVA, LPVOID DataStorage);
+__declspec(dllexport) bool TITCALL GetPE32DataEx(char* szFileName, LPVOID DataStorage);
+__declspec(dllexport) bool TITCALL GetPE32DataExW(wchar_t* szFileName, LPVOID DataStorage);
+__declspec(dllexport) bool TITCALL SetPE32DataForMappedFile(ULONG_PTR FileMapVA, DWORD WhichSection, DWORD WhichData, ULONG_PTR NewDataValue);
+__declspec(dllexport) bool TITCALL SetPE32Data(char* szFileName, DWORD WhichSection, DWORD WhichData, ULONG_PTR NewDataValue);
+__declspec(dllexport) bool TITCALL SetPE32DataW(wchar_t* szFileName, DWORD WhichSection, DWORD WhichData, ULONG_PTR NewDataValue);
+__declspec(dllexport) bool TITCALL SetPE32DataForMappedFileEx(ULONG_PTR FileMapVA, LPVOID DataStorage);
+__declspec(dllexport) bool TITCALL SetPE32DataEx(char* szFileName, LPVOID DataStorage);
+__declspec(dllexport) bool TITCALL SetPE32DataExW(wchar_t* szFileName, LPVOID DataStorage);
+__declspec(dllexport) long TITCALL GetPE32SectionNumberFromVA(ULONG_PTR FileMapVA, ULONG_PTR AddressToConvert);
+__declspec(dllexport) ULONG_PTR TITCALL ConvertVAtoFileOffset(ULONG_PTR FileMapVA, ULONG_PTR AddressToConvert, bool ReturnType);
+__declspec(dllexport) ULONG_PTR TITCALL ConvertVAtoFileOffsetEx(ULONG_PTR FileMapVA, DWORD FileSize, ULONG_PTR ImageBase, ULONG_PTR AddressToConvert, bool AddressIsRVA, bool ReturnType);
+__declspec(dllexport) ULONG_PTR TITCALL ConvertFileOffsetToVA(ULONG_PTR FileMapVA, ULONG_PTR AddressToConvert, bool ReturnType);
+__declspec(dllexport) ULONG_PTR TITCALL ConvertFileOffsetToVAEx(ULONG_PTR FileMapVA, DWORD FileSize, ULONG_PTR ImageBase, ULONG_PTR AddressToConvert, bool ReturnType);
+__declspec(dllexport) bool TITCALL MemoryReadSafe(HANDLE hProcess, LPVOID lpBaseAddress, LPVOID lpBuffer, SIZE_T nSize, SIZE_T * lpNumberOfBytesRead);
+__declspec(dllexport) bool TITCALL MemoryWriteSafe(HANDLE hProcess, LPVOID lpBaseAddress, LPCVOID lpBuffer, SIZE_T nSize, SIZE_T * lpNumberOfBytesWritten);
+// TitanEngine.Realigner.functions:
+__declspec(dllexport) bool TITCALL FixHeaderCheckSum(char* szFileName);
+__declspec(dllexport) bool TITCALL FixHeaderCheckSumW(wchar_t* szFileName);
+__declspec(dllexport) long TITCALL RealignPE(ULONG_PTR FileMapVA, DWORD FileSize, DWORD RealingMode);
+__declspec(dllexport) long TITCALL RealignPEEx(char* szFileName, DWORD RealingFileSize, DWORD ForcedFileAlignment);
+__declspec(dllexport) long TITCALL RealignPEExW(wchar_t* szFileName, DWORD RealingFileSize, DWORD ForcedFileAlignment);
+__declspec(dllexport) bool TITCALL WipeSection(char* szFileName, int WipeSectionNumber, bool RemovePhysically);
+__declspec(dllexport) bool TITCALL WipeSectionW(wchar_t* szFileName, int WipeSectionNumber, bool RemovePhysically);
+__declspec(dllexport) bool TITCALL IsPE32FileValidEx(char* szFileName, DWORD CheckDepth, LPVOID FileStatusInfo);
+__declspec(dllexport) bool TITCALL IsPE32FileValidExW(wchar_t* szFileName, DWORD CheckDepth, LPVOID FileStatusInfo);
+__declspec(dllexport) bool TITCALL FixBrokenPE32FileEx(char* szFileName, LPVOID FileStatusInfo, LPVOID FileFixInfo);
+__declspec(dllexport) bool TITCALL FixBrokenPE32FileExW(wchar_t* szFileName, LPVOID FileStatusInfo, LPVOID FileFixInfo);
+__declspec(dllexport) bool TITCALL IsFileDLL(char* szFileName, ULONG_PTR FileMapVA);
+__declspec(dllexport) bool TITCALL IsFileDLLW(wchar_t* szFileName, ULONG_PTR FileMapVA);
+// TitanEngine.Hider.functions:
+__declspec(dllexport) void* TITCALL GetPEBLocation(HANDLE hProcess);
+__declspec(dllexport) void* TITCALL GetPEBLocation64(HANDLE hProcess);
+__declspec(dllexport) void* TITCALL GetTEBLocation(HANDLE hThread);
+__declspec(dllexport) void* TITCALL GetTEBLocation64(HANDLE hThread);
+__declspec(dllexport) bool TITCALL HideDebugger(HANDLE hProcess, DWORD PatchAPILevel);
+__declspec(dllexport) bool TITCALL UnHideDebugger(HANDLE hProcess, DWORD PatchAPILevel);
+// TitanEngine.Relocater.functions:
+__declspec(dllexport) void TITCALL RelocaterCleanup();
+__declspec(dllexport) void TITCALL RelocaterInit(DWORD MemorySize, ULONG_PTR OldImageBase, ULONG_PTR NewImageBase);
+__declspec(dllexport) void TITCALL RelocaterAddNewRelocation(HANDLE hProcess, ULONG_PTR RelocateAddress, DWORD RelocateState);
+__declspec(dllexport) long TITCALL RelocaterEstimatedSize();
+__declspec(dllexport) bool TITCALL RelocaterExportRelocation(ULONG_PTR StorePlace, DWORD StorePlaceRVA, ULONG_PTR FileMapVA);
+__declspec(dllexport) bool TITCALL RelocaterExportRelocationEx(char* szFileName, char* szSectionName);
+__declspec(dllexport) bool TITCALL RelocaterExportRelocationExW(wchar_t* szFileName, char* szSectionName);
+__declspec(dllexport) bool TITCALL RelocaterGrabRelocationTable(HANDLE hProcess, ULONG_PTR MemoryStart, DWORD MemorySize);
+__declspec(dllexport) bool TITCALL RelocaterGrabRelocationTableEx(HANDLE hProcess, ULONG_PTR MemoryStart, ULONG_PTR MemorySize, DWORD NtSizeOfImage);
+__declspec(dllexport) bool TITCALL RelocaterMakeSnapshot(HANDLE hProcess, char* szSaveFileName, LPVOID MemoryStart, ULONG_PTR MemorySize);
+__declspec(dllexport) bool TITCALL RelocaterMakeSnapshotW(HANDLE hProcess, wchar_t* szSaveFileName, LPVOID MemoryStart, ULONG_PTR MemorySize);
+__declspec(dllexport) bool TITCALL RelocaterCompareTwoSnapshots(HANDLE hProcess, ULONG_PTR LoadedImageBase, ULONG_PTR NtSizeOfImage, char* szDumpFile1, char* szDumpFile2, ULONG_PTR MemStart);
+__declspec(dllexport) bool TITCALL RelocaterCompareTwoSnapshotsW(HANDLE hProcess, ULONG_PTR LoadedImageBase, ULONG_PTR NtSizeOfImage, wchar_t* szDumpFile1, wchar_t* szDumpFile2, ULONG_PTR MemStart);
+__declspec(dllexport) bool TITCALL RelocaterChangeFileBase(char* szFileName, ULONG_PTR NewImageBase);
+__declspec(dllexport) bool TITCALL RelocaterChangeFileBaseW(wchar_t* szFileName, ULONG_PTR NewImageBase);
+__declspec(dllexport) bool TITCALL RelocaterRelocateMemoryBlock(ULONG_PTR FileMapVA, ULONG_PTR MemoryLocation, void* RelocateMemory, DWORD RelocateMemorySize, ULONG_PTR CurrentLoadedBase, ULONG_PTR RelocateBase);
+__declspec(dllexport) bool TITCALL RelocaterWipeRelocationTable(char* szFileName);
+__declspec(dllexport) bool TITCALL RelocaterWipeRelocationTableW(wchar_t* szFileName);
+// TitanEngine.Resourcer.functions:
+__declspec(dllexport) ULONG_PTR TITCALL ResourcerLoadFileForResourceUse(char* szFileName);
+__declspec(dllexport) ULONG_PTR TITCALL ResourcerLoadFileForResourceUseW(wchar_t* szFileName);
+__declspec(dllexport) bool TITCALL ResourcerFreeLoadedFile(LPVOID LoadedFileBase);
+__declspec(dllexport) bool TITCALL ResourcerExtractResourceFromFileEx(ULONG_PTR FileMapVA, char* szResourceType, char* szResourceName, char* szExtractedFileName);
+__declspec(dllexport) bool TITCALL ResourcerExtractResourceFromFile(char* szFileName, char* szResourceType, char* szResourceName, char* szExtractedFileName);
+__declspec(dllexport) bool TITCALL ResourcerExtractResourceFromFileW(wchar_t* szFileName, char* szResourceType, char* szResourceName, char* szExtractedFileName);
+__declspec(dllexport) bool TITCALL ResourcerFindResource(char* szFileName, char* szResourceType, DWORD ResourceType, char* szResourceName, DWORD ResourceName, DWORD ResourceLanguage, PULONG_PTR pResourceData, LPDWORD pResourceSize);
+__declspec(dllexport) bool TITCALL ResourcerFindResourceW(wchar_t* szFileName, wchar_t* szResourceType, DWORD ResourceType, wchar_t* szResourceName, DWORD ResourceName, DWORD ResourceLanguage, PULONG_PTR pResourceData, LPDWORD pResourceSize);
+__declspec(dllexport) bool TITCALL ResourcerFindResourceEx(ULONG_PTR FileMapVA, DWORD FileSize, wchar_t* szResourceType, DWORD ResourceType, wchar_t* szResourceName, DWORD ResourceName, DWORD ResourceLanguage, PULONG_PTR pResourceData, LPDWORD pResourceSize);
+__declspec(dllexport) void TITCALL ResourcerEnumerateResource(char* szFileName, void* CallBack);
+__declspec(dllexport) void TITCALL ResourcerEnumerateResourceW(wchar_t* szFileName, void* CallBack);
+__declspec(dllexport) void TITCALL ResourcerEnumerateResourceEx(ULONG_PTR FileMapVA, DWORD FileSize, void* CallBack);
+// TitanEngine.Threader.functions:
+__declspec(dllexport) bool TITCALL ThreaderImportRunningThreadData(DWORD ProcessId);
+__declspec(dllexport) void* TITCALL ThreaderGetThreadInfo(HANDLE hThread, DWORD ThreadId);
+__declspec(dllexport) void TITCALL ThreaderEnumThreadInfo(void* EnumCallBack);
+__declspec(dllexport) bool TITCALL ThreaderPauseThread(HANDLE hThread);
+__declspec(dllexport) bool TITCALL ThreaderResumeThread(HANDLE hThread);
+__declspec(dllexport) bool TITCALL ThreaderTerminateThread(HANDLE hThread, DWORD ThreadExitCode);
+__declspec(dllexport) bool TITCALL ThreaderPauseAllThreads(bool LeaveMainRunning);
+__declspec(dllexport) bool TITCALL ThreaderResumeAllThreads(bool LeaveMainPaused);
+__declspec(dllexport) bool TITCALL ThreaderPauseProcess();
+__declspec(dllexport) bool TITCALL ThreaderResumeProcess();
+__declspec(dllexport) ULONG_PTR TITCALL ThreaderCreateRemoteThread(ULONG_PTR ThreadStartAddress, bool AutoCloseTheHandle, LPVOID ThreadPassParameter, LPDWORD ThreadId);
+__declspec(dllexport) bool TITCALL ThreaderInjectAndExecuteCode(LPVOID InjectCode, DWORD StartDelta, DWORD InjectSize);
+__declspec(dllexport) ULONG_PTR TITCALL ThreaderCreateRemoteThreadEx(HANDLE hProcess, ULONG_PTR ThreadStartAddress, bool AutoCloseTheHandle, LPVOID ThreadPassParameter, LPDWORD ThreadId);
+__declspec(dllexport) bool TITCALL ThreaderInjectAndExecuteCodeEx(HANDLE hProcess, LPVOID InjectCode, DWORD StartDelta, DWORD InjectSize);
+__declspec(dllexport) void TITCALL ThreaderSetCallBackForNextExitThreadEvent(LPVOID exitThreadCallBack);
+__declspec(dllexport) bool TITCALL ThreaderIsThreadStillRunning(HANDLE hThread);
+__declspec(dllexport) bool TITCALL ThreaderIsThreadActive(HANDLE hThread);
+__declspec(dllexport) bool TITCALL ThreaderIsAnyThreadActive();
+__declspec(dllexport) bool TITCALL ThreaderExecuteOnlyInjectedThreads();
+__declspec(dllexport) ULONG_PTR TITCALL ThreaderGetOpenHandleForThread(DWORD ThreadId);
+__declspec(dllexport) bool TITCALL ThreaderIsExceptionInMainThread();
+// TitanEngine.Debugger.functions:
+__declspec(dllexport) void* TITCALL StaticDisassembleEx(ULONG_PTR DisassmStart, LPVOID DisassmAddress);
+__declspec(dllexport) void* TITCALL StaticDisassemble(LPVOID DisassmAddress);
+__declspec(dllexport) void* TITCALL DisassembleEx(HANDLE hProcess, LPVOID DisassmAddress, bool ReturnInstructionType);
+__declspec(dllexport) void* TITCALL Disassemble(LPVOID DisassmAddress);
+__declspec(dllexport) long TITCALL StaticLengthDisassemble(LPVOID DisassmAddress);
+__declspec(dllexport) long TITCALL LengthDisassembleEx(HANDLE hProcess, LPVOID DisassmAddress);
+__declspec(dllexport) long TITCALL LengthDisassemble(LPVOID DisassmAddress);
+__declspec(dllexport) void* TITCALL InitDebug(char* szFileName, char* szCommandLine, char* szCurrentFolder);
+__declspec(dllexport) void* TITCALL InitDebugW(wchar_t* szFileName, wchar_t* szCommandLine, wchar_t* szCurrentFolder);
+__declspec(dllexport) void* TITCALL InitDebugEx(char* szFileName, char* szCommandLine, char* szCurrentFolder, LPVOID EntryCallBack);
+__declspec(dllexport) void* TITCALL InitDebugExW(wchar_t* szFileName, wchar_t* szCommandLine, wchar_t* szCurrentFolder, LPVOID EntryCallBack);
+__declspec(dllexport) void* TITCALL InitDLLDebug(char* szFileName, bool ReserveModuleBase, char* szCommandLine, char* szCurrentFolder, LPVOID EntryCallBack);
+__declspec(dllexport) void* TITCALL InitDLLDebugW(wchar_t* szFileName, bool ReserveModuleBase, wchar_t* szCommandLine, wchar_t* szCurrentFolder, LPVOID EntryCallBack);
+__declspec(dllexport) bool TITCALL StopDebug();
+__declspec(dllexport) void TITCALL SetBPXOptions(long DefaultBreakPointType);
+__declspec(dllexport) bool TITCALL IsBPXEnabled(ULONG_PTR bpxAddress);
+__declspec(dllexport) bool TITCALL EnableBPX(ULONG_PTR bpxAddress);
+__declspec(dllexport) bool TITCALL DisableBPX(ULONG_PTR bpxAddress);
+__declspec(dllexport) bool TITCALL SetBPX(ULONG_PTR bpxAddress, DWORD bpxType, LPVOID bpxCallBack);
+__declspec(dllexport) bool TITCALL DeleteBPX(ULONG_PTR bpxAddress);
+__declspec(dllexport) bool TITCALL SafeDeleteBPX(ULONG_PTR bpxAddress);
+__declspec(dllexport) bool TITCALL SetAPIBreakPoint(const char* szDLLName, const char* szAPIName, DWORD bpxType, DWORD bpxPlace, LPVOID bpxCallBack);
+__declspec(dllexport) bool TITCALL DeleteAPIBreakPoint(const char* szDLLName, const char* szAPIName, DWORD bpxPlace);
+__declspec(dllexport) bool TITCALL SafeDeleteAPIBreakPoint(const char* szDLLName, const char* szAPIName, DWORD bpxPlace);
+__declspec(dllexport) bool TITCALL SetMemoryBPX(ULONG_PTR MemoryStart, SIZE_T SizeOfMemory, LPVOID bpxCallBack);
+__declspec(dllexport) bool TITCALL SetMemoryBPXEx(ULONG_PTR MemoryStart, SIZE_T SizeOfMemory, DWORD BreakPointType, bool RestoreOnHit, LPVOID bpxCallBack);
+__declspec(dllexport) bool TITCALL RemoveMemoryBPX(ULONG_PTR MemoryStart, SIZE_T SizeOfMemory);
+__declspec(dllexport) bool TITCALL GetContextFPUDataEx(HANDLE hActiveThread, void* FPUSaveArea);
+__declspec(dllexport) ULONG_PTR TITCALL GetContextDataEx(HANDLE hActiveThread, DWORD IndexOfRegister);
+__declspec(dllexport) ULONG_PTR TITCALL GetContextData(DWORD IndexOfRegister);
+__declspec(dllexport) bool TITCALL SetContextFPUDataEx(HANDLE hActiveThread, void* FPUSaveArea);
+__declspec(dllexport) bool TITCALL SetContextDataEx(HANDLE hActiveThread, DWORD IndexOfRegister, ULONG_PTR NewRegisterValue);
+__declspec(dllexport) bool TITCALL SetContextData(DWORD IndexOfRegister, ULONG_PTR NewRegisterValue);
+__declspec(dllexport) void TITCALL ClearExceptionNumber();
+__declspec(dllexport) long TITCALL CurrentExceptionNumber();
+__declspec(dllexport) bool TITCALL MatchPatternEx(HANDLE hProcess, void* MemoryToCheck, int SizeOfMemoryToCheck, void* PatternToMatch, int SizeOfPatternToMatch, PBYTE WildCard);
+__declspec(dllexport) bool TITCALL MatchPattern(void* MemoryToCheck, int SizeOfMemoryToCheck, void* PatternToMatch, int SizeOfPatternToMatch, PBYTE WildCard);
+__declspec(dllexport) ULONG_PTR TITCALL FindEx(HANDLE hProcess, LPVOID MemoryStart, DWORD MemorySize, LPVOID SearchPattern, DWORD PatternSize, LPBYTE WildCard);
+extern "C" __declspec(dllexport) ULONG_PTR TITCALL Find(LPVOID MemoryStart, DWORD MemorySize, LPVOID SearchPattern, DWORD PatternSize, LPBYTE WildCard);
+__declspec(dllexport) bool TITCALL FillEx(HANDLE hProcess, LPVOID MemoryStart, DWORD MemorySize, PBYTE FillByte);
+__declspec(dllexport) bool TITCALL Fill(LPVOID MemoryStart, DWORD MemorySize, PBYTE FillByte);
+__declspec(dllexport) bool TITCALL PatchEx(HANDLE hProcess, LPVOID MemoryStart, DWORD MemorySize, LPVOID ReplacePattern, DWORD ReplaceSize, bool AppendNOP, bool PrependNOP);
+__declspec(dllexport) bool TITCALL Patch(LPVOID MemoryStart, DWORD MemorySize, LPVOID ReplacePattern, DWORD ReplaceSize, bool AppendNOP, bool PrependNOP);
+__declspec(dllexport) bool TITCALL ReplaceEx(HANDLE hProcess, LPVOID MemoryStart, DWORD MemorySize, LPVOID SearchPattern, DWORD PatternSize, DWORD NumberOfRepetitions, LPVOID ReplacePattern, DWORD ReplaceSize, PBYTE WildCard);
+__declspec(dllexport) bool TITCALL Replace(LPVOID MemoryStart, DWORD MemorySize, LPVOID SearchPattern, DWORD PatternSize, DWORD NumberOfRepetitions, LPVOID ReplacePattern, DWORD ReplaceSize, PBYTE WildCard);
+__declspec(dllexport) void* TITCALL GetDebugData();
+__declspec(dllexport) void* TITCALL GetTerminationData();
+__declspec(dllexport) long TITCALL GetExitCode();
+__declspec(dllexport) ULONG_PTR TITCALL GetDebuggedDLLBaseAddress();
+__declspec(dllexport) ULONG_PTR TITCALL GetDebuggedFileBaseAddress();
+__declspec(dllexport) bool TITCALL GetRemoteString(HANDLE hProcess, LPVOID StringAddress, LPVOID StringStorage, int MaximumStringSize);
+__declspec(dllexport) ULONG_PTR TITCALL GetFunctionParameter(HANDLE hProcess, DWORD FunctionType, DWORD ParameterNumber, DWORD ParameterType);
+__declspec(dllexport) ULONG_PTR TITCALL GetJumpDestinationEx(HANDLE hProcess, ULONG_PTR InstructionAddress, bool JustJumps);
+__declspec(dllexport) ULONG_PTR TITCALL GetJumpDestination(HANDLE hProcess, ULONG_PTR InstructionAddress);
+__declspec(dllexport) bool TITCALL IsJumpGoingToExecuteEx(HANDLE hProcess, HANDLE hThread, ULONG_PTR InstructionAddress, ULONG_PTR RegFlags);
+__declspec(dllexport) bool TITCALL IsJumpGoingToExecute();
+__declspec(dllexport) void TITCALL SetCustomHandler(DWORD ExceptionId, LPVOID CallBack);
+__declspec(dllexport) void TITCALL ForceClose();
+__declspec(dllexport) void TITCALL StepInto(LPVOID traceCallBack);
+__declspec(dllexport) void TITCALL StepOver(LPVOID traceCallBack);
+__declspec(dllexport) void TITCALL StepOut(LPVOID StepOut, bool StepFinal);
+__declspec(dllexport) void TITCALL SingleStep(DWORD StepCount, LPVOID StepCallBack);
+__declspec(dllexport) bool TITCALL GetUnusedHardwareBreakPointRegister(LPDWORD RegisterIndex);
+__declspec(dllexport) bool TITCALL SetHardwareBreakPointEx(HANDLE hActiveThread, ULONG_PTR bpxAddress, DWORD IndexOfRegister, DWORD bpxType, DWORD bpxSize, LPVOID bpxCallBack, LPDWORD IndexOfSelectedRegister);
+__declspec(dllexport) bool TITCALL SetHardwareBreakPoint(ULONG_PTR bpxAddress, DWORD IndexOfRegister, DWORD bpxType, DWORD bpxSize, LPVOID bpxCallBack);
+__declspec(dllexport) bool TITCALL DeleteHardwareBreakPoint(DWORD IndexOfRegister);
+__declspec(dllexport) bool TITCALL RemoveAllBreakPoints(DWORD RemoveOption);
+//__declspec(dllexport) void* TITCALL GetProcessInformation();
+__declspec(dllexport) void* TITCALL GetStartupInformation();
+__declspec(dllexport) void TITCALL DebugLoop();
+__declspec(dllexport) void TITCALL SetDebugLoopTimeOut(DWORD TimeOut);
+__declspec(dllexport) void TITCALL SetNextDbgContinueStatus(DWORD SetDbgCode);
+__declspec(dllexport) bool TITCALL AttachDebugger(DWORD ProcessId, bool KillOnExit, LPVOID DebugInfo, LPVOID CallBack);
+__declspec(dllexport) bool TITCALL DetachDebugger(DWORD ProcessId);
+__declspec(dllexport) bool TITCALL DetachDebuggerEx(DWORD ProcessId);
+__declspec(dllexport) void TITCALL DebugLoopEx(DWORD TimeOut);
+__declspec(dllexport) void TITCALL AutoDebugEx(char* szFileName, bool ReserveModuleBase, char* szCommandLine, char* szCurrentFolder, DWORD TimeOut, LPVOID EntryCallBack);
+__declspec(dllexport) void TITCALL AutoDebugExW(wchar_t* szFileName, bool ReserveModuleBase, wchar_t* szCommandLine, wchar_t* szCurrentFolder, DWORD TimeOut, LPVOID EntryCallBack);
+__declspec(dllexport) bool TITCALL IsFileBeingDebugged();
+__declspec(dllexport) void TITCALL SetErrorModel(bool DisplayErrorMessages);
+// TitanEngine.FindOEP.functions:
+__declspec(dllexport) void TITCALL FindOEPInit();
+__declspec(dllexport) bool TITCALL FindOEPGenerically(char* szFileName, LPVOID TraceInitCallBack, LPVOID CallBack);
+__declspec(dllexport) bool TITCALL FindOEPGenericallyW(wchar_t* szFileName, LPVOID TraceInitCallBack, LPVOID CallBack);
+// TitanEngine.Importer.functions:
+__declspec(dllexport) void TITCALL ImporterAddNewDll(char* szDLLName, ULONG_PTR FirstThunk);
+__declspec(dllexport) void TITCALL ImporterAddNewAPI(char* szAPIName, ULONG_PTR ThunkValue);
+__declspec(dllexport) void TITCALL ImporterAddNewOrdinalAPI(ULONG_PTR OrdinalNumber, ULONG_PTR ThunkValue);
+__declspec(dllexport) long TITCALL ImporterGetAddedDllCount();
+__declspec(dllexport) long TITCALL ImporterGetAddedAPICount();
+__declspec(dllexport) bool TITCALL ImporterExportIAT(ULONG_PTR StorePlace, ULONG_PTR FileMapVA, HANDLE hFileMap);
+__declspec(dllexport) long TITCALL ImporterEstimatedSize();
+__declspec(dllexport) bool TITCALL ImporterExportIATEx(char* szDumpFileName, char* szExportFileName, char* szSectionName);
+__declspec(dllexport) bool TITCALL ImporterExportIATExW(wchar_t* szDumpFileName, wchar_t* szExportFileName, wchar_t* szSectionName = L".RL!TEv2");
+__declspec(dllexport) ULONG_PTR TITCALL ImporterFindAPIWriteLocation(char* szAPIName);
+__declspec(dllexport) ULONG_PTR TITCALL ImporterFindOrdinalAPIWriteLocation(ULONG_PTR OrdinalNumber);
+__declspec(dllexport) ULONG_PTR TITCALL ImporterFindAPIByWriteLocation(ULONG_PTR APIWriteLocation);
+__declspec(dllexport) ULONG_PTR TITCALL ImporterFindDLLByWriteLocation(ULONG_PTR APIWriteLocation);
+__declspec(dllexport) void* TITCALL ImporterGetDLLName(ULONG_PTR APIAddress);
+__declspec(dllexport) void* TITCALL ImporterGetDLLNameW(ULONG_PTR APIAddress);
+__declspec(dllexport) void* TITCALL ImporterGetAPIName(ULONG_PTR APIAddress);
+__declspec(dllexport) ULONG_PTR TITCALL ImporterGetAPIOrdinalNumber(ULONG_PTR APIAddress);
+__declspec(dllexport) void* TITCALL ImporterGetAPINameEx(ULONG_PTR APIAddress, ULONG_PTR DLLBasesList);
+__declspec(dllexport) ULONG_PTR TITCALL ImporterGetRemoteAPIAddress(HANDLE hProcess, ULONG_PTR APIAddress);
+__declspec(dllexport) ULONG_PTR TITCALL ImporterGetRemoteAPIAddressEx(char* szDLLName, char* szAPIName);
+__declspec(dllexport) ULONG_PTR TITCALL ImporterGetLocalAPIAddress(HANDLE hProcess, ULONG_PTR APIAddress);
+__declspec(dllexport) void* TITCALL ImporterGetDLLNameFromDebugee(HANDLE hProcess, ULONG_PTR APIAddress);
+__declspec(dllexport) void* TITCALL ImporterGetDLLNameFromDebugeeW(HANDLE hProcess, ULONG_PTR APIAddress);
+__declspec(dllexport) void* TITCALL ImporterGetAPINameFromDebugee(HANDLE hProcess, ULONG_PTR APIAddress);
+__declspec(dllexport) ULONG_PTR TITCALL ImporterGetAPIOrdinalNumberFromDebugee(HANDLE hProcess, ULONG_PTR APIAddress);
+__declspec(dllexport) long TITCALL ImporterGetDLLIndexEx(ULONG_PTR APIAddress, ULONG_PTR DLLBasesList);
+__declspec(dllexport) long TITCALL ImporterGetDLLIndex(HANDLE hProcess, ULONG_PTR APIAddress, ULONG_PTR DLLBasesList);
+__declspec(dllexport) ULONG_PTR TITCALL ImporterGetRemoteDLLBase(HANDLE hProcess, HMODULE LocalModuleBase);
+__declspec(dllexport) ULONG_PTR TITCALL ImporterGetRemoteDLLBaseEx(HANDLE hProcess, char* szModuleName);
+__declspec(dllexport) void* TITCALL ImporterGetRemoteDLLBaseExW(HANDLE hProcess, wchar_t* szModuleName);
+__declspec(dllexport) bool TITCALL ImporterIsForwardedAPI(HANDLE hProcess, ULONG_PTR APIAddress);
+__declspec(dllexport) void* TITCALL ImporterGetForwardedAPIName(HANDLE hProcess, ULONG_PTR APIAddress);
+__declspec(dllexport) void* TITCALL ImporterGetForwardedDLLName(HANDLE hProcess, ULONG_PTR APIAddress);
+__declspec(dllexport) long TITCALL ImporterGetForwardedDLLIndex(HANDLE hProcess, ULONG_PTR APIAddress, ULONG_PTR DLLBasesList);
+__declspec(dllexport) ULONG_PTR TITCALL ImporterGetForwardedAPIOrdinalNumber(HANDLE hProcess, ULONG_PTR APIAddress);
+__declspec(dllexport) ULONG_PTR TITCALL ImporterGetNearestAPIAddress(HANDLE hProcess, ULONG_PTR APIAddress);
+__declspec(dllexport) void* TITCALL ImporterGetNearestAPIName(HANDLE hProcess, ULONG_PTR APIAddress);
+__declspec(dllexport) bool TITCALL ImporterCopyOriginalIAT(char* szOriginalFile, char* szDumpFile);
+__declspec(dllexport) bool TITCALL ImporterCopyOriginalIATW(wchar_t* szOriginalFile, wchar_t* szDumpFile);
+__declspec(dllexport) bool TITCALL ImporterLoadImportTable(char* szFileName);
+__declspec(dllexport) bool TITCALL ImporterLoadImportTableW(wchar_t* szFileName);
+__declspec(dllexport) bool TITCALL ImporterMoveOriginalIAT(char* szOriginalFile, char* szDumpFile, char* szSectionName);
+__declspec(dllexport) bool TITCALL ImporterMoveOriginalIATW(wchar_t* szOriginalFile, wchar_t* szDumpFile, char* szSectionName);
+__declspec(dllexport) void TITCALL ImporterAutoSearchIAT(DWORD ProcessId, char* szFileName, ULONG_PTR SearchStart, LPVOID pIATStart, LPVOID pIATSize);
+__declspec(dllexport) void TITCALL ImporterAutoSearchIATW(DWORD ProcessIds, wchar_t* szFileName, ULONG_PTR SearchStart, LPVOID pIATStart, LPVOID pIATSize);
+__declspec(dllexport) void TITCALL ImporterAutoSearchIATEx(DWORD ProcessId, ULONG_PTR ImageBase, ULONG_PTR SearchStart, LPVOID pIATStart, LPVOID pIATSize);
+__declspec(dllexport) void TITCALL ImporterEnumAddedData(LPVOID EnumCallBack);
+__declspec(dllexport) long TITCALL ImporterAutoFixIATEx(DWORD ProcessId, char* szDumpedFile, char* szSectionName, bool DumpRunningProcess, bool RealignFile, ULONG_PTR EntryPointAddress, ULONG_PTR ImageBase, ULONG_PTR SearchStart, bool TryAutoFix, bool FixEliminations, LPVOID UnknownPointerFixCallback);
+__declspec(dllexport) long TITCALL ImporterAutoFixIATExW(DWORD ProcessId, wchar_t* szDumpedFile, wchar_t* szSectionName, bool DumpRunningProcess, bool RealignFile, ULONG_PTR EntryPointAddress, ULONG_PTR ImageBase, ULONG_PTR SearchStart,  bool TryAutoFix, bool FixEliminations, LPVOID UnknownPointerFixCallback);
+__declspec(dllexport) long TITCALL ImporterAutoFixIAT(DWORD ProcessId, char* szDumpedFile, ULONG_PTR SearchStart);
+__declspec(dllexport) long TITCALL ImporterAutoFixIATW(DWORD ProcessId, wchar_t* szDumpedFile, ULONG_PTR SearchStart);
+__declspec(dllexport) bool TITCALL ImporterDeleteAPI(DWORD_PTR apiAddr);
+// Global.Engine.Hook.functions:
+__declspec(dllexport) bool TITCALL HooksSafeTransitionEx(LPVOID HookAddressArray, int NumberOfHooks, bool TransitionStart);
+__declspec(dllexport) bool TITCALL HooksSafeTransition(LPVOID HookAddress, bool TransitionStart);
+__declspec(dllexport) bool TITCALL HooksIsAddressRedirected(LPVOID HookAddress);
+__declspec(dllexport) void* TITCALL HooksGetTrampolineAddress(LPVOID HookAddress);
+__declspec(dllexport) void* TITCALL HooksGetHookEntryDetails(LPVOID HookAddress);
+__declspec(dllexport) bool TITCALL HooksInsertNewRedirection(LPVOID HookAddress, LPVOID RedirectTo, int HookType);
+__declspec(dllexport) bool TITCALL HooksInsertNewIATRedirectionEx(ULONG_PTR FileMapVA, ULONG_PTR LoadedModuleBase, char* szHookFunction, LPVOID RedirectTo);
+__declspec(dllexport) bool TITCALL HooksInsertNewIATRedirection(char* szModuleName, char* szHookFunction, LPVOID RedirectTo);
+__declspec(dllexport) bool TITCALL HooksRemoveRedirection(LPVOID HookAddress, bool RemoveAll);
+__declspec(dllexport) bool TITCALL HooksRemoveRedirectionsForModule(HMODULE ModuleBase);
+__declspec(dllexport) bool TITCALL HooksRemoveIATRedirection(char* szModuleName, char* szHookFunction, bool RemoveAll);
+__declspec(dllexport) bool TITCALL HooksDisableRedirection(LPVOID HookAddress, bool DisableAll);
+__declspec(dllexport) bool TITCALL HooksDisableRedirectionsForModule(HMODULE ModuleBase);
+__declspec(dllexport) bool TITCALL HooksDisableIATRedirection(char* szModuleName, char* szHookFunction, bool DisableAll);
+__declspec(dllexport) bool TITCALL HooksEnableRedirection(LPVOID HookAddress, bool EnableAll);
+__declspec(dllexport) bool TITCALL HooksEnableRedirectionsForModule(HMODULE ModuleBase);
+__declspec(dllexport) bool TITCALL HooksEnableIATRedirection(char* szModuleName, char* szHookFunction, bool EnableAll);
+__declspec(dllexport) void TITCALL HooksScanModuleMemory(HMODULE ModuleBase, LPVOID CallBack);
+__declspec(dllexport) void TITCALL HooksScanEntireProcessMemory(LPVOID CallBack);
+__declspec(dllexport) void TITCALL HooksScanEntireProcessMemoryEx();
+// TitanEngine.Tracer.functions:
+__declspec(dllexport) void TITCALL TracerInit();
+__declspec(dllexport) ULONG_PTR TITCALL TracerLevel1(HANDLE hProcess, ULONG_PTR AddressToTrace);
+__declspec(dllexport) ULONG_PTR TITCALL HashTracerLevel1(HANDLE hProcess, ULONG_PTR AddressToTrace, DWORD InputNumberOfInstructions);
+__declspec(dllexport) long TITCALL TracerDetectRedirection(HANDLE hProcess, ULONG_PTR AddressToTrace);
+__declspec(dllexport) ULONG_PTR TITCALL TracerFixKnownRedirection(HANDLE hProcess, ULONG_PTR AddressToTrace, DWORD RedirectionId);
+__declspec(dllexport) ULONG_PTR TITCALL TracerFixRedirectionViaModule(HMODULE hModuleHandle, HANDLE hProcess, ULONG_PTR AddressToTrace, DWORD IdParameter);
+__declspec(dllexport) long TITCALL TracerFixRedirectionViaImpRecPlugin(HANDLE hProcess, char* szPluginName, ULONG_PTR AddressToTrace);
+// TitanEngine.Exporter.functions:
+__declspec(dllexport) void TITCALL ExporterCleanup();
+__declspec(dllexport) void TITCALL ExporterSetImageBase(ULONG_PTR ImageBase);
+__declspec(dllexport) void TITCALL ExporterInit(DWORD MemorySize, ULONG_PTR ImageBase, DWORD ExportOrdinalBase, char* szExportModuleName);
+__declspec(dllexport) bool TITCALL ExporterAddNewExport(char* szExportName, DWORD ExportRelativeAddress);
+__declspec(dllexport) bool TITCALL ExporterAddNewOrdinalExport(DWORD OrdinalNumber, DWORD ExportRelativeAddress);
+__declspec(dllexport) long TITCALL ExporterGetAddedExportCount();
+__declspec(dllexport) long TITCALL ExporterEstimatedSize();
+__declspec(dllexport) bool TITCALL ExporterBuildExportTable(ULONG_PTR StorePlace, ULONG_PTR FileMapVA);
+__declspec(dllexport) bool TITCALL ExporterBuildExportTableEx(char* szExportFileName, char* szSectionName);
+__declspec(dllexport) bool TITCALL ExporterBuildExportTableExW(wchar_t* szExportFileName, char* szSectionName);
+__declspec(dllexport) bool TITCALL ExporterLoadExportTable(char* szFileName);
+__declspec(dllexport) bool TITCALL ExporterLoadExportTableW(wchar_t* szFileName);
+// TitanEngine.Librarian.functions:
+__declspec(dllexport) bool TITCALL LibrarianSetBreakPoint(char* szLibraryName, DWORD bpxType, bool SingleShoot, LPVOID bpxCallBack);
+__declspec(dllexport) bool TITCALL LibrarianRemoveBreakPoint(char* szLibraryName, DWORD bpxType);
+__declspec(dllexport) void* TITCALL LibrarianGetLibraryInfo(char* szLibraryName);
+__declspec(dllexport) void* TITCALL LibrarianGetLibraryInfoW(wchar_t* szLibraryName);
+__declspec(dllexport) void* TITCALL LibrarianGetLibraryInfoEx(void* BaseOfDll);
+__declspec(dllexport) void* TITCALL LibrarianGetLibraryInfoExW(void* BaseOfDll);
+__declspec(dllexport) void TITCALL LibrarianEnumLibraryInfo(void* EnumCallBack);
+__declspec(dllexport) void TITCALL LibrarianEnumLibraryInfoW(void* EnumCallBack);
+// TitanEngine.Process.functions:
+__declspec(dllexport) long TITCALL GetActiveProcessId(char* szImageName);
+__declspec(dllexport) long TITCALL GetActiveProcessIdW(wchar_t* szImageName);
+__declspec(dllexport) void TITCALL EnumProcessesWithLibrary(char* szLibraryName, void* EnumFunction);
+__declspec(dllexport) HANDLE TITCALL TitanOpenProcess(DWORD dwDesiredAccess, bool bInheritHandle, DWORD dwProcessId);
+// TitanEngine.TLSFixer.functions:
+__declspec(dllexport) bool TITCALL TLSBreakOnCallBack(LPVOID ArrayOfCallBacks, DWORD NumberOfCallBacks, LPVOID bpxCallBack);
+__declspec(dllexport) bool TITCALL TLSGrabCallBackData(char* szFileName, LPVOID ArrayOfCallBacks, LPDWORD NumberOfCallBacks);
+__declspec(dllexport) bool TITCALL TLSGrabCallBackDataW(wchar_t* szFileName, LPVOID ArrayOfCallBacks, LPDWORD NumberOfCallBacks);
+__declspec(dllexport) bool TITCALL TLSBreakOnCallBackEx(char* szFileName, LPVOID bpxCallBack);
+__declspec(dllexport) bool TITCALL TLSBreakOnCallBackExW(wchar_t* szFileName, LPVOID bpxCallBack);
+__declspec(dllexport) bool TITCALL TLSRemoveCallback(char* szFileName);
+__declspec(dllexport) bool TITCALL TLSRemoveCallbackW(wchar_t* szFileName);
+__declspec(dllexport) bool TITCALL TLSRemoveTable(char* szFileName);
+__declspec(dllexport) bool TITCALL TLSRemoveTableW(wchar_t* szFileName);
+__declspec(dllexport) bool TITCALL TLSBackupData(char* szFileName);
+__declspec(dllexport) bool TITCALL TLSBackupDataW(wchar_t* szFileName);
+__declspec(dllexport) bool TITCALL TLSRestoreData();
+__declspec(dllexport) bool TITCALL TLSBuildNewTable(ULONG_PTR FileMapVA, ULONG_PTR StorePlace, ULONG_PTR StorePlaceRVA, LPVOID ArrayOfCallBacks, DWORD NumberOfCallBacks);
+__declspec(dllexport) bool TITCALL TLSBuildNewTableEx(char* szFileName, char* szSectionName, LPVOID ArrayOfCallBacks, DWORD NumberOfCallBacks);
+__declspec(dllexport) bool TITCALL TLSBuildNewTableExW(wchar_t* szFileName, char* szSectionName, LPVOID ArrayOfCallBacks, DWORD NumberOfCallBacks);
+// TitanEngine.TranslateName.functions:
+__declspec(dllexport) void* TITCALL TranslateNativeName(char* szNativeName);
+__declspec(dllexport) void* TITCALL TranslateNativeNameW(wchar_t* szNativeName);
+// TitanEngine.Handler.functions:
+__declspec(dllexport) long TITCALL HandlerGetActiveHandleCount(DWORD ProcessId);
+__declspec(dllexport) bool TITCALL HandlerIsHandleOpen(DWORD ProcessId, HANDLE hHandle);
+__declspec(dllexport) void* TITCALL HandlerGetHandleName(HANDLE hProcess, DWORD ProcessId, HANDLE hHandle, bool TranslateName);
+__declspec(dllexport) void* TITCALL HandlerGetHandleNameW(HANDLE hProcess, DWORD ProcessId, HANDLE hHandle, bool TranslateName);
+__declspec(dllexport) long TITCALL HandlerEnumerateOpenHandles(DWORD ProcessId, LPVOID HandleBuffer, DWORD MaxHandleCount);
+__declspec(dllexport) ULONG_PTR TITCALL HandlerGetHandleDetails(HANDLE hProcess, DWORD ProcessId, HANDLE hHandle, DWORD InformationReturn);
+__declspec(dllexport) bool TITCALL HandlerCloseRemoteHandle(HANDLE hProcess, HANDLE hHandle);
+__declspec(dllexport) long TITCALL HandlerEnumerateLockHandles(char* szFileOrFolderName, bool NameIsFolder, bool NameIsTranslated, LPVOID HandleDataBuffer, DWORD MaxHandleCount);
+__declspec(dllexport) long TITCALL HandlerEnumerateLockHandlesW(wchar_t* szFileOrFolderName, bool NameIsFolder, bool NameIsTranslated, LPVOID HandleDataBuffer, DWORD MaxHandleCount);
+__declspec(dllexport) bool TITCALL HandlerCloseAllLockHandles(char* szFileOrFolderName, bool NameIsFolder, bool NameIsTranslated);
+__declspec(dllexport) bool TITCALL HandlerCloseAllLockHandlesW(wchar_t* szFileOrFolderName, bool NameIsFolder, bool NameIsTranslated);
+__declspec(dllexport) bool TITCALL HandlerIsFileLocked(char* szFileOrFolderName, bool NameIsFolder, bool NameIsTranslated);
+__declspec(dllexport) bool TITCALL HandlerIsFileLockedW(wchar_t* szFileOrFolderName, bool NameIsFolder, bool NameIsTranslated);
+// TitanEngine.Handler[Mutex].functions:
+__declspec(dllexport) long TITCALL HandlerEnumerateOpenMutexes(HANDLE hProcess, DWORD ProcessId, LPVOID HandleBuffer, DWORD MaxHandleCount);
+__declspec(dllexport) ULONG_PTR TITCALL HandlerGetOpenMutexHandle(HANDLE hProcess, DWORD ProcessId, char* szMutexString);
+__declspec(dllexport) ULONG_PTR TITCALL HandlerGetOpenMutexHandleW(HANDLE hProcess, DWORD ProcessId, wchar_t* szMutexString);
+__declspec(dllexport) long TITCALL HandlerGetProcessIdWhichCreatedMutex(char* szMutexString);
+__declspec(dllexport) long TITCALL HandlerGetProcessIdWhichCreatedMutexW(wchar_t* szMutexString);
+// TitanEngine.Injector.functions:
+__declspec(dllexport) bool TITCALL RemoteLoadLibrary(HANDLE hProcess, char* szLibraryFile, bool WaitForThreadExit);
+__declspec(dllexport) bool TITCALL RemoteLoadLibraryW(HANDLE hProcess, wchar_t* szLibraryFile, bool WaitForThreadExit);
+__declspec(dllexport) bool TITCALL RemoteFreeLibrary(HANDLE hProcess, HMODULE hModule, char* szLibraryFile, bool WaitForThreadExit);
+__declspec(dllexport) bool TITCALL RemoteFreeLibraryW(HANDLE hProcess, HMODULE hModule, wchar_t* szLibraryFile, bool WaitForThreadExit);
+__declspec(dllexport) bool TITCALL RemoteExitProcess(HANDLE hProcess, DWORD ExitCode);
+// TitanEngine.StaticUnpacker.functions:
+__declspec(dllexport) bool TITCALL StaticFileLoad(char* szFileName, DWORD DesiredAccess, bool SimulateLoad, LPHANDLE FileHandle, LPDWORD LoadedSize, LPHANDLE FileMap, PULONG_PTR FileMapVA);
+__declspec(dllexport) bool TITCALL StaticFileLoadW(wchar_t* szFileName, DWORD DesiredAccess, bool SimulateLoad, LPHANDLE FileHandle, LPDWORD LoadedSize, LPHANDLE FileMap, PULONG_PTR FileMapVA);
+__declspec(dllexport) bool TITCALL StaticFileUnload(char* szFileName, bool CommitChanges, HANDLE FileHandle, DWORD LoadedSize, HANDLE FileMap, ULONG_PTR FileMapVA);
+__declspec(dllexport) bool TITCALL StaticFileUnloadW(wchar_t* szFileName, bool CommitChanges, HANDLE FileHandle, DWORD LoadedSize, HANDLE FileMap, ULONG_PTR FileMapVA);
+__declspec(dllexport) bool TITCALL StaticFileOpen(char* szFileName, DWORD DesiredAccess, LPHANDLE FileHandle, LPDWORD FileSizeLow, LPDWORD FileSizeHigh);
+__declspec(dllexport) bool TITCALL StaticFileOpenW(wchar_t* szFileName, DWORD DesiredAccess, LPHANDLE FileHandle, LPDWORD FileSizeLow, LPDWORD FileSizeHigh);
+__declspec(dllexport) bool TITCALL StaticFileGetContent(HANDLE FileHandle, DWORD FilePositionLow, LPDWORD FilePositionHigh, void* Buffer, DWORD Size);
+__declspec(dllexport) void TITCALL StaticFileClose(HANDLE FileHandle);
+__declspec(dllexport) void TITCALL StaticMemoryDecrypt(LPVOID MemoryStart, DWORD MemorySize, DWORD DecryptionType, DWORD DecryptionKeySize, ULONG_PTR DecryptionKey);
+__declspec(dllexport) void TITCALL StaticMemoryDecryptEx(LPVOID MemoryStart, DWORD MemorySize, DWORD DecryptionKeySize, void* DecryptionCallBack);
+__declspec(dllexport) void TITCALL StaticMemoryDecryptSpecial(LPVOID MemoryStart, DWORD MemorySize, DWORD DecryptionKeySize, DWORD SpecDecryptionType, void* DecryptionCallBack);
+__declspec(dllexport) void TITCALL StaticSectionDecrypt(ULONG_PTR FileMapVA, DWORD SectionNumber, bool SimulateLoad, DWORD DecryptionType, DWORD DecryptionKeySize, ULONG_PTR DecryptionKey);
+__declspec(dllexport) bool TITCALL StaticMemoryDecompress(void* Source, DWORD SourceSize, void* Destination, DWORD DestinationSize, int Algorithm);
+__declspec(dllexport) bool TITCALL StaticRawMemoryCopy(HANDLE hFile, ULONG_PTR FileMapVA, ULONG_PTR VitualAddressToCopy, DWORD Size, bool AddressIsRVA, char* szDumpFileName);
+__declspec(dllexport) bool TITCALL StaticRawMemoryCopyW(HANDLE hFile, ULONG_PTR FileMapVA, ULONG_PTR VitualAddressToCopy, DWORD Size, bool AddressIsRVA, wchar_t* szDumpFileName);
+__declspec(dllexport) bool TITCALL StaticRawMemoryCopyEx(HANDLE hFile, DWORD RawAddressToCopy, DWORD Size, char* szDumpFileName);
+__declspec(dllexport) bool TITCALL StaticRawMemoryCopyExW(HANDLE hFile, DWORD RawAddressToCopy, DWORD Size, wchar_t* szDumpFileName);
+__declspec(dllexport) bool TITCALL StaticRawMemoryCopyEx64(HANDLE hFile, DWORD64 RawAddressToCopy, DWORD64 Size, char* szDumpFileName);
+__declspec(dllexport) bool TITCALL StaticRawMemoryCopyEx64W(HANDLE hFile, DWORD64 RawAddressToCopy, DWORD64 Size, wchar_t* szDumpFileName);
+__declspec(dllexport) bool TITCALL StaticHashMemory(void* MemoryToHash, DWORD SizeOfMemory, void* HashDigest, bool OutputString, int Algorithm);
+__declspec(dllexport) bool TITCALL StaticHashFileW(wchar_t* szFileName, char* HashDigest, bool OutputString, int Algorithm);
+__declspec(dllexport) bool TITCALL StaticHashFile(char* szFileName, char* HashDigest, bool OutputString, int Algorithm);
+// TitanEngine.Engine.functions:
+__declspec(dllexport) void TITCALL EngineUnpackerInitialize(char* szFileName, char* szUnpackedFileName, bool DoLogData, bool DoRealignFile, bool DoMoveOverlay, void* EntryCallBack);
+__declspec(dllexport) void TITCALL EngineUnpackerInitializeW(wchar_t* szFileName, wchar_t* szUnpackedFileName, bool DoLogData, bool DoRealignFile, bool DoMoveOverlay, void* EntryCallBack);
+__declspec(dllexport) bool TITCALL EngineUnpackerSetBreakCondition(void* SearchStart, DWORD SearchSize, void* SearchPattern, DWORD PatternSize, DWORD PatternDelta, ULONG_PTR BreakType, bool SingleBreak, DWORD Parameter1, DWORD Parameter2);
+__declspec(dllexport) void TITCALL EngineUnpackerSetEntryPointAddress(ULONG_PTR UnpackedEntryPointAddress);
+__declspec(dllexport) void TITCALL EngineUnpackerFinalizeUnpacking();
+// TitanEngine.Engine.functions:
+__declspec(dllexport) void TITCALL SetEngineVariable(DWORD VariableId, bool VariableSet);
+__declspec(dllexport) bool TITCALL EngineCreateMissingDependencies(char* szFileName, char* szOutputFolder, bool LogCreatedFiles);
+__declspec(dllexport) bool TITCALL EngineCreateMissingDependenciesW(wchar_t* szFileName, wchar_t* szOutputFolder, bool LogCreatedFiles);
+__declspec(dllexport) bool TITCALL EngineFakeMissingDependencies(HANDLE hProcess);
+__declspec(dllexport) bool TITCALL EngineDeleteCreatedDependencies();
+__declspec(dllexport) bool TITCALL EngineCreateUnpackerWindow(char* WindowUnpackerTitle, char* WindowUnpackerLongTitle, char* WindowUnpackerName, char* WindowUnpackerAuthor, void* StartUnpackingCallBack);
+__declspec(dllexport) void TITCALL EngineAddUnpackerWindowLogMessage(char* szLogMessage);
+__declspec(dllexport) bool TITCALL EngineCheckStructAlignment(DWORD StructureType, ULONG_PTR StructureSize);
+// Global.Engine.Extension.Functions:
+__declspec(dllexport) bool TITCALL ExtensionManagerIsPluginLoaded(char* szPluginName);
+__declspec(dllexport) bool TITCALL ExtensionManagerIsPluginEnabled(char* szPluginName);
+__declspec(dllexport) bool TITCALL ExtensionManagerDisableAllPlugins();
+__declspec(dllexport) bool TITCALL ExtensionManagerDisablePlugin(char* szPluginName);
+__declspec(dllexport) bool TITCALL ExtensionManagerEnableAllPlugins();
+__declspec(dllexport) bool TITCALL ExtensionManagerEnablePlugin(char* szPluginName);
+__declspec(dllexport) bool TITCALL ExtensionManagerUnloadAllPlugins();
+__declspec(dllexport) bool TITCALL ExtensionManagerUnloadPlugin(char* szPluginName);
+__declspec(dllexport) void* TITCALL ExtensionManagerGetPluginInfo(char* szPluginName);
+
+#ifdef __cplusplus
+}
+#endif
+
+#pragma pack(pop)
+
+#endif /*TITANENGINE*/

src/pluginsdk/_plugin_types.h

@@ -0,0 +1,24 @@
+#ifndef _PLUGIN_DATA_H
+#define _PLUGIN_DATA_H
+
+#ifdef BUILD_DBG
+
+#include "_global.h"
+
+#else
+
+#ifdef __GNUC__
+#include "dbghelp\dbghelp.h"
+#else
+#include <dbghelp.h>
+#endif // __GNUC__
+
+#ifndef deflen
+#define deflen 1024
+#endif // deflen
+
+#include "bridgemain.h"
+
+#endif // BUILD_DBG
+
+#endif // _PLUGIN_DATA_H

src/pluginsdk/_plugins.h

@@ -0,0 +1,198 @@
+#ifndef _PLUGINS_H
+#define _PLUGINS_H
+
+#ifndef PLUG_IMPEXP
+#ifdef BUILD_DBG
+#define PLUG_IMPEXP __declspec(dllexport)
+#else
+#define PLUG_IMPEXP __declspec(dllimport)
+#endif //BUILD_DBG
+#endif //PLUG_IMPEXP
+
+#include "_plugin_types.h"
+
+//default structure alignments forced
+#ifdef _WIN64
+#pragma pack(push, 16)
+#else //x86
+#pragma pack(push, 8)
+#endif //_WIN64
+
+//defines
+#define PLUG_SDKVERSION 1
+
+//structures
+struct PLUG_INITSTRUCT
+{
+    //provided by the debugger
+    int pluginHandle;
+    //provided by the pluginit function
+    int sdkVersion;
+    int pluginVersion;
+    char pluginName[256];
+};
+
+struct PLUG_SETUPSTRUCT
+{
+    //provided by the debugger
+    HWND hwndDlg; //gui window handle
+    int hMenu; //plugin menu handle
+};
+
+//callback structures
+struct PLUG_CB_INITDEBUG
+{
+    const char* szFileName;
+};
+
+struct PLUG_CB_STOPDEBUG
+{
+    void* reserved;
+};
+
+struct PLUG_CB_CREATEPROCESS
+{
+    CREATE_PROCESS_DEBUG_INFO* CreateProcessInfo;
+    IMAGEHLP_MODULE64* modInfo;
+    const char* DebugFileName;
+    PROCESS_INFORMATION* fdProcessInfo;
+};
+
+struct PLUG_CB_EXITPROCESS
+{
+    EXIT_PROCESS_DEBUG_INFO* ExitProcess;
+};
+
+struct PLUG_CB_CREATETHREAD
+{
+    CREATE_THREAD_DEBUG_INFO* CreateThread;
+    DWORD dwThreadId;
+};
+
+struct PLUG_CB_EXITTHREAD
+{
+    EXIT_THREAD_DEBUG_INFO* ExitThread;
+    DWORD dwThreadId;
+};
+
+struct PLUG_CB_SYSTEMBREAKPOINT
+{
+    void* reserved;
+};
+
+struct PLUG_CB_LOADDLL
+{
+    LOAD_DLL_DEBUG_INFO* LoadDll;
+    IMAGEHLP_MODULE64* modInfo;
+    const char* modname;
+};
+
+struct PLUG_CB_UNLOADDLL
+{
+    UNLOAD_DLL_DEBUG_INFO* UnloadDll;
+};
+
+struct PLUG_CB_OUTPUTDEBUGSTRING
+{
+    OUTPUT_DEBUG_STRING_INFO* DebugString;
+};
+
+struct PLUG_CB_EXCEPTION
+{
+    EXCEPTION_DEBUG_INFO* Exception;
+};
+
+struct PLUG_CB_BREAKPOINT
+{
+    BRIDGEBP* breakpoint;
+};
+
+struct PLUG_CB_PAUSEDEBUG
+{
+    void* reserved;
+};
+
+struct PLUG_CB_RESUMEDEBUG
+{
+    void* reserved;
+};
+
+struct PLUG_CB_STEPPED
+{
+    void* reserved;
+};
+
+struct PLUG_CB_ATTACH
+{
+    DWORD dwProcessId;
+};
+
+struct PLUG_CB_DETACH
+{
+    PROCESS_INFORMATION* fdProcessInfo;
+};
+
+struct PLUG_CB_DEBUGEVENT
+{
+    DEBUG_EVENT* DebugEvent;
+};
+
+struct PLUG_CB_MENUENTRY
+{
+    int hEntry;
+};
+
+//enums
+enum CBTYPE
+{
+    CB_INITDEBUG, //PLUG_CB_INITDEBUG
+    CB_STOPDEBUG, //PLUG_CB_STOPDEBUG
+    CB_CREATEPROCESS, //PLUG_CB_CREATEPROCESS
+    CB_EXITPROCESS, //PLUG_CB_EXITPROCESS
+    CB_CREATETHREAD, //PLUG_CB_CREATETHREAD
+    CB_EXITTHREAD, //PLUG_CB_EXITTHREAD
+    CB_SYSTEMBREAKPOINT, //PLUG_CB_SYSTEMBREAKPOINT
+    CB_LOADDLL, //PLUG_CB_LOADDLL
+    CB_UNLOADDLL, //PLUG_CB_UNLOADDLL
+    CB_OUTPUTDEBUGSTRING, //PLUG_CB_OUTPUTDEBUGSTRING
+    CB_EXCEPTION, //PLUG_CB_EXCEPTION
+    CB_BREAKPOINT, //PLUG_CB_BREAKPOINT
+    CB_PAUSEDEBUG, //PLUG_CB_PAUSEDEBUG
+    CB_RESUMEDEBUG, //PLUG_CB_RESUMEDEBUG
+    CB_STEPPED, //PLUG_CB_STEPPED
+    CB_ATTACH, //PLUG_CB_ATTACHED (before attaching, after CB_INITDEBUG)
+    CB_DETACH, //PLUG_CB_DETACH (before detaching, before CB_STOPDEBUG)
+    CB_DEBUGEVENT, //PLUG_CB_DEBUGEVENT (called on any debug event)
+    CB_MENUENTRY //PLUG_CB_MENUENTRY
+};
+
+//typedefs
+typedef void (*CBPLUGIN)(CBTYPE cbType, void* callbackInfo);
+typedef bool (*CBPLUGINCOMMAND)(int, char**);
+
+//exports
+#ifdef __cplusplus
+extern "C"
+{
+#endif
+
+PLUG_IMPEXP void _plugin_registercallback(int pluginHandle, CBTYPE cbType, CBPLUGIN cbPlugin);
+PLUG_IMPEXP bool _plugin_unregistercallback(int pluginHandle, CBTYPE cbType);
+PLUG_IMPEXP bool _plugin_registercommand(int pluginHandle, const char* command, CBPLUGINCOMMAND cbCommand, bool debugonly);
+PLUG_IMPEXP bool _plugin_unregistercommand(int pluginHandle, const char* command);
+PLUG_IMPEXP void _plugin_logprintf(const char* format, ...);
+PLUG_IMPEXP void _plugin_logputs(const char* text);
+PLUG_IMPEXP void _plugin_debugpause();
+PLUG_IMPEXP void _plugin_debugskipexceptions(bool skip);
+PLUG_IMPEXP int _plugin_menuadd(int hMenu, const char* title);
+PLUG_IMPEXP bool _plugin_menuaddentry(int hMenu, int hEntry, const char* title);
+PLUG_IMPEXP bool _plugin_menuaddseparator(int hMenu);
+PLUG_IMPEXP bool _plugin_menuclear(int hMenu);
+
+#ifdef __cplusplus
+}
+#endif
+
+#pragma pack(pop)
+
+#endif // _PLUGINS_H

src/pluginsdk/basic_types.h

@@ -0,0 +1,272 @@
+/**
+ * @file   basic_types.h
+ * @author  <[email protected]>
+ * @date   Thu Dec 24 19:31:22 2009
+ *
+ * @brief  Definitions of fixed-size integer types for various platforms
+ *
+ * This file is part of BeaEngine.
+ *
+ *    BeaEngine is free software: you can redistribute it and/or modify
+ *    it under the terms of the GNU Lesser General Public License as published by
+ *    the Free Software Foundation, either version 3 of the License, or
+ *    (at your option) any later version.
+ *
+ *    BeaEngine is distributed in the hope that it will be useful,
+ *    but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *    GNU Lesser General Public License for more details.
+ *
+ *    You should have received a copy of the GNU Lesser General Public License
+ *    along with BeaEngine.  If not, see <http://www.gnu.org/licenses/>. */
+
+#ifndef __BEA_BASIC_TYPES_HPP__
+#define __BEA_BASIC_TYPES_HPP__
+
+#include <stddef.h>
+
+#if defined(__GNUC__) || defined (__INTEL_COMPILER) || defined(__LCC__) || defined(__POCC__)
+#include <stdint.h>
+#endif
+
+#if defined(_MSC_VER) && !defined(__BORLANDC__)
+/*
+* Windows/Visual C++
+*/
+typedef signed char            Int8;
+typedef unsigned char          UInt8;
+typedef signed short           Int16;
+typedef unsigned short         UInt16;
+typedef signed int             Int32;
+typedef unsigned int           UInt32;
+typedef signed __int64         Int64;
+typedef unsigned __int64       UInt64;
+#if defined(_WIN64)
+#define BEA_PTR_IS_64_BIT 1
+typedef signed __int64     IntPtr;
+typedef unsigned __int64   UIntPtr;
+#else
+typedef signed long        IntPtr;
+typedef size_t             UIntPtr;
+#endif
+#define BEA_HAVE_INT64 1
+#elif defined(__POCC__)
+/*
+* PellesC
+*/
+typedef signed char            Int8;
+typedef unsigned char          UInt8;
+typedef signed short           Int16;
+typedef unsigned short         UInt16;
+typedef signed int             Int32;
+typedef unsigned int           UInt32;
+typedef signed long long       Int64;
+typedef unsigned long long     UInt64;
+#if defined(_WIN64)
+#define BEA_PTR_IS_64_BIT 1
+typedef signed long long   IntPtr;
+typedef unsigned long long UIntPtr;
+#else
+typedef signed long        IntPtr;
+typedef size_t             UIntPtr;
+#endif
+#define BEA_HAVE_INT64 1
+#elif defined(__GNUC__) || defined(__LCC__)
+/*
+* Unix/GCC
+*/
+typedef signed char            Int8;
+typedef unsigned char          UInt8;
+typedef signed short           Int16;
+typedef unsigned short         UInt16;
+typedef signed int             Int32;
+typedef unsigned int           UInt32;
+typedef intptr_t               IntPtr;
+typedef uintptr_t              UIntPtr;
+#if defined(__LP64__)
+#define BEA_PTR_IS_64_BIT 1
+#define BEA_LONG_IS_64_BIT 1
+typedef signed long        Int64;
+typedef unsigned long      UInt64;
+#else
+#if defined (__INTEL_COMPILER) || defined (__ICC) || defined (_ICC)
+typedef __int64           Int64;
+typedef unsigned __int64  UInt64;
+#else
+typedef signed long long   Int64;
+typedef unsigned long long UInt64;
+#endif
+#endif
+#define BEA_HAVE_INT64 1
+#elif defined(__DECCXX)
+/*
+* Compaq C++
+*/
+typedef signed char            Int8;
+typedef unsigned char          UInt8;
+typedef signed short           Int16;
+typedef unsigned short         UInt16;
+typedef signed int             Int32;
+typedef unsigned int           UInt32;
+typedef signed __int64         Int64;
+typedef unsigned __int64       UInt64;
+#if defined(__VMS)
+#if defined(__32BITS)
+typedef signed long    IntPtr;
+typedef unsigned long  UIntPtr;
+#else
+typedef Int64          IntPtr;
+typedef UInt64         UIntPtr;
+#define BEA_PTR_IS_64_BIT 1
+#endif
+#else
+typedef signed long        IntPtr;
+typedef unsigned long      UIntPtr;
+#define BEA_PTR_IS_64_BIT 1
+#define BEA_LONG_IS_64_BIT 1
+#endif
+#define BEA_HAVE_INT64 1
+#elif defined(__HP_aCC)
+/*
+* HP Ansi C++
+*/
+typedef signed char            Int8;
+typedef unsigned char          UInt8;
+typedef signed short           Int16;
+typedef unsigned short         UInt16;
+typedef signed int             Int32;
+typedef unsigned int           UInt32;
+typedef signed long            IntPtr;
+typedef unsigned long          UIntPtr;
+#if defined(__LP64__)
+#define BEA_PTR_IS_64_BIT 1
+#define BEA_LONG_IS_64_BIT 1
+typedef signed long        Int64;
+typedef unsigned long      UInt64;
+#else
+typedef signed long long   Int64;
+typedef unsigned long long UInt64;
+#endif
+#define BEA_HAVE_INT64 1
+#elif defined(__SUNPRO_CC) || defined(__SUNPRO_C)
+/*
+* SUN Forte C++
+*/
+typedef signed char            Int8;
+typedef unsigned char          UInt8;
+typedef signed short           Int16;
+typedef unsigned short         UInt16;
+typedef signed int             Int32;
+typedef unsigned int           UInt32;
+typedef signed long            IntPtr;
+typedef unsigned long          UIntPtr;
+#if defined(__sparcv9)
+#define BEA_PTR_IS_64_BIT 1
+#define BEA_LONG_IS_64_BIT 1
+typedef signed long        Int64;
+typedef unsigned long      UInt64;
+#else
+typedef signed long long   Int64;
+typedef unsigned long long UInt64;
+#endif
+#define BEA_HAVE_INT64 1
+#elif defined(__IBMCPP__)
+/*
+* IBM XL C++
+*/
+typedef signed char            Int8;
+typedef unsigned char          UInt8;
+typedef signed short           Int16;
+typedef unsigned short         UInt16;
+typedef signed int             Int32;
+typedef unsigned int           UInt32;
+typedef signed long            IntPtr;
+typedef unsigned long          UIntPtr;
+#if defined(__64BIT__)
+#define BEA_PTR_IS_64_BIT 1
+#define BEA_LONG_IS_64_BIT 1
+typedef signed long        Int64;
+typedef unsigned long      UInt64;
+#else
+typedef signed long long   Int64;
+typedef unsigned long long UInt64;
+#endif
+#define BEA_HAVE_INT64 1
+#elif defined(__BORLANDC__)
+/*
+* Borland C/C++
+*/
+typedef signed char            Int8;
+typedef unsigned char          UInt8;
+typedef signed short           Int16;
+typedef unsigned short         UInt16;
+typedef signed int             Int32;
+typedef unsigned int           UInt32;
+typedef unsigned __int64       Int64;
+typedef signed __int64         UInt64;
+typedef signed long            IntPtr;
+typedef unsigned long          UIntPtr;
+#define BEA_HAVE_INT64 1
+#elif defined(__WATCOMC__)
+/*
+* Watcom C/C++
+*/
+typedef signed char            Int8;
+typedef unsigned char          UInt8;
+typedef signed short           Int16;
+typedef unsigned short         UInt16;
+typedef signed int             Int32;
+typedef unsigned int           UInt32;
+typedef unsigned __int64       Int64;
+typedef signed __int64         UInt64;
+#define BEA_HAVE_INT64 1
+typedef size_t                 UIntPtr;
+#elif defined(__sgi)
+/*
+* MIPSpro C++
+*/
+typedef signed char            Int8;
+typedef unsigned char          UInt8;
+typedef signed short           Int16;
+typedef unsigned short         UInt16;
+typedef signed int             Int32;
+typedef unsigned int           UInt32;
+typedef signed long            IntPtr;
+typedef unsigned long          UIntPtr;
+#if _MIPS_SZLONG == 64
+#define BEA_PTR_IS_64_BIT 1
+#define BEA_LONG_IS_64_BIT 1
+typedef signed long        Int64;
+typedef unsigned long      UInt64;
+#else
+typedef signed long long   Int64;
+typedef unsigned long long UInt64;
+#endif
+#define BEA_HAVE_INT64 1
+#endif
+
+#if defined(_MSC_VER) || defined(__BORLANDC__)
+#define W64LIT(x) x##ui64
+#else
+#define W64LIT(x) x##ULL
+#endif
+
+
+#ifndef C_STATIC_ASSERT
+#define C_STATIC_ASSERT(tag_name, x)            \
+       typedef int cache_static_assert_ ## tag_name[(x) * 2-1]
+#endif
+
+C_STATIC_ASSERT(sizeof_Int8 , (sizeof(Int8)  == 1));
+C_STATIC_ASSERT(sizeof_UInt8, (sizeof(UInt8) == 1));
+
+C_STATIC_ASSERT(sizeof_Int16 , (sizeof(Int16)  == 2));
+C_STATIC_ASSERT(sizeof_UInt16, (sizeof(UInt16) == 2));
+
+C_STATIC_ASSERT(sizeof_Int32 , (sizeof(Int32)  == 4));
+C_STATIC_ASSERT(sizeof_UInt32, (sizeof(UInt32) == 4));
+
+C_STATIC_ASSERT(sizeof_Int64 , (sizeof(Int64)  == 8));
+C_STATIC_ASSERT(sizeof_UInt64, (sizeof(UInt64) == 8));
+
+#endif

src/pluginsdk/bridgemain.h

@@ -0,0 +1,700 @@
+#ifndef _BRIDGEMAIN_H_
+#define _BRIDGEMAIN_H_
+
+#include <windows.h>
+
+//default structure alignments forced
+#ifdef _WIN64
+#pragma pack(push, 16)
+#else //x86
+#pragma pack(push, 8)
+#endif //_WIN64
+
+#ifdef _WIN64
+typedef unsigned long long duint;
+typedef signed long long dsint;
+#else
+typedef unsigned long duint;
+typedef signed long dsint;
+#endif //_WIN64
+
+#ifndef BRIDGE_IMPEXP
+#ifdef BUILD_BRIDGE
+#define BRIDGE_IMPEXP __declspec(dllexport)
+#else
+#define BRIDGE_IMPEXP __declspec(dllimport)
+#endif //BUILD_BRIDGE
+#endif //BRIDGE_IMPEXP
+
+#ifdef __cplusplus
+extern "C"
+{
+#endif
+
+//Bridge defines
+#define MAX_SETTING_SIZE 65536
+#define DBG_VERSION 19
+
+//Bridge functions
+BRIDGE_IMPEXP const char* BridgeInit();
+BRIDGE_IMPEXP const char* BridgeStart();
+BRIDGE_IMPEXP void* BridgeAlloc(size_t size);
+BRIDGE_IMPEXP void BridgeFree(void* ptr);
+BRIDGE_IMPEXP bool BridgeSettingGet(const char* section, const char* key, char* value);
+BRIDGE_IMPEXP bool BridgeSettingGetUint(const char* section, const char* key, duint* value);
+BRIDGE_IMPEXP bool BridgeSettingSet(const char* section, const char* key, const char* value);
+BRIDGE_IMPEXP bool BridgeSettingSetUint(const char* section, const char* key, duint value);
+BRIDGE_IMPEXP int BridgeGetDbgVersion();
+
+//Debugger defines
+#define MAX_LABEL_SIZE 256
+#define MAX_COMMENT_SIZE 512
+#define MAX_MODULE_SIZE 256
+#define MAX_BREAKPOINT_SIZE 256
+#define MAX_SCRIPT_LINE_SIZE 2048
+#define MAX_THREAD_NAME_SIZE 256
+#define MAX_STRING_SIZE 512
+
+#define TYPE_VALUE 1
+#define TYPE_MEMORY 2
+#define TYPE_ADDR 4
+#define MAX_MNEMONIC_SIZE 64
+
+//Debugger enums
+enum DBGSTATE
+{
+    initialized,
+    paused,
+    running,
+    stopped
+};
+
+enum SEGMENTREG
+{
+    SEG_DEFAULT,
+    SEG_ES,
+    SEG_DS,
+    SEG_FS,
+    SEG_GS,
+    SEG_CS,
+    SEG_SS
+};
+
+enum ADDRINFOFLAGS
+{
+    flagmodule=1,
+    flaglabel=2,
+    flagcomment=4,
+    flagbookmark=8,
+    flagfunction=16,
+    flagloop=32
+};
+
+enum BPXTYPE
+{
+    bp_none=0,
+    bp_normal=1,
+    bp_hardware=2,
+    bp_memory=4
+};
+
+enum FUNCTYPE
+{
+    FUNC_NONE,
+    FUNC_BEGIN,
+    FUNC_MIDDLE,
+    FUNC_END,
+    FUNC_SINGLE
+};
+
+enum LOOPTYPE
+{
+    LOOP_NONE,
+    LOOP_BEGIN,
+    LOOP_MIDDLE,
+    LOOP_ENTRY,
+    LOOP_END
+};
+
+enum DBGMSG
+{
+    DBG_SCRIPT_LOAD,                // param1=const char* filename,      param2=unused
+    DBG_SCRIPT_UNLOAD,              // param1=unused,                    param2=unused
+    DBG_SCRIPT_RUN,                 // param1=int destline,              param2=unused
+    DBG_SCRIPT_STEP,                // param1=unused,                    param2=unused
+    DBG_SCRIPT_BPTOGGLE,            // param1=int line,                  param2=unused
+    DBG_SCRIPT_BPGET,               // param1=int line,                  param2=unused
+    DBG_SCRIPT_CMDEXEC,             // param1=const char* command,       param2=unused
+    DBG_SCRIPT_ABORT,               // param1=unused,                    param2=unused
+    DBG_SCRIPT_GETLINETYPE,         // param1=int line,                  param2=unused
+    DBG_SCRIPT_SETIP,               // param1=int line,                  param2=unused
+    DBG_SCRIPT_GETBRANCHINFO,       // param1=int line,                  param2=SCRIPTBRANCH* info
+    DBG_SYMBOL_ENUM,                // param1=SYMBOLCBINFO* cbInfo,      param2=unused
+    DBG_ASSEMBLE_AT,                // param1=duint addr,                param2=const char* instruction
+    DBG_MODBASE_FROM_NAME,          // param1=const char* modname,       param2=unused
+    DBG_DISASM_AT,                  // param1=duint addr,				 param2=DISASM_INSTR* instr
+    DBG_STACK_COMMENT_GET,          // param1=duint addr,                param2=STACK_COMMENT* comment
+    DBG_GET_THREAD_LIST,            // param1=THREADALLINFO* list,       param2=unused
+    DBG_SETTINGS_UPDATED,           // param1=unused,                    param2=unused
+    DBG_DISASM_FAST_AT,             // param1=duint addr,                param2=BASIC_INSTRUCTION_INFO* basicinfo
+    DBG_MENU_ENTRY_CLICKED,         // param1=int hEntry,                param2=unused
+    DBG_FUNCTION_GET,               // param1=FUNCTION_LOOP_INFO* info,  param2=unused
+    DBG_FUNCTION_OVERLAPS,          // param1=FUNCTION_LOOP_INFO* info,  param2=unused
+    DBG_FUNCTION_ADD,               // param1=FUNCTION_LOOP_INFO* info,  param2=unused
+    DBG_FUNCTION_DEL,               // param1=FUNCTION_LOOP_INFO* info,  param2=unused
+    DBG_LOOP_GET,                   // param1=FUNCTION_LOOP_INFO* info,  param2=unused
+    DBG_LOOP_OVERLAPS,              // param1=FUNCTION_LOOP_INFO* info,  param2=unused
+    DBG_LOOP_ADD,                   // param1=FUNCTION_LOOP_INFO* info,  param2=unused
+    DBG_LOOP_DEL,                   // param1=FUNCTION_LOOP_INFO* info,  param2=unused
+    DBG_IS_RUN_LOCKED,              // param1=unused,                    param2=unused
+    DBG_IS_BP_DISABLED,             // param1=duint addr,                param2=unused
+    DBG_SET_AUTO_COMMENT_AT,        // param1=duint addr,                param2=const char* text
+    DBG_DELETE_AUTO_COMMENT_RANGE,  // param1=duint start,               param2=duint end
+    DBG_SET_AUTO_LABEL_AT,          // param1=duint addr,                param2=const char* text
+    DBG_DELETE_AUTO_LABEL_RANGE,    // param1=duint start,               param2=duint end
+    DBG_SET_AUTO_BOOKMARK_AT,       // param1=duint addr,                param2=const char* text
+    DBG_DELETE_AUTO_BOOKMARK_RANGE, // param1=duint start,               param2=duint end
+    DBG_SET_AUTO_FUNCTION_AT,       // param1=duint addr,                param2=const char* text
+    DBG_DELETE_AUTO_FUNCTION_RANGE, // param1=duint start,               param2=duint end
+    DBG_GET_STRING_AT,              // param1=duint addr,                param2=unused
+    DBG_GET_FUNCTIONS               // param1=unused,                    param2=unused
+};
+
+enum SCRIPTLINETYPE
+{
+    linecommand,
+    linebranch,
+    linelabel,
+    linecomment,
+    lineempty,
+};
+
+enum SCRIPTBRANCHTYPE
+{
+    scriptnobranch,
+    scriptjmp,
+    scriptjnejnz,
+    scriptjejz,
+    scriptjbjl,
+    scriptjajg,
+    scriptjbejle,
+    scriptjaejge,
+    scriptcall
+};
+
+enum DISASM_INSTRTYPE
+{
+    instr_normal,
+    instr_branch,
+    instr_stack
+};
+
+enum DISASM_ARGTYPE
+{
+    arg_normal,
+    arg_memory
+};
+
+enum STRING_TYPE
+{
+    str_none,
+    str_ascii,
+    str_unicode
+};
+
+enum THREADPRIORITY
+{
+    _PriorityIdle = -15,
+    _PriorityAboveNormal = 1,
+    _PriorityBelowNormal = -1,
+    _PriorityHighest = 2,
+    _PriorityLowest = -2,
+    _PriorityNormal = 0,
+    _PriorityTimeCritical = 15,
+    _PriorityUnknown = 0x7FFFFFFF
+};
+
+enum THREADWAITREASON
+{
+    _Executive = 0,
+    _FreePage = 1,
+    _PageIn = 2,
+    _PoolAllocation = 3,
+    _DelayExecution = 4,
+    _Suspended = 5,
+    _UserRequest = 6,
+    _WrExecutive = 7,
+    _WrFreePage = 8,
+    _WrPageIn = 9,
+    _WrPoolAllocation = 10,
+    _WrDelayExecution = 11,
+    _WrSuspended = 12,
+    _WrUserRequest = 13,
+    _WrEventPair = 14,
+    _WrQueue = 15,
+    _WrLpcReceive = 16,
+    _WrLpcReply = 17,
+    _WrVirtualMemory = 18,
+    _WrPageOut = 19,
+    _WrRendezvous = 20,
+    _Spare2 = 21,
+    _Spare3 = 22,
+    _Spare4 = 23,
+    _Spare5 = 24,
+    _WrCalloutStack = 25,
+    _WrKernel = 26,
+    _WrResource = 27,
+    _WrPushLock = 28,
+    _WrMutex = 29,
+    _WrQuantumEnd = 30,
+    _WrDispatchInt = 31,
+    _WrPreempted = 32,
+    _WrYieldExecution = 33,
+    _WrFastMutex = 34,
+    _WrGuardedMutex = 35,
+    _WrRundown = 36,
+};
+
+enum MEMORY_SIZE
+{
+    size_byte,
+    size_word,
+    size_dword,
+    size_qword
+};
+
+//Debugger typedefs
+typedef MEMORY_SIZE VALUE_SIZE;
+struct SYMBOLINFO;
+struct DBGFUNCTIONS;
+
+typedef void (*CBSYMBOLENUM)(SYMBOLINFO* symbol, void* user);
+
+//Debugger structs
+struct MEMPAGE
+{
+    MEMORY_BASIC_INFORMATION mbi;
+    char info[MAX_MODULE_SIZE];
+};
+
+struct MEMMAP
+{
+    int count;
+    MEMPAGE* page;
+};
+
+struct BRIDGEBP
+{
+    BPXTYPE type;
+    duint addr;
+    bool enabled;
+    bool singleshoot;
+    bool active;
+    char name[MAX_BREAKPOINT_SIZE];
+    char mod[MAX_MODULE_SIZE];
+    unsigned short slot;
+};
+
+struct BPMAP
+{
+    int count;
+    BRIDGEBP* bp;
+};
+
+struct FUNCTION
+{
+    duint start; //OUT
+    duint end; //OUT
+};
+
+struct LOOP
+{
+    int depth; //IN
+    duint start; //OUT
+    duint end; //OUT
+};
+
+struct ADDRINFO
+{
+    int flags; //ADDRINFOFLAGS (IN)
+    char module[MAX_MODULE_SIZE]; //module the address is in
+    char label[MAX_LABEL_SIZE];
+    char comment[MAX_COMMENT_SIZE];
+    bool isbookmark;
+    FUNCTION function;
+    LOOP loop;
+};
+
+struct SYMBOLINFO
+{
+    duint addr;
+    char* decoratedSymbol;
+    char* undecoratedSymbol;
+};
+
+struct SYMBOLMODULEINFO
+{
+    duint base;
+    char name[MAX_MODULE_SIZE];
+};
+
+struct SYMBOLCBINFO
+{
+    duint base;
+    CBSYMBOLENUM cbSymbolEnum;
+    void* user;
+};
+
+struct FLAGS
+{
+    bool c;
+    bool p;
+    bool a;
+    bool z;
+    bool s;
+    bool t;
+    bool i;
+    bool d;
+    bool o;
+};
+
+struct REGDUMP
+{
+    duint cax;
+    duint ccx;
+    duint cdx;
+    duint cbx;
+    duint csp;
+    duint cbp;
+    duint csi;
+    duint cdi;
+#ifdef _WIN64
+    duint r8;
+    duint r9;
+    duint r10;
+    duint r11;
+    duint r12;
+    duint r13;
+    duint r14;
+    duint r15;
+#endif //_WIN64
+    duint cip;
+    unsigned int eflags;
+    FLAGS flags;
+    unsigned short gs;
+    unsigned short fs;
+    unsigned short es;
+    unsigned short ds;
+    unsigned short cs;
+    unsigned short ss;
+    duint dr0;
+    duint dr1;
+    duint dr2;
+    duint dr3;
+    duint dr6;
+    duint dr7;
+};
+
+struct DISASM_ARG
+{
+    DISASM_ARGTYPE type;
+    SEGMENTREG segment;
+    char mnemonic[64];
+    duint constant;
+    duint value;
+    duint memvalue;
+};
+
+struct DISASM_INSTR
+{
+    char instruction[64];
+    DISASM_INSTRTYPE type;
+    int argcount;
+    int instr_size;
+    DISASM_ARG arg[3];
+};
+
+struct STACK_COMMENT
+{
+    char color[8]; //hex color-code
+    char comment[MAX_COMMENT_SIZE];
+};
+
+struct THREADINFO
+{
+    int ThreadNumber;
+    HANDLE hThread;
+    DWORD dwThreadId;
+    duint ThreadStartAddress;
+    duint ThreadLocalBase;
+    char threadName[MAX_THREAD_NAME_SIZE];
+};
+
+struct THREADALLINFO
+{
+    THREADINFO BasicInfo;
+    duint ThreadCip;
+    DWORD SuspendCount;
+    THREADPRIORITY Priority;
+    THREADWAITREASON WaitReason;
+    DWORD LastError;
+};
+
+struct THREADLIST
+{
+    int count;
+    THREADALLINFO* list;
+    int CurrentThread;
+};
+
+struct MEMORY_INFO
+{
+    ULONG_PTR value; //displacement / addrvalue (rip-relative)
+    MEMORY_SIZE size; //byte/word/dword/qword
+    char mnemonic[MAX_MNEMONIC_SIZE];
+};
+
+struct VALUE_INFO
+{
+    ULONG_PTR value;
+    VALUE_SIZE size;
+};
+
+struct BASIC_INSTRUCTION_INFO
+{
+    DWORD type; //value|memory|addr
+    VALUE_INFO value; //immediat
+    MEMORY_INFO memory;
+    ULONG_PTR addr; //addrvalue (jumps + calls)
+    bool branch; //jumps/calls
+    bool call; //instruction is a call
+};
+
+struct SCRIPTBRANCH
+{
+    SCRIPTBRANCHTYPE type;
+    int dest;
+    char branchlabel[256];
+};
+
+struct FUNCTION_LOOP_INFO
+{
+    duint addr;
+    duint start;
+    duint end;
+    bool manual;
+    int depth;
+};
+
+//Debugger functions
+BRIDGE_IMPEXP const char* DbgInit();
+BRIDGE_IMPEXP void DbgExit();
+BRIDGE_IMPEXP bool DbgMemRead(duint va, unsigned char* dest, duint size);
+BRIDGE_IMPEXP bool DbgMemWrite(duint va, const unsigned char* src, duint size);
+BRIDGE_IMPEXP duint DbgMemGetPageSize(duint base);
+BRIDGE_IMPEXP duint DbgMemFindBaseAddr(duint addr, duint* size);
+BRIDGE_IMPEXP bool DbgCmdExec(const char* cmd);
+BRIDGE_IMPEXP bool DbgCmdExecDirect(const char* cmd);
+BRIDGE_IMPEXP bool DbgMemMap(MEMMAP* memmap);
+BRIDGE_IMPEXP bool DbgIsValidExpression(const char* expression);
+BRIDGE_IMPEXP bool DbgIsDebugging();
+BRIDGE_IMPEXP bool DbgIsJumpGoingToExecute(duint addr);
+BRIDGE_IMPEXP bool DbgGetLabelAt(duint addr, SEGMENTREG segment, char* text);
+BRIDGE_IMPEXP bool DbgSetLabelAt(duint addr, const char* text);
+BRIDGE_IMPEXP bool DbgGetCommentAt(duint addr, char* text);
+BRIDGE_IMPEXP bool DbgSetCommentAt(duint addr, const char* text);
+BRIDGE_IMPEXP bool DbgGetBookmarkAt(duint addr);
+BRIDGE_IMPEXP bool DbgSetBookmarkAt(duint addr, bool isbookmark);
+BRIDGE_IMPEXP bool DbgGetModuleAt(duint addr, char* text);
+BRIDGE_IMPEXP BPXTYPE DbgGetBpxTypeAt(duint addr);
+BRIDGE_IMPEXP duint DbgValFromString(const char* string);
+BRIDGE_IMPEXP bool DbgGetRegDump(REGDUMP* regdump);
+BRIDGE_IMPEXP bool DbgValToString(const char* string, duint value);
+BRIDGE_IMPEXP bool DbgMemIsValidReadPtr(duint addr);
+BRIDGE_IMPEXP int DbgGetBpList(BPXTYPE type, BPMAP* list);
+BRIDGE_IMPEXP FUNCTYPE DbgGetFunctionTypeAt(duint addr);
+BRIDGE_IMPEXP LOOPTYPE DbgGetLoopTypeAt(duint addr, int depth);
+BRIDGE_IMPEXP duint DbgGetBranchDestination(duint addr);
+BRIDGE_IMPEXP void DbgScriptLoad(const char* filename);
+BRIDGE_IMPEXP void DbgScriptUnload();
+BRIDGE_IMPEXP void DbgScriptRun(int destline);
+BRIDGE_IMPEXP void DbgScriptStep();
+BRIDGE_IMPEXP bool DbgScriptBpToggle(int line);
+BRIDGE_IMPEXP bool DbgScriptBpGet(int line);
+BRIDGE_IMPEXP bool DbgScriptCmdExec(const char* command);
+BRIDGE_IMPEXP void DbgScriptAbort();
+BRIDGE_IMPEXP SCRIPTLINETYPE DbgScriptGetLineType(int line);
+BRIDGE_IMPEXP void DbgScriptSetIp(int line);
+BRIDGE_IMPEXP bool DbgScriptGetBranchInfo(int line, SCRIPTBRANCH* info);
+BRIDGE_IMPEXP void DbgSymbolEnum(duint base, CBSYMBOLENUM cbSymbolEnum, void* user);
+BRIDGE_IMPEXP bool DbgAssembleAt(duint addr, const char* instruction);
+BRIDGE_IMPEXP duint DbgModBaseFromName(const char* name);
+BRIDGE_IMPEXP void DbgDisasmAt(duint addr, DISASM_INSTR* instr);
+BRIDGE_IMPEXP bool DbgStackCommentGet(duint addr, STACK_COMMENT* comment);
+BRIDGE_IMPEXP void DbgGetThreadList(THREADLIST* list);
+BRIDGE_IMPEXP void DbgSettingsUpdated();
+BRIDGE_IMPEXP void DbgDisasmFastAt(duint addr, BASIC_INSTRUCTION_INFO* basicinfo);
+BRIDGE_IMPEXP void DbgMenuEntryClicked(int hEntry);
+BRIDGE_IMPEXP bool DbgFunctionGet(duint addr, duint* start, duint* end);
+BRIDGE_IMPEXP bool DbgFunctionOverlaps(duint start, duint end);
+BRIDGE_IMPEXP bool DbgFunctionAdd(duint start, duint end);
+BRIDGE_IMPEXP bool DbgFunctionDel(duint addr);
+BRIDGE_IMPEXP bool DbgLoopGet(int depth, duint addr, duint* start, duint* end);
+BRIDGE_IMPEXP bool DbgLoopOverlaps(int depth, duint start, duint end);
+BRIDGE_IMPEXP bool DbgLoopAdd(duint start, duint end);
+BRIDGE_IMPEXP bool DbgLoopDel(int depth, duint addr);
+BRIDGE_IMPEXP bool DbgIsRunLocked();
+BRIDGE_IMPEXP bool DbgIsBpDisabled(duint addr);
+BRIDGE_IMPEXP bool DbgSetAutoCommentAt(duint addr, const char* text);
+BRIDGE_IMPEXP void DbgClearAutoCommentRange(duint start, duint end);
+BRIDGE_IMPEXP bool DbgSetAutoLabelAt(duint addr, const char* text);
+BRIDGE_IMPEXP void DbgClearAutoLabelRange(duint start, duint end);
+BRIDGE_IMPEXP bool DbgSetAutoBookmarkAt(duint addr);
+BRIDGE_IMPEXP void DbgClearAutoBookmarkRange(duint start, duint end);
+BRIDGE_IMPEXP bool DbgSetAutoFunctionAt(duint start, duint end);
+BRIDGE_IMPEXP void DbgClearAutoFunctionRange(duint start, duint end);
+BRIDGE_IMPEXP bool DbgGetStringAt(duint addr, char* text);
+BRIDGE_IMPEXP const DBGFUNCTIONS* DbgFunctions();
+
+//Gui defines
+#define GUI_PLUGIN_MENU 0
+
+#define GUI_DISASSEMBLY 0
+#define GUI_DUMP 1
+#define GUI_STACK 2
+
+#define GUI_MAX_LINE_SIZE 65536
+
+//Gui enums
+enum GUIMSG
+{
+    GUI_DISASSEMBLE_AT,             // param1=(duint)va,            param2=(duint)cip
+    GUI_SET_DEBUG_STATE,            // param1=(DBGSTATE)state,      param2=unused
+    GUI_ADD_MSG_TO_LOG,             // param1=(const char*)msg,     param2=unused
+    GUI_CLEAR_LOG,                  // param1=unused,               param2=unused
+    GUI_UPDATE_REGISTER_VIEW,       // param1=unused,               param2=unused
+    GUI_UPDATE_DISASSEMBLY_VIEW,    // param1=unused,               param2=unused
+    GUI_UPDATE_BREAKPOINTS_VIEW,    // param1=unused,               param2=unused
+    GUI_UPDATE_WINDOW_TITLE,        // param1=(const char*)file,    param2=unused
+    GUI_GET_WINDOW_HANDLE,          // param1=unused,               param2=unused
+    GUI_DUMP_AT,                    // param1=(duint)va             param2=unused
+    GUI_SCRIPT_ADD,                 // param1=int count,            param2=const char** lines
+    GUI_SCRIPT_CLEAR,               // param1=unused,               param2=unused
+    GUI_SCRIPT_SETIP,               // param1=int line,             param2=unused
+    GUI_SCRIPT_ERROR,               // param1=int line,             param2=const char* message
+    GUI_SCRIPT_SETTITLE,            // param1=const char* title,    param2=unused
+    GUI_SCRIPT_SETINFOLINE,         // param1=int line,             param2=const char* info
+    GUI_SCRIPT_MESSAGE,             // param1=const char* message,  param2=unused
+    GUI_SCRIPT_MSGYN,               // param1=const char* message,  param2=unused
+    GUI_SYMBOL_LOG_ADD,             // param1(const char*)msg,      param2=unused
+    GUI_SYMBOL_LOG_CLEAR,           // param1=unused,               param2=unused
+    GUI_SYMBOL_SET_PROGRESS,        // param1=int percent           param2=unused
+    GUI_SYMBOL_UPDATE_MODULE_LIST,  // param1=int count,            param2=SYMBOLMODULEINFO* modules
+    GUI_REF_ADDCOLUMN,              // param1=int width,            param2=(const char*)title
+    GUI_REF_SETROWCOUNT,            // param1=int rows,             param2=unused
+    GUI_REF_GETROWCOUNT,            // param1=unused,               param2=unused
+    GUI_REF_DELETEALLCOLUMNS,       // param1=unused,               param2=unused
+    GUI_REF_SETCELLCONTENT,         // param1=(CELLINFO*)info,      param2=unused
+    GUI_REF_GETCELLCONTENT,         // param1=int row,              param2=int col
+    GUI_REF_RELOADDATA,             // param1=unused,               param2=unused
+    GUI_REF_SETSINGLESELECTION,     // param1=int index,            param2=bool scroll
+    GUI_REF_SETPROGRESS,            // param1=int progress,			param2=unused
+    GUI_REF_SETSEARCHSTARTCOL,      // param1=int col               param2=unused
+    GUI_STACK_DUMP_AT,              // param1=duint addr,           param2=duint csp
+    GUI_UPDATE_DUMP_VIEW,           // param1=unused,               param2=unused
+    GUI_UPDATE_THREAD_VIEW,         // param1=unused,               param2=unused
+    GUI_ADD_RECENT_FILE,            // param1=(const char*)file,    param2=unused
+    GUI_SET_LAST_EXCEPTION,         // param1=unsigned int code,    param2=unused
+    GUI_GET_DISASSEMBLY,            // param1=duint addr,           param2=char* text
+    GUI_MENU_ADD,                   // param1=int hMenu,            param2=const char* title
+    GUI_MENU_ADD_ENTRY,             // param1=int hMenu,            param2=const char* title
+    GUI_MENU_ADD_SEPARATOR,         // param1=int hMenu,            param2=unused
+    GUI_MENU_CLEAR,                 // param1=int hMenu,            param2=unused
+    GUI_SELECTION_GET,              // param1=int hWindow,          param2=SELECTIONDATA* selection
+    GUI_SELECTION_SET,              // param1=int hWindow,          param2=const SELECTIONDATA* selection
+    GUI_GETLINE_WINDOW,             // param1=const char* title,    param2=char* text
+    GUI_AUTOCOMPLETE_ADDCMD,        // param1=const char* cmd,      param2=ununsed
+    GUI_AUTOCOMPLETE_DELCMD,        // param1=const char* cmd,      param2=ununsed
+    GUI_AUTOCOMPLETE_CLEARALL,      // param1=ununsed,              param2=unused
+    GUI_SCRIPT_ENABLEHIGHLIGHTING,  // param1=bool enable,          param2=unused
+    GUI_ADD_MSG_TO_STATUSBAR,       // param1=const char* msg,      param2=unused
+    GUI_UPDATE_SIDEBAR,             // param1=unused,               param2=unused
+    GUI_REPAINT_TABLE_VIEW          // param1=unused,               param2=unused
+};
+
+//GUI structures
+struct CELLINFO
+{
+    int row;
+    int col;
+    const char* str;
+};
+
+struct SELECTIONDATA
+{
+    duint start;
+    duint end;
+};
+
+//GUI functions
+BRIDGE_IMPEXP void GuiDisasmAt(duint addr, duint cip);
+BRIDGE_IMPEXP void GuiSetDebugState(DBGSTATE state);
+BRIDGE_IMPEXP void GuiAddLogMessage(const char* msg);
+BRIDGE_IMPEXP void GuiLogClear();
+BRIDGE_IMPEXP void GuiUpdateAllViews();
+BRIDGE_IMPEXP void GuiUpdateRegisterView();
+BRIDGE_IMPEXP void GuiUpdateDisassemblyView();
+BRIDGE_IMPEXP void GuiUpdateBreakpointsView();
+BRIDGE_IMPEXP void GuiUpdateWindowTitle(const char* filename);
+BRIDGE_IMPEXP HWND GuiGetWindowHandle();
+BRIDGE_IMPEXP void GuiDumpAt(duint va);
+BRIDGE_IMPEXP void GuiScriptAdd(int count, const char** lines);
+BRIDGE_IMPEXP void GuiScriptClear();
+BRIDGE_IMPEXP void GuiScriptSetIp(int line);
+BRIDGE_IMPEXP void GuiScriptError(int line, const char* message);
+BRIDGE_IMPEXP void GuiScriptSetTitle(const char* title);
+BRIDGE_IMPEXP void GuiScriptSetInfoLine(int line, const char* info);
+BRIDGE_IMPEXP void GuiScriptMessage(const char* message);
+BRIDGE_IMPEXP int GuiScriptMsgyn(const char* message);
+BRIDGE_IMPEXP void GuiScriptEnableHighlighting(bool enable);
+BRIDGE_IMPEXP void GuiSymbolLogAdd(const char* message);
+BRIDGE_IMPEXP void GuiSymbolLogClear();
+BRIDGE_IMPEXP void GuiSymbolSetProgress(int percent);
+BRIDGE_IMPEXP void GuiSymbolUpdateModuleList(int count, SYMBOLMODULEINFO* modules);
+BRIDGE_IMPEXP void GuiReferenceAddColumn(int width, const char* title);
+BRIDGE_IMPEXP void GuiReferenceSetRowCount(int count);
+BRIDGE_IMPEXP int GuiReferenceGetRowCount();
+BRIDGE_IMPEXP void GuiReferenceDeleteAllColumns();
+BRIDGE_IMPEXP void GuiReferenceSetCellContent(int row, int col, const char* str);
+BRIDGE_IMPEXP const char* GuiReferenceGetCellContent(int row, int col);
+BRIDGE_IMPEXP void GuiReferenceReloadData();
+BRIDGE_IMPEXP void GuiReferenceSetSingleSelection(int index, bool scroll);
+BRIDGE_IMPEXP void GuiReferenceSetProgress(int progress);
+BRIDGE_IMPEXP void GuiReferenceSetSearchStartCol(int col);
+BRIDGE_IMPEXP void GuiStackDumpAt(duint addr, duint csp);
+BRIDGE_IMPEXP void GuiUpdateDumpView();
+BRIDGE_IMPEXP void GuiUpdateThreadView();
+BRIDGE_IMPEXP void GuiAddRecentFile(const char* file);
+BRIDGE_IMPEXP void GuiSetLastException(unsigned int exception);
+BRIDGE_IMPEXP bool GuiGetDisassembly(duint addr, char* text);
+BRIDGE_IMPEXP int GuiMenuAdd(int hMenu, const char* title);
+BRIDGE_IMPEXP int GuiMenuAddEntry(int hMenu, const char* title);
+BRIDGE_IMPEXP void GuiMenuAddSeparator(int hMenu);
+BRIDGE_IMPEXP void GuiMenuClear(int hMenu);
+BRIDGE_IMPEXP bool GuiSelectionGet(int hWindow, SELECTIONDATA* selection);
+BRIDGE_IMPEXP bool GuiSelectionSet(int hWindow, const SELECTIONDATA* selection);
+BRIDGE_IMPEXP bool GuiGetLineWindow(const char* title, char* text);
+BRIDGE_IMPEXP void GuiAutoCompleteAddCmd(const char* cmd);
+BRIDGE_IMPEXP void GuiAutoCompleteDelCmd(const char* cmd);
+BRIDGE_IMPEXP void GuiAutoCompleteClearAll();
+BRIDGE_IMPEXP void GuiAddStatusBarMessage(const char* msg);
+BRIDGE_IMPEXP void GuiUpdateSideBar();
+BRIDGE_IMPEXP void GuiRepaintTableView();
+
+#ifdef __cplusplus
+}
+#endif
+
+#pragma pack(pop)
+
+#endif // _BRIDGEMAIN_H_

src/pluginsdk/export.h

@@ -0,0 +1,173 @@
+/**
+ * @file   export.h
+ * @author [email protected]
+ * @date   Mon Sep 22 09:28:54 2008
+ *
+ * @brief  This file sets things up for C dynamic library function definitions and
+ *         static inlined functions
+ *
+ * This file is part of BeaEngine.
+ *
+ *    BeaEngine is free software: you can redistribute it and/or modify
+ *    it under the terms of the GNU Lesser General Public License as published by
+ *    the Free Software Foundation, either version 3 of the License, or
+ *    (at your option) any later version.
+ *
+ *    BeaEngine is distributed in the hope that it will be useful,
+ *    but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *    GNU Lesser General Public License for more details.
+ *
+ *    You should have received a copy of the GNU Lesser General Public License
+ *    along with BeaEngine.  If not, see <http://www.gnu.org/licenses/>. */
+
+#ifndef __BEA_EXPORT_H__
+#define __BEA_EXPORT_H__
+
+
+/*  Set up for C function definitions, even when using C++ */
+
+#ifdef __cplusplus
+#define CPP_VISIBLE_BEGIN extern "C" {
+#define CPP_VISIBLE_END }
+#else
+#define CPP_VISIBLE_BEGIN
+#define CPP_VISIBLE_END
+#endif
+
+#if defined(_MSC_VER)
+#pragma warning( disable: 4251 )
+#endif
+
+/* Some compilers use a special export keyword */
+#ifndef bea__api_export__
+# if defined(__BEOS__)
+#  if defined(__GNUC__)
+#   define bea__api_export__		__declspec(dllexport)
+#  else
+#   define bea__api_export__		__declspec(export)
+#  endif
+# elif defined(_WIN32) || defined(_WIN64)
+#  ifdef __BORLANDC__
+#    define bea__api_export__   __declspec(dllexport)
+#    define bea__api_import__ 	__declspec(dllimport)
+#  elif defined(__WATCOMC__)
+#    define bea__api_export__	__declspec(dllexport)
+#    define bea__api_import__
+#  else
+#   define bea__api_export__		__declspec(dllexport)
+#   define bea__api_import__		__declspec(dllimport)
+#  endif
+# elif defined(__OS2__)
+#  ifdef __WATCOMC__
+#    define bea__api_export__	__declspec(dllexport)
+#    define bea__api_import__
+#  else
+#   define bea__api_export__
+#   define bea__api_import__
+#  endif
+# else
+#  if defined(_WIN32) && defined(__GNUC__) && __GNUC__ >= 4
+#   define bea__api_export__		__attribubea__ ((visibility("default")))
+#   define bea__api_import__		__attribubea__ ((visibility("default")))
+#  else
+#   define bea__api_export__
+#   define bea__api_import__
+#  endif
+# endif
+#endif
+
+/* Use C calling convention by default*/
+
+#ifndef __bea_callspec__
+#if defined(BEA_USE_STDCALL)
+#if defined(__WIN32__) || defined(WIN32) || defined(_WIN32) || defined(_WIN64)
+#if defined(__BORLANDC__) || defined(__WATCOMC__) || defined(_MSC_VER) || defined(__MINGW32__) || defined(__POCC__)
+#define __bea_callspec__	 __stdcall
+#else
+#define __bea_callspec__
+#endif
+#else
+#ifdef __OS2__
+#define __bea_callspec__ _System
+#else
+#define __bea_callspec__
+#endif
+#endif
+#else
+#define __bea_callspec__
+#endif
+#endif
+
+#ifdef __SYMBIAN32__
+#	ifndef EKA2
+#		undef bea__api_export__
+#		undef bea__api_import__
+#		define bea__api_export__
+#		define bea__api_import__
+#	elif !defined(__WINS__)
+#		undef bea__api_export__
+#		undef bea__api_import__
+#		define bea__api_export__ __declspec(dllexport)
+#		define bea__api_import__ __declspec(dllexport)
+#	endif /* !EKA2 */
+#endif /* __SYMBIAN32__ */
+
+
+#if defined(__GNUC__) && (__GNUC__ > 2)
+#define BEA_EXPECT_CONDITIONAL(c)    (__builtin_expect((c), 1))
+#define BEA_UNEXPECT_CONDITIONAL(c)  (__builtin_expect((c), 0))
+#else
+#define BEA_EXPECT_CONDITIONAL(c)    (c)
+#define BEA_UNEXPECT_CONDITIONAL(c)  (c)
+#endif
+
+
+/* Set up compiler-specific options for inlining functions */
+#ifndef BEA_HAS_INLINE
+#if defined(__GNUC__) || defined(__POCC__) || defined(__WATCOMC__) || defined(__SUNPRO_C)
+#define BEA_HAS_INLINE
+#else
+/* Add any special compiler-specific cases here */
+#if defined(_MSC_VER) || defined(__BORLANDC__) ||	\
+  defined(__DMC__) || defined(__SC__) ||		\
+  defined(__WATCOMC__) || defined(__LCC__) ||		\
+  defined(__DECC) || defined(__EABI__)
+#ifndef __inline__
+#define __inline__	__inline
+#endif
+#define BEA_HAS_INLINE
+#else
+#if !defined(__MRC__) && !defined(_SGI_SOURCE)
+#ifndef __inline__
+#define __inline__ inline
+#endif
+#define BEA_HAS_INLINE
+#endif /* Not a funky compiler */
+#endif /* Visual C++ */
+#endif /* GNU C */
+#endif /* CACHE_HAS_INLINE */
+
+/* If inlining isn't supported, remove "__inline__", turning static
+   inlined functions into static functions (resulting in code bloat
+   in all files which include the offending header files)
+*/
+#ifndef BEA_HAS_INLINE
+#define __inline__
+#endif
+
+/* fix a bug with gcc under windows */
+
+#if defined(__WIN32__) || defined(WIN32) || defined(_WIN32) || defined(_WIN64)
+#if defined(__MINGW32__)
+#define const__
+#else
+#define const__ const
+#endif
+#else
+#define const__ const
+#endif
+
+
+
+#endif

src/pluginsdk/macros.h

@@ -0,0 +1,41 @@
+#ifndef __BEAENGINE_MACROS_H__
+#define __BEAENGINE_MACROS_H__
+/*
+============================================================================
+ Compiler Silencing macros
+
+ Some compilers complain about parameters that are not used.  This macro
+ should keep them quiet.
+ ============================================================================
+ */
+
+# if defined (__GNUC__) && ((__GNUC__ > 4 || (__GNUC__ == 4 && __GNUC_MINOR__ >= 2)))
+#   define BEA_UNUSED_ARG(a) (void) (a)
+#elif defined (ghs) || defined (__GNUC__) || defined (__hpux) || defined (__sgi) || defined (__DECCXX) || defined (__rational__) || defined (__USLC__) || defined (BEA__RM544) || defined (__DCC__) || defined (__PGI) || defined (__TANDEM) || defined(__BORLANDC__)
+/*
+ Some compilers complain about "statement with no effect" with (a).
+ This eliminates the warnings, and no code is generated for the null
+ conditional statement.  Note, that may only be true if -O is enabled,
+ such as with GreenHills (ghs) 1.8.8.
+ */
+
+# define BEA_UNUSED_ARG(a) do {/* null */} while (&a == 0)
+#elif defined (__DMC__)
+#if defined(__cplusplus)
+#define BEA_UNUSED_ID(identifier)
+template <class T>
+inline void BEA_UNUSED_ARG(const T& BEA_UNUSED_ID(t)) { }
+#else
+#define BEA_UNUSED_ARG(a)
+#endif
+#else /* ghs || __GNUC__ || ..... */
+# define BEA_UNUSED_ARG(a) (a)
+#endif /* ghs || __GNUC__ || ..... */
+
+#if defined (_MSC_VER) || defined(__sgi) || defined (ghs) || defined (__DECCXX) || defined(__BORLANDC__) || defined (BEA_RM544) || defined (__USLC__) || defined (__DCC__) || defined (__PGI) || defined (__TANDEM) || (defined (__HP_aCC) && (__HP_aCC >= 60500))
+# define BEA_NOTREACHED(a)
+#else  /* __sgi || ghs || ..... */
+# define BEA_NOTREACHED(a) a
+#endif /* __sgi || ghs || ..... */
+
+#endif /* __BEAENGINE_MACROS_H__ */

src/x64_dbg_analysisplugin.sln

@@ -1,18 +1,31 @@
 
-Microsoft Visual Studio Solution File, Format Version 11.00
-# Visual Studio 2010
+Microsoft Visual Studio Solution File, Format Version 12.00
+# Visual Studio 2013
+VisualStudioVersion = 12.0.30110.0
+MinimumVisualStudioVersion = 10.0.40219.1
 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "x64_dbg_analysisplugin", "x64_dbg_analysisplugin.vcxproj", "{56EC1214-EF57-5BB5-8D3B-E74ED52F6386}"
 EndProject
+Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "Solution Items", "Solution Items", "{FD596FFE-45FC-4FCB-8FFE-B9D13DB7B2F6}"
+	ProjectSection(SolutionItems) = preProject
+		examplestruct.txt = examplestruct.txt
+	EndProjectSection
+EndProject
 Global
 	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Release|ARM = Release|ARM
 		Release|Win32 = Release|Win32
+		Release|Win64 = Release|Win64
 		Release|x64 = Release|x64
 	EndGlobalSection
 	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{56EC1214-EF57-5BB5-8D3B-E74ED52F6386}.Release|ARM.ActiveCfg = Release|x64
+		{56EC1214-EF57-5BB5-8D3B-E74ED52F6386}.Release|ARM.Build.0 = Release|x64
 		{56EC1214-EF57-5BB5-8D3B-E74ED52F6386}.Release|Win32.ActiveCfg = Release|Win32
 		{56EC1214-EF57-5BB5-8D3B-E74ED52F6386}.Release|Win32.Build.0 = Release|Win32
-		{56EC1214-EF57-5BB5-8D3B-E74ED52F6386}.Release|x64.ActiveCfg = Release|x64
-		{56EC1214-EF57-5BB5-8D3B-E74ED52F6386}.Release|x64.Build.0 = Release|x64
+		{56EC1214-EF57-5BB5-8D3B-E74ED52F6386}.Release|Win64.ActiveCfg = Release|x64
+		{56EC1214-EF57-5BB5-8D3B-E74ED52F6386}.Release|Win64.Build.0 = Release|x64
+		{56EC1214-EF57-5BB5-8D3B-E74ED52F6386}.Release|x64.ActiveCfg = Release|Win32
+		{56EC1214-EF57-5BB5-8D3B-E74ED52F6386}.Release|x64.Build.0 = Release|Win32
 	EndGlobalSection
 	GlobalSection(SolutionProperties) = preSolution
 		HideSolutionNode = FALSE

src/x64_dbg_analysisplugin.vcxproj

@@ -1,6 +1,10 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="12.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
   <ItemGroup Label="ProjectConfigurations">
+    <ProjectConfiguration Include="Release|ARM">
+      <Configuration>Release</Configuration>
+      <Platform>ARM</Platform>
+    </ProjectConfiguration>
     <ProjectConfiguration Include="Release|Win32">
       <Configuration>Release</Configuration>
       <Platform>Win32</Platform>
@@ -15,6 +19,9 @@
     <ClCompile Include="ApiDB.cpp" />
     <ClCompile Include="ICommand.cpp" />
     <ClCompile Include="pluginmain.cpp" />
+    <ClCompile Include="RegisterEmulator.cpp" />
+    <ClCompile Include="StackEmulator.cpp" />
+    <ClCompile Include="S_IntermodularCallsX64.cpp" />
     <ClCompile Include="S_IntermodularCallsX86.cpp" />
     <ClCompile Include="internal.cpp" />
   </ItemGroup>
@@ -28,24 +35,35 @@
     <ClInclude Include="pluginsdk\BeaEngine.h" />
     <ClInclude Include="pluginsdk\bridgemain.h" />
     <ClInclude Include="pluginsdk\macros.h" />
-    <ClInclude Include="pluginsdk\TitanEngine\TitanEngine.h" />
+    <ClInclude Include="pluginsdk\TitanEngine\TitanEngine.hpp" />
     <ClInclude Include="pluginsdk\_plugins.h" />
     <ClInclude Include="pluginsdk\_plugin_types.h" />
-    <ClInclude Include="S_IntermodularCallsX86.h" />
+    <ClInclude Include="RegisterEmulator.h" />
+    <ClInclude Include="StackEmulator.h" />
+    <ClInclude Include="S_IntermodularCalls.h" />
     <ClInclude Include="internal.h" />
+    <ClInclude Include="TitanEngine.h" />
   </ItemGroup>
   <PropertyGroup Label="Globals">
     <Keyword>Win32Proj</Keyword>
     <ProjectName>x64_dbg_analysisplugin</ProjectName>
+    <ProjectGuid>{56EC1214-EF57-5BB5-8D3B-E74ED52F6386}</ProjectGuid>
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
     <ConfigurationType>DynamicLibrary</ConfigurationType>
     <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>v120</PlatformToolset>
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
     <ConfigurationType>DynamicLibrary</ConfigurationType>
     <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>v120</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>v120</PlatformToolset>
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
   <ImportGroup Label="ExtensionSettings">
@@ -56,6 +74,9 @@
   <ImportGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="PropertySheets">
     <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
   </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
   <PropertyGroup Label="UserMacros" />
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
     <LinkIncremental>true</LinkIncremental>
@@ -70,6 +91,11 @@
     <TargetName>analysisplugin</TargetName>
     <TargetExt>.dll</TargetExt>
   </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM'">
+    <TargetName>analysisplugin</TargetName>
+    <TargetExt>.dll</TargetExt>
+    <LinkIncremental>true</LinkIncremental>
+  </PropertyGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
     <ClCompile>
       <PreprocessorDefinitions>WIN32;NDEBUG;_WINDOWS;_USRDLL;X64_DBG_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
@@ -87,6 +113,21 @@
     </Link>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <ClCompile>
+      <PreprocessorDefinitions>WIN32;NDEBUG;_WINDOWS;_USRDLL;X64_DBG_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
+      <WarningLevel>Level3</WarningLevel>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
+    </ClCompile>
+    <Link>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <SubSystem>Windows</SubSystem>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <OptimizeReferences>true</OptimizeReferences>
+      <AdditionalDependencies>psapi.lib;pluginsdk\x64_dbg.lib;pluginsdk\x64_bridge.lib;pluginsdk\TitanEngine\TitanEngine_x64.lib;pluginsdk\BeaEngine_64.lib;%(AdditionalDependencies)</AdditionalDependencies>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM'">
     <ClCompile>
       <PreprocessorDefinitions>WIN32;NDEBUG;_WINDOWS;_USRDLL;X64_DBG_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>

src/x64_dbg_analysisplugin.vcxproj.filters

@@ -42,6 +42,15 @@
     <ClCompile Include="internal.cpp">
       <Filter>Source Files</Filter>
     </ClCompile>
+    <ClCompile Include="S_IntermodularCallsX64.cpp">
+      <Filter>Analysis</Filter>
+    </ClCompile>
+    <ClCompile Include="StackEmulator.cpp">
+      <Filter>Analysis</Filter>
+    </ClCompile>
+    <ClCompile Include="RegisterEmulator.cpp">
+      <Filter>Analysis</Filter>
+    </ClCompile>
   </ItemGroup>
   <ItemGroup>
     <ClInclude Include="pluginmain.h">
@@ -56,9 +65,6 @@
     <ClInclude Include="pluginsdk\bridgemain.h">
       <Filter>Header Files\pluginsdk</Filter>
     </ClInclude>
-    <ClInclude Include="pluginsdk\TitanEngine\TitanEngine.h">
-      <Filter>Header Files\pluginsdk\TitanEngine</Filter>
-    </ClInclude>
     <ClInclude Include="AnalysisRunner.h">
       <Filter>Analysis</Filter>
     </ClInclude>
@@ -74,9 +80,6 @@
     <ClInclude Include="ICommand.h">
       <Filter>Analysis</Filter>
     </ClInclude>
-    <ClInclude Include="S_IntermodularCallsX86.h">
-      <Filter>Analysis</Filter>
-    </ClInclude>
     <ClInclude Include="meta.h">
       <Filter>Analysis</Filter>
     </ClInclude>
@@ -86,5 +89,20 @@
     <ClInclude Include="internal.h">
       <Filter>Header Files</Filter>
     </ClInclude>
+    <ClInclude Include="StackEmulator.h">
+      <Filter>Analysis</Filter>
+    </ClInclude>
+    <ClInclude Include="pluginsdk\TitanEngine\TitanEngine.hpp">
+      <Filter>Header Files\pluginsdk\TitanEngine</Filter>
+    </ClInclude>
+    <ClInclude Include="S_IntermodularCalls.h">
+      <Filter>Analysis</Filter>
+    </ClInclude>
+    <ClInclude Include="RegisterEmulator.h">
+      <Filter>Analysis</Filter>
+    </ClInclude>
+    <ClInclude Include="TitanEngine.h">
+      <Filter>Header Files\pluginsdk\TitanEngine</Filter>
+    </ClInclude>
   </ItemGroup>
 </Project>