#pragma once #include #include #include #include #define ABS_TO_IMG( addr, mod_base, img_base ) ( addr - mod_base ) + img_base #define LEA_R12_SIG "\x4C\x8D\x25\x00\x00\x00\x00" #define LEA_R12_MASK "xxx????" #define PUSH_4B_IMM "\x68\x00\x00\x00\x00" #define PUSH_4B_MASK "x????" namespace vm::locate { struct vm_handler_table_info_t { std::uint32_t rva, lea_r12_rva; zydis_decoded_instr_t lea_r12_instr; }; std::vector< vm_handler_table_info_t > all_handler_tables( std::uintptr_t module_base ); std::vector< std::pair< std::uint32_t, std::uint32_t > > all_vm_enters( std::uintptr_t module_base, std::vector< vm_handler_table_info_t > &vm_handler_tables ); } // namespace vm::locate