#101

Add virtual-memory and thread-control primitives

Openfloberndwants to merge intofrom

Summary

Adds the low-level virtual-memory and thread-control primitives needed for cross-platform inline hooking, plus a few correctness fixes surfaced along the way. Targets Linux, macOS, and Windows on x86-64.

Intention

The Zyrex hook engine needs to allocate executable trampolines near a target (within +/-2 GiB), query existing page protections, and suspend and redirect threads while a patch is applied. Those capabilities previously existed only implicitly on Windows. This adds portable APIs so the hook engine can run on POSIX.

Changes

  • ZyanMemoryVirtualAlloc and ZyanMemoryVirtualQuery, including an address hint for near allocation within +/-2 GiB of a target.
  • Thread control: ZyanThreadEnumerate, ZyanThreadSuspend / ZyanThreadResume, and get/set instruction pointer, using a realtime-signal park mechanism on Linux.
  • Fix ZyanProcessFlushInstructionCache on POSIX to use __builtin___clear_cache instead of msync, which only accepts page-aligned ranges.
  • Fix ZYAN_ALIGN_DOWN so it no longer misaligns values that are already aligned.
  • Bound the ZyanThreadSuspend park-wait so it cannot deadlock on a thread that is exiting.

Notes

These primitives are consumed by the zyan-hook-engine multi-platform inline hooking PR.