Helix C++引擎

使用教程和更新日志 -> Helix C++ 跨平台内存安全扩展

Github开源，MIT协议，但要求指出原出处。点我去下载源代码。

插件下载和头文件。为了保证代码规范，所有结构或类定义只能放头文件里，不准备支持.cpp中的结构或类的扫描。

使用方法，把头文件放到项目里。假设你有一个Shared项目，Helix.Runtime应该和Shared文件夹在同一级。

 

 

 

请务必把语法改成C++ 20，如图

 

1. Exe

ComplexTest.h

#pragma once
#include <iostream> 
#include <string>
#include <vector>
#include <stddef.h>
#include <iomanip>
#if defined(_KERNEL_MODE)
#include <ntifs.h> // Helix Auto-Wrapped
#endif
#if !defined(_KERNEL_MODE)
#include <Windows.h> // Helix Auto-Wrapped
#endif
#if !defined(_KERNEL_MODE)
#include <TlHelp32.h> // Helix Auto-Wrapped
#endif
#if !defined(_KERNEL_MODE)
#include <Psapi.h> // Helix Auto-Wrapped
#endif
#if !defined(_KERNEL_MODE)
#include <winternl.h> // Helix Auto-Wrapped
#endif

#include "Helix.h"  

using EventCallback = void (*)(int, const char*);

#pragma pack(push, 1)
struct SensorData {
public:
    short sensorId;
    Offset(2);
    union {
        float floatVal;
        int intVal;
    };
    char status;

    unsigned char flagA : 1;
    unsigned char flagB : 3;
    unsigned char flagC : 4;
};

enum class ConnectState : uint8_t { // 明确指定为 1 个字节
    Disconnected = 0,
    Connected = 1
};

class ComplexEntity {
public:
    ConnectState state; 
    int entityId;
    Offset(4);
    SensorData sensor;

    static ComplexEntity* staticBoss;
    Extern void* externalResource;
    ComplexEntity* childNode;

    Extern EventCallback onEventTriggered;

    ComplexEntity() = default;

    ComplexEntity(int id) : entityId(id) {
        std::cout << "[Constructor] ComplexEntity ID " << entityId << " created via parameterized constructor.\n";
    }

    ~ComplexEntity() {
        std::cout << "[Destructor] ComplexEntity ID " << entityId << " reclaimed.\n";
    }

    void ProcessData(int multiplier) {
        sensor.intVal *= multiplier;
        if (onEventTriggered) {
            onEventTriggered(entityId, "Data Processed successfully via callback!");
        }
    }
};

struct NestedPayload {
    void* rawPointers[3];
    ComplexEntity* entityList[2];
    int matrix[4];
};

class AdvancedArrayNode {
public:
    int nodeId;
    Offset(4);
    NestedPayload payload;

    AdvancedArrayNode() = default;

    AdvancedArrayNode(int id) : nodeId(id) {
        memset(&payload, 0, sizeof(payload));
        std::cout << "[Constructor] AdvancedArrayNode ID " << nodeId << " created.\n";
    }

    ~AdvancedArrayNode() {
        std::cout << "[Destructor] AdvancedArrayNode ID " << nodeId << " reclaimed.\n";
    }

    void MutateArray(int multiplier) {
        for (int i = 0; i < 4; i++) {
            payload.matrix[i] *= multiplier;
        }
    }
};
#pragma pack(pop)

class IWorker {
public:
    virtual ~IWorker() = default;
    virtual void ExecuteTask() = 0;
};

class BaseWorker : public IWorker {
public:
    int baseId;

    virtual void ExecuteTask() override {
        std::cout << "[BaseWorker] Task executed by ID " << baseId << ".\n";
    }

    virtual void Upgrade() {
        baseId += 1;
    }
};

class FinalWorker final : public BaseWorker {
public:
    int powerLevel;

    void ExecuteTask() override final {
        std::cout << "[FinalWorker] Final task executed by ID " << baseId << " with power " << powerLevel << ".\n";
    }

    void Upgrade() override {
        powerLevel += 10;
    }

    ~FinalWorker() {
        std::cout << "[Destructor] FinalWorker ID " << baseId << " reclaimed.\n";
    }
};

class NativeResourceConfig {
public:
    DWORD targetPid;

    CLIENT_ID clientId;
    UNICODE_STRING imagePath;

    ~NativeResourceConfig() {
        std::cout << "[Destructor] NativeResourceConfig PID " << targetPid << " reclaimed.\n";
    }

    void InitNativeData() {
        clientId.UniqueProcess = (HANDLE)(ULONG_PTR)targetPid;
        clientId.UniqueThread = (HANDLE)0x1337;

        imagePath.Length = 10;
        imagePath.MaximumLength = 12;
        imagePath.Buffer = (PWSTR)L"Helix";
    }
};

inline void AssignGlobalPointer(Extern int** outPtr) {
    auto newInt = New<int>(9999);
    *outPtr = &newInt;
}

Vmp inline void VmpGlobalFunction(const char* message) {
    std::cout << "  -> [Vmp Global] Executing protected global logic...\n";
    std::cout << "  -> Message: " << message << "\n";
}

class SecurityManager {
public:
    int secretCode = 0;

    Vmp static bool VerifyLicense(const std::string& key) {
        std::cout << "  -> [Vmp Static] Verifying license key...\n";
        if (key == "SECRET-KEY") {
            std::cout << "[Vmp] License Verified Successfully!\n";
            return true;
        }
        return false;
    }

    Vmp void ExecutePayload() {
        secretCode ^= 0x55;
        std::cout << "  -> [Vmp Member] Payload executed. Secret code mutated to: " << secretCode << "\n";
    }

    Vmp int ComplexVmpLogic(int multiplier) {
        int tempCode = 10;
        this->secretCode += (tempCode * multiplier);

        if (this->secretCode > 10) {
            tempCode = 999;
        }

        ExecutePayload();

        return this->secretCode + tempCode;
    }
};

extern ComplexEntity* g_VmpGlobalNode;

class VmpAdvancedTester {
public:
    static ComplexEntity* staticNode;
    Extern ComplexEntity* externDataNode;

    Vmp void RecursiveAllocTest(int depth, Extern ComplexEntity** outParam) {
        if (depth <= 0) return;

        for (int i = 0; i < 2; i++) {
            auto node = New<ComplexEntity>(depth * 100 + i);

            if (depth == 1 && i == 1 && outParam != nullptr) {
                *outParam = &node;
            }
        }

        RecursiveAllocTest(depth - 1, outParam);
    }

    Vmp void LoopAllocAndAssign() {
        for (int i = 1; i <= 5; i++) {
            auto node = New<ComplexEntity>(i * 1000);

            if (i == 2) {
                g_VmpGlobalNode = &node;
            }
            else if (i == 3) {
                staticNode = &node;
            }
            else if (i == 5) {
                externDataNode = &node;
            }
        }
    }
};

struct TestAnyPayload {
    int magicCode;
    float version;
    bool isActivated;

    // 供动态调用的测试方法
    void PrintStatus() {
#ifdef _KERNEL_MODE
        DbgPrint("      -> [TestAnyPayload::PrintStatus] Magic: 0x%X, Version: %.2f, Activated: %s\n",
            magicCode, version, isActivated ? "TRUE" : "FALSE");
#else
        std::cout << "      -> [TestAnyPayload::PrintStatus] Magic: 0x"
            << std::hex << std::uppercase << magicCode << std::dec
            << ", Version: " << std::fixed << std::setprecision(2) << version
            << ", Activated: " << (isActivated ? "TRUE" : "FALSE") << "\n";
#endif
    }

    ~TestAnyPayload()
    {
#ifdef _KERNEL_MODE
        DbgPrint("[Destructor] magicCode %d reclaimed.\n", magicCode);
#else
        std::cout << "[Destructor] magicCode " << std::dec << magicCode << " reclaimed.\n";
#endif
    }
};

// 引擎底层已实现 C++ 名称修饰自适应，无需外包 extern "C"
API("ntdll.dll") unsigned long NTAPI RtlRandomEx(unsigned long* Seed);
API("ws2_32.dll") int __stdcall _115(unsigned short wVersionRequested, void* lpWSAData);
API("ntdll.dll") NTSTATUS NTAPI _15(void* Param1);

// --- 定义测试结构 ---
struct Vector2D {
    float X;
    float Y;
    void Scale(float factor) {
        X *= factor;
        Y *= factor;
    }
};

struct PlayerStats {
    int Health;
    int Mana;
    int Heal(int amount) {
        Health += amount;
        return Health;
    }
};

class ControlBase {
public:
    int controlId = 0;
    virtual ~ControlBase() = default;
    virtual const char* GetControlType() { return "ControlBase"; }
};

// 具体的按钮控件
class ButtonControl : public ControlBase {
public:
    int clickCount = 0;

    const char* GetControlType() override { return "ButtonControl"; }

    // 模拟事件回调：接收发起者指针与参数
    bool OnClick(ControlBase* sender, int arg) {
        if (sender) {
            clickCount += arg;
            return true;
        }
        return false;
    }
};

// 具体的面板控件
class PanelControl : public ControlBase {
public:
    int messageCount = 0;

    const char* GetControlType() override { return "PanelControl"; }

    // 目标 Invoke 函数：参数 (ControlBase*, const char*)
    bool OnMessage(ControlBase* sender, const char* msg) {
        if (sender && msg) {
            std::cout << "    [Panel] Received message: " << msg << " from sender ID: " << sender->controlId << "\n";
            messageCount++;
            return true;
        }
        return false;
    }
};

// 全局线程局部控件栈
inline static thread_local std::vector<ControlBase*> ControlStack;

// --- 专用于刺探 Reflec 参数匹配机制的测试模型 ---
class ArgProbeState {
public:
    // 测试 A：完全对应当前工程的签名
    bool MethodA(ControlBase* sender, const char* prop) {
        std::cout << "    -> MethodA (ControlBase*, const char*) Invoked!\n";
        return true;
    }

    // 测试 B：参数 2 改为 std::string
    bool MethodB(ControlBase* sender, std::string prop) {
        std::cout << "    -> MethodB (ControlBase*, std::string) Invoked!\n";
        return true;
    }

    // 测试 C：参数 1 退化为 void*
    bool MethodC(void* sender, const char* prop) {
        std::cout << "    -> MethodC (void*, const char*) Invoked!\n";
        return true;
    }

    // 测试 D：只传 1 个参数 const char*
    bool MethodD(const char* prop) {
        std::cout << "    -> MethodD (const char*) Invoked!\n";
        return true;
    }
};

// [类型 A]：普通多态基类（带普通虚函数）
class StandardVirtualBase {
public:
    virtual ~StandardVirtualBase() = default;
    virtual const char* GetName() { return "StandardVirtualBase"; }
};

// [类型 B]：纯虚基类（Abstract Class）
class PureVirtualBase {
public:
    virtual ~PureVirtualBase() = default;
    virtual const char* GetName() = 0; // 纯虚函数
};

// 用于实例化纯虚基类的派生类
class PureVirtualDerived : public PureVirtualBase {
public:
    const char* GetName() override { return "PureVirtualDerived"; }
};

// ==========================================
// 2. 定义接收端目标类（模拟 AppState）
// ==========================================
class ReflecProbeTarget {
public:
    // 测试 1：期望接收普通虚类指针
    bool HandleStandard(StandardVirtualBase* sender, const char* msg) {
        std::cout << "    [Target] HandleStandard Invoked! sender: " << (void*)sender << ", msg: " << msg << "\n";
        return true;
    }

    // 测试 2：期望接收纯虚基类指针
    bool HandlePure(PureVirtualBase* sender, const char* msg) {
        std::cout << "    [Target] HandlePure Invoked! sender: " << (void*)sender << ", msg: " << msg << "\n";
        return true;
    }

    // 测试 3：期望接收 void* 降维指针
    bool HandleVoid(void* sender, const char* msg) {
        std::cout << "    [Target] HandleVoid Invoked! sender: " << sender << ", msg: " << msg << "\n";
        return true;
    }
};

Main.cpp

#include <iostream>
#include <vector>
#include <string>

#include "ComplexTest.h"

ComplexEntity* ComplexEntity::staticBoss = nullptr;
void* g_PersistentWeapon = nullptr;
int* g_PersistentInt = nullptr;
ComplexEntity* g_VmpGlobalNode = nullptr;
ComplexEntity* VmpAdvancedTester::staticNode = nullptr;

void GlobalEventLogger(int id, const char* msg) {
    std::cout << "    -> [Callback Invoked] Entity " << id << " reported: " << msg << "\n";
}

DWORD FindProcessId(const char* processName) { 
    DWORD pid = 0;
    HANDLE hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    if (hSnap != INVALID_HANDLE_VALUE) {
        PROCESSENTRY32 pe;
        pe.dwSize = sizeof(PROCESSENTRY32); 
        if (Process32First(hSnap, &pe)) {
            do {
                char exeName[MAX_PATH];
                for (int i = 0; i < MAX_PATH && pe.szExeFile[i] != 0; i++) {
                    exeName[i] = (char)pe.szExeFile[i];
                }
                exeName[MAX_PATH - 1] = '\0';

                if (_stricmp(exeName, processName) == 0) {
                    pid = pe.th32ProcessID;
                    break;
                }
            } while (Process32Next(hSnap, &pe));
        }
        CloseHandle(hSnap);
    }
    return pid;
}

void TestSerializationAndReflection() {
    std::cout << "=== Test 1: Complex Serialization & Reflection ===\n";

    auto assertTest = [](bool condition, const std::string& msg) {
        if (condition) std::cout << "[PASS] " << msg << "\n";
        else std::cout << "[FAIL] " << msg << "\n";
        };

    auto entity = New<ComplexEntity>(1024);
    entity->state = ConnectState::Connected;
    entity->sensor.sensorId = 7;
    entity->sensor.floatVal = 3.14f;
    entity->sensor.status = 'A';
    entity->sensor.flagA = 1;
    entity->sensor.flagB = 5;
    entity->sensor.flagC = 10;
    entity->onEventTriggered = GlobalEventLogger;

    std::vector<uint8_t> bytes = Serialize(entity);
    auto cloned = Deserialize<ComplexEntity>(bytes);

    assertTest(cloned.entityId == 1024 && cloned.state == ConnectState::Connected, "Deserialization restored entityId on Stack Obj");
    assertTest(cloned.onEventTriggered == GlobalEventLogger, "Deserialization flawlessly restored function pointer");

    auto meta = Reflec(cloned);
    meta.SetValue("entityId", 2048);
    meta.SetValue("state", ConnectState::Disconnected);
    assertTest(cloned.entityId == 2048 && cloned.state == ConnectState::Disconnected, "Reflection SetValue correctly modified local Stack Obj memory");

    // 深层嵌套反射漫游测试 (Nested Reflection)
    std::cout << "  --> Testing Deep Nested Reflection (xxxx.yyyy)...\n";

    auto childEnt = New<ComplexEntity>(888);
    childEnt->sensor.sensorId = 42;
    childEnt->sensor.intVal = 10;
    cloned.childNode = childEnt;

    int childId = meta.GetValue<int>("childNode.entityId");
    assertTest(childId == 888, "Nested GetValue traversed pointer 'childNode' to read 'entityId'");

    short fetchedSensorId = meta.GetValue<short>("childNode.sensor.sensorId");
    assertTest(fetchedSensorId == 42, "Nested GetValue penetrated multiple levels (childNode.sensor.sensorId)");

    float localfloatVal = meta.GetValue<float>("sensor.floatVal");
    assertTest(localfloatVal == 3.14f, "Nested GetValue read local value-type nested struct (sensor.floatVal)");

    meta.SetValue("childNode.sensor.sensorId", (short)999);
    assertTest(cloned.childNode->sensor.sensorId == 999, "Nested SetValue mutated deep pointer structure field");

    meta.SetValue("sensor.status", 'Z');
    assertTest(cloned.sensor.status == 'Z', "Nested SetValue mutated local value-type nested struct (sensor.status)");

    meta.Invoke("childNode.ProcessData", 5);
    assertTest(cloned.childNode->sensor.intVal == 50, "Nested Invoke dynamically resolved target and executed method with arguments");

    std::cout << "  --> Testing Nested Arrays (T[n], T*[n], void*[n])...\n";
    AdvancedArrayNode advNode(7777);
    advNode.payload.rawPointers[0] = (void*)(intptr_t)0xDEADBEEF;
    advNode.payload.rawPointers[1] = (void*)(intptr_t)0xCAFEBABE;
    advNode.payload.entityList[0] = (ComplexEntity*)entity;
    advNode.payload.matrix[0] = 10;
    advNode.payload.matrix[1] = 20;

    auto advBytes = Serialize(advNode);
    auto advCloned = Deserialize<AdvancedArrayNode>(advBytes);

    assertTest(advCloned.nodeId == 7777, "Nested array deserialization preserved base attributes");
    assertTest(advCloned.payload.rawPointers[0] == (void*)(intptr_t)0xDEADBEEF, "Nested array deserialization flawlessly restored void*[n]");
    assertTest(advCloned.payload.entityList[0] == (ComplexEntity*)entity, "Nested array deserialization flawlessly restored T*[n]");
    assertTest(advCloned.payload.matrix[1] == 20, "Nested array deserialization flawlessly restored T[n]");

    auto advMeta = Reflec(advCloned);
    advMeta.Invoke("MutateArray", 5);
    assertTest(advCloned.payload.matrix[0] == 50 && advCloned.payload.matrix[1] == 100, "SFINAE Reflection dynamically executed method on Nested Array Stack Object");

    int testArr[3] = { 100, 200, 300 };
    auto arrBytes = Serialize<int[3]>(testArr);
    auto arrCloned = Deserialize<int[3]>(arrBytes);
    assertTest(arrCloned[0] == 100 && arrCloned[2] == 300, "Direct TypeTrait Deserialize<T[n]> successfully extracted HArray");

    std::cout << "\n";
}
void TestGCAndPersistence() {
    std::cout << "=== Test 2: GC Persistence & Extern Validation ===\n";
    {
        auto tempObj = New<ComplexEntity>(1);
        auto bossObj = New<ComplexEntity>(999);
        ComplexEntity::staticBoss = &bossObj;
        auto weaponObj = New<ComplexEntity>(888);
        g_PersistentWeapon = &weaponObj;
        auto extObj = New<ComplexEntity>(777);
        bossObj->externalResource = &extObj;
        auto childObj = New<ComplexEntity>(666);
        tempObj->childNode = &childObj;
    }
    std::cout << "--- Inner scope ended. Only ID 1 and 666 should be reclaimed! ---\n\n";
}

void TestWinApiAndExtern() {
    std::cout << "=== Test 3: Windows Native Struct & Extern Pointer ===\n";
    auto assertTest = [](bool condition, const std::string& msg) {
        if (condition) std::cout << "[PASS] " << msg << "\n";
        else std::cout << "[FAIL] " << msg << "\n";
        };

    auto nativeCfg = New<NativeResourceConfig>();
    nativeCfg->targetPid = GetCurrentProcessId();

    auto meta = Reflec(nativeCfg);
    meta.Invoke("InitNativeData");
    assertTest(nativeCfg->clientId.UniqueProcess == (HANDLE)(ULONG_PTR)nativeCfg->targetPid, "Reflection Invoked method updating CLIENT_ID struct natively");

    AssignGlobalPointer(&g_PersistentInt);
    assertTest(g_PersistentInt != nullptr && *g_PersistentInt == 9999, "Extern int** successfully exported GC pointer using & operator");
    std::cout << "\n";
}

void TestPolymorphism() {
    std::cout << "=== Test 4: Polymorphism & Keywords (virtual, override, final) ===\n";
    auto finalObj = New<FinalWorker>();
    finalObj->baseId = 100;
    finalObj->powerLevel = 9000;
    IWorker* interfacePtr = &finalObj;
    std::cout << "    ";
    interfacePtr->ExecuteTask();
    std::cout << "\n";
}

void TestVmpAnnotations() {
    std::cout << "=== Test 5: Vmp Control Flow Flattening & Obfuscation ===\n";
    VmpGlobalFunction("This is a VMP protected global function!");
    auto secMgr = New<SecurityManager>();
    secMgr->ExecutePayload();
    std::cout << "\n";
}

void TestAdvancedVmp() {
    std::cout << "=== Test 6: Advanced Vmp (Recursion, Loops, Global, Static & Extern) ===\n";
    auto tester = New<VmpAdvancedTester>();
    tester->LoopAllocAndAssign();
    ComplexEntity* recursiveOut = nullptr;
    tester->RecursiveAllocTest(3, &recursiveOut);
    std::cout << "\n";
}

void TestLoopMemoryLeak() {
    std::cout << "=== Test 7: Loop Memory Leak Prevention ===\n";
    for (int i = 0; i < 5; i++) {
        void* p = New<ComplexEntity>(8000 + i);
    }
    std::cout << "\n";
}

void TestHelixSystemKeywords() {
    std::cout << "=== Test 8: Helix System Keywords & Multi-Dimensional Read/Write ===\n";
    auto assertTest = [](bool condition, const std::string& msg) {
        if (condition) std::cout << "[PASS] " << msg << "\n";
        else std::cout << "[FAIL] " << msg << "\n";
        };

    // 1. 获取系统信息 (System Keyword)
    auto sys = System();
    if (sys != nullptr) {
        std::cout << "[System] OS: " << sys->OSName << " v" << sys->MajorVersion << "." << sys->MinorVersion
            << " (Build " << sys->BuildNumber << ")\n";
        std::cout << "[System] HWID: " << sys->SerialNumber << "\n";
    }

    // 2. 获取 CPU 信息 (Cpu Keyword)
    auto cpu = Cpu();
    if (cpu != nullptr) {
        std::cout << "[Cpu] Vendor: " << cpu->Vendor << " | Brand: " << cpu->Brand << "\n";
        std::cout << "[Cpu] Model: " << cpu->ModelName << " | Serial: " << cpu->SerialNumber << "\n";
    }

    // 3. 获取物理网卡 MAC 阵列 (Mac Keyword)
    auto macs = Mac();
    if (macs != nullptr && macs->size() > 0) {
        std::cout << "[Mac] Found " << macs->size() << " Network Adapter(s):\n";
        for (size_t i = 0; i < macs->size(); i++) {
            std::cout << "  -> [" << i << "] " << (*macs)[i].MacAddress
                << " (" << (*macs)[i].Description << ")\n";
        }
    }

    // 4. 获取磁盘信息阵列 (Disk Keyword)，例如Disk("c")
    auto disks = Disk();
    if (disks != nullptr && disks->size() > 0) {
        std::cout << "[Disk] Found " << disks->size() << " Storage Drive(s):\n";
        for (size_t i = 0; i < disks->size(); i++) {
            // 使用 full precision 计算，保留为双精度浮点数显示 GB
            double totalGB = (double)(*disks)[i].TotalSize / (1024.0 * 1024.0 * 1024.0);
            double freeGB = (double)(*disks)[i].FreeSpace / (1024.0 * 1024.0 * 1024.0);

            std::cout << "  -> " << (*disks)[i].DriveLetter
                << " | Model: " << (*disks)[i].Model
                << " | Serial: " << (*disks)[i].SerialNumber << "\n"
                << "     Space: " << freeGB << " GB Free / " << totalGB << " GB Total\n";
        }
    }
    std::cout << "\n";
    // PID = -1 彻底绕过系统调用，实现零开销原生访问
    std::cout << "  --> Testing Local Bypass (PID = -1) Read/Write/Allocate...\n";
    void* localMem = Allocate(-1, sizeof(int));
    if (localMem) {
        int payload = 7777;
        Write(-1, localMem, payload);
        auto pureVal = Read<int>(-1, localMem);
        assertTest(pureVal == 7777, "Local Bypass (-1) flawlessly allocated, wrote, and read stack value via zero-overhead fast path");
    }

    DWORD notepadPid = FindProcessId("notepad.exe");
    bool createdNotepad = false;
    HANDLE hNotepad = NULL;

    if (notepadPid == 0) {
        std::cout << "  --> notepad.exe not found. Launching decoy instance...\n";
        STARTUPINFOA si = { sizeof(si) };
        PROCESS_INFORMATION pi = { 0 };
        if (CreateProcessA(nullptr, (LPSTR)"notepad.exe", nullptr, nullptr, FALSE, 0, nullptr, nullptr, &si, &pi)) {
            notepadPid = pi.dwProcessId;
            hNotepad = pi.hProcess;
            CloseHandle(pi.hThread);
            createdNotepad = true;
            Sleep(500);
        }
    }
    else {
        hNotepad = OpenProcess(PROCESS_ALL_ACCESS, FALSE, notepadPid);
    }

    if (notepadPid != 0 && hNotepad != NULL) {
        void* pRemoteMem = Allocate(notepadPid, sizeof(int));
        int remoteAddrInt = (int)(intptr_t)pRemoteMem;

        if (pRemoteMem) {
            int payload = 1337;
            Write(notepadPid, pRemoteMem, payload);

            auto pureVal = Read<int>(notepadPid, pRemoteMem);
            assertTest(pureVal == 1337, "Read<T> flawlessly retrieved memory directly as stack value");
        }

        std::cout << "  --> Testing Cross-Process Nested Arrays Write/Read (T[n], T*[n], void*[n])...\n";

        AdvancedArrayNode localAdvArr[2] = { AdvancedArrayNode(8888), AdvancedArrayNode(9999) };
        localAdvArr[0].payload.rawPointers[0] = (void*)(intptr_t)0x11112222;
        localAdvArr[0].payload.entityList[1] = (ComplexEntity*)(intptr_t)0x33334444;
        localAdvArr[1].payload.matrix[3] = 777;

        void* remoteAdvArray = Allocate(notepadPid, sizeof(AdvancedArrayNode) * 2);

        if (remoteAdvArray != nullptr) {
            int wStatus = Write<AdvancedArrayNode[2]>(notepadPid, remoteAdvArray, localAdvArr);
            assertTest(wStatus == 1, "Write<T[n]> successfully injected Array of Nested Structs (AdvancedArrayNode[2])");

            auto readAdvArr = Read<AdvancedArrayNode[2]>(notepadPid, remoteAdvArray);
            assertTest(readAdvArr[0].nodeId == 8888 && readAdvArr[1].nodeId == 9999, "Read<T[n]> effortlessly retrieved Array Objects");
            assertTest(readAdvArr[0].payload.rawPointers[0] == (void*)(intptr_t)0x11112222, "Read<T[n]> meticulously extracted nested void*[n]");
            assertTest(readAdvArr[0].payload.entityList[1] == (ComplexEntity*)(intptr_t)0x33334444, "Read<T[n]> meticulously extracted nested T*[n]");
            assertTest(readAdvArr[1].payload.matrix[3] == 777, "Read<T[n]> meticulously extracted nested T[n] from second element");

            void* rawPointersAddr = (void*)((uintptr_t)remoteAdvArray + offsetof(AdvancedArrayNode, payload) + offsetof(NestedPayload, rawPointers));
            auto remoteVoidArray = Read<void* [3]>(notepadPid, rawPointersAddr);
            assertTest(remoteVoidArray[0] == (void*)(intptr_t)0x11112222, "Read<void*[n]> explicitly pinpointed and extracted subset void* array");

            std::cout << "  --> Simulated memory tracker recorded void* remote allocations (" << std::hex << remoteAddrInt << std::dec << ") for AST cleanup.\n";
        }

        if (createdNotepad) {
            std::cout << "  --> Terminating decoy notepad.exe instance...\n";
            TerminateProcess(hNotepad, 0);
        }
        CloseHandle(hNotepad);
    }
    std::cout << "\n";
}

ComplexEntity* g_p;

Vmp void TestKeywordMemoryLeak() {
    std::cout << "=== Test 9: Keyword Zero-Leak Stress Test (10 Iterations) ===\n";
    PROCESS_MEMORY_COUNTERS pmcBefore;
    GetProcessMemoryInfo(GetCurrentProcess(), &pmcBefore, sizeof(pmcBefore));

    int dummyVar = 42;

    std::cout << "  --> Running 10 iterations of New, Cpu, System, Mac, Disk, Read, and Allocate (using Local Bypass -1)...\n";
    for (int i = 0; i < 10; i++) {
        auto cpu = Cpu();
        auto sys = System();
        //auto macs = Mac();//非内存泄漏
        auto disks = Disk();

        // 统一使用 -1 表达本进程
        auto pureVal = Read<int>(-1, &dummyVar);
        auto dummyObj = New<ComplexEntity>(99000 + i);
        void* localMem = Allocate(-1, 256);

        //测试基本数据类型
        auto basicInt = New<int>();
        auto basicFloatArr = New<float[3]>();//非内存泄漏
        auto refBasicFloatArray = Reflec(basicFloatArr);
    }

    PROCESS_MEMORY_COUNTERS pmcAfter;
    GetProcessMemoryInfo(GetCurrentProcess(), &pmcAfter, sizeof(pmcAfter));
    long long diffKB = ((long long)pmcAfter.WorkingSetSize - (long long)pmcBefore.WorkingSetSize) / 1024;

    g_p = (ComplexEntity*)Allocate((uint32_t)-1, sizeof(ComplexEntity));
    g_p->entityId = 1038;

    std::cout << "[PASS] 10 iterations completed (Including Allocate). Memory delta: " << diffKB << " KB.\n";
    std::cout << "\n";
}

void TestDynamicApi() {
    std::cout << "=== Test 10: Dynamic API Keyword (Ring 3) ===\n";

    unsigned long seed = 0x1337;
    unsigned long randomVal = RtlRandomEx(&seed);

    if (randomVal != 0) {
        std::cout << "[PASS] API Keyword triggered seamlessly! Random Value: " << randomVal
            << " (New Seed: " << seed << ")\n";
    }
    else {
        std::cout << "[FAIL] API Keyword failed or returned 0.\n";
    }

    char wsaData[512] = { 0 };
    int wsaStatus = _115(0x0202, wsaData); // 传入 MAKEWORD(2,2)
    if (wsaStatus == 0) {
        std::cout << "[PASS] Ring 3 Ordinal (ws2_32.dll #115 WSAStartup) Executed Successfully!\n";
    }
    else {
        std::cout << "[FAIL] Ring 3 Ordinal failed or returned: " << wsaStatus << "\n";
    }

    void* funcPtr15 = (void*)_15;
    if (funcPtr15 != nullptr) {
        std::cout << "[PASS] Ring 3 Ordinal (ntdll.dll #15) Resolved successfully to: " << funcPtr15 << "\n";
    }
    else {
        std::cout << "[FAIL] Ring 3 Ordinal failed to resolve.\n";
    }
    std::cout << "\n";
}

void TestCrossRingSDKReflection() {
    auto assertTest = [](bool condition, const std::string& msg) {
        if (condition) std::cout << "[PASS] " << msg << "\n";
        else std::cout << "[FAIL] " << msg << "\n"; 
        };

    std::cout << "=== Test 11: Cross-Ring Native SDK Struct Reflection ===\n";

    // 反射 CLIENT_ID (双端互通结构)
    auto clientIdObj = New<CLIENT_ID>();
    auto metaClientWrite = Reflec(clientIdObj);  

    metaClientWrite.SetValue("UniqueProcess", (HANDLE)(intptr_t)0x1234); 
    metaClientWrite.SetValue("UniqueThread", (HANDLE)(intptr_t)0x5678);
     
    auto cidBytes = Serialize(clientIdObj);
    auto cidCloned = Deserialize<CLIENT_ID>(cidBytes);
    auto metaClientRead = Reflec(cidCloned);

    assertTest(metaClientRead.GetValue<HANDLE>("UniqueProcess") == (HANDLE)(intptr_t)0x1234,
        "Deserialize<CLIENT_ID> successfully restored Native SDK Struct (UniqueProcess)");

    metaClientRead.SetValue("UniqueThread", (HANDLE)(intptr_t)0x9999);
    assertTest(metaClientRead.GetValue<HANDLE>("UniqueThread") == (HANDLE)(intptr_t)0x9999,
        "Reflec<CLIENT_ID> successfully modified Native SDK Struct field dynamically");

    // 反射 LIST_ENTRY (双端互通结构)
    auto listEntryObj = New<LIST_ENTRY>();
    auto metaListWrite = Reflec(listEntryObj);
    metaListWrite.SetValue("Flink", (PLIST_ENTRY)(intptr_t)0xAAAA);
    metaListWrite.SetValue("Blink", (PLIST_ENTRY)(intptr_t)0xBBBB);

    auto listBytes = Serialize(listEntryObj);
    auto listCloned = Deserialize<LIST_ENTRY>(listBytes);
    auto metaListRead = Reflec(listCloned);

    assertTest(metaListRead.GetValue<PLIST_ENTRY>("Blink") == (PLIST_ENTRY)(intptr_t)0xBBBB,
        "Deserialize<LIST_ENTRY> successfully restored Doubly-Linked List node");

    metaListRead.SetValue("Flink", (PLIST_ENTRY)(intptr_t)0xCCCC);
    assertTest(metaListRead.GetValue<PLIST_ENTRY>("Flink") == (PLIST_ENTRY)(intptr_t)0xCCCC,
        "Reflec<LIST_ENTRY> successfully modified Doubly-Linked List field dynamically");

    // 反射 MDL (Ring 0 纯内核态结构)
    auto mdlObj = New<MDL>();
    auto metaMdlWrite = Reflec(mdlObj);
    
    metaMdlWrite.SetValue("Size", (short)1024);
    metaMdlWrite.SetValue("MdlFlags", (short)0x0004);
    metaMdlWrite.SetValue("ByteCount", (unsigned long)4096);
      
    auto mdlBytes = Serialize(mdlObj);
    auto mdlCloned = Deserialize<MDL>(mdlBytes);
    auto metaMdlRead = Reflec(mdlCloned);

    assertTest(metaMdlRead.GetValue<unsigned long>("ByteCount") == 4096,
        "Deserialize<MDL> successfully restored Kernel-Only Struct (ByteCount)");

    metaMdlRead.SetValue("MdlFlags", (short)0x0008);
    assertTest(metaMdlRead.GetValue<short>("MdlFlags") == 0x0008,
        "Reflec<MDL> successfully modified Kernel-Only Struct field dynamically");

    // 反射 SYSTEMTIME (Ring 3 纯用户态结构 - 源自 Windows.h)
    auto sysTimeObj = New<SYSTEMTIME>();
    auto metaSysTimeWrite = Reflec(sysTimeObj);

    metaSysTimeWrite.SetValue("wYear", (unsigned short)2026);
    metaSysTimeWrite.SetValue("wMonth", (unsigned short)8);

    auto sysTimeBytes = Serialize(sysTimeObj);
    auto sysTimeCloned = Deserialize<SYSTEMTIME>(sysTimeBytes);
    auto metaSysTimeRead = Reflec(sysTimeCloned);

    assertTest(metaSysTimeRead.GetValue<unsigned short>("wMonth") == 8,
        "Deserialize<SYSTEMTIME> successfully restored User-Only Struct (wMonth) inside Ring 3");

    metaSysTimeRead.SetValue("wYear", (unsigned short)2099);
    assertTest(metaSysTimeRead.GetValue<unsigned short>("wYear") == 2099,
        "Reflec<SYSTEMTIME> successfully modified User-Only Struct field dynamically inside Ring 3");

    std::cout << "\n";
}

void ProcessAnyEvent(Any payload) {
#ifdef _KERNEL_MODE
    DbgPrint("Entering ProcessAnyEvent with Any payload...\n");
#else
    std::cout << "Entering ProcessAnyEvent with Any payload...\n";
#endif

    // 1. 瞬间提权：从虚空中唤醒对象的真实灵魂
    auto meta = Reflec(payload);

    // 2. 动态内省：获取真实类名
    const char* className = meta.GetClassName();
#ifdef _KERNEL_MODE
    DbgPrint("Dynamically resolved ClassName: %s\n", className ? className : "UNKNOWN");
    if (className && strcmp(className, "TestAnyPayload") == 0) {
        DbgPrint("[PASS] ClassName perfectly matched!\n");
    }
    else {
        DbgPrint("[FAIL] ClassName mismatch or Unknown!\n");
    }
#else
    std::cout << "Dynamically resolved ClassName: " << (className ? className : "UNKNOWN") << "\n";
    if (className && strcmp(className, "TestAnyPayload") == 0) {
        std::cout << "[PASS] ClassName perfectly matched!\n";
    }
    else {
        std::cout << "[FAIL] ClassName mismatch or Unknown!\n";
    }
#endif

    // 3. 动态内省：遍历打印所有字段和方法
    int fieldCount = meta.GetFieldCount();
#ifdef _KERNEL_MODE
    DbgPrint("  [+] Field Count: %d\n", fieldCount);
    for (int i = 0; i < fieldCount; i++) {
        DbgPrint("      - Field[%d]: %s\n", i, meta.GetFieldName(i));
    }
#else
    std::cout << "  [+] Field Count: " << fieldCount << "\n";
    for (int i = 0; i < fieldCount; i++) {
        std::cout << "      - Field[" << i << "]: " << meta.GetFieldName(i) << "\n";
    }
#endif

    int methodCount = meta.GetMethodCount();
#ifdef _KERNEL_MODE
    DbgPrint("  [+] Method Count: %d\n", methodCount);
    for (int i = 0; i < methodCount; i++) {
        DbgPrint("      - Method[%d]: %s\n", i, meta.GetMethodName(i));
    }
#else
    std::cout << "  [+] Method Count: " << methodCount << "\n";
    for (int i = 0; i < methodCount; i++) {
        std::cout << "      - Method[" << i << "]: " << meta.GetMethodName(i) << "\n";
    }
#endif

    // 4. 深度穿透读写
    int oldMagic = meta.GetValue<int>("magicCode", 0);
#ifdef _KERNEL_MODE
    DbgPrint("Read 'magicCode': 0x%X\n", oldMagic);
#else
    std::cout << "Read 'magicCode': 0x" << std::hex << std::uppercase << oldMagic << std::dec << "\n";
#endif

    bool setRes = meta.SetValue("version", 99.9f);
    meta.SetValue("isActivated", true);

#ifdef _KERNEL_MODE
    if (setRes) {
        DbgPrint("[PASS] SetValue on 'version' succeeded!\n");
    }
    else {
        DbgPrint("[FAIL] SetValue failed!\n");
    }

    // 5. 动态方法调用 (Invoke)
    DbgPrint("Invoking 'PrintStatus' dynamically:\n");
#else
    if (setRes) {
        std::cout << "[PASS] SetValue on 'version' succeeded!\n";
    }
    else {
        std::cout << "[FAIL] SetValue failed!\n";
    }

    // 5. 动态方法调用 (Invoke)
    std::cout << "Invoking 'PrintStatus' dynamically:\n";
#endif
    meta.Invoke("PrintStatus");
}

void TestAnyDynamicReflection() {
#ifdef _KERNEL_MODE
    DbgPrint("========== [Test 12] Any Dynamic Reflection & Introspection ==========\n");
#else
    std::cout << "========== [Test 12] Any Dynamic Reflection & Introspection ==========\n";
#endif

    // 1. 创建强类型的托管对象
    auto originalPayload = New<TestAnyPayload>();
    originalPayload->magicCode = 1001;
    originalPayload->version = 1.0f;
    originalPayload->isActivated = false;

    // 2. 发生隐式类型擦除：强类型 -> Any 
    // 此时 GetTypeHash<TestAnyPayload> 已被悄悄烙印在 dynamicBox 内部
    Any dynamicBox = originalPayload;

    // 3. 将 Any 传入黑盒处理函数
    ProcessAnyEvent(dynamicBox);

    // 4. 验证在黑盒中通过 Any 篡改的内存是否真实生效
#ifdef _KERNEL_MODE
    DbgPrint("Verifying original object memory...\n");
    if (originalPayload->version == 99.9f && originalPayload->isActivated == true) {
        DbgPrint("[PASS] Memory modified successfully across Any boundary!\n");
    }
    else {
        DbgPrint("[FAIL] Memory verification failed!\n");
    }
#else
    std::cout << "Verifying original object memory...\n";
    if (originalPayload->version == 99.9f && originalPayload->isActivated == true) {
        std::cout << "[PASS] Memory modified successfully across Any boundary!\n";
    }
    else {
        std::cout << "[FAIL] Memory verification failed!\n";
    }
#endif
}

static Any FindControlById(int targetId) {
    // 调用 Iterator 遍历栈
    for (auto it = ControlStack.begin(); it != ControlStack.end(); ++it) {
        // 中途赋值给临时变量 ControlBase*
        ControlBase* temp = *it;
        if (temp && temp->controlId == targetId) {
            // 再匹配返回，将基类指针再次隐式封入 Any 神匣
            return temp;
        }
    }
    return nullptr;
}

void AnyReflection() {
    std::cout << "\n======================================================\n";
    std::cout << " [TEST 13] Any Reflection, Move & Cast Validation\n";
    std::cout << "======================================================\n";

    // 匿名辅助函数：验证基础反射与生命周期转移
    auto processAnyData = [](Any argData, const char* expectedClassName) {
        bool isPass = true;

        Any localData = std::move(argData);
        auto meta = Reflec(localData);

        const char* className = meta.GetClassName();
        if (!className || strcmp(className, expectedClassName) != 0) {
            std::cout << "[ERROR] Class name mismatch. Expected: " << expectedClassName << ", Got: " << (className ? className : "NULL") << "\n";
            isPass = false;
        }

        std::cout << "  -> Detected Class : " << className << "\n";

        // 物理坐标绝对穿透与 SFINAE 动态调用
        if (strcmp(className, "Vector2D") == 0) {
            meta.SetValue("X", 99.0f);
            if (meta.GetValue<float>("X") != 99.0f) isPass = false;

            meta.Invoke("Scale", 2.0f);
            if (meta.GetValue<float>("X") != 198.0f) isPass = false;
        }
        else if (strcmp(className, "PlayerStats") == 0) {
            meta.SetValue("Health", 100);
            int result = meta.Invoke<int>("Heal", 50);
            if (result != 150 || meta.GetValue<int>("Health") != 150) isPass = false;
        }

        if (isPass) {
            std::cout << "[PASS] " << expectedClassName << " reflection pipeline verified.\n\n";
        }
        else {
            std::cout << "[FAIL] " << expectedClassName << " reflection pipeline encountered errors.\n\n";
        }
        };

    // -----------------------------------------------------
    // 执行注入测试
    // -----------------------------------------------------
    try {
        // 测试 A & B: 基础物理数据结构
        auto vec = New<Vector2D>();
        vec->X = 1.0f; vec->Y = 2.0f;
        processAnyData(vec, "Vector2D");

        auto player = New<PlayerStats>();
        player->Health = 50; player->Mana = 100;
        processAnyData(player, "PlayerStats");

        // -----------------------------------------------------
        // 测试 C: HelixUI 控件系统 - Any 多态强转解包测试
        // -----------------------------------------------------
        std::cout << " --- Testing Polymorphic Control Cast ---\n";
        auto btn = New<ButtonControl>();
        Any self = btn;

        // 1. 验证 C 风格隐式强转解包
        ControlBase* basePtr = (ControlBase*)self;
        if (basePtr) {
            // 2. 验证 C++ 虚表 (vtable) 多态是否完好存活
            std::cout << "  -> VTable Dispatch : " << basePtr->GetControlType() << "\n";

            if (strcmp(basePtr->GetControlType(), "ButtonControl") == 0) {
                // 3. 终极实战：拿着 (ControlBase*)self 作为参数传给反射引擎！
                auto modelMeta = Reflec(self);
                bool invokeRes = modelMeta.Invoke<bool>("OnClick", (ControlBase*)self, 42);

                if (invokeRes && modelMeta.GetValue<int>("clickCount") == 42) {
                    std::cout << "[PASS] Any pointer cast & vtable dispatch perfectly verified.\n\n";
                }
                else {
                    std::cout << "[FAIL] Polymorphic invoke execution failed.\n\n";
                }
            }
            else {
                std::cout << "[FAIL] VTable corrupted after Any cast.\n\n";
            }
        }
        else {
            std::cout << "[FAIL] (ControlBase*)self cast returned nullptr.\n\n";
        }

    }
    catch (const std::exception& e) {
        std::cout << "[FAIL] Runtime exception caught: " << e.what() << "\n";
    }
    catch (...) {
        std::cout << "[FAIL] Unknown exception encountered during testing.\n";
    }

    try {
        // 1. 初始化派生类并封入 Any
        auto panel = New<PanelControl>();
        panel->controlId = 9527;
        Any originalAny = panel;

        // 2. 将 Any 隐式强转为 ControlBase* 并压入线程局部栈
        ControlStack.push_back(originalAny);

        // 3. 通过遍历器查找，并以 Any 形式返回
        Any foundAny = FindControlById(9527);

        if (foundAny != nullptr) {
            // 4. 反射返回的 Any
            auto meta = Reflec(foundAny);
            std::cout << "  -> Re-Boxed Detected Class : " << meta.GetClassName() << "\n";

            // 5. 使用 Invoke 执行回调
            // 第一个参数是 ControlBase* (foundAny 隐式解包)，第二个是 const char*
            bool invokeRes = meta.Invoke<bool>("OnMessage", (ControlBase*)foundAny, "HelixUI Event Dispatched");

            // 验证执行结果
            if (invokeRes) {
                // 如果底层的 Any 构造时没有丢失多态信息（比如使用了 GetTypeHash<ControlBase> 的多态特化），
                // 那么它可以安全调用到派生类的成员。如果此处失败，说明需要升级引擎的 RTTI 哈希机制。
                std::cout << "[PASS] Control matched, returned, and invoked successfully.\n\n";
            }
            else {
                std::cout << "[FAIL] Invoke execution returned false.\n\n";
            }
        }
        else {
            std::cout << "[FAIL] Failed to find the control in the stack.\n\n";
        }
    }
    catch (const std::exception& e) {
        std::cout << "[FAIL] Runtime exception caught: " << e.what() << "\n";
    }
    catch (...) {
        std::cout << "[FAIL] Unknown exception encountered.\n";
    }

    // 清理测试现场
    ControlStack.clear();

    try {
        auto state = New<ArgProbeState>();
        Any model = state;
        auto meta = Reflec(model);

        // 构造虚假的发送者与属性名
        ControlBase* dummySender = (ControlBase*)(int)0xDEADBEEF;
        const char* propName = "Visible";
        std::string propStr = "Visible";

        std::cout << "\n--- Test A: Invoke(\"MethodA\", ControlBase*, const char*) ---\n";
        bool resA = false;
        try { resA = meta.Invoke<bool>("MethodA", dummySender, propName); }
        catch (...) {}
        std::cout << "Result: " << (resA ? "MATCHED" : "FAILED (Silent Mismatch)") << "\n";

        std::cout << "\n--- Test B: Invoke(\"MethodB\", ControlBase*, std::string) ---\n";
        bool resB = false;
        try { resB = meta.Invoke<bool>("MethodB", dummySender, propStr); }
        catch (...) {}
        std::cout << "Result: " << (resB ? "MATCHED" : "FAILED (Silent Mismatch)") << "\n";

        std::cout << "\n--- Test C: Invoke(\"MethodC\", void*, const char*) ---\n";
        bool resC = false;
        try { resC = meta.Invoke<bool>("MethodC", (void*)dummySender, propName); }
        catch (...) {}
        std::cout << "Result: " << (resC ? "MATCHED" : "FAILED (Silent Mismatch)") << "\n";

        std::cout << "\n--- Test D: Invoke(\"MethodD\", const char*) ---\n";
        bool resD = false;
        try { resD = meta.Invoke<bool>("MethodD", propName); }
        catch (...) {}
        std::cout << "Result: " << (resD ? "MATCHED" : "FAILED (Silent Mismatch)") << "\n";

        std::cout << "\n======================================================\n\n";
    }
    catch (const std::exception& e) {
        std::cout << "[ERROR] Exception during probe: " << e.what() << "\n";
    }

    try {
        // 注册接收端目标
        auto target = New<ReflecProbeTarget>();
        Any anyTarget = target;
        auto meta = Reflec(anyTarget);

        // 构造实体与指针
        StandardVirtualBase stdBase;
        PureVirtualDerived pureDerived;

        StandardVirtualBase* ptrStd = &stdBase;
        PureVirtualBase* ptrPure = &pureDerived;
        void* ptrVoid = &stdBase;

        const char* testMsg = "Probe_Signal";

        // ---------------------------------------------------------
        std::cout << "\n--- Probe 1: Passing StandardVirtualBase* ---\n";
        bool res1 = false;
        try { res1 = meta.Invoke<bool>("HandleStandard", ptrStd, testMsg); }
        catch (const std::exception& e) { std::cout << " Exception: " << e.what() << "\n"; }
        catch (...) { std::cout << " Unknown Exception!\n"; }
        std::cout << "Result: " << (res1 ? "MATCHED (Success)" : "FAILED (Silent Mismatch)") << "\n";

        // ---------------------------------------------------------
        std::cout << "\n--- Probe 2: Passing PureVirtualBase* (Abstract Class) ---\n";
        bool res2 = false;
        try { res2 = meta.Invoke<bool>("HandlePure", ptrPure, testMsg); }
        catch (const std::exception& e) { std::cout << " Exception: " << e.what() << "\n"; }
        catch (...) { std::cout << " Unknown Exception!\n"; }
        std::cout << "Result: " << (res2 ? "MATCHED (Success)" : "FAILED (Silent Mismatch)") << "\n";

        // ---------------------------------------------------------
        std::cout << "\n--- Probe 3: Passing void* (Type Erasure) ---\n";
        bool res3 = false;
        try { res3 = meta.Invoke<bool>("HandleVoid", ptrVoid, testMsg); }
        catch (const std::exception& e) { std::cout << " Exception: " << e.what() << "\n"; }
        catch (...) { std::cout << " Unknown Exception!\n"; }
        std::cout << "Result: " << (res3 ? "MATCHED (Success)" : "FAILED (Silent Mismatch)") << "\n";

        std::cout << "\n======================================================\n\n";
    }
    catch (const std::exception& e) {
        std::cout << "[ERROR] Critical Exception during probe setup: " << e.what() << "\n";
    }
}

int main(void** args) {
    std::cout << "========================================\n";
    std::cout << "  HELIX USER-MODE ENGINE IGNITED! \n";
    std::cout << "========================================\n\n";

    if (args && args[0]) {
        std::cout << "[System] Process Path : " << (const char*)args[0] << "\n\n";
    }
    
    TestSerializationAndReflection();
    TestGCAndPersistence();
    TestWinApiAndExtern();
    TestPolymorphism();
    TestVmpAnnotations();
    TestAdvancedVmp();
    TestLoopMemoryLeak();

    TestHelixSystemKeywords();
    TestKeywordMemoryLeak();
    TestDynamicApi();
    TestCrossRingSDKReflection();
    TestAnyDynamicReflection();
    AnyReflection();

    std::cout << "Releasing ComplexEntity ID " << g_p->entityId << " reclaimed.\n";
    std::cout << "[System] Process terminating. Globals and Statics will be cleaned by OS now.\n";
    return 0;
}

2. Dll，为了方便大家测试，专门给大家写了一个Dll输出调试。点我下载

DllExample.h

#pragma once
#include <iostream> 
#include <string>
#include <vector>
#include <stddef.h>
#include <iomanip>

#if defined(_KERNEL_MODE)
#include <ntifs.h> // Helix Auto-Wrapped
#endif
#if !defined(_KERNEL_MODE)
#include <Windows.h> // Helix Auto-Wrapped
#endif
#if !defined(_KERNEL_MODE)
#include <TlHelp32.h> // Helix Auto-Wrapped
#endif
#if !defined(_KERNEL_MODE)
#include <Psapi.h> // Helix Auto-Wrapped
#endif
#if !defined(_KERNEL_MODE)
#include <winternl.h> // Helix Auto-Wrapped
#endif

#include "Helix.h"

API() void __stdcall HelixExportedTask(int secretCode);  
API() int __cdecl CalculateData(const char* payload);


using EventCallback = void (*)(int, const char*);

#pragma pack(push, 1)
struct SensorData {
public:
    short sensorId;
    Offset(2);
    union {
        float floatVal;
        int intVal;
    };
    char status;

    unsigned char flagA : 1;
    unsigned char flagB : 3;
    unsigned char flagC : 4;
};

class ComplexEntity {
public:
    int entityId;
    Offset(4);
    SensorData sensor;

    static ComplexEntity* staticBoss;
    Extern void* externalResource;
    ComplexEntity* childNode;

    Extern EventCallback onEventTriggered;

    ComplexEntity() = default;

    ComplexEntity(int id) : entityId(id) {
        std::cout << "[Constructor] ComplexEntity ID " << entityId << " created via parameterized constructor.\n";
    }

    ~ComplexEntity() {
        std::cout << "[Destructor] ComplexEntity ID " << entityId << " reclaimed.\n";
    }

    void ProcessData(int multiplier) {
        sensor.intVal *= multiplier;
        if (onEventTriggered) {
            onEventTriggered(entityId, "Data Processed successfully via callback!");
        }
    }
};

struct NestedPayload {
    void* rawPointers[3];
    ComplexEntity* entityList[2];
    int matrix[4];
};

class AdvancedArrayNode {
public:
    int nodeId;
    Offset(4);
    NestedPayload payload;

    AdvancedArrayNode() = default;

    AdvancedArrayNode(int id) : nodeId(id) {
        memset(&payload, 0, sizeof(payload));
        std::cout << "[Constructor] AdvancedArrayNode ID " << nodeId << " created.\n";
    }

    ~AdvancedArrayNode() {
        std::cout << "[Destructor] AdvancedArrayNode ID " << nodeId << " reclaimed.\n";
    }

    void MutateArray(int multiplier) {
        for (int i = 0; i < 4; i++) {
            payload.matrix[i] *= multiplier;
        }
    }
};
#pragma pack(pop)

class IWorker {
public:
    virtual ~IWorker() = default;
    virtual void ExecuteTask() = 0;
};

class BaseWorker : public IWorker {
public:
    int baseId;

    virtual void ExecuteTask() override {
        std::cout << "[BaseWorker] Task executed by ID " << baseId << ".\n";
    }

    virtual void Upgrade() {
        baseId += 1;
    }
};

class FinalWorker final : public BaseWorker {
public:
    int powerLevel;

    void ExecuteTask() override final {
        std::cout << "[FinalWorker] Final task executed by ID " << baseId << " with power " << powerLevel << ".\n";
    }

    void Upgrade() override {
        powerLevel += 10;
    }

    ~FinalWorker() {
        std::cout << "[Destructor] FinalWorker ID " << baseId << " reclaimed.\n";
    }
};

class NativeResourceConfig {
public:
    DWORD targetPid;

    CLIENT_ID clientId;
    UNICODE_STRING imagePath;

    ~NativeResourceConfig() {
        std::cout << "[Destructor] NativeResourceConfig PID " << targetPid << " reclaimed.\n";
    }

    void InitNativeData() {
        clientId.UniqueProcess = (HANDLE)(ULONG_PTR)targetPid;
        clientId.UniqueThread = (HANDLE)0x1337;

        imagePath.Length = 10;
        imagePath.MaximumLength = 12;
        imagePath.Buffer = (PWSTR)L"Helix";
    }
};

inline void AssignGlobalPointer(Extern int** outPtr) {
    auto newInt = New<int>(9999);
    *outPtr = &newInt;
}

Vmp inline void VmpGlobalFunction(const char* message) {
    std::cout << "  -> [Vmp Global] Executing protected global logic...\n";
    std::cout << "  -> Message: " << message << "\n";
}

class SecurityManager {
public:
    int secretCode = 0;

    Vmp static bool VerifyLicense(const std::string& key) {
        std::cout << "  -> [Vmp Static] Verifying license key...\n";
        if (key == "SECRET-KEY") {
            std::cout << "[Vmp] License Verified Successfully!\n";
            return true;
        }
        return false;
    }

    Vmp void ExecutePayload() {
        secretCode ^= 0x55;
        std::cout << "  -> [Vmp Member] Payload executed. Secret code mutated to: " << secretCode << "\n";
    }

    Vmp int ComplexVmpLogic(int multiplier) {
        int tempCode = 10;
        this->secretCode += (tempCode * multiplier);

        if (this->secretCode > 10) {
            tempCode = 999;
        }

        ExecutePayload();

        return this->secretCode + tempCode;
    }
};

extern ComplexEntity* g_VmpGlobalNode;

class VmpAdvancedTester {
public:
    static ComplexEntity* staticNode;
    Extern ComplexEntity* externDataNode;

    Vmp void RecursiveAllocTest(int depth, Extern ComplexEntity** outParam) {
        if (depth <= 0) return;

        for (int i = 0; i < 2; i++) {
            auto node = New<ComplexEntity>(depth * 100 + i);

            if (depth == 1 && i == 1 && outParam != nullptr) {
                *outParam = &node;
            }
        }

        RecursiveAllocTest(depth - 1, outParam);
    }

    Vmp void LoopAllocAndAssign() {
        for (int i = 1; i <= 5; i++) {
            auto node = New<ComplexEntity>(i * 1000);

            if (i == 2) {
                g_VmpGlobalNode = &node;
            }
            else if (i == 3) {
                staticNode = &node;
            }
            else if (i == 5) {
                externDataNode = &node;
            }
        }
    }
};


struct TestAnyPayload {
    int magicCode;
    float version;
    bool isActivated;

    // 供动态调用的测试方法
    void PrintStatus() {
#ifdef _KERNEL_MODE
        DbgPrint("      -> [TestAnyPayload::PrintStatus] Magic: 0x%X, Version: %.2f, Activated: %s\n",
            magicCode, version, isActivated ? "TRUE" : "FALSE");
#else
        std::cout << "      -> [TestAnyPayload::PrintStatus] Magic: 0x"
            << std::hex << std::uppercase << magicCode << std::dec
            << ", Version: " << std::fixed << std::setprecision(2) << version
            << ", Activated: " << (isActivated ? "TRUE" : "FALSE") << "\n";
#endif
    }

    ~TestAnyPayload()
    {
#ifdef _KERNEL_MODE
        DbgPrint("[Destructor] magicCode %d reclaimed.\n", magicCode);
#else
        std::cout << "[Destructor] magicCode " << std::dec << magicCode << " reclaimed.\n";
#endif
    }
};


// 引擎底层已实现 C++ 名称修饰自适应，无需外包 extern "C"
API("ntdll.dll") unsigned long NTAPI RtlRandomEx(unsigned long* Seed);
API("ws2_32.dll") int __stdcall _115(unsigned short wVersionRequested, void* lpWSAData);
API("ntdll.dll") NTSTATUS NTAPI _15(void* Param1);

struct Vector2D {
    float X;
    float Y;
    void Scale(float factor) {
        X *= factor;
        Y *= factor;
    }
};

struct PlayerStats {
    int Health;
    int Mana;
    int Heal(int amount) {
        Health += amount;
        return Health;
    }
};

class ControlBase {
public:
    int controlId = 0;
    virtual ~ControlBase() = default;
    virtual const char* GetControlType() { return "ControlBase"; }
};

// 具体的按钮控件
class ButtonControl : public ControlBase {
public:
    int clickCount = 0;

    const char* GetControlType() override { return "ButtonControl"; }

    // 模拟事件回调：接收发起者指针与参数
    bool OnClick(ControlBase* sender, int arg) {
        if (sender) {
            clickCount += arg;
            return true;
        }
        return false;
    }
};

// 具体的面板控件
class PanelControl : public ControlBase {
public:
    int messageCount = 0;

    const char* GetControlType() override { return "PanelControl"; }

    // 目标 Invoke 函数：参数 (ControlBase*, const char*)
    bool OnMessage(ControlBase* sender, const char* msg) {
        if (sender && msg) {
            std::cout << "    [Panel] Received message: " << msg << " from sender ID: " << sender->controlId << "\n";
            messageCount++;
            return true;
        }
        return false;
    }
};

// 全局线程局部控件栈
inline static thread_local std::vector<ControlBase*> ControlStack;

// --- 专用于刺探 Reflec 参数匹配机制的测试模型 ---
class ArgProbeState {
public:
    // 测试 A：完全对应当前工程的签名
    bool MethodA(ControlBase* sender, const char* prop) {
        std::cout << "    -> MethodA (ControlBase*, const char*) Invoked!\n";
        return true;
    }

    // 测试 B：参数 2 改为 std::string
    bool MethodB(ControlBase* sender, std::string prop) {
        std::cout << "    -> MethodB (ControlBase*, std::string) Invoked!\n";
        return true;
    }

    // 测试 C：参数 1 退化为 void*
    bool MethodC(void* sender, const char* prop) {
        std::cout << "    -> MethodC (void*, const char*) Invoked!\n";
        return true;
    }

    // 测试 D：只传 1 个参数 const char*
    bool MethodD(const char* prop) {
        std::cout << "    -> MethodD (const char*) Invoked!\n";
        return true;
    }
};

// [类型 A]：普通多态基类（带普通虚函数）
class StandardVirtualBase {
public:
    virtual ~StandardVirtualBase() = default;
    virtual const char* GetName() { return "StandardVirtualBase"; }
};

// [类型 B]：纯虚基类（Abstract Class）
class PureVirtualBase {
public:
    virtual ~PureVirtualBase() = default;
    virtual const char* GetName() = 0; // 纯虚函数
};

// 用于实例化纯虚基类的派生类
class PureVirtualDerived : public PureVirtualBase {
public:
    const char* GetName() override { return "PureVirtualDerived"; }
};

// ==========================================
// 2. 定义接收端目标类（模拟 AppState）
// ==========================================
class ReflecProbeTarget {
public:
    // 测试 1：期望接收普通虚类指针
    bool HandleStandard(StandardVirtualBase* sender, const char* msg) {
        std::cout << "    [Target] HandleStandard Invoked! sender: " << (void*)sender << ", msg: " << msg << "\n";
        return true;
    }

    // 测试 2：期望接收纯虚基类指针
    bool HandlePure(PureVirtualBase* sender, const char* msg) {
        std::cout << "    [Target] HandlePure Invoked! sender: " << (void*)sender << ", msg: " << msg << "\n";
        return true;
    }

    // 测试 3：期望接收 void* 降维指针
    bool HandleVoid(void* sender, const char* msg) {
        std::cout << "    [Target] HandleVoid Invoked! sender: " << sender << ", msg: " << msg << "\n";
        return true;
    }
};

dllmain.cpp

#include <iostream>
#include <vector>
#include <string>

#include "DllExample.h"

// [API 导出实现] 引擎会自动将这两个函数作为标准 C 符号导出到 DLL 中
// 供外部 EXE 或其他项目完美调用
void __stdcall HelixExportedTask(int secretCode) {
    std::cout << "\n[Export] HelixExportedTask triggered with SecretCode: " << secretCode << "\n";
}

int __cdecl CalculateData(const char* payload) {
    std::cout << "\n[Export] CalculateData triggered with Payload: " << (payload ? payload : "NULL") << "\n";
    if (payload == nullptr) return 0;
    return 1337;
}

ComplexEntity* ComplexEntity::staticBoss = nullptr;
void* g_PersistentWeapon = nullptr;
int* g_PersistentInt = nullptr;
ComplexEntity* g_VmpGlobalNode = nullptr;
ComplexEntity* VmpAdvancedTester::staticNode = nullptr;

void GlobalEventLogger(int id, const char* msg) {
    std::cout << "    -> [Callback Invoked] Entity " << id << " reported: " << msg << "\n";
}

DWORD FindProcessId(const char* processName) {
    DWORD pid = 0;
    HANDLE hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    if (hSnap != INVALID_HANDLE_VALUE) {
        PROCESSENTRY32 pe;
        pe.dwSize = sizeof(PROCESSENTRY32);
        if (Process32First(hSnap, &pe)) {
            do {
                char exeName[MAX_PATH];
                for (int i = 0; i < MAX_PATH && pe.szExeFile[i] != 0; i++) {
                    exeName[i] = (char)pe.szExeFile[i];
                }
                exeName[MAX_PATH - 1] = '\0';

                if (_stricmp(exeName, processName) == 0) {
                    pid = pe.th32ProcessID;
                    break;
                }
            } while (Process32Next(hSnap, &pe));
        }
        CloseHandle(hSnap);
    }
    return pid;
}

void TestSerializationAndReflection() {
    std::cout << "=== Test 1: Complex Serialization & Reflection ===\n";

    auto assertTest = [](bool condition, const std::string& msg) {
        if (condition) std::cout << "[PASS] " << msg << "\n";
        else std::cout << "[FAIL] " << msg << "\n";
        };

    auto entity = New<ComplexEntity>(1024);
    entity->sensor.sensorId = 7;
    entity->sensor.floatVal = 3.14f;
    entity->sensor.status = 'A';
    entity->sensor.flagA = 1;
    entity->sensor.flagB = 5;
    entity->sensor.flagC = 10;
    entity->onEventTriggered = GlobalEventLogger;

    std::vector<uint8_t> bytes = Serialize(entity);
    auto cloned = Deserialize<ComplexEntity>(bytes);

    assertTest(cloned.entityId == 1024, "Deserialization restored entityId on Stack Obj");
    assertTest(cloned.onEventTriggered == GlobalEventLogger, "Deserialization flawlessly restored function pointer");

    auto meta = Reflec(cloned);
    meta.SetValue("entityId", 2048);
    assertTest(cloned.entityId == 2048, "Reflection SetValue correctly modified local Stack Obj memory");

    // 深层嵌套反射漫游测试 (Nested Reflection)
    std::cout << "  --> Testing Deep Nested Reflection (xxxx.yyyy)...\n";

    auto childEnt = New<ComplexEntity>(888);
    childEnt->sensor.sensorId = 42;
    childEnt->sensor.intVal = 10;
    cloned.childNode = childEnt;

    int childId = meta.GetValue<int>("childNode.entityId");
    assertTest(childId == 888, "Nested GetValue traversed pointer 'childNode' to read 'entityId'");

    short fetchedSensorId = meta.GetValue<short>("childNode.sensor.sensorId");
    assertTest(fetchedSensorId == 42, "Nested GetValue penetrated multiple levels (childNode.sensor.sensorId)");

    float localfloatVal = meta.GetValue<float>("sensor.floatVal");
    assertTest(localfloatVal == 3.14f, "Nested GetValue read local value-type nested struct (sensor.floatVal)");

    meta.SetValue("childNode.sensor.sensorId", (short)999);
    assertTest(cloned.childNode->sensor.sensorId == 999, "Nested SetValue mutated deep pointer structure field");

    meta.SetValue("sensor.status", 'Z');
    assertTest(cloned.sensor.status == 'Z', "Nested SetValue mutated local value-type nested struct (sensor.status)");

    meta.Invoke("childNode.ProcessData", 5);
    assertTest(cloned.childNode->sensor.intVal == 50, "Nested Invoke dynamically resolved target and executed method with arguments");

    std::cout << "  --> Testing Nested Arrays (T[n], T*[n], void*[n])...\n";
    AdvancedArrayNode advNode(7777);
    advNode.payload.rawPointers[0] = (void*)(intptr_t)0xDEADBEEF;
    advNode.payload.rawPointers[1] = (void*)(intptr_t)0xCAFEBABE;
    advNode.payload.entityList[0] = (ComplexEntity*)entity;
    advNode.payload.matrix[0] = 10;
    advNode.payload.matrix[1] = 20;

    auto advBytes = Serialize(advNode);
    auto advCloned = Deserialize<AdvancedArrayNode>(advBytes);

    assertTest(advCloned.nodeId == 7777, "Nested array deserialization preserved base attributes");
    assertTest(advCloned.payload.rawPointers[0] == (void*)(intptr_t)0xDEADBEEF, "Nested array deserialization flawlessly restored void*[n]");
    assertTest(advCloned.payload.entityList[0] == (ComplexEntity*)entity, "Nested array deserialization flawlessly restored T*[n]");
    assertTest(advCloned.payload.matrix[1] == 20, "Nested array deserialization flawlessly restored T[n]");

    auto advMeta = Reflec(advCloned);
    advMeta.Invoke("MutateArray", 5);
    assertTest(advCloned.payload.matrix[0] == 50 && advCloned.payload.matrix[1] == 100, "SFINAE Reflection dynamically executed method on Nested Array Stack Object");

    int testArr[3] = { 100, 200, 300 };
    auto arrBytes = Serialize<int[3]>(testArr);
    auto arrCloned = Deserialize<int[3]>(arrBytes);
    assertTest(arrCloned[0] == 100 && arrCloned[2] == 300, "Direct TypeTrait Deserialize<T[n]> successfully extracted HArray");

    std::cout << "\n";
}

void TestGCAndPersistence() {
    std::cout << "=== Test 2: GC Persistence & Extern Validation ===\n";
    {
        auto tempObj = New<ComplexEntity>(1);
        auto bossObj = New<ComplexEntity>(999);
        ComplexEntity::staticBoss = &bossObj;
        auto weaponObj = New<ComplexEntity>(888);
        g_PersistentWeapon = &weaponObj;
        auto extObj = New<ComplexEntity>(777);
        bossObj->externalResource = &extObj;
        auto childObj = New<ComplexEntity>(666);
        tempObj->childNode = &childObj;
    }
    std::cout << "--- Inner scope ended. Only ID 1 and 666 should be reclaimed! ---\n\n";
}

void TestWinApiAndExtern() {
    std::cout << "=== Test 3: Windows Native Struct & Extern Pointer ===\n";
    auto assertTest = [](bool condition, const std::string& msg) {
        if (condition) std::cout << "[PASS] " << msg << "\n";
        else std::cout << "[FAIL] " << msg << "\n";
        };

    auto nativeCfg = New<NativeResourceConfig>();
    nativeCfg->targetPid = GetCurrentProcessId();

    auto meta = Reflec(nativeCfg);
    meta.Invoke("InitNativeData");
    assertTest(nativeCfg->clientId.UniqueProcess == (HANDLE)(ULONG_PTR)nativeCfg->targetPid, "Reflection Invoked method updating CLIENT_ID struct natively");

    AssignGlobalPointer(&g_PersistentInt);
    assertTest(g_PersistentInt != nullptr && *g_PersistentInt == 9999, "Extern int** successfully exported GC pointer using & operator");
    std::cout << "\n";
}

void TestPolymorphism() {
    std::cout << "=== Test 4: Polymorphism & Keywords (virtual, override, final) ===\n";
    auto finalObj = New<FinalWorker>();
    finalObj->baseId = 100;
    finalObj->powerLevel = 9000;
    IWorker* interfacePtr = &finalObj;
    std::cout << "    ";
    interfacePtr->ExecuteTask();
    std::cout << "\n";
}

void TestVmpAnnotations() {
    std::cout << "=== Test 5: Vmp Control Flow Flattening & Obfuscation ===\n";
    VmpGlobalFunction("This is a VMP protected global function!");
    auto secMgr = New<SecurityManager>();
    secMgr->ExecutePayload();
    std::cout << "\n";
}

void TestAdvancedVmp() {
    std::cout << "=== Test 6: Advanced Vmp (Recursion, Loops, Global, Static & Extern) ===\n";
    auto tester = New<VmpAdvancedTester>();
    tester->LoopAllocAndAssign();
    ComplexEntity* recursiveOut = nullptr;
    tester->RecursiveAllocTest(3, &recursiveOut);
    std::cout << "\n";
}

void TestLoopMemoryLeak() {
    std::cout << "=== Test 7: Loop Memory Leak Prevention ===\n";
    for (int i = 0; i < 5; i++) {
        void* p = New<ComplexEntity>(8000 + i);
    }
    std::cout << "\n";
}

void TestHelixSystemKeywords() {
    std::cout << "=== Test 8: Helix System Keywords & Multi-Dimensional Read/Write ===\n";
    auto assertTest = [](bool condition, const std::string& msg) {
        if (condition) std::cout << "[PASS] " << msg << "\n";
        else std::cout << "[FAIL] " << msg << "\n";
        };
    // 1. 获取系统信息 (System Keyword)
    auto sys = System();
    if (sys != nullptr) {
        std::cout << "[System] OS: " << sys->OSName << " v" << sys->MajorVersion << "." << sys->MinorVersion
            << " (Build " << sys->BuildNumber << ")\n";
        std::cout << "[System] HWID: " << sys->SerialNumber << "\n";
    }
    // 2. 获取 CPU 信息 (Cpu Keyword)
    auto cpu = Cpu();
    if (cpu != nullptr) {
        std::cout << "[Cpu] Vendor: " << cpu->Vendor << " | Brand: " << cpu->Brand << "\n";
        std::cout << "[Cpu] Model: " << cpu->ModelName << " | Serial: " << cpu->SerialNumber << "\n";
    }
    // 3. 获取物理网卡 MAC 阵列 (Mac Keyword)
    auto macs = Mac();
    if (macs != nullptr && macs->size() > 0) {
        std::cout << "[Mac] Found " << macs->size() << " Network Adapter(s):\n";
        for (size_t i = 0; i < macs->size(); i++) {
            std::cout << "  -> [" << i << "] " << (*macs)[i].MacAddress
                << " (" << (*macs)[i].Description << ")\n";
        }
    }
    // 4. 获取磁盘信息阵列 (Disk Keyword)，例如Disk("c")
    auto disks = Disk();
    if (disks != nullptr && disks->size() > 0) {
        std::cout << "[Disk] Found " << disks->size() << " Storage Drive(s):\n";
        for (size_t i = 0; i < disks->size(); i++) {
            // 使用 full precision 计算，保留为双精度浮点数显示 GB
            double totalGB = (double)(*disks)[i].TotalSize / (1024.0 * 1024.0 * 1024.0);
            double freeGB = (double)(*disks)[i].FreeSpace / (1024.0 * 1024.0 * 1024.0);
            std::cout << "  -> " << (*disks)[i].DriveLetter
                << " | Model: " << (*disks)[i].Model
                << " | Serial: " << (*disks)[i].SerialNumber << "\n"
                << "     Space: " << freeGB << " GB Free / " << totalGB << " GB Total\n";
        }
    }
    std::cout << "\n";

    // PID = -1 彻底绕过系统调用，实现零开销原生访问
    std::cout << "  --> Testing Local Bypass (PID = -1) Read/Write/Allocate...\n";
    void* localMem = Allocate(-1, sizeof(int));
    if (localMem) {
        int payload = 7777;
        Write(-1, localMem, payload);
        auto pureVal = Read<int>(-1, localMem);
        assertTest(pureVal == 7777, "Local Bypass (-1) flawlessly allocated, wrote, and read stack value via zero-overhead fast path");
    }

    DWORD notepadPid = FindProcessId("notepad.exe");
    bool createdNotepad = false;
    HANDLE hNotepad = NULL;

    if (notepadPid == 0) {
        std::cout << "  --> notepad.exe not found. Launching decoy instance...\n";
        STARTUPINFOA si = { sizeof(si) };
        PROCESS_INFORMATION pi = { 0 };
        if (CreateProcessA(nullptr, (LPSTR)"notepad.exe", nullptr, nullptr, FALSE, 0, nullptr, nullptr, &si, &pi)) {
            notepadPid = pi.dwProcessId;
            hNotepad = pi.hProcess;
            CloseHandle(pi.hThread);
            createdNotepad = true;
            Sleep(500);
        }
    }
    else {
        hNotepad = OpenProcess(PROCESS_ALL_ACCESS, FALSE, notepadPid);
    }

    if (notepadPid != 0 && hNotepad != NULL) {
        void* pRemoteMem = Allocate(notepadPid, sizeof(int));
        int remoteAddrInt = (int)(intptr_t)pRemoteMem;

        if (pRemoteMem) {
            int payload = 1337;
            Write(notepadPid, pRemoteMem, payload);

            auto pureVal = Read<int>(notepadPid, pRemoteMem);
            assertTest(pureVal == 1337, "Read<T> flawlessly retrieved memory directly as stack value");
        }

        std::cout << "  --> Testing Cross-Process Nested Arrays Write/Read (T[n], T*[n], void*[n])...\n";

        AdvancedArrayNode localAdvArr[2] = { AdvancedArrayNode(8888), AdvancedArrayNode(9999) };
        localAdvArr[0].payload.rawPointers[0] = (void*)(intptr_t)0x11112222;
        localAdvArr[0].payload.entityList[1] = (ComplexEntity*)(intptr_t)0x33334444;
        localAdvArr[1].payload.matrix[3] = 777;

        void* remoteAdvArray = Allocate(notepadPid, sizeof(AdvancedArrayNode) * 2);

        if (remoteAdvArray != nullptr) {
            int wStatus = Write<AdvancedArrayNode[2]>(notepadPid, remoteAdvArray, localAdvArr);
            assertTest(wStatus == 1, "Write<T[n]> successfully injected Array of Nested Structs (AdvancedArrayNode[2])");

            auto readAdvArr = Read<AdvancedArrayNode[2]>(notepadPid, remoteAdvArray);
            assertTest(readAdvArr[0].nodeId == 8888 && readAdvArr[1].nodeId == 9999, "Read<T[n]> effortlessly retrieved Array Objects");
            assertTest(readAdvArr[0].payload.rawPointers[0] == (void*)(intptr_t)0x11112222, "Read<T[n]> meticulously extracted nested void*[n]");
            assertTest(readAdvArr[0].payload.entityList[1] == (ComplexEntity*)(intptr_t)0x33334444, "Read<T[n]> meticulously extracted nested T*[n]");
            assertTest(readAdvArr[1].payload.matrix[3] == 777, "Read<T[n]> meticulously extracted nested T[n] from second element");

            void* rawPointersAddr = (void*)((uintptr_t)remoteAdvArray + offsetof(AdvancedArrayNode, payload) + offsetof(NestedPayload, rawPointers));
            auto remoteVoidArray = Read<void* [3]>(notepadPid, rawPointersAddr);
            assertTest(remoteVoidArray[0] == (void*)(intptr_t)0x11112222, "Read<void*[n]> explicitly pinpointed and extracted subset void* array");

            std::cout << "  --> Simulated memory tracker recorded void* remote allocations (" << std::hex << remoteAddrInt << std::dec << ") for AST cleanup.\n";
        }

        if (createdNotepad) {
            std::cout << "  --> Terminating decoy notepad.exe instance...\n";
            TerminateProcess(hNotepad, 0);
        }
        CloseHandle(hNotepad);
    }
    std::cout << "\n";
}

Extern ComplexEntity* g_p;

Vmp void TestKeywordMemoryLeak() {
    std::cout << "=== Test 9: Keyword Zero-Leak Stress Test (10 Iterations) ===\n";
    PROCESS_MEMORY_COUNTERS pmcBefore;
    GetProcessMemoryInfo(GetCurrentProcess(), &pmcBefore, sizeof(pmcBefore));

    int dummyVar = 42;

    std::cout << "  --> Running 10 iterations of New, Cpu, System, Mac, Disk, Read, and Allocate (using Local Bypass -1)...\n";
    for (int i = 0; i < 10; i++) {
        auto cpu = Cpu();
        auto sys = System();
        //auto macs = Mac();
        auto disks = Disk();

        // 使用 -1 实现本进程内存无系统调用开销的极速操作
        auto pureVal = Read<int>(-1, &dummyVar);
        auto dummyObj = New<ComplexEntity>(99000 + i);
        void* localMem = Allocate(-1, 256);

        //测试基本数据类型
        auto basicInt = New<int>();
        auto basicFloatArr = New<float[3]>();//非内存泄漏
        auto refBasicFloatArray = Reflec(basicFloatArr);
    }

    PROCESS_MEMORY_COUNTERS pmcAfter;
    GetProcessMemoryInfo(GetCurrentProcess(), &pmcAfter, sizeof(pmcAfter));
    long long diffKB = ((long long)pmcAfter.WorkingSetSize - (long long)pmcBefore.WorkingSetSize) / 1024;

    g_p = (ComplexEntity*)Allocate((uint32_t)-1, sizeof(ComplexEntity));
    
    g_p->entityId = 1038;

    std::cout << "[PASS] 10 iterations completed (Including Allocate). Memory delta: " << diffKB << " KB.\n";
    std::cout << "\n";
}

void TestDynamicApi() {
    std::cout << "=== Test 10: Dynamic API Keyword (Ring 3) ===\n";

    unsigned long seed = 0x1337;
    unsigned long randomVal = RtlRandomEx(&seed);

    if (randomVal != 0) {
        std::cout << "[PASS] API Keyword triggered seamlessly! Random Value: " << randomVal
            << " (New Seed: " << seed << ")\n";
    }
    else {
        std::cout << "[FAIL] API Keyword failed or returned 0.\n";
    }

    char wsaData[512] = { 0 };
    int wsaStatus = _115(0x0202, wsaData); // 传入 MAKEWORD(2,2)
    if (wsaStatus == 0) {
        std::cout << "[PASS] Ring 3 Ordinal (ws2_32.dll #115 WSAStartup) Executed Successfully!\n";
    }
    else {
        std::cout << "[FAIL] Ring 3 Ordinal failed or returned: " << wsaStatus << "\n";
    }

    void* funcPtr15 = (void*)_15;
    if (funcPtr15 != nullptr) {
        std::cout << "[PASS] Ring 3 Ordinal (ntdll.dll #15) Resolved successfully to: " << funcPtr15 << "\n";
    }
    else {
        std::cout << "[FAIL] Ring 3 Ordinal failed to resolve.\n";
    }
    std::cout << "\n";
}

void TestCrossRingSDKReflection() {
    auto assertTest = [](bool condition, const std::string& msg) {
        if (condition) std::cout << "[PASS] " << msg << "\n";
        else std::cout << "[FAIL] " << msg << "\n";
        };

    std::cout << "=== Test 11: Cross-Ring Native SDK Struct Reflection ===\n";

    auto clientIdObj = New<CLIENT_ID>();
    auto metaClientWrite = Reflec(clientIdObj);

    metaClientWrite.SetValue("UniqueProcess", (HANDLE)(intptr_t)0x1234);
    metaClientWrite.SetValue("UniqueThread", (HANDLE)(intptr_t)0x5678);

    auto cidBytes = Serialize(clientIdObj);
    auto cidCloned = Deserialize<CLIENT_ID>(cidBytes);
    auto metaClientRead = Reflec(cidCloned);

    assertTest(metaClientRead.GetValue<HANDLE>("UniqueProcess") == (HANDLE)(intptr_t)0x1234,
        "Deserialize<CLIENT_ID> successfully restored Native SDK Struct (UniqueProcess)");

    metaClientRead.SetValue("UniqueThread", (HANDLE)(intptr_t)0x9999);
    assertTest(metaClientRead.GetValue<HANDLE>("UniqueThread") == (HANDLE)(intptr_t)0x9999,
        "Reflec<CLIENT_ID> successfully modified Native SDK Struct field dynamically");

    auto listEntryObj = New<LIST_ENTRY>();
    auto metaListWrite = Reflec(listEntryObj);
    metaListWrite.SetValue("Flink", (PLIST_ENTRY)(intptr_t)0xAAAA);
    metaListWrite.SetValue("Blink", (PLIST_ENTRY)(intptr_t)0xBBBB);

    auto listBytes = Serialize(listEntryObj);
    auto listCloned = Deserialize<LIST_ENTRY>(listBytes);
    auto metaListRead = Reflec(listCloned);

    assertTest(metaListRead.GetValue<PLIST_ENTRY>("Blink") == (PLIST_ENTRY)(intptr_t)0xBBBB,
        "Deserialize<LIST_ENTRY> successfully restored Doubly-Linked List node");

    metaListRead.SetValue("Flink", (PLIST_ENTRY)(intptr_t)0xCCCC);
    assertTest(metaListRead.GetValue<PLIST_ENTRY>("Flink") == (PLIST_ENTRY)(intptr_t)0xCCCC,
        "Reflec<LIST_ENTRY> successfully modified Doubly-Linked List field dynamically");

    auto mdlObj = New<MDL>();
    auto metaMdlWrite = Reflec(mdlObj);

    metaMdlWrite.SetValue("Size", (short)1024);
    metaMdlWrite.SetValue("MdlFlags", (short)0x0004);
    metaMdlWrite.SetValue("ByteCount", (unsigned long)4096);

    auto mdlBytes = Serialize(mdlObj);
    auto mdlCloned = Deserialize<MDL>(mdlBytes);
    auto metaMdlRead = Reflec(mdlCloned);

    assertTest(metaMdlRead.GetValue<unsigned long>("ByteCount") == 4096,
        "Deserialize<MDL> successfully restored Kernel-Only Struct (ByteCount)");

    metaMdlRead.SetValue("MdlFlags", (short)0x0008);
    assertTest(metaMdlRead.GetValue<short>("MdlFlags") == 0x0008,
        "Reflec<MDL> successfully modified Kernel-Only Struct field dynamically");

    auto sysTimeObj = New<SYSTEMTIME>();
    auto metaSysTimeWrite = Reflec(sysTimeObj);

    metaSysTimeWrite.SetValue("wYear", (unsigned short)2026);
    metaSysTimeWrite.SetValue("wMonth", (unsigned short)8);

    auto sysTimeBytes = Serialize(sysTimeObj);
    auto sysTimeCloned = Deserialize<SYSTEMTIME>(sysTimeBytes);
    auto metaSysTimeRead = Reflec(sysTimeCloned);

    assertTest(metaSysTimeRead.GetValue<unsigned short>("wMonth") == 8,
        "Deserialize<SYSTEMTIME> successfully restored User-Only Struct (wMonth) inside Ring 3");

    metaSysTimeRead.SetValue("wYear", (unsigned short)2099);
    assertTest(metaSysTimeRead.GetValue<unsigned short>("wYear") == 2099,
        "Reflec<SYSTEMTIME> successfully modified User-Only Struct field dynamically inside Ring 3");

    std::cout << "\n";
}


void ProcessAnyEvent(Any payload) {
#ifdef _KERNEL_MODE
    DbgPrint("Entering ProcessAnyEvent with Any payload...\n");
#else
    std::cout << "Entering ProcessAnyEvent with Any payload...\n";
#endif

    // 1. 瞬间提权：从虚空中唤醒对象的真实灵魂
    auto meta = Reflec(payload);

    // 2. 动态内省：获取真实类名
    const char* className = meta.GetClassName();
#ifdef _KERNEL_MODE
    DbgPrint("Dynamically resolved ClassName: %s\n", className ? className : "UNKNOWN");
    if (className && strcmp(className, "TestAnyPayload") == 0) {
        DbgPrint("[PASS] ClassName perfectly matched!\n");
    }
    else {
        DbgPrint("[FAIL] ClassName mismatch or Unknown!\n");
    }
#else
    std::cout << "Dynamically resolved ClassName: " << (className ? className : "UNKNOWN") << "\n";
    if (className && strcmp(className, "TestAnyPayload") == 0) {
        std::cout << "[PASS] ClassName perfectly matched!\n";
    }
    else {
        std::cout << "[FAIL] ClassName mismatch or Unknown!\n";
    }
#endif

    // 3. 动态内省：遍历打印所有字段和方法
    int fieldCount = meta.GetFieldCount();
#ifdef _KERNEL_MODE
    DbgPrint("  [+] Field Count: %d\n", fieldCount);
    for (int i = 0; i < fieldCount; i++) {
        DbgPrint("      - Field[%d]: %s\n", i, meta.GetFieldName(i));
    }
#else
    std::cout << "  [+] Field Count: " << fieldCount << "\n";
    for (int i = 0; i < fieldCount; i++) {
        std::cout << "      - Field[" << i << "]: " << meta.GetFieldName(i) << "\n";
    }
#endif

    int methodCount = meta.GetMethodCount();
#ifdef _KERNEL_MODE
    DbgPrint("  [+] Method Count: %d\n", methodCount);
    for (int i = 0; i < methodCount; i++) {
        DbgPrint("      - Method[%d]: %s\n", i, meta.GetMethodName(i));
    }
#else
    std::cout << "  [+] Method Count: " << methodCount << "\n";
    for (int i = 0; i < methodCount; i++) {
        std::cout << "      - Method[" << i << "]: " << meta.GetMethodName(i) << "\n";
    }
#endif

    // 4. 深度穿透读写
    int oldMagic = meta.GetValue<int>("magicCode", 0);
#ifdef _KERNEL_MODE
    DbgPrint("Read 'magicCode': 0x%X\n", oldMagic);
#else
    std::cout << "Read 'magicCode': 0x" << std::hex << std::uppercase << oldMagic << std::dec << "\n";
#endif

    bool setRes = meta.SetValue("version", 99.9f);
    meta.SetValue("isActivated", true);

#ifdef _KERNEL_MODE
    if (setRes) {
        DbgPrint("[PASS] SetValue on 'version' succeeded!\n");
    }
    else {
        DbgPrint("[FAIL] SetValue failed!\n");
    }

    // 5. 动态方法调用 (Invoke)
    DbgPrint("Invoking 'PrintStatus' dynamically:\n");
#else
    if (setRes) {
        std::cout << "[PASS] SetValue on 'version' succeeded!\n";
    }
    else {
        std::cout << "[FAIL] SetValue failed!\n";
    }

    // 5. 动态方法调用 (Invoke)
    std::cout << "Invoking 'PrintStatus' dynamically:\n";
#endif
    meta.Invoke("PrintStatus");
}

void TestAnyDynamicReflection() {
#ifdef _KERNEL_MODE
    DbgPrint("========== [Test 12] Any Dynamic Reflection & Introspection ==========\n");
#else
    std::cout << "========== [Test 12] Any Dynamic Reflection & Introspection ==========\n";
#endif

    // 1. 创建强类型的托管对象
    auto originalPayload = New<TestAnyPayload>();
    originalPayload->magicCode = 1001;
    originalPayload->version = 1.0f;
    originalPayload->isActivated = false;

    // 2. 发生隐式类型擦除：强类型 -> Any 
    // 此时 GetTypeHash<TestAnyPayload> 已被悄悄烙印在 dynamicBox 内部
    Any dynamicBox = originalPayload;

    // 3. 将 Any 传入黑盒处理函数
    ProcessAnyEvent(dynamicBox);

    // 4. 验证在黑盒中通过 Any 篡改的内存是否真实生效
#ifdef _KERNEL_MODE
    DbgPrint("Verifying original object memory...\n");
    if (originalPayload->version == 99.9f && originalPayload->isActivated == true) {
        DbgPrint("[PASS] Memory modified successfully across Any boundary!\n");
    }
    else {
        DbgPrint("[FAIL] Memory verification failed!\n");
    }
#else
    std::cout << "Verifying original object memory...\n";
    if (originalPayload->version == 99.9f && originalPayload->isActivated == true) {
        std::cout << "[PASS] Memory modified successfully across Any boundary!\n";
    }
    else {
        std::cout << "[FAIL] Memory verification failed!\n";
    }
#endif
}

static Any FindControlById(int targetId) {
    // 调用 Iterator 遍历栈
    for (auto it = ControlStack.begin(); it != ControlStack.end(); ++it) {
        // 中途赋值给临时变量 ControlBase*
        ControlBase* temp = *it;
        if (temp && temp->controlId == targetId) {
            // 再匹配返回，将基类指针再次隐式封入 Any 神匣
            return temp;
        }
    }
    return nullptr;
}

void AnyReflection() {
    std::cout << "\n======================================================\n";
    std::cout << " [TEST 13] Any Reflection, Move & Cast Validation\n";
    std::cout << "======================================================\n";

    // 匿名辅助函数：验证基础反射与生命周期转移
    auto processAnyData = [](Any argData, const char* expectedClassName) {
        bool isPass = true;

        Any localData = std::move(argData);
        auto meta = Reflec(localData);

        const char* className = meta.GetClassName();
        if (!className || strcmp(className, expectedClassName) != 0) {
            std::cout << "[ERROR] Class name mismatch. Expected: " << expectedClassName << ", Got: " << (className ? className : "NULL") << "\n";
            isPass = false;
        }

        std::cout << "  -> Detected Class : " << className << "\n";

        // 物理坐标绝对穿透与 SFINAE 动态调用
        if (strcmp(className, "Vector2D") == 0) {
            meta.SetValue("X", 99.0f);
            if (meta.GetValue<float>("X") != 99.0f) isPass = false;

            meta.Invoke("Scale", 2.0f);
            if (meta.GetValue<float>("X") != 198.0f) isPass = false;
        }
        else if (strcmp(className, "PlayerStats") == 0) {
            meta.SetValue("Health", 100);
            int result = meta.Invoke<int>("Heal", 50);
            if (result != 150 || meta.GetValue<int>("Health") != 150) isPass = false;
        }

        if (isPass) {
            std::cout << "[PASS] " << expectedClassName << " reflection pipeline verified.\n\n";
        }
        else {
            std::cout << "[FAIL] " << expectedClassName << " reflection pipeline encountered errors.\n\n";
        }
        };

    // -----------------------------------------------------
    // 执行注入测试
    // -----------------------------------------------------
    try {
        // 测试 A & B: 基础物理数据结构
        auto vec = New<Vector2D>();
        vec->X = 1.0f; vec->Y = 2.0f;
        processAnyData(vec, "Vector2D");

        auto player = New<PlayerStats>();
        player->Health = 50; player->Mana = 100;
        processAnyData(player, "PlayerStats");

        // -----------------------------------------------------
        // 测试 C: HelixUI 控件系统 - Any 多态强转解包测试
        // -----------------------------------------------------
        std::cout << " --- Testing Polymorphic Control Cast ---\n";
        auto btn = New<ButtonControl>();
        Any self = btn;

        // 1. 验证 C 风格隐式强转解包
        ControlBase* basePtr = (ControlBase*)self;
        if (basePtr) {
            // 2. 验证 C++ 虚表 (vtable) 多态是否完好存活
            std::cout << "  -> VTable Dispatch : " << basePtr->GetControlType() << "\n";

            if (strcmp(basePtr->GetControlType(), "ButtonControl") == 0) {
                // 3. 终极实战：拿着 (ControlBase*)self 作为参数传给反射引擎！
                auto modelMeta = Reflec(self);
                bool invokeRes = modelMeta.Invoke<bool>("OnClick", (ControlBase*)self, 42);

                if (invokeRes && modelMeta.GetValue<int>("clickCount") == 42) {
                    std::cout << "[PASS] Any pointer cast & vtable dispatch perfectly verified.\n\n";
                }
                else {
                    std::cout << "[FAIL] Polymorphic invoke execution failed.\n\n";
                }
            }
            else {
                std::cout << "[FAIL] VTable corrupted after Any cast.\n\n";
            }
        }
        else {
            std::cout << "[FAIL] (ControlBase*)self cast returned nullptr.\n\n";
        }

    }
    catch (const std::exception& e) {
        std::cout << "[FAIL] Runtime exception caught: " << e.what() << "\n";
    }
    catch (...) {
        std::cout << "[FAIL] Unknown exception encountered during testing.\n";
    }

    try {
        // 1. 初始化派生类并封入 Any
        auto panel = New<PanelControl>();
        panel->controlId = 9527;
        Any originalAny = panel;

        // 2. 将 Any 隐式强转为 ControlBase* 并压入线程局部栈
        ControlStack.push_back(originalAny);

        // 3. 通过遍历器查找，并以 Any 形式返回
        Any foundAny = FindControlById(9527);

        if (foundAny != nullptr) {
            // 4. 反射返回的 Any
            auto meta = Reflec(foundAny);
            std::cout << "  -> Re-Boxed Detected Class : " << meta.GetClassName() << "\n";

            // 5. 使用 Invoke 执行回调
            // 第一个参数是 ControlBase* (foundAny 隐式解包)，第二个是 const char*
            bool invokeRes = meta.Invoke<bool>("OnMessage", (ControlBase*)foundAny, "HelixUI Event Dispatched");

            // 验证执行结果
            if (invokeRes) {
                // 如果底层的 Any 构造时没有丢失多态信息（比如使用了 GetTypeHash<ControlBase> 的多态特化），
                // 那么它可以安全调用到派生类的成员。如果此处失败，说明需要升级引擎的 RTTI 哈希机制。
                std::cout << "[PASS] Control matched, returned, and invoked successfully.\n\n";
            }
            else {
                std::cout << "[FAIL] Invoke execution returned false.\n\n";
            }
        }
        else {
            std::cout << "[FAIL] Failed to find the control in the stack.\n\n";
        }
    }
    catch (const std::exception& e) {
        std::cout << "[FAIL] Runtime exception caught: " << e.what() << "\n";
    }
    catch (...) {
        std::cout << "[FAIL] Unknown exception encountered.\n";
    }

    // 清理测试现场
    ControlStack.clear();

    try {
        auto state = New<ArgProbeState>();
        Any model = state;
        auto meta = Reflec(model);

        // 构造虚假的发送者与属性名
        ControlBase* dummySender = (ControlBase*)(int)0xDEADBEEF;
        const char* propName = "Visible";
        std::string propStr = "Visible";

        std::cout << "\n--- Test A: Invoke(\"MethodA\", ControlBase*, const char*) ---\n";
        bool resA = false;
        try { resA = meta.Invoke<bool>("MethodA", dummySender, propName); }
        catch (...) {}
        std::cout << "Result: " << (resA ? "MATCHED" : "FAILED (Silent Mismatch)") << "\n";

        std::cout << "\n--- Test B: Invoke(\"MethodB\", ControlBase*, std::string) ---\n";
        bool resB = false;
        try { resB = meta.Invoke<bool>("MethodB", dummySender, propStr); }
        catch (...) {}
        std::cout << "Result: " << (resB ? "MATCHED" : "FAILED (Silent Mismatch)") << "\n";

        std::cout << "\n--- Test C: Invoke(\"MethodC\", void*, const char*) ---\n";
        bool resC = false;
        try { resC = meta.Invoke<bool>("MethodC", (void*)dummySender, propName); }
        catch (...) {}
        std::cout << "Result: " << (resC ? "MATCHED" : "FAILED (Silent Mismatch)") << "\n";

        std::cout << "\n--- Test D: Invoke(\"MethodD\", const char*) ---\n";
        bool resD = false;
        try { resD = meta.Invoke<bool>("MethodD", propName); }
        catch (...) {}
        std::cout << "Result: " << (resD ? "MATCHED" : "FAILED (Silent Mismatch)") << "\n";

        std::cout << "\n======================================================\n\n";
    }
    catch (const std::exception& e) {
        std::cout << "[ERROR] Exception during probe: " << e.what() << "\n";
    }

    try {
        // 注册接收端目标
        auto target = New<ReflecProbeTarget>();
        Any anyTarget = target;
        auto meta = Reflec(anyTarget);

        // 构造实体与指针
        StandardVirtualBase stdBase;
        PureVirtualDerived pureDerived;

        StandardVirtualBase* ptrStd = &stdBase;
        PureVirtualBase* ptrPure = &pureDerived;
        void* ptrVoid = &stdBase;

        const char* testMsg = "Probe_Signal";

        // ---------------------------------------------------------
        std::cout << "\n--- Probe 1: Passing StandardVirtualBase* ---\n";
        bool res1 = false;
        try { res1 = meta.Invoke<bool>("HandleStandard", ptrStd, testMsg); }
        catch (const std::exception& e) { std::cout << " Exception: " << e.what() << "\n"; }
        catch (...) { std::cout << " Unknown Exception!\n"; }
        std::cout << "Result: " << (res1 ? "MATCHED (Success)" : "FAILED (Silent Mismatch)") << "\n";

        // ---------------------------------------------------------
        std::cout << "\n--- Probe 2: Passing PureVirtualBase* (Abstract Class) ---\n";
        bool res2 = false;
        try { res2 = meta.Invoke<bool>("HandlePure", ptrPure, testMsg); }
        catch (const std::exception& e) { std::cout << " Exception: " << e.what() << "\n"; }
        catch (...) { std::cout << " Unknown Exception!\n"; }
        std::cout << "Result: " << (res2 ? "MATCHED (Success)" : "FAILED (Silent Mismatch)") << "\n";

        // ---------------------------------------------------------
        std::cout << "\n--- Probe 3: Passing void* (Type Erasure) ---\n";
        bool res3 = false;
        try { res3 = meta.Invoke<bool>("HandleVoid", ptrVoid, testMsg); }
        catch (const std::exception& e) { std::cout << " Exception: " << e.what() << "\n"; }
        catch (...) { std::cout << " Unknown Exception!\n"; }
        std::cout << "Result: " << (res3 ? "MATCHED (Success)" : "FAILED (Silent Mismatch)") << "\n";

        std::cout << "\n======================================================\n\n";
    }
    catch (const std::exception& e) {
        std::cout << "[ERROR] Critical Exception during probe setup: " << e.what() << "\n";
    }
}


int main(void** args) {
    if (!args) return 0;

    DWORD loadReason = (DWORD)(unsigned long long)args[2];
    void* lpvReserved = args[3];

    switch (loadReason) {
    case DLL_PROCESS_ATTACH:
    {
        CreateThread(nullptr, 0, [](LPVOID lpParam) -> DWORD {
            void** args = (void**)lpParam;

            std::cout << "========================================\n";
            std::cout << "  HELIX DLL ENGINE IGNITED! \n";
            std::cout << "========================================\n\n";

            std::cout << "[System] DLL Full Path : " << (char*)args[0] << "\n";
            std::cout << "[System] Module Base   : " << args[1] << "\n";
            std::cout << "[System] Load Reason   : DLL_PROCESS_ATTACH\n\n";

            TestSerializationAndReflection();
            TestGCAndPersistence();
            TestWinApiAndExtern();
            TestPolymorphism();
            TestVmpAnnotations();
            TestAdvancedVmp();
            TestLoopMemoryLeak();

            TestHelixSystemKeywords();
            TestKeywordMemoryLeak();
            TestDynamicApi();
            TestCrossRingSDKReflection();
            TestAnyDynamicReflection();
            AnyReflection();

            return 0;
            }, args, 0, nullptr);
    } break;

    case DLL_THREAD_ATTACH:
        break;

    case DLL_THREAD_DETACH:
        break;

    case DLL_PROCESS_DETACH:
   
        std::cout << "Releasing ComplexEntity ID " << g_p->entityId << " reclaimed.\n";
        std::cout << "\n[System] Load Reason   : DLL_PROCESS_DETACH\n";
        std::cout << "[System] Helix DLL is safely shutting down...\n";
        break;
    }

    return 0;
}

3. Sys

ComplexTest.h

#pragma once
#include <stddef.h>

// [跨 Ring 包含装甲]
// VSIX 引擎会自动将其隔离，并逆向提取出 Ring 3 的特有结构体
// 为 Ring 0 提供完美的 1:1 像素级 Polyfill 支持！
#if !defined(_KERNEL_MODE)
#include <Windows.h> // Helix Auto-Wrapped
#endif
#if !defined(_KERNEL_MODE)
#include <TlHelp32.h> // Helix Auto-Wrapped
#endif
#if !defined(_KERNEL_MODE)
#include <Psapi.h> // Helix Auto-Wrapped
#endif
#if !defined(_KERNEL_MODE)
#include <winternl.h> // Helix Auto-Wrapped
#endif
#if defined(_KERNEL_MODE)
#include <ntifs.h> // Helix Auto-Wrapped
#endif

#include "Helix.h"

using EventCallback = void (*)(int, const char*);

// [原生内核 API 声明]
// 使用引擎的 API 宏动态解析 ntoskrnl.exe 导出函数
API("ntoskrnl.exe") unsigned long NTAPI RtlRandomEx(unsigned long* Seed);
API("ntoskrnl.exe") NTSTATUS NTAPI _15(void* Param1);
API("ntoskrnl.exe") NTSTATUS NTAPI ZwQuerySystemInformation(ULONG SystemInformationClass, PVOID SystemInformation, ULONG SystemInformationLength, PULONG ReturnLength);

#pragma pack(push, 1)
struct SensorData {
public:
    short sensorId;
    Offset(2);
    union {
        float floatVal;
        int intVal;
    };
    char status;

    unsigned char flagA : 1;
    unsigned char flagB : 3;
    unsigned char flagC : 4;
};

class ComplexEntity {
public:
    int entityId;
    Offset(4);
    SensorData sensor;

    static ComplexEntity* staticBoss;
    Extern void* externalResource;
    ComplexEntity* childNode;

    Extern EventCallback onEventTriggered;

    ComplexEntity() = default;

    ComplexEntity(int id) : entityId(id) {
        DbgPrint("[Constructor] ComplexEntity ID %d created via parameterized constructor.\n", entityId);
    }

    ~ComplexEntity() {
        DbgPrint("[Destructor] ComplexEntity ID %d reclaimed.\n", entityId);
    }

    void ProcessData(int multiplier) {
        sensor.intVal *= multiplier;
        if (onEventTriggered) {
            onEventTriggered(entityId, "Data Processed successfully via callback!");
        }
    }
};

struct NestedPayload {
    void* rawPointers[3];
    ComplexEntity* entityList[2];
    int matrix[4];
};

class AdvancedArrayNode {
public:
    int nodeId;
    Offset(4);
    NestedPayload payload;

    AdvancedArrayNode() = default;

    AdvancedArrayNode(int id) : nodeId(id) {
        memset(&payload, 0, sizeof(payload));
        DbgPrint("[Constructor] AdvancedArrayNode ID %d created.\n", nodeId);
    }

    ~AdvancedArrayNode() {
        DbgPrint("[Destructor] AdvancedArrayNode ID %d reclaimed.\n", nodeId);
    }

    void MutateArray(int multiplier) {
        for (int i = 0; i < 4; i++) {
            payload.matrix[i] *= multiplier;
        }
    }
};
#pragma pack(pop)

class IWorker {
public:
    virtual ~IWorker() = default;
    virtual void ExecuteTask() = 0;
};

class BaseWorker : public IWorker {
public:
    int baseId;

    virtual void ExecuteTask() override {
        DbgPrint("[BaseWorker] Task executed by ID %d.\n", baseId);
    }

    virtual void Upgrade() {
        baseId += 1;
    }
};

class FinalWorker final : public BaseWorker {
public:
    int powerLevel;

    void ExecuteTask() override final {
        DbgPrint("[FinalWorker] Final task executed by ID %d with power %d.\n", baseId, powerLevel);
    }

    void Upgrade() override {
        powerLevel += 10;
    }

    ~FinalWorker() {
        DbgPrint("[Destructor] FinalWorker ID %d reclaimed.\n", baseId);
    }
};

class NativeResourceConfig {
public:
    DWORD targetPid;

    CLIENT_ID clientId;
    UNICODE_STRING imagePath;

    ~NativeResourceConfig() {
        DbgPrint("[Destructor] NativeResourceConfig PID %d reclaimed.\n", targetPid);
    }

    void InitNativeData() {
        clientId.UniqueProcess = (HANDLE)(ULONG_PTR)targetPid;
        clientId.UniqueThread = (HANDLE)0x1337;

        imagePath.Length = 10;
        imagePath.MaximumLength = 12;
        imagePath.Buffer = (PWSTR)L"Helix";
    }
};

inline void AssignGlobalPointer(Extern int** outPtr) {
    auto newInt = New<int>(9999);
    *outPtr = &newInt;
}

Vmp inline void VmpGlobalFunction(const char* message) {
    DbgPrint("  -> [Vmp Global] Executing protected global logic...\n");
    DbgPrint("  -> Message: %s\n", message);
}

class SecurityManager {
public:
    int secretCode = 0;

    Vmp static bool VerifyLicense(const char* key) {
        DbgPrint("  -> [Vmp Static] Verifying license key...\n");
        bool match = true;
        const char* secret = "SECRET-KEY";
        for (int i = 0; i < 10; ++i) { if (key[i] != secret[i]) match = false; }

        if (match) {
            DbgPrint("[Vmp] License Verified Successfully!\n");
            return true;
        }
        return false;
    }

    Vmp void ExecutePayload() {
        secretCode ^= 0x55;
        DbgPrint("  -> [Vmp Member] Payload executed. Secret code mutated to: %d\n", secretCode);
    }

    Vmp int ComplexVmpLogic(int multiplier) {
        int tempCode = 10;
        this->secretCode += (tempCode * multiplier);

        if (this->secretCode > 10) {
            tempCode = 999;
        }

        ExecutePayload();

        return this->secretCode + tempCode;
    }
};

extern ComplexEntity* g_VmpGlobalNode;

class VmpAdvancedTester {
public:
    static ComplexEntity* staticNode;
    Extern ComplexEntity* externDataNode;

    Vmp void RecursiveAllocTest(int depth, Extern ComplexEntity** outParam) {
        if (depth <= 0) return;

        for (int i = 0; i < 2; i++) {
            auto node = New<ComplexEntity>(depth * 100 + i);

            if (depth == 1 && i == 1 && outParam != nullptr) {
                *outParam = &node;
            }
        }

        RecursiveAllocTest(depth - 1, outParam);
    }

    Vmp void LoopAllocAndAssign() {
        for (int i = 1; i <= 5; i++) {
            auto node = New<ComplexEntity>(i * 1000);

            if (i == 2) {
                g_VmpGlobalNode = &node;
            }
            else if (i == 3) {
                staticNode = &node;
            }
            else if (i == 5) {
                externDataNode = &node;
            }
        }
    }
};


struct TestAnyPayload {
    int magicCode;
    float version;
    bool isActivated;

    // 供动态调用的测试方法
    void PrintStatus() {
#ifdef _KERNEL_MODE
        DbgPrint("      -> [TestAnyPayload::PrintStatus] Magic: 0x%X, Version: %.2f, Activated: %s\n",
            magicCode, version, isActivated ? "TRUE" : "FALSE");
#else
        std::cout << "      -> [TestAnyPayload::PrintStatus] Magic: 0x"
            << std::hex << std::uppercase << magicCode << std::dec
            << ", Version: " << std::fixed << std::setprecision(2) << version
            << ", Activated: " << (isActivated ? "TRUE" : "FALSE") << "\n";
#endif
    }

    ~TestAnyPayload()
    {
#ifdef _KERNEL_MODE
        DbgPrint("[Destructor] magicCode %d reclaimed.\n", magicCode);
#else
        std::cout << "[Destructor] magicCode " << std::dec << magicCode << " reclaimed.\n";
#endif
    }
};

// 基础结构定义
struct Vector2D {
    float X;
    float Y;
    void Scale(float factor) {
        X *= factor;
        Y *= factor;
    }
};

struct PlayerStats {
    int Health;
    int Mana;
    int Heal(int amount) {
        Health += amount;
        return Health;
    }
};

class ControlBase {
public:
    int controlId = 0;
    virtual ~ControlBase() = default;
    virtual const char* GetControlType() { return "ControlBase"; }
};

// 具体的按钮控件
class ButtonControl : public ControlBase {
public:
    int clickCount = 0;

    const char* GetControlType() override { return "ButtonControl"; }

    // 模拟事件回调：接收发起者指针与参数
    bool OnClick(ControlBase* sender, int arg) {
        if (sender) {
            clickCount += arg;
            return true;
        }
        return false;
    }
};

// 具体的面板控件
class PanelControl : public ControlBase {
public:
    int messageCount = 0;

    const char* GetControlType() override { return "PanelControl"; }

    // 目标 Invoke 函数：参数 (ControlBase*, const char*)
    bool OnMessage(ControlBase* sender, const char* msg) {
        if (sender && msg) {
            DbgPrint("    [Panel] Received message: %s from sender ID: %d\n", msg, sender->controlId);
            messageCount++;
            return true;
        }
        return false;
    }
};

// 模拟线程局部控件栈 (剥离 STL)
#define MAX_CONTROL_STACK 16
inline static ControlBase* ControlStack[MAX_CONTROL_STACK];
inline static int ControlStackCount = 0;

// 专用于刺探 Reflec 参数匹配机制的测试模型
class ArgProbeState {
public:
    // 测试 A：完全对应当前工程的签名
    bool MethodA(ControlBase* sender, const char* prop) {
        DbgPrint("    -> MethodA (ControlBase*, const char*) Invoked!\n");
        return true;
    }

    // 测试 B：(内核无 std::string，替换为按值传递 int)
    bool MethodB(ControlBase* sender, int propId) {
        DbgPrint("    -> MethodB (ControlBase*, int) Invoked! ID: %d\n", propId);
        return true;
    }

    // 测试 C：参数 1 退化为 void*
    bool MethodC(void* sender, const char* prop) {
        DbgPrint("    -> MethodC (void*, const char*) Invoked!\n");
        return true;
    }

    // 测试 D：只传 1 个参数 const char*
    bool MethodD(const char* prop) {
        DbgPrint("    -> MethodD (const char*) Invoked!\n");
        return true;
    }
};

// [类型 A]：普通多态基类（带普通虚函数）
class StandardVirtualBase {
public:
    virtual ~StandardVirtualBase() = default;
    virtual const char* GetName() { return "StandardVirtualBase"; }
};

// [类型 B]：纯虚基类（Abstract Class）
class PureVirtualBase {
public:
    virtual ~PureVirtualBase() = default;
    virtual const char* GetName() = 0;
};

// 用于实例化纯虚基类的派生类
class PureVirtualDerived : public PureVirtualBase {
public:
    const char* GetName() override { return "PureVirtualDerived"; }
};

// 2. 定义接收端目标类（模拟 AppState）
class ReflecProbeTarget {
public:
    // 测试 1：期望接收普通虚类指针
    bool HandleStandard(StandardVirtualBase* sender, const char* msg) {
        DbgPrint("    [Target] HandleStandard Invoked! sender: %p, msg: %s\n", (void*)sender, msg);
        return true;
    }

    // 测试 2：期望接收纯虚基类指针
    bool HandlePure(PureVirtualBase* sender, const char* msg) {
        DbgPrint("    [Target] HandlePure Invoked! sender: %p, msg: %s\n", (void*)sender, msg);
        return true;
    }

    // 测试 3：期望接收 void* 降维指针
    bool HandleVoid(void* sender, const char* msg) {
        DbgPrint("    [Target] HandleVoid Invoked! sender: %p, msg: %s\n", sender, msg);
        return true;
    }
};

Main.cpp

#include "ComplexTest.h"

ComplexEntity* ComplexEntity::staticBoss = nullptr;
void* g_PersistentWeapon = nullptr;
int* g_PersistentInt = nullptr;
ComplexEntity* g_VmpGlobalNode = nullptr;
ComplexEntity* VmpAdvancedTester::staticNode = nullptr;

void GlobalEventLogger(int id, const char* msg) {
    DbgPrint("    -> [Callback Invoked] Entity %d reported: %s\n", id, msg);
}


DWORD FindProcessId(const char* processName) {
    DWORD pid = 0;
    ULONG bufferSize = 0;

    // SystemProcessInformation = 5
    ZwQuerySystemInformation(5, NULL, 0, &bufferSize);
    if (bufferSize == 0) return 0;

    void* buffer = Allocate((uint32_t)-1, bufferSize + 0x2000);
    if (!buffer) return 0;

    if (NT_SUCCESS(ZwQuerySystemInformation(5, buffer, bufferSize + 0x2000, &bufferSize))) {
        auto spi = (SYSTEM_PROCESS_INFORMATION*)buffer;
        while (true) {
            if (spi->ImageName.Buffer && spi->ImageName.Length > 0) {
                char exeName[260] = { 0 };
                ULONG len = spi->ImageName.Length / 2;
                for (ULONG i = 0; i < len && i < 259; i++) {
                    exeName[i] = (char)spi->ImageName.Buffer[i];
                }
                
                bool match = true;
                for (int i = 0; i < 260; i++) {
                    char c1 = exeName[i];
                    char c2 = processName[i];
                    if (c1 >= 'A' && c1 <= 'Z') c1 += 32;
                    if (c2 >= 'A' && c2 <= 'Z') c2 += 32;
                    if (c1 != c2) { match = false; break; }
                    if (c1 == '\0') break;
                }

                if (match) {
                    pid = (DWORD)(uintptr_t)spi->UniqueProcessId;
                    break;
                }
            }
            if (spi->NextEntryOffset == 0) break;
            spi = (SYSTEM_PROCESS_INFORMATION*)((PUCHAR)spi + spi->NextEntryOffset);
        }
    }
    return pid;
}

void TestSerializationAndReflection() {
    DbgPrint("=== Test 1: Complex Serialization & Reflection ===\n");

    auto assertTest = [](bool condition, const char* msg) {
        if (condition) DbgPrint("[PASS] %s\n", msg);
        else DbgPrint("[FAIL] %s\n", msg);
        };

    auto entity = New<ComplexEntity>(1024);
    entity->sensor.sensorId = 7;
    entity->sensor.floatVal = 3.14f;
    entity->sensor.status = 'A';
    entity->sensor.flagA = 1;
    entity->sensor.flagB = 5;
    entity->sensor.flagC = 10;
    entity->onEventTriggered = GlobalEventLogger;

    auto bytes = Serialize(entity);
    auto cloned = Deserialize<ComplexEntity>(bytes);

    assertTest(cloned.entityId == 1024, "Deserialization restored entityId on Stack Obj");
    assertTest(cloned.onEventTriggered == GlobalEventLogger, "Deserialization flawlessly restored function pointer");

    auto meta = Reflec(cloned);
    meta.SetValue("entityId", 2048);
    assertTest(cloned.entityId == 2048, "Reflection SetValue correctly modified local Stack Obj memory");

    DbgPrint("  --> Testing Deep Nested Reflection (xxxx.yyyy)...\n");

    auto childEnt = New<ComplexEntity>(888);
    childEnt->sensor.sensorId = 42;
    childEnt->sensor.intVal = 10;
    cloned.childNode = childEnt;
    childEnt->onEventTriggered = nullptr;

    int childId = meta.GetValue<int>("childNode.entityId");
    assertTest(childId == 888, "Nested GetValue traversed pointer 'childNode' to read 'entityId'");

    short fetchedSensorId = meta.GetValue<short>("childNode.sensor.sensorId");
    assertTest(fetchedSensorId == 42, "Nested GetValue penetrated multiple levels (childNode.sensor.sensorId)");

    float localfloatVal = meta.GetValue<float>("sensor.floatVal");
    assertTest(localfloatVal > 3.1f && localfloatVal < 3.2f, "Nested GetValue read local value-type nested struct (sensor.floatVal)");

    meta.SetValue("childNode.sensor.sensorId", (short)999);
    assertTest(cloned.childNode->sensor.sensorId == 999, "Nested SetValue mutated deep pointer structure field");

    meta.SetValue("sensor.status", 'Z');
    assertTest(cloned.sensor.status == 'Z', "Nested SetValue mutated local value-type nested struct (sensor.status)");

    meta.Invoke("childNode.ProcessData", 5);
    assertTest(cloned.childNode->sensor.intVal == 50, "Nested Invoke dynamically resolved target and executed method with arguments");

    DbgPrint("  --> Testing Nested Arrays (T[n], T*[n], void*[n])...\n");
    AdvancedArrayNode advNode(7777);
    advNode.payload.rawPointers[0] = (void*)(intptr_t)0xDEADBEEF;
    advNode.payload.rawPointers[1] = (void*)(intptr_t)0xCAFEBABE;
    advNode.payload.entityList[0] = (ComplexEntity*)entity;
    advNode.payload.matrix[0] = 10;
    advNode.payload.matrix[1] = 20;

    auto advBytes = Serialize(advNode);
    auto advCloned = Deserialize<AdvancedArrayNode>(advBytes);

    assertTest(advCloned.nodeId == 7777, "Nested array deserialization preserved base attributes");
    assertTest(advCloned.payload.rawPointers[0] == (void*)(intptr_t)0xDEADBEEF, "Nested array deserialization flawlessly restored void*[n]");
    assertTest(advCloned.payload.entityList[0] == (ComplexEntity*)entity, "Nested array deserialization flawlessly restored T*[n]");
    assertTest(advCloned.payload.matrix[1] == 20, "Nested array deserialization flawlessly restored T[n]");

    auto advMeta = Reflec(advCloned);
    advMeta.Invoke("MutateArray", 5);
    assertTest(advCloned.payload.matrix[0] == 50 && advCloned.payload.matrix[1] == 100, "SFINAE Reflection dynamically executed method on Nested Array Stack Object");

    int testArr[3] = { 100, 200, 300 };
    auto arrBytes = Serialize<int[3]>(testArr);
    auto arrCloned = Deserialize<int[3]>(arrBytes);
    assertTest(arrCloned[0] == 100 && arrCloned[2] == 300, "Direct TypeTrait Deserialize<T[n]> successfully extracted HArray");

    DbgPrint("\n");
}

void TestGCAndPersistence() {
    DbgPrint("=== Test 2: GC Persistence & Extern Validation ===\n");
    {
        auto tempObj = New<ComplexEntity>(1);
        auto bossObj = New<ComplexEntity>(999);
        ComplexEntity::staticBoss = &bossObj;
        auto weaponObj = New<ComplexEntity>(888);
        g_PersistentWeapon = &weaponObj;
        auto extObj = New<ComplexEntity>(777);
        bossObj->externalResource = &extObj;
        auto childObj = New<ComplexEntity>(666);
        tempObj->childNode = &childObj;
    }
    DbgPrint("--- Inner scope ended. Only ID 1 and 666 should be reclaimed! ---\n\n");
}

void TestWinApiAndExtern() {
    DbgPrint("=== Test 3: Windows Native Struct & Extern Pointer ===\n");
    auto assertTest = [](bool condition, const char* msg) {
        if (condition) DbgPrint("[PASS] %s\n", msg);
        else DbgPrint("[FAIL] %s\n", msg);
        };

    auto nativeCfg = New<NativeResourceConfig>();
    nativeCfg->targetPid = (DWORD)(uintptr_t)PsGetCurrentProcessId();

    auto meta = Reflec(nativeCfg);
    meta.Invoke("InitNativeData");
    assertTest(nativeCfg->clientId.UniqueProcess == (HANDLE)(ULONG_PTR)nativeCfg->targetPid, "Reflection Invoked method updating CLIENT_ID struct natively");

    AssignGlobalPointer(&g_PersistentInt);
    assertTest(g_PersistentInt != nullptr && *g_PersistentInt == 9999, "Extern int** successfully exported GC pointer using & operator");
    DbgPrint("\n");
}

void TestPolymorphism() {
    DbgPrint("=== Test 4: Polymorphism & Keywords (virtual, override, final) ===\n");
    auto finalObj = New<FinalWorker>();
    finalObj->baseId = 100;
    finalObj->powerLevel = 9000;
    IWorker* interfacePtr = &finalObj;
    DbgPrint("    ");
    interfacePtr->ExecuteTask();
    DbgPrint("\n");
}

void TestVmpAnnotations() {
    DbgPrint("=== Test 5: Vmp Control Flow Flattening & Obfuscation ===\n");
    VmpGlobalFunction("This is a VMP protected global function!");
    auto secMgr = New<SecurityManager>();
    secMgr->ExecutePayload();
    DbgPrint("\n");
}

void TestAdvancedVmp() {
    DbgPrint("=== Test 6: Advanced Vmp (Recursion, Loops, Global, Static & Extern) ===\n");
    auto tester = New<VmpAdvancedTester>();
    tester->LoopAllocAndAssign();
    ComplexEntity* recursiveOut = nullptr;
    tester->RecursiveAllocTest(3, &recursiveOut);
    DbgPrint("\n");
}

void TestLoopMemoryLeak() {
    DbgPrint("=== Test 7: Loop Memory Leak Prevention ===\n");
    for (int i = 0; i < 5; i++) {
        void* p = New<ComplexEntity>(8000 + i);
    }
    DbgPrint("\n");
}

void TestHelixSystemKeywords() {
    DbgPrint("=== Test 8: Helix System Keywords & Multi-Dimensional Read/Write ===\n");
    auto assertTest = [](bool condition, const char* msg) {
        if (condition) DbgPrint("[PASS] %s\n", msg);
        else DbgPrint("[FAIL] %s\n", msg);
        };

    // 1. 获取系统信息 (System Keyword)
    auto sys = System();
    if (sys != nullptr) {
        DbgPrint("[System] OS: %s v%u.%u (Build %u)\n",
            sys->OSName, sys->MajorVersion, sys->MinorVersion, sys->BuildNumber);
        DbgPrint("[System] HWID: %s\n", sys->SerialNumber);
    }

    // 2. 获取 CPU 信息 (Cpu Keyword)
    auto cpu = Cpu();
    if (cpu != nullptr) {
        DbgPrint("[Cpu] Vendor: %s | Brand: %s\n", cpu->Vendor, cpu->Brand);
        DbgPrint("[Cpu] Model: %s | Serial: %s\n", cpu->ModelName, cpu->SerialNumber);
    }

    // 3. 获取物理网卡 MAC 阵列 (Mac Keyword)
    auto macs = Mac();
    if (macs != nullptr && macs->size() > 0) {
        DbgPrint("[Mac] Found %I64u Network Adapter(s):\n", (uint64_t)macs->size());
        for (size_t i = 0; i < macs->size(); i++) {
            DbgPrint("  -> [%I64u] %s (%s)\n",
                (uint64_t)i, (*macs)[i].MacAddress, (*macs)[i].Description);
        }
    }

    // 4. 获取磁盘信息阵列 (Disk Keyword)，例如Disk("c")
    auto disks = Disk();
    if (disks != nullptr && disks->size() > 0) {
        DbgPrint("[Disk] Found %I64u Storage Drive(s):\n", (uint64_t)disks->size());
        for (size_t i = 0; i < disks->size(); i++) {
            // 内核安全浮点模拟：分离整数位与百分位 (保留两位小数精度)
            uint64_t gbDivisor = 1024ULL * 1024ULL * 1024ULL;

            uint64_t totalGbInt = (*disks)[i].TotalSize / gbDivisor;
            uint64_t totalGbFrac = (((*disks)[i].TotalSize % gbDivisor) * 100ULL) / gbDivisor;

            uint64_t freeGbInt = (*disks)[i].FreeSpace / gbDivisor;
            uint64_t freeGbFrac = (((*disks)[i].FreeSpace % gbDivisor) * 100ULL) / gbDivisor;

            DbgPrint("  -> %s | Model: %s | Serial: %s\n",
                (*disks)[i].DriveLetter, (*disks)[i].Model, (*disks)[i].SerialNumber);
            DbgPrint("     Space: %I64u.%02I64u GB Free / %I64u.%02I64u GB Total\n",
                freeGbInt, freeGbFrac, totalGbInt, totalGbFrac);
        }
    }
    DbgPrint("\n");

    DbgPrint("  --> Testing Local Bypass (PID = -1) Read/Write/Allocate...\n");
    void* localMem = Allocate((uint32_t)-1, sizeof(int));
    if (localMem) {
        int payload = 7777;
        Write((uint32_t)-1, localMem, payload);
        auto pureVal = Read<int>((uint32_t)-1, localMem);
        assertTest(pureVal == 7777, "Local Bypass (-1) flawlessly allocated, wrote, and read stack value via zero-overhead fast path");
    }

    DWORD notepadPid = FindProcessId("notepad.exe");

    if (notepadPid == 0) {
        DbgPrint("  --> notepad.exe not found. Please open notepad.exe manually for cross-process tests.\n");
    }
    else {
        DbgPrint("  --> notepad.exe found! PID: %u\n", notepadPid);

        void* pRemoteMem = Allocate(notepadPid, sizeof(int));
        int remoteAddrInt = (int)(intptr_t)pRemoteMem;

        if (pRemoteMem) {
            int payload = 1337;
            Write(notepadPid, pRemoteMem, payload);

            auto pureVal = Read<int>(notepadPid, pRemoteMem);
            assertTest(pureVal == 1337, "Read<T> flawlessly retrieved memory directly as stack value");
        }

        DbgPrint("  --> Testing Cross-Process Nested Arrays Write/Read (T[n], T*[n], void*[n])...\n");

        AdvancedArrayNode localAdvArr[2] = { AdvancedArrayNode(8888), AdvancedArrayNode(9999) };
        localAdvArr[0].payload.rawPointers[0] = (void*)(intptr_t)0x11112222;
        localAdvArr[0].payload.entityList[1] = (ComplexEntity*)(intptr_t)0x33334444;
        localAdvArr[1].payload.matrix[3] = 777;

        void* remoteAdvArray = Allocate(notepadPid, sizeof(AdvancedArrayNode) * 2);

        if (remoteAdvArray != nullptr) {
            int wStatus = Write<AdvancedArrayNode[2]>(notepadPid, remoteAdvArray, localAdvArr);
            assertTest(wStatus == 1, "Write<T[n]> successfully injected Array of Nested Structs (AdvancedArrayNode[2])");

            auto readAdvArr = Read<AdvancedArrayNode[2]>(notepadPid, remoteAdvArray);
            assertTest(readAdvArr[0].nodeId == 8888 && readAdvArr[1].nodeId == 9999, "Read<T[n]> effortlessly retrieved Array Objects");
            assertTest(readAdvArr[0].payload.rawPointers[0] == (void*)(intptr_t)0x11112222, "Read<T[n]> meticulously extracted nested void*[n]");
            assertTest(readAdvArr[0].payload.entityList[1] == (ComplexEntity*)(intptr_t)0x33334444, "Read<T[n]> meticulously extracted nested T*[n]");
            assertTest(readAdvArr[1].payload.matrix[3] == 777, "Read<T[n]> meticulously extracted nested T[n] from second element");

            void* rawPointersAddr = (void*)((uintptr_t)remoteAdvArray + offsetof(AdvancedArrayNode, payload) + offsetof(NestedPayload, rawPointers));
            auto remoteVoidArray = Read<void* [3]>(notepadPid, rawPointersAddr);
            assertTest(remoteVoidArray[0] == (void*)(intptr_t)0x11112222, "Read<void*[n]> explicitly pinpointed and extracted subset void* array");

            DbgPrint("  --> Simulated memory tracker recorded void* allocations (%x) for AST cleanup.\n", remoteAddrInt);
        }
    }
    DbgPrint("\n");
}

ComplexEntity* g_p;

Vmp void TestKeywordMemoryLeak() {
    DbgPrint("=== Test 9: Keyword Zero-Leak Stress Test (10 Iterations) ===\n");

    auto pmcTest = New<PROCESS_MEMORY_COUNTERS>();
    pmcTest->WorkingSetSize = 1024;

    int dummyVar = 42;

    DbgPrint("  --> Running 10 iterations of New, Cpu, System, Mac, Disk, Read, and Allocate (using Local Bypass -1)...\n");
    for (int i = 0; i < 10; i++) {
        auto cpu = Cpu();
        auto sys = System();
        //auto macs = Mac();//无内存泄漏
        auto disks = Disk();
        auto pureVal = Read<int>((uint32_t)-1, &dummyVar);
        auto dummyObj = New<ComplexEntity>(99000 + i);
        void* remoteMem = Allocate((uint32_t)-1, 256);

        //测试基本数据类型
        auto basicInt = New<int>();
        auto basicFloatArr = New<float[3]>();//非内存泄漏
        auto refBasicFloatArray = Reflec(basicFloatArr);
    }
    g_p = (ComplexEntity*) Allocate((uint32_t)-1, sizeof(ComplexEntity)); 
    
    g_p->entityId = 1038;

    DbgPrint("[PASS] 10 iterations completed (Including Allocate). Polyfilled Struct Value: %llu\n", (unsigned long long)pmcTest->WorkingSetSize);
    DbgPrint("\n");
}

void TestDynamicApi() {
    DbgPrint("=== Test 10: Dynamic API Keyword (Ring 0) ===\n");

    unsigned long seed = 0x1337;
    unsigned long randomVal = RtlRandomEx(&seed);

    if (randomVal != 0) {
        DbgPrint("[PASS] API Keyword triggered seamlessly! Random Value: %lu (New Seed: %lu)\n", randomVal, seed);
    }
    else {
        DbgPrint("[FAIL] API Keyword failed or returned 0.\n");
    }

    void* funcPtr15 = (void*)_15;
    if (funcPtr15 != nullptr) {
        DbgPrint("[PASS] Ring 0 Ordinal (ntoskrnl.exe #15) Resolved successfully to: %p\n", funcPtr15);
    }
    else {
        DbgPrint("[FAIL] Ring 0 Ordinal failed to resolve.\n");
    }
    DbgPrint("\n");
}

void TestCrossRingSDKReflection() {
    auto assertTest = [](bool condition, const char* msg) {
        if (condition) DbgPrint("[PASS] %s\n", msg);
        else DbgPrint("[FAIL] %s\n", msg);
        };

    DbgPrint("=== Test 11: Cross-Ring Native SDK Struct Reflection ===\n");

    auto clientIdObj = New<CLIENT_ID>();
    auto metaClientWrite = Reflec(clientIdObj);

    metaClientWrite.SetValue("UniqueProcess", (HANDLE)(intptr_t)0x1234);
    metaClientWrite.SetValue("UniqueThread", (HANDLE)(intptr_t)0x5678);

    auto cidBytes = Serialize(clientIdObj);
    auto cidCloned = Deserialize<CLIENT_ID>(cidBytes);
    auto metaClientRead = Reflec(cidCloned);

    assertTest(metaClientRead.GetValue<HANDLE>("UniqueProcess") == (HANDLE)(intptr_t)0x1234,
        "Deserialize<CLIENT_ID> successfully restored Native SDK Struct (UniqueProcess)");

    metaClientRead.SetValue("UniqueThread", (HANDLE)(intptr_t)0x9999);
    assertTest(metaClientRead.GetValue<HANDLE>("UniqueThread") == (HANDLE)(intptr_t)0x9999,
        "Reflec<CLIENT_ID> successfully modified Native SDK Struct field dynamically");

    auto listEntryObj = New<LIST_ENTRY>();
    auto metaListWrite = Reflec(listEntryObj);
    metaListWrite.SetValue("Flink", (PLIST_ENTRY)(intptr_t)0xAAAA);
    metaListWrite.SetValue("Blink", (PLIST_ENTRY)(intptr_t)0xBBBB);

    auto listBytes = Serialize(listEntryObj);
    auto listCloned = Deserialize<LIST_ENTRY>(listBytes);
    auto metaListRead = Reflec(listCloned);

    assertTest(metaListRead.GetValue<PLIST_ENTRY>("Blink") == (PLIST_ENTRY)(intptr_t)0xBBBB,
        "Deserialize<LIST_ENTRY> successfully restored Doubly-Linked List node");

    metaListRead.SetValue("Flink", (PLIST_ENTRY)(intptr_t)0xCCCC);
    assertTest(metaListRead.GetValue<PLIST_ENTRY>("Flink") == (PLIST_ENTRY)(intptr_t)0xCCCC,
        "Reflec<LIST_ENTRY> successfully modified Doubly-Linked List field dynamically");

    auto mdlObj = New<MDL>();
    auto metaMdlWrite = Reflec(mdlObj);

    metaMdlWrite.SetValue("Size", (short)1024);
    metaMdlWrite.SetValue("MdlFlags", (short)0x0004);
    metaMdlWrite.SetValue("ByteCount", (unsigned long)4096);

    auto mdlBytes = Serialize(mdlObj);
    auto mdlCloned = Deserialize<MDL>(mdlBytes);
    auto metaMdlRead = Reflec(mdlCloned);

    assertTest(metaMdlRead.GetValue<unsigned long>("ByteCount") == 4096,
        "Deserialize<MDL> successfully restored Kernel-Only Struct (ByteCount)");

    metaMdlRead.SetValue("MdlFlags", (short)0x0008);
    assertTest(metaMdlRead.GetValue<short>("MdlFlags") == 0x0008,
        "Reflec<MDL> successfully modified Kernel-Only Struct field dynamically");

    auto sysTimeObj = New<SYSTEMTIME>();
    auto metaSysTimeWrite = Reflec(sysTimeObj);

    metaSysTimeWrite.SetValue("wYear", (unsigned short)2026);
    metaSysTimeWrite.SetValue("wMonth", (unsigned short)8);

    auto sysTimeBytes = Serialize(sysTimeObj);
    auto sysTimeCloned = Deserialize<SYSTEMTIME>(sysTimeBytes);
    auto metaSysTimeRead = Reflec(sysTimeCloned);

    assertTest(metaSysTimeRead.GetValue<unsigned short>("wMonth") == 8,
        "Deserialize<SYSTEMTIME> successfully restored User-Only Struct (wMonth) inside Ring 0 via Polyfill");

    metaSysTimeRead.SetValue("wYear", (unsigned short)2099);
    assertTest(metaSysTimeRead.GetValue<unsigned short>("wYear") == 2099,
        "Reflec<SYSTEMTIME> successfully modified User-Only Struct field dynamically inside Ring 0 via Polyfill");

    DbgPrint("\n");
}


void ProcessAnyEvent(Any payload) {
#ifdef _KERNEL_MODE
    DbgPrint("Entering ProcessAnyEvent with Any payload...\n");
#else
    std::cout << "Entering ProcessAnyEvent with Any payload...\n";
#endif

    // 1. 瞬间提权：从虚空中唤醒对象的真实灵魂
    auto meta = Reflec(payload);

    // 2. 动态内省：获取真实类名
    const char* className = meta.GetClassName();
#ifdef _KERNEL_MODE
    DbgPrint("Dynamically resolved ClassName: %s\n", className ? className : "UNKNOWN");
    if (className && strcmp(className, "TestAnyPayload") == 0) {
        DbgPrint("[PASS] ClassName perfectly matched!\n");
    }
    else {
        DbgPrint("[FAIL] ClassName mismatch or Unknown!\n");
    }
#else
    std::cout << "Dynamically resolved ClassName: " << (className ? className : "UNKNOWN") << "\n";
    if (className && strcmp(className, "TestAnyPayload") == 0) {
        std::cout << "[PASS] ClassName perfectly matched!\n";
    }
    else {
        std::cout << "[FAIL] ClassName mismatch or Unknown!\n";
    }
#endif

    // 3. 动态内省：遍历打印所有字段和方法
    int fieldCount = meta.GetFieldCount();
#ifdef _KERNEL_MODE
    DbgPrint("  [+] Field Count: %d\n", fieldCount);
    for (int i = 0; i < fieldCount; i++) {
        DbgPrint("      - Field[%d]: %s\n", i, meta.GetFieldName(i));
    }
#else
    std::cout << "  [+] Field Count: " << fieldCount << "\n";
    for (int i = 0; i < fieldCount; i++) {
        std::cout << "      - Field[" << i << "]: " << meta.GetFieldName(i) << "\n";
    }
#endif

    int methodCount = meta.GetMethodCount();
#ifdef _KERNEL_MODE
    DbgPrint("  [+] Method Count: %d\n", methodCount);
    for (int i = 0; i < methodCount; i++) {
        DbgPrint("      - Method[%d]: %s\n", i, meta.GetMethodName(i));
    }
#else
    std::cout << "  [+] Method Count: " << methodCount << "\n";
    for (int i = 0; i < methodCount; i++) {
        std::cout << "      - Method[" << i << "]: " << meta.GetMethodName(i) << "\n";
    }
#endif

    // 4. 深度穿透读写
    int oldMagic = meta.GetValue<int>("magicCode", 0);
#ifdef _KERNEL_MODE
    DbgPrint("Read 'magicCode': 0x%X\n", oldMagic);
#else
    std::cout << "Read 'magicCode': 0x" << std::hex << std::uppercase << oldMagic << std::dec << "\n";
#endif

    bool setRes = meta.SetValue("version", 99.9f);
    meta.SetValue("isActivated", true);

#ifdef _KERNEL_MODE
    if (setRes) {
        DbgPrint("[PASS] SetValue on 'version' succeeded!\n");
    }
    else {
        DbgPrint("[FAIL] SetValue failed!\n");
    }

    // 5. 动态方法调用 (Invoke)
    DbgPrint("Invoking 'PrintStatus' dynamically:\n");
#else
    if (setRes) {
        std::cout << "[PASS] SetValue on 'version' succeeded!\n";
    }
    else {
        std::cout << "[FAIL] SetValue failed!\n";
    }

    // 5. 动态方法调用 (Invoke)
    std::cout << "Invoking 'PrintStatus' dynamically:\n";
#endif
    meta.Invoke("PrintStatus");
}

void TestAnyDynamicReflection() {
#ifdef _KERNEL_MODE
    DbgPrint("========== [Test 12] Any Dynamic Reflection & Introspection ==========\n");
#else
    std::cout << "========== [Test 12] Any Dynamic Reflection & Introspection ==========\n";
#endif

    // 1. 创建强类型的托管对象
    auto originalPayload = New<TestAnyPayload>();
    originalPayload->magicCode = 1001;
    originalPayload->version = 1.0f;
    originalPayload->isActivated = false;

    // 2. 发生隐式类型擦除：强类型 -> Any 
    // 此时 GetTypeHash<TestAnyPayload> 已被悄悄烙印在 dynamicBox 内部
    Any dynamicBox = originalPayload;

    // 3. 将 Any 传入黑盒处理函数
    ProcessAnyEvent(dynamicBox);

    // 4. 验证在黑盒中通过 Any 篡改的内存是否真实生效
#ifdef _KERNEL_MODE
    DbgPrint("Verifying original object memory...\n");
    if (originalPayload->version == 99.9f && originalPayload->isActivated == true) {
        DbgPrint("[PASS] Memory modified successfully across Any boundary!\n");
    }
    else {
        DbgPrint("[FAIL] Memory verification failed!\n");
    }
#else
    std::cout << "Verifying original object memory...\n";
    if (originalPayload->version == 99.9f && originalPayload->isActivated == true) {
        std::cout << "[PASS] Memory modified successfully across Any boundary!\n";
    }
    else {
        std::cout << "[FAIL] Memory verification failed!\n";
    }
#endif
}

static Any FindControlById(int targetId) {
    for (int i = 0; i < ControlStackCount; ++i) {
        ControlBase* temp = ControlStack[i];
        if (temp && temp->controlId == targetId) {
            return temp;
        }
    }
    return nullptr;
}

void AnyReflection() {
    DbgPrint("\n[TEST 13] Any Reflection, Move & Cast Validation (Ring 0 Adapted)\n\n");

    // 匿名辅助函数：验证基础反射与生命周期转移
    auto processAnyData = [](Any argData, const char* expectedClassName) {
        bool isPass = true;

        Any localData = (Any&&)argData; // 模拟 std::move，触发右值构造
        auto meta = Reflec(localData);

        const char* className = meta.GetClassName();
        if (!className || strcmp(className, expectedClassName) != 0) {
            DbgPrint("[ERROR] Class name mismatch. Expected: %s, Got: %s\n", expectedClassName, className ? className : "NULL");
            isPass = false;
        }

        DbgPrint("  -> Detected Class : %s\n", className ? className : "UNKNOWN");

        // 物理坐标绝对穿透与 SFINAE 动态调用
        if (strcmp(className, "Vector2D") == 0) {
            meta.SetValue("X", 99.0f);
            if (meta.GetValue<float>("X") != 99.0f) isPass = false;

            meta.Invoke("Scale", 2.0f);
            if (meta.GetValue<float>("X") != 198.0f) isPass = false;
        }
        else if (strcmp(className, "PlayerStats") == 0) {
            meta.SetValue("Health", 100);
            int result = meta.Invoke<int>("Heal", 50);
            if (result != 150 || meta.GetValue<int>("Health") != 150) isPass = false;
        }

        if (isPass) {
            DbgPrint("[PASS] %s reflection pipeline verified.\n\n", expectedClassName);
        }
        else {
            DbgPrint("[FAIL] %s reflection pipeline encountered errors.\n\n", expectedClassName);
        }
        };

    // 测试 A & B: 基础物理数据结构
    auto vec = New<Vector2D>();
    vec->X = 1.0f; vec->Y = 2.0f;
    processAnyData(vec, "Vector2D");

    auto player = New<PlayerStats>();
    player->Health = 50; player->Mana = 100;
    processAnyData(player, "PlayerStats");

    // 测试 C: HelixUI 控件系统 - Any 多态强转解包测试
    DbgPrint(" --- Testing Polymorphic Control Cast ---\n");
    auto btn = New<ButtonControl>();
    Any self = btn;

    ControlBase* basePtr = (ControlBase*)self;
    if (basePtr) {
        DbgPrint("  -> VTable Dispatch : %s\n", basePtr->GetControlType());

        if (strcmp(basePtr->GetControlType(), "ButtonControl") == 0) {
            auto modelMeta = Reflec(self);
            bool invokeRes = modelMeta.Invoke<bool>("OnClick", (ControlBase*)self, 42);

            if (invokeRes && modelMeta.GetValue<int>("clickCount") == 42) {
                DbgPrint("[PASS] Any pointer cast & vtable dispatch perfectly verified.\n\n");
            }
            else {
                DbgPrint("[FAIL] Polymorphic invoke execution failed.\n\n");
            }
        }
        else {
            DbgPrint("[FAIL] VTable corrupted after Any cast.\n\n");
        }
    }
    else {
        DbgPrint("[FAIL] (ControlBase*)self cast returned nullptr.\n\n");
    }

    // 线程局部栈压入与提取测试
    auto panel = New<PanelControl>();
    panel->controlId = 9527;
    Any originalAny = panel;

    if (ControlStackCount < MAX_CONTROL_STACK) {
        ControlStack[ControlStackCount++] = originalAny;
    }

    Any foundAny = FindControlById(9527);

    if (foundAny != nullptr) {
        auto meta = Reflec(foundAny);
        DbgPrint("  -> Re-Boxed Detected Class : %s\n", meta.GetClassName());

        bool invokeRes = meta.Invoke<bool>("OnMessage", (ControlBase*)foundAny, "HelixUI Event Dispatched");

        if (invokeRes) {
            DbgPrint("[PASS] Control matched, returned, and invoked successfully.\n\n");
        }
        else {
            DbgPrint("[FAIL] Invoke execution returned false.\n\n");
        }
    }
    else {
        DbgPrint("[FAIL] Failed to find the control in the stack.\n\n");
    }

    ControlStackCount = 0; // 清理现场

    // 探针测试：强类型匹配机制
    auto state = New<ArgProbeState>();
    Any model = state;
    auto meta = Reflec(model);

    ControlBase* dummySender = (ControlBase*)(intptr_t)0xDEADBEEF;
    const char* propName = "Visible";
    int propId = 42;

    DbgPrint("--- Test A: Invoke(\"MethodA\", ControlBase*, const char*) ---\n");
    bool resA = meta.Invoke<bool>("MethodA", dummySender, propName);
    DbgPrint("Result: %s\n\n", resA ? "MATCHED" : "FAILED (Silent Mismatch)");

    DbgPrint("--- Test B: Invoke(\"MethodB\", ControlBase*, int) ---\n");
    bool resB = meta.Invoke<bool>("MethodB", dummySender, propId);
    DbgPrint("Result: %s\n\n", resB ? "MATCHED" : "FAILED (Silent Mismatch)");

    DbgPrint("--- Test C: Invoke(\"MethodC\", void*, const char*) ---\n");
    bool resC = meta.Invoke<bool>("MethodC", (void*)dummySender, propName);
    DbgPrint("Result: %s\n\n", resC ? "MATCHED" : "FAILED (Silent Mismatch)");

    DbgPrint("--- Test D: Invoke(\"MethodD\", const char*) ---\n");
    bool resD = meta.Invoke<bool>("MethodD", propName);
    DbgPrint("Result: %s\n\n", resD ? "MATCHED" : "FAILED (Silent Mismatch)");

    // 目标接收端测试：纯虚基类与降维容错
    auto target = New<ReflecProbeTarget>();
    Any anyTarget = target;
    auto targetMeta = Reflec(anyTarget);

    StandardVirtualBase stdBase;
    PureVirtualDerived pureDerived;

    StandardVirtualBase* ptrStd = &stdBase;
    PureVirtualBase* ptrPure = &pureDerived;
    void* ptrVoid = &stdBase;

    const char* testMsg = "Probe_Signal";

    DbgPrint("--- Probe 1: Passing StandardVirtualBase* ---\n");
    bool res1 = targetMeta.Invoke<bool>("HandleStandard", ptrStd, testMsg);
    DbgPrint("Result: %s\n\n", res1 ? "MATCHED (Success)" : "FAILED (Silent Mismatch)");

    DbgPrint("--- Probe 2: Passing PureVirtualBase* (Abstract Class) ---\n");
    bool res2 = targetMeta.Invoke<bool>("HandlePure", ptrPure, testMsg);
    DbgPrint("Result: %s\n\n", res2 ? "MATCHED (Success)" : "FAILED (Silent Mismatch)");

    DbgPrint("--- Probe 3: Passing void* (Type Erasure) ---\n");
    bool res3 = targetMeta.Invoke<bool>("HandleVoid", ptrVoid, testMsg);
    DbgPrint("Result: %s\n\n", res3 ? "MATCHED (Success)" : "FAILED (Silent Mismatch)");
}

void DriverUnload(PDRIVER_OBJECT DriverObject) {
    DbgPrint("========================================\n");
    DbgPrint("  HELIX KERNEL-MODE ENGINE UNLOADED! \n");
    DbgPrint("========================================\n");
}

int main(void** args) {
    DbgPrint("========================================\n");
    DbgPrint("  HELIX KERNEL-MODE ENGINE IGNITED! \n");
    DbgPrint("========================================\n\n");

    if (args && args[0]) {
        DbgPrint("[System] Driver Path : %s\n\n", (const char*)args[0]);
    }

    if (args && args[1]) {
        PDRIVER_OBJECT DriverObject = (PDRIVER_OBJECT)args[1];
        DriverObject->DriverUnload = DriverUnload;
    }
    TestSerializationAndReflection();
    TestGCAndPersistence();
    TestWinApiAndExtern();
    TestPolymorphism();
    TestVmpAnnotations();
    TestAdvancedVmp();
    TestLoopMemoryLeak();

    TestHelixSystemKeywords();
    TestKeywordMemoryLeak();
    TestDynamicApi();
    TestCrossRingSDKReflection();
    TestAnyDynamicReflection();
    AnyReflection();

    DbgPrint("Releasing ComplexEntity %d reclaimed.\n", g_p->entityId);
    DbgPrint("[System] Helix Driver logic completed. Returning to OS.\n");
    return 0;
}