RTTI_Reverse_Lookup.lua

if syntaxcheck then return end
local function autoUntick()
  if memrec then
    local mr = memrec
    local t = createTimer(nil, false)
    t.Interval = 1
    t.OnTimer = function(timer)
      timer.destroy()
      if mr then mr.Active = false end
    end
    t.Enabled = true
  end
end

local function safeDestroy(o)
  if o and o.destroy then
    pcall(function() o.destroy() end)
  end
end

local TRACEBACK = (debug and debug.traceback) or function(err) return tostring(err) end
local UNPACK = table.unpack or unpack

local ok, err = xpcall(function()

  local function ensureTargetAttached()
    local pid = 0

    if type(getOpenedProcessID) == "function" then
      local okPid, value = pcall(getOpenedProcessID)
      if okPid then
        pid = tonumber(value) or 0
      end
    end

    if pid ~= 0 then
      return true
    end

    pcall(function()
      messageDialog(
        'No target process is attached.\n\n' ..
        'Select the target process first, then run the script again.',
        mtWarning,
        mbOK
      )
    end)
    return false
  end

  if not ensureTargetAttached() then
    return
  end

  local is64 = targetIs64Bit()
  local pointersize = is64 and 8 or 4
  local scantype = is64 and vtQword or vtDword
  local maxaddr = is64 and 0xffffffffffffffff or 0xffffffff

  local tdNameOffset = is64 and 0x10 or 0x08
  local colSignature = is64 and 1 or 0

  local processBase = getAddress(process)
  local processSize = getModuleSize(process)
  local processEnd  = processBase + processSize - 1

  ---------------------------------------------------------
  -- HELPERS
  ---------------------------------------------------------

  local function normalizePtr(v)
    if v == nil then return nil end

    -- x86 CE can hand back signed pointer-like values
    if (not is64) and v < 0 then
      return v + 0x100000000
    end

    return v
  end

  local function readAsciiZ(addr, maxlen)
    local t = readBytes(addr, maxlen, true)
    if not t then return nil end

    local out = {}
    for i=1,#t do
      if t[i] == 0 then break end
      out[#out+1] = string.char(t[i])
    end

    return table.concat(out)
  end

  local function getSections(modBase)
    local mz = readSmallInteger(modBase)
    if mz ~= 0x5A4D then return nil end

    local e_lfanew = readInteger(modBase + 0x3C)
    if not e_lfanew then return nil end

    local nt = modBase + e_lfanew
    local pe = readInteger(nt)
    if pe ~= 0x00004550 then return nil end

    local numSections = readSmallInteger(nt + 6)
    local sizeOptional = readSmallInteger(nt + 20)
    local optMagic = readSmallInteger(nt + 24)

    -- PE32  = 0x10B
    -- PE32+ = 0x20B
    if optMagic ~= 0x10B and optMagic ~= 0x20B then
      return nil
    end

    local sec = nt + 24 + sizeOptional
    local out = {}

    for i=1,numSections do
      local name = readAsciiZ(sec, 8) or ""
      local virtualSize = readInteger(sec + 8) or 0
      local virtualAddress = readInteger(sec + 12) or 0
      local rawSize = readInteger(sec + 16) or 0
      local characteristics = readInteger(sec + 36) or 0

      local size = virtualSize
      if rawSize > size then size = rawSize end

      if size > 0 then
        out[#out+1] = {
          name = name,
          base = modBase + virtualAddress,
          finish = modBase + virtualAddress + size - 1,
          characteristics = characteristics
        }
      end

      sec = sec + 40
    end

    return out
  end

  local function getModuleSections(mod)
    if mod == nil then return nil end
    if mod.sections ~= nil then return mod.sections end

    mod.sections = getSections(mod.base)
    return mod.sections
  end

  local function isWritableSection(sec)
    if sec == nil then return false end

    local ch = sec.characteristics or 0

    -- IMAGE_SCN_MEM_WRITE = 0x80000000
    if ch < 0 then return true end
    if ch >= 0x80000000 then return true end

    return false
  end

  local function isDataLikeSection(name)
    local s = (name or ""):lower()
    return s:find("^%.data") ~= nil or s:find("^%.bss") ~= nil
  end

  local function addUnique(list, map, value)
    if value == nil then return end
    if map[value] then return end
    map[value] = true
    table.insert(list, value)
  end

  local function addUniqueRange(list, map, base, finish, modulename, secname)
    if base == nil or finish == nil then return end

    local key = string.format("%x:%x", base, finish)
    if map[key] then return end
    map[key] = true

    table.insert(list, {
      base = base,
      finish = finish,
      module = modulename or "?",
      section = secname or "?"
    })
  end

  local function shiftHeld()
    return isKeyPressed(VK_SHIFT)
  end

  local function buildModuleList()
    local out = {}
    local seen = {}

    if type(enumModules) == "function" then
      local mods = enumModules()

      if type(mods) == "table" then
        for i=1,#mods do
          local me = mods[i]

          local name = me.Name or me.name or me.ModuleName or me.modulename or me[1]
          local base = me.Address or me.address or me.BaseAddress or me.base
          local size = me.Size or me.size

          if name ~= nil then
            if base == nil then base = getAddress(name) end
            if size == nil then size = getModuleSize(name) end

            base = normalizePtr(base)

            if name and base and size and not seen[base] then
              seen[base] = true
              table.insert(out, {
                name = name,
                base = base,
                size = size,
                finish = base + size - 1
              })
            end
          end
        end
      elseif mods and mods.Count then
        for i=0,mods.Count-1 do
          local name = mods[i]
          local base = normalizePtr(getAddress(name))
          local size = getModuleSize(name)

          if name and base and size and not seen[base] then
            seen[base] = true
            table.insert(out, {
              name = name,
              base = base,
              size = size,
              finish = base + size - 1
            })
          end
        end

        safeDestroy(mods)
      end
    end

    if #out == 0 then
      table.insert(out, {
        name = process,
        base = processBase,
        size = processSize,
        finish = processEnd
      })
    end

    table.sort(out, function(a,b) return a.base < b.base end)
    return out
  end

  local function findModuleByAddress(modules, addr)
    addr = normalizePtr(addr)
    if addr == nil then return nil end

    for i=1,#modules do
      local m = modules[i]
      if addr >= m.base and addr <= m.finish then
        return m
      end
    end

    return nil
  end

  local function findModuleByBase(modules, base)
    base = normalizePtr(base)
    if base == nil then return nil end

    for i=1,#modules do
      if modules[i].base == base then
        return modules[i]
      end
    end

    return nil
  end

  local function getModuleInfoByAddressFallback(addr)
    addr = normalizePtr(addr)
    if addr == nil then return nil end
    if not inModule(addr) then return nil end

    local s = getNameFromAddress(addr, true, false, false)
    if not s then return nil end

    local modulename = s:match("^[^+]+")
    if not modulename or modulename == "" then
      return nil
    end

    local base = normalizePtr(getAddress(modulename))
    local size = getModuleSize(modulename)

    if not base or not size then
      return nil
    end

    return {
      name = modulename,
      base = base,
      size = size,
      finish = base + size - 1
    }
  end

  local function getOrCreateModuleByAddress(modules, addr)
    local m = findModuleByAddress(modules, addr)
    if m then return m end

    local fm = getModuleInfoByAddressFallback(addr)
    if fm == nil then return nil end

    local existing = findModuleByBase(modules, fm.base)
    if existing then return existing end

    table.insert(modules, fm)
    table.sort(modules, function(a,b) return a.base < b.base end)
    return fm
  end

  local function formatAddress(modules, addr)
    addr = normalizePtr(addr)
    if addr == nil or addr == 0 then
      return "0"
    end

    local m = findModuleByAddress(modules, addr)
    if m then
      return string.format('%x  "%s"+%x', addr, m.name, addr - m.base)
    end

    return string.format("%x", addr)
  end

  local function collectQuickRanges(moduleList)
    local out = {}
    local seen = {}

    for i=1,#moduleList do
      local mod = moduleList[i]
      local secs = getModuleSections(mod)

      if secs ~= nil then
        local foundDataLike = false
        local foundWritable = false

        for j=1,#secs do
          local sec = secs[j]
          if isDataLikeSection(sec.name) then
            addUniqueRange(out, seen, sec.base, sec.finish, mod.name, sec.name)
            foundDataLike = true
          end
        end

        if not foundDataLike then
          for j=1,#secs do
            local sec = secs[j]
            if isWritableSection(sec) then
              addUniqueRange(out, seen, sec.base, sec.finish, mod.name, sec.name)
              foundWritable = true
            end
          end
        end

        if not foundDataLike and not foundWritable then
          addUniqueRange(out, seen, mod.base, mod.finish, mod.name, "(whole module)")
        end
      else
        addUniqueRange(out, seen, mod.base, mod.finish, mod.name, "(whole module)")
      end
    end

    return out
  end

  local function pulseUI(timeout)
    pcall(function() processMessages() end)
    pcall(function() checkSynchronize(timeout or 0) end)
  end

  local CANCELLED = {}

  local function checkCancelled(state)
    if state and state.cancelRequested then
      error(CANCELLED, 0)
    end
  end

  ---------------------------------------------------------
  -- SCAN UI
  ---------------------------------------------------------

  local function createProgressDialog(title, state)
    local form = createForm(false)
    form.Caption = title or 'Scanning...'
    form.Width = 640
    form.Height = 160
    form.Position = poScreenCenter
    form.BorderStyle = bsDialog
    form.KeyPreview = true
    pcall(function() form.BorderIcons = '[]' end)

    local MARGIN = 10
    local GAP = 8
    local BUTTON_W = 100

    local lblPhase = createLabel(form)
    lblPhase.Caption = 'Starting...'
    lblPhase.Left = MARGIN
    lblPhase.Top = GAP

    local lblDetail = createLabel(form)
    lblDetail.Caption = ''
    lblDetail.Left = MARGIN
    lblDetail.Top = lblPhase.Top + lblPhase.Height + GAP
    lblDetail.Width = form.ClientWidth - MARGIN * 2
    lblDetail.Height = lblDetail.Height * 2
    lblDetail.AutoSize = false
    pcall(function() lblDetail.WordWrap = true end)
    lblDetail.Anchors = '[akLeft, akTop, akRight]'

    local pb = createProgressBar(form)
    pb.Left = MARGIN
    pb.Top = lblDetail.Top + lblDetail.Height + GAP
    pb.Width = form.ClientWidth - MARGIN * 2
    pb.Min = 0
    pb.Max = 1000
    pb.Position = 0
    pb.Anchors = '[akLeft, akTop, akRight]'

    local lblInfo = createLabel(form)
    lblInfo.Caption = ''
    lblInfo.Left = MARGIN
    lblInfo.Top = pb.Top + pb.Height + GAP / 2

    local bottomPanel = createPanel(form)
    bottomPanel.Align = alBottom
    bottomPanel.BevelOuter = bvNone

    local buttonPanel = createPanel(bottomPanel)
    buttonPanel.BevelOuter = bvNone

    local btnCancel = createButton(buttonPanel)
    btnCancel.Caption = 'Cancel'
    btnCancel.Left = 0
    btnCancel.Width = BUTTON_W

    buttonPanel.Width = btnCancel.Width
    buttonPanel.Height = btnCancel.Height

    bottomPanel.Height = buttonPanel.Height + GAP * 2

    local function centerButtonPanel()
      buttonPanel.Left = math.floor((bottomPanel.Width - buttonPanel.Width) / 2)
      buttonPanel.Top = math.floor((bottomPanel.Height - buttonPanel.Height) / 2)
    end

    bottomPanel.OnResize = centerButtonPanel

    local dlg = {}

    function dlg.requestCancel()
      if state.cancelRequested then return end
      state.cancelRequested = true
      lblPhase.Caption = 'Cancel requested...'
      lblDetail.Caption = 'The current memscan step must finish first.'
      lblInfo.Caption = ''
      btnCancel.Enabled = false
    end

    function dlg.checkCancelled()
      checkCancelled(state)
    end

    function dlg.setStatus(phase, detail)
      if phase ~= nil then
        lblPhase.Caption = phase
      end
      if detail ~= nil then
        lblDetail.Caption = detail
      end
    end

    function dlg.setProgress(current, total, results)
      if current ~= nil and total ~= nil and total > 0 then
        local pos = math.floor((current * pb.Max) / total)
        if pos < 0 then pos = 0 end
        if pos > pb.Max then pos = pb.Max end
        pb.Position = pos

        if results ~= nil then
          lblInfo.Caption = string.format('%d / %d   (%d result%s)', current, total, results, results == 1 and '' or 's')
        else
          lblInfo.Caption = string.format('%d / %d', current, total)
        end
      else
        pb.Position = 0
        if results ~= nil then
          lblInfo.Caption = string.format('%d result%s', results, results == 1 and '' or 's')
        else
          lblInfo.Caption = ''
        end
      end
    end

    btnCancel.OnClick = function(sender)
      dlg.requestCancel()
    end

    form.OnKeyDown = function(sender, key)
      if key == VK_ESCAPE then
        dlg.requestCancel()
        key = 0
      end
    end

    form.OnCloseQuery = function(sender, canClose)
      dlg.requestCancel()
      canClose = false
    end

    form.show()
    centerButtonPanel()
    pulseUI()

    dlg.form = form
    return dlg
  end

  local function runWithProgress(title, fn)
    local state = { cancelRequested = false }
    local dlg = createProgressDialog(title, state)
    local result = nil

    local okRun, runErr = xpcall(function()
      result = fn(state, dlg)
    end, function(e)
      if e == CANCELLED then return e end
      return TRACEBACK(e)
    end)

    safeDestroy(dlg.form)

    if not okRun then
      return false, nil, runErr
    end

    return true, result, nil
  end

  ---------------------------------------------------------
  -- RESPONSIVE MEMSCAN WAIT
  ---------------------------------------------------------

  local function withMemScan(fn)
    local s = createMemScan()
    local fl = createFoundList(s)
    local out = nil

    local okRun, runErr = xpcall(function()
      out = { fn(s, fl) }
    end, function(e)
      if e == CANCELLED then return e end
      return TRACEBACK(e)
    end)

    pcall(function() fl.deinitialize() end)
    safeDestroy(fl)
    safeDestroy(s)

    if not okRun then
      error(runErr, 0)
    end

    return UNPACK(out or {})
  end

  local function scanCollect(scan, fl, startScanFn, state, dlg, phase, detail)
    pcall(function() fl.deinitialize() end)

    checkCancelled(state)

    if dlg then
      dlg.setStatus(phase, detail)
      dlg.setProgress(0, 1, 0)
    end

    local scanDone = false

    scan.OnScanDone = function(memscan)
      scanDone = true
    end

    scan.newScan()
    startScanFn()

    while not scanDone do
      if dlg then
        local gp = nil
        pcall(function()
          gp = scan.getProgress()
        end)

        if type(gp) == "table" then
          dlg.setProgress(gp.CurrentlyScanned, gp.TotalAddressesToScan, gp.ResultsFound)
        end
      end

      pulseUI(10)
    end

    -- Per CE docs, still finish with waitTillDone() after OnScanDone
    scan.waitTillDone()
    scan.OnScanDone = nil

    checkCancelled(state)

    fl.initialize()

    local out = {}
    for i=1,fl.Count do
      out[#out+1] = tonumber(fl[i-1],16)
    end

    return out
  end

  local function scanValue(scan, fl, vartype, value, startaddr, stopaddr, protection, alignment, alignParam, state, dlg, phase, detail)
    value = normalizePtr(value)

    return scanCollect(scan, fl, function()
      scan.firstScan(
        soExactValue,
        vartype,
        rtRounded,
        string.format("%x", value),
        '',
        startaddr,
        stopaddr,
        protection,
        alignment,
        alignParam,
        true,
        true,
        false,
        true
      )
    end, state, dlg, phase, detail)
  end

  local function scanStringValue(scan, fl, value, startaddr, stopaddr, protection, alignment, alignParam, state, dlg, phase, detail)
    return scanCollect(scan, fl, function()
      scan.firstScan(
        soExactValue,
        vtString,
        rtRounded,
        value,
        '',
        startaddr,
        stopaddr,
        protection,
        alignment,
        alignParam,
        false,
        true,
        false,
        true
      )
    end, state, dlg, phase, detail)
  end

  ---------------------------------------------------------
  -- MODULES
  ---------------------------------------------------------

  local modules = buildModuleList()
  local mainModule = findModuleByBase(modules, processBase)

  if mainModule == nil then
    mainModule = {
      name = process,
      base = processBase,
      size = processSize,
      finish = processEnd
    }
    table.insert(modules, mainModule)
    table.sort(modules, function(a,b) return a.base < b.base end)
  end

  print(string.format('Main module: %s (%x-%x)', mainModule.name, mainModule.base, mainModule.finish))
  print(string.format('Modules known: %d', #modules))

  ---------------------------------------------------------
  -- RTTI DISCOVERY SCOPE
  ---------------------------------------------------------

  local function chooseDiscoveryScope()
    local form = createForm(false)
    form.Caption = 'RTTI discovery'
    form.Width = 300
    form.Position = poScreenCenter
    form.KeyPreview = true

    local MARGIN = 10
    local GAP = 8
    local BUTTON_W = 100

    local lbl = createLabel(form)
    lbl.Caption = 'Choose RTTI discovery scope'
    lbl.Left = MARGIN
    lbl.Top = GAP

    local bottomPanel = createPanel(form)
    bottomPanel.Align = alBottom
    bottomPanel.BevelOuter = bvNone

    local buttonPanel = createPanel(bottomPanel)
    buttonPanel.BevelOuter = bvNone

    local btnOK = createButton(buttonPanel)
    btnOK.Caption = 'OK'
    btnOK.Left = 0
    btnOK.Width = BUTTON_W

    local btnCancel = createButton(buttonPanel)
    btnCancel.Caption = 'Cancel'
    btnCancel.Width = BUTTON_W
    btnCancel.Left = btnOK.Left + BUTTON_W + MARGIN

    buttonPanel.Width = btnCancel.Left + BUTTON_W
    buttonPanel.Height = math.max(btnOK.Height, btnCancel.Height)

    bottomPanel.Height = buttonPanel.Height + GAP

    local function centerButtonPanel()
      buttonPanel.Left = math.floor((bottomPanel.Width - buttonPanel.Width) / 2)
      buttonPanel.Top = math.floor((bottomPanel.Height - buttonPanel.Height) / 2)
    end

    bottomPanel.OnResize = centerButtonPanel

    local listbox = createListBox(form)
    listbox.Left = MARGIN
    listbox.Top = lbl.Top + lbl.Height + GAP
    listbox.Width = form.ClientWidth - MARGIN * 2
    listbox.Anchors = '[akLeft, akTop, akRight]'
    listbox.Items.add('Process module only - fast start')
    listbox.Items.add('All modules - slower start, broader class list')
    listbox.ItemIndex = 0

    local picked = nil

    local function accept()
      if listbox.ItemIndex == 0 then
        picked = {
          name = "Process only",
          startaddr = processBase,
          stopaddr = processEnd,
          showprogress = false
        }
        form.ModalResult = mrOK
      elseif listbox.ItemIndex == 1 then
        picked = {
          name = "All modules",
          startaddr = 0,
          stopaddr = maxaddr,
          showprogress = true
        }
        form.ModalResult = mrOK
      end
    end

    btnOK.OnClick = function()
      accept()
    end

    btnCancel.OnClick = function()
      form.ModalResult = mrCancel
    end

    listbox.OnKeyDown = function(sender, key)
      if (key == VK_RETURN or key == VK_SPACE) then
        accept()
        key = 0
      elseif key == VK_ESCAPE then
        form.ModalResult = mrCancel
        key = 0
      end
    end

    form.OnKeyDown = function(sender, key)
      if key == VK_ESCAPE then
        form.ModalResult = mrCancel
        key = 0
      elseif key == VK_RETURN then
        accept()
        key = 0
      end
    end

    listbox.OnDblClick = function(sender)
      accept()
    end

    form.OnShow = function(sender)
      local itemH = listbox.ItemHeight
      if itemH == 0 then itemH = btnOK.Height end

      listbox.Height = itemH * listbox.Items.Count + 4

      form.ClientHeight =
        listbox.Top +
        listbox.Height +
        bottomPanel.Height

      centerButtonPanel()
      listbox.setFocus()
    end

    local modalResult = form.showModal()
    safeDestroy(form)

    if modalResult ~= mrOK then
      return nil
    end

    return picked
  end

  local discovery = chooseDiscoveryScope()
  if discovery == nil then
    return
  end

  print(string.format('RTTI discovery scope: %s', discovery.name))

  ---------------------------------------------------------
  -- NAME LIST
  ---------------------------------------------------------

  local names = nil

  local function buildNameListFromHits(hits, dlg)
    local namesLocal = {}
    local namesSeen = {}

    if dlg then
      dlg.setStatus('Collecting RTTI classes...', 'Reading names from scan results')
      dlg.setProgress(0, #hits, nil)
    end

    for i=1,#hits do
      if (i % 256) == 0 then
        if dlg then
          dlg.setProgress(i, #hits, nil)
          dlg.checkCancelled()
        end
        pulseUI()
      end

      local a = hits[i]
      local mod = getOrCreateModuleByAddress(modules, a)

      if mod ~= nil then
        local td = a - tdNameOffset

        if not namesSeen[td] then
          local nm = readString(a+4)
          if nm ~= nil and nm ~= "" then
            namesSeen[td] = true

            local ne = {}
            ne.name = nm
            ne.typeDescriptor = td
            ne.modulename = mod.name
            ne.modulebase = mod.base
            ne.moduleend = mod.finish
            ne.display = string.format('%s    [%s]', ne.name, ne.modulename)
            ne.search = (ne.name .. " " .. ne.modulename):lower()

            table.insert(namesLocal, ne)
          end
        end
      end
    end

    table.sort(namesLocal, function(a,b)
      local an = a.name:lower()
      local bn = b.name:lower()

      if an ~= bn then return an < bn end

      local am = a.modulename:lower()
      local bm = b.modulename:lower()

      if am ~= bm then return am < bm end

      return a.typeDescriptor < b.typeDescriptor
    end)

    return namesLocal
  end

  if discovery.showprogress then
    local okRun, result, runErr = runWithProgress('RTTI discovery', function(state, dlg)
      local hits = withMemScan(function(s, fl)
        return scanStringValue(
          s,
          fl,
          '.?AV',
          discovery.startaddr,
          discovery.stopaddr,
          "*W*X*C",
          fsmNotAligned,
          '1',
          state,
          dlg,
          'Scanning RTTI strings...',
          discovery.name
        )
      end)

      print(string.format("RTTI string hits: %d", #hits))
      return buildNameListFromHits(hits, dlg)
    end)

    if not okRun then
      if runErr == CANCELLED then
        print("RTTI discovery cancelled by user")
        return
      end
      error(runErr)
    end

    names = result
  else
    local hits = withMemScan(function(s, fl)
      return scanStringValue(
        s,
        fl,
        '.?AV',
        discovery.startaddr,
        discovery.stopaddr,
        "*W*X*C",
        fsmNotAligned,
        '1'
      )
    end)

    print(string.format("RTTI string hits: %d", #hits))
    names = buildNameListFromHits(hits)
  end

  print(string.format("RTTI classes collected: %d", #names))

  if #names == 0 then
    print("No MSVC RTTI classes were found")
    return
  end

  ---------------------------------------------------------
  -- CUSTOM DIALOG START
  ---------------------------------------------------------

  local function pickClass(entries)
    local form = createForm(false)
    form.Caption = 'RTTI Classes (' .. #entries .. ' found)'
    form.Width = 640
    form.Height = 480
    form.Position = poScreenCenter
    form.KeyPreview = true
    form.BorderStyle = bsSizeable
    pcall(function() form.WindowState = wsMaximized end)

    local MARGIN = 10
    local GAP = 8
    local BUTTON_W = 100

    -- TOP PANEL (Search)
    local topPanel = createPanel(form)
    topPanel.Align = alTop
    topPanel.BevelOuter = bvNone

    local lblSearch = createLabel(topPanel)
    lblSearch.Caption = 'Search:'
    lblSearch.Width = lblSearch.Canvas.getTextWidth(lblSearch.Caption)
    lblSearch.Left = MARGIN
    lblSearch.Top = GAP + 3

    local edtSearch = createEdit(topPanel)
    edtSearch.Left = lblSearch.Left + lblSearch.Width + MARGIN
    edtSearch.Top = GAP
    edtSearch.Anchors = '[akLeft, akTop, akRight]'

    local lblCount = createLabel(topPanel)
    lblCount.Caption = ''
    lblCount.Left = MARGIN
    lblCount.Top = edtSearch.Top + edtSearch.Height + math.floor(GAP / 2)

    topPanel.Height = lblCount.Top + lblCount.Height + math.floor(GAP / 2)

    -- BOTTOM PANEL (Buttons)
    local bottomPanel = createPanel(form)
    bottomPanel.Align = alBottom
    bottomPanel.BevelOuter = bvNone

    local buttonPanel = createPanel(bottomPanel)
    buttonPanel.Left = MARGIN
    buttonPanel.BevelOuter = bvNone

    local btnSelect = createButton(buttonPanel)
    btnSelect.Caption = 'Select'
    btnSelect.Left = 0
    btnSelect.Width = BUTTON_W

    local btnSave = createButton(buttonPanel)
    btnSave.Caption = 'Save to TXT'
    btnSave.Width = BUTTON_W
    btnSave.Left = btnSelect.Left + BUTTON_W + MARGIN

    local btnCancel = createButton(buttonPanel)
    btnCancel.Caption = 'Cancel'
    btnCancel.Width = BUTTON_W
    btnCancel.Left = btnSave.Left + btnSave.Width + MARGIN

    buttonPanel.Width = btnCancel.Left + BUTTON_W
    buttonPanel.Height = math.max(btnSelect.Height, btnSave.Height, btnCancel.Height)

    bottomPanel.Height = buttonPanel.Height + GAP * 2

    local function VcenterButtonPanel()
      buttonPanel.Top = math.floor((bottomPanel.Height - buttonPanel.Height) / 2)
    end

    -- LISTBOX
    local listbox = createListBox(form)
    listbox.Align = alClient
    listbox.Font.Name = 'Consolas'

    -- MIN SIZE
    local function applyMinSize()
      local MIN_LIST_ROWS = 3

      local itemH = listbox.ItemHeight
      if itemH == 0 then
        itemH = btnSelect.Height
      end

      local minListHeight = itemH * MIN_LIST_ROWS + 4
      local minClientHeight = topPanel.Height + minListHeight + bottomPanel.Height

      pcall(function()
        form.Constraints.MinWidth = MARGIN + buttonPanel.Width + MARGIN
        form.Constraints.MinHeight = minClientHeight
      end)
    end

    local filtered = {}
    local picked = nil

    local function updateFilter(filterText)
      listbox.Items.beginUpdate()
      listbox.Items.clear()
      filtered = {}

      local ft = (filterText or ""):lower()

      for i=1,#entries do
        local e = entries[i]
        if ft == "" or e.search:find(ft, 1, true) or e.display:lower():find(ft, 1, true) then
          listbox.Items.add(e.display)
          filtered[#filtered+1] = i
        end
      end

      listbox.Items.endUpdate()

      lblCount.Caption = string.format('%d / %d shown', #filtered, #entries)

      if listbox.Items.Count > 0 then
        if listbox.ItemIndex < 0 then
          listbox.ItemIndex = 0
        elseif listbox.ItemIndex >= listbox.Items.Count then
          listbox.ItemIndex = listbox.Items.Count - 1
        end
      else
        listbox.ItemIndex = -1
      end
    end

    local function focusList(move)
      if listbox.Items.Count == 0 then return end

      if listbox.ItemIndex == -1 then
        if move == -1 then
          listbox.ItemIndex = listbox.Items.Count - 1
        else
          listbox.ItemIndex = 0
        end
      else
        if move == -1 and listbox.ItemIndex > 0 then
          listbox.ItemIndex = listbox.ItemIndex - 1
        elseif move == 1 and listbox.ItemIndex < listbox.Items.Count - 1 then
          listbox.ItemIndex = listbox.ItemIndex + 1
        end
      end

      listbox.setFocus()
    end

    -- Hook search bar changes
    edtSearch.OnChange = function(sender)
      updateFilter(sender.Text)
    end

    ---------------------------------------------------------
    -- KEYBOARD UX
    ---------------------------------------------------------

    edtSearch.OnKeyDown = function(sender, key)
      if key == VK_TAB then
        if shiftHeld() then
          btnCancel.setFocus()
        else
          focusList(0)
        end
        key = 0
      elseif key == VK_DOWN then
        focusList(1)
        key = 0
      elseif key == VK_UP then
        focusList(-1)
        key = 0
      elseif key == VK_RETURN then
        focusList(0)
        key = 0
      elseif key == VK_ESCAPE then
        form.ModalResult = mrCancel
        key = 0
      end
    end

    listbox.OnKeyDown = function(sender, key)
      if (key == VK_RETURN or key == VK_SPACE) and listbox.ItemIndex ~= -1 then
        btnSelect.OnClick(btnSelect)
        key = 0
      elseif key == VK_TAB then
        if shiftHeld() then
          edtSearch.setFocus()
        else
          btnSelect.setFocus()
        end
        key = 0
      elseif key == VK_ESCAPE then
        form.ModalResult = mrCancel
        key = 0
      end
    end

    local function buttonKeyDown(sender, key)
      if key == VK_TAB then
        if shiftHeld() then
          if sender == btnSelect then
            listbox.setFocus()
          elseif sender == btnSave then
            btnSelect.setFocus()
          elseif sender == btnCancel then
            btnSave.setFocus()
          end
        else
          if sender == btnSelect then
            btnSave.setFocus()
          elseif sender == btnSave then
            btnCancel.setFocus()
          elseif sender == btnCancel then
            edtSearch.setFocus()
          end
        end
        key = 0

      elseif key == VK_ESCAPE then
        form.ModalResult = mrCancel
        key = 0

      elseif key == VK_RETURN then
        if sender == btnSelect then
          btnSelect.OnClick(btnSelect)
        elseif sender == btnSave then
          btnSave.OnClick(btnSave)
        elseif sender == btnCancel then
          form.ModalResult = mrCancel
        end
        key = 0
      end
    end

    btnSelect.OnKeyDown = buttonKeyDown
    btnSave.OnKeyDown = buttonKeyDown
    btnCancel.OnKeyDown = buttonKeyDown

    form.OnKeyDown = function(sender, key)
      if key == VK_ESCAPE then
        form.ModalResult = mrCancel
        key = 0
      end
    end

    -- Button Actions
    btnSelect.OnClick = function(sender)
      if listbox.ItemIndex ~= -1 then
        local idx = filtered[listbox.ItemIndex + 1]
        if idx ~= nil then
          picked = entries[idx]
          form.ModalResult = mrOK
        end
      end
    end

    -- Allow double clicking the list to select
    listbox.OnDblClick = function(sender)
      btnSelect.OnClick(btnSelect)
    end

    btnCancel.OnClick = function(sender)
      form.ModalResult = mrCancel
    end

    btnSave.OnClick = function(sender)
      local sd = createSaveDialog(form)
      sd.Title = "Save Visible Classes to Text File"
      sd.Filter = "Text files (*.txt)|*.txt"
      sd.DefaultExt = "txt"

      if sd.Execute() then
        local sl = createStringList()
        for i=0,listbox.Items.Count-1 do
          sl.add(listbox.Items[i])
        end
        sl.saveToFile(sd.FileName)
        sl.destroy()
        print("Visible classes successfully saved to: " .. sd.FileName)
      end

      sd.destroy()
    end

    -- Auto focus search bar safely when the window appears
    form.OnShow = function(sender)
      VcenterButtonPanel()
      applyMinSize()
      edtSearch.Width = form.ClientWidth - edtSearch.Left * 2
      edtSearch.setFocus()
    end

    -- Initialize listbox
    updateFilter("")

    -- Show the dialog and wait for user input
    local modalResult = form.showModal()
    safeDestroy(form)

    if modalResult ~= mrOK then
      return nil
    end

    return picked
  end

  local picked = pickClass(names)
  if picked == nil then
    return
  end

  ---------------------------------------------------------
  -- CUSTOM DIALOG END
  ---------------------------------------------------------

  ---------------------------------------------------------
  -- RTTI -> COL -> VTABLE
  ---------------------------------------------------------

  print(string.format('You picked %s [%s]', picked.name, picked.modulename))

  local ownerModule = findModuleByBase(modules, picked.modulebase)
  if ownerModule == nil then
    ownerModule = {
      name = picked.modulename,
      base = picked.modulebase,
      size = picked.moduleend - picked.modulebase + 1,
      finish = picked.moduleend
    }
    table.insert(modules, ownerModule)
    table.sort(modules, function(a,b) return a.base < b.base end)
  end

  local mstart = ownerModule.base
  local mstop  = ownerModule.finish

  local RTTIInfo = {}
  local RTTIInfoMap = {}

  local vtables = {}
  local vtablesMap = {}

  do
    local a = picked.typeDescriptor
    if is64 then
      a = a - mstart -- x64 COL stores module-relative TD offset
    end

    print(string.format("Scanning owner module %s (%x-%x)", ownerModule.name, mstart, mstop))
    print(string.format("Scanning for TD ref %x", a))

    local tdhits = withMemScan(function(s, fl)
      return scanValue(
        s,
        fl,
        vtDword,
        a,
        mstart,
        mstop,
        "*W*X*C",
        fsmNotAligned,
        '1'
      )
    end)

    print("found "..#tdhits.." TD ref result(s)")

    for i=1,#tdhits do
      if (i % 256) == 0 then
        pulseUI()
      end

      local col = tdhits[i] - 12
      if readBytes(col,1) == colSignature then
        addUnique(RTTIInfo, RTTIInfoMap, col)
      end
    end

    table.sort(RTTIInfo)
    print("after checking only "..#RTTIInfo.." COL(s) left")

    withMemScan(function(s, fl)
      for i=1,#RTTIInfo do
        local col = RTTIInfo[i]

        print(string.format("Scanning for COL %x", col))

        local hits = scanValue(
          s,
          fl,
          scantype,
          col,
          mstart,
          mstop,
          "*W*X*C",
          fsmNotAligned,
          '1'
        )

        for j=1,#hits do
          local vt = hits[j] + pointersize
          addUnique(vtables, vtablesMap, vt)
        end

        if (i % 8) == 0 then
          pulseUI()
        end
      end
    end)
  end

  table.sort(vtables)
  print(#vtables.." vtables found")

  if #vtables == 0 then
    print("No vtables found for the selected class")
    return
  end

  ---------------------------------------------------------
  -- QUICK PASS
  -- scan writable image sections in owner module and
  -- main module for:
  --   1) embedded/global objects whose first ptr is a vtable
  --   2) static refs/pointers to such objects
  ---------------------------------------------------------

  local instances = {}
  local instancesMap = {}

  local staticrefs = {}
  local staticrefsMap = {}

  local quickModules = { ownerModule }
  if mainModule ~= nil and mainModule.base ~= ownerModule.base then
    table.insert(quickModules, mainModule)
  end

  local quickRanges = collectQuickRanges(quickModules)

  local function runQuickPass()
    local beforeInst = #instances
    local beforeRefs = #staticrefs
    local t0 = os.clock()

    if #quickRanges == 0 then
      print("Quick pass: no image ranges to scan")
      return
    end

    print("")
    print("==== QUICK PASS ====")
    print(string.format("Quick image ranges: %d", #quickRanges))

    for i=1,#quickRanges do
      local rg = quickRanges[i]

      print(string.format(
        'Quick %d/%d : %s %s (%x-%x)',
        i, #quickRanges, rg.module, rg.section, rg.base, rg.finish
      ))

      local p = rg.base
      local stop = rg.finish - pointersize + 1
      local step = 0

      while p <= stop do
        if (step % 4096) == 0 then
          pulseUI()
        end

        local v = normalizePtr(readPointer(p))

        if v ~= nil then
          -- direct/global object embedded in writable image memory
          if vtablesMap[v] then
            addUnique(instances, instancesMap, p)
          end

          -- pointer/static ref to object
          if v > 0x10000 then
            local first = normalizePtr(readPointer(v))
            if first ~= nil and vtablesMap[first] then
              addUnique(staticrefs, staticrefsMap, p)
              addUnique(instances, instancesMap, v)
            end
          end
        end

        p = p + pointersize
        step = step + 1
      end
    end

    table.sort(instances)
    table.sort(staticrefs)

    print(string.format(
      "Quick pass added %d candidate instance(s), %d static/image ref(s) in %.3f sec",
      #instances - beforeInst,
      #staticrefs - beforeRefs,
      os.clock() - t0
    ))
  end

  runQuickPass()

  ---------------------------------------------------------
  -- ASK ABOUT FULL SCAN
  ---------------------------------------------------------

  local function shouldRunFullScan()
    local text

    if #instances > 0 or #staticrefs > 0 then
      text = string.format(
        "Quick scan finished.\n\nCandidate instances: %d\nStatic/image refs: %d\n\nRun full scan too?",
        #instances,
        #staticrefs
      )
    else
      text =
        "Quick scan found no hits.\n\n" ..
        "Run full scan anyway?"
    end

    return messageDialog(text, mtConfirmation, mbYes, mbNo) == mrYes
  end

  ---------------------------------------------------------
  -- FULL PASS
  -- broad/full memory scan for all discovered vtables
  ---------------------------------------------------------

  local function runFullPass()
    local beforeInst = #instances
    local t0 = os.clock()

    print("")
    print("==== FULL PASS ====")

    local okRun, _, runErr = runWithProgress('Full scan', function(state, dlg)
      withMemScan(function(s, fl)
        for i=1,#vtables do
          dlg.checkCancelled()

          local vt = vtables[i]

          print(string.format('Full %d/%d : scanning for %x', i, #vtables, vt))

          local hits = scanValue(
            s,
            fl,
            scantype,
            vt,
            0,
            maxaddr,
            "*W*X*C",
            fsmNotAligned,
            '1',
            state,
            dlg,
            'Full pass...',
            string.format('Scanning %d / %d for %x', i, #vtables, vt)
          )

          for j=1,#hits do
            addUnique(instances, instancesMap, hits[j])
          end

          pulseUI()
        end
      end)
    end)

    if not okRun then
      if runErr == CANCELLED then
        print("Full scan cancelled by user")
        return false
      end
      error(runErr)
    end

    table.sort(instances)

    print(string.format(
      "Full pass added %d new candidate instance(s) in %.3f sec",
      #instances - beforeInst,
      os.clock() - t0
    ))

    return true
  end

  if shouldRunFullScan() then
    local completed = runFullPass()
    if completed == false then
      return
    end
  else
    print("Full scan skipped by user")
  end

  ---------------------------------------------------------
  -- OUTPUT
  ---------------------------------------------------------

  table.sort(staticrefs)
  table.sort(instances)

  print("")

  if #staticrefs > 0 then
    print("The following static/image refs to the class "..picked.name.." were found")
    for i=1,#staticrefs do
      local ref = staticrefs[i]
      local obj = normalizePtr(readPointer(ref))
      print(string.format('%s -> %s', formatAddress(modules, ref), formatAddress(modules, obj)))
    end
  else
    print("No static/image refs were found")
  end

  print("")
  print("The following candidate instances of the class "..picked.name.." were found")
  for i=1,#instances do
    print(formatAddress(modules, instances[i]))
  end
  print("")

end, TRACEBACK)

if not ok then
  print('[Find class instances] Error:')
  print(err)
end

autoUntick()