leechcorepyc 2.22.2__tar.gz → 2.22.5__tar.gz

{leechcorepyc-2.22.2/leechcorepyc.egg-info → leechcorepyc-2.22.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 1.2
 Name: leechcorepyc
-Version: 2.22.2
+Version: 2.22.5
 Summary: LeechCore for Python
 Home-page: https://github.com/ufrisk/LeechCore
 Author: Ulf Frisk

{leechcorepyc-2.22.2 → leechcorepyc-2.22.5}/includes/leechcore.h

@@ -11,7 +11,7 @@
 // - README: https://github.com/ufrisk/LeechCore
 // - GUIDE:  https://github.com/ufrisk/LeechCore/wiki
 //
-// (c) Ulf Frisk, 2020-2025
+// (c) Ulf Frisk, 2020-2026
 // Author: Ulf Frisk, pcileech@frizk.net
 //
 // Header Version: 2.20.0

{leechcorepyc-2.22.2 → leechcorepyc-2.22.5}/includes/leechcore_device.h

@@ -15,7 +15,7 @@
 // device may be created/opened - if only one instance may be open at the same
 // time this should be handled by the plugin module itself.
 //
-// (c) Ulf Frisk, 2020-2025
+// (c) Ulf Frisk, 2020-2026
 // Author: Ulf Frisk, pcileech@frizk.net
 //
 // Header Version: 2.5

{leechcorepyc-2.22.2 → leechcorepyc-2.22.5}/leechcore/Makefile.macos

@@ -1,5 +1,5 @@
 CC=clang
-CFLAGS  += -I. -D MACOS -D _GNU_SOURCE -fPIC -fvisibility=hidden -pthread
+CFLAGS  += -I. -I../includes -D MACOS -D _GNU_SOURCE -fPIC -fvisibility=hidden -pthread
 CFLAGS += -fPIC -fstack-protector-strong -D_FORTIFY_SOURCE=2 -O1
 CFLAGS += -Wall -Wno-multichar -Wno-unused-result -Wno-unused-variable -Wno-unused-value
 CFLAGS += -Wno-pointer-to-int-cast -Wno-int-to-pointer-cast

{leechcorepyc-2.22.2 → leechcorepyc-2.22.5}/leechcore/device_file.c

@@ -1,6 +1,6 @@
 // device_file.c : implementation related to file backed memory acquisition device.
 //
-// (c) Ulf Frisk, 2018-2025
+// (c) Ulf Frisk, 2018-2026
 // Author: Ulf Frisk, pcileech@frizk.net
 //
 #include "leechcore.h"
@@ -862,12 +862,12 @@ BOOL DeviceFile_Open(_Inout_ PLC_CONTEXT ctxLC, _Out_opt_ PPLC_CONFIG_ERRORINFO
     ctxLC->Config.fVolatile = FALSE;                    // Files are assumed to be static non-volatile.
     if(0 == _strnicmp("file://", ctxLC->Config.szDevice, 7)) {
         if((pParam = LcDeviceParameterGet(ctxLC, DEVICE_FILE_PARAMETER_FILE)) && pParam->szValue[0]) {
-            // we have a file name on the new format, i.e. fpga://file=<filename> - use the new format.
+            // we have a file name on the new format, i.e. file://file=<filename> - use the new format.
             strncpy_s(ctx->szFileName, _countof(ctx->szFileName), pParam->szValue, _TRUNCATE);
             ctxLC->Config.fVolatile = LcDeviceParameterGetNumeric(ctxLC, DEVICE_FILE_PARAMETER_VOLATILE) ? TRUE : FALSE;
             ctxLC->Config.fWritable = LcDeviceParameterGetNumeric(ctxLC, DEVICE_FILE_PARAMETER_WRITE) ? TRUE : FALSE;
         } else {
-            // we have a file name on the old format, i.e. fpga://<filename> - use the old format.
+            // we have a file name on the old format, i.e. file://<filename> - use the old format.
             strncpy_s(ctx->szFileName, _countof(ctx->szFileName), ctxLC->Config.szDevice + 7, _countof(ctxLC->Config.szDevice) - 7);
         }
     } else if(0 == _stricmp(ctxLC->Config.szDevice, "livekd")) {

{leechcorepyc-2.22.2 → leechcorepyc-2.22.5}/leechcore/device_fpga.c

@@ -7,7 +7,7 @@
 //     - FT2232H/FT245 protocol - access FPGA via FT2232H USB2 instead of FT601 USB3.
 //     - Other devices with plugin driver - ZDMA etc.
 //
-// (c) Ulf Frisk, 2017-2025
+// (c) Ulf Frisk, 2017-2026
 // Author: Ulf Frisk, pcileech@frizk.net
 //
 #include "leechcore.h"
@@ -293,6 +293,8 @@ typedef struct tdDEVICE_CONTEXT_FPGA {
     } tlp_callback;
     BOOL fFT601;
     BOOL fCustomDriver;
+    BOOL fATS;
+    BYTE bAT;
 } DEVICE_CONTEXT_FPGA, *PDEVICE_CONTEXT_FPGA;
 
 // STRUCT FROM FTD3XX.h
@@ -339,7 +341,7 @@ typedef struct {
 
 typedef struct tdTLP_HDR {
     WORD Length : 10;
-    WORD _AT : 2;
+    WORD AT : 2;
     WORD _Attr : 2;
     WORD _EP : 1;
     WORD _TD : 1;
@@ -2354,6 +2356,7 @@ VOID DeviceFPGA_Synch_ReadScatter_Impl(_In_ PLC_CONTEXT ctxLC, _In_ DWORD cMEMs,
     BYTE bTag;
     SIZE_T cbTlpRaw;
     BYTE pbTlpRaw[TLP_RX_MAX_SIZE];
+    BOOL fATS = ctx->fATS;
     // TX queued RAW TLPs (if any) from other threads and flush:
     if(ObByteQueue_Size(ctx->tlp_callback.pBqTx)) {
         while(ObByteQueue_Pop(ctx->tlp_callback.pBqTx, NULL, sizeof(pbTlpRaw), pbTlpRaw, &cbTlpRaw)) {
@@ -2392,6 +2395,7 @@ VOID DeviceFPGA_Synch_ReadScatter_Impl(_In_ PLC_CONTEXT ctxLC, _In_ DWORD cMEMs,
                 is32 = pDMA->qwA < 0x100000000;
                 if(is32) {
                     hdrRd32->h.TypeFmt = TLP_MRd32;
+                    if(fATS) { hdrRd32->h.AT = ctx->bAT; }
                     hdrRd32->h.Length = (WORD)((cb < 0x1000) ? cb >> 2 : 0);
                     hdrRd32->RequesterID = ctx->wDeviceId;
                     hdrRd32->Tag = bTag;
@@ -2400,6 +2404,7 @@ VOID DeviceFPGA_Synch_ReadScatter_Impl(_In_ PLC_CONTEXT ctxLC, _In_ DWORD cMEMs,
                     hdrRd32->Address = (DWORD)(pDMA->qwA + o);
                 } else {
                     hdrRd64->h.TypeFmt = TLP_MRd64;
+                    if(fATS) { hdrRd64->h.AT = ctx->bAT; }
                     hdrRd64->h.Length = (WORD)((cb < 0x1000) ? cb >> 2 : 0);
                     hdrRd64->RequesterID = ctx->wDeviceId;
                     hdrRd64->Tag = bTag;
@@ -2643,6 +2648,21 @@ BOOL DeviceFPGA_Async2_Read_RxTlpFromBuffer(_In_ PLC_CONTEXT ctxLC, _In_ PDEVICE
 {
     BOOL fReadTlp = FALSE;
     DWORD cdwTlpDataConsumed = 1;
+    PDWORD pdwSData = NULL;
+    // FPGA USB core contains a bug in which the initial 0x55556666 fillers may
+    // occur at start of buffer (or in rare cases, after the initial status dword).
+    if(ctx->rxbuf.cb - ctx->rxbuf.o >= 20) {
+        pdwSData = (PDWORD)(ctx->rxbuf.pb + ctx->rxbuf.o);
+        if((pdwSData[1] == 0x55556666) && (pdwSData[2] == 0x55556666) && (pdwSData[3] == 0x55556666) && (pdwSData[4] == 0x55556666)) {
+            if(pdwSData[0] == 0x55556666) {
+                ctx->rxbuf.o += 20;
+            } else if(((pdwSData[0] & 0xf0000000) == 0xe0000000) && (ctx->rxbuf.cb - ctx->rxbuf.o >= 24)) {
+                pdwSData[5] = pdwSData[0];
+                ctx->rxbuf.o += 20;
+            }
+        }
+    }
+    // Acquire one TLP at a time:
     while((ctx->rxbuf.o + 32 <= ctx->rxbuf.cb) && cdwTlpDataConsumed) {
         cdwTlpDataConsumed = DeviceFPGA_Async2_Read_RxTlpSingle(ctxLC, ctx, (ctx->rxbuf.cb - ctx->rxbuf.o) >> 2, (PDWORD)(ctx->rxbuf.pb + ctx->rxbuf.o));
         fReadTlp = fReadTlp || (cdwTlpDataConsumed & 0x80000000);
@@ -2679,6 +2699,7 @@ VOID DeviceFPGA_Async2_Read_TxTlpSingle_MrdTlp(_In_ PLC_CONTEXT ctxLC, _In_ PDEV
     PTLP_HDR_MRdWr32 hdrRd32 = (PTLP_HDR_MRdWr32)tx;
     if(f32) {
         hdrRd32->h.TypeFmt = TLP_MRd32;
+        if(ctx->fATS) { hdrRd32->h.AT = ctx->bAT; }
         hdrRd32->h.Length = wTlpDwLength;
         hdrRd32->RequesterID = ctx->wDeviceId;
         hdrRd32->Tag = iTag;
@@ -2687,6 +2708,7 @@ VOID DeviceFPGA_Async2_Read_TxTlpSingle_MrdTlp(_In_ PLC_CONTEXT ctxLC, _In_ PDEV
         hdrRd32->Address = (DWORD)(qwA);
     } else {
         hdrRd64->h.TypeFmt = TLP_MRd64;
+        if(ctx->fATS) { hdrRd32->h.AT = ctx->bAT; }
         hdrRd64->h.Length = wTlpDwLength;
         hdrRd64->RequesterID = ctx->wDeviceId;
         hdrRd64->Tag = iTag;
@@ -3310,6 +3332,7 @@ VOID DeviceFPGA_ProbeMEM_Impl(_In_ PLC_CONTEXT ctxLC, _In_ QWORD qwAddr, _In_ DW
         is32 = qwAddr + (i << 12) < 0x100000000;
         if(is32) {
             hdrRd32->h.TypeFmt = TLP_MRd32;
+            if(ctx->fATS) { hdrRd32->h.AT = ctx->bAT; }
             hdrRd32->h.Length = 1;
             hdrRd32->RequesterID = ctx->wDeviceId;
             hdrRd32->FirstBE = 0xf;
@@ -3318,6 +3341,7 @@ VOID DeviceFPGA_ProbeMEM_Impl(_In_ PLC_CONTEXT ctxLC, _In_ QWORD qwAddr, _In_ DW
             hdrRd32->Tag = (BYTE)((i >> 5) & 0x1f); // 5 high address bits coded into tag.
         } else {
             hdrRd64->h.TypeFmt = TLP_MRd64;
+            if(ctx->fATS) { hdrRd32->h.AT = ctx->bAT; }
             hdrRd64->h.Length = 1;
             hdrRd64->RequesterID = ctx->wDeviceId;
             hdrRd64->FirstBE = 0xf;
@@ -3376,6 +3400,7 @@ BOOL DeviceFPGA_WriteMEM_TXP(_In_ PLC_CONTEXT ctxLC, _Inout_ PDEVICE_CONTEXT_FPG
     memset(pbTlp, 0, 16);
     if(pa < 0x100000000) {
         hdrWr32->h.TypeFmt = TLP_MWr32;
+        if(ctx->fATS) { hdrWr32->h.AT = ctx->bAT; }
         hdrWr32->h.Length = (WORD)(cb + 3) >> 2;
         hdrWr32->FirstBE = bFirstBE;
         hdrWr32->LastBE = bLastBE;
@@ -3389,6 +3414,7 @@ BOOL DeviceFPGA_WriteMEM_TXP(_In_ PLC_CONTEXT ctxLC, _Inout_ PDEVICE_CONTEXT_FPG
         cbTlp = (12 + cb + 3) & ~0x3;
     } else {
         hdrWr64->h.TypeFmt = TLP_MWr64;
+        if(ctx->fATS) { hdrWr64->h.AT = ctx->bAT; }
         hdrWr64->h.Length = (WORD)(cb + 3) >> 2;
         hdrWr64->FirstBE = bFirstBE;
         hdrWr64->LastBE = bLastBE;
@@ -3848,6 +3874,7 @@ BOOL DeviceFPGA_SetOption_DoLock(_In_ PLC_CONTEXT ctxLC, _In_ QWORD fOption, _In
 #define FPGA_PARAMETER_DEVICE_ID       "bdf"
 #define FPGA_PARAMETER_DRIVER          "driver"
 #define FPGA_PARAMETER_FT601           "ft601"
+#define FPGA_PARAMETER_ATS             "ats"
 
 #define FPGA_PARAMETER_ALGO_TINY                0x01
 #define FPGA_PARAMETER_ALGO_SYNCHRONOUS         0x02
@@ -3885,6 +3912,8 @@ BOOL DeviceFPGA_Open(_Inout_ PLC_CONTEXT ctxLC, _Out_opt_ PPLC_CONFIG_ERRORINFO
     }
     if(szDeviceError) { goto fail; }
     ctx->fRestartDevice = (1 == LcDeviceParameterGetNumeric(ctxLC, FPGA_PARAMETER_RESTART_DEVICE));
+    ctx->bAT = (BYTE)LcDeviceParameterGetNumeric(ctxLC, FPGA_PARAMETER_ATS);
+    ctx->fATS = ((ctx->bAT >= 1) && (ctx->bAT <= 3));
     DeviceFPGA_GetDeviceID_FpgaVersion(ctx);
     if(!ctx->wFpgaVersionMajor) {
         szDeviceError = "Unable to connect to FPGA device";

{leechcorepyc-2.22.2 → leechcorepyc-2.22.5}/leechcore/device_hibr.c

@@ -5,7 +5,7 @@
 // blog post by ForensicXlab at: https://www.forensicxlab.com/blog/hibernation
 // Also the original paper at: https://www.cct.lsu.edu/~golden/Papers/sylvehiber.pdf
 //
-// (c) Ulf Frisk, 2024-2025
+// (c) Ulf Frisk, 2024-2026
 // Author: Ulf Frisk, pcileech@frizk.net
 //
 #include "leechcore.h"

{leechcorepyc-2.22.2 → leechcorepyc-2.22.5}/leechcore/device_pmem.c

@@ -1,6 +1,6 @@
 // device_pmem.c : implementation of the rekall winpmem memory acquisition device.
 //
-// (c) Ulf Frisk, 2018-2025
+// (c) Ulf Frisk, 2018-2026
 // Author: Ulf Frisk, pcileech@frizk.net
 //
 #include "leechcore.h"

{leechcorepyc-2.22.2 → leechcorepyc-2.22.5}/leechcore/device_tmd.c

@@ -2,7 +2,7 @@
 //                Also known as: CVE-2018-1038. Please see Microsoft advisory for more information:
 //                https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-1038
 //
-// (c) Ulf Frisk, 2020-2025
+// (c) Ulf Frisk, 2020-2026
 // Author: Ulf Frisk, pcileech@frizk.net
 //
 #include "leechcore.h"

{leechcorepyc-2.22.2 → leechcorepyc-2.22.5}/leechcore/device_usb3380.c

@@ -1,6 +1,6 @@
 // device_usb3380.c : implementation related to the USB3380 hardware device.
 //
-// (c) Ulf Frisk, 2017-2025
+// (c) Ulf Frisk, 2017-2026
 // Author: Ulf Frisk, pcileech@frizk.net
 //
 #include "leechcore.h"

{leechcorepyc-2.22.2 → leechcorepyc-2.22.5}/leechcore/device_vmm.c

@@ -3,7 +3,7 @@
 // 
 // Syntax: vmm://hvmm=0x<VMM_HANDLE>,hvm=0x<VMMVM_HANDLE>,max=<MAX_ADDRESS>
 // 
-// (c) Ulf Frisk, 2022-2025
+// (c) Ulf Frisk, 2022-2026
 // Author: Ulf Frisk, pcileech@frizk.net
 //
 #include "leechcore.h"

{leechcorepyc-2.22.2 → leechcorepyc-2.22.5}/leechcore/device_vmware.c

@@ -2,7 +2,7 @@
 // 
 // tested with vmware workstation 16.1.2
 //
-// (c) Ulf Frisk, 2022-2025
+// (c) Ulf Frisk, 2022-2026
 // Author: Ulf Frisk, pcileech@frizk.net
 //
 #include "leechcore.h"

{leechcorepyc-2.22.2 → leechcorepyc-2.22.5}/leechcore/leechcore.c

@@ -1,6 +1,6 @@
 // leechcore.c : core implementation of the the LeechCore physical memory acquisition library.
 //
-// (c) Ulf Frisk, 2020-2025
+// (c) Ulf Frisk, 2020-2026
 // Author: Ulf Frisk, pcileech@frizk.net
 //
 

{leechcorepyc-2.22.2 → leechcorepyc-2.22.5}/leechcore/leechcore.h

@@ -11,7 +11,7 @@
 // - README: https://github.com/ufrisk/LeechCore
 // - GUIDE:  https://github.com/ufrisk/LeechCore/wiki
 //
-// (c) Ulf Frisk, 2020-2025
+// (c) Ulf Frisk, 2020-2026
 // Author: Ulf Frisk, pcileech@frizk.net
 //
 // Header Version: 2.20.0

{leechcorepyc-2.22.2 → leechcorepyc-2.22.5}/leechcore/leechcore_device.h

@@ -15,7 +15,7 @@
 // device may be created/opened - if only one instance may be open at the same
 // time this should be handled by the plugin module itself.
 //
-// (c) Ulf Frisk, 2020-2025
+// (c) Ulf Frisk, 2020-2026
 // Author: Ulf Frisk, pcileech@frizk.net
 //
 // Header Version: 2.5

{leechcorepyc-2.22.2 → leechcorepyc-2.22.5}/leechcore/leechcore_internal.h

@@ -1,7 +1,7 @@
 // leechcore_internal.h : definitions of internal leechcore functionality such
 //                        as non exported parts of memory map functionality.
 //
-// (c) Ulf Frisk, 2020-2025
+// (c) Ulf Frisk, 2020-2026
 // Author: Ulf Frisk, pcileech@frizk.net
 //
 

{leechcorepyc-2.22.2 → leechcorepyc-2.22.5}/leechcore/leechrpc.h

@@ -1,6 +1,6 @@
 // leechrpcclient.h : definitions related to the leech rpc service.
 //
-// (c) Ulf Frisk, 2018-2025
+// (c) Ulf Frisk, 2018-2026
 // Author: Ulf Frisk, pcileech@frizk.net
 //
 #ifndef __LEECHRPC_H__

{leechcorepyc-2.22.2 → leechcorepyc-2.22.5}/leechcore/leechrpc_c.c

@@ -7,7 +7,7 @@
 /* at Tue Jan 19 04:14:07 2038
  */
 /* Compiler settings for leechrpc.idl:
-    Oicf, W1, Zp8, env=Win64 (32b run), target_arch=ARM64 8.01.0628 
+    Oicf, W1, Zp8, env=Win64 (32b run), target_arch=AMD64 8.01.0628 
     protocol : all , ms_ext, c_ext, robust
     error checks: allocation ref bounds_check enum stub_data 
     VC __declspec() decoration level: 
@@ -16,7 +16,7 @@
 */
 /* @@MIDL_FILE_HEADING(  ) */
 
-#if defined(_M_ARM64)
+#if defined(_M_AMD64)
 
 
 #if _MSC_VER >= 1200
@@ -32,7 +32,7 @@
 #include "leechrpc_h.h"
 
 #define TYPE_FORMAT_STRING_SIZE   43                                
-#define PROC_FORMAT_STRING_SIZE   67                                
+#define PROC_FORMAT_STRING_SIZE   61                                
 #define EXPR_FORMAT_STRING_SIZE   1                                 
 #define TRANSMIT_AS_TABLE_SIZE    0            
 #define WIRE_MARSHAL_TABLE_SIZE   0            
@@ -185,7 +185,7 @@ error_status_t LeechRpc_ReservedSubmitCommand(
 }
 
 
-#if !defined(__RPC_ARM64__)
+#if !defined(__RPC_WIN64__)
 #error  Invalid build platform for this stub.
 #endif
 
@@ -200,58 +200,52 @@ static const leechrpc_MIDL_PROC_FORMAT_STRING leechrpc__MIDL_ProcFormatString =
 			0x48,		/* Old Flags:  */
 /*  2 */	NdrFcLong( 0x0 ),	/* 0 */
 /*  6 */	NdrFcShort( 0x0 ),	/* 0 */
-/*  8 */	NdrFcShort( 0x30 ),	/* ARM64 Stack size/offset = 48 */
+/*  8 */	NdrFcShort( 0x30 ),	/* X64 Stack size/offset = 48 */
 /* 10 */	0x32,		/* FC_BIND_PRIMITIVE */
 			0x0,		/* 0 */
-/* 12 */	NdrFcShort( 0x0 ),	/* ARM64 Stack size/offset = 0 */
+/* 12 */	NdrFcShort( 0x0 ),	/* X64 Stack size/offset = 0 */
 /* 14 */	NdrFcShort( 0x8 ),	/* 8 */
 /* 16 */	NdrFcShort( 0x24 ),	/* 36 */
 /* 18 */	0x47,		/* Oi2 Flags:  srv must size, clt must size, has return, has ext, */
 			0x5,		/* 5 */
-/* 20 */	0x10,		/* 16 */
+/* 20 */	0xa,		/* 10 */
 			0x7,		/* Ext Flags:  new corr desc, clt corr check, srv corr check, */
 /* 22 */	NdrFcShort( 0x1 ),	/* 1 */
 /* 24 */	NdrFcShort( 0x1 ),	/* 1 */
 /* 26 */	NdrFcShort( 0x0 ),	/* 0 */
-/* 28 */	NdrFcShort( 0x5 ),	/* 5 */
-/* 30 */	0x5,		/* 5 */
-			0x80,		/* 128 */
-/* 32 */	0x81,		/* 129 */
-			0x82,		/* 130 */
-/* 34 */	0x83,		/* 131 */
-			0x84,		/* 132 */
+/* 28 */	NdrFcShort( 0x0 ),	/* 0 */
 
 	/* Parameter cbIn */
 
-/* 36 */	NdrFcShort( 0x48 ),	/* Flags:  in, base type, */
-/* 38 */	NdrFcShort( 0x8 ),	/* ARM64 Stack size/offset = 8 */
-/* 40 */	0x8,		/* FC_LONG */
+/* 30 */	NdrFcShort( 0x48 ),	/* Flags:  in, base type, */
+/* 32 */	NdrFcShort( 0x8 ),	/* X64 Stack size/offset = 8 */
+/* 34 */	0x8,		/* FC_LONG */
 			0x0,		/* 0 */
 
 	/* Parameter pbIn */
 
-/* 42 */	NdrFcShort( 0x10b ),	/* Flags:  must size, must free, in, simple ref, */
-/* 44 */	NdrFcShort( 0x10 ),	/* ARM64 Stack size/offset = 16 */
-/* 46 */	NdrFcShort( 0x6 ),	/* Type Offset=6 */
+/* 36 */	NdrFcShort( 0x10b ),	/* Flags:  must size, must free, in, simple ref, */
+/* 38 */	NdrFcShort( 0x10 ),	/* X64 Stack size/offset = 16 */
+/* 40 */	NdrFcShort( 0x6 ),	/* Type Offset=6 */
 
 	/* Parameter pcbOut */
 
-/* 48 */	NdrFcShort( 0x2150 ),	/* Flags:  out, base type, simple ref, srv alloc size=8 */
-/* 50 */	NdrFcShort( 0x18 ),	/* ARM64 Stack size/offset = 24 */
-/* 52 */	0x8,		/* FC_LONG */
+/* 42 */	NdrFcShort( 0x2150 ),	/* Flags:  out, base type, simple ref, srv alloc size=8 */
+/* 44 */	NdrFcShort( 0x18 ),	/* X64 Stack size/offset = 24 */
+/* 46 */	0x8,		/* FC_LONG */
 			0x0,		/* 0 */
 
 	/* Parameter ppbOut */
 
-/* 54 */	NdrFcShort( 0x2013 ),	/* Flags:  must size, must free, out, srv alloc size=8 */
-/* 56 */	NdrFcShort( 0x20 ),	/* ARM64 Stack size/offset = 32 */
-/* 58 */	NdrFcShort( 0x16 ),	/* Type Offset=22 */
+/* 48 */	NdrFcShort( 0x2013 ),	/* Flags:  must size, must free, out, srv alloc size=8 */
+/* 50 */	NdrFcShort( 0x20 ),	/* X64 Stack size/offset = 32 */
+/* 52 */	NdrFcShort( 0x16 ),	/* Type Offset=22 */
 
 	/* Return value */
 
-/* 60 */	NdrFcShort( 0x70 ),	/* Flags:  out, return, base type, */
-/* 62 */	NdrFcShort( 0x28 ),	/* ARM64 Stack size/offset = 40 */
-/* 64 */	0x10,		/* FC_ERROR_STATUS_T */
+/* 54 */	NdrFcShort( 0x70 ),	/* Flags:  out, return, base type, */
+/* 56 */	NdrFcShort( 0x28 ),	/* X64 Stack size/offset = 40 */
+/* 58 */	0x10,		/* FC_ERROR_STATUS_T */
 			0x0,		/* 0 */
 
 			0x0
@@ -272,7 +266,7 @@ static const leechrpc_MIDL_TYPE_FORMAT_STRING leechrpc__MIDL_TypeFormatString =
 /*  8 */	NdrFcShort( 0x1 ),	/* 1 */
 /* 10 */	0x28,		/* Corr desc:  parameter, FC_LONG */
 			0x0,		/*  */
-/* 12 */	NdrFcShort( 0x8 ),	/* ARM64 Stack size/offset = 8 */
+/* 12 */	NdrFcShort( 0x8 ),	/* X64 Stack size/offset = 8 */
 /* 14 */	NdrFcShort( 0x1 ),	/* Corr flags:  early, */
 /* 16 */	0x1,		/* FC_BYTE */
 			0x5b,		/* FC_END */
@@ -292,7 +286,7 @@ static const leechrpc_MIDL_TYPE_FORMAT_STRING leechrpc__MIDL_TypeFormatString =
 /* 32 */	NdrFcShort( 0x1 ),	/* 1 */
 /* 34 */	0x28,		/* Corr desc:  parameter, FC_LONG */
 			0x54,		/* FC_DEREFERENCE */
-/* 36 */	NdrFcShort( 0x18 ),	/* ARM64 Stack size/offset = 24 */
+/* 36 */	NdrFcShort( 0x18 ),	/* X64 Stack size/offset = 24 */
 /* 38 */	NdrFcShort( 0x1 ),	/* Corr flags:  early, */
 /* 40 */	0x1,		/* FC_BYTE */
 			0x5b,		/* FC_END */
@@ -308,7 +302,7 @@ static const unsigned short LeechRpc_FormatStringOffsetTable[] =
 
 
 
-#endif /* defined(_M_ARM64) */
+#endif /* defined(_M_AMD64)*/
 
 
 
@@ -319,7 +313,7 @@ static const unsigned short LeechRpc_FormatStringOffsetTable[] =
 /* at Tue Jan 19 04:14:07 2038
  */
 /* Compiler settings for leechrpc.idl:
-    Oicf, W1, Zp8, env=Win64 (32b run), target_arch=ARM64 8.01.0628 
+    Oicf, W1, Zp8, env=Win64 (32b run), target_arch=AMD64 8.01.0628 
     protocol : all , ms_ext, c_ext, robust
     error checks: allocation ref bounds_check enum stub_data 
     VC __declspec() decoration level: 
@@ -328,12 +322,12 @@ static const unsigned short LeechRpc_FormatStringOffsetTable[] =
 */
 /* @@MIDL_FILE_HEADING(  ) */
 
-#if defined(_M_ARM64)
+#if defined(_M_AMD64)
 
 
 
 
-#if !defined(__RPC_ARM64__)
+#if !defined(__RPC_WIN64__)
 #error  Invalid build platform for this stub.
 #endif
 
@@ -427,12 +421,6 @@ struct
     struct _NDR64_PARAM_FORMAT frag5;
     struct _NDR64_PARAM_FORMAT frag6;
     struct _NDR64_PARAM_FORMAT frag7;
-    struct /* ARM Parameter Layout */
-    {
-        NDR64_UINT16 frag1;
-        NDR64_UINT8 frag2;
-        NDR64_UINT8 frag3[ 5 ];
-    } frag8;
 }
 __midl_frag2_t;
 extern const __midl_frag2_t __midl_frag2;
@@ -583,7 +571,7 @@ static const __midl_frag2_t __midl_frag2 =
 /* LeechRpc_ReservedSubmitCommand */
     { 
     /* LeechRpc_ReservedSubmitCommand */      /* procedure LeechRpc_ReservedSubmitCommand */
-        (NDR64_UINT32) 91095104 /* 0x56e0040 */,    /* explicit handle */ /* IsIntrepreted, ServerMustSize, ClientMustSize, HasReturn, ServerCorrelation, ClientCorrelation, HasExtensions, HasArmParamLayout */
+        (NDR64_UINT32) 23986240 /* 0x16e0040 */,    /* explicit handle */ /* IsIntrepreted, ServerMustSize, ClientMustSize, HasReturn, ServerCorrelation, ClientCorrelation, HasExtensions */
         (NDR64_UINT32) 48 /* 0x30 */ ,  /* Stack size */
         (NDR64_UINT32) 8 /* 0x8 */,
         (NDR64_UINT32) 40 /* 0x28 */,
@@ -723,19 +711,6 @@ static const __midl_frag2_t __midl_frag2 =
         },    /* [out], IsReturn, Basetype, ByValue */
         (NDR64_UINT16) 0 /* 0x0 */,
         40 /* 0x28 */,   /* Stack offset */
-    },
-    { 
-    /* LeechRpc_ReservedSubmitCommand */      /* ARM register placement data */
-        (NDR64_UINT16) 5 /* 0x5 */ ,  /* Number of Entries */
-        (NDR64_UINT8) 5 /* 0x5 */ ,  /* Slots Used */
-        { 
-        /* LeechRpc_ReservedSubmitCommand */      /* Placement data octets */
-            (NDR64_UINT8) 0x80, 
-            (NDR64_UINT8) 0x81, 
-            (NDR64_UINT8) 0x82, 
-            (NDR64_UINT8) 0x83, 
-            (NDR64_UINT8) 0x84
-        }
     }
 };
 
@@ -825,5 +800,5 @@ static const MIDL_STUBLESS_PROXY_INFO LeechRpc_ProxyInfo =
 #endif
 
 
-#endif /* defined(_M_ARM64) */
+#endif /* defined(_M_AMD64)*/
 

{leechcorepyc-2.22.2 → leechcorepyc-2.22.5}/leechcore/leechrpc_h.h

@@ -7,7 +7,7 @@
 /* at Tue Jan 19 04:14:07 2038
  */
 /* Compiler settings for leechrpc.idl:
-    Oicf, W1, Zp8, env=Win64 (32b run), target_arch=ARM64 8.01.0628 
+    Oicf, W1, Zp8, env=Win64 (32b run), target_arch=AMD64 8.01.0628 
     protocol : all , ms_ext, c_ext, robust
     error checks: allocation ref bounds_check enum stub_data 
     VC __declspec() decoration level: 

{leechcorepyc-2.22.2 → leechcorepyc-2.22.5}/leechcore/leechrpcclient.c

@@ -1,6 +1,6 @@
 // leechrpcclient.c : implementation of the remote procedure call (RPC) client.
 //
-// (c) Ulf Frisk, 2018-2025
+// (c) Ulf Frisk, 2018-2026
 // Author: Ulf Frisk, pcileech@frizk.net
 //
 #include "leechcore.h"

{leechcorepyc-2.22.2 → leechcorepyc-2.22.5}/leechcore/leechrpcshared.c

@@ -1,6 +1,6 @@
 // leechrpcshared.c : implementation of the remote procedure call (RPC) shared functionality (client/server).
 //
-// (c) Ulf Frisk, 2018-2025
+// (c) Ulf Frisk, 2018-2026
 // Author: Ulf Frisk, pcileech@frizk.net
 //
 #include <stdio.h>

{leechcorepyc-2.22.2 → leechcorepyc-2.22.5}/leechcore/memmap.c

@@ -1,6 +1,6 @@
 // memmap.c : implementation : memory map.
 //
-// (c) Ulf Frisk, 2020-2025
+// (c) Ulf Frisk, 2020-2026
 // Author: Ulf Frisk, pcileech@frizk.net
 //
 

{leechcorepyc-2.22.2 → leechcorepyc-2.22.5}/leechcore/oscompatibility.c

@@ -1,6 +1,6 @@
 // oscompatibility.c : LeechCore Windows/Linux compatibility layer.
 //
-// (c) Ulf Frisk, 2017-2025
+// (c) Ulf Frisk, 2017-2026
 // Author: Ulf Frisk, pcileech@frizk.net
 //
 #ifdef _WIN32

{leechcorepyc-2.22.2 → leechcorepyc-2.22.5}/leechcore/oscompatibility.h

@@ -1,6 +1,6 @@
 // oscompatibility.h : LeechCore Windows/Linux compatibility layer.
 //
-// (c) Ulf Frisk, 2017-2025
+// (c) Ulf Frisk, 2017-2026
 // Author: Ulf Frisk, pcileech@frizk.net
 //
 #ifndef __OSCOMPATIBILITY_H__

{leechcorepyc-2.22.2 → leechcorepyc-2.22.5}/leechcore/util.c

@@ -1,6 +1,6 @@
 // util.c : implementation of various utility functions.
 //
-// (c) Ulf Frisk, 2018-2025
+// (c) Ulf Frisk, 2018-2026
 // Author: Ulf Frisk, pcileech@frizk.net
 //
 #include "util.h"

{leechcorepyc-2.22.2 → leechcorepyc-2.22.5}/leechcore/util.h

@@ -1,6 +1,6 @@
 // util.h : definitions of various utility functions.
 //
-// (c) Ulf Frisk, 2018-2025
+// (c) Ulf Frisk, 2018-2026
 // Author: Ulf Frisk, pcileech@frizk.net
 //
 #ifndef __UTIL_H__

{leechcorepyc-2.22.2 → leechcorepyc-2.22.5}/leechcore/version.h

@@ -3,8 +3,8 @@
 
 #define VERSION_MAJOR               2
 #define VERSION_MINOR               22
-#define VERSION_REVISION            2
-#define VERSION_BUILD               88
+#define VERSION_REVISION            5
+#define VERSION_BUILD               91
 
 #define VER_FILE_DESCRIPTION_STR    "LeechCore Memory Acquisition Library"
 #define VER_FILE_VERSION            VERSION_MAJOR, VERSION_MINOR, VERSION_REVISION, VERSION_BUILD

{leechcorepyc-2.22.2 → leechcorepyc-2.22.5}/leechcore_device_rawtcp/version.h

@@ -5,8 +5,8 @@
 
 #define VERSION_MAJOR               2
 #define VERSION_MINOR               22
-#define VERSION_REVISION            1
-#define VERSION_BUILD               87
+#define VERSION_REVISION            2
+#define VERSION_BUILD               88
 
 #define VER_FILE_DESCRIPTION_STR    "LeechCorePlugin : RAWTCP"
 #define VER_FILE_VERSION            VERSION_MAJOR, VERSION_MINOR, VERSION_REVISION, VERSION_BUILD

{leechcorepyc-2.22.2 → leechcorepyc-2.22.5}/leechcorepyc.c

@@ -1,6 +1,6 @@
 //	leechcorepyc.c : Implementation of the LeechCore Python API
 //
-// (c) Ulf Frisk, 2020-2025
+// (c) Ulf Frisk, 2020-2026
 // Author: Ulf Frisk, pcileech@frizk.net
 //
 #include "leechcorepyc.h"

{leechcorepyc-2.22.2 → leechcorepyc-2.22.5/leechcorepyc.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 1.2
 Name: leechcorepyc
-Version: 2.22.2
+Version: 2.22.5
 Summary: LeechCore for Python
 Home-page: https://github.com/ufrisk/LeechCore
 Author: Ulf Frisk

{leechcorepyc-2.22.2 → leechcorepyc-2.22.5}/leechcorepyc.h

@@ -1,6 +1,6 @@
 //	leechcorepyc.c : Implementation of the LeechCore Python API
 //
-// (c) Ulf Frisk, 2020-2025
+// (c) Ulf Frisk, 2020-2026
 // Author: Ulf Frisk, pcileech@frizk.net
 //
 #ifndef __LEECHCOREPYC_H__

{leechcorepyc-2.22.2 → leechcorepyc-2.22.5}/leechcorepyc_barrequest.c

@@ -1,6 +1,6 @@
 // leechcorepyc_barrequest.c : implementation of LeechCore PCIe BAR request.
 //
-// (c) Ulf Frisk, 2024-2025
+// (c) Ulf Frisk, 2024-2026
 // Author: Ulf Frisk, pcileech@frizk.net
 //
 

{leechcorepyc-2.22.2 → leechcorepyc-2.22.5}/oscompatibility.c

@@ -1,6 +1,6 @@
 // oscompatibility.c : LeechCore Windows/Linux compatibility layer.
 //
-// (c) Ulf Frisk, 2017-2025
+// (c) Ulf Frisk, 2017-2026
 // Author: Ulf Frisk, pcileech@frizk.net
 //
 #ifdef _WIN32

{leechcorepyc-2.22.2 → leechcorepyc-2.22.5}/oscompatibility.h

@@ -1,6 +1,6 @@
 // oscompatibility.h : LeechCore Windows/Linux compatibility layer.
 //
-// (c) Ulf Frisk, 2017-2025
+// (c) Ulf Frisk, 2017-2026
 // Author: Ulf Frisk, pcileech@frizk.net
 //
 #ifndef __OSCOMPATIBILITY_H__

{leechcorepyc-2.22.2 → leechcorepyc-2.22.5}/setup.py

@@ -19,7 +19,7 @@ leechcorepyc = Extension(
 
 setup(
     name='leechcorepyc',
-    version='2.22.2', # VERSION_END
+    version='2.22.5', # VERSION_END
     description='LeechCore for Python',
     long_description='LeechCore for Python : native extension for physical memory access',
     url='https://github.com/ufrisk/LeechCore',