updated to the latest pluginsdk

angelscript/sampleScript.as

@@ -0,0 +1,13 @@
+void main()
+{
+    // Print the value that we received
+    Print("Script started!\n");
+    
+    // Do some stepping
+    for(int i=0; i<100; i++) {
+    	Print("Stepping " + (i+1) + "...\n");
+    	StepIn();
+    }
+    StepOver();
+    StepOut();
+}

angelscript/scriptstdstring.h

@@ -0,0 +1,53 @@
+//
+// Script std::string
+//
+// This function registers the std::string type with AngelScript to be used as the default string type.
+//
+// The string type is registered as a value type, thus may have performance issues if a lot of
+// string operations are performed in the script. However, for relatively few operations, this should
+// not cause any problem for most applications.
+//
+
+#ifndef SCRIPTSTDSTRING_H
+#define SCRIPTSTDSTRING_H
+
+#ifndef ANGELSCRIPT_H
+// Avoid having to inform include path if header is already include before
+#include "angelscript.h"
+#endif
+
+#include <string>
+
+//---------------------------
+// Compilation settings
+//
+
+// The use of the string pool can improve performance quite drastically
+// for scripts that work with a lot of literal string constants.
+//
+//  1 = on
+//  0 = off
+
+#ifndef AS_USE_STRINGPOOL
+#define AS_USE_STRINGPOOL 1
+#endif
+
+// Sometimes it may be desired to use the same method names as used by C++ STL.
+// This may for example reduce time when converting code from script to C++ or
+// back.
+//
+//  0 = off
+//  1 = on
+
+#ifndef AS_USE_STLNAMES
+#define AS_USE_STLNAMES 0
+#endif
+
+BEGIN_AS_NAMESPACE
+
+void RegisterStdString(asIScriptEngine* engine);
+void RegisterStdStringUtils(asIScriptEngine* engine);
+
+END_AS_NAMESPACE
+
+#endif

install32.bat

@@ -1,4 +1,4 @@
 @echo off
-set PLUGINDIR=..\x64_dbg\bin\x32\plugins
+set PLUGINDIR=..\x64dbg\bin\x32\plugins
 mkdir %PLUGINDIR%
 copy bin\x32\testplugin.dll %PLUGINDIR%\testplugin.dp32

install64.bat

@@ -1,4 +1,4 @@
 @echo off
-set PLUGINDIR=..\x64_dbg\bin\x64\plugins
+set PLUGINDIR=..\x64dbg\bin\x64\plugins
 mkdir %PLUGINDIR%
 copy bin\x64\testplugin.dll %PLUGINDIR%\testplugin.dp64

pluginsdk/DeviceNameResolver/DeviceNameResolver.h

@@ -8,12 +8,12 @@ extern "C"
 {
 #endif
 
-__declspec(dllexport) bool DevicePathToPathW(const wchar_t* szDevicePath, wchar_t* szPath, size_t nSize);
-__declspec(dllexport) bool DevicePathToPathA(const char* szDevicePath, char* szPath, size_t nSize);
-__declspec(dllexport) bool DevicePathFromFileHandleW(HANDLE hFile, wchar_t* szDevicePath, size_t nSize);
-__declspec(dllexport) bool DevicePathFromFileHandleA(HANDLE hFile, char* szDevicePath, size_t nSize);
-__declspec(dllexport) bool PathFromFileHandleW(HANDLE hFile, wchar_t* szPath, size_t nSize);
-__declspec(dllexport) bool PathFromFileHandleA(HANDLE hFile, char* szPath, size_t nSize);
+__declspec(dllexport) bool DevicePathToPathW(const wchar_t* szDevicePath, wchar_t* szPath, size_t nSizeInChars);
+__declspec(dllexport) bool DevicePathToPathA(const char* szDevicePath, char* szPath, size_t nSizeInChars);
+__declspec(dllexport) bool DevicePathFromFileHandleW(HANDLE hFile, wchar_t* szDevicePath, size_t nSizeInChars);
+__declspec(dllexport) bool DevicePathFromFileHandleA(HANDLE hFile, char* szDevicePath, size_t nSizeInChars);
+__declspec(dllexport) bool PathFromFileHandleW(HANDLE hFile, wchar_t* szPath, size_t nSizeInChars);
+__declspec(dllexport) bool PathFromFileHandleA(HANDLE hFile, char* szPath, size_t nSizeInChars);
 
 #ifdef __cplusplus
 }

pluginsdk/_dbgfunctions.h

@@ -27,18 +27,78 @@ typedef struct
     DBGCALLSTACKENTRY* entries;
 } DBGCALLSTACK;
 
+typedef struct
+{
+    duint addr;
+    duint handler;
+} DBGSEHRECORD;
+
+typedef struct
+{
+    duint total;
+    DBGSEHRECORD* records;
+} DBGSEHCHAIN;
+
 typedef struct
 {
     DWORD dwProcessId;
     char szExeFile[MAX_PATH];
 } DBGPROCESSINFO;
 
+typedef enum
+{
+    InstructionBody = 0,
+    InstructionHeading = 1,
+    InstructionTailing = 2,
+    InstructionOverlapped = 3, // The byte was executed with differing instruction base addresses
+    DataByte,  // This and the following is not implemented yet.
+    DataWord,
+    DataDWord,
+    DataQWord,
+    DataFloat,
+    DataDouble,
+    DataLongDouble,
+    DataXMM,
+    DataYMM,
+    DataMMX,
+    DataMixed, //the byte is accessed in multiple ways
+    InstructionDataMixed //the byte is both executed and written
+} TRACERECORDBYTETYPE;
+
+typedef enum
+{
+    TraceRecordNone,
+    TraceRecordBitExec,
+    TraceRecordByteWithExecTypeAndCounter,
+    TraceRecordWordWithExecTypeAndCounter
+} TRACERECORDTYPE;
+
+typedef struct
+{
+    duint Handle;
+    unsigned char TypeNumber;
+    unsigned int GrantedAccess;
+} HANDLEINFO;
+
+// The longest ip address is 1234:6789:1234:6789:1234:6789:123.567.901.345 (46 bytes)
+#define TCP_ADDR_SIZE 50
+
+typedef struct
+{
+    char RemoteAddress[TCP_ADDR_SIZE];
+    unsigned short RemotePort;
+    char LocalAddress[TCP_ADDR_SIZE];
+    unsigned short LocalPort;
+    char StateText[TCP_ADDR_SIZE];
+    unsigned int State;
+} TCPCONNECTIONINFO;
+
 typedef bool (*ASSEMBLEATEX)(duint addr, const char* instruction, char* error, bool fillnop);
 typedef bool (*SECTIONFROMADDR)(duint addr, char* section);
 typedef bool (*MODNAMEFROMADDR)(duint addr, char* modname, bool extension);
-typedef duint (*MODBASEFROMADDR)(duint addr);
-typedef duint (*MODBASEFROMNAME)(const char* modname);
-typedef duint (*MODSIZEFROMADDR)(duint addr);
+typedef duint(*MODBASEFROMADDR)(duint addr);
+typedef duint(*MODBASEFROMNAME)(const char* modname);
+typedef duint(*MODSIZEFROMADDR)(duint addr);
 typedef bool (*ASSEMBLE)(duint addr, unsigned char* dest, int* size, const char* instruction, char* error);
 typedef bool (*PATCHGET)(duint addr);
 typedef bool (*PATCHINRANGE)(duint start, duint end);
@@ -49,9 +109,10 @@ typedef bool (*PATCHRESTORE)(duint addr);
 typedef int (*PATCHFILE)(DBGPATCHINFO* patchlist, int count, const char* szFileName, char* error);
 typedef int (*MODPATHFROMADDR)(duint addr, char* path, int size);
 typedef int (*MODPATHFROMNAME)(const char* modname, char* path, int size);
-typedef bool (*DISASMFAST)(unsigned char* data, duint addr, BASIC_INSTRUCTION_INFO* basicinfo);
+typedef bool (*DISASMFAST)(const unsigned char* data, duint addr, BASIC_INSTRUCTION_INFO* basicinfo);
 typedef void (*MEMUPDATEMAP)();
 typedef void (*GETCALLSTACK)(DBGCALLSTACK* callstack);
+typedef void (*GETSEHCHAIN)(DBGSEHCHAIN* sehchain);
 typedef void (*SYMBOLDOWNLOADALLSYMBOLS)(const char* szSymbolStore);
 typedef bool (*GETJIT)(char* jit, bool x64);
 typedef bool (*GETJITAUTO)(bool* jitauto);
@@ -63,10 +124,26 @@ typedef bool (*PAGERIGHTSTOSTRING)(DWORD protect, char* rights);
 typedef bool (*ISPROCESSELEVATED)();
 typedef bool (*GETCMDLINE)(char* cmdline, size_t* cbsize);
 typedef bool (*SETCMDLINE)(const char* cmdline);
-typedef duint (*FILEOFFSETTOVA)(const char* modname, duint offset);
-typedef duint (*VATOFILEOFFSET)(duint va);
-typedef duint (*GETADDRFROMLINE)(const char* szSourceFile, int line);
-typedef bool(*GETSOURCEFROMADDR)(duint addr, char* szSourceFile, int* line);
+typedef duint(*FILEOFFSETTOVA)(const char* modname, duint offset);
+typedef duint(*VATOFILEOFFSET)(duint va);
+typedef duint(*GETADDRFROMLINE)(const char* szSourceFile, int line, duint* displacement);
+typedef bool (*GETSOURCEFROMADDR)(duint addr, char* szSourceFile, int* line);
+typedef bool (*VALFROMSTRING)(const char* string, duint* value);
+typedef bool (*PATCHGETEX)(duint addr, DBGPATCHINFO* info);
+typedef bool (*GETBRIDGEBP)(BPXTYPE type, duint addr, BRIDGEBP* bp);
+typedef bool (*STRINGFORMATINLINE)(const char* format, size_t resultSize, char* result);
+typedef void (*GETMNEMONICBRIEF)(const char* mnem, size_t resultSize, char* result);
+typedef unsigned int (*GETTRACERECORDHITCOUNT)(duint address);
+typedef TRACERECORDBYTETYPE(*GETTRACERECORDBYTETYPE)(duint address);
+typedef bool (*SETTRACERECORDTYPE)(duint pageAddress, TRACERECORDTYPE type);
+typedef TRACERECORDTYPE(*GETTRACERECORDTYPE)(duint pageAddress);
+typedef bool (*ENUMHANDLES)(ListOf(HANDLEINFO) handles);
+typedef bool (*GETHANDLENAME)(duint handle, char* name, size_t nameSize, char* typeName, size_t typeNameSize);
+typedef bool (*ENUMTCPCONNECTIONS)(ListOf(TCPCONNECTIONINFO) connections);
+typedef duint(*GETDBGEVENTS)();
+typedef int (*MODGETPARTY)(duint base);
+typedef void (*MODSETPARTY)(duint base, int party);
+typedef bool (*WATCHISWATCHDOGTRIGGERED)(unsigned int id);
 
 typedef struct DBGFUNCTIONS_
 {
@@ -89,6 +166,7 @@ typedef struct DBGFUNCTIONS_
     DISASMFAST DisasmFast;
     MEMUPDATEMAP MemUpdateMap;
     GETCALLSTACK GetCallStack;
+    GETSEHCHAIN GetSEHChain;
     SYMBOLDOWNLOADALLSYMBOLS SymbolDownloadAllSymbols;
     GETJITAUTO GetJitAuto;
     GETJIT GetJit;
@@ -104,6 +182,22 @@ typedef struct DBGFUNCTIONS_
     VATOFILEOFFSET VaToFileOffset;
     GETADDRFROMLINE GetAddrFromLine;
     GETSOURCEFROMADDR GetSourceFromAddr;
+    VALFROMSTRING ValFromString;
+    PATCHGETEX PatchGetEx;
+    GETBRIDGEBP GetBridgeBp;
+    STRINGFORMATINLINE StringFormatInline;
+    GETMNEMONICBRIEF GetMnemonicBrief;
+    GETTRACERECORDHITCOUNT GetTraceRecordHitCount;
+    GETTRACERECORDBYTETYPE GetTraceRecordByteType;
+    SETTRACERECORDTYPE SetTraceRecordType;
+    GETTRACERECORDTYPE GetTraceRecordType;
+    ENUMHANDLES EnumHandles;
+    GETHANDLENAME GetHandleName;
+    ENUMTCPCONNECTIONS EnumTcpConnections;
+    GETDBGEVENTS GetDbgEvents;
+    MODGETPARTY ModGetParty;
+    MODSETPARTY ModSetParty;
+    WATCHISWATCHDOGTRIGGERED WatchIsWatchdogTriggered;
 } DBGFUNCTIONS;
 
 #ifdef BUILD_DBG

pluginsdk/_plugin_types.h

@@ -8,7 +8,7 @@
 #else
 
 #ifdef __GNUC__
-#include "dbghelp\dbghelp.h"
+#include "dbghelp/dbghelp.h"
 #else
 #include <dbghelp.h>
 #endif // __GNUC__
@@ -19,6 +19,7 @@
 
 #include "bridgemain.h"
 #include "_dbgfunctions.h"
+#include "jansson/jansson.h"
 
 #endif // BUILD_DBG
 

pluginsdk/_plugins.h

@@ -25,6 +25,9 @@
 //defines
 #define PLUG_SDKVERSION 1
 
+#define PLUG_DB_LOADSAVE_DATA 1
+#define PLUG_DB_LOADSAVE_ALL 2
+
 //structures
 typedef struct
 {
@@ -46,6 +49,11 @@ typedef struct
     int hMenuStack; //plugin stack menu handle
 } PLUG_SETUPSTRUCT;
 
+typedef struct
+{
+    void* data; //user data
+} PLUG_SCRIPTSTRUCT;
+
 //callback structures
 typedef struct
 {
@@ -162,6 +170,12 @@ typedef struct
     bool retval;
 } PLUG_CB_WINEVENTGLOBAL;
 
+typedef struct
+{
+    json_t* root;
+    int loadSaveType;
+} PLUG_CB_LOADSAVEDB;
+
 //enums
 typedef enum
 {
@@ -185,12 +199,16 @@ typedef enum
     CB_DEBUGEVENT, //PLUG_CB_DEBUGEVENT (called on any debug event)
     CB_MENUENTRY, //PLUG_CB_MENUENTRY
     CB_WINEVENT, //PLUG_CB_WINEVENT
-    CB_WINEVENTGLOBAL //PLUG_CB_WINEVENTGLOBAL
+    CB_WINEVENTGLOBAL, //PLUG_CB_WINEVENTGLOBAL
+    CB_LOADDB, //PLUG_CB_LOADSAVEDB
+    CB_SAVEDB //PLUG_CB_LOADSAVEDB
 } CBTYPE;
 
 //typedefs
 typedef void (*CBPLUGIN)(CBTYPE cbType, void* callbackInfo);
-typedef bool (*CBPLUGINCOMMAND)(int, char**);
+typedef bool (*CBPLUGINCOMMAND)(int argc, char** argv);
+typedef void (*CBPLUGINSCRIPT)();
+typedef duint(*CBPLUGINEXPRFUNCTION)(int argc, duint* argv, void* userdata);
 
 //exports
 #ifdef __cplusplus
@@ -212,6 +230,10 @@ PLUG_IMPEXP bool _plugin_menuaddseparator(int hMenu);
 PLUG_IMPEXP bool _plugin_menuclear(int hMenu);
 PLUG_IMPEXP void _plugin_menuseticon(int hMenu, const ICONDATA* icon);
 PLUG_IMPEXP void _plugin_menuentryseticon(int pluginHandle, int hEntry, const ICONDATA* icon);
+PLUG_IMPEXP void _plugin_startscript(CBPLUGINSCRIPT cbScript);
+PLUG_IMPEXP bool _plugin_waituntilpaused();
+PLUG_IMPEXP bool _plugin_registerexprfunction(int pluginHandle, const char* name, int argc, CBPLUGINEXPRFUNCTION cbFunction, void* userdata);
+PLUG_IMPEXP bool _plugin_unregisterexprfunction(int pluginHandle, const char* name);
 
 #ifdef __cplusplus
 }

pluginsdk/_scriptapi.h

@@ -0,0 +1,8 @@
+#ifndef _SCRIPT_API_H
+#define _SCRIPT_API_H
+
+#include "_plugins.h"
+
+#define SCRIPT_EXPORT PLUG_IMPEXP
+
+#endif //_SCRIPT_API_H

pluginsdk/_scriptapi_argument.h

@@ -0,0 +1,31 @@
+#ifndef _SCRIPTAPI_ARGUMENT_H
+#define _SCRIPTAPI_ARGUMENT_H
+
+#include "_scriptapi.h"
+
+namespace Script
+{
+    namespace Argument
+    {
+        struct ArgumentInfo
+        {
+            char mod[MAX_MODULE_SIZE];
+            duint rvaStart;
+            duint rvaEnd;
+            bool manual;
+            duint instructioncount;
+        };
+
+        SCRIPT_EXPORT bool Add(duint start, duint end, bool manual, duint instructionCount = 0);
+        SCRIPT_EXPORT bool Add(const ArgumentInfo* info);
+        SCRIPT_EXPORT bool Get(duint addr, duint* start = nullptr, duint* end = nullptr, duint* instructionCount = nullptr);
+        SCRIPT_EXPORT bool GetInfo(duint addr, ArgumentInfo* info);
+        SCRIPT_EXPORT bool Overlaps(duint start, duint end);
+        SCRIPT_EXPORT bool Delete(duint address);
+        SCRIPT_EXPORT void DeleteRange(duint start, duint end, bool deleteManual = false);
+        SCRIPT_EXPORT void Clear();
+        SCRIPT_EXPORT bool GetList(ListOf(ArgumentInfo) list); //caller has the responsibility to free the list
+    }; //Argument
+}; //Script
+
+#endif //_SCRIPTAPI_ARGUMENT_H

pluginsdk/_scriptapi_assembler.h

@@ -0,0 +1,17 @@
+#ifndef _SCRIPTAPI_ASSEMBLER_H
+#define _SCRIPTAPI_ASSEMBLER_H
+
+#include "_scriptapi.h"
+
+namespace Script
+{
+    namespace Assembler
+    {
+        SCRIPT_EXPORT bool Assemble(duint addr, unsigned char* dest, int* size, const char* instruction); //dest[16]
+        SCRIPT_EXPORT bool AssembleEx(duint addr, unsigned char* dest, int* size, const char* instruction, char* error); //dest[16], error[MAX_ERROR_SIZE]
+        SCRIPT_EXPORT bool AssembleMem(duint addr, const char* instruction);
+        SCRIPT_EXPORT bool AssembleMemEx(duint addr, const char* instruction, int* size, char* error, bool fillnop); //error[MAX_ERROR_SIZE]
+    }; //Assembler
+}; //Script
+
+#endif //_SCRIPTAPI_ASSEMBLER_H

pluginsdk/_scriptapi_bookmark.h

@@ -0,0 +1,28 @@
+#ifndef _SCRIPTAPI_BOOKMARK_H
+#define _SCRIPTAPI_BOOKMARK_H
+
+#include "_scriptapi.h"
+
+namespace Script
+{
+    namespace Bookmark
+    {
+        struct BookmarkInfo
+        {
+            char mod[MAX_MODULE_SIZE];
+            duint rva;
+            bool manual;
+        };
+
+        SCRIPT_EXPORT bool Set(duint addr, bool manual = false);
+        SCRIPT_EXPORT bool Set(const BookmarkInfo* info);
+        SCRIPT_EXPORT bool Get(duint addr);
+        SCRIPT_EXPORT bool GetInfo(duint addr, BookmarkInfo* info);
+        SCRIPT_EXPORT bool Delete(duint addr);
+        SCRIPT_EXPORT void DeleteRange(duint start, duint end);
+        SCRIPT_EXPORT void Clear();
+        SCRIPT_EXPORT bool GetList(ListOf(BookmarkInfo) list); //caller has the responsibility to free the list
+    }; //Bookmark
+}; //Script
+
+#endif //_SCRIPTAPI_BOOKMARK_H

pluginsdk/_scriptapi_comment.h

@@ -0,0 +1,29 @@
+#ifndef _SCRIPTAPI_COMMENT_H
+#define _SCRIPTAPI_COMMENT_H
+
+#include "_scriptapi.h"
+
+namespace Script
+{
+    namespace Comment
+    {
+        struct CommentInfo
+        {
+            char mod[MAX_MODULE_SIZE];
+            duint rva;
+            char text[MAX_LABEL_SIZE];
+            bool manual;
+        };
+
+        SCRIPT_EXPORT bool Set(duint addr, const char* text, bool manual = false);
+        SCRIPT_EXPORT bool Set(const CommentInfo* info);
+        SCRIPT_EXPORT bool Get(duint addr, char* text); //text[MAX_COMMENT_SIZE]
+        SCRIPT_EXPORT bool GetInfo(duint addr, CommentInfo* info);
+        SCRIPT_EXPORT bool Delete(duint addr);
+        SCRIPT_EXPORT void DeleteRange(duint start, duint end);
+        SCRIPT_EXPORT void Clear();
+        SCRIPT_EXPORT bool GetList(ListOf(CommentInfo) list); //caller has the responsibility to free the list
+    }; //Comment
+}; //Script
+
+#endif //_SCRIPTAPI_COMMENT_H

pluginsdk/_scriptapi_debug.h

@@ -0,0 +1,32 @@
+#ifndef _SCRIPTAPI_DEBUG_H
+#define _SCRIPTAPI_DEBUG_H
+
+#include "_scriptapi.h"
+
+namespace Script
+{
+    namespace Debug
+    {
+        enum HardwareType
+        {
+            HardwareAccess,
+            HardwareWrite,
+            HardwareExecute
+        };
+
+        SCRIPT_EXPORT void Wait();
+        SCRIPT_EXPORT void Run();
+        SCRIPT_EXPORT void Pause();
+        SCRIPT_EXPORT void Stop();
+        SCRIPT_EXPORT void StepIn();
+        SCRIPT_EXPORT void StepOver();
+        SCRIPT_EXPORT void StepOut();
+        SCRIPT_EXPORT bool SetBreakpoint(duint address);
+        SCRIPT_EXPORT bool DeleteBreakpoint(duint address);
+        SCRIPT_EXPORT bool DisableBreakpoint(duint address);
+        SCRIPT_EXPORT bool SetHardwareBreakpoint(duint address, HardwareType type = HardwareExecute);
+        SCRIPT_EXPORT bool DeleteHardwareBreakpoint(duint address);
+    }; //Debug
+}; //Script
+
+#endif //_SCRIPTAPI_DEBUG_H

pluginsdk/_scriptapi_flag.h

@@ -0,0 +1,47 @@
+#ifndef _SCRIPTAPI_FLAG_H
+#define _SCRIPTAPI_FLAG_H
+
+#include "_scriptapi.h"
+
+namespace Script
+{
+    namespace Flag
+    {
+        enum FlagEnum
+        {
+            ZF,
+            OF,
+            CF,
+            PF,
+            SF,
+            TF,
+            AF,
+            DF,
+            IF
+        };
+
+        SCRIPT_EXPORT bool Get(FlagEnum flag);
+        SCRIPT_EXPORT bool Set(FlagEnum flag, bool value);
+
+        SCRIPT_EXPORT bool GetZF();
+        SCRIPT_EXPORT bool SetZF(bool value);
+        SCRIPT_EXPORT bool GetOF();
+        SCRIPT_EXPORT bool SetOF(bool value);
+        SCRIPT_EXPORT bool GetCF();
+        SCRIPT_EXPORT bool SetCF(bool value);
+        SCRIPT_EXPORT bool GetPF();
+        SCRIPT_EXPORT bool SetPF(bool value);
+        SCRIPT_EXPORT bool GetSF();
+        SCRIPT_EXPORT bool SetSF(bool value);
+        SCRIPT_EXPORT bool GetTF();
+        SCRIPT_EXPORT bool SetTF(bool value);
+        SCRIPT_EXPORT bool GetAF();
+        SCRIPT_EXPORT bool SetAF(bool value);
+        SCRIPT_EXPORT bool GetDF();
+        SCRIPT_EXPORT bool SetDF(bool value);
+        SCRIPT_EXPORT bool GetIF();
+        SCRIPT_EXPORT bool SetIF(bool value);
+    };
+};
+
+#endif //_SCRIPTAPI_FLAG_H

pluginsdk/_scriptapi_function.h

@@ -0,0 +1,31 @@
+#ifndef _SCRIPTAPI_FUNCTION_H
+#define _SCRIPTAPI_FUNCTION_H
+
+#include "_scriptapi.h"
+
+namespace Script
+{
+    namespace Function
+    {
+        struct FunctionInfo
+        {
+            char mod[MAX_MODULE_SIZE];
+            duint rvaStart;
+            duint rvaEnd;
+            bool manual;
+            duint instructioncount;
+        };
+
+        SCRIPT_EXPORT bool Add(duint start, duint end, bool manual, duint instructionCount = 0);
+        SCRIPT_EXPORT bool Add(const FunctionInfo* info);
+        SCRIPT_EXPORT bool Get(duint addr, duint* start = nullptr, duint* end = nullptr, duint* instructionCount = nullptr);
+        SCRIPT_EXPORT bool GetInfo(duint addr, FunctionInfo* info);
+        SCRIPT_EXPORT bool Overlaps(duint start, duint end);
+        SCRIPT_EXPORT bool Delete(duint address);
+        SCRIPT_EXPORT void DeleteRange(duint start, duint end, bool deleteManual = false);
+        SCRIPT_EXPORT void Clear();
+        SCRIPT_EXPORT bool GetList(ListOf(FunctionInfo) list); //caller has the responsibility to free the list
+    }; //Function
+}; //Script
+
+#endif //_SCRIPTAPI_FUNCTION_H

pluginsdk/_scriptapi_gui.h

@@ -0,0 +1,60 @@
+#ifndef _SCRIPTAPI_GUI_H
+#define _SCRIPTAPI_GUI_H
+
+#include "_scriptapi.h"
+
+namespace Script
+{
+    namespace Gui
+    {
+        namespace Disassembly
+        {
+            SCRIPT_EXPORT bool SelectionGet(duint* start, duint* end);
+            SCRIPT_EXPORT bool SelectionSet(duint start, duint end);
+            SCRIPT_EXPORT duint SelectionGetStart();
+            SCRIPT_EXPORT duint SelectionGetEnd();
+        }; //Disassembly
+
+        namespace Dump
+        {
+            SCRIPT_EXPORT bool SelectionGet(duint* start, duint* end);
+            SCRIPT_EXPORT bool SelectionSet(duint start, duint end);
+            SCRIPT_EXPORT duint SelectionGetStart();
+            SCRIPT_EXPORT duint SelectionGetEnd();
+        }; //Dump
+
+        namespace Stack
+        {
+            SCRIPT_EXPORT bool SelectionGet(duint* start, duint* end);
+            SCRIPT_EXPORT bool SelectionSet(duint start, duint end);
+            SCRIPT_EXPORT duint SelectionGetStart();
+            SCRIPT_EXPORT duint SelectionGetEnd();
+        }; //Stack
+    }; //Gui
+
+    namespace Gui
+    {
+        enum Window
+        {
+            DisassemblyWindow,
+            DumpWindow,
+            StackWindow
+        };
+
+        SCRIPT_EXPORT bool SelectionGet(Window window, duint* start, duint* end);
+        SCRIPT_EXPORT bool SelectionSet(Window window, duint start, duint end);
+        SCRIPT_EXPORT duint SelectionGetStart(Window window);
+        SCRIPT_EXPORT duint SelectionGetEnd(Window window);
+        SCRIPT_EXPORT void Message(const char* message);
+        SCRIPT_EXPORT bool MessageYesNo(const char* message);
+        SCRIPT_EXPORT bool InputLine(const char* title, char* text); //text[GUI_MAX_LINE_SIZE]
+        SCRIPT_EXPORT bool InputValue(const char* title, duint* value);
+        SCRIPT_EXPORT void Refresh();
+        SCRIPT_EXPORT void AddQWidgetTab(void* qWidget);
+        SCRIPT_EXPORT void ShowQWidgetTab(void* qWidget);
+        SCRIPT_EXPORT void CloseQWidgetTab(void* qWidget);
+
+    }; //Gui
+}; //Script
+
+#endif //_SCRIPTAPI_GUI_H

pluginsdk/_scriptapi_label.h

@@ -0,0 +1,30 @@
+#ifndef _SCRIPTAPI_LABEL_H
+#define _SCRIPTAPI_LABEL_H
+
+#include "_scriptapi.h"
+
+namespace Script
+{
+    namespace Label
+    {
+        struct LabelInfo
+        {
+            char mod[MAX_MODULE_SIZE];
+            duint rva;
+            char text[MAX_LABEL_SIZE];
+            bool manual;
+        };
+
+        SCRIPT_EXPORT bool Set(duint addr, const char* text, bool manual = false);
+        SCRIPT_EXPORT bool Set(const LabelInfo* info);
+        SCRIPT_EXPORT bool FromString(const char* label, duint* addr);
+        SCRIPT_EXPORT bool Get(duint addr, char* text); //text[MAX_LABEL_SIZE]
+        SCRIPT_EXPORT bool GetInfo(duint addr, LabelInfo* info);
+        SCRIPT_EXPORT bool Delete(duint addr);
+        SCRIPT_EXPORT void DeleteRange(duint start, duint end);
+        SCRIPT_EXPORT void Clear();
+        SCRIPT_EXPORT bool GetList(ListOf(LabelInfo) list); //caller has the responsibility to free the list
+    }; //Label
+}; //Script
+
+#endif //_SCRIPTAPI_LABEL_H

pluginsdk/_scriptapi_memory.h

@@ -0,0 +1,29 @@
+#ifndef _SCRIPTAPI_MEMORY_H
+#define _SCRIPTAPI_MEMORY_H
+
+#include "_scriptapi.h"
+
+namespace Script
+{
+    namespace Memory
+    {
+        SCRIPT_EXPORT bool Read(duint addr, void* data, duint size, duint* sizeRead);
+        SCRIPT_EXPORT bool Write(duint addr, const void* data, duint size, duint* sizeWritten);
+        SCRIPT_EXPORT bool IsValidPtr(duint addr);
+        SCRIPT_EXPORT duint RemoteAlloc(duint addr, duint size);
+        SCRIPT_EXPORT bool RemoteFree(duint addr);
+
+        SCRIPT_EXPORT unsigned char ReadByte(duint addr);
+        SCRIPT_EXPORT bool WriteByte(duint addr, unsigned char data);
+        SCRIPT_EXPORT unsigned short ReadWord(duint addr);
+        SCRIPT_EXPORT bool WriteWord(duint addr, unsigned short data);
+        SCRIPT_EXPORT unsigned int ReadDword(duint addr);
+        SCRIPT_EXPORT bool WriteDword(duint addr, unsigned int data);
+        SCRIPT_EXPORT unsigned long long ReadQword(duint addr);
+        SCRIPT_EXPORT bool WriteQword(duint addr, unsigned long long data);
+        SCRIPT_EXPORT duint ReadPtr(duint addr);
+        SCRIPT_EXPORT bool WritePtr(duint addr, duint data);
+    }; //Memory
+}; //Script
+
+#endif //_SCRIPTAPI_MEMORY_H

pluginsdk/_scriptapi_misc.h

@@ -0,0 +1,18 @@
+#ifndef _SCRIPTAPI_MISC_H
+#define _SCRIPTAPI_MISC_H
+
+#include "_scriptapi.h"
+
+namespace Script
+{
+    namespace Misc
+    {
+        SCRIPT_EXPORT bool ParseExpression(const char* expression, duint* value);
+        SCRIPT_EXPORT duint RemoteGetProcAddress(const char* module, const char* api);
+        SCRIPT_EXPORT duint ResolveLabel(const char* label);
+        SCRIPT_EXPORT void* Alloc(duint size);
+        SCRIPT_EXPORT void Free(void* ptr);
+    }; //Misc
+}; //Script
+
+#endif //_SCRIPTAPI_MISC_H

pluginsdk/_scriptapi_module.h

@@ -0,0 +1,56 @@
+#ifndef _SCRIPTAPI_MODULE_H
+#define _SCRIPTAPI_MODULE_H
+
+#include "_scriptapi.h"
+
+namespace Script
+{
+    namespace Module
+    {
+        struct ModuleInfo
+        {
+            duint base;
+            duint size;
+            duint entry;
+            int sectionCount;
+            char name[MAX_MODULE_SIZE];
+            char path[MAX_PATH];
+        };
+
+        struct ModuleSectionInfo
+        {
+            duint addr;
+            duint size;
+            char name[MAX_SECTION_SIZE * 5];
+        };
+
+        SCRIPT_EXPORT bool InfoFromAddr(duint addr, ModuleInfo* info);
+        SCRIPT_EXPORT bool InfoFromName(const char* name, ModuleInfo* info);
+        SCRIPT_EXPORT duint BaseFromAddr(duint addr);
+        SCRIPT_EXPORT duint BaseFromName(const char* name);
+        SCRIPT_EXPORT duint SizeFromAddr(duint addr);
+        SCRIPT_EXPORT duint SizeFromName(const char* name);
+        SCRIPT_EXPORT bool NameFromAddr(duint addr, char* name); //name[MAX_MODULE_SIZE]
+        SCRIPT_EXPORT bool PathFromAddr(duint addr, char* path); //path[MAX_PATH]
+        SCRIPT_EXPORT bool PathFromName(const char* name, char* path); //path[MAX_PATH]
+        SCRIPT_EXPORT duint EntryFromAddr(duint addr);
+        SCRIPT_EXPORT duint EntryFromName(const char* name);
+        SCRIPT_EXPORT int SectionCountFromAddr(duint addr);
+        SCRIPT_EXPORT int SectionCountFromName(const char* name);
+        SCRIPT_EXPORT bool SectionFromAddr(duint addr, int number, ModuleSectionInfo* section);
+        SCRIPT_EXPORT bool SectionFromName(const char* name, int number, ModuleSectionInfo* section);
+        SCRIPT_EXPORT bool SectionListFromAddr(duint addr, ListOf(ModuleSectionInfo) list);
+        SCRIPT_EXPORT bool SectionListFromName(const char* name, ListOf(ModuleSectionInfo) list);
+        SCRIPT_EXPORT bool GetMainModuleInfo(ModuleInfo* info);
+        SCRIPT_EXPORT duint GetMainModuleBase();
+        SCRIPT_EXPORT duint GetMainModuleSize();
+        SCRIPT_EXPORT duint GetMainModuleEntry();
+        SCRIPT_EXPORT int GetMainModuleSectionCount();
+        SCRIPT_EXPORT bool GetMainModuleName(char* name); //name[MAX_MODULE_SIZE]
+        SCRIPT_EXPORT bool GetMainModulePath(char* path); //path[MAX_PATH]
+        SCRIPT_EXPORT bool GetMainModuleSectionList(ListOf(ModuleSectionInfo) list); //caller has the responsibility to free the list
+        SCRIPT_EXPORT bool GetList(ListOf(ModuleInfo) list); //caller has the responsibility to free the list
+    }; //Module
+}; //Script
+
+#endif //_SCRIPTAPI_MODULE_H

pluginsdk/_scriptapi_pattern.h

@@ -0,0 +1,19 @@
+#ifndef _SCRIPTAPI_PATTERN_H
+#define _SCRIPTAPI_PATTERN_H
+
+#include "_scriptapi.h"
+
+namespace Script
+{
+    namespace Pattern
+    {
+        SCRIPT_EXPORT duint Find(unsigned char* data, duint datasize, const char* pattern);
+        SCRIPT_EXPORT duint FindMem(duint start, duint size, const char* pattern);
+        SCRIPT_EXPORT void Write(unsigned char* data, duint datasize, const char* pattern);
+        SCRIPT_EXPORT void WriteMem(duint start, duint size, const char* pattern);
+        SCRIPT_EXPORT bool SearchAndReplace(unsigned char* data, duint datasize, const char* searchpattern, const char* replacepattern);
+        SCRIPT_EXPORT bool SearchAndReplaceMem(duint start, duint size, const char* searchpattern, const char* replacepattern);
+    };
+};
+
+#endif //_SCRIPTAPI_FIND_H

pluginsdk/_scriptapi_register.h

@@ -0,0 +1,265 @@
+#ifndef _SCRIPTAPI_REGISTER_H
+#define _SCRIPTAPI_REGISTER_H
+
+#include "_scriptapi.h"
+
+namespace Script
+{
+    namespace Register
+    {
+        enum RegisterEnum
+        {
+            DR0,
+            DR1,
+            DR2,
+            DR3,
+            DR6,
+            DR7,
+
+            EAX,
+            AX,
+            AH,
+            AL,
+            EBX,
+            BX,
+            BH,
+            BL,
+            ECX,
+            CX,
+            CH,
+            CL,
+            EDX,
+            DX,
+            DH,
+            DL,
+            EDI,
+            DI,
+            ESI,
+            SI,
+            EBP,
+            BP,
+            ESP,
+            SP,
+            EIP,
+
+#ifdef _WIN64
+            RAX,
+            RBX,
+            RCX,
+            RDX,
+            RSI,
+            SIL,
+            RDI,
+            DIL,
+            RBP,
+            BPL,
+            RSP,
+            SPL,
+            RIP,
+            R8,
+            R8D,
+            R8W,
+            R8B,
+            R9,
+            R9D,
+            R9W,
+            R9B,
+            R10,
+            R10D,
+            R10W,
+            R10B,
+            R11,
+            R11D,
+            R11W,
+            R11B,
+            R12,
+            R12D,
+            R12W,
+            R12B,
+            R13,
+            R13D,
+            R13W,
+            R13B,
+            R14,
+            R14D,
+            R14W,
+            R14B,
+            R15,
+            R15D,
+            R15W,
+            R15B,
+#endif //_WIN64
+
+            CIP,
+            CSP,
+        }; //RegisterEnum
+
+        SCRIPT_EXPORT duint Get(RegisterEnum reg);
+        SCRIPT_EXPORT bool Set(RegisterEnum reg, duint value);
+        SCRIPT_EXPORT int Size(); //gets architecture register size in bytes
+
+        SCRIPT_EXPORT duint GetDR0();
+        SCRIPT_EXPORT bool SetDR0(duint value);
+        SCRIPT_EXPORT duint GetDR1();
+        SCRIPT_EXPORT bool SetDR1(duint value);
+        SCRIPT_EXPORT duint GetDR2();
+        SCRIPT_EXPORT bool SetDR2(duint value);
+        SCRIPT_EXPORT duint GetDR3();
+        SCRIPT_EXPORT bool SetDR3(duint value);
+        SCRIPT_EXPORT duint GetDR6();
+        SCRIPT_EXPORT bool SetDR6(duint value);
+        SCRIPT_EXPORT duint GetDR7();
+        SCRIPT_EXPORT bool SetDR7(duint value);
+
+        SCRIPT_EXPORT unsigned int GetEAX();
+        SCRIPT_EXPORT bool SetEAX(unsigned int value);
+        SCRIPT_EXPORT unsigned short GetAX();
+        SCRIPT_EXPORT bool SetAX(unsigned short value);
+        SCRIPT_EXPORT unsigned char GetAH();
+        SCRIPT_EXPORT bool SetAH(unsigned char value);
+        SCRIPT_EXPORT unsigned char GetAL();
+        SCRIPT_EXPORT bool SetAL(unsigned char value);
+        SCRIPT_EXPORT unsigned int GetEBX();
+        SCRIPT_EXPORT bool SetEBX(unsigned int value);
+        SCRIPT_EXPORT unsigned short GetBX();
+        SCRIPT_EXPORT bool SetBX(unsigned short value);
+        SCRIPT_EXPORT unsigned char GetBH();
+        SCRIPT_EXPORT bool SetBH(unsigned char value);
+        SCRIPT_EXPORT unsigned char GetBL();
+        SCRIPT_EXPORT bool SetBL(unsigned char value);
+        SCRIPT_EXPORT unsigned int GetECX();
+        SCRIPT_EXPORT bool SetECX(unsigned int value);
+        SCRIPT_EXPORT unsigned short GetCX();
+        SCRIPT_EXPORT bool SetCX(unsigned short value);
+        SCRIPT_EXPORT unsigned char GetCH();
+        SCRIPT_EXPORT bool SetCH(unsigned char value);
+        SCRIPT_EXPORT unsigned char GetCL();
+        SCRIPT_EXPORT bool SetCL(unsigned char value);
+        SCRIPT_EXPORT unsigned int GetEDX();
+        SCRIPT_EXPORT bool SetEDX(unsigned int value);
+        SCRIPT_EXPORT unsigned short GetDX();
+        SCRIPT_EXPORT bool SetDX(unsigned short value);
+        SCRIPT_EXPORT unsigned char GetDH();
+        SCRIPT_EXPORT bool SetDH(unsigned char value);
+        SCRIPT_EXPORT unsigned char GetDL();
+        SCRIPT_EXPORT bool SetDL(unsigned char value);
+        SCRIPT_EXPORT unsigned int GetEDI();
+        SCRIPT_EXPORT bool SetEDI(unsigned int value);
+        SCRIPT_EXPORT unsigned short GetDI();
+        SCRIPT_EXPORT bool SetDI(unsigned short value);
+        SCRIPT_EXPORT unsigned int GetESI();
+        SCRIPT_EXPORT bool SetESI(unsigned int value);
+        SCRIPT_EXPORT unsigned short GetSI();
+        SCRIPT_EXPORT bool SetSI(unsigned short value);
+        SCRIPT_EXPORT unsigned int GetEBP();
+        SCRIPT_EXPORT bool SetEBP(unsigned int value);
+        SCRIPT_EXPORT unsigned short GetBP();
+        SCRIPT_EXPORT bool SetBP(unsigned short value);
+        SCRIPT_EXPORT unsigned int GetESP();
+        SCRIPT_EXPORT bool SetESP(unsigned int value);
+        SCRIPT_EXPORT unsigned short GetSP();
+        SCRIPT_EXPORT bool SetSP(unsigned short value);
+        SCRIPT_EXPORT unsigned int GetEIP();
+        SCRIPT_EXPORT bool SetEIP(unsigned int value);
+
+#ifdef _WIN64
+        SCRIPT_EXPORT unsigned long long GetRAX();
+        SCRIPT_EXPORT bool SetRAX(unsigned long long value);
+        SCRIPT_EXPORT unsigned long long GetRBX();
+        SCRIPT_EXPORT bool SetRBX(unsigned long long value);
+        SCRIPT_EXPORT unsigned long long GetRCX();
+        SCRIPT_EXPORT bool SetRCX(unsigned long long value);
+        SCRIPT_EXPORT unsigned long long GetRDX();
+        SCRIPT_EXPORT bool SetRDX(unsigned long long value);
+        SCRIPT_EXPORT unsigned long long GetRSI();
+        SCRIPT_EXPORT bool SetRSI(unsigned long long value);
+        SCRIPT_EXPORT unsigned char GetSIL();
+        SCRIPT_EXPORT bool SetSIL(unsigned char value);
+        SCRIPT_EXPORT unsigned long long GetRDI();
+        SCRIPT_EXPORT bool SetRDI(unsigned long long value);
+        SCRIPT_EXPORT unsigned char GetDIL();
+        SCRIPT_EXPORT bool SetDIL(unsigned char value);
+        SCRIPT_EXPORT unsigned long long GetRBP();
+        SCRIPT_EXPORT bool SetRBP(unsigned long long value);
+        SCRIPT_EXPORT unsigned char GetBPL();
+        SCRIPT_EXPORT bool SetBPL(unsigned char value);
+        SCRIPT_EXPORT unsigned long long GetRSP();
+        SCRIPT_EXPORT bool SetRSP(unsigned long long value);
+        SCRIPT_EXPORT unsigned char GetSPL();
+        SCRIPT_EXPORT bool SetSPL(unsigned char value);
+        SCRIPT_EXPORT unsigned long long GetRIP();
+        SCRIPT_EXPORT bool SetRIP(unsigned long long value);
+        SCRIPT_EXPORT unsigned long long GetR8();
+        SCRIPT_EXPORT bool SetR8(unsigned long long value);
+        SCRIPT_EXPORT unsigned int GetR8D();
+        SCRIPT_EXPORT bool SetR8D(unsigned int value);
+        SCRIPT_EXPORT unsigned short GetR8W();
+        SCRIPT_EXPORT bool SetR8W(unsigned short value);
+        SCRIPT_EXPORT unsigned char GetR8B();
+        SCRIPT_EXPORT bool SetR8B(unsigned char value);
+        SCRIPT_EXPORT unsigned long long GetR9();
+        SCRIPT_EXPORT bool SetR9(unsigned long long value);
+        SCRIPT_EXPORT unsigned int GetR9D();
+        SCRIPT_EXPORT bool SetR9D(unsigned int value);
+        SCRIPT_EXPORT unsigned short GetR9W();
+        SCRIPT_EXPORT bool SetR9W(unsigned short value);
+        SCRIPT_EXPORT unsigned char GetR9B();
+        SCRIPT_EXPORT bool SetR9B(unsigned char value);
+        SCRIPT_EXPORT unsigned long long GetR10();
+        SCRIPT_EXPORT bool SetR10(unsigned long long value);
+        SCRIPT_EXPORT unsigned int GetR10D();
+        SCRIPT_EXPORT bool SetR10D(unsigned int value);
+        SCRIPT_EXPORT unsigned short GetR10W();
+        SCRIPT_EXPORT bool SetR10W(unsigned short value);
+        SCRIPT_EXPORT unsigned char GetR10B();
+        SCRIPT_EXPORT bool SetR10B(unsigned char value);
+        SCRIPT_EXPORT unsigned long long GetR11();
+        SCRIPT_EXPORT bool SetR11(unsigned long long value);
+        SCRIPT_EXPORT unsigned int GetR11D();
+        SCRIPT_EXPORT bool SetR11D(unsigned int value);
+        SCRIPT_EXPORT unsigned short GetR11W();
+        SCRIPT_EXPORT bool SetR11W(unsigned short value);
+        SCRIPT_EXPORT unsigned char GetR11B();
+        SCRIPT_EXPORT bool SetR11B(unsigned char value);
+        SCRIPT_EXPORT unsigned long long GetR12();
+        SCRIPT_EXPORT bool SetR12(unsigned long long value);
+        SCRIPT_EXPORT unsigned int GetR12D();
+        SCRIPT_EXPORT bool SetR12D(unsigned int value);
+        SCRIPT_EXPORT unsigned short GetR12W();
+        SCRIPT_EXPORT bool SetR12W(unsigned short value);
+        SCRIPT_EXPORT unsigned char GetR12B();
+        SCRIPT_EXPORT bool SetR12B(unsigned char value);
+        SCRIPT_EXPORT unsigned long long GetR13();
+        SCRIPT_EXPORT bool SetR13(unsigned long long value);
+        SCRIPT_EXPORT unsigned int GetR13D();
+        SCRIPT_EXPORT bool SetR13D(unsigned int value);
+        SCRIPT_EXPORT unsigned short GetR13W();
+        SCRIPT_EXPORT bool SetR13W(unsigned short value);
+        SCRIPT_EXPORT unsigned char GetR13B();
+        SCRIPT_EXPORT bool SetR13B(unsigned char value);
+        SCRIPT_EXPORT unsigned long long GetR14();
+        SCRIPT_EXPORT bool SetR14(unsigned long long value);
+        SCRIPT_EXPORT unsigned int GetR14D();
+        SCRIPT_EXPORT bool SetR14D(unsigned int value);
+        SCRIPT_EXPORT unsigned short GetR14W();
+        SCRIPT_EXPORT bool SetR14W(unsigned short value);
+        SCRIPT_EXPORT unsigned char GetR14B();
+        SCRIPT_EXPORT bool SetR14B(unsigned char value);
+        SCRIPT_EXPORT unsigned long long GetR15();
+        SCRIPT_EXPORT bool SetR15(unsigned long long value);
+        SCRIPT_EXPORT unsigned int GetR15D();
+        SCRIPT_EXPORT bool SetR15D(unsigned int value);
+        SCRIPT_EXPORT unsigned short GetR15W();
+        SCRIPT_EXPORT bool SetR15W(unsigned short value);
+        SCRIPT_EXPORT unsigned char GetR15B();
+        SCRIPT_EXPORT bool SetR15B(unsigned char value);
+#endif //_WIN64
+
+        SCRIPT_EXPORT duint GetCIP();
+        SCRIPT_EXPORT bool SetCIP(duint value);
+        SCRIPT_EXPORT duint GetCSP();
+        SCRIPT_EXPORT bool SetCSP(duint value);
+    }; //Register
+}; //Script
+
+#endif //_SCRIPTAPI_REGISTER_H

pluginsdk/_scriptapi_stack.h

@@ -0,0 +1,16 @@
+#ifndef _SCRIPTAPI_STACK_H
+#define _SCRIPTAPI_STACK_H
+
+#include "_scriptapi.h"
+
+namespace Script
+{
+    namespace Stack
+    {
+        SCRIPT_EXPORT duint Pop();
+        SCRIPT_EXPORT duint Push(duint value); //returns the previous top, equal to Peek(1)
+        SCRIPT_EXPORT duint Peek(int offset = 0); //offset is in multiples of Register::Size(), for easy x32/x64 portability
+    }; //Stack
+}; //Script
+
+#endif //_SCRIPTAPI_STACK_H

pluginsdk/_scriptapi_symbol.h

@@ -0,0 +1,30 @@
+#ifndef _SCRIPTAPI_SYMBOL_H
+#define _SCRIPTAPI_SYMBOL_H
+
+#include "_scriptapi.h"
+
+namespace Script
+{
+    namespace Symbol
+    {
+        enum SymbolType
+        {
+            Function,
+            Import,
+            Export
+        };
+
+        struct SymbolInfo
+        {
+            char mod[MAX_MODULE_SIZE];
+            duint rva;
+            char name[MAX_LABEL_SIZE];
+            bool manual;
+            SymbolType type;
+        };
+
+        SCRIPT_EXPORT bool GetList(ListOf(SymbolInfo) list); //caller has the responsibility to free the list
+    }; //Symbol
+}; //Script
+
+#endif //_SCRIPTAPI_SYMBOL_H

pluginsdk/bridgegraph.h

@@ -0,0 +1,164 @@
+#ifndef _GRAPH_H
+#define _GRAPH_H
+
+typedef struct
+{
+    duint parentGraph; //function of which this node is a part
+    duint start; //start of the block
+    duint end; //end of the block (inclusive)
+    duint brtrue; //destination if condition is true
+    duint brfalse; //destination if condition is false
+    duint icount; //number of instructions in node
+    bool terminal; //node is a RET
+    bool split; //node is a split (brtrue points to the next node)
+    void* userdata; //user data
+    ListInfo exits; //exits (including brtrue and brfalse, duint)
+    ListInfo data; //block data
+} BridgeCFNodeList;
+
+typedef struct
+{
+    duint entryPoint; //graph entry point
+    void* userdata; //user data
+    ListInfo nodes; //graph nodes (BridgeCFNodeList)
+} BridgeCFGraphList;
+
+#ifdef __cplusplus
+#if _MSC_VER > 1300
+
+#include <unordered_map>
+#include <unordered_set>
+#include <vector>
+#include <utility>
+
+struct BridgeCFNode
+{
+    duint parentGraph; //function of which this node is a part
+    duint start; //start of the block
+    duint end; //end of the block (inclusive)
+    duint brtrue; //destination if condition is true
+    duint brfalse; //destination if condition is false
+    duint icount; //number of instructions in node
+    bool terminal; //node is a RET
+    bool split; //node is a split (brtrue points to the next node)
+    void* userdata; //user data
+    std::vector<duint> exits; //exits (including brtrue and brfalse)
+    std::vector<unsigned char> data; //block data
+
+    explicit BridgeCFNode(BridgeCFNodeList* nodeList, bool freedata = true)
+    {
+        if(!nodeList)
+            __debugbreak();
+        parentGraph = nodeList->parentGraph;
+        start = nodeList->start;
+        end = nodeList->end;
+        brtrue = nodeList->brtrue;
+        brfalse = nodeList->brfalse;
+        icount = nodeList->icount;
+        terminal = nodeList->terminal;
+        split = nodeList->split;
+        userdata = nodeList->userdata;
+        if(!BridgeList<duint>::ToVector(&nodeList->exits, exits, freedata))
+            __debugbreak();
+        if(!BridgeList<unsigned char>::ToVector(&nodeList->data, data, freedata))
+            __debugbreak();
+    }
+
+    explicit BridgeCFNode(duint parentGraph, duint start, duint end)
+        : parentGraph(parentGraph),
+          start(start),
+          end(end),
+          brtrue(0),
+          brfalse(0),
+          icount(0),
+          terminal(false),
+          split(false),
+          userdata(nullptr)
+    {
+    }
+
+    explicit BridgeCFNode()
+        : BridgeCFNode(0, 0, 0)
+    {
+    }
+
+    BridgeCFNodeList ToNodeList() const
+    {
+        BridgeCFNodeList out;
+        out.parentGraph = parentGraph;
+        out.start = start;
+        out.end = end;
+        out.brtrue = brtrue;
+        out.brfalse = brfalse;
+        out.icount = icount;
+        out.terminal = terminal;
+        out.split = split;
+        out.userdata = userdata;
+        BridgeList<duint>::CopyData(&out.exits, exits);
+        BridgeList<unsigned char>::CopyData(&out.data, data);
+        return std::move(out);
+    }
+};
+
+struct BridgeCFGraph
+{
+    duint entryPoint; //graph entry point
+    void* userdata; //user data
+    std::unordered_map<duint, BridgeCFNode> nodes; //CFNode.start -> CFNode
+    std::unordered_map<duint, std::unordered_set<duint>> parents; //CFNode.start -> parents
+
+    explicit BridgeCFGraph(BridgeCFGraphList* graphList, bool freedata = true)
+    {
+        if(!graphList || graphList->nodes.size != graphList->nodes.count * sizeof(BridgeCFNodeList))
+            __debugbreak();
+        entryPoint = graphList->entryPoint;
+        userdata = graphList->userdata;
+        auto data = (BridgeCFNodeList*)graphList->nodes.data;
+        for(int i = 0; i < graphList->nodes.count; i++)
+            AddNode(BridgeCFNode(&data[i], freedata));
+        if(freedata && data)
+            BridgeFree(data);
+    }
+
+    explicit BridgeCFGraph(duint entryPoint)
+        : entryPoint(entryPoint),
+          userdata(nullptr)
+    {
+    }
+
+    void AddNode(const BridgeCFNode & node)
+    {
+        nodes[node.start] = node;
+        AddParent(node.start, node.brtrue);
+        AddParent(node.start, node.brfalse);
+    }
+
+    void AddParent(duint child, duint parent)
+    {
+        if(!child || !parent)
+            return;
+        auto found = parents.find(child);
+        if(found == parents.end())
+            parents[child] = std::unordered_set<duint>(std::initializer_list<duint> { parent });
+        else
+            found->second.insert(parent);
+    }
+
+    BridgeCFGraphList ToGraphList() const
+    {
+        BridgeCFGraphList out;
+        out.entryPoint = entryPoint;
+        out.userdata = userdata;
+        std::vector<BridgeCFNodeList> nodeList;
+        nodeList.reserve(nodes.size());
+        for(const auto & nodeIt : nodes)
+            nodeList.push_back(nodeIt.second.ToNodeList());
+        BridgeList<BridgeCFNodeList>::CopyData(&out.nodes, nodeList);
+        return std::move(out);
+    }
+};
+
+#endif //_MSC_VER
+#endif //__cplusplus
+
+#endif //_GRAPH_H

pluginsdk/bridgelist.h

@@ -0,0 +1,141 @@
+#ifndef _LIST_H
+#define _LIST_H
+
+typedef struct
+{
+    int count; //Number of element in the list.
+    size_t size; //Size of list in bytes (used for type checking).
+    void* data; //Pointer to the list contents. Must be deleted by the caller using BridgeFree (or BridgeList::Free).
+} ListInfo;
+
+#define ListOf(Type) ListInfo*
+
+#ifdef __cplusplus
+
+#include <vector>
+
+/**
+\brief A list object. This object is NOT thread safe.
+\tparam Type BridgeList contents type.
+*/
+template<typename Type>
+class BridgeList
+{
+public:
+    /**
+    \brief BridgeList constructor.
+    \param _freeData (Optional) the free function.
+    */
+    explicit BridgeList()
+    {
+        memset(&_listInfo, 0, sizeof(_listInfo));
+    }
+
+    /**
+    \brief BridgeList destructor.
+    */
+    ~BridgeList()
+    {
+        Cleanup();
+    }
+
+    /**
+    \brief Gets the list data.
+    \return Returns ListInfo->data. Can be null if the list was never initialized. Will be destroyed once this object goes out of scope!
+    */
+    Type* Data() const
+    {
+        return reinterpret_cast<Type*>(_listInfo.data);
+    }
+
+    /**
+    \brief Gets the number of elements in the list. This will crash the program if the data is not consistent with the specified template argument.
+    \return The number of elements in the list.
+    */
+    int Count() const
+    {
+        if(_listInfo.size != _listInfo.count * sizeof(Type))  //make sure the user is using the correct type.
+            __debugbreak();
+        return _listInfo.count;
+    }
+
+    /**
+    \brief Cleans up the list, freeing the list data when it is not null.
+    */
+    void Cleanup()
+    {
+        if(_listInfo.data)
+        {
+            BridgeFree(_listInfo.data);
+            _listInfo.data = nullptr;
+        }
+    }
+
+    /**
+    \brief Reference operator (cleans up the previous list)
+    \return Pointer to the ListInfo.
+    */
+    ListInfo* operator&()
+    {
+        Cleanup();
+        return &_listInfo;
+    }
+
+    /**
+    \brief Array indexer operator. This will crash if you try to access out-of-bounds.
+    \param index Zero-based index of the item you want to get.
+    \return Reference to a value at that index.
+    */
+    Type & operator[](size_t index) const
+    {
+        if(index >= size_t(Count()))  //make sure the out-of-bounds access is caught as soon as possible.
+            __debugbreak();
+        return Data()[index];
+    }
+
+    /**
+    \brief Copies data to a ListInfo structure..
+    \param [out] listInfo If non-null, information describing the list.
+    \param listData Data to copy in the ListInfo structure.
+    \return true if it succeeds, false if it fails.
+    */
+    static bool CopyData(ListInfo* listInfo, const std::vector<Type> & listData)
+    {
+        if(!listInfo)
+            return false;
+        listInfo->count = int(listData.size());
+        listInfo->size = listInfo->count * sizeof(Type);
+        if(listInfo->count)
+        {
+            listInfo->data = BridgeAlloc(listInfo->size);
+            Type* curItem = reinterpret_cast<Type*>(listInfo->data);
+            for(const auto & item : listData)
+            {
+                *curItem = item;
+                ++curItem;
+            }
+        }
+        else
+            listInfo->data = nullptr;
+        return true;
+    }
+
+    static bool ToVector(const ListInfo* listInfo, std::vector<Type> & listData, bool freedata = true)
+    {
+        if(!listInfo || listInfo->size != listInfo->count * sizeof(Type) || (listInfo->count && !listInfo->data))
+            return false;
+        listData.resize(listInfo->count);
+        for(int i = 0; i < listInfo->count; i++)
+            listData[i] = ((Type*)listInfo->data)[i];
+        if(freedata && listInfo->data)
+            BridgeFree(listInfo->data);
+        return true;
+    }
+
+private:
+    ListInfo _listInfo;
+};
+
+#endif //__cplusplus
+
+#endif //_LIST_H

pluginsdk/bridgemain.h

@@ -7,6 +7,9 @@
 #include <stdbool.h>
 #endif
 
+//list structure (and C++ wrapper)
+#include "bridgelist.h"
+
 //default structure alignments forced
 #ifdef _WIN64
 #pragma pack(push, 16)
@@ -40,31 +43,45 @@ extern "C"
 #define DBG_VERSION 25
 
 //Bridge functions
-BRIDGE_IMPEXP const char* BridgeInit();
-BRIDGE_IMPEXP const char* BridgeStart();
+BRIDGE_IMPEXP const wchar_t* BridgeInit();
+BRIDGE_IMPEXP const wchar_t* BridgeStart();
 BRIDGE_IMPEXP void* BridgeAlloc(size_t size);
 BRIDGE_IMPEXP void BridgeFree(void* ptr);
 BRIDGE_IMPEXP bool BridgeSettingGet(const char* section, const char* key, char* value);
 BRIDGE_IMPEXP bool BridgeSettingGetUint(const char* section, const char* key, duint* value);
 BRIDGE_IMPEXP bool BridgeSettingSet(const char* section, const char* key, const char* value);
 BRIDGE_IMPEXP bool BridgeSettingSetUint(const char* section, const char* key, duint value);
+BRIDGE_IMPEXP bool BridgeSettingFlush();
+BRIDGE_IMPEXP bool BridgeSettingRead(int* errorLine);
 BRIDGE_IMPEXP int BridgeGetDbgVersion();
 
+#ifdef __cplusplus
+}
+#endif
+
+#include "bridgegraph.h"
+
+#ifdef __cplusplus
+extern "C"
+{
+#endif
+
 //Debugger defines
 #define MAX_LABEL_SIZE 256
 #define MAX_COMMENT_SIZE 512
 #define MAX_MODULE_SIZE 256
+#define MAX_IMPORT_SIZE 65536
 #define MAX_BREAKPOINT_SIZE 256
+#define MAX_CONDITIONAL_EXPR_SIZE 256
+#define MAX_CONDITIONAL_TEXT_SIZE 256
 #define MAX_SCRIPT_LINE_SIZE 2048
 #define MAX_THREAD_NAME_SIZE 256
+#define MAX_WATCH_NAME_SIZE 256
 #define MAX_STRING_SIZE 512
 #define MAX_ERROR_SIZE 512
 #define RIGHTS_STRING_SIZE (sizeof("ERWCG") + 1)
 #define MAX_SECTION_SIZE 10
-
-#define TYPE_VALUE 1
-#define TYPE_MEMORY 2
-#define TYPE_ADDR 4
+#define MAX_COMMAND_LINE_SIZE 256
 #define MAX_MNEMONIC_SIZE 64
 #define PAGE_SIZE 0x1000
 
@@ -95,7 +112,8 @@ typedef enum
     flagcomment = 4,
     flagbookmark = 8,
     flagfunction = 16,
-    flagloop = 32
+    flagloop = 32,
+    flagargs = 64
 } ADDRINFOFLAGS;
 
 typedef enum
@@ -124,6 +142,24 @@ typedef enum
     LOOP_END
 } LOOPTYPE;
 
+//order by most important type last
+typedef enum
+{
+    XREF_NONE,
+    XREF_DATA,
+    XREF_JMP,
+    XREF_CALL
+} XREFTYPE;
+
+typedef enum
+{
+    ARG_NONE,
+    ARG_BEGIN,
+    ARG_MIDDLE,
+    ARG_END,
+    ARG_SINGLE
+} ARGTYPE;
+
 typedef enum
 {
     DBG_SCRIPT_LOAD,                // param1=const char* filename,      param2=unused
@@ -167,7 +203,30 @@ typedef enum
     DBG_GET_STRING_AT,              // param1=duint addr,                param2=unused
     DBG_GET_FUNCTIONS,              // param1=unused,                    param2=unused
     DBG_WIN_EVENT,                  // param1=MSG* message,              param2=long* result
-    DBG_WIN_EVENT_GLOBAL            // param1=MSG* message,              param2=unused
+    DBG_WIN_EVENT_GLOBAL,           // param1=MSG* message,              param2=unused
+    DBG_INITIALIZE_LOCKS,           // param1=unused,                    param2=unused
+    DBG_DEINITIALIZE_LOCKS,         // param1=unused,                    param2=unused
+    DBG_GET_TIME_WASTED_COUNTER,    // param1=unused,                    param2=unused
+    DBG_SYMBOL_ENUM_FROMCACHE,      // param1=SYMBOLCBINFO* cbInfo,      param2=unused
+    DBG_DELETE_COMMENT_RANGE,       // param1=duint start,               param2=duint end
+    DBG_DELETE_LABEL_RANGE,         // param1=duint start,               param2=duint end
+    DBG_DELETE_BOOKMARK_RANGE,      // param1=duint start,               param2=duint end
+    DBG_GET_XREF_COUNT_AT,          // param1=duint addr,                param2=unused
+    DBG_GET_XREF_TYPE_AT,           // param1=duint addr,                param2=unused
+    DBG_XREF_ADD,                   // param1=duint addr,                param2=duint from
+    DBG_XREF_DEL_ALL,               // param1=duint addr,                param2=unused
+    DBG_XREF_GET,                   // param1=duint addr,                param2=XREF_INFO* info
+    DBG_GET_ENCODE_TYPE_BUFFER,     // param1=duint addr,                param2=unused
+    DBG_ENCODE_TYPE_GET,            // param1=duint addr,                param2=duint size
+    DBG_DELETE_ENCODE_TYPE_RANGE,   // param1=duint start,               param2=duint end
+    DBG_ENCODE_SIZE_GET,            // param1=duint addr,                param2=duint codesize
+    DBG_DELETE_ENCODE_TYPE_SEG,     // param1=duint addr,                param2=unused
+    DBG_RELEASE_ENCODE_TYPE_BUFFER, // param1=void* buffer,              param2=unused
+    DBG_ARGUMENT_GET,               // param1=FUNCTION* info,            param2=unused
+    DBG_ARGUMENT_OVERLAPS,          // param1=FUNCTION* info,            param2=unused
+    DBG_ARGUMENT_ADD,               // param1=FUNCTION* info,            param2=unused
+    DBG_ARGUMENT_DEL,               // param1=FUNCTION* info,            param2=unused
+    DBG_GET_WATCH_LIST              // param1=ListOf(WATCHINFO),         param2=unused
 } DBGMSG;
 
 typedef enum
@@ -273,6 +332,49 @@ typedef enum
     size_qword = 8
 } MEMORY_SIZE;
 
+typedef enum
+{
+    enc_unknown,  //must be 0
+    enc_byte,     //1 byte
+    enc_word,     //2 bytes
+    enc_dword,    //4 bytes
+    enc_fword,    //6 bytes
+    enc_qword,    //8 bytes
+    enc_tbyte,    //10 bytes
+    enc_oword,    //16 bytes
+    enc_mmword,   //8 bytes
+    enc_xmmword,  //16 bytes
+    enc_ymmword,  //32 bytes
+    enc_zmmword,  //64 bytes avx512 not supported
+    enc_real4,    //4 byte float
+    enc_real8,    //8 byte double
+    enc_real10,   //10 byte decimal
+    enc_ascii,    //ascii sequence
+    enc_unicode,  //unicode sequence
+    enc_code,     //start of code
+    enc_junk,     //junk code
+    enc_middle    //middle of data
+} ENCODETYPE;
+
+typedef enum
+{
+    TYPE_UINT, // unsigned integer
+    TYPE_INT,  // signed integer
+    TYPE_FLOAT,// single precision floating point value
+    TYPE_ASCII, // ascii string
+    TYPE_UNICODE, // unicode string
+    TYPE_INVALID // invalid watch expression or data type
+} WATCHVARTYPE;
+
+typedef enum
+{
+    MODE_DISABLED, // watchdog is disabled
+    MODE_ISTRUE,   // alert if expression is not 0
+    MODE_ISFALSE,  // alert if expression is 0
+    MODE_CHANGED,  // alert if expression is changed
+    MODE_UNCHANGED // alert if expression is not changed
+} WATCHDOGMODE;
+
 //Debugger typedefs
 typedef MEMORY_SIZE VALUE_SIZE;
 typedef struct SYMBOLINFO_ SYMBOLINFO;
@@ -303,6 +405,15 @@ typedef struct
     char name[MAX_BREAKPOINT_SIZE];
     char mod[MAX_MODULE_SIZE];
     unsigned short slot;
+    // extended part
+    unsigned int hitCount;
+    bool fastResume;
+    bool silent;
+    char breakCondition[MAX_CONDITIONAL_EXPR_SIZE];
+    char logText[MAX_CONDITIONAL_TEXT_SIZE];
+    char logCondition[MAX_CONDITIONAL_EXPR_SIZE];
+    char commandText[MAX_CONDITIONAL_TEXT_SIZE];
+    char commandCondition[MAX_CONDITIONAL_EXPR_SIZE];
 } BRIDGEBP;
 
 typedef struct
@@ -311,10 +422,23 @@ typedef struct
     BRIDGEBP* bp;
 } BPMAP;
 
+typedef struct
+{
+    char WatchName[MAX_WATCH_NAME_SIZE];
+    char Expression[MAX_CONDITIONAL_EXPR_SIZE];
+    unsigned int window;
+    unsigned int id;
+    WATCHVARTYPE varType;
+    WATCHDOGMODE watchdogMode;
+    duint value;
+    bool watchdogTriggered;
+} WATCHINFO;
+
 typedef struct
 {
     duint start; //OUT
     duint end; //OUT
+    duint instrcount; //OUT
 } FUNCTION;
 
 typedef struct
@@ -324,6 +448,7 @@ typedef struct
     duint end; //OUT
 } LOOP;
 
+#ifndef _NO_ADDRINFO
 typedef struct
 {
     int flags; //ADDRINFOFLAGS (IN)
@@ -333,13 +458,16 @@ typedef struct
     bool isbookmark;
     FUNCTION function;
     LOOP loop;
+    FUNCTION args;
 } ADDRINFO;
+#endif
 
 struct SYMBOLINFO_
 {
     duint addr;
     char* decoratedSymbol;
     char* undecoratedSymbol;
+    bool isImported;
 };
 
 typedef struct
@@ -504,7 +632,7 @@ typedef struct
 typedef struct
 {
     DWORD code;
-    const char* name;
+    char name[128];
 } LASTERROR;
 
 typedef struct
@@ -521,12 +649,12 @@ typedef struct
 
 typedef struct
 {
-    DISASM_ARGTYPE type;
+    DISASM_ARGTYPE type; //normal/memory
     SEGMENTREG segment;
     char mnemonic[64];
-    duint constant;
-    duint value;
-    duint memvalue;
+    duint constant; //constant in the instruction (imm/disp)
+    duint value; //equal to constant or equal to the register value
+    duint memvalue; //memsize:[value]
 } DISASM_ARG;
 
 typedef struct
@@ -573,23 +701,28 @@ typedef struct
 
 typedef struct
 {
-    ULONG_PTR value; //displacement / addrvalue (rip-relative)
+    duint value; //displacement / addrvalue (rip-relative)
     MEMORY_SIZE size; //byte/word/dword/qword
     char mnemonic[MAX_MNEMONIC_SIZE];
 } MEMORY_INFO;
 
 typedef struct
 {
-    ULONG_PTR value;
+    duint value;
     VALUE_SIZE size;
 } VALUE_INFO;
 
+//definitions for BASIC_INSTRUCTION_INFO.type
+#define TYPE_VALUE 1
+#define TYPE_MEMORY 2
+#define TYPE_ADDR 4
+
 typedef struct
 {
     DWORD type; //value|memory|addr
     VALUE_INFO value; //immediat
     MEMORY_INFO memory;
-    ULONG_PTR addr; //addrvalue (jumps + calls)
+    duint addr; //addrvalue (jumps + calls)
     bool branch; //jumps/calls
     bool call; //instruction is a call
     int size;
@@ -612,6 +745,18 @@ typedef struct
     int depth;
 } FUNCTION_LOOP_INFO;
 
+typedef struct
+{
+    duint addr;
+    XREFTYPE type;
+} XREF_RECORD;
+
+typedef struct
+{
+    duint refcount;
+    XREF_RECORD* references;
+} XREF_INFO;
+
 //Debugger functions
 BRIDGE_IMPEXP const char* DbgInit();
 BRIDGE_IMPEXP void DbgExit();
@@ -627,10 +772,13 @@ BRIDGE_IMPEXP bool DbgIsDebugging();
 BRIDGE_IMPEXP bool DbgIsJumpGoingToExecute(duint addr);
 BRIDGE_IMPEXP bool DbgGetLabelAt(duint addr, SEGMENTREG segment, char* text);
 BRIDGE_IMPEXP bool DbgSetLabelAt(duint addr, const char* text);
+BRIDGE_IMPEXP void DbgClearLabelRange(duint start, duint end);
 BRIDGE_IMPEXP bool DbgGetCommentAt(duint addr, char* text);
 BRIDGE_IMPEXP bool DbgSetCommentAt(duint addr, const char* text);
+BRIDGE_IMPEXP void DbgClearCommentRange(duint start, duint end);
 BRIDGE_IMPEXP bool DbgGetBookmarkAt(duint addr);
 BRIDGE_IMPEXP bool DbgSetBookmarkAt(duint addr, bool isbookmark);
+BRIDGE_IMPEXP void DbgClearBookmarkRange(duint start, duint end);
 BRIDGE_IMPEXP bool DbgGetModuleAt(duint addr, char* text);
 BRIDGE_IMPEXP BPXTYPE DbgGetBpxTypeAt(duint addr);
 BRIDGE_IMPEXP duint DbgValFromString(const char* string);
@@ -653,6 +801,7 @@ BRIDGE_IMPEXP SCRIPTLINETYPE DbgScriptGetLineType(int line);
 BRIDGE_IMPEXP void DbgScriptSetIp(int line);
 BRIDGE_IMPEXP bool DbgScriptGetBranchInfo(int line, SCRIPTBRANCH* info);
 BRIDGE_IMPEXP void DbgSymbolEnum(duint base, CBSYMBOLENUM cbSymbolEnum, void* user);
+BRIDGE_IMPEXP void DbgSymbolEnumFromCache(duint base, CBSYMBOLENUM cbSymbolEnum, void* user);
 BRIDGE_IMPEXP bool DbgAssembleAt(duint addr, const char* instruction);
 BRIDGE_IMPEXP duint DbgModBaseFromName(const char* name);
 BRIDGE_IMPEXP void DbgDisasmAt(duint addr, DISASM_INSTR* instr);
@@ -665,10 +814,19 @@ BRIDGE_IMPEXP bool DbgFunctionGet(duint addr, duint* start, duint* end);
 BRIDGE_IMPEXP bool DbgFunctionOverlaps(duint start, duint end);
 BRIDGE_IMPEXP bool DbgFunctionAdd(duint start, duint end);
 BRIDGE_IMPEXP bool DbgFunctionDel(duint addr);
+BRIDGE_IMPEXP bool DbgArgumentGet(duint addr, duint* start, duint* end);
+BRIDGE_IMPEXP bool DbgArgumentOverlaps(duint start, duint end);
+BRIDGE_IMPEXP bool DbgArgumentAdd(duint start, duint end);
+BRIDGE_IMPEXP bool DbgArgumentDel(duint addr);
 BRIDGE_IMPEXP bool DbgLoopGet(int depth, duint addr, duint* start, duint* end);
 BRIDGE_IMPEXP bool DbgLoopOverlaps(int depth, duint start, duint end);
 BRIDGE_IMPEXP bool DbgLoopAdd(duint start, duint end);
 BRIDGE_IMPEXP bool DbgLoopDel(int depth, duint addr);
+BRIDGE_IMPEXP bool DbgXrefAdd(duint addr, duint from);
+BRIDGE_IMPEXP bool DbgXrefDelAll(duint addr);
+BRIDGE_IMPEXP bool DbgXrefGet(duint addr, XREF_INFO* info);
+BRIDGE_IMPEXP size_t DbgGetXrefCountAt(duint addr);
+BRIDGE_IMPEXP XREFTYPE DbgGetXrefTypeAt(duint addr);
 BRIDGE_IMPEXP bool DbgIsRunLocked();
 BRIDGE_IMPEXP bool DbgIsBpDisabled(duint addr);
 BRIDGE_IMPEXP bool DbgSetAutoCommentAt(duint addr, const char* text);
@@ -683,6 +841,17 @@ BRIDGE_IMPEXP bool DbgGetStringAt(duint addr, char* text);
 BRIDGE_IMPEXP const DBGFUNCTIONS* DbgFunctions();
 BRIDGE_IMPEXP bool DbgWinEvent(MSG* message, long* result);
 BRIDGE_IMPEXP bool DbgWinEventGlobal(MSG* message);
+BRIDGE_IMPEXP bool DbgIsRunning();
+BRIDGE_IMPEXP duint DbgGetTimeWastedCounter();
+BRIDGE_IMPEXP ARGTYPE DbgGetArgTypeAt(duint addr);
+BRIDGE_IMPEXP void* DbgGetEncodeTypeBuffer(duint addr);
+BRIDGE_IMPEXP void DbgReleaseEncodeTypeBuffer(void* buffer);
+BRIDGE_IMPEXP ENCODETYPE DbgGetEncodeTypeAt(duint addr, duint size);
+BRIDGE_IMPEXP duint DbgGetEncodeSizeAt(duint addr, duint codesize);
+BRIDGE_IMPEXP bool DbgSetEncodeType(duint addr, duint size, ENCODETYPE type);
+BRIDGE_IMPEXP void DbgDelEncodeTypeRange(duint start, duint end);
+BRIDGE_IMPEXP void DbgDelEncodeTypeSegment(duint start);
+BRIDGE_IMPEXP bool DbgGetWatchList(ListOf(WATCHINFO) list);
 
 //Gui defines
 #define GUI_PLUGIN_MENU 0
@@ -730,7 +899,8 @@ typedef enum
     GUI_REF_GETCELLCONTENT,         // param1=int row,              param2=int col
     GUI_REF_RELOADDATA,             // param1=unused,               param2=unused
     GUI_REF_SETSINGLESELECTION,     // param1=int index,            param2=bool scroll
-    GUI_REF_SETPROGRESS,            // param1=int progress,            param2=unused
+    GUI_REF_SETPROGRESS,            // param1=int progress,         param2=unused
+    GUI_REF_SETCURRENTTASKPROGRESS, // param1=int progress,         param2=const char* taskTitle
     GUI_REF_SETSEARCHSTARTCOL,      // param1=int col               param2=unused
     GUI_STACK_DUMP_AT,              // param1=duint addr,           param2=duint csp
     GUI_UPDATE_DUMP_VIEW,           // param1=unused,               param2=unused
@@ -747,21 +917,47 @@ typedef enum
     GUI_GETLINE_WINDOW,             // param1=const char* title,    param2=char* text
     GUI_AUTOCOMPLETE_ADDCMD,        // param1=const char* cmd,      param2=ununsed
     GUI_AUTOCOMPLETE_DELCMD,        // param1=const char* cmd,      param2=ununsed
-    GUI_AUTOCOMPLETE_CLEARALL,      // param1=unused,              param2=unused
+    GUI_AUTOCOMPLETE_CLEARALL,      // param1=unused,               param2=unused
     GUI_SCRIPT_ENABLEHIGHLIGHTING,  // param1=bool enable,          param2=unused
     GUI_ADD_MSG_TO_STATUSBAR,       // param1=const char* msg,      param2=unused
     GUI_UPDATE_SIDEBAR,             // param1=unused,               param2=unused
     GUI_REPAINT_TABLE_VIEW,         // param1=unused,               param2=unused
     GUI_UPDATE_PATCHES,             // param1=unused,               param2=unused
     GUI_UPDATE_CALLSTACK,           // param1=unused,               param2=unused
+    GUI_UPDATE_SEHCHAIN,            // param1=unused,               param2=unused
     GUI_SYMBOL_REFRESH_CURRENT,     // param1=unused,               param2=unused
     GUI_UPDATE_MEMORY_VIEW,         // param1=unused,               param2=unused
     GUI_REF_INITIALIZE,             // param1=const char* name,     param2=unused
     GUI_LOAD_SOURCE_FILE,           // param1=const char* path,     param2=line
     GUI_MENU_SET_ICON,              // param1=int hMenu,            param2=ICONINFO*
-    GUI_MENU_SET_ENTRY_ICON         // param1=int hEntry,           param2=ICONINFO*
+    GUI_MENU_SET_ENTRY_ICON,        // param1=int hEntry,           param2=ICONINFO*
+    GUI_SHOW_CPU,                   // param1=unused,               param2=unused
+    GUI_ADD_QWIDGET_TAB,            // param1=QWidget*,             param2=unused
+    GUI_SHOW_QWIDGET_TAB,           // param1=QWidget*,             param2=unused
+    GUI_CLOSE_QWIDGET_TAB,          // param1=QWidget*,             param2=unused
+    GUI_EXECUTE_ON_GUI_THREAD,      // param1=GUICALLBACK,          param2=unused
+    GUI_UPDATE_TIME_WASTED_COUNTER, // param1=unused,               param2=unused
+    GUI_SET_GLOBAL_NOTES,           // param1=const char* text,     param2=unused
+    GUI_GET_GLOBAL_NOTES,           // param1=char** text,          param2=unused
+    GUI_SET_DEBUGGEE_NOTES,         // param1=const char* text,     param2=unused
+    GUI_GET_DEBUGGEE_NOTES,         // param1=char** text,          param2=unused
+    GUI_DUMP_AT_N,                  // param1=int index,            param2=duint va
+    GUI_DISPLAY_WARNING,            // param1=const char *text,     param2=unused
+    GUI_REGISTER_SCRIPT_LANG,       // param1=SCRIPTTYPEINFO* info, param2=unused
+    GUI_UNREGISTER_SCRIPT_LANG,     // param1=int id,               param2=unused
+    GUI_UPDATE_ARGUMENT_VIEW,       // param1=unused,               param2=unused
+    GUI_FOCUS_VIEW,                 // param1=int hWindow,          param2=unused
+    GUI_UPDATE_WATCH_VIEW,          // param1=unused,               param2=unused
+    GUI_LOAD_GRAPH,                 // param1=BridgeCFGraphList*    param2=unused
+    GUI_GRAPH_AT,                   // param1=duint addr            param2=unused
+    GUI_UPDATE_GRAPH_VIEW           // param1=unused,               param2=unused
 } GUIMSG;
 
+//GUI Typedefs
+typedef void (*GUICALLBACK)();
+typedef bool (*GUISCRIPTEXECUTE)(const char* text);
+typedef void (*GUISCRIPTCOMPLETER)(const char* text, char** entries, int* entryCount);
+
 //GUI structures
 typedef struct
 {
@@ -782,7 +978,16 @@ typedef struct
     duint size;
 } ICONDATA;
 
+typedef struct
+{
+    char name[64];
+    int id;
+    GUISCRIPTEXECUTE execute;
+    GUISCRIPTCOMPLETER completeCommand;
+} SCRIPTTYPEINFO;
+
 //GUI functions
+//code page is utf8
 BRIDGE_IMPEXP void GuiDisasmAt(duint addr, duint cip);
 BRIDGE_IMPEXP void GuiSetDebugState(DBGSTATE state);
 BRIDGE_IMPEXP void GuiAddLogMessage(const char* msg);
@@ -818,9 +1023,11 @@ BRIDGE_IMPEXP const char* GuiReferenceGetCellContent(int row, int col);
 BRIDGE_IMPEXP void GuiReferenceReloadData();
 BRIDGE_IMPEXP void GuiReferenceSetSingleSelection(int index, bool scroll);
 BRIDGE_IMPEXP void GuiReferenceSetProgress(int progress);
+BRIDGE_IMPEXP void GuiReferenceSetCurrentTaskProgress(int progress, const char* taskTitle);
 BRIDGE_IMPEXP void GuiReferenceSetSearchStartCol(int col);
 BRIDGE_IMPEXP void GuiStackDumpAt(duint addr, duint csp);
 BRIDGE_IMPEXP void GuiUpdateDumpView();
+BRIDGE_IMPEXP void GuiUpdateWatchView();
 BRIDGE_IMPEXP void GuiUpdateThreadView();
 BRIDGE_IMPEXP void GuiUpdateMemoryView();
 BRIDGE_IMPEXP void GuiAddRecentFile(const char* file);
@@ -841,10 +1048,32 @@ BRIDGE_IMPEXP void GuiUpdateSideBar();
 BRIDGE_IMPEXP void GuiRepaintTableView();
 BRIDGE_IMPEXP void GuiUpdatePatches();
 BRIDGE_IMPEXP void GuiUpdateCallStack();
-BRIDGE_IMPEXP void GuiUpdateMemoryView();
+BRIDGE_IMPEXP void GuiUpdateSEHChain();
 BRIDGE_IMPEXP void GuiLoadSourceFile(const char* path, int line);
 BRIDGE_IMPEXP void GuiMenuSetIcon(int hMenu, const ICONDATA* icon);
 BRIDGE_IMPEXP void GuiMenuSetEntryIcon(int hEntry, const ICONDATA* icon);
+BRIDGE_IMPEXP void GuiShowCpu();
+BRIDGE_IMPEXP void GuiAddQWidgetTab(void* qWidget);
+BRIDGE_IMPEXP void GuiShowQWidgetTab(void* qWidget);
+BRIDGE_IMPEXP void GuiCloseQWidgetTab(void* qWidget);
+BRIDGE_IMPEXP void GuiExecuteOnGuiThread(GUICALLBACK cbGuiThread);
+BRIDGE_IMPEXP void GuiUpdateTimeWastedCounter();
+BRIDGE_IMPEXP void GuiSetGlobalNotes(const char* text);
+BRIDGE_IMPEXP void GuiGetGlobalNotes(char** text);
+BRIDGE_IMPEXP void GuiSetDebuggeeNotes(const char* text);
+BRIDGE_IMPEXP void GuiGetDebuggeeNotes(char** text);
+BRIDGE_IMPEXP void GuiDumpAtN(duint va, int index);
+BRIDGE_IMPEXP void GuiDisplayWarning(const char* title, const char* text);
+BRIDGE_IMPEXP void GuiRegisterScriptLanguage(SCRIPTTYPEINFO* info);
+BRIDGE_IMPEXP void GuiUnregisterScriptLanguage(int id);
+BRIDGE_IMPEXP void GuiUpdateArgumentWidget();
+BRIDGE_IMPEXP void GuiFocusView(int hWindow);
+BRIDGE_IMPEXP bool GuiIsUpdateDisabled();
+BRIDGE_IMPEXP void GuiUpdateEnable(bool updateNow);
+BRIDGE_IMPEXP void GuiUpdateDisable();
+BRIDGE_IMPEXP void GuiLoadGraph(BridgeCFGraphList* graph);
+BRIDGE_IMPEXP void GuiGraphAt(duint addr);
+BRIDGE_IMPEXP void GuiUpdateGraphView();
 
 #ifdef __cplusplus
 }

pluginsdk/capstone/m68k.h

@@ -0,0 +1,607 @@
+#ifndef CAPSTONE_M68K_H
+#define CAPSTONE_M68K_H
+
+/* Capstone Disassembly Engine */
+/* By Daniel Collin <[email protected]>, 2015-2016 */
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include "platform.h"
+
+#ifdef _MSC_VER
+#pragma warning(disable:4201)
+#endif
+
+#define M68K_OPERAND_COUNT 4
+
+//> M68K registers and special registers
+typedef enum m68k_reg
+{
+    M68K_REG_INVALID = 0,
+
+    M68K_REG_D0,
+    M68K_REG_D1,
+    M68K_REG_D2,
+    M68K_REG_D3,
+    M68K_REG_D4,
+    M68K_REG_D5,
+    M68K_REG_D6,
+    M68K_REG_D7,
+
+    M68K_REG_A0,
+    M68K_REG_A1,
+    M68K_REG_A2,
+    M68K_REG_A3,
+    M68K_REG_A4,
+    M68K_REG_A5,
+    M68K_REG_A6,
+    M68K_REG_A7,
+
+    M68K_REG_FP0,
+    M68K_REG_FP1,
+    M68K_REG_FP2,
+    M68K_REG_FP3,
+    M68K_REG_FP4,
+    M68K_REG_FP5,
+    M68K_REG_FP6,
+    M68K_REG_FP7,
+
+    M68K_REG_PC,
+
+    M68K_REG_SR,
+    M68K_REG_CCR,
+    M68K_REG_SFC,
+    M68K_REG_DFC,
+    M68K_REG_USP,
+    M68K_REG_VBR,
+    M68K_REG_CACR,
+    M68K_REG_CAAR,
+    M68K_REG_MSP,
+    M68K_REG_ISP,
+    M68K_REG_TC,
+    M68K_REG_ITT0,
+    M68K_REG_ITT1,
+    M68K_REG_DTT0,
+    M68K_REG_DTT1,
+    M68K_REG_MMUSR,
+    M68K_REG_URP,
+    M68K_REG_SRP,
+
+    M68K_REG_FPCR,
+    M68K_REG_FPSR,
+    M68K_REG_FPIAR,
+
+    M68K_REG_ENDING,   // <-- mark the end of the list of registers
+} m68k_reg;
+
+//> M68K Addressing Modes
+typedef enum m68k_address_mode
+{
+    M68K_AM_NONE = 0,           // No address mode.
+
+    M68K_AM_REG_DIRECT_DATA,        // Register Direct - Data
+    M68K_AM_REG_DIRECT_ADDR,        // Register Direct - Address
+
+    M68K_AM_REGI_ADDR,              // Register Indirect - Address
+    M68K_AM_REGI_ADDR_POST_INC,     // Register Indirect - Address with Postincrement
+    M68K_AM_REGI_ADDR_PRE_DEC,      // Register Indirect - Address with Predecrement
+    M68K_AM_REGI_ADDR_DISP,         // Register Indirect - Address with Displacement
+
+    M68K_AM_AREGI_INDEX_8_BIT_DISP, // Address Register Indirect With Index- 8-bit displacement
+    M68K_AM_AREGI_INDEX_BASE_DISP,  // Address Register Indirect With Index- Base displacement
+
+    M68K_AM_MEMI_POST_INDEX,        // Memory indirect - Postindex
+    M68K_AM_MEMI_PRE_INDEX,         // Memory indirect - Preindex
+
+    M68K_AM_PCI_DISP,               // Program Counter Indirect - with Displacement
+
+    M68K_AM_PCI_INDEX_8_BIT_DISP,   // Program Counter Indirect with Index - with 8-Bit Displacement
+    M68K_AM_PCI_INDEX_BASE_DISP,    // Program Counter Indirect with Index - with Base Displacement
+
+    M68K_AM_PC_MEMI_POST_INDEX,     // Program Counter Memory Indirect - Postindexed
+    M68K_AM_PC_MEMI_PRE_INDEX,      // Program Counter Memory Indirect - Preindexed
+
+    M68K_AM_ABSOLUTE_DATA_SHORT,    // Absolute Data Addressing  - Short
+    M68K_AM_ABSOLUTE_DATA_LONG,     // Absolute Data Addressing  - Long
+    M68K_AM_IMMEDIATE,              // Immediate value
+} m68k_address_mode;
+
+//> Operand type for instruction's operands
+typedef enum m68k_op_type
+{
+    M68K_OP_INVALID = 0, // = CS_OP_INVALID (Uninitialized).
+    M68K_OP_REG,         // = CS_OP_REG (Register operand).
+    M68K_OP_IMM,         // = CS_OP_IMM (Immediate operand).
+    M68K_OP_MEM,         // = CS_OP_MEM (Memory operand).
+    M68K_OP_FP_SINGLE,   // single precision Floating-Point operand
+    M68K_OP_FP_DOUBLE,   // double precision Floating-Point operand
+    M68K_OP_REG_BITS,    // Register bits move
+    M68K_OP_REG_PAIR,    // Register pair in the same op (upper 4 bits for first reg, lower for second)
+} m68k_op_type;
+
+// Instruction's operand referring to memory
+// This is associated with M68K_OP_MEM operand type above
+typedef struct m68k_op_mem
+{
+    m68k_reg base_reg;      // base register (or M68K_REG_INVALID if irrelevant)
+    m68k_reg index_reg;     // index register (or M68K_REG_INVALID if irrelevant)
+    m68k_reg in_base_reg;   // indirect base register (or M68K_REG_INVALID if irrelevant)
+    uint32_t in_disp;       // indirect displacement
+    uint32_t out_disp;      // other displacement
+    uint16_t disp;          // displacement value
+    uint8_t scale;          // scale for index register
+    uint8_t bitfield;       // set to true if the two values below should be used
+    uint8_t width;          // used for bf* instructions
+    uint8_t offset;         // used for bf* instructions
+    uint8_t index_size;     // 0 = w, 1 = l
+} m68k_op_mem;
+
+// Instruction operand
+typedef struct cs_m68k_op
+{
+    union
+    {
+        uint64_t imm;               // immediate value for IMM operand
+        double dimm;            // double imm
+        float simm;             // float imm
+        m68k_reg reg;           // register value for REG operand
+        struct              // register pair in one operand
+        {
+            m68k_reg reg_0;
+            m68k_reg reg_1;
+        } reg_pair;
+        m68k_op_mem mem;        // data when operand is targeting memory
+        uint32_t register_bits; // register bits for movem etc. (always in d0-d7, a0-a7, fp0 - fp7 order)
+    };
+    m68k_op_type type;
+    m68k_address_mode address_mode; // M68K addressing mode for this op
+} cs_m68k_op;
+
+// Operation size of the CPU instructions
+typedef enum m68k_cpu_size
+{
+    M68K_CPU_SIZE_NONE = 0,     // unsized or unspecified
+    M68K_CPU_SIZE_BYTE = 1,     // 1 byte in size
+    M68K_CPU_SIZE_WORD = 2,     // 2 bytes in size
+    M68K_CPU_SIZE_LONG = 4,     // 4 bytes in size
+} m68k_cpu_size;
+
+// Operation size of the FPU instructions (Notice that FPU instruction can also use CPU sizes if needed)
+typedef enum m68k_fpu_size
+{
+    M68K_FPU_SIZE_NONE = 0,     // unsized like fsave/frestore
+    M68K_FPU_SIZE_SINGLE = 4,       // 4 byte in size (single float)
+    M68K_FPU_SIZE_DOUBLE = 8,       // 8 byte in size (double)
+    M68K_FPU_SIZE_EXTENDED = 12,    // 12 byte in size (extended real format)
+} m68k_fpu_size;
+
+// Type of size that is being used for the current instruction
+typedef enum m68k_size_type
+{
+    M68K_SIZE_TYPE_INVALID = 0,
+
+    M68K_SIZE_TYPE_CPU,
+    M68K_SIZE_TYPE_FPU,
+} m68k_size_type;
+
+// Operation size of the current instruction (NOT the actually size of instruction)
+typedef struct m68k_op_size
+{
+    m68k_size_type type;
+    union
+    {
+        m68k_cpu_size cpu_size;
+        m68k_fpu_size fpu_size;
+    };
+} m68k_op_size;
+
+// The M68K instruction and it's operands
+typedef struct cs_m68k
+{
+    // Number of operands of this instruction or 0 when instruction has no operand.
+    cs_m68k_op operands[M68K_OPERAND_COUNT]; // operands for this instruction.
+    m68k_op_size op_size;   // size of data operand works on in bytes (.b, .w, .l, etc)
+    uint8_t op_count; // number of operands for the instruction
+} cs_m68k;
+
+//> M68K instruction
+typedef enum m68k_insn
+{
+    M68K_INS_INVALID = 0,
+
+    M68K_INS_ABCD,
+    M68K_INS_ADD,
+    M68K_INS_ADDA,
+    M68K_INS_ADDI,
+    M68K_INS_ADDQ,
+    M68K_INS_ADDX,
+    M68K_INS_AND,
+    M68K_INS_ANDI,
+    M68K_INS_ASL,
+    M68K_INS_ASR,
+    M68K_INS_BHS,
+    M68K_INS_BLO,
+    M68K_INS_BHI,
+    M68K_INS_BLS,
+    M68K_INS_BCC,
+    M68K_INS_BCS,
+    M68K_INS_BNE,
+    M68K_INS_BEQ,
+    M68K_INS_BVC,
+    M68K_INS_BVS,
+    M68K_INS_BPL,
+    M68K_INS_BMI,
+    M68K_INS_BGE,
+    M68K_INS_BLT,
+    M68K_INS_BGT,
+    M68K_INS_BLE,
+    M68K_INS_BRA,
+    M68K_INS_BSR,
+    M68K_INS_BCHG,
+    M68K_INS_BCLR,
+    M68K_INS_BSET,
+    M68K_INS_BTST,
+    M68K_INS_BFCHG,
+    M68K_INS_BFCLR,
+    M68K_INS_BFEXTS,
+    M68K_INS_BFEXTU,
+    M68K_INS_BFFFO,
+    M68K_INS_BFINS,
+    M68K_INS_BFSET,
+    M68K_INS_BFTST,
+    M68K_INS_BKPT,
+    M68K_INS_CALLM,
+    M68K_INS_CAS,
+    M68K_INS_CAS2,
+    M68K_INS_CHK,
+    M68K_INS_CHK2,
+    M68K_INS_CLR,
+    M68K_INS_CMP,
+    M68K_INS_CMPA,
+    M68K_INS_CMPI,
+    M68K_INS_CMPM,
+    M68K_INS_CMP2,
+    M68K_INS_CINVL,
+    M68K_INS_CINVP,
+    M68K_INS_CINVA,
+    M68K_INS_CPUSHL,
+    M68K_INS_CPUSHP,
+    M68K_INS_CPUSHA,
+    M68K_INS_DBT,
+    M68K_INS_DBF,
+    M68K_INS_DBHI,
+    M68K_INS_DBLS,
+    M68K_INS_DBCC,
+    M68K_INS_DBCS,
+    M68K_INS_DBNE,
+    M68K_INS_DBEQ,
+    M68K_INS_DBVC,
+    M68K_INS_DBVS,
+    M68K_INS_DBPL,
+    M68K_INS_DBMI,
+    M68K_INS_DBGE,
+    M68K_INS_DBLT,
+    M68K_INS_DBGT,
+    M68K_INS_DBLE,
+    M68K_INS_DBRA,
+    M68K_INS_DIVS,
+    M68K_INS_DIVSL,
+    M68K_INS_DIVU,
+    M68K_INS_DIVUL,
+    M68K_INS_EOR,
+    M68K_INS_EORI,
+    M68K_INS_EXG,
+    M68K_INS_EXT,
+    M68K_INS_EXTB,
+    M68K_INS_FABS,
+    M68K_INS_FSABS,
+    M68K_INS_FDABS,
+    M68K_INS_FACOS,
+    M68K_INS_FADD,
+    M68K_INS_FSADD,
+    M68K_INS_FDADD,
+    M68K_INS_FASIN,
+    M68K_INS_FATAN,
+    M68K_INS_FATANH,
+    M68K_INS_FBF,
+    M68K_INS_FBEQ,
+    M68K_INS_FBOGT,
+    M68K_INS_FBOGE,
+    M68K_INS_FBOLT,
+    M68K_INS_FBOLE,
+    M68K_INS_FBOGL,
+    M68K_INS_FBOR,
+    M68K_INS_FBUN,
+    M68K_INS_FBUEQ,
+    M68K_INS_FBUGT,
+    M68K_INS_FBUGE,
+    M68K_INS_FBULT,
+    M68K_INS_FBULE,
+    M68K_INS_FBNE,
+    M68K_INS_FBT,
+    M68K_INS_FBSF,
+    M68K_INS_FBSEQ,
+    M68K_INS_FBGT,
+    M68K_INS_FBGE,
+    M68K_INS_FBLT,
+    M68K_INS_FBLE,
+    M68K_INS_FBGL,
+    M68K_INS_FBGLE,
+    M68K_INS_FBNGLE,
+    M68K_INS_FBNGL,
+    M68K_INS_FBNLE,
+    M68K_INS_FBNLT,
+    M68K_INS_FBNGE,
+    M68K_INS_FBNGT,
+    M68K_INS_FBSNE,
+    M68K_INS_FBST,
+    M68K_INS_FCMP,
+    M68K_INS_FCOS,
+    M68K_INS_FCOSH,
+    M68K_INS_FDBF,
+    M68K_INS_FDBEQ,
+    M68K_INS_FDBOGT,
+    M68K_INS_FDBOGE,
+    M68K_INS_FDBOLT,
+    M68K_INS_FDBOLE,
+    M68K_INS_FDBOGL,
+    M68K_INS_FDBOR,
+    M68K_INS_FDBUN,
+    M68K_INS_FDBUEQ,
+    M68K_INS_FDBUGT,
+    M68K_INS_FDBUGE,
+    M68K_INS_FDBULT,
+    M68K_INS_FDBULE,
+    M68K_INS_FDBNE,
+    M68K_INS_FDBT,
+    M68K_INS_FDBSF,
+    M68K_INS_FDBSEQ,
+    M68K_INS_FDBGT,
+    M68K_INS_FDBGE,
+    M68K_INS_FDBLT,
+    M68K_INS_FDBLE,
+    M68K_INS_FDBGL,
+    M68K_INS_FDBGLE,
+    M68K_INS_FDBNGLE,
+    M68K_INS_FDBNGL,
+    M68K_INS_FDBNLE,
+    M68K_INS_FDBNLT,
+    M68K_INS_FDBNGE,
+    M68K_INS_FDBNGT,
+    M68K_INS_FDBSNE,
+    M68K_INS_FDBST,
+    M68K_INS_FDIV,
+    M68K_INS_FSDIV,
+    M68K_INS_FDDIV,
+    M68K_INS_FETOX,
+    M68K_INS_FETOXM1,
+    M68K_INS_FGETEXP,
+    M68K_INS_FGETMAN,
+    M68K_INS_FINT,
+    M68K_INS_FINTRZ,
+    M68K_INS_FLOG10,
+    M68K_INS_FLOG2,
+    M68K_INS_FLOGN,
+    M68K_INS_FLOGNP1,
+    M68K_INS_FMOD,
+    M68K_INS_FMOVE,
+    M68K_INS_FSMOVE,
+    M68K_INS_FDMOVE,
+    M68K_INS_FMOVECR,
+    M68K_INS_FMOVEM,
+    M68K_INS_FMUL,
+    M68K_INS_FSMUL,
+    M68K_INS_FDMUL,
+    M68K_INS_FNEG,
+    M68K_INS_FSNEG,
+    M68K_INS_FDNEG,
+    M68K_INS_FNOP,
+    M68K_INS_FREM,
+    M68K_INS_FRESTORE,
+    M68K_INS_FSAVE,
+    M68K_INS_FSCALE,
+    M68K_INS_FSGLDIV,
+    M68K_INS_FSGLMUL,
+    M68K_INS_FSIN,
+    M68K_INS_FSINCOS,
+    M68K_INS_FSINH,
+    M68K_INS_FSQRT,
+    M68K_INS_FSSQRT,
+    M68K_INS_FDSQRT,
+    M68K_INS_FSF,
+    M68K_INS_FSBEQ,
+    M68K_INS_FSOGT,
+    M68K_INS_FSOGE,
+    M68K_INS_FSOLT,
+    M68K_INS_FSOLE,
+    M68K_INS_FSOGL,
+    M68K_INS_FSOR,
+    M68K_INS_FSUN,
+    M68K_INS_FSUEQ,
+    M68K_INS_FSUGT,
+    M68K_INS_FSUGE,
+    M68K_INS_FSULT,
+    M68K_INS_FSULE,
+    M68K_INS_FSNE,
+    M68K_INS_FST,
+    M68K_INS_FSSF,
+    M68K_INS_FSSEQ,
+    M68K_INS_FSGT,
+    M68K_INS_FSGE,
+    M68K_INS_FSLT,
+    M68K_INS_FSLE,
+    M68K_INS_FSGL,
+    M68K_INS_FSGLE,
+    M68K_INS_FSNGLE,
+    M68K_INS_FSNGL,
+    M68K_INS_FSNLE,
+    M68K_INS_FSNLT,
+    M68K_INS_FSNGE,
+    M68K_INS_FSNGT,
+    M68K_INS_FSSNE,
+    M68K_INS_FSST,
+    M68K_INS_FSUB,
+    M68K_INS_FSSUB,
+    M68K_INS_FDSUB,
+    M68K_INS_FTAN,
+    M68K_INS_FTANH,
+    M68K_INS_FTENTOX,
+    M68K_INS_FTRAPF,
+    M68K_INS_FTRAPEQ,
+    M68K_INS_FTRAPOGT,
+    M68K_INS_FTRAPOGE,
+    M68K_INS_FTRAPOLT,
+    M68K_INS_FTRAPOLE,
+    M68K_INS_FTRAPOGL,
+    M68K_INS_FTRAPOR,
+    M68K_INS_FTRAPUN,
+    M68K_INS_FTRAPUEQ,
+    M68K_INS_FTRAPUGT,
+    M68K_INS_FTRAPUGE,
+    M68K_INS_FTRAPULT,
+    M68K_INS_FTRAPULE,
+    M68K_INS_FTRAPNE,
+    M68K_INS_FTRAPT,
+    M68K_INS_FTRAPSF,
+    M68K_INS_FTRAPSEQ,
+    M68K_INS_FTRAPGT,
+    M68K_INS_FTRAPGE,
+    M68K_INS_FTRAPLT,
+    M68K_INS_FTRAPLE,
+    M68K_INS_FTRAPGL,
+    M68K_INS_FTRAPGLE,
+    M68K_INS_FTRAPNGLE,
+    M68K_INS_FTRAPNGL,
+    M68K_INS_FTRAPNLE,
+    M68K_INS_FTRAPNLT,
+    M68K_INS_FTRAPNGE,
+    M68K_INS_FTRAPNGT,
+    M68K_INS_FTRAPSNE,
+    M68K_INS_FTRAPST,
+    M68K_INS_FTST,
+    M68K_INS_FTWOTOX,
+    M68K_INS_HALT,
+    M68K_INS_ILLEGAL,
+    M68K_INS_JMP,
+    M68K_INS_JSR,
+    M68K_INS_LEA,
+    M68K_INS_LINK,
+    M68K_INS_LPSTOP,
+    M68K_INS_LSL,
+    M68K_INS_LSR,
+    M68K_INS_MOVE,
+    M68K_INS_MOVEA,
+    M68K_INS_MOVEC,
+    M68K_INS_MOVEM,
+    M68K_INS_MOVEP,
+    M68K_INS_MOVEQ,
+    M68K_INS_MOVES,
+    M68K_INS_MOVE16,
+    M68K_INS_MULS,
+    M68K_INS_MULU,
+    M68K_INS_NBCD,
+    M68K_INS_NEG,
+    M68K_INS_NEGX,
+    M68K_INS_NOP,
+    M68K_INS_NOT,
+    M68K_INS_OR,
+    M68K_INS_ORI,
+    M68K_INS_PACK,
+    M68K_INS_PEA,
+    M68K_INS_PFLUSH,
+    M68K_INS_PFLUSHA,
+    M68K_INS_PFLUSHAN,
+    M68K_INS_PFLUSHN,
+    M68K_INS_PLOADR,
+    M68K_INS_PLOADW,
+    M68K_INS_PLPAR,
+    M68K_INS_PLPAW,
+    M68K_INS_PMOVE,
+    M68K_INS_PMOVEFD,
+    M68K_INS_PTESTR,
+    M68K_INS_PTESTW,
+    M68K_INS_PULSE,
+    M68K_INS_REMS,
+    M68K_INS_REMU,
+    M68K_INS_RESET,
+    M68K_INS_ROL,
+    M68K_INS_ROR,
+    M68K_INS_ROXL,
+    M68K_INS_ROXR,
+    M68K_INS_RTD,
+    M68K_INS_RTE,
+    M68K_INS_RTM,
+    M68K_INS_RTR,
+    M68K_INS_RTS,
+    M68K_INS_SBCD,
+    M68K_INS_ST,
+    M68K_INS_SF,
+    M68K_INS_SHI,
+    M68K_INS_SLS,
+    M68K_INS_SCC,
+    M68K_INS_SHS,
+    M68K_INS_SCS,
+    M68K_INS_SLO,
+    M68K_INS_SNE,
+    M68K_INS_SEQ,
+    M68K_INS_SVC,
+    M68K_INS_SVS,
+    M68K_INS_SPL,
+    M68K_INS_SMI,
+    M68K_INS_SGE,
+    M68K_INS_SLT,
+    M68K_INS_SGT,
+    M68K_INS_SLE,
+    M68K_INS_STOP,
+    M68K_INS_SUB,
+    M68K_INS_SUBA,
+    M68K_INS_SUBI,
+    M68K_INS_SUBQ,
+    M68K_INS_SUBX,
+    M68K_INS_SWAP,
+    M68K_INS_TAS,
+    M68K_INS_TRAP,
+    M68K_INS_TRAPV,
+    M68K_INS_TRAPT,
+    M68K_INS_TRAPF,
+    M68K_INS_TRAPHI,
+    M68K_INS_TRAPLS,
+    M68K_INS_TRAPCC,
+    M68K_INS_TRAPHS,
+    M68K_INS_TRAPCS,
+    M68K_INS_TRAPLO,
+    M68K_INS_TRAPNE,
+    M68K_INS_TRAPEQ,
+    M68K_INS_TRAPVC,
+    M68K_INS_TRAPVS,
+    M68K_INS_TRAPPL,
+    M68K_INS_TRAPMI,
+    M68K_INS_TRAPGE,
+    M68K_INS_TRAPLT,
+    M68K_INS_TRAPGT,
+    M68K_INS_TRAPLE,
+    M68K_INS_TST,
+    M68K_INS_UNLK,
+    M68K_INS_UNPK,
+    M68K_INS_ENDING,   // <-- mark the end of the list of instructions
+
+} m68k_insn;
+
+//> Group of M68K instructions
+typedef enum m68k_group_type
+{
+    M68K_GRP_INVALID = 0,  // CS_GRUP_INVALID
+    M68K_GRP_JUMP,  // = CS_GRP_JUMP
+    M68K_GRP_RET = 3,  // = CS_GRP_RET
+    M68K_GRP_IRET = 5, // = CS_GRP_IRET
+
+    M68K_GRP_ENDING,// <-- mark the end of the list of groups
+} m68k_group_type;
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif

pluginsdk/capstone/platform.h

@@ -1,28 +1,110 @@
-/* Capstone Disassembly Engine */
-/* By Axel Souchet & Nguyen Anh Quynh, 2014 */
-
-// handle C99 issue (for pre-2013 VisualStudio)
-#ifndef CAPSTONE_PLATFORM_H
-#define CAPSTONE_PLATFORM_H
-
-#if !defined(__MINGW32__) && !defined(__MINGW64__) && (defined (WIN32) || defined (WIN64) || defined (_WIN32) || defined (_WIN64))
-// MSVC
-
-// stdbool.h
-#if (_MSC_VER < 1800)
-#ifndef __cplusplus
-typedef unsigned char bool;
-#define false 0
-#define true 1
-#endif
-
-#else
-// VisualStudio 2013+ -> C99 is supported
-#include <stdbool.h>
-#endif
-
-#else // not MSVC -> C99 is supported
-#include <stdbool.h>
-#endif
-
-#endif
+/* Capstone Disassembly Engine */
+/* By Axel Souchet & Nguyen Anh Quynh, 2014 */
+
+#ifndef CAPSTONE_PLATFORM_H
+#define CAPSTONE_PLATFORM_H
+
+
+// handle C99 issue (for pre-2013 VisualStudio)
+#if !defined(__CYGWIN__) && !defined(__MINGW32__) && !defined(__MINGW64__) && (defined (WIN32) || defined (WIN64) || defined (_WIN32) || defined (_WIN64))
+// MSVC
+
+// stdbool.h
+#if (_MSC_VER < 1800) || defined(_KERNEL_MODE)
+// this system does not have stdbool.h
+#ifndef __cplusplus
+typedef unsigned char bool;
+#define false 0
+#define true 1
+#endif  // __cplusplus
+
+#else
+// VisualStudio 2013+ -> C99 is supported
+#include <stdbool.h>
+#endif  // (_MSC_VER < 1800) || defined(_KERNEL_MODE)
+
+#else
+// not MSVC -> C99 is supported
+#include <stdbool.h>
+#endif  // !defined(__CYGWIN__) && !defined(__MINGW32__) && !defined(__MINGW64__) && (defined (WIN32) || defined (WIN64) || defined (_WIN32) || defined (_WIN64))
+
+
+// handle inttypes.h / stdint.h compatibility
+#if defined(_WIN32_WCE) && (_WIN32_WCE < 0x800)
+#include "windowsce/stdint.h"
+#endif  // defined(_WIN32_WCE) && (_WIN32_WCE < 0x800)
+
+#if defined(CAPSTONE_HAS_OSXKERNEL) || (defined(_MSC_VER) && (_MSC_VER <= 1700 || defined(_KERNEL_MODE)))
+// this system does not have inttypes.h
+
+#if defined(_MSC_VER) && (_MSC_VER <= 1700 || defined(_KERNEL_MODE))
+// this system does not have stdint.h
+typedef signed char  int8_t;
+typedef signed short int16_t;
+typedef signed int   int32_t;
+typedef unsigned char  uint8_t;
+typedef unsigned short uint16_t;
+typedef unsigned int   uint32_t;
+typedef signed long long   int64_t;
+typedef unsigned long long uint64_t;
+
+#define INT8_MIN         (-127i8 - 1)
+#define INT16_MIN        (-32767i16 - 1)
+#define INT32_MIN        (-2147483647i32 - 1)
+#define INT64_MIN        (-9223372036854775807i64 - 1)
+#define INT8_MAX         127i8
+#define INT16_MAX        32767i16
+#define INT32_MAX        2147483647i32
+#define INT64_MAX        9223372036854775807i64
+#define UINT8_MAX        0xffui8
+#define UINT16_MAX       0xffffui16
+#define UINT32_MAX       0xffffffffui32
+#define UINT64_MAX       0xffffffffffffffffui64
+#endif  // defined(_MSC_VER) && (_MSC_VER <= 1700 || defined(_KERNEL_MODE))
+
+#define __PRI_8_LENGTH_MODIFIER__ "hh"
+#define __PRI_64_LENGTH_MODIFIER__ "ll"
+
+#define PRId8         __PRI_8_LENGTH_MODIFIER__ "d"
+#define PRIi8         __PRI_8_LENGTH_MODIFIER__ "i"
+#define PRIo8         __PRI_8_LENGTH_MODIFIER__ "o"
+#define PRIu8         __PRI_8_LENGTH_MODIFIER__ "u"
+#define PRIx8         __PRI_8_LENGTH_MODIFIER__ "x"
+#define PRIX8         __PRI_8_LENGTH_MODIFIER__ "X"
+
+#define PRId16        "hd"
+#define PRIi16        "hi"
+#define PRIo16        "ho"
+#define PRIu16        "hu"
+#define PRIx16        "hx"
+#define PRIX16        "hX"
+
+#if defined(_MSC_VER) && _MSC_VER <= 1700
+#define PRId32        "ld"
+#define PRIi32        "li"
+#define PRIo32        "lo"
+#define PRIu32        "lu"
+#define PRIx32        "lx"
+#define PRIX32        "lX"
+#else   // OSX
+#define PRId32        "d"
+#define PRIi32        "i"
+#define PRIo32        "o"
+#define PRIu32        "u"
+#define PRIx32        "x"
+#define PRIX32        "X"
+#endif  // defined(_MSC_VER) && _MSC_VER <= 1700
+
+#define PRId64        __PRI_64_LENGTH_MODIFIER__ "d"
+#define PRIi64        __PRI_64_LENGTH_MODIFIER__ "i"
+#define PRIo64        __PRI_64_LENGTH_MODIFIER__ "o"
+#define PRIu64        __PRI_64_LENGTH_MODIFIER__ "u"
+#define PRIx64        __PRI_64_LENGTH_MODIFIER__ "x"
+#define PRIX64        __PRI_64_LENGTH_MODIFIER__ "X"
+
+#else
+// this system has inttypes.h by default
+#include <inttypes.h>
+#endif  // defined(CAPSTONE_HAS_OSXKERNEL) || (defined(_MSC_VER) && (_MSC_VER <= 1700 || defined(_KERNEL_MODE)))
+
+#endif

pluginsdk/capstone/xcore.h

@@ -1,242 +1,243 @@
-#ifndef CAPSTONE_XCORE_H
-#define CAPSTONE_XCORE_H
-
-/* Capstone Disassembly Engine */
-/* By Nguyen Anh Quynh <[email protected]>, 2014 */
-
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-#include <stdint.h>
-#include "platform.h"
-
-#ifdef _MSC_VER
-#pragma warning(disable:4201)
-#endif
-
-//> Operand type for instruction's operands
-typedef enum xcore_op_type
-{
-    XCORE_OP_INVALID = 0, // = CS_OP_INVALID (Uninitialized).
-    XCORE_OP_REG, // = CS_OP_REG (Register operand).
-    XCORE_OP_IMM, // = CS_OP_IMM (Immediate operand).
-    XCORE_OP_MEM, // = CS_OP_MEM (Memory operand).
-} xcore_op_type;
-
-// Instruction's operand referring to memory
-// This is associated with XCORE_OP_MEM operand type above
-typedef struct xcore_op_mem
-{
-    uint8_t base;   // base register
-    uint8_t index;  // index register
-    int32_t disp;   // displacement/offset value
-    int     direct; // +1: forward, -1: backward
-} xcore_op_mem;
-
-// Instruction operand
-typedef struct cs_xcore_op
-{
-    xcore_op_type type; // operand type
-    union
-    {
-        unsigned int reg;   // register value for REG operand
-        int32_t imm;        // immediate value for IMM operand
-        xcore_op_mem mem;       // base/disp value for MEM operand
-    };
-} cs_xcore_op;
-
-// Instruction structure
-typedef struct cs_xcore
-{
-    // Number of operands of this instruction,
-    // or 0 when instruction has no operand.
-    uint8_t op_count;
-    cs_xcore_op operands[8]; // operands for this instruction.
-} cs_xcore;
-
-//> XCore registers
-typedef enum xcore_reg
-{
-    XCORE_REG_INVALID = 0,
-
-    XCORE_REG_CP,
-    XCORE_REG_DP,
-    XCORE_REG_LR,
-    XCORE_REG_SP,
-    XCORE_REG_R0,
-    XCORE_REG_R1,
-    XCORE_REG_R2,
-    XCORE_REG_R3,
-    XCORE_REG_R4,
-    XCORE_REG_R5,
-    XCORE_REG_R6,
-    XCORE_REG_R7,
-    XCORE_REG_R8,
-    XCORE_REG_R9,
-    XCORE_REG_R10,
-    XCORE_REG_R11,
-
-    //> pseudo registers
-    XCORE_REG_PC,   // pc
-
-    // internal thread registers
-    // see The-XMOS-XS1-Architecture(X7879A).pdf
-    XCORE_REG_SCP,  // save pc
-    XCORE_REG_SSR,  // save status
-    XCORE_REG_ET,   // exception type
-    XCORE_REG_ED,   // exception data
-    XCORE_REG_SED,  // save exception data
-    XCORE_REG_KEP,  // kernel entry pointer
-    XCORE_REG_KSP,  // kernel stack pointer
-    XCORE_REG_ID,   // thread ID
-
-    XCORE_REG_ENDING,   // <-- mark the end of the list of registers
-} xcore_reg;
-
-//> XCore instruction
-typedef enum xcore_insn
-{
-    XCORE_INS_INVALID = 0,
-
-    XCORE_INS_ADD,
-    XCORE_INS_ANDNOT,
-    XCORE_INS_AND,
-    XCORE_INS_ASHR,
-    XCORE_INS_BAU,
-    XCORE_INS_BITREV,
-    XCORE_INS_BLA,
-    XCORE_INS_BLAT,
-    XCORE_INS_BL,
-    XCORE_INS_BF,
-    XCORE_INS_BT,
-    XCORE_INS_BU,
-    XCORE_INS_BRU,
-    XCORE_INS_BYTEREV,
-    XCORE_INS_CHKCT,
-    XCORE_INS_CLRE,
-    XCORE_INS_CLRPT,
-    XCORE_INS_CLRSR,
-    XCORE_INS_CLZ,
-    XCORE_INS_CRC8,
-    XCORE_INS_CRC32,
-    XCORE_INS_DCALL,
-    XCORE_INS_DENTSP,
-    XCORE_INS_DGETREG,
-    XCORE_INS_DIVS,
-    XCORE_INS_DIVU,
-    XCORE_INS_DRESTSP,
-    XCORE_INS_DRET,
-    XCORE_INS_ECALLF,
-    XCORE_INS_ECALLT,
-    XCORE_INS_EDU,
-    XCORE_INS_EEF,
-    XCORE_INS_EET,
-    XCORE_INS_EEU,
-    XCORE_INS_ENDIN,
-    XCORE_INS_ENTSP,
-    XCORE_INS_EQ,
-    XCORE_INS_EXTDP,
-    XCORE_INS_EXTSP,
-    XCORE_INS_FREER,
-    XCORE_INS_FREET,
-    XCORE_INS_GETD,
-    XCORE_INS_GET,
-    XCORE_INS_GETN,
-    XCORE_INS_GETR,
-    XCORE_INS_GETSR,
-    XCORE_INS_GETST,
-    XCORE_INS_GETTS,
-    XCORE_INS_INCT,
-    XCORE_INS_INIT,
-    XCORE_INS_INPW,
-    XCORE_INS_INSHR,
-    XCORE_INS_INT,
-    XCORE_INS_IN,
-    XCORE_INS_KCALL,
-    XCORE_INS_KENTSP,
-    XCORE_INS_KRESTSP,
-    XCORE_INS_KRET,
-    XCORE_INS_LADD,
-    XCORE_INS_LD16S,
-    XCORE_INS_LD8U,
-    XCORE_INS_LDA16,
-    XCORE_INS_LDAP,
-    XCORE_INS_LDAW,
-    XCORE_INS_LDC,
-    XCORE_INS_LDW,
-    XCORE_INS_LDIVU,
-    XCORE_INS_LMUL,
-    XCORE_INS_LSS,
-    XCORE_INS_LSUB,
-    XCORE_INS_LSU,
-    XCORE_INS_MACCS,
-    XCORE_INS_MACCU,
-    XCORE_INS_MJOIN,
-    XCORE_INS_MKMSK,
-    XCORE_INS_MSYNC,
-    XCORE_INS_MUL,
-    XCORE_INS_NEG,
-    XCORE_INS_NOT,
-    XCORE_INS_OR,
-    XCORE_INS_OUTCT,
-    XCORE_INS_OUTPW,
-    XCORE_INS_OUTSHR,
-    XCORE_INS_OUTT,
-    XCORE_INS_OUT,
-    XCORE_INS_PEEK,
-    XCORE_INS_REMS,
-    XCORE_INS_REMU,
-    XCORE_INS_RETSP,
-    XCORE_INS_SETCLK,
-    XCORE_INS_SET,
-    XCORE_INS_SETC,
-    XCORE_INS_SETD,
-    XCORE_INS_SETEV,
-    XCORE_INS_SETN,
-    XCORE_INS_SETPSC,
-    XCORE_INS_SETPT,
-    XCORE_INS_SETRDY,
-    XCORE_INS_SETSR,
-    XCORE_INS_SETTW,
-    XCORE_INS_SETV,
-    XCORE_INS_SEXT,
-    XCORE_INS_SHL,
-    XCORE_INS_SHR,
-    XCORE_INS_SSYNC,
-    XCORE_INS_ST16,
-    XCORE_INS_ST8,
-    XCORE_INS_STW,
-    XCORE_INS_SUB,
-    XCORE_INS_SYNCR,
-    XCORE_INS_TESTCT,
-    XCORE_INS_TESTLCL,
-    XCORE_INS_TESTWCT,
-    XCORE_INS_TSETMR,
-    XCORE_INS_START,
-    XCORE_INS_WAITEF,
-    XCORE_INS_WAITET,
-    XCORE_INS_WAITEU,
-    XCORE_INS_XOR,
-    XCORE_INS_ZEXT,
-
-    XCORE_INS_ENDING,   // <-- mark the end of the list of instructions
-} xcore_insn;
-
-//> Group of XCore instructions
-typedef enum xcore_insn_group
-{
-    XCORE_GRP_INVALID = 0, // = CS_GRP_INVALID
-
-    //> Generic groups
-    // all jump instructions (conditional+direct+indirect jumps)
-    XCORE_GRP_JUMP, // = CS_GRP_JUMP
-
-    XCORE_GRP_ENDING,   // <-- mark the end of the list of groups
-} xcore_insn_group;
-
-#ifdef __cplusplus
-}
-#endif
-
-#endif
+#ifndef CAPSTONE_XCORE_H
+#define CAPSTONE_XCORE_H
+
+/* Capstone Disassembly Engine */
+/* By Nguyen Anh Quynh <[email protected]>, 2014-2015 */
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include "platform.h"
+
+#ifdef _MSC_VER
+#pragma warning(disable:4201)
+#endif
+
+//> Operand type for instruction's operands
+typedef enum xcore_op_type
+{
+    XCORE_OP_INVALID = 0, // = CS_OP_INVALID (Uninitialized).
+    XCORE_OP_REG, // = CS_OP_REG (Register operand).
+    XCORE_OP_IMM, // = CS_OP_IMM (Immediate operand).
+    XCORE_OP_MEM, // = CS_OP_MEM (Memory operand).
+} xcore_op_type;
+
+//> XCore registers
+typedef enum xcore_reg
+{
+    XCORE_REG_INVALID = 0,
+
+    XCORE_REG_CP,
+    XCORE_REG_DP,
+    XCORE_REG_LR,
+    XCORE_REG_SP,
+    XCORE_REG_R0,
+    XCORE_REG_R1,
+    XCORE_REG_R2,
+    XCORE_REG_R3,
+    XCORE_REG_R4,
+    XCORE_REG_R5,
+    XCORE_REG_R6,
+    XCORE_REG_R7,
+    XCORE_REG_R8,
+    XCORE_REG_R9,
+    XCORE_REG_R10,
+    XCORE_REG_R11,
+
+    //> pseudo registers
+    XCORE_REG_PC,   // pc
+
+    // internal thread registers
+    // see The-XMOS-XS1-Architecture(X7879A).pdf
+    XCORE_REG_SCP,  // save pc
+    XCORE_REG_SSR,  // save status
+    XCORE_REG_ET,   // exception type
+    XCORE_REG_ED,   // exception data
+    XCORE_REG_SED,  // save exception data
+    XCORE_REG_KEP,  // kernel entry pointer
+    XCORE_REG_KSP,  // kernel stack pointer
+    XCORE_REG_ID,   // thread ID
+
+    XCORE_REG_ENDING,   // <-- mark the end of the list of registers
+} xcore_reg;
+
+// Instruction's operand referring to memory
+// This is associated with XCORE_OP_MEM operand type above
+typedef struct xcore_op_mem
+{
+    uint8_t base;       // base register, can be safely interpreted as
+    // a value of type `xcore_reg`, but it is only
+    // one byte wide
+    uint8_t index;      // index register, same conditions apply here
+    int32_t disp;   // displacement/offset value
+    int     direct; // +1: forward, -1: backward
+} xcore_op_mem;
+
+// Instruction operand
+typedef struct cs_xcore_op
+{
+    xcore_op_type type; // operand type
+    union
+    {
+        xcore_reg reg;  // register value for REG operand
+        int32_t imm;        // immediate value for IMM operand
+        xcore_op_mem mem;       // base/disp value for MEM operand
+    };
+} cs_xcore_op;
+
+// Instruction structure
+typedef struct cs_xcore
+{
+    // Number of operands of this instruction,
+    // or 0 when instruction has no operand.
+    uint8_t op_count;
+    cs_xcore_op operands[8]; // operands for this instruction.
+} cs_xcore;
+
+//> XCore instruction
+typedef enum xcore_insn
+{
+    XCORE_INS_INVALID = 0,
+
+    XCORE_INS_ADD,
+    XCORE_INS_ANDNOT,
+    XCORE_INS_AND,
+    XCORE_INS_ASHR,
+    XCORE_INS_BAU,
+    XCORE_INS_BITREV,
+    XCORE_INS_BLA,
+    XCORE_INS_BLAT,
+    XCORE_INS_BL,
+    XCORE_INS_BF,
+    XCORE_INS_BT,
+    XCORE_INS_BU,
+    XCORE_INS_BRU,
+    XCORE_INS_BYTEREV,
+    XCORE_INS_CHKCT,
+    XCORE_INS_CLRE,
+    XCORE_INS_CLRPT,
+    XCORE_INS_CLRSR,
+    XCORE_INS_CLZ,
+    XCORE_INS_CRC8,
+    XCORE_INS_CRC32,
+    XCORE_INS_DCALL,
+    XCORE_INS_DENTSP,
+    XCORE_INS_DGETREG,
+    XCORE_INS_DIVS,
+    XCORE_INS_DIVU,
+    XCORE_INS_DRESTSP,
+    XCORE_INS_DRET,
+    XCORE_INS_ECALLF,
+    XCORE_INS_ECALLT,
+    XCORE_INS_EDU,
+    XCORE_INS_EEF,
+    XCORE_INS_EET,
+    XCORE_INS_EEU,
+    XCORE_INS_ENDIN,
+    XCORE_INS_ENTSP,
+    XCORE_INS_EQ,
+    XCORE_INS_EXTDP,
+    XCORE_INS_EXTSP,
+    XCORE_INS_FREER,
+    XCORE_INS_FREET,
+    XCORE_INS_GETD,
+    XCORE_INS_GET,
+    XCORE_INS_GETN,
+    XCORE_INS_GETR,
+    XCORE_INS_GETSR,
+    XCORE_INS_GETST,
+    XCORE_INS_GETTS,
+    XCORE_INS_INCT,
+    XCORE_INS_INIT,
+    XCORE_INS_INPW,
+    XCORE_INS_INSHR,
+    XCORE_INS_INT,
+    XCORE_INS_IN,
+    XCORE_INS_KCALL,
+    XCORE_INS_KENTSP,
+    XCORE_INS_KRESTSP,
+    XCORE_INS_KRET,
+    XCORE_INS_LADD,
+    XCORE_INS_LD16S,
+    XCORE_INS_LD8U,
+    XCORE_INS_LDA16,
+    XCORE_INS_LDAP,
+    XCORE_INS_LDAW,
+    XCORE_INS_LDC,
+    XCORE_INS_LDW,
+    XCORE_INS_LDIVU,
+    XCORE_INS_LMUL,
+    XCORE_INS_LSS,
+    XCORE_INS_LSUB,
+    XCORE_INS_LSU,
+    XCORE_INS_MACCS,
+    XCORE_INS_MACCU,
+    XCORE_INS_MJOIN,
+    XCORE_INS_MKMSK,
+    XCORE_INS_MSYNC,
+    XCORE_INS_MUL,
+    XCORE_INS_NEG,
+    XCORE_INS_NOT,
+    XCORE_INS_OR,
+    XCORE_INS_OUTCT,
+    XCORE_INS_OUTPW,
+    XCORE_INS_OUTSHR,
+    XCORE_INS_OUTT,
+    XCORE_INS_OUT,
+    XCORE_INS_PEEK,
+    XCORE_INS_REMS,
+    XCORE_INS_REMU,
+    XCORE_INS_RETSP,
+    XCORE_INS_SETCLK,
+    XCORE_INS_SET,
+    XCORE_INS_SETC,
+    XCORE_INS_SETD,
+    XCORE_INS_SETEV,
+    XCORE_INS_SETN,
+    XCORE_INS_SETPSC,
+    XCORE_INS_SETPT,
+    XCORE_INS_SETRDY,
+    XCORE_INS_SETSR,
+    XCORE_INS_SETTW,
+    XCORE_INS_SETV,
+    XCORE_INS_SEXT,
+    XCORE_INS_SHL,
+    XCORE_INS_SHR,
+    XCORE_INS_SSYNC,
+    XCORE_INS_ST16,
+    XCORE_INS_ST8,
+    XCORE_INS_STW,
+    XCORE_INS_SUB,
+    XCORE_INS_SYNCR,
+    XCORE_INS_TESTCT,
+    XCORE_INS_TESTLCL,
+    XCORE_INS_TESTWCT,
+    XCORE_INS_TSETMR,
+    XCORE_INS_START,
+    XCORE_INS_WAITEF,
+    XCORE_INS_WAITET,
+    XCORE_INS_WAITEU,
+    XCORE_INS_XOR,
+    XCORE_INS_ZEXT,
+
+    XCORE_INS_ENDING,   // <-- mark the end of the list of instructions
+} xcore_insn;
+
+//> Group of XCore instructions
+typedef enum xcore_insn_group
+{
+    XCORE_GRP_INVALID = 0, // = CS_GRP_INVALID
+
+    //> Generic groups
+    // all jump instructions (conditional+direct+indirect jumps)
+    XCORE_GRP_JUMP, // = CS_GRP_JUMP
+
+    XCORE_GRP_ENDING,   // <-- mark the end of the list of groups
+} xcore_insn_group;
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif

pluginsdk/yara/yara.h

@@ -1,28 +1,30 @@
-/*
-Copyright (c) 2007-2013. The YARA Authors. All Rights Reserved.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-   http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-#ifndef YR_YARA_H
-#define YR_YARA_H
-
-#include "yara/utils.h"
-#include "yara/filemap.h"
-#include "yara/compiler.h"
-#include "yara/modules.h"
-#include "yara/object.h"
-#include "yara/libyara.h"
-#include "yara/error.h"
-
-#endif
+/*
+Copyright (c) 2007-2013. The YARA Authors. All Rights Reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+#ifndef YR_YARA_H
+#define YR_YARA_H
+
+#include "yara/utils.h"
+#include "yara/filemap.h"
+#include "yara/compiler.h"
+#include "yara/modules.h"
+#include "yara/object.h"
+#include "yara/libyara.h"
+#include "yara/error.h"
+#include "yara/stream.h"
+#include "yara/hash.h"
+
+#endif

pluginsdk/yara/yara/ahocorasick.h

@@ -1,50 +1,71 @@
-/*
-Copyright (c) 2013. The YARA Authors. All Rights Reserved.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-   http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-#ifndef _AHOCORASICK_H
-#define _AHOCORASICK_H
-
-#include "limits.h"
-#include "atoms.h"
-#include "types.h"
-
-
-int yr_ac_create_automaton(
-    YR_ARENA* arena,
-    YR_AC_AUTOMATON** automaton);
-
-
-int yr_ac_add_string(
-    YR_ARENA* arena,
-    YR_AC_AUTOMATON* automaton,
-    YR_STRING* string,
-    YR_ATOM_LIST_ITEM* atom);
-
-
-YR_AC_STATE* yr_ac_next_state(
-    YR_AC_STATE* state,
-    uint8_t input);
-
-
-int yr_ac_create_failure_links(
-    YR_ARENA* arena,
-    YR_AC_AUTOMATON* automaton);
-
-
-void yr_ac_print_automaton(
-    YR_AC_AUTOMATON* automaton);
-
-#endif
+/*
+Copyright (c) 2013. The YARA Authors. All Rights Reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+#ifndef _AHOCORASICK_H
+#define _AHOCORASICK_H
+
+#include "limits.h"
+#include "atoms.h"
+#include "types.h"
+
+
+#define YR_AC_ROOT_STATE                0
+#define YR_AC_NEXT_STATE(t)             (t >> 32)
+#define YR_AC_INVALID_TRANSITION(t, c)  (((t) & 0xFFFF) != c)
+
+#define YR_AC_MAKE_TRANSITION(state, code, flags) \
+  ((uint64_t)((((uint64_t) state) << 32) | ((flags) << 16) | (code)))
+
+#define YR_AC_USED_FLAG    0x1
+
+#define YR_AC_USED_TRANSITION_SLOT(x)   ((x) & (YR_AC_USED_FLAG << 16))
+#define YR_AC_UNUSED_TRANSITION_SLOT(x) (!YR_AC_USED_TRANSITION_SLOT(x))
+
+
+typedef struct _YR_AC_TABLES
+{
+    YR_AC_TRANSITION* transitions;
+    YR_AC_MATCH_TABLE_ENTRY* matches;
+
+} YR_AC_TABLES;
+
+
+int yr_ac_automaton_create(
+    YR_AC_AUTOMATON** automaton);
+
+
+int yr_ac_automaton_destroy(
+    YR_AC_AUTOMATON* automaton);
+
+
+int yr_ac_add_string(
+    YR_AC_AUTOMATON* automaton,
+    YR_STRING* string,
+    YR_ATOM_LIST_ITEM* atom,
+    YR_ARENA* matches_arena);
+
+
+int yr_ac_compile(
+    YR_AC_AUTOMATON* automaton,
+    YR_ARENA* arena,
+    YR_AC_TABLES* tables);
+
+
+void yr_ac_print_automaton(
+    YR_AC_AUTOMATON* automaton);
+
+
+#endif

pluginsdk/yara/yara/arena.h

@@ -1,151 +1,152 @@
-/*
-Copyright (c) 2013. The YARA Authors. All Rights Reserved.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-   http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-#ifndef YR_ARENA_H
-#define YR_ARENA_H
-
-#include <stdint.h>
-#include <stddef.h>
-
-
-#define ARENA_FLAGS_FIXED_SIZE   1
-#define ARENA_FLAGS_COALESCED    2
-#define ARENA_FILE_VERSION       6
-
-#define EOL ((size_t) -1)
-
-
-typedef struct _YR_RELOC
-{
-    int32_t offset;
-    struct _YR_RELOC* next;
-
-} YR_RELOC;
-
-
-typedef struct _YR_ARENA_PAGE
-{
-
-    uint8_t* new_address;
-    uint8_t* address;
-
-    size_t size;
-    size_t used;
-
-    YR_RELOC* reloc_list_head;
-    YR_RELOC* reloc_list_tail;
-
-    struct _YR_ARENA_PAGE* next;
-    struct _YR_ARENA_PAGE* prev;
-
-} YR_ARENA_PAGE;
-
-
-typedef struct _YR_ARENA
-{
-    int flags;
-
-    YR_ARENA_PAGE* page_list_head;
-    YR_ARENA_PAGE* current_page;
-
-} YR_ARENA;
-
-
-int yr_arena_create(
-    size_t initial_size,
-    int flags,
-    YR_ARENA** arena);
-
-
-void yr_arena_destroy(
-    YR_ARENA* arena);
-
-
-void* yr_arena_base_address(
-    YR_ARENA* arena);
-
-
-void* yr_arena_next_address(
-    YR_ARENA* arena,
-    void* address,
-    int offset);
-
-
-int yr_arena_coalesce(
-    YR_ARENA* arena);
-
-
-int yr_arena_reserve_memory(
-    YR_ARENA* arena,
-    size_t size);
-
-
-int yr_arena_allocate_memory(
-    YR_ARENA* arena,
-    size_t size,
-    void** allocated_memory);
-
-
-int yr_arena_allocate_struct(
-    YR_ARENA* arena,
-    size_t size,
-    void** allocated_memory,
-    ...);
-
-
-int yr_arena_make_relocatable(
-    YR_ARENA* arena,
-    void* base,
-    ...);
-
-
-int yr_arena_write_data(
-    YR_ARENA* arena,
-    void* data,
-    size_t size,
-    void** written_data);
-
-
-int yr_arena_write_string(
-    YR_ARENA* arena,
-    const char* string,
-    char** written_string);
-
-
-int yr_arena_append(
-    YR_ARENA* target_arena,
-    YR_ARENA* source_arena);
-
-
-int yr_arena_save(
-    YR_ARENA* arena,
-    const char* filename);
-
-
-int yr_arena_load(
-    const char* filename,
-    YR_ARENA** arena);
-
-
-int yr_arena_duplicate(
-    YR_ARENA* arena,
-    YR_ARENA** duplicated);
-
-
-void yr_arena_print(
-    YR_ARENA* arena);
-
-#endif
+/*
+Copyright (c) 2013. The YARA Authors. All Rights Reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+#ifndef YR_ARENA_H
+#define YR_ARENA_H
+
+#include <stdint.h>
+#include <stddef.h>
+
+#include "stream.h"
+
+#define ARENA_FLAGS_FIXED_SIZE   1
+#define ARENA_FLAGS_COALESCED    2
+#define ARENA_FILE_VERSION       10
+
+#define EOL ((size_t) -1)
+
+
+typedef struct _YR_RELOC
+{
+    uint32_t offset;
+    struct _YR_RELOC* next;
+
+} YR_RELOC;
+
+
+typedef struct _YR_ARENA_PAGE
+{
+
+    uint8_t* new_address;
+    uint8_t* address;
+
+    size_t size;
+    size_t used;
+
+    YR_RELOC* reloc_list_head;
+    YR_RELOC* reloc_list_tail;
+
+    struct _YR_ARENA_PAGE* next;
+    struct _YR_ARENA_PAGE* prev;
+
+} YR_ARENA_PAGE;
+
+
+typedef struct _YR_ARENA
+{
+    int flags;
+
+    YR_ARENA_PAGE* page_list_head;
+    YR_ARENA_PAGE* current_page;
+
+} YR_ARENA;
+
+
+int yr_arena_create(
+    size_t initial_size,
+    int flags,
+    YR_ARENA** arena);
+
+
+void yr_arena_destroy(
+    YR_ARENA* arena);
+
+
+void* yr_arena_base_address(
+    YR_ARENA* arena);
+
+
+void* yr_arena_next_address(
+    YR_ARENA* arena,
+    void* address,
+    size_t offset);
+
+
+int yr_arena_coalesce(
+    YR_ARENA* arena);
+
+
+int yr_arena_reserve_memory(
+    YR_ARENA* arena,
+    size_t size);
+
+
+int yr_arena_allocate_memory(
+    YR_ARENA* arena,
+    size_t size,
+    void** allocated_memory);
+
+
+int yr_arena_allocate_struct(
+    YR_ARENA* arena,
+    size_t size,
+    void** allocated_memory,
+    ...);
+
+
+int yr_arena_make_relocatable(
+    YR_ARENA* arena,
+    void* base,
+    ...);
+
+
+int yr_arena_write_data(
+    YR_ARENA* arena,
+    void* data,
+    size_t size,
+    void** written_data);
+
+
+int yr_arena_write_string(
+    YR_ARENA* arena,
+    const char* string,
+    char** written_string);
+
+
+int yr_arena_append(
+    YR_ARENA* target_arena,
+    YR_ARENA* source_arena);
+
+
+int yr_arena_load_stream(
+    YR_STREAM* stream,
+    YR_ARENA** arena);
+
+
+int yr_arena_save_stream(
+    YR_ARENA* arena,
+    YR_STREAM* stream);
+
+
+int yr_arena_duplicate(
+    YR_ARENA* arena,
+    YR_ARENA** duplicated);
+
+
+void yr_arena_print(
+    YR_ARENA* arena);
+
+#endif

pluginsdk/yara/yara/atoms.h

@@ -1,89 +1,89 @@
-/*
-Copyright (c) 2013. The YARA Authors. All Rights Reserved.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-   http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-#ifndef YR_ATOMS_H
-#define YR_ATOMS_H
-
-#include "limits.h"
-#include "re.h"
-
-#define ATOM_TREE_LEAF  1
-#define ATOM_TREE_AND   2
-#define ATOM_TREE_OR    3
-
-
-typedef struct _ATOM_TREE_NODE
-{
-    uint8_t type;
-    uint8_t atom_length;
-    uint8_t atom[MAX_ATOM_LENGTH];
-
-    uint8_t* forward_code;
-    uint8_t* backward_code;
-
-    RE_NODE* recent_nodes[MAX_ATOM_LENGTH];
-
-    struct _ATOM_TREE_NODE* children_head;
-    struct _ATOM_TREE_NODE* children_tail;
-    struct _ATOM_TREE_NODE* next_sibling;
-
-} ATOM_TREE_NODE;
-
-
-typedef struct _ATOM_TREE
-{
-    ATOM_TREE_NODE* current_leaf;
-    ATOM_TREE_NODE* root_node;
-
-} ATOM_TREE;
-
-
-typedef struct _YR_ATOM_LIST_ITEM
-{
-    uint8_t atom_length;
-    uint8_t atom[MAX_ATOM_LENGTH];
-
-    uint16_t backtrack;
-
-    uint8_t* forward_code;
-    uint8_t* backward_code;
-
-    struct _YR_ATOM_LIST_ITEM* next;
-
-} YR_ATOM_LIST_ITEM;
-
-
-int yr_atoms_extract_from_re(
-    RE* re,
-    int flags,
-    YR_ATOM_LIST_ITEM** atoms);
-
-
-int yr_atoms_extract_from_string(
-    uint8_t* string,
-    int string_length,
-    int flags,
-    YR_ATOM_LIST_ITEM** atoms);
-
-
-int yr_atoms_min_quality(
-    YR_ATOM_LIST_ITEM* atom_list);
-
-
-void yr_atoms_list_destroy(
-    YR_ATOM_LIST_ITEM* list_head);
-
-#endif
+/*
+Copyright (c) 2013. The YARA Authors. All Rights Reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+#ifndef YR_ATOMS_H
+#define YR_ATOMS_H
+
+#include "limits.h"
+#include "re.h"
+
+#define ATOM_TREE_LEAF  1
+#define ATOM_TREE_AND   2
+#define ATOM_TREE_OR    3
+
+
+typedef struct _ATOM_TREE_NODE
+{
+    uint8_t type;
+    uint8_t atom_length;
+    uint8_t atom[MAX_ATOM_LENGTH];
+
+    uint8_t* forward_code;
+    uint8_t* backward_code;
+
+    RE_NODE* recent_nodes[MAX_ATOM_LENGTH];
+
+    struct _ATOM_TREE_NODE* children_head;
+    struct _ATOM_TREE_NODE* children_tail;
+    struct _ATOM_TREE_NODE* next_sibling;
+
+} ATOM_TREE_NODE;
+
+
+typedef struct _ATOM_TREE
+{
+    ATOM_TREE_NODE* current_leaf;
+    ATOM_TREE_NODE* root_node;
+
+} ATOM_TREE;
+
+
+typedef struct _YR_ATOM_LIST_ITEM
+{
+    uint8_t atom_length;
+    uint8_t atom[MAX_ATOM_LENGTH];
+
+    uint16_t backtrack;
+
+    uint8_t* forward_code;
+    uint8_t* backward_code;
+
+    struct _YR_ATOM_LIST_ITEM* next;
+
+} YR_ATOM_LIST_ITEM;
+
+
+int yr_atoms_extract_from_re(
+    RE* re,
+    int flags,
+    YR_ATOM_LIST_ITEM** atoms);
+
+
+int yr_atoms_extract_from_string(
+    uint8_t* string,
+    int string_length,
+    int flags,
+    YR_ATOM_LIST_ITEM** atoms);
+
+
+int yr_atoms_min_quality(
+    YR_ATOM_LIST_ITEM* atom_list);
+
+
+void yr_atoms_list_destroy(
+    YR_ATOM_LIST_ITEM* list_head);
+
+#endif

pluginsdk/yara/yara/compiler.h

@@ -1,196 +1,207 @@
-/*
-Copyright (c) 2013. The YARA Authors. All Rights Reserved.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-   http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-#ifndef YR_COMPILER_H
-#define YR_COMPILER_H
-
-#include <stdio.h>
-#include <setjmp.h>
-
-#include "ahocorasick.h"
-#include "arena.h"
-#include "hash.h"
-#include "utils.h"
-
-
-#define YARA_ERROR_LEVEL_ERROR   0
-#define YARA_ERROR_LEVEL_WARNING 1
-
-
-typedef void (*YR_COMPILER_CALLBACK_FUNC)(
-    int error_level,
-    const char* file_name,
-    int line_number,
-    const char* message,
-    void* user_data);
-
-
-typedef struct _YR_COMPILER
-{
-    int               errors;
-    int               error_line;
-    int               last_error;
-    int               last_error_line;
-    int               last_result;
-
-    jmp_buf           error_recovery;
-
-    YR_ARENA*         sz_arena;
-    YR_ARENA*         rules_arena;
-    YR_ARENA*         strings_arena;
-    YR_ARENA*         code_arena;
-    YR_ARENA*         re_code_arena;
-    YR_ARENA*         automaton_arena;
-    YR_ARENA*         compiled_rules_arena;
-    YR_ARENA*         externals_arena;
-    YR_ARENA*         namespaces_arena;
-    YR_ARENA*         metas_arena;
-
-    YR_AC_AUTOMATON*  automaton;
-    YR_HASH_TABLE*    rules_table;
-    YR_HASH_TABLE*    objects_table;
-    YR_NAMESPACE*     current_namespace;
-    YR_STRING*        current_rule_strings;
-
-    int               current_rule_flags;
-    int               namespaces_count;
-
-    int8_t*           loop_address[MAX_LOOP_NESTING];
-    char*             loop_identifier[MAX_LOOP_NESTING];
-    int               loop_depth;
-    int               loop_for_of_mem_offset;
-
-    int               allow_includes;
-
-    char*             file_name_stack[MAX_INCLUDE_DEPTH];
-    int               file_name_stack_ptr;
-
-    FILE*             file_stack[MAX_INCLUDE_DEPTH];
-    int               file_stack_ptr;
-
-    char              last_error_extra_info[MAX_COMPILER_ERROR_EXTRA_INFO];
-
-    char              lex_buf[LEX_BUF_SIZE];
-    char*             lex_buf_ptr;
-    unsigned short    lex_buf_len;
-
-    char              include_base_dir[MAX_PATH];
-    void*             user_data;
-
-    YR_COMPILER_CALLBACK_FUNC  callback;
-
-} YR_COMPILER;
-
-
-#define yr_compiler_set_error_extra_info(compiler, info) \
-    strlcpy( \
-        compiler->last_error_extra_info, \
-        info, \
-        sizeof(compiler->last_error_extra_info)); \
- 
-
-#define yr_compiler_set_error_extra_info_fmt(compiler, fmt, ...) \
-    snprintf( \
-        compiler->last_error_extra_info, \
-        sizeof(compiler->last_error_extra_info), \
-        fmt, __VA_ARGS__);
-
-
-int _yr_compiler_push_file(
-    YR_COMPILER* compiler,
-    FILE* fh);
-
-
-FILE* _yr_compiler_pop_file(
-    YR_COMPILER* compiler);
-
-
-int _yr_compiler_push_file_name(
-    YR_COMPILER* compiler,
-    const char* file_name);
-
-
-void _yr_compiler_pop_file_name(
-    YR_COMPILER* compiler);
-
-
-YR_API int yr_compiler_create(
-    YR_COMPILER** compiler);
-
-
-YR_API void yr_compiler_destroy(
-    YR_COMPILER* compiler);
-
-
-YR_API void yr_compiler_set_callback(
-    YR_COMPILER* compiler,
-    YR_COMPILER_CALLBACK_FUNC callback,
-    void* user_data);
-
-
-YR_API int yr_compiler_add_file(
-    YR_COMPILER* compiler,
-    FILE* rules_file,
-    const char* namespace_,
-    const char* file_name);
-
-
-YR_API int yr_compiler_add_string(
-    YR_COMPILER* compiler,
-    const char* rules_string,
-    const char* namespace_);
-
-
-YR_API char* yr_compiler_get_error_message(
-    YR_COMPILER* compiler,
-    char* buffer,
-    int buffer_size);
-
-
-YR_API char* yr_compiler_get_current_file_name(
-    YR_COMPILER* context);
-
-
-YR_API int yr_compiler_define_integer_variable(
-    YR_COMPILER* compiler,
-    const char* identifier,
-    int64_t value);
-
-
-YR_API int yr_compiler_define_boolean_variable(
-    YR_COMPILER* compiler,
-    const char* identifier,
-    int value);
-
-
-YR_API int yr_compiler_define_float_variable(
-    YR_COMPILER* compiler,
-    const char* identifier,
-    double value);
-
-
-YR_API int yr_compiler_define_string_variable(
-    YR_COMPILER* compiler,
-    const char* identifier,
-    const char* value);
-
-
-YR_API int yr_compiler_get_rules(
-    YR_COMPILER* compiler,
-    YR_RULES** rules);
-
-
-#endif
+/*
+Copyright (c) 2013. The YARA Authors. All Rights Reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+#ifndef YR_COMPILER_H
+#define YR_COMPILER_H
+
+#include <stdio.h>
+#include <setjmp.h>
+
+#include "ahocorasick.h"
+#include "arena.h"
+#include "hash.h"
+#include "utils.h"
+
+
+#define YARA_ERROR_LEVEL_ERROR   0
+#define YARA_ERROR_LEVEL_WARNING 1
+
+
+typedef void (*YR_COMPILER_CALLBACK_FUNC)(
+    int error_level,
+    const char* file_name,
+    int line_number,
+    const char* message,
+    void* user_data);
+
+
+typedef struct _YR_FIXUP
+{
+    int64_t* address;
+    struct _YR_FIXUP* next;
+
+} YR_FIXUP;
+
+
+typedef struct _YR_COMPILER
+{
+    int               errors;
+    int               error_line;
+    int               last_error;
+    int               last_error_line;
+    int               last_result;
+
+    jmp_buf           error_recovery;
+
+    YR_ARENA*         sz_arena;
+    YR_ARENA*         rules_arena;
+    YR_ARENA*         strings_arena;
+    YR_ARENA*         code_arena;
+    YR_ARENA*         re_code_arena;
+    YR_ARENA*         compiled_rules_arena;
+    YR_ARENA*         externals_arena;
+    YR_ARENA*         namespaces_arena;
+    YR_ARENA*         metas_arena;
+    YR_ARENA*         matches_arena;
+    YR_ARENA*         automaton_arena;
+
+    YR_AC_AUTOMATON*  automaton;
+    YR_HASH_TABLE*    rules_table;
+    YR_HASH_TABLE*    objects_table;
+    YR_HASH_TABLE*    strings_table;
+    YR_NAMESPACE*     current_namespace;
+    YR_RULE*          current_rule;
+
+    YR_FIXUP*         fixup_stack_head;
+
+    int               namespaces_count;
+
+    uint8_t*          loop_address[MAX_LOOP_NESTING];
+    char*             loop_identifier[MAX_LOOP_NESTING];
+    int               loop_depth;
+    int               loop_for_of_mem_offset;
+
+    int               allow_includes;
+
+    char*             file_name_stack[MAX_INCLUDE_DEPTH];
+    int               file_name_stack_ptr;
+
+    FILE*             file_stack[MAX_INCLUDE_DEPTH];
+    int               file_stack_ptr;
+
+    char              last_error_extra_info[MAX_COMPILER_ERROR_EXTRA_INFO];
+
+    char              lex_buf[LEX_BUF_SIZE];
+    char*             lex_buf_ptr;
+    unsigned short    lex_buf_len;
+
+    char              include_base_dir[MAX_PATH];
+    void*             user_data;
+
+    YR_COMPILER_CALLBACK_FUNC  callback;
+
+} YR_COMPILER;
+
+
+#define yr_compiler_set_error_extra_info(compiler, info) \
+    strlcpy( \
+        compiler->last_error_extra_info, \
+        info, \
+        sizeof(compiler->last_error_extra_info)); \
+ 
+
+#define yr_compiler_set_error_extra_info_fmt(compiler, fmt, ...) \
+    snprintf( \
+        compiler->last_error_extra_info, \
+        sizeof(compiler->last_error_extra_info), \
+        fmt, __VA_ARGS__);
+
+
+int _yr_compiler_push_file(
+    YR_COMPILER* compiler,
+    FILE* fh);
+
+
+FILE* _yr_compiler_pop_file(
+    YR_COMPILER* compiler);
+
+
+int _yr_compiler_push_file_name(
+    YR_COMPILER* compiler,
+    const char* file_name);
+
+
+void _yr_compiler_pop_file_name(
+    YR_COMPILER* compiler);
+
+
+YR_API int yr_compiler_create(
+    YR_COMPILER** compiler);
+
+
+YR_API void yr_compiler_destroy(
+    YR_COMPILER* compiler);
+
+
+YR_API void yr_compiler_set_callback(
+    YR_COMPILER* compiler,
+    YR_COMPILER_CALLBACK_FUNC callback,
+    void* user_data);
+
+
+YR_API int yr_compiler_add_file(
+    YR_COMPILER* compiler,
+    FILE* rules_file,
+    const char* namespace_,
+    const char* file_name);
+
+
+YR_API int yr_compiler_add_string(
+    YR_COMPILER* compiler,
+    const char* rules_string,
+    const char* namespace_);
+
+
+YR_API char* yr_compiler_get_error_message(
+    YR_COMPILER* compiler,
+    char* buffer,
+    int buffer_size);
+
+
+YR_API char* yr_compiler_get_current_file_name(
+    YR_COMPILER* context);
+
+
+YR_API int yr_compiler_define_integer_variable(
+    YR_COMPILER* compiler,
+    const char* identifier,
+    int64_t value);
+
+
+YR_API int yr_compiler_define_boolean_variable(
+    YR_COMPILER* compiler,
+    const char* identifier,
+    int value);
+
+
+YR_API int yr_compiler_define_float_variable(
+    YR_COMPILER* compiler,
+    const char* identifier,
+    double value);
+
+
+YR_API int yr_compiler_define_string_variable(
+    YR_COMPILER* compiler,
+    const char* identifier,
+    const char* value);
+
+
+YR_API int yr_compiler_get_rules(
+    YR_COMPILER* compiler,
+    YR_RULES** rules);
+
+
+#endif

pluginsdk/yara/yara/elf.h

@@ -45,16 +45,20 @@ typedef uint64_t elf64_xword_t;
 #define ELF_ET_LOPROC   0xFF00  // Processor-specific
 #define ELF_ET_HIPROC   0x00FF  // Processor-specific
 
-#define ELF_EM_NONE     0x0000  // no type
-#define ELF_EM_M32      0x0001  // AT&T WE 32100
-#define ELF_EM_SPARC    0x0002  // SPARC
-#define ELF_EM_386      0x0003  // Intel 80386
-#define ELF_EM_68K      0x0004  // Motorola 68000
-#define ELF_EM_88K      0x0005  // Motorola 88000
-#define ELF_EM_860      0x0007  // Intel 80860
-#define ELF_EM_MIPS     0x0008  // MIPS RS3000
-#define ELF_EM_ARM      0x0032  // ARM
-#define ELF_EM_X86_64   0x003E  // AMD/Intel x86_64
+#define ELF_EM_NONE         0x0000  // no type
+#define ELF_EM_M32          0x0001  // AT&T WE 32100
+#define ELF_EM_SPARC        0x0002  // SPARC
+#define ELF_EM_386          0x0003  // Intel 80386
+#define ELF_EM_68K          0x0004  // Motorola 68000
+#define ELF_EM_88K          0x0005  // Motorola 88000
+#define ELF_EM_860          0x0007  // Intel 80860
+#define ELF_EM_MIPS         0x0008  // MIPS I Architecture
+#define ELF_EM_MIPS_RS3_LE  0x000A  // MIPS RS3000 Little-endian
+#define ELF_EM_PPC          0x0014  // PowerPC
+#define ELF_EM_PPC64        0x0015  // 64-bit PowerPC
+#define ELF_EM_ARM          0x0028  // ARM
+#define ELF_EM_X86_64       0x003E  // AMD/Intel x86_64
+#define ELF_EM_AARCH64      0x00B7  // 64-bit ARM
 
 #define ELF_CLASS_NONE  0x0000
 #define ELF_CLASS_32    0x0001  // 32bit file
@@ -83,6 +87,25 @@ typedef uint64_t elf64_xword_t;
 #define ELF_SHF_ALLOC        0x2   // Section is present during execution
 #define ELF_SHF_EXECINSTR    0x4   // Section contains executable instructions
 
+#define ELF_SHN_LORESERVE    0xFF00
+
+#define ELF_PT_NULL          0     // The array element is unused
+#define ELF_PT_LOAD          1     // Loadable segment
+#define ELF_PT_DYNAMIC       2     // Segment contains dynamic linking info
+#define ELF_PT_INTERP        3     // Contains interpreter pathname
+#define ELF_PT_NOTE          4     // Location & size of auxiliary info
+#define ELF_PT_SHLIB         5     // Reserved, unspecified semantics
+#define ELF_PT_PHDR          6     // Location and size of program header table
+#define ELF_PT_TLS           7     // Thread-Local Storage
+#define ELF_PT_GNU_EH_FRAME  0x6474e550
+#define ELF_PT_GNU_STACK     0x6474e551
+
+#define ELF_PF_X             0x1   // Segment is executable
+#define ELF_PF_W             0x2   // Segment is writable
+#define ELF_PF_R             0x4   // Segment is readable
+
+#define ELF_PN_XNUM          0xffff
+
 #pragma pack(push,1)
 
 typedef struct
@@ -199,4 +222,4 @@ typedef struct
 
 #pragma pack(pop)
 
-#endif
+#endif

pluginsdk/yara/yara/error.h

@@ -1,100 +1,108 @@
-/*
-Copyright (c) 2014. The YARA Authors. All Rights Reserved.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-   http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-#ifndef YR_ERROR_H
-#define YR_ERROR_H
-
-#include <string.h>
-
-#ifndef ERROR_SUCCESS
-#define ERROR_SUCCESS                           0
-#endif
-
-#define ERROR_INSUFICIENT_MEMORY                1
-#define ERROR_COULD_NOT_ATTACH_TO_PROCESS       2
-#define ERROR_COULD_NOT_OPEN_FILE               3
-#define ERROR_COULD_NOT_MAP_FILE                4
-#define ERROR_INVALID_FILE                      6
-#define ERROR_CORRUPT_FILE                      7
-#define ERROR_UNSUPPORTED_FILE_VERSION          8
-#define ERROR_INVALID_REGULAR_EXPRESSION        9
-#define ERROR_INVALID_HEX_STRING                10
-#define ERROR_SYNTAX_ERROR                      11
-#define ERROR_LOOP_NESTING_LIMIT_EXCEEDED       12
-#define ERROR_DUPLICATED_LOOP_IDENTIFIER        13
-#define ERROR_DUPLICATED_IDENTIFIER             14
-#define ERROR_DUPLICATED_TAG_IDENTIFIER         15
-#define ERROR_DUPLICATED_META_IDENTIFIER        16
-#define ERROR_DUPLICATED_STRING_IDENTIFIER      17
-#define ERROR_UNREFERENCED_STRING               18
-#define ERROR_UNDEFINED_STRING                  19
-#define ERROR_UNDEFINED_IDENTIFIER              20
-#define ERROR_MISPLACED_ANONYMOUS_STRING        21
-#define ERROR_INCLUDES_CIRCULAR_REFERENCE       22
-#define ERROR_INCLUDE_DEPTH_EXCEEDED            23
-#define ERROR_WRONG_TYPE                        24
-#define ERROR_EXEC_STACK_OVERFLOW               25
-#define ERROR_SCAN_TIMEOUT                      26
-#define ERROR_TOO_MANY_SCAN_THREADS             27
-#define ERROR_CALLBACK_ERROR                    28
-#define ERROR_INVALID_ARGUMENT                  29
-#define ERROR_TOO_MANY_MATCHES                  30
-#define ERROR_INTERNAL_FATAL_ERROR              31
-#define ERROR_NESTED_FOR_OF_LOOP                32
-#define ERROR_INVALID_FIELD_NAME                33
-#define ERROR_UNKNOWN_MODULE                    34
-#define ERROR_NOT_A_STRUCTURE                   35
-#define ERROR_NOT_INDEXABLE                     36
-#define ERROR_NOT_A_FUNCTION                    37
-#define ERROR_INVALID_FORMAT                    38
-#define ERROR_TOO_MANY_ARGUMENTS                39
-#define ERROR_WRONG_ARGUMENTS                   40
-#define ERROR_WRONG_RETURN_TYPE                 41
-#define ERROR_DUPLICATED_STRUCTURE_MEMBER       42
-
-
-#define FAIL_ON_ERROR(x) { \
-  int result = (x); \
-  if (result != ERROR_SUCCESS) \
-    return result; \
-}
-
-#define FAIL_ON_ERROR_WITH_CLEANUP(x, cleanup) { \
-  int result = (x); \
-  if (result != ERROR_SUCCESS) { \
-    cleanup; \
-    return result; \
-  } \
-}
-
-#define FAIL_ON_COMPILER_ERROR(x) { \
-  compiler->last_result = (x); \
-  if (compiler->last_result != ERROR_SUCCESS) \
-    return compiler->last_result; \
-}
-
-
-#ifdef NDEBUG
-#define assertf(expr, msg)  ((void)0)
-#else
-#define assertf(expr, msg, ...) \
-    if(!(expr)) { \
-      fprintf(stderr, "%s:%d: " msg "\n", __FILE__, __LINE__, ##__VA_ARGS__); \
-      abort(); \
-    }
-#endif
-
-#endif
+/*
+Copyright (c) 2014. The YARA Authors. All Rights Reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+#ifndef YR_ERROR_H
+#define YR_ERROR_H
+
+#include <string.h>
+
+#if defined(_WIN32) || defined(__CYGWIN__)
+#include <windows.h>
+#endif
+
+#ifndef ERROR_SUCCESS
+#define ERROR_SUCCESS                           0
+#endif
+
+#define ERROR_INSUFICIENT_MEMORY                1
+#define ERROR_COULD_NOT_ATTACH_TO_PROCESS       2
+#define ERROR_COULD_NOT_OPEN_FILE               3
+#define ERROR_COULD_NOT_MAP_FILE                4
+#define ERROR_INVALID_FILE                      6
+#define ERROR_CORRUPT_FILE                      7
+#define ERROR_UNSUPPORTED_FILE_VERSION          8
+#define ERROR_INVALID_REGULAR_EXPRESSION        9
+#define ERROR_INVALID_HEX_STRING                10
+#define ERROR_SYNTAX_ERROR                      11
+#define ERROR_LOOP_NESTING_LIMIT_EXCEEDED       12
+#define ERROR_DUPLICATED_LOOP_IDENTIFIER        13
+#define ERROR_DUPLICATED_IDENTIFIER             14
+#define ERROR_DUPLICATED_TAG_IDENTIFIER         15
+#define ERROR_DUPLICATED_META_IDENTIFIER        16
+#define ERROR_DUPLICATED_STRING_IDENTIFIER      17
+#define ERROR_UNREFERENCED_STRING               18
+#define ERROR_UNDEFINED_STRING                  19
+#define ERROR_UNDEFINED_IDENTIFIER              20
+#define ERROR_MISPLACED_ANONYMOUS_STRING        21
+#define ERROR_INCLUDES_CIRCULAR_REFERENCE       22
+#define ERROR_INCLUDE_DEPTH_EXCEEDED            23
+#define ERROR_WRONG_TYPE                        24
+#define ERROR_EXEC_STACK_OVERFLOW               25
+#define ERROR_SCAN_TIMEOUT                      26
+#define ERROR_TOO_MANY_SCAN_THREADS             27
+#define ERROR_CALLBACK_ERROR                    28
+#define ERROR_INVALID_ARGUMENT                  29
+#define ERROR_TOO_MANY_MATCHES                  30
+#define ERROR_INTERNAL_FATAL_ERROR              31
+#define ERROR_NESTED_FOR_OF_LOOP                32
+#define ERROR_INVALID_FIELD_NAME                33
+#define ERROR_UNKNOWN_MODULE                    34
+#define ERROR_NOT_A_STRUCTURE                   35
+#define ERROR_NOT_INDEXABLE                     36
+#define ERROR_NOT_A_FUNCTION                    37
+#define ERROR_INVALID_FORMAT                    38
+#define ERROR_TOO_MANY_ARGUMENTS                39
+#define ERROR_WRONG_ARGUMENTS                   40
+#define ERROR_WRONG_RETURN_TYPE                 41
+#define ERROR_DUPLICATED_STRUCTURE_MEMBER       42
+#define ERROR_EMPTY_STRING                      43
+#define ERROR_DIVISION_BY_ZERO                  44
+#define ERROR_REGULAR_EXPRESSION_TOO_LARGE      45
+#define ERROR_TOO_MANY_RE_FIBERS                46
+
+
+#define FAIL_ON_ERROR(x) { \
+  int result = (x); \
+  if (result != ERROR_SUCCESS) \
+    return result; \
+}
+
+#define FAIL_ON_ERROR_WITH_CLEANUP(x, cleanup) { \
+  int result = (x); \
+  if (result != ERROR_SUCCESS) { \
+    cleanup; \
+    return result; \
+  } \
+}
+
+#define FAIL_ON_COMPILER_ERROR(x) { \
+  compiler->last_result = (x); \
+  if (compiler->last_result != ERROR_SUCCESS) \
+    return compiler->last_result; \
+}
+
+
+#ifdef NDEBUG
+#define assertf(expr, msg, ...)  ((void)0)
+#else
+#define assertf(expr, msg, ...) \
+    if(!(expr)) { \
+      fprintf(stderr, "%s:%d: " msg "\n", __FILE__, __LINE__, ##__VA_ARGS__); \
+      abort(); \
+    }
+#endif
+
+#endif

pluginsdk/yara/yara/exec.h

@@ -1,156 +1,162 @@
-/*
-Copyright (c) 2013-2014. The YARA Authors. All Rights Reserved.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-   http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-#ifndef YR_EXEC_H
-#define YR_EXEC_H
-
-#include "hash.h"
-#include "scan.h"
-#include "types.h"
-#include "rules.h"
-
-
-#define UNDEFINED           0xFFFABADAFABADAFFLL
-#define IS_UNDEFINED(x)     ((size_t)(x) == (size_t) UNDEFINED)
-
-#define OP_ERROR          0
-#define OP_HALT           255
-
-#define OP_AND            1
-#define OP_OR             2
-#define OP_NOT            3
-#define OP_BITWISE_NOT    4
-#define OP_BITWISE_AND    5
-#define OP_BITWISE_OR     6
-#define OP_BITWISE_XOR    7
-#define OP_SHL            8
-#define OP_SHR            9
-#define OP_MOD            10
-#define OP_INT_TO_DBL     11
-#define OP_STR_TO_BOOL    12
-#define OP_PUSH           13
-#define OP_POP            14
-#define OP_CALL           15
-#define OP_OBJ_LOAD       16
-#define OP_OBJ_VALUE      17
-#define OP_OBJ_FIELD      18
-#define OP_INDEX_ARRAY    19
-#define OP_COUNT          20
-#define OP_FOUND          21
-#define OP_FOUND_AT       22
-#define OP_FOUND_IN       23
-#define OP_OFFSET         24
-#define OP_OF             25
-#define OP_PUSH_RULE      26
-#define OP_MATCH_RULE     27
-#define OP_INCR_M         28
-#define OP_CLEAR_M        29
-#define OP_ADD_M          30
-#define OP_POP_M          31
-#define OP_PUSH_M         32
-#define OP_SWAPUNDEF      33
-#define OP_JNUNDEF        34
-#define OP_JLE            35
-#define OP_FILESIZE       36
-#define OP_ENTRYPOINT     37
-#define OP_CONTAINS       38
-#define OP_MATCHES        39
-#define OP_IMPORT         40
-#define OP_LOOKUP_DICT    41
-
-#define _OP_EQ            0
-#define _OP_NEQ           1
-#define _OP_LT            2
-#define _OP_GT            3
-#define _OP_LE            4
-#define _OP_GE            5
-#define _OP_ADD           6
-#define _OP_SUB           7
-#define _OP_MUL           8
-#define _OP_DIV           9
-#define _OP_MINUS         10
-
-#define OP_INT_BEGIN      100
-#define OP_INT_EQ         (OP_INT_BEGIN + _OP_EQ)
-#define OP_INT_NEQ        (OP_INT_BEGIN + _OP_NEQ)
-#define OP_INT_LT         (OP_INT_BEGIN + _OP_LT)
-#define OP_INT_GT         (OP_INT_BEGIN + _OP_GT)
-#define OP_INT_LE         (OP_INT_BEGIN + _OP_LE)
-#define OP_INT_GE         (OP_INT_BEGIN + _OP_GE)
-#define OP_INT_ADD        (OP_INT_BEGIN + _OP_ADD)
-#define OP_INT_SUB        (OP_INT_BEGIN + _OP_SUB)
-#define OP_INT_MUL        (OP_INT_BEGIN + _OP_MUL)
-#define OP_INT_DIV        (OP_INT_BEGIN + _OP_DIV)
-#define OP_INT_MINUS      (OP_INT_BEGIN + _OP_MINUS)
-#define OP_INT_END        OP_INT_MINUS
-
-#define OP_DBL_BEGIN      120
-#define OP_DBL_EQ         (OP_DBL_BEGIN + _OP_EQ)
-#define OP_DBL_NEQ        (OP_DBL_BEGIN + _OP_NEQ)
-#define OP_DBL_LT         (OP_DBL_BEGIN + _OP_LT)
-#define OP_DBL_GT         (OP_DBL_BEGIN + _OP_GT)
-#define OP_DBL_LE         (OP_DBL_BEGIN + _OP_LE)
-#define OP_DBL_GE         (OP_DBL_BEGIN + _OP_GE)
-#define OP_DBL_ADD        (OP_DBL_BEGIN + _OP_ADD)
-#define OP_DBL_SUB        (OP_DBL_BEGIN + _OP_SUB)
-#define OP_DBL_MUL        (OP_DBL_BEGIN + _OP_MUL)
-#define OP_DBL_DIV        (OP_DBL_BEGIN + _OP_DIV)
-#define OP_DBL_MINUS      (OP_DBL_BEGIN + _OP_MINUS)
-#define OP_DBL_END        OP_DBL_MINUS
-
-#define OP_STR_BEGIN      140
-#define OP_STR_EQ         (OP_STR_BEGIN + _OP_EQ)
-#define OP_STR_NEQ        (OP_STR_BEGIN + _OP_NEQ)
-#define OP_STR_LT         (OP_STR_BEGIN + _OP_LT)
-#define OP_STR_GT         (OP_STR_BEGIN + _OP_GT)
-#define OP_STR_LE         (OP_STR_BEGIN + _OP_LE)
-#define OP_STR_GE         (OP_STR_BEGIN + _OP_GE)
-#define OP_STR_END        OP_STR_GE
-
-#define IS_INT_OP(x)      ((x) >= OP_INT_BEGIN && (x) <= OP_INT_END)
-#define IS_DBL_OP(x)      ((x) >= OP_DBL_BEGIN && (x) <= OP_DBL_END)
-#define IS_STR_OP(x)      ((x) >= OP_STR_BEGIN && (x) <= OP_STR_END)
-
-#define OP_READ_INT       240
-#define OP_INT8           (OP_READ_INT + 0)
-#define OP_INT16          (OP_READ_INT + 1)
-#define OP_INT32          (OP_READ_INT + 2)
-#define OP_UINT8          (OP_READ_INT + 3)
-#define OP_UINT16         (OP_READ_INT + 4)
-#define OP_UINT32         (OP_READ_INT + 5)
-#define OP_INT8BE         (OP_READ_INT + 6)
-#define OP_INT16BE        (OP_READ_INT + 7)
-#define OP_INT32BE        (OP_READ_INT + 8)
-#define OP_UINT8BE        (OP_READ_INT + 9)
-#define OP_UINT16BE       (OP_READ_INT + 10)
-#define OP_UINT32BE       (OP_READ_INT + 11)
-
-
-#define OPERATION(operator, op1, op2) \
-    (IS_UNDEFINED(op1) || IS_UNDEFINED(op2)) ? (UNDEFINED) : (op1 operator op2)
-
-
-#define COMPARISON(operator, op1, op2) \
-    (IS_UNDEFINED(op1) || IS_UNDEFINED(op2)) ? (0) : (op1 operator op2)
-
-
-int yr_execute_code(
-    YR_RULES* rules,
-    YR_SCAN_CONTEXT* context,
-    int timeout,
-    time_t start_time);
-
-#endif
+/*
+Copyright (c) 2013-2014. The YARA Authors. All Rights Reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+#ifndef YR_EXEC_H
+#define YR_EXEC_H
+
+#include "hash.h"
+#include "scan.h"
+#include "types.h"
+#include "rules.h"
+
+
+#define UNDEFINED           0xFFFABADAFABADAFFLL
+#define IS_UNDEFINED(x)     ((size_t)(x) == (size_t) UNDEFINED)
+
+#define OP_ERROR          0
+#define OP_HALT           255
+
+#define OP_AND            1
+#define OP_OR             2
+#define OP_NOT            3
+#define OP_BITWISE_NOT    4
+#define OP_BITWISE_AND    5
+#define OP_BITWISE_OR     6
+#define OP_BITWISE_XOR    7
+#define OP_SHL            8
+#define OP_SHR            9
+#define OP_MOD            10
+#define OP_INT_TO_DBL     11
+#define OP_STR_TO_BOOL    12
+#define OP_PUSH           13
+#define OP_POP            14
+#define OP_CALL           15
+#define OP_OBJ_LOAD       16
+#define OP_OBJ_VALUE      17
+#define OP_OBJ_FIELD      18
+#define OP_INDEX_ARRAY    19
+#define OP_COUNT          20
+#define OP_LENGTH         21
+#define OP_FOUND          22
+#define OP_FOUND_AT       23
+#define OP_FOUND_IN       24
+#define OP_OFFSET         25
+#define OP_OF             26
+#define OP_PUSH_RULE      27
+#define OP_INIT_RULE      28
+#define OP_MATCH_RULE     29
+#define OP_INCR_M         30
+#define OP_CLEAR_M        31
+#define OP_ADD_M          32
+#define OP_POP_M          33
+#define OP_PUSH_M         34
+#define OP_SWAPUNDEF      35
+#define OP_JNUNDEF        36
+#define OP_JLE            37
+#define OP_FILESIZE       38
+#define OP_ENTRYPOINT     39
+#define OP_CONTAINS       40
+#define OP_MATCHES        41
+#define OP_IMPORT         42
+#define OP_LOOKUP_DICT    43
+#define OP_JFALSE         44
+#define OP_JTRUE          45
+
+
+#define _OP_EQ            0
+#define _OP_NEQ           1
+#define _OP_LT            2
+#define _OP_GT            3
+#define _OP_LE            4
+#define _OP_GE            5
+#define _OP_ADD           6
+#define _OP_SUB           7
+#define _OP_MUL           8
+#define _OP_DIV           9
+#define _OP_MINUS         10
+
+
+#define OP_INT_BEGIN      100
+#define OP_INT_EQ         (OP_INT_BEGIN + _OP_EQ)
+#define OP_INT_NEQ        (OP_INT_BEGIN + _OP_NEQ)
+#define OP_INT_LT         (OP_INT_BEGIN + _OP_LT)
+#define OP_INT_GT         (OP_INT_BEGIN + _OP_GT)
+#define OP_INT_LE         (OP_INT_BEGIN + _OP_LE)
+#define OP_INT_GE         (OP_INT_BEGIN + _OP_GE)
+#define OP_INT_ADD        (OP_INT_BEGIN + _OP_ADD)
+#define OP_INT_SUB        (OP_INT_BEGIN + _OP_SUB)
+#define OP_INT_MUL        (OP_INT_BEGIN + _OP_MUL)
+#define OP_INT_DIV        (OP_INT_BEGIN + _OP_DIV)
+#define OP_INT_MINUS      (OP_INT_BEGIN + _OP_MINUS)
+#define OP_INT_END        OP_INT_MINUS
+
+#define OP_DBL_BEGIN      120
+#define OP_DBL_EQ         (OP_DBL_BEGIN + _OP_EQ)
+#define OP_DBL_NEQ        (OP_DBL_BEGIN + _OP_NEQ)
+#define OP_DBL_LT         (OP_DBL_BEGIN + _OP_LT)
+#define OP_DBL_GT         (OP_DBL_BEGIN + _OP_GT)
+#define OP_DBL_LE         (OP_DBL_BEGIN + _OP_LE)
+#define OP_DBL_GE         (OP_DBL_BEGIN + _OP_GE)
+#define OP_DBL_ADD        (OP_DBL_BEGIN + _OP_ADD)
+#define OP_DBL_SUB        (OP_DBL_BEGIN + _OP_SUB)
+#define OP_DBL_MUL        (OP_DBL_BEGIN + _OP_MUL)
+#define OP_DBL_DIV        (OP_DBL_BEGIN + _OP_DIV)
+#define OP_DBL_MINUS      (OP_DBL_BEGIN + _OP_MINUS)
+#define OP_DBL_END        OP_DBL_MINUS
+
+#define OP_STR_BEGIN      140
+#define OP_STR_EQ         (OP_STR_BEGIN + _OP_EQ)
+#define OP_STR_NEQ        (OP_STR_BEGIN + _OP_NEQ)
+#define OP_STR_LT         (OP_STR_BEGIN + _OP_LT)
+#define OP_STR_GT         (OP_STR_BEGIN + _OP_GT)
+#define OP_STR_LE         (OP_STR_BEGIN + _OP_LE)
+#define OP_STR_GE         (OP_STR_BEGIN + _OP_GE)
+#define OP_STR_END        OP_STR_GE
+
+#define IS_INT_OP(x)      ((x) >= OP_INT_BEGIN && (x) <= OP_INT_END)
+#define IS_DBL_OP(x)      ((x) >= OP_DBL_BEGIN && (x) <= OP_DBL_END)
+#define IS_STR_OP(x)      ((x) >= OP_STR_BEGIN && (x) <= OP_STR_END)
+
+#define OP_READ_INT       240
+#define OP_INT8           (OP_READ_INT + 0)
+#define OP_INT16          (OP_READ_INT + 1)
+#define OP_INT32          (OP_READ_INT + 2)
+#define OP_UINT8          (OP_READ_INT + 3)
+#define OP_UINT16         (OP_READ_INT + 4)
+#define OP_UINT32         (OP_READ_INT + 5)
+#define OP_INT8BE         (OP_READ_INT + 6)
+#define OP_INT16BE        (OP_READ_INT + 7)
+#define OP_INT32BE        (OP_READ_INT + 8)
+#define OP_UINT8BE        (OP_READ_INT + 9)
+#define OP_UINT16BE       (OP_READ_INT + 10)
+#define OP_UINT32BE       (OP_READ_INT + 11)
+
+
+#define OPERATION(operator, op1, op2) \
+    (IS_UNDEFINED(op1) || IS_UNDEFINED(op2)) ? (UNDEFINED) : (op1 operator op2)
+
+
+#define COMPARISON(operator, op1, op2) \
+    (IS_UNDEFINED(op1) || IS_UNDEFINED(op2)) ? (0) : (op1 operator op2)
+
+
+int yr_execute_code(
+    YR_RULES* rules,
+    YR_SCAN_CONTEXT* context,
+    int timeout,
+    time_t start_time);
+
+#endif

pluginsdk/yara/yara/exefiles.h

@@ -1,30 +1,30 @@
-/*
-Copyright (c) 2007. The YARA Authors. All Rights Reserved.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-   http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-#ifndef YR_EXEFILES_H
-#define YR_EXEFILES_H
-
-uint64_t yr_get_entry_point_offset(
-    uint8_t* buffer,
-    size_t buffer_length);
-
-
-uint64_t yr_get_entry_point_address(
-    uint8_t* buffer,
-    size_t buffer_length,
-    size_t base_address);
-
-#endif
+/*
+Copyright (c) 2007. The YARA Authors. All Rights Reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+#ifndef YR_EXEFILES_H
+#define YR_EXEFILES_H
+
+uint64_t yr_get_entry_point_offset(
+    uint8_t* buffer,
+    size_t buffer_length);
+
+
+uint64_t yr_get_entry_point_address(
+    uint8_t* buffer,
+    size_t buffer_length,
+    size_t base_address);
+
+#endif

pluginsdk/yara/yara/filemap.h

@@ -1,62 +1,77 @@
-/*
-Copyright (c) 2007-2015. The YARA Authors. All Rights Reserved.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-   http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-#ifndef YR_FILEMAP_H
-#define YR_FILEMAP_H
-
-#ifdef _WIN32
-#include <windows.h>
-#define FILE_DESCRIPTOR    HANDLE
-#define off_t              int64_t
-#else
-#include <sys/types.h>
-#define FILE_DESCRIPTOR    int
-#endif
-
-#include <stdlib.h>
-#include <stdint.h>
-
-#include "utils.h"
-
-
-typedef struct _YR_MAPPED_FILE
-{
-    FILE_DESCRIPTOR     file;
-    size_t              size;
-    uint8_t*            data;
-#ifdef _WIN32
-    HANDLE              mapping;
-#endif
-
-} YR_MAPPED_FILE;
-
-
-YR_API int yr_filemap_map(
-    const char* file_path,
-    YR_MAPPED_FILE* pmapped_file);
-
-
-YR_API int yr_filemap_map_ex(
-    const char* file_path,
-    off_t offset,
-    size_t size,
-    YR_MAPPED_FILE* pmapped_file);
-
-
-YR_API void yr_filemap_unmap(
-    YR_MAPPED_FILE* pmapped_file);
-
-#endif
+/*
+Copyright (c) 2007-2015. The YARA Authors. All Rights Reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+#ifndef YR_FILEMAP_H
+#define YR_FILEMAP_H
+
+#ifdef _MSC_VER
+#define off_t              int64_t
+#else
+#include <sys/types.h>
+#endif
+
+#if defined(_WIN32) || defined(__CYGWIN__)
+#include <windows.h>
+#define YR_FILE_DESCRIPTOR    HANDLE
+#else
+#define YR_FILE_DESCRIPTOR    int
+#endif
+
+#include <stdlib.h>
+#include <stdint.h>
+
+#include "utils.h"
+
+
+typedef struct _YR_MAPPED_FILE
+{
+    YR_FILE_DESCRIPTOR  file;
+    size_t              size;
+    uint8_t*            data;
+#if defined(_WIN32) || defined(__CYGWIN__)
+    HANDLE              mapping;
+#endif
+
+} YR_MAPPED_FILE;
+
+
+YR_API int yr_filemap_map(
+    const char* file_path,
+    YR_MAPPED_FILE* pmapped_file);
+
+
+YR_API int yr_filemap_map_fd(
+    YR_FILE_DESCRIPTOR file,
+    off_t offset,
+    size_t size,
+    YR_MAPPED_FILE* pmapped_file);
+
+
+YR_API int yr_filemap_map_ex(
+    const char* file_path,
+    off_t offset,
+    size_t size,
+    YR_MAPPED_FILE* pmapped_file);
+
+
+YR_API void yr_filemap_unmap(
+    YR_MAPPED_FILE* pmapped_file);
+
+
+YR_API void yr_filemap_unmap_fd(
+    YR_MAPPED_FILE* pmapped_file);
+
+#endif

pluginsdk/yara/yara/globals.h

@@ -1,23 +1,23 @@
-/*
-Copyright (c) 2014. The YARA Authors. All Rights Reserved.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-   http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-#ifndef YR_GLOBALS_H
-#define YR_GLOBALS_H
-
-extern char lowercase[256];
-extern char altercase[256];
-
-#endif
+/*
+Copyright (c) 2014. The YARA Authors. All Rights Reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+#ifndef YR_GLOBALS_H
+#define YR_GLOBALS_H
+
+extern char lowercase[256];
+extern char altercase[256];
+
+#endif

pluginsdk/yara/yara/hash.h

@@ -1,66 +1,72 @@
-/*
-Copyright (c) 2013. The YARA Authors. All Rights Reserved.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-   http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-#ifndef YR_HASH_H
-#define YR_HASH_H
-
-
-typedef struct _YR_HASH_TABLE_ENTRY
-{
-    char* key;
-    char* ns;
-    void* value;
-
-    struct _YR_HASH_TABLE_ENTRY* next;
-
-} YR_HASH_TABLE_ENTRY;
-
-
-typedef struct _YR_HASH_TABLE
-{
-    int size;
-
-    YR_HASH_TABLE_ENTRY* buckets[1];
-
-} YR_HASH_TABLE;
-
-
-typedef int (*YR_HASH_TABLE_FREE_VALUE_FUNC)(void* value);
-
-
-int yr_hash_table_create(
-    int size,
-    YR_HASH_TABLE** table);
-
-
-void yr_hash_table_destroy(
-    YR_HASH_TABLE* table,
-    YR_HASH_TABLE_FREE_VALUE_FUNC free_value);
-
-
-void* yr_hash_table_lookup(
-    YR_HASH_TABLE* table,
-    const char* key,
-    const char* ns);
-
-
-int yr_hash_table_add(
-    YR_HASH_TABLE* table,
-    const char* key,
-    const char* ns,
-    void* value);
-
-#endif
+/*
+Copyright (c) 2013. The YARA Authors. All Rights Reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+#ifndef YR_HASH_H
+#define YR_HASH_H
+
+#include "utils.h"
+
+typedef struct _YR_HASH_TABLE_ENTRY
+{
+    char* key;
+    char* ns;
+    void* value;
+
+    struct _YR_HASH_TABLE_ENTRY* next;
+
+} YR_HASH_TABLE_ENTRY;
+
+
+typedef struct _YR_HASH_TABLE
+{
+    int size;
+
+    YR_HASH_TABLE_ENTRY* buckets[1];
+
+} YR_HASH_TABLE;
+
+
+typedef int (*YR_HASH_TABLE_FREE_VALUE_FUNC)(void* value);
+
+
+YR_API int yr_hash_table_create(
+    int size,
+    YR_HASH_TABLE** table);
+
+
+YR_API void yr_hash_table_clean(
+    YR_HASH_TABLE* table,
+    YR_HASH_TABLE_FREE_VALUE_FUNC free_value);
+
+
+YR_API void yr_hash_table_destroy(
+    YR_HASH_TABLE* table,
+    YR_HASH_TABLE_FREE_VALUE_FUNC free_value);
+
+
+YR_API void* yr_hash_table_lookup(
+    YR_HASH_TABLE* table,
+    const char* key,
+    const char* ns);
+
+
+YR_API int yr_hash_table_add(
+    YR_HASH_TABLE* table,
+    const char* key,
+    const char* ns,
+    void* value);
+
+#endif

pluginsdk/yara/yara/hex_lexer.h

@@ -1,98 +1,98 @@
-/*
-Copyright (c) 2007. Victor M. Alvarez [[email protected]].
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-   http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-#include "re.h"
-
-#undef yyparse
-#undef yylex
-#undef yyerror
-#undef yyfatal
-#undef yychar
-#undef yydebug
-#undef yynerrs
-#undef yyget_extra
-#undef yyget_lineno
-
-#undef YY_FATAL_ERROR
-#undef YY_DECL
-#undef LEX_ENV
-
-#define yyparse         hex_yyparse
-#define yylex           hex_yylex
-#define yyerror         hex_yyerror
-#define yyfatal         hex_yyfatal
-#define yychar          hex_yychar
-#define yydebug         hex_yydebug
-#define yynerrs         hex_yynerrs
-#define yyget_extra     hex_yyget_extra
-#define yyget_lineno    hex_yyget_lineno
-
-
-#ifndef YY_TYPEDEF_YY_SCANNER_T
-#define YY_TYPEDEF_YY_SCANNER_T
-typedef void* yyscan_t;
-#endif
-
-#define YY_EXTRA_TYPE RE*
-#define YY_USE_CONST
-
-
-typedef struct _HEX_LEX_ENVIRONMENT
-{
-    int token_count;
-    int inside_or;
-    int last_error_code;
-    char last_error_message[256];
-
-} HEX_LEX_ENVIRONMENT;
-
-
-#define YY_FATAL_ERROR(msg) hex_yyfatal(yyscanner, msg)
-
-#define LEX_ENV  ((HEX_LEX_ENVIRONMENT*) lex_env)
-
-#include <hex_grammar.h>
-
-#define YY_DECL int hex_yylex \
-    (YYSTYPE * yylval_param , yyscan_t yyscanner, HEX_LEX_ENVIRONMENT* lex_env)
-
-
-YY_EXTRA_TYPE yyget_extra(
-    yyscan_t yyscanner);
-
-int yylex(
-    YYSTYPE* yylval_param,
-    yyscan_t yyscanner,
-    HEX_LEX_ENVIRONMENT* lex_env);
-
-int yyparse(
-    void* yyscanner,
-    HEX_LEX_ENVIRONMENT* lex_env);
-
-void yyerror(
-    yyscan_t yyscanner,
-    HEX_LEX_ENVIRONMENT* lex_env,
-    const char* error_message);
-
-void yyfatal(
-    yyscan_t yyscanner,
-    const char* error_message);
-
-int yr_parse_hex_string(
-    const char* hex_string,
-    int flags,
-    RE** re,
-    RE_ERROR* error);
+/*
+Copyright (c) 2007. Victor M. Alvarez [[email protected]].
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+#include "re.h"
+
+#undef yyparse
+#undef yylex
+#undef yyerror
+#undef yyfatal
+#undef yychar
+#undef yydebug
+#undef yynerrs
+#undef yyget_extra
+#undef yyget_lineno
+
+#undef YY_FATAL_ERROR
+#undef YY_DECL
+#undef LEX_ENV
+
+#define yyparse         hex_yyparse
+#define yylex           hex_yylex
+#define yyerror         hex_yyerror
+#define yyfatal         hex_yyfatal
+#define yychar          hex_yychar
+#define yydebug         hex_yydebug
+#define yynerrs         hex_yynerrs
+#define yyget_extra     hex_yyget_extra
+#define yyget_lineno    hex_yyget_lineno
+
+
+#ifndef YY_TYPEDEF_YY_SCANNER_T
+#define YY_TYPEDEF_YY_SCANNER_T
+typedef void* yyscan_t;
+#endif
+
+#define YY_EXTRA_TYPE RE*
+#define YY_USE_CONST
+
+
+typedef struct _HEX_LEX_ENVIRONMENT
+{
+    int token_count;
+    int inside_or;
+    int last_error_code;
+    char last_error_message[256];
+
+} HEX_LEX_ENVIRONMENT;
+
+
+#define YY_FATAL_ERROR(msg) hex_yyfatal(yyscanner, msg)
+
+#define LEX_ENV  ((HEX_LEX_ENVIRONMENT*) lex_env)
+
+#include <hex_grammar.h>
+
+#define YY_DECL int hex_yylex \
+    (YYSTYPE * yylval_param , yyscan_t yyscanner, HEX_LEX_ENVIRONMENT* lex_env)
+
+
+YY_EXTRA_TYPE yyget_extra(
+    yyscan_t yyscanner);
+
+int yylex(
+    YYSTYPE* yylval_param,
+    yyscan_t yyscanner,
+    HEX_LEX_ENVIRONMENT* lex_env);
+
+int yyparse(
+    void* yyscanner,
+    HEX_LEX_ENVIRONMENT* lex_env);
+
+void yyerror(
+    yyscan_t yyscanner,
+    HEX_LEX_ENVIRONMENT* lex_env,
+    const char* error_message);
+
+void yyfatal(
+    yyscan_t yyscanner,
+    const char* error_message);
+
+int yr_parse_hex_string(
+    const char* hex_string,
+    int flags,
+    RE** re,
+    RE_ERROR* error);

pluginsdk/yara/yara/lexer.h

@@ -1,131 +1,133 @@
-/*
-Copyright (c) 2007. Victor M. Alvarez [[email protected]].
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-   http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-#include "compiler.h"
-
-
-#undef yyparse
-#undef yylex
-#undef yyerror
-#undef yyfatal
-#undef yychar
-#undef yydebug
-#undef yynerrs
-#undef yyget_extra
-#undef yyget_lineno
-
-#undef YY_DECL
-#undef YY_FATAL_ERROR
-#undef YY_EXTRA_TYPE
-
-#define yyparse       yara_yyparse
-#define yylex         yara_yylex
-#define yyerror       yara_yyerror
-#define yyfatal       yara_yyfatal
-#define yywarning     yara_yywarning
-#define yychar        yara_yychar
-#define yydebug       yara_yydebug
-#define yynerrs       yara_yynerrs
-#define yyget_extra   yara_yyget_extra
-#define yyget_lineno  yara_yyget_lineno
-
-
-#ifndef YY_TYPEDEF_YY_SCANNER_T
-#define YY_TYPEDEF_YY_SCANNER_T
-typedef void* yyscan_t;
-#endif
-
-#ifndef YY_TYPEDEF_EXPRESSION_T
-#define YY_TYPEDEF_EXPRESSION_T
-
-
-// Expression type constants are powers of two because they are used as flags.
-// For example:
-//   CHECK_TYPE(whatever, EXPRESSION_TYPE_INTEGER | EXPRESSION_TYPE_FLOAT)
-// The expression above is used to ensure that the type of "whatever" is either
-// integer or float.
-
-#define EXPRESSION_TYPE_BOOLEAN   1
-#define EXPRESSION_TYPE_INTEGER   2
-#define EXPRESSION_TYPE_STRING    4
-#define EXPRESSION_TYPE_REGEXP    8
-#define EXPRESSION_TYPE_OBJECT    16
-#define EXPRESSION_TYPE_FLOAT     32
-
-typedef struct _EXPRESSION
-{
-    int type;
-
-    union
-    {
-        int64_t integer;
-        YR_OBJECT* object;
-    } value;
-
-    const char* identifier;
-
-} EXPRESSION;
-
-union YYSTYPE;
-
-#endif
-
-
-#define YY_DECL int yylex( \
-    union YYSTYPE* yylval_param, yyscan_t yyscanner, YR_COMPILER* compiler)
-
-
-#define YY_FATAL_ERROR(msg) yara_yyfatal(yyscanner, msg)
-
-
-#define YY_EXTRA_TYPE YR_COMPILER*
-#define YY_USE_CONST
-
-
-int yyget_lineno(yyscan_t yyscanner);
-
-int yylex(
-    union YYSTYPE* yylval_param,
-    yyscan_t yyscanner,
-    YR_COMPILER* compiler);
-
-int yyparse(
-    void* yyscanner,
-    YR_COMPILER* compiler);
-
-void yyerror(
-    yyscan_t yyscanner,
-    YR_COMPILER* compiler,
-    const char* error_message);
-
-void yywarning(
-    yyscan_t yyscanner,
-    const char* warning_message);
-
-void yyfatal(
-    yyscan_t yyscanner,
-    const char* error_message);
-
-YY_EXTRA_TYPE yyget_extra(
-    yyscan_t yyscanner);
-
-int yr_lex_parse_rules_string(
-    const char* rules_string,
-    YR_COMPILER* compiler);
-
-int yr_lex_parse_rules_file(
-    FILE* rules_file,
-    YR_COMPILER* compiler);
+/*
+Copyright (c) 2007. Victor M. Alvarez [[email protected]].
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+#include "compiler.h"
+
+
+#undef yyparse
+#undef yylex
+#undef yyerror
+#undef yyfatal
+#undef yychar
+#undef yydebug
+#undef yynerrs
+#undef yyget_extra
+#undef yyget_lineno
+
+#undef YY_DECL
+#undef YY_FATAL_ERROR
+#undef YY_EXTRA_TYPE
+
+#define yyparse       yara_yyparse
+#define yylex         yara_yylex
+#define yyerror       yara_yyerror
+#define yyfatal       yara_yyfatal
+#define yywarning     yara_yywarning
+#define yychar        yara_yychar
+#define yydebug       yara_yydebug
+#define yynerrs       yara_yynerrs
+#define yyget_extra   yara_yyget_extra
+#define yyget_lineno  yara_yyget_lineno
+
+
+#ifndef YY_TYPEDEF_YY_SCANNER_T
+#define YY_TYPEDEF_YY_SCANNER_T
+typedef void* yyscan_t;
+#endif
+
+#ifndef YY_TYPEDEF_EXPRESSION_T
+#define YY_TYPEDEF_EXPRESSION_T
+
+
+// Expression type constants are powers of two because they are used as flags.
+// For example:
+//   CHECK_TYPE(whatever, EXPRESSION_TYPE_INTEGER | EXPRESSION_TYPE_FLOAT)
+// The expression above is used to ensure that the type of "whatever" is either
+// integer or float.
+
+#define EXPRESSION_TYPE_BOOLEAN   1
+#define EXPRESSION_TYPE_INTEGER   2
+#define EXPRESSION_TYPE_STRING    4
+#define EXPRESSION_TYPE_REGEXP    8
+#define EXPRESSION_TYPE_OBJECT    16
+#define EXPRESSION_TYPE_FLOAT     32
+
+typedef struct _EXPRESSION
+{
+    int type;
+
+    union
+    {
+        int64_t integer;
+        YR_OBJECT* object;
+        SIZED_STRING* sized_string;
+    } value;
+
+    const char* identifier;
+
+} EXPRESSION;
+
+union YYSTYPE;
+
+#endif
+
+
+#define YY_DECL int yylex( \
+    union YYSTYPE* yylval_param, yyscan_t yyscanner, YR_COMPILER* compiler)
+
+
+#define YY_FATAL_ERROR(msg) yara_yyfatal(yyscanner, msg)
+
+
+#define YY_EXTRA_TYPE YR_COMPILER*
+#define YY_USE_CONST
+
+
+int yyget_lineno(yyscan_t yyscanner);
+
+int yylex(
+    union YYSTYPE* yylval_param,
+    yyscan_t yyscanner,
+    YR_COMPILER* compiler);
+
+int yyparse(
+    void* yyscanner,
+    YR_COMPILER* compiler);
+
+void yyerror(
+    yyscan_t yyscanner,
+    YR_COMPILER* compiler,
+    const char* error_message);
+
+void yywarning(
+    yyscan_t yyscanner,
+    const char* message_fmt,
+    ...);
+
+void yyfatal(
+    yyscan_t yyscanner,
+    const char* error_message);
+
+YY_EXTRA_TYPE yyget_extra(
+    yyscan_t yyscanner);
+
+int yr_lex_parse_rules_string(
+    const char* rules_string,
+    YR_COMPILER* compiler);
+
+int yr_lex_parse_rules_file(
+    FILE* rules_file,
+    YR_COMPILER* compiler);

pluginsdk/yara/yara/libyara.h

@@ -1,49 +1,68 @@
-/*
-Copyright (c) 2014. The YARA Authors. All Rights Reserved.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-   http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-#ifndef YR_LIBYARA_H
-#define YR_LIBYARA_H
-
-#include "utils.h"
-
-#define YR_MAJOR_VERSION   3
-#define YR_MINOR_VERSION   3
-#define YR_MICRO_VERSION   0
-
-// Version as a string
-#define YR_VERSION         "3.3.0"
-
-// Version as a single 4-byte hex number, e.g. 0x030401 == 3.4.1.
-#define YR_VERSION_HEX ((YR_MAJOR_VERSION << 16) | \
-    (YR_MINOR_VERSION << 8) | \
-    (YR_MICRO_VERSION << 0)
-
-
-YR_API int yr_initialize(void);
-
-
-YR_API int yr_finalize(void);
-
-
-YR_API void yr_finalize_thread(void);
-
-
-YR_API int yr_get_tidx(void);
-
-
-YR_API void yr_set_tidx(int);
-
-#endif
+/*
+Copyright (c) 2014. The YARA Authors. All Rights Reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+#ifndef YR_LIBYARA_H
+#define YR_LIBYARA_H
+
+#include "utils.h"
+
+#define YR_MAJOR_VERSION   3
+#define YR_MINOR_VERSION   4
+#define YR_MICRO_VERSION   0
+
+// Version as a string
+#define YR_VERSION         "3.4.0"
+
+
+// Version as a single 4-byte hex number, e.g. 0x030401 == 3.4.1.
+#define YR_VERSION_HEX ((YR_MAJOR_VERSION << 16) | \
+    (YR_MINOR_VERSION << 8) | \
+    (YR_MICRO_VERSION << 0))
+
+
+// Enumerated type listing configuration options
+typedef enum _YR_CONFIG_NAME
+{
+    YR_CONFIG_STACK_SIZE,
+    YR_CONFIG_MAX
+
+} YR_CONFIG_NAME;
+
+
+#define DEFAULT_STACK_SIZE 16384
+
+
+YR_API int yr_initialize(void);
+
+
+YR_API int yr_finalize(void);
+
+
+YR_API void yr_finalize_thread(void);
+
+
+YR_API int yr_get_tidx(void);
+
+
+YR_API void yr_set_tidx(int);
+
+
+YR_API int yr_set_configuration(YR_CONFIG_NAME, void*);
+
+
+YR_API int yr_get_configuration(YR_CONFIG_NAME, void*);
+
+#endif

pluginsdk/yara/yara/limits.h

@@ -1,48 +1,52 @@
-/*
-Copyright (c) 2013. The YARA Authors. All Rights Reserved.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-   http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-#ifndef YR_LIMITS_H
-#define YR_LIMITS_H
-
-
-// MAX_THREADS is the number of threads that can use a YR_RULES
-// object simultaneosly. This value is limited by the number of
-// bits in tidx_mask.
-
-#define MAX_THREADS 32
-
-
-#ifndef MAX_PATH
-#define MAX_PATH 1024
-#endif
-
-#define MAX_COMPILER_ERROR_EXTRA_INFO   256
-#define MAX_ATOM_LENGTH                 4
-#define MAX_LOOP_NESTING                4
-#define MAX_ARENA_PAGES                 32
-#define MAX_INCLUDE_DEPTH               16
-#define MAX_STRING_MATCHES              1000000
-#define MAX_FUNCTION_ARGS               128
-#define MAX_FAST_HEX_RE_STACK           300
-#define MAX_OVERLOADED_FUNCTIONS        10
-#define MAX_HEX_STRING_TOKENS           10000
-
-#define LOOP_LOCAL_VARS                 4
-#define STRING_CHAINING_THRESHOLD       200
-#define LEX_BUF_SIZE                    1024
-
-
-#endif
+/*
+Copyright (c) 2013. The YARA Authors. All Rights Reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+#ifndef YR_LIMITS_H
+#define YR_LIMITS_H
+
+#if defined(_WIN32) || defined(__CYGWIN__)
+#include <windows.h>
+#endif
+
+
+// MAX_THREADS is the number of threads that can use a YR_RULES
+// object simultaneosly. This value is limited by the number of
+// bits in tidx_mask.
+
+#define MAX_THREADS 32
+
+
+#ifndef MAX_PATH
+#define MAX_PATH 1024
+#endif
+
+#define MAX_COMPILER_ERROR_EXTRA_INFO   256
+#define MAX_ATOM_LENGTH                 4
+#define MAX_LOOP_NESTING                4
+#define MAX_ARENA_PAGES                 32
+#define MAX_INCLUDE_DEPTH               16
+#define MAX_STRING_MATCHES              1000000
+#define MAX_FUNCTION_ARGS               128
+#define MAX_FAST_HEX_RE_STACK           300
+#define MAX_OVERLOADED_FUNCTIONS        10
+#define MAX_HEX_STRING_TOKENS           10000
+
+#define LOOP_LOCAL_VARS                 4
+#define STRING_CHAINING_THRESHOLD       200
+#define LEX_BUF_SIZE                    8192
+
+
+#endif

pluginsdk/yara/yara/mem.h

@@ -1,63 +1,63 @@
-/*
-Copyright (c) 2007. The YARA Authors. All Rights Reserved.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-   http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-#ifndef YR_MEM_H
-#define YR_MEM_H
-
-#include <stdio.h>
-
-#include "config.h"
-
-#ifdef DMALLOC
-
-#define yr_malloc malloc
-#define yr_calloc calloc
-#define yr_realloc realloc
-#define yr_free free
-#define yr_strdup strdup
-#define yr_strndup strndup
-
-#include <dmalloc.h>
-
-#else
-
-void* yr_calloc(
-    size_t count,
-    size_t size);
-
-void* yr_malloc(
-    size_t size);
-
-void* yr_realloc(
-    void* ptr,
-    size_t size);
-
-void yr_free(
-    void* ptr);
-
-char* yr_strdup(
-    const char* str);
-
-char* yr_strndup(
-    const char* str, size_t n);
-
-#endif
-
-int yr_heap_alloc();
-
-int yr_heap_free();
-
-#endif
+/*
+Copyright (c) 2007. The YARA Authors. All Rights Reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+#ifndef YR_MEM_H
+#define YR_MEM_H
+
+#include <stdio.h>
+
+#include "config.h"
+
+#ifdef DMALLOC
+
+#define yr_malloc malloc
+#define yr_calloc calloc
+#define yr_realloc realloc
+#define yr_free free
+#define yr_strdup strdup
+#define yr_strndup strndup
+
+#include <dmalloc.h>
+
+#else
+
+void* yr_calloc(
+    size_t count,
+    size_t size);
+
+void* yr_malloc(
+    size_t size);
+
+void* yr_realloc(
+    void* ptr,
+    size_t size);
+
+void yr_free(
+    void* ptr);
+
+char* yr_strdup(
+    const char* str);
+
+char* yr_strndup(
+    const char* str, size_t n);
+
+#endif
+
+int yr_heap_alloc(void);
+
+int yr_heap_free(void);
+
+#endif

pluginsdk/yara/yara/modules.h

@@ -1,439 +1,434 @@
-/*
-Copyright (c) 2014. The YARA Authors. All Rights Reserved.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-   http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-#ifndef YR_MODULES_H
-#define YR_MODULES_H
-
-#include <assert.h>
-#include <stdio.h>
-#include <string.h>
-#include <math.h>
-
-#include "utils.h"
-#include "limits.h"
-#include "error.h"
-#include "exec.h"
-#include "types.h"
-#include "object.h"
-#include "libyara.h"
-
-// Concatenation that macro-expands its arguments.
-
-#define CONCAT(arg1, arg2) _CONCAT(arg1, arg2) // expands the arguments.
-#define _CONCAT(arg1, arg2) arg1 ## arg2       // do the actual concatenation.
-
-
-#define module_declarations CONCAT(MODULE_NAME, __declarations)
-#define module_load CONCAT(MODULE_NAME, __load)
-#define module_unload CONCAT(MODULE_NAME, __unload)
-#define module_initialize CONCAT(MODULE_NAME, __initialize)
-#define module_finalize CONCAT(MODULE_NAME, __finalize)
-
-#define begin_declarations \
-    int module_declarations(YR_OBJECT* module) { \
-      YR_OBJECT* stack[64]; \
-      int stack_top = 0; \
-      stack[stack_top] = module;
-
-
-#define end_declarations \
-    return ERROR_SUCCESS; }
-
-
-#define begin_struct(name) { \
-    YR_OBJECT* structure; \
-    FAIL_ON_ERROR(yr_object_create( \
-        OBJECT_TYPE_STRUCTURE, \
-        name, \
-        stack[stack_top], \
-        &structure)); \
-    assertf( \
-        stack_top < sizeof(stack)/sizeof(stack[0]) - 1, \
-        "too many nested structures"); \
-    stack[++stack_top] = structure; \
-  }
-
-
-#define begin_struct_array(name) { \
-    YR_OBJECT* structure; \
-    YR_OBJECT* array; \
-    FAIL_ON_ERROR(yr_object_create( \
-        OBJECT_TYPE_ARRAY, \
-        name, \
-        stack[stack_top], \
-        &array)); \
-    FAIL_ON_ERROR(yr_object_create( \
-        OBJECT_TYPE_STRUCTURE, \
-        name, \
-        array, \
-        &structure)); \
-    assertf( \
-        stack_top < sizeof(stack)/sizeof(stack[0]) - 1, \
-        "too many nested structures"); \
-    stack[++stack_top] = structure; \
-  }
-
-
-#define begin_struct_dictionary(name) { \
-    YR_OBJECT* structure; \
-    YR_OBJECT* array; \
-    FAIL_ON_ERROR(yr_object_create( \
-        OBJECT_TYPE_DICTIONARY, \
-        name, \
-        stack[stack_top], \
-        &array)); \
-    FAIL_ON_ERROR(yr_object_create( \
-        OBJECT_TYPE_STRUCTURE, \
-        name, \
-        array, \
-        &structure)); \
-    assertf( \
-        stack_top < sizeof(stack)/sizeof(stack[0]) - 1, \
-        "too many nested structures"); \
-    stack[++stack_top] = structure; \
-  }
-
-
-#define end_struct(name) { \
-    assert(stack[stack_top]->type == OBJECT_TYPE_STRUCTURE); \
-    assertf( \
-        strcmp(stack[stack_top]->identifier, name) == 0, \
-        "unbalanced begin_struct/end_struct"); \
-    stack_top--; \
-  }
-
-
-#define end_struct_array(name) end_struct(name)
-
-
-#define end_struct_dictionary(name) end_struct(name)
-
-
-#define declare_integer(name) { \
-    FAIL_ON_ERROR(yr_object_create( \
-        OBJECT_TYPE_INTEGER, \
-        name, \
-        stack[stack_top], \
-        NULL)); \
-  }
-
-
-#define declare_integer_array(name) { \
-    YR_OBJECT* array; \
-    FAIL_ON_ERROR(yr_object_create( \
-        OBJECT_TYPE_ARRAY, \
-        name, \
-        stack[stack_top], \
-        &array)); \
-    FAIL_ON_ERROR(yr_object_create( \
-        OBJECT_TYPE_INTEGER, \
-        name, \
-        array, \
-        NULL)); \
-  }
-
-
-#define declare_integer_dictionary(name) { \
-    YR_OBJECT* dict; \
-    FAIL_ON_ERROR(yr_object_create( \
-        OBJECT_TYPE_DICTIONARY, \
-        name, \
-        stack[stack_top], \
-        &dict)); \
-    FAIL_ON_ERROR(yr_object_create( \
-        OBJECT_TYPE_INTEGER, \
-        name, \
-        dict, \
-        NULL)); \
-  }
-
-
-#define declare_float(name) { \
-    FAIL_ON_ERROR(yr_object_create( \
-        OBJECT_TYPE_FLOAT, \
-        name, \
-        stack[stack_top], \
-        NULL)); \
-  }
-
-
-#define declare_float_array(name) { \
-    YR_OBJECT* array; \
-    FAIL_ON_ERROR(yr_object_create( \
-        OBJECT_TYPE_ARRAY, \
-        name, \
-        stack[stack_top], \
-        &array)); \
-    FAIL_ON_ERROR(yr_object_create( \
-        OBJECT_TYPE_FLOAT, \
-        name, \
-        array, \
-        NULL)); \
-  }
-
-
-#define declare_float_dictionary(name) { \
-    YR_OBJECT* dict; \
-    FAIL_ON_ERROR(yr_object_create( \
-        OBJECT_TYPE_DICTIONARY, \
-        name, \
-        stack[stack_top], \
-        &dict)); \
-    FAIL_ON_ERROR(yr_object_create( \
-        OBJECT_TYPE_FLOAT, \
-        name, \
-        dict, \
-        NULL)); \
-  }
-
-
-#define declare_string(name) { \
-    FAIL_ON_ERROR(yr_object_create( \
-        OBJECT_TYPE_STRING, \
-        name, \
-        stack[stack_top], \
-        NULL)); \
-  }
-
-
-#define declare_string_array(name) { \
-    YR_OBJECT* array; \
-    FAIL_ON_ERROR(yr_object_create( \
-        OBJECT_TYPE_ARRAY, \
-        name, \
-        stack[stack_top], \
-        &array)); \
-    FAIL_ON_ERROR(yr_object_create( \
-        OBJECT_TYPE_STRING, \
-        name, \
-        array, \
-        NULL)); \
-  }
-
-
-#define declare_string_dictionary(name) { \
-    YR_OBJECT* dict; \
-    FAIL_ON_ERROR(yr_object_create( \
-        OBJECT_TYPE_DICTIONARY, \
-        name, \
-        stack[stack_top], \
-        &dict)); \
-    FAIL_ON_ERROR(yr_object_create( \
-        OBJECT_TYPE_STRING, \
-        name, \
-        dict, \
-        NULL)); \
-  }
-
-
-#define declare_function(name, args_fmt, ret_fmt, func) { \
-    YR_OBJECT* function; \
-    FAIL_ON_ERROR(yr_object_function_create( \
-        name, \
-        args_fmt, \
-        ret_fmt, \
-        func, \
-        stack[stack_top], \
-        &function)); \
-    }
-
-
-#define define_function(func) \
-    int func ( \
-        void* __args, \
-        YR_SCAN_CONTEXT* __context, \
-        YR_OBJECT_FUNCTION* __function_obj)
-
-
-#define sized_string_argument(n) \
-    ((SIZED_STRING*)(size_t)((int64_t*) __args)[n-1])
-
-#define string_argument(n) \
-    (sized_string_argument(n)->c_string)
-
-#define integer_argument(n) \
-    (((int64_t*) __args)[n-1])
-
-#define float_argument(n) \
-    (((double*) __args)[n-1])
-
-#define regexp_argument(n) \
-    ((RE_CODE)((int64_t*) __args)[n-1])
-
-
-#define module()        yr_object_get_root((YR_OBJECT*) __function_obj)
-#define parent()        (__function_obj->parent)
-#define scan_context()  (__context)
-
-
-#define foreach_memory_block(context, block) \
-  for (block = (context)->mem_block; \
-       block != NULL; \
-       block = block->next) \
- 
-
-#define first_memory_block(context) \
-      (context)->mem_block
-
-
-#define is_undefined(object, ...) \
-    yr_object_has_undefined_value(object, __VA_ARGS__)
-
-
-#define get_object(object, ...) \
-    yr_object_lookup(object, 0, __VA_ARGS__)
-
-
-#define get_integer(object, ...) \
-    yr_object_get_integer(object, __VA_ARGS__)
-
-
-#define get_float(object, ...) \
-    yr_object_get_float(object, __VA_ARGS__)
-
-
-#define get_string(object, ...) \
-    yr_object_get_string(object, __VA_ARGS__)
-
-
-#define set_integer(value, object, ...) \
-    yr_object_set_integer(value, object, __VA_ARGS__)
-
-
-#define set_float(value, object, ...) \
-    yr_object_set_float(value, object, __VA_ARGS__)
-
-
-#define set_sized_string(value, len, object, ...) \
-    yr_object_set_string(value, len, object, __VA_ARGS__)
-
-
-#define set_string(value, object, ...) \
-    set_sized_string(value, strlen(value), object, __VA_ARGS__)
-
-
-#define return_integer(integer) { \
-      assertf( \
-          __function_obj->return_obj->type == OBJECT_TYPE_INTEGER, \
-          "return type differs from function declaration"); \
-      yr_object_set_integer( \
-          (integer), \
-          __function_obj->return_obj, \
-          NULL); \
-      return ERROR_SUCCESS; \
-    }
-
-
-#define return_float(double_) { \
-      assertf( \
-          __function_obj->return_obj->type == OBJECT_TYPE_FLOAT, \
-          "return type differs from function declaration"); \
-      double d = (double) (double_); \
-      yr_object_set_float( \
-          (d != (double) UNDEFINED) ? d : NAN, \
-          __function_obj->return_obj, \
-          NULL); \
-      return ERROR_SUCCESS; \
-    }
-
-
-#define return_string(string) { \
-      assertf( \
-          __function_obj->return_obj->type == OBJECT_TYPE_STRING, \
-          "return type differs from function declaration"); \
-      char* s = (char*) (string); \
-      yr_object_set_string( \
-          (s != (char*) UNDEFINED) ? s : NULL, \
-          (s != (char*) UNDEFINED) ? strlen(s) : 0, \
-          __function_obj->return_obj, \
-          NULL); \
-      return ERROR_SUCCESS; \
-    }
-
-
-struct _YR_MODULE;
-
-
-typedef int (*YR_EXT_INITIALIZE_FUNC)(
-    struct _YR_MODULE* module);
-
-
-typedef int (*YR_EXT_FINALIZE_FUNC)(
-    struct _YR_MODULE* module);
-
-
-typedef int (*YR_EXT_DECLARATIONS_FUNC)(
-    YR_OBJECT* module_object);
-
-
-typedef int (*YR_EXT_LOAD_FUNC)(
-    YR_SCAN_CONTEXT* context,
-    YR_OBJECT* module_object,
-    void* module_data,
-    size_t module_data_size);
-
-
-typedef int (*YR_EXT_UNLOAD_FUNC)(
-    YR_OBJECT* module_object);
-
-
-typedef struct _YR_MODULE
-{
-    tidx_mask_t is_loaded;
-
-    char* name;
-
-    YR_EXT_DECLARATIONS_FUNC declarations;
-    YR_EXT_LOAD_FUNC load;
-    YR_EXT_UNLOAD_FUNC unload;
-    YR_EXT_INITIALIZE_FUNC initialize;
-    YR_EXT_FINALIZE_FUNC finalize;
-
-} YR_MODULE;
-
-
-typedef struct _YR_MODULE_IMPORT
-{
-    const char* module_name;
-    void* module_data;
-    size_t module_data_size;
-
-} YR_MODULE_IMPORT;
-
-
-int yr_modules_initialize(void);
-
-
-int yr_modules_finalize(void);
-
-
-int yr_modules_do_declarations(
-    const char* module_name,
-    YR_OBJECT* main_structure);
-
-
-int yr_modules_load(
-    const char* module_name,
-    YR_SCAN_CONTEXT* context);
-
-
-int yr_modules_unload_all(
-    YR_SCAN_CONTEXT* context);
-
-
-void yr_modules_print_data(
-    YR_SCAN_CONTEXT* context);
-#endif
+/*
+Copyright (c) 2014. The YARA Authors. All Rights Reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+#ifndef YR_MODULES_H
+#define YR_MODULES_H
+
+#include <assert.h>
+#include <stdio.h>
+#include <string.h>
+#include <math.h>
+
+#include "utils.h"
+#include "limits.h"
+#include "error.h"
+#include "exec.h"
+#include "types.h"
+#include "object.h"
+#include "libyara.h"
+
+// Concatenation that macro-expands its arguments.
+
+#define CONCAT(arg1, arg2) YARA_CONCAT(arg1, arg2) // expands the arguments.
+#define YARA_CONCAT(arg1, arg2) arg1 ## arg2       // do the actual concatenation.
+
+
+#define module_declarations CONCAT(MODULE_NAME, __declarations)
+#define module_load CONCAT(MODULE_NAME, __load)
+#define module_unload CONCAT(MODULE_NAME, __unload)
+#define module_initialize CONCAT(MODULE_NAME, __initialize)
+#define module_finalize CONCAT(MODULE_NAME, __finalize)
+
+#define begin_declarations \
+    int module_declarations(YR_OBJECT* module) { \
+      YR_OBJECT* stack[64]; \
+      int stack_top = 0; \
+      stack[stack_top] = module;
+
+
+#define end_declarations \
+    return ERROR_SUCCESS; }
+
+
+#define begin_struct(name) { \
+    YR_OBJECT* structure; \
+    FAIL_ON_ERROR(yr_object_create( \
+        OBJECT_TYPE_STRUCTURE, \
+        name, \
+        stack[stack_top], \
+        &structure)); \
+    assertf( \
+        stack_top < sizeof(stack)/sizeof(stack[0]) - 1, \
+        "too many nested structures"); \
+    stack[++stack_top] = structure; \
+  }
+
+
+#define begin_struct_array(name) { \
+    YR_OBJECT* structure; \
+    YR_OBJECT* array; \
+    FAIL_ON_ERROR(yr_object_create( \
+        OBJECT_TYPE_ARRAY, \
+        name, \
+        stack[stack_top], \
+        &array)); \
+    FAIL_ON_ERROR(yr_object_create( \
+        OBJECT_TYPE_STRUCTURE, \
+        name, \
+        array, \
+        &structure)); \
+    assertf( \
+        stack_top < sizeof(stack)/sizeof(stack[0]) - 1, \
+        "too many nested structures"); \
+    stack[++stack_top] = structure; \
+  }
+
+
+#define begin_struct_dictionary(name) { \
+    YR_OBJECT* structure; \
+    YR_OBJECT* array; \
+    FAIL_ON_ERROR(yr_object_create( \
+        OBJECT_TYPE_DICTIONARY, \
+        name, \
+        stack[stack_top], \
+        &array)); \
+    FAIL_ON_ERROR(yr_object_create( \
+        OBJECT_TYPE_STRUCTURE, \
+        name, \
+        array, \
+        &structure)); \
+    assertf( \
+        stack_top < sizeof(stack)/sizeof(stack[0]) - 1, \
+        "too many nested structures"); \
+    stack[++stack_top] = structure; \
+  }
+
+
+#define end_struct(name) { \
+    assert(stack[stack_top]->type == OBJECT_TYPE_STRUCTURE); \
+    assertf( \
+        strcmp(stack[stack_top]->identifier, name) == 0, \
+        "unbalanced begin_struct/end_struct"); \
+    stack_top--; \
+  }
+
+
+#define end_struct_array(name) end_struct(name)
+
+
+#define end_struct_dictionary(name) end_struct(name)
+
+
+#define declare_integer(name) { \
+    FAIL_ON_ERROR(yr_object_create( \
+        OBJECT_TYPE_INTEGER, \
+        name, \
+        stack[stack_top], \
+        NULL)); \
+  }
+
+
+#define declare_integer_array(name) { \
+    YR_OBJECT* array; \
+    FAIL_ON_ERROR(yr_object_create( \
+        OBJECT_TYPE_ARRAY, \
+        name, \
+        stack[stack_top], \
+        &array)); \
+    FAIL_ON_ERROR(yr_object_create( \
+        OBJECT_TYPE_INTEGER, \
+        name, \
+        array, \
+        NULL)); \
+  }
+
+
+#define declare_integer_dictionary(name) { \
+    YR_OBJECT* dict; \
+    FAIL_ON_ERROR(yr_object_create( \
+        OBJECT_TYPE_DICTIONARY, \
+        name, \
+        stack[stack_top], \
+        &dict)); \
+    FAIL_ON_ERROR(yr_object_create( \
+        OBJECT_TYPE_INTEGER, \
+        name, \
+        dict, \
+        NULL)); \
+  }
+
+
+#define declare_float(name) { \
+    FAIL_ON_ERROR(yr_object_create( \
+        OBJECT_TYPE_FLOAT, \
+        name, \
+        stack[stack_top], \
+        NULL)); \
+  }
+
+
+#define declare_float_array(name) { \
+    YR_OBJECT* array; \
+    FAIL_ON_ERROR(yr_object_create( \
+        OBJECT_TYPE_ARRAY, \
+        name, \
+        stack[stack_top], \
+        &array)); \
+    FAIL_ON_ERROR(yr_object_create( \
+        OBJECT_TYPE_FLOAT, \
+        name, \
+        array, \
+        NULL)); \
+  }
+
+
+#define declare_float_dictionary(name) { \
+    YR_OBJECT* dict; \
+    FAIL_ON_ERROR(yr_object_create( \
+        OBJECT_TYPE_DICTIONARY, \
+        name, \
+        stack[stack_top], \
+        &dict)); \
+    FAIL_ON_ERROR(yr_object_create( \
+        OBJECT_TYPE_FLOAT, \
+        name, \
+        dict, \
+        NULL)); \
+  }
+
+
+#define declare_string(name) { \
+    FAIL_ON_ERROR(yr_object_create( \
+        OBJECT_TYPE_STRING, \
+        name, \
+        stack[stack_top], \
+        NULL)); \
+  }
+
+
+#define declare_string_array(name) { \
+    YR_OBJECT* array; \
+    FAIL_ON_ERROR(yr_object_create( \
+        OBJECT_TYPE_ARRAY, \
+        name, \
+        stack[stack_top], \
+        &array)); \
+    FAIL_ON_ERROR(yr_object_create( \
+        OBJECT_TYPE_STRING, \
+        name, \
+        array, \
+        NULL)); \
+  }
+
+
+#define declare_string_dictionary(name) { \
+    YR_OBJECT* dict; \
+    FAIL_ON_ERROR(yr_object_create( \
+        OBJECT_TYPE_DICTIONARY, \
+        name, \
+        stack[stack_top], \
+        &dict)); \
+    FAIL_ON_ERROR(yr_object_create( \
+        OBJECT_TYPE_STRING, \
+        name, \
+        dict, \
+        NULL)); \
+  }
+
+
+#define declare_function(name, args_fmt, ret_fmt, func) { \
+    YR_OBJECT* function; \
+    FAIL_ON_ERROR(yr_object_function_create( \
+        name, \
+        args_fmt, \
+        ret_fmt, \
+        func, \
+        stack[stack_top], \
+        &function)); \
+    }
+
+
+#define define_function(func) \
+    int func ( \
+        void* __args, \
+        YR_SCAN_CONTEXT* __context, \
+        YR_OBJECT_FUNCTION* __function_obj)
+
+
+#define sized_string_argument(n) \
+    ((SIZED_STRING*)(size_t)((int64_t*) __args)[n-1])
+
+#define string_argument(n) \
+    (sized_string_argument(n)->c_string)
+
+#define integer_argument(n) \
+    (((int64_t*) __args)[n-1])
+
+#define float_argument(n) \
+    (((double*) __args)[n-1])
+
+#define regexp_argument(n) \
+    ((RE_CODE)((int64_t*) __args)[n-1])
+
+
+#define module()        yr_object_get_root((YR_OBJECT*) __function_obj)
+#define parent()        (__function_obj->parent)
+#define scan_context()  (__context)
+
+
+#define foreach_memory_block(context, block) \
+  for (block = (context)->mem_block; \
+       block != NULL; \
+       block = block->next) \
+ 
+
+#define first_memory_block(context) \
+      (context)->mem_block
+
+
+#define is_undefined(object, ...) \
+    yr_object_has_undefined_value(object, __VA_ARGS__)
+
+
+#define get_object(object, ...) \
+    yr_object_lookup(object, 0, __VA_ARGS__)
+
+
+#define get_integer(object, ...) \
+    yr_object_get_integer(object, __VA_ARGS__)
+
+
+#define get_float(object, ...) \
+    yr_object_get_float(object, __VA_ARGS__)
+
+
+#define get_string(object, ...) \
+    yr_object_get_string(object, __VA_ARGS__)
+
+
+#define set_integer(value, object, ...) \
+    yr_object_set_integer(value, object, __VA_ARGS__)
+
+
+#define set_float(value, object, ...) \
+    yr_object_set_float(value, object, __VA_ARGS__)
+
+
+#define set_sized_string(value, len, object, ...) \
+    yr_object_set_string(value, len, object, __VA_ARGS__)
+
+
+#define set_string(value, object, ...) \
+    set_sized_string(value, strlen(value), object, __VA_ARGS__)
+
+
+#define return_integer(integer) { \
+      assertf( \
+          __function_obj->return_obj->type == OBJECT_TYPE_INTEGER, \
+          "return type differs from function declaration"); \
+      yr_object_set_integer( \
+          (integer), \
+          __function_obj->return_obj, \
+          NULL); \
+      return ERROR_SUCCESS; \
+    }
+
+
+#define return_float(double_) { \
+      double d = (double) (double_); \
+      assertf( \
+          __function_obj->return_obj->type == OBJECT_TYPE_FLOAT, \
+          "return type differs from function declaration"); \
+      yr_object_set_float( \
+          (d != (double) UNDEFINED) ? d : NAN, \
+          __function_obj->return_obj, \
+          NULL); \
+      return ERROR_SUCCESS; \
+    }
+
+
+#define return_string(string) { \
+      char* s = (char*) (string); \
+      assertf( \
+          __function_obj->return_obj->type == OBJECT_TYPE_STRING, \
+          "return type differs from function declaration"); \
+      yr_object_set_string( \
+          (s != (char*) UNDEFINED) ? s : NULL, \
+          (s != (char*) UNDEFINED) ? strlen(s) : 0, \
+          __function_obj->return_obj, \
+          NULL); \
+      return ERROR_SUCCESS; \
+    }
+
+
+struct _YR_MODULE;
+
+
+typedef int (*YR_EXT_INITIALIZE_FUNC)(
+    struct _YR_MODULE* module);
+
+
+typedef int (*YR_EXT_FINALIZE_FUNC)(
+    struct _YR_MODULE* module);
+
+
+typedef int (*YR_EXT_DECLARATIONS_FUNC)(
+    YR_OBJECT* module_object);
+
+
+typedef int (*YR_EXT_LOAD_FUNC)(
+    YR_SCAN_CONTEXT* context,
+    YR_OBJECT* module_object,
+    void* module_data,
+    size_t module_data_size);
+
+
+typedef int (*YR_EXT_UNLOAD_FUNC)(
+    YR_OBJECT* module_object);
+
+
+typedef struct _YR_MODULE
+{
+    char* name;
+
+    YR_EXT_DECLARATIONS_FUNC declarations;
+    YR_EXT_LOAD_FUNC load;
+    YR_EXT_UNLOAD_FUNC unload;
+    YR_EXT_INITIALIZE_FUNC initialize;
+    YR_EXT_FINALIZE_FUNC finalize;
+
+} YR_MODULE;
+
+
+typedef struct _YR_MODULE_IMPORT
+{
+    const char* module_name;
+    void* module_data;
+    size_t module_data_size;
+
+} YR_MODULE_IMPORT;
+
+
+int yr_modules_initialize(void);
+
+
+int yr_modules_finalize(void);
+
+
+int yr_modules_do_declarations(
+    const char* module_name,
+    YR_OBJECT* main_structure);
+
+
+int yr_modules_load(
+    const char* module_name,
+    YR_SCAN_CONTEXT* context);
+
+
+int yr_modules_unload_all(
+    YR_SCAN_CONTEXT* context);
+
+#endif

pluginsdk/yara/yara/object.h

@@ -1,156 +1,165 @@
-/*
-Copyright (c) 2014. The YARA Authors. All Rights Reserved.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-   http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-#ifndef YR_OBJECT_H
-#define YR_OBJECT_H
-
-#ifdef _MSC_VER
-#include <float.h>
-#define isnan _isnan
-//#define INFINITY (DBL_MAX + DBL_MAX)
-//#define NAN (INFINITY-INFINITY)
-#endif
-
-#include "types.h"
-
-
-#define OBJECT_CREATE           1
-
-#define OBJECT_TYPE_INTEGER     1
-#define OBJECT_TYPE_STRING      2
-#define OBJECT_TYPE_STRUCTURE   3
-#define OBJECT_TYPE_ARRAY       4
-#define OBJECT_TYPE_FUNCTION    5
-#define OBJECT_TYPE_REGEXP      6
-#define OBJECT_TYPE_DICTIONARY  7
-#define OBJECT_TYPE_FLOAT       8
-
-
-int yr_object_create(
-    int8_t type,
-    const char* identifier,
-    YR_OBJECT* parent,
-    YR_OBJECT** object);
-
-
-int yr_object_function_create(
-    const char* identifier,
-    const char* arguments_fmt,
-    const char* return_fmt,
-    YR_MODULE_FUNC func,
-    YR_OBJECT* parent,
-    YR_OBJECT** function);
-
-
-int yr_object_from_external_variable(
-    YR_EXTERNAL_VARIABLE* external,
-    YR_OBJECT** object);
-
-
-void yr_object_destroy(
-    YR_OBJECT* object);
-
-
-YR_OBJECT* yr_object_lookup_field(
-    YR_OBJECT* object,
-    const char* field_name);
-
-
-YR_OBJECT* yr_object_lookup(
-    YR_OBJECT* root,
-    int flags,
-    const char* pattern,
-    ...);
-
-
-int yr_object_has_undefined_value(
-    YR_OBJECT* object,
-    const char* field,
-    ...);
-
-int64_t yr_object_get_integer(
-    YR_OBJECT* object,
-    const char* field,
-    ...);
-
-
-SIZED_STRING* yr_object_get_string(
-    YR_OBJECT* object,
-    const char* field,
-    ...);
-
-
-int yr_object_set_integer(
-    int64_t value,
-    YR_OBJECT* object,
-    const char* field,
-    ...);
-
-
-int yr_object_set_float(
-    double value,
-    YR_OBJECT* object,
-    const char* field,
-    ...);
-
-
-int yr_object_set_string(
-    const char* value,
-    size_t len,
-    YR_OBJECT* object,
-    const char* field,
-    ...);
-
-
-YR_OBJECT* yr_object_array_get_item(
-    YR_OBJECT* object,
-    int flags,
-    int index);
-
-
-int yr_object_array_set_item(
-    YR_OBJECT* object,
-    YR_OBJECT* item,
-    int index);
-
-
-YR_OBJECT* yr_object_dict_get_item(
-    YR_OBJECT* object,
-    int flags,
-    const char* key);
-
-
-int yr_object_dict_set_item(
-    YR_OBJECT* object,
-    YR_OBJECT* item,
-    const char* key);
-
-
-int yr_object_structure_set_member(
-    YR_OBJECT* object,
-    YR_OBJECT* member);
-
-
-YR_OBJECT* yr_object_get_root(
-    YR_OBJECT* object);
-
-
-void yr_object_print_data(
-    YR_OBJECT* object,
-    int indent);
-
-
-#endif
+/*
+Copyright (c) 2014. The YARA Authors. All Rights Reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+#ifndef YR_OBJECT_H
+#define YR_OBJECT_H
+
+#ifdef _MSC_VER
+
+#include <float.h>
+#define isnan _isnan
+
+#ifndef INFINITY
+#define INFINITY (DBL_MAX + DBL_MAX)
+#endif
+
+#ifndef NAN
+#define NAN (INFINITY-INFINITY)
+#endif
+
+#endif
+
+#include "types.h"
+
+
+#define OBJECT_CREATE           1
+
+#define OBJECT_TYPE_INTEGER     1
+#define OBJECT_TYPE_STRING      2
+#define OBJECT_TYPE_STRUCTURE   3
+#define OBJECT_TYPE_ARRAY       4
+#define OBJECT_TYPE_FUNCTION    5
+#define OBJECT_TYPE_REGEXP      6
+#define OBJECT_TYPE_DICTIONARY  7
+#define OBJECT_TYPE_FLOAT       8
+
+
+int yr_object_create(
+    int8_t type,
+    const char* identifier,
+    YR_OBJECT* parent,
+    YR_OBJECT** object);
+
+
+int yr_object_function_create(
+    const char* identifier,
+    const char* arguments_fmt,
+    const char* return_fmt,
+    YR_MODULE_FUNC func,
+    YR_OBJECT* parent,
+    YR_OBJECT** function);
+
+
+int yr_object_from_external_variable(
+    YR_EXTERNAL_VARIABLE* external,
+    YR_OBJECT** object);
+
+
+void yr_object_destroy(
+    YR_OBJECT* object);
+
+
+YR_OBJECT* yr_object_lookup_field(
+    YR_OBJECT* object,
+    const char* field_name);
+
+
+YR_OBJECT* yr_object_lookup(
+    YR_OBJECT* root,
+    int flags,
+    const char* pattern,
+    ...);
+
+
+int yr_object_has_undefined_value(
+    YR_OBJECT* object,
+    const char* field,
+    ...);
+
+int64_t yr_object_get_integer(
+    YR_OBJECT* object,
+    const char* field,
+    ...);
+
+
+SIZED_STRING* yr_object_get_string(
+    YR_OBJECT* object,
+    const char* field,
+    ...);
+
+
+int yr_object_set_integer(
+    int64_t value,
+    YR_OBJECT* object,
+    const char* field,
+    ...);
+
+
+int yr_object_set_float(
+    double value,
+    YR_OBJECT* object,
+    const char* field,
+    ...);
+
+
+int yr_object_set_string(
+    const char* value,
+    size_t len,
+    YR_OBJECT* object,
+    const char* field,
+    ...);
+
+
+YR_OBJECT* yr_object_array_get_item(
+    YR_OBJECT* object,
+    int flags,
+    int index);
+
+
+int yr_object_array_set_item(
+    YR_OBJECT* object,
+    YR_OBJECT* item,
+    int index);
+
+
+YR_OBJECT* yr_object_dict_get_item(
+    YR_OBJECT* object,
+    int flags,
+    const char* key);
+
+
+int yr_object_dict_set_item(
+    YR_OBJECT* object,
+    YR_OBJECT* item,
+    const char* key);
+
+
+int yr_object_structure_set_member(
+    YR_OBJECT* object,
+    YR_OBJECT* member);
+
+
+YR_OBJECT* yr_object_get_root(
+    YR_OBJECT* object);
+
+
+YR_API void yr_object_print_data(
+    YR_OBJECT* object,
+    int indent,
+    int print_identifier);
+
+
+#endif

pluginsdk/yara/yara/parser.h

@@ -1,120 +1,125 @@
-/*
-Copyright (c) 2013. The YARA Authors. All Rights Reserved.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-   http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-#ifndef YR_PARSER_H
-#define YR_PARSER_H
-
-
-#include "lexer.h"
-
-
-int yr_parser_emit(
-    yyscan_t yyscanner,
-    int8_t instruction,
-    int8_t** instruction_address);
-
-
-int yr_parser_emit_with_arg(
-    yyscan_t yyscanner,
-    int8_t instruction,
-    int64_t argument,
-    int8_t** instruction_address);
-
-
-int yr_parser_emit_with_arg_double(
-    yyscan_t yyscanner,
-    int8_t instruction,
-    double argument,
-    int8_t** instruction_address);
-
-
-int yr_parser_emit_with_arg_reloc(
-    yyscan_t yyscanner,
-    int8_t instruction,
-    int64_t argument,
-    int8_t** instruction_address);
-
-
-int yr_parser_check_types(
-    YR_COMPILER* compiler,
-    YR_OBJECT_FUNCTION* function,
-    const char* actual_args_fmt);
-
-
-YR_STRING* yr_parser_lookup_string(
-    yyscan_t yyscanner,
-    const char* identifier);
-
-
-int yr_parser_lookup_loop_variable(
-    yyscan_t yyscanner,
-    const char* identifier);
-
-
-int yr_parser_reduce_rule_declaration(
-    yyscan_t yyscanner,
-    int flags,
-    const char* identifier,
-    char* tags,
-    YR_STRING* strings,
-    YR_META* metas);
-
-
-YR_STRING* yr_parser_reduce_string_declaration(
-    yyscan_t yyscanner,
-    int flags,
-    const char* identifier,
-    SIZED_STRING* str);
-
-
-YR_META* yr_parser_reduce_meta_declaration(
-    yyscan_t yyscanner,
-    int32_t type,
-    const char* identifier,
-    const char* string,
-    int32_t integer);
-
-
-int yr_parser_reduce_string_identifier(
-    yyscan_t yyscanner,
-    const char* identifier,
-    int8_t instruction,
-    uint64_t at_offset);
-
-
-int yr_parser_emit_pushes_for_strings(
-    yyscan_t yyscanner,
-    const char* identifier);
-
-
-int yr_parser_reduce_external(
-    yyscan_t yyscanner,
-    const char* identifier,
-    int8_t intruction);
-
-
-int yr_parser_reduce_import(
-    yyscan_t yyscanner,
-    SIZED_STRING* module_name);
-
-
-int yr_parser_reduce_operation(
-    yyscan_t yyscanner,
-    const char* operation,
-    EXPRESSION left_operand,
-    EXPRESSION right_operand);
-
-#endif
+/*
+Copyright (c) 2013. The YARA Authors. All Rights Reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+#ifndef YR_PARSER_H
+#define YR_PARSER_H
+
+
+#include "lexer.h"
+
+
+int yr_parser_emit(
+    yyscan_t yyscanner,
+    uint8_t instruction,
+    uint8_t** instruction_address);
+
+
+int yr_parser_emit_with_arg(
+    yyscan_t yyscanner,
+    uint8_t instruction,
+    int64_t argument,
+    uint8_t** instruction_address,
+    int64_t** argument_address);
+
+
+int yr_parser_emit_with_arg_double(
+    yyscan_t yyscanner,
+    uint8_t instruction,
+    double argument,
+    uint8_t** instruction_address,
+    double** argument_address);
+
+
+int yr_parser_emit_with_arg_reloc(
+    yyscan_t yyscanner,
+    uint8_t instruction,
+    int64_t argument,
+    uint8_t** instruction_address,
+    int64_t** argument_address);
+
+
+int yr_parser_check_types(
+    YR_COMPILER* compiler,
+    YR_OBJECT_FUNCTION* function,
+    const char* actual_args_fmt);
+
+
+YR_STRING* yr_parser_lookup_string(
+    yyscan_t yyscanner,
+    const char* identifier);
+
+
+int yr_parser_lookup_loop_variable(
+    yyscan_t yyscanner,
+    const char* identifier);
+
+
+YR_RULE* yr_parser_reduce_rule_declaration_phase_1(
+    yyscan_t yyscanner,
+    int32_t flags,
+    const char* identifier);
+
+
+int yr_parser_reduce_rule_declaration_phase_2(
+    yyscan_t yyscanner,
+    YR_RULE* rule);
+
+
+YR_STRING* yr_parser_reduce_string_declaration(
+    yyscan_t yyscanner,
+    int32_t flags,
+    const char* identifier,
+    SIZED_STRING* str);
+
+
+YR_META* yr_parser_reduce_meta_declaration(
+    yyscan_t yyscanner,
+    int32_t type,
+    const char* identifier,
+    const char* string,
+    int64_t integer);
+
+
+int yr_parser_reduce_string_identifier(
+    yyscan_t yyscanner,
+    const char* identifier,
+    uint8_t instruction,
+    uint64_t at_offset);
+
+
+int yr_parser_emit_pushes_for_strings(
+    yyscan_t yyscanner,
+    const char* identifier);
+
+
+int yr_parser_reduce_external(
+    yyscan_t yyscanner,
+    const char* identifier,
+    uint8_t intruction);
+
+
+int yr_parser_reduce_import(
+    yyscan_t yyscanner,
+    SIZED_STRING* module_name);
+
+
+int yr_parser_reduce_operation(
+    yyscan_t yyscanner,
+    const char* operation,
+    EXPRESSION left_operand,
+    EXPRESSION right_operand);
+
+#endif

pluginsdk/yara/yara/pe.h

@@ -1,491 +1,501 @@
-/*
-Copyright (c) 2013. The YARA Authors. All Rights Reserved.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-   http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-#pragma pack(push, 1)
-
-#ifdef _WIN32
-#include <windows.h>
-
-// These definitions are not present in older Windows headers.
-
-#ifndef IMAGE_FILE_MACHINE_ARMNT
-#define IMAGE_FILE_MACHINE_ARMNT             0x01c4
-#endif
-
-#ifndef IMAGE_FILE_MACHINE_ARM64
-#define IMAGE_FILE_MACHINE_ARM64             0xaa64
-#endif
-
-#else
-
-#include <stdint.h>
-#include <stdlib.h>
-
-typedef uint8_t   BYTE;
-typedef uint16_t  WORD;
-typedef uint32_t  DWORD;
-typedef int32_t   LONG;
-typedef uint32_t  ULONG;
-typedef uint64_t  ULONGLONG;
-
-
-#define FIELD_OFFSET(type, field)    ((size_t)&(((type *)0)->field))
-
-#ifndef _MAC
-
-#define IMAGE_DOS_SIGNATURE                 0x5A4D      // MZ
-#define IMAGE_OS2_SIGNATURE                 0x454E      // NE
-#define IMAGE_OS2_SIGNATURE_LE              0x454C      // LE
-#define IMAGE_VXD_SIGNATURE                 0x454C      // LE
-#define IMAGE_NT_SIGNATURE                  0x00004550  // PE00
-
-#else
-
-#define IMAGE_DOS_SIGNATURE                 0x4D5A      // MZ
-#define IMAGE_OS2_SIGNATURE                 0x4E45      // NE
-#define IMAGE_OS2_SIGNATURE_LE              0x4C45      // LE
-#define IMAGE_NT_SIGNATURE                  0x50450000  // PE00
-
-#endif
-
-#pragma pack(push, 2)
-
-typedef struct _IMAGE_DOS_HEADER        // DOS .EXE header
-{
-    WORD   e_magic;                     // Magic number
-    WORD   e_cblp;                      // Bytes on last page of file
-    WORD   e_cp;                        // Pages in file
-    WORD   e_crlc;                      // Relocations
-    WORD   e_cparhdr;                   // Size of header in paragraphs
-    WORD   e_minalloc;                  // Minimum extra paragraphs needed
-    WORD   e_maxalloc;                  // Maximum extra paragraphs needed
-    WORD   e_ss;                        // Initial (relative) SS value
-    WORD   e_sp;                        // Initial SP value
-    WORD   e_csum;                      // Checksum
-    WORD   e_ip;                        // Initial IP value
-    WORD   e_cs;                        // Initial (relative) CS value
-    WORD   e_lfarlc;                    // File address of relocation table
-    WORD   e_ovno;                      // Overlay number
-    WORD   e_res[4];                    // Reserved words
-    WORD   e_oemid;                     // OEM identifier (for e_oeminfo)
-    WORD   e_oeminfo;                   // OEM information; e_oemid specific
-    WORD   e_res2[10];                  // Reserved words
-    LONG   e_lfanew;                    // File address of new exe header
-} IMAGE_DOS_HEADER, *PIMAGE_DOS_HEADER;
-
-#pragma pack(pop)
-
-//
-// File header format.
-//
-
-#pragma pack(push,4)
-
-typedef struct _IMAGE_FILE_HEADER
-{
-    WORD    Machine;
-    WORD    NumberOfSections;
-    DWORD   TimeDateStamp;
-    DWORD   PointerToSymbolTable;
-    DWORD   NumberOfSymbols;
-    WORD    SizeOfOptionalHeader;
-    WORD    Characteristics;
-} IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER;
-
-
-
-#define IMAGE_SIZEOF_FILE_HEADER             20
-
-
-#define IMAGE_FILE_RELOCS_STRIPPED           0x0001  // Relocation info stripped from file.
-#define IMAGE_FILE_EXECUTABLE_IMAGE          0x0002  // File is executable  (i.e. no unresolved externel references).
-#define IMAGE_FILE_LINE_NUMS_STRIPPED        0x0004  // Line nunbers stripped from file.
-#define IMAGE_FILE_LOCAL_SYMS_STRIPPED       0x0008  // Local symbols stripped from file.
-#define IMAGE_FILE_AGGRESIVE_WS_TRIM         0x0010  // Agressively trim working set
-#define IMAGE_FILE_LARGE_ADDRESS_AWARE       0x0020  // App can handle >2gb addresses
-#define IMAGE_FILE_BYTES_REVERSED_LO         0x0080  // Bytes of machine word are reversed.
-#define IMAGE_FILE_32BIT_MACHINE             0x0100  // 32 bit word machine.
-#define IMAGE_FILE_DEBUG_STRIPPED            0x0200  // Debugging info stripped from file in .DBG file
-#define IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP   0x0400  // If Image is on removable media, copy and run from the swap file.
-#define IMAGE_FILE_NET_RUN_FROM_SWAP         0x0800  // If Image is on Net, copy and run from the swap file.
-#define IMAGE_FILE_SYSTEM                    0x1000  // System File.
-#define IMAGE_FILE_DLL                       0x2000  // File is a DLL.
-#define IMAGE_FILE_UP_SYSTEM_ONLY            0x4000  // File should only be run on a UP machine
-#define IMAGE_FILE_BYTES_REVERSED_HI         0x8000  // Bytes of machine word are reversed.
-
-
-#define IMAGE_FILE_MACHINE_UNKNOWN           0x0000
-#define IMAGE_FILE_MACHINE_AM33              0x01d3
-#define IMAGE_FILE_MACHINE_AMD64             0x8664
-#define IMAGE_FILE_MACHINE_ARM               0x01c0
-#define IMAGE_FILE_MACHINE_ARMNT             0x01c4
-#define IMAGE_FILE_MACHINE_ARM64             0xaa64
-#define IMAGE_FILE_MACHINE_EBC               0x0ebc
-#define IMAGE_FILE_MACHINE_I386              0x014c
-#define IMAGE_FILE_MACHINE_IA64              0x0200
-#define IMAGE_FILE_MACHINE_M32R              0x9041
-#define IMAGE_FILE_MACHINE_MIPS16            0x0266
-#define IMAGE_FILE_MACHINE_MIPSFPU           0x0366
-#define IMAGE_FILE_MACHINE_MIPSFPU16         0x0466
-#define IMAGE_FILE_MACHINE_POWERPC           0x01f0
-#define IMAGE_FILE_MACHINE_POWERPCFP         0x01f1
-#define IMAGE_FILE_MACHINE_R4000             0x0166
-#define IMAGE_FILE_MACHINE_SH3               0x01a2
-#define IMAGE_FILE_MACHINE_SH3DSP            0x01a3
-#define IMAGE_FILE_MACHINE_SH4               0x01a6
-#define IMAGE_FILE_MACHINE_SH5               0x01a8
-#define IMAGE_FILE_MACHINE_THUMB             0x01c2
-#define IMAGE_FILE_MACHINE_WCEMIPSV2         0x0169
-
-// Section characteristics
-#define IMAGE_SCN_CNT_CODE                   0x00000020
-#define IMAGE_SCN_CNT_INITIALIZED_DATA       0x00000040
-#define IMAGE_SCN_CNT_UNINITIALIZED_DATA     0x00000080
-#define IMAGE_SCN_GPREL                      0x00008000
-#define IMAGE_SCN_MEM_16BIT                  0x00020000
-#define IMAGE_SCN_LNK_NRELOC_OVFL            0x01000000
-#define IMAGE_SCN_MEM_DISCARDABLE            0x02000000
-#define IMAGE_SCN_MEM_NOT_CACHED             0x04000000
-#define IMAGE_SCN_MEM_NOT_PAGED              0x08000000
-#define IMAGE_SCN_MEM_SHARED                 0x10000000
-#define IMAGE_SCN_MEM_EXECUTE                0x20000000
-#define IMAGE_SCN_MEM_READ                   0x40000000
-#define IMAGE_SCN_MEM_WRITE                  0x80000000
-
-//
-// Directory format.
-//
-
-typedef struct _IMAGE_DATA_DIRECTORY
-{
-    DWORD   VirtualAddress;
-    DWORD   Size;
-} IMAGE_DATA_DIRECTORY, *PIMAGE_DATA_DIRECTORY;
-
-#define IMAGE_NUMBEROF_DIRECTORY_ENTRIES    16
-
-
-#define IMAGE_DIRECTORY_ENTRY_EXPORT          0   // Export Directory
-#define IMAGE_DIRECTORY_ENTRY_IMPORT          1   // Import Directory
-#define IMAGE_DIRECTORY_ENTRY_RESOURCE        2   // Resource Directory
-#define IMAGE_DIRECTORY_ENTRY_EXCEPTION       3   // Exception Directory
-#define IMAGE_DIRECTORY_ENTRY_SECURITY        4   // Security Directory
-#define IMAGE_DIRECTORY_ENTRY_BASERELOC       5   // Base Relocation Table
-#define IMAGE_DIRECTORY_ENTRY_DEBUG           6   // Debug Directory
-#define IMAGE_DIRECTORY_ENTRY_COPYRIGHT       7   // (X86 usage)
-#define IMAGE_DIRECTORY_ENTRY_ARCHITECTURE    7   // Architecture Specific Data
-#define IMAGE_DIRECTORY_ENTRY_GLOBALPTR       8   // RVA of GP
-#define IMAGE_DIRECTORY_ENTRY_TLS             9   // TLS Directory
-#define IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG    10   // Load Configuration Directory
-#define IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT   11   // Bound Import Directory in headers
-#define IMAGE_DIRECTORY_ENTRY_IAT            12   // Import Address Table
-#define IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT   13   // Delay Load Import Descriptors
-#define IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 14   // COM Runtime descriptor
-
-
-//
-// Optional header format.
-//
-
-typedef struct _IMAGE_OPTIONAL_HEADER32
-{
-    WORD Magic;
-    BYTE MajorLinkerVersion;
-    BYTE MinorLinkerVersion;
-    DWORD SizeOfCode;
-    DWORD SizeOfInitializedData;
-    DWORD SizeOfUninitializedData;
-    DWORD AddressOfEntryPoint;
-    DWORD BaseOfCode;
-    DWORD BaseOfData;
-    DWORD ImageBase;
-    DWORD SectionAlignment;
-    DWORD FileAlignment;
-    WORD MajorOperatingSystemVersion;
-    WORD MinorOperatingSystemVersion;
-    WORD MajorImageVersion;
-    WORD MinorImageVersion;
-    WORD MajorSubsystemVersion;
-    WORD MinorSubsystemVersion;
-    DWORD Win32VersionValue;
-    DWORD SizeOfImage;
-    DWORD SizeOfHeaders;
-    DWORD CheckSum;
-    WORD Subsystem;
-    WORD DllCharacteristics;
-    DWORD SizeOfStackReserve;
-    DWORD SizeOfStackCommit;
-    DWORD SizeOfHeapReserve;
-    DWORD SizeOfHeapCommit;
-    DWORD LoaderFlags;
-    DWORD NumberOfRvaAndSizes;
-    IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
-
-} IMAGE_OPTIONAL_HEADER32, *PIMAGE_OPTIONAL_HEADER32;
-
-
-typedef struct _IMAGE_OPTIONAL_HEADER64
-{
-    WORD Magic;
-    BYTE MajorLinkerVersion;
-    BYTE MinorLinkerVersion;
-    DWORD SizeOfCode;
-    DWORD SizeOfInitializedData;
-    DWORD SizeOfUninitializedData;
-    DWORD AddressOfEntryPoint;
-    DWORD BaseOfCode;
-    ULONGLONG ImageBase;
-    DWORD SectionAlignment;
-    DWORD FileAlignment;
-    WORD MajorOperatingSystemVersion;
-    WORD MinorOperatingSystemVersion;
-    WORD MajorImageVersion;
-    WORD MinorImageVersion;
-    WORD MajorSubsystemVersion;
-    WORD MinorSubsystemVersion;
-    DWORD Win32VersionValue;
-    DWORD SizeOfImage;
-    DWORD SizeOfHeaders;
-    DWORD CheckSum;
-    WORD Subsystem;
-    WORD DllCharacteristics;
-    ULONGLONG SizeOfStackReserve;
-    ULONGLONG SizeOfStackCommit;
-    ULONGLONG SizeOfHeapReserve;
-    ULONGLONG SizeOfHeapCommit;
-    DWORD LoaderFlags;
-    DWORD NumberOfRvaAndSizes;
-    IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
-
-} IMAGE_OPTIONAL_HEADER64, *PIMAGE_OPTIONAL_HEADER64;
-
-
-#define IMAGE_NT_OPTIONAL_HDR32_MAGIC      0x10b
-#define IMAGE_NT_OPTIONAL_HDR64_MAGIC      0x20b
-
-
-typedef struct _IMAGE_NT_HEADERS32
-{
-    DWORD Signature;
-    IMAGE_FILE_HEADER FileHeader;
-    IMAGE_OPTIONAL_HEADER32 OptionalHeader;
-
-} IMAGE_NT_HEADERS32, *PIMAGE_NT_HEADERS32;
-
-
-typedef struct _IMAGE_NT_HEADERS64
-{
-    DWORD Signature;
-    IMAGE_FILE_HEADER FileHeader;
-    IMAGE_OPTIONAL_HEADER64 OptionalHeader;
-
-} IMAGE_NT_HEADERS64, *PIMAGE_NT_HEADERS64;
-
-
-// IMAGE_FIRST_SECTION doesn't need 32/64 versions since the file header is
-// the same either way.
-
-#define IMAGE_FIRST_SECTION( ntheader ) ((PIMAGE_SECTION_HEADER) \
-    ((BYTE*)ntheader + \
-     FIELD_OFFSET( IMAGE_NT_HEADERS32, OptionalHeader ) + \
-     ((PIMAGE_NT_HEADERS32)(ntheader))->FileHeader.SizeOfOptionalHeader \
-    ))
-
-// Subsystem Values
-
-#define IMAGE_SUBSYSTEM_UNKNOWN              0   // Unknown subsystem.
-#define IMAGE_SUBSYSTEM_NATIVE               1   // Image doesn't require a subsystem.
-#define IMAGE_SUBSYSTEM_WINDOWS_GUI          2   // Image runs in the Windows GUI subsystem.
-#define IMAGE_SUBSYSTEM_WINDOWS_CUI          3   // Image runs in the Windows character subsystem.
-#define IMAGE_SUBSYSTEM_OS2_CUI              5   // image runs in the OS/2 character subsystem.
-#define IMAGE_SUBSYSTEM_POSIX_CUI            7   // image runs in the Posix character subsystem.
-#define IMAGE_SUBSYSTEM_NATIVE_WINDOWS       8   // image is a native Win9x driver.
-
-//
-// Section header format.
-//
-
-#define IMAGE_SIZEOF_SHORT_NAME              8
-
-typedef struct _IMAGE_SECTION_HEADER
-{
-    BYTE    Name[IMAGE_SIZEOF_SHORT_NAME];
-    union
-    {
-        DWORD   PhysicalAddress;
-        DWORD   VirtualSize;
-    } Misc;
-    DWORD   VirtualAddress;
-    DWORD   SizeOfRawData;
-    DWORD   PointerToRawData;
-    DWORD   PointerToRelocations;
-    DWORD   PointerToLinenumbers;
-    WORD    NumberOfRelocations;
-    WORD    NumberOfLinenumbers;
-    DWORD   Characteristics;
-
-} IMAGE_SECTION_HEADER, *PIMAGE_SECTION_HEADER;
-
-#define IMAGE_SIZEOF_SECTION_HEADER          40
-
-
-typedef struct _IMAGE_EXPORT_DIRECTORY
-{
-    DWORD Characteristics;
-    DWORD TimeDateStamp;
-    WORD  MajorVersion;
-    WORD  MinorVersion;
-    DWORD Name;
-    DWORD Base;
-    DWORD NumberOfFunctions;
-    DWORD NumberOfNames;
-    DWORD AddressOfFunctions;
-    DWORD AddressOfNames;
-    DWORD AddressOfNameOrdinals;
-} IMAGE_EXPORT_DIRECTORY, *PIMAGE_EXPORT_DIRECTORY;
-
-
-typedef struct _IMAGE_IMPORT_DESCRIPTOR
-{
-    union
-    {
-        DWORD Characteristics;
-        DWORD OriginalFirstThunk;
-    } ;
-    DWORD TimeDateStamp;
-    DWORD ForwarderChain;
-    DWORD Name;
-    DWORD FirstThunk;
-
-} IMAGE_IMPORT_DESCRIPTOR, *PIMAGE_IMPORT_DESCRIPTOR;
-
-
-typedef struct _IMAGE_IMPORT_BY_NAME
-{
-    WORD Hint;
-    BYTE Name[1];
-
-} IMAGE_IMPORT_BY_NAME, *PIMAGE_IMPORT_BY_NAME;
-
-typedef struct _IMAGE_THUNK_DATA32
-{
-    union
-    {
-        DWORD ForwarderString;
-        DWORD Function;
-        DWORD Ordinal;
-        DWORD AddressOfData;
-    } u1;
-
-} IMAGE_THUNK_DATA32, *PIMAGE_THUNK_DATA32;
-
-
-#define IMAGE_ORDINAL_FLAG32  0x80000000
-#define IMAGE_ORDINAL_FLAG64  0x8000000000000000L
-
-typedef struct _IMAGE_THUNK_DATA64
-{
-    union
-    {
-        ULONGLONG ForwarderString;
-        ULONGLONG Function;
-        ULONGLONG Ordinal;
-        ULONGLONG AddressOfData;
-    } u1;
-
-} IMAGE_THUNK_DATA64, *PIMAGE_THUNK_DATA64;
-
-
-typedef struct _IMAGE_RESOURCE_DIRECTORY_ENTRY
-{
-    DWORD Name;
-    DWORD OffsetToData;
-} IMAGE_RESOURCE_DIRECTORY_ENTRY, *PIMAGE_RESOURCE_DIRECTORY_ENTRY;
-
-
-typedef struct _IMAGE_RESOURCE_DATA_ENTRY
-{
-    DWORD OffsetToData;
-    DWORD Size;
-    DWORD CodePage;
-    DWORD Reserved;
-} IMAGE_RESOURCE_DATA_ENTRY, *PIMAGE_RESOURCE_DATA_ENTRY;
-
-
-typedef struct _IMAGE_RESOURCE_DIRECTORY
-{
-    DWORD Characteristics;
-    DWORD TimeDateStamp;
-    WORD  MajorVersion;
-    WORD  MinorVersion;
-    WORD  NumberOfNamedEntries;
-    WORD  NumberOfIdEntries;
-} IMAGE_RESOURCE_DIRECTORY, *PIMAGE_RESOURCE_DIRECTORY;
-
-#pragma pack(pop)
-
-#endif  // _WIN32
-
-typedef struct _VERSION_INFO
-{
-    WORD   Length;
-    WORD   ValueLength;
-    WORD   Type;
-    char   Key[0];
-} VERSION_INFO, *PVERSION_INFO;
-
-
-#define WIN_CERT_REVISION_1_0 0x0100
-#define WIN_CERT_REVISION_2_0 0x0200
-
-#define WIN_CERT_TYPE_X509             0x0001
-#define WIN_CERT_TYPE_PKCS_SIGNED_DATA 0x0002
-#define WIN_CERT_TYPE_RESERVED_1       0x0003
-#define WIN_CERT_TYPE_TS_STACK_SIGNED  0x0004
-
-typedef struct _WIN_CERTIFICATE
-{
-    DWORD Length;
-    WORD  Revision;
-    WORD  CertificateType;
-    BYTE  Certificate[1];
-} WIN_CERTIFICATE, *PWIN_CERTIFICATE;
-
-
-//
-// Rich signature.
-// http://www.ntcore.com/files/richsign.htm
-//
-
-typedef struct _RICH_SIGNATURE
-{
-    DWORD dans;
-    DWORD key1;
-    DWORD key2;
-    DWORD key3;
-} RICH_SIGNATURE, *PRICH_SIGNATURE;
-
-#define RICH_DANS 0x536e6144 // "DanS"
-#define RICH_RICH 0x68636952 // "Rich"
-
-typedef struct _RICH_DATA
-{
-    size_t len;
-    BYTE* raw_data;
-    BYTE* clear_data;
-} RICH_DATA, *PRICH_DATA;
-
-#pragma pack(pop)
+/*
+Copyright (c) 2013. The YARA Authors. All Rights Reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+#pragma pack(push, 1)
+
+#if defined(_WIN32) || defined(__CYGWIN__)
+#include <windows.h>
+
+// These definitions are not present in older Windows headers.
+
+#ifndef IMAGE_FILE_MACHINE_ARMNT
+#define IMAGE_FILE_MACHINE_ARMNT             0x01c4
+#endif
+
+#ifndef IMAGE_FILE_MACHINE_ARM64
+#define IMAGE_FILE_MACHINE_ARM64             0xaa64
+#endif
+
+#else
+
+#include <stdint.h>
+#include <stdlib.h>
+
+typedef uint8_t   BYTE;
+typedef uint16_t  WORD;
+typedef uint32_t  DWORD;
+typedef int32_t   LONG;
+typedef uint32_t  ULONG;
+typedef uint64_t  ULONGLONG;
+
+
+#define FIELD_OFFSET(type, field)    ((size_t)&(((type *)0)->field))
+
+#ifndef _MAC
+
+#define IMAGE_DOS_SIGNATURE                 0x5A4D      // MZ
+#define IMAGE_OS2_SIGNATURE                 0x454E      // NE
+#define IMAGE_OS2_SIGNATURE_LE              0x454C      // LE
+#define IMAGE_VXD_SIGNATURE                 0x454C      // LE
+#define IMAGE_NT_SIGNATURE                  0x00004550  // PE00
+
+#else
+
+#define IMAGE_DOS_SIGNATURE                 0x4D5A      // MZ
+#define IMAGE_OS2_SIGNATURE                 0x4E45      // NE
+#define IMAGE_OS2_SIGNATURE_LE              0x4C45      // LE
+#define IMAGE_NT_SIGNATURE                  0x50450000  // PE00
+
+#endif
+
+#pragma pack(push, 2)
+
+typedef struct _IMAGE_DOS_HEADER        // DOS .EXE header
+{
+    WORD   e_magic;                     // Magic number
+    WORD   e_cblp;                      // Bytes on last page of file
+    WORD   e_cp;                        // Pages in file
+    WORD   e_crlc;                      // Relocations
+    WORD   e_cparhdr;                   // Size of header in paragraphs
+    WORD   e_minalloc;                  // Minimum extra paragraphs needed
+    WORD   e_maxalloc;                  // Maximum extra paragraphs needed
+    WORD   e_ss;                        // Initial (relative) SS value
+    WORD   e_sp;                        // Initial SP value
+    WORD   e_csum;                      // Checksum
+    WORD   e_ip;                        // Initial IP value
+    WORD   e_cs;                        // Initial (relative) CS value
+    WORD   e_lfarlc;                    // File address of relocation table
+    WORD   e_ovno;                      // Overlay number
+    WORD   e_res[4];                    // Reserved words
+    WORD   e_oemid;                     // OEM identifier (for e_oeminfo)
+    WORD   e_oeminfo;                   // OEM information; e_oemid specific
+    WORD   e_res2[10];                  // Reserved words
+    LONG   e_lfanew;                    // File address of new exe header
+} IMAGE_DOS_HEADER, *PIMAGE_DOS_HEADER;
+
+#pragma pack(pop)
+
+//
+// File header format.
+//
+
+#pragma pack(push,4)
+
+typedef struct _IMAGE_FILE_HEADER
+{
+    WORD    Machine;
+    WORD    NumberOfSections;
+    DWORD   TimeDateStamp;
+    DWORD   PointerToSymbolTable;
+    DWORD   NumberOfSymbols;
+    WORD    SizeOfOptionalHeader;
+    WORD    Characteristics;
+} IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER;
+
+
+
+#define IMAGE_SIZEOF_FILE_HEADER             20
+
+
+#define IMAGE_FILE_RELOCS_STRIPPED           0x0001  // Relocation info stripped from file.
+#define IMAGE_FILE_EXECUTABLE_IMAGE          0x0002  // File is executable  (i.e. no unresolved externel references).
+#define IMAGE_FILE_LINE_NUMS_STRIPPED        0x0004  // Line nunbers stripped from file.
+#define IMAGE_FILE_LOCAL_SYMS_STRIPPED       0x0008  // Local symbols stripped from file.
+#define IMAGE_FILE_AGGRESIVE_WS_TRIM         0x0010  // Agressively trim working set
+#define IMAGE_FILE_LARGE_ADDRESS_AWARE       0x0020  // App can handle >2gb addresses
+#define IMAGE_FILE_BYTES_REVERSED_LO         0x0080  // Bytes of machine word are reversed.
+#define IMAGE_FILE_32BIT_MACHINE             0x0100  // 32 bit word machine.
+#define IMAGE_FILE_DEBUG_STRIPPED            0x0200  // Debugging info stripped from file in .DBG file
+#define IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP   0x0400  // If Image is on removable media, copy and run from the swap file.
+#define IMAGE_FILE_NET_RUN_FROM_SWAP         0x0800  // If Image is on Net, copy and run from the swap file.
+#define IMAGE_FILE_SYSTEM                    0x1000  // System File.
+#define IMAGE_FILE_DLL                       0x2000  // File is a DLL.
+#define IMAGE_FILE_UP_SYSTEM_ONLY            0x4000  // File should only be run on a UP machine
+#define IMAGE_FILE_BYTES_REVERSED_HI         0x8000  // Bytes of machine word are reversed.
+
+
+#define IMAGE_FILE_MACHINE_UNKNOWN           0x0000
+#define IMAGE_FILE_MACHINE_AM33              0x01d3
+#define IMAGE_FILE_MACHINE_AMD64             0x8664
+#define IMAGE_FILE_MACHINE_ARM               0x01c0
+#define IMAGE_FILE_MACHINE_ARMNT             0x01c4
+#define IMAGE_FILE_MACHINE_ARM64             0xaa64
+#define IMAGE_FILE_MACHINE_EBC               0x0ebc
+#define IMAGE_FILE_MACHINE_I386              0x014c
+#define IMAGE_FILE_MACHINE_IA64              0x0200
+#define IMAGE_FILE_MACHINE_M32R              0x9041
+#define IMAGE_FILE_MACHINE_MIPS16            0x0266
+#define IMAGE_FILE_MACHINE_MIPSFPU           0x0366
+#define IMAGE_FILE_MACHINE_MIPSFPU16         0x0466
+#define IMAGE_FILE_MACHINE_POWERPC           0x01f0
+#define IMAGE_FILE_MACHINE_POWERPCFP         0x01f1
+#define IMAGE_FILE_MACHINE_R4000             0x0166
+#define IMAGE_FILE_MACHINE_SH3               0x01a2
+#define IMAGE_FILE_MACHINE_SH3DSP            0x01a3
+#define IMAGE_FILE_MACHINE_SH4               0x01a6
+#define IMAGE_FILE_MACHINE_SH5               0x01a8
+#define IMAGE_FILE_MACHINE_THUMB             0x01c2
+#define IMAGE_FILE_MACHINE_WCEMIPSV2         0x0169
+
+// Section characteristics
+#define IMAGE_SCN_CNT_CODE                   0x00000020
+#define IMAGE_SCN_CNT_INITIALIZED_DATA       0x00000040
+#define IMAGE_SCN_CNT_UNINITIALIZED_DATA     0x00000080
+#define IMAGE_SCN_GPREL                      0x00008000
+#define IMAGE_SCN_MEM_16BIT                  0x00020000
+#define IMAGE_SCN_LNK_NRELOC_OVFL            0x01000000
+#define IMAGE_SCN_MEM_DISCARDABLE            0x02000000
+#define IMAGE_SCN_MEM_NOT_CACHED             0x04000000
+#define IMAGE_SCN_MEM_NOT_PAGED              0x08000000
+#define IMAGE_SCN_MEM_SHARED                 0x10000000
+#define IMAGE_SCN_MEM_EXECUTE                0x20000000
+#define IMAGE_SCN_MEM_READ                   0x40000000
+#define IMAGE_SCN_MEM_WRITE                  0x80000000
+
+//
+// Directory format.
+//
+
+typedef struct _IMAGE_DATA_DIRECTORY
+{
+    DWORD   VirtualAddress;
+    DWORD   Size;
+} IMAGE_DATA_DIRECTORY, *PIMAGE_DATA_DIRECTORY;
+
+#define IMAGE_NUMBEROF_DIRECTORY_ENTRIES    16
+
+
+#define IMAGE_DIRECTORY_ENTRY_EXPORT          0   // Export Directory
+#define IMAGE_DIRECTORY_ENTRY_IMPORT          1   // Import Directory
+#define IMAGE_DIRECTORY_ENTRY_RESOURCE        2   // Resource Directory
+#define IMAGE_DIRECTORY_ENTRY_EXCEPTION       3   // Exception Directory
+#define IMAGE_DIRECTORY_ENTRY_SECURITY        4   // Security Directory
+#define IMAGE_DIRECTORY_ENTRY_BASERELOC       5   // Base Relocation Table
+#define IMAGE_DIRECTORY_ENTRY_DEBUG           6   // Debug Directory
+#define IMAGE_DIRECTORY_ENTRY_COPYRIGHT       7   // (X86 usage)
+#define IMAGE_DIRECTORY_ENTRY_ARCHITECTURE    7   // Architecture Specific Data
+#define IMAGE_DIRECTORY_ENTRY_GLOBALPTR       8   // RVA of GP
+#define IMAGE_DIRECTORY_ENTRY_TLS             9   // TLS Directory
+#define IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG    10   // Load Configuration Directory
+#define IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT   11   // Bound Import Directory in headers
+#define IMAGE_DIRECTORY_ENTRY_IAT            12   // Import Address Table
+#define IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT   13   // Delay Load Import Descriptors
+#define IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 14   // COM Runtime descriptor
+
+
+//
+// Optional header format.
+//
+
+typedef struct _IMAGE_OPTIONAL_HEADER32
+{
+    WORD Magic;
+    BYTE MajorLinkerVersion;
+    BYTE MinorLinkerVersion;
+    DWORD SizeOfCode;
+    DWORD SizeOfInitializedData;
+    DWORD SizeOfUninitializedData;
+    DWORD AddressOfEntryPoint;
+    DWORD BaseOfCode;
+    DWORD BaseOfData;
+    DWORD ImageBase;
+    DWORD SectionAlignment;
+    DWORD FileAlignment;
+    WORD MajorOperatingSystemVersion;
+    WORD MinorOperatingSystemVersion;
+    WORD MajorImageVersion;
+    WORD MinorImageVersion;
+    WORD MajorSubsystemVersion;
+    WORD MinorSubsystemVersion;
+    DWORD Win32VersionValue;
+    DWORD SizeOfImage;
+    DWORD SizeOfHeaders;
+    DWORD CheckSum;
+    WORD Subsystem;
+    WORD DllCharacteristics;
+    DWORD SizeOfStackReserve;
+    DWORD SizeOfStackCommit;
+    DWORD SizeOfHeapReserve;
+    DWORD SizeOfHeapCommit;
+    DWORD LoaderFlags;
+    DWORD NumberOfRvaAndSizes;
+    IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
+
+} IMAGE_OPTIONAL_HEADER32, *PIMAGE_OPTIONAL_HEADER32;
+
+
+typedef struct _IMAGE_OPTIONAL_HEADER64
+{
+    WORD Magic;
+    BYTE MajorLinkerVersion;
+    BYTE MinorLinkerVersion;
+    DWORD SizeOfCode;
+    DWORD SizeOfInitializedData;
+    DWORD SizeOfUninitializedData;
+    DWORD AddressOfEntryPoint;
+    DWORD BaseOfCode;
+    ULONGLONG ImageBase;
+    DWORD SectionAlignment;
+    DWORD FileAlignment;
+    WORD MajorOperatingSystemVersion;
+    WORD MinorOperatingSystemVersion;
+    WORD MajorImageVersion;
+    WORD MinorImageVersion;
+    WORD MajorSubsystemVersion;
+    WORD MinorSubsystemVersion;
+    DWORD Win32VersionValue;
+    DWORD SizeOfImage;
+    DWORD SizeOfHeaders;
+    DWORD CheckSum;
+    WORD Subsystem;
+    WORD DllCharacteristics;
+    ULONGLONG SizeOfStackReserve;
+    ULONGLONG SizeOfStackCommit;
+    ULONGLONG SizeOfHeapReserve;
+    ULONGLONG SizeOfHeapCommit;
+    DWORD LoaderFlags;
+    DWORD NumberOfRvaAndSizes;
+    IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
+
+} IMAGE_OPTIONAL_HEADER64, *PIMAGE_OPTIONAL_HEADER64;
+
+
+#define IMAGE_NT_OPTIONAL_HDR32_MAGIC      0x10b
+#define IMAGE_NT_OPTIONAL_HDR64_MAGIC      0x20b
+
+
+typedef struct _IMAGE_NT_HEADERS32
+{
+    DWORD Signature;
+    IMAGE_FILE_HEADER FileHeader;
+    IMAGE_OPTIONAL_HEADER32 OptionalHeader;
+
+} IMAGE_NT_HEADERS32, *PIMAGE_NT_HEADERS32;
+
+
+typedef struct _IMAGE_NT_HEADERS64
+{
+    DWORD Signature;
+    IMAGE_FILE_HEADER FileHeader;
+    IMAGE_OPTIONAL_HEADER64 OptionalHeader;
+
+} IMAGE_NT_HEADERS64, *PIMAGE_NT_HEADERS64;
+
+
+// IMAGE_FIRST_SECTION doesn't need 32/64 versions since the file header is
+// the same either way.
+
+#define IMAGE_FIRST_SECTION( ntheader ) ((PIMAGE_SECTION_HEADER) \
+    ((BYTE*)ntheader + \
+     FIELD_OFFSET( IMAGE_NT_HEADERS32, OptionalHeader ) + \
+     ((PIMAGE_NT_HEADERS32)(ntheader))->FileHeader.SizeOfOptionalHeader \
+    ))
+
+// Subsystem Values
+
+#define IMAGE_SUBSYSTEM_UNKNOWN              0   // Unknown subsystem.
+#define IMAGE_SUBSYSTEM_NATIVE               1   // Image doesn't require a subsystem.
+#define IMAGE_SUBSYSTEM_WINDOWS_GUI          2   // Image runs in the Windows GUI subsystem.
+#define IMAGE_SUBSYSTEM_WINDOWS_CUI          3   // Image runs in the Windows character subsystem.
+#define IMAGE_SUBSYSTEM_OS2_CUI              5   // image runs in the OS/2 character subsystem.
+#define IMAGE_SUBSYSTEM_POSIX_CUI            7   // image runs in the Posix character subsystem.
+#define IMAGE_SUBSYSTEM_NATIVE_WINDOWS       8   // image is a native Win9x driver.
+
+//
+// Section header format.
+//
+
+#define IMAGE_SIZEOF_SHORT_NAME              8
+
+typedef struct _IMAGE_SECTION_HEADER
+{
+    BYTE    Name[IMAGE_SIZEOF_SHORT_NAME];
+    union
+    {
+        DWORD   PhysicalAddress;
+        DWORD   VirtualSize;
+    } Misc;
+    DWORD   VirtualAddress;
+    DWORD   SizeOfRawData;
+    DWORD   PointerToRawData;
+    DWORD   PointerToRelocations;
+    DWORD   PointerToLinenumbers;
+    WORD    NumberOfRelocations;
+    WORD    NumberOfLinenumbers;
+    DWORD   Characteristics;
+
+} IMAGE_SECTION_HEADER, *PIMAGE_SECTION_HEADER;
+
+#define IMAGE_SIZEOF_SECTION_HEADER          40
+
+
+typedef struct _IMAGE_EXPORT_DIRECTORY
+{
+    DWORD Characteristics;
+    DWORD TimeDateStamp;
+    WORD  MajorVersion;
+    WORD  MinorVersion;
+    DWORD Name;
+    DWORD Base;
+    DWORD NumberOfFunctions;
+    DWORD NumberOfNames;
+    DWORD AddressOfFunctions;
+    DWORD AddressOfNames;
+    DWORD AddressOfNameOrdinals;
+} IMAGE_EXPORT_DIRECTORY, *PIMAGE_EXPORT_DIRECTORY;
+
+
+typedef struct _IMAGE_IMPORT_DESCRIPTOR
+{
+    union
+    {
+        DWORD Characteristics;
+        DWORD OriginalFirstThunk;
+    } ;
+    DWORD TimeDateStamp;
+    DWORD ForwarderChain;
+    DWORD Name;
+    DWORD FirstThunk;
+
+} IMAGE_IMPORT_DESCRIPTOR, *PIMAGE_IMPORT_DESCRIPTOR;
+
+
+typedef struct _IMAGE_IMPORT_BY_NAME
+{
+    WORD Hint;
+    BYTE Name[1];
+
+} IMAGE_IMPORT_BY_NAME, *PIMAGE_IMPORT_BY_NAME;
+
+typedef struct _IMAGE_THUNK_DATA32
+{
+    union
+    {
+        DWORD ForwarderString;
+        DWORD Function;
+        DWORD Ordinal;
+        DWORD AddressOfData;
+    } u1;
+
+} IMAGE_THUNK_DATA32, *PIMAGE_THUNK_DATA32;
+
+
+#define IMAGE_ORDINAL_FLAG32  0x80000000
+#define IMAGE_ORDINAL_FLAG64  0x8000000000000000L
+
+typedef struct _IMAGE_THUNK_DATA64
+{
+    union
+    {
+        ULONGLONG ForwarderString;
+        ULONGLONG Function;
+        ULONGLONG Ordinal;
+        ULONGLONG AddressOfData;
+    } u1;
+
+} IMAGE_THUNK_DATA64, *PIMAGE_THUNK_DATA64;
+
+
+typedef struct _IMAGE_RESOURCE_DIRECTORY_ENTRY
+{
+    DWORD Name;
+    DWORD OffsetToData;
+} IMAGE_RESOURCE_DIRECTORY_ENTRY, *PIMAGE_RESOURCE_DIRECTORY_ENTRY;
+
+
+typedef struct _IMAGE_RESOURCE_DATA_ENTRY
+{
+    DWORD OffsetToData;
+    DWORD Size;
+    DWORD CodePage;
+    DWORD Reserved;
+} IMAGE_RESOURCE_DATA_ENTRY, *PIMAGE_RESOURCE_DATA_ENTRY;
+
+
+typedef struct _IMAGE_RESOURCE_DIRECTORY
+{
+    DWORD Characteristics;
+    DWORD TimeDateStamp;
+    WORD  MajorVersion;
+    WORD  MinorVersion;
+    WORD  NumberOfNamedEntries;
+    WORD  NumberOfIdEntries;
+} IMAGE_RESOURCE_DIRECTORY, *PIMAGE_RESOURCE_DIRECTORY;
+
+#pragma pack(pop)
+
+#endif  // _WIN32
+
+typedef struct _VERSION_INFO
+{
+    WORD   Length;
+    WORD   ValueLength;
+    WORD   Type;
+    char   Key[0];
+} VERSION_INFO, *PVERSION_INFO;
+
+
+#define WIN_CERT_REVISION_1_0 0x0100
+#define WIN_CERT_REVISION_2_0 0x0200
+
+#define WIN_CERT_TYPE_X509             0x0001
+#define WIN_CERT_TYPE_PKCS_SIGNED_DATA 0x0002
+#define WIN_CERT_TYPE_RESERVED_1       0x0003
+#define WIN_CERT_TYPE_TS_STACK_SIGNED  0x0004
+
+typedef struct _WIN_CERTIFICATE
+{
+    DWORD Length;
+    WORD  Revision;
+    WORD  CertificateType;
+    BYTE  Certificate[0];
+} WIN_CERTIFICATE, *PWIN_CERTIFICATE;
+
+
+//
+// Rich signature.
+// http://www.ntcore.com/files/richsign.htm
+//
+
+#define RICH_VERSION_ID(id_version) (id_version >> 16)
+#define RICH_VERSION_VERSION(id_version) (id_version & 0xFFFF)
+
+typedef struct _RICH_VERSION_INFO
+{
+    DWORD id_version; //tool id and version (use RICH_VERSION_ID and RICH_VERSION_VERSION macros)
+    DWORD times; //number of times this tool was used
+} RICH_VERSION_INFO, *PRICH_VERSION_INFO;
+
+typedef struct _RICH_SIGNATURE
+{
+    DWORD dans;
+    DWORD key1;
+    DWORD key2;
+    DWORD key3;
+    RICH_VERSION_INFO versions[0];
+} RICH_SIGNATURE, *PRICH_SIGNATURE;
+
+#define RICH_DANS 0x536e6144 // "DanS"
+#define RICH_RICH 0x68636952 // "Rich"
+
+typedef struct _RICH_DATA
+{
+    size_t len;
+    BYTE* raw_data;
+    BYTE* clear_data;
+} RICH_DATA, *PRICH_DATA;
+
+#pragma pack(pop)

pluginsdk/yara/yara/proc.h

@@ -1,26 +1,26 @@
-/*
-Copyright (c) 2007. The YARA Authors. All Rights Reserved.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-   http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-#ifndef YR_PROC_H
-#define YR_PROC_H
-
-#include "types.h"
-
-int yr_process_get_memory(
-    int pid,
-    YR_MEMORY_BLOCK** first_block);
-
-#endif
+/*
+Copyright (c) 2007. The YARA Authors. All Rights Reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+#ifndef YR_PROC_H
+#define YR_PROC_H
+
+#include "types.h"
+
+int yr_process_get_memory(
+    int pid,
+    YR_MEMORY_BLOCK** first_block);
+
+#endif

pluginsdk/yara/yara/re.h

@@ -1,240 +1,243 @@
-/*
-Copyright (c) 2013. The YARA Authors. All Rights Reserved.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-   http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-#ifndef YR_RE_H
-#define YR_RE_H
-
-#include <ctype.h>
-
-#include "arena.h"
-#include "sizedstr.h"
-
-#define RE_NODE_LITERAL             1
-#define RE_NODE_MASKED_LITERAL      2
-#define RE_NODE_ANY                 3
-#define RE_NODE_CONCAT              4
-#define RE_NODE_ALT                 5
-#define RE_NODE_RANGE               6
-#define RE_NODE_STAR                7
-#define RE_NODE_PLUS                8
-#define RE_NODE_CLASS               9
-#define RE_NODE_WORD_CHAR           10
-#define RE_NODE_NON_WORD_CHAR       11
-#define RE_NODE_SPACE               12
-#define RE_NODE_NON_SPACE           13
-#define RE_NODE_DIGIT               14
-#define RE_NODE_NON_DIGIT           15
-#define RE_NODE_EMPTY               16
-#define RE_NODE_ANCHOR_START        17
-#define RE_NODE_ANCHOR_END          18
-#define RE_NODE_WORD_BOUNDARY       19
-#define RE_NODE_NON_WORD_BOUNDARY   20
-
-
-#define RE_OPCODE_ANY                   0xA0
-#define RE_OPCODE_ANY_EXCEPT_NEW_LINE   0xA1
-#define RE_OPCODE_LITERAL               0xA2
-#define RE_OPCODE_LITERAL_NO_CASE       0xA3
-#define RE_OPCODE_MASKED_LITERAL        0xA4
-#define RE_OPCODE_CLASS                 0xA5
-#define RE_OPCODE_CLASS_NO_CASE         0xA6
-#define RE_OPCODE_WORD_CHAR             0xA7
-#define RE_OPCODE_NON_WORD_CHAR         0xA8
-#define RE_OPCODE_SPACE                 0xA9
-#define RE_OPCODE_NON_SPACE             0xAA
-#define RE_OPCODE_DIGIT                 0xAB
-#define RE_OPCODE_NON_DIGIT             0xAC
-#define RE_OPCODE_MATCH                 0xAD
-
-#define RE_OPCODE_MATCH_AT_END          0xB0
-#define RE_OPCODE_MATCH_AT_START        0xB1
-#define RE_OPCODE_WORD_BOUNDARY         0xB2
-#define RE_OPCODE_NON_WORD_BOUNDARY     0xB3
-
-#define RE_OPCODE_SPLIT_A               0xC0
-#define RE_OPCODE_SPLIT_B               0xC1
-#define RE_OPCODE_PUSH                  0xC2
-#define RE_OPCODE_POP                   0xC3
-#define RE_OPCODE_JNZ                   0xC4
-#define RE_OPCODE_JUMP                  0xC5
-
-
-#define RE_FLAGS_FAST_HEX_REGEXP          0x02
-#define RE_FLAGS_BACKWARDS                0x04
-#define RE_FLAGS_EXHAUSTIVE               0x08
-#define RE_FLAGS_WIDE                     0x10
-#define RE_FLAGS_NO_CASE                  0x20
-#define RE_FLAGS_SCAN                     0x40
-#define RE_FLAGS_DOT_ALL                  0x80
-#define RE_FLAGS_NOT_AT_START            0x100
-
-
-typedef struct RE RE;
-typedef struct RE_NODE RE_NODE;
-typedef struct RE_ERROR RE_ERROR;
-
-typedef uint8_t* RE_CODE;
-
-#define CHAR_IN_CLASS(chr, cls)  \
-    ((cls)[(chr) / 8] & 1 << ((chr) % 8))
-
-
-#define IS_WORD_CHAR(chr) \
-    (isalnum(chr) || (chr) == '_')
-
-
-struct RE_NODE
-{
-    int type;
-
-    union
-    {
-        int value;
-        int count;
-        int start;
-    };
-
-    union
-    {
-        int mask;
-        int end;
-    };
-
-    int greedy;
-
-    uint8_t* class_vector;
-
-    RE_NODE* left;
-    RE_NODE* right;
-
-    RE_CODE forward_code;
-    RE_CODE backward_code;
-};
-
-
-struct RE
-{
-
-    uint32_t flags;
-    RE_NODE* root_node;
-    YR_ARENA* code_arena;
-    RE_CODE code;
-};
-
-
-struct RE_ERROR
-{
-
-    char message[512];
-
-};
-
-
-typedef int RE_MATCH_CALLBACK_FUNC(
-    uint8_t* match,
-    int match_length,
-    int flags,
-    void* args);
-
-
-int yr_re_create(
-    RE** re);
-
-
-int yr_re_parse(
-    const char* re_string,
-    int flags,
-    RE** re,
-    RE_ERROR* error);
-
-
-int yr_re_parse_hex(
-    const char* hex_string,
-    int flags,
-    RE** re,
-    RE_ERROR* error);
-
-
-int yr_re_compile(
-    const char* re_string,
-    int flags,
-    YR_ARENA* code_arena,
-    RE** re,
-    RE_ERROR* error);
-
-
-void yr_re_destroy(
-    RE* re);
-
-
-void yr_re_print(
-    RE* re);
-
-
-RE_NODE* yr_re_node_create(
-    int type,
-    RE_NODE* left,
-    RE_NODE* right);
-
-
-void yr_re_node_destroy(
-    RE_NODE* node);
-
-
-SIZED_STRING* yr_re_extract_literal(
-    RE* re);
-
-
-int yr_re_contains_dot_star(
-    RE* re);
-
-
-int yr_re_split_at_chaining_point(
-    RE* re,
-    RE** result_re,
-    RE** remainder_re,
-    int32_t* min_gap,
-    int32_t* max_gap);
-
-
-int yr_re_emit_code(
-    RE* re,
-    YR_ARENA* arena);
-
-
-int yr_re_exec(
-    RE_CODE re_code,
-    uint8_t* input,
-    size_t input_size,
-    int flags,
-    RE_MATCH_CALLBACK_FUNC callback,
-    void* callback_args);
-
-
-int yr_re_match(
-    RE_CODE re_code,
-    const char* target);
-
-
-int yr_re_initialize(void);
-
-
-int yr_re_finalize(void);
-
-
-int yr_re_finalize_thread(void);
-
-#endif
+/*
+Copyright (c) 2013. The YARA Authors. All Rights Reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+#ifndef YR_RE_H
+#define YR_RE_H
+
+#include <ctype.h>
+
+#include "arena.h"
+#include "sizedstr.h"
+
+#define RE_NODE_LITERAL             1
+#define RE_NODE_MASKED_LITERAL      2
+#define RE_NODE_ANY                 3
+#define RE_NODE_CONCAT              4
+#define RE_NODE_ALT                 5
+#define RE_NODE_RANGE               6
+#define RE_NODE_STAR                7
+#define RE_NODE_PLUS                8
+#define RE_NODE_CLASS               9
+#define RE_NODE_WORD_CHAR           10
+#define RE_NODE_NON_WORD_CHAR       11
+#define RE_NODE_SPACE               12
+#define RE_NODE_NON_SPACE           13
+#define RE_NODE_DIGIT               14
+#define RE_NODE_NON_DIGIT           15
+#define RE_NODE_EMPTY               16
+#define RE_NODE_ANCHOR_START        17
+#define RE_NODE_ANCHOR_END          18
+#define RE_NODE_WORD_BOUNDARY       19
+#define RE_NODE_NON_WORD_BOUNDARY   20
+
+
+#define RE_OPCODE_ANY                   0xA0
+#define RE_OPCODE_ANY_EXCEPT_NEW_LINE   0xA1
+#define RE_OPCODE_LITERAL               0xA2
+#define RE_OPCODE_LITERAL_NO_CASE       0xA3
+#define RE_OPCODE_MASKED_LITERAL        0xA4
+#define RE_OPCODE_CLASS                 0xA5
+#define RE_OPCODE_CLASS_NO_CASE         0xA6
+#define RE_OPCODE_WORD_CHAR             0xA7
+#define RE_OPCODE_NON_WORD_CHAR         0xA8
+#define RE_OPCODE_SPACE                 0xA9
+#define RE_OPCODE_NON_SPACE             0xAA
+#define RE_OPCODE_DIGIT                 0xAB
+#define RE_OPCODE_NON_DIGIT             0xAC
+#define RE_OPCODE_MATCH                 0xAD
+
+#define RE_OPCODE_MATCH_AT_END          0xB0
+#define RE_OPCODE_MATCH_AT_START        0xB1
+#define RE_OPCODE_WORD_BOUNDARY         0xB2
+#define RE_OPCODE_NON_WORD_BOUNDARY     0xB3
+
+#define RE_OPCODE_SPLIT_A               0xC0
+#define RE_OPCODE_SPLIT_B               0xC1
+#define RE_OPCODE_PUSH                  0xC2
+#define RE_OPCODE_POP                   0xC3
+#define RE_OPCODE_JNZ                   0xC4
+#define RE_OPCODE_JUMP                  0xC5
+
+
+#define RE_FLAGS_FAST_HEX_REGEXP        0x02
+#define RE_FLAGS_BACKWARDS              0x04
+#define RE_FLAGS_EXHAUSTIVE             0x08
+#define RE_FLAGS_WIDE                   0x10
+#define RE_FLAGS_NO_CASE                0x20
+#define RE_FLAGS_SCAN                   0x40
+#define RE_FLAGS_DOT_ALL                0x80
+#define RE_FLAGS_NOT_AT_START          0x100
+#define RE_FLAGS_GREEDY                0x400
+#define RE_FLAGS_UNGREEDY              0x800
+
+
+typedef struct RE RE;
+typedef struct RE_NODE RE_NODE;
+typedef struct RE_ERROR RE_ERROR;
+
+typedef uint8_t RE_SPLIT_ID_TYPE;
+typedef uint8_t* RE_CODE;
+
+#define CHAR_IN_CLASS(chr, cls)  \
+    ((cls)[(chr) / 8] & 1 << ((chr) % 8))
+
+
+#define IS_WORD_CHAR(chr) \
+    (isalnum(chr) || (chr) == '_')
+
+
+struct RE_NODE
+{
+    int type;
+
+    union
+    {
+        int value;
+        int count;
+        int start;
+    };
+
+    union
+    {
+        int mask;
+        int end;
+    };
+
+    int greedy;
+
+    uint8_t* class_vector;
+
+    RE_NODE* left;
+    RE_NODE* right;
+
+    RE_CODE forward_code;
+    RE_CODE backward_code;
+};
+
+
+struct RE
+{
+
+    uint32_t flags;
+    RE_NODE* root_node;
+    YR_ARENA* code_arena;
+    RE_CODE code;
+};
+
+
+struct RE_ERROR
+{
+
+    char message[512];
+
+};
+
+
+typedef int RE_MATCH_CALLBACK_FUNC(
+    uint8_t* match,
+    int match_length,
+    int flags,
+    void* args);
+
+
+int yr_re_create(
+    RE** re);
+
+
+int yr_re_parse(
+    const char* re_string,
+    int flags,
+    RE** re,
+    RE_ERROR* error);
+
+
+int yr_re_parse_hex(
+    const char* hex_string,
+    int flags,
+    RE** re,
+    RE_ERROR* error);
+
+
+int yr_re_compile(
+    const char* re_string,
+    int flags,
+    YR_ARENA* code_arena,
+    RE** re,
+    RE_ERROR* error);
+
+
+void yr_re_destroy(
+    RE* re);
+
+
+void yr_re_print(
+    RE* re);
+
+
+RE_NODE* yr_re_node_create(
+    int type,
+    RE_NODE* left,
+    RE_NODE* right);
+
+
+void yr_re_node_destroy(
+    RE_NODE* node);
+
+
+SIZED_STRING* yr_re_extract_literal(
+    RE* re);
+
+
+int yr_re_contains_dot_star(
+    RE* re);
+
+
+int yr_re_split_at_chaining_point(
+    RE* re,
+    RE** result_re,
+    RE** remainder_re,
+    int32_t* min_gap,
+    int32_t* max_gap);
+
+
+int yr_re_emit_code(
+    RE* re,
+    YR_ARENA* arena);
+
+
+int yr_re_exec(
+    RE_CODE re_code,
+    uint8_t* input,
+    size_t input_size,
+    int flags,
+    RE_MATCH_CALLBACK_FUNC callback,
+    void* callback_args);
+
+
+int yr_re_match(
+    RE_CODE re_code,
+    const char* target);
+
+
+int yr_re_initialize(void);
+
+
+int yr_re_finalize(void);
+
+
+int yr_re_finalize_thread(void);
+
+#endif

pluginsdk/yara/yara/re_lexer.h

@@ -1,97 +1,97 @@
-/*
-Copyright (c) 2013. The YARA Authors. All Rights Reserved.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
- http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-#undef yyparse
-#undef yylex
-#undef yyerror
-#undef yyfatal
-#undef yychar
-#undef yydebug
-#undef yynerrs
-#undef yyget_extra
-#undef yyget_lineno
-
-#undef YY_FATAL_ERROR
-#undef YY_DECL
-#undef LEX_ENV
-
-
-#define yyparse         re_yyparse
-#define yylex           re_yylex
-#define yyerror         re_yyerror
-#define yyfatal         re_yyfatal
-#define yychar          re_yychar
-#define yydebug         re_yydebug
-#define yynerrs         re_yynerrs
-#define yyget_extra     re_yyget_extra
-#define yyget_lineno    re_yyget_lineno
-
-
-#ifndef YY_TYPEDEF_YY_SCANNER_T
-#define YY_TYPEDEF_YY_SCANNER_T
-typedef void* yyscan_t;
-#endif
-
-#define YY_EXTRA_TYPE RE*
-#define YY_USE_CONST
-
-
-typedef struct _RE_LEX_ENVIRONMENT
-{
-    int negated_class;
-    uint8_t class_vector[32];
-    int last_error_code;
-    char last_error_message[256];
-
-} RE_LEX_ENVIRONMENT;
-
-
-#define LEX_ENV  ((RE_LEX_ENVIRONMENT*) lex_env)
-
-#define YY_FATAL_ERROR(msg) re_yyfatal(yyscanner, msg)
-
-#include <re_grammar.h>
-
-#define YY_DECL int re_yylex \
-    (YYSTYPE * yylval_param , yyscan_t yyscanner, RE_LEX_ENVIRONMENT* lex_env)
-
-
-YY_EXTRA_TYPE yyget_extra(
-    yyscan_t yyscanner);
-
-int yylex(
-    YYSTYPE* yylval_param,
-    yyscan_t yyscanner,
-    RE_LEX_ENVIRONMENT* lex_env);
-
-int yyparse(
-    void* yyscanner,
-    RE_LEX_ENVIRONMENT* lex_env);
-
-void yyerror(
-    yyscan_t yyscanner,
-    RE_LEX_ENVIRONMENT* lex_env,
-    const char* error_message);
-
-void yyfatal(
-    yyscan_t yyscanner,
-    const char* error_message);
-
-int yr_parse_re_string(
-    const char* re_string,
-    int flags,
-    RE** re,
-    RE_ERROR* error);
+/*
+Copyright (c) 2013. The YARA Authors. All Rights Reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+#undef yyparse
+#undef yylex
+#undef yyerror
+#undef yyfatal
+#undef yychar
+#undef yydebug
+#undef yynerrs
+#undef yyget_extra
+#undef yyget_lineno
+
+#undef YY_FATAL_ERROR
+#undef YY_DECL
+#undef LEX_ENV
+
+
+#define yyparse         re_yyparse
+#define yylex           re_yylex
+#define yyerror         re_yyerror
+#define yyfatal         re_yyfatal
+#define yychar          re_yychar
+#define yydebug         re_yydebug
+#define yynerrs         re_yynerrs
+#define yyget_extra     re_yyget_extra
+#define yyget_lineno    re_yyget_lineno
+
+
+#ifndef YY_TYPEDEF_YY_SCANNER_T
+#define YY_TYPEDEF_YY_SCANNER_T
+typedef void* yyscan_t;
+#endif
+
+#define YY_EXTRA_TYPE RE*
+#define YY_USE_CONST
+
+
+typedef struct _RE_LEX_ENVIRONMENT
+{
+    int negated_class;
+    uint8_t class_vector[32];
+    int last_error_code;
+    char last_error_message[256];
+
+} RE_LEX_ENVIRONMENT;
+
+
+#define LEX_ENV  ((RE_LEX_ENVIRONMENT*) lex_env)
+
+#define YY_FATAL_ERROR(msg) re_yyfatal(yyscanner, msg)
+
+#include <re_grammar.h>
+
+#define YY_DECL int re_yylex \
+    (YYSTYPE * yylval_param , yyscan_t yyscanner, RE_LEX_ENVIRONMENT* lex_env)
+
+
+YY_EXTRA_TYPE yyget_extra(
+    yyscan_t yyscanner);
+
+int yylex(
+    YYSTYPE* yylval_param,
+    yyscan_t yyscanner,
+    RE_LEX_ENVIRONMENT* lex_env);
+
+int yyparse(
+    void* yyscanner,
+    RE_LEX_ENVIRONMENT* lex_env);
+
+void yyerror(
+    yyscan_t yyscanner,
+    RE_LEX_ENVIRONMENT* lex_env,
+    const char* error_message);
+
+void yyfatal(
+    yyscan_t yyscanner,
+    const char* error_message);
+
+int yr_parse_re_string(
+    const char* re_string,
+    int flags,
+    RE** re,
+    RE_ERROR* error);

pluginsdk/yara/yara/rules.h

@@ -1,127 +1,147 @@
-/*
-Copyright (c) 2014. The YARA Authors. All Rights Reserved.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-   http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-
-#ifndef YR_RULES_H
-#define YR_RULES_H
-
-#include "types.h"
-#include "utils.h"
-
-
-#define CALLBACK_MSG_RULE_MATCHING              1
-#define CALLBACK_MSG_RULE_NOT_MATCHING          2
-#define CALLBACK_MSG_SCAN_FINISHED              3
-#define CALLBACK_MSG_IMPORT_MODULE              4
-
-#define CALLBACK_CONTINUE   0
-#define CALLBACK_ABORT      1
-#define CALLBACK_ERROR      2
-
-
-#define yr_rule_tags_foreach(rule, tag_name) \
-    for (tag_name = rule->tags; \
-         tag_name != NULL && *tag_name != '\0'; \
-         tag_name += strlen(tag_name) + 1)
-
-
-#define yr_rule_metas_foreach(rule, meta) \
-    for (meta = rule->metas; !META_IS_NULL(meta); meta++)
-
-
-#define yr_rule_strings_foreach(rule, string) \
-    for (string = rule->strings; !STRING_IS_NULL(string); string++)
-
-
-#define yr_string_matches_foreach(string, match) \
-    for (match = STRING_MATCHES(string).head; match != NULL; match = match->next)
-
-
-#define yr_rules_foreach(rules, rule) \
-    for (rule = rules->rules_list_head; !RULE_IS_NULL(rule); rule++)
-
-
-
-YR_API int yr_rules_scan_mem(
-    YR_RULES* rules,
-    uint8_t* buffer,
-    size_t buffer_size,
-    int flags,
-    YR_CALLBACK_FUNC callback,
-    void* user_data,
-    int timeout);
-
-
-YR_API int yr_rules_scan_file(
-    YR_RULES* rules,
-    const char* filename,
-    int flags,
-    YR_CALLBACK_FUNC callback,
-    void* user_data,
-    int timeout);
-
-
-YR_API int yr_rules_scan_proc(
-    YR_RULES* rules,
-    int pid,
-    int flags,
-    YR_CALLBACK_FUNC callback,
-    void* user_data,
-    int timeout);
-
-
-YR_API int yr_rules_save(
-    YR_RULES* rules,
-    const char* filename);
-
-
-YR_API int yr_rules_load(
-    const char* filename,
-    YR_RULES** rules);
-
-
-YR_API int yr_rules_destroy(
-    YR_RULES* rules);
-
-
-YR_API int yr_rules_define_integer_variable(
-    YR_RULES* rules,
-    const char* identifier,
-    int64_t value);
-
-
-YR_API int yr_rules_define_boolean_variable(
-    YR_RULES* rules,
-    const char* identifier,
-    int value);
-
-
-YR_API int yr_rules_define_float_variable(
-    YR_RULES* rules,
-    const char* identifier,
-    double value);
-
-
-YR_API int yr_rules_define_string_variable(
-    YR_RULES* rules,
-    const char* identifier,
-    const char* value);
-
-
-YR_API void yr_rules_print_profiling_info(
-    YR_RULES* rules);
-
-#endif
+/*
+Copyright (c) 2014. The YARA Authors. All Rights Reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+#ifndef YR_RULES_H
+#define YR_RULES_H
+
+#include "types.h"
+#include "utils.h"
+#include "filemap.h"
+
+
+#define CALLBACK_MSG_RULE_MATCHING              1
+#define CALLBACK_MSG_RULE_NOT_MATCHING          2
+#define CALLBACK_MSG_SCAN_FINISHED              3
+#define CALLBACK_MSG_IMPORT_MODULE              4
+#define CALLBACK_MSG_MODULE_IMPORTED            5
+
+#define CALLBACK_CONTINUE   0
+#define CALLBACK_ABORT      1
+#define CALLBACK_ERROR      2
+
+
+#define yr_rule_tags_foreach(rule, tag_name) \
+    for (tag_name = rule->tags; \
+         tag_name != NULL && *tag_name != '\0'; \
+         tag_name += strlen(tag_name) + 1)
+
+
+#define yr_rule_metas_foreach(rule, meta) \
+    for (meta = rule->metas; !META_IS_NULL(meta); meta++)
+
+
+#define yr_rule_strings_foreach(rule, string) \
+    for (string = rule->strings; !STRING_IS_NULL(string); string++)
+
+
+#define yr_string_matches_foreach(string, match) \
+    for (match = STRING_MATCHES(string).head; match != NULL; match = match->next)
+
+
+#define yr_rules_foreach(rules, rule) \
+    for (rule = rules->rules_list_head; !RULE_IS_NULL(rule); rule++)
+
+
+
+YR_API int yr_rules_scan_mem(
+    YR_RULES* rules,
+    uint8_t* buffer,
+    size_t buffer_size,
+    int flags,
+    YR_CALLBACK_FUNC callback,
+    void* user_data,
+    int timeout);
+
+
+YR_API int yr_rules_scan_file(
+    YR_RULES* rules,
+    const char* filename,
+    int flags,
+    YR_CALLBACK_FUNC callback,
+    void* user_data,
+    int timeout);
+
+
+YR_API int yr_rules_scan_fd(
+    YR_RULES* rules,
+    YR_FILE_DESCRIPTOR fd,
+    int flags,
+    YR_CALLBACK_FUNC callback,
+    void* user_data,
+    int timeout);
+
+
+YR_API int yr_rules_scan_proc(
+    YR_RULES* rules,
+    int pid,
+    int flags,
+    YR_CALLBACK_FUNC callback,
+    void* user_data,
+    int timeout);
+
+
+YR_API int yr_rules_save(
+    YR_RULES* rules,
+    const char* filename);
+
+
+YR_API int yr_rules_save_stream(
+    YR_RULES* rules,
+    YR_STREAM* stream);
+
+
+YR_API int yr_rules_load(
+    const char* filename,
+    YR_RULES** rules);
+
+
+YR_API int yr_rules_load_stream(
+    YR_STREAM* stream,
+    YR_RULES** rules);
+
+
+YR_API int yr_rules_destroy(
+    YR_RULES* rules);
+
+
+YR_API int yr_rules_define_integer_variable(
+    YR_RULES* rules,
+    const char* identifier,
+    int64_t value);
+
+
+YR_API int yr_rules_define_boolean_variable(
+    YR_RULES* rules,
+    const char* identifier,
+    int value);
+
+
+YR_API int yr_rules_define_float_variable(
+    YR_RULES* rules,
+    const char* identifier,
+    double value);
+
+
+YR_API int yr_rules_define_string_variable(
+    YR_RULES* rules,
+    const char* identifier,
+    const char* value);
+
+
+YR_API void yr_rules_print_profiling_info(
+    YR_RULES* rules);
+
+#endif

pluginsdk/yara/yara/scan.h

@@ -1,35 +1,35 @@
-/*
-Copyright (c) 2014. The YARA Authors. All Rights Reserved.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-   http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-#ifndef YR_SCAN_H
-#define YR_SCAN_H
-
-#include "types.h"
-
-#define SCAN_FLAGS_FAST_MODE         1
-#define SCAN_FLAGS_PROCESS_MEMORY    2
-
-
-int yr_scan_verify_match(
-    YR_AC_MATCH* ac_match,
-    uint8_t* data,
-    size_t data_size,
-    size_t data_base,
-    size_t offset,
-    YR_ARENA* matches_arena,
-    int flags);
-
-#endif
+/*
+Copyright (c) 2014. The YARA Authors. All Rights Reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+#ifndef YR_SCAN_H
+#define YR_SCAN_H
+
+#include "types.h"
+
+// Bitmasks for flags.
+#define SCAN_FLAGS_FAST_MODE         1
+#define SCAN_FLAGS_PROCESS_MEMORY    2
+
+
+int yr_scan_verify_match(
+    YR_SCAN_CONTEXT* context,
+    YR_AC_MATCH* ac_match,
+    uint8_t* data,
+    size_t data_size,
+    size_t data_base,
+    size_t offset);
+
+#endif

pluginsdk/yara/yara/sizedstr.h

@@ -1,42 +1,44 @@
-/*
-Copyright (c) 2007-2014. The YARA Authors. All Rights Reserved.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-   http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-#ifndef _SIZEDSTR_H
-#define _SIZEDSTR_H
-
-//
-// This struct is used to support strings containing null chars. The length of
-// the string is stored along the string data. However the string data is also
-// terminated with a null char.
-//
-
-#define SIZED_STRING_FLAGS_NO_CASE  1
-#define SIZED_STRING_FLAGS_DOT_ALL  2
-
-typedef struct _SIZED_STRING
-{
-    int length;
-    int flags;
-    char c_string[1];
-
-} SIZED_STRING;
-
-
-int sized_string_cmp(
-    SIZED_STRING* s1,
-    SIZED_STRING* s2);
-
-#endif
+/*
+Copyright (c) 2007-2014. The YARA Authors. All Rights Reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+#ifndef _SIZEDSTR_H
+#define _SIZEDSTR_H
+
+#include <stddef.h>
+
+//
+// This struct is used to support strings containing null chars. The length of
+// the string is stored along the string data. However the string data is also
+// terminated with a null char.
+//
+
+#define SIZED_STRING_FLAGS_NO_CASE  1
+#define SIZED_STRING_FLAGS_DOT_ALL  2
+
+typedef struct _SIZED_STRING
+{
+    size_t length;
+    int flags;
+    char c_string[1];
+
+} SIZED_STRING;
+
+
+int sized_string_cmp(
+    SIZED_STRING* s1,
+    SIZED_STRING* s2);
+
+#endif

pluginsdk/yara/yara/stream.h

@@ -0,0 +1,59 @@
+/*
+Copyright (c) 2015. The YARA Authors. All Rights Reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+#ifndef YR_STREAM_H
+#define YR_STREAM_H
+
+#include <stddef.h>
+
+typedef size_t (*YR_STREAM_READ_FUNC)(
+    void* ptr,
+    size_t size,
+    size_t count,
+    void* user_data);
+
+
+typedef size_t (*YR_STREAM_WRITE_FUNC)(
+    const void* ptr,
+    size_t size,
+    size_t count,
+    void* user_data);
+
+
+typedef struct _YR_STREAM
+{
+    void* user_data;
+
+    YR_STREAM_READ_FUNC read;
+    YR_STREAM_WRITE_FUNC write;
+
+} YR_STREAM;
+
+
+size_t yr_stream_read(
+    void* ptr,
+    size_t size,
+    size_t count,
+    YR_STREAM* stream);
+
+
+size_t yr_stream_write(
+    const void* ptr,
+    size_t size,
+    size_t count,
+    YR_STREAM* stream);
+
+#endif

pluginsdk/yara/yara/strutils.h

@@ -1,77 +1,79 @@
-/*
-Copyright (c) 2007-2014. The YARA Authors. All Rights Reserved.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-   http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-#ifndef YR_STRUTILS_H
-#define YR_STRUTILS_H
-
-#include <assert.h>
-#include <stdlib.h>
-#include <stdint.h>
-
-#include "config.h"
-
-#ifdef _WIN32
-#define snprintf _snprintf
-#define strcasecmp _stricmp
-#define strncasecmp _strnicmp
-#endif
-
-
-uint64_t xtoi(
-    const char* hexstr);
-
-
-#if !HAVE_STRLCPY
-size_t strlcpy(
-    char* dst,
-    const char* src,
-    size_t size);
-#endif
-
-
-#if !HAVE_STRLCAT
-size_t strlcat(
-    char* dst,
-    const char* src,
-    size_t size);
-#endif
-
-
-#if !HAVE_MEMMEM
-void* memmem(
-    const void* haystack,
-    size_t haystack_size,
-    const void* needle,
-    size_t needle_size);
-#endif
-
-
-int strlen_w(
-    const char* w_str);
-
-
-int strcmp_w(
-    const char* w_str,
-    const char* str);
-
-
-size_t strlcpy_w(
-    char* dst,
-    const char* w_src,
-    size_t n);
-
-#endif
-
+/*
+Copyright (c) 2007-2014. The YARA Authors. All Rights Reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+#ifndef YR_STRUTILS_H
+#define YR_STRUTILS_H
+
+#include <assert.h>
+#include <stdlib.h>
+#include <stdint.h>
+
+#include "config.h"
+
+// Cygwin already has these functions.
+#if defined(_WIN32) && !defined(__CYGWIN__)
+#if defined(_MSC_VER) && _MSC_VER < 1900
+#define snprintf _snprintf
+#endif
+#define strcasecmp _stricmp
+#define strncasecmp _strnicmp
+#endif
+
+
+uint64_t xtoi(
+    const char* hexstr);
+
+
+#if !HAVE_STRLCPY && !defined(strlcpy)
+size_t strlcpy(
+    char* dst,
+    const char* src,
+    size_t size);
+#endif
+
+
+#if !HAVE_STRLCAT && !defined(strlcat)
+size_t strlcat(
+    char* dst,
+    const char* src,
+    size_t size);
+#endif
+
+
+#if !HAVE_MEMMEM && !defined(memmem)
+void* memmem(
+    const void* haystack,
+    size_t haystack_size,
+    const void* needle,
+    size_t needle_size);
+#endif
+
+
+int strnlen_w(
+    const char* w_str);
+
+
+int strcmp_w(
+    const char* w_str,
+    const char* str);
+
+
+size_t strlcpy_w(
+    char* dst,
+    const char* w_src,
+    size_t n);
+
+#endif

pluginsdk/yara/yara/threading.h

@@ -0,0 +1,52 @@
+/*
+Copyright (c) 2016. The YARA Authors. All Rights Reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+#ifndef YR_MUTEX_H
+#define YR_MUTEX_H
+
+
+
+#if defined(_WIN32) || defined(__CYGWIN__)
+
+#include <windows.h>
+
+typedef DWORD YR_THREAD_ID;
+typedef DWORD YR_THREAD_STORAGE_KEY;
+typedef HANDLE YR_MUTEX;
+
+#else
+
+#include <pthread.h>
+
+typedef pthread_t YR_THREAD_ID;
+typedef pthread_key_t YR_THREAD_STORAGE_KEY;
+typedef pthread_mutex_t YR_MUTEX;
+
+#endif
+
+YR_THREAD_ID yr_current_thread_id(void);
+
+int yr_mutex_create(YR_MUTEX*);
+int yr_mutex_destroy(YR_MUTEX*);
+int yr_mutex_lock(YR_MUTEX*);
+int yr_mutex_unlock(YR_MUTEX*);
+
+int yr_thread_storage_create(YR_THREAD_STORAGE_KEY*);
+int yr_thread_storage_destroy(YR_THREAD_STORAGE_KEY*);
+int yr_thread_storage_set_value(YR_THREAD_STORAGE_KEY*, void*);
+void* yr_thread_storage_get_value(YR_THREAD_STORAGE_KEY*);
+
+#endif

pluginsdk/yara/yara/utils.h

@@ -1,67 +1,77 @@
-/*
-Copyright (c) 2014. The YARA Authors. All Rights Reserved.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-   http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-
-#ifndef YR_UTILS_H
-#define YR_UTILS_H
-
-#ifndef TRUE
-#define TRUE 1
-#endif
-
-#ifndef FALSE
-#define FALSE 0
-#endif
-
-#ifndef NULL
-#define NULL 0
-#endif
-
-#ifdef __cplusplus
-#define YR_API extern "C" __declspec(dllimport)
-#else
-#define YR_API
-#endif
-
-#ifndef min
-#define min(x, y) ((x < y) ? (x) : (y))
-#endif
-
-#ifndef max
-#define max(x, y) ((x > y) ? (x) : (y))
-#endif
-
-
-#define PTR_TO_UINT64(x)  ((uint64_t) (size_t) x)
-
-
-#ifdef NDEBUG
-
-#define assertf(expr, msg)  ((void)0)
-
-#else
-
-#include <stdlib.h>
-
-#define assertf(expr, msg, ...) \
-    if(!(expr)) { \
-      fprintf(stderr, "%s:%d: " msg "\n", __FILE__, __LINE__, ##__VA_ARGS__); \
-      abort(); \
-    }
-
-#endif
-
-#endif
+/*
+Copyright (c) 2014. The YARA Authors. All Rights Reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+
+#ifndef YR_UTILS_H
+#define YR_UTILS_H
+
+#ifndef TRUE
+#define TRUE 1
+#endif
+
+#ifndef FALSE
+#define FALSE 0
+#endif
+
+#ifndef NULL
+#define NULL 0
+#endif
+
+#ifdef __cplusplus
+#define EXTERNC extern "C"
+#else
+#define EXTERNC
+#endif
+
+#if defined(__GNUC__)
+#define YR_API EXTERNC __attribute__((visibility("default")))
+#elif defined(_MSC_VER)
+#define YR_API EXTERNC __declspec(dllexport)
+#else
+#define YR_API EXTERNC
+#endif
+
+#if defined(__GNUC__)
+#define YR_ALIGN(n) __attribute__((aligned(n)))
+#elif defined(_MSC_VER)
+#define YR_ALIGN(n) __declspec(align(n))
+#else
+#define YR_ALIGN(n)
+#endif
+
+#define yr_min(x, y) ((x < y) ? (x) : (y))
+#define yr_max(x, y) ((x > y) ? (x) : (y))
+
+#define PTR_TO_INT64(x)  ((int64_t) (size_t) x)
+
+
+#ifdef NDEBUG
+
+#define assertf(expr, msg, ...)  ((void)0)
+
+#else
+
+#include <stdlib.h>
+
+#define assertf(expr, msg, ...) \
+    if(!(expr)) { \
+      fprintf(stderr, "%s:%d: " msg "\n", __FILE__, __LINE__, ##__VA_ARGS__); \
+      abort(); \
+    }
+
+#endif
+
+#endif

script.cpp

@@ -0,0 +1,491 @@
+#include "script.h"
+#include "angelscript\angelscript.h"
+#include "angelscript\scriptstdstring.h"
+#include "pluginsdk\_scriptapi_debug.h"
+#include "pluginsdk\_scriptapi_memory.h"
+#include "pluginsdk\_scriptapi_register.h"
+
+//
+// Script Engine stuff
+//
+
+static void MessageCallback(const asSMessageInfo* msg, void* param)
+{
+    const char* type = "ERR ";
+    if(msg->type == asMSGTYPE_WARNING)
+        type = "WARN";
+    else if(msg->type == asMSGTYPE_INFORMATION)
+        type = "INFO";
+
+    _plugin_logprintf("[TEST] %s (%d, %d) : %s : %s\n", msg->section, msg->row, msg->col, type, msg->message);
+}
+
+// Function implementation with native calling convention
+static void PrintString(std::string & str)
+{
+    _plugin_logprintf(str.c_str());
+}
+
+// Function implementation with generic script interface
+static void PrintString_Generic(asIScriptGeneric* gen)
+{
+    PrintString(*(std::string*)gen->GetArgAddress(0));
+}
+
+#ifdef _DEBUG
+#define VERIFY(x) assert((x) >= 0)
+#else
+#define VERIFY(x) x
+#endif
+
+static int StringTypeId;
+
+static void asParseVarArgs(asIScriptGeneric* Gen, int ArgIndex, char* Buffer, size_t Size)
+{
+    // Zero any data
+    memset(Buffer, 0, Size);
+
+    // Convert each parameter to the va_list form
+    va_list va = (va_list)Buffer;
+
+    for(int i = ArgIndex; i < Gen->GetArgCount(); i++)
+    {
+        PVOID addr = *(PVOID*)Gen->GetAddressOfArg(i);
+        int type = Gen->GetArgTypeId(i);
+        int size = Gen->GetEngine()->GetSizeOfPrimitiveType(type);
+
+        switch(type)
+        {
+        case asTYPEID_VOID:
+            break;
+
+        case asTYPEID_BOOL:
+        case asTYPEID_UINT8:
+        case asTYPEID_INT8:
+        case asTYPEID_UINT16:
+        case asTYPEID_INT16:
+        case asTYPEID_UINT32:
+        case asTYPEID_INT32:
+        case asTYPEID_UINT64:
+        case asTYPEID_INT64:
+        case asTYPEID_FLOAT:
+        case asTYPEID_DOUBLE:
+            memcpy(va, addr, size);
+            va += size;
+            break;
+
+        default:
+            if(type == StringTypeId)
+                va_arg(va, const char*) = ((std::string*)addr)->c_str();
+            else
+                memcpy(va, addr, size);
+            va += size;
+            break;
+        }
+    }
+}
+
+static void asPrintf(asIScriptGeneric* Gen)
+{
+    // Format is the first parameter
+    std::string* format = static_cast<std::string*>(Gen->GetArgObject(0));
+
+    // Buffer to store arguments for vsnprintf_s
+    char data[256];
+    asParseVarArgs(Gen, 1, data, sizeof(data));
+
+    char buf[1024];
+    vsnprintf_s(buf, _TRUNCATE, format->c_str(), (va_list)&data);
+
+    // Send the string to the log window
+    _plugin_logprintf(buf);
+}
+
+static void ConfigureEngine(asIScriptEngine* engine)
+{
+
+    // Register the script string type
+    // Look at the implementation for this function for more information
+    // on how to register a custom string type, and other object types.
+    RegisterStdString(engine);
+
+    VERIFY(engine->RegisterTypedef("byte", "uint8"));
+    VERIFY(engine->RegisterTypedef("word", "uint16"));
+    VERIFY(engine->RegisterTypedef("dword", "uint"));
+    VERIFY(engine->RegisterTypedef("qword", "uint64"));
+
+#ifdef _WIN64
+    VERIFY(engine->RegisterTypedef("ptr", "uint64"));
+    VERIFY(engine->RegisterTypedef("duint", "uint64"));
+    VERIFY(engine->RegisterTypedef("handle", "uint64"));
+#else
+    VERIFY(engine->RegisterTypedef("ptr", "uint"));
+    VERIFY(engine->RegisterTypedef("duint", "uint"));
+    VERIFY(engine->RegisterTypedef("handle", "uint"));
+#endif
+
+    StringTypeId = engine->GetTypeIdByDecl("string");
+
+    engine->SetDefaultNamespace("");
+
+    VERIFY(engine->RegisterGlobalFunction("void Print(string &in format, ?&in = null, ?&in = null, ?&in = null, ?&in = null, ?&in = null, ?&in = null)", asFUNCTION(asPrintf), asCALL_GENERIC));
+
+    VERIFY(engine->SetDefaultNamespace("Debug"));
+    VERIFY(engine->RegisterGlobalFunction("void Wait()", asFUNCTION(Script::Debug::Wait), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("void Run()", asFUNCTION(Script::Debug::Run), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("void Pause()", asFUNCTION(Script::Debug::Pause), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("void Stop()", asFUNCTION(Script::Debug::Stop), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("void StepIn()", asFUNCTION(Script::Debug::StepIn), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("void StepOver()", asFUNCTION(Script::Debug::StepOver), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("void StepOut()", asFUNCTION(Script::Debug::StepOut), asCALL_CDECL));
+
+    VERIFY(engine->SetDefaultNamespace("Memory"));
+    VERIFY(engine->RegisterGlobalFunction("byte ReadByte(duint addr)", asFUNCTION(Script::Memory::ReadByte), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool WriteByte(duint addr, byte value)", asFUNCTION(Script::Memory::WriteByte), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("word ReadWord(duint addr)", asFUNCTION(Script::Memory::ReadWord), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool WriteWord(duint addr, word value)", asFUNCTION(Script::Memory::WriteWord), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("dword ReadDword(duint addr)", asFUNCTION(Script::Memory::ReadDword), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool WriteDword(duint addr, dword value)", asFUNCTION(Script::Memory::WriteDword), asCALL_CDECL));
+#ifdef _WIN64
+    VERIFY(engine->RegisterGlobalFunction("qword ReadQword(duint addr)", asFUNCTION(Script::Memory::ReadQword), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool WriteQword(duint addr, qword value)", asFUNCTION(Script::Memory::WriteQword), asCALL_CDECL));
+#endif //_WIN64
+    VERIFY(engine->RegisterGlobalFunction("duint ReadPtr(duint addr)", asFUNCTION(Script::Memory::ReadPtr), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool WritePtr(duint addr, duint value)", asFUNCTION(Script::Memory::WritePtr), asCALL_CDECL));
+
+    VERIFY(engine->SetDefaultNamespace("Register"));
+    VERIFY(engine->RegisterGlobalFunction("duint GetDR0()", asFUNCTION(Script::Register::GetDR0), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetDR0(duint value)", asFUNCTION(Script::Register::SetDR0), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("duint GetDR1()", asFUNCTION(Script::Register::GetDR1), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetDR1(duint value)", asFUNCTION(Script::Register::SetDR1), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("duint GetDR2()", asFUNCTION(Script::Register::GetDR2), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetDR2(duint value)", asFUNCTION(Script::Register::SetDR2), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("duint GetDR3()", asFUNCTION(Script::Register::GetDR3), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetDR3(duint value)", asFUNCTION(Script::Register::SetDR3), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("duint GetDR6()", asFUNCTION(Script::Register::GetDR6), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetDR6(duint value)", asFUNCTION(Script::Register::SetDR6), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("duint GetDR7()", asFUNCTION(Script::Register::GetDR7), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetDR7(duint value)", asFUNCTION(Script::Register::SetDR7), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("dword GetEAX()", asFUNCTION(Script::Register::GetEAX), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetEAX(dword value)", asFUNCTION(Script::Register::SetEAX), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("word GetAX()", asFUNCTION(Script::Register::GetAX), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetAX(word value)", asFUNCTION(Script::Register::SetAX), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("byte GetAH()", asFUNCTION(Script::Register::GetAH), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetAH(byte value)", asFUNCTION(Script::Register::SetAH), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("byte GetAL()", asFUNCTION(Script::Register::GetAL), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetAL(byte value)", asFUNCTION(Script::Register::SetAL), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("dword GetEBX()", asFUNCTION(Script::Register::GetEBX), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetEBX(dword value)", asFUNCTION(Script::Register::SetEBX), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("word GetBX()", asFUNCTION(Script::Register::GetBX), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetBX(word value)", asFUNCTION(Script::Register::SetBX), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("byte GetBH()", asFUNCTION(Script::Register::GetBH), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetBH(byte value)", asFUNCTION(Script::Register::SetBH), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("byte GetBL()", asFUNCTION(Script::Register::GetBL), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetBL(byte value)", asFUNCTION(Script::Register::SetBL), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("dword GetECX()", asFUNCTION(Script::Register::GetECX), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetECX(dword value)", asFUNCTION(Script::Register::SetECX), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("word GetCX()", asFUNCTION(Script::Register::GetCX), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetCX(word value)", asFUNCTION(Script::Register::SetCX), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("byte GetCH()", asFUNCTION(Script::Register::GetCH), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetCH(byte value)", asFUNCTION(Script::Register::SetCH), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("byte GetCL()", asFUNCTION(Script::Register::GetCL), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetCL(byte value)", asFUNCTION(Script::Register::SetCL), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("dword GetEDX()", asFUNCTION(Script::Register::GetEDX), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetEDX(dword value)", asFUNCTION(Script::Register::SetEDX), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("word GetDX()", asFUNCTION(Script::Register::GetDX), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetDX(word value)", asFUNCTION(Script::Register::SetDX), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("byte GetDH()", asFUNCTION(Script::Register::GetDH), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetDH(byte value)", asFUNCTION(Script::Register::SetDH), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("byte GetDL()", asFUNCTION(Script::Register::GetDL), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetDL(byte value)", asFUNCTION(Script::Register::SetDL), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("dword GetEDI()", asFUNCTION(Script::Register::GetEDI), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetEDI(dword value)", asFUNCTION(Script::Register::SetEDI), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("word GetDI()", asFUNCTION(Script::Register::GetDI), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetDI(word value)", asFUNCTION(Script::Register::SetDI), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("dword GetESI()", asFUNCTION(Script::Register::GetESI), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetESI(dword value)", asFUNCTION(Script::Register::SetESI), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("word GetSI()", asFUNCTION(Script::Register::GetSI), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetSI(word value)", asFUNCTION(Script::Register::SetSI), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("dword GetEBP()", asFUNCTION(Script::Register::GetEBP), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetEBP(dword value)", asFUNCTION(Script::Register::SetEBP), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("word GetBP()", asFUNCTION(Script::Register::GetBP), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetBP(word value)", asFUNCTION(Script::Register::SetBP), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("dword GetESP()", asFUNCTION(Script::Register::GetESP), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetESP(dword value)", asFUNCTION(Script::Register::SetESP), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("word GetSP()", asFUNCTION(Script::Register::GetSP), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetSP(word value)", asFUNCTION(Script::Register::SetSP), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("dword GetEIP()", asFUNCTION(Script::Register::GetEIP), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetEIP(dword value)", asFUNCTION(Script::Register::SetEIP), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("duint GetCIP()", asFUNCTION(Script::Register::GetCIP), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetCIP(duint value)", asFUNCTION(Script::Register::SetCIP), asCALL_CDECL));
+#ifdef _WIN64
+    VERIFY(engine->RegisterGlobalFunction("uint64 GetRAX()", asFUNCTION(Script::Register::GetRAX), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetRAX(uint64 value)", asFUNCTION(Script::Register::SetRAX), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("uint64 GetRBX()", asFUNCTION(Script::Register::GetRBX), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetRBX(uint64 value)", asFUNCTION(Script::Register::SetRBX), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("uint64 GetRCX()", asFUNCTION(Script::Register::GetRCX), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetRCX(uint64 value)", asFUNCTION(Script::Register::SetRCX), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("uint64 GetRDX()", asFUNCTION(Script::Register::GetRDX), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetRDX(uint64 value)", asFUNCTION(Script::Register::SetRDX), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("uint64 GetRSI()", asFUNCTION(Script::Register::GetRSI), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetRSI(uint64 value)", asFUNCTION(Script::Register::SetRSI), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("byte GetSIL()", asFUNCTION(Script::Register::GetSIL), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetSIL(byte value)", asFUNCTION(Script::Register::SetSIL), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("uint64 GetRDI()", asFUNCTION(Script::Register::GetRDI), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetRDI(uint64 value)", asFUNCTION(Script::Register::SetRDI), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("byte GetDIL()", asFUNCTION(Script::Register::GetDIL), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetDIL(byte value)", asFUNCTION(Script::Register::SetDIL), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("uint64 GetRBP()", asFUNCTION(Script::Register::GetRBP), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetRBP(uint64 value)", asFUNCTION(Script::Register::SetRBP), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("byte GetBPL()", asFUNCTION(Script::Register::GetBPL), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetBPL(byte value)", asFUNCTION(Script::Register::SetBPL), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("uint64 GetRSP()", asFUNCTION(Script::Register::GetRSP), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetRSP(uint64 value)", asFUNCTION(Script::Register::SetRSP), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("byte GetSPL()", asFUNCTION(Script::Register::GetSPL), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetSPL(byte value)", asFUNCTION(Script::Register::SetSPL), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("uint64 GetRIP()", asFUNCTION(Script::Register::GetRIP), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetRIP(uint64 value)", asFUNCTION(Script::Register::SetRIP), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("uint64 GetR8()", asFUNCTION(Script::Register::GetR8), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetR8(uint64 value)", asFUNCTION(Script::Register::SetR8), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("dword GetR8D()", asFUNCTION(Script::Register::GetR8D), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetR8D(dword value)", asFUNCTION(Script::Register::SetR8D), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("word GetR8W()", asFUNCTION(Script::Register::GetR8W), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetR8W(word value)", asFUNCTION(Script::Register::SetR8W), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("byte GetR8B()", asFUNCTION(Script::Register::GetR8B), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetR8B(byte value)", asFUNCTION(Script::Register::SetR8B), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("uint64 GetR9()", asFUNCTION(Script::Register::GetR9), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetR9(uint64 value)", asFUNCTION(Script::Register::SetR9), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("dword GetR9D()", asFUNCTION(Script::Register::GetR9D), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetR9D(dword value)", asFUNCTION(Script::Register::SetR9D), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("word GetR9W()", asFUNCTION(Script::Register::GetR9W), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetR9W(word value)", asFUNCTION(Script::Register::SetR9W), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("byte GetR9B()", asFUNCTION(Script::Register::GetR9B), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetR9B(byte value)", asFUNCTION(Script::Register::SetR9B), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("uint64 GetR10()", asFUNCTION(Script::Register::GetR10), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetR10(uint64 value)", asFUNCTION(Script::Register::SetR10), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("dword GetR10D()", asFUNCTION(Script::Register::GetR10D), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetR10D(dword value)", asFUNCTION(Script::Register::SetR10D), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("word GetR10W()", asFUNCTION(Script::Register::GetR10W), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetR10W(word value)", asFUNCTION(Script::Register::SetR10W), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("byte GetR10B()", asFUNCTION(Script::Register::GetR10B), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetR10B(byte value)", asFUNCTION(Script::Register::SetR10B), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("uint64 GetR11()", asFUNCTION(Script::Register::GetR11), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetR11(uint64 value)", asFUNCTION(Script::Register::SetR11), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("dword GetR11D()", asFUNCTION(Script::Register::GetR11D), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetR11D(dword value)", asFUNCTION(Script::Register::SetR11D), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("word GetR11W()", asFUNCTION(Script::Register::GetR11W), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetR11W(word value)", asFUNCTION(Script::Register::SetR11W), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("byte GetR11B()", asFUNCTION(Script::Register::GetR11B), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetR11B(byte value)", asFUNCTION(Script::Register::SetR11B), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("uint64 GetR12()", asFUNCTION(Script::Register::GetR12), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetR12(uint64 value)", asFUNCTION(Script::Register::SetR12), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("dword GetR12D()", asFUNCTION(Script::Register::GetR12D), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetR12D(dword value)", asFUNCTION(Script::Register::SetR12D), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("word GetR12W()", asFUNCTION(Script::Register::GetR12W), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetR12W(word value)", asFUNCTION(Script::Register::SetR12W), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("byte GetR12B()", asFUNCTION(Script::Register::GetR12B), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetR12B(byte value)", asFUNCTION(Script::Register::SetR12B), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("uint64 GetR13()", asFUNCTION(Script::Register::GetR13), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetR13(uint64 value)", asFUNCTION(Script::Register::SetR13), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("dword GetR13D()", asFUNCTION(Script::Register::GetR13D), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetR13D(dword value)", asFUNCTION(Script::Register::SetR13D), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("word GetR13W()", asFUNCTION(Script::Register::GetR13W), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetR13W(word value)", asFUNCTION(Script::Register::SetR13W), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("byte GetR13B()", asFUNCTION(Script::Register::GetR13B), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetR13B(byte value)", asFUNCTION(Script::Register::SetR13B), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("uint64 GetR14()", asFUNCTION(Script::Register::GetR14), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetR14(uint64 value)", asFUNCTION(Script::Register::SetR14), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("dword GetR14D()", asFUNCTION(Script::Register::GetR14D), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetR14D(dword value)", asFUNCTION(Script::Register::SetR14D), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("word GetR14W()", asFUNCTION(Script::Register::GetR14W), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetR14W(word value)", asFUNCTION(Script::Register::SetR14W), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("byte GetR14B()", asFUNCTION(Script::Register::GetR14B), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetR14B(byte value)", asFUNCTION(Script::Register::SetR14B), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("uint64 GetR15()", asFUNCTION(Script::Register::GetR15), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetR15(uint64 value)", asFUNCTION(Script::Register::SetR15), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("dword GetR15D()", asFUNCTION(Script::Register::GetR15D), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetR15D(dword value)", asFUNCTION(Script::Register::SetR15D), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("word GetR15W()", asFUNCTION(Script::Register::GetR15W), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetR15W(word value)", asFUNCTION(Script::Register::SetR15W), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("byte GetR15B()", asFUNCTION(Script::Register::GetR15B), asCALL_CDECL));
+    VERIFY(engine->RegisterGlobalFunction("bool SetR15B(byte value)", asFUNCTION(Script::Register::SetR15B), asCALL_CDECL));
+#endif //_WIN64
+}
+
+static int CompileScript(asIScriptEngine* engine)
+{
+    int r;
+
+    char scriptFile[GUI_MAX_LINE_SIZE] = "";
+    if(!GuiGetLineWindow("Script file", scriptFile))
+    {
+        _plugin_logputs("[TEST] No script to open...");
+        return -1;
+    }
+
+    // We will load the script from a file on the disk.
+    FILE* f = fopen(scriptFile, "rb");
+    if(f == 0)
+    {
+        _plugin_logprintf("[TEST] Failed to open the script file \"%s\"\n", scriptFile);
+        return -1;
+    }
+
+    // Determine the size of the file
+    fseek(f, 0, SEEK_END);
+    int len = ftell(f);
+    fseek(f, 0, SEEK_SET);
+
+    // On Win32 it is possible to do the following instead
+    // int len = _filelength(_fileno(f));
+
+    // Read the entire file
+    std::string script;
+    script.resize(len);
+    size_t c = fread(&script[0], len, 1, f);
+    fclose(f);
+
+    if(c == 0)
+    {
+        _plugin_logprintf("[TEST] Failed to load the script file \"%s\"\n", scriptFile);
+        return -1;
+    }
+
+    // Add the script sections that will be compiled into executable code.
+    // If we want to combine more than one file into the same script, then
+    // we can call AddScriptSection() several times for the same module and
+    // the script engine will treat them all as if they were one. The script
+    // section name, will allow us to localize any errors in the script code.
+    asIScriptModule* mod = engine->GetModule(0, asGM_ALWAYS_CREATE);
+    r = mod->AddScriptSection("script", &script[0], len);
+    if(r < 0)
+    {
+        _plugin_logputs("[TEST] AddScriptSection() failed!");
+        return -1;
+    }
+
+    // Compile the script. If there are any compiler messages they will
+    // be written to the message stream that we set right after creating the
+    // script engine. If there are no errors, and no warnings, nothing will
+    // be written to the stream.
+    r = mod->Build();
+    if(r < 0)
+    {
+        _plugin_logputs("[TEST] Build() failed!");
+        return -1;
+    }
+
+    // The engine doesn't keep a copy of the script sections after Build() has
+    // returned. So if the script needs to be recompiled, then all the script
+    // sections must be added again.
+
+    // If we want to have several scripts executing at different times but
+    // that have no direct relation with each other, then we can compile them
+    // into separate script modules. Each module use their own namespace and
+    // scope, so function names, and global variables will not conflict with
+    // each other.
+
+    return 0;
+}
+
+static int RunApplication()
+{
+    int r;
+
+    // Create the script engine
+    asIScriptEngine* engine = asCreateScriptEngine(ANGELSCRIPT_VERSION);
+    if(engine == 0)
+    {
+        _plugin_logputs("[TEST] Failed to create script engine!");
+        return -1;
+    }
+
+    // The script compiler will write any compiler messages to the callback.
+    engine->SetMessageCallback(asFUNCTION(MessageCallback), 0, asCALL_CDECL);
+
+    // Configure the script engine with all the functions,
+    // and variables that the script should be able to use.
+    ConfigureEngine(engine);
+
+    // Compile the script code
+    r = CompileScript(engine);
+    if(r < 0)
+    {
+        engine->Release();
+        return -1;
+    }
+
+    // Create a context that will execute the script.
+    asIScriptContext* ctx = engine->CreateContext();
+    if(ctx == 0)
+    {
+        _plugin_logputs("[TEST] Failed to create the context");
+        engine->Release();
+        return -1;
+    }
+
+    // Find the function for the function we want to execute.
+    asIScriptFunction* func = engine->GetModule(0)->GetFunctionByDecl("void main()");
+    if(func == 0)
+    {
+        _plugin_logputs("[TEST] The function 'void main()' was not found!");
+        ctx->Release();
+        engine->Release();
+        return -1;
+    }
+
+    // Prepare the script context with the function we wish to execute. Prepare()
+    // must be called on the context before each new script function that will be
+    // executed. Note, that if you intend to execute the same function several
+    // times, it might be a good idea to store the function returned by
+    // GetFunctionByDecl(), so that this relatively slow call can be skipped.
+    r = ctx->Prepare(func);
+    if(r < 0)
+    {
+        _plugin_logputs("[TEST] Failed to prepare the context!");
+        ctx->Release();
+        engine->Release();
+        return -1;
+    }
+
+    // Execute the function
+    _plugin_logputs("[TEST] Executing the script...");
+    r = ctx->Execute();
+    if(r != asEXECUTION_FINISHED)
+    {
+        // The execution didn't finish as we had planned. Determine why.
+        if(r == asEXECUTION_ABORTED)
+            _plugin_logputs("[TEST] The script was aborted before it could finish.");
+        else if(r == asEXECUTION_EXCEPTION)
+        {
+            _plugin_logputs("[TEST] The script ended with an exception.");
+
+            // Write some information about the script exception
+            asIScriptFunction* func = ctx->GetExceptionFunction();
+            _plugin_logprintf("[TEST] func: %s\n", func->GetDeclaration());
+            _plugin_logprintf("[TEST] modl: %s\n", func->GetModuleName());
+            _plugin_logprintf("[TEST] sect: %s\n", func->GetScriptSectionName());
+            _plugin_logprintf("[TEST] line: %d\n", ctx->GetExceptionLineNumber());
+            _plugin_logprintf("[TEST] desc: %s\n", ctx->GetExceptionString());
+        }
+        else
+            _plugin_logprintf("[TEST] The script ended for some unforeseen reason %d\n", r);
+    }
+    else
+    {
+        _plugin_logputs("[TEST] The script function returned.");
+    }
+
+    // We must release the contexts when no longer using them
+    ctx->Release();
+
+    // Shut down the engine
+    engine->ShutDownAndRelease();
+
+    return 0;
+}
+
+void cbScript()
+{
+    RunApplication();
+}

script.h

@@ -0,0 +1,8 @@
+#ifndef _SCRIPT_H
+#define _SCRIPT_H
+
+#include "pluginmain.h"
+
+void cbScript();
+
+#endif //_SCRIPT_H

test.cpp

@@ -5,14 +5,16 @@
 #include <stdio.h>
 #include <psapi.h>
 #include "icons.h"
+#include "script.h"
+#include "pluginsdk\_scriptapi_module.h"
 
 static void adler32selection(const SELECTIONDATA & sel)
 {
-    int len = sel.end - sel.start + 1;
+    duint len = sel.end - sel.start + 1;
     unsigned char* data = new unsigned char[len];
     DbgMemRead(sel.start, data, len);
     DWORD a = 1, b = 0;
-    for(int index = 0; index < len; ++index)
+    for(duint index = 0; index < len; ++index)
     {
         a = (a + data[index]) % 65521;
         b = (b + a) % 65521;
@@ -200,6 +202,12 @@ extern "C" __declspec(dllexport) void CBMENUENTRY(CBTYPE cbType, PLUG_CB_MENUENT
         adler32selection(sel);
     }
     break;
+
+    case MENU_SCRIPT:
+    {
+        _plugin_startscript(cbScript);
+    }
+    break;
     }
 }
 
@@ -375,6 +383,35 @@ bool cbGraph(int argc, char* argv[])
     return true;
 }
 
+bool cbModuleEnum(int argc, char* argv[])
+{
+    using namespace Script;
+    BridgeList<Module::ModuleInfo> modList;
+    if (Module::GetList(&modList))
+    {
+        for (int i = 0; i < modList.Count(); i++)
+        {
+            _plugin_logprintf("Base: %p, Size: %p, Name: \"%s\"\n", modList[i].base, modList[i].size, modList[i].name);
+            BridgeList<Module::ModuleSectionInfo> sectionList;
+            if (Module::SectionListFromAddr(modList[i].base, &sectionList))
+            {
+                for (int j = 0; j < sectionList.Count(); j++)
+                    _plugin_logprintf("  Addr: %p, Size: %p, Name: \"%s\"\n", sectionList[j].addr, sectionList[j].size, sectionList[j].name);
+            }
+            else
+                _plugin_logputs("[TEST] Module::SectionListFromAddr() failed...");
+        }
+    }
+    else
+        _plugin_logputs("[TEST] Module::GetList() failed...");
+    return true;
+}
+
+static duint exprZero(int argc, duint* argv, void* userdata)
+{
+	return 0;
+}
+
 void testInit(PLUG_INITSTRUCT* initStruct)
 {
     _plugin_logprintf("[TEST] pluginHandle: %d\n", pluginHandle);
@@ -386,6 +423,10 @@ void testInit(PLUG_INITSTRUCT* initStruct)
         _plugin_logputs("[TEST] error registering the \"grs\" command!");
     if(!_plugin_registercommand(pluginHandle, "graph", cbGraph, true))
         _plugin_logputs("[TEST] error registering the \"graph\" command!");
+    if (!_plugin_registercommand(pluginHandle, "modenum", cbModuleEnum, true))
+        _plugin_logputs("[TEST] error registering the \"modenum\" command!");
+    if (!_plugin_registerexprfunction(pluginHandle, "testplugin.zero", 0, exprZero, 0))
+        _plugin_logputs("[TEST] error registering the \"testplugin.zero\" expression function!");
 }
 
 void testStop()
@@ -393,6 +434,7 @@ void testStop()
     _plugin_unregistercommand(pluginHandle, "plugin1");
     _plugin_unregistercommand(pluginHandle, "DumpProcess");
     _plugin_unregistercommand(pluginHandle, "grs");
+    _plugin_unregistercommand(pluginHandle, "modenum");
     _plugin_menuclear(hMenu);
     _plugin_menuclear(hMenuDisasm);
     _plugin_menuclear(hMenuDump);
@@ -417,6 +459,7 @@ void testSetup()
     _plugin_menuaddentry(hMenu, MENU_TEST, "&Menu Test");
     _plugin_menuaddentry(hMenu, MENU_SELECTION, "&Selection API Test");
     _plugin_menuaddentry(hMenu, MENU_FILEOFFSET, "Follow &File Offset...");
+    _plugin_menuaddentry(hMenu, MENU_SCRIPT, "&Test script...");
     int hGraphMenu = _plugin_menuadd(hMenu, "&Graph");
     _plugin_menuaddentry(hGraphMenu, MENU_GRAPH_SELECTION, "&Selection");
     _plugin_menuaddentry(hGraphMenu, MENU_GRAPH_FUNCTION, "&Function");

test.h

@@ -10,12 +10,13 @@
 #define MENU_FILEOFFSET 3
 #define MENU_GRAPH_SELECTION 4
 #define MENU_GRAPH_FUNCTION 5
+#define MENU_SCRIPT 6
 
-#define MENU_DISASM_ADLER32 6
-#define MENU_DUMP_ADLER32 7
-#define MENU_STACK_ADLER32 8
-#define MENU_DISASM_GRAPH_SELECTION 9
-#define MENU_DISASM_GRAPH_FUNCTION 10
+#define MENU_DISASM_ADLER32 7
+#define MENU_DUMP_ADLER32 8
+#define MENU_STACK_ADLER32 9
+#define MENU_DISASM_GRAPH_SELECTION 10
+#define MENU_DISASM_GRAPH_FUNCTION 11
 
 //functions
 void testInit(PLUG_INITSTRUCT* initStruct);

x64_dbg_testplugin.vcxproj

@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="12.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
   <ItemGroup Label="ProjectConfigurations">
     <ProjectConfiguration Include="Release|Win32">
       <Configuration>Release</Configuration>
@@ -11,14 +11,19 @@
     </ProjectConfiguration>
   </ItemGroup>
   <ItemGroup>
+    <ClCompile Include="angelscript\scriptstdstring.cpp" />
     <ClCompile Include="FunctionGraph.cpp" />
     <ClCompile Include="pluginmain.cpp" />
+    <ClCompile Include="script.cpp" />
     <ClCompile Include="test.cpp" />
   </ItemGroup>
   <ItemGroup>
+    <ClInclude Include="angelscript\angelscript.h" />
+    <ClInclude Include="angelscript\scriptstdstring.h" />
     <ClInclude Include="FunctionGraph.h" />
     <ClInclude Include="icons.h" />
     <ClInclude Include="pluginmain.h" />
+    <ClInclude Include="pluginsdk\bridgelist.h" />
     <ClInclude Include="pluginsdk\bridgemain.h" />
     <ClInclude Include="pluginsdk\capstone\arm.h" />
     <ClInclude Include="pluginsdk\capstone\arm64.h" />
@@ -72,19 +77,40 @@
     <ClInclude Include="pluginsdk\_dbgfunctions.h" />
     <ClInclude Include="pluginsdk\_plugins.h" />
     <ClInclude Include="pluginsdk\_plugin_types.h" />
+    <ClInclude Include="pluginsdk\_scriptapi.h" />
+    <ClInclude Include="pluginsdk\_scriptapi_argument.h" />
+    <ClInclude Include="pluginsdk\_scriptapi_assembler.h" />
+    <ClInclude Include="pluginsdk\_scriptapi_bookmark.h" />
+    <ClInclude Include="pluginsdk\_scriptapi_comment.h" />
+    <ClInclude Include="pluginsdk\_scriptapi_debug.h" />
+    <ClInclude Include="pluginsdk\_scriptapi_flag.h" />
+    <ClInclude Include="pluginsdk\_scriptapi_function.h" />
+    <ClInclude Include="pluginsdk\_scriptapi_gui.h" />
+    <ClInclude Include="pluginsdk\_scriptapi_label.h" />
+    <ClInclude Include="pluginsdk\_scriptapi_memory.h" />
+    <ClInclude Include="pluginsdk\_scriptapi_misc.h" />
+    <ClInclude Include="pluginsdk\_scriptapi_module.h" />
+    <ClInclude Include="pluginsdk\_scriptapi_pattern.h" />
+    <ClInclude Include="pluginsdk\_scriptapi_register.h" />
+    <ClInclude Include="pluginsdk\_scriptapi_stack.h" />
+    <ClInclude Include="pluginsdk\_scriptapi_symbol.h" />
+    <ClInclude Include="script.h" />
     <ClInclude Include="test.h" />
   </ItemGroup>
   <PropertyGroup Label="Globals">
     <Keyword>Win32Proj</Keyword>
+    <ProjectGuid>{C1055F2B-A0C2-0005-0D1B-3C99DC93F137}</ProjectGuid>
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
     <ConfigurationType>DynamicLibrary</ConfigurationType>
     <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>v120_xp</PlatformToolset>
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
     <ConfigurationType>DynamicLibrary</ConfigurationType>
     <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>v120_xp</PlatformToolset>
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
   <ImportGroup Label="ExtensionSettings">
@@ -122,7 +148,7 @@
       <SubSystem>Windows</SubSystem>
       <EnableCOMDATFolding>true</EnableCOMDATFolding>
       <OptimizeReferences>true</OptimizeReferences>
-      <AdditionalDependencies>psapi.lib;pluginsdk\x32dbg.lib;pluginsdk\x32bridge.lib;pluginsdk\TitanEngine\TitanEngine_x86.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>winmm.lib;angelscript\angelscript.lib;psapi.lib;pluginsdk\x32dbg.lib;pluginsdk\x32bridge.lib;pluginsdk\TitanEngine\TitanEngine_x86.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
@@ -137,7 +163,7 @@
       <SubSystem>Windows</SubSystem>
       <EnableCOMDATFolding>true</EnableCOMDATFolding>
       <OptimizeReferences>true</OptimizeReferences>
-      <AdditionalDependencies>psapi.lib;pluginsdk\x64dbg.lib;pluginsdk\x64bridge.lib;pluginsdk\TitanEngine\TitanEngine_x64.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>winmm.lib;angelscript\angelscript64.lib;psapi.lib;pluginsdk\x64dbg.lib;pluginsdk\x64bridge.lib;pluginsdk\TitanEngine\TitanEngine_x64.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />

x64_dbg_testplugin.vcxproj.filters

@@ -43,6 +43,12 @@
     <Filter Include="Header Files\pluginsdk\capstone">
       <UniqueIdentifier>{159fe27f-06af-4f64-ab68-272e61a3608e}</UniqueIdentifier>
     </Filter>
+    <Filter Include="Header Files\angelscript">
+      <UniqueIdentifier>{575af53e-a968-430f-8b8b-68ac2984f882}</UniqueIdentifier>
+    </Filter>
+    <Filter Include="Source Files\angelscript">
+      <UniqueIdentifier>{1581c677-40a6-4e25-9f8c-f7f5f882507a}</UniqueIdentifier>
+    </Filter>
   </ItemGroup>
   <ItemGroup>
     <ClCompile Include="pluginmain.cpp">
@@ -54,6 +60,12 @@
     <ClCompile Include="FunctionGraph.cpp">
       <Filter>Source Files</Filter>
     </ClCompile>
+    <ClCompile Include="script.cpp">
+      <Filter>Source Files</Filter>
+    </ClCompile>
+    <ClCompile Include="angelscript\scriptstdstring.cpp">
+      <Filter>Source Files\angelscript</Filter>
+    </ClCompile>
   </ItemGroup>
   <ItemGroup>
     <ClInclude Include="pluginmain.h">
@@ -227,5 +239,68 @@
     <ClInclude Include="icons.h">
       <Filter>Header Files</Filter>
     </ClInclude>
+    <ClInclude Include="script.h">
+      <Filter>Header Files</Filter>
+    </ClInclude>
+    <ClInclude Include="angelscript\scriptstdstring.h">
+      <Filter>Header Files\angelscript</Filter>
+    </ClInclude>
+    <ClInclude Include="angelscript\angelscript.h">
+      <Filter>Header Files\angelscript</Filter>
+    </ClInclude>
+    <ClInclude Include="pluginsdk\_scriptapi.h">
+      <Filter>Header Files\pluginsdk</Filter>
+    </ClInclude>
+    <ClInclude Include="pluginsdk\_scriptapi_assembler.h">
+      <Filter>Header Files\pluginsdk</Filter>
+    </ClInclude>
+    <ClInclude Include="pluginsdk\_scriptapi_debug.h">
+      <Filter>Header Files\pluginsdk</Filter>
+    </ClInclude>
+    <ClInclude Include="pluginsdk\_scriptapi_gui.h">
+      <Filter>Header Files\pluginsdk</Filter>
+    </ClInclude>
+    <ClInclude Include="pluginsdk\_scriptapi_memory.h">
+      <Filter>Header Files\pluginsdk</Filter>
+    </ClInclude>
+    <ClInclude Include="pluginsdk\_scriptapi_misc.h">
+      <Filter>Header Files\pluginsdk</Filter>
+    </ClInclude>
+    <ClInclude Include="pluginsdk\_scriptapi_module.h">
+      <Filter>Header Files\pluginsdk</Filter>
+    </ClInclude>
+    <ClInclude Include="pluginsdk\_scriptapi_pattern.h">
+      <Filter>Header Files\pluginsdk</Filter>
+    </ClInclude>
+    <ClInclude Include="pluginsdk\_scriptapi_register.h">
+      <Filter>Header Files\pluginsdk</Filter>
+    </ClInclude>
+    <ClInclude Include="pluginsdk\_scriptapi_stack.h">
+      <Filter>Header Files\pluginsdk</Filter>
+    </ClInclude>
+    <ClInclude Include="pluginsdk\bridgelist.h">
+      <Filter>Header Files\pluginsdk</Filter>
+    </ClInclude>
+    <ClInclude Include="pluginsdk\_scriptapi_argument.h">
+      <Filter>Header Files\pluginsdk</Filter>
+    </ClInclude>
+    <ClInclude Include="pluginsdk\_scriptapi_bookmark.h">
+      <Filter>Header Files\pluginsdk</Filter>
+    </ClInclude>
+    <ClInclude Include="pluginsdk\_scriptapi_comment.h">
+      <Filter>Header Files\pluginsdk</Filter>
+    </ClInclude>
+    <ClInclude Include="pluginsdk\_scriptapi_flag.h">
+      <Filter>Header Files\pluginsdk</Filter>
+    </ClInclude>
+    <ClInclude Include="pluginsdk\_scriptapi_function.h">
+      <Filter>Header Files\pluginsdk</Filter>
+    </ClInclude>
+    <ClInclude Include="pluginsdk\_scriptapi_label.h">
+      <Filter>Header Files\pluginsdk</Filter>
+    </ClInclude>
+    <ClInclude Include="pluginsdk\_scriptapi_symbol.h">
+      <Filter>Header Files\pluginsdk</Filter>
+    </ClInclude>
   </ItemGroup>
 </Project>