#include "providers.h"
#include "child_process.h"
#include "handle_channel.h"
#include "section.h"
#include "ansi_api.h"
#include "module_api.h"
#include "loader.h"
#include "tls.h"
#include "exceptions.h"
#include "resources.h"
#include "memory.h"
#include "object_api.h"
#include "heap.h"
#include "api.h"
#include "apiset.h"
#include "text.h"
#include "kernel_context.h"
#include "actctx.h"
#include "unwind.h"
#include "prefix.h"
#include "profile_api.h"
#include "runtime_profile.h"
#include "registry.h"
#include "system_exports.h"
#include "desktop/api.h"
#include "desktop/windows.h"
#include "cpu/served_queue.h"
#ifdef RAVEN_OPENGL
#include "graphics/opengl_bridge.h"
#endif
#ifdef RAVEN_VULKAN
#include "graphics/vulkan_bridge.h"
#endif

#include <unistd.h>
#include <sys/mman.h>
#include <x86intrin.h>
#include <algorithm>
#include <fstream>
#include <iostream>
#include <array>
#include <stdexcept>
#include <csignal>

namespace raven {

// A whole host file in one read: libraries such as a browser's main DLL run to hundreds of megabytes, and reading them a character at
// a time through a stream iterator cost seconds in every process that loads them.
static std::vector<uint8_t> read_host_file(const std::filesystem::path &path)
{
	std::ifstream stream(path, std::ios::binary | std::ios::ate);
	const auto size = stream ? stream.tellg() : std::streampos(-1);
	if (size <= 0)
		return {};
	std::vector<uint8_t> bytes(static_cast<size_t>(size));
	stream.seekg(0);
	if (!stream.read(reinterpret_cast<char *>(bytes.data()), size))
		bytes.resize(static_cast<size_t>(stream.gcount()));
	return bytes;
}

// The PathCch functions live in kernelbase.dll on Windows and are not in the import libraries the public lists come from.
static constexpr std::array<std::string_view, 50> names{
	"CloseHandle","CreateEventA","CreateEventW","ExitProcess",
	"FindResourceA", "FindResourceExA", "FindResourceExW", "FindResourceW", "FreeLibrary",
	"GetACP", "GetCommandLineA", "GetCommandLineW", "GetCurrentProcessId", "GetCurrentThreadId", "GetFileType", "GetLastError", "GetModuleHandleA",
	"GetModuleHandleW", "GetProcAddress", "GetProcessHeap", "GetStartupInfoA", "GetStartupInfoW", "GetStdHandle", "HeapAlloc", "HeapCreate", "HeapDestroy", "HeapFree", "HeapReAlloc", "HeapSize",
	"LoadLibraryA", "LoadLibraryW", "LoadResource",
	"LockResource", "MultiByteToWideChar", "PathCchCanonicalize", "PathCchCanonicalizeEx", "PathCchCombineEx", "PathCchRemoveFileSpec", "PathCchSkipRoot", "RaiseException", "ResetEvent", "SetEvent", "SetLastError", "SizeofResource",
	"VirtualAlloc", "VirtualFree", "VirtualProtect", "VirtualQuery", "WaitForSingleObject", "WriteFile"
};

std::vector<uint8_t> environment_provider(std::string_view name, uint64_t base)
{
	if (name != "kernel32.dll" && name != "kernelbase.dll")
		throw std::runtime_error("unsupported environment provider module");
	return runtime_provider(name, base, names);
}

namespace {

// Hot kernel32 services that run as guest machine code on the thread block; the slow path traps at offset 0x30.
struct FastStub {
	std::string_view name;
	std::vector<uint8_t> code;
};

const std::vector<FastStub> &fast_stubs()
{
	static const std::vector<FastStub> stubs = {
		// mov eax, gs:[0x68]; ret
		{"GetLastError", {0x65, 0x8b, 0x04, 0x25, 0x68, 0, 0, 0, 0xc3}},
		// mov eax, gs:[0x48]; ret (the thread's ClientId.UniqueThread)
		{"GetCurrentThreadId", {0x65, 0x8b, 0x04, 0x25, 0x48, 0, 0, 0, 0xc3}},
		// mov eax, gs:[0x40]; ret (the thread's ClientId.UniqueProcess)
		{"GetCurrentProcessId", {0x65, 0x8b, 0x04, 0x25, 0x40, 0, 0, 0, 0xc3}},
		// mov gs:[0x68], ecx; ret
		{"SetLastError", {0x65, 0x89, 0x0c, 0x25, 0x68, 0, 0, 0, 0xc3}},
		// mov rax, -1; ret (the pseudo handle of the current process)
		{"GetCurrentProcess", {0x48, 0xc7, 0xc0, 0xff, 0xff, 0xff, 0xff, 0xc3}},
		// mov rax, -2; ret (the pseudo handle of the current thread)
		{"GetCurrentThread", {0x48, 0xc7, 0xc0, 0xfe, 0xff, 0xff, 0xff, 0xc3}},
		// cmp ecx,64; jae slow; mov ecx,ecx; mov rax,gs:[rcx*8+0x1480]; mov dword gs:[0x68],0; ret
		{"TlsGetValue", {0x83, 0xf9, 0x40, 0x73, 0x2b, 0x8b, 0xc9, 0x65, 0x48, 0x8b, 0x04, 0xcd, 0x80, 0x14, 0, 0,
			0x65, 0xc7, 0x04, 0x25, 0x68, 0, 0, 0, 0, 0, 0, 0, 0xc3}},
		// cmp ecx,64; jae slow; mov ecx,ecx; mov gs:[rcx*8+0x1480],rdx; mov eax,1; ret
		{"TlsSetValue", {0x83, 0xf9, 0x40, 0x73, 0x2b, 0x8b, 0xc9, 0x65, 0x48, 0x89, 0x14, 0xcd, 0x80, 0x14, 0, 0,
			0xb8, 1, 0, 0, 0, 0xc3}},
		// mov rax,gs:[0x17c8]; test rax,rax; jz slow; cmp ecx,4080; jae slow; mov ecx,ecx; mov rax,[rax+rcx*8]; mov dword gs:[0x68],0; ret
		{"FlsGetValue", {0x65, 0x48, 0x8b, 0x04, 0x25, 0xc8, 0x17, 0, 0, 0x48, 0x85, 0xc0, 0x74, 0x22,
			0x81, 0xf9, 0xf0, 0x0f, 0, 0, 0x73, 0x1a, 0x8b, 0xc9, 0x48, 0x8b, 0x04, 0xc8,
			0x65, 0xc7, 0x04, 0x25, 0x68, 0, 0, 0, 0, 0, 0, 0, 0xc3}},
		// The same without touching the last error, as the second form does.
		{"FlsGetValue2", {0x65, 0x48, 0x8b, 0x04, 0x25, 0xc8, 0x17, 0, 0, 0x48, 0x85, 0xc0, 0x74, 0x22,
			0x81, 0xf9, 0xf0, 0x0f, 0, 0, 0x73, 0x1a, 0x8b, 0xc9, 0x48, 0x8b, 0x04, 0xc8, 0xc3}},
		// A one-time initialization that has completed answers in the guest; any other state is served.
		// mov rax,[rcx]; mov r10,rax; and r10,3; cmp r10,2; jne slow; test r9,r9; jz done; and rax,-4; mov [r9],rax; done: mov eax,1; ret
		{"InitOnceExecuteOnce", {0x48, 0x8b, 0x01, 0x49, 0x89, 0xc2, 0x49, 0x83, 0xe2, 0x03, 0x49, 0x83, 0xfa, 0x02, 0x75, 0x20,
			0x4d, 0x85, 0xc9, 0x74, 0x07, 0x48, 0x83, 0xe0, 0xfc, 0x49, 0x89, 0x01, 0xb8, 1, 0, 0, 0, 0xc3}},
		// Singly linked lists keep the served layout: the head in the first word, the depth in the low 16 bits of the second
		// and a sequence above it that every change advances, so a 16-byte compare and exchange updates both at once.
		// test cl,15; jnz slow; push rbx; mov r9,rcx; mov r8,rdx; mov rax,[r9]; mov rdx,[r9+8]
		// retry: mov [r8],rax; mov rbx,r8; lea rcx,[rdx+0x10001]; lock cmpxchg16b [r9]; jnz retry; pop rbx; ret
		{"InterlockedPushEntrySList", {0xf6, 0xc1, 0x0f, 0x75, 0x2b, 0x53, 0x49, 0x89, 0xc9, 0x49, 0x89, 0xd0, 0x49, 0x8b, 0x01,
			0x49, 0x8b, 0x51, 0x08, 0x49, 0x89, 0x00, 0x4c, 0x89, 0xc3, 0x48, 0x8d, 0x8a, 0x01, 0x00, 0x01, 0x00,
			0xf0, 0x49, 0x0f, 0xc7, 0x09, 0x75, 0xec, 0x5b, 0xc3}},
		// test cl,15; jnz slow; push rbx; mov r9,rcx; mov rax,[r9]; mov rdx,[r9+8]
		// retry: test rax,rax; jz done; mov rbx,[rax]; lea rcx,[rdx+0xffff]; lock cmpxchg16b [r9]; jnz retry; done: pop rbx; ret
		{"InterlockedPopEntrySList", {0xf6, 0xc1, 0x0f, 0x75, 0x2b, 0x53, 0x49, 0x89, 0xc9, 0x49, 0x8b, 0x01, 0x49, 0x8b, 0x51, 0x08,
			0x48, 0x85, 0xc0, 0x74, 0x11, 0x48, 0x8b, 0x18, 0x48, 0x8d, 0x8a, 0xff, 0xff, 0x00, 0x00,
			0xf0, 0x49, 0x0f, 0xc7, 0x09, 0x75, 0xea, 0x5b, 0xc3}},
		// test cl,15; jnz slow; push rbx; mov r9,rcx; mov rax,[r9]; mov rdx,[r9+8]
		// retry: test rax,rax; jz done; xor ebx,ebx; mov rcx,rdx; xor cx,cx; add rcx,0x10000; lock cmpxchg16b [r9]; jnz retry; done: pop rbx; ret
		{"InterlockedFlushSList", {0xf6, 0xc1, 0x0f, 0x75, 0x2b, 0x53, 0x49, 0x89, 0xc9, 0x49, 0x8b, 0x01, 0x49, 0x8b, 0x51, 0x08,
			0x48, 0x85, 0xc0, 0x74, 0x16, 0x31, 0xdb, 0x48, 0x89, 0xd1, 0x66, 0x31, 0xc9, 0x48, 0x81, 0xc1, 0x00, 0x00, 0x01, 0x00,
			0xf0, 0x49, 0x0f, 0xc7, 0x09, 0x75, 0xe5, 0x5b, 0xc3}},
	};
	return stubs;
}

}

// Calls that only read and write guest memory: their stubs leave the arguments in a block the runtime shares with the guest and spin until
// the answer is there, so the guest never stops for them.
static bool served_api(std::string_view module, std::string_view name)
{
	if (module == "kernel32.dll" || module == "kernelbase.dll")
		return name == "QueryPerformanceCounter" || name == "QueryPerformanceFrequency" || name == "WakeConditionVariable" ||
			name == "WakeAllConditionVariable" || name == "ReleaseSemaphore" || name == "CreateSemaphoreExW" ||
			name == "WaitForSingleObject" || name == "WaitForSingleObjectEx" || name == "SetEvent" || name == "ResetEvent" || name == "CloseHandle";
	// Reading a socket's recorded events polls the host sockets and never blocks.
	if (module == "ws2_32.dll")
		return name == "WSAEnumNetworkEvents";
	// Waking marks the sleepers; they run when the scheduler next picks a thread.
	if (module == "ntdll.dll")
		return name == "RtlWakeConditionVariable" || name == "RtlWakeAllConditionVariable";
#ifdef RAVEN_OPENGL
	if (module == "opengl32.dll")
		return OpenGLBridge::served_api(name);
#endif
	if (module != "vulkan-1.dll")
		return false;
	static constexpr std::array<std::string_view, 23> recording{
		"vkAcquireNextImageKHR", "vkAllocateCommandBuffers", "vkAllocateDescriptorSets", "vkBeginCommandBuffer", "vkEndCommandBuffer", "vkFreeCommandBuffers",
		"vkFreeDescriptorSets", "vkGetDescriptorEXT", "vkGetFenceStatus", "vkGetSemaphoreCounterValue", "vkGetSemaphoreCounterValueKHR", "vkQueueSubmit",
		"vkQueueSubmit2", "vkQueueSubmit2KHR", "vkResetCommandBuffer", "vkResetCommandPool", "vkResetDescriptorPool", "vkResetFences",
		"vkSignalSemaphore", "vkSignalSemaphoreKHR", "vkUpdateDescriptorSetWithTemplate", "vkUpdateDescriptorSetWithTemplateKHR",
		"vkUpdateDescriptorSets"};
	return name.starts_with("vkCmd") || std::find(recording.begin(), recording.end(), name) != recording.end();
}

// A served stub: it loads the block address from the provider's own pointer, which stays zero until the runtime maps the block, stores
// RCX, RDX, R8, R9, RSP and the low halves of XMM0 to XMM3, publishes its own address and spins until the runtime clears it. After a
// thousand rounds it stops at a breakpoint instead, which gives the processor to the runtime when the two compete for it.
static constexpr size_t served_stub_size = 128, served_trap = 0x70, served_wait = 85, served_yield = 109;

static std::vector<uint8_t> served_stub(int32_t to_pointer)
{
	std::vector<uint8_t> code{0x4c, 0x8b, 0x15, 0, 0, 0, 0, 0x4d, 0x85, 0xd2, 0x74, uint8_t(served_trap - 12),
		0x49, 0x89, 0x4a, 0x08, 0x49, 0x89, 0x52, 0x10, 0x4d, 0x89, 0x42, 0x18, 0x4d, 0x89, 0x4a, 0x20, 0x49, 0x89, 0x62, 0x28,
		0x66, 0x49, 0x0f, 0x7e, 0x42, 0x30, 0x66, 0x49, 0x0f, 0x7e, 0x4a, 0x38, 0x66, 0x49, 0x0f, 0x7e, 0x52, 0x40, 0x66, 0x49, 0x0f, 0x7e, 0x5a, 0x48,
		0x4c, 0x8d, 0x1d, 0xc1, 0xff, 0xff, 0xff, 0x4d, 0x89, 0x1a,
		// mov r11d, 1000; spin: pause; cmp qword [r10], 0; je done; dec r11d; jnz spin; int3; jmp to the compare; nop
		0x41, 0xbb, 0xe8, 0x03, 0x00, 0x00, 0xf3, 0x90, 0x49, 0x83, 0x3a, 0x00, 0x74, 0x0a, 0x41, 0xff, 0xcb, 0x75, 0xf3, 0xcc, 0xeb, 0xf2,
		0x66, 0x90,
		// done: mov rax, [r10+80]; mov r11, [r10+88]; test r11, r11; je return; cmp r11d, 2; je fallback; int3; return: ret
		// A declined call (2) takes the fallback trap that follows, with the argument registers as the caller left them.
		0x49, 0x8b, 0x42, 0x50, 0x4d, 0x8b, 0x5a, 0x58, 0x4d, 0x85, 0xdb, 0x74, 0x07, 0x41, 0x83, 0xfb, 0x02, 0x74, 0x03, 0xcc, 0xc3};
	const int32_t displacement = to_pointer - 7;
	std::memcpy(code.data() + 3, &displacement, 4);
	code.resize(served_trap + 2);
	code[served_trap] = 0xcc;
	code[served_trap + 1] = 0xc3;
	return code;
}

static unsigned queued_arguments(std::string_view module, std::string_view name)
{
#ifdef RAVEN_OPENGL
	if (module == "opengl32.dll") {
		if (!std::getenv("RAVEN_QUEUED_OPENGL")) return 0;
		// Only context-local state: shared texture and program changes still flush every producer synchronously.
		if (name == "glColor4f" || name == "glColor4ub" || name == "glRotatef" || name == "glDrawElements") return 4;
		if (name == "glVertex3f" || name == "glTranslatef" || name == "glScalef") return 3;
		if (name == "glTexCoord2f" || name == "glBindBuffer") return 2;
		if (name == "glActiveTexture" || name == "glUseProgram" || name == "glEnable" || name == "glDisable") return 1;
		return 0;
	}
#endif
	if (module != "vulkan-1.dll")
		return 0;
	if (name == "vkCmdBindDescriptorSets") return 8;
	if (name == "vkCmdBindVertexBuffers") return 5;
	if (name == "vkCmdDrawIndexed") return 6;
	if (name == "vkCmdDraw" || name == "vkCmdDrawIndirect" || name == "vkCmdDrawIndexedIndirect") return 5;
	if (name == "vkCmdBindIndexBuffer" || name == "vkCmdDispatch") return 4;
	if (name == "vkCmdBindPipeline" || name == "vkCmdSetStencilReference") return 3;
	return 0;
}

static constexpr size_t queued_prelude_size = 384;

static std::vector<uint8_t> queued_prelude(int32_t to_served, unsigned arguments, std::string_view name)
{
	static_assert(ServedQueue::head * 8 == 0x80 && ServedQueue::tail * 8 == 0x88 && ServedQueue::enabled * 8 == 0x90 &&
		ServedQueue::records * 8 == 0x100 && ServedQueue::gl_elements * 8 == 0x98 && ServedQueue::words == 16 && ServedQueue::capacity == 16);
	// Read the thread's ring, or use the synchronous stub when disabled, full or the copied arrays would exceed a record.
	std::vector<uint8_t> code{
		0x66, 0x90, 0x65, 0x4c, 0x8b, 0x14, 0x25, 0xf0, 0x1f, 0, 0, 0x4d, 0x85, 0xd2, 0x0f, 0x84, 0, 0, 0, 0,
		0x49, 0x83, 0xba, 0x90, 0, 0, 0, 1, 0x0f, 0x85, 0, 0, 0, 0,
		0x49, 0x8b, 0x82, 0x80, 0, 0, 0, 0x49, 0x89, 0xc3, 0x4d, 0x2b, 0x9a, 0x88, 0, 0, 0,
		0x49, 0x83, 0xfb, 0x10, 0x0f, 0x83, 0, 0, 0, 0,
		0x49, 0x89, 0xc3, 0x41, 0x83, 0xe3, 0x0f, 0x49, 0xc1, 0xe3, 7, 0x4d, 0x01, 0xd3,
		0x49, 0x89, 0x8b, 0x08, 1, 0, 0, 0x49, 0x89, 0x93, 0x10, 1, 0, 0,
		0x4d, 0x89, 0x83, 0x18, 1, 0, 0, 0x4d, 0x89, 0x8b, 0x20, 1, 0, 0};
	std::vector<size_t> fallback{16, 30, 57};
	if (name == "glDrawElements") {
		const uint8_t bound[]{0x49, 0x83, 0xba, 0x98, 0, 0, 0, 1, 0x0f, 0x85, 0, 0, 0, 0};
		fallback.push_back(code.size() + 10);
		code.insert(code.end(), std::begin(bound), std::end(bound));
	} else if (name == "glBindBuffer") {
		// Element-buffer changes publish the capability before another draw can enter the ring.
		const uint8_t elements[]{0x81, 0xf9, 0x93, 0x88, 0, 0, 0x0f, 0x84, 0, 0, 0, 0};
		fallback.push_back(code.size() + 8);
		code.insert(code.end(), std::begin(elements), std::end(elements));
	}
	const bool descriptors = name == "vkCmdBindDescriptorSets", vertices = name == "vkCmdBindVertexBuffers";
	if (descriptors) {
		for (const uint8_t at : {uint8_t(40), uint8_t(56)}) {
			const uint8_t bound[]{0x83, 0x7c, 0x24, at, 4, 0x0f, 0x87, 0, 0, 0, 0};
			fallback.push_back(code.size() + 7);
			code.insert(code.end(), std::begin(bound), std::end(bound));
		}
	} else if (vertices) {
		const uint8_t bound[]{0x41, 0x83, 0xf8, 4, 0x0f, 0x87, 0, 0, 0, 0};
		fallback.push_back(code.size() + 6);
		code.insert(code.end(), std::begin(bound), std::end(bound));
	}
	for (unsigned index = 4; index < arguments; ++index) {
		const uint8_t word[]{0x48, 0x8b, 0x4c, 0x24, uint8_t(40 + (index - 4) * 8),
			0x49, 0x89, 0x8b, uint8_t(8 + index * 8), 1, 0, 0};
		code.insert(code.end(), std::begin(word), std::end(word));
	}
	if (name.starts_with("gl")) {
		// Copy the low XMM words before the caller can reuse them. Vulkan's array payload uses these words instead.
		for (unsigned index = 0; index < 4; ++index) {
			const uint8_t word[]{0x66, 0x49, 0x0f, 0x7e, uint8_t(0x83 + index * 8), uint8_t(0x48 + index * 8), 1, 0, 0};
			code.insert(code.end(), std::begin(word), std::end(word));
		}
	}
	if (descriptors || vertices) {
		// Preserve Windows' nonvolatile copy registers; the published pointers name the record, never the caller's scratch arrays.
		code.insert(code.end(), {0x56, 0x57});
		const auto copy = [&](unsigned pointer, unsigned count, unsigned payload, bool wide) {
			const auto displacement = [&](unsigned value) {
				const uint32_t at = 0x100 + value;
				const auto *bytes = reinterpret_cast<const uint8_t *>(&at);
				code.insert(code.end(), bytes, bytes + 4);
			};
			code.insert(code.end(), {0x49, 0x8b, 0xb3}); displacement((pointer + 1) * 8);
			code.insert(code.end(), {0x49, 0x8d, 0xbb}); displacement(payload);
			code.insert(code.end(), {0x49, 0x89, 0xbb}); displacement((pointer + 1) * 8);
			code.insert(code.end(), {0x41, 0x8b, 0x8b}); displacement((count + 1) * 8);
			code.push_back(0xf3);
			if (wide) code.push_back(0x48);
			code.push_back(0xa5);
		};
		if (descriptors) { copy(5, 4, 80, true); copy(7, 6, 112, false); }
		else { copy(3, 2, 64, true); copy(4, 2, 96, true); }
		code.insert(code.end(), {0x5f, 0x5e});
	}
	const size_t stub_pointer = code.size() + 3;
	const uint8_t publish[]{0x48, 0x8d, 0x0d, 0, 0, 0, 0, 0x49, 0x89, 0x8b, 0, 1, 0, 0,
		0x49, 0xff, 0x82, 0x80, 0, 0, 0, 0xc3};
	code.insert(code.end(), std::begin(publish), std::end(publish));
	if (code.size() > queued_prelude_size - 5)
		throw std::runtime_error("queued command prelude exceeds its slot");
	code.resize(queued_prelude_size, 0x90);
	const auto relative = [&](size_t at, int32_t target) {
		const int32_t displacement = target - int32_t(at + 4);
		std::memcpy(code.data() + at, &displacement, 4);
	};
	for (const size_t at : fallback)
		relative(at, queued_prelude_size - 5);
	relative(stub_pointer, to_served);
	code[queued_prelude_size - 5] = 0xe9;
	relative(queued_prelude_size - 4, to_served);
	return code;
}

// The performance counter is read in the guest once the runtime has published how the processor's time stamp counter relates to it: the
// stub exported for it is a prelude that computes the count from RDTSC and falls back to its served stub until then. The calibration sits
// in the served block: the counter value at the base, the count at the base, and the multiplier, a 32.32 fixed-point count per tick of
// the time stamp counter, written last.
static bool guest_clock_api(std::string_view module, std::string_view name)
{
	return (module == "kernel32.dll" || module == "kernelbase.dll") && name == "QueryPerformanceCounter";
}

static constexpr size_t clock_prelude_size = 96, clock_calibration = 0x800;

static std::vector<uint8_t> clock_prelude(int32_t to_pointer, int32_t to_served)
{
	std::vector<uint8_t> code{
		// mov r10, [pointer]; test r10, r10; jz served
		0x4c, 0x8b, 0x15, 0, 0, 0, 0, 0x4d, 0x85, 0xd2, 0x0f, 0x84, 0, 0, 0, 0,
		// mov r11, [r10 + multiplier]; test r11, r11; jz served
		0x4d, 0x8b, 0x9a, 0x10, 0x08, 0, 0, 0x4d, 0x85, 0xdb, 0x0f, 0x84, 0, 0, 0, 0,
		// rdtsc; shl rdx, 32; or rax, rdx; sub rax, [r10 + base counter]; mul r11; shrd rax, rdx, 32; add rax, [r10 + base count]
		0x0f, 0x31, 0x48, 0xc1, 0xe2, 0x20, 0x48, 0x09, 0xd0, 0x49, 0x2b, 0x82, 0x00, 0x08, 0, 0, 0x49, 0xf7, 0xe3, 0x48, 0x0f, 0xac, 0xd0, 0x20,
		0x49, 0x03, 0x82, 0x08, 0x08, 0, 0,
		// mov [rcx], rax; mov eax, 1; ret
		0x48, 0x89, 0x01, 0xb8, 1, 0, 0, 0, 0xc3};
	const int32_t displacement = to_pointer - 7;
	std::memcpy(code.data() + 3, &displacement, 4);
	for (const size_t jump : {size_t(12), size_t(28)}) {
		const int32_t relative = to_served - int32_t(jump + 4);
		std::memcpy(code.data() + jump, &relative, 4);
	}
	return code;
}

// Committing and decommitting pages that are already open in the guest is done by the guest itself: the runtime publishes the open
// ranges in the served block, and the preludes of VirtualAlloc and VirtualFree log a read-write commit, or a small decommit, that falls in
// one of them there instead of stopping; the runtime takes the log into its accounting before its next memory operation. A decommit
// zeroes its pages in place and leaves them open, as the runtime does for pages inside a range. Anything else jumps to the export's
// breakpoint.
enum class GuestMemoryApi { none, commit, decommit };

static GuestMemoryApi guest_memory_api(std::string_view module, std::string_view name)
{
	if (module != "kernel32.dll" && module != "kernelbase.dll")
		return GuestMemoryApi::none;
	return name == "VirtualAlloc" ? GuestMemoryApi::commit : name == "VirtualFree" ? GuestMemoryApi::decommit : GuestMemoryApi::none;
}

static bool guest_commit_api(std::string_view module, std::string_view name)
{
	return guest_memory_api(module, name) != GuestMemoryApi::none;
}

static constexpr size_t commit_prelude_size = 192;

static size_t commit_jump(GuestMemoryApi kind)
{
	return kind == GuestMemoryApi::commit ? 37 : 31;
}

// mov r10,[pointer]; test r10,r10; jz slow; test rcx,rcx; jz slow; test rdx,rdx; jz slow; cmp r8d,MEM_DECOMMIT; je main; slow: jmp trap;
// restore: mov r8d,MEM_DECOMMIT; jmp slow; main: cmp rdx,256 KiB; ja slow; rax = first page, r11 = end page; look through the open
// ranges for one holding [rax, r11), take a log slot with lock xadd, zero the pages with rep stosb (keeping rdi), store the range with
// its low bit set and return TRUE; a full log or no range goes back to restore.
static std::vector<uint8_t> decommit_prelude(int32_t to_pointer, int32_t to_trap)
{
	std::vector<uint8_t> code{0x4c, 0x8b, 0x15, 0, 0, 0, 0, 0x4d, 0x85, 0xd2, 0x74, 0x13, 0x48, 0x85, 0xc9, 0x74, 0x0e, 0x48, 0x85, 0xd2,
		0x74, 0x09, 0x41, 0x81, 0xf8, 0x00, 0x40, 0x00, 0x00, 0x74, 0x0d, 0xe9, 0, 0, 0, 0, 0x41, 0xb8, 0x00, 0x40, 0x00, 0x00,
		0xeb, 0xf3, 0x48, 0x81, 0xfa, 0x00, 0x00, 0x04, 0x00, 0x77, 0xea, 0x48, 0x89, 0xc8, 0x48, 0x25, 0x00, 0xf0, 0xff, 0xff, 0x4c,
		0x8d, 0x9c, 0x11, 0xff, 0x0f, 0x00, 0x00, 0x49, 0x81, 0xe3, 0x00, 0xf0, 0xff, 0xff, 0x45, 0x8b, 0x82, 0x00, 0x0a, 0x00, 0x00,
		0x4d, 0x8d, 0x8a, 0x08, 0x0a, 0x00, 0x00, 0x45, 0x85, 0xc0, 0x74, 0xc4, 0x49, 0x3b, 0x01, 0x72, 0x4b, 0x4d, 0x3b, 0x59, 0x08,
		0x77, 0x45, 0x41, 0xb8, 0x01, 0x00, 0x00, 0x00, 0xf0, 0x45, 0x0f, 0xc1, 0x82, 0x10, 0x0d, 0x00, 0x00, 0x41, 0x83, 0xf8, 0x20,
		0x73, 0xa4, 0x49, 0xc1, 0xe0, 0x04, 0x57, 0x48, 0x89, 0xc7, 0x49, 0x89, 0xc1, 0x4c, 0x89, 0xd9, 0x48, 0x29, 0xc1, 0x31, 0xc0,
		0xf3, 0xaa, 0x5f, 0x49, 0x83, 0xc9, 0x01, 0x4f, 0x89, 0x8c, 0x02, 0x18, 0x0d, 0x00, 0x00, 0x4f, 0x89, 0x9c, 0x02, 0x20, 0x0d,
		0x00, 0x00, 0xb8, 0x01, 0x00, 0x00, 0x00, 0xc3, 0x49, 0x83, 0xc1, 0x10, 0x41, 0xff, 0xc8, 0xeb, 0xa2};
	const int32_t displacement = to_pointer - 7;
	std::memcpy(code.data() + 3, &displacement, 4);
	const int32_t relative = to_trap - int32_t(commit_jump(GuestMemoryApi::decommit) + 5);
	std::memcpy(code.data() + commit_jump(GuestMemoryApi::decommit) + 1, &relative, 4);
	return code;
}

// String services that the guest runs itself in their common case: lengths and bounded copies, and conversions of plain ASCII text
// between the ANSI or UTF-8 code pages and UTF-16, which every such code page maps alike. A program that starts with thousands of them
// would otherwise stop for each. Each ends in a jump to the export's breakpoint, taken for null pointers, other code pages or flags,
// text beyond ASCII, and buffers too small, where the runtime answers.
struct GuestPrelude {
	std::string_view name;
	std::vector<uint8_t> code;
};

static const std::vector<GuestPrelude> &string_preludes()
{
	// lstrlen: count to the terminator, 0 for a null pointer. lstrcpyn: copy at most n - 1 characters and terminate, returning the
	// destination. MultiByteToWideChar and WideCharToMultiByte: code page 0, 1252 or UTF-8, only flags that leave plain ASCII as it is
	// (MB_PRECOMPOSED and MB_ERR_INVALID_CHARS, none for UTF-8 beyond the second), the length counted when it is -1, every character
	// below 0x80, and the result written when there is room or its length returned when the buffer is absent or empty; the
	// used-default flag is cleared when asked for. lstrcmpW: two ASCII strings ordered as the runtime orders them, by their upper case
	// letters and then, on a tie, with the lower case letter first. CompareStringEx and CompareStringW: the same order for two ASCII
	// strings, counted or terminated, the case ignored for the flags the runtime ignores it for (the CLR compares names this way by the
	// thousand while Paint.NET draws). GetThreadLocale and SetThreadLocale: the runtime's constant answers, US English and success.
	static const std::vector<uint8_t> compare = {0x4d, 0x85, 0xc0, 0x0f, 0x84, 0xd1, 0x00, 0x00, 0x00, 0x4c, 0x8b, 0x54, 0x24, 0x28, 0x4d, 0x85, 0xd2, 0x0f, 0x84, 0xc3, 0x00, 0x00, 0x00, 0x44,
		0x8b, 0x5c, 0x24, 0x30, 0x45, 0x89, 0xc9, 0x45, 0x85, 0xc9, 0x79, 0x10, 0x45, 0x31, 0xc9, 0x66, 0x43, 0x83, 0x3c, 0x48, 0x00, 0x74, 0x05, 0x49,
		0xff, 0xc1, 0xeb, 0xf3, 0x45, 0x85, 0xdb, 0x79, 0x10, 0x45, 0x31, 0xdb, 0x66, 0x43, 0x83, 0x3c, 0x5a, 0x00, 0x74, 0x05, 0x49, 0xff, 0xc3, 0xeb,
		0xf3, 0x53, 0x56, 0x31, 0xc9, 0x4c, 0x39, 0xc9, 0x74, 0x3f, 0x4c, 0x39, 0xd9, 0x74, 0x3a, 0x41, 0x0f, 0xb7, 0x04, 0x48, 0x41, 0x0f, 0xb7, 0x1c,
		0x4a, 0x3d, 0x80, 0x00, 0x00, 0x00, 0x73, 0x70, 0x81, 0xfb, 0x80, 0x00, 0x00, 0x00, 0x73, 0x68, 0x8d, 0x70, 0x9f, 0x83, 0xfe, 0x19, 0x77, 0x03,
		0x83, 0xe8, 0x20, 0x8d, 0x73, 0x9f, 0x83, 0xfe, 0x19, 0x77, 0x03, 0x83, 0xeb, 0x20, 0x39, 0xd8, 0x72, 0x38, 0x77, 0x3d, 0x48, 0xff, 0xc1, 0xeb,
		0xbc, 0x4d, 0x39, 0xd9, 0x72, 0x2c, 0x77, 0x31, 0xf7, 0xc2, 0x11, 0x00, 0x00, 0x10, 0x75, 0x30, 0x31, 0xc9, 0x4c, 0x39, 0xc9, 0x74, 0x29, 0x41,
		0x0f, 0xb7, 0x04, 0x48, 0x41, 0x0f, 0xb7, 0x1c, 0x4a, 0x39, 0xd8, 0x75, 0x05, 0x48, 0xff, 0xc1, 0xeb, 0xe8, 0x8d, 0x70, 0xbf, 0x83, 0xfe, 0x19,
		0x76, 0x07, 0xb8, 0x01, 0x00, 0x00, 0x00, 0xeb, 0x0c, 0xb8, 0x03, 0x00, 0x00, 0x00, 0xeb, 0x05, 0xb8, 0x02, 0x00, 0x00, 0x00, 0x5e, 0x5b, 0xc3,
		0x5e, 0x5b, 0xe9, 0x00, 0x00, 0x00, 0x00};
	static const std::vector<GuestPrelude> preludes = {
		{"lstrlenW", {0x48, 0x85, 0xc9, 0x74, 0x16, 0x48, 0x89, 0xc8, 0x66, 0x83, 0x38, 0x00, 0x74, 0x06, 0x48, 0x83, 0xc0, 0x02, 0xeb, 0xf4, 0x48, 0x29, 0xc8, 0x48,
			0xd1, 0xe8, 0xc3, 0x31, 0xc0, 0xc3, 0xe9, 0x00, 0x00, 0x00, 0x00}},
		{"lstrlenA", {0x48, 0x85, 0xc9, 0x74, 0x11, 0x48, 0x89, 0xc8, 0x80, 0x38, 0x00, 0x74, 0x05, 0x48, 0xff, 0xc0, 0xeb, 0xf6, 0x48, 0x29, 0xc8, 0xc3, 0x31, 0xc0,
			0xc3, 0xe9, 0x00, 0x00, 0x00, 0x00}},
		{"lstrcpynW", {0x48, 0x85, 0xc9, 0x74, 0x36, 0x48, 0x85, 0xd2, 0x74, 0x31, 0x45, 0x85, 0xc0, 0x7e, 0x2c, 0x48, 0x89, 0xc8, 0x45, 0x8d, 0x48, 0xff, 0x45, 0x85,
			0xc9, 0x74, 0x1a, 0x44, 0x0f, 0xb7, 0x12, 0x45, 0x85, 0xd2, 0x74, 0x11, 0x66, 0x44, 0x89, 0x11, 0x48, 0x83, 0xc1, 0x02, 0x48, 0x83, 0xc2, 0x02,
			0x41, 0xff, 0xc9, 0xeb, 0xe1, 0x66, 0xc7, 0x01, 0x00, 0x00, 0xc3, 0xe9, 0x00, 0x00, 0x00, 0x00}},
		{"lstrcpynA", {0x48, 0x85, 0xc9, 0x74, 0x31, 0x48, 0x85, 0xd2, 0x74, 0x2c, 0x45, 0x85, 0xc0, 0x7e, 0x27, 0x48, 0x89, 0xc8, 0x45, 0x8d, 0x48, 0xff, 0x45, 0x85,
			0xc9, 0x74, 0x17, 0x44, 0x0f, 0xb6, 0x12, 0x45, 0x85, 0xd2, 0x74, 0x0e, 0x44, 0x88, 0x11, 0x48, 0xff, 0xc1, 0x48, 0xff, 0xc2, 0x41, 0xff, 0xc9,
			0xeb, 0xe4, 0xc6, 0x01, 0x00, 0xc3, 0xe9, 0x00, 0x00, 0x00, 0x00}},
		{"lstrcmpW", {0x48, 0x85, 0xc9, 0x0f, 0x84, 0x81, 0x00, 0x00, 0x00, 0x48, 0x85, 0xd2, 0x74, 0x7c, 0x45, 0x31, 0xc0, 0x42, 0x0f, 0xb7, 0x04, 0x41, 0x46, 0x0f,
			0xb7, 0x0c, 0x42, 0x3d, 0x80, 0x00, 0x00, 0x00, 0x73, 0x68, 0x41, 0x81, 0xf9, 0x80, 0x00, 0x00, 0x00, 0x73, 0x5f, 0x44, 0x8d, 0x50, 0x9f, 0x41,
			0x83, 0xfa, 0x19, 0x77, 0x03, 0x83, 0xe8, 0x20, 0x45, 0x8d, 0x51, 0x9f, 0x41, 0x83, 0xfa, 0x19, 0x77, 0x04, 0x41, 0x83, 0xe9, 0x20, 0x44, 0x39,
			0xc8, 0x72, 0x30, 0x77, 0x34, 0x85, 0xc0, 0x74, 0x05, 0x49, 0xff, 0xc0, 0xeb, 0xbb, 0x45, 0x31, 0xc0, 0x42, 0x0f, 0xb7, 0x04, 0x41, 0x46, 0x0f,
			0xb7, 0x0c, 0x42, 0x44, 0x39, 0xc8, 0x75, 0x09, 0x85, 0xc0, 0x74, 0x1b, 0x49, 0xff, 0xc0, 0xeb, 0xe8, 0x44, 0x8d, 0x50, 0xbf, 0x41, 0x83, 0xfa,
			0x19, 0x76, 0x06, 0xb8, 0xff, 0xff, 0xff, 0xff, 0xc3, 0xb8, 0x01, 0x00, 0x00, 0x00, 0xc3, 0x31, 0xc0, 0xc3, 0xe9, 0x00, 0x00, 0x00, 0x00}},
		{"MultiByteToWideChar", {0x81, 0xf9, 0xe9, 0xfd, 0x00, 0x00, 0x75, 0x0e, 0xf7, 0xc2, 0xf7, 0xff, 0xff, 0xff, 0x0f, 0x85, 0x88, 0x00, 0x00, 0x00, 0xeb, 0x14, 0x85, 0xc9,
			0x74, 0x08, 0x81, 0xf9, 0xe4, 0x04, 0x00, 0x00, 0x75, 0x7a, 0xf7, 0xc2, 0xf6, 0xff, 0xff, 0xff, 0x75, 0x72, 0x4d, 0x85, 0xc0, 0x74, 0x6d, 0x44,
			0x89, 0xc8, 0x83, 0xf8, 0xff, 0x75, 0x17, 0x4d, 0x89, 0xc2, 0x41, 0x80, 0x3a, 0x00, 0x74, 0x05, 0x49, 0xff, 0xc2, 0xeb, 0xf5, 0x4d, 0x29, 0xc2,
			0x41, 0x8d, 0x42, 0x01, 0xeb, 0x04, 0x85, 0xc0, 0x7e, 0x4a, 0x45, 0x31, 0xd2, 0x41, 0x39, 0xc2, 0x73, 0x0c, 0x43, 0xf6, 0x04, 0x10, 0x80, 0x75,
			0x3b, 0x41, 0xff, 0xc2, 0xeb, 0xef, 0x4c, 0x8b, 0x5c, 0x24, 0x28, 0x44, 0x8b, 0x54, 0x24, 0x30, 0x45, 0x85, 0xd2, 0x74, 0x26, 0x4d, 0x85, 0xdb,
			0x74, 0x22, 0x4d, 0x39, 0xc3, 0x74, 0x1d, 0x41, 0x39, 0xc2, 0x7c, 0x18, 0x45, 0x31, 0xd2, 0x41, 0x39, 0xc2, 0x73, 0x0f, 0x43, 0x0f, 0xb6, 0x14,
			0x10, 0x66, 0x43, 0x89, 0x14, 0x53, 0x41, 0xff, 0xc2, 0xeb, 0xec, 0xc3, 0xe9, 0x00, 0x00, 0x00, 0x00}},
		{"WideCharToMultiByte", {0x85, 0xc9, 0x74, 0x2c, 0x81, 0xf9, 0xe4, 0x04, 0x00, 0x00, 0x74, 0x24, 0x81, 0xf9, 0xe9, 0xfd, 0x00, 0x00, 0x0f, 0x85, 0xa4, 0x00, 0x00, 0x00,
			0x48, 0x83, 0x7c, 0x24, 0x38, 0x00, 0x0f, 0x85, 0x98, 0x00, 0x00, 0x00, 0x48, 0x83, 0x7c, 0x24, 0x40, 0x00, 0x0f, 0x85, 0x8c, 0x00, 0x00, 0x00,
			0x85, 0xd2, 0x0f, 0x85, 0x84, 0x00, 0x00, 0x00, 0x4d, 0x85, 0xc0, 0x74, 0x7f, 0x44, 0x89, 0xc8, 0x83, 0xf8, 0xff, 0x75, 0x1c, 0x4d, 0x89, 0xc2,
			0x66, 0x41, 0x83, 0x3a, 0x00, 0x74, 0x06, 0x49, 0x83, 0xc2, 0x02, 0xeb, 0xf3, 0x4d, 0x29, 0xc2, 0x49, 0xd1, 0xea, 0x41, 0x8d, 0x42, 0x01, 0xeb,
			0x04, 0x85, 0xc0, 0x7e, 0x57, 0x45, 0x31, 0xd2, 0x41, 0x39, 0xc2, 0x73, 0x0e, 0x66, 0x43, 0x81, 0x3c, 0x50, 0x80, 0x00, 0x73, 0x46, 0x41, 0xff,
			0xc2, 0xeb, 0xed, 0x4c, 0x8b, 0x5c, 0x24, 0x28, 0x44, 0x8b, 0x54, 0x24, 0x30, 0x45, 0x85, 0xd2, 0x74, 0x20, 0x4d, 0x85, 0xdb, 0x74, 0x2d, 0x41,
			0x39, 0xc2, 0x7c, 0x28, 0x45, 0x31, 0xd2, 0x41, 0x39, 0xc2, 0x73, 0x0e, 0x43, 0x0f, 0xb7, 0x14, 0x50, 0x43, 0x88, 0x14, 0x13, 0x41, 0xff, 0xc2,
			0xeb, 0xed, 0x4c, 0x8b, 0x5c, 0x24, 0x40, 0x4d, 0x85, 0xdb, 0x74, 0x07, 0x41, 0xc7, 0x03, 0x00, 0x00, 0x00, 0x00, 0xc3, 0xe9, 0x00, 0x00, 0x00,
			0x00}},
		{"CompareStringEx", compare},
		{"CompareStringW", compare},
		{"GetThreadLocale", {0xb8, 0x09, 0x04, 0x00, 0x00, 0xc3, 0xe9, 0x00, 0x00, 0x00, 0x00}},
		{"SetThreadLocale", {0xb8, 0x01, 0x00, 0x00, 0x00, 0xc3, 0xe9, 0x00, 0x00, 0x00, 0x00}},
	};
	return preludes;
}

static const GuestPrelude *string_prelude(std::string_view module, std::string_view name)
{
	if (module != "kernel32.dll" && module != "kernelbase.dll")
		return nullptr;
	for (const auto &prelude : string_preludes())
		if (prelude.name == name)
			return &prelude;
	return nullptr;
}

// Services the guest answers from what the runtime publishes in the served block. The millisecond clocks are the performance counter
// divided by 10000, read from the time stamp counter once the runtime has published its calibration, as QueryPerformanceCounter is.
// Each loads the block pointer first, as the served stubs do, and ends in a jump to the export's breakpoint.
struct BlockPrelude {
	std::string_view module, name;
};

static const std::vector<uint8_t> &tick_prelude()
{
	// mov r10,[pointer]; test r10,r10; jz slow; mov r11,[r10+multiplier]; test r11,r11; jz slow; rdtsc; the count as in the clock
	// prelude; xor edx,edx; mov ecx,10000; div rcx; ret; slow: jmp breakpoint
	static const std::vector<uint8_t> code{
		0x4c, 0x8b, 0x15, 0x00, 0x00, 0x00, 0x00, 0x4d, 0x85, 0xd2, 0x74, 0x36, 0x4d, 0x8b, 0x9a, 0x10, 0x08, 0x00, 0x00, 0x4d, 0x85, 0xdb, 0x74, 0x2a,
		0x0f, 0x31, 0x48, 0xc1, 0xe2, 0x20, 0x48, 0x09, 0xd0, 0x49, 0x2b, 0x82, 0x00, 0x08, 0x00, 0x00, 0x49, 0xf7, 0xe3, 0x48, 0x0f, 0xac, 0xd0, 0x20,
		0x49, 0x03, 0x82, 0x08, 0x08, 0x00, 0x00, 0x31, 0xd2, 0xb9, 0x10, 0x27, 0x00, 0x00, 0x48, 0xf7, 0xf1, 0xc3, 0xe9, 0x00, 0x00, 0x00, 0x00};
	return code;
}

// The screen's device context for GetDC(NULL), which programs take to read the display resolution and give back at once: the runtime
// publishes one context, its capabilities as a table indexed by GetDeviceCaps' index and a state word (0 free, 1 taken by a GetDC the
// guest answered, 2 changed by a call the runtime served); GetDC takes it free with lock cmpxchg, ReleaseDC frees it unless changed, and
// GetDeviceCaps reads the table. A changed context goes back to the runtime, which releases it and publishes another.
static constexpr size_t screen_caps = 0x400, screen_dc = 0x600, screen_dc_state = 0x608;

static const std::vector<uint8_t> &screen_get_dc_prelude()
{
	// mov r10,[pointer]; test r10,r10; jz slow; test rcx,rcx; jnz slow; xor eax,eax; mov r11d,1; lock cmpxchg [r10+state],r11d; jne slow;
	// mov rax,[r10+context]; test rax,rax; jz undo; ret; undo: mov dword [r10+state],0; slow: jmp breakpoint
	static const std::vector<uint8_t> code{
		0x4c, 0x8b, 0x15, 0x00, 0x00, 0x00, 0x00, 0x4d, 0x85, 0xd2, 0x74, 0x30, 0x48, 0x85, 0xc9, 0x75, 0x2b, 0x31, 0xc0, 0x41, 0xbb, 0x01, 0x00, 0x00,
		0x00, 0xf0, 0x45, 0x0f, 0xb1, 0x9a, 0x08, 0x06, 0x00, 0x00, 0x75, 0x18, 0x49, 0x8b, 0x82, 0x00, 0x06, 0x00, 0x00, 0x48, 0x85, 0xc0, 0x74, 0x01,
		0xc3, 0x41, 0xc7, 0x82, 0x08, 0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xe9, 0x00, 0x00, 0x00, 0x00};
	return code;
}

static const std::vector<uint8_t> &screen_release_dc_prelude()
{
	// mov r10,[pointer]; test r10,r10; jz slow; test rcx,rcx; jnz slow; test rdx,rdx; jz slow; cmp rdx,[r10+context]; jne slow;
	// mov eax,1; xor r11d,r11d; lock cmpxchg [r10+state],r11d; jne slow; ret; slow: jmp breakpoint
	static const std::vector<uint8_t> code{
		0x4c, 0x8b, 0x15, 0x00, 0x00, 0x00, 0x00, 0x4d, 0x85, 0xd2, 0x74, 0x27, 0x48, 0x85, 0xc9, 0x75, 0x22, 0x48, 0x85, 0xd2, 0x74, 0x1d, 0x49, 0x3b,
		0x92, 0x00, 0x06, 0x00, 0x00, 0x75, 0x14, 0xb8, 0x01, 0x00, 0x00, 0x00, 0x45, 0x31, 0xdb, 0xf0, 0x45, 0x0f, 0xb1, 0x9a, 0x08, 0x06, 0x00, 0x00,
		0x75, 0x01, 0xc3, 0xe9, 0x00, 0x00, 0x00, 0x00};
	return code;
}

static const std::vector<uint8_t> &screen_device_caps_prelude()
{
	// mov r10,[pointer]; test r10,r10; jz slow; test rcx,rcx; jz slow; cmp edx,127; ja slow; the screen's context answers from the
	// caps table; another context answers when the attribute table holds its slot (see dc_text_color_prelude) and the index does not
	// depend on its bitmap: TECHNOLOGY 1 (DT_RASDISPLAY, a memory context's too), LOGPIXELSX and LOGPIXELSY 96, PLANES 1, SHADEBLENDCAPS
	// 0, as device_caps answers them; anything else: jmp breakpoint. GDI+ asks these thousands of times while it paints. The slot's
	// window flag that TECHNOLOGY once read is left unreached (mov eax,[rax+0x18]; ret).
	static const std::vector<uint8_t> code{
		0x4c, 0x8b, 0x15, 0x00, 0x00, 0x00, 0x00, 0x4d, 0x85, 0xd2, 0x74, 0x6f, 0x48, 0x85, 0xc9, 0x74, 0x6a, 0x83, 0xfa, 0x7f, 0x77, 0x65, 0x49, 0x3b,
		0x8a, 0x00, 0x06, 0x00, 0x00, 0x74, 0x51, 0x4d, 0x8b, 0x9a, 0x48, 0x07, 0x00, 0x00, 0x4d, 0x85, 0xdb, 0x74, 0x50, 0x89, 0xc8, 0x25, 0xff, 0x03,
		0x00, 0x00, 0xc1, 0xe0, 0x05, 0x49, 0x8d, 0x84, 0x03, 0x00, 0x10, 0x00, 0x00, 0x48, 0x3b, 0x08, 0x75, 0x39, 0x83, 0xfa, 0x02, 0x74, 0x20, 0x83,
		0xfa, 0x58, 0x74, 0x15, 0x83, 0xfa, 0x5a, 0x74, 0x10, 0x83, 0xfa, 0x0e, 0x74, 0x11, 0x83, 0xfa, 0x78, 0x74, 0x12, 0xeb, 0x1e, 0x8b, 0x40, 0x18,
		0xc3, 0xb8, 0x60, 0x00, 0x00, 0x00, 0xc3, 0xb8, 0x01, 0x00, 0x00, 0x00, 0xc3, 0x31, 0xc0, 0xc3, 0x89, 0xd0, 0x41, 0x8b, 0x84, 0x82, 0x00, 0x04,
		0x00, 0x00, 0xc3, 0xe9, 0x00, 0x00, 0x00, 0x00};
	return code;
}

// Window state the guest reads from the window table the runtime keeps (see NativeWindows::publish_windows), found through the served
// block: the record at the handle's low nine bits, when it is that window's. GetWindowLong and GetWindowLongPtr answer the extra bytes
// the record holds and the indexes the runtime answers, GetPropW the properties named by an atom when the record holds all of them,
// IsWindow and IsWindowUnicode a window of this process, GetClientRect and GetWindowRect its rectangles. A window without a record,
// another index or a null pointer goes to the runtime.
static constexpr size_t window_table = 0x700;

static const std::vector<uint8_t> &window_long_ptr_prelude()
{
	static const std::vector<uint8_t> code{
		0x4c, 0x8b, 0x15, 0x00, 0x00, 0x00, 0x00, 0x4d, 0x85, 0xd2, 0x0f, 0x84, 0x82, 0x00, 0x00, 0x00, 0x4d, 0x8b, 0x9a, 0x00, 0x07, 0x00, 0x00, 0x4d,
		0x85, 0xdb, 0x74, 0x76, 0x48, 0x85, 0xc9, 0x74, 0x71, 0x89, 0xc8, 0x25, 0xff, 0x01, 0x00, 0x00, 0xc1, 0xe0, 0x08, 0x49, 0x01, 0xc3, 0x49, 0x3b,
		0x0b, 0x75, 0x5f, 0x85, 0xd2, 0x78, 0x15, 0x89, 0xd0, 0x4c, 0x8d, 0x50, 0x08, 0x45, 0x3b, 0x53, 0x50, 0x77, 0x4f, 0x49, 0x8b, 0x84, 0x03, 0xa0,
		0x00, 0x00, 0x00, 0xc3, 0x83, 0xfa, 0xeb, 0x75, 0x05, 0x49, 0x8b, 0x43, 0x08, 0xc3, 0x83, 0xfa, 0xfc, 0x75, 0x05, 0x49, 0x8b, 0x43, 0x10, 0xc3,
		0x83, 0xfa, 0xfa, 0x75, 0x05, 0x49, 0x8b, 0x43, 0x18, 0xc3, 0x83, 0xfa, 0xf8, 0x75, 0x05, 0x49, 0x8b, 0x43, 0x20, 0xc3, 0x83, 0xfa, 0xf4, 0x75,
		0x05, 0x49, 0x8b, 0x43, 0x28, 0xc3, 0x83, 0xfa, 0xf0, 0x75, 0x05, 0x41, 0x8b, 0x43, 0x30, 0xc3, 0x83, 0xfa, 0xec, 0x75, 0x05, 0x41, 0x8b, 0x43,
		0x34, 0xc3, 0xe9, 0x00, 0x00, 0x00, 0x00};
	return code;
}

static const std::vector<uint8_t> &window_long_prelude()
{
	static const std::vector<uint8_t> code{
		0x4c, 0x8b, 0x15, 0x00, 0x00, 0x00, 0x00, 0x4d, 0x85, 0xd2, 0x74, 0x64, 0x4d, 0x8b, 0x9a, 0x00, 0x07, 0x00, 0x00, 0x4d, 0x85, 0xdb, 0x74, 0x58,
		0x48, 0x85, 0xc9, 0x74, 0x53, 0x89, 0xc8, 0x25, 0xff, 0x01, 0x00, 0x00, 0xc1, 0xe0, 0x08, 0x49, 0x01, 0xc3, 0x49, 0x3b, 0x0b, 0x75, 0x41, 0x85,
		0xd2, 0x78, 0x15, 0x89, 0xd0, 0x4c, 0x8d, 0x50, 0x04, 0x45, 0x3b, 0x53, 0x50, 0x77, 0x31, 0x41, 0x8b, 0x84, 0x03, 0xa0, 0x00, 0x00, 0x00, 0xc3,
		0x83, 0xfa, 0xeb, 0x75, 0x05, 0x41, 0x8b, 0x43, 0x08, 0xc3, 0x83, 0xfa, 0xf4, 0x75, 0x05, 0x41, 0x8b, 0x43, 0x28, 0xc3, 0x83, 0xfa, 0xf0, 0x75,
		0x05, 0x41, 0x8b, 0x43, 0x30, 0xc3, 0x83, 0xfa, 0xec, 0x75, 0x05, 0x41, 0x8b, 0x43, 0x34, 0xc3, 0xe9, 0x00, 0x00, 0x00, 0x00};
	return code;
}

static const std::vector<uint8_t> &window_property_prelude()
{
	static const std::vector<uint8_t> code{
		0x4c, 0x8b, 0x15, 0x00, 0x00, 0x00, 0x00, 0x4d, 0x85, 0xd2, 0x74, 0x52, 0x4d, 0x8b, 0x9a, 0x00, 0x07, 0x00, 0x00, 0x4d, 0x85, 0xdb, 0x74, 0x46,
		0x48, 0x85, 0xc9, 0x74, 0x41, 0x89, 0xc8, 0x25, 0xff, 0x01, 0x00, 0x00, 0xc1, 0xe0, 0x08, 0x49, 0x01, 0xc3, 0x49, 0x3b, 0x0b, 0x75, 0x2f, 0x48,
		0x81, 0xfa, 0xff, 0xff, 0x00, 0x00, 0x77, 0x26, 0x41, 0x8b, 0x43, 0x54, 0x83, 0xf8, 0x04, 0x77, 0x1d, 0x4d, 0x8d, 0x53, 0x60, 0x85, 0xc0, 0x74,
		0x0d, 0x49, 0x3b, 0x12, 0x74, 0x0b, 0x49, 0x83, 0xc2, 0x10, 0xff, 0xc8, 0xeb, 0xef, 0x31, 0xc0, 0xc3, 0x49, 0x8b, 0x42, 0x08, 0xc3, 0xe9, 0x00,
		0x00, 0x00, 0x00};
	return code;
}

static const std::vector<uint8_t> &window_exists_prelude()
{
	static const std::vector<uint8_t> code{
		0x4c, 0x8b, 0x15, 0x00, 0x00, 0x00, 0x00, 0x4d, 0x85, 0xd2, 0x74, 0x29, 0x4d, 0x8b, 0x9a, 0x00, 0x07, 0x00, 0x00, 0x4d, 0x85, 0xdb, 0x74, 0x1d,
		0x48, 0x85, 0xc9, 0x74, 0x18, 0x89, 0xc8, 0x25, 0xff, 0x01, 0x00, 0x00, 0xc1, 0xe0, 0x08, 0x49, 0x01, 0xc3, 0x49, 0x3b, 0x0b, 0x75, 0x06, 0xb8,
		0x01, 0x00, 0x00, 0x00, 0xc3, 0xe9, 0x00, 0x00, 0x00, 0x00};
	return code;
}

static const std::vector<uint8_t> &window_client_prelude()
{
	static const std::vector<uint8_t> code{
		0x4c, 0x8b, 0x15, 0x00, 0x00, 0x00, 0x00, 0x4d, 0x85, 0xd2, 0x74, 0x3d, 0x4d, 0x8b, 0x9a, 0x00, 0x07, 0x00, 0x00, 0x4d, 0x85, 0xdb, 0x74, 0x31,
		0x48, 0x85, 0xc9, 0x74, 0x2c, 0x89, 0xc8, 0x25, 0xff, 0x01, 0x00, 0x00, 0xc1, 0xe0, 0x08, 0x49, 0x01, 0xc3, 0x49, 0x3b, 0x0b, 0x75, 0x1a, 0x48,
		0x85, 0xd2, 0x74, 0x15, 0x48, 0xc7, 0x02, 0x00, 0x00, 0x00, 0x00, 0x49, 0x8b, 0x43, 0x38, 0x48, 0x89, 0x42, 0x08, 0xb8, 0x01, 0x00, 0x00, 0x00,
		0xc3, 0xe9, 0x00, 0x00, 0x00, 0x00};
	return code;
}

static const std::vector<uint8_t> &window_outer_prelude()
{
	static const std::vector<uint8_t> code{
		0x4c, 0x8b, 0x15, 0x00, 0x00, 0x00, 0x00, 0x4d, 0x85, 0xd2, 0x74, 0x3d, 0x4d, 0x8b, 0x9a, 0x00, 0x07, 0x00, 0x00, 0x4d, 0x85, 0xdb, 0x74, 0x31,
		0x48, 0x85, 0xc9, 0x74, 0x2c, 0x89, 0xc8, 0x25, 0xff, 0x01, 0x00, 0x00, 0xc1, 0xe0, 0x08, 0x49, 0x01, 0xc3, 0x49, 0x3b, 0x0b, 0x75, 0x1a, 0x48,
		0x85, 0xd2, 0x74, 0x15, 0x49, 0x8b, 0x43, 0x40, 0x48, 0x89, 0x02, 0x49, 0x8b, 0x43, 0x48, 0x48, 0x89, 0x42, 0x08, 0xb8, 0x01, 0x00, 0x00, 0x00,
		0xc3, 0xe9, 0x00, 0x00, 0x00, 0x00};
	return code;
}

// Locale information, which the runtime answers by type alone: the guest reads it from the table the runtime publishes once (see
// locale_table), through the served block. A type with flags beyond LOCALE_RETURN_NUMBER and LOCALE_NOUSEROVERRIDE, one without
// text, a buffer too small or a null buffer goes to the runtime.
static constexpr size_t locale_pointer = 0x708;

static const std::vector<uint8_t> &locale_prelude()
{
	static const std::vector<uint8_t> code{
		0x4c, 0x8b, 0x15, 0x00, 0x00, 0x00, 0x00, 0x4d, 0x85, 0xd2, 0x0f, 0x84, 0x94, 0x00, 0x00, 0x00, 0x4d, 0x8b, 0x9a, 0x08, 0x07, 0x00, 0x00, 0x4d,
		0x85, 0xdb, 0x0f, 0x84, 0x84, 0x00, 0x00, 0x00, 0x89, 0xd0, 0x25, 0xff, 0xff, 0xff, 0x5f, 0x3d, 0x80, 0x00, 0x00, 0x00, 0x72, 0x0f, 0x2d, 0x00,
		0x10, 0x00, 0x00, 0x83, 0xf8, 0x10, 0x73, 0x6c, 0x05, 0x80, 0x00, 0x00, 0x00, 0x45, 0x0f, 0xb7, 0x14, 0xc3, 0x41, 0x81, 0xfa, 0xff, 0xff, 0x00,
		0x00, 0x74, 0x59, 0xf7, 0xc2, 0x00, 0x00, 0x00, 0x20, 0x75, 0x38, 0x41, 0x0f, 0xb7, 0x44, 0xc3, 0x02, 0xff, 0xc0, 0x45, 0x85, 0xc9, 0x74, 0x2a,
		0x78, 0x42, 0x41, 0x39, 0xc1, 0x72, 0x3d, 0x4d, 0x85, 0xc0, 0x74, 0x38, 0x4f, 0x8d, 0x94, 0x53, 0x80, 0x04, 0x00, 0x00, 0x89, 0xc1, 0x66, 0x41,
		0x8b, 0x12, 0x66, 0x41, 0x89, 0x10, 0x49, 0x83, 0xc2, 0x02, 0x49, 0x83, 0xc0, 0x02, 0xff, 0xc9, 0x75, 0xec, 0xc3, 0x41, 0x83, 0xf9, 0x02, 0x7c,
		0x13, 0x4d, 0x85, 0xc0, 0x74, 0x0e, 0x41, 0x8b, 0x44, 0xc3, 0x04, 0x41, 0x89, 0x00, 0xb8, 0x02, 0x00, 0x00, 0x00, 0xc3, 0xe9, 0x00, 0x00, 0x00,
		0x00};
	return code;
}

// NtAllocateVirtualMemory committing read-write pages in an open range, as the commit prelude of VirtualAlloc does for its own
// arguments: the current process, no zero bits, the base and size behind their pointers, MEM_COMMIT and PAGE_READWRITE. The rounded
// base and size are written back and STATUS_SUCCESS returned; anything else goes to the runtime with the arguments as they came.
static const std::vector<uint8_t> &nt_commit_prelude()
{
	static const std::vector<uint8_t> code{
		0x4c, 0x8b, 0x15, 0x00, 0x00, 0x00, 0x00, 0x4d, 0x85, 0xd2, 0x0f, 0x84, 0xce, 0x00, 0x00, 0x00, 0x48, 0x83, 0xf9, 0xff, 0x0f, 0x85, 0xc4, 0x00,
		0x00, 0x00, 0x4d, 0x85, 0xc0, 0x0f, 0x85, 0xbb, 0x00, 0x00, 0x00, 0x48, 0x85, 0xd2, 0x0f, 0x84, 0xb2, 0x00, 0x00, 0x00, 0x4d, 0x85, 0xc9, 0x0f,
		0x84, 0xa9, 0x00, 0x00, 0x00, 0x81, 0x7c, 0x24, 0x28, 0x00, 0x10, 0x00, 0x00, 0x0f, 0x85, 0x9b, 0x00, 0x00, 0x00, 0x83, 0x7c, 0x24, 0x30, 0x04,
		0x0f, 0x85, 0x90, 0x00, 0x00, 0x00, 0x48, 0x8b, 0x02, 0x48, 0x85, 0xc0, 0x0f, 0x84, 0x84, 0x00, 0x00, 0x00, 0x4d, 0x8b, 0x19, 0x4d, 0x85, 0xdb,
		0x74, 0x7c, 0x4e, 0x8d, 0x9c, 0x18, 0xff, 0x0f, 0x00, 0x00, 0x49, 0x81, 0xe3, 0x00, 0xf0, 0xff, 0xff, 0x48, 0x25, 0x00, 0xf0, 0xff, 0xff, 0x49,
		0x39, 0xc3, 0x76, 0x62, 0x41, 0x8b, 0x8a, 0x00, 0x0a, 0x00, 0x00, 0x4d, 0x8d, 0x82, 0x08, 0x0a, 0x00, 0x00, 0x85, 0xc9, 0x74, 0x46, 0x49, 0x3b,
		0x00, 0x72, 0x39, 0x4d, 0x3b, 0x58, 0x08, 0x77, 0x33, 0xb9, 0x01, 0x00, 0x00, 0x00, 0xf0, 0x41, 0x0f, 0xc1, 0x8a, 0x10, 0x0d, 0x00, 0x00, 0x83,
		0xf9, 0x20, 0x73, 0x28, 0x48, 0xc1, 0xe1, 0x04, 0x49, 0x89, 0x84, 0x0a, 0x18, 0x0d, 0x00, 0x00, 0x4d, 0x89, 0x9c, 0x0a, 0x20, 0x0d, 0x00, 0x00,
		0x48, 0x89, 0x02, 0x49, 0x29, 0xc3, 0x4d, 0x89, 0x19, 0x31, 0xc0, 0xc3, 0x49, 0x83, 0xc0, 0x10, 0xff, 0xc9, 0xeb, 0xb6, 0x48, 0xc7, 0xc1, 0xff,
		0xff, 0xff, 0xff, 0x45, 0x31, 0xc0, 0xe9, 0x00, 0x00, 0x00, 0x00};
	static_assert(NativeMemory::commit_windows == 0xa00 && NativeMemory::commit_log == 0xd10 && NativeMemory::commit_log_count == 32,
		"the commit preludes' offsets are written into their code");
	return code;
}

// NtFreeVirtualMemory decommitting at most 256 KiB of an open range, as the decommit prelude of VirtualFree does: the pages are
// zeroed in place and logged with the low bit set, and the rounded base and size are written back.
static const std::vector<uint8_t> &nt_decommit_prelude()
{
	static const std::vector<uint8_t> code{
		0x4c, 0x8b, 0x15, 0x00, 0x00, 0x00, 0x00, 0x4d, 0x85, 0xd2, 0x0f, 0x84, 0xe5, 0x00, 0x00, 0x00, 0x48, 0x83, 0xf9, 0xff, 0x0f, 0x85, 0xdb, 0x00,
		0x00, 0x00, 0x48, 0x85, 0xd2, 0x0f, 0x84, 0xd2, 0x00, 0x00, 0x00, 0x4d, 0x85, 0xc0, 0x0f, 0x84, 0xc9, 0x00, 0x00, 0x00, 0x41, 0x81, 0xf9, 0x00,
		0x40, 0x00, 0x00, 0x0f, 0x85, 0xbc, 0x00, 0x00, 0x00, 0x48, 0x8b, 0x02, 0x48, 0x85, 0xc0, 0x0f, 0x84, 0xb0, 0x00, 0x00, 0x00, 0x4d, 0x8b, 0x18,
		0x4d, 0x85, 0xdb, 0x0f, 0x84, 0xa4, 0x00, 0x00, 0x00, 0x49, 0x81, 0xfb, 0x00, 0x00, 0x04, 0x00, 0x0f, 0x87, 0x97, 0x00, 0x00, 0x00, 0x4e, 0x8d,
		0x9c, 0x18, 0xff, 0x0f, 0x00, 0x00, 0x49, 0x81, 0xe3, 0x00, 0xf0, 0xff, 0xff, 0x48, 0x25, 0x00, 0xf0, 0xff, 0xff, 0x49, 0x39, 0xc3, 0x76, 0x7d,
		0x41, 0x8b, 0x8a, 0x00, 0x0a, 0x00, 0x00, 0x4d, 0x8d, 0x8a, 0x08, 0x0a, 0x00, 0x00, 0x85, 0xc9, 0x74, 0x5e, 0x49, 0x3b, 0x01, 0x72, 0x51, 0x4d,
		0x3b, 0x59, 0x08, 0x77, 0x4b, 0xb9, 0x01, 0x00, 0x00, 0x00, 0xf0, 0x41, 0x0f, 0xc1, 0x8a, 0x10, 0x0d, 0x00, 0x00, 0x83, 0xf9, 0x20, 0x73, 0x40,
		0x48, 0xc1, 0xe1, 0x04, 0x49, 0x89, 0xc9, 0x57, 0x50, 0x48, 0x89, 0xc7, 0x4c, 0x89, 0xd9, 0x48, 0x29, 0xc1, 0x31, 0xc0, 0xf3, 0xaa, 0x58, 0x5f,
		0x48, 0x8d, 0x48, 0x01, 0x4b, 0x89, 0x8c, 0x0a, 0x18, 0x0d, 0x00, 0x00, 0x4f, 0x89, 0x9c, 0x0a, 0x20, 0x0d, 0x00, 0x00, 0x48, 0x89, 0x02, 0x49,
		0x29, 0xc3, 0x4d, 0x89, 0x18, 0x31, 0xc0, 0xc3, 0x49, 0x83, 0xc1, 0x10, 0xff, 0xc9, 0xeb, 0x9e, 0x48, 0xc7, 0xc1, 0xff, 0xff, 0xff, 0xff, 0x41,
		0xb9, 0x00, 0x40, 0x00, 0x00, 0xe9, 0x00, 0x00, 0x00, 0x00};
	return code;
}

// IsChild walks the parents the window table holds, GetFocus reads the focus window the runtime publishes with it, and GetDpiForWindow
// answers 96 as the runtime does.
static constexpr size_t focus_published = 0x710, focus_window = 0x718;

static const std::vector<uint8_t> &window_child_prelude()
{
	static const std::vector<uint8_t> code{
		0x4c, 0x8b, 0x15, 0x00, 0x00, 0x00, 0x00, 0x4d, 0x85, 0xd2, 0x74, 0x5f, 0x4d, 0x8b, 0x9a, 0x00, 0x07, 0x00, 0x00, 0x4d, 0x85, 0xdb, 0x74, 0x53,
		0x31, 0xc0, 0x48, 0x85, 0xc9, 0x74, 0x4b, 0x48, 0x85, 0xd2, 0x74, 0x46, 0x48, 0x39, 0xd1, 0x74, 0x41, 0x41, 0xb8, 0x40, 0x00, 0x00, 0x00, 0x49,
		0x89, 0xd1, 0x44, 0x89, 0xc8, 0x25, 0xff, 0x01, 0x00, 0x00, 0xc1, 0xe0, 0x08, 0x4c, 0x01, 0xd8, 0x4c, 0x3b, 0x08, 0x75, 0x15, 0x4c, 0x8b, 0x48,
		0x58, 0x31, 0xc0, 0x4d, 0x85, 0xc9, 0x74, 0x1a, 0x49, 0x39, 0xc9, 0x74, 0x10, 0x41, 0xff, 0xc8, 0x75, 0xd8, 0x41, 0xb8, 0x00, 0x00, 0x00, 0x00,
		0x45, 0x31, 0xc9, 0xeb, 0x06, 0xb8, 0x01, 0x00, 0x00, 0x00, 0xc3, 0xe9, 0x00, 0x00, 0x00, 0x00};
	return code;
}

static const std::vector<uint8_t> &window_dpi_prelude()
{
	static const std::vector<uint8_t> code{
		0x4c, 0x8b, 0x15, 0x00, 0x00, 0x00, 0x00, 0xb8, 0x60, 0x00, 0x00, 0x00, 0xc3, 0xe9, 0x00, 0x00, 0x00, 0x00};
	return code;
}

static const std::vector<uint8_t> &focus_prelude()
{
	static const std::vector<uint8_t> code{
		0x4c, 0x8b, 0x15, 0x00, 0x00, 0x00, 0x00, 0x4d, 0x85, 0xd2, 0x74, 0x12, 0x49, 0x83, 0xba, 0x10, 0x07, 0x00, 0x00, 0x00, 0x74, 0x08, 0x49, 0x8b,
		0x82, 0x18, 0x07, 0x00, 0x00, 0xc3, 0xe9, 0x00, 0x00, 0x00, 0x00};
	return code;
}

// Menus by position, read from the menu table the runtime keeps (see NativeWindows::publish_menus): GetMenuItemCount, GetSubMenu,
// GetMenuItemID and GetMenuStringW with MF_BYPOSITION. A menu without a slot goes to the runtime.
static constexpr size_t menu_pointer = 0x720;

static const std::vector<uint8_t> &menu_count_prelude()
{
	static const std::vector<uint8_t> code{
		0x4c, 0x8b, 0x15, 0x00, 0x00, 0x00, 0x00, 0x4d, 0x85, 0xd2, 0x74, 0x27, 0x4d, 0x8b, 0x9a, 0x20, 0x07, 0x00, 0x00, 0x4d, 0x85, 0xdb, 0x74, 0x1b,
		0x48, 0x85, 0xc9, 0x74, 0x16, 0x89, 0xc8, 0x25, 0xff, 0x03, 0x00, 0x00, 0xc1, 0xe0, 0x04, 0x4c, 0x01, 0xd8, 0x48, 0x3b, 0x08, 0x75, 0x04, 0x8b,
		0x40, 0x0c, 0xc3, 0xe9, 0x00, 0x00, 0x00, 0x00};
	return code;
}

static const std::vector<uint8_t> &menu_submenu_prelude()
{
	static const std::vector<uint8_t> code{
		0x4c, 0x8b, 0x15, 0x00, 0x00, 0x00, 0x00, 0x4d, 0x85, 0xd2, 0x74, 0x3e, 0x4d, 0x8b, 0x9a, 0x20, 0x07, 0x00, 0x00, 0x4d, 0x85, 0xdb, 0x74, 0x32,
		0x48, 0x85, 0xc9, 0x74, 0x2d, 0x89, 0xc8, 0x25, 0xff, 0x03, 0x00, 0x00, 0xc1, 0xe0, 0x04, 0x4c, 0x01, 0xd8, 0x48, 0x3b, 0x08, 0x75, 0x1b, 0x3b,
		0x50, 0x0c, 0x73, 0x13, 0x44, 0x8b, 0x50, 0x08, 0x4d, 0x01, 0xda, 0x89, 0xd0, 0x48, 0xc1, 0xe0, 0x05, 0x49, 0x8b, 0x44, 0x02, 0x10, 0xc3, 0x31,
		0xc0, 0xc3, 0xe9, 0x00, 0x00, 0x00, 0x00};
	return code;
}

static const std::vector<uint8_t> &menu_id_prelude()
{
	static const std::vector<uint8_t> code{
		0x4c, 0x8b, 0x15, 0x00, 0x00, 0x00, 0x00, 0x4d, 0x85, 0xd2, 0x74, 0x4a, 0x4d, 0x8b, 0x9a, 0x20, 0x07, 0x00, 0x00, 0x4d, 0x85, 0xdb, 0x74, 0x3e,
		0x48, 0x85, 0xc9, 0x74, 0x39, 0x89, 0xc8, 0x25, 0xff, 0x03, 0x00, 0x00, 0xc1, 0xe0, 0x04, 0x4c, 0x01, 0xd8, 0x48, 0x3b, 0x08, 0x75, 0x27, 0x3b,
		0x50, 0x0c, 0x73, 0x1c, 0x44, 0x8b, 0x50, 0x08, 0x4d, 0x01, 0xda, 0x89, 0xd0, 0x48, 0xc1, 0xe0, 0x05, 0x49, 0x01, 0xc2, 0x49, 0x83, 0x7a, 0x10,
		0x00, 0x75, 0x05, 0x41, 0x8b, 0x42, 0x08, 0xc3, 0xb8, 0xff, 0xff, 0xff, 0xff, 0xc3, 0xe9, 0x00, 0x00, 0x00, 0x00};
	return code;
}

// GetMenuState, and GetMenuStringW by command as well as by position: an item looked up by command is searched for in the order the
// runtime searches, a level's own items first and then each submenu in turn, on the guest's stack; a menu missing from the table or
// a tree deeper than the stack allows goes to the runtime.
static const std::vector<uint8_t> &menu_state_prelude()
{
	static const std::vector<uint8_t> code{
		0x4c, 0x8b, 0x15, 0x00, 0x00, 0x00, 0x00, 0x4d, 0x85, 0xd2, 0x0f, 0x84, 0x41, 0x01, 0x00, 0x00, 0x4d, 0x8b, 0x9a, 0x20, 0x07, 0x00, 0x00, 0x4d,
		0x85, 0xdb, 0x0f, 0x84, 0x31, 0x01, 0x00, 0x00, 0x48, 0x85, 0xc9, 0x0f, 0x84, 0x28, 0x01, 0x00, 0x00, 0x41, 0xf7, 0xc0, 0x00, 0x04, 0x00, 0x00,
		0x74, 0x2d, 0x89, 0xc8, 0x25, 0xff, 0x03, 0x00, 0x00, 0xc1, 0xe0, 0x04, 0x4c, 0x01, 0xd8, 0x48, 0x3b, 0x08, 0x0f, 0x85, 0x09, 0x01, 0x00, 0x00,
		0x3b, 0x50, 0x0c, 0x73, 0x74, 0x44, 0x8b, 0x50, 0x08, 0x4d, 0x01, 0xda, 0x89, 0xd0, 0x48, 0xc1, 0xe0, 0x05, 0x49, 0x01, 0xc2, 0xeb, 0x1f, 0x55,
		0x48, 0x89, 0xe5, 0x51, 0x52, 0xe8, 0x5d, 0x00, 0x00, 0x00, 0x48, 0x8b, 0x4d, 0xf8, 0x48, 0x8b, 0x55, 0xf0, 0x48, 0x89, 0xec, 0x5d, 0x48, 0x85,
		0xc0, 0x74, 0x46, 0x49, 0x89, 0xc2, 0x41, 0x8b, 0x02, 0x25, 0x64, 0x09, 0x00, 0x00, 0x41, 0x0b, 0x42, 0x04, 0x49, 0x83, 0x7a, 0x10, 0x00, 0x74,
		0x2f, 0x4d, 0x8b, 0x4a, 0x10, 0x45, 0x89, 0xca, 0x41, 0x81, 0xe2, 0xff, 0x03, 0x00, 0x00, 0x41, 0xc1, 0xe2, 0x04, 0x4d, 0x01, 0xda, 0x4d, 0x3b,
		0x0a, 0x0f, 0x85, 0xa2, 0x00, 0x00, 0x00, 0x0f, 0xb6, 0xc0, 0x83, 0xc8, 0x10, 0x45, 0x8b, 0x4a, 0x0c, 0x41, 0xc1, 0xe1, 0x08, 0x44, 0x09, 0xc8,
		0xc3, 0xb8, 0xff, 0xff, 0xff, 0xff, 0xc3, 0x48, 0x89, 0xe8, 0x48, 0x29, 0xe0, 0x48, 0x3d, 0x00, 0x10, 0x00, 0x00, 0x77, 0x70, 0x89, 0xc8, 0x25,
		0xff, 0x03, 0x00, 0x00, 0xc1, 0xe0, 0x04, 0x4c, 0x01, 0xd8, 0x48, 0x3b, 0x08, 0x75, 0x5e, 0x44, 0x8b, 0x50, 0x08, 0x4d, 0x01, 0xda, 0x8b, 0x40,
		0x0c, 0x41, 0x52, 0x50, 0x85, 0xc0, 0x74, 0x1d, 0x49, 0x83, 0x7a, 0x10, 0x00, 0x75, 0x0e, 0x41, 0x3b, 0x52, 0x08, 0x75, 0x08, 0x4c, 0x89, 0xd0,
		0x48, 0x83, 0xc4, 0x10, 0xc3, 0x49, 0x83, 0xc2, 0x20, 0xff, 0xc8, 0xeb, 0xdf, 0x58, 0x41, 0x5a, 0x85, 0xc0, 0x74, 0x21, 0x49, 0x8b, 0x4a, 0x10,
		0x48, 0x85, 0xc9, 0x74, 0x10, 0x41, 0x52, 0x50, 0xe8, 0x9a, 0xff, 0xff, 0xff, 0x48, 0x85, 0xc0, 0x75, 0x0e, 0x58, 0x41, 0x5a, 0x49, 0x83, 0xc2,
		0x20, 0xff, 0xc8, 0xeb, 0xdb, 0x31, 0xc0, 0xc3, 0x48, 0x83, 0xc4, 0x10, 0xc3, 0x48, 0x8b, 0x4d, 0xf8, 0x48, 0x8b, 0x55, 0xf0, 0x48, 0x89, 0xec,
		0x5d, 0xe9, 0x00, 0x00, 0x00, 0x00};
	return code;
}

static const std::vector<uint8_t> &menu_string_prelude()
{
	static const std::vector<uint8_t> code{
		0x4c, 0x8b, 0x15, 0x00, 0x00, 0x00, 0x00, 0x4d, 0x85, 0xd2, 0x0f, 0x84, 0x3f, 0x01, 0x00, 0x00, 0x4d, 0x8b, 0x9a, 0x20, 0x07, 0x00, 0x00, 0x4d,
		0x85, 0xdb, 0x0f, 0x84, 0x2f, 0x01, 0x00, 0x00, 0x48, 0x85, 0xc9, 0x0f, 0x84, 0x26, 0x01, 0x00, 0x00, 0x45, 0x85, 0xc9, 0x0f, 0x88, 0x1d, 0x01,
		0x00, 0x00, 0xf7, 0x44, 0x24, 0x28, 0x00, 0x04, 0x00, 0x00, 0x74, 0x2d, 0x89, 0xc8, 0x25, 0xff, 0x03, 0x00, 0x00, 0xc1, 0xe0, 0x04, 0x4c, 0x01,
		0xd8, 0x48, 0x3b, 0x08, 0x0f, 0x85, 0xfd, 0x00, 0x00, 0x00, 0x3b, 0x50, 0x0c, 0x73, 0x6b, 0x44, 0x8b, 0x50, 0x08, 0x4d, 0x01, 0xda, 0x89, 0xd0,
		0x48, 0xc1, 0xe0, 0x05, 0x49, 0x01, 0xc2, 0xeb, 0x1f, 0x55, 0x48, 0x89, 0xe5, 0x51, 0x52, 0xe8, 0x51, 0x00, 0x00, 0x00, 0x48, 0x8b, 0x4d, 0xf8,
		0x48, 0x8b, 0x55, 0xf0, 0x48, 0x89, 0xec, 0x5d, 0x48, 0x85, 0xc0, 0x74, 0x3d, 0x49, 0x89, 0xc2, 0x41, 0x8b, 0x42, 0x0c, 0x45, 0x85, 0xc9, 0x74,
		0x30, 0x4d, 0x85, 0xc0, 0x74, 0x2b, 0x41, 0x8d, 0x49, 0xff, 0x39, 0xc8, 0x0f, 0x47, 0xc1, 0x45, 0x8b, 0x52, 0x18, 0x4d, 0x01, 0xda, 0x31, 0xc9,
		0x39, 0xc1, 0x74, 0x0e, 0x66, 0x41, 0x8b, 0x14, 0x4a, 0x66, 0x41, 0x89, 0x14, 0x48, 0xff, 0xc1, 0xeb, 0xee, 0x66, 0x41, 0xc7, 0x04, 0x48, 0x00,
		0x00, 0xc3, 0x31, 0xc0, 0xc3, 0x48, 0x89, 0xe8, 0x48, 0x29, 0xe0, 0x48, 0x3d, 0x00, 0x10, 0x00, 0x00, 0x77, 0x70, 0x89, 0xc8, 0x25, 0xff, 0x03,
		0x00, 0x00, 0xc1, 0xe0, 0x04, 0x4c, 0x01, 0xd8, 0x48, 0x3b, 0x08, 0x75, 0x5e, 0x44, 0x8b, 0x50, 0x08, 0x4d, 0x01, 0xda, 0x8b, 0x40, 0x0c, 0x41,
		0x52, 0x50, 0x85, 0xc0, 0x74, 0x1d, 0x49, 0x83, 0x7a, 0x10, 0x00, 0x75, 0x0e, 0x41, 0x3b, 0x52, 0x08, 0x75, 0x08, 0x4c, 0x89, 0xd0, 0x48, 0x83,
		0xc4, 0x10, 0xc3, 0x49, 0x83, 0xc2, 0x20, 0xff, 0xc8, 0xeb, 0xdf, 0x58, 0x41, 0x5a, 0x85, 0xc0, 0x74, 0x21, 0x49, 0x8b, 0x4a, 0x10, 0x48, 0x85,
		0xc9, 0x74, 0x10, 0x41, 0x52, 0x50, 0xe8, 0x9a, 0xff, 0xff, 0xff, 0x48, 0x85, 0xc0, 0x75, 0x0e, 0x58, 0x41, 0x5a, 0x49, 0x83, 0xc2, 0x20, 0xff,
		0xc8, 0xeb, 0xdb, 0x31, 0xc0, 0xc3, 0x48, 0x83, 0xc4, 0x10, 0xc3, 0x48, 0x8b, 0x4d, 0xf8, 0x48, 0x8b, 0x55, 0xf0, 0x48, 0x89, 0xec, 0x5d, 0xe9,
		0x00, 0x00, 0x00, 0x00};
	return code;
}

// GetObject on a bitmap, read from the bitmap table the runtime keeps (see NativeWindows::publish_bitmaps): the size with no buffer,
// nothing for a buffer under 32 bytes, else the BITMAP. A DIB section asked for its DIBSECTION, or another object, goes to the runtime.
static constexpr size_t bitmap_pointer = 0x728;

static const std::vector<uint8_t> &bitmap_object_prelude()
{
	static const std::vector<uint8_t> code{
		0x4c, 0x8b, 0x15, 0x00, 0x00, 0x00, 0x00, 0x4d, 0x85, 0xd2, 0x74, 0x64, 0x4d, 0x8b, 0x9a, 0x28, 0x07, 0x00, 0x00, 0x4d, 0x85, 0xdb, 0x74, 0x58,
		0x48, 0x85, 0xc9, 0x74, 0x53, 0x89, 0xc8, 0x25, 0xff, 0x03, 0x00, 0x00, 0x6b, 0xc0, 0x30, 0x49, 0x01, 0xc3, 0x49, 0x3b, 0x0b, 0x75, 0x41, 0xb8,
		0x20, 0x00, 0x00, 0x00, 0x4d, 0x85, 0xc0, 0x74, 0x33, 0x83, 0xfa, 0x20, 0x7c, 0x2f, 0x41, 0xf7, 0x43, 0x08, 0x01, 0x00, 0x00, 0x00, 0x74, 0x05,
		0x83, 0xfa, 0x68, 0x7d, 0x23, 0x4d, 0x8b, 0x53, 0x10, 0x4d, 0x89, 0x10, 0x4d, 0x8b, 0x53, 0x18, 0x4d, 0x89, 0x50, 0x08, 0x4d, 0x8b, 0x53, 0x20,
		0x4d, 0x89, 0x50, 0x10, 0x4d, 0x8b, 0x53, 0x28, 0x4d, 0x89, 0x50, 0x18, 0xc3, 0x31, 0xc0, 0xc3, 0xe9, 0x00, 0x00, 0x00, 0x00};
	return code;
}

// Services with nothing behind them but their arguments, answered by the guest as the runtime answers them: MulDiv rounding half away
// from zero and failing with -1 for a zero divisor or a result beyond 32 bits, OffsetRect, SetRect and IntersectRect (an empty
// intersection clears the destination and returns FALSE), PathFindFileNameW after the last separator or drive colon, and GetWindowTheme
// without themes. A null pointer goes to the runtime.
static const std::vector<uint8_t> &muldiv_prelude()
{
	static const std::vector<uint8_t> code{
		0x4c, 0x8b, 0x15, 0x00, 0x00, 0x00, 0x00, 0x45, 0x85, 0xc0, 0x74, 0x48, 0x48, 0x63, 0xc1, 0x4c, 0x63, 0xda, 0x49, 0x0f, 0xaf, 0xc3, 0x4d, 0x63,
		0xd8, 0x4d, 0x89, 0xd9, 0x49, 0xf7, 0xd9, 0x4d, 0x0f, 0x48, 0xcb, 0x49, 0x89, 0xc2, 0x49, 0xf7, 0xda, 0x4c, 0x0f, 0x48, 0xd0, 0x4c, 0x31, 0xd8,
		0x49, 0x89, 0xc3, 0x4c, 0x89, 0xc8, 0x48, 0xd1, 0xe8, 0x4c, 0x01, 0xd0, 0x31, 0xd2, 0x49, 0xf7, 0xf1, 0x4d, 0x85, 0xdb, 0x79, 0x03, 0x48, 0xf7,
		0xd8, 0x4c, 0x63, 0xd0, 0x49, 0x39, 0xc2, 0x75, 0x03, 0x89, 0xc0, 0xc3, 0xb8, 0xff, 0xff, 0xff, 0xff, 0xc3, 0xe9, 0x00, 0x00, 0x00, 0x00};
	return code;
}

static const std::vector<uint8_t> &offset_rect_prelude()
{
	static const std::vector<uint8_t> code{
		0x4c, 0x8b, 0x15, 0x00, 0x00, 0x00, 0x00, 0x48, 0x85, 0xc9, 0x74, 0x13, 0x01, 0x11, 0x01, 0x51, 0x08, 0x44, 0x01, 0x41, 0x04, 0x44, 0x01, 0x41,
		0x0c, 0xb8, 0x01, 0x00, 0x00, 0x00, 0xc3, 0xe9, 0x00, 0x00, 0x00, 0x00};
	return code;
}

static const std::vector<uint8_t> &set_rect_prelude()
{
	static const std::vector<uint8_t> code{
		0x4c, 0x8b, 0x15, 0x00, 0x00, 0x00, 0x00, 0x48, 0x85, 0xc9, 0x74, 0x17, 0x89, 0x11, 0x44, 0x89, 0x41, 0x04, 0x44, 0x89, 0x49, 0x08, 0x8b, 0x44,
		0x24, 0x28, 0x89, 0x41, 0x0c, 0xb8, 0x01, 0x00, 0x00, 0x00, 0xc3, 0xe9, 0x00, 0x00, 0x00, 0x00};
	return code;
}

static const std::vector<uint8_t> &intersect_rect_prelude()
{
	static const std::vector<uint8_t> code{
		0x4c, 0x8b, 0x15, 0x00, 0x00, 0x00, 0x00, 0x48, 0x85, 0xc9, 0x74, 0x62, 0x48, 0x85, 0xd2, 0x74, 0x5d, 0x4d, 0x85, 0xc0, 0x74, 0x58, 0x44, 0x8b,
		0x0a, 0x45, 0x3b, 0x08, 0x45, 0x0f, 0x4c, 0x08, 0x44, 0x8b, 0x52, 0x04, 0x45, 0x3b, 0x50, 0x04, 0x45, 0x0f, 0x4c, 0x50, 0x04, 0x44, 0x8b, 0x5a,
		0x08, 0x45, 0x3b, 0x58, 0x08, 0x45, 0x0f, 0x4f, 0x58, 0x08, 0x8b, 0x42, 0x0c, 0x41, 0x3b, 0x40, 0x0c, 0x41, 0x0f, 0x4f, 0x40, 0x0c, 0x45, 0x39,
		0xcb, 0x7e, 0x19, 0x44, 0x39, 0xd0, 0x7e, 0x14, 0x44, 0x89, 0x09, 0x44, 0x89, 0x51, 0x04, 0x44, 0x89, 0x59, 0x08, 0x89, 0x41, 0x0c, 0xb8, 0x01,
		0x00, 0x00, 0x00, 0xc3, 0x31, 0xc0, 0x48, 0x89, 0x01, 0x48, 0x89, 0x41, 0x08, 0xc3, 0xe9, 0x00, 0x00, 0x00, 0x00};
	return code;
}

static const std::vector<uint8_t> &window_theme_prelude()
{
	static const std::vector<uint8_t> code{
		0x4c, 0x8b, 0x15, 0x00, 0x00, 0x00, 0x00, 0x31, 0xc0, 0xc3, 0xe9, 0x00, 0x00, 0x00, 0x00};
	return code;
}

static const std::vector<uint8_t> &file_name_prelude()
{
	static const std::vector<uint8_t> code{
		0x4c, 0x8b, 0x15, 0x00, 0x00, 0x00, 0x00, 0x48, 0x85, 0xc9, 0x74, 0x42, 0x48, 0x89, 0xc8, 0x49, 0x89, 0xca, 0x45, 0x0f, 0xb7, 0x1a, 0x45, 0x85,
		0xdb, 0x74, 0x32, 0x41, 0x83, 0xfb, 0x5c, 0x74, 0x0c, 0x41, 0x83, 0xfb, 0x2f, 0x74, 0x06, 0x41, 0x83, 0xfb, 0x3a, 0x75, 0x1a, 0x45, 0x0f, 0xb7,
		0x4a, 0x02, 0x45, 0x85, 0xc9, 0x74, 0x10, 0x41, 0x83, 0xf9, 0x5c, 0x74, 0x0a, 0x41, 0x83, 0xf9, 0x2f, 0x74, 0x04, 0x49, 0x8d, 0x42, 0x02, 0x49,
		0x83, 0xc2, 0x02, 0xeb, 0xc5, 0xc3, 0xe9, 0x00, 0x00, 0x00, 0x00};
	return code;
}

// CallWindowProc calls the procedure it is given with the other four arguments, as the runtime does: the guest moves them down a
// register and jumps to it, so the procedure returns to the caller. A null procedure goes to the runtime.
static const std::vector<uint8_t> &call_procedure_prelude()
{
	static const std::vector<uint8_t> code{
		0x4c, 0x8b, 0x15, 0x00, 0x00, 0x00, 0x00, 0x48, 0x85, 0xc9, 0x74, 0x13, 0x48, 0x89, 0xc8, 0x48, 0x89, 0xd1, 0x4c, 0x89, 0xc2, 0x4d, 0x89, 0xc8, 0x4c, 0x8b, 0x4c, 0x24, 0x28, 0xff, 0xe0, 0xe9, 0x00, 0x00, 0x00, 0x00};
	return code;
}

// GetSystemMetrics and GetSysColor, which do not change while the process runs, read from the table the runtime writes once (see
// NativeWindows::set_system_table) for indexes below 128 and 64.
static constexpr size_t system_pointer = 0x730;

static const std::vector<uint8_t> &system_metrics_prelude()
{
	static const std::vector<uint8_t> code{
		0x4c, 0x8b, 0x15, 0x00, 0x00, 0x00, 0x00, 0x4d, 0x85, 0xd2, 0x74, 0x1b, 0x4d, 0x8b, 0x9a, 0x30, 0x07, 0x00, 0x00, 0x4d, 0x85, 0xdb, 0x74, 0x0f,
		0x81, 0xf9, 0x80, 0x00, 0x00, 0x00, 0x73, 0x07, 0x89, 0xc8, 0x41, 0x8b, 0x04, 0x83, 0xc3, 0xe9, 0x00, 0x00, 0x00, 0x00};
	return code;
}

static const std::vector<uint8_t> &system_colors_prelude()
{
	static const std::vector<uint8_t> code{
		0x4c, 0x8b, 0x15, 0x00, 0x00, 0x00, 0x00, 0x4d, 0x85, 0xd2, 0x74, 0x1c, 0x4d, 0x8b, 0x9a, 0x30, 0x07, 0x00, 0x00, 0x4d, 0x85, 0xdb, 0x74, 0x10,
		0x83, 0xf9, 0x40, 0x73, 0x0b, 0x89, 0xc8, 0x41, 0x8b, 0x84, 0x83, 0x00, 0x02, 0x00, 0x00, 0xc3, 0xe9, 0x00, 0x00, 0x00, 0x00};
	return code;
}

// The message loop's helpers for the messages they leave alone, answered as the runtime answers them: TranslateMessage for a message
// that is not a key, TranslateAcceleratorW for one that is not a key or character with a window and an accelerator table the runtime
// knows (it publishes the tables beside the system metrics), CallMsgFilterW without message filter hooks (a flag the runtime
// publishes at 0x738), and GetDesktopWindow once the desktop window exists (its handle at 0x740).
static const std::vector<uint8_t> &translate_message_prelude()
{
	static const std::vector<uint8_t> code{
		0x4c, 0x8b, 0x15, 0x00, 0x00, 0x00, 0x00, 0x48, 0x85, 0xc9, 0x74, 0x10, 0x8b, 0x41, 0x08, 0x2d, 0x00, 0x01, 0x00, 0x00, 0x83, 0xf8, 0x09, 0x76,
		0x03, 0x31, 0xc0, 0xc3, 0xe9, 0x00, 0x00, 0x00, 0x00};
	return code;
}

static const std::vector<uint8_t> &message_filter_prelude()
{
	static const std::vector<uint8_t> code{
		0x4c, 0x8b, 0x15, 0x00, 0x00, 0x00, 0x00, 0x4d, 0x85, 0xd2, 0x74, 0x12, 0x41, 0x8b, 0x82, 0x38, 0x07, 0x00, 0x00, 0xa8, 0x01, 0x74, 0x07, 0xa8,
		0x02, 0x75, 0x03, 0x31, 0xc0, 0xc3, 0xe9, 0x00, 0x00, 0x00, 0x00};
	return code;
}

static const std::vector<uint8_t> &desktop_window_prelude()
{
	static const std::vector<uint8_t> code{
		0x4c, 0x8b, 0x15, 0x00, 0x00, 0x00, 0x00, 0x4d, 0x85, 0xd2, 0x74, 0x0d, 0x49, 0x8b, 0x82, 0x40, 0x07, 0x00, 0x00, 0x48, 0x85, 0xc0, 0x74, 0x01,
		0xc3, 0xe9, 0x00, 0x00, 0x00, 0x00};
	return code;
}

static const std::vector<uint8_t> &accelerator_prelude()
{
	static const std::vector<uint8_t> code{
		0x4c, 0x8b, 0x15, 0x00, 0x00, 0x00, 0x00, 0x4d, 0x85, 0xd2, 0x74, 0x6f, 0x4d, 0x85, 0xc0, 0x74, 0x6a, 0x41, 0x8b, 0x40, 0x08, 0x3d, 0x00, 0x01,
		0x00, 0x00, 0x74, 0x5f, 0x3d, 0x02, 0x01, 0x00, 0x00, 0x74, 0x58, 0x3d, 0x04, 0x01, 0x00, 0x00, 0x74, 0x51, 0x4d, 0x8b, 0x9a, 0x00, 0x07, 0x00,
		0x00, 0x4d, 0x85, 0xdb, 0x74, 0x45, 0x48, 0x85, 0xc9, 0x74, 0x40, 0x89, 0xc8, 0x25, 0xff, 0x01, 0x00, 0x00, 0xc1, 0xe0, 0x08, 0x49, 0x3b, 0x0c,
		0x03, 0x75, 0x30, 0x4d, 0x8b, 0x9a, 0x30, 0x07, 0x00, 0x00, 0x4d, 0x85, 0xdb, 0x74, 0x24, 0x48, 0x85, 0xd2, 0x74, 0x1f, 0x41, 0x8b, 0x83, 0x00,
		0x04, 0x00, 0x00, 0x83, 0xf8, 0x40, 0x77, 0x13, 0x85, 0xc0, 0x74, 0x0f, 0xff, 0xc8, 0x49, 0x3b, 0x94, 0xc3, 0x08, 0x04, 0x00, 0x00, 0x75, 0xf0,
		0x31, 0xc0, 0xc3, 0xe9, 0x00, 0x00, 0x00, 0x00};
	return code;
}

// Device context attributes the guest sets and reads in the attribute table the runtime keeps (see NativeWindows::apply_dc_log): text
// and background colors, background mode and text alignment, each setter logging the context for the runtime. A context without a
// slot, the published screen context, an invalid value or a full log goes to the runtime.
static constexpr size_t dc_pointer = 0x748;

static const std::vector<uint8_t> &dc_text_color_prelude()
{
	static const std::vector<uint8_t> code{
		0x4c, 0x8b, 0x15, 0x00, 0x00, 0x00, 0x00, 0x4d, 0x85, 0xd2, 0x74, 0x57, 0x4d, 0x8b, 0x9a, 0x48, 0x07, 0x00, 0x00, 0x4d, 0x85, 0xdb, 0x74, 0x4b,
		0x48, 0x85, 0xc9, 0x74, 0x46, 0x49, 0x3b, 0x8a, 0x00, 0x06, 0x00, 0x00, 0x74, 0x3d, 0x89, 0xc8, 0x25, 0xff, 0x03, 0x00, 0x00, 0xc1, 0xe0, 0x05,
		0x49, 0x8d, 0x84, 0x03, 0x00, 0x10, 0x00, 0x00, 0x48, 0x3b, 0x08, 0x75, 0x26, 0xf7, 0xc2, 0x00, 0x00, 0x00, 0xff, 0x75, 0x1e, 0x49, 0x89, 0xc2,
		0x41, 0x8b, 0x03, 0x83, 0xf8, 0x40, 0x73, 0x13, 0x49, 0x89, 0x4c, 0xc3, 0x08, 0xff, 0xc0, 0x41, 0x89, 0x03, 0x41, 0x8b, 0x42, 0x08, 0x41, 0x89,
		0x52, 0x08, 0xc3, 0xe9, 0x00, 0x00, 0x00, 0x00};
	return code;
}

static const std::vector<uint8_t> &dc_background_color_prelude()
{
	static const std::vector<uint8_t> code{
		0x4c, 0x8b, 0x15, 0x00, 0x00, 0x00, 0x00, 0x4d, 0x85, 0xd2, 0x74, 0x57, 0x4d, 0x8b, 0x9a, 0x48, 0x07, 0x00, 0x00, 0x4d, 0x85, 0xdb, 0x74, 0x4b,
		0x48, 0x85, 0xc9, 0x74, 0x46, 0x49, 0x3b, 0x8a, 0x00, 0x06, 0x00, 0x00, 0x74, 0x3d, 0x89, 0xc8, 0x25, 0xff, 0x03, 0x00, 0x00, 0xc1, 0xe0, 0x05,
		0x49, 0x8d, 0x84, 0x03, 0x00, 0x10, 0x00, 0x00, 0x48, 0x3b, 0x08, 0x75, 0x26, 0xf7, 0xc2, 0x00, 0x00, 0x00, 0xff, 0x75, 0x1e, 0x49, 0x89, 0xc2,
		0x41, 0x8b, 0x03, 0x83, 0xf8, 0x40, 0x73, 0x13, 0x49, 0x89, 0x4c, 0xc3, 0x08, 0xff, 0xc0, 0x41, 0x89, 0x03, 0x41, 0x8b, 0x42, 0x0c, 0x41, 0x89,
		0x52, 0x0c, 0xc3, 0xe9, 0x00, 0x00, 0x00, 0x00};
	return code;
}

static const std::vector<uint8_t> &dc_background_mode_prelude()
{
	static const std::vector<uint8_t> code{
		0x4c, 0x8b, 0x15, 0x00, 0x00, 0x00, 0x00, 0x4d, 0x85, 0xd2, 0x74, 0x59, 0x4d, 0x8b, 0x9a, 0x48, 0x07, 0x00, 0x00, 0x4d, 0x85, 0xdb, 0x74, 0x4d,
		0x48, 0x85, 0xc9, 0x74, 0x48, 0x49, 0x3b, 0x8a, 0x00, 0x06, 0x00, 0x00, 0x74, 0x3f, 0x89, 0xc8, 0x25, 0xff, 0x03, 0x00, 0x00, 0xc1, 0xe0, 0x05,
		0x49, 0x8d, 0x84, 0x03, 0x00, 0x10, 0x00, 0x00, 0x48, 0x3b, 0x08, 0x75, 0x28, 0x83, 0xfa, 0x01, 0x74, 0x05, 0x83, 0xfa, 0x02, 0x75, 0x1e, 0x49,
		0x89, 0xc2, 0x41, 0x8b, 0x03, 0x83, 0xf8, 0x40, 0x73, 0x13, 0x49, 0x89, 0x4c, 0xc3, 0x08, 0xff, 0xc0, 0x41, 0x89, 0x03, 0x41, 0x8b, 0x42, 0x10,
		0x41, 0x89, 0x52, 0x10, 0xc3, 0xe9, 0x00, 0x00, 0x00, 0x00};
	return code;
}

static const std::vector<uint8_t> &dc_text_align_prelude()
{
	static const std::vector<uint8_t> code{
		0x4c, 0x8b, 0x15, 0x00, 0x00, 0x00, 0x00, 0x4d, 0x85, 0xd2, 0x74, 0x4f, 0x4d, 0x8b, 0x9a, 0x48, 0x07, 0x00, 0x00, 0x4d, 0x85, 0xdb, 0x74, 0x43,
		0x48, 0x85, 0xc9, 0x74, 0x3e, 0x49, 0x3b, 0x8a, 0x00, 0x06, 0x00, 0x00, 0x74, 0x35, 0x89, 0xc8, 0x25, 0xff, 0x03, 0x00, 0x00, 0xc1, 0xe0, 0x05,
		0x49, 0x8d, 0x84, 0x03, 0x00, 0x10, 0x00, 0x00, 0x48, 0x3b, 0x08, 0x75, 0x1e, 0x49, 0x89, 0xc2, 0x41, 0x8b, 0x03, 0x83, 0xf8, 0x40, 0x73, 0x13,
		0x49, 0x89, 0x4c, 0xc3, 0x08, 0xff, 0xc0, 0x41, 0x89, 0x03, 0x41, 0x8b, 0x42, 0x14, 0x41, 0x89, 0x52, 0x14, 0xc3, 0xe9, 0x00, 0x00, 0x00, 0x00};
	return code;
}

static const std::vector<uint8_t> &dc_get_text_color_prelude()
{
	static const std::vector<uint8_t> code{
		0x4c, 0x8b, 0x15, 0x00, 0x00, 0x00, 0x00, 0x4d, 0x85, 0xd2, 0x74, 0x35, 0x4d, 0x8b, 0x9a, 0x48, 0x07, 0x00, 0x00, 0x4d, 0x85, 0xdb, 0x74, 0x29,
		0x48, 0x85, 0xc9, 0x74, 0x24, 0x49, 0x3b, 0x8a, 0x00, 0x06, 0x00, 0x00, 0x74, 0x1b, 0x89, 0xc8, 0x25, 0xff, 0x03, 0x00, 0x00, 0xc1, 0xe0, 0x05,
		0x49, 0x8d, 0x84, 0x03, 0x00, 0x10, 0x00, 0x00, 0x48, 0x3b, 0x08, 0x75, 0x04, 0x8b, 0x40, 0x08, 0xc3, 0xe9, 0x00, 0x00, 0x00, 0x00};
	return code;
}

static const std::vector<uint8_t> &dc_get_background_color_prelude()
{
	static const std::vector<uint8_t> code{
		0x4c, 0x8b, 0x15, 0x00, 0x00, 0x00, 0x00, 0x4d, 0x85, 0xd2, 0x74, 0x35, 0x4d, 0x8b, 0x9a, 0x48, 0x07, 0x00, 0x00, 0x4d, 0x85, 0xdb, 0x74, 0x29,
		0x48, 0x85, 0xc9, 0x74, 0x24, 0x49, 0x3b, 0x8a, 0x00, 0x06, 0x00, 0x00, 0x74, 0x1b, 0x89, 0xc8, 0x25, 0xff, 0x03, 0x00, 0x00, 0xc1, 0xe0, 0x05,
		0x49, 0x8d, 0x84, 0x03, 0x00, 0x10, 0x00, 0x00, 0x48, 0x3b, 0x08, 0x75, 0x04, 0x8b, 0x40, 0x0c, 0xc3, 0xe9, 0x00, 0x00, 0x00, 0x00};
	return code;
}

static const std::vector<uint8_t> &dc_get_background_mode_prelude()
{
	static const std::vector<uint8_t> code{
		0x4c, 0x8b, 0x15, 0x00, 0x00, 0x00, 0x00, 0x4d, 0x85, 0xd2, 0x74, 0x35, 0x4d, 0x8b, 0x9a, 0x48, 0x07, 0x00, 0x00, 0x4d, 0x85, 0xdb, 0x74, 0x29,
		0x48, 0x85, 0xc9, 0x74, 0x24, 0x49, 0x3b, 0x8a, 0x00, 0x06, 0x00, 0x00, 0x74, 0x1b, 0x89, 0xc8, 0x25, 0xff, 0x03, 0x00, 0x00, 0xc1, 0xe0, 0x05,
		0x49, 0x8d, 0x84, 0x03, 0x00, 0x10, 0x00, 0x00, 0x48, 0x3b, 0x08, 0x75, 0x04, 0x8b, 0x40, 0x10, 0xc3, 0xe9, 0x00, 0x00, 0x00, 0x00};
	return code;
}

static const std::vector<uint8_t> &dc_get_text_align_prelude()
{
	static const std::vector<uint8_t> code{
		0x4c, 0x8b, 0x15, 0x00, 0x00, 0x00, 0x00, 0x4d, 0x85, 0xd2, 0x74, 0x35, 0x4d, 0x8b, 0x9a, 0x48, 0x07, 0x00, 0x00, 0x4d, 0x85, 0xdb, 0x74, 0x29,
		0x48, 0x85, 0xc9, 0x74, 0x24, 0x49, 0x3b, 0x8a, 0x00, 0x06, 0x00, 0x00, 0x74, 0x1b, 0x89, 0xc8, 0x25, 0xff, 0x03, 0x00, 0x00, 0xc1, 0xe0, 0x05,
		0x49, 0x8d, 0x84, 0x03, 0x00, 0x10, 0x00, 0x00, 0x48, 0x3b, 0x08, 0x75, 0x04, 0x8b, 0x40, 0x14, 0xc3, 0xe9, 0x00, 0x00, 0x00, 0x00};
	return code;
}

// Releases the guest answers itself and logs for the runtime (see NativeWindows::take_deferred): DestroyIcon of a valid icon, DeleteDC of
// a memory context, and DeleteObject of a bitmap the runtime marked as free to release. Anything else, or a full log, goes to the runtime.
static constexpr size_t deferred_pointer = 0x750, icons_pointer = 0x758;

static const std::vector<uint8_t> &destroy_icon_prelude()
{
	static const std::vector<uint8_t> code{
		0x4c, 0x8b, 0x15, 0x00, 0x00, 0x00, 0x00, 0x4d, 0x85, 0xd2, 0x74, 0x5e, 0x4d, 0x8b, 0x9a, 0x58, 0x07, 0x00, 0x00, 0x4d, 0x85, 0xdb, 0x74, 0x52,
		0x48, 0x85, 0xc9, 0x74, 0x4d, 0x89, 0xc8, 0x25, 0xff, 0x03, 0x00, 0x00, 0x4d, 0x8d, 0x04, 0xc3, 0x49, 0x3b, 0x08, 0x75, 0x3d, 0x4d, 0x8b, 0x9a,
		0x50, 0x07, 0x00, 0x00, 0x4d, 0x85, 0xdb, 0x74, 0x31, 0x41, 0x8b, 0x03, 0x3d, 0xff, 0x00, 0x00, 0x00, 0x73, 0x27, 0x41, 0x89, 0xc1, 0x49, 0xc1,
		0xe1, 0x04, 0x4b, 0x89, 0x4c, 0x0b, 0x10, 0x4b, 0xc7, 0x44, 0x0b, 0x18, 0x01, 0x00, 0x00, 0x00, 0xff, 0xc0, 0x41, 0x89, 0x03, 0x49, 0xc7, 0x00,
		0x00, 0x00, 0x00, 0x00, 0xb8, 0x01, 0x00, 0x00, 0x00, 0xc3, 0xe9, 0x00, 0x00, 0x00, 0x00};
	return code;
}

static const std::vector<uint8_t> &delete_dc_prelude()
{
	static const std::vector<uint8_t> code{
		0x4c, 0x8b, 0x15, 0x00, 0x00, 0x00, 0x00, 0x4d, 0x85, 0xd2, 0x74, 0x6f, 0x4d, 0x8b, 0x9a, 0x48, 0x07, 0x00, 0x00, 0x4d, 0x85, 0xdb, 0x74, 0x63,
		0x48, 0x85, 0xc9, 0x74, 0x5e, 0x89, 0xc8, 0x25, 0xff, 0x03, 0x00, 0x00, 0xc1, 0xe0, 0x05, 0x4d, 0x8d, 0x84, 0x03, 0x00, 0x10, 0x00, 0x00, 0x49,
		0x3b, 0x08, 0x75, 0x47, 0x41, 0xf7, 0x40, 0x18, 0x01, 0x00, 0x00, 0x00, 0x75, 0x3d, 0x4d, 0x8b, 0x9a, 0x50, 0x07, 0x00, 0x00, 0x4d, 0x85, 0xdb,
		0x74, 0x31, 0x41, 0x8b, 0x03, 0x3d, 0xff, 0x00, 0x00, 0x00, 0x73, 0x27, 0x41, 0x89, 0xc1, 0x49, 0xc1, 0xe1, 0x04, 0x4b, 0x89, 0x4c, 0x0b, 0x10,
		0x4b, 0xc7, 0x44, 0x0b, 0x18, 0x02, 0x00, 0x00, 0x00, 0xff, 0xc0, 0x41, 0x89, 0x03, 0x49, 0xc7, 0x00, 0x00, 0x00, 0x00, 0x00, 0xb8, 0x01, 0x00,
		0x00, 0x00, 0xc3, 0xe9, 0x00, 0x00, 0x00, 0x00};
	return code;
}

static const std::vector<uint8_t> &delete_object_prelude()
{
	static const std::vector<uint8_t> code{
		0x4c, 0x8b, 0x15, 0x00, 0x00, 0x00, 0x00, 0x4d, 0x85, 0xd2, 0x74, 0x6b, 0x4d, 0x8b, 0x9a, 0x28, 0x07, 0x00, 0x00, 0x4d, 0x85, 0xdb, 0x74, 0x5f,
		0x48, 0x85, 0xc9, 0x74, 0x5a, 0x89, 0xc8, 0x25, 0xff, 0x03, 0x00, 0x00, 0x6b, 0xc0, 0x30, 0x4d, 0x8d, 0x04, 0x03, 0x49, 0x3b, 0x08, 0x75, 0x47,
		0x41, 0xf7, 0x40, 0x08, 0x02, 0x00, 0x00, 0x00, 0x74, 0x3d, 0x4d, 0x8b, 0x9a, 0x50, 0x07, 0x00, 0x00, 0x4d, 0x85, 0xdb, 0x74, 0x31, 0x41, 0x8b,
		0x03, 0x3d, 0xff, 0x00, 0x00, 0x00, 0x73, 0x27, 0x41, 0x89, 0xc1, 0x49, 0xc1, 0xe1, 0x04, 0x4b, 0x89, 0x4c, 0x0b, 0x10, 0x4b, 0xc7, 0x44, 0x0b,
		0x18, 0x03, 0x00, 0x00, 0x00, 0xff, 0xc0, 0x41, 0x89, 0x03, 0x49, 0xc7, 0x00, 0x00, 0x00, 0x00, 0x00, 0xb8, 0x01, 0x00, 0x00, 0x00, 0xc3, 0xe9,
		0x00, 0x00, 0x00, 0x00};
	return code;
}

static const std::vector<uint8_t> *block_prelude(std::string_view module, std::string_view name)
{
	static constexpr std::array<BlockPrelude, 5> ticks{{{"kernel32.dll", "GetTickCount"}, {"kernel32.dll", "GetTickCount64"},
		{"kernelbase.dll", "GetTickCount"}, {"kernelbase.dll", "GetTickCount64"}, {"winmm.dll", "timeGetTime"}}};
	for (const auto &prelude : ticks)
		if (prelude.module == module && prelude.name == name)
			return &tick_prelude();
	if ((module == "kernel32.dll" || module == "kernelbase.dll") && (name == "GetLocaleInfoEx" || name == "GetLocaleInfoW"))
		return &locale_prelude();
	if (module == "ntdll.dll" && (name == "NtAllocateVirtualMemory" || name == "ZwAllocateVirtualMemory"))
		return &nt_commit_prelude();
	if (module == "ntdll.dll" && (name == "NtFreeVirtualMemory" || name == "ZwFreeVirtualMemory"))
		return &nt_decommit_prelude();
	if ((module == "kernel32.dll" || module == "kernelbase.dll") && name == "MulDiv")
		return &muldiv_prelude();
	if ((module == "shlwapi.dll" || module == "kernelbase.dll") && name == "PathFindFileNameW")
		return &file_name_prelude();
	// Without visual styles no window has a theme, and the answer needs no trip to the runtime.
	if (module == "uxtheme.dll" && name == "GetWindowTheme" && [] {
			const char *chosen = std::getenv("RAVEN_THEME");
			return chosen && std::string_view(chosen) == "classic";
		}())
		return &window_theme_prelude();
	if (module == "user32.dll" && name == "TranslateMessage")
		return &translate_message_prelude();
	if (module == "user32.dll" && name == "CallMsgFilterW")
		return &message_filter_prelude();
	if (module == "user32.dll" && name == "GetDesktopWindow")
		return &desktop_window_prelude();
	if (module == "user32.dll" && name == "TranslateAcceleratorW")
		return &accelerator_prelude();
	if (module == "user32.dll" && name == "GetSystemMetrics")
		return &system_metrics_prelude();
	if (module == "user32.dll" && name == "GetSysColor")
		return &system_colors_prelude();
	if (module == "user32.dll" && (name == "CallWindowProcW" || name == "CallWindowProcA"))
		return &call_procedure_prelude();
	if (module == "user32.dll" && name == "OffsetRect")
		return &offset_rect_prelude();
	if (module == "user32.dll" && name == "SetRect")
		return &set_rect_prelude();
	if (module == "user32.dll" && name == "IntersectRect")
		return &intersect_rect_prelude();
	if (module == "gdi32.dll") {
		static constexpr std::array<std::pair<std::string_view, const std::vector<uint8_t> &(*)()>, 8> attributes{{
			{"SetTextColor", dc_text_color_prelude}, {"SetBkColor", dc_background_color_prelude}, {"SetBkMode", dc_background_mode_prelude},
			{"SetTextAlign", dc_text_align_prelude}, {"GetTextColor", dc_get_text_color_prelude}, {"GetBkColor", dc_get_background_color_prelude},
			{"GetBkMode", dc_get_background_mode_prelude}, {"GetTextAlign", dc_get_text_align_prelude}}};
		for (const auto &[attribute, prelude] : attributes)
			if (name == attribute)
				return &prelude();
	}
	if (module == "user32.dll" && name == "DestroyIcon")
		return &destroy_icon_prelude();
	if (module == "gdi32.dll" && name == "DeleteDC")
		return &delete_dc_prelude();
	if (module == "gdi32.dll" && name == "DeleteObject")
		return &delete_object_prelude();
	if (module == "gdi32.dll" && (name == "GetObjectW" || name == "GetObjectA"))
		return &bitmap_object_prelude();
	if (module == "user32.dll" && name == "GetDC")
		return &screen_get_dc_prelude();
	if (module == "user32.dll" && name == "ReleaseDC")
		return &screen_release_dc_prelude();
	if (module == "gdi32.dll" && name == "GetDeviceCaps")
		return &screen_device_caps_prelude();
	if (module != "user32.dll")
		return nullptr;
	if (name == "GetWindowLongPtrW" || name == "GetWindowLongPtrA")
		return &window_long_ptr_prelude();
	if (name == "GetWindowLongW" || name == "GetWindowLongA")
		return &window_long_prelude();
	if (name == "GetPropW")
		return &window_property_prelude();
	if (name == "IsWindow" || name == "IsWindowUnicode")
		return &window_exists_prelude();
	if (name == "GetClientRect")
		return &window_client_prelude();
	if (name == "GetWindowRect")
		return &window_outer_prelude();
	if (name == "IsChild")
		return &window_child_prelude();
	if (name == "GetDpiForWindow")
		return &window_dpi_prelude();
	if (name == "GetFocus")
		return &focus_prelude();
	if (name == "GetMenuItemCount")
		return &menu_count_prelude();
	if (name == "GetSubMenu")
		return &menu_submenu_prelude();
	if (name == "GetMenuItemID")
		return &menu_id_prelude();
	if (name == "GetMenuStringW")
		return &menu_string_prelude();
	if (name == "GetMenuState")
		return &menu_state_prelude();
	return nullptr;
}

static size_t string_prelude_slot(const GuestPrelude &prelude)
{
	return (prelude.code.size() + 63) & ~size_t(63);
}

static std::vector<uint8_t> commit_prelude(int32_t to_pointer, int32_t to_trap)
{
	// mov r10,[pointer]; test r10,r10; jz slow; test rcx,rcx; jz slow; test rdx,rdx; jz slow; cmp r8d,MEM_COMMIT; jne slow;
	// cmp r9d,PAGE_READWRITE; je main; slow: jmp trap; restore: mov r8d,MEM_COMMIT; mov r9d,PAGE_READWRITE; jmp slow;
	// main: rax = first page, r11 = end page; jbe slow; look through the open ranges at commit_windows for one holding [rax, r11),
	// take a log slot with lock xadd at commit_log, store the range there and return rax; a full log or no range goes back to restore.
	std::vector<uint8_t> code{0x4c, 0x8b, 0x15, 0, 0, 0, 0, 0x4d, 0x85, 0xd2, 0x74, 0x19, 0x48, 0x85, 0xc9, 0x74, 0x14, 0x48, 0x85, 0xd2,
		0x74, 0x0f, 0x41, 0x81, 0xf8, 0x00, 0x10, 0x00, 0x00, 0x75, 0x06, 0x41, 0x83, 0xf9, 0x04, 0x74, 0x13, 0xe9, 0, 0, 0, 0, 0x41,
		0xb8, 0x00, 0x10, 0x00, 0x00, 0x41, 0xb9, 0x04, 0x00, 0x00, 0x00, 0xeb, 0xed, 0x48, 0x89, 0xc8, 0x48, 0x25, 0x00, 0xf0, 0xff,
		0xff, 0x4c, 0x8d, 0x9c, 0x11, 0xff, 0x0f, 0x00, 0x00, 0x49, 0x81, 0xe3, 0x00, 0xf0, 0xff, 0xff, 0x49, 0x39, 0xc3, 0x76, 0xd0,
		0x45, 0x8b, 0x82, 0x00, 0x0a, 0x00, 0x00, 0x4d, 0x8d, 0x8a, 0x08, 0x0a, 0x00, 0x00, 0x45, 0x85, 0xc0, 0x74, 0xc2, 0x49, 0x3b,
		0x01, 0x72, 0x30, 0x4d, 0x3b, 0x59, 0x08, 0x77, 0x2a, 0x41, 0xb8, 0x01, 0x00, 0x00, 0x00, 0xf0, 0x45, 0x0f, 0xc1, 0x82, 0x10,
		0x0d, 0x00, 0x00, 0x41, 0x83, 0xf8, 0x20, 0x73, 0xa2, 0x49, 0xc1, 0xe0, 0x04, 0x4b, 0x89, 0x84, 0x02, 0x18, 0x0d, 0x00, 0x00,
		0x4f, 0x89, 0x9c, 0x02, 0x20, 0x0d, 0x00, 0x00, 0xc3, 0x49, 0x83, 0xc1, 0x10, 0x41, 0xff, 0xc8, 0xeb, 0xbd};
	static_assert(NativeMemory::commit_windows == 0xa00 && NativeMemory::commit_log == 0xd10 && NativeMemory::commit_window_count == 48 &&
		NativeMemory::commit_log_count == 32, "the commit prelude's offsets are written into its code");
	const int32_t displacement = to_pointer - 7;
	std::memcpy(code.data() + 3, &displacement, 4);
	const int32_t relative = to_trap - int32_t(commit_jump(GuestMemoryApi::commit) + 5);
	std::memcpy(code.data() + commit_jump(GuestMemoryApi::commit) + 1, &relative, 4);
	return code;
}

// Where the served stub behind an export sits: the export itself, or the stub a clock prelude falls back to; for a commit prelude, the
// breakpoint it falls back to.
static uint32_t served_stub_rva(std::span<const uint8_t> image, std::string_view module, std::string_view name, uint32_t rva)
{
	if (queued_arguments(module, name) && rva <= image.size() && image.size() - rva >= queued_prelude_size &&
		image[rva] == 0x66 && image[rva + 1] == 0x90) {
		int32_t relative = 0;
		std::memcpy(&relative, image.data() + rva + queued_prelude_size - 4, 4);
		return uint32_t(int64_t(rva) + queued_prelude_size + relative);
	}
	if (module == "ntdll.dll" && rva <= image.size() && image.size() - rva >= 11 &&
		image[rva] == 0x4c && image[rva + 1] == 0x8b && image[rva + 2] == 0xd1 && image[rva + 3] == 0xb8)
		return rva;
	// A plain provider has no guest-side prelude in front of its trap.
	if (rva < image.size() && (image[rva] == 0xcc || (image[rva] == 0x90 && size_t(rva) + 15 < image.size() && image[rva + 14] == 0xcc)))
		return rva;
	if (const auto *prelude = block_prelude(module, name)) {
		int32_t relative = 0;
		std::memcpy(&relative, image.data() + rva + prelude->size() - 4, 4);
		return uint32_t(int64_t(rva) + prelude->size() + relative);
	}
	if (const auto *prelude = string_prelude(module, name)) {
		int32_t relative = 0;
		std::memcpy(&relative, image.data() + rva + prelude->code.size() - 4, 4);
		return uint32_t(int64_t(rva) + prelude->code.size() + relative);
	}
	if (const auto kind = guest_memory_api(module, name); kind != GuestMemoryApi::none) {
		int32_t relative = 0;
		std::memcpy(&relative, image.data() + rva + commit_jump(kind) + 1, 4);
		return uint32_t(int64_t(rva) + commit_jump(kind) + 5 + relative);
	}
	if (!guest_clock_api(module, name))
		return rva;
	int32_t relative = 0;
	std::memcpy(&relative, image.data() + rva + 12, 4);
	return uint32_t(int64_t(rva) + 16 + relative);
}

static uint32_t nt_service_number(std::string_view module, std::string_view name)
{
	if (module != "ntdll.dll" || (!name.starts_with("Nt") && !name.starts_with("Zw")))
		return 0;
	const std::string canonical = "Nt" + std::string(name.substr(2));
	const auto names = system_export_names("ntdll.dll");
	const auto found = std::lower_bound(names.begin(), names.end(), canonical);
	// Use the complete name table so a copied service keeps its identity across different process import graphs.
	return found != names.end() && *found == canonical ? 0x10000 + uint32_t(found - names.begin()) : 0;
}

uint64_t api_trap_address(const PEModule &provider, std::string_view module, std::string_view name, uint32_t address)
{
	// An export that is its own breakpoint has no stub in front of it: a provider built without guest-side paths.
	const auto image = provider.loaded.data();
	if (address < image.size() && image[address] == 0xcc)
		return provider.loaded.base() + address;
	const uint32_t stub = served_stub_rva(image, module, name, address);
	// A plain x64 slot keeps its breakpoint past the space hooking libraries overwrite.
	if (!served_api(module, name) && size_t(stub) + 15 < image.size() && image[stub] == 0x90 && image[stub + 14] == 0xcc)
		return provider.loaded.base() + stub + 14;
	return provider.loaded.base() + stub + fast_stub_trap_offset(module, name);
}

// Offset of the slow-path breakpoint inside a fast or served stub.
size_t fast_stub_trap_offset(std::string_view module, std::string_view name)
{
	if (served_api(module, name))
		return served_trap;
	if (module == "user32.dll")
		return 14;
	if (module != "kernel32.dll" && module != "kernelbase.dll")
		return 0;
	for (const auto &stub : fast_stubs())
		if (stub.name == name)
			return 0x30;
	return 0;
}

std::vector<uint8_t> runtime_provider(std::string_view name, uint64_t base,
	std::span<const std::string_view> exports, bool x86, std::span<const std::string_view> data_exports,
	std::span<const std::pair<std::string_view, uint16_t>> ordinal_exports, bool fast_paths)
{
	if (!x86 && !data_exports.empty())
		throw std::runtime_error("native data exports require an x86 provider");
	for (const auto symbol : data_exports)
		if (!std::binary_search(exports.begin(), exports.end(), symbol))
			throw std::runtime_error("native data export is missing from the export table");
	if (exports.empty() || exports.size() > 4096 || name.empty() || name.size() > 63 || name.find('\0') != name.npos ||
		!std::is_sorted(exports.begin(), exports.end()) || std::adjacent_find(exports.begin(), exports.end()) != exports.end())
		throw std::runtime_error("invalid native provider export table");
	size_t string_size = name.size() + 1;
	for (const auto symbol : exports) {
		if (symbol.empty() || symbol.find('\0') != symbol.npos || symbol.size() + 1 > 1024 * 1024 - string_size)
			throw std::runtime_error("native provider export names exceed policy limit");
		string_size += symbol.size() + 1;
	}
	// Every export owns a slot; public ordinals pin a name to its Windows slot and the other names fill the gaps.
	std::vector<uint32_t> slot_of(exports.size(), 0);
	uint32_t slot_count = 0;
	for (const auto &[exported, ordinal] : ordinal_exports) {
		const auto found = std::lower_bound(exports.begin(), exports.end(), exported);
		if (found == exports.end() || *found != exported || !ordinal)
			throw std::runtime_error("native provider ordinal names an unknown export");
		auto &slot = slot_of[size_t(found - exports.begin())];
		if (slot)
			throw std::runtime_error("native provider ordinal is assigned twice");
		slot = ordinal;
		slot_count = std::max<uint32_t>(slot_count, ordinal);
	}
	// The other names take numbers above every public one Windows gives these libraries, so a program that asks for a number Raven does
	// not publish gets no function rather than an unrelated one.
	const uint32_t first_free = slot_count ? std::max<uint32_t>(slot_count + 1, 1024) : 1;
	std::vector<bool> taken(size_t(first_free) + exports.size() + 1, false);
	for (const auto slot : slot_of)
		if (slot && taken[slot])
			throw std::runtime_error("native provider ordinal collides with another export");
		else if (slot)
			taken[slot] = true;
	uint32_t next_slot = first_free;
	for (auto &slot : slot_of)
		if (!slot) {
			while (taken[next_slot])
				++next_slot;
			slot = next_slot;
			taken[slot] = true;
			slot_count = std::max(slot_count, slot);
		}
	const bool numbered = !ordinal_exports.empty();
	const size_t function_count = numbered ? slot_count : exports.size();
	const size_t directory = 0x200 + exports.size() * 16;
	const size_t functions = directory + 40;
	const size_t name_table = functions + function_count * 4;
	const size_t ordinals = name_table + exports.size() * 4;
	const size_t module_name = ordinals + exports.size() * 2;
	// Each data export owns one zeroed 16-byte slot after the strings; the section becomes writable for them.
	const size_t data_start = (module_name + string_size + 15) & ~size_t(15);
	const bool kernel_module = fast_paths && !x86 && (name == "kernel32.dll" || name == "kernelbase.dll");
	size_t fast_count = 0;
	if (kernel_module)
		for (const auto symbol : exports)
			for (const auto &stub : fast_stubs())
				fast_count += stub.name == symbol;
	const size_t fast_start = (data_start + data_exports.size() * 16 + 63) & ~size_t(63);
	size_t served_count = 0;
	if (!x86)
		for (const auto symbol : exports)
			served_count += served_api(name, symbol);
	size_t clock_count = 0;
	if (!x86)
		for (const auto symbol : exports)
			clock_count += guest_clock_api(name, symbol);
	size_t commit_count = 0;
	if (!x86 && served_count)
		for (const auto symbol : exports)
			commit_count += guest_commit_api(name, symbol);
	size_t block_size = 0;
	if (fast_paths && !x86)
		for (const auto symbol : exports)
			if (const auto *prelude = block_prelude(name, symbol))
				block_size += (prelude->size() + 63) & ~size_t(63);
	// The block pointer of the served stubs and the block preludes, then the stubs, then the clock preludes, then the commit preludes.
	const size_t served_start = fast_start + fast_count * 64;
	const size_t clock_start = served_start + (served_count || block_size ? 64 + served_count * served_stub_size : 0);
	const size_t commit_start = clock_start + clock_count * clock_prelude_size;
	const size_t strings_start = commit_start + commit_count * commit_prelude_size;
	size_t strings_size = 0;
	if (kernel_module)
		for (const auto symbol : exports)
			if (const auto *prelude = string_prelude(name, symbol))
				strings_size += string_prelude_slot(*prelude);
	const size_t blocks_start = strings_start + strings_size;
	const bool queued = fast_paths && !x86 && std::getenv("RAVEN_PARALLEL") && std::getenv("RAVEN_QUEUED_GRAPHICS");
	size_t queued_count = 0;
	if (queued)
		for (const auto symbol : exports)
			queued_count += queued_arguments(name, symbol) != 0;
	const size_t queued_start = blocks_start + block_size;
	const size_t end = queued_start + queued_count * queued_prelude_size;
	std::vector<uint8_t> bytes((end + 511) & ~size_t(511));
	const auto rva = [](size_t offset) { return 0x1000 + offset - 0x200; };
	const auto put = [&](size_t offset, uint64_t value, size_t width = 4) {
		for (size_t index = 0; index < width; ++index)
			bytes.at(offset + index) = static_cast<uint8_t>(value >> (index * 8));
	};
	const auto text = [&](size_t offset, std::string_view value) {
		std::copy(value.begin(), value.end(), bytes.begin() + static_cast<ptrdiff_t>(offset));
	};
	put(0, 0x5a4d, 2);
	put(0x3c, 0x80);
	put(0x80, 0x4550);
	// PE32 headers end 16 bytes earlier: no BaseOfData widening, a 4-byte image base and 224 optional bytes.
	const size_t count_field = x86 ? 0xf4 : 0x104;
	const size_t section = x86 ? 0x178 : 0x188;
	put(0x84, x86 ? 0x14c : 0x8664, 2);
	put(0x86, 1, 2);
	put(0x94, x86 ? 224 : 240, 2);
	put(0x96, x86 ? 0x2103 : 0x2003, 2);
	put(0x98, x86 ? 0x10b : 0x20b, 2);
	if (x86 && base > UINT32_MAX - 0x100000)
		throw std::runtime_error("native x86 provider base exceeds the 32-bit address space");
	put(x86 ? 0xb4 : 0xb0, base, x86 ? 4 : 8);
	put(0xb8, 0x1000);
	put(0xbc, 0x200);
	put(0xd0, (rva(bytes.size()) + 4095) & ~size_t(4095));
	put(0xd4, 0x200);
	put(0xdc, 3, 2);
	put(count_field, 16);
	put(count_field + 4, rva(directory));
	// Data slots stay outside the export directory range, or loaders would treat them as forwarders.
	put(count_field + 8, data_start - directory);
	text(section, ".api");
	put(section + 8, bytes.size() - 0x200);
	put(section + 12, 0x1000);
	put(section + 16, bytes.size() - 0x200);
	put(section + 20, 0x200);
	put(section + 36, data_exports.empty() ? 0x60000020 : 0xe0000020);
	put(directory + 12, rva(module_name));
	// Only the independently verified common-controls identity receives a public ordinal.
	const bool icon_control = name == "comctl32.dll" && exports.size() == 1 && exports[0] == "LoadIconWithScaleDown";
	// Names without a public number take the top of the 16-bit ordinal range, where no program imports by number; ordinals are
	// words, and code that adds the base to an index in a word must not wrap.
	put(directory + 16, numbered ? 1 : icon_control ? 381 : uint32_t(0x10000 - function_count));
	put(directory + 20, function_count);
	put(directory + 24, exports.size());
	put(directory + 28, rva(functions));
	put(directory + 32, rva(name_table));
	put(directory + 36, rva(ordinals));
	text(module_name, name);
	size_t cursor = module_name + name.size() + 1;
	size_t fast_next = 0, served_next = 0, clock_next = 0, commit_next = 0, strings_next = strings_start, blocks_next = blocks_start;
	size_t queued_next = queued_start;
	for (size_t index = 0; index < exports.size(); ++index) {
		size_t code = 0x200 + index * 16;
		const uint32_t service = x86 ? 0 : nt_service_number(name, exports[index]);
		bytes[code] = 0xcc;
		bytes[code + 1] = 0xc3;
		// Hooking libraries copy an x64 entry preamble into a trampoline; keep the breakpoint beyond their 14-byte jump space.
		if (!x86 && (fast_paths || name == "user32.dll")) {
			std::fill_n(bytes.begin() + ptrdiff_t(code), 14, 0x90);
			bytes[code + 14] = 0xcc;
			bytes[code + 15] = 0xc3;
		}
		if (service) {
			const std::array<uint8_t, 11> entry{0x4c, 0x8b, 0xd1, 0xb8, 0, 0, 0, 0, 0x0f, 0x05, 0xc3};
			std::copy(entry.begin(), entry.end(), bytes.begin() + ptrdiff_t(code));
			put(code + 4, service);
		}
		if (!x86 && served_api(name, exports[index])) {
			code = served_start + 64 + served_next++ * served_stub_size;
			const auto stub = served_stub(int32_t(served_start) - int32_t(code));
			std::copy(stub.begin(), stub.end(), bytes.begin() + ptrdiff_t(code));
			if (guest_clock_api(name, exports[index])) {
				const size_t served = code;
				code = clock_start + clock_next++ * clock_prelude_size;
				const auto prelude = clock_prelude(int32_t(served_start + 8) - int32_t(code), int32_t(served) - int32_t(code));
				std::copy(prelude.begin(), prelude.end(), bytes.begin() + ptrdiff_t(code));
			}
		}
		if (const auto *prelude = fast_paths && !x86 && !service ? block_prelude(name, exports[index]) : nullptr) {
			const size_t trap = code;
			code = blocks_next;
			blocks_next += (prelude->size() + 63) & ~size_t(63);
			auto bytes_of = *prelude;
			const int32_t displacement = int32_t(served_start) - int32_t(code) - 7;
			std::memcpy(bytes_of.data() + 3, &displacement, 4);
			const int32_t relative = int32_t(trap) - int32_t(code + bytes_of.size());
			std::memcpy(bytes_of.data() + bytes_of.size() - 4, &relative, 4);
			std::copy(bytes_of.begin(), bytes_of.end(), bytes.begin() + ptrdiff_t(code));
		}
		if (const auto *prelude = kernel_module ? string_prelude(name, exports[index]) : nullptr) {
			const size_t trap = code;
			code = strings_next;
			strings_next += string_prelude_slot(*prelude);
			auto bytes_of = prelude->code;
			const int32_t relative = int32_t(trap) - int32_t(code + bytes_of.size());
			std::memcpy(bytes_of.data() + bytes_of.size() - 4, &relative, 4);
			std::copy(bytes_of.begin(), bytes_of.end(), bytes.begin() + ptrdiff_t(code));
		}
		if (!x86 && !service && served_count && guest_commit_api(name, exports[index])) {
			const size_t trap = code;
			code = commit_start + commit_next++ * commit_prelude_size;
			const auto prelude = guest_memory_api(name, exports[index]) == GuestMemoryApi::commit ?
				commit_prelude(int32_t(served_start) - int32_t(code), int32_t(trap) - int32_t(code)) :
				decommit_prelude(int32_t(served_start) - int32_t(code), int32_t(trap) - int32_t(code));
			std::copy(prelude.begin(), prelude.end(), bytes.begin() + ptrdiff_t(code));
		}
		if (kernel_module)
			for (const auto &stub : fast_stubs())
				if (stub.name == exports[index]) {
					code = fast_start + fast_next++ * 64;
					std::copy(stub.code.begin(), stub.code.end(), bytes.begin() + ptrdiff_t(code));
					bytes[code + 0x30] = 0xcc;
					bytes[code + 0x31] = 0xc3;
				}
		if (queued && queued_arguments(name, exports[index])) {
			const size_t served = code;
			code = queued_next;
			queued_next += queued_prelude_size;
			const auto prelude = queued_prelude(int32_t(served) - int32_t(code), queued_arguments(name, exports[index]), exports[index]);
			std::copy(prelude.begin(), prelude.end(), bytes.begin() + ptrdiff_t(code));
		}
		const auto data = std::find(data_exports.begin(), data_exports.end(), exports[index]);
		const size_t entry = numbered ? slot_of[index] - 1 : index;
		put(functions + entry * 4, data == data_exports.end() ? rva(code) : rva(data_start + size_t(data - data_exports.begin()) * 16));
		put(name_table + index * 4, rva(cursor));
		put(ordinals + index * 2, entry, 2);
		text(cursor, exports[index]);
		cursor += exports[index].size() + 1;
	}
	return bytes;
}

// The native API providers sit high in the address space, as Windows places its system libraries: the low default bases are what
// programs' own libraries ask for (0x180000000 for most 64-bit DLLs), and a library that finds its base taken is relocated in every
// process that loads it. The host keeps its own mappings above 0x700000000000.
// A call the runtime is serving: the windows it touches stay touched until the outermost one returns.
struct WindowCallScope {
	NativeWindows &windows;
	explicit WindowCallScope(NativeWindows &windows) : windows(windows) { windows.api_entered(); }
	~WindowCallScope() { windows.api_left(); }
	WindowCallScope(const WindowCallScope &) = delete;
	WindowCallScope &operator=(const WindowCallScope &) = delete;
};

// A queue may be drained by a different guest thread from the one that published it.
struct ServedThreadScope {
	NativeEnvironment &environment;
	uint64_t previous;
	ServedThreadScope(NativeEnvironment &environment, uint64_t producer) : environment(environment), previous(environment.teb())
	{
		if (producer) environment.set_current(producer);
	}
	~ServedThreadScope() { environment.set_current(previous); }
};

// RAVEN_NO_GUEST_PATHS builds the providers without the paths the guest answers itself, for comparing the two.
static bool guest_paths()
{
	static const bool enabled = !std::getenv("RAVEN_NO_GUEST_PATHS");
	return enabled;
}

static uint64_t provider_base(const ModuleSet &modules, uint32_t size)
{
	uint64_t base = 0x6fff00000000ULL;
	for (;;) {
		bool overlap = false;
		for (const auto &[name, module] : modules.all()) {
			const uint64_t start = module->loaded.base();
			const uint64_t end = start + module->loaded.data().size();
			if (base < end && start < base + size) {
				base = (end + 65535) & ~uint64_t(65535);
				overlap = true;
				break;
			}
		}
		if (base >= 0x800000000000ULL - size)
			throw std::runtime_error("no address available for native API provider");
		if (!overlap)
			return base;
	}
}

NativeResult run_native_process(ModuleSet &modules, PEModule &entry,
	const std::string &bootstrap, std::chrono::milliseconds timeout,
	std::function<std::optional<ModuleBytes>(std::string_view)> source,
	std::function<void(std::span<const uint8_t>)> debug, DesktopPresentation presentation,
	std::optional<NativeLaunch> launch)
{
	if (timeout.count() <= 0 || (entry.image.characteristics & 0x2000) ||
		!std::any_of(modules.all().begin(), modules.all().end(), [&](const auto &item) { return item.second.get() == &entry; }))
		throw std::runtime_error("native process requires an executable graph and positive timeout");
	for (const auto &[name,module]:modules.all()) validate_native_image(module->image,name);
	// The system libraries are the runtime's, except those a copy in the program's folder may replace: those are looked for there first.
	std::vector<std::string_view> native_modules{"kernel32.dll","kernelbase.dll","user32.dll","gdi32.dll","comctl32.dll","ntdll.dll"};
	for (const auto library : system_library_names())
		if (!program_may_replace(library) && std::find(native_modules.begin(), native_modules.end(), library) == native_modules.end())
			native_modules.push_back(library);
#ifdef RAVEN_OPENGL
	// The bridge is the program's OpenGL unless the program brings its own opengl32.dll and the bridge was not asked for.
	const bool native_opengl = OpenGLBridge::enabled() && (OpenGLBridge::requested() || !modules.all().contains("opengl32.dll"));
	if (native_opengl) native_modules.push_back("opengl32.dll");
#endif
#ifdef RAVEN_VULKAN
	native_modules.push_back("vulkan-1.dll");
#endif
	load_initial_dependencies(modules,source,native_modules);
	std::map<uint64_t, std::string> traps;
#ifdef RAVEN_OPENGL
	if (native_opengl) {
		if (modules.all().contains("opengl32.dll")) throw std::runtime_error("native OpenGL cannot share a supplied opengl32.dll");
		const auto symbols = OpenGLBridge::exports();
		const auto bytes = runtime_provider("opengl32.dll", 0x180000000ULL, symbols, false, {}, {}, guest_paths());
		const auto base = provider_base(modules, PEImage(bytes).image_size);
		auto &provider = modules.add("opengl32.dll", runtime_provider("opengl32.dll", base, symbols, false, {}, {}, guest_paths()), base);
		provider.runtime_api = true;
		for (const auto &symbol : provider.exports)
			traps.emplace(api_trap_address(provider, "opengl32.dll", symbol.names.at(0), symbol.address), symbol.names.at(0));
	}
#endif
	std::map<uint64_t,std::pair<uint32_t,std::string>> services;
	std::map<uint32_t, std::string> generated_services;
	std::vector<std::string_view> nt_names(NativeMemory::nt_exports().begin(),NativeMemory::nt_exports().end());
	nt_names.insert(nt_names.end(),NativeEnvironment::nt_exports().begin(),NativeEnvironment::nt_exports().end());
	nt_names.insert(nt_names.end(),NativeObjectAPI::nt_exports().begin(),NativeObjectAPI::nt_exports().end());
	const bool has_heap=modules.all().contains("raven-rtl.dll");
	if (has_heap) {
		if (modules.all().contains("ntdll.dll") && !modules.all().at("ntdll.dll")->runtime_api)
			throw std::runtime_error("native RTL component cannot share heap ownership with a supplied ntdll");
		nt_names.insert(nt_names.end(),NativeHeap::nt_exports().begin(),NativeHeap::nt_exports().end());
		for (const auto name : {"DbgBreakPoint","DbgPrint","NtQueryInformationThread","NtReleaseKeyedEvent",
			"NtWaitForKeyedEvent","RtlRaiseException","RtlRaiseStatus","ZwAllocateVirtualMemory","ZwFreeVirtualMemory",
			"ZwProtectVirtualMemory","ZwQueryPerformanceCounter","ZwQuerySystemInformation","ZwQueryVirtualMemory"})
			nt_names.push_back(name);
	}
	// Natives that the shared API registry implements.
	for (const auto name : {"NtSetInformationThread", "NtOpenThreadToken", "NtOpenThreadTokenEx", "NtOpenThread", "NtOpenProcess", "NtOpenProcessToken", "NtOpenProcessTokenEx", "NtQueryInformationProcess", "NtReadVirtualMemory", "NtWriteVirtualMemory", "NtQuerySection", "NtFlushInstructionCache", "RtlAddGrowableFunctionTable", "RtlGrowFunctionTable", "RtlDeleteGrowableFunctionTable",
		"NtWriteFile", "NtQueryDirectoryFile", "ZwQueryDirectoryFile", "RtlNtStatusToDosError", "NtQueryObject", "NtMapViewOfSection", "NtUnmapViewOfSection",
		"RtlAcquireSRWLockExclusive", "RtlAcquireSRWLockShared", "RtlWakeConditionVariable", "RtlWakeAllConditionVariable", "RtlWaitOnAddress",
		"RtlWakeAddressSingle", "RtlWakeAddressAll",
		// The processor a thread runs on.
		"NtGetCurrentProcessorNumber", "NtGetCurrentProcessorNumberEx", "RtlGetCurrentProcessorNumber", "RtlGetCurrentProcessorNumberEx",
		// The C runtime string functions ntdll exports.
		"strlen", "strcmp", "strncmp",
		// Cancelling one pending operation, which mio uses for its AFD polls.
		"NtCancelIoFileEx",
		// Opening files by their native names, which Rust's standard library and mio look up at run time.
		"NtCreateFile", "NtOpenFile",
		// What the runtime's own components import from ntdll, which they need whether a program loads them at start or later.
		"DbgPrint", "NtCancelIoFile", "NtCreateSection", "NtFsControlFile", "NtReadFile", "RtlCreateUnicodeStringFromAsciiz", "RtlFreeHeap",
		"RtlFreeUnicodeString", "RtlDllShutdownInProgress", "RtlGetVersion", "RtlIpv6AddressToStringExW", "RtlIpv6StringToAddressW", "RtlLengthSid", "RtlUnicodeToMultiByteN",
		"RtlUnicodeToMultiByteSize", "RtlIsTextUnicode", "RtlImageNtHeader", "NtDeleteKey",
		// What a browser installer looks up about the machine it runs on.
		"RtlGetDeviceFamilyInfoEnum", "RtlConvertDeviceFamilyInfoToString",
		// The unwinding of 64-bit frames, which libraries built with their own exception handling import.
		"RtlCaptureContext", "RtlLookupFunctionEntry", "RtlPcToFileHeader", "RtlVirtualUnwind", "RtlUnwindEx",
		// What the .NET runtime imports from ntdll: the function tables of the code it compiles, and the restoring of a context.
		"VerSetConditionMask", "RtlInstallFunctionTableCallback", "RtlAddFunctionTable", "RtlDeleteFunctionTable", "RtlRestoreContext",
		// What the native layer of WPF imports from ntdll.
		"DbgPrintEx", "DbgPrompt", "RtlVerifyVersionInfo", "RtlInitializeBitMap", "RtlSetBits", "RtlClearBits", "RtlSetAllBits",
		"RtlClearAllBits", "RtlAreBitsClear", "RtlAreBitsSet", "RtlFindClearBits", "RtlFindClearBitsAndSet", "RtlNumberOfSetBits",
		"RtlInitializeSListHead", "RtlInterlockedPushEntrySList", "RtlInterlockedPopEntrySList", "RtlInterlockedFlushSList",
		"RtlQueryDepthSList",
		// What Wine's builds of the Direct3D 10.1 and Direct2D libraries import from ntdll.
		"_vsnprintf",
		// The registry natives, which libraries loaded after start (the Click-to-Run integration of Office among them) import by name.
		"NtCreateKey", "NtOpenKey", "NtOpenKeyEx", "NtQueryKey", "NtQueryValueKey", "NtSetValueKey", "NtDeleteValueKey", "NtSetInformationKey",
		// Looked up by diagnostics code that records where a call came from.
		"RtlCaptureStackBackTrace",
		// What the virtualization layer of Click-to-Run Office imports from ntdll: more of the registry and the objects, counted strings,
		// file name expressions, and the generic tables, which the guest RTL holds.
		"NtDuplicateObject", "NtEnumerateKey", "NtEnumerateValueKey", "NtFlushKey", "NtNotifyChangeKey", "NtNotifyChangeMultipleKeys",
		"NtOpenJobObject", "NtQuerySecurityObject", "NtRenameKey", "NtSetSecurityObject", "RtlInitUnicodeString", "RtlCompareUnicodeString",
		"RtlCopyUnicodeString", "RtlEqualUnicodeString", "RtlPrefixUnicodeString", "RtlIntegerToUnicodeString", "RtlIsNameInExpression",
		"RtlInitializeGenericTableAvl", "RtlInsertElementGenericTableAvl", "RtlInsertElementGenericTableFullAvl", "RtlIsGenericTableEmptyAvl",
		"RtlNumberGenericTableElementsAvl", "RtlLookupElementGenericTableAvl", "RtlLookupElementGenericTableFullAvl", "RtlEnumerateGenericTableAvl",
		"RtlEnumerateGenericTableWithoutSplayingAvl", "RtlLookupFirstMatchingElementGenericTableAvl", "RtlGetElementGenericTableAvl",
		"RtlDeleteElementGenericTableAvl"})
		if (std::find(nt_names.begin(),nt_names.end(),name)==nt_names.end()) nt_names.push_back(name);
	std::sort(nt_names.begin(),nt_names.end());
	// Every Windows system library that a program may import gets a provider; names without a handler stop visibly when called.
	std::vector<std::string> system_modules{"kernel32.dll", "kernelbase.dll", "user32.dll", "gdi32.dll", "comctl32.dll"};
	for (const auto library : system_library_names())
		if (std::find(system_modules.begin(), system_modules.end(), library) == system_modules.end())
			system_modules.emplace_back(library);
	ProgramLibraries program_libraries;
	if (launch)
		program_libraries = ProgramLibraries(launch->image_path, true);
	// A number with no name known for it still gets an export, so a program that imports by that number binds, and the call it ends in names the number.
	std::map<std::string, std::vector<std::pair<std::string_view, uint16_t>>> unknown_ordinals;
	std::map<std::string, std::vector<std::string>> unknown_names;
	std::deque<std::string> unknown_storage;
	for (const auto &[module_name, module] : modules.all())
		for (const auto &symbol : module->imports) {
			if (!symbol.by_ordinal)
				continue;
			auto library = symbol.module;
			for (auto &character : library)
				if (character >= 'A' && character <= 'Z')
					character = static_cast<char>(character + ('a' - 'A'));
			if (library.find('.') == library.npos)
				library += ".dll";
			const auto known = system_export_ordinals(library);
			if (std::find(system_modules.begin(), system_modules.end(), library) == system_modules.end() || modules.all().contains(library) ||
				std::any_of(known.begin(), known.end(), [&](const auto &item) { return item.second == symbol.ordinal; }))
				continue;
			const auto text = "Ordinal" + std::to_string(symbol.ordinal);
			if (std::find(unknown_names[library].begin(), unknown_names[library].end(), text) != unknown_names[library].end())
				continue;
			unknown_names[library].push_back(text);
			unknown_ordinals[library].emplace_back(unknown_storage.emplace_back(text), symbol.ordinal);
		}
	for (const auto &name : system_modules) {
		const auto base_symbols = name == "ntdll.dll" ? std::span<const std::string_view>(nt_names) : name == "user32.dll" ? NativeDesktop::user_exports() :
			name == "gdi32.dll" ? NativeDesktop::gdi_exports() :
			name == "comctl32.dll" ? NativeDesktop::control_exports() :
			name == "kernel32.dll" || name == "kernelbase.dll" ? std::span<const std::string_view>(names) : std::span<const std::string_view>();
		const auto library = name == "kernelbase.dll" ? std::string_view("kernel32.dll") : std::string_view(name);
		std::vector<std::string_view> symbols(base_symbols.begin(), base_symbols.end());
		// ntdll.dll answers for what it implements and what the program imports: a program probing for other functions by name must not
		// find ones that cannot run, as it does not on a system that lacks them.
		const auto listed = library == "ntdll.dll" ? std::span<const std::string_view>() : system_export_names(library);
		symbols.insert(symbols.end(), listed.begin(), listed.end());
		if (library == "ntdll.dll")
			for (const auto &[module_name, module] : modules.all())
				for (const auto &symbol : module->imports) {
					auto imported = symbol.module;
					for (auto &character : imported)
						if (character >= 'A' && character <= 'Z')
							character = static_cast<char>(character + ('a' - 'A'));
					if ((imported == "ntdll.dll" || imported == "ntdll") && !symbol.by_ordinal)
						symbols.push_back(unknown_storage.emplace_back(symbol.name));
				}
		if (const auto extra = unknown_ordinals.find(std::string(name)); extra != unknown_ordinals.end())
			for (const auto &item : extra->second)
				symbols.push_back(item.first);
		if (library == "kernel32.dll")
			symbols.push_back("RcConsolidateFrames");
		std::sort(symbols.begin(), symbols.end());
		symbols.erase(std::unique(symbols.begin(), symbols.end()), symbols.end());
		if (symbols.empty())
			continue;
		const auto published_numbers = system_export_ordinals(library);
		std::vector<std::pair<std::string_view, uint16_t>> ordinals(published_numbers.begin(), published_numbers.end());
		if (const auto extra = unknown_ordinals.find(std::string(name)); extra != unknown_ordinals.end())
			ordinals.insert(ordinals.end(), extra->second.begin(), extra->second.end());
		PEModule *provider = nullptr;
		const auto found = modules.all().find(name);
		if (found != modules.all().end() && found->second->runtime_api) {
			provider = found->second.get();
		} else if (found != modules.all().end()) {
			if (!program_may_replace(name))
				continue;
			const auto fallback = "system32-" + name;
			if (!modules.all().contains(fallback)) {
				const auto bytes = runtime_provider(name, 0x180000000ULL, symbols, false, {}, ordinals, guest_paths());
				const auto base = provider_base(modules, PEImage(bytes).image_size);
				provider = &modules.add(fallback, runtime_provider(name, base, symbols, false, {}, ordinals, guest_paths()), base);
				provider->runtime_api = true;
			}
		} else {
			const auto provider_key = program_libraries.contains(name) ? "system32-" + name : name;
			const auto bytes = runtime_provider(name, 0x180000000ULL, symbols, false, {}, ordinals, guest_paths());
			const auto base = provider_base(modules, PEImage(bytes).image_size);
			provider = &modules.add(provider_key, runtime_provider(name, base, symbols, false, {}, ordinals, guest_paths()), base);
			provider->runtime_api = true;
		}
		if (!provider)
			continue;
		// A guest component that implements part of a system library receives those calls directly instead of through a trap.
		if (provider->runtime_api) {
			struct Overlay { const char *library, *component, *prefix; };
			static constexpr Overlay overlays[] = {
				{"user32.dll", "raven-user32.dll", "raven-user32."}, {"comdlg32.dll", "raven-shell.dll", "raven-shell."},
				{"ole32.dll", "raven-shell.dll", "raven-shell."}, {"shell32.dll", "raven-shell.dll", "raven-shell."},
				{"shlwapi.dll", "raven-shell.dll", "raven-shell."}, {"setupapi.dll", "raven-setupapi.dll", "raven-setupapi."},
				{"ole32.dll", "raven-storage.dll", "raven-storage."}, {"combase.dll", "raven-shell.dll", "raven-shell."},
				{"uiautomationcore.dll", "raven-shell.dll", "raven-shell."}, {"runtimeobject.dll", "raven-shell.dll", "raven-shell."},
				{"api-ms-win-core-winrt-l1-1-0.dll", "raven-shell.dll", "raven-shell."},
				// The heap, critical sections and the free paths of SRW locks and condition variables run in the guest RTL.
				{"kernel32.dll", "raven-rtl.dll", "raven-rtl."}, {"kernelbase.dll", "raven-rtl.dll", "raven-rtl."},
				// The generic AVL tables and critical sections of ntdll; its heap stays with the host, which calls the guest RTL itself.
				{"ntdll.dll", "raven-rtl.dll", "raven-rtl."}};
			for (const auto &overlay_rule : overlays) {
				if (name != overlay_rule.library)
					continue;
				const bool nt_only = name == "ntdll.dll";
				const auto overlay = modules.all().find(overlay_rule.component);
				if (overlay == modules.all().end() || overlay->second->runtime_api)
					continue;
				for (auto &symbol : provider->exports)
					if (!symbol.names.empty() && (!nt_only || symbol.names.at(0).find("GenericTable") != std::string::npos || symbol.names.at(0).find("CriticalSection") != std::string::npos) && std::any_of(overlay->second->exports.begin(), overlay->second->exports.end(), [&](const auto &candidate) {
							return candidate.forwarder.empty() && std::find(candidate.names.begin(), candidate.names.end(), symbol.names.at(0)) != candidate.names.end();
						}))
						symbol.forwarder = overlay_rule.prefix + symbol.names.at(0);
			}
			// The structured exception handler of C code, which kernel32 publishes for compilers that import it from there, is the C
			// runtime's.
			if (name == "kernel32.dll")
				if (const auto runtime = modules.all().find("ucrtbase.dll"); runtime != modules.all().end() && !runtime->second->runtime_api)
					for (auto &symbol : provider->exports)
						if (!symbol.names.empty() && symbol.names.at(0) == "__C_specific_handler")
							symbol.forwarder = "ucrtbase.__C_specific_handler";
		}
		forward_opengl_formats(modules, *provider);
		// The traps of ntdll.dll are made below, where the Zw names answer as their Nt twins.
		if (name != "ntdll.dll")
			for (const auto &symbol : provider->exports)
				if (symbol.address && !symbol.names.empty() && symbol.forwarder.empty())
					traps.emplace(provider->runtime_api ? api_trap_address(*provider, name, symbol.names.at(0), symbol.address) :
						provider->loaded.base() + symbol.address, symbol.names.at(0));
	}
	const auto nt=modules.all().find("ntdll.dll");
	const bool needs_nt=std::any_of(modules.all().begin(),modules.all().end(),[](const auto &item) {
		return std::any_of(item.second->imports.begin(),item.second->imports.end(),[](const auto &symbol) {
			auto name=symbol.module;
			for (auto &character : name)
				if (character>='A' && character<='Z') character=char(character+('a'-'A'));
			return name=="ntdll.dll" || name=="ntdll";
		});
	});
	if (nt==modules.all().end() && needs_nt) {
		const auto bytes=runtime_provider("ntdll.dll",0x180000000ULL,nt_names,false,{},{},guest_paths());
		const auto base=provider_base(modules,PEImage(bytes).image_size);
		auto &provider=modules.add("ntdll.dll",runtime_provider("ntdll.dll",base,nt_names,false,{},{},guest_paths()),base);
		provider.runtime_api=true;
	}
	if (modules.all().contains("ntdll.dll"))
		for (const auto &symbol : modules.all().at("ntdll.dll")->exports)
			for (const auto &name : symbol.names)
				if (symbol.address && (modules.all().at("ntdll.dll")->runtime_api || std::find(nt_names.begin(),nt_names.end(),name)!=nt_names.end()) && symbol.forwarder.empty()) {
					const auto &image=*modules.all().at("ntdll.dll");
					if (image.runtime_api) {
						if (const uint32_t number = nt_service_number("ntdll.dll", name)) {
							generated_services.emplace(number, "Nt" + name.substr(2));
							continue;
						}
						traps.emplace(api_trap_address(image,"ntdll.dll",name,symbol.address),name.starts_with("Zw") ? "Nt"+name.substr(2) : name);
						continue;
					}
					const auto bytes=image.image.file_span(symbol.address,11);
					const bool first=bytes[0]==0xb8 && bytes[5]==0x4c && bytes[6]==0x8b && bytes[7]==0xd1;
					const bool second=bytes[0]==0x4c && bytes[1]==0x8b && bytes[2]==0xd1 && bytes[3]==0xb8;
					if ((!first && !second) || bytes[8]!=0x0f || bytes[9]!=0x05 || bytes[10]!=0xc3)
						throw std::runtime_error("unsupported native NT syscall stub: "+name);
					uint32_t number=0;
					for (size_t byte=0; byte<4; ++byte) number|=uint32_t(bytes[(first ? 1 : 4)+byte])<<(byte*8);
					services.emplace(image.loaded.base()+symbol.address+10,std::pair{number,name});
				}
#ifdef RAVEN_VULKAN
	const auto found_vulkan = modules.all().find("vulkan-1.dll");
	if (found_vulkan == modules.all().end()) {
		const auto bytes = runtime_provider("vulkan-1.dll", 0x180000000ULL, VulkanBridge::exports(), false, {}, {}, guest_paths());
		const auto base = provider_base(modules, PEImage(bytes).image_size);
		auto &provider = modules.add("vulkan-1.dll", runtime_provider("vulkan-1.dll", base, VulkanBridge::exports(), false, {}, {}, guest_paths()), base);
		provider.runtime_api = true;
	}
	if (modules.all().at("vulkan-1.dll")->runtime_api)
		for (const auto &symbol : modules.all().at("vulkan-1.dll")->exports)
			traps.emplace(api_trap_address(*modules.all().at("vulkan-1.dll"), "vulkan-1.dll", symbol.names.at(0), symbol.address),
				symbol.names.at(0));
#endif
	alias_api_sets(modules);
	modules.bind_imports();
	auto order = initialization_order(modules, entry);
	// The user32 component registers the built-in classes in its DllMain, before any library that subclasses them.
	if (const auto controls = modules.all().find("raven-user32.dll"); controls != modules.all().end() && !controls->second->runtime_api) {
		const auto found = std::find(order.begin(), order.end(), controls->second.get());
		if (found != order.end()) {
			order.erase(found);
			order.insert(order.begin(), controls->second.get());
		}
	}
	std::vector<LoadedImage *> images;
	for (const auto &[name, module] : modules.all())
		images.push_back(&module->loaded);
	const auto deadline = std::chrono::steady_clock::now() + timeout;
	NativeProcess process(images, bootstrap, timeout, NativeMode::x64, entry.image.stack_reserve);
	for (const auto &[address, name] : traps)
		process.add_api_trap(address);
	NativeEnvironment environment(process, entry.loaded.base(), uint32_t(::getpid()), 1);
	const bool has_launch = launch.has_value();
	if (!launch) {
		NativeLaunch initial;
		for (const char byte : entry.name) {
			const auto character=static_cast<unsigned char>(byte);
			if (character>127) throw std::runtime_error("native default launch identity requires ASCII");
			initial.image_path.push_back(char16_t(character));
		}
		initial.command_line=u"\""+initial.image_path+u"\"";
		launch=std::move(initial);
	}
	NativeObjects kernel_objects;
	adopt_inherited(kernel_objects,launch->inherited);
	std::array<uint64_t,3> standard_handles{UINT64_MAX,UINT64_MAX,UINT64_MAX};
	for (size_t i=0;i<3;++i) {
		// A standard handle the creator also let the child inherit is that inherited object, under its own value.
		const auto shared=std::find_if(launch->inherited.begin(),launch->inherited.end(),[&](const InheritedHandle &record) {
			return (record.standard & (1U << i)) && kernel_objects.object(record.handle);
		});
		if (shared!=launch->inherited.end()) { standard_handles[i]=shared->handle; continue; }
		if (launch->standard_fds[i]<0) continue;
		const auto inherited=kernel_objects.inherit_file(launch->standard_fds[i]);
		if (inherited.status) throw std::runtime_error("cannot inherit native standard file");
		// The standard handles came from the creator by inheritance, so they are inheritable, as programs that pass them on in a
		// handle list (PROC_THREAD_ATTRIBUTE_HANDLE_LIST) require.
		kernel_objects.set_inherit(inherited.value,true);
		standard_handles[i]=inherited.value;
	}
	environment.prepare_parameters(*launch,standard_handles);
	ApiRegistry api_registry, desktop_api;
	NativeLoaderData loader_data(process, environment.peb(), modules, entry);
	// Compilers can address executable TLS through slot zero without reading its index.
	auto tls_order = order;
	std::erase(tls_order, &entry);
	tls_order.insert(tls_order.begin(), &entry);
	NativeTLS tls(process, environment, tls_order);
	NativeModuleAPI module_api(process, environment, modules, entry);
	NativeResources resources(process, environment, modules, entry);
	// What a program may commit, as set by RAVEN_COMMIT_LIMIT_MB. By default the host's memory, as Windows lets a 64-bit program commit up
	// to its memory and page file: a .NET program maps assemblies of more than 100 MiB as images, and each is committed whole.
	const size_t host_memory=size_t(std::max<long>(::sysconf(_SC_PHYS_PAGES),0))*size_t(std::max<long>(::sysconf(_SC_PAGESIZE),0));
	// An empty or zero setting leaves the limit to the host, as the control panel describes it.
	const char *setting=std::getenv("RAVEN_COMMIT_LIMIT_MB");
	const size_t requested=setting ? size_t(std::strtoull(setting,nullptr,10)) : 0;
	const size_t commit_limit=requested ? requested*1024*1024 : std::max(host_memory,size_t(512)*1024*1024);
	NativeMemory memory(process,environment,commit_limit);
	register_images(memory,modules);
	NativeObjectAPI object_api(process,environment,kernel_objects,deadline);
	NativeHeap heap(process,environment,modules,entry.image);
	DesktopObjects desktop_objects;
	NativeDesktop desktop(process, environment, desktop_objects, resources);
	desktop.set_source(source);
	if (const auto component = modules.all().find("raven-user32.dll"); component != modules.all().end() && !component->second->runtime_api)
		desktop.set_oem_module(component->second->loaded.base());
	NativeWindows windows(process,environment,desktop_objects);
	windows.set_deadline(deadline);
	windows.set_menu_loader([&desktop](uint64_t instance,uint64_t identifier) { return desktop.menu_resource(instance,identifier); });
	windows.set_presentation(std::move(presentation));
#ifdef RAVEN_OPENGL
	std::unique_ptr<OpenGLBridge> opengl;
	if (native_opengl) opengl = std::make_unique<OpenGLBridge>(process, modules, desktop_objects, windows);
#endif
	desktop.set_updated([&](uint64_t window) { windows.drawing(window); });
#ifdef RAVEN_VULKAN
	VulkanBridge vulkan(process, modules);
	vulkan.set_surface_source({[&windows](uint64_t window) { return windows.host_surface(window,true); },
		[&windows](uint64_t window) { windows.release_host_surface(window); },
		[&windows](uint64_t window) { return windows.client_size(window); }, windows.host_platform()});
#endif
	const auto remaining = [&] { return std::chrono::duration_cast<std::chrono::milliseconds>(deadline - std::chrono::steady_clock::now()); };
	size_t debug_bytes=0;
	KernelContext *kernel_ptr=nullptr;
	NativeThreads *threads_ptr=nullptr;
	auto last_service=std::chrono::steady_clock::now();
	const auto invoke = [&](uint64_t address, std::span<const uint64_t> arguments) {
		auto budget = remaining();
		if (budget.count() <= 0)
			return NativeResult{NativeStop::timeout, 0, address, 0};
		// Level of this loop in the callback nesting; an exception dispatch that redirects the guest resumes at its own level.
		const size_t level = process.active() ? process.callback_depth() + 1 : 0;
		auto result = process.active() ? process.callback(address, arguments, budget) : process.call(address, arguments, budget);
		while (result.stop == NativeStop::api || result.stop == NativeStop::syscall || result.stop==NativeStop::fault) {
			if (result.stop==NativeStop::fault) {
				const auto image=modules.all().find("ntdll.dll");
				if (!debug || image==modules.all().end() || result.signal!=SIGSEGV || result.signal_code!=SI_KERNEL || result.value!=1 ||
					result.instruction<image->second->loaded.base() || result.instruction-image->second->loaded.base()+4>image->second->image.image_size ||
					process.read_memory(result.instruction,4)!=std::vector<uint8_t>{0xcd,0x2d,0xcc,0xc3}) {
					if (result.signal==SIGTRAP && result.signal_code==TRAP_HWBKPT) {
						std::cerr << "watch: write by";
						if (kernel_ptr && kernel_ptr->describe_stack) {
							const auto saved=process.context();
							(void)saved;
						}
						const auto rip=process.context().registers.rip;
						for (const auto &[module_name,module]:modules.all())
							if (rip>=module->loaded.base() && rip<module->loaded.base()+module->image.image_size)
								std::cerr << ' ' << module_name << '+' << std::hex << rip-module->loaded.base() << std::dec;
						std::cerr << '\n';
						budget=remaining();
						result=process.resume(budget);
						continue;
					}
					if (std::getenv("RAVEN_TRACE_FAULT")) {
						const auto describe=[&](uint64_t at) {
							for (const auto &[module_name,module]:modules.all())
								if (at>=module->loaded.base() && at<module->loaded.base()+module->image.image_size)
									return module_name+"+"+std::to_string(at-module->loaded.base());
							return std::string("?");
						};
						const auto registers=process.context().registers;
						std::cerr << "fault: signal " << result.signal << " at " << std::hex << result.instruction << " (" << describe(result.instruction) << ")"
							<< " address=" << result.fault_address << " rax=" << registers.rax << " rbx=" << registers.rbx
							<< " rcx=" << registers.rcx << " rdx=" << registers.rdx << " rsp=" << registers.rsp;
						for (const auto address : {registers.rsp, registers.rbx}) {
							try {
								const auto bytes = process.read_memory(address, 64);
								for (size_t at = 0; at < bytes.size(); at += 8) {
									uint64_t value = 0;
									std::memcpy(&value, bytes.data() + at, 8);
									std::cerr << " [" << address + at << "]=" << value << " (" << describe(value) << ")";
								}
							} catch (const std::runtime_error &) {}
						}
						std::cerr << std::dec << '\n';
					}
					// A CPU fault is a Windows exception: structured handlers of the faulting frames get the first chance.
					if (!kernel_ptr || !kernel_ptr->raise_fault || result.signal==0)
						return result;
					try {
						kernel_ptr->raise_fault(result);
					} catch (const ExecutionRedirected &redirected) {
						if (redirected.level!=level) throw;
						budget=remaining();
						if (budget.count()<=0)
							return NativeResult{NativeStop::timeout,0,result.instruction,0};
						result=process.resume(budget);
						continue;
					}
					return result;
				}
				const auto context=process.context().registers;
				const auto length=uint32_t(context.rdx);
				if (length>512 || length>1024*1024-debug_bytes)
					return result;
				const auto message=process.read_memory(context.rcx,length);
				debug(message);
				debug_bytes+=length;
				process.complete_debug_print(result.instruction);
				const auto budget=remaining();
				if (budget.count()<=0)
					return NativeResult{NativeStop::timeout,0,result.instruction,0};
				result=process.resume(budget);
				continue;
			}
			const std::string *service_name = nullptr;
			if (result.stop == NativeStop::syscall) {
				const auto supplied = services.find(result.instruction);
				const auto generated = generated_services.find(uint32_t(result.value));
				if (supplied != services.end() && supplied->second.first == result.value)
					service_name = &supplied->second.second;
				else if (result.value <= UINT32_MAX && generated != generated_services.end())
					service_name = &generated->second;
				else
					return result;
				process.enter_nt_service(result.instruction, uint32_t(result.value));
			}
			const auto found = traps.find(result.value);
			if (!service_name && found == traps.end())
				return result;
			const auto &api_name = service_name ? *service_name : found->second;
			// ntdll's RtlExitUserProcess is the ExitProcess of programs that do without kernel32.
			if (api_name == "ExitProcess" || api_name == "RtlExitUserProcess") {
				const auto code=uint32_t(process.api_arguments(1)[0]);
				process.abandon_call();
				throw ProcessExit{code,result.instruction};
			}
			// RAVEN_TRACE_API is 1 for every call or a comma-separated list of API names to follow.
			bool tracing = false;
			static const char *const trace_selection = std::getenv("RAVEN_TRACE_API");
			static const char *const trace_program = std::getenv("RAVEN_TRACE_PROGRAM");
			if (const char *selection = trace_selection; selection &&
				(!trace_program || equal_fold(from_utf8(entry.name), from_utf8(trace_program)))) {
				const std::string wanted = std::string(",") + selection + ",";
				tracing = wanted == ",1," || wanted.find("," + api_name + ",") != wanted.npos;
			}
			if (tracing) {
				std::cerr << "api " << api_name << '(' << std::hex;
				// RAVEN_TRACE_ARGS widens the argument list shown (the default is the four register arguments).
				const char *width = std::getenv("RAVEN_TRACE_ARGS");
				for (const auto value : process.api_arguments(width ? std::clamp(std::atoi(width), 1, 12) : 4))
					std::cerr << ' ' << value;
				std::cerr << std::dec << " )";
				if (std::getenv("RAVEN_TRACE_STRINGS"))
					for (const auto value : process.api_arguments(4))
						if (const auto text = describe_text(process, value); !text.empty())
							std::cerr << " <" << text << '>';
				// The caller shows which guest module and offset asked, which is what a diagnosis needs most.
				const auto stack = process.read_memory(process.context().registers.rsp, 8);
				uint64_t caller = 0;
				std::memcpy(&caller, stack.data(), 8);
				for (const auto &[module_name, module] : modules.all())
					if (caller >= module->loaded.base() && caller < module->loaded.base() + module->image.image_size)
						std::cerr << " from " << module_name << '+' << std::hex << caller - module->loaded.base() << std::dec;
				if (std::getenv("RAVEN_TRACE_STACK") && kernel_ptr && kernel_ptr->describe_stack)
					std::cerr << " stack:" << kernel_ptr->describe_stack();
				if (threads_ptr)
					std::cerr << " on thread " << threads_ptr->current_id();
				std::cerr << '\n';
			}
			if (const char *spec = std::getenv("RAVEN_STEP")) {
				// Diagnosis aid: NAME:OCCURRENCE:COUNT single-steps COUNT instructions after the OCCURRENCE-th return of NAME.
				static std::map<std::string,int> seen;
				const std::string text(spec);
				const auto first = text.find(':'), second = text.find(':', first + 1);
				if (first != text.npos && second != text.npos && api_name == text.substr(0, first) &&
					(!trace_program || equal_fold(from_utf8(entry.name), from_utf8(trace_program))) &&
					++seen[api_name] == std::stoi(text.substr(first + 1, second - first - 1)))
					process.trace_instructions(size_t(std::stoul(text.substr(second + 1))), [&modules, &process](uint64_t rip) {
						std::cerr << "step";
						for (const auto &[module_name, module] : modules.all())
							if (rip >= module->loaded.base() && rip < module->loaded.base() + module->image.image_size)
								std::cerr << ' ' << module_name << '+' << std::hex << rip - module->loaded.base() << std::dec;
						if (std::getenv("RAVEN_TRACE_STRINGS")) {
							const auto registers = process.context().registers;
							for (const auto value : {registers.rcx, registers.rdx, registers.r8, registers.r9})
								if (const auto value_text = describe_text(process, value); !value_text.empty())
									std::cerr << " <" << value_text << '>';
						}
						std::cerr << '\n';
					});
			}
			if (api_name=="RtlRaiseStatus")
				return native_raise_rtl_exception(process,true);
			// A thread that never waits still answers the other processes, a few times every second at most.
			if (const auto now = std::chrono::steady_clock::now(); now - last_service >= std::chrono::milliseconds(2)) {
				last_service = now;
				if (threads_ptr)
					threads_ptr->serve();
			}
			bool dispatched;
			api_in_progress = api_name.c_str();
			windows.apply_dc_log();
			windows.take_deferred([&desktop](uint32_t operation, uint64_t handle) { desktop.apply_deferred(operation, handle); });
			windows.screen_dc_use(api_name);
			const auto profile_start = RuntimeProfile::instance().enabled() ? std::chrono::steady_clock::now() : std::chrono::steady_clock::time_point{};
			static const bool trace_failures = std::getenv("RAVEN_TRACE_FAIL");
			const auto error_before = trace_failures ? environment.last_error() : 0;
			const auto failure_arguments = trace_failures ? process.api_arguments(4) : std::vector<uint64_t>{};
			try {
				const WindowCallScope window_scope(windows);
				// The generalized desktop services come first so that they replace the older narrow ones.
				dispatched = desktop_api.dispatch(process, environment, api_name) || environment.dispatch(api_name) || module_api.dispatch(api_name) || resources.dispatch(api_name) || memory.dispatch(api_name) || object_api.dispatch(api_name) || heap.dispatch(api_name) || desktop.dispatch(api_name) || windows.dispatch(api_name) || api_registry.dispatch(process, environment, api_name)
#ifdef RAVEN_VULKAN
					|| vulkan.dispatch(api_name)
#endif
					;
			} catch (const ExecutionRedirected &redirected) {
				if (redirected.level!=level) throw;
				budget=remaining();
				if (budget.count()<=0)
					return NativeResult{NativeStop::timeout,0,result.instruction,0};
				result=process.resume(budget);
				continue;
			}
			// Calls that stopped the guest are counted apart from served ones: a stop costs far more than the call.
			if (RuntimeProfile::instance().enabled() && profile_start != std::chrono::steady_clock::time_point{})
				RuntimeProfile::instance().api("(stop) " + api_name, std::chrono::steady_clock::now() - profile_start);
			if (!dispatched && std::getenv("RAVEN_SURVEY_MISSING")) {
				// Survey aid: report each missing API once and fail it, so one run lists every API a program reaches.
				static std::set<std::string> reported;
				if (reported.insert(api_name).second)
					std::cerr << "raven: missing " << api_name << '\n';
				environment.set_last_error(120);
				process.return_api(0);
				budget = remaining();
				result = process.resume(budget);
				continue;
			}
			if (!dispatched) {
				std::cerr << "raven: unimplemented native API " << api_name << '\n';
				// RAVEN_CONTINUE_UNIMPLEMENTED lists every missing function of a run: each call fails with ERROR_CALL_NOT_IMPLEMENTED instead.
				if (!std::getenv("RAVEN_CONTINUE_UNIMPLEMENTED"))
					return result;
				environment.set_last_error(120);
				process.return_api(0);
				budget = remaining();
				result = process.resume(budget);
				continue;
			}
			if (tracing)
				std::cerr << "  -> " << std::hex << process.result_register() << std::dec << " (error " << environment.last_error() << ")\n";
			if (trace_failures && environment.last_error() != error_before) {
				std::cerr << "fail " << api_name << " error " << environment.last_error() << " args";
				for (const auto value : failure_arguments) std::cerr << ' ' << std::hex << value << std::dec;
				if (api_name == "CreateWindowExW" && failure_arguments.size() > 1) {
					std::string class_name;
					try {
						if (failure_arguments[1] > 0xffff) {
							const auto text = process.read_memory(failure_arguments[1], 64);
							for (size_t i = 0; i < 32 && (text[i * 2] | text[i * 2 + 1]); ++i)
								class_name.push_back(char(text[i * 2]));
						} else
							class_name = "#" + std::to_string(failure_arguments[1]);
					} catch (...) {}
					std::cerr << " class=" << class_name;
				}
				// Calls that take a name first say which name failed.
				static constexpr std::string_view named[] = {"LoadLibraryExW", "LoadLibraryW", "CreateFileW", "GetFileAttributesW",
					"GetFileAttributesExW", "FindFirstFileW", "FindFirstFileExW", "CreateDirectoryW", "DeleteFileW", "OpenEventW", "OpenMutexW",
					"CreateFileMappingW", "OpenFileMappingW"};
				const bool name_first = std::find(std::begin(named), std::end(named), api_name) != std::end(named);
				const size_t name_index = api_name == "CreateFileMappingW" ? 5 : api_name.starts_with("Open") ? 2 : 0;
				if (name_first && failure_arguments.size() > name_index && failure_arguments[name_index] > 0xffff) {
					std::string text;
					try {
						const auto raw = process.read_memory(failure_arguments[name_index], 240);
						for (size_t i = 0; i < 120 && (raw[i * 2] | raw[i * 2 + 1]); ++i)
							text.push_back(raw[i * 2 + 1] ? '?' : char(raw[i * 2]));
					} catch (...) {}
					std::cerr << " name=" << text;
				}
				// A failed lookup says which export of which library was missing.
				if (api_name == "GetProcAddress" && failure_arguments.size() > 1) {
					for (const auto &[module_name, module] : modules.all())
						if (module->loaded.base() == failure_arguments[0]) std::cerr << " module=" << module_name;
					if (failure_arguments[1] > 0xffff) {
						std::string text;
						try {
							const auto raw = process.read_memory(failure_arguments[1], 96);
							for (size_t i = 0; i < raw.size() && raw[i]; ++i) text.push_back(char(raw[i]));
						} catch (...) {}
						std::cerr << " name=" << text;
					}
				}

				for (const auto &[module_name, module] : modules.all()) {
					const auto stack = process.read_memory(process.context().registers.rsp, 8);
					uint64_t caller = 0;
					std::memcpy(&caller, stack.data(), 8);
					if (caller >= module->loaded.base() && caller < module->loaded.base() + module->image.image_size)
						std::cerr << " from " << module_name << '+' << std::hex << caller - module->loaded.base() << std::dec;
				}
				std::cerr << '\n';
			}

			budget = remaining();
			if (budget.count() <= 0)
				return NativeResult{NativeStop::timeout, 0, result.instruction, 0};
			if (RuntimeProfile::instance().enabled()) {
				const auto before = std::chrono::steady_clock::now();
				result = process.resume(budget);
				RuntimeProfile::instance().guest(std::chrono::steady_clock::now() - before);
			} else {
				try {
					result = process.resume(budget);
				} catch (const std::runtime_error &failure) {
					// A handler that leaves the call without its answer is named, since the global name may belong to another thread by now.
					throw std::runtime_error(std::string(failure.what()) + " after " + api_name);
				}
			}
		}
		return result;
	};
	const auto prefix = NativePrefix::from_environment();
	prefix.place_runtime_components(std::filesystem::path(bootstrap).parent_path());
	NativePaths paths(prefix);
	if (launch && !launch->directory.empty())
		paths.set_current(launch->directory);
	desktop.set_section_source([&](uint64_t handle) -> std::optional<std::pair<int, uint64_t>> {
		const auto section = kernel_objects.object_as<SectionObject>(handle);
		if (!section || section->descriptor < 0)
			return std::nullopt;
		return std::make_pair(section->descriptor, section->size);
	});
	desktop.set_host_files([&paths](std::u16string_view path) -> std::optional<std::vector<uint8_t>> {
		const auto resolved = paths.resolve(path);
		if (!resolved || !resolved->exists || !std::filesystem::is_regular_file(resolved->host))
			return std::nullopt;
		return read_host_file(resolved->host);
	});
	GuestAllocator allocator(memory, heap);
	NativeThreads threads(process, environment, memory, &tls, deadline);
	threads.set_runner(invoke);
	threads.default_stack_reserve = entry.image.stack_reserve;
	threads_ptr = &threads;
	// Other processes ask for handles of this one and send theirs; the scheduler answers them.
	threads.add_service([&kernel_objects] { receive_handles(kernel_objects); });
	object_api.set_cooperative(true);
	object_api.set_threads(&threads);
	windows.set_message_wait([&threads](std::function<bool()> ready,std::chrono::steady_clock::time_point until) {
		HostWait waiting;
		threads.block(std::move(ready),until);
	});
	windows.set_idle_sources([&threads](std::chrono::steady_clock::time_point limit) { return threads.idle_until(limit); },
		[&threads](std::vector<pollfd> &descriptors) { threads.idle_descriptors(descriptors); }, [&threads] { threads.drain_wake(); });
	KernelContext kernel{process, environment, memory, allocator, kernel_objects, threads, paths, modules, entry, *launch, invoke};
	threads.set_watched([reactor = kernel.reactor](std::vector<pollfd> &descriptors) { reactor->watch(descriptors); });
	windows.set_global_allocator([&allocator](uint64_t size) { return allocator.allocate(size,true); });
	kernel.queue_status=[&windows](uint32_t thread,uint32_t mask,bool clear) { return windows.queue_status(thread,mask,clear); };
	windows.set_block([&threads](std::function<bool()> ready) {
		HostWait waiting;
		threads.block(std::move(ready), std::nullopt);
	});
#ifdef RAVEN_VULKAN
	vulkan.set_blocking([&threads](std::function<bool()> ready) {
		HostWait waiting;
		threads.block(std::move(ready), std::nullopt);
	}, [&threads] { threads.nudge(); });
#endif
	// The block the served stubs of every runtime provider share, and which stub serves which name.
	const int served_file = memfd_create("raven-served-calls", MFD_CLOEXEC);
	if (served_file < 0 || ftruncate(served_file, 4096) != 0)
		throw std::runtime_error("cannot create the served call block");
	auto *served_block = static_cast<uint64_t *>(mmap(nullptr, 4096, PROT_READ | PROT_WRITE, MAP_SHARED, served_file, 0));
	if (served_block == MAP_FAILED)
		throw std::runtime_error("cannot map the served call block");
	const uint64_t served_guest = process.map_shared(served_file, 4096);
	close(served_file);
	std::map<uint64_t, std::string> served_names;
	// The pointers live in the module images, which outlast this process: they are cleared when it ends so that another process mapping
	// the same images starts with its stubs trapping.
	struct ServedPointers {
		std::vector<uint8_t *> places;
		std::vector<std::pair<uint8_t *, std::array<uint8_t, 12>>> entries;
		~ServedPointers()
		{
			for (auto *place : places)
				std::memset(place, 0, 8);
			for (const auto &[place, bytes] : entries)
				std::copy(bytes.begin(), bytes.end(), place);
		}
	} served_pointers;
	for (const auto &[module_key, module] : modules.all()) {
		if (!module->runtime_api)
			continue;
		const std::string_view module_name = module_key.starts_with("system32-") ? std::string_view(module_key).substr(9) : std::string_view(module_key);
		for (const auto &symbol : module->exports) {
			// The clock and the tick counts only read calibration; their pointers are safe while other threads run.
			if (symbol.address && !symbol.names.empty() && symbol.forwarder.empty() &&
				(guest_clock_api(module_name, symbol.names.at(0)) || block_prelude(module_name, symbol.names.at(0)) == &tick_prelude() ||
					(!process.parallel() && block_prelude(module_name, symbol.names.at(0)))) &&
				served_stub_rva(module->loaded.data(), module_name, symbol.names.at(0), symbol.address) != symbol.address) {
				auto image = module->loaded.data();
				int32_t displacement = 0;
				std::memcpy(&displacement, image.data() + symbol.address + 3, 4);
				std::memcpy(image.data() + symbol.address + 7 + displacement, &served_guest, 8);
				served_pointers.places.push_back(image.data() + symbol.address + 7 + displacement);
			}
			if (!symbol.address || symbol.names.empty() || !symbol.forwarder.empty() || !served_api(module_name, symbol.names.at(0)))
				continue;
			auto image = module->loaded.data();
			const uint32_t stub = served_stub_rva(image, module_name, symbol.names.at(0), symbol.address);
			if (process.parallel()) {
				std::array<uint8_t, 12> previous{};
				std::copy_n(image.data() + stub, previous.size(), previous.begin());
				served_pointers.entries.emplace_back(image.data() + stub, previous);
				// Load this thread's block through GS; keep every completion trap at its original offset.
				const std::array<uint8_t, 12> local{0x65, 0x4c, 0x8b, 0x14, 0x25, 0xf0, 0x1f, 0, 0, 0x90, 0x90, 0x90};
				std::copy(local.begin(), local.end(), image.data() + stub);
			} else {
				int32_t displacement = 0;
				std::memcpy(&displacement, image.data() + stub + 3, 4);
				std::memcpy(image.data() + stub + 7 + displacement, &served_guest, 8);
				served_pointers.places.push_back(image.data() + stub + 7 + displacement);
			}
			served_names.emplace(module->loaded.base() + stub, symbol.names.at(0));
		}
	}
	std::vector<uint64_t> served_stubs, yield_traps, queued_stubs;
	for (const auto &[stub, name] : served_names) {
		served_stubs.push_back(stub);
		yield_traps.push_back(stub + served_yield);
		if (process.parallel() && std::getenv("RAVEN_QUEUED_GRAPHICS") &&
			(queued_arguments("vulkan-1.dll", name) || queued_arguments("opengl32.dll", name)))
			queued_stubs.push_back(stub);
	}
	// A thread inside a commit prelude must not lose the processor between taking a log slot and filling it: the prelude counts as a
	// served stub for the scheduler, in two pieces as it is longer than one.
	for (const auto &[module_key, module] : modules.all())
		if (module->runtime_api) {
			const std::string_view module_name = module_key.starts_with("system32-") ? std::string_view(module_key).substr(9) : std::string_view(module_key);
			for (const auto &symbol : module->exports)
				if (symbol.address && !symbol.names.empty() && symbol.forwarder.empty() && guest_commit_api(module_name, symbol.names.at(0)) &&
					served_stub_rva(module->loaded.data(), module_name, symbol.names.at(0), symbol.address) != symbol.address)
					for (const uint64_t piece : {uint64_t(0), uint64_t(served_trap)})
						served_stubs.push_back(module->loaded.base() + symbol.address + piece);
		}
	// So must one between taking the screen context and reading which it is, or reading a window's record.
	for (const auto &[module_key, module] : modules.all())
		if (module->runtime_api) {
			const std::string_view module_name = module_key.starts_with("system32-") ? std::string_view(module_key).substr(9) : std::string_view(module_key);
			for (const auto &symbol : module->exports)
				if (symbol.address && !symbol.names.empty() && symbol.forwarder.empty() && (module_name == "user32.dll" || module_name == "ntdll.dll"))
					if (const auto *prelude = block_prelude(module_name, symbol.names.at(0)); prelude && prelude != &screen_release_dc_prelude() &&
						served_stub_rva(module->loaded.data(), module_name, symbol.names.at(0), symbol.address) != symbol.address)
						for (uint64_t piece = 0; piece < prelude->size(); piece += served_stub_size)
							served_stubs.push_back(module->loaded.base() + symbol.address + piece);
		}
	memory.set_commit_block(served_block);
	windows.set_screen_block(served_block);
	static_assert(focus_published == NativeWindows::focus_published && focus_window == NativeWindows::focus_window,
		"the focus prelude reads what NativeWindows publishes");
	// The window table the window preludes read, mapped into the guest and published in the served block.
	const size_t windows_size = NativeWindows::window_records * NativeWindows::window_record, table_size = windows_size + 8192 +
		NativeWindows::menu_area + NativeWindows::bitmap_records * NativeWindows::bitmap_record + 4096 + NativeWindows::dc_table_size + 4096 +
		NativeWindows::icon_slots * 8;
	const int table_file = memfd_create("raven-window-table", MFD_CLOEXEC);
	if (table_file < 0 || ftruncate(table_file, off_t(table_size)) != 0)
		throw std::runtime_error("cannot create the window table");
	auto *table = static_cast<uint8_t *>(mmap(nullptr, table_size, PROT_READ | PROT_WRITE, MAP_SHARED, table_file, 0));
	if (table == MAP_FAILED)
		throw std::runtime_error("cannot map the window table");
	const uint64_t table_guest = process.map_shared(table_file, table_size);
	close(table_file);
	windows.set_window_table(table);
	process.set_resume_hook([&windows] { windows.publish_windows(); });
	__atomic_store_n(&served_block[window_table / 8], table_guest, __ATOMIC_RELEASE);
	// The locale table follows the window table.
	const auto locales = locale_table();
	if (locales.size() > 8192)
		throw std::runtime_error("the locale table does not fit its page");
	std::memcpy(table + windows_size, locales.data(), locales.size());
	__atomic_store_n(&served_block[locale_pointer / 8], table_guest + windows_size, __ATOMIC_RELEASE);
	// The menu table follows the locale table.
	windows.set_menu_table(table + windows_size + 8192);
	__atomic_store_n(&served_block[menu_pointer / 8], table_guest + windows_size + 8192, __ATOMIC_RELEASE);
	// The bitmap table follows the menu table.
	const size_t bitmaps_at = windows_size + 8192 + NativeWindows::menu_area;
	windows.set_bitmap_table(table + bitmaps_at);
	__atomic_store_n(&served_block[bitmap_pointer / 8], table_guest + bitmaps_at, __ATOMIC_RELEASE);
	// The system metrics and colors follow the bitmap table.
	const size_t system_at = bitmaps_at + NativeWindows::bitmap_records * NativeWindows::bitmap_record;
	windows.set_system_table(table + system_at);
	__atomic_store_n(&served_block[system_pointer / 8], table_guest + system_at, __ATOMIC_RELEASE);
	// The device context attributes follow the system table.
	const size_t dcs_at = system_at + 4096;
	windows.set_dc_table(table + dcs_at);
	__atomic_store_n(&served_block[dc_pointer / 8], table_guest + dcs_at, __ATOMIC_RELEASE);
	// The deferred release log and the icon set follow the attribute table.
	const size_t deferred_at = dcs_at + NativeWindows::dc_table_size, icons_at = deferred_at + 4096;
	windows.set_deferred_tables(table + deferred_at, table + icons_at);
	__atomic_store_n(&served_block[deferred_pointer / 8], table_guest + deferred_at, __ATOMIC_RELEASE);
	__atomic_store_n(&served_block[icons_pointer / 8], table_guest + icons_at, __ATOMIC_RELEASE);
	process.set_served_calls(served_block, std::move(served_stubs), served_trap, served_wait, std::move(yield_traps), [&, served_names = std::move(served_names)](uint64_t stub) {
		const auto found = served_names.find(stub);
		if (found == served_names.end())
			throw std::runtime_error("a served call came from an unknown stub");
		const ServedThreadScope thread_scope(environment, process.serving_teb());
		api_in_progress = found->second.c_str();
		// Deferred releases wait for a stop of the guest: releasing a DIB section unmaps guest memory, which a running guest cannot have
		// done to it.
		windows.apply_dc_log();
		windows.screen_dc_use(found->second);
		const WindowCallScope window_scope(windows);
		const auto profile_start = RuntimeProfile::instance().enabled() ? std::chrono::steady_clock::now() : std::chrono::steady_clock::time_point{};
		const bool dispatched = api_registry.dispatch(process, environment, found->second)
#ifdef RAVEN_VULKAN
			|| vulkan.dispatch(found->second)
#endif
			;
		if (!dispatched)
			throw std::runtime_error("served call " + found->second + " has no handler");
		if (RuntimeProfile::instance().enabled() && profile_start != std::chrono::steady_clock::time_point{})
			RuntimeProfile::instance().api(found->second, std::chrono::steady_clock::now() - profile_start);
	}, std::move(queued_stubs));
	// The guest reads the performance counter itself once the time stamp counter is calibrated against it over 200 ms: the base is taken
	// when published, so the guest's count goes on from the runtime's, and the multiplier is written last.
	struct ClockCalibration {
		uint64_t counter = __rdtsc(), ticks = counter_ticks();
		bool published = false;
	};
	threads.add_service([served_block, calibration = std::make_shared<ClockCalibration>()] {
		if (calibration->published || counter_ticks() - calibration->ticks < 2000000)
			return;
		const uint64_t counter = __rdtsc(), ticks = counter_ticks();
		if (counter <= calibration->counter)
			return;
		uint64_t *published = served_block + clock_calibration / 8;
		published[0] = counter;
		published[1] = ticks;
		const unsigned __int128 multiplier = (static_cast<unsigned __int128>(ticks - calibration->ticks) << 32) / (counter - calibration->counter);
		__atomic_store_n(&published[2], static_cast<uint64_t>(multiplier), __ATOMIC_RELEASE);
		calibration->published = true;
	});
	// RAVEN_SAMPLE_GUEST=1 reports every five seconds where the guest spent its running time, by module and 256-byte block.
	if (std::getenv("RAVEN_SAMPLE_GUEST")) {
		auto samples = std::make_shared<std::map<uint64_t, uint32_t>>();
		auto reported = std::make_shared<std::chrono::steady_clock::time_point>(std::chrono::steady_clock::now());
		process.set_guest_sampler(std::chrono::milliseconds(2), [&modules, samples, reported](uint64_t rip) {
			++(*samples)[rip & ~uint64_t(255)];
			if (std::chrono::steady_clock::now() - *reported < std::chrono::seconds(5))
				return;
			*reported = std::chrono::steady_clock::now();
			std::vector<std::pair<uint32_t, uint64_t>> top;
			uint32_t total = 0;
			for (const auto &[where, count] : *samples) {
				top.emplace_back(count, where);
				total += count;
			}
			std::sort(top.rbegin(), top.rend());
			std::cerr << "samples: " << total << " in the last period\n";
			for (size_t index = 0; index < std::min<size_t>(top.size(), 15); ++index) {
				std::string place = "?";
				for (const auto &[module_name, module] : modules.all())
					if (top[index].second >= module->loaded.base() && top[index].second < module->loaded.base() + module->image.image_size) {
						std::ostringstream text;
						text << module_name << '+' << std::hex << top[index].second - module->loaded.base();
						place = text.str();
					}
				std::cerr << "  " << top[index].first << ' ' << place << '\n';
			}
			samples->clear();
		});
	}
	kernel_ptr=&kernel;
	NativeUnwinder unwinder(process, modules);
	register_exception_api(api_registry, kernel, unwinder);
	register_system_api(api_registry, kernel);
	register_process_api(api_registry, kernel);
	register_security_api(api_registry, kernel);
	register_child_process_api(api_registry, kernel);
	register_winsock_api(api_registry, kernel);
#ifdef RAVEN_OPENSSL
	register_wininet_api(api_registry, kernel);
#endif
	register_host_api(api_registry, kernel);
	register_pipe_api(api_registry, kernel);
	register_job_api(api_registry, kernel);
	register_wave_api(api_registry, kernel);
	register_mmio_api(api_registry, kernel);
	register_crypt32_api(api_registry, kernel);
	register_bcrypt_api(api_registry, kernel);
	register_process_info_api(api_registry, kernel);
	register_font_service(api_registry, kernel);
	register_shader_service(api_registry, kernel);
	register_canvas_service(api_registry, kernel);
	register_sync_api(api_registry, kernel);
	register_thread_api(api_registry, kernel);
	NativeObjectAPI::register_served(api_registry, kernel.objects);
	register_text_api(api_registry, kernel);
	register_console_api(api_registry, kernel);
	register_memory_api(api_registry, kernel);
	register_file_api(api_registry, kernel);
	register_shlwapi_api(api_registry, kernel);
	register_shell_api(api_registry, kernel);
	register_platform_api(api_registry, kernel);
	register_actctx_api(api_registry, kernel);
	register_version_api(api_registry, kernel);
#ifdef RAVEN_OPENGL
	if (opengl) opengl->register_api(api_registry, threads);
#endif
	windows.register_api(desktop_api);
	desktop.register_gdi_api(desktop_api);
	desktop.register_text_api(desktop_api);
	desktop.register_image_api(desktop_api);
	NativeRegistry hive(prefix.registry_file());
	apply_registry_settings(hive);
	paths.set_package_roots([&hive] { return virtual_package_roots(hive); });
	register_registry_api(api_registry, kernel, hive);
	register_service_api(api_registry, kernel, hive);
	NativeProfile profile(process, environment, prefix);
	register_profile_api(api_registry, profile);
	register_ansi_adapters(api_registry);
	register_legacy_file_api(api_registry);
	std::vector<const PEModule *> attached;
	attached.reserve(order.size());
	const auto notify_tls = [&](const PEModule &module, uint64_t reason) {
		const uint64_t arguments[] = {module.loaded.base(), reason, 0};
		for (const auto address : tls.callbacks(module)) {
			const auto result = invoke(address, arguments);
			if (result.stop != NativeStop::returned)
				return result;
		}
		return NativeResult{NativeStop::returned, 0, 0, 0};
	};
	std::set<const PEModule *> detaching;
	const auto detach = [&](const PEModule &module, uint64_t reserved) {
		detaching.insert(&module);
		const auto tls_result = notify_tls(module, 0);
		if (tls_result.stop != NativeStop::returned)
			return tls_result;
		const uint64_t arguments[] = {module.loaded.base(), 0, reserved};
		if ((module.image.characteristics & 0x2000) && module.image.entry && !module.image.il_only()) {
			const auto result = invoke(module.loaded.base() + module.image.entry, arguments);
			if (result.stop != NativeStop::returned)
				return result;
		}
		detaching.erase(&module);
		return NativeResult{NativeStop::returned, 0, 0, 0};
	};
	std::set<const PEModule *> pinned;
	size_t data_serial = 0;
	std::set<const PEModule *> apart_modules;
	std::map<const PEModule *, uint64_t> references;
	for (const auto &[name, module] : modules.all()) {
		pinned.insert(module.get());
		references.emplace(module.get(), 0);
	}
	bool loading = false;
	// The thread that holds the loader: another thread that loads or frees a library meanwhile waits for it, as it would for the
	// loader lock.
	uint32_t loading_thread = 0;
	const auto await_loader = [&] {
		if (!loading || loading_thread == threads.current_id())
			return;
		HostWait waiting;
		threads.block([&] { return !loading; }, std::nullopt);
	};
	struct LoadFailure { uint32_t error; };
	const auto checked = [](NativeResult result) {
		if (result.stop != NativeStop::returned)
			throw result;
	};
	// Libraries loaded by explicit path keep their host file under the module identity (lower-case file name).
	std::map<std::string, std::filesystem::path> explicit_files;
	kernel.reference_module = [&](uint64_t base, bool pin) {
		const auto found = std::find_if(references.begin(), references.end(), [&](const auto &item) { return item.first->loaded.base() == base; });
		if (found == references.end())
			return;
		if (pin)
			pinned.insert(found->first);
		else if (found->second != UINT64_MAX)
			++found->second;
	};
	// A library named by its path is in the process when the module of that file name came from that file. The libraries Raven
	// serves itself live in the system folder, where GetModuleFileName reports them.
	module_api.set_path_lookup([&](const std::string &name) -> uint64_t {
		const auto slash = name.find_last_of("/\\");
		auto identity = name.substr(slash == name.npos ? 0 : slash + 1);
		for (auto &character : identity)
			if (character >= 'A' && character <= 'Z')
				character = static_cast<char>(character + ('a' - 'A'));
		if (identity.find('.') == identity.npos)
			identity += ".dll";
		const auto found = modules.all().find(identity);
		if (found == modules.all().end())
			return 0;
		const auto requested = paths.resolve(from_utf8(name));
		if (!requested)
			return 0;
		std::error_code error;
		const auto explicit_file = explicit_files.find(identity);
		const auto file = explicit_file != explicit_files.end() ? explicit_file->second : found->second->file;
		if (!file.empty())
			return std::filesystem::equivalent(requested->host, file, error) ? found->second->loaded.base() : 0;
		const auto system = paths.resolve(u"C:\\Windows\\System32\\" + from_utf8(identity));
		return system && requested->host == system->host ? found->second->loaded.base() : 0;
	});
	kernel.module_named = [&](uint64_t address, bool wide) { return module_api.module_handle(address, wide); };
	module_api.set_loader([&](std::string name) -> uint64_t {
		await_loader();
		// DONT_RESOLVE_DLL_REFERENCES maps the library alone: its imports are not followed and it is not started, so even an image of
		// managed code alone loads, as the runtime of .NET 2.0 loads its class library. A library loaded as a data file or for its
		// resources is mapped the same way, whatever its width and even when it is a program, and stays out of the loader's list.
		const uint32_t flags = module_api.load_flags();
		const bool as_data = flags & 0x62;
		const bool unresolved = (flags & 1) || as_data;
		if (name.empty()) {
			environment.set_last_error(126);
			return 0;
		}
		for (auto &character : name)
			if (static_cast<unsigned char>(character) < 32) {
				environment.set_last_error(87);
				return 0;
			}
		if (name.find_first_of("/\\:") != name.npos) {
			// A path names its module by file name; Windows system libraries are served natively wherever the path points.
			const auto slash = name.find_last_of("/\\");
			auto identity = name.substr(slash == name.npos ? 0 : slash + 1);
			for (auto &character : identity)
				if (character >= 'A' && character <= 'Z')
					character = static_cast<char>(character + ('a' - 'A'));
			if (identity.find('.') == identity.npos)
				identity += ".dll";
			// A library named by its path in the system directory is looked for as by its name, as Windows finds its own there.
			auto folder = slash == name.npos ? std::string() : name.substr(0, slash);
			for (auto &character : folder) {
				if (character == '/')
					character = '\\';
				else if (character >= 'A' && character <= 'Z')
					character = static_cast<char>(character + ('a' - 'A'));
			}
			const bool system_folder = folder == "c:\\windows\\system32" || folder == "c:\\windows\\syswow64";
			if (system_folder && modules.all().contains("system32-" + identity)) {
				name = "system32-" + identity;
			} else {
				if (!system_folder && (program_may_replace(identity) || !modules.all().contains(identity)) && apiset_host(identity).empty()) {
					const auto resolved = paths.resolve(from_utf8(name));
					if (!resolved || !resolved->exists || !std::filesystem::is_regular_file(resolved->host)) {
						environment.set_last_error(126);
						return 0;
					}
					// The file named now is the one to load, even where a library of the same name came from another folder before.
					explicit_files.insert_or_assign(identity, resolved->host);
				}
				name = identity;
			}
		}
		for (auto &character : name) {
			if (static_cast<unsigned char>(character) > 127) {
				environment.set_last_error(120);
				return 0;
			}
			if (character >= 'A' && character <= 'Z')
				character = static_cast<char>(character + ('a' - 'A'));
		}
		if (name.back() == '.')
			name.pop_back();
		else if (name.find('.') == std::string::npos)
			name += ".dll";
		if (const auto host = apiset_host(name); !host.empty())
			name = host;
		if ((flags & 0x1f00) == 0x800 && modules.all().contains("system32-" + name))
			name = "system32-" + name;
		const auto existing = modules.all().find(name);
		// Other threads waited above, so a load already under way is this thread's own: a library starting up loads another, as
		// Windows lets it. A library that is in the process already, even one the outer load has not started yet, is handed back.
		const bool nested = loading;
		if (nested && existing != modules.all().end() && references.contains(existing->second.get())) {
			++references.at(existing->second.get());
			return existing->second->loaded.base();
		}
		if (existing != modules.all().end()) {
			auto &count = references.at(existing->second.get());
			if (count == UINT64_MAX)
				throw std::runtime_error("native DLL reference count overflow");
			++count;
			return existing->second->loaded.base();
		}
		struct Staged { PEModule *module; bool mapped = false; bool listed = false; bool tls = false; bool attached = false; };
		std::vector<Staged> staged;
		bool guest_started = false;
		loading = true;
		loading_thread = threads.current_id();
		const auto rollback = [&] {
			for (auto item = attached.rbegin(); item != attached.rend(); ++item)
				if (std::any_of(staged.begin(), staged.end(), [&](const auto &s) { return s.module == *item && s.attached; }))
					checked(detach(**item, 0));
			std::erase_if(attached, [&](const auto *item) {
				return std::any_of(staged.begin(), staged.end(), [&](const auto &s) { return s.module == item; });
			});
			for (auto item = staged.rbegin(); item != staged.rend(); ++item) {
				if (item->tls)
					tls.remove(*item->module);
				if (item->listed)
					loader_data.remove(*item->module);
				if (item->mapped)
					{ memory.remove_image(item->module->loaded.base()); process.unmap_image(item->module->loaded.base()); }
				references.erase(item->module);
				modules.remove(*item->module);
			}
		};
		const auto acquire = [&](std::string identity) -> PEModule & {
			for (auto &character : identity)
				if (character >= 'A' && character <= 'Z')
					character = static_cast<char>(character + ('a' - 'A'));
			if (identity.find('.') == std::string::npos)
				identity += ".dll";
			// An API set name stands for the library that implements it, as it does for the libraries loaded at startup.
			if (const auto host = apiset_host(identity); !host.empty()) {
				if (const auto present = modules.all().find(host); present != modules.all().end()) {
					modules.add_alias(identity, host);
					return *present->second;
				}
				identity = host;
			}
			if (const auto found = modules.all().find(identity); found != modules.all().end())
				return *found->second;
			if (modules.all().size() >= 10000)
				throw std::runtime_error("native DLL graph exceeds module limit");
			if (!source || identity.find_first_of("/\\:") != std::string::npos) {
				if (std::getenv("RAVEN_TRACE_API"))
					std::cerr << "raven: library not loadable by path: " << identity << '\n';
				throw LoadFailure{126};
			}
			std::optional<ModuleBytes> bytes;
			std::filesystem::path origin;
			if (const auto explicit_file = explicit_files.find(identity); explicit_file != explicit_files.end()) {
				bytes = ModuleBytes::map(explicit_file->second);
				origin = explicit_file->second;
			} else {
				const auto system_names = system_library_names();
				const bool system = std::find(system_names.begin(), system_names.end(), identity) != system_names.end();
				if ((!system || (has_launch && program_may_replace(identity))) && !activation_contexts().library_folder(identity)) {
					if (const auto found = paths.find_library(launch->image_path, from_utf8(identity), true, flags)) {
						bool system_copy = false;
						if (system) {
							auto dos_path = to_utf8(paths.dos(found->host));
							for (auto &character : dos_path)
								if (character >= 'A' && character <= 'Z')
									character = static_cast<char>(character + ('a' - 'A'));
							system_copy = dos_path.starts_with("c:\\windows\\system32\\") || dos_path.starts_with("c:\\windows\\syswow64\\");
						}
						if (!system_copy) {
							bytes = ModuleBytes::map(found->host);
							origin = found->host;
						}
					// A search of the system directory also finds what the runtime provides as part of it, DirectWrite among them.
					} else if ((flags & 0x1f00) && !(flags & 0x800) && !system) {
						throw LoadFailure{126};
					}
				}
				if (!bytes && !(system && (flags & 0x1f00)))
					if (auto read = source(identity)) bytes.emplace(std::move(*read));
				if (!bytes && system) {
					if (const auto fallback = modules.all().find("system32-" + identity); fallback != modules.all().end())
						return *fallback->second;
				}
			}
			// A library loaded by path finds its dependencies in its own directory, as LOAD_WITH_ALTERED_SEARCH_PATH and a DLL directory
			// set to that folder do on Windows; programs that unpack themselves to a temporary folder rely on it.
			for (auto file = explicit_files.begin(); !bytes && file != explicit_files.end(); ++file) {
				std::error_code error;
				for (const auto &entry : std::filesystem::directory_iterator(file->second.parent_path(), error)) {
					auto candidate = entry.path().filename().string();
					for (auto &character : candidate)
						if (character >= 'A' && character <= 'Z')
							character = static_cast<char>(character + ('a' - 'A'));
					if (candidate != identity || !entry.is_regular_file(error))
						continue;
					bytes = ModuleBytes::map(entry.path());
					origin = entry.path();
					explicit_files.emplace(identity, entry.path());
					break;
				}
			}
			if (!bytes) {
				if (std::getenv("RAVEN_TRACE_API"))
					std::cerr << "raven: library file not found: " << identity << '\n';
				throw LoadFailure{126};
			}
			// A file that is no program image at all, a type library tried as a resource module first, is ERROR_BAD_EXE_FORMAT.
			std::optional<PEImage> parsed;
			try {
				parsed.emplace(*bytes);
			} catch (const std::runtime_error &) {
				throw LoadFailure{193};
			}
			const bool only_mapped = unresolved && staged.empty();
			// 64-bit Windows loads a library of managed code alone built for any CPU in its 64-bit form: the header is widened as for such
			// a program, and the runtime that asked for it runs its code.
			bool widened = false;
			if (!parsed->is_64 && parsed->il_only() && !only_mapped && !as_data) {
				const std::span<const uint8_t> view = *bytes;
				std::vector<uint8_t> copy(view.begin(), view.end());
				if (widen_il_only_image(copy)) {
					bytes.emplace(std::move(copy));
					parsed.emplace(*bytes);
					widened = true;
				}
			}
			// Reject unsupported initialization before publishing an image.
			const PEImage &image = *parsed;
			// An image of the other width maps only as data, or when it holds managed code alone, as a 64-bit process maps the 32-bit form
			// of a class library for the runtime; either stays apart from the libraries that run.
			const bool apart = only_mapped && (as_data || (!image.is_64 && image.il_only()));
			if (!image.is_64 && !apart)
				throw LoadFailure{193};
			// An image with no entry point maps and binds as a library even when it is not one, as the runtime loads a precompiled
			// assembly built as a program: there is nothing of it to run.
			const bool inert = image.is_64 && (!image.entry || widened);
			if (!(image.characteristics & 0x2000) && !only_mapped && !inert)
				throw LoadFailure{120};
			if ((image.directories[13].address || image.directories[13].size) && !only_mapped)
				for (const auto &descriptor : image.delay_imports())
					if (!(image.file_span(descriptor.descriptor_address, 4)[0] & 1))
						throw LoadFailure{120};
			// Mixed managed and native code starts through its entry point like any library, which hands it to the runtime; an image
			// of managed code alone is the runtime's to map, unless it is only mapped.
			if (image.il_only() && !only_mapped && !inert)
				throw LoadFailure{120};
			staged.reserve(staged.size() + 1);
			// A library read as data takes a name of its own, so that nothing loaded later resolves imports through it.
			const auto available = [&](uint64_t base, uint64_t size) { return process.memory_available(base, size); };
			auto &module = apart ? modules.add_data(identity + "#data" + std::to_string(++data_serial), std::move(*bytes), available) :
				modules.add(identity, std::move(*bytes), available);
			if (apart)
				apart_modules.insert(&module);
			module.file = origin;
			staged.push_back({&module});
			references.emplace(&module, 0);
			return module;
		};
		std::map<const PEModule *, uint64_t> entry_contexts;
		try {
			auto &root = acquire(name);
			if (unresolved && staged.size() == 1 && staged.front().module == &root)
				root.imports.clear();
			// Follow only activated import forwarders, not every optional export. Every missing export is reported before the load fails.
			bool missing = false;
			for (size_t index = 0; index < staged.size(); ++index) {
				// A library's own manifest names the side-by-side assemblies its imports come from, the C runtime of its compiler most often.
				// Its context is the one in effect while it and the libraries it brings in start, which the C runtime checks it was found by.
				const auto own = activation_contexts().module_manifest(staged[index].module->image);
				uint64_t context = own ? activation_contexts().create({*own, {}}) : 0;
				if (const auto inherited = entry_contexts.find(staged[index].module); !context && inherited != entry_contexts.end())
					context = inherited->second;
				if (context)
					entry_contexts[staged[index].module] = context;
				for (const auto &symbol : staged[index].module->imports) {
					if (own)
						if (const auto folder = activation_contexts().assembly_folder(*own, symbol.module)) {
							auto wanted = symbol.module;
							for (auto &character : wanted)
								if (character >= 'A' && character <= 'Z')
									character = static_cast<char>(character + ('a' - 'A'));
							std::error_code error;
							if (!modules.all().contains(wanted) && !explicit_files.contains(wanted))
								for (const auto &entry : std::filesystem::directory_iterator(*folder, error)) {
									auto candidate = entry.path().filename().string();
									for (auto &character : candidate)
										if (character >= 'A' && character <= 'Z')
											character = static_cast<char>(character + ('a' - 'A'));
									if (candidate == wanted && entry.is_regular_file(error)) {
										explicit_files.emplace(wanted, entry.path());
										break;
									}
								}
						}
					auto &dependency = acquire(symbol.module);
					if (context)
						entry_contexts.emplace(&dependency, context);
					for (;;) {
						try {
							modules.resolve(symbol);
							break;
						} catch (const std::runtime_error &error) {
							const std::string_view message = error.what();
							if (message.starts_with("missing PE module: "))
								acquire(std::string(message.substr(19)));
							else if (message.starts_with("missing PE export: ")) {
								if (std::getenv("RAVEN_TRACE_API") || std::getenv("RAVEN_TRACE_FAIL"))
									std::cerr << "raven: cannot load " << name << ": " << staged[index].module->name << " imports " << message << '\n';
								missing = true;
								break;
							}
							else
								throw;
						}
					}
				}
			}
			if (missing)
				throw LoadFailure{127};
			modules.bind_imports();
			const auto dynamic_order = initialization_order(modules, entry);
			for (auto &item : staged) {
				process.map_image(item.module->loaded);
				register_image(memory, *item.module);
				item.mapped = true;
				if (apart_modules.contains(item.module))
					continue;
				loader_data.add(*item.module);
				item.listed = true;
				tls.add(*item.module);
				item.tls = true;
			}
			attached.reserve(attached.size() + staged.size());
			for (const auto *module : dynamic_order) {
				const auto found = std::find_if(staged.begin(), staged.end(), [&](const auto &s) { return s.module == module; });
				if (found == staged.end())
					continue;
				guest_started = true;
				// A library only mapped is never told it is attached, nor later that it is detached.
				if (unresolved && module == &root)
					continue;
				checked(notify_tls(*module, 1));
				// Managed code alone has no native entry to start: its entry is the runtime's.
				if (module->image.entry && !module->image.il_only()) {
					const uint64_t arguments[] = {module->loaded.base(), 1, 0};
					const auto context = entry_contexts.find(module);
					const auto thread = threads.current_id();
					const auto cookie = context == entry_contexts.end() ? 0 : activation_contexts().activate(thread, context->second);
					const auto result = invoke(module->loaded.base() + module->image.entry, arguments);
					if (cookie)
						activation_contexts().deactivate(thread, cookie);
					checked(result);
					if (!static_cast<uint32_t>(result.value)) {
						checked(detach(*module, 0));
						throw LoadFailure{1114};
					}
				}
				found->attached = true;
				attached.push_back(module);
				loader_data.initialized(*module);
			}
			++references.at(&root);
			loading = nested;
			return root.loaded.base();
		} catch (const NativeResult &) {
			// A fault or timeout is terminal; never execute extra guest cleanup.
			throw;
		} catch (const LoadFailure &failure) {
			rollback();
			loading = nested;
			environment.set_last_error(failure.error);
			return 0;
		} catch (...) {
			if (!guest_started)
				rollback();
			loading = nested;
			throw;
		}
	}, [&](uint64_t handle) {
		await_loader();
		const auto found = std::find_if(references.begin(), references.end(), [&](const auto &item) { return item.first->loaded.base() == handle; });
		if (found == references.end() || !found->second) {
			environment.set_last_error(found == references.end() ? 126 : 120);
			return false;
		}
		if (loading) {
			environment.set_last_error(120);
			return false;
		}
		--found->second;
		std::set<const PEModule *> reachable = pinned;
		std::vector<const PEModule *> pending;
		for (const auto &[module, count] : references)
			if (count || pinned.contains(module)) {
				reachable.insert(module);
				pending.push_back(module);
			}
		while (!pending.empty()) {
			const auto *module = pending.back();
			pending.pop_back();
			for (const auto &symbol : module->imports)
				for (const auto *dependency : modules.resolution_path(symbol))
					if (reachable.insert(dependency).second)
						pending.push_back(dependency);
		}
		std::vector<const PEModule *> released;
		loading = true;
		loading_thread = threads.current_id();
		for (auto item = attached.rbegin(); item != attached.rend(); ++item)
			if (!reachable.contains(*item)) {
				checked(detach(**item, 0));
				released.push_back(*item);
			}
		std::erase_if(attached, [&](const auto *item) { return !reachable.contains(item); });
		for (const auto *module : released) {
			tls.remove(*module);
			loader_data.remove(*module);
			memory.remove_image(module->loaded.base());
			process.unmap_image(module->loaded.base());
			references.erase(module);
			modules.remove(*module);
		}
		loading = false;
		return true;
	});
	// Thread notifications reach the executable's TLS callbacks first, then every loaded module in load order (reverse on exit).
	threads.set_notifier([&](uint32_t reason) {
		const auto notify = [&](const PEModule &module) {
			if (const auto stopped = notify_tls(module, reason); stopped.stop != NativeStop::returned)
				throw stopped;
			if ((module.image.characteristics & 0x2000) && module.image.entry && !module.runtime_api && !module.image.il_only()) {
				const uint64_t arguments[] = {module.loaded.base(), reason, 0};
				const auto result = invoke(module.loaded.base() + module.image.entry, arguments);
				if (result.stop != NativeStop::returned)
					throw result;
			}
		};
		// An entry point may load or free libraries, so the walk goes over a copy and skips a module that is gone by its turn.
		const auto modules_now = attached;
		const auto still_attached = [&](const PEModule *module) { return std::find(attached.begin(), attached.end(), module) != attached.end(); };
		if (reason == 2) {
			notify(entry);
			for (const auto *module : modules_now)
				if (module != &entry && still_attached(module))
					notify(*module);
		} else {
			for (auto module = modules_now.rbegin(); module != modules_now.rend(); ++module)
				if (*module != &entry && still_attached(*module))
					notify(**module);
			notify(entry);
		}
	});
	bool entry_tls_ready=false,cleanup_started=false;
	const auto exit_result = [&](ProcessExit request) {
		threads.stop_time_slicing();
		// The other threads end before the libraries are told the process detaches, so none of them runs on what detaching frees.
		threads.terminate_others(request.code);
		try {
			if (!cleanup_started && !request.terminated) {
				kernel_ptr->shutdown_in_progress=true;
				// Detaching counts as a load of this thread's own: a library that frees or loads another in its detach goes on at once
				// instead of waiting for a load no other thread will finish.
				cleanup_started=true; loading=true; loading_thread=threads.current_id();
				if (entry_tls_ready) {
					const auto stopped=notify_tls(entry,0);
					if (stopped.stop!=NativeStop::returned) { windows.shutdown(); return stopped; }
				}
				for (auto module=attached.rbegin();module!=attached.rend();++module) {
					if (detaching.contains(*module)) continue;
					const auto stopped=detach(**module,environment.peb());
					if (stopped.stop!=NativeStop::returned) { windows.shutdown(); return stopped; }
				}
			}
		} catch (const ProcessExit &repeated) { request=repeated; }
		catch (const NativeResult &stopped) { windows.shutdown(); return stopped; }
		windows.shutdown();
		return NativeResult{NativeStop::exited,request.code,request.instruction,0};
	};
	try {
		windows.set_call(invoke);
		desktop.set_call(invoke);
		wait_suspended_process(launch->suspended_fd, kernel_objects);
		heap.initialize(invoke);
		for (const auto *module : order) {
			if (module == &entry)
				continue;
			const auto tls_result = notify_tls(*module, 1);
			if (tls_result.stop != NativeStop::returned)
				return tls_result;
			if (!(module->image.characteristics & 0x2000) || !module->image.entry || module->image.il_only()) {
				attached.push_back(module);
				continue;
			}
			const uint64_t arguments[] = {module->loaded.base(), 1, environment.peb()};
			const auto result = invoke(module->loaded.base() + module->image.entry, arguments);
			if (result.stop != NativeStop::returned)
				return result;
			if (static_cast<uint32_t>(result.value) == 0) {
				if (detach(*module, 0).stop != NativeStop::returned)
					throw std::runtime_error("native DLL failure cleanup did not return: " + module->name);
				for (auto previous = attached.rbegin(); previous != attached.rend(); ++previous)
					if (detach(**previous, 0).stop != NativeStop::returned)
						throw std::runtime_error("native DLL rollback did not return: " + (*previous)->name);
				throw std::runtime_error("DLL_PROCESS_ATTACH failed: " + module->name);
			}
			attached.push_back(module);
		}
		const auto tls_result = notify_tls(entry, 1);
		if (tls_result.stop != NativeStop::returned)
			return tls_result;
		entry_tls_ready=true;
		const auto result = invoke(program_start(modules, entry), {});
		if (result.stop != NativeStop::returned)
			return result;
		cleanup_started=true; loading=true;
		kernel_ptr->shutdown_in_progress=true;
		const auto tls_detach = notify_tls(entry, 0);
		if (tls_detach.stop != NativeStop::returned)
			return tls_detach;
		for (auto module = attached.rbegin(); module != attached.rend(); ++module) {
			const auto stopped = detach(**module, environment.peb());
			if (stopped.stop != NativeStop::returned)
				return stopped;
		}
		windows.shutdown();
		return result;
	} catch (const ProcessExit &request) {
		return exit_result(request);
	} catch (const NativeResult &stopped) {
		return stopped;
	}
}

}