WinAPIOverride 6.13.1

WinApiOvverride and Plugin SDK update to solve trouble inside cross architecture interprocess communication between plugin and overriding dll (x86 overriding dll with x64 plugin)

WinApiOverride:
- Added support for packaged apps AppxManifest dependencies (Monitoring File Builder, StubResolver)
- Bug correction :PointedElementsCount= was not taken into account for fixed values (:PointedElementsCount=ArgX was working). It's still recommanded to use the ArgX option when possible
- Regression solved since version 6.10 Unload of injected dll not done in some cases when pressing stop button
- Some monitoring files updates

Хорошо бы русский язык

WinApiOverride:
- Arguments PointedDataSize=ArgX option checks for invalid values and limits were added to avoid large amount of invalid data retrieval - Added : monitoring files for win 11 (ntdll.dll, kernel32.dll, kernelbase.dll, shell32.dll, user32.dll, ...)
- HexControl updated to Helium Hex Editor release v2.6.12
- Solved : Potential crash (Async function parsing introduced in 6.9.8 version)
- Solved : small GUI bug solved

Monitoring File Builder :
- Solved : potential crashs during monitoring file updates

WinApiOverride:
- Asynchronous symbols loading : avoid to freeze interface when downloading symbols from microsoft server
- HexControl updated to Helium Hex Editor release v2.6.10
- Bug correction: since v6.9.2, reloading logs file of v6.9.1 or previous versions could fail if logs contain DISPPARAMETERS or VARIANT.
Specific case if your are impacted by this bug for logs saved with v6.9.1: as v6.9.1 logs can't be distinguish from v6.9.x, you need to change version inside your xml logs files to 6.8, so it can be parsed correctly by v6.9.7 and upper

Stub Resolver:
- Regression introduced in WinApiOverride v6.9.6 solved

Dumper:
- Solved Module integrity checking : hide rebasing option regression since WinApiOverride v6.7.1 solved
- Added UserTime and Kernel Time for processes

- PE parsing bug solved : Forwarded functions without Hint was not properly detected
- HexControl updated to Helium Hex Editor release v2.6.8

- PE parsing regression introduced in v6.9.3 solved
- HexControl updated to Helium Hex Editor release v2.6.7

WinApiOverride:
- Fuzzing : added capability to fuzz c++ objects methods
- Monitoring file builder : solved crash when retrieving data from microsoft documentation
- HexControl updated to Helium Hex Editor release v2.6.1

WinApiOverride:
- Hooking of some functions with specific relative instructions crash solved (x64 ony)
- Better handling of exception thrown by monitored function (x64 only)
- Monitoring files (ntdll, kernelbase, kernel32, ...) reworked and updated with addition of win10 new functions

WinApiOverride:
- Added support and monitoring files for DirectX 9, DirectX 10, DirectX 11 and DirectX 12
- DirectX monitoring tutorial and tutorial videos added
- Logs file size reduced by 50% and reloading speed increased by 25%

- Crash on Exception detail information display solved
- COM object IDispatch parsing for IUnknown solved
- Listview bad rendering solved
- Crash on incorrect enum description solved

Monitoring file builder
- Can extract functions definition from header files (windows sdk headers supported up to 10.0.22000.0)
- Web search are done on docs.microsft.com instead of google

Dumper
- Noisy Popup messages removed

  -  Use of the Helium Hex Editor control to display parameters. This allows post logging structures mapping on buffer parameters.
This is usefull for functions like DeviceIoControl which have generic lpInBuffer and lpOutBuffer LPVOID parameters.
For one call you can map buffer to a struct, and for an other call map buffer to another struct
  -  Disasm parser updated
  -  Struct parsing bugs solved. Added Bit fields support of "next_field_define_values_file" pragma
  -  License : Incorrect Virtual Machine detection when Hyper V was enabled solved
  -  Small bugs solved
Dumper
  -  Process integrity checking improvment
DebugInfoViewer
  -  Added Raw search
Monitoring File Builder
  -  Online Microsoft function definition auto retrival search updated due to google and docs.microsoft changes
  -  Monitoring wizard : added binaries internal functions detection (x64 only)
Internal functions start addresses and number of parameters are automatically retrieved to generate the monitoring file specific to the application

В описании интересно звучит "программа создана для продвинутых юзеров, поэтому Русской поддержки в ней нет" ... получается что русские не очень то и продвинутые :)

Вопрос для продвинутых: в этом приложении можно сделать такое - прицепить хук к нужному процессу и все вызовы определённой функии перехвачивать и возвращать константные значения? если в этой нельзя, то есть ли такие где можно сделать такое?