process.cpp

#include "include/process.h"

int get_pid_internal(std::string process_name) {
	HANDLE snapshot;
	PROCESSENTRY32W pe;
	int pid = 0;
	BOOL result;
	snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
	if (INVALID_HANDLE_VALUE == snapshot) return 0;
	pe.dwSize = sizeof(PROCESSENTRY32W);
	result = Process32FirstW(snapshot, &pe);
	while (result) {
		std::wstring process_name_ws = std::wstring(process_name.begin(), process_name.end());
		const wchar_t* process_name_wc = process_name_ws.c_str();
		if (wcscmp(process_name_wc, pe.szExeFile) == 0) {
			pid = pe.th32ProcessID;
			break;
		}
		result = Process32NextW(snapshot, &pe);
	}
	CloseHandle(snapshot);
	return pid;
}

DWORD get_main_thread(DWORD processId)
{
	HANDLE snap = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);
	THREADENTRY32 thread;
	thread.dwSize = sizeof(THREADENTRY32);
	if (Thread32First(snap, &thread))
	{
		while (Thread32Next(snap, &thread))
		{
			if (thread.th32OwnerProcessID == processId)
			{
				CloseHandle(snap);
				return thread.th32ThreadID;
			}
		}
	}
	CloseHandle(snap);
	return (EXIT_FAILURE);
}

Process::Process(std::string name)
{
	this->name = name;
	this->pid = get_pid_internal(name);
	Hijacker h(this->pid);
	this->handle = h.get();
	Thread t(get_main_thread(this->pid));
    this->mainthread = std::move(t);
}

Process Process::create_process(std::string name, std::wstring file, ULONG flag) {
    NTSTATUS stat;
    std::wstring nt_path = L"\\??\\" + file;
    OBJECT_ATTRIBUTES objattr{};
    WCHAR wstrobjname[MAX_PATH];
    wcsncpy_s(wstrobjname, nt_path.c_str(), MAX_PATH - 1);
    UNICODE_STRING objname{};
    objname.Buffer = wstrobjname;
    objname.Length = static_cast<USHORT>(nt_path.size() * sizeof(WCHAR));
    objname.MaximumLength = objname.Length + sizeof(WCHAR);
    InitializeObjectAttributes(&objattr, &objname, 0, NULL, NULL);
    stat = Sw3NtCreateProcessEx(NULL, GENERIC_ALL, &objattr, GetCurrentProcess(), flag, NULL, NULL, NULL, false);
    if (stat != 0) {
        printf("[%s] Failed at creating process (%x)\n", __FUNCTION__, stat);
    }
    return Process(name);
}

int Process::get_pid()
{
	return this->pid;
}

std::string Process::get_name()
{
	return this->name;
}

HANDLE Process::get_handle()
{
	return this->handle;
}

const Thread& Process::get_mainthread() const
{
	return this->mainthread;
}

bool Process::enable_privilege(LPCWSTR privilege) {
    HANDLE token;
    if (!OpenProcessToken(this->handle, TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &token))
        return false;
    LUID luid;
    if (!LookupPrivilegeValueW(NULL, privilege, &luid)) {
        CloseHandle(token);
        return false;
    }
    TOKEN_PRIVILEGES tp;
    tp.PrivilegeCount = 1;
    tp.Privileges[0].Luid = luid;
    tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
    bool success = AdjustTokenPrivileges(token, FALSE, &tp, sizeof(TOKEN_PRIVILEGES), NULL, NULL);
    CloseHandle(token);
    return success && GetLastError() == ERROR_SUCCESS;
}

std::vector<Thread> Process::get_threads() {
	std::vector<Thread> threads;
	HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);
	if (snapshot == INVALID_HANDLE_VALUE) return threads;
	THREADENTRY32 te32 = { sizeof(THREADENTRY32) };
	if (Thread32First(snapshot, &te32)) {
		do {
			if (te32.th32OwnerProcessID == this->pid) {
				threads.emplace_back(te32.th32ThreadID);
			}
		} while (Thread32Next(snapshot, &te32));
	}
	CloseHandle(snapshot);
	return threads;
}

void Process::suspend_all_threads()
{
    auto threads = get_threads();
    for (auto& thread : threads) {
        thread.suspend();
    }
}

std::vector<NormalSection> Process::get_sections()
{
    std::vector<NormalSection> sections;
    ULONG handleInfoSize = 0x10000;
    PVOID handleInfoBuffer = malloc(handleInfoSize);
    if (!handleInfoBuffer)
        return sections;
    ULONG returnLength = 0;
    NTSTATUS status = Sw3NtQuerySystemInformation(
        SystemHandleInformation,
        handleInfoBuffer,
        handleInfoSize,
        &returnLength
    );
    while (status == STATUS_INFO_LENGTH_MISMATCH) {
        free(handleInfoBuffer);
        handleInfoSize = returnLength;
        handleInfoBuffer = malloc(handleInfoSize);
        if (!handleInfoBuffer)
            return sections;
        status = Sw3NtQuerySystemInformation(SystemHandleInformation, handleInfoBuffer, handleInfoSize, &returnLength);
    }
    if (!NT_SUCCESS(status)) {
        free(handleInfoBuffer);
        return sections;
    }
    PSYSTEM_HANDLE_INFORMATION handleInfo = (PSYSTEM_HANDLE_INFORMATION)handleInfoBuffer;
    for (ULONG i = 0; i < handleInfo->HandleCount; i++) {
        SYSTEM_HANDLE sh = handleInfo->Handles[i];
        if (sh.ProcessId != this->pid)
            continue;
        HANDLE remoteHandle = (HANDLE)(ULONG_PTR)sh.Handle;
        HANDLE dupHandle = nullptr;
        if (!DuplicateHandle(
            this->handle,
            (HANDLE)(ULONG_PTR)sh.Handle,
            GetCurrentProcess(),
            &dupHandle,
            0,
            FALSE,
            DUPLICATE_SAME_ACCESS))
        {
            continue;
        }
        ULONG objInfoSize = 0x100;
        PVOID objInfoBuffer = malloc(objInfoSize);
        if (!objInfoBuffer) {
            CloseHandle(dupHandle);
            continue;
        }
        status = Sw3NtQueryObject(
            dupHandle,
            ObjectTypeInformation,
            objInfoBuffer,
            objInfoSize,
            &returnLength
        );
        if (status == STATUS_INFO_LENGTH_MISMATCH) {
            free(objInfoBuffer);
            objInfoSize = returnLength;
            objInfoBuffer = malloc(objInfoSize);
            if (!objInfoBuffer) {
                CloseHandle(dupHandle);
                continue;
            }
            status = Sw3NtQueryObject(dupHandle, ObjectTypeInformation, objInfoBuffer, objInfoSize, &returnLength);
        }
        if (!NT_SUCCESS(status)) {
            free(objInfoBuffer);
            CloseHandle(dupHandle);
            continue;
        }
        POBJECT_TYPE_INFORMATION typeInfo = (POBJECT_TYPE_INFORMATION)objInfoBuffer;
        std::wstring typeName(typeInfo->TypeName.Buffer,
            typeInfo->TypeName.Length / sizeof(WCHAR));
        free(objInfoBuffer);
        if (typeName != L"Section") {
            CloseHandle(dupHandle);
            continue;
        }
        ULONG nameInfoSize = 0;
        PVOID nameInfoBuffer = nullptr;
        status = Sw3NtQueryObject(
            dupHandle,
            ObjectNameInformation,
            NULL,
            0,
            &nameInfoSize
        );
        if (status != STATUS_INFO_LENGTH_MISMATCH) {
            CloseHandle(dupHandle);
            continue;
        }
        nameInfoBuffer = malloc(nameInfoSize);
        if (!nameInfoBuffer) {
            CloseHandle(dupHandle);
            continue;
        }
        status = Sw3NtQueryObject(
            dupHandle,
            ObjectNameInformation,
            nameInfoBuffer,
            nameInfoSize,
            &nameInfoSize
        );
        if (!NT_SUCCESS(status)) {
            free(nameInfoBuffer);
            CloseHandle(dupHandle);
            continue;
        }
        PUNICODE_STRING nameInfo = (PUNICODE_STRING)nameInfoBuffer;
        if (nameInfo->Length == 0) {
            free(nameInfoBuffer);
            CloseHandle(dupHandle);
            continue;
        }
        std::wstring sectionName(nameInfo->Buffer, nameInfo->Length / sizeof(WCHAR));
        free(nameInfoBuffer);
        CloseHandle(dupHandle);
        OBJECT_ATTRIBUTES objAttrs;
        UNICODE_STRING nameStr;
        nameStr.Buffer = const_cast<PWSTR>(sectionName.c_str());
        nameStr.Length = static_cast<USHORT>(sectionName.size() * sizeof(WCHAR));
        nameStr.MaximumLength = nameStr.Length + sizeof(WCHAR);  // Allow room for a null terminator if needed
#define OBJ_CASE_INSENSITIVE 0x00000040
        InitializeObjectAttributes(&objAttrs, &nameStr, OBJ_CASE_INSENSITIVE, NULL, NULL);
        NormalSection ns(this->handle, (PWSTR)sectionName.c_str(), SECTION_ALL_ACCESS, objAttrs, remoteHandle);
        if (ns.get_handle() != nullptr) {
            sections.push_back(ns);
        }
    }
    free(handleInfoBuffer);
    return sections;
}

void Process::resume_all_threads()
{
    auto threads = get_threads();
    for (auto& thread : threads) {
        thread.resume();
    }
}

NTSTATUS Process::write_mem(PVOID baseAddress, PVOID data, SIZE_T size, PSIZE_T bytesWritten)
{
	NTSTATUS stat;
	stat = Sw3NtWriteVirtualMemory(this->handle, baseAddress, data, size, bytesWritten);
	if (stat == 0) {
		return 0;
	}
	return stat;
}

NTSTATUS Process::read_mem(PVOID baseAddress, PVOID data, SIZE_T size, PSIZE_T bytesRead)
{
	NTSTATUS stat;
	stat = Sw3NtReadVirtualMemory(this->handle, baseAddress, data, size, bytesRead);
	if (stat == 0) {
		return 0;
	}
	return stat;
}

std::string Process::read_string(uintptr_t baseAddr) {
    std::string result;
    char byte;
    while (true) {
        read_mem((PVOID)baseAddr, &byte, 1, NULL);
        if (byte == 0) break;
        result += byte;
        baseAddr++;
    }
    return result;
}

NTSTATUS Process::change_protection(PVOID baseAddress, SIZE_T size, uint32_t protection, PDWORD originalProtection) {
    NTSTATUS stat;
    stat = Sw3NtProtectVirtualMemory(this->handle, &baseAddress, &size, protection, originalProtection);
    if (stat == 0) {
        return 0;
    }
    return stat;
}

// not recommended to use in production, also if you do use it, remember to either remap back to the old protection or unhook after hooking, integrity check is still there + probably fucks hyperion mapped view
NTSTATUS Process::remap(PVOID remapTarget, DWORD pageProtection) {
    NTSTATUS stat = 0;

    MEMORY_BASIC_INFORMATION bi;
    if (VirtualQueryEx(this->handle, (LPCVOID)remapTarget, &bi, sizeof(MEMORY_BASIC_INFORMATION)) == 0) { return 0; };
    BYTE* buf = (BYTE*)VirtualAlloc(NULL, bi.RegionSize, MEM_COMMIT, pageProtection);
    if (buf == NULL) { return 0; }
    DWORD64 x = 0;
    while (x < bi.RegionSize) {
        read_mem((PVOID)((DWORD64)bi.BaseAddress + x), buf + x, 0x1000, NULL); x += 0x1000;
    }
    stat = (DWORD)Sw3NtUnmapViewOfSection(this->handle, bi.BaseAddress);
    if (stat != 0) { return stat; }
    HANDLE section;
    DWORD64 size = bi.RegionSize;
    stat = (DWORD)Sw3NtCreateSection(&section, 0xf001f, 0, (PLARGE_INTEGER)&size, 0x40, 0x8000000, 0);
    if (stat != 0) { return stat; }

    PVOID addr = bi.BaseAddress;
    SIZE_T viewsize = bi.RegionSize;
    stat = (DWORD)Sw3NtMapViewOfSection(section, this->handle, &addr, 0, viewsize, 0, &viewsize, (SECTION_INHERIT)2, 0x400000, 0x40);
    if (stat != 0) { return stat; }

    x = 0;
    while (x < bi.RegionSize) {
        write_mem((PVOID)((DWORD64)bi.BaseAddress + x), buf + x, 0x1000, NULL); x += 0x1000;
    }

    if (VirtualFree(buf, size, MEM_RELEASE) == 0) { return 0; };
}

NTSTATUS Process::query_page(PVOID baseAddress, MEMORY_INFORMATION_CLASS memoryInformationClass, PVOID memoryInformation, SIZE_T memoryInformationLength)
{
    NTSTATUS stat;
    stat = Sw3NtQueryVirtualMemory(this->handle, baseAddress, memoryInformationClass, memoryInformation, memoryInformationLength, NULL);
    if (stat == 0) {
        return 0;
    }
    return stat;
}

Memory Process::allocate_mem(SIZE_T size, ULONG allocationType, ULONG protect)
{
	return Memory(this->handle, size, allocationType, protect);
}


void Process::create_thread_in_threadpool(HANDLE iohandle, LPVOID addr)
{
    MEMORY_BASIC_INFORMATION mbi;
    PTP_DIRECT remoteDirectAddress = nullptr;
    auto modules = get_all_modules();
    for (auto mod : modules) {
        uintptr_t currentSearchStart = 0;
        while (true) {
            remoteDirectAddress = (PTP_DIRECT)scan_codecave_in_module(mod, 0x1000, 0x00, currentSearchStart);
            if (!remoteDirectAddress) {
                break;
            }
            TP_DIRECT direct = { 0 };
            direct.Callback = static_cast<TP_DIRECT*>(addr);
            DWORD oldProtect;
            change_protection(remoteDirectAddress, sizeof(TP_DIRECT), PAGE_EXECUTE_READWRITE, &oldProtect);
            NTSTATUS status_mem = write_mem(remoteDirectAddress, &direct, sizeof(TP_DIRECT), nullptr);
            change_protection(remoteDirectAddress, sizeof(TP_DIRECT), oldProtect, &oldProtect);
            if (NT_SUCCESS(status_mem)) {
                printf("[%s] Successfully wrote payload to 0x%p\n", __FUNCTION__, remoteDirectAddress);
                goto SUCCESS_FOUND;
            }
            else {
                printf("[%s] Write failed at 0x%p (Status: 0x%x). Retrying next cave...\n", __FUNCTION__, remoteDirectAddress, status_mem);
                currentSearchStart = (uintptr_t)remoteDirectAddress + 1;
            }
        }
    }
    printf("[%s] Failed to find any writable code cave in any module.\n", __FUNCTION__);
    CloseHandle(iohandle);
    return;
SUCCESS_FOUND:
    NTSTATUS status_io = Sw3NtSetIoCompletion(iohandle, (ULONG_PTR)remoteDirectAddress, 0, 0, 0);

    if (!NT_SUCCESS(status_io)) {
        printf("[%s] Failed to set IO Completion (0x%x)\n", __FUNCTION__, status_io);
    }

    CloseHandle(iohandle);
}

// credits: (https://github.com/atrexus/thread-bypass/tree/main), thanks atrexus
// NOTE: This does not work anymore, latest anticheat changes encrypted the entrypoint of the thread map
void Process::whitelist_thread_internal(HANDLE hThread, DWORD dwThreadId, uintptr_t startAddress) {
    printf("[%s] Starting whitelisting for Thread ID: %lu\n", __FUNCTION__, dwThreadId);
    auto modules = get_all_modules();
    auto hyperion = get_module_by_name(modules, "RobloxPlayerBeta.dll");
    if (!hyperion) {
        printf("[%s] Failed to find RobloxPlayerBeta.dll module.\n", __FUNCTION__);
        return;
    }
    const uintptr_t map_offset = 0x29a130; // NEEDS TO BE CHANGED 05/15/2025
    uintptr_t map_addr = reinterpret_cast<uintptr_t>(hyperion->base) + map_offset;
    printf("[%s] Hyperion thread map structure at: %#llx\n", __FUNCTION__, (unsigned long long)map_addr);
    FILETIME creation_time{}, exit_time{}, kernel_time{}, user_time{};
    if (GetThreadTimes(hThread, &creation_time, &exit_time, &kernel_time, &user_time) == 0) {
        printf("[%s] GetThreadTimes failed for handle %p: %lu\n", __FUNCTION__, hThread, GetLastError());
        return;
    }
    const uint64_t creation_time_64 = (creation_time.dwHighDateTime) << 32 | creation_time.dwLowDateTime;
    suspend_all_threads();
    NTSTATUS status;
    SIZE_T bytesRead = 0;
    SIZE_T bytesWritten = 0;
    uintptr_t root_entry_addr = 0;
    status = read_mem(reinterpret_cast<PVOID>(map_addr), &root_entry_addr, sizeof(uintptr_t), &bytesRead);
    if (!NT_SUCCESS(status) || bytesRead != sizeof(uintptr_t)) {
        printf("[%s] Failed to read map root pointer: %lx\n", __FUNCTION__, status);
        resume_all_threads();
        return;
    }
    uintptr_t map_size = 0;
    status = read_mem(reinterpret_cast<PVOID>(map_addr + sizeof(uintptr_t)), &map_size, sizeof(uintptr_t), &bytesRead);
    if (!NT_SUCCESS(status) || bytesRead != sizeof(uintptr_t)) {
        printf("[%s] Failed to read map size: %lx\n", __FUNCTION__, status);
        resume_all_threads();
        return;
    }
    printf("[%s] Read Map Root: %#llx, Size: %llu\n", __FUNCTION__, (unsigned long long)root_entry_addr, (unsigned long long)map_size);
    uintptr_t next_entry_addr = 0;
    status = read_mem(reinterpret_cast<PVOID>(root_entry_addr + sizeof(uintptr_t)), &next_entry_addr, sizeof(uintptr_t), &bytesRead);
    if (!NT_SUCCESS(status) || bytesRead != sizeof(uintptr_t)) {
        printf("[%s] Failed to read root's right child pointer: %lx\n", __FUNCTION__, status);
        resume_all_threads();
        return;
    }
    Memory map_entry_allocation = allocate_mem(0x38, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
    if (map_entry_allocation.get_base_address() == nullptr) {
        printf("[%s] Failed to allocate memory for map entry node.\n", __FUNCTION__);
        resume_all_threads();
        return;
    }
    uintptr_t new_entry_addr = reinterpret_cast<uintptr_t>(map_entry_allocation.get_base_address());
    printf("[%s] Allocated new entry node at: %#llx\n", __FUNCTION__, (unsigned long long)new_entry_addr);
    std::array<uintptr_t, 7> entry_data = {
        root_entry_addr,       // Parent pointer
        next_entry_addr,       // Left child pointer
        root_entry_addr,       // Right child pointer
        0,                     // Flags
        (uintptr_t)dwThreadId, // Thread ID
        creation_time_64,      // Thread creation time
        startAddress           // Thread start address
    };
    printf("[%s] Writing new node data...\n", __FUNCTION__);
    status = map_entry_allocation.write_mem(entry_data.data(), entry_data.size() * sizeof(uintptr_t), &bytesWritten);
    if (!NT_SUCCESS(status) || bytesWritten != entry_data.size() * sizeof(uintptr_t)) {
        printf("[%s] Error writing node data: %lx\n", __FUNCTION__, status);
        resume_all_threads();
        return;
    }
    uintptr_t new_map_size = map_size + 1;
    status = write_mem(reinterpret_cast<PVOID>(map_addr + sizeof(uintptr_t)), &new_map_size, sizeof(uintptr_t), &bytesWritten);
    if (!NT_SUCCESS(status) || bytesWritten != sizeof(uintptr_t)) {
        printf("[%s] Failed to update map size: %lx\n", __FUNCTION__, status);
        resume_all_threads();
        return;
    }
    printf("[%s] Updated map size to: %llu\n", __FUNCTION__, (unsigned long long)new_map_size);
    std::array<uintptr_t, 3> next_entry_update = {
        new_entry_addr,
        new_entry_addr,
        new_entry_addr
    };
    status = write_mem(reinterpret_cast<PVOID>(next_entry_addr), next_entry_update.data(), next_entry_update.size() * sizeof(uintptr_t), &bytesWritten);
    if (!NT_SUCCESS(status) || bytesWritten != next_entry_update.size() * sizeof(uintptr_t)) {
        printf("[%s] Failed to update next entry pointers: %lx\n", __FUNCTION__, status);
    }
    else {
        printf("[%s] Updated next entry pointers successfully\n", __FUNCTION__);
    }
    printf("[%s] Whitelisting completed successfully. Resuming threads...\n", __FUNCTION__);
    resume_all_threads();
}

HANDLE Process::create_whitelisted_hyperion_thread(LPTHREAD_START_ROUTINE startAddress, LPVOID params) {
    printf("[%s] Attempting to create and whitelist thread...\n", __FUNCTION__);
    DWORD threadid = 0;
    HANDLE hthread = CreateRemoteThreadEx(this->handle, nullptr, 0, startAddress, params, CREATE_SUSPENDED, nullptr, &threadid);
    if (hthread == NULL) {
        printf("[%s] Error: CreateRemoteThreadEx failed: %lu\n", __FUNCTION__, GetLastError());
        return NULL;
    }
    printf("[%s] Created thread - ID: %lu, Handle: %p, Start Address: %p\n", __FUNCTION__, threadid, hthread, startAddress);
    whitelist_thread_internal(hthread, threadid, reinterpret_cast<uintptr_t>(startAddress));
    printf("[%s] Whitelisting process complete. Returning thread handle.\n", __FUNCTION__);
    ResumeThread(hthread);
    return hthread;

}

void Process::dump_vector_list() {
    auto modules = get_all_modules();
    auto loader = get_module_by_name(modules, "RobloxPlayerBeta.dll");
    auto startptr = loader->base + 0x28f898; // updated 05/22/2025
    auto endptr = loader->base + 0x273a98; // updated 05/22/2025
    uintptr_t vectorstart = 0;
    uintptr_t vectorend = 0;
    SIZE_T bytesread = 0;
    suspend_all_threads();
    NTSTATUS status = read_mem((PVOID)startptr, &vectorstart, sizeof(vectorstart), &bytesread);
    if (!NT_SUCCESS(status)) {
        printf("[%s] Failed to read start pointer\n", __FUNCTION__);
        resume_all_threads();
        return;
    }
    status = read_mem((PVOID)endptr, &vectorend, sizeof(vectorend), &bytesread);
    if (!NT_SUCCESS(status)) {
        printf("[%s] Failed to read start pointer\n", __FUNCTION__);
        resume_all_threads();
        return;
    }
    printf("[%s] Vector Start = 0x%p\n", __FUNCTION__, vectorstart);
    printf("[%s] Vector End = 0x%p\n", __FUNCTION__, vectorend);
    size_t entry_count = (vectorend - vectorstart) / sizeof(Utils::EncodedVectorEntry);

    if (entry_count > 1000) {
        printf("[%s] Vector count is too long (more than 1000 entries)\n", __FUNCTION__);
        resume_all_threads();
        return;
    }
    std::vector<Utils::EncodedVectorEntry> entries(entry_count);
    status = read_mem((PVOID)vectorstart, entries.data(), entries.size() * sizeof(Utils::EncodedVectorEntry), &bytesread);
    if (!NT_SUCCESS(status)) {
        printf("[%s] Failed to read entries\n", __FUNCTION__);
        resume_all_threads();
        return;
    }
    resume_all_threads();
    for (size_t i = 0; i < entry_count; i++) {
        Utils::EncodedVectorEntry& entry = entries[i];
        std::pair decoded = Utils::decode_module_vector(&entry);
        Utils::EncodedVectorEntry encoded = Utils::encode_module_vector(decoded.first, decoded.second);
        std::pair redecoded = Utils::decode_module_vector(&encoded); 
        // Maybe add them to a file instead of just printing it out, its fine for now cause this is not actually used except in debugging
        printf("Entry %i\n", i);
        printf("Raw Keys: \n");
        printf("key1 = 0x%llx\n", entry.key1);
        printf("key2 = 0x%llx\n", entry.key2);
        printf("key3 = 0x%I32x\n", entry.key3);
        printf("Decoded values: \n");
        printf("base = 0x%p\n", decoded.first);
        printf("size = 0x%x\n", decoded.second);
        printf("Encoded keys: \n");
        printf("key1 = 0x%llx\n", encoded.key1);
        printf("key2 = 0x%llx\n", encoded.key2);
        printf("key3 = 0x%I32x\n", encoded.key3);
        printf("Re-Decoded values: \n");
        printf("base = 0x%p\n", redecoded.first);
        printf("size = 0x%x\n", redecoded.second);
        printf("\n");
    }
}

NTSTATUS Process::queue_apc_thread_flags(PPS_APC_ROUTINE function) {
    HMODULE ntdll = GetModuleHandleA("ntdll.dll");
    ULONG_PTR NtQueueApcThreadEx2Address = (ULONG_PTR)GetProcAddress(ntdll, "NtQueueApcThreadEx2");
    NtQueueApcThreadEx2Defs NtQueueApcThreadEx2 = (NtQueueApcThreadEx2Defs)NtQueueApcThreadEx2Address;
    HANDLE hThread = OpenThread(THREAD_ALL_ACCESS, false, get_mainthread().get_tid());
    NTSTATUS stat = NtQueueApcThreadEx2(hThread, NULL, QUEUE_USER_APC_FLAGS_SPECIAL_USER_APC, function, NULL, NULL, NULL);
    if (stat == 0) {
        return 0;
    }
    return stat;

}

NormalSection Process::create_normal_section(HANDLE fileHandle, ULONG sectionPageProtection, ULONG allocationAttributes, PLARGE_INTEGER maximumSize, OBJECT_ATTRIBUTES objectAttributes)
{
	return NormalSection(this->handle, fileHandle, sectionPageProtection, allocationAttributes, maximumSize, objectAttributes);
}

ExtendedSection Process::create_extended_section(ULONG sectionPageProtection, ULONG allocationAttributes, ULONG extendedParametersCount, POBJECT_ATTRIBUTES objectAttributes, PLARGE_INTEGER maximumSize, PMEM_EXTENDED_PARAMETER extendedParameters, HANDLE fileHandle)
{
	return ExtendedSection(this->handle, sectionPageProtection, allocationAttributes, extendedParametersCount, objectAttributes, maximumSize, extendedParameters, fileHandle);
}

Process::~Process()
{
	if (handle != nullptr) {
		Sw3NtClose(handle);
	}
}

std::vector<Process::Module> Process::get_all_modules() {
    std::vector<Process::Module> modules;
    DWORD cbNeeded;
    HMODULE* hMods = nullptr;
    DWORD numModules;
    if (!EnumProcessModules(this->handle, nullptr, 0, &cbNeeded)) {
        return modules;
    }
    numModules = cbNeeded / sizeof(HMODULE);
    hMods = new HMODULE[numModules];
    if (!EnumProcessModules(this->handle, hMods, cbNeeded, &cbNeeded)) {
        delete[] hMods;
        return modules;
    }
    for (DWORD i = 0; i < numModules; ++i) {
        Process::Module mod;
        mod.base = reinterpret_cast<BYTE*>(hMods[i]);
        char name[MAX_PATH];
        DWORD nameLen = GetModuleBaseNameA(this->handle, hMods[i], name, sizeof(name));
        if (nameLen == 0) {
            continue;
        }
        mod.name = std::string(name, nameLen);
        MODULEINFO modInfo;
        if (!GetModuleInformation(this->handle, hMods[i], &modInfo, sizeof(modInfo))) {
            continue;
        }
        mod.size = static_cast<int>(modInfo.SizeOfImage);

        modules.push_back(mod);
    }
    delete[] hMods;
    return modules;
}

std::vector<Process::Module> Process::get_all_modules_local()
{
    std::vector<Module> modules;
    DWORD cbNeeded = 0;
    DWORD numModules = 0;
    if (!EnumProcessModules(GetCurrentProcess(), nullptr, 0, &cbNeeded)) {
        std::cerr << "EnumProcessModules failed." << std::endl;
        return modules;
    }
    numModules = cbNeeded / sizeof(HMODULE);
    HMODULE* hMods = new HMODULE[numModules];
    if (!EnumProcessModules(GetCurrentProcess(), hMods, cbNeeded, &cbNeeded)) {
        std::cerr << "EnumProcessModules failed on second call." << std::endl;
        delete[] hMods;
        return modules;
    }
    for (DWORD i = 0; i < numModules; ++i) {
        Module mod;
        mod.base = reinterpret_cast<BYTE*>(hMods[i]);
        char moduleName[MAX_PATH] = { 0 };
        if (GetModuleBaseNameA(GetCurrentProcess(), hMods[i], moduleName, sizeof(moduleName))) {
            mod.name = std::string(moduleName);
        }
        else {
            mod.name = "Unknown";
        }
        MODULEINFO modInfo = { 0 };
        if (GetModuleInformation(GetCurrentProcess(), hMods[i], &modInfo, sizeof(modInfo))) {
            mod.size = modInfo.SizeOfImage;
        }
        else {
            mod.size = 0;
        }
        modules.push_back(mod);
    }
    delete[] hMods;
    return modules;
}

Process::Module* Process::get_module_by_name(const std::vector<Module>& modules, const std::string& moduleName)
{
    for (auto& module : modules) {
        if (module.name == moduleName) {
            return const_cast<Module*>(&module);
        }
    }
    return nullptr;
}

Process::Module* Process::get_module_for_function(void(*function)())
{
    static std::vector<Module> localModules;
    if (localModules.empty()) {
        localModules = get_all_modules_local();
        if (localModules.empty()) {
            printf("[%s] Failed to retrieve local modules.\n", __FUNCTION__);
            return nullptr;
        }
    }
    uintptr_t funcAddr = reinterpret_cast<uintptr_t>(function);
    for (auto& mod : localModules) {
        uintptr_t baseAddr = reinterpret_cast<uintptr_t>(mod.base);
        if (mod.size <= 0) continue;
        uintptr_t endAddr = baseAddr + mod.size;
        if (funcAddr >= baseAddr && funcAddr < endAddr) {
            return &mod;
        }
    }
    printf("[%s] Function at address %p not found within any loaded local module.\n", __FUNCTION__, (void*)function);
    return nullptr;
}

void Process::add_module_to_vector_list(const Module& module) {
    auto modules = get_all_modules();
    if (modules.empty()) {
        printf("[%s] Failed to get modules for target process.\n", __FUNCTION__);
        return;
    }
    auto loader = get_module_by_name(modules, "RobloxPlayerBeta.dll");
    if (!loader) {
        printf("[%s] Failed to find RobloxPlayerBeta.dll in target process.\n", __FUNCTION__);
        return;
    }
    uintptr_t startptr_addr = reinterpret_cast<uintptr_t>(loader->base) + 0x28f898; // NEEDS TO BE CHANGED (05/22/2025)
    uintptr_t endptr_addr = reinterpret_cast<uintptr_t>(loader->base) + 0x273a98; // NEEDS TO BE CHANGED (05/22/2025)
    uintptr_t current_vector_start = 0;
    uintptr_t current_vector_end = 0;
    SIZE_T bytes_op = 0;
    NTSTATUS status;
    Utils::EncodedVectorEntry template_entry = { 0, 0, 0 };
    printf("[%s] Suspending threads...\n", __FUNCTION__);
    suspend_all_threads();
    status = read_mem(reinterpret_cast<PVOID>(startptr_addr), &current_vector_start, sizeof(current_vector_start), &bytes_op);
    if (!NT_SUCCESS(status) || bytes_op != sizeof(current_vector_start)) {
        printf("[%s] Failed to read current vector start pointer from 0x%p (Status: 0x%lX)\n", __FUNCTION__, (void*)startptr_addr, status);
        resume_all_threads();
        return;
    }
    status = read_mem(reinterpret_cast<PVOID>(endptr_addr), &current_vector_end, sizeof(current_vector_end), &bytes_op);
    if (!NT_SUCCESS(status) || bytes_op != sizeof(current_vector_end)) {
        printf("[%s] Failed to read current vector end pointer from 0x%p (Status: 0x%lX)\n", __FUNCTION__, (void*)endptr_addr, status);
        resume_all_threads();
        return;
    }
    if (current_vector_start == 0) {
        printf("[%s] Current Vector Start pointer at 0x%p is NULL.\n", __FUNCTION__, (void*)startptr_addr);
        current_vector_end = current_vector_start;
    }
    else if (current_vector_end < current_vector_start) {
        printf("[%s] Current Vector End (0x%p) is before Vector Start (0x%p).\n", __FUNCTION__, (void*)current_vector_end, (void*)current_vector_start);
        resume_all_threads();
        return;
    }
    printf("[%s] Current Vector Pointers: Start=0x%p, End=0x%p\n", __FUNCTION__, (void*)current_vector_start, (void*)current_vector_end);
    SIZE_T current_vector_size_bytes = current_vector_end > current_vector_start ? (current_vector_end - current_vector_start) : 0;
    std::vector<BYTE> original_vector_data;
    original_vector_data.resize(current_vector_size_bytes);
    if (current_vector_size_bytes > 0) {
        printf("[%s] Reading %llu bytes from original vector at 0x%p...\n", __FUNCTION__, (unsigned long long)current_vector_size_bytes, (void*)current_vector_start);
        status = read_mem(reinterpret_cast<PVOID>(current_vector_start), original_vector_data.data(), current_vector_size_bytes, &bytes_op);
        if (!NT_SUCCESS(status) || bytes_op != current_vector_size_bytes) {
            printf("[%s] Failed to read original vector data (Status: 0x%lX, BytesRead: %llu)\n", __FUNCTION__, status, (unsigned long long)bytes_op);
            resume_all_threads();
            return;
        }
        else {
            printf("[%s] Original vector size (%llu) is smaller than an entry.\n", __FUNCTION__, (unsigned long long)current_vector_size_bytes);
        }
    }
    else {
        printf("[%s] Original vector is emptye.\n", __FUNCTION__);
    }

    Utils::EncodedVectorEntry new_encoded_entry = Utils::encode_module_vector(reinterpret_cast<uintptr_t>(module.base), module.size);
    printf("[%s] Encoded new module (Base=0x%p, Size=%d) -> Keys: 0x%llx, 0x%llx, 0x%lx\n", __FUNCTION__, module.base, module.size, new_encoded_entry.key1, new_encoded_entry.key2, new_encoded_entry.key3);
    SIZE_T new_vector_size_bytes = current_vector_size_bytes + sizeof(Utils::EncodedVectorEntry);
    printf("[%s] Allocating %llu bytes for the new vector...\n", __FUNCTION__, (unsigned long long)new_vector_size_bytes);
    Memory new_vector_allocation = allocate_mem(new_vector_size_bytes, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
    if (new_vector_allocation.get_base_address() == nullptr) {
        printf("[%s] Failed to allocate memory for the new vector.\n", __FUNCTION__);
        resume_all_threads();
        return;
    }
    uintptr_t new_vector_start_addr = reinterpret_cast<uintptr_t>(new_vector_allocation.get_base_address());
    uintptr_t new_vector_end_addr = new_vector_start_addr + new_vector_size_bytes;
    printf("[%s] Allocated new vector memory at: Start=0x%p, End=0x%p\n", __FUNCTION__, (void*)new_vector_start_addr, (void*)new_vector_end_addr);
    if (current_vector_size_bytes > 0) {
        printf("[%s] Writing %llu bytes of original data to new location 0x%p...\n", __FUNCTION__, (unsigned long long)current_vector_size_bytes, (void*)new_vector_start_addr);
        status = new_vector_allocation.write_mem(original_vector_data.data(), current_vector_size_bytes, &bytes_op);
        if (!NT_SUCCESS(status) || bytes_op != current_vector_size_bytes) {
            printf("[%s] Failed to write original vector data to new allocation (Status: 0x%lX, BytesWritten: %llu)\n", __FUNCTION__, status, (unsigned long long)bytes_op);
            resume_all_threads();
            return;
        }
    }
    uintptr_t new_entry_write_addr = new_vector_start_addr + current_vector_size_bytes;
    printf("[%s] Writing new entry to new location 0x%p...\n", __FUNCTION__, (void*)new_entry_write_addr);
    status = new_vector_allocation.write_mem_at_offset(static_cast<int>(current_vector_size_bytes), &new_encoded_entry, sizeof(Utils::EncodedVectorEntry), &bytes_op);
    if (!NT_SUCCESS(status) || bytes_op != sizeof(Utils::EncodedVectorEntry)) {
        printf("[%s] Failed to write new entry to new allocation (Status: 0x%lX, BytesWritten: %llu)\n", __FUNCTION__, status, (unsigned long long)bytes_op);
        resume_all_threads();
        return;
    }
    printf("[%s] Updating original vector pointers at 0x%p and 0x%p...\n", __FUNCTION__, (void*)startptr_addr, (void*)endptr_addr);
    status = write_mem(reinterpret_cast<PVOID>(startptr_addr), &new_vector_start_addr, sizeof(new_vector_start_addr), &bytes_op);
    if (!NT_SUCCESS(status) || bytes_op != sizeof(new_vector_start_addr)) {
        printf("[%s] Failed to update vector start pointer (Status: 0x%lX). State may be inconsistent!\n", __FUNCTION__, status);
    }
    else {
        printf("[%s] Updated start pointer to 0x%p\n", __FUNCTION__, (void*)new_vector_start_addr);
    }
    status = write_mem(reinterpret_cast<PVOID>(endptr_addr), &new_vector_end_addr, sizeof(new_vector_end_addr), &bytes_op);
    if (!NT_SUCCESS(status) || bytes_op != sizeof(new_vector_end_addr)) {
        printf("[%s] Failed to update vector end pointer (Status: 0x%lX). State may be inconsistent!\n", __FUNCTION__, status);
    }
    else {
        printf("[%s] Updated end pointer to 0x%p\n", __FUNCTION__, (void*)new_vector_end_addr);
    }
    printf("[%s] Resuming threads...\n", __FUNCTION__);
    resume_all_threads();
    printf("[%s] Module addition process complete.\n", __FUNCTION__);
}

PVOID Process::scan_codecave_in_module(const Module& targetModule, size_t caveSize, BYTE caveByte, uintptr_t startAddress) {
    if (!targetModule.base || targetModule.size == 0) {
        printf("[%s] Invalid target module provided (Base: %p, Size: %d).\n", __FUNCTION__, targetModule.base, targetModule.size);
        return NULL;
    }
    if (caveSize == 0) {
        printf("[%s] Code cave size cannot be zero.\n", __FUNCTION__);
        return NULL;
    }
    if (targetModule.size < caveSize) {
        printf("[%s] Requested cave size (%zu) might be larger than readable regions in module (%d).\n", __FUNCTION__, caveSize, targetModule.size);
    }
    //printf("[%s] Scanning module '%s' (Base: %p, Reported Size: %d) for code cave of size %zu with byte 0x%02X\n", __FUNCTION__, targetModule.name.c_str(), targetModule.base, targetModule.size, caveSize, caveByte);
    std::vector<unsigned char> buffer;
    buffer.reserve(targetModule.size);
    uintptr_t current_address = (uintptr_t)targetModule.base;
    uintptr_t module_end_address = current_address + targetModule.size;
    if (startAddress != 0) {
        if (startAddress >= module_end_address) {
            printf("[%s] Retry address %p is beyond module end. Stopping.\n", __FUNCTION__, (void*)startAddress);
            return NULL;
        }
        current_address = startAddress;
    }
    SIZE_T total_bytes_read = 0;
    //printf("[%s] Reading module content region by region...\n", __FUNCTION__);
    while (current_address < module_end_address) {
        MEMORY_BASIC_INFORMATION mbi;
        NTSTATUS status = query_page((PVOID)current_address, MemoryBasicInformation, &mbi, sizeof(mbi));
        if (!NT_SUCCESS(status)) {
            printf("[%s] NtQueryVirtualMemory failed at address %p (Error: %lu). Stopping read.\n", __FUNCTION__, (PVOID)current_address, GetLastError());
            break;
        }
        if (mbi.BaseAddress != (PVOID)current_address) {
            printf("[%s] NtQueryVirtualMemory returned unexpected BaseAddress %p (expected %p). Stopping read.\n", __FUNCTION__, mbi.BaseAddress, (PVOID)current_address);
            break;
        }
        uintptr_t region_end_address = (uintptr_t)mbi.BaseAddress + mbi.RegionSize;
        SIZE_T bytes_to_read_in_region = mbi.RegionSize;
        if (region_end_address > module_end_address) {
            bytes_to_read_in_region = module_end_address - current_address;
            //printf("[%s] Clamping read size for region at %p from %zu to %zu bytes (module boundary).\n", __FUNCTION__, mbi.BaseAddress, mbi.RegionSize, bytes_to_read_in_region);
        }
        if (bytes_to_read_in_region == 0) {
            break;
        }
        bool is_readable = (mbi.State == MEM_COMMIT) &&
            (mbi.Protect & (PAGE_READONLY | PAGE_READWRITE | PAGE_WRITECOPY | PAGE_EXECUTE_READ | PAGE_EXECUTE_READWRITE | PAGE_EXECUTE_WRITECOPY));
        if (is_readable) {
            size_t old_size = buffer.size();
            buffer.resize(old_size + bytes_to_read_in_region);
            SIZE_T region_bytes_read = 0;
            NTSTATUS status = read_mem(mbi.BaseAddress, buffer.data() + old_size, bytes_to_read_in_region, &region_bytes_read);
            if (NT_SUCCESS(status) || status == 0xC000000D) {
                if (region_bytes_read > 0) {
                    //printf("[%s] Read %llu bytes from readable region at %p (Protect: 0x%lX)\n", __FUNCTION__, (unsigned long long)region_bytes_read, mbi.BaseAddress, mbi.Protect);
                    total_bytes_read += region_bytes_read;
                    if (region_bytes_read < bytes_to_read_in_region) {
                        //printf("[%s] Partial copy occurred within region %p. Read %llu/%zu bytes.\n", __FUNCTION__, mbi.BaseAddress, (unsigned long long)region_bytes_read, bytes_to_read_in_region);
                        buffer.resize(old_size + region_bytes_read);
                        current_address += region_bytes_read;
                        if (status != 0xC000000D) status = 0xC000000D;
                    }
                    else {
                        current_address += bytes_to_read_in_region;
                    }
                }
                else {
                    //printf("[%s] Read 0 bytes from readable region at %p (Status: 0x%lX). Stopping read.\n", __FUNCTION__, mbi.BaseAddress, status);
                    buffer.resize(old_size);
                    break;
                }
                if (status == 0xC000000D && region_bytes_read > 0 && region_bytes_read < bytes_to_read_in_region) {
                }
                else if (!NT_SUCCESS(status)) {
                    printf("[%s] Failed to read supposedly readable region at %p (Status: 0x%lX). Stopping read.\n", __FUNCTION__, mbi.BaseAddress, status);
                    buffer.resize(old_size);
                    break;
                }

            }
            else {
                printf("[%s] Failed to read supposedly readable region at %p (Status: 0x%lX). Stopping read.\n", __FUNCTION__, mbi.BaseAddress, status);
                buffer.resize(old_size); 
                break; 
            }

        }
        else {
            //printf("[%s] Skipping non-readable/non-committed region at %p (State: 0x%lX, Protect: 0x%lX)\n", __FUNCTION__, mbi.BaseAddress, mbi.State, mbi.Protect);
            current_address += bytes_to_read_in_region;
        }
    }
    //printf("[%s] Finished reading regions. Total bytes read into buffer: %llu\n", __FUNCTION__, (unsigned long long)total_bytes_read);
    if (buffer.size() < caveSize) {
        printf("[%s] Total readable bytes (%zu) is less than required cave size (%zu).\n", __FUNCTION__, buffer.size(), caveSize);
        return NULL;
    }
    //printf("[%s] Scanning buffer for code cave...\n", __FUNCTION__);
    for (size_t j = 0; j <= buffer.size() - caveSize; ++j) {
        bool match = true;
        for (size_t o = 0; o < caveSize; ++o) {
            if (buffer[j + o] != caveByte) {
                match = false;
                break;
            }
        }
        if (match) {
            uintptr_t current_scan_addr = (uintptr_t)targetModule.base;
            size_t accumulated_read_size = 0;
            while (current_scan_addr < module_end_address) {
                MEMORY_BASIC_INFORMATION mbi_scan;
                NTSTATUS status = query_page((PVOID)current_scan_addr, MemoryBasicInformation, &mbi_scan, sizeof(mbi_scan));
                if (!NT_SUCCESS(status)) {
                    break;
                }
                uintptr_t region_scan_end_addr = (uintptr_t)mbi_scan.BaseAddress + mbi_scan.RegionSize;
                SIZE_T bytes_to_consider_in_region = mbi_scan.RegionSize;
                if (region_scan_end_addr > module_end_address) {
                    bytes_to_consider_in_region = module_end_address - current_scan_addr;
                }
                bool is_region_readable = (mbi_scan.State == MEM_COMMIT) &&
                    (mbi_scan.Protect & (PAGE_READONLY | PAGE_READWRITE | PAGE_WRITECOPY | PAGE_EXECUTE_READ | PAGE_EXECUTE_READWRITE | PAGE_EXECUTE_WRITECOPY));
                if (is_region_readable && bytes_to_consider_in_region > 0) {
                    if (j >= accumulated_read_size && j < (accumulated_read_size + bytes_to_consider_in_region)) {
                        size_t offset_within_region = j - accumulated_read_size;
                        PVOID cave_address = (PVOID)(current_scan_addr + offset_within_region);
                        if (current_scan_addr + offset_within_region + caveSize <= current_scan_addr + bytes_to_consider_in_region)
                        {
                            printf("[%s] Found code cave at address %p within module '%s' (in readable region starting at %p).\n", __FUNCTION__, cave_address, targetModule.name.c_str(), (PVOID)current_scan_addr);
                            return cave_address;
                        }
                        else {
                            //printf("[%s] Found potential cave pattern at buffer offset %zu, but it spans across readable region boundaries. Skipping.\n", __FUNCTION__, j);
                            match = false;
                            break; 
                        }

                    }
                    accumulated_read_size += bytes_to_consider_in_region;
                }
                current_scan_addr = (uintptr_t)mbi_scan.BaseAddress + mbi_scan.RegionSize;
            }
            if (match) {
                printf("[%s] Found cave match but couldn't map buffer offset %zu back to virtual address.\n", __FUNCTION__, j);
            }
        } 
    }
    //printf("[%s] No suitable code cave found in module '%s'.\n", __FUNCTION__, targetModule.name.c_str());
    return NULL;
}

std::string Process::get_accurate_object_type_name(USHORT handleValue) {
    HANDLE dupHandle = NULL;
    NTSTATUS status = Sw3NtDuplicateObject(
        this->handle,
        (HANDLE)(ULONG_PTR)handleValue,
        GetCurrentProcess(),
        &dupHandle,
        0,
        0,
        DUPLICATE_SAME_ACCESS
    );
    if (!NT_SUCCESS(status) || dupHandle == NULL) {
        return "Unknown";
    }
    ULONG returnLength = 0;
    status = Sw3NtQueryObject(
        dupHandle,
        ObjectTypeInformation,
        NULL,
        0,
        &returnLength
    );

    if (returnLength == 0) {
        CloseHandle(dupHandle);
        return "Unknown";
    }
    POBJECT_TYPE_INFORMATION typeInfo = (POBJECT_TYPE_INFORMATION)malloc(returnLength);
    if (!typeInfo) {
        CloseHandle(dupHandle);
        return "Unknown";
    }
    status = Sw3NtQueryObject(
        dupHandle,
        ObjectTypeInformation,
        typeInfo,
        returnLength,
        &returnLength
    );
    std::string typeName = "Unknown";
    if (NT_SUCCESS(status)) {
        int length = WideCharToMultiByte(CP_ACP, 0, typeInfo->TypeName.Buffer,
            typeInfo->TypeName.Length / 2, NULL, 0, NULL, NULL);
        if (length > 0) {
            char* buffer = new char[length + 1];
            WideCharToMultiByte(CP_ACP, 0, typeInfo->TypeName.Buffer,
                typeInfo->TypeName.Length / 2, buffer, length, NULL, NULL);
            buffer[length] = '\0';
            typeName = buffer;
            delete[] buffer;
        }
    }
    free(typeInfo);
    CloseHandle(dupHandle);
    return typeName;
}

std::vector<Process::Handle> Process::get_all_handles() {
    std::vector<Handle> result;
    ULONG bufferSize = 1024 * 1024;
    NTSTATUS status = STATUS_INFO_LENGTH_MISMATCH;
    PSYSTEM_HANDLE_INFORMATION handleInfo = NULL;
    const int MAX_ATTEMPTS = 5;
    int attempts = 0;
    while (status == STATUS_INFO_LENGTH_MISMATCH && attempts < MAX_ATTEMPTS) {
        if (handleInfo) {
            free(handleInfo);
        }
        handleInfo = (PSYSTEM_HANDLE_INFORMATION)malloc(bufferSize);
        if (!handleInfo) {
            std::cerr << "Failed to allocate memory for handle information" << std::endl;
            return result;
        }
        memset(handleInfo, 0, bufferSize);
        status = Sw3NtQuerySystemInformation(
            (SYSTEM_INFORMATION_CLASS)SystemHandleInformation,
            handleInfo,
            bufferSize,
            &bufferSize
        );
        bufferSize *= 2;
        attempts++;
    }
    if (!NT_SUCCESS(status)) {
        std::cerr << "NtQuerySystemInformation failed with status: 0x" << std::hex << status << std::endl;
        if (handleInfo) {
            free(handleInfo);
        }
        return result;
    }
    for (ULONG i = 0; i < handleInfo->HandleCount; i++) {
        if (handleInfo->Handles[i].ProcessId == this->pid) {
            Handle info;
            info.HandleValue = handleInfo->Handles[i].Handle;
            info.ObjectTypeNumber = handleInfo->Handles[i].ObjectTypeNumber;
            info.Flags = handleInfo->Handles[i].Flags;
            info.Object = handleInfo->Handles[i].Object;
            info.GrantedAccess = handleInfo->Handles[i].GrantedAccess;
            info.TypeName = get_accurate_object_type_name(info.HandleValue);
            result.push_back(info);
        }
    }
    free(handleInfo);
    return result;
}

std::vector<Process::Handle> Process::get_handles_by_type(const std::string& typeName) {
    std::vector<Handle> result;
    std::vector<Handle> allHandles = get_all_handles();
    for (const auto& handle : allHandles) {
        if (handle.TypeName == typeName) {
            result.push_back(handle);
        }
    }
    return result;
}

Process::Handle Process::get_handle_by_type(const std::string& typeName) {
    std::vector<Handle> handles = get_handles_by_type(typeName);
    if (!handles.empty()) {
        return handles[0];
    }
    Handle emptyHandle;
    emptyHandle.HandleValue = 0;
    emptyHandle.ObjectTypeNumber = 0;
    emptyHandle.Flags = 0;
    emptyHandle.Object = nullptr;
    emptyHandle.GrantedAccess = 0;
    emptyHandle.TypeName = "Not Found";
    return emptyHandle;
}

HANDLE Process::convert_handle_info_to_handle(Handle handleInfo) {
    HANDLE targetHandle = NULL;
    if (!DuplicateHandle(
        this->handle,                   
        (HANDLE)handleInfo.HandleValue,  
        GetCurrentProcess(),             
        &targetHandle,                   
        0,                               
        FALSE,                           
        DUPLICATE_SAME_ACCESS)) {      
        return NULL;
    }
    return targetHandle;
}

Process::AllocatedFunctionResult Process::allocate_function_with_args(
    void(*function_ptr)(),
    const std::vector<void*>& arguments)
{
    constexpr size_t MARKER_SIZE = sizeof(uintptr_t);
    const uintptr_t EXPECTED_MARKER = 0xDEADBEEFDEADC0DE;
    printf("[%s] Attempting to allocate function at address %p with %zu arguments.\n", __FUNCTION__, (void*)function_ptr, arguments.size());
    if (function_ptr == nullptr) {
        printf("[%s] Null function pointer provided.\n", __FUNCTION__);
        return AllocatedFunctionResult();
    }
    Module* local_mod = get_module_for_function(function_ptr);
    if (local_mod == nullptr || local_mod->base == nullptr || local_mod->size <= 0) {
        printf("[%s] Could not find a valid local module for function at %p.\n", __FUNCTION__, (void*)function_ptr);
        return AllocatedFunctionResult();
    }
    printf("[%s] Function %p belongs to local module: %s (Base: %p, Size: %d)\n", __FUNCTION__, (void*)function_ptr, local_mod->name.c_str(), local_mod->base, local_mod->size);
    uintptr_t function_addr_local = reinterpret_cast<uintptr_t>(function_ptr);
    uintptr_t module_base_local = reinterpret_cast<uintptr_t>(local_mod->base);
    size_t module_size = local_mod->size;
    if (function_addr_local < module_base_local || function_addr_local >= (module_base_local + module_size)) {
        printf("[%s] Function address %p is outside the bounds of its detected module (%s: %p - %p).\n", __FUNCTION__, (void*)function_ptr, local_mod->name.c_str(), local_mod->base, (void*)(module_base_local + module_size));
        return AllocatedFunctionResult();
    }
    size_t function_offset_in_module = function_addr_local - module_base_local;
    printf("[%s] Function offset within module: 0x%zx\n", __FUNCTION__, function_offset_in_module);
    std::vector<uint8_t> module_copy(module_size);
    memcpy(module_copy.data(), local_mod->base, module_size);
    printf("[%s] Created local copy of module %s (%zu bytes).\n", __FUNCTION__, local_mod->name.c_str(), module_size);
    size_t arg_index = 0;
    size_t markers_found = 0;
    std::vector<std::pair<size_t, size_t>> marker_offsets;
    printf("[%s] Searching for marker (0x%llX) in entire module copy (0x0 - 0x%zx)...\n",
        __FUNCTION__, (unsigned long long)EXPECTED_MARKER, module_size);
    size_t search_end_offset = module_size > MARKER_SIZE ? module_size - MARKER_SIZE : 0;
    for (size_t offset = 0; offset <= search_end_offset; ++offset) {
        if (*reinterpret_cast<uintptr_t*>(module_copy.data() + offset) == EXPECTED_MARKER) {
            markers_found++;
            size_t distance = offset > function_offset_in_module ? offset - function_offset_in_module : function_offset_in_module - offset;
            marker_offsets.emplace_back(offset, distance);
            printf("[%s] Found marker %zu at module offset 0x%zx (distance from function: 0x%zx).\n",
                __FUNCTION__, markers_found, offset, distance);
            offset += MARKER_SIZE - 1;
        }
    }
    if (markers_found == 0) {
        printf("[%s] No markers (0x%llX) found in module '%s'.\n",
            __FUNCTION__, (unsigned long long)EXPECTED_MARKER, local_mod->name.c_str());
        return AllocatedFunctionResult();
    }
    std::sort(marker_offsets.begin(), marker_offsets.end(),
        [](const auto& a, const auto& b) { return a.second < b.second; });
    for (size_t i = 0; i < marker_offsets.size() && arg_index < arguments.size(); ++i) {
        size_t offset = marker_offsets[i].first;
        void* arg_value = arguments[arg_index];
        printf("[%s] Replacing marker %zu at offset 0x%zx with argument %zu (Value: %p).\n",
            __FUNCTION__, i + 1, offset, arg_index, arg_value);
        *reinterpret_cast<uintptr_t*>(module_copy.data() + offset) = reinterpret_cast<uintptr_t>(arg_value);
        arg_index++;
    }
    if (arg_index < arguments.size()) {
        printf("[%s] Provided %zu arguments, but only %zu markers were used in '%s'.\n",
            __FUNCTION__, arguments.size(), arg_index, local_mod->name.c_str());
    }
    else if (markers_found > arg_index) {
        printf("[%s] Found %zu markers, but only %zu were replaced (limited by %zu arguments).\n",
            __FUNCTION__, markers_found, arg_index, arguments.size());
    }
    else {
        printf("[%s] Replaced %zu markers with %zu arguments successfully.\n", __FUNCTION__, arg_index, arg_index);
    }
    printf("[%s] Scanning for code cave of size %zu to host module content...\n", __FUNCTION__, module_size);
    PVOID module_base_remote = nullptr;
    auto modules = get_all_modules();
    for (auto& mod : modules) {
        module_base_remote = scan_codecave_in_module(mod, module_size, 0x00, 0);

        if (module_base_remote) {
            printf("[%s] Found suitable cave at %p in module %s\n", __FUNCTION__, module_base_remote, mod.name.c_str());
            break;
        }
    }
    if (module_base_remote == nullptr) {
        printf("[%s] Failed to find a code cave large enough (%zu bytes) in any module.\n", __FUNCTION__, module_size);
        return AllocatedFunctionResult();
    }
    DWORD oldProtect;
    change_protection(module_base_remote, sizeof(TP_DIRECT), PAGE_EXECUTE_READWRITE, &oldProtect);
    SIZE_T bytes_written = 0;
    NTSTATUS status = write_mem(module_base_remote, module_copy.data(), module_size, &bytes_written);
    change_protection(module_base_remote, sizeof(TP_DIRECT), oldProtect, &oldProtect);
    if (!NT_SUCCESS(status) || bytes_written != module_size) {
        printf("[%s] Failed to write to code cave (Status: 0x%lX, Written: %llu/%zu)\n",
            __FUNCTION__, status, (unsigned long long)bytes_written, module_size);
        return AllocatedFunctionResult();
    }
    printf("[%s] Successfully wrote modified module content to %p.\n", __FUNCTION__, module_base_remote);
    Memory remote_mem(this->handle, module_base_remote, module_size);
    PVOID function_address_remote = reinterpret_cast<PVOID>(
        reinterpret_cast<uintptr_t>(module_base_remote) + function_offset_in_module
        );
    printf("[%s] Calculated remote function address: %p\n", __FUNCTION__, function_address_remote);
    return AllocatedFunctionResult(std::move(remote_mem), function_address_remote);
}